test(cli): clarify cleanup timing limits and namespace failures (#1873)

packages/cli/tests/case-cleanup-time.test.mjs

@@ -15,6 +15,8 @@ const read=name=>readFileSync(new URL(`../../../scripts/${name}`,import.meta.url
 // The namespace fixes /proc inventory size; it does not replace clean_session.
 // See org-cleanup-time-build.md for the standalone and loaded calibration. The
 // bound must reject 1s/2s delays and leave most of the 2s production headroom.
+// Constant delays below 0.5s can pass; this is not a bound on host-wide scan
+// cost. In particular, per-entry work needs a shipped scan-cost follow-up.
 const CLEANUP_LIMIT_SECONDS=0.5;
 const probe=fileURLToPath(new URL('./case-cleanup-time-fixture.mjs',import.meta.url));
 
@@ -42,8 +44,9 @@ for(const name of scripts)test(`cleanup timing ${name}: inner timeout kills desc
   ],{
     encoding:'utf8',timeout:15000,killSignal:'SIGKILL',
   });
-  assert.equal(outer.error,undefined,outer.error?.message);
-  assert.equal(outer.status,0,outer.stdout+outer.stderr);
+  const prerequisite='requires /usr/bin/unshare and unprivileged user/PID/mount namespaces (check kernel/AppArmor/container seccomp)';
+  assert.equal(outer.error,undefined,`${prerequisite}: ${outer.error?.message}`);
+  assert.equal(outer.status,0,`${prerequisite}; probe output:\n${outer.stdout}${outer.stderr}`);
   assert.equal(outer.stderr,'');
   const result=JSON.parse(outer.stdout);
   assert.equal(result.error,undefined,result.error);
@@ -57,6 +60,9 @@ for(const name of scripts)test(`cleanup timing ${name}: inner timeout kills desc
   assert.notEqual(pairs[1][0],pairs[0][0]);
   assert.equal(pairs[1][1],pairs[0][1],'the descendant belongs to the supervised session');
   assert.deepEqual(result.live,[],'cleanup must kill the whole process tree before namespace teardown');
+  // A positive centisecond pair relies on clean_session's current mandatory
+  // 0.01s retry sleep. Revisit this measurement if shipped cleanup removes it;
+  // keep the shared inner-timer parser strict in the meantime.
   const seconds=readProbeSeconds(result.clock);
   t.diagnostic(`${name}: cleanup ${seconds}s; limit ${CLEANUP_LIMIT_SECONDS}s`);
   assert.ok(seconds<CLEANUP_LIMIT_SECONDS,`${name}: cleanup ${seconds}s must be < ${CLEANUP_LIMIT_SECONDS}s`);