starred/orca
1
0
Fork 0
mirror of https://github.com/stablyai/orca.git synced 2026-09-22 08:02:28 +00:00
Code Issues Packages Projects Releases Wiki Activity
Files
e4d95e032ddf13ff73be0813ef43ca2d136dbb03
orca/config/reliability-gates.jsonc
T

16245 lines
1.3 MiB
Plaintext
Raw Blame History

This file contains ambiguous Unicode characters
This file contains Unicode characters that might be confused with other characters. If you think that this is intentional, you can safely ignore this warning. Use the Escape button to reveal them.
{
"schemaVersion": 1,
"updatedAt": "2026-08-23",
"policy": {
"maturityLevels": ["experimental", "soak", "blocking", "accepted-gap", "deprecated"],
"blockingPromotion": {
"minimumSoakRuns": 100,
"minimumSoakDays": 14,
"maximumUnexplainedFlakes": 0
}
},
"gates": [
{
"id": "cmd-j-tabs.host-qualified-candidate-ownership",
"title": "Cmd-J tab candidates retain execution-host ownership",
"maturity": "experimental",
"protection": "partial",
"owner": "renderer-workspace-tabs",
"layer": "renderer-state-and-navigation",
"surfaces": [
"Cmd-J browser tabs",
"Cmd-J simulator tabs",
"Cmd-J workspace tabs",
"paired-runtime tab mirror"
],
"platforms": ["macos", "linux", "windows"],
"providers": ["local", "ssh", "remote-runtime"],
"coveredPlatforms": ["macos"],
"coveredProviders": ["local", "ssh", "remote-runtime"],
"coverageNotes": "Deterministic candidate-builder contracts inject local and paired-runtime worktrees with the same bare id into the real aggregated tab buckets, including folder workspaces and a paired runtime transporting an SSH-owned worktree. A mirror contract preserves distinct same-id runtime tabs. Manual local-emulator contracts retain local ownership and dedupe explicitly owned tabs before worktree hydration. A paired Electron journey verifies both visible browser rows and both visible simulator rows, then requires each selection to render its owning active tab and update backing host-qualified state.",
"motivatingLinks": [
"https://linear.app/stably/issue/STA-4965",
"https://github.com/stablyai/orca/pull/15371"
],
"invariant": "Candidate identity is the tuple of execution-host identity and worktree identity: same-id sibling hosts retain separate correct browser, simulator, and workspace tabs, each tab appears exactly once, and selection activates its owning host.",
"oracle": "Aggregate two hosts' tabs under one intentionally colliding worktree id, stamp each unified tab with its execution host, and require exactly one candidate per owner. Repeat with an SSH physical owner transported by a paired-runtime alias. Independently require each browser and simulator Cmd-J selection to update activeWorkspaceExecutionHostId plus its owning workspace/group and render the selected tab active. Ambiguous legacy tabs without ownership fail closed.",
"commands": [
"pnpm exec vitest run --config config/vitest.config.ts src/renderer/src/components/cmd-j/worktree-checks-review-index.test.ts",
"pnpm exec vitest run --config config/vitest.config.ts src/renderer/src/components/WorktreeJumpPalette.test.tsx",
"pnpm exec vitest run --config config/vitest.config.ts src/renderer/src/lib/palette-repo-resolution.test.ts",
"pnpm exec vitest run --config config/vitest.config.ts src/renderer/src/lib/ensure-simulator-tab-behavior.test.ts src/renderer/src/lib/palette-repo-resolution.test.ts",
"pnpm exec vitest run --config config/vitest.config.ts src/renderer/src/lib/browser-palette-page-entries.test.ts src/renderer/src/lib/simulator-palette-search.test.ts",
"pnpm exec vitest run --config config/vitest.config.ts src/renderer/src/lib/cmd-j-host-qualified-candidate-ownership.test.ts src/renderer/src/store/slices/tabs-open-close-lifecycle.test.ts",
"pnpm exec vitest run --config config/vitest.config.ts src/renderer/src/lib/browser-palette-page-entries.test.ts src/renderer/src/lib/simulator-palette-search.test.ts src/renderer/src/lib/ensure-simulator-tab-behavior.test.ts src/renderer/src/store/slices/tabs-open-close-lifecycle.test.ts src/renderer/src/store/slices/tabs-pane-layout-operations.test.ts src/shared/workspace-session-schema.test.ts",
"pnpm exec vitest run --config config/vitest.config.ts src/renderer/src/lib/cmd-j-host-qualified-candidate-ownership.test.ts src/renderer/src/lib/palette-repo-resolution.test.ts src/renderer/src/lib/browser-palette-page-entries.test.ts src/renderer/src/lib/browser-palette-search.test.ts src/renderer/src/lib/simulator-palette-search.test.ts src/renderer/src/lib/workspace-tab-palette-search.test.ts src/renderer/src/lib/browser-page-palette-activation.test.ts src/renderer/src/lib/simulator-tab-palette-activation.test.ts src/renderer/src/lib/ensure-simulator-tab-behavior.test.ts src/renderer/src/runtime/web-session-tabs-sync-mirror-identity.test.ts src/renderer/src/store/slices/tabs-open-close-lifecycle.test.ts src/renderer/src/store/slices/tabs-pane-layout-operations.test.ts src/shared/workspace-session-schema.test.ts",
"pnpm exec vitest run --config config/vitest.config.ts src/renderer/src/components/cmd-j/worktree-checks-review-index.test.ts src/renderer/src/components/WorktreeJumpPalette.test.tsx src/renderer/src/components/tab-bar/use-open-tab-search.test.ts src/renderer/src/lib/cmd-j-host-qualified-candidate-ownership.test.ts src/renderer/src/lib/palette-repo-resolution.test.ts src/renderer/src/lib/browser-palette-page-entries.test.ts src/renderer/src/lib/browser-palette-search.test.ts src/renderer/src/lib/simulator-palette-search.test.ts src/renderer/src/lib/workspace-tab-palette-search.test.ts src/renderer/src/lib/browser-page-palette-activation.test.ts src/renderer/src/lib/simulator-tab-palette-activation.test.ts src/renderer/src/lib/ensure-simulator-tab-behavior.test.ts src/renderer/src/runtime/web-session-tabs-sync-mirror-identity.test.ts src/renderer/src/store/slices/tabs-open-close-lifecycle.test.ts src/renderer/src/store/slices/tabs-pane-layout-operations.test.ts src/shared/workspace-session-schema.test.ts",
"pnpm exec vitest run --config config/vitest.config.ts src/renderer/src/components/cmd-j/worktree-checks-review-index.test.ts src/renderer/src/components/WorktreeJumpPalette.test.tsx src/renderer/src/components/tab-bar/use-open-tab-search.test.ts src/renderer/src/lib/cmd-j-host-qualified-candidate-ownership.test.ts src/renderer/src/lib/palette-repo-resolution.test.ts src/renderer/src/lib/browser-palette-page-entries.test.ts src/renderer/src/lib/browser-palette-search.test.ts src/renderer/src/lib/simulator-palette-search.test.ts src/renderer/src/lib/workspace-tab-palette-search.test.ts src/renderer/src/lib/browser-page-palette-activation.test.ts src/renderer/src/lib/simulator-tab-palette-activation.test.ts src/renderer/src/lib/ensure-simulator-tab-behavior.test.ts src/renderer/src/lib/open-mobile-emulator-tab.test.ts src/renderer/src/runtime/web-session-tabs-sync-mirror-identity.test.ts src/renderer/src/store/slices/tabs-open-close-lifecycle.test.ts src/renderer/src/store/slices/tabs-pane-layout-operations.test.ts src/shared/workspace-session-schema.test.ts",
"pnpm exec playwright test tests/e2e/paired-cmd-j-host-qualified-tabs.spec.ts --config tests/playwright.config.ts --project electron-headless --workers=1",
"SKIP_BUILD=1 pnpm exec playwright test tests/e2e/paired-cmd-j-host-qualified-tabs.spec.ts --config tests/playwright.config.ts --project electron-headless --workers=1"
],
"testFiles": [
"src/renderer/src/components/cmd-j/worktree-checks-review-index.test.ts",
"src/renderer/src/components/WorktreeJumpPalette.test.tsx",
"src/renderer/src/components/tab-bar/use-open-tab-search.test.ts",
"src/renderer/src/lib/cmd-j-host-qualified-candidate-ownership.test.ts",
"src/renderer/src/lib/palette-repo-resolution.test.ts",
"src/renderer/src/lib/browser-palette-page-entries.test.ts",
"src/renderer/src/lib/browser-palette-search.test.ts",
"src/renderer/src/lib/simulator-palette-search.test.ts",
"src/renderer/src/lib/workspace-tab-palette-search.test.ts",
"src/renderer/src/lib/browser-page-palette-activation.test.ts",
"src/renderer/src/lib/simulator-tab-palette-activation.test.ts",
"src/renderer/src/lib/ensure-simulator-tab-behavior.test.ts",
"src/renderer/src/lib/open-mobile-emulator-tab.test.ts",
"src/renderer/src/runtime/web-session-tabs-sync-mirror-identity.test.ts",
"src/renderer/src/store/slices/tabs-open-close-lifecycle.test.ts",
"src/renderer/src/store/slices/tabs-pane-layout-operations.test.ts",
"src/shared/workspace-session-schema.test.ts",
"tests/e2e/paired-cmd-j-host-qualified-tabs.spec.ts"
],
"assertionRefs": [
{
"file": "src/renderer/src/components/cmd-j/worktree-checks-review-index.test.ts",
"assertions": [
"a runtime-owned SSH worktree never exposes review metadata cached for its physical host"
]
},
{
"file": "src/renderer/src/components/WorktreeJumpPalette.test.tsx",
"assertions": [
"a runtime-owned worktree row never renders repository metadata borrowed from its physical SSH host"
]
},
{
"file": "src/renderer/src/lib/cmd-j-host-qualified-candidate-ownership.test.ts",
"assertions": [
"browser, simulator, and workspace candidates recognize a paired-runtime alias for an SSH-owned worktree",
"paired-runtime aliases retain current-row state and unverifiable explicit legacy owners fail closed",
"host filtering and scoped open-tab search cannot hide a same-id sibling from the legacy ownership ambiguity set"
]
},
{
"file": "src/renderer/src/store/slices/tabs-open-close-lifecycle.test.ts",
"assertions": [
"active local tab creation stamps local ownership instead of leaving a same-id row ambiguous"
]
},
{
"file": "src/renderer/src/lib/palette-repo-resolution.test.ts",
"assertions": [
"paired SSH rows resolve display metadata through their runtime owner alias",
"paired SSH worktrees resolve their runtime-owned repository metadata",
"an unavailable explicit runtime owner never borrows physical-host or bare repository metadata",
"an explicit unknown owner never borrows another host's metadata"
]
},
{
"file": "src/renderer/src/lib/ensure-simulator-tab-behavior.test.ts",
"assertions": [
"same-id folder simulator reuse selects the active owning host",
"inactive local simulator creation remains host-stamped amid a collision",
"an explicitly owned simulator is reused before its matching worktree row hydrates"
]
},
{
"file": "src/renderer/src/lib/open-mobile-emulator-tab.test.ts",
"assertions": ["manual emulator launch lookup and creation stay on the local provider"]
},
{
"file": "src/renderer/src/lib/browser-palette-page-entries.test.ts",
"assertions": [
"same-id local and remote browser tabs appear once under their owning hosts"
]
},
{
"file": "src/renderer/src/lib/simulator-palette-search.test.ts",
"assertions": [
"same-id local and remote simulator tabs appear once under their owning hosts"
]
},
{
"file": "tests/e2e/paired-cmd-j-host-qualified-tabs.spec.ts",
"assertions": [
"both browser selections activate and render their owning host and workspace",
"both simulator selections activate and render their owning host and group"
]
}
],
"evidenceRuns": [
{
"date": "2026-08-20",
"runner": "local",
"platform": "macos",
"command": "pnpm exec vitest run --config config/vitest.config.ts src/renderer/src/lib/cmd-j-host-qualified-candidate-ownership.test.ts src/renderer/src/store/slices/tabs-open-close-lifecycle.test.ts",
"result": "failed",
"durationSeconds": 1.8,
"summary": "The first review-round oracle failed 4/40: browser and simulator dropped the SSH worktree's paired-runtime-owned tab, generic workspace rows attributed the remote tab to local, and active local tab creation left ownership unstamped."
},
{
"date": "2026-08-20",
"runner": "local",
"platform": "macos",
"command": "pnpm exec vitest run --config config/vitest.config.ts src/renderer/src/lib/browser-palette-page-entries.test.ts src/renderer/src/lib/simulator-palette-search.test.ts",
"result": "failed",
"durationSeconds": 0.5,
"summary": "The byte-identical oracle on affected baseline 012e9f410c failed 4 tests and passed 24: each same-id browser and simulator tab was routed through both hosts, and ambiguous unstamped rows were duplicated instead of failing closed."
},
{
"date": "2026-08-20",
"runner": "local",
"platform": "macos",
"command": "pnpm exec vitest run --config config/vitest.config.ts src/renderer/src/lib/browser-palette-page-entries.test.ts src/renderer/src/lib/simulator-palette-search.test.ts src/renderer/src/lib/ensure-simulator-tab-behavior.test.ts src/renderer/src/store/slices/tabs-open-close-lifecycle.test.ts src/renderer/src/store/slices/tabs-pane-layout-operations.test.ts src/shared/workspace-session-schema.test.ts",
"result": "passed",
"durationSeconds": 2.3,
"summary": "6 test files passed, 104 tests passed on the STA-4965 candidate."
},
{
"date": "2026-08-20",
"runner": "local",
"platform": "macos",
"command": "SKIP_BUILD=1 pnpm exec playwright test tests/e2e/paired-cmd-j-host-qualified-tabs.spec.ts --config tests/playwright.config.ts --project electron-headless --workers=1",
"result": "passed",
"durationSeconds": 12.7,
"summary": "The paired Electron journey passed real host browser publication, same-id collision injection, separate browser/simulator Cmd-J rows, and selected-host backing-state assertions."
},
{
"date": "2026-08-20",
"runner": "local",
"platform": "macos",
"command": "pnpm exec playwright test tests/e2e/paired-cmd-j-host-qualified-tabs.spec.ts --config tests/playwright.config.ts --project electron-headless --workers=1",
"result": "passed",
"durationSeconds": 24.1,
"summary": "A fresh electron-vite --mode e2e build passed the paired journey: the visible Cmd-J list retained one owning browser/simulator row and each selection changed the execution host plus its owning workspace or group."
},
{
"date": "2026-08-20",
"runner": "local",
"platform": "macos",
"command": "pnpm exec vitest run --config config/vitest.config.ts src/renderer/src/lib/browser-palette-page-entries.test.ts src/renderer/src/lib/simulator-palette-search.test.ts",
"result": "failed",
"durationSeconds": 0.5,
"summary": "The same oracle on fe45b73c20 with only browser-palette-page-entries.ts and simulator-palette-search.ts restored from origin/main failed the same 4 tests and passed 24; restored candidate files passed all 28."
},
{
"date": "2026-08-20",
"runner": "local",
"platform": "macos",
"command": "pnpm exec vitest run --config config/vitest.config.ts src/renderer/src/lib/cmd-j-host-qualified-candidate-ownership.test.ts src/renderer/src/lib/palette-repo-resolution.test.ts src/renderer/src/lib/browser-palette-page-entries.test.ts src/renderer/src/lib/browser-palette-search.test.ts src/renderer/src/lib/simulator-palette-search.test.ts src/renderer/src/lib/workspace-tab-palette-search.test.ts src/renderer/src/lib/browser-page-palette-activation.test.ts src/renderer/src/lib/simulator-tab-palette-activation.test.ts src/renderer/src/lib/ensure-simulator-tab-behavior.test.ts src/renderer/src/runtime/web-session-tabs-sync-mirror-identity.test.ts src/renderer/src/store/slices/tabs-open-close-lifecycle.test.ts src/renderer/src/store/slices/tabs-pane-layout-operations.test.ts src/shared/workspace-session-schema.test.ts",
"result": "passed",
"durationSeconds": 10.5,
"summary": "The review-hardened candidate passed 189/189 focused contracts, including direct browser-result host fallback, SSH plus paired-runtime current-row aliases, explicit-owner fail-closed behavior, generic workspace rows, simulator reuse, local creation stamping, activation, and same-id distinct-runtime mirror preservation."
},
{
"date": "2026-08-20",
"runner": "local",
"platform": "macos",
"command": "pnpm exec vitest run --config config/vitest.config.ts src/renderer/src/lib/ensure-simulator-tab-behavior.test.ts src/renderer/src/lib/palette-repo-resolution.test.ts",
"result": "failed",
"durationSeconds": 0.8,
"summary": "The final-review oracle failed 4/16 before the follow-up: same-id folder simulator reuse selected no owning tab, inactive local simulator creation was unstamped, the paired SSH/runtime alias resolved local metadata, and an explicit unknown owner fell back locally."
},
{
"date": "2026-08-21",
"runner": "local",
"platform": "macos",
"command": "pnpm exec vitest run --config config/vitest.config.ts src/renderer/src/components/cmd-j/worktree-checks-review-index.test.ts src/renderer/src/components/WorktreeJumpPalette.test.tsx src/renderer/src/components/tab-bar/use-open-tab-search.test.ts src/renderer/src/lib/cmd-j-host-qualified-candidate-ownership.test.ts src/renderer/src/lib/palette-repo-resolution.test.ts src/renderer/src/lib/browser-palette-page-entries.test.ts src/renderer/src/lib/browser-palette-search.test.ts src/renderer/src/lib/simulator-palette-search.test.ts src/renderer/src/lib/workspace-tab-palette-search.test.ts src/renderer/src/lib/browser-page-palette-activation.test.ts src/renderer/src/lib/simulator-tab-palette-activation.test.ts src/renderer/src/lib/ensure-simulator-tab-behavior.test.ts src/renderer/src/runtime/web-session-tabs-sync-mirror-identity.test.ts src/renderer/src/store/slices/tabs-open-close-lifecycle.test.ts src/renderer/src/store/slices/tabs-pane-layout-operations.test.ts src/shared/workspace-session-schema.test.ts",
"result": "passed",
"durationSeconds": 24.3,
"summary": "The OpenCode-review-hardened candidate passed 225/225 focused contracts, including unfiltered ownership ambiguity under host filters and scoped open-tab search, review-cache ownership, rendered palette repo metadata, folder workspaces, inactive local simulator creation, paired SSH/runtime display metadata, and explicit-owner fail-closed resolution."
},
{
"date": "2026-08-20",
"runner": "local",
"platform": "macos",
"command": "pnpm exec vitest run --config config/vitest.config.ts src/renderer/src/lib/palette-repo-resolution.test.ts",
"result": "failed",
"durationSeconds": 0.1,
"summary": "The final reviewer repo-label oracle failed 1/6 before the follow-up: a paired SSH worktree resolved the local bare-id repository instead of its runtime-owned repository."
},
{
"date": "2026-08-20",
"runner": "local",
"platform": "macos",
"command": "pnpm exec vitest run --config config/vitest.config.ts src/renderer/src/lib/palette-repo-resolution.test.ts",
"result": "failed",
"durationSeconds": 0.1,
"summary": "The final clean-round fail-closed oracle failed 1/7 before the follow-up: an unavailable explicit runtime owner borrowed physical SSH repository metadata."
},
{
"date": "2026-08-20",
"runner": "local",
"platform": "macos",
"command": "pnpm exec vitest run --config config/vitest.config.ts src/renderer/src/components/WorktreeJumpPalette.test.tsx",
"result": "failed",
"durationSeconds": 5.1,
"summary": "With the component's physical-host prelookup restored, the rendered palette oracle failed 1/12: the runtime-owned row displayed the physical SSH repository badge."
},
{
"date": "2026-08-20",
"runner": "local",
"platform": "macos",
"command": "pnpm exec vitest run --config config/vitest.config.ts src/renderer/src/components/cmd-j/worktree-checks-review-index.test.ts",
"result": "failed",
"durationSeconds": 0.2,
"summary": "The final review-cache oracle failed 1/6: a runtime-owned SSH worktree exposed the physical host's cached pull request."
},
{
"date": "2026-08-20",
"runner": "local",
"platform": "macos",
"command": "pnpm exec vitest run --config config/vitest.config.ts src/renderer/src/components/cmd-j/worktree-checks-review-index.test.ts",
"result": "failed",
"durationSeconds": 0.4,
"summary": "The exact-head clean-round oracle failed 1/6: after the host-qualified index rejected a physical SSH review, the palette document still surfaced its unqualified legacy cache entry for the runtime-owned worktree."
},
{
"date": "2026-08-20",
"runner": "local",
"platform": "macos",
"command": "pnpm exec playwright test tests/e2e/paired-cmd-j-host-qualified-tabs.spec.ts --config tests/playwright.config.ts --project electron-headless --workers=1",
"result": "passed",
"durationSeconds": 36.7,
"summary": "A fresh e2e-mode Electron build passed the paired journey: each remote/local browser and simulator candidate appeared exactly once, selected the owning host plus workspace or group tab, and rendered that tab active. The group active-tab oracle remains stable while asynchronous paired session mirroring updates the legacy bare-worktree activeTabType field."
},
{
"date": "2026-08-21",
"runner": "local",
"platform": "macos",
"command": "SKIP_BUILD=1 pnpm exec playwright test tests/e2e/paired-cmd-j-host-qualified-tabs.spec.ts --config tests/playwright.config.ts --project electron-headless --workers=1",
"result": "passed",
"durationSeconds": 20.6,
"summary": "After a fresh build exposed an unrelated mirrored terminal entering the broad backing-state diagnostic, the exact built candidate passed with that oracle scoped to the four seeded browser/simulator tabs; rendered active-tab and backing execution-host assertions remained green."
}
],
"runtimeBudget": {
"p95Seconds": 180,
"scope": "focused deterministic contracts plus one paired Electron journey"
},
"flakeHistory": {
"status": "not-started",
"evidence": "The candidate contract has no timers. Initial Electron attempts exposed seeded-worktree discovery and programmatic keyboard-selection harness races before the ownership assertions; soak history is not yet available."
},
"redGreenEvidence": {
"status": "complete",
"evidence": "Byte-identical browser and simulator candidate tests failed 4/28 on affected baseline 012e9f410c, passed 28/28 on candidate fe45b73c20, failed the same 4/28 when only the two candidate filters were disabled, and returned to 28/28 after restoration. Review-round topology contracts failed 4/40 before the alias/generic/local-stamping follow-up; final-review contracts then failed 4/16 before folder/background/worktree-metadata hardening, 1/6 before paired repository-metadata hardening, 1/7 before unavailable-runtime fail-closed hardening, 1/12 with the component's physical-host bypass restored, 1/6 before review-cache ownership used the same resolver, 1/6 before the downstream document rejected a remote owner's unqualified legacy cache entry, and 1/6 when a host filter or scoped open-tab search hid the same-id sibling from legacy ambiguity detection. Manual local-provider ownership failed 1/12 before explicit host routing, and pre-hydration dedupe failed 1/13 before exact stamped-owner reuse; the combined contracts then passed 25/25 and the six-file review suite passed 73/73. The prior completed focused suite passed 225/225."
},
"performanceBudget": {
"required": true,
"evidence": "Candidate construction adds bounded in-memory ownership filtering over the already-read worktree tab bucket and introduces no polling or network work."
},
"promotionCriteria": [
"Collect paired Electron CI soak history without unexplained flakes.",
"Add a live paired-runtime-over-SSH journey when the E2E harness can provision that combined topology."
],
"knownGaps": [
"Live Linux, Windows, and paired-runtime-over-SSH journeys are not collected; the SSH/runtime dual-owner topology is deterministic renderer coverage.",
"The paired Electron simulator path seeds renderer state because remote web clients cannot launch a native emulator.",
"The paired Electron journey proves a real host mirror stamp before injecting the same-id sibling state; it does not create the collision through the wire.",
"Mixed-version behavior is covered by optional-field parsing and fail-closed legacy ambiguity, not a live old-client/new-host matrix."
],
"demotionRule": "Cannot promote if a same-id sibling tab duplicates, disappears, activates another host, or if ambiguous unstamped ownership is guessed."
},
{
"id": "ephemeral-vm-runtime.rollback-readable-sidecar",
"title": "VM lifecycle stays rollback-readable and cleanup-retryable",
"maturity": "experimental",
"protection": "partial",
"owner": "ephemeral-vm-runtime-store",
"layer": "desktop-main-persistence",
"surfaces": [
"VM runtime sidecar",
"recipe lifecycle",
"cleanup retry",
"provisioned-root direct SSH"
],
"platforms": ["macos", "linux", "windows"],
"providers": ["orca-server", "direct-ssh"],
"coveredPlatforms": ["macos", "linux", "windows"],
"coveredProviders": ["orca-server", "direct-ssh"],
"coverageNotes": "A pinned exact-source harness runs the pre-#14352 reader and lifecycle service against baseline, affected-main, candidate, and fix-reverted stores. Platform-neutral tests cover store compatibility, user-cancellable cleanup, branch/ref adoption, and resume ownership integrity. The direct-SSH provisioned-root Electron journey remains the live transport and destroy proof; this desktop sidecar is not mobile-facing and changes no RPC or remote wire payload.",
"motivatingLinks": [
"https://linear.app/stably/issue/STA-4274",
"https://github.com/stablyai/orca/pull/14352",
"https://github.com/stablyai/orca/issues/13044"
],
"invariant": "A sidecar written by the new build cannot make the previous production build lose otherwise compatible VM runtimes. Downgrade lifecycle writes remain authoritative after re-upgrade, provisioned-root metadata remains recoverable, and corrupt or future feature metadata is preserved without poisoning the rollback-readable v1 store. Destroy attempts have no automatic wall-clock cutoff; a user stop terminates the process tree, retains cleanup ownership, and permits a fresh retry. Provider failure retains the SSH/project context needed for safe cleanup. Unrecoverable recipe context releases only the hidden SSH registration while preserving lifecycle/provider metadata. Provisioned-root create receives the source ref's pinned commit, adoption verifies the requested branch/ref, and resume preserves the connection mode plus stable SSH ownership identity while allowing endpoint rotation.",
"oracle": "Write one ordinary schema-v1 runtime and one provisioned-root runtime. Require the exact pre-#14352 reader to return both, run the old destroy lifecycle against the projected provisioned record, then require the candidate to retain the cleaned state while restoring schema-v2 and checkout-mode metadata. The same old reader must reject affected-main and fix-reverted bytes. Malformed, oversized, unknown-record, and future-version feature sidecars must leave rollback-compatible records accessible and must not be overwritten during compatible lifecycle mutations. Require destroy to have no implicit deadline, stop a hung destroy through the public desktop action, require cleanup_failed plus a fresh successful retry, prove provider or project-host rollback failure retains every ownership record required to retry, and prove missing recipe context cannot leave an unremovable hidden SSH registration. Supply the source ref's captured commit to create, reject a provisioned checkout on the wrong branch/ref, and reject a resume that changes connection mode or SSH ownership.",
"commands": [
"node config/scripts/run-ephemeral-vm-runtime-store-rollback-repro.mjs config/scripts/ephemeral-vm-runtime-store-cross-version.test.ts",
"pnpm exec vitest run --config config/vitest.config.ts src/shared/ephemeral-vm-runtime-store.test.ts src/shared/ephemeral-vm-runtime-store-rollback.test.ts src/shared/ephemeral-vm-recipe-process.test.ts src/main/ephemeral-vm-runtime-service.test.ts src/main/ephemeral-vm-resume-integrity.test.ts src/main/ephemeral-vm-recipe-runner.test.ts src/main/ephemeral-vm-runtime-ssh-cleanup.test.ts src/main/ipc/ephemeral-vm-runtime-handler-cleanup.test.ts src/main/ipc/ephemeral-vm-provision-cancel.test.ts src/main/ipc/ephemeral-vm-provisioned-root-ref.test.ts src/main/ipc/ephemeral-vm.test.ts src/main/provisioned-root-ssh-adoption.test.ts src/renderer/src/components/settings/EphemeralVmRuntimesSection.test.tsx src/renderer/src/lib/ephemeral-vm-failed-create-cleanup.test.ts src/renderer/src/lib/ephemeral-vm-runtime-cleanup.test.ts src/renderer/src/lib/ephemeral-vm-workspace-target.test.ts src/renderer/src/lib/ephemeral-vm-worktree-creation.test.ts src/renderer/src/lib/provisioned-root-create-options.test.ts src/renderer/src/store/slices/repos-ephemeral-vm-cleanup-retention.test.ts",
"ORCA_E2E_SSH_DOCKER=1 pnpm exec playwright test tests/e2e/ephemeral-vm-provisioned-root.spec.ts --config tests/playwright.config.ts --project electron-headless --workers=1",
"SKIP_BUILD=1 ORCA_E2E_SSH_DOCKER=1 pnpm exec playwright test tests/e2e/ephemeral-vm-provisioned-root.spec.ts --config tests/playwright.config.ts --project electron-headless --workers=1",
"pnpm exec playwright test tests/e2e/ephemeral-vm-cleanup-retry.spec.ts --config tests/playwright.config.ts --project electron-headless --workers=1"
],
"testFiles": [
"config/scripts/ephemeral-vm-runtime-store-cross-version.test.ts",
"config/scripts/run-ephemeral-vm-runtime-store-rollback-repro.mjs",
"src/shared/ephemeral-vm-runtime-store-rollback.test.ts",
"src/shared/ephemeral-vm-runtime-store.test.ts",
"src/shared/ephemeral-vm-recipe-process.test.ts",
"src/main/ephemeral-vm-runtime-service.test.ts",
"src/main/ephemeral-vm-recipe-runner.test.ts",
"src/main/ephemeral-vm-runtime-ssh-cleanup.test.ts",
"src/main/ephemeral-vm-resume-integrity.test.ts",
"src/main/ipc/ephemeral-vm-runtime-handler-cleanup.test.ts",
"src/main/ipc/ephemeral-vm-provision-cancel.test.ts",
"src/main/ipc/ephemeral-vm-provisioned-root-ref.test.ts",
"src/main/ipc/ephemeral-vm.test.ts",
"src/main/provisioned-root-ssh-adoption.test.ts",
"src/renderer/src/components/settings/EphemeralVmRuntimesSection.test.tsx",
"src/renderer/src/lib/ephemeral-vm-failed-create-cleanup.test.ts",
"src/renderer/src/lib/ephemeral-vm-runtime-cleanup.test.ts",
"src/renderer/src/lib/ephemeral-vm-workspace-target.test.ts",
"src/renderer/src/lib/ephemeral-vm-worktree-creation.test.ts",
"src/renderer/src/lib/provisioned-root-create-options.test.ts",
"src/renderer/src/store/slices/repos-ephemeral-vm-cleanup-retention.test.ts",
"tests/e2e/ephemeral-vm-cleanup-retry.spec.ts",
"tests/e2e/ephemeral-vm-provisioned-root.spec.ts"
],
"assertionRefs": [
{
"file": "config/scripts/ephemeral-vm-runtime-store-cross-version.test.ts",
"assertions": [
"the exact rollback reader accepts both projected records",
"the rollback lifecycle service destroys the provisioned resource using schema-v1 provider data",
"re-upgrade restores provisioned-root metadata without reverting lifecycle state"
]
},
{
"file": "src/shared/ephemeral-vm-runtime-store-rollback.test.ts",
"assertions": [
"ordinary runtime bytes remain unchanged and create no feature sidecar",
"malformed, future, oversized, and unknown feature data is preserved without poisoning v1 records",
"current-main poisoned bytes migrate to a rollback-readable projection",
"unchanged compatibility metadata is not rewritten during lifecycle updates"
]
},
{
"file": "src/main/ephemeral-vm-runtime-service.test.ts",
"assertions": [
"an unreadable companion rejects checkout-mode recipes before their create command runs",
"post-create persistence failure destroys the provider resource when possible",
"failed destroy persists a durable rollback-readable cleanup recovery record"
]
},
{
"file": "src/shared/ephemeral-vm-recipe-process.test.ts",
"assertions": [
"recipe commands have no implicit wall-clock deadline",
"a stopped process that ignores graceful termination is force-killed and settled"
]
},
{
"file": "src/renderer/src/components/settings/EphemeralVmRuntimesSection.test.tsx",
"assertions": [
"a running cleanup exposes a persistent Stop cleanup action and becomes retryable after stopping"
]
},
{
"file": "src/main/ipc/ephemeral-vm-runtime-handler-cleanup.test.ts",
"assertions": [
"unrecoverable recipe context releases the hidden SSH registration but preserves failed lifecycle state"
]
},
{
"file": "src/renderer/src/lib/ephemeral-vm-runtime-cleanup.test.ts",
"assertions": [
"provider failure retains runtime-owned SSH targets and confirmed success releases them",
"unknown runtime inventory retains an explicitly requested target"
]
},
{
"file": "src/renderer/src/lib/ephemeral-vm-failed-create-cleanup.test.ts",
"assertions": ["failed or unconfirmed project-host rollback prevents provider destroy"]
},
{
"file": "src/main/provisioned-root-ssh-adoption.test.ts",
"assertions": [
"adoption rejects a checkout on an unrequested branch or ref",
"tag and commit refs remain valid when the requested local branch is attached"
]
},
{
"file": "src/main/ipc/ephemeral-vm-provisioned-root-ref.test.ts",
"assertions": [
"selected and default source ref commits are captured before provider create",
"the create recipe receives both the symbolic ref and its pinned commit",
"multi-remote bases pair the selected remote URL with a fetchable branch ref",
"an unresolved source ref rejects before provider create"
]
},
{
"file": "src/main/ipc/ephemeral-vm-provision-cancel.test.ts",
"assertions": ["cancellation during source-ref resolution aborts before provider create"]
},
{
"file": "src/renderer/src/lib/ephemeral-vm-worktree-creation.test.ts",
"assertions": [
"the captured source commit reaches the main-owned provisioned-root adoption request"
]
},
{
"file": "src/main/ephemeral-vm-resume-integrity.test.ts",
"assertions": [
"resume allows host and port rotation",
"resume rejects connection-mode and stable SSH ownership drift"
]
},
{
"file": "tests/e2e/ephemeral-vm-cleanup-retry.spec.ts",
"assertions": [
"the rendered runtime row stops a live cleanup process without an automatic deadline and a retry succeeds"
]
},
{
"file": "tests/e2e/ephemeral-vm-provisioned-root.spec.ts",
"assertions": [
"default-base create adopts the recipe checkout at the captured source commit",
"workspace removal invokes recipe destroy and removes the provider container"
]
}
],
"evidenceRuns": [
{
"date": "2026-08-14",
"runner": "local",
"platform": "macos",
"command": "node config/scripts/run-ephemeral-vm-runtime-store-rollback-repro.mjs config/scripts/ephemeral-vm-runtime-store-cross-version.test.ts",
"result": "passed",
"durationSeconds": 11,
"summary": "The pinned baseline and affected-main oracles passed, candidate downgrade ran the exact old destroy service, candidate re-upgrade retained lifecycle state, and both affected-main and fix-reverted bytes failed the old reader as expected."
},
{
"date": "2026-08-14",
"runner": "local",
"platform": "macos",
"command": "pnpm exec vitest run --config config/vitest.config.ts src/shared/ephemeral-vm-runtime-store.test.ts src/shared/ephemeral-vm-runtime-store-rollback.test.ts src/shared/ephemeral-vm-recipe-process.test.ts src/main/ephemeral-vm-runtime-service.test.ts src/main/ephemeral-vm-resume-integrity.test.ts src/main/ephemeral-vm-recipe-runner.test.ts src/main/ephemeral-vm-runtime-ssh-cleanup.test.ts src/main/ipc/ephemeral-vm-runtime-handler-cleanup.test.ts src/main/ipc/ephemeral-vm-provision-cancel.test.ts src/main/ipc/ephemeral-vm-provisioned-root-ref.test.ts src/main/ipc/ephemeral-vm.test.ts src/main/provisioned-root-ssh-adoption.test.ts src/renderer/src/components/settings/EphemeralVmRuntimesSection.test.tsx src/renderer/src/lib/ephemeral-vm-failed-create-cleanup.test.ts src/renderer/src/lib/ephemeral-vm-runtime-cleanup.test.ts src/renderer/src/lib/ephemeral-vm-workspace-target.test.ts src/renderer/src/lib/ephemeral-vm-worktree-creation.test.ts src/renderer/src/lib/provisioned-root-create-options.test.ts src/renderer/src/store/slices/repos-ephemeral-vm-cleanup-retention.test.ts",
"result": "passed",
"durationSeconds": 3,
"summary": "One hundred twenty-two focused store, recipe-process, lifecycle, cleanup-handler, rendered stop-action, retry-context, source-ref, adoption-integrity, resume-integrity, and provisioning-recovery tests passed."
},
{
"date": "2026-08-14",
"runner": "local",
"platform": "macos",
"command": "ORCA_E2E_SSH_DOCKER=1 pnpm exec playwright test tests/e2e/ephemeral-vm-provisioned-root.spec.ts --config tests/playwright.config.ts --project electron-headless --workers=1",
"result": "passed",
"durationSeconds": 22,
"summary": "The final-tree full-build run completed the Docker Linux SSH journey: default-base create at the captured source commit, provisioned-root adoption, terminal, workspace removal, destroy, and provider-container cleanup."
}
],
"runtimeBudget": {
"p95Seconds": 180,
"scope": "pinned cross-version source oracle, focused lifecycle contracts, and one Docker SSH Electron journey"
},
"flakeHistory": {
"status": "unknown",
"evidence": "The deterministic contract runs are stable. Two local Electron attempts reached successful adoption and terminal use, then hit the existing final context-menu detach; the immediate build-reuse rerun completed removal and destroy. CI soak history has not started."
},
"redGreenEvidence": {
"status": "complete",
"evidence": "The same pinned oracle passes the pre-#14352 ordinary store, fails the affected-main mixed store with file-is-invalid, passes the candidate mixed store plus old-service destroy and re-upgrade, and fails again when the candidate compatibility files are reverted to affected main."
},
"performanceBudget": {
"required": true,
"evidence": "Ordinary writes remain byte-identical and create no feature sidecar. Reads add one bounded feature-file existence check; sorted feature comparisons avoid unchanged rewrites, and durable companion writes occur only when compatibility metadata changes. Cleanup adds one constant-size in-flight controller per active destroy and no automatic deadline; the visible settings section polls once per second only while cleanup is active. Provisioning adds one source-host Git ref-resolution command only when a ref was requested and runs it before provider create; adoption adds no remote subprocess beyond its existing checkout probes, and resume adds only in-memory comparisons."
},
"promotionCriteria": [
"Keep the pinned baseline/latest/candidate/revert oracle green in CI.",
"Keep the Docker provisioned-root create/adopt/terminal/remove/destroy journey green.",
"Keep user-stopped destroy, fresh retry, and retained-context failure tests green.",
"Collect soak history without unexplained lifecycle or sidecar flakes."
],
"knownGaps": [
"No packaged-build downgrade installer journey; the exact released source reader and service are executed in-process.",
"Live Docker SSH evidence runs locally on macOS and in the changed-file PR E2E lane on Ubuntu; Windows desktop behavior is covered by the platform-neutral filesystem codec and package job."
],
"demotionRule": "Demote if a new write fails the pinned rollback reader, a downgrade lifecycle mutation is lost after re-upgrade, malformed/future metadata overwrites recoverable bytes, ordinary v1 bytes change, user stop cannot settle a destroy process tree, cleanup loses retry ownership, an unrecoverable context leaves a permanent hidden SSH registration, or the focused gate flakes without an identified harness defect."
},
{
"id": "terminal-session.shell-ready-exec-prompt-fallback",
"title": "Startup exec falls back to the identified shell's line editor",
"maturity": "experimental",
"protection": "partial",
"owner": "terminal-session-readiness",
"layer": "posix-pty-and-shell-startup",
"surfaces": [
"queued terminal startup commands",
"zsh, bash, and Fish startup output",
"Bash PROMPT_COMMAND lifecycle composition"
],
"platforms": ["macos", "linux"],
"providers": ["local", "local-daemon", "ssh-daemon", "ssh-relay", "paired-runtime"],
"coveredPlatforms": ["macos", "linux"],
"coveredProviders": ["local", "local-daemon", "ssh-relay", "paired-runtime"],
"coverageNotes": "Real macOS node-pty integration covers zsh 5.9 .zshenv/.zprofile and bash 3.2 profile replacement shells, including exec -a names, same-shell and child-process silent reads, a blocking zle-line-init hook, non-shell readline replacements, and a non-shell image renamed zsh. A real Fish PTY proves marker stripping is byte-exact and does not render bracketed-paste control text. Ubuntu 20.04/Bash 5.0 and Ubuntu 24.04/Bash 5.2 containers cover scalar and array PROMPT_COMMAND composition, including real zoxide on 24.04. Deterministic owner contracts cover local, daemon, and SSH relay identity/readiness composition plus provider-owned delivery; explicit terminal-paste remains renderer-owned. Live isolated journeys cover a macOS headed desktop owner with paired web client, headless orca serve with paired web client, and a Docker Linux OpenSSH/Bash target with one readiness-time reconnect. Linux desktop, WSL/Windows, live zsh-over-SSH, and physical remote hosts remain gaps.",
"motivatingLinks": [
"https://github.com/stablyai/orca/issues/13767",
"https://linear.app/stably/issue/STA-4067",
"https://linear.app/stably/issue/STA-4068",
"https://github.com/stablyai/orca/pull/14161",
"https://github.com/stablyai/orca/issues/14448",
"https://linear.app/stably/issue/STA-4292",
"https://github.com/stablyai/orca/pull/14451"
],
"invariant": "Shell startup scanning preserves every non-Orca output byte in order across arbitrary PTY chunk boundaries. Bash scalar and supported array PROMPT_COMMAND values preserve user bytes, hook order, and foreground exit status while emitting exactly one OSC 133 A/C/D lifecycle without syntax errors. Before user startup files run, the wrapper publishes its shell PID. If a later exec discards the ready marker, proof-based recovery releases queued startup input only after the launched shell's actual executable image with that exact PID owns the PTY foreground, emits its post-hook line-editor enable sequence, and exposes zle/readline termios; startup reads, line-init hooks, child foreground processes, and non-shell readline replacements cannot trigger that proof. The existing bounded compatibility timeout may enqueue input without proof, but must not publish readiness, lose or duplicate that input across reconnect, or execute it before the replacement shell can accept it.",
"oracle": "Split Fish output immediately after the ready marker and after the following ESC introducer; local and daemon owners must emit the exact ESC [ ? 2004 h bytes and headless xterm must not render literal control text. Run the real generated wrappers under node-pty with disposable zsh, bash, and Fish startup files. Exercise Bash scalar and array PROMPT_COMMAND values with empty, repeated, escaped, whitespace, control-byte, odd-backslash, status-mutating, DEBUG-trap, zoxide, and RHEL-style hooks; require exact A,C,D:0,A,C,D:1,A,C ordering and byte preservation. Plain and exec -a replacement shells must receive one queued command at their first completed line editor without waiting for the 15-second timeout. The identical oracle must time out without the startup identity and prompt fallback. Same-shell reads, child-process reads, a blocking zle-line-init hook, sqlite3, and sqlite3 renamed zsh must not trigger prompt fallback. Relay owner coverage must use the same lossless scanner composition and release through the same prompt contract.",
"commands": [
"pnpm exec vitest run --config config/vitest.config.ts src/main/daemon/repro-13767-shell-ready-marker-lost-to-exec.test.ts src/main/daemon/bash-prompt-command-composition.test.ts src/main/line-editor-ready-output-scanner.test.ts src/main/shell-startup-identity-scanner.test.ts src/main/shell-startup-output-scanner.test.ts src/main/shell-prompt-readiness-probe.test.ts src/shared/pty-slave-line-discipline-echo.test.ts src/shared/shell-process-readiness.test.ts src/main/daemon/session.test.ts src/main/daemon/shell-ready.test.ts src/main/providers/local-pty-shell-ready-marker-scan.test.ts src/main/providers/local-pty-shell-ready-startup-command.test.ts src/main/providers/local-pty-shell-ready-wrapper-generation.test.ts src/main/providers/local-pty-provider-shell-readiness.test.ts src/relay/pty-shell-launch.test.ts src/relay/pty-handler-startup-command-delivery.test.ts",
"pnpm exec vitest run --config config/vitest.config.ts src/main/daemon/repro-13767-shell-ready-marker-lost-to-exec.test.ts src/main/line-editor-ready-output-scanner.test.ts src/main/shell-startup-identity-scanner.test.ts src/main/shell-startup-output-scanner.test.ts src/main/shell-prompt-readiness-probe.test.ts src/shared/pty-slave-line-discipline-echo.test.ts src/shared/shell-process-readiness.test.ts src/main/daemon/session.test.ts src/main/daemon/shell-ready.test.ts src/main/providers/local-pty-shell-ready-marker-scan.test.ts src/main/providers/local-pty-shell-ready-startup-command.test.ts src/main/providers/local-pty-shell-ready-wrapper-generation.test.ts src/main/providers/local-pty-provider-shell-readiness.test.ts src/relay/pty-shell-launch.test.ts src/relay/pty-handler-startup-command-delivery.test.ts",
"pnpm exec vitest run --config config/vitest.config.ts --maxWorkers=1 src/main/daemon/shell-ready.test.ts src/main/shell-startup-output-scanner.test.ts",
"ORCA_E2E_SSH_DOCKER=1 SKIP_BUILD=1 pnpm exec playwright test tests/e2e/ssh-startup-exec-readiness.spec.ts --config tests/playwright.config.ts --project electron-headful --workers=1",
"ORCA_E2E_WEB_CLIENT=1 SKIP_BUILD=1 pnpm exec playwright test tests/e2e/paired-startup-exec-readiness.spec.ts --config tests/playwright.config.ts --project electron-headless --project electron-headful --workers=1"
],
"testFiles": [
"src/main/daemon/repro-13767-shell-ready-marker-lost-to-exec.test.ts",
"src/main/daemon/bash-prompt-command-composition.test.ts",
"src/main/line-editor-ready-output-scanner.test.ts",
"src/main/shell-startup-identity-scanner.test.ts",
"src/main/shell-startup-output-scanner.test.ts",
"src/main/shell-prompt-readiness-probe.test.ts",
"src/shared/pty-slave-line-discipline-echo.test.ts",
"src/shared/shell-process-readiness.test.ts",
"src/main/daemon/session.test.ts",
"src/main/daemon/shell-ready.test.ts",
"src/main/providers/local-pty-shell-ready-marker-scan.test.ts",
"src/main/providers/local-pty-shell-ready-startup-command.test.ts",
"src/main/providers/local-pty-shell-ready-wrapper-generation.test.ts",
"src/main/providers/local-pty-provider-shell-readiness.test.ts",
"src/relay/pty-shell-launch.test.ts",
"src/relay/pty-handler-startup-command-delivery.test.ts",
"tests/e2e/ssh-startup-exec-readiness.spec.ts",
"tests/e2e/paired-startup-exec-readiness.spec.ts"
],
"assertionRefs": [
{
"file": "src/main/daemon/bash-prompt-command-composition.test.ts",
"assertions": [
"scalar and array PROMPT_COMMAND values accept trailing separators and whitespace",
"escaped trailing spaces and semicolons remain byte-exact",
"BASH_REMATCH and chained DEBUG-trap command identity remain intact",
"OSC 133 A/C/D lifecycle ordering and command exit status remain exact"
]
},
{
"file": "src/main/shell-startup-output-scanner.test.ts",
"assertions": [
"Fish bracketed-paste output stays byte-exact across marker and ESC chunk splits",
"every byte after readiness is preserved across every chunk boundary, even when it resembles an identity marker",
"pre-ready identity and readiness markers strip across every chunk boundary without reordering prompt output",
"incomplete scanner prefixes drain in byte order"
]
},
{
"file": "src/main/daemon/session.test.ts",
"assertions": [
"daemon output is byte-exact for both Fish chunk splits",
"headless xterm never renders literal bracketed-paste control text"
]
},
{
"file": "src/main/providers/local-pty-provider-shell-readiness.test.ts",
"assertions": ["local PTY output is byte-exact for both Fish chunk splits"]
},
{
"file": "src/main/daemon/repro-13767-shell-ready-marker-lost-to-exec.test.ts",
"assertions": [
"real zsh .zshenv/.zprofile and bash profile replacement shells receive queued input exactly once",
"same-shell raw silent reads retain queued input",
"child-process raw silent reads retain queued input while the identified shell is not foreground",
"a blocking zle-line-init read retains queued input until the hook completes",
"sqlite3 and a sqlite3 image renamed zsh cannot impersonate the launched shell executable path",
"zsh configurations without a line-editor enable sequence retain the existing timeout backstop"
]
},
{
"file": "src/relay/pty-handler-startup-command-delivery.test.ts",
"assertions": [
"the SSH relay owner strips startup identity and releases provider-delivered input through prompt readiness",
"renderer-owned SSH delivery receives the existing ready marker after authoritative relay prompt readiness",
"normal renderer-owned ready markers pass through unchanged and retain no readiness state"
]
},
{
"file": "tests/e2e/ssh-startup-exec-readiness.spec.ts",
"assertions": [
"a Docker Linux OpenSSH/Bash replacement shell retains one compatibility-fallback input across reconnect without executing it before the blocked replacement can accept it",
"the owning terminal handle and raw PTY identity remain singular and stable",
"painted output, authoritative terminal output, and the first interactive input each appear exactly once"
]
},
{
"file": "tests/e2e/paired-startup-exec-readiness.spec.ts",
"assertions": [
"a headed desktop owner and paired client recover startup exec on one stable owning PTY",
"an isolated headless orca serve owner provides the same exact-once output and input contract"
]
}
],
"evidenceRuns": [
{
"date": "2026-08-12",
"runner": "manual",
"platform": "linux",
"command": "pnpm exec vitest run --config config/vitest.config.ts --maxWorkers=1 src/main/daemon/shell-ready.test.ts src/main/shell-startup-output-scanner.test.ts",
"result": "passed",
"durationSeconds": 7,
"summary": "A clean Debian 12 arm64 container with real Fish 3.6 and node-pty passed exact marker-stripped output plus headless-xterm rendering."
},
{
"date": "2026-08-12",
"runner": "local",
"platform": "macos",
"command": "pnpm exec vitest run --config config/vitest.config.ts src/main/daemon/repro-13767-shell-ready-marker-lost-to-exec.test.ts src/main/line-editor-ready-output-scanner.test.ts src/main/shell-startup-identity-scanner.test.ts src/main/shell-startup-output-scanner.test.ts src/main/shell-prompt-readiness-probe.test.ts src/shared/pty-slave-line-discipline-echo.test.ts src/shared/shell-process-readiness.test.ts src/main/daemon/session.test.ts src/main/daemon/shell-ready.test.ts src/main/providers/local-pty-shell-ready-marker-scan.test.ts src/main/providers/local-pty-shell-ready-startup-command.test.ts src/main/providers/local-pty-shell-ready-wrapper-generation.test.ts src/main/providers/local-pty-provider-shell-readiness.test.ts src/relay/pty-shell-launch.test.ts src/relay/pty-handler-startup-command-delivery.test.ts",
"result": "passed",
"durationSeconds": 6,
"summary": "473 tests passed with one local Fish skip, including every-boundary scanner composition, real exec, silent-read, line-init-hook, renamed-image, disabled-bracketed-paste, and relay-owner oracles."
},
{
"date": "2026-08-15",
"runner": "local",
"platform": "macos",
"command": "pnpm exec vitest run --config config/vitest.config.ts src/main/daemon/repro-13767-shell-ready-marker-lost-to-exec.test.ts src/main/daemon/bash-prompt-command-composition.test.ts src/main/line-editor-ready-output-scanner.test.ts src/main/shell-startup-identity-scanner.test.ts src/main/shell-startup-output-scanner.test.ts src/main/shell-prompt-readiness-probe.test.ts src/shared/pty-slave-line-discipline-echo.test.ts src/shared/shell-process-readiness.test.ts src/main/daemon/session.test.ts src/main/daemon/shell-ready.test.ts src/main/providers/local-pty-shell-ready-marker-scan.test.ts src/main/providers/local-pty-shell-ready-startup-command.test.ts src/main/providers/local-pty-shell-ready-wrapper-generation.test.ts src/main/providers/local-pty-provider-shell-readiness.test.ts src/relay/pty-shell-launch.test.ts src/relay/pty-handler-startup-command-delivery.test.ts",
"result": "passed",
"durationSeconds": 6,
"summary": "233 tests passed with one local Fish skip, including exact Bash PROMPT_COMMAND byte/status/lifecycle composition across daemon, local, and relay owners."
},
{
"date": "2026-08-12",
"runner": "local",
"platform": "linux",
"command": "ORCA_E2E_SSH_DOCKER=1 SKIP_BUILD=1 pnpm exec playwright test tests/e2e/ssh-startup-exec-readiness.spec.ts --config tests/playwright.config.ts --project electron-headful --workers=1",
"result": "passed",
"durationSeconds": 17,
"summary": "The live OpenSSH/Bash relay journey crossed the bounded compatibility fallback while rc-file exec was blocked, proved one queued command echo with no command execution, then passed a disconnect/reconnect with exact-once startup output/input and stable pane plus owner PTY identities."
},
{
"date": "2026-08-12",
"runner": "local",
"platform": "macos",
"command": "ORCA_E2E_WEB_CLIENT=1 SKIP_BUILD=1 pnpm exec playwright test tests/e2e/paired-startup-exec-readiness.spec.ts --config tests/playwright.config.ts --project electron-headless --project electron-headful --workers=1",
"result": "passed",
"durationSeconds": 14,
"summary": "The shared oracle passed a headed desktop owner plus paired web client and an isolated headless orca serve owner plus paired web client."
}
],
"runtimeBudget": {
"p95Seconds": 120,
"scope": "focused local wrapper contracts plus isolated SSH and paired live journeys"
},
"flakeHistory": {
"status": "unknown",
"evidence": "Fresh deterministic and isolated live runs pass locally; CI and soak history have not started."
},
"redGreenEvidence": {
"status": "complete",
"evidence": "Daemon oracle SHA-256 b13b08006a38b2adc2acb51ae9342909514e55ab4822fac4fbb76cd49b344cc6 was byte-identical across runs: affected baseline 09ec516ae5 failed 4 of 14, while pre-PR main bc2e30000b and this PR passed 14 of 14. The unchanged live SSH oracle failed on bc2e30000b and with the ownership change reverted because the ledger stayed pending after reconnect, then passed on this PR. Fish chunk oracle patch SHA-256 fd49a4d3d91bd5f0d10c1b1f44f4cfbd92cef9155a5505b415c8680184cdc765 was also byte-identical: scan target e4c278eb52, main 150cc6f50c, and candidate ae7f30318a with shared scanner integration disabled failed only the ESC-introducer split in local and daemon owners, while ae7f30318a passed all 163 cases plus headless-xterm rendering."
},
"performanceBudget": {
"required": true,
"evidence": "Two bounded linear scans partition identity ownership at the exact ready-marker boundary and retain only the existing bounded prefixes. The normal ready-marker path cancels before external probing. A missing marker triggers a debounced stty read only after a line-editor enable sequence, followed by narrow PID status and executable-image inspection only when termios matches. Slow ordinary startup output triggers zero probes; rejected protocol emissions are capped at four probes per startup. There is no per-command hook or steady-state polling."
},
"promotionCriteria": [
"Collect CI and soak history for the Docker SSH and paired live journeys.",
"Collect CI and soak history without unexplained flakes.",
"Keep same-shell, child-process, line-init-hook, and non-shell readline contracts green."
],
"knownGaps": [
"The fallback requires a readable POSIX PTY slave; WSL through wsl.exe, ConPTY, and native Windows retain the existing timeout backstop.",
"The live SSH journey covers Docker Linux OpenSSH with Bash, not zsh, WSL, Windows SSH, a Linux desktop renderer, or a physical remote host.",
"An exec integration that forks a replacement shell instead of retaining the identified shell PID retains the existing timeout backstop.",
"A zsh configuration that disables bracketed-paste output emits no safe post-hook protocol signal and retains the existing timeout backstop.",
"The pre-existing timeout backstop can still deliver queued input to a non-shell replacement after it expires; this fallback prevents indefinite startup hangs and is unchanged by the prompt fallback.",
"The fallback restores safe startup-command delivery but cannot recreate OSC 133 hooks or overlay restores already discarded by exec.",
"Startup code running in the launched shell can deliberately spoof the public line-editor enable sequence after configuring matching termios; the existing timeout path already trusts a public OSC marker from the same startup code."
],
"demotionRule": "Keep experimental or demote if prompt fallback enters a normal, child, or line-init read; a non-shell executable triggers prompt fallback; the identified shell PID is not foreground; delivery duplicates; ordinary startup output spawns probes; probe attempts exceed four; or the focused gate flakes without an identified harness defect."
},
{
"id": "editor.restored-sibling-owner-reparent",
"title": "Restored sibling tabs migrate filesystem authority before becoming editable",
"maturity": "experimental",
"protection": "partial",
"owner": "editor-runtime",
"layer": "renderer-store-controller-contract",
"surfaces": [
"restored editor tabs",
"editor save and autosave",
"filesystem watches and hot-exit persistence"
],
"platforms": ["macos", "linux", "windows"],
"providers": ["local", "ssh", "paired-runtime"],
"coveredPlatforms": ["macos"],
"coveredProviders": ["local", "ssh", "paired-runtime"],
"coverageNotes": "Deterministic store/controller tests cover local, direct-SSH, paired-runtime identity, folder workspaces, queue quiescence, stale route and connection-generation rejection, authoritative active-workspace projection, owner-derived IDs, drafts and editor maps, tab/group placement, exact watch replacement, change/delete/rename correlation, explicit save, autosave, collision refusal without activation reconciliation, provenance, and restart hot-exit persistence. Live headed/headless paired-runtime and post-establish Electron IPC remain uncollected.",
"motivatingLinks": [
"https://github.com/stablyai/orca/issues/11304",
"https://github.com/stablyai/orca/pull/11369"
],
"invariant": "A restored absolute path owned by a same-host sibling workspace cannot read, save, watch, or persist until old saves drain, the exact route and host generations are revalidated, and one authoritative activation transaction installs the sibling owner, target projection, editor state, reconciliation, and first-activation terminal preparation; collisions and stale routes fail before activation preparation or reconciliation.",
"oracle": "Hold an old-owner save in flight, start migration, then remove the sibling, change a folder root, or reconnect SSH and require owner migration to fail closed after quiescence. On a stable route require one coherent target-workspace projection, first-activation terminal generation preparation, destination authority for explicit save and autosave, exact watch replacement, destination-only change/delete/rename handling, owner-derived state rekeys, and hot-exit restart ownership. Seed an invalid destination tab/group model before a collision and require the target projection to remain byte-identical.",
"commands": [
"pnpm exec vitest run --config config/vitest.config.ts src/renderer/src/store/slices/restored-editor-owner-reparent.test.ts src/renderer/src/components/editor/restored-editor-owner-save-lifecycle.test.ts src/renderer/src/lib/runtime-workspace-file-route.test.ts"
],
"testFiles": [
"src/renderer/src/store/slices/restored-editor-owner-reparent.test.ts",
"src/renderer/src/components/editor/restored-editor-owner-save-lifecycle.test.ts",
"src/renderer/src/lib/runtime-workspace-file-route.test.ts"
],
"assertionRefs": [
{
"file": "src/renderer/src/store/slices/restored-editor-owner-reparent.test.ts",
"assertions": [
"one atomic commit rekeys owner-derived editor, preview, draft, cursor, view, tab, group, active, reveal, focus, provenance, and persistence state",
"active reparenting uses the centralized workspace activation transaction for terminal, browser, pending-creation, explorer, first-activation, and post-commit state",
"source watch unsubscribes once, destination watch subscribes once, and only destination change/delete/rename events reach the file",
"dirty and clean destination collisions fail closed without changing either open session or reconciling destination tabs and groups",
"folder and direct-SSH owners retain exact root, host, target, and connection-generation authority"
]
},
{
"file": "src/renderer/src/components/editor/restored-editor-owner-save-lifecycle.test.ts",
"assertions": [
"migration waits for the old save queue and routes later explicit and automatic saves through the destination worktree",
"a removed sibling, changed folder root, or changed direct-SSH generation after quiescence rejects migration without changing ownership"
]
},
{
"file": "src/renderer/src/lib/runtime-workspace-file-route.test.ts",
"assertions": [
"same-host runtime, folder, local, and direct-SSH roots resolve without cross-host fallback"
]
}
],
"evidenceRuns": [
{
"date": "2026-08-03",
"runner": "local",
"platform": "macos",
"command": "pnpm exec vitest run --config config/vitest.config.ts src/renderer/src/store/slices/restored-editor-owner-reparent.test.ts src/renderer/src/components/editor/restored-editor-owner-save-lifecycle.test.ts src/renderer/src/lib/runtime-workspace-file-route.test.ts",
"result": "passed",
"durationSeconds": 3,
"summary": "Three deterministic files passed 20 lifecycle, stale-route, activation, ownership, host, collision, persistence, watch, and save tests."
}
],
"runtimeBudget": {
"p95Seconds": 5,
"scope": "focused renderer store/controller contract on a local development runner"
},
"flakeHistory": {
"status": "unknown",
"evidence": "One local deterministic run is recorded; CI and soak history have not started."
},
"redGreenEvidence": {
"status": "complete",
"evidence": "The final2 verifier's byte-identical post-quiescence lifecycle scope passed 21/21 on 7890271160 and failed 7 tests on f92db196a1; base e08eba674c, published 1bcfe3bcb0, and revert b3627461ab were structurally red. The permanent collision oracle is in test blob ac62a89c671a0c8f081ebf06736715bd2150ce9f (SHA-256 a61970ace80be1cb56f781aee6f878a8446c6c4527f9eb0cd0c151d8df96bf50). The same byte-identical blob is structurally red on base, published, and revert, behaviorally red on rejected final2 candidate 7890271160 because pre-commit reconciliation removes the stale destination tab, and green on implementation b72a838cdc; the full permanent gate passes 20/20."
},
"performanceBudget": {
"required": true,
"evidence": "Route lookup scans only the already-indexed renderer workspace catalog, while migration is O(open editor files + source/destination tabs/groups) and performs no provider call, Git scan, polling, retry, subprocess, or global fanout beyond the required old/new watch delta."
},
"promotionCriteria": [
"Collect two fresh child-verifier decisions against the correction candidate.",
"Collect headed and headless paired-runtime coverage after the post-establish Electron IPC gap is fixed.",
"Collect physical Windows or WSL path/host evidence and CI soak history."
],
"knownGaps": [
"Headed Electron post-establish IPC, paired headless, reconnect, and physical Windows/WSL journeys are uncollected.",
"Cold many-repo main-process sibling discovery remains a separately measured follow-up.",
"Registered-workspace symlink policy remains inherited and unchanged."
],
"demotionRule": "Keep experimental or demote if migration can race a save, retain source authority, fan out watches, lose dirty/editor state, accept an owner-generation change, merge a collision, or the focused contract flakes without a product or harness bug."
},
{
"id": "terminal-provider.login-session-retirement",
"title": "macOS login-session retirement preserves live daemons through transient rejection bursts",
"maturity": "experimental",
"protection": "partial",
"owner": "daemon-terminal",
"layer": "macos-daemon-lifecycle",
"surfaces": [
"GUI-spawned macOS daemon",
"local PTY survival",
"daemon reconnect and replacement"
],
"platforms": ["macos"],
"providers": ["local-daemon"],
"coveredPlatforms": ["macos"],
"coveredProviders": ["local-daemon"],
"coverageNotes": "A deterministic fake clock covers short-burst recovery, sustained session death, pending-timer and in-flight-probe suspension, event-trigger preemption, resolver corroboration, and shutdown cancellation. The production-only watch remains behind the macOS GUI launch flag; SSH/headless, WSL, Linux, Windows, mobile, and relay paths are unaffected.",
"motivatingLinks": [
"https://github.com/stablyai/orca/issues/11749",
"https://github.com/stablyai/orca/issues/7936"
],
"invariant": "A GUI-spawned macOS daemon may retire for PAM rejections only after it previously accepted login wrapping, receives three conclusive rejections spanning at least one uninterrupted 120-second observation window, and observes explicitly unhealthy in-process resolver state. A conclusive acceptance or a sleep/App Nap-sized gap before or during a probe resets the rejection window to the periodic cadence, and client or PTY activity cannot shorten its scheduled backoff.",
"oracle": "Arm the watch with an accepted probe, inject three rejections over 20 seconds plus unhealthy resolver state, then inject client and PTY activity and require zero resolver reads, zero retirement calls, and exactly four probes until the 120-second boundary. Return acceptance at that boundary and require the daemon to survive. Jump wall time by one hour while a timer is pending and while a PAM probe promise is unresolved; require rejection evidence to restart after wake, zero probes for the next 119,999 milliseconds, and recovery without retirement in both cases. Repeatedly delay timers beyond the suspension threshold for one hour and require the periodic probe bound, one live timer, and zero resolver or retirement calls. Separately keep rejecting through an uninterrupted boundary and require one retirement, while healthy or unknown resolver state suppresses it and stop aborts an in-flight resolver check.",
"commands": [
"pnpm exec vitest run --config config/vitest.config.ts src/main/daemon/macos-login-session-death-watch.test.ts --reporter=dot"
],
"testFiles": ["src/main/daemon/macos-login-session-death-watch.test.ts"],
"assertionRefs": [
{
"file": "src/main/daemon/macos-login-session-death-watch.test.ts",
"assertions": [
"preserves the daemon when a short PAM rejection burst recovers after wake",
"does not count a suspended timer gap as rejection evidence",
"does not count suspension during an in-flight probe as rejection evidence",
"backs off repeated timer lateness to the periodic probe cadence",
"retires only after sustained conclusive rejections with a degraded resolver",
"suppresses retirement while resolver health is healthy or unknown, then retires on explicit degradation",
"stop prevents an in-flight resolver check from retiring the daemon"
]
}
],
"evidenceRuns": [
{
"date": "2026-08-01",
"runner": "local",
"platform": "macos",
"command": "pnpm exec vitest run --config config/vitest.config.ts src/main/daemon/macos-login-session-death-watch.test.ts --reporter=dot",
"result": "passed",
"durationSeconds": 0.1,
"summary": "The focused state-machine suite passed 21 tests, including the field-shaped 20-second rejection burst, pending-timer and in-flight-probe suspension rebaselining, repeated-lateness backoff, bounded recovery retry, sustained-death convergence, resolver suppression, trigger coalescing, and shutdown cancellation."
}
],
"runtimeBudget": {
"p95Seconds": 2,
"scope": "deterministic login-session death-watch state-machine suite"
},
"flakeHistory": {
"status": "unknown",
"evidence": "The deterministic suite passes locally; focused CI and soak history are not yet available."
},
"redGreenEvidence": {
"status": "complete",
"evidence": "On origin/main, the field-shaped accepted then three-rejection sequence calls onRetire after 20 seconds and fails the recovery oracle. With the minimum observation window and non-preemptible rejection schedule, the identical oracle preserves the daemon and recovers at the boundary."
},
"performanceBudget": {
"required": true,
"evidence": "The watch retains one timer and one in-flight probe. A rejection burst runs the existing two 10-second confirmation probes, then one recovery probe at the 120-second boundary; client and PTY activity cannot pull that deadline earlier. Timer lateness and in-flight probe suspension both rebaseline evidence to the periodic cadence, preventing an App Nap retry loop, and resolver work is skipped until the time floor. No polling loop, startup await, session scan, renderer work, provider fanout, listener, or retained payload was added."
},
"promotionCriteria": [
"Collect 100 consecutive focused CI passes or 14 days of soak history.",
"Capture field evidence from macOS sleep/wake and a full GUI logout without a false retirement or missed stale-session recovery.",
"Keep the exact probe-count, no-early-resolver, trigger-preemption, acceptance-reset, and shutdown-abort assertions green."
],
"knownGaps": [
"A real dead macOS GUI login session cannot be fabricated without ending the runner's login session; sustained-death coverage uses deterministic PAM and resolver oracles.",
"The two-minute production window and one-hour pending/in-flight suspension cases are covered by fake-clock tests rather than a real sleep/wake run.",
"No multi-process aggregate throttle is added; each stale daemon independently obeys the same non-preemptible observation window."
],
"demotionRule": "Keep experimental or demote if any activity trigger shortens the rejection window, a transient burst reaches resolver retirement authority, sustained dead-session evidence no longer converges, shutdown permits late retirement, or the focused gate flakes without an identified product or harness fault."
},
{
"id": "ssh-filesystem.stream-inactivity-lifecycle",
"title": "SSH file streams bound inactivity without counting host sleep",
"maturity": "experimental",
"protection": "partial",
"owner": "desktop-ssh",
"layer": "ssh-file-stream-lifecycle",
"surfaces": ["SSH filesystem reads", "AI Vault remote scanning", "system sleep/wake"],
"platforms": ["macos", "linux", "windows"],
"providers": ["ssh2", "system-ssh"],
"coveredPlatforms": ["macos"],
"coveredProviders": ["ssh2", "system-ssh"],
"coverageNotes": "Deterministic fake-clock coverage proves inactivity cancellation, active-transfer renewal, sticky suspend replay before metadata, failure-isolated lifecycle fanout, committed-quit bridge disposal, timer cleanup, and listener cleanup. A real Docker SSH relay previously proved active and stalled transfer behavior; physical sleep/wake and Windows/Linux clients remain gaps.",
"motivatingLinks": [
"https://github.com/stablyai/orca/issues/11362",
"https://github.com/stablyai/orca/pull/11364"
],
"invariant": "A non-empty SSH file stream that produces no valid frame for 30 seconds must cancel at its authoritative stream reader and release all local lifecycle state. System suspend is sticky across metadata and subscription races, resume grants every still-live stream one fresh inactivity window, one failing consumer cannot block the others, and the sole Electron bridge survives a vetoed before-quit without retaining a per-stream Electron listener.",
"oracle": "Publish suspend before stream metadata resolves, jump wall time by one hour, and require the late-subscribing stream to remain pending until resume grants a fresh 30-second window. Deliver a valid final chunk and end frame, require exact content, then publish another resume and require zero timers, multiplexer listeners, or renewed work; separately require stalled cancellation at 30 seconds, atomic state replay, failure-isolated fanout, and bridge disposal only after the committed will-quit gate.",
"commands": [
"pnpm exec vitest run --config config/vitest.config.ts src/main/providers/ssh-filesystem-provider-stream.test.ts src/main/system-resume-broadcast.test.ts src/main/system-power-lifecycle.test.ts src/main/startup/desktop-startup-ordering.test.ts --reporter=dot"
],
"testFiles": [
"src/main/providers/ssh-filesystem-provider-stream.test.ts",
"src/main/system-resume-broadcast.test.ts",
"src/main/system-power-lifecycle.test.ts",
"src/main/startup/desktop-startup-ordering.test.ts"
],
"assertionRefs": [
{
"file": "src/main/providers/ssh-filesystem-provider-stream.test.ts",
"assertions": [
"cancels and cleans up a stream that stalls after metadata",
"keeps a long stream alive while chunks continue arriving",
"grants an active stream a fresh inactivity window after system resume",
"keeps metadata received during suspend paused until resume"
]
},
{
"file": "src/main/system-resume-broadcast.test.ts",
"assertions": ["publishes suspend and resume to main-process lifecycle consumers"]
},
{
"file": "src/main/system-power-lifecycle.test.ts",
"assertions": [
"replays suspended state to a late subscriber",
"atomically replays a transition to a subscriber added during publication",
"isolates a failing listener from the remaining subscribers"
]
},
{
"file": "src/main/startup/desktop-startup-ordering.test.ts",
"assertions": [
"keeps the power bridge through vetoable before-quit and disposes after commit"
]
}
],
"evidenceRuns": [
{
"date": "2026-08-01",
"runner": "local",
"platform": "macos",
"command": "pnpm exec vitest run --config config/vitest.config.ts src/main/providers/ssh-filesystem-provider-stream.test.ts src/main/system-resume-broadcast.test.ts src/main/system-power-lifecycle.test.ts src/main/startup/desktop-startup-ordering.test.ts --reporter=dot",
"result": "passed",
"durationSeconds": 1.6,
"summary": "Four focused files and 33 tests passed, including stalled cancellation, active progress, late metadata replay, failure isolation, committed-quit bridge lifetime, and post-settlement cleanup."
}
],
"runtimeBudget": {
"p95Seconds": 2,
"scope": "deterministic SSH file-stream and system power lifecycle unit tests"
},
"flakeHistory": {
"status": "unknown",
"evidence": "The deterministic correction suite passes locally; focused CI and soak history are not yet available."
},
"redGreenEvidence": {
"status": "complete",
"evidence": "The byte-identical oracle is incomplete on origin/main because stalled streams never settle, and the pre-correction candidate cancels immediately after a simulated one-hour suspend. The corrected candidate bounds uninterrupted inactivity while granting a full post-resume window."
},
"performanceBudget": {
"required": true,
"evidence": "One app-global powerMonitor listener publishes to an in-memory set. Each active non-empty read retains one set entry and one unref'd timer, clears both on settlement, and performs constant work per valid chunk; each power transition performs O(active streams) isolated notifications with no polling, provider scan, subprocess, renderer work, or per-stream Electron listener."
},
"promotionCriteria": [
"Collect 100 consecutive focused CI passes or 14 days of soak history.",
"Capture physical macOS, Linux, and Windows sleep/wake evidence with a live SSH read.",
"Keep timeout, post-resume renewal, and zero-retained-lifecycle assertions green."
],
"knownGaps": [
"Suspend/resume is injected at the authoritative main-process event seam rather than by physically sleeping the runner.",
"Slow links that produce no complete valid frame for 30 uninterrupted awake seconds remain intentionally retryable failures."
],
"demotionRule": "Keep experimental or demote if sleep consumes inactivity evidence, stalled streams become unbounded, or settled reads retain timers or lifecycle subscriptions."
},
{
"id": "ssh-relay.staged-upload-recovery",
"title": "SSH relay uploads remain retryable before the shared install lock",
"maturity": "experimental",
"protection": "partial",
"owner": "ssh-relay-install",
"layer": "ssh-transfer-install-contract",
"surfaces": [
"SSH relay first install",
"split shell and SFTP namespaces",
"system SSH transfer fallback",
"relay install retry after cancellation"
],
"platforms": ["macos", "linux", "windows"],
"providers": ["ssh2", "system-ssh"],
"coveredPlatforms": ["macos", "linux"],
"coveredProviders": ["ssh2", "system-ssh"],
"coverageNotes": "Deterministic unit, exact POSIX shell, native ARM macOS PowerShell 7.6.4, and real ssh2 SFTP-wire tests cover lock ordering, concurrent-install loss, fixed-slot ownership identity, payload-only promotion, bounded stale-stage reclamation, installed-fast-path draining, joined cancellation teardown, cross-version isolation, split-SFTP redirection, and system-SSH bypass. A throwaway linux-arm64 Docker sshd reached through a non-loopback LAN address covers live bytes-in-flight SFTP cancellation, injected unconfirmed cancellation, immediate retry against a real Git repository, fixed-slot recovery behind unclaimable entries, and real version-GC filtering with 15,197 unrelated names.",
"motivatingLinks": [
"https://github.com/stablyai/orca/issues/9828",
"https://github.com/stablyai/orca/pull/10207"
],
"invariant": "A first-install relay transfer must complete in an attempt-owned fixed staging slot before acquiring the shared version install lock. Reservation, promotion, confirmed cleanup, and stale recovery must reject path replacement, persisted-identity mismatch, POSIX symlinks, and Windows reparse points. Recovery examines only eight fixed slot/claim/delete names and removes at most one stale valid stage per call; eight unclaimable states fail with an explicit manual-recovery message. Split-SFTP hosts must prove the stage identity on the exact transfer session, only payload contents may be promoted under the shared lock, and cancellation must boundedly join SFTP, stream, local file-handle, and transfer settlement.",
"oracle": "Pause a real ssh2 SFTP relay.js write after one remotely acknowledged chunk, prove the remote file is partial, abort the live transfer, and require no shared .install-lock, leaked local descriptor, or foreign-process termination. Separately inject two unconfirmed cancellations, require an independent deployment to install, launch, answer relay RPC, and read a real repository HEAD. Replace one retained fixed slot with an old-mtime same-owner directory while preserving the original, add a fixed-slot POSIX symlink, and require installed-path recovery to skip both while reclaiming a valid stale slot behind them. Add 15,197 unrelated relay-shaped names and run the real version GC, requiring bounded stdout and no removal. Unit and wire contracts cover exact POSIX and native PowerShell 0/1/7/8/9+ quota behavior, no-follow identity fencing, payload symlink/reparse rejection, one-item repeated draining, zero lock acquisition before upload settlement, joined transfer/channel teardown including never-settling failures, SFTP redirection, package.json namespace ownership, promotion only after the lock, cross-version isolation, and system-SSH behavior.",
"commands": [
"node config/scripts/run-ssh-staged-upload-reliability.mjs --powershell <PowerShell-7.6.4-executable> src/main/ssh/sftp-upload.test.ts src/main/ssh/ssh-file-transfer-abort.test.ts src/main/ssh/ssh-relay-deploy-staged-upload.test.ts src/main/ssh/ssh-relay-native-deps-install-staged-upload.test.ts src/main/ssh/ssh-relay-sftp-namespace-install.test.ts src/main/ssh/ssh-relay-install-namespace.test.ts src/main/ssh/ssh-relay-upload-stage-commands.test.ts src/main/ssh/sftp-namespace-resolution.test.ts src/main/ssh/ssh-connection-sftp-wire.test.ts src/main/ssh/ssh-remote-commands.test.ts src/main/ssh/ssh-relay-cross-version-isolation.test.ts",
"ORCA_REVIEW_SSH_UPLOAD_CANCEL=1 ORCA_REVIEW_SSH_TARGET_HOST=<non-loopback-host> ORCA_REVIEW_SSH_IMAGE=<throwaway-sshd-image> ORCA_REVIEW_EXPECT_RECOVERY=1 pnpm exec vitest run --config config/vitest.config.ts src/main/ssh/ssh-relay-upload-cancel.docker.test.ts --maxWorkers=1 --reporter=verbose"
],
"testFiles": [
"src/main/ssh/sftp-upload.test.ts",
"src/main/ssh/ssh-file-transfer-abort.test.ts",
"src/main/ssh/ssh-relay-deploy-staged-upload.test.ts",
"src/main/ssh/ssh-relay-native-deps-install-staged-upload.test.ts",
"src/main/ssh/ssh-relay-sftp-namespace-install.test.ts",
"src/main/ssh/ssh-relay-install-namespace.test.ts",
"src/main/ssh/ssh-relay-upload-stage-commands.test.ts",
"src/main/ssh/sftp-namespace-resolution.test.ts",
"src/main/ssh/ssh-connection-sftp-wire.test.ts",
"src/main/ssh/ssh-remote-commands.test.ts",
"src/main/ssh/ssh-relay-cross-version-isolation.test.ts",
"src/main/ssh/ssh-relay-upload-cancel.docker.test.ts"
],
"assertionRefs": [
{
"file": "src/main/ssh/sftp-upload.test.ts",
"assertions": ["joins local file-descriptor teardown when a live upload is aborted"]
},
{
"file": "src/main/ssh/ssh-file-transfer-abort.test.ts",
"assertions": [
"joins confirmed SFTP close and transfer teardown before rejecting an abort",
"marks transfer teardown unconfirmed when close wins but the transfer never settles"
]
},
{
"file": "src/main/ssh/ssh-relay-upload-stage-commands.test.ts",
"assertions": [
"bounds reservation at 0, 1, 7, 8, and 9+ entries on POSIX and native PowerShell",
"rejects same-path replacement, symlink, reparse, and identity substitution before promotion or deletion",
"reclaims at most one valid stale fixed slot and progresses across repeated deployments"
]
},
{
"file": "src/main/ssh/ssh-relay-deploy-staged-upload.test.ts",
"assertions": [
"waits for a deferred SFTP upload before acquiring the install lock",
"drops only its stage when a sibling finishes before the locked re-probe",
"recovers one fixed stale stage before a fresh upload",
"launches before bounded installed-path recovery",
"never enumerates arbitrary stage paths during installation",
"retries immediately after an unconfirmed upload termination instead of waiting on a fresh install lock"
]
},
{
"file": "src/main/ssh/ssh-remote-commands.test.ts",
"assertions": [
"uses encoded PowerShell for Windows deploy commands",
"enumerates Windows staging children before copying",
"lets only one PowerShell caller acquire a legacy-visible lock"
]
},
{
"file": "src/main/ssh/ssh-relay-cross-version-isolation.test.ts",
"assertions": ["a v2 deploy never references the v1 install dir or v1 socket path"]
},
{
"file": "src/main/ssh/ssh-relay-sftp-namespace-install.test.ts",
"assertions": [
"redirects every first-install artifact transfer while shell commands stay canonical",
"leaves system-SSH connections unmapped and unprobed"
]
},
{
"file": "src/main/ssh/ssh-relay-upload-cancel.docker.test.ts",
"assertions": [
"aborts a live SFTP upload after remote bytes arrive without creating the shared lock",
"recovers cancellation with bounded safe reclamation and bounded real version GC"
]
}
],
"evidenceRuns": [
{
"date": "2026-07-31",
"runner": "local",
"platform": "macos",
"command": "node config/scripts/run-ssh-staged-upload-reliability.mjs --powershell <PowerShell-7.6.4-executable> src/main/ssh/sftp-upload.test.ts src/main/ssh/ssh-file-transfer-abort.test.ts src/main/ssh/ssh-relay-deploy-staged-upload.test.ts src/main/ssh/ssh-relay-native-deps-install-staged-upload.test.ts src/main/ssh/ssh-relay-sftp-namespace-install.test.ts src/main/ssh/ssh-relay-install-namespace.test.ts src/main/ssh/ssh-relay-upload-stage-commands.test.ts src/main/ssh/sftp-namespace-resolution.test.ts src/main/ssh/ssh-connection-sftp-wire.test.ts src/main/ssh/ssh-remote-commands.test.ts src/main/ssh/ssh-relay-cross-version-isolation.test.ts",
"result": "passed",
"durationSeconds": 57.9,
"summary": "Eleven focused files passed 152 tests with 3 platform skips using exact POSIX sh, native ARM macOS PowerShell 7.6.4, real ssh2 split-SFTP wire sessions, fixed-slot identity races, bounded recovery, joined cancellation teardown, and cross-version isolation."
},
{
"date": "2026-07-31",
"runner": "local",
"platform": "linux",
"command": "ORCA_REVIEW_SSH_UPLOAD_CANCEL=1 ORCA_REVIEW_SSH_TARGET_HOST=<non-loopback-host> ORCA_REVIEW_SSH_IMAGE=<throwaway-sshd-image> ORCA_REVIEW_EXPECT_RECOVERY=1 pnpm exec vitest run --config config/vitest.config.ts src/main/ssh/ssh-relay-upload-cancel.docker.test.ts --maxWorkers=1 --reporter=verbose",
"result": "passed",
"durationSeconds": 12.58,
"summary": "A throwaway linux-arm64 Docker sshd acknowledged 65,536 of 837,401 relay.js bytes before live abort with no shared lock and preserved the foreign sleep sentinel. Two injected unconfirmed stages remained pre-lock; retry launched the relay, answered RPC, and read a real Git HEAD. Installed recovery preserved a same-owner identity-mismatched replacement, its original, a POSIX symlink, and its foreign target while draining one valid stale slot behind them. Real version GC retained all 15,197 unrelated names, emitted 25 bytes, and completed in 25 ms."
}
],
"runtimeBudget": {
"p95Seconds": 35,
"scope": "focused unit, SFTP-wire, and local Docker SSH contracts"
},
"flakeHistory": {
"status": "unknown",
"evidence": "Focused deterministic and Docker runs pass locally; CI and soak history are not yet available."
},
"redGreenEvidence": {
"status": "partial",
"evidence": "A byte-identical local Docker oracle run on latest main left a fresh shared .install-lock and blocked retry; the staged candidate left no shared lock and recovered immediately, and disabling staged ordering restored the blocked result. No committed baseline artifact or baseline installed-fast-path cleanup oracle is retained, so this evidence is intentionally not marked complete."
},
"performanceBudget": {
"required": true,
"evidence": "Stage recovery examines only eight fixed slot/claim/delete paths and reclaims at most one stale valid stage per invocation; installed reconnects launch before asynchronous recovery. Full quota produces an explicit error instead of unbounded cleanup. Version GC still scans the relay base directory, but remote filtering caps stdout and local candidate work at 64. Cancellation adds one bounded five-second join of channel and transfer settlement."
},
"promotionCriteria": [
"Collect 100 consecutive CI passes or 14 days of soak history.",
"Run live first-install cancellation and retry on Windows OpenSSH and a split-SFTP Synology-class host.",
"Keep exact lock-order, no-follow identity, promotion, bounded reclamation, and teardown assertions in the gate command."
],
"knownGaps": [
"The live Docker target is Linux ARM64 with a unified namespace; split-SFTP behavior is covered by real ssh2 wire and deterministic deploy fixtures.",
"Native PowerShell coverage runs on ARM macOS with POSIX filesystem paths; Windows OpenSSH, Windows PowerShell 5.1, and system-SSH behavior remain command and transfer-contract coverage rather than a live target.",
"The fixed pool retains up to eight relay bundles; eight foreign or otherwise unclaimable fixed states require manual inspection instead of automatic deletion.",
"Version GC remotely filters and caps output but still scans the base .orca-remote directory; it does not promise constant remote enumeration time.",
"The Docker oracle is opt-in because it requires a local image and a reachable non-loopback host address."
],
"demotionRule": "Demote or quarantine if cancellation creates the shared install lock before transfer settlement, a split-SFTP transfer loses identity proof, recovery deletes a replacement/symlink/reparse/foreign stage, fixed-path work exceeds its eight-slot bound, cancellation leaks a local descriptor, or the focused gate flakes without a product or harness bug."
},
{
"id": "mobile-ui.drawer-close-continuity",
"title": "Mobile drawers finish closing despite parent rerenders",
"maturity": "experimental",
"protection": "partial",
"owner": "mobile-ui",
"layer": "react-native-modal-lifecycle",
"surfaces": [
"host action sheet",
"host rename navigation",
"host removal confirmation",
"shared mobile bottom drawers"
],
"platforms": ["ios", "android", "macos"],
"providers": ["provider-independent"],
"coveredPlatforms": ["ios", "macos"],
"coveredProviders": ["provider-independent"],
"coverageNotes": "A deterministic React lifecycle test proves callback churn cannot restart an in-flight drawer close, and an iOS 26.5 simulator run covers Edit Host plus confirmed host removal. Android native-modal behavior remains a live-test gap.",
"motivatingLinks": ["https://github.com/stablyai/orca/issues/8791"],
"invariant": "Once a bottom drawer begins closing, unrelated parent rerenders must not replace its completion callback or restart the native hide animation. The drawer must unmount once and deliver the latest after-close action exactly once.",
"oracle": "Render one drawer, begin closing it, rerender with new parent callbacks before completion, and require every MountedBottomDrawer frame to retain one onHidden identity. Trigger that completion barrier repeatedly, then require the drawer's null render to commit before only the latest after-close callback runs exactly once.",
"commands": [
"pnpm --dir mobile exec vitest run --root .. mobile/src/components/bottom-drawer-close-lifecycle.test.ts",
"Manual iOS 26.5 simulator: long-press paired host; open Edit host; return; long-press host; Remove; confirm Remove; assert host disappears"
],
"testFiles": ["mobile/src/components/bottom-drawer-close-lifecycle.test.ts"],
"assertionRefs": [
{
"file": "mobile/src/components/bottom-drawer-close-lifecycle.test.ts",
"assertions": ["keeps close stable and delivers the latest action once after unmount"]
}
],
"evidenceRuns": [
{
"date": "2026-07-28",
"runner": "local",
"platform": "macos",
"command": "pnpm --dir mobile exec vitest run --root .. mobile/src/components/bottom-drawer-close-lifecycle.test.ts",
"result": "passed",
"durationSeconds": 0.18,
"summary": "The focused lifecycle harness passed with stable completion identity, latest-callback delivery, and drawer unmount assertions."
},
{
"date": "2026-07-28",
"runner": "manual",
"platform": "ios",
"command": "Manual iOS 26.5 simulator: long-press paired host; open Edit host; return; long-press host; Remove; confirm Remove; assert host disappears",
"result": "passed",
"durationSeconds": 37,
"summary": "Edit host opened responsively after the drawer closed; returning and confirming Remove deleted the host without freezing."
}
],
"runtimeBudget": {
"p95Seconds": 5,
"scope": "focused React lifecycle contract test"
},
"flakeHistory": {
"status": "unknown",
"evidence": "One deterministic local contract run and one iOS simulator flow exist; CI and soak history are not yet available."
},
"redGreenEvidence": {
"status": "complete",
"evidence": "On current main, the harness failed because each parent render created a different onHidden callback. The stable completion callback fix passes the byte-identical oracle; restoring the inline callback reproduces the failure."
},
"performanceBudget": {
"required": true,
"evidence": "Any number of parent rerenders retains one close-completion identity, so they add zero hide-animation restarts, timers, listeners, or after-close deliveries."
},
"promotionCriteria": [
"Collect 100 consecutive CI passes or 14 days of soak history.",
"Run the host Edit and Remove flows on a physical iOS device and an Android emulator or device.",
"Keep the callback-identity and exactly-once delivery assertions intact for every shared drawer lifecycle change."
],
"knownGaps": [
"Android native-modal behavior has no live evidence.",
"The simulator run used an unreachable stored host rather than a connected multi-worktree host.",
"The contract test injects the hide-completion barrier instead of running Reanimated."
],
"demotionRule": "Keep experimental or demote if parent rerenders can restart drawer hiding, after-close delivery duplicates or goes stale, the focused contract flakes, or either mobile platform retains a touch-blocking modal."
},
{
"id": "mobile-relay.endpoint-recovery",
"title": "Mobile relay recovery retries offline hosts and races direct endpoints",
"maturity": "experimental",
"protection": "partial",
"owner": "mobile-runtime",
"layer": "shared-mobile-transport-contract",
"surfaces": [
"paired mobile reconnect",
"cloud relay host-offline recovery",
"LAN direct endpoint",
"Tailscale direct endpoint"
],
"platforms": ["ios", "android", "macos", "linux", "windows"],
"providers": ["lan", "tailscale", "cloud-relay"],
"coveredPlatforms": ["macos"],
"coveredProviders": ["lan", "tailscale", "cloud-relay"],
"coverageNotes": "Deterministic TypeScript tests cover shared close-code policy, foreground retry timers, continuous-outage escalation, persistent pairing-rejection escalation, a bounded background Relay grace, direct-winner and background cancellation, credential-gated Relay presentation, and concurrent LAN/Tailscale authentication. Physical iOS/Android radios, GFE, and production relay recovery remain live-test gaps.",
"motivatingLinks": [
"https://github.com/stablyai/orca-cloud/pull/96",
"https://linear.app/stably/issue/STA-4587",
"https://linear.app/stably/issue/STA-4681"
],
"invariant": "A foregrounded paired phone must recover from relay HOST_OFFLINE without a foreground or network-change signal, while direct recovery must select the first authenticated configured LAN or Tailscale endpoint without serial timeout delays. Relay recovery presentation starts only for a failed active Relay or a dial backed by an eligible credential, remains pending through a genuine failed-dial cooldown, and exposes the supervisor's consecutive failed-dial count so a continuous outage escalates to unreachable. A relay credential the desktop keeps refusing escalates to re-pair once its transient-rejection budget is spent, and only an authenticated session clears that verdict. A healthy Relay survives backgrounding for at most 30 seconds and is reused on a quick foreground without redial; expiry, transport failure, direct success, or stop cancels the grace safely, late confirmation bookkeeping preserves lease rotation for a retained live Relay, and losing probes or replacements close without affecting the winner.",
"oracle": "Inject deterministic relay close codes, missing and expired credentials, delayed credential reads, random bytes, fake timers, suspended timers, stale callbacks, and independently controlled direct clients. Require HOST_OFFLINE to replace any faster transport timer with one 5-15 second retry, require no retry before the selected delay, keep Relay presentation absent when no socket can open, clear it across lifecycle races, retain it through real dial cooldowns, retain one healthy Relay through 29,999 milliseconds of background time without a new dial, close it exactly once at 30 seconds or on a later foreground when the timer was suspended, reject a stale expiry after foreground, recover a retained Relay transport failure only after foreground, resume a lease rotation that came due during the grace, arm a lease whose confirmation persistence finishes during the grace, and leave healthy direct sessions unchanged. Establish Relay through the supervisor and require its active close plus 11 failed replacements to publish reconnect attempt 12 and a Relay-unreachable verdict, race all unique non-relay endpoints, select the first authenticated path, close every loser exactly once, and retain no retry after direct connectivity wins. Drive a supervisor-established Relay through four simulated hours of E2EE rejections and require the re-pair verdict, require it to survive a background/foreground cycle, require two rejections followed by acceptance to never latch it, and require a plain transport outage to still read Relay-unreachable.",
"commands": [
"pnpm --dir mobile exec vitest run --root .. mobile/src/transport/mobile-direct-endpoint-probe.test.ts mobile/src/transport/mobile-relay-background-grace.test.ts mobile/src/transport/mobile-relay-background-lifecycle.test.ts mobile/src/transport/mobile-relay-reconnect-controller.test.ts mobile/src/transport/mobile-endpoint-supervisor.test.ts mobile/src/transport/mobile-endpoint-supervisor-nudge.test.ts mobile/src/transport/mobile-relay-outage-escalation.test.ts mobile/src/transport/mobile-relay-pairing-rejection-escalation.test.ts mobile/src/transport/stable-logical-rpc-client.test.ts mobile/src/transport/mobile-relay-runtime-failover.test.ts mobile/src/transport/connection-health.test.ts",
"pnpm --dir mobile exec vitest run --root .. mobile/src/transport/mobile-direct-endpoint-probe.test.ts mobile/src/transport/mobile-relay-reconnect-controller.test.ts mobile/src/transport/mobile-endpoint-supervisor.test.ts mobile/src/transport/mobile-relay-outage-escalation.test.ts mobile/src/transport/mobile-relay-pairing-rejection-escalation.test.ts mobile/src/transport/stable-logical-rpc-client.test.ts mobile/src/transport/mobile-relay-runtime-failover.test.ts mobile/src/transport/connection-health.test.ts",
"pnpm exec vitest run --config config/vitest.config.ts src/shared/mobile-relay-close-codes.test.ts --reporter=dot"
],
"testFiles": [
"mobile/src/transport/mobile-direct-endpoint-probe.test.ts",
"mobile/src/transport/mobile-relay-background-grace.test.ts",
"mobile/src/transport/mobile-relay-background-lifecycle.test.ts",
"mobile/src/transport/mobile-relay-reconnect-controller.test.ts",
"mobile/src/transport/mobile-endpoint-supervisor.test.ts",
"mobile/src/transport/mobile-endpoint-supervisor-nudge.test.ts",
"mobile/src/transport/mobile-relay-outage-escalation.test.ts",
"mobile/src/transport/mobile-relay-pairing-rejection-escalation.test.ts",
"mobile/src/transport/stable-logical-rpc-client.test.ts",
"mobile/src/transport/mobile-relay-runtime-failover.test.ts",
"mobile/src/transport/connection-health.test.ts",
"src/shared/mobile-relay-close-codes.test.ts"
],
"assertionRefs": [
{
"file": "mobile/src/transport/mobile-direct-endpoint-probe.test.ts",
"assertions": [
"a reachable Tailscale endpoint authenticates without waiting for a stale primary LAN timeout",
"the stale direct candidate closes while the authenticated winner stays open"
]
},
{
"file": "mobile/src/transport/mobile-relay-background-grace.test.ts",
"assertions": [
"the grace expires exactly once at 30 seconds",
"foreground deadline checks enforce expiry when the OS suspended the timer",
"a stale expiry callback cannot close a foreground connection"
]
},
{
"file": "mobile/src/transport/mobile-relay-background-lifecycle.test.ts",
"assertions": [
"a quick background round trip reuses Relay without a new dial",
"Relay closes exactly once at grace expiry and recovers only after foreground",
"foreground enforces an overdue grace when the OS suspended its timer",
"a retained Relay transport failure suspends without a background redial and recovers on foreground",
"a healthy direct connection is unchanged by the Relay-only grace",
"a lease rotation that becomes due during the grace starts promptly on foreground",
"lease rotation remains armed when confirmation persistence finishes during the grace"
]
},
{
"file": "mobile/src/transport/mobile-relay-reconnect-controller.test.ts",
"assertions": [
"HOST_OFFLINE replaces a pending capacity retry with the bounded host-offline delay",
"direct connectivity cancels the pending relay retry"
]
},
{
"file": "mobile/src/transport/mobile-endpoint-supervisor.test.ts",
"assertions": [
"a foregrounded supervisor retries HOST_OFFLINE without an external lifecycle signal",
"a missing or expired credential never presents a Relay connection that cannot start",
"backgrounding during credential selection cannot publish a stale Relay recovery path",
"a genuine failed Relay dial remains pending through its retry cooldown"
]
},
{
"file": "mobile/src/transport/mobile-endpoint-supervisor-nudge.test.ts",
"assertions": [
"a replacement Relay that authenticates after backgrounding withdraws without replacing the retained session"
]
},
{
"file": "mobile/src/transport/mobile-relay-outage-escalation.test.ts",
"assertions": [
"a supervisor-established Relay close plus 11 failed replacements publish reconnect attempt 12",
"the existing connection classifier escalates the continuous outage to Can't connect via Relay"
]
},
{
"file": "mobile/src/transport/mobile-relay-pairing-rejection-escalation.test.ts",
"assertions": [
"a persistent E2EE rejection escalates to Pairing invalid — re-pair with your desktop",
"the re-pair verdict survives a background/foreground cycle",
"rejections inside the transient budget followed by acceptance never latch it",
"a plain transport outage still reads Can't connect via Relay"
]
},
{
"file": "mobile/src/transport/connection-health.test.ts",
"assertions": [
"a rejected pairing outranks a pending Relay recovery",
"a rejected pairing never overrides a live connection"
]
},
{
"file": "mobile/src/transport/stable-logical-rpc-client.test.ts",
"assertions": [
"supervisor Relay attempts overlay but never replace a larger active-session retry count",
"count-only changes notify connection-path subscribers and clearing recovery restores the physical count"
]
},
{
"file": "mobile/src/transport/mobile-relay-runtime-failover.test.ts",
"assertions": [
"a fresh credential starts Relay presentation with the controller's current count",
"missing or expired credentials never open a Relay socket"
]
},
{
"file": "src/shared/mobile-relay-close-codes.test.ts",
"assertions": ["HOST_OFFLINE maps to self-healing full-jitter recovery"]
}
],
"evidenceRuns": [
{
"date": "2026-08-26",
"runner": "local",
"platform": "macos",
"command": "pnpm --dir mobile exec vitest run --root .. mobile/src/transport/mobile-direct-endpoint-probe.test.ts mobile/src/transport/mobile-relay-background-grace.test.ts mobile/src/transport/mobile-relay-background-lifecycle.test.ts mobile/src/transport/mobile-relay-reconnect-controller.test.ts mobile/src/transport/mobile-endpoint-supervisor.test.ts mobile/src/transport/mobile-endpoint-supervisor-nudge.test.ts mobile/src/transport/mobile-relay-outage-escalation.test.ts mobile/src/transport/mobile-relay-pairing-rejection-escalation.test.ts mobile/src/transport/stable-logical-rpc-client.test.ts mobile/src/transport/mobile-relay-runtime-failover.test.ts mobile/src/transport/connection-health.test.ts",
"result": "passed",
"durationSeconds": 1.15,
"summary": "Eleven focused mobile transport files passed with 135 assertions, including 30-second Relay retention, supervisor-level timer-suspension recovery, mid-grace transport failure, late-persistence lease rotation, manual retry, and direct-path non-regression."
},
{
"date": "2026-08-18",
"runner": "local",
"platform": "macos",
"command": "pnpm --dir mobile exec vitest run --root .. mobile/src/transport/mobile-direct-endpoint-probe.test.ts mobile/src/transport/mobile-relay-reconnect-controller.test.ts mobile/src/transport/mobile-endpoint-supervisor.test.ts mobile/src/transport/mobile-relay-outage-escalation.test.ts mobile/src/transport/mobile-relay-pairing-rejection-escalation.test.ts mobile/src/transport/stable-logical-rpc-client.test.ts mobile/src/transport/mobile-relay-runtime-failover.test.ts mobile/src/transport/connection-health.test.ts",
"result": "passed",
"durationSeconds": 1.25,
"summary": "Eight focused mobile transport files passed with 109 assertions, including production-lifecycle outage escalation, persistent pairing-rejection escalation, and logical count publication."
},
{
"date": "2026-08-16",
"runner": "local",
"platform": "macos",
"command": "pnpm exec vitest run --config config/vitest.config.ts src/shared/mobile-relay-close-codes.test.ts --reporter=dot",
"result": "passed",
"durationSeconds": 0.17,
"summary": "The shared close-code contract passed with five assertions."
}
],
"runtimeBudget": {
"p95Seconds": 5,
"scope": "focused shared and mobile transport unit tests"
},
"flakeHistory": {
"status": "unknown",
"evidence": "Two deterministic local runs exist; CI and soak history are not yet available."
},
"redGreenEvidence": {
"status": "complete",
"evidence": "On 2026-08-26, the unchanged immediate-teardown implementation failed the new supervisor oracle at the first 29,999-millisecond assertion because suspendActiveSession had already run once; the candidate retained Relay until the exact deadline and rejected stale or OS-suspended timer paths. The first grace candidate also failed the persistence-straddles-background oracle because only one Relay open occurred after the lease rotation deadline; scheduling from retained Relay liveness restores the required second open. Banking the pairing rejection after registerFailure's gated early return — the pre-fix placement — leaves the four-hour E2EE oracle on 'Connecting via Relay…' and reds 7 assertions while the 17 others stay green; moving it ahead of the gate turns them green. The pre-fix production-lifecycle oracle establishes Relay through the supervisor, then completes one active close plus 11 replacement failures while the public retry count remains 0; the candidate publishes 12 and reaches the existing Relay-unreachable verdict. The prior external-signal HOST_OFFLINE policy and serial direct probe also fail their respective retry and first-authenticated-endpoint timing oracles."
},
"performanceBudget": {
"required": true,
"evidence": "The background grace adds at most one one-shot timer and retains at most the already-active Relay splice for 30 seconds; it adds no polling, new dial, probe, listener, or wire API. A quick foreground performs zero Relay opens, while expiry closes once and opens no replacement until foreground. The deterministic outage asserts exactly one successful establishment plus 11 failed replacements at the escalation boundary. All configured direct candidates start in one turn, the first authenticated candidate wins after 100 ms, and every losing client is closed."
},
"promotionCriteria": [
"Collect 100 consecutive CI passes or 14 days of soak history.",
"Run paired iOS and Android recovery through production-like GFE HOST_OFFLINE responses.",
"Measure reconnect radio and battery impact for the 5-15 second foreground retry window."
],
"knownGaps": [
"No physical iOS or Android device was exercised.",
"The deterministic transport seam does not measure production GFE, carrier NAT, DNS, TLS, or Cloud SQL latency.",
"React Native timer suspension means the client enforces an overdue deadline on foreground but cannot guarantee server-side splice release at exactly 30 seconds while JavaScript is frozen.",
"Background-to-foreground recovery remains covered by supervisor tests but lacks a physical sleep/wake run."
],
"demotionRule": "Keep experimental or demote if focused tests flake, HOST_OFFLINE can park indefinitely, direct probes serialize configured endpoints, loser cleanup leaks clients, or physical-device radio cost exceeds the measured budget."
},
{
"id": "mobile-transport.lifecycle-liveness",
"title": "Wanted mobile hosts self-heal without false physical-session death",
"maturity": "experimental",
"protection": "partial",
"owner": "mobile-runtime",
"layer": "mobile-provider-and-physical-session-contract",
"surfaces": [
"mobile host acquisition",
"Keychain and Keystore catalog reads",
"direct LAN and Tailscale RPC",
"cloud relay RPC",
"foreground and network revival"
],
"platforms": ["ios", "android", "macos", "linux", "windows"],
"providers": ["lan", "tailscale", "cloud-relay"],
"coveredPlatforms": ["macos"],
"coveredProviders": ["lan", "tailscale", "cloud-relay"],
"coverageNotes": "Deterministic React/provider tests cover catalog, missing-host, construction, cancellation, release, forget, refresh, backoff, stale-generation outcomes, and path-aware recovery presentation. Direct sessions cover idle probing and three fair misses. Relay sessions cover zero idle polling, rate-limited foreground probes, two fair misses, authenticated activity before semantic decoding, delivery ambiguity, scheduler stalls, and write failure. Physical iOS/Android sleep, carrier/Tailscale loss, and production relay paths remain live-test gaps.",
"motivatingLinks": [
"https://linear.app/stably/issue/STA-4153/mobile-app-disconnects-frequently"
],
"invariant": "A provider-wanted host without a logical client retries every current-generation pre-client failure until success or explicit cancellation, while release, disconnect, forget, refresh, and stale async continuations preserve their distinct resurrection policies. Direct sessions probe after authenticated silence and terminate after three fair misses. Relay sessions emit no periodic idle or demand-driven probes, use rate-limited foreground probes, and terminate after two fair misses. Authenticated traffic, scheduler stalls, and replacement identities cannot manufacture death. Relay recovery must notify presentation independently of transport-state changes, must not inherit a failed direct path's Tailscale hint, and must retain long-outage escalation.",
"oracle": "Inject rejected and never-settling catalog reads, missing profiles, synchronous construction failure, release, refresh, forget, revival, and stale completion under fake time. Require bounded 1s through 60s retry, exact current-generation publication, and no zero-owner or forgotten-client resurrection. Inject direct and relay authenticated text/binary traffic, silent probe windows, stalled clocks, replacement identities, and failed writes. Require direct three-miss tolerance; Relay zero idle and demand-driven liveness traffic, one foreground probe sequence, two fair 4s misses, a 10s voluntary rate limit, no old-session network-change probe, and delivery-unknown mutations without replay. Start and clear Relay recovery without changing transport state and require observers to rerender. Project five failed Tailscale attempts into a neutral Relay-specific verdict, then require twelve attempts to produce a Relay-specific unreachable verdict with no Tailscale hint.",
"commands": [
"pnpm --dir mobile exec vitest run --root .. mobile/src/transport/client-context.test.ts mobile/src/transport/host-open-recovery.test.tsx mobile/src/transport/host-open-retry-scheduler.test.ts mobile/src/transport/rpc-session-liveness-watchdog.test.ts mobile/src/transport/rpc-session-liveness-integration.test.ts mobile/src/transport/mobile-relay-rpc-session.test.ts mobile/src/transport/mobile-relay-rpc-session-liveness.test.ts mobile/src/transport/mobile-endpoint-nudge-router.test.ts mobile/src/transport/mobile-relay-e2ee-link.test.ts mobile/src/transport/stable-logical-rpc-client.test.ts mobile/src/transport/connection-health.test.ts"
],
"testFiles": [
"mobile/src/transport/client-context.test.ts",
"mobile/src/transport/host-open-recovery.test.tsx",
"mobile/src/transport/host-open-retry-scheduler.test.ts",
"mobile/src/transport/rpc-session-liveness-watchdog.test.ts",
"mobile/src/transport/rpc-session-liveness-integration.test.ts",
"mobile/src/transport/mobile-relay-rpc-session.test.ts",
"mobile/src/transport/mobile-relay-rpc-session-liveness.test.ts",
"mobile/src/transport/mobile-endpoint-nudge-router.test.ts",
"mobile/src/transport/mobile-relay-e2ee-link.test.ts",
"mobile/src/transport/stable-logical-rpc-client.test.ts",
"mobile/src/transport/connection-health.test.ts"
],
"assertionRefs": [
{
"file": "mobile/src/transport/client-context.test.ts",
"assertions": [
"a retired close-on-release owner closes an ownerless manual reconnect",
"a Relay recovery path change rerenders observers without a transport-state change"
]
},
{
"file": "mobile/src/transport/host-open-recovery.test.tsx",
"assertions": [
"catalog, missing-host, and construction failures retry without remounting",
"final release and forget prevent later client publication",
"refresh bypasses a never-settling stale open and stale failure cannot clobber its replacement",
"revival expedites recovery without resetting the failure tier",
"a retired owner's release cannot cancel a newer owner's open",
"explicit reconnect demand survives a pre-client failure"
]
},
{
"file": "mobile/src/transport/rpc-session-liveness-watchdog.test.ts",
"assertions": [
"authenticated traffic resets the idle and missed-probe clocks",
"two fair misses are tolerated and the third terminates exactly once",
"scheduler stalls and replacement identities cannot terminate the current session",
"continuous authenticated traffic does not churn idle timers per frame"
]
},
{
"file": "mobile/src/transport/rpc-session-liveness-integration.test.ts",
"assertions": [
"direct handshake and probe write exceptions recover without escaping",
"one silent foreground window preserves the connected direct socket",
"authenticated terminal binary output restores direct-session liveness",
"a replay write failure retains every queued stream for the replacement session",
"liveness probe replies cannot consume the authentication retry budget"
]
},
{
"file": "mobile/src/transport/mobile-relay-rpc-session.test.ts",
"assertions": [
"written Relay requests retain delivery-unknown failures",
"resume confirmation and stream routing remain authenticated"
]
},
{
"file": "mobile/src/transport/mobile-relay-rpc-session-liveness.test.ts",
"assertions": [
"an idle Relay emits zero periodic traffic",
"RPCs and subscriptions after prolonged silence emit no liveness probe",
"foreground Relay liveness uses two fair 4-second misses and a 10-second sequence rate limit",
"network change does not probe the replaced Relay",
"a failed foreground probe write disconnects immediately"
]
},
{
"file": "mobile/src/transport/stable-logical-rpc-client.test.ts",
"assertions": [
"a delivery-unknown mutation is not replayed onto a replacement Relay",
"Relay recovery path changes publish and remain pending between failed dials",
"a connected path clears recovery state before any later disconnect"
]
},
{
"file": "mobile/src/transport/connection-health.test.ts",
"assertions": [
"a Relay fallback pending over five failed Tailscale attempts remains neutral and omits the Tailscale hint",
"a prolonged Relay recovery escalates without reviving the Tailscale hint"
]
}
],
"evidenceRuns": [
{
"date": "2026-08-16",
"runner": "local",
"platform": "macos",
"command": "pnpm --dir mobile exec vitest run --root .. mobile/src/transport/client-context.test.ts mobile/src/transport/host-open-recovery.test.tsx mobile/src/transport/host-open-retry-scheduler.test.ts mobile/src/transport/rpc-session-liveness-watchdog.test.ts mobile/src/transport/rpc-session-liveness-integration.test.ts mobile/src/transport/mobile-relay-rpc-session.test.ts mobile/src/transport/mobile-relay-rpc-session-liveness.test.ts mobile/src/transport/mobile-endpoint-nudge-router.test.ts mobile/src/transport/mobile-relay-e2ee-link.test.ts mobile/src/transport/stable-logical-rpc-client.test.ts mobile/src/transport/connection-health.test.ts",
"result": "passed",
"durationSeconds": 0.77,
"summary": "Eleven focused files passed 85 deterministic provider lifecycle, path presentation, direct/Relay liveness, traffic, and delivery-ambiguity tests."
}
],
"runtimeBudget": {
"p95Seconds": 5,
"scope": "focused mobile provider and transport unit tests"
},
"flakeHistory": {
"status": "unknown",
"evidence": "One deterministic local focused run exists; CI and soak history are not yet available."
},
"redGreenEvidence": {
"status": "complete",
"evidence": "Current main failed six deterministic assertions: terminal catalog failure, zero-owner publication, stale failure clobber, initial direct handshake write throw, one-window direct death, and foreground probe write throw. The candidate passes the same assertions and adds relay parity, backoff, cancellation, and scheduler-fairness coverage."
},
"performanceBudget": {
"required": true,
"evidence": "Each wanted clientless host owns at most one open and one retry timer with a 60-second capped tail. Direct sessions own one idle or probe timer. Idle Relay sessions own no liveness timer and emit no periodic or demand-driven liveness traffic; foreground sequences start at most once per 10 seconds. No subprocess, wire opcode, or server-side work is introduced."
},
"promotionCriteria": [
"Collect 100 consecutive CI passes or 14 days of soak history.",
"Capture the existing final-timeout log immediately before an affected-device drop.",
"Run physical iOS and Android direct LAN, Tailscale, relay, background/resume, and network-handoff journeys.",
"Measure reconnect radio and battery impact during the 60-second catalog retry tail, direct 44-second idle liveness budget, and Relay foreground probes."
],
"knownGaps": [
"No physical iOS or Android device was exercised.",
"No affected-device log yet proves the old one-window watchdog caused the reported live-session drop.",
"Carrier NAT, production Tailscale, production relay cells, and real scheduler suspension remain unmeasured.",
"Persistent pre-client failure metadata is not yet exposed in Home UI."
],
"demotionRule": "Keep experimental or demote if a wanted host can park without retry, stale work can publish or notify, disconnect or forget resurrects a host, direct closes before three fair misses, Relay polls while idle or on demand, survives two fair foreground misses, authenticated traffic fails to restore health, timers leak across identity replacement, mutations replay after ambiguous delivery, or physical-device radio cost exceeds the measured budget."
},
{
"id": "desktop-relay.assignment-backpressure",
"title": "Desktop relay drain recovery cannot amplify a director outage",
"maturity": "experimental",
"protection": "partial",
"owner": "desktop-runtime",
"layer": "main-relay-state-machine",
"surfaces": [
"desktop relay drain recovery",
"director assignment overload",
"relay broker shutdown"
],
"platforms": ["macos", "linux", "windows"],
"providers": ["cloud-relay"],
"coveredPlatforms": ["macos"],
"coveredProviders": ["cloud-relay"],
"coverageNotes": "Deterministic main-process tests cover duplicate drain notifications, full-jitter backoff, Retry-After during initial setup and drain recovery, successful recovery, and broker-close cleanup. Packaged desktop, mixed-version fleets, GFE, and production Cloud SQL remain live-test gaps.",
"motivatingLinks": ["https://github.com/stablyai/orca-cloud/actions/runs/30223521062"],
"invariant": "One relay host may have at most one assignment attempt or retry timer per recovery path. Sustained director failure must increase the retry window up to five minutes, a bounded Retry-After must be respected during initial setup and drain recovery, shutdown must cancel pending work, and recovery must activate the authoritative assigned origin.",
"oracle": "Inject duplicate drain events, deterministic randomness, fake time, repeated assignment failures, a 30-second Retry-After during initial setup and drain recovery, broker close, and eventual director recovery. Count every assignment call, require 500 ms then 1,000 ms retry windows, reject duplicate fanout, require no pre-hint retry or post-close work, and prove the recovered cell becomes authoritative.",
"commands": [
"pnpm exec vitest run --config config/vitest.config.ts src/main/runtime/relay/relay-session-broker.test.ts src/main/runtime/relay/relay-http-client.test.ts src/main/runtime/relay/relay-auth-coordinator-recovery.test.ts --reporter=dot"
],
"testFiles": [
"src/main/runtime/relay/relay-session-broker.test.ts",
"src/main/runtime/relay/relay-http-client.test.ts",
"src/main/runtime/relay/relay-auth-coordinator-recovery.test.ts"
],
"assertionRefs": [
{
"file": "src/main/runtime/relay/relay-session-broker.test.ts",
"assertions": [
"duplicate drain notifications share one exponentially backed-off retry schedule",
"Retry-After suppresses early assignment requests",
"broker close prevents retry resurrection",
"a later successful assignment activates the new origin"
]
},
{
"file": "src/main/runtime/relay/relay-http-client.test.ts",
"assertions": ["assignment overload preserves a bounded Retry-After hint"]
},
{
"file": "src/main/runtime/relay/relay-auth-coordinator-recovery.test.ts",
"assertions": ["initial relay setup does not retry before Retry-After expires"]
}
],
"evidenceRuns": [
{
"date": "2026-07-26",
"runner": "local",
"platform": "macos",
"command": "pnpm exec vitest run --config config/vitest.config.ts src/main/runtime/relay/relay-session-broker.test.ts src/main/runtime/relay/relay-http-client.test.ts src/main/runtime/relay/relay-auth-coordinator-recovery.test.ts --reporter=dot",
"result": "passed",
"durationSeconds": 0.49,
"summary": "Three focused relay files passed with 25 assertions."
}
],
"runtimeBudget": {
"p95Seconds": 5,
"scope": "focused desktop relay state-machine tests"
},
"flakeHistory": {
"status": "unknown",
"evidence": "One deterministic local run exists; CI and soak history are not yet available."
},
"redGreenEvidence": {
"status": "complete",
"evidence": "The prior fixed-delay implementation issued a duplicate assignment within 499 ms and ignored Retry-After, while the candidate passes the byte-identical timer and call-count oracle."
},
"performanceBudget": {
"required": true,
"evidence": "One host retains at most one assignment attempt or retry timer, retry windows grow to a five-minute cap, duplicate drain events add no calls, and close leaves no timer-driven work."
},
"promotionCriteria": [
"Collect 100 consecutive CI passes or 14 days of soak history.",
"Run a mixed-version load test with at least the incident-scale desktop population.",
"Verify production director request rate decays during an injected assignment outage."
],
"knownGaps": [
"No packaged desktop or physical phone was exercised.",
"The deterministic seam does not measure production GFE, carrier NAT, DNS, TLS, or Cloud SQL behavior.",
"Legacy desktop versions remain dependent on server-side overload protection."
],
"demotionRule": "Keep experimental or demote if assignment calls overlap, duplicate drain events bypass backoff, Retry-After is ignored, close resurrects work, or mixed-version request rate exceeds the reviewed director budget."
},
{
"id": "git-worktree.refresh-event-semantics",
"title": "Index-only Git metadata cannot trigger structural worktree refresh fanout",
"maturity": "experimental",
"protection": "partial",
"owner": "terminal-runtime",
"layer": "main-preload-renderer-contract",
"surfaces": [
"terminal input availability",
"worktree discovery",
"Source Control status refresh",
"direct SSH detected-worktree scheduling",
"direct SSH reconnect telemetry",
"direct SSH host catalog authority",
"direct SSH generation-scope rollover"
],
"platforms": ["macos", "linux", "windows"],
"providers": ["local", "ssh"],
"coveredPlatforms": ["macos"],
"coveredProviders": ["local", "ssh"],
"coverageNotes": "Local deterministic evidence covers git-common classification, desktop watcher debounce counts, non-overlapping poller semantics, macOS native-watch fallback, preload cleanup, Source Control active-visible repo filtering, the direct SSH five-slot fair scheduler, timeout barrier, aggregate privacy schema, coordinator-to-renderer telemetry wiring, host-catalog provenance rejection, and process generation-scope rollover across sibling targets. A macOS Electron client completed a direct SSH disconnect/reconnect against an ephemeral Linux Docker target with exact host/authority hydration and remote proof-file verification. Linux/Windows desktop clients, multi-target live fanout, paired-client, and WSL runs remain gaps.",
"motivatingLinks": ["https://github.com/stablyai/orca/pull/7086"],
"invariant": "Index-only Git activity below the common Git directory must not emit worktrees:changed, invalidate worktree caches, or trigger fetchWorktrees fanout; structural add/remove/HEAD/gitdir/locked/config.worktree changes must still refresh worktrees and nudge Source Control; external head moves (commit, amend, reset) must reach background worktree rows through spawn-free metadata reads, never through structural fanout. Direct SSH reconnect discovery must stay host- and authority-qualified, reject contradictory main-catalog provenance without returning rows, admit at most five locally unsettled provider calls, retain a retrying timeout barrier, and emit one identifier-free aggregate product event per target operation. A process generation-scope rollover revokes every direct SSH target and old-scope provider request, not only the target whose counter exhausted.",
"oracle": "Classify exact git-common paths as structural, status-only, or ignored; count notifications from debounced watcher events; force the Linux/Windows poll path to emit allowlisted leaf events, detect linked HEAD rewrites independent of entry-directory mtime, and surface in-place index rewrites via the backstop re-stat; diff head identities from metadata-file reads and notify only real head moves; assert Source Control subscribes to both structural and status-only signals with active-repo and visibility filters. For direct SSH, reject catalog rows whose explicit and legacy host provenance contradict, roll one exhausted target into a fresh process generation scope while invalidating sibling target tokens, count locally unsettled attempts and round-robin admissions, keep lineage blocked through the first timeout retry, distinguish timeout/rejection/cancel/stale results, and reject telemetry properties carrying target, repo, host, path, label, user, request, lease, terminal, or raw-error data.",
"commands": [
"pnpm exec vitest run --config config/vitest.config.ts src/main/ipc/worktree-base-directory-event-filter.test.ts src/main/ipc/worktree-base-directory-watcher.test.ts src/main/ipc/worktree-base-directory-poller.test.ts src/main/ipc/worktree-head-identity-reader.test.ts src/renderer/src/hooks/worktree-head-identity-apply.test.ts src/renderer/src/components/right-sidebar/git-status-push-signal-refresh.test.ts src/renderer/src/hooks/useIpcEvents-browser-tab-create.test.ts",
"pnpm exec vitest run --config config/vitest.config.ts src/main/ipc/repos-remote.test.ts src/main/ssh/ssh-connection-generation.test.ts src/main/ssh/ssh-provider-authority.test.ts --reporter=dot",
"pnpm exec vitest run --config config/vitest.config.ts src/shared/direct-ssh-reconnect-telemetry-schema.test.ts src/renderer/src/lib/direct-ssh-reconnect-product-telemetry.test.ts src/renderer/src/hooks/direct-ssh-worktree-refresh-scheduler.test.ts src/renderer/src/hooks/direct-ssh-reconnect-coordinator.test.ts src/renderer/src/hooks/useIpcEvents-agent-status-ssh-authority.test.ts --reporter=dot",
"ORCA_E2E_SSH_DOCKER=1 SKIP_BUILD=1 pnpm exec playwright test tests/e2e/ssh-docker-relay-perf.spec.ts --config tests/playwright.config.ts --project electron-headless --workers=1"
],
"testFiles": [
"src/main/ipc/worktree-base-directory-event-filter.test.ts",
"src/main/ipc/worktree-base-directory-watcher.test.ts",
"src/main/ipc/worktree-base-directory-poller.test.ts",
"src/main/ipc/worktree-head-identity-reader.test.ts",
"src/renderer/src/hooks/worktree-head-identity-apply.test.ts",
"src/renderer/src/components/right-sidebar/git-status-push-signal-refresh.test.ts",
"src/renderer/src/hooks/useIpcEvents-browser-tab-create.test.ts",
"src/renderer/src/hooks/useIpcEvents-agent-status-ssh-authority.test.ts",
"src/main/ipc/repos-remote.test.ts",
"src/main/ssh/ssh-connection-generation.test.ts",
"src/main/ssh/ssh-provider-authority.test.ts",
"src/shared/direct-ssh-reconnect-telemetry-schema.test.ts",
"src/renderer/src/lib/direct-ssh-reconnect-product-telemetry.test.ts",
"src/renderer/src/hooks/direct-ssh-worktree-refresh-scheduler.test.ts",
"src/renderer/src/hooks/direct-ssh-reconnect-coordinator.test.ts",
"tests/e2e/ssh-docker-relay-perf.spec.ts"
],
"assertionRefs": [
{
"file": "src/main/ipc/worktree-base-directory-event-filter.test.ts",
"assertions": [
"primary HEAD and packed-refs classify as structural while primary index classifies as status-only",
"linked HEAD/gitdir/locked classify as structural while linked index classifies as status-only",
"HEAD reflog appends classify as status-only for linked and primary checkouts while per-ref reflogs stay ignored",
"config.worktree classifies as structural at both linked and primary levels",
"ignored common-dir churn, spaces, Windows separators, and outside-root paths do not match structurally"
]
},
{
"file": "src/main/ipc/worktree-base-directory-watcher.test.ts",
"assertions": [
"linked index bursts produce zero notifyWorktreesChanged calls and one debounced status-only notification",
"linked HEAD and locked metadata still produce a structural worktree notification",
"status-only head moves emit head identities without structural fanout and only when heads actually changed",
"structural notifications re-baseline head identities silently and SSH watches never read identities",
"SSH-shaped index renames are status-only while overflow remains conservatively structural"
]
},
{
"file": "src/main/ipc/worktree-base-directory-poller.test.ts",
"assertions": [
"non-darwin git-common polling emits entry create/delete and allowlisted HEAD/index leaf events",
"linked HEAD rewrites are detected even after restoring the entry-directory mtime",
"linked and primary HEAD reflog appends emit despite bumping no watched leaf or entry dir",
"in-place index rewrites surface through the periodic backstop re-stat",
"primary checkout HEAD changes and macOS narrow watch/fallback behavior still emit"
]
},
{
"file": "src/renderer/src/components/right-sidebar/git-status-push-signal-refresh.test.ts",
"assertions": [
"Source Control nudges only for the active visible repo on structural and status-only signals",
"preload subscriptions and terminal command-finished listeners are cleaned up"
]
},
{
"file": "src/main/ipc/worktree-head-identity-reader.test.ts",
"assertions": [
"loose-ref, packed-refs, detached, unborn, and relative-gitdir layouts resolve or skip without spawning Git",
"traversal-shaped or backslash/colon symrefs are rejected before any path join and only hex object ids are ever emitted"
]
},
{
"file": "src/renderer/src/hooks/worktree-head-identity-apply.test.ts",
"assertions": [
"head identities patch matching rows by path (including Windows separator/casing drift) and skip unknown rows"
]
},
{
"file": "src/renderer/src/hooks/useIpcEvents-browser-tab-create.test.ts",
"assertions": [
"renderer preload API fixtures include the status-metadata and head-identity subscription contracts"
]
},
{
"file": "src/renderer/src/hooks/useIpcEvents-agent-status-ssh-authority.test.ts",
"assertions": [
"direct SSH coordinator telemetry is wired through the fail-soft product adapter"
]
},
{
"file": "src/main/ipc/repos-remote.test.ts",
"assertions": [
"a host-qualified catalog rejects contradictory executionHostId and connectionId provenance without returning rows",
"local, sibling SSH, and runtime rows remain excluded from the exact direct SSH catalog"
]
},
{
"file": "src/main/ssh/ssh-connection-generation.test.ts",
"assertions": [
"one exhausted target rolls the process generation scope and invalidates every sibling target token",
"old-scope mutation expectations fail while the new-scope authority continues rotating"
]
},
{
"file": "src/main/ssh/ssh-provider-authority.test.ts",
"assertions": [
"generation-scope rollover invalidates every target authority before abort callbacks run",
"every registered old-scope provider request aborts exactly once"
]
},
{
"file": "src/renderer/src/hooks/direct-ssh-worktree-refresh-scheduler.test.ts",
"assertions": [
"coordinator-owned locally unsettled provider work never exceeds five and target lanes round-robin",
"the first timeout remains retrying and reports queue wait separately from provider execution",
"cancel debt admits at most two replacements and terminally distinguishes budget exhaustion"
]
},
{
"file": "src/renderer/src/hooks/direct-ssh-reconnect-coordinator.test.ts",
"assertions": [
"lineage and token creation remain blocked until a timed-out repo retry settles",
"exact overlapping preparation emits one aggregate with a join count",
"telemetry callback failure cannot affect reconnect completion"
]
},
{
"file": "src/shared/direct-ssh-reconnect-telemetry-schema.test.ts",
"assertions": [
"timeout, rejection, cancellation, and stale outcomes have independent fields",
"target, repo, host, path, label, user, request, lease, terminal, and raw-error fields are rejected"
]
},
{
"file": "src/renderer/src/lib/direct-ssh-reconnect-product-telemetry.test.ts",
"assertions": [
"one coordinator aggregate maps to one typed product event with queue and provider percentiles",
"adapter failure is swallowed before it can reach recovery"
]
},
{
"file": "tests/e2e/ssh-docker-relay-perf.spec.ts",
"assertions": [
"repo and worktree hydration use the exact direct SSH host and complete provider authority",
"terminal input remains live after disconnect/reconnect and writes a proof file visible inside the Linux target"
]
}
],
"evidenceRuns": [
{
"date": "2026-07-12",
"runner": "local",
"platform": "macos",
"command": "pnpm exec vitest run --config config/vitest.config.ts src/main/ipc/worktree-base-directory-event-filter.test.ts src/main/ipc/worktree-base-directory-watcher.test.ts src/main/ipc/worktree-base-directory-poller.test.ts src/main/ipc/worktree-head-identity-reader.test.ts src/renderer/src/hooks/worktree-head-identity-apply.test.ts src/renderer/src/components/right-sidebar/git-status-push-signal-refresh.test.ts src/renderer/src/hooks/useIpcEvents-browser-tab-create.test.ts",
"result": "passed",
"durationSeconds": 3.12,
"summary": "7 files and 130 tests passed locally, adding head-identity emit-on-change without structural fanout, reflog status triggers, config.worktree structural classification, the in-place index backstop, and the spawn-free head reader with symref traversal rejection and hex-object-id output validation."
},
{
"date": "2026-07-27",
"runner": "local",
"platform": "macos",
"command": "pnpm exec vitest run --config config/vitest.config.ts src/main/ipc/repos-remote.test.ts src/main/ssh/ssh-connection-generation.test.ts src/main/ssh/ssh-provider-authority.test.ts --reporter=dot",
"result": "passed",
"durationSeconds": 1.61,
"summary": "Three main-process catalog and authority files passed with 118 tests, including contradictory catalog provenance rejection and all-target generation-scope revocation."
},
{
"date": "2026-07-27",
"runner": "local",
"platform": "macos",
"command": "pnpm exec vitest run --config config/vitest.config.ts src/shared/direct-ssh-reconnect-telemetry-schema.test.ts src/renderer/src/lib/direct-ssh-reconnect-product-telemetry.test.ts src/renderer/src/hooks/direct-ssh-worktree-refresh-scheduler.test.ts src/renderer/src/hooks/direct-ssh-reconnect-coordinator.test.ts src/renderer/src/hooks/useIpcEvents-agent-status-ssh-authority.test.ts --reporter=dot",
"result": "passed",
"durationSeconds": 3.45,
"summary": "Five focused direct SSH scheduler, coordinator, telemetry, and hook-wiring files passed with 130 tests."
},
{
"date": "2026-07-27",
"runner": "local",
"platform": "macos",
"command": "ORCA_E2E_SSH_DOCKER=1 SKIP_BUILD=1 pnpm exec playwright test tests/e2e/ssh-docker-relay-perf.spec.ts --config tests/playwright.config.ts --project electron-headless --workers=1",
"result": "passed",
"durationSeconds": 66,
"summary": "Four Electron Docker SSH tests passed: two typing/performance paths, one concurrent file/Git load path, and exact-authority disconnect/reconnect with a container-visible remote proof file."
}
],
"runtimeBudget": {
"p95Seconds": 15,
"scope": "focused main/preload/renderer polling and direct SSH scheduler/telemetry tests"
},
"flakeHistory": {
"status": "unknown",
"evidence": "Three deterministic local macOS runs cover the original watcher lane, main catalog/authority lane, and direct SSH scheduler/telemetry lane; CI soak is still unavailable."
},
"redGreenEvidence": {
"status": "partial",
"evidence": "The watcher count assertions fail against the old single-signal classifier because linked index events call notifyWorktreesChanged. The direct SSH tests encode failures for unbounded admission, early lineage release, merged timeout/rejection/cancel/stale results, identifier-bearing telemetry, duplicate joined events, and telemetry exceptions, but no intentional-break artifact was run or claimed; saved red/green artifacts are still needed before blocking promotion."
},
"performanceBudget": {
"required": true,
"evidence": "Index-only bursts produce zero structural notifications, so renderer fetchWorktrees and detected-worktree cache invalidation are not reached. The non-darwin poller stays bounded and non-overlapping. Direct SSH coordinator-owned detected-worktree work is capped at five locally unsettled calls with a two-call late-work allowance; terminal finalization precedes provider discovery, and queue wait and provider execution are reported separately. A 30-second live Electron run with 2,000 external linked-status calls delivered 50 ordered input chunks and recorded zero Orca-owned git worktree spawns across six diagnostic windows; no equivalent live direct SSH fanout benchmark is claimed."
},
"promotionCriteria": [
"Run in soak for at least 100 consecutive passes or 14 days across required CI platforms.",
"Attach live Electron main-thread diagnostic evidence for repeated linked-worktree index rewrites while typing.",
"Add Linux/Windows live watcher evidence if shared poller-layer coverage diverges from platform behavior."
],
"knownGaps": [
"The live Electron diagnostic and screenshot evidence must remain attached to the motivating PR for durable review.",
"Linux and Windows are forced through the shared non-darwin poller in unit tests but are not live-tested here.",
"Git loose ref watching remains outside this incident fix by design.",
"SSH watches classify head-move triggers but skip the metadata-read identity diff; remote background-worktree heads still wait on a structural event or activation.",
"The Docker/Linux journey covers one direct SSH target; a live multi-target fanout and large-catalog benchmark remains missing.",
"Paired web clients intentionally do not run the desktop direct SSH coordinator, and paired-close non-interference lacks a new live run.",
"WSL direct SSH fanout remains an explicit live-test gap rather than inferred coverage."
],
"demotionRule": "Keep experimental or demote if the focused gate flakes without a product or harness bug, if index-only churn can emit worktrees:changed, or if structural add/remove/HEAD/lock changes fail to converge."
},
{
"id": "runtime.multi-client-view-isolation",
"title": "A client's workspace create navigates only the caller unless follow is explicit",
"maturity": "experimental",
"protection": "partial",
"owner": "runtime-platform",
"layer": "runtime-client-event-authority",
"surfaces": [
"paired desktop client",
"paired web client",
"headed Orca desktop server",
"headless orca serve",
"worktree.create with activate",
"runtime.clientEvents stream"
],
"platforms": ["macos", "linux", "windows"],
"providers": ["local", "orca-server"],
"coveredPlatforms": ["macos"],
"coveredProviders": ["local", "orca-server"],
"coverageNotes": "A real two-client integration harness pairs two authenticated devices to one OrcaRuntimeService over WebSockets with E2EE and drives worktree.create through the real RPC dispatcher, in both headed-notifier and headless orca-serve shapes. The headless case is a modeled `orca serve` runtime shape — no notifier, no attached window — not a CLI bootstrap, and the in-process reveal non-regression calls createManagedWorktree directly. A headed Electron journey runs the desktop app as the remote server with two independently paired web clients in separate partitions and asserts each client's rendered active worktree. Windows and Linux are covered by the platform-neutral contract only; the reported field topology was a Windows server with mixed-OS clients.",
"motivatingLinks": ["https://github.com/stablyai/orca/issues/11027"],
"invariant": "View intent belongs to the connection that requested it. With no explicit navigation target, a workspace create arriving over a paired desktop/web client connection activates only that caller; it must not emit an activateWorktree client event to sibling connections or drive the host renderer. An explicit navigation of host/clients/all remains an allowed, tested follow intent. Shared model state — repo/worktree catalogs, terminals, agent output — must keep propagating to every client unchanged. In-process and CLI creates keep notifying the host and all clients so a headless server's only viewer still gets its reveal.",
"oracle": "notifyActivateWorktree takes its navigation target as a required parameter, so a create call site that forgets to forward it is a compile error rather than a silent fallback to broadcasting — mutation testing confirmed all six call sites (folder, git, and remote/SSH branches, startup and no-startup each) are killed by typecheck. Behaviorally: two paired clients subscribe to runtime.clientEvents. Client A creates a workspace with activate:true; a reposChanged fence emitted after the create must be the next frame each client sees, proving no activation frame was interleaved, while worktreesChanged still arrives on both streams. The host notifier's activateWorktree is asserted not called and the host's mirrored selection is unchanged. Repeated ordinary worktree.activate calls by A are the negative control. The same file asserts the in-process create still reaches host and clients, headed and headless. The Electron journey asserts the observer's data-rendered-active-worktree-id is unchanged while the created workspace still appears in its sidebar.",
"commands": [
"pnpm exec vitest run --config config/vitest.config.ts src/main/runtime/multi-client-navigation-isolation.integration.test.ts src/main/runtime/rpc/methods/worktree-create-navigation.test.ts",
"pnpm run test:e2e:multi-client-navigation -- tests/e2e/multi-client-navigation-isolation.spec.ts"
],
"testFiles": [
"src/main/runtime/multi-client-navigation-isolation.integration.test.ts",
"src/main/runtime/rpc/methods/worktree-create-navigation.test.ts",
"tests/e2e/multi-client-navigation-isolation.spec.ts"
],
"assertionRefs": [
{
"file": "src/main/runtime/multi-client-navigation-isolation.integration.test.ts",
"assertions": [
"keeps a paired client workspace create-with-activate off every other client and the host",
"still reveals to every client when a paired caller asks for all-surface navigation",
"does not replay a missed create activation to a reconnecting observer",
"keeps create activation caller-scoped on a headless orca serve host",
"still reveals a host-originated create-with-activate on the host and every client",
"keeps worktree navigation local to each paired runtime client by default",
"routes explicit host and paired-client follow intent without changing the default"
]
},
{
"file": "src/main/runtime/rpc/methods/worktree-create-navigation.test.ts",
"assertions": [
"resolves create activation from the paired runtime client kind",
"resolves create activation from the paired mobile client kind",
"honors an explicit follow navigation on create",
"keeps an explicit all-surface reveal from a paired caller"
]
},
{
"file": "tests/e2e/multi-client-navigation-isolation.spec.ts",
"assertions": [
"keeps a paired client workspace create-with-agent off the other client and the host",
"keeps two paired browser clients and the host on independent worktrees"
]
}
],
"evidenceRuns": [
{
"date": "2026-08-18",
"runner": "local",
"platform": "macos",
"command": "pnpm exec vitest run --config config/vitest.config.ts src/main/runtime/multi-client-navigation-isolation.integration.test.ts src/main/runtime/rpc/methods/worktree-create-navigation.test.ts",
"result": "passed",
"durationSeconds": 6,
"summary": "Eleven paired-runtime contracts pass, including the headless orca-serve shape, the in-process reveal non-regression, and the CLI-shaped explicit all-surface reveal. With the caller scoping removed the observer's stream carried activateWorktree instead of the fence."
},
{
"date": "2026-08-18",
"runner": "local",
"platform": "macos",
"command": "pnpm run test:e2e:multi-client-navigation -- tests/e2e/multi-client-navigation-isolation.spec.ts",
"result": "passed",
"durationSeconds": 80,
"summary": "Headed Orca desktop server with two paired web clients: the observer stayed on its own worktree while the creator's workspace appeared in its sidebar. With the fix disabled the same journey failed with the observer rendering the created workspace."
}
],
"runtimeBudget": {
"p95Seconds": 120,
"scope": "two-client WebSocket integration contracts plus one headed Electron two-web-client journey"
},
"flakeHistory": {
"status": "unknown",
"evidence": "New contracts. The integration file is fence-ordered rather than timing-based and passed repeatedly locally; the Electron journey passed twice locally on macOS. CI and soak history have not started."
},
"redGreenEvidence": {
"status": "complete",
"evidence": "Both layers were observed red on origin/main 4ec6bbf588 before any fix: the observer client received ['worktreesChanged', 'activateWorktree'] instead of the fence, and the Electron observer's data-rendered-active-worktree-id resolved to the workspace the other client had just created. Both went green with the caller scoping and red again when only resolveRuntimeNavigationTarget's clientKind input was removed."
},
"performanceBudget": {
"required": false,
"evidence": "The change adds one enum resolution per create request and two boolean checks before an existing fan-out. No new listeners, subscriptions, provider calls, or timers; the client-event fan-out itself is unchanged in shape and frequency."
},
"promotionCriteria": [
"Collect CI soak history for the Electron journey on macOS plus at least one Linux run.",
"Add a live Windows-server topology run matching the reported field setup.",
"Extend the oracle to mobile observers and to a client with two windows open on one connection."
],
"knownGaps": [
"No live Windows or Linux server run yet; the reported field topology was a Windows 11 server.",
"Mobile observers are covered only by the platform-neutral clientKind contract, not by a live phone journey.",
"Host-originated CLI creates deliberately still reveal on every client; that broader authority question is untouched by this gate.",
"Mobile creates deliberately keep the all-surface reveal: a phone has no renderer to provision repo setup/default tabs off the activation event.",
"The Electron journey drives the store create action, so the composer's automatic self-navigation on create is proved by worktree-creation-flow.test.ts and worktree.spec.ts rather than by this journey.",
"Headless coverage is a modeled runtime shape; CLI bootstrap and argument parsing for orca serve are not exercised here.",
"Host-first rollout: the fix is enforced by the host, so a NEW client paired to an OLD always-on server still sees the original cross-client jump. Shipping clients alone fixes nothing for anyone; the runtime/server must be updated. Nothing breaks under that skew — the old host simply keeps its old behavior — but release notes and support triage must check the host version, not the client version. No skew combination is worse than pre-fix main: an old CLI is recognized by its cliProvenanceRequest marker so its --activate reveal survives an updated host.",
"A future contributor could still hardcode a wrong navigation target at a call site: the required object key makes omission a compile error, but not substitution. Only the folder/no-startup branch has a behavioral test that would catch it; adding one for the remote/SSH branch needs new SSH provider scaffolding and was judged not worth the surface.",
"Out of scope, host-only and unreachable from the product UI: a paired caller that explicitly requests terminal.create with presentation 'focused' still navigates the host renderer (the Orca client always sends 'background'); agent-session already downgrades that presentation for paired callers.",
"The remote/SSH create branch (createManagedRemoteWorktree) has compile-time propagation coverage but no behavioral navigation test; the folder branch is covered by the integration suite and the git branch by the Electron journey.",
"Out of scope: browser.tabCreate/tabSwitch carry no paired-client navigation policy, so they can change the host's active browser tab when the host is already on that worktree. They never cross worktrees, and the paired web client sends activate:true deliberately."
],
"demotionRule": "Demote if a create, activate, or reveal path can move a viewer that did not request it, or if scoping regresses the in-process/CLI reveal that a headless server's only remote viewer depends on."
