v1.91.105.0 fix(tests): the free suite stops needing its retry pass; test:health tells the truth (#3154) (#3212)

* test: turn git auto-maintenance off in free fixtures, with a runner backstop

git 2.29+ starts a detached `git maintenance run --auto` after every commit;
it creates and deletes .git/objects/maintenance.lock after the commit returns.
Diagnosed on 47d639a (git 2.55.0):

- gstack-docs-candidate (ledger 37742176952/16): 4/150 replicated snapshots
  saw the .git listing change, every one `-objects/maintenance.lock`; 0/150
  with the keys. repo() now sets maintenance.auto=false and gc.auto=0.
- plan-design-sdk-fixture (ledger 37807608021/6): under commit load 18/150
  runs failed the collector check; in every one Bun's rmSync(recursive, force)
  returned without throwing and left the scratch repo behind. 0/100 with the
  keys in the fixture's replacement git env, which never sees the runner's.
- qa-functional-observer (ledger 37800857251/4): under load 6/200 observer
  setups threw ENOENT lstat .git/objects/maintenance.lock; 0/400 with the keys
  in the inherited env. The observer and its fixture (22 paid cases) are not
  edited; the runner backstop covers them.

runFreeShard appends the two keys after any inherited GIT_CONFIG_* pairs of
each shard child (a malformed inherited count is left for git to reject).
A GIT_TRACE commit shows 3 maintenance lines with defaults and 0 in the
runner child env; the new test pins that and the env merge cases.
Failure messages now name the changed .git entries and surviving fixture
directories; no assertion changed.

Co-authored-by: capy-ai[bot] <230910855+capy-ai[bot]@users.noreply.github.com>

* test: synchronize the zombie publication-lock test on a framed PID line

Ledger 38153371796/3 and 38161906980/3: line 69 `existsSync(ready)` failed.
The test polled 300 x 10 ms for the Python parent's readiness file, then
another 300 x 10 ms of /proc for state Z; under shard load the fixed count
expired. existsSync also raced the write (an empty file read as pid 0).

The parent now waits for its child with os.waitid(P_PID, WEXITED|WNOWAIT),
which leaves it unreaped in state Z, and prints the PID with flush=True. The
test reads exactly one newline-framed line from the parent's stdout under the
test's own (unchanged) 10 s timeout, rejects a malformed or non-positive PID,
and makes one /proc read that must show Z. Early exit, a malformed line or a
timeout reports the parent's exit status and stderr tail; the owned parent is
always killed in cleanup.

Intentional assertion replacement: the readiness-file existence check and the
polling loop are replaced by the framed-line requirement (a positive PID) and
one /proc read; `expect(state).toBe('Z')` and every lock-recovery assertion
are unchanged.

Co-authored-by: capy-ai[bot] <230910855+capy-ai[bot]@users.noreply.github.com>

* test: stop the next-version smoke test from calling live GitHub

Ledger 37804770972/9: "CLI runs against real repo and emits parseable JSON"
failed with `JSON Parse error: Unexpected EOF` after 30032 ms. The smoke test
ran the real CLI against live `gh`; bin/gstack-next-version's per-PR
`gh api` calls run one after another (spawnSync inside its async workers), so
27 open PRs passed the 30 s spawn timeout and stdout was empty. Measured with
a delayed fake gh: 8 PRs x 0.5 s = 4108 ms; 27 PRs x 1.2 s = 32637 ms. The
CLI defect is filed as a P1 follow-up, not fixed here.

The test keeps the real repository and the real CLI and puts a named fake gh
first on PATH. It logs every argv, answers exactly the calls the CLI makes
(auth status only when origin is not github.com, pr view exit 1, canned pr
list, repo view and contents with one same-owner PR claiming 1.6.4.0) and
exits 2 with a FAKE_GH_UNHANDLED marker for anything else; glab exits 1. The
test now checks the exit code with stderr before JSON.parse, the exact call
set, no marker, no glab call, host github, offline false, no fallback, no
warnings, the canned claim, and version 1.6.5.0. Every existing assertion is
kept; the spawn timeout is unchanged.

