fix(test): isolate smoke harness daemon runtime

[astandrik]

What does this PR do?

Part of #1696 (audit ledger), follow-up to #1691/#1695.

scripts/smoke-test.sh starts every product process of a smoke run and retires
"the account daemon" through daemon stop from seven call sites. Its wrappers
sandbox HOME/XDG/TMPDIR and CBM_CACHE_DIR, but only CBM_RUNTIME_DIR moves the
daemon rendezvous (src/daemon/bootstrap.c:231-241, docs/CONFIGURATION.md), so
every retirement landed on the operator's live account daemon: stopped when no
committed client was attached, or FAIL ...: account daemon still active when one
was.

• scripts/smoke-test.sh sources scripts/test-runtime.sh, calls
  cbm_test_runtime_init after argument validation and runs
  cbm_test_runtime_cleanup "$BINARY" from the EXIT trap. The wrappers
  (smoke-local.sh, vm-smoke.sh) are unchanged: their CBM_CACHE_DIR is now
  overridden by the harness-owned root, and the smoke-fixture contract pins stay valid.
• tests/test_smoke_runtime_isolation_contract.sh: drives the harness with an
  environment-probe fixture under a caller CBM_RUNTIME_DIR/CBM_CACHE_DIR and
  requires that no product process receives them, that runtime and cache sit under
  one private root, and that the root is gone after exit. No daemon is started.
  Fails on main with FAIL: smoke-test exposed the caller CBM_RUNTIME_DIR to a product process; passes with this change. Wired as Step 0t2 in scripts/test.sh.

Not verified here: the Windows leg (vm-smoke.sh → protected-root helper path of
test-runtime.sh without CBM_CI_TEMP_ROOT) — CI only.

Checklist

• Every commit is signed off (git commit -s)
• Tests pass locally (make -f Makefile.cbm test) — shell-only change; the new
  contract plus test_smoke_fixture_contract, test_venue_parity_contract,
  test_runtime_isolation_contract and test_shell_line_endings were run; the
  full C suite was not run on this host
• Lint passes (make -f Makefile.cbm lint-ci) — no C changes;
  scripts/check-no-test-skips.sh run
• New behavior is covered by a test (reproduce-first for bug fixes)

[Copilot]

Warning

Copilot couldn't run its full agentic review because it didn't start before the timeout. Make sure your repository has a runner available, or add a copilot-code-review.yml file specifying one with the runs-on attribute. See the docs for more details.

Pull request overview

This PR fixes smoke-test harness isolation by ensuring the daemon rendezvous/runtime and cache are owned by the harness (not inherited from the caller), and adds a contract test to prevent regressions.

Changes:

• Add a new contract test that verifies scripts/smoke-test.sh does not leak caller CBM_RUNTIME_DIR/CBM_CACHE_DIR into product processes and cleans up the private root.
• Wire the new contract test into scripts/test.sh.
• Update scripts/smoke-test.sh to initialize a private runtime/cache via scripts/test-runtime.sh and clean it up on exit.

Reviewed changes

Copilot reviewed 3 out of 3 changed files in this pull request and generated 2 comments.

File	Description
tests/test_smoke_runtime_isolation_contract.sh	New contract test asserting smoke harness runtime/cache isolation and cleanup.
scripts/test.sh	Adds a new test step to run the smoke harness isolation contract.
scripts/smoke-test.sh	Initializes harness-owned runtime/cache and adds cleanup on EXIT.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[astandrik]

Handled as one lifecycle requirement in fa138acf: the runtime cleanup trap is armed right after cbm_test_runtime_init, and the fixture trap that replaces it runs cbm_test_runtime_cleanup before smoke_rmtree. Details in the PR comment.

[astandrik]

Handled as one lifecycle requirement in fa138acf: the runtime cleanup trap is armed right after cbm_test_runtime_init, and the fixture trap that replaces it runs cbm_test_runtime_cleanup before smoke_rmtree. Details in the PR comment.

[github-actions]

Thanks for opening this — it has been seen, and it is queued.

