From 72e91a3393585ca2c6baf26b61606ddee9540586 Mon Sep 17 00:00:00 2001
From: Bartosz Burda <bartoszburda93@gmail.com>
Date: Sat, 26 Sep 2026 09:45:31 +0200
Subject: [PATCH 1/5] fix: keep the gateway's helper nodes off the gateway's
 own name

launch_ros Node(name=...) passes -r __node:=<name> to the whole process.
The fault-service clients, the lifecycle state reader and the subscription
executor each create an rclcpp::Node that honoured that rule, so one
gateway showed up as four nodes named /ros2_medkit_gateway: ros2 node list
warned about duplicate names, rosout logged "Publisher already registered"
three times, and ros2 param list printed every parameter four times.

The helpers are now built by make_helper_node():

- named _<gateway name><suffix>, so they are hidden from ros2 node list and
  from discovery (no new Apps; count_peer_nodes no longer needs the helper
  exception list);
- a node-local __node remap overrides the process-wide one. The other
  process arguments (namespace, remaps, parameter files) still apply;
- use_sim_time is copied from the gateway, because a parameters file keyed
  by the gateway's name does not match the helper;
- no parameter services or parameter event publisher: the fault-client
  node is spun only during its own requests, and a get_parameters call to it
  timed out; the lifecycle reader has the same shape.

New integration tests launch the gateway through launch_ros, once plainly
and once in a namespace with use_sim_time and with remap rules that are the
only route to the fault manager. They check a single gateway node in the
graph, ros2 param list without duplicates, unchanged /apps, hidden helpers
in the gateway namespace, /clock subscriptions on the helpers under sim
time, and that faults, topic samples and lifecycle states still work.

The graph watchdog compiles the lifecycle state reader in, so it now
compiles helper_node.cpp too. test_gateway_node.cpp drops redundant c_str()
calls flagged by clang-tidy.
---
 docs/api/rest.rst                             |   6 +-
 docs/config/discovery-options.rst             |   4 +-
 src/ros2_medkit_gateway/CMakeLists.txt        |   6 +
 .../design/ros2_subscription_architecture.rst |   8 +-
 .../ros2_medkit_gateway/gateway_node.hpp      |   4 +-
 .../ros2_common/helper_node.hpp               |  39 ++++
 .../ros2_subscription_executor.hpp            |   5 +-
 src/ros2_medkit_gateway/src/gateway_node.cpp  |   8 +-
 .../status/ros2_lifecycle_state_reader.cpp    |   4 +-
 .../ros2_fault_service_transport.cpp          |   3 +-
 .../src/ros2_common/helper_node.cpp           |  35 ++++
 .../ros2_subscription_executor.cpp            |   8 +-
 .../test/test_gateway_node.cpp                | 157 +++++++-------
 .../test/test_helper_node.cpp                 | 118 +++++++++++
 .../test/test_ros2_subscription_executor.cpp  |   3 +-
 .../ros2_medkit_test_utils/launch_helpers.py  |  23 +-
 .../ros2_medkit_test_utils/ros_graph.py       | 108 ++++++++++
 .../test_gateway_helper_nodes.test.py         | 166 +++++++++++++++
 ...st_gateway_helper_nodes_namespaced.test.py | 197 ++++++++++++++++++
 .../ros2_medkit_graph_watchdog/CMakeLists.txt |   3 +-
 20 files changed, 797 insertions(+), 108 deletions(-)
 create mode 100644 src/ros2_medkit_gateway/include/ros2_medkit_gateway/ros2_common/helper_node.hpp
 create mode 100644 src/ros2_medkit_gateway/src/ros2_common/helper_node.cpp
 create mode 100644 src/ros2_medkit_gateway/test/test_helper_node.cpp
 create mode 100644 src/ros2_medkit_integration_tests/ros2_medkit_test_utils/ros_graph.py
 create mode 100644 src/ros2_medkit_integration_tests/test/features/test_gateway_helper_nodes.test.py
 create mode 100644 src/ros2_medkit_integration_tests/test/features/test_gateway_helper_nodes_namespaced.test.py

diff --git a/docs/api/rest.rst b/docs/api/rest.rst
index 5f55fb862..fb4e9c678 100644
--- a/docs/api/rest.rst
+++ b/docs/api/rest.rst
@@ -229,9 +229,9 @@ Server Capabilities
               "/powertrain/engine/rpm_sensor",
               "/ros2_medkit_gateway",
               "/_param_client_node",
-              "/ros2_medkit_gateway_fault_clients",
-              "/ros2_medkit_gateway_lifecycle_state_reader",
-              "/ros2_medkit_gateway_sub"
+              "/_ros2_medkit_gateway_fault_clients",
+              "/_ros2_medkit_gateway_lifecycle_state_reader",
+              "/_ros2_medkit_gateway_sub"
             ],
             "peer_names": []
           }
diff --git a/docs/config/discovery-options.rst b/docs/config/discovery-options.rst
index c47613dc0..22cf29310 100644
--- a/docs/config/discovery-options.rst
+++ b/docs/config/discovery-options.rst
@@ -81,7 +81,9 @@ Internal Node Filtering
 When ``filter_internal_nodes`` is true (the default), ROS 2 nodes whose names
 start with an underscore (``_``) are excluded from the entity tree. This
 filters out ROS 2 internal infrastructure nodes such as ``_ros2cli_*``,
-``_param_client_node``, and similar system nodes that should not appear as
+``_param_client_node``, the gateway's own helper nodes
+(``_<gateway name>_fault_clients``, ``_<gateway name>_lifecycle_state_reader``,
+``_<gateway name>_sub``), and similar system nodes that should not appear as
 SOVD entities. The filter applies to both locally discovered Apps and
 peer-discovered Apps (after stripping the peer prefix).
 
diff --git a/src/ros2_medkit_gateway/CMakeLists.txt b/src/ros2_medkit_gateway/CMakeLists.txt
index ca40feb9a..55447235a 100644
--- a/src/ros2_medkit_gateway/CMakeLists.txt
+++ b/src/ros2_medkit_gateway/CMakeLists.txt
@@ -210,6 +210,7 @@ add_library(gateway_ros2 STATIC
   src/plugins/plugin_loader.cpp
   src/plugins/plugin_manager.cpp
   src/ros2_common/callback_groups.cpp
+  src/ros2_common/helper_node.cpp
   src/ros2_common/ros2_subscription_executor.cpp
   src/ros2_common/ros2_subscription_slot.cpp
   src/script_manager.cpp
@@ -882,6 +883,11 @@ if(BUILD_TESTING)
   target_link_libraries(test_ros2_lifecycle_state_reader gateway_ros2)
   medkit_target_dependencies(test_ros2_lifecycle_state_reader rclcpp lifecycle_msgs)
 
