* test(ui): deslop q0002 tests
Remove duplicate E2E layers and success-only capture scaffolding. Keep browser geometry, real transport, lifecycle and security assertions. Make the retained waiting-timer alignment check independent of optional artifact capture.
Retained proof: new-session-page.durable-write-teardown.e2e.test.ts owns the identical near-cap and pending-write scenarios; config-page.custom-theme.test.ts and view-appearance.browser.test.tsx own Clear/import and rejected-preference behavior; question-prompt.shared-state.test.ts and chat-question-card.test.tsx own sibling resolution and typed-answer remounts. Keep secret validation and corrected-host submission together.
Usage rendering/status remain in usage-page.test.ts, view.test.ts, view-overview.test.ts, provider-usage.test.tsx and tooltip.browser.test.ts. Sidebar ordering remains in app-sidebar-session-navigation-logic.test.ts, app-sidebar-session-filter.browser.test.ts and sidebar-selection-overflow/session-stability/pin-placement E2Es. Desktop mapping/retry remain in desktop-panel.test.ts and desktop-panel-session.test.ts; real keyboard/control proof remains in desktop-keyboard.e2e.test.ts and desktop-panel.e2e.test.ts.
CI-only campaign: no tests, builds or coverage run. Plain oxlint, oxfmt and diff checks pass. LOC 6099 -> 5163 (15.3%); declarations 57 -> 45; literal-expanded cases 73 -> 53. Stop below 40% to preserve distinct browser and real MCP transport proof. No production, support or routing changes.
* test(ui): consolidate remaining q0002 e2e layers
Keep browser geometry and real transport contracts while removing owner-boundary replays. Cumulative shard LOC: 6099 -> 3635 (-40.4%); this commit removes another 1528 lines net. Static declarations 57 -> 30, expanded cases 73 -> 38. No test/build/coverage runs under CI-only mode; plain oxlint, oxfmt and diff checks pass.
Subagent lifecycle, elapsed time and token accumulation remain in chat-progress.test.ts (reports the whole request; retains a resumed request), chat-sessions-yield.test.ts (counts each run once), chat-transcript-message-index.test.ts (preserves handoff), chat-pane-sidebar-layout.test.tsx (focus and retained panels) and chat-header-subagents.e2e.test.ts. Keep inline width, working-status ordering and waiting-clock browser geometry here.
MCP confirmation/context and live authority remain in mcp-app-view.test.ts, server-methods/mcp-app.test.ts and mcp-app-standalone.test.ts; cache policy remains in mcp-app-sandbox-http.test.ts. Keep real App/HTTP/stdio cancellation, teardown, history and cross-origin theme proof.
Appearance defaults/accent/server-selection remain in control-ui-presentation.test.ts, view-appearance.browser.test.tsx, server-prefs.test.ts, config-page.custom-theme.test.ts, settings.navigation-profile.test.ts and theme-selection-defaults.e2e.test.ts. Keep actual imported-palette reload and read-only reasoning proof. Question state/recovery remain in chat-composer-question.test.ts, question-prompt.test.ts and favicon status/browser owners; retain shared-card secret validation/retry in the mounted ask document.
Attachment restoration and retirement remain in draft-handoff, incognito-navigation and attachment-url-lifecycle E2Es. Read completion, partial-batch custody and submission gates remain in chat-attachments.test.tsx, composer-attachments.test.ts, submit-gates.test.ts and chat-attachment-read-lifecycle.e2e.test.ts. Initial text adoption remains in history-merge.test.ts. Trim unasserted usage fixture fields only.
Navigation startup/loading and typing remain in chat-history-warm-startup.test.ts, sessions/index.test.ts, connection-bootstrap.test.ts and chat-composer-focus.e2e.test.ts. Desktop popup routing remains in desktop-panel.e2e.test.ts and the session URL contract tests. No production, helper, routing or baseline changes. Leave the pre-existing obsolete cost-window-card selectors for coordinator diagnosis.
* test(scripts): deslop q0005 tests
Remove native-assignment cases duplicated by upgrade-survivor-native-assignments.test.ts, redundant tooling argument variants and log inventories. Share hosted-gate fixtures and assertions while retaining trust, freshness, membership and ordering checks. Keep the release-reuse resolver suite unchanged: its remaining cases protect distinct release authority and policy branches.
* test(scripts): deslop q0012 tests
Remove the copied frozen-membership suite from the plugin registry tests; upgrade-survivor-membership-compat.test.ts retains its three identical cases. Remove the copied loaded-stop-policy suite and virtual-clock harness from systemd tests; upgrade-survivor-stop-policy.test.ts retains all seven identical declarations, including process custody and cleanup failures.
Trim source-spelling inventories already covered by executable Docker mount and credential tests and release workflow step lookups. Drop the untouched, unreferenced candidate-manifest self-comparison; preserve Node private-export loading proof.
CI-only campaign: no tests, coverage, or builds run. Plain oxlint, oxfmt and git diff --check passed. 6383 to 5689 test lines; the remaining independent ownership, authority and lifecycle paths prevent an honest 40 percent cut.
* test(scripts): consolidate q0001 fixtures and owner proof
Squash the three q0001 cleanup commits onto the campaign lane. Preserve the newer lane waiver-admission cases, updated qualification-success assertions, and repaired owner-exemption fixture while retaining the shard consolidations and deletions elsewhere.
CI-only validation: plain oxlint and oxfmt --check pass for all nine touched files; git diff --check passes. No tests, coverage, Testbox, or check-changed run; affected-test execution is deferred to landing PR CI.