},
{
"id": "runtime.headless-desktop-promotion-continuity",
"title": "Headless serve opens its desktop without replacing live terminal sessions",
"maturity": "experimental",
"protection": "partial",
"owner": "runtime-platform",
"layer": "electron-runtime-contract",
"surfaces": [
"headless orca serve",
"single-instance desktop activation",
"CLI open",
"persistent terminal reattach",
"update install handoff"
],
"platforms": ["macos", "linux", "windows"],
"providers": ["local", "daemon", "ssh"],
"coveredPlatforms": ["macos"],
"coveredProviders": ["local", "daemon", "ssh"],
"coverageNotes": "Deterministic unit coverage exercises activation gating, single-instance ownership, quit policy, local/remote CLI status, headless binding persistence, local daemon identity, SSH identity transfer, the promoted renderer's agent-resume accounting, and the macOS serve update handoff from staged installer through atomic bundle replacement and target-version readiness. A macOS Electron journey covers headless promotion and persistent PTY identity. A disposable locally signed Electron canary exercised real ShipIt and a temporary LaunchAgent with the compiled production supervisor; full packaged Orca and Linux/Windows serve updates remain uncollected.",
"motivatingLinks": [
"https://github.com/stablyai/orca/issues/8457",
"https://github.com/stablyai/orca/issues/9563"
],
"invariant": "A safely promotable headless serve process is the single app owner. Desktop activation preserves its daemon-backed sessions. On macOS, a CLI-supervised serve update keeps the node-mode parent alive across ShipIt's atomic bundle swap, restarts with the original serve arguments only after the target bundle is present, and clears handoff state only after that target version reports runtime readiness. Unsupported or failed handoffs leave the current serving owner intact or recover it once without an install retry loop.",
"oracle": "Unit tests coalesce early activation, preserve daemon and SSH identity, and reproduce the update race with a staged target, old serving child, persistent CLI parent, atomic .app replacement, and replacement readiness message. They assert the parent does not exit for launchd to respawn the old app, the native updater does not launch an interactive GUI, the replacement version is verified before handoff completion, mismatches become durable failures without retries, and unsupported/preflight-failed installs do not invoke native quit or PTY cleanup. A joined lock-owner/activation/hydration contract asserts that a forced relaunch opens exactly one window and that the renderer promoted inside the serve process launches zero agent resumes, creates no replacement tab or startup command, and leaves every surviving session record untouched. The Electron journey independently verifies headless promotion retains owner/runtime/daemon/PTY identity and terminal I/O.",
"commands": [
"pnpm exec vitest run --config config/vitest.config.ts src/cli/runtime/launch.test.ts src/main/serve-update-handoff.test.ts src/main/updater.headless-serve-install.test.ts src/main/updater.test.ts src/main/updater.mac-install.test.ts src/main/window/attach-main-window-services.test.ts src/main/startup/serve-desktop-activation-wiring.test.ts",
"pnpm exec vitest run --config config/vitest.config.ts src/main/startup/serve-desktop-activation.test.ts src/main/startup/serve-desktop-activation-wiring.test.ts src/main/startup/single-instance-lock.test.ts src/main/startup/window-all-closed-quit-policy.test.ts src/cli/runtime-client.test.ts src/cli/runtime/websocket-transport.test.ts src/main/runtime/orca-runtime.test.ts",
"pnpm exec vitest run --config config/vitest.config.ts src/renderer/src/lib/serve-desktop-promotion-session-continuity.test.ts",
"pnpm exec electron-vite build --mode e2e",
"pnpm run test:e2e -- tests/e2e/headless-serve-desktop-activation.spec.ts --workers=1"
],
"testFiles": [
"src/main/updater.headless-serve-install.test.ts",
"src/main/serve-update-handoff.test.ts",
"src/cli/runtime/launch.test.ts",
"src/main/startup/serve-desktop-activation.test.ts",
"src/main/startup/serve-desktop-activation-wiring.test.ts",
"src/main/startup/single-instance-lock.test.ts",
"src/main/startup/window-all-closed-quit-policy.test.ts",
"src/cli/runtime-client.test.ts",
"src/cli/runtime/websocket-transport.test.ts",
"src/main/runtime/orca-runtime.test.ts",
"src/renderer/src/lib/serve-desktop-promotion-session-continuity.test.ts",
"tests/e2e/headless-serve-desktop-activation.spec.ts"
],
"assertionRefs": [
{
"file": "src/main/updater.headless-serve-install.test.ts",
"assertions": [
"a ready update in headless serve is deferred before native install, paired-client disconnect, or active-session cleanup",
"a supervised serve persists handoff after checkpoints but before native quit and uses no native GUI relaunch",
"unsupported serve refuses updater staging and install-on-quit while preserving availability checks",
"a failed handoff preflight preserves the serving owner before native quit or PTY cleanup",
"macOS installer-readiness timeout cannot quit a headless serving owner",
"ordinary macOS app quit is not reinterpreted as an install request in headless serve mode",
"repeated requests emit one deterministic status and lifecycle diagnostic while interactive installs remain unchanged"
]
},
{
"file": "src/cli/runtime/launch.test.ts",
"assertions": [
"the CLI parent remains alive after the old serving child exits instead of letting launchd respawn it",
"an atomic app-bundle replacement starts one target-version serve child with the original arguments",
"handoff completes only after the replacement reports target-version runtime readiness",
"a replacement version mismatch or readiness timeout is persisted and exits without an in-process retry loop"
]
},
{
"file": "src/main/serve-update-handoff.test.ts",
"assertions": [
"install intent and failure state are written atomically under canonical user data",
"an injected handoff path outside canonical user data cannot authorize an update",
"a target-version startup clears stale failure state"
]
},
{
"file": "src/main/startup/serve-desktop-activation.test.ts",
"assertions": [
"early activation requests coalesce until the persistent provider is ready",
"a blocked provider drops pending activation and never opens a window"
]
},
{
"file": "src/main/startup/serve-desktop-activation-wiring.test.ts",
"assertions": [
"second-instance and macOS app activation use the same safety gate",
"headless PTY registration waits for provider settlement and promotion waits for RPC startup"
]
},
{
"file": "src/main/startup/single-instance-lock.test.ts",
"assertions": [
"serve never skips the single-instance lock even in development",
"the isolated E2E profile can opt into the production ownership path"
]
},
{
"file": "src/main/startup/window-all-closed-quit-policy.test.ts",
"assertions": [
"a promoted serve owner remains alive after an ordinary window close but exits after a committed quit"
]
},
{
"file": "src/cli/runtime-client.test.ts",
"assertions": [
"local open activates a reachable headless owner and waits for a desktop window",
"unsafe promotion returns an explicit blocked error instead of launching a second owner"
]
},
{
"file": "src/cli/runtime/websocket-transport.test.ts",
"assertions": [
"remote-paired open reports remote desktop state without launching a local app"
]
},
{
"file": "src/main/runtime/orca-runtime.test.ts",
"assertions": [
"the headless sentinel transfers authority to the first real window",
"headless local and SSH PTY bindings are persisted on first promotion and later windowless reattach without changing ordinary desktop spawn persistence",
"status distinguishes available, openable, initializing, and blocked desktop states",
"desktop-only bell, command, and link scanners remain disabled until a real renderer graph is ready"
]
},
{
"file": "src/renderer/src/lib/serve-desktop-promotion-session-continuity.test.ts",
"assertions": [
"a forced desktop relaunch reaching the headless lock owner opens exactly one window, and only after the persistent provider settles",
"a duplicate `orca serve` launch never promotes the headless owner",
"the renderer promoted inside the serve process resumes zero agents while daemon panes survive, before and after those panes rebind their PTYs",
"no replacement resume tab, startup command, or automatic-resume claim is created, and every surviving session record is left untouched"
]
},
{
"file": "tests/e2e/headless-serve-desktop-activation.spec.ts",
"assertions": [
"desktop activation keeps the same main owner PID, runtime id, daemon PID, and PTY id",
"terminal output written before promotion remains visible and post-promotion input/output still works",
"the activating second process exits instead of becoming another owner"
]
}
],
"evidenceRuns": [
{
"date": "2026-08-05",
"runner": "local",
"platform": "macos",
"command": "pnpm exec vitest run --config config/vitest.config.ts src/renderer/src/lib/serve-desktop-promotion-session-continuity.test.ts",
"result": "passed",
"durationSeconds": 2,
"summary": "Six tests passed joining the serve lock owner, the activation gate, and the promoted renderer's resume accounting. Red evidence: reverting the hidden-pane ownership predicate launched two duplicate codex resume tabs; additionally zeroing the live-PTY check made both hydration passes red; removing the duplicate-serve argv guard opened a window for `--serve`; always marking the gate ready removed the fail-closed diagnostic; refusing to open a window dropped both promotion assertions."
},
{
"date": "2026-07-21",
"runner": "local",
"platform": "macos",
"command": "pnpm exec vitest run --config config/vitest.config.ts src/cli/runtime/launch.test.ts src/main/serve-update-handoff.test.ts src/main/updater.headless-serve-install.test.ts src/main/updater.test.ts src/main/updater.mac-install.test.ts src/main/window/attach-main-window-services.test.ts src/main/startup/serve-desktop-activation-wiring.test.ts",
"result": "passed",
"durationSeconds": 5,
"summary": "Seven focused files passed with 133 tests. The lifecycle harness keeps the CLI parent alive across an atomic .app replacement, starts one target-version serve replacement, and requires its bounded readiness message. Unsupported and failed-preflight paths make zero native install and PTY-cleanup calls; supervised native install leaves the modeled daemon session intact and suppresses native GUI relaunch."
},
{
"date": "2026-07-13",
"runner": "local",
"platform": "macos",
"command": "pnpm exec vitest run --config config/vitest.config.ts src/main/startup/serve-desktop-activation.test.ts src/main/startup/serve-desktop-activation-wiring.test.ts src/main/startup/single-instance-lock.test.ts src/main/startup/window-all-closed-quit-policy.test.ts src/cli/runtime-client.test.ts src/cli/runtime/websocket-transport.test.ts src/main/runtime/orca-runtime.test.ts",
"result": "passed",
"durationSeconds": 13,
"summary": "Seven activation, ownership, quit, local/remote CLI, and runtime contract files passed with 704 tests, including first and repeated windowless reattach, local/SSH identity transfer, ordinary desktop persistence isolation, and dynamic side-effect scanner gating."
},
{
"date": "2026-07-13",
"runner": "local",
"platform": "macos",
"command": "pnpm run test:e2e -- tests/e2e/headless-serve-desktop-activation.spec.ts --workers=1",
"result": "passed",
"durationSeconds": 52,
"summary": "The isolated Electron journey passed repeatedly on the final source; the latest 51.6-second run retained the same main owner, runtime, daemon, and PTY, restored pre-promotion output, accepted post-promotion input, and observed the activating process exit."
}
],
"runtimeBudget": {
"p95Seconds": 120,
"scope": "focused unit contracts plus one isolated Electron headless-to-desktop journey"
},
"flakeHistory": {
"status": "unknown",
"evidence": "New deterministic contracts and two consecutive local macOS Electron passes; CI and cross-platform soak history are not yet available."
},
"redGreenEvidence": {
"status": "complete",
"evidence": "The original updater regression was observed red with one native install call, one paired-client disconnect, one cleanup start, no replacement owner, and a stranded staged installer. The root-cause harness was then observed red because the Electron child received no handoff path and the CLI parent exited, allowing launchd to spawn the old version while ShipIt still required zero running target apps. A live canary then exposed MacUpdater ignoring quitAndInstall relaunch arguments and starting a second desktop owner; disabling its independent relaunch for supervised mode produced one stable LaunchAgent parent, one verified replacement, and a surviving session across the real ShipIt swap. The final deterministic harness keeps that parent, observes the atomic bundle swap, and verifies the new serving version before clearing state. Earlier activation evidence also fixed second-owner and replacement-PTY failures."
},
"performanceBudget": {
"required": true,
"evidence": "Normal serve and desktop paths add only constant-time mode checks plus one IPC listener on the macOS CLI child. During an actual install handoff only, the CLI watches the stable app parent directory and performs a bounded 250ms version-file poll for at most 120 seconds; there are no subprocesses, network calls, provider scans, or startup waits. Activation performance is unchanged."
},
"promotionCriteria": [
"Collect at least 100 consecutive CI or soak passes or 14 days without an unexplained flake.",
"Add live packaged activation coverage on macOS plus representative Linux and Windows single-instance journeys.",
"Add an Electron SSH promotion journey in addition to the deterministic identity-transfer unit contract."
],
"knownGaps": [
"The Electron journey uses an isolated development bundle rather than the installed application so it cannot disturb a real user session.",
"The live ShipIt/LaunchAgent canary used a disposable minimal Electron bundle plus the compiled production supervisor; a full packaged Orca update has not yet been run.",
"Linux and Windows single-instance activation have unit coverage but no live Electron evidence yet.",
"SSH identity transfer is deterministic unit coverage only; the live Electron journey currently exercises the local daemon provider."
],
"demotionRule": "Quarantine the Electron journey only with a linked product or harness defect; demote if activation changes the owner/runtime/daemon/PTY identity, loses prior output, opens before provider readiness, or fails to honor a committed quit."
},
{
"id": "runtime.renderer-graph-reload-termination",
"title": "Renderer graph reloads terminate under exact document and window authority",
"maturity": "experimental",
"protection": "partial",
"owner": "runtime-platform",
"layer": "electron-runtime-contract",
"surfaces": [
"desktop renderer reload and crash recovery",
"headless-to-desktop promotion",
"CLI and paired-runtime graph availability"
],
"platforms": ["macos", "linux", "windows"],
"providers": ["local", "daemon", "ssh", "paired-runtime"],
"coveredPlatforms": ["macos"],
"coveredProviders": ["local", "daemon", "paired-runtime"],
"coverageNotes": "Deterministic lifecycle, IPC, window-notification, and runtime ownership tests cover generation replacement, stale callbacks, same-frame old-document publication, blocked external navigation, cancelled renderer navigation, concurrent provisional starts, process loss, timeout cleanup, headless fallback, and competing windows. Isolated macOS Electron validation covers cancelled navigation, forced renderer recovery, and headless serve promotion with live daemon-backed PTY identity and I/O. Linux, Windows, WSL, SSH promotion, and mixed-version desktop/server live runs remain uncollected; the renderer generation stays local to Electron IPC and does not change the remote wire.",
"motivatingLinks": [
"https://github.com/stablyai/orca/issues/14066",
"https://linear.app/stably/issue/STA-4016",
"https://github.com/stablyai/orca/pull/14070"
],
"invariant": "Every genuine renderer graph reload revision settles exactly once, while a blocked external navigation that preserves the current document never starts a revision. A cancelled renderer-document navigation restores authority only when that same renderer survived; cancellation after an earlier document committed remains fenced until publication or timeout. Replacing a reload cancels only the prior revision; its timer and callbacks cannot settle a newer revision. A desktop reload succeeds only from a publication carrying a new renderer-document generation, while a failed headless promotion may recover only from its originating window. Timeout, renderer loss, and close reach a terminal graph state, and successful desktop publication permanently retires headless sentinel fallback until a new headless runtime is established.",
"oracle": "Start a blocked external main-frame navigation and require the current renderer graph and notification path to remain authoritative. Start a same-renderer navigation, cancel it before commit, and require the renderer canary and ready authority to survive; coalesce overlapping provisional starts into one fence, and keep an earlier committed reload fenced if a later navigation is cancelled. Drive two genuine reloads half a timeout apart and require the first deadline to leave the second revision reloading while the second deadline alone makes it unavailable. During the second revision publish from the prior renderer document through the still-current main frame and require rejection without graph mutation or timeout cancellation. Restore headless authority after failed promotion, publish from a competing window, and require rejection while the sentinel remains authoritative. Then force a real renderer crash and separately promote an isolated headless serve owner; require runtime graph readiness, stable runtime/main/daemon/PTY identities, recovered visible terminal output, and post-recovery input/output.",
"commands": [
"pnpm exec vitest run --config config/vitest.config.ts src/main/runtime/runtime-graph-reload-lifecycle.test.ts src/main/window/runtime-renderer-notification-sender.test.ts src/main/window/renderer-document-navigation.test.ts src/main/ipc/runtime.test.ts src/main/window/attach-main-window-services.test.ts src/main/runtime/orca-runtime.test.ts src/renderer/src/runtime/sync-runtime-graph-scheduling.test.ts src/renderer/src/runtime/sync-runtime-graph-payload-partition.test.ts",
"pnpm exec electron-vite build --mode e2e",
"SKIP_BUILD=1 pnpm exec playwright test tests/e2e/renderer-blocked-navigation-graph-authority.spec.ts --config tests/playwright.config.ts --project electron-headless --workers=1",
"SKIP_BUILD=1 pnpm exec playwright test e2e/renderer-crash-recovery-terminal-input.spec.ts tests/e2e/renderer-crash-recovery-terminal-input.spec.ts --config tests/playwright.config.ts --project electron-headless --workers=1",
"SKIP_BUILD=1 pnpm exec playwright test e2e/headless-serve-desktop-activation.spec.ts tests/e2e/headless-serve-desktop-activation.spec.ts --config tests/playwright.config.ts --project electron-headless --workers=1"
],
"testFiles": [
"src/main/runtime/runtime-graph-reload-lifecycle.test.ts",
"src/main/window/runtime-renderer-notification-sender.test.ts",
"src/main/window/renderer-document-navigation.test.ts",
"src/main/ipc/runtime.test.ts",
"src/main/window/attach-main-window-services.test.ts",
"src/main/runtime/orca-runtime.test.ts",
"src/renderer/src/runtime/sync-runtime-graph-scheduling.test.ts",
"src/renderer/src/runtime/sync-runtime-graph-payload-partition.test.ts",
"tests/e2e/renderer-blocked-navigation-graph-authority.spec.ts",
"tests/e2e/renderer-crash-recovery-terminal-input.spec.ts",
"tests/e2e/headless-serve-desktop-activation.spec.ts"
],
"assertionRefs": [
{
"file": "src/main/runtime/runtime-graph-reload-lifecycle.test.ts",
"assertions": [
"each revision settles exactly once",
"replacement cancels the old revision and fences its timeout",
"settlement and timeout release their timers"
]
},
{
"file": "src/main/runtime/orca-runtime.test.ts",
"assertions": [
"only the newest reload owns the terminal timeout",
"a superseded renderer-document generation cannot settle a reload",
"cancelled navigation restores only the renderer or headless authority that actually survived",
"cancellation after an earlier document commit stays fenced until its restarted timeout",
"failed headless promotion remains pinned to its originating window",
"successful desktop publication retires headless fallback"
]
},
{
"file": "src/main/ipc/runtime.test.ts",
"assertions": [
"graph publication requires a non-empty renderer generation",
"only the current BrowserWindow main frame may publish"
]
},
{
"file": "src/main/window/runtime-renderer-notification-sender.test.ts",
"assertions": [
"renderer failure is contained once per load generation",
"late events cannot revive a closed sender"
]
},
{
"file": "src/main/window/renderer-document-navigation.test.ts",
"assertions": [
"blocked external navigation does not start a renderer generation",
"only the packaged renderer file or development origin starts a renderer generation",
"concurrent provisional starts share one reload fence and cancel only after every attempt fails"
]
},
{
"file": "tests/e2e/renderer-blocked-navigation-graph-authority.spec.ts",
"assertions": [
"blocked external navigation starts and stops loading without replacing the renderer document",
"runtime graph epoch, readiness, and authoritative window remain unchanged",
"a later listener can cancel a renderer navigation while its canary and authoritative graph recover"
]
},
{
"file": "tests/e2e/renderer-crash-recovery-terminal-input.spec.ts",
"assertions": [
"main observes renderer process loss and a completed recovery load",
"the same daemon-backed PTY remains reachable through transport and direct-write probes"
]
},
{
"file": "tests/e2e/headless-serve-desktop-activation.spec.ts",
"assertions": [
"promotion preserves main owner, runtime, daemon, and PTY identity",
"terminal output survives promotion and post-promotion input/output remains live"
]
}
],
"evidenceRuns": [
{
"date": "2026-08-14",
"runner": "local",
"platform": "macos",
"command": "pnpm exec vitest run --config config/vitest.config.ts src/main/runtime/runtime-graph-reload-lifecycle.test.ts src/main/window/runtime-renderer-notification-sender.test.ts src/main/window/renderer-document-navigation.test.ts src/main/ipc/runtime.test.ts src/main/window/attach-main-window-services.test.ts src/main/runtime/orca-runtime.test.ts src/renderer/src/runtime/sync-runtime-graph-scheduling.test.ts src/renderer/src/runtime/sync-runtime-graph-payload-partition.test.ts",
"result": "passed",
"durationSeconds": 12,
"summary": "Eight focused files passed with 1,175 tests and one pre-existing skip after the merge from latest main. The suite covers exact reload settlement, timeout replacement, cancelled-navigation recovery, concurrent provisional starts, document and window authority, notification containment, preload IPC, and renderer publication scheduling."
},
{
"date": "2026-08-14",
"runner": "local",
"platform": "macos",
"command": "SKIP_BUILD=1 pnpm exec playwright test tests/e2e/renderer-blocked-navigation-graph-authority.spec.ts --config tests/playwright.config.ts --project electron-headless --workers=1",
"result": "passed",
"durationSeconds": 8,
"summary": "Two isolated Electron flows passed: blocked external navigation left epoch and authority unchanged, and a same-renderer navigation cancelled by a later listener preserved its canary while returning the incremented graph generation to ready under the same authoritative window."
},
{
"date": "2026-08-13",
"runner": "local",
"platform": "macos",
"command": "SKIP_BUILD=1 pnpm exec playwright test e2e/renderer-crash-recovery-terminal-input.spec.ts tests/e2e/renderer-crash-recovery-terminal-input.spec.ts --config tests/playwright.config.ts --project electron-headless --workers=1",
"result": "passed",
"durationSeconds": 18,
"summary": "Two forced renderer process deaths each produced a main-observed recovery load; the same daemon-backed PTY remained live through renderer transport and direct-write probes."
},
{
"date": "2026-08-13",
"runner": "local",
"platform": "macos",
"command": "SKIP_BUILD=1 pnpm exec playwright test e2e/headless-serve-desktop-activation.spec.ts tests/e2e/headless-serve-desktop-activation.spec.ts --config tests/playwright.config.ts --project electron-headless --workers=1",
"result": "passed",
"durationSeconds": 10,
"summary": "The isolated headless serve owner promoted to a real renderer while preserving main owner, runtime, daemon, and PTY identity. Pre-promotion output remained visible and post-promotion terminal input/output succeeded; a full-window proof image records both markers."
}
],
"runtimeBudget": {
"p95Seconds": 420,
"scope": "focused deterministic contracts plus isolated forced-crash and headless-promotion Electron journeys"
},
"flakeHistory": {
"status": "unknown",
"evidence": "Fresh deterministic and two isolated Electron journeys are green; CI soak history is pending."
},
"redGreenEvidence": {
"status": "complete",
"evidence": "A byte-identical three-case oracle was rerun on 2026-08-13. Latest main ee8dd4796e failed all three: reload remained reloading after 22.5 seconds, the prior renderer document settled the replacement, and a competing window stole failed-promotion authority. Submitted PR head feeca6c22f passed the bounded replacement timeout but failed both authority cases. The locally rewritten candidate passed all three. Disabling the local document-generation and pending-window fences reproduces the submitted-head failures; disabling the cancelled-navigation classifier leaves the graph reloading and increments its epoch in the new live oracle."
},
"performanceBudget": {
"required": true,
"evidence": "Fresh delegated audit passed with no blocking, major, or actionable minor findings. The candidate retains at most one unref'd timer, reuses the existing renderer document UUID, adds about 67 serialized bytes to each already-coalesced local graph IPC, and performs constant-time generation/window checks. It adds no polling, subprocess, network request, remote frame, provider scan, or steady-state fanout; a dedicated benchmark would measure existing graph/structured-clone noise rather than meaningful incremental work."
},
"promotionCriteria": [
"Collect CI and soak history without unexplained flakes.",
"Collect live Linux and Windows desktop reload evidence.",
"Add live SSH or WSL promotion evidence if provider-specific graph restoration diverges."
],
"knownGaps": [
"The live journeys cover macOS and daemon-backed local terminals, not Linux desktop, Windows, WSL, or SSH promotion.",
"The same-frame stale-document race is deterministic fault injection because Playwright cannot schedule an invoke precisely between did-start-loading and frame replacement.",
"No mixed-version live run is required because rendererGeneration is confined to same-version preload/main Electron IPC and the remote runtime wire is unchanged."
],
"demotionRule": "Demote if a reload revision settles more than once, a stale document or competing window can publish, a timer survives settlement, desktop failure stays indefinitely reloading, headless fallback returns after successful promotion, or either isolated Electron journey loses runtime or PTY identity."
},
{
"id": "runtime.websocket-heartbeat-cadence",
"title": "Runtime WebSockets enter an owned shared heartbeat cadence",
"maturity": "experimental",
"protection": "partial",
"owner": "runtime-platform",
"layer": "websocket-transport-lifecycle",
"surfaces": [
"headed paired runtime",
"headless orca serve",
"web and mobile runtime clients"
],
"platforms": ["macos", "linux", "windows"],
"providers": ["remote-runtime"],
"coveredPlatforms": ["macos"],
"coveredProviders": ["remote-runtime"],
"coverageNotes": "Deterministic transport tests cover listener-before-probe ownership, first- and later-socket shared cadence, responsive and unresponsive cleanup, pause/resume, connection caps, pre-auth expiry, and close/error races. Headed paired-runtime and headless serve validation passed on macOS; live Linux and Windows heartbeat evidence remains uncollected.",
"motivatingLinks": [
"https://github.com/stablyai/orca/issues/11298",
"https://github.com/stablyai/orca/pull/11300"
],
"invariant": "Every accepted runtime socket installs message, pong, close, and error ownership before any heartbeat probe. With uninterrupted timer delivery, the first socket that arms an idle heartbeat is probed immediately and an unresponsive socket is reaped within one interval. Later sockets join the existing shared cadence without another timer or immediate sweep and are reaped within two intervals. Responsive sockets survive, pause recovery grants a fresh probe, and close or error-to-close releases connection listeners and timers.",
"oracle": "With one fake clock and exact socket identities, accept the first socket at 0 ms and require an immediate owned probe plus reaping at 100 ms when unresponsive. Keep a responsive first socket, accept an unresponsive later socket at 50 ms, require the same shared timer, its first probe at 100 ms, no early reap, and termination at 200 ms. Inject synchronous message, pong, close, and error events, then require exact heartbeat membership and zero retained timers/listeners after final close. Production transport tests independently cover real socket round trips, pre-auth and capacity bounds, revocation, shutdown, and half-open cleanup.",
"commands": [
"pnpm exec vitest run --config config/vitest.config.ts src/main/runtime/rpc/ws-transport-accept-order.test.ts src/main/runtime/rpc/remote-runtime-server-heartbeat.test.ts src/main/runtime/rpc/ws-transport.test.ts"
],
"testFiles": [
"src/main/runtime/rpc/ws-transport-accept-order.test.ts",
"src/main/runtime/rpc/remote-runtime-server-heartbeat.test.ts",
"src/main/runtime/rpc/ws-transport.test.ts"
],
"assertionRefs": [
{
"file": "src/main/runtime/rpc/ws-transport-accept-order.test.ts",
"assertions": [
"the first synchronous probe observes message, pong, close, and error ownership",
"the first unresponsive socket is reaped at one interval",
"a later socket keeps the original shared timer, is first probed on the shared tick, and is reaped within two intervals",
"final close releases heartbeat membership, listeners, and timers"
]
},
{
"file": "src/main/runtime/rpc/remote-runtime-server-heartbeat.test.ts",
"assertions": [
"one missed probe reaps only the unresponsive client",
"event-loop resume grants clients a fresh probe"
]
},
{
"file": "src/main/runtime/rpc/ws-transport.test.ts",
"assertions": [
"heartbeat arming and shutdown follow accepted connection membership",
"pre-auth, raw TCP, and accepted WebSocket resource bounds remain enforced",
"error and close races finalize membership once"
]
}
],
"evidenceRuns": [
{
"date": "2026-07-29",
"runner": "local",
"platform": "macos",
"command": "pnpm exec vitest run --config config/vitest.config.ts src/main/runtime/rpc/ws-transport-accept-order.test.ts src/main/runtime/rpc/remote-runtime-server-heartbeat.test.ts src/main/runtime/rpc/ws-transport.test.ts",
"result": "passed",
"durationSeconds": 0.91,
"summary": "Three runtime transport files and 35 tests passed with deterministic first- and later-socket cadence, exact listener/timer ownership, pause recovery, security bounds, and cleanup."
}
],
"runtimeBudget": {
"p95Seconds": 2,
"scope": "focused runtime WebSocket heartbeat and transport tests"
},
"flakeHistory": {
"status": "unknown",
"evidence": "Deterministic fake-clock and local socket coverage passed on macOS; CI soak history is not yet available."
},
"redGreenEvidence": {
"status": "complete",
"evidence": "On latest main and with the listener-order fix disabled, the first synchronous probe observed no message, pong, close, or error owner. The structural listener-order fix passed those assertions. The published delayed-first-sweep alternative missed the first-socket one-interval cleanup bound. A later-socket oracle now separately pins the intended shared cadence at a 100 ms first probe and 200 ms reap after acceptance at 50 ms."
},
"performanceBudget": {
"required": true,
"evidence": "The transport retains exactly one shared interval, performs one O(N) sweep per tick, and adds no per-socket heartbeat timer, polling, subprocess, network request, or immediate later-socket sweep. Each accepted socket retains only its existing lifecycle listeners and pre-auth timer; deterministic assertions preserve the shared timer identity and bound final cleanup to zero timers."
},
"promotionCriteria": [
"Collect at least 100 consecutive CI or soak passes or 14 days without an unexplained flake.",
"Collect live Linux and Windows paired-runtime heartbeat evidence.",
"Add a multi-client live fanout run that confirms shared-cadence cleanup under connection churn."
],
"knownGaps": [
"Live paired-runtime validation currently covers macOS only.",
"The later-socket bound is deterministic fake-clock coverage; live scheduler jitter is not measured.",
"Multi-client churn and sleep/wake fanout remain live-test gaps."
],
"demotionRule": "Demote if any probe can run before lifecycle ownership, if more than one shared heartbeat timer is armed, if first-socket cleanup exceeds one interval, if later-socket cleanup exceeds two intervals, or if close/error cleanup retains listeners or timers."
},
{
"id": "runtime.streaming-subscription-close-delivery",
"title": "Retiring a runtime transport always tells the renderer its streams closed",
"maturity": "experimental",
"protection": "partial",
"owner": "runtime-platform",
"layer": "runtime-subscription-ipc-contract",
"surfaces": [
"paired remote server",
"runtime environment disconnect and re-pair",
"terminal.multiplex streaming",
"browser screencast streaming",
"parked remote terminal reveal"
],
"platforms": ["macos", "linux", "windows"],
"providers": ["remote-runtime"],
"coveredPlatforms": ["macos"],
"coveredProviders": ["remote-runtime"],
"coverageNotes": "Deterministic main-IPC contract tests cover disconnect-driven close delivery, exactly-once close, per-subscription teardown isolation against a failing socket close and a throwing liveness probe, containment of a throwing renderer send on the unguarded host-close path, and continued suppression of stale payloads from a retired transport. A headed paired-server journey (real Orca host plus a separate paired Orca desktop client) covers hidden-but-mounted reveal, cold-parked reveal, and cold-parked reveal across a disconnect/reconnect. Live Linux and Windows paired-server evidence and real sleep/wake transport loss remain uncollected.",
"motivatingLinks": [
"tests/e2e/paired-remote-terminal-parked-reveal-interactivity.spec.ts",
"docs/reference/headless-linux-server.md"
],
"invariant": "Every renderer-held runtime subscription receives exactly one terminal close event when its transport is retired, including when the retirement advanced the transport generation first, and a single failing teardown never abandons that environment's remaining subscriptions nor escapes into the transport that reported the close. Payload frames from a retired transport stay suppressed. A revealed remote terminal therefore reattaches over a live multiplex connection: its buffer restores, typed input reaches the host PTY, the echo paints without a tab flip, and the PTY converges on the revealed pane grid.",
"oracle": "The main IPC contract test subscribes terminal.multiplex through the real handler, disconnects the environment, and asserts the renderer received exactly one {type: close} subscription event. Two isolation tests subscribe a second stream to the same environment and make the first one fail -- in its socket close, and in the liveness probe inside notifyClosed -- then assert the disconnect does not throw, both transports closed, and every close the renderer could still receive was delivered. A third drives a host-initiated close through the transport callback, which is the one notifyClosed call site with no surrounding guard, with a renderer send that throws, and asserts it cannot escape into the WebSocket close handler. A fourth test asserts that after retirement a late response frame is not forwarded and a late transport close does not re-send. The paired-server journey runs three reveal scenarios against one real host and one real paired desktop client, and for each records buffer restore, host-side receipt of the typed marker through an out-of-band host sink file, live paint without a tab flip, and PTY-versus-pane grid convergence.",
"commands": [
"pnpm exec vitest run --config config/vitest.config.ts src/main/ipc/runtime-environments-subscription-teardown.test.ts",
"pnpm exec playwright test tests/e2e/paired-remote-terminal-parked-reveal-interactivity.spec.ts --config tests/playwright.config.ts --project electron-headless --workers=1"
],
"testFiles": [
"src/main/ipc/runtime-environments-subscription-teardown.test.ts",
"tests/e2e/paired-remote-terminal-parked-reveal-interactivity.spec.ts"
],
"assertionRefs": [
{
"file": "src/main/ipc/runtime-environments-subscription-teardown.test.ts",
"assertions": [
"tells the renderer when retiring the transport closes its streaming subscription (the load-bearing repro; red with the fix reverted)",
"retires an environment's remaining subscriptions when one teardown throws (load-bearing; red without per-subscription isolation)",
"contains a throwing renderer send on a host-initiated close (load-bearing; red without the guarded send, and the only coverage of the unguarded notifyClosed call site)",
"retires remaining subscriptions when a liveness probe inside notifyClosed throws (load-bearing; keeps the isolation structural rather than comment-asserted)",
"suppresses stale payloads from a retired transport but never re-sends its close (forward guard on the retained generation gate, not a repro)"
]
},
{
"file": "tests/e2e/paired-remote-terminal-parked-reveal-interactivity.spec.ts",
"assertions": [
"a revealed hidden-but-mounted remote terminal restores, accepts input, and paints live",
"a revealed cold-parked remote terminal restores, accepts input, and paints live",
"a cold-parked remote terminal revealed after a runtime disconnect and reconnect restores, accepts input, and paints live",
"the host PTY grid converges on the revealed pane grid in every scenario"
]
}
],
"evidenceRuns": [
{
"date": "2026-08-03",
"runner": "local",
"platform": "macos",
"command": "pnpm exec vitest run --config config/vitest.config.ts src/main/ipc/runtime-environments-subscription-teardown.test.ts",
"result": "passed",
"durationSeconds": 0.81,
"summary": "53 runtime environment IPC tests passed, including the new close-delivery, both teardown-isolation, transport-path containment, and stale-payload-suppression contracts."
},
{
"date": "2026-08-03",
"runner": "local",
"platform": "macos",
"command": "pnpm exec playwright test tests/e2e/paired-remote-terminal-parked-reveal-interactivity.spec.ts --config tests/playwright.config.ts --project electron-headless --workers=1",
"result": "passed",
"durationSeconds": 15.5,
"summary": "All three reveal scenarios restored their buffer, delivered typed input to the host PTY, painted live without a tab flip, and converged the PTY on the 135x60 pane grid. Before the fix the reconnect-parked scenario stayed blank at recoveryState connecting with the PTY stranded at the host 128x60 grid."
},
{
"date": "2026-08-03",
"runner": "local",
"platform": "macos",
"command": "pnpm exec playwright test tests/e2e/paired-remote-terminal-parked-reveal-interactivity.spec.ts --config tests/playwright.config.ts --project electron-headless --workers=1",
"result": "passed",
"durationSeconds": 15.5,
"summary": "Repeat run on a clean uninstrumented build; all three scenarios green with identical grids."
},
{
"date": "2026-08-03",
"runner": "local",
"platform": "macos",
"command": "pnpm exec playwright test tests/e2e/paired-remote-terminal-parked-reveal-interactivity.spec.ts --config tests/playwright.config.ts --project electron-headless --workers=1",
"result": "passed",
"durationSeconds": 14.7,
"summary": "Third consecutive pass after the review follow-ups (env save/restore and the hidden-mounted stayed-mounted assertion)."
}
],
"runtimeBudget": {
"p95Seconds": 60,
"scope": "focused runtime environment IPC tests plus one headed paired-server reveal journey"
},
"flakeHistory": {
"status": "unknown",
"evidence": "Deterministic IPC coverage plus the three recorded paired-server journey runs, which passed consecutively on macOS at 14.7-15.5s; the spec also passed once on a shared CI runner. Longer soak history is not yet available."
},
"redGreenEvidence": {
"status": "complete",
"evidence": "On main the paired-server journey reproduced a blank, non-interactive pane after revealing a cold-parked remote terminal across a reconnect: recoveryState stayed connecting, the xterm buffer stayed empty, typed input never reached the host sink, a tab flip did not recover it, and the PTY stayed at the host 128x60 grid. Renderer instrumentation showed the multiplexer reusing a dead subscription (ensureConnected reuse-ready) and never receiving a subscribed event. Reverting the main-side fix also turns the close-delivery IPC test red; with the fix the multiplexer observes handleClose, reconnects fresh, and every scenario passes."
},
"performanceBudget": {
"required": true,
"evidence": "The fix adds one boolean latch and at most one extra IPC send per retired subscription, on a path that already tears the subscription down. It introduces no timer, poll, retry, subprocess, or per-frame work, and the close is deduplicated so a transport-driven close after an environment-wide retirement sends nothing."
},
"promotionCriteria": [
"Collect at least 100 consecutive CI or soak passes or 14 days without an unexplained flake.",
"Collect live Linux and Windows paired-server reveal evidence.",
"Add real sleep/wake and network-loss transport drops alongside the explicit disconnect trigger."
],
"knownGaps": [
"Live paired-server validation currently covers macOS host and client only.",
"The transport drop is an explicit runtime disconnect; real sleep/wake and network partitions are not yet exercised by this gate.",
"Browser screencast subscribers now have deterministic shared-stream fanout coverage; a full headed reveal journey for multiple simultaneous viewers remains uncollected, while web and mobile clients continue to use their parallel transports."
],
"demotionRule": "Demote if a retired runtime transport can leave a renderer subscription without a close event, if a close is delivered more than once, if one failing teardown strands its sibling subscriptions, if payload frames from a retired transport reach the renderer, or if a revealed remote terminal can stay blank or reject input after a reconnect."
},
{
"id": "browser-session.remote-terminal-link-ownership",
"title": "Paired terminal links open one browser on their owning runtime",
"maturity": "experimental",
"protection": "partial",
"owner": "browser-runtime",
"layer": "renderer-paired-runtime-routing",
"surfaces": [
"paired remote terminal HTTP links",
"terminal link action destinations",
"runtime-owned managed browser creation"
],
"platforms": ["macos", "linux", "windows"],
"providers": ["remote-runtime", "ssh"],
"coveredPlatforms": ["macos"],
"coveredProviders": [],
"coverageNotes": "A headed macOS desktop host and separate paired Electron client exercise a real mirrored terminal link, owner-asserted host browser creation, exact host/client page identity, rendered DOM, explicit browser-tab activation, client external-browser suppression, exact host/client close convergence, and continued original-PTY liveness. Unit contracts cover OSC, WebLinksAddon, click fallback, explicit System Browser routing, failed creation, incapable runtimes, and unchanged direct SSH behavior.",
"motivatingLinks": [
"https://stablygroup.slack.com/archives/C0AK2T3JEF4/p1786567689897109",
"https://github.com/stablyai/orca/issues/12418"
],
"invariant": "Selecting Orca Browser for an HTTP link in a runtime-owned terminal creates exactly one browser page on that owning runtime and exactly one mirrored client browser workspace, with matching remote page identity and no client external-browser call. Explicit System Browser remains client-owned, direct SSH remains system-browser-only, and unknown or mismatched owners fail closed.",
"oracle": "Use the focused routing contracts as the byte-identical baseline/candidate oracle. Require runtime OSC, WebLinksAddon, click fallback, action-menu, and modifier paths to target the exact owner without client fallback, while direct SSH and generic remote document links stay external. Separately run one byte-identical headed paired Electron journey on the candidate and with only runtime browser registration disabled. Require one new host browser tab, one new client mirror with exact page identity, rendered fixture DOM, explicit browser-tab activation, zero client shell.openExternal calls, exact close convergence, unchanged terminal counts, and continued output on the original PTY.",
"commands": [
"pnpm exec vitest run --config config/vitest.config.ts src/renderer/src/components/terminal-pane/terminal-runtime-host-link-routing.test.ts src/renderer/src/components/terminal-pane/terminal-link-action-routing.test.ts src/renderer/src/components/terminal-pane/terminal-link-open-hints.test.ts src/renderer/src/lib/http-link-routing.test.ts src/renderer/src/lib/http-link-modifier-routing.test.ts src/renderer/src/lib/workspace-browser-tab-open.test.ts",
"pnpm exec vitest run --config config/vitest.config.ts src/renderer/src/components/terminal-pane/terminal-runtime-host-link-routing.test.ts src/renderer/src/components/terminal-pane/terminal-link-action-routing.test.ts src/renderer/src/lib/workspace-browser-tab-open.test.ts",
"ORCA_E2E_WEB_CLIENT=1 ORCA_E2E_FORCE_HEADFUL=1 pnpm exec playwright test tests/e2e/paired-remote-terminal-browser-link.spec.ts --config tests/playwright.config.ts --project electron-headless --workers=1"
],
"testFiles": [
"src/renderer/src/components/terminal-pane/terminal-runtime-host-link-routing.test.ts",
"src/renderer/src/components/terminal-pane/terminal-link-action-routing.test.ts",
"src/renderer/src/components/terminal-pane/terminal-link-open-hints.test.ts",
"src/renderer/src/lib/http-link-routing.test.ts",
"src/renderer/src/lib/http-link-modifier-routing.test.ts",
"src/renderer/src/lib/workspace-browser-tab-open.test.ts",
"tests/e2e/paired-remote-terminal-browser-link.spec.ts"
],
"assertionRefs": [
{
"file": "src/renderer/src/components/terminal-pane/terminal-runtime-host-link-routing.test.ts",
"assertions": [
"OSC, WebLinksAddon, and click-fallback activations route through the exact runtime owner",
"direct SSH continues to use only the system browser"
]
},
{
"file": "src/renderer/src/lib/workspace-browser-tab-open.test.ts",
"assertions": [
"an asserted runtime cannot fall back to a client browser",
"mismatched and incapable runtime owners fail closed"
]
},
{
"file": "tests/e2e/paired-remote-terminal-browser-link.spec.ts",
"assertions": [
"one terminal action produces one host page and one client mirror with exact identity",
"the host browser renders the fixture while client external navigation stays empty",
"an explicit browser-tab click reveals the exact mirror",
"closing the mirror returns host and client inventories to baseline",
"the original remote PTY accepts and renders fresh output after browser close"
]
}
],
"evidenceRuns": [
{
"date": "2026-08-12",
"runner": "local",
"platform": "macos",
"command": "pnpm exec vitest run --config config/vitest.config.ts src/renderer/src/components/terminal-pane/terminal-runtime-host-link-routing.test.ts src/renderer/src/components/terminal-pane/terminal-link-action-routing.test.ts src/renderer/src/lib/workspace-browser-tab-open.test.ts",
"result": "failed",
"durationSeconds": 2.58,
"summary": "Latest main e4c278eb523 failed 6/25 owner-routing assertions: runtime terminal links called the viewing client's external browser and the managed-browser helper did not enforce an asserted runtime owner."
},
{
"date": "2026-08-12",
"runner": "local",
"platform": "macos",
"command": "pnpm exec vitest run --config config/vitest.config.ts src/renderer/src/components/terminal-pane/terminal-runtime-host-link-routing.test.ts src/renderer/src/components/terminal-pane/terminal-link-action-routing.test.ts src/renderer/src/components/terminal-pane/terminal-link-open-hints.test.ts src/renderer/src/lib/http-link-routing.test.ts src/renderer/src/lib/http-link-modifier-routing.test.ts src/renderer/src/lib/workspace-browser-tab-open.test.ts",
"result": "passed",
"durationSeconds": 1.83,
"summary": "Candidate passed 84/84 across six focused routing, modifier, availability, owner assertion, failure, SSH, and system-browser contract files."
},
{
"date": "2026-08-12",
"runner": "local",
"platform": "macos",
"command": "ORCA_E2E_WEB_CLIENT=1 ORCA_E2E_FORCE_HEADFUL=1 pnpm exec playwright test tests/e2e/paired-remote-terminal-browser-link.spec.ts --config tests/playwright.config.ts --project electron-headless --workers=1",
"result": "passed",
"durationSeconds": 32.9,
"summary": "Candidate created one host browser and one client mirror with matching page identity, rendered the fixture, activated on an explicit tab click, made zero client external-browser calls, converged both inventories after exact UI close, and delivered fresh output on the original remote PTY."
},
{
"date": "2026-08-12",
"runner": "local",
"platform": "macos",
"command": "ORCA_E2E_WEB_CLIENT=1 ORCA_E2E_FORCE_HEADFUL=1 pnpm exec playwright test tests/e2e/paired-remote-terminal-browser-link.spec.ts --config tests/playwright.config.ts --project electron-headless --workers=1",
"result": "failed",
"durationSeconds": 53,
"summary": "The byte-identical final Electron oracle failed at its exact host/client identity barrier when the sole source delta replaced src/renderer/src/store/index.ts registration lines 110-113 with registerRuntimeHttpLinkBrowserOpener(null); no host-owned browser appeared within the deterministic 60-second bound."
}
],
"runtimeBudget": {
"p95Seconds": 45,
"scope": "six focused renderer contract files plus one isolated headed paired-runtime journey"
},
"flakeHistory": {
"status": "unknown",
"evidence": "The focused contracts are deterministic and the headed paired-runtime journey passed locally after its PTY namespace oracle was corrected; longer CI and soak history is not yet available."
},
"redGreenEvidence": {
"status": "complete",
"evidence": "The focused owner-routing oracle is red on latest main e4c278eb523 and green on the candidate. The byte-identical headed Electron oracle is green on the candidate and red when the sole source delta replaces the runtime browser opener registration with registerRuntimeHttpLinkBrowserOpener(null); candidate evidence proves exact host/client identity, rendered content, explicit activation, exact close convergence, original-PTY survival, and absence of client external navigation."
},
"performanceBudget": {
"required": true,
"evidence": "The production change adds no timer, polling, retry, subprocess, stream opcode, RPC method, or host publication. Each link hover or activation performs bounded in-memory owner and capability lookups; an Orca Browser action issues the same single browser creation and snapshot reconciliation already used by the tab bar."
},
"promotionCriteria": [
"Collect Linux and physical Windows paired-server evidence.",
"Collect a live headless-serve terminal-link journey.",
"Collect 100 consecutive focused CI passes or 14 days without an unexplained flake."
],
"knownGaps": [
"Live paired-server validation currently covers macOS only.",
"A live headless-serve journey and multiple simultaneous viewers are not exercised by the Electron journey.",
"Direct SSH intentionally retains its existing system-browser-only semantics.",
"Terminal-link activation does not change the existing asynchronous host/client focus policy."
],
"demotionRule": "Demote if one runtime terminal link creates a client-owned or duplicate browser, targets a runtime other than the pane owner, invokes the client external browser for Orca Browser, or removes the source terminal."
},
{
"id": "browser-session.remote-html-preview-ownership",
"title": "Paired HTML previews keep one host page and one stable client split",
"maturity": "experimental",
"protection": "partial",
"owner": "browser-runtime",
"layer": "renderer-paired-runtime-reconciliation",
"surfaces": [
"paired remote HTML file preview",
"background preview creation and explicit browser activation",
"client-only split placement",
"capability-unknown and mixed-version preview rejection cleanup",
"post-create reconciliation failure and compensating rollback",
"remote browser close convergence"
],
"platforms": ["macos", "linux", "windows"],
"providers": ["remote-runtime"],
"coveredPlatforms": ["macos"],
"coveredProviders": ["remote-runtime"],
"coverageNotes": "A headed macOS desktop host and separate paired client exercise the Explorer eye-button path with a real remote file URL, host browser DOM, renderer split layout, background preview creation, explicit browser activation, browser close, forced capability rejection after caller preflight, a forced post-create reconciliation timeout, and navigation held beyond the client create deadline. The same reconciliation fault oracles pass against a live headless server. Unit contracts cover absent, unknown, and mixed-version capabilities, visible rejection, empty-split cleanup, owning-runtime routing, canonical preallocated page identity, navigation-independent acknowledgement, exact client materialization, confirmed rollback, ambiguous cleanup, and teardown. Linux and Windows live journeys remain gaps.",
"motivatingLinks": [
"https://linear.app/stably/issue/STA-3872/unable-to-open-html-files-in-remote-server",
"https://linear.app/stably/issue/STA-4025/p1-browser-create-reports-success-when-tab-reconcile-fails-after-pr",
"https://linear.app/stably/issue/STA-4063/p1-paired-html-preview-rejects-outside-cleanup-after-pr-13909",
"https://linear.app/stably/issue/STA-4231/p1-owner-pinned-paired-browser-create-can-time-out-after-host-tab",
"https://github.com/stablyai/orca/pull/14363",
"https://github.com/stablyai/orca/pull/13876"
],
"invariant": "Opening one HTML preview from a paired client succeeds only after exactly one browser page on the worktree-owning runtime materializes as exactly one client browser workspace and unified tab in the requested group. Owner-pinned creation returns the canonical host page identity before navigation readiness; delayed navigation cannot turn a created page into an unidentifiable failure or a duplicate retry. Capability rejection before host mutation must preserve the original error, issue no RPC, surface a failure toast, and remove only a caller-declared newly-created empty split. Post-create reconciliation failure requires exact rollback; ambiguous rollback rejects without local fallback. Preview focus and close preserve the source editor and terminal.",
"oracle": "Run one unchanged contract oracle for direct create and side-preview callers with absent status, unknown capabilities, and a mixed-version host. Require the original unsupported error or visible toast, zero RPCs, and no retained new split. Run it on the scan target, latest main, candidate, and candidate with the cleanup boundary disabled. In headed paired Electron, arm capability rejection after the caller preflight, invoke the visible HTML side-preview action, require the failure toast, and compare exact host/client browser, editor, terminal, and group inventories to baseline. Hold a real navigation response beyond the 15-second client deadline after host creation; require the first RPC to return the exact host inventory page ID, one host page, and no retry. Repeat reconciliation faults against headless serve. Retain the separate exact-page reconciliation rollback oracle.",
"commands": [
"pnpm exec vitest run --config config/vitest.config.ts src/main/runtime/orca-runtime-browser.test.ts src/main/runtime/rpc/methods/browser.test.ts src/renderer/src/lib/file-preview.test.ts src/renderer/src/runtime/web-session-browser-placement.test.ts src/renderer/src/runtime/web-runtime-session.test.ts src/renderer/src/runtime/web-session-tabs-sync.test.ts src/renderer/src/runtime/remote-server-parity.test.ts",
"pnpm exec vitest run --config config/vitest.config.ts src/renderer/src/runtime/web-runtime-browser-materialization.test.ts",
"pnpm exec vitest run --config config/vitest.config.ts src/renderer/src/runtime/web-runtime-browser-capability-cleanup.test.ts src/renderer/src/lib/file-preview-capability-cleanup.test.ts",
"pnpm exec vitest run --config config/vitest.config.ts src/main/runtime/orca-runtime-browser.test.ts src/renderer/src/runtime/web-runtime-session.test.ts",
"pnpm exec vitest run --config config/vitest.config.ts src/main/runtime/orca-runtime.test.ts src/main/runtime/orca-runtime-browser.test.ts src/renderer/src/hooks/useIpcEvents-browser-tab-create.test.ts src/renderer/src/hooks/useIpcEvents-close-routing-browser-pages.test.ts src/renderer/src/hooks/useIpcEvents-close-routing-session-tabs.test.ts src/renderer/src/store/slices/browser.test.ts src/renderer/src/runtime/web-runtime-session.test.ts",
"SKIP_BUILD=1 pnpm exec playwright test tests/e2e/paired-browser-create-navigation-deadline.spec.ts --config tests/playwright.config.ts --project electron-headful --workers=1",
"ORCA_E2E_WEB_CLIENT=1 ORCA_E2E_FORCE_HEADFUL=1 ORCA_E2E_FORWARD_APP_LOGS=1 pnpm exec playwright test tests/e2e/paired-remote-html-browser-focus.spec.ts --config tests/playwright.config.ts --project electron-headless --workers=1",
"ORCA_E2E_WEB_CLIENT=1 ORCA_E2E_FORCE_HEADFUL=1 ORCA_E2E_FORWARD_APP_LOGS=1 pnpm exec playwright test tests/e2e/paired-remote-html-browser-focus.spec.ts --config tests/playwright.config.ts --project electron-headless --workers=1 --repeat-each=3",
"SKIP_BUILD=1 ORCA_E2E_WEB_CLIENT=1 ORCA_E2E_FORCE_HEADFUL=1 pnpm exec playwright test tests/e2e/paired-remote-html-browser-focus.spec.ts --config tests/playwright.config.ts --project electron-headless --workers=1",
"ORCA_E2E_WEB_CLIENT=1 ORCA_E2E_FORCE_HEADFUL=1 pnpm exec playwright test tests/e2e/paired-remote-html-browser-focus.spec.ts --config tests/playwright.config.ts --project electron-headless --workers=1",
"SKIP_BUILD=1 ORCA_E2E_FORCE_HEADFUL=1 ORCA_E2E_FORWARD_APP_LOGS=1 pnpm exec playwright test tests/e2e/paired-browser-creation-reconciliation-failure.spec.ts --config tests/playwright.config.ts --project electron-headful --workers=1 --reporter=line",
"SKIP_BUILD=1 ORCA_E2E_FORCE_HEADFUL=1 ORCA_E2E_FORWARD_APP_LOGS=1 pnpm exec playwright test tests/e2e/paired-browser-creation-reconciliation-failure.spec.ts --config tests/playwright.config.ts --project electron-headless --workers=1 --reporter=line"
],
"testFiles": [
"src/main/runtime/orca-runtime-browser.test.ts",
"src/main/runtime/rpc/methods/browser.test.ts",
"src/renderer/src/lib/file-preview.test.ts",
"src/renderer/src/lib/file-preview-capability-cleanup.test.ts",
"src/renderer/src/runtime/web-session-browser-placement.test.ts",
"src/renderer/src/runtime/web-runtime-browser-materialization.test.ts",
"src/renderer/src/runtime/web-runtime-browser-capability-cleanup.test.ts",
"src/renderer/src/runtime/web-runtime-session.test.ts",
"src/renderer/src/runtime/web-session-tabs-sync.test.ts",
"src/renderer/src/runtime/remote-server-parity.test.ts",
"src/renderer/src/hooks/useIpcEvents-browser-tab-create.test.ts",
"src/renderer/src/hooks/useIpcEvents-close-routing-browser-pages.test.ts",
"src/renderer/src/hooks/useIpcEvents-close-routing-session-tabs.test.ts",
"src/renderer/src/store/slices/browser.test.ts",
"tests/e2e/paired-remote-html-browser-focus.spec.ts",
"tests/e2e/paired-browser-create-navigation-deadline.spec.ts",
"tests/e2e/paired-browser-creation-reconciliation-failure.spec.ts"
],
"assertionRefs": [
{
"file": "src/renderer/src/runtime/web-runtime-browser-capability-cleanup.test.ts",
"assertions": [
"absent status, unknown capabilities, and mixed-version hosts preserve the unsupported rejection",
"direct creation removes the caller-declared new split without issuing an RPC"
]
},
{
"file": "src/renderer/src/lib/file-preview-capability-cleanup.test.ts",
"assertions": [
"known unavailability reports visibly without creating a split",
"capability loss after caller preflight reports visibly without duplicating transaction cleanup"
]
},
{
"file": "src/renderer/src/lib/file-preview.test.ts",
"assertions": [
"a failed side preview reports visibly without caller-owned split cleanup",
"overlapping side previews reuse the split without the first failure deleting it"
]
},
{
"file": "src/renderer/src/runtime/web-runtime-browser-materialization.test.ts",
"assertions": [
"success requires the exact environment and remote page handle plus a unified browser tab",
"a requested client group must contain the materialized browser tab"
]
},
{
"file": "src/renderer/src/runtime/web-runtime-session.test.ts",
"assertions": [
"a post-create timeout returns false only after exact host close and a confirming snapshot",
"owner-pinned creation launches navigation separately and materializes without awaiting it",
"a lost create acknowledgement cleans the capability-gated canonical page ID",
"unconfirmed cleanup rejects so callers cannot create a competing local fallback",
"the canonical placement and a newly-created empty split are released on rollback",
"one failed preview cannot remove a shared split still reserved after an environment ownership change",
"if every overlapping creation fails, the last reservation closes the caller-created empty split"
]
},
{
"file": "src/main/runtime/orca-runtime-browser.test.ts",
"assertions": [
"explicit renderer cleanup bypasses guest registration while retaining typed missing-page behavior",
"offscreen cleanup rejects a page outside the requested worktree"
]
},
{
"file": "src/renderer/src/hooks/useIpcEvents-browser-tab-create.test.ts",
"assertions": [
"renderer-backed creation preserves the requested canonical page ID while keeping its workspace identity independent"
]
},
{
"file": "src/renderer/src/hooks/useIpcEvents-close-routing-browser-pages.test.ts",
"assertions": [
"closing an absent renderer page returns browser_tab_not_found instead of an untyped failure"
]
},
{
"file": "src/renderer/src/hooks/useIpcEvents-close-routing-session-tabs.test.ts",
"assertions": ["explicit cleanup cannot close a page owned by another worktree"]
},
{
"file": "src/renderer/src/store/slices/browser.test.ts",
"assertions": [
"a requested canonical page ID is stored on the page rather than reused as its workspace ID",
"duplicate canonical page IDs are rejected before a second tab can materialize"
]
},
{
"file": "src/renderer/src/runtime/web-session-browser-placement.test.ts",
"assertions": [
"pending page placements are bounded and reserve worktree groups across environment ownership changes",
"caller-created cleanup transfers to the last failed overlapping reservation",
"capacity rejects a new placement without evicting an active reservation or its cleanup ownership",
"worktree and environment teardown clear only their own placement state"
]
},
{
"file": "src/renderer/src/runtime/web-session-tabs-sync.test.ts",
"assertions": [
"a host browser page stays in its exact client-owned preview group",
"a reserved empty split survives a pre-publication host snapshot",
"later client moves supersede initial preview placement"
]
},
{
"file": "src/renderer/src/runtime/remote-server-parity.test.ts",
"assertions": [
"a caller-created browser gains focus when the exact predecessor tab is still visible"
]
},
{
"file": "tests/e2e/paired-remote-html-browser-focus.spec.ts",
"assertions": [
"one HTML open produces one client workspace, one client unified tab, and one host page",
"the source editor and remote frame remain visible in separate groups",
"preview creation leaves the editor active, an explicit browser click is authoritative, and close preserves the editor and terminal"
]
},
{
"file": "tests/e2e/paired-browser-create-navigation-deadline.spec.ts",
"assertions": [
"a held navigation exceeds the former create deadline while the first RPC returns the exact authoritative host page ID",
"host inventory contains exactly one new page and the user retry branch is never entered"
]
},
{
"file": "tests/e2e/paired-browser-creation-reconciliation-failure.spec.ts",
"assertions": [
"the exact created page exists on the host while publication is held and no browser tab materializes on the client",
"a forced post-create reconciliation timeout closes the exact host page and removes only the reserved empty split",
"a forced capability rejection after caller preflight shows a toast and restores exact host and client inventories",
"headed and headless hosts preserve the unrelated editor and terminal without local fallback"
]
}
],
"evidenceRuns": [
{
"date": "2026-08-12",
"runner": "local",
"platform": "macos",
"command": "pnpm exec vitest run --config config/vitest.config.ts src/renderer/src/runtime/web-runtime-browser-capability-cleanup.test.ts src/renderer/src/lib/file-preview-capability-cleanup.test.ts",
"result": "failed",
"durationSeconds": 0.72,
"summary": "The unchanged STA-4063 oracle failed 5/5 on scan e4c278eb52 and latest main bc2e30000b: direct create never closed the new split, and side-preview rejection produced neither cleanup nor a toast. Pre-fix PR #14100 passed the two caller cases but still failed all three direct transaction cases."
},
{
"date": "2026-08-12",
"runner": "local",
"platform": "macos",
"command": "pnpm exec vitest run --config config/vitest.config.ts src/renderer/src/runtime/web-runtime-browser-capability-cleanup.test.ts src/renderer/src/lib/file-preview-capability-cleanup.test.ts",
"result": "passed",
"durationSeconds": 0.7,
"summary": "Rebased candidate 14b5877a75 passed 5/5: absent, unknown, mixed-version, preflight-known, and post-preflight capability failures all reported failure and retained no new empty split."
},
{
"date": "2026-08-12",
"runner": "local",
"platform": "macos",
"command": "SKIP_BUILD=1 ORCA_E2E_FORCE_HEADFUL=1 ORCA_E2E_FORWARD_APP_LOGS=1 pnpm exec playwright test tests/e2e/paired-browser-creation-reconciliation-failure.spec.ts --config tests/playwright.config.ts --project electron-headful --workers=1 --reporter=line",
"result": "passed",
"durationSeconds": 18.3,
"summary": "The full headed spec passed 2/2. A visible desktop host and separate paired Electron client proved both reconciliation rollback and capability rejection with a failure toast and exact host/client browser, group, editor, and terminal inventory restoration."
},
{
"date": "2026-08-12",
"runner": "local",
"platform": "macos",
"command": "SKIP_BUILD=1 ORCA_E2E_FORCE_HEADFUL=1 ORCA_E2E_FORWARD_APP_LOGS=1 pnpm exec playwright test tests/e2e/paired-browser-creation-reconciliation-failure.spec.ts --config tests/playwright.config.ts --project electron-headless --workers=1 --reporter=line",
"result": "passed",
"durationSeconds": 9.1,
"summary": "The full isolated headless-serve journey passed 1/1, applying both reconciliation and capability faults to the same live host while preserving the visible-toast and exact inventory-restoration oracle."
},
{
"date": "2026-08-12",
"runner": "local",
"platform": "macos",
"command": "pnpm exec vitest run --config config/vitest.config.ts src/renderer/src/runtime/web-runtime-browser-materialization.test.ts",
"result": "passed",
"durationSeconds": 0.11,
"summary": "The exact environment, remote page, client workspace, unified browser tab, and requested group materialization contract passed 1/1 on the final rebased candidate."
},
{
"date": "2026-08-12",
"runner": "local",
"platform": "macos",
"command": "SKIP_BUILD=1 ORCA_E2E_FORCE_HEADFUL=1 ORCA_E2E_FORWARD_APP_LOGS=1 pnpm exec playwright test tests/e2e/paired-browser-creation-reconciliation-failure.spec.ts --config tests/playwright.config.ts --project electron-headful --workers=1 --reporter=line",
"result": "passed",
"durationSeconds": 24.3,
"summary": "A visible desktop host and separate paired Electron client held one exact host page before client materialization, forced the post-create timeout, then proved exact host rollback, empty-split removal, failure UI, no local fallback, and surviving editor and terminal."
},
{
"date": "2026-08-12",
"runner": "local",
"platform": "macos",
"command": "SKIP_BUILD=1 ORCA_E2E_FORCE_HEADFUL=1 ORCA_E2E_FORWARD_APP_LOGS=1 pnpm exec playwright test tests/e2e/paired-browser-creation-reconciliation-failure.spec.ts --config tests/playwright.config.ts --project electron-headless --workers=1 --reporter=line",
"result": "passed",
"durationSeconds": 18.5,
"summary": "The same exact-page hold, timeout, rollback, client cleanup, no-fallback, editor, and terminal oracle passed against isolated headless serve."
},
{
"date": "2026-08-12",
"runner": "local",
"platform": "macos",
"command": "pnpm exec vitest run --config config/vitest.config.ts src/main/runtime/orca-runtime-browser.test.ts src/main/runtime/rpc/methods/browser.test.ts src/renderer/src/lib/file-preview.test.ts src/renderer/src/runtime/web-session-browser-placement.test.ts src/renderer/src/runtime/web-runtime-session.test.ts src/renderer/src/runtime/web-session-tabs-sync.test.ts src/renderer/src/runtime/remote-server-parity.test.ts",
"result": "passed",
"durationSeconds": 3.48,
"summary": "Seven focused host and renderer contract files passed 183/183 tests, covering owning-runtime routing, focused and unfocused creation, placement, reconciliation, failure cleanup, and teardown."
},
{
"date": "2026-08-12",
"runner": "local",
"platform": "macos",
"command": "ORCA_E2E_WEB_CLIENT=1 ORCA_E2E_FORCE_HEADFUL=1 ORCA_E2E_FORWARD_APP_LOGS=1 pnpm exec playwright test tests/e2e/paired-remote-html-browser-focus.spec.ts --config tests/playwright.config.ts --project electron-headless --workers=1 --repeat-each=3",
"result": "passed",
"durationSeconds": 16.1,
"summary": "The candidate passed exact host/client cardinality, split stability, rendered DOM, focus authority, close convergence, and surviving editor and terminal."
},
{
"date": "2026-08-12",
"runner": "local",
"platform": "macos",
"command": "SKIP_BUILD=1 ORCA_E2E_WEB_CLIENT=1 ORCA_E2E_FORCE_HEADFUL=1 pnpm exec playwright test tests/e2e/paired-remote-html-browser-focus.spec.ts --config tests/playwright.config.ts --project electron-headless --workers=1",
"result": "failed",
"durationSeconds": 11.6,
"summary": "Latest-main a90a18d43da333e1cc327779a3f9912a78308848 failed the byte-identical 5806b23f oracle because the HTML preview collapsed into the source editor group instead of retaining its requested split."
},
{
"date": "2026-08-12",
"runner": "local",
"platform": "macos",
"command": "ORCA_E2E_WEB_CLIENT=1 ORCA_E2E_FORCE_HEADFUL=1 pnpm exec playwright test tests/e2e/paired-remote-html-browser-focus.spec.ts --config tests/playwright.config.ts --project electron-headless --workers=1",
"result": "passed",
"durationSeconds": 6.5,
"summary": "Rebased candidate b7de9c0961a4edf389a29079b2b4d5250184b57e passed the byte-identical 5806b23f oracle: one host page, one client workspace, requested split, rendered DOM, stable focus, and browser-only close."
},
{
"date": "2026-08-12",
"runner": "local",
"platform": "macos",
"command": "ORCA_E2E_WEB_CLIENT=1 ORCA_E2E_FORCE_HEADFUL=1 pnpm exec playwright test tests/e2e/paired-remote-html-browser-focus.spec.ts --config tests/playwright.config.ts --project electron-headless --workers=1",
"result": "failed",
"durationSeconds": 10.9,
"summary": "Rebased candidate b7de9c0961a4edf389a29079b2b4d5250184b57e with only the side-preview owning-runtime routing seam disabled failed the byte-identical 5806b23f oracle with two client workspaces."
},
{
"date": "2026-08-12",
"runner": "local",
"platform": "macos",
"command": "ORCA_E2E_WEB_CLIENT=1 ORCA_E2E_FORCE_HEADFUL=1 pnpm exec playwright test tests/e2e/paired-remote-html-browser-focus.spec.ts --config tests/playwright.config.ts --project electron-headless --workers=1",
"result": "passed",
"durationSeconds": 7.6,
"summary": "Final candidate d5767481b982b736e7cc5b4653b2a32a61280638 on merge-base 36d45af062ec4022265aabac8fc6a9d36eecedf1 passed the byte-identical 5806b23f oracle after final review and rebase: one host page, one client workspace, requested split, rendered DOM, stable focus, and browser-only close."
},
{
"date": "2026-08-12",
"runner": "local",
"platform": "macos",
"command": "ORCA_E2E_WEB_CLIENT=1 ORCA_E2E_FORCE_HEADFUL=1 pnpm exec playwright test tests/e2e/paired-remote-html-browser-focus.spec.ts --config tests/playwright.config.ts --project electron-headless --workers=1",
"result": "failed",
"durationSeconds": 11.8,
"summary": "Latest-main 346e59c879 failed the byte-identical 2ec1dcf1 oracle with two client HTML browser workspaces instead of one."
},
{
"date": "2026-08-12",
"runner": "local",
"platform": "macos",
"command": "ORCA_E2E_WEB_CLIENT=1 ORCA_E2E_FORCE_HEADFUL=1 pnpm exec playwright test tests/e2e/paired-remote-html-browser-focus.spec.ts --config tests/playwright.config.ts --project electron-headless --workers=1",
"result": "passed",
"durationSeconds": 8.4,
"summary": "Candidate d05217c40d passed the byte-identical 2ec1dcf1 oracle: one host page, one client workspace, stable split, rendered DOM, editor focus after creation, explicit-click browser focus, and browser-only close."
},
{
"date": "2026-08-12",
"runner": "local",
"platform": "macos",
"command": "ORCA_E2E_WEB_CLIENT=1 ORCA_E2E_FORCE_HEADFUL=1 pnpm exec playwright test tests/e2e/paired-remote-html-browser-focus.spec.ts --config tests/playwright.config.ts --project electron-headless --workers=1",
"result": "failed",
"durationSeconds": 12.3,
"summary": "Candidate d05217c40d with only the side-preview focusOnCreate:false call disabled failed the byte-identical 2ec1dcf1 oracle because preview creation activated the browser instead of preserving editor focus."
},
{
"date": "2026-08-13",
"runner": "local",
"platform": "macos",
"command": "pnpm exec vitest run --config config/vitest.config.ts src/main/runtime/orca-runtime.test.ts src/main/runtime/orca-runtime-browser.test.ts src/renderer/src/hooks/useIpcEvents-browser-tab-create.test.ts src/renderer/src/hooks/useIpcEvents-close-routing-browser-pages.test.ts src/renderer/src/hooks/useIpcEvents-close-routing-session-tabs.test.ts src/renderer/src/store/slices/browser.test.ts src/renderer/src/runtime/web-runtime-session.test.ts",
"result": "passed",
"durationSeconds": 10.83,
"summary": "Five post-review host, IPC, store, and client lifecycle files passed 1,356 tests with one pre-existing skip, including both shards that failed before the canonical page/workspace identity and typed missing-page cleanup corrections."
},
{
"date": "2026-08-13",
"runner": "local",
"platform": "macos",
"command": "SKIP_BUILD=1 pnpm exec playwright test tests/e2e/paired-browser-create-navigation-deadline.spec.ts --config tests/playwright.config.ts --project electron-headful --workers=1",
"result": "passed",
"durationSeconds": 18.1,
"summary": "Two isolated headed Electron/CDP journeys passed: the direct owner-pinned call returned one canonical host ID before held navigation, and the real remote-pane context-menu route materialized that one page without retry or duplicate."
}
],
"runtimeBudget": {
"p95Seconds": 90,
"scope": "focused host/renderer contracts plus normal and faulted headed/headless paired-runtime journeys"
},
"flakeHistory": {
"status": "unknown",
"evidence": "The candidate passed isolated local macOS Electron runs before and after the final rebase; longer CI and soak history is not yet available."
},
"redGreenEvidence": {
"status": "complete",
"evidence": "The unchanged STA-4063 five-assertion oracle is red 5/5 on scan e4c278eb52 and latest main bc2e30000b, partially green 2/5 on pre-fix PR #14100, green 5/5 on candidate 14b5877a75, and red 3/5 when only the new transaction cleanup boundary is disabled on final candidate a9e6fb7716. The earlier STA-4025 transaction oracle remains red on the post-#13909 base and green on this candidate. The byte-identical STA-4231 headed oracle is red on latest-main b19d99bd00: both 15-second creates return runtime_timeout without a page ID while the host retains two distinct pages after retry. The relevant behavior is unchanged through 0a0ae974d4. The candidate is green with one returned canonical ID, one host/client page, and no retry; disabling only the navigation-independent acknowledgement is red with the same two orphaned pages. The byte-identical 2ec1dcf1 Electron oracle remains red on latest main 346e59c879, green on candidate d05217c40d, and red with only side-preview focus disabled; historical 5806b23f evidence separately proves owning-runtime routing."
},
"performanceBudget": {
"required": true,
"evidence": "The transaction adds no timer, polling, retry, subprocess, RPC method, stream opcode, or global host publication. Owner-pinned success performs one create RPC followed by one asynchronous goto, retains one page, and performs zero retry or cleanup calls. A lost create acknowledgement performs one exact close by the preallocated canonical ID and at most one confirming snapshot. Headless goto publishes one worktree-scoped session snapshot after navigation. Capability rejection performs zero RPCs and one bounded empty-group close. The E2E-only one-shot faults are build-gated, retain one promise/flag and a bounded page-id set, and reset after each run. Pending client placements remain capped at 128 and clear on adoption, failure, or teardown."
},
"promotionCriteria": [
"Collect Linux and physical Windows paired-server evidence.",
"Collect 100 consecutive focused CI passes or 14 days without an unexplained flake."
],
"knownGaps": [
"Live paired-server validation currently covers macOS only.",
"Multiple simultaneous viewers are not exercised by the Electron journey.",
"Direct SSH remote file URLs remain intentionally unsupported and local file previews retain their existing path."
],
"demotionRule": "Demote if one paired HTML action can create duplicate client or host browser identities, lose the requested split, steal editor focus before an explicit browser click, lose browser focus after that click, or remove unrelated editor or terminal state on close."
},
{
"id": "browser-network-tunnel.bounded-fail-closed-route",
"title": "Client-hosted browser routes stay bounded and fail closed",
"maturity": "experimental",
"protection": "partial",
"owner": "browser-runtime",
"layer": "shared-protocol-main-network-contract",
"surfaces": [
"client-hosted browser tunnel framing",
"execution-host TCP credit flow",
"capability-gated native and SSH execution-host adapters",
"main-owned loopback SOCKS5 route",
"runtime-owned browser-host lease and placement authority",
"exact live client-page placement admission",
"bounded client page-command dispatch and replay",
"server-owned page-command issue and result ledger",
"same-socket paired-runtime control requests",
"paired desktop browser-host lifecycle composition",
"same-pairing browser-host authority replacement",
"bounded client-page reconciliation execution",
"proof-driven server page-reconciliation orchestration",
"capability-gated client-page reconciliation commands",
"dedicated paired-runtime E2EE tunnel subscription"
],
"platforms": ["macos", "linux", "windows"],
"providers": ["local", "remote-runtime", "ssh", "wsl"],
"coveredPlatforms": ["macos"],
"coveredProviders": ["remote-runtime", "ssh"],
"coverageNotes": "Deterministic protocol, registry, injected-socket, and loopback-listener tests cover strict framing, remote-DNS targets, exact destination-write and source-consumption credit, at most 16 pending opens, 128 admitted opens per 10-second monotonic window, an 8 MiB per-route application-buffer ledger, shared 32 MiB browser-host and 128 MiB process ledgers across application copies, encrypted client queues, and native WebSocket bufferedAmount, bounded byte/claim/socket-source counts, a four-frame queued-drain quantum, authority epochs, exact host selection, one host per authenticated connection, four hosts per paired device, eight global browser-host polls with four per authenticated paired device, a shared ask/host ceiling that retains one quarter for waits, bounded initial and reconnect runtime_busy recovery, long-poll metering and disconnect abort, monotonic host/page/route generations without page tombstones, two-phase exact page retirement with cancellation, connection-owned cleanup, exact client revocation, stale and replaced fences, retired stream IDs, half-close and close ordering, SOCKS CONNECT, bind/close races, listener wildcard normalization, unsupported commands, unavailable routes, and raw/terminal binary-handler isolation. Page commands use a separately echoed v1 attach negotiation, exact authority/host/page generations, bounded command IDs and sequences, and bounded create/navigate payloads; legacy attaches still receive only the unchanged ready/revoked event shapes. A second optional reconciliation subprotocol gates bounded reclaim, close, and restore payloads behind exact attach/ready echo, complete inventory, command negotiation, reconnect authority, and command-result authority; the production client advertises it only with the matching command and inventory capabilities. Exact guest or app-renderer loss marks one page generation outcome-unknown, coalesces a bounded negotiated inventory reattach, closes or retires the dead generation, and allocates a fresh generation before URL restore; explicit close is not misclassified as a crash. Mixed-version mutation tests project hidden client pages before activate, close, split, reorder, and move-to-group admission, preserve hidden raw order slots, translate visible insertion indices, and project mutation snapshots. A production server orchestrator consumes each immutable inventory once, reserves target generations without exposing placement, emits only negotiated ledger commands, commits after exact completed proof, preserves unrelated and server placements, aborts an attempt when connection authority enters reconnect grace, and requires fresh inventory after failure or abort. The production client dispatcher additionally proves per-page FIFO execution, exact payload-matched duplicate replay, frozen command/result snapshots, a global retired-generation floor, transactional admission, bounded pages/active commands/queues/per-page and global result cache/concurrency, create dependency failure, cancellation, deduplicated retirement joining, and bounded close without late-result overwrite. The server ledger owns issue order and immutable command/result snapshots, bounds outstanding commands, active pages, and per-page/global replay caches, releases active-page capacity after an exact completed close while retaining bounded result replay, validates the shared wire payload before admission, requires live delivery and exact placement, authenticates results to the negotiated connection and paired lease, rejects gaps and conflicting replay, and fences outstanding outcomes at exact retirement. Negotiated command results reuse the authenticated attach socket through bounded nested JSON requests; exact ID routing, reverse-order replies, unknown and duplicate IDs, timeout teardown, serialization failure, aggregate queue accounting, acknowledgement validation, and the unchanged non-v1 path are deterministic. A stable local listener rejects CONNECT while offline or reconnecting, retains its address across replacement, requires a strictly increasing tunnel generation, ignores late superseded callbacks, propagates tunnel protocol failure to the route owner, and recycles exhausted stream IDs only after generation replacement. Reconnect uses the unchanged native v1 attach payload and capability pair; SSH descriptors alone add an execution-host capability and require a runtime-minted grant bound to the exact browser-host lease. Exact SSH provider epoch and connection generation fence ssh2 forwardOut and one non-interactive standalone system-SSH dynamic forward per route. Unit tests preserve domain-form SOCKS requests, sanitize remote errors, bound stderr, cancel startup, release timed-out and synchronously failed sockets, and release routes once. An ephemeral Docker sshd resolves a container-only domain and returns a unique HTTP marker through both ssh2 and the actual system-OpenSSH dynamic-forward adapter without touching the user's SSH files; authority loss fences the ssh2 route. The execution runtime charges route application bytes to the same per-host/process policy; its existing E2EE owner separately caps native outbound buffers process-wide. Production-registered browser-host and paired-runtime methods lease one exact host, prove attach, command delivery, and result settlement share one exact connection identity, then carry SOCKS and HTTP bytes over a dedicated E2EE socket to the fenced execution-host revision and prove route close destroys the destination socket. The production desktop adapter now composes one exact host per environment pairing revision with the page executor, current renderer selector, route Session/WebContents registries, and one reference-counted route per canonical execution-host key. Negotiated same-client control reconnect retains exact authority, placements, grants, dispatcher dedupe, executor guests, and listener addresses; it fences tunnels immediately, blocks route admission, reattaches command delivery only after ready, and replays unsettled commands without repeating completed mutations. Terminal release, replacement, legacy disconnect, and reconnect-grace expiry make only the exact host generation's client placements non-cancellable retirement-pending while retaining capacity until exact cleanup; reconnect grace preserves them. Environment replacement and app shutdown still serialize transport closure before page cleanup and force-close every remaining route. The production placement preparation starts the exact desktop adapter and advertises host/tunnel capabilities only when the paired Electron client is eligible. Node stream-internal high-water bytes, strict cross-route scheduling, and physical cross-platform evidence remain uncovered.",
"motivatingLinks": [
"https://linear.app/stably/issue/STA-4150/refactor-remote-browser-to-client-hosted-electron-webviews"
],
"invariant": "A client-hosted browser network route exists only for an exact live server-owned browser-host lease, authority epoch, host generation, paired identity, execution-host revision or SSH provider authority, and server-owned route generation. A client page is usable only when its runtime ID, authority epoch, host identity and generation, logical page ID, page-host generation, current placement, and still-live lease all match atomically; a retired, retirement-pending, or server-placed page cannot be claimed as live client placement. Live logical placements and their identities are bounded, an occupied logical page cannot change placement until exact two-phase retirement completes, cancellation restores the same authority, and the runtime-wide page generation stays monotonic without tombstones. Server-issued page commands and results remain bounded, FIFO per page, immutable after admission, authenticated to the exact paired lease, attach connection, and live placement, and replayable only when byte-equivalent. Negotiated transient result-transport loss retains exact authority and replays unsettled commands through the preserved client dedupe cache; terminal authority loss makes outstanding outcomes unknown and makes only the exact host generation's placements non-cancellable retirement-pending until exact cleanup or reconciliation proof. Desktop composition installs exact command authority before delivery, keeps result settlements below nested-request capacity, suspends every tunnel without closing guests on negotiated loss, gates handlers through route recovery, and synchronously suspends routes and revokes exact retained navigation grants before asynchronous transport or handler cleanup on terminal loss. Navigation-revocation failure remains observable without preventing guest destruction and route cleanup. One environment pairing revision owns at most one composed desktop host and one reference-counted route per canonical execution-host key; pairing replacement and shutdown close control transport before pages and force-close routes even when guest cleanup remains ambiguous. Non-native descriptors require explicit capability negotiation and an exact runtime-minted lease-bound execution-host grant. Host selection never chooses arbitrarily, stale cleanup or settlement cannot remove a replacement, destination names remain unresolved until the execution host, credit returns only after writes settle, and route loss never falls back to desktop DNS or sockets. A main-owned local listener remains stable across upstream transport loss, rejects CONNECT while offline, accepts only a strictly newer tunnel generation, ignores superseded callbacks, and never reuses a stream ID within one generation. Pending opens, admitted open rate, nested control requests, per-route application bytes, aggregate browser-host/process bytes, claims, and socket sources remain bounded with exact release on settlement and retirement. Queued transport drain yields after a bounded quantum. The local SOCKS endpoint accepts only loopback CONNECT and rejects unsupported commands.",
"oracle": "Attach two browser hosts and require unqualified selection to fail ambiguous while exact selection succeeds. Reject a second identity on one connection and a fifth identity for one paired device, release one exact lease, then admit its replacement without starving another device. Admit four hosts from one authenticated device and a host from a second, reject the first device's fifth host, and release only the first device's exact counters while the second remains live. Fill asks and hosts to their shared ceiling, retain a quarter of the total budget for ordinary waits, close both sockets, and prove every global, class, and device counter releases. Reject one initial host attach with the unchanged runtime_busy response, then require bounded client-specific jitter to attach when capacity returns; repeated rejection and explicit close must release every timer and subscription. Replace one same-device connection, require the old subscription and route to fence, then prove late old cleanup leaves the new generation live. Mint an exact execution-host grant, reject a different key, prove late old grant cleanup leaves its replacement, and invalidate every grant with lease replacement. Reject client-to-client, client-to-server, server-to-server, and server-to-client placement overwrite until exact retirement. Begin retirement once idempotently, reject client use and every replacement while pending, cancel the exact token to restore the same placement, and reject delayed cancellation or completion after a newer retirement begins. On explicit release, replacement, legacy disconnect, and reconnect-grace expiry, require only the exact host generation's client placements to become non-cancellable retirement-pending before lease settlement; preserve negotiated grace, other hosts, server placements, replacements, and capacity until exact completion. Complete only the exact pending token, retain capacity until completion, and require a reused client page ID to receive a higher global generation without retaining a tombstone. Require a client page through the exact runtime, epoch, host, and page tuple; reject every mismatch, released or replaced leases, retirement-pending pages, retired pages, server placements, invalid identities, and the 257th live placement. Admit 16 pending destination opens and reject the seventeenth until one connects; admit 128 opens in one monotonic 10-second window and reject the 129th until the window expires. Fill 8 MiB across destination-to-client queues and separately across unsettled client-to-destination writes, release one exact retired stream, admit one replacement, and require the next byte claim to close the route without stale-callback or reentrant-close underflow. Across multiple routes, charge application copies, encrypted queue entries, and dynamic native socket bytes to one 32 MiB browser-host and 128 MiB process ceiling; reject zero-byte claim/socket-source floods, fence released leases, synchronously release JavaScript queue claims while retaining native claims through exact socket close, and yield a parked queue after four frames without reordering. Route nested responses by exact ID under reordering, reject unknown and duplicate IDs, cap pending requests and queued bytes, and tear down every concurrent waiter once on timeout or close. Drive one real paired attach, command, and result through one exact connection ID; reject missing send support and malformed or wrong-runtime acknowledgements while preserving old non-v1 attaches. Drop an authenticated transport, require the same listener to reject CONNECT before and during reconnect, attach the exact existing native v1 payload and capability pair to a strictly newer generation, ignore late old callbacks, and roll an exhausted stream-ID ledger only by replacing the generation. Require SSH descriptors to add an execution-host capability and exact grant, reject missing grants and stale provider authority before resolver or binary registration, pass exact domains to ssh2 and system-SSH SOCKS without local resolution, sanitize connector diagnostics, and close every stream and standalone route process once on timeout, synchronous failure, or rotation. Drive the accepted lease through real paired E2EE native SOCKS-to-HTTP and ephemeral Docker ssh2 remote-only DNS journeys, then exercise exact frame, credit, half-close, stale-stream, remote-DNS, unsupported-command, offline, and teardown assertions.",
"commands": [
"pnpm exec vitest run --config config/vitest.config.ts src/main/browser/browser-route-webcontents-registry.test.ts src/main/browser/browser-client-page-unavailability.test.ts src/main/browser/paired-runtime-browser-client-host-reconnect.test.ts src/main/browser/paired-runtime-browser-client-host-composition.test.ts src/main/runtime/runtime-browser-client-page-recovery.test.ts src/main/runtime/rpc/methods/session-tab-browser-placement-mutations.test.ts src/main/runtime/rpc/methods/session-tab-browser-placement-projection.test.ts",
"pnpm exec vitest run --config config/vitest.config.ts src/main/runtime/browser-host-page-retirement.test.ts src/main/runtime/browser-host-page-placement-replacement.test.ts src/main/runtime/browser-host-page-placement.test.ts src/main/runtime/browser-host-lease-registry.test.ts",
"pnpm exec vitest run --config config/vitest.config.ts src/main/runtime/browser-host-lease-placement-retirement.test.ts src/main/runtime/browser-host-page-retirement.test.ts src/main/runtime/browser-host-page-placement-replacement.test.ts src/main/runtime/browser-host-page-placement.test.ts src/main/runtime/browser-host-lease-registry.test.ts",
"pnpm exec vitest run --config config/vitest.config.ts src/main/runtime/browser-host-page-reconciliation-plan.test.ts src/main/runtime/browser-host-page-reconciliation-executor.test.ts",
"pnpm exec vitest run --config config/vitest.config.ts src/main/runtime/browser-host-page-reconciliation-orchestration.test.ts src/main/runtime/browser-host-command-ledger.test.ts src/main/runtime/browser-host-page-placement.test.ts src/main/runtime/browser-host-lease-registry.test.ts",
"pnpm exec vitest run --config config/vitest.config.ts src/shared/browser-client-host-reconciliation-protocol.test.ts src/main/browser/paired-runtime-browser-host-reconciliation-negotiation.test.ts src/main/runtime/rpc/methods/browser-client-host-reconciliation.test.ts src/main/runtime/browser-host-lease-registry.test.ts src/main/browser/paired-runtime-browser-client-host.test.ts",
"pnpm exec vitest run --config config/vitest.config.ts src/shared/browser-client-host-protocol.test.ts src/main/browser/browser-client-host-attach-request.test.ts src/main/browser/browser-client-page-command-executor.test.ts src/main/browser/browser-client-page-command-integration.test.ts src/main/browser/browser-client-page-inventory.test.ts src/main/browser/paired-runtime-browser-client-host-composition.test.ts src/main/browser/paired-runtime-browser-client-host.test.ts src/main/browser/paired-runtime-browser-host-lease.test.ts src/main/runtime/browser-host-lease-registry.test.ts src/main/runtime/rpc/methods/browser-client-host.test.ts src/main/runtime/browser-host-page-reconciliation-plan.test.ts",
"pnpm exec vitest run --config config/vitest.config.ts src/main/browser/browser-client-host-reconciliation-command-order.test.ts src/main/browser/browser-client-page-reconciliation-adapters.test.ts src/main/browser/browser-route-prepared-page-rekey.test.ts",
"pnpm exec vitest run --config config/vitest.config.ts src/shared/browser-network-capabilities.test.ts src/shared/browser-network-tunnel-protocol.test.ts src/main/browser/browser-network-tunnel-session.test.ts src/main/browser/remote-browser-socks-server.test.ts",
"pnpm exec vitest run --config config/vitest.config.ts src/main/browser/browser-network-tunnel-client.test.ts src/main/browser/paired-runtime-browser-network-route.test.ts src/main/runtime/runtime-binary-message-router.test.ts src/main/runtime/rpc/methods/browser-network-tunnel.test.ts src/main/runtime/browser-network-tunnel-paired-runtime.integration.test.ts",
"pnpm exec vitest run --config config/vitest.config.ts src/main/browser/browser-network-tunnel-outbound-memory-budget.test.ts src/main/browser/browser-network-tunnel-client-memory-budget.test.ts src/main/browser/browser-network-tunnel-session-aggregate-memory.test.ts src/shared/ws-outbound-backpressure-queue.test.ts src/shared/remote-runtime-client.test.ts",
"pnpm exec vitest run --config config/vitest.config.ts src/shared/browser-client-host-protocol.test.ts src/shared/ws-outbound-backpressure-queue.test.ts src/shared/remote-runtime-client.test.ts src/main/runtime/browser-host-lease-registry.test.ts src/main/runtime/runtime-rpc-browser-host-admission.test.ts src/main/runtime/rpc/methods/browser-client-host.test.ts src/main/runtime/rpc/methods/browser-network-tunnel.test.ts src/main/browser/paired-runtime-browser-host-lease.test.ts src/main/browser/paired-runtime-browser-network-route.test.ts src/main/runtime/browser-network-tunnel-paired-runtime.integration.test.ts src/main/browser/browser-network-tunnel-client.test.ts src/main/browser/browser-network-tunnel-client-memory-budget.test.ts src/main/browser/browser-network-tunnel-session.test.ts src/main/browser/browser-network-tunnel-session-aggregate-memory.test.ts src/main/browser/browser-network-tunnel-outbound-memory-budget.test.ts src/main/browser/remote-browser-socks-server.test.ts",
"pnpm exec vitest run --config config/vitest.config.ts src/shared/browser-client-host-protocol.test.ts src/main/runtime/browser-host-lease-registry.test.ts src/main/runtime/runtime-rpc-browser-host-admission.test.ts src/main/runtime/rpc/methods/browser-client-host.test.ts src/main/runtime/rpc/methods/browser-network-tunnel.test.ts src/main/browser/paired-runtime-browser-host-lease.test.ts src/main/browser/paired-runtime-browser-network-route.test.ts src/main/runtime/browser-network-tunnel-paired-runtime.integration.test.ts src/main/browser/browser-network-tunnel-client.test.ts src/main/browser/browser-network-tunnel-session.test.ts src/main/browser/remote-browser-socks-server.test.ts",
"pnpm exec vitest run --config config/vitest.config.ts src/shared/remote-runtime-client.test.ts",
"pnpm exec vitest run --config config/vitest.config.ts src/shared/remote-runtime-subscription-request.test.ts",
"pnpm exec vitest run --config config/vitest.config.ts src/main/browser/browser-client-host-command-dispatcher.test.ts",
"pnpm exec vitest run --config config/vitest.config.ts src/main/browser/paired-runtime-browser-client-host.test.ts src/main/browser/paired-runtime-browser-host-lease.test.ts src/main/browser/browser-client-host-command-dispatcher.test.ts",
"pnpm exec vitest run --config config/vitest.config.ts src/main/browser/paired-runtime-browser-client-host.test.ts src/main/browser/paired-runtime-browser-client-host-reconnect.test.ts src/main/browser/paired-runtime-browser-host-lease.test.ts src/main/browser/paired-runtime-browser-host-lease-reconnect.test.ts src/main/browser/browser-host-lease-reconnect-delay.test.ts src/main/browser/browser-client-host-command-dispatcher.test.ts",
"pnpm exec vitest run --config config/vitest.config.ts src/main/runtime/runtime-rpc-browser-host-admission.test.ts src/main/browser/paired-runtime-browser-host-lease-reconnect.test.ts",
"pnpm exec vitest run --config config/vitest.config.ts src/shared/browser-client-host-protocol.test.ts src/main/browser/browser-client-host-attach-request.test.ts src/main/browser/browser-client-network-route-registry.test.ts src/main/browser/paired-runtime-browser-client-host-composition.test.ts src/main/browser/paired-runtime-browser-client-host.test.ts src/main/browser/paired-runtime-browser-client-host-reconnect.test.ts src/main/browser/paired-runtime-browser-host-lease.test.ts src/main/browser/paired-runtime-browser-host-lease-reconnect.test.ts src/main/browser/browser-host-lease-reconnect-delay.test.ts src/main/browser/paired-runtime-browser-network-route.test.ts src/main/runtime/browser-host-command-ledger.test.ts src/main/runtime/browser-host-command-ledger-capacity.test.ts src/main/runtime/browser-host-lease-registry.test.ts src/main/runtime/rpc/methods/browser-client-host.test.ts",
"pnpm exec vitest run --config config/vitest.config.ts src/shared/browser-client-host-protocol.test.ts src/main/browser/browser-client-host-attach-request.test.ts src/main/browser/browser-client-network-route-registry.test.ts src/main/browser/paired-runtime-browser-client-host-composition.test.ts src/main/browser/paired-runtime-browser-client-host.test.ts src/main/browser/paired-runtime-browser-client-host-reconnect.test.ts src/main/browser/paired-runtime-browser-host-lease.test.ts src/main/browser/paired-runtime-browser-host-lease-reconnect.test.ts src/main/browser/browser-host-lease-reconnect-delay.test.ts src/main/browser/paired-runtime-browser-network-route.test.ts src/main/runtime/browser-host-command-ledger.test.ts src/main/runtime/browser-host-command-ledger-capacity.test.ts src/main/runtime/browser-host-lease-registry.test.ts src/main/runtime/runtime-rpc-browser-host-admission.test.ts src/main/runtime/rpc/methods/browser-client-host.test.ts",
"pnpm exec vitest run --config config/vitest.config.ts src/shared/browser-client-host-protocol.test.ts src/main/browser/browser-client-host-attach-request.test.ts src/main/browser/browser-client-network-route-registry.test.ts src/main/browser/paired-runtime-browser-client-host-composition.test.ts src/main/browser/paired-runtime-browser-client-host.test.ts src/main/browser/paired-runtime-browser-client-host-reconnect.test.ts src/main/browser/paired-runtime-browser-host-lease.test.ts src/main/browser/paired-runtime-browser-host-lease-reconnect.test.ts src/main/browser/browser-host-lease-reconnect-delay.test.ts src/main/browser/paired-runtime-browser-network-route.test.ts src/main/runtime/browser-host-command-ledger.test.ts src/main/runtime/browser-host-command-ledger-capacity.test.ts src/main/runtime/browser-host-lease-placement-retirement.test.ts src/main/runtime/browser-host-lease-registry.test.ts src/main/runtime/runtime-rpc-browser-host-admission.test.ts src/main/runtime/rpc/methods/browser-client-host.test.ts",
"pnpm exec vitest run --config config/vitest.config.ts src/main/browser/browser-client-network-route-registry.test.ts src/main/browser/paired-runtime-browser-client-host-composition.test.ts src/main/browser/paired-runtime-browser-client-host-registry.test.ts src/main/browser/paired-runtime-browser-client-host-runtime.test.ts src/main/browser/browser-client-page-command-executor.test.ts src/main/browser/browser-session-startup.test.ts src/main/ipc/runtime-environments-subscription-teardown.test.ts",
"pnpm exec vitest run --config config/vitest.config.ts src/main/runtime/browser-host-command-ledger.test.ts src/main/runtime/browser-host-command-ledger-capacity.test.ts src/main/runtime/browser-host-lease-registry.test.ts src/main/runtime/rpc/methods/browser-client-host.test.ts",
"pnpm exec vitest run --config config/vitest.config.ts src/main/runtime/browser-host-lease-registry.test.ts src/main/browser/browser-network-deferred-socket.test.ts src/main/browser/browser-network-execution-route.test.ts src/main/browser/paired-runtime-browser-network-route.test.ts src/main/runtime/rpc/methods/browser-network-tunnel.test.ts src/main/browser/ssh-browser-network-execution-route.test.ts src/main/browser/system-ssh-socks-client-socket.test.ts src/main/ssh/system-ssh-dynamic-forward-process.test.ts src/shared/browser-client-host-protocol.test.ts src/shared/browser-network-capabilities.test.ts src/main/ssh/system-ssh-forward-process.test.ts src/main/ssh/ssh-system-fallback.test.ts src/main/ssh/ssh-port-forward.test.ts",
"ORCA_RUN_DOCKER_SSH_BROWSER_E2E=1 pnpm exec vitest run --config config/vitest.config.ts tests/e2e/ssh-browser-network-execution-route.docker.unit.test.ts"
],
"testFiles": [
"src/main/browser/browser-route-webcontents-registry.test.ts",
"src/main/browser/browser-client-page-unavailability.test.ts",
"src/main/runtime/runtime-browser-client-page-recovery.test.ts",
"src/main/runtime/rpc/methods/session-tab-browser-placement-mutations.test.ts",
"src/main/runtime/rpc/methods/session-tab-browser-placement-projection.test.ts",
"src/shared/browser-network-capabilities.test.ts",
"src/shared/browser-client-host-protocol.test.ts",
"src/shared/browser-client-host-reconciliation-protocol.test.ts",
"src/shared/browser-network-tunnel-protocol.test.ts",
"src/main/runtime/browser-host-lease-placement-retirement.test.ts",
"src/main/runtime/browser-host-page-retirement.test.ts",
"src/main/runtime/browser-host-page-placement-replacement.test.ts",
"src/main/runtime/browser-host-page-placement.test.ts",
"src/main/runtime/browser-host-page-reconciliation-plan.test.ts",
"src/main/runtime/browser-host-page-reconciliation-executor.test.ts",
"src/main/runtime/browser-host-page-reconciliation-orchestration.test.ts",
"src/main/runtime/browser-host-command-ledger.test.ts",
"src/main/runtime/browser-host-command-ledger-capacity.test.ts",
"src/main/runtime/browser-host-lease-registry.test.ts",
"src/main/runtime/runtime-rpc-browser-host-admission.test.ts",
"src/main/runtime/rpc/methods/browser-client-host.test.ts",
"src/main/runtime/rpc/methods/browser-client-host-reconciliation.test.ts",
"src/main/browser/paired-runtime-browser-host-lease.test.ts",
"src/main/browser/paired-runtime-browser-host-lease-reconnect.test.ts",
"src/main/browser/paired-runtime-browser-host-reconciliation-negotiation.test.ts",
"src/main/browser/browser-host-lease-reconnect-delay.test.ts",
"src/main/browser/paired-runtime-browser-client-host.test.ts",
"src/main/browser/paired-runtime-browser-client-host-reconnect.test.ts",
"src/main/browser/browser-client-network-route-registry.test.ts",
"src/main/browser/paired-runtime-browser-client-host-composition.test.ts",
"src/main/browser/paired-runtime-browser-client-host-registry.test.ts",
"src/main/browser/paired-runtime-browser-client-host-runtime.test.ts",
"src/main/browser/browser-client-host-attach-request.test.ts",
"src/main/browser/browser-client-host-reconciliation-command-order.test.ts",
"src/main/browser/browser-client-page-command-executor.test.ts",
"src/main/browser/browser-client-page-command-integration.test.ts",
"src/main/browser/browser-client-page-reconciliation-adapters.test.ts",
"src/main/browser/browser-client-page-inventory.test.ts",
"src/main/browser/browser-route-prepared-page-rekey.test.ts",
"src/main/browser/browser-session-startup.test.ts",
"src/main/ipc/runtime-environments-subscription-teardown.test.ts",
"src/main/browser/browser-client-host-command-dispatcher.test.ts",
"src/main/browser/browser-network-tunnel-session.test.ts",
"src/main/browser/browser-network-tunnel-session-aggregate-memory.test.ts",
"src/main/browser/browser-network-tunnel-client.test.ts",
"src/main/browser/browser-network-tunnel-client-memory-budget.test.ts",
"src/main/browser/browser-network-tunnel-outbound-memory-budget.test.ts",
"src/main/browser/browser-network-deferred-socket.test.ts",
"src/main/browser/browser-network-execution-route.test.ts",
"src/main/browser/paired-runtime-browser-network-route.test.ts",
"src/main/browser/ssh-browser-network-execution-route.test.ts",
"src/main/browser/system-ssh-socks-client-socket.test.ts",
"src/main/ssh/system-ssh-dynamic-forward-process.test.ts",
"src/main/ssh/ssh-port-forward.test.ts",
"src/main/browser/remote-browser-socks-server.test.ts",
"src/main/runtime/runtime-binary-message-router.test.ts",
"src/main/runtime/rpc/methods/browser-network-tunnel.test.ts",
"src/main/runtime/browser-network-tunnel-paired-runtime.integration.test.ts",
"src/shared/remote-runtime-client.test.ts",
"src/shared/remote-runtime-subscription-request.test.ts",
"src/shared/ws-outbound-backpressure-queue.test.ts",
"tests/e2e/ssh-browser-network-execution-route.docker.unit.test.ts"
],
"assertionRefs": [
{
"file": "src/main/runtime/browser-host-lease-placement-retirement.test.ts",
"assertions": [
"terminal release fences exact host-generation placements before lease settlement and makes retirement non-cancellable",
"terminal fencing upgrades an existing retirement without touching server placements or another host generation",
"negotiated reconnect grace preserves placement while grace expiry and legacy disconnect retire it",
"late old-generation cleanup cannot retire a replacement and capacity remains occupied until exact completion"
]
},
{
"file": "src/main/runtime/browser-host-page-retirement.test.ts",
"assertions": [
"pending retirement fences exact client-page use and every replacement",
"retirement begin is idempotent while exact cancellation restores the same authority",
"delayed cancellation or completion cannot settle a newer retirement",
"capacity releases only after exact completion and reused page generations remain monotonic",
"completion serializes against cancellation and recursion while hook failure stays retryable",
"server placements use the same two-phase settlement barrier"
]
},
{
"file": "src/main/runtime/browser-host-page-placement-replacement.test.ts",
"assertions": [
"client and server placements cannot overwrite an occupied logical page",
"occupied page IDs reject replacement before client-host selection",
"placement capacity remains occupied until exact retirement",
"stale cleanup cannot retire a replacement and page generations remain monotonic"
]
},
{
"file": "src/main/runtime/browser-host-page-placement.test.ts",
"assertions": [
"client placement requires the exact runtime, epoch, host, and page generation on a live lease",
"lease release and replacement fence an otherwise matching client placement",
"retired, replaced, and server placements cannot be claimed as live client pages",
"live placement count and page/host identities are bounded before generation allocation"
]
},
{
"file": "src/main/runtime/browser-host-page-reconciliation-plan.test.ts",
"assertions": [
"exact current pages retain without navigation while runtime-missing pages restore and client orphans close",
"profile, execution-host, authority, generation, and outcome-unknown mismatches require a close-before-restore barrier",
"old-epoch reclaim requires one exact persisted previous authority on the same runtime, authenticated paired-device provenance, an epoch transition, and the same browser-host client identity while allowing counters to restart under the new epoch",
"a runtime-authority change, including an SSH page whose route key omits runtime identity, requires close-before-restore instead of DOM-preserving reclaim",
"duplicate and over-capacity inventories fail atomically before returning a partial plan",
"invalid identities, generations, URLs, states, limits, duplicate inventories, and over-capacity inventories fail atomically while valid records and action lists are immutable"
]
},
{
"file": "src/main/runtime/browser-host-lease-registry.test.ts",
"assertions": [
"multiple live hosts require exact selection instead of first-connected routing",
"one connection and one paired device cannot retain more than their exact host limits",
"same-device replacement increments generation and fences the old connection",
"negotiated disconnect keeps exact authority and placement unavailable until same-device reattach or grace expiry",
"an exact reconnect arriving before old cleanup supersedes only the connection while preserving authority and fencing tunnels",
"foreign device, capability mismatch, explicit release, and late reattach cannot resume fenced authority",
"disconnect fences every tunnel immediately while retaining command, placement, and execution-host state through grace",
"late cleanup cannot remove a newer lease or route generation",
"execution-host grants bind to one exact lease and key while stale cleanup cannot remove a replacement",
"lease replacement invalidates every grant from the old host generation",
"late page cleanup cannot remove a replacement client generation or server placement",
"retired page placement leaves no tombstone and a reused ID receives a higher global generation",
"page placement generations are monotonic and stale lease authority is rejected",
"incomplete, unsupported-version, duplicate, over-budget, and foreign-client inventories fail before lease replacement",
"a previous-runtime inventory remains eligible for exact persisted-authority restart reconciliation",
"the exact authenticated lease retains an immutable inventory snapshot",
"reconciliation requires command and complete-inventory negotiation",
"reconnect cannot change reconciliation negotiation in place",
"legacy command leases reject reconciliation variants before delivery"
]
},
{
"file": "src/main/runtime/runtime-rpc-browser-host-admission.test.ts",
"assertions": [
"browser-host attachment has a dedicated sub-cap that preserves ordinary wait admission",
"one paired device cannot consume the second device's reserved browser-host share",
"asks and browser hosts share a ceiling that retains one quarter of total capacity for waits",
"socket close aborts the exact host and wait handlers and releases both counters"
]
},
{
"file": "src/shared/browser-client-host-protocol.test.ts",
"assertions": [
"page-command v1 negotiation is optional and independent of the legacy ready/revoked stream",
"lease reconnect v1 is optional, stripped by old decoders, and valid only beside complete page inventory v1",
"page-inventory v1 is optional, independently echoed, authority-bound, duplicate-free, capped at 256 pages and 768 KiB, and stripped by old attach and ready decoders",
"inventory-only identities are capped after JSON escaping so 256 worst-case valid page records remain within budget without narrowing legacy fields",
"create and navigate commands bind bounded IDs and sequences to exact runtime, epoch, host, and page generations",
"unknown versions, command kinds, invalid generations, and oversized identities fail before delivery",
"command-result acknowledgements require an explicit boolean accepted field"
]
},
{
"file": "src/shared/browser-client-host-reconciliation-protocol.test.ts",
"assertions": [
"old attach and ready decoders strip the optional reconciliation version",
"reclaim, close, and restore commands require exact reconciliation negotiation",
"reclaim and close bind the previous page to exact authority while restore inputs remain bounded",
"legacy create and navigate command payloads remain unchanged"
]
},
{
"file": "src/main/browser/paired-runtime-browser-host-lease.test.ts",
"assertions": [
"a client requests commands only with a delivery handler and accepts them only after an exact v1 echo",
"an old host that omits the echo cannot deliver a command",
"one complete inventory snapshot is sampled before attach, a missing echo stays unsupported, and an unsolicited echo closes the lease",
"stale authority commands close the exact lease before handler delivery",
"completed and failed results submit exact command authority on the established subscription",
"missing result transport, handler failure, server rejection, and malformed or wrong-runtime acknowledgement close the lease",
"exact duplicate result acknowledgement remains idempotent",
"result settlement concurrency stays below nested-request capacity and excess unsettled results fail closed"
]
},
{
"file": "src/main/browser/paired-runtime-browser-host-lease-reconnect.test.ts",
"assertions": [
"initial runtime_busy admission retries on bounded deterministic jitter and attaches when capacity returns",
"initial admission expiry and explicit close release every timer and subscription",
"runtime_busy during negotiated reconnect remains inside the existing grace without replacing authority",
"only an echoed reconnect v1 plus complete inventory preserves exact authority after recoverable transport loss",
"duplicate and stale transport callbacks cannot start extra attempts or fence the current subscription",
"repeated reconnects retain bounded timers and subscriptions while authority changes and explicit revocation fail terminally",
"missing echo preserves legacy teardown and grace expiry closes every retained attempt exactly once",
"malformed and unsolicited reconnect echoes fail closed",
"outstanding command replay reuses exact active result admissions without double-charging settlement capacity",
"an unencodable reconnect inventory cannot silently replace exact authority or fall back to legacy"
]
},
{
"file": "src/main/browser/paired-runtime-browser-host-reconciliation-negotiation.test.ts",
"assertions": [
"the optional reconciliation request is retained only after exact ready echo",
"an older host can omit the echo without enabling reconciliation",
"unsolicited and dependency-inconsistent echoes fail closed",
"exact reconnect rejects reconciliation downgrade"
]
},
{
"file": "src/main/browser/browser-host-lease-reconnect-delay.test.ts",
"assertions": [
"client-specific retry jitter is deterministic and remains inside exponential, two-second, and grace ceilings",
"invalid timer delays fail before starting a subscription"
]
},
{
"file": "src/main/browser/paired-runtime-browser-client-host.test.ts",
"assertions": [
"reconciliation is advertised only when the composed host explicitly enables it beside complete inventory",
"exact dispatcher authority exists before the first same-socket command can arrive",
"explicit close shuts transport before aborting every owned page handler",
"dispatcher abort still runs when lease cleanup rejects",
"lease transport failure aborts every owned handler and reports one terminal error",
"retirement and forgetting accept only the exact owned page generation",
"timed-out retirement stays fenced until the exact late handler settles",
"bounded host close exposes exact eventual settlement for deferred page cleanup"
]
},
{
"file": "src/main/browser/paired-runtime-browser-client-host-reconnect.test.ts",
"assertions": [
"an acknowledged mutation replay uses the preserved dispatcher result without rerunning its handler"
]
},
{
"file": "src/main/browser/paired-runtime-browser-client-host-composition.test.ts",
"assertions": [
"exact route authority activates before the first page command",
"each initial or reconnect attach samples a fresh exact executor inventory while the compatibility gate binds to the latest published snapshot",
"control loss suspends routes without closing pages and command admission waits for exact route recovery",
"one command gate spans repeated loss while stale route recoveries cannot close the replacement",
"page retirement settles dispatcher ownership before guest cleanup and ledger forget",
"terminal close suspends routes and fences every navigation grant before control cleanup can await handlers",
"shutdown closes control transport before executor pages and every retained route",
"non-settling handlers remove network reach immediately and defer page cleanup until exact late settlement",
"deferred executor cleanup failures remain fenced and emit an observable composition error",
"same-pairing runtime replacement retires old routes, fences guest navigation, waits for old handlers, and activates retained inventory only after exact reconciliation echo",
"a legacy replacement remains available for empty inventory but cannot activate routes for unreconciled retained pages",
"retired-route cleanup failure closes the composition before replacement authority can activate",
"late callbacks from a replaced host generation cannot suspend or close its replacement",
"cleanly absent failed creates are forgotten while unresolved cleanup remains fenced"
]
},
{
"file": "src/main/browser/browser-client-host-attach-request.test.ts",
"assertions": [
"an unencodable optional inventory is omitted without changing legacy page-command negotiation",
"reconnect negotiation is emitted only beside an encoded complete inventory"
]
},
{
"file": "src/main/browser/browser-client-host-reconciliation-command-order.test.ts",
"assertions": [
"reclaim, restore, and close are valid first commands only after exact reconciliation negotiation",
"reclaim and restore failure cancels later navigation without running it",
"nested prior authority is immutable and exact duplicate matching rejects mutation on both ledgers",
"successful close is terminal while failed close releases the fence and successful reclaim can continue with navigation"
]
},
{
"file": "src/main/browser/browser-client-page-command-executor.test.ts",
"assertions": [
"in-flight create, ambiguous cleanup, and stale renderer authority snapshot as outcome unknown",
"a destroyed exact guest snapshots as outcome unknown before executor retirement",
"create-to-active transition emits one exact page record without duplicate identity",
"successful normalized navigation updates the immutable current URL snapshot unless normalization exceeds the URL field bound",
"legacy-valid command identities remain executable even when optional inventory cannot encode them",
"executor capacity cannot exceed the shared 256-page attach limit",
"failed retirement leaves immutable outcome-unknown inventory without a retryable live-page handle",
"authority transition retains page inventory while fencing old navigation and uses the replacement connection identity for future pages",
"in-flight old-authority creation rechecks transition state and releases its route without committing a page",
"transition revocation failure keeps later commands fenced while exact cleanup still completes",
"ordinary navigation requires the page inventory to match the exact command authority",
"terminal navigation fencing revokes retained grants once and blocks late in-flight creation without inferring destruction",
"revocation failure remains observable while exact guest, renderer, Session, and route cleanup still run"
]
},
{
"file": "src/main/browser/browser-client-page-reconciliation-adapters.test.ts",
"assertions": [
"reclaim moves one exact retained guest to a new authority without remounting",
"DOM-preserving reclaim is rejected when the runtime authority changes",
"restore creates fresh authority and destroys it when initial navigation cannot be proven",
"close targets only exact prior authority",
"renderer failure or abort after main rekey retires both possible exact renderer identities, preserves unrelated pages, destroys the guest, and reports outcome unknown"
]
},
{
"file": "src/main/browser/browser-route-prepared-page-rekey.test.ts",
"assertions": [
"prepared authority rekeys without changing its opaque capability token",
"stale, occupied, cross-page, and cross-renderer targets fail without mutation"
]
},
{
"file": "src/main/browser/browser-client-page-command-integration.test.ts",
"assertions": [
"spontaneous exact guest destruction revokes active inventory before explicit page retirement"
]
},
{
"file": "src/main/browser/browser-client-page-inventory.test.ts",
"assertions": [
"optional URLs compact by deterministic codepoint order without dropping required page identity",
"an unencodable complete snapshot declines inventory negotiation instead of dropping a page"
]
},
{
"file": "src/main/browser/paired-runtime-browser-client-host-registry.test.ts",
"assertions": [
"one environment pairing revision shares one host composition",
"a same-pairing runtime change preserves that composition and delegates exact authority replacement",
"a failed authority replacement retains a cleanup tombstone and cannot expose a half-active successor",
"a changed pairing revision closes before its replacement starts",
"unsettled host cleanup retains a bounded tombstone, blocks replacement, and releases only when deferred cleanup proves completion",
"unresolved deferred cleanup remains fail-closed until authenticated reconciliation or process restart",
"environment retirement permits a later exact restart",
"app shutdown permanently fences new host admission before closing every environment"
]
},
{
"file": "src/main/browser/browser-client-network-route-registry.test.ts",
"assertions": [
"canonical execution-host keys share one route until the final page release",
"native routes must name the exact authority runtime",
"aborted startup releases without admitting a route handle",
"suspension blocks new retention and reconnect preserves the exact listener address",
"one transient route failure retries without closing healthy routes",
"a superseded route recovery retains no retry timer",
"persistent route failure exhausts bounded grace without leaking retry timers",
"authority retirement blocks admission and reconnect while retaining suspended SSH routes until exact page release",
"final shutdown force-closes retained retired routes",
"registry shutdown closes every route and rejects later admission"
]
},
{
"file": "src/main/browser/paired-runtime-browser-client-host-runtime.test.ts",
"assertions": ["pairing resolution failures preserve the asynchronous start contract"]
},
{
"file": "src/main/browser/browser-client-host-command-dispatcher.test.ts",
"assertions": [
"commands execute FIFO per page while only exact payload-matched duplicates replay without rerunning side effects",
"authority, sequence, generation, and create dependencies fence stale or ambiguous commands",
"failed admission consumes no page authority and every resource class stays bounded",
"retirement and close cancel immediately but retain a fence until non-cooperative handlers settle",
"bounded close exposes one exact eventual-settlement barrier after late handlers finish",
"a handler cannot reenter retirement before its bounded join is installed",
"an abort listener cannot reenter before the shared retirement operation is published",
"retiring a queued generation removes its stale scheduler entry before replacement",
"forgotten pages retain a global stale-generation floor and cached results have a global ceiling",
"lease authority and command identity are immutable snapshots while replacement releases retired cache"
]
},
{
"file": "src/main/runtime/browser-host-command-ledger.test.ts",
"assertions": [
"server-issued commands are delivered FIFO per page and settle only in exact sequence",
"reattached delivery replays every unsettled command without replacing its immutable identity",
"partial replay delivery failure detaches transport without discarding unsettled commands",
"exact result replay is idempotent while conflicting, stale, or gapped results fail closed",
"outstanding commands and pages remain bounded before admission side effects",
"lease loss or exact page retirement makes every outstanding outcome unknown"
]
},
{
"file": "src/main/runtime/browser-host-command-ledger-capacity.test.ts",
"assertions": [
"per-page and global result replay caches expire at exact ceilings",
"accepted authority, command, and result payloads remain immutable",
"oversized wire payloads fail before page, sequence, or delivery admission",
"new issue delivery failure closes the ledger and fences every outstanding outcome"
]
},
{
"file": "src/main/runtime/rpc/methods/browser-client-host.test.ts",
"assertions": [
"the control method stays out of production registration",
"only a negotiated authenticated paired-runtime connection receives a server-owned epoch and generation",
"page-command v1 is echoed only to an explicit v1 attach while legacy event shapes remain unchanged",
"page-inventory v1 is echoed only after a complete authenticated inventory is retained on the exact lease",
"negotiated exact reattach emits ready before replaying the unchanged unsettled command",
"reattach before old cleanup preserves the same authority and ends only the superseded connection stream",
"only the exact negotiated connection, paired device, and live page placement can settle a server-owned command",
"an unnegotiated runtime connection cannot submit command results",
"exact duplicate results are idempotent while conflicts and stale or retired placement fail closed",
"a second browser-host identity on one authenticated connection is rejected",
"legacy cleanup emits exact revocation while negotiated cleanup enters bounded unavailable grace"
]
},
{
"file": "src/main/runtime/rpc/methods/browser-client-host-reconciliation.test.ts",
"assertions": [
"the authenticated server echoes and retains reconciliation only when explicitly requested",
"command result settlement requires the exact negotiated reconciliation authority"
]
},
{
"file": "src/shared/browser-network-tunnel-protocol.test.ts",
"assertions": [
"remote DNS names round-trip without client resolution",
"unknown versions, opcodes, oversized payloads, and length mismatches fail closed"
]
},
{
"file": "src/main/browser/browser-network-tunnel-session.test.ts",
"assertions": [
"destination writes replenish client credit only after settlement",
"stale generations and reused stream IDs cannot replace the current destination",
"late frames for retired or reserved stream IDs leave concurrent destinations alive while never-reserved IDs fail closed",
"pending opens and admitted open rate remain bounded and recover only after exact release or window expiry",
"both traffic directions share an 8 MiB application-retention ledger with exact settlement, retirement, stale-callback, and reentrant-close release",
"unsettled client-to-destination writes retain at most 256 chunks per stream independently of byte credit"
]
},
{
"file": "src/main/browser/browser-network-tunnel-session-aggregate-memory.test.ts",
"assertions": [
"multiple execution-host routes share browser-host application-byte admission in both traffic directions",
"route close releases aggregate claims exactly before stale destination-write callbacks"
]
},
{
"file": "src/main/browser/browser-network-tunnel-client.test.ts",
"assertions": [
"source writes never exceed granted credit or the bounded data-frame size",
"destination credit tracks only browser-facing socket writes that settle after readable consumption",
"pending tiny frames stay chunk-bounded and data drains before remote close retirement",
"late local settlement after remote close sends no stale credit and leaves the tunnel usable",
"stale generations cannot open a stream and route close destroys every source",
"late frames for retired stream IDs leave concurrent sources alive while never-allocated IDs fail closed",
"stream IDs never repeat within one tunnel generation after the bounded ledger exhausts"
]
},
{
"file": "src/main/browser/browser-network-tunnel-client-memory-budget.test.ts",
"assertions": [
"multiple client routes on one browser host share source-write application admission",
"destination copies remain charged through browser-facing socket settlement",
"credited transport handoff transfers application ownership before callback settlement"
]
},
{
"file": "src/main/browser/browser-network-tunnel-outbound-memory-budget.test.ts",
"assertions": [
"application, encrypted-queue, and native socket bytes share one host ceiling",
"distinct hosts share one process ceiling with exact release",
"zero-byte claims, socket sources, hosts, and leases have independent bounds",
"released leases cannot admit work and retained owners keep exact accounting alive",
"unavailable native-buffer evidence fails closed until its exact source releases"
]
},
{
"file": "src/main/runtime/runtime-binary-message-router.test.ts",
"assertions": [
"dedicated raw tunnel traffic cannot replace or be decoded as terminal stream traffic on the same connection"
]
},
{
"file": "src/main/browser/remote-browser-socks-server.test.ts",
"assertions": [
"domain CONNECT preserves the final execution-host DNS target",
"unsupported commands and unavailable routes open no fallback destination"
]
},
{
"file": "src/main/runtime/rpc/methods/browser-network-tunnel.test.ts",
"assertions": [
"the production RPC registry excludes the tunnel until route authorization exists",
"unnegotiated, self-asserted, stale, wrong-execution-revision, and stale-SSH-authority browser hosts register no binary handler",
"SSH execution-host descriptors require a separately negotiated capability",
"ungranted or wrong-key SSH routes are rejected before resolver, memory, or binary registration",
"connector diagnostics are mapped to a stable public error without local path disclosure",
"grant revocation aborts connector startup immediately and cannot race through route admission",
"execution-host invalidation closes the session and releases its connector exactly once",
"memory exhaustion opens no route or binary handler",
"the server allocates route generations and fences the replaced route",
"subscription cleanup removes the exact connection-owned raw handler",
"raw-handler cleanup failure cannot retain route memory or lease authority"
]
},
{
"file": "src/main/browser/paired-runtime-browser-network-route.test.ts",
"assertions": [
"route teardown closes a subscription that resolves after startup cancellation",
"close after subscription acquisition settles the pending readiness wait",
"post-auth readiness has a deadline and runtime close tears down the local route",
"listener teardown failures remain visible to the route owner",
"the route binds and releases its exact host/process memory lease and four-frame drain quantum",
"one listener stays fail-closed and address-stable through reconnect",
"replacement generations advance strictly and remain fenced after ready-close races",
"reconnect retains the exact existing native v1 attach payload and capability pair",
"only an SSH descriptor adds the execution-host capability",
"late superseded callbacks cannot replace or close the current transport",
"a current-generation protocol failure retires the transport and remains reconnectable",
"stream-ID exhaustion replaces the generation before recycling an ID"
]
},
{
"file": "src/main/browser/browser-network-deferred-socket.test.ts",
"assertions": [
"destroy before source attachment emits one close and destroys a late source",
"source close after destroy cannot emit duplicate wrapper close"
]
},
{
"file": "src/main/browser/browser-network-execution-route.test.ts",
"assertions": [
"execution-host route keys cannot collide on delimiter-containing identities",
"native routing accepts only the exact runtime revision without retaining an invalidation callback"
]
},
{
"file": "src/main/browser/ssh-browser-network-execution-route.test.ts",
"assertions": [
"missing and stale SSH provider authority is rejected before destination open",
"ssh2 forwardOut receives the exact domain and port without desktop resolution",
"a synchronous forwardOut disconnect releases the exact deferred socket once",
"provider rotation invalidates and releases the exact route once",
"one system-SSH dynamic forward is owned by the whole route",
"grant revocation aborts an in-progress system-SSH dynamic forward"
]
},
{
"file": "src/main/browser/system-ssh-socks-client-socket.test.ts",
"assertions": [
"the internal SOCKS5 client encodes the exact destination as a domain request"
]
},
{
"file": "src/main/ssh/system-ssh-dynamic-forward-process.test.ts",
"assertions": [
"system SSH uses BatchMode=yes, disables ControlMaster, and positions one dynamic forward before the destination",
"authority invalidation cancels an in-progress SSH launch and destroys its active readiness probe immediately"
]
},
{
"file": "src/main/ssh/ssh-port-forward.test.ts",
"assertions": [
"static system-SSH forwards receive the connection's complete resolved build options"
]
},
{
"file": "tests/e2e/ssh-browser-network-execution-route.docker.unit.test.ts",
"assertions": [
"an ephemeral sshd resolves a container-only domain and returns a unique HTTP marker",
"the real ssh2 forwardOut receives that exact domain and provider loss fences the route",
"one non-interactive system-OpenSSH dynamic forward passes the same remote-only oracle and closes cleanly"
]
},
{
"file": "src/main/runtime/browser-network-tunnel-paired-runtime.integration.test.ts",
"assertions": [
"attach, page-command delivery, and result settlement share one exact authenticated connection and paired identity",
"same-runtime authority replacement commits placement only after the exact completed client result",
"SOCKS HTTP bytes cross the dedicated authenticated E2EE subscription to runtime-native TCP",
"closing the route destroys the execution-host destination socket"
]
},
{
"file": "src/shared/remote-runtime-subscription-request.test.ts",
"assertions": [
"nested JSON responses route by exact request ID under reverse-order delivery",
"unknown and duplicate response IDs fail the authenticated subscription",
"serialization failure consumes no pending capacity and the 33rd concurrent request is rejected",
"one timeout rejects every concurrent waiter exactly once and closes the subscription",
"queued control bytes release once while native socket ownership remains charged through exact close",
"socket-registration and queue-claim denial report terminal failure exactly once"
]
},
{
"file": "src/shared/remote-runtime-client.test.ts",
"assertions": [
"the authenticated socket binds the optional tunnel capability",
"the dedicated outbound queue reports hard overflow instead of dropping a frame",
"encrypted queue claims release synchronously while native socket ownership remains charged through exact close"
]
},
{
"file": "src/shared/ws-outbound-backpressure-queue.test.ts",
"assertions": [
"direct and already-retained queued frames use distinct aggregate admission semantics",
"queued drain yields after its configured frame quantum without reordering",
"aggregate queue claims release on drain, denial, disposal, and close"
]
}
],
"evidenceRuns": [
{
"date": "2026-08-15",
"runner": "local",
"platform": "macos",
"command": "pnpm exec vitest run --config config/vitest.config.ts src/shared/browser-client-host-protocol.test.ts src/main/browser/browser-client-host-attach-request.test.ts src/main/browser/browser-client-network-route-registry.test.ts src/main/browser/paired-runtime-browser-client-host-composition.test.ts src/main/browser/paired-runtime-browser-client-host.test.ts src/main/browser/paired-runtime-browser-client-host-reconnect.test.ts src/main/browser/paired-runtime-browser-host-lease.test.ts src/main/browser/paired-runtime-browser-host-lease-reconnect.test.ts src/main/browser/browser-host-lease-reconnect-delay.test.ts src/main/browser/paired-runtime-browser-network-route.test.ts src/main/runtime/browser-host-command-ledger.test.ts src/main/runtime/browser-host-command-ledger-capacity.test.ts src/main/runtime/browser-host-lease-placement-retirement.test.ts src/main/runtime/browser-host-lease-registry.test.ts src/main/runtime/runtime-rpc-browser-host-admission.test.ts src/main/runtime/rpc/methods/browser-client-host.test.ts",
"result": "passed",
"durationSeconds": 3.61,
"summary": "On the #14753 tip, sixteen files passed 167 exact terminal navigation/route fencing, retained reconnect grace, placement retirement, attach, command, result, route recovery, admission, and mixed-version protocol assertions. The new composition oracle was 1 failed / 10 passed before implementation because terminal host loss started asynchronous close without first suspending routes or revoking navigation."
},
{
"date": "2026-08-15",
"runner": "local",
"platform": "macos",
"command": "pnpm exec vitest run --config config/vitest.config.ts src/main/runtime/browser-host-lease-placement-retirement.test.ts src/main/runtime/browser-host-page-retirement.test.ts src/main/runtime/browser-host-page-placement-replacement.test.ts src/main/runtime/browser-host-page-placement.test.ts src/main/runtime/browser-host-lease-registry.test.ts",
"result": "passed",
"durationSeconds": 0.32,
"summary": "On origin/main@5b7f44278a, the new oracle was 6 failed / 1 passed before implementation because terminal host fencing left exact placements cancellable; the candidate passed 44/44 terminal release, replacement, legacy disconnect, grace expiry, reconnect preservation, exact-generation isolation, capacity retention, and two-phase settlement assertions."
},
{
"date": "2026-08-15",
"runner": "local",
"platform": "macos",
"command": "pnpm exec vitest run --config config/vitest.config.ts src/main/runtime/runtime-rpc-browser-host-admission.test.ts src/main/browser/paired-runtime-browser-host-lease-reconnect.test.ts",
"result": "passed",
"durationSeconds": 7.89,
"summary": "On origin/main@5b7f44278a, two files passed 16 authenticated per-device/global browser-host admission, shared wait reservation, exact socket-counter release, bounded initial runtime_busy retry, explicit-close cleanup, and reconnect-grace authority-preservation tests."
},
{
"date": "2026-08-15",
"runner": "local",
"platform": "macos",
"command": "pnpm exec vitest run --config config/vitest.config.ts src/shared/browser-client-host-protocol.test.ts src/main/browser/browser-client-host-attach-request.test.ts src/main/browser/browser-client-network-route-registry.test.ts src/main/browser/paired-runtime-browser-client-host-composition.test.ts src/main/browser/paired-runtime-browser-client-host.test.ts src/main/browser/paired-runtime-browser-client-host-reconnect.test.ts src/main/browser/paired-runtime-browser-host-lease.test.ts src/main/browser/paired-runtime-browser-host-lease-reconnect.test.ts src/main/browser/browser-host-lease-reconnect-delay.test.ts src/main/browser/paired-runtime-browser-network-route.test.ts src/main/runtime/browser-host-command-ledger.test.ts src/main/runtime/browser-host-command-ledger-capacity.test.ts src/main/runtime/browser-host-lease-registry.test.ts src/main/runtime/runtime-rpc-browser-host-admission.test.ts src/main/runtime/rpc/methods/browser-client-host.test.ts",
"result": "passed",
"durationSeconds": 7.18,
"summary": "On origin/main@5b7f44278a, fifteen files passed 159 mixed-version attach, exact authority, bounded admission and recovery, reconnect, route suspension, page-command replay, result-ledger, and authenticated lease tests."
},
{
"date": "2026-08-14",
"runner": "local",
"platform": "macos",
"command": "pnpm exec vitest run --config config/vitest.config.ts src/shared/browser-client-host-protocol.test.ts src/main/browser/browser-client-host-attach-request.test.ts src/main/browser/browser-client-network-route-registry.test.ts src/main/browser/paired-runtime-browser-client-host-composition.test.ts src/main/browser/paired-runtime-browser-client-host.test.ts src/main/browser/paired-runtime-browser-client-host-reconnect.test.ts src/main/browser/paired-runtime-browser-host-lease.test.ts src/main/browser/paired-runtime-browser-host-lease-reconnect.test.ts src/main/browser/browser-host-lease-reconnect-delay.test.ts src/main/browser/paired-runtime-browser-network-route.test.ts src/main/runtime/browser-host-command-ledger.test.ts src/main/runtime/browser-host-command-ledger-capacity.test.ts src/main/runtime/browser-host-lease-registry.test.ts src/main/runtime/rpc/methods/browser-client-host.test.ts",
"result": "passed",
"durationSeconds": 2.23,
"summary": "Fourteen files passed 150 negotiated same-client reconnect, legacy skew, active takeover, exact authority, immediate route suspension, independently bounded route retry, stable fail-closed SOCKS, ready-before-replay, completed-mutation dedupe, partial-replay delivery recovery, repeated-loss, stale-callback, explicit-revocation, grace cleanup, and deterministic jittered-backoff tests."
},
{
"date": "2026-08-14",
"runner": "local",
"platform": "macos",
"command": "pnpm exec vitest run --config config/vitest.config.ts src/shared/browser-client-host-protocol.test.ts src/main/browser/browser-client-host-attach-request.test.ts src/main/browser/browser-client-page-command-executor.test.ts src/main/browser/browser-client-page-command-integration.test.ts src/main/browser/browser-client-page-inventory.test.ts src/main/browser/paired-runtime-browser-client-host-composition.test.ts src/main/browser/paired-runtime-browser-client-host.test.ts src/main/browser/paired-runtime-browser-host-lease.test.ts src/main/runtime/browser-host-lease-registry.test.ts src/main/runtime/rpc/methods/browser-client-host.test.ts src/main/runtime/browser-host-page-reconciliation-plan.test.ts",
"result": "passed",
"durationSeconds": 7.3,
"summary": "Eleven files passed 145 exact inventory negotiation, 256-page and 768 KiB atomic bounds, worst-case JSON-escaped inventory identities, deterministic optional-URL compaction, legacy-command preservation when inventory is unencodable, legacy strip, immutable authenticated lease snapshot, strict v1/duplicate/foreign-client rejection, paired-device-bound previous-runtime restart admission, missing and unsolicited echo, create-to-active deduplication, renderer/guest-stale outcome-unknown classification, normalized URL bounds, composition sampling, RPC retention, and reconciliation tests."
},
{
"date": "2026-08-14",
"runner": "local",
"platform": "macos",
"command": "pnpm exec vitest run --config config/vitest.config.ts src/main/browser/paired-runtime-browser-client-host.test.ts src/main/browser/paired-runtime-browser-host-lease.test.ts src/main/browser/browser-client-host-command-dispatcher.test.ts",
"result": "passed",
"durationSeconds": 0.8,
"summary": "Fifty tests passed synchronous authority activation, hard 16/256 result bounds, exact transport-close-before-handler-abort ordering, cleanup rejection with guaranteed abort, same-socket result settlement, exact page retirement and forgetting, and late non-cooperative retirement settlement. The broader runtime/browser/shared run passed 9,711 tests with 24 existing skips."
},
{
"date": "2026-08-14",
"runner": "local",
"platform": "macos",
"command": "pnpm exec vitest run --config config/vitest.config.ts src/shared/remote-runtime-subscription-request.test.ts",
"result": "passed",
"durationSeconds": 0.4,
"summary": "Ten tests passed same-socket nested JSON request delivery, reverse-order exact-ID routing, unknown and duplicate response rejection, 32-request admission, serialization rollback, concurrent timeout teardown, queued/native memory release, and exact-once socket-registration and queue-claim denial."
},
{
"date": "2026-08-14",
"runner": "local",
"platform": "macos",
"command": "pnpm exec vitest run --config config/vitest.config.ts src/main/browser/browser-client-host-command-dispatcher.test.ts",
"result": "passed",
"durationSeconds": 0.2,
"summary": "Sixteen tests passed immutable lease/command/result snapshots, exact-authority FIFO dispatch, payload-matched duplicate replay, transactional bounded admission, create dependency failure, stale and forgotten-generation fencing, scheduler replacement, retired-cache release, per-page and global cached-result expiry, pre-abort shared retirement publication, deduplicated/reentrant joining, cancellation, and bounded close."
},
{
"date": "2026-08-14",
"runner": "local",
"platform": "macos",
"command": "pnpm exec vitest run --config config/vitest.config.ts src/main/runtime/browser-host-command-ledger.test.ts src/main/runtime/browser-host-command-ledger-capacity.test.ts src/main/runtime/browser-host-lease-registry.test.ts src/main/runtime/rpc/methods/browser-client-host.test.ts",
"result": "passed",
"durationSeconds": 1.88,
"summary": "Four files passed 31 server-owned issue order, shared-schema payload validation, immutable authority and payload, exact result connection authentication and replay, stale and retirement fencing, outstanding/page/cache ceilings, transactional lifecycle settlement, delivery failure, and outcome-unknown tests."
},
{
"date": "2026-08-14",
"runner": "local",
"platform": "macos",
"command": "pnpm exec vitest run --config config/vitest.config.ts src/shared/browser-client-host-protocol.test.ts src/shared/ws-outbound-backpressure-queue.test.ts src/shared/remote-runtime-client.test.ts src/main/runtime/browser-host-lease-registry.test.ts src/main/runtime/runtime-rpc-browser-host-admission.test.ts src/main/runtime/rpc/methods/browser-client-host.test.ts src/main/runtime/rpc/methods/browser-network-tunnel.test.ts src/main/browser/paired-runtime-browser-host-lease.test.ts src/main/browser/paired-runtime-browser-network-route.test.ts src/main/runtime/browser-network-tunnel-paired-runtime.integration.test.ts src/main/browser/browser-network-tunnel-client.test.ts src/main/browser/browser-network-tunnel-client-memory-budget.test.ts src/main/browser/browser-network-tunnel-session.test.ts src/main/browser/browser-network-tunnel-session-aggregate-memory.test.ts src/main/browser/browser-network-tunnel-outbound-memory-budget.test.ts src/main/browser/remote-browser-socks-server.test.ts",
"result": "passed",
"durationSeconds": 3.9,
"summary": "Sixteen files passed 154 bounded page-command negotiation, legacy ready/revoked compatibility, exact authority, unnegotiated and stale-command delivery, lease, tunnel, memory, flow-control, SOCKS, and paired E2EE tests."
},
{
"date": "2026-08-14",
"runner": "local",
"platform": "macos",
"command": "pnpm exec vitest run --config config/vitest.config.ts src/main/runtime/browser-host-page-retirement.test.ts src/main/runtime/browser-host-page-placement-replacement.test.ts src/main/runtime/browser-host-page-placement.test.ts src/main/runtime/browser-host-lease-registry.test.ts",
"result": "passed",
"durationSeconds": 0.2,
"summary": "Four files passed 26 two-phase retirement, exact replacement, pre-selection admission, runtime/epoch/host/page authority, live-lease fencing, monotonic generation, invalid-identity, default 256-placement capacity, and stale-settlement tests."
},
{
"date": "2026-08-14",
"runner": "local",
"platform": "macos",
"command": "pnpm exec vitest run --config config/vitest.config.ts src/main/runtime/browser-host-lease-registry.test.ts src/main/browser/browser-network-deferred-socket.test.ts src/main/browser/browser-network-execution-route.test.ts src/main/browser/paired-runtime-browser-network-route.test.ts src/main/runtime/rpc/methods/browser-network-tunnel.test.ts src/main/browser/ssh-browser-network-execution-route.test.ts src/main/browser/system-ssh-socks-client-socket.test.ts src/main/ssh/system-ssh-dynamic-forward-process.test.ts src/shared/browser-client-host-protocol.test.ts src/shared/browser-network-capabilities.test.ts src/main/ssh/system-ssh-forward-process.test.ts src/main/ssh/ssh-system-fallback.test.ts src/main/ssh/ssh-port-forward.test.ts",
"result": "passed",
"durationSeconds": 2.6,
"summary": "Thirteen files passed 142 structural route-key, native-shape, live lease-bound SSH grant, startup cancellation, diagnostic redaction, deferred-socket release, capability negotiation, exact SSH authority and client, ssh2 forwarding, standalone system-SSH dynamic-forward, active-probe cleanup, static-forward option reuse, internal SOCKS domain, and exact release tests."
},
{
"date": "2026-08-14",
"runner": "local",
"platform": "macos",
"command": "ORCA_RUN_DOCKER_SSH_BROWSER_E2E=1 pnpm exec vitest run --config config/vitest.config.ts tests/e2e/ssh-browser-network-execution-route.docker.unit.test.ts",
"result": "passed",
"durationSeconds": 1.3,
"summary": "Two tests passed: an ephemeral Linux sshd resolved remote-only.internal and returned the sta-4150-remote-only HTTP marker over real ssh2 forwardOut and one real system-OpenSSH dynamic forward; the ssh2 route also fenced on authority invalidation."
},
{
"date": "2026-08-14",
"runner": "local",
"platform": "macos",
"command": "pnpm exec vitest run --config config/vitest.config.ts src/shared/browser-client-host-protocol.test.ts src/shared/ws-outbound-backpressure-queue.test.ts src/shared/remote-runtime-client.test.ts src/main/runtime/browser-host-lease-registry.test.ts src/main/runtime/runtime-rpc-browser-host-admission.test.ts src/main/runtime/rpc/methods/browser-client-host.test.ts src/main/runtime/rpc/methods/browser-network-tunnel.test.ts src/main/browser/paired-runtime-browser-host-lease.test.ts src/main/browser/paired-runtime-browser-network-route.test.ts src/main/runtime/browser-network-tunnel-paired-runtime.integration.test.ts src/main/browser/browser-network-tunnel-client.test.ts src/main/browser/browser-network-tunnel-client-memory-budget.test.ts src/main/browser/browser-network-tunnel-session.test.ts src/main/browser/browser-network-tunnel-session-aggregate-memory.test.ts src/main/browser/browser-network-tunnel-outbound-memory-budget.test.ts src/main/browser/remote-browser-socks-server.test.ts",
"result": "passed",
"durationSeconds": 7.7,
"summary": "Sixteen files passed 131 route, lease, aggregate application/encrypted/native memory, exact release, bounded-drain, stable-listener and protocol-failure reconnect, v1 reattach compatibility, generation/stream-ID fencing, SOCKS, and real paired E2EE tests; the full runtime-RPC suite separately passed 1,349 tests with one skip."
},
{
"date": "2026-08-14",
"runner": "local",
"platform": "macos",
"command": "pnpm exec vitest run --config config/vitest.config.ts src/shared/browser-client-host-protocol.test.ts src/main/runtime/browser-host-lease-registry.test.ts src/main/runtime/runtime-rpc-browser-host-admission.test.ts src/main/runtime/rpc/methods/browser-client-host.test.ts src/main/runtime/rpc/methods/browser-network-tunnel.test.ts src/main/browser/paired-runtime-browser-host-lease.test.ts src/main/browser/paired-runtime-browser-network-route.test.ts src/main/runtime/browser-network-tunnel-paired-runtime.integration.test.ts src/main/browser/browser-network-tunnel-client.test.ts src/main/browser/browser-network-tunnel-session.test.ts src/main/browser/remote-browser-socks-server.test.ts",
"result": "passed",
"durationSeconds": 6.9,
"summary": "Eleven files passed 73 admission, lease, route-generation, bidirectional retained-byte/chunk, pending-open/rate, exact-release, SOCKS, and real paired E2EE tests; the full runtime-RPC suite separately passed 1,347 tests with one skip."
},
{
"date": "2026-08-14",
"runner": "local",
"platform": "macos",
"command": "pnpm exec vitest run --config config/vitest.config.ts src/shared/browser-client-host-protocol.test.ts src/main/runtime/browser-host-lease-registry.test.ts src/main/runtime/runtime-rpc-browser-host-admission.test.ts src/main/runtime/rpc/methods/browser-client-host.test.ts src/main/runtime/rpc/methods/browser-network-tunnel.test.ts src/main/browser/paired-runtime-browser-host-lease.test.ts src/main/browser/paired-runtime-browser-network-route.test.ts src/main/runtime/browser-network-tunnel-paired-runtime.integration.test.ts src/main/browser/browser-network-tunnel-client.test.ts src/main/browser/browser-network-tunnel-session.test.ts src/main/browser/remote-browser-socks-server.test.ts",
"result": "passed",
"durationSeconds": 3.4,
"summary": "Eleven files passed 67 lease, reserved long-poll and host admission, token-safe placement retirement, authority, capability, route-generation, adversarial-revocation, lifecycle, flow-control, SOCKS, and real paired E2EE tests."
},
{
"date": "2026-08-13",
"runner": "local",
"platform": "macos",
"command": "pnpm exec vitest run --config config/vitest.config.ts src/shared/browser-network-capabilities.test.ts src/shared/browser-network-tunnel-protocol.test.ts src/main/browser/browser-network-tunnel-session.test.ts src/main/browser/remote-browser-socks-server.test.ts",
"result": "passed",
"durationSeconds": 0.4,
"summary": "Four files passed 25 deterministic capability, codec, credit, generation, half-close, SOCKS routing, remote-DNS, and fail-closed tests."
},
{
"date": "2026-08-14",
"runner": "local",
"platform": "macos",
"command": "pnpm exec vitest run --config config/vitest.config.ts src/main/browser/browser-network-tunnel-client.test.ts src/main/browser/paired-runtime-browser-network-route.test.ts src/main/runtime/runtime-binary-message-router.test.ts src/main/runtime/rpc/methods/browser-network-tunnel.test.ts src/main/runtime/browser-network-tunnel-paired-runtime.integration.test.ts",
"result": "passed",
"durationSeconds": 4.7,
"summary": "Five files passed 19 source-flow, settled-consumption, chunk-bound, ordered-close, readiness-deadline, cleanup-failure, binary-routing, attach-authorization, and real paired-runtime E2EE SOCKS-to-HTTP tests."
},
{
"date": "2026-08-14",
"runner": "local",
"platform": "macos",
"command": "pnpm exec vitest run --config config/vitest.config.ts src/shared/remote-runtime-client.test.ts",
"result": "passed",
"durationSeconds": 3.0,
"summary": "Seventeen authenticated subscription tests passed, including tunnel capability binding and hard outbound-queue overflow rejection."
}
],
"runtimeBudget": {
"p95Seconds": 10,
"scope": "deterministic lease, protocol, aggregate-memory, flow-control, loopback, RPC, and paired-runtime test files"
},
"flakeHistory": {
"status": "unknown",
"evidence": "The deterministic and paired-runtime suites passed locally; CI and soak history have not started for the stacked route stage."
},
"redGreenEvidence": {
"status": "partial",
"evidence": "The protocol and tunnel-session oracles fail on origin/main 3246b73add because the modules do not exist, then pass on the candidate. The lease registry and control-client suites were recorded red at missing modules before implementation. The unchanged tunnel authorization oracle was behaviorally red because an authenticated socket could self-assert its paired device ID and received ready generation 7 without a lease; it is green after server-owned lease and route fencing. On c9a41abf24, the unchanged admission oracle failed three ways: a second identity on one connection and a fifth identity for one paired device were both admitted, and closed page placement had no retirement API. All three pass after bounded admission and tombstone-free global page generations. Before the admission-fairness stage, one paired device's four hosts filled the global host cap and rejected a second device, initial runtime_busy was terminal, and reconnect runtime_busy ended preserved authority. Raising only the host cap then let asks and hosts starve ordinary waits. The reviewed candidate caps hosts at eight globally and four per authenticated paired device, caps asks plus hosts at twelve of sixteen polls, and retries runtime_busy only inside the existing attach or reconnect deadline; the unchanged oracle passes all 16 focused assertions with exact counter, subscription, and timer release. On parent 81eb14c849, the initial three replacement-barrier tests failed because occupied client and server pages could be overwritten without retirement; the candidate rejects every placement-kind overwrite before host selection, preserves capacity until exact retirement, and keeps replacement generations monotonic. On parent 32c0c7f309, all five two-phase retirement tests failed because retirement had only an immediate-delete API; the candidate fences pending pages, restores exact cancellation, rejects delayed tokens, and releases capacity only after exact completion. On parent 392d13be9f, the deterministic resource oracle admitted 17 pending opens, admitted a 129th open inside 10 seconds, and retained more than 8 MiB across one route; all three failed assertions pass on the candidate, which also covers unsettled writes and reentrant exact release. With aggregate enforcement replaced by a no-op scaffold on parent b32610e365, all three host/process memory assertions failed: host bytes, process bytes, claims, and socket sources were independently unbounded. They pass with exact owner release, client and execution-host application charging, encrypted queue/native socket charging, and bounded drain. On parent a089829521, stream exhaustion was not distinguishable, transport loss closed the local listener with ECONNREFUSED, reconnect opened no replacement subscription, and a ready generation that closed before await continuation could be replayed. The initial reconnect candidate also retained a dead transport after a client-side protocol failure and therefore refused replacement. The reviewed candidate keeps one fail-closed address, propagates protocol closure, strictly fences observed generations, ignores superseded callbacks, and recycles stream IDs only after replacement while preserving the v1 attach shape. Parent 9889adf4c5 accepts only a native executionHost schema and its handler unconditionally reads native runtimeId and revision; widening the schema made node typecheck fail at those exact assumptions before adapter integration. The candidate keeps native subscription bytes and capabilities unchanged, capability-gates SSH, rejects stale authority before binary registration, and passes exact domains through both adapter contracts. Before the reviewed authorization and lifecycle fix, 10 of 34 focused assertions failed: an ungranted SSH key reached the resolver, grants did not exist, native routes exposed a global never-settling invalidation promise, pre-attach destroy emitted no close, synchronous forwardOut escaped without cleanup, OpenSSH did not force a standalone process, and raw connector detail crossed the RPC boundary. The same 34 assertions pass with exact tokenized grants, optional native invalidation, one-close deferred sockets, caught synchronous opens, standalone OpenSSH, and stable public errors. The real paired journey failed at the missing network.browserTunnel method before explicit test injection, then passed with an exact control lease while both production registries remained closed. Full mutation/revert evidence remains to be collected before promotion."
