# Fault-sensitive test conformance

This document maps every required fault-sensitive test in
[`docs/design.md` §18 and §A.8](design.md) to the current test suite. It is a
traceability record, not a claim that similarly shaped tests satisfy a numbered
requirement.

Classification rules:

- `implemented`: a test name or adjacent test comment names the design number
  (`[doc N]` or `[appendix N]`) and its assertions cover the complete required
  fault, fence, or negative control.
- `partially`: numbered coverage exists but omits part of the required oracle,
  or an unnumbered test provides supporting evidence that cannot qualify as an
  implemented numbered test.
- `implemented-to-capability-limit`: the complete available capability-port
  contract is fault-sensitive and green, while a named upstream runtime version
  still lacks the API required for a real end-to-end oracle. The row records the
  version-triggered re-verification obligation.
- `deferred-with-reason`: the required production capability or authorized
  implementation layer does not exist yet, so no honest test can exercise it.

Where a capable fake or projection port is the only evidence, the table says so
explicitly.

| No. | Design case | Test evidence | Status | Coverage or missing evidence |
| ---: | --- | --- | --- | --- |
| 1 | Confirmed-bind roster | `test/confirmed-bind-onboarding.test.ts` — five `[doc 1]` confirmed-bootstrap, headless, existing-roster, partial-failure, and stock-AMQ cases | implemented | `/amq bind` previews the physical root, session/project, complete roster, `.amqrc`/`.gitignore` effects, and exact `coop init` command. TUI confirmation gates mutation; headless and partial verification remain dormant; stock AMQ's uninitialized `who=null` result is handled explicitly; env, mailbox, and roster are re-verified before persistence. |
| 2 | Kill before `pending` commit | `test/inbox-pump.test.ts` — `[doc 2] a failed pending commit cannot consume, and the next pump finds the same ID` | implemented | The atomic pre-commit fault prevents the read, then a new pump finds and injects the same ID. |
| 3 | Kill after `pending`, before read | `test/inbox-pump.test.ts` — `[doc 3,4,5,6] startup recovery reconciles projections and cur before watch`; `[doc 3] an exact-read miss enters recovery instead of orphaning its pending journal`<br>`test/bridge-journal.test.ts` — `[doc 3] a matching pending record can be adopted only by the replacement receiver generation` | implemented | Covers generation-safe adoption, exact-ID recovery, and recovery-before-watch. |
| 4 | Kill after `new -> cur`, before journal enrichment | `test/inbox-pump.test.ts` — `[doc 3,4,5,6] startup recovery reconciles projections and cur before watch`<br>`test/stock-amq-integration.test.ts` — `[doc 4] recovering an exact ID already in cur does not emit a second drained receipt` | implemented | Recovery reads the same exact ID from `cur`; the stock-AMQ receipt ledger remains at exactly one `drained` receipt after the recovery read. |
| 5 | Kill after pi scheduling, before `injected` | `test/inbox-pump.test.ts` — `[doc 3,4,5,6] startup recovery reconciles projections and cur before watch` | implemented | A disk-visible matching projection is reconciled before watch and the ID is not scheduled again. |
| 6 | Volatile scheduling and missing historical projection | `test/inbox-pump.test.ts` — `[doc 3,4,5,6] startup recovery reconciles projections and cur before watch` | implemented | Volatile-only delivery remains pending; a missing historical projection is reported without resurrecting the injected task. |
| 7 | Two live pi processes, one receiver | `test/receiver-lease.test.ts` — `[doc 7] two live contenders produce exactly one receiver owner`<br>`test/runtime-status.test.ts` — `[doc 7] the losing extension runtime exposes send-only while the owning generation receives` | implemented | Exactly one contender owns the generation; the loser retains send/reply inspection surfaces but exposes send-only and cannot consume or set principal presence. |
| 8 | Stale-lock race and fail-closed owners | `test/receiver-lease.test.ts` — four `[doc 8]` stale-race, fail-closed owner, identity-proof, and paused-owner cases | implemented | Proven-dead owners quarantine through the ordinary race; remote, corrupt, unverifiable, age-only, and live paused owners are never displaced. |
| 9 | Stock print/json subagent is send-only | `test/runtime-status.test.ts` — `[doc 9] print/json are send-only and never start the receiver`<br>`test/stock-pi-integration.test.ts` — `[doc 9] stock print/json pi subprocesses inherit AM_ME, stay send-only, and emit one attributed send` | implemented | Real Pi 0.84.2 text/JSON subprocesses use a deterministic provider and logged stock AMQ binary. Each performs one `delegate`-attributed send and no watch, read/drain claim, or principal-presence command. |
