test(handoff): capture bounded owner-validation failure evidence - #181

Problem and diagnostic scope

The failures in #180 lose the distinction between a worker timeout, process failure, invalid response and owner/generation mismatch. The SSH queue-count assertion also hides the earlier send result. This PR captures that evidence. The original CI cause remains unverified; this is not a claimed runtime repair.

The PR targets chore/178-dependency-secret-checks at 75539231927637f1f73772026b99a571f888752f (#179). Head 89a7aafee37fff58964e72969c8dfa55b7dde96f adds only four diagnostic/test files relative to that exact baseline. #179 itself is unchanged.

Changes

• An internal diagnostics_channel observation records phase, outcome, elapsed time, configured timeout and process exit/stop reason. It contains no path, target/thread ID, generation, message, arguments or native output. Production has no diagnostic file I/O; collection requires an explicit test preload.
• Send and independent wait retain the same validation predicate, 800-ms probe limit, total monotonic budget, owner/storage qualification and no-replay behavior.
• Test preloads cap captured records and record size. Failure assertions include prior send, queue/native-call and probe evidence; fixtures emit bounded ordered traces, timing/outcome/stop-reason summaries and capture/drop counters. Missing terminal markers mean completeness is unknown; the shared-file byte quota is best-effort across processes, not atomic. Cleanup remains in finally blocks.
• Four injected timeout/start-error/malformed-response/wrong-generation cases must still refuse with zero queue calls. These tests validate classification/privacy, not the historical cause.

Evidence and validation

• Exact macOS arm64 CI toolchain: Node 22.23.4 / npm 10.9.9. Unchanged baseline 7553923 passed both targets in three serialized runs and a full suite: 666 total, 654 pass, 0 fail, 11 platform skips, 1 existing TODO, with the pinned Python reference.
• Instrumented targets and fault cases pass 6/6 on local Node 22 and Node 24. Build/types, repository/diff and exact 95-file package smoke/lifecycle checks pass.
• Diagnostic-only head 068219c passed the full remote matrix and an additional macOS Node 22 observation. The latter had 670 total, 658 pass, 0 fail, 11 skips, 1 existing TODO.
• Previous stacked head 682d71e passed all 11 generated checks, including the original workflow combination, Gitleaks and macOS/Ubuntu/Windows Node 22/24 jobs. Code review at 682d71e completed with no findings; Security Review also completed at the same SHA. No unresolved review threads are recorded.
• No natural owner-probe failure was observed in these instrumented runs. Expected wrong-owner, abort and injected-failure records are distinguished from normal probes. A local 64-sample read-only experiment of the unchanged original worker also matched every sample (max 349.222ms, p95 342.665ms); this temporary experiment is archived outside the PR.

Remaining investigation

Historical worker outcomes were not retained in the original failing CI. Passing runs do not establish that its failures were harmless or fixed. A future naturally failing instrumented invocation is needed to choose a causal repair. #180 stays open. No assertion, runtime timeout or platform policy is weakened, and no speculative runtime workaround is added.

Refs #180; follows the failure blocking #179. #179 remains unmerged.

Independent investigation and test-only follow-up

Two non-interactive, read-only reviewers independently examined the same frozen 189,288-byte evidence packet (SHA-256 2e35bb48af698cd19071aa92853d0084ae4e218beadd5c57766d05ed2a344df8), pinned to 682d71e and the original CI failures. Claude Code 2.1.319 reported canonical claude-opus-5-5 (exit 0); Antigravity 1.5.3 reported gemini-4-argon-medium (SUCCESS). Both runs completed without retries. Their opinions were checked against source; agreement is not treated as causal proof.

Both identified an early SSH exit-code assertion that ran before detailed diagnostic construction. Test-only follow-up 5f577d8 fixes it and the analogous local assertion, emits bounded ordered traces including stopReason, and makes dropped/unknown capture completeness explicit. Two new tests cover capture bounds and private-field/custom-toJSON exclusion. Production source is unchanged from the reviewed 682d71e.

Local Node 22.23.4 and Node 24.22.1 targets pass 8/8 each. A controlled loss-vs-inject assertion experiment fails intentionally before and after: before omits probe/queue/native/capture details from the assertion; after includes all four. This validates diagnostic coverage only, not the historical CI cause. Build/types and diff checks pass. Remote evidence for each exact head is separated below; earlier-head results are not reused.

The first original failure is narrowed to pre-write owner validation/native initialization binding, after the initial capability probes. The second SSH failure did not retain the send result, so its cause cannot be equated with the first. A timeout would establish budget expiry, not prove scheduler starvation. stopReason already survives aborted/stopped classification; no speculative predicate, timeout, cancellation or protocol change was made. Natural failing evidence remains required; #180 remains open.

Windows preload correction

The first follow-up CI at 5f577d8 exposed ERR_UNSUPPORTED_ESM_URL_SCHEME in the two newly added cross-platform collector tests: Windows drive paths were passed to --import. Commit 89a7aaf uses the preload's file URL instead. Both collector tests pass locally on Node 22 and 24 and test:types passes. This test harness defect is distinct from #180; the corrected remote matrix completed successfully as recorded below. No production source changed.

Final exact-head verification: 89a7aaf

• All 10 generated check runs completed successfully at 89a7aaf, including macOS/Ubuntu/Windows Node 22/24, repository policy, release gate, Gitleaks and GitGuardian. No commit-status contexts are configured for this SHA; their empty aggregate is not a failed check. CLI run: https://github.com/abruption/session-peer-ts/actions/runs/42575272102.
• Both macOS full suites: 672 total, 660 pass, 0 fail, 11 platform skips, 1 existing TODO. The original local and SSH targets pass. Windows Node 22/24 also pass the two new capture tests and package checks after the file-URL correction.
• Current-head Code Review completed with no findings; Security Review completed at the same SHA. The earlier newline-escaping finding was checked against raw source, generated worker output (actual LF; valid JSON) and distinct passing tests; the evidence reply is recorded and the thread resolved. No source edit was warranted for that finding.
• The original natural failure still did not recur. Expected wrong-owner, timeout/abort and explicitly injected failures are not counted as reproductions. test: investigate macOS Node 22 owner-validation failures blocking #179 #180 remains open and no causal runtime fix or release is claimed. ci: add reviewed Dependabot updates and redacted secret scans #179 and test(handoff): capture bounded owner-validation failure evidence #181 remain unmerged.