},
"performanceBudget": {
"required": true,
"evidence": "Data frames, send credit, pending bytes and chunk counts in both directions, streams, SOCKS handshake, and pipelined application bytes are bounded. Each route admits at most 16 pending opens, 128 opens per monotonic 10-second window, and 8 MiB of session-owned queued or unsettled application bytes with exact settlement and retirement release. Multiple client routes share a 32 MiB browser-host and 128 MiB process ceiling across application copies, encrypted queue frames, and dynamic native socket buffers; the execution runtime uses the same per-host/process application policy. Claims, socket sources, host records, and leases have independent count caps; explicit close releases JavaScript queue claims synchronously while native socket ownership remains charged until exact socket close. Parked encrypted queues hand at most four frames to the native socket per immediate cooperative drain turn. One authenticated connection retains at most one browser host and one paired device at most four, with exact release restoring admission. Permanent browser-host polls use at most eight of sixteen slots and four per authenticated paired device; asks plus hosts use at most twelve, preserving four slots for ordinary waits. Admission retry adds no polling or subprocess: it owns one attach subscription and one timer at a time, uses deterministic client-specific jitter, and cannot outlive the existing attach timeout or negotiated reconnect grace. Each SSH route owns one ssh2 authority or one standalone system-SSH dynamic-forward process, keeps at most 64 KiB of stderr tail, and releases every adapter/socket on exact route close or provider rotation. The system-SSH process exposes a separate no-auth loopback SOCKS listener outside application stream/rate/memory accounting under the documented same-user desktop trust boundary. Credit returns only after the execution-host or browser-facing socket write settles, and the injected transport must explicitly accept each frame. Node stream-internal high-water bytes and strict cross-route scheduling evidence remain required before live tunnel advertisement."
},
"promotionCriteria": [
"Charge Node stream-internal high-water bytes and prove cross-route fairness under slow physical links; add a strict scheduler if the four-frame yield quantum is insufficient.",
"Approve all same-host local processes and users as inside the desktop trust boundary or replace SOCKS no-auth with Chromium-compatible process isolation.",
"Isolate or authenticate the system-SSH dynamic SOCKS listener, prove the bound listener belongs to the owned child, and preserve authenticated ControlMaster-only targets without persistent forwarding.",
"Add old/new peer coverage to the dedicated paired-runtime binary tunnel journey.",
"Add WSL, headed Linux, and physical Windows evidence.",
"Prove an Electron partition routes loopback, DNS, HTTP, HTTPS, WebSocket, workers, and speculative traffic without desktop fallback."
],
"knownGaps": [
"Eligible paired Electron clients advertise the runtime capabilities, use the production paired-tunnel method, and select the prepared route partition; older and ineligible clients do not.",
"The two-phase token-safe page-retirement API has no production lifecycle caller until client placement activates.",
"Application, encrypted queue, and native WebSocket bytes are aggregated, but Node stream-internal high-water bytes are only per-stream bounded and not charged to the host/process ledger.",
"A four-frame queued-drain quantum yields between timers, but strict cross-route fairness and slow-link soak evidence are not complete.",
"The loopback SOCKS endpoint uses Chromium-compatible no-auth and is not safe to activate until its desktop trust boundary is approved or isolated.",
"The system-SSH adapter opens another no-auth loopback SOCKS listener outside tunnel accounting; its release-and-bind port can be claimed by a sibling process, and readiness proves only that some TCP listener answered.",
"Standalone system-SSH cleanup is exact, but targets that require an already-authenticated ControlMaster, passphrase, PIN, or keyboard-interactive prompt can fail non-interactive route startup.",
"Execution-host grant keys are not independently capped or ref-counted; activation requires one server-owned page or partition lifetime and bounded per-lease grant admission.",
"Same-authority replay and concrete client reclaim, restore, and close application are deterministic, but server placement reconciliation still lacks dedicated authenticated command issuance and proof-driven placement rekey after runtime restart.",
"SSH2 and system OpenSSH have isolated Docker evidence, but WSL, browserless serve, Electron proxy policy, UDP denial, and desktop DNS/socket capture are not exercised."
],
"demotionRule": "Keep experimental or demote if a self-asserted or ambiguous host can receive a route, an SSH descriptor bypasses capability, lease-bound grant, or provider-authority checks, late cleanup can remove a replacement, a route can resolve names on the desktop, exceed a byte or stream bound, replenish credit before destination settlement, accept a stale or non-increasing generation, reuse a stream ID within one generation, lose or bypass its fail-closed listener during reconnect, expose the SOCKS listener off-loopback, accept BIND/UDP, or fall back when the selected route is unavailable."
},
{
"id": "browser-client-host.route-partition-policy",
"title": "Client-hosted browser partitions apply route policy before attachment",
"maturity": "experimental",
"protection": "partial",
"owner": "browser-runtime",
"layer": "electron-main-session-security-boundary",
"surfaces": [
"route- and profile-scoped Electron partitions",
"persistent partition binding metadata",
"fixed SOCKS5 session policy",
"webview partition allowlist"
],
"platforms": ["macos", "linux", "windows"],
"providers": ["remote-runtime", "ssh", "wsl"],
"coveredPlatforms": ["macos"],
"coveredProviders": [],
"coverageNotes": "Deterministic main-process tests cover versioned delimiter-safe aggregate partition derivation, path-safe opaque names, durable collision metadata, oversized or corrupt metadata refusal, missing-sidecar Chromium-data refusal, bounded binding/live-page admission, immediate SOCKS5 setup with Chromium loopback bypass disabled, inherited-connection closure, exact proxy verification before allowlisting, concurrent setup coalescing, live proxy-retarget refusal, token-safe page replacement, existing browser-profile policy installation, active Orca-profile storage scoping, blank-only initial attachment, arbitrary initial-navigation denial, and fail-closed per-guest WebRTC policy through delayed or failed cleanup. The production client-page executor prepares, registers, and grants the exact route page. A real Electron A/B capture proves HTTP, HTTPS, WebSocket, redirects, subresources, downloads, and a `.test` hostname traverse SOCKS with no direct target connection. A two-launch control proves immediate setProxy routes a forced persisted-worker wake and later worker fetch. A separate capture proves the protected guest sends zero direct STUN packets. A further capture proves non-WebRTC UDP is also contained: a WebTransport session and a fetch forced onto QUIC both reach the desktop directly in the control arm and emit zero datagrams through the route partition, and the shipped disable-features list hides the Direct Sockets constructors whose mere construction kills a control-arm renderer. DNS prefetch is a tripwire over an accepted residual rather than a guard: Electron 43 inherits Chromium's PrefetchDNS, so a `<link rel=\"dns-prefetch\">` host resolves on the desktop resolver outside the tunnel, and a source census keeps any DoH host-resolver mode from widening that leak. Network-service restart and provider journeys remain uncovered.",
"motivatingLinks": [
"https://linear.app/stably/issue/STA-4150/refactor-remote-browser-to-client-hosted-electron-webviews"
],
"invariant": "A client-hosted partition is derived only in main from stable Orca-profile, browser-profile, authority-connection, and execution-host identities. Raw identities and individually linkable component hashes never enter its path-safe partition name. Durable binding metadata must match and precede Chromium partition data before reuse. One live partition never changes execution host or proxy endpoint. Fixed SOCKS5 setup starts immediately after Session creation, before policy installation can yield or a persisted worker is awakened; no partition enters the webview allowlist until browser policy is installed, inherited connections are closed, and resolveProxy returns exactly that one listener. Initial route-partition attachment is blank-only. Its exact WebContents is quarantined before applying non-proxied WebRTC denial and remains navigation- and popup-denied if policy application or cleanup fails. Distinct live partitions, retained logical page generations, durable bindings, and binding-file reads remain bounded. No UDP transport a route-partition page can reach — WebRTC, WebTransport, or forced QUIC — emits a datagram to the desktop, the Direct Sockets constructors stay absent from every guest so no page can kill its renderer, and the process never enables a DoH host-resolver mode.",
"oracle": "Derive two delimiter-adversarial identities and require distinct full-digest path-safe partitions with no raw IDs or component hashes. Persist one binding, reload it, and reject replacement, malformed or oversized state, Chromium data without matching metadata, and the 513th binding. Prepare one partition and require setProxy with <-loopback> to be invoked immediately after getSession and before policy setup, then closeAllConnections and exact SOCKS5 resolveProxy while isAllowedPartition remains false; only then may it become live. Under real Electron, require direct controls for HTTP, HTTPS, WebSocket, redirects, subresources, and downloads, then require the fixed SOCKS session to route every equivalent request plus an otherwise-unresolvable `.test` hostname with zero direct target connections. Across two Electron launches, require immediate setProxy to route a forced worker wake and post-verification fetch. Reject DIRECT, endpoint retargeting, and capacity overflow. Require quarantine before disable_non_proxied_udp and admission; under real Electron require the unprotected control to emit STUN and the protected guest to emit zero direct UDP packets. Under real Electron require a direct control to emit WebTransport and forced-QUIC datagrams and the SOCKS partition to emit none, require an explicitly enabled Direct Sockets control to expose the constructors and die on construction, and require the shipped disable-features list to leave them undefined with the renderer alive. Capture a route partition's netLog across a dns-prefetch load and require the prefetched host to appear on a local resolver task while an unreferenced control host appears nowhere; require no source file to set a non-'off' secureDnsMode.",
"commands": [
"pnpm exec vitest run --config config/vitest.config.ts src/main/browser/browser-route-identity.test.ts src/main/browser/browser-route-partition-binding-store.test.ts src/main/browser/browser-route-session-registry.test.ts src/main/browser/browser-session-registry.test.ts src/main/browser/browser-session-startup.test.ts src/main/window/createMainWindow.test.ts",
"pnpm exec vitest run --config config/vitest.config.ts src/main/browser/browser-route-webcontents-registry.test.ts src/main/browser/browser-route-webrtc-egress.electron.test.ts",
"pnpm exec vitest run --config config/vitest.config.ts src/main/browser/browser-route-session-registry.test.ts src/main/browser/browser-route-persisted-worker-egress.electron.test.ts src/main/browser/browser-route-webrtc-egress.electron.test.ts",
"pnpm exec vitest run --config config/vitest.config.ts src/main/browser/browser-route-tcp-egress.electron.test.ts",
"pnpm exec vitest run --config config/vitest.config.ts src/main/browser/browser-route-h3-egress.electron.test.ts src/main/browser/browser-route-dns-prefetch.electron.test.ts src/main/startup/secure-dns-census.test.ts"
],
"testFiles": [
"src/main/browser/browser-route-identity.test.ts",
"src/main/browser/browser-route-partition-binding-store.test.ts",
"src/main/browser/browser-route-session-registry.test.ts",
"src/main/browser/browser-route-persisted-worker-egress.electron.test.ts",
"src/main/browser/browser-route-tcp-egress.electron.test.ts",
"src/main/browser/browser-route-webrtc-egress.electron.test.ts",
"src/main/browser/browser-route-h3-egress.electron.test.ts",
"src/main/browser/browser-route-dns-prefetch.electron.test.ts",
"src/main/startup/secure-dns-census.test.ts",
"src/main/browser/browser-route-webcontents-registry.test.ts",
"src/main/browser/browser-session-registry.test.ts",
"src/main/browser/browser-session-startup.test.ts",
"src/main/window/createMainWindow.test.ts"
],
"assertionRefs": [
{
"file": "src/main/browser/browser-route-identity.test.ts",
"assertions": [
"aggregate partition and durable binding fingerprints are stable and opaque",
"delimiter-containing identities remain structurally distinct",
"individual component equality and Windows-illegal path separators are absent",
"empty and unbounded identity components are rejected"
]
},
{
"file": "src/main/browser/browser-route-partition-binding-store.test.ts",
"assertions": [
"opaque bindings survive restart",
"replacement and malformed metadata fail closed",
"oversized metadata and Chromium data without a binding fail closed",
"persisted binding count is bounded"
]
},
{
"file": "src/main/browser/browser-route-session-registry.test.ts",
"assertions": [
"policy, proxy, connection closure, and verification finish before allowlisting",
"DIRECT and endpoint retargeting are rejected",
"non-loopback listeners and invalid page generations are rejected before persistence",
"missing browser profiles consume no durable binding capacity",
"partial setup cleanup and concurrent setup settle exactly once",
"partition and page-generation counts are bounded",
"stale page cleanup cannot retire its replacement"
]
},
{
"file": "src/main/browser/browser-route-persisted-worker-egress.electron.test.ts",
"assertions": [
"a forced persisted-worker wake before proxy setup reaches the direct desktop control endpoint",
"getAllRunning is empty immediately after persistent Session creation in either arm",
"invoking setProxy before the forced wake routes it through SOCKS with no direct target request",
"a later worker message fetch remains routed after exact proxy verification"
]
},
{
"file": "src/main/browser/browser-route-tcp-egress.electron.test.ts",
"assertions": [
"the unprotected Electron control reaches HTTP, HTTPS, WebSocket, redirect, subresource, and download targets directly",
"the fixed SOCKS session routes every equivalent TCP surface with zero direct target connections",
"an otherwise-unresolvable `.test` hostname is carried to SOCKS rather than desktop DNS"
]
},
{
"file": "src/main/browser/browser-route-webrtc-egress.electron.test.ts",
"assertions": [
"the unprotected SOCKS-partition control emits direct STUN packets",
"disable_non_proxied_udp leaves the exact guest with zero direct UDP packets"
]
},
{
"file": "src/main/browser/browser-route-h3-egress.electron.test.ts",
"assertions": [
"the direct control reaches a WebTransport endpoint over UDP and the route partition sends zero datagrams",
"a fetch forced onto QUIC by --origin-to-force-quic-on emits UDP directly and zero through the route partition",
"an explicit --enable-features exposes the Direct Sockets constructors in the control arm",
"constructing a TCPSocket in the control arm kills the guest renderer",
"the shipped disable-features list leaves every Direct Sockets constructor undefined and the renderer alive"
]
},
{
"file": "src/main/browser/browser-route-dns-prefetch.electron.test.ts",
"assertions": [
"a dns-prefetch hostname in a SOCKS route partition still opens a local host-resolver job",
"that job runs as a system or built-in DNS task, neither of which traverses the partition proxy",
"a hostname the page never references produces no host-resolver events"
]
},
{
"file": "src/main/startup/secure-dns-census.test.ts",
"assertions": [
"no source file configures a host resolver with a non-'off' secureDnsMode",
"the census matcher flags a known DoH offender"
]
},
{
"file": "src/main/browser/browser-route-webcontents-registry.test.ts",
"assertions": [
"route guests apply non-proxied WebRTC denial before admission",
"policy failure remains quarantined through delayed or failed guest close"
]
},
{
"file": "src/main/window/createMainWindow.test.ts",
"assertions": [
"a live route partition may attach only the normalized blank document",
"an arbitrary URL cannot be the initial route-partition document"
]
}
],
"evidenceRuns": [
{
"date": "2026-08-20",
"runner": "local",
"platform": "macos",
"command": "pnpm exec vitest run --config config/vitest.config.ts src/main/browser/browser-route-h3-egress.electron.test.ts src/main/browser/browser-route-dns-prefetch.electron.test.ts src/main/startup/secure-dns-census.test.ts",
"result": "passed",
"durationSeconds": 21,
"summary": "The direct control emitted 5 WebTransport and 6 forced-QUIC datagrams while the SOCKS route partition emitted zero of each. With Direct Sockets explicitly enabled the control exposed TCPSocket/UDPSocket/TCPServerSocket and constructing one killed the guest renderer; the shipped disable-features list left all three undefined and the renderer alive. The dns-prefetch tripwire recorded HOST_RESOLVER_SYSTEM_TASK for the prefetched host with zero events for an unreferenced control host, documenting the accepted local-resolution residual.",
"notes": "The dns-prefetch expectation intentionally asserts the leak. Flip it to an empty event list when the upstream Electron PrefetchDNS fix lands."
},
{
"date": "2026-08-17",
"runner": "local",
"platform": "macos",
"command": "pnpm exec vitest run --config config/vitest.config.ts src/main/browser/browser-route-tcp-egress.electron.test.ts",
"result": "passed",
"durationSeconds": 1,
"summary": "The real Electron direct control reached all six TCP request surfaces; the fixed SOCKS session carried HTTP, HTTPS, WebSocket, redirects, subresources, downloads, and remote DNS with zero direct target connections."
},
{
"date": "2026-08-16",
"runner": "local",
"platform": "macos",
"command": "pnpm exec vitest run --config config/vitest.config.ts src/main/browser/browser-route-session-registry.test.ts src/main/browser/browser-route-persisted-worker-egress.electron.test.ts src/main/browser/browser-route-webrtc-egress.electron.test.ts",
"result": "passed",
"durationSeconds": 10,
"summary": "Three files passed 28 tests. The two-launch worker control reached desktop localhost before proxy setup; immediate setProxy invocation routed the same wake and a later worker fetch through SOCKS with path-attributed direct counts remaining zero. Both resolved and rejected proxy setup keep failed-policy retries joined through connection cleanup. The protected WebRTC guest emitted zero direct UDP packets."
},
{
"date": "2026-08-16",
"runner": "local",
"platform": "macos",
"command": "pnpm exec vitest run --config config/vitest.config.ts src/main/browser/browser-route-webcontents-registry.test.ts src/main/browser/browser-route-webrtc-egress.electron.test.ts",
"result": "passed",
"durationSeconds": 8,
"summary": "Two files passed 24 assertions; the real Electron control emitted direct STUN, while the exact per-guest policy emitted zero desktop UDP packets and policy failure remained quarantined through delayed or failed close."
},
{
"date": "2026-08-14",
"runner": "local",
"platform": "macos",
"command": "pnpm exec vitest run --config config/vitest.config.ts src/main/browser/browser-route-identity.test.ts src/main/browser/browser-route-partition-binding-store.test.ts src/main/browser/browser-route-session-registry.test.ts src/main/browser/browser-session-registry.test.ts src/main/browser/browser-session-startup.test.ts src/main/window/createMainWindow.test.ts",
"result": "passed",
"durationSeconds": 0.5,
"summary": "Six files passed 150 opaque identity, durable collision binding, bounded partition/page, proxy-before-allowlist, policy reuse, profile startup, and blank-only attach tests."
}
],
"runtimeBudget": {
"p95Seconds": 2,
"scope": "deterministic identity, binding-store, session-policy, and window-boundary tests"
},
"flakeHistory": {
"status": "unknown",
"evidence": "The deterministic suite passes locally; CI and real Electron soak history have not started."
},
"redGreenEvidence": {
"status": "partial",
"evidence": "The TCP A/B control first reached all six target paths directly, while the fixed SOCKS arm routed the same HTTP, HTTPS, WebSocket, redirect, subresource, and download traffic plus remote DNS with zero direct target connections. The two-launch worker control reached desktop localhost before setProxy; immediate setProxy routed the same wake and later fetch through SOCKS. The WebRTC control emitted four direct STUN packets until disable_non_proxied_udp reduced the capture to zero. Non-WebRTC UDP and network-service restart remain explicit residuals."
},
"performanceBudget": {
"required": true,
"evidence": "Derivation performs one bounded full SHA-256 aggregate partition hash and one binding hash. The registry admits at most 64 live or pending partitions, 64 logical page generations per partition, and 512 durable bindings per Orca profile. Concurrent preparation shares one promise and one Electron proxy application per partition. Binding-file reads are capped at 128 KiB. Writes are bounded synchronous profile-local JSON, fsync the temporary file before Windows-retried rename, and fsync the containing directory where supported."
},
"promotionCriteria": [
"Use the production paired journey to prove proxy application precedes the first popup and speculative request.",
"Prove spontaneous persisted-worker background events cannot issue network requests between Session creation and immediate proxy invocation on macOS, Linux, and Windows; add a worker hold only if that evidence requires it.",
"Prove network-service restart cannot reset the partition to DIRECT or system proxy.",
"Activate a trusted exact-WebContents registration/grant flow before navigation, and fence reload, popup, restore, profile-switch, renderer-crash, and stale-cleanup paths.",
"Disable or capture every remaining UDP, QUIC, DoH, and non-SOCKS desktop egress path on macOS, Linux, and Windows."
],
"knownGaps": [
"The production client-page executor calls preparePage before renderer mounting and navigation grant.",
"A forced persisted worker is routed once setProxy is invoked immediately after Session creation; spontaneous background-event wake timing beyond the two-launch oracle still needs cross-platform soak evidence.",
"The route partition permits only blank initial attachment; the production executor registers and grants only the exact main-observed WebContents.",
"Network-service recovery, speculative requests, and popup traffic remain incompletely captured.",
"QUIC, DoH, WebTransport, and non-WebRTC UDP/direct-network paths are not yet disabled or proven fail closed.",
"Partition deletion, download/transfer draining, idle route release, disk quotas, and browser-profile cloning are later lifecycle stages.",
"Binding writes serialize in Electron main, and packaged hosts rely on Orca's per-userData single-instance lock. Activation still needs an explicit guard for dev instances that share userData or a cross-process CAS/lock.",
"Sequential proxy or policy setup failures retain durable bindings and can exhaust the 512-binding ledger. Activation requires bounded tombstone recovery and partition garbage collection.",
"Each preparePage synchronously reads and parses bounded binding metadata on Electron main; activation requires latency evidence or a safely invalidated cache before this becomes frequent."
],
"demotionRule": "Keep experimental or demote if raw identities enter a partition path, a durable binding mismatch is reused, a partition retargets to another execution host or live listener, a route partition becomes attachable before exact proxy verification, initial attachment can navigate beyond blank, stale cleanup retires a replacement, admission exceeds a declared cap, or any browser request reaches desktop DNS, TCP, UDP, localhost, or system proxy outside the selected route."
},
{
"id": "browser-client-host.webcontents-quarantine",
"title": "Route guests stay blank and popup-denied until exact registration",
"maturity": "experimental",
"protection": "partial",
"owner": "browser-runtime",
"layer": "electron-main-webcontents-authority",
"surfaces": [
"route guest did-attach lifecycle",
"exact host renderer and WebContents ownership",
"top-frame preload request admission",
"document-owned retained renderer webviews",
"logical page-generation registration",
"post-registration navigation grant",
"route popup fail-closed policy"
],
"platforms": ["macos", "linux", "windows"],
"providers": ["remote-runtime", "ssh", "wsl"],
"coveredPlatforms": ["macos"],
"coveredProviders": [],
"coverageNotes": "Deterministic main-process fakes cover route-Session recognition after logical release, prepared-page renderer ownership, stale and live waiters sharing pending partition setup, generic-policy-before-route-lockdown ordering, blank quarantine, exact guest/renderer/partition/logical-page registration, opaque page-authority replacement, a separate navigation grant, repeated navigation, invalid-scheme denial, dynamic page-authority revocation, popup denial, delayed/failed admission closure, exact page-release closure, retirement-start and destroyed-inspection failure, shared-partition retirement ordering, policy retention until every destroyed acknowledgement, guest process loss/destruction, opaque lifecycle claims across spontaneous destruction and WebContents ID reuse, owning-renderer process loss before, during, and after registration, mutable input isolation, page conflicts, and token-safe destroyed cleanup. The production page-command executor additionally retains an exact execution-host route, prepares its immutable partition, mounts one trusted renderer generation blank, registers and grants its exact guest, loads only normalized HTTP(S), and attempts every safe generation-scoped cleanup after failure, abort, or retirement while holding network resources without destruction proof. A production main-process bridge binds mount and retirement requests to the exact current renderer object and document generation, rejects sender spoofing and WebContents-ID reuse, carries no target URL, bounds pending requests, aborts, timeouts, malformed replies, and lifecycle replacement, and restores only an exact surviving renderer document after blocked or failed provisional navigation. The top-frame preload now queues and validates bounded requests before one replaceable subscriber, while a document-owned renderer registry mounts only blank route webviews, bounds global and per-partition guests, and fences attachment, retirement, destruction, and renderer loss by the full page tuple. Real Electron 43.1.0 proves exact main-frame reply admission, delayed guest-ID readiness, blank attachment, host ownership, destruction, and fail-closed denied attachment. Normal browser Sessions and paired web clients bypass the renderer registry. Production host composition and client placement activate the executor only after capability-gated placement preparation. Process/document swaps, worker/request/download settlement, traffic containment, and provider journeys remain uncovered.",
"motivatingLinks": [
"https://linear.app/stably/issue/STA-4150/refactor-remote-browser-to-client-hosted-electron-webviews"
],
"invariant": "A prepared route page binds its opaque authority to one exact main-observed renderer WebContents while that page generation is active or retiring. Before requesting a blank guest, the production command executor must retain the exact execution-host route, verify its key, and prepare the route/profile partition for one still-current renderer generation. Main sends the approved opaque partition and exact page generation, but no target URL, through one bounded request admitted against the exact current renderer object and document generation; only a schema-valid reply from that same object, request, operation, and page generation can settle it. Preload accepts requests only in the top frame, binds outcomes to the admitted request, fails overflow and unavailable subscribers within a bounded interval, and fences callbacks replaced by a newer document subscriber. Renderer retains each blank webview under one non-React document host keyed by the exact partition, page ID, and generation, never reparents it, and holds an attached or process-lost generation until exact destruction. Renderer replacement, WebContents-ID reuse, abort, timeout, malformed reply, disposal, and process loss fence pending work without admitting a late reply. Renderer-document replacement retires before commit, while blocked external navigation is ignored and failed or cancelled provisional navigation restores only the exact surviving frame. A WebContents whose Electron Session has belonged to a prepared route partition is quarantined synchronously after generic guest policy installation, including when page authority disappears between will-attach and did-attach. It must be a live blank webview owned by the exact renderer WebContents. Nonblank navigation remains denied until main matches the exact partition, browser page, page-host generation, guest WebContents, renderer WebContents, and opaque live page authority, then issues a separate grant. Every later navigation rechecks the same opaque guest incarnation and page authority, so reusing a logical tuple or WebContents ID cannot revive a stale guest. Releasing that authority, losing or destroying the guest process, or losing its owning renderer before, during, or after registration synchronously fences pending authority admission, ends exact logical authority, revokes navigation, and closes any attached guest through the same retirement barrier. Failed, aborted, or retired creation attempts revoke the exact guest and renderer mount before releasing the Session and route, attempt every safe cleanup, and never clear or admit a replacement generation after uncertain cleanup. Session and route release require exact guest destruction proof; an ambiguous mount outcome retains them. If close is delayed or fails, the partition stays outside attachment admission and route policies remain installed until the exact destroyed acknowledgement. Route popups remain denied throughout. Active and retiring page maps and pending renderer requests are bounded, stale callbacks cannot retire or clear replacements, and non-route browser guests retain existing behavior.",
"oracle": "Prepare a page for one renderer and require authority lookup and registration by a sibling renderer to fail; reject owner replacement while the generation is active or retiring, then lose the owning renderer before guest registration and require only its prepared pages to retire. Pause partition setup, lose the owner, and require its waiter to fail without authority; add a live sibling waiter to the same pending setup and require only that waiter to admit; exceed the configured waiter cap and require immediate refusal. Make policy cleanup throw in the first of two owned partitions and require the sweep to retire both without restoring admission. Through the production executor, retain one exact route, prepare its partition, mount blank on one current renderer, register and grant the exact guest in order, then load only its normalized HTTP(S) URL. Queue renderer requests before subscription, replace one subscriber, overflow both request and page budgets, race attachment with retirement, delay guest identity until DOM readiness, lose the guest renderer, and require exact bounded settlement without reparenting or cross-partition collision. Under real Electron, require the main bridge to accept only the actual main-frame reply, match the positive renderer WebContents ID to did-attach-webview, destroy it on retirement, and reject and remove a denied unprepared guest. Reject a mismatched route, stale renderer or page generation, and file URL without touching Chromium. Abort or fail registration after mount and require exact guest, renderer, Session, and route cleanup in that order; make renderer cleanup reject but require destruction before later release, and keep the generation fenced from replacement. Make guest retirement fail or mount outcome ambiguous and require every safe cleanup while Session and route remain retained. Destroy a guest spontaneously before command cleanup, reuse its WebContents identity, and require the old opaque claim not to retire the replacement while the replacement claim still can. Attach a blank route guest and require nonblank navigation plus every popup to be denied. Reject a wrong renderer, wrong page generation, nonblank initial document, wrong WebContents type, destroyed guest, and excess attachment; delay or fail its close and require navigation and popups to remain denied. Register the exact prepared tuple and prove navigation remains denied until a second grant; then allow repeated HTTP(S) navigation while continuing to deny file navigation and popups. Release logical page authority with delayed guest close; require immediate navigation revocation, one exact close, no partition admission, no policy cleanup, and same-tuple preparation refusal until destroyed acknowledgement. Make destroyed inspection throw and require retirement plus navigation to remain fail-closed until the explicit destroyed event. Acknowledge destruction, require one policy cleanup, reprepare the tuple, replay stale acknowledgement, and prove the replacement remains admitted. Make retirement startup throw and require policy plus capacity to remain fail-closed. Retire two pages sharing one partition and require cleanup only after both exact acknowledgements. Emit guest render-process-gone and destroyed, and emit owning-renderer process loss through the main-window boundary; require exact logical retirement, close, and grant revocation while unrelated renderer guests and prepared pages survive. Reject retirement for the wrong opaque authority. Reprepare after ordinary release, require a new opaque authority, deny the stale guest, and admit an exact replacement. Destroy a registered guest under real destroyed state, verify best-effort listener release, replay stale cleanup, and prove its replacement remains grantable. Mutate caller input after registration and prove main-owned authority is unchanged. Attach a normal browser Session and require no route-registry mutation.",
"commands": [
"pnpm exec vitest run --config config/vitest.config.ts src/main/browser/browser-client-page-command-executor.test.ts src/main/browser/browser-client-page-command-integration.test.ts src/main/browser/browser-client-page-renderer-bridge.test.ts src/main/browser/browser-client-page-renderer-lifecycle.electron.test.ts src/main/browser/browser-client-page-renderer-runtime.test.ts src/main/browser/browser-route-session-registry.test.ts src/main/browser/browser-route-webcontents-registry.test.ts src/preload/browser-client-page-renderer-requests.test.ts src/renderer/src/components/browser-pane/browser-client-page-retained-registry.test.ts src/renderer/src/components/browser-pane/browser-client-page-renderer-installation.test.ts src/main/window/createMainWindow.test.ts src/main/window/renderer-document-navigation.test.ts",
"pnpm exec vitest run --config config/vitest.config.ts src/main/browser/browser-client-page-command-executor.test.ts src/main/browser/browser-client-page-command-integration.test.ts src/main/browser/browser-client-page-renderer-bridge.test.ts src/main/browser/browser-client-page-renderer-runtime.test.ts src/main/browser/browser-route-session-registry.test.ts src/main/browser/browser-route-webcontents-registry.test.ts src/main/window/createMainWindow.test.ts src/main/window/renderer-document-navigation.test.ts",
"pnpm exec vitest run --config config/vitest.config.ts src/main/browser/browser-client-page-reconciliation-adapters.test.ts src/main/browser/browser-route-prepared-page-rekey.test.ts"
],
"testFiles": [
"src/main/browser/browser-client-page-command-executor.test.ts",
"src/main/browser/browser-client-page-command-integration.test.ts",
"src/main/browser/browser-client-page-reconciliation-adapters.test.ts",
"src/main/browser/browser-client-page-renderer-bridge.test.ts",
"src/main/browser/browser-client-page-renderer-lifecycle.electron.test.ts",
"src/main/browser/browser-client-page-renderer-runtime.test.ts",
"src/main/browser/browser-route-session-registry.test.ts",
"src/main/browser/browser-route-prepared-page-rekey.test.ts",
"src/main/browser/browser-route-webcontents-registry.test.ts",
"src/preload/browser-client-page-renderer-requests.test.ts",
"src/renderer/src/components/browser-pane/browser-client-page-retained-registry.test.ts",
"src/renderer/src/components/browser-pane/browser-client-page-renderer-installation.test.ts",
"src/main/window/createMainWindow.test.ts",
"src/main/window/renderer-document-navigation.test.ts"
],
"assertionRefs": [
{
"file": "src/main/browser/browser-client-page-command-executor.test.ts",
"assertions": [
"exact execution route and trusted renderer precede blank guest registration and grant",
"navigation targets only the retained opaque guest incarnation and exact generation and rejects local files",
"abort, failed registration, ambiguous mount, and retirement attempt every safe exact cleanup without releasing network resources before destruction proof or admitting a replacement after failure",
"close racing creation cannot retain a late page, cleanly absent creates remain forgettable, and unresolved cleanup stays generation-fenced",
"navigation fencing revokes retained exact claims once and rejects late in-flight creation before guest registration or grant"
]
},
{
"file": "src/main/browser/browser-client-page-command-integration.test.ts",
"assertions": [
"a fresh new-authority dispatcher reclaims an old-authority executor page while real route Session and WebContents registries preserve exact cleanup"
]
},
{
"file": "src/main/browser/browser-client-page-reconciliation-adapters.test.ts",
"assertions": [
"exact reclaim preserves the guest while rekeying renderer, Session, lifecycle claim, and navigation authority",
"rekey uncertainty retires both possible renderer identities and failed restore navigation destroys the affected guest before releasing retained resources"
]
},
{
"file": "src/main/browser/browser-client-page-renderer-bridge.test.ts",
"assertions": [
"mount requests carry only the main-approved partition and exact page generation to the exact current main-frame document",
"sender spoofing, subframe replies, stale document frames, malformed replies, renderer replacement, WebContents-ID reuse, abort, and late replies fail closed",
"timeout, send failure, and request-ID collision release only their exact admission",
"pending mount and retirement requests share one bounded admission ledger and release it exactly once"
]
},
{
"file": "src/main/browser/browser-client-page-renderer-runtime.test.ts",
"assertions": [
"one app-lifetime reply listener binds the exact current Electron renderer to the bridge",
"mount settlement and renderer retirement use the production IPC channel wiring"
]
},
{
"file": "src/main/browser/browser-client-page-renderer-lifecycle.electron.test.ts",
"assertions": [
"real Electron binds replies to the current main frame and matches the renderer guest ID to did-attach-webview",
"a document-owned blank webview survives attachment and is destroyed without reparenting on retirement",
"an unprepared partition is denied and its renderer host settles and disappears"
]
},
{
"file": "src/preload/browser-client-page-renderer-requests.test.ts",
"assertions": [
"top-frame-only requests queue before subscription and fail overflow or missing subscribers within bounded limits",
"latest-subscriber replacement fences prior callbacks and outcomes cannot spoof request identity or operation"
]
},
{
"file": "src/renderer/src/components/browser-pane/browser-client-page-retained-registry.test.ts",
"assertions": [
"full partition, page, and generation tuples retain one exact blank guest with global and per-partition budgets",
"attachment, DOM readiness, retirement, destruction, process loss, and denied-attachment timeout settle exact state",
"cross-partition page IDs coexist while an attached retiring generation remains fenced until destruction"
]
},
{
"file": "src/main/browser/browser-route-session-registry.test.ts",
"assertions": [
"a prepared Electron Session remains recognizable for late-attachment quarantine",
"prepared authority is bound to one renderer and owner loss retires unregistered pages",
"page release removes logical authority and tuple reuse receives a new opaque token",
"route policy stays installed and tuple reuse stays blocked until delayed exact-guest destruction settles"
]
},
{
"file": "src/main/browser/browser-route-prepared-page-rekey.test.ts",
"assertions": [
"prepared authority moves only across an exact same-page same-renderer generation change",
"rekey preserves the opaque authority and leaves stale or conflicting input unchanged"
]
},
{
"file": "src/main/browser/browser-route-webcontents-registry.test.ts",
"assertions": [
"route guests remain blank and popup-denied before exact registration and grant",
"guest, renderer, partition, and logical page generation must all match",
"later navigation rechecks live page authority and invalid schemes remain denied",
"only the exact opaque guest lifecycle claim can revoke navigation without destroying the guest",
"late, excess, and close-failed attachments remain navigation- and popup-denied",
"opaque authority replacement, page conflicts, mutable inputs, and stale cleanup fail closed",
"exact page retirement revokes and closes only the authority-matched guest",
"guest process loss and owning-renderer retirement end the exact authority while unrelated guests survive",
"normal browser Sessions remain outside the route registry"
]
},
{
"file": "src/main/window/createMainWindow.test.ts",
"assertions": [
"generic guest policy installs before route lockdown can override popup behavior",
"every attached webview is offered to the route registry without changing normal guests",
"main-renderer process loss retires every route guest owned by that renderer",
"process loss and renderer-document replacement retire the exact client-page renderer generation, while blocked external, failed provisional, and same-document navigation preserve or restore only the surviving document"
]
},
{
"file": "src/main/window/renderer-document-navigation.test.ts",
"assertions": [
"only packaged or same-origin development renderer-document replacement starts a lifecycle fence",
"failed, cancelled, and blocked provisional navigation restore the surviving document without clearing a committed fence",
"a delayed failure from a committed attempt cannot cancel a live same-URL replacement while its main frame is still loading",
"concurrent failure plus blocked replacement converges when the unchanged document becomes idle"
]
}
],
"evidenceRuns": [
{
"date": "2026-08-15",
"runner": "local",
"platform": "macos",
"command": "pnpm exec vitest run --config config/vitest.config.ts src/main/browser/browser-client-page-command-executor.test.ts src/main/browser/browser-client-page-command-integration.test.ts src/main/browser/browser-client-page-renderer-bridge.test.ts src/main/browser/browser-client-page-renderer-lifecycle.electron.test.ts src/main/browser/browser-client-page-renderer-runtime.test.ts src/main/browser/browser-route-session-registry.test.ts src/main/browser/browser-route-webcontents-registry.test.ts src/preload/browser-client-page-renderer-requests.test.ts src/renderer/src/components/browser-pane/browser-client-page-retained-registry.test.ts src/renderer/src/components/browser-pane/browser-client-page-renderer-installation.test.ts src/main/window/createMainWindow.test.ts src/main/window/renderer-document-navigation.test.ts",
"result": "passed",
"durationSeconds": 1.22,
"summary": "On the candidate atop #14753, twelve files passed 132 exact opaque-claim navigation revocation, in-flight create fencing, revocation-error cleanup, retained guest destruction separation, route Session, renderer bridge/registry, Electron lifecycle, and main-window document assertions."
},
{
"date": "2026-08-14",
"runner": "local",
"platform": "macos",
"command": "pnpm exec vitest run --config config/vitest.config.ts src/main/browser/browser-client-page-command-executor.test.ts src/main/browser/browser-client-page-command-integration.test.ts src/main/browser/browser-client-page-renderer-bridge.test.ts src/main/browser/browser-client-page-renderer-runtime.test.ts src/main/browser/browser-route-session-registry.test.ts src/main/browser/browser-route-webcontents-registry.test.ts src/main/window/createMainWindow.test.ts src/main/window/renderer-document-navigation.test.ts",
"result": "passed",
"durationSeconds": 0.8,
"summary": "Eight files and 174 tests passed deterministic route retention, trusted-renderer create ordering, exact renderer WebContents and main-frame-document fencing, subframe and stale-frame rejection, wrong-page and wrong-operation rejection, timeout/send/collision settlement, renderer-document replacement retirement, blocked external and same-document preservation, failed provisional restoration, stale same-URL failure rejection during a live replacement, concurrent failure plus blocked replacement convergence, production IPC wiring, composed real Session/WebContents registry lifecycle, abort and cleanup fencing, Session-index and prepared-owner fencing, bounded pending waiters, late/rejected route-WebContents quarantine, opaque-authority and process-loss fencing, fail-closed shared-partition release barriers, exact registration and navigation, popup denial, and main-window ordering tests."
},
{
"date": "2026-08-14",
"runner": "local",
"platform": "macos",
"command": "pnpm exec vitest run --config config/vitest.config.ts src/main/browser/browser-client-page-command-executor.test.ts src/main/browser/browser-client-page-command-integration.test.ts src/main/browser/browser-client-page-renderer-bridge.test.ts src/main/browser/browser-client-page-renderer-lifecycle.electron.test.ts src/main/browser/browser-client-page-renderer-runtime.test.ts src/main/browser/browser-route-session-registry.test.ts src/main/browser/browser-route-webcontents-registry.test.ts src/preload/browser-client-page-renderer-requests.test.ts src/renderer/src/components/browser-pane/browser-client-page-retained-registry.test.ts src/renderer/src/components/browser-pane/browser-client-page-renderer-installation.test.ts src/main/window/createMainWindow.test.ts src/main/window/renderer-document-navigation.test.ts",
"result": "passed",
"durationSeconds": 2.7,
"summary": "Twelve files and 199 tests passed the existing main authority gate plus top-frame preload queueing, bounded outcomes, exact retained renderer tuples, delayed guest-ID readiness, idempotent retirement, resource budgets, process-loss fencing, and real Electron main-frame reply, blank attachment, denial, and destruction lifecycle."
}
],
"runtimeBudget": {
"p95Seconds": 15,
"scope": "deterministic route Session and WebContents authority plus one isolated real-Electron renderer lifecycle"
},
"flakeHistory": {
"status": "unknown",
"evidence": "The deterministic and isolated real-Electron suite passes locally; CI and cross-platform soak history have not started."
},
"redGreenEvidence": {
"status": "partial",
"evidence": "The route-WebContents oracle first failed because no registry existed, and the Session oracle failed because no exact Session/page index existed. A first candidate blocked every navigation after the initial document committed because it incorrectly required the current URL to remain blank; repeated-navigation evidence failed until blank validation was limited to registration and grant. Mutable-input evidence then proved caller-owned data could alter stored authority until the registry copied it. Fresh review found late and rejected attachments could keep generic navigation policy, destroyed cleanup skipped listener release, and tuple reuse revived stale grants; the added deterministic cases fail that candidate and pass with retained Session recognition, deny-first admission, best-effort destroyed cleanup, and opaque authority tokens. The page-release oracle then failed because no exact retirement handshake existed; it passes with synchronous revocation plus policy cleanup held behind the exact destroyed callback. Guest-process, guest-destruction, and owning-renderer loss tests then failed because none ended logical page authority; the candidate routes all three through exact fenced retirement. Prepared-owner tests subsequently failed because a sibling renderer received the same live authority and no pre-registration renderer-retirement method existed; the candidate binds live authority to the exact owner and sweeps only that renderer's prepared pages. Fresh review then reproduced cleanup-failure sweep abort, pending authority resurrection, and live-partition success after owner loss; snapshot-first retirement, best-effort cleanup, renderer epochs, and the final async-boundary check now fence stale work while allowing an unrelated live waiter to admit the verified partition. The executor baseline lacked the module, exact guest navigation, and unregistered retirement. Later deterministic probes caught early route release after renderer failure, ambiguous mount leakage, failed-create readmission, discarded destruction proof, proof-ledger eviction, WebContents ID reuse, and stale navigation; the candidate keeps a bounded failed-page fence and retains an immutable opaque guest claim whose destruction promise, retirement, and navigation survive spontaneous loss without targeting a replacement. Renderer-lifecycle review then reproduced blocked-navigation detachment, stale same-URL cancellation, and a concurrent failure plus blocked-replacement stuck fence; constant document-generation and idle-state tracking makes those exact sequences green without retaining a navigation list. The renderer baseline had no preload consumer or retained page registry. Its first real-Electron candidate failed because getWebContentsId was transiently unavailable at did-attach, then because pre-attach destruction released state without rejecting the mount; DOM-readiness retry and exact pre-attach destruction settlement make both sequences green. A later deterministic sequence proved did-attach cancelled the timeout before a guest ID existed and retirement released the observed guest without destruction; retaining the deadline through valid identity and recording observed attachment make both sequences green. Fresh review then caught cached re-advertisement after guest identity became unreadable and an unhandled rejection when reply transport threw; exact live-ID comparison now fences the stale incarnation, while safe reply construction and transport containment leave main's timeout as the bounded recovery. Real Electron mutation/revert, lifetime page-generation authority, worker/request settlement, and traffic evidence remain required before activation."
},
"performanceBudget": {
"required": true,
"evidence": "Session, guest, page, and exact-owner lookups are O(1), install no polling, and retain at most 256 attached route guests in registry maps in addition to the lower 64-partition and 64-active-or-retiring-page-per-partition bounds. The production executor retains at most 256 active, creating, or failed page IDs; each observed guest owns one immutable lifecycle claim and one destruction promise, with no global tombstone ledger. The renderer bridge retains at most 512 pending mount or retirement requests, one timer and optional abort listener per request, and one app-lifetime IPC reply listener; settlement, abort, timeout, replacement, and disposal remove each exactly once. Preload independently retains at most 512 validated requests and one timer each, removes queued identifiers on every settlement, and exposes one replaceable subscriber. The renderer retains at most 256 exact page tuples and 64 per partition, one host, webview, timer, promise, and four lifecycle listeners each; attached retirement keeps bounded fail-closed tombstones until destruction. Renderer-document tracking retains only constant generation, active-fence, and cancellation state across concurrent navigation events. At most 64 callers per partition can await one setup promise. Renderer loss scans at most 256 guests plus 4,096 bounded active pages and snapshots only exact owner matches. Each guest retains at most one retirement callback. Historical Session recognition uses weak keys. Normal guests perform one bounded Session lookup at did-attach. Destroyed guests synchronously release exact mappings and attempt each listener removal independently."
},
"promotionCriteria": [
"Use Playwright CDP in real Electron to prove did-attach lockdown precedes page script, popup, redirect, worker, and speculative activity.",
"Extend exact WebContents release fencing to service workers, downloads, active requests, network-service recovery, ordinary document/process swaps, profile switch, lease replacement, and app shutdown.",
"Implement bounded generation-scoped popup reservations without any shell.openExternal or native-window fallback."
],
"knownGaps": [
"The production host lifecycle, route resolver, and retained renderer surface are active for eligible paired Electron clients; headed and headless paired-runtime product journeys cover the normal creation path on macOS.",
"Real Electron main-frame reply, delayed guest-ID readiness, denial, destruction, and retained visible attachment are covered locally; process swaps, traffic isolation, and physical-platform behavior remain unvalidated.",
"Guest and owning-renderer process-loss fencing is deterministic only; real Electron crash/reload ordering and WebContents process recovery remain unvalidated.",
"Logical page release now revokes and closes the exact WebContents while holding policy cleanup for destroyed acknowledgement, but does not yet prove service-worker, download, active-request, connection, or persistent-storage settlement.",
"A close that never reaches destroyed or a retirement that cannot start intentionally keeps the route policy and capacity reserved; bounded force-close recovery must not clear policy under a live or unknown guest.",
"A failed or ambiguous create remains fenced until authenticated inventory reconciliation proves whether the guest exists; a real transport-loss recovery journey remains to be recorded.",
"The runtime-owned placement registry supplies monotonic page generations after retirement; persistence across a full authority restart remains deterministic rather than a packaged-upgrade journey.",
"Popup reservations do not exist; every route guest popup is denied.",
"The production caller derives renderer, page, host generation, and route identity from live main-owned state; physical Windows and Linux Electron ordering remain unvalidated."
],
"demotionRule": "Demote if a route guest can navigate nonblank before exact registration and grant, a mismatched, released, crashed, or ownerless page remains authoritative, tuple reuse revives stale authority, page release clears route policy before exact guest destruction, a stale retirement clears a replacement, a popup reaches shell.openExternal or an unregistered native window, a rejected attachment retains navigation or popup capability, stale cleanup retires a replacement, normal browser guests change behavior, or any claimed exact identity is sourced only from renderer input."
},
{
"id": "browser-client-host.activated-placement",
"title": "Eligible paired Electron clients host new browser pages without dual execution",
"maturity": "experimental",
"protection": "partial",
"owner": "browser-runtime",
"layer": "paired-runtime-product-placement-and-materialization",
"surfaces": [
"browser tab creation from the renderer store",
"paired Electron host preparation",
"runtime-owned browser placement publication",
"retained client webview materialization",
"client-hosted automation routing",
"new-page-only kill switch"
],
"platforms": ["macos", "linux", "windows", "ios"],
"providers": ["remote-runtime", "ssh", "wsl"],
"coveredPlatforms": ["macos", "ios"],
"coveredProviders": ["remote-runtime", "ssh", "wsl"],
"coverageNotes": "Fresh-build Playwright journeys run the same production store action against an isolated headed Electron server and a real headless orca serve host. They prove one immutable client placement owns one real retained guest on the viewing desktop, the server owns no duplicate guest, no screencast frame renders, browser.snapshot reaches the client guest, disabling the setting preserves that guest, and the next page uses the legacy server engine. Deterministic contracts cover omitted placement, missing capabilities, explicit server placement, exact renderer-store materialization after delayed publication, no fallback after client-create failure, folder workspaces, git worktrees, browserless hosts, native and WSL routes, exact connected SSH authority, reconnect command replay, lease replacement, imported-inventory cleanup, bounded retirement, and shared remote screencast fanout for multiple independent viewers. A published v1.4.184 package runs both skew directions: an old client omits placement against the current host, while a current client capability-downgrades against the old host; each creates one server guest, no client guest, and returns the exact snapshot marker. A current iOS Simulator client paired to that legacy packaged host visibly loads Example Domain through the preserved server-hosted surface. A Docker OpenSSH target proves container-only DNS and localhost through both ssh2 and system-SSH routes. Physical Windows/Linux Electron and physical mobile journeys remain gaps.",
"motivatingLinks": [
"https://linear.app/stably/issue/STA-4150/refactor-remote-browser-to-client-hosted-electron-webviews"
],
"invariant": "Placement is selected exactly once before page creation. An eligible, capable paired Electron desktop creates one client-hosted guest; old, ineligible, web/mobile, browserless-client, or explicit-server callers use the unchanged server path. Omitted placement remains server-hosted. Once client placement is selected, failure is surfaced and must not create, migrate, or fall back to a server guest. The acknowledged exact environment, worktree or folder workspace, remote page, and target group must materialize before the renderer reports success. Client pages bypass screencast and remote-input rendering, while agent and CLI automation routes only to the exact client guest. Disabling the kill switch affects only later pages. Reconnect, replacement, and cleanup preserve exact authority and never revive or retire another generation.",
"oracle": "Create through the normal renderer-store action with client hosting enabled. Require client placement, one client-owned guest at the fixture URL, zero server-owned guests, no remote-browser frame, a visible retained marker, and a browser.snapshot marker from the same remote page. Disable the setting and require that guest to survive; create another page and require one server-owned guest, zero matching client guests, and a visible server screencast. Delay renderer publication after tabCreate acknowledgement and require one exact bounded subscription to materialize the page without polling or cleanup. Reject a client create and require no server fallback. Omit placement or capabilities and require no client-host RPC. During replacement, admit close-first only for negotiated reconciliation of imported inventory; ordinary close-first and navigate-first remain rejected. Run the same placement oracle against headed and headless paired hosts, plus deterministic native, SSH, WSL, folder, worktree, reconnect, retirement, and browserless-host contracts.",
"commands": [
"pnpm exec playwright test tests/e2e/paired-client-hosted-browser.spec.ts --config tests/playwright.config.ts --project electron-headless --workers=1",
"pnpm exec vitest run --config config/vitest.config.ts src/renderer/src/runtime/web-runtime-session-browser-client-placement.test.ts src/renderer/src/runtime/web-runtime-session-browser-create-failure.test.ts src/main/runtime/orca-runtime-browser-client-hosted.test.ts src/main/runtime/runtime-browser-client-page-creation.test.ts src/main/runtime/browser-host-page-reconciliation-orchestration.test.ts src/main/runtime/browser-host-command-ledger.test.ts",
"pnpm exec vitest run --config config/vitest.config.ts src/shared/browser-client-host-protocol.test.ts src/shared/remote-runtime-client.test.ts src/main/runtime/browser-host-capability-selection.test.ts src/main/runtime/rpc/methods/browser-tab-create-schema.test.ts src/main/ipc/runtime-environment-browser-client-host-handler.test.ts",
"pnpm exec vitest run --config config/vitest.config.ts tests/e2e/cross-version-wire/cross-version-browser-placement.unit.test.ts",
"SKIP_BUILD=1 ORCA_CROSS_VERSION_PACKAGED_EXECUTABLE=/Applications/Orca.app/Contents/MacOS/Orca pnpm exec playwright test tests/e2e/packaged-mixed-version-browser-placement.spec.ts --config tests/playwright.config.ts --project electron-headless --workers=1",
"pnpm exec vitest run --config config/vitest.config.ts src/main/runtime/browser-network-tunnel-paired-runtime.integration.test.ts src/main/browser/paired-runtime-browser-network-route.test.ts src/main/browser/browser-network-execution-route.test.ts src/main/browser/wsl-browser-network-execution-route.test.ts src/main/browser/wsl-browser-network-relay-launch.test.ts src/main/runtime/runtime-browser-network-execution-host.test.ts",
"pnpm exec vitest run --config config/vitest.config.ts src/main/browser/browser-screencast-lifecycle.test.ts src/main/browser/browser-screencast-stream.test.ts src/main/runtime/orca-runtime-browser-screencast-fanout.test.ts",
"ORCA_RUN_DOCKER_SSH_BROWSER_E2E=1 pnpm exec vitest run --config config/vitest.config.ts tests/e2e/ssh-browser-network-execution-route.docker.unit.test.ts",
"Manual iOS 26.5 simulator: pair current mobile code to packaged Orca 1.4.184; create Browser; navigate to https://example.com; require one visible Example Domain tab on the server-hosted surface"
],
"testFiles": [
"tests/e2e/paired-client-hosted-browser.spec.ts",
"src/renderer/src/runtime/web-runtime-session-browser-client-placement.test.ts",
"src/renderer/src/runtime/web-runtime-session-browser-create-failure.test.ts",
"src/main/runtime/orca-runtime-browser-client-hosted.test.ts",
"src/main/runtime/runtime-browser-client-page-creation.test.ts",
"src/main/runtime/browser-host-page-reconciliation-orchestration.test.ts",
"src/main/runtime/browser-host-command-ledger.test.ts",
"src/shared/browser-client-host-protocol.test.ts",
"src/shared/remote-runtime-client.test.ts",
"src/main/runtime/browser-host-capability-selection.test.ts",
"src/main/runtime/rpc/methods/browser-tab-create-schema.test.ts",
"src/main/ipc/runtime-environment-browser-client-host-handler.test.ts",
"tests/e2e/cross-version-wire/cross-version-browser-placement.unit.test.ts",
"tests/e2e/packaged-mixed-version-browser-placement.spec.ts",
"src/main/runtime/browser-network-tunnel-paired-runtime.integration.test.ts",
"src/main/browser/paired-runtime-browser-network-route.test.ts",
"src/main/browser/browser-network-execution-route.test.ts",
"src/main/browser/wsl-browser-network-execution-route.test.ts",
"src/main/browser/wsl-browser-network-relay-launch.test.ts",
"src/main/runtime/runtime-browser-network-execution-host.test.ts",
"src/main/browser/browser-screencast-lifecycle.test.ts",
"src/main/browser/browser-screencast-stream.test.ts",
"src/main/runtime/orca-runtime-browser-screencast-fanout.test.ts",
"tests/e2e/ssh-browser-network-execution-route.docker.unit.test.ts"
],
"assertionRefs": [
{
"file": "tests/e2e/paired-client-hosted-browser.spec.ts",
"assertions": [
"headed and headless product actions select one client placement with one viewing-desktop guest and no server duplicate",
"client pages render without a remote screencast and browser.snapshot reaches the exact retained guest",
"the kill switch preserves existing client pages and selects server placement only for the next page"
]
},
{
"file": "src/renderer/src/runtime/web-runtime-session-browser-client-placement.test.ts",
"assertions": [
"eligible desktops prepare exact client placement while legacy and explicit-server requests omit placement",
"client preparation failure surfaces without server fallback",
"acknowledged client pages wait for exact renderer-store materialization"
]
},
{
"file": "tests/e2e/cross-version-wire/cross-version-browser-placement.unit.test.ts",
"assertions": [
"a real stable release has no client-host or browser-tunnel capability constants",
"the old server schema strips additive placement without changing legacy fields",
"the current schema accepts the old request with placement omitted"
]
},
{
"file": "tests/e2e/packaged-mixed-version-browser-placement.spec.ts",
"assertions": [
"an old packaged client omits placement and creates exactly one current-host guest with no client guest",
"a current client detects an old packaged host, keeps server placement, and creates no local guest",
"both skew directions return the exact server-hosted snapshot marker"
]
},
{
"file": "src/main/runtime/browser-host-command-ledger.test.ts",
"assertions": [
"reconciliation may close imported inventory before a create command in the replacement ledger",
"ordinary close-first and navigate-first commands remain rejected"
]
},
{
"file": "tests/e2e/ssh-browser-network-execution-route.docker.unit.test.ts",
"assertions": [
"ssh2 and system OpenSSH resolve a container-only domain and localhost on the execution host"
]
},
{
"file": "src/main/runtime/orca-runtime-browser-screencast-fanout.test.ts",
"assertions": [
"two independent viewers share one physical CDP screencast without evicting one another",
"viewer-specific backpressure and viewport ownership survive attach, detach, and replacement"
]
}
],
"evidenceRuns": [
{
"date": "2026-08-16",
"runner": "local",
"platform": "macos",
"command": "pnpm exec playwright test tests/e2e/paired-client-hosted-browser.spec.ts --config tests/playwright.config.ts --project electron-headless --workers=1",
"result": "passed",
"durationSeconds": 48.8,
"summary": "Two fresh-build production journeys passed against isolated headed Electron and real headless orca serve hosts, including client ownership, visible retained content, automation, no screencast, new-page-only kill switch, and server fallback without duplicate execution."
},
{
"date": "2026-08-16",
"runner": "local",
"platform": "macos",
"command": "pnpm exec vitest run --config config/vitest.config.ts tests/e2e/cross-version-wire/cross-version-browser-placement.unit.test.ts",
"result": "passed",
"durationSeconds": 0.23,
"summary": "Three assertions passed against published v1.4.182 and the current tree: the release lacks the negotiated capabilities, strips additive placement without changing legacy fields, and the current server preserves an old request with omitted placement."
},
{
"date": "2026-08-16",
"runner": "local",
"platform": "macos",
"command": "SKIP_BUILD=1 ORCA_CROSS_VERSION_PACKAGED_EXECUTABLE=/Applications/Orca.app/Contents/MacOS/Orca pnpm exec playwright test tests/e2e/packaged-mixed-version-browser-placement.spec.ts --config tests/playwright.config.ts --project electron-headless --workers=1",
"result": "passed",
"durationSeconds": 10.3,
"summary": "Two packaged v1.4.184 skew journeys passed four times (9.6, 10.3, 9.5, and 10.3 seconds), including after the latest-main rebase: old client to current host and current client to old host each selected server placement, owned one host guest and zero client guests, and returned packaged-skew-marker through browser.snapshot."
},
{
"date": "2026-08-16",
"runner": "local",
"platform": "macos",
"command": "ORCA_RUN_DOCKER_SSH_BROWSER_E2E=1 pnpm exec vitest run --config config/vitest.config.ts tests/e2e/ssh-browser-network-execution-route.docker.unit.test.ts",
"result": "passed",
"durationSeconds": 3.31,
"summary": "Two real Docker/OpenSSH routes resolved and loaded a container-only HTTP target through ssh2 and system SSH."
},
{
"date": "2026-08-16",
"runner": "manual",
"platform": "ios",
"command": "Manual iOS 26.5 simulator: pair current mobile code to packaged Orca 1.4.184; create Browser; navigate to https://example.com; require one visible Example Domain tab on the server-hosted surface",
"result": "passed",
"durationSeconds": 180,
"summary": "Current mobile code paired to an isolated legacy packaged host, created one Browser tab, and visibly progressed from about:blank through loading to Example Domain at https://example.com/ on the server-hosted mobile surface."
},
{
"date": "2026-08-17",
"runner": "local",
"platform": "macos",
"command": "pnpm exec vitest run --config config/vitest.config.ts src/main/browser/browser-screencast-lifecycle.test.ts src/main/browser/browser-screencast-stream.test.ts src/main/runtime/orca-runtime-browser-screencast-fanout.test.ts",
"result": "passed",
"durationSeconds": 1.2,
"summary": "22 screencast lifecycle, stream, and shared-fanout tests passed; the suite confirms one physical CDP stream fans out independently to multiple viewers, preserves viewport ownership, and cleans up without cross-viewer eviction."
}
],
"runtimeBudget": {
"p95Seconds": 300,
"scope": "fresh-build headed and headless paired Electron journeys plus deterministic placement, compatibility, reconnect, route, and Docker SSH contracts"
},
"flakeHistory": {
"status": "unknown",
"evidence": "The fresh headed/headless and deterministic matrices pass locally; CI and cross-platform soak history have not started for the activated cumulative tip."
},
"redGreenEvidence": {
"status": "partial",
"evidence": "Before activation, production capability advertisement, client-host RPC registration, placement preparation, runtime client creation, logical publication, retained mounting, and automation routing were absent. During cumulative validation, delayed post-ack renderer publication caused the real paired journey to declare failure before the exact page materialized; the new deterministic delayed-publication test was red until a bounded exact Zustand subscription replaced the immediate check. Reconnect validation was then red 3 of 116 because the activation ordering guard rejected replacement-ledger close-first reconciliation for client-reported imported inventory; admitting only reconciliation close-first made the unchanged lifecycle package green 116 of 116 while a new unit oracle keeps ordinary close-first rejected. The paired tunnel integration was red 3 of 3 because its fixture duplicated methods now registered by the production registry; exercising ALL_RPC_METHODS directly is green 3 of 3. Packaged old/new skew and a current-mobile/legacy-host journey are now green; full candidate-revert evidence remains to be collected before promotion."
},
"performanceBudget": {
"required": true,
"evidence": "Placement preparation performs one fresh capability/status check and starts or reuses one exact browser host. Materialization uses one bounded exact store subscription with no polling and releases it on match or timeout. Each client page owns one retained non-reparented webview, one route/profile partition, one reference-counted execution-host grant, and bounded command/result state. Automation reuses the existing AgentBrowserBridge through one bounded negotiated envelope rather than duplicating browser methods. Headed and headless journeys each create exactly one client guest and one later server guest with no duplicate engine."
},
"promotionCriteria": [
"Run the same production placement and traffic-isolation oracle on physical Windows and Linux Electron hosts, including headed and headless where supported.",
"Capture real Electron HTTP, HTTPS, WebSocket, worker, redirect, speculative, DNS, WebRTC, and UDP/DoH behavior to prove no desktop-network fallback.",
"Complete fresh architecture, compatibility, lifecycle, security, performance, and test reviews on the rebased landing stack."
],
"knownGaps": [
"Live production journeys are macOS-only; WSL is deterministic and SSH uses Docker Linux rather than physical Windows/Linux Electron.",
"The packaged skew journey uses one published old package plus the current E2E artifact on macOS; packaged Windows/Linux and a second independently released post-feature package remain unrecorded.",
"The live fixture proves routed HTTP, HTTPS, WebSocket, redirect, subresource, and download ownership plus remote DNS through the fixed SOCKS session; worker, speculative, WebRTC, UDP, and DoH containment remain unrecorded.",
"The setting currently requires explicit enablement while product rollout policy is decided; disabling it is intentionally new-page-only."
],
"demotionRule": "Demote if placement changes after creation, a client failure creates a server fallback page, one logical page owns two engines, an omitted or unnegotiated field activates client hosting, the execution route resolves on the viewing desktop, a client page uses screencast/input RPC rendering, automation reaches a different page or engine, delayed publication leaks listeners or causes cleanup of a materialized page, or the kill switch mutates an existing page."
},
{
"id": "browser-stream.bounded-reconnect",
"title": "Remote browser streams recover within a bounded retry budget",
"maturity": "experimental",
"protection": "partial",
"owner": "browser-runtime",
"layer": "renderer-state-machine-paired-runtime",
"surfaces": [
"paired remote browser panes",
"browser screencast disconnect and reconnect",
"remote browser viewport restart"
],
"platforms": ["macos", "linux", "windows"],
"providers": ["remote-runtime"],
"coveredPlatforms": ["macos", "linux"],
"coveredProviders": ["remote-runtime"],
"coverageNotes": "Deterministic fake-clock tests cover counted backoff, in-flight ownership and handoff, cancellation, supersession, transient and permanent failures, late stale rejection, silent hosts, flapping streams, viewport restarts, stale events, budget exhaustion, and manual recovery. A headless paired-runtime journey drops the real runtime connection, proves the bounded retry state and visible Reconnect control, reconnects the same host, and requires a newly painted frame. Headed paired-server, Windows, sleep/wake, and real network-partition evidence remain uncollected.",
"motivatingLinks": [
"https://github.com/stablyai/orca/pull/12787",
"https://linear.app/stably/issue/STA-3483"
],
"invariant": "A current remote browser stream that closes must retry transient failures on one counted, capped backoff chain. Cancellation, pane or runtime supersession, missing pages, and permanent failures stop that chain without stale state mutation. A stream that stays healthy refills the budget; a silent or flapping stream cannot retry forever. Exhaustion and every non-retrying failure leave an actionable Reconnect control, and manual reconnect creates a fresh stream without resurrecting stale subscriptions.",
"oracle": "With one fake clock and exact pane, operation, stream, page, and runtime identities, drop a confirmed stream and require the counted delay sequence, one active chain, stale-token rejection, exact cancellation, full cleanup, and either a new live subscription or one stopped state with Reconnect after exhaustion. Inject transport error without close, close racing rejection, never-ready subscriptions, ready-then-end flapping, viewport supersession, missing pages, and permanent failures. In a separate paired client against an isolated headless Orca host, paint one remote frame, disconnect the owning runtime, require the bounded-retry notice and Reconnect control, reconnect, click once, and require a different frame object URL from the recovered stream.",
"commands": [
"pnpm exec vitest run --config config/vitest.config.ts src/renderer/src/components/browser-pane/stream-remote/remote-browser-stream-errors.test.ts src/renderer/src/components/browser-pane/stream-remote/remote-browser-stream-lifecycle.test.ts src/renderer/src/components/browser-pane/stream-remote/remote-browser-stream-restart-scheduler.test.ts src/renderer/src/components/browser-pane/stream-remote/remote-browser-stream-status.test.ts",
"pnpm exec playwright test tests/e2e/paired-remote-browser-stream-reconnect.spec.ts --config tests/playwright.config.ts --project electron-headless --workers=1"
],
"testFiles": [
"src/renderer/src/components/browser-pane/stream-remote/remote-browser-stream-errors.test.ts",
"src/renderer/src/components/browser-pane/stream-remote/remote-browser-stream-lifecycle.test.ts",
"src/renderer/src/components/browser-pane/stream-remote/remote-browser-stream-restart-scheduler.test.ts",
"src/renderer/src/components/browser-pane/stream-remote/remote-browser-stream-status.test.ts",
"tests/e2e/paired-remote-browser-stream-reconnect.spec.ts"
],
"assertionRefs": [
{
"file": "src/renderer/src/components/browser-pane/stream-remote/remote-browser-stream-restart-scheduler.test.ts",
"assertions": [
"transient failures retry until recovery on counted delays",
"budget exhaustion stops exactly once",
"cancellation retires an in-flight attempt without re-arming",
"a close during an in-flight attempt queues one replacement chain"
]
},
{
"file": "src/renderer/src/components/browser-pane/stream-remote/remote-browser-stream-lifecycle.test.ts",
"assertions": [
"dropped, silent, and flapping streams converge on a bounded retry or actionable stop",
"stale, superseded, missing-page, and permanent-failure work cannot mutate the current pane",
"manual reopen starts a fresh budget and adopts one current subscription",
"a late stale rejection cannot clear the replacement stream's ready deadline"
]
},
{
"file": "tests/e2e/paired-remote-browser-stream-reconnect.spec.ts",
"assertions": [
"a real paired-runtime disconnect ends with an actionable Reconnect control",
"manual reconnect paints a new remote frame instead of retaining only the frozen frame",
"a pane whose first open fails can recover from no prior subscription"
]
}
],
"evidenceRuns": [
{
"date": "2026-08-07",
"runner": "local",
"platform": "macos",
"command": "pnpm exec vitest run --config config/vitest.config.ts src/renderer/src/components/browser-pane/stream-remote/remote-browser-stream-errors.test.ts src/renderer/src/components/browser-pane/stream-remote/remote-browser-stream-lifecycle.test.ts src/renderer/src/components/browser-pane/stream-remote/remote-browser-stream-restart-scheduler.test.ts src/renderer/src/components/browser-pane/stream-remote/remote-browser-stream-status.test.ts",
"result": "passed",
"durationSeconds": 0.36,
"summary": "Four focused files passed 61 deterministic error, status, scheduler, lifecycle, in-flight ownership, stale-rejection, liveness, and cleanup tests."
},
{
"date": "2026-08-07",
"runner": "ci",
"platform": "linux",
"command": "pnpm exec playwright test tests/e2e/paired-remote-browser-stream-reconnect.spec.ts --config tests/playwright.config.ts --project electron-headless --workers=1",
"result": "passed",
"durationSeconds": 59.8,
"summary": "Both isolated headless paired-runtime scenarios passed: bounded recovery after a live-stream disconnect and manual recovery when the first stream never opened."
}
],
"runtimeBudget": {
"p95Seconds": 120,
"scope": "focused fake-clock renderer contracts plus one isolated headless paired-runtime journey"
},
"flakeHistory": {
"status": "unknown",
"evidence": "The deterministic suite and one changed-E2E CI run passed; soak history has not started."
},
"redGreenEvidence": {
"status": "complete",
"evidence": "The byte-identical scheduler oracle fails with the reschedule disabled at one attempt instead of four and passes after restoration. On the PR head, the delayed handoff oracle counted two scheduled attempts instead of one, and the late stale-rejection oracle lost the replacement ready deadline and never offered reconnect; both pass after the ownership fixes. Current main structurally contains the original one-shot timer dead end. The focused suite passes 61 tests, and the isolated paired-runtime CI journey passes both disconnect and cold-open recovery scenarios."
},
"performanceBudget": {
"required": true,
"evidence": "Each pane retains at most one retry timer, one in-flight attempt, and one ready deadline. Automatic recovery makes at most five counted attempts with no global scan, subprocess, polling loop, or cross-pane fanout; exhaustion stops background work until explicit user reconnect."
},
"promotionCriteria": [
"Run the same journey against a headed Orca desktop server and retain independent host/client state evidence.",
"Collect Linux and physical Windows paired-server evidence plus sleep/wake or network-partition recovery.",
"Collect 100 consecutive focused CI passes or 14 days without an unexplained flake.",
"Replace the E2E's post-exhaustion elapsed-time check with an exact subscribe-attempt oracle."
],
"knownGaps": [
"The paired journey covers headless orca serve, not the primary headed desktop-server topology.",
"The live fault is an explicit disconnect rather than sleep/wake or a real network partition.",
"The E2E observes UI convergence and new frame identity but does not count screencast subscribe attempts directly.",
"Live Linux and Windows evidence is uncollected."
],
"demotionRule": "Keep experimental or demote if retries can stop before recovery or exhaustion, continue after exhaustion, run in parallel, mutate a superseded pane, hide the Reconnect control, leak a subscription or timer, or fail to paint a new frame after manual reconnect."
},
{
"id": "editor.live-log-append-stability",
"title": "Long live session logs retain their Monaco viewport while appending",
"maturity": "experimental",
"protection": "partial",
"owner": "editor-runtime",
"layer": "renderer-electron-contract",
"surfaces": [
"Agent Session History View Log",
"Monaco external-content reconciliation",
"renderer crash containment"
],
"platforms": ["macos", "linux", "windows"],
"providers": ["local"],
"coveredPlatforms": ["macos"],
"coveredProviders": ["local"],
"coverageNotes": "Focused tests and real-Monaco 9/50 MiB performance and undo-retention benchmarks are platform-independent. Local macOS Electron evidence opens a synthetic 9 MiB transcript through Agent Session History at fixed 900x720 viewport, 13px font, 1x zoom, and asserts the full 9 MiB model length loaded as a font-metric-independent containment check (word-wrap pixel geometry varies ~10% across runners, so a generous content-height floor is only a collapsed/truncated-render smoke check), then verifies three five-second-cadence watcher appends with Find open and closed. Live Windows/Linux evidence remains uncollected.",
"motivatingLinks": ["https://github.com/stablyai/orca/pull/8432"],
"invariant": "Append-only external file growth changes only Monaco's model suffix, retaining the viewport, selection, Find state, and renderer liveness above the append point; read-only live tails do not create undo history, while editable external updates remain undoable and arbitrary rewrites continue to replace the model content.",
"oracle": "Focused tests assert one post-mount content owner, actual outer lifecycle remount ordering across retained path models, exact end-of-model suffix edits with one model read, no-op equality, full replacement for non-appends, and real-Monaco undo behavior for read-only live tails versus editable files. With Node forced GC, real-Monaco benchmarks alternate 30 suffix and 30 replacement samples after five warmups on fresh equivalent models at 9 and 50 MiB, then compare exact Monaco undo-service and ArrayBuffer retention after five 10 MiB appends. The Electron scenario alternates an e2e-only legacy setValue red control and the fixed watcher append from restored equivalent model/geometry at the measured legacy-failure cadence, asserting that the control disrupts anchor state while the fixed path preserves visible ranges, selection, complete Find state, scroll offset, non-undoability, renderer survival, and forced-GC heap/native-memory budgets.",
"commands": [
"pnpm exec vitest run --config config/vitest.config.ts src/renderer/src/components/editor/monaco-content-sync.test.ts src/renderer/src/components/editor/MonacoEditor.content-owner.test.tsx src/renderer/src/components/editor/EditorContent.monaco-lifecycle.test.tsx",
"pnpm exec vitest run --config config/vitest.config.ts src/renderer/src/components/editor/monaco-content-sync.undo-history.test.ts",
"node --expose-gc ./node_modules/vitest/vitest.mjs bench src/renderer/src/components/editor/monaco-content-sync.bench.ts --pool=threads",
"node --expose-gc ./node_modules/vitest/vitest.mjs bench src/renderer/src/components/editor/monaco-content-sync.undo-retention.bench.ts --pool=threads",
"pnpm run test:e2e -- tests/e2e/agent-session-log-tail-stability.spec.ts --workers=1"
],
"testFiles": [
"src/renderer/src/components/editor/monaco-content-sync.test.ts",
"src/renderer/src/components/editor/monaco-content-sync.undo-history.test.ts",
"src/renderer/src/components/editor/MonacoEditor.content-owner.test.tsx",
"src/renderer/src/components/editor/EditorContent.monaco-lifecycle.test.tsx",
"src/renderer/src/components/editor/monaco-content-sync.bench.ts",
"src/renderer/src/components/editor/monaco-content-sync.undo-retention.bench.ts",
"tests/e2e/agent-session-log-tail-stability.spec.ts"
],
"assertionRefs": [
{
"file": "src/renderer/src/components/editor/monaco-content-sync.test.ts",
"assertions": [
"append-only drift reads the current model once and inserts only at the previous model end",
"identical content emits no edit and non-append drift retains full replacement plus undo stops",
"read-only live-tail appends, replacements, truncations, and stale retained-model remounts use non-undoing edits",
"a stale retained target model reconciles on mount without explicit undo stops while prior-path content and undo history remain isolated"
]
},
{
"file": "src/renderer/src/components/editor/monaco-content-sync.undo-history.test.ts",
"assertions": [
"a real Monaco read-only live-tail append leaves canUndo false while an ordinary external update remains undoable"
]
},
{
"file": "src/renderer/src/components/editor/MonacoEditor.content-owner.test.tsx",
"assertions": ["the Monaco wrapper receives defaultValue and no controlled value prop"]
},
{
"file": "src/renderer/src/components/editor/EditorContent.monaco-lifecycle.test.tsx",
"assertions": [
"a same-pane path switch unmounts the prior outer Monaco before real mount reconciliation refreshes the stale target; the prior retained model content and undo sentinel remain untouched"
]
},
{
"file": "src/renderer/src/components/editor/monaco-content-sync.bench.ts",
"assertions": [
"with forced GC and deterministic settlement between every arm, fresh real-Monaco 9 MiB and 50 MiB models alternate 30 append and 30 replacement samples after five warmups; append p95 stays below 50/100ms and at least 2x faster"
]
},
{
"file": "src/renderer/src/components/editor/monaco-content-sync.undo-retention.bench.ts",
"assertions": [
"five 10 MiB read-only live-tail appends retain zero Monaco undo-service and ArrayBuffer bytes while the undoable control retains at least 50 MiB"
]
},
{
"file": "tests/e2e/agent-session-log-tail-stability.spec.ts",
"assertions": [
"production Agent Session History opens a synthetic 9 MiB View Log and confirms the full model length loaded as font-metric-independent containment, with a generous content-height floor as a collapsed/truncated-render smoke check",
"an executable e2e-only legacy setValue control disrupts selection/Find/anchor state at each fixed-geometry five-second sample, then restores the equivalent model state before the fixed arm",
"three alternating watcher suffix appends preserve visible ranges, selection, scroll offset, Find open/query/active-match state, and exact suffix content",
"the production read-only live-tail model remains non-undoable before and after every watcher append",
"the renderer remains responsive with no render-process-gone event and forced-GC JS-heap/working-set/private-memory peak and retained budgets hold against paired legacy controls"
]
}
],
"evidenceRuns": [
{
"date": "2026-07-12",
"runner": "local",
"platform": "macos",
"command": "pnpm exec vitest run --config config/vitest.config.ts src/renderer/src/components/editor/monaco-content-sync.test.ts src/renderer/src/components/editor/MonacoEditor.content-owner.test.tsx src/renderer/src/components/editor/EditorContent.monaco-lifecycle.test.tsx",
"result": "passed",
"durationSeconds": 5,
"summary": "Focused editor ownership, edit-shape, mount reconciliation, lifecycle-key, and actual same-pane retained-model remount tests passed."
},
{
"date": "2026-07-12",
"runner": "local",
"platform": "macos",
"command": "node --expose-gc ./node_modules/vitest/vitest.mjs bench src/renderer/src/components/editor/monaco-content-sync.bench.ts --pool=threads",
"result": "passed",
"durationSeconds": 75,
"summary": "Forced-GC, settled, alternating fresh-model Monaco p95: 9 MiB append 4.02-5.51ms versus replacement 81.42-83.76ms; 50 MiB append 22.72-26.60ms versus replacement 445.11-449.21ms."
},
{
"date": "2026-07-12",
"runner": "local",
"platform": "macos",
"command": "pnpm run test:e2e -- tests/e2e/agent-session-log-tail-stability.spec.ts --workers=1",
"result": "passed",
"durationSeconds": 78,
"summary": "The production View Log journey alternated retained e2e-only legacy-red controls with fixed appends from restored equivalent state; every control detected instability while the fixed path retained viewport, selection, complete Find state, renderer liveness, and normalized forced-GC/native memory budgets."
},
{
"date": "2026-07-13",
"runner": "local",
"platform": "macos",
"command": "pnpm exec vitest run --config config/vitest.config.ts src/renderer/src/components/editor/monaco-content-sync.undo-history.test.ts",
"result": "passed",
"durationSeconds": 4,
"summary": "The real-Monaco undo-history test confirmed a read-only live-tail append leaves canUndo false while an ordinary external update remains undoable."
},
{
"date": "2026-07-13",
"runner": "local",
"platform": "macos",
"command": "node --expose-gc ./node_modules/vitest/vitest.mjs bench src/renderer/src/components/editor/monaco-content-sync.undo-retention.bench.ts --pool=threads",
"result": "passed",
"durationSeconds": 5,
"summary": "The undoable 50 MiB control retained 104,858,630 undo-service bytes and 104,857,790 ArrayBuffer bytes; the read-only live-tail arm retained zero of both and remained non-undoable."
},
{
"date": "2026-07-13",
"runner": "local",
"platform": "macos",
"command": "pnpm run test:e2e -- tests/e2e/agent-session-log-tail-stability.spec.ts --workers=1",
"result": "passed",
"durationSeconds": 78,
"summary": "The production View Log journey preserved viewport, selection, Find state, renderer liveness, and forced-GC/native budgets across three watcher appends while canUndo remained false."
}
],
"runtimeBudget": {
"p95Seconds": 600,
"scope": "local focused renderer tests plus one Electron production-journey scenario"
},
"flakeHistory": {
"status": "unknown",
"evidence": "New deterministic gate with local macOS passes; CI soak history is not yet available."
},
"redGreenEvidence": {
"status": "complete",
"evidence": "A fail-first real-Monaco test observed canUndo=true after one read-only live-tail append, and the forced-GC 50 MiB control retained 104,858,630 bytes in Monaco's undo service. After the fix the read-only arm retained zero undo-service bytes while the editable control stayed undoable. The retained Electron gate also proves each fixed watcher arm preserves viewport, selection, Find state, and non-undoability. Production builds never install its legacy setValue control."
},
"performanceBudget": {
"required": true,
"evidence": "Every update retrieves the model value once and performs at most one equality-or-prefix comparison; a matching append submits only the suffix. The registered Node commands require --expose-gc and --pool=threads so worker GC is available. Current p95: 9 MiB append 5.93-7.12ms versus replacement 114.09-145.89ms; 50 MiB append 26.84-34.91ms versus replacement 602.36-699.21ms. The new 50 MiB retention arm measured 104,858,630 undo-service bytes and 104,857,790 ArrayBuffer bytes for the undoable control versus zero for read-only live-tail sync. Electron forced-GC JS-heap, renderer working-set, and OS-private-memory budgets also pass."
},
"promotionCriteria": [
"Collect stable soak history on macOS, Linux, and Windows.",
"Accumulate 100 consecutive deterministic gate passes or 14 days without unexplained flakes."
],
"knownGaps": ["No live Windows or Linux View Log evidence yet."],
"demotionRule": "Quarantine the Electron scenario if it flakes without a product or harness bug; demote if viewport/Find drift, renderer loss, p95 regression, or memory retention exceeds the registered budgets."
},
{
"id": "terminal-session.snapshot-freshness",
"title": "Stale liveness snapshots cannot close newer PTY bindings",
"maturity": "experimental",
"protection": "partial",
"owner": "terminal-runtime",
"layer": "renderer-unit",
"surfaces": ["terminal lifecycle", "dead-session reconciliation", "tab creation"],
"platforms": ["macos", "linux", "windows"],
"providers": ["local", "daemon"],
"coveredPlatforms": ["macos"],
"coveredProviders": [],
"coverageNotes": "Local macOS evidence over the reconcile guards that exist on main@1282f5c2d. Broader targeted-hasPty resume paths, no-hot listing counts, and live Electron survival arrive with the pending reliability stack.",
"motivatingLinks": [
"https://github.com/stablyai/orca/issues/6773",
"https://github.com/stablyai/orca/pull/6514",
"https://github.com/stablyai/orca/pull/6796",
"https://github.com/stablyai/orca/pull/6801"
],
"invariant": "A local or daemon liveness snapshot requested before a pane binds a PTY cannot prove that newer binding dead or route it through exit teardown.",
"oracle": "The decision layer rejects reconciliation when ptyBoundAt is greater than or equal to snapshotRequestedAt, still reconciles genuinely absent older local ids, and treats rejected provider listing as unknown.",
"commands": [
"pnpm exec vitest run --config config/vitest.config.ts src/renderer/src/components/terminal-pane/terminal-dead-session-reconcile.test.ts"
],
"testFiles": [
"src/renderer/src/components/terminal-pane/terminal-dead-session-reconcile.test.ts"
],
"assertionRefs": [
{
"file": "src/renderer/src/components/terminal-pane/terminal-dead-session-reconcile.test.ts",
"assertions": [
"a newborn pane bound after the snapshot was requested is not reconciled (boundAt >= requestedAt freshness guard)",
"a rejected listSessions is treated as unknown and reconciles nothing",
"remote, SSH, and mid-spawn panes are skipped by the reconcile path",
"targeted liveness probes receive the request timestamp and resolved live-session ids"
]
}
],
"evidenceRuns": [
{
"date": "2026-07-03",
"runner": "local",
"platform": "macos",
"command": "pnpm exec vitest run --config config/vitest.config.ts src/renderer/src/components/terminal-pane/terminal-dead-session-reconcile.test.ts",
"result": "passed",
"durationSeconds": 1.5,
"summary": "1 test file(s) passed, 17 tests passed on main@1282f5c2d in a clean checkout."
}
],
"runtimeBudget": {
"p95Seconds": 10,
"scope": "local unit test"
},
"flakeHistory": {
"status": "unknown",
"evidence": "Registered after existing targeted tests were found; needs soak history before blocking promotion."
},
"redGreenEvidence": {
"status": "partial",
"evidence": "Unit tests encode the stale snapshot/newborn race and fail if the freshness guard is removed. Needs saved CI or intentional-break artifact before blocking promotion."
},
"performanceBudget": {
"required": true,
"evidence": "The gate itself is cheap. Any PR changing reconciliation loops, hidden-pane scans, or provider polling must also run a terminal throughput or event-loop-delay measurement before blocking promotion."
},
"promotionCriteria": [
"Run in soak for at least 100 consecutive passes or 14 days across required CI platforms.",
"Attach red/green evidence from the freshness guard regression.",
"Add an integration/provider-contract follow-up that proves tab survival plus input/output after stale snapshot release."
],
"knownGaps": [
"Current command asserts the pure decision and orchestration timestamp forwarding, not a full Electron tab-survival/input echo flow.",
"SSH and remote providers are intentionally unknown-liveness paths and need separate provider-contract gates."
],
"demotionRule": "Demote or quarantine if the gate flakes once without a product bug or harness bug filed to the owner."
},
{
"id": "terminal-session.layout-pty-ownership",
"title": "Restored terminal layouts retain one renderer owner per PTY",
"maturity": "experimental",
"protection": "partial",
"owner": "terminal-runtime",
"layer": "renderer-electron-restore",
"surfaces": [
"persisted terminal layout restore",
"daemon PTY reattach",
"terminal tab hide and reveal",
"xterm renderer ownership",
"remote terminal layout mirroring"
],
"platforms": ["macos", "linux", "windows"],
"providers": ["local", "local-daemon", "ssh", "wsl", "remote-runtime"],
"coveredPlatforms": ["macos"],
"coveredProviders": ["local-daemon"],
"coverageNotes": "Provider-independent unit tests cover persisted replay, state-boundary authority transfer, remote-runtime mirroring, rootless layouts, repeated leaf ids, metadata repair, and 12,000 nested duplicate leaves. A two-launch macOS Electron journey covers a real surviving local-daemon PTY, persisted duplicate ownership, synchronized streaming output, and tab hide/reveal. Live Linux, Windows, SSH, WSL, and remote-runtime restore journeys remain gaps.",
"motivatingLinks": [
"https://github.com/stablyai/orca/issues/11757",
"https://github.com/stablyai/orca/pull/11726"
],
"invariant": "Within one terminal tab, each PTY has at most one layout leaf, pane manager surface, and xterm renderer owner. Restore and remote mirroring must normalize duplicate ownership before replay while retaining active-leaf focus, scrollback, pane authority, agent metadata, and distinct sibling PTYs.",
"oracle": "Launch Orca with a real daemon PTY running a synchronized full-screen stream, close the desktop client without killing the daemon process, seed the persisted tab layout with two leaves bound to that PTY, and relaunch. Hide the restored tab behind a sibling and reveal it, then require the stream to remain visible with exactly one manager pane, one xterm DOM node, one root leaf, one PTY binding, and one unique PTY. Unit contracts require the same one-owner result through persisted replay, store hydration, remote mirroring, rootless and repeated-leaf layouts, and deeply nested input.",
"commands": [
"pnpm exec vitest run --config config/vitest.config.ts src/renderer/src/components/terminal-pane/terminal-layout-duplicate-pty-replay.test.ts src/renderer/src/components/terminal-pane/terminal-layout-pty-ownership-depth.test.ts src/renderer/src/components/terminal-pane/terminal-layout-pty-ownership.test.ts src/renderer/src/store/slices/terminal-layout-pty-ownership.test.ts src/renderer/src/runtime/web-session-tabs-sync.test.ts --reporter=dot",
"pnpm exec electron-vite build --mode e2e",
"SKIP_BUILD=1 pnpm exec playwright test tests/e2e/terminal-duplicate-pty-renderer-reveal.spec.ts --config tests/playwright.config.ts --project electron-headless --workers=1"
],
"testFiles": [
"src/renderer/src/components/terminal-pane/terminal-layout-duplicate-pty-replay.test.ts",
"src/renderer/src/components/terminal-pane/terminal-layout-pty-ownership-depth.test.ts",
"src/renderer/src/components/terminal-pane/terminal-layout-pty-ownership.test.ts",
"src/renderer/src/store/slices/terminal-layout-pty-ownership.test.ts",
"src/renderer/src/runtime/web-session-tabs-sync.test.ts",
"tests/e2e/terminal-duplicate-pty-renderer-reveal.spec.ts"
],
"assertionRefs": [
{
"file": "src/renderer/src/components/terminal-pane/terminal-layout-duplicate-pty-replay.test.ts",
"assertions": [
"replays one surface when restored leaves point to the same PTY",
"reattaches one PTY when the split repeats its bound leaf id"
]
},
{
"file": "src/renderer/src/components/terminal-pane/terminal-layout-pty-ownership-depth.test.ts",
"assertions": ["prunes deeply nested duplicate ownership without recursive stack growth"]
},
{
"file": "src/renderer/src/components/terminal-pane/terminal-layout-pty-ownership.test.ts",
"assertions": [
"keeps the active leaf and prunes the stale surface plus its metadata",
"is idempotent and preserves one owner across PTY and focus permutations"
]
},
{
"file": "src/renderer/src/store/slices/terminal-layout-pty-ownership.test.ts",
"assertions": [
"normalizes duplicate PTY surfaces at the renderer state boundary",
"moves hydrated pane authority onto the retained PTY leaf"
]
},
{
"file": "src/renderer/src/runtime/web-session-tabs-sync.test.ts",
"assertions": ["deduplicates mirrored leaves that claim the same remote PTY"]
},
{
"file": "tests/e2e/terminal-duplicate-pty-renderer-reveal.spec.ts",
"assertions": ["repairs duplicate persisted PTY renderers before streaming tab reveal"]
}
],
"evidenceRuns": [
{
"date": "2026-08-01",
"runner": "local",
"platform": "macos",
"command": "pnpm exec vitest run --config config/vitest.config.ts src/renderer/src/components/terminal-pane/terminal-layout-duplicate-pty-replay.test.ts src/renderer/src/components/terminal-pane/terminal-layout-pty-ownership-depth.test.ts src/renderer/src/components/terminal-pane/terminal-layout-pty-ownership.test.ts src/renderer/src/store/slices/terminal-layout-pty-ownership.test.ts src/renderer/src/runtime/web-session-tabs-sync.test.ts --reporter=dot",
"result": "passed",
"durationSeconds": 1.33,
"summary": "Five focused files passed 92 ownership, replay, hydration, depth, and remote-mirroring tests."
},
{
"date": "2026-08-01",
"runner": "local",
"platform": "macos",
"command": "SKIP_BUILD=1 pnpm exec playwright test tests/e2e/terminal-duplicate-pty-renderer-reveal.spec.ts --config tests/playwright.config.ts --project electron-headless --workers=1",
"result": "passed",
"durationSeconds": 8.7,
"summary": "The two-launch Electron journey preserved one real daemon PTY and one renderer through duplicate-layout repair and post-relaunch tab reveal."
}
],
"runtimeBudget": {
"p95Seconds": 30,
"scope": "focused ownership unit suite plus one prebuilt two-launch Electron journey"
},
"flakeHistory": {
"status": "unknown",
"evidence": "The deterministic unit and Electron gates pass locally on macOS; focused CI and soak history are not yet available."
},
"redGreenEvidence": {
"status": "complete",
"evidence": "Orca 1.4.161 visibly strands and fragments the synchronized stream after restoring duplicate PTY renderers (https://github.com/user-attachments/assets/6917ac6f-9ba3-4f6f-a082-fb62932d511f). The post-resize capture remains corrupted, with duplicated lower rows and the terminal still stranded on the right; it is not recovery evidence (https://github.com/user-attachments/assets/32f7be79-0919-48c2-bcad-e4b7f1e14f2d). After the #11726 ownership repair, the equivalent stream remains continuous in one full-width renderer (https://github.com/user-attachments/assets/8c9cc5a2-dbe3-4348-b05c-f8268b98c476), and the final automated journey reports one owner at every layer after relaunch and tab reveal (https://github.com/user-attachments/assets/f19b46aa-e56f-476c-9e2c-e4c3a784c805)."
},
"performanceBudget": {
"required": true,
"evidence": "Ownership normalization is bounded by layout size, uses iterative traversal, and passes a 12,000-leaf duplicate layout without recursive stack growth. The follow-up adds no production polling, renderer work, listeners, persistence scans, or retained payloads."
},
"promotionCriteria": [
"Collect 100 consecutive focused CI passes or 14 days of soak history.",
"Run the live two-launch journey on Linux and Windows.",
"Add live SSH or remote-runtime duplicate-restore evidence before claiming provider-complete coverage."
],
"knownGaps": [
"Live Electron evidence currently covers macOS with a local daemon PTY only.",
"The live journey uses a git-backed test workspace; folder-workspace restoration currently relies on the same provider-independent normalization contracts rather than a separate Electron run.",
"The gate deterministically seeds the historical persisted-state shape; it does not depend on reproducing the unknown UI sequence that originally wrote duplicate ownership.",
"The visual old-release evidence and the structural current-version oracle are separate runs because the current test harness did not exist in Orca 1.4.161."
],
"demotionRule": "Keep experimental or demote if ownership cardinality flakes, duplicate replay reaches a second renderer, active metadata or authority moves to the wrong leaf, deep normalization regresses, or a supported provider bypasses normalization."
},
{
"id": "terminal-session.kill-all-surface-cleanup",
"title": "Kill all sessions removes only the confirmed terminal surfaces and current bindings",
"maturity": "experimental",
"protection": "partial",
"owner": "terminal-runtime",
"layer": "renderer-main-contract",
"surfaces": [
"terminal lifecycle",
"terminal tab cleanup",
"PTY shutdown",
"Manage Sessions",
"Resource Manager"
],
"platforms": ["macos", "linux", "windows"],
"providers": ["local", "daemon", "ssh", "wsl", "remote-runtime", "mobile-relay"],
"coveredPlatforms": ["macos"],
"coveredProviders": ["local", "daemon", "ssh"],
"coverageNotes": "Local macOS deterministic evidence covers the renderer snapshot/coordinator, exact local and SSH-shaped PTY request settlement, active-last and pinned terminal-tab routing, component-unmount continuation, and the existing current/legacy daemon management contract. Windows Electron process absence, live SSH/WSL behavior, and remote-runtime/mobile host completion remain explicit gaps.",
"motivatingLinks": ["https://github.com/stablyai/orca/issues/8001"],
"invariant": "Every terminal surface confirmed in the invoking renderer is force-closed exactly once after daemon management settles, later-created surfaces and non-terminal tabs survive, and exact shutdown requests are limited to deduplicated current non-runtime PTY bindings of the confirmed surfaces.",
"oracle": "Snapshot terminal entity IDs before the first await; mutate ownership, active selection, bindings, and tab presence while daemon management is pending and between bounded close batches; then assert only the immutable targets disappear from both terminal stores, active targets close last with valid editor/browser/deactivated post-state, every captured exact PTY promise settles before callbacks, and no provider inventory sweep or late-tab kill occurs.",
"commands": [
"pnpm exec vitest run --config config/vitest.config.ts src/renderer/src/components/shared/kill-all-terminal-surfaces.test.ts src/renderer/src/components/shared/useDaemonActions.test.tsx src/renderer/src/components/terminal/terminal-tab-actions-kill-all.test.ts src/main/ipc/pty-management.test.ts"
],
"testFiles": [
"src/renderer/src/components/shared/kill-all-terminal-surfaces.test.ts",
"src/renderer/src/components/shared/useDaemonActions.test.tsx",
"src/renderer/src/components/terminal/terminal-tab-actions-kill-all.test.ts",
"src/main/ipc/pty-management.test.ts"
],
"assertionRefs": [
{
"file": "src/renderer/src/components/shared/kill-all-terminal-surfaces.test.ts",
"assertions": [
"snapshot deduplicates legacy, unified-only, split, multi-worktree, and floating terminal surfaces while excluding editor tabs",
"cleanup-time moves, active-worktree switches, rebinding, missing targets, and later-created tabs preserve the confirmation boundary and active-last order",
"current exact PTY bindings are deduplicated, remote runtime IDs and stale/late bindings are excluded, and all per-PTY settlements finish before completion",
"the production dependency path calls daemon management exactly once and never invokes listSessions for a post-kill sweep",
"management rejection and per-close/provider failures do not stop remaining cleanup and produce bounded count/latency diagnostics",
"a real 100-tab Zustand fixture records 100 close attempts and exact kills, at least 100 writes, and 49 event-loop yields; ownership is revalidated at most once after each yield when the store changed"
]
},
{
"file": "src/renderer/src/components/shared/useDaemonActions.test.tsx",
"assertions": [
"the hook snapshots before onKillAllStart and before coordinator work",
"unmounting the invoking component does not revoke cleanup while React callbacks remain mount-gated",
"error and settled callbacks run only after coordinator settlement",
"closed terminal tabs report success instead of the no-sessions informational state when daemon management reports zero"
]
},
{
"file": "src/renderer/src/components/terminal/terminal-tab-actions-kill-all.test.ts",
"assertions": [
"force closes pinned terminals without a second confirmation",
"closing the last active terminal preserves and activates editor or browser content, otherwise deactivates without auto-spawn"
]
},
{
"file": "src/main/ipc/pty-management.test.ts",
"assertions": [
"killAll fires one shutdown for each initial daemon session and polls those initial IDs until empty",
"freshly respawned session IDs are excluded from remainingCount",
"per-session shutdown rejection does not stop the daemon batch and refused initial sessions remain reported"
]
}
],
"evidenceRuns": [
{
"date": "2026-07-09",
"runner": "local",
"platform": "macos",
"command": "pnpm exec vitest run --config config/vitest.config.ts src/renderer/src/components/shared/kill-all-terminal-surfaces.test.ts src/renderer/src/components/shared/useDaemonActions.test.tsx src/renderer/src/components/terminal/terminal-tab-actions-kill-all.test.ts src/main/ipc/pty-management.test.ts",
"result": "passed",
"durationSeconds": 1.31,
"summary": "4 test files and 27 tests passed locally, including the existing daemon handler contract and a real 100-terminal Zustand cleanup fixture."
}
],
"runtimeBudget": {
"p95Seconds": 10,
"scope": "focused renderer/main unit and performance-count tests"
},
"flakeHistory": {
"status": "unknown",
"evidence": "The focused 27-test slice passed locally once; it needs CI and soak history before promotion."
},
"redGreenEvidence": {
"status": "partial",
"evidence": "The initial 100-tab implementation exposed an oversized close batch; two-close event-loop batching fixed the structural issue. The gate now uses deterministic batch instrumentation because full-suite CPU saturation made wall-clock assertions flaky; saved CI artifacts and intentional-break evidence are still needed."
},
"performanceBudget": {
"required": true,
"evidence": "The coordinator performs one management sweep, builds an initial live-owner index, and revalidates at most once after each two-close yield when the Zustand state changed (at most 49 replans for the 100-tab fixture). It closes each present unique target once and sends at most one exact kill per unique current non-runtime PTY not already settled by daemon management. The fixture asserts 100 close attempts, 100 local kill calls, at least 100 store writes, and 49 yields; planner-level tests prove each individual plan build scans terminal and unified ownership stores once. Production diagnostics report measured close-batch duration, while the deterministic gate makes no machine-load-sensitive latency claim."
},
"promotionCriteria": [
"Run the focused gate for at least 100 consecutive passes or 14 days across required CI platforms.",
"Attach Windows Electron evidence for both entry points, empty and established terminals, later-tab survival, xterm removal, and initial PTY absence after settlement.",
"Exercise the SSH fixture and WSL when available, or keep their live process-absence gaps explicit.",
"Propagate and align runtime-host tab-close completion before claiming verified remote-runtime shutdown."
],
"knownGaps": [
"Windows Electron screenshots and live process/xterm absence evidence were not produced by this local macOS run.",
"Live SSH and WSL process absence, Linux local/daemon behavior, and mobile/relay shutdown remain unproved.",
"Runtime-host terminal close is best-effort because closeTerminalTab still discards the existing async host result and its close-intent lifetime is shorter than the possible RPC flow.",
"Daemon adapter listing failures remain suppressed by the existing management API, so reported daemon counts are not authoritative verification of every process."
],
"demotionRule": "Keep experimental or demote to protection none if the gate flakes, permits a late-created tab or unrelated PTY to close, duplicates provider shutdown, or performs more than one ownership replan per bounded yield."
},
{
"id": "terminal-session.explicit-close-retirement",
"title": "Explicit terminal close retires parked PTYs and agent authority exactly once",
"maturity": "experimental",
"protection": "partial",
"owner": "terminal-runtime",
"layer": "main-preload-renderer-electron-contract",
"surfaces": [
"terminal tab close",
"split pane close and detach",
"hidden terminal parking",
"agent resume authority"
],
"platforms": ["macos", "linux", "windows"],
"providers": ["local", "daemon", "ssh", "runtime"],
"coveredPlatforms": ["macos"],
"coveredProviders": ["local", "daemon", "ssh", "runtime"],
"coverageNotes": "Live macOS Electron tests prove exact local PTY disappearance after parked-tab close and detached-pgid descendant death after agent close. A deterministic final-pane interleaving now proves durable tab retirement commits before externally owned PTY teardown can publish graph loss, and preserves an unrelated live canary through duplicate exit retirement. Deterministic tests also cover final-pane CLI close durability, persisted-empty restart suppression, same-incarnation handle continuity, replacement and hard graph-loss stale fencing, preallocated-handle supersession, daemon and SSH routing, local/daemon pending-snapshot ownership across natural exit, stale-root descendant-signal suppression, graceful-to-immediate kill upgrades, duplicate-kill completion sharing, locale-stable bounded/fresh/coalesced process-table reads, deadline-safe successor scans, cycle-safe linear descendant traversal, target-only escalation indexing, 32-wide bulk teardown, source-scan timestamp identity, same-second PID ambiguity, ordinary runtime close ownership, unified-only hydration, split ownership, pane detach transfer, restart alias hydration, and late-hook suppression; live Linux, Windows, WSL, SSH, and remote-runtime process evidence remains pending. A paired macOS Electron journey (real attached-window desktop host plus a separate real paired desktop client, isolated profiles) covers the inverse authority direction for host-created terminals: a renderer graph sync must not retire a tab that `orca terminal create` made. That claim now covers BOTH shapes, including the incident shape the real CLI produces - a repo's FIRST host-created terminal, since src/cli/handlers/terminal.ts sends no clientMutationId - each asserted by its own test. An earlier reading of this gate called a preceding host-created terminal and a `clientMutationId` protective; main-process instrumentation refuted that. The renderer's stale session write deleted the host tab from persistence in every variant, and only the delete's timing relative to the measured sync differed, so those rows were false negatives of a single-sync oracle. The defect was in persistence: persistPtyBinding did not raise the repo's terminal topology fence for the first host-admitted tab, leaving the renderer's pre-create tab list free to replay over it. Elapsed time and paired-client mirroring never decided anything. A windowless `orca serve` parity arm runs the identical oracle and passes on both the merge-base and the branch, confirming that topology does not exhibit the defect (the gate it turns on is window-conditioned) and that making the host binding unconditional did not regress it. All of this is macOS-local only. The reported incident occurred on a physical Windows host; we did not run against one. The claim that the mechanism is platform-independent rests on the authoritative-window gate and publication-epoch inheritance being OS-agnostic, not on Windows evidence, so no ConPTY, Windows window-lifecycle, update, or sleep behavior is covered here.",
"motivatingLinks": [
"https://linear.app/stably/issue/STA-4327",
"https://github.com/stablyai/orca/pull/14590",
"https://github.com/stablyai/orca/pull/8628",
"https://github.com/stablyai/orca/pull/8706",
"https://github.com/stablyai/orca/issues/14524"
],
"invariant": "Close permanently removes the owned provider session, agent descendants, persisted tab/layout authority, and resume authority even when no TerminalPane is mounted; final-pane CLI close commits durable tab retirement before PTY stop can publish graph loss, does not acknowledge before that retirement, and treats the later exit retirement as idempotent. A persisted explicit-empty state prevents initial-tab fallback from repopulating the workspace after reload or restart. A handle remains valid while the same provider-attested PTY incarnation survives renderer reload or re-key, and becomes stale without adopting a replacement incarnation. A terminating id remains reserved through natural exit, duplicate callers await the same completion, and immediate teardown upgrades any graceful request without signalling a recycled PID or a descendant tree after root ownership is lost; process-table work is locale-stable, bounded, fresh for each post-start request, same-turn coalesced, and begins within the requesting caller's deadline, including bulk worktree cleanup; detach and park preserve ownership; aliases prevent a detached agent's immutable physical pane key from being retired with its former tab.",
"oracle": "Capture exact tab, pane, PTY, handle, incarnation, and persisted layout identities. Final-pane terminal.close must invoke one durability-acknowledged tab retirement before exact PTY teardown; controlled PTY exit and graph removal afterward must remain idempotent, omit the target from persistence and provider inventory, and leave an unrelated canary handle live. The ordinary path stays pending until the persisted row is removed and never falls back to the fire-and-forget pane event; reload/restart must keep the explicitly emptied worktree at zero terminal tabs and provider sessions. Reloading the renderer with the same tab/pane/PTY/incarnation must keep the handle readable; changing only the incarnation behind the same PTY id, losing the authoritative graph, or superseding the renderer handle with a preallocated handle must reject the old handle with terminal_handle_stale. Parked-close tests prove the exact PTY disappears; descendant/process tests keep natural exits reserved, upgrade teardown safely, bound/coalesce process-table work, and protect recycled identities.",
"commands": [
"pnpm exec vitest run --config config/vitest.config.ts src/main/runtime/orca-runtime-terminal-close-continuity.test.ts",
"pnpm exec vitest run --config config/vitest.config.ts src/renderer/src/components/terminal/initial-terminal.test.ts src/renderer/src/lib/worktree-activation-default-tabs.test.ts src/renderer/src/store/slices/terminals-explicit-empty-hydration.test.ts",
"pnpm dlx node@24 ./node_modules/vitest/vitest.mjs run --config config/vitest.config.ts src/main/agent-hooks/server-pane-authority.test.ts src/main/ipc/agent-hooks.test.ts src/main/ipc/agent-pane-authority-ownership.test.ts src/main/ipc/pty-management.test.ts src/main/persistence-initial-load.test.ts src/main/persistence-pane-identity-migration.test.ts src/main/persistence-pty-binding-reconciliation.test.ts src/renderer/src/store/slices/agent-pane-authority.test.ts src/renderer/src/store/slices/terminal-pane-detach-agent-identity.test.ts src/renderer/src/store/slices/terminal-tab-retirement.test.ts src/renderer/src/store/slices/terminal-tab-retirement-store.test.ts tests/e2e/completed-worker-retirement-resume.unit.test.ts src/renderer/src/components/shared/kill-all-terminal-surfaces.test.ts",
"pnpm exec vitest run --config config/vitest.config.ts src/main/pty-descendant-termination.test.ts src/main/daemon/session.test.ts src/main/daemon/terminal-host.test.ts src/main/providers/local-pty-provider-shutdown.test.ts src/main/runtime/worktree-teardown.test.ts",
"pnpm run test:e2e -- tests/e2e/terminal-tab-close-restart-persistence.spec.ts --workers=1",
"pnpm run test:e2e -- tests/e2e/terminal-parked-close-retirement.spec.ts --workers=1",
"pnpm run test:e2e -- tests/e2e/agent-descendant-process-kill.spec.ts --workers=1",
"pnpm run test:e2e -- tests/e2e/paired-cli-terminal-graph-sync-tab-retention.spec.ts --workers=1",
"pnpm run test:e2e -- tests/e2e/headless-serve-cli-terminal-retention-parity.spec.ts --workers=1"
],
"testFiles": [
"src/main/runtime/orca-runtime-terminal-close-continuity.test.ts",
"src/renderer/src/components/terminal/initial-terminal.test.ts",
"src/renderer/src/lib/worktree-activation-default-tabs.test.ts",
"src/renderer/src/store/slices/terminals-explicit-empty-hydration.test.ts",
"src/main/agent-hooks/server-pane-authority.test.ts",
"src/main/ipc/agent-hooks.test.ts",
"src/main/ipc/agent-pane-authority-ownership.test.ts",
"src/main/ipc/pty-management.test.ts",
"src/main/persistence-initial-load.test.ts",
"src/main/persistence-pane-identity-migration.test.ts",
"src/main/persistence-pty-binding-reconciliation.test.ts",
"src/main/pty-descendant-termination.test.ts",
"src/main/daemon/session.test.ts",
"src/main/daemon/terminal-host.test.ts",
"src/main/providers/local-pty-provider-shutdown.test.ts",
"src/main/runtime/worktree-teardown.test.ts",
"src/renderer/src/store/slices/agent-pane-authority.test.ts",
"src/renderer/src/store/slices/terminal-pane-detach-agent-identity.test.ts",
"src/renderer/src/store/slices/terminal-tab-retirement.test.ts",
"src/renderer/src/store/slices/terminal-tab-retirement-store.test.ts",
"tests/e2e/completed-worker-retirement-resume.unit.test.ts",
"src/renderer/src/components/shared/kill-all-terminal-surfaces.test.ts",
"tests/e2e/terminal-tab-close-restart-persistence.spec.ts",
"tests/e2e/terminal-parked-close-retirement.spec.ts",
"tests/e2e/agent-descendant-process-kill.spec.ts",
"tests/e2e/paired-cli-terminal-graph-sync-tab-retention.spec.ts",
"tests/e2e/headless-serve-cli-terminal-retention-parity.spec.ts"
],
"assertionRefs": [
{
"file": "src/main/runtime/orca-runtime-terminal-close-continuity.test.ts",
"assertions": [
"final-pane terminal.close remains pending until one renderer durability acknowledgement retires the persisted tab and layout",
"final-pane externally owned teardown commits session retirement before PTY stop, tolerates duplicate exit retirement, and preserves an unrelated live canary",
"post-ack workspace-session loss falls back to renderer cleanup and verified PTY teardown while every pre-ack retirement error remains non-destructive",
"renderer reload with the same provider-attested PTY incarnation preserves the exact handle",
"same-id replacement incarnation publishes a new handle and makes the old handle deterministically stale",
"hard graph loss and preallocated-handle supersession make the retained renderer handle deterministically stale"
]
},
{
"file": "tests/e2e/terminal-tab-close-restart-persistence.spec.ts",
"assertions": [
"a durability-acknowledged whole-tab close leaves zero terminal tabs and provider sessions after restart"
]
},
{
"file": "src/renderer/src/store/slices/terminals-explicit-empty-hydration.test.ts",
"assertions": [
"git worktree and folder workspace hydration preserve an explicit empty terminal row"
]
},
{
"file": "src/renderer/src/components/terminal/initial-terminal.test.ts",
"assertions": ["preserves an explicitly persisted empty terminal list"]
},
{
"file": "src/renderer/src/lib/worktree-activation-default-tabs.test.ts",
"assertions": ["does not recreate a terminal after an explicit empty state was persisted"]
},
{
"file": "tests/e2e/completed-worker-retirement-resume.unit.test.ts",
"assertions": [
"explicit close revokes the exact live recovery record both before and after PTY exit removes the tab, while PTY exit alone preserves interrupted-session recovery"
]
},
{
"file": "tests/e2e/terminal-parked-close-retirement.spec.ts",
"assertions": [
"a long-lived exact PTY remains alive after its terminal view is parked",
"closing the parked tab removes the exact PTY from the provider inventory and the visible tab model"
]
},
{
"file": "tests/e2e/paired-cli-terminal-graph-sync-tab-retention.spec.ts",
"assertions": [
"an attached-window desktop host publishes the CLI-created terminal under the renderer publication epoch it inherits, proving the vulnerable classification path was taken rather than a headless or serve/SSH-shaped one",
"with an earlier host-created terminal already present, a renderer graph sync leaves the `terminal.create` tab in the host session inventory still naming its original daemon PTY",
"the original fixture process answers a write through that handle with its own pid and a single READY line, so a respawned replacement cannot pass as a survivor",
"the paired client applied that same sync and kept the tab with no replacement or resume tab appended",
"an unrelated workspace keeps its own CLI terminal and PTY, and the client raises no direct local connection attempt or uncaught renderer error"
]
},
{
"file": "tests/e2e/headless-serve-cli-terminal-retention-parity.spec.ts",
"assertions": [
"a windowless serve host publishes host-created terminals under a headless epoch, never a renderer one, which is why it cannot reach the window-conditioned prune the desktop arm reproduces",
"a later CLI dispatch leaves the earlier host-created terminal in the serve-host inventory still bound to its original PTY",
"both original fixture processes answer writes through their own handles after the later dispatch",
"the paired client mirrors exactly those two tabs with no replacement or resume tab appended, no direct local connection attempt, and no uncaught renderer error"
]
},
{
"file": "src/main/ipc/agent-pane-authority-ownership.test.ts",
"assertions": [
"pane authority transfer accepts only the PTY bound to the physical local pane or the canonical legacy/scoped runtime handle"
]
},
{
"file": "src/renderer/src/store/slices/agent-pane-authority.test.ts",
"assertions": [
"exact pane retirement removes resume and launch authority while preserving siblings",
"chained detach keeps physical hooks and resume authority routed to the current owner until that owner closes"
]
},
{
"file": "src/main/pty-descendant-termination.test.ts",
"assertions": [
"20 same-turn process-table requests execute one fresh scan while later arrivals start one shared successor inside their own deadline",
"snapshot and escalation readers stop at their deadline",
"production ps reads force locale-independent C timestamps",
"the source scan timestamp survives request resolution and capture-second identities are never escalated with SIGKILL",
"cyclic-looking duplicate PID rows terminate with each descendant visited once and duplicate escalation identities stay unsignalled",
"descendant signals are suppressed after the caller loses root ownership"
]
},
{
"file": "src/main/daemon/terminal-host.test.ts",
"assertions": [
"agent immediate kill rejects reattach while descendant capture is pending",
"a naturally exited session id remains reserved until capture finishes without force-killing its retired PID",
"graceful teardown upgrades to immediate both during and after descendant capture",
"duplicate immediate kill starts one descendant sweep"
]
},
{
"file": "src/main/runtime/worktree-teardown.test.ts",
"assertions": [
"owned provider shutdowns start together so process-table snapshots can coalesce within a batch",
"inventories above 32 sessions never exceed 32 concurrent provider shutdowns"
]
},
{
"file": "tests/e2e/agent-descendant-process-kill.spec.ts",
"assertions": [
"a detached-pgid descendant is alive before agent PTY kill and absent afterward"
]
}
],
"evidenceRuns": [
{
"date": "2026-07-13",
"runner": "local",
"platform": "macos",
"command": "pnpm run test:e2e -- tests/e2e/terminal-parked-close-retirement.spec.ts --workers=1",
"result": "passed",
"durationSeconds": 40.3,
"summary": "A fresh E2E build launched an isolated Electron profile, parked a live terminal, closed it through closeTab, and observed its exact PTY disappear."
},
{
"date": "2026-07-14",
"runner": "local",
"platform": "macos",
"command": "pnpm run test:e2e -- tests/e2e/agent-descendant-process-kill.spec.ts --workers=1",
"result": "passed",
"durationSeconds": 37.7,
"summary": "A current-main integrated fresh-build run proved a detached-pgid child was alive before agent PTY kill and absent afterward on the deadline-safe, root-ownership-gated implementation."
},
{
"date": "2026-07-15",
"runner": "local",
"platform": "macos",
"command": "pnpm run test:e2e -- tests/e2e/agent-descendant-process-kill.spec.ts --workers=1",
"result": "passed",
"durationSeconds": 78,
"summary": "The cycle-safe, target-indexed, bounded-fanout review head passed from a cold full build; the live detached-pgid descendant test body completed in 4.8 seconds."
},
{
"date": "2026-08-14",
"runner": "local",
"platform": "macos",
"command": "pnpm exec vitest run --config config/vitest.config.ts src/main/runtime/orca-runtime-terminal-close-continuity.test.ts",
"result": "passed",
"durationSeconds": 8.38,
"summary": "Six owner-level checks proved durable final-pane retirement, same-incarnation handle and waiter continuity, and deterministic stale fencing at replacement or hard lifecycle boundaries."
},
{
"date": "2026-08-15",
"runner": "local",
"platform": "macos",
"command": "pnpm exec vitest run --config config/vitest.config.ts src/main/runtime/orca-runtime-terminal-close-continuity.test.ts",
"result": "passed",
"durationSeconds": 4.49,
"summary": "Fifteen checks passed after merging latest main, including post-ack session-loss cleanup and the inverse non-destructive pre-ack error proof."
},
{
"date": "2026-08-14",
"runner": "local",
"platform": "macos",
"command": "pnpm exec vitest run --config config/vitest.config.ts src/renderer/src/components/terminal/initial-terminal.test.ts src/renderer/src/lib/worktree-activation-default-tabs.test.ts src/renderer/src/store/slices/terminals-explicit-empty-hydration.test.ts",
"result": "passed",
"durationSeconds": 4.71,
"summary": "Forty-nine renderer checks preserved explicit empty terminal state for git and folder workspaces and suppressed initial/default recreation only for previously persisted workspace rows."
},
{
"date": "2026-08-14",
"runner": "local",
"platform": "macos",
"command": "pnpm run test:e2e -- tests/e2e/terminal-tab-close-restart-persistence.spec.ts --workers=1",
"result": "passed",
"durationSeconds": 18.8,
"summary": "A fresh isolated Electron profile closed a split terminal tab through the runtime CLI and kept both renderer and runtime terminal inventories empty after restart."
}
],
"runtimeBudget": {
"p95Seconds": 60,
"scope": "fresh E2E build plus isolated local Electron parked-close and descendant-kill tests"
},
"flakeHistory": {
"status": "unknown",
"evidence": "The Electron gate passed three times locally, including the final review-fix head through the registered fresh-build command; CI and soak history are not yet available."
},
"redGreenEvidence": {
"status": "complete",
"evidence": "STA-4327 used two byte-identical oracles. Runtime oracle cd248b67cc10ef64f2def315b86c3b0236b102639d03c65a0c5d9519e538d3af failed the same three durability/continuity checks on reported v1.4.180 (0b62333cf1), latest main (9bb8836bb6), and disabled fix; runtime candidate 3cf8a37447 passed 5/5, and final code candidate 121e112d77 separately passed its expanded 6/6 oracle. Renderer oracle 3b0949eef8b792cf5b09cfa55341f4216c08714f158e4b132e988e8114636cea failed both explicit-empty hydration/fallback checks on v1.4.180, latest main, and disabled fix, while renderer candidate 121e112d77 passed 2/2. The 1.4.187 recurrence oracle deterministically failed with historical tab_not_found when PTY stop was moved ahead of durable retirement, then passed with retirement committed before externally owned teardown while the canary remained live."
},
"performanceBudget": {
"required": true,
"evidence": "The close path is user-triggered and bounded by canonical live-owner indexing. Production ps has a 1s kill timeout; 20 same-turn requests execute one fresh process-table read, while requests arriving after a scan starts immediately share one successor so their deadline is not consumed waiting and no unusable ps starts after timeout. Completed tables are never reused. Bulk worktree shutdown runs in 32-wide batches so each batch can coalesce its initial scan without unbounded provider fanout. Descendant traversal uses a visited set and index cursor; a Node 24 local 100,000-wide synthetic tree fell from 861ms to 16.7ms, and escalation indexes only the requested descendant PIDs instead of duplicating the full process table. Escalation uses the same bounded coordinator, and kill-all store scale remains covered by terminal-session.kill-all-surface-cleanup."
},
"promotionCriteria": [
"Accumulate 100 clean runs or 14 days on required CI platforms.",
"Add live Windows/ConPTY, Linux, WSL, SSH, and ordinary runtime process-absence evidence.",
"Add restart/no-resurrection and repeated park-close soak coverage."
],
"knownGaps": [
"The live Electron proof currently covers macOS local PTYs only.",
"Disconnected SSH relay death still requires reconnect-aware provider ownership.",
"Daemon owner leases and durable retry inventory remain follow-up hardening.",
"Windows ConPTY, SSH-hosted PTYs, app-quit killAll, and daemon dispose retain foreground-tree-only teardown.",
"A process born in the capture second is SIGTERMed but not SIGKILLed because ps cannot prove its recycled-PID identity.",
"A descendant orphaned before or during root ownership loss requires the separate crash-orphan sweep and is not recovered from a stale kill-time snapshot.",
"recordTerminalSurfaceRetirement advances the INCOMING session's terminal topology revision, so a tombstoned close whose write carries a revision at or below the store's own is rebased away instead of persisting. Pre-existing for every repo already past revision 0 and unchanged by the host-admitted membership fix, which only makes more repos reach that state sooner; the authoritative close path (persistTerminalSurfaceRetirements) computes from the store's session and is unaffected. Known, unaddressed, and deliberately out of scope here: the safe correction is per-tab rather than per-worktree rebase arbitration, because raising the incoming revision wholesale would re-open the host-tab loss whenever a close coincides with a host create.",
"The SSH relay reattach binding (src/main/ssh/ssh-relay-session.ts persistPtyBinding) is NOT flagged host-admitted, so a lease rebind that has to mint a missing tab raises no fence. It rebinds an existing lease rather than admitting a new surface, so it is believed not to need one, but that was not established either way. Known, unaddressed, and deliberately out of scope here.",
"The host-created retention journey is macOS-local; the reported incident was on a physical Windows host, which we did not run against."
],
"demotionRule": "Keep experimental or demote to protection none if exact PTY disappearance flakes, a sibling/detached pane is retired, late hooks can recreate closed authority, or a renderer graph sync retires a host-created tab that no explicit close retired."
},
{
"id": "terminal-session.daemon-generation-reconnect-safety",
"title": "Negotiated close intent protects live daemon-generation terminals",
"maturity": "experimental",
"protection": "partial",
"owner": "terminal-runtime",
"layer": "renderer-runtime-rpc-daemon-contract",
"surfaces": [
"runtime session reconnect",
"legacy daemon adoption",
"mixed-version paired viewer close",
"terminal lifecycle close",
"app relaunch and profile reconnect"
],
"platforms": ["macos", "linux", "windows"],
"providers": ["daemon", "runtime", "ssh", "wsl"],
"coveredPlatforms": ["linux", "macos", "windows"],
"coveredProviders": ["daemon", "runtime"],
"coverageNotes": "Recorded native Windows evidence covers the v21/v22/v23/v24/v25 named-pipe matrix. The deterministic daemon harness covers capable and legacy paired-runtime request shapes against live v25/v26 PTYs in separate worktrees, plus an unrelated control. Host/renderer tests cover old servers, missing liveness, stale publications, reused claims, split parents, explicit user intent, cross-profile isolation, remote runtime clients, SSH-provider routing, and WSL boundaries. A headed host paired to a separate live client, headless serve parity, Linux, SSH, and WSL remain explicit gaps.",
"motivatingLinks": [
"https://github.com/stablyai/orca/issues/9749",
"https://github.com/stablyai/orca/issues/9949",
"https://github.com/stablyai/orca/issues/8871",
"https://github.com/stablyai/orca/issues/9138",
"https://github.com/stablyai/orca/issues/9229"
],
"invariant": "Reconnect, replay, or lifecycle observations from a viewer that negotiated explicit close intent must never kill a live PTY. A capable reasonless close must keep and republish; a legacy paired viewer must retain current-main behavior because its intentional close and cleanup echo are wire-identical. Lifecycle close requires the exact observed publication, terminal, environment, and authoritative liveness, never signals a process, and leaves renderer-owned or partial-split retirement to its owner. Legacy daemon hello and warm reattachment remain non-destructive.",
"oracle": "Start isolated v25 and v26 daemon generations with one capable-viewer PTY and one legacy-viewer PTY per generation in four target worktrees plus an unaddressed control PTY in a fifth worktree. Route them through the production desktop scanner, runtime, RPC dispatcher, renderer-close relay, and daemon router. First issue sequential reasonless closes from an authenticated capable connection and require refusal, snapshot republish, zero shutdown calls, exact process survival, and post-close I/O. Then issue the byte-identical requests without the negotiated capability and require current-main behavior: two ordered immediate shutdowns, session-killed events, and exact root/descendant death, while capable and control PTYs survive. An observer lists all targets before, between, and after while issuing zero closes. Unit contracts also require in-process reasonless refusal, legacy runtime/mobile compatibility, explicit user closes, encrypted client-auth advertisement, and old-server lifecycle calls never to fall back.",
"commands": [
"pnpm exec vitest run --config config/vitest.config.ts src/main/daemon/daemon-server-kill-attribution.test.ts src/main/runtime/orca-runtime.test.ts src/main/runtime/remote-runtime-request-connection.integration.test.ts src/main/runtime/rpc/runtime-close-attribution-topology.test.ts src/main/runtime/rpc/methods/session-tabs.test.ts src/main/runtime/rpc/methods/session-tabs-schemas.test.ts src/main/runtime/rpc/e2ee-channel.test.ts src/main/runtime/rpc/e2ee-channel-v2.test.ts src/main/runtime/rpc/mobile-socket-wiring.test.ts src/main/runtime/rpc/runtime-client-capabilities.test.ts src/shared/remote-runtime-client.test.ts src/shared/remote-runtime-request-connection.test.ts src/shared/remote-runtime-shared-control-connection.test.ts src/cli/runtime/websocket-transport.test.ts src/renderer/src/web/web-runtime-client.test.ts src/renderer/src/runtime/web-runtime-session.test.ts src/renderer/src/runtime/web-session-close-intent.test.ts src/renderer/src/runtime/web-session-tabs-sync.test.ts src/renderer/src/components/terminal/terminal-tab-actions.test.ts src/renderer/src/components/terminal/terminal-close-incarnation.test.ts src/renderer/src/components/terminal-pane/terminal-parked-tab-watchers.test.ts",
"pnpm exec playwright test tests/e2e/daemon-generation-reconnect-safety.spec.ts --config tests/playwright.config.ts --project electron-headless --workers=1",
"pnpm exec playwright test tests/e2e/daemon-generation-legacy-close-safety.spec.ts --config tests/playwright.config.ts --project electron-headless --workers=1"
],
"testFiles": [
"src/main/daemon/daemon-server-kill-attribution.test.ts",
"src/main/runtime/orca-runtime.test.ts",
"src/main/runtime/remote-runtime-request-connection.integration.test.ts",
"src/main/runtime/rpc/runtime-close-attribution-topology.test.ts",
"src/main/runtime/rpc/methods/session-tabs.test.ts",
"src/main/runtime/rpc/methods/session-tabs-schemas.test.ts",
"src/main/runtime/rpc/e2ee-channel.test.ts",
"src/main/runtime/rpc/e2ee-channel-v2.test.ts",
"src/main/runtime/rpc/mobile-socket-wiring.test.ts",
"src/main/runtime/rpc/runtime-client-capabilities.test.ts",
"src/shared/remote-runtime-client.test.ts",
"src/shared/remote-runtime-request-connection.test.ts",
"src/shared/remote-runtime-shared-control-connection.test.ts",
"src/cli/runtime/websocket-transport.test.ts",
"src/renderer/src/web/web-runtime-client.test.ts",
"src/renderer/src/runtime/web-runtime-session.test.ts",
"src/renderer/src/runtime/web-session-close-intent.test.ts",
"src/renderer/src/runtime/web-session-tabs-sync.test.ts",
"src/renderer/src/components/terminal/terminal-tab-actions.test.ts",
"src/renderer/src/components/terminal/terminal-close-incarnation.test.ts",
"src/renderer/src/components/terminal-pane/terminal-parked-tab-watchers.test.ts",
"tests/e2e/daemon-generation-reconnect-safety.spec.ts",
"tests/e2e/daemon-generation-legacy-close-safety.spec.ts"
],
"assertionRefs": [
{
"file": "src/main/daemon/daemon-server-kill-attribution.test.ts",
"assertions": [
"successful and failed daemon kill requests retain the authenticated control-client identity without claiming a failed kill succeeded"
]
},
{
"file": "src/main/runtime/rpc/runtime-close-attribution-topology.test.ts",
"assertions": [
"remote, legacy, reconnect, stale, concurrent, cross-worktree, and unowned close spans retain authoritative runtime, target, requester, decision, and outcome identities without serializing the bearer credential",
"close attribution adds no terminal inventory scan or provider fanout"
]
},
{
"file": "src/main/runtime/remote-runtime-request-connection.integration.test.ts",
"assertions": [
"the real encrypted WebSocket handshake binds close-intent capability through authenticated socket state and RPC context to reasonless-close refusal"
]
},
{
"file": "tests/e2e/daemon-generation-legacy-close-safety.spec.ts",
"assertions": [
"one identified capable viewer and one legacy viewer issue byte-identical sequential reasonless closes while a third viewer lists every target before, between, and after but issues zero closes",
"capable v25/v26 PTY root/descendant incarnations in separate worktrees survive, answer post-close input, and produce zero shutdown calls and zero daemon session-killed events",
"legacy v25/v26 PTY root/descendant incarnations die through ordered immediate shutdown calls with one daemon session-killed event each, matching current-main behavior",
"an unaddressed fifth-worktree PTY root and descendant survive with zero kill events, excluding global fanout",
"the JSON reconstruction records request order, negotiated capabilities, viewer connection, worktree/tab/PTY ids, daemon PID/protocol, call site, and exact before/after process liveness"
]
},
{
"file": "tests/e2e/daemon-generation-reconnect-safety.spec.ts",
"assertions": [
"the production scanner discovers v21/v22/v23/v24/v25 from v26 and every generation accepts repeated client hellos while every exact daemon, PTY-root, and descendant incarnation remains alive",
"desktop and two remote profiles repeat lifecycle closes before and after client relaunch with zero session-killed events",
"shutdown-dispose-failed drops named-pipe authority within the deadline and exact fixture cleanup leaves no process tree"
]
},
{
"file": "src/main/runtime/rpc/mobile-socket-wiring.test.ts",
"assertions": [
"the optional client capability is captured from legacy encrypted authentication and bound to the authenticated runtime-scoped socket identity"
]
},
{
"file": "src/main/runtime/rpc/e2ee-channel.test.ts",
"assertions": [
"runtime capabilities are accepted only from encrypted authentication metadata, not the unauthenticated hello"
]
},
{
"file": "src/main/runtime/rpc/e2ee-channel-v2.test.ts",
"assertions": ["mobile E2EE v2 continues to reject additive runtime capability metadata"]
},
{
"file": "src/main/runtime/rpc/runtime-client-capabilities.test.ts",
"assertions": [
"the authenticated capability parser accepts only bounded string arrays and rejects malformed or oversized input"
]
},
{
"file": "src/shared/remote-runtime-client.test.ts",
"assertions": [
"one-shot and subscription runtime clients remain compatible while sending encrypted client authentication"
]
},
{
"file": "src/shared/remote-runtime-request-connection.test.ts",
"assertions": [
"the cached paired-desktop request connection advertises close-intent support in encrypted authentication while reusing one socket"
]
},
{
"file": "src/shared/remote-runtime-shared-control-connection.test.ts",
"assertions": [
"the reconnecting shared-control client advertises close-intent support in encrypted authentication"
]
},
{
"file": "src/cli/runtime/websocket-transport.test.ts",
"assertions": [
"updated paired runtime clients advertise close-intent support in encrypted auth fields ignored by legacy servers"
]
},
{
"file": "src/renderer/src/web/web-runtime-client.test.ts",
"assertions": [
"the browser paired-runtime client advertises close-intent support inside encrypted authentication"
]
},
{
"file": "src/main/runtime/orca-runtime.test.ts",
"assertions": [
"live, unknown, stale, missing-intent, non-owner, and inventory-proven but not yet pane-bound lifecycle closes invoke neither PTY kill nor renderer close",
"dead whole-headless retirement removes stale state without signalling a retained PTY id"
]
},
{
"file": "src/main/runtime/rpc/methods/session-tabs.test.ts",
"assertions": [
"in-process and capable-runtime reasonless closes refuse while legacy runtime/mobile and explicit current user closes retain current-main destructive semantics"
]
},
{
"file": "src/renderer/src/runtime/web-runtime-session.test.ts",
"assertions": [
"lifecycle close uses the additive method with publication and terminal evidence",
"old-server method_not_found never falls back to destructive legacy close"
]
},
{
"file": "src/renderer/src/runtime/web-session-close-intent.test.ts",
"assertions": [
"identical worktree and tab ids in another runtime cannot suppress, reconcile, or clear this profile's intent"
]
},
{
"file": "src/renderer/src/components/terminal-pane/terminal-parked-tab-watchers.test.ts",
"assertions": [
"parked lifecycle closes carry the exact exiting PTY and cannot borrow a replacement or sibling incarnation"
]
}
],
"evidenceRuns": [
{
"date": "2026-07-27",
"runner": "ci",
"platform": "linux",
"command": "pnpm exec playwright test tests/e2e/daemon-generation-legacy-close-safety.spec.ts --config tests/playwright.config.ts --project electron-headless --workers=1",
"result": "passed",
"durationSeconds": 6.6,
"summary": "Current-head capability-gated oracle passed in E2E run https://github.com/stablyai/orca/actions/runs/30250731941/job/89928386794: capable v25/v26 roots and descendants survived with snapshot republish and post-close I/O, byte-identical legacy closes retained current-main shutdown behavior, and the unrelated fifth-worktree control survived."
},
{
"date": "2026-07-21",
"runner": "local",
"platform": "windows",
"command": "pnpm exec playwright test tests/e2e/daemon-generation-reconnect-safety.spec.ts --config tests/playwright.config.ts --project electron-headless --workers=1",
"result": "passed",
"durationSeconds": 137.1,
"summary": "The full command, including a fresh Electron E2E build, passed. Production desktop discovery found v21/v22/v23/v24 from v25; all five daemons and all ten exact PTY-root/descendant canaries survived six repeated lifecycle attempts per stale mirror with zero session-killed events. Bounded shutdown-dispose-failed dropped pipe authority while its refusing daemon/root/descendant remained alive until exact fixture cleanup; no fixture directory remained."
}
],
"runtimeBudget": {
"p95Seconds": 180,
"scope": "isolated native-Windows generation reconnect plus two-generation mixed-version close adjudication and fresh E2E build"
},
"flakeHistory": {
"status": "unknown",
"evidence": "Local deterministic Windows evidence includes the final two-scenario pass and a separate 25-burst stress pass; CI and 14-day soak history are absent."
},
"redGreenEvidence": {
"status": "complete",
"evidence": "Current main and PR #10013 route both reasonless viewer sequences to immediate shutdown, while the prior global-refusal candidate incorrectly preserves the legacy sequence. The capability-gated candidate passed the combined GitHub oracle: capable v25/v26 PTYs survive and answer input, legacy PTYs retain current-main shutdown behavior, and the unrelated control survives. Existing Windows red/green evidence separately covers evidence-bearing lifecycle closes."
},
"performanceBudget": {
"required": true,
"evidence": "Production adds one bounded client-capability parse during the authenticated connection handshake and one constant-time membership branch per close. It adds no polling, subprocess, provider listing, retry, timer, or process-per-session work. Refusal reuses the existing single-worktree snapshot republish. Test-only inventory and cleanup are bounded."
},
"promotionCriteria": [
"Collect 100 clean native-Windows runs over 14 days with zero unexplained flakes.",
"Add packaged Electron update/relaunch evidence with the same exact PTY survival oracle.",
"Add live Linux SSH-relay and Windows WSL reconnect artifacts without weakening keep-on-unknown."
],
"knownGaps": [
"The strongest proof is Electron-as-Node over real daemon PTYs, not a packaged headed Orca host paired to a separate old client; that is the primary live E2E still required.",
"Headless orca serve parity, live Linux, Linux SSH relay, and Windows WSL reconnect are not exercised; Docker SSH would cover only the SSH provider and cannot substitute for paired Orca-server evidence.",
"A topology containing any pre-contract paired desktop viewer remains vulnerable to that viewer's stale reasonless close storm; preserving its intentional-close behavior makes this unavoidable until the viewer upgrades.",
"Cross-profile daemon inventory and generation handoff/retirement remain the separate #9138/#9229 design.",
"A dead split leaf stays with its authoritative owner rather than being remotely pruned."
],
"demotionRule": "Keep experimental or quarantine if reconnect emits session-killed for a live canary, an exact root/descendant dies, an old server receives fallback destructive close, cleanup leaks a fixture process/pipe, or the gate flakes without a proven harness defect."
},
{
"id": "terminal-session.startup-cwd-missing-dir-recovery",
"title": "Fresh local terminal creation cannot be bricked by a deleted startup cwd",
"maturity": "experimental",
"protection": "partial",
"owner": "terminal-runtime",
"layer": "shared-main-renderer-contract",
"surfaces": ["terminal lifecycle", "tab creation", "PTY spawn", "startup cwd persistence"],
"platforms": ["macos", "linux", "windows", "mobile"],
"providers": ["local", "daemon", "ssh", "wsl", "remote-runtime"],
"coveredPlatforms": ["macos"],
"coveredProviders": ["local", "ssh", "remote-runtime"],
"coverageNotes": "Local macOS evidence covers the shared missing-dir fallback policy, main pty:spawn recovery and metadata, no-flag and reattach strictness, renderer IPC flag routing, SSH-tagged and remote-runtime omission, and the visibility-gated terminal notice. Daemon shares the same pre-provider main cwd decision but lacks a live daemon-provider run; WSL UNC paths are exempt from the probe by design and lack a live run; Linux/Windows and mobile/API strictness are gaps.",
"motivatingLinks": [
"https://github.com/stablyai/orca/issues/7239",
"https://github.com/stablyai/orca/pull/7750",
"https://github.com/stablyai/orca/pull/7678"
],
"invariant": "A fresh local renderer terminal spawn may recover from a saved startup cwd whose directory no longer exists only by spawning at the selected workspace root and printing a generic in-terminal notice; existing directories — including ones outside the worktree (#7685) — spawn as requested, and reattach, SSH, remote-runtime, runtime/API, and mobile callers keep exact cwd semantics.",
"oracle": "The shared resolver falls back to the workspace root only when the injected existence probe reports the resolved cwd missing and the workspace root present, and never probes floating terminals or a cwd equal to the root. The renderer sends cwdFallback only for fresh local IPC spawns, main honors it only when connectionId and sessionId are absent, WSL UNC paths never engage the probe-based fallback, main returns fallback metadata only after an actual fallback, the IPC transport preserves that metadata, and the connection layer writes a generic notice that omits the missing path.",
"commands": [
"pnpm exec vitest run --config config/vitest.config.ts src/shared/terminal-startup-cwd.test.ts",
"pnpm exec vitest run --config config/vitest.config.ts src/main/ipc/pty-spawn-cwd-fallback.test.ts src/main/ipc/pty-wsl-cwd-validation.test.ts",
"pnpm exec vitest run --config config/vitest.config.ts src/renderer/src/components/terminal-pane/pty-transport-connect-spawn.test.ts",
"pnpm exec vitest run --config config/vitest.config.ts src/renderer/src/components/terminal-pane/pty-connection-runtime-owner-spawn-routing.test.ts"
],
"testFiles": [
"src/shared/terminal-startup-cwd.test.ts",
"src/main/ipc/pty-spawn-cwd-fallback.test.ts",
"src/main/ipc/pty-wsl-cwd-validation.test.ts",
"src/renderer/src/components/terminal-pane/pty-transport-connect-spawn.test.ts",
"src/renderer/src/components/terminal-pane/pty-connection-runtime-owner-spawn-routing.test.ts"
],
"assertionRefs": [
{
"file": "src/shared/terminal-startup-cwd.test.ts",
"assertions": [
"a missing requested cwd falls back to the workspace root and reports the missing path to the callback",
"existing cwds — nested or outside the worktree (#7685) — are never remapped",
"no fallback happens when the workspace root is missing too",
"floating terminal cwds and root-equal requests are never probed",
"non-ASCII worktree roots and folder workspace roots are recovered verbatim"
]
},
{
"file": "src/main/ipc/pty-spawn-cwd-fallback.test.ts",
"assertions": [
"local pty:spawn with cwdFallback worktree spawns at the worktree root when the saved cwd is missing and returns fallback metadata"
]
},
{
"file": "src/main/ipc/pty-wsl-cwd-validation.test.ts",
"assertions": [
"a missing cwd without the flag still surfaces the provider's missing-directory error",
"an existing outside-worktree cwd spawns as requested without fallback metadata",
"session reattach spawns ignore the fallback flag and keep exact cwd semantics"
]
},
{
"file": "src/renderer/src/components/terminal-pane/pty-transport-connect-spawn.test.ts",
"assertions": [
"IPC transport sends cwdFallback only for local fresh spawns",
"SSH-tagged and session reattach spawns omit cwdFallback",
"IPC transport returns startup cwd fallback metadata to the connection layer"
]
},
{
"file": "src/renderer/src/components/terminal-pane/pty-connection-runtime-owner-spawn-routing.test.ts",
"assertions": [
"fresh local IPC worktree spawns are marked with cwdFallback worktree",
"startup cwd fallback metadata prints a generic in-terminal notice",
"remote-runtime worktree spawns are not marked with cwdFallback"
]
}
],
"evidenceRuns": [
{
"date": "2026-07-08",
"runner": "local",
"platform": "macos",
"command": "pnpm exec vitest run --config config/vitest.config.ts src/shared/terminal-startup-cwd.test.ts",
"result": "passed",
"durationSeconds": 0.2,
"summary": "1 test file passed, 21 tests passed; covers the missing-dir fallback policy, #7685 outside-worktree preservation, and root-missing/floating exemptions."
},
{
"date": "2026-07-08",
"runner": "local",
"platform": "macos",
"command": "pnpm exec vitest run --config config/vitest.config.ts src/main/ipc/pty-spawn-cwd-fallback.test.ts src/main/ipc/pty-wsl-cwd-validation.test.ts",
"result": "passed",
"durationSeconds": 0.9,
"summary": "1 test file passed, 225 tests passed; covers main pty:spawn recovery, fallback metadata, and no-flag/reattach provider-error strictness."
},
{
"date": "2026-07-08",
"runner": "local",
"platform": "macos",
"command": "pnpm exec vitest run --config config/vitest.config.ts src/renderer/src/components/terminal-pane/pty-transport-connect-spawn.test.ts",
"result": "passed",
"durationSeconds": 0.34,
"summary": "1 test file passed, 58 tests passed; covers cwdFallback forwarding only for local fresh spawns and metadata handoff."
},
{
"date": "2026-07-08",
"runner": "local",
"platform": "macos",
"command": "pnpm exec vitest run --config config/vitest.config.ts src/renderer/src/components/terminal-pane/pty-connection-runtime-owner-spawn-routing.test.ts",
"result": "passed",
"durationSeconds": 6.5,
"summary": "1 test file passed, 341 tests passed; covers local IPC marking, the generic terminal fallback notice, and remote-runtime omission."
}
],
"runtimeBudget": {
"p95Seconds": 30,
"scope": "focused unit and IPC contract tests"
},
"flakeHistory": {
"status": "unknown",
"evidence": "New experimental gate added with local deterministic evidence only; needs CI soak before promotion."
},
"redGreenEvidence": {
"status": "partial",
"evidence": "The main IPC missing-cwd tests fail with the provider's 'Working directory ... does not exist.' error when the fallback is removed and pass with it. Full live Electron reproduction from a production persisted session is not captured."
},
"performanceBudget": {
"required": true,
"evidence": "The runtime change adds at most two statSync probes on the fresh-local spawn path (the provider already stats the same paths during validation) and one bounded terminal write only when fallback actually occurs; no polling, provider listing, hidden-pane work, startup awaits, subprocesses, or render-loop work was added."
},
"promotionCriteria": [
"Attach CI evidence for all declared test files.",
"Add a live Electron regression that opens a local terminal whose persisted startupCwd was deleted and proves visible shell input/output at the workspace root.",
"Add WSL/mobile/API provider-contract coverage or explicitly narrow their risk scope."
],
"knownGaps": [
"No live Electron fixture seeds a persisted tab whose startupCwd directory was deleted.",
"Daemon coverage is via the shared pre-provider main cwd decision, not a live daemon provider spawn.",
"WSL UNC paths bypass the probe by design and have no live existence-recovery run; Linux, Windows, and mobile/API strictness are not directly exercised."
],
"demotionRule": "Demote or quarantine if the gate flakes without a product bug, if an existing directory is ever remapped away from the requested cwd, or if a reattach/remote/API caller can engage the fallback."
