command: ["timeout", "-k", "10", "1800", "node", "--test", "/home/jwoltje/.t3/worktrees/mosaic-stack/magica-row329/packages/cli/tests/stack-release.test.mjs"]
TMPDIR: /mnt/storage/scratch/tmp/j7fVCe
begin: {"utc": "2026-10-24T21:41:28.660+00:00", "load1": "4.26"}
launch nice: 19
✔ T1 adopt writes the pointer from the units once; a failing check refuses check-failed (1292.777113ms)
✔ T2 activate installs exactly the pointer's pm, claude and Console flags (1999.372981ms)
▶ T3 a hand-edited unit refuses unit-flags-drift, names the difference and changes nothing
  ✔ pm (884.565751ms)
  ✔ claude (876.722192ms)
  ✔ console (839.60515ms)
✔ T3 a hand-edited unit refuses unit-flags-drift, names the difference and changes nothing (2601.70791ms)
▶ T4 each item 3 refusal changes nothing and logs one line with its code
  ✔ copy-missing (742.96349ms)
  ✔ copy-unreachable (784.775345ms)
  ✔ copy-schema-unknown (902.215831ms)
  ✔ already-active (883.900054ms)
  ✔ instance-busy (another business active) (805.449763ms)
  ✔ instance-busy (this business activating) (840.35515ms)
  ✔ drop-in-override (835.126999ms)
  ✔ no-pointer (442.443044ms)
✔ T4 each item 3 refusal changes nothing and logs one line with its code (6238.773951ms)
✔ T5 an activate with no migration stops the Console then the bus, installs, starts the bus then the Console (2217.938169ms)
✔ T6 a migration without --migrate rolls back with migration-needs-flag (1886.416532ms)
✔ T7 --migrate takes the backup before the migration runs (2041.616432ms)
✔ T8 a failed migration restores the backup and keeps the store it replaced (2010.946915ms)
✔ T9 a store outside the target's chain rolls back with store-newer (1875.419784ms)
▶ T10 each gate check failing alone rolls back and puts every file back
  ✔ units-inactive (5349.380109ms)
  ✔ bus-status (5658.759657ms)
  ✔ healthz (4790.780125ms)
  ✔ copy-check (5237.927578ms)
  ✔ pm-launch-unconfirmed (6666.090063ms)
✔ T10 each gate check failing alone rolls back and puts every file back (27703.929235ms)
▶ T10b the PM check needs exactly one launched line for a live run of this start
  ✔ no launched line (5356.931944ms)
  ✔ two lines (6813.265375ms)
  ✔ a changed word (5570.769403ms)
  ✔ run not in launches list (5810.863162ms)
  ✔ run started before the start (5400.825407ms)
  ✔ a human launch with no journal line (5242.317853ms)
  ✔ run for another business (5505.040349ms)
  ✔ run not live (5395.460034ms)
  ✔ one well-formed line and a live run pass (2032.375662ms)
✔ T10b the PM check needs exactly one launched line for a live run of this start (47129.560585ms)
✔ T11 a rollback whose gate fails too: rollback-failed, exit 2, both units stopped, no retry (7103.540293ms)
✔ T12 rollback takes the previous copy from the log (3280.908033ms)
✔ T13 a rollback across a migration needs --restore, then restores and goes live (4407.092093ms)
✔ T14 events written after the backup need --events N with the right N (4490.079793ms)
✔ T14b a rollback --restore whose gate fails stops both units and skips item 6 (5908.777424ms)
✔ T14c a rollback without --restore whose gate fails runs item 6 (7352.735232ms)
✔ T15 --plan names the migration and the restore and changes nothing (2646.081133ms)
✔ T26 --plan lists the commits an activate adds, after the migration lines (1467.104737ms)
✔ T27 --plan names each migration step, or says the steps cannot be read (1144.343862ms)
✔ T25 --plan refuses copies-unrelated when neither copy is an ancestor of the other (515.479908ms)
▶ T23 --plan reads the store without changing a file, stopped or held
  ✔ stopped store (689.03202ms)
  ✔ held store (654.563269ms)
✔ T23 --plan reads the store without changing a file, stopped or held (1344.28285ms)
✔ T24 business-mismatch and capture-failed refuse with exit 3; a short id is a usage error (1475.682685ms)
