diff --git a/.github/workflows/testbox.yml b/.github/workflows/testbox.yml
index d18c0028a..6c5bd3a12 100644
--- a/.github/workflows/testbox.yml
+++ b/.github/workflows/testbox.yml
@@ -2,7 +2,7 @@
 # (scripts/goport/testbox.sh). `blacksmith testbox warmup` dispatches this workflow, `testbox run` syncs
 # the working tree to it and runs one command. The setup matches the Linux test job of ci.yml, with
 # zbook's toolchains. Sticky disks keep target/ and the cargo registry warm between testboxes.
-# A pull request that changes this file runs it in validation mode (no testbox_id).
+# A pull request that changes this file, testbox-data.sh or testbox-data.txt runs it in validation mode (no testbox_id).
 name: Blacksmith Testbox
 
 on:
@@ -15,6 +15,8 @@ on:
   pull_request:
     paths:
       - ".github/workflows/testbox.yml"
+      - "scripts/goport/testbox-data.sh"
+      - "scripts/goport/testbox-data.txt"
 
 permissions:
   contents: read
@@ -42,7 +44,10 @@ jobs:
       - uses: actions/checkout@v5
         with:
           persist-credentials: false
-      # After checkout: its clean step would empty a disk mounted in the workspace.
+      # After checkout: its clean step would empty a disk mounted in the workspace. A sticky disk commits only
+      # when the job ends with no failed or cancelled step: the idle timeout end requests a commit (testbox.sh
+      # release; not every request lands, see scripts/goport/README.md), `blacksmith testbox stop` cancels the
+      # job and does not (testbox.sh stop).
       - uses: useblacksmith/stickydisk@v1
         with:
           key: ts-rust-testbox-target
@@ -51,6 +56,10 @@ jobs:
         with:
           key: ts-rust-testbox-cargo
           path: ~/.cargo/registry
+      # np-suite needs Node 22 or newer; npm ci below needs node.
+      - uses: actions/setup-node@v5
+        with:
+          node-version: 24
       # main's Go pin is the saved state's batch.upstreamPin.to (AGENTS.md, "Pin"). The Go checkout sits
       # outside the workspace, so a sync of the local tree does not touch it.
       - name: Resolve the Go pin
@@ -71,19 +80,17 @@ jobs:
           key: ts-rust-testbox-pin-${{ steps.pin.outputs.key }}
           path: ~/goport-data/pin
           commit: on-change
+      # The whole repo, not only the Go subdir: np-suite reads packages/typescript and the root node_modules.
       - name: Check out the pinned Go source
         uses: actions/checkout@v5
         with:
           repository: ${{ steps.pin.outputs.repo }}
           ref: ${{ steps.pin.outputs.commit }}
           path: go-pin
-          sparse-checkout: ${{ steps.pin.outputs.subdir }}
           persist-credentials: false
-      - name: Install the Go repo's typescript package
+      - name: Install the Go repo's node_modules
         run: |
-          url=$(jq -r '.packages["node_modules/typescript"].resolved' go-pin/package-lock.json)
-          mkdir -p go-pin/node_modules/typescript
-          curl -sSfL "$url" | tar xz -C go-pin/node_modules/typescript --strip-components=1
+          (cd go-pin && npm ci --ignore-scripts --no-audit --no-fund --loglevel=error)
           mv go-pin "$HOME/go-pin"
       - uses: actions/setup-go@v6
         with:
@@ -109,7 +116,7 @@ jobs:
           SUBDIR: ${{ steps.pin.outputs.subdir }}
         run: |
           cat > "$HOME/testbox.env" <<EOF
-          export PATH="$(dirname "$(command -v go)"):$HOME/.cargo/bin:\$PATH"
+          export PATH="$(dirname "$(command -v go)"):$(dirname "$(command -v node)"):$HOME/.cargo/bin:\$PATH"
           export CARGO_TERM_COLOR=always
           export TS_GO_REPO="$HOME/go-pin${SUBDIR:+/$SUBDIR}"
           export TSCTEST_TMP="$RUNNER_TEMP/tsctest"
diff --git a/scripts/goport/README.md b/scripts/goport/README.md
index 3bb43552b..8dc33e5ff 100644
--- a/scripts/goport/README.md
+++ b/scripts/goport/README.md
@@ -288,3 +288,72 @@ revision evidence (`remote.sh help`, "Reserved"): timing that needs zbook-class
 - mini-abf9 is Theo's own machine again since 2026-10-04. `remote.sh` refuses every command on it.
 - dbook-lan and mini-743d: `sudo -n`, perf_event_paranoid 4 (use `sudo perf`), THP madvise, and
   perf, bpftrace and strace installed.
+
+## Blacksmith testboxes
+
+`testbox.sh` runs builds, the protected suites, the gate and the oracle batteries on a warm Blacksmith
+runner (32 vCPU, 124 GB RAM), not on zbook or the SSH hosts. `.github/workflows/testbox.yml` sets up the
+testbox, `testbox-data.sh` makes zbook's paths there, and `testbox-remote.sh` holds the steps of `tests`,
+`np-suite` and `pin`. `testbox.sh help` gives the usage.