| 10 | Reload/resume/fork/clone/new-session handoff | `test/extension-lifecycle-integration.test.ts` — `[doc 10] extension lifecycle verifies every bind, hands one lease off sequentially, and keeps a concurrent parent send-only` | implemented | Real extension event handlers and stock AMQ cover binding verification plus sequential reload/resume/fork/clone/new-session release/reacquire. A concurrent same-handle process remains send-only with no watch or presence write. |
| 11 | Repin while watch waits | `test/inbox-pump.test.ts` — `[doc 11] watch restart is bounded and revalidates authority before another child`; `[doc 11] AMQ context mismatch disables receiving without restart` | implemented | Exit-5/mismatch disables receiving and bounded backoff cannot start another child after authority changes. |
| 12 | Priority delivery while idle/tools run and staged recovery | `test/priority-delivery-scheduler.test.ts` — `[doc 12] priority mapping and deterministic priority/created/ID order are exact`; `[doc 12] idle and active-tool runtime states preserve exact priority delivery without aborting the tool`<br>`test/inbox-pump.test.ts` — `[doc 12] kill with low mail staged, then replacement-generation recovery injects the same pending attempt`; `[doc 12,18]` cohort coverage | implemented | Idle and active-tool states retain exact `steer`/`followUp`/`nextTurn` options without tool abort. A volatile low delivery remains attempt 1 pending and a replacement lease generation recovers it from `cur` to a durable projection. |
| 13 | Fresh-session gate refusal | `test/fresh-session-dispatcher.test.ts` — `[doc 13] non-authorized fresh-session mail is refused without capability dispatch`<br>`test/inbox-pump.test.ts` — `[doc 13] refused fresh-session request is injected in the current session with visible metadata` | implemented | Proves no privileged dispatch and current-session injection with visible refusal metadata. |
| 14 | Authorized fresh-session replacement | `test/fresh-session-dispatcher.test.ts` — `[doc 14] capable fresh-session dispatch is serialized`; `[doc 14,15] capable command context waits idle, rechecks the interlock, and requires replacement projection`; `[doc 14] a not-yet-disk-visible replacement projection is a legitimate deferred state, not a failure`; `[doc 14] a replacement projection for an unrelated message id is rejected`<br>`test/fresh-session-port.test.ts` — `[design.md 8.3] replace() dispatches the expanded command and resolves once the handler completes newSession with a disk-visible projection`; `[design.md 8.3] a kickoff not yet flushed to disk but visible in the in-memory branch resolves with diskVisible:false`; `[design.md 8.3] a kickoff visible on neither disk nor the in-memory branch rejects instead of recording injected`<br>`test/inbox-pump.test.ts` — `[doc 14] capable fresh-session projection commits the replacement session target`; `[doc 14] a not-yet-disk-visible fresh-session projection stays pending with its target set until reconciliation observes the flush` | implemented | On the pi 0.84.2 floor, `PiFreshSessionReplacementPort` fires the real `expandPromptTemplates` dispatch and the registered `/amq-new-task` command handler drives `ctx.waitForIdle()` → `ctx.newSession` → `withSession` kickoff → projection verification, exercised against a fake `ExtensionCommandContext`/`ReplacedSessionContext` and real on-disk/in-memory-branch fixtures. Pi persists a fresh session's file lazily (nothing is written until its first assistant entry), so an in-memory-branch-only match legitimately resolves `diskVisible:false`; `CommandContextFreshSessionCapability`/`FreshSessionDispatcher` accept that deferred evidence by matching `messageId` only, and the journal (`transport/inbox-pump.ts`) commits the target session but records `injected` only once `diskVisible` becomes true, exactly as the pre-existing reconciliation path for ordinary delivery already required. A kickoff absent from both the branch and disk remains a hard failure. |
| 15 | Cancel/fail `ctx.newSession`, then ingest | `test/fresh-session-dispatcher.test.ts` — `[doc 14,15] capable command context waits idle, rechecks the interlock, and requires replacement projection`<br>`test/inbox-pump.test.ts` — `[doc 15] fresh-session capability gap stays pending until explicit ingest promotes current-session delivery`<br>`test/fresh-session-port.test.ts` — cancelled-`newSession`, dispatch-timeout, duplicate-in-flight, abort, and unmatched-projection cases | implemented | A cancelled `newSession`, a command handler that never fires within its dispatch bound, or a replacement session missing the matching in-memory/disk projection each surface as a real failure; the journal stays pending and `/amq ingest` recovers it without invented completion. |
