[pranems]

Summary

Current integration checkpoint, 29 October 2026: normal merge
aa7865164f8b5af8831c526b98cc08eaffc7be83 preserves fixture head 9d6d5c62
and merged security master 80460d59 as its two parents. Product is 0.55.61.
Both CI-owned locks, manifests and dependency-pin tests are byte-identical
to merged master. This PR adds no runtime/dependency changes above master.
Keep this PR draft; no merge or deployment is requested.

The dated pre-integration measurements below remain historical evidence,
not the current dependency or image status. RFC prerequisites now also exist
in master, so neither RFC file remains in this PR's diff.

Correct four proven logging-test timer leaks without changing application
timers, lifecycle, timeouts, worker counts, force-exit settings or versions.

• Two SSE fixtures never disconnected. Invoke their registered close callback,
  assert response completion, and require zero timers after each stream case.
• Two prune startup fixtures used a runtime setter before initialization.
  Configure startup before construction, restore environment exactly, and
  require zero timers after service shutdown.
• Include only the exact same-day live-verified RFC manifest/README prerequisite
  from preserved commit 6716b3bb, proved byte-identical and offline GREEN.
  No diagnostic/performance source or baseline is imported.
• Independent branch from verified master 5bfff2de. PR ci: qualify membership performance on isolated Linux runners #251 remains separate,
  draft and held; no merge or deployment is requested by this checkpoint.

Linked Defect / Plan Reference

• DELIVERY_PLAN.md defect ID: N/A: existing test-lifecycle follow-up, not a new product feature.
• Audit doc reference: docs/SCIM_CORRECTNESS_EXECUTION_ISSUES_AND_RCA.md RC-I107, RC-I108 and RC-I109.
• ADR (if applicable): N/A: no application architecture change.

TDD Process

• RED test written first; observed it fail for the expected reason
• GREEN: minimal implementation that turns the test green
• Refactor (if any) keeps the test green
• Permanent regression guard added (where applicable - see existing patterns in api/src/security/)

Both zero-timer guards failed in exactly their two defective fixture cases
with expected zero / actual one. The complete serial unit diagnostic now
exits naturally after 6,214 passes, instead of retaining the two prune handles.

Feature / Bug-Fix Commit Checklist (standing rule)

Every behavioral change must include all that apply. Tick or strike through with N/A + reason.

• Unit Tests - service-level and controller-level coverage of the new behavior
• E2E Tests - end-to-end spec under api/test/e2e/ exercising the feature through HTTP N/A: no HTTP behavior changed. Existing 62 focused and 2,570 complete serial HTTP tests were executed.
• Live Integration Tests - new section in scripts/live-test.ps1 runnable against local + Docker + Azure N/A: test-fixture-only change; no live estate was mutated.
• Feature Documentation - dedicated doc in docs/ with architecture, RFC references, Mermaid diagrams, test coverage. Existing RCA ledger updated; no new feature or diagram.
• INDEX.md Update - add the new doc reference to docs/INDEX.md N/A: no new feature document.
• CHANGELOG.md Update - [Unreleased] entry with full test counts and feature summary
• Session & Context Updates - Session_starter.md and docs/CONTEXT_INSTRUCTIONS.md
• Version Management - bump api/package.json (and any other version refs) when behavior changed N/A: test/docs-only integration; product 0.55.61 is inherited unchanged from merged security master.
• Response Contract Tests - API responses contain ONLY documented fields (key allowlist assertion at unit + E2E + live) N/A: no response contract change; existing HTTP assertions were run unchanged.

