✔ installed SessionManager explicitly persists an exact pre-assistant scaffold and keeps normal appends (13.357917ms)
✔ installed SessionManager scaffold persistence fails closed on EEXIST without overwrite (1.11925ms)
✔ installed verified session open rejects path replacement after identity capture (11.088292ms)
✔ runtime and YOLO switch preserve expected file identity through the final open (10.834834ms)
✔ YOLO session bootstrap no-ops for an existing durable session and appends one safe marker for a fresh session (10.189917ms)
✔ YOLO session bootstrap uses a per-session single flight (40.596875ms)
▶ YOLO session bootstrap fails closed on inode changes, symlinks, identity mismatch, EEXIST, and timeout
  ✔ inode change (6.254834ms)
  ✔ symlink (0.751583ms)
  ✔ secure no-follow open (4.951667ms)
  ✔ symlink replacement between lstat and open (5.208917ms)
  ✔ session mismatch (4.601875ms)
  ✔ EEXIST race (0.753042ms)
  ✔ timeout (22.641375ms)
✔ YOLO session bootstrap fails closed on inode changes, symlinks, identity mismatch, EEXIST, and timeout (45.659833ms)
✔ resume outcome disposition recognizes only the exact continuation protocol (0.054458ms)
✔ explicit Resume selection bootstraps the current session before resolving the delivery target (0.46075ms)
✔ session handoff grants require an exact fresh bounded request and absent old owner (0.441875ms)
✔ session startup consumes a handoff grant only after restored state and exact resume target are emitted (0.403791ms)
✔ reload state handshake republishes session-scoped capabilities only to the exact active session (0.285791ms)
✔ legacy enabled state migrates to five non-destructive capabilities with auto-destroy off (0.069875ms)
✔ existing delivery state upgrades with route optimization and continuity enabled but auto-destroy off (0.025667ms)
✔ Full YOLO delivery automatically selects every non-destructive prerequisite (0.049375ms)
✔ Auto-destroy is independently selectable, confirmation-gated, and Full YOLO does not toggle it (0.054125ms)
✔ Wayfinder and continuity are independently selectable for manual workflows (0.029292ms)
✔ disabling any Full YOLO prerequisite turns off only full delivery (0.030333ms)
✔ turning Full YOLO delivery off leaves independent capabilities available (0.023166ms)
✔ cross-session takeover disables only Full YOLO delivery (0.024292ms)
✔ normalization makes Full YOLO delivery authoritative over every prerequisite (0.018875ms)
✔ session transfer strips destructive authority without mutating source state (0.024334ms)
✔ manual Wayfinder recognizes only raw explicit supported workflow commands (0.104666ms)
✔ manual Session auto-continuity injects concrete checkpoint values independently of Wayfinder (1.002875ms)
✔ delivery workflow visibility matrix hides fresh and unattached sessions (0.067417ms)
✔ delivery pause labels distinguish a settled pause from an active phase draining (0.040792ms)
✔ status bar separates enabled capability from execution and explains no-work idle (0.0925ms)
✔ delivery indicator precedence is deterministic (0.056666ms)
✔ strict protocol v2 delivery envelopes reject malformed lifecycle streams (1.007042ms)
✔ delivery stream acceptance is session-bound, monotonic, and replaces runtimes only through correlated inspection (0.073625ms)
✔ workflow ownership UI preserves resolved lease details, deduplicates sessions, and bounds malformed input (0.20375ms)
✔ status widget keeps full detail within the compact line budget while /yolo status retains exact runtime inspection (1.631958ms)
✔ unattached sessions keep capability and idle status lines but gate detailed workflow surfaces (0.464958ms)
✔ capability selector exposes independent danger-labelled auto-destroy and excludes it from Full YOLO (0.336542ms)
✔ start-new stays in one selector and exposes a rendered safe-default confirmation (2.491292ms)
✔ start-new requires a separate explicit confirmation input (0.208875ms)
✔ start-new escape cancels without authorizing discovery (0.16425ms)
✔ start-new expands the exact loaded handoff skill before extension message delivery (2.858584ms)
✔ start-new fails closed when the exact user-scoped handoff skill is unavailable or ambiguous (0.092958ms)
✔ delivery choice lists ordinary and authorized recovery phases before start-new (0.063917ms)
✔ session discovery settles before delivery inspection begins (0.046834ms)
✔ discovered recorded sessions are ordered before unrecorded resumable handoffs (0.102333ms)
✔ legacy extension-trigger sessions associate with a canonical resumable target before menu rendering (0.313916ms)
✔ delivery recovery rows stay separate from ticket remediation and reject malformed state (0.06025ms)