| 16 | Per-envelope reply provenance with interactive input | `test/priority-delivery-scheduler.test.ts` — `[doc 16] every coalesced envelope retains immutable reply provenance`<br>`test/guidance.test.ts` — `[doc 16] guidance retains immutable per-envelope reply provenance under 40 lines`<br>`test/extension-registration.test.ts` — `[doc 16] queued interactive input cannot clear or overwrite immutable per-envelope reply provenance` | implemented | Queued interactive input leaves every ID/sender/thread/reply instruction byte-for-byte intact; the runtime has no mutable global channel/sender marker to clear or overwrite. |
| 17 | Bounded large bodies and safe slices | `test/priority-delivery-scheduler.test.ts` — `[doc 17] individual previews are 8 KiB, batches are 24 KiB, and truncation is explicit`<br>`test/amq-operations.test.ts` — `[doc 17] get_message uses the receiver claim port and returns a bounded UTF-8 slice` | implemented | Covers byte-safe preview/batch bounds, exact-ID slice retrieval, and queue-path suppression. |
| 18 | Corrupt mail goes to DLQ | `test/inbox-pump.test.ts` — `[doc 12,18] a cohort is journaled before exact reads, deduplicated, ordered, and DLQ-safe` | implemented | The corrupt candidate becomes terminal `dlq` and is absent from valid delivery batches. |
| 19 | Verified DLQ retry and terminal tombstone | `test/bridge-journal.test.ts` — two `[doc 19]` atomic promotion/crash-recovery cases<br>`test/dlq-retry-audit.test.ts` — `[doc 19]` production stock-AMQ audit parser/filter case<br>`test/inbox-pump.test.ts` — `[doc 19]` verified same-ID redelivery and no-evidence refusal cases | implemented | A terminal attempt advances exactly once only when the same ID is visibly redelivered and an unused AMQ `retry_state=delivered` audit with the matching retry count exists. The old attempt is archived before the pending attempt+1 replacement; a crash after history commit is recoverable; absent/reused audit evidence remains terminal. |
| 20 | Multi-recipient partial send | `test/amq-operations.test.ts` — `[doc 20,21] partial send evidence remains visible and is never retried` | implemented | Per-recipient committed/failed evidence remains visible and the send command runs exactly once. |
| 21 | Receipt and sender-outbox audit failures | `test/inbox-pump.test.ts` — `[doc 21] a receipt-audit failure is classified as a committed claim and remains distinct from sender audit failure`<br>`test/amq-operations.test.ts` — `[doc 21] a sender-outbox audit failure is classified separately after committed delivery`; `[doc 20,21]` partial-send evidence | implemented | Receipt failure is surfaced as `Claim committed; drained receipt audit failed`; sender outbox failure is `delivery-committed-sender-audit-failed`. Both retain committed primary delivery evidence and neither retries. |
| 22 | Compaction preserves pending recovery facts | `test/guidance.test.ts` — `[doc 22] compaction projection preserves only bounded pending IDs and unread counts`<br>`test/extension-lifecycle-integration.test.ts` — `[doc 22] real session_compact preserves injected and pending facts, then restart recovers only pending mail` | implemented | A real registered `session_compact` handler sees one injected and one volatile pending envelope, projects only the pending recovery fact, and a replacement runtime recovers only that ID without resurrecting or losing the injected fact. |
| 23 | Route/trace diagnostics preserve primary failure | `test/amq-operations.test.ts` — four `[doc 23]` send/timeout/trace/secondary diagnostic cases<br>`test/binding-resolver.test.ts` — `[doc 23] binding-failure integration preserves the primary verification refusal when route diagnosis also fails` | implemented | Binding, route, and trace diagnostic branches can fail independently while the literal primary failure/category remains authoritative; timeout never resends. |
| 24 | RPC worker is send-only | `test/worker-launch-contract.test.ts` — `[appendix 24,33,36]` exact send-only launch contract<br>`test/worker-process-supervisor.test.ts` — `[appendix 24,33,34,42]` supervised RPC cancellation | implemented | The launch contract fixes send-only transport, scrubs receiver authority, and the supervised RPC process follows durable cancellation ordering. |
