test(runtime-host): assert owned Host exit against the kernel's shutdown contract

Both owned-lifecycle tests asserted that a Host process had exited against a
5 s wall clock, which is shorter than the exit the kernel guarantees, and one
of them started that clock from an event the Host does not control.

`an authority-supervised Candidate exits if its launch owner is killed` waited
on `connected.connection.closed` and then gave the process 5 s. That promise is
the Client's own transport, and the Client aborts the transport when a liveness
probe goes unanswered for two seconds, so a Host that is merely busy resolves it
while still running and the exit budget starts at an unrelated moment. The Host
also cannot exit as early as the bound assumed: the owner-loss close is armed by
`launchOwnerGuard.bind(...)` only after `startExecutionRuntimeHostCandidate`
resolves, so composition startup and recovery must finish first, and the
shutdown that follows is bounded by `shutdownGraceMs` (10 s). Wait for the
process instead, with a 20 s bound that sits above that grace and below the
launcher fixture's idle grace, and keep the connection-closed assertion after
the exit, where it is a consequence rather than a gate.

The fixture's idle grace moves from 10 s to 60 s so a Candidate that exits
because it went idle can never satisfy an owner-loss bound, with an explicit
10 s first-connection deadline so a Candidate no Client reaches still exits.

`owned Host exits promptly after its first connection closes` allowed the whole
shutdown 5 s against a kernel that allows itself 10 s, and conflated the two
claims in its name. The promptness claim is the owned launch's idleGraceMs of 0
against a 30 s default, which the draining registration the kernel publishes as
its first shutdown step reports directly; the exit is a second claim, now
bounded by the kernel's grace.

Refs #4776

Generated-by: Claude Code

Author: UncertaintyDeterminesYou4ndMe

packages/runtime-host/src/__tests__/fixtures/owned-authority-launcher.ts

@@ -32,7 +32,13 @@ const attempt = await launchOwnedRuntimeHostCandidate({
   rootPath,
   expectedRootId,
   entrypoint: new URL('../../execution-candidate-main.js', import.meta.url),
-  idleGraceMs: 10_000,
+  // The idle grace only has to outlast the test, and it has to stay clear of
+  // any bound a test puts on an owner-loss exit: a Candidate that exits
+  // because it went idle must never be mistaken for one that exited because
+  // its launch owner died. The first-connection deadline stays short so a
+  // Candidate no Client ever reaches still exits on its own.
+  idleGraceMs: 60_000,
+  initialConnectionTimeoutMs: 10_000,
   inheritableAuthorityLeaseFd: leaseFd,
   launchOwnerClientInstanceId: clientInstanceId,
 }).spawned;

packages/runtime-host/src/__tests__/host-kernel.test.ts

@@ -1916,12 +1916,26 @@ describe('non-serving Runtime Host kernel', () => {
 
       launcher.kill('SIGKILL');
       await waitForExit(launcher);
+      // The process is the only thing that reports the claim. A Client's
+      // `connection.closed` does not: it is that Client's own transport, and
+      // the Client aborts it after its liveness probe goes unanswered for two
+      // seconds. A Host that is merely busy therefore resolves it while still
+      // running, and gating the exit assertion on it starts the exit budget at
+      // a moment that has nothing to do with the Host's shutdown.
+      //
+      // The bound comes from the kernel's contract rather than from an
+      // interval this test could predict. Owner loss cannot close a
+      // composition before its startup settles, and the shutdown that follows
+      // is bounded by `shutdownGraceMs` (10 s), after which the kernel
+      // force-terminates. Twenty seconds therefore sits above every
+      // legitimate exit and below the launcher's 60 s idle grace, so it cannot
+      // be satisfied by a Candidate that merely went idle.
+      await waitForProcessExit(launchedPid, 20_000);
       await withTimeout(
         connected.connection.closed,
         5_000,
-        'authority-supervised Candidate survived its launch owner',
+        'authority-supervised Candidate exited without closing its Client connection',
       );
-      await waitForProcessExit(launchedPid);
       paths.resources.forgetPid(launchedPid);
     });
   });