Validation Output

Current integration aa786516:

Exact command	Observed result
pwsh -NoProfile -File scripts\sync-rfcs.ps1 -Quiet	PASS, valid verified prerequisite retained without restamp
pwsh -NoProfile -File scripts\audit-doc-freshness.ps1 -BaseRef origin/fix/log-stream-test-teardown-20261028 -Quiet	PASS, 27 docs
node scripts\audit-doc-content.mjs	PASS, 27 docs
npm test -- --runInBand --detectOpenHandles --runTestsByPath src/modules/logging/log-config.controller.spec.ts src/modules/scim/controllers/endpoint-log.controller.spec.ts src/modules/logging/logging-auto-prune.spec.ts	PASS, 99 tests / 3 suites, natural exit, 19.075s
npm test -- --runInBand --runTestsByPath src/scripts/check-dependency-pins.spec.ts	PASS, 29 tests / 1 suite, 0.838s
npm ls body-parser multer iconv-lite --all --json	PASS, actual inventory exit 0
$env:PREPUSH_MODE='Validate'; git push origin fix/log-stream-test-teardown-20261028	First attempt BLOCKED at Prisma generation: missing DATABASE_URL. All 25 preceding gates passed; complete failed receipt retained
Same normal protected Validate push with the existing checked-in CI DATABASE_URL placeholder	PASS, 28/28 gates in 921.9s; published aa78651. Units 6,220 / 213 suites, HTTP 2,514 / 118 suites plus 42 skips, web 1,655 / 124 files

No manually repeated broad suite preceded the hook. The retry changed only
the required process environment, copied from build-test.yml; no gate,
deadline, worker count, exclusion or fallback was changed. The separate
ordinary HTTP worker warning remains unresolved and is not kill-success proof.
The first hosted-review request with plain copilot was rejected; the
documented @copilot selector succeeded and started exact-tip hosted review.
Final new-tip hosted outcomes are all PASS:

• PR Build Test Image 40891100479:
  validate, immutable-image smoke and unchanged HIGH/CRITICAL Trivy gate PASS.
  PR test-merge revision aceb41776351165511b05f543407848a5b87f3e1 has the
  same tree b79cd4037e6661abcff9cf56985edebf509542ca as head aa786516.
  Image: sha256:eba8aadc9b3aebe0a0cb24204a7fe14bd41e4f4272d63daebefbbc210be9e435.
• Push Build Test Image 40891089224:
  validate, exact-head immutable-image smoke and unchanged HIGH/CRITICAL
  Trivy gate PASS. Revision aa7865164f8b5af8831c526b98cc08eaffc7be83.
  Image: sha256:2c01642e82b2ab2f2199bbe53222642dd9d6fcd2af4803035a4b298f14345fc6.
• CodeQL 40891100590
  PASS; analysis 2054515360 identifies current PR test merge aceb4177
  with results_count 0. Separate paginated current PR merge-ref query: zero
  open alerts. This is not a repository-wide alert-clearance claim.
• Docs 40891100631 PASS.
  RFC has no new hosted path trigger because its files are now already in
  master; local preflight and protected RFC gate PASS.
• Hosted Copilot review 40891222105
  PASS. Review 5699366264 at exact head recommends approval with no active
  issues. All review comments/threads retrieved: zero, unresolved zero.

Both image scans retain severity: HIGH,CRITICAL, ignore-unfixed: true,
and the existing OS/library scope and documented ignore file. No scan
suppression or scope downgrade was introduced. PR257 remains draft.

Historical pre-integration validation:

Focused unit: 99 / 99 pass across three logging controller/prune suites.
Full unit handle diagnostic: 6,214 / 6,214 pass, 213 suites, natural exit 0.
Focused HTTP handle diagnostic: 62 / 62 pass, three suites, natural exit 0.
Full serial HTTP: 2,570 pass, 120 suites; existing 42 tests / two suites skipped.
Full ordinary parallel hook: 25 / 25 PASS in 558.6 seconds.
Unit hook: 213 suites / 6,214 pass, no unit worker-force-exit warning.
HTTP hook: 118 suites / 2,514 pass, existing 42 skipped; parallel exit warning remains.
Lint: zero errors / 507 warnings.
Bundle: web production build PASS; size budgets N/A to this test-only change.
Em-dash: added-line check PASS.

