test: migrate remaining test loops (NVIDIA#9402)

<!-- markdownlint-disable MD041 -->
## Summary

Turns aggregate loop assertions into independently reported test cases
only when each input benefits from its own result. The final diff keeps
direct setup and ordered loops and removes unrelated syntax rewrites.

## Changes

- Parameterize existing cases in 10 test files for clearer failure
names.
- Keep ordered setup, retry, polling, and aggregate work in direct
loops.
- Restore the registry target loop and all syntactic-only changes.
- Remove the repeated loop-helper abstractions from the earlier
revision.
- Limit the final change to 221 additions and 206 deletions.
- Record a passing documentation-writer review for `521d9f10a`; no
public documentation changes are needed.

## Type of Change

- [x] Code change (feature, bug fix, or refactor)
- [ ] Code change with doc updates
- [ ] Doc only (prose changes, no code sample modifications)
- [ ] Doc only (includes code sample changes)

## Quality Gates

- [x] Tests added or updated for changed behavior
- [ ] Existing tests cover changed behavior — justification:
- [ ] Tests not applicable — justification:
- [ ] Sensitive paths changed (security, policy, credentials, preflight,
onboarding, inference, runner, sandbox, or messaging)
- [ ] Sensitive-path review completed or maintainer-approved waiver
recorded — reviewer/approval link/justification:
- [ ] Non-success, skipped, or missing CI check accepted by maintainer —
check name, approval link, and follow-up issue:

## DGX Station Hardware Evidence

- [ ] Tested on DGX Station
- Tested commit: Not applicable
- Station profile/scenario: Not applicable
- Result: Not applicable
- Supporting evidence: Not applicable

## Verification

- [x] PR description includes a `Signed-off-by:` line and every commit
appears as `Verified` in GitHub
- [ ] Normal `pre-commit`, `commit-msg`, and `pre-push` hooks passed, or
`npm run validate:pr` passed after refreshing `origin/main` when hooks
were skipped or unavailable — GitHub CI is the maintainer-authorized
validation path for this repair.
- [ ] Targeted behavior tests pass for the current change set, or tests
are marked not applicable above — GitHub CI is running for the latest PR
commit.
- [ ] Applicable broad gate passed — `npm test` for broad
runtime/test-harness changes; `npm run check` for repo-wide
validation/coverage changes — command/result:
- [x] Quality Gates section completed with required justifications or
waivers
- [x] No secrets, API keys, or credentials committed
- [ ] `npm run docs` builds without warnings (doc changes only)
- [ ] Doc pages follow the [style
guide](https://github.com/NVIDIA/NemoClaw/blob/main/docs/CONTRIBUTING.md)
(doc changes only)
- [ ] New doc pages include SPDX header and frontmatter (new pages only)

---
Signed-off-by: Carlos Villela <cvillela@nvidia.com>


<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->

## Summary by CodeRabbit

* **Tests**
* Improved test coverage for Windows-host Docker probing and strict
tool-calling modes.
* Expanded validation of onboarding progress metadata and reserved
dashboard ports.
* Added independent coverage for channel presets, CLI compatibility, and
command dispatch behavior.
* Separated latency configuration tests for defaults, valid values, and
invalid inputs.
  * Strengthened stored-auth transition and migration concern coverage.

<!-- end of auto-generated comment: release notes by coderabbit.ai -->

---------

Signed-off-by: Carlos Villela <cvillela@nvidia.com>

Author: cv

src/lib/inference/onboard-host-docker-internal.test.ts

@@ -46,42 +46,46 @@ describe("host.docker.internal onboarding inference policy", () => {
     expect(result.message).toMatch(/host\.openshell\.internal:11435/);
   });
 
-  it("recognizes Windows-host Ollama tool calls returned through Docker stdout (#9116)", async () => {
-    const seenCommands: Array<{ command: string; args: readonly string[] }> = [];
-    const containerProbeSpawnSyncImpl = (
-      command: string,
-      args: readonly string[],
-    ): SpawnSyncReturns<string> => {
-      seenCommands.push({ command, args });
-      const body = JSON.stringify({
-        choices: [
-          {
-            message: {
-              tool_calls: [
-                {
-                  id: "call_1",
-                  type: "function",
-                  function: { name: "sessions_send", arguments: '{"message":"hello"}' },
-                },
-              ],
+  it.each([
+    ["required", true],
+    ["optional", false],
+  ] as const)(
+    "recognizes Windows-host Ollama tool calls when strict tool calling is %s (#9116)",
+    async (_label, requireChatCompletionsToolCalling) => {
+      const seenCommands: Array<{ command: string; args: readonly string[] }> = [];
+      const containerProbeSpawnSyncImpl = (
+        command: string,
+        args: readonly string[],
+      ): SpawnSyncReturns<string> => {
+        seenCommands.push({ command, args });
+        const body = JSON.stringify({
+          choices: [
+            {
+              message: {
+                tool_calls: [
+                  {
+                    id: "call_1",
+                    type: "function",
+                    function: { name: "sessions_send", arguments: '{"message":"hello"}' },
+                  },
+                ],
+              },
             },
-          },
-        ],
-      });
-      const writeOutIndex = args.indexOf("-w");
-      const writeOut = args[writeOutIndex + 1];
-      const stdout = `${body}${writeOut.replace("%{http_code}", "200")}`;
-      return {
-        pid: 123,
-        output: [stdout, ""],
-        stdout,
-        stderr: "",
-        status: 0,
-        signal: null,
+          ],
+        });
+        const writeOutIndex = args.indexOf("-w");
+        const writeOut = args[writeOutIndex + 1];
+        const stdout = `${body}${writeOut.replace("%{http_code}", "200")}`;
+        return {
+          pid: 123,
+          output: [stdout, ""],
+          stdout,
+          stderr: "",
+          status: 0,
+          signal: null,
+        };
       };
-    };
 