Co-authored-by: capy-ai[bot] <230910855+capy-ai[bot]@users.noreply.github.com>

* fix(test-health): report the Windows wall over PR runs and name the seed's real prerequisite

free-wall read windows-free-tests.yml with `branch: 'main'`, but that
workflow runs only on pull requests and workflow_dispatch, so the "main" runs
it averaged were dispatch duration recordings. It now uses listWorkflowRuns'
existing `event: 'pull_request'` filter and prints the population inline:
`windows-free-tests (successful PR runs) 7.1 min (23 runs)`, or `no
successful PR runs in window`. The free-tests half is byte-identical.

The CEO-10 fix text stops offering a "CI recording" (none exists for the Linux
seed) and names UBICLOUD_API_KEY; test:ubicloud --record-durations copies the
seed back into the checkout, and contributors without the key leave the
refresh to a maintainer. docs/TESTING_INTERNALS.md drops "or a CI recording"
in the same change.

Intentional pin change: test/test-health-report.test.ts free-wall value
`windows-free-tests 0.0 min (1 runs)` -> `windows-free-tests (successful PR
runs) 0.0 min (1 runs)`; the fixture now carries a PR run and an excluded
dispatch run, plus a new case for the empty and mixed populations.

Co-authored-by: capy-ai[bot] <230910855+capy-ai[bot]@users.noreply.github.com>

* fix(timeline-read): reject missing and unparseable --since/--branch values

`--since` and `--branch` read an unbound $2 under `set -u` and crashed with
exit 1 when given no value, and an unparseable --since ("yesterday", "2
weeks") silently returned unfiltered history because the Bun regex was
unanchored and fell through. Unknown arguments were silently ignored.

--since is now parsed once in bash (no `date -d`, no bash-4 features) into a
cutoff in epoch ms, and the Bun regex is deleted. Accepted forms: "<N>
minute|hour|day|week|month[s] ago" (case-insensitive, as before), "<N>h|d|w"
(the form gstack-global-discover documents) and ISO dates YYYY-MM-DD or
YYYY-MM-DDTHH:MM:SSZ (UTC). In #1723's shape, before any read:

  --since must be a relative time like "7 days ago" (got no value); accepted: ...
  --since must be a relative time like "7 days ago" (got 'yesterday'); accepted: ...
  --branch must be a branch name (got flag '--limit')

with "got an empty value" for ''. Unknown arguments exit 2 with the usage
line; --help/-h prints it and exits 0. Tests extend the --limit table in
test/timeline.test.ts and run every case on empty and populated history,
plus each accepted --since form filtering old events; the quoted-branch and
no-filter tests are unchanged.

Behavior change: unrecognized arguments (previously ignored) now exit 2.

Co-authored-by: capy-ai[bot] <230910855+capy-ai[bot]@users.noreply.github.com>

* docs: record the due audit follow-ups with verdicts, and file wave-2 follow-ups

docs/test-audit-2026-10.md gains a dated 2026-10-15 section from a no-spend
`bun run test:health --since-days 7`, with the 2026-10-12 figures from #3154
kept as history and a verdict per target: full-fallback 45.9% (open; the
audit's next step is touchfile mappings for bin/, lib/, hosts/, make-pdf/),
spend per merged PR $73.52 (verdict unavailable: the pre-change baseline,
recomputed with collectHealth at now=2026-10-04 behind an upper-bound client,
holds no trial-outcomes artifacts because the recorder shipped with the
audit), cancelled slice-minutes 1,545/week, push-to-verdict p50 11.4 min
(missed against 3-5 min), flaky-pass 6.1% (missed; this wave repairs it).
Census reliability is not due until 2026-10-26; the interim figure is
recorded and the repair stays with #3153/#3200.

TODOS.md: one appended dated section (P1 gstack-next-version serial fetch with
the 4160 ms measurement, P1 standing seed recorder, P1 full-fallback/spend,
P1 dated flake follow-ups, P2 createQAFunctionalFixture maintenance keys, P2
diagnostic-mode HOME/state-root artifacts). The timeline-read bullet was
deleted with its fix.

Co-authored-by: capy-ai[bot] <230910855+capy-ai[bot]@users.noreply.github.com>

* chore(release): tentative stamp v1.91.105.0 with its CHANGELOG entry

Stamp-at-merge policy (.gstack/ship-policy.json): the branch carries a
tentative PATCH stamp and its CHANGELOG section directly under
`# Changelog`; the queue restamps at merge time. Base 47d639a is 1.91.101.0,
but the live slot scan shows 1.91.102.0 (#3190), 1.91.103.0 (#3200) and
1.91.104.0 (#3209) claimed, so this branch takes 1.91.105.0. Written with
`gstack-restamp --version 1.91.105.0 --base main --expect-base 47d639a
--allow-repo-commands` (VERSION, package.json's npm translation, the agents
digest via the policy's release tool, and the CHANGELOG header).