Exact commands and observed results:

• node node_modules\jest\bin\jest.js --runInBand --detectOpenHandles --runTestsByPath src\modules\logging\log-config.controller.spec.ts src\modules\scim\controllers\endpoint-log.controller.spec.ts src\modules\logging\logging-auto-prune.spec.ts: PASS, 99 tests, natural exit.
• node node_modules\jest\bin\jest.js --runInBand --detectOpenHandles: PASS, 213 suites / 6,214 tests, natural exit in 83.657 seconds, no reported open handles.
• node node_modules\jest\bin\jest.js --config test\e2e\jest-e2e.config.ts --runInBand --detectOpenHandles --runTestsByPath test\e2e\log-config.e2e-spec.ts test\e2e\endpoint-scoped-logs.e2e-spec.ts test\e2e\scim-event-sse-bridge.e2e-spec.ts: PASS, 62 tests, natural exit.
• node node_modules\jest\bin\jest.js --config test\e2e\jest-e2e.config.ts --runInBand --detectOpenHandles: PASS, 120 suites / 2,570 tests, existing two suites / 42 skips, natural exit in 372.871 seconds.
• git diff --exit-code 6716b3bb -- docs\rfcs\rfc-manifest.json docs\rfcs\README.md: PASS, exact artifact identity.
• pwsh -NoProfile -File scripts\sync-rfcs.ps1 -Quiet: PASS, current/intact corpus; existing four waiver warnings unchanged.
• $env:PREPUSH_MODE='Fast'; git push origin fix/log-stream-test-teardown-20261028: PASS, default normal hook 25/25 gates in 558.6 seconds, final head 2d57e785d2f3a224f64ffcf97f6280f094162f7b.

The full serial HTTP selector includes two log suites / 56 tests excluded by
ordinary CI/pre-push. Those exclusions and ordinary parallel settings are
unchanged. Serial natural exit does not retrospectively explain the independent
historical parallel HTTP worker warning. No no-leak claim is inferred from
the ordinary HTTP command's existing --forceExit.
The final ordinary unit run no longer emits the worker-force-exit warning.
The final ordinary parallel HTTP run still emits it; that separate cause
remains open and is not claimed fixed by these unit-fixture changes.

The first partial push was stopped after identifying the new base's expired
RFC date; it published nothing. A subsequent complete hook passed 25/25 in
487.1 seconds but retained a unit warning, which led to the second diagnosis
and correction rather than treating assertion-green as lifecycle-green.

Docker/live/Playwright/deployment matrices were not rerun: no runtime or UI
behavior changes, and independent release security/performance holds remain.
Exact-tip hosted results are recorded separately after publication; known
body-parser/multer image findings are not waived by this test correction.

Historical hosted evidence at 2d57e785d2f3a224f64ffcf97f6280f094162f7b:

• PR CI 40800193688: ordinary validation PASS; image scan FAIL with body-parser 2.3.0 / CVE-2026-111181 and multer 2.4.0 / CVE-2026-113872, two HIGH / zero CRITICAL.
• Push CI 40800068074: ordinary validation PASS; image job FAIL.
• CodeQL 40800193645: PASS; separate open-alert query for this PR merge ref returns an empty list.
• Docs 40800193644 and RFC 40800193732: PASS.

Keep this PR draft and held. Issue #256 tracks approved dependency remediation;
no exception, suppression, merge or deployment follows from these fixture fixes.
The former body-parser/multer observations above describe old images; the
current master remediation is PR #258. Issue #256 also has independent API/web
advisory records, so this integration neither closes it nor claims global
security clearance. Parent reports master CodeQL PASS but 107 pre-existing
OPEN repository alerts, zero first-created since that merge. A successful
CodeQL workflow is not an empty repository alert inventory.

Outstanding release evidence remains performance 1.23928982 > 1.10,
customer-data proof, cleanup 403, measured-browser/human visual proof and the
global competing Mermaid renderer conflict. PR #251 remains separate at
e5e107f5; no overall release completion is claimed.