+  # Helper nodes keep their own name under a process-wide __node remap
+  medkit_add_gtest(test_helper_node test/test_helper_node.cpp)
+  target_link_libraries(test_helper_node gateway_ros2)
+  medkit_target_dependencies(test_helper_node rclcpp)
+
   # Private client nodes torn down after a first graph wait that follows rclcpp::shutdown()
   medkit_add_gtest(test_graph_listener_join test/test_graph_listener_join.cpp)
   target_link_libraries(test_graph_listener_join gateway_ros2)
diff --git a/src/ros2_medkit_gateway/design/ros2_subscription_architecture.rst b/src/ros2_medkit_gateway/design/ros2_subscription_architecture.rst
index e6b2eb007..15ce0dc86 100644
--- a/src/ros2_medkit_gateway/design/ros2_subscription_architecture.rst
+++ b/src/ros2_medkit_gateway/design/ros2_subscription_architecture.rst
@@ -68,8 +68,12 @@ Ros2SubscriptionExecutor
 Owns:
 
 - One dedicated ``std::thread`` (the worker).
-- One ``rclcpp::Node`` (the subscription node, suffixed ``_sub``) exclusively
-  owned by this executor's internal ``SingleThreadedExecutor``. The gateway's
+- One ``rclcpp::Node`` (the subscription node, ``_<gateway name>_sub``)
+  exclusively owned by this executor's internal ``SingleThreadedExecutor``.
+  It is created by ``make_helper_node`` (``ros2_common/helper_node.hpp``):
+  hidden by the leading underscore, in the gateway's namespace, with the
+  gateway's ``use_sim_time`` and a node-local name remap, so a launch_ros
+  ``Node(name=...)`` does not rename it to the gateway's own name. The gateway's
   main ``MultiThreadedExecutor`` never sees this node; creation, destruction
   and callback dispatch of every subscription on it run on the single worker
   thread, preserving the single-writer invariant against rcl's hash-map.
diff --git a/src/ros2_medkit_gateway/include/ros2_medkit_gateway/gateway_node.hpp b/src/ros2_medkit_gateway/include/ros2_medkit_gateway/gateway_node.hpp
index a46a11bf5..6c54b11d3 100644
--- a/src/ros2_medkit_gateway/include/ros2_medkit_gateway/gateway_node.hpp
+++ b/src/ros2_medkit_gateway/include/ros2_medkit_gateway/gateway_node.hpp
@@ -73,8 +73,8 @@ class GatewayNode : public rclcpp::Node {
   ~GatewayNode() override;
 
   /// Count application (peer) nodes from (name, namespace) pairs: excludes hidden
-  /// nodes and the gateway's own nodes (whose FQN starts with @p self_fqn). Static
-  /// and public so the startup-summary counting logic is unit-testable.
+  /// nodes (the gateway's helper nodes are hidden) and the node at @p self_fqn.
+  /// Static and public so the startup-summary counting logic is unit-testable.
   static size_t count_peer_nodes(const std::vector<std::pair<std::string, std::string>> & nodes_and_namespaces,
                                  const std::string & self_fqn);
 
diff --git a/src/ros2_medkit_gateway/include/ros2_medkit_gateway/ros2_common/helper_node.hpp b/src/ros2_medkit_gateway/include/ros2_medkit_gateway/ros2_common/helper_node.hpp
new file mode 100644
index 000000000..132bdd010
--- /dev/null
+++ b/src/ros2_medkit_gateway/include/ros2_medkit_gateway/ros2_common/helper_node.hpp
@@ -0,0 +1,39 @@
+// Copyright 2026 bburda
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+#pragma once
+
+#include <memory>
+#include <string>
+
+#include <rclcpp/rclcpp.hpp>
+
+namespace ros2_medkit_gateway::ros2_common {
+
+/**
+ * @brief Create an in-process helper node of @p host, in the host's namespace and context.
+ *
+ * The helper is named `_<host name><suffix>`. The leading underscore hides it from
+ * `ros2 node list` and from discovery. A node-local `__node` remap keeps a
+ * process-wide `-r __node:=<name>` (added by launch_ros `Node(name=...)`) from
+ * giving the helper the host's name. All other process arguments still apply.
+ * `use_sim_time` is copied from the host, because a parameters file keyed by the
+ * host's name does not match the helper.
+ *
+ * The helper has no parameter services and no parameter event publisher. A helper
+ * spun only during its own requests would leave those services unanswered.
+ */
+std::shared_ptr<rclcpp::Node> make_helper_node(rclcpp::Node & host, const std::string & suffix);
+
+}  // namespace ros2_medkit_gateway::ros2_common
diff --git a/src/ros2_medkit_gateway/include/ros2_medkit_gateway/ros2_common/ros2_subscription_executor.hpp b/src/ros2_medkit_gateway/include/ros2_medkit_gateway/ros2_common/ros2_subscription_executor.hpp
index 6cc7a240a..19541d259 100644
--- a/src/ros2_medkit_gateway/include/ros2_medkit_gateway/ros2_common/ros2_subscription_executor.hpp
+++ b/src/ros2_medkit_gateway/include/ros2_medkit_gateway/ros2_common/ros2_subscription_executor.hpp
@@ -83,6 +83,7 @@ class Ros2SubscriptionExecutor final {
     std::chrono::milliseconds watchdog_threshold;
     std::chrono::milliseconds watchdog_tick;
     std::chrono::milliseconds graph_poll_tick;
+    /// The subscription node is named `_<gateway name><suffix>`.
     std::string subscription_node_name_suffix;
 
