test(extensions): cross-process concurrency stress for W2 lifecycle services (swamp-club#254)

[stack72]

Summary

Closes swamp-club#254. Post-merge follow-up to PR #1310 (W2 — lifecycle services).

Adds integration/lifecycle_concurrent_stress_test.ts that mirrors the swamp-club#234 race-regression pattern at integration/data_delete_test.ts. 50 iterations × 4 concurrent CLI subprocesses (extension pull @stress/alpha, pull @stress/beta, rm @stress/alpha, update) verify the W2 services' per-extension-atomicity claim under cross-process contention.

Five invariants per iteration:

• (i) Catalog ↔ lockfile bijection: every Indexed _extension_catalog.db row for @stress/* matches a lockfile entry by name+version, and vice versa.
• (ii) No DuplicateTypeError leakage across distinct fixture types (@stress/alpha-model vs @stress/beta-model). Fixtures deliberately declare distinct type ids — sharing them would surface a real cross-extension collision on every concurrent install of alpha+beta and the test would mis-categorise it as benign.
• (ii') No lockfile-retry-budget exhaustion (Could not acquire lock on upstream_extensions.json) or SQLite-busy contention (SQLITE_BUSY, database is locked). These are real failures, not benign race outcomes.
• (iii) extensions/models/upstream_extensions.json is well-formed JSON after every iteration.
• (iv) No orphan files under .swamp/pulled-extensions/@stress/... — every file is referenced by some lockfile entry's files[]. Empty leftover directories are tolerated; extension rm only prunes the deepest empty directory, matching integration/extension_rm_test.ts's file-level absence assertion.

The harness ships a co-located Deno.serve fixture registry implementing the four ExtensionApiClient endpoints the install path requires (/{name}, /{name}/latest, /{name}@{version}/download, /checksum) so the test runs offline and deterministically. Inline comments at each fake endpoint reference the corresponding extension_api_client.ts callsite so future API drift fails this test loudly rather than silently shipping bad production code.

design/extension.md "Crash-state recovery" section gains one paragraph pinning this test as the load-bearing concurrency-claim verification, with inline swamp-club#254 and test-path references.

Test Plan

• deno check clean
• deno lint clean
• deno fmt --check clean
• New stress test runs 3× back-to-back green: 2m58s, 2m57s, 2m57s
• Full suite (deno run test) green: 5527 passed / 0 failed / 28 ignored (3m15s)
• deno run compile builds binary
• Wall-clock cost: 2m57s for 50 iterations × 4 children. data_delete_test.ts is 1m39s for 50 × 2 children — ~1.78× ratio, expected scaling.

Notes for reviewers

• Both load-bearing constants (RACE_ITERATIONS = 50, CONCURRENCY_PER_ITERATION = 4) are pinned with code-comments referencing swamp-club#254 — please don't shrink them silently.
• N=50 is mirrored from data_delete_test.ts (where it was calibrated against an evidence-base) but this test verifies the absence of a race in code claimed safe — there's no calibration point. The header comment is honest about this; CI's natural soak across the merge train is the longer-tail coverage.

🤖 Generated with Claude Code

[github-actions]

Code Review

Well-written cross-process concurrency stress test. The code is thorough, well-documented, and follows project conventions consistently.

Blocking Issues

None.

DDD Assessment

The test correctly exercises the W2 lifecycle domain services (InstallExtensionService / RemoveExtensionService / UpgradeExtensionService) through the CLI subprocess boundary rather than bypassing domain services directly. Invariant verification reads from the infrastructure layer (ExtensionCatalogStore, lockfile, filesystem) — appropriate for a test asserting cross-layer aggregate consistency. No domain logic violations or anti-patterns.

Conventions Verified

• License header: Present ✓
• No any types: Uses as unknown as X for two Deno type-bridge casts, no raw any ✓
• No fire-and-forget promises: All promises awaited ✓
• @std/path for path ops: Uses dirname, fromFileUrl, join throughout ✓
• Windows compatibility: toForwardSlash normalizer for path comparisons, .catch(() => {}) on temp dir cleanup ✓
• Import boundary: No libswamp imports — imports from src/infrastructure/ directly, consistent with all other integration tests ✓
• Test naming: Descriptive name with issue reference ✓
• deno fmt/deno lint/deno check: PR states all clean ✓

Suggestions

1. The two as unknown as BufferSource / as unknown as BodyInit double-casts (lines 220, 346) are slightly inelegant but pragmatic for Deno's type system gaps — not worth changing.

2. The ~50-line file header comment is long but justified here: the calibration note honestly disclaiming N=50's statistical power, and the architecture note explaining why SQLITE_BUSY is tolerated, are both genuinely valuable for future maintainers of a test this nuanced.

3. The design doc addition at design/extension.md:1010-1019 sits naturally in the "Crash-state recovery" section and pins the test as the load-bearing verification — good traceability.

Clean PR. The five invariants are well-defined, the fixture registry is minimal but complete, and the Windows/cross-platform handling is thorough.