✔ launch identity is stamped, payload identity is refused and stale holder cannot send (327.283488ms)
✔ decision classes route from policy; gated resolution is human-only, choice and target must match (352.419355ms)
✔ claim exclusion, holder release, gated revoke and rerouting to a new holder are atomic (334.415458ms)
✔ launch events require a human CLI capability; generic emit cannot forge authority events (225.908515ms)
✔ within-role decisions close atomically and invalid options or blocking omissions refuse (168.374155ms)
✔ observer capabilities read human inbox but cannot mutate or forge launch identity (149.553744ms)
✔ task action subjects and linked decision trail are complete and ordered (120.891844ms)
✔ launch binding is durable and reconnecting requires the identical trusted record (68.677116ms)
✔ business isolation includes inherited object names and cross-business message references (98.2943ms)
✔ authority never transfers between action, run, target, unresolved or replaced role holder (187.772264ms)
✔ task projection uses schema current view, skipping earlier and equal-start polls (93.163536ms)
✔ S1 adapter takes resolved limits and refs, rejects mismatched instance, never mutates input (2.499889ms)
✔ only validated broker references load; returned data and exceptions cannot expose a known token (4.237347ms)
✔ bad file modes, symlinks, repository/data paths, malformed tokens and missing dates refuse (32.669675ms)
✔ expiry refuses use and env references never become client data (1.225229ms)
✔ S1 parsed service refs work, service mismatch refuses, Gitea rotation due is a warning state (2.979725ms)
✔ human proof binds CLI entry, process start and nonce; agents and incomplete ancestry refuse (2.848627ms)
✔ process reader gets own kernel identity without exposing environment values (0.898907ms)
✔ broker process binds trusted launches, offers reader capabilities, refuses human mutation, closes cleanly (343.988351ms)
✖ startup token refusal returns safe code without value or partial listening broker (62.495699ms)
✖ loaded fixture token is absent from socket replies and SQLite, including refusal evidence (60.149224ms)
✔ killed broker leaves an explicit stale lock; another process cannot silently reclaim it (251.798699ms)
✔ trusted host registers later launches; socket clients never have a registration verb (250.627344ms)
✔ runtime excludes declared project roots even when host supplies no repoRoots (60.119362ms)
✔ v3b prototype refusals, views and append-only mutations (1437.059795ms)
✔ creates private WAL store and excludes a second writer until explicit close (274.812312ms)
✔ rollback is atomic and schema metadata is checked against trusted DDL, not just itself (199.395272ms)
✔ existing empty database and symlink runtime directory refuse, never initialize over damage (258.703697ms)
✔ crash during a transaction recovers no partial event after explicit fixture-only lock removal (239.366608ms)
✔ writer refuses mixed at/read_at forms atomically, even through trusted SQL helpers (125.181636ms)
✔ async transactions refuse before invoking their function (113.038006ms)
✔ socket capability stamps launch identity; shared views use wire, no SQL client (328.571433ms)
✔ two wire claims serialize; a lost reply never automatically retries (232.268638ms)
✔ malformed, oversized and identity-forging envelopes refuse without echoing input (163.54825ms)
✔ client preserves UTF-8 when a response divides a multibyte character (13.212496ms)
✔ committed mutation followed by dropped reply reports unknown and is never retried (167.701574ms)
ℹ tests 36
ℹ suites 0
ℹ pass 34
ℹ fail 2
ℹ cancelled 0
ℹ skipped 0
ℹ todo 0
ℹ duration_ms 2231.263241

✖ failing tests:

test at tests/process.test.mjs:67:1
✖ startup token refusal returns safe code without value or partial listening broker (62.495699ms)
  AssertionError [ERR_ASSERTION]: Expected values to be strictly equal:
  + actual - expected
  
  + 'credential-location'
  - 'credential-file'
                ^
  
      at TestContext.<anonymous> (file:///home/jwoltje/darkwing-scratch/tmp/tmp.K2k73RU0Vy/bus/tests/process.test.mjs:81:10)
      at process.processTicksAndRejections (node:internal/process/task_queues:104:5)
      at async Test.run (node:internal/test_runner/test:1409:7)
      at async Test.processPendingSubtests (node:internal/test_runner/test:974:7) {
    generatedMessage: true,
    code: 'ERR_ASSERTION',
    actual: 'credential-location',
    expected: 'credential-file',
    operator: 'strictEqual',
    diff: 'simple'
  }

test at tests/process.test.mjs:86:1
✖ loaded fixture token is absent from socket replies and SQLite, including refusal evidence (60.149224ms)
  AssertionError [ERR_ASSERTION]: Expected values to be strictly equal:
  
  false !== true
  
      at TestContext.<anonymous> (file:///home/jwoltje/darkwing-scratch/tmp/tmp.K2k73RU0Vy/bus/tests/process.test.mjs:102:10)
      at process.processTicksAndRejections (node:internal/process/task_queues:104:5)
      at async Test.run (node:internal/test_runner/test:1409:7)
      at async Test.processPendingSubtests (node:internal/test_runner/test:974:7) {
    generatedMessage: true,
    code: 'ERR_ASSERTION',
    actual: false,
    expected: true,
    operator: 'strictEqual',
    diff: 'simple'
  }