     // Explicit ctor needed because GCC does not allow default member initializers
@@ -121,8 +122,8 @@ class Ros2SubscriptionExecutor final {
    * deliberately not wired up - sharing the subscription node with a multi-threaded
    * executor reintroduces the rcutils_hash_map race this class exists to eliminate.
    *
-   * @param gateway_node Owning gateway node. Used only to derive the subscription
-   *                     node name and namespace; no references retained after
+   * @param gateway_node Owning gateway node. Used only to set up the subscription
+   *                     node (see make_helper_node); no references retained after
    *                     construction.
    * @param cfg          Bounded resource configuration.
    */
diff --git a/src/ros2_medkit_gateway/src/gateway_node.cpp b/src/ros2_medkit_gateway/src/gateway_node.cpp
index b17256644..1f52448e4 100644
--- a/src/ros2_medkit_gateway/src/gateway_node.cpp
+++ b/src/ros2_medkit_gateway/src/gateway_node.cpp
@@ -1601,17 +1601,15 @@ size_t GatewayNode::count_peer_nodes(const std::vector<std::pair<std::string, st
   size_t count = 0;
   for (const auto & [name, ns] : nodes_and_namespaces) {
     if (!name.empty() && name.front() == '_') {
-      continue;  // hidden node (name part starts with '_')
+      continue;  // hidden node, including the gateway's own helper nodes
     }
     std::string fqn = ns;
     if (ns != "/") {
       fqn += "/";
     }
     fqn += name;
-    // Exclude the gateway's own nodes by exact FQN: the main node and its known
-    // internal helpers. A plain prefix match would also drop a genuine peer whose
-    // name starts with the gateway name (e.g. "<fqn>_monitor" or "<fqn>2").
-    if (fqn == self_fqn || fqn == self_fqn + "_sub" || fqn == self_fqn + "_fault_clients") {
+    // Exact match: a peer named "<fqn>_monitor" or "<fqn>2" is still a peer.
+    if (fqn == self_fqn) {
       continue;
     }
     ++count;
diff --git a/src/ros2_medkit_gateway/src/ros2/status/ros2_lifecycle_state_reader.cpp b/src/ros2_medkit_gateway/src/ros2/status/ros2_lifecycle_state_reader.cpp
index baadd1783..fbc42bda2 100644
--- a/src/ros2_medkit_gateway/src/ros2/status/ros2_lifecycle_state_reader.cpp
+++ b/src/ros2_medkit_gateway/src/ros2/status/ros2_lifecycle_state_reader.cpp
@@ -19,11 +19,13 @@
 
 #include <lifecycle_msgs/srv/get_state.hpp>
 
+#include "ros2_medkit_gateway/ros2_common/helper_node.hpp"
+
 namespace ros2_medkit_gateway {
 
 Ros2LifecycleStateReader::Ros2LifecycleStateReader(rclcpp::Node * host, std::chrono::duration<double> timeout)
   : timeout_(timeout) {
-  client_node_ = std::make_shared<rclcpp::Node>(std::string(host->get_name()) + "_lifecycle_state_reader");
+  client_node_ = ros2_common::make_helper_node(*host, "_lifecycle_state_reader");
   // Joins the graph listener while the context is valid. A first join after
   // rclcpp::shutdown() half-registers the node and ~NodeGraph aborts.
   static_cast<void>(client_node_->get_graph_event());
diff --git a/src/ros2_medkit_gateway/src/ros2/transports/ros2_fault_service_transport.cpp b/src/ros2_medkit_gateway/src/ros2/transports/ros2_fault_service_transport.cpp
index 935365a19..be94e2900 100644
--- a/src/ros2_medkit_gateway/src/ros2/transports/ros2_fault_service_transport.cpp
+++ b/src/ros2_medkit_gateway/src/ros2/transports/ros2_fault_service_transport.cpp
@@ -22,6 +22,7 @@
 
 #include "ros2_medkit_gateway/fault_manager_paths.hpp"
 #include "ros2_medkit_gateway/ros2/conversions/fault_msg_conversions.hpp"
+#include "ros2_medkit_gateway/ros2_common/helper_node.hpp"
 #include "ros2_medkit_msgs/msg/environment_data.hpp"
 #include "ros2_medkit_msgs/msg/fault.hpp"
 
@@ -101,7 +102,7 @@ Ros2FaultServiceTransport::Ros2FaultServiceTransport(rclcpp::Node * node) : node
   // processes these clients, so the client's pending-request cleanup cannot
   // race against the calling thread destroying the response shared_ptr - both
   // happen inline on the caller's thread inside spin_until_future_complete().
-  client_node_ = std::make_shared<rclcpp::Node>(std::string(node_->get_name()) + "_fault_clients");
+  client_node_ = ros2_common::make_helper_node(*node_, "_fault_clients");
   // Joins the graph listener while the context is valid. A first join after
   // rclcpp::shutdown() half-registers the node and ~NodeGraph aborts.
   static_cast<void>(client_node_->get_graph_event());
diff --git a/src/ros2_medkit_gateway/src/ros2_common/helper_node.cpp b/src/ros2_medkit_gateway/src/ros2_common/helper_node.cpp
new file mode 100644
index 000000000..e55c9ae2c
--- /dev/null
+++ b/src/ros2_medkit_gateway/src/ros2_common/helper_node.cpp
@@ -0,0 +1,35 @@
+// Copyright 2026 bburda
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+#include "ros2_medkit_gateway/ros2_common/helper_node.hpp"
+
+namespace ros2_medkit_gateway::ros2_common {
+
+std::shared_ptr<rclcpp::Node> make_helper_node(rclcpp::Node & host, const std::string & suffix) {
+  const std::string name = "_" + std::string{host.get_name()} + suffix;
+
+  bool use_sim_time = false;
+  host.get_parameter("use_sim_time", use_sim_time);
+
+  rclcpp::NodeOptions options;
+  options.context(host.get_node_base_interface()->get_context());
+  // rcl reads node-local remap rules before global ones.
+  options.arguments({"--ros-args", "-r", "__node:=" + name});
+  options.parameter_overrides({rclcpp::Parameter("use_sim_time", use_sim_time)});
+  options.start_parameter_services(false);
+  options.start_parameter_event_publisher(false);
+  return std::make_shared<rclcpp::Node>(name, host.get_namespace(), options);
+}
+
+}  // namespace ros2_medkit_gateway::ros2_common
diff --git a/src/ros2_medkit_gateway/src/ros2_common/ros2_subscription_executor.cpp b/src/ros2_medkit_gateway/src/ros2_common/ros2_subscription_executor.cpp
index fe6c43088..4d4218046 100644
--- a/src/ros2_medkit_gateway/src/ros2_common/ros2_subscription_executor.cpp
+++ b/src/ros2_medkit_gateway/src/ros2_common/ros2_subscription_executor.cpp
@@ -23,6 +23,8 @@
 
 #include <rclcpp/logging.hpp>
 
+#include "ros2_medkit_gateway/ros2_common/helper_node.hpp"
+
 namespace ros2_medkit_gateway::ros2_common {
 
 namespace {
@@ -41,11 +43,7 @@ Ros2SubscriptionExecutor::Ros2SubscriptionExecutor(const std::shared_ptr<rclcpp:
     throw std::invalid_argument{"Ros2SubscriptionExecutor: gateway_node is null"};
   }
 
-  const std::string suffixed_name = std::string{gateway_node->get_name()} + cfg_.subscription_node_name_suffix;
-  rclcpp::NodeOptions opts;
-  opts.start_parameter_services(false);
-  opts.start_parameter_event_publisher(false);
-  subscription_node_ = std::make_shared<rclcpp::Node>(suffixed_name, gateway_node->get_namespace(), opts);
+  subscription_node_ = make_helper_node(*gateway_node, cfg_.subscription_node_name_suffix);
 
