perf(test): shorten hostport and cli-kits test tail - #654

AI assistance disclosure

Authored by an AI agent (OpenCode, dispatched by First Mate) and reviewed by two separate adversarial AI reviews (no blockers; non-blockers fixed). Human review requested; no human approval yet.

Context

The bash 3.2 CI job takes 8.5 to 16 min for the same code (1.7x runner spread). A few tests set the wall time. Root causes, measured locally:

Production code and defaults are unchanged (no changes outside test/bats).

Plan / Changes (test/bats only)

• helper.bash: new acq_untrace_subshell (set +T; trap - DEBUG), called first in the provision subshells of 113-host-port-override.bats (4) and 95-kit-ref-persistence.bats (2). errexit/ERR trap still apply; only failure-location tracing inside those subshells is lost.
• 60-help.bats: run the 15 --help invocations concurrently, then assert each (exit status, header, no banner) individually.
• kit-fetch-lifecycle.py: same 21 cases, 4 at a time (ThreadPoolExecutor), every failure reported, failure-only ceilings raised (they cannot slow a passing run).

Before / after (local, 2 CPUs, same machine, 3 runs each, seconds)

Note: the kit-fetch baseline was measured while another agent loaded the machine and the test also failed there (flaky under load, pre-existing). Measured unloaded, back to back: 23.2s before vs 2.3-3.4s after.

Verification transcript

• Full offline suite (bash 5.3, scripts/test-acq-bats, 2 jobs): 1058 ok, 11m46s. The only failure, 117-msys-path-forms test 3 (mkdir: Permission denied), is a sandbox permission issue and fails identically on an untouched copy of origin/main.
• Touched files run 3x concurrently under 2-way file parallelism (xargs -P 2, same as the suite's fallback): all 3 rounds passed (wall 67s / 58s / 62s). An earlier round with 8 workers and 3s ceilings flaked (exec SIGHUP timeout); fixed by 4 workers + raised ceilings, then re-verified as above. The same flake appeared again with 15s ceilings in two rounds only while a second agent's full suite shared the machine (load 4+ on 2 CPUs); not reproducible on a quiet machine.
• Real bash 3.2.57 (musl build): 95 and 60-help pass; 113 subset passes. 103 cannot run under the 3.2 shim here because the shim path is not exec-able from python subprocess (environment limitation, not the change); python script itself passed 17/17 cases on 3.2 earlier via the shim in a direct run of the pre-edit version.
• ShellCheck (0.10.0 available locally, not 0.9.0), --severity=warning: clean on touched shell files. py_compile OK, git diff --check clean. pre-commit itself could not run locally (no pre-commit/network in sandbox); CI must confirm.

Mutation checks (each test still fails when its behavior is broken)

• SAME kit different ports: forcing the chosen host to the guest port fails the test (before and after).
• explicit host honored: emitting guest:guest instead of host:guest fails.
• two kits collapse: dedupe print made unconditional fails.
• kit-pinned unprobeable: removing the unknown-probe notice fails.
• WITHOUT_PORTS: removing the _portrecs="" drop fails.
• cli-kits persists: disabling acq_cli_kits_write in provision fails.
• help: wrong header for stop, version, non-zero exit, banner leak each fail.
• kit fetch lifecycle (identical verdict before/after on 8 mutations): guardian ignores USR1, no cleanup signal, no parent-liveness check, guardian EXIT rm removed all fail; the other 4 (no parent EXIT trap, no rm in parent cleanup, startup HUP/INT handlers removed) pass both before and after, i.e. were never covered; not made worse.
• Note: "counter does not advance" mutation of the port picker passes both before and after (the random base differs per process); not a regression.

What was not sped up

• 113 still ~72s: the acq_child (publish B) tests run real acq child processes (1s guardian teardown + provisioning each, 1.3-3.4s) and malformed values (10s, 4 acq runs). Left alone: they are the 4-5s tail, not the tail that sets wall time, and parallelizing them risks the stub counters.
• 60-help file still ~47s from many other 1s acq invocations.
• The 1s guardian teardown itself (production acq) is the shared root of several slow tests; fixing it is a production change and is out of scope.

Rollback

Revert this commit; test-only.

Security impact

None. Test-only; no auth, data handling, network or attack-surface change.