An admin's "All fine" in tests reads only its own forge: the asks, board and capacity suites stop failing on signals their shard neighbours raise #1635

Two forges made by createApp in one process no longer share the error and refusal signals that vitals() turns into needs. Another forge's signal can't push an admin off "All fine" on / or in the header. The type check is clean and the tests I ran pass.

What changed

• Errors: src/kernel/log.ts now keeps errors in an ErrorLedger. The process still has its own ledger, which is what the sentinel reads. createApp also gives each forge a ledger, registered at creation and released in close(), so a new forge starts empty.
• Where errors count: a forge's ledger records errors from module-level loggers (createLog("x")), because those belong to no forge. It also records errors from that forge's own app.log, which now carries an owner id. It does not record errors from another forge's app.log.
• Refusals: each forge has its own RefusedLedger (src/kernel/internal_refused.ts), which src/http/server.ts writes to when it refuses an internal call.
• Plumbing: App.signals carries both ledgers. vitals() takes an optional signals input, and readHealth, the board's forge strip and forgeNeedsFor pass it. If signals is unset, vitals() reads the process ledgers, as before.
• Production: it has one forge per process. That forge's ledger sees the same lines the process ledger does, so the needs it shows don't change.

Test and how I ran it

• New test: test/vitals.test.ts ("two forges in one process keep their own error and refusal signals"). It checks four things:

- An error burst and a refusal on forge B leave forge A with no needs. - A module-logger burst reaches every forge, as in production. - A forge created later starts clean. - A forge no longer needs the process-wide reset between tests.

• Runs: I ran vitals, sentinel, asks, board, capacity and map together in one bun test process, 10 runs in a row, with 0 failures in each. I did not run them in the gate's shard order through scripts/test-shards.ts --gate. test/health.test.ts and test/app.test.ts also pass.

Existing test changed

• Why: in test/vitals.test.ts, "an unauthenticated internal call is refused…" reset the process-wide refusal counter and called vitals() without signals. It now clears app.signals.refused and passes signals, because the server writes to that ledger now.
• What stayed: every assertion is unchanged.

Left out: clearErrors and resetRefusedInternal stay for the sentinel and older tests. I didn't give module loggers a forge owner, because there is no per-request forge context. Errors they raise while a forge is alive count for every live forge in the process.

Pre-existing failure: capacity.test.ts fails here only because the sandbox sets FORGE_CHECK_SHARDS=6. It fails the same way on the base branch and passes with the variable unset.

Closes #1614

Each of the asks, board and capacity suites now clears its forge's error and refusal signals before every test, so a shard neighbour's burst can no longer push them off "All fine". I haven't run them in the gate's shard order (scripts/test-shards.ts --gate), so I haven't shown the flake is gone there. In this shell the five touched suites (vitals, asks, board, capacity, check-budget) pass: 49 tests, with FORGE_CHECK_SHARDS unset. tsc --noEmit is clean.

Why the per-forge ledgers alone weren't enough. Sentinel is right. About 46 of the ~51 error sites in src use module loggers (crew, checks, apps, looks, runner and others). By design those still reach every live forge's ledger, so a neighbour's burst through them crosses into this forge's. I kept the per-forge ledgers because they still stop one forge's errors and refusals from showing in another's vitals. They don't fix the flake. The beforeEach clearing is what does.

Changes

• Suites: test/asks.test.ts, test/board.test.ts and test/capacity.test.ts each clear app.signals.errors and app.signals.refused in beforeEach.
• Dead ledger: src/kernel/internal_refused.ts no longer has the process-wide ledger or the defaulted ledger parameters. noteRefusedInternal and refusedInternal now take the ledger explicitly.
• VitalsInput.signals: it is now required, so nothing can fall back to a process-wide ledger. I updated the vitals and check-budget tests to pass app.signals and removed resetRefusedInternal from them.
• Brace: fixed the mis-indented closing brace in src/kernel/vitals.ts.

Not done

• I did not split the module loggers by forge. That would mean threading an owner through every createLog call, which is a much larger change than this fix.

Environment note: capacity.test.ts "an admin changes each one…" fails here whenever FORGE_CHECK_SHARDS=6 is in the environment. It fails the same way without my change, so it isn't caused by this pull.

Try it: env -u FORGE_CHECK_SHARDS bun test test/vitals.test.ts test/asks.test.ts test/board.test.ts test/capacity.test.ts