test: stabilize and speed the parallel suite without a full rerun

[pavelhov]

TESTS ONLY. No packaging, Cursor protocol, or product/security audit work.

What was flaky and why

Pavel’s repro: bun run test:parallel (~605 files, default 4 workers) took ~5m28s, then tests/codex-plugins-doctor.test.ts and tests/claude-models-discovery.test.ts failed. Both pass in isolation and hit a ~20s timeout under parallel load. The recovery was CCX_TEST_PARALLEL_WORKERS=2 bun run test:parallel — a full-suite rerun at half workers.

Root cause (verified, not guessed):

• The parallel runner spawned one Bun process per file (bun test --isolate) × 4 workers.
• codex-plugins-doctor spawned another Bun CLI (ccx status --json) with a 20s test budget and no spawnSync timeout. Under load that nested boot exceeded 20s.
• claude-models-discovery binds real servers (startServer) many times in one file. Same isolate-per-file contention class; it already had a 30s budget, but still competed with hundreds of other process boots.
• The runner had no fail-and-retry-only-failed-files path, so a load flake meant rerunning all ~605 files.

What changed (runner + tests)

• Planner (scripts/test-plan.ts): cheap unit files share a process (--no-isolate --max-concurrency=1, batches of 8). Files that bind a server, spawn process.execPath, call saveConfig, or mutate CODEXCOMMANDER_HOME/CODEX_HOME still get their own process. tests/preload.ts HOME sandbox is unchanged (still per process, including a bare bun test <file>).
• Retry: failed files are retried once, file-by-file, on 1 worker. The printed recovery command is bun run test:parallel tests/foo.test.ts …, not a 2-worker full rerun. Default worker count stays min(4, CPUs).
• Doctor: the nested CLI spawn is now in-process collectStatus() (same codexPlugins + CODEX_HOME read-only assertions). Spawned status --json coverage, including CODEX_HOME read-only and codexPlugins, stays in tests/cli-status-json.test.ts with SPAWN_BUDGET_MS.
• Discovery: uses SERVER_BUDGET_MS (30s) instead of a magic number.
• Linux host-bus hermeticity: Route Back / ensure / sync tests no longer treat a missing systemd user bus as SERVICE_BLOCKED. Child processes get the existing systemctl stub on PATH; restore-back passes diagnoseService into the replacement start path.
• Guidance: AGENTS.md / contributing / CI now say rerun only failed files. CI runs bun run test:parallel so local and CI share the retry path.

CCX_TEST_FORCE_ISOLATE=1 restores one process per file. CCX_TEST_RETRY=0 disables retry.

Timings

	Wall clock	Workers	Result
Before (Pavel’s laptop)	~5m28s	default 4	603/605, then a full rerun at 2 workers
After (this agent VM, 4 CPUs)	1.7 min / 103s	default 4 (CCX_TEST_PARALLEL_WORKERS unset)	605/605, no retry pass, no 2-worker full rerun

Plan on this tree: 605 files → 239 isolated + 366 batchable in 46 batches = 285 work items.

Formerly flaky files (codex-plugins-doctor, claude-models-discovery) plus heavy neighbors: 5/5 passes under default 4-worker bun run test:parallel (~8s each).

Landing

Pushed onto development (fast-forward 03c66ca5..9c4c195d) after the evidence above. Not pushed to main. development was first fast-forwarded to main so it was not 105 commits behind.

Audit / packaging / Cursor

Out of scope. Not in this PR.

Verification

• Focused tests: test-runner, ci-workflows, codex-plugins-doctor, cli-status-json, claude-models-discovery
• bun run typecheck
• Previously host-contaminated files (lifecycle, sync, service log path) pass in isolation
• bun run test:parallel (default workers) green: 605 files, 1.7 min, no retry
• Formerly flaky files pass repeatedly under default parallel load (5/5)
• No CCX_TEST_PARALLEL_WORKERS=2 full-rerun hack required

Security review

.github/workflows/ci.yml Test suite step is now bun run test:parallel (contents: read; no new secrets, third-party actions, or permission changes). Needs explicit security review per MAINTAINERS.md.

GitHub ci on this branch (and on main) currently fails at GUI tests before the proxy suite runs. That failure is pre-existing on main and is out of scope for this tests-only change.