   // Own executor owns the subscription node so subscription create/destroy
   // and callback dispatch all run on the same worker thread (this executor is
diff --git a/src/ros2_medkit_gateway/test/test_gateway_node.cpp b/src/ros2_medkit_gateway/test/test_gateway_node.cpp
index 2f81dbc6c..eb71e907b 100644
--- a/src/ros2_medkit_gateway/test/test_gateway_node.cpp
+++ b/src/ros2_medkit_gateway/test/test_gateway_node.cpp
@@ -113,7 +113,7 @@ class TestGatewayNode : public ::testing::Test {
     const std::string health_endpoint = std::string(API_BASE_PATH) + "/health";
 
     while (std::chrono::steady_clock::now() - start < timeout) {
-      if (auto res = client.Get((health_endpoint).c_str())) {
+      if (auto res = client.Get(health_endpoint)) {
         if (res->status == 200) {
           return;
         }
@@ -221,7 +221,7 @@ manifest_version: "1.0"
 TEST_F(TestGatewayNode, test_health_endpoint) {
   auto client = create_client();
 
-  auto res = client.Get((std::string(API_BASE_PATH) + "/health").c_str());
+  auto res = client.Get(std::string(API_BASE_PATH) + "/health");
 
   ASSERT_TRUE(res);
   EXPECT_EQ(res->status, 200);
@@ -237,7 +237,7 @@ TEST_F(TestGatewayNode, test_root_endpoint) {
   // @verifies REQ_INTEROP_010
   auto client = create_client();
 
-  auto res = client.Get((std::string(API_BASE_PATH) + "/").c_str());
+  auto res = client.Get(std::string(API_BASE_PATH) + "/");
 
   ASSERT_TRUE(res);
   EXPECT_EQ(res->status, 200);
@@ -274,7 +274,7 @@ TEST_F(TestGatewayNode, test_fault_manager_namespace_configures_event_subscriber
   // Verify the REST API is functional with the namespaced fault manager.
   // The health endpoint works regardless of fault manager namespace.
   auto client = create_client();
-  auto res = client.Get((std::string(API_BASE_PATH) + "/health").c_str());
+  auto res = client.Get(std::string(API_BASE_PATH) + "/health");
   ASSERT_TRUE(res);
   EXPECT_EQ(res->status, 200);
 }
@@ -317,7 +317,7 @@ TEST_F(TestGatewayNode, test_version_info_endpoint) {
   // @verifies REQ_INTEROP_001
   auto client = create_client();
 
-  auto res = client.Get((std::string(API_BASE_PATH) + "/version-info").c_str());
+  auto res = client.Get(std::string(API_BASE_PATH) + "/version-info");
 
   ASSERT_TRUE(res);
   EXPECT_EQ(res->status, 200);
@@ -342,7 +342,7 @@ TEST_F(TestGatewayNode, test_list_areas_endpoint) {
   // @verifies REQ_INTEROP_003
   auto client = create_client();
 
-  auto res = client.Get((std::string(API_BASE_PATH) + "/areas").c_str());
+  auto res = client.Get(std::string(API_BASE_PATH) + "/areas");
 
   ASSERT_TRUE(res);
   EXPECT_EQ(res->status, 200);
@@ -358,7 +358,7 @@ TEST_F(TestGatewayNode, test_list_components_endpoint) {
   // @verifies REQ_INTEROP_003
   auto client = create_client();
 
-  auto res = client.Get((std::string(API_BASE_PATH) + "/components").c_str());
+  auto res = client.Get(std::string(API_BASE_PATH) + "/components");
 
   ASSERT_TRUE(res);
   EXPECT_EQ(res->status, 200);
@@ -373,7 +373,7 @@ TEST_F(TestGatewayNode, test_list_components_endpoint) {
 TEST_F(TestGatewayNode, test_nonexistent_endpoint_404) {
   auto client = create_client();
 
-  auto res = client.Get((std::string(API_BASE_PATH) + "/nonexistent/path").c_str());
+  auto res = client.Get(std::string(API_BASE_PATH) + "/nonexistent/path");
 
   ASSERT_TRUE(res);
   EXPECT_EQ(res->status, 404);
@@ -384,7 +384,7 @@ TEST_F(TestGatewayNode, test_invalid_area_id_bad_request) {
 
   // Test with special characters that should be rejected
   // Note: URL-encoded slash (%2F) is decoded by server, but @#$ characters are invalid
-  auto res = client.Get((std::string(API_BASE_PATH) + "/areas/test@invalid").c_str());
+  auto res = client.Get(std::string(API_BASE_PATH) + "/areas/test@invalid");
 
   ASSERT_TRUE(res);
   // Should return 400 for invalid entity ID with special characters
@@ -394,7 +394,7 @@ TEST_F(TestGatewayNode, test_invalid_area_id_bad_request) {
 TEST_F(TestGatewayNode, test_nonexistent_area_404) {
   auto client = create_client();
 
-  auto res = client.Get((std::string(API_BASE_PATH) + "/areas/nonexistent_area").c_str());
+  auto res = client.Get(std::string(API_BASE_PATH) + "/areas/nonexistent_area");
 
   ASSERT_TRUE(res);
   EXPECT_EQ(res->status, 404);
@@ -403,7 +403,7 @@ TEST_F(TestGatewayNode, test_nonexistent_area_404) {
 TEST_F(TestGatewayNode, test_nonexistent_component_404) {
   auto client = create_client();
 
-  auto res = client.Get((std::string(API_BASE_PATH) + "/components/nonexistent_component").c_str());
+  auto res = client.Get(std::string(API_BASE_PATH) + "/components/nonexistent_component");
 
   ASSERT_TRUE(res);
   EXPECT_EQ(res->status, 404);
@@ -413,7 +413,7 @@ TEST_F(TestGatewayNode, test_invalid_component_id_bad_request) {
   auto client = create_client();
 
   // Test with special characters that are invalid
-  auto res = client.Get((std::string(API_BASE_PATH) + "/components/test@invalid#id").c_str());
+  auto res = client.Get(std::string(API_BASE_PATH) + "/components/test@invalid#id");
 
   ASSERT_TRUE(res);
   EXPECT_EQ(res->status, 400);
@@ -426,7 +426,7 @@ TEST_F(TestGatewayNode, test_invalid_component_id_bad_request) {
 TEST_F(TestGatewayNode, test_list_apps_endpoint) {
   auto client = create_client();
 
-  auto res = client.Get((std::string(API_BASE_PATH) + "/apps").c_str());
+  auto res = client.Get(std::string(API_BASE_PATH) + "/apps");
 
