[roodboi]

Current state (head 4fced95)

Reworked after verification of 384bf68 failed. This head merges origin/next at ae032e7 and moves waitForFileContent to tests/helpers/wait-for-file-content.ts. The two reads named in the verdict now use it: the descendant pid in native-compose-adoption-job-worktrees.test.ts, and the rollback barrier in native-compose-route-claims.test.ts. The barrier's reference is now taken before the writer is killed, and its fixture holds the empty-file window open on every run. No assertion changed.

Verified locally on Bun 1.4.2 with a private HOME and HACK_HOME, at load averages of about 30-75 from other agents:

• Mutations: reverting the route-claims site to an existence-only wait fails 5 of 5 runs (Unexpected end of JSON input); unmutated, that case passes 5 of 5. The adoption site, with a temporary torn fixture and a wider deadline, fails 4 of 5 on the > 0 assertion and once on the deadline below; with the helper it passes 4 of 5, with one failure on deadline expired.
• Passed 3 of 3: native-runtime-client, checkout-write-guard, private-env-file.
• Failed some runs: native-compose-adoption-job-worktrees passed 2 of 3 and native-compose-route-claims passed 2 of 3. The failing cases are timing-bound under load; see the open problem below.
• Gates: bun run --cwd packages/cli typecheck, Biome on the changed files, and gitleaks over the new commits all pass.

Open problem, not fixed here: "inherited-pipe descendants withhold cancellation settlement…" still fails under host load, with or without this change (paired runs at load 45-60: 25 of 30 before, 27 of 30 after; at load 10-16: 2 of 40 before, 3 of 40 after, on Bun 1.4.4). Its 250 ms capture deadline covers starting both processes, so a slow start gets the process group killed before the file is written or while it is still empty. Other cases in these two files also failed under load at their 1 s capture deadlines or Bun's 5 s default: "an exited leader…", "expired readiness…", and route-claims cases such as "explicit verified stop…". They were left alone rather than loosened.

Not re-run at this head: native-compose-storage-witness-xattr-owner.test.ts, the full suite, and any load matrix. The tables below describe 384bf68 and earlier. Hosted CI at this head was not yet reported when this was written.

---

Refs HACK-1439. Based on next after #480 (HACK-1422), which touched three of these files, landed. next was merged in again at 148ef8f, which brought in #494 (HACK-1440) and #497.

Test-only. No assertion was removed or weakened; the only changes are bounds on waits, named Bun timeouts, and fixture timing that makes a race happen on every run.

Root causes

1. Checkout write guard. installCheckoutWriteGuard registered its end-of-run afterAll without a timeout, so it ran under Bun's 5 s default hook timeout. Under host load the synchronous git status --untracked-files=all passed 5 s. Bun then killed git mid-read ("killed 1 dangling process"), git returned non-zero, and the guard refused with "git status failed" on a run whose cases all passed.
2. Create-then-write race. In native-runtime-client.test.ts, the "cancellation starts at most one native request and reaps only its owned child" case waited only for the pid file to exist, then aborted. writeFileSync creates the file before it writes the digits, so the abort could SIGKILL the child in between. The file then stayed "" and Number("") gave 0.
3. 5 s defaults and 30 s literals. The cases in private-env-file.test.ts and native-compose-storage-witness-xattr-owner.test.ts do a fixed amount of store file work (env layer lock, staged write and rename; durable generation publish/enroll/verify/retire) and wait on no timer. Under load they passed Bun's 5 s default or the fixed 30_000 literals while their assertions still held.

Fix

1. tests/helpers/checkout-write-guard.ts
   • Every guard git call is bounded by CHECKOUT_GIT_BUDGET_MS (60 s, spawnSync timeout + SIGKILL).
   • A call that reaches the bound is refused, closed, with its own message: git status did not finish within N ms. A real failure still gives git status failed. The guard never treats an unreadable checkout as clean.
   • The afterAll hook is registered with CHECKOUT_GUARD_HOOK_BUDGET_MS (status bound + 30 s). A slow status therefore ends as the guard's named refusal, not as a Bun kill.
   • checkout-write-guard.test.ts: the guarded fixtures' keep-alive cases get KEEP_ALIVE_CASE_TIMEOUT_MS. The late spawnSync blocks their event loop while a cold bun child starts, and under load that passed 5 s. This was found while running the file under load.
2. tests/native-runtime-client.test.ts
   • A single bounded waitForFileContent helper now backs waitForPid and waitForFileText (fix(env): retry a private env read that races an atomic replace instead of refusing it as a symlink #480 added the latter for the finished file).
   • The existence-only waitForFile is removed. Each of its three call sites now waits for complete content: the cancellation case's pid before it aborts, the abort-mode keeper pid, and the late-writer finished text.
   • The cancellation fixture now publishes its pid as a torn handshake (empty file, 50 ms gap, then the digits), as the sibling cases do. An existence-only wait now fails on every run, not by chance.
   • Audited the native-runtime siblings (native-runtime-metadata, -not-running-cli, -preflight): none waits for a file.
3. private-env-file.test.ts and native-compose-storage-witness-xattr-owner.test.ts
   • Each file sets a file-scoped default with setDefaultTimeout: ENV_STORE_CASE_BUDGET_MS (60 s) and fix(env): retry a private env read that races an atomic replace instead of refusing it as a symlink #480's STORE_CASE_BUDGET_MS. Every case and hook gets a named budget.
   • STORE_CASE_BUDGET_MS is raised from 180 s to 600 s. In one wave at a sustained load average of 110-190, every run failed the same four store cases (warm no-op up/restart, warm enrollment, adjacent verification) at 180 s while their assertions held. The slowest case had taken 63 s at a load of about 90. Those measurements predate perf(native-compose): cut redundant store rechecks per proof step #494, which cut the store's call counts. The budget is a hang guard, so it is sized with room to spare.
   • The 22 fixed 30_000 literals in the xattr file are removed so the named default applies.
   • The two other real-use carriers captured with a 60 s wall-clock deadline now use FAKE_CARRIER_LIFETIME_MS. A slow case can then only time out cleanly; it cannot fail because the carrier deadline expired. The one case that mocks Date.now keeps its own clock deadline.
   • Bun 1.4.2 was checked directly: setDefaultTimeout applies to this file's cases, test.each rows and hooks, and does not leak into a later file in the same run.