This note is automated, but it is not a brush-off: it exists so you know where your PR stands instead of having to guess from silence.

Current review status: working through a backlog. 0.9.1-rc.1 is out, so the release freeze that held reviews is over — but it left a large queue of open pull requests behind it, and we are reading through them oldest-first. The background is in discussion #1144.

What that means for this PR, concretely:

• It will not be closed for inactivity. No stale bot touches pull requests here.
• It may still sit a while before a human reads it. That is on us, not on you.
• Older PRs are read first, so a recent one is not being skipped — it is behind a queue.

Things that will genuinely speed it up whenever review does happen:

• Keep it rebased on main — the tree is moving quickly right now, and a conflicting branch cannot be reviewed as the diff you intended.
• Get CI green, or say which failures you believe are pre-existing.
• Keep the change to one claim. Bundled features and refactors get split before they get merged, which costs you a round trip.
• Every commit needs a sign-off (git commit -s) — CI enforces DCO.

If this fixes a bug, a reproduction we can run is worth more than a description of the symptom.

Thanks for contributing, and sorry in advance for the wait.

[DeusData]

Thank you for isolating the smoke-test runtime. One remaining cleanup concern is that initialization occurs before the EXIT trap is installed. Please install cleanup immediately after successful runtime initialization, and ensure an earlier cleanup failure cannot prevent private-runtime cleanup. The duplicate inline observations can be handled as this one lifecycle requirement.

[DeusData]

Two updates, and one of them should save you some time.

The test-unix (macos-14) red is ours, not yours. It failed on:

tests/test_watcher.c:2238: index_call_count == 0, expected 1

That is the same symptom we just saw on an unrelated PR (#2207) at test_watcher.c:2706 — the watcher's index callback intermittently never fires. Two different PRs, two different lines, one shape. Nothing in your diff touches the watcher, so please do not spend time on it. It is logged on our side, and I am treating a required check that passes on rerun as a defect of ours to attribute rather than something to retry past.

#2196 and #2197 merged today (6cd19006, 5aeebbac), so scripts/test.sh has moved. A rebase will also give this PR a current CI verdict — the run it is carrying is from 2026-09-13 and main has moved a long way since.

The open review item remains the one from 2026-09-19: install cleanup immediately after successful runtime initialization, and make sure an earlier cleanup failure cannot prevent private-runtime cleanup. That ordering concern is the real review point and it is worth getting right — the same trap exists in the sibling harnesses, and #2196 handles it by leaning on cbm_test_runtime_cleanup's idempotence so an early trap and a later explicit call can both fire harmlessly.

Thank you for this series. The soak and memlab halves landing today fixed a root cause that had been reddening other people's pull requests for weeks.

[astandrik]

Rebased onto main (def38f3e) and addressed the lifecycle point in a separate commit (fa138acf), so the delta is easy to see:

• trap 'cbm_test_runtime_cleanup "$BINARY"' EXIT is now armed immediately after cbm_test_runtime_init, the same shape as soak-test.sh and memlab.sh. The only statements between init and the fixture trap are the fixture mktemp and its cygpath conversion; a set -e exit there now takes the private root with it.
• The fixture trap that replaces it runs cbm_test_runtime_cleanup first and smoke_rmtree second, so no earlier cleanup step stands between the exit and the private daemon's retirement. smoke_rmtree never returns non-zero, so it could not short-circuit before either, but the order now says so structurally, and on Windows retiring the daemon first is also what unblocks the fixture rm. BINARY is bound at line 38 via ${1:?} and never reassigned, so the trap cannot trip set -u.
• The contract test pins the early trap to the window between the init call and the first fixture; the pin fails against the previous head.

Locally on macOS: the four runtime-isolation contracts, test_smoke_fixture_contract, test_venue_parity_contract, test_shell_line_endings, check-no-test-skips.sh and check-dco.sh are green. CI on fa138acf is green across the board, including test-unix (macos-14) this time and the Windows smoke leg I could not run here. Thanks for the note on the watcher failure; I did not touch it.