test(e2e): failing-test-first guard for #2701 + recovery framework helpers

[jyaunches]

Summary

Failing-test-first regression guard for #2701: gateway recovery currently warns about a missing /tmp guard chain after a pod recreate but launches the gateway naked anyway, triggering the @homebridge/ciao crash loop documented in the issue (5-minute rebuild --yes is the only manual recovery on DGX Spark).

This PR captures the #2701 contract in two formats so the bug shows up in CI before the fix lands. The bash and Vitest suites stay completely separate and do not call each other.

1. Legacy bash flip — test/e2e/test-issue-2478-crash-loop-recovery.sh Phase 4 keeps the existing [DGX Spark] Gateway crash loop on startup: @homebridge/ciao networkInterfaces() returns EPERM in OpenShell sandbox #2478 WARNING assertion and now also asserts the guard chain is restored after recovery. Will be red on main; flips green when the [DGX Spark] Host reboot bricks sandbox until 5-min rebuild --yes: connect recovery path warns about missing /tmp guards but launches gateway naked → @homebridge/ciao crash loop #2701 fix lands. The new fail() is deferred so Phase 4 restore + Phase 5 soak still execute and the artifact bundle stays comparable to historical runs. Runs in the existing issue-2478-crash-loop-recovery-e2e job in nightly-e2e.yaml — no workflow change.

2. New Vitest live E2E — test/e2e-scenario/live/gateway-guard-recovery.test.ts. First slice migrated from the legacy 2478 harness. Asserts the same [DGX Spark] Host reboot bricks sandbox until 5-min rebuild --yes: connect recovery path warns about missing /tmp guards but launches gateway naked → @homebridge/ciao crash loop #2701 contract using typed framework fixtures and runs in the Vitest workflow only (e2e-vitest-scenarios.yaml) as a new free-standing gateway-guard-recovery job. Not part of the registry-driven matrix because recovery scenarios don't fit the steady-state expected-state probe model.

3. Framework helpers — sandbox-lifecycle disruption-and-recovery primitives, reusable for any future recovery scenario:

   • GatewayClient.expectGuardChainActive — reads /tmp/nemoclaw-proxy-env.sh (not /proc/<pid>/environ; kernel.yama.ptrace_scope=1 blocks cross-tree environ reads — same approach as the legacy gateway_guards_active shell helper) and asserts the expected --require markers are present.
   • GatewayClient.expectLogContains / expectLogDoesNotContain — tail and grep /tmp/gateway.log inside the sandbox.
   • GatewayClient.expectPidStable — sample gateway PID over a window, fail on change (crash-loop) or disappearance.
   • GatewayClient.resolveGatewayPid — typed wrapper around the legacy two-pass ps detection.
   • SandboxClient.wipeGuardChain — remove /tmp/nemoclaw-proxy-env.sh plus the seven guard preload files; equivalent shape to a fresh container's /tmp after pod recreate.
   • SandboxClient.killGatewayTree — pkill -9 -f '[o]penclaw' + verify nothing came back.
   • 21 unit tests in test/e2e-scenario/framework-tests/e2e-recovery-helpers.test.ts covering the new helpers (mocked runner, no live deps).

Phases 1, 2, 3, and 5 of the legacy 2478 script (initial-state, normal crash-recovery loop, idle soak) remain in bash pending a follow-up migration PR per the migration doc's "preserve the requirement before removing legacy runner pieces" policy. Migration inventory updated to record the partial Vitest target.

Suite separation

• nightly-e2e.yaml — bash E2E only. Untouched by this PR. The issue-2478-crash-loop-recovery-e2e job already runs the legacy script; the new Phase 4 assertion lights up automatically.
• e2e-vitest-scenarios.yaml — Vitest E2E only. Gains the new gateway-guard-recovery job. workflow_dispatch only today, matching the existing Vitest workflow's trigger model.

The two suites do not call each other and do not share workflow definitions. PR-C may revisit the Vitest workflow's trigger model (e.g. add a schedule) but that's out of scope for this PR.

