[roodboi]

Summary

Follow-ups from HACK-1459 (items 1-6 plus its comment) and the HACK-1460 flake. Test fixtures no longer read the caller's Git or Docker environment, load-sensitive cases get named budgets sized for their work, a timed-out case can no longer break the next one, and one env refusal gets a stable code.

Root causes

1. Hermeticity (HACK-1459 item 1 and comment). Fixture git calls in about 50 test files inherited the runner's environment.
   • An exported GIT_DIR/GIT_WORK_TREE sent the fixture's init/commit/worktree add into that repository. tests/native-env-metadata.test.ts cleared those variables in beforeEach, but its fixture runs in beforeAll, before that.
   • Under a private HOME, git still read the contributor's $XDG_CONFIG_HOME/git/config, whose core.hooksPath guard refused fixture commits. That is the actual cause of the local-only failure of native-compose-generation "real linked worktree ...". The fixture already set its identity with -c user.*; it fails on the hook, not the identity.
2. down --recover storage-witness cases fail locally. DOCKER_HOST did not cause this. The cases fail the same way with and without it, and with a private or a real HOME. invoke() defaults HACK_COMPOSE_STARTUP_TIMEOUT_MS to 1 s, and down --recover bounds its owned stop by that budget. On a loaded host (load average 60-150 here) the stop's synthetic Docker processes take longer than 1 s, so the CLI reports native_compose_effect_refusal {effect-execution, private-uncertain} instead of E_COMPOSE_FAILED. With a 60 s budget the same run gave E_COMPOSE_FAILED at load average 108. Two more wall-clock bounds expired under load: the in-process carrier deadline (Date.now() + 30_000, which gave "witness missing ... uncertain") and invoke's 15 s kill (exit 137).
3. native-env-metadata beforeAll (items 2-3). The template build (five git processes) had Bun's 5 s hook budget. Bun starts afterAll as soon as beforeAll times out, while the build keeps creating native-env-metadata-template-* directories. Probe: a 200 ms hook budget with a 300 ms body showed afterAll running while the body was still in progress.
4. HACK-1460 file-owner. The up cancellation case had an explicit 5 s budget. Other cases had 15 or 30 s. When a case times out, Bun runs afterEach while the body keeps running, and that body reads the module-level store/root, which the next beforeEach replaces. A late body can therefore act on the next case's store. That is how one timeout becomes "state unsafe" in the next case.
5. Items 4-6.
   • Item 4: since fix(storage): bound storage helper probes by the carrier's remaining budget #437, a hung helper start is bounded only by the carrier's remaining budget, so it reports storage-budget. That is the right reason, because the remedy is the budget variable that the summary names. The code, the probe-budget test and the reference already agreed; the doc and the test now state it explicitly.
   • Item 5: hack env hydrate with a .hack/.internal file is refused by the earlier legacy adoption-state check (ENOTDIR counts as an input access failure, never as absence), so it reports E_CONFIG_INVALID. docs/env.md said E_PATH_CONFLICT.
   • Item 6: EnvLayerLockRefusedError was an uncoded ClosedCliError, so the CLI printed it without an E_* prefix and --json reported E_UNEXPECTED.

Fix

• New tests/helpers/fixture-git.ts: fixtureGitEnv(), fixtureGitShellEnv() (for src/lib/shell.ts), runFixtureGit[Sync]().
  • It builds the environment from PATH/TMPDIR plus the caller's values.
  • It removes every GIT_* variable, DOCKER_HOST/DOCKER_CONTEXT and the runner's HOME/XDG_CONFIG_HOME.
  • It sets GIT_CONFIG_GLOBAL=/dev/null, GIT_CONFIG_NOSYSTEM=1, a fixed author and committer identity, and GIT_TERMINAL_PROMPT=0.
  • gitEnv lets a test set a Git variable on purpose (used for GIT_INDEX_FILE and GIT_CEILING_DIRECTORIES).
• Every fixture git spawn in tests/ goes through it (about 50 files). The e2e runCommand gets an exactEnv option. The checkout write guard drops a caller's repository variables but keeps the contributor's config.
• tests/fixture-hermeticity.test.ts:
  • Exports GIT_DIR, the work tree, the index, the object directory, the common dir, a hostile GIT_CONFIG_GLOBAL and a hostile identity, then runs every fixture route. The scratch repository stays byte-for-byte unchanged, and no hostile hook runs.
  • A fixture HOME's own .gitconfig cannot add hooks, signing or identity.
  • An ambient DOCKER_HOST/DOCKER_CONTEXT never reaches fixture git or the private CLI env.
  • A source scan refuses any new fixture git spawn that does not use the helper.
• native-compose-storage-witness-command: named RECOVERY_DEADLINE_MS (30 s), CLI_COMMAND_TIMEOUT_MS (45 s) and a 3 min case budget. The carrier deadline uses the product default. The source-unavailable recovery case also runs with an ambient DOCKER_HOST at a missing socket plus a DOCKER_CONTEXT.
• native-env-metadata: named TEMPLATE_BUDGET_MS (60 s) on both hooks. afterAll waits for the build to settle, and a build that outlives that wait removes its own directory.
• native-compose-file-owner: one named FILE_OWNER_CASE_BUDGET_MS (60 s) via setDefaultTimeout replaces the per-case 5/15/30 s budgets. afterEach waits for the running body before teardown.
• EnvLayerLockRefusedError is now a coded E_PATH_CONFLICT HackCliError. docs/env.md is aligned on hydrate's .internal file and the lock refusal. The storage-carrier reference names storage-budget as the reason for a hung start.

Assertions in the flaky cases are unchanged. Only budgets, deadlines and teardown order changed.

Evidence

In progress: local 30-run soaks under load and hosted CI at this head; this section is updated when they finish.

Gaps

Listed when the evidence above is complete.

Refs HACK-1459
Refs HACK-1460

🤖 Generated with Claude Code

---

^{Need help on this PR? Tag @codesmith-bot with what you need.}

[linear-code]

HACK-1459

HACK-1460