Standing Rules Acknowledgment

• No em-dash (Unicode U+2014) anywhere in the diff. Verified via Select-String -Pattern ([char]0x2014).
• No git commit --amend on history that has been pushed.
• No new credentials, tokens, or secrets committed to source. Forbidden patterns regression spec at api/src/security/forbidden-source-patterns.spec.ts will catch known anti-patterns.
• Migrations are additive-only (expand-contract for column changes). Migration linter at api/src/scripts/lint-migrations.ts enforces this. No migration changed.

Destructive Migration Override (skip if not applicable)

N/A: no migration or schema change.

• This PR contains a NEW destructive Prisma migration (DROP TABLE/COLUMN, ALTER COLUMN ... TYPE, RENAME, INSERT ... SELECT FROM)
• I have set ALLOW_DESTRUCTIVE_MIGRATION=1 in the CI environment for this PR
• Justification (required if box above is ticked):

  <!-- Why this destructive change is necessary, what the rollback path is, and which release window it ships in -->
  

Reviewer Hint

Diff areas worth special attention from the reviewer:

• Fixture shutdown assertions must run before real timers are restored.
• Enabled prune startup must not call the runtime setter before initialization.
• Environment restoration must preserve absent values, including on failure.
• Verify that no production service, runner limit or existing exclusion changed.
• Self-improvement: applied zero-owned-timer guards and retained real-handle
  allocation stacks. Design disposition: accepted; typed fixture helpers and
  the existing application lifecycle suffice without a new abstraction.

[pranems]

Parallel HTTP warning: actual lifecycle evidence

Documentation-only follow-up b3eb51e3f9f61b0ed3fcd81a2e48802756b63814
is normally published. The four unit fixture corrections remain unchanged.

Two actual two-worker diagnostics each pass 118 suites / 2,514 tests, with
42 existing skips, and reproduce the warning. Native milestones show:

Milestone after parent shutdown request	Worker 1	Worker 2
JavaScript exit, code 0	1.326 ms	1.410 ms
Native Environment end marker	3.413 ms	3.258 ms
Parent observes process exit, code 0	5838.091 ms	6790.108 ms

The parent's SIGTERM and SIGKILL calls return false. After shutdown dispatch
the snapshots have two pipe resources, no referenced timer or server.
The observer has a passing delayed-consumer/no-added-message-listener control.

This attributes the observed phase, not the final native cause. Worker
native destruction, OS notification and parent processing are not yet
separated; delayed parent observation does not prove the worker remained
alive throughout the gap. No application timer, runner deadline, worker
count, exclusion or force-exit setting changed.

The RC-I110 explanation and flow
retain measurements, limits, source verification and next action.

New validation

• git push origin HEAD: 25/25 normal Fast hook gates PASS.
  Units: 213 suites / 6,214 PASS, no unit worker warning.
  HTTP: 118 suites / 2,514 PASS, 42 existing skips; separate warning retained.
• npm run docs:mermaid:render: 812 diagrams PASS in both themes.
• npm run docs:html -- docs\SCIM_CORRECTNESS_EXECUTION_ISSUES_AND_RCA.md:
  PASS, standalone RCA with the actual new diagram pre-rendered as SVG.
• npm run docs:mermaid:doctor: one local editor BLOCKER,
  built-in plus marketplace renderer installed. No global extension removal
  or window reload was attempted. HTML is independent of that viewer state.
• The raw hook reports 32758.9 seconds overall, including 31733.7 seconds
  for its successful doc-content gate. Its durations use wall-clock
  Get-Date subtraction. This outlier is retained, not presented as CPU cost
  or assigned an unproven suspend/clock-change cause.

Exact-tip hosted checks

• PR image 40862696690:
  validation PASS; Trivy FAIL, two HIGH / zero CRITICAL.
• Push image 40862687202:
  validation PASS; independent Trivy FAIL, same two HIGH / zero CRITICAL.
• CodeQL 40862696659,
  docs 40862696699
  and RFC 40862696725:
  PASS. Open CodeQL alerts on this PR merge ref: [].