| 25 | Fresh session while workers are active | `test/fresh-session-dispatcher.test.ts` — `[appendix 25]` capability interlock<br>`test/worker-runtime-policy.test.ts` and `test/workflow-run-store.test.ts` — `[appendix 25,37,47,48]` actual active-to-settled ledger path | implemented | The dispatcher refuses before capability dispatch; the authoritative ledger refuses replacement with a running worker and permits it only after every attempt is terminal, certain, and attached. |
| 26 | Crash after `run-opened` | `test/workflow-run-store.test.ts` — `[appendix 26,39,40]` ledger rebuild and `[appendix 26,39]` post-commit recovery | partially | Ledger authority and no-replay recovery are covered. Missing: a process-kill oracle at exactly the root-only event. |
| 27 | Idempotent `startRun` | `test/workflow-run-store.test.ts` — `[appendix 27]` same-key replay and conflicting fingerprint | implemented | Same input returns one run; changed immutable input refuses without another event. |
| 28 | Spawn contract validation | `test/workflow-run-store.test.ts` — `[appendix 28,41]` invalid-contract no-mutation<br>`test/worker-process-supervisor.test.ts` — `[appendix 28]` required-field matrix and `[appendix 28,34]` grant/depth/concurrency preflight | partially | Goal, acceptance, constraints, budget, model, capability, and workspace omissions all refuse before ledger, worker-session lease, or process effects. Capability, budget, and unresolved trust also fail closed. Missing: an explicit mutation-grant authority and exceedance oracle. |
| 29 | Idempotent `spawn_worker` | `test/worker-process-supervisor.test.ts` — `[appendix 28,34]` repeated request returns the existing worker | partially | Same-key replay and conflict fencing exist. Missing: a literal driver crash between tool return and caller observation. |
| 30 | One worker session, one owner | `test/workflow-lease.test.ts` — three `[appendix 30]` exclusivity/takeover/fail-closed tests<br>`test/worker-process-supervisor.test.ts` — run-scoped sessions, authoritative child exit, and PID-disappearance negative control | implemented | Canonical session leases are generation-fenced. Lease-owner staleness and worker lifecycle exit remain separate; PID disappearance never synthesizes worker exit or replacement. |
| 31 | Parent death and stale output | `test/node-pi-process-factory.test.ts` — `[appendix 31]` parent-liveness and process-group tests<br>`test/worker-process-supervisor.test.ts` — `[appendix 30,31,40]` detached no-replay recovery, `[appendix 31,32,34]` uncertain-effect ambiguity, `[appendix 31]` live stale-output fencing, and JSON settled liveness release | implemented | Parent loss leaves a known-live worker running with detached control and run needs-attention; uncertain effects enter ambiguity. After supervisor takeover, a live mutating old-generation worker cannot commit result, usage, candidate, or exit facts. A settled JSON one-shot releases its liveness pipe only after the correlated settled envelope. |
| 32 | Broken RPC pipe after uncertain work | `test/worker-process-supervisor.test.ts` — `[appendix 31,32,34]` uncertain external exit becomes ambiguous<br>`test/workflow-run-store.test.ts` — `[appendix 32]` durable reconciliation | implemented | Uncertain effects become ambiguous, never replay, and require explicit reconciliation. |
| 33 | JSON/RPC contract boundary | `test/worker-launch-contract.test.ts` and `test/worker-process-supervisor.test.ts` — `[appendix 24,33,36]`, `[appendix 33]`, EOF-before-ready, and exit-after-drain<br>`test/stock-worker-protocol-integration.test.ts` — real Pi JSON/RPC fd-4 and descriptor-mismatch cases | partially | JSON closes stdin before ready while RPC retains stdin for control. Both use a dedicated worker-control descriptor; Pi stdout and diagnostic stderr cannot impersonate launch parity. Driver-inbox forwarding is not part of W3. |
| 34 | Hard budget enforcement | `test/worker-process-supervisor.test.ts` — `[appendix 28,34]`, `[appendix 31,32,34]`, and five `[appendix 34]` cases | implemented | Every run ceiling has direct evidence: max-workers, concurrency, depth, total attempts, token, wall-clock, cost, and output bytes. Preflight exhaustion refuses before process creation or ledger mutation; observed runtime exhaustion persists the trigger usage and cancellation intent before signaling. |
| 35 | Mutation isolation | — | deferred-with-reason | Requires worker mutation/worktree leases and concurrent mutating worker execution. |
| 36 | Child launch parity and trust | `test/worker-launch-contract.test.ts` — `[appendix 24,33,36]`, `[appendix 28,33,36]`, schema-1 historical compatibility, and schema-2 fd parity<br>`test/stock-worker-protocol-integration.test.ts` — real Pi descriptor mismatch fails closed | implemented | Model, thinking level, cwd, tools, capability, channel, trust, and liveness/control descriptor mismatches fail before useful child work. |
