Helper-lifecycle test hygiene: PID sentinels, process.ppid, an unexercised selector branch, and a shipped test hook

[possibilities]

Follow-up from CodeRabbit review of #665. All of it is #664 surface, so it is filed rather than folded into a PR whose scope is one behavior change.

1. Dead-helper fixtures rely on PIDs above the platform ceiling

test/app-bind.test.ts:1143-1144 (and :1187) use 2_147_483_646/-645/-644; test/codex-manager-rotation-command.test.ts:484-494 uses 99999999; test/runtime-current-account.test.ts:573-598 uses 99999998/99999999. These exceed pid_max on Linux and PID_MAX on macOS, so process.kill(pid, 0) may raise EINVAL rather than ESRCH.

Worth noting what saves it today: every liveness check in the tree returns true only for EPERM and treats every other errno as dead (lib/runtime/app-bind.ts:417-427, lib/runtime/runtime-current-account.ts:114-124, lib/codex-manager/commands/rotation.ts:593-603, test/codex-bin-wrapper.test.ts:722-729), so EINVAL classifies as dead either way. The fixtures are correct by a property they never state. Owning a child and killing it — as reaps a stranded helper whose owner PID is genuinely dead in #665 does — makes "dead" a fact instead.

2. process.ppid makes the "+1 more running" count environment-dependent

test/codex-manager-rotation-command.test.ts:503 depends on the vitest worker's parent staying alive. That parent is the pool process, which the test does not control; reparenting differs across threads, forks, and --no-file-parallelism, and a parent exiting mid-run flips the assertion to (+0 more running). A sleeper the test owns and kills in finally makes the second live PID deterministic.

3. readAppRuntimeHelperStatus never exercises its recency sort

lib/runtime/runtime-current-account.ts:168-188 sorts live candidates by recency before returning the first, but test/runtime-current-account.test.ts:571 supplies exactly one live candidate, so live.sort(byRecency) is dead weight in the test. The equivalent case exists for the rotation command (test/codex-manager-rotation-command.test.ts:449), but that is a different selector, and this one drives runtime account resolution.

4. A metadata-cleanup fault injector ships in the published wrapper

scripts/codex.js:4088 reads its environment variable unconditionally and package.json publishes the file. The default is 0, but Number.parseInt also accepts "2abc" and "1e3". Either remove the hook from shipped code or put it behind an explicit test-only gate, with a regression case asserting production invocations ignore it.

5. Minor: re-encoded owner-path literal in tests

test/app-bind.test.ts:1199 hand-builds runtime-rotation-app-helper-owner.<pid>.json although resolveRuntimeHelperOwnerPath already exists at test/app-bind.test.ts:95-108.

Credit: CodeRabbit, on #665.

[coderabbitai]

🔗 Related PRs

#648 - fix(codex): route resume/fork through the canonical home and bound helper shutdown (#647) [closed]
#658 - fix: resolve issues #652–#656 [merged]
#662 - fix(codex): route app-server through the canonical home (#659) [closed]
#664 - fix(codex): stop runtime helpers from leaking past their idle timeout (#663) [open]
#665 - fix(codex): reap app helpers stranded by the detach grace [open]

---

📝 Issue Planner

_{Check the box below or use the @coderabbitai plan command to generate an implementation plan and prompts that you can use with your favorite coding assistant.}

• Create Plan

---

🧪 Issue enrichment is currently in open beta.

To disable automatic issue enrichment, add the following to your .coderabbit.yaml:

issue_enrichment:
  auto_enrich:
    enabled: false

💬 Have feedback or questions? Drop into our discord!

[ndycode]

Fixed by #669, merged to main in 0e66b1f.

Left open by a syntax slip in the PR body: Closes #666, #667, #668 only registers the keyword against the first number, so #666 closed automatically and this one did not. Closing by hand.

• "Which helper is current" is implemented twice, and neither copy checks process identity #667 — both hand-rolled selectors replaced by selectRuntimeHelperStatus in lib/runtime/app-helper-selection.ts; printRotationStatus now selects once and threads one now through the status line, the live count and the account marker. Liveness is identity-checked via record freshness, and PIDs are validated as positive integers.
• Helper-lifecycle test hygiene: PID sentinels, process.ppid, an unexercised selector branch, and a shipped test hook #668 — PID sentinels and process.ppid replaced with processes the tests own; the recency sort exercised with two live candidates; all seven fault injectors in the published wrapper gated behind an explicit opt-in with a strict digits-only parse; the owner-path literal reuses resolveRuntimeHelperOwnerPath.

Covered by regression tests plus a stress suite at the scale of the original report, mutation-checked.