Related Issue

Refs #2701 #2478 #4356 #4941

Sequencing

• PR-A (this PR) — failing-test-first guard. Two assertions go red: legacy issue-2478-crash-loop-recovery-e2e (Phase 4 new assertion, runs in nightly) and the new Vitest gateway-guard-recovery job (runs on workflow_dispatch of e2e-vitest-scenarios.yaml).
• PR-B (next) — the [DGX Spark] Host reboot bricks sandbox until 5-min rebuild --yes: connect recovery path warns about missing /tmp guards but launches gateway naked → @homebridge/ciao crash loop #2701 fix. Implements install-preloads.sh + a guard-recovery.ts module + wires re-emit into buildOpenClawRecoveryScript. Both assertions flip green.
• PR-C (later) — full migration of the remaining 4 phases of the 2478 bash test into Vitest after PR-B has soaked clean. Legacy bash test deletion gated on green soak per the migration policy.

Changes

• .github/workflows/e2e-vitest-scenarios.yaml — new gateway-guard-recovery free-standing job (not in the matrix).
• test/e2e-scenario/framework/clients/gateway.ts — added SandboxClient constructor dep + 5 new helpers.
• test/e2e-scenario/framework/clients/sandbox.ts — added wipeGuardChain and killGatewayTree disruption helpers.
• test/e2e-scenario/framework/e2e-test.ts — wire sandbox fixture into gateway fixture (chain stays acyclic).
• test/e2e-scenario/framework-tests/e2e-clients.test.ts and e2e-phase-state-validation.test.ts — updated existing test constructors to the new GatewayClient(host, sandbox) signature.
• test/e2e-scenario/framework-tests/e2e-recovery-helpers.test.ts (new) — 21 unit tests for the new helpers.
• test/e2e-scenario/live/gateway-guard-recovery.test.ts (new) — failing live E2E.
• test/e2e-scenario/migration/legacy-inventory.json — record the Vitest target for test/e2e/test-issue-2478-crash-loop-recovery.sh.
• test/e2e/test-issue-2478-crash-loop-recovery.sh — Phase 4 [DGX Spark] Host reboot bricks sandbox until 5-min rebuild --yes: connect recovery path warns about missing /tmp guards but launches gateway naked → @homebridge/ciao crash loop #2701 contract assertion (deferred fail).
• vitest.config.ts — exclude test/e2e-scenario/live/** from the cli project so pre-commit Test (cli) doesn't accidentally pick up live tests that need Docker. Pre-existing issue surfaced by this PR.

nightly-e2e.yaml is intentionally untouched.

Type of Change

• Code change (feature, bug fix, or refactor)
• Code change with doc updates
• Doc only (prose changes, no code sample modifications)
• Doc only (includes code sample changes)

Verification

• npx vitest run --project e2e-scenario-framework — 320 passed (baseline 299 + 21 new).
• npx prek run --all-files — pre-existing flake in runtime-hermes-secret-boundary-behavioural.test.ts and slow tests in nemoclaw-start.test.ts time out under prek's parallel load (unrelated to this PR; same behavior on main).
• Tests added for new behavior (21 unit tests for helpers; 1 live E2E test as the failing-test-first regression guard)
• No secrets, API keys, or credentials committed
• Docs updated for user-facing behavior changes (none — internal test infra only)

The new Vitest live E2E and the bash Phase 4 assertion are expected to fail on main-equivalent CI on this PR — that is the regression-guard signal. They will flip to green when the #2701 fix lands in PR-B.

---

Signed-off-by: J. Yaunches jyaunches@nvidia.com

🤖 Generated with Claude Code

Summary by CodeRabbit

• Tests

  • Added comprehensive end-to-end tests for gateway recovery after disruptions.
  • Enhanced test fixtures with recovery and health assertion capabilities.

• Chores

  • Improved CI/CD workflow with manual dispatch support and enhanced PR reporting.
  • Updated test configuration and helpers for recovery scenario validation.

[copy-pr-bot]

Auto-sync is disabled for draft pull requests in this repository. Workflows must be run manually.