The actual new scan logs still identify body-parser 2.3.0 /
CVE-2026-111181 and multer 2.4.0 / CVE-2026-113872. No suppression or
quarantine/registry bypass was introduced. Both PRs remain draft and
MERGEABLE with zero unresolved review threads; #251 and master are unchanged.
No merge, serving-code change, version bump, campaign, live mutation or
deployment occurred. Security, performance and customer verification holds
remain independent and unresolved.

[pranems]

Windows shutdown observation published at 9d6d5c6

The normal protected push passed 25/25 Fast gates in 543 seconds.
All 6,214 unit tests passed without the former unit worker warning.
Ordinary parallel HTTP retained 2,514 passes / 42 existing skips and its
separate warning. All 813 diagrams rendered in both themes under strict
security. No application, dependency, product version or runner setting changed.

The passive Windows diagnostic makes a narrower, useful distinction:

Observation after parent END	Worker 97984	Worker 9968
JavaScript exit, code 0	1.264 ms	1.075 ms
Windows exit status 0 but process object unsignaled	166.421 ms	105.003 ms
Parent successful exit callback	6377.966 ms	6088.494 ms
First sampled signaled process object	6418.031 ms	6115.038 ms

Pinned libuv source checks exit status in its kill path but registers exit
notification on the process handle. That is a compatible explanation of
the different observations, not proof of a captured native error or the
component consuming the remaining delay. Polling records transitions, not
every unchanged sample or maximum gap; exact signaling time and uninterrupted
six-second nonsignaling are not claimed. The external observer has only
limited-query/synchronize rights and a passing queued-message/natural-exit
control. The first control's ES-module mismatch and its corrected retry are
both retained.

The updated RC-I110
contains the measurements, flow, source citations and limitations.

Actual new exact-tip hosted results:

Run	Result
PR image 40868551902	Validation PASS; Trivy FAIL
Independent push image 40868544574	Validation PASS; Trivy FAIL
CodeQL 40868551915	PASS; open merge-ref alerts []
Docs 40868551999	PASS
RFC 40868551896	PASS

Both actual new scan logs confirm two HIGH / zero CRITICAL:
body-parser 2.3.0 / CVE-2026-111181 and multer 2.4.0 / CVE-2026-113872.
The approved-feed metadata-only recheck at 29 October 05:35 local still
returned E404 for listed fixes 2.4.0 and 2.5.0. No installation, public-feed
fallback, local lockfile regeneration, suppression or age waiver occurred.
Issue #256 remains blocking; an E404 does not establish its underlying cause.

PR #257 stays draft with zero unresolved review threads at the current read.
Master remains 5bfff2d and PR #251 remains e5e107f, unchanged. No merge or
deployment occurred. Performance admission, customer-data restore, final
cleanup and admitted-artifact live/browser/operator verification remain
independent release holds.

[pranems]

Follow-up: the long wait is before Windows process-completion signaling

A stronger ignored, read-only diagnostic, not an application or runner
change, now retains each state's preceding query, exact query start/end
intervals, query counts and maximum gaps. Its control was RED against the
old observer (Missing sampleNumber), then GREEN after those records were
added. Queued IPC and natural exit remain required.

The new ordinary-selector parallel HTTP run passes 118 suites / 2,514
tests plus 42 existing skips in 198.799 seconds, retaining the warning.

Relative to parent END	PID 11348	PID 88820
Last unsignaled query begins	8442.674 ms	7061.988 ms
First successful/signaled query ends	8490.018 ms	7109.354 ms
Completion-signal bracket width	47.344 ms	47.366 ms
Parent successful exit callback	8454.280 ms	7108.966 ms
Last unsignaled exit status / wait	0 / 258	0 / 258
Actual query count	6074	6074
Maximum inter-query gap	138.440 ms	145.613 ms
Maximum query duration	10.237 ms	1.177 ms

Both callbacks fall inside their approximately 47 ms completion brackets.
Windows still reports unsignaled process objects in queries beginning more
than seven seconds after END, far past Jest's unchanged 500 ms deadline.
Thus this run's long wait precedes Windows process-object signaling; it is
not explained by seconds of delayed JavaScript callback handling in the
parent. The particular native/OS component postponing completion is still
unidentified. This does not justify an application timer change, forced-kill
claim, deadline increase or release waiver.

