internal/session: two tests fail only while other suites run beside them — a 40 ms wall-clock audit window, and a write under the home after Close

[AbirAbbas]

What happened

Two internal/session tests fail only while other test suites run beside them on the same machine. Each passes when run alone. CLAUDE.md treats a failure like this as a bug report rather than a flake to rerun, so here it is. Both were seen during make pr-ready BASE=origin/dev runs for #1410 (santos/dev2) on 2026-09-24, and neither test file is touched by that branch. retiredpin_wire_test.go came to dev with #1108, and task_settle_test.go was last changed on dev in #949.

1. TestAStalledCheckerIsNamedAsAStallEvenWhenItSpentTheWindow (task_settle_test.go):

=== RUN   TestAStalledCheckerIsNamedAsAStallEvenWhenItSpentTheWindow
    task_settle_test.go:315: the report does not say what actually happened to the calls:
        the check ran out of time before a call could be made — it had 40ms
        Wrote greet.go with the greeting.
--- FAIL: TestAStalledCheckerIsNamedAsAStallEvenWhenItSpentTheWindow (0.75s)

The test sets config.auditWindow = 40 * time.Millisecond, a real wall-clock window, and scripts a checker that never answers on either of its two attempts. It expects the report to say the calls were abandoned. On a loaded box the 40 ms ran out before the first checker call was placed, so the report took the other true branch, "ran out of time before a call could be made". The assertion depends on the scheduler, not the code.

2. TestAnErrandBesideTheTurnDoesNotCarryTheTalkPin (retiredpin_wire_test.go):

=== RUN   TestAnErrandBesideTheTurnDoesNotCarryTheTalkPin
    testing.go:1464: TempDir RemoveAll cleanup: unlinkat /tmp/TestAnErrandBesideTheTurnDoesNotCarryTheTalkPin1419077516/001/v3: directory not empty
--- FAIL: TestAnErrandBesideTheTurnDoesNotCarryTheTalkPin (0.01s)

001 is the test's home.EnvVar directory. Something still writes under <home>/v3 after the test's agent.Close() cleanup has returned. The write races t.TempDir's RemoveAll, and it lands inside the removal only when the box is slow. The likely writer is the errand the test name refers to (a side call made beside the turn), or its journal, still running after Close. This is the same late-write-after-close class as #1198 and the cmd/codeaf hosted-welcome test (#1492). #1441 lists other load-only reds on the same branch; these two are not on it.

Replication

Deterministic (no model). Neither needs a key. Load the box, then loop the one test:

# load: one busy loop per core, stopped afterwards with `kill %1 %2 ...` or `pkill -x yes`
for i in $(seq "$(nproc)"); do yes >/dev/null & done
GOMAXPROCS=2 go test -count=200 -run '^TestAStalledCheckerIsNamedAsAStallEvenWhenItSpentTheWindow$' ./internal/session/
GOMAXPROCS=2 go test -count=200 -run '^TestAnErrandBesideTheTurnDoesNotCarryTheTalkPin$' ./internal/session/

Without the load the same loops pass: 20 of 20 and 50 of 50 on both santos/dev2 and its base. The only sightings so far are one failure of each inside a whole make pr-ready (the light gate plus every package the branch touches, internal/session among them, run beside internal/tui3). How often the loaded loop above fails has not been measured yet; the first job of whoever takes this is to get it failing on demand.

Field. Not needed. No model is involved.

Where

• internal/session/task_settle_test.go, TestAStalledCheckerIsNamedAsAStallEvenWhenItSpentTheWindow. Search for config.auditWindow = 40 * time.Millisecond. The two report sentences are checkerWindowClosed / "without answering and was abandoned" and "ran out of time before a call could be made".
• internal/session/retiredpin_wire_test.go, TestAnErrandBesideTheTurnDoesNotCarryTheTalkPin, together with whatever Agent.Close leaves running that writes under <CODEAF_HOME>/v3.

The fix

1. The audit window in that test runs on the test's own clock, or the checker's first call is proven placed before the window is allowed to close, so the test asserts the stall sentence and never the scheduler.
2. Agent.Close waits for everything it started that writes under the home, errands included, before it returns. This follows the close law session: join the usage writer at Close so no usage row is written after a process quits #1259 and catalog: the lazy warm is owned, cancelled and joined at close, so it cannot write under a later home #1274 set for the process. After Close returns, nothing writes under the home. The test must not be changed to skip the cleanup.

Acceptance

• Unit (under load): both -count=200 loops above are green with one busy loop per core running, three times in a row.
• Unit (law): a probe that walks <home> for files modified after agent.Close() returned, after a 2-second wait, finds none for the talk-pin test's agent.
• touched packages on the next promotion stays green without a rerun.