Tests and mutation proofs

• New: "the guard kills and refuses a git status that reaches its bound instead of waiting on it". Fake git exec sleep 30, budget 200 ms.
  • Without the spawnSync timeout, the guard returns [] after 30 s (no refusal): the test fails.
  • Without the timedOut branch, the message is "git status failed": the test fails.
• New: "an end-of-run git status slower than Bun's default hook timeout still passes a clean run". A git wrapper makes only the end-of-run status sleep 6 s, and records that it slept.
  • With the hook registered without its budget (the old code), the inner run fails with exactly the reported killed 1 dangling process + checkout write guard: git status failed.
• Cancellation case: replacing waitForPid(pidFile) with an existence wait fails 3 of 3 runs with Expected: <pid> Received: 0, the reported failure. The fixed version passes 3 of 3.
• Budget changes, before and after (before = fix(env): retry a private env read that races an atomic replace instead of refusing it as a symlink #480's head, at load average ~70 on 18 CPUs): the xattr file had 20 timeouts (13 at the 5 s default, 7 at 30 s), for example "resume refuses * before workload", "fresh readonly proofs tolerate …" and "warm run stays …". After: 108 of 108 pass at the same load. The slowest case took 63 s.

Evidence (local, macOS, 18 CPUs; ambient load from other agents, plus a yes load generator stopped in a trap)

Each run is a full bun test <file> with a private HOME, HACK_HOME and DOCKER_CONFIG, and the checkout write guard preloaded. The load average is the 1-minute value, sampled as each run ended.

At the exact PR head 384bf68:

File	Runs passed	Parallel	Extra yes load	Load average
private-env-file.test.ts	30 / 30 (15 cases each)	3	8	31-35
checkout-write-guard.test.ts	30 / 30 (14 cases each)	3	8	38-72
native-runtime-client.test.ts	30 / 30 (34 cases each)	3	8	70-88
native-compose-storage-witness-xattr-owner.test.ts	30 / 30 (109 cases each)	6	8	65-122; uptime read 110-290 while the fifth wave ran

Earlier rounds of the same change:

• On top of fix(env): retry a private env read that races an atomic replace instead of refusing it as a symlink #480's head, 30 / 30 runs of each file passed, at load averages of 61-69 (env file), 57-71 (write guard), 65-164 (native runtime client) and 38-109 (xattr, with about 150 between samples).
• At 7dc0359 (before the 600 s budget), these runs passed: 30 / 30 of the three quick files at load averages of 39-59, and runs 1-20 of the xattr file at load averages of 50-220. Runs 21-25 of the xattr file are the failed 180 s wave described under Fix.

Gates: bun run check (includes privacy:check) passes. bun run typecheck and bun run --cwd packages/cli typecheck report 0 errors. ultracite check on the five changed files is clean. gitleaks 8.30.1 over origin/next..HEAD finds no leaks. The CLI surface and agent guidance did not change, so no generated docs needed regenerating.

Full suite: hosted CI run 40143709633 passed at the exact PR head 384bf68, including test shards 1-4. All 20 checks are green. The earlier head 7dc0359 was also fully green.

Gaps

• The keep-alive budget and the two store budgets are timing fixes. No deterministic mutation reproduces them; the before/after load runs above are their evidence.
• The local 30-run loops are macOS only. Hosted CI covers Linux, but runs each file once.
• No budget is a guarantee under unbounded load. 600 s held at load averages up to about 290, but a host that is even more oversubscribed can still time out. HACK-1434 tracks the product cost behind the store cases.
• Other test files outside this unit still wait for existence and then read, or use short fixed budgets. They are filed as findings, not changed here.

🤖 Generated with Claude Code

[linear-code]

HACK-1439