The safe bracket uses the preceding query's start, not its end, as the
lower bound, and the successful query's end as the upper bound. Raw Node and
Windows records, failed/green controls and helper versions are preserved
separately from the preceding immutable checkpoint.

Separate security progress: approved-feed time metadata now proves that
body-parser 2.4.0 and multer 2.5.0 crossed seven days of age today at
11:39:38Z and 11:58:46Z respectively. Both exact-version metadata queries
now succeed through the approved feed. The earlier E404 checks preceded
those thresholds. A separate minimal security implementation is underway
in a fresh context, with CI-owned locks and normal protected publication.
This is not yet patched-installation or clean-image proof. This PR remains
draft and unmerged.

[Copilot]

🟢 Approval recommended

No active review issues remain for the logging-test timer cleanup changes.

No open issues 🎉

What changed in this PR

This PR fixes four logging-test timer leaks without changing application behavior or test-runner settings. It also documents the separate parallel HTTP worker-exit warning, whose cause remains unresolved.

Changes:

• Disconnect two SSE fixtures through their registered close callback and assert zero pending timers after each stream test.
• Configure prune startup before service construction, restore environment values exactly, and verify timer cleanup after shutdown.
• Record validation evidence, diagnostic limitations, and integration with merged security changes.

File	Description
Session_starter.md	Updates integration context, fixture results, and remaining investigation boundaries.
docs/​strategy/​ENGINEERING_LESSONS_AND_PATTERNS.md	Documents lifecycle-based diagnosis and non-disruptive observer practices.
docs/​SCIM_CORRECTNESS_EXECUTION_ISSUES_AND_RCA.md	Records timer-leak causes, fixes, and worker-exit diagnostic evidence.
docs/​CONTEXT_INSTRUCTIONS.md	Refreshes project context and distinguishes historical results from current validation.
CHANGELOG.md	Summarizes fixture cleanup, diagnostics, and security-master integration.
api/​src/​modules/​logging/​logging-auto-prune.spec.ts	Corrects startup fixtures, preserves environment state, and asserts timer cleanup.
api/​src/​modules/​logging/​log-config.controller.spec.ts	Disconnects SSE fixtures and adds zero-timer teardown assertions.

_{Review effort: Balanced}

[pranems]

Actual merged-master checkpoint

Normally merged as 727860866c53c7ec8d01d1ff5bae858f80a1715d, preserving
all constituent fixture and security history. The merge tree exactly equals
the reviewed aa786516 tree. Product remains 0.55.61.

The actual merged-source Build Test Image run 40892935677
passed: 6,220 API units, 2,514 HTTP tests plus 42 existing skips, 1,655 web
tests, real container boot/discovery smoke and the existing HIGH/CRITICAL
image scan policy. Automatic merged-source CodeQL run 40892853224 passed.

Actual merged-source immutable image:
ghcr.io/pranems/scimserver@sha256:efad4b082fb5ca36b5950c5e7884e50293a9c1df56605500591644797ec9f85c.
A unique test tag was used. Neither latest nor any deployment changed.
This is new merged-source evidence, not an earlier branch/PR image.

The four proven fixture leaks are corrected without changing production
timers, worker deadlines, force-exit settings or exclusions. The protected
local unit gate has no unit-worker warning. The separate Windows HTTP
completion-delay diagnosis remains open; its exact native/OS component has
not been identified.

The independent Seroval/Undici advisory remediation is proceeding separately.
Issue #256, performance admission, customer-data/restore proof, cleanup,
browser measurement and human visual verification remain open. Successful
CodeQL/Trivy execution is not blanket security clearance or release admission.