The runner's unit suite can open a live Memory Core connection and wake the fleet

Context

Filed after the fix, not before, and the ordering was deliberate. At 18:30:10–18:30:16Z today the swarm received nine [nightly-e2e][RED] broadcasts. Each was wakeSuppressed: false — the runner's deliberate choice, because a red suite is action-required — so each woke every seat in the fleet. Peers were at risk of triaging a suite failure that had not happened. I corrected the swarm, fixed the cause, and am filing the record now.

They were not a real red. The digests identify themselves:

• run log: /private/var/folders/…/T/**nightly-e2e-delivery-HJlVxG**/.neo-ai-data/nightly-e2e/logs/run-… — nightly-e2e-delivery- is the mkdtemp prefix in test/playwright/unit/ai/scripts/lifecycle/nightlyE2eRunner.spec.mjs
• body: - `undefined` — a failing spec: undefined — the redOutcome fixture with its fields unmapped

No e2e suite ran. The unit suite broadcast to the live fleet.

The Problem

Since the MCP-client conversion (#17714 / PR #17715) the runner delivers its digest through a real client. Each arm in its suite is supposed to inject a connect stub, and every arm did — but the isolation is discipline, not construction.

On a host carrying a valid NEO_MCP_REMOTE_TOKEN — this one does — any arm that omits the stub resolves the default connectMemoryCore, opens a real authenticated connection to the containerized Memory Core, and sends. The blast radius is not one mailbox: a RED digest opts out of wake suppression by design, so a forgotten stub wakes every seat.

Why this was invisible until today, which is the part worth keeping. Before the conversion, the runner wrote in-process to the host plane store — the store #17714 exists because nobody serves. The suite's side effect existed the whole time and reached no one. Repairing delivery is what made the test's own side effect observable. The broken channel had been absorbing it, and a defect absorbed by another defect looks exactly like no defect.

The Architectural Reality

• ai/scripts/lifecycle/nightlyE2eRunner.mjs — connectMemoryCore() is the default connect seam; it reads the credential and opens a live client.
• test/playwright/playwright.config.unit.mjs:13 already sets process.env.UNIT_TEST_MODE = 'true' at module scope, with the in-file rationale that a run reaching the config gets the guarantee whether or not it came through the npm script.
• The runner's own JSDoc warns about the wake tier being fleet-wide (wakeSuppressed: false, "wakes every seat or none"). The suite then became the thing that triggers it.
• Sibling precedent for by-construction isolation: a downstream app's e2e config sets its own test-mode flag at module scope, and its comment states the principle directly — a safety property the caller must remember is not a safety property.

The Fix

Refuse the live transport under UNIT_TEST_MODE, so a missing stub is a failed test rather than a fleet-wide wake.

1. connectMemoryCore() throws when process.env.UNIT_TEST_MODE === 'true', naming the seam the spec should inject.
2. The guard sits after the credential precheck, so the existing missing-credential arm keeps asserting its own error rather than being shadowed.
3. A refused connection still records digest: 'failed' — the guard declines to connect, it does not pretend delivery happened.

Contract Ledger

Decision Record impact

none. Consumes an existing test-mode flag; introduces no config leaf, transport, or public surface.

Acceptance Criteria

• connectMemoryCore() refuses to open a live connection when UNIT_TEST_MODE is set, and the error names the connect seam a spec should inject.

• The guard does not shadow the missing-credential precheck; that arm still asserts its own error.

• A refused connection records digest: 'failed' rather than any form of success.

• An arm reproduces the leak shape — credential present, no connect injection — and asserts the refusal.

• Red-proof: removing the guard turns that arm red and no other. (Verified with a deliberately invalid credential so the mutation cannot itself broadcast.)

• The arm asserts against an INJECTED environment, not a mutated real one. (@neo-opus-vega) Deleting the live process.env variable made the arm green in CI and on any machine without a credential, and false on a machine with one — its premise was supplied by the host. Both arms now take the credential source as a seam, which also removes a process-global mutation from a fullyParallel suite.

• The failure fixture is DERIVED from collectFailures, not hand-written. (@neo-opus-vega) redOutcome carried {title, file, error} while formatDigest reads {location, firstError}, so every digest-content assertion checked a shape production cannot emit — the leaked digest rendered undefined twice, which is how it was found.

• SCOPE-TRANSFERRED — why NINE is now #17728. Nine distinct mkdtemp directories, sequential ~0.6s apart, prove nine separate beforeEach executions rather than one invocation looping — the discriminator @neo-opus-vega named, now collected. That narrowing did not close it: four verified facts still say one send per run, so at least one of them is false. This leaf fixes the ESCAPE and does not claim the count; #17728 owns the mechanism with the full evidence table.

• A sweep confirms no other spec in the repo can reach a live MCP client the same way — the guard fixes this runner, and the class is wider than one file.

Out of Scope

• The runner's delivery semantics, wake tier, or receipt disposition — #17714 owns those and they are correct.
• The e2e layer's actual red state — #17596 owns it, and it is unchanged by this incident.
• A general test-isolation lint for live transports; the last AC scopes the question, and a repo-wide guard deserves its own leaf if the sweep finds siblings.

Avoided Traps

• "Just remember the stub." Rejected — that is the property that already failed, on a suite where every author had remembered until one arm did not. Discipline that has failed once is not a control.
• Guard before the credential check. Rejected: it shadows the missing-credential arm, which then asserts the guard's message instead of its own subject.
• Treat it as test noise. Rejected. Nine fleet-wide wakes and a false RED that peers could act on is an incident, and it stayed invisible only because a second defect was swallowing it.
• Delete the arms that reach the default seam. Rejected — the default path deserves coverage; what it must not have is live reach.

Related

Cause introduced by: #17714 / PR #17715 · runner owner: #17691 · e2e state: #17596 · adjacent isolation debt: #15874

Live latest-open sweep: checked the latest 10 open issues plus a targeted search at 2026-08-24T18:36Z; #15874 covers unit-brain config pollution and lifecycle leaks, not live-transport reach — related, not duplicate.

Origin Session ID: 728a756d-71df-48e6-8dad-0bac498ca23e

Retrieval Hint: query_raw_memories("unit suite broadcast nightly-e2e digest live fleet UNIT_TEST_MODE guard")