Contributors can view more details about this message here.

[coderabbitai]

Note

Reviews paused

It looks like this branch is under active development. To avoid overwhelming you with review comments due to an influx of new commits, CodeRabbit has automatically paused this review. You can configure this behavior by changing the reviews.auto_review.auto_pause_after_reviewed_commits setting.

Use the following commands to manage reviews:

• @coderabbitai resume to resume automatic reviews.
• @coderabbitai review to trigger a single review.

Use the checkboxes below for quick actions:

• ▶️ Resume reviews
• 🔍 Trigger review

📝 Walkthrough

Walkthrough

This PR implements gateway guard-chain recovery verification by adding sandbox-aware test client APIs, sandbox disruption helpers, comprehensive unit tests, a live E2E scenario, and CI workflow wiring to validate that gateway recovery restores the /tmp guard chain after pod-recreate wipes.

Changes

Gateway Guard Recovery Feature

Layer / File(s)	Summary
Gateway & Sandbox client recovery APIs test/e2e-scenario/fixtures/clients/gateway.ts, test/e2e-scenario/fixtures/clients/sandbox.ts	Adds GatewayClient recovery methods (resolveGatewayPid, expectGuardChainActive, expectLogContains, expectPidStable) and SandboxClient disruption helpers (wipeGuardChain, killGatewayTree). Both clients now use shared probe environments with explicit OPENSHELL_GATEWAY injection, and SandboxClient.status() is updated to use --name semantics.
Unit tests for recovery and disruption test/e2e-scenario/support-tests/e2e-recovery-helpers.test.ts	Adds comprehensive test coverage via a ScriptedRunner harness, validating GatewayClient probe helpers (guard markers, log tails, PID parsing, PID stability polling) and SandboxClient disruption helpers (guard-chain wiping, gateway tree killing) across success and failure cases.
Fixture wiring & client test updates test/e2e-scenario/fixtures/e2e-test.ts, test/e2e-scenario/support-tests/e2e-clients.test.ts, test/e2e-scenario/support-tests/e2e-phase-state-validation.test.ts	Reorders fixtures to instantiate sandbox before gateway, updates gateway fixture and framework tests to construct GatewayClient(host, sandbox), and adjusts OpenShell command expectations to use --name placement.
Live gateway-guard-recovery scenario test/e2e-scenario/live/gateway-guard-recovery.test.ts	Provisions a Docker sandbox, asserts guard chain is active after onboarding, simulates pod-recreate disruption (wipe + kill), triggers recovery via nemoclaw connect --probe-only with probe environment, and validates guard restoration, absence of recovery warnings, and PID stability.
CI workflow: gateway-guard-recovery job and reporting .github/workflows/e2e-vitest-scenarios.yaml	Adds optional workflow_dispatch pr_number input, introduces gateway-guard-recovery job that installs OpenShell and runs the live test, and updates report-to-pr to depend on all jobs and post markdown results to a targeted or inferred PR.
Legacy integration & vitest config test/e2e/test-issue-2478-crash-loop-recovery.sh, vitest.config.ts	Updates legacy crash-loop script to assert guard-chain activation post-respawn; adds vitest config comments explaining live scenario exclusion from CLI tests.
Test input construction tweaks src/lib/security/credential-filter.test.ts, test/snapshot.test.ts	Minor test data changes: X-API-Key and Slack botToken test inputs expressed via string concatenation.

Estimated code review effort

🎯 4 (Complex) | ⏱️ ~60 minutes

Possibly related issues

• NVIDIA/NemoClaw#2701: PR directly implements E2E tests and sandbox/gateway helpers that simulate the guard-chain recovery scenario described in the issue.
• NVIDIA/NemoClaw#4999: PR extends the same Vitest fixture/client framework and CI workflow orchestration described by the epic.

Possibly related PRs

• NVIDIA/NemoClaw#5101: Shares a credential-filter.test.ts edit pattern for secret-value construction.
• NVIDIA/NemoClaw#5107: Introduces the openshell-version-pin-vitest job that this PR's workflow now depends on.