},
{
"id": "agent-status.pi-hook-liveness",
"title": "Pi status hooks cannot stall a turn or complete a live runtime",
"maturity": "experimental",
"protection": "partial",
"owner": "agent-session",
"layer": "main-provider-contract",
"surfaces": [
"Pi and OMP managed extensions",
"agent status hooks",
"runtime reload and session replacement",
"loopback restart and stall recovery"
],
"platforms": ["macos", "linux", "windows"],
"providers": ["local", "daemon", "ssh", "wsl", "remote-runtime"],
"coveredPlatforms": ["macos"],
"coveredProviders": [],
"coverageNotes": "Local macOS execution of the generated Pi/OMP extension plus the shared hook normalizer. WSL fallback behavior is covered with mocked native-fetch failure and Windows curl handoff. Daemon PTYs use the same generated extension without a distinct delivery path. SSH/relay ingest uses the shared normalizer, but no live remote Pi process is exercised.",
"motivatingLinks": [
"https://github.com/stablyai/orca/issues/7791",
"https://github.com/stablyai/orca/pull/7802",
"https://github.com/stablyai/orca/pull/7838"
],
"invariant": "Orca status reporting must return synchronously from every Pi/OMP extension handler, retain at most one active request and one latest pending snapshot, and abandon stalled loopback delivery within one second. A Pi session_shutdown event cannot mark a turn done because Pi also emits it for reload, new, resume, and fork while the PTY remains alive; only agent_end proves turn completion, while real process exit is cleared by PTY teardown.",
"oracle": "Execute the generated extension with a fetch that remains pending and assert the Pi handler returns before delivery; emit three statuses during the stall and assert exactly one request is active and only the latest pending status is sent next; advance fake time by one second and assert the active signal aborts and the latest status proceeds. Through the shared normalizer, assert session_shutdown yields no status while agent_end still yields done.",
"commands": [
"pnpm exec vitest run --config config/vitest.config.ts src/main/pi/agent-status-extension-source.test.ts src/main/agent-hooks/server-pi-normalization.test.ts --maxWorkers=1"
],
"testFiles": [
"src/main/pi/agent-status-extension-source.test.ts",
"src/main/agent-hooks/server-pi-normalization.test.ts"
],
"assertionRefs": [
{
"file": "src/main/pi/agent-status-extension-source.test.ts",
"assertions": [
"a pending loopback fetch does not keep the Pi event handler unresolved",
"three events during a stall produce one active request and one request for only the latest pending status",
"the one-second delivery deadline aborts the active request and advances the latest pending status",
"the managed status extension does not register session_shutdown as a completion event",
"WSL native-fetch failures still hand off to a detached Windows curl process"
]
},
{
"file": "src/main/agent-hooks/server-pi-normalization.test.ts",
"assertions": [
"session_shutdown normalizes to no status instead of done",
"agent_end remains the authoritative Pi/OMP done event"
]
}
],
"evidenceRuns": [
{
"date": "2026-07-11",
"runner": "local",
"platform": "macos",
"command": "pnpm exec vitest run --config config/vitest.config.ts src/main/pi/agent-status-extension-source.test.ts src/main/agent-hooks/server-pi-normalization.test.ts --maxWorkers=1",
"result": "passed",
"durationSeconds": 1.3,
"summary": "2 files and 238 tests passed, including executed generated-extension liveness, latest-only queue bounds, timeout abort, WSL fallback, and Pi shutdown normalization."
}
],
"runtimeBudget": {
"p95Seconds": 10,
"scope": "generated-extension and shared-normalizer unit gate"
},
"flakeHistory": {
"status": "unknown",
"evidence": "New deterministic gate with local fake-receiver and fake-timer evidence; needs CI soak before promotion."
},
"redGreenEvidence": {
"status": "partial",
"evidence": "Before the fix, the pending-fetch handler assertion remained false and session_shutdown normalized to done (2 focused failures, 233 passes). With the fix, both pass; the bounded count and deadline assertions additionally fail if latest-only coalescing or the timeout is removed. Needs saved CI evidence before blocking promotion."
},
"performanceBudget": {
"required": true,
"evidence": "Every Pi event does O(1) work and returns without awaiting I/O. Delivery retains at most one active request plus one latest pending object, uses one unref'd timer per active request, and creates no polling, provider scans, subprocesses outside the existing WSL failure fallback, or renderer work. The deterministic burst test proves three stalled events retain two delivery slots rather than an event-count-sized queue."
},
"promotionCriteria": [
"Run in soak for at least 100 consecutive passes or 14 days across required CI platforms.",
"Attach saved red/green evidence for both the unresolved-handler and false-done regressions.",
"Add a live Pi Electron test that stalls or restarts the hook listener during a running turn and proves terminal output continues."
],
"knownGaps": [
"No live model-backed Pi turn or Electron Running-view assertion is automated; the gate executes the exact generated extension and shared normalizer below those surfaces.",
"An already-running Pi process keeps its previously loaded extension until Pi reloads or restarts.",
"During receiver unavailability, intermediate status details may be coalesced to the latest snapshot; this is intentional and bounded, but no UI test measures the temporary detail loss.",
"SSH/remote and Windows are not exercised with live providers; relay ingest shares normalization and WSL fallback has mocked contract coverage."
],
"demotionRule": "Demote or quarantine if the gate flakes without a product or harness bug, if a Pi handler can again await receiver I/O, or if coalescing allows an older status to overwrite a newer one."
},
{
"id": "agent-status.manual-compact-identity",
"title": "A finished Claude compact clears the pane, and an aborted one never strands it",
"maturity": "experimental",
"protection": "partial",
"owner": "agent-session",
"layer": "shared-main-relay-contract",
"surfaces": [
"Claude status hooks",
"manual compact lifecycle",
"last-status persistence",
"SSH relay ingest"
],
"platforms": ["macos", "linux", "windows"],
"providers": ["local", "daemon", "ssh", "wsl", "remote-runtime"],
"coveredPlatforms": ["macos"],
"coveredProviders": ["local", "ssh"],
"coverageNotes": "Deterministic listener, loopback HTTP, relay-restart, persisted-restore, and fake-SSH transport contracts run on macOS. Behavior tests deliver only events present in CLAUDE_EVENTS, so a mapping that is not registered cannot pass -- the failure mode that let the earlier compact correlation ship unreachable. Claude Code 2.1.227 PTY captures prove a successful manual compact emits PreCompact, a start-less summarizer SubagentStop, SessionStart(source=compact), then PostCompact, that an aborted compact emits PreCompact ALONE, that /compact emits no UserPromptSubmit, and that session_id is stable across the window. The shared Node paths are platform-independent; live Linux, Windows, WSL, and paired-runtime journeys remain gaps.",
"motivatingLinks": [
"https://github.com/stablyai/orca/issues/11352",
"https://github.com/stablyai/orca/pull/11353"
],
"invariant": "PreCompact is never registered and may never move a pane, because it fires before the compact is validated and an aborted compact emits it alone. Only a manual PostCompact may mark done, and it does so as a session boundary so completion-reactive consumers stay out of it; an automatic PostCompact claims nothing and writes no compact-scoped state, since its turn resumes and emits its own Stop. A completion either CLEARS a row or publishes nothing at all: it never creates a row, so a retired pane cannot be resurrected, and it never restates one it cannot clear, because a restated row loses restoredUnconfirmed and restarts the staleness clock. A manual /compact only completes at an idle prompt, so it retires a subagent that exists ONLY as a disk snapshot; live evidence -- a child observed in this runtime, an unclassifiable running background task, a registered session cron -- still holds the pane at working. A completion requires a valid provider prompt UUID, matches the pane owner by connection and provider session -- except on a restored row, which carries the previous connection and may carry no session at all -- and is applied at most once per compact. Ownership is enforced by the client that owns pane identity; a relay forwards and defers, so a cold relay cache cannot swallow the clearing event. A relay predating this contract forwards its own mapping, so ingest drops automatic envelopes, stamps the boundary on manual ones, carries the summarized turn label onto a promptless completion with or without a trigger, and classifies a trigger-stripped replay by payload state while still enforcing ownership. Kimi and other Claude-compatible vendors remain fail-closed.",
"oracle": "Replay the measured Claude compact streams through a harness gated on the real CLAUDE_EVENTS, plus local HTTP, relay, SSH, and persisted-restore transports. Require the successful manual stream to end done with sessionBoundary set, and require the aborted stream (PreCompact alone) to leave both an idle and a working pane exactly as it found them. Drive the restart shape end to end over loopback HTTP from a hydrated row: a pane held only by a snapshot child must reach done with an empty roster, while a pane a runtime child still owns must emit NOTHING and keep its row object identical, so receivedAt and restoredUnconfirmed both survive. Deliver the restored-row cases with the hydrated row still cached at completion time and assert the summarizer published nothing, so the restored-row branch is the branch under test. Require rejection of an automatic completion, a completion with absent prompt UUID, a foreign provider session, a duplicate, and a completion for a pane with no cached row; require an automatic completion to leave the consumed-compact map untouched. Require a relay with a COLD cache to forward the completion while the client still refuses to mint a row it never had. Require ingest to drop legacy automatic envelopes, stamp the boundary on legacy manual ones, carry the summarized turn label onto a promptless completion with and without a trigger, and leave a FINISHED pane finished when a trigger-stripped working replay arrives. Require the consumed-compact map to be empty after each pane-scoped teardown route and to follow a pane move. Assert registration membership, emitted event order, and the authoritative lastStatusByPaneKey snapshot.",
"commands": [
"pnpm exec vitest run --config config/vitest.config.ts src/main/claude/compact-status-registration.test.ts src/main/agent-hooks/manual-compact-hook-stream.test.ts src/main/agent-hooks/manual-compact-status-cleanup.test.ts src/shared/agent-hook-listener-claude-turn-state.test.ts src/shared/agent-hook-listener-claude-compatible-vendors.test.ts src/shared/agent-hook-relay.test.ts src/relay/agent-hook-server.test.ts src/main/agent-hooks/server-claude-normalization.test.ts src/main/agent-hooks/server-last-status-write.test.ts src/main/ssh/ssh-relay-session-agent-hooks.integration.test.ts --reporter=dot",
"Manual Claude Code interactive compact under a PTY: register every hook to a logging script, run one turn then /compact to observe the abort stream, then seven turns and /compact to observe the success stream; compare source, trigger, session_id, and prompt_id across both"
],
"testFiles": [
"src/main/claude/compact-status-registration.test.ts",
"src/main/agent-hooks/manual-compact-hook-stream.test.ts",
"src/main/agent-hooks/manual-compact-status-cleanup.test.ts",
"src/shared/agent-hook-listener-claude-turn-state.test.ts",
"src/shared/agent-hook-listener-claude-compatible-vendors.test.ts",
"src/shared/agent-hook-relay.test.ts",
"src/relay/agent-hook-server.test.ts",
"src/main/agent-hooks/server-claude-normalization.test.ts",
"src/main/agent-hooks/server-last-status-write.test.ts",
"src/main/ssh/ssh-relay-session-agent-hooks.integration.test.ts"
],
"assertionRefs": [
{
"file": "src/main/claude/compact-status-registration.test.ts",
"assertions": [
"PostCompact is registered in CLAUDE_EVENTS and written into the settings Claude reads, and PreCompact is absent from both",
"the measured successful manual compact ends a stuck working row as a done with sessionBoundary",
"an aborted compact (PreCompact alone) leaves an idle pane idle and a working pane working",
"an automatic completion claims nothing, writes no compact-scoped state, and the turn's own Stop still closes it",
"a completion retires a child that exists only as a disk snapshot, but a runtime child or an active session cron still holds the pane and the completion then publishes nothing at all",
"a completion clears a restored row -- delivered while that hydrated row is still the cached owner -- despite a stale connection id or a missing provider session, but never resurrects a retired pane",
"absent prompt UUID, foreign provider session, and duplicate delivery fail closed",
"the consumed-compact record is dropped by clearPaneCacheState and clearAllListenerCaches and follows movePaneCacheState"
]
},
{
"file": "src/main/agent-hooks/manual-compact-hook-stream.test.ts",
"assertions": [
"the measured local HTTP stream settles once and rejects a duplicate completion",
"a hydrated restart-stuck pane reaches done with an empty roster, and a pane a runtime child owns emits nothing and keeps its row object identical",
"the relay forwards the completion and preserves its compact identity in the replay cache so the client re-runs ownership before applying the clearing row",
"a relay with a cold cache still forwards the completion, and the client still refuses to mint a row it never had",
"a legacy relay's manual envelope is stamped as a session boundary and its automatic envelope is dropped instead of minting working",
"a promptless completion keeps the summarized turn's label with and without a trigger on the envelope",
"a trigger-stripped replay is classified by payload state, leaves a FINISHED pane finished, and is still rejected on an owner mismatch",
"a PreCompact envelope never drives pane state"
]
},
{
"file": "src/main/agent-hooks/manual-compact-status-cleanup.test.ts",
"assertions": ["pane, tab, and server cleanup revoke compact completion authority"]
},
{
"file": "src/main/ssh/ssh-relay-session-agent-hooks.integration.test.ts",
"assertions": [
"SSH stamps the receiving connection and forwards source, prompt UUID, session, and manual trigger"
]
}
],
"evidenceRuns": [
{
"date": "2026-08-18",
"runner": "local",
"platform": "macos",
"command": "pnpm exec vitest run --config config/vitest.config.ts src/main/claude/compact-status-registration.test.ts src/main/agent-hooks/manual-compact-hook-stream.test.ts src/main/agent-hooks/manual-compact-status-cleanup.test.ts src/shared/agent-hook-listener-claude-turn-state.test.ts src/shared/agent-hook-listener-claude-compatible-vendors.test.ts src/shared/agent-hook-relay.test.ts src/relay/agent-hook-server.test.ts src/main/agent-hooks/server-claude-normalization.test.ts src/main/agent-hooks/server-last-status-write.test.ts src/main/ssh/ssh-relay-session-agent-hooks.integration.test.ts --reporter=dot",
"result": "passed",
"durationSeconds": 3.28,
"summary": "Ten files and 116 tests passed across registration, listener, local HTTP, relay, SSH, persistence, and cleanup. Reverting only the four source files to the merge base first turned 12 of 21 registration-gated tests and 8 of 12 relay/ingest tests red, so the suite observes its own failure rather than passing over unreachable code. Every assertion was additionally mutation-tested: 18 of 18 targeted mutations -- including reaping runtime children as well as snapshot ones, restating a pane live evidence still holds, re-enforcing compact ownership on the relay, and dropping the consumed-compact map from any one teardown route -- are caught."
},
{
"date": "2026-08-17",
"runner": "manual",
"platform": "macos",
"command": "Manual Claude Code interactive compact under a PTY: register every hook to a logging script, run one turn then /compact to observe the abort stream, then seven turns and /compact to observe the success stream; compare source, trigger, session_id, and prompt_id across both",
"result": "passed",
"durationSeconds": 1080,
"summary": "Claude Code 2.1.227. Aborted compact emitted PreCompact(manual) ALONE with no PostCompact and no SessionStart(compact). Successful compact emitted PreCompact(manual), a start-less SubagentStop (agent_type empty, no matching SubagentStart), SessionStart(source=compact), PostCompact(manual), then Notification(idle_prompt). /compact emitted no UserPromptSubmit in either the TUI or print mode; session_id was stable across the whole window while the compact allocated its own prompt_id."
}
],
"runtimeBudget": {
"p95Seconds": 20,
"scope": "shared, main-process, relay, persistence, and fake-SSH contract tests"
},
"flakeHistory": {
"status": "unknown",
"evidence": "New deterministic gate with one local run; CI soak history is not yet available."
},
"redGreenEvidence": {
"status": "complete",
"evidence": "The byte-identical oracle (SHA-256 24e80c15b467ffa9c47a81099f11bf26dea71293e47b5d950b2fad1497094764) failed 5 of 6 on origin/main@a20165a43d, passed 6 of 6 on the candidate, failed 3 of 6 when only the exact-transition guard was disabled, and passed 6 of 6 after restoration."
},
"performanceBudget": {
"required": true,
"evidence": "Each compact event performs one O(1) current-status lookup plus bounded UUID, source, connection, session, and event comparisons. Identity lives on the existing status row and is removed by its existing lifecycle; the change adds no owner map, global scan, polling, timer, subprocess, network request, or listener. The 4,097-key adversarial arm retains zero status, prompt, or ownership entries."
},
"promotionCriteria": [
"Collect 100 consecutive focused CI passes or 14 days of soak history.",
"Run live manual compact journeys on Linux and Windows and through a real SSH target.",
"Keep automatic compact completion disabled until a generation-unique provider identity is proven."
],
"knownGaps": [
"No live Linux, Windows, WSL, paired-runtime, or real-SSH manual compact journey was run.",
"Claude versions before prompt_id support intentionally cannot complete a manual compact row through PostCompact.",
"Automatic Claude and Kimi completion remain intentionally fail-closed because their hooks do not prove an exact compact generation."
],
"demotionRule": "Demote or quarantine if identity-mismatched completion can retire newer work, cleanup retains compact authority, or the focused gate flakes without a product or harness bug."
},
{
"id": "agent-launch.discovery-authority",
"title": "Agent discovery and launch use the same workspace authority",
"maturity": "experimental",
"protection": "partial",
"owner": "agent-session",
"layer": "renderer-store-contract",
"surfaces": ["Quick Launch agent inventory", "agent launch", "Floating Workspace"],
"platforms": ["macos", "linux", "windows"],
"providers": ["local", "wsl", "ssh", "remote-runtime"],
"coveredPlatforms": ["macos", "windows"],
"coveredProviders": ["local", "wsl"],
"coverageNotes": "A deterministic Windows-mode renderer oracle keeps an active WSL project and explicit-local Floating Workspace mounted together with disjoint agent inventories, then independently asserts discovery and launch authority. A headed physical Windows 2 journey with real Ubuntu WSL2 independently verified the rendered inventory and native PowerShell launch; SSH and paired-runtime behavior retain their existing contract coverage.",
"motivatingLinks": [
"https://linear.app/stably/issue/STA-4027/p1-floating-workspace-agent-detection-still-uses-active-wsl-project",
"https://github.com/stablyai/orca/pull/13995"
],
"invariant": "Every agent launch surface must advertise the provider set detected on its explicit execution authority and launch on that same authority; a local Floating Workspace must never inherit an unrelated active project's WSL, SSH, or paired-runtime context.",
"oracle": "Model an active WSL project and a native-Windows Floating Workspace with WSL-only Claude and host-only Codex. Keep both detection consumers mounted, require their advertised sets to stay disjoint through refresh, require the legacy active-project inventory to remain unchanged, then independently assert the Floating launch call and PTY transport select local IPC with no WSL project runtime.",
"commands": [
"pnpm exec vitest run --config config/vitest.config.ts src/renderer/src/hooks/useDetectedAgents.test.tsx src/renderer/src/hooks/useAgentDetectionTarget.test.ts src/renderer/src/store/slices/detected-agents.test.ts src/renderer/src/store/slices/local-detected-agent-state.test.ts src/renderer/src/store/slices/repos-remove-project-purge-leak.test.ts src/renderer/src/lib/local-preflight-context.test.ts src/renderer/src/lib/launch-agent-in-new-tab.test.ts --reporter=verbose",
"pnpm exec vitest run --config config/vitest.config.ts src/renderer/src/components/terminal-pane/pty-connection-fresh-spawn-guards.test.ts --reporter=dot",
"Headed Electron/CDP STA-4027 journey on Orca environment windows 2 with a selected Ubuntu-24.04 WSL project and local Floating Workspace"
],
"testFiles": [
"src/renderer/src/hooks/useDetectedAgents.test.tsx",
"src/renderer/src/hooks/useAgentDetectionTarget.test.ts",
"src/renderer/src/store/slices/detected-agents.test.ts",
"src/renderer/src/store/slices/local-detected-agent-state.test.ts",
"src/renderer/src/store/slices/repos-remove-project-purge-leak.test.ts",
"src/renderer/src/lib/local-preflight-context.test.ts",
"src/renderer/src/lib/launch-agent-in-new-tab.test.ts",
"src/renderer/src/components/terminal-pane/pty-connection-fresh-spawn-guards.test.ts"
],
"assertionRefs": [
{
"file": "src/renderer/src/hooks/useDetectedAgents.test.tsx",
"assertions": [
"the active WSL project advertises only its WSL agent while Floating advertises only the native-host agent",
"Floating refresh preserves both scoped inventories and does not overwrite the legacy active-project inventory"
]
},
{
"file": "src/renderer/src/store/slices/local-detected-agent-state.test.ts",
"assertions": [
"same-context callers deduplicate without cached broadcast fanout",
"refresh supersedes stale detection and failed cold refresh remains retryable",
"project removal evicts settled and in-flight context state"
]
},
{
"file": "src/renderer/src/store/slices/repos-remove-project-purge-leak.test.ts",
"assertions": [
"removing one project evicts its authority-scoped agent inventory without disturbing another project"
]
},
{
"file": "src/renderer/src/lib/launch-agent-in-new-tab.test.ts",
"assertions": [
"the advertised Floating agent launches in a Floating tab with null runtime ownership and no paired-runtime create call"
]
},
{
"file": "src/renderer/src/components/terminal-pane/pty-connection-fresh-spawn-guards.test.ts",
"assertions": [
"the Floating agent's actual PTY selects local IPC, carries executionHostId local, and omits the active project's WSL runtime"
]
}
],
"evidenceRuns": [
{
"date": "2026-08-12",
"runner": "local",
"platform": "macos",
"command": "pnpm exec vitest run --config config/vitest.config.ts src/renderer/src/hooks/useDetectedAgents.test.tsx src/renderer/src/hooks/useAgentDetectionTarget.test.ts src/renderer/src/store/slices/detected-agents.test.ts src/renderer/src/store/slices/local-detected-agent-state.test.ts src/renderer/src/store/slices/repos-remove-project-purge-leak.test.ts src/renderer/src/lib/local-preflight-context.test.ts src/renderer/src/lib/launch-agent-in-new-tab.test.ts --reporter=verbose",
"result": "passed",
"durationSeconds": 2,
"summary": "Seven focused files passed independent WSL/local inventory, refresh isolation, cache lifecycle, project eviction, and Floating launch-call assertions."
},
{
"date": "2026-08-12",
"runner": "local",
"platform": "macos",
"command": "pnpm exec vitest run --config config/vitest.config.ts src/renderer/src/components/terminal-pane/pty-connection-fresh-spawn-guards.test.ts --reporter=dot",
"result": "passed",
"durationSeconds": 20,
"summary": "The full PTY connection suite passed the independent Floating native-host transport oracle."
},
{
"date": "2026-08-12",
"runner": "manual",
"platform": "windows",
"command": "Headed Electron/CDP STA-4027 journey on Orca environment windows 2 with a selected Ubuntu-24.04 WSL project and local Floating Workspace",
"result": "passed",
"durationSeconds": 22.3,
"summary": "Environment abfee683-80eb-4ac3-ada0-da5d1b6303a6, runtime b3bea13e-f6b7-41e7-b850-0a118f7eda38: Floating advertised native Claude/Codex without WSL-only Gemini and launched Claude through native PowerShell with local host ownership while the WSL project remained active."
}
],
"runtimeBudget": {
"p95Seconds": 40,
"scope": "eight focused renderer authority, cache, eviction, and launch test files"
},
"flakeHistory": {
"status": "soaking",
"evidence": "The deterministic oracle uses mocked provider results and React effect barriers. Exact-head PR run 31644438349 passed the full Node 24/26 matrix; an earlier patch-identical run's transient shard failures passed on rerun, but long-term soak history is not yet available."
},
"redGreenEvidence": {
"status": "complete",
"evidence": "The byte-identical oracle fails on merged PR #13995 and the tested latest-main snapshot ebe5125476 because Floating receives the WSL-only Claude inventory while launch remains local. The candidate passes; disabling the scoped Floating target reproduces the mismatch."
},
"performanceBudget": {
"required": true,
"evidence": "Floating uses one stable host context key, retained tab bars do not rescan worktree indexes on store writes, concurrent probes deduplicate per context, and in-flight promise entries are deleted on settlement."
},
"promotionCriteria": [
"Collect 100 consecutive focused CI passes or 14 days of soak history.",
"Keep the physical Windows/WSL inventory and launch journey green when authority routing changes.",
"Keep disjoint provider inventories, refresh isolation, launch authority, and bounded in-flight state green."
],
"knownGaps": [
"Live SSH and paired-runtime launch journeys are covered by existing authority contracts rather than this focused oracle."
],
"demotionRule": "Demote if discovery and launch can resolve different authorities, a scoped Floating probe overwrites the active-project inventory, or local context selection adds recurring scans or retained in-flight entries."
},
{
"id": "agent-session.provider-ownership",
"title": "Provider sessions are resumed once per workspace ownership claim",
"maturity": "experimental",
"protection": "partial",
"owner": "agent-session",
"layer": "cross-boundary",
"surfaces": [
"agent launch",
"workspace activation",
"sleep and hibernate restore",
"provider session dedupe",
"sidebar and mobile identity",
"runtime-owned background PTY mount and remount"
],
"platforms": ["macos", "linux", "windows"],
"providers": ["local", "daemon", "ssh", "wsl", "remote-runtime"],
"coveredPlatforms": ["macos"],
"coveredProviders": ["local", "daemon", "remote-runtime"],
"coverageNotes": "Renderer ownership/dedupe contracts cover provider-session claims. Local and daemon attach-only contracts prove an existing stable-pane owner is adopted without provider creation, while remote-runtime transport contracts preserve adopted ownership through cancellation. The Electron oracle covers a local macOS runtime and daemon with real agent, Setup, and unrelated-canary processes; SSH, WSL, paired-server, Linux, and Windows remain contract-only or unrun.",
"motivatingLinks": [
"https://github.com/stablyai/orca/pull/6800",
"https://github.com/stablyai/orca/pull/5240",
"https://github.com/stablyai/orca/pull/6411",
"https://github.com/stablyai/orca/pull/6833",
"https://github.com/stablyai/orca/pull/11789",
"https://github.com/stablyai/orca/pull/11819"
],
"invariant": "Workspace activation, launch, restore, sleep, hibernate, dedupe, clearing, mount, remount, and reconnect code must not replay or resume a provider session id already owned, queued, pending, live, or durably bound to a host PTY in that workspace. A renderer with missing projection state must adopt the exact runtime-owned PTY for the original tab and leaf rather than create a replacement.",
"oracle": "Renderer-state tests assert provider-session ownership across preserved and queued panes. Main/provider contracts assert atomic attach-only adoption, stable host/worktree/tab/leaf identity, no fresh spawn on adoption, and safe paired-runtime cancellation. The Electron oracle creates inactive runtime-owned Codex and Setup PTYs plus an unrelated canary, seeds an exact resumable provider session, removes only the target renderer projections, and activates the workspace. It requires byte-stable handle, PTY, incarnation, tab, leaf, process PID, renderer graph, persisted binding, runtime id, graph epoch, and daemon PID across first mount and reload; PID-specific DOM keyboard I/O must remain live with one launch, zero resume argv, zero signals, zero interruption text, and no canary mutation.",
"commands": [
"pnpm exec vitest run --config config/vitest.config.ts src/renderer/src/lib/resume-sleeping-agent-session.test.ts",
"pnpm exec vitest run --config config/vitest.config.ts tests/e2e/completed-worker-retirement-resume.unit.test.ts --reporter=verbose",
"pnpm exec vitest run --config config/vitest.config.ts src/renderer/src/lib/resume-sleeping-agent-session.test.ts src/main/providers/local-pty-provider-spawn-session.test.ts src/main/daemon/terminal-host.test.ts src/main/daemon/daemon-pty-adapter.test.ts src/main/ipc/pty-pane-materialization-race.test.ts src/main/ipc/pty-persisted-incarnation-repair.test.ts src/main/ipc/pty-pane-reservation-settlement.test.ts src/main/runtime/orca-runtime.test.ts src/renderer/src/lib/pane-manager/pane-fit.test.ts src/renderer/src/components/terminal-pane/pty-connection-deferred-reattach-live-output.test.ts src/renderer/src/components/terminal-pane/remote-runtime-pty-transport-host-session-launch.test.ts",
"pnpm exec electron-vite build --mode e2e && SKIP_BUILD=1 pnpm exec playwright test tests/e2e/live-background-terminal-mount-authority.spec.ts --config tests/playwright.config.ts --project electron-headless --workers=1"
],
"testFiles": [
"src/renderer/src/lib/resume-sleeping-agent-session.test.ts",
"tests/e2e/completed-worker-retirement-resume.unit.test.ts",
"src/main/providers/local-pty-provider-spawn-session.test.ts",
"src/main/daemon/terminal-host.test.ts",
"src/main/daemon/daemon-pty-adapter.test.ts",
"src/main/ipc/pty-pane-materialization-race.test.ts",
"src/main/ipc/pty-persisted-incarnation-repair.test.ts",
"src/main/ipc/pty-pane-reservation-settlement.test.ts",
"src/main/runtime/orca-runtime.test.ts",
"src/renderer/src/lib/pane-manager/pane-fit.test.ts",
"src/renderer/src/components/terminal-pane/pty-connection-deferred-reattach-live-output.test.ts",
"src/renderer/src/components/terminal-pane/remote-runtime-pty-transport-host-session-launch.test.ts",
"tests/e2e/live-background-terminal-mount-authority.spec.ts"
],
"assertionRefs": [
{
"file": "tests/e2e/completed-worker-retirement-resume.unit.test.ts",
"assertions": [
"completed and explicitly retired workers retain no provider-resume authority on first workspace activation",
"the original tab, leaf, PTY, provider session, release state, replacement count, queued resume argv, emitted restored banner, and unrelated canary remain exact across restart"
]
},
{
"file": "src/renderer/src/lib/resume-sleeping-agent-session.test.ts",
"assertions": [
"preserved panes claim their provider session and only stale duplicates are cleared",
"one launch per provider session: skipped duplicates are cleared instead of relaunched",
"active stable-pane records owned by preserved or visible panes are not resumed again",
"hibernated stable panes with cleared live PTY bindings are skipped"
]
},
{
"file": "src/main/ipc/pty-pane-materialization-race.test.ts",
"assertions": [
"a completed runtime-owned stable pane is adopted with its original PTY and incarnation while renderer resume intent is stripped"
]
},
{
"file": "src/main/ipc/pty-persisted-incarnation-repair.test.ts",
"assertions": [
"an exact persisted owner is attach-only adopted when the runtime projection is missing"
]
},
{
"file": "src/main/ipc/pty-pane-reservation-settlement.test.ts",
"assertions": [
"runtime and persisted stable-pane owner conflicts fail closed before provider creation"
]
},
{
"file": "src/renderer/src/lib/pane-manager/pane-fit.test.ts",
"assertions": [
"withheld hidden-window animation frames exhaust the bounded fit retry and release its continuation"
]
},
{
"file": "src/renderer/src/components/terminal-pane/pty-connection-deferred-reattach-live-output.test.ts",
"assertions": [
"same-generation explicit reattach drains the authoritative snapshot before immediate live bytes and ACKs their delivery credit"
]
},
{
"file": "src/renderer/src/components/terminal-pane/remote-runtime-pty-transport-host-session-launch.test.ts",
"assertions": [
"paired-runtime stable-pane adoption reports reattach without fresh-spawn ownership",
"cancellation after a paired-runtime adoption cannot close the original owner"
]
},
{
"file": "tests/e2e/live-background-terminal-mount-authority.spec.ts",
"assertions": [
"first mount and renderer reload preserve exact agent and Setup handle, PTY, incarnation, tab, leaf, and PID identity",
"PID-specific keyboard input and output remain user-visible in both mounted panes",
"runtime inventory, renderer graph, persisted session, runtime epoch, and daemon PID converge without replacement or resume",
"the unrelated canary remains writable and receives no signal across target projection repair"
]
}
],
"evidenceRuns": [
{
"date": "2026-07-03",
"runner": "local",
"platform": "macos",
"command": "pnpm exec vitest run --config config/vitest.config.ts src/renderer/src/lib/resume-sleeping-agent-session.test.ts",
"result": "passed",
"durationSeconds": 1.9,
"summary": "1 test file(s) passed, 30 tests passed on main@1282f5c2d in a clean checkout."
}
],
"runtimeBudget": {
"p95Seconds": 180,
"scope": "focused renderer/main/provider contracts plus one isolated Electron mount-and-reload journey"
},
"flakeHistory": {
"status": "unknown",
"evidence": "The renderer gate has prior local evidence; the stable-pane Electron oracle is new and needs CI soak before blocking promotion."
},
"redGreenEvidence": {
"status": "partial",
"evidence": "Renderer tests encode provider-session dedupe across active, inactive, queued, and live claims. The cross-boundary Electron oracle is constructed for byte-identical latest-main, candidate, and candidate-revert runs; record those three terminal results before promoting this gate."
},
"performanceBudget": {
"required": true,
"evidence": "Renderer state tests assert bounded provider-session indexing. Stable-pane adoption is a targeted owner lookup and attach-only call; focused contracts require no provider listing scan, fresh spawn callback, or repeated resume probe. The Electron oracle checks exact launch counts but is not a throughput benchmark."
},
"promotionCriteria": [
"Run in soak for at least 100 consecutive passes or 14 days across required CI platforms.",
"Add bounded-work assertions for delayed hook/status ownership scans if those paths grow.",
"Attach red/green evidence that display/replay evidence alone cannot claim ownership.",
"Record byte-identical latest-main, candidate, and candidate-revert Electron results."
],
"knownGaps": [
"Providers listed on this gate are affected identity surfaces; live integration is limited to local macOS while daemon and remote-runtime adoption also have focused contracts.",
"The Electron oracle seeds the production hook-store contract instead of running an authenticated Codex hook end to end.",
"The live Electron topology is local macOS only; folder workspaces, SSH, WSL, paired headed/headless servers, Linux, and Windows are not exercised by that journey.",
"The oracle covers first activation and one renderer reload, not repeated soak activation or an installed-app update."
],
"demotionRule": "Demote or quarantine if failures are non-actionable or if a duplicate resume escape occurs outside the modeled matrix."
},
{
"id": "agent-session.remote-host-authority",
"title": "Remote agent sessions have one host-authoritative PTY and durable surface lifecycle",
"maturity": "experimental",
"protection": "partial",
"owner": "agent-session",
"layer": "runtime-controller-provider-renderer-contract",
"surfaces": [
"remote agent launch and explicit resume",
"multi-client remote runtime sessions",
"paired viewer-local structured agent focus",
"headed desktop remote-server pairing",
"headless remote-server parity",
"daemon and relay reconnect",
"remote completion classification across disconnect and reconnect",
"terminal exit retirement and restart restore",
"mixed-version fallback"
],
"platforms": ["macos", "linux", "windows"],
"providers": ["local", "daemon", "ssh", "wsl", "remote-runtime"],
"coveredPlatforms": ["macos"],
"coveredProviders": ["local", "daemon", "ssh", "wsl", "remote-runtime"],
"coverageNotes": "Deterministic macOS tests cover controller claims, daemon and SSH/relay operation replay, mixed-version selection, runtime ownership, exact provisional handoff, durable terminal retirement, two independent viewer mirrors, guarded adoption of legacy live PTYs, and completion classification when either the outer remote transport or authoritative host/provider process inspection becomes unreachable. The adoption harness models v1.4.150 agent/setup/shell tabs, current-generation restart and reconnect, exact handle/incarnation/worktree/host checks, topology CAS, competing clients, split-pane/group restoration, WSL ownership, and SSH owner rejection. The secondary parity repro runs independent clients against one headless remote Orca runtime over encrypted pairing and a real daemon-backed PTY, with tokened fixture-process identity separated from unrelated Codex app-server startup probes. The automated primary topology runs an isolated headed macOS Orca desktop server plus a separate paired web client and proves viewer-local fresh/resume focus, exact legacy placement, writable PTYs, unrelated-terminal survival, and host/client cleanup. SSH coverage is provider/relay contract and fault-injection coverage only; it does not substitute for paired-server coverage. Live Windows, Linux, WSL, SSH, and physical paired-Linux hosts remain gaps.",
"motivatingLinks": [
"https://github.com/stablyai/orca/issues/8878",
"https://github.com/stablyai/orca/issues/9151",
"https://github.com/stablyai/orca/issues/9352",
"https://github.com/stablyai/orca/pull/9687",
"https://github.com/stablyai/orca/issues/10192",
"https://github.com/stablyai/orca/pull/10193"
],
"invariant": "For every claim-capable execution route, one provider-session identity has at most one live PTY owner and one canonical host surface across concurrent clients, retries, reconnects, and stale publications. For paired structured fresh and resume requests, the authenticated owning runtime creates in background without a renderer window; activate=true focuses the exact requested leaf only on the requesting viewer, while activate=false changes no viewer focus. A live orphan may be adopted only when the controller proves its exact handle and incarnation, its worktree and host owner match, no competing visual owner exists, and a host topology CAS wins. A viewer may classify completion only from successful host/provider inspection or explicit lifecycle evidence; transport, handle, or provider unavailability remains unknown and breaks any consecutive-idle proof. A physical exit retires that exact incarnation durably so stale client state and host restart cannot recreate it. Mixed-version routes select the unchanged legacy request before any authority side effect or execution-owner-local filesystem access.",
"oracle": "Race independent clients and repeated operation IDs, then assert one physical spawn and one canonical PTY/surface; inject exit-before-reply, provider disconnect, conflicting claim scope, old daemon/relay capabilities, reused handles, stale incarnations, owner mismatch, and topology revision conflict; assert safe adoption or explicit failure without a second spawn or wrong-process attachment. Run fresh/resume with activate true/false against an isolated headed desktop host and a separate paired client, then against isolated headless serve: assert host presentation stays background, only the requesting viewer focuses the exact leaf, inactive calls preserve client/DOM focus, a same-version publication replay cannot lose focus intent, and sibling-first split publication cannot consume exact-leaf intent. Restore legacy split panes and groups beside a newer host-owned tab, preserving exact predecessor/new/successor order, output, input, resize, titles, tab/leaf identity, active group, and multi-client convergence. For completion, drive a known running agent through outer transport loss, authoritative provider rejection, reconnect, explicit stop, real exit status, and successful hook completion; assert unavailable evidence never dispatches completion and two fresh authoritative idle samples are required after the gap. After exact exit, assert terminal and tab listings omit the surface, a stale publication cannot restore it, restart cannot resurrect it, exact tokened fixture PIDs are dead, and unrelated tabs/processes survive until scoped cleanup.",
"commands": [
"pnpm exec vitest run --config config/vitest.config.ts src/main/runtime/rpc/methods/agent-session.test.ts src/renderer/src/runtime/web-runtime-session.test.ts src/renderer/src/runtime/web-session-tabs-sync.test.ts src/renderer/src/runtime/web-session-intent-owner.test.ts src/renderer/src/runtime/remote-server-parity.test.ts",
"pnpm exec vitest run --config config/vitest.config.ts src/shared/claimed-agent-pty-owner.test.ts src/main/daemon/daemon-pty-adapter.test.ts src/main/providers/ssh-pty-provider-agent-session-create-operation.test.ts src/main/runtime/orca-runtime-agent-session-operation.test.ts src/main/runtime/remote-agent-session-host-authority.integration.test.ts src/main/runtime/orca-runtime-terminal-retirement.test.ts src/renderer/src/components/terminal-pane/remote-runtime-pty-transport-host-session-launch.test.ts src/renderer/src/components/terminal-pane/remote-runtime-pty-transport-create-handoff.test.ts src/renderer/src/runtime/remote-runtime-session-tabs-inflight.test.ts src/renderer/src/runtime/web-runtime-session.test.ts src/renderer/src/runtime/web-session-tabs-sync.test.ts",
"pnpm exec vitest run --config config/vitest.config.ts tests/e2e/remote-terminal-tab-retirement.unit.test.ts",
"pnpm test:repro:remote-agent-session",
"pnpm run build:cli && pnpm run build:electron-vite && node config/scripts/remote-agent-session-authority-repro.mjs",
"node --check config/scripts/remote-agent-session-process-cleanup.mjs && node config/scripts/remote-agent-session-authority-repro.mjs",
"pnpm exec electron-vite build --mode e2e",
"VITE_EXPOSE_STORE=true pnpm run build:web",
"ORCA_E2E_WEB_CLIENT=1 SKIP_BUILD=1 pnpm exec playwright test tests/e2e/remote-agent-session-focus-authority.spec.ts --config tests/playwright.config.ts --project electron-headful --workers=1",
"Manual headed paired-server journey: isolated Orca desktop host + separate paired web client + real Codex process + 20-second WebSocket fault + reconnect + explicit stop",
"pnpm exec vitest run --config config/vitest.config.ts src/main/runtime/orca-runtime.test.ts src/main/runtime/terminal-orphan-owner.test.ts src/main/runtime/terminal-orphan-topology.test.ts src/renderer/src/runtime/web-session-terminal-orphan-recovery.test.ts src/renderer/src/runtime/web-session-terminal-orphan-mixed-version.test.ts src/renderer/src/runtime/web-session-tabs-sync.test.ts --maxWorkers=1",
"pnpm exec vitest run --config config/vitest.config.ts src/main/providers/pty-process-inspection.test.ts src/main/daemon/terminal-host.test.ts src/main/daemon/daemon-pty-router.test.ts src/main/daemon/degraded-daemon-pty-provider.test.ts src/relay/pty-handler-spawn-admission.test.ts src/main/daemon/daemon-pty-adapter.test.ts src/main/runtime/orca-runtime.test.ts tests/e2e/remote-agent-completion-authority.unit.test.ts src/renderer/src/runtime/runtime-terminal-inspection.test.ts src/renderer/src/components/terminal-pane/agent-completion-coordinator-process-cadence.test.ts src/renderer/src/components/terminal-pane/agent-completion-coordinator-pending-title-inspection.test.ts",
"pnpm exec vitest run --config config/vitest.config.ts tests/e2e/remote-agent-completion-authority.unit.test.ts src/main/providers/pty-process-inspection.test.ts src/main/daemon/terminal-host.test.ts src/main/daemon/daemon-pty-router.test.ts src/main/daemon/degraded-daemon-pty-provider.test.ts src/relay/pty-handler-spawn-admission.test.ts src/main/daemon/daemon-pty-adapter.test.ts src/renderer/src/runtime/runtime-terminal-inspection.test.ts src/renderer/src/components/terminal-pane/agent-completion-coordinator-process-cadence.test.ts src/renderer/src/components/terminal-pane/agent-completion-coordinator-pending-title-inspection.test.ts src/renderer/src/components/terminal-pane/pty-connection-task-complete-dispatch.test.ts src/renderer/src/lib/codex-session-restart.test.ts"
],
"testFiles": [
"src/main/providers/pty-process-inspection.test.ts",
"src/main/daemon/terminal-host.test.ts",
"src/main/daemon/daemon-pty-router.test.ts",
"src/main/daemon/degraded-daemon-pty-provider.test.ts",
"src/relay/pty-handler-spawn-admission.test.ts",
"src/main/runtime/orca-runtime.test.ts",
"tests/e2e/remote-agent-completion-authority.unit.test.ts",
"src/renderer/src/runtime/runtime-terminal-inspection.test.ts",
"src/renderer/src/components/terminal-pane/agent-completion-coordinator-process-cadence.test.ts",
"src/renderer/src/components/terminal-pane/agent-completion-coordinator-pending-title-inspection.test.ts",
"src/renderer/src/components/terminal-pane/pty-connection-task-complete-dispatch.test.ts",
"src/renderer/src/lib/codex-session-restart.test.ts",
"src/shared/claimed-agent-pty-owner.test.ts",
"src/main/daemon/daemon-pty-adapter.test.ts",
"src/main/providers/ssh-pty-provider-agent-session-create-operation.test.ts",
"src/main/runtime/orca-runtime-agent-session-operation.test.ts",
"src/main/runtime/remote-agent-session-host-authority.integration.test.ts",
"src/main/runtime/rpc/methods/agent-session.test.ts",
"src/main/runtime/orca-runtime-terminal-retirement.test.ts",
"src/renderer/src/components/terminal-pane/remote-runtime-pty-transport-host-session-launch.test.ts",
"src/renderer/src/components/terminal-pane/remote-runtime-pty-transport-create-handoff.test.ts",
"src/renderer/src/runtime/remote-runtime-session-tabs-inflight.test.ts",
"src/renderer/src/runtime/web-runtime-session.test.ts",
"src/renderer/src/runtime/web-session-tabs-sync.test.ts",
"src/renderer/src/runtime/web-session-intent-owner.test.ts",
"src/renderer/src/runtime/remote-server-parity.test.ts",
"tests/e2e/remote-agent-session-focus-authority.spec.ts",
"config/scripts/remote-agent-session-authority-repro.mjs",
"config/scripts/remote-agent-session-process-cleanup.mjs",
"tests/e2e/remote-terminal-tab-retirement.unit.test.ts",
"src/main/runtime/orca-runtime.test.ts",
"src/main/runtime/terminal-orphan-owner.test.ts",
"src/main/runtime/terminal-orphan-topology.test.ts",
"src/renderer/src/runtime/web-session-terminal-orphan-recovery.test.ts",
"src/renderer/src/runtime/web-session-terminal-orphan-mixed-version.test.ts"
],
"assertionRefs": [
{
"file": "src/main/runtime/orca-runtime.test.ts",
"assertions": [
"completion-sensitive process inspection preserves authoritative host/provider failures"
]
},
{
"file": "src/main/providers/pty-process-inspection.test.ts",
"assertions": [
"dedicated provider inspection preserves failures and rejects missing PTYs instead of returning idle evidence"
]
},
{
"file": "src/main/daemon/daemon-pty-router.test.ts",
"assertions": [
"completion inspection rejects an unmapped session instead of borrowing the current daemon"
]
},
{
"file": "src/main/daemon/degraded-daemon-pty-provider.test.ts",
"assertions": [
"completion inspection rejects an unmapped session instead of borrowing the local fallback"
]
},
{
"file": "src/relay/pty-handler-spawn-admission.test.ts",
"assertions": ["strict relay inspection rejects a missing PTY"]
},
{
"file": "tests/e2e/remote-agent-completion-authority.unit.test.ts",
"assertions": [
"transport loss remains unknown through reconnect and cannot dispatch completion",
"returned unavailability or a thrown transport failure interrupts consecutive-idle proof and requires two fresh authoritative idle samples",
"explicit stop, real exit status, and genuine successful completion remain distinct"
]
},
{
"file": "src/renderer/src/runtime/runtime-terminal-inspection.test.ts",
"assertions": [
"direct SSH terminals use strict main-process inspection rather than lax split IPC evidence"
]
},
{
"file": "src/renderer/src/components/terminal-pane/pty-connection-task-complete-dispatch.test.ts",
"assertions": [
"completion polling uses the atomic process-inspection boundary without regressing established lifecycle behavior"
]
},
{
"file": "src/renderer/src/lib/codex-session-restart.test.ts",
"assertions": [
"one unreachable pane cannot suppress restart notices for another authoritatively confirmed Codex pane"
]
},
{
"file": "src/shared/claimed-agent-pty-owner.test.ts",
"assertions": [
"concurrent exact claims spawn once and later callers adopt the canonical owner",
"same identity in another worktree conflicts and cannot be found as the current scope's owner",
"generation-guarded exit and authoritative reconciliation cannot retire a replacement owner"
]
},
{
"file": "src/main/runtime/orca-runtime-agent-session-operation.test.ts",
"assertions": [
"old execution owners select exact legacy fallback before trust, spawn, or ledger mutation",
"nested SSH Pi resume selects legacy before reading the remote-only transcript path locally",
"fresh operation retries replay one result and retain a fence after an ambiguous physical commit"
]
},
{
"file": "src/main/runtime/remote-agent-session-host-authority.integration.test.ts",
"assertions": [
"independent runtime clients converge on one canonical live agent-session owner",
"retries and concurrent requests cannot create a second physical PTY"
]
},
{
"file": "src/main/runtime/orca-runtime-terminal-retirement.test.ts",
"assertions": [
"an exact PTY exit retires host membership and stale topology cannot recreate the surface",
"incarnation fencing prevents an old delayed exit from retiring a replacement PTY"
]
},
{
"file": "src/renderer/src/runtime/remote-runtime-session-tabs-inflight.test.ts",
"assertions": [
"a causally post-operation inventory waits out an older request and concurrent confirmations share the fresh request"
]
},
{
"file": "src/main/runtime/rpc/methods/agent-session.test.ts",
"assertions": [
"authenticated runtime and mobile structured requests normalize focused presentation to background before reaching the owning runtime",
"trusted in-process structured callers retain focused presentation"
]
},
{
"file": "src/renderer/src/runtime/web-runtime-session.test.ts",
"assertions": [
"fresh/resume activate true/false always request background host presentation and record focus intent only for active calls",
"a publication that beats the RPC response is replayed once without broad polling"
]
},
{
"file": "src/renderer/src/runtime/web-session-tabs-sync.test.ts",
"assertions": [
"only an exact structured-create handoff retires its provisional tab",
"an absent host tab retires its exact provisional handoff only after a causally post-create snapshot while unrelated tabs remain",
"adopted split sessions focus the exact requested leaf, preserve expanded-leaf state, and retain intent when a sibling publishes first"
]
},
{
"file": "tests/e2e/remote-agent-session-focus-authority.spec.ts",
"assertions": [
"headed desktop host remains unfocused while the paired requester alone follows active fresh/resume sessions and inactive rows preserve exact client/DOM focus",
"legacy afterTabId placement is exact in authoritative, mirrored, and rendered order with a pre-existing successor",
"host PTY inventory plus writable agent/unrelated shell markers prove liveness, unrelated survival, and exact terminal/tab/PTY/process cleanup"
]
},
{
"file": "config/scripts/remote-agent-session-authority-repro.mjs",
"assertions": [
"headless focused fresh/resume requests create background host surfaces without a renderer window",
"dropped committed responses replay the same operation identity without another tokened agent spawn",
"exact terminal/tab/process identity survives retries and stale-write rejection, then retires without restart resurrection while unrelated shells survive until scoped cleanup"
]
},
{
"file": "config/scripts/remote-agent-session-process-cleanup.mjs",
"assertions": [
"isolated daemon roots and captured descendants are verified dead before profile PID records are removed"
]
},
{
"file": "tests/e2e/remote-terminal-tab-retirement.unit.test.ts",
"assertions": [
"a durable host exit removes the terminal from two independent viewer mirrors instead of publishing a handle-less phantom",
"one exact exit produces one same-epoch higher-version host publication and one durable persistence flush",
"same-epoch stale publications cannot resurrect the retired surface after reconnect"
]
},
{
"file": "src/main/runtime/orca-runtime.test.ts",
"assertions": [
"v1.4.150-shaped agent, setup, and shell PTYs adopt as one CAS transaction while stale incarnation and competing clients fail safely",
"current-generation restart and disconnect/reconnect preserve output, input, resize, title, tab, leaf, handle, and incarnation identity",
"split-pane and multi-group legacy topology merges beside a newer host-owned terminal without replacing it",
"equivalent Windows and separator-normalized persisted worktree keys canonicalize without duplicate terminal topology",
"connection mismatch, reused handles, SSH ownership mismatch, and stale topology revisions cannot claim a live PTY while WSL ownership succeeds"
]
},
{
"file": "src/renderer/src/runtime/web-session-terminal-orphan-recovery.test.ts",
"assertions": [
"absence stays pending until an exact live orphan adoption settles",
"client pane and group topology is pruned to exact orphan claims and translated to host tab identities",
"a missing split leaf remains recoverable when another leaf in the same tab is already host-owned"
]
},
{
"file": "src/renderer/src/runtime/web-session-terminal-orphan-mixed-version.test.ts",
"assertions": [
"mixed-version inventory without incarnation evidence remains visible but cannot adopt",
"a truncated legacy unfiltered inventory cannot hide a candidate whose liveness is unresolved"
]
}
],
"evidenceRuns": [
{
"date": "2026-07-23",
"runner": "local",
"platform": "macos",
"command": "pnpm exec vitest run --config config/vitest.config.ts src/main/runtime/rpc/methods/agent-session.test.ts src/renderer/src/runtime/web-runtime-session.test.ts src/renderer/src/runtime/web-session-tabs-sync.test.ts src/renderer/src/runtime/web-session-intent-owner.test.ts src/renderer/src/runtime/remote-server-parity.test.ts",
"result": "passed",
"durationSeconds": 2.28,
"summary": "Five focused files and 140 tests passed on the structural candidate, covering authenticated host presentation normalization, trusted local preservation, fresh/resume viewer intent, same-version response/publication replay, exact split-leaf focus, sibling-first publication, and paired-runtime parity."
},
{
"date": "2026-07-23",
"runner": "local",
"platform": "macos",
"command": "pnpm test:repro:remote-agent-session",
"result": "passed",
"durationSeconds": 53.6,
"summary": "The build-backed isolated headless serve harness passed over encrypted pairing. Tokened fresh/resume fixture processes were distinguished from unrelated Codex app-server startup probes; response-loss replay, exact spawn identity/count, writable PTYs, unrelated survival, stale rejection, exact PID death, empty restart inventory, and no session resurrection all passed."
},
{
"date": "2026-07-23",
"runner": "local",
"platform": "macos",
"command": "ORCA_E2E_WEB_CLIENT=1 SKIP_BUILD=1 pnpm exec playwright test tests/e2e/remote-agent-session-focus-authority.spec.ts --config tests/playwright.config.ts --project electron-headful --workers=1",
"result": "passed",
"durationSeconds": 5.8,
"summary": "After fresh Electron E2E and exposed-store web builds, the isolated headed desktop host plus separate paired web client passed fresh/resume activate true/false, exact non-tail legacy placement in host/mirror/DOM, host focus isolation, requester-only exact focus, writable agent and unrelated shell markers, unrelated survival, and terminal/tab/PTY/process cleanup."
},
{
"date": "2026-07-22",
"runner": "manual",
"platform": "macos",
"command": "Manual headed paired-server journey: isolated Orca desktop host + separate paired web client + real Codex process + 20-second WebSocket fault + reconnect + explicit stop",
"result": "passed",
"durationSeconds": 549,
"summary": "The primary user topology used an isolated headed Orca desktop as the owning server and a separate paired Edge client. Host inspection reported Codex alive before, during, and after a page-scoped WebSocket fault; the client showed no completion toast, reconnected to the same live Codex TUI, and explicit stop restored the shell prompt with no child process."
},
{
"date": "2026-07-23",
"runner": "local",
"platform": "macos",
"command": "pnpm exec vitest run --config config/vitest.config.ts tests/e2e/remote-agent-completion-authority.unit.test.ts src/main/providers/pty-process-inspection.test.ts src/main/daemon/terminal-host.test.ts src/main/daemon/daemon-pty-router.test.ts src/main/daemon/degraded-daemon-pty-provider.test.ts src/relay/pty-handler-spawn-admission.test.ts src/main/daemon/daemon-pty-adapter.test.ts src/renderer/src/runtime/runtime-terminal-inspection.test.ts src/renderer/src/components/terminal-pane/agent-completion-coordinator-process-cadence.test.ts src/renderer/src/components/terminal-pane/agent-completion-coordinator-pending-title-inspection.test.ts src/renderer/src/components/terminal-pane/pty-connection-task-complete-dispatch.test.ts src/renderer/src/lib/codex-session-restart.test.ts",
"result": "passed",
"durationSeconds": 11.96,
"summary": "Eleven focused files and 870 tests passed on the current-main candidate. The cross-boundary harness fails with the implementation reverted by dispatching process-exit from unavailable remote evidence. Direct SSH uses strict main-process inspection, daemon and relay inspection reject missing or unmapped sessions, the terminal lifecycle suite uses the atomic inspection boundary, and one stale pane cannot suppress restart notices for a separately confirmed Codex pane."
},
{
"date": "2026-07-21",
"runner": "local",
"platform": "macos",
"command": "pnpm exec vitest run --config config/vitest.config.ts src/shared/claimed-agent-pty-owner.test.ts src/main/daemon/daemon-pty-adapter.test.ts src/main/providers/ssh-pty-provider-agent-session-create-operation.test.ts src/main/runtime/orca-runtime-agent-session-operation.test.ts src/main/runtime/remote-agent-session-host-authority.integration.test.ts src/main/runtime/orca-runtime-terminal-retirement.test.ts src/renderer/src/components/terminal-pane/remote-runtime-pty-transport-host-session-launch.test.ts src/renderer/src/components/terminal-pane/remote-runtime-pty-transport-create-handoff.test.ts src/renderer/src/runtime/remote-runtime-session-tabs-inflight.test.ts src/renderer/src/runtime/web-runtime-session.test.ts src/renderer/src/runtime/web-session-tabs-sync.test.ts",
"result": "passed",
"durationSeconds": 7.67,
"summary": "Ten focused files and 325 tests passed after the final review fixes, covering claim scope, mixed-version Pi/SSH fallback ordering, operation replay, terminal retirement, causal inventory fencing, exact concurrent handoff confirmation, daemon-generation integration, transport behavior, and remote host integration."
},
{
"date": "2026-07-22",
"runner": "local",
"platform": "macos",
"command": "pnpm test:repro:remote-agent-session",
"result": "passed",
"durationSeconds": 48.63,
"summary": "The secondary build-backed headless parity harness passed post-rebase on main@72a2d7bc7 over encrypted WebSocket pairing with independent clients, proving one spawn, retry adoption, durable exit retirement, stale-publication rejection, and no restart resurrection."
},
{
"date": "2026-07-22",
"runner": "local",
"platform": "macos",
"command": "pnpm exec vitest run --config config/vitest.config.ts tests/e2e/remote-terminal-tab-retirement.unit.test.ts",
"result": "failed",
"durationSeconds": 3.11,
"summary": "The exact cross-boundary oracle failed on pre-#9687 commit 2a32c5c9a because the retired publication still contained the pinned persisted terminal surface."
},
{
"date": "2026-07-22",
"runner": "local",
"platform": "macos",
"command": "pnpm exec vitest run --config config/vitest.config.ts tests/e2e/remote-terminal-tab-retirement.unit.test.ts",
"result": "failed",
"durationSeconds": 3.48,
"summary": "The exact strengthened oracle failed on PR #9053 head d3a1d3047 because its stale-headless pruning retained the pinned persisted terminal surface."
},
{
"date": "2026-07-22",
"runner": "local",
"platform": "macos",
"command": "pnpm exec vitest run --config config/vitest.config.ts tests/e2e/remote-terminal-tab-retirement.unit.test.ts",
"result": "passed",
"durationSeconds": 3.18,
"summary": "The same strengthened oracle passed on main@4fce2de49."
}
],
"runtimeBudget": {
"p95Seconds": 30,
"scope": "focused ownership, compatibility, lifecycle, and renderer handoff tests; build-backed repro tracked separately"
},
"flakeHistory": {
"status": "unknown",
"evidence": "New experimental gate with deterministic local coverage and no soak history yet."
},
"redGreenEvidence": {
"status": "partial",
"evidence": "Issue #10192 has byte-identical renderer-oracle evidence: origin/main@ee87bb38d (and earlier ef985ed80 and 94d3db4a2) fails activated fresh and resume rows by requesting focused host presentation, the PR client change passes all four rows, and disabling it turns the activated rows red again. The original PR still fails an old-client focused request against a new headless host; host-boundary normalization turns that mixed-version control green while trusted local callers remain focused. Issue #9151 has local red/green evidence for completion authority. The exact retirement oracle is red on pre-#9687 commit 2a32c5c9a and PR #9053 head d3a1d3047, and green on main@4fce2de49. Saved CI artifacts are still needed."
},
"performanceBudget": {
"required": true,
"evidence": "Agent-session reconciliation runs only at explicit claim admission, dedupes concurrent provider listing, and adds no polling or renderer output work. Viewer focus reconciliation reuses the existing one post-create list and bounded intent map; same-version replay permits one already-received snapshot, and exact-leaf matching adds one conditional scan over the bounded tab snapshot. Completion inspection reuses the coordinator's per-pane in-flight guard, global concurrency/rate queue, and existing error backoff; the strict daemon path reduces two foreground RPCs to one. Create-operation ledgers are capped globally and per client, expire after 24 hours, and reject rather than evict live replay fences. Capability caches are bounded or connection-scoped, and exact handoffs are consumed by the next authoritative snapshot."
},
"promotionCriteria": [
"Run the focused gate and remote-server repro for at least 100 consecutive passes or 14 days across required CI platforms.",
"Attach saved red/green evidence for duplicate remote resume and exit-before-snapshot retirement.",
"Run the automated headed Orca desktop-server and paired-client journey in required CI lanes; add a physical host when OS, ConPTY, update, sleep, firewall, or window lifecycle is causal.",
"Add live SSH/WSL provider evidence before claiming full provider coverage; Docker SSH proves only the SSH provider/relay path."
],
"knownGaps": [
"The primary headed macOS desktop-server journey is automated locally but not yet run in CI; Windows and Linux window, ConPTY, update, sleep/wake, and firewall behavior remain uncollected.",
"Mixed-version pairings remain conservative only when the completion-aware client and strict-inspection host changes are both present; older peers retain their legacy classification behavior.",
"The secondary headless parity harness runs on macOS with a local daemon-backed execution owner and independent short-lived encrypted RPC clients; two persistent viewer-store mirrors and reconnect ordering are joined deterministically in the cross-boundary unit test rather than mounted live.",
"SSH and relay failure ordering is deterministic provider-contract coverage, not a live SSH-host journey or paired-Orca-server proof; WSL has no provider-specific run, and Linux and Windows runs remain uncollected.",
"Fresh-launch operation replay is memory-backed and intentionally does not survive runtime restart; a durable operation journal is a documented future extension.",
"Automatic sleep checkpoints, verified nested-SSH execution namespaces, and multi-process profile coordination remain outside v1."
],
"demotionRule": "Keep experimental or demote if the focused gate flakes without a product or harness bug, if a retry can physically spawn twice, if a stale exit/publication can replace or resurrect a terminal, or if mixed-version fallback occurs after an authority side effect."
},
{
"id": "runtime-routing.active-server-preference",
"title": "Active Server changes only through its explicit Advanced control",
"maturity": "experimental",
"protection": "partial",
"owner": "runtime-routing",
"layer": "main-preload-renderer-persistence-contract",
"surfaces": [
"Advanced Active Server setting",
"saved server Connect and Disconnect",
"remote workspace navigation",
"Add Project host selection, scan, import, and catalog refresh",
"terminal reveal and create",
"browser and mobile handoff",
"app restart"
],
"platforms": ["macos", "linux", "windows", "mobile"],
"providers": ["local", "remote-runtime", "ssh", "wsl"],
"coveredPlatforms": ["macos"],
"coveredProviders": ["local", "remote-runtime", "ssh", "wsl"],
"coverageNotes": "Platform-neutral deterministic tests separate the durable Active Server preference from per-client connection, selected-workspace, browser-session, Add Project, and execution-host routing. The composed regression models Local desktop -> connect/navigate Windows 2 -> reveal a local terminal -> restart. Multi-client browser host overrides, multi-server profile caches, generic settings IPC rejection, local and remote workspace ownership, Add Project eligibility/owner capture/stale-result fencing, host-qualified group/folder/worktree identity, and restart reset of transient routing are covered. A visible macOS Orca desktop server plus separate paired Electron and web clients prove selected-runtime Add Project operations and disabled creation when the only listed host is blocked or unavailable; headless-server parity also passed. Live Linux, Windows, WSL, and SSH Add Project journeys remain uncollected.",
"motivatingLinks": [
"https://github.com/stablyai/orca/pull/9687",
"https://linear.app/stably/issue/STA-4024/p1-paired-web-add-project-enables-unavailable-host-fallback-after-pr"
],
"invariant": "Only an explicit user change in Settings > Remote Orca Servers > Advanced > Active Server may mutate activeRuntimeEnvironmentId. Connecting, pairing, disconnecting, selecting or revealing a workspace or terminal, browser/mobile handoff, remote navigation, and reconnect must use transient or target-owner routing and must never rewrite the durable preference. Every Add Project selected host must satisfy canSelectAddRepoHost; paired web has no local filesystem fallback, so no valid host means Browse, Clone, and Create remain disabled. Every operation stays on the host selected when it began, even if preference or catalog state changes. Generic settings mutation cannot bypass the dedicated preference IPC.",
"oracle": "Start with Active Server=Local desktop, connect and navigate Windows 2, then reveal a local terminal and assert it succeeds while the persisted preference remains local before and after restart. Repeat transient routing and selected-runtime Add Project operations with exact-ID host decoys and completion reordering. Separately pair the real web client to an isolated headed host, then make its sole still-listed runtime compatibility-blocked and unavailable. Require a null authoritative selection, a disabled host option, and disabled Browse, Clone, and Create actions with no local fallback. Repeat against headless serve. Run the byte-identical selector/action contract on latest main, candidate, and candidate with the eligibility seam disabled.",
"commands": [
"pnpm exec vitest run --config config/vitest.config.ts src/main/ipc/settings.test.ts src/main/ipc/runtime-environments-pairing.test.ts src/renderer/src/store/slices/settings.test.ts src/renderer/src/store/slices/browser.test.ts src/renderer/src/components/settings/browser-session-host-selection.test.ts src/renderer/src/components/settings/RuntimeEnvironmentsPane.test.ts src/renderer/src/components/status-bar/SshStatusSegment.test.ts src/renderer/src/components/sidebar/use-add-repo-host-selection.test.ts src/renderer/src/hooks/useIpcEvents-terminal-create-surfacing.test.ts src/renderer/src/web/web-preload-api-runtime-environment.test.ts --maxWorkers=1",
"pnpm exec vitest run --config config/vitest.config.ts src/renderer/src/components/sidebar/AddProjectFromFolderDialog.test.tsx src/renderer/src/components/sidebar/NonGitFolderDialog.test.tsx src/renderer/src/components/sidebar/AddRepoDialog.default-checkout.test.ts src/renderer/src/components/sidebar/AddRepoSteps.default-checkout.test.ts src/renderer/src/components/sidebar/project-added-default-checkout.test.ts src/renderer/src/components/sidebar/useAddRepoLocalFolderFlow.test.ts src/renderer/src/components/sidebar/useAddRepoNestedImportFlow.test.ts src/renderer/src/components/sidebar/useAddRepoServerPathFlow.test.ts src/renderer/src/components/sidebar/useAddRepoCloneFlow.test.ts src/renderer/src/components/sidebar/useCreateRepo.default-checkout.test.ts src/renderer/src/components/sidebar/worktree-list/listing/host-filtering.test.ts src/renderer/src/lib/resolved-worktree-execution-host.test.ts src/renderer/src/lib/worktree-runtime-owner.test.ts src/renderer/src/store/selectors.test.ts src/renderer/src/store/slices/repos-all-hosts-folder-workspaces.test.ts src/renderer/src/store/slices/repos-project-groups.test.ts src/renderer/src/store/slices/repos-selected-owner-routing.test.ts src/renderer/src/store/slices/selected-host-active-workspace-identity.test.ts src/renderer/src/store/slices/worktrees-fetch-owner-routing.test.ts --maxWorkers=1",
"pnpm exec vitest run --config config/vitest.config.ts src/renderer/src/components/sidebar/use-add-repo-host-selection.test.ts src/renderer/src/components/sidebar/add-repo-browse-authority.test.ts src/renderer/src/components/sidebar/AddRepoDialogStepContent.test.tsx src/renderer/src/components/sidebar/AddRepoStartSteps.test.tsx src/renderer/src/components/sidebar/useAddRepoServerPathFlow.test.ts src/renderer/src/runtime/runtime-server-directory-browser.test.ts src/renderer/src/store/slices/repos-paired-runtime-add.test.ts --maxWorkers=1",
"pnpm exec vitest run --config config/vitest.config.ts src/renderer/src/components/sidebar/AddProjectFromFolderDialog.test.tsx src/renderer/src/components/sidebar/NonGitFolderDialog.test.tsx src/renderer/src/components/sidebar/AddRepoDialog.default-checkout.test.ts src/renderer/src/components/sidebar/AddRepoSteps.default-checkout.test.ts src/renderer/src/components/sidebar/project-added-default-checkout.test.ts src/renderer/src/components/sidebar/useAddRepoLocalFolderFlow.test.ts src/renderer/src/components/sidebar/useAddRepoNestedImportFlow.test.ts src/renderer/src/components/sidebar/useAddRepoServerPathFlow.test.ts src/renderer/src/components/sidebar/useAddRepoCloneFlow.test.ts src/renderer/src/components/sidebar/useCreateRepo.default-checkout.test.ts src/renderer/src/components/sidebar/worktree-list/listing/host-filtering.test.ts src/renderer/src/lib/resolved-worktree-execution-host.test.ts src/renderer/src/lib/worktree-runtime-owner.test.ts src/renderer/src/store/selectors.test.ts src/renderer/src/store/slices/repos-all-hosts-folder-workspaces.test.ts src/renderer/src/store/slices/repos-project-groups.test.ts src/renderer/src/store/slices/repos-selected-owner-routing.test.ts src/renderer/src/store/slices/selected-host-active-workspace-identity.test.ts src/renderer/src/store/slices/worktrees-fetch-owner-routing.test.ts src/renderer/src/runtime/web-runtime-session.test.ts --maxWorkers=1",
"pnpm run ensure:electron-runtime && npx playwright test tests/e2e/pr11346-selected-runtime-add.spec.ts --config tests/playwright.config.ts --project electron-headful --workers=1 --reporter=line",
"pnpm run ensure:electron-runtime && npx playwright test tests/e2e/pr11346-selected-runtime-add.spec.ts --config tests/playwright.config.ts --project electron-headless --workers=1 --reporter=line",
"SKIP_BUILD=1 ORCA_E2E_WEB_CLIENT=1 ORCA_E2E_FORCE_HEADFUL=1 pnpm exec playwright test tests/e2e/paired-web-add-project-unavailable-host.spec.ts --config tests/playwright.config.ts --project electron-headful --workers=1 --reporter=line",
"SKIP_BUILD=1 ORCA_E2E_WEB_CLIENT=1 ORCA_E2E_FORCE_HEADFUL=1 pnpm exec playwright test tests/e2e/paired-web-add-project-unavailable-host.spec.ts --config tests/playwright.config.ts --project electron-headless --workers=1 --reporter=line"
],
"testFiles": [
"src/main/ipc/settings.test.ts",
"src/main/ipc/runtime-environments-pairing.test.ts",
"src/renderer/src/store/slices/settings.test.ts",
"src/renderer/src/store/slices/browser.test.ts",
"src/renderer/src/components/settings/browser-session-host-selection.test.ts",
"src/renderer/src/components/settings/RuntimeEnvironmentsPane.test.ts",
"src/renderer/src/components/status-bar/SshStatusSegment.test.ts",
"src/renderer/src/components/sidebar/use-add-repo-host-selection.test.ts",
"src/renderer/src/components/sidebar/add-repo-browse-authority.test.ts",
"src/renderer/src/hooks/useIpcEvents-terminal-create-surfacing.test.ts",
"src/renderer/src/web/web-preload-api-runtime-environment.test.ts",
"src/renderer/src/components/sidebar/AddProjectFromFolderDialog.test.tsx",
"src/renderer/src/components/sidebar/NonGitFolderDialog.test.tsx",
"src/renderer/src/components/sidebar/AddRepoDialog.default-checkout.test.ts",
"src/renderer/src/components/sidebar/AddRepoDialogStepContent.test.tsx",
"src/renderer/src/components/sidebar/AddRepoStartSteps.test.tsx",
"src/renderer/src/components/sidebar/AddRepoSteps.default-checkout.test.ts",
"src/renderer/src/components/sidebar/project-added-default-checkout.test.ts",
"src/renderer/src/components/sidebar/useAddRepoLocalFolderFlow.test.ts",
"src/renderer/src/components/sidebar/useAddRepoNestedImportFlow.test.ts",
"src/renderer/src/components/sidebar/useAddRepoServerPathFlow.test.ts",
"src/renderer/src/components/sidebar/useAddRepoCloneFlow.test.ts",
"src/renderer/src/components/sidebar/useCreateRepo.default-checkout.test.ts",
"src/renderer/src/components/sidebar/worktree-list/listing/host-filtering.test.ts",
"src/renderer/src/lib/resolved-worktree-execution-host.test.ts",
"src/renderer/src/lib/worktree-runtime-owner.test.ts",
"src/renderer/src/store/selectors.test.ts",
"src/renderer/src/store/slices/repos-paired-runtime-add.test.ts",
"src/renderer/src/store/slices/repos-all-hosts-folder-workspaces.test.ts",
"src/renderer/src/store/slices/repos-project-groups.test.ts",
"src/renderer/src/store/slices/repos-selected-owner-routing.test.ts",
"src/renderer/src/store/slices/selected-host-active-workspace-identity.test.ts",
"src/renderer/src/store/slices/worktrees-fetch-owner-routing.test.ts",
"src/renderer/src/runtime/web-runtime-session.test.ts",
"tests/e2e/pr11346-selected-runtime-add.spec.ts",
"tests/e2e/paired-web-add-project-unavailable-host.spec.ts"
],
"assertionRefs": [
{
"file": "src/renderer/src/components/sidebar/use-add-repo-host-selection.test.ts",
"assertions": [
"paired web hides the viewing computer as an Add Project filesystem authority and selects only an eligible paired runtime",
"a sole blocked or errored runtime remains listed but produces no selected Add Project host"
]
},
{
"file": "src/renderer/src/components/sidebar/add-repo-browse-authority.test.ts",
"assertions": [
"paired runtime browsing opens the host browser without invoking native pickFolders while desktop local and SSH routes remain intact"
]
},
{
"file": "src/renderer/src/components/sidebar/AddRepoDialogStepContent.test.tsx",
"assertions": ["paired runtime browsing renders the in-app host filesystem browser"]
},
{
"file": "src/renderer/src/components/sidebar/AddRepoStartSteps.test.tsx",
"assertions": [
"host-scoped Add Project actions remain disabled until a paired runtime is selectable"
]
},
{
"file": "src/renderer/src/store/slices/repos-paired-runtime-add.test.ts",
"assertions": [
"an explicitly selected paired runtime submits repo.add to that runtime without native repo or folder-picker calls"
]
},
{
"file": "src/main/ipc/settings.test.ts",
"assertions": [
"generic settings IPC strips activeRuntimeEnvironmentId while the dedicated validated IPC persists it",
"invalid preference types and unknown server identities cannot mutate the durable preference"
]
},
{
"file": "src/renderer/src/hooks/useIpcEvents-terminal-create-surfacing.test.ts",
"assertions": [
"Local desktop remains the durable default after transient Windows 2 navigation and a focused local terminal reveal succeeds",
"local and remote terminal create route by target workspace ownership instead of the durable preference"
]
},
{
"file": "src/renderer/src/store/slices/browser.test.ts",
"assertions": [
"multiple clients select different transient browser hosts without changing Active Server",
"restart clears transient browser host override while retaining the durable local preference",
"late profile and import results update only their captured host and cannot overwrite a newer selection"
]
},
{
"file": "src/renderer/src/components/settings/browser-session-host-selection.test.ts",
"assertions": [
"a removed transient server override falls back to an available host instead of leaving browser settings on an invalid option"
]
},
{
"file": "src/renderer/src/components/settings/RuntimeEnvironmentsPane.test.ts",
"assertions": [
"connection status and the Advanced default-host selection are distinct concepts"
]
},
{
"file": "src/renderer/src/web/web-preload-api-runtime-environment.test.ts",
"assertions": [
"generic web settings writes cannot mutate Active Server",
"the dedicated web preference setter rejects unknown server identities without corrupting the saved choice"
]
},
{
"file": "src/renderer/src/components/sidebar/useAddRepoCloneFlow.test.ts",
"assertions": [
"stamps a Clone response with the captured runtime or SSH owner before store upsert and worktree refresh",
"preserves same-ID repository siblings that belong to different execution hosts"
]
},
{
"file": "src/renderer/src/components/sidebar/useCreateRepo.default-checkout.test.ts",
"assertions": [
"stamps Create responses with the captured runtime or SSH owner before store upsert and Git or folder worktree refresh"
]
},
{
"file": "src/renderer/src/store/slices/repos-selected-owner-routing.test.ts",
"assertions": [
"keeps same-ID local, direct-SSH, and runtime group/folder rows partitioned by execution host",
"drops reversed same-host and pre-reconnect group/folder responses without pruning newer catalogs",
"prunes deleted direct-SSH rows from the desktop-owned catalog without erasing same-ID runtime siblings",
"keeps explicit runtime groups and folders after a later ordinary local refresh",
"keeps a selected-runtime import refresh across an overlapping local refresh",
"pins selected SSH scans and cancellation to local IPC over an ambient runtime"
]
},
{
"file": "src/renderer/src/components/sidebar/project-added-default-checkout.test.ts",
"assertions": [
"filters loaded, detected, refreshed, and activated default checkouts by the captured execution host when repo IDs collide"
]
},
{
"file": "src/renderer/src/store/slices/worktrees-fetch-owner-routing.test.ts",
"assertions": [
"honors an explicit runtime owner before the repo catalog is hydrated",
"honors an explicit SSH owner before the repo catalog is hydrated",
"rejects a missing-owner SSH result after the repo catalog changes",
"rejects a missing-owner SSH result after the provider reconnects"
]
},
{
"file": "src/renderer/src/store/slices/selected-host-active-workspace-identity.test.ts",
"assertions": [
"selects the runtime worktree when exact repo/worktree IDs collide in local-first or reversed order",
"keeps exact-ID folder/group activation on the explicitly selected runtime without local fallback"
]
},
{
"file": "src/renderer/src/store/selectors.test.ts",
"assertions": [
"does not fall back to a same-ID local repo when the selected runtime row is unavailable"
]
},
{
"file": "src/renderer/src/runtime/web-runtime-session.test.ts",
"assertions": [
"terminal, browser, and staged-browser selection preserve the explicit runtime execution host when local and runtime worktree IDs collide"
]
},
{
"file": "tests/e2e/pr11346-selected-runtime-add.spec.ts",
"assertions": [
"routes Git Add, plain-folder Add, Clone, Create, and nested import to a selected non-default headed runtime while exact-ID local siblings remain visible and cannot capture final activation @headful",
"preserves same-ID runtime group/folder/worktree catalogs across reversed order, local refresh, switch, disconnect, and reconnect-overlap completion",
"keeps every expanded selected-runtime Add Project path in hidden-window desktop parity",
"creates the first paired runtime terminal while same-ID local/runtime worktrees remain visible without clearing the selected runtime owner"
]
},
{
"file": "tests/e2e/paired-web-add-project-unavailable-host.spec.ts",
"assertions": [
"a version-blocked sole host stays visible and non-selectable while Browse, Clone, and Create are disabled",
"an unavailable sole host has the same disabled action contract without a local fallback",
"the rendered contract passes against headed desktop and headless serve hosts"
]
}
],
"evidenceRuns": [
{
"date": "2026-08-12",
"runner": "local",
"platform": "macos",
"command": "SKIP_BUILD=1 ORCA_E2E_WEB_CLIENT=1 ORCA_E2E_FORCE_HEADFUL=1 pnpm exec playwright test tests/e2e/paired-web-add-project-unavailable-host.spec.ts --config tests/playwright.config.ts --project electron-headful --workers=1 --reporter=line",
"result": "passed",
"durationSeconds": 12.3,
"summary": "A real paired web client against a visible desktop host kept the sole blocked and unavailable runtime listed but non-selectable, with Browse, Clone, and Create disabled and no local host fallback."
},
{
"date": "2026-08-12",
"runner": "local",
"platform": "macos",
"command": "SKIP_BUILD=1 ORCA_E2E_WEB_CLIENT=1 ORCA_E2E_FORCE_HEADFUL=1 pnpm exec playwright test tests/e2e/paired-web-add-project-unavailable-host.spec.ts --config tests/playwright.config.ts --project electron-headless --workers=1 --reporter=line",
"result": "passed",
"durationSeconds": 5.8,
"summary": "The same present-but-blocked and present-but-unavailable Add Project action oracle passed against isolated headless serve."
},
{
"date": "2026-07-22",
"runner": "local",
"platform": "macos",
"command": "pnpm exec vitest run --config config/vitest.config.ts src/main/ipc/settings.test.ts src/main/ipc/runtime-environments-pairing.test.ts src/renderer/src/store/slices/settings.test.ts src/renderer/src/store/slices/browser.test.ts src/renderer/src/components/settings/browser-session-host-selection.test.ts src/renderer/src/components/settings/RuntimeEnvironmentsPane.test.ts src/renderer/src/components/status-bar/SshStatusSegment.test.ts src/renderer/src/components/sidebar/use-add-repo-host-selection.test.ts src/renderer/src/hooks/useIpcEvents-terminal-create-surfacing.test.ts src/renderer/src/web/web-preload-api-runtime-environment.test.ts --maxWorkers=1",
"result": "passed",
"durationSeconds": 6.55,
"summary": "Ten files and 282 tests passed, including the composed Local -> Windows 2 navigation -> local reveal -> restart regression, dedicated-only preference persistence, removed transient-host fallback, multi-client browser routing, late host-operation suppression, and web pairing/preference separation."
},
{
"date": "2026-07-30",
"runner": "local",
"platform": "macos",
"command": "pnpm exec vitest run --config config/vitest.config.ts src/renderer/src/components/sidebar/AddProjectFromFolderDialog.test.tsx src/renderer/src/components/sidebar/NonGitFolderDialog.test.tsx src/renderer/src/components/sidebar/AddRepoDialog.default-checkout.test.ts src/renderer/src/components/sidebar/AddRepoSteps.default-checkout.test.ts src/renderer/src/components/sidebar/project-added-default-checkout.test.ts src/renderer/src/components/sidebar/useAddRepoLocalFolderFlow.test.ts src/renderer/src/components/sidebar/useAddRepoNestedImportFlow.test.ts src/renderer/src/components/sidebar/useAddRepoServerPathFlow.test.ts src/renderer/src/components/sidebar/useAddRepoCloneFlow.test.ts src/renderer/src/components/sidebar/useCreateRepo.default-checkout.test.ts src/renderer/src/components/sidebar/worktree-list/listing/host-filtering.test.ts src/renderer/src/lib/resolved-worktree-execution-host.test.ts src/renderer/src/lib/worktree-runtime-owner.test.ts src/renderer/src/store/selectors.test.ts src/renderer/src/store/slices/repos-all-hosts-folder-workspaces.test.ts src/renderer/src/store/slices/repos-project-groups.test.ts src/renderer/src/store/slices/repos-selected-owner-routing.test.ts src/renderer/src/store/slices/selected-host-active-workspace-identity.test.ts src/renderer/src/store/slices/worktrees-fetch-owner-routing.test.ts --maxWorkers=1",
"result": "passed",
"durationSeconds": 8.77,
"summary": "Nineteen files and 386 tests passed after rebasing onto 94cf2f1422f30fc309cb47c5e864a831d516fa8b, including exact-ID repo/worktree/group/folder host identity in both catalog orders, fail-closed active-repo selection when a runtime row is unavailable, selected runtime and SSH owner capture through final Add/Clone/Create/folder activation, direct-SSH authoritative pruning, reversed catalog responses, reconnect generation fencing, local-after-runtime isolation, and missing-catalog worktree routing."
},
{
"date": "2026-07-30",
"runner": "local",
"platform": "macos",
"command": "pnpm run ensure:electron-runtime && npx playwright test tests/e2e/pr11346-selected-runtime-add.spec.ts --config tests/playwright.config.ts --project electron-headful --workers=1 --reporter=line",
"result": "passed",
"durationSeconds": 23,
"summary": "A visible isolated Orca desktop server and separate paired Electron client added one real Git repo, one plain folder, one clone, one created project, and two nested repos to the selected non-default runtime across preference switches and disconnect/reconnect. Exact-ID local/runtime repo, worktree, group, and folder rows remained concurrently visible in local-first and reversed order without capturing final activation. Server inventory, active host identity, rendered rows, local-client exclusion, preserved post-reconnect catalogs, and zero direct SSH fallback agreed. Runtime switch/Git/folder/Clone/Create/reconnect/nested-import measurements were 307/1667/2932/1247/1321/259/1319 ms."
},
{
"date": "2026-07-30",
"runner": "local",
"platform": "macos",
"command": "pnpm run ensure:electron-runtime && npx playwright test tests/e2e/pr11346-selected-runtime-add.spec.ts --config tests/playwright.config.ts --project electron-headless --workers=1 --reporter=line",
"result": "passed",
"durationSeconds": 66,
"summary": "The hidden-window desktop-server parity journey passed with exact-ID Add/Clone/Create activation, selected-runtime inventory, reversed catalog order, reconnect overlap, ownership, local exclusion, and host-qualified catalog-preservation assertions. Runtime switch/Git/folder/Clone/Create/reconnect/nested-import measurements were 59/1770/4330/1375/2137/279/1945 ms."
},
{
"date": "2026-07-31",
"runner": "local",
"platform": "macos",
"command": "pnpm exec vitest run --config config/vitest.config.ts src/renderer/src/components/sidebar/AddProjectFromFolderDialog.test.tsx src/renderer/src/components/sidebar/NonGitFolderDialog.test.tsx src/renderer/src/components/sidebar/AddRepoDialog.default-checkout.test.ts src/renderer/src/components/sidebar/AddRepoSteps.default-checkout.test.ts src/renderer/src/components/sidebar/project-added-default-checkout.test.ts src/renderer/src/components/sidebar/useAddRepoLocalFolderFlow.test.ts src/renderer/src/components/sidebar/useAddRepoNestedImportFlow.test.ts src/renderer/src/components/sidebar/useAddRepoServerPathFlow.test.ts src/renderer/src/components/sidebar/useAddRepoCloneFlow.test.ts src/renderer/src/components/sidebar/useCreateRepo.default-checkout.test.ts src/renderer/src/components/sidebar/worktree-list/listing/host-filtering.test.ts src/renderer/src/lib/resolved-worktree-execution-host.test.ts src/renderer/src/lib/worktree-runtime-owner.test.ts src/renderer/src/store/selectors.test.ts src/renderer/src/store/slices/repos-all-hosts-folder-workspaces.test.ts src/renderer/src/store/slices/repos-project-groups.test.ts src/renderer/src/store/slices/repos-selected-owner-routing.test.ts src/renderer/src/store/slices/selected-host-active-workspace-identity.test.ts src/renderer/src/store/slices/worktrees-fetch-owner-routing.test.ts src/renderer/src/runtime/web-runtime-session.test.ts --maxWorkers=1",
"result": "passed",
"durationSeconds": 7.1,
"summary": "Twenty files and 430 tests passed on current main integration, including explicit runtime-owner preservation for terminal and browser session activation."
},
{
"date": "2026-07-31",
"runner": "local",
"platform": "macos",
"command": "pnpm run ensure:electron-runtime && npx playwright test tests/e2e/pr11346-selected-runtime-add.spec.ts --config tests/playwright.config.ts --project electron-headful --workers=1 --reporter=line",
"result": "passed",
"durationSeconds": 19.9,
"summary": "The visible headed server and separate paired client passed the strengthened same-ID terminal-activation oracle with a disposable runtime Git identity. Runtime switch/Git/folder/Clone/Create/reconnect/nested-import measurements were 43/1513/3841/1200/790/202/1312 ms."
},
{
"date": "2026-07-31",
"runner": "local",
"platform": "macos",
"command": "pnpm run ensure:electron-runtime && npx playwright test tests/e2e/pr11346-selected-runtime-add.spec.ts --config tests/playwright.config.ts --project electron-headless --workers=1 --reporter=line",
"result": "passed",
"durationSeconds": 19.7,
"summary": "The hidden-window server and separate paired client passed the strengthened same-ID terminal-activation oracle with a disposable runtime Git identity. Runtime switch/Git/folder/Clone/Create/reconnect/nested-import measurements were 51/1502/3843/880/939/200/1359 ms."
}
],
"runtimeBudget": {
"p95Seconds": 180,
"scope": "focused persistence/routing contracts plus isolated paired Electron journeys"
},
"flakeHistory": {
"status": "unknown",
"evidence": "Deterministic contracts and the final visible plus hidden-window paired Electron runs passed locally. During expansion, attempts exposed three harness-only assumptions: exact project labels did not allow path disambiguation, clicking the inner host label raced cmdk layout, and a disposable CI runtime had no Git author identity for Create. The oracle now targets the host command item, accepts the rendered disambiguated label, seeds only its isolated runtime home with a test Git identity, and explicitly creates a first paired terminal while same-ID local/runtime worktrees remain present. CI soak history is not yet available."
},
"redGreenEvidence": {
"status": "complete",
"evidence": "The Add Project selector file from fix-disabled overlay 17a612c819 and candidate 8abf0f5d20 is byte-identical (SHA-256 f34c3c69c8adba23811c3a3b6a0efb669f787666c5ada086df8a167e785eea20): its blocked and unavailable sole-host cases fail with the production fix disabled on latest main ebe5125476 after PR #13909 and pass on the candidate. The focused combined selector/transaction invocation was 3 failed with 69 skipped on the red overlay and 3 passed with 75 skipped on the candidate; the different totals come from supplemental browser-transaction cases, not this selector file. The originating/latest affected main 1136503c6a and its fix-disabled overlay were also red before the provider-gating rebase. The byte-identical focused oracle (SHA-256 6de18c140a86801460e58f52287e27a58b97f1576f9f387fa82e1bd4eb378f7b) fails 2/3 on review baseline aa6f945001a5f78a07663c854fabb95c55d8b40b and on the r5-disabled parent e21f4ca58e: local-first lookup returns /local/repo and folder activation has no runtime host. It passes 3/3 on the candidate. Main later advanced to 94cf2f1422f30fc309cb47c5e864a831d516fa8b without changing any of the candidate's 68 files or the focused oracle production boundary; the rebased disabled parent f247d961cab15237bc7fcf0598fe76007f78ec7c has the same stable patch ID as e21f4ca58e. The final paired spec and fixture have SHA-256 bd6d9014d1bed2715397bcd2121d5d7e01792347b13ff14778ccf608bf98789c and d1d78a82f868e2f3152777550825c0ca2d4dc3cba5c6de548e066d2931751fc7. With the final runtime-session owner fix disabled, the focused session test fails 3/43 and the byte-identical hidden paired oracle deterministically creates the host terminal but reports null active client owner while same-ID local/runtime worktrees remain. The integrated candidate passes the same focused test and both headed/hidden paired oracles with exact runtime ownership, server inventory, local exclusion, preserved catalogs, visible rows, and zero direct SSH fallback. Earlier Active Server preference paths retain deterministic coverage but do not yet have a saved intentional-break artifact."
},
"performanceBudget": {
"required": true,
"evidence": "Preference writes are explicit user actions; transient routing adds no polling or provider fanout and retains one authoritative worktree refresh per completed add. Host-qualified owner indexes are WeakMap-cached and do not add subprocesses or network calls. The final headed journey measured 43 ms for three preference switches, 1,513 ms for Git add, 3,841 ms for folder add, 1,200 ms for Clone, 790 ms for Create with controlled exact-ID completion gates, 202 ms for disconnect/reconnect with overlapping catalog refreshes, and 1,312 ms for nested import. The final session-activation fix adds one execution-host string conversion per explicit terminal/browser activation and no provider call, scan, timer, or retry. Existing Zustand selector fan-out evidence remained 0 render invalidations across 5,000,000 selector runs."
},
"promotionCriteria": [
"Run the focused gate in soak across macOS, Linux, and Windows.",
"Attach a live Windows Local -> Windows 2 -> local reveal -> restart artifact.",
"Attach saved red/green evidence for generic settings mutation and transient connection routing.",
"Run the paired Add Project journey on Linux and native Windows, plus live SSH and WSL hosts."
],
"knownGaps": [
"The exact journey is deterministic contract coverage, not a packaged Windows UI automation run.",
"Browser/mobile handoff is covered through transient routing state and preload contracts, not a live phone browser session.",
"The paired Add Project journey is macOS-only; native Windows was unavailable.",
"SSH and WSL Add Project ownership is deterministic store/controller coverage, not a live host journey."
],
"demotionRule": "Demote or block release if any non-Advanced path mutates Active Server, if local reveal or Add Project depends on the durable default instead of captured workspace/host ownership, if an Add Project operation reaches a different host after it begins, or if transient host state survives restart."
},
{
"id": "terminal-geometry.visible-convergence",
"title": "Visible desktop terminals converge across xterm, fit, PTY, shell, and runtime mirror size",
"maturity": "experimental",
"protection": "partial",
"owner": "terminal-rendering",
"layer": "renderer-provider-contract",
"surfaces": [
"PTY sizing",
"split layout",
"restore",
"hidden-to-visible transitions",
"window wake"
],
"platforms": ["macos", "linux", "windows"],
"providers": ["local", "daemon", "ssh", "remote-runtime"],
"coveredPlatforms": ["macos"],
"coveredProviders": [],
"coverageNotes": "Local macOS evidence on main@1282f5c2d, including #7192's runtime-mirror geometry authority slice. Deterministic provider-contract coverage now includes settled window-wake reassertion and SSH relay applied-size readback. Live shell-visible SSH/remote geometry and Windows ConPTY readback remain non-blocking gaps.",
"motivatingLinks": [
"https://github.com/stablyai/orca/pull/6644",
"https://github.com/stablyai/orca/pull/6649",
"https://github.com/stablyai/orca/pull/6725",
"https://github.com/stablyai/orca/pull/6785",
"https://github.com/stablyai/orca/pull/6853",
"https://github.com/stablyai/orca/pull/6939",
"https://github.com/stablyai/orca/pull/7192"
],
"invariant": "A visible desktop-owned terminal cannot trust 0x0, stale requested size, or renderer-only size; xterm, fit/proposed size, applied PTY size, shell-visible size, and the runtime mirror's parse dimensions must converge or enter explicit degraded state, and mirror resize reflow must stay ordered with queued output writes.",
"oracle": "The current executable slice uses deterministic frame schedulers and fake providers to force 0x0 first fit, delayed layout settle, dropped resize/readback drift, hidden-to-visible activation, and window wake. It asserts the renderer forwards a usable size, pty:getSize reports applied rather than merely requested size where available, visibility resume reasserts real drift without hot listSessions, one settled wake produces one geometry-only readback, and SSH relay readback is authoritative with bounded fallback. Shell-visible stty/echo-wrap convergence remains a live-gate follow-up.",
"commands": [
"pnpm exec vitest run --config config/vitest.config.ts src/renderer/src/components/terminal-pane/pty-size-reconcile.test.ts src/renderer/src/components/terminal-pane/pty-size-reassertion.test.ts src/renderer/src/components/terminal-pane/split-right-white-screen.test.ts src/renderer/src/components/terminal-pane/use-terminal-window-wake-recovery.test.ts src/main/ipc/pty-applied-size-reporting.test.ts src/main/providers/ssh-pty-provider.test.ts src/main/runtime/orca-runtime.test.ts src/relay/pty-handler-output-streaming.test.ts"
],
"testFiles": [
"src/renderer/src/components/terminal-pane/pty-size-reconcile.test.ts",
"src/renderer/src/components/terminal-pane/pty-size-reassertion.test.ts",
"src/renderer/src/components/terminal-pane/split-right-white-screen.test.ts",
"src/renderer/src/components/terminal-pane/use-terminal-window-wake-recovery.test.ts",
"src/main/ipc/pty-applied-size-reporting.test.ts",
"src/main/providers/ssh-pty-provider.test.ts",
"src/main/runtime/orca-runtime.test.ts",
"src/relay/pty-handler-output-streaming.test.ts"
],
"assertionRefs": [
{
"file": "src/renderer/src/components/terminal-pane/pty-size-reconcile.test.ts",
"assertions": [
"hidden delayed narrow settle is forwarded instead of stopping on a fixed frame budget",
"unmeasurable frames do not count as settled",
"applied-size readback divergence is re-forwarded before handoff"
]
},
{
"file": "src/renderer/src/components/terminal-pane/pty-size-reassertion.test.ts",
"assertions": [
"only one applied-size read stays in flight while the grid changes",
"stale in-flight targets never resize the PTY back to an older grid"
]
},
{
"file": "src/renderer/src/components/terminal-pane/split-right-white-screen.test.ts",
"assertions": [
"0x0 split-right spawn recovers when the container becomes measurable",
"visible permanently-unmeasurable 0x0 pane gets a nonzero safe fallback",
"hidden 0x0 background spawn is not forced to phantom desktop size"
]
},
{
"file": "src/renderer/src/components/terminal-pane/use-terminal-window-wake-recovery.test.ts",
"assertions": [
"window focus reasserts PTY size after fitting",
"the immediate and settled wake fits produce exactly one geometry-only reassertion"
]
},
{
"file": "src/main/ipc/pty-applied-size-reporting.test.ts",
"assertions": [
"accepted desktop resizes fan out to the runtime after provider resize",
"rejected desktop resizes do not fan out to the runtime",
"provider-owned null remains unverified instead of falling back to requested size"
]
},
{
"file": "src/main/providers/ssh-pty-provider.test.ts",
"assertions": [
"SSH applied-size readback uses the relay with a one-second timeout",
"old-relay method-not-found is cached while transient failures remain retryable"
]
},
{
"file": "src/main/runtime/orca-runtime.test.ts",
"assertions": [
"the headless mirror resizes after an accepted desktop PTY resize (#7192)",
"headless mirror resizes are ordered behind queued PTY writes (#7192)"
]
},
{
"file": "src/relay/pty-handler-output-streaming.test.ts",
"assertions": [
"relay readback reports the grid actually applied by node-pty",
"missing relay PTYs return an unverified null size"
]
}
],
"evidenceRuns": [
{
"date": "2026-07-21",
"runner": "local",
"platform": "macos",
"command": "pnpm exec vitest run --config config/vitest.config.ts src/renderer/src/components/terminal-pane/pty-size-reconcile.test.ts src/renderer/src/components/terminal-pane/pty-size-reassertion.test.ts src/renderer/src/components/terminal-pane/split-right-white-screen.test.ts src/renderer/src/components/terminal-pane/use-terminal-window-wake-recovery.test.ts src/main/ipc/pty-applied-size-reporting.test.ts src/main/providers/ssh-pty-provider.test.ts src/main/runtime/orca-runtime.test.ts src/relay/pty-handler-output-streaming.test.ts",
"result": "passed",
"durationSeconds": 18.54,
"summary": "8 test files passed, 1,272 tests passed on the PR branch."
}
],
"runtimeBudget": {
"p95Seconds": 60,
"scope": "provider-contract or focused Electron test"
},
"flakeHistory": {
"status": "unknown",
"evidence": "Deterministic Vitest slices passed locally; no CI soak history yet."
},
"redGreenEvidence": {
"status": "partial",
"evidence": "#7192 proved the mirror slice red before its fix (snapshot stayed 80x24, queued write parsed at the wrong width). The renderer 0x0/settle slices do not have recorded red runs."
},
"performanceBudget": {
"required": true,
"evidence": "The wake hook count test permits two visual fits but exactly one applied-size read per visible pane and no broad visibility/agent lifecycle call. SSH readback has a one-second timeout, caches stable method-not-found, and retries only transient failures. No polling, listSessions scan, subprocess, or unbounded retry was added."
},
"promotionCriteria": [
"Build deterministic fault hooks before adding broad E2E coverage.",
"Keep stress variants non-blocking until runtime and flake history are known."
],
"knownGaps": [
"Local and Docker-backed SSH Electron wake specs exist but remain manual/non-blocking pending runtime and flake history.",
"The deterministic gate proves the SSH provider/relay readback contract, not live shell-visible convergence across every remote path.",
"Does not yet prove Windows ConPTY geometry/readback.",
"Current command uses deterministic fake providers for the main/renderer contracts, not a real remote PTY."
],
"demotionRule": "Cannot promote without deterministic oracle and runtime history."
},
{
"id": "xterm-addon.boundary-containment",
"title": "xterm addon failures stay pane-scoped and input survives",
"maturity": "experimental",
"protection": "partial",
"owner": "terminal-rendering",
"layer": "renderer-unit",
"surfaces": ["terminal search", "links", "WebGL", "decorations", "keyboard navigation"],
"platforms": ["macos", "linux", "windows"],
"providers": ["local", "daemon", "ssh", "remote-runtime"],
"coveredPlatforms": ["macos"],
"coveredProviders": [],
"coverageNotes": "Local macOS evidence over the WebGL/link/search containment suites on main@1282f5c2d, adopting the #6949 atlas-recovery rename and #7133's reveal hardening tests. Core addon-load throw containment and live typed-input survival arrive with #7004 and a live follow-up.",
"motivatingLinks": [
"https://github.com/stablyai/orca/pull/6852",
"https://github.com/stablyai/orca/pull/6872",
"https://github.com/stablyai/orca/pull/6855"
],
"invariant": "Search, link, WebGL, decoration, input-protocol, or keyboard-navigation errors must not unmount the terminal surface, crash React/window, break focus, or stop PTY input/output.",
"oracle": "The current executable slice injects a core addon load throw and asserts pane opening continues through later addons, covers link provider throws as pane-scoped no-link results, covers search decoration positive-integer failures as false results instead of renderer crashes, and covers WebGL attach/refresh/recovery containment. Focused typed input echo after addon failure still needs a live/component follow-up.",
"commands": [
"pnpm exec vitest run --config config/vitest.config.ts src/renderer/src/lib/pane-manager/terminal-link-provider-guard.test.ts src/renderer/src/components/terminal-search-safe-find.test.ts src/renderer/src/lib/pane-manager/pane-webgl-refresh-lifecycle.test.ts src/renderer/src/components/terminal-pane/terminal-webgl-atlas-recovery.test.ts src/renderer/src/lib/pane-manager/pane-webgl-context-recovery.test.ts src/renderer/src/lib/pane-manager/pane-webgl-renderer.test.ts src/renderer/src/lib/pane-manager/pane-reveal-repaint.test.ts src/renderer/src/components/terminal-pane/terminal-visibility-resume.test.ts"
],
"testFiles": [
"src/renderer/src/lib/pane-manager/terminal-link-provider-guard.test.ts",
"src/renderer/src/components/terminal-search-safe-find.test.ts",
"src/renderer/src/lib/pane-manager/pane-webgl-refresh-lifecycle.test.ts",
"src/renderer/src/components/terminal-pane/terminal-webgl-atlas-recovery.test.ts",
"src/renderer/src/lib/pane-manager/pane-webgl-context-recovery.test.ts",
"src/renderer/src/lib/pane-manager/pane-webgl-renderer.test.ts",
"src/renderer/src/lib/pane-manager/pane-reveal-repaint.test.ts",
"src/renderer/src/components/terminal-pane/terminal-visibility-resume.test.ts"
],
"assertionRefs": [
{
"file": "src/renderer/src/lib/pane-manager/terminal-link-provider-guard.test.ts",
"assertions": [
"link-provider throws are reproduced and contained without escaping the surface"
]
},
{
"file": "src/renderer/src/components/terminal-search-safe-find.test.ts",
"assertions": [
"the xterm positive-integers decoration crash is swallowed while unrelated errors re-throw"
]
},
{
"file": "src/renderer/src/lib/pane-manager/pane-webgl-refresh-lifecycle.test.ts",
"assertions": [
"WebGL teardown/refresh lifecycle stays pane-scoped and cancels on dispose"
]
},
{
"file": "src/renderer/src/components/terminal-pane/terminal-webgl-atlas-recovery.test.ts",
"assertions": ["continues recovery when a manager throws after scheduling"]
},
{
"file": "src/renderer/src/lib/pane-manager/pane-webgl-context-recovery.test.ts",
"assertions": [
"failed attach backs off and context-lost panes recover on the next rendering resume"
]
},
{
"file": "src/renderer/src/lib/pane-manager/pane-webgl-renderer.test.ts",
"assertions": [
"attach bail disposes the addon instead of orphaning it (#7133 single-addon invariant)"
]
},
{
"file": "src/renderer/src/lib/pane-manager/pane-reveal-repaint.test.ts",
"assertions": [
"reveal repaint waits for a settled frame and keeps repainting when one pane throws (#7133)"
]
},
{
"file": "src/renderer/src/components/terminal-pane/terminal-visibility-resume.test.ts",
"assertions": [
"tab reveal, heavy reveal, and window wake schedule pane-scoped repaint (#7133)"
]
}
],
"evidenceRuns": [
{
"date": "2026-07-03",
"runner": "local",
"platform": "macos",
"command": "pnpm exec vitest run --config config/vitest.config.ts src/renderer/src/lib/pane-manager/terminal-link-provider-guard.test.ts src/renderer/src/components/terminal-search-safe-find.test.ts src/renderer/src/lib/pane-manager/pane-webgl-refresh-lifecycle.test.ts src/renderer/src/components/terminal-pane/terminal-webgl-atlas-recovery.test.ts src/renderer/src/lib/pane-manager/pane-webgl-context-recovery.test.ts src/renderer/src/lib/pane-manager/pane-webgl-renderer.test.ts src/renderer/src/lib/pane-manager/pane-reveal-repaint.test.ts src/renderer/src/components/terminal-pane/terminal-visibility-resume.test.ts",
"result": "passed",
"durationSeconds": 0.8,
"summary": "8 test file(s) passed, 33 tests passed on main@1282f5c2d in a clean checkout."
}
],
"runtimeBudget": {
"p95Seconds": 30,
"scope": "renderer unit or component test"
},
"flakeHistory": {
"status": "unknown",
"evidence": "Focused renderer-unit containment slice passed locally on 2026-07-02; needs soak history before promotion."
},
"redGreenEvidence": {
"status": "partial",
"evidence": "#7133 proved the reveal-hardening slice against live corrupted specimens; the link/search guards reproduce their original crashes in-test. No recorded red runs for the refresh-lifecycle slice."
},
"performanceBudget": {
"required": false,
"evidence": "Required only if containment adds retry loops, polling, or renderer fallback churn."
},
"promotionCriteria": [
"Add deterministic addon throw injection.",
"Prove input/output survives after boundary failure."
],
"knownGaps": [
"Current command is renderer-unit containment, not live Electron typed input/output survival after addon failure.",
"Does not yet inject WebGL dispose/reset throws and active/hidden/resumed pane focus recovery in one component-level oracle."
],
"demotionRule": "Cannot promote while it only checks visual rendering."
},
{
"id": "terminal-scroll.intent-preservation",
"title": "Scrollbar drag intent survives tab and visibility resume",
"maturity": "experimental",
"protection": "partial",
"owner": "terminal-rendering",
"layer": "renderer-unit",
"surfaces": [
"terminal lifecycle",
"hidden-to-visible resume",
"tab switching",
"xterm scrollbar DOM",
"scrollback"
],
"platforms": ["macos", "linux", "windows"],
"providers": ["local", "daemon", "ssh", "wsl", "remote-runtime"],
"coveredPlatforms": ["macos"],
"coveredProviders": [],
"coverageNotes": "Renderer-unit coverage proves the shared xterm DOM intent path. Live Electron evidence is PR validation evidence for local macOS only until the flow has stable automation; live SSH, WSL, Linux, and Windows paths remain unproved.",
"motivatingLinks": ["STA-1341"],
"invariant": "A user-driven xterm scrollbar thumb or track scroll updates the live terminal scroll intent before tab, visibility, or layout resume enforces intent, so resume preserves the latest dragged viewport instead of an older pinned line.",
"oracle": "Pointerdown on .xterm-scrollbar or .xterm-slider followed by xterm viewport movement records the new pinned viewport, and enforcing current intent restores that dragged line instead of stale top intent.",
"commands": [
"pnpm exec vitest run --config config/vitest.config.ts src/renderer/src/lib/pane-manager/terminal-scroll-intent.test.ts"
],
"testFiles": ["src/renderer/src/lib/pane-manager/terminal-scroll-intent.test.ts"],
"assertionRefs": [
{
"file": "src/renderer/src/lib/pane-manager/terminal-scroll-intent.test.ts",
"assertions": [
"pointer-driven .xterm-scrollbar and .xterm-slider scrolls update terminal scroll intent",
"a scrollbar-dragged viewport is restored instead of stale top intent",
"terminal body pointer activity is not treated as scrollbar intent"
]
}
],
"evidenceRuns": [
{
"date": "2026-07-05",
"runner": "local",
"platform": "macos",
"command": "pnpm exec vitest run --config config/vitest.config.ts src/renderer/src/lib/pane-manager/terminal-scroll-intent.test.ts",
"result": "passed",
"durationSeconds": 0.3,
"summary": "1 test file(s) passed, 17 tests passed in this worktree."
}
],
"runtimeBudget": {
"p95Seconds": 10,
"scope": "focused renderer unit test"
},
"flakeHistory": {
"status": "unknown",
"evidence": "New experimental gate; needs soak history before promotion."
},
"redGreenEvidence": {
"status": "partial",
"evidence": "The new scrollbar DOM target assertions fail when only .xterm-viewport pointerdown is recognized. Needs saved CI/intentional-break artifact before blocking promotion."
},
"performanceBudget": {
"required": true,
"evidence": "Runtime fix is limited to constant-time class/closest checks on pointerdown. It must not add polling, output parsing, PTY listing, hidden-pane wakeups, resize calls, or startup awaits."
},
"promotionCriteria": [
"Collect stable CI soak history for the renderer-unit gate.",
"Add stable live Electron automation for the scrollbar drag plus tab-switch repro.",
"Attach red/green evidence for stale intent restoring the wrong viewport."
],
"knownGaps": [
"Manifest command is deterministic renderer-unit coverage, not a live Electron scrollbar drag.",
"Live daemon, SSH, WSL, remote-runtime, Linux, and Windows validation is not covered by this gate.",
"Future xterm scrollbar DOM class changes are only caught if they break the currently modeled class contract."
],
"demotionRule": "Demote or quarantine if the unit gate flakes without a product bug or harness bug filed to the owner."
},
{
"id": "terminal-scroll.streaming-refocus-intent",
"title": "Streaming refocus preserves follow-output viewport intent",
"maturity": "experimental",
"protection": "partial",
"owner": "terminal-rendering",
"layer": "renderer-unit-and-electron-e2e",
"surfaces": [
"terminal lifecycle",
"window focus recovery",
"hidden-to-visible resume",
"xterm write backlog",
"scrollback"
],
"platforms": ["macos", "linux", "windows"],
"providers": ["local", "daemon", "ssh", "wsl", "remote-runtime"],
"coveredPlatforms": ["macos"],
"coveredProviders": ["local", "daemon"],
"coverageNotes": "Unit coverage proves provider-independent ordering for any PaneManager. Live Electron coverage exercises a local PTY through the daemon on macOS; SSH, WSL, remote-runtime, Linux, and Windows remain unproved for this exact race.",
"motivatingLinks": [
"https://github.com/stablyai/orca/issues/11753",
"https://github.com/stablyai/orca/pull/11915"
],
"invariant": "When output is queued during a focus or visibility transition, Orca records the pre-flush viewport intent before xterm parses backlog writes, so a follow-output terminal stays at the bottom and a pinned terminal keeps its prior position.",
"oracle": "Unit tests require exactly one intent sync before each queued-output flush. The Electron test injects a transient top-of-buffer xterm wobble during refocus and requires every presented scrollbar frame, including the final rendered output, to remain at the bottom.",
"commands": [
"pnpm exec vitest run --config config/vitest.config.ts src/renderer/src/components/terminal-pane/terminal-visibility-resume.test.ts",
"pnpm exec electron-vite build --mode e2e",
"SKIP_BUILD=1 pnpm exec playwright test tests/e2e/terminal-streaming-refocus-viewport.spec.ts --config tests/playwright.config.ts --project electron-headless --workers=1 --repeat-each=5"
],
"testFiles": [
"src/renderer/src/components/terminal-pane/terminal-visibility-resume.test.ts",
"tests/e2e/terminal-streaming-refocus-viewport.spec.ts"
],
"assertionRefs": [
{
"file": "src/renderer/src/components/terminal-pane/terminal-visibility-resume.test.ts",
"assertions": [
"window-wake recovery synchronizes viewport intent exactly once before flushing queued output",
"heavy visibility resume synchronizes intent exactly once before flushing queued output"
]
},
{
"file": "tests/e2e/terminal-streaming-refocus-viewport.spec.ts",
"assertions": [
"phase-one scrollback is visibly ready at the bottom without a fixed sleep",
"no presented animation frame moves the scrollbar thumb away from the bottom during refocus",
"the final streamed marker renders with the visible scrollbar still at the bottom"
]
}
],
"evidenceRuns": [
{
"date": "2026-08-01",
"runner": "local",
"platform": "macos",
"command": "pnpm exec vitest run --config config/vitest.config.ts src/renderer/src/components/terminal-pane/terminal-visibility-resume.test.ts",
"result": "passed",
"durationSeconds": 0.096,
"summary": "14 tests passed, including exact sync count and pre-flush ordering for wake and heavy visibility resume."
},
{
"date": "2026-08-01",
"runner": "local",
"platform": "macos",
"command": "SKIP_BUILD=1 pnpm exec playwright test tests/e2e/terminal-streaming-refocus-viewport.spec.ts --config tests/playwright.config.ts --project electron-headless --workers=1 --repeat-each=5",
"result": "passed",
"durationSeconds": 35.2,
"summary": "Five consecutive Electron iterations passed after replacing fixed-time readiness and stale tab capture with deterministic viewport and pane-identity oracles."
}
],
"runtimeBudget": {
"p95Seconds": 30,
"scope": "focused renderer unit test or one Electron E2E iteration"
},
"flakeHistory": {
"status": "soaking",
"evidence": "Five consecutive local Electron iterations passed; CI soak history is still required before promotion."
},
"redGreenEvidence": {
"status": "complete",
"evidence": "The controlled xterm viewport wobble reproduces the pinned-top failure with post-flush intent sampling and passes when intent is latched before the queued write flush."
},
"performanceBudget": {
"required": true,
"evidence": "Wake recovery keeps one O(panes) intent pass before the existing bounded 64 KiB-per-pane flush. Heavy resume removes its second intent pass and keeps the existing bounded 256 KiB-per-pane flush; no polling, timers, subprocesses, IPC, output parsing, fit, or repaint work is added."
},
"promotionCriteria": [
"Collect stable CI soak history for the Electron race gate.",
"Run the live oracle on Linux and Windows terminal backends.",
"Add live SSH or remote-runtime coverage for queued output during refocus."
],
"knownGaps": [
"The deterministic wobble uses xterm private buffer state and must be updated if that internal contract changes.",
"Live Linux, Windows, SSH, WSL, and remote-runtime execution is not covered for this exact race.",
"The Electron gate proves follow-output behavior; adjacent scroll-intent coverage protects pinned viewport behavior."
],
"demotionRule": "Demote or quarantine if the Electron oracle flakes without a product bug or harness bug filed to terminal-rendering."
},
{
"id": "startup-upgrade.persisted-session-corpus",
"title": "Current Orca preserves or recovers old production persisted sessions",
"maturity": "experimental",
"protection": "none",
"owner": "startup-persistence",
"layer": "upgrade-fixture",
"surfaces": ["startup", "upgrade", "session restore", "daemon restore"],
"platforms": ["macos", "linux", "windows"],
"providers": ["local", "daemon", "ssh", "wsl"],
"coveredPlatforms": [],
"coveredProviders": [],
"coverageNotes": "Registered gap only; no executable coverage is wired yet.",
"motivatingLinks": [
"https://github.com/stablyai/orca/issues/5356",
"https://github.com/stablyai/orca/pull/5234",
"https://github.com/stablyai/orca/pull/5240"
],
"invariant": "Startup and restore fixes must preserve or explicitly recover sessions from the last affected production persisted-state schema, not only from state written by current code.",
"oracle": "Boot current Orca against immutable copied user-data fixtures from affected versions and reject blank replacement panes, duplicate resume tabs, silent session loss, or works-only-after-current-write behavior.",
"commands": [],
"testFiles": [],
"assertionRefs": [],
"evidenceRuns": [],
"runtimeBudget": {
"p95Seconds": 120,
"scope": "focused Electron upgrade fixture"
},
"flakeHistory": {
"status": "not-started",
"evidence": "Fixture corpus not implemented."
},
"redGreenEvidence": {
"status": "missing",
"evidence": "Needs immutable pre-fix persisted-state fixture."
},
"performanceBudget": {
"required": true,
"evidence": "Startup fixture must record startup latency and avoid adding blocking migration scans."
},
"promotionCriteria": [
"Land immutable old-version fixture with documented source version.",
"Run second restart after current code writes upgraded state.",
"Record startup timing and failure artifact."
],
"knownGaps": ["No fixture corpus or command yet."],
"demotionRule": "Cannot promote without old production fixture provenance."
},
{
"id": "terminal-platform.live-pty-liveness",
"title": "A real Electron local PTY accepts input, survives workspace restore, resizes, and exits cleanly",
"maturity": "experimental",
"protection": "none",
"owner": "terminal-runtime",
"layer": "electron-live-pty",
"surfaces": [
"active terminal PTY binding",
"xterm focus",
"keyboard input",
"PTY output",
"workspace hide and restore",
"resize",
"exit cleanup"
],
"platforms": ["linux", "macos"],
"providers": ["local"],
"coveredPlatforms": [],
"coveredProviders": [],
"coverageNotes": "Registered gap on main. The live Electron Playwright slice exists only on the pending reliability stack. It registers here with its owning split PR.",
"motivatingLinks": [
"https://github.com/stablyai/orca/pull/6801",
"https://github.com/stablyai/orca/pull/6842",
"https://github.com/stablyai/orca/pull/6939",
"https://github.com/stablyai/orca/pull/6989"
],
"invariant": "An active local Electron terminal has one active PTY id listed exactly once, accepts real keyboard input through focused xterm, renders process output visibly, keeps the same live PTY across repeated workspace hide/restore cycles, applies an actual size change, and removes the old PTY from liveness state after exit.",
"oracle": "A deterministic raw-mode probe prints a ready marker, ordered key markers from real keyboard input, the active PTY id appears exactly once in pty:listSessions, remains bound to the same PTY id across two worktree switch-away/switch-back cycles, accepts more keyboard input after each restore, changes pty:getSize after viewport resize, prints the same process-visible size, and prints an exit marker; after shell exit, pty:listSessions no longer contains the old id.",
"commands": [],
"testFiles": [],
"assertionRefs": [],
"evidenceRuns": [],
"runtimeBudget": {
"p95Seconds": 75,
"scope": "focused Electron live PTY gate including e2e build/setup"
},
"flakeHistory": {
"status": "unknown",
"evidence": "Focused Playwright gate passed locally after adding two workspace hide/restore cycles, exact active-PTY listing, and actual resize convergence on 2026-07-02: 1 test passed, 8.6s test body, 58.6s full command including build/setup. Needs repeated CI/runtime history before promotion."
},
"redGreenEvidence": {
"status": "partial",
"evidence": "The gate asserts PTY binding, active PTY listed exactly once, real xterm keyboard delivery, same-PTY ownership across repeated workspace hide/restore cycles, post-restore input delivery, actual pty:getSize change, matching process-visible size, and listSessions cleanup after shell exit. Needs saved intentional-break evidence before promotion."
},
"performanceBudget": {
"required": true,
"evidence": "Must record key latencies, size snapshots, and final liveness state. The gate may use broad listing as a test oracle; product hot paths must not use broad provider listing as a synchronization primitive."
},
"promotionCriteria": [
"Implement without blind sleeps; wait only on PTY binding, probe markers, size marker, and liveness absence.",
"Run in soak on Linux before blocking; keep macOS as soak until stable.",
"Attach red/green evidence for focus, PTY write, resize, and exit cleanup failures."
],
"knownGaps": [
"No executable coverage on main yet; the slice lives on the pending fix-terminal-reliability stack.",
"Needs soak/runtime history before promotion.",
"Does not yet cover tab switch inside one worktree, scrollback after restore, or app restart persistence.",
"Does not cover Windows ConPTY, SSH, WSL, daemon, or remote-runtime providers."
],
"demotionRule": "Cannot promote without deterministic user-visible oracle, failure artifacts, and stable runtime history."
},
{
"id": "terminal-session.windows-main-crash-survival",
"title": "A Windows main-process crash preserves and reattaches daemon terminals",
"maturity": "experimental",
"protection": "partial",
"owner": "terminal-platform",
"layer": "windows-packaged-electron-daemon",
"surfaces": [
"Electron main-process crash",
"detached terminal daemon",
"ConPTY shell survival",
"packaged relaunch reattach"
],
"platforms": ["windows"],
"providers": ["daemon"],
"coveredPlatforms": ["windows"],
"coveredProviders": ["daemon"],
"coverageNotes": "A packaged Windows CI run force-kills the launched instance's real Electron main without tree-killing, then proves the same scoped daemon and interactive PowerShell survive, no FailFast event is observed, and relaunch input reaches the same shell. Focused cross-platform unit tests fail closed on unavailable event-log or PID-liveness evidence, stale or ambiguous daemon identity, and incomplete reattach assertions.",
"motivatingLinks": [
"https://github.com/stablyai/orca/issues/7742",
"https://github.com/stablyai/orca/pull/9311"
],
"invariant": "On packaged Windows, abrupt death of Orca's Electron main process must not terminate or replace the userData-scoped terminal daemon or its live ConPTY shell, and a relaunch must adopt that exact daemon and route terminal input to that exact surviving shell without a PowerShell 0xE9 FailFast.",
"oracle": "Resolve the launched instance's real main PID from inside Electron, force-kill only that PID, require it to die, require one command-line-scoped daemon PID and the stamped interactive shell PID to remain live, relaunch with persisted state, require the daemon PID to remain identical, read the exact shell PID and a per-shell environment sentinel back through the exact restored tab, then require a successful Windows Application event-log query with zero matching pwsh FailFast events across the full crash-to-input window.",
"commands": [
"pnpm exec vitest run --config config/vitest.config.ts config/scripts/win-crash-survival-e2e.test.mjs",
"node tests/tools/win-crash-survival-e2e/run.mjs --expect survival --exe-path \"$env:ORCA_EXE\" --soak-seconds 8"
],
"testFiles": [
"config/scripts/win-crash-survival-e2e.test.mjs",
"tests/tools/win-crash-survival-e2e/run.mjs"
],
"assertionRefs": [
{
"file": "config/scripts/win-crash-survival-e2e.test.mjs",
"assertions": [
"survival requires the crash antecedent, daemon and shell liveness, unchanged daemon identity, zero FailFast events, and same-shell reattach",
"event-log query failure cannot be converted into zero FailFast events",
"malformed event-log and PID-liveness evidence fails closed",
"stale, missing, or ambiguous userData-scoped daemon identity fails closed",
"the packaged survival proof remains wired to targeted pull requests without a duplicate branch-push run"
]
},
{
"file": "tests/tools/win-crash-survival-e2e/run.mjs",
"assertions": [
"force-killing only the real Electron main leaves the exact scoped daemon and stamped interactive shell alive",
"packaged relaunch adopts the unchanged daemon and reads the survivor shell's environment sentinel through the restored terminal"
]
}
],
"evidenceRuns": [
{
"date": "2026-07-18",
"runner": "ci",
"platform": "windows",
"command": "node tests/tools/win-crash-survival-e2e/run.mjs --expect survival --exe-path \"$env:ORCA_EXE\" --soak-seconds 8",
"result": "passed",
"durationSeconds": 61,
"summary": "The packaged branch build's real main died; the same daemon and shell PIDs survived; the event-log scan found zero FailFast events; relaunch adopted the unchanged daemon; and terminal input read the survivor shell sentinel back."
}
],
"runtimeBudget": {
"p95Seconds": 120,
"scope": "installed-app crash/relaunch harness, excluding installer build and dependency setup"
},
"flakeHistory": {
"status": "unknown",
"evidence": "One green packaged Windows CI run is recorded; the durable pull-request trigger must accumulate repeated history before promotion."
},
"redGreenEvidence": {
"status": "partial",
"evidence": "The inverse orphaned profile failed against the fixed packaged build because the daemon stayed live and no FailFast occurred. A genuinely pre-relocation packaged build has not yet been retained as a CI red fixture."
},
"performanceBudget": {
"required": true,
"evidence": "Production code is unchanged. The harness has bounded 500ms liveness polls, one 8-second crash soak, two scoped daemon identity scans plus teardown rediscovery, a 60-second cap on every synchronous PowerShell probe, a 5-second cap on Electron main-PID resolution, cleared and unreferenced close deadlines, a 50-minute job timeout, concurrency cancellation, and targeted production-path filtering that excludes source tests and benchmarks. The installer cache is keyed by every production build input; the job also restores the pnpm store and restores Electron/NSIS downloads only when an installer rebuild is required. The measured packaged harness completed in 61 seconds."
},
"promotionCriteria": [
"Collect at least 100 consecutive targeted Windows PR or soak passes over 14 days with zero unexplained flakes.",
"Retain a pre-relocation packaged red fixture or equivalent fault injection that makes the survival profile fail for daemon death and shell loss.",
"Keep the live oracle fail-closed for crash delivery, event-log access, daemon identity, and same-shell reattach."
],
"knownGaps": [
"The packaged journey proves one terminal end to end; concurrent restoration across the user's multi-terminal, multi-worktree layout is not exercised live.",
"The gate covers a Windows local daemon-backed PowerShell terminal; WSL-backed shells are not exercised.",
"SSH, remote-runtime, relay, mobile, macOS, and Linux paths are unaffected by the Windows relocated ConPTY host contract and are not exercised here.",
"The Application event-log query is machine-wide, so an unrelated PowerShell crash on a non-isolated runner can false-fail the gate.",
"Standalone daemon self-crash and renderer-only crash containment remain separate invariants."
],
"demotionRule": "Keep experimental or quarantine with a linked harness defect if the Windows job flakes; never weaken the crash, identity, event-log, or same-shell reattach oracle to obtain a pass."
},
{
"id": "terminal-platform.windows-conpty-liveness",
"title": "Windows ConPTY terminals stay input-live, render-live, and geometry-live",
"maturity": "experimental",
"protection": "partial",
"owner": "terminal-platform",
"layer": "windows-electron-conpty",
"surfaces": [
"Windows ConPTY",
"PowerShell and cmd",
"keyboard protocol",
"CJK repaint",
"cursor and resize"
],
"platforms": ["windows"],
"providers": ["local", "daemon", "wsl"],
"coveredPlatforms": ["windows"],
"coveredProviders": ["daemon"],
"coverageNotes": "Issue #8048 now has deterministic wrapper and cold-restore re-anchor tests plus a Windows PR-CI harness that drives the built daemon through 25 real ConPTY workspace-close races while an unrelated witness PTY stays alive. Keyboard reset, CJK repaint, WSL, and full visible Electron coverage remain gaps.",
"motivatingLinks": [
"https://github.com/stablyai/orca/pull/6541",
"https://github.com/stablyai/orca/pull/6858",
"https://github.com/stablyai/orca/pull/6876",
"https://github.com/stablyai/orca/pull/6968",
"https://github.com/stablyai/orca/pull/6970",
"https://github.com/stablyai/orca/pull/6999",
"https://github.com/stablyai/orca/issues/8048"
],
"invariant": "Windows local and daemon terminals must spawn with the intended shell, survive overlapping graceful/forced workspace teardown without affecting unrelated PTYs, retain recovered scrollback across the fresh daemon's first checkpoint, accept normal Enter/Backspace/Arrow input after agent or TUI exit, render cursor/CJK/wide-glyph redraws without stale cells, and converge to nonzero applied size.",
"oracle": "The issue #8048 slice asserts one node-pty ConPTY close for a graceful-then-force sequence, atomically seeds recovered history before fresh shell output and re-anchoring, preserves recovery after seed failure plus adapter restart, and runs 25 built-daemon close races while checking victim session/PID reaping, a stable daemon PID, and a live witness PTY. A broader Windows live gate still needs shell input, resize, cursor, and CJK/wide-glyph pixel evidence.",
"commands": [
"pnpm vitest run src/main/daemon/pty-subprocess.test.ts src/main/daemon/daemon-pty-adapter.test.ts",
"pnpm build:electron-vite && node config/scripts/windows-daemon-workspace-close-repro.mjs",
"node config/scripts/windows-daemon-workspace-close-repro.mjs"
],
"testFiles": [
"src/main/daemon/pty-subprocess.test.ts",
"src/main/daemon/daemon-pty-adapter.test.ts",
"config/scripts/windows-daemon-workspace-close-repro.mjs"
],
"assertionRefs": [
{
"file": "src/main/daemon/pty-subprocess.test.ts",
"assertions": [
"graceful kill followed by force and dispose invokes Windows node-pty kill exactly once and never retries the dead child PID"
]
},
{
"file": "src/main/daemon/daemon-pty-adapter.test.ts",
"assertions": [
"the first checkpoint orders recovered scrollback before synchronously emitted fresh-shell startup output",
"a failed atomic history seed remains non-authoritative across adapter restart and cannot overwrite the recovery files"
]
},
{
"file": "config/scripts/windows-daemon-workspace-close-repro.mjs",
"assertions": [
"all 25 victim sessions and OS PIDs are reaped while the built daemon PID and an unrelated witness PowerShell remain alive"
]
}
],
"evidenceRuns": [
{
"date": "2026-07-10",
"runner": "local",
"platform": "windows",
"command": "node config/scripts/windows-daemon-workspace-close-repro.mjs",
"result": "passed",
"durationSeconds": 7.6,
"summary": "All 25 victim sessions and OS PIDs were reaped while the built daemon and witness PTY survived the real ConPTY workspace-close races. The double-close, history ordering, and seed-failure restart regressions produced intentional red failures before their fixes and passed afterward."
}
],
"runtimeBudget": {
"p95Seconds": 90,
"scope": "Windows focused Electron ConPTY gate"
},
"flakeHistory": {
"status": "unknown",
"evidence": "The built-daemon issue #8048 harness passed locally once and is wired into Windows PR CI; it needs repeated CI history before promotion."
},
"redGreenEvidence": {
"status": "partial",
"evidence": "The ConPTY double-close and cold-restore re-anchor assertions were each observed failing before the fix and passing afterward. Keyboard protocol, shell resolution, resize, and CJK repaint still need red/green proof."
},
"performanceBudget": {
"required": true,
"evidence": "Must include input latency and no broad session listing while typing or switching terminals."
},
"promotionCriteria": [
"Start as Windows nightly/soak because Windows Electron E2E has been flaky.",
"Use deterministic PTY markers for input/resize and reserve screenshots for repaint diagnostics.",
"Split shell parity, keyboard reset, and CJK repaint into smaller gates if a combined gate is flaky."
],
"knownGaps": [
"Real IME composition may require a separate lower-layer/native-text-forwarding gate.",
"The built-daemon harness proves process/session liveness but not renderer pixels; visible shell input, resize, cursor, and CJK repaint remain uncovered."
],
"demotionRule": "Cannot promote while Windows E2E is flaky, silently skipped, or screenshot-only."
},
{
"id": "terminal-performance.cold-restore-replay-budget",
"title": "Daemon cold restore keeps replay work and retained payloads bounded",
"maturity": "experimental",
"protection": "partial",
"owner": "terminal-runtime",
"layer": "main-daemon-unit",
"surfaces": [
"startup restore",
"daemon history replay",
"sleep and hibernation restore",
"main-process memory"
],
"platforms": ["macos", "linux", "windows"],
"providers": ["daemon", "wsl"],
"coveredPlatforms": ["macos"],
"coveredProviders": ["daemon"],
"coverageNotes": "Deterministic main-process tests cover byte-bounded cache eviction and ACK release, one-at-a-time replay admission, a fixed per-turn replay budget within one large output record, UTF-16 boundary preservation, and checkpoint-only restore bypass while another replay is paused. The same HistoryReader path carries WSL context, but live WSL and cross-platform startup-scale runs remain gaps.",
"motivatingLinks": [
"https://github.com/stablyai/orca/issues/9971",
"https://github.com/stablyai/orca/pull/9990",
"https://github.com/stablyai/orca/issues/9441"
],
"invariant": "Cold restore must reproduce persisted terminal output while admitting at most one scratch-emulator replay, yielding after at most 64 Ki UTF-16 code units or 1,024 replay operations, keeping sticky restore payloads within 16 MiB, and allowing header-only checkpoint restores to bypass the replay queue.",
"oracle": "Pause setImmediate during two single-batch restores larger than one replay slice and require exactly one admitted yield at a time, preserved text across a surrogate-pair slice boundary, and a concurrent header-only checkpoint restore to finish without consuming a replay slot. Cache tests require least-recently-used eviction, rejection of one oversized payload, and zero retained cache bytes after renderer ACK.",
"commands": [
"pnpm exec vitest run --config config/vitest.config.ts src/main/daemon/cold-restore-payload-cache.test.ts src/main/daemon/history-reader.test.ts src/main/daemon/terminal-history-incremental-restore.test.ts src/main/daemon/hibernation-cold-restore-repro.test.ts src/main/daemon/daemon-pty-adapter.test.ts"
],
"testFiles": [
"src/main/daemon/cold-restore-payload-cache.test.ts",
"src/main/daemon/history-reader.test.ts",
"src/main/daemon/terminal-history-incremental-restore.test.ts",
"src/main/daemon/hibernation-cold-restore-repro.test.ts",
"src/main/daemon/daemon-pty-adapter.test.ts"
],
"assertionRefs": [
{
"file": "src/main/daemon/terminal-history-incremental-restore.test.ts",
"assertions": [
"large single-batch replays yield within the record, preserve a surrogate pair at the slice boundary, and admit only one scratch replay at a time",
"a header-only checkpoint restore completes while an unrelated incremental replay is paused"
]
},
{
"file": "src/main/daemon/cold-restore-payload-cache.test.ts",
"assertions": [
"least-recently-used payloads are evicted to the aggregate byte budget",
"one payload larger than the entire budget is not retained"
]
},
{
"file": "src/main/daemon/daemon-pty-adapter.test.ts",
"assertions": [
"StrictMode remount receives sticky cold-restore data until renderer ACK clears its retained bytes"
]
}
],
"evidenceRuns": [
{
"date": "2026-07-22",
"runner": "local",
"platform": "macos",
"command": "pnpm exec vitest run --config config/vitest.config.ts src/main/daemon/cold-restore-payload-cache.test.ts src/main/daemon/history-reader.test.ts src/main/daemon/terminal-history-incremental-restore.test.ts src/main/daemon/hibernation-cold-restore-repro.test.ts src/main/daemon/daemon-pty-adapter.test.ts",
"result": "passed",
"durationSeconds": 5.68,
"summary": "Five focused files passed 150 tests, including deterministic single-record replay slicing, one-at-a-time admission, UTF-16 boundary preservation, header-only queue bypass, byte-bounded LRU eviction, and ACK cleanup."
}
],
"runtimeBudget": {
"p95Seconds": 15,
"scope": "focused main-process cold-restore unit contract"
},
"flakeHistory": {
"status": "unknown",
"evidence": "The focused deterministic slice is new and has no CI or soak history yet."
},
"redGreenEvidence": {
"status": "partial",
"evidence": "The prior implementation had no yield inside one large batch and queued header-only restores behind the shared semaphore by inspection; an intentional pre-fix test run was not recorded."
},
"performanceBudget": {
"required": true,
"evidence": "Production admits one emulator replay globally, yields after a deterministic 64 Ki character or 1,024-operation budget even within one record, bypasses the semaphore for the common header-only final-checkpoint path, and caps sticky payloads at 16 MiB. No polling, subprocess, session inventory, or renderer wake loop is added."
},
"promotionCriteria": [
"Record an intentional-break red run for both the within-record yield and header-only bypass assertions.",
"Collect startup event-loop-delay evidence with dozens of near-cap histories on representative macOS, Windows, and Linux hardware.",
"Add live WSL restore evidence before claiming WSL coverage."
],
"knownGaps": [
"The log decoder and final headless snapshot serialization remain synchronous inside the one-at-a-time replay slot; the gate bounds replay writes, not every CPU phase.",
"No live Electron startup-scale run currently proves first-pane paint order or end-to-end restore latency with dozens of histories.",
"SSH, remote-runtime, relay, and mobile do not use this local daemon history reader and are unaffected."
],
"demotionRule": "Keep experimental or demote to protection none if output differs across replay slices, header-only restores consume a replay slot, retained payload bytes exceed the cap, or the focused gate flakes."