+
+```sh
+scripts/goport/testbox.sh warmup                                # about 1 min; TESTBOX_REF=<branch> for a workflow change
+scripts/goport/testbox.sh tests <out-dir> <base results.json>   # build-goport-tests.sh, goport-tests.sh, compare-tests.py
+scripts/goport/testbox.sh np-suite <label> [<base label>]       # np-suite.sh run, then np-suite.sh diff
+scripts/goport/testbox.sh push <bins dir>                       # then run gate.sh, lsp_oracle.py or api_oracle.py as on zbook,
+                                                                 # from the zbook path, so the manifest names the same scripts:
+                                                                 # run bash -c 'cd /home/theo/Code/sandbox/ts-rust && GOPORT_PIN=<pin> bash scripts/goport/gate.sh ...'
+scripts/goport/testbox.sh get <remote> [<local>]                # rsync a result back
+scripts/goport/testbox.sh stop                                  # or release (see "Sticky disks")
+```
+
+- Warmup: bubblewrap, psutil, Node 24, Go, Rust 1.93.0 and the nightly, and zbook's paths
+  (`testbox-data.sh mount`):
+  - The workspace is bound on `/home/theo/Code/sandbox/ts-rust`, and the testbox env sets
+    `HOME=/home/theo`.
+  - The whole checkout of the batch pin, with `npm ci` node_modules, is bound on its zbook path.
+  - Each path of `testbox-data.txt` is bound from its sticky disk.
+  - `pin.py exec` binds the pin over the default oracle and goCheckout paths. bwrap makes those bind targets.
+- Data: `testbox-data.txt` lists the zbook files that the gate and the LSP and API oracles read and git does
+  not hold. Disk `ts-rust-testbox-inputs` holds the files that are the same for every pin: the project inputs,
+  the runner trees and the corpus. Disk `ts-rust-testbox-pin-<key>` holds the pin cache, the LSP and API
+  goldens and the pin oracle. `testbox.sh seed [inputs|pin]` copies them from zbook (30 to 35 minutes; a
+  rerun copies only what is missing). Then `release`.
+- Oracles: `pin.py` checks the sha256 of the pin oracle, and a build on the runner has another sha256 (Go
+  puts absolute paths in the binary). So the testbox uses zbook's recorded binary from the pin disk.
+  `tests` compares the testbox's copy with UPSTREAM.json and pushes zbook's binary when they differ.
+- Git: the sync sends files, not git state. `tests` needs HEAD on origin: the testbox fetches it and resets
+  its index to it, so `build-goport-tests.sh` sees a clean tree at HEAD. Before a gate, fetch the commit
+  that the bins name (`run git fetch --depth=1 origin <sha>`).
+- Other pins: `testbox.sh pin KEY` checks out a pin of this worktree's UPSTREAM.json (microsoft/TypeScript
+  pins only), for example bump D fed0bf24149f from a bump D worktree. Then
+  `testbox.sh tests --pin KEY <out-dir> <base results.json>` or `testbox.sh np-suite --pin KEY <label>`.
+  The pin disk holds only the batch pin's files. `tests --pin` pushes the other pin's oracle to that
+  testbox only.
+- Output: `tests` writes `<out-dir>/tests-run` (results.json, logs, tsv, track), `<out-dir>/testbin` (the
+  metadata, no binaries) and `<out-dir>/compare.json`. After a failed build it writes the cargo logs to
+  `<out-dir>/testbin.new/logs` and prints the compiler errors. `np-suite` writes the label dir in the main
+  checkout's np-suite dir. Neither replaces an existing dir.
+- Activity: the idle timer reads the marker `/home/runner/.testbox-last-activity`. The CLI touches it at
+  the start and the end of each `run`. `testbox.sh` runs the command in a subshell, so the
+  `HOME=/home/theo` of the testbox env does not move the end touch. The timer does not see the SSH route
+  of `push`, `get` and the `tests` poll. So `push` and `seed` touch the marker every minute, and the
+  `tests` and `np-suite` jobs every 30 s.
+- Sticky disks: `target/` and the cargo registry, and the inputs and pin disks. The inputs and pin disks
+  commit only when a file changed (`commit: on-change`), so a testbox that only reads them does not commit an
+  older copy. A sticky disk commits only when the job ends with no failed or cancelled step. `stop` cancels the
+  job, so its writes are lost. `release` forgets the testbox, which ends at its idle timeout
+  (`TESTBOX_IDLE`, default 15 minutes) and requests a commit.
+  - Not every requested commit lands. On 2026-10-10, five testboxes that lived 2 to 13 minutes committed,
+    up to 2.1 GiB (a warm target after `tests` and `np-suite`). One that lived 27 minutes (10 to 15 idle
+    minutes at the end, no `stop`) requested a 2 GiB commit that never landed. The cause is not known: a
+    39-minute testbox of another session probably did commit.