* test(scripts): deslop q0014 tests
Share repeated recovery request slices, method/path selectors, and pagination fixtures in the security-review entry-point suite. Preserve every case and assertion; no production or shared test-support changes.\n\nKeep mac-runtime and frv.release unchanged: their executable security, publication, transport, and lifecycle boundaries have no redundant source-grep layer to remove safely. CI-only validation: plain oxlint, oxfmt, and diff check.
* test(scripts): remove redundant q0014 boundary layers
Remove duplicate parser variants, fixture self-checks, and internal inventory lookup proof already exercised by retained materialization snapshots and path-binding cases. Retain direct classifier cursor restoration, close-on-advance, abort cleanup, descriptor substitution, and publication guards.
Consolidate release transport and artifact variants at their shared decision branches. Keep child workflow authentication at both callsites and denied second-page reads. Remove repeated security-review recovery and lifecycle scenarios covered by retained recovery cases, dependency-guard-script same-head approval, security-review-rollout ancestry, and security-sensitive-guard-script lifecycle tests.
CI-only: oxfmt, plain oxlint, and diff check passed; no tests or coverage run. Original shard LOC 5624 to 5060; the 40 percent target remains unmet because remaining security, publication, and lifecycle contracts have no equivalent retained proof.
* test(scripts): consolidate q0014 evidence fixtures
Share security-review assertion, lifecycle, timing, and CI fixtures; retain all cases while consolidating common completion scenarios. Share FRV subprocess fixture ownership and legacy qualification setup without changing their distinct outcomes.
Narrow Mac staging proof to package selection, launcher removal, owner metadata, isolation, and publication. The materialization resource snapshot and derived-runtime consumer cases retain byte-preservation and foreign-image removal proof. Share materializer FD/race evidence recording while retaining schedule, identity, bytes, and cleanup assertions.
CI-only: plain oxlint, oxfmt, and diff check pass; no tests or coverage run. Original shard 5624 lines to 4886. The 40 percent target remains unmet; no sole security, release, or lifecycle proof was deleted to force the metric.
* test(qa-lab): deslop q0015 tests
Drop the synthetic v3 server and its cleanup-only test. Protocol range and mismatch behavior remain in src/gateway/client.test.ts (advertises the protocol compatibility range; pauses default operator clients after a permanent protocol mismatch).
Consolidate real node inventory, presence and location invocation into the retained v3/v4 reconnect scenario. Keep plugin-surface negotiation, pairing reuse, exact invocation results and presence persistence checks.
Remove the duplicate Discord quiet-success row: quiet failed-tool coverage remains in the shard, and message-handler.draft-preview.rest.test.ts covers completed tool activity with progress disabled. Run the identical portable rendering subscenario once rather than once per Discord progress variant.
CI-only shard: oxfmt, diff-check and plain oxlint pass; no tests or coverage executed. Lines 5041 -> 4715; static cases 25 -> 21. Below the 40 percent target because the remaining scenarios cover distinct authority, lifecycle, catalog replacement and transport behavior.
* test(qa-lab): remove redundant q0015 e2e layers
Reduce the original shard from 5041 to 2606 test lines (48.3 percent), plus delete its now-unused 65-line native CLI fixture. Keep the previous shard commit intact. CI-only validation: oxfmt, diff-check and plain oxlint pass; no tests, coverage, builds or typechecks run.
Retire the orphaned gateway-node-control-plane suite: its five control-plane helper imports have no implementations or exports, including at the shard baseline. Keep client.test.ts protocol-range proof, server.node-pairing-authz.test.ts legacy reconnect and surface approval proof, plugin-node-capability.test.ts legacy ceiling and capability proof, node-command-policy.test.ts policy proof, and server-node-events.test.ts plus device-pairing.test.ts and node-catalog.test.ts presence persistence/projection proof. Remove only its exact CI inventory and timing entries.
Remove announcement E2E replays and their proxy/observer fixtures. Owner proof remains in subagent-announce-delivery.test.ts (reports suppression/adapter ambiguity; does not credit unidentified automatic receipts), delivery-completion.integration.test.ts (keeps an uncertainty notice owed without a delivery identity), and session-observer.terminal.test.ts (preserves the cause of a model failure). Slack dispatch.preview-fallback.test.ts owns compact/card/native task, failure and explicit reply-target branches; Discord message-handler.draft-preview.rest.test.ts and message-handler.process.draft-final.test.ts own quiet/tool progress and settlement. Keep the real stale pre-tool preview regression, origin-loss/native-stop rejection and portable Discord wire proof.
Keep Telegram catalog replacement with claimed callback, no premature edit, two acknowledged callbacks, advanced polling offset and fully drained ingress. Generic browsing/CLI availability remains in bot.model-picker.test-support.ts via bot.test.ts, bot.create-telegram-bot.test.ts callback retry, model-callback.loopback.integration.test.ts, models-list-result.cli-runtime-availability.test.ts and prepared-model-runtime.native-demand.test.ts.
Remove the mixed worker lifecycle replay: node-worker-bundle-installer.test.ts repairs missing receipts; node-worker-supervisor.test.ts admits two durable launches and releases physical slots; worker-turn-launcher-failure-recovery.test.ts preserves active placement after offline/capacity rejection; placement-dispatch-reclaim.test.ts moves back without a reclaimed intermediate; nodes.test.ts and provider-node-teardown.test.ts own role-removal ordering and exact stop/credential settlement. Keep real revoked/unconfirmed turn fencing. Codex retains denial/approval, credential isolation, persistent authorization, physical disconnect extinction and fresh recovery; remove duplicated diagnostic scaffolding and reuse joined cleanup.
* test(ui): deslop q0016 tests
Remove capture-only video, screenshot, and timing-report scaffolding while retaining pagination probe evidence and all real-Gateway ordering, byte-budget, pagination, and avatar-cache assertions.