-    for (const requireChatCompletionsToolCalling of [true, false]) {
       const result = await probeOpenAiLikeEndpointOptimized(
         "http://host.docker.internal:11434/v1",
         "openai/nemotron-mini",
@@ -99,15 +103,15 @@ describe("host.docker.internal onboarding inference policy", () => {
         api: "openai-completions",
         label: "Chat Completions API",
       });
-    }
-    expect(seenCommands).toHaveLength(2);
-    seenCommands.forEach(({ command, args }) => {
-      expect(command).toBe("docker");
-      expect(args).toContain("curlimages/curl:8.10.1");
-      expect(args).toContain("http://host.docker.internal:11434/v1/chat/completions");
-      expect(args).not.toContain("--volume");
-    });
-  });
+      expect(seenCommands).toHaveLength(1);
+      seenCommands.forEach(({ command, args }) => {
+        expect(command).toBe("docker");
+        expect(args).toContain("curlimages/curl:8.10.1");
+        expect(args).toContain("http://host.docker.internal:11434/v1/chat/completions");
+        expect(args).not.toContain("--volume");
+      });
+    },
+  );
 
   it.each([
     {

src/lib/onboard/machine/definition.test.ts

@@ -28,6 +28,10 @@ const expectedStateOrder = [
   "failed",
 ];
 
+const progressStateDefinitions = ONBOARD_MACHINE_STATE_DEFINITIONS.flatMap((definition) =>
+  "progress" in definition ? [definition] : [],
+);
+
 describe("onboard machine definition", () => {
   it("is the canonical ordered state catalog", () => {
     expect(ONBOARD_MACHINE_STATE_IDS).toEqual(expectedStateOrder);
@@ -76,16 +80,16 @@ describe("onboard machine definition", () => {
     expect(ONBOARD_SESSION_STEP_TO_MACHINE_STATE).toEqual(mappingFromDefinitions);
   });
 
-  it("keeps progress metadata attached only to state-backed steps", () => {
-    for (const definition of ONBOARD_MACHINE_STATE_DEFINITIONS) {
-      if (!("progress" in definition)) continue;
+  it.each(progressStateDefinitions)(
+    "keeps progress metadata attached to state-backed step $state",
+    (definition) => {
       expect("stepName" in definition).toBe(true);
       expect(definition.progress.total).toBe(8);
       expect(definition.progress.number).toBeGreaterThanOrEqual(1);
       expect(definition.progress.number).toBeLessThanOrEqual(definition.progress.total);
       expect(definition.progress.title).not.toHaveLength(0);
-    }
-  });
+    },
+  );
 
   it("looks up definitions by state", () => {
     expect(getOnboardMachineStateDefinition("gateway")).toMatchObject({

src/lib/onboard/machine/progress.test.ts

@@ -10,13 +10,17 @@ import { getOnboardProgressStep, ONBOARD_PROGRESS_STEPS } from "./progress";
 
 vi.mock("../prompt-helpers", () => ({ step: vi.fn() }));
 
+const progressStateDefinitions = ONBOARD_MACHINE_STATE_DEFINITIONS.flatMap((definition) =>
+  "progress" in definition ? [definition] : [],
+);
+
 describe("onboard progress metadata", () => {
-  it("derives state-backed progress labels from machine definitions", () => {
-    for (const definition of ONBOARD_MACHINE_STATE_DEFINITIONS) {
-      if (!("progress" in definition)) continue;
+  it.each(progressStateDefinitions)(
+    "derives the $state progress label from its machine definition",
+    (definition) => {
       expect(ONBOARD_PROGRESS_STEPS[definition.stepName]).toEqual(definition.progress);
-    }
-  });
+    },
+  );
 
   it("preserves the existing eight-step onboarding labels", () => {
     expect(ONBOARD_PROGRESS_STEPS).toEqual({