+  - `TESTBOX_IDLE=1` with a release right after the last command gave commits that landed. Only `tests`,
+    `np-suite`, `push` and `seed` keep a testbox alive: with a short idle timeout, a `run` or `pin` command
+    longer than about 6 minutes is cut off (the VM waits at most 290 s for SSH sessions, then shuts down).
+    `TESTBOX_ID=<id> testbox.sh status` shows the end.
+  - The last commit wins, across branches too: every branch uses the same disk keys.
+- Times (2026-10-10, cold target): `tests` 502 s (test bins 3.6 min, suite 4.7 min), `np-suite` 112 s. With
+  the R189 bins: the full gate 8.4 min, the LSP batteries 3 min, the API batteries 1 min.
+- Not on testboxes yet: `candidate.sh side` and `perf.sh`. Revision evidence stays on dbook-lan and timing on
+  mini-743d.
diff --git a/scripts/goport/testbox-data.sh b/scripts/goport/testbox-data.sh
index b4a41617c..ac29f1944 100755
--- a/scripts/goport/testbox-data.sh
+++ b/scripts/goport/testbox-data.sh
@@ -36,7 +36,7 @@ case "$1" in
       else mkdir -p "$(dirname "$src")" "$(dirname "$dest")"; touch "$src" "$dest"; fi
       sudo mount --bind "$src" "$dest"
     done < <(paths)
-    # The workflow checks out only the pin's Go subdir, at ~/go-pin.
+    # The workflow checks out the whole Go repo at ~/go-pin (np-suite needs packages/ and node_modules).
     go=$(jq -r '(.subdir // "") as $s | .goCheckout | if $s == "" then . else rtrimstr("/" + $s) end' <<<"$pin")
     mkdir -p "$go" "$REPO"
     sudo mount --bind "$HOME/go-pin" "$go"
diff --git a/scripts/goport/testbox-remote.sh b/scripts/goport/testbox-remote.sh
new file mode 100755
index 000000000..465e0c6f5
--- /dev/null
+++ b/scripts/goport/testbox-remote.sh
@@ -0,0 +1,153 @@
+#!/usr/bin/env bash
+# The testbox side of testbox.sh. Each command runs on a Blacksmith testbox in the synced repo root, through
+# `blacksmith testbox run`. The workflow has set up zbook's paths (testbox-data.sh mount): the workspace is
+# bound on /home/theo/Code/sandbox/ts-rust, the batch pin's Go checkout (with node_modules) on its zbook path,
+# the pin oracle and the other files of testbox-data.txt on theirs, and the testbox env sets HOME=/home/theo.
+# usage: testbox-remote.sh pin [KEY...]            the Go checkout of each pin at its zbook path, at the pin commit,
+#                                                  with npm ci node_modules (default: the batch pin, which the
+#                                                  workflow checks out)
+#        testbox-remote.sh start RUN STEP ARGS...  run `testbox-remote.sh STEP ARGS...` detached from the SSH session:
+#                                                  output in RUN.log, then its exit code in RUN.rc. The job counts as
+#                                                  testbox activity (the idle timer does not end the testbox under it)
+#        testbox-remote.sh tests KEY COMMIT RUN    build-goport-tests.sh at COMMIT, goport-tests.sh at pin KEY,
+#                                                  pack the results and logs in RUN/out.tar.gz (after a failed build,
+#                                                  its cargo logs in testbin.new/logs)
+#        testbox-remote.sh np-suite KEY LABEL RUN  a stable release tsgo, np-suite.sh run LABEL at pin KEY, pack
+#                                                  the label dir in RUN/out.tar.gz, then remove the label dir
+#                                                  (after a failed build, only its build.log)
+# pin.py exec binds a pin's oracle and Go checkout over the default ones; bwrap makes those bind targets.
+# Only microsoft/TypeScript pins (layout typescript) are set up: the older layout needs the TypeScript submodule.
+set -euo pipefail
+case "${1:-help}" in help | -h | --help) sed -n '2,/^set -euo/p' "$0" | sed '$d'; exit 0 ;; esac
+
+# zbook's main checkout: the root of the absolute paths in UPSTREAM.json (pinRoot) and np-suite.sh.
+ZBOOK_REPO=/home/theo/Code/sandbox/ts-rust
+die() { echo "testbox-remote.sh: $*" >&2; exit 1; }
+cd "$(git -C "$(dirname -- "${BASH_SOURCE[0]}")" rev-parse --show-toplevel)"
+pin() { python3 scripts/upstream/pin.py "$@"; }
+batch_pin() { jq -r '.batch.upstreamPin.to // empty' docs/typechecker-state/current.json; }
+
+# on_testbox: the workspace must be bound on $ZBOOK_REPO (testbox-data.sh mount). On zbook $ZBOOK_REPO is the
+# main checkout itself, and `tests` must not move its HEAD (at_commit).