| 37 | Dormant transport independence | `test/workflow-run-store.test.ts` — `[appendix 37,47,48] zero-AMQ run demonstrates three governed workers and live FleetView`<br>`test/extension-registration.test.ts` and `test/worker-tools.test.ts` | implemented | One interactive non-AMQ run exercises three distinct model/difficulty/channel contracts, steer, cancellation, collection, Gate completion, budget projection, and Fleet navigation while proving no `.agent-mail` path is created. Worker tools register independently of transport activation. |
| 38 | Cross-domain correlation without merged state | `test/workflow-domain-isolation.test.ts` — `[appendix 38]` | implemented | AMQ correlation cannot cross-replay or mutate the workflow persistence owner. |
| 39 | Ledger projection correctness | `test/workflow-run-store.test.ts` — `[appendix 26,39,40]` and `[appendix 39,45]` | implemented | Snapshot corruption is ignored in favor of the contiguous event chain; gaps and checksum changes fail closed. |
| 40 | Resume has no hidden control flow | `test/worker-process-supervisor.test.ts` — `[appendix 30,31,40]` plus PID-disappearance negative control<br>`test/workflow-run-store.test.ts` — `[appendix 26,39,40]` | partially | Recovery performs no process replay and explicit resume requires authoritative exit/reconciliation evidence. Empty-root process-kill coverage remains part of case 26. |
| 41 | Evidence FSM/DAG guards | `test/worker-gate.test.ts`, `test/run-gate.test.ts`, W3/W4 Gate tests in `test/worker-process-supervisor.test.ts`, and invalid evidence-graph tests in `test/workflow-run-store.test.ts` | implemented | Separate worker and run legality tables reject undeclared transitions and report independent evidence, verifier, prerequisite, active, uncertain, and detached blockers; cyclic evidence prerequisites fail before mutation. |
| 42 | Model-driven cancellation semantics | `test/worker-process-supervisor.test.ts` — `[appendix 24,33,34,42]` and `[appendix 31,32,34]` | implemented | Intent precedes signaling; uncertain effects remain ambiguous rather than becoming cancelled by assertion. |
| 43 | Guidance is advisory | `test/guidance.test.ts`, `test/coordination-skill.test.ts`, `test/worker-tools.test.ts`, `test/extension-registration.test.ts`, and WR-G1/WR-G2 tests | implemented | Either named doctrine can be removed independently without changing functional projections; the registry explicitly rejects `pipeline`, `parallel`, `judge`, and `loop`, while the six atomic worker tools remain exact. |
| 44 | Worked fan-out uses atomic truth | `skills/coordination-patterns/references/supervised-worker-fan-out.md` plus Gate/tool tests | partially | The shipped few-shot uses atomic calls and Gate truth. A real multi-worker provider demo is still required. |
| 45 | Ledger chain failure is fail-closed | `test/workflow-run-store.test.ts` — `[appendix 39,45]`, `[appendix 30,45]` | implemented | Chain mutation and stale writer generation both refuse mutation. |
| 46 | Lifecycle adapter projection is derived | `test/lifecycle-projection.test.ts` — `[appendix 46]` exact Adapter Contract v1 context/labels; `extension/worker-runtime.ts` committed-projection subscriber | partially | Exact derived metadata and no-retry runtime wiring exist. Missing: an integration fault that injects failed and indeterminate AMQ sends while proving the committed worker ledger remains unchanged. |
| 47 | FleetView invalidation is live | `test/fleet-view.test.ts` — `[appendix 47]` live source invalidation/input boundary<br>`test/workflow-run-store.test.ts` — `[appendix 37,47,48]` authoritative multi-worker ledger projection | implemented | Committed ledger events update all three worker rows through the subscribed Fleet source, including lifecycle/activity/budget changes, while editor text remains unintercepted and list state stays open. |
| 48 | Viewer control is generation/mode fenced | `test/fleet-view.test.ts` — `[appendix 48]` and `[appendix 48,49]` detail controller<br>`test/workflow-run-store.test.ts` — `[appendix 37,47,48]` durable RPC steer/cancel facts | implemented | Current RPC generation fencing, exact JSON refusal text, `x,x` requested/observed/indeterminate semantics, and durable steer/cancel facts are covered; runtime rechecks the current ledger generation at the effect port. |
| 49 | Overlay is non-blocking | `test/fleet-view.test.ts` — `[appendix 48,49]` asynchronous detail controls and live resolver | partially | The overlay controller never switches sessions and resolves controls asynchronously against live records. Missing: one concurrent real-main-stream, worker-tail, and AMQ-delivery integration oracle. |