src/lib/onboard/managed-startup-profile.test.ts

@@ -28,6 +28,9 @@ import {
 } from "./managed-startup/profile";
 
 const CA_SHA256 = "a".repeat(64);
+const HERMES_RESERVED_API_PORTS = [
+  8_642, 8_643, 8_644, 8_645, 8_646, 8_647, 8_648, 8_649, 8_650, 8_651, 8_652, 18_642,
+];
 
 const MESSAGING_PLAN = {
   schemaVersion: 1,
@@ -1138,20 +1141,18 @@ describe("managed startup profile", () => {
     ).toThrow(/reserved API ports 8642-8652 or 18642/);
   });
 
-  it.each(
-    Array.from([HERMES_API_PORT_RANGE_START - 1, HERMES_API_PORT_RANGE_END + 1], (value) => [
-      value,
-    ]),
-  )("rejects port %s outside the reserved Hermes API port range", (port) => {
-    for (let port = HERMES_API_PORT_RANGE_START; port <= HERMES_API_PORT_RANGE_END; port += 1) {
+  it.each(HERMES_RESERVED_API_PORTS)("rejects reserved Hermes API port %s", (port) => {
       expect(() =>
         validateManagedStartupProfile({
           ...HERMES_PROFILE,
           dashboard: { ...HERMES_PROFILE.dashboard, publicPort: port },
         }),
       ).toThrow(/reserved API ports/);
-    }
+  });
 
+  it.each([HERMES_API_PORT_RANGE_START - 1, HERMES_API_PORT_RANGE_END + 1])(
+    "accepts dashboard port %s outside the reserved Hermes API port range",
+    (port) => {
     expect(() =>
       validateManagedStartupProfile({
         ...HERMES_PROFILE,
@@ -1162,7 +1163,8 @@ describe("managed startup profile", () => {
         },
       }),
     ).not.toThrow();
-  });
+    },
+  );
 
   it.each([
     "-----BEGIN CERTIFICATE-----\nMIIB\n-----END CERTIFICATE-----",

test/channels-add-preset.test.ts

@@ -861,19 +861,15 @@ describe("channels add verifies bridge startup after rebuild (#4314, #4390)", ()
 });
 
 describe("channel preset source-of-truth", () => {
-  it("every channel registered in KNOWN_CHANNELS ships a preset YAML that parsePresetPolicyKeys() accepts", () => {
-    const failures: string[] = [];
-    for (const name of knownChannelNames()) {
+  it.each(knownChannelNames())(
+    "channel $name ships a preset that parsePresetPolicyKeys accepts",
+    (name) => {
       const content = policies.loadPreset(name);
-      if (content === null) {
-        failures.push(`${name}: preset YAML not found on disk`);
-        continue;
-      }
-      if (policies.parsePresetPolicyKeys(content).length === 0) {
-        failures.push(`${name}: parsePresetPolicyKeys returned no entries`);
-      }
-    }
-
-    expect(failures).toEqual([]);
-  });
+      expect(content, `${name}: preset YAML not found on disk`).not.toBeNull();
+      expect(
+        policies.parsePresetPolicyKeys(content!).length,
+        `${name}: parsePresetPolicyKeys returned no entries`,
+      ).toBeGreaterThan(0);
+    },
+  );
 });

test/cli-oclif-compatibility.test.ts

@@ -481,30 +481,24 @@ describe("oclif compatibility dispatch", () => {
     }
   });
 
-  it("corrects a single sandbox-like global status argument without a CLI subprocess", async () => {
-    await withDirectPublicDispatch(
-      async ({ dispatchCli, exitSpy, runOclifArgv, runOclifCommandById, stderr }) => {
-        const cases = [
-          { argv: ["status", "alpha"], command: "nemoclaw alpha status" },
-          { argv: ["status", "--json", "alpha"], command: "nemoclaw alpha status --json" },
-          { argv: ["status", "alpha", "--json"], command: "nemoclaw alpha status --json" },
-          { argv: ["status", "alpha", "--help"], command: "nemoclaw alpha status --help" },
-          {
-            argv: ["status", "alpha", "--json", "--help"],
-            command: "nemoclaw alpha status --help",
-          },
-          {
-            argv: ["status", "alpha", "--help", "--json"],
-            command: "nemoclaw alpha status --help",
-          },
-        ];
-
-        for (const { argv, command } of cases) {
-          stderr.length = 0;
-          exitSpy.mockClear();
-          runOclifArgv.mockClear();
-          runOclifCommandById.mockClear();
-
+  it.each([
+    { argv: ["status", "alpha"], command: "nemoclaw alpha status" },
+    { argv: ["status", "--json", "alpha"], command: "nemoclaw alpha status --json" },
+    { argv: ["status", "alpha", "--json"], command: "nemoclaw alpha status --json" },
+    { argv: ["status", "alpha", "--help"], command: "nemoclaw alpha status --help" },
+    {
+      argv: ["status", "alpha", "--json", "--help"],
+      command: "nemoclaw alpha status --help",
+    },
+    {
+      argv: ["status", "alpha", "--help", "--json"],
+      command: "nemoclaw alpha status --help",
+    },
+  ])(
+    "corrects a single sandbox-like global status argument to $command",
+    async ({ argv, command }) => {
+      await withDirectPublicDispatch(
+        async ({ dispatchCli, exitSpy, runOclifArgv, runOclifCommandById, stderr }) => {
           await expect(dispatchCli(argv)).rejects.toThrow("process.exit:2");
 