Coverage owners: chat-error-details.e2e.test.ts and chat-view.test.ts retain error disclosure/copy contracts; chat-responsive.browser.test.ts, new-session-page.responsive-welcome.e2e.test.ts, and new-session-page.model-picker-spacing.e2e.test.ts retain shared responsive composer/picker layout. The streaming flow retains terminal partial text, keyboard/touch disclosure, error geometry, and retry clearing.
Delete repeated account-refresh proof owned by model-control.metadata-lifecycle.test.ts (selects a usable retained account after refresh failure without changing saved preferences). Delete folder fallback replay owned by place-browser-state.test.ts (opens HOME for a missing starting folder but reports explicit navigation failures) and place-browser.test.tsx (failed-refresh alert and recovery).
CI-only campaign: no tests, coverage, build, or check-changed runs. Plain oxlint, oxfmt, and diff-check pass. Below the 40% target: retain distinct media transport, history/reconnect, approval, telemetry-row identity, and durable-store interleaving coverage.
* test(qa): deslop q0017 tests
Remove duplicate Docker destination-policy proof retained by required-destination-container-wire.e2e.test.ts. Retain real cancellation and container cleanup proof.
Keep exact-pin private-history coverage in src/gateway/server-methods/skills-library.test.ts (exposes exact private pins only while session access remains current), with private RPC denial in skill-library-identity-wire.e2e.test.ts. Keep non-read automation action coverage in src/agents/agent-tools.turn-authority.test.ts (serves caller-scoped automation reads and keeps every write owner-gated).
Deduplicate native provider setup with the existing fixture, remove diagnostic-only bookkeeping, and reduce ownership input combinations without losing attachment, ordering, or seeded/unseeded dispatch branches. Preserve all distinct revocation, disclosure, native settlement, and installed-package boundaries.
CI-only validation: formatter, plain oxlint, and git diff --check pass. No tests or coverage run. Shard lines 5421 to 5065; declarations 14 to 13; expanded cases 18 to 15. The 40 percent line target is not safely attainable without dropping distinct end-to-end proof.
* test(qa): remove redundant q0017 e2e layers
Delete provider-review composition: sessions-provider-review.test.ts owns literal admission and awaited-read authority; provider-review-continuation.test.ts owns exact SSE/WebSocket steer and final-effect revalidation; sessions-sharing.test.ts owns viewer denial; devices.lifecycle.test.ts owns immediate invalidation. Session lifecycle tests retain review persistence.
Delete Docker composition: required-destination-container-wire.e2e.test.ts retains physical execution and result reconciliation; node-worker-supervisor.container.test.ts retains mounts, labels, isolation and cancellation acknowledgement; worker-runtime-permissions.suite.ts retains full-mode approval suppression. UI chat-flow.models-reasoning, worker-inference and chat-run-lifecycle E2Es retain send/settings/start/abort ordering.
Delete automation-boundary composition: system-turn-automation-reads.e2e.test.ts retains real notice admission; cron.validation.test.ts retains creator isolation and history hydration deletion/closure; agent-tools.turn-authority.test.ts retains owner gating and forged provenance; authenticated-request-dispatch.server.test.ts retains runtime revocation before response. Cron service one-shot and batch-finalization tests retain durable failure and auto-disable notification.
Remove global ownership replay covered by chat-send-global-identity, chat-send-attachments.owner, chat-history-ownership, server.agent.gateway-server-agent-a, placement-turn-claims.worker and sessions-describe-worker tests. Remove worker permission/legacy/audit and Workshop-authoring replays covered by worker-runtime-permissions.suite, node-launch-adapter, execution-decision-facts/work and skill-library-authoring tests.
Preserve loaded finalization, reconnect, physical skill materialization/pinning, native same-session settlement, canonical OpenShell authority and installed OTel coverage. Original shard 5421 to 2881 lines (-46.9%); additional pass 5065 to 2881 (-43.1%). Static formatter, plain oxlint and diff check pass. No tests or coverage run under CI-only instructions.
* test(ui): consolidate q0003 e2e owner proof
Port q0003 commits 351963564e993 and df86bbb922071 onto the campaign lane. Preserve the newer capability-menu and session-group cases unchanged, plus all four Enter-key cases and their stronger committed-state wait. Apply the remaining cleanup and retain receipt-list failure visibility and desktop scrollability assertions.
CI-only validation: oxlint and oxfmt --check passed for all six shard files; git diff --check passed. No tests, coverage, Testbox, or check-changed were run. Independent review is clean after fixing two Activity assertion gaps.
* test(scripts): trim q0012 owner replays and fixtures
Port q0012 commits ef8017a51048, 446dc27dff34, and 565ac587d1c7 onto the campaign lane. Preserve the newer Windows release-selection matrix, exact-head security-enforcement cases, and package-test sparse declaration-roots regression while applying the shard cleanup.
CI-only proof: plain oxlint and oxfmt --check passed for all eight touched files; git diff --check passed. Independent review found no actionable findings. Tests, coverage, Testbox, and check-changed were not run; affected-test execution is deferred to landing PR CI.
* test(ui): deslop q0020 tests
Remove the restored A2UI suite: its renderer, corpus fixture and bundler were retired in 6f88c26dcf (#182109). Retired-widget migration remains covered by src/commands/doctor-a2ui-widgets.test.ts.
Keep direct shortcuts in session-shortcuts.e2e.test.ts and keyboard-shortcuts-focus.e2e.test.ts instead of replaying them in the real-Gateway search scenario. Keep both composer routes with hover coverage rather than additionally replaying without hover.
Share pending account-pagination checks. Remove optional capture/reporting layers and unasserted render diagnostics while retaining budget assertions, native security/recovery, search scope, and responsive controls. CI-only campaign: oxfmt, plain oxlint and diff-check passed; tests and coverage deferred to hosted CI.