+on_testbox() {
+  [[ $PWD != "$ZBOOK_REPO" && $ZBOOK_REPO -ef $PWD ]] ||
+    die "not on a testbox: $ZBOOK_REPO is not a bind of $PWD (testbox-data.sh mount)"
+}
+
+# checkout KEY: the whole pin checkout at its zbook path, at the pin commit, with the root node_modules
+# (astnav tests and np-suite run node on them).
+checkout() {
+  local rec repo commit go dir
+  rec=$(pin show "$1") || die "unknown pin $1"
+  [[ $(jq -r .layout <<< "$rec") == typescript ]] || die "pin $1: layout $(jq -r .layout <<< "$rec"), not typescript"
+  repo=$(jq -r .repo <<< "$rec") commit=$(jq -r .commit <<< "$rec") go=$(jq -r .goCheckout <<< "$rec")
+  dir=${go%/"$(jq -r .subdir <<< "$rec")"}
+  [[ $dir == /home/theo/.explore/repos/?* ]] || die "pin $1: checkout $dir is not under /home/theo/.explore/repos"
+  if [[ $(git -C "$dir" rev-parse HEAD 2> /dev/null) == "$commit" && -f $dir/node_modules/typescript/package.json ]]; then
+    echo "pin $1: $dir ready"
+    return
+  fi
+  # The workflow binds its checkout of the batch pin here: never empty it.
+  ! mountpoint -q "$dir" || die "pin $1: the workflow's checkout at $dir is not at ${commit:0:12} with node_modules"
+  rm -rf "$dir"
+  git init -q "$dir"
+  git -C "$dir" fetch -q --depth=1 "https://github.com/$repo" "$commit"
+  git -C "$dir" -c advice.detachedHead=false checkout -q FETCH_HEAD
+  (cd "$dir" && npm ci --ignore-scripts --no-audit --no-fund --loglevel=error)
+  [[ -d $go/testdata/baselines/reference ]] || die "pin $1: no $go/testdata/baselines/reference"
+  echo "pin $1: $dir at ${commit:0:12}, $(ls "$dir/node_modules" | wc -l) node_modules"
+}
+
+# at_commit COMMIT: HEAD and the index at COMMIT, the synced files kept (the sync sends files, not git state).
+at_commit() {
+  [[ $(git rev-parse HEAD) != "$1" ]] || return 0
+  git cat-file -e "$1^{commit}" 2> /dev/null || git fetch -q --depth=1 origin "$1" ||
+    die "commit $1 is not on origin: push it first"
+  git reset -q "$1"
+}
+
+cmd=$1
+shift
+case $cmd in
+  start)
+    (($# >= 2)) || die "usage: start RUN STEP ARGS..."
+    [[ ! -e $1.log ]] || die "$1.log exists"
+    mkdir -p "$(dirname "$1")"
+    # A dropped SSH session must not stop a long job (one dropped after 170 s on 2026-10-10).
+    setsid nohup "$0" job "$@" > /dev/null 2>&1 < /dev/null &
+    echo "started $1"
+    ;;
+  job)
+    run=$1
+    shift
+    # run-testbox resets its idle timer when this file is newer than the last activity. It is in the login
+    # home (/home/runner), not in ~: the testbox env sets HOME=/home/theo. The keepalive ends with this
+    # shell, so a killed job lets the testbox end at its idle timeout and the local poll stop.
+    marker=$(getent passwd "$(id -u)" | cut -d: -f6)/.testbox-last-activity
+    (while sleep 30 && kill -0 "$$" 2> /dev/null; do touch "$marker"; done) &
+    keep=$!
+    # RUN.rc is written on every exit. It stays 1 when the job shell itself is killed.
+    rc=1
+    trap 'kill "$keep" 2> /dev/null || true; echo "$rc" > "$run.rc"' EXIT
+    if "$0" "$@" > "$run.log" 2>&1 < /dev/null; then rc=0; else rc=$?; fi
+    ;;
+  pin)
+    on_testbox
+    (($#)) || { k=$(batch_pin); [[ -z $k ]] || set -- "$k"; }
+    (($#)) || echo "no batch pin in docs/typechecker-state/current.json: no pin checkout (testbox.sh pin KEY sets one up)"
+    for k in "$@"; do checkout "$k"; done
+    ;;
+  tests)
+    (($# == 3)) || die "usage: tests KEY COMMIT RUN"
+    key=$1 commit=$2 run=$3
+    [[ ! -e $run ]] || die "$run exists"
+    # First: it refuses to run on zbook before at_commit moves HEAD.
+    on_testbox
+    at_commit "$commit"
+    checkout "$key"
+    mkdir -p "$run"
+    rc=0
+    echo "build-goport-tests.sh at ${commit:0:12} ($(date -u +%T))"
+    scripts/goport/build-goport-tests.sh "$PWD" "$run/testbin" > "$run/build.log" 2>&1 || rc=$?
+    # Not the bare DONE line: a driver log that ends in DONE or FAIL must not match it early.