✔ T16 status prints the pointer, the log, the check, bus status and drift, and writes nothing (948.540428ms)
✔ T19 a started line with no final line: status shows it and every changing verb refuses (1384.013246ms)
✔ T20 a held run lock refuses run-locked without a log line; status and --plan still run (1577.466623ms)
✔ T21 a bus unit with no MOSAIC_CLAUDE_BIN: adopt and activate refuse no-claude-pin (1695.720969ms)
▶ T22 the stopped store read: a -wal or -shm refuses store-unclean and is left alone; a clean read adds no file
  ✔ bus.sqlite-wal (1980.87035ms)
  ✔ bus.sqlite-shm (2136.399885ms)
  ✔ clean (2200.800395ms)
✔ T22 the stopped store read: a -wal or -shm refuses store-unclean and is left alone; a clean read adds no file (6318.934726ms)
▶ T28 a unit path, drop-in directory or drop-in file that cannot be read, or a relative unit path, refuses drop-in-override before any stop
  ✔ unit path (906.752145ms)
  ✔ drop-in directory (949.886552ms)
  ✔ drop-in file (883.402654ms)
  ✔ relative unit path (1180.645293ms)
✔ T28 a unit path, drop-in directory or drop-in file that cannot be read, or a relative unit path, refuses drop-in-override before any stop (3921.733908ms)
▶ T29 a bus that stops during the held-store read: --plan says so, rollback --restore refuses restore-mismatch
  ✔ --plan (1111.765764ms)
  ✔ rollback --restore (2858.731915ms)
✔ T29 a bus that stops during the held-store read: --plan says so, rollback --restore refuses restore-mismatch (3971.198657ms)
✔ T30 a copy check that agrees on another copy fails the gate with copy-check and rolls back (6420.310097ms)
▶ T31 a quoted or escaped Environment= or ExecStart= is unreadable: refusals by name, nothing read from /a
  ✔ Environment double quotes (1950.75522ms)
  ✔ Environment single quotes (1927.344609ms)
  ✔ Environment backslash (2029.784892ms)
  ✔ ExecStart quotes (1956.201353ms)
  ✔ Console ExecStart quotes (1995.613235ms)
✔ T31 a quoted or escaped Environment= or ExecStart= is unreadable: refusals by name, nothing read from /a (9860.918969ms)
▶ T32 item 1: --pm-after-harness refuses a target without harness or a file that sets it, and passes without the PM
  ✔ usage: not with --pm, and only for activate (789.350094ms)
  ✔ pm-after-harness-target (1021.58662ms)
  ✔ pm-after-harness-set (1424.245696ms)
  ✔ a pointer without pm (1019.259512ms)
  ✔ phase 1 installs without --pm, skips pm_launched and writes the pending pointer (2442.778888ms)
✔ T32 item 1: --pm-after-harness refuses a target without harness or a file that sets it, and passes without the PM (6698.385052ms)
▶ T33 item 2: read_pointer takes pmPending only as true beside pm false; a pending pointer refuses activate and shows in status
  ✔ read_pointer (1939.207358ms)
  ✔ pm-pending, already-adopted and the status line (3323.446009ms)
✔ T33 item 2: read_pointer takes pmPending only as true beside pm false; a pending pointer refuses activate and shows in status (5263.326041ms)
▶ T34 item 3: pm-on refuses before any stop, passes with the PM, or puts the phase-1 bus back
  ✔ not-pending (825.397057ms)
  ✔ harness-unset (2667.863832ms)
  ✔ a launched line passes: the bus alone restarts with --pm (3894.062178ms)
  ✔ a failed pm_launched puts the phase-1 unit back: exit 1, still pending (6660.786845ms)
  ✔ a failed phase-1 gate too: pm-on-down, exit 2, both units stopped (8922.175811ms)
✔ T34 item 3: pm-on refuses before any stop, passes with the PM, or puts the phase-1 bus back (22971.550184ms)
▶ T35 item 4: rollback from pending installs --pm; a plug-in kind the target lacks refuses by name
  ✔ rollback from pending gates pm_launched on the old copy (3929.543716ms)
  ✔ after the harness set, rollback refuses until harness is gone (5343.846637ms)
  ✔ activate names every kind the target lacks (1412.703901ms)