* test(ui): consolidate q0016 e2e owner coverage
Retire redundant picker revalidation and retry scenarios covered by model-control.metadata-lifecycle.test.ts, model-control.test.ts, and chat-model-picker.browser.test.tsx. Keep browser geometry and metadata publication recovery.
Image alias acquisition and eviction remain in chat-message-image-admission.test.tsx and chat-message.images.test.tsx. File-copy fallback remains in chat-file-copy-retirement.e2e.test.ts (current/path) and clipboard.test.ts (absent API). Avatar cache semantics remain in assistant-avatar-http.test.ts.
Cursor commentary recovery remains in chat-history-cursor.test.ts; pane eviction remains in the retained paginated-history scenario. Offline attachment replay remains in chat-outbox-payloads.e2e.test.ts. Consolidate retained reasoning/tool navigation and pre-submit creation assertions into the stronger cross-tab and browsed-folder scenarios.
Keep touch-completion interleaving; generic disclosure and normalization remain in chat-responsive.e2e.test.ts, chat-transcript-render.test.ts, and markdown-streaming.test.ts. Tool detail contracts remain in chat-tool-cards.test.tsx. Incognito queue persistence remains in composer-persistence.test.ts; checkout/filter behavior remains in checkout-chip.test.ts, where-chip.test.ts, and new-session-page.incognito-navigation.e2e.test.ts.
CI-only: plain oxlint, oxfmt, and git diff --check pass. No tests, builds, or coverage run. Original shard 5466 lines to 3558 (34.9%); further cuts would retire distinct lifecycle, security, storage, or layout proof.
* test(scripts): deslop q0019 tests
Factor dialect expectation rows and release-child rejection types without removing cases. Keep all 22 primitive-owner matrix inputs and every release authority and lifecycle boundary.
Remove the repeated identical-input inventory scan assertion; the retained SQL inventory case still verifies its rows. Remove copied benchmark lane IDs; the retained inventory test still validates the manifest and hashes the selected workload.
* test(scripts): remove redundant q0019 fixture layers
Replace the fixture-defined cancellation/rescue driver with the fixture owner promise-join and unwind contract. Keep real process cleanup at test/helpers/run-node-script.test.ts and test/scripts/managed-child-process.output.test.ts (starts owned-tree cleanup at leader exit while a descendant holds both output pipes).
Use the shared copied-source compiler for lint fixtures, trim repeated branch variants, and remove copied catalog, recipe, workflow-default and diagnostic inventories. Workflow default identity remains in full-release-validation-continuation-workflow.test.ts; the stronger mid-verification rerun and failed-upload cases retain reuse validation coverage.
Preserve distinct release approval, provenance ordering, credential isolation and worker shutdown interleavings. Validation is static only under the campaign CI-only instruction.
* test(scripts): consolidate q0019 owner-boundary proof
Keep related lint outcomes and Android approval rejections in shared tables with all distinct inputs retained. Compact dialect expectations while preserving construct order, multiplicity, owner classification and independent span checks.
Drop duplicate Barnacle maintainer exemption proof covered by ancillary-workflow-concurrency.test.ts (rejects the owners known exemption before allocation). Keep inline-model conversion at src/agents/embedded-agent-runner/model.inline-provider.test.ts and wrapper trailer formatting at run-vitest-bounded.test.ts; retain shutdown races in their owner suite.
Reuse the watchdog and benchmark schedule fixture owners; remove prepared-layout source inventories and repeated stage-independent logging validation. No production changes or runtime tests; CI-only campaign static gates passed.
* test(scripts): deslop q0018 tests
Remove copied workflow and catalog inventories while retaining executable provenance, planner, redaction, and renderer contracts. The prerelease scheduler case retains the external-install canary; renderer collision checks retain generic anchor uniqueness. Exact child identity and dispatch behavior remain covered by package-acceptance-workflow.test.ts.
CI-only: oxfmt, plain oxlint, and diff checks passed. No tests or coverage run. Shard LOC 5665 to 5368 (5.2%); below the 40% target because the remaining credential, npm provenance, and process lifecycle cases protect distinct boundaries.
* test(scripts): deslop q0018 redundant proof layers
Drop repeated allowlist-entry graphs; retain exact worker/Doctor admission, unowned references, sink budgets, repeated publication edges, SDK escapes, command and lazy-import boundaries. Replace copied planner partitions with complete, unique file coverage and Telegram config ownership.
Delegate profiler contents to run-vitest-profile.test.ts (profiles selected runner) and post-ack shutdown to vitest-fork-shutdown.test.ts (joins hung-exit shutdown). Preserve namespace and SQLite lifetime proof here. Remove duplicate npm producer-verifier rows and report inventories; shared producer failures remain covered by requires a successful parent for publication and reuses successful preparation and source jobs after parent failure. Synthetic maturity judgments still assert the independent 75 percent result.
CI-only: oxfmt, plain oxlint and git diff --check passed; no tests, coverage or check-changed ran. Additional cut: 5368 to 4771 lines. Cumulative: 5665 to 4771 (15.8 percent), still below the requested 40 percent. No production or support files changed.
* test(scripts): reduce q0018 runner replay fixtures
Replace the multi-wrapper state-cleanup replay with focused real two-file SQLite retirement, strict first/second-file failure verdicts, and native shell-profile isolation. Keep native-home admission and resource receipt failure branches. Home staging remains covered by test/test-env.test.ts, temp-home lifecycle by src/test-utils/temp-home.test.ts, worker retirement by test/non-isolated-runner.test.ts, cache lifetime by vitest-process-cache.test.ts, and wrapper execution by run-vitest, run-vitest-profile, and vitest-report-owner tests.