Suggested reviewers

• cv
• prekshivyas

Poem

🐰 A gateway guard stands firm and true,
Through pod-recreate and wipes anew,
With probes and helpers all in place,
The recovery dance finds its grace,
CI logs the victory's trace. 🔐

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Docstring Coverage	⚠️ Warning	Docstring coverage is 28.57% which is insufficient. The required threshold is 80.00%.	Write docstrings for the functions missing them to satisfy the coverage threshold.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title 'test(e2e): failing-test-first guard for #2701 + recovery framework helpers' accurately reflects the main changes: introducing E2E test guards and framework helpers for issue #2701.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[github-actions]

Selective E2E Results — ❌ Some jobs failed

Run: 27227063905
Target ref: ff460c66fcb07a2584882bad910bf54ef1f54b35
Workflow ref: main
Requested jobs: issue-2478-crash-loop-recovery-e2e
Summary: 0 passed, 1 failed, 0 skipped

Job	Result
issue-2478-crash-loop-recovery-e2e	❌ failure

Failed jobs: issue-2478-crash-loop-recovery-e2e. Check run artifacts for logs.

[github-actions]

Vitest E2E Scenario Results — ❌ Some jobs failed

Run: 27235281178
Workflow ref: fix/2701-failing-e2e-guard-pr-a
Requested scenarios: (default — all supported)
Summary: 2 passed, 1 failed, 0 skipped

Job	Result
gateway-guard-recovery	❌ failure
generate-matrix	✅ success
live-scenarios	✅ success

Failed jobs: gateway-guard-recovery. Check run artifacts for logs.

[github-actions]

Vitest E2E Scenario Results — ❌ Some jobs failed

Run: 27236542721
Workflow ref: fix/2701-failing-e2e-guard-pr-a
Requested scenarios: (default — all supported)
Summary: 2 passed, 1 failed, 0 skipped

Job	Result
gateway-guard-recovery	❌ failure
generate-matrix	✅ success
live-scenarios	✅ success

Failed jobs: gateway-guard-recovery. Check run artifacts for logs.

[wscurran]

✨
Related open issues:

• #2701 [DGX Spark] Host reboot bricks sandbox until 5-min rebuild --yes: connect recovery path warns about missing /tmp guards but launches gateway naked → @homebridge/ciao crash loop
• #2478 [DGX Spark] Gateway crash loop on startup: @homebridge/ciao networkInterfaces() returns EPERM in OpenShell sandbox

[coderabbitai]

🧹 Nitpick comments (1)

.github/workflows/e2e-vitest-scenarios.yaml (1)

240-244: ⚡ Quick win

Consider explicit input validation as defense in depth.

Static analysis flagged potential template injection at lines 243-244 where inputs.pr_number and inputs.scenarios are expanded via ${{ toJSON(...) }}. While toJSON() should properly escape strings and inputs.scenarios is already validated via regex in the generate-matrix job (lines 54-57), adding explicit validation in this script provides defense in depth and makes the security posture more obvious to future maintainers.

🛡️ Optional: Add explicit validation

         with:
           script: |
             const needs = ${{ toJSON(needs) }};
             const runUrl = `${context.serverUrl}/${context.repo.owner}/${context.repo.repo}/actions/runs/${context.runId}`;
             const workflowBranch = context.ref.replace('refs/heads/', '');
             const prNumberInput = ${{ toJSON(inputs.pr_number) }} || '';
             const requestedScenarios = ${{ toJSON(inputs.scenarios) }} || '';
+            
+            // Validate inputs (defense in depth)
+            if (prNumberInput && !/^\d+$/.test(prNumberInput)) {
+              core.setFailed(`Invalid pr_number input: ${prNumberInput}`);
+              return;
+            }
+            if (requestedScenarios && !/^[A-Za-z0-9_-]+(,[A-Za-z0-9_-]+)*$/.test(requestedScenarios)) {
+              core.setFailed(`Invalid scenarios input: ${requestedScenarios}`);
+              return;
+            }

             let prNumber = prNumberInput ? Number.parseInt(prNumberInput, 10) : undefined;