},
{
"id": "terminal-performance.remote-hidden-retention-budget",
"title": "Paired terminals park client renderers while host PTYs preserve bounded history",
"maturity": "experimental",
"protection": "partial",
"owner": "terminal-runtime",
"layer": "paired-headed-and-headless-runtime",
"surfaces": [
"paired remote terminal first paint",
"paired remote terminal ordinary parking",
"paired remote terminal bounded scrollback restore",
"stalled paired terminal stream recovery",
"snapshot-probe sequence gap recovery",
"hidden remote worktree retention",
"remote terminal reveal and input",
"paired host relaunch with preserved daemon PTYs",
"manual server disconnect"
],
"platforms": ["macos", "linux", "windows"],
"providers": ["paired-runtime", "ssh"],
"coveredPlatforms": ["macos"],
"coveredProviders": ["paired-runtime"],
"coverageNotes": "Deterministic headed macOS runs launch an isolated Orca desktop server and a separate paired web client. A byte-identical headless run uses an isolated `orca serve` host. Both create six real paired host PTYs with bounded high-output scrollback, prove sustained output while all six client xterms are warm-mounted but hidden causes zero renderer scheduler work, then drive 180 timed real-PTY spinner frames through a second production `session.tabs.subscribeAll` transport and the real Zustand store. Each worktree must publish and apply only its exact initial-working and final-idle titles. Both topologies ordinary-park five xterms without enabling the lossy retention budget, assert bounded cells/heap/timer lag, then restore the bounded authoritative tail exactly once on the original PTY including output produced while parked and continued input/output. The headed oracle additionally keeps every remote target workspace and terminal unmounted in the host renderer before and after client recovery. Production-parity React contracts reproduce and remove the independent cold-park watcher/title feedback loop, including memo-cache discard, StrictMode cleanup replay, detached split-PTY replacement, and the zero-park fast path. A deterministic cross-boundary contract drives 24 real PTY trackers in distinct worktrees through 2,880 decorative spinner and bare-native redraw chunks and counts host publications, serialized bytes, renderer apply calls, and store mutations while preserving exact per-PTY raw chunks and per-worktree semantic transitions. Fake-clock continuation beyond the 30-minute stale boundary requires one deduplicated refresh per worktree every 15 minutes, globally spaced by at least 50 ms, with every mirrored working status still fresh. Exact-identical Pi plus rotating normalized Pi/Grok frames renew coarse working/permission state; rich prompt/tool/question fields retain their original 30-minute lease, and `stateStartedAt`/acknowledgement identity remain stable across title/hook source swaps. A separate headed desktop-client journey relaunches the host main process while retaining the daemon and a daemon-backgrounded PTY, then requires first-observation foreground sync and continued input/output on the same PTY. Unit coverage keeps layout versions out of snapshot output high-waters when a restored snapshot has no output sequence and retries an existing subscriber only after authoritative provider inventory proves the retained PTY exists. Separate headed/headless ACK-starvation tests recover one stalled stream without replacing its PTY. A headed output-drop oracle proves a successful snapshot probe cannot certify a stale live stream when the authoritative PTY sequence advanced beyond the client high-water. Unit coverage requires an unsequenced client to establish a first-probe baseline, remain attached at the same sequence, and recover only after a later probe advances. A capability-disabled run proves legacy hosts retain the prior lossy limit/TTL fallback. Unit tests cover exact-owner capability routing, raw-stream release, singleton side-effect facts with timed handoff cleanup, 64 simultaneous synthetic-title sources with zero decorative client events after convergence, per-client late-subscribe recovery, semantic bell/title transitions, local animation-frame preservation, legacy no-output-pause delivery gating with exact snapshot restore, provider-authoritative snapshots, 128 active streams plus retry after a 129th-stream capacity rejection, capacity-pressure backoff, full split-leaf remint reconciliation, truncation, and manual-disconnect queue fencing. Linux, Windows, live SSH, and production-scale paired hosts remain gaps.",
"motivatingLinks": [
"https://github.com/stablyai/orca/issues/8652",
"https://github.com/stablyai/orca/pull/10625"
],
"invariant": "A host advertising terminal.paired-parking.v1 keeps the PTY and bounded authoritative history alive while an ordinary hidden-view park destroys the client xterm and releases its raw per-PTY stream. Reveal must restore up to the requested 5,000 rows, parked-time side effects/output, the same PTY identity, and continued input/output. Parked watcher synchronization compares parking semantics rather than fresh object identity, owns setup and cleanup across StrictMode replay, reconciles real PTY/layout changes, and performs no terminal-state scan when nothing is parked. After a host main-process relaunch, unknown local delivery-sync state must not be treated as proof that a surviving daemon PTY is already foregrounded. If subscription precedes provider readiness, authoritative inventory must reconsider that existing subscriber without spawning, resizing, or changing reconnect state. A snapshot without an output high-water must keep it unknown rather than borrowing a layout version that can suppress newer live output. Hosts without the capability must gate hidden raw output before xterm scheduling and repaint from the authoritative snapshot on reveal while retaining the existing limit/TTL force-parking fallback. After the first semantic title state, decorative spinner frequency must add zero paired client-event frames and zero full session-tabs work between status-freshness leases regardless of hidden worktree count. Continuous working or permission evidence may refresh each affected worktree once per 15 minutes through one globally spaced FIFO so current and legacy viewers do not decay before 30 minutes; sibling PTYs share that worktree refresh, while local title animation, raw output, and semantic title, status, bell, completion, and query facts remain intact. A paired terminal stream whose delivery credits stop progressing must replace only that stream; command silence first probes authoritative state and replaces the stream if the probe times out or proves the PTY advanced beyond the client's delivered output sequence. When no comparable delivery high-water exists, the first sequenced probe establishes a baseline and only later advancement proves staleness. A same-sequence snapshot remains valid proof of a responsive silent command. A successful status probe may replace a pre-ready shared-control socket without rejecting or duplicating calls already waiting for that transport. Manual disconnect must retain pairing while preventing queued or passive calls and subscriptions from recreating transport until explicit Connect.",
"oracle": "Run one byte-identical six-terminal oracle against an isolated headed desktop host and an isolated headless `orca serve` host. Stage at least 1,000,000 xterm cells, hide all six warm managers, emit an initial working title followed by 30 timed real-PTY spinner frames and a final idle title per worktree, and observe a second real session-tabs subscription plus the production renderer store. Require exactly two transport envelopes and two title mutations per worktree, no decorative title crossing either boundary, and positive decoded-envelope bytes. Enable ordinary parking with the lossy retention budget disabled, require exactly one mounted manager and five parked tabs, at most 45% retained cells, no more than 16 MiB heap growth, and under 500 ms timer drift. In headed mode, require the host renderer to remain on its original workspace with zero target terminal managers mounted throughout client park, reveal, and live I/O. While a tab is parked, require authoritative terminal.read to observe new PTY output; reveal it and require the original PTY, a marker within the requested 5,000-row history, the parked marker, and post-reveal input/output. Drive 24 real PTY title trackers in distinct worktrees through 40 decorative spinner frames each, then 40 spinner frames alternating with Cursor's bare native identity redraw, using fake clocks. Require all 2,880 raw chunks exactly and zero host session-tabs publications, serialized bytes, renderer apply calls, and renderer store mutations. Continue decorative evidence beyond 30 minutes, require exactly one refresh per worktree per 15-minute lease through a FIFO spaced by at least 50 ms, and require all 24 viewer statuses to remain working and fresh; then require one exact semantic idle transition and one visible-output chunk per PTY. Require ordinary and interior-Braille title changes to publish. Drive 64 host PTYs through ten 80 ms synthetic title frames, require zero paired client events after the first frame per PTY while all 640 local frames remain observable, attach a late client and require one current frame per PTY, then require semantic bell and idle transitions on both clients. Reconstruct a legacy subscribed stream with no outputPause capability, hide a chatty pane, require no hidden xterm writes, reveal it, and require one authoritative snapshot plus continued live output. Drop and acknowledge output only for one original paired-client stream, prove the fixture process consumed input while the host model advanced and the client stayed stale, then require the command snapshot probe to replace that stream, repaint exact fixture output, preserve authoritative PTY identity and target-tab cardinality, and resume live I/O. For a client without a delivered sequence, require the first numeric probe to establish a baseline without replacement, a same-sequence probe to remain attached, and a later advanced probe to replace only that stream. Withhold the first encrypted shared-control ready frame, start one RPC, trigger a status-probe refresh, and require two connections, one host delivery, successful response, and zero retained request bytes. Admit 128 active streams, reject the 129th as retryable, release one stream, then require the retry to attach and publish a snapshot without multiplying retained subscribers. Disable terminal.paired-parking.v1 and require the same oracle to fail before parking, while the legacy limit-one fallback separately passes. Also preserve truncated first paint, ACK-starved same-PTY recovery, responsive silent-command snapshot probes, dead-stream probe timeout recovery, and queued manual-disconnect fencing.",
"commands": [
"pnpm exec vitest run --config config/vitest.config.ts src/main/runtime/mobile-session-tabs-agent-status-heartbeat.test.ts src/main/runtime/orca-runtime-hook-agent-status-projection.test.ts tests/e2e/session-tabs-decorative-title-fanout.unit.test.ts tests/e2e/session-tabs-rich-status-boundaries.unit.test.ts --maxWorkers=1",
"pnpm exec vitest run --config config/vitest.config.ts src/renderer/src/components/terminal-pane/terminal-cold-park-pre-gate-loop.react185.test.tsx src/renderer/src/components/terminal-pane/use-parked-terminal-watcher-synchronization.react185.test.tsx src/renderer/src/components/terminal-pane/terminal-cold-park-verdict-loop.test.tsx src/renderer/src/components/terminal-pane/use-terminal-tab-cold-parking.test.ts --maxWorkers=1",
"pnpm exec vitest run --config config/vitest.config.ts src/main/runtime/orca-runtime.test.ts src/main/runtime/rpc/terminal-multiplex-initial-snapshot-buffering.test.ts src/main/runtime/rpc/terminal-multiplex-snapshot-serialization.test.ts src/main/runtime/rpc/terminal-multiplex-pty-wait-capacity.test.ts src/main/runtime/rpc/terminal-subscribe-buffer.test.ts src/renderer/src/components/terminal-pane/parked-terminal-byte-watcher.test.ts src/renderer/src/components/terminal-pane/terminal-side-effect-facts-handler.test.ts src/renderer/src/components/terminal-pane/pty-connection-hidden-output-restore.test.ts src/renderer/src/components/terminal-pane/pty-connection-parked-ssh-snapshot.test.ts src/renderer/src/components/terminal-pane/remote-runtime-pty-transport-activation-inventory-fallback.test.ts src/renderer/src/components/terminal-pane/terminal-hidden-view-parking.test.ts src/renderer/src/components/terminal-pane/terminal-hidden-worktree-retention.test.ts src/renderer/src/components/terminal-pane/terminal-parked-tab-watchers.test.ts src/renderer/src/components/terminal-pane/terminal-parked-watcher-reconciliation.test.ts src/renderer/src/components/terminal-pane/terminal-parked-watcher-partial-reconciliation.test.ts src/renderer/src/components/terminal-pane/terminal-parking-e2e-overrides.test.ts src/renderer/src/runtime/remote-runtime-terminal-stall-recovery.test.ts src/renderer/src/runtime/runtime-client-events.test.ts src/renderer/src/web/web-preload-api-runtime-environment.test.ts src/main/ipc/runtime-environments-pairing.test.ts",
"pnpm exec vitest run --config config/vitest.config.ts src/main/runtime/terminal-subscriber-driven-daemon-attach.test.ts",
"pnpm exec vitest run --config config/vitest.config.ts src/shared/remote-runtime-shared-control-connection.test.ts",
"pnpm exec vitest run --config config/vitest.config.ts src/renderer/src/runtime/remote-runtime-terminal-parse-backpressure.test.ts",
"pnpm exec vitest run --config config/vitest.config.ts src/main/ipc/pty-ipc-hidden-delivery-gate.test.ts",
"SKIP_BUILD=1 pnpm exec playwright test tests/e2e/paired-remote-terminal-host-restart-background-sync.spec.ts --config tests/playwright.config.ts --project electron-headless --workers=1",
"ORCA_E2E_FORWARD_APP_LOGS=1 SKIP_BUILD=1 pnpm exec playwright test tests/e2e/paired-remote-terminal-host-restart-background-sync.spec.ts --config tests/playwright.config.ts --project electron-headless --workers=1 --repeat-each=10 --max-failures=1",
"ORCA_E2E_WEB_CLIENT=1 SKIP_BUILD=1 pnpm exec playwright test tests/e2e/paired-remote-terminal-truncated-tail-first-paint.spec.ts --config tests/playwright.config.ts --project electron-headful --workers=1",
"ORCA_E2E_WEB_CLIENT=1 ORCA_E2E_DISABLE_PAIRED_TERMINAL_PARKING=1 SKIP_BUILD=1 pnpm exec playwright test tests/e2e/paired-remote-terminal-truncated-tail-first-paint.spec.ts --config tests/playwright.config.ts --project electron-headful --workers=1",
"ORCA_E2E_WEB_CLIENT=1 SKIP_BUILD=1 pnpm exec playwright test tests/e2e/paired-remote-terminal-stall-recovery.spec.ts --config tests/playwright.config.ts --project electron-headful --workers=1",
"ORCA_E2E_WEB_CLIENT=1 SKIP_BUILD=1 pnpm exec playwright test tests/e2e/paired-remote-terminal-probe-gap-recovery.spec.ts --config tests/playwright.config.ts --project electron-headful --workers=1",
"ORCA_E2E_WEB_CLIENT=1 SKIP_BUILD=1 pnpm exec playwright test tests/e2e/headless-paired-remote-terminal-stall-recovery.spec.ts --config tests/playwright.config.ts --project electron-headful --workers=1",
"ORCA_E2E_WEB_CLIENT=1 pnpm exec playwright test tests/e2e/paired-remote-terminal-retention-memory.spec.ts --config tests/playwright.config.ts --project electron-headful --workers=1",
"ORCA_E2E_WEB_CLIENT=1 SKIP_BUILD=1 pnpm exec playwright test tests/e2e/paired-remote-terminal-retention-memory.spec.ts --config tests/playwright.config.ts --project electron-headful --workers=1",
"ORCA_E2E_WEB_CLIENT=1 SKIP_BUILD=1 pnpm exec playwright test tests/e2e/headless-paired-remote-terminal-retention-memory.spec.ts --config tests/playwright.config.ts --project electron-headless --workers=1",
"SKIP_BUILD=1 pnpm exec playwright test tests/e2e/terminal-parked-memory.spec.ts --config tests/playwright.config.ts --project electron-headful --workers=1"
],
"testFiles": [
"src/main/runtime/mobile-session-tabs-agent-status-heartbeat.test.ts",
"src/main/runtime/orca-runtime-hook-agent-status-projection.test.ts",
"tests/e2e/session-tabs-decorative-title-fanout.unit.test.ts",
"tests/e2e/session-tabs-rich-status-boundaries.unit.test.ts",
"src/renderer/src/components/terminal-pane/terminal-cold-park-pre-gate-loop.react185.test.tsx",
"src/renderer/src/components/terminal-pane/use-parked-terminal-watcher-synchronization.react185.test.tsx",
"src/renderer/src/components/terminal-pane/terminal-cold-park-verdict-loop.test.tsx",
"src/renderer/src/components/terminal-pane/use-terminal-tab-cold-parking.test.ts",
"src/main/runtime/orca-runtime.test.ts",
"src/renderer/src/web/web-preload-api-runtime-environment.test.ts",
"src/main/ipc/runtime-environments-pairing.test.ts",
"src/main/runtime/rpc/terminal-multiplex-initial-snapshot-buffering.test.ts",
"src/main/runtime/rpc/terminal-multiplex-snapshot-serialization.test.ts",
"src/main/runtime/rpc/terminal-multiplex-pty-wait-capacity.test.ts",
"src/main/runtime/rpc/terminal-subscribe-buffer.test.ts",
"src/main/runtime/terminal-subscriber-driven-daemon-attach.test.ts",
"src/main/ipc/pty-ipc-hidden-delivery-gate.test.ts",
"src/renderer/src/components/terminal-pane/parked-terminal-byte-watcher.test.ts",
"src/renderer/src/components/terminal-pane/terminal-side-effect-facts-handler.test.ts",
"src/renderer/src/components/terminal-pane/pty-connection-hidden-output-restore.test.ts",
"src/renderer/src/components/terminal-pane/pty-connection-parked-ssh-snapshot.test.ts",
"src/renderer/src/components/terminal-pane/terminal-hidden-worktree-retention.test.ts",
"src/renderer/src/components/terminal-pane/terminal-hidden-view-parking.test.ts",
"src/renderer/src/components/terminal-pane/terminal-parked-tab-watchers.test.ts",
"src/renderer/src/components/terminal-pane/terminal-parked-watcher-reconciliation.test.ts",
"src/renderer/src/components/terminal-pane/terminal-parked-watcher-partial-reconciliation.test.ts",
"src/renderer/src/components/terminal-pane/terminal-parking-e2e-overrides.test.ts",
"src/renderer/src/runtime/remote-runtime-terminal-stall-recovery.test.ts",
"src/renderer/src/runtime/remote-runtime-terminal-parse-backpressure.test.ts",
"src/renderer/src/runtime/runtime-client-events.test.ts",
"src/renderer/src/components/terminal-pane/remote-runtime-pty-transport-activation-inventory-fallback.test.ts",
"src/shared/remote-runtime-shared-control-connection.test.ts",
"tests/e2e/paired-remote-terminal-truncated-tail-first-paint.spec.ts",
"tests/e2e/paired-remote-terminal-stall-recovery.spec.ts",
"tests/e2e/paired-remote-terminal-probe-gap-recovery.spec.ts",
"tests/e2e/headless-paired-remote-terminal-stall-recovery.spec.ts",
"tests/e2e/paired-remote-terminal-retention-memory.spec.ts",
"tests/e2e/headless-paired-remote-terminal-retention-memory.spec.ts",
"tests/e2e/terminal-parked-memory.spec.ts",
"tests/e2e/paired-remote-terminal-host-restart-background-sync.spec.ts"
],
"assertionRefs": [
{
"file": "src/main/runtime/mobile-session-tabs-agent-status-heartbeat.test.ts",
"assertions": [
"one globally spaced FIFO refreshes each continuously active worktree before status expiry",
"sibling PTYs deduplicate to one worktree refresh while semantic transitions bypass the queue",
"sole-source PTY teardown removes queued work while sibling PTY sources remain deduplicated",
"worktree, pending-queue, and timer state is removed on teardown"
]
},
{
"file": "src/main/runtime/orca-runtime-hook-agent-status-projection.test.ts",
"assertions": [
"a live pending question remains visible under the current live shell title but cannot cross a later working interval, identity-only owner title, or provider generation",
"inherited tool names, stale rows, resume-only rows, and unconfirmed restored rows cannot reopen a shell-reclaimed pane"
]
},
{
"file": "src/renderer/src/components/terminal-pane/terminal-cold-park-pre-gate-loop.react185.test.tsx",
"assertions": [
"parked terminal and unified-label title republication settles without a maximum-depth loop",
"equivalent semantic inputs remain stable when React discards memoized identities"
]
},
{
"file": "src/renderer/src/components/terminal-pane/use-parked-terminal-watcher-synchronization.react185.test.tsx",
"assertions": [
"StrictMode cleanup replay restores watcher ownership",
"detached split-PTY and layout replacement reconciles",
"unparked unrelated writes perform zero PTY-map reads"
]
},
{
"file": "tests/e2e/session-tabs-decorative-title-fanout.unit.test.ts",
"assertions": [
"2,880 decorative spinner and bare-native real-PTY OSC chunks publish zero session-tabs snapshots or serialized bytes after semantic convergence",
"the viewer performs zero snapshot applies and zero store mutations during decorative activity",
"after 30 minutes, one globally spaced refresh per worktree keeps every mirrored working status fresh",
"exact Pi and rotating normalized Pi/Grok frames renew explicit and fallback status without changing stateStartedAt or acknowledgement semantics",
"matching title evidence renews retained OSC hook status without resetting stateStartedAt, then drops unverifiable prompt metadata after the hook row expires",
"renderer-authored rich status keeps its original lease, then renews only coarse title-confirmed state and provider identity",
"ordinary-shell title transitions replace working stateStartedAt with the completion transition time",
"decorative heartbeats remain blocked until unknown foreground ownership resolves, then resume at the bounded interval",
"tracked terminal state reset clears delayed foreground ownership markers",
"raw chunks, semantic idle transitions, and visible output remain exact"
]
},
{
"file": "tests/e2e/session-tabs-rich-status-boundaries.unit.test.ts",
"assertions": [
"pending renderer, retained OSC, and live-hook questions survive the shell title that currently obscures them",
"a new working interval, provider generation, or identity owner strips the prior question"
]
},
{
"file": "src/main/runtime/terminal-subscriber-driven-daemon-attach.test.ts",
"assertions": ["retries an existing subscriber when provider inventory becomes ready"]
},
{
"file": "src/main/ipc/pty-ipc-hidden-delivery-gate.test.ts",
"assertions": [
"foregrounds a preserved daemon PTY after handler recreation loses sync memory exactly once"
]
},
{
"file": "src/main/runtime/rpc/terminal-multiplex-initial-snapshot-buffering.test.ts",
"assertions": ["keeps layout versions out of the output sequence domain"]
},
{
"file": "src/main/runtime/rpc/terminal-subscribe-buffer.test.ts",
"assertions": [
"omits an unknown snapshot output sequence instead of publishing the layout version"
]
},
{
"file": "tests/e2e/paired-remote-terminal-host-restart-background-sync.spec.ts",
"assertions": [
"preserves daemon PID and target PTY identity across the paired host relaunch",
"foregrounds the daemon-backgrounded target on its first post-relaunch remote observation",
"delivers target and post-relaunch control terminal input and live output"
]
},
{
"file": "tests/e2e/paired-remote-terminal-probe-gap-recovery.spec.ts",
"assertions": ["replaces a stale paired stream when the PTY snapshot advanced"]
},
{
"file": "tests/e2e/paired-remote-terminal-stall-recovery.spec.ts",
"assertions": [
"restarts one ACK-starved paired terminal stream without replacing its PTY"
]
},
{
"file": "tests/e2e/headless-paired-remote-terminal-stall-recovery.spec.ts",
"assertions": ["recovers an ACK-starved stream from an isolated headless Orca host"]
},
{
"file": "tests/e2e/paired-remote-terminal-truncated-tail-first-paint.spec.ts",
"assertions": [
"paints a paired remote terminal when only its retained text tail overflowed",
"legacy paired hosts retain the lossy hidden-manager budget fallback"
]
},
{
"file": "tests/e2e/paired-remote-terminal-retention-memory.spec.ts",
"assertions": [
"ordinary-parks paired terminals and restores authoritative host scrollback",
"warm-mounted hidden paired streams schedule zero renderer output work under sustained host output",
"six hidden real PTYs publish and apply only exact working and idle title transitions across paired transport",
"client recovery completes while every target terminal remains unmounted in the host renderer"
]
},
{
"file": "tests/e2e/headless-paired-remote-terminal-retention-memory.spec.ts",
"assertions": [
"ordinary-parks paired terminals against an isolated headless Orca host",
"cold-activates only visible paired terminals against an isolated headless host",
"the headless host bounds real-PTY decorative title transport and production store application",
"the headless host shares the zero-hidden-renderer-work and exact-restoration contract"
]
},
{
"file": "tests/e2e/terminal-parked-memory.spec.ts",
"assertions": [
"releases un-parkable hidden worktree buffers only once the retention budget engages"
]
},
{
"file": "src/renderer/src/components/terminal-pane/terminal-hidden-worktree-retention.test.ts",
"assertions": [
"treats a host-backed paired PTY as settled despite activation residue",
"preserves real startup work and non-paired activation guards",
"force-parks the least-recently-hidden candidates beyond the retention limit"
]
},
{
"file": "src/main/runtime/orca-runtime.test.ts",
"assertions": [
"forwards facts over the shared client-event stream without a desktop renderer",
"bounds decorative title delivery per paired client without reducing local frames",
"prefers provider history over a partial headless mirror for requested snapshots",
"falls back to the available mirror when authoritative provider history is unavailable",
"bounds a hung authoritative provider acquisition and reuses its fallback"
]
},
{
"file": "src/main/runtime/rpc/terminal-multiplex-snapshot-serialization.test.ts",
"assertions": [
"binary first paint remains valid when only retained history was truncated"
]
},
{
"file": "src/main/runtime/rpc/terminal-multiplex-pty-wait-capacity.test.ts",
"assertions": [
"admits 128 active streams, rejects the 129th, and reuses released capacity",
"reserves PTY wait capacity independently from active streams"
]
},
{
"file": "src/renderer/src/components/terminal-pane/parked-terminal-byte-watcher.test.ts",
"assertions": ["consumes host facts without a raw terminal stream for paired PTYs"]
},
{
"file": "src/renderer/src/components/terminal-pane/pty-connection-hidden-output-restore.test.ts",
"assertions": [
"pauses capable paired output while hidden and restores exactly on reveal",
"locally gates hidden paired output when a legacy host cannot pause it"
]
},
{
"file": "src/renderer/src/components/terminal-pane/pty-connection-parked-ssh-snapshot.test.ts",
"assertions": ["restores configured paired scrollback after an ordinary park reveal"]
},
{
"file": "src/renderer/src/components/terminal-pane/terminal-hidden-view-parking.test.ts",
"assertions": [
"selects only reachable hosts advertising the paired parking contract",
"accepts paired ptys only for the exact snapshot-capable owner",
"rejects paired, fail-open, foreign, and null ptys without capability evidence"
]
},
{
"file": "src/renderer/src/components/terminal-pane/remote-runtime-pty-transport-activation-inventory-fallback.test.ts",
"assertions": [
"keeps a mounted HUB mirror alive when the old stream ends before the replacement snapshot"
]
},
{
"file": "src/renderer/src/components/terminal-pane/terminal-parked-tab-watchers.test.ts",
"assertions": ["starts a fact watcher for snapshot-capable paired PTYs"]
},
{
"file": "src/renderer/src/components/terminal-pane/terminal-parked-watcher-partial-reconciliation.test.ts",
"assertions": [
"retains a continuing watcher and title while reconciling a reminted split leaf"
]
},
{
"file": "src/renderer/src/runtime/remote-runtime-terminal-stall-recovery.test.ts",
"assertions": [
"restarts only the stream whose renderer delivery credit never settles",
"probes then restarts a stream when an entered command receives no frames",
"keeps a silent responsive stream after its authoritative snapshot probe",
"restarts a stream when the authoritative snapshot advanced without live output",
"establishes a probe baseline before recovering an unsequenced stream",
"keeps a responsive stream when its probe confirms zero output high-water",
"classifies a capacity rejection followed by end as recoverable transport pressure"
]
},
{
"file": "src/renderer/src/web/web-preload-api-runtime-environment.test.ts",
"assertions": [
"keeps pairing while manual disconnect fences passive reconnects",
"fences a web runtime response that completes after manual disconnect",
"returns a disconnect envelope when a queued active runtime call disconnects",
"returns a disconnect envelope when a queued selected environment call disconnects"
]
}
],
"evidenceRuns": [
{
"date": "2026-08-10",
"runner": "local",
"platform": "macos",
"command": "pnpm exec vitest run --config config/vitest.config.ts src/renderer/src/components/terminal-pane/terminal-cold-park-pre-gate-loop.react185.test.tsx src/renderer/src/components/terminal-pane/use-parked-terminal-watcher-synchronization.react185.test.tsx src/renderer/src/components/terminal-pane/terminal-cold-park-verdict-loop.test.tsx src/renderer/src/components/terminal-pane/use-terminal-tab-cold-parking.test.ts --maxWorkers=1",
"result": "passed",
"durationSeconds": 1.56,
"summary": "All 16 production-parity parking/watcher contracts passed on the combined candidate, covering the maximum-depth loop, semantic stability, StrictMode ownership, split-PTY reconciliation, and zero-park fast path."
},
{
"date": "2026-08-10",
"runner": "local",
"platform": "macos",
"command": "ORCA_E2E_WEB_CLIENT=1 pnpm exec playwright test tests/e2e/paired-remote-terminal-retention-memory.spec.ts --config tests/playwright.config.ts --project electron-headful --workers=1",
"result": "passed",
"durationSeconds": 27.6,
"summary": "The isolated headed desktop host and separate encrypted paired client drove 180 timed decorative real-PTY titles across six hidden worktrees and observed exactly 12 semantic transport envelopes and 12 production store title mutations, then reduced six managers to one, stayed within heap/cell/timer budgets, restored the bounded host tail exactly, and continued input/output while the host renderer retained zero target managers."
},
{
"date": "2026-08-10",
"runner": "local",
"platform": "macos",
"command": "ORCA_E2E_WEB_CLIENT=1 SKIP_BUILD=1 pnpm exec playwright test tests/e2e/headless-paired-remote-terminal-retention-memory.spec.ts --config tests/playwright.config.ts --project electron-headless --workers=1",
"result": "passed",
"durationSeconds": 33.9,
"summary": "The isolated headless `orca serve` host passed the same six-worktree real-title transport/store bound, parking, and exact-restoration oracle; a second scenario proved cold activation mounted only the visible paired terminal."
},
{
"date": "2026-08-10",
"runner": "local",
"platform": "macos",
"command": "pnpm exec vitest run --config config/vitest.config.ts src/main/runtime/mobile-session-tabs-agent-status-heartbeat.test.ts src/main/runtime/orca-runtime-hook-agent-status-projection.test.ts tests/e2e/session-tabs-decorative-title-fanout.unit.test.ts tests/e2e/session-tabs-rich-status-boundaries.unit.test.ts --maxWorkers=1",
"result": "passed",
"durationSeconds": 5.62,
"summary": "Forty-two deterministic contracts passed. The real-PTY cross-boundary contract delivered all 2,880 decorative spinner and bare-native redraw chunks with zero hot-path host publications, serialized bytes, renderer applies, or store mutations; continued past 30 minutes with one globally spaced freshness refresh per worktree every 15 minutes; kept all 24 mirrored statuses working; and preserved stable stateStartedAt. Exact-identical Pi and rotating normalized Pi/Grok frames renewed renderer-authored and retained-hook status without changing acknowledgement semantics. Rich status could not cross task completion, permission, provider-generation, or identity-owner boundaries, while neutral titles preserved same-task prompt and acknowledgement identity until authoritative shell evidence. Fresh renderer, retained OSC, and live-hook questions remained visible under the current shell title, but a later working interval, identity-only owner title, or provider generation stripped them; inherited tools and stale, resume-only, restored, or prior-interval questions stayed suppressed. After each rich source's original lease expired, title evidence kept only coarse working state and provider identity fresh while dropping unverifiable prompts. Unknown foreground ownership held publications at zero until resolution, then resumed the bounded heartbeat; tracked terminal state reset removed its delayed marker. The focused heartbeat contracts proved worktree deduplication, FIFO fairness, semantic bypass, PTY-source teardown, and timer cleanup. Causal-disable controls made ownership, teardown, retained source-switch, renderer rich-TTL, completion-transition, boundary-ordering, and live-question oracles fail; restoring the production corrections returned green."
},
{
"date": "2026-08-07",
"runner": "local",
"platform": "macos",
"command": "pnpm exec vitest run --config config/vitest.config.ts src/main/runtime/terminal-subscriber-driven-daemon-attach.test.ts",
"result": "passed",
"durationSeconds": 4.29,
"summary": "All 10 subscriber-driven attach contracts passed. With two authoritative inventories overlapping one refused in-flight attach, removing only the post-settlement retry made the byte-identical focused assertion fail with one attach instead of two; restoring it retained one bounded waiter, retried once, and resumed live output on the existing stream."
},
{
"date": "2026-08-07",
"runner": "local",
"platform": "macos",
"command": "pnpm exec vitest run --config config/vitest.config.ts src/main/ipc/pty-ipc-hidden-delivery-gate.test.ts",
"result": "passed",
"durationSeconds": 5.84,
"summary": "The full PTY IPC file passed 449 tests, including one first-observation foreground sync after handler recreation and deduplication of the repeated presence signal."
},
{
"date": "2026-08-07",
"runner": "local",
"platform": "macos",
"command": "ORCA_E2E_FORWARD_APP_LOGS=1 SKIP_BUILD=1 pnpm exec playwright test tests/e2e/paired-remote-terminal-host-restart-background-sync.spec.ts --config tests/playwright.config.ts --project electron-headless --workers=1 --repeat-each=10 --max-failures=1",
"result": "passed",
"durationSeconds": 126,
"summary": "Ten consecutive isolated host-relaunch journeys preserved the daemon and PTY identities and resumed terminal input plus live output after the paired transport recovered."
},
{
"date": "2026-08-07",
"runner": "local",
"platform": "macos",
"command": "SKIP_BUILD=1 pnpm exec playwright test tests/e2e/paired-remote-terminal-host-restart-background-sync.spec.ts --config tests/playwright.config.ts --project electron-headless --workers=1",
"result": "passed",
"durationSeconds": 12.5,
"summary": "With the parking override captured by both host launches, the isolated headed host and separate paired desktop client retained the daemon PID and PTY ID across host relaunch, emitted one target foreground transition, and delivered target plus post-relaunch control input/output. The byte-identical run with only the unknown-state fix reverted failed at the missing target foreground transition."
},
{
"date": "2026-08-02",
"runner": "local",
"platform": "macos",
"command": "pnpm exec vitest run --config config/vitest.config.ts src/main/runtime/orca-runtime.test.ts src/main/runtime/rpc/terminal-multiplex-initial-snapshot-buffering.test.ts src/main/runtime/rpc/terminal-multiplex-snapshot-serialization.test.ts src/main/runtime/rpc/terminal-multiplex-pty-wait-capacity.test.ts src/main/runtime/rpc/terminal-subscribe-buffer.test.ts src/renderer/src/components/terminal-pane/parked-terminal-byte-watcher.test.ts src/renderer/src/components/terminal-pane/terminal-side-effect-facts-handler.test.ts src/renderer/src/components/terminal-pane/pty-connection-hidden-output-restore.test.ts src/renderer/src/components/terminal-pane/pty-connection-parked-ssh-snapshot.test.ts src/renderer/src/components/terminal-pane/remote-runtime-pty-transport-activation-inventory-fallback.test.ts src/renderer/src/components/terminal-pane/terminal-hidden-view-parking.test.ts src/renderer/src/components/terminal-pane/terminal-hidden-worktree-retention.test.ts src/renderer/src/components/terminal-pane/terminal-parked-tab-watchers.test.ts src/renderer/src/components/terminal-pane/terminal-parked-watcher-reconciliation.test.ts src/renderer/src/components/terminal-pane/terminal-parked-watcher-partial-reconciliation.test.ts src/renderer/src/components/terminal-pane/terminal-parking-e2e-overrides.test.ts src/renderer/src/runtime/remote-runtime-terminal-stall-recovery.test.ts src/renderer/src/runtime/runtime-client-events.test.ts src/renderer/src/web/web-preload-api-runtime-environment.test.ts src/main/ipc/runtime-environments-pairing.test.ts",
"result": "passed",
"durationSeconds": 18.71,
"summary": "Seventeen focused files passed 2,044 tests with one existing skip, including the 64-PTY decorative-title bound, per-client late subscription, semantic-fact preservation, and the true no-output-pause legacy client shape."
},
{
"date": "2026-08-02",
"runner": "local",
"platform": "macos",
"command": "ORCA_E2E_WEB_CLIENT=1 SKIP_BUILD=1 pnpm exec playwright test tests/e2e/paired-remote-terminal-retention-memory.spec.ts --config tests/playwright.config.ts --project electron-headful --workers=1",
"result": "passed",
"durationSeconds": 13.7,
"summary": "The isolated headed desktop host and encrypted paired web client kept hidden renderer work bounded, ordinary-parked five of six real PTYs, restored the authoritative tail once, preserved PTY identity, and resumed live input/output."
},
{
"date": "2026-08-02",
"runner": "local",
"platform": "macos",
"command": "ORCA_E2E_WEB_CLIENT=1 SKIP_BUILD=1 pnpm exec playwright test tests/e2e/headless-paired-remote-terminal-retention-memory.spec.ts --config tests/playwright.config.ts --project electron-headless --workers=1",
"result": "passed",
"durationSeconds": 31.4,
"summary": "Both isolated headless `orca serve` scenarios passed: ordinary parking restored authoritative history and cold activation mounted only the visible paired terminal."
},
{
"date": "2026-07-30",
"runner": "local",
"platform": "macos",
"command": "ORCA_E2E_WEB_CLIENT=1 SKIP_BUILD=1 pnpm exec playwright test tests/e2e/paired-remote-terminal-probe-gap-recovery.spec.ts --config tests/playwright.config.ts --project electron-headful --workers=1",
"result": "passed",
"durationSeconds": 17.3,
"summary": "The headed paired oracle dropped and acknowledged output only for the original client stream, proved the fixture consumed input while the host model advanced and the client stayed stale, then replaced the stream, repainted exact fixture output, preserved authoritative PTY identity and target-tab cardinality, and resumed live I/O."
},
{
"date": "2026-07-29",
"runner": "local",
"platform": "macos",
"command": "pnpm exec vitest run --config config/vitest.config.ts src/main/runtime/orca-runtime.test.ts src/main/runtime/rpc/terminal-multiplex-initial-snapshot-buffering.test.ts src/main/runtime/rpc/terminal-multiplex-snapshot-serialization.test.ts src/main/runtime/rpc/terminal-multiplex-pty-wait-capacity.test.ts src/main/runtime/rpc/terminal-subscribe-buffer.test.ts src/renderer/src/components/terminal-pane/parked-terminal-byte-watcher.test.ts src/renderer/src/components/terminal-pane/terminal-side-effect-facts-handler.test.ts src/renderer/src/components/terminal-pane/pty-connection-hidden-output-restore.test.ts src/renderer/src/components/terminal-pane/pty-connection-parked-ssh-snapshot.test.ts src/renderer/src/components/terminal-pane/remote-runtime-pty-transport-activation-inventory-fallback.test.ts src/renderer/src/components/terminal-pane/terminal-hidden-view-parking.test.ts src/renderer/src/components/terminal-pane/terminal-hidden-worktree-retention.test.ts src/renderer/src/components/terminal-pane/terminal-parked-tab-watchers.test.ts src/renderer/src/components/terminal-pane/terminal-parked-watcher-reconciliation.test.ts src/renderer/src/components/terminal-pane/terminal-parked-watcher-partial-reconciliation.test.ts src/renderer/src/components/terminal-pane/terminal-parking-e2e-overrides.test.ts src/renderer/src/runtime/remote-runtime-terminal-stall-recovery.test.ts src/renderer/src/runtime/runtime-client-events.test.ts src/renderer/src/web/web-preload-api-runtime-environment.test.ts src/main/ipc/runtime-environments-pairing.test.ts",
"result": "passed",
"durationSeconds": 19.54,
"summary": "Seventeen focused files passed 1,938 tests with one existing skip, including 128 active streams, retryable rejection at 129, released-slot snapshot recovery, bounded liveness probes, and balanced subscriber cleanup."
},
{
"date": "2026-07-29",
"runner": "local",
"platform": "macos",
"command": "ORCA_E2E_WEB_CLIENT=1 SKIP_BUILD=1 pnpm exec playwright test tests/e2e/paired-remote-terminal-truncated-tail-first-paint.spec.ts --config tests/playwright.config.ts --project electron-headful --workers=1",
"result": "passed",
"durationSeconds": 11.4,
"summary": "The headed paired-server scenario painted a truncated retained history after reload; the capability-disabled legacy fallback scenario is skipped unless explicitly selected."
},
{
"date": "2026-07-29",
"runner": "local",
"platform": "macos",
"command": "ORCA_E2E_WEB_CLIENT=1 SKIP_BUILD=1 pnpm exec playwright test tests/e2e/paired-remote-terminal-stall-recovery.spec.ts --config tests/playwright.config.ts --project electron-headful --workers=1",
"result": "passed",
"durationSeconds": 18,
"summary": "The byte-identical headed oracle exhausted one paired stream, proved host/client divergence, then repainted the marker while preserving the original PTY and tab."
},
{
"date": "2026-07-29",
"runner": "local",
"platform": "macos",
"command": "ORCA_E2E_WEB_CLIENT=1 SKIP_BUILD=1 pnpm exec playwright test tests/e2e/paired-remote-terminal-retention-memory.spec.ts --config tests/playwright.config.ts --project electron-headful --workers=1",
"result": "passed",
"durationSeconds": 14.5,
"summary": "Six real paired worktrees and host PTYs ordinary-parked five client xterms with the lossy budget disabled, released at least 55% of staged cells within heap and timer-lag budgets, then restored requested row 4,000, parked-time output, and live I/O on the original PTY while every target terminal remained unmounted in the host renderer."
},
{
"date": "2026-07-29",
"runner": "local",
"platform": "macos",
"command": "ORCA_E2E_WEB_CLIENT=1 SKIP_BUILD=1 pnpm exec playwright test tests/e2e/headless-paired-remote-terminal-stall-recovery.spec.ts --config tests/playwright.config.ts --project electron-headful --workers=1",
"result": "passed",
"durationSeconds": 14.4,
"summary": "An isolated `orca serve` host and paired web renderer exhausted one terminal stream, recovered it, and preserved the original PTY and tab without exposing readiness or pairing material."
},
{
"date": "2026-07-30",
"runner": "local",
"platform": "macos",
"command": "ORCA_E2E_WEB_CLIENT=1 SKIP_BUILD=1 pnpm exec playwright test tests/e2e/headless-paired-remote-terminal-retention-memory.spec.ts --config tests/playwright.config.ts --project electron-headless --workers=1",
"result": "passed",
"durationSeconds": 23,
"summary": "The isolated headless `orca serve` host passed ordinary parking plus cold activation: deferred tabs stayed unmounted until activation, preserved PTY identity and parked output, and resumed live input."
},
{
"date": "2026-07-29",
"runner": "local",
"platform": "macos",
"command": "ORCA_E2E_WEB_CLIENT=1 ORCA_E2E_DISABLE_PAIRED_TERMINAL_PARKING=1 SKIP_BUILD=1 pnpm exec playwright test tests/e2e/paired-remote-terminal-truncated-tail-first-paint.spec.ts --config tests/playwright.config.ts --project electron-headful --workers=1",
"result": "passed",
"durationSeconds": 18.6,
"summary": "A host without terminal.paired-parking.v1 preserved the existing lossy limit-one fallback, restored retained output, and continued PTY input/output."
},
{
"date": "2026-07-29",
"runner": "local",
"platform": "macos",
"command": "pnpm exec vitest run --config config/vitest.config.ts src/shared/remote-runtime-shared-control-connection.test.ts",
"result": "passed",
"durationSeconds": 3.16,
"summary": "All 27 encrypted shared-control tests passed. The new oracle was red on rc.1-equivalent behavior with the exact Refreshing remote runtime control transport error, then passed with one replacement connection, one delivered host RPC, and zero retained pending bytes."
},
{
"date": "2026-07-30",
"runner": "local",
"platform": "macos",
"command": "ORCA_E2E_WEB_CLIENT=1 SKIP_BUILD=1 pnpm exec playwright test tests/e2e/paired-remote-terminal-retention-memory.spec.ts --config tests/playwright.config.ts --project electron-headful --workers=1",
"result": "passed",
"durationSeconds": 17.5,
"summary": "The headed six-PTY oracle kept all warm-mounted hidden streams at zero renderer scheduler enqueues/drains under sustained output and under 500 ms timer lag, then restored the authoritative flood tail and parked/live markers exactly once."
}
],
"runtimeBudget": {
"p95Seconds": 360,
"scope": "focused units plus isolated headed paired-runtime and renderer-memory scenarios"
},
"flakeHistory": {
"status": "unknown",
"evidence": "The host-relaunch oracle passed a fresh 10-run local series. One earlier exploratory repeat timed out in transport recovery before terminal input/output assertions; it did not recur with forwarded app logs. A later Linux CI run reproduced missing live output when inventory overlapped the refused in-flight attach, which now has a deterministic unit oracle and is pending cross-platform rerun. Broader headed/headless parking coverage has no aggregated CI or soak history yet."
},
"redGreenEvidence": {
"status": "complete",
"evidence": "The six-PTY ordinary-parking oracle was red in two independently observed stages: the parked paired remount first used detached attach and restored only rows 5,963–5,999, then the requested snapshot still lost to the current-screen replay until park reveals explicitly entered the capability-gated reattach coordinator. The candidate is green on headed and headless hosts, while disabling terminal.paired-parking.v1 makes the byte-identical oracle fail at its capability precondition and leaves the separately tested legacy lossy fallback green. The parked-title production-parity control throws Maximum update depth exceeded on the affected parking synchronization and settles with semantic dependencies; forced memo-cache discard, StrictMode cleanup replay, and split-PTY replacement are independently red before their corrections and green on the combined candidate. The real-PTY session-tabs oracle produces 96 full snapshots, 64,032 serialized bytes, 96 renderer applies, and 96 store mutations on unmodified main and on a one-line causal revert before reaching the alternating native-title phase; the candidate produces zero in all four dimensions while preserving all 2,880 redraw chunks and 24 exact semantic transitions. The 64-PTY decorative-title control delivered 576 client events after convergence on unmodified main; the candidate delivers zero while preserving all 640 local frames, one current frame to a late client, and bell/idle transitions to both clients. The legacy no-output-pause control failed to request a reveal snapshot and kept hidden bytes on the xterm path; the candidate gates those bytes locally and restores one authoritative snapshot before live output. With stalled-stream recovery disabled, the host cursor advanced but the client remained frozen; enabling it repainted the marker with the same PTY and tab. The sequence-gap unit and headed paired oracle are red on current main and with only the new probe decision reverted: the authoritative host advances while the client stays stale after a successful probe. The candidate replaces the stream, repaints the marker, preserves PTY identity, and resumes I/O. Reverting the active-stream limit to 64 makes the exact 128-stream contract fail at 64; restoring 128 admits every intended stream, rejects 129, and reattaches it after one slot releases. The host-relaunch oracle fails when unknown delivery state is coerced to foregrounded or a layout version becomes an output high-water; the candidate foregrounds the preserved daemon PTY once and resumes same-PTY input/output. When authoritative inventory overlaps a refused in-flight attach, removing only the post-settlement retry leaves the existing subscriber without daemon output; the candidate retains one waiter across repeated inventory publications, retries exactly once, and restores live output."
},
"performanceBudget": {
"required": true,
"evidence": "Before ordinary parking, six warm-mounted hidden paired xterms receive zero raw frames and schedule zero renderer output drains while host models continue ingesting sustained output. The headed and headless production transports each admit only the initial and final semantic title snapshots per worktree across 180 timed decorative frames, and the real store performs only those 12 exact title mutations. Ordinary parking then retains the host PTY and bounded 5,000-row provider model while destroying five client xterms. Parked watcher synchronization is keyed by bounded parking semantics rather than fresh object identities; unrelated store writes perform zero PTY-map reads when no tab is parked, while parked reconciliation remains bounded by the worktree's terminal tabs and assignments. Decorative title ticks are collapsed both on the paired client-event channel and at the authoritative real-PTY session-tabs classifier before snapshot construction, serialization, transport, recovery, or store application; semantic facts remain exact. Headed and headless oracles require exact reduction from six managers to one, at least 55% staged xterm-cell release, no more than 16 MiB heap growth, and under 500 ms timer drift. The forced hidden-worktree retention policy keeps at most four otherwise un-parkable worktrees mounted and force-parks all after 15 minutes; the separate ordinary hot-retain policy keeps at most four recently visible worktrees warm for five minutes. Legacy hosts still gate hidden raw output before xterm scheduling and restore from a bounded snapshot on reveal. Stream recovery adds no polling and is scoped to one stream. Provider-ready reconciliation runs only for PTYs returned by a successful controller inventory, requires an existing remote subscriber, and retains at most one post-settlement waiter per PTY while attach deduplication remains active."
},
"promotionCriteria": [
"Collect 100 consecutive CI passes or 14 days of soak history for the headed and headless parking commands.",
"Run the paired topology on Windows and Linux and add one live SSH retention run.",
"Run the stream-stall oracle with a v1.4.160-rc.3 host and v1.4.160-rc.4 client.",
"Add a production-scale paired run with dozens of worktrees and explicit event-loop and renderer-memory budgets.",
"Keep the budget-off control, exact manager count, final bounded-tail flood marker, parked-time output, and post-reveal PTY input in both topology runs."
],
"knownGaps": [
"Paired reveal restores at most the requested 5,000 rows; older history is intentionally unavailable.",
"The scaled paired scenarios use six worktrees and ordinary-park five; they prove real host-backed eviction and buffer release, not a 100-worktree soak.",
"Display-off reveal latency is a separate atlas and viewport-reflow class and is not covered by this gate.",
"Historical field trace archives are still required to order replay-wedge events against renderer heartbeat loss and deduplicate archived records.",
"The legacy protocol shape is deterministic unit coverage; a packaged pre-v1.4.163 host has not yet run the full headed memory oracle.",
"The live windows-issues incident recorded two fast snapshot-probe successes while fresh output remained stale, but that release did not log the returned snapshot sequence; the deterministic sequence-gap oracle matches the observed false-health boundary without proving the field transport's lower-level drop mechanism."
],
"demotionRule": "Keep experimental or demote to protection none if decorative title frequency changes paired client-event or session-tabs publication volume after convergence, a semantic fact is dropped, paired first paint is blank, passive work reconnects after manual disconnect, a capable hidden paired manager survives ordinary parking, a legacy hidden pane schedules raw xterm output or bypasses its fallback, reveal loses requested bounded history or live PTY identity, retained buffer cells do not fall, or either headed/headless scenario flakes."
},
{
"id": "terminal-performance.no-hot-list-sessions",
"title": "Hot terminal interactions do not call global PTY session listing",
"maturity": "experimental",
"protection": "partial",
"owner": "terminal-performance",
"layer": "ipc-count-contract",
"surfaces": [
"typing",
"focus",
"tab switch",
"workspace switch",
"visibility resume",
"resize",
"render"
],
"platforms": ["macos", "linux", "windows"],
"providers": ["local", "daemon", "ssh", "wsl", "remote-runtime"],
"coveredPlatforms": ["macos"],
"coveredProviders": ["local", "ssh", "remote-runtime"],
"coverageNotes": "Platform-neutral unit coverage proves the Resource Manager closed badge performs one readiness seed, coalesces unknown spawn signals, skips known-session reattach signals, installs no interval, and re-reads only once per explicit daemon-management kill/restart. AI Vault tab-title sync uses bounded exact identities on the transcript-owning local, SSH, or runtime host and has no access to broad listing; unsupported older hosts retain persisted titles without fallback scans. WSL path translation still needs a Windows integration oracle.",
"motivatingLinks": [
"https://github.com/stablyai/orca/pull/7002",
"https://github.com/stablyai/orca/pull/6858",
"https://github.com/stablyai/orca/issues/9386",
"https://github.com/stablyai/orca/pull/9387",
"https://github.com/stablyai/orca/pull/12778"
],
"invariant": "Typing, focus, terminal switch, workspace switch, visibility resume, resize, render, per-pane liveness, and tab-title synchronization must not call global pty:listSessions or aiVault.listSessions; they must use targeted APIs or cached provider-owned state.",
"oracle": "The current executable slice asserts targeted visibility/first-input liveness, resize re-assertion after visibility resume, light tab/active-state resume, SSH/remote skip behavior, and a closed Resource Manager budget of one readiness seed plus one coalesced inventory read only for unknown spawn IDs. AI Vault title sync deterministically accepts only resolveSessionTitles, batches at most 64 exact identities, serializes worker work, routes requests to the transcript-owning local/SSH/runtime host, and proves zero broad scans for unsupported hosts. The full hot-path oracle still needs instrumentation around raw focus, split focus, workspace switch, render ticks, and high-session PTY fixtures.",
"commands": [
"pnpm exec vitest run --config config/vitest.config.ts src/main/ipc/pty-startup-barrier-and-listing.test.ts src/renderer/src/components/status-bar/use-resource-session-inventory.test.tsx src/renderer/src/components/status-bar/resource-session-inventory.test.ts src/renderer/src/components/status-bar/ResourceUsageStatusSegment.session-polling.test.ts",
"pnpm exec vitest run --config config/vitest.config.ts src/renderer/src/lib/ai-vault-tab-title-sync.test.ts src/main/ai-vault/session-scanner-worker-client.test.ts src/main/ai-vault/session-title-file-reader.test.ts src/main/ai-vault/session-parse-cache-persistence.test.ts src/main/ipc/ai-vault.test.ts src/main/runtime/rpc/methods/ai-vault.test.ts src/relay/ai-vault-handler.test.ts"
],
"testFiles": [
"src/main/ipc/pty-startup-barrier-and-listing.test.ts",
"src/renderer/src/components/status-bar/use-resource-session-inventory.test.tsx",
"src/renderer/src/components/status-bar/resource-session-inventory.test.ts",
"src/renderer/src/components/status-bar/ResourceUsageStatusSegment.session-polling.test.ts",
"src/renderer/src/lib/ai-vault-tab-title-sync.test.ts",
"src/main/ai-vault/session-scanner-worker-client.test.ts",
"src/main/ai-vault/session-title-file-reader.test.ts",
"src/main/ai-vault/session-parse-cache-persistence.test.ts",
"src/main/ipc/ai-vault.test.ts",
"src/main/runtime/rpc/methods/ai-vault.test.ts",
"src/relay/ai-vault-handler.test.ts"
],
"assertionRefs": [
{
"file": "src/renderer/src/components/status-bar/use-resource-session-inventory.test.tsx",
"assertions": [
"the false-to-true workspace readiness transition performs one daemon inventory seed",
"a failed readiness seed surfaces an error and a later inventory refresh recovers",
"known-session reattach signals perform zero additional inventory reads",
"multiple unknown background spawn signals coalesce to one inventory read",
"spawn signals during a slow inventory read never overlap provider-wide scans and cause at most one required follow-up",
"unknown sessions that exit before reconciliation cancel their queued inventory read",
"unmount during a slow inventory read cannot schedule follow-up work",
"exit and out-of-order refresh races cannot resurrect stale sessions",
"an explicit daemon-management invalidation performs exactly one inventory read, and none before readiness or after unmount"
]
},
{
"file": "src/main/ipc/pty-startup-barrier-and-listing.test.ts",
"assertions": ["global inventory starts local and SSH provider listings concurrently"]
},
{
"file": "src/renderer/src/components/status-bar/resource-session-inventory.test.ts",
"assertions": [
"daemon inventory construction copies its source and preserves count parity",
"single and batch removals preserve unrelated sessions and no-op references"
]
},
{
"file": "src/renderer/src/components/status-bar/ResourceUsageStatusSegment.session-polling.test.ts",
"assertions": [
"the closed inventory hook installs no interval",
"the badge count comes from cached daemon inventory rather than wake-hint bindings"
]
},
{
"file": "src/renderer/src/lib/ai-vault-tab-title-sync.test.ts",
"assertions": [
"title sync invokes only exact resolveSessionTitles requests",
"status pings and worktree path changes do not trigger rereads",
"title requests are bounded to 64 identities per batch",
"independent hosts resolve concurrently while each host wire stays serial"
]
},
{
"file": "src/main/ai-vault/session-scanner-worker-client.test.ts",
"assertions": [
"full scans and exact-title reads share one serial FIFO worker",
"active cancellation stays serialized and queued work remains bounded",
"worker faults restart queued work and idle time preserves incremental parse state",
"worker disposal rejects retained work and terminates the worker"
]
},
{
"file": "src/main/ai-vault/session-parse-cache-persistence.test.ts",
"assertions": [
"the background scanner receives the configured persisted-cache identity",
"unchanged transcripts remain reusable across process restarts"
]
},
{
"file": "src/main/ipc/ai-vault.test.ts",
"assertions": [
"exact title identities route to local, SSH, and runtime host authority",
"unsupported remote hosts return no refresh and never fall back to broad scans"
]
}
],
"evidenceRuns": [
{
"date": "2026-07-22",
"runner": "local",
"platform": "macos",
"command": "pnpm exec vitest run --config config/vitest.config.ts src/main/ipc/pty-startup-barrier-and-listing.test.ts src/renderer/src/components/status-bar/use-resource-session-inventory.test.tsx src/renderer/src/components/status-bar/resource-session-inventory.test.ts src/renderer/src/components/status-bar/ResourceUsageStatusSegment.session-polling.test.ts",
"result": "passed",
"durationSeconds": 4.3,
"summary": "4 files and 358 tests passed, covering readiness seed/recovery, zero interval polling, bounded unknown-spawn reconciliation, concurrent provider starts, exit fencing, cleanup, and out-of-order refresh fencing."
},
{
"date": "2026-08-09",
"runner": "local",
"platform": "macos",
"command": "pnpm exec vitest run --config config/vitest.config.ts src/renderer/src/lib/ai-vault-tab-title-sync.test.ts src/main/ai-vault/session-scanner-worker-client.test.ts src/main/ai-vault/session-title-file-reader.test.ts src/main/ai-vault/session-parse-cache-persistence.test.ts src/main/ipc/ai-vault.test.ts src/main/runtime/rpc/methods/ai-vault.test.ts src/relay/ai-vault-handler.test.ts",
"result": "passed",
"durationSeconds": 3.1,
"summary": "The focused run passed 112 tests across 7 files, proving exact-title-only renderer requests, provider-isolated batching, persistent serial worker lifecycle and fault recovery, exact transcript identity, host routing, mixed-version degradation, and zero broad-scan fallback."
}
],
"runtimeBudget": {
"p95Seconds": 20,
"scope": "unit or focused Electron count gate"
},
"flakeHistory": {
"status": "unknown",
"evidence": "Focused count tests now run locally; needs soak history before promotion."
},
"redGreenEvidence": {
"status": "partial",
"evidence": "Tests assert visibility resume prefers targeted hasPty over listSessions, first input after visibility resume calls targeted hasPty once, resize re-assertion after visibility resume uses getSize/resize without listSessions, light tab switches and visible active-state resume avoid listSessions/hasPty/getSize fanout, and the closed Resource Manager performs one readiness seed while known reattach signals and steady time perform no additional reads. For the #12778 regression, title sync no longer receives a listSessions dependency at all: it sends at most 64 exact identities per batch to one serial worker or transcript-owning remote host, and old hosts degrade without broad fallback. Needs broader raw focus/workspace-switch/render/high-session PTY count coverage before promotion."
},
"performanceBudget": {
"required": true,
"evidence": "This gate is the performance budget for global session listing in hot paths. AI Vault title sync permits zero global scans, at most 64 exact identities per request, one active worker operation, 16 queued operations, four concurrent transcript parses inside the worker, a 4,096-title index, and no worktree-path-triggered refresh. The worker emits the aiVault.scan.worker span with duration and session count for full scans."
},
"promotionCriteria": [
"Add deterministic call-count instrumentation.",
"Cover typing, focus, switch, visibility resume, resize, and render separately.",
"Run with enough preserved sessions/providers to make a broad listing observable."
],
"knownGaps": [
"Current commands cover Resource Manager readiness/lifecycle inventory counts; the broader targeted-liveness slice still lives on the pending fix-terminal-reliability stack.",
"Current coverage includes the closed Resource Manager's no-interval and known-reattach budgets, but not every hot interaction listed in the invariant.",
"No Electron or IPC-level high-session counter gate yet proves raw focus, workspace switch, render, or high-session typing stay at zero PTY listSessions calls.",
"The exact-title path has deterministic provider routing coverage but no packaged Windows WSL or live SSH performance run yet."
],
"demotionRule": "Cannot promote if the test allows broad listing in any hot interaction path."
},
{
"id": "terminal-observability.lifecycle-breadcrumbs",
"title": "Terminal lifecycle anomalies enter crash diagnostics as compact breadcrumbs",
"maturity": "experimental",
"protection": "partial",
"owner": "terminal-runtime",
"layer": "renderer-observability",
"surfaces": [
"terminal lifecycle",
"reattach",
"restore",
"replay-wedge identity",
"provider ownership",
"diagnostics bundle"
],
"platforms": ["macos", "linux", "windows"],
"providers": ["local", "daemon", "ssh", "wsl", "remote-runtime"],
"coveredPlatforms": ["macos"],
"coveredProviders": [],
"coverageNotes": "Renderer unit coverage proves replay-guard lost-completion and certified-wedge events carry correlatable tab, worktree, durable leaf, pane, and redacted PTY identity without exposing path-bearing values. Full provider lifecycle attribution and diagnostics-bundle artifact proof remain gaps.",
"motivatingLinks": [
"https://github.com/stablyai/orca/pull/6800",
"https://github.com/stablyai/orca/issues/6773"
],
"invariant": "Terminal lifecycle anomalies around reattach, restore, replay wedges, provider ownership, stale liveness, and fallback routing must leave compact, deduped, privacy-safe breadcrumbs in crash diagnostics so future reports can be attributed from evidence. Replay anomalies must distinguish pane managers and PTYs without recording path-bearing worktree or session identities.",
"oracle": "Drop a replay write completion while allowing its FIFO probe to parse, then require the lost-completion breadcrumb to include pane ID, stable hashes for tab/worktree/leaf identity, and a path-redacted PTY ID. Existing wedge tests require both lost-completion and certified-dead paths to record their distinct event names. Full pane transition traces and diagnostics-bundle artifact proof remain follow-ups.",
"commands": [
"pnpm exec vitest run --config config/vitest.config.ts src/renderer/src/components/terminal-pane/replay-guard.test.ts"
],
"testFiles": ["src/renderer/src/components/terminal-pane/replay-guard.test.ts"],
"assertionRefs": [
{
"file": "src/renderer/src/components/terminal-pane/replay-guard.test.ts",
"assertions": [
"records correlatable replay identity without exposing worktree or PTY paths",
"releases after the probe itself never parses (wedged pipeline) and reports it"
]
}
],
"evidenceRuns": [
{
"date": "2026-07-29",
"runner": "local",
"platform": "macos",
"command": "pnpm exec vitest run --config config/vitest.config.ts src/renderer/src/components/terminal-pane/replay-guard.test.ts",
"result": "passed",
"durationSeconds": 0.201,
"summary": "The focused file passed 29 tests; replay anomaly breadcrumbs preserved event classification while adding hashed tab/worktree/leaf correlation and a path-redacted PTY identity."
}
],
"runtimeBudget": {
"p95Seconds": 10,
"scope": "renderer observability unit test"
},
"flakeHistory": {
"status": "unknown",
"evidence": "The replay-guard unit slice passed locally once; no CI soak history yet."
},
"redGreenEvidence": {
"status": "partial",
"evidence": "Tests fail if replay anomalies stop recording their event name, omit pane/terminal correlation, or expose the fixture's path-bearing worktree and PTY prefixes. Needs diagnostics-bundle artifact proof and full transition-trace evidence before promotion."
},
"performanceBudget": {
"required": true,
"evidence": "Replay identity hashing is synchronous and only runs when replay writes are queued; it adds no polling or provider calls. Breadcrumb storage remains bounded by the existing crash reporter. Full trace buffers must include size and event-count caps before promotion."
},
"promotionCriteria": [
"Add full compact pane lifecycle trace buffer with event-count caps.",
"Prove diagnostics bundle includes recent terminal lifecycle breadcrumbs or traces.",
"Add forbidden-transition tests for stale close, unknown owner fallback, and stuck zero-size panes."
],
"knownGaps": [
"The replay identity schema has not yet been exercised in a live Electron/provider failure.",
"Current coverage records anomaly breadcrumbs only, not a full pane lifecycle state-machine trace.",
"Current coverage does not prove crash/diagnostics bundle export includes the breadcrumb.",
"Current coverage does not assert forbidden transitions across live Electron/provider flows."
],
"demotionRule": "Cannot promote if diagnostics are console-only, unbounded, or missing from support artifacts."
},
{
"id": "terminal-performance.output-backpressure-budget",
"title": "Terminal output backpressure stays bounded from daemon to renderer",
"maturity": "experimental",
"protection": "partial",
"owner": "terminal-performance",
"layer": "provider-ipc-renderer-perf",
"surfaces": [
"daemon stream",
"main PTY batching",
"runtime path provenance",
"runtime terminal wait detection",
"SSH relay frame decoding",
"SSH PTY source retention",
"SSH PTY reconnect waves",
"renderer ACK",
"xterm scheduler",
"hidden output"
],
"platforms": ["macos", "linux", "windows"],
"providers": ["local", "daemon", "ssh", "remote-runtime"],
"coveredPlatforms": ["macos"],
"coveredProviders": ["ssh"],
"coverageNotes": "Local macOS evidence covers main-process pending-output and projection-admission caps, runtime path-provenance history reuse, saturated-tail wait detection, direct-SSH source retention/accounting, always-on V1 negotiation with legacy peer fallback, exact provider-generation pause ownership, renderer exit/data ordering, decoder input bounds, bounded reconnect scheduling, and WSL stdio transport settlement through deterministic unit contracts. A joined main/runtime oracle exercises renderer-sourced headed semantics and headless-model snapshot semantics without launching a live paired server. Separately, a macOS-hosted Docker OpenSSH run exercises only the deployed Linux relay and direct SSH provider with an exact 256 KiB source-credit plateau, concurrent PTY typing, fixed-size filesystem frames, Git churn, and owner-lease reconnect. Neither deterministic topology labels nor Docker SSH constitute live headed desktop, headless orca serve, or physical WSL evidence; local/daemon, prior-version daemons, Windows named pipes/ConPTY, folder workspaces, and mixed-version clients also remain uncovered.",
"motivatingLinks": [
"https://github.com/stablyai/orca/pull/6836",
"https://github.com/stablyai/orca/pull/6858",
"https://github.com/stablyai/orca/pull/7002",
"https://github.com/stablyai/orca/pull/7054"
],
"invariant": "High-volume terminal output must stay bounded across daemon socket writes, SSH relay writer/decoder/source retention/reconnect, main model and projection admission, runtime metadata, detectors, and tail checks, main-to-renderer in-flight bytes, renderer scheduler queues, and hidden-output restore without starving focused input. Every new SSH session offers V1 and every same-build relay supports it; legacy delivery is reachable only when capability negotiation proves the peer cannot use V1. Negotiated SSH spans remain exact and contiguous through activation, exit, cancellation, recovery, desktop projection, and required remote replacement; provisional activation data cannot project, reconnect may release it only into the exact attempt's private recovery quarantine after contract validation, and exit seals that quarantine against later same-token frames until ordered admission or exact cancellation proof. Reconnect checkpoint capture freezes exact provider-generation/PTy admission, cancels queued old work, and waits for the running raw completion before exposing its accepted checkpoint; timeout or failure detaches only that PTy's old model, makes the checkpoint unavailable, and releases the bounded fence without closing the shared provider, while the same failure outside an active exact migration remains generation-fatal and overlapping reconnects preserve any earlier outstanding fence. Pending renderer projection IDs are capped and compacted across split remainders, exit preparation owns its renderer fence through finalization, exit-time cancellation transfers published projections before proof commit, generation close fences late proof while draining exact projection waiters, closed-generation identity compacts without weakening stale rejection, canceled source-delivery retirement retains at most one ordered token per PTY, and pause/resume targets only the exact provider generation. Additional subscribers cannot stall the owner, while the required legacy primary retains backpressure.",
"oracle": "The current executable slice injects main-process renderer backlog pressure, then asserts unchanged path-provenance history reuse for pathless output, ordinary terminal-wait detection without a joined-tail allocation and with full prompt-family continuity, per-PTY and total pending-output caps, a 1,024-ID projection cap with split-remainder compaction, preserved sequenced-tail metadata, active-pending protection ahead of background trimming, exact provider-generation pause ownership, renderer exit/data ordering, and ACK-gated in-flight bounds. The negotiation seam proves every initial connection and reconnect offers V1, the same-build relay advertises V1 without launch flags, old clients remain token-free, and method-not-found peers fall back without installing source ACK publication. The joined source-intake/multiplex oracle blocks renderer or headless serialization, admits one snapshot-covered span and one trailing span, requires replacement reservation only after the authoritative sequence is known, advances upstream ACK eligibility exactly to the covered boundary after SnapshotEnd, and delivers then ACKs the trailing span through the ordinary live path without cancellation. Source-range ledger and multiplex seams additionally require cumulative byte ACK 40 then 100 for one 100-byte frame to release exact byte credit without early source settlement, admit a contiguous higher-generation recovered token while the prior token remains unsettled, and reject stale stream or source generations without releasing in-flight byte credit. Replacement reservation rolls back every earlier span on a later failure, commit requires the exact frozen transfer states, and an authoritatively reclaimed covered span rejects commit without local trim authority while rollback removes the reservation idempotently. The exit-deadline oracle publishes a source-backed desktop projection, advances a fake clock to cancellation, and requires one projection transfer, proof commit, preparation, and final exit with no provider close, retained obligation, duplicate finalization, or process-lifetime cancellation tombstone; a second controlled proof remains pending across generation close and must never publish final exit, while both paths release the renderer preparation lease exactly once. The model-migration oracle accepts span A, blocks span B's raw emulator completion, begins disconnect migration, and proves no checkpoint or reconnect attach can remain at A; releasing B advances the exact checkpoint to B and projects B once. Its fake-clock arm reaches the 10-second deadline, requires checkpoint-unavailable, one exact model reset, zero retained admission charge and timers, and no effect from late raw settlement. Its two-PTY failure arm rejects one running raw callback under an active exact migration and requires one checkpoint-unavailable result, one model reset, zero provider closes, retained sibling checkpoint and transport liveness, zero charges and timers, and an unaffected other generation; a non-migrating sibling oracle still requires generation close. The intake additionally closes 2,048 sequential provider generations into one exact range, rejects stale events across that range, and preserves an out-of-order live gap until its own close. Direct-SSH contracts additionally prove activation-response settlement before the first source frame, claim-gated projection under same-decoder-turn response/data delivery, exact early-ACK reservation through send settlement or same-token retry, recovery completion visible before lease-held frames transfers those frames only into the private quarantine and admits no output until exact checkpoint-to-recoveryEnd coverage, invalid-checkpoint restore retention through response settlement followed by fresh-token retry and one live source frame, isolated saturated-subscriber eviction with healthy owner liveness, preserved legacy-primary backpressure, one-write ownership across write(false)/drain, control selection ahead of queued ordinary PTY input with FIFO lanes and bounded fairness, liveness rebasing, failed-exit retention through late ACK or exact recovery, response-settlement cancellation authority, token-scoped exit cancellation, exact checkpoint-to-recoveryEnd continuity, stale-owner one-shot retry, no physical PTY teardown on recovery failure, exact provider-generation closure and once-only cleanup when recovery cancellation publication or proof rejects, 16 MiB-plus-1 MiB decoder caps, charged per-PTY/session retention budgets, and eight-wide isolated reattach. The live Electron perf oracle adds hidden-output floods, renderer scheduler queue depth, dropped-output-zero normal scenarios, and active key latency budgets before promotion.",
"commands": [
"pnpm exec vitest run --config config/vitest.config.ts src/main/ipc/pty-renderer-inflight-credit.test.ts src/main/ipc/pty-global-renderer-credit.test.ts src/main/ipc/pty-output-batching-drain.test.ts src/main/ipc/pty-ipc-producer-flow-control.test.ts",
"pnpm exec vitest run --config config/vitest.config.ts src/main/ipc/pty-pending-projection-admissions.test.ts src/main/ipc/ssh-pty-legacy-projection.test.ts src/main/ipc/ssh-pty-model-admission.test.ts --reporter=dot",
"pnpm exec vitest run --config config/vitest.config.ts src/main/runtime/orca-runtime-path-candidate-history.test.ts",
"pnpm exec vitest run --config config/vitest.config.ts src/main/runtime/orca-runtime.test.ts src/main/runtime/orca-runtime-tail-wait-memo.test.ts",
"pnpm exec vitest run --config config/vitest.config.ts src/main/providers/ssh-pty-provider.test.ts src/main/providers/ssh-pty-source-delivery-ledger.test.ts src/main/ssh/ssh-pty-retired-source-deliveries.test.ts src/main/ssh/ssh-relay-session.test.ts src/main/ssh/ssh-relay-session-data-delivery.test.ts src/main/ssh/ssh-relay-session-recovery-races.test.ts src/main/ssh/ssh-relay-session-incarnation.test.ts src/main/ssh/ssh-relay-session-reconnect-incarnation.test.ts src/main/ssh/ssh-relay-session-terminal-error.test.ts src/main/ssh/ssh-pty-recovery-retention-budget.test.ts src/main/ssh/relay-protocol-backpressure.test.ts src/relay/protocol-backpressure.test.ts src/relay/pty-source-credit-ledger.test.ts src/relay/pty-source-credit-scheduler.test.ts src/relay/relay-pty-source-publication.test.ts src/relay/ssh-pty-source-credit-adapter.test.ts --reporter=dot",
"pnpm exec vitest run --config config/vitest.config.ts src/main/ipc/ssh-pty-model-admission.test.ts src/main/ipc/ssh-pty-output-model-migration.test.ts src/main/ssh/ssh-relay-session-model-migration.test.ts --reporter=dot",
"pnpm exec vitest run --config config/vitest.config.ts src/relay/git-response-stream-ownership.test.ts src/relay/pty-handler-output-streaming.test.ts --reporter=dot",
"pnpm exec vitest run --config config/vitest.config.ts src/main/providers/ssh-pty-notification-routing.test.ts src/main/providers/ssh-pty-provider-agent-session-create-operation.test.ts src/main/providers/ssh-pty-provider-exit-race.test.ts src/main/providers/ssh-pty-provider-reattach-incarnation.test.ts --reporter=dot",
"pnpm exec vitest run --config config/vitest.config.ts src/relay/relay-pty-source-recovery-interleavings.test.ts src/relay/relay-pty-source-recovery-completion.test.ts src/relay/relay-pty-source-restore-retry.test.ts --reporter=dot",
"pnpm exec vitest run --config config/vitest.config.ts src/relay/dispatcher.test.ts src/relay/pty-handler-source-publication.test.ts --reporter=dot",
"pnpm exec vitest run --config config/vitest.config.ts src/main/ssh/ssh-relay-session-recovery-races.test.ts --reporter=dot",
"pnpm exec vitest run --config config/vitest.config.ts src/main/ipc/ssh-pty-legacy-projection.test.ts --reporter=dot",
"pnpm exec vitest run --config config/vitest.config.ts src/main/ipc/ssh-pty-remote-source-range-consumers.test.ts src/main/runtime/rpc/terminal-source-range-ledger.test.ts src/main/runtime/rpc/terminal-multiplex-source-range-admission.test.ts --reporter=dot",
"pnpm exec vitest run --config config/vitest.config.ts src/shared/pty-consumer-session.test.ts src/main/ipc/ssh-pty-output-intake.test.ts src/main/ipc/ssh-pty-output-exit-deadline.test.ts src/main/ipc/ssh-pty-remote-source-range-consumers.test.ts src/main/runtime/rpc/terminal-multiplex-source-range-admission.test.ts src/main/ssh/ssh-multiplexer-transport-writer.test.ts src/main/ssh/ssh-channel-multiplexer.test.ts src/main/ssh/ssh-relay-deploy.test.ts src/relay/dispatcher-client-writer.test.ts --reporter=dot",
"pnpm exec vitest run --config config/vitest.config.ts src/shared/pty-consumer-session.test.ts src/main/ipc/ssh-pty-output-intake.test.ts src/main/ipc/ssh-pty-output-generation-guard.test.ts src/main/ipc/ssh-pty-output-exit-deadline.test.ts src/main/ipc/ssh-pty-remote-source-range-consumers.test.ts src/main/runtime/rpc/terminal-multiplex-source-range-admission.test.ts src/main/ssh/ssh-multiplexer-transport-writer.test.ts src/main/ssh/ssh-channel-multiplexer.test.ts src/main/ssh/ssh-channel-multiplexer-backpressure.test.ts src/main/ssh/ssh-relay-deploy.test.ts src/relay/dispatcher-client-writer.test.ts --reporter=dot",
"pnpm exec vitest run --config config/vitest.config.ts src/relay/relay-pty-source-restore-retry.test.ts src/main/ssh/ssh-relay-session-recovery-races.test.ts src/main/runtime/rpc/terminal-source-range-ledger.test.ts src/main/runtime/rpc/terminal-multiplex-source-range-admission.test.ts src/main/ssh/ssh-multiplexer-transport-writer.test.ts src/main/ssh/ssh-channel-multiplexer-backpressure.test.ts src/main/providers/ssh-pty-notification-routing.test.ts src/main/providers/ssh-pty-source-delivery-ledger.test.ts src/main/ssh/ssh-pty-retired-source-deliveries.test.ts src/main/providers/ssh-pty-provider-agent-session-create-operation.test.ts src/main/providers/ssh-pty-provider-exit-race.test.ts src/main/ipc/ssh-pty-output-exit-deadline.test.ts src/main/ipc/ssh-pty-remote-source-range-consumers.test.ts --reporter=dot",
"pnpm exec vitest run src/main/providers/ssh-pty-notification-routing.test.ts src/main/providers/ssh-pty-provider-exit-race.test.ts src/main/ssh/ssh-relay-session-data-delivery.test.ts src/main/ssh/ssh-relay-session-recovery-races.test.ts src/main/ssh/ssh-relay-session-reconnect-incarnation.test.ts src/main/ssh/ssh-relay-session-incarnation.test.ts src/main/ssh/ssh-relay-session.test.ts --reporter=dot",
"pnpm exec vitest run --config config/vitest.config.ts src/main/ssh/ssh-relay-session.test.ts src/main/ssh/ssh-relay-session-data-delivery.test.ts src/main/ssh/ssh-relay-session-reconnect-incarnation.test.ts src/main/ssh/ssh-relay-deploy.test.ts src/relay/ssh-pty-consumer-session-adapter.test.ts src/main/persistence-ssh-targets-and-pane-keys.test.ts --reporter=dot",
"pnpm exec vitest run --config config/vitest.config.ts src/main/providers/ssh-pty-notification-routing.test.ts src/main/providers/ssh-pty-provider-reattach-incarnation.test.ts src/relay/relay-pty-source-recovery-interleavings.test.ts src/main/ssh/ssh-relay-deploy.test.ts src/main/ssh/ssh-relay-session-data-delivery.test.ts --reporter=dot",
"pnpm exec vitest run --config config/vitest.config.ts src/main/agent-hooks/wsl-hook-relay-sentinel.test.ts --reporter=dot",
"ORCA_E2E_SSH_DOCKER=1 SKIP_BUILD=1 pnpm exec playwright test tests/e2e/ssh-docker-relay-perf.spec.ts --config tests/playwright.config.ts --project electron-headless --workers=1",
"ORCA_E2E_SSH_DOCKER=1 pnpm exec playwright test tests/e2e/ssh-docker-relay-perf.spec.ts --config tests/playwright.config.ts --project electron-headless --workers=1",
// Historical evidence commands; the override is ignored after the always-on transition.
"ORCA_E2E_SSH_DOCKER=1 ORCA_SSH_PTY_SOURCE_CREDIT_V1=1 SKIP_BUILD=1 pnpm exec playwright test tests/e2e/ssh-docker-relay-perf.spec.ts --config tests/playwright.config.ts --project electron-headless --workers=1",
"ORCA_E2E_SSH_DOCKER=1 ORCA_SSH_PTY_SOURCE_CREDIT_V1=1 pnpm exec playwright test tests/e2e/ssh-docker-relay-perf.spec.ts --config tests/playwright.config.ts --project electron-headless --workers=1"
],
"testFiles": [
"src/main/ipc/pty-renderer-inflight-credit.test.ts",
"src/main/ipc/pty-global-renderer-credit.test.ts",
"src/main/ipc/pty-output-batching-drain.test.ts",
"src/main/ipc/pty-ipc-producer-flow-control.test.ts",
"src/main/ipc/pty-pending-projection-admissions.test.ts",
"src/main/ipc/ssh-pty-legacy-projection.test.ts",
"src/main/runtime/orca-runtime-path-candidate-history.test.ts",
"src/main/runtime/orca-runtime.test.ts",
"src/main/runtime/orca-runtime-tail-wait-memo.test.ts",
"src/main/providers/ssh-pty-provider.test.ts",
"src/main/providers/ssh-pty-notification-routing.test.ts",
"src/main/providers/ssh-pty-source-delivery-ledger.test.ts",
"src/main/providers/ssh-pty-provider-agent-session-create-operation.test.ts",
"src/main/providers/ssh-pty-provider-exit-race.test.ts",
"src/main/providers/ssh-pty-provider-reattach-incarnation.test.ts",
"src/main/ssh/ssh-relay-session.test.ts",
"src/main/ssh/ssh-relay-session-data-delivery.test.ts",
"src/main/ssh/ssh-relay-session-model-migration.test.ts",
"src/main/ssh/ssh-relay-session-recovery-races.test.ts",
"src/main/ssh/ssh-relay-session-incarnation.test.ts",
"src/main/ssh/ssh-relay-session-reconnect-incarnation.test.ts",
"src/main/ssh/ssh-relay-session-terminal-error.test.ts",
"src/main/ssh/ssh-pty-recovery-retention-budget.test.ts",
"src/main/ssh/ssh-pty-retired-source-deliveries.test.ts",
"src/main/ssh/relay-protocol-backpressure.test.ts",
"src/relay/protocol-backpressure.test.ts",
"src/relay/git-response-stream-ownership.test.ts",
"src/relay/pty-handler-output-streaming.test.ts",
"src/relay/pty-source-credit-ledger.test.ts",
"src/relay/pty-source-credit-scheduler.test.ts",
"src/relay/relay-pty-source-publication.test.ts",
"src/relay/relay-pty-source-recovery-interleavings.test.ts",
"src/relay/relay-pty-source-recovery-completion.test.ts",
"src/relay/relay-pty-source-restore-retry.test.ts",
"src/relay/dispatcher.test.ts",
"src/relay/pty-handler-source-publication.test.ts",
"src/relay/ssh-pty-source-credit-adapter.test.ts",
"src/shared/pty-consumer-session.test.ts",
"src/main/ipc/ssh-pty-model-admission.test.ts",
"src/main/ipc/ssh-pty-output-intake.test.ts",
"src/main/ipc/ssh-pty-output-model-migration.test.ts",
"src/main/ipc/ssh-pty-output-generation-guard.test.ts",
"src/main/ipc/ssh-pty-output-exit-deadline.test.ts",
"src/main/ipc/ssh-pty-remote-source-range-consumers.test.ts",
"src/main/runtime/rpc/terminal-source-range-ledger.test.ts",
"src/main/runtime/rpc/terminal-multiplex-source-range-admission.test.ts",
"src/main/ssh/ssh-multiplexer-transport-writer.test.ts",
"src/main/ssh/ssh-channel-multiplexer.test.ts",
"src/main/ssh/ssh-channel-multiplexer-backpressure.test.ts",
"src/main/ssh/ssh-relay-deploy.test.ts",
"src/main/persistence-ssh-targets-and-pane-keys.test.ts",
"src/relay/dispatcher-client-writer.test.ts",
"src/main/agent-hooks/wsl-hook-relay-sentinel.test.ts",
"tests/e2e/ssh-docker-relay-perf.spec.ts"
],
"assertionRefs": [
{
"file": "src/main/ipc/pty-renderer-inflight-credit.test.ts",
"assertions": ["total renderer in-flight output is capped across many PTYs"]
},
{
"file": "src/main/ipc/pty-global-renderer-credit.test.ts",
"assertions": ["active PTY pending output is prioritized during renderer backpressure"]
},
{
"file": "src/main/ipc/pty-output-batching-drain.test.ts",
"assertions": ["combined pending output exceeding the interactive size limit is batched"]
},
{
"file": "src/main/ipc/pty-ipc-producer-flow-control.test.ts",
"assertions": [
"reconnect replacement cannot redirect pause or resume away from the exact provider generation",
"data arriving while SSH exit waits for renderer projection settlement cannot follow exit preparation"
]
},
{
"file": "src/main/ipc/pty-pending-projection-admissions.test.ts",
"assertions": [
"pending projection IDs retain exactly 1,024 entries then transfer the full ordered run",
"published prefixes compact before append while transfer state survives every split remainder"
]
},
{
"file": "src/main/ipc/ssh-pty-legacy-projection.test.ts",
"assertions": [
"split projection publication remains pending until its exact display and accounting ranges are fully published"
]
},
{
"file": "src/main/runtime/orca-runtime-path-candidate-history.test.ts",
"assertions": [
"reuses path-candidate history across repeated pathless PTY output",
"copies history when new output adds a path candidate"
]
},
{
"file": "src/main/runtime/orca-runtime-tail-wait-memo.test.ts",
"assertions": [
"does not rebuild or repeatedly scan an ordinary saturated tail",
"memoized stamping matches recompute reference: blocked prompt split across chunks",
"stays equivalent across tail eviction beyond the retained cap"
]
},
{
"file": "src/main/runtime/orca-runtime.test.ts",
"assertions": [
"returns a blocked wait result for Codex update prompts",
"returns a blocked wait result for Codex workspace trust prompts",
"returns a blocked wait result for generic Codex interactive prompts",
"resolves tui-idle when a stale Codex prompt is followed by the ready header"
]
},
{
"file": "src/main/providers/ssh-pty-notification-routing.test.ts",
"assertions": [
"provisional source frames remain unprojected and are discarded on rollback",
"held and later recovery frames route only to the private sink until final commit, without ordinary listeners or live PTY publication",
"exact source frames use their immutable incarnation without invoking or mutating the legacy incarnation resolver",
"exit during private recovery retires the activation ledger at final commit and rejects late same-token frames",
"private recovery retirement restores the exact predecessor without issuing a second cancellation",
"older rollback cancels only its exact token without replacing a newer activation"
]
},
{
"file": "src/main/providers/ssh-pty-source-delivery-ledger.test.ts",
"assertions": [
"exit seals a provisional or private-recovery lease against later same-token admission",
"a stale transfer retains rollback authority and requests exact cancellation instead of orphaning its token"
]
},
{
"file": "src/main/providers/ssh-pty-provider-agent-session-create-operation.test.ts",
"assertions": [
"same-decoder-turn source data waits for claim validation, failed claim rollback, and exact cancellation proof while a newer activation remains live"
]
},
{
"file": "src/main/providers/ssh-pty-provider-exit-race.test.ts",
"assertions": [
"exit before a fresh spawn reply drops provisional source data and settles exact cancellation"
]
},
{
"file": "src/main/providers/ssh-pty-provider-reattach-incarnation.test.ts",
"assertions": [
"source-credit restore-required generic reattach fails as expired instead of returning an outputless live PTY"
]
},
{
"file": "src/main/ssh/ssh-relay-session-reconnect-incarnation.test.ts",
"assertions": [
"fifty reattaches use at most eight workers and healthy siblings finish before one slow and one failed PTY",
"initial connection and automatic reconnect both offer source credit"
]
},
{
"file": "src/main/ssh/ssh-relay-session.test.ts",
"assertions": [
"each transient PTY failure is retried once without tearing down successful provider registration"
]
},
{
"file": "src/main/persistence-ssh-targets-and-pane-keys.test.ts",
"assertions": [
"retired per-target source-credit selections are removed during normalization"
]
},
{
"file": "src/main/ssh/ssh-relay-session-model-migration.test.ts",
"assertions": [
"overlapping reconnect attaches remain blocked behind the old-generation per-PTY model fence and receive only the post-completion exact checkpoint",
"stale-owner retry retains the old-generation fence through raw completion, then requests checkpoint-unavailable restore"
]
},
{
"file": "src/main/ssh/ssh-pty-recovery-retention-budget.test.ts",
"assertions": [
"fragmented recovery is bounded per PTY and per session in source units, charged bytes, and frames",
"UTF-16 string storage and record overhead are charged before aggregate admission"
]
},
{
"file": "src/relay/pty-source-credit-ledger.test.ts",
"assertions": [
"an exact early cumulative ACK reserves eligibility without advancing credit before send settlement and survives only an exact same-token retry",
"source retention charges max UTF-8 or UTF-16 storage plus one record",
"fragmented multi-PTY source, charged-byte, and frame caps bind independently"
]
},
{
"file": "src/relay/pty-source-credit-scheduler.test.ts",
"assertions": [
"one rejecting delivery is removed after one reservation attempt while prior and later peer reservations remain committed without head-of-line blocking"
]
},
{
"file": "src/relay/git-response-stream-ownership.test.ts",
"assertions": [
"an 8-byte encoded producer capacity emits exactly two 6-byte payload chunks and one end call while the first bulk write is saturated"
]
},
{
"file": "src/relay/pty-handler-output-streaming.test.ts",
"assertions": [
"a fresh plain pending entry after transformed source-only output omits inherited rawLength and completes in exactly three admission calls"
]
},
{
"file": "src/relay/dispatcher.test.ts",
"assertions": [
"a saturated legacy primary remains required backpressure and is never detached as an additional subscriber"
]
},
{
"file": "src/relay/pty-handler-source-publication.test.ts",
"assertions": [
"immutable spawn and attach activation identity settles before the first source frame in the response/data interleaving",
"one saturated additional subscriber is bounded and detached without pausing the native PTY or negotiated owner"
]
},
{
"file": "src/relay/relay-pty-source-recovery-interleavings.test.ts",
"assertions": [
"failed exit publication retains sealed delivery for late cumulative ACK and exact token recovery",
"exact owner recovery republishes exit without reopening source admission",
"a failed recovery-completion frame rolls back its fence and the next exact owner republishes it before live admission",
"failed activation response retains private retry authority, and exact retry clears activation only after successful settlement"
]
},
{
"file": "src/relay/relay-pty-source-recovery-completion.test.ts",
"assertions": [
"unadmitted recovery completion retries once writer capacity returns, stays single-flight, and releases its bounded capacity listener"
]
},
{
"file": "src/relay/relay-pty-source-restore-retry.test.ts",
"assertions": [
"invalid-checkpoint cancellation retains the exact delivery until restore response settlement, then retry mints a fresh activation and emits one live source frame"
]
},
{
"file": "src/main/ssh/relay-protocol-backpressure.test.ts",
"assertions": [
"main SSH decoder accepts one maximum frame plus 1 MiB partial input and rejects one extra byte",
"a throwing continuation clears retained input, releases one pause epoch, and publishes one typed ownership error"
]
},
{
"file": "src/relay/protocol-backpressure.test.ts",
"assertions": [
"relay decoder accepts one maximum frame plus 1 MiB partial input and rejects one extra byte",
"a throwing continuation clears retained input, releases one pause epoch, and publishes one typed ownership error"
]
},
{
"file": "src/main/ipc/ssh-pty-legacy-projection.test.ts",
"assertions": ["provider-generation close drains exact projection terminality waiters"]
},
{
"file": "src/main/ipc/ssh-pty-model-admission.test.ts",
"assertions": [
"disposal resumes every paused provider generation exactly once, including pause-only rejected entries",
"migration cancels queued old-generation work while retaining the one running raw completion",
"a callback failure outside migration closes its generation and rejects a sibling PTY admission"
]
},
{
"file": "src/main/ipc/ssh-pty-output-intake.test.ts",
"assertions": [
"exit remains behind accepted model, desktop projection, and required remote obligations",
"exit timeout cancels only the matching delivery and keeps unrelated provider work usable",
"desktop source identity and scanner facts commit atomically or roll back without credit",
"renderer exit preparation remains owned through finalization and releases on duplicate, failure, or generation close",
"2,048 monotonic provider closes compact into one exact stale-generation range while out-of-order live gaps remain admissible"
]
},
{
"file": "src/main/ipc/ssh-pty-output-model-migration.test.ts",
"assertions": [
"migration waits for blocked span B before exporting its checkpoint and projects B exactly once",
"migration timeout returns checkpoint-unavailable, resets one exact PTY model, and releases admission charge and timers before late raw settlement",
"migration-owned callback failure resets only the failed PTY while late settlement cannot advance it and sibling checkpoint, provider transport, and another generation remain live"
]
},
{
"file": "src/main/ipc/ssh-pty-output-generation-guard.test.ts",
"assertions": [
"sequential generation closure compacts to one exact range without weakening stale rejection",
"out-of-order closures expose the exact unclosed generation count below the closed high-water"
]
},
{
"file": "src/main/ipc/ssh-pty-output-exit-deadline.test.ts",
"assertions": [
"published projection transfer precedes cancellation-proof span reclamation with one preparation and final exit",
"generation close fences a pending cancellation proof from final exit and retained obligations"
]
},
{
"file": "src/main/ipc/ssh-pty-remote-source-range-consumers.test.ts",
"assertions": [
"replacement reserves only immutable spans whose retained model-sequence end is covered by the authoritative snapshot",
"renderer-sourced and headless-sourced replacement commits only after current-generation SnapshotEnd sequence coverage",
"partial replacement reservation rolls every prior exact transfer back to the live stream obligation",
"commit and rollback reject a transfer state replaced by concurrent mutation",
"a span reclaimed by cancellation proof rejects replacement commit without local trim authority, then exact rollback removes the reservation idempotently"
]
},
{
"file": "src/main/runtime/rpc/terminal-source-range-ledger.test.ts",
"assertions": [
"partial cumulative byte ACK releases exact credit while retaining the immutable covering source frame",
"a contiguous higher-generation recovery token is admitted while the prior token remains unsettled",
"stale stream and source generations cannot advance or replace the current ledger identity"
]
},
{
"file": "src/main/runtime/rpc/terminal-multiplex-source-range-admission.test.ts",
"assertions": [
"blocked renderer and headless snapshot serialization admits one covered and one trailing source span",
"SnapshotEnd makes exactly the covered span upstream-ACK eligible while the trailing span is delivered and ACKed live",
"snapshot replacement, trailing replay, and exit complete without provider cancellation or retained obligation",
"a partial cumulative byte ACK does not settle its source frame or detach the stream before recovered-token output",
"a parsed stale-generation ACK cannot release in-flight byte credit or flush queued output"
]
},
{
"file": "src/shared/pty-consumer-session.test.ts",
"assertions": [
"mismatched recovery is typed for one-shot fallback while the stale principal remains a subscriber and the retained principal and lease preserve recovery authority"
]
},
{
"file": "src/main/ssh/ssh-relay-session-data-delivery.test.ts",
"assertions": [
"the state-machine stale-owner error clears cached state and retries exactly once without resume",
"completion visible before lease-held recovery frames transfers those frames only into private quarantine and projects them once after exact checkpoint-to-recoveryEnd coverage and live handoff",
"invalid recovery cancels only its replacement token without physical PTY or ownership teardown"
]
},
{
"file": "src/main/ssh/ssh-relay-session-recovery-races.test.ts",
"assertions": [
"empty recovery retains recoveryEndSu as the first live-frame continuity anchor",
"validated token cancellation drops queued late frames without physical PTY teardown",
"after recovery quarantine ownership transfer, rejected cancellation publication or proof closes only the exact provider generation and releases its provider, publishers, mux, and activation state once",
"negative, credited-ahead, checkpoint-mismatched, and under-covering recovery cancellation proofs fail closed against the highest privately observed range",
"overlapping recovery never cancels on or mutates the replacement mux, checkpoint, lease, provider state, or ownership"
]
},
{
"file": "src/main/ssh/ssh-pty-retired-source-deliveries.test.ts",
"assertions": [
"10,000 ordered token cancellations for one PTY retain one latest-token retirement record",
"the next activation or PTY exit boundary clears only that PTY's retirement record"
]
},
{
"file": "src/main/ssh/ssh-multiplexer-transport-writer.test.ts",
"assertions": [
"write(false) owns one frame and later ordinary traffic waits for drain",
"queued control is selected before ordinary PTY backlog at drain while each lane remains FIFO",
"four-control fairness guarantees ordinary progress without starving control",
"one coalesced liveness bypass is allowed per saturated epoch",
"saturation and drain transitions are reported exactly once"
]
},
{
"file": "src/main/ssh/ssh-channel-multiplexer-backpressure.test.ts",
"assertions": [
"source ACK, cancellation, exit, request, and response control frames precede queued pasted PTY input after drain",
"control and ordinary frames preserve lane FIFO while ordinary input progresses after four control writes"
]
},
{
"file": "src/main/ssh/ssh-channel-multiplexer.test.ts",
"assertions": [
"self-imposed writer saturation suppresses false death and rebases both health clocks on drain"
]
},
{
"file": "src/relay/dispatcher-client-writer.test.ts",
"assertions": [
"encoded producer frames stay below high-water-minus-reserve capacity",
"one fixed-size filesystem compatibility frame is admitted only on an empty sink",
"control remains reserved while producer retention stays bounded"
]
},
{
"file": "src/main/agent-hooks/wsl-hook-relay-sentinel.test.ts",
"assertions": [
"WSL stdin forwards write(false), callback settlement, and drain without claiming a live WSL topology"
]
},
{
"file": "tests/e2e/ssh-docker-relay-perf.spec.ts",
"assertions": [
"a stalled renderer ACK produces an exact 256 KiB negotiated source-credit plateau while a second SSH PTY remains responsive",
"fixed-size filesystem frames and Git churn complete without stream corruption while active typing remains within budget",
"the negotiated owner lease reconnects and the existing SSH workspace terminal remains usable"
]
}
],
"evidenceRuns": [
{
"date": "2026-07-03",
"runner": "local",
"platform": "macos",
"command": "pnpm exec vitest run --config config/vitest.config.ts src/main/ipc/pty-renderer-inflight-credit.test.ts src/main/ipc/pty-global-renderer-credit.test.ts src/main/ipc/pty-output-batching-drain.test.ts src/main/ipc/pty-ipc-producer-flow-control.test.ts",
"result": "passed",
"durationSeconds": 1.5,
"summary": "1 test file(s) passed, 209 tests passed on main@1282f5c2d in a clean checkout."
},
{
"date": "2026-07-10",
"runner": "local",
"platform": "macos",
"command": "pnpm exec vitest run --config config/vitest.config.ts src/main/runtime/orca-runtime-path-candidate-history.test.ts",
"result": "passed",
"durationSeconds": 3.49,
"summary": "1 test file passed, 2 tests passed on the exact rebased tree based on main@dc468f0ded."
},
{
"date": "2026-07-10",
"runner": "local",
"platform": "macos",
"command": "pnpm exec vitest run --config config/vitest.config.ts src/main/runtime/orca-runtime.test.ts src/main/runtime/orca-runtime-tail-wait-memo.test.ts",
"result": "passed",
"durationSeconds": 21.33,
"summary": "2 test files passed, 609 tests passed on pushed commit 4fb14eac3897."
},
{
"date": "2026-07-29",
"runner": "local",
"platform": "macos",
"command": "pnpm exec vitest run --config config/vitest.config.ts src/main/providers/ssh-pty-provider.test.ts src/main/providers/ssh-pty-source-delivery-ledger.test.ts src/main/ssh/ssh-pty-retired-source-deliveries.test.ts src/main/ssh/ssh-relay-session.test.ts src/main/ssh/ssh-relay-session-data-delivery.test.ts src/main/ssh/ssh-relay-session-recovery-races.test.ts src/main/ssh/ssh-relay-session-incarnation.test.ts src/main/ssh/ssh-relay-session-reconnect-incarnation.test.ts src/main/ssh/ssh-relay-session-terminal-error.test.ts src/main/ssh/ssh-pty-recovery-retention-budget.test.ts src/main/ssh/relay-protocol-backpressure.test.ts src/relay/protocol-backpressure.test.ts src/relay/pty-source-credit-ledger.test.ts src/relay/pty-source-credit-scheduler.test.ts src/relay/relay-pty-source-publication.test.ts src/relay/ssh-pty-source-credit-adapter.test.ts --reporter=dot",
"result": "passed",
"durationSeconds": 2.24,
"summary": "Sixteen deterministic SSH relay/session/source/decoder files passed 192 tests, including exit-sealed private recovery, retained stale-transfer cancellation authority, exact private-frame proof watermarks, one retirement record across 10,000 same-PTY token rotations, stale-owner fallback, and scheduler rejection isolation; no live topology was exercised."
},
{
"date": "2026-07-29",
"runner": "local",
"platform": "macos",
"command": "pnpm exec vitest run --config config/vitest.config.ts src/relay/git-response-stream-ownership.test.ts src/relay/pty-handler-output-streaming.test.ts --reporter=dot",
"result": "passed",
"durationSeconds": 11.81,
"summary": "Two deterministic relay stream and PTY batching files passed 120 tests, including exact encoded chunk capacity and transformed-to-plain metadata isolation."
},
{
"date": "2026-07-28",
"runner": "local",
"platform": "macos",
"command": "pnpm exec vitest run --config config/vitest.config.ts src/main/ipc/ssh-pty-remote-source-range-consumers.test.ts src/main/runtime/rpc/terminal-source-range-ledger.test.ts src/main/runtime/rpc/terminal-multiplex-source-range-admission.test.ts --reporter=dot",
"result": "passed",
"durationSeconds": 7.17,
"summary": "Three deterministic main/runtime files passed 78 tests, including joined renderer/headless snapshot admission, exact partial cumulative credit, and recovered-token continuity; no live paired server or Docker topology was exercised."
},
{
"date": "2026-07-29",
"runner": "local",
"platform": "macos",
"command": "pnpm exec vitest run --config config/vitest.config.ts src/relay/relay-pty-source-restore-retry.test.ts src/main/ssh/ssh-relay-session-recovery-races.test.ts src/main/runtime/rpc/terminal-source-range-ledger.test.ts src/main/runtime/rpc/terminal-multiplex-source-range-admission.test.ts src/main/ssh/ssh-multiplexer-transport-writer.test.ts src/main/ssh/ssh-channel-multiplexer-backpressure.test.ts src/main/providers/ssh-pty-notification-routing.test.ts src/main/providers/ssh-pty-source-delivery-ledger.test.ts src/main/ssh/ssh-pty-retired-source-deliveries.test.ts src/main/providers/ssh-pty-provider-agent-session-create-operation.test.ts src/main/providers/ssh-pty-provider-exit-race.test.ts src/main/ipc/ssh-pty-output-exit-deadline.test.ts src/main/ipc/ssh-pty-remote-source-range-consumers.test.ts --reporter=dot",
"result": "passed",
"durationSeconds": 6.89,
"summary": "Thirteen current-head deterministic files passed 150 tests across exit-sealed private recovery, stale-transfer cancellation authority, bounded latest-token retirement, restore retirement, fail-closed recovery cancellation, partial ACK and token rotation, reclaimed-span replacement, mux lane fairness, provisional activation, and exit-proof ordering; no live topology was exercised."
},
{
"date": "2026-07-28",
"runner": "local",
"platform": "macos",
"command": "pnpm exec vitest run src/main/providers/ssh-pty-notification-routing.test.ts src/main/providers/ssh-pty-provider-exit-race.test.ts src/main/ssh/ssh-relay-session-data-delivery.test.ts src/main/ssh/ssh-relay-session-recovery-races.test.ts src/main/ssh/ssh-relay-session-reconnect-incarnation.test.ts src/main/ssh/ssh-relay-session-incarnation.test.ts src/main/ssh/ssh-relay-session.test.ts --reporter=dot",
"result": "passed",
"durationSeconds": 1.86,
"summary": "Seven current-worktree provider/session files passed 94 tests after a red deterministic seam reproduced completion visibility before lease-held recovery data; the candidate transfers held and later frames only into private recovery quarantine, final-commits after fence/admission, retires exited activation state, and preserves fail-closed malformed, gapped, overlapping, missing-body, cancellation-proof, and replacement behavior."
},
{
"date": "2026-07-28",
"runner": "local",
"platform": "macos",
"command": "pnpm exec vitest run --config config/vitest.config.ts src/main/providers/ssh-pty-notification-routing.test.ts src/main/providers/ssh-pty-provider-reattach-incarnation.test.ts src/relay/relay-pty-source-recovery-interleavings.test.ts src/main/ssh/ssh-relay-deploy.test.ts src/main/ssh/ssh-relay-session-data-delivery.test.ts --reporter=dot",
"result": "passed",
"durationSeconds": 1.63,
"summary": "Five deterministic provider, relay, deploy, and session files passed 70 tests after red seams proved that source frames mutated legacy incarnation state and generic restore-required reattach returned an outputless live PTY. The candidate keeps exact source identity side-effect free, fails generic restore-required reattach as expired, offers V1 through reconnect, and proves a failed recovery activation stays private and exact-retryable until successful response settlement; no live topology was exercised."
},
{
"date": "2026-07-28",
"runner": "local",
"platform": "macos",
"command": "ORCA_E2E_SSH_DOCKER=1 ORCA_SSH_PTY_SOURCE_CREDIT_V1=1 SKIP_BUILD=1 pnpm exec playwright test tests/e2e/ssh-docker-relay-perf.spec.ts --config tests/playwright.config.ts --project electron-headless --workers=1",
"result": "passed",
"durationSeconds": 60,
"summary": "All four deployed Linux relay/direct-SSH cases passed after an exact-current E2E rebuild at code commit 5611bb45b51a/tree 8e85c3afedec: main bundle SHA-256 cbaf4e997d74bbe0ae1179bc20e52b122c60f0b56ee49ca607e12ae4125a4342 and Linux-x64 relay SHA-256 a7438fc47c4da0223ceaafab621086e14b6cdee427f53a3bf2e710fa99bcf2e6. Direct typing was 3.7/109.1 ms median/worst, ACK-stalled typing was 5.1/109.7 ms at exactly 262,144 held source units, fixed-size filesystem/Git churn was 144.9/153.2 ms with 104 bulk reads, and owner-lease reconnect completed in 15.8 seconds."
},
{
"date": "2026-07-28",
"runner": "local",
"platform": "macos",
"command": "ORCA_E2E_SSH_DOCKER=1 ORCA_SSH_PTY_SOURCE_CREDIT_V1=1 pnpm exec playwright test tests/e2e/ssh-docker-relay-perf.spec.ts --config tests/playwright.config.ts --project electron-headless --workers=1",
"result": "passed",
"durationSeconds": 60,
"summary": "Four post-rebase Docker OpenSSH/deployed-relay tests passed: direct typing median/worst 107.7/113.6 ms, stalled-ACK typing 3.6/107.3 ms at an exact 262,144-source-unit plateau, fixed-size filesystem/Git churn 148.1/161.1 ms with 93 bulk reads, and terminal owner-lease reconnect in 15.7 seconds."
},
{
"date": "2026-07-29",
"runner": "local",
"platform": "macos",
"command": "ORCA_E2E_SSH_DOCKER=1 SKIP_BUILD=1 pnpm exec playwright test tests/e2e/ssh-docker-relay-perf.spec.ts --config tests/playwright.config.ts --project electron-headless --workers=1",
"result": "passed",
"durationSeconds": 56.7,
"summary": "All four always-on deployed Linux relay/direct-SSH cases passed after rebuilding at current-main merge commit adba3410fe4427ceb7525f3fdce2ec58973263a7/tree e43d87340666ca3a733bdb38007c24f95be3f219: main bundle SHA-256 3c304ffc0618520e42bede9a52f72d4b7bb68cbfe543974f89e82a3c477c44b3 and Linux-x64 relay SHA-256 366cb7ccf2e4b388cc6f81a8f6055ab9fde57d2d91381767005c15908832e776. Direct typing was 5.3/108.9 ms median/worst, ACK-stalled typing was 4.8/107.6 ms at exactly 262,144 held source units, fixed-size filesystem/Git churn was 152.0/173.3 ms with 84 bulk reads, and owner-lease reconnect completed in 14.3 seconds; no paired-runtime topology was exercised."
}
],
"runtimeBudget": {
"p95Seconds": 120,
"scope": "deterministic provider/IPC contract now; terminal perf soak/report gate before promotion"
},
"flakeHistory": {
"status": "unknown",
"evidence": "Focused main-process backlog and direct-SSH reconnect/memory/decoder tests are deterministic unit slices. On 2026-07-27 the source-credit reconnect case passed once in the full four-test Docker suite (15.7 seconds) and three consecutive isolated repeat-each runs (21.1, 19.8, and 15.3 seconds). On 2026-07-28 it passed against private recovery transfer in 17.7 seconds alone and 16.0 seconds in the full four-case suite; the combined perf soak still needs longer runtime history before promotion."
},
"redGreenEvidence": {
"status": "partial",
"evidence": "Tests assert pathless runtime output reuses unchanged path-provenance history with zero old-candidate byte scans, ordinary saturated terminal tails retain no rebuilt wait text or repeated phrase scans while every blocked/ready prompt family remains live, main pending renderer output plus projection IDs stay within exact caps, direct-SSH source/recovery memory and both frame decoders stay within exact caps, and 50-PTY reconnect isolates slow/failing siblings. On pre-fix 4bf54da9b, reconnect pause targeted the replacement provider, disposal omitted a pause-only generation, normal and generation-close exit paths never released the renderer preparation lease, and the projection-cap seam did not exist; the same oracles pass with exact generation indexing, paused-generation enumeration, barrier-owned exit leases, and the 1,024-ID transfer latch. The deterministic main-to-relay drain oracle failed with ordinary-2 and ordinary-3 ahead of a later control frame under the single FIFO, then passed with control-first lane selection and four-write ordinary fairness. On exact pre-fix baseline db167ea3d with test-only oracles, cancellation proof reclaimed the published projection span before transfer and generation close allowed a late proof to publish final exit; both deterministic oracles pass after proof acquisition and commit are separated under the exact deadline barrier. Before snapshot admission, the trailing span entered transferring instead of remaining open; after retaining model-sequence ends and reserving at the serialized fence, the joined main/runtime oracle passed for renderer and headless sources with upstream boundaries 4 then 8. Before cumulative partial ACK and source rotation, the ledger rejected ACK 40 of 100 and the multiplex seam detached instead of publishing recovered token B; both exact oracles pass while stale stream and source generations remain rejected. Before restore-record retirement, invalid-checkpoint recovery followed by restore/retry returned restoreRequired a second time instead of opening a fresh activation; the same deterministic oracle passes after exact response-settlement cleanup. With test-only oracles on pre-fix 4bf54da9b, an existing-owner mismatch lacked the stale-owner code and both shared authority and main fallback rows failed; the candidate types that refusal while stale fresh admission remains a subscriber and the retained principal and lease can still recover. Before the recovery-quarantine activation fix, completion was visible at source unit 4 while lease-held recovery ended at 8, so the fence rejected and cancellation failed; the same byte-identical seam now transfers held ranges only into private quarantine, admits output after exact body/fence validation, and the deployed Linux relay reconnect passes. Other controls previously failed with serial reattach, UTF-8-only accounting, and roughly 32 MiB decoder retention. Needs daemon-stream contract coverage and broader hidden-output/input-latency perf artifacts before promotion."
},
"performanceBudget": {
"required": true,
"evidence": "Suggested ceilings: renderer in-flight <=8MB total, <=512KB per PTY plus active reserve, renderer queued chars <=2MB, dropped backlogs 0, hidden restore <=1000ms, active key median/worst <=75ms/300ms in perf scenarios. Always-on capability offers add no persisted setting reads, polling, scans, subprocesses, provider fanout, or reconnect-path reevaluation. Restore-record retirement adds one exact map-identity check at response settlement with no polling, timers, scans, subprocesses, or provider calls. The Docker SSH gate enforces median/worst typing below 500/2,000 ms; the current private-transfer artifact observed 5.5/16.3 ms during an exact 256 KiB stalled-credit plateau, 141.2/151.5 ms during 95 completed filesystem/Git bulk reads, and a 16.0-second reconnect. With 1,024 retained provenance candidates, 4,096 pathless chunks dropped from 78.84ms and 4,096 array replacements to 1.74ms and zero replacements. Brace-free 1 KiB output dropped from 20.32/79.12/318.23ms to 0.31/0.64/2.35ms across 4,096/16,384/65,536 chunks. Repeated ordinary 252,000-character tail checks dropped from 96.34/464.20/941.79/3,796.70ms to 3.21/15.68/31.34/129.72ms across 100/500/1,000/4,096 updates."
},
"promotionCriteria": [
"Split daemon stream backpressure into a deterministic provider/IPC contract if full E2E is flaky.",
"Record JSON artifacts with bytes, dropped counts, queue depth, timer drift, and key latency.",
"Keep stress variants non-blocking until stable runtime history exists."
],
"knownGaps": [
"Local daemon/provider and prior-version daemon topologies were not executed.",
"Headed paired desktop, headless orca serve, folder workspace, and mixed-version client topologies were not executed.",
"Physical WSL and Windows named-pipe/ConPTY topologies were unavailable and were not executed.",
"Ubuntu 20.04/glibc 2.31 packaging was not physically executed; cross-target relay bundling is build evidence only.",
"Runtime provenance coverage is deterministic and does not include a live high-throughput provider artifact.",
"Terminal-wait scale evidence is deterministic and does not yet include a live saturated-tail event-loop artifact.",
"Current command does not prove renderer parse pressure, scheduler queue depth, event-loop delay, or active key latency.",
"Live hidden-output pressure, active input latency, and full Electron perf artifacts remain unproved."
],
"demotionRule": "Cannot promote without metric artifacts and bounded-byte assertions."
},
{
"id": "terminal-provider.daemon-startup-degraded-contract",
"title": "Daemon startup reconcile and degraded fallback preserve provider identity",
"maturity": "experimental",
"protection": "partial",
"owner": "terminal-provider",
"layer": "provider-contract",
"surfaces": [
"daemon startup",
"degraded daemon",
"fallback PTY",
"provider ownership",
"startup restore",
"stable-pane reopen"
],
"platforms": ["macos", "linux", "windows"],
"providers": ["daemon", "local"],
"coveredPlatforms": ["macos"],
"coveredProviders": ["daemon", "local"],
"coverageNotes": "Deterministic provider contracts cover complete, incomplete, conflicting, refused, and identity-invalidated owner inventories; degraded fallback/current/legacy routing; repeated stale-binding classification; and fresh-session reattach without local fallback during unresolved ownership. Main IPC contracts cover exact persisted-binding retirement and one fresh replacement after confirmed absence. Live Linux, Windows, WSL, SSH, paired-runtime, and packaged-upgrade journeys remain uncollected.",
"motivatingLinks": [
"https://github.com/stablyai/orca/pull/6830",
"https://github.com/stablyai/orca/pull/6866",
"https://github.com/stablyai/orca/pull/7002",
"https://github.com/stablyai/orca/pull/12776"
],
"invariant": "Daemon startup reconciliation must preserve valid live daemon sessions and reap only true orphans. A persisted binding stays fail-closed while any possible owner is incomplete, conflicting, refusing attach, or identity-invalidated, but complete authoritative absence from every configured provider must retire that exact stale binding and let retry or reopen converge without attaching it through local fallback or duplicating a PTY.",
"oracle": "Hold exact fallback, current-daemon, and legacy-daemon inventories behind controlled promises. No attach may settle or dispatch until every provider answers. Complete zero-candidate inventories must report SessionNotFound; incomplete, duplicate, refused, and identity-invalidated attempts must remain owner-unverified. In degraded mode, repeated stale attempts scan each eligible provider once per attempt and dispatch no attach, then one explicit fresh spawn and exact reattach use only the recorded fresh route. Main IPC must compare-and-swap retire only the matching persisted PTY/incarnation, emit one synthetic exit, and create one different fresh PTY.",
"commands": [
"pnpm exec vitest run --config config/vitest.config.ts src/main/daemon/daemon-session-owner-resolution.test.ts src/main/daemon/daemon-pty-router.test.ts src/main/daemon/degraded-daemon-pty-provider.test.ts src/main/ipc/pty-dead-owner-respawn.test.ts src/main/ipc/pty-persisted-incarnation-repair.test.ts --reporter=dot"
],
"testFiles": [
"src/main/daemon/daemon-session-owner-resolution.test.ts",
"src/main/daemon/daemon-pty-router.test.ts",
"src/main/daemon/degraded-daemon-pty-provider.test.ts",
"src/main/ipc/pty-dead-owner-respawn.test.ts",
"src/main/ipc/pty-persisted-incarnation-repair.test.ts"
],
"assertionRefs": [
{
"file": "src/main/daemon/daemon-session-owner-resolution.test.ts",
"assertions": [
"controlled concurrent inventories wait for fallback, current, and legacy authority before classifying exact persisted PTYs absent",
"incomplete inventory, duplicate claims, owner refusal, and identity replacement stay fail-closed with exact list and spawn counts"
]
},
{
"file": "src/main/daemon/daemon-pty-router.test.ts",
"assertions": [
"complete current and legacy daemon inventories prove liveness absence with one list call per adapter",
"one unavailable daemon inventory keeps the same missing PTY liveness unknown"
]
},
{
"file": "src/main/daemon/degraded-daemon-pty-provider.test.ts",
"assertions": [
"repeated complete absence never dispatches the stale id to fallback or either daemon",
"one explicit fresh fallback PTY reattaches by its exact PTY and incarnation without another inventory",
"a mapped fallback-owned PTY reports live without borrowing fallback authority for unknown ids or scanning daemon inventories"
]
},
{
"file": "src/main/ipc/pty-dead-owner-respawn.test.ts",
"assertions": [
"confirmed absence retires the exact persisted binding once and creates one differently identified fresh PTY"
]
},
{
"file": "src/main/ipc/pty-persisted-incarnation-repair.test.ts",
"assertions": ["unverified ownership retains the binding and creates no fresh PTY"]
}
],
"evidenceRuns": [
{
"date": "2026-08-06",
"runner": "local",
"platform": "macos",
"command": "pnpm exec vitest run --config config/vitest.config.ts src/main/daemon/daemon-session-owner-resolution.test.ts src/main/daemon/daemon-pty-router.test.ts src/main/daemon/degraded-daemon-pty-provider.test.ts src/main/ipc/pty-dead-owner-respawn.test.ts src/main/ipc/pty-persisted-incarnation-repair.test.ts --reporter=dot",
"result": "passed",
"durationSeconds": 5.44,
"summary": "Four files passed 535 owner-resolution, router, degraded-provider, and IPC lifecycle tests. With only the resolver fix disabled, the unchanged four-file gate failed four stale-absence, identity-retry, and router-liveness assertions; restoring it passed 535 of 535."
}
],
"runtimeBudget": {
"p95Seconds": 45,
"scope": "provider contract unit/integration test"
},
"flakeHistory": {
"status": "unknown",
"evidence": "Focused provider contract tests now run locally; needs soak history before promotion."
},
"redGreenEvidence": {
"status": "complete",
"evidence": "The byte-identical owner-resolver blob d35d2795d56e7e32c1ca99af6726fe6b92181881 is present in v1.4.176-rc.0@ddf64199fa, prod-release-1.4.176@8ddf575fe6, and origin/main@cb960408f2. It returns TerminalSessionOwnerUnverifiedError for both controlled complete-empty persisted PTYs and leaves degraded stale bindings unrecoverable. The candidate passes 535 of 535 registered tests. Restoring only the old predicate makes the unchanged four-file gate fail four of 535 tests; restoring the fix passes 535 of 535."
},
"performanceBudget": {
"required": true,
"evidence": "One unresolved attempt performs one concurrent listProcesses call per eligible provider, concurrent pane attempts coalesce onto that inventory, and no polling, sleep, timer, subprocess, listener, or retry loop is added. Confirmed absence is not cached; repeated explicit attempts remain bounded to one fanout each. Reattaching the newly recorded fresh route adds no inventory or daemon spawn."
},
"promotionCriteria": [
"Wire reconcileOnStartup or mark the production wiring gap explicitly.",
"Cover priorWorktreeIds so renamed worktrees are not falsely reaped."
],
"knownGaps": [
"Production startup reconcile wiring remains unproven.",
"Prior-worktree aliases and renamed-worktree startup reconcile are not covered by the current executable corpus.",
"Real daemon restart behavior is still covered only by lower-level synthetic exit and provider-contract tests.",
"No live Linux, Windows, WSL, SSH, headed/headless paired-runtime, folder-workspace, or mixed-version packaged-upgrade journey was run for stale-owner recovery."
],
"demotionRule": "Cannot promote while restored daemon ids or routing operations can silently route to local fallback."
},
{
"id": "terminal-provider.startup-shutdown-authority",
"title": "Cold-start terminal shutdown targets the installed daemon provider",
"maturity": "experimental",
"protection": "partial",
"owner": "terminal-provider",
"layer": "main-provider-contract",
"surfaces": [
"daemon startup",
"renderer terminal close",
"runtime terminal stop",
"restored terminal teardown"
],
"platforms": ["macos", "linux", "windows"],
"providers": ["local", "daemon", "ssh"],
"coveredPlatforms": ["macos"],
"coveredProviders": ["local", "daemon", "ssh"],
"coverageNotes": "A real daemon server over a local socket proves a fresh adapter can kill a live session before any prior client operation. Main-process tests prove renderer IPC, runtime kill, and runtime exact-stop wait for the provider swap and issue zero shutdowns to the fallback provider, while SSH spawn and kill bypass the local barrier. The same shared logic runs on Linux and Windows; live platform runs remain gaps.",
"motivatingLinks": [
"https://github.com/stablyai/orca/issues/7742",
"https://github.com/stablyai/orca/pull/7836"
],
"invariant": "A local PTY shutdown requested during desktop cold start must resolve its provider only after daemon startup settles, and a fresh daemon adapter must connect before issuing the destructive request; a fallback provider must never falsely acknowledge shutdown while the restored daemon session remains live, and SSH shutdown must not wait on local startup.",
"oracle": "Hold the desktop provider-startup promise unresolved, request shutdown through renderer IPC and both runtime-controller entry points, install the daemon provider, and assert the fallback receives zero shutdowns while the daemon receives exactly the requested kill; prove the provider gate opens as soon as daemon authority settles even while optional hook startup remains unresolved, and prove an SSH spawn and kill complete without touching either local barrier. Separately, spawn a session through one adapter, kill it through a fresh unconnected adapter, and assert the daemon no longer lists it.",
"commands": [
"pnpm exec vitest run --config config/vitest.config.ts src/main/ipc/pty-runtime-kill-and-exit.test.ts src/main/ipc/pty-startup-barrier-and-listing.test.ts src/main/daemon/daemon-pty-adapter.test.ts src/main/startup/first-window-startup-services.test.ts"
],
"testFiles": [
"src/main/ipc/pty-runtime-kill-and-exit.test.ts",
"src/main/ipc/pty-startup-barrier-and-listing.test.ts",
"src/main/daemon/daemon-pty-adapter.test.ts",
"src/main/startup/first-window-startup-services.test.ts"
],
"assertionRefs": [
{
"file": "src/main/ipc/pty-runtime-kill-and-exit.test.ts",
"assertions": [
"renderer local kills issue zero fallback shutdowns before startup and target the installed daemon afterward",
"runtime fire-and-forget local kills issue zero fallback shutdowns before startup and target the installed daemon afterward",
"runtime exact local stops issue zero fallback shutdowns before startup and verify the installed daemon target stopped"
]
},
{
"file": "src/main/ipc/pty-startup-barrier-and-listing.test.ts",
"assertions": [
"SSH spawns and kills bypass the unresolved local startup barrier and target the SSH provider"
]
},
{
"file": "src/main/daemon/daemon-pty-adapter.test.ts",
"assertions": [
"a fresh unconnected adapter kills a session hosted by the live daemon and the session disappears from daemon inventory",
"concurrent shutdowns through a fresh adapter perform exactly one control-plus-stream handshake and remove both daemon sessions"
]
},
{
"file": "src/main/startup/first-window-startup-services.test.ts",
"assertions": [
"daemon provider authority opens before an unresolved optional hook startup while the broader local spawn gate remains closed",
"the provider authority gate shares the bounded 60-second fail-open when daemon startup hangs"
]
}
],
"evidenceRuns": [
{
"date": "2026-07-17",
"runner": "local",
"platform": "macos",
"command": "pnpm exec vitest run --config config/vitest.config.ts src/main/ipc/pty-runtime-kill-and-exit.test.ts src/main/ipc/pty-startup-barrier-and-listing.test.ts src/main/daemon/daemon-pty-adapter.test.ts src/main/startup/first-window-startup-services.test.ts",
"result": "passed",
"durationSeconds": 3.27,
"summary": "3 files and 406 tests passed, including single and concurrent real-socket fresh-adapter shutdown, one control-plus-stream handshake for burst shutdown, three deferred local provider-selection teardown paths, hook-independent provider authority, and SSH barrier bypass."
}
],
"runtimeBudget": {
"p95Seconds": 10,
"scope": "focused main-process provider and IPC contract tests"
},
"flakeHistory": {
"status": "unknown",
"evidence": "The focused deterministic gate passed locally once and needs CI soak history."
},
"redGreenEvidence": {
"status": "partial",
"evidence": "Removing the adapter connection reproduces DaemonProtocolError: Not connected, and removing the renderer startup barrier routes shutdown to the fallback. The new runtime-controller barrier assertions also fail against the prior provider-before-startup shape; saved CI red artifacts remain uncollected."
},
"performanceBudget": {
"required": true,
"evidence": "The provider-authority barrier and connection guard add no polling, timers, subprocesses, session inventories, or provider fanout; runtime exact-stop's existing post-stop verification inventory is unchanged. Shutdown does not wait for optional hook startup once daemon authority settles. Each path awaits one bounded provider promise; DaemonClient.ensureConnected is an O(1) no-op when connected and deduplicates concurrent connection attempts when disconnected. Tests deterministically count zero fallback shutdowns, exactly one target shutdown per entry point, and exactly one control-plus-stream handshake for concurrent fresh-adapter shutdowns."
},
"promotionCriteria": [
"Run the focused gate for at least 100 consecutive passes or 14 days across required CI platforms.",
"Collect a Windows cold-start close or exact-stop run against a preserved daemon PTY.",
"Attach saved red/green artifacts for all three provider-selection entry points."
],
"knownGaps": [
"No live Electron restart-to-close journey is included; provider and IPC contracts cover the race deterministically.",
"The bounded daemon-startup fail-open to LocalPtyProvider remains an accepted boot-over-persistence tradeoff tracked by issue #5232.",
"Daemon process death and the resulting Windows ConPTY PowerShell FailFast are separate from provider-selection shutdown authority."
],
"demotionRule": "Keep experimental or demote if the gate flakes without a product or harness bug, if any local shutdown reaches fallback before startup settles, or if shutdown adds inventory scans or retry loops."
},
{
"id": "terminal-provider.snapshot-capability-renderer-responsiveness",
"title": "PTY snapshot capability discovery never blocks renderer JavaScript",
"maturity": "experimental",
"protection": "partial",
"owner": "terminal-provider",
"layer": "renderer-ipc",
"surfaces": [
"renderer startup",
"cold terminal restoration",
"hidden terminal parking",
"SSH terminal restoration"
],
"platforms": ["macos", "linux", "windows"],
"providers": ["daemon", "ssh", "remote-runtime"],
"coveredPlatforms": ["macos"],
"coveredProviders": ["daemon", "ssh"],
"coverageNotes": "A preload contract and Electron main-stall oracle prove capability lookup is asynchronous. Startup prefetch covers restored primary and split-pane PTY identities before cold activation, while unknown providers remain eager. Docker SSH journeys prove remote terminals still remount eagerly and reclaim their authenticated PTY owner after restart.",
"motivatingLinks": ["https://stablygroup.slack.com/archives/C0BD60A5J85/p1785524559818629"],
"invariant": "PTY snapshot capability discovery must never synchronously block renderer JavaScript. Restored daemon capability must be known before workspace readiness enables cold activation; unknown or legacy capability must remain eager. A healthy SSH provider must return definitive false without polling. One unresponsive capability batch must fail open within one second regardless of PTY count, and stale async responses must not update current bindings.",
"oracle": "The preload test rejects sendSync and requires ipcRenderer.invoke. Unit contracts assert 512-ID batching, one-second fail-open, unknown retry, definitive SSH false, and generation-fenced stale responses. During an injected 1.5-second Electron main-thread stall, a renderer-owned 50ms interval must keep a maximum gap below 500ms and each API call must return within 100ms. The production cold-activation journey must still mount at most three of eight daemon tabs after reload, while Docker SSH restoration remains eager.",
"commands": [
"pnpm exec vitest run --config config/vitest.config.ts src/preload/pty-snapshot-capability-ipc.test.ts src/main/ipc/pty-startup-barrier-and-listing.test.ts src/main/providers/ssh-pty-provider.test.ts src/renderer/src/components/terminal/terminal-provider-snapshot-capability.test.ts src/renderer/src/components/terminal/use-terminal-provider-snapshot-capability.test.tsx src/renderer/src/components/terminal/background-terminal-worktree-mount.test.ts src/renderer/src/components/terminal-pane/terminal-hidden-view-parking.test.ts src/renderer/src/app-startup-routing.test.ts --reporter=dot",
"pnpm exec electron-vite build --mode e2e",
"SKIP_BUILD=1 pnpm exec playwright test tests/e2e/pty-snapshot-capability-main-stall.spec.ts --config tests/playwright.config.ts --project electron-headless --workers=1 --repeat-each=3",
"SKIP_BUILD=1 pnpm exec playwright test tests/e2e/terminal-cold-activation-deferral.spec.ts --config tests/playwright.config.ts --project electron-headless --workers=1",
"ORCA_E2E_SSH_DOCKER=1 SKIP_BUILD=1 pnpm exec playwright test tests/e2e/ssh-cold-activation-restore.spec.ts --config tests/playwright.config.ts --project electron-headless --workers=1"
],
"testFiles": [
"src/preload/pty-snapshot-capability-ipc.test.ts",
"src/main/ipc/pty-startup-barrier-and-listing.test.ts",
"src/main/providers/ssh-pty-provider.test.ts",
"src/renderer/src/components/terminal/terminal-provider-snapshot-capability.test.ts",
"src/renderer/src/components/terminal/use-terminal-provider-snapshot-capability.test.tsx",
"src/renderer/src/components/terminal/background-terminal-worktree-mount.test.ts",
"src/renderer/src/components/terminal-pane/terminal-hidden-view-parking.test.ts",
"src/renderer/src/app-startup-routing.test.ts",
"tests/e2e/pty-snapshot-capability-main-stall.spec.ts",
"tests/e2e/terminal-cold-activation-deferral.spec.ts",
"tests/e2e/ssh-cold-activation-restore.spec.ts"
],
"assertionRefs": [
{
"file": "tests/e2e/pty-snapshot-capability-main-stall.spec.ts",
"assertions": [
"a 1.5-second main stall leaves renderer interval gaps below 500ms",
"capability calls return to renderer JavaScript within 100ms"
]
},
{
"file": "tests/e2e/terminal-cold-activation-deferral.spec.ts",
"assertions": [
"cold reload mounts at most three of eight daemon tabs and parked watchers cover the rest"
]
}
],
"evidenceRuns": [
{
"date": "2026-07-31",
"runner": "local",
"platform": "macos",
"command": "SKIP_BUILD=1 pnpm exec playwright test tests/e2e/pty-snapshot-capability-main-stall.spec.ts --config tests/playwright.config.ts --project electron-headless --workers=1 --repeat-each=3",
"result": "passed",
"durationSeconds": 16.8,
"summary": "Three 1.5-second main stalls produced 32 renderer calls each; maximum interval gaps were 70.3ms, 70.1ms, and 71.6ms, and maximum call-return durations were 0.1ms, 0.1ms, and 0.2ms. The synchronous baseline produced a 1465.1ms interval gap and 1464.2ms call-return duration."
}
],
"runtimeBudget": {
"p95Seconds": 30,
"scope": "focused Electron responsiveness and cold-restore journeys"
},
"flakeHistory": {
"status": "unknown",
"evidence": "The deterministic Electron oracle passed three consecutive local runs; CI soak history is not yet available."
},
"redGreenEvidence": {
"status": "complete",
"evidence": "The byte-identical Electron oracle failed with synchronous sendSync at a 1465.1ms renderer interval gap and 1464.2ms call-return duration, then passed three times with async invoke at no more than 71.6ms and 0.2ms respectively. The preload test also fails on the synchronous baseline."
},
"performanceBudget": {
"required": true,
"evidence": "Capability requests are deduplicated by PTY ID, sent in bounded 512-ID batches, cached after a definitive result, and retried only for unknown results. SSH now returns definitive false. One unresponsive batch fails open after one second without scanning further batches. No subprocesses or provider inventories are added."
},
"promotionCriteria": [
"Run the Electron main-stall oracle for at least 100 consecutive passes or 14 days across required CI platforms.",
"Collect Windows and Linux desktop cold-restore coverage.",
"Add a headed paired-desktop cold-restore journey if provider capability semantics move into the remote runtime."
],
"knownGaps": [
"The main-stall and local daemon cold-restore Electron journeys currently run on macOS only.",
"Docker SSH proves the Linux relay/provider path but not a Linux desktop renderer.",
"This gate proves renderer responsiveness to main stalls; it does not identify the cause of the reported production hard freeze."
],
"demotionRule": "Demote if capability discovery reintroduces synchronous renderer IPC, cold daemon tabs mount eagerly despite authoritative snapshots, SSH capability polls after a definitive response, or the renderer gap budget flakes without a product or harness bug."
},
{
"id": "terminal-provider.ssh-remote-reattach-contract",
"title": "SSH restore and remote-runtime recovery preserve live terminal ownership",
"maturity": "experimental",
"protection": "partial",
"owner": "terminal-provider",
"layer": "provider-contract",
"surfaces": [
"SSH deferred restore",
"direct SSH reconnect finalization",
"direct SSH folder workspace reattach",
"direct SSH split-pane retry ownership",
"same-authority terminal correction",
"remote-runtime host surface materialization",
"remote-runtime mirror polling",
"remote-runtime network recovery",
"paired client sleep/wake reconnect",
"terminal create idempotency",
"provider listing",
"reattach",
"provider reattach incarnation fencing",
"unknown liveness"
],
"platforms": ["macos", "linux", "windows"],
"providers": ["ssh", "remote-runtime", "wsl"],
"coveredPlatforms": ["macos"],
"coveredProviders": ["ssh", "remote-runtime"],
"coverageNotes": "Deterministic renderer coverage proves startup publishes the state returned by ssh.connect, retained native and runtime SSH payloads are admitted through production routes only with valid complete authority, stale cleanup cannot unregister a replacement runtime terminal, direct SSH Git and folder panes clear and retry by exact authority, one authority chain stops after two automatic attempts even when each timeout exceeds the rolling window, rejected acknowledgements mutate no store maps, and one shared exact attempt admits every concurrent split-pane spawn and reattach while preserving the first PTY as the tab fallback. A later sibling failure rotates the tab once, stale callbacks from the prior attempt mutate no state, split remount activity suppression is counted per leaf, primary PTY exit promotes a bound survivor or preserves an empty continuation gap for a late sibling, and primary, non-primary, or null-PTY detach preserves exact authority on both resulting tabs. Intentional pane disposal cancels its settlement timer without breaking StrictMode remount timeout ownership. Target snapshot hydration/reconnect preserves sibling SSH/local/WSL/runtime state, and a mounted remote-runtime terminal survives repeated transport partitions without changing PTY identity. A real encrypted-WebSocket oracle proves a successful reachability probe can replace a pre-ready shared-control socket without rejecting or duplicating the waiting RPC. Direct SSH coordinator tests cover immediate terminal finalization, hydration correction, damping, bounded retry, and telemetry non-interference. Client/server heartbeat tests cover timer suspension, socket generations fence stale callbacks, cold restored-terminal attachment retries, cached pixels remain unhealthy until authoritative replay, automatic retries stop after one minute, manual reconnect preserves the PTY, and pane closure releases recovery UI state. Current macOS Electron journeys against an ephemeral Linux Docker SSH target cover exact-authority repo/worktree hydration, live terminal recovery after disconnect/reconnect, and eager six-terminal remount after renderer reload. A Windows remote-runtime smoke covers reachability and PTY round-trip. Multi-target live fanout, paired-close, WSL, and patched live partition journeys remain gaps.",
"motivatingLinks": [
"https://linear.app/stably/issue/STA-3107",
"https://github.com/stablyai/orca/pull/12664",
"https://github.com/stablyai/orca/pull/6951",
"https://github.com/stablyai/orca/pull/6955",
"https://github.com/stablyai/orca/pull/6979",
"https://github.com/stablyai/orca/pull/7009",
"https://github.com/stablyai/orca/pull/8597",
"https://github.com/stablyai/orca/issues/11541"
],
"invariant": "SSH, WSL, and remote-runtime restore paths must treat provider listing failures and unknown liveness as unknown, not dead, while still avoiding duplicate spawn and clearing expired relay leases exactly once. Direct SSH reconnect must atomically clear only exact-target live PTY bindings, preserve relay identity, retry Git and folder panes without paired close or provider shutdown, and allow at most two automatic attempts in one authority chain even when each settlement exceeds the rolling window. A rejected acknowledgement mutates no store map. A successful exact split-pane spawn or reattach must retain that attempt as shared live authority until sibling leaves settle; the first success cannot consume sibling authority, a sibling failure can start at most one second tab-wide attempt, and prior-attempt callbacks become inert after rotation. Once the retry budget is exhausted, a failure cannot start attempt three or revoke attempt-two authority from siblings that may still settle. Primary PTY exit must promote a bound survivor or preserve exact authority through an empty activation gap, and split detach must project that authority to both resulting tabs. Hydrated PTY hints cannot supersede a current exact-attempt owner, and target snapshot hydration/reconnect cannot reset sibling SSH, local, WSL, or runtime-owned state. Every restored remote terminal must preserve its provider PTY identity, including the authoritative incarnation returned by a successful session-ID reattach. After a recoverable partition the same authenticated runtime must reattach the same PTY, reject detached input, apply the latest viewport, and report healthy only after authoritative replay. A successful one-shot reachability probe may replace a pre-ready shared-control socket, but waiting RPCs must continue onto the replacement under their original deadline without duplicate host delivery or retained request bytes. Automatic PTY recovery stops after one bounded minute without a fatal terminal error; a manual reconnect starts a newly fenced epoch against the same PTY, and closed panes retain no recovery UI state. One capability-gated terminal-create mutation must produce at most one host PTY across an unknown response outcome, remain manually retryable after cutoff, and never let a stale completion replace a newer pane lifecycle. Reconnect must alternate exact activation with authoritative inventory so neither a stale activation response nor an activation failure can strand or retire a pane, and activating a parked surface whose persisted binding was already retired must respawn it rather than report a changed owner after signalling its exit.",
"oracle": "Deterministic tests cover bounded stale-handle replacement, suspended heartbeat clocks, cold and established subscription failure, ten partition/recovery cycles, automatic-recovery cutoff, manual reconnect, and exact direct SSH binding recovery. They assert one atomic store publication clears only exact-target PTY indexes, null-PTY activation remains unchanged, relay identity survives, Git and folder panes retry symmetrically, another target/local/WSL/runtime panes remain byte-identical through target snapshot hydration and reconnect, only an accepted exact failure or timeout starts the second attempt, two 31-second timeouts cannot start a third settlement-triggered attempt, rejected stale/mismatched acknowledgements preserve every store map, and concurrent split-pane spawn and reattach callbacks both commit under the same attempt ID after the first success replaces pending state with live shared authority. A sibling failure revokes that shared authority and starts exactly one second attempt; duplicate failures and late first-attempt PTY callbacks preserve the second attempt and every state map. Attempt-two failure retains continuation authority for later siblings, primary exit promotes a bound survivor or preserves the lease until a late sibling binds, and primary plus non-primary detach retain exact authority and history on both resulting tabs. Both remount callbacks consume split-count activity suppression, intentional dispose emits no failure/timeout, and a same-attempt StrictMode remount still owns one timeout. Hydration clears an untrusted PTY hint without clearing its current pending owner, healthy current-authority bindings suppress correction, hydration finalizes once, and reconnect emits no paired close lifecycle. A provider-level session-ID reattach returns an incarnation, then a legacy exit without an incarnation must resolve to that returned identity rather than minting a fallback identity. The shared-control oracle withholds the first encrypted ready frame, starts one RPC, triggers the successful-probe refresh, then requires exactly two client connections, one host request, a successful response, zero pending calls, and zero retained request bytes. Tests also assert one unsubscribe per remote-runtime epoch, observable recovery phases, stable PTY identity, resumed snapshot/output/input, no healthy state before replay, no retry or input after cutoff, a new manual epoch against the same PTY, quiet recovery UI with an explicit Reconnect action, pane-close state cleanup, one stable create mutation id, old-runtime no-retry behavior, cross-process PTY adoption, and bounded in-flight coordination.",
"commands": [
"pnpm exec vitest run --config config/vitest.config.ts src/main/providers/ssh-pty-provider-reattach-incarnation.test.ts --reporter=dot",
"pnpm exec vitest run --config config/vitest.config.ts src/renderer/src/components/terminal-pane/paired-reconnect-multi-pane-materialization.test.ts src/renderer/src/runtime/paired-reconnect-sidebar-agent-count.test.ts --reporter=dot",
"pnpm exec vitest run --config config/vitest.config.ts src/renderer/src/startup/ssh-startup-reconnect.test.ts src/renderer/src/lib/resolved-worktree-execution-host.test.ts src/renderer/src/components/terminal/background-terminal-worktree-mount.test.ts src/renderer/src/runtime/sync-runtime-graph-scheduling.test.ts src/renderer/src/components/terminal-pane/use-terminal-pane-lifecycle.test.ts src/renderer/src/components/terminal-pane/pty-connection-direct-ssh-spawn-retry.test.ts src/renderer/src/components/terminal-pane/pty-connection-direct-ssh-reattach-retry.test.ts src/renderer/src/components/terminal-pane/remote-runtime-pty-transport-host-surface-replacement.test.ts src/renderer/src/components/terminal-pane/remote-runtime-pty-transport-stream-reconnect.test.ts src/renderer/src/runtime/remote-runtime-session-tabs-inflight.test.ts src/renderer/src/runtime/web-session-terminal-handle-events.test.ts src/renderer/src/store/slices/terminal-pty-identity-replacement.test.ts",
"pnpm exec vitest run --config config/vitest.config.ts src/renderer/src/components/terminal-pane/pty-transport-reattach-admission.test.ts src/renderer/src/components/terminal-pane/pty-transport-detach-attach-handoff.test.ts",
"pnpm exec vitest run --config config/vitest.config.ts src/renderer/src/components/terminal-pane/remote-runtime-pty-transport-attach-subscription.test.ts src/renderer/src/components/terminal-pane/remote-runtime-pty-transport-host-surface-replacement.test.ts src/renderer/src/components/terminal-pane/remote-runtime-pty-transport-stream-reconnect.test.ts src/renderer/src/components/terminal-pane/remote-runtime-pty-transport-expired-pane-recovery.test.ts src/renderer/src/components/terminal-pane/remote-runtime-pty-transport-create-outcome-recovery.test.ts src/renderer/src/components/terminal-pane/remote-runtime-pty-transport-create-handoff.test.ts src/renderer/src/components/terminal-pane/remote-runtime-pty-recovery-state.test.ts src/renderer/src/components/terminal-pane/TerminalRemoteRuntimeReconnectBanner.test.tsx src/renderer/src/components/terminal-pane/terminal-remote-runtime-recovery-ui-state.test.ts src/shared/remote-runtime-socket-liveness.test.ts src/shared/remote-runtime-shared-control-connection.test.ts src/shared/remote-runtime-shared-control-socket-generation.test.ts src/shared/remote-runtime-client-error-classification.test.ts src/main/runtime/rpc/remote-runtime-server-heartbeat.test.ts src/main/runtime/rpc/methods/terminal-create-idempotency.test.ts src/main/runtime/orca-runtime-terminal-create-idempotency.test.ts",
"pnpm exec vitest run --config config/vitest.config.ts src/renderer/src/store/slices/direct-ssh-terminal-retry.test.ts src/renderer/src/store/slices/direct-ssh-pane-detach-ledger.test.ts src/renderer/src/store/slices/direct-ssh-terminal-recovery.test.ts src/renderer/src/store/slices/direct-ssh-terminal-workspace-scope.test.ts src/renderer/src/store/slices/terminals-hydration.test.ts src/renderer/src/store/slices/repos-ssh-host-reconciliation.test.ts src/renderer/src/hooks/direct-ssh-reconnect-coordinator.test.ts src/renderer/src/hooks/direct-ssh-host-hydration.test.ts src/renderer/src/hooks/direct-ssh-state-routing.test.ts src/renderer/src/hooks/remote-workspace-target-sync.test.ts src/renderer/src/components/terminal-pane/pty-connection-direct-ssh-spawn-retry.test.ts src/renderer/src/components/terminal-pane/pty-connection-direct-ssh-reattach-retry.test.ts src/renderer/src/components/terminal-pane/terminal-pane-tab-detach.test.ts --reporter=dot",
"pnpm exec vitest run --config config/vitest.config.ts src/main/ipc/repos-remote.test.ts src/main/ipc/ssh.test.ts src/main/ipc/worktrees-ssh-repo-owner-resolution.test.ts src/main/ipc/worktrees-lineage-hydration.test.ts src/main/runtime/public-ssh-state.test.ts src/main/ssh/ssh-connection-manager.test.ts src/main/ssh/ssh-connection.test.ts src/main/ssh/ssh-provider-authority.test.ts src/preload/ssh-authority-forwarding.test.ts src/renderer/src/runtime/runtime-client-events.test.ts src/renderer/src/runtime/runtime-environment-ssh-state.test.ts src/shared/ssh-retained-payload-admission.test.ts src/shared/ssh-types.test.ts --reporter=dot",
"pnpm exec electron-vite build --mode e2e",
"pnpm run build:web-from-renderer",
"SKIP_BUILD=1 pnpm exec playwright test tests/e2e/paired-remote-terminal-materialization-reconnect.spec.ts --config tests/playwright.config.ts --project electron-headless --workers=1",
"SKIP_BUILD=1 pnpm exec playwright test tests/e2e/terminal-cold-activation-deferral.spec.ts --config tests/playwright.config.ts --project electron-headless --workers=1",
"ORCA_E2E_SSH_DOCKER=1 SKIP_BUILD=1 pnpm exec playwright test tests/e2e/ssh-cold-activation-restore.spec.ts --config tests/playwright.config.ts --project electron-headless --workers=1",
"ORCA_E2E_SSH_DOCKER=1 SKIP_BUILD=1 pnpm exec playwright test tests/e2e/ssh-docker-relay-perf.spec.ts --config tests/playwright.config.ts --project electron-headless --workers=1"
],
"testFiles": [
"src/main/providers/ssh-pty-provider-reattach-incarnation.test.ts",
"src/renderer/src/components/terminal-pane/paired-reconnect-multi-pane-materialization.test.ts",
"src/renderer/src/runtime/paired-reconnect-sidebar-agent-count.test.ts",
"src/renderer/src/startup/ssh-startup-reconnect.test.ts",
"src/renderer/src/lib/resolved-worktree-execution-host.test.ts",
"src/renderer/src/components/terminal/background-terminal-worktree-mount.test.ts",
"src/renderer/src/runtime/sync-runtime-graph-scheduling.test.ts",
"src/renderer/src/components/terminal-pane/use-terminal-pane-lifecycle.test.ts",
"src/renderer/src/components/terminal-pane/pty-connection-direct-ssh-spawn-retry.test.ts",
"src/renderer/src/components/terminal-pane/pty-connection-direct-ssh-reattach-retry.test.ts",
"src/renderer/src/components/terminal-pane/pty-transport-reattach-admission.test.ts",
"src/renderer/src/components/terminal-pane/pty-transport-detach-attach-handoff.test.ts",
"src/renderer/src/components/terminal-pane/remote-runtime-pty-transport-attach-subscription.test.ts",
"src/renderer/src/components/terminal-pane/remote-runtime-pty-transport-host-surface-replacement.test.ts",
"src/renderer/src/components/terminal-pane/remote-runtime-pty-transport-stream-reconnect.test.ts",
"src/renderer/src/components/terminal-pane/remote-runtime-pty-transport-expired-pane-recovery.test.ts",
"src/renderer/src/components/terminal-pane/remote-runtime-pty-transport-create-outcome-recovery.test.ts",
"src/renderer/src/components/terminal-pane/remote-runtime-pty-transport-create-handoff.test.ts",
"src/renderer/src/components/terminal-pane/remote-runtime-pty-recovery-state.test.ts",
"src/renderer/src/components/terminal-pane/TerminalRemoteRuntimeReconnectBanner.test.tsx",
"src/renderer/src/components/terminal-pane/terminal-remote-runtime-recovery-ui-state.test.ts",
"src/renderer/src/runtime/remote-runtime-session-tabs-inflight.test.ts",
"src/renderer/src/runtime/web-session-terminal-handle-events.test.ts",
"src/renderer/src/store/slices/terminal-pty-identity-replacement.test.ts",
"src/shared/remote-runtime-socket-liveness.test.ts",
"src/shared/remote-runtime-shared-control-connection.test.ts",
"src/shared/remote-runtime-shared-control-socket-generation.test.ts",
"src/shared/remote-runtime-client-error-classification.test.ts",
"src/main/runtime/rpc/remote-runtime-server-heartbeat.test.ts",
"src/main/runtime/rpc/methods/terminal-create-idempotency.test.ts",
"src/main/runtime/orca-runtime-terminal-create-idempotency.test.ts",
"tests/e2e/paired-remote-terminal-materialization-reconnect.spec.ts",
"src/renderer/src/store/slices/direct-ssh-terminal-retry.test.ts",
"src/renderer/src/store/slices/direct-ssh-pane-detach-ledger.test.ts",
"src/renderer/src/store/slices/direct-ssh-terminal-recovery.test.ts",
"src/renderer/src/store/slices/direct-ssh-terminal-workspace-scope.test.ts",
"src/renderer/src/store/slices/terminals-hydration.test.ts",
"src/renderer/src/store/slices/repos-ssh-host-reconciliation.test.ts",
"src/renderer/src/hooks/direct-ssh-reconnect-coordinator.test.ts",
"src/renderer/src/hooks/direct-ssh-host-hydration.test.ts",
"src/renderer/src/hooks/direct-ssh-state-routing.test.ts",
"src/renderer/src/hooks/remote-workspace-target-sync.test.ts",
"src/renderer/src/components/terminal-pane/terminal-pane-tab-detach.test.ts",
"src/main/ipc/repos-remote.test.ts",
"src/main/ipc/ssh.test.ts",
"src/main/ipc/worktrees-ssh-repo-owner-resolution.test.ts",
"src/main/ipc/worktrees-lineage-hydration.test.ts",
"src/main/runtime/public-ssh-state.test.ts",
"src/main/ssh/ssh-connection-manager.test.ts",
"src/main/ssh/ssh-connection.test.ts",
"src/main/ssh/ssh-provider-authority.test.ts",
"src/preload/ssh-authority-forwarding.test.ts",
"src/renderer/src/runtime/runtime-client-events.test.ts",
"src/renderer/src/runtime/runtime-environment-ssh-state.test.ts",
"src/shared/ssh-retained-payload-admission.test.ts",
"src/shared/ssh-types.test.ts",
"tests/e2e/terminal-cold-activation-deferral.spec.ts",
"tests/e2e/ssh-cold-activation-restore.spec.ts",
"tests/e2e/ssh-docker-relay-perf.spec.ts"
],
"assertionRefs": [
{
"file": "src/renderer/src/components/terminal-pane/paired-reconnect-multi-pane-materialization.test.ts",
"assertions": [
"six panes sharing one dropped multiplex connection each resubscribe to a distinct live host handle",
"a pane parked while the client slept is authoritatively activated and rematerialized without leaving any pane handle null"
]
},
{
"file": "src/renderer/src/runtime/paired-reconnect-sidebar-agent-count.test.ts",
"assertions": [
"after a long sleep every live host PTY and tab retains its client-owned sidebar agent row",
"unwritten or explicitly released pane authority still cedes deletion to the host"
]
},
{
"file": "src/renderer/src/startup/ssh-startup-reconnect.test.ts",
"assertions": [
"the state returned by ssh.connect is published before persisted terminals reconnect"
]
},
{
"file": "src/renderer/src/components/terminal/background-terminal-worktree-mount.test.ts",
"assertions": [
"startup waits for hydration before mounting terminal panes while degraded mode remains interactive",
"only an explicit local execution host can defer cold activation",
"SSH, remote-runtime, and unresolved owners remain eager"
]
},
{
"file": "src/renderer/src/components/terminal-pane/remote-runtime-pty-transport-host-surface-replacement.test.ts",
"assertions": [
"a stale web-mirror handle polls until a different ready handle is published without resubscribing the stale handle",
"replacement does not emit pane exit or disconnect callbacks and explicit terminal exit still retires the mirror",
"replacement polling and each in-flight request share a 15-second deadline, then accepted snapshots own recovery without input re-arming polling"
]
},
{
"file": "src/renderer/src/components/terminal-pane/remote-runtime-pty-transport-attach-subscription.test.ts",
"assertions": [
"cold restored-terminal subscription failure retries and resumes snapshot, output, and input without a fatal error",
"a canonical close before subscription readiness opens exactly one replacement stream without surfacing a fatal error",
"cached terminal pixels remain disconnected until authoritative replay completes"
]
},
{
"file": "src/renderer/src/components/terminal-pane/remote-runtime-pty-transport-stream-reconnect.test.ts",
"assertions": [
"recovery exposes connecting, recovering, backoff, connected, and fatal-offline phases with fenced epochs",
"ten partition cycles retain one PTY identity, reject detached input, and unsubscribe each epoch exactly once",
"automatic retries stop after one minute with no fatal error, no further requests, and no stale input",
"manual reconnect starts a new epoch, resubscribes the same PTY exactly once, and becomes healthy only after its snapshot"
]
},
{
"file": "src/renderer/src/components/terminal-pane/remote-runtime-pty-transport-create-outcome-recovery.test.ts",
"assertions": [
"unknown terminal-create recovery stops all request activity after one minute without a fatal error, clips post-probe RPC timeouts to the remaining budget, then manual retry re-probes capability and reconciles the same mutation",
"an authoritative capability-probe failure replaces the stale connectivity error"
]
},
{
"file": "src/renderer/src/components/terminal-pane/remote-runtime-pty-transport-create-handoff.test.ts",
"assertions": [
"a stale create completion cannot replace or close a newer attachment, including when two runtimes use the same raw handle"
]
},
{
"file": "src/renderer/src/components/terminal-pane/remote-runtime-pty-recovery-state.test.ts",
"assertions": [
"a healthy replacement invalidates the prior recovery epoch so a slower failure cannot re-arm retry",
"the automatic-recovery deadline cancels pending backoff and a manual retry owns a new epoch",
"a caller-owned recovery cutoff cancels scheduled work and remains disconnected"
]
},
{
"file": "src/renderer/src/components/terminal-pane/TerminalRemoteRuntimeReconnectBanner.test.tsx",
"assertions": [
"automatic recovery renders as a quiet bounded status without a button",
"the disconnected state exposes one explicit Reconnect action"
]
},
{
"file": "src/renderer/src/components/terminal-pane/terminal-remote-runtime-recovery-ui-state.test.ts",
"assertions": [
"only actionable recovery phases retain UI state and pane closure removes disconnected state"
]
},
{
"file": "src/shared/remote-runtime-socket-liveness.test.ts",
"assertions": [
"a suspended client receives a fresh probe deadline after resume and post-resume activity clears it"
]
},
{
"file": "src/main/runtime/orca-runtime-terminal-create-idempotency.test.ts",
"assertions": [
"one authenticated client/worktree mutation derives a stable server-owned terminal handle",
"an unknown-outcome retry adopts the same provider PTY after runtime-process restart without rerunning startup",
"retry inventory failure, missing same-worktree identity metadata, or ownership mismatch fails closed without spawning",
"in-flight mutation coordination is bounded and releases capacity after settlement"
]
},
{
"file": "src/renderer/src/runtime/remote-runtime-session-tabs-inflight.test.ts",
"assertions": [
"concurrent panes share one in-flight inventory request within a runtime/worktree and do not share across ownership boundaries"
]
},
{
"file": "src/renderer/src/runtime/web-session-terminal-handle-events.test.ts",
"assertions": [
"accepted host snapshot listeners are scoped by runtime, worktree, and pane and distinguish pending handles from removed surfaces",
"listeners are released after the waiting transport settles"
]
},
{
"file": "src/renderer/src/store/slices/terminal-pty-identity-replacement.test.ts",
"assertions": [
"repeated handle rotations retain exactly one live PTY identity and update the tab fallback atomically",
"snapshot-first replacement still migrates stale PTY-indexed state"
]
},
{
"file": "src/renderer/src/store/slices/direct-ssh-terminal-recovery.test.ts",
"assertions": [
"one atomic patch clears exact-target live PTY indexes while preserving relay identity and null-PTY activation",
"another SSH target, local, WSL, floating, and runtime-owned terminal state remains unchanged"
]
},
{
"file": "src/renderer/src/store/slices/direct-ssh-terminal-workspace-scope.test.ts",
"assertions": [
"Git and folder workspaces resolve only from consistent exact-target provenance",
"ambiguous, contradictory, mixed, and runtime-owned folders fail closed"
]
},
{
"file": "src/renderer/src/store/slices/direct-ssh-terminal-retry.test.ts",
"assertions": [
"one authority chain permits at most two automatic attempts even when both timeouts exceed the rolling thirty-second window",
"rejected stale-authority, stale-attempt, or pre-commit success acknowledgements mutate none of the tab, PTY-index, pending, history, or live-binding maps",
"both split-pane siblings bind under one exact attempt while the first PTY remains the tab fallback",
"a sibling failure starts one second tab-wide attempt and stale first-attempt callbacks preserve it",
"an exhausted attempt retains sibling continuation authority and promotes a surviving primary PTY without attempt three",
"primary exit before sibling commit preserves the exact continuation lease and accepts the late sibling"
]
},
{
"file": "src/renderer/src/store/slices/direct-ssh-pane-detach-ledger.test.ts",
"assertions": [
"primary and non-primary split detach preserve exact live authority and retry history on both resulting tabs",
"detaching the only bound split while its sibling is still spawning preserves the source continuation lease until that sibling binds",
"detaching during a null-PTY continuation gap projects the exact lease to both pending tabs",
"a pending-only all-null detach preserves the exact lease on both tabs before either leaf binds",
"same-authority invalidation and correction leave both detached live PTYs unchanged"
]
},
{
"file": "src/renderer/src/components/terminal-pane/terminal-pane-tab-detach.test.ts",
"assertions": [
"a detached null-PTY leaf remains marked for pending activation before ownership transfer"
]
},
{
"file": "src/main/providers/ssh-pty-provider-reattach-incarnation.test.ts",
"assertions": [
"a successful session-ID reattach remembers its returned incarnation before a later legacy exit is published"
]
},
{
"file": "src/main/ipc/repos-remote.test.ts",
"assertions": [
"host-qualified repo catalogs require one consistent execution host and complete current SSH authority",
"contradictory, partial, mismatched, stale, and runtime-owned catalog requests fail closed"
]
},
{
"file": "src/main/ipc/ssh.test.ts",
"assertions": [
"concurrent same-authority connects share one provider attempt",
"authority rotation starts stale transport cancellation before teardown, concurrent fresh callers share one replacement, and stale completion cannot clobber the fresh session",
"same-turn disconnect and forward-teardown failures across removal, reset, and terminate keep replacement connects and metadata mutation behind complete target cleanup"
]
},
{
"file": "src/main/ssh/ssh-connection-manager.test.ts",
"assertions": [
"disconnect invalidates a pending transport attempt immediately so late rejection or resolution cannot remove the replacement"
]
},
{
"file": "src/main/ssh/ssh-connection.test.ts",
"assertions": [
"late ssh2 ready and startup error events after disconnect cannot resurrect or overwrite disconnected state"
]
},
{
"file": "src/main/ipc/worktrees-ssh-repo-owner-resolution.test.ts",
"assertions": [
"host-qualified worktree reads reject malformed or contradictory repo executionHostId/connectionId provenance before provider access and after provider awaits without durable mutations"
]
},
{
"file": "src/main/ipc/worktrees-lineage-hydration.test.ts",
"assertions": [
"host-qualified lineage excludes other SSH and runtime owners and rejects ambiguous or contradictory provenance",
"one lineage request snapshots repo, folder, and group catalogs once and memoizes repeated owner resolution"
]
},
{
"file": "src/main/runtime/public-ssh-state.test.ts",
"assertions": [
"public SSH state preserves the complete provider epoch and connection generation pair"
]
},
{
"file": "src/main/ssh/ssh-provider-authority.test.ts",
"assertions": [
"provider epoch and connection generation rotate as one exact authority pair",
"provider resolution rejects stale or incomplete authority",
"unknown-target currency probes reject without allocating provider authority state"
]
},
{
"file": "src/preload/ssh-authority-forwarding.test.ts",
"assertions": [
"full authority crosses Electron IPC without loss",
"partial authority becomes unknown for bounded reconciliation and malformed full authority is dropped",
"variable-form host-qualified worktree requests retain fail-closed outcomes in their return type"
]
},
{
"file": "src/shared/ssh-retained-payload-admission.test.ts",
"assertions": [
"retained connection states reject partial or malformed authority",
"only partial compatibility authority can normalize to unknown for bounded direct-SSH reconciliation",
"shared direct SSH authority admission requires bounded identifiers and a non-negative safe generation"
]
},
{
"file": "src/renderer/src/runtime/runtime-client-events.test.ts",
"assertions": [
"retained runtime snapshots and live events preserve the full pair",
"partial runtime authority is rejected before it reaches environment state"
]
},
{
"file": "src/renderer/src/runtime/runtime-environment-ssh-state.test.ts",
"assertions": [
"runtime-owned SSH state remains isolated by environment and rejects partial retained authority",
"in-flight hydration cannot resurrect disconnected or removed runtime environments"
]
},
{
"file": "src/shared/ssh-types.test.ts",
"assertions": [
"SSH connection state carries the provider epoch and connection generation authority pair"
]
},
{
"file": "src/renderer/src/store/slices/terminals-hydration.test.ts",
"assertions": [
"target-scoped hydration and reconnect preserve sibling SSH and runtime tabs, PTY indexes, runtime ownership, and active selection",
"authoritative target-tab deletion prunes only that tab's retry, live-binding, and retry-history ledgers",
"a snapshot PTY from another SSH host is rejected from the target scope"
]
},
{
"file": "src/renderer/src/store/slices/repos-ssh-host-reconciliation.test.ts",
"assertions": [
"a provider result becomes stale when same-ID repo ownership turns malformed or contradictory during the await"
]
},
{
"file": "src/renderer/src/hooks/direct-ssh-reconnect-coordinator.test.ts",
"assertions": [
"terminal invalidation and retry run synchronously before provider preparation",
"hydrated terminal finalization and same-authority correction are current-authority fenced",
"rapid authority rotation keeps immediate terminal checks while damping full preparation"
]
},
{
"file": "src/renderer/src/hooks/direct-ssh-host-hydration.test.ts",
"assertions": [
"exact-host catalog and lineage hydration preserves sibling SSH, local, runtime, ambiguous, and contradictory rows"
]
},
{
"file": "src/renderer/src/hooks/remote-workspace-target-sync.test.ts",
"assertions": [
"snapshot hydration preserves newer local recovery and keeps imported PTY ids retryable until exact-attempt transport acknowledgement",
"stale operation tokens cannot apply an older snapshot over current authority",
"target snapshot projection and persisted-terminal reconnect are host-qualified and preserve sibling SSH, local, WSL, and runtime state"
]
},
{
"file": "src/renderer/src/components/terminal-pane/pty-connection-direct-ssh-spawn-retry.test.ts",
"assertions": [
"StrictMode remounts join only the same direct SSH retry attempt",
"authority rotation starts a new spawn and rejects then retires a late obsolete-authority fresh PTY",
"both concurrent split-pane spawns commit through the same exact retry attempt",
"a sibling mounted after first success captures the retained live lease",
"authority rotation rejects and retires a delayed sibling spawned from a retained live lease",
"intentional pane disposal cancels retry settlement while a same-attempt StrictMode remount retains one timeout"
]
},
{
"file": "src/renderer/src/components/terminal-pane/pty-connection-direct-ssh-reattach-retry.test.ts",
"assertions": [
"late stale rebind and reattach completions, including lease replacement during asynchronous SSH preparation, callback errors, rejected promises, session-expired, empty, and launch-metadata outcomes, cannot clear current state, start replacement recovery, publish errors, or publish metadata",
"both concurrent split-pane reattaches commit through the same exact retry attempt"
]
},
{
"file": "src/renderer/src/components/terminal-pane/pty-transport-reattach-admission.test.ts",
"assertions": [
"admission rejection precedes buffered final-frame and exit publication",
"a rejected or destroyed fresh session fallback settles retirement before it can publish handlers, shutdown refusal is reported as unknown, and reattach remains non-destructive"
]
},
{
"file": "src/renderer/src/components/terminal-pane/pty-transport-detach-attach-handoff.test.ts",
"assertions": [
"abandoning an obsolete reattach drops its data, replay, write-unavailable, and exit handlers without killing the durable PTY"
]
},
{
"file": "tests/e2e/ssh-cold-activation-restore.spec.ts",
"assertions": [
"six relay-backed tabs retain the same six PTY ids across renderer reload",
"all six SSH managers mount eagerly and none is parked",
"restored terminal input reaches a proof file on the Linux SSH host"
]
},
{
"file": "tests/e2e/ssh-docker-relay-perf.spec.ts",
"assertions": [
"repo and worktree setup fails closed unless the exact direct SSH host and complete authority are returned",
"a reconnected terminal accepts input and writes a proof file visible inside the Linux SSH target"
]
}
],
"evidenceRuns": [
{
"date": "2026-08-23",
"runner": "local",
"platform": "macos",
"command": "pnpm exec vitest run --config config/vitest.config.ts src/renderer/src/components/terminal-pane/paired-reconnect-multi-pane-materialization.test.ts src/renderer/src/runtime/paired-reconnect-sidebar-agent-count.test.ts --reporter=dot",
"result": "passed",
"durationSeconds": 2.54,
"summary": "Seven deterministic STA-3107 contracts passed across six-pane multiplex rematerialization and client-owned sidebar-row retention after sleep/wake."
