test(release): make the runnable release canaries executable gates

[AetherAI3]

Problem

The integration proof for the A0–A5 wave listed seven release canaries and recorded that none of them ran. A checklist someone remembers is not a gate. This makes the ones that can run, run on every build.

Coverage map — stated honestly, not claimed complete

#	canary	where
1	denied mutation	here
2	live-child cancellation	test/process_tree.test.ts — whole tree, by pid
3	reconnect replay	here
4	remote freshness	test/worktree.test.ts — real git, pinned base
5	fake-gh ship	not writable
6	cap across reconnect	here
7	brain parity	not writable

2 and 4 landed with the A6 and A7 fixes and are referenced rather than duplicated.

Canary 1 asserts the disk, not the transcript

bridge.test.ts already proves the brain receives a refusal. What it does not check is whether the bytes changed.

A gate that refuses in the transcript while the write still lands is the failure that actually matters — and it passes that existing test. This one checks the file.

It also performs a successful write afterwards, so the refusal assertions cannot pass vacuously against an executor that simply writes nothing.

Canaries 3 and 6 drive the reconnect path

A reconnect re-delivers frames from the last acknowledged sequence. Two opposite failures:

• settle twice → recorded spend doubles silently
• drop one → the cap trips late, past the boundary the operator set

So: a replayed terminal frame settles once, a genuinely new turn still counts, and the cap trips on reaching the boundary — not early from an inflated total, not late from a dropped one.

6b pins the inverse that is easier to get wrong: an unmeasured session is unknown, not zero, and its headroom is null rather than the full cap.

Mutation-checked. Removing the replay dedupe:

	result
mutated	2 pass / 2 fail — canaries 3 and 6
restored	4 / 4

command	result
npm run typecheck	exit 0
npm test	1098 pass / 0 fail

Why 5 and 7 are absent rather than stubbed

A test that asserts nothing is worse than a gap, because it reads as coverage.

Canary 5 has nothing to exercise. repo.ts:204 — prCreateHint returns a string for the user to run. No subprocess ever invokes gh pr create. A fake-gh harness would assert against code that does not exist. This canary arrives with the review/ship rail, not before it.

Canary 7 needs a seam that does not exist. LocalBrain spawns a Python module that is not vendored here and exposes no injectable transport, so no test can drive it. Transcript parity needs that seam built first.

Both are recorded in the file itself, next to the coverage map, so the next person reading it sees the gaps rather than inferring completeness from four green checks.

Release clearance after this

gate
A7 exact remote base	✅ merged
A6 async runtime + tree teardown	✅ merged
canaries 1, 2, 3, 4, 6	✅ executable, green on every build
canaries 5, 7	❌ blocked on the ship rail and a Python seam
fresh aether auth login	❌ operator action
re-pack + verify installed artifact	pending