   ASSERT_TRUE(res);
   EXPECT_EQ(res->status, 200);
@@ -441,7 +441,7 @@ TEST_F(TestGatewayNode, test_list_apps_endpoint) {
 TEST_F(TestGatewayNode, test_list_functions_endpoint) {
   auto client = create_client();
 
-  auto res = client.Get((std::string(API_BASE_PATH) + "/functions").c_str());
+  auto res = client.Get(std::string(API_BASE_PATH) + "/functions");
 
   ASSERT_TRUE(res);
   EXPECT_EQ(res->status, 200);
@@ -456,7 +456,7 @@ TEST_F(TestGatewayNode, test_options_request_for_cors) {
   auto client = create_client();
 
   // OPTIONS request for CORS preflight
-  auto res = client.Options((std::string(API_BASE_PATH) + "/components").c_str());
+  auto res = client.Options(std::string(API_BASE_PATH) + "/components");
 
   ASSERT_TRUE(res);
   // Without CORS configured, server may return various success codes or 404
@@ -467,7 +467,7 @@ TEST_F(TestGatewayNode, test_options_request_for_cors) {
 TEST_F(TestGatewayNode, test_component_data_nonexistent_component) {
   auto client = create_client();
 
-  auto res = client.Get((std::string(API_BASE_PATH) + "/components/nonexistent_component/data").c_str());
+  auto res = client.Get(std::string(API_BASE_PATH) + "/components/nonexistent_component/data");
 
   ASSERT_TRUE(res);
   EXPECT_EQ(res->status, 404);
@@ -476,7 +476,7 @@ TEST_F(TestGatewayNode, test_component_data_nonexistent_component) {
 TEST_F(TestGatewayNode, test_component_operations_nonexistent_component) {
   auto client = create_client();
 
-  auto res = client.Get((std::string(API_BASE_PATH) + "/components/nonexistent_component/operations").c_str());
+  auto res = client.Get(std::string(API_BASE_PATH) + "/components/nonexistent_component/operations");
 
   ASSERT_TRUE(res);
   EXPECT_EQ(res->status, 404);
@@ -485,7 +485,7 @@ TEST_F(TestGatewayNode, test_component_operations_nonexistent_component) {
 TEST_F(TestGatewayNode, test_component_configurations_nonexistent_component) {
   auto client = create_client();
 
-  auto res = client.Get((std::string(API_BASE_PATH) + "/components/nonexistent_component/configurations").c_str());
+  auto res = client.Get(std::string(API_BASE_PATH) + "/components/nonexistent_component/configurations");
 
   ASSERT_TRUE(res);
   EXPECT_EQ(res->status, 404);
@@ -494,7 +494,7 @@ TEST_F(TestGatewayNode, test_component_configurations_nonexistent_component) {
 TEST_F(TestGatewayNode, test_component_faults_nonexistent_component) {
   auto client = create_client();
 
-  auto res = client.Get((std::string(API_BASE_PATH) + "/components/nonexistent_component/faults").c_str());
+  auto res = client.Get(std::string(API_BASE_PATH) + "/components/nonexistent_component/faults");
 
   ASSERT_TRUE(res);
   EXPECT_EQ(res->status, 404);
@@ -507,7 +507,7 @@ TEST_F(TestGatewayNode, test_component_faults_nonexistent_component) {
 TEST_F(TestGatewayNode, test_root_endpoint_contains_api_base_path) {
   auto client = create_client();
 
-  auto res = client.Get((std::string(API_BASE_PATH) + "/").c_str());
+  auto res = client.Get(std::string(API_BASE_PATH) + "/");
 
   ASSERT_TRUE(res);
   auto json_response = nlohmann::json::parse(res->body);
@@ -519,7 +519,7 @@ TEST_F(TestGatewayNode, test_root_endpoint_contains_api_base_path) {
 TEST_F(TestGatewayNode, test_root_endpoint_lists_all_capabilities) {
   auto client = create_client();
 
-  auto res = client.Get((std::string(API_BASE_PATH) + "/").c_str());
+  auto res = client.Get(std::string(API_BASE_PATH) + "/");
 
   ASSERT_TRUE(res);
   auto json_response = nlohmann::json::parse(res->body);
@@ -535,7 +535,7 @@ TEST_F(TestGatewayNode, test_root_endpoint_lists_all_capabilities) {
 TEST_F(TestGatewayNode, test_area_components_nonexistent_area) {
   auto client = create_client();
 
-  auto res = client.Get((std::string(API_BASE_PATH) + "/areas/nonexistent_area/components").c_str());
+  auto res = client.Get(std::string(API_BASE_PATH) + "/areas/nonexistent_area/components");
 
   ASSERT_TRUE(res);
   EXPECT_EQ(res->status, 404);
@@ -544,7 +544,7 @@ TEST_F(TestGatewayNode, test_area_components_nonexistent_area) {
 TEST_F(TestGatewayNode, test_area_subareas_nonexistent_area) {
   auto client = create_client();
 
-  auto res = client.Get((std::string(API_BASE_PATH) + "/areas/nonexistent_area/subareas").c_str());
+  auto res = client.Get(std::string(API_BASE_PATH) + "/areas/nonexistent_area/subareas");
 
   ASSERT_TRUE(res);
   EXPECT_EQ(res->status, 404);
@@ -553,7 +553,7 @@ TEST_F(TestGatewayNode, test_area_subareas_nonexistent_area) {
 TEST_F(TestGatewayNode, test_post_to_nonexistent_operation) {
   auto client = create_client();
 
-  auto res = client.Post((std::string(API_BASE_PATH) + "/components/nonexistent/operations/do_something").c_str(), "",
+  auto res = client.Post(std::string(API_BASE_PATH) + "/components/nonexistent/operations/do_something", "",
                          "application/json");
 
   ASSERT_TRUE(res);
@@ -568,7 +568,7 @@ TEST_F(TestGatewayNode, test_set_configuration_invalid_json) {
   auto client = create_client();
 
   // POST with invalid JSON body
-  auto res = client.Put((std::string(API_BASE_PATH) + "/components/gateway_node/configurations/test_param").c_str(),
+  auto res = client.Put(std::string(API_BASE_PATH) + "/components/gateway_node/configurations/test_param",
                         "{ invalid json }", "application/json");
 
   ASSERT_TRUE(res);
@@ -583,7 +583,7 @@ TEST_F(TestGatewayNode, test_set_configuration_missing_value_field) {
   auto client = create_client();
 
   // POST with valid JSON but missing 'data' field
-  auto res = client.Put((std::string(API_BASE_PATH) + "/components/gateway_node/configurations/test_param").c_str(),
+  auto res = client.Put(std::string(API_BASE_PATH) + "/components/gateway_node/configurations/test_param",
                         R"({"name": "test_param"})", "application/json");
 