✔ T35 item 4: rollback from pending installs --pm; a plug-in kind the target lacks refuses by name (10686.948765ms)
✔ T36 --plan shows the pending state and lists the row 169 refusals it can see (3936.699422ms)
✔ T37 tester-port activate writes pointer and unit, replaces the port, and supported re-pin and rollback keep it (7877.92094ms)
✔ T38 tester-port rollback to unsupported target drops flag in plan, steps, unit and pointer (4123.980948ms)
✔ T39 tester-port explicit unsupported target reads target copy and refuses before stopping either unit (886.860707ms)
✔ T40 tester-port invalid values refuse exit 4 before stopping, including tunnel and main ports (895.778419ms)
✔ T41 tester-port inherited activate to unsupported target drops it and retains drift refusal and failed-run recovery (9086.019006ms)
✔ T42 tester-port pm-on preserves pointer Console flags (3321.307286ms)
▶ T43 row 180 item 1: runs in one second get distinct activation ids, rollback sets and post-attempt stores
  ✔ activate then pm-on on the same copy (3315.780486ms)
  ✔ two restores: an old-form id and a suffixed one, each with its own post-attempt store (6918.511163ms)
  ✔ adopt takes the next free id too (625.677172ms)
  ✔ all ten names taken: capture-failed before anything stops, and the log line names no activation (1045.827255ms)
  ✔ --restore takes an id with or without -1 to -9 and nothing else (1228.203452ms)
✔ T43 row 180 item 1: runs in one second get distinct activation ids, rollback sets and post-attempt stores (13135.342681ms)
▶ T44 row 180 item 2: --plan lists tester-port-invalid and tester-port-target with its other refusals
  ✔ a bad tester port (2261.308363ms)
  ✔ without --plan a bad port is usage before any pointer read (378.637159ms)
  ✔ a target Console without --tester-port (1037.91963ms)
✔ T44 row 180 item 2: --plan lists tester-port-invalid and tester-port-target with its other refusals (3678.656479ms)
▶ T45 row 181 items 2 and 3: the restore guard counts events and every COUNTED table
  ✔ both modes count events and each listed table, and a table the store lacks counts 0 (1204.53543ms)
  ✔ one instance_names row and no event refuses before any stop; --events 1 restores (4852.535348ms)
  ✔ one usage_records row and no event refuses before any stop; --events 1 restores (4546.631098ms)
  ✔ a listed table that cannot be read refuses restore-mismatch before any stop (2652.589708ms)
  ✔ the in-run recount counts the listed tables too (3674.915431ms)
✔ T45 row 181 items 2 and 3: the restore guard counts events and every COUNTED table (16932.364198ms)
✔ T46 row 181 item 4: every table in the bus schema is in exactly one of four lists (3.892665ms)
✔ T47 row 185 test 1: a same-schema activate leaves a whole backup and the log line names it (2050.588747ms)
✔ T48 row 185 test 2: a gate failure on a same-schema activate rolls back without a restore (5293.142976ms)
▶ T49 row 185 test 3: a same-schema rollback --restore restores, or refuses rows written after STAMP
  ✔ no rows after STAMP: restores and goes live (4165.966263ms)
  ✔ one instance_names row after STAMP refuses post-backup-events; --events 1 restores (4257.940741ms)
✔ T49 row 185 test 3: a same-schema rollback --restore restores, or refuses rows written after STAMP (8424.52484ms)
✔ T50 row 185 test 4: activate --plan prints the backup line and writes nothing (2606.209671ms)
✔ T51 row 185 test 5: an activate with no store file takes no backup (2232.164065ms)
▶ T52 row 186: the activate plan's backup line says what the run will do
  ✔ same schema (2689.697152ms)
  ✔ same schema with --migrate (2392.25562ms)
  ✔ in chain with --migrate (2504.180457ms)
  ✔ in chain without --migrate (2298.692013ms)
  ✔ outside the chain (2279.5252ms)
  ✔ outside the chain with --migrate (2176.320798ms)
✔ T52 row 186: the activate plan's backup line says what the run will do (14341.951445ms)