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In @.github/workflows/e2e-vitest-scenarios.yaml around lines 240 - 244, The
template expands user inputs into prNumberInput and requestedScenarios without
runtime checks; add explicit validation/sanitization immediately after those
assignments: ensure prNumberInput contains only digits (or is empty) and
coerce/clear it otherwise, and ensure requestedScenarios matches the allowed
pattern (reuse the regex from generate-matrix or a conservative whitelist for
scenario names, splitting and validating each item) falling back to an empty
string or failing fast; update the block where prNumberInput and
requestedScenarios are defined to perform these checks and log or handle invalid
input accordingly.

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Nitpick comments:
In @.github/workflows/e2e-vitest-scenarios.yaml:
- Around line 240-244: The template expands user inputs into prNumberInput and
requestedScenarios without runtime checks; add explicit validation/sanitization
immediately after those assignments: ensure prNumberInput contains only digits
(or is empty) and coerce/clear it otherwise, and ensure requestedScenarios
matches the allowed pattern (reuse the regex from generate-matrix or a
conservative whitelist for scenario names, splitting and validating each item)
falling back to an empty string or failing fast; update the block where
prNumberInput and requestedScenarios are defined to perform these checks and log
or handle invalid input accordingly.

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Enterprise

Run ID: 103670ef-451b-45cf-a084-34a82f83eb20

📥 Commits

Reviewing files that changed from the base of the PR and between 2f1c2da and 9bcdab8.

📒 Files selected for processing (12)

• .github/workflows/e2e-vitest-scenarios.yaml
• src/commands/sandbox/agents/list.ts
• test/e2e-scenario/framework-tests/e2e-clients.test.ts
• test/e2e-scenario/framework-tests/e2e-phase-state-validation.test.ts
• test/e2e-scenario/framework-tests/e2e-recovery-helpers.test.ts
• test/e2e-scenario/framework/clients/gateway.ts
• test/e2e-scenario/framework/clients/sandbox.ts
• test/e2e-scenario/framework/e2e-test.ts
• test/e2e-scenario/live/gateway-guard-recovery.test.ts
• test/e2e-scenario/migration/legacy-inventory.json
• test/e2e/test-issue-2478-crash-loop-recovery.sh
• vitest.config.ts

[coderabbitai]

Actionable comments posted: 4

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In @.github/workflows/e2e-vitest-scenarios.yaml:
- Around line 243-259: prNumber currently uses Number.parseInt on prNumberInput
and silently falls back to finding the first open PR when parsing fails; change
the logic so a non-empty prNumberInput that is malformed causes the workflow to
fail instead of retrying: when prNumberInput is non-empty validate it with a
strict check (e.g., /^\d+$/ or compare parsed number to the trimmed input)
before assigning prNumber, and if validation fails call core.setFailed or throw
an error (do not call github.rest.pulls.list or use the workflowBranch
fallback); keep the existing branch-only lookup behavior only when prNumberInput
is empty.

In `@test/e2e-scenario/framework/clients/gateway.ts`:
- Around line 140-147: The probe options are built incorrectly: helper-specific
env from probeEnv() is overwritten by caller options because options is spread
after env; update the probe options construction in GatewayClient and
SandboxClient so non-env fields are spread first and env is merged explicitly
(env: { ...probeEnv(), ...options?.env }) before passing to this.sandbox.exec
(references: GatewayClient, SandboxClient, probeEnv, and the this.sandbox.exec
call building artifactName/gateway-guard-chain-...). Ensure you apply this same
merge pattern wherever helper probe options are assembled so OPENSHELL_GATEWAY
and other helper vars are preserved.
- Around line 221-223: The loop undercounts total wait time when durationSeconds
isn't a multiple of pollIntervalSeconds: change the sample calculation to use
Math.ceil instead of Math.floor (i.e., compute samples = Math.max(1,
Math.ceil(options.durationSeconds / pollIntervalSeconds))) so the for-loop that
calls sleepSeconds(pollIntervalSeconds) runs long enough to cover at least
durationSeconds; update any related comments/tests referencing samples if
present.
- Around line 241-255: tailLog currently ignores the sandbox.exec exit code so a
missing/unreadable GATEWAY_LOG_PATH yields an empty string and lets
expectLogDoesNotContain false-pass; update tailLog (the private async tailLog in
gateway.ts) to check the result from this.sandbox.exec (the call that runs
["sh","-c", `tail -n ${lines} ${GATEWAY_LOG_PATH} 2>/dev/null`]) and throw an
Error when result.exitCode is non-zero (include result.stderr or a descriptive
message) so callers like expectLogDoesNotContain fail when tail could not read
the file.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Enterprise