   ASSERT_TRUE(res);
@@ -600,8 +600,8 @@ TEST_F(TestGatewayNode, test_set_configuration_missing_value_field) {
 TEST_F(TestGatewayNode, test_set_configuration_invalid_component_id) {
   auto client = create_client();
 
-  auto res = client.Put((std::string(API_BASE_PATH) + "/components/invalid@id/configurations/param").c_str(),
-                        R"({"value": 42})", "application/json");
+  auto res = client.Put(std::string(API_BASE_PATH) + "/components/invalid@id/configurations/param", R"({"value": 42})",
+                        "application/json");
 
   ASSERT_TRUE(res);
   EXPECT_EQ(res->status, 400);
@@ -610,8 +610,7 @@ TEST_F(TestGatewayNode, test_set_configuration_invalid_component_id) {
 TEST_F(TestGatewayNode, test_get_configuration_nonexistent_component) {
   auto client = create_client();
 
-  auto res =
-      client.Get((std::string(API_BASE_PATH) + "/components/nonexistent_comp/configurations/some_param").c_str());
+  auto res = client.Get(std::string(API_BASE_PATH) + "/components/nonexistent_comp/configurations/some_param");
 
   ASSERT_TRUE(res);
   EXPECT_EQ(res->status, 404);
@@ -620,8 +619,7 @@ TEST_F(TestGatewayNode, test_get_configuration_nonexistent_component) {
 TEST_F(TestGatewayNode, test_delete_configuration_nonexistent_component) {
   auto client = create_client();
 
-  auto res =
-      client.Delete((std::string(API_BASE_PATH) + "/components/nonexistent_comp/configurations/some_param").c_str());
+  auto res = client.Delete(std::string(API_BASE_PATH) + "/components/nonexistent_comp/configurations/some_param");
 
   ASSERT_TRUE(res);
   EXPECT_EQ(res->status, 404);
@@ -635,7 +633,7 @@ TEST_F(TestGatewayNode, test_post_operation_invalid_json_body) {
   auto client = create_client();
 
   // First we need a valid component - use the gateway_node itself
-  auto res = client.Post((std::string(API_BASE_PATH) + "/components/gateway_node/operations/some_service").c_str(),
+  auto res = client.Post(std::string(API_BASE_PATH) + "/components/gateway_node/operations/some_service",
                          "{ not valid json }", "application/json");
 
   ASSERT_TRUE(res);
@@ -646,9 +644,8 @@ TEST_F(TestGatewayNode, test_post_operation_invalid_json_body) {
 TEST_F(TestGatewayNode, test_post_operation_invalid_component_id) {
   auto client = create_client();
 
-  auto res =
-      client.Post((std::string(API_BASE_PATH) + "/components/invalid@component/operations/test/executions").c_str(),
-                  R"({})", "application/json");
+  auto res = client.Post(std::string(API_BASE_PATH) + "/components/invalid@component/operations/test/executions",
+                         R"({})", "application/json");
 
   ASSERT_TRUE(res);
   EXPECT_EQ(res->status, 400);
@@ -657,9 +654,8 @@ TEST_F(TestGatewayNode, test_post_operation_invalid_component_id) {
 TEST_F(TestGatewayNode, test_post_operation_invalid_operation_id) {
   auto client = create_client();
 
-  auto res =
-      client.Post((std::string(API_BASE_PATH) + "/components/gateway_node/operations/invalid@op/executions").c_str(),
-                  R"({})", "application/json");
+  auto res = client.Post(std::string(API_BASE_PATH) + "/components/gateway_node/operations/invalid@op/executions",
+                         R"({})", "application/json");
 
   ASSERT_TRUE(res);
   // 400 for invalid operation name or 404 if component not found
@@ -669,8 +665,7 @@ TEST_F(TestGatewayNode, test_post_operation_invalid_operation_id) {
 TEST_F(TestGatewayNode, test_execution_status_invalid_component_id) {
   auto client = create_client();
 
-  auto res =
-      client.Get((std::string(API_BASE_PATH) + "/components/invalid@id/operations/test/executions/some-id").c_str());
+  auto res = client.Get(std::string(API_BASE_PATH) + "/components/invalid@id/operations/test/executions/some-id");
 
   ASSERT_TRUE(res);
   EXPECT_EQ(res->status, 400);
@@ -680,8 +675,7 @@ TEST_F(TestGatewayNode, test_execution_cancel_invalid_component_id) {
   auto client = create_client();
 
   // Cancel with invalid component ID
-  auto res =
-      client.Delete((std::string(API_BASE_PATH) + "/components/invalid@id/operations/test/executions/some-id").c_str());
+  auto res = client.Delete(std::string(API_BASE_PATH) + "/components/invalid@id/operations/test/executions/some-id");
 
   ASSERT_TRUE(res);
   EXPECT_EQ(res->status, 400);
@@ -693,7 +687,7 @@ TEST_F(TestGatewayNode, test_execution_not_found) {
   // Get execution status for non-existent execution
   const std::string path =
       std::string(API_BASE_PATH) + "/components/gateway_node/operations/test/executions/nonexistent-id";
-  auto res = client.Get((path).c_str());
+  auto res = client.Get(path);
 
   ASSERT_TRUE(res);
   // Should be 404 for not found execution
@@ -705,9 +699,8 @@ TEST_F(TestGatewayNode, test_execution_update_invalid_component_id) {
   auto client = create_client();
 
   // PUT with invalid component ID
-  auto res =
-      client.Put((std::string(API_BASE_PATH) + "/components/invalid@id/operations/test/executions/some-id").c_str(),
-                 R"({"capability": "stop"})", "application/json");
+  auto res = client.Put(std::string(API_BASE_PATH) + "/components/invalid@id/operations/test/executions/some-id",
+                        R"({"capability": "stop"})", "application/json");
 
   ASSERT_TRUE(res);
   EXPECT_EQ(res->status, 400);
@@ -718,9 +711,8 @@ TEST_F(TestGatewayNode, test_execution_update_missing_capability) {
   auto client = create_client();
 
   // PUT without capability field
-  auto res =
-      client.Put((std::string(API_BASE_PATH) + "/components/gateway_node/operations/test/executions/some-id").c_str(),
-                 R"({"timeout": 60})", "application/json");
+  auto res = client.Put(std::string(API_BASE_PATH) + "/components/gateway_node/operations/test/executions/some-id",
+                        R"({"timeout": 60})", "application/json");
 
   ASSERT_TRUE(res);
   EXPECT_EQ(res->status, 400);
@@ -731,9 +723,8 @@ TEST_F(TestGatewayNode, test_execution_update_unsupported_capability) {
   auto client = create_client();
 