+    tail -2 "$run/build.log" | grep -vx DONE || true
+    if ((rc == 0)); then
+      echo "goport-tests.sh at pin $key ($(date -u +%T))"
+      GOPORT_PIN=$key scripts/goport/goport-tests.sh "$run/testbin" "$run/tests-run" > "$run/tests.log" 2>&1 || rc=$?
+      grep -E '^[a-z_0-9-]+: [0-9]+ names|^incomplete:' "$run/tests.log" || true
+      tail -1 "$run/tests.log"
+    fi
+    # Not the test binaries, the release bins, the crates archive (tests-run/src) or the runner temp. A failed
+    # build leaves its cargo logs (the compiler errors) in testbin.new/logs.
+    (cd "$run" && for f in build.log tests.log testbin/* testbin.new/logs tests-run/*; do
+      case $f in testbin/relbin | tests-run/src | tests-run/tmp) continue ;; esac
+      if [[ -d $f || (-f $f && ! -x $f) ]]; then echo "$f"; fi
+    done) > "$run/pack.list"
+    tar -C "$run" -czf "$run/out.tar.gz" -T "$run/pack.list"
+    echo "packed $run/out.tar.gz ($(du -h "$run/out.tar.gz" | cut -f1)); rc $rc ($(date -u +%T))"
+    exit "$rc"
+    ;;
+  np-suite)
+    (($# == 3)) || die "usage: np-suite KEY LABEL RUN"
+    key=$1 label=$2 run=$3
+    [[ ! -e $run ]] || die "$run exists"
+    on_testbox
+    checkout "$key"
+    mkdir -p "$run"
+    # Stable and not incremental, as candidate.sh builds release bins.
+    TS_CARGO_NIGHTLY=0 TS_CARGO_INCREMENTAL=0 scripts/run-cargo-capped.sh build --release --locked -p ts_goport --bin tsgo \
+      > "$run/build.log" 2>&1 || {
+      tail -20 "$run/build.log"
+      tar -czf "$run/out.tar.gz" -C "$run" build.log
+      die "tsgo build failed"
+    }
+    np=target/continuation-r97-goport/compat-backlog/np-suite
+    rc=0
+    NP_GO_DIR=$(pin path goCheckout "$key") scripts/goport/np-suite.sh run "$label" "$PWD/target/release/tsgo" || rc=$?
+    tar -czf "$run/out.tar.gz" -C "$run" build.log -C "$PWD/$np" "$label"
+    # The local copy is the record: the sticky target/ keeps no label dirs.
+    rm -rf "${np:?}/${label:?}"
+    exit "$rc"
+    ;;
+  *) die "unknown command $cmd (testbox-remote.sh help)" ;;
+esac
diff --git a/scripts/goport/testbox.sh b/scripts/goport/testbox.sh
index f65940810..fd8d0d0cc 100755
--- a/scripts/goport/testbox.sh
+++ b/scripts/goport/testbox.sh
@@ -1,7 +1,8 @@
 #!/usr/bin/env bash
 # Blacksmith testboxes: a warm 32 vCPU Linux x64 runner (.github/workflows/testbox.yml) that runs a command
 # against this worktree's files. `run` syncs this worktree to the testbox (the CLI's rsync) and runs the
-# command in the synced repo root. target/ and the cargo registry sit on sticky disks.
+# command in the synced repo root. target/, the cargo registry and the files of testbox-data.txt sit on
+# sticky disks.
 # usage: testbox.sh help                      this text
 #        testbox.sh warmup                    start a testbox; saves its ID to target/testbox-id
 #        testbox.sh run <command...>          sync this worktree, then run the command with the testbox env
@@ -12,21 +13,45 @@
 #        testbox.sh push <path>...            copy zbook files or dirs to the same absolute paths (e.g. a bins dir)
 #        testbox.sh seed [inputs|pin]...      copy the files of testbox-data.txt (default both disks) to their
 #                                             sticky disks (30 to 35 minutes; a rerun copies only what is
-#                                             missing). Then let the testbox end on its
-#                                             idle timeout: a stopped job is cancelled, and a cancelled job does
-#                                             not commit its sticky disks
-#        testbox.sh status | stop | list      the saved testbox's status, stop it (no sticky disk commit), list
+#                                             missing), then release: a stopped testbox does not commit them
+#        testbox.sh status | list             the saved testbox's status, list active testboxes
+#        testbox.sh stop                      end the saved testbox now. stop cancels the job, and the sticky disks
+#                                             do not commit after a cancelled step: the writes to them are lost
+#        testbox.sh release                   forget the saved testbox: it ends at its idle timeout (TESTBOX_IDLE
+#                                             minutes after the last command), and that end requests a commit of the
+#                                             sticky disks. Use it after a cold build or a seed. Commits of
+#                                             testboxes that lived 2 to 13 minutes landed (up to 2.1 GiB); those of two
+#                                             that lived 25 and 27 minutes did not. For a commit, warm up with
+#                                             TESTBOX_IDLE=1 and release after the last command. `status` shows the end
+#        testbox.sh pin [KEY...]              check out each pin's Go repo at its zbook path, with npm ci node_modules
+#                                             (default: the batch pin, which warmup checks out). KEY comes from this
+#                                             worktree's UPSTREAM.json
+#        testbox.sh tests [--pin KEY] OUT BASE
+#                                             the protected test suite at HEAD: build-goport-tests.sh and
+#                                             goport-tests.sh on the testbox (pushes the pin oracle first when the
+#                                             testbox lacks it), fetch results.json and the logs to OUT (must not
+#                                             exist), print compare-tests.py BASE OUT. After a failed build, print its
+#                                             compiler errors (OUT/testbin.new/logs).