Remove copied prerelease command and concurrency inventories while keeping scheduler completeness, non-cancellation, release-context rejection and blocking-result invariants. CI-only: oxfmt, plain oxlint and diff checks passed; no tests or builds run. Shard LOC 4771 to 4434 this pass, 5665 to 4434 cumulatively (21.7 percent); the requested 40 percent remains unmet.
* test(release): share q0013 transport and native helper proof
Port q0013 commits f2633d4609e0, 818c7c5651bd, and d376c73ca2b4 onto the campaign lane as one commit. Preserve newer release-state coverage, including HTTP/2 recovery, artifact errors, ghost attempts, Windows policy, cancellation, and candidate manifests.
CI-only validation: plain oxlint, oxfmt --check, and git diff --check passed. No tests or coverage run. Independent review finding checked against the helper producer and consumer paths and rejected: both use the fixture work/helper-products file.
* test(scripts): deslop q0023 tests
Consolidate fixtures and remove duplicated gauntlet process lifecycle replays. Keep managed-child-process.output.test.ts, managed-child-process.test.ts, and managed-child-process.drain.test.ts as lifecycle owners; retain gauntlet error mapping and late-signal rethrow proof.
Retain HTTP routing coverage while relying on agent-plugin-bundle-response.test.ts for bundle receipt rejection and bench-gateway-concurrency.test.ts for runtime-carrier boundary variants. Remove repeated same-guard control inputs and copied default inventories.
CI-only campaign: oxfmt, plain oxlint and diff-check pass. No tests or coverage run. 5245 to 4925 lines (6.1% reduction); the 40% target remains unmet because remaining cases protect distinct security, provenance, lifecycle and publication paths.
* test(scripts): remove redundant q0023 tooling layers
Retire repeated lifecycle matrices and complete command inventories. Checkout ownership/reset/retry/cancellation stays in ci-platform-checkout.test.ts; generic fencing, typed recovery and output settlement stays in ci-git-owner.test.ts. QA topology/protocol-base validation stays in ci-workflow-evidence.test.ts.
Keep gauntlet-specific late-signal rethrow and timeout row mapping with minimal native fixtures; shared managed-child-process tests own descendant cleanup. Keep one real QA diagnostic integration and exercise invalid summaries directly through readQaSuiteSummary. Combine dependency/slash lifecycle setup and replace parser inventories with shared-branch representatives.
Bundle protocol stays in agent-plugin-bundle-response.test.ts; retain HTTP routing checks. Replace the self-counting npm fixture with a direct reported-tarball identity assertion; npm-runner.test.ts retains runner selection proof. Remove same-guard input variants while retaining security boundaries.
CI-only: oxfmt, plain oxlint and diff-check pass; no tests/build/coverage run. This commit cuts 4925 to 4176 lines. Cumulative 5245 to 4176 is 20.4%, below the 40% target; remaining independent downloader, mock-server and publication behaviors have no replacement proof.
* test(scripts): consolidate remaining q0023 duplicate proof
Remove the test-local readiness simulation and nested state factory mock. Preserve the SQLite flip live endpoint, configuration failure and verified child cleanup contracts at actual instance acquisition. Keep utility model precedence and shared streaming lifecycle assertions once; malformed MCP output remains covered by the Code Mode fixture completion scenario.
Move QA hot CPU assertions into the existing diagnostic integration; startup CPU remains covered by check-gateway-cpu-scenarios.test.ts. Merge empty-run cleanup into the existing slash-only scenario. Remove redundant process signal call-shape instrumentation while retaining observable death of initially-live resistant descendants.
Shrink copied input and manifest inventories and shared executable fixtures. Preserve independent custom package runner timeout, graceful drain, clamp and external termination cases: these do not use the managed-child runner. Keep downloader security and provenance guards.
CI-only static gates pass: oxfmt, plain oxlint and diff-check. No tests/build/coverage run. Additional 4176 to 3987 lines; cumulative 5245 to 3987 (24.0%). Target remains unmet by 840 lines; no files or production code deleted.
* test(ui): deslop q0021 tests
Remove optional capture scaffolding and duplicate E2E owner replays. Keep browser geometry, keyboard focus, remote approval routing, recovery authority, and real-Gateway interleavings.
Remaining proof: approval-page.test.ts covers malformed projections and reconnect gating; canonical winner E2E covers refreshed Gateway content. markdown-code-blocks.test.ts and markdown-streaming.test.ts cover literal indented rendering/copying, and markdown-element-refs-solid.test.ts covers retained observation teardown. processes-panel-data.test.ts and chat-processes-panel.test.ts cover transient reads, empty results and stop capability changes. Catalog cold-link flow retains sidebar return, split ownership and adoption; one viewer and one over-budget art size cover the duplicate input rows.
CI-only campaign: plain oxlint, oxfmt and diff check pass. No tests or coverage run. LOC 5100 -> 4654 (-8.75%); target 40% not reached without dropping distinct behaviors.
* test(ui): deslop q0021 e2e owner layers
Remove quota switching replay: chat-state.test.ts rebinds selected-global auth and rejects superseded Main; chat-pane-identity.test.ts rebinds retained fixed-route presentation; chat-view.test.ts scopes subscription usage and navigation.
Keep share routes in route-loader-catalog-share.test.ts; catalog views in codex-sessions.e2e.test.ts; process lifecycle in processes-panel-data.test.ts, chat-processes-panel.test.ts and processes-panel.e2e.test.ts; subagent navigation in chat-details-subagents.test.tsx and chat-subagents-panel.test.ts.