* test(seed): refresh the free-suite duration seed from a Ubicloud recording (#3154)

Recorded with `bun run test:ubicloud --record-durations` (standard-16,
eu-central-h1) on this branch, which equals origin/main 47d639a plus this
wave; the recorder exited 0 and wrote 1219 durations (1055 before, 164 new,
none removed; serial 2439 s -> 3202 s). `test:health` CEO-10 now reports
0 unseeded files.

Two earlier recordings did not count: one failed on an unrelated fixed-sleep
race in test/plan-seed-submission.test.ts (filed P2, not edited here), the
other failed free-seed-ratchet because it ran against the first attempt's
pulled seed. No file was excluded.

free-seed-ratchet: three files are over the 60 s ceiling in this recording
and are allowlisted with a split todo (setup-install-registry 82 s,
host-renders-prune 64 s, setup-codex-scope 60.4 s); the split follow-up and
the plan-seed-submission race are filed in the appended TODOS section.

The ratchet test now names scripts/free-test-seed-allowlist.json literally
(a pin on SEED_ALLOWLIST_FILE): pregate's lanes check maps data files to
tests through string literals, and the allowlist had no lane
(PREGATE_NO_LANE). Additive assertion; nothing weakened.

Co-authored-by: capy-ai[bot] <230910855+capy-ai[bot]@users.noreply.github.com>

* test: give the git-maintenance backstop test a Windows-safe empty global config

windows-free-shard (2) on #3212 (run 38832498861) failed two cases in
test/test-free-shards-git-maintenance.test.ts, both serially reproduced by
the retry pass: Git for Windows rejects GIT_CONFIG_GLOBAL=os.devNull
(`fatal: unable to access '\\.\nul': Invalid argument`), so the malformed-count
case saw that error instead of git's GIT_CONFIG_COUNT rejection, and the traced
commit's `git init` exited nonzero. Point GIT_CONFIG_GLOBAL at a file that does
not exist in the scratch HOME, as test/ceo-plan-mode-fixture.test.ts does;
git reads a missing global config as empty on every platform. No assertion
changed.

Co-authored-by: capy-ai[bot] <230910855+capy-ai[bot]@users.noreply.github.com>

---------

Co-authored-by: capy-ai[bot] <230910855+capy-ai[bot]@users.noreply.github.com>

docs/TESTING_INTERNALS.md

@@ -1133,15 +1133,44 @@ Free-suite flake rules:
   daemon without `CI=true` launches Chromium sandboxed.
 - Handshakes with a runner wait for the runner's own observable effect (its
   progress line, a coalesced read count), not for a fixture side file or a timer.
+- Fixtures that commit and then list, watch or remove a repository's `.git`
+  turn git auto-maintenance off themselves (`maintenance.auto=false` and
+  `gc.auto=0` in the repo config, or in the explicit git env they build). Since
+  git 2.29, `git commit` starts a detached `git maintenance run --auto` that
+  creates and deletes `.git/objects/maintenance.lock` after the commit has
+  returned; a listing counts it, a watcher's `lstat` misses it, and Bun's
+  `rmSync(..., { recursive: true, force: true })` returns without an error while
+  leaving the directory behind. `runFreeShard` appends the same two keys to
+  every shard child's `GIT_CONFIG_*` pairs as a backstop, so it covers fixtures
+  that inherit the environment, and `bun run scripts/ship-measure.ts free
+  --backend local` measures with that environment; a fixture with its own
+  replacement env never sees the backstop.
+
+To reproduce a ledger entry, take the shard's exact file list from the CI run's
+`free-plan` artifact, then rerun it with the flaky retry off on a CI-mirrored VM:
+
+```bash
+gh run download <run-id> -R garrytan/gstack -n free-plan -D /tmp/free-plan
+files=$(jq -r --argjson s <shard> '.shards[] | select(.shard == $s) | .files | join(",")' /tmp/free-plan/free-plan.json)
+bun run test:ubicloud --diagnostic --files "$files" --reruns 30
+```
+
+The ledger entry names the shard (`flake-ledger-<shard>`). Read the counts from
+the run's `free-measurement.json` (`completed`, `passed`, `capHit`): with a
+before-fix failure rate p, a fix needs at least 3/p clean completed reruns of
+the same command, so zero failures would have under a 5% chance if nothing had
+changed. Cut or unstarted reruns are incomplete, not passes.
 