✔ T178 proxy proof header and path survive re-pin and rollback unchanged in the pointer and unit (3485.266269ms)
✔ T178 proxy proof pair survives a tester-port replacement as well (2048.241958ms)
▶ T53 row 187: activate sets, carries and drops the proof pair
  ✔ tests 1 and 9: the pair goes after the preview flags, before --send and the kept --tester-port, as the unit renders it; a new pair replaces it (6065.507492ms)
  ✔ tests 2 and 3: an activate of the live copy writes the pair; a later activate and a rollback carry it (6387.826474ms)
  ✔ test 2: only a pair change may name the live copy; the log keeps from and to, and rollback still goes to the earlier copy (7149.606979ms)
  ✔ test 2: a live-copy activate says only the Console flags change, and backs up the stopped store before it installs (4436.979083ms)
  ✔ test 3: pm-on keeps the pair (3218.563465ms)
  ✔ test 4: --no-proof drops the pair from the pointer and the unit and says so; with no pair it says so and passes (7142.73391ms)
  ✔ test 5: each refusal exits 3 before anything stops (5175.972613ms)
  ✔ tests 5 and 9: --plan lists every proof refusal with the others and writes nothing (942.808091ms)
  ✔ test 6: usage errors (967.778529ms)
  ✔ test 7: a rollback to a copy without proof support drops the pair and says so (4204.388231ms)
  ✔ test 7: an activate to a copy without proof support refuses proof-target without --no-proof and passes with it (4759.812303ms)
✔ T53 row 187: activate sets, carries and drops the proof pair (50454.515454ms)
▶ T54 row 188: a carried pair gets the proof file checks, and a proof file inside the repository refuses
  ✔ test 1: an activate that carries the pair refuses after chmod 644, in the plan and the run, before anything stops (2863.824521ms)
  ✔ test 1: an activate that carries the pair refuses after a symlink to a mode-600 file, in the plan and the run, before anything stops (3004.879209ms)
  ✔ test 1: an activate that carries the pair refuses after removal, in the plan and the run, before anything stops (2802.177477ms)
  ✔ test 2: a rollback that carries the pair refuses after chmod 644, in the plan and the run, before anything stops (3024.136367ms)
  ✔ test 3: a proof file inside the repository refuses, in the plan and the run, before anything stops (1169.881778ms)
  ✔ test 4: a path outside the repository through a directory symlink into it refuses on its realpath (1159.905398ms)
✔ T54 row 188: a carried pair gets the proof file checks, and a proof file inside the repository refuses (14026.212276ms)
▶ T55 row 189: activate --no-send drops --send, and rollback and pm-on carry it off
  ✔ test 1: a live-copy --no-send drops --send from the pointer and the unit, keeps the rest in order, logs the step and backs up the stopped store (2510.192897ms)
  ✔ test 2: a plain live-copy activate still refuses already-active, and so does --no-send once --send is gone (4787.738012ms)
  ✔ test 3: --plan prints one send: line in each case, with the live-copy note on a same-copy run (6839.257713ms)
  ✔ test 4: after --no-send, a rollback to the earlier copy leaves --send out of the pointer and the unit (4399.953538ms)
  ✔ test 4: pm-on after --no-send keeps --send off (3650.058199ms)
  ✔ test 5: --no-send on rollback, pm-on, status, adopt or rehearse is a usage error (770.938229ms)
  ✔ test 6: with both a pair and --send in the pointer, --no-send and --no-proof each drop what they name and keep the rest (11204.885455ms)
✔ T55 row 189: activate --no-send drops --send, and rollback and pm-on carry it off (34164.619739ms)
▶ T57 row 200: activate --sso, its refusals before any stop, and the rollback to a Console without --sso
  ✔ item 1: --sso drops the preview set and the pair, puts --sso before --send and the tester port, and the plan names what it drops and carries (4265.202276ms)