Keep streaming fence control identity in chat-message-streaming.browser.test.tsx; rail navigation and viewport membership in chat-position-rail.e2e.test.ts; responsive composer sizing in chat-composer-sizing.test.ts; tooltip pin/dismiss behavior in tooltip.test.ts and tooltip.browser.test.ts.
Keep pending device creation in new-session-page.device-folder.e2e.test.ts, create-params.test.ts and session-placement-startup.test.ts; destination restoration in draft-place-default-repository.test.ts, draft-place-state.test.ts and draft-session-placement.test.ts. Queue mutation conflicts remain in chat-queue-edit-conflict-recovery.e2e.test.ts and chat-queue-reorder.test.ts.
Consolidate fixtures and browser probes while retaining real geometry, codecs, recovery guards and collaborator interleavings. Correct pre-existing nonexistent composer harness imports to the existing exact locator boundary. Approval severity and canonical resolution remain in approval-page.test.ts. Attachment status rendering remains in chat-message-attachments.test.tsx.
CI-only: no tests, coverage or builds run. Plain oxlint, oxfmt and git diff --check pass. Original shard 5100 -> 3104 LOC (39.1%); 44 lines short of 40%, retained rather than deleting distinct browser/lifecycle proof.
* test: retain d453 contracts flagged by CI and review
* feat(release): qualify frozen candidates with their own harness
Keep candidate qualification code, required coverage, and baselines frozen while independently trusted tooling authenticates admission and publication. Preserve historical recovery and verify exact qualified npm and Docker artifacts without candidate-to-publisher ancestry.
Co-authored-by: RomneyDa <6581799+RomneyDa@users.noreply.github.com>
* fix(release): restore authenticated harnesses before execution
Bootstrap only from the immutable caller commit, then restore and verify the authenticated callee revision before any repository code runs. Preserve canonical origin and path guards, with real Git regression coverage. Remove duplicate coercion declarations without importing executable normalization code before bootstrap admission.
Co-authored-by: RomneyDa <6581799+RomneyDa@users.noreply.github.com>
* test(release): align qualification fixtures with frozen harnesses
Provide explicit ordinary-lane workflow inputs and the complete committed bootstrap closure. Assert immutable caller seeds rather than a moving main checkout, preserving authenticated harness restoration. Keep the internal evidence script constant private.
Co-authored-by: RomneyDa <6581799+RomneyDa@users.noreply.github.com>
* fix(ci): register frozen qualification dynamic entrypoints
Model the verified Node child runner and generated admission-transport fixture as exact Knip entrypoints. Keep the fixture out of production roots and preserve the hard-zero unused-file and export checks without ignores or fake imports.
Co-authored-by: RomneyDa <6581799+RomneyDa@users.noreply.github.com>
* test(release): include captured baselines in plugin fixtures
Model the independent phase qualification-baseline step with empty outputs and assert both trusted baseline output bindings. Preserve the substituted candidate SHA and the scanner checks against the separately admitted source identity.
Co-authored-by: RomneyDa <6581799+RomneyDa@users.noreply.github.com>
* fix(release): remove circular manifest policy dependency
Remove the retired empty-advisory helper and emit the unchanged empty wire fields at their producers. Keep strict advisory rejection and the single manifest builder.
Co-authored-by: RomneyDa <6581799+RomneyDa@users.noreply.github.com>
* test(release): cover frozen catalog checkout closure
Preserve exact sparse-path, byte-integrity, and candidate-isolation assertions for both catalog dependencies. Keep them excluded from preflight materialization.
Co-authored-by: RomneyDa <6581799+RomneyDa@users.noreply.github.com>
* refactor(release): remove unused evidence facade export
Keep manifest child evidence owned by the extracted manifest module; policy and state consumers use that owner directly.
Co-authored-by: RomneyDa <6581799+RomneyDa@users.noreply.github.com>
* fix(release): revalidate admission before publication effects
Carry authenticated admission authority through Docker and npm publication, rechecking it after preparation and immediately before each external registry mutation. Preserve original evidence and publisher guards; deny revoked authority in recovered and multi-package publication.
Co-authored-by: RomneyDa <6581799+RomneyDa@users.noreply.github.com>
* test: align release qualification coverage with main
* test: format release checklist coverage
* test: restore release fixture closure
* test: run compact admission from frozen tooling
* test: cover oldest supported upgrade baseline
* test: reconcile package acceptance coverage
* test(release): align candidate-owned dispatch docs
---------
Co-authored-by: roboclaw-bot <309084314+roboclaw-bot@users.noreply.github.com>
Co-authored-by: RomneyDa <6581799+RomneyDa@users.noreply.github.com>
Co-authored-by: Dallin Romney <dallinromney@gmail.com>
Embed the shared, verified OpenClaw Bun runtime in the Linux companion without automatically replacing existing Gateway services. Fresh setup and the confirmed Use bundled runtime action delegate to canonical CLI installation with the observed runtime pin and service definition; the writer also preserves an intervening operator pause under its native lock.
Remove automatic migration, pending recovery, rollback and Node restoration ownership. Retain immutable runtime directories, document explicit CLI recovery, and keep Tauri on macOS unchanged.
Proof: dual Node 24/e167 suites and final 47-case writer/CLI replay; P2 scoped-clean branch review; x64/ARM Cargo, AppImage/deb and ABI smoke; Node-hidden Bun-only smoke; native fresh/adoption/update/pause/reassignment/lock-race and published-CLI compatibility flows. Exact-head CI failures are retained and independently attributed through the native admin exception; see the PR evidence for unresolved main-side test causes.