✔ remediation renewal rows expose initial and repeated grants up to the cumulative ceiling (0.095ms)
✔ enabling Full YOLO pauses before exact resume or new-batch discovery (1.368375ms)
✔ status dashboard can re-enter a blocked workflow while remediation grants remain separately explicit (0.631208ms)
✔ source-session takeover disables delivery while preserving supporting capabilities (0.31175ms)
✔ status panel distinguishes remediation and reconciliation actions (0.286125ms)
✔ status panel exposes bounded Wayfinder mapping state without paths or capsule content (0.473833ms)
✔ Pi, shared, and archive paths are writable (0.41975ms)
✔ Hermes and unsafe paths denied (0.122084ms)
✔ destruction defers to permission system and wrong vault is denied (0.057125ms)
✔ trash requires explicit bounded trash folder (0.056875ms)
✔ folder migration requires both paths inside approved boundaries (0.495125ms)
✔ retrieves notes directly from a bounded filesystem snapshot (27.878916ms)
✔ refreshes the filesystem snapshot after a bounded cache window (134.16525ms)
✔ extracts metadata and targeted relationships without Obsidian Desktop (5.516ms)
✔ rejects unsafe paths and never follows symlinked vault content (3.591791ms)
✔ wrapper injects the filesystem backend and contains no GUI launcher (1.013667ms)
✔ previews and atomically commits one digest-bound Markdown folder move (41.884916ms)
✔ refuses overwrite, nested moves, hidden files, and symlinks while allowing inert regular-file artifacts (52.207292ms)
✔ cancels commit when source bytes changed after approval (6.568542ms)
✔ rejects traversal, wildcard, root, and missing-parent requests (7.527708ms)
✔ automatic run updates once then is a timestamp-free no-op (101.757958ms)
✔ represented state change updates expected generated notes (66.0645ms)
✔ automatic allowlist is fixed and protected roots are rejected (7.365958ms)
✔ symlink escape and missing vault fail safely (35.33375ms)
✔ malformed manual markers prevent overwrite (22.278208ms)
✔ exclusive lock skips concurrent run and recovers stale lock (15.584125ms)
✔ atomic write failure leaves target unchanged and removes temp (8.996791ms)
✔ exact npm source parsing (3.321917ms)
✔ inventory uses fixed roots and exports metadata only (38.178916ms)
✔ generated merge preserves manual content (0.251333ms)
✔ atomic writes stay inside allowed root (26.366666ms)
✔ stable launcher resolves reviewed Node without shell initialization (34.477208ms)
✔ staged LaunchAgent uses stable launcher and deterministic auto command (1.318667ms)
✔ debounces repeated lifecycle changes (1.9505ms)
✔ shutdown flush runs pending work once (0.15225ms)
✔ authoritative lifecycle ignores a raw no-target pause and preserves bounded targets (0.820667ms)
✔ completed handoff proof requires the exact terminal authority envelope (0.220916ms)
✔ archive completion proof rejects missing, wrong, duplicate, and symlinked handoffs (7.40075ms)
✔ runtime lifecycle wiring retains exact selections, correlates dispatch settlement, and proves archive completion (1.22975ms)
✔ session handoff requests are strict, bounded, exactly addressed, and deterministic (3.077291ms)
✔ session handoff grants strictly reserve one recorded session for the named requester (0.400584ms)
✔ handoff abort restoration and shutdown finalization decisions are monotonic (0.098583ms)
✔ session handoff lifecycle wiring scans before capping and fences shutdown before publication (2.676958ms)
✔ explicit takeover retries deferred requester registration after session scaffold persistence (0.940083ms)
✔ workflow ownership reports a local active session as the viewing-session owner (0.422208ms)
✔ workflow ownership reports another-process active session (0.07275ms)
✔ workflow ownership detects another process taking over the viewing session's recorded workflow (0.072375ms)
✔ a viewing-session ID opened by another process never masquerades as current ownership (0.047208ms)
✔ workflow ownership reports multiple active Pi sessions (0.085458ms)
✔ workflow ownership keeps a stale lease out of active work and in recovery (0.040125ms)
✔ workflow ownership keeps a malformed lease out of active work and in recovery (0.031916ms)
✔ workflow ownership deduplicates multiple leases held by one Pi session (0.062417ms)
✔ workflow ownership ignores the provider coordination lease instead of reporting false recovery (0.029291ms)
✔ workflow ownership keeps a live lease without session presence in recovery, never active (0.034416ms)
✔ workflow ownership requires one canonical handoff identity for a live lease (0.026541ms)