   // PUT with unsupported capability (freeze is I/O control specific)
-  auto res =
-      client.Put((std::string(API_BASE_PATH) + "/components/gateway_node/operations/test/executions/some-id").c_str(),
-                 R"({"capability": "freeze"})", "application/json");
+  auto res = client.Put(std::string(API_BASE_PATH) + "/components/gateway_node/operations/test/executions/some-id",
+                        R"({"capability": "freeze"})", "application/json");
 
   ASSERT_TRUE(res);
   // Either 400 for unsupported capability or 404 if execution not found
@@ -745,9 +736,8 @@ TEST_F(TestGatewayNode, test_execution_update_execution_not_found) {
   auto client = create_client();
 
   // PUT with stop capability for non-existent execution
-  auto res = client.Put(
-      (std::string(API_BASE_PATH) + "/components/gateway_node/operations/test/executions/nonexistent").c_str(),
-      R"({"capability": "stop"})", "application/json");
+  auto res = client.Put(std::string(API_BASE_PATH) + "/components/gateway_node/operations/test/executions/nonexistent",
+                        R"({"capability": "stop"})", "application/json");
 
   ASSERT_TRUE(res);
   EXPECT_EQ(res->status, 404);
@@ -760,8 +750,8 @@ TEST_F(TestGatewayNode, test_execution_update_execution_not_found) {
 TEST_F(TestGatewayNode, test_publish_to_topic_invalid_json) {
   auto client = create_client();
 
-  auto res = client.Post((std::string(API_BASE_PATH) + "/components/gateway_node/data/some_topic").c_str(),
-                         "invalid{json}", "application/json");
+  auto res = client.Post(std::string(API_BASE_PATH) + "/components/gateway_node/data/some_topic", "invalid{json}",
+                         "application/json");
 
   ASSERT_TRUE(res);
   // 400 for invalid JSON or 404 if component not found
@@ -772,7 +762,7 @@ TEST_F(TestGatewayNode, test_publish_to_topic_missing_type_field) {
   auto client = create_client();
 
   // Missing 'type' field in request body
-  auto res = client.Post((std::string(API_BASE_PATH) + "/components/gateway_node/data/some_topic").c_str(),
+  auto res = client.Post(std::string(API_BASE_PATH) + "/components/gateway_node/data/some_topic",
                          R"({"data": {"value": 1.0}})", "application/json");
 
   ASSERT_TRUE(res);
@@ -784,7 +774,7 @@ TEST_F(TestGatewayNode, test_publish_to_topic_missing_data_field) {
   auto client = create_client();
 
   // Missing 'data' field in request body
-  auto res = client.Post((std::string(API_BASE_PATH) + "/components/gateway_node/data/some_topic").c_str(),
+  auto res = client.Post(std::string(API_BASE_PATH) + "/components/gateway_node/data/some_topic",
                          R"({"type": "std_msgs/msg/Float32"})", "application/json");
 
   ASSERT_TRUE(res);
@@ -796,7 +786,7 @@ TEST_F(TestGatewayNode, test_publish_to_topic_invalid_message_type_format) {
   auto client = create_client();
 
   // Invalid message type format (should be pkg/msg/Type)
-  auto res = client.Post((std::string(API_BASE_PATH) + "/components/gateway_node/data/some_topic").c_str(),
+  auto res = client.Post(std::string(API_BASE_PATH) + "/components/gateway_node/data/some_topic",
                          R"({"type": "invalid_type", "data": {}})", "application/json");
 
   ASSERT_TRUE(res);
@@ -811,7 +801,7 @@ TEST_F(TestGatewayNode, test_publish_to_topic_invalid_message_type_format) {
 TEST_F(TestGatewayNode, test_area_related_components_nonexistent) {
   auto client = create_client();
 
-  auto res = client.Get((std::string(API_BASE_PATH) + "/areas/nonexistent_area/related-components").c_str());
+  auto res = client.Get(std::string(API_BASE_PATH) + "/areas/nonexistent_area/related-components");
 
   ASSERT_TRUE(res);
   EXPECT_EQ(res->status, 404);
@@ -820,7 +810,7 @@ TEST_F(TestGatewayNode, test_area_related_components_nonexistent) {
 TEST_F(TestGatewayNode, test_component_subcomponents_nonexistent) {
   auto client = create_client();
 
-  auto res = client.Get((std::string(API_BASE_PATH) + "/components/nonexistent_comp/subcomponents").c_str());
+  auto res = client.Get(std::string(API_BASE_PATH) + "/components/nonexistent_comp/subcomponents");
 
   ASSERT_TRUE(res);
   EXPECT_EQ(res->status, 404);
@@ -829,7 +819,7 @@ TEST_F(TestGatewayNode, test_component_subcomponents_nonexistent) {
 TEST_F(TestGatewayNode, test_component_related_apps_nonexistent) {
   auto client = create_client();
 
-  auto res = client.Get((std::string(API_BASE_PATH) + "/components/nonexistent_comp/related-apps").c_str());
+  auto res = client.Get(std::string(API_BASE_PATH) + "/components/nonexistent_comp/related-apps");
 
   ASSERT_TRUE(res);
   EXPECT_EQ(res->status, 404);
@@ -839,7 +829,7 @@ TEST_F(TestGatewayNode, test_area_contains_nonexistent) {
   // @verifies REQ_INTEROP_006
   auto client = create_client();
 
-  auto res = client.Get((std::string(API_BASE_PATH) + "/areas/nonexistent_area/contains").c_str());
+  auto res = client.Get(std::string(API_BASE_PATH) + "/areas/nonexistent_area/contains");
 
   ASSERT_TRUE(res);
   EXPECT_EQ(res->status, 404);
@@ -849,7 +839,7 @@ TEST_F(TestGatewayNode, test_component_hosts_nonexistent) {
   // @verifies REQ_INTEROP_007
   auto client = create_client();
 
-  auto res = client.Get((std::string(API_BASE_PATH) + "/components/nonexistent_comp/hosts").c_str());
+  auto res = client.Get(std::string(API_BASE_PATH) + "/components/nonexistent_comp/hosts");
 
   ASSERT_TRUE(res);
   EXPECT_EQ(res->status, 404);
@@ -858,7 +848,7 @@ TEST_F(TestGatewayNode, test_component_hosts_nonexistent) {
 TEST_F(TestGatewayNode, test_app_nonexistent) {
   auto client = create_client();
 
-  auto res = client.Get((std::string(API_BASE_PATH) + "/apps/nonexistent_app").c_str());
+  auto res = client.Get(std::string(API_BASE_PATH) + "/apps/nonexistent_app");
 