* fix(test): checkout fixture budgets cut healthy runs on loaded hosts
On a loaded macOS host (load 55-83), ci-platform-checkout.test.ts and the
other checkout fixture consumers failed through three fixture-internal
wall-clock budgets, not through the workflow under test:
- the supervisor's mock-resolution preflight ran bash under its own 2 s
timeout ("mock command resolution failed: spawnSync bash ETIMEDOUT");
- the POSIX process census shadowed its caller's operation deadline with a
fresh 1 s budget for all singleton ps queries ("Fixture process census
failed (ETIMEDOUT)"); the owner-ancestry walk had the same 1 s shape;
- the supervisor cut every run at 45 s ("fixture deadline exceeded"), nested
under the helper's 50 s close race only because the helper could not see
the Vitest test timeout.
Measured breakdown: a multi-attempt scenario serially starts 25-36 Node
actors plus the Python owner; at load ~72 Linux git-failure spent 19.4 s,
of which the fixture's own 82 ps calls were 1.6 s. The work scales with
scheduler latency and is the contract under test, so the fix is ownership
of the time bound, not less work.
The owning test's AbortSignal now bounds a supervised run.
withCiCheckoutFixture takes it, rejects its close join on abort, and asks
the live supervisor to cancel over IPC so its own stop() retires the
detached shell group and actors, keeping the SIGKILL fallback for a wedged
supervisor. The supervisor drops its 45 s watchdog; its operation deadline
becomes the existing 60 s actor lifetime ceiling, which only bounds orphans.
Census, preflight, and ancestry queries borrow that operation deadline, as
the Windows census witness already did.
Every runCiGitStep and withCiCheckoutFixture caller passes its test signal;
.each registrations that need the context move to .for, which is the only
form Vitest 5 hands the context to.
Regressions: the shared slow-witness preload now gives POSIX supervisors a
first native query that spends 1.1 s on their clock (fails main's fixture
7/7 with "census failed (unverified)"), and the outer-runner retention
proof gains a cancel fault proving the aborted supervisor retires its shell.
* fix(test): keep checkout signal bindings lint-clean
* chore(deps): refresh seven-day-cooled dependencies
* fix: resolve dependency refresh CI blockers
Recheck caller cancellation after the OpenAI SSE iterator ends and before
Chat Completions can promote provisional tool calls. OpenAI 7.8 may end
an aborted iterator normally; preserve the shared transport's abort contract.
Wait for the fake WebSocket receive callback before emitting replies in
three Watch journal fixtures, retaining their existing timeout and assertions.
Point the QA release-policy catalog at the repository-owned plugin guide
after main removed its duplicate ClawHub publishing page.
The existing OpenAI regression fails before the owner fix and passes after,
with 243 owner/sibling tests and both transports exercised over real loopback
HTTP. The 58-test QA catalog suite, changed gates, AI package build, and
independent scoped P0 review pass. Fresh exact-head hosted CI, including
iOS lifecycle and production advisory checks, remains required before merge.
* test(mattermost): control loopback timeout deadlines
* test(ai): cover cancellation at normal stream completion
Prove the shared Chat Completions parser rejects an abort immediately before normal iterator return and never finalizes the provisional tool call. The regression fails with only the post-loop guard removed; 312 owner and sibling tests and the changed-file gate pass with the guard intact.
* fix(ui): preserve focused popovers during sidebar updates
Keep community invitation geometry deferred while a DOM-owned popover item has keyboard focus, even when Chromium reports no sidebar focus-within. Exercise background presence updates after real menu focus.
Distinguish independent Swarm child hydration from canonical roster refreshes in the held unread acknowledgement test. Preserve immediate badge clearing and prove an extra canonical refresh still fails the assertion.
Validation: 12 Control UI E2E cases and 431 related UI tests pass; the focused invitation case fails on the previous production condition. Independent Codex P0 review is scoped-clean.
* chore(deps): upgrade CUA and preserve published docs anchors
Upgrade CUA 0.22.0 to 0.22.2 with its coordinated accepted native
artifact records, and slugify 2.2.0 to 2.2.1 under the frozen seven-day
cutoff. Preserve Mint's published heading and component anchors before
counter allocation.
Synchronize the docs publisher's independent slugify manifest and npm
lock atomically with its parser; reject unrelated dependency drift after
rebasing the publish commit. Preserve every existing product security
exception, patch, toolchain document, and public configuration contract.
209 selected owner tests, source/publisher anchor corpus comparisons,
full changed checks and build, the exact dependency age/integrity audit,
and independent managed P0 review passed. Native CUA execution and
fresh exact-head CI remain required before landing PR #138199.
* chore(deps): refresh newly cooled September 5 dependencies
Advance the frozen seven-day selection to 2026-08-29T18:40:39Z. Update AWS, ACP, TUI, Discord types, Matrix WASM and duration formatting; align standalone broker Node types. Preserve main security exceptions and hold incompatible direct Zod upgrades.
* fix: align dependency refresh CI fixtures
Model the atomic publisher manifest/lock handoff in the process-fault fixture and execute its real validator before push. Preserve strict command matching, drain ordering and terminal rejection semantics. Inline the single-use reasoning-effort resolver to keep the shared stream below its existing line limit without changing cancellation or reasoning behavior.
* test(ui): await settled skill-menu geometry
Wait for the existing semantic and animation readiness boundary before comparing list and action widths. Preserve exact width tolerance, viewport bounds and read-only pin assertions; do not fast-forward animation or alter production styling.
* test(ui): bind live browser disclosures to their owners
Adapt the run/tool identity repair from 90c51add82fc8b40801af39da496f86a635f2d3e while preserving the existing 15-second overall observation budget. Remove live page-wide positional disclosure polling; keep history and inert-route assertions, and capture optional synthetic proof.
Reduce redundant history work by keying completed frames on their rendered outcome and nested content, reusing the prepared message-to-row index, and rejecting impossible JSON-object probes before parsing. Remove the duplicate yield-output parser and unused render-dependency slot.