Run ID: 36971dbc-e347-4f83-80c9-e1b2d0ca1b34

📥 Commits

Reviewing files that changed from the base of the PR and between 9bcdab8 and 671aa71.

📒 Files selected for processing (11)

• .github/workflows/e2e-vitest-scenarios.yaml
• test/e2e-scenario/framework-tests/e2e-clients.test.ts
• test/e2e-scenario/framework-tests/e2e-phase-state-validation.test.ts
• test/e2e-scenario/framework-tests/e2e-recovery-helpers.test.ts
• test/e2e-scenario/framework/clients/gateway.ts
• test/e2e-scenario/framework/clients/sandbox.ts
• test/e2e-scenario/framework/e2e-test.ts
• test/e2e-scenario/live/gateway-guard-recovery.test.ts
• test/e2e-scenario/migration/legacy-inventory.json
• test/e2e/test-issue-2478-crash-loop-recovery.sh
• vitest.config.ts

🚧 Files skipped from review as they are similar to previous changes (7)

• test/e2e-scenario/live/gateway-guard-recovery.test.ts
• test/e2e-scenario/framework-tests/e2e-phase-state-validation.test.ts
• test/e2e-scenario/migration/legacy-inventory.json
• test/e2e/test-issue-2478-crash-loop-recovery.sh
• test/e2e-scenario/framework/e2e-test.ts
• test/e2e-scenario/framework-tests/e2e-recovery-helpers.test.ts
• test/e2e-scenario/framework-tests/e2e-clients.test.ts

[github-actions]

Vitest E2E Scenario Results — ❌ Some jobs failed

Run: 27244789650
Workflow ref: fix/2701-failing-e2e-guard-pr-a
Requested scenarios: (default — all supported)
Summary: 2 passed, 1 failed, 0 skipped

Job	Result
gateway-guard-recovery	❌ failure
generate-matrix	✅ success
live-scenarios	✅ success

Failed jobs: gateway-guard-recovery. Check run artifacts for logs.

[github-actions]

Selective E2E Results — ❌ Some jobs failed

Run: 27244790666
Target ref: 671aa71ac9cc53b92e3becb0d438703489e38a56
Workflow ref: main
Requested jobs: issue-2478-crash-loop-recovery-e2e
Summary: 0 passed, 1 failed, 0 skipped

Job	Result
issue-2478-crash-loop-recovery-e2e	❌ failure

Failed jobs: issue-2478-crash-loop-recovery-e2e. Check run artifacts for logs.

[cv]

Hybrid framing note

Since #5098 cites this PR as the HYBRID precedent, I want to make the intended meaning explicit.

“Hybrid” should be a migration/convergence state, not a permanent architecture with two E2E systems. The useful lesson from this PR is not “some E2Es live forever in bash and some in Vitest.” The useful lesson is:

• preserve the high-fidelity contract first;
• add the typed/Vitest harness without losing the real system boundary;
• keep existing bash coverage only while the Vitest representation is incomplete or while it is still proving equivalence.

If the contract requires shell behavior, the Vitest E2E can and should execute that real shell behavior: process signals, /proc reads, login shell state, bash install.sh, etc. The thing we should avoid preserving is a second bash test runner/harness.

So for follow-ups from this PR, the durable target should still be a Vitest E2E harness with boundary fixtures/helpers, not a long-term split suite. Related clarification is now on #4941, #5098, and #4999.