},
{
"date": "2026-07-14",
"runner": "local",
"platform": "macos",
"command": "ORCA_E2E_SSH_DOCKER=1 SKIP_BUILD=1 pnpm exec playwright test tests/e2e/ssh-cold-activation-restore.spec.ts --config tests/playwright.config.ts --project electron-headless --workers=1",
"result": "passed",
"durationSeconds": 128,
"summary": "Six focused files and 475 tests passed; the local cold-activation journey passed; the Docker/Linux SSH journey restored six of six original relay PTYs, mounted six of six managers without parking, and executed remote input through the restored terminal."
},
{
"date": "2026-07-17",
"runner": "local",
"platform": "macos",
"command": "pnpm exec vitest run --config config/vitest.config.ts src/renderer/src/startup/ssh-startup-reconnect.test.ts src/renderer/src/lib/resolved-worktree-execution-host.test.ts src/renderer/src/components/terminal/background-terminal-worktree-mount.test.ts src/renderer/src/runtime/sync-runtime-graph-scheduling.test.ts src/renderer/src/components/terminal-pane/use-terminal-pane-lifecycle.test.ts src/renderer/src/components/terminal-pane/pty-connection-direct-ssh-spawn-retry.test.ts src/renderer/src/components/terminal-pane/pty-connection-direct-ssh-reattach-retry.test.ts src/renderer/src/components/terminal-pane/remote-runtime-pty-transport-host-surface-replacement.test.ts src/renderer/src/components/terminal-pane/remote-runtime-pty-transport-stream-reconnect.test.ts src/renderer/src/runtime/remote-runtime-session-tabs-inflight.test.ts src/renderer/src/runtime/web-session-terminal-handle-events.test.ts src/renderer/src/store/slices/terminal-pty-identity-replacement.test.ts",
"result": "passed",
"durationSeconds": 15,
"summary": "Ten provider-contract files and 566 tests passed, including a shared 15-second polling/RPC deadline, no input-triggered re-polling after the bound, post-timeout snapshot recovery, listener cleanup, in-flight inventory deduplication, and replacement-state migration."
},
{
"date": "2026-07-21",
"runner": "local",
"platform": "macos",
"command": "pnpm exec vitest run --config config/vitest.config.ts src/renderer/src/components/terminal-pane/remote-runtime-pty-transport-attach-subscription.test.ts src/renderer/src/components/terminal-pane/remote-runtime-pty-transport-host-surface-replacement.test.ts src/renderer/src/components/terminal-pane/remote-runtime-pty-transport-stream-reconnect.test.ts src/renderer/src/components/terminal-pane/remote-runtime-pty-transport-expired-pane-recovery.test.ts src/renderer/src/components/terminal-pane/remote-runtime-pty-transport-create-outcome-recovery.test.ts src/renderer/src/components/terminal-pane/remote-runtime-pty-transport-create-handoff.test.ts src/renderer/src/components/terminal-pane/remote-runtime-pty-recovery-state.test.ts src/renderer/src/components/terminal-pane/TerminalRemoteRuntimeReconnectBanner.test.tsx src/renderer/src/components/terminal-pane/terminal-remote-runtime-recovery-ui-state.test.ts src/shared/remote-runtime-socket-liveness.test.ts src/shared/remote-runtime-shared-control-connection.test.ts src/shared/remote-runtime-shared-control-socket-generation.test.ts src/shared/remote-runtime-client-error-classification.test.ts src/main/runtime/rpc/remote-runtime-server-heartbeat.test.ts src/main/runtime/rpc/methods/terminal-create-idempotency.test.ts src/main/runtime/orca-runtime-terminal-create-idempotency.test.ts",
"result": "passed",
"durationSeconds": 5,
"summary": "Eleven fault-injection and recovery-UI files and 127 tests passed, covering suspended heartbeat clocks, stale socket, PTY, and create generations, canonical pre-ready close recovery with one replacement subscription, cold and repeated PTY reattachment, authoritative health, bounded PTY and terminal-create recovery, post-probe timeout clipping, manually retryable create cutoff, accurate capability-probe failures, same-PTY manual reconnect, pane-state cleanup, fatal error deduplication, stable create identity, cross-process PTY adoption, and fail-closed legacy inventory."
},
{
"date": "2026-07-28",
"runner": "local",
"platform": "macos",
"command": "pnpm exec vitest run --config config/vitest.config.ts src/renderer/src/store/slices/direct-ssh-terminal-retry.test.ts src/renderer/src/store/slices/direct-ssh-pane-detach-ledger.test.ts src/renderer/src/store/slices/direct-ssh-terminal-recovery.test.ts src/renderer/src/store/slices/direct-ssh-terminal-workspace-scope.test.ts src/renderer/src/store/slices/terminals-hydration.test.ts src/renderer/src/store/slices/repos-ssh-host-reconciliation.test.ts src/renderer/src/hooks/direct-ssh-reconnect-coordinator.test.ts src/renderer/src/hooks/direct-ssh-host-hydration.test.ts src/renderer/src/hooks/direct-ssh-state-routing.test.ts src/renderer/src/hooks/remote-workspace-target-sync.test.ts src/renderer/src/components/terminal-pane/pty-connection-direct-ssh-spawn-retry.test.ts src/renderer/src/components/terminal-pane/pty-connection-direct-ssh-reattach-retry.test.ts src/renderer/src/components/terminal-pane/terminal-pane-tab-detach.test.ts --reporter=dot",
"result": "passed",
"durationSeconds": 15.8,
"summary": "Twelve direct SSH files and 647 tests passed, including exact lease revalidation after asynchronous SSH preparation, primary-exit continuation gaps, pending-only and live null-PTY two-sided split-detach authority, delayed post-success sibling admission, stale-authority provider retirement, late ownership-provenance rejection, and deleted-tab ledger pruning."
},
{
"date": "2026-07-28",
"runner": "local",
"platform": "macos",
"command": "pnpm exec vitest run --config config/vitest.config.ts src/renderer/src/components/terminal-pane/pty-transport-reattach-admission.test.ts src/renderer/src/components/terminal-pane/pty-transport-detach-attach-handoff.test.ts",
"result": "passed",
"durationSeconds": 1.48,
"summary": "All 90 transport tests passed, including pre-publication admission rejection, handler-complete non-destructive detach for obsolete SSH reattach transports, settled retirement of rejected or destroyed fresh fallbacks, and reported shutdown refusal."
},
{
"date": "2026-07-28",
"runner": "local",
"platform": "macos",
"command": "pnpm exec vitest run --config config/vitest.config.ts src/main/ipc/repos-remote.test.ts src/main/ipc/ssh.test.ts src/main/ipc/worktrees-ssh-repo-owner-resolution.test.ts src/main/ipc/worktrees-lineage-hydration.test.ts src/main/runtime/public-ssh-state.test.ts src/main/ssh/ssh-connection-manager.test.ts src/main/ssh/ssh-connection.test.ts src/main/ssh/ssh-provider-authority.test.ts src/preload/ssh-authority-forwarding.test.ts src/renderer/src/runtime/runtime-client-events.test.ts src/renderer/src/runtime/runtime-environment-ssh-state.test.ts src/shared/ssh-retained-payload-admission.test.ts src/shared/ssh-types.test.ts --reporter=dot",
"result": "passed",
"durationSeconds": 2.55,
"summary": "Twelve main, preload, runtime, and shared authority files and 513 tests passed, including fail-closed pre/post-await repo ownership provenance, production retained-payload admission, fenced stale-transport replacement, failure-safe target lifecycle barriers, and real ssh2 late-ready/error rejection."
},
{
"date": "2026-07-28",
"runner": "local",
"platform": "macos",
"command": "ORCA_E2E_SSH_DOCKER=1 SKIP_BUILD=1 pnpm exec playwright test tests/e2e/ssh-docker-relay-perf.spec.ts --config tests/playwright.config.ts --project electron-headless --workers=1",
"result": "passed",
"durationSeconds": 51.4,
"summary": "Four Electron Docker SSH tests passed on the final implementation, including exact-authority repo/worktree hydration, two concurrent immutable file streams under Git churn, live terminal input before and after disconnect/reconnect, and an independent container-visible remote proof file."
},
{
"date": "2026-07-28",
"runner": "local",
"platform": "macos",
"command": "ORCA_E2E_SSH_DOCKER=1 SKIP_BUILD=1 pnpm exec playwright test tests/e2e/ssh-cold-activation-restore.spec.ts --config tests/playwright.config.ts --project electron-headless --workers=1",
"result": "passed",
"durationSeconds": 12.5,
"summary": "One Electron journey passed on the final implementation after exact-authority hydration; six restored SSH terminal managers remounted after renderer reload and remote input reached the Linux target."
}
],
"runtimeBudget": {
"p95Seconds": 150,
"scope": "all configured provider-contract, build, Electron, Docker SSH reconnect, and six-terminal cold-restore commands"
},
"flakeHistory": {
"status": "unknown",
"evidence": "Focused renderer contracts, one current 627-test direct SSH run, and current Docker/Linux reconnect and six-terminal cold-restore journeys pass locally. One pressure run entered reconnect while waiting for its seventh marker; later runs delivered all markers but exposed an independent disappearing-second-file fixture race. The corrected two-reader single-file load passed the complete 4/4 suite while retaining concurrent stream pressure. Live multi-target fanout still needs CI soak history before promotion."
},
"redGreenEvidence": {
"status": "partial",
"evidence": "The remote-runtime fault tests failed before the recovery changes by leaving a cold restored subscription detached, reporting connected before authoritative replay, delivering a fatal setup error twice, and allowing an unknown create outcome to spawn again after process-local state was lost. For STA-3107, reverting #11542 in the six-pane multiplex harness leaves exactly one parked pane without a resubscribed handle while its siblings recover; before #12664, the first post-sleep host snapshot erases every stale client-owned sidebar row despite live tabs and host PTYs. The deterministic contracts pass after host activation rematerializes the missing pane and client-written ownership, rather than freshness, controls row retention. On exact pre-fix HEAD 939719443, the split-pane store, fresh-spawn, and reattach oracles failed because the first success removed pending authority and the sibling could not bind; the same three oracles pass after live bindings retain the exact attempt ID. On exact committed HEAD d501f2e96, primary-exit-before-sibling and primary/non-primary split-detach oracles failed because live authority was deleted during the empty gap or transferred to only one resulting tab; all three pass after continuation-gap preservation and two-sided detach projection. On exact committed HEAD d44ea382b with test-only oracles, a pending-only all-null detach deleted the attempt ledger, a sibling mounted after first success committed without its lease, and that sibling could bind after authority rotation; all three pass after pending-only projection and retained-live-lease capture with provider retirement. On exact committed HEAD 9fa84dacf, the production-manager in-progress oracle rejected the fresh authority and the forward-removal barrier delayed stale transport cancellation; both pass after replacement starts cancellation immediately, shares concurrent fresh callers, and waits for teardown before connecting. On exact committed HEAD e5ba9a9e5, overlapping disconnect allowed a replacement connect before forward teardown completed and delayed transport cancellation behind that barrier; disconnect, removal, and terminate now share a target lifecycle barrier, start transport cancellation immediately, retain captured-session identity, and admit the replacement only after cleanup. On exact committed HEAD 9a29e7a81, a rejected forward teardown short-circuited the lifecycle while transport disconnect was pending, removal left its captured relay session alive, same-turn connect escaped admission, and reset remained outside the target barrier; the exact failure oracles pass after both cleanup branches settle, captured sessions always retire, admission is authority-fenced, and reset shares the barrier. On exact committed HEAD 47c7198f2, reset's remaining bespoke forward teardown could still reject after authority rotation but before captured-session retirement; reset now uses the same hardened session teardown and a failed reset remains cleanly retryable. Other direct SSH tests encode red conditions for non-atomic binding clear, cross-target retry, folder omission, duplicate same-authority attempts, hydration overwrite, terminal finalization delayed behind provider work, obsolete-authority pending-spawn adoption, Git lineage namespace mismatch, and snapshot PTY hint promotion without exact-attempt acknowledgement. Existing SSH and stale-handle reattach coverage remains green. Needs WSL, paired-close, and a patched live remote-runtime partition journey before promotion."
},
"performanceBudget": {
"required": true,
"evidence": "Direct SSH terminal invalidation and retry each use one exact-target store publication and execute before provider discovery; another target's five occupied provider slots cannot delay terminal finalization. Each split-pane completion or delayed mount adds constant-time pending/live lease lookups and no provider listing, polling, subprocess, cross-tab scan, or new fanout; two mounted leaves still perform exactly their two existing provider operations. The scheduler caps locally unsettled detected-worktree work at five with a two-call late-work allowance. Remote-runtime recovery allocates at most one backoff timer and one one-minute deadline per detached pane, then stops all PTY retry work until explicit user action. Timers, accepted-snapshot listeners, stale streams, and pane UI entries are released on health, cutoff, rebind, removal, detach, or destroy; ten-cycle tests prove one unsubscribe per epoch. Common terminal input/output paths add only constant-time state checks. No live large-terminal-map direct SSH timing is claimed."
},
"promotionCriteria": [
"Use deterministic fake providers for failure and unknown-liveness cases.",
"Keep environment-dependent live SSH tests as soak until stable.",
"Include reconnect/polling artifacts that identify provider, connection id, and lease state."
],
"knownGaps": [
"Current command covers store wake-hint metadata, main-process SSH provider failure semantics, provider attach/expired-attach behavior, and renderer deferred SSH reconnect/transient-failure/expired-relay fallback with mocked transports.",
"The live SSH journey is environment-dependent and currently runs from a macOS Electron client against a Linux Docker host.",
"Current Docker/Linux journeys prove one target's reconnect and cold-restore paths; live multi-target fanout, folder-workspace reconnect, and large-terminal-map timing remain untested.",
"No paired-client close/non-interference journey was run for direct SSH reconnect; paired web clients intentionally remain outside coordinator ownership.",
"WSL restore and direct SSH/WSL isolation remain inferred rather than directly covered.",
"Linux and Windows desktop-client partition journeys using patched builds are not yet collected; the Windows smoke proves current reachability and PTY round-trip only.",
"Terminal-create recovery depends on providers authoritatively listing live terminal handles and worktree ownership; older runtimes do not advertise the capability and are never retried after an unknown outcome."
],
"demotionRule": "Cannot promote if provider failure can close panes or if the oracle is screenshot-only."
},
{
"id": "terminal-input.remote-write-rejection-recovery",
"title": "Rejected paired-runtime terminal input remounts the pane",
"maturity": "experimental",
"protection": "partial",
"owner": "terminal-runtime",
"layer": "paired-runtime-stream-contract",
"surfaces": [
"terminal multiplex input",
"legacy binary terminal input",
"one-shot terminal.send fallback",
"pane recovery",
"pty:hasPty liveness routing"
],
"platforms": ["macos", "linux", "windows"],
"providers": ["paired-runtime"],
"coveredPlatforms": ["macos"],
"coveredProviders": ["paired-runtime"],
"coverageNotes": "One end-to-end contract runs the real dispatcher, renderer multiplexer, remote transport, and pty-connection together and requires the tab remount, so the signal is proven past the transport callback it used to die behind. Focused contracts cover capability negotiation, legacy binary subscriptions, stream-id reuse, pane lifecycle reuse, the one-shot JSON fallback, and main refusing to answer liveness for a `remote:` id. Live headed/headless paired-runtime and mixed installed releases remain uncollected.",
"motivatingLinks": [
"https://linear.app/stably/issue/STA-2830",
"https://github.com/stablyai/orca/issues/11124"
],
"invariant": "When a paired-runtime client accepts terminal input locally but the authoritative host rejects the PTY write, a capability-compatible stream must notify only that current pane generation and that notification must end in an actual tab remount — no local liveness probe may veto it, because main owns no registry entry for a `remote:` id and must answer unknown for one. A host must never send the new opcode to a legacy or un-negotiated client, and a late rejection must never recover a replacement stream or pane lifecycle.",
"oracle": "Wire the real dispatcher to the real renderer multiplexer, remote transport, and pty-connection over one bridged subscription; type into the pane, reject the authoritative runtime send before any process write, and require both the WriteUnavailable frame and a remountTerminalTabForRecovery call — repeated for every answer main can produce for a `remote:` id (fabricated dead, unknown, thrown). Separately: require one frame only for a capability-declaring client by driving an un-negotiated legacy binary subscriber first and a capable one second on the same runtime, so the capable frame proves the rejection had already been processed for both. Reuse the stream id before releasing a held rejection and require no signal; replace the stream or detach and reattach the same handle before releasing held failures and require no stale recovery. Require pty:hasPty to answer null for a `remote:` id without consulting the local provider.",
"commands": [
"pnpm exec vitest run --config config/vitest.config.ts src/main/runtime/rpc/terminal-multiplex-input-write-rejection.test.ts src/renderer/src/runtime/runtime-terminal-stream.test.ts src/renderer/src/runtime/remote-runtime-terminal-parse-backpressure.test.ts src/renderer/src/components/terminal-pane/remote-runtime-pty-transport-attach-subscription.test.ts src/renderer/src/components/terminal-pane/remote-runtime-pty-transport-input-fallback.test.ts tests/e2e/paired-runtime-rejected-input-remount.unit.test.ts src/renderer/src/components/terminal-pane/terminal-pane-recovery.test.ts src/main/ipc/pty-session-liveness-and-ownership.test.ts --reporter=dot"
],
"testFiles": [
"src/main/runtime/rpc/terminal-multiplex-input-write-rejection.test.ts",
"src/renderer/src/runtime/runtime-terminal-stream.test.ts",
"src/renderer/src/runtime/remote-runtime-terminal-parse-backpressure.test.ts",
"src/renderer/src/components/terminal-pane/remote-runtime-pty-transport-attach-subscription.test.ts",
"src/renderer/src/components/terminal-pane/remote-runtime-pty-transport-input-fallback.test.ts",
"tests/e2e/paired-runtime-rejected-input-remount.unit.test.ts",
"src/renderer/src/components/terminal-pane/terminal-pane-recovery.test.ts",
"src/main/ipc/pty-session-liveness-and-ownership.test.ts"
],
"assertionRefs": [
{
"file": "src/main/runtime/rpc/terminal-multiplex-input-write-rejection.test.ts",
"assertions": [
"rejected authoritative input emits WriteUnavailable only for capable multiplex and legacy binary clients",
"an un-negotiated legacy binary subscriber never receives the rejection opcode",
"a late rejection cannot target a replacement stream with the same id"
]
},
{
"file": "src/renderer/src/components/terminal-pane/remote-runtime-pty-transport-attach-subscription.test.ts",
"assertions": [
"WriteUnavailable reaches the current pane recovery callback without a fatal error"
]
},
{
"file": "src/renderer/src/components/terminal-pane/remote-runtime-pty-transport-input-fallback.test.ts",
"assertions": [
"superseded streams and same-handle pane lifecycles ignore delayed rejections",
"a rejected one-shot runtime fallback invokes pane recovery"
]
},
{
"file": "tests/e2e/paired-runtime-rejected-input-remount.unit.test.ts",
"assertions": [
"a host-rejected write travels dispatcher to multiplexer to transport to pty-connection and remounts the tab",
"no answer the local liveness probe can give for a `remote:` id blocks that remount"
]
},
{
"file": "src/renderer/src/components/terminal-pane/terminal-pane-recovery.test.ts",
"assertions": [
"input-rejected-by-host recovery consults no liveness probe",
"input-rejected-by-host still coalesces under the shared recovery cooldown"
]
},
{
"file": "src/main/ipc/pty-session-liveness-and-ownership.test.ts",
"assertions": [
"pty:hasPty answers unknown for a paired-runtime handle instead of the local provider's fabricated dead"
]
}
],
"evidenceRuns": [
{
"date": "2026-08-05",
"runner": "local",
"platform": "macos",
"command": "pnpm exec vitest run --config config/vitest.config.ts src/main/runtime/rpc/terminal-multiplex-input-write-rejection.test.ts src/renderer/src/runtime/runtime-terminal-stream.test.ts src/renderer/src/runtime/remote-runtime-terminal-parse-backpressure.test.ts src/renderer/src/components/terminal-pane/remote-runtime-pty-transport-attach-subscription.test.ts src/renderer/src/components/terminal-pane/remote-runtime-pty-transport-input-fallback.test.ts tests/e2e/paired-runtime-rejected-input-remount.unit.test.ts src/renderer/src/components/terminal-pane/terminal-pane-recovery.test.ts src/main/ipc/pty-session-liveness-and-ownership.test.ts --reporter=dot",
"result": "passed",
"durationSeconds": 15,
"summary": "678 passed / 0 failed with the end-to-end remount contract, the un-negotiated legacy binary gate, and the pty:hasPty liveness-routing contract added."
}
],
"runtimeBudget": {
"p95Seconds": 45,
"scope": "focused paired-runtime host and renderer contracts plus the end-to-end remount chain"
},
"flakeHistory": {
"status": "unknown",
"evidence": "Deterministic controlled-promise tests pass locally; CI and soak history have not started."
},
"redGreenEvidence": {
"status": "complete",
"evidence": "On origin/main e5f49e0e1d, the test-only dispatcher oracle subscribed, accepted client input, invoked the authoritative host send once, recorded no process write, and failed only because no WriteUnavailable frame returned. The end-to-end contract was then red at the last hop on the delivery-only implementation — the host frame arrived and no remount followed — for all three liveness answers (3 failed / 0 passed), and green after the recovery routing fix (3 passed). Deleting the legacy-binary capability gate makes terminal-multiplex red (1 failed / 62 passed); deleting the pty:hasPty `remote:` guard makes the main contract red with the fabricated `false`; reverting either half of the renderer routing makes the end-to-end contract red (3 failed). Every mutation was restored by re-applying the edit and re-verified green."
},
"performanceBudget": {
"required": true,
"evidence": "The change adds one optional capability field, one constant-time outcome classification per existing write, and one rejection-only frame/callback. The recovery routing adds one string comparison per rejection and removes an IPC round-trip on that path; the pty:hasPty guard is a prefix test that short-circuits a provider lookup. It adds no polling, timer, provider listing, subprocess, retained payload, or cross-pane fanout."
},
"promotionCriteria": [
"Collect headed and headless paired-runtime journeys with a rejected host write.",
"Collect mixed installed-release evidence in both client/server directions.",
"Collect CI soak history with no unexplained flakes."
],
"knownGaps": [
"Live headed and headless paired-runtime journeys are not collected.",
"Linux, Windows, mobile, and mixed installed-release runs are not collected.",
"Dead-record connected-state correction remains tracked separately in STA-2896."
],
"demotionRule": "Keep experimental or demote if rejected input can remain silent, the signal stops short of a remount, a legacy or un-negotiated client receives an unknown opcode, a liveness probe fabricates an answer for a `remote:` id, a stale failure recovers a replacement pane, or the deterministic contract flakes without an identified product or harness bug."
},
{
"id": "terminal-provider.wsl-restore-contract",
"title": "WSL terminals preserve launch identity, liveness, and restore boundaries",
"maturity": "experimental",
"protection": "none",
"owner": "terminal-provider",
"layer": "windows-provider-contract",
"surfaces": [
"WSL",
"Windows host boundary",
"cwd identity",
"startup command",
"provider liveness",
"restore"
],
"platforms": ["windows"],
"providers": ["wsl"],
"coveredPlatforms": [],
"coveredProviders": [],
"coverageNotes": "Registered gap only; no executable coverage is wired yet.",
"motivatingLinks": [
"https://github.com/stablyai/orca/pull/6801",
"https://github.com/stablyai/orca/pull/6830",
"https://github.com/stablyai/orca/pull/6866",
"https://github.com/stablyai/orca/pull/6951"
],
"invariant": "WSL terminal restore must preserve Windows-host and Linux-guest path/cwd identity, shell launch args, startup command delivery, provider liveness semantics, and saved session ownership without being treated as ordinary local Windows ConPTY or generic SSH.",
"oracle": "No executable slice yet. Promotion needs a Windows provider contract plus one focused live WSL smoke proving cwd/path mapping, shell echo, startup command delivery, targeted liveness unknown handling, and restore without duplicate panes or destructive false-dead cleanup.",
"commands": [],
"testFiles": [],
"assertionRefs": [],
"evidenceRuns": [],
"runtimeBudget": {
"p95Seconds": 90,
"scope": "Windows WSL provider contract plus focused live smoke"
},
"flakeHistory": {
"status": "not-started",
"evidence": "WSL is split out from SSH/remote planning so it cannot be mistaken for covered provider behavior."
},
"redGreenEvidence": {
"status": "missing",
"evidence": "Needs intentional-break evidence for path/cwd mapping, startup command delivery, liveness unknown handling, and restore ownership."
},
"performanceBudget": {
"required": true,
"evidence": "WSL restore and liveness checks must avoid broad provider scans on typing, focus, switch, render, or resize hot paths."
},
"promotionCriteria": [
"Start with deterministic provider contracts for path/cwd mapping and launch args.",
"Add one focused Windows live WSL smoke after provider contracts are stable.",
"Keep WSL separate from SSH and local ConPTY evidence in PR descriptions."
],
"knownGaps": [
"No manifest command yet.",
"No live Windows WSL CI evidence.",
"No provider contract yet separates Windows host paths from Linux guest cwd identity."
],
"demotionRule": "Cannot promote while WSL restore is inferred from SSH, local ConPTY, or remote-runtime gates."
},
{
"id": "terminal-output.scrollback-replay-fifo",
"title": "Replay, scrollback, and hidden-output restore preserve ordering and clear semantics",
"maturity": "experimental",
"protection": "none",
"owner": "terminal-rendering",
"layer": "renderer-unit-provider-contract",
"surfaces": [
"snapshot replay",
"scrollback restore",
"hidden output",
"metadata-only replay",
"WebGL recovery"
],
"platforms": ["macos", "linux", "windows"],
"providers": ["local", "daemon", "ssh", "remote-runtime"],
"coveredPlatforms": [],
"coveredProviders": [],
"coverageNotes": "Registered gap on main. The replay FIFO/burst coalescing product change and its tests exist only on the pending reliability stack; main still uses a single pendingReplayData slot. It registers here with its owning split PR.",
"motivatingLinks": [
"https://github.com/stablyai/orca/pull/7012",
"https://github.com/stablyai/orca/pull/7054",
"https://github.com/stablyai/orca/pull/6949"
],
"invariant": "Multiple replay notifications, metadata-only eager replays, hidden-output restores, and WebGL recovery must preserve FIFO ordering, apply clear-before-replay only when intended, and never overlay stale bytes on newer terminal output.",
"oracle": "The current executable slice injects overlapping replay notifications while async replay drains and asserts pre-parse coalescing, in-flight replay preservation, FIFO draining after xterm parsing starts, and bounded burst-tail coalescing. Metadata-only replay, hidden output chunks, live output interleaving, clear semantics, and stale-overlap checks remain promotion-scope gaps.",
"commands": [],
"testFiles": [],
"assertionRefs": [],
"evidenceRuns": [],
"runtimeBudget": {
"p95Seconds": 20,
"scope": "renderer unit or provider-contract test"
},
"flakeHistory": {
"status": "unknown",
"evidence": "Focused remote replay tests now run locally; needs soak history before promotion."
},
"redGreenEvidence": {
"status": "partial",
"evidence": "Focused tests assert pre-parse replay coalescing, in-flight replay preservation, FIFO draining for multiple replay notifications accepted after xterm parsing starts, and bounded burst-tail coalescing that keeps the newest snapshot. Needs saved red/green evidence and broader clear/metadata/hidden-output cases before promotion."
},
"performanceBudget": {
"required": true,
"evidence": "Replay fixes must not add unbounded renderer parsing, hidden-pane wakeups, or retry loops."
},
"promotionCriteria": [
"Extend deterministic multi-replay coverage before changing replay code.",
"Prove metadata-only replay does not clear restored scrollback.",
"Keep long-table/golden visual tests as supporting evidence, not the primary oracle."
],
"knownGaps": [
"No executable coverage on main yet; the slice lives on the pending fix-terminal-reliability stack.",
"Current command covers remote replay overlap, in-flight preservation, FIFO ordering for multiple in-progress replay notifications, and bounded burst-tail coalescing only.",
"Does not yet cover clearBeforeReplay metadata on the fresh main implementation.",
"Does not yet cover hidden-output restore plus live-output interleaving."
],
"demotionRule": "Cannot promote without ordered replay and clear-semantics assertions."
},
{
"id": "terminal-input.ime-and-synthetic-forwarding",
"title": "IME, native text, and synthetic input commit exactly once, do not leak preedit bytes, and pair every claimed press with one release",
"maturity": "experimental",
"protection": "partial",
"owner": "terminal-input",
"layer": "renderer-unit-platform-soak",
"surfaces": [
"IME",
"native text forwarding",
"synthetic input",
"paste",
"keyboard bypass",
"JIS yen"
],
"platforms": ["macos", "linux", "windows"],
"providers": ["local", "daemon", "ssh", "remote-runtime"],
"coveredPlatforms": ["macos", "linux"],
"coveredProviders": [],
"coverageNotes": "Local macOS and containerized Linux evidence, deterministic renderer-unit coverage for the Linux/Sogou candidate-key policy including the legacy orphaned-keyup fallback, Electron/CDP live-PTY Sogou-style repros, and macOS renderer/main slices for Preview kitty commits and layout-native Option input. The Option slice covers complete CSI-u flag fields including lock state, repeat/release event types, authoritative committed associated text, native dead-key release suppression, functional-versus-printable numpad codes, press-pinned release identity, live keyup modifiers, pending-layout text fallback, atomic layout refresh, rapid in-focus input-source changes, stable native layout characters, and both native/web preload fallbacks. Snapshot flag provenance keeps a proven 0, a proven non-zero, and an absent field distinct from daemon through the sequenced remote SnapshotStart frame. Real Linux/Sogou OS IME automation, Windows ConPTY post-agent reset, and the CJK/Vietnamese/Arabic matrix remain registered gaps.",
"motivatingLinks": [
"https://github.com/stablyai/orca/pull/6699",
"https://github.com/stablyai/orca/pull/6682",
"https://github.com/stablyai/orca/pull/6513",
"https://github.com/stablyai/orca/pull/6999"
],
"invariant": "Composition, native text forwarding, synthetic input, paste, and platform keyboard bypass paths must not send preedit/control bytes before commit and must commit text exactly once to the intended PTY. Layout-native Option text must preserve negotiated CSI-u alternate/associated fields and lock modifiers, distinguish repeat from press, and resolve releases with the press's primary identity plus the actual keyup modifiers without exposing a partial or stale layout refresh. An in-focus macOS input-source change must invalidate both renderer authorities before the next key can use the old source. When the snapshot source proves kitty state, macOS Preview commits must use the application's effective flags after the sequenced snapshot and every proven replay/live transition, and a claimed press delivered under report_event_types must produce exactly one matching release regardless of whether keyup arrives before or after insertText and regardless of xterm's defensive internal reset.",
"oracle": "Exact outbound bytes from the REAL native-text forwarder behind installPreviewImeBridge after initial snapshot restore, replacement resync, live transitions, and both keydown->insertText->keyup and keydown->keyup->insertText orderings; a wiring-only mock is supporting evidence, not the oracle. The current renderer-unit slice asserts native text commits route to the intended PTY once, composition/preedit bookkeeping does not leak premature text, input-source classification handles synthetic/native paths, paste/runtime forwarding avoids duplicate terminal payloads for covered fixtures, and Linux/Sogou candidate Space/digit selectors do not leak keydown/keypress/keyup while ordinary and long-held letter-to-digit typing remains available. A main/preload/renderer notification chain proves every live window invalidates immediately, the old native read settles before a coalesced refresh signal, and older refreshes are generation-fenced. The Electron/CDP live-PTY repro verifies Sogou-style Space and digit selectors submit only the committed Chinese text, while the legacy orphaned-letter-keyup sequence sends no selector byte to the PTY. Real legacy IME commit preservation and the full CJK/Vietnamese/Arabic/JIS-yen matrix run in follow-up platform soak where automation is possible.",
"commands": [
"pnpm exec vitest run --config config/vitest.config.ts src/renderer/src/components/terminal-pane/terminal-ime-native-text-forwarder.test.ts src/renderer/src/components/terminal-pane/terminal-ime-substituted-text-commit.test.ts src/renderer/src/components/terminal-pane/terminal-ime-macos-keybinding-dict-trace.test.ts src/renderer/src/components/terminal-pane/terminal-paste-runtime.test.ts src/renderer/src/components/terminal-pane/terminal-ime-composition-tracker.test.ts src/renderer/src/components/terminal-pane/terminal-ime-candidate-key-release-guard.test.ts src/renderer/src/components/terminal-pane/xterm-bypass-policy-non-mac.test.ts src/renderer/src/components/terminal-pane/xterm-bypass-policy.test.ts",
"pnpm exec vitest run --config config/vitest.config.ts src/renderer/src/components/terminal-pane/terminal-ime-linux-candidate-state.test.ts",
"pnpm exec vitest run --config config/vitest.config.ts src/renderer/src/components/dashboard-popout/preview-terminal-ime-bridge-kitty-bytes.test.ts src/renderer/src/components/dashboard-popout/preview-terminal-snapshot-replay.test.ts src/renderer/src/components/dashboard-popout/AgentTerminalPreview.test.tsx src/renderer/src/components/dashboard-popout/AgentTerminalPreview.option-dead-key.test.tsx src/shared/terminal-kitty-keyboard-mode-tracker.test.ts src/main/ipc/terminal-preview.test.ts src/main/ipc/terminal-preview-output-stream.test.ts src/renderer/src/runtime/remote-runtime-terminal-snapshot-kitty-flags.test.ts src/main/daemon/daemon-pty-adapter.test.ts",
"pnpm exec vitest run --config config/vitest.config.ts src/renderer/src/components/terminal-pane/terminal-kitty-csi-u-encoding.test.ts src/renderer/src/components/terminal-pane/terminal-shortcut-option-compose.test.ts src/renderer/src/components/terminal-pane/terminal-option-kitty-release.test.ts src/renderer/src/lib/keyboard-layout/layout-base-character.test.ts src/renderer/src/lib/keyboard-layout/option-as-alt-probe.test.ts src/main/ipc/macos-keyboard-layout-snapshot.test.ts src/main/ipc/macos-keyboard-layout-change-notifications.test.ts src/preload/app-restart-checkpoint-routing.test.ts src/renderer/src/web/web-preload-api-ui.test.ts",
"pnpm run test:e2e -- tests/e2e/chinese-ime-chat-input-repro.spec.ts",
"pnpm run test:e2e -- tests/e2e/terminal-option-composed-ascii.spec.ts"
],
"testFiles": [
"tests/e2e/terminal-option-composed-ascii.spec.ts",
"src/renderer/src/components/terminal-pane/terminal-ime-native-text-forwarder.test.ts",
"src/renderer/src/components/terminal-pane/terminal-ime-substituted-text-commit.test.ts",
"src/renderer/src/components/terminal-pane/terminal-ime-macos-keybinding-dict-trace.test.ts",
"src/renderer/src/components/terminal-pane/terminal-paste-runtime.test.ts",
"src/renderer/src/components/terminal-pane/terminal-ime-composition-tracker.test.ts",
"src/renderer/src/components/terminal-pane/terminal-ime-candidate-key-release-guard.test.ts",
"src/renderer/src/components/terminal-pane/terminal-ime-linux-candidate-state.test.ts",
"src/renderer/src/components/terminal-pane/xterm-bypass-policy-non-mac.test.ts",
"src/renderer/src/components/terminal-pane/xterm-bypass-policy.test.ts",
"src/renderer/src/components/terminal-pane/terminal-kitty-csi-u-encoding.test.ts",
"src/renderer/src/components/terminal-pane/terminal-shortcut-option-compose.test.ts",
"src/renderer/src/components/terminal-pane/terminal-option-kitty-release.test.ts",
"src/renderer/src/lib/keyboard-layout/layout-base-character.test.ts",
"src/renderer/src/lib/keyboard-layout/option-as-alt-probe.test.ts",
"src/main/ipc/macos-keyboard-layout-snapshot.test.ts",
"src/main/ipc/macos-keyboard-layout-change-notifications.test.ts",
"src/preload/app-restart-checkpoint-routing.test.ts",
"src/renderer/src/web/web-preload-api-ui.test.ts",
"src/renderer/src/components/dashboard-popout/preview-terminal-ime-bridge-kitty-bytes.test.ts",
"src/renderer/src/components/dashboard-popout/preview-terminal-snapshot-replay.test.ts",
"src/renderer/src/components/dashboard-popout/AgentTerminalPreview.test.tsx",
"src/renderer/src/components/dashboard-popout/AgentTerminalPreview.option-dead-key.test.tsx",
"src/shared/terminal-kitty-keyboard-mode-tracker.test.ts",
"src/main/ipc/terminal-preview.test.ts",
"src/main/ipc/terminal-preview-output-stream.test.ts",
"src/renderer/src/runtime/remote-runtime-terminal-snapshot-kitty-flags.test.ts",
"src/main/daemon/daemon-pty-adapter.test.ts",
"tests/e2e/chinese-ime-chat-input-repro.spec.ts"
],
"assertionRefs": [
{
"file": "src/renderer/src/components/terminal-pane/terminal-ime-native-text-forwarder.test.ts",
"assertions": [
"native text commits route once to the intended PTY",
"composition/preedit bookkeeping does not leak premature text",
"multi-codepoint committed text is reported independently from physical key identity"
]
},
{
"file": "src/renderer/src/components/terminal-pane/terminal-ime-substituted-text-commit.test.ts",
"assertions": [
"synthetic and native input-source paths are classified for covered fixtures",
"report-all commits retain the unshifted physical key while associated text carries the committed substitution"
]
},
{
"file": "src/renderer/src/components/terminal-pane/terminal-ime-macos-keybinding-dict-trace.test.ts",
"assertions": [
"an OS key-binding substitution reaches the PTY instead of the raw layout character",
"the same key with no substitution in play still sends the layout character"
]
},
{
"file": "src/renderer/src/components/terminal-pane/terminal-paste-runtime.test.ts",
"assertions": ["paste/runtime forwarding avoids duplicate terminal payloads"]
},
{
"file": "src/renderer/src/components/terminal-pane/terminal-ime-composition-tracker.test.ts",
"assertions": [
"empty Sogou-style compositionupdate keeps composition active",
"stale composition state expires so editing keys cannot stay suppressed indefinitely",
"post-composition candidate guard is armed only by Sogou-style empty updates and clears after real typing"
]
},
{
"file": "src/renderer/src/components/terminal-pane/terminal-ime-candidate-key-release-guard.test.ts",
"assertions": [
"suppressed candidate keydown arms only the matching keypress/keyup release guard",
"held-key repeat keydowns stay guarded until their keyup, even past expiry",
"fresh keydowns, other keys, modified keys, and expired keypresses are not guarded, and a fresh press drops a stale pending release"
]
},
{
"file": "src/renderer/src/components/terminal-pane/terminal-ime-linux-candidate-state.test.ts",
"assertions": [
"an orphaned plain-letter keyup arms exactly the next bare digit guard",
"ordinary, overlapping, shifted, and long-held letter keydowns keep following digits available",
"physical letter tracking survives cross-pane focus handoff and clears on renderer-window blur"
]
},
{
"file": "src/renderer/src/components/terminal-pane/xterm-bypass-policy-non-mac.test.ts",
"assertions": [
"standalone Linux 229 keydowns reach xterm while Windows 229 keydowns stay suppressed",
"candidate Space/digit selectors are suppressed only while candidate guards are active"
]
},
{
"file": "src/renderer/src/components/terminal-pane/xterm-bypass-policy.test.ts",
"assertions": [
"macOS standalone Process key behavior and composition-owned key suppression stay intact"
]
},
{
"file": "tests/e2e/terminal-option-composed-ascii.spec.ts",
"assertions": [
"a live kitty-negotiated pane receives the Option-composed ASCII character, not the physical alt chord",
"an Option layer that also needs Shift still reaches the pty as text",
"configured Option-as-Alt still reports the layout-resolved physical chord",
"a non-ASCII Option glyph still reaches the application as its alt hotkey"
]
},
{
"file": "src/renderer/src/components/terminal-pane/terminal-kitty-csi-u-encoding.test.ts",
"assertions": [
"report-all Option events encode exact alternate, repeat, release, and associated-text fields",
"report-all native commits preserve unresolved layout characters and distinguish functional from printable numpad identities",
"associated text omits forbidden control codepoints",
"release events omit associated text and sparse PC-101 alternates retain their parameter position",
"CapsLock and NumLock occupy their protocol modifier bits"
]
},
{
"file": "src/renderer/src/components/terminal-pane/terminal-shortcut-option-compose.test.ts",
"assertions": [
"native Option-composed ASCII remains text outside report-all mode while configured-Alt sides remain chords",
"pending shifted-layout data fails safe to composed text while configured-Alt ownership remains authoritative",
"dead, Process, Unidentified, composing, and keyCode-229 events stay with composition",
"configured Alt-side dead keys retain legacy chords while other IME-owned events stay with composition",
"policy-owned configured Alt uses the active layout, preserves engine-owned global legacy and form-only legacy encoding, and omits associated text",
"report-all uses layout primary/shifted identities plus committed text for ISO and Space keys"
]
},
{
"file": "src/renderer/src/components/terminal-pane/terminal-option-kitty-release.test.ts",
"assertions": [
"owned releases use live Shift and Option state and current alternate-key flags",
"owned releases retain the delivered press identity across layout, Shift, and NumLock changes",
"a native dead-key keyup is consumed without inventing an unmatched protocol release",
"event-type pop consumes without bytes and repeat keydowns cannot replace the original release owner"
]
},
{
"file": "src/renderer/src/lib/keyboard-layout/layout-base-character.test.ts",
"assertions": [
"complete native layout characters replace atomically while input continues using the prior complete snapshot",
"native and browser layout sources from separate transactions are never combined",
"an input-source notification clears stale characters synchronously and fences the older refresh"
]
},
{
"file": "src/renderer/src/lib/keyboard-layout/option-as-alt-probe.test.ts",
"assertions": [
"a stale asynchronous input-source probe cannot overwrite the newest classification",
"an input-source notification changes the classification to unknown synchronously before refreshing"
]
},
{
"file": "src/main/ipc/macos-keyboard-layout-snapshot.test.ts",
"assertions": [
"the native snapshot parser preserves input/layout identities and both modifier layers"
]
},
{
"file": "src/main/ipc/macos-keyboard-layout-change-notifications.test.ts",
"assertions": [
"the distributed input-source notification invalidates every live window before waiting out the old helper read",
"rapid input-source changes coalesce to one latest-generation refresh signal",
"destroyed windows and teardown races cannot crash the main process, and will-quit unsubscribes exactly once",
"non-macOS processes install no native subscription"
]
},
{
"file": "src/preload/app-restart-checkpoint-routing.test.ts",
"assertions": [
"macOS keyboard reads and the change subscription remain wired after main integration",
"the two-phase change payload reaches the renderer unchanged",
"the subscription disposer removes the exact IPC listener"
]
},
{
"file": "src/renderer/src/web/web-preload-api-ui.test.ts",
"assertions": [
"web fallbacks expose no local captured chords, no native layout snapshot, and a no-op layout-change subscription"
]
},
{
"file": "src/renderer/src/components/dashboard-popout/preview-terminal-ime-bridge-kitty-bytes.test.ts",
"assertions": [
"the real forwarder behind the Preview bridge encodes the commit from the snapshot-proven flags before any live output",
"flags 0/1 commit raw text, flags 2 add one CSI-u release, flags 8 emit one CSI-u press, and flags 10 emit a CSI-u press followed by exactly one release",
"both keydown->insertText->keyup and keydown->keyup->insertText orderings produce the same bytes",
"the release is emitted by the forwarder while xterm's internal kitty flags stay 0",
"the mutable flags getter is read exactly once, at commit time, never on keydown or keyup",
"auto-repeat, two-key rollover, a swallowed commit, a retired claim, blur, and disposal each emit at most one release and never synthesize one"
]
},
{
"file": "src/renderer/src/components/dashboard-popout/preview-terminal-snapshot-replay.test.ts",
"assertions": [
"a Preview opened on a snapshot carrying flags 8 adopts 8 before any live output",
"a replacement snapshot whose ANSI carries no kitty bytes keeps its proven flags, and a proven 0 clears an earlier 8",
"a missing field leaves the mirror unproven at the raw-text fallback and a later live negotiation still upgrades it",
"restored flags land on the screen the snapshot scan selected",
"a proven post-snapshot suffix advances the stack while redelivered bytes apply idempotently"
]
},
{
"file": "src/renderer/src/components/dashboard-popout/AgentTerminalPreview.test.tsx",
"assertions": [
"the Preview hands the forwarder the live kitty mirror seeded from the snapshot's proven flags"
]
},
{
"file": "src/renderer/src/components/dashboard-popout/AgentTerminalPreview.option-dead-key.test.tsx",
"assertions": [
"native and configured-side dead-key releases remain owned by the Preview without duplicate bytes"
]
},
{
"file": "src/shared/terminal-kitty-keyboard-mode-tracker.test.ts",
"assertions": [
"a fresh PTY's known 0 is distinguishable from a snapshot's unproven 0 fallback",
"restoreSnapshotFlags proves only the active screen and rejects non-safe-integer values",
"provenance survives absolute sets, screen switches, RIS and DECSTR, but a pop past omitted push history returns to unknown rather than a manufactured 0"
]
},
{
"file": "src/main/ipc/terminal-preview.test.ts",
"assertions": [
"terminalPreview:connect returns image, sequence, and kitty flags from the same capture, including after an overflow retry"
]
},
{
"file": "src/main/ipc/terminal-preview-output-stream.test.ts",
"assertions": [
"fully covered chunks are dropped, a sliced or strictly newer sequenced suffix gets live mode semantics, and an unsliceable or metadata-less overlap gets replay semantics"
]
},
{
"file": "src/renderer/src/runtime/remote-runtime-terminal-snapshot-kitty-flags.test.ts",
"assertions": [
"SnapshotStart decodes proven 0 and 8 with their seq into requested and host-pushed snapshot paths",
"negative, fractional, unsafe, and non-numeric values are treated as absent rather than clamped",
"an old host that omits the field stays usable and is never coerced to a proven 0"
]
},
{
"file": "src/main/daemon/daemon-pty-adapter.test.ts",
"assertions": ["daemon provider snapshots publish proven kitty flags including a known 0"]
},
{
"file": "tests/e2e/chinese-ime-chat-input-repro.spec.ts",
"assertions": [
"Sogou-style Space candidate selection submits only the committed Chinese character",
"Sogou-style digit candidate selection submits only the committed Chinese phrase",
"Post-composition Sogou-style digit selection stays out of the PTY after compositionend",
"Legacy orphaned-letter-keyup digit selection submits no selector byte to the PTY; real legacy candidate commit preservation remains a platform gap"
]
}
],
"evidenceRuns": [
{
"date": "2026-08-16",
"runner": "local",
"platform": "macos",
"command": "pnpm exec vitest run --config config/vitest.config.ts src/renderer/src/components/terminal-pane/terminal-kitty-csi-u-encoding.test.ts src/renderer/src/components/terminal-pane/terminal-shortcut-option-compose.test.ts src/renderer/src/components/terminal-pane/terminal-option-kitty-release.test.ts src/renderer/src/lib/keyboard-layout/layout-base-character.test.ts src/renderer/src/lib/keyboard-layout/option-as-alt-probe.test.ts src/main/ipc/macos-keyboard-layout-snapshot.test.ts src/main/ipc/macos-keyboard-layout-change-notifications.test.ts src/preload/app-restart-checkpoint-routing.test.ts src/renderer/src/web/web-preload-api-ui.test.ts",
"result": "passed",
"durationSeconds": 0.8,
"summary": "The deterministic Option/layout slice passed exact protocol bytes for filtered committed associated text, physical and alternate key identities, functional and printable numpad keys, press-pinned releases across layout and lock changes, lock modifiers, layout-aware configured Alt across individual flags and dead keys, terminal-engine-owned global legacy handling, IME-owned DOM events, ISO/Space keys, native dead-key release suppression, pending-layout text fallback, release ownership, the two-phase native-read barrier, synchronous cache invalidation, rapid-change coalescing, generation fencing, every-live-window fanout, cleanup, and native/web platform fallbacks."
},
{
"date": "2026-08-16",
"runner": "local",
"platform": "macos",
"command": "pnpm run test:e2e -- tests/e2e/terminal-option-composed-ascii.spec.ts",
"result": "passed",
"durationSeconds": 66,
"summary": "Four live-Electron scenarios passed against a real pty whose kitty flags were armed by the application's own CSI > 1 u: Option-composed `@` and Option+Shift-composed `\\` arrive as text with no alt chord, configured Option-as-Alt still reports the layout-resolved chord, and a non-ASCII Option glyph still reaches the application as its alt hotkey. Discrimination was proven by mutation rather than assumed — restoring the pre-fix policy makes exactly the two composed-text scenarios fail with the character never reaching the pty, while both chord scenarios stay green."
},
{
"date": "2026-08-16",
"runner": "local",
"platform": "macos",
"command": "pnpm run test:e2e -- tests/e2e/chinese-ime-chat-input-repro.spec.ts",
"result": "passed",
"durationSeconds": 13.9,
"summary": "The Electron live-PTY IME gate passed three scenarios covering Windows IME Shift commit, candidate-selector suppression with committed Chinese text, and composed text/cursor/Backspace stability; the opt-in real-agent scenario remained skipped."
},
{
"date": "2026-08-16",
"runner": "local",
"platform": "macos",
"command": "pnpm exec vitest run --config config/vitest.config.ts src/renderer/src/components/dashboard-popout/preview-terminal-ime-bridge-kitty-bytes.test.ts src/renderer/src/components/dashboard-popout/preview-terminal-snapshot-replay.test.ts src/renderer/src/components/dashboard-popout/AgentTerminalPreview.test.tsx src/renderer/src/components/dashboard-popout/AgentTerminalPreview.option-dead-key.test.tsx src/shared/terminal-kitty-keyboard-mode-tracker.test.ts src/main/ipc/terminal-preview.test.ts src/main/ipc/terminal-preview-output-stream.test.ts src/renderer/src/runtime/remote-runtime-terminal-snapshot-kitty-flags.test.ts src/main/daemon/daemon-pty-adapter.test.ts",
"result": "passed",
"durationSeconds": 4.3,
"summary": "9 test files and 172 tests passed, covering the Preview kitty slice: real forwarder bytes at snapshot-proven flags, press/release pairing across both keyup/insertText orderings, native and configured-side dead-key release ownership, and flag provenance where a proven 0, a proven non-zero, and an absent field stay three distinct facts — asserted on the daemon snapshot and on a host-pushed remote snapshot that carries the flags with their sequence. The emitter-side rule that a remote SnapshotStart withholds flags without a seq has no direct assertion yet; the client-side gate is what these files pin."
},
{
"date": "2026-08-09",
"runner": "local",
"platform": "macos",
"command": "pnpm exec vitest run --config config/vitest.config.ts src/renderer/src/components/terminal-pane/terminal-ime-native-text-forwarder.test.ts src/renderer/src/components/terminal-pane/terminal-ime-substituted-text-commit.test.ts src/renderer/src/components/terminal-pane/terminal-ime-macos-keybinding-dict-trace.test.ts src/renderer/src/components/terminal-pane/terminal-paste-runtime.test.ts src/renderer/src/components/terminal-pane/terminal-ime-composition-tracker.test.ts src/renderer/src/components/terminal-pane/terminal-ime-candidate-key-release-guard.test.ts src/renderer/src/components/terminal-pane/xterm-bypass-policy-non-mac.test.ts src/renderer/src/components/terminal-pane/xterm-bypass-policy.test.ts",
"result": "passed",
"durationSeconds": 0.7,
"summary": "8 test file(s) passed, 143 tests, after adding the OS key-binding substitution replay. Discrimination checked by mutation rather than assumed: suppressing the structural claim, and separately removing the single character the older punctuation table happened to list, each make the replay send the raw layout character while both paired negatives stay green."
},
{
"date": "2026-07-11",
"runner": "local",
"platform": "macos",
"command": "pnpm exec vitest run --config config/vitest.config.ts src/renderer/src/components/terminal-pane/terminal-ime-linux-candidate-state.test.ts",
"result": "passed",
"durationSeconds": 0.619,
"summary": "1 state test file and 10 tests passed on macOS, including orphan-keyup, shifted/modifier-changed releases, intervening-key cancellation, cross-pane focus handoff, window/terminal blur cleanup, and long-held-letter coverage; the complete 8-file slice also passed 158 tests."
},
{
"date": "2026-07-11",
"runner": "local",
"platform": "linux",
"command": "pnpm exec vitest run --config config/vitest.config.ts src/renderer/src/components/terminal-pane/terminal-ime-linux-candidate-state.test.ts",
"result": "passed",
"durationSeconds": 0.747,
"summary": "1 state test file and 10 tests passed in Debian 12 arm64 Docker under Node 24, including orphan-keyup, shifted/modifier-changed releases, intervening-key cancellation, cross-pane focus handoff, window/terminal blur cleanup, and long-held-letter coverage; the complete 8-file slice also passed 158 tests."
},
{
"date": "2026-07-11",
"runner": "local",
"platform": "linux",
"command": "pnpm run test:e2e -- tests/e2e/chinese-ime-chat-input-repro.spec.ts",
"result": "passed",
"durationSeconds": 30.3,
"summary": "Debian 12 arm64 Docker with Node 24 and Xvfb passed both live Electron/PTY IME scenarios; the orphaned-letter-keyup candidate digit submitted no selector byte, and the real-Codex opt-in scenario was skipped."
},
{
"date": "2026-07-07",
"runner": "local",
"platform": "macos",
"command": "pnpm exec vitest run --config config/vitest.config.ts src/renderer/src/components/terminal-pane/terminal-ime-native-text-forwarder.test.ts src/renderer/src/components/terminal-pane/terminal-ime-substituted-text-commit.test.ts src/renderer/src/components/terminal-pane/terminal-ime-macos-keybinding-dict-trace.test.ts src/renderer/src/components/terminal-pane/terminal-paste-runtime.test.ts src/renderer/src/components/terminal-pane/terminal-ime-composition-tracker.test.ts src/renderer/src/components/terminal-pane/terminal-ime-candidate-key-release-guard.test.ts src/renderer/src/components/terminal-pane/xterm-bypass-policy-non-mac.test.ts src/renderer/src/components/terminal-pane/xterm-bypass-policy.test.ts",
"result": "passed",
"durationSeconds": 0.7,
"summary": "7 test file(s) passed, 144 tests passed on the Linux/Sogou candidate-key branch (includes held-key repeat guard coverage). The command shown is the gate's current one, which the manifest check requires; the run itself predates two of the files it now lists. The 2026-08-09 entry is the one that covers the current slice."
},
{
"date": "2026-07-07",
"runner": "local",
"platform": "macos",
"command": "pnpm run test:e2e -- tests/e2e/chinese-ime-chat-input-repro.spec.ts",
"result": "passed",
"durationSeconds": 72.0,
"summary": "Electron/CDP IME repro passed: Sogou candidate selection, post-composition candidate selection, and existing Chinese IME harness passed; real Codex IME test was skipped behind ORCA_E2E_REAL_CODEX_IME."
}
],
"runtimeBudget": {
"p95Seconds": 90,
"scope": "renderer unit plus focused Electron/CDP IME repro"
},
"flakeHistory": {
"status": "unknown",
"evidence": "Focused renderer input tests and the Electron/CDP Sogou-style repro are now registered; needs soak history and true platform IME evidence before promotion."
},
"redGreenEvidence": {
"status": "partial",
"evidence": "Focused tests cover existing native-text, input-source, paste/runtime forwarding, Linux/Sogou candidate selector, post-composition guard contracts, live-PTY Sogou-style candidate commits, and the Preview kitty slice (press/release pairing in both keyup orderings, and snapshot flag provenance separating a proven 0 from an absent field). Needs intentional-break proof for duplicate native text forwarding and composition preedit leakage, plus the broader language/platform matrix."
},
"performanceBudget": {
"required": true,
"evidence": "Terminal input hot-path audit clean on 2026-08-16: candidate guards retain O(1) checks and bounded per-pane state. Layout changes add one process-lifetime native listener, two singleton renderer subscriptions, one O(live windows) broadcast per OS event, and generation-fenced refreshes whose native helper read is deduplicated in flight. The path is event-driven with will-quit/dispose cleanup and adds no polling, timers, per-key IPC, SSH/remote transport work, unbounded queues, or retained terminal data."
},
"promotionCriteria": [
"Cover deterministic byte/cell oracles first.",
"Mark true OS IME automation gaps explicitly by platform.",
"Pair with Windows ConPTY keyboard reset for Windows standard-key behavior."
],
"knownGaps": [
"Current commands include renderer-unit coverage and a CDP-driven Electron repro; real OS IME automation may need manual or soak evidence.",
"Backspace/Enter during composition, JIS yen, Arabic/RTL, paste edge cases, and Windows ConPTY post-agent key reset still need representative gate coverage.",
"An older remote host omits the optional SnapshotStart kitty field, so a new client falls back to raw commits until live negotiation is observed.",
"Snapshot authorities expose only the active screen's effective flags, not kitty's complete two-screen push stacks; a pop that crosses the restored boundary degrades to unknown rather than a proven value."
],
"demotionRule": "Cannot promote if success is based only on DOM text without PTY byte/cell evidence."
},
{
"id": "terminal-input.windows-conpty-keyboard-reset",
"title": "Windows ConPTY resets keyboard protocol state after agents and TUIs exit",
"maturity": "experimental",
"protection": "none",
"owner": "terminal-platform",
"layer": "windows-electron-conpty",
"surfaces": [
"Windows ConPTY",
"keyboard protocol",
"agent exit",
"TUI exit",
"standard key input"
],
"platforms": ["windows"],
"providers": ["local", "daemon", "wsl"],
"coveredPlatforms": [],
"coveredProviders": [],
"coverageNotes": "Registered gap only; no executable coverage is wired yet.",
"motivatingLinks": [
"https://github.com/stablyai/orca/pull/6999",
"https://github.com/stablyai/orca/pull/6858"
],
"invariant": "After an agent or TUI exits on Windows ConPTY, ordinary Enter, Backspace, Arrow, paste, and printable keys must be delivered as standard shell input, not stale Kitty/CSI-u or application-mode bytes.",
"oracle": "A Windows gate records PTY input bytes before and after agent/TUI exit, submits real shell commands, and proves standard keys work without protocol leakage.",
"commands": [],
"testFiles": [],
"assertionRefs": [],
"evidenceRuns": [],
"runtimeBudget": {
"p95Seconds": 60,
"scope": "Windows provider-contract or focused Electron gate"
},
"flakeHistory": {
"status": "not-started",
"evidence": "Gate is registered as a known Windows ConPTY gap; no command is wired."
},
"redGreenEvidence": {
"status": "missing",
"evidence": "Needs intentional-break proof for stale keyboard-protocol mode after agent/TUI exit."
},
"performanceBudget": {
"required": true,
"evidence": "Must not add per-key global session listing or repeated protocol reset work on the typing hot path."
},
"promotionCriteria": [
"Use byte-level PTY input evidence, not only screenshots.",
"Start as Windows soak until skip and flake behavior is known.",
"Fail promotion on silent Windows environment skips."
],
"knownGaps": [
"No manifest command yet.",
"Real Windows ConPTY execution is not covered by macOS/Linux CI."
],
"demotionRule": "Cannot promote if standard-key behavior is inferred without PTY byte evidence."
},
{
"id": "terminal-input.windows-modified-enter-routing",
"title": "Windows modified Enter routes agent-compatible bytes to the active pane",
"maturity": "experimental",
"protection": "partial",
"owner": "terminal-input",
"layer": "main-provider-renderer-unit-and-windows-electron",
"surfaces": [
"terminal input",
"Windows modified Enter",
"agent identity",
"split panes",
"SSH",
"WSL",
"remote runtime"
],
"platforms": ["macos", "linux", "windows"],
"providers": ["local", "daemon", "ssh", "wsl", "remote-runtime"],
"coveredPlatforms": ["macos"],
"coveredProviders": [],
"coverageNotes": "Deterministic main/renderer tests run on macOS and exercise simulated Windows plus POSIX/Linux process-confirmation behavior. They cover exact local-ConPTY membership, detached-child rejection, SSH and paired-runtime host-platform routing including legacy runtime PTY IDs, active-PTY ownership after worktree host changes, Windows-to-WSL routing, unknown-metadata fallback, production handler composition, KKP authorization on every host, process-confirmed Droid routing and launch-triggered confirmation, typed-alias and forged-OSC isolation, shells without OSC 133, split/detach ownership with preserved shell classification, stale PTY exit/rebind rejection, command-generation revocation, daemon v21 warm-reattach identity, unavailable inspection, and lazy subprocess/RPC callback counts. A live linux-arm64 Docker target additionally proved real relay deployment, SSH PTY host detection, and exact inactive/active KKP bytes. The Electron byte test runs only on Windows; live Windows evidence remains uncollected. Test failures report exact expected bytes; no product telemetry or raw terminal logging is added.",
"motivatingLinks": [
"https://github.com/stablyai/orca/issues/7620",
"https://github.com/stablyai/orca/pull/7668"
],
"invariant": "Shift+Enter key recognition follows the client OS, while emitted bytes follow the active application and PTY host: active Kitty keyboard protocol authorizes CSI-u on every host; otherwise Windows hosts use Esc+CR except when allowlisted Droid ownership or fresh routing-trusted Droid process evidence authorizes CSI-u, and non-Windows hosts use Esc+CR. The active SSH connection, remote-runtime PTY owner, or live local session outranks later worktree ownership changes, and missing host-platform metadata falls back to the client. Every new command and PTY replacement revokes stale agent routing until current evidence settles; split or reused panes cannot inherit sibling or prior-PTY authority; unrelated keys perform no host, agent, protocol, or ConPTY lookup.",
"oracle": "Renderer tests assert exact bytes across client/PTY-host combinations, including Kitty keyboard protocol active and inactive on Windows and non-Windows hosts, and prove SSH identity, the environment encoded in an active remote-runtime PTY id, and live local-session identity outrank current worktree ownership, while unavailable platform metadata falls back to the client. A live linux-arm64 SSH PTY independently captured Esc+CR with KKP inactive and CSI-u with KKP active. Fresh Windows process evidence authorizes Droid bytes only after a recognized global candidate is intersected with the exact ConPTY console process list; detached descendants, helper failure/timeout/root-only fallback, stale PTY exit/rebind results, typed text, and hook/OSC output fail closed. A new OSC 133;C immediately publishes a routing-neutral generation, including during D-to-C races. In cmd.exe/Git Bash/custom shells without OSC 133, accepted inferred commands start the same fresh generation; accepted submit/interrupt, title exit, focus, and visibility revoke trusted Droid bytes while one bounded confirmation runs. Detach preserves the live PTY's source shell override so WSL/native classification cannot change with the current default. Ordinary fast shell commands use cached/no-scan paths; routing-relevant confirmation bypasses cached process snapshots and keeps the bounded three-read ladder. Daemon protocol v21 persists only an allowlisted launchAgent; warm reattach uses it as a display/confirmation hint and restores routing only after current process proof. The Windows Electron test focuses the real xterm textarea and records exact renderer-to-main PTY writes.",
"commands": [
"pnpm exec vitest run --config config/vitest.config.ts src/main/daemon/daemon-foreground-confirmation-protocol.test.ts src/main/daemon/daemon-pty-adapter.test.ts src/main/daemon/daemon-pty-router.test.ts src/main/daemon/daemon-server.test.ts src/main/daemon/degraded-daemon-pty-provider.test.ts src/main/daemon/pty-subprocess-foreground-scan-cadence.test.ts src/main/daemon/pty-subprocess.test.ts src/main/ipc/pty-runtime-kill-and-exit.test.ts src/main/providers/agent-foreground-process.test.ts src/main/providers/local-pty-provider-foreground-process.test.ts src/main/daemon/pty-subprocess-foreground-degraded-scan.test.ts src/main/providers/windows-console-attached-processes.test.ts src/main/providers/windows-pty-job-membership.test.ts src/renderer/src/components/terminal-pane/pane-foreground-agent-tracker.test.ts src/renderer/src/components/terminal-pane/pty-connection-command-finished-cleanup.test.ts src/renderer/src/components/terminal-pane/pty-connection-foreground-agent-routing.test.ts src/renderer/src/components/terminal-pane/pty-connection-foreground-agent-sampling.test.ts src/renderer/src/components/terminal-pane/pty-transport-reattach-admission.test.ts src/renderer/src/components/terminal-pane/terminal-pane-tab-detach.test.ts src/renderer/src/components/terminal-pane/terminal-shortcut-policy.test.ts src/renderer/src/components/terminal-pane/terminal-windows-shift-enter.test.ts src/renderer/src/store/slices/store-active-worktree-terminal-creation.test.ts src/renderer/src/store/slices/terminal-pane-detach-agent-identity.test.ts src/shared/agent-process-recognition.test.ts src/shared/process-table-snapshot.test.ts tests/e2e/terminal-foreground-confirmation.unit.test.ts",
"pnpm run test:e2e -- tests/e2e/terminal-shortcuts.spec.ts",
"pnpm exec vitest run --config config/vitest.config.ts src/renderer/src/components/terminal-pane/keyboard-handlers.test.ts src/renderer/src/components/terminal-pane/remote-runtime-pty-transport-pane-handle-resolution.test.ts src/renderer/src/components/terminal-pane/terminal-input-host-platform.test.ts"
],
"testFiles": [
"src/main/daemon/daemon-foreground-confirmation-protocol.test.ts",
"src/main/daemon/daemon-pty-adapter.test.ts",
"src/main/daemon/daemon-pty-router.test.ts",
"src/main/daemon/daemon-server.test.ts",
"src/main/daemon/degraded-daemon-pty-provider.test.ts",
"src/main/daemon/pty-subprocess-foreground-scan-cadence.test.ts",
"src/main/daemon/pty-subprocess.test.ts",
"src/main/ipc/pty-runtime-kill-and-exit.test.ts",
"src/main/providers/agent-foreground-process.test.ts",
"src/main/providers/local-pty-provider-foreground-process.test.ts",
"src/main/daemon/pty-subprocess-foreground-degraded-scan.test.ts",
"src/main/providers/windows-console-attached-processes.test.ts",
"src/main/providers/windows-pty-job-membership.test.ts",
"src/renderer/src/components/terminal-pane/pane-foreground-agent-tracker.test.ts",
"src/renderer/src/components/terminal-pane/keyboard-handlers.test.ts",
"src/renderer/src/components/terminal-pane/pty-connection-command-finished-cleanup.test.ts",
"src/renderer/src/components/terminal-pane/pty-connection-foreground-agent-routing.test.ts",
"src/renderer/src/components/terminal-pane/pty-connection-foreground-agent-sampling.test.ts",
"src/renderer/src/components/terminal-pane/pty-transport-reattach-admission.test.ts",
"src/renderer/src/components/terminal-pane/remote-runtime-pty-transport-pane-handle-resolution.test.ts",
"src/renderer/src/components/terminal-pane/terminal-pane-tab-detach.test.ts",
"src/renderer/src/components/terminal-pane/terminal-input-host-platform.test.ts",
"src/renderer/src/components/terminal-pane/terminal-shortcut-policy.test.ts",
"src/renderer/src/components/terminal-pane/terminal-windows-shift-enter.test.ts",
"src/renderer/src/store/slices/store-active-worktree-terminal-creation.test.ts",
"src/renderer/src/store/slices/terminal-pane-detach-agent-identity.test.ts",
"src/shared/agent-process-recognition.test.ts",
"src/shared/process-table-snapshot.test.ts",
"tests/e2e/terminal-foreground-confirmation.unit.test.ts",
"tests/e2e/terminal-shortcuts.spec.ts"
],
"assertionRefs": [
{
"file": "src/shared/process-table-snapshot.test.ts",
"assertions": [
"a fresh request bypasses a same-tick TTL cache and any scan already in flight before the request",
"same-turn fresh requests and ordinary cache misses share one later scan while requests arriving after it starts queue behind it"
]
},
{
"file": "src/main/providers/agent-foreground-process.test.ts",
"assertions": [
"successful root-present Windows enumeration and failed, blank, malformed, or root-missing enumeration remain distinct evidence states",
"an observed shell root with no children is authoritative while a snapshot omitting that root is unavailable",
"an attached Droid candidate is authorized only when exact ConPTY membership contains it, while a detached Start-Process descendant is rejected",
"a Windows process-table scan with no recognized agent performs zero ConPTY membership helper forks",
"fresh POSIX scan failure or a snapshot missing the PTY root is unavailable rather than shell proof",
"the compatibility process-name API still preserves its existing fallback contract for other consumers"
]
},
{
"file": "src/main/providers/windows-console-attached-processes.test.ts",
"assertions": [
"the fixed node-pty helper returns validated integer console membership containing the PTY root",
"root-only fallback, malformed/missing-root messages, spawn errors, and a silent helper timeout all fail closed",
"the bounded timeout kills the child helper exactly once"
]
},
{
"file": "src/main/providers/windows-pty-job-membership.test.ts",
"assertions": [
"never spawns a child process to answer",
"refuses an answer that does not contain the shell",
"is asked with the pty handle, because a bare pid cannot find the job"
]
},
{
"file": "src/main/daemon/pty-subprocess-foreground-degraded-scan.test.ts",
"assertions": [
"stops holding a dead agent once the job answer is only a superset",
"restores the idle refresh backoff once the dead identity is gone",
"never expires an identity while scans stay degraded",
"never expires an identity while the job answer is unverifiable"
]
},
{
"file": "src/main/providers/local-pty-provider-foreground-process.test.ts",
"assertions": [
"a delayed foreground confirmation is discarded after the owning PTY exits"
]
},
{
"file": "src/main/daemon/daemon-pty-adapter.test.ts",
"assertions": [
"new daemon sessions and warm reattach results carry the same minimal allowlisted launchAgent"
]
},
{
"file": "src/main/daemon/daemon-server.test.ts",
"assertions": [
"daemon protocol v21 persists allowlisted launchAgent across reattach and drops unknown identity strings"
]
},
{
"file": "src/main/daemon/pty-subprocess.test.ts",
"assertions": [
"Windows daemon foreground lookup can return PowerShell synchronously before async process-tree enrichment resolves the agent",
"the enriched agent result is served by a later foreground read",
"fresh confirmation awaits a post-request scan instead of serving cached PowerShell and returns null when inspection is unavailable"
]
},
{
"file": "tests/e2e/terminal-foreground-confirmation.unit.test.ts",
"assertions": [
"the real daemon handle and pane tracker keep restored Droid identity when confirmation resolves after the old cache window",
"one fresh command-finish scan confirms real shell exit, while unavailable inspection performs exactly three bounded reads and never claims shell"
]
},
{
"file": "src/renderer/src/components/terminal-pane/keyboard-handlers.test.ts",
"assertions": [
"the production keyboard-policy boundary requires active-host routing and composes macOS Shift+Enter with Windows PTY bytes"
]
},
{
"file": "src/renderer/src/components/terminal-pane/remote-runtime-pty-transport-pane-handle-resolution.test.ts",
"assertions": [
"a legacy remote PTY id retains the transport's captured runtime environment identity"
]
},
{
"file": "src/renderer/src/components/terminal-pane/terminal-input-host-platform.test.ts",
"assertions": [
"SSH terminals use remote-platform metadata and execution-host identity when the active transport has not captured a connection id",
"encoded and legacy active remote-runtime PTY identities plus a live local PTY session outrank later worktree host changes",
"a live WSL session normalizes to a Linux terminal host",
"missing SSH/runtime platform metadata and local terminals fall back to the client platform"
]
},
{
"file": "src/renderer/src/components/terminal-pane/terminal-shortcut-policy.test.ts",
"assertions": [
"Windows defaults and non-Droid agents preserve Esc+CR while explicit Droid capability selects CSI-u",
"Windows and non-Windows PTYs reached cross-OS use CSI-u only with active Kitty keyboard protocol unless trusted Windows Droid evidence independently authorizes it",
"unrelated keys invoke neither host, agent, nor protocol callbacks"
]
},
{
"file": "src/renderer/src/components/terminal-pane/terminal-windows-shift-enter.test.ts",
"assertions": [
"only routing-trusted current process identity overrides launch evidence and confirmed shell foreground clears stale identity",
"a newer untrusted or neutral command generation blocks stale launch ownership until confirmation",
"only allowlisted fresh process or pane-scoped launch ownership selects Droid's CSI-u capability",
"forged hook or OSC-derived Droid status cannot change the Windows byte encoding",
"after split and original-pane close, a sole surviving sibling cannot inherit the original pane's Droid launch identity"
]
},
{
"file": "src/renderer/src/components/terminal-pane/pane-foreground-agent-tracker.test.ts",
"assertions": [
"manual and restored local agent identity is published from bounded foreground-process reads",
"a delayed read cannot publish after the pane rebinds to a replacement PTY id",
"every new command publishes a routing-neutral generation before confirmation",
"typed agent text only widens the confirmation window and never becomes published or routable identity",
"unavailable typed-command confirmation stays on legacy routing through the three-read ladder and then fails closed",
"ordinary fast OSC 133;C-to-D command pairs publish shell without a fresh confirmation scan",
"command-start and visible launch recovery use at most three reads across the bounded 350 ms, 1.2 s, and 6 s ladder",
"null and rejected reads participate in the same bounded known-identity ladder",
"command-finished accepts one fresh recognized shell scan when agent evidence exists, while unavailable final evidence retires routing without claiming shell"
]
},
{
"file": "src/renderer/src/components/terminal-pane/pty-connection-command-finished-cleanup.test.ts",
"assertions": [
"a still-running Droid process republishes Droid instead of being overwritten with shell-foreground evidence",
"typed Droid input cannot replace live Antigravity process or pane-scoped launch identity inside another TUI",
"typed Droid input on SSH or remote-runtime panes never writes local process evidence",
"Droid routing survives a fresh command-finish scan that still sees Droid and retires after one fresh shell result",
"a D-to-C transition immediately routes legacy bytes while the new command generation is pending",
"unavailable command-finish evidence resolves deferred cleanup, returns legacy routing, and does not assert shell foreground"
]
},
{
"file": "src/renderer/src/components/terminal-pane/pty-connection-foreground-agent-routing.test.ts",
"assertions": [
"typing droid does not route CSI-u until fresh process evidence confirms Droid",
"null and rejected command-start reads never promote typed Droid text to process evidence",
"a manually typed Droid in a shell without OSC 133 gains routing only after accepted-input fresh confirmation",
"accepted no-OSC exit or interrupt input immediately revokes trusted Droid bytes and confirms the returned shell"
]
},
{
"file": "src/renderer/src/components/terminal-pane/pty-connection-foreground-agent-sampling.test.ts",
"assertions": [
"after detach remount, pane-key launch/process identity forces a leaked nested OSC 133;D through foreground confirmation",
"an identityless visible-read versus OSC 133;D race cancels stale sampling and fails closed to shell",
"daemon-returned allowlisted launchAgent requests warm-reattach confirmation without restoring stale byte authority or the original args/env payload, while missing identity fails closed",
"an unknown persisted wrapper cannot spoof launch identity and confirmed shell state prevents repeat focus scans"
]
},
{
"file": "src/renderer/src/components/terminal-pane/pty-transport-reattach-admission.test.ts",
"assertions": [
"allowlisted daemon launchAgent reaches PtyConnectResult on reattach",
"unknown launch identity is dropped at the renderer transport boundary"
]
},
{
"file": "src/renderer/src/store/slices/terminal-pane-detach-agent-identity.test.ts",
"assertions": [
"pane-to-tab detach moves only the detached leaf's launch and process identity to its new pane key",
"pane-to-tab detach preserves the source PTY shell override across native PowerShell and WSL classifications",
"the source hook snapshot is retired rather than copied to a key the running PTY cannot emit",
"the detached Droid keeps CSI-u while the source sibling keeps its own legacy encoding"
]
},
{
"file": "src/shared/agent-process-recognition.test.ts",
"assertions": [
"Droid's process name resolves to the allowlisted Droid agent identity without substring matching"
]
},
{
"file": "tests/e2e/terminal-shortcuts.spec.ts",
"assertions": [
"on Windows the focused terminal sends CSI-u bytes for a Droid pane and Esc+CR bytes after switching that same pane to Antigravity identity",
"the byte oracle observes the real renderer-to-main PTY write path rather than terminal DOM state"
]
}
],
"evidenceRuns": [
{
"date": "2026-08-25",
"runner": "local",
"platform": "macos",
"command": "pnpm exec vitest run --config config/vitest.config.ts src/main/daemon/daemon-foreground-confirmation-protocol.test.ts src/main/daemon/daemon-pty-adapter.test.ts src/main/daemon/daemon-pty-router.test.ts src/main/daemon/daemon-server.test.ts src/main/daemon/degraded-daemon-pty-provider.test.ts src/main/daemon/pty-subprocess-foreground-scan-cadence.test.ts src/main/daemon/pty-subprocess.test.ts src/main/ipc/pty-runtime-kill-and-exit.test.ts src/main/providers/agent-foreground-process.test.ts src/main/providers/local-pty-provider-foreground-process.test.ts src/main/daemon/pty-subprocess-foreground-degraded-scan.test.ts src/main/providers/windows-console-attached-processes.test.ts src/main/providers/windows-pty-job-membership.test.ts src/renderer/src/components/terminal-pane/pane-foreground-agent-tracker.test.ts src/renderer/src/components/terminal-pane/pty-connection-command-finished-cleanup.test.ts src/renderer/src/components/terminal-pane/pty-connection-foreground-agent-routing.test.ts src/renderer/src/components/terminal-pane/pty-connection-foreground-agent-sampling.test.ts src/renderer/src/components/terminal-pane/pty-transport-reattach-admission.test.ts src/renderer/src/components/terminal-pane/terminal-pane-tab-detach.test.ts src/renderer/src/components/terminal-pane/terminal-shortcut-policy.test.ts src/renderer/src/components/terminal-pane/terminal-windows-shift-enter.test.ts src/renderer/src/store/slices/store-active-worktree-terminal-creation.test.ts src/renderer/src/store/slices/terminal-pane-detach-agent-identity.test.ts src/shared/agent-process-recognition.test.ts src/shared/process-table-snapshot.test.ts tests/e2e/terminal-foreground-confirmation.unit.test.ts",
"result": "passed",
"durationSeconds": 3.88,
"summary": "Twenty-six focused test files passed (489 tests) on the PR head, covering fresh-scan ordering/deduplication, exact ConPTY membership and detached-child rejection, stale PTY guards, daemon v21 launch ownership with current-process confirmation, no-OSC command/exit recovery, preserved detach shell classification, unavailable evidence, routing-neutral command generations, exact shortcut bytes, and the composed daemon-plus-tracker contract; the Windows Electron byte test remains platform-gated and is not counted as local macOS evidence."
}
],
"runtimeBudget": {
"p95Seconds": 90,
"scope": "focused renderer units plus the Windows Electron terminal-shortcut spec"
},
"flakeHistory": {
"status": "unknown",
"evidence": "The deterministic units are stable locally; the Windows-only Electron byte path needs CI or nightly soak history before promotion."
},
"redGreenEvidence": {
"status": "partial",
"evidence": "Reverting to the previous unconditional Windows Esc+CR branch fails the Droid byte assertion, while resolving launch metadata from any key other than the active pane fails the split-survivor isolation assertion. Saved intentional-break artifacts and live Windows history are still missing."
},
"performanceBudget": {
"required": true,
"evidence": "Callback-count tests prove unrelated ordinary keys invoke neither host, agent, nor Kitty-protocol resolution. Host and agent callbacks are created once per keyboard effect, so printable input adds no per-key allocations or store reads. Shift+Enter performs bounded synchronous active-transport and indexed store lookups, plus at most one pane-keyed protocol-mode lookup when trusted Windows Droid evidence does not already authorize CSI-u, with no IPC, RPC, subprocess, polling, listener, or timer. Typed text performs no routing write. Ordinary fast OSC 133;C-to-D shell commands perform no fresh confirmation RPC or process scan. An accepted submit/interrupt while trusted Droid is current, a typed allowlisted agent command, title exit, focus, visibility transition, or an idle burst after trusted Droid Shift+Enter can schedule the bounded confirmation ladder; each event cancels/deduplicates prior work and no timer recurs after settling. Windows confirmation performs one fresh process-table scan and forks exact ConPTY membership only after a recognized agent candidate appears; no recognized candidate makes zero helper calls. Same-turn fresh requests share one scan and later arrivals queue at most one successor. Recovery remains three bounded one-shot reads (350 ms, 1.2 s, 6 s). No polling loop, provider fanout, persistent listener, hidden-pane wake loop, or per-printable-key work is added."
},
"promotionCriteria": [
"Run the exact PTY-byte Electron oracle on Windows without silent platform skips.",
"Collect stable runtime and flake history for local and daemon Windows ConPTY while retaining deterministic host-routing assertions for SSH, WSL, and remote runtime.",
"Attach saved intentional-break evidence for Droid capability removal and split-sibling identity leakage."
],
"knownGaps": [
"No Windows runner or live Windows PTY evidence is attached; the Electron byte test skips on macOS and Linux, while a live Linux SSH PTY covers only the remote Linux host path.",
"Droid agent-specific CSI-u authorization is available only from trusted pane evidence; without it, Windows and non-Windows PTY hosts depend on the application's Kitty keyboard protocol state.",
"The Electron test injects allowlisted pane identity rather than launching the real Droid and Antigravity binaries.",
"If both Windows process-enumeration backends remain unavailable through the bounded ladder, routing fails closed to the legacy Esc+CR path; no live Droid artifact covers that degraded host configuration.",
"Protocol v21 restarts older daemons because the minimal persisted launchAgent is a new contract; sessions preserved by pre-v21 daemons cannot supply warm-reattach launch ownership and fail closed until current process confirmation or restart.",
"No live daemon, WSL, remote-runtime, paired-web, or restore/replay byte artifact has been collected; SSH is covered only by a macOS-client-to-Linux-host relay run.",
"A running PTY keeps its spawn-time ORCA_PANE_KEY after pane-to-tab detach. This change transfers launch/process routing evidence and retires the stale hook snapshot, but does not redesign future hook reattribution across tab IDs."
],
"demotionRule": "Keep non-blocking or demote to protection none if the Windows byte test silently skips, flakes without an actionable artifact, routes bytes using tab/title/terminal-output heuristics, or adds any ordinary-key lookup, IPC, polling, scan, or lifecycle leak."
},
{
"id": "terminal-input.guarded-agent-send-authorization",
"title": "Guarded agent sends authorize only the confirmed exact PTY",
"maturity": "experimental",
"protection": "partial",
"owner": "terminal-input",
"layer": "runtime-provider-contract",
"surfaces": [
"terminal input",
"guarded note sends",
"agent status",
"PTY identity",
"foreground process confirmation"
],
"platforms": ["macos", "linux", "windows"],
"providers": ["local", "daemon", "ssh", "wsl", "remote-runtime"],
"coveredPlatforms": ["macos"],
"coveredProviders": ["local", "daemon"],
"coverageNotes": "Runtime and provider-contract tests on macOS cover exact-PTY authorization, verified managed-Claude launch identity, local/daemon fresh confirmation, exact ConPTY membership, and unsupported-provider fail-closed behavior. Physical Windows, live Linux, SSH, WSL, and remote-runtime validation remain explicit gaps; providers without confirmation preserve conservative refusal when no verified launch identity exists.",
"motivatingLinks": ["https://github.com/stablyai/orca/issues/8303"],
"invariant": "A guarded note send writes only to the exact PTY binding checked by the guard and only while permission/wait evidence allows input; a generic busy title requires independent agent identity from the title, a verified managed launch bound to the current PTY incarnation, or the foreground process; fresh hook state conflicting with an ordinary shell foreground requires fresh provider confirmation of a recognized agent in that PTY.",
"oracle": "A quarter-circle Claude task title authorizes without a provider lookup only on the exact PTY incarnation carrying verified managed-Claude launch identity; the same title in a bare pane, with an unverified launch hint, or after PTY incarnation replacement is refused while current Claude activity remains a working signal. Fresh explicit state plus ordinary PowerShell plus confirmed recognized agent is sendable on the same PTY. Confirmed shell/non-agent, unavailable confirmation, PTY exit, handle rebind, or a callback PTY mismatch returns a refusal or not-writable result and writes zero bytes.",
"commands": [
"pnpm exec vitest run --config config/vitest.config.ts src/main/runtime/quarter-circle-title-send-authorization.test.ts",
"pnpm exec vitest run --config config/vitest.config.ts src/main/runtime/orca-runtime.test.ts src/main/runtime/rpc/terminal-send.test.ts src/main/ipc/pty-runtime-kill-and-exit.test.ts src/main/providers/agent-foreground-process.test.ts src/main/providers/local-pty-provider-foreground-process.test.ts src/main/daemon/pty-subprocess-foreground-degraded-scan.test.ts src/main/providers/windows-console-attached-processes.test.ts src/main/providers/windows-pty-job-membership.test.ts src/main/daemon/daemon-foreground-confirmation-protocol.test.ts src/main/daemon/pty-subprocess.test.ts src/renderer/src/lib/active-agent-note-send-explicit-target.test.ts src/renderer/src/components/browser-pane/annotate/BrowserAnnotationSendMenuContent.test.tsx"
],
"testFiles": [
"src/main/runtime/quarter-circle-title-send-authorization.test.ts",
"src/main/runtime/orca-runtime.test.ts",
"src/main/runtime/rpc/terminal-send.test.ts",
"src/main/ipc/pty-runtime-kill-and-exit.test.ts",
"src/main/providers/agent-foreground-process.test.ts",
"src/main/providers/local-pty-provider-foreground-process.test.ts",
"src/main/daemon/pty-subprocess-foreground-degraded-scan.test.ts",
"src/main/providers/windows-console-attached-processes.test.ts",
"src/main/providers/windows-pty-job-membership.test.ts",
"src/main/daemon/daemon-foreground-confirmation-protocol.test.ts",
"src/main/daemon/pty-subprocess.test.ts",
"src/renderer/src/lib/active-agent-note-send-explicit-target.test.ts",
"src/renderer/src/components/browser-pane/annotate/BrowserAnnotationSendMenuContent.test.tsx"
],
"assertionRefs": [
{
"file": "src/main/runtime/quarter-circle-title-send-authorization.test.ts",
"assertions": [
"a verified managed-Claude launch authorizes a task-text quarter-circle title without foreground-process work",
"a bare pane, an unverified launch hint, and a replacement PTY incarnation remain refused",
"quarter circles remain working signals and braille authorization is unchanged"
]
},
{
"file": "src/main/runtime/orca-runtime.test.ts",
"assertions": [
"a recognized fresh provider confirmation authorizes explicit hook state over an ordinary shell result",
"shell, non-agent, null, thrown, and missing confirmation remain fail-closed",
"title blockers and ordinary recognized agent evidence add no confirmation call",
"PTY exit or handle rebind during either foreground read rejects evidence bound to the original PTY",
"controller-less yields preserve stale-handle errors and confirmation methods retain their controller receiver"
]
},
{
"file": "src/main/runtime/rpc/terminal-send.test.ts",
"assertions": [
"a handle rebind during guarded status evaluation returns not writable and writes zero bytes",
"the callback's actual PTY must equal the handle binding before status can authorize a write"
]
},
{
"file": "src/main/ipc/pty-runtime-kill-and-exit.test.ts",
"assertions": [
"runtime confirmation reaches the provider owning the captured PTY",
"unsupported or missing providers return unavailable confirmation"
]
},
{
"file": "src/main/providers/agent-foreground-process.test.ts",
"assertions": [
"recognized Windows candidates require exact ConPTY membership and detached descendants are rejected",
"unavailable process inspection is distinct from authoritative shell evidence"
]
},
{
"file": "src/main/providers/local-pty-provider-foreground-process.test.ts",
"assertions": ["fresh confirmation is discarded when its owning local PTY exits"]
},
{
"file": "src/main/providers/windows-console-attached-processes.test.ts",
"assertions": [
"exact ConPTY console membership comes from the fixed node-pty helper",
"malformed, incomplete, timed-out, and spawn-error membership reads fail closed"
]
},
{
"file": "src/main/daemon/daemon-foreground-confirmation-protocol.test.ts",
"assertions": [
"daemons from before the fresh-confirmation RPC are rejected by protocol version"
]
},
{
"file": "src/main/daemon/pty-subprocess.test.ts",
"assertions": [
"fresh confirmation bypasses cached PowerShell and waits for a post-request process scan"
]
},
{
"file": "src/renderer/src/lib/active-agent-note-send-explicit-target.test.ts",
"assertions": ["selected active-agent note sends retain guarded paste and submit routing"]
},
{
"file": "src/renderer/src/components/browser-pane/annotate/BrowserAnnotationSendMenuContent.test.tsx",
"assertions": [
"browser annotation send content routes through review-notes send so existing agent sessions remain selectable",
"both browser annotation send surfaces wire the shared menu content"
]
}
],
"evidenceRuns": [
{
"date": "2026-08-12",
"runner": "local",
"platform": "macos",
"command": "pnpm exec vitest run --config config/vitest.config.ts src/main/runtime/quarter-circle-title-send-authorization.test.ts",
"result": "passed",
"durationSeconds": 20.9,
"summary": "The focused file passed 9 tests, including current-incarnation managed-Claude authorization with zero foreground calls and fail-closed bare, unverified, and replacement-incarnation quarter-circle titles."
},
{
"date": "2026-08-25",
"runner": "local",
"platform": "macos",
"command": "pnpm exec vitest run --config config/vitest.config.ts src/main/runtime/orca-runtime.test.ts src/main/runtime/rpc/terminal-send.test.ts src/main/ipc/pty-runtime-kill-and-exit.test.ts src/main/providers/agent-foreground-process.test.ts src/main/providers/local-pty-provider-foreground-process.test.ts src/main/daemon/pty-subprocess-foreground-degraded-scan.test.ts src/main/providers/windows-console-attached-processes.test.ts src/main/providers/windows-pty-job-membership.test.ts src/main/daemon/daemon-foreground-confirmation-protocol.test.ts src/main/daemon/pty-subprocess.test.ts src/renderer/src/lib/active-agent-note-send-explicit-target.test.ts src/renderer/src/components/browser-pane/annotate/BrowserAnnotationSendMenuContent.test.tsx",
"result": "passed",
"durationSeconds": 13.74,
"summary": "Twelve focused test files passed (1351 tests, 1 skipped), covering runtime confirmation and PTY revalidation, guarded RPC zero-write behavior, PTY controller routing, local/daemon fresh scans, exact ConPTY membership, and unchanged renderer note routing."
}
],
"runtimeBudget": {
"p95Seconds": 45,
"scope": "focused runtime, RPC, PTY provider, and renderer routing units"
},
"flakeHistory": {
"status": "unknown",
"evidence": "Deterministic units have local coverage only; promotion requires repeated CI and platform history."
},
"redGreenEvidence": {
"status": "partial",
"evidence": "Before the verified-launch fallback, the managed-Claude unavailable-foreground case failed with isRunningAgent false; the focused file passed 7 tests after the fix. Removing the launch-incarnation comparison makes the replacement-incarnation refusal fail. Removing strong confirmation fails the shell-conflict success oracle, while removing either exact-binding comparison fails zero-write rebind coverage; physical Windows evidence remains missing."
},
"performanceBudget": {
"required": true,
"evidence": "Confirmation is invoked at most once per status evaluation and only for fresh explicit hook state whose ordinary foreground result is a shell. Count tests prove verified managed-Claude launch identity, permission/title blockers, and ordinary recognized-agent evidence add zero provider calls; no polling, retry, session listing, provider fanout, or runtime-global cache is added, and existing provider snapshot dedup remains authoritative."
},
"promotionCriteria": [
"Run the browser annotation existing-agent and repeat-send path in Electron on Windows ConPTY without a recognition refusal.",
"Collect stable CI and flake history across local and daemon providers on Windows plus representative macOS/Linux coverage.",
"Attach saved intentional-break evidence for confirmation removal and exact-PTY revalidation removal."
],
"knownGaps": [
"Physical Windows validation is unavailable on the current macOS host; exact ConPTY membership is covered deterministically.",
"Electron annotation golden-path, repeat-send, adjacent-menu evidence, and screenshots are left to coordinator validation.",
"SSH, WSL, legacy daemon, and remote-runtime providers without confirmation remain intentionally fail-closed on an ordinary-shell conflict; no live artifacts cover those degraded paths.",
"No live Linux PTY, paired-web, mobile/relay, restore/replay, or multi-window artifact is attached; those surfaces receive no renderer, persistence, or protocol change."
],
"demotionRule": "Keep non-blocking or demote to protection none if a generic busy title authorizes without exact title, verified-launch, or foreground identity; provider confirmation becomes unconditional; exact-PTY mismatch can write bytes; unsupported providers fail open; or the focused gate flakes without an actionable product or harness defect."
},
{
"id": "terminal-input.cli-agent-prompt-submit",
"title": "CLI text plus Enter settles recognized agent composers before submit",
"maturity": "experimental",
"protection": "partial",
"owner": "terminal-input",
"layer": "cli-rpc-runtime-pty-contract",
"surfaces": [
"terminal send CLI",
"terminal.send RPC",
"agent prompt injection",
"PTY writes",
"bracketed paste"
],
"platforms": ["macos", "linux", "windows"],
"providers": ["local", "daemon", "ssh", "remote-runtime"],
"coveredPlatforms": ["macos", "windows"],
"coveredProviders": ["local"],
"coverageNotes": "Source-built macOS and physical Windows Electron journeys cover the public CLI through RPC, runtime identity, real PTY/ConPTY writes, and a delayed fake Codex composer. Focused units cover CLI intent, fresh Claude/Codex foreground identity, framing bytes, stale-agent shell fallback, and exact legacy behavior for every other configured agent. SSH, daemon, and remote-runtime remain explicit gaps.",
"motivatingLinks": [
"https://linear.app/stably/issue/STA-4328",
"https://github.com/stablyai/orca/issues/14525"
],
"invariant": "A public CLI send containing non-empty text plus Enter and no interrupt identifies agent-prompt intent. The owning runtime uses bracketed-paste and settled submit only when a fresh foreground-process read positively identifies the exact target as Claude or Codex on a desktop call; every other agent, stale agent metadata over a shell, text-only input, bare Enter, interrupts, mobile input, query replies, and older clients keep the direct terminal contract.",
"oracle": "Launch a bare fake Codex through the real Electron PTY and delay its composer render for 1,200 ms, beyond the legacy generic 500 ms gap. Send a 557-byte prompt with the public CLI and require the marker, zero premature Enter, no rescue Enter, and one submission. POSIX child stdin must retain one bracketed-paste frame; Windows ConPTY consumes that control frame, so runtime tests require the frame at the PTY write boundary while the Windows child requires the exact prompt. The same harness against the installed pre-fix runtime must record one premature Enter and require one bare rescue Enter. Focused units require CLI intent only for text plus Enter, settlement only for freshly identified Claude/Codex, the legacy platform delay for every other configured agent, stale Codex launch identity over a shell to fall back, no wrapper polling, and byte-for-byte direct delivery for non-targets.",
"commands": [
"pnpm exec vitest run --config config/vitest.config.ts src/cli/handlers/terminal.test.ts src/main/runtime/rpc/terminal-agent-prompt-send.test.ts src/main/runtime/rpc/terminal-send.test.ts src/main/runtime/orca-runtime.test.ts src/shared/agent-prompt-injection.test.ts",
"pnpm run build:cli && pnpm exec playwright test tests/e2e/terminal-send-agent-prompt-submit.spec.ts --config tests/playwright.config.ts --project electron-headless --workers=1",
"pnpm.cmd exec playwright test tests/e2e/terminal-send-agent-prompt-submit.spec.ts --config tests/playwright.config.ts --project electron-headless --workers=1",
"node tests/tools/repro-terminal-send-submit.mjs --cli orca --worktree <registered-worktree> --discard-report"
],
"testFiles": [
"src/cli/handlers/terminal.test.ts",
"src/main/runtime/rpc/terminal-agent-prompt-send.test.ts",
"src/main/runtime/rpc/terminal-send.test.ts",
"src/main/runtime/orca-runtime.test.ts",
"src/shared/agent-prompt-injection.test.ts",
"tests/e2e/terminal-send-agent-prompt-submit.spec.ts",
"tests/tools/repro-terminal-send-submit.mjs"
],
"assertionRefs": [
{
"file": "src/cli/handlers/terminal.test.ts",
"assertions": [
"combined text and Enter carries explicit agent-prompt intent",
"text-only and bare Enter remain direct terminal input"
]
},
{
"file": "src/main/runtime/rpc/terminal-agent-prompt-send.test.ts",
"assertions": [
"a freshly proven Claude or Codex desktop target uses settled prompt delivery",
"a non-target agent or shell preserves the existing direct send"
]
},
{
"file": "src/main/runtime/orca-runtime.test.ts",
"assertions": [
"Claude and Codex wait for marker-gated composer quiescence before submit",
"every other configured TUI agent retains the legacy platform delay",
"a speculative CLI prompt check does not poll wrapper foregrounds",
"the PTY write boundary retains bracketed framing and one delayed submit"
]
},
{
"file": "tests/e2e/terminal-send-agent-prompt-submit.spec.ts",
"assertions": [
"the public source-built CLI submits after a delayed composer render without rescue",
"the fake agent receives the marker and zero premature Enter on macOS and Windows",
"POSIX preserves one bracketed-paste frame while Windows validates the ConPTY-observable payload"
]
}
],
"evidenceRuns": [
{
"date": "2026-08-14",
"runner": "local",
"platform": "macos",
"command": "node tests/tools/repro-terminal-send-submit.mjs --cli orca --worktree <registered-worktree> --discard-report",
"result": "failed",
"durationSeconds": 5.46,
"summary": "The installed pre-fix runtime received all 567 prompt bytes but no bracketed-paste frame; Enter arrived before the 1,200 ms composer render and one later bare Enter was required."
},
{
"date": "2026-08-14",
"runner": "local",
"platform": "macos",
"command": "pnpm run build:cli && pnpm exec playwright test tests/e2e/terminal-send-agent-prompt-submit.spec.ts --config tests/playwright.config.ts --project electron-headless --workers=1",
"result": "passed",
"durationSeconds": 38.5,
"summary": "Two independent final source-built CLI/RPC/runtime/PTY journeys passed with one bracketed-paste frame, zero premature Enter, and no rescue send (36.5s and 38.5s)."
},
{
"date": "2026-08-14",
"runner": "manual",
"platform": "windows",
"command": "pnpm.cmd exec playwright test tests/e2e/terminal-send-agent-prompt-submit.spec.ts --config tests/playwright.config.ts --project electron-headless --workers=1",
"result": "passed",
"durationSeconds": 47.6,
"summary": "Two independent physical Windows source-built Electron/CLI/ConPTY journeys passed at cf814f2f46 with the prompt marker received, zero premature Enter, and no rescue send (47.6s and 47.1s)."
},
{
"date": "2026-08-15",
"runner": "local",
"platform": "macos",
"command": "pnpm exec vitest run --config config/vitest.config.ts src/cli/handlers/terminal.test.ts src/main/runtime/rpc/terminal-agent-prompt-send.test.ts src/main/runtime/rpc/terminal-send.test.ts src/main/runtime/orca-runtime.test.ts src/shared/agent-prompt-injection.test.ts",
"result": "passed",
"durationSeconds": 23.2,
"summary": "After rebasing onto current main, the final narrowed runtime/CLI/RPC suite passed 1,201 tests with one skip, including fresh Claude/Codex identity, stale-agent shell fallback, and legacy timing for every other configured agent."
}
],
"runtimeBudget": {
"p95Seconds": 90,
"scope": "focused units plus one isolated Electron CLI/PTY journey"
},
"flakeHistory": {
"status": "unknown",
"evidence": "The final oracle passed twice in independent macOS app launches and twice on physical Windows. A shared --repeat-each fixture mode failed before test execution because only one seeded worktree loaded; supported isolated invocations were used for product evidence. CI history is not yet collected."
},
"redGreenEvidence": {
"status": "partial",
"evidence": "The fake-composer oracle was red against the installed pre-fix runtime with prematureEnters=1 and rescueSent=true. It also caught a source-built late-identity race with a complete paste frame but one premature Enter before the render gate began resolving foreground identity. The final candidate is green on macOS and Windows with prematureEnters=0 and rescueSent=false."
},
"performanceBudget": {
"required": true,
"evidence": "Only a CLI request with non-empty text plus Enter and no interrupt adds a bounded fresh foreground read and one non-retrying liveness check. Positively identified Claude and Codex reuse the O(prompt bytes) chunked prompt sender plus one PTY-local listener until post-marker quiescence or the bounded fallback. Every other agent and shell retains the existing direct-send path. Text-only, bare Enter, interrupt, mobile, renderer stream input, and query replies add no work."
},
"promotionCriteria": [
"Collect live Codex and Claude CLI sends on representative slow systems.",
"Retain mixed-version evidence that old hosts strip the optional intent and new hosts accept old clients without a protocol bump."
],
"knownGaps": [
"Live SSH/daemon/remote-runtime evidence is not yet attached.",
"Only Claude and Codex opt into settlement; every other agent retains the legacy behavior until independently validated.",
"A new CLI talking to an old host safely loses the optional field and therefore keeps the old timing behavior until the host updates.",
"The E2E fake agent models the submission race without requiring external agent authentication; live account-backed agents are covered separately."
],
"demotionRule": "Keep experimental or demote to protection none if direct shell/mobile/query input is reframed, an unrecognized target receives bracketed paste, a prompt can emit duplicate Enter, mixed-version decoding rejects the optional field, or the deterministic fake-composer candidate requires a rescue send."
},
{
"id": "terminal-input.agent-prompt-injection",
"title": "Orchestration agent prompts arrive as bracketed paste before submit",
"maturity": "experimental",
"protection": "partial",
"owner": "terminal-input",
"layer": "runtime-contract-and-cli-repro",
"surfaces": [
"terminal input",
"agent prompt injection",
"orchestration dispatch",
"PTY writes",
"bracketed paste"
],
"platforms": ["macos", "linux", "windows"],
"providers": ["local", "daemon", "ssh", "remote-runtime"],
"coveredPlatforms": ["macos"],
"coveredProviders": ["local"],
"coverageNotes": "Local macOS evidence covers the runtime PTY write contract, live Codex orchestration, a dev-runtime CLI repro, and Claude and Codex composer traces. A deterministic worker-start RPC/SQLite contract proves delayed Codex composer acceptance, exactly one submitted turn, durable Dispatch success, and explicit stalled failure when Enter is swallowed without a rescue send. The render gate stays on the PTY-owning runtime, so paired and SSH callers use the same provider write/output path without a wire change. SSH, daemon, remote-runtime, Linux, and Windows live journeys remain gaps.",
"motivatingLinks": [
"https://linear.app/stably/issue/STA-3800",
"https://linear.app/stably/issue/STA-3904",
"https://linear.app/stably/issue/STA-4328",
"https://github.com/stablyai/orca/issues/7226",
"https://github.com/stablyai/orca/issues/13821",
"https://github.com/stablyai/orca/issues/14347"
],
"invariant": "Injected orchestration task prompts for recognized agent CLIs must send the prompt body inside one bracketed-paste frame, sanitize embedded ESC bytes, preserve chunk boundaries without losing the frame, and submit exactly once only after the agent can accept Enter. A successful orchestration.workerStart must durably record exactly one accepted and started turn; a swallowed Enter must fail with agent_prompt_stalled and never trigger a blind rescue Enter. Claude and Codex must emit a post-paste composer marker and then settle, or reach the bounded fallback first; every other agent retains the platform delay.",
"oracle": "Runtime tests assert the exact PTY write sequence, failure cleanup, Claude/Codex marker-gated multi-frame renders, and the legacy platform delay for every other configured agent. The candidate resets settlement on later frames, gives a late marker a fresh bounded window, and still submits once at the hard deadline if output never settles. The worker-start contract drives the production RPC through a delayed fake Codex composer and independently checks exact turn/Enter counts plus reopened SQLite Task, Dispatch, worker receipt, and mutation receipt state for accepted and swallowed outcomes. Other orchestration tests assert dispatch/coordinator use the agent prompt path; the live CLI harness covers long Codex-like framing.",
"commands": [
"pnpm exec vitest run --config config/vitest.config.ts src/shared/agent-prompt-injection.test.ts src/main/runtime/orca-runtime.test.ts src/main/runtime/rpc/methods/orchestration-tasks-dispatch.test.ts src/main/runtime/orchestration/coordinator.test.ts",
"pnpm exec vitest run --config config/vitest.config.ts src/main/runtime/rpc/methods/orchestration-worker-start-prompt-contract.test.ts --reporter=dot",
"node tests/tools/repro-orchestration-long-prompt.mjs --cli out/bin/orca-dev --mode codex-like --size-kb 32 --timeout-ms 20000"
],
"testFiles": [
"src/shared/agent-prompt-injection.test.ts",
"src/main/runtime/orca-runtime.test.ts",
"src/main/runtime/rpc/methods/orchestration-tasks-dispatch.test.ts",
"src/main/runtime/rpc/methods/orchestration-worker-start-prompt-contract.test.ts",
"src/main/runtime/orchestration/coordinator.test.ts",
"tests/tools/repro-orchestration-long-prompt.mjs"
],
"assertionRefs": [
{
"file": "src/shared/agent-prompt-injection.test.ts",
"assertions": [
"agent prompts are always framed as bracketed paste",
"submit stays separate from the paste frame",
"embedded ESC bytes are made inert before framing",
"chunk reconstruction preserves the paste frame"
]
},
{
"file": "src/main/runtime/orca-runtime.test.ts",
"assertions": [
"runtime writes bracketed paste before a delayed submit",
"Claude and Codex ignore unrelated and split pre-marker output, then wait for render quiescence before one submit",
"every other configured TUI agent retains the platform delay",
"a late Codex marker receives a fresh settlement window before one submit",
"a silent Claude composer reaches one bounded fallback submit",
"a marked Claude composer with continuous render output reaches one bounded fallback submit",
"large prompt frames are chunked and reconstructed before submit",
"partial prompt write failure closes the paste frame and does not submit"
]
},
{
"file": "src/main/runtime/rpc/methods/orchestration-tasks-dispatch.test.ts",
"assertions": [
"orchestration.dispatch uses the agent prompt path for injected preambles",
"raw terminal.send is not called for injected task prompts",
"failed prompt injection rolls back the active dispatch"
]
},
{
"file": "src/main/runtime/rpc/methods/orchestration-worker-start-prompt-contract.test.ts",
"assertions": [
"delayed composer readiness produces exactly one submitted and started turn with no premature Enter and durable ready receipts",
"a swallowed Enter records agent_prompt_stalled across Task, Dispatch, worker, and mutation receipts without a rescue Enter"
]
},
{
"file": "src/main/runtime/orchestration/coordinator.test.ts",
"assertions": [
"coordinator dispatch failures from prompt injection circuit-break through the DB",
"silent-skip paths do not attempt prompt injection"
]
},
{
"file": "tests/tools/repro-orchestration-long-prompt.mjs",
"assertions": [
"fake Codex-like worker observes submit after long orchestration dispatch",
"32KB task marker survives before submit",
"prompt bytes include a bracketed-paste frame with zero unframed line breaks"
]
}
],
"evidenceRuns": [
{
"date": "2026-08-23",
"runner": "local",
"platform": "macos",
"command": "pnpm exec vitest run --config config/vitest.config.ts src/main/runtime/rpc/methods/orchestration-worker-start-prompt-contract.test.ts --reporter=dot",
"result": "passed",
"durationSeconds": 21.84,
"summary": "Two deterministic worker-start RPC contracts passed with fake clocks and reopened SQLite receipts for one accepted turn and one swallowed-Enter stalled outcome."
},
{
"date": "2026-08-14",
"runner": "local",
"platform": "macos",
"command": "pnpm exec vitest run --config config/vitest.config.ts src/shared/agent-prompt-injection.test.ts src/main/runtime/orca-runtime.test.ts src/main/runtime/rpc/methods/orchestration-tasks-dispatch.test.ts src/main/runtime/orchestration/coordinator.test.ts",
"result": "passed",
"durationSeconds": 11.32,
"summary": "4 files and 1,303 tests passed with one skipped. Claude and Codex both wait for post-marker quiescence, and a Codex marker arriving at 7.9 seconds receives a fresh window through its final slow frame. Exact-build live Codex workers accepted injected prompts without manual Enter, replied, called worker_done, and settled successfully in the rendered Electron UI."
},
{
"date": "2026-08-13",
"runner": "local",
"platform": "macos",
"command": "pnpm exec vitest run --config config/vitest.config.ts src/shared/agent-prompt-injection.test.ts src/main/runtime/orca-runtime.test.ts src/main/runtime/rpc/methods/orchestration-tasks-dispatch.test.ts src/main/runtime/orchestration/coordinator.test.ts",
"result": "passed",
"durationSeconds": 13.3,
"summary": "4 files and 1,283 tests passed. The hardened multi-frame oracle failed on the first-marker candidate because it submitted at 751 ms during an intermediate Claude frame; the quiescence candidate waited through the final 1,000 ms frame and submitted once at 2,500 ms. Continuous render output remained bounded to one fallback submit at 8 seconds. An isolated Claude Code 2.1.231 Haiku probe saw the first marker at 400 ms, continued output through 1,500 ms, sent one Enter at 3,000 ms after 1.5 seconds quiet, and created the expected marker; no Fable or Opus probe was used."
},
{
"date": "2026-08-13",
"runner": "local",
"platform": "macos",
"command": "pnpm exec vitest run --config config/vitest.config.ts src/shared/agent-prompt-injection.test.ts src/main/runtime/orca-runtime.test.ts src/main/runtime/rpc/methods/orchestration-tasks-dispatch.test.ts src/main/runtime/orchestration/coordinator.test.ts",
"result": "passed",
"durationSeconds": 16.9,
"summary": "4 files and 1,282 tests passed. Unmodified main wrote Enter at 500 ms before the deterministic Claude composer rendered at 750 ms; the candidate waited for the split show-cursor marker and wrote one Enter. A live Claude Code 2.1.231 Haiku trace rendered the pasted marker and show-cursor in one 523-byte frame without submitting a model request."
},
{
"date": "2026-07-07",
"runner": "local",
"platform": "macos",
"command": "pnpm exec vitest run --config config/vitest.config.ts src/shared/agent-prompt-injection.test.ts src/main/runtime/orca-runtime.test.ts src/main/runtime/rpc/methods/orchestration-tasks-dispatch.test.ts src/main/runtime/orchestration/coordinator.test.ts",
"result": "passed",
"durationSeconds": 7.4,
"summary": "4 test files passed, 697 tests passed; covers framing, runtime PTY writes, orchestration RPC dispatch, and coordinator dispatch behavior."
},
{
"date": "2026-07-07",
"runner": "local",
"platform": "macos",
"command": "node tests/tools/repro-orchestration-long-prompt.mjs --cli out/bin/orca-dev --mode codex-like --size-kb 32 --timeout-ms 20000",
"result": "passed",
"durationSeconds": 2.2,
"summary": "Live dev-runtime repro passed: expectedSpecBytes=32830, hasSubmit=true, rawContainsMarker=true, hasBracketedPasteFrame=true, unframedLineBreaks=0, contractOk=true."
}
],
"runtimeBudget": {
"p95Seconds": 30,
"scope": "runtime contract tests plus optional local dev-runtime CLI repro"
},
"flakeHistory": {
"status": "unknown",
"evidence": "First local macOS evidence only; needs repeated dev-runtime harness runs and provider matrix evidence before promotion."
},
"redGreenEvidence": {
"status": "partial",
"evidence": "The original Claude-shaped oracle fails on unmodified main and passes with the render gate. The hardened multi-frame oracle then fails on the first-marker candidate, which submits at 751 ms during an intermediate frame, and passes when the gate requires post-marker quiescence. Codex used the legacy platform delay before this candidate; the late-marker oracle proves the original deadline would pre-empt slow-host settlement without re-arming. The worker-start negative controls caught both premature submission before composer readiness and a false-ready swallowed Enter; the accepted candidate records one started turn, while the swallowed arm records agent_prompt_stalled without a rescue Enter. The earlier live harness also reproduced the unsafe raw multiline contract before its framing fix. Intentional-break evidence remains local rather than a separate CI job."
},
"performanceBudget": {
"required": true,
"evidence": "Agent prompt dispatch remains O(prompt bytes) with existing 16KB chunking. Claude and Codex add one PTY-local output listener until 1.5 seconds of post-marker output quiescence or the bounded fallback; each later frame resets one quiet timer. Other agents retain the platform delay. No polling, provider listing, subprocess churn, hidden-pane wakeups, renderer work, or wire traffic is added."
},
"promotionCriteria": [
"Run the live harness in soak with a self-starting dev runtime or provider-contract fixture.",
"Add daemon, SSH, remote-runtime, Linux, and Windows evidence or mark narrower provider scope.",
"Capture stable red/green intentional-break evidence in CI before blocking promotion."
],
"knownGaps": [
"Live harness command currently expects an already-running dev runtime and generated out/bin/orca-dev wrapper.",
"No Windows ConPTY, Linux PTY, SSH, daemon, or remote-runtime live evidence yet.",
"Push-on-idle orchestration message banners remain outside this dispatch-prompt gate."
],
"demotionRule": "Demote or quarantine if the live harness flakes without a product bug or harness bug filed to the terminal-input owner."
},
{
"id": "orchestration.notification-mailbox-consistency",
"title": "Orchestration pointers expose the mailbox their terminal check consumes",
"maturity": "experimental",
"protection": "partial",
"owner": "orchestration",
"layer": "runtime-db-rpc-contract",
"surfaces": [
"live-idle terminal notification",
"Run binding and rebinding",
"active Dispatch ownership",
"orchestration check and acknowledgment",
"outstanding Run Deliveries",
"runtime restart and durable pointer cursors",
"pointer transport settlement"
],
"platforms": ["macos", "linux", "windows"],
"providers": ["local", "daemon", "ssh", "wsl", "remote-runtime"],
"coveredPlatforms": ["macos"],
"coveredProviders": ["local", "daemon", "ssh"],
"coverageNotes": "A deterministic isolated runtime/SQLite/RPC harness covers Run and Dispatch ownership, exact handle and remint-stable pane recipients, fixed Delivery replay and acknowledgment, restart, concurrent pollers, filtered waiters, and built-CLI parity with direct DB state. Schema v28 durably records every coordinator handle through SQLite triggers, backfills current handles on open, recreates routing triggers after old table rebuilds, and atomically canonicalizes coordinator-addressed inserts to run:<id>. A 125-row oracle and 151-row reconciliation suite cover paged old-handle backlogs, commit-without-notify recovery, duplicate Dispatch owners, cancellation, and lifecycle fencing. Federation tests use real databases, dropped acknowledgments, restart/reconnect, and protocol v1/v2 peers; duplicate read rows do not wake again. Daemon and SSH pointer settlement is deterministic, with SSH bounded at 60 seconds beyond the 20-second mux health window. No RPC parameter, stream opcode, or published payload changed. Live headed/headless paired-runtime, physical SSH, WSL, Linux, and Windows acceptance remain gaps.",
"motivatingLinks": [
"https://linear.app/stably/issue/STA-4325",
"https://github.com/stablyai/orca/issues/14522",
"internal incident evidence: improve-vps-setup, 2026-08-10"
],
"invariant": "Each message has one stable row ID and authoritative recipient; coordinator-addressed current-delivery inserts are atomically owned by run:<id>. Pointer staging may set delivered_at but never consumes mail. Each Run consumer generation has at most one outstanding Delivery with a fixed ID and fixed message IDs; ordinary checks replay it until an explicit matching acknowledgment marks exactly those rows read. Rebinding fences the old generation, notification types/counts correspond to unread rows retrievable under the same authority, and federation replay imports each stable message identity once without re-waking an already-read duplicate.",
"oracle": "Seed status, dispatch, and worker_done rows across direct-handle and canonical Run recipients in an isolated DB. Compare pointer count, RPC and built-CLI check output, direct SQLite rows, unread/peek/all/type filters, concurrent pollers, fixed Delivery IDs, explicit acknowledgment, restart, filtered check --wait, and coordinator remint. Route a 125-row old-handle backlog, inject a commit without notification, and require startup repair. Exercise duplicate Run/Dispatch owners, stale panes, 50-row pages, cancellation, lifecycle fencing, and absent PTYs. Drop a federation ACK, reconnect/restart v1/v2 peers, and require stable import plus no duplicate read-row wake. Hold a healthy SSH write past five seconds but below the 60-second settlement deadline, then separately exceed the bound and require retryable undelivered state.",
"commands": [
"pnpm run build:cli && pnpm exec vitest run --config config/vitest.config.ts src/main/runtime/orchestration-message-delivery-identity.test.ts --reporter=dot --testTimeout=5000",
"pnpm exec vitest run --config config/vitest.config.ts src/main/runtime/orchestration-mailbox-routing-races.test.ts src/main/runtime/orchestration-mailbox-notification-consistency.test.ts src/main/runtime/orchestration-mailbox-detached-routing.test.ts src/main/runtime/orchestration-mailbox-transport-settlement.test.ts src/main/runtime/orchestration/run-coordinator-handle-migration.test.ts src/main/runtime/orchestration/orchestration-run-delivery-db.test.ts src/main/runtime/orchestration/orchestration-worker-dispatch-db.test.ts src/main/runtime/orchestration/formatter.test.ts src/main/providers/ssh-pty-provider.test.ts src/main/providers/ssh-pty-write.test.ts src/main/daemon/client.test.ts src/main/daemon/daemon-pty-router.test.ts src/main/daemon/degraded-daemon-pty-provider.test.ts",
"pnpm exec vitest run --config config/vitest.config.ts src/main/runtime/orca-runtime.test.ts src/main/runtime/terminal-send-stale-leaf-liveness.test.ts src/main/runtime/rpc/methods/orchestration-runs.test.ts src/main/runtime/rpc/methods/orchestration-send.test.ts src/main/runtime/rpc/methods/orchestration-check.test.ts",
"pnpm exec vitest run --config config/vitest.config.ts src/main/runtime/orchestration/federation-sync.test.ts src/main/runtime/rpc/methods/orchestration-federation.test.ts src/main/runtime/rpc/methods/orchestration-federation-lifecycle-settlement.test.ts --reporter=dot"
],
"testFiles": [
"src/main/runtime/orchestration-message-delivery-identity.test.ts",
"src/main/runtime/orchestration-mailbox-notification-consistency.test.ts",
"src/main/runtime/orchestration-mailbox-detached-routing.test.ts",
"src/main/runtime/orchestration-mailbox-routing-races.test.ts",
"src/main/runtime/orchestration-mailbox-transport-settlement.test.ts",
"src/main/runtime/orchestration/run-coordinator-handle-migration.test.ts",
"src/main/runtime/orchestration/orchestration-run-delivery-db.test.ts",
"src/main/runtime/orchestration/orchestration-worker-dispatch-db.test.ts",
"src/main/runtime/orchestration/formatter.test.ts",
"src/main/providers/ssh-pty-provider.test.ts",
"src/main/providers/ssh-pty-write.test.ts",
"src/main/daemon/client.test.ts",
"src/main/daemon/daemon-pty-router.test.ts",
"src/main/daemon/degraded-daemon-pty-provider.test.ts",
"src/main/runtime/orca-runtime.test.ts",
"src/main/runtime/terminal-send-stale-leaf-liveness.test.ts",
"src/main/runtime/rpc/methods/orchestration-runs.test.ts",
"src/main/runtime/rpc/methods/orchestration-send.test.ts",
"src/main/runtime/rpc/methods/orchestration-check.test.ts",
"src/main/runtime/orchestration/federation-sync.test.ts",
"src/main/runtime/rpc/methods/orchestration-federation.test.ts",
"src/main/runtime/rpc/methods/orchestration-federation-lifecycle-settlement.test.ts"
],
"assertionRefs": [
{
"file": "src/main/runtime/orchestration-message-delivery-identity.test.ts",
"assertions": [
"status, dispatch, and worker_done rows keep stable message IDs across handle-to-Run routing",
"notification count equals the concurrently replayed fixed Delivery batch",
"unread, peek, all, and type filters preserve explicit acknowledgment semantics",
"restart replays one outstanding Delivery ID without inserting another Delivery row",
"a filtered check --wait wakes once without a duplicate terminal pointer",
"a 125-row old-handle backlog is atomically rebound before coordinator identity changes",
"committed coordinator mail is canonicalized without relying on notification delivery",
"the built CLI returns the same fixed Delivery and count as isolated SQLite"
]
},
{
"file": "src/main/runtime/orchestration-mailbox-notification-consistency.test.ts",
"assertions": [
"Run A direct mail cannot point after the pane binds Run B",
"a fresh runtime cannot replay the unactionable pointer",
"a fresh runtime reconciles a database that already contains the production mismatch",
"large persisted mismatches route in 50-row pages with coalesced per-mailbox wakes",
"Run pointers pin the existing mixed-version-compatible --run identity",
"direct and Dispatch mail remain durable without unpinned synthetic terminal turns",
"a delayed pointer submit cannot press Enter after the agent becomes working",
"an explicit check releases its staged pointer reservation without redrive",
"accepted pointer text is durably deduplicated before delayed Enter and provider Enter refusal",
"a known PTY exit releases staged rows for the replacement process",
"a staged pointer follows its Run to a new live pane without cross-PTY duplication",
"equivalent panes serialize one mailbox while newer mail arrives during Enter delay",
"same-Run direct mail is delivered and acknowledged through the bound Run",
"a submitted actionable pointer is durably deduplicated across restart without marking mail read",
"newer Run mail is not pointed behind an outstanding fixed Delivery",
"same-owner filtered checks drain later 50-row pages before waiting"
]
},
{
"file": "src/main/runtime/orchestration-mailbox-detached-routing.test.ts",
"assertions": [
"active worker direct mail is exposed by its Dispatch check after handle remint",
"late direct mail is normalized when its displaced Run rebinds",
"bound and filtered waiters wake only for residual mailbox types",
"stale-leaf arrivals retain Run or Dispatch pane identity",
"unowned detached-recipient mail remains directly addressable",
"duplicate Dispatch ownership is deduplicated before the 51-row branch cap"
]
},
{
"file": "src/main/runtime/orchestration/run-coordinator-handle-migration.test.ts",
"assertions": [
"v27 databases backfill current coordinator handles during v28 migration",
"v28 triggers retain A-to-B-to-C coordinator history across old-runtime writes",
"message-table rebuild migration recreates atomic coordinator-mail canonicalization"
]
},
{
"file": "src/main/runtime/orchestration/federation-sync.test.ts",
"assertions": [
"an acknowledged duplicate replay does not wake a waiter",
"overlapping syncs preserve one durable forward-only checkpoint"
]
},
{
"file": "src/main/runtime/rpc/methods/orchestration-federation.test.ts",
"assertions": [
"a lost relay acknowledgment retries without duplicating the home message",
"a reordered relay gap converges without loss or duplication"
]
},
{
"file": "src/main/runtime/rpc/methods/orchestration-federation-lifecycle-settlement.test.ts",
"assertions": [
"protocol v1 and v2 completion acknowledgments replay after Run-home restart",
"terminal settlement remains replayable until the worker durably acknowledges it"
]
},
{
"file": "src/main/runtime/orchestration-mailbox-transport-settlement.test.ts",
"assertions": [
"a rejected pointer transport stays undelivered and becomes restart-retryable"
]
},
{
"file": "src/main/daemon/client.test.ts",
"assertions": [
"an asynchronous daemon socket write failure settles as rejected",
"a wedged daemon socket write disconnects at its bounded settlement deadline"
]
},
{
"file": "src/main/runtime/orchestration/orchestration-worker-dispatch-db.test.ts",
"assertions": [
"remote Dispatch attachment lookup remains bounded across pane remints and malformed suffix collisions"
]
},
{
"file": "src/main/runtime/orchestration-mailbox-routing-races.test.ts",
"assertions": [
"Run and Dispatch consumers are fenced after ownership changes during a routing-page yield",
"current and stored reminted handles both drain in one explicit check",
"explicit paging terminates at its indexed start-of-check sequence snapshot and stops on cancellation",
"a fenced inactive Dispatch transfers unread rows to its Run in 50-row pages and coalesces arrival types for supported consumption and acknowledgment",
"a cancelled inactive-Dispatch migration wakes partial progress and finishes only its captured snapshot in the background",
"filtered Dispatch wait cancellation reconciles unrelated unread types before fencing",
"unfiltered and filtered parked reservations union in either arrival order",
"reminted Dispatch pane lookup uses a bounded partial expression index while exact legacy keys remain supported"
]
}
],
"evidenceRuns": [
{
"date": "2026-08-13",
"runner": "local",
"platform": "macos",
"command": "pnpm exec vitest run --config config/vitest.config.ts src/main/runtime/orchestration-mailbox-routing-races.test.ts src/main/runtime/orchestration-mailbox-notification-consistency.test.ts src/main/runtime/orchestration-mailbox-detached-routing.test.ts src/main/runtime/orchestration-mailbox-transport-settlement.test.ts src/main/runtime/orchestration/run-coordinator-handle-migration.test.ts src/main/runtime/orchestration/orchestration-run-delivery-db.test.ts src/main/runtime/orchestration/orchestration-worker-dispatch-db.test.ts src/main/runtime/orchestration/formatter.test.ts src/main/providers/ssh-pty-provider.test.ts src/main/providers/ssh-pty-write.test.ts src/main/daemon/client.test.ts src/main/daemon/daemon-pty-router.test.ts src/main/daemon/degraded-daemon-pty-provider.test.ts",
"result": "passed",
"durationSeconds": 8.22,
"summary": "245 tests passed across mailbox identity, durable coordinator-handle migration, insertion-time canonicalization, duplicate-free 51-row ownership branch caps, unrestricted reservation merging, direct and Dispatch pointer suppression, persisted reconciliation, 50-row paging and filtered waits, cross-PTY serialization, lifecycle fencing, bounded daemon and SSH transport settlement, outstanding Deliveries, reminted Dispatch ownership, acknowledgment, cancellation, and bounded pane lookup."
},
{
"date": "2026-08-14",
"runner": "local",
"platform": "macos",
"command": "pnpm exec vitest run --config config/vitest.config.ts src/main/runtime/orchestration/federation-sync.test.ts src/main/runtime/rpc/methods/orchestration-federation.test.ts src/main/runtime/rpc/methods/orchestration-federation-lifecycle-settlement.test.ts --reporter=dot",
"result": "passed",
"durationSeconds": 8.99,
"summary": "52 tests passed with real OrchestrationDb rows, a deliberately dropped federation acknowledgment, reconnect/restart, forward-only checkpoints, duplicate read-row wake suppression, and protocol v1/v2 lifecycle settlement replay. The broader final federation/cross-version set passed 77/77."
},
{
"date": "2026-08-14",
"runner": "local",
"platform": "macos",
"command": "pnpm run build:cli && pnpm exec vitest run --config config/vitest.config.ts src/main/runtime/orchestration-message-delivery-identity.test.ts --reporter=dot --testTimeout=5000",
"result": "passed",
"durationSeconds": 8.42,
"summary": "The byte-identical five-case STA-4325 oracle (SHA-256 76a2d672d27e04e5b1db2f52df3b303468bdf006be7cfd003bf443618a856c35) failed 5/5 on reported v1.4.180, latest main, and production-reverted candidate, then passed 5/5 on the final candidate. It aligns pointer counts with one fixed Delivery across concurrent pollers and filters, replays that Delivery through restart, routes a 125-row old-handle backlog before rebind, repairs committed mail without relying on a notification callback, and matches built-CLI output to direct isolated SQLite state."
},
{
"date": "2026-08-14",
"runner": "local",
"platform": "macos",
"command": "pnpm exec vitest run --config config/vitest.config.ts src/main/runtime/orca-runtime.test.ts src/main/runtime/terminal-send-stale-leaf-liveness.test.ts src/main/runtime/rpc/methods/orchestration-runs.test.ts src/main/runtime/rpc/methods/orchestration-send.test.ts src/main/runtime/rpc/methods/orchestration-check.test.ts",
"result": "passed",
"durationSeconds": 14.15,
"summary": "1,293 tests passed and 1 was skipped across Run-bound pointer delivery, PTY retirement and respawn, stale-leaf liveness, direct-mail routing, filtered waiter ownership, canonical stored-recipient notification, and orchestration RPC behavior."
}
],
"runtimeBudget": {
"p95Seconds": 20,
"scope": "deterministic runtime, SQLite, and RPC contract tests"
},
"flakeHistory": {
"status": "unknown",
"evidence": "Repeated deterministic local macOS runs passed during four review rounds; controlled fake timers and lifecycle events replace arbitrary sleeps and wall-clock delivery assertions."
},
"redGreenEvidence": {
"status": "complete",
"evidence": "The byte-identical five-test oracle (SHA-256 76a2d672d27e04e5b1db2f52df3b303468bdf006be7cfd003bf443618a856c35) failed 5/5 on reported v1.4.180 commit 0b62333cf179, failed 5/5 on latest origin/main 9bb8836bb6, passed 5/5 on the final candidate, and failed 5/5 with candidate production changes reverted to 9bb8836bb6. Baselines announced two messages while check exposed one, returned no direct-only row after restart, left all 125 old-handle rows direct, failed commit-without-notify canonicalization, and made built CLI report one of two rows. The candidate aligned every count, stable message ID, fixed Delivery, acknowledgment, restart, backlog, and CLI/SQLite assertion. Live topology coverage remains a separate promotion gap."
},
"performanceBudget": {
"required": true,
"evidence": "Coordinator inserts use one SQLite trigger in the insertion transaction; current handles are backfilled and historical A-to-B-to-C bindings are trigger-recorded. Bulk rebind is one indexed O(backlog) UPDATE. Detached routing is an ownership-driven UNION whose coordinator, exact-Dispatch, and pane-Dispatch branches each cap at 51 duplicate-free rows before the final merge; full drains measured 40/77/187/1,040 ms for 5k/10k/20k/100k rows versus the prior 96/429/1,908 ms at 5k/10k/20k. Each transaction routes at most 50 rows and yields between pages. Typed partial indexes keep filtered Run peek at 0.08-0.13 ms over 100k rows. Trigger overhead measured about 0.6-1.0 microseconds per message. SSH pointer writes use one cleared, unrefed 60-second timer per pending write, beyond the 20-second mux health window. No subprocess, provider fanout, polling, persistent listener, renderer work, or wire payload was added."
},
"promotionCriteria": [
"Add isolated live restart and SSH or paired-runtime evidence.",
"Accumulate stable soak runs before considering blocking promotion."
],
"knownGaps": [
"No headed Electron restart journey was required to prove the runtime/PTY/check boundary.",
"No daemon, paired remote-runtime, live SSH, WSL, Linux, or Windows journey has been collected.",
"Daemon and SSH PTY writes are transport-settled but remain owner-unacknowledged; capability-negotiated owner acknowledgments are separate protocol work.",
"Direct and Dispatch mail stay durable and explicitly checkable but do not synthesize agent turns until a backward-compatible pinned action or passive UI exists.",
"Passive renderer-native unread UI and opt-in coordinator wake policy remain separate product work."
],
"demotionRule": "Demote or quarantine if the deterministic oracle flakes without a product or harness bug owned by orchestration."