Preserve the initial 800-message load, 1,000-message older pages, saved reader position, disclosures, and final-response actions. Sixteen source-pinned Gateway/Chromium trials measured 11%/15% lower initial/older maximum frame-gap medians with zero anchor drift; saved-return timings remain mixed.
Consolidate prepared CI comparison refs at authenticated checkout while preserving identity checks and credential lifetime. Shared UI fixture cleanup joins admitted Gateway work before shutdown and works in afterAll. The hovercard test controls its existing dismissal clock after preview loading and retains native pointer coverage.
Validation: 854 cases on the measured source; 23 Gateway/publication cases on unchanged affected paths; 15 complete-file Linux browser cases on the final tree; canonical static gate and managed P0 review. Final exact-head CI: 33700312894 attempt 2 passed 159 jobs with 10 skips, including the required aggregate. Three initially unassigned Mac jobs completed through the documented failed-job retry.
## What Problem This Solves
The native Signal Server-Sent Events (SSE) client retried every non-success HTTP response forever. Operators saw a generic recovering status even when the daemon had definitively rejected the request and needed a configuration fix.
## Why This Change Was Made
The native client now preserves the HTTP status in a typed `SignalSseRejectionError` instead of leaving reconnect policy to parse error text.
The reconnect owner publishes the shared blocked terminal status for permanent 4xx responses and settles after one attempt. HTTP 408, 425, and 429 remain retryable. Network errors, stream ends, 5xx responses, receive-handler failures, managed-daemon exits, and the container WebSocket transport retain their existing recovery policy.
This matches signal-cli v0.14.7: its native event endpoint returns permanent 400, 404, 405, and 421 request rejections, while handler failure returns 500.
## User Impact
`openclaw channels status` now shows a stopped, blocked Signal account with a terminal disconnect and recovery guidance after a permanent native SSE rejection. Transient failures still reconnect automatically.
## Evidence
- Current main `cb75c1a820`: a production Signal channel against a local HTTP 400 SSE endpoint made eight requests and remained `running: true`, `lifecycle: "recovering"`, without a terminal flag.
- Repaired head `3c1793b688151c3ca5b5421546b053706eedcf68`: the same product path made one request and reported `running: false`, `lifecycle: "blocked"`, `terminalDisconnect: true`, and `healthState: "terminal-disconnect"`.
- Transient control on the repaired head: after `channels.start`, an HTTP 503 endpoint received six requests and status remained `running: true`, `lifecycle: "recovering"`, without a terminal flag.
- Regression provenance: the new real-server test fails on current main because the permanent case reconnects a second time; the 503 control passes.
- Focused tests: `node scripts/run-vitest.mjs extensions/signal/src/client.test.ts extensions/signal/src/client-adapter.test.ts extensions/signal/src/sse-reconnect.test.ts extensions/signal/src/sse-reconnect.real-server.test.ts` — 37 passed.
- Checks: Oxfmt, Oxlint, conflict markers, import cycles, extension import boundaries, max-lines, assertion safety, coercion helpers, deprecated API use, and test-temp reporting passed.
- CI repair: run `33621364324` completed its bundled and guard checks, then failed because three comparison-base fetches ran after authenticated checkout discarded its token. Those bases now arrive in the authenticated checkout; 419 focused workflow/Git-owner tests and the workflow guard passed.
- Upstream contract: b01b6b370d/src/main/java/org/asamk/signal/http/HttpServerHandler.java (L169-L241)
## Test Audit
The real-server regression crosses the production reconnect loop, client adapter, native HTTP client, and protocol endpoint. It adds no test-only production seam. The prior mocked 401-only test was removed because it could prove the mock without proving the changed boundary.
Co-authored-by: Ayaan Zaidi <hi@obviy.us>
* fix(ui): preserve mocked browser proof across reruns
Give mocked browser captures run- and attempt-owned directories so reruns preserve earlier screenshots, recordings, and reports. Keep capture helpers and Mantis evidence consumers within the same directory owner.
* test(ci): align fixtures with capture allocation and source imports
The Checkout step fetched .ci-harness as a full --depth=1 snapshot and only
applied sparse-checkout afterwards, so the narrowing never reached the network
transfer: every job downloaded a complete second copy of the tree and discarded
all but .github/actions.
Set sparse-checkout before the fetch and add --filter=blob:none. The harness
checkout now materializes blobs over the network, so it carries the fetch
deadline instead of running unbounded.
Measured against the live remote: harness fetch 18.59s -> 0.98s, .ci-harness/.git
117 MB -> 7.0 MB. The workspace fetch stays unfiltered because jobs need real
file contents.
* fix(macos): isolate native test process resources
* test(macos): include native launcher in workflow routing contract
* fix(scripts): finalize strict child ownership before output closure
* test(macos): isolate signing failure resources
* test(ci): own checkout fixture processes and retained artifacts
* ci(macos): capture bounded native test diagnostics
* fix(macos): provision disposable native test keychains
Complete the pre-bundle resource owner with an unlocked private Keychain and verified cleanup. Cover setup, shutdown, output drainage, migration, and failure retention without changing production preview behavior. Remove temporary native diagnostics before exact-head CI proof.
* test(macos): honor Foundation path contracts
Normalize both home-path operands with Foundation and verify inherited TMPDIR separately from Darwin's per-user temporary directory. Preserve actual fixture containment, cleanup, and Keychain acceptance; correct the matching docs and socket-fixture guidance.
* test: preserve fixture cleanup failures
Join the existing child-close promise within the cleanup budget, retain body and teardown errors through the shared fixture owner, and keep independent test-case dimensions explicit. Resolve fixture lint without weakening assertions or process cleanup.