+#                                             HEAD must be pushed; crates/, Cargo.toml and Cargo.lock must be clean
+#        testbox.sh np-suite [--pin KEY] LABEL [BASE]
+#                                             a stable release tsgo and np-suite.sh run LABEL on the testbox, fetched to
+#                                             the main checkout's np-suite dir (LABEL must not exist), then
+#                                             np-suite.sh diff BASE LABEL
 # The gate and the oracles run as on zbook: the testbox env sets HOME=/home/theo and the workflow binds the
 # workspace on /home/theo/Code/sandbox/ts-rust (testbox-data.sh). Fetch a commit that the bins name before a
 # gate: run git fetch --depth=1 origin <sha>.
+# KEY defaults to the batch pin (docs/typechecker-state/current.json batch.upstreamPin.to).
 # TESTBOX_ID overrides the saved ID. TESTBOX_IDLE: idle minutes before the testbox stops (default 15).
 # TESTBOX_REF: the ref the workflow runs from (default main: the workflow must be on the default branch).
 # Auth: `blacksmith auth login` once per host (`blacksmith auth status` shows it).
+# scripts/goport/testbox-remote.sh holds the steps that run on the testbox.
 set -euo pipefail
 case "${1:-help}" in help | -h | --help) sed -n '2,/^set -euo/p' "$0" | sed '$d'; exit 0 ;; esac
 
 repo_root="$(git -C "$(dirname -- "${BASH_SOURCE[0]}")" rev-parse --show-toplevel)"
 id_file="$repo_root/target/testbox-id"
+# The synced repo root on the testbox, relative to the SSH login dir (/home/runner).
+remote_root=_work/ts-rust/ts-rust
 cd "$repo_root"
 
 saved_id() {
@@ -34,16 +59,30 @@ saved_id() {
   [[ -n "$id" ]] || { echo "no testbox: run 'testbox.sh warmup' or set TESTBOX_ID" >&2; exit 2; }
   echo "$id"
 }
+batch_pin() { jq -r '.batch.upstreamPin.to // empty' docs/typechecker-state/current.json; }
+
+# remote <command...>: sync this worktree, run the command in the testbox's repo root with the testbox env.
+remote() {
+  local remote_cmd
+  printf -v remote_cmd '%q ' "$@"
+  # A subshell: the CLI touches ~/.testbox-last-activity after the command in this shell, and testbox.env sets
+  # HOME=/home/theo. Outside the subshell that touch would miss the marker, and the idle time would count from
+  # the start of a long command.
+  blacksmith testbox run --id "$(saved_id)" "(. ~/testbox.env && $remote_cmd)"
+}
 
 # ssh_route: sets host and ssh for rsync over the CLI's own SSH route (port 64000 and the key that warmup
 # saves in ~/.blacksmith/testboxes/<id>; CLI 0.4.70, see `run --debug`). The login dir is /home/runner.
+# Commands over this route do not source the testbox env, and they read stdin: give them < /dev/null.
 ssh_route() {
   local id key
   id="$(saved_id)"
-  host="$(blacksmith testbox status --id "$id" | awk -v id="$id" '$1 == id {print $3}')"
+  # --wait: a testbox that is not ready yet has no IP, and its row has the workflow path in that column.
+  host="$(blacksmith testbox status --id "$id" --wait --wait-timeout 15m | awk -v id="$id" '$1 == id && $2 == "ready" {print $3}')"
   key="$HOME/.blacksmith/testboxes/$id/id_ed25519"
-  [[ -n "$host" && -f "$key" ]] || { echo "no SSH route to $id (host '$host', key $key)" >&2; exit 1; }
-  ssh="ssh -p 64000 -i $key -o IdentitiesOnly=yes -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null -o LogLevel=ERROR -o Compression=no"
+  # A host with a / would make rsync copy to a local path.
