feat: engine registry, jev calibration, codex late close fix (0.0.59)

[okisdev]

summary

• engine identity ({codex, grok}: ids, display names, rescue and managed agent types, companion file and environment names, data directory names, the contract's terminal status set) moves into one registry, plugins/fusion/scripts/lib/engines.mjs. the same facts were derived again across the fusion scripts and had started to drift: the grok data directory was resolved in two places, the terminal status set was copied five times with different members, the peer agent type sets lived in four files, and fusion-stats.mjs alone carried three engine registries

• twelve fusion scripts now read the registry (worker-lifecycle, worker-state, fusion-stats, job-collect, engine-acceptance, engine-job-state, codex-state-roots, breaker-check, both job monitors, inline-delegation-guard, brief-sensor). every message, regex match set, export and signature is unchanged for the two current engines. engine specific behavior stays put on purpose: the codex only capability branches in fusion-stats, the breaker's failure patterns and legacy status tolerance, the codex ledger versus grok collector acceptance asymmetry, strict versus lenient companion overrides

• tests/engines.test.mjs pins the registry and guards it: a fusion script that repeats an engine identity literal fails the suite, and hooks.json (static JSON, so it stays literal) may only wire peer agents the registry knows

• the jev threshold gets a repeatable calibration, bench/jev/calibrate.mjs with twelve labeled briefs: exit 1 on a missed flaw, a false positive or a call without an answer, --model <id> to score a candidate before the pin moves (so askJev takes { env, model }), and an opt in --retained replay that is scoped to the checkout holding the script, never the caller's directory

• reviewable logic is lib/engines.mjs, the twelve consumer diffs and bench/jev/calibrate.mjs; the rest is tests, the verification manifest (now maps the registry to its consumer suites and covers five scripts that had no entry), docs and the 0.0.59 release

• codex: a cancelled or timed out run whose process tree is verifiably gone is no longer recorded as cleanup-required because the child's close event arrived late. the exec layer waited only 50ms for that event after verified termination; on a starved machine it lands later, which left finished jobs running and is what kept test (macos-latest, 22) red on a rotating set of process cases (flaky: codex companion process tests fail on the macos-latest node 22 job under load #64, also red on main's own push runs). the window is 2000ms now, armed only while close is pending and cleared when it arrives; the timeout path budget becomes 591075ms, still under the 600000ms Bash cap. four test races of the same family are fixed beside it (two 50ms timeouts that raced the fake CLI's startup, a 2000ms cap on a whole companion run, 100ms gaps used to order two pipes, and the fake's pipe holder sized against the old window)

• both job monitors install their signal and EPIPE handlers before the first scan. the first scan writes the announced state file, which tests and callers treat as ready, so a SIGTERM landing between that write and the handler install killed the monitor by signal (exits 0 on SIGTERM returned null on the ubuntu node 24 job for this PR's second head)

breaking changes

• internal only: askJev(state, questions, env) becomes askJev(state, questions, { env, model }). every caller in the repository is updated; nothing outside the plugin imports it

test plan

already verified

• npm test on the committed tree -> 1200 tests, 1199 pass, 0 fail, 1 skipped (the existing skip)

• the literal guard bites: appending new Set(["codex", "grok"]) to fleet-posture.mjs fails tests/engines.test.mjs with the file and literal named, and reverting restores green

• the scope test bites: removing the cwd pin from calibrate.mjs fails 4 of the 11 calibration tests

• node bench/jev/calibrate.mjs --retained against the real API -> 12 of 12 fixtures hold, 29 retained briefs scored, 0 unanswered, 1 flagged (a deliberately flawed probe); the same command run from outside the repository reports the same 29; --model jev-0.0.0 exits 1; no key exits 2

• two intended semantic changes checked by the suites: fusion-stats resolves the grok data directory through the shared resolver (also honors HOME from the passed environment), and grok companion lookup gains the codex tie break on equal mtimes

• late close fix, measured under a self limiting CPU saturation (two busy loops per core): before, the reproduction failed 9 of 10 runs with phase: cleanup-required or rollout: not_attempted; after, 10 of 10 pass and the six affected cases pass three rounds in a row. widening only the window, with nothing else changed, turned 4 of 5 failures into 8 of 8 passes, which isolates the cause

• npm test after the fix, with the machine still at a load average near 49 -> 1200 tests, 1199 pass, 0 fail, 1 skipped

• monitor startup order: node --test tests/jobs-monitor.test.mjs tests/codex-jobs-monitor.test.mjs -> 79/79, full npm test -> 1200 tests, 1199 pass, 0 fail, 1 skipped. the race did not reproduce locally in 25 loaded rounds; the fix rests on ordering (the ready signal is now written strictly after the handlers exist), not on a measured rate

reviewer should verify

• after the cache refresh and a session restart, run /fusion:smoke and settle it with /fusion:stats --record; expect the same three PASS gates and the same "Recorded accepted for Codex job" and "for Grok job" lines as on 0.0.58
• dispatch a collector request with a malformed engine line; expect the unchanged deny text "exactly one engine: codex|grok line"

notes

• flaky: codex companion process tests fail on the macos-latest node 22 job under load #64 stays open until the macos-latest node 22 job has been green across ten consecutive main runs
• one unrelated failure showed up once under load during this work: tests/grok-state-lock.test.mjs "concurrent reapers serialize after a lock owner is killed". it imports no fusion code, passes 10 of 10 on an untouched main and 15 of 15 on this tree when idle; tracked in flaky: grok-state-lock 'concurrent reapers serialize after a lock owner is killed' fails under load #62
• live only after marketplace cache refresh plus a session restart