## Summary

- Implemented: **38**
- Implemented to capability limit: **2**
- Partially implemented: **8**
- Deferred with reason: **1**
- Total: **49**

## Unnumbered WorkerRuntime evidence gates

These gates extend the worker evidence protocol without renumbering or changing
the 49 transport/Appendix conformance cases above.

| Gate | Test evidence | Status | Coverage |
| --- | --- | --- | --- |
| WR-G1 prompt capsule | `test/worker-prompt-capsule.test.ts` | implemented | Canonical role/acceptance/constraint context is byte-identical at prompt head and tail; a one-byte negative control fails. |
| WR-G2 live model overlays | `test/worker-model-catalog.test.ts` | implemented | Live-catalog tier selection, current fallback, auditor floor, user notes, trusted project override, malformed notice, and untrusted-project non-read are covered. |
| WR-G3 launch preview | `test/spawn-confirmation.test.ts`, `test/launch-preview.test.ts`, and `test/workflow-run-store.test.ts` | implemented | Esc and tool abort call no launch effect; headless required previews fail before effects; single-worker `multi-worker-only` skips; role/task/model/difficulty/downward-budget edits are mutable proposals; accepted human-edited provenance survives ledger replay. |
| WR-G4 declarations and installed guide | `test/worker-role-presets.test.ts`, `test/guide.test.ts`, and `test/extension-registration.test.ts` | implemented | All five builtins, user/trusted-project precedence, untrusted-project non-read, fixed installed topics, unindexed path refusal, UTF-8 bounds, command/tool registration, and package-root resolution are covered. |
| WR-G5 deliberate worker continuation | `test/worker-process-supervisor.test.ts` — two `V1.1 deliberate continuation` cases | implemented | Fresh contracts may continue only the exact session file of a terminal worker whose exit is durably observed and whose process identity is absent or replaced. Live, unknown, and non-terminal sources fail before ledger/process effects; the new ledger projection links prior worker/attempt/lease provenance and the canonical lease generation changes. |
| WR-G6 explicit workflow cleanup | `test/run-cleanup.test.ts`, `test/worker-tools.test.ts`, and `test/extension-registration.test.ts` | implemented | Dry-run is mutation-free and reports run, worker-session, and artifact sizes; active, ambiguous, held-lease, and corrupt-lease state is refused. Deletion requires TUI or headless confirmation, holds the current supervisor fence, and persists an audit event before the first removal. |
| WR-G7 read-only workflow doctor | `test/workflow-doctor.test.ts`, `test/workflow-run-store.test.ts`, `test/workflow-lease.test.ts`, `test/worker-tools.test.ts`, and `test/extension-registration.test.ts` | implemented | Independent run-ledger validation, PID identity cross-checks, orphan/stale/abandoned/corrupt lease classification, dangling sessions, disk usage, and exact suggested argv are covered. The diagnostic leaves corrupt and dangling fixtures unchanged. |
| WR-G8 shared run artifact directory | `test/run-artifacts.test.ts`, `test/worker-prompt-capsule.test.ts`, `test/guidance.test.ts`, and `test/run-cleanup.test.ts` | implemented | One deterministic mode-0700 directory is shared by every worker in a run, differs across runs, becomes the first immutable artifact context ref without mutating caller input, is mirrored in the prompt capsule, and remains covered by explicit cleanup size/deletion evidence. |