✔ workflow ownership resolves canonical phase action checkpoint and activity (0.046875ms)
✔ workflow ownership never lets an older checkpoint masquerade as the live owner (0.032791ms)
✔ workflow ownership inspects every lease record before bounding active UI output (0.225417ms)
✔ workflow ownership reports no active sessions for an empty lease set (0.026833ms)
✔ delivery attachment matrix covers no selection, unattached, fresh/resumed attachment, and detach (0.078584ms)
✔ active attachment identity survives only exact canonicals or verified owned leases (0.071708ms)
✔ selected workflow ownership includes another-process worker and excludes unrelated-batch inventory (0.065708ms)
✔ dispatch requires every Full YOLO capability, idle state, and a new signal (0.067917ms)
✔ pause blocks dispatch and resume preserves pending work (0.026708ms)
✔ pause during an active phase drains that phase and blocks the next dispatch (0.033292ms)
✔ failed send remains retryable (0.022375ms)
✔ YOLO session continuation resumes first and falls back only when unavailable (0.050584ms)
✔ YOLO runtime checkpoints are complete, concrete, and safe for manual lookup (0.667125ms)
✔ queue preflight wakes only for exact YOLO handoff states (0.085625ms)
✔ machine statuses and runtime indicators use one deterministic contract (0.691125ms)
✔ strict queue analysis quarantines unsafe YOLO envelopes and ignores manual delivery (0.468333ms)
✔ duplicate active handoffs quarantine only their batch identity (0.13625ms)
✔ resumable delivery targets include authorized recovery phases and bind exact snapshots (0.325541ms)
✔ Wayfinder metadata is strict opt-in and malformed declarations never downgrade to legacy (0.221709ms)
✔ Wayfinder enabled capsules reject absent, duplicate, unlinked, or ticket-mismatched navigation metadata (0.362291ms)
✔ Wayfinder phase plans are deterministic and metadata-first (0.092542ms)
✔ Wayfinder capsules bind exact queue identity, metadata generation, and handoff bytes (0.39075ms)
✔ Wayfinder optimization toggle removes selective hydration but preserves strict mapping and freshness (0.126208ms)
✔ Wayfinder maps authorized parallel targets sequentially with maximum mapping concurrency one (9.3295ms)
✔ Wayfinder stale attempts never settle reconciliation or remediation even when automatic remapping is paused (0.064916ms)
✔ Wayfinder singleton mapping lease fences cross-process contenders and stale publishers (10.85575ms)
✔ non-canonical implementation queue mutations fail closed (0.127667ms)
✔ remediation renewal targets allow repeated explicit one-to-three-attempt grants up to 12 (0.229292ms)
✔ reload requests exact session capability state before delivery runtime startup (0.506709ms)
✔ ticket remediation holds pause delivery independently of renewal-row eligibility (0.086542ms)
✔ reload restores one exact recorded workflow attachment and exhausted renewal pauses safely (0.157875ms)
✔ delivery state preserves blocked workflow resume after settled phase dispatch is removed (1.621875ms)
✔ blocked remediation is opt-in, bounded, and visible as active remediation (0.16925ms)
✔ remediation accounting is ticket-scoped and inherited successor counters fail closed (0.258ms)
✔ recovery fingerprint ignores activity-log edits but changes with blocker evidence (0.237958ms)
✔ parallel dispatch grouping requires matching explicit authority and never exceeds two (0.075583ms)
✔ lease-loss reconciliation markers remain batch/path exact across a ticket transition (0.131917ms)
✔ queue wake gate suppresses unchanged filesystem signals and blocked snapshots (0.050583ms)
✔ cross-process lease allows one owner and fences a stale owner after takeover (6.783333ms)
✔ simultaneous contenders produce exactly one lease owner (0.863167ms)
✔ graceful lease release permits immediate takeover (1.359167ms)
✔ settled recovery fingerprint suppresses duplicate local-process attempts (2.306708ms)
✔ dispatcher requires a complete post-route consistency gate (0.54825ms)
✔ runtime reports separate counts and explicit ticket actions for every delivery phase (2.621833ms)
✔ lease loss records reconciliation, fences the old invocation, and rearms only after settlement (0.597375ms)
✔ parallel delivery is explicit, bounded to two, and keeps Obsidian writes in the parent (0.409041ms)
✔ dedicated YOLO subagents preserve parent-only Obsidian authority (0.89475ms)
✔ dispatcher requires pinned initiative-scoped archive completion (0.187083ms)
✔ reviewed workflow skills require coherent Wayfinder metadata across routing transitions (1.085792ms)
ℹ tests 155
ℹ suites 0
ℹ pass 155
ℹ fail 0
ℹ cancelled 0
ℹ skipped 0
ℹ todo 0
ℹ duration_ms 812.260375