Record debby Linux test run findings post-retirement (Sam & Claude)

2329/2348 tests pass on Node 24 / Debian 13.
19 failures: ~17 expected crypto.argon2 Linux exclusions,
2 need FreeBSD cross-check (explanation-grounder, cms nginxConf).
Colibri Rust: 31/31 green.

---
Build: pass | Tests: FAIL — 19 failed

docs/internal/sessions/2026-05-27-debby-linux-test-run.md

@@ -0,0 +1,83 @@
+# Session: debby Linux Test Run — Post-Retirement Validation
+
+**Date:** 27.maj.2026  
+**Agent:** Claude / Hermes (debby — Debian 13)  
+**Branch:** main @ a3fc030  
+**Topic:** Cross-platform test validation after TS retirement commit
+
+## Summary
+
+Pulled main after the retirement commit (3425 deletions, 38 files changed) and ran
+the full vitest suite on debby (Linux, Node v24.16.0).
+
+```
+Tests: 19 failed | 2329 passed (2348 total)
+Duration: 22.95s
+```
+
+---
+
+## Known Linux Exclusions (expected, not regressions)
+
+`crypto.argon2` is a FreeBSD-only Node.js API — unavailable on Linux.
+All argon2-related failures are expected on this platform.
+
+Affected tests:
+- `src/controlplane-db.test.ts` — `hashPassword`, `verifyPassword`, `getAgentByApiKey` (9 tests)
+- `src/controlplane-setup.test.ts` — operator account hash/verify (5 tests)
+- `src/postinstall-setup.test.ts` — bootstrap token hash + rate-limit (2 tests)
+- `src/controlplane-heartbeat.test.ts` — `runAgentHeartbeat` no-task case (1 test, argon2 cascade)
+- `src/controlplane-api.test.ts` — (argon2 cascade)
+
+**Total expected Linux exclusions: ~17 of the 19 failures**
+
+---
+
+## Failures Requiring FreeBSD Cross-Check
+
+These two do **not** appear to be argon2-related — Codex should verify on FreeBSD:
+
+### 1. `src/explanation-grounder.test.ts`
+
+```
+FAIL > buildExplanationGrounding > builds a database grounding pack from runtime facts, live state, and canonical sources
+```
+
+Expected output to contain:
+```
+password is passed via PGPASSWORD env, not argv
+```
+
+Got a full grounding block without that string. Likely a snippet or assertion drift
+from the retirement cleanup — the canonical snippet source may have been trimmed.
+
+### 2. `setup/cms.test.ts`
+
+```
+FAIL > setup/cms nginxConf > builds explicit server blocks for cms admin and tenant surfaces
+```
+
+nginx config assertion mismatch. May be a content change from the retirement commit
+or a Linux path/locale difference. Needs verification on FreeBSD.
+
+---
+
+## Colibri Rust Tests (all green)
+
+Also pulled and validated Colibri @ 9743923 on debby:
+
+```
+cargo test --workspace
+Tests: 31 passed, 0 failed
+```
+
+New glasspane Phase 3 tests (PiJsonlIngestor, PaneSupervisor, PTY seam) all pass
+on Linux — confirming cross-platform parity for the Rust layer.
+
+---
+
+## Action Items for FreeBSD Agent (Codex)
+
+- [ ] Run `npx vitest run` on FreeBSD and check if `explanation-grounder` and `cms` tests pass
+- [ ] If they pass on FreeBSD: failures are Linux-specific, note in AGENTS.md
+- [ ] If they also fail on FreeBSD: regression from retirement commit, needs fix