  ✔ item 1: --sso may re-pin the live copy once; later activates carry it; --no-send still drops --send (10221.389285ms)
  ✔ item 1: --sso with a pair or --no-proof, or on any verb but activate, is a usage error (832.030669ms)
  ✔ item 2: a target without --sso, a missing or bad console.sso, and each slot problem refuse before any stop (6970.912678ms)
  ✔ item 3: a config whose console key the target loader refuses stops an activate or a rollback before any stop, naming the first step (5013.798963ms)
  ✔ row 203: a config whose federation key the target loader refuses stops an activate or a rollback before any stop, naming the first step (4222.658036ms)
  ✔ item 3: a rollback from --sso to a Console without it takes the flags from the set of the activation onto the copy, past a same-copy re-pin (sage-1389) (12779.437201ms)
  ✔ item 3: a rollback set that is missing, fails its sums, holds no argv or already ran --sso refuses sso-rollback-flags (4817.189468ms)
  ✔ round 2 (webby-0028 N1): run through a symlinked repository path, a slot or a proof file inside the repository still refuses (2595.440471ms)
  ✔ round 2 (webby-0028 N2): a config.json that does not parse stops the run before anything is read or stopped (2387.124731ms)
  ✔ round 3 (sage-1556): a named instance turns --sso on with its own config, slot and Console unit, and rolls back from its own set (5447.513524ms)
  ✔ row 238 (#1744): on a named instance the sso-config first step names --instance NAME in both commands (1296.560533ms)
✔ T57 row 200: activate --sso, its refusals before any stop, and the rollback to a Console without --sso (60851.893639ms)
▶ T58 row 273: activate --send and --no-sso
  ✔ T1: --sso --send turns send on after --sso and before the tester port, and the plan says so (3046.572268ms)
  ✔ T1: --send beside a carried --sso re-pins the live copy once, and the plan names the carried --sso (5089.76098ms)
  ✔ T2: --send without --sso, given or carried, refuses before any stop, and --plan lists it (2145.417383ms)
  ✔ T2 (sage-2315 B1): a rollback from an --sso --send pointer to a Console without --sso ends with neither flag (4546.709341ms)
  ✔ T2 and T4: --send with --no-send, --no-sso with --sso, --send, a pair or --no-proof, and either flag on another verb, is a usage error (2516.361074ms)
  ✔ T3: --no-sso on the same copy returns the unit and the pointer to the flags from before --sso, without --send (5884.333477ms)
  ✔ T3: the set walk passes later re-pins that ran with --sso, and the tester follows the pointer (5893.915843ms)
  ✔ T3 (sage-2305 a): after --sso, two later re-pins that carry it, then --no-sso restores the flags from before --sso byte for byte (9201.081856ms)
  ✔ T4 (sage-2305 b): a log in which every set holds a Console with --sso refuses before any unit stops (4442.100505ms)
  ✔ T4: --no-sso refuses before any stop on a pointer without --sso, a tampered or missing set, a set that ran with --sso, an ok line with no activation, and a log with no set (6315.937821ms)
✔ T58 row 273: activate --send and --no-sso (49084.405043ms)
✔ R1 rehearse passes on the same schema; the scratch root holds its files and the live files stay byte-identical (2467.299447ms)
✔ R2 rehearse runs the migration checks when the schema differs; the live store stays at 3g (2571.203926ms)
✔ R3 a failing migration gives REHEARSAL_FAIL migrate and starts nothing (416.741861ms)
✔ R4 a host that does not start, does not answer status, reports another pid, launches anyway, makes a launches directory or keeps its lock each fails by name (17597.979081ms)
✔ R5 a host that ignores SIGTERM gets SIGKILL and FAIL host-stopped (3589.691784ms)
✔ R6 a Console that does not answer /healthz gives REHEARSAL_FAIL healthz (6076.56341ms)
✔ R7 a host on another copy fails copy-match (5763.06404ms)