 ### Free suite duration seed
 
 `scripts/free-test-durations.json` drives shard packing; files missing from it
-pack at the seed's 99th percentile. Acceptable seeds come from
+pack at the seed's 99th percentile. Acceptable seeds come only from
 `bun run test:ubicloud --record-durations` (each file timed in its own child on a
-VM with the CI lane's environment) or a CI recording. A 4-core laptop or
-small-sandbox recording is not acceptable: browser and display tests skip or slow
-down there, so the seed misstates them.
+VM with the CI lane's environment; it needs `UBICLOUD_API_KEY` and copies the
+refreshed seed back into the checkout). A 4-core laptop or small-sandbox
+recording is not acceptable: browser and display tests skip or slow down there,
+so the seed misstates them. Contributors without `UBICLOUD_API_KEY` leave the
+refresh to a maintainer.
 
 - `--ci-plan` warns in the job summary, with the refresh command, when more than 5
   files are unseeded; it never fails a PR. `--ci-verify` lists shards that ran

docs/test-audit-2026-10.md

@@ -274,3 +274,34 @@ The 4 remaining shouting pins are enum or marker tokens (`PLAN MODE EXCEPTION
 ALWAYS RUN`, `[CRITICAL]`, `ALWAYS-ON` CLI output), not emphasis. Most remaining
 sentence pins sit in QA caller, detector-helper and workflow files that other
 work in flight owns.
+
+## Post-merge follow-up (2026-10-15)
+
+The "post-merge audit metrics" TODO, from a no-spend run of
+`bun run test:health --since-days 7` (window 2026-10-08T22:14Z to
+2026-10-15T22:14Z). The 2026-10-12 figures are the weekly health run in issue
+#3154 (run 38234556073), kept as dated history.
+
+| Metric | 2026-10-12 | 2026-10-15 | Target | Verdict |
+|---|---:|---:|---|---|
+| PR full-fallback rate | 45.0% (58/129 runs) | 45.9% (39/85 runs) | none numeric; the replay above names the cause | open: branches touching `bin/`, `lib/`, `hosts/` or `make-pdf/` still select every case |
+| Recorded PR-lane spend per merged PR | $75.09 (46 merged) | $73.52 (33 merged) | down at least 50% from the pre-change baseline | unavailable: baseline not recorded (below) |
+| Cancelled slice-minutes per week | 1,939 (44 runs) | 1,545 (33 runs) | none numeric | reported |
+| PR push-to-verdict | p50 12.0 min, p95 1,160.7 min (122 runs) | p50 11.4 min, p95 107.9 min (80 runs) | 3–5 minutes for typical PR checks (CONTRIBUTING.md) | missed |
+| Free-suite flaky-pass rate | 13.0% (6/46 main runs) | 6.1% (2/33 main runs; `terminal-agent-publication-lock` 2/33, over the 5% per-file check) | under 5% of main runs | missed; fix wave 2 repairs the five ledger files |
+
+**Spend baseline.** The pre-change window was recomputed with the exported
+`collectHealth` at `now = 2026-10-04T00:00Z`, seven days, through a client that
+drops runs created and PRs merged after that instant (`listWorkflowRuns` has no
+upper bound of its own). The window holds 12 merged PRs but no
+`trial-outcomes-pr-*` artifacts and no paid-plan manifest with `prCoverage`:
+the recorder that feeds this metric shipped with the audit, so the PR lanes
+before it wrote nothing it can read (their other artifacts are retained until
+2026-11-02 and later). Baseline not recorded; verdict unavailable. The P1 in
+TODOS.md is opened on the absolute figures.
+
+**Census reliability (not yet due).** Due after the fourth scheduled census
+after the audit merge (2026-10-26). Interim: periodic 2.00 expected failed
+trials per run (6/538 over 3 runs; target at most 1.0), gate census 0.33 (1/308
+over 3 runs; target at most 0.5). The TODO keeps its due date; the census
+repair stays with #3153 and #3200.