packages/runtime-host/src/__tests__/owned-candidate.test.ts

@@ -23,6 +23,11 @@ import { mkdtemp, readdir, rm } from 'node:fs/promises';
 import { tmpdir } from 'node:os';
 import { join } from 'node:path';
 import test from 'node:test';
+import {
+  resolveExistingStorageRoot,
+  resolveExistingStorageRootControlDirectory,
+} from '@maka/storage/root-authority';
+import { readHostRegistration } from '../control/registration.js';
 import {
   INTERACTIVE_RUNTIME_HOST_COMPOSITION_ID,
   RUNTIME_HOST_PROTOCOL_VERSION,
@@ -257,12 +262,20 @@ test('owned Host exits promptly after its first connection closes', async () =>
 
   assert.equal(result.kind, 'connected', connectFailure(result));
   if (result.kind !== 'connected') return;
+  const controlDirectory = await resolveHostControlDirectory(rootPath, result.connection.rootId);
   await result.connection.close();
-  // Prompt means the owned launch's idleGraceMs of 0, as opposed to the 30 s
-  // default grace, so the bound only has to sit well below that. Shutdown takes
-  // about 30 ms on an idle machine and stretches past 500 ms under a full CI
-  // suite while still exiting cleanly: the Host is starved, not stuck.
-  assert.equal(await result.host.settle(5_000), true);
+  // Promptness is when the Host starts shutting down, not how long shutting
+  // down takes: the owned launch's idleGraceMs is 0 against a 30 s default.
+  // The kernel publishes its draining registration as the first step of
+  // shutdown, so the registration reports the idle grace directly. Reading it
+  // from `settle` alone could not separate the two, which is why a loaded
+  // machine that only made the shutdown itself slow failed this assertion.
+  await waitForHostShutdownStart(controlDirectory, 10_000);
+  // The exit is a second claim with a bound of its own, and the kernel sets
+  // it: shutdown gets `shutdownGraceMs` (10 s) to close every resource before
+  // the kernel force-terminates the process. Anything below that fails a Host
+  // that is starved rather than stuck.
+  assert.equal(await result.host.settle(15_000), true);
 });
 
 test('an exited owned Candidate permits one real successor in the same election', {
@@ -436,6 +449,35 @@ test('pre-cancelled hosted execution does not start a Runtime Host', async () =>
   assert.deepEqual(await readdir(rootPath), []);
 });
 
+async function resolveHostControlDirectory(rootPath: string, rootId: string): Promise<string> {
+  const capability = await resolveExistingStorageRoot({
+    path: rootPath,
+    kind: 'interactive',
+    expectedRootId: rootId,
+  });
+  const { controlDirectory } = await resolveExistingStorageRootControlDirectory(capability);
+  return controlDirectory;
+}
+
+/**
+ * Resolves once the Host has begun shutting down. `draining` is the state the
+ * kernel publishes before it does any shutdown work, and the registration is
+ * removed near the end of that work, so either observation proves shutdown
+ * started; the Host was serving this Client, so its registration existed.
+ */
+async function waitForHostShutdownStart(
+  controlDirectory: string,
+  timeoutMs: number,
+): Promise<void> {
+  const deadline = Date.now() + timeoutMs;
+  while (Date.now() < deadline) {
+    const registration = await readHostRegistration(controlDirectory).catch(() => undefined);
+    if (!registration || registration.state === 'draining') return;
+    await new Promise((resolve) => setTimeout(resolve, 10));
+  }
+  throw new Error('owned Host did not begin shutting down after its first connection closed');
+}
+
 function connectFailure(
   result:
     | Awaited<ReturnType<typeof connectOwnedRuntimeHostWithDependencies>>