| WR-G9 forked worker context | `test/pi-session-fork.test.ts`, `test/worker-process-supervisor.test.ts`, `test/launch-preview.test.ts`, and `test/workflow-run-store.test.ts` | implemented | Fresh remains the default. Fork copies the exact current driver leaf into an independently leased child session, records source/branch/size provenance, exposes inherited size before acceptance, and leaves parent bytes unchanged; copy failure produces no process. |
| WR-G10 ordered model fallback | `test/worker-process-supervisor.test.ts`, `test/worker-tools.test.ts`, `test/worker-runtime-policy.test.ts`, and `test/launch-preview.test.ts` | implemented | Only child launch-validation and classified provider auth/quota/capacity failures advance the bounded live-catalog chain. Every actual model and reason is ledgered; ordinary failure never advances, exhaustion stays failed, and tier degradation is visible. |
| WR-G11 directional peer messaging | `test/worker-process-supervisor.test.ts`, `test/workflow-run-store.test.ts`, `test/worker-launch-contract.test.ts`, `test/launch-preview.test.ts`, and `test/worker-prompt-capsule.test.ts` | implemented | Exact and uniquely resolved role grants map only to the child peer tool. Unauthorized, ambiguous, self, detached, and stale-generation delivery fail closed; recipient inference is never interrupted; one correlated hashed message fact projects under both endpoints and survives ledger replay. Restart turns a memory-only pending body into indeterminate without replay. |
| WR-G12 generation-correlated typed waits | `test/worker-gate.test.ts`, `test/workflow-run-store.test.ts`, `test/worker-process-supervisor.test.ts`, `test/worker-launch-contract.test.ts`, and `test/worker-runtime-policy.test.ts` | implemented | RPC children receive `wait_for_input`; a current-generation reason/correlation fact alone enters blocked. Prose and `message_end` do not. Missing or mismatched steer/revision/peer correlation reaches no child pipe and causes no wake; all three exact inputs return the attempt to running. Blocked workers reject stall observations, and Fleet/tool projections expose reason and correlation. |
| WR-G13 in-process reload adoption | `test/worker-runtime-reload.test.ts` | implemented | A replacement extension adopts the exact process-global core only after PID/start, workspace/namespace, and on-disk supervisor-generation validation. Real RPC workers remain listable, steerable, and cancellable across replacement; old Fleet/notice subscribers are detached. Missing, corrupt, mismatched, and other-PID ownership all fail closed without changing the lease. |

## Transport-slice closure

Categories A–C are green; there are no remaining transport-slice blockers.
Tests **14** and **15** are fully implemented against the pi 0.84.2 floor: no
capability-limited rows remain.

W1 through W4 plus the post-W4 role, guide, and launch-preview bundle move the
WorkerRuntime boundary into production modules. Tests
**26, 28, 29, 31, 33, 34, 37, 40, 41, 43, 44, 47, and 48** retain the literal
missing oracle recorded in their rows. Tests **35, 46, and 49** remain deferred
to mutation isolation, AMQ lifecycle projection, and the full live overlay.