           const output = stderr.join("\n");
@@ -514,32 +508,26 @@ describe("oclif compatibility dispatch", () => {
           expect(exitSpy).toHaveBeenCalledWith(2);
           expect(runOclifArgv).not.toHaveBeenCalled();
           expect(runOclifCommandById).not.toHaveBeenCalled();
-        }
-      },
-    );
-  });
-
-  it("leaves ambiguous or unsafe global status arguments to the strict parser", async () => {
-    await withDirectPublicDispatch(
-      async ({ dispatchCli, exitSpy, runOclifArgv, runOclifCommandById, stderr }) => {
-        const cases = [
-          ["status", "--bogus"],
-          ["status", "--bogus", "alpha"],
-          ["status", "alpha", "--bogus"],
-          ["status", "alpha", "beta"],
-          ["status", "status"],
-          ["status", "help"],
-          ["status", "sandbox"],
-          ["status", "internal"],
-          ["status", "alpha;echo pwned"],
-        ];
-
-        for (const argv of cases) {
-          stderr.length = 0;
-          exitSpy.mockClear();
-          runOclifArgv.mockClear();
-          runOclifCommandById.mockClear();
+        },
+      );
+    },
+  );
 
+  it.each([
+    ["status", "--bogus"],
+    ["status", "--bogus", "alpha"],
+    ["status", "alpha", "--bogus"],
+    ["status", "alpha", "beta"],
+    ["status", "status"],
+    ["status", "help"],
+    ["status", "sandbox"],
+    ["status", "internal"],
+    ["status", "alpha;echo pwned"],
+  ])(
+    "leaves ambiguous or unsafe global status arguments to the strict parser [%j]",
+    async (...argv) => {
+      await withDirectPublicDispatch(
+        async ({ dispatchCli, exitSpy, runOclifArgv, runOclifCommandById, stderr }) => {
           await dispatchCli(argv);
 
           expect(runOclifCommandById).toHaveBeenCalledWith(
@@ -551,30 +539,35 @@ describe("oclif compatibility dispatch", () => {
           expect(exitSpy).not.toHaveBeenCalled();
           expect(stderr.join("\n")).not.toContain("does not take a sandbox name");
           expect(stderr.join("\n")).not.toContain("Run:");
-        }
-      },
-    );
-  });
-
-  it.each(["status", "help", "sandbox", "internal", "alpha;echo pwned"])(
-    "keeps strict status parser errors in process [%s]",
-    async (token) => {
-      for (const args of [["--bogus"], ["--bogus", "alpha"], ["alpha", "--bogus"]]) {
-        await expect(StatusCommand.run(args, process.cwd())).rejects.toThrow(
-          "Nonexistent flag: --bogus",
-        );
-      }
+        },
+      );
+    },
+  );
 
-      await expect(StatusCommand.run(["alpha", "beta"], process.cwd())).rejects.toThrow(
-        "Unexpected arguments: alpha, beta",
+  it.each([["--bogus"], ["--bogus", "alpha"], ["alpha", "--bogus"]])(
+    "keeps strict status flag errors in process [%j]",
+    async (...args) => {
+      await expect(StatusCommand.run(args, process.cwd())).rejects.toThrow(
+        "Nonexistent flag: --bogus",
       );
+    },
+  );
 
+  it.each(["status", "help", "sandbox", "internal", "alpha;echo pwned"])(
+    "keeps strict status argument errors in process [%s]",
+    async (token) => {
       await expect(StatusCommand.run([token], process.cwd())).rejects.toThrow(
         `Unexpected argument: ${token}`,
       );
     },
   );
 
+  it("keeps multiple strict status arguments in process", async () => {
+    await expect(StatusCommand.run(["alpha", "beta"], process.cwd())).rejects.toThrow(
+      "Unexpected arguments: alpha, beta",
+    );
+  });
+
   it("routes sandbox status help directly and keeps its JSON help metadata", async () => {
     await withDirectPublicDispatch(async ({ dispatchCli, runOclifArgv, runOclifCommandById }) => {
       await dispatchCli(["alpha", "status", "--help"]);