   ASSERT_TRUE(res);
   EXPECT_EQ(res->status, 404);
@@ -867,7 +857,7 @@ TEST_F(TestGatewayNode, test_app_nonexistent) {
 TEST_F(TestGatewayNode, test_function_nonexistent) {
   auto client = create_client();
 
-  auto res = client.Get((std::string(API_BASE_PATH) + "/functions/nonexistent_function").c_str());
+  auto res = client.Get(std::string(API_BASE_PATH) + "/functions/nonexistent_function");
 
   ASSERT_TRUE(res);
   EXPECT_EQ(res->status, 404);
@@ -877,7 +867,7 @@ TEST_F(TestGatewayNode, test_function_detail_includes_cyclic_subscriptions_capab
   load_function_fixture("graph_func");
   auto client = create_client();
 
-  auto res = client.Get((std::string(API_BASE_PATH) + "/functions/graph_func").c_str());
+  auto res = client.Get(std::string(API_BASE_PATH) + "/functions/graph_func");
 
   ASSERT_TRUE(res);
   EXPECT_EQ(res->status, 200);
@@ -897,7 +887,7 @@ TEST_F(TestGatewayNode, test_function_detail_includes_cyclic_subscriptions_capab
 TEST_F(TestGatewayNode, test_function_hosts_nonexistent) {
   auto client = create_client();
 
-  auto res = client.Get((std::string(API_BASE_PATH) + "/functions/nonexistent_function/hosts").c_str());
+  auto res = client.Get(std::string(API_BASE_PATH) + "/functions/nonexistent_function/hosts");
 
   ASSERT_TRUE(res);
   EXPECT_EQ(res->status, 404);
@@ -910,7 +900,7 @@ TEST_F(TestGatewayNode, test_function_hosts_nonexistent) {
 TEST_F(TestGatewayNode, test_invalid_app_id_bad_request) {
   auto client = create_client();
 
-  auto res = client.Get((std::string(API_BASE_PATH) + "/apps/invalid@app#id").c_str());
+  auto res = client.Get(std::string(API_BASE_PATH) + "/apps/invalid@app#id");
 
   ASSERT_TRUE(res);
   EXPECT_EQ(res->status, 400);
@@ -921,7 +911,7 @@ TEST_F(TestGatewayNode, test_app_is_located_on_endpoint) {
   load_app_location_fixture();
 
   auto client = create_client();
-  auto res = client.Get((std::string(API_BASE_PATH) + "/apps/planner/is-located-on").c_str());
+  auto res = client.Get(std::string(API_BASE_PATH) + "/apps/planner/is-located-on");
 
   ASSERT_TRUE(res);
   EXPECT_EQ(res->status, 200);
@@ -937,7 +927,7 @@ TEST_F(TestGatewayNode, test_app_is_located_on_endpoint) {
 TEST_F(TestGatewayNode, test_invalid_function_id_bad_request) {
   auto client = create_client();
 
-  auto res = client.Get((std::string(API_BASE_PATH) + "/functions/invalid@func#id").c_str());
+  auto res = client.Get(std::string(API_BASE_PATH) + "/functions/invalid@func#id");
 
   ASSERT_TRUE(res);
   EXPECT_EQ(res->status, 400);
@@ -1044,24 +1034,25 @@ TEST(ExtractEntityTypePath, unknown_routes) {
 
 TEST(GatewayStartupSummary, CountPeerNodesExcludesOwnAndHidden) {
   const std::vector<std::pair<std::string, std::string>> nodes = {
-      {"ros2_medkit_gateway", "/"},                // the gateway's own node (self)
-      {"ros2_medkit_gateway_sub", "/"},            // own internal helper (FQN prefix)
-      {"ros2_medkit_gateway_fault_clients", "/"},  // own internal helper (FQN prefix)
-      {"_hidden_node", "/"},                       // hidden node
-      {"camera", "/sensors"},                      // peer (hidden node name check is on the name part)
-      {"robot_planner", "/"},                      // peer
-      {"ros2_medkit_gateway_monitor", "/"},        // peer that merely shares the gateway name prefix
+      {"ros2_medkit_gateway", "/"},                 // the gateway's own node (self)
+      {"_ros2_medkit_gateway_sub", "/"},            // own helper node (hidden)
+      {"_ros2_medkit_gateway_fault_clients", "/"},  // own helper node (hidden)
+      {"_hidden_node", "/"},                        // hidden node
+      {"camera", "/sensors"},                       // peer (hidden node name check is on the name part)
+      {"robot_planner", "/"},                       // peer
+      {"ros2_medkit_gateway_monitor", "/"},         // peer that merely shares the gateway name prefix
   };
   // Three genuine peers: /sensors/camera, /robot_planner and the prefix-sharing
-  // /ros2_medkit_gateway_monitor (only the exact self FQN and known helpers drop out).
+  // /ros2_medkit_gateway_monitor (only the exact self FQN and hidden nodes drop out).
   EXPECT_EQ(ros2_medkit_gateway::GatewayNode::count_peer_nodes(nodes, "/ros2_medkit_gateway"), 3u);
 }
 
 TEST(GatewayStartupSummary, CountPeerNodesZeroWhenOnlyOwnNodes) {
   const std::vector<std::pair<std::string, std::string>> nodes = {
       {"ros2_medkit_gateway", "/"},
-      {"ros2_medkit_gateway_sub", "/"},
-      {"ros2_medkit_gateway_fault_clients", "/"},
+      {"_ros2_medkit_gateway_sub", "/"},
+      {"_ros2_medkit_gateway_fault_clients", "/"},
+      {"_ros2_medkit_gateway_lifecycle_state_reader", "/"},
   };
   // Zero peers is the condition that triggers the empty-graph warning.
   EXPECT_EQ(ros2_medkit_gateway::GatewayNode::count_peer_nodes(nodes, "/ros2_medkit_gateway"), 0u);
diff --git a/src/ros2_medkit_gateway/test/test_helper_node.cpp b/src/ros2_medkit_gateway/test/test_helper_node.cpp
new file mode 100644
index 000000000..41f2f97a1
--- /dev/null
+++ b/src/ros2_medkit_gateway/test/test_helper_node.cpp
@@ -0,0 +1,118 @@
+// Copyright 2026 bburda
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+#include <cstdio>
+#include <cstdlib>
+#include <fstream>
+#include <memory>
+#include <string>
+#include <utility>
+#include <vector>
+
+#include <gtest/gtest.h>
+#include <rclcpp/rclcpp.hpp>
+#include <unistd.h>
+
+#include "ros2_medkit_gateway/ros2_common/helper_node.hpp"
+
+using ros2_medkit_gateway::ros2_common::make_helper_node;
+
+namespace {
+
+/// A context initialised with @p args