+  [[ -n "$host" && $host != */* && -f "$key" ]] || { echo "no SSH route to $id (host '$host', key $key)" >&2; exit 1; }
+  ssh="ssh -p 64000 -i $key -o IdentitiesOnly=yes -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null -o LogLevel=ERROR -o Compression=no -o ConnectTimeout=20"
 }
 
 # push_paths <path>...: rsync each path to the same path on the testbox.
@@ -63,10 +102,85 @@ push_paths() {
     if [[ -d "$p" ]]; then rsync -aH --mkpath --compress --compress-choice=zstd -e "$ssh" "$p/" "runner@$host:$p/"
     else rsync -aHL --mkpath --inplace --compress --compress-choice=zstd -e "$ssh" "$p" "runner@$host:$p"; fi
   done
+  # A caller can run on for minutes (tests): stop the keepalive now.
+  kill "$keep" 2>/dev/null || true
+  trap - EXIT
+}
+
+# push_oracle KEY: push zbook's recorded oracle of pin KEY when the testbox's copy differs. The batch pin's
+# oracle path is a bind of the pin disk (testbox-data.txt), so the push lands there; another pin's stays on
+# this testbox only. A build on the runner has another sha256 (Go puts absolute paths in the binary).
+push_oracle() {
+  local path sha host ssh
+  path=$(python3 scripts/upstream/pin.py path oracle "$1") || exit 2
+  sha=$(python3 scripts/upstream/pin.py show "$1" | jq -r .oracle.sha256)
+  [[ $(sha256sum < "$path" | cut -d' ' -f1) == "$sha" ]] ||
+    { echo "$path does not match the sha256 in UPSTREAM.json" >&2; exit 1; }
+  ssh_route
+  if [[ $($ssh "runner@$host" sha256sum "$path" < /dev/null 2> /dev/null | cut -d' ' -f1) == "$sha" ]]; then
+    echo "oracle $1 on the testbox"
+  else
+    push_paths "$path"
+  fi
+}
+
+# job RUN STEP ARGS...: start testbox-remote.sh STEP ARGS... detached on the testbox, print its log as it grows
+# and return its exit code. It polls over the SSH route, which does not sync this worktree.
+job() {
+  local run=$1 host ssh t size=0 fails=0 rc
+  # exit, not return: callers run job in a || list (no set -e there), and then fetch RUN, which must not
+  # take another job's run.
+  remote scripts/goport/testbox-remote.sh start "$@" || exit
+  ssh_route
+  t=$(mktemp -d)
+  while :; do
+    # RUN.rc first: once it is there, the log is complete.
+    rc=$($ssh "runner@$host" cat "$remote_root/$run.rc" < /dev/null 2> /dev/null) || rc=
+    if $ssh "runner@$host" tail -c "+$((size + 1))" "$remote_root/$run.log" < /dev/null > "$t/new" 2> /dev/null; then
+      fails=0
+      cat "$t/new"
+      size=$((size + $(stat -c %s "$t/new")))
+    elif ((++fails >= 10)); then
+      echo "testbox $(saved_id): no $run.log after 10 tries" >&2
+      rm -rf "$t"
+      return 1
+    fi
+    [[ -z $rc ]] || break
+    sleep 15
+  done
+  rm -rf "$t"
+  return "$rc"
+}
+
+# fetch RUN DEST: copy RUN/out.tar.gz and RUN.log back, unpack them in DEST, then remove them on the testbox
+# (the test binaries would fill the sticky target/). Without RUN/out.tar.gz (the job ended before it packed),
+# it keeps RUN.log on the testbox and returns 1.
+fetch() {
+  local host ssh t
+  ssh_route
+  t=$(mktemp -d)
+  rsync -a -e "$ssh" "runner@$host:$remote_root/$1/out.tar.gz" "$t/" || {
+    rm -rf "$t"
+    echo "no $1/out.tar.gz on the testbox (the job log above has its error; $1.log stays there)" >&2
+    return 1
+  }
+  rsync -a -e "$ssh" "runner@$host:$remote_root/$1.log" "$t/testbox.log"
+  mkdir -p "$2"
+  tar -xzf "$t/out.tar.gz" -C "$2"
+  mv "$t/testbox.log" "$2/"
+  rm -rf "$t"
+  $ssh "runner@$host" rm -rf "$remote_root/$1" "$remote_root/$1.log" "$remote_root/$1.rc" < /dev/null
 }
 
 cmd="$1"
 shift
+pin_key=
+if [[ $cmd == tests || $cmd == np-suite ]] && [[ ${1:-} == --pin ]]; then
+  (($# >= 2)) || { echo "usage: testbox.sh $cmd --pin KEY ..." >&2; exit 2; }
+  pin_key=$2
+  shift 2
+fi
+pin_key=${pin_key:-$(batch_pin)}
 case "$cmd" in
   warmup)
     rc=0
@@ -81,15 +195,60 @@ case "$cmd" in
     ;;
   run)
     (($#)) || { echo "usage: testbox.sh run <command...>" >&2; exit 2; }
-    printf -v remote_cmd '%q ' "$@"
-    blacksmith testbox run --id "$(saved_id)" ". ~/testbox.env && $remote_cmd"
+    remote "$@"
+    ;;
+  pin) remote scripts/goport/testbox-remote.sh pin "$@" ;;
+  tests)
+    (($# == 2)) || { echo "usage: testbox.sh tests [--pin KEY] OUT BASE" >&2; exit 2; }
+    out=$(realpath -m -- "$1") base=$(realpath -- "$2")
+    [[ ! -e $out ]] || { echo "$out exists (results are never replaced)" >&2; exit 2; }
+    [[ -z $(git status --porcelain --untracked-files=all -- crates Cargo.toml Cargo.lock) ]] ||
+      { echo "crates/, Cargo.toml or Cargo.lock has changes: commit them (build-goport-tests.sh builds HEAD)" >&2; exit 2; }
+    head=$(git rev-parse HEAD)
+    git branch -r --contains "$head" | grep -q . ||
+      echo "warning: no remote branch here has HEAD ${head:0:12}; the testbox fetches it from origin" >&2
+    push_oracle "$pin_key"
+    run=target/testbox-runs/tests-$(date -u +%Y%m%dT%H%M%S)-${head:0:9}
+    rc=0
+    job "$run" tests "$pin_key" "$head" "$run" || rc=$?