},
{
"id": "orchestration.worker-terminal-delivery",
"title": "Workers remain visible and observable across workspace entry and app restart",
"maturity": "experimental",
"protection": "partial",
"owner": "orchestration",
"layer": "cli-runtime-renderer-contract",
"surfaces": [
"Run and Dispatch mailboxes",
"worker-start",
"terminal creation",
"terminal tab materialization",
"workspace re-entry",
"app restart with retained daemon PTYs",
"legacy update resume fencing"
],
"platforms": ["macos", "linux", "windows"],
"providers": ["local", "daemon", "ssh", "wsl", "remote-runtime"],
"coveredPlatforms": ["macos"],
"coveredProviders": ["local", "daemon", "ssh"],
"coverageNotes": "A deterministic service-state-machine oracle now models a current-contract worker and coordinator whose renderer graph identities disappear across an app/runtime update. It exercises the production verifier with restored PTY and hydrated hook commitments, proves authenticated completion replay across a fresh runtime, explicit takeover, ordinary mail routing, remote-attachment process fencing, retained Task/Dispatch/terminal identity, and unchanged fixture marker bytes, and rejects foreign pane evidence. Other deterministic units cover authority-aware legacy formatting, exact legacy worker identity planning, local worker presentation, retained-output reads after adoption, reveal-failure warnings, stable-pane Run/Dispatch routing, creator pane/process/Run-generation fencing, indexed retained-Run lookup scaling, the SSH in-process CLI fallback, exact legacy Task/Dispatch/report-receipt verification, JSON rejection envelopes, and capability-negotiated Run-home settlement. The federation oracle drops the first terminal ACK, restarts Run-home twice, verifies replay through the existing polling path and the persisted acknowledgment watermark, races identical reports, accepts preexisting same-outcome ACK batches, rejects conflicting batches, and covers protocol v1/v2 completion across independently updated peers. A migration unit upgrades a v26 database with a zeroed watermark without replaying older migrations. Three isolated macOS Electron journeys launch fake Codex workers through the real RPC path. Distinct installed A/B artifacts plus live SSH, WSL, folder, Linux, and Windows cutover journeys remain explicit gaps.",
"motivatingLinks": [
"https://github.com/stablyai/orca/pull/11107#discussion_r3663321387",
"https://github.com/stablyai/orca/issues/13858",
"https://github.com/stablyai/orca/pull/14105",
"https://linear.app/stably/issue/STA-4020",
"https://linear.app/stably/issue/STA-4021",
"https://linear.app/stably/issue/STA-4022"
],
"invariant": "Starting a worker in the coordinator's current workspace must materialize one inactive terminal tab before worker-start returns, preserve coordinator focus, and remain exactly once after workspace re-entry. After an app update or restart, an exact live legacy worker must fence automatic provider resume, adopt its original PTY into its original background pane, retain readable output, and clear the resume record without spawning, writing, signalling, interrupting, replacing, or focusing the worker. A current-contract worker whose renderer graph identity is temporarily absent must retain its Dispatch capability and settle exactly once from exact hook-attested handle, pane, and process evidence; otherwise only an exact attested coordinator may take over. A worker_done caller may report success only after the owning runtime returns an explicit lifecycle verdict or authoritative reads prove that the exact Task, Dispatch, and worker report receipt settled the expected outcome. Federated terminal settlement must remain replay-eligible until the worker durably acknowledges it, and identical same-outcome retries must converge idempotently. Independently updated clients and worker servers must preserve the negotiated protocol: current peers use Run-home lifecycle settlement, while protocol v1/v2 peers retain their legacy completion path without receiving newer-only fields. A federated worker may accept only the authority defined by its negotiated protocol. An exact existing target workspace must receive a discoverable tab without stealing coordinator focus; if renderer reveal fails, worker-start must expose that the live worker remains background-only. Run and Dispatch checks must resolve through the caller's stable pane identity when a terminal handle is reminted, while a live handle outranks mismatched pane metadata. A nested worker's creator edge requires the current creator pane, process incarnation, and owning Run generation; reminting and rebinding that pane to another Run must remove the stale edge. Explicit legacy terminal inspection remains handle-scoped, and remote or headless worker presentation remains background-only.",
"oracle": "Drive Run create, Task create, and worker-start through production Electron runtimes with a deterministic Codex fixture. Require append-only ledgers with one still-live PID and no interruption, a visible inactive worker tab while the coordinator stays active, Run delivery through stable pane identity, and stable PTY/incarnation, tab, leaf, worktree, Task, and Dispatch across workspace re-entry. In a restart journey, retain the original daemon PTY and PID, remove renderer ownership, retain sleeping-session evidence, mark the Dispatch legacy, relaunch, and require exact inactive tab adoption, readable ACK output, cleared resume state, one spawn, and no resume argv or Conversation interrupted text after another workspace round trip. The service oracle removes renderer lookup identity from current-contract callers while retaining real restored-PTY and hook commitments, replays authenticated completion and takeover across fresh runtimes, and requires one Task, Dispatch, terminal authority, message, mutation, ordinary-mail delivery, remote process fencing, and unchanged fixture marker bytes while foreign pane evidence remains rejected. Unit tests separately remint a creator pane and process from Run A into Run B, require the nested Run A worker to fall back to its current coordinator, require indexed query plans, and bound 300 Task reads with 50,000 retained Runs. They also assert authority-specific legacy affordances, exact identity and owner matching, retained-output fallback, pane-stable routing, federated non-activation, and SSH fallback parity.",
"commands": [
"pnpm exec vitest run --config config/vitest.config.ts src/main/runtime/rpc/orchestration-runtime-update-settlement.test.ts --reporter=dot",
"pnpm exec vitest run --config config/vitest.config.ts src/cli/handlers/orchestration.test.ts src/cli/handlers/orchestration-check-identity.test.ts src/cli/handlers/orchestration-worker-cli.test.ts src/main/runtime/rpc/methods/orchestration-composed-workers.test.ts src/main/runtime/rpc/methods/orchestration-check.test.ts src/main/runtime/rpc/methods/orchestration-send.test.ts src/main/ssh/ssh-remote-orca-cli.test.ts",
"pnpm exec vitest run --config config/vitest.config.ts src/cli/handlers/orchestration-lifecycle-rejection.test.ts src/cli/handlers/orchestration-lifecycle-json-rejection.test.ts src/cli/handlers/orchestration-migration.test.ts",
"pnpm exec vitest run --config config/vitest.config.ts src/main/runtime/orchestration/formatter.test.ts src/main/runtime/rpc/methods/orchestration-federation.test.ts",
"pnpm exec vitest run --config config/vitest.config.ts src/main/runtime/rpc/methods/orchestration-federation-lifecycle-settlement.test.ts --reporter=dot",
"pnpm exec vitest run --config config/vitest.config.ts src/main/runtime/orchestration/federation-acknowledgment-migration.test.ts --reporter=dot",
"pnpm exec vitest run --config config/vitest.config.ts src/main/runtime/orchestration/orchestration-legacy-worker-terminal-recovery.test.ts",
"pnpm exec vitest run --config config/vitest.config.ts src/main/runtime/orchestration/orchestration-creator-authority-performance.test.ts",
"pnpm exec vitest run --config config/vitest.config.ts src/main/runtime/orca-runtime.test.ts",
"pnpm run test:e2e -- tests/e2e/orchestration-worker-terminal-visibility.spec.ts --workers=1",
"pnpm run test:e2e -- tests/e2e/orchestration-legacy-worker-restart-recovery.spec.ts --workers=1",
"pnpm run build:cli && SKIP_BUILD=1 pnpm exec playwright test tests/e2e/orchestration-worker-settlement-release-cli.spec.ts --config tests/playwright.config.ts --project electron-headless --workers=1"
],
"testFiles": [
"src/main/runtime/rpc/orchestration-runtime-update-settlement.test.ts",
"src/main/runtime/orchestration/formatter.test.ts",
"src/main/runtime/orchestration/orchestration-legacy-worker-terminal-recovery.test.ts",
"src/main/runtime/orchestration/orchestration-creator-authority-performance.test.ts",
"src/main/runtime/orca-runtime.test.ts",
"src/cli/handlers/orchestration.test.ts",
"src/cli/handlers/orchestration-lifecycle-rejection.test.ts",
"src/cli/handlers/orchestration-lifecycle-json-rejection.test.ts",
"src/cli/handlers/orchestration-migration.test.ts",
"src/cli/handlers/orchestration-check-identity.test.ts",
"src/cli/handlers/orchestration-worker-cli.test.ts",
"src/main/runtime/rpc/methods/orchestration-composed-workers.test.ts",
"src/main/runtime/rpc/methods/orchestration-check.test.ts",
"src/main/runtime/rpc/methods/orchestration-send.test.ts",
"src/main/runtime/rpc/methods/orchestration-federation.test.ts",
"src/main/runtime/rpc/methods/orchestration-federation-lifecycle-settlement.test.ts",
"src/main/runtime/orchestration/federation-acknowledgment-migration.test.ts",
"src/main/ssh/ssh-remote-orca-cli.test.ts",
"tests/e2e/orchestration-worker-terminal-visibility.spec.ts",
"tests/e2e/orchestration-legacy-worker-restart-recovery.spec.ts",
"tests/e2e/orchestration-worker-settlement-release-cli.spec.ts"
],
"assertionRefs": [
{
"file": "src/main/runtime/rpc/orchestration-runtime-update-settlement.test.ts",
"assertions": [
"an exact current worker settles once through an app/runtime update even when renderer graph identity is absent",
"only an attested current coordinator may explicitly take over retained live work",
"Task, Dispatch, terminal authority, completion, and filesystem bytes are neither lost nor duplicated",
"foreign pane evidence cannot borrow retained lifecycle authority",
"ordinary mail and remote attachments use the same attested pane and process authority"
]
},
{
"file": "src/main/runtime/orchestration/orchestration-creator-authority-performance.test.ts",
"assertions": [
"creator lookup uses the assignee-handle and pane-leaf indexes without a retained-Run scan",
"300 Task reads remain bounded with 50,000 unrelated retained Runs"
]
},
{
"file": "src/main/runtime/orchestration/orchestration-legacy-worker-terminal-recovery.test.ts",
"assertions": [
"only exact unique terminal, pane, process-incarnation, and worktree evidence becomes recoverable",
"ambiguous, incomplete, or mismatched legacy identities remain fenced and deferred"
]
},
{
"file": "src/main/runtime/orca-runtime.test.ts",
"assertions": [
"one exact live legacy worker is adopted into its original background pane without input or signals",
"automatic provider resume stays fenced until exact adoption is persisted",
"retained renderer output remains readable through the recovered terminal"
]
},
{
"file": "src/main/runtime/orchestration/formatter.test.ts",
"assertions": [
"legacy compatibility and recovery replay show only runtime-supplied supported actions",
"legacy provenance without live authority stays read-only",
"current formatting remains unchanged"
]
},
{
"file": "src/cli/handlers/orchestration-lifecycle-rejection.test.ts",
"assertions": [
"an explicit current worker_done verdict completes without a compatibility read",
"a worker_done response without a lifecycle verdict checks the exact authoritative Dispatch and report receipt",
"legacy succeeded and failed reports require matching terminal Task and Dispatch state",
"stopped or stale Dispatches cannot impersonate report settlement",
"an idempotent retry accepts the first authoritative report from the same worker",
"a Run-home relay rejection reaches the CLI error boundary"
]
},
{
"file": "src/cli/handlers/orchestration-lifecycle-json-rejection.test.ts",
"assertions": ["a rejected lifecycle verdict is emitted as a JSON ok=false envelope"]
},
{
"file": "src/cli/handlers/orchestration-migration.test.ts",
"assertions": [
"first and replayed legacy worker_done settlements are accepted from their authoritative runtime verdict"
]
},
{
"file": "src/cli/handlers/orchestration-check-identity.test.ts",
"assertions": [
"implicit check carries the caller pane key with a potentially stale environment handle",
"explicit legacy terminal inspection does not inherit the caller pane key"
]
},
{
"file": "src/cli/handlers/orchestration-worker-cli.test.ts",
"assertions": [
"worker-start prints an explicit warning when its live worker remains background-only"
]
},
{
"file": "src/main/runtime/rpc/methods/orchestration-composed-workers.test.ts",
"assertions": [
"same-workspace worker creation uses visible inactive presentation",
"worker-start preserves and reports renderer reveal failures"
]
},
{
"file": "src/main/runtime/rpc/methods/orchestration-check.test.ts",
"assertions": [
"Run delivery resolves through a stable coordinator pane after handle remint",
"a live handle cannot be retargeted by mismatched pane metadata"
]
},
{
"file": "src/main/runtime/rpc/methods/orchestration-send.test.ts",
"assertions": [
"Dispatch delivery resolves through a stable worker pane after handle remint"
]
},
{
"file": "src/main/runtime/rpc/methods/orchestration-federation-lifecycle-settlement.test.ts",
"assertions": [
"a remote worker_done waits for Run-home settlement even when an older CLI omits the wait hint",
"protocol v1/v2 clients can start fresh workers and complete success or failure on a current worker server",
"protocol v1/v2 completion ACK loss replays safely after a Run-home restart without newer-only wire fields",
"a current Run home still completes reports from legacy protocol v1/v2 worker servers",
"persisted protocol v1/v2 workers retain legacy-compatible completion after their worker server updates",
"the existing relay polling path retries a committed settlement across Run-home restarts until the worker acknowledgment watermark advances",
"identical pending reports coalesce to one relay and every caller receives the same Run-home verdict",
"preexisting same-outcome terminal ACK batches settle atomically while conflicting outcomes acknowledge nothing",
"an aborted settlement wait returns operation_unknown instead of accepted success",
"an already-aborted signal registers no settlement waiter",
"a Run-home terminal verdict settles the remote attachment and revokes its capability",
"a terminal verdict cannot settle an unrelated relay item",
"a terminal verdict cannot contradict the exact queued worker report outcome",
"a rejected report replays its exact verdict without mutating durable rejection mail twice"
]
},
{
"file": "src/main/runtime/orchestration/federation-acknowledgment-migration.test.ts",
"assertions": [
"a v26 database gains a zeroed durable home-to-worker acknowledgment watermark",
"a complete v26 database starts migration at v26 rather than replaying v7-v26",
"the migration advances schema version without losing the imported relay cursor"
]
},
{
"file": "src/main/runtime/rpc/methods/orchestration-federation.test.ts",
"assertions": ["federated worker placement explicitly sets activate=false"]
},
{
"file": "src/main/ssh/ssh-remote-orca-cli.test.ts",
"assertions": [
"implicit SSH fallback checks retain stable pane identity",
"explicit legacy SSH inspection does not inherit the caller pane key"
]
},
{
"file": "tests/e2e/orchestration-worker-terminal-visibility.spec.ts",
"assertions": [
"worker-start exposes one inactive worker tab before workspace navigation",
"the coordinator tab remains active",
"ACK delivery reaches a stable coordinator pane through a stale handle",
"one spawn remains live with no interruption event",
"PTY/incarnation, tab, leaf, worktree, Task, and Dispatch identities remain stable",
"workspace re-entry does not duplicate the worker tab or print Conversation interrupted"
]
},
{
"file": "tests/e2e/orchestration-legacy-worker-restart-recovery.spec.ts",
"assertions": [
"the original daemon PTY, process incarnation, PID, pane, Task, and Dispatch survive app restart",
"the legacy worker tab is restored once in the background with retained ACK output",
"sleeping-session, resume-claim, and pending-startup state are cleared after adoption",
"no second spawn, resume argv, input, signal, interruption, or duplicate tab occurs after workspace re-entry"
]
},
{
"file": "tests/e2e/orchestration-worker-settlement-release-cli.spec.ts",
"assertions": [
"a compiled CLI worker_done with the wrong identity exits nonzero with ok=false",
"the exact Task and Dispatch remain dispatched after rejection",
"the correct worker identity receives an explicit completed lifecycle verdict",
"an independent runtime read observes the Dispatch completed"
]
}
],
"evidenceRuns": [
{
"date": "2026-08-13",
"runner": "local",
"platform": "macos",
"command": "pnpm exec vitest run --config config/vitest.config.ts src/main/runtime/rpc/methods/orchestration-federation-lifecycle-settlement.test.ts --reporter=dot",
"result": "passed",
"durationSeconds": 6.02,
"summary": "The 70f1d52f mixed-version oracle passed all 21 cases. Protocol v1/v2 clients started fresh workers on a current server, completed success and failure with explicit legacy authority, and automatically retried a lost ACK after Run-home restart; current-protocol settlement and duplicate-report controls stayed green."
},
{
"date": "2026-08-13",
"runner": "local",
"platform": "macos",
"command": "pnpm exec vitest run --config config/vitest.config.ts src/main/runtime/rpc/methods/orchestration-federation-lifecycle-settlement.test.ts --reporter=dot",
"result": "failed",
"durationSeconds": 4.21,
"summary": "The byte-identical 70f1d52f oracle failed 6 mixed-version cases while 15 controls passed when the fresh v1/v2 refusal was restored: success and failure through both negotiated versions plus both lost-ACK restart cases."
},
{
"date": "2026-08-12",
"runner": "local",
"platform": "macos",
"command": "pnpm exec vitest run --config config/vitest.config.ts src/main/runtime/rpc/methods/orchestration-federation-lifecycle-settlement.test.ts --reporter=dot",
"result": "failed",
"durationSeconds": 5.05,
"summary": "The byte-identical ac7bdf4e federation oracle failed 7 of 17 tests on affected 09ec516ae5: fresh v1/v2 work started before completion rejection, persisted v1/v2 work could not finish after update, same-outcome ACKs rejected, duplicate reports remained pending, and a dropped ACK was not replayed."
},
{
"date": "2026-08-12",
"runner": "local",
"platform": "macos",
"command": "pnpm exec vitest run --config config/vitest.config.ts src/main/runtime/rpc/methods/orchestration-federation-lifecycle-settlement.test.ts --reporter=dot",
"result": "failed",
"durationSeconds": 5.86,
"summary": "The same byte-identical oracle failed the same 7 of 17 tests on latest main 1136503c6a."
},
{
"date": "2026-08-12",
"runner": "local",
"platform": "macos",
"command": "pnpm exec vitest run --config config/vitest.config.ts src/main/runtime/rpc/methods/orchestration-federation-lifecycle-settlement.test.ts --reporter=dot",
"result": "passed",
"durationSeconds": 4.28,
"summary": "The same byte-identical oracle passed all 17 tests on candidate 008f740161, including restart replay and both directions of v1/v2 update compatibility."
},
{
"date": "2026-08-12",
"runner": "local",
"platform": "macos",
"command": "pnpm exec vitest run --config config/vitest.config.ts src/main/runtime/rpc/methods/orchestration-federation-lifecycle-settlement.test.ts --reporter=dot",
"result": "failed",
"durationSeconds": 19.84,
"summary": "With the claimed production files restored to latest main in 3a15d3ed5d, the same byte-identical oracle returned to the same 7 failures while 10 unaffected cases still passed."
},
{
"date": "2026-08-12",
"runner": "local",
"platform": "macos",
"command": "pnpm exec vitest run --config config/vitest.config.ts src/main/runtime/orchestration/federation-acknowledgment-migration.test.ts --reporter=dot",
"result": "passed",
"durationSeconds": 0.47,
"summary": "A complete v26 database resolved migration start at v26, upgraded to v27, retained its imported cursor, and initialized the durable acknowledgment watermark to zero."
},
{
"date": "2026-08-12",
"runner": "local",
"platform": "macos",
"command": "pnpm run build:cli && SKIP_BUILD=1 pnpm exec playwright test tests/e2e/orchestration-worker-settlement-release-cli.spec.ts --config tests/playwright.config.ts --project electron-headless --workers=1",
"result": "passed",
"durationSeconds": 20,
"summary": "The combined candidate passed one real Electron and compiled-CLI journey: wrong worker identity exited nonzero with ok=false while Dispatch stayed dispatched, the exact worker received an explicit completed verdict, and runtime state independently reached completed."
},
{
"date": "2026-08-03",
"runner": "local",
"platform": "macos",
"command": "pnpm exec vitest run --config config/vitest.config.ts src/main/runtime/rpc/orchestration-runtime-update-settlement.test.ts --reporter=dot",
"result": "failed",
"durationSeconds": 3.07,
"summary": "The byte-identical 5f45c270f1 oracle, applied as the sole tree overlay in 063340a8ba on origin/main@34291f07e9, failed 3 of 5 rows: completion remained dispatched, takeover lacked a stable pane, and remote attachment authority lost process identity."
},
{
"date": "2026-08-03",
"runner": "local",
"platform": "macos",
"command": "pnpm exec vitest run --config config/vitest.config.ts src/main/runtime/rpc/orchestration-runtime-update-settlement.test.ts --reporter=dot",
"result": "passed",
"durationSeconds": 3.13,
"summary": "The same byte-identical oracle passed 5 tests on candidate@2748b0b29b, exercising the production verifier and fresh-runtime replay while preserving exact DB identity and unchanged fixture bytes."
},
{
"date": "2026-08-03",
"runner": "local",
"platform": "macos",
"command": "pnpm exec vitest run --config config/vitest.config.ts src/main/runtime/rpc/orchestration-runtime-update-settlement.test.ts --reporter=dot",
"result": "failed",
"durationSeconds": 3.14,
"summary": "With current-authority propagation actually disabled in candidate child 08a7db37bf, the same byte-identical oracle failed 2 of 5 rows: completion remained dispatched and remote attachment authority was rejected."
},
{
"date": "2026-08-03",
"runner": "local",
"platform": "macos",
"command": "pnpm exec vitest run --config config/vitest.config.ts src/main/runtime/rpc/orchestration-runtime-update-settlement.test.ts --reporter=dot",
"result": "passed",
"durationSeconds": 3.1,
"summary": "After reverting the intentional break in d2a4e2e024, the same byte-identical oracle passed all 5 tests."
},
{
"date": "2026-07-28",
"runner": "local",
"platform": "macos",
"command": "pnpm exec vitest run --config config/vitest.config.ts src/cli/handlers/orchestration.test.ts src/cli/handlers/orchestration-check-identity.test.ts src/cli/handlers/orchestration-worker-cli.test.ts src/main/runtime/rpc/methods/orchestration-composed-workers.test.ts src/main/runtime/rpc/methods/orchestration-check.test.ts src/main/runtime/rpc/methods/orchestration-send.test.ts src/main/ssh/ssh-remote-orca-cli.test.ts",
"result": "passed",
"durationSeconds": 5.27,
"summary": "Five focused files passed with 216 tests, covering visible inactive local worker creation, reveal-failure warnings, stable-pane mailbox routing, live-handle precedence, and SSH fallback parity."
},
{
"date": "2026-08-11",
"runner": "local",
"platform": "macos",
"command": "pnpm exec vitest run --config config/vitest.config.ts src/cli/handlers/orchestration-lifecycle-rejection.test.ts src/cli/handlers/orchestration-lifecycle-json-rejection.test.ts src/cli/handlers/orchestration-migration.test.ts",
"result": "passed",
"durationSeconds": 0.4,
"summary": "Three focused files passed 12 deterministic tests covering explicit current and Run-home verdicts, JSON failure output, exact report and terminal-state verification for stripped responses, stale/stopped rejection, idempotent retry, and first/replayed attested legacy settlements."
},
{
"date": "2026-08-12",
"runner": "local",
"platform": "macos",
"command": "pnpm exec vitest run --config config/vitest.config.ts src/main/runtime/rpc/methods/orchestration-federation-lifecycle-settlement.test.ts --reporter=dot",
"result": "passed",
"durationSeconds": 4.58,
"summary": "Nine deterministic tests passed for protocol negotiation, Run-home completion and rejection, already-aborted waits, authoritative remote-attachment settlement bound to the exact queued worker_done outcome, and exact verdict replay after lost acknowledgments without mutating durable rejection mail twice."
},
{
"date": "2026-07-28",
"runner": "local",
"platform": "macos",
"command": "pnpm exec vitest run --config config/vitest.config.ts src/main/runtime/orchestration/formatter.test.ts src/main/runtime/rpc/methods/orchestration-federation.test.ts",
"result": "passed",
"durationSeconds": 2.72,
"summary": "Two focused files passed with 34 tests, covering authority-aware legacy affordances and federated non-reveal."
},
{
"date": "2026-07-28",
"runner": "local",
"platform": "macos",
"command": "pnpm run test:e2e -- tests/e2e/orchestration-worker-terminal-visibility.spec.ts --workers=1",
"result": "passed",
"durationSeconds": 8.3,
"summary": "The isolated Electron journey passed with one live fake-agent spawn, no interruption events, stable PTY/incarnation/tab/leaf/worktree/Task/Dispatch identity, immediate inactive presentation, pane-stable ACK delivery, and exactly one tab after workspace re-entry."
},
{
"date": "2026-07-28",
"runner": "local",
"platform": "macos",
"command": "pnpm run test:e2e -- tests/e2e/orchestration-legacy-worker-restart-recovery.spec.ts --workers=1",
"result": "passed",
"durationSeconds": 12.6,
"summary": "The restart journey retained one daemon PTY and PID, adopted its exact original background pane, preserved readable ACK output and Task/Dispatch authority, cleared all resume state, and recorded no second spawn, resume argv, input, signal, interruption, or duplicate after workspace re-entry."
}
],
"runtimeBudget": {
"p95Seconds": 75,
"scope": "focused CLI/runtime units plus isolated worker-start and app-restart Electron journeys"
},
"flakeHistory": {
"status": "unknown",
"evidence": "The deterministic units and three isolated Electron journeys pass locally; CI and soak history are not yet available."
},
"redGreenEvidence": {
"status": "complete",
"evidence": "The byte-identical ac7bdf4e federation oracle failed 7 of 17 tests on affected 09ec516ae5 and latest main 1136503c6a, passed 17 of 17 on candidate 008f740161, and returned to the same 7 failures when the claimed production files were restored to latest main in 3a15d3ed5d. The follow-up byte-identical 70f1d52f oracle passes 21 of 21 with fresh v1/v2 compatibility and fails 6 mixed-version cases while 15 controls pass when only the refusal is restored. Together they prove dropped-ACK replay across Run-home restarts for current and legacy protocols, identical and preexisting same-outcome retry convergence, conflicting-outcome refusal, fresh and persisted old-client/current-server completion, current-client/old-server completion, and legacy wire isolation. The compiled-CLI Electron oracle separately failed on main 5ea7df1a5b, passed on candidate d697666ce8, and reproduced its original failure with the claimed production files disabled. Distinct installed A/B and CI artifacts are still needed."
},
"performanceBudget": {
"required": true,
"evidence": "Worker-start reuses the existing one-shot renderer reveal and adds no polling, provider listing, or output work. Startup recovery performs one bounded controller inventory per legacy candidate, exact owner/identity checks, one background reveal, and a provider/renderer snapshot only when an adopted worker's in-memory tail is empty and terminal.read is explicitly requested. Check adds one optional pane-key field and reuses the existing Run scan or bounded active-Dispatch lookup. Federation replay keeps the existing per-Dispatch polling cadence and existing transport queue limit, retaining a terminal Dispatch only while its imported cursor exceeds one persisted acknowledgment watermark. Each successful ACK adds one primary-key SQLite update; exact eligibility is a primary-key lookup, and identical pending terminal lookup is bounded by the existing 256-item per-Dispatch relay quota and pending-relay index. A version-aware schema sentinel keeps valid v26 databases on the direct v26-to-v27 migration path."
},
"promotionCriteria": [
"Collect 100 consecutive passes or 14 days of stable CI history on macOS, Linux, and Windows.",
"Run distinct installed A/B artifacts through separate headed and headless paired-runtime cutover journeys, plus a git-independent folder workspace parameter.",
"Add Docker SSH restart/reconnect proof and physical Windows WSL correct-distro/wrong-distro proof.",
"Attach saved intentional-break artifacts for hidden local presentation and dropped stable-pane delivery."
],
"knownGaps": [
"No distinct installed A/B headed or headless paired-runtime cutover is attached; the restart journey relaunches the same build while preserving the daemon and agent.",
"No Docker SSH restart/reconnect, physical Windows WSL distro-authority, or git-independent folder-workspace cutover journey is attached.",
"Packaged Windows updater and uninstaller continuity is owned by separate updater reliability work and is not claimed by this gate.",
"The Electron journey uses a deterministic fake Codex CLI rather than a real account.",
"The local presentation journey tolerates its existing terminal-handle remint and proves continuity by PTY/incarnation/tab/leaf; byte-stable handle proof across a real A/B cutover awaits the runtime-authority/RPC implementation.",
"The local Electron restart proof covers retained visible output from the same-build daemon checkpoint, not transcript recovery after a transport cut or distinct A/B runtime replacement."
],
"demotionRule": "Keep experimental or demote if either Electron journey flakes without a product or harness defect, if local worker-start can return before tab materialization without an explicit reveal warning, if focus moves to the worker, if restart or workspace re-entry spawns/resumes/duplicates/interferes with the worker, if retained output becomes unreadable, or if pane-stable delivery reads the wrong mailbox."
},
{
"id": "orchestration.context-only-dispatch-release",
"title": "Manual Dispatch release fences assignments without stopping unsupervised terminals",
"maturity": "experimental",
"protection": "partial",
"owner": "orchestration",
"layer": "cli-runtime-sqlite-terminal-lifecycle",
"surfaces": [
"orchestration dispatch",
"dispatch-show",
"worker-abandon",
"worker-stop",
"manual terminal reuse"
],
"platforms": ["macos", "linux", "windows"],
"providers": ["local", "daemon", "ssh", "wsl", "remote-runtime"],
"coveredPlatforms": ["macos"],
"coveredProviders": ["local"],
"coverageNotes": "Deterministic runtime tests cover both release verbs, durable outcomes, repeat and cross-verb idempotency, superseded Task ownership, unrelated and supervised Dispatch isolation, and unknown ids. An isolated Electron journey drives the real app runtime and proves both releases preserve the exact PTY incarnation and allow immediate same-pane redispatch.",
"motivatingLinks": [
"https://github.com/stablyai/orca/issues/13005",
"https://github.com/stablyai/orca/pull/13250"
],
"invariant": "A live Dispatch created by orchestration dispatch can be stopped or abandoned even though it has no supervised worker row. Release must durably record the requested outcome, revoke lifecycle authority, close questions, free the exact assignee identity, and block only the Task whose current Dispatch was released. It must never close the unsupervised terminal process, disturb unrelated or supervised workers, or let a repeat or opposite verb rewrite the persisted outcome.",
"oracle": "Create manual, unrelated, and supervised Dispatches through production runtime methods. Require dispatch-show to return the manual id while no worker row exists, then release it and require failed status with exact stopped or abandoned provenance, completion and revocation timestamps, one status notification, zero terminal closes, and immediate redispatch to the same terminal. Repeat through the opposite verb and require the first durable outcome. Create two active contexts for one Task through an explicit ready override, release the older context, and require only its identity to unlock while the newer context and Task remain dispatched. In an isolated Electron runtime, repeat both verbs against one real pane and require the same PTY/incarnation to survive before a third dispatch succeeds.",
"commands": [
"pnpm exec vitest run --config config/vitest.config.ts src/main/runtime/rpc/methods/orchestration-manual-dispatch-release.test.ts src/main/runtime/orchestration/orchestration-worker-dispatch-db.test.ts src/main/runtime/rpc/methods/orchestration-workers-recovery.test.ts src/main/runtime/rpc/methods/orchestration-worker-release.test.ts src/cli/handlers/orchestration-worker-cli.test.ts --reporter=dot",
"pnpm run ensure:electron-runtime && pnpm exec playwright test tests/e2e/orchestration-low-level-dispatch-release.spec.ts --config tests/playwright.config.ts --project electron-headless --workers=1",
"SKIP_BUILD=1 pnpm exec playwright test tests/e2e/orchestration-low-level-dispatch-release.spec.ts --config tests/playwright.config.ts --project electron-headless --workers=1"
],
"testFiles": [
"src/main/runtime/rpc/methods/orchestration-manual-dispatch-release.test.ts",
"src/main/runtime/orchestration/orchestration-worker-dispatch-db.test.ts",
"src/main/runtime/rpc/methods/orchestration-workers-recovery.test.ts",
"src/main/runtime/rpc/methods/orchestration-worker-release.test.ts",
"src/cli/handlers/orchestration-worker-cli.test.ts",
"tests/e2e/orchestration-low-level-dispatch-release.spec.ts"
],
"assertionRefs": [
{
"file": "src/main/runtime/rpc/methods/orchestration-manual-dispatch-release.test.ts",
"assertions": [
"worker-abandon and worker-stop durably release context-only Dispatches without closing terminals",
"repeat and cross-verb calls preserve the first stored outcome",
"superseded release frees only the old identity and leaves the current Task Dispatch active",
"unrelated and supervised workers remain unchanged"
]
},
{
"file": "src/cli/handlers/orchestration-worker-cli.test.ts",
"assertions": [
"text-mode worker-stop reports that a manual Dispatch retained its unsupervised terminal process"
]
},
{
"file": "tests/e2e/orchestration-low-level-dispatch-release.spec.ts",
"assertions": [
"dispatch-show returns the live manual Dispatch before release",
"abandon and stop record distinct durable outcomes",
"the exact PTY and incarnation survive worker-stop",
"the same pane accepts a third Dispatch after both releases"
]
}
],
"evidenceRuns": [
{
"date": "2026-08-09",
"runner": "local",
"platform": "macos",
"command": "SKIP_BUILD=1 pnpm exec playwright test tests/e2e/orchestration-low-level-dispatch-release.spec.ts --config tests/playwright.config.ts --project electron-headless --workers=1",
"result": "failed",
"durationSeconds": 4.3,
"summary": "Current main 2dc172f666 reproduced issue #13005: dispatch-show returned the live id, then worker-abandon failed with dispatch_not_found before any release or pane reuse could occur."
},
{
"date": "2026-08-09",
"runner": "local",
"platform": "macos",
"command": "pnpm exec vitest run --config config/vitest.config.ts src/main/runtime/rpc/methods/orchestration-manual-dispatch-release.test.ts src/main/runtime/orchestration/orchestration-worker-dispatch-db.test.ts src/main/runtime/rpc/methods/orchestration-workers-recovery.test.ts src/main/runtime/rpc/methods/orchestration-worker-release.test.ts src/cli/handlers/orchestration-worker-cli.test.ts --reporter=dot",
"result": "passed",
"durationSeconds": 3.38,
"summary": "Five focused files passed 60 tests, including both context-only release verbs, stale/current ownership, question closure, repeat and cross-verb idempotency, supervised controls, terminal-close negative assertions, and text-mode retained-process guidance."
},
{
"date": "2026-08-09",
"runner": "local",
"platform": "macos",
"command": "SKIP_BUILD=1 pnpm exec playwright test tests/e2e/orchestration-low-level-dispatch-release.spec.ts --config tests/playwright.config.ts --project electron-headless --workers=1",
"result": "passed",
"durationSeconds": 4.1,
"summary": "The isolated Electron journey passed both release verbs, preserved the exact pane PTY/incarnation, and dispatched a third Task to the same terminal."
}
],
"runtimeBudget": {
"p95Seconds": 30,
"scope": "focused runtime contracts plus one isolated Electron journey"
},
"flakeHistory": {
"status": "unknown",
"evidence": "The deterministic unit and Electron journeys pass locally; CI and soak history are not yet available."
},
"redGreenEvidence": {
"status": "complete",
"evidence": "The byte-identical Electron oracle failed on current main 2dc172f666 with dispatch_not_found and passed after the context-only release implementation. The focused runtime oracle additionally proves durable outcomes and stale Task ownership."
},
"performanceBudget": {
"required": true,
"evidence": "Release is an explicit control-path transaction with indexed Dispatch and worker lookups, one latest-context lookup for the affected Task, bounded updates, and no polling, process inspection, provider listing, subprocess, renderer work, or terminal I/O."
},
"promotionCriteria": [
"Collect 100 consecutive focused CI passes or 14 days of soak history on macOS, Linux, and Windows.",
"Add isolated headed and headless paired-runtime journeys against mixed client and host versions.",
"Add Docker SSH and physical Windows WSL same-pane reuse evidence."
],
"knownGaps": [
"Live paired-runtime, headless serve, SSH, WSL, Linux, and Windows evidence is not yet attached.",
"The Electron journey calls production runtime RPC methods directly instead of spawning a separate CLI process.",
"The local journey covers a folder-backed seeded repository through the app fixture but not a git-independent folder workspace."
],
"demotionRule": "Keep experimental or demote if release closes an unsupervised terminal, rewrites a durable outcome, blocks a newer Task Dispatch, leaves an assignee identity occupied, or the focused oracle flakes without a product or harness defect."
},
{
"id": "orchestration.settled-worker-terminal-release",
"title": "Settled worker cleanup preserves one exact terminal lease and immutable output",
"maturity": "experimental",
"protection": "partial",
"owner": "orchestration",
"layer": "runtime-sqlite-terminal-lifecycle",
"surfaces": [
"worker-release",
"worker-retain",
"explicit terminal reuse",
"restart reconciliation",
"worker-read archives",
"orchestration reset"
],
"platforms": ["macos", "linux", "windows"],
"providers": ["local", "daemon", "ssh", "wsl", "remote-runtime"],
"coveredPlatforms": ["macos"],
"coveredProviders": ["local", "ssh"],
"coverageNotes": "Deterministic service tests cover release-versus-reuse ordering, transactional retain and takeover cancellation, exact host/pane/process identity, dead external/user-owned/transferred/stopped/abandoned reconciliation, conservative unknown provider and legacy metadata handling, immutable transcript and bounded terminal archives, mutation restart, reset cleanup, replay idempotency, and 50-resource accounting. A macOS Electron journey invokes the freshly compiled worker-release CLI after the worker process disappears, then independently checks released SQLite state and coordinator liveness. Injected inventories cover local and SSH provider routing; live SSH, WSL, Windows, paired-runtime, and provider-close lost-ack journeys remain explicit gaps.",
"motivatingLinks": [
"https://github.com/stablyai/orca/pull/12355",
"https://github.com/stablyai/orca/issues/13860",
"STA-905",
"STA-3932"
],
"invariant": "A settled Dispatch may close only its one coordinator-created terminal lease. Explicit reuse, real user input, retain, identity or host change, ambiguity, and another resource for the same exact host/pane/process must fence closure. Once the authoritative owning provider positively excludes the resource's exact immutable process incarnation, even an external, user-owned, or transferred dead resource must converge to released without any process close. Unknown host scope, missing incarnation metadata, or unavailable inventory must remain retained. Output preservation and the requested-to-releasing transition are atomic, archives remain readable without the provider file, retries resume idempotently, and orchestration reset removes archive and authority state.",
"oracle": "Record release intent for a settled owner, attempt exact reuse before close, and require worker-start to fail with terminal_release_in_progress while the terminal stays open; then release the original owner exactly once. Race retain and real user input against a controlled archive promise and require no committed archive or close. For retained external, user-owned, transferred, stopped, and abandoned resources, run one fresh inventory against the exact local/WSL or SSH provider: an exact live incarnation and every unknown inventory shape stay retained, while positive absence atomically sets ownership_state and release_state to released with processAction none and zero closeTerminal calls. Change host or process identity and inject duplicate resource evidence to require retention. Freeze a structured transcript, delete its source file, and require archived worker-read to return the same bounded redacted messages. Restart a pending mutation, reset orchestration state, and create 50 resources while asserting replay convergence, zero orphan rows, two-query worker listing, and no unrelated close.",
"commands": [
"pnpm exec vitest run --config config/vitest.config.ts src/main/runtime/orca-runtime-process-incarnation-liveness.test.ts src/main/runtime/rpc/methods/orchestration-worker-release.test.ts src/main/runtime/rpc/methods/orchestration-worker-release-recovery.test.ts src/main/runtime/rpc/orchestration-mutation-ledger.test.ts src/main/runtime/orchestration/worker-transcript-read.test.ts src/renderer/src/lib/worker-terminal-takeover-report.test.ts --reporter=dot",
"pnpm exec vitest run --config config/vitest.config.ts src/main/runtime/rpc/methods/orchestration-worker-release.test.ts src/main/runtime/rpc/methods/orchestration-worker-release-recovery.test.ts src/main/runtime/rpc/orchestration-mutation-ledger.test.ts src/main/runtime/orchestration/worker-transcript-read.test.ts src/renderer/src/lib/worker-terminal-takeover-report.test.ts --reporter=dot",
"pnpm exec vitest run --config config/vitest.config.ts tests/e2e/completed-worker-retirement-resume.unit.test.ts --reporter=verbose",
"pnpm run build:cli && SKIP_BUILD=1 pnpm exec playwright test tests/e2e/orchestration-worker-settlement-release-cli.spec.ts --config tests/playwright.config.ts --project electron-headless --workers=1"
],
"testFiles": [
"src/main/runtime/orca-runtime-process-incarnation-liveness.test.ts",
"src/main/runtime/rpc/methods/orchestration-worker-release.test.ts",
"src/main/runtime/rpc/methods/orchestration-worker-release-recovery.test.ts",
"src/main/runtime/rpc/orchestration-mutation-ledger.test.ts",
"src/main/runtime/orchestration/worker-transcript-read.test.ts",
"src/renderer/src/lib/worker-terminal-takeover-report.test.ts",
"tests/e2e/completed-worker-retirement-resume.unit.test.ts",
"tests/e2e/orchestration-worker-settlement-release-cli.spec.ts"
],
"assertionRefs": [
{
"file": "src/main/runtime/orca-runtime-process-incarnation-liveness.test.ts",
"assertions": [
"classifies only an exact incarnation as live on its owning provider",
"keeps missing or malformed identity and unavailable inventory unknown",
"does not inspect an unproven host scope",
"uses the local provider inventory for local and WSL scopes"
]
},
{
"file": "tests/e2e/completed-worker-retirement-resume.unit.test.ts",
"assertions": [
"an already-exited succeeded Dispatch reaches released while its late exact close revokes the missing tab's stale resume record"
]
},
{
"file": "src/main/runtime/rpc/methods/orchestration-worker-release.test.ts",
"assertions": [
"reconciles a dead external terminal without closing a process",
"reconciles a dead user-taken-over terminal without closing a process",
"reconciles a dead stopped or abandoned worker without closing a process",
"reconciles dead transferred ownership after the current owner settles",
"rejects exact reuse after release intent instead of closing the new worker",
"lets an explicit retain cancel a release while output capture is pending",
"retains when the terminal host scope changed instead of closing",
"reads an immutable transcript snapshot after the provider file disappears",
"backfills a legacy creator plus explicit reuser as ambiguous",
"removes terminal authority and archived output on orchestration reset"
]
},
{
"file": "src/main/runtime/rpc/orchestration-mutation-ledger.test.ts",
"assertions": ["resumes a pending idempotent worker release after restart"]
},
{
"file": "src/main/runtime/rpc/methods/orchestration-worker-release-recovery.test.ts",
"assertions": [
"finishes a requested release after restart-style interruption",
"coalesces overlapping reconciliation passes and closes each resource once",
"keeps live terminals bounded across 50 settled workers while controls survive"
]
},
{
"file": "tests/e2e/orchestration-worker-settlement-release-cli.spec.ts",
"assertions": [
"compiled worker-release reconciles a dead external retained resource to released",
"the CLI reports processAction none instead of closing a process",
"SQLite independently records released ownership and release state",
"the unrelated coordinator terminal remains live"
]
}
],
"evidenceRuns": [
{
"date": "2026-08-12",
"runner": "local",
"platform": "macos",
"command": "pnpm run build:cli && SKIP_BUILD=1 pnpm exec playwright test tests/e2e/orchestration-worker-settlement-release-cli.spec.ts --config tests/playwright.config.ts --project electron-headless --workers=1",
"result": "passed",
"durationSeconds": 20,
"summary": "The combined candidate's compiled worker-release returned released with processAction none after positive process absence; an independent SQLite read showed both states released and the coordinator terminal remained live."
},
{
"date": "2026-08-11",
"runner": "local",
"platform": "macos",
"command": "pnpm exec vitest run --config config/vitest.config.ts src/main/runtime/orca-runtime-process-incarnation-liveness.test.ts src/main/runtime/rpc/methods/orchestration-worker-release.test.ts src/main/runtime/rpc/methods/orchestration-worker-release-recovery.test.ts src/main/runtime/rpc/orchestration-mutation-ledger.test.ts src/main/runtime/orchestration/worker-transcript-read.test.ts src/renderer/src/lib/worker-terminal-takeover-report.test.ts --reporter=dot",
"result": "passed",
"durationSeconds": 4.98,
"summary": "Six focused files passed 67 tests on the rebased candidate, covering dead external, user-owned, stopped, abandoned, and transferred reconciliation; exact local/WSL/SSH provider routing; malformed, missing, and unavailable inventory retention; zero process closes; existing lease, archive, recovery, mutation, and renderer-input contracts."
},
{
"date": "2026-08-03",
"runner": "local",
"platform": "macos",
"command": "pnpm exec vitest run --config config/vitest.config.ts src/main/runtime/rpc/methods/orchestration-worker-release.test.ts src/main/runtime/rpc/methods/orchestration-worker-release-recovery.test.ts src/main/runtime/rpc/orchestration-mutation-ledger.test.ts src/main/runtime/orchestration/worker-transcript-read.test.ts src/renderer/src/lib/worker-terminal-takeover-report.test.ts --reporter=dot",
"result": "passed",
"durationSeconds": 3.48,
"summary": "Five focused files passed 56 tests covering lease serialization, reminted-handle transfer, duplicate-identity fencing, retain and takeover races, immutable archives, conservative legacy migration, mutation restart, reset cleanup, bounded accounting, and renderer input reporting."
}
],
"runtimeBudget": {
"p95Seconds": 45,
"scope": "deterministic runtime, SQLite, transcript, renderer-input, mutation contracts, and one compiled-CLI Electron journey"
},
"flakeHistory": {
"status": "unknown",
"evidence": "Repeated local deterministic runs pass; focused CI and soak history are not yet available."
},
"redGreenEvidence": {
"status": "complete",
"evidence": "The byte-identical compiled-CLI Electron oracle left the dead resource external/retained on latest main 5ea7df1a5b, passed on combined candidate d697666ce8 with released/released SQLite state and processAction none, and reproduced external/retained after disabling the claimed production files at merge-base 64aec94cb2. The earlier unchanged three-case dead external/user-owned/transferred service oracle likewise failed 3/3 on main, passed 3/3 on candidate, and failed 3/3 with production restored; every run asserted durable state and zero terminal close calls."
},
"performanceBudget": {
"required": true,
"evidence": "Normal owned release performs constant-count indexed resource and identity queries plus one bounded archive capture. A retained release performs exactly one bounded inventory against its authoritative local/WSL or specific SSH provider, with no retry, polling, timer, subprocess, renderer subscription, or per-session follow-up fanout. Worker-list uses two set queries rather than one resource lookup per worker."
},
"promotionCriteria": [
"Collect 100 consecutive focused CI passes or 14 days of soak history.",
"Add live headed and headless paired-runtime release/reuse journeys.",
"Add Docker SSH reconnect and physical Windows WSL host-scope evidence.",
"Prove provider-close lost acknowledgements converge with an exact durable close receipt."
],
"knownGaps": [
"Provider close has no durable cross-process operation receipt, so a crash after host mutation but before SQLite settlement remains release_pending until exact inventory returns.",
"Federated release remains explicitly unsupported and retained.",
"Mobile/direct remote input takeover and live Linux, Windows, WSL, SSH, headed, and headless paired-runtime release are not exercised; the current fix changes provider inventory classification and SQLite state only, not ConPTY, filesystem, update, sleep, firewall, or window lifecycle semantics."
],
"demotionRule": "Keep experimental or demote if release can overlap exact reuse, close a conflicting lease, lose immutable output, retain reset archives, fan out per worker, or any focused ordering test flakes without a product or harness defect."
},
{
"id": "terminal-render.windows-cjk-repaint",
"title": "Windows ConPTY wide glyphs and cursor rewrites repaint without stale cells",
"maturity": "experimental",
"protection": "none",
"owner": "terminal-rendering",
"layer": "windows-electron-conpty",
"surfaces": [
"Windows ConPTY",
"CJK",
"emoji",
"wide glyphs",
"cursor repaint",
"rewrite output"
],
"platforms": ["windows"],
"providers": ["local", "daemon", "wsl"],
"coveredPlatforms": [],
"coveredProviders": [],
"coverageNotes": "Registered gap only; no executable coverage is wired yet.",
"motivatingLinks": [
"https://github.com/stablyai/orca/pull/6876",
"https://github.com/stablyai/orca/pull/6968",
"https://github.com/stablyai/orca/pull/6970"
],
"invariant": "Windows terminal repaint must not leave stale cells, clipped wide glyphs, or hidden cursor state after CJK, emoji, or cursor-rewrite output.",
"oracle": "A Windows gate combines xterm buffer assertions with bounded screenshot/canvas evidence for representative CJK, emoji, and rewrite sequences.",
"commands": [],
"testFiles": [],
"assertionRefs": [],
"evidenceRuns": [],
"runtimeBudget": {
"p95Seconds": 90,
"scope": "Windows focused Electron render gate"
},
"flakeHistory": {
"status": "not-started",
"evidence": "Gate is registered as a known Windows rendering gap; no command is wired."
},
"redGreenEvidence": {
"status": "missing",
"evidence": "Needs intentional-break proof for stale wide-glyph repaint or cursor restore."
},
"performanceBudget": {
"required": true,
"evidence": "Must record refresh count or frame budget so repaint fixes do not mask excessive redraw churn."
},
"promotionCriteria": [
"Use buffer/cell evidence as the primary oracle and screenshots as diagnostics.",
"Keep stress cases non-blocking until Windows runtime history is stable.",
"Fail promotion on silent Windows environment skips."
],
"knownGaps": ["No manifest command yet.", "No Windows CJK/emoji repaint command is wired."],
"demotionRule": "Cannot promote if the oracle is screenshot-only or environment-skipped."
},
{
"id": "terminal-shell.windows-resolution-parity",
"title": "Windows local and daemon providers resolve shells and startup commands consistently",
"maturity": "experimental",
"protection": "none",
"owner": "terminal-platform",
"layer": "provider-contract-windows",
"surfaces": [
"shell resolution",
"startup command",
"cwd",
"environment",
"local provider",
"daemon provider"
],
"platforms": ["windows"],
"providers": ["local", "daemon", "wsl"],
"coveredPlatforms": [],
"coveredProviders": [],
"coverageNotes": "Registered gap only; no executable coverage is wired yet.",
"motivatingLinks": [
"https://github.com/stablyai/orca/pull/6541",
"https://github.com/stablyai/orca/pull/6858"
],
"invariant": "Windows local and daemon terminals must resolve equivalent shell paths, args, cwd, env, startup command delivery, and fallback behavior for PowerShell 5/7, cmd, Git Bash, WSL, and missing pwsh.",
"oracle": "Provider-contract fixtures compare resolved command descriptors and live shell markers for supported Windows shells across local and daemon providers.",
"commands": [],
"testFiles": [],
"assertionRefs": [],
"evidenceRuns": [],
"runtimeBudget": {
"p95Seconds": 60,
"scope": "Windows provider-contract gate"
},
"flakeHistory": {
"status": "not-started",
"evidence": "Gate is registered as a known Windows shell parity gap; no command is wired."
},
"redGreenEvidence": {
"status": "missing",
"evidence": "Needs intentional-break proof for mismatched daemon/local shell resolution or lost startup command."
},
"performanceBudget": {
"required": false,
"evidence": "Required if resolution adds probing or PATH scans on hot startup paths."
},
"promotionCriteria": [
"Start with provider-contract fixtures before live Electron coverage.",
"Cover missing-shell fallback explicitly.",
"Fail promotion on silent Windows environment skips."
],
"knownGaps": [
"No manifest command yet.",
"No local-vs-daemon Windows shell parity command is wired."
],
"demotionRule": "Cannot promote if local and daemon provider behavior are tested separately without parity assertions."
},
{
"id": "terminal-performance.input-throughput",
"title": "Terminal input latency and throughput stay inside explicit budgets",
"maturity": "experimental",
"protection": "none",
"owner": "terminal-performance",
"layer": "electron-perf",
"surfaces": [
"typing latency",
"output throughput",
"hidden output",
"renderer CPU",
"resize churn"
],
"platforms": ["macos", "linux", "windows"],
"providers": ["local", "daemon", "ssh", "remote-runtime"],
"coveredPlatforms": [],
"coveredProviders": [],
"coverageNotes": "Registered gap only; no executable coverage is wired yet.",
"motivatingLinks": [
"https://github.com/stablyai/orca/pull/7002",
"https://github.com/stablyai/orca/pull/6858"
],
"invariant": "Terminal typing, paste, resize, and output rendering must stay within latency and throughput budgets under realistic active and hidden-output load.",
"oracle": "Perf artifacts record median/p95/max key latency, event-loop delay, renderer CPU, output bytes/sec, resize count, hidden restore latency, queue depth, and dropped-output counts.",
"commands": [],
"testFiles": [],
"assertionRefs": [],
"evidenceRuns": [],
"runtimeBudget": {
"p95Seconds": 120,
"scope": "focused terminal perf report gate"
},
"flakeHistory": {
"status": "not-started",
"evidence": "Existing terminal perf scripts exist, but this gate is not wired with budgets or artifacts."
},
"redGreenEvidence": {
"status": "missing",
"evidence": "Needs intentional-break proof for hot-path listing, unbounded scheduler work, and input starvation."
},
"performanceBudget": {
"required": true,
"evidence": "Suggested initial budgets: active key median <=75ms, worst <=300ms in perf scenarios, dropped output 0, and bounded queue depths recorded per run."
},
"promotionCriteria": [
"Wire existing perf scripts to emit machine-readable artifacts.",
"Make budgets platform-aware before blocking.",
"Do not promote stress variants until runtime history is stable."
],
"knownGaps": [
"No manifest command yet.",
"Existing perf scripts are not registered with explicit budgets or flake history."
],
"demotionRule": "Cannot promote without metric artifacts and stable p95 runtime history."
},
{
"id": "terminal-performance.daemon-stream-backpressure",
"title": "Daemon terminal streams respect socket backpressure under output floods",
"maturity": "experimental",
"protection": "none",
"owner": "terminal-performance",
"layer": "daemon-provider-contract",
"surfaces": ["daemon stream", "socket write", "drain", "hidden output", "input starvation"],
"platforms": ["macos", "linux", "windows"],
"providers": ["daemon"],
"coveredPlatforms": [],
"coveredProviders": [],
"coverageNotes": "Registered gap on main. The daemon batcher write(false)/drain contracts exist only on the pending reliability stack. It registers here with its owning split PR.",
"motivatingLinks": [
"https://github.com/stablyai/orca/pull/6836",
"https://github.com/stablyai/orca/pull/6858"
],
"invariant": "Daemon terminal output floods must pause when socket writes return false, resume on drain, keep buffered bytes bounded, and not starve focused input.",
"oracle": "The current executable slice injects a slow socket and asserts write(false)/drain ordering, bounded queued daemon stream bytes, close/error listener cleanup, newest-tail preservation under sustained pressure, and flush-immediate cross-session priority ahead of unrelated background backlog on drain. Active input latency remains part of the broader perf gate.",
"commands": [],
"testFiles": [],
"assertionRefs": [],
"evidenceRuns": [],
"runtimeBudget": {
"p95Seconds": 60,
"scope": "daemon provider-contract gate"
},
"flakeHistory": {
"status": "unknown",
"evidence": "Focused daemon stream backpressure contract runs locally; needs soak history before promotion."
},
"redGreenEvidence": {
"status": "partial",
"evidence": "Tests assert daemon stream writes pause after socket write(false), later stream data queues behind the pressured socket, flush-immediate output from another session is prioritized ahead of unrelated queued background backlog on drain while preserving per-session order, queued lines resume on drain, global cleanup and close/error clear pending drain listeners, and queued bytes are bounded by preserving priority output plus the newest tail. Needs intentional-break artifact plus active-input latency proof before promotion."
},
"performanceBudget": {
"required": true,
"evidence": "Must record queued bytes, drain count, write(false) count, dropped output, and active input latency."
},
"promotionCriteria": [
"Keep deterministic socket mocks as the blocking candidate only after soak.",
"Record byte and drain artifacts on failure.",
"Pair with the broader output-backpressure budget before blocking."
],
"knownGaps": [
"No executable coverage on main yet; the slice lives on the pending fix-terminal-reliability stack.",
"Current command is daemon batcher contract coverage, not live daemon/Electron perf.",
"Active input latency is not proven in live daemon/Electron perf."
],
"demotionRule": "Cannot promote if backpressure is inferred only from renderer output success."
},
{
"id": "terminal-performance.store-and-git-hot-paths",
"title": "Terminal-adjacent store and git polling work stays off hot interaction paths",
"maturity": "experimental",
"protection": "none",
"owner": "terminal-performance",
"layer": "renderer-main-perf-contract",
"surfaces": [
"store selectors",
"git polling",
"startup hydration",
"terminal focus",
"tab switch",
"workspace switch",
"agent status"
],
"platforms": ["macos", "linux", "windows"],
"providers": ["local", "daemon", "ssh", "remote-runtime"],
"coveredPlatforms": [],
"coveredProviders": [],
"coverageNotes": "Registered gap on main. The boot-hydration counters and their tests exist only on the pending reliability stack. It registers here with its owning split PR.",
"motivatingLinks": ["https://github.com/stablyai/orca/pull/7002"],
"invariant": "Terminal typing, focus, resize, tab/workspace switch, and agent/session restore must not trigger unbounded store projection, git status, provider listing, or per-pane polling work.",
"oracle": "The current executable slice instruments boot-time local PTY registry hydration with repo counts, local-vs-remote repo skips, worktree enumeration counts, adapter/session listing counts, registration/skipped-session counts, duration, and failure phase. The broader oracle still needs instrumentation that counts store selector recomputes, git status requests, provider listings, and session scans during scripted hot interactions with many worktrees and terminal panes.",
"commands": [],
"testFiles": [],
"assertionRefs": [],
"evidenceRuns": [],
"runtimeBudget": {
"p95Seconds": 60,
"scope": "renderer-main perf/count gate"
},
"flakeHistory": {
"status": "unknown",
"evidence": "Focused boot-hydration counter slice passed locally once; needs CI/runtime history before promotion."
},
"redGreenEvidence": {
"status": "partial",
"evidence": "Tests would fail if boot hydration enumerated SSH worktrees, stopped recording provider-unavailable retry state, lost the startup counter surface, stopped recording fatal hydration failures, or missed router adapter fanout/list-failure counters. Needs intentional-break proof for git/status polling or store scans triggered by terminal hot paths."
},
"performanceBudget": {
"required": true,
"evidence": "Current slice records boot-hydration repo, worktree, adapter, session, skip, register, and duration counters. Promotion still requires count budgets for listSessions, git status, provider scans, store recomputes, and elapsed hot-interaction time."
},
"promotionCriteria": [
"Use deterministic counters before broad perf scenarios.",
"Cover high-session and high-worktree fixtures.",
"Keep stress variants non-blocking until stable."
],
"knownGaps": [
"No executable coverage on main yet; the slice lives on the pending fix-terminal-reliability stack.",
"Current command covers boot hydration counters only, not interactive terminal hot paths.",
"No Electron count gate yet proves focus, typing, tab switch, workspace switch, render, or high-session provider fanout avoids broad store/git/provider scans."
],
"demotionRule": "Cannot promote without count budgets and actionable artifacts."
},
{
"id": "terminal-output.scrollback-restore",
"title": "Scrollback restore, hidden output, and replay clear semantics do not overlap stale bytes",
"maturity": "experimental",
"protection": "partial",
"owner": "terminal-rendering",
"layer": "renderer-provider-contract",
"surfaces": [
"scrollback",
"hidden output",
"snapshot replay",
"metadata-only replay",
"clear semantics"
],
"platforms": ["macos", "linux", "windows"],
"providers": ["local", "daemon", "ssh", "remote-runtime"],
"coveredPlatforms": ["macos"],
"coveredProviders": [],
"coverageNotes": "Local macOS evidence over the merged #7133/#7173 restore and hidden-output ordering tests on main@1282f5c2d. The dirty-state exactness contract, normal-buffer clear semantics, and metadata-only replay remain pending-stack work.",
"motivatingLinks": [
"https://github.com/stablyai/orca/pull/7173",
"https://github.com/stablyai/orca/pull/7133",
"https://github.com/stablyai/orca/pull/7012",
"https://github.com/stablyai/orca/pull/7054",
"https://github.com/stablyai/orca/pull/6949"
],
"invariant": "Hidden-output restore, snapshot replay, metadata-only replay, and clear-before-replay must preserve order and never overlay stale bytes on newer live terminal output; restoring a snapshot onto an already-dirty pane must yield a buffer exactly equal to the snapshot frame.",
"oracle": "Apply snapshots onto adversarially dirty pane states (already on the alternate screen, stale content occupying cells the new frame leaves blank, scrollback present, wide glyphs, revived sessions with restarted PTY seq counters) and assert exact buffer equality with the snapshot frame; fault injection interleaves hidden chunks, live output, metadata-only replay, and clear-before-replay, then asserts ordered terminal buffer content, clear decisions, and replay diagnostics. Marker-presence checks are not acceptable evidence on restore paths.",
"commands": [
"pnpm exec vitest run --config config/vitest.config.ts src/renderer/src/components/terminal-pane/pty-connection-hidden-backlog-snapshot.test.ts src/renderer/src/components/terminal-pane/pty-connection-hidden-output-restore.test.ts src/renderer/src/components/terminal-pane/pty-connection-stalled-hidden-restore.test.ts src/renderer/src/components/terminal-pane/pty-connection-replay-payload-handling.test.ts"
],
"testFiles": [
"src/renderer/src/components/terminal-pane/pty-connection-hidden-backlog-snapshot.test.ts",
"src/renderer/src/components/terminal-pane/pty-connection-hidden-output-restore.test.ts",
"src/renderer/src/components/terminal-pane/pty-connection-stalled-hidden-restore.test.ts",
"src/renderer/src/components/terminal-pane/pty-connection-replay-payload-handling.test.ts"
],
"assertionRefs": [
{
"file": "src/renderer/src/components/terminal-pane/pty-connection-hidden-backlog-snapshot.test.ts",
"assertions": [
"restoring an alternate-screen snapshot clears only the alternate screen (#7133)"
]
},
{
"file": "src/renderer/src/components/terminal-pane/pty-connection-hidden-output-restore.test.ts",
"assertions": [
"hidden Codex output is restored when the pty seq counter restarts, with or without an observed exit (#7173)"
]
},
{
"file": "src/renderer/src/components/terminal-pane/pty-connection-stalled-hidden-restore.test.ts",
"assertions": ["pending hidden restore chunks are not replayed after a terminal clear"]
},
{
"file": "src/renderer/src/components/terminal-pane/pty-connection-replay-payload-handling.test.ts",
"assertions": ["a scrolled-up viewport is preserved after hidden-backlog snapshot replay"]
}
],
"evidenceRuns": [
{
"date": "2026-07-03",
"runner": "local",
"platform": "macos",
"command": "pnpm exec vitest run --config config/vitest.config.ts src/renderer/src/components/terminal-pane/pty-connection-hidden-backlog-snapshot.test.ts src/renderer/src/components/terminal-pane/pty-connection-hidden-output-restore.test.ts src/renderer/src/components/terminal-pane/pty-connection-stalled-hidden-restore.test.ts src/renderer/src/components/terminal-pane/pty-connection-replay-payload-handling.test.ts",
"result": "passed",
"durationSeconds": 8.4,
"summary": "1 test file(s) passed, 311 tests passed on main@1282f5c2d in a clean checkout."
}
],
"runtimeBudget": {
"p95Seconds": 45,
"scope": "renderer provider-contract gate"
},
"flakeHistory": {
"status": "not-started",
"evidence": "Remote replay FIFO has a focused slice, but the broader scrollback restore gate is not wired."
},
"redGreenEvidence": {
"status": "partial",
"evidence": "#7133 and #7173 each proved their slices red before fix (stale alt-screen bleed-through; stale background chunk written after restore; frozen revived seq counters). The broader dirty-state exactness contract has no red runs yet."
},
"performanceBudget": {
"required": true,
"evidence": "Must keep hidden restore bounded and avoid unbounded renderer parsing or wake loops."
},
"promotionCriteria": [
"Start every restore case from adversarially dirty pane state, never only fresh terminals.",
"Assert frame exactness or stale-content absence, never marker presence.",
"Build deterministic lower-layer clear and interleaving tests before broad golden E2E.",
"Use long-table/golden visual tests only as supporting evidence.",
"Record ordered buffer diagnostics on failure."
],
"knownGaps": [
"No manifest command yet.",
"The existing replay FIFO command is narrower than this broader scrollback restore invariant.",
"#7133's merged alt-only-clear restore tests exist on main but are not yet registered as this gate's command.",
"#7173's ordered-seq interleaving and session-revival tests in pty-connection.test.ts on main are the seed for the hidden/live interleaving slice and are unregistered until the rebase."
],
"demotionRule": "Cannot promote without clear-semantics and hidden/live interleaving assertions."
},
{
"id": "terminal-capability.startup-color-query",
"title": "Startup color capability queries do not leak into shell or terminal streams",
"maturity": "experimental",
"protection": "none",
"owner": "terminal-rendering",
"layer": "renderer-provider-contract",
"surfaces": [
"OSC 10/11",
"startup capability query",
"shell stream",
"renderer stream",
"terminal colors"
],
"platforms": ["macos", "linux", "windows"],
"providers": ["local", "daemon", "ssh", "remote-runtime"],
"coveredPlatforms": [],
"coveredProviders": [],
"coverageNotes": "Registered gap only; no executable coverage is wired yet.",
"motivatingLinks": ["https://github.com/stablyai/orca/pull/6949"],
"invariant": "Startup OSC 10/11 color queries are answered out of band at startup only, never leak into shell/provider output streams, and ordinary runtime OSC color queries remain renderer-handled.",
"oracle": "A provider-contract fixture records startup query replies, shell-visible bytes, renderer-visible bytes, and later runtime OSC behavior to prove no query leakage or color deadlock.",
"commands": [],
"testFiles": [],
"assertionRefs": [],
"evidenceRuns": [],
"runtimeBudget": {
"p95Seconds": 30,
"scope": "renderer provider-contract gate"
},
"flakeHistory": {
"status": "not-started",
"evidence": "Gate is registered as a capability/startup gap; no command is wired."
},
"redGreenEvidence": {
"status": "missing",
"evidence": "Needs intentional-break proof for leaked startup OSC replies or disabled runtime OSC handling."
},
"performanceBudget": {
"required": false,
"evidence": "Required if capability probing adds retry loops or startup polling."
},
"promotionCriteria": [
"Assert shell/provider byte streams directly.",
"Cover startup-only and runtime OSC paths separately.",
"Keep screenshot evidence diagnostic only."
],
"knownGaps": ["No manifest command yet.", "No startup color-query contract is wired."],
"demotionRule": "Cannot promote if success is based only on absence of visible artifacts."
},
{
"id": "terminal-input.cooked-reply-queue",
"title": "Terminal query replies stay atomic and bounded without evicting ordinary input",
"maturity": "experimental",
"protection": "partial",
"owner": "terminal-runtime",
"layer": "renderer-provider-contract",
"surfaces": [
"desktop terminal input",
"OSC 10/11 replies",
"mode-2031 replies",
"DA1 and CPR replies",
"local PTY",
"daemon and SSH PTYs"
],
"platforms": ["macos", "linux", "windows"],
"providers": ["local", "daemon", "ssh"],
"coveredPlatforms": ["macos"],
"coveredProviders": ["local", "ssh"],
"coverageNotes": "Deterministic renderer and IPC-transport tests prove count and text ceilings, oldest-reply shedding, explicit query-reply source routing, ordinary-input preservation, one-reply-per-write delivery for OSC, DA1, and CPR replies, real xterm OSC reply generation, drain-failure containment, and clear/reuse generation fencing. Remote-runtime tests preserve separate query-reply writes across pending input, async validation, and viewport-claim buffering. Host-contract tests prove a later DA1/CPR reply cannot overtake a deferred OSC reply, including a coalesced legacy-client payload. Live macOS Electron tests cover local PTY OSC replies and interactive typing; a macOS-hosted Docker OpenSSH test proves an upstream-node-pty Linux relay keeps OSC/DA1 replies out of the next fish child's stdin. No live daemon, paired-runtime, WSL, physical Linux/Windows client, or binary mixed-version run is registered.",
"motivatingLinks": [
"https://github.com/stablyai/orca/issues/13137",
"https://github.com/stablyai/orca/issues/7329",
"https://github.com/stablyai/orca/issues/13892"
],
"invariant": "The desktop PTY input queue retains at most 64 explicitly sourced pending terminal query replies and 4096 UTF-16 code units. Every retained reply reaches the provider as one atomic write, and the host writes each reply the moment it accepts it, so replies reach the PTY in the order they were produced with no queue that could reorder them. A reply's own echo is contained on the output side by projecting its known echo shapes; the ESC-initial verbatim shape is matched only when complete, never held as a partial, so a query torn at its own ESC is still answered. Overflow removes only the oldest query replies, never ordinary input except the documented modified-F3/CPR byte collision, and drain failures cannot clear a newer queue generation.",
"oracle": "Synchronously enqueue separate 10,000-entry OSC and DA1 reply floods before the scheduled drain and assert that only the initial immediate reply and newest 64 pending replies are written, each as one provider write, before a trailing keystroke. At the host boundary, defer an OSC reply and assert that separate or legacy-coalesced DA1/CPR replies flush after it in observed query order. At the remote-runtime boundary, preserve separate writes around pending ordinary input, async validation, and viewport-claim buffering. Repeat behind 10,000 ordinary inputs and exercise the text ceiling, real xterm generation, provider-write failure, rejected yield, and clear/reuse generation fencing.",
"commands": [
"pnpm exec vitest run --config config/vitest.config.ts src/renderer/src/components/terminal-pane/pty-input-write-queue.test.ts src/renderer/src/components/terminal-pane/pty-transport-input-write.test.ts src/shared/terminal-query-reply.test.ts src/shared/pty-startup-ingress-live-query-reply.test.ts",
"pnpm exec vitest run --config config/vitest.config.ts src/renderer/src/components/terminal-pane/remote-runtime-pty-batching.test.ts src/renderer/src/components/terminal-pane/remote-runtime-pty-query-reply-immediate.test.ts src/renderer/src/components/terminal-pane/remote-runtime-pty-transport-input-coalescing.test.ts",
"pnpm exec playwright test tests/e2e/terminal-osc-color-queries.spec.ts --config tests/playwright.config.ts --project electron-headless --workers=1",
"pnpm exec playwright test tests/e2e/terminal-typing-latency.spec.ts --config tests/playwright.config.ts --project electron-headless --workers=1",
"ORCA_E2E_SSH_DOCKER=1 pnpm exec playwright test tests/e2e/pty-input-write-queue-ssh.spec.ts --config tests/playwright.config.ts --project electron-headless --workers=1"
],
"testFiles": [
"src/renderer/src/components/terminal-pane/pty-input-write-queue.test.ts",
"src/renderer/src/components/terminal-pane/pty-transport-input-write.test.ts",
"src/renderer/src/components/terminal-pane/remote-runtime-pty-batching.test.ts",
"src/renderer/src/components/terminal-pane/remote-runtime-pty-query-reply-immediate.test.ts",
"src/renderer/src/components/terminal-pane/remote-runtime-pty-transport-input-coalescing.test.ts",
"src/shared/terminal-query-reply.test.ts",
"src/shared/pty-startup-ingress-live-query-reply.test.ts",
"tests/e2e/terminal-osc-color-queries.spec.ts",
"tests/e2e/terminal-typing-latency.spec.ts",
"tests/e2e/pty-input-write-queue-ssh.spec.ts"
],
"assertionRefs": [
{
"file": "src/renderer/src/components/terminal-pane/pty-input-write-queue.test.ts",
"assertions": [
"a synchronous 10,000-reply flood writes only the immediate first and newest 64 pending replies before a trailing keystroke",
"10,000 ordinary queued inputs survive a later reply flood while reply retention remains bounded",
"reply-shaped bytes from the ordinary input path never enter the shed-able reply budget",
"reply count and text overflow remove only the oldest pending replies",
"real xterm OSC 10/11 query handlers remain subject to the same retention ceiling",
"retained OSC, DA1, and CPR replies stay one provider write each and both OSC and DA1 floods remain bounded",
"provider-write and yield failures settle without unhandled rejection, repeated same-generation admission, or stale-generation clearing",
"clear releases saturated reply accounting and fences in-flight validation before later input"
]
},
{
"file": "src/renderer/src/components/terminal-pane/pty-transport-input-write.test.ts",
"assertions": [
"sendInputImmediate applies the reply ceiling while sendInput preserves a reply-shaped ordinary payload in exact IPC write order",
"a thrown renderer write triggers one owning-transport recovery callback and rejects later input in that queue generation"
]
},
{
"file": "src/renderer/src/components/terminal-pane/remote-runtime-pty-batching.test.ts",
"assertions": [
"a validation barrier runs after earlier deferred input and before later input"
]
},
{
"file": "src/renderer/src/components/terminal-pane/remote-runtime-pty-query-reply-immediate.test.ts",
"assertions": [
"pending ordinary input and asynchronously validated paste stay ahead of but separate from an immediate query reply"
]
},
{
"file": "src/renderer/src/components/terminal-pane/remote-runtime-pty-transport-input-coalescing.test.ts",
"assertions": [
"viewport-claim buffering replays ordinary input, a query reply, and later ordinary input as three ordered stream frames",
"a 10,000-reply viewport-claim flood retains and replays only the newest 64 query replies"
]
},
{
"file": "src/shared/terminal-query-reply.test.ts",
"assertions": [
"only complete query replies are classified and consecutive mixed reply kinds extract losslessly"
]
},
{
"file": "src/shared/pty-startup-ingress-live-query-reply.test.ts",
"assertions": [
"repeated live query replies are delivered independently and their cooked echoes stay hidden"
]
},
{
"file": "tests/e2e/terminal-osc-color-queries.spec.ts",
"assertions": [
"real Electron xterm OSC 10/11 replies reach the active local PTY as separate writes"
]
},
{
"file": "tests/e2e/terminal-typing-latency.spec.ts",
"assertions": [
"real keyboard input reaches and echoes from the active local PTY within the interactive latency ceilings"
]
},
{
"file": "tests/e2e/pty-input-write-queue-ssh.spec.ts",
"assertions": [
"a real Linux SSH process emits an OSC query and receives xterm's synthetic reply through the live PTY queue",
"an upstream-node-pty Linux relay has no echoState export and keeps OSC/DA1 reply bytes out of the next fish child stdin"
]
}
],
"evidenceRuns": [
{
"date": "2026-08-09",
"runner": "local",
"platform": "macos",
"command": "pnpm exec vitest run --config config/vitest.config.ts src/renderer/src/components/terminal-pane/pty-input-write-queue.test.ts src/renderer/src/components/terminal-pane/pty-transport-input-write.test.ts src/shared/terminal-query-reply.test.ts src/shared/pty-startup-ingress-live-query-reply.test.ts",
"result": "passed",
"durationSeconds": 2.35,
"summary": "Four files and 138 tests passed, including explicit IPC reply-source routing, the 10,000-reply count ceiling, text ceiling, 10,000-entry ordinary backlog preservation, real xterm OSC query flood, single-shot drain-failure recovery, one-reply-per-write echo containment, and clear/reuse generation fencing."
},
{
"date": "2026-08-09",
"runner": "local",
"platform": "macos",
"command": "pnpm exec playwright test tests/e2e/terminal-osc-color-queries.spec.ts --config tests/playwright.config.ts --project electron-headless --workers=1",
"result": "passed",
"durationSeconds": 13.2,
"summary": "The real Electron/xterm OSC 10/11 query path wrote the exact foreground and background replies separately to the active local PTY."
},
{
"date": "2026-08-09",
"runner": "local",
"platform": "macos",
"command": "pnpm exec playwright test tests/e2e/terminal-typing-latency.spec.ts --config tests/playwright.config.ts --project electron-headless --workers=1",
"result": "passed",
"durationSeconds": 10.6,
"summary": "Real keyboard events traversed xterm and the input queue to a local interactive PTY with every sampled key echoed inside the latency ceiling."
},
{
"date": "2026-08-09",
"runner": "local",
"platform": "macos",
"command": "ORCA_E2E_SSH_DOCKER=1 pnpm exec playwright test tests/e2e/pty-input-write-queue-ssh.spec.ts --config tests/playwright.config.ts --project electron-headless --workers=1",
"result": "passed",
"durationSeconds": 36.8,
"summary": "A real Linux process behind Docker OpenSSH emitted an OSC 10 query and observed xterm's synthetic RGB reply after it traversed the live renderer queue, Electron IPC, SSH provider, and relay PTY."
},
{
"date": "2026-08-14",
"runner": "local",
"platform": "macos",
"command": "ORCA_E2E_SSH_DOCKER=1 pnpm exec playwright test tests/e2e/pty-input-write-queue-ssh.spec.ts --config tests/playwright.config.ts --project electron-headless --workers=1",
"result": "passed",
"durationSeconds": 36.9,
"summary": "Run with SKIP_BUILD=1 against the existing e2e bundle. Both Docker OpenSSH Electron tests passed: the live OSC query returned its RGB reply, and an upstream-node-pty Linux ARM64 relay without echoState kept OSC/DA1 bytes out of the next fish 4.8.1 child's stdin."
}
],
"runtimeBudget": {
"p95Seconds": 120,
"scope": "focused unit, local Electron, and Docker SSH contracts"
},
"flakeHistory": {
"status": "unknown",
"evidence": "Ten consecutive local unit-gate runs passed 1,380 tests in 29.57 seconds total with no fixed timing sleeps. The exact Docker SSH OSC oracle passed three consecutive runs before extraction and then passed both registered full-spec runs. The upstream-node-pty fish handoff oracle passed three local runs, including the final post-rebase run. CI and the normal soak window are not yet available."
},
"redGreenEvidence": {
"status": "partial",
"evidence": "Without the branch's admission cap, the 10,000-reply fixture writes all replies before the trailing keystroke. Before the source-routing repair, the queue had no API capable of distinguishing reply-shaped ordinary input; before failure containment, a thrown provider write rejected waitForDrain and Vitest recorded an unhandled rejection; the first containment pass retried a failed generation and invoked recovery twice; before generation fencing, a rejected stale yield cleared fresh input. No saved intentional-break artifact is attached yet."
},
"performanceBudget": {
"required": true,
"evidence": "Pending query replies are capped at 64 and 4096 UTF-16 code units. Explicit source routing and separate sequence-merged FIFOs keep ordinary input out of the fixed-size reply store; oldest-reply eviction uses an amortized O(1) head advance without scanning ordinary input, consumed prefixes compact at a fixed threshold, and drain coalescing reads the stored classification without repeated reply-regex scans. Separate synchronous OSC and DA1 floods forward only the immediate first and newest 64 replies before the trailing key, and the remote-runtime viewport-claim buffer likewise retains only the newest 64 query segments while coalescing adjacent ordinary input. The sync ECHO probe removes an `stty` subprocess from the common quiet-query path and the fallback adds no polling beyond the existing bounded ECHO probe."
},
"promotionCriteria": [
"Run the gate on Windows and Linux CI.",
"Exercise a live daemon PTY with cooked echo enabled and record exact shell-visible and provider-visible bytes.",
"Attach an intentional-break run proving reply overflow cannot evict ordinary input or exceed either ceiling.",
"Accumulate the normal soak window with zero unexplained flakes."
],
"knownGaps": [
"No live daemon, paired-runtime, WSL, physical Linux/Windows client, mixed-version, or network-fault run is registered.",
"Ordinary-input queue growth predates this change and is outside this reply-only gate.",
"Reply overload intentionally sheds the oldest synthetic replies; the modified-F3/CPR byte collision shares that budget, and live application behavior under a pathological query flood is not measured."
],
"demotionRule": "Keep experimental or revert if ordinary input is evicted, pending replies exceed either ceiling, retained replies are coalesced, a trailing key sits behind more than the bounded reply window, or the gate develops unexplained flakes."
},
{
"id": "terminal-query.mobile-view-authority",
"title": "Mobile xterm answers live terminal queries exactly once without replay or floor side effects",
"maturity": "experimental",
"protection": "partial",
"owner": "terminal-runtime",
"layer": "mobile-runtime-rpc-contract",
"surfaces": [
"mobile terminal WebView",
"terminal query authority",
"runtime RPC",
"mobile subscription replay",
"multi-mobile input floor"
],
"platforms": ["macos", "linux", "windows", "mobile"],
"providers": ["local", "daemon", "ssh", "remote-runtime"],
"coveredPlatforms": ["macos"],
"coveredProviders": [],
"coverageNotes": "Deterministic local tests execute the exact injected mobile replay/generation gate, the React Native query classifier, stale-subscription sender, server-side single-responder election, query-reply RPC semantics, and live-output capture during async mobile fit. The provider write path is shared, but no live iOS/Android, SSH, WSL, or multi-device run is registered yet.",
"motivatingLinks": [
"https://github.com/stablyai/orca/issues/8128",
"https://github.com/stablyai/orca/pull/8206"
],
"invariant": "Snapshot and replacement-terminal replay answer no terminal queries; every live query delivered to subscribed mobile views has at most one current responder; a live query queued behind replay is answered after the replay boundary; terminal-generated replies never transfer the user-input floor.",
"oracle": "The injected gate emits zero replies during replay, exactly one after its live boundary, and ignores a superseded generation; native routing rejects ordinary input; the sender rejects disconnected or unsubscribed handles; runtime election accepts only the earliest active mobile subscriber and promotes its survivor; terminal.send writes only validated query grammar without mobileTookFloor; legacy binary subscribe captures a query while phone-fit is still pending and emits it after the snapshot.",
"commands": [
"pnpm --dir mobile exec vitest run --root .. mobile/src/terminal/terminal-webview-query-reply.test.ts mobile/src/terminal/terminal-webview-query-reply-routing.test.ts mobile/src/terminal/mobile-terminal-query-reply.test.ts",
"pnpm exec vitest run --config config/vitest.config.ts src/main/runtime/rpc/terminal-send.test.ts src/main/runtime/rpc/terminal-subscribe-buffer.test.ts src/main/runtime/mobile-presence-lock.test.ts src/shared/terminal-query-reply.test.ts src/shared/terminal-reply-query-scan.test.ts",
"pnpm exec vitest run --config config/vitest.config.ts src/renderer/src/components/terminal-pane/pty-connection-terminal-input-gating.test.ts"
],
"testFiles": [
"mobile/src/terminal/terminal-webview-query-reply.test.ts",
"mobile/src/terminal/terminal-webview-query-reply-routing.test.ts",
"mobile/src/terminal/mobile-terminal-query-reply.test.ts",
"src/main/runtime/rpc/terminal-send.test.ts",
"src/main/runtime/rpc/terminal-subscribe-buffer.test.ts",
"src/main/runtime/mobile-presence-lock.test.ts",
"src/shared/terminal-query-reply.test.ts",
"src/shared/terminal-reply-query-scan.test.ts",
"src/renderer/src/components/terminal-pane/pty-connection-terminal-input-gating.test.ts"
],
"assertionRefs": [
{
"file": "mobile/src/terminal/terminal-webview-query-reply.test.ts",
"assertions": [
"snapshot replay emits no terminal-data message before the replay boundary",
"a live query after the boundary emits exactly one terminal-data message",
"a superseded terminal generation cannot regain reply authority",
"xterm parser replies remain enabled while its DOM textarea and hardware-key path stay inert"
]
},
{
"file": "src/main/runtime/rpc/terminal-send.test.ts",
"assertions": [
"only the elected mobile subscriber can write a claimed query reply",
"valid replies skip mobileTookFloor",
"ordinary bytes and reply payloads combined with enter, interrupt, or guarded-send semantics are rejected"
]
},
{
"file": "src/main/runtime/rpc/terminal-subscribe-buffer.test.ts",
"assertions": [
"live terminal data and view authority register before asynchronous mobile fit",
"a query received during that await is retained and emitted after the snapshot"
]
},
{
"file": "src/renderer/src/components/terminal-pane/pty-connection-terminal-input-gating.test.ts",
"assertions": [
"desktop xterm onData replies are dropped while mobile owns the terminal driver",
"desktop capability-handler replies outside onData honor the same mobile authority lock"
]
}
],
"evidenceRuns": [
{
"date": "2026-07-10",
"runner": "local",
"platform": "macos",
"command": "pnpm --dir mobile exec vitest run --root .. mobile/src/terminal/terminal-webview-query-reply.test.ts mobile/src/terminal/terminal-webview-query-reply-routing.test.ts mobile/src/terminal/mobile-terminal-query-reply.test.ts",
"result": "passed",
"durationSeconds": 1,
"summary": "10 mobile bridge, routing, replay/generation, and stale-subscription tests passed. Before implementation, the WebView listener, native route, and sender tests failed."
},
{
"date": "2026-07-10",
"runner": "local",
"platform": "macos",
"command": "pnpm exec vitest run --config config/vitest.config.ts src/main/runtime/rpc/terminal-send.test.ts src/main/runtime/rpc/terminal-subscribe-buffer.test.ts src/main/runtime/mobile-presence-lock.test.ts src/shared/terminal-query-reply.test.ts src/shared/terminal-reply-query-scan.test.ts",
"result": "passed",
"durationSeconds": 4,
"summary": "69 shared/runtime tests passed. Before implementation, terminal.send took the floor for claimed replies and accepted ordinary claimed bytes."
},
{
"date": "2026-07-10",
"runner": "local",
"platform": "macos",
"command": "pnpm exec vitest run --config config/vitest.config.ts src/renderer/src/components/terminal-pane/pty-connection-terminal-input-gating.test.ts",
"result": "passed",
"durationSeconds": 11,
"summary": "421 renderer terminal connection tests passed, including desktop onData and capability-handler suppression while mobile owns query authority."
}
],
"runtimeBudget": {
"p95Seconds": 20,
"scope": "mobile and runtime deterministic unit gate"
},
"flakeHistory": {
"status": "unknown",
"evidence": "New deterministic gate; no soak history yet. Tests use no timing sleeps or external services."
},
"redGreenEvidence": {
"status": "partial",
"evidence": "Observed red before implementation for the missing WebView listener/native route/sender and for RPC floor-taking plus unvalidated claims; all are green after the fix. The later multi-mobile and pre-fit race assertions have green deterministic coverage but no saved intentional-break artifact yet."
},
"performanceBudget": {
"required": true,
"evidence": "No polling, scans, timers, or output fanout were added. The WebView adds one disposable onData listener; native/RPC work occurs only for xterm data and is grammar-filtered; responder election is O(1) from Map insertion order; pre-fit output uses the existing capped pending-output queue."
},
"promotionCriteria": [
"Attach an intentional-break artifact for the pre-fit capture and multi-mobile election assertions.",
"Run live iOS and Android WebViews against a real querying TUI and verify no software-keyboard regression.",
"Exercise two physical/virtual mobile clients on one PTY and observe one reply per query.",
"Accumulate the normal soak window with zero unexplained flakes."
],
"knownGaps": [
"No live iOS or Android WebView run is registered.",
"No real SSH, WSL, daemon, or two-device provider-contract run is registered.",
"Mixed-version pairing is gated by the terminal.query-reply-input.v1 capability (mobile drops replies unless the host advertises it), but no live old-binary pairing run is registered.",
"A desktop-to-mobile driver handoff has a bounded double-reply window: the server elects the mobile responder synchronously while the desktop renderer's cached driver map updates via an async event, so an in-flight query can be answered by both until the driver-change event lands."
],
"demotionRule": "Keep experimental or disable mobile forwarding if the gate flakes without a product bug, live WebView input isolation regresses, or duplicate replies appear under multi-mobile use."
},
{
"id": "terminal-runtime.mobile-stream-budget",
"title": "Runtime and mobile terminal streams keep snapshot and live-output bytes bounded",
"maturity": "experimental",
"protection": "partial",
"owner": "terminal-runtime",
"layer": "runtime-rpc-contract",
"surfaces": [
"mobile terminal",
"native-chat terminal overlay",
"runtime RPC",
"binary multiplex",
"JSON subscribe fallback",
"snapshot buffering"
],
"platforms": ["macos", "linux", "windows", "mobile"],
"providers": ["remote-runtime", "ssh", "local", "daemon"],
"coveredPlatforms": ["macos"],
"coveredProviders": ["remote-runtime"],
"coverageNotes": "Local macOS evidence covers runtime-RPC stream budgets, paired-renderer parse/discard credit, and negotiated host-side suppression for hidden paired desktop panes. Deferred credit is shared by local and remote transports, batches ACKs at 192 KiB or 4 ms, grows per-stream windows from 512 KiB to 2 MiB and aggregate windows from 2 MiB to 8 MiB, bounds queued output to 256 KiB per stream, and caps each multiplex connection at 32 active or pending streams for an 8 MiB aggregate pending-output ceiling. Deterministic tests cover replay ordering, stale generations, malformed frames, hidden panes, queue eviction, disposal, send/recovery failure, repeated pending-slot replacement, reconnect, mixed-version pause negotiation, and round-robin fairness. The opt-in benchmark covers 1/20/100 ms RTT and 1/4/8 viewers, exact protocol-frame allocations, scheduler CPU, and measured @xterm/headless parser CPU/retained heap. Live Android restore evidence, browser/WebGL parser measurements, and legacy JSON subscribe parity remain required.",
"motivatingLinks": [
"https://github.com/stablyai/orca/pull/6951",
"https://github.com/stablyai/orca/pull/6955",
"https://github.com/stablyai/orca/pull/7009"
],
"invariant": "Runtime and mobile terminal subscriptions must cap initial snapshots, live output buffered while snapshots load, chunk sizes, batches, and aggregate in-flight credit. ACK means the renderer parsed the bytes or intentionally discarded them; receipt-time ACK is forbidden. A capability-negotiated hidden paired desktop stream must deliver zero raw output frames after host model ingestion, preserve side-effect facts, and restore from one authoritative snapshot before exact live output resumes. Every replay, stale-generation, malformed-frame, hidden-pane, eviction, disposal, error, and reconnect path must settle credit exactly once so streams neither leak memory nor stall. A terminal covered by native chat must restore from fresh scrollback when revealed, while preserving output order, input locks, resize/driver events, fairness, and safe mixed-version fallback.",
"oracle": "Assert mobile initial snapshots downgrade until they fit <=512KB, requested binary snapshots downgrade until they fit <=2MB, live output queued while snapshots load stays <=256KB per stream, large output splits into <=48KB frames, and output bursts coalesce. Pause three negotiated paired desktop streams, sustain output, and assert zero renderer frames; reveal one and assert one authoritative snapshot followed by exact live bytes with no loss or duplication. Prove old clients continue receiving output and new clients never send pause to old hosts. Feed paired output through the xterm parse callback and prove ACK is deferred until parse or intentional discard, then inject stale generation, malformed/transformed frames, replay failure, queue eviction, hidden panes, pane disposal, ACK send failure, recovery serialization failure, and reconnect races; assert ordered replay and exactly-once credit settlement. Fill the aggregate window across bulk and interactive streams, ACK once, and prove round-robin progress. Run the opt-in 64 MiB/viewer RTT matrix and enforce bounded 8 MiB aggregate in-flight memory, >7 MiB/s/viewer at 100 ms RTT, and <200 ms completion spread. JSON fallback parity and live Android scrollback restoration remain explicit gaps.",
"commands": [
"pnpm exec vitest run --config config/vitest.config.ts src/main/runtime/rpc/terminal-multiplex-snapshot-serialization.test.ts src/main/runtime/rpc/terminal-multiplex-ack-output-budget.test.ts src/main/runtime/rpc/terminal-multiplex-ack-overflow-recovery.test.ts src/main/runtime/rpc/terminal-multiplex-pty-wait-capacity.test.ts src/main/runtime/rpc/terminal-multiplex-output-pause-and-viewport.test.ts --maxWorkers=1",
"pnpm exec vitest run --config config/vitest.config.ts src/main/runtime/rpc/terminal-subscribe-buffer.test.ts src/main/runtime/rpc/terminal-output-batching.test.ts src/main/runtime/rpc/terminal-multiplex-snapshot-serialization.test.ts src/main/runtime/rpc/terminal-multiplex-ack-output-budget.test.ts src/main/runtime/rpc/terminal-multiplex-ack-overflow-recovery.test.ts src/main/runtime/rpc/terminal-multiplex-pty-wait-capacity.test.ts src/main/runtime/rpc/terminal-multiplex-output-pause-and-viewport.test.ts",
"pnpm exec vitest run --config config/vitest.config.ts src/main/runtime/rpc/terminal-subscribe-buffer.test.ts src/main/runtime/rpc/terminal-output-batching.test.ts src/main/runtime/rpc/terminal-multiplex-snapshot-serialization.test.ts src/main/runtime/rpc/terminal-multiplex-ack-output-budget.test.ts src/main/runtime/rpc/terminal-multiplex-ack-overflow-recovery.test.ts src/main/runtime/rpc/terminal-multiplex-pty-wait-capacity.test.ts src/main/runtime/rpc/terminal-multiplex-output-pause-and-viewport.test.ts src/renderer/src/components/terminal-pane/pty-connection-hidden-output-restore.test.ts src/renderer/src/components/terminal-pane/remote-runtime-pty-transport-stream-reconnect.test.ts src/renderer/src/components/terminal-pane/terminal-pty-ack-gate.test.ts src/renderer/src/lib/pane-manager/terminal-delivery-credit.test.ts src/renderer/src/runtime/remote-runtime-terminal-parse-backpressure.test.ts src/renderer/src/runtime/runtime-terminal-stream.test.ts --maxWorkers=1",
"ORCA_TERMINAL_PERF_BENCH=1 pnpm exec vitest run --config config/vitest.config.ts --disableConsoleIntercept src/main/runtime/rpc/terminal-multiplex-flow-control.bench.test.ts",
"pnpm --dir mobile exec vitest run --root .. mobile/src/session/mobile-native-chat-terminal-stream.test.ts",
"pnpm --dir mobile exec vitest run --root .. mobile/src/session/use-mobile-native-chat-terminal-stream.test.ts"
],
"testFiles": [
"src/main/runtime/rpc/terminal-subscribe-buffer.test.ts",
"src/main/runtime/rpc/terminal-output-batching.test.ts",
"src/main/runtime/rpc/terminal-multiplex-snapshot-serialization.test.ts",
"src/main/runtime/rpc/terminal-multiplex-ack-output-budget.test.ts",
"src/main/runtime/rpc/terminal-multiplex-ack-overflow-recovery.test.ts",
"src/main/runtime/rpc/terminal-multiplex-pty-wait-capacity.test.ts",
"src/main/runtime/rpc/terminal-multiplex-output-pause-and-viewport.test.ts",
"src/main/runtime/rpc/terminal-multiplex-flow-control.bench.test.ts",
"src/renderer/src/components/terminal-pane/pty-connection-hidden-output-restore.test.ts",
"src/renderer/src/components/terminal-pane/remote-runtime-pty-transport-stream-reconnect.test.ts",
"src/renderer/src/components/terminal-pane/terminal-pty-ack-gate.test.ts",
"src/renderer/src/lib/pane-manager/terminal-delivery-credit.test.ts",
"src/renderer/src/runtime/remote-runtime-terminal-parse-backpressure.test.ts",
"src/renderer/src/runtime/runtime-terminal-stream.test.ts",
"mobile/src/session/mobile-native-chat-terminal-stream.test.ts",
"mobile/src/session/use-mobile-native-chat-terminal-stream.test.ts"
],
"assertionRefs": [
{
"file": "src/main/runtime/rpc/terminal-subscribe-buffer.test.ts",
"assertions": [
"legacy binary output queued during initial snapshot serialization stays bounded",
"stale mobile resize re-stream completions are dropped for legacy binary streams",
"aborted stream signals do not register stale listeners"
]
},
{
"file": "src/main/runtime/rpc/terminal-output-batching.test.ts",
"assertions": [
"desktop output bursts coalesce before stream emission",
"large binary output is encoded lazily before the first output frame"
]
},
{
"file": "src/main/runtime/rpc/terminal-multiplex-snapshot-serialization.test.ts",
"assertions": [
"requested snapshots fall back smaller when serialized data exceeds the send budget"
]
},
{
"file": "src/main/runtime/rpc/terminal-multiplex-ack-output-budget.test.ts",
"assertions": [
"oversized live output frames are bounded for subscribed binary streams",
"multibyte live output flushes when encoded bytes reach the batch budget",
"adaptive credit grows only after ACK, stays globally bounded, and drains pending streams round-robin"
]
},
{
"file": "src/main/runtime/rpc/terminal-multiplex-ack-overflow-recovery.test.ts",
"assertions": [
"send and recovery serialization failures detach once instead of leaking credit or retrying forever"
]
},
{
"file": "src/main/runtime/rpc/terminal-multiplex-pty-wait-capacity.test.ts",
"assertions": [
"32 active or pending slots cap aggregate queued output and repeated pending-slot subscribe cancels its older waiter"
]
},
{
"file": "src/main/runtime/rpc/terminal-multiplex-output-pause-and-viewport.test.ts",
"assertions": [
"three negotiated hidden desktop streams emit zero output frames under sustained load while an unpaused stream remains live",
"an older client that omits pause negotiation continues receiving output"
]
},
{
"file": "src/renderer/src/components/terminal-pane/pty-connection-hidden-output-restore.test.ts",
"assertions": [
"a runtime-owned hidden pane pauses output, consumes status/title/theme facts, and keeps input writable",
"reveal resumes before one authoritative snapshot and exact live output with no hidden raw write, loss, or duplication",
"dispose releases pause and unregisters the fact consumer"
]
},
{
"file": "src/renderer/src/components/terminal-pane/remote-runtime-pty-transport-stream-reconnect.test.ts",
"assertions": [
"desired pause reapplies after either capability/snapshot ordering and across reconnect",
"reconnect delivers each authoritative snapshot and post-resume live marker exactly once"
]
},
{
"file": "src/renderer/src/lib/pane-manager/terminal-delivery-credit.test.ts",
"assertions": [
"nested synchronous deliveries restore the outer credit owner",
"unclaimed intentional discards settle automatically while every claimed scheduler child must settle before the parent credits"
]
},
{
"file": "src/renderer/src/runtime/remote-runtime-terminal-parse-backpressure.test.ts",
"assertions": [
"paired renderer ACK waits for xterm parse completion or explicit discard",
"192 KiB parsed output batches into one ACK while the 4 ms timer releases interactive output",
"malformed frames, malformed transformed output, disposal, late parse, renderer delivery failure, and ACK transport failure release credit or close the owning stream without reordering output"
]
},
{
"file": "src/renderer/src/runtime/runtime-terminal-stream.test.ts",
"assertions": [
"drops output only from the armed stream when its replacement reuses the stream ID"
]
},
{
"file": "src/main/runtime/rpc/terminal-multiplex-flow-control.bench.test.ts",
"assertions": [
"one through eight viewers stay within the 8 MiB aggregate adaptive window",
"the 100 ms RTT model sustains more than 7 MiB/s per viewer with less than 200 ms fairness spread",
"the opt-in benchmark reports RTT throughput, scheduler CPU time, exact protocol frame allocations, completion spread, and measured @xterm/headless parser CPU and retained heap"
]
},
{
"file": "mobile/src/session/mobile-native-chat-terminal-stream.test.ts",
"assertions": [
"an active terminal stream pauses while native chat covers its WebView",
"the stream resumes only for the ready active terminal after chat closes",
"non-terminal and already-settled stream states perform no lifecycle work"
]
},
{
"file": "mobile/src/session/use-mobile-native-chat-terminal-stream.test.ts",
"assertions": [
"a late WebView-ready transition converts a cold-start lease-only stream back to output",
"ordinary WebView readiness does not rerender the mobile session route"
]
}
],
"evidenceRuns": [
{
"date": "2026-07-03",
"runner": "local",
"platform": "macos",
"command": "pnpm exec vitest run --config config/vitest.config.ts src/main/runtime/rpc/terminal-subscribe-buffer.test.ts src/main/runtime/rpc/terminal-output-batching.test.ts src/main/runtime/rpc/terminal-multiplex-snapshot-serialization.test.ts src/main/runtime/rpc/terminal-multiplex-ack-output-budget.test.ts src/main/runtime/rpc/terminal-multiplex-ack-overflow-recovery.test.ts src/main/runtime/rpc/terminal-multiplex-pty-wait-capacity.test.ts src/main/runtime/rpc/terminal-multiplex-output-pause-and-viewport.test.ts",
"result": "passed",
"durationSeconds": 3.8,
"summary": "3 test file(s) passed, 28 tests passed on main@1282f5c2d in a clean checkout."
},
{
"date": "2026-07-12",
"runner": "local",
"platform": "macos",
"command": "pnpm --dir mobile exec vitest run --root .. mobile/src/session/mobile-native-chat-terminal-stream.test.ts",
"result": "passed",
"durationSeconds": 0.2,
"summary": "The focused mobile native-chat suite passed with 3 terminal-stream lifecycle assertions in the staged PR #5824 worktree."
},
{
"date": "2026-07-22",
"runner": "local",
"platform": "macos",
"command": "ORCA_TERMINAL_PERF_BENCH=1 pnpm exec vitest run --config config/vitest.config.ts --disableConsoleIntercept src/main/runtime/rpc/terminal-multiplex-flow-control.bench.test.ts",
"result": "passed",
"durationSeconds": 0.91,
"summary": "The 1/20/100 ms RTT x 1/4/8 viewer matrix stayed at or below 8 MiB in flight with zero completion spread. At 100 ms it modeled 18.8 MiB/s per viewer for 1-4 viewers and 9.7 MiB/s for 8 viewers. Measured @xterm/headless parsing was 26.7/63.6/95.3 aggregate MiB/s for 1/4/8 viewers, with 84.4/236.5/336.0 ms CPU and 2893/13409/28991 KiB retained heap for 4 MiB per viewer."
},
{
"date": "2026-07-30",
"runner": "local",
"platform": "macos",
"command": "pnpm exec vitest run --config config/vitest.config.ts src/main/runtime/rpc/terminal-multiplex-snapshot-serialization.test.ts src/main/runtime/rpc/terminal-multiplex-ack-output-budget.test.ts src/main/runtime/rpc/terminal-multiplex-ack-overflow-recovery.test.ts src/main/runtime/rpc/terminal-multiplex-pty-wait-capacity.test.ts src/main/runtime/rpc/terminal-multiplex-output-pause-and-viewport.test.ts --maxWorkers=1",
"result": "passed",
"durationSeconds": 9.05,
"summary": "All 58 terminal multiplex tests passed, including the three-stream hidden-output oracle. Its byte-identical title-selected command failed on current origin/main and failed again with the two causal host/protocol files reverted because hidden Output frames reached the renderer."
}
],
"runtimeBudget": {
"p95Seconds": 20,
"scope": "runtime RPC contract test"
},
"flakeHistory": {
"status": "unknown",
"evidence": "Focused runtime RPC contract tests passed locally on 2026-07-02; needs soak history before promotion."
},
"redGreenEvidence": {
"status": "partial",
"evidence": "The hidden paired-output oracle is red on origin/main, green on the candidate, and red with its causal host/protocol files reverted. It proves three paused streams emit no raw frames while an unpaused control remains live; compatibility tests preserve old-client/new-host output and prevent new-client/old-host pause opcodes. The broader gate remains partial pending legacy JSON fallback and live Android coverage."
},
"performanceBudget": {
"required": true,
"evidence": "Parsed/discarded credit uses 192 KiB/4 ms ACK batching, 512 KiB-to-2 MiB adaptive per-stream windows, a 2 MiB-to-8 MiB aggregate window, <=48 KiB output frames, <=256 KiB queued output per stream, and <=32 streams per connection (8 MiB aggregate pending output). Negotiated hidden paired streams add zero renderer output frames or scheduler drains after host ingestion; headed and headless six-stream runs enforce under 500 ms timer lag. The 64 MiB/viewer model gate requires >7 MiB/s/viewer at 100 ms RTT, <200 ms completion spread, and aggregate in-flight bytes <=8 MiB."
},
"promotionCriteria": [
"Gate binary multiplex first.",
"Decide whether JSON fallback is supported, gated, or deprecated.",
"Record byte counts and order/cursor artifacts on failure."
],
"knownGaps": [
"The pure mobile decision gate does not yet prove live Android WebView scrollback restore after a chat toggle.",
"Legacy JSON subscribe parity is undecided.",
"The parser measurement uses @xterm/headless; browser renderer/WebGL CPU, GPU, and allocation behavior still need packaged-app performance evidence."
],
"demotionRule": "Cannot promote while a supported stream path has uncapped snapshot or live-output buffering."
},
{
"id": "terminal-mirror.parser-parity",
"title": "Renderer xterm and main headless mirror parse identical bytes into identical cells",
"maturity": "experimental",
"protection": "partial",
"owner": "terminal-rendering",
"layer": "renderer-main-parity-contract",
"surfaces": [
"main mirror buffer",
"snapshot restore",
"terminal reads",
"mobile streams",
"unicode width",
"parser configuration"
],
"platforms": ["macos", "linux", "windows"],
"providers": ["local", "daemon", "ssh", "remote-runtime"],
"coveredPlatforms": ["macos"],
"coveredProviders": [],
"coverageNotes": "Local macOS evidence over #7148's width-parity oracle on main@1282f5c2d. A broader byte corpus, a shared parser-construction assertion over terminal-unicode-provider.ts/pane-terminal-options.ts, and recorded agent-session corpora remain gaps.",
"motivatingLinks": [
"https://github.com/stablyai/orca/pull/7148",
"https://github.com/stablyai/orca/pull/7133"
],
"invariant": "The main-process headless terminal mirror and the renderer xterm must parse identical byte streams into cell-identical buffers (unicode width tables, joining behavior, modes, and addon-visible semantics), so snapshots, restores, reads, and mobile streams never encode a frame the renderer would not have produced.",
"oracle": "Feed identical byte corpora (emoji/ZWJ/wide glyphs, positioned overwrites after wide characters, alternate-screen transitions, wrapped lines) to both parser configurations and assert cell-identical visible buffers; both parsers must be constructed from one shared configuration module so one-sided drift fails the gate.",
"commands": [
"pnpm exec vitest run --config config/vitest.config.ts src/main/daemon/headless-emulator-unicode-width.test.ts"
],
"testFiles": ["src/main/daemon/headless-emulator-unicode-width.test.ts"],
"assertionRefs": [
{
"file": "src/main/daemon/headless-emulator-unicode-width.test.ts",
"assertions": [
"emoji advance two cells in the headless mirror so positioned writes land like the renderer (#7148)",
"ZWJ emoji join into one wide pair like the renderer provider (#7148)"
]
}
],
"evidenceRuns": [
{
"date": "2026-07-03",
"runner": "local",
"platform": "macos",
"command": "pnpm exec vitest run --config config/vitest.config.ts src/main/daemon/headless-emulator-unicode-width.test.ts",
"result": "passed",
"durationSeconds": 0.7,
"summary": "1 test file(s) passed, 2 tests passed on main@1282f5c2d in a clean checkout."
}
],
"runtimeBudget": {
"p95Seconds": 30,
"scope": "shared parser-parity unit gate"
},
"flakeHistory": {
"status": "not-started",
"evidence": "Deterministic unit-layer corpus; no timing dependence expected."
},
"redGreenEvidence": {
"status": "partial",
"evidence": "#7148 proved this red before its fix (positioned overwrite after emoji landed shifted in the mirror). Intentional-drift proof for the shared provider is still missing."
},
"performanceBudget": {
"required": true,
"evidence": "Shared parser construction must not add renderer or emulator startup cost; the corpus stays a bounded unit fixture."
},
"promotionCriteria": [
"Register #7148's merged width test (src/main/daemon/headless-emulator-unicode-width.test.ts) plus a shared-construction assertion over src/shared/terminal-unicode-provider.ts and pane-terminal-options.ts as the first command during the stack rebase.",
"Extend the corpus with recorded real agent-session byte streams.",
"Promote only on aggregated reliability-gates CI history."
],
"knownGaps": [
"No manifest command yet; the seed test exists on fresh main but not at this branch's merge-base.",
"Width parity is protected only by #7148's single test; no broader corpus or shared-construction assertion covers the other parser-config axes.",
"Corpus does not yet include recorded live agent sessions.",
"Parity at identical configuration cannot catch state-synchronization divergence such as #7192's stale-width mirror; geometry fan-out and reflow ordering are owned by terminal-geometry.visible-convergence."
],
"demotionRule": "Cannot promote without cell-exact parity assertions over a wide-glyph corpus and shared-construction proof."
},
{
"id": "terminal-observability.restore-convergence-selfcheck",
"title": "Post-restore convergence self-check flags renderer/mirror divergence as an anomaly",
"maturity": "experimental",
"protection": "none",
"owner": "terminal-rendering",
"layer": "renderer-observability",
"surfaces": ["hidden-output restore", "snapshot replay", "anomaly breadcrumbs", "telemetry"],
"platforms": ["macos", "linux", "windows"],
"providers": ["local", "daemon", "ssh", "remote-runtime"],
"coveredPlatforms": [],
"coveredProviders": [],
"coverageNotes": "Registered gap only; the anomaly-breadcrumb machinery exists in this branch but no convergence probe is implemented.",
"motivatingLinks": [
"https://github.com/stablyai/orca/pull/7133",
"https://github.com/stablyai/orca/pull/7054"
],
"invariant": "After every hidden-to-visible reveal settles — whether or not a restore was triggered — the renderer buffer must converge with the current main-mirror state; divergence is recorded as a compact, content-free terminal_lifecycle_anomaly breadcrumb and counted in telemetry instead of failing silently. Restore-scoped checking is insufficient: #7173's frozen-output variant restores faithfully and then silently drops later hidden output, so it never triggers another restore.",
"oracle": "Deterministic tests inject forced divergence in both shapes — stale bytes written after a faithful restore, and a frozen pane whose reveal triggers no restore — and assert exactly one deduped breadcrumb with row-hash evidence and no terminal content; the production probe is a bounded row-hash sample comparison against current mirror rows that runs once per reveal with no polling and a strict time budget.",
"commands": [],
"testFiles": [],
"assertionRefs": [],
"evidenceRuns": [],
"runtimeBudget": {
"p95Seconds": 30,
"scope": "renderer observability unit gate"
},
"flakeHistory": {
"status": "not-started",
"evidence": "Probe and tests not yet implemented."
},
"redGreenEvidence": {
"status": "missing",
"evidence": "Needs an intentionally divergent restore fixture proving the probe fires, dedupes, and stays silent on faithful restores."
},
"performanceBudget": {
"required": true,
"evidence": "One bounded comparison per reveal; no polling, no hot-path work, no content serialization beyond hashed row samples."
},
"promotionCriteria": [
"Prove the probe is content-free and privacy-safe (hashes and indices only).",
"Prove zero false positives across the existing restore test corpus before enabling telemetry counting.",
"Watch anomaly telemetry after each terminal release as the in-production regression signal."
],
"knownGaps": [
"No manifest command yet.",
"Probe not implemented; #7133-class and #7173-class corruption is currently silent in production.",
"Pixel-level divergence is out of scope for this probe (see terminal-render.pixel-refresh-repair).",
"Renderer-vs-mirror comparison cannot see corruption upstream of the mirror itself (#7192's stale-width mirror); mirror-vs-PTY truth is owned by terminal-geometry.visible-convergence."
],
"demotionRule": "Disable the probe if it exceeds its per-reveal budget or produces false-positive anomaly noise."
},
{
"id": "terminal-render.atlas-recovery-fanout",
"title": "Ordinary terminal output avoids shared atlas recovery fanout",
"maturity": "experimental",
"protection": "partial",
"owner": "terminal-rendering",
"layer": "renderer-unit-and-electron",
"surfaces": [
"WebGL rendering",
"document visibility",
"hidden terminal output",
"alternate-screen redraws",
"paired terminal traffic"
],
"platforms": ["macos", "linux", "windows"],
"providers": ["local", "daemon", "ssh", "remote-runtime"],
"coveredPlatforms": ["macos"],
"coveredProviders": ["local"],
"coverageNotes": "Deterministic renderer contracts require foreground renderer-risk, synchronized, hidden, and alternate-screen PTY output to stay on pane-local repaint paths without a global atlas reset. Separate contracts preserve explicit paste, reveal, visibility-resume, system-resume, and confirmed-desync recovery. A macOS Electron run verifies that a document visibility cycle preserves real WebGL atlases and terminal pixels; the candidate has not been rerun against an isolated live paired server.",
"motivatingLinks": [
"https://github.com/stablyai/orca/pull/7054",
"https://github.com/stablyai/orca/pull/7604",
"https://github.com/stablyai/orca/issues/12094"
],
"invariant": "Ordinary PTY output must never clear the shared WebGL glyph atlas, including synchronized frames, hidden output, renderer-risk glyphs, and alternate-screen entry, redraw, or exit. Affected visible panes still receive pane-local refresh after parsing. Explicit paste, reveal, visibility-resume, system-resume, context-loss, and confirmed-desync recovery remain available and may reset visible renderers.",
"oracle": "Parse foreground renderer-risk, synchronized, hidden, and alternate-screen PTY output and require pane-local refresh where needed with zero calls to shared reset-and-refresh recovery. Require the atlas-recovery module to expose only explicit lifecycle entry points, then verify paste and tab reveal still perform their recovery bursts. Dispatch a visible document visibilitychange and require atlas-preserving wake recovery; register one visible manager and 64 hidden managers and require heavy recovery to reset and refresh only the visible manager. Separately, drive an Electron visibility cycle with two real WebGL panes, require zero atlas clears, and retain at least 85% of each pane's baseline ink pixels.",
"commands": [
"pnpm exec vitest run --config config/vitest.config.ts src/renderer/src/components/terminal-pane/use-terminal-window-wake-recovery.test.ts src/renderer/src/components/terminal-pane/use-terminal-pane-global-effects-window-focus-recovery.test.ts src/renderer/src/components/terminal-pane/terminal-webgl-atlas-recovery.test.ts src/renderer/src/lib/pane-manager/pane-manager-registry.test.ts src/renderer/src/components/terminal-pane/terminal-render-desync-sentinel.test.ts src/renderer/src/lib/pane-manager/pane-webgl-context-recovery.test.ts src/renderer/src/components/terminal-pane/pty-connection-hidden-atlas-recovery.test.ts src/renderer/src/components/terminal-pane/pty-connection-renderer-risk-repaint.test.ts",
"pnpm run ensure:electron-runtime && pnpm exec playwright test tests/e2e/terminal-document-visibility-webgl-recovery.spec.ts --config tests/playwright.config.ts --project electron-headless --workers=1",
"pnpm run ensure:electron-runtime && pnpm exec playwright test tests/e2e/terminal-document-visibility-webgl-recovery.spec.ts --config tests/playwright.config.ts --project electron-headful --workers=1"
],
"testFiles": [
"src/renderer/src/components/terminal-pane/use-terminal-window-wake-recovery.test.ts",
"src/renderer/src/components/terminal-pane/use-terminal-pane-global-effects-window-focus-recovery.test.ts",
"src/renderer/src/components/terminal-pane/terminal-webgl-atlas-recovery.test.ts",
"src/renderer/src/lib/pane-manager/pane-manager-registry.test.ts",
"src/renderer/src/components/terminal-pane/terminal-render-desync-sentinel.test.ts",
"src/renderer/src/lib/pane-manager/pane-webgl-context-recovery.test.ts",
"src/renderer/src/components/terminal-pane/pty-connection-hidden-atlas-recovery.test.ts",
"src/renderer/src/components/terminal-pane/pty-connection-renderer-risk-repaint.test.ts",
"tests/e2e/terminal-document-visibility-webgl-recovery.spec.ts"
],
"assertionRefs": [
{
"file": "src/renderer/src/components/terminal-pane/use-terminal-window-wake-recovery.test.ts",
"assertions": ["preserves the glyph atlas when a fullscreen Space becomes visible"]
},
{
"file": "src/renderer/src/components/terminal-pane/use-terminal-pane-global-effects-window-focus-recovery.test.ts",
"assertions": [
"preserves WebGL texture atlases when the active terminal document becomes visible"
]
},
{
"file": "src/renderer/src/components/terminal-pane/terminal-webgl-atlas-recovery.test.ts",
"assertions": ["limits atlas recovery to explicit renderer lifecycle events"]
},
{
"file": "src/renderer/src/lib/pane-manager/pane-manager-registry.test.ts",
"assertions": ["bounds atlas recovery to visible managers"]
},
{
"file": "src/renderer/src/components/terminal-pane/terminal-render-desync-sentinel.test.ts",
"assertions": ["persists and recovers after the same cells stay missing twice"]
},
{
"file": "src/renderer/src/lib/pane-manager/pane-webgl-context-recovery.test.ts",
"assertions": ["recovers a context-lost pane on the next rendering resume"]
},
{
"file": "src/renderer/src/components/terminal-pane/pty-connection-hidden-atlas-recovery.test.ts",
"assertions": ["keeps hidden synchronized output off the global atlas recovery path"]
},
{
"file": "src/renderer/src/components/terminal-pane/pty-connection-renderer-risk-repaint.test.ts",
"assertions": [
"refreshes renderer-risk output without clearing the shared glyph atlas",
"refreshes alternate-screen redraws without clearing the shared glyph atlas",
"avoids atlas clears when one chunk enters and exits alternate screen"
]
},
{
"file": "tests/e2e/terminal-document-visibility-webgl-recovery.spec.ts",
"assertions": [
"preserves the WebGL atlas and keeps terminal text painted after document visibility resumes"
]
}
],
"evidenceRuns": [
{
"date": "2026-08-10",
"runner": "local",
"platform": "macos",
"command": "pnpm exec vitest run --config config/vitest.config.ts src/renderer/src/components/terminal-pane/use-terminal-window-wake-recovery.test.ts src/renderer/src/components/terminal-pane/use-terminal-pane-global-effects-window-focus-recovery.test.ts src/renderer/src/components/terminal-pane/terminal-webgl-atlas-recovery.test.ts src/renderer/src/lib/pane-manager/pane-manager-registry.test.ts src/renderer/src/components/terminal-pane/terminal-render-desync-sentinel.test.ts src/renderer/src/lib/pane-manager/pane-webgl-context-recovery.test.ts src/renderer/src/components/terminal-pane/pty-connection-hidden-atlas-recovery.test.ts src/renderer/src/components/terminal-pane/pty-connection-renderer-risk-repaint.test.ts",
"result": "passed",
"durationSeconds": 47,
"summary": "All 625 focused renderer contracts passed on the final head for atlas-preserving visibility, visible-only heavy recovery fanout, confirmed-desync and context-loss recovery, explicit lifecycle recovery, pane-local foreground redraws, and zero ordinary-output atlas resets."
},
{
"date": "2026-08-01",
"runner": "local",
"platform": "macos",
"command": "pnpm run ensure:electron-runtime && pnpm exec playwright test tests/e2e/terminal-document-visibility-webgl-recovery.spec.ts --config tests/playwright.config.ts --project electron-headless --workers=1",
"result": "passed",
"durationSeconds": 18,
"summary": "The changed-spec CI topology retained both real WebGL terminal panes with zero atlas clears after a deterministic document visibility cycle."
},
{
"date": "2026-08-01",
"runner": "local",
"platform": "macos",
"command": "pnpm run ensure:electron-runtime && pnpm exec playwright test tests/e2e/terminal-document-visibility-webgl-recovery.spec.ts --config tests/playwright.config.ts --project electron-headful --workers=1",
"result": "passed",
"durationSeconds": 23,
"summary": "Two real WebGL terminal panes retained painted glyphs with zero atlas clears after a deterministic document visibility cycle. BrowserWindow.hide did not change document visibility in the harness, so the test used its explicit visibility-event fallback."
}
],
"runtimeBudget": {
"p95Seconds": 60,
"scope": "focused renderer contracts plus one prebuilt Electron visibility test"
},
"flakeHistory": {
"status": "unknown",
"evidence": "The focused unit oracle and one local Electron run passed; CI soak history is not yet available."
},
"redGreenEvidence": {
"status": "complete",
"evidence": "Before the change, foreground renderer-risk and alternate-screen PTY writes requested terminal-output atlas recovery after parsing; hidden synchronized/TUI output also drove the same path. The updated oracle spies on that request before its removed 200ms debounce and on the eventual shared reset, while explicit lifecycle recovery remains required."
},
"performanceBudget": {
"required": true,
"evidence": "A 120-frame foreground redraw at 300ms cadence produced 13 terminal-output atlas reset cycles before the change and zero afterward over 37.470 seconds. Ordinary PTY output now adds no atlas debounce, retry timer, buffer-switch listener, global manager traversal, provider call, or recurring work; pane-local refresh remains for renderer-risk output. Explicit heavy recovery still touches visible managers only."
},
"promotionCriteria": [
"Accumulate stable macOS Electron runs with real BrowserWindow visibility transitions.",
"Run an isolated headed paired-server terminal flood and verify renderer CPU and atlas diagnostics remain flat under ordinary output.",
"Add Linux and Windows WebGL visibility evidence before claiming cross-platform visual coverage."
],
"knownGaps": [
"The Electron harness used a deterministic visibility-event fallback because BrowserWindow.hide did not change document.visibilityState.",
"No isolated live paired-server candidate run is recorded; remote-runtime coverage is a provider-agnostic renderer contract plus production incident evidence.",
"The gate counts recovery fanout and pixel retention but does not impose an end-to-end renderer frame-latency threshold."
],
"demotionRule": "Demote if ordinary PTY output re-enters shared reset/refresh recovery, pane-local redraw coverage regresses, ordinary visibility clears the atlas, real WebGL pixels regress, or the focused Electron test cannot remain deterministic."
},
{
"id": "terminal-render.atlas-identity-invalidation",
"title": "A WebGL atlas identity change rebuilds cached glyph vertices",
"maturity": "experimental",
"protection": "partial",
"owner": "terminal-rendering",
"layer": "electron-visual-golden",
"surfaces": ["WebGL rendering", "shared glyph atlas", "render model"],
"platforms": ["macos", "linux", "windows"],
"providers": ["local", "daemon", "ssh", "remote-runtime"],
"coveredPlatforms": ["macos"],
"coveredProviders": [],
"coverageNotes": "A deterministic macOS Electron test uses two real WebGL terminals with distinct atlas populations, attaches one renderer to the other's atlas, and compares its pixels before and after rendering. Provider paths are unaffected because atlas ownership is renderer-local; Linux and Windows GPU evidence remains pending.",
"motivatingLinks": ["https://github.com/stablyai/orca/pull/8899"],
"invariant": "Whenever GlyphRenderer attaches a different shared atlas, every cached glyph vertex is rebuilt before the next draw even if the old and new atlases have the same clear-model generation.",
"oracle": "Render terminal A and capture its non-empty canvas, populate terminal B with a distinct atlas, attach A's glyph renderer to B's atlas without changing A's buffer, render A again, and require byte-equivalent visible pixels. Also require the atlas identities to differ so the test cannot pass without exercising the transition.",
"commands": [
"pnpm run ensure:electron-runtime && pnpm exec playwright test tests/e2e/terminal-webgl-atlas-budget.spec.ts --config tests/playwright.config.ts --project electron-headless --workers=1"
],
"testFiles": ["tests/e2e/terminal-webgl-atlas-budget.spec.ts"],
"assertionRefs": [
{
"file": "tests/e2e/terminal-webgl-atlas-budget.spec.ts",
"assertions": [
"the replacement scenario uses distinct atlas identities and renders a non-empty baseline",
"attaching the replacement atlas leaves zero pixels different from the same terminal buffer's baseline"
]
}
],
"evidenceRuns": [
{
"date": "2026-07-17",
"runner": "local",
"platform": "macos",
"command": "pnpm run ensure:electron-runtime && pnpm exec playwright test tests/e2e/terminal-webgl-atlas-budget.spec.ts --config tests/playwright.config.ts --project electron-headless --workers=1",
"result": "passed",
"durationSeconds": 44,
"summary": "Both real-WebGL scenarios passed. The atlas-replacement case changed 327,165 pixels with the old generation adoption and zero pixels after identity invalidation."
}
],
"runtimeBudget": {
"p95Seconds": 180,
"scope": "fresh E2E build plus two real-WebGL atlas tests"
},
"flakeHistory": {
"status": "unknown",
"evidence": "The focused local macOS run and the PR's macOS golden experiment job passed. The Linux golden job skipped both WebGL atlas tests because WebGL was unavailable; soak history is not yet available."
},
"redGreenEvidence": {
"status": "complete",
"evidence": "The old setAtlas behavior deterministically changed 327,165 pixels after replacement; setting the last-seen generation to an invalid value on identity change produced zero changed pixels."
},
"performanceBudget": {
"required": true,
"evidence": "The added work is one existing full-model rebuild only when atlas object identity changes; ordinary frames and repeated setAtlas calls with the same object take the existing path. The field sentinel remains off by default, samples only a modifier-clicked pane in a bounded ten-second burst, reuses and releases one readback canvas, and caps renderer and disk evidence."
},
"promotionCriteria": [
"Accumulate stable macOS and Linux GPU runs across the release golden suite.",
"Add Windows GPU evidence or retain the platform gap explicitly.",
"Remove the flag-gated field sentinel after the confirmation window while keeping this pixel regression."
],
"knownGaps": [
"The historical field capture predates renderer-internal atlas identity diagnostics, so it cannot prove this exact transition retrospectively.",
"The deterministic test drives the renderer transition directly rather than reproducing the original Cmd/Ctrl-click lifecycle trigger.",
"Windows GPU evidence is not yet recorded."
],
"demotionRule": "Keep experimental or demote to protection none if GPU skips hide the transition, the pixel oracle flakes across stable runners, or the test no longer fails with generation adoption restored."
},
{
"id": "terminal-render.pixel-refresh-repair",
"title": "Forced repaint does not change revealed pane pixels",
"maturity": "experimental",
"protection": "partial",
"owner": "terminal-rendering",
"layer": "electron-visual-golden",
"surfaces": [
"WebGL rendering",
"tab reveal",
"worktree resume",
"window wake",
"render model"
],
"platforms": ["macos", "linux", "windows"],
"providers": ["local", "daemon"],
"coveredPlatforms": ["macos"],
"coveredProviders": ["local"],
"coverageNotes": "A headed macOS Electron test drives explicit destructive atlas recovery while DEC 2026 output is held, then compares compositor screenshots before and after a direct full-buffer present. The same renderer choreography is provider-local, but daemon, SSH, remote-runtime, Linux, and Windows GPU runs remain gaps.",
"motivatingLinks": [
"https://github.com/stablyai/orca/pull/7133",
"https://github.com/stablyai/orca/pull/7054"
],
"invariant": "After proven renderer damage triggers destructive recovery, visible pixels equal a full model-invalidating present of the current buffer.",
"oracle": "Hold DEC 2026, invoke explicit atlas recovery, require an atlas clear, screenshot the pane, force a direct renderer present, and assert the bounded pixel diff is immaterial. Compositor screenshots only, because WebGL canvas readback is blank with preserveDrawingBuffer disabled.",
"commands": [
"pnpm run ensure:electron-runtime && pnpm exec playwright test tests/e2e/terminal-reveal-paused-render-repro.spec.ts --config tests/playwright.config.ts --project electron-headful --workers=1",
"pnpm exec vitest run --config config/vitest.config.ts src/renderer/src/components/terminal-pane/pty-connection-hidden-backlog-snapshot.test.ts src/renderer/src/components/terminal-pane/terminal-visibility-resume.test.ts src/renderer/src/components/terminal-pane/use-terminal-window-wake-recovery.test.ts src/renderer/src/lib/pane-manager/pane-manager-registry.test.ts src/renderer/src/lib/pane-manager/pane-webgl-renderer.test.ts src/renderer/src/lib/pane-manager/terminal-canvas-dpr-repair.test.ts src/renderer/src/lib/pane-manager/terminal-render-pause-release.test.ts",
"ORCA_E2E_RECORD_VIDEO=1 pnpm exec playwright test tests/e2e/terminal-reveal-paused-render-repro.spec.ts --config tests/playwright.config.ts --project electron-headful --workers=1 --repeat-each=3"
],
"testFiles": [
"src/renderer/src/components/terminal-pane/pty-connection-hidden-backlog-snapshot.test.ts",
"src/renderer/src/components/terminal-pane/terminal-visibility-resume.test.ts",
"src/renderer/src/components/terminal-pane/use-terminal-window-wake-recovery.test.ts",
"src/renderer/src/lib/pane-manager/pane-manager-registry.test.ts",
"src/renderer/src/lib/pane-manager/pane-webgl-renderer.test.ts",
"src/renderer/src/lib/pane-manager/terminal-canvas-dpr-repair.test.ts",
"src/renderer/src/lib/pane-manager/terminal-render-pause-release.test.ts",
"tests/e2e/terminal-reveal-paused-render-repro.spec.ts"
],
"assertionRefs": [
{
"file": "src/renderer/src/components/terminal-pane/use-terminal-window-wake-recovery.test.ts",
"assertions": [
"deduplicates a deferred dpr retry and consumes it after repair succeeds",
"caps a deferred dpr transition at sixteen animation-frame retries"
]
},
{
"file": "src/renderer/src/components/terminal-pane/terminal-visibility-resume.test.ts",
"assertions": ["defers a heavy-reveal dpr present until the shared atlas recovery"]
},
{
"file": "src/renderer/src/lib/pane-manager/terminal-canvas-dpr-repair.test.ts",
"assertions": [
"repairs when the canvas and renderer dimensions share a stale dpr cache",
"defers an unmeasurable WebGL canvas but accepts a renderer-less pane"
]
},
{
"file": "tests/e2e/terminal-reveal-paused-render-repro.spec.ts",
"assertions": ["@headful atlas recovery presents a synchronized-output WebGL frame"]
}
],
"evidenceRuns": [
{
"date": "2026-08-23",
"runner": "local",
"platform": "macos",
"command": "pnpm exec vitest run --config config/vitest.config.ts src/renderer/src/components/terminal-pane/pty-connection-hidden-backlog-snapshot.test.ts src/renderer/src/components/terminal-pane/terminal-visibility-resume.test.ts src/renderer/src/components/terminal-pane/use-terminal-window-wake-recovery.test.ts src/renderer/src/lib/pane-manager/pane-manager-registry.test.ts src/renderer/src/lib/pane-manager/pane-webgl-renderer.test.ts src/renderer/src/lib/pane-manager/terminal-canvas-dpr-repair.test.ts src/renderer/src/lib/pane-manager/terminal-render-pause-release.test.ts",
"result": "passed",
"durationSeconds": 2,
"summary": "All 98 renderer contracts passed, including same-DPR zero-scan behavior, visible-only fanout, tri-state DPR repair, deduplicated bounded retry, heavy-reveal repair, and listener cleanup."
},
{
"date": "2026-08-23",
"runner": "local",
"platform": "macos",
"command": "pnpm run ensure:electron-runtime && pnpm exec playwright test tests/e2e/terminal-reveal-paused-render-repro.spec.ts --config tests/playwright.config.ts --project electron-headful --workers=1",
"result": "passed",
"durationSeconds": 60,
"summary": "Both headed oracles passed together. Explicit destructive atlas recovery presented the held synchronized-output buffer with zero pixels different from a direct renderer present; the test attached before/after screenshots plus pixel-diff metadata."
},
{
"date": "2026-08-22",
"runner": "local",
"platform": "macos",
"command": "ORCA_E2E_RECORD_VIDEO=1 pnpm exec playwright test tests/e2e/terminal-reveal-paused-render-repro.spec.ts --config tests/playwright.config.ts --project electron-headful --workers=1 --repeat-each=3",
"result": "passed",
"durationSeconds": 48,
"summary": "Three consecutive headed real-WebGL runs passed in 15.0-15.7 seconds each and emitted a 1920x1080 video per BrowserWindow."
}
],
"runtimeBudget": {
"p95Seconds": 120,
"scope": "focused prebuilt headed Electron visual test"
},
"flakeHistory": {
"status": "unknown",
"evidence": "Five local macOS headed runs passed, including one on the final branch state and three consecutive video-recorded repeats; CI soak history and cross-platform GPU runs are not yet available."
},
"redGreenEvidence": {
"status": "complete",
"evidence": "Without the forced synchronized-output present, the damaged compositor differed from a direct renderer present across 87.68% of pixels even though serialization already contained the new frame. With explicit destructive recovery, the same oracle passes the 1.5% material-diff threshold."
},
"performanceBudget": {
"required": true,
"evidence": "Destructive recovery remains event-driven and limited to confirmed renderer-lifecycle boundaries. Gate-local contracts prove ordinary same-DPR resize performs zero pane scans; a true transition scans only the visible manager; unavailable canvas retry is deduplicated and capped at 16 frames; and heavy reveal adds one bounded visible-pane scan. The shared terminal-render.atlas-recovery-fanout contracts separately prove zero hidden-manager atlas clears or presents and a per-pane display:none retry capped at 16 frames."
},
"promotionCriteria": [
"Establish a stable material-diff threshold across platforms via nightly runs.",
"Promotion means membership in the release-blocking terminal-rendering-golden suite that release-cut.yml runs against every release tag; never PR-blocking.",
"Add Linux and Windows GPU evidence or retain those platform gaps explicitly."
],
"knownGaps": [
"The deterministic recovery test disables xterm's one-second safety timeout so the held-frame damage remains stable until recovery.",
"The renderer-level frame injection isolates the paint failure; provider delivery and hidden-output snapshot restore have separate gates.",
"Linux, Windows, daemon, SSH, and remote-runtime live GPU evidence is not yet recorded."
],
"demotionRule": "Drop from the golden suite back to nightly diagnostic if diff thresholds cannot be kept stable across CI runners."
},
{
"id": "terminal-render.synchronized-reveal-coherence",
"title": "Ordinary reveal preserves synchronized-output frame coherence",
"maturity": "experimental",
"protection": "partial",
"owner": "terminal-rendering",
"layer": "electron-visual-golden",
"surfaces": ["WebGL rendering", "tab reveal", "snapshot restore", "DEC 2026"],
"platforms": ["macos", "linux", "windows"],
"providers": ["local", "daemon", "ssh", "remote-runtime"],
"coveredPlatforms": ["macos"],
"coveredProviders": ["local"],
"coverageNotes": "A headed macOS Electron test uses a real xterm WebGL renderer and production tab reveal. It proves the coherent pre-hide canvas remains visible while DEC 2026 holds a newer buffer, then proves normal release and xterm's one-second watchdog publish complete frames. Renderer behavior is provider-neutral; live Linux, Windows, daemon, SSH, and remote-runtime GPU runs remain gaps.",
"motivatingLinks": [
"https://github.com/stablyai/orca/pull/7133",
"https://github.com/stablyai/orca/pull/7054"
],
"invariant": "terminal-render.synchronized-reveal-coherence: an ordinary reveal never clears a healthy shared atlas or publishes a partially built DEC 2026 frame; it retains the last coherent canvas until release or xterm's bounded watchdog.",
"oracle": "Paint and capture a coherent frame, hide the real terminal tab, build a distinct full-screen frame while DEC 2026 is held, reveal through production, and require zero atlas clears plus pixel-equivalence with the coherent frame. Then release normally and through the one-second watchdog, requiring both compositor frames to match a direct renderer present.",
"commands": [
"pnpm run ensure:electron-runtime && pnpm exec playwright test tests/e2e/terminal-reveal-paused-render-repro.spec.ts --config tests/playwright.config.ts --project electron-headful --workers=1",
"pnpm exec vitest run --config config/vitest.config.ts src/renderer/src/components/terminal-pane/pty-connection-hidden-backlog-snapshot.test.ts src/renderer/src/components/terminal-pane/terminal-visibility-resume.test.ts src/renderer/src/components/terminal-pane/terminal-webgl-atlas-recovery.test.ts src/renderer/src/lib/pane-manager/pane-webgl-renderer.test.ts src/renderer/src/lib/pane-manager/terminal-render-pause-release.test.ts"
],
"testFiles": [
"src/renderer/src/components/terminal-pane/pty-connection-hidden-backlog-snapshot.test.ts",
"src/renderer/src/components/terminal-pane/terminal-visibility-resume.test.ts",
"src/renderer/src/components/terminal-pane/terminal-webgl-atlas-recovery.test.ts",
"src/renderer/src/lib/pane-manager/pane-webgl-renderer.test.ts",
"src/renderer/src/lib/pane-manager/terminal-render-pause-release.test.ts",
"tests/e2e/terminal-reveal-paused-render-repro.spec.ts"
],
"assertionRefs": [
{
"file": "src/renderer/src/components/terminal-pane/terminal-visibility-resume.test.ts",
"assertions": [
"schedules an atlas-preserving present on a light tab reveal",
"keeps heavy atlas recovery off a plain window refocus"
]
},
{
"file": "src/renderer/src/lib/pane-manager/pane-webgl-renderer.test.ts",
"assertions": ["preserves a synchronized frame on an ordinary reveal present"]
},
{
"file": "src/renderer/src/lib/pane-manager/terminal-render-pause-release.test.ts",
"assertions": [
"routes synchronized output through RenderService instead of the renderer",
"releases observer pause before requesting the synchronized frame"
]
},
{
"file": "tests/e2e/terminal-reveal-paused-render-repro.spec.ts",
"assertions": [
"@headful reveal preserves the coherent frame until synchronized output releases"
]
}
],
"evidenceRuns": [
{
"date": "2026-08-23",
"runner": "local",
"platform": "macos",
"command": "pnpm run ensure:electron-runtime && pnpm exec playwright test tests/e2e/terminal-reveal-paused-render-repro.spec.ts --config tests/playwright.config.ts --project electron-headful --workers=1",
"result": "passed",
"durationSeconds": 53,
"summary": "Both final-head headed oracles passed together. The coherent held frame differed by 73 of 1,404,288 pixels (0.0052%), ordinary reveal performed zero atlas clears, normal release differed from the direct present by 95 pixels (0.0068%), and watchdog release matched exactly. All three ratios passed the 1.5% compositor threshold."
}
],
"runtimeBudget": {
"p95Seconds": 120,
"scope": "focused prebuilt headed Electron prevention and watchdog test"
},
"flakeHistory": {
"status": "unknown",
"evidence": "One final watchdog-inclusive macOS headed run passed; CI soak history and cross-platform GPU runs are not yet available."
},
"redGreenEvidence": {
"status": "complete",
"evidence": "Before the prevention change, the ordinary reveal oracle failed deterministically because it observed three atlas clears. After the change, reveal performs zero clears and the first visible frame remains pixel-equivalent to the coherent pre-hide frame."
},
"performanceBudget": {
"required": true,
"evidence": "Ordinary reveal removes three shared-atlas clears and their global visible-manager presents. It adds one settled, event-driven full-viewport refresh request per revealed pane; DEC 2026 coalesces it and uses xterm's existing one-second watchdog. No polling, subprocess, provider call, PTY inventory, background-output work, listener, or unbounded retry was added; the display-none retry remains deduplicated and capped at 16 frames."
},
"promotionCriteria": [
"Accumulate stable macOS runs for both normal release and watchdog release.",
"Add Linux and Windows GPU evidence or retain those platform gaps explicitly.",
"Keep the destructive atlas-recovery oracle separate and passing."
],
"knownGaps": [
"The deterministic test injects full-screen marker frames through xterm rather than invoking a live model; genuine OpenCode full-window evidence separately proves the original corruption.",
"Linux, Windows, daemon, SSH, and remote-runtime live GPU evidence is not yet recorded.",
"The 1.5% compositor threshold tolerates cursor and shell-prompt timing noise; exact buffer content and atlas-clear counts are asserted separately."
],
"demotionRule": "Demote if ordinary reveal clears the shared atlas, the held frame stops matching its coherent baseline, release/watchdog output diverges from a direct present, or the headed oracle cannot remain deterministic."
},
{
"id": "pty-delivery.renderer-lifecycle-accounting-reset",
"title": "Renderer lifecycle reset clears leaked PTY delivery accounting so surviving PTYs cannot freeze",
"maturity": "experimental",
"protection": "partial",
"owner": "terminal-runtime",
"layer": "main-unit",
"surfaces": [
"terminal output delivery",
"renderer reload / crash recovery",
"surviving daemon and local PTYs"
],
"platforms": ["macos", "linux", "windows"],
"providers": ["local", "daemon"],
"coveredPlatforms": ["macos"],
"coveredProviders": [],
"coverageNotes": "Local macOS unit evidence over the shared main-process delivery pipeline in registerPtyHandlers. The oracle drives a local mock PTY, but the in-flight/pending accounting is provider-agnostic and daemon PTYs ride the identical pipeline (the manual dev repro that proved the freeze was daemon-backed). SSH is a separate relay/credit path and never enters these counters; mobile/relay ride unaffected paths; WSL terminals ride this same local/daemon pipeline and are covered by the same accounting (no dedicated provider-contract test yet). Motivated by a production incident on v1.4.131 (three frozen/broken terminal panes in one desktop session) diagnosed to leaked in-flight/pending accounting across a renderer reload (rendererGraphEpoch 3). Live validation of the fix on a rebuilt dev instance surfaced a second leak mode (the boot window): after the reset ran, main resumed flushing a flooding PTY into the still-booting page before its pty:data listener re-registered, so those sends were dropped yet counted and re-pinned rendererInFlightChars at 524288. The gate now also covers holding sends until the renderer's pty:rendererDispatcherReady handshake. A watchdog self-heals a lost handshake: on each reset a one-shot ~10s timer arms and, if the handshake never arrives, force-opens the gate (rendererDispatcherReadyForcedCount increments) so a dropped handshake degrades to pre-handshake behavior instead of a permanent hold; the real handshake or a re-registration cancels it. Two new diagnostics — rendererPtyDispatcherReady and rendererDispatcherReadyForcedCount — expose the otherwise-invisible boot-window hold, which early-returns before ackGatedFlushSkipCount increments.",
"motivatingLinks": [
// #5787 introduced the renderer-reload delivery-accounting path this gate hardens;
// kept for lineage, not the primary motivation. THIS fix is motivated by the
// v1.4.131 three-frozen-panes incident (see coverageNotes).
"https://github.com/stablyai/orca/pull/5787",
"https://github.com/stablyai/orca/pull/8034"
],
"invariant": "After a renderer lifecycle reset (main-frame did-start-navigation / render-process-gone / destroyed), no surviving PTY remains delivery-gated by pre-reset unacked bytes: main's in-flight counters and pending backlog equal the true state of the new page (zero in-flight, zero pending). Delivery then resumes only once the reloaded page's pty:data dispatcher re-registers and signals pty:rendererDispatcherReady; during the boot window before that handshake main holds all sends (data accrues losslessly in the capped pending backlog) so bytes cannot be dropped into a listener-less page and re-pin the gate. The hold itself cannot become a permanent freeze: a one-shot ~10s watchdog armed on each reset force-opens the gate (incrementing rendererDispatcherReadyForcedCount) if the handshake is lost, and the real handshake or a re-registration cancels it. The reset fires only for a new-document main-frame navigation: did-start-navigation carries exact frame and same-document details, so overlapping subframe or in-page navigation never clears accounting or holds the gate on the still-alive page. If a renderer lifecycle edge is otherwise missed, a backstop still recovers: because the handshake is one-shot per page load, receiving pty:rendererDispatcherReady while the gate is already open proves a reset was missed (or the watchdog force-opened the gate), so the handler reconciles by clearing the stale accounting before re-opening. The renderer sends that handshake exactly once per page load, after its pty:data listener registers.",
"oracle": "Ingest more than 512 KB of PTY output with no renderer ACKs and assert the per-PTY gate closes (sends stop at the 512 KB high-water, remainder accrues as pending). Fire the registered main-frame did-start-navigation listener and assert rendererInFlightChars and pendingChars are zero and the new diagnostics record the reset (rendererLifecycleResetCount 1, lastLifecycleResetClearedChars 512 KB). Then, before any dispatcher-ready handshake, ingest another chunk and assert it is NOT sent and NOT counted in-flight (held for the boot window, accruing in pending). Finally fire the pty:rendererDispatcherReady handshake and assert the held chunk is delivered to the renderer. Counters-zero without proving both the boot-window hold and that delivery resumes is insufficient. Additional cases prove the boot-window hold also covers the interactive direct-send fast path (input-primed keystroke echo is held, not sent, until the handshake) and that the self-heal watchdog force-opens the gate (rendererDispatcherReadyForcedCount 1) when no handshake arrives, while a timely handshake cancels the watchdog and leaves no orphaned timer. A further case opens the new page with a main-frame navigation and dispatcher handshake, then fires an overlapping subframe navigation and asserts the gate stays ready, the reset count stays at exactly one, and fresh output delivers without the watchdog — proving an iframe cannot reclose the live page. A backstop case saturates the gate, then fires pty:rendererDispatcherReady while the gate is still open (ready true) with no preceding reset — modeling a missed lifecycle edge — and asserts the handler reconciles: in-flight and pending clear, rendererLifecycleResetCount increments, and fresh output flows immediately (a straggler ACK is clamped and cannot underflow). A renderer-side case (pty-dispatcher-pi-routing.test.ts) asserts ensurePtyDispatcher() sends pty:rendererDispatcherReady exactly once across two attach calls — proving the send fires (it is optional-chained) and the one-shot guard holds.",
"commands": [
"pnpm exec vitest run --config config/vitest.config.ts src/main/ipc/pty-renderer-lifecycle-delivery-reset.test.ts src/main/ipc/pty-dispatcher-handshake-osc-answers.test.ts src/renderer/src/components/terminal-pane/pty-dispatcher-pi-routing.test.ts"
],
"testFiles": [
"src/main/ipc/pty-renderer-lifecycle-delivery-reset.test.ts",
"src/main/ipc/pty-dispatcher-handshake-osc-answers.test.ts",
"src/renderer/src/components/terminal-pane/pty-dispatcher-pi-routing.test.ts"
],
"assertionRefs": [
{
"file": "src/main/ipc/pty-renderer-lifecycle-delivery-reset.test.ts",
"assertions": [
"a PTY saturated past the 512 KB per-PTY high-water with no ACKs stops sending and accrues pending output (gate closed)",
"firing the registered main-frame did-start-navigation listener zeroes rendererInFlightChars and pendingData and records rendererLifecycleResetCount and lastLifecycleResetClearedChars",
"after the reset, output ingested during the boot window is NOT sent and NOT counted in-flight until the pty:rendererDispatcherReady handshake fires (held in pending)",
"firing the pty:rendererDispatcherReady handshake releases the held backlog and delivery resumes (delivery gated on the handshake, not just counters cleared)",
"interactive input-primed keystroke echo is also held during the boot window (interactive fast path gated on the handshake) and delivered once it fires",
"when no handshake arrives, the ~10s watchdog force-opens the gate (rendererDispatcherReadyForcedCount 1) and the held backlog drains; a timely handshake cancels the watchdog and leaves no orphaned timer",
"an overlapping subframe did-start-navigation after the fresh dispatcher handshake does NOT reclose delivery (rendererLifecycleResetCount stays 1, rendererPtyDispatcherReady stays true, forced count stays 0) and fresh output delivers immediately",
"a pty:rendererDispatcherReady handshake arriving while the gate is still open (ready true, no preceding reset — a missed lifecycle edge) reconciles the stale accounting: in-flight and pending clear, rendererLifecycleResetCount increments, fresh output flows, and a straggler ACK is clamped"
]
},
{
"file": "src/main/ipc/pty-dispatcher-handshake-osc-answers.test.ts",
"assertions": [
"re-registering handlers (macOS re-activate / new window) cancels the prior registration's armed dispatcher-ready watchdog via the cross-registration bridge, leaving no orphaned ~10s timer to force-open a dead window's gate"
]
},
{
"file": "src/renderer/src/components/terminal-pane/pty-dispatcher-pi-routing.test.ts",
"assertions": [
"ensurePtyDispatcher() sends pty:rendererDispatcherReady exactly once across two attach calls (the optional-chained send fires, and the ptyDispatcherAttached one-shot guard prevents a re-signal)"
]
}
],
"evidenceRuns": [
{
"date": "2026-08-02",
"runner": "local",
"platform": "macos",
"command": "pnpm exec vitest run --config config/vitest.config.ts src/main/ipc/pty-renderer-lifecycle-delivery-reset.test.ts src/main/ipc/pty-dispatcher-handshake-osc-answers.test.ts src/renderer/src/components/terminal-pane/pty-dispatcher-pi-routing.test.ts",
"result": "passed",
"durationSeconds": 5,
"summary": "439 tests passed including the lifecycle-reset, boot-window (dispatcher-ready handshake), interactive-gate hold, watchdog self-heal, exact-navigation filter (overlapping subframe navigation is ignored), missed-reset reconcile backstop (handshake-while-open), cross-registration watchdog-cancel, and renderer-side one-shot handshake-send regressions. Removing the reset call reproduces the reload freeze (rendererInFlightChars stays 524288); removing the send-hold reproduces the boot-window leak; removing the interactive-path flag check sends keystroke echo into the not-yet-ready page; removing the watchdog arm leaves the gate held forever; removing the watchdog cancel leaves an orphaned timer after the handshake; switching back to aggregate did-start-loading state lets an overlapping iframe load reclose the gate; removing the handshake-while-open reconcile leaves the survivors pinned at 524288 after a missed lifecycle edge."
}
],
"runtimeBudget": {
"p95Seconds": 10,
"scope": "local main-process unit test"
},
"flakeHistory": {
"status": "unknown",
"evidence": "Newly registered with this fix; needs soak history before any promotion. The oracle is deterministic (fake timers, mock webContents)."
},
"redGreenEvidence": {
"status": "partial",
"evidence": "Locally verified red/green on every load-bearing branch: (1) reset call removed -> rendererInFlightChars stays 524288 after main-frame did-start-navigation; (2) boot-window send-hold removed -> post-reload output is sent into the not-yet-ready page ('NOT sent until handshake' fails); (3) interactive-path flag check removed -> input-primed keystroke echo is sent during the hold; (4) watchdog arm removed -> the gate is never force-opened and the held backlog never drains; (5) watchdog cancel removed -> an orphaned ~10s timer survives the handshake (getTimerCount 1); (6) aggregate did-start-loading classification restored -> an overlapping subframe navigation recloses the gate after the handshake (ready false until watchdog) — deterministically red; (7) handshake-while-open reconcile removed -> a pty:rendererDispatcherReady arriving after a missed lifecycle edge leaves the gate pinned (rendererInFlightChars stays 524288, pending 90112, rendererLifecycleResetCount 0) — locally verified red; (8) cross-registration bridge cancel removed (top-of-registerPtyHandlers clearRendererDispatcherReadyWatchdog) -> a prior registration's armed watchdog survives re-registration as an orphaned timer (getTimerCount 1 instead of 0) — locally verified red. With the full fix all eight are green. The performance budget below still holds: the watchdog is a single unref'd one-shot per reset, not per-chunk. Needs a saved CI or intentional-break artifact before blocking promotion."