✔ R8 a scratch port in use or reserved refuses, and the rehearsal takes no other port (633.076471ms)
✔ R9 mos-0963: a role reference left outside placeholders/, or left on an env variable, fails credential-ref-live before the host starts (1112.269304ms)
✔ R10 mos-0962: a scratch business that still sets a tracker fails tracker-configured (443.707637ms)
✔ R11 mos-0961: a scratch config on the live data root or on any root but the scratch one, or a sessions.json naming a running pid, refuses by name (1726.024504ms)
✔ R12 mos-0962: a notifier config with a binding fails notify-off (602.313363ms)
✔ R13 the pre-checks: an old copy, a backup that fails its sums, a missing backup or pointer, and usage (933.216635ms)
✔ R14 a host that writes the live config, the live business file or the backup fails the end check by name (8679.449439ms)
✔ R15 a rehearsal stopped by TERM, INT or HUP fails signal and still stops the host and Console and runs the end checks (9208.482613ms)
✔ row 233: --backup last takes the newest backup the log records; a later line with backup null does not hide it, and the store line names it (3701.257129ms)
✔ row 233: --backup last with no backup in the log, or no log, exits 3 with no-backup and makes no rehearsal directory (270.14695ms)
✔ row 233: --backup last refuses a newest backup that is not an activation id, with exit 1 (147.5461ms)
▶ T56 row 190: named instances side by side on one unit directory, $BIN and set of stand-ins
  ✔ T-I3 each instance renders its own config, session env and Description, and nothing of another (2175.705796ms)
  ✔ T-I4 a Console port another installed Console takes refuses port-claimed, and a named instance keeps off the default ports (2321.906671ms)
  ✔ T-I6 alpha's activate and rollback reach nothing of beta's (4649.327419ms)
  ✔ T-I6 swapped: beta's reach nothing of alpha's (4890.681013ms)
  ✔ T-I7 MOSAIC_CONFIG naming alpha's config with no flag refuses instance-root-mismatch and changes nothing (738.086048ms)
  ✔ T-I9 another instance's bus active refuses nothing; one of this instance's does (7779.703312ms)
✔ T56 row 190: named instances side by side on one unit directory, $BIN and set of stand-ins (22556.960817ms)
✔ row196 explicit socket conversion refuses inherited TCP before stop and rollback disables socket (6905.196434ms)
✔ row196 SSO socket conversion pins pointer and unit argv order without send (2780.154544ms)
▶ row196 interpreter activation checks receipt, identity, plan and startup log
  ✔ plan and started log preserve the same interpreter JSON (2752.153087ms)
  ✔ interpreter-receipt-refuse fails at the gate and restores the pointer (3947.760769ms)
  ✔ interpreter-drift fails at the gate and restores the pointer (3898.914486ms)
  ✔ missing-verifier refuses before any start or stop (1220.518087ms)
  ✔ interpreter-unsafe refuses before any start or stop (1215.0547ms)
✔ row196 interpreter activation checks receipt, identity, plan and startup log (13036.227192ms)
▶ row196 rehearsal selects socket only for marked copies and uses scratch dataRoot
  ✔ socket copy (3558.696941ms)
  ✔ legacy copy (3486.818243ms)
✔ row196 rehearsal selects socket only for marked copies and uses scratch dataRoot (7046.515778ms)
✔ config-any-key: a non-console target refusal stops activate and rollback before any stop (3016.286608ms)
✔ config-any-key: a pre-270 target refuses each row 270 key on a full activate and rollback, naming the key (5675.117223ms)
✔ config-any-key: accepting loaders run validate with the selected config on activate and rollback (4223.611835ms)
✔ config-any-key: missing-loader copies accept only the four oldest keys (186.36323ms)
✔ config-any-key: missing config passes but malformed JSON refuses without calling the loader (61.611375ms)
ℹ tests 224
ℹ suites 0
ℹ pass 224
ℹ fail 0
ℹ cancelled 0
ℹ skipped 0
ℹ todo 0
ℹ duration_ms 664740.998541