+    fetch "$run" "$out"
+    if [[ ! -f $out/tests-run/results.json ]]; then
+      # A failed build: its compiler errors, from the cargo logs (without the colors).
+      sed 's/\x1b\[[0-9;]*m//g' "$out"/testbin.new/logs/build-*.log 2> /dev/null | grep -A 12 -m 10 '^error' | head -80 || true
+      echo "no results.json (rc $rc): see $out/build.log, $out/testbin.new/logs and $out/tests.log" >&2
+      exit 1
+    fi
+    python3 scripts/goport/compare-tests.py "$base" "$out/tests-run/results.json" --out "$out/compare.json" || rc=$?
+    echo "results $out/tests-run/results.json, compare $out/compare.json"
+    exit "$rc"
+    ;;
+  np-suite)
+    (($# == 1 || $# == 2)) || { echo "usage: testbox.sh np-suite [--pin KEY] LABEL [BASE]" >&2; exit 2; }
+    # One dir name: the result moves to $np/LABEL, and np-suite.sh diff takes labels.
+    [[ -n $1 && $1 != */* ]] || { echo "LABEL must be a dir name without /: $1" >&2; exit 2; }
+    np=/home/theo/Code/sandbox/ts-rust/target/continuation-r97-goport/compat-backlog/np-suite
+    [[ ! -e $np/$1 ]] || { echo "$np/$1 exists (results are never replaced)" >&2; exit 2; }
+    run=target/testbox-runs/np-$(date -u +%Y%m%dT%H%M%S)-$1
+    rc=0
+    job "$run" np-suite "$pin_key" "$1" "$run" || rc=$?
+    mkdir -p "$np" target
+    tmp=$(mktemp -d "$repo_root/target/testbox-np.XXXXXX")
+    fetch "$run" "$tmp"
+    [[ -d $tmp/$1 ]] || { echo "no np-suite result (rc $rc): the tsgo build log is $tmp/build.log" >&2; exit 1; }
+    mv "$tmp/$1" "$np/$1"
+    mv "$tmp/build.log" "$np/$1/testbox-build.log"
+    mv "$tmp/testbox.log" "$np/$1/testbox.log"
+    rmdir "$tmp"
+    cat "$np/$1/summary.txt"
+    [[ -z ${2:-} ]] || scripts/goport/np-suite.sh diff "$2" "$1" | tail -20
+    exit "$rc"
     ;;
   get)
     # rsync, not `blacksmith testbox download`: that timed out after 5 minutes on a 124 MB results dir.
     (($# == 1 || $# == 2)) || { echo "usage: testbox.sh get <remote> [local]" >&2; exit 2; }
     ssh_route
     src="$1"
-    [[ "$src" == /* ]] || src="_work/ts-rust/ts-rust/$src"
+    [[ "$src" == /* ]] || src="$remote_root/$src"
     rsync -aH --compress --compress-choice=zstd -e "$ssh" "runner@$host:$src" "${2:-.}"
     ;;
   push)
@@ -104,10 +263,15 @@ case "$cmd" in
     push_paths "${paths[@]}"
     ;;
   status) blacksmith testbox status --id "$(saved_id)" "$@" ;;
-  stop)
+  stop | release)
     id="$(saved_id)"
-    blacksmith testbox stop --id "$id"
-    # Keep the saved ID when TESTBOX_ID stopped another testbox.
+    if [[ $cmd == stop ]]; then
+      blacksmith testbox stop --id "$id"
+    else
+      echo "testbox $id: released; it ends at its idle timeout and requests a commit of its sticky disks"
+      echo "(TESTBOX_ID=$id scripts/goport/testbox.sh status shows when it completed)"
+    fi
+    # Keep the saved ID when TESTBOX_ID named another testbox.
     [[ "$(cat "$id_file" 2>/dev/null || true)" != "$id" ]] || rm -f "$id_file"
     ;;
   list) blacksmith testbox list "$@" ;;