},
"performanceBudget": {
"required": true,
"evidence": "The reset is an O(#ptys) map clear on rare lifecycle events (reload/crash) plus one unref'd one-shot ~10s watchdog timer per reset (cancelled by the handshake or a re-registration); no polling and no per-chunk work. Any PR changing the delivery gate, in-flight accounting, or flush loop must re-measure terminal throughput before promotion."
},
"promotionCriteria": [
"Run in soak for at least 100 consecutive passes or 14 days across required CI platforms.",
"Attach saved red/green evidence from removing the lifecycle-reset accounting clear.",
"Add an Electron-level reload survival test that proves a saturated pane resumes rendering and input after Cmd+R / crash recovery."
],
"knownGaps": [
"The unit oracle drives a local mock PTY; daemon and WSL coverage rides the same pipeline but has no dedicated provider-contract test yet.",
"The dev repro covers the output-delivery freeze only; the arrow-key input symptom and mouse-mode flood observed in the same incident are out of scope and need their own repros.",
"No live Electron reload-survival assertion yet — the gate proves the main-side accounting reset, not the full renderer reattach paint."
],
"demotionRule": "Demote or quarantine if the gate flakes once without a product bug or harness bug filed to the owner."
},
{
"id": "runtime-files.watcher-process-isolation",
"title": "Runtime and SSH relay watcher faults stay process-isolated without disrupting host services",
"maturity": "experimental",
"protection": "partial",
"owner": "runtime-platform",
"layer": "process-rpc-contract",
"surfaces": [
"headless orca serve",
"paired file explorer",
"runtime editor external-change detection",
"desktop filesystem watcher",
"SSH relay filesystem watcher and live PTYs"
],
"platforms": ["macos", "linux", "windows"],
"providers": ["local", "remote-runtime", "ssh"],
"coveredPlatforms": ["macos"],
"coveredProviders": ["local", "remote-runtime", "ssh"],
"coverageNotes": "Deterministic tests cover one shared healthy child per runtime process plus at most four bounded fault-quarantine children, native desktop, paired-runtime, and WSL snapshot processes sharing the same eight-physical-child reservation with typed serialized event-driven capacity recovery, including recursive re-wait when crash recovery reclaims an announced slot, one quarantine attempt per watch lifetime, generation-scoped cancellation, bounded termination with removable deadline waiters, replacement-crawl errors that cannot be blessed by a late readiness ack, pre-ready paired-web cancellation registered before an unbounded capacity wait, already-resolved and late physical-exit retry of a rejected paired-web teardown, physical desktop-install and local/SSH PTY teardown, stale-generation rejection, per-child stat bounds, final-overflow RPC delivery, and renderer eviction before terminal callbacks can retry. Destructive local and SSH removal fences both ID-derived and resolved-cwd terminal roots, including sibling-root/cwd combinations with reverse admission rollback, closes descendant relay watches before parent deletion, enumerates authoritative provider/cwd ownership, falls back to daemon spawn cwd before OSC 7, and keeps daemon/relay immediate shutdown pending until native exit or a bounded fail-closed error; a dead relay PID discovered during attach also settles concurrent shutdown before its stale entry is reaped, while Windows runtime watcher deadlines retain one removable physical-close waiter, treat Node's error-close path as positive physical-exit proof, and clear root ownership on late close. The relay policy test maps a standard repository's base, Git common directory, and worktree roots to one healthy supervisor, then proves a shared-child failure recovers those roots in separate quarantine supervisors with overflow and resumed events. Abortable capacity, quarantine, runtime-root, relay, SSH, and relay pre-install setup waits attach one reaction to each shared promise and explicitly remove 10,000 cancelled caller closures while one anchor remains. Built-entry macOS harnesses kill the desktop/runtime and SSH relay watcher children, then require automatic resubscription and later events while the host process and relay PTY survive. SSH bundles the child boundary beside relay.js, requires both artifacts for install completeness, and preserves registration-owned same-root cancellation.",
"motivatingLinks": [
"https://github.com/stablyai/orca/issues/5308",
"https://github.com/stablyai/orca/issues/7547",
"https://github.com/stablyai/orca/issues/8212"
],
"invariant": "Local runtime and SSH relay roots share one watcher child per host process while healthy and use at most four quarantine children after shard failure; native desktop, paired-runtime, and direct WSL snapshot children consume the same process-wide eight-child reservation and retry transient exhaustion without permanently disabling a root. Cancellation remains owned by its child generation and settles only after acknowledgement or bounded physical exit; paired-web retains cleanup ownership and can cancel before readiness even while capacity is exhausted, retries a failed unwatch after already-resolved or late physical exit without duplicating stream termination, replacements never overlap a still-retiring generation, and aborted or timed-out callers detach immediately even while queued behind same-root relay teardown. Destructive local and SSH cleanup holds one containment-aware watcher/terminal removal fence through descendant watcher and PTY physical exit plus parent Git/filesystem deletion; daemon and relay kill requests retain ownership until the actual subprocess exit callback or an equivalent positive dead-PID proof and propagate rejected signals or a bounded failure otherwise. A crash-fused shared shard moves affected roots into the bounded quarantine pool, a second fused quarantine ends those watch lifetimes, interrupted setup emits overflow after recovery, metadata work stays bounded, and the SSH relay, PTYs, Git, and other filesystem operations never load the watcher native addon or share its fault boundary.",
"oracle": "Fill the global watcher-child reservation, require native desktop, paired-runtime, and WSL setup to retain typed transient capacity and retry after one serialized release, then cancel pending desktop and paired-client watches and require no retry. Hold one live anchor while aborting 10,000 callers at the capacity, quarantine-assignment, runtime-root, relay-setup, and SSH-registration layers; require exactly one explicit waiter and one base-promise reaction to remain, then zero after settlement. Hold an old relay unsubscribe, queue one same-root setup leader and one anchor, then abort 10,000 joiners; require every cancellation to settle before teardown releases, exactly one anchor waiter, and only one later physical install. Advance the former paired-web callback deadline while capacity remains full, require cancellation ownership to stay live, publish the server token before ready, and require files.unwatch to abort setup before a later slot release can install a native root. Reject the first ready-watch unwatch with a physical-exit promise, resolve that exit later, and require a fresh physical unwatch attempt, registry release, and exactly one stream end. Fill one healthy shared child with multiple roots, map a standard SSH repository's base, Git common directory, and worktree roots to one relay supervisor, then inject IPC disconnect-before-exit, queued and active cancellation, operations during termination, kill-without-exit, repeated unkillable generations, initial and recovery timeouts, and shard failure. During local and SSH deletion, attempt a late terminal spawn whose worktree identity and cwd name different roots, enumerate a non-prefix remote PTY by authoritative worktree ownership, withhold daemon/relay exit callbacks, make attach positively prove a concurrent-shutdown PID dead, and make the provider unavailable; require every acquired admission to roll back on rejection, dead-PID proof to settle physical exit before reaping, timeout to retain ownership, and Git/filesystem deletion never to start. Require bounded watcher process count, physical-exit settlement, healthy-root recovery, stale-generation rejection, overflow plus later events, and fail-closed destructive cleanup. Verify relay build hashes and remote install probes require both relay.js and relay-watcher.js. Launch the built relay with a real PTY and Parcel watch, kill only the watcher child, and require the same relay PID and PTY to answer before a replacement child delivers overflow and a post-crash event.",
"commands": [
"pnpm exec vitest run --config config/vitest.config.ts src/main/runtime/rpc/methods/files-watch-cleanup.test.ts --reporter=dot",
"pnpm exec vitest run --config config/vitest.config.ts src/relay/relay-watcher-pending-setup-waiters.test.ts --reporter=dot",
"pnpm exec vitest run --config config/vitest.config.ts src/relay/relay-watcher-parent-removal.test.ts --reporter=dot",
"pnpm exec vitest run --config config/vitest.config.ts src/main/ipc/parcel-watcher-unsubscribe-timeout.test.ts --reporter=dot",
"pnpm exec vitest run --config config/vitest.config.ts src/main/ipc/filesystem-watcher.test.ts src/main/ipc/filesystem-watcher-native-capacity.test.ts src/main/ipc/parcel-watcher-child-registry.test.ts src/main/ipc/parcel-watcher-child-launch.test.ts src/main/ipc/parcel-watcher-process.test.ts src/main/ipc/parcel-watcher-supervisor-capacity-wait.test.ts src/main/ipc/parcel-watcher-supervisor-capacity.test.ts src/main/ipc/parcel-watcher-disconnect-termination.test.ts src/main/ipc/runtime-watcher-pending-assignment.test.ts src/main/ipc/runtime-watcher-process-pool.test.ts src/main/ipc/parcel-watcher-process-entry.test.ts src/main/ipc/parcel-watcher-event-delivery.test.ts src/main/ipc/filesystem-watcher-local-unsubscribe.test.ts src/main/ipc/filesystem-watcher-wsl.test.ts src/main/ipc/worktrees-delete-pty-teardown.test.ts src/main/ipc/worktrees-orphan-directory-cleanup.test.ts src/main/ipc/worktrees-remove-preflight.test.ts src/main/ipc/worktrees-remove-archive-hooks.test.ts src/main/ipc/watcher-removal-gate.test.ts src/main/runtime/file-watcher-host.test.ts src/main/runtime/orca-runtime-files-watch.test.ts src/main/runtime/worktree-teardown.test.ts src/main/runtime/orca-runtime.test.ts src/main/runtime/rpc/methods/files.test.ts src/main/runtime/rpc/methods/files-watch-cancellation.test.ts src/main/providers/ssh-filesystem-provider-watch-waiters.test.ts src/main/providers/ssh-filesystem-provider.test.ts src/renderer/src/runtime/runtime-file-client.test.ts src/renderer/src/web/web-runtime-client.test.ts src/shared/cross-platform-path.test.ts src/shared/physical-exit-tracker.test.ts src/shared/promise-settlement-waiters.test.ts src/main/ipc/pty-spawn-cwd-fallback.test.ts src/main/ipc/pty-listener-teardown-and-orphans.test.ts src/main/providers/local-pty-provider-shutdown.test.ts src/main/providers/local-pty-provider-session-inventory.test.ts src/main/daemon/daemon-pty-adapter.test.ts src/main/daemon/pty-subprocess.test.ts src/main/daemon/session.test.ts src/main/daemon/terminal-host.test.ts src/main/daemon/terminal-host-session-reaping-leak.test.ts src/main/providers/ssh-pty-provider.test.ts src/relay/relay-watcher-setup-wait.test.ts src/relay/pty-handler-dispose-lifecycle.test.ts src/relay/pty-handler-shutdown-signals.test.ts src/relay/pty-handler-spawn-admission.test.ts src/relay/pty-handler-attach-replay.test.ts src/relay/pty-handler-revive.test.ts --reporter=dot",
"pnpm exec vitest run --config config/vitest.config.ts src/main/ipc/filesystem-watcher.test.ts src/main/ipc/filesystem-watcher-native-capacity.test.ts src/main/ipc/parcel-watcher-child-registry.test.ts src/main/ipc/parcel-watcher-child-launch.test.ts src/main/ipc/parcel-watcher-process.test.ts src/main/ipc/parcel-watcher-supervisor-capacity.test.ts src/main/ipc/parcel-watcher-disconnect-termination.test.ts src/main/ipc/runtime-watcher-process-pool.test.ts src/main/ipc/parcel-watcher-process-entry.test.ts src/main/ipc/parcel-watcher-event-delivery.test.ts src/main/ipc/filesystem-watcher-local-unsubscribe.test.ts src/main/ipc/filesystem-watcher-wsl.test.ts src/main/ipc/worktrees-delete-pty-teardown.test.ts src/main/ipc/worktrees-orphan-directory-cleanup.test.ts src/main/ipc/worktrees-remove-preflight.test.ts src/main/ipc/worktrees-remove-archive-hooks.test.ts src/main/ipc/watcher-removal-gate.test.ts src/main/runtime/file-watcher-host.test.ts src/main/runtime/orca-runtime-files-watch.test.ts src/main/runtime/worktree-teardown.test.ts src/main/runtime/orca-runtime.test.ts src/main/runtime/rpc/methods/files.test.ts src/main/runtime/rpc/methods/files-watch-cancellation.test.ts src/main/providers/ssh-filesystem-provider.test.ts src/renderer/src/runtime/runtime-file-client.test.ts src/renderer/src/web/web-runtime-client.test.ts src/shared/cross-platform-path.test.ts src/shared/physical-exit-tracker.test.ts src/main/ipc/pty-spawn-cwd-fallback.test.ts src/main/ipc/pty-listener-teardown-and-orphans.test.ts src/main/providers/local-pty-provider-shutdown.test.ts src/main/providers/local-pty-provider-session-inventory.test.ts src/main/daemon/daemon-pty-adapter.test.ts src/main/daemon/pty-subprocess.test.ts src/main/daemon/session.test.ts src/main/daemon/terminal-host.test.ts src/main/daemon/terminal-host-session-reaping-leak.test.ts src/main/providers/ssh-pty-provider.test.ts src/relay/pty-handler-dispose-lifecycle.test.ts src/relay/pty-handler-shutdown-signals.test.ts src/relay/pty-handler-spawn-admission.test.ts src/relay/pty-handler-attach-replay.test.ts src/relay/pty-handler-revive.test.ts --reporter=dot",
"pnpm exec vitest run --config config/vitest.config.ts src/main/ipc/filesystem-watcher.test.ts src/main/ipc/parcel-watcher-process.test.ts src/main/ipc/parcel-watcher-disconnect-termination.test.ts src/main/ipc/runtime-watcher-process-pool.test.ts src/main/ipc/parcel-watcher-process-entry.test.ts src/main/ipc/parcel-watcher-event-delivery.test.ts src/main/ipc/filesystem-watcher-local-unsubscribe.test.ts src/main/ipc/filesystem-watcher-wsl.test.ts src/main/ipc/worktrees-delete-pty-teardown.test.ts src/main/ipc/worktrees-orphan-directory-cleanup.test.ts src/main/ipc/worktrees-remove-preflight.test.ts src/main/ipc/worktrees-remove-archive-hooks.test.ts src/main/ipc/watcher-removal-gate.test.ts src/main/runtime/file-watcher-host.test.ts src/main/runtime/orca-runtime-files-watch.test.ts src/main/runtime/worktree-teardown.test.ts src/main/runtime/orca-runtime.test.ts src/main/runtime/rpc/methods/files.test.ts src/main/providers/ssh-filesystem-provider.test.ts src/renderer/src/runtime/runtime-file-client.test.ts src/renderer/src/web/web-runtime-client.test.ts src/shared/cross-platform-path.test.ts src/main/ipc/pty-spawn-cwd-fallback.test.ts src/main/ipc/pty-listener-teardown-and-orphans.test.ts src/main/providers/local-pty-provider-shutdown.test.ts src/main/providers/local-pty-provider-session-inventory.test.ts src/main/daemon/pty-subprocess.test.ts src/main/daemon/session.test.ts src/main/daemon/terminal-host.test.ts src/main/daemon/terminal-host-session-reaping-leak.test.ts src/main/providers/ssh-pty-provider.test.ts src/relay/pty-handler-dispose-lifecycle.test.ts src/relay/pty-handler-shutdown-signals.test.ts src/relay/pty-handler-spawn-admission.test.ts src/relay/pty-handler-attach-replay.test.ts src/relay/pty-handler-revive.test.ts --reporter=dot",
"pnpm exec vitest run --config config/vitest.config.ts src/main/ipc/parcel-watcher-process.test.ts src/main/ipc/parcel-watcher-disconnect-termination.test.ts src/main/ipc/runtime-watcher-process-pool.test.ts src/main/ipc/parcel-watcher-process-entry.test.ts src/main/ipc/parcel-watcher-event-delivery.test.ts src/main/ipc/filesystem-watcher-local-unsubscribe.test.ts src/main/ipc/filesystem-watcher-wsl.test.ts src/main/ipc/worktrees-delete-pty-teardown.test.ts src/main/ipc/worktrees-orphan-directory-cleanup.test.ts src/main/ipc/worktrees-remove-preflight.test.ts src/main/ipc/worktrees-remove-archive-hooks.test.ts src/main/ipc/watcher-removal-gate.test.ts src/main/runtime/file-watcher-host.test.ts src/main/runtime/orca-runtime-files-watch.test.ts src/main/runtime/worktree-teardown.test.ts src/main/runtime/orca-runtime.test.ts src/main/runtime/rpc/methods/files.test.ts src/main/providers/ssh-filesystem-provider.test.ts src/renderer/src/runtime/runtime-file-client.test.ts src/renderer/src/web/web-runtime-client.test.ts src/shared/cross-platform-path.test.ts src/main/ipc/pty-spawn-cwd-fallback.test.ts src/main/ipc/pty-listener-teardown-and-orphans.test.ts src/main/providers/local-pty-provider-shutdown.test.ts src/main/providers/local-pty-provider-session-inventory.test.ts src/main/daemon/pty-subprocess.test.ts src/main/daemon/session.test.ts src/main/daemon/terminal-host.test.ts src/main/daemon/terminal-host-session-reaping-leak.test.ts src/main/providers/ssh-pty-provider.test.ts src/relay/pty-handler-dispose-lifecycle.test.ts src/relay/pty-handler-shutdown-signals.test.ts src/relay/pty-handler-spawn-admission.test.ts src/relay/pty-handler-attach-replay.test.ts src/relay/pty-handler-revive.test.ts",
"pnpm exec vitest run --config config/vitest.config.ts src/main/ipc/parcel-watcher-process.test.ts src/main/ipc/parcel-watcher-disconnect-termination.test.ts src/main/ipc/runtime-watcher-process-pool.test.ts src/main/ipc/parcel-watcher-process-entry.test.ts src/main/ipc/parcel-watcher-event-delivery.test.ts src/main/ipc/filesystem-watcher-local-unsubscribe.test.ts src/main/ipc/filesystem-watcher-wsl.test.ts src/main/ipc/worktrees-delete-pty-teardown.test.ts src/main/ipc/worktrees-orphan-directory-cleanup.test.ts src/main/ipc/worktrees-remove-preflight.test.ts src/main/ipc/worktrees-remove-archive-hooks.test.ts src/main/ipc/watcher-removal-gate.test.ts src/main/runtime/file-watcher-host.test.ts src/main/runtime/orca-runtime-files-watch.test.ts src/main/runtime/worktree-teardown.test.ts src/main/runtime/orca-runtime.test.ts src/main/runtime/rpc/methods/files.test.ts src/main/providers/ssh-filesystem-provider.test.ts src/renderer/src/runtime/runtime-file-client.test.ts src/renderer/src/web/web-runtime-client.test.ts src/shared/cross-platform-path.test.ts src/main/ipc/pty-spawn-cwd-fallback.test.ts src/main/ipc/pty-listener-teardown-and-orphans.test.ts src/main/providers/local-pty-provider-shutdown.test.ts src/main/providers/local-pty-provider-session-inventory.test.ts src/main/daemon/session.test.ts src/main/daemon/terminal-host.test.ts src/main/daemon/terminal-host-session-reaping-leak.test.ts src/main/providers/ssh-pty-provider.test.ts src/relay/pty-handler-dispose-lifecycle.test.ts src/relay/pty-handler-shutdown-signals.test.ts src/relay/pty-handler-spawn-admission.test.ts src/relay/pty-handler-attach-replay.test.ts src/relay/pty-handler-revive.test.ts",
"pnpm exec vitest run --config config/vitest.config.ts src/main/ipc/parcel-watcher-process.test.ts src/main/ipc/parcel-watcher-disconnect-termination.test.ts src/main/ipc/runtime-watcher-process-pool.test.ts src/main/ipc/parcel-watcher-process-entry.test.ts src/main/ipc/parcel-watcher-event-delivery.test.ts src/main/ipc/filesystem-watcher-local-unsubscribe.test.ts src/main/ipc/filesystem-watcher-wsl.test.ts src/main/ipc/worktrees-delete-pty-teardown.test.ts src/main/ipc/worktrees-orphan-directory-cleanup.test.ts src/main/ipc/worktrees-remove-preflight.test.ts src/main/ipc/worktrees-remove-archive-hooks.test.ts src/main/ipc/watcher-removal-gate.test.ts src/main/runtime/file-watcher-host.test.ts src/main/runtime/orca-runtime-files-watch.test.ts src/main/runtime/worktree-teardown.test.ts src/main/runtime/orca-runtime.test.ts src/main/runtime/rpc/methods/files.test.ts src/main/providers/ssh-filesystem-provider.test.ts src/renderer/src/runtime/runtime-file-client.test.ts src/renderer/src/web/web-runtime-client.test.ts src/shared/cross-platform-path.test.ts src/main/ipc/pty-spawn-cwd-fallback.test.ts src/main/ipc/pty-listener-teardown-and-orphans.test.ts src/main/daemon/terminal-host.test.ts src/main/daemon/terminal-host-session-reaping-leak.test.ts src/main/providers/ssh-pty-provider.test.ts src/relay/pty-handler-dispose-lifecycle.test.ts src/relay/pty-handler-shutdown-signals.test.ts src/relay/pty-handler-spawn-admission.test.ts src/relay/pty-handler-attach-replay.test.ts src/relay/pty-handler-revive.test.ts",
"pnpm exec vitest run --config config/vitest.config.ts src/main/ipc/parcel-watcher-process.test.ts src/main/ipc/parcel-watcher-disconnect-termination.test.ts src/main/ipc/runtime-watcher-process-pool.test.ts src/main/ipc/parcel-watcher-process-entry.test.ts src/main/ipc/parcel-watcher-event-delivery.test.ts src/main/ipc/filesystem-watcher-local-unsubscribe.test.ts src/main/ipc/filesystem-watcher-wsl.test.ts src/main/ipc/worktrees-delete-pty-teardown.test.ts src/main/ipc/worktrees-orphan-directory-cleanup.test.ts src/main/ipc/worktrees-remove-preflight.test.ts src/main/ipc/worktrees-remove-archive-hooks.test.ts src/main/ipc/watcher-removal-gate.test.ts src/main/runtime/file-watcher-host.test.ts src/main/runtime/orca-runtime-files-watch.test.ts src/main/runtime/worktree-teardown.test.ts src/main/runtime/orca-runtime.test.ts src/main/runtime/rpc/methods/files.test.ts src/main/providers/ssh-filesystem-provider.test.ts src/renderer/src/runtime/runtime-file-client.test.ts src/renderer/src/web/web-runtime-client.test.ts src/shared/cross-platform-path.test.ts",
"pnpm run build:electron-vite",
"node config/scripts/runtime-file-watcher-resource-probe.mjs",
"node config/scripts/runtime-file-watcher-fault-harness.mjs",
"ELECTRON_RUN_AS_NODE=1 pnpm exec electron config/scripts/runtime-file-watcher-fault-harness.mjs",
"pnpm exec vitest run --config config/vitest.config.ts src/relay/relay-watcher-setup-wait.test.ts src/relay/relay-filesystem-watch-registry.test.ts src/relay/fs-handler.test.ts src/relay/git-handler.test.ts src/relay/subprocess.test.ts src/main/ssh/ssh-relay-versioned-install.test.ts config/scripts/package-electron-runtime-contract.test.mjs",
"pnpm exec vitest run --config config/vitest.config.ts src/relay/relay-filesystem-watch-registry.test.ts src/relay/fs-handler.test.ts src/relay/git-handler.test.ts src/relay/subprocess.test.ts src/main/ssh/ssh-relay-versioned-install.test.ts config/scripts/package-electron-runtime-contract.test.mjs",
"pnpm run build:relay",
"node config/scripts/relay-watcher-fault-harness.mjs"
],
"testFiles": [
"src/main/daemon/daemon-pty-adapter.test.ts",
"src/main/ipc/filesystem-watcher.test.ts",
"src/main/ipc/filesystem-watcher-native-capacity.test.ts",
"src/main/ipc/parcel-watcher-child-registry.test.ts",
"src/main/ipc/parcel-watcher-child-launch.test.ts",
"src/main/ipc/parcel-watcher-process.test.ts",
"src/main/ipc/parcel-watcher-unsubscribe-timeout.test.ts",
"src/main/ipc/parcel-watcher-supervisor-capacity-wait.test.ts",
"src/main/ipc/parcel-watcher-supervisor-capacity.test.ts",
"src/main/ipc/parcel-watcher-disconnect-termination.test.ts",
"src/main/ipc/runtime-watcher-pending-assignment.test.ts",
"src/main/ipc/runtime-watcher-process-pool.test.ts",
"src/main/ipc/parcel-watcher-process-entry.test.ts",
"src/main/ipc/parcel-watcher-event-delivery.test.ts",
"src/main/ipc/filesystem-watcher-local-unsubscribe.test.ts",
"src/main/ipc/filesystem-watcher-wsl.test.ts",
"src/main/ipc/worktrees-delete-pty-teardown.test.ts",
"src/main/ipc/worktrees-orphan-directory-cleanup.test.ts",
"src/main/ipc/worktrees-remove-preflight.test.ts",
"src/main/ipc/worktrees-remove-archive-hooks.test.ts",
"src/main/ipc/watcher-removal-gate.test.ts",
"src/main/ipc/pty-spawn-cwd-fallback.test.ts",
"src/main/ipc/pty-listener-teardown-and-orphans.test.ts",
"src/main/providers/local-pty-provider-shutdown.test.ts",
"src/main/providers/local-pty-provider-session-inventory.test.ts",
"src/main/daemon/pty-subprocess.test.ts",
"src/main/daemon/session.test.ts",
"src/main/daemon/terminal-host.test.ts",
"src/main/daemon/terminal-host-session-reaping-leak.test.ts",
"src/main/runtime/file-watcher-host.test.ts",
"src/main/runtime/orca-runtime-files-watch.test.ts",
"src/main/runtime/worktree-teardown.test.ts",
"src/main/runtime/orca-runtime.test.ts",
"src/main/runtime/rpc/methods/files.test.ts",
"src/main/runtime/rpc/methods/files-watch-cancellation.test.ts",
"src/main/runtime/rpc/methods/files-watch-cleanup.test.ts",
"src/main/providers/ssh-filesystem-provider.test.ts",
"src/main/providers/ssh-filesystem-provider-watch-waiters.test.ts",
"src/main/providers/ssh-pty-provider.test.ts",
"src/renderer/src/runtime/runtime-file-client.test.ts",
"src/renderer/src/web/web-runtime-client.test.ts",
"src/shared/cross-platform-path.test.ts",
"src/shared/physical-exit-tracker.test.ts",
"src/shared/promise-settlement-waiters.test.ts",
"config/scripts/runtime-file-watcher-fault-harness.mjs",
"config/scripts/runtime-file-watcher-resource-probe.mjs",
"src/relay/relay-filesystem-watch-registry.test.ts",
"src/relay/relay-watcher-pending-setup-waiters.test.ts",
"src/relay/relay-watcher-parent-removal.test.ts",
"src/relay/relay-watcher-setup-wait.test.ts",
"src/relay/fs-handler.test.ts",
"src/relay/pty-handler-dispose-lifecycle.test.ts",
"src/relay/pty-handler-shutdown-signals.test.ts",
"src/relay/pty-handler-spawn-admission.test.ts",
"src/relay/pty-handler-attach-replay.test.ts",
"src/relay/pty-handler-revive.test.ts",
"src/relay/git-handler.test.ts",
"src/relay/subprocess.test.ts",
"src/main/ssh/ssh-relay-versioned-install.test.ts",
"config/scripts/package-electron-runtime-contract.test.mjs",
"config/scripts/relay-watcher-fault-harness.mjs"
],
"assertionRefs": [
{
"file": "src/main/ipc/filesystem-watcher.test.ts",
"assertions": [
"a transient WSL child-capacity rejection automatically retries on release and renderer unwatch cancels the wait",
"failed SSH worktree removal restores every live renderer listener, emits overflow, and resumes precise events"
]
},
{
"file": "src/main/ipc/filesystem-watcher-native-capacity.test.ts",
"assertions": [
"typed native child-capacity exhaustion automatically retries after a serialized slot release",
"renderer unwatch cancels a pending native capacity retry before subscription restarts"
]
},
{
"file": "src/main/ipc/parcel-watcher-child-registry.test.ts",
"assertions": [
"capacity notification closes the release-before-listen race, supports cancellation, fires at most once, and serializes reserving waiters per released slot"
]
},
{
"file": "src/main/ipc/parcel-watcher-child-launch.test.ts",
"assertions": [
"native launcher reports typed transient capacity exhaustion without forking another child"
]
},
{
"file": "src/shared/physical-exit-tracker.test.ts",
"assertions": [
"timed-out physical-exit waiters detach while active and later retries still settle on exact exit"
]
},
{
"file": "src/shared/promise-settlement-waiters.test.ts",
"assertions": [
"one shared-promise reaction serves an anchor plus 10,000 abortable callers, and all cancelled closures detach immediately",
"timeout and already-aborted paths remove timers, listeners, and ownership while preserving the active anchor"
]
},
{
"file": "src/main/daemon/daemon-pty-adapter.test.ts",
"assertions": [
"daemon process enumeration falls back to spawn cwd before OSC 7 reports a live cwd",
"force-killed keep-history sleep remains cold-restorable across repeated wake cycles after physical exit"
]
},
{
"file": "src/main/ipc/parcel-watcher-process.test.ts",
"assertions": [
"initial-subscribe crashes complete with an interruption refresh",
"watch errors before readiness reject setup and physically cancel the native crawl",
"watch errors during replacement crawl terminate recovery and a late readiness ack cannot revive the failed root",
"IPC disconnect recovery restores every existing root before accepting new setup",
"queued abort removes one request without restarting healthy roots, while active abort or crawl-scoped timeout restores the shard",
"a crash-resubscribe crawl deadline and concurrent unsubscribe settle only after physical shard exit, or report physical-exit failure at the termination deadline",
"a close-only asynchronous spawn failure settles physical termination without waiting for the exit deadline",
"production runtime-pool disposal rejects later subscriptions without forking an overlapping child",
"Vitest cleanup resets rather than re-disposes the reusable runtime pool",
"native child launch preserves typed transient capacity exhaustion instead of reporting permanent process unavailability",
"missing built entries fail closed and unavailable canary storage remains optional",
"fault-harness PID reporting cannot clobber an existing filesystem path"
]
},
{
"file": "src/main/ipc/parcel-watcher-unsubscribe-timeout.test.ts",
"assertions": [
"a canary-independent native-unsubscribe deadline restarts the shard and restores healthy siblings after physical child exit",
"an unkillable child rejects the native unsubscribe with its retained physical-exit promise only at the bounded exit deadline"
]
},
{
"file": "src/main/ipc/parcel-watcher-supervisor-capacity-wait.test.ts",
"assertions": [
"10,000 cancelled capacity callers leave exactly one live anchor and zero waiters after the released slot settles"
]
},
{
"file": "src/main/ipc/parcel-watcher-supervisor-capacity.test.ts",
"assertions": [
"one released physical slot launches one shared supervisor child for every waiting root, while partial/all cancellation and disposal remove the shared capacity barrier",
"a waiter recursively re-enters the event-driven barrier when crash recovery reclaims its announced slot"
]
},
{
"file": "src/main/ipc/parcel-watcher-disconnect-termination.test.ts",
"assertions": [
"pending-crawl cancellation after disconnect remains pending until the exact child exits",
"ready and pending-crawl cancellation force disconnected-child exit even while a healthy sibling root remains",
"a cancellation deadline joins active disconnect termination without duplicate sibling resubscription",
"an exit-deadline failure replaces the early cancellation and remains visible to synchronous unsubscribe until physical exit"
]
},
{
"file": "src/main/ipc/runtime-watcher-pending-assignment.test.ts",
"assertions": [
"10,000 cancelled quarantine-assignment callers leave exactly one live anchor and zero waiters after grant",
"an already-aborted first caller synchronously releases pending assignment ownership"
]
},
{
"file": "src/main/ipc/runtime-watcher-process-pool.test.ts",
"assertions": [
"healthy roots share one supervisor until a fault requires quarantine",
"a supervisor-scoped failure spreads affected roots across at most four quarantine supervisors",
"a second fused quarantine creates no further replacement for that watch lifetime",
"a root-specific failure preserves healthy shard assignments",
"a live root whose crash-resubscribe times out moves to quarantine",
"an older same-root teardown cannot erase a newer watch lease's assignment",
"test reset explicitly reopens the production-disposed pool",
"a zero-waiter aborted assignment cannot poison a same-turn replacement subscribe"
]
},
{
"file": "src/main/ipc/parcel-watcher-process-entry.test.ts",
"assertions": [
"queued cancellation removes the request before Parcel starts its crawl",
"active cancellation requests one host restart and emits no stale subscribed acknowledgement",
"runtime batches receive directory metadata before child IPC",
"an FSEvents dropped-events error is reported as recoverable and later events continue",
"batches above the configured event limit become one overflow before stat or IPC fanout",
"while process.send is backpressured, later bursts retain at most one bounded pending batch and collapse excess paths to overflow",
"unsubscribe discards pending delivery before it can perform stale stat work"
]
},
{
"file": "src/main/ipc/parcel-watcher-event-delivery.test.ts",
"assertions": [
"eight concurrent root batches never exceed eight active directory metadata stats within one child"
]
},
{
"file": "src/main/ipc/filesystem-watcher-local-unsubscribe.test.ts",
"assertions": [
"worktree deletion physically aborts pending native setup and settles before its crawl resolves",
"app shutdown physically aborts pending native setup and releases a late native handle",
"a cancelled pending install retains physical-exit failure across an immediate second destructive close",
"desktop terminal failure remains root-owned even when the cleared subscription later unsubscribes cleanly",
"Windows drive and UNC watcher ownership is found across path casing and separator variants",
"Windows event payloads retain the physical root spelling instead of the comparison key",
"failed local worktree removal restores every live renderer listener and emits overflow"
]
},
{
"file": "src/main/ipc/filesystem-watcher-wsl.test.ts",
"assertions": [
"unsubscribe and startup abort remain pending until the WSL watcher process physically closes",
"a termination timeout or rejected kill retains the WSL watcher owner for later physical-exit proof",
"WSL watcher processes consume the shared eight-child reservation until physical close, including synchronous startup-write cleanup"
]
},
{
"file": "src/main/ipc/worktrees-delete-pty-teardown.test.ts",
"assertions": [
"desktop IPC deletion never starts Git removal when physical PTY teardown cannot be proven",
"normal and orphan/leftover deletion paths perform strict PTY teardown before local or SSH Git/filesystem removal"
]
},
{
"file": "src/main/ipc/worktrees-remove-preflight.test.ts",
"assertions": [
"SSH deletion fails closed before Git when the remote PTY provider is unavailable"
]
},
{
"file": "src/main/ipc/worktrees-remove-archive-hooks.test.ts",
"assertions": [
"failed IPC deletion finishes the watcher fence as aborted so logical subscriptions can recover"
]
},
{
"file": "src/main/ipc/watcher-removal-gate.test.ts",
"assertions": [
"Windows-equivalent spellings share one removal fence while distinct POSIX backslash roots do not",
"desktop and runtime removal entry points cannot own overlapping destructive roots concurrently",
"parent removal waits descendant terminal spawns and rejects later descendant installs"
]
},
{
"file": "src/main/ipc/pty-spawn-cwd-fallback.test.ts",
"assertions": [
"renderer PTY spawn is rejected before provider creation while destructive worktree removal holds the shared terminal gate",
"renderer and runtime spawns fence both the worktree-ID root and resolved cwd, including cross-worktree cwd ownership with rollback"
]
},
{
"file": "src/main/ipc/pty-listener-teardown-and-orphans.test.ts",
"assertions": [
"manual and runtime-controller local PTY shutdown retain listener and provider ownership until physical exit",
"did-finish-load orphan cleanup disposes data delivery but retains the onExit listener and tracker through physical exit",
"a failed local PTY kill retains retryable provider ownership until a later physical exit"
]
},
{
"file": "src/main/providers/local-pty-provider-session-inventory.test.ts",
"assertions": [
"local process enumeration retains the spawn cwd for destructive ownership fallback"
]
},
{
"file": "src/main/providers/local-pty-provider-shutdown.test.ts",
"assertions": [
"local shutdown remains pending and owned until node-pty reports physical exit",
"destructive cleanup escalates an existing graceful shutdown without losing its shared exit proof",
"POSIX graceful shutdown escalates to one bounded SIGKILL when the child ignores SIGTERM",
"Windows graceful-to-destructive cleanup treats the first ConPTY kill as final and never double-closes the handle",
"orphan cleanup racing immediate shutdown shares one kill and remains owned until the queued physical exit",
"timeout and kill failure preserve ownership for a later successful retry"
]
},
{
"file": "src/main/daemon/pty-subprocess.test.ts",
"assertions": [
"rejected graceful and force kills propagate without marking the wrapper dead so retries can signal the same child"
]
},
{
"file": "src/main/daemon/session.test.ts",
"assertions": [
"graceful daemon termination force-kills after its deadline but retains session ownership and late output until physical exit",
"rejected graceful and force kills reopen termination state for a later retry"
]
},
{
"file": "src/main/daemon/terminal-host.test.ts",
"assertions": [
"immediate daemon kill remains pending and listed until the subprocess exit callback",
"an unconfirmed immediate kill rejects at the bounded deadline, retains ownership, and blocks same-id replacement"
]
},
{
"file": "src/main/daemon/terminal-host-session-reaping-leak.test.ts",
"assertions": [
"immediate daemon kill reaps the emulator and session only after physical exit"
]
},
{
"file": "src/main/runtime/file-watcher-host.test.ts",
"assertions": [
"same-root clients share one physical watch and one client abort cannot cancel another owner's setup",
"concurrent pre-ready cancellations join one native root release before an immediate replacement subscribes",
"10,000 cancelled runtime-root callers detach while one setup anchor remains",
"root-scoped destructive cleanup joins an in-progress subscriber teardown",
"shard failure preserves existing subscribers through isolated recovery and rejects stale-generation events",
"only failed isolated recovery ends subscribers, after a conservative overflow",
"initial setup failure remains discoverable by root-scoped destructive cleanup until physical exit"
]
},
{
"file": "src/main/runtime/orca-runtime-files-watch.test.ts",
"assertions": [
"Windows runtime cleanup waits for the native close event, fails closed at a bounded deadline, and clears retained ownership on late close without retry listeners",
"a Windows watcher error before cleanup uses Node's proven native error-close as physical-exit proof, emits final overflow and terminal error, and releases deletion ownership",
"pre-publication local runtime setup failure remains owned through destructive cleanup",
"failed deletion re-arms runtime watches immediately after ordinary teardown or after delayed physical exit, without reviving a logically stopped watch"
]
},
{
"file": "src/main/runtime/worktree-teardown.test.ts",
"assertions": [
"overlapping runtime, provider, and registry sweeps stay behind one physical PTY-stop promise",
"destructive teardown rejects instead of releasing deletion when physical stop misses its deadline",
"cwd-owned and floating PTYs are swept while legacy rows without cwd retain prefix ownership",
"remote provider enumeration matches authoritative worktree ownership without touching the local-only registry"
]
},
{
"file": "src/main/runtime/orca-runtime.test.ts",
"assertions": [
"destructive worktree teardown awaits controller stopAndWait instead of treating fire-and-forget kill as physical exit",
"runtime worktree deletion never starts Git removal when a known PTY cannot be physically stopped",
"SSH runtime deletion shuts down an authoritatively owned remote PTY before remote Git removal",
"a delayed physical-exit retry remains scoped to its registered cleanup owner and cannot tear down a same-id replacement",
"failed CLI worktree deletion restores watcher ownership after releasing the install fence",
"cross-layer teardown failure joins every bounded watcher close before restoration begins"
]
},
{
"file": "src/main/runtime/rpc/methods/files.test.ts",
"assertions": [
"pre-ready transport abort reaches RuntimeFileCommands as the owning AbortSignal",
"terminal watcher loss flushes a final overflow change before error/end and unregisters cleanup"
]
},
{
"file": "src/main/runtime/rpc/methods/files-watch-cancellation.test.ts",
"assertions": [
"the server publishes a cleanup token before ready and files.unwatch aborts pending setup without delivering queued crawl events"
]
},
{
"file": "src/main/runtime/rpc/methods/files-watch-cleanup.test.ts",
"assertions": [
"a failed paired-web unwatch retries after already-resolved or late physical exit and emits stream end exactly once"
]
},
{
"file": "src/main/providers/ssh-filesystem-provider-watch-waiters.test.ts",
"assertions": [
"10,000 cancelled SSH callers detach while one registration-owned setup anchor remains"
]
},
{
"file": "src/main/providers/ssh-filesystem-provider.test.ts",
"assertions": [
"an SSH caller abort rejects promptly without cancelling another same-root subscriber's shared setup",
"the physical relay request is cancelled when the last pending subscriber leaves",
"provider disposal cancels pending setup and sends one remote unwatch",
"equivalent Windows spellings share one provider generation and terminal failure reaches the surviving owner"
]
},
{
"file": "src/main/providers/ssh-pty-provider.test.ts",
"assertions": [
"remote process enumeration preserves authoritative worktree ownership while scoping relay PTY ids to the SSH connection"
]
},
{
"file": "src/shared/cross-platform-path.test.ts",
"assertions": [
"comparison keys preserve literal POSIX backslashes while folding Windows drive and UNC spellings"
]
},
{
"file": "src/renderer/src/runtime/runtime-file-client.test.ts",
"assertions": [
"terminal error evicts the shared renderer watch before an error callback can synchronously retry",
"the old stream's later end cannot evict or orphan the replacement stream",
"the end response releases retained preload and main-process subscription bookkeeping",
"a later same-root listener opens a fresh server subscription instead of reusing a dead stream"
]
},
{
"file": "src/relay/relay-watcher-parent-removal.test.ts",
"assertions": [
"POSIX and Windows parent deletion closes and terminally notifies descendant watches before removal while preserving path siblings",
"parent deletion waits for descendant setup publication and already-retiring descendant teardown before removal"
]
},
{
"file": "src/relay/relay-watcher-pending-setup-waiters.test.ts",
"assertions": [
"10,000 aborted relay setup callers detach while one same-root teardown anchor remains and only one replacement installs"
]
},
{
"file": "src/relay/relay-watcher-setup-wait.test.ts",
"assertions": [
"10,000 cancelled relay setup callers leave exactly one explicit anchor and one base-promise reaction"
]
},
{
"file": "src/relay/relay-filesystem-watch-registry.test.ts",
"assertions": [
"each SSH host keeps its own healthy watcher supervisor while a standard repository's three distinct roots share that one child",
"shared-child failure moves those roots into separate quarantine supervisors with overflow and resumed events",
"replacement emits overflow before later ordered events",
"terminal shard failure preserves same-root clients through recovery",
"pending setup aborts only after the last same-root client leaves",
"relay-side removal sends every client a terminal failure, closes every watch, and fences new same-root watcher or PTY setup even when deletion fails",
"a missing child fails closed even if the relay inherits a VITEST environment"
]
},
{
"file": "src/relay/fs-handler.test.ts",
"assertions": [
"shared watches retain the twenty-root budget and release after every client leaves",
"recursive relay deletion closes and terminally notifies same-root watches before removing the directory"
]
},
{
"file": "src/relay/pty-handler-dispose-lifecycle.test.ts",
"assertions": [
"immediate relay shutdown stays pending with the PTY map entry retained until onExit",
"a missing exit rejects at the bounded deadline, preserves the physical owner, and a retry joins without duplicate SIGKILL",
"worktree removal waits explicit and default-cwd PTY creation, rejects later creation, and physically stops only authoritative matching PTYs before deletion"
]
},
{
"file": "src/relay/pty-handler-shutdown-signals.test.ts",
"assertions": [
"Windows relay graceful, fallback, immediate, stale-spawn, exit-dispose, and handler-dispose paths issue at most one ConPTY kill"
]
},
{
"file": "src/relay/pty-handler-spawn-admission.test.ts",
"assertions": [
"relay PTY admission succeeds when post-Node-18 array copy methods are unavailable",
"concurrent spawn and revive admission is atomic, capped at fifty physical PTYs, and same-id revive is deduplicated",
"relay spawn and revive fence distinct worktree-ID and cwd roots, rolling back earlier admissions in reverse when either root is removing"
]
},
{
"file": "src/relay/pty-handler-attach-replay.test.ts",
"assertions": [
"attach dead-PID proof settles a concurrent immediate shutdown before the stale PTY entry is reaped"
]
},
{
"file": "src/renderer/src/web/web-runtime-client.test.ts",
"assertions": [
"a stopped pre-ready paired-web watch retains its callback beyond the former deadline and uses the early server token to unwatch",
"transient shared-socket loss replays an active file watch under a new transport id while preserving its logical handle and never revives a stopped watch"
]
},
{
"file": "src/relay/git-handler.test.ts",
"assertions": [
"remote Git worktree removal executes inside the relay filesystem watcher fence"
]
},
{
"file": "src/relay/subprocess.test.ts",
"assertions": [
"the real relay bundle serves PTY, filesystem, and Git requests with its adjacent watcher child",
"the Node-18-targeted relay bundle contains no unsupported array copy methods"
]
},
{
"file": "src/main/ssh/ssh-relay-versioned-install.test.ts",
"assertions": [
"remote completeness requires relay.js, relay-watcher.js, and the install sentinel"
]
},
{
"file": "config/scripts/package-electron-runtime-contract.test.mjs",
"assertions": ["every release platform packages and gates the hashed watcher child"]
},
{
"file": "config/scripts/runtime-file-watcher-resource-probe.mjs",
"assertions": [
"five healthy roots share one exact watcher PID within the per-child RSS budget",
"four quarantine roots use exactly four child PIDs and remain within the global eight-child reservation cap",
"CPU and RSS are sampled for every exact child PID and every PID exits during cleanup",
"per-child and aggregate RSS and sampled CPU ceilings fail the probe before the physical child cap can hide excess resource use"
]
},
{
"file": "config/scripts/runtime-file-watcher-fault-harness.mjs",
"assertions": [
"the built watcher entry delivers an event before fault injection",
"the harness parent survives watcher-child SIGSEGV",
"the real supervisor automatically replaces the child, resubscribes, and delivers a post-crash event"
]
},
{
"file": "config/scripts/relay-watcher-fault-harness.mjs",
"assertions": [
"the built relay and existing PTY survive watcher-child fault injection",
"replacement emits overflow and a precise post-crash event"
]
}
],
"evidenceRuns": [
{
"date": "2026-07-13",
"runner": "local",
"platform": "macos",
"command": "pnpm exec vitest run --config config/vitest.config.ts src/main/ipc/filesystem-watcher.test.ts src/main/ipc/filesystem-watcher-native-capacity.test.ts src/main/ipc/parcel-watcher-child-registry.test.ts src/main/ipc/parcel-watcher-child-launch.test.ts src/main/ipc/parcel-watcher-process.test.ts src/main/ipc/parcel-watcher-supervisor-capacity-wait.test.ts src/main/ipc/parcel-watcher-supervisor-capacity.test.ts src/main/ipc/parcel-watcher-disconnect-termination.test.ts src/main/ipc/runtime-watcher-pending-assignment.test.ts src/main/ipc/runtime-watcher-process-pool.test.ts src/main/ipc/parcel-watcher-process-entry.test.ts src/main/ipc/parcel-watcher-event-delivery.test.ts src/main/ipc/filesystem-watcher-local-unsubscribe.test.ts src/main/ipc/filesystem-watcher-wsl.test.ts src/main/ipc/worktrees-delete-pty-teardown.test.ts src/main/ipc/worktrees-orphan-directory-cleanup.test.ts src/main/ipc/worktrees-remove-preflight.test.ts src/main/ipc/worktrees-remove-archive-hooks.test.ts src/main/ipc/watcher-removal-gate.test.ts src/main/runtime/file-watcher-host.test.ts src/main/runtime/orca-runtime-files-watch.test.ts src/main/runtime/worktree-teardown.test.ts src/main/runtime/orca-runtime.test.ts src/main/runtime/rpc/methods/files.test.ts src/main/runtime/rpc/methods/files-watch-cancellation.test.ts src/main/providers/ssh-filesystem-provider-watch-waiters.test.ts src/main/providers/ssh-filesystem-provider.test.ts src/renderer/src/runtime/runtime-file-client.test.ts src/renderer/src/web/web-runtime-client.test.ts src/shared/cross-platform-path.test.ts src/shared/physical-exit-tracker.test.ts src/shared/promise-settlement-waiters.test.ts src/main/ipc/pty-spawn-cwd-fallback.test.ts src/main/ipc/pty-listener-teardown-and-orphans.test.ts src/main/providers/local-pty-provider-shutdown.test.ts src/main/providers/local-pty-provider-session-inventory.test.ts src/main/daemon/daemon-pty-adapter.test.ts src/main/daemon/pty-subprocess.test.ts src/main/daemon/session.test.ts src/main/daemon/terminal-host.test.ts src/main/daemon/terminal-host-session-reaping-leak.test.ts src/main/providers/ssh-pty-provider.test.ts src/relay/relay-watcher-setup-wait.test.ts src/relay/pty-handler-dispose-lifecycle.test.ts src/relay/pty-handler-shutdown-signals.test.ts src/relay/pty-handler-spawn-admission.test.ts src/relay/pty-handler-attach-replay.test.ts src/relay/pty-handler-revive.test.ts --reporter=dot",
"result": "passed",
"durationSeconds": 11.98,
"summary": "Thirty-nine watcher, cancellation, desktop/serve, paired-web, WSL, SSH/relay, removal, and PTY physical-exit files passed with 2,008 tests. Capacity, quarantine, runtime-root, relay, and SSH setup layers each prove that 10,000 aborted callers detach while one anchor remains and zero waiters remain after settlement."
},
{
"date": "2026-07-13",
"runner": "local",
"platform": "macos",
"command": "pnpm exec vitest run --config config/vitest.config.ts src/main/ipc/filesystem-watcher.test.ts src/main/ipc/filesystem-watcher-native-capacity.test.ts src/main/ipc/parcel-watcher-child-registry.test.ts src/main/ipc/parcel-watcher-child-launch.test.ts src/main/ipc/parcel-watcher-process.test.ts src/main/ipc/parcel-watcher-supervisor-capacity.test.ts src/main/ipc/parcel-watcher-disconnect-termination.test.ts src/main/ipc/runtime-watcher-process-pool.test.ts src/main/ipc/parcel-watcher-process-entry.test.ts src/main/ipc/parcel-watcher-event-delivery.test.ts src/main/ipc/filesystem-watcher-local-unsubscribe.test.ts src/main/ipc/filesystem-watcher-wsl.test.ts src/main/ipc/worktrees-delete-pty-teardown.test.ts src/main/ipc/worktrees-orphan-directory-cleanup.test.ts src/main/ipc/worktrees-remove-preflight.test.ts src/main/ipc/worktrees-remove-archive-hooks.test.ts src/main/ipc/watcher-removal-gate.test.ts src/main/runtime/file-watcher-host.test.ts src/main/runtime/orca-runtime-files-watch.test.ts src/main/runtime/worktree-teardown.test.ts src/main/runtime/orca-runtime.test.ts src/main/runtime/rpc/methods/files.test.ts src/main/runtime/rpc/methods/files-watch-cancellation.test.ts src/main/providers/ssh-filesystem-provider.test.ts src/renderer/src/runtime/runtime-file-client.test.ts src/renderer/src/web/web-runtime-client.test.ts src/shared/cross-platform-path.test.ts src/shared/physical-exit-tracker.test.ts src/main/ipc/pty-spawn-cwd-fallback.test.ts src/main/ipc/pty-listener-teardown-and-orphans.test.ts src/main/providers/local-pty-provider-shutdown.test.ts src/main/providers/local-pty-provider-session-inventory.test.ts src/main/daemon/daemon-pty-adapter.test.ts src/main/daemon/pty-subprocess.test.ts src/main/daemon/session.test.ts src/main/daemon/terminal-host.test.ts src/main/daemon/terminal-host-session-reaping-leak.test.ts src/main/providers/ssh-pty-provider.test.ts src/relay/pty-handler-dispose-lifecycle.test.ts src/relay/pty-handler-shutdown-signals.test.ts src/relay/pty-handler-spawn-admission.test.ts src/relay/pty-handler-attach-replay.test.ts src/relay/pty-handler-revive.test.ts --reporter=dot",
"result": "passed",
"durationSeconds": 11.59,
"summary": "Thirty-four watcher, cancellation, desktop/serve, paired-web, WSL, removal, PTY physical-exit, provider, renderer, and path files passed with 1,999 tests; paired-web cancellation now owns a server token before ready and aborts pending setup without a late native install."
},
{
"date": "2026-07-13",
"runner": "local",
"platform": "macos",
"command": "node config/scripts/runtime-file-watcher-resource-probe.mjs",
"result": "passed",
"durationSeconds": 0.58,
"summary": "Five healthy roots shared one child at 50,688 KiB RSS and 4.9% sampled CPU; four quarantine children totaled 202,368 KiB RSS and 29.5% sampled CPU, all budgets and the eight-child cap passed, and exact-PID cleanup was true."
},
{
"date": "2026-07-13",
"runner": "local",
"platform": "macos",
"command": "pnpm exec vitest run --config config/vitest.config.ts src/main/ipc/filesystem-watcher.test.ts src/main/ipc/parcel-watcher-process.test.ts src/main/ipc/parcel-watcher-disconnect-termination.test.ts src/main/ipc/runtime-watcher-process-pool.test.ts src/main/ipc/parcel-watcher-process-entry.test.ts src/main/ipc/parcel-watcher-event-delivery.test.ts src/main/ipc/filesystem-watcher-local-unsubscribe.test.ts src/main/ipc/filesystem-watcher-wsl.test.ts src/main/ipc/worktrees-delete-pty-teardown.test.ts src/main/ipc/worktrees-orphan-directory-cleanup.test.ts src/main/ipc/worktrees-remove-preflight.test.ts src/main/ipc/worktrees-remove-archive-hooks.test.ts src/main/ipc/watcher-removal-gate.test.ts src/main/runtime/file-watcher-host.test.ts src/main/runtime/orca-runtime-files-watch.test.ts src/main/runtime/worktree-teardown.test.ts src/main/runtime/orca-runtime.test.ts src/main/runtime/rpc/methods/files.test.ts src/main/providers/ssh-filesystem-provider.test.ts src/renderer/src/runtime/runtime-file-client.test.ts src/renderer/src/web/web-runtime-client.test.ts src/shared/cross-platform-path.test.ts src/main/ipc/pty-spawn-cwd-fallback.test.ts src/main/ipc/pty-listener-teardown-and-orphans.test.ts src/main/providers/local-pty-provider-shutdown.test.ts src/main/providers/local-pty-provider-session-inventory.test.ts src/main/daemon/pty-subprocess.test.ts src/main/daemon/session.test.ts src/main/daemon/terminal-host.test.ts src/main/daemon/terminal-host-session-reaping-leak.test.ts src/main/providers/ssh-pty-provider.test.ts src/relay/pty-handler-dispose-lifecycle.test.ts src/relay/pty-handler-shutdown-signals.test.ts src/relay/pty-handler-spawn-admission.test.ts src/relay/pty-handler-attach-replay.test.ts src/relay/pty-handler-revive.test.ts --reporter=dot",
"result": "passed",
"durationSeconds": 10.01,
"summary": "Twenty-seven watcher, WSL, desktop/serve removal, local/daemon/SSH PTY physical-exit, provider ownership, RPC, renderer, relay PTY admission, and cross-platform path files passed with 1,886 tests. The suite includes nested removal fencing, renderer/runtime cwd-only admission, legacy provider rows, rejected kill retries, transient WSL capacity, and synchronous-startup reservation cleanup."
},
{
"date": "2026-07-13",
"runner": "local",
"platform": "macos",
"command": "node config/scripts/runtime-file-watcher-resource-probe.mjs",
"result": "passed",
"durationSeconds": 0.56,
"summary": "Five healthy roots shared one child at 50,176 KiB RSS and 6.0% sampled CPU; four quarantine children totaled 200,112 KiB RSS and 18.0% sampled CPU. The global eight-child cap and all per-child/aggregate budgets passed, and exact-PID cleanup was true."
},
{
"date": "2026-07-13",
"runner": "local",
"platform": "macos",
"command": "pnpm exec vitest run --config config/vitest.config.ts src/relay/relay-filesystem-watch-registry.test.ts src/relay/fs-handler.test.ts src/relay/git-handler.test.ts src/relay/subprocess.test.ts src/main/ssh/ssh-relay-versioned-install.test.ts config/scripts/package-electron-runtime-contract.test.mjs",
"result": "passed",
"durationSeconds": 10.01,
"summary": "Six relay registry, filesystem/Git handler, bundled subprocess, install, and package contract files passed with 226 tests."
},
{
"date": "2026-07-13",
"runner": "local",
"platform": "macos",
"command": "pnpm run build:electron-vite",
"result": "passed",
"durationSeconds": 24.41,
"summary": "The production Electron main, preload, renderer, daemon, and watcher child entries built successfully."
},
{
"date": "2026-07-13",
"runner": "local",
"platform": "macos",
"command": "node config/scripts/runtime-file-watcher-fault-harness.mjs",
"result": "passed",
"durationSeconds": 0.1,
"summary": "The Node host survived watcher-child SIGSEGV, replaced and resubscribed the child, and delivered a post-crash event."
},
{
"date": "2026-07-13",
"runner": "local",
"platform": "macos",
"command": "ELECTRON_RUN_AS_NODE=1 pnpm exec electron config/scripts/runtime-file-watcher-fault-harness.mjs",
"result": "passed",
"durationSeconds": 0.46,
"summary": "The Electron-as-Node host survived watcher-child SIGSEGV, replaced and resubscribed the child, and delivered a post-crash event."
},
{
"date": "2026-07-13",
"runner": "local",
"platform": "macos",
"command": "pnpm run build:relay",
"result": "passed",
"durationSeconds": 0.38,
"summary": "Relay and adjacent watcher artifacts built for Linux, macOS, and Windows on x64 and arm64, plus the WSL hook relay."
},
{
"date": "2026-07-13",
"runner": "local",
"platform": "macos",
"command": "node config/scripts/relay-watcher-fault-harness.mjs",
"result": "passed",
"durationSeconds": 0.12,
"summary": "The relay and existing PTY survived watcher-child SIGSEGV; replacement delivered overflow and a precise post-crash event."
},
{
"date": "2026-07-13",
"runner": "local",
"platform": "macos",
"command": "pnpm exec vitest run --config config/vitest.config.ts src/main/ipc/parcel-watcher-process.test.ts src/main/ipc/parcel-watcher-disconnect-termination.test.ts src/main/ipc/runtime-watcher-process-pool.test.ts src/main/ipc/parcel-watcher-process-entry.test.ts src/main/ipc/parcel-watcher-event-delivery.test.ts src/main/ipc/filesystem-watcher-local-unsubscribe.test.ts src/main/ipc/filesystem-watcher-wsl.test.ts src/main/ipc/worktrees-delete-pty-teardown.test.ts src/main/ipc/worktrees-orphan-directory-cleanup.test.ts src/main/ipc/worktrees-remove-preflight.test.ts src/main/ipc/worktrees-remove-archive-hooks.test.ts src/main/ipc/watcher-removal-gate.test.ts src/main/runtime/file-watcher-host.test.ts src/main/runtime/orca-runtime-files-watch.test.ts src/main/runtime/worktree-teardown.test.ts src/main/runtime/orca-runtime.test.ts src/main/runtime/rpc/methods/files.test.ts src/main/providers/ssh-filesystem-provider.test.ts src/renderer/src/runtime/runtime-file-client.test.ts src/renderer/src/web/web-runtime-client.test.ts src/shared/cross-platform-path.test.ts src/main/ipc/pty-spawn-cwd-fallback.test.ts src/main/ipc/pty-listener-teardown-and-orphans.test.ts src/main/providers/local-pty-provider-shutdown.test.ts src/main/providers/local-pty-provider-session-inventory.test.ts src/main/daemon/session.test.ts src/main/daemon/terminal-host.test.ts src/main/daemon/terminal-host-session-reaping-leak.test.ts src/main/providers/ssh-pty-provider.test.ts src/relay/pty-handler-dispose-lifecycle.test.ts src/relay/pty-handler-shutdown-signals.test.ts src/relay/pty-handler-spawn-admission.test.ts src/relay/pty-handler-attach-replay.test.ts src/relay/pty-handler-revive.test.ts",
"result": "passed",
"durationSeconds": 9.12,
"summary": "Twenty-five watcher, WSL, desktop/serve removal, local/daemon/SSH PTY physical-exit, provider ownership, RPC, renderer, relay PTY admission, and cross-platform path files passed with 1,762 tests. The suite covers operations joining in-flight termination, kill failures retaining ownership, bounded timeouts, atomic relay spawn/revive caps, and PTY-removal admission."
},
{
"date": "2026-07-13",
"runner": "local",
"platform": "macos",
"command": "node config/scripts/runtime-file-watcher-resource-probe.mjs",
"result": "passed",
"durationSeconds": 0.56,
"summary": "Five healthy roots shared one child at 50,096 KiB RSS and 3.4% sampled CPU; four quarantine children totaled 200,576 KiB RSS and 25.0% sampled CPU. The eight-child physical cap and every per-child/aggregate CPU and RSS budget passed, and exact-PID cleanup was true."
},
{
"date": "2026-07-13",
"runner": "local",
"platform": "macos",
"command": "pnpm exec vitest run --config config/vitest.config.ts src/relay/relay-filesystem-watch-registry.test.ts src/relay/fs-handler.test.ts src/relay/git-handler.test.ts src/relay/subprocess.test.ts src/main/ssh/ssh-relay-versioned-install.test.ts config/scripts/package-electron-runtime-contract.test.mjs",
"result": "passed",
"durationSeconds": 10.69,
"summary": "Six relay registry, filesystem/Git handler, bundled subprocess, install, and package contract files passed with 226 tests, including watcher/PTY removal fencing and recursive deletion failure behavior."
},
{
"date": "2026-07-13",
"runner": "local",
"platform": "macos",
"command": "pnpm run build:electron-vite",
"result": "passed",
"durationSeconds": 24,
"summary": "The production Electron main, preload, renderer, daemon, and watcher child entries built successfully."
},
{
"date": "2026-07-13",
"runner": "local",
"platform": "macos",
"command": "node config/scripts/runtime-file-watcher-fault-harness.mjs",
"result": "passed",
"durationSeconds": 0.01,
"summary": "The Node host survived watcher-child SIGSEGV, replaced and resubscribed the child, and delivered a post-crash event."
},
{
"date": "2026-07-13",
"runner": "local",
"platform": "macos",
"command": "ELECTRON_RUN_AS_NODE=1 pnpm exec electron config/scripts/runtime-file-watcher-fault-harness.mjs",
"result": "passed",
"durationSeconds": 0.46,
"summary": "The Electron-as-Node host survived watcher-child SIGSEGV, replaced and resubscribed the child, and delivered a post-crash event."
},
{
"date": "2026-07-13",
"runner": "local",
"platform": "macos",
"command": "pnpm run build:relay",
"result": "passed",
"durationSeconds": 0.39,
"summary": "Relay and adjacent watcher artifacts built for Linux, macOS, and Windows on x64 and arm64, plus the WSL hook relay."
},
{
"date": "2026-07-13",
"runner": "local",
"platform": "macos",
"command": "node config/scripts/relay-watcher-fault-harness.mjs",
"result": "passed",
"durationSeconds": 0.12,
"summary": "The relay and existing PTY survived watcher-child SIGSEGV; replacement delivered overflow and a precise post-crash event."
},
{
"date": "2026-07-13",
"runner": "local",
"platform": "macos",
"command": "pnpm exec vitest run --config config/vitest.config.ts src/main/ipc/parcel-watcher-process.test.ts src/main/ipc/parcel-watcher-disconnect-termination.test.ts src/main/ipc/runtime-watcher-process-pool.test.ts src/main/ipc/parcel-watcher-process-entry.test.ts src/main/ipc/parcel-watcher-event-delivery.test.ts src/main/ipc/filesystem-watcher-local-unsubscribe.test.ts src/main/ipc/filesystem-watcher-wsl.test.ts src/main/ipc/worktrees-delete-pty-teardown.test.ts src/main/ipc/worktrees-orphan-directory-cleanup.test.ts src/main/ipc/worktrees-remove-preflight.test.ts src/main/ipc/worktrees-remove-archive-hooks.test.ts src/main/ipc/watcher-removal-gate.test.ts src/main/runtime/file-watcher-host.test.ts src/main/runtime/orca-runtime-files-watch.test.ts src/main/runtime/worktree-teardown.test.ts src/main/runtime/orca-runtime.test.ts src/main/runtime/rpc/methods/files.test.ts src/main/providers/ssh-filesystem-provider.test.ts src/renderer/src/runtime/runtime-file-client.test.ts src/renderer/src/web/web-runtime-client.test.ts src/shared/cross-platform-path.test.ts src/main/ipc/pty-spawn-cwd-fallback.test.ts src/main/ipc/pty-listener-teardown-and-orphans.test.ts src/main/daemon/terminal-host.test.ts src/main/daemon/terminal-host-session-reaping-leak.test.ts src/main/providers/ssh-pty-provider.test.ts src/relay/pty-handler-dispose-lifecycle.test.ts src/relay/pty-handler-shutdown-signals.test.ts src/relay/pty-handler-spawn-admission.test.ts src/relay/pty-handler-attach-replay.test.ts src/relay/pty-handler-revive.test.ts",
"result": "passed",
"durationSeconds": 9.03,
"summary": "Twenty-three watcher, desktop/serve removal, terminal-spawn gate, daemon/SSH physical PTY exit, provider ownership, RPC, renderer, and cross-platform path files passed with 1,630 tests. The suite includes same-turn watcher replacement, authoritative SSH teardown before Git, bounded kill-without-exit failures that retain ownership, and local/SSH deletion fail-closed behavior."
},
{
"date": "2026-07-13",
"runner": "local",
"platform": "macos",
"command": "node config/scripts/runtime-file-watcher-resource-probe.mjs",
"result": "passed",
"durationSeconds": 0.55,
"summary": "Five healthy roots shared one child at 50,160 KiB RSS and 5.6% sampled CPU; four quarantine children totaled 199,968 KiB RSS and 16.7% sampled CPU, hard per-child and aggregate RSS/CPU budgets passed, the eight-child reservation cap rejected the next launch, and every exact PID exited during cleanup."
},
{
"date": "2026-07-13",
"runner": "local",
"platform": "macos",
"command": "pnpm exec vitest run --config config/vitest.config.ts src/relay/relay-filesystem-watch-registry.test.ts src/relay/fs-handler.test.ts src/relay/git-handler.test.ts src/relay/subprocess.test.ts src/main/ssh/ssh-relay-versioned-install.test.ts config/scripts/package-electron-runtime-contract.test.mjs",
"result": "passed",
"durationSeconds": 9.79,
"summary": "Six relay registry, filesystem/Git handler, bundled subprocess, install, and package contract files passed with 225 tests, including terminal removal notification and recursive deletion fencing."
},
{
"date": "2026-07-12",
"runner": "local",
"platform": "macos",
"command": "node config/scripts/relay-watcher-fault-harness.mjs",
"result": "passed",
"durationSeconds": 0.61,
"summary": "The relay PID and existing PTY survived watcher-child SIGSEGV; overflow and precise events resumed from a replacement child."
},
{
"date": "2026-07-13",
"runner": "local",
"platform": "macos",
"command": "pnpm exec vitest run --config config/vitest.config.ts src/main/ipc/parcel-watcher-process.test.ts src/main/ipc/parcel-watcher-disconnect-termination.test.ts src/main/ipc/runtime-watcher-process-pool.test.ts src/main/ipc/parcel-watcher-process-entry.test.ts src/main/ipc/parcel-watcher-event-delivery.test.ts src/main/ipc/filesystem-watcher-local-unsubscribe.test.ts src/main/ipc/filesystem-watcher-wsl.test.ts src/main/ipc/worktrees-delete-pty-teardown.test.ts src/main/ipc/worktrees-orphan-directory-cleanup.test.ts src/main/ipc/worktrees-remove-preflight.test.ts src/main/ipc/worktrees-remove-archive-hooks.test.ts src/main/ipc/watcher-removal-gate.test.ts src/main/runtime/file-watcher-host.test.ts src/main/runtime/orca-runtime-files-watch.test.ts src/main/runtime/worktree-teardown.test.ts src/main/runtime/orca-runtime.test.ts src/main/runtime/rpc/methods/files.test.ts src/main/providers/ssh-filesystem-provider.test.ts src/renderer/src/runtime/runtime-file-client.test.ts src/renderer/src/web/web-runtime-client.test.ts src/shared/cross-platform-path.test.ts",
"result": "passed",
"durationSeconds": 8.85,
"summary": "18 focused supervisor, disconnect termination, pool, child-entry, delivery, desktop/WSL cleanup and IPC removal, removal-gate, runtime-host/commands and physical PTY teardown, RPC, SSH ownership, renderer/paired-web clients, and cross-platform path files passed with 1,193 tests."
},
{
"date": "2026-07-12",
"runner": "local",
"platform": "macos",
"command": "node config/scripts/runtime-file-watcher-fault-harness.mjs",
"result": "passed",
"durationSeconds": 5,
"summary": "All 26 built-entry SIGSEGV injections preserved the parent, replaced and resubscribed the child, and delivered a post-crash event; watcher-canary temp-directory count remained 6 before and after the final five-run leak check."
},
{
"date": "2026-07-11",
"runner": "local",
"platform": "macos",
"command": "node config/scripts/runtime-file-watcher-fault-harness.mjs",
"result": "passed",
"durationSeconds": 0.3,
"summary": "The source-bundled real supervisor delivered through the built child before and after SIGSEGV; the parent survived and automatic resubscription used a replacement PID."
},
{
"date": "2026-07-11",
"runner": "local",
"platform": "macos",
"command": "node config/scripts/runtime-file-watcher-fault-harness.mjs",
"result": "passed",
"durationSeconds": 2.2,
"summary": "Ten consecutive invocations survived, automatically replaced and resubscribed the child, and delivered a post-crash event. The watcher-canary temp-directory count remained 8 before and after the loop."
}
],
"runtimeBudget": {
"p95Seconds": 60,
"scope": "focused process/RPC contract tests plus built child fault harness"
},
"flakeHistory": {
"status": "unknown",
"evidence": "New deterministic unit coverage and ten consecutive local built-entry harness passes; still below the CI and soak history required for promotion."
},
"redGreenEvidence": {
"status": "partial",
"evidence": "Red tests reproduced the reviewed failures: IPC disconnect-before-exit orphaned existing roots, queue-admission deadlines cascaded shard replacement, a fused shard created one child per root, a standard SSH repository created three healthy watcher supervisors, destructive desktop cleanup waited indefinitely for native setup, and synchronous renderer retry joined a terminal stream. Earlier red coverage also reproduced missing-entry fail-open, terminal recovery loss, stale same-root lease deletion, and unbounded per-child stat lanes. The bounded quarantine and cancellation rewrite passes those contracts, the relay-specific healthy width test reduces the three-root case to one supervisor, and the real-supervisor built-entry harness survives SIGSEGV with automatic replacement. CI/soak history is still absent."
},
"performanceBudget": {
"required": true,
"evidence": "The committed resource probe reproducibly measures five healthy roots sharing one child (50,160 KiB RSS, 5.6% sampled CPU) and four quarantine children (199,968 KiB total RSS, 16.7% sampled CPU), enforces 128 MiB/50% per-child and 512 MiB/100% quarantine aggregate budgets, derives a 1 GiB/400% ceiling across the global eight-physical-child cap, and waits for every exact PID during cleanup. A relay policy test separately proves a standard SSH repository's three roots share one healthy child. Shared pending setup attaches one base-promise reaction per generation; quantitative owner tests abort 10,000 callers at each affected layer and require exactly one anchor, then zero explicit waiters after settlement. The shared supervisor capacity barrier is event-driven, one-shot, abortable, and serialized per released physical slot, waking every same-child desktop, paired-runtime, or SSH relay root without consuming crash-recovery attempts; direct WSL capacity retains the same event-driven desktop retry. Relay PTY admission adds at most two deduplicated path checks per spawn/revive and releases both without polling or retained listeners, while dead-PID reaping settles an existing tracker without allocating another timer. Fault quarantine distributes affected roots by least load, disposes empty slots, and permits no replacement after a quarantine shard itself fuses. Each child caps directory stats at eight across its assigned roots (at most eight healthy or 32 quarantined operations), each subscription retains at most one active plus one bounded pending batch, and no additional polling or serve-process stat fanout is added."
},
"promotionCriteria": [
"Run the built-entry SIGSEGV harness in soak for at least 100 consecutive passes or 14 days on macOS.",
"Add an eight-root/six-writer event-loop-delay soak artifact with an explicit latency budget.",
"Add a packaged orca serve pairing scenario that proves a connected client refreshes after child replacement."
],
"knownGaps": [
"The fault harness bundles the real source supervisor and drives the built child, but it does not launch a packaged orca serve pairing session or exercise app.asar path resolution.",
"The committed resource probe covers the one-child healthy pool, four-child fault-quarantine ceiling, RSS/CPU sampling, global physical-child cap, and exact-PID cleanup, but sustained six-writer event-loop-delay and CPU soak evidence is still absent.",
"Linux native watcher fault containment is source-equivalent but not live fault-injected in this evidence run.",
"Windows native runtime watches bypass this child path; WSL reservation/release is deterministic-contract tested but not live fault-injected, and SSH registration ownership is not live-relay fault-injected."
],
"demotionRule": "Demote or quarantine if the fault harness flakes without a product or harness bug, if healthy operation exceeds one runtime watcher child, if total physical operation exceeds eight children including retiring generations, if quarantine children outlive their roots or repeat after fusing, if event delivery becomes unbounded, or if metadata/stat work returns to the serve process."
},
{
"id": "terminal-input.plugin-explicit-worktree-routing",
"title": "Plugin terminal input stays inside the freshly resolved worktree",
"maturity": "experimental",
"protection": "partial",
"owner": "plugin-platform",
"layer": "main-relay-contract",
"surfaces": [
"plugin host API terminal input",
"active worktree resolution",
"provider terminal inventory",
"relay capability enforcement"
],
"platforms": ["macos", "linux", "windows"],
"providers": ["local", "daemon", "ssh", "wsl", "remote-runtime", "mobile-relay"],
"coveredPlatforms": ["macos"],
"coveredProviders": ["local", "ssh"],
"coverageNotes": "Deterministic macOS contract evidence covers opaque local- and SSH-shaped terminal ids, one bounded worktree listing, mismatch rejection, and the main/relay host-call adapter matrix. It does not launch a live PTY or provision a relay-hosted plugin.",
"motivatingLinks": ["https://github.com/stablyai/orca/pull/8549"],
"invariant": "terminal.sendText accepts only an explicit provider-owned terminal id present in one bounded inventory of the worktree resolved immediately before the send; an absent id causes zero send calls, and relay callers cannot supply their own capability grants or transport classification.",
"oracle": "Resolve the active worktree once, list that worktree with the v0 terminal cap once, and assert zero sendTerminal calls for a mismatched opaque id versus exactly one send for matching local- and SSH-shaped ids; then run the same permission and schema cases through desktop-main and registered relay panel/worker adapters and compare error codes.",
"commands": [
"pnpm exec vitest run --config config/vitest.config.ts src/main/plugins/plugin-host-methods.test.ts src/main/plugins/plugin-host-conformance.test.ts"
],
"testFiles": [
"src/main/plugins/plugin-host-methods.test.ts",
"src/main/plugins/plugin-host-conformance.test.ts"
],
"assertionRefs": [
{
"file": "src/main/plugins/plugin-host-methods.test.ts",
"assertions": [
"a terminal outside the freshly resolved worktree performs one capped list and zero sends",
"matching local- and SSH-shaped opaque ids each perform one capped list and one exact send",
"workspace.readContext drops provider paths, path-bearing internal worktree ids, and terminal titles while capping its terminal projection"
]
},
{
"file": "src/main/plugins/plugin-host-conformance.test.ts",
"assertions": [
"all 13 v0 methods succeed with the required consented capability through desktop-main and relay adapters",
"missing consent, missing capability, unknown method, malformed params, panel-forbidden access, malformed results, and mutation-audit failure return identical codes",
"malformed qualified keys, client-supplied grants, and client-supplied transport flags are rejected before host policy resolution"
]
}
],
"evidenceRuns": [
{
"date": "2026-07-10",
"runner": "local",
"platform": "macos",
"command": "pnpm exec vitest run --config config/vitest.config.ts src/main/plugins/plugin-host-methods.test.ts src/main/plugins/plugin-host-conformance.test.ts",
"result": "passed",
"durationSeconds": 0.18,
"summary": "2 files and 17 tests passed, covering the 13-method main/relay conformance matrix and exact terminal routing call counts."
}
],
"runtimeBudget": {
"p95Seconds": 10,
"scope": "plugin host main/relay contract tests"
},
"flakeHistory": {
"status": "unknown",
"evidence": "The deterministic focused suite passed locally once and needs CI and soak history before promotion."
},
"redGreenEvidence": {
"status": "partial",
"evidence": "Exact mismatch/send counts and adapter error parity are asserted; intentional-break and saved CI evidence are still missing."
},
"performanceBudget": {
"required": true,
"evidence": "Each plugin send resolves once, performs exactly one list capped at 50 terminals, and performs at most one send. The path adds no polling, subprocesses, provider fanout, renderer work, or startup await."
},
"promotionCriteria": [
"Run for at least 100 consecutive passes or 14 days across required CI platforms.",
"Attach intentional-break evidence for the worktree membership check and relay transport binding.",
"Exercise live local and SSH provider terminals, including mismatch rejection and successful input echo.",
"Keep relay-hosted plugin provisioning behind a separate reviewed policy before replacing the fail-closed registration."
],
"knownGaps": [
"Linux and Windows execution evidence is not recorded.",
"Daemon, WSL, remote-runtime, and mobile-relay providers have no live input evidence.",
"Local and SSH coverage is contract-level over opaque ids, not a live PTY input/echo run.",
"The bounded 50-terminal inventory intentionally rejects a target not present in the capped result; scale behavior above that cap needs a targeted membership API before expansion.",
"Relay-hosted plugin provisioning, consent persistence, workers, and audit services remain out of scope and the relay registration therefore denies every provisioned identity by default."
],
"demotionRule": "Keep experimental or demote to protection none if the suite flakes, permits a mismatched terminal send, performs more than one inventory list per call, accepts client-supplied grants, or relay and desktop error codes diverge."
},
{
"id": "ssh-port-forward.renderer-snapshot-continuity",
"title": "SSH forwarded-port state survives stale renderer hydration",
"maturity": "experimental",
"protection": "partial",
"owner": "desktop-ssh",
"layer": "renderer-ssh-snapshot-reconciliation",
"surfaces": [
"SSH Ports panel",
"forwarded-port renderer state",
"persisted forward restoration",
"ssh2 port forwarding",
"system-SSH port forwarding"
],
"platforms": ["macos", "linux", "windows"],
"providers": ["ssh2", "system-ssh"],
"coveredPlatforms": ["macos"],
"coveredProviders": ["ssh2", "system-ssh"],
"coverageNotes": "A deterministic renderer ordering test covers stale initial snapshots independently by target and stream, including hydration after partial SSH authority reconciliation. Headed macOS Electron tests force the same startup hydration race and use an ephemeral Docker sshd, a real remote Git worktree, real remote Node listeners, real HTTP forwards, in-place relay and full transport reconnect restoration, collision rejection, scan refresh, explicit removal, and an unrelated surviving forward through both transports. The forced-system run requires a recorded OpenSSH -L invocation.",
"motivatingLinks": ["user-reported SSH Ports panel disappearance"],
"invariant": "For one connected SSH authority, a renderer snapshot may update Forwarded or Detected state only if no newer push for that target and stream arrived after the snapshot began. Active tunnels and persisted intent remain authoritative through scan refresh and reconnect until explicit removal or a real connection-lifecycle transition.",
"oracle": "Hold empty initial Forwarded and Detected snapshot promises, publish live events, release the snapshots, and require each target and stream to preserve only its own newer push while applying unaffected snapshots. Reject one target's Detected snapshot and require its Forwarded snapshot plus later targets to hydrate independently. Begin another target with partial connected authority and require its snapshots to hydrate after same-watermark authority reconciliation. In headed Electron, hold an authoritative empty Forwarded snapshot across renderer reload, add a forward through the Ports panel, release and confirm the wrapped main handler resumed, then complete a later renderer-to-main listPortForwards round trip as the ordered hydration-continuation barrier. Before checking the Forwarded row, require main inventory, persisted intent, HTTP, remote process identity, and close warnings to prove the tunnel remained authoritative. Then forward two real Docker listeners, refresh detection, force an in-place relay-channel reconnect, perform a full transport reconnect, reject a bound local-port collision, remove one row, and require all signals to agree.",
"commands": [
"pnpm exec vitest run --config config/vitest.config.ts src/renderer/src/hooks/useIpcEvents-agent-status-ssh-authority.test.ts src/main/ssh/ssh-port-forward.test.ts src/main/ssh/system-ssh-forward-process.test.ts src/main/ipc/ssh.test.ts src/main/ssh/ssh-relay-session.test.ts tests/e2e/helpers/ssh-port-forward-snapshot-barrier.unit.test.ts --reporter=dot",
"pnpm exec electron-vite build --mode e2e",
"ORCA_E2E_SSH_DOCKER=1 ORCA_E2E_FORWARD_APP_LOGS=1 SKIP_BUILD=1 pnpm exec playwright test tests/e2e/ssh-port-forward-lifecycle.spec.ts --config tests/playwright.config.ts --project electron-headful --workers=1",
"ORCA_E2E_SSH_DOCKER=1 ORCA_SSH_FORCE_SYSTEM_TRANSPORT=1 ORCA_E2E_FORWARD_APP_LOGS=1 SKIP_BUILD=1 pnpm exec playwright test tests/e2e/ssh-port-forward-lifecycle.spec.ts --config tests/playwright.config.ts --project electron-headful --workers=1"
],
"testFiles": [
"src/renderer/src/hooks/useIpcEvents-agent-status-ssh-authority.test.ts",
"src/main/ssh/ssh-port-forward.test.ts",
"src/main/ssh/system-ssh-forward-process.test.ts",
"src/main/ipc/ssh.test.ts",
"src/main/ssh/ssh-relay-session.test.ts",
"tests/e2e/helpers/ssh-port-forward-snapshot-barrier.unit.test.ts",
"tests/e2e/ssh-port-forward-lifecycle.spec.ts"
],
"assertionRefs": [
{
"file": "src/renderer/src/hooks/useIpcEvents-agent-status-ssh-authority.test.ts",
"assertions": ["does not let initial SSH port snapshots overwrite newer push events"]
},
{
"file": "src/main/ssh/ssh-port-forward.test.ts",
"assertions": ["lists forwards filtered by connectionId", "removes a forward by id"]
},
{
"file": "src/main/ssh/system-ssh-forward-process.test.ts",
"assertions": [
"does not spawn ssh when the requested local forward port is already in use",
"sends SIGTERM then SIGKILL when the process does not exit",
"does not resolve stop until the process exits"
]
},
{
"file": "src/main/ipc/ssh.test.ts",
"assertions": [
"preserves active port forwards and live connections across handler re-registration",
"persists desired forwards and broadcasts when an active forward closes unexpectedly"
]
},
{
"file": "src/main/ssh/ssh-relay-session.test.ts",
"assertions": ["cleans up port forwards on reconnect"]
},
{
"file": "tests/e2e/helpers/ssh-port-forward-snapshot-barrier.unit.test.ts",
"assertions": ["holds only the first matching request while its snapshot is unresolved"]
},
{
"file": "tests/e2e/ssh-port-forward-lifecycle.spec.ts",
"assertions": ["keeps a user-forwarded listener live across scan refresh @headful"]
}
],
"evidenceRuns": [
{
"date": "2026-07-30",
"runner": "local",
"platform": "macos",
"command": "pnpm exec vitest run --config config/vitest.config.ts src/renderer/src/hooks/useIpcEvents-agent-status-ssh-authority.test.ts src/main/ssh/ssh-port-forward.test.ts src/main/ssh/system-ssh-forward-process.test.ts src/main/ipc/ssh.test.ts src/main/ssh/ssh-relay-session.test.ts tests/e2e/helpers/ssh-port-forward-snapshot-barrier.unit.test.ts --reporter=dot",
"result": "passed",
"durationSeconds": 6.77,
"summary": "Six renderer, main-process, and barrier lifecycle files passed with 215 tests, including deterministic stale-snapshot, rejected-stream, partial-authority, and single-capture isolation plus existing collision, delayed-exit, reconnect, persistence, re-registration, and unrelated-forward contracts."
},
{
"date": "2026-07-30",
"runner": "local",
"platform": "macos",
"command": "ORCA_E2E_SSH_DOCKER=1 ORCA_E2E_FORWARD_APP_LOGS=1 SKIP_BUILD=1 pnpm exec playwright test tests/e2e/ssh-port-forward-lifecycle.spec.ts --config tests/playwright.config.ts --project electron-headful --workers=1",
"result": "passed",
"durationSeconds": 53.7,
"summary": "Headed Electron passed against a real Docker sshd over ssh2 after forcing the stale startup-snapshot race and exact renderer-continuation barrier, with two remote listeners, scan refresh, in-place relay and full transport reconnect restoration, collision rejection, explicit removal, independent state inventories, HTTP responses, process identity, and no live forward-close warning."
},
{
"date": "2026-07-30",
"runner": "local",
"platform": "macos",
"command": "ORCA_E2E_SSH_DOCKER=1 ORCA_SSH_FORCE_SYSTEM_TRANSPORT=1 ORCA_E2E_FORWARD_APP_LOGS=1 SKIP_BUILD=1 pnpm exec playwright test tests/e2e/ssh-port-forward-lifecycle.spec.ts --config tests/playwright.config.ts --project electron-headful --workers=1",
"result": "passed",
"durationSeconds": 66,
"summary": "The identical stale-snapshot and headed lifecycle passed through forced system OpenSSH, with a wrapper marker proving the -L forward process executed; in-place relay and full transport reconnects restored both intents, no unexpected forward close was captured before assertions, and intentional removal completed."
}
],
"runtimeBudget": {
"p95Seconds": 180,
"scope": "focused renderer/main contracts plus two headed Docker SSH transport runs"
},
"flakeHistory": {
"status": "unknown",
"evidence": "The deterministic contract and both real transport runs passed locally; CI and soak history are not yet available."
},
"redGreenEvidence": {
"status": "complete",
"evidence": "The identical renderer unit and headed Electron oracles fail on current main because the stale empty hydration reply becomes a second and final Forwarded write, pass with bounded per-target per-stream pending-hydration state, fail again when only that fix is removed, and pass again after restoration. In the tightened headed revert, both transports first proved main inventory, persisted intent, HTTP, remote process identity, no live close warning, and renderer continuation, then failed only at the missing Forwarded-row assertion. Both passed after rebuilding the restored candidate."
},
"performanceBudget": {
"required": true,
"evidence": "The fix adds one effect-scoped map containing only unresolved target hydrations, one O(1) boolean write per relevant existing push event, and one O(1) authority/stream check per initial snapshot. Forwarded and Detected hydrate independently so a stalled stream does not block its peer or later targets; entries are removed after both settle. It adds no polling, timers, IPC calls, scans, subprocesses, or renderer subscriptions."
},
"promotionCriteria": [
"Collect 100 consecutive focused CI passes or 14 days of soak history.",
"Run the headed topology on Linux and Windows with their native system-SSH clients.",
"Re-run the headed snapshot barrier after Electron major-version upgrades.",
"Keep the independent Forwarded and Detected freshness assertions and both transport runs green."
],
"knownGaps": [
"Headed live evidence is macOS-only; Linux and Windows system-SSH clients were not exercised.",
"The headed race uses Electron's private invoke-handler registry to delay the real listPortForwards handler because Electron exposes no public handler-wrapping API.",
"The live run reconnects an existing app session but does not restart the packaged application from disk.",
"The live topology uses an SSH Git worktree; folder-workspace behavior is covered by target-scoped renderer reconciliation rather than a second headed topology."
],
"demotionRule": "Keep experimental or demote if same-authority snapshots can overwrite newer pushes, reconnect silently loses persisted intent, one forward operation disturbs unrelated forwards, live HTTP diverges from renderer/main inventory, or either transport topology flakes without an identified product or harness fault."
},
{
"id": "remote-wire.cross-version-terminal-journey",
"title": "A released client and a current server still complete one terminal journey in both skew directions",
"maturity": "experimental",
"protection": "partial",
"owner": "remote-runtime",
"layer": "cross-version-protocol-integration",
"surfaces": [
"terminal binary stream framing",
"terminal multiplex subscribe handshake and capability negotiation",
"host-published snapshot and output projection",
"remote terminal reconnect"
],
"platforms": ["macos", "linux", "windows"],
"providers": ["paired-runtime"],
"coveredPlatforms": ["macos"],
"coveredProviders": ["paired-runtime"],
"coverageNotes": "Loads the real host RPC methods, the real RpcDispatcher, and the real renderer terminal multiplexer from two builds (current working tree and the newest release tag) and drives them against each other over an in-process transport that reproduces production frame routing, including the host-side decode that silently drops unknown opcodes. Covers the terminal stream only; the session-tab sync channel, agent-session publications, file/Git RPCs, mobile E2EE framing, and the relay transport are uncovered.",
"motivatingLinks": [
"https://github.com/stablyai/orca/pull/12641",
"https://github.com/stablyai/orca/pull/12655"
],
"invariant": "A client and a server built from different releases must complete subscribe, input delivery to the process, hide/reveal buffer snapshot, transport drop, and resubscribe with no frame refused by the receiving build's decoder, the same negotiated capabilities, and the same published snapshot content — so a new optional field stays safe, a new opcode is only sent after negotiation, and a change in what the host publishes is visible before release.",
"oracle": "Run one fixed journey per pairing (old client/new server, new client/old server, and current/current as control) and assert the recorded step list, the exact named frame sequence, both subscribed events with their negotiated capabilities, the exact input texts the host wrote to the PTY before and after reconnect, the rendered snapshot and live-output content, and an empty set of decoder-rejected frames in either direction. Missing host runtime methods are reported by name so a harness gap can never be read as a wire incompatibility.",
"commands": [
"pnpm exec vitest run --config config/vitest.config.ts tests/e2e/cross-version-wire/cross-version-terminal-wire.unit.test.ts"
],
"testFiles": ["tests/e2e/cross-version-wire/cross-version-terminal-wire.unit.test.ts"],
"assertionRefs": [
{
"file": "tests/e2e/cross-version-wire/cross-version-terminal-wire.unit.test.ts",
"assertions": [
"expect(record.completed).toEqual([...JOURNEY_STEPS])",
"expect(record.frameSequence).toEqual(EXPECTED_JOURNEY_FRAMES)",
"expect(record.rejected).toEqual([])",
"expect(record.inputAtProcess).toEqual([JOURNEY_INPUTS.first, JOURNEY_INPUTS.second])",
"expect(event.capabilities).toEqual({ outputPause: 1 })"
]
}
],
"evidenceRuns": [
{
"date": "2026-08-05",
"runner": "local",
"platform": "macos",
"result": "passed",
"command": "pnpm exec vitest run --config config/vitest.config.ts tests/e2e/cross-version-wire/cross-version-terminal-wire.unit.test.ts",
"durationSeconds": 6,
"summary": "v1.4.169 against working tree c4d5a535f2; all three pairings produced the identical 16-frame journey with zero rejected frames."
}
],
"runtimeBudget": {
"p95Seconds": 60,
"scope": "one baseline checkout extraction plus three in-process journeys"
},
"flakeHistory": {
"status": "not-started",
"evidence": "New gate; no soak history yet. The journey uses observed-state barriers only, with no sleeps or elapsed-time oracles."
},
"redGreenEvidence": {
"status": "complete",
"evidence": "Red proven separately for each rule by injecting the violation into the working tree and reverting it. Rule 2: adding opcode 17 and sending it ungated from the client turned new-client/old-server red with rejected rawOpcode 17 in the client-to-host direction, while old-client/new-server stayed green. Rule 3: making the host stop publishing the snapshot `source` field turned both new-server pairings red and left the old-server pairing green; trimming the published initial buffer removed the SnapshotChunk frame and failed the frame-sequence oracle. Rule 1: adding an optional `hiddenOutputReason` field to the snapshot frame kept all pairings green, and making the client require that field turned only new-client/old-server red."
},
"performanceBudget": {
"required": false,
"evidence": "Test-only infrastructure; it adds no product code path. The extracted baseline tree is cached by resolved commit, so repeat runs skip extraction and each journey completes in roughly 35ms."
},
"promotionCriteria": [
"Extend the matrix beyond two version points, for example the previous two minor releases.",
"Cover a second wire surface, starting with the session-tab sync channel that PR #12641 changed.",
"Collect 100 consecutive CI passes on the dedicated cross-version-wire job.",
"Run the job on Linux and Windows runners, not only macOS locally."
],
"knownGaps": [
"Only the terminal stream is covered; session tabs, agent sessions, file/Git RPCs, mobile E2EE framing, and the relay transport are not.",
"Only two version points are compared, so a regression introduced and reverted between them is invisible.",
"The host runtime is a stub around a fake PTY, so real PTY, daemon, and SSH provider behavior is out of scope.",
"The baseline is the newest release tag by default, so the compared pair changes when a new release is cut unless ORCA_CROSS_VERSION_BASELINE_REF pins it.",
"tests/ is outside every tsconfig include, so the harness is linted and executed but not typechecked."
],
"demotionRule": "Demote if the baseline checkout cannot be materialized in CI, if a pairing has to be skipped to keep the lane green, or if the journey stops asserting the full step list and frame sequence."
},
{
"id": "codex.state-db-backfill-recovery-bounds",
"title": "Codex state DB backfill recovery has bounded process and timer use",
"maturity": "experimental",
"protection": "partial",
"owner": "codex-runtime",
"layer": "main-process-supervisor",
"surfaces": [
"Codex state DB backfill recovery",
"managed Codex home startup",
"Codex PTY and rate-limit recovery triggers"
],
"platforms": ["macos", "linux", "windows"],
"providers": ["local", "wsl", "paired-runtime-host"],
"coveredPlatforms": ["macos"],
"coveredProviders": ["local", "wsl"],
"coverageNotes": "A deterministic injected claimant and clock cover exits before and after the former ten-second classification boundary, exact spawn/poll/backoff counts, transient exit and spawn-error recovery, owner-lock reacquisition, WSL routing, and cleanup. Live Windows, WSL, and paired-runtime-host process evidence remains uncollected.",
"motivatingLinks": ["https://github.com/stablyai/orca/releases/tag/v1.4.177-rc.0"],
"invariant": "One authoritative Codex state DB backfill supervisor spawns at most five claimants regardless of process lifetime, retains at most one child and one timer, rejects later automatic restarts after claimant exhaustion, and bounds pre-claim coordinator failures to five triggers while transient claimant and owner-lock failures can recover within those budgets.",
"oracle": "Use an injected process and clock to exit every claimant at 10,001ms without waiting. Permanent failure must give up after five spawns and exits with exactly 15 poll timers and four backoffs, no live child or pending timer, and no safety-fuse abort; repeated triggers must reuse the exhausted result with zero new lock or runner calls. Separately fail twice at 10,001ms and complete on the third claimant, recover from a first-spawn error on attempt two, reacquire after a transient owner-lock failure, and cap permanent lock-root failures at five attempts across six triggers.",
"commands": [
"pnpm exec vitest run --config config/vitest.config.ts src/main/codex/codex-state-db-backfill-recovery.test.ts"
],
"testFiles": ["src/main/codex/codex-state-db-backfill-recovery.test.ts"],
"assertionRefs": [
{
"file": "src/main/codex/codex-state-db-backfill-recovery.test.ts",
"assertions": [
"does not restart an exhausted supervisor when later triggers arrive",
"releases a completed supervisor entry",
"releases a failed owner-lock attempt for later arbitration",
"bounds permanent coordinator failures across later triggers",
"bounds permanent claimant exits just beyond the fast-failure window",
"recovers after claimant exits just beyond the old fast-failure window",
"recovers after a transient process spawn error",
"routes a WSL managed home through its distro and Linux CODEX_HOME",
"does not interfere with a live supervisor from another Orca instance"
]
}
],
"evidenceRuns": [
{
"date": "2026-08-07",
"runner": "local",
"platform": "macos",
"result": "passed",
"command": "pnpm exec vitest run --config config/vitest.config.ts src/main/codex/codex-state-db-backfill-recovery.test.ts",
"durationSeconds": 0.4,
"summary": "Twelve deterministic recovery and owner-lock tests passed, including exact permanent and transient 10,001ms exit accounting, spawn-error recovery, trigger-level exhaustion memoization, bounded coordinator failure, successful owner-lock reacquisition, and zero retained children or timers."
}
],
"runtimeBudget": {
"p95Seconds": 2,
"scope": "deterministic main-process supervisor and owner-lock contract"
},
"flakeHistory": {
"status": "not-started",
"evidence": "New fake-clock gate; no arbitrary sleeps or elapsed wall-time oracle."
},
"redGreenEvidence": {
"status": "complete",
"evidence": "The byte-identical production source at release commit 9e948fbdf462ede3c0160c719474100fc5cbefb7 and origin/main spawned six claimants and reached the harness fuse with 18 polls and six backoffs. The candidate gives up after five claimants with 15 polls and four backoffs; removing the total-spawn cap restores the exact red result."
},
"performanceBudget": {
"required": true,
"evidence": "The supervisor retains at most one claimant and one awaited timer. A permanent process lifetime is bounded to five subprocesses, 15 status polls, and four backoffs; later triggers reuse one settled promise and spawn nothing. Pre-claim coordinator failures perform at most five status/lock attempts. The fix adds no polling, listener, provider call, scan, wire field, or hot-path work."
},
"promotionCriteria": [
"Collect 100 consecutive focused CI passes or 14 days of soak history.",
"Collect live Windows/WSL and paired-runtime-host recovery evidence.",
"Keep exact spawn, exit, timer, backoff, cleanup, and transient-recovery assertions green."
],
"knownGaps": [
"Live child-process behavior is represented by an injected EventEmitter claimant.",
"Physical Windows, WSL, SSH, and paired-runtime-host journeys were not run."
],
"demotionRule": "Demote if any exit duration can evade the spawn budget, concurrent children or timers appear, cleanup retains resources, or a transient failure cannot recover within the budget."
},
{
"id": "runtime.headless-serve-graceful-signal-exit",
"title": "Packaged headless Linux serve exits cleanly after foreground signals",
"maturity": "experimental",
"protection": "partial",
"owner": "runtime-platform",
"layer": "electron-headless-quit-lifecycle",
"surfaces": ["packaged Linux AppImage", "headless orca serve", "owned Xvfb lifecycle"],
"platforms": ["linux"],
"providers": ["local-daemon"],
"coveredPlatforms": ["linux"],
"coveredProviders": ["local-daemon"],
"coverageNotes": "An Ubuntu 26.04 amd64 container extracts the packaged AppImage into disposable HOME and XDG directories, leaves APPDIR unset to preserve extracted-AppRun direct serve mode, waits for structured serve readiness, then exercises terminal-style foreground-process-group SIGINT and the documented systemd KillMode=mixed main-PID SIGTERM in separate containers. Local evidence runs under Rosetta on an arm64 Docker host; native amd64 PR CI repeats the same foreground AppRun identity contract.",
"motivatingLinks": [
"https://github.com/stablyai/orca/issues/14109",
"https://linear.app/stably/issue/STA-4051"
],
"invariant": "After packaged foreground headless serve publishes structured readiness, one SIGINT or SIGTERM exits successfully without an Electron fatal trap or core evidence, releases the exact listener and owned Xvfb/process tree, and leaves an unrelated process identity untouched.",
"oracle": "For each signal, start a fresh unprivileged Ubuntu 26.04 container with disposable profile and runtime directories, a random loopback port, DISPLAY unset, software GL, and the extracted AppImage in a fresh session. Wait for orca_server_ready schema version 1, record the listener owner, process tree, owned Xvfb, and unrelated canary identities, deliver SIGINT to the foreground process group or the documented KillMode=mixed graceful SIGTERM to the AppRun PID, then require wait status zero, no Failed to shutdown, SIGTRAP, core, listener, recorded descendant, profile/AppImage/Xvfb residue, or changed canary identity. The 30-second bounds are failure deadlines, never success conditions.",
"commands": [
"pnpm exec vitest run --config config/vitest.config.ts src/main/startup/ensure-virtual-display.test.ts config/scripts/headless-serve-shutdown-workflow.test.mjs --reporter=dot",
"shellcheck config/docker/headless-serve-shutdown/run-signal-case.sh",
"node config/scripts/run-headless-serve-shutdown-docker.mjs --appimage dist/orca-linux.AppImage",
"node config/scripts/run-headless-serve-shutdown-docker.mjs --appimage dist/orca-linux.AppImage --platform linux/amd64"
],
"testFiles": [
"src/main/startup/ensure-virtual-display.test.ts",
"config/scripts/headless-serve-shutdown-workflow.test.mjs",
"config/scripts/run-headless-serve-shutdown-docker.mjs",
"config/docker/headless-serve-shutdown/run-signal-case.sh"
],
"assertionRefs": [
{
"file": "src/main/startup/ensure-virtual-display.test.ts",
"assertions": [
"owned Xvfb starts with terminate-after-last-client semantics",
"owned Xvfb uses an independent process group so terminal Ctrl-C cannot preempt Electron teardown",
"owned Xvfb retains an early-process-exit guard until Electron is ready",
"owned Xvfb is not stopped from Electron's cancelable will-quit event",
"external displays and non-Linux startup remain untouched"
]
},
{
"file": "config/scripts/headless-serve-shutdown-workflow.test.mjs",
"assertions": [
"PR CI builds an x64 AppImage before invoking the packaged shutdown oracle",
"the documented systemd unit uses KillMode=mixed so graceful TERM targets Orca before its owned Xvfb"
]
},
{
"file": "config/scripts/run-headless-serve-shutdown-docker.mjs",
"assertions": [
"SIGINT and SIGTERM run in separate disposable containers",
"both signal failures are reported before the oracle exits",
"the exact AppImage SHA-256, entrypoint, and signal target are published",
"the launcher exec overlay isolates the related STA-4017 signal boundary"
]
},
{
"file": "config/docker/headless-serve-shutdown/run-signal-case.sh",
"assertions": [
"SIGINT reaches the isolated foreground process group while owned Xvfb stays in its own group",
"SIGTERM reaches the exact AppRun PID under the documented systemd KillMode=mixed policy",
"target and descendant identities are fenced by PID start ticks before signaling and residue checks"
]
}
],
"evidenceRuns": [
{
"date": "2026-08-13",
"runner": "local",
"platform": "linux",
"command": "pnpm exec vitest run --config config/vitest.config.ts src/main/startup/ensure-virtual-display.test.ts config/scripts/headless-serve-shutdown-workflow.test.mjs --reporter=dot",
"result": "passed",
"durationSeconds": 1,
"summary": "The focused startup and workflow contracts passed with owned-display termination semantics and native amd64 CI wiring."
},
{
"date": "2026-08-13",
"runner": "local",
"platform": "linux",
"command": "node config/scripts/run-headless-serve-shutdown-docker.mjs --appimage dist/orca-linux.AppImage --platform linux/amd64",
"result": "passed",
"durationSeconds": 48,
"summary": "The extracted candidate AppRun passed process-group SIGINT and systemd-mixed main-PID SIGTERM under Ubuntu 26.04 amd64 emulation with status zero, no fatal evidence, full listener/Xvfb/tree cleanup, and an unchanged canary identity."
}
],
"runtimeBudget": {
"p95Seconds": 240,
"scope": "two fresh Ubuntu 26.04 containers, one per foreground signal"
},
"flakeHistory": {
"status": "not-started",
"evidence": "The event- and identity-driven harness is new; soak history is not yet available."
},
"redGreenEvidence": {
"status": "complete",
"evidence": "The byte-identical Docker oracle failed process-group SIGINT and main-PID SIGTERM on v1.4.180 AppImage af3b6e6a67fc, launch-day main AppImage 017ff5abc35a, and candidate-with-fix-disabled AppImage f409f58dd9c3 with wait status 133 plus Electron Failed to shutdown and SIGTRAP. The prior candidate 5b94b86a9879 passed PID signals but failed process-group SIGINT with status 133, proving Xvfb also needed an independent process group. Final candidate AppImage 5c82936043e4 passed process-group SIGINT and the documented systemd KillMode=mixed main-PID SIGTERM with status zero and complete cleanup. A control-group TERM that also targets Xvfb remains red, proving KillMode=mixed is required for the documented owned-Xvfb unit. Applying PR #14071's launcher exec semantics with PID delivery left v1.4.180 red and the candidate green, proving the launcher and Electron/Xvfb fixes are independent and composable."
},
"performanceBudget": {
"required": true,
"evidence": "The product change adds one standard Xvfb startup flag, isolates the existing Xvfb child from foreground process-group signals, replaces one Electron lifecycle listener with a process listener that is removed at ready, and adds no polling, timer, subprocess, IPC, provider fanout, renderer work, retained payload, native dependency, or recurring hot-path work. After ready, Xvfb exits from its existing client-disconnect path."
},
"promotionCriteria": [
"Collect 100 consecutive native amd64 CI or soak passes or 14 days without an unexplained flake.",
"Collect one native Ubuntu 26.04 AppRun signal run with foreground wait status zero for both signals.",
"Keep exact listener, Xvfb, descendant, fatal-evidence, and canary identity assertions green."
],
"knownGaps": [
"The local arm64 Docker host uses Rosetta for amd64 containers; native amd64 PR CI supplies the non-emulated repeat of the same extracted-AppRun PID contract.",
"Ubuntu 20.04 is covered by the packaged native-binary glibc floor gate; this lifecycle journey runs on the reported Ubuntu 26.04 topology.",
"Systemd units that override or omit the documented KillMode=mixed policy can still terminate owned Xvfb before Electron disconnects.",
"The harness exercises foreground headless Linux shutdown and does not replace desktop, updater, SSH, or detached PTY lifecycle coverage."
],
"demotionRule": "Keep experimental or demote if either signal traps, returns nonzero, retains its listener/Xvfb/run-owned process identity, touches the unrelated canary, or the focused gate flakes without an identified product or harness defect."
},
{
"id": "ssh-managed-hooks.node18-runtime-compatibility",
"title": "SSH managed-hook companions load and install hooks on Node 18",
"maturity": "experimental",
"protection": "partial",
"owner": "agent-hooks",
"layer": "ssh-relay-companion-runtime",
"surfaces": [
"SSH managed-hook companion startup",
"remote Codex hook installation",
"remote Claude hook installation"
],
"platforms": ["macos", "linux", "windows"],
"providers": ["ssh"],
"coveredPlatforms": ["macos"],
"coveredProviders": ["ssh"],
"coverageNotes": "A real Node 18 process loads every platform's built companion and runs the bundled Codex and Claude installers against an isolated temporary home. The six artifacts share one platform-neutral source bundle; live SSH transport and physical remote hosts remain uncollected.",
"motivatingLinks": ["https://github.com/stablyai/orca/pull/12617"],
"invariant": "Every managed-hook companion shipped for Node 18 must load before agent installers execute, and importing desktop-only state inspection must not make unrelated remote installers depend on node:sqlite.",
"oracle": "Build all relay artifacts, require each managed-hook-runtime.js in a real Node 18 process, assert its installer export, then install only Codex and Claude into a fresh temporary home. Require two successful installer results, executable hook scripts, and both agent configs to reference their managed scripts without touching the user's home.",
"commands": [
"pnpm run build:relay && npx -y node@18 config/scripts/smoke-managed-hook-runtime-node18.mjs",
"pnpm exec vitest run --config config/vitest.config.ts config/scripts/pr-workflow-parallelism.test.mjs"
],
"testFiles": [
"config/scripts/smoke-managed-hook-runtime-node18.mjs",
"config/scripts/pr-workflow-parallelism.test.mjs"
],
"assertionRefs": [
{
"file": "config/scripts/smoke-managed-hook-runtime-node18.mjs",
"assertions": [
"all six built companions load and export installManagedHooks under Node 18",
"Codex and Claude installations both succeed in an isolated home",
"both generated configs reference executable managed hook scripts"
]
},
{
"file": "config/scripts/pr-workflow-parallelism.test.mjs",
"assertions": [
"PR CI builds the companions before switching to Node 18 and running the smoke oracle"
]
}
],
"evidenceRuns": [
{
"date": "2026-08-08",
"runner": "local",
"platform": "macos",
"result": "passed",
"command": "pnpm run build:relay && npx -y node@18 config/scripts/smoke-managed-hook-runtime-node18.mjs",
"durationSeconds": 4,
"summary": "All six companions loaded under Node 18.20.8; Codex and Claude produced two successful results, executable hook scripts, and managed configs in a temporary home."
}
],
"runtimeBudget": {
"p95Seconds": 30,
"scope": "six built-companion loads plus two isolated local-filesystem installer executions"
},
"flakeHistory": {
"status": "not-started",
"evidence": "New deterministic artifact smoke with no timing oracle; CI history is not yet available."
},
"redGreenEvidence": {
"status": "complete",
"evidence": "On main de4f272b31, the same Node 18 require exited 1 before exports with ERR_UNKNOWN_BUILTIN_MODULE for node:sqlite. The candidate passes all six loads and both installers; restoring the eager node:sqlite value import reproduces the original exit."
},
"performanceBudget": {
"required": false,
"evidence": "The product change replaces one eager built-in import with a constructor-time built-in lookup. It adds no polling, IPC, filesystem scan, subprocess, listener, or recurring work."
},
"promotionCriteria": [
"Collect 100 consecutive focused CI passes or 14 days of soak history.",
"Collect one live SSH install on Linux and one on Windows OpenSSH.",
"Keep all-platform load, selected installer, isolated-home, and workflow-order assertions green."
],
"knownGaps": [
"The artifact journey uses local filesystem calls rather than a live SSH transport.",
"Platform-named bundles are loaded on macOS locally; physical Linux and Windows evidence is not yet recorded."
],
"demotionRule": "Demote if any shipped companion stops loading on Node 18, selected installers mutate outside the isolated home, or the CI lane no longer runs the built artifact with Node 18."
},
{
"id": "terminal-history.daemon-checkpoint-session-isolation",
"title": "Daemon history checkpoints isolate stalled terminal sessions",
"maturity": "experimental",
"protection": "partial",
"owner": "daemon-terminal",
"layer": "main-process-daemon-history",
"surfaces": [
"warm daemon terminal reattach",
"deep daemon buffer snapshots",
"periodic and final durable-history checkpoints"
],
"platforms": ["macos", "linux", "windows"],
"providers": ["local-daemon", "ssh-daemon", "wsl-daemon", "paired-runtime-host"],
"coveredPlatforms": ["macos"],
"coveredProviders": ["local-daemon"],
"coverageNotes": "A real daemon server and adapter on macOS cover per-session isolation, same-session deadlines, post-deadline commit, aggregate overlay admission, and live-window fallback. The provider-neutral adapter has no new path or wire assumptions; a live Linux SSH-relay journey covers the unchanged remote consumer, while live Linux daemon, Windows, WSL, and paired-runtime-host journeys remain gaps.",
"motivatingLinks": [
"https://linear.app/stably/issue/STA-4173",
"https://github.com/stablyai/orca/pull/14346"
],
"invariant": "A stalled durable-history checkpoint may delay only its own daemon session. Warm reattach and deep snapshots degrade to the live window after five seconds, non-final background checkpoints defer after fifteen seconds, same-session writes remain serialized, non-final running plus queued work stays bounded to three per session, overlay compacts stay bounded to four across sessions, and final sleep or disconnect checkpoints remain deadline-free.",
"oracle": "Park one session inside the real history checkpoint write, then require an unrelated warm reattach to return within two seconds with its own output while the first write remains parked. Require the stalled session to return its live window after the overlay deadline and later commit the abandoned write. Park four distinct overlay compacts, require a fifth reattach to return its live window without starting another compact, and require fast non-final RPC rejection plus both deadlines to leave diagnostic breadcrumbs.",
"commands": [
"pnpm exec vitest run --config config/vitest.config.ts src/main/daemon/daemon-checkpoint-session-queue.test.ts src/main/daemon/daemon-reattach-checkpoint-isolation.test.ts src/main/daemon/daemon-pty-adapter.test.ts --reporter=dot"
],
"testFiles": [
"src/main/daemon/daemon-checkpoint-session-queue.test.ts",
"src/main/daemon/daemon-reattach-checkpoint-isolation.test.ts",
"src/main/daemon/daemon-pty-adapter.test.ts"
],
"assertionRefs": [
{
"file": "src/main/daemon/daemon-checkpoint-session-queue.test.ts",
"assertions": [
"same-session operations serialize while unrelated sessions run independently",
"deadline fallback leaves the operation running and retains later waiter ordering",
"operation rejection remains distinct from a deadline",
"running plus queued work is bounded per session and drains"
]
},
{
"file": "src/main/daemon/daemon-reattach-checkpoint-isolation.test.ts",
"assertions": [
"an unrelated session reattaches while another checkpoint remains parked",
"same-session deadline fallback returns the live window and logs a breadcrumb",
"an abandoned checkpoint commits when the stalled write resumes",
"four parked overlays turn away a fifth compact without blocking its reattach"
]
},
{
"file": "src/main/daemon/daemon-pty-adapter.test.ts",
"assertions": [
"periodic checkpoint work caps concurrent snapshot, disk operations, and admission probes at four",
"non-final checkpoint RPC failures retain the existing warning path",
"final checkpoints bypass cooldown and remain awaited"
]
}
],
"evidenceRuns": [
{
"date": "2026-08-13",
"runner": "local",
"platform": "macos",
"result": "passed",
"command": "pnpm exec vitest run --config config/vitest.config.ts src/main/daemon/daemon-checkpoint-session-queue.test.ts src/main/daemon/daemon-reattach-checkpoint-isolation.test.ts src/main/daemon/daemon-pty-adapter.test.ts --reporter=dot",
"durationSeconds": 15,
"summary": "Three focused files passed, including unrelated-session reattach, five-second fallback, post-deadline durable commit, aggregate non-final admission, late-rejection diagnostics, and final-checkpoint behavior."
}
],
"runtimeBudget": {
"p95Seconds": 30,
"scope": "focused queue, real daemon-adapter isolation, and daemon adapter regression suite"
},
"flakeHistory": {
"status": "not-started",
"evidence": "Fresh deterministic local runs pass; CI and soak history have not started."
},
"redGreenEvidence": {
"status": "partial",
"evidence": "Origin main routes the parked overlay through one process-wide checkpoint tail, while the candidate oracle observes unrelated reattach at about 79 milliseconds. The exact reverted-source oracle was not executed in this review worktree."
},
"performanceBudget": {
"required": true,
"evidence": "Non-final work holds one admission per session and four globally; a full admission set stops the current periodic pass after four probes, and its diagnostic state stays bounded to the active admissions plus one global marker. Deadline timers are unrefed, abandoned waits retain admission until the actual write settles, dirty-gated polling remains unchanged, final checkpoints remain deadline-free, and the change adds no subprocess, renderer, store, startup probe, or wire work."
},
"promotionCriteria": [
"Execute the oracle against an affected baseline and retain the exact red result.",
"Collect 100 consecutive focused CI passes or 14 days of soak history.",
"Collect live Linux daemon, Windows, WSL, and paired-runtime-host reattach evidence.",
"Keep per-session and aggregate admission, deadline, diagnostics, and final-checkpoint assertions green."
],
"knownGaps": [
"Live Electron evidence covers the unchanged Linux SSH-relay consumer rather than a daemon running on the SSH host.",
"Physical Windows, WSL, Linux daemon, and paired-runtime-host journeys were not run.",
"The reverted-source failure is established from the old process-wide call path but was not executed."
],
"demotionRule": "Demote if unrelated reattach joins a stalled session tail, overlay or periodic work exceeds its admission bound, a deadline cancels durable work, final checkpoints defer, or failures and deadline fallbacks lose their diagnostic breadcrumbs."
},
{
"id": "skill-upload.cross-process-staging-ownership",
"title": "Concurrent runtime and relay uploads retain exact staging ownership",
"maturity": "experimental",
"protection": "partial",
"owner": "skill-upload-session-service",
"layer": "host-filesystem-lifecycle",
"surfaces": [
"paired-runtime skill upload",
"SSH relay skill upload",
"upload cancellation",
"process restart and disposal"
],
"platforms": ["macos", "linux", "windows"],
"providers": ["orca-server", "ssh"],
"coveredPlatforms": ["macos"],
"coveredProviders": ["ssh"],
"coverageNotes": "Two independent services share one parent under controlled ordering, four real crash boundaries run in child processes, and two bundled relays share one isolated home through distinct socket and hook endpoints. A current relay also shares that home safely with the originating relay in both launch orders. Graceful relay and desktop-runtime disposal join service cleanup. Linux, Windows, and paired headed/headless runtime process evidence remain uncollected; the change is host-local and changes no wire payload.",
"motivatingLinks": [
"https://linear.app/stably/issue/STA-4967",
"https://github.com/stablyai/orca/pull/14934"
],
"invariant": "Initialization, cleanup, or disposal by one service process can never remove bytes owned by a still-live upload in another process. Each service owns one atomic PID-and-UUID namespace, serializes begin admission at four active sessions, and retains the package-size limit. Abandoned owner cleanup inspects at most 64 entries per attempt, and success, failure, cancellation, restart, and disposal release only their exact owned paths.",
"oracle": "Begin and partially append upload A, then begin and append upload B from an independent service or relay sharing the same parent. Require two exact PID-and-UUID owner directories, two upload-ID archives, and byte-for-byte survival of both. Cancel B then A and require archive counts 1 then 0. Stage two more live uploads, terminate relay A, and require relay B's exact owner, archive, and bytes to survive before B terminates and the root becomes empty. Kill real child owners at begun, partial, uploaded, and committed boundaries and require a fresh owner to remove only exited-process staging and complete its own transfer. Seed 65 exited owners, require one attempt to remove exactly 64 and reject before adding bytes, then require retry to drain the final stale owner and begin normally.",
"commands": [
"pnpm exec vitest run --config config/vitest.config.ts src/main/skills/skill-upload-session-service.test.ts --reporter=verbose",
"ORCA_REAL_PROCESS_SKILL_TEST=1 pnpm exec vitest run --config config/vitest.config.ts src/main/skills/skill-upload-process-restart.integration.test.ts src/main/skills/skill-upload-process-restart-child.test.ts --pool=forks --maxWorkers=1 --no-file-parallelism --reporter=verbose",
"pnpm exec vitest run --config config/vitest.config.ts src/relay/skill-upload-multi-relay.integration.test.ts --pool=forks --maxWorkers=1 --no-file-parallelism --reporter=verbose",
"ORCA_REAL_PROCESS_SKILL_TEST=1 pnpm exec vitest run --config config/vitest.config.ts src/main/skills/skill-upload-session-service.test.ts src/main/skills/skill-upload-process-restart.integration.test.ts src/main/skills/skill-upload-process-restart-child.test.ts src/relay/skill-upload-multi-relay.integration.test.ts --pool=forks --maxWorkers=1 --no-file-parallelism --reporter=verbose",
"ORCA_SKILL_UPLOAD_LEGACY_RELAY_ENTRY=<fa9b20cb4163-relay.js> pnpm exec vitest run --config config/vitest.config.ts src/relay/skill-upload-multi-relay.integration.test.ts --pool=forks --maxWorkers=1 --no-file-parallelism --reporter=verbose",
"ORCA_SKILL_UPLOAD_RELAY_ENTRY=<fa9b20cb4163-relay.js;sha256=4db8609c4e1772f1efa9b0c0cf6affa8f64ff9ebc8e2b6f9e71678992ccdcf1a> pnpm exec vitest run --config config/vitest.config.ts src/relay/skill-upload-multi-relay.integration.test.ts --pool=forks --maxWorkers=1 --no-file-parallelism --reporter=verbose",
"ORCA_SKILL_UPLOAD_RELAY_ENTRY=<012e9f410c-fix-reverted-relay.js;sha256=ca03bf47d93828ec30473391b542d945df887b7881cce3df17e95d90226e34fb> pnpm exec vitest run --config config/vitest.config.ts src/relay/skill-upload-multi-relay.integration.test.ts --pool=forks --maxWorkers=1 --no-file-parallelism --reporter=verbose"
],
"testFiles": [
"src/main/skills/skill-upload-session-service.test.ts",
"src/main/skills/skill-upload-process-restart.integration.test.ts",
"src/main/skills/skill-upload-process-restart-child.test.ts",
"src/relay/skill-upload-multi-relay.integration.test.ts"
],
"assertionRefs": [
{
"file": "src/main/skills/skill-upload-session-service.test.ts",
"assertions": [
"a second service preserves the first service's exact file and bytes",
"five concurrent begins admit exactly four sessions and disposal removes them",
"disposal waits for an initializing begin and leaves no owner",
"concurrent disposal callers join the same exact cleanup promise",
"archive hashing failure releases the session and rejects later appends",
"symlink or junction staging roots are rejected before cleanup or admission",
"failed archive removal remains owned and counts toward the four-path bound",
"cancellation and disposal reduce exact archive and owner counts",
"one abandoned-owner sweep removes at most 64 entries and retry completes"
]
},
{
"file": "src/main/skills/skill-upload-process-restart.integration.test.ts",
"assertions": [
"begun, partial, uploaded, and committed crash residue is reclaimed",
"the replacement transfer completes and leaves no owner directory"
]
},
{
"file": "src/relay/skill-upload-multi-relay.integration.test.ts",
"assertions": [
"two bundled relay PIDs retain separate archives under one account home",
"current and originating relay bundles retain separate archives in both launch orders",
"relay cancellation and live-upload graceful shutdown clean only the exact owner"
]
}
],
"evidenceRuns": [
{
"date": "2026-08-20",
"runner": "local",
"platform": "macos",
"result": "passed",
"command": "ORCA_REAL_PROCESS_SKILL_TEST=1 pnpm exec vitest run --config config/vitest.config.ts src/main/skills/skill-upload-session-service.test.ts src/main/skills/skill-upload-process-restart.integration.test.ts src/main/skills/skill-upload-process-restart-child.test.ts src/relay/skill-upload-multi-relay.integration.test.ts --pool=forks --maxWorkers=1 --no-file-parallelism --reporter=verbose",
"durationSeconds": 5.95,
"summary": "Fifteen service tests, four crash-boundary cases, and one two-current-relay topology passed; the child fixture and two explicitly separate mixed-version cases skipped."
},
{
"date": "2026-08-20",
"runner": "local",
"platform": "macos",
"result": "passed",
"command": "ORCA_SKILL_UPLOAD_LEGACY_RELAY_ENTRY=<fa9b20cb4163-relay.js> pnpm exec vitest run --config config/vitest.config.ts src/relay/skill-upload-multi-relay.integration.test.ts --pool=forks --maxWorkers=1 --no-file-parallelism --reporter=verbose",
"durationSeconds": 0.9,
"summary": "The current/current case and both originating/current mixed-version launch orders passed with exact per-root archive bytes."
},
{
"date": "2026-08-20",
"runner": "local",
"platform": "macos",
"result": "failed",
"command": "ORCA_SKILL_UPLOAD_RELAY_ENTRY=<fa9b20cb4163-relay.js;sha256=4db8609c4e1772f1efa9b0c0cf6affa8f64ff9ebc8e2b6f9e71678992ccdcf1a> pnpm exec vitest run --config config/vitest.config.ts src/relay/skill-upload-multi-relay.integration.test.ts --pool=forks --maxWorkers=1 --no-file-parallelism --reporter=verbose",
"durationSeconds": 0.4,
"summary": "Expected red: zero PID/UUID owner directories and one archive were observed where two each were required; relay A's exact first five bytes were missing."
},
{
"date": "2026-08-20",
"runner": "local",
"platform": "macos",
"result": "failed",
"command": "ORCA_SKILL_UPLOAD_RELAY_ENTRY=<012e9f410c-fix-reverted-relay.js;sha256=ca03bf47d93828ec30473391b542d945df887b7881cce3df17e95d90226e34fb> pnpm exec vitest run --config config/vitest.config.ts src/relay/skill-upload-multi-relay.integration.test.ts --pool=forks --maxWorkers=1 --no-file-parallelism --reporter=verbose",
"durationSeconds": 0.4,
"summary": "Expected red: zero PID/UUID owner directories and one archive were observed where two each were required; relay A's exact first five bytes were missing."
}
],
"runtimeBudget": {
"p95Seconds": 15,
"scope": "focused service, four child-process restarts, and two bundled relays"
},
"flakeHistory": {
"status": "not-started",
"evidence": "The barriers are request acknowledgements, filesystem state, and process exit; CI and soak history have not started."
},
"redGreenEvidence": {
"status": "complete",
"evidence": "The byte-identical two-relay oracle failed at the exact two-owner count on originating merge fa9b20cb4163 and latest-main/reverted source 012e9f410c76, each observing one shared-root entry after relay B began. The candidate passed with two owner directories, two archives, A-byte survival, 1-to-0 cancellation cleanup, and 1-to-0 owner disposal cleanup."
},
"performanceBudget": {
"required": true,
"evidence": "Initialization scans at most 64 direct parent entries, creates one owner directory per live service, retains the existing four active sessions and package-size caps, and adds no polling, timer, subprocess, wire field, renderer work, or provider fanout. An over-budget parent rejects before creating new staged bytes."
},
"promotionCriteria": [
"Collect 100 consecutive focused CI passes or 14 days without an unexplained flake.",
"Run the same two-owner relay topology on Linux and Windows.",
"Run paired headed and headless runtime uploads under one OS account.",
"Keep exact owner/file counts, byte survival, bounded sweep, and all four crash boundaries green."
],
"knownGaps": [
"The live two-relay and crash evidence was collected on macOS; Linux and Windows process/filesystem behavior remains CI coverage.",
"The service is shared by paired runtimes, but separate headed and headless paired-runtime process journeys were not run.",
"PID reuse is handled conservatively: an abandoned namespace whose PID is currently occupied is preserved until a later process generation rather than risking deletion of live bytes.",
"The legacy remote-uploads root is intentionally not reclaimed while a mixed-version relay may still own bytes there; eventual legacy-root retirement requires a separate compatibility decision."
],
"demotionRule": "Demote if one live owner can remove another owner's bytes, cleanup exceeds 64 inspected entries per attempt, a lifecycle path retains its exact owned archive after settlement, or the process oracle flakes without an identified harness or product defect."
},
{
"id": "terminal-startup.quick-command-pre-bind-recovery",
"title": "Quick Command survives a pre-bind terminal recovery",
"maturity": "experimental",
"protection": "partial",
"owner": "terminal-renderer-lifecycle",
"layer": "electron-ui-and-real-local-pty",
"surfaces": ["Quick Commands", "terminal pane recovery", "fresh PTY startup"],
"platforms": ["macos", "linux", "windows"],
"providers": ["local"],
"coveredPlatforms": ["macos"],
"coveredProviders": ["local"],
"coverageNotes": "A forced pre-spawn barrier makes one visible Quick Command cross a recovery remount before its successor PTY binds. Store and lifecycle contracts retain lower-layer ownership; the Electron sentinel adds the rendered affordance, real PTY, exact-once terminal marker, staged identity file, and unrelated sibling canary.",
"motivatingLinks": [
"https://linear.app/stably/issue/STA-4876",
"https://github.com/stablyai/orca/pull/15630"
],
"invariant": "A Quick Command selected for a new terminal remains owned by that tab through a recovery remount, executes exactly once only after the successor PTY binds, and never reaches an unrelated terminal.",
"oracle": "Arm the E2E-only pre-spawn barrier, click the visible Quick Command, force one recovery generation while the original spawn is blocked, and release it. Require one exact semantic xterm marker, an independently written pane/tab identity file matching the bound live PTY, queue consumption only after bind, and a live interactive sibling canary.",
"commands": [
"pnpm exec vitest run --config config/vitest.config.ts src/renderer/src/components/terminal-pane/pty-connection-queued-startup-consume.test.ts src/renderer/src/components/terminal-pane/use-terminal-pane-lifecycle.test.ts src/renderer/src/store/slices/terminal-startup-command-retention.test.ts --reporter=dot",
"pnpm exec playwright test tests/e2e/terminal-quick-command-pre-bind-recovery.spec.ts --config tests/playwright.config.ts --project electron-headless --workers=1",
"ORCA_E2E_FORCE_HEADFUL=1 SKIP_BUILD=1 pnpm exec playwright test tests/e2e/terminal-quick-command-pre-bind-recovery.spec.ts --config tests/playwright.config.ts --project electron-headless --workers=1"
],
"testFiles": [
"src/renderer/src/components/terminal-pane/pty-connection-queued-startup-consume.test.ts",
"src/renderer/src/components/terminal-pane/use-terminal-pane-lifecycle.test.ts",
"src/renderer/src/store/slices/terminal-startup-command-retention.test.ts",
"tests/e2e/terminal-quick-command-pre-bind-recovery.spec.ts"
],
"assertionRefs": [
{
"file": "src/renderer/src/store/slices/terminal-startup-command-retention.test.ts",
"assertions": ["recovery remount retains the exact queued startup command"]
},
{
"file": "tests/e2e/terminal-quick-command-pre-bind-recovery.spec.ts",
"assertions": [
"the visible Quick Command executes exactly once in the intended fresh PTY",
"queue consumption follows PTY binding and the sibling terminal remains live"
]
}
],
"evidenceRuns": [
{
"date": "2026-08-23",
"runner": "local",
"platform": "macos",
"result": "passed",
"command": "pnpm exec playwright test tests/e2e/terminal-quick-command-pre-bind-recovery.spec.ts --config tests/playwright.config.ts --project electron-headless --workers=1",
"durationSeconds": 23,
"summary": "The exact rebased PR head passed the headless Electron flow in 23.0 seconds after an E2E-mode build."
},
{
"date": "2026-08-23",
"runner": "local",
"platform": "macos",
"result": "passed",
"command": "ORCA_E2E_FORCE_HEADFUL=1 SKIP_BUILD=1 pnpm exec playwright test tests/e2e/terminal-quick-command-pre-bind-recovery.spec.ts --config tests/playwright.config.ts --project electron-headless --workers=1",
"durationSeconds": 24,
"summary": "The exact rebased PR head passed the visible-window Electron flow in 23.9 seconds using the same E2E build."
}
],
"runtimeBudget": {
"p95Seconds": 90,
"scope": "one isolated Electron app, one forced recovery remount, and two local PTYs"
},
"flakeHistory": {
"status": "not-started",
"evidence": "The new sentinel has local headless and forced-headful evidence but no routed CI soak history."
},
"redGreenEvidence": {
"status": "complete",
"evidence": "The byte-identical spec failed with pending:null before PTY bind when the pre-6e25a900 eager-consume behavior was restored, then passed after restoration."
},
"performanceBudget": {
"required": true,
"evidence": "The barrier exists only in E2E builds, adds no production timer or polling, and the live sentinel completed in under 20 seconds locally."
},
"promotionCriteria": [
"Collect 100 consecutive routed CI passes over at least 14 days without an unexplained flake.",
"Keep retries at zero and retain both semantic and identity oracles.",
"Collect Linux Electron evidence before promoting the focused lane to blocking."
],
"knownGaps": [
"Windows, Linux, SSH, WSL, and paired-runtime topologies are not covered because they were not causal to STA-4876.",
"The sentinel remains advisory while the repository-wide E2E signal is red."
],
"demotionRule": "Demote if the barrier can be bypassed nondeterministically, either independent oracle is removed, the sibling canary is no longer isolated, or one unexplained flake occurs."
},
{
"id": "quick-open.paired-host-path-search",
"title": "Paired Quick Open searches bounded host paths",
"maturity": "experimental",
"protection": "partial",
"owner": "runtime-filesystem",
"layer": "host-file-search-and-paired-runtime",
"surfaces": ["Quick Open", "paired desktop runtime", "headless runtime host"],
"platforms": ["macos", "linux", "windows"],
"providers": ["local", "ssh", "paired-runtime"],
"coveredPlatforms": ["macos"],
"coveredProviders": ["local", "paired-runtime"],
"coverageNotes": "Focused contracts cover bounded host search, ignore traversal, RPC response bounds, renderer cancellation, deterministic ordering, and transport payload size. Headed and headless paired-runtime journeys use an 88,763-file fixture and are source-routed into advisory PR E2E; physical SSH and Windows remain gaps.",
"motivatingLinks": [
"https://linear.app/stably/issue/STA-4354",
"https://github.com/stablyai/orca/pull/15158"
],
"invariant": "Quick Open queries execute on the worktree host, find exact ignored-path matches beyond the legacy inventory prefix, return deterministic bounded results, and keep the paired runtime usable without overflowing its outbound reply buffer.",
"oracle": "Create 88,763 paths with 77,792 ignored entries and a nominal 22 GiB sparse file, query exact late gitignored and .orcaignored targets through headed and headless paired runtimes, and require one deterministic match, a payload below 4 KiB, and a healthy follow-up worktree call.",
"commands": [
"pnpm exec vitest run --config config/vitest.config.ts src/main/ipc/filesystem-search-file-paths.test.ts src/main/runtime/orca-runtime-files-search.test.ts src/main/runtime/rpc/methods/files-path-search.test.ts src/renderer/src/components/quick-open-file-list.react.test.tsx src/renderer/src/runtime/runtime-file-client-search-listing.test.ts src/shared/quick-open-transport-budget.test.ts --reporter=dot",
"pnpm exec playwright test tests/e2e/paired-quick-open-large-tree.spec.ts --config tests/playwright.config.ts --workers=1"
],
"testFiles": [
"src/main/ipc/filesystem-search-file-paths.test.ts",
"src/main/runtime/orca-runtime-files-search.test.ts",
"src/main/runtime/rpc/methods/files-path-search.test.ts",
"src/renderer/src/components/quick-open-file-list.react.test.tsx",
"src/renderer/src/runtime/runtime-file-client-search-listing.test.ts",
"src/shared/quick-open-transport-budget.test.ts",
"tests/e2e/paired-quick-open-large-tree.spec.ts"
],
"assertionRefs": [
{
"file": "src/main/ipc/filesystem-search-file-paths.test.ts",
"assertions": [
"host search stays bounded and respects gitignore plus .orcaignore traversal"
]
},
{
"file": "src/renderer/src/runtime/runtime-file-client-search-listing.test.ts",
"assertions": ["paired path queries stay deterministic and bounded across transport"]
},
{
"file": "tests/e2e/paired-quick-open-large-tree.spec.ts",
"assertions": ["headed and headless hosts find late ignored targets and remain callable"]
}
],
"evidenceRuns": [
{
"date": "2026-08-23",
"runner": "local",
"platform": "macos",
"result": "passed",
"command": "pnpm exec vitest run --config config/vitest.config.ts src/main/ipc/filesystem-search-file-paths.test.ts src/main/runtime/orca-runtime-files-search.test.ts src/main/runtime/rpc/methods/files-path-search.test.ts src/renderer/src/components/quick-open-file-list.react.test.tsx src/renderer/src/runtime/runtime-file-client-search-listing.test.ts src/shared/quick-open-transport-budget.test.ts --reporter=dot",
"durationSeconds": 5,
"summary": "Six focused files passed 52 tests across host search, runtime RPC, renderer query ownership, and transport bounds; existing React act warnings remained non-fatal."
}
],
"runtimeBudget": {
"p95Seconds": 300,
"scope": "focused deterministic contracts plus two serial paired Electron large-tree journeys"
},
"flakeHistory": {
"status": "not-started",
"evidence": "The sentinel is newly source-routed for PR collection; no route-specific soak history exists yet."
},
"redGreenEvidence": {
"status": "complete",
"evidence": "The merged STA-4354 oracle places both targets beyond the removed inventory prefix; the old client-side prefix inventory misses them, while host search returns the exact deterministic paths."
},
"performanceBudget": {
"required": true,
"evidence": "Search is query-driven, result-limited, cancellation-aware, and payload-bounded; PR routing selects this fixture only for its exact production authorities or direct spec edits."
},
"promotionCriteria": [
"Collect 100 consecutive routed CI passes or 14 days without an unexplained flake.",
"Collect physical SSH and Windows paired-runtime evidence.",
"Keep deterministic result hashes, payload bounds, and post-query runtime health green."
],
"knownGaps": [
"The live large-tree evidence uses local headed and headless hosts rather than physical SSH.",
"Windows path-search tooling and filesystem behavior are not represented by the local evidence."
],
"demotionRule": "Demote if the routed fixture flakes without a diagnosed product or harness cause, returns unbounded payloads, misses either late ignored target, or leaves the paired runtime unhealthy."
},
{
"id": "terminal-session.host-cold-park-stream-continuity",
"title": "Host cold parking preserves paired terminal streams",
"maturity": "experimental",
"protection": "partial",
"owner": "terminal-runtime-graph",
"layer": "renderer-runtime-graph-and-terminal-stream",
"surfaces": ["host terminal cold park", "paired remote viewer", "multi-pane runtime graph"],
"platforms": ["macos", "linux", "windows"],
"providers": ["local-daemon", "ssh-daemon", "paired-runtime"],
"coveredPlatforms": ["macos"],
"coveredProviders": ["local-daemon", "paired-runtime"],
"coverageNotes": "Deterministic policy and multiplex tests separate renderer parking from authoritative stream liveness, while runtime-graph tests cover exact parked leaf, pane runtime ID, title, multi-pane active-leaf, and disposal behavior. One headed paired journey proves input and echoed output while the host pane remains cold-parked.",
"motivatingLinks": [
"https://linear.app/stably/issue/STA-2854",
"https://github.com/stablyai/orca/pull/15514"
],
"invariant": "Cold parking a host renderer pane never retires its live PTY's runtime-graph leaf or interrupts a paired subscriber's stream, input, reconnect, pane identity, or multi-pane routing; the leaf retires only when exact PTY ownership ends.",
"oracle": "Cold-park a host-owned pane while a paired client actively views it, require the host manager to unmount, then type through the client and require the same PTY to receive and echo the token without any disconnected sample. Separately publish multi-pane parked leaves with exact pane runtime IDs and require per-PTY disposal to remove only the retired leaf.",
"commands": [
"pnpm exec vitest run --config config/vitest.config.ts src/renderer/src/components/terminal-pane/terminal-parked-tab-watchers.test.ts src/renderer/src/runtime/sync-runtime-graph-parked-leaf.test.ts tests/e2e/host-cold-park-remote-subscriber.unit.test.ts --reporter=dot",
"pnpm exec playwright test tests/e2e/host-parked-pane-remote-viewer.spec.ts --config tests/playwright.config.ts --project electron-headless --workers=1"
],
"testFiles": [
"src/renderer/src/components/terminal-pane/terminal-parked-tab-watchers.test.ts",
"src/renderer/src/runtime/sync-runtime-graph-parked-leaf.test.ts",
"tests/e2e/host-cold-park-remote-subscriber.unit.test.ts",
"tests/e2e/host-parked-pane-remote-viewer.spec.ts"
],
"assertionRefs": [
{
"file": "src/renderer/src/runtime/sync-runtime-graph-parked-leaf.test.ts",
"assertions": [
"a live parked watcher publishes the exact leaf, pane runtime ID, and title",
"multi-pane publication never names an unsent active leaf and exact disposal retires ownership"
]
},
{
"file": "tests/e2e/host-cold-park-remote-subscriber.unit.test.ts",
"assertions": [
"a fully unmounted host renderer still streams, accepts input, and resubscribes"
]
},
{
"file": "tests/e2e/host-parked-pane-remote-viewer.spec.ts",
"assertions": [
"a cold-parked host pane carries a complete paired-client input and echo round trip"
]
}
],
"evidenceRuns": [
{
"date": "2026-08-23",
"runner": "local",
"platform": "macos",
"result": "passed",
"command": "pnpm exec vitest run --config config/vitest.config.ts src/renderer/src/components/terminal-pane/terminal-parked-tab-watchers.test.ts src/renderer/src/runtime/sync-runtime-graph-parked-leaf.test.ts tests/e2e/host-cold-park-remote-subscriber.unit.test.ts --reporter=dot",
"durationSeconds": 8,
"summary": "Three focused files passed 64 watcher, multi-pane runtime-graph, cold-park policy, and authoritative-stream tests."
}
],
"runtimeBudget": {
"p95Seconds": 180,
"scope": "focused deterministic contracts plus one serial headed paired cold-park journey"
},
"flakeHistory": {
"status": "not-started",
"evidence": "The existing sentinel is newly source-routed for PR collection; route-specific CI history has not started."
},
"redGreenEvidence": {
"status": "complete",
"evidence": "On the affected STA-2854 path, cold parking removed the runtime-graph leaf and the paired stream disconnected; retaining the exact live parked watcher leaf keeps every sampled client phase connected and completes input plus echo."
},
"performanceBudget": {
"required": true,
"evidence": "Publication reads the existing bounded parked-watcher registry and adds no timer, polling, provider scan, subprocess, or wire field; the 90-second live timeline is selected only by exact parking and graph authorities."
},
"promotionCriteria": [
"Collect 100 consecutive routed CI passes or 14 days without an unexplained flake.",
"Collect Linux, Windows, WSL, and physical SSH cold-park evidence.",
"Keep exact per-leaf disposal, multi-pane identity, and full client round-trip assertions green."
],
"knownGaps": [
"The live paired cold-park journey is macOS-only and uses a local daemon PTY.",
"Physical SSH, WSL, Linux, Windows, and host-restart cold-park journeys are not recorded."
],
"demotionRule": "Demote if a live parked PTY loses its exact graph leaf, a retired PTY remains published, multi-pane identity drifts, or the routed client round trip flakes without a diagnosed cause."
},
{
"id": "terminal-session.remote-pane-layout-retry",
"title": "Remote pane layouts retry identical state after reconnect",
"maturity": "experimental",
"protection": "partial",
"owner": "terminal-layout-sync",
"layer": "renderer-paired-runtime-layout",
"surfaces": ["paired terminal split layout", "pane title", "runtime reconnect"],
"platforms": ["macos", "linux", "windows"],
"providers": ["paired-runtime"],
"coveredPlatforms": ["macos"],
"coveredProviders": ["paired-runtime"],
"coverageNotes": "Pure contracts cover identity-equal local write bailouts and remote push deduplication, while a headless-host paired Electron journey proves that an identical local layout is retried after a failed disconnected push and becomes visible to an independent observer.",
"motivatingLinks": ["https://github.com/stablyai/orca/pull/12420"],
"invariant": "Identity-equal pane layout writes avoid local churn but never suppress a remote retry whose prior push failed; reconnecting and repeating the same layout persists it on the host and publishes it to other paired clients.",
"oracle": "Disconnect a paired client, change a pane title, and observe the failed host push while local state retains the layout. Reconnect without remounting, submit the identical title again, and require the headless host plus a second paired observer to receive it.",
"commands": [
"pnpm exec vitest run --config config/vitest.config.ts src/renderer/src/components/terminal-pane/remote-pane-layout-push.test.ts src/renderer/src/store/slices/terminal-write-identity-bailouts.test.ts --reporter=dot",
"pnpm exec playwright test tests/e2e/paired-remote-pane-layout-retry.spec.ts --config tests/playwright.config.ts --project electron-headless --workers=1"
],
"testFiles": [
"src/renderer/src/components/terminal-pane/remote-pane-layout-push.test.ts",
"src/renderer/src/store/slices/terminal-write-identity-bailouts.test.ts",
"tests/e2e/paired-remote-pane-layout-retry.spec.ts"
],
"assertionRefs": [
{
"file": "src/renderer/src/components/terminal-pane/remote-pane-layout-push.test.ts",
"assertions": ["only successfully pushed layouts deduplicate later remote writes"]
},
{
"file": "src/renderer/src/store/slices/terminal-write-identity-bailouts.test.ts",
"assertions": ["identity-equal layout and timer writes avoid redundant local updates"]
},
{
"file": "tests/e2e/paired-remote-pane-layout-retry.spec.ts",
"assertions": [
"an identical layout retries after reconnect and reaches a second paired observer"
]
}
],
"evidenceRuns": [
{
"date": "2026-08-23",
"runner": "local",
"platform": "macos",
"result": "passed",
"command": "pnpm exec vitest run --config config/vitest.config.ts src/renderer/src/components/terminal-pane/remote-pane-layout-push.test.ts src/renderer/src/store/slices/terminal-write-identity-bailouts.test.ts --reporter=dot",
"durationSeconds": 5,
"summary": "Two focused files passed 20 remote-push and identity-bailout contracts."
}
],
"runtimeBudget": {
"p95Seconds": 90,
"scope": "two focused renderer contracts plus one serial headless-host paired journey"
},
"flakeHistory": {
"status": "not-started",
"evidence": "The existing paired sentinel is newly source-routed and has no route-specific CI soak history."
},
"redGreenEvidence": {
"status": "complete",
"evidence": "The affected implementation cached the disconnected layout before host acknowledgment and suppressed the identical retry; the merged oracle keeps only successful remote pushes deduplicated and the observer receives the retried title."
},
"performanceBudget": {
"required": true,
"evidence": "Successful identity-equal writes remain O(1) bailouts; one failed remote push permits one later identical retry, with no polling, timer, provider scan, subprocess, or new wire field."
},
"promotionCriteria": [
"Collect 100 consecutive routed CI passes or 14 days without an unexplained flake.",
"Collect Linux and Windows paired-runtime reconnect evidence.",
"Keep local identity bailouts and failed-push retry ownership green."
],
"knownGaps": [
"The paired reconnect journey has only local macOS evidence.",
"The sentinel changes a pane title within an existing layout; concurrent split and close conflicts remain separate coverage."
],
"demotionRule": "Demote if a failed push suppresses an identical retry, a successful equal write resumes redundant churn, or the routed observer journey flakes without a diagnosed cause."
}
]
}
Reference in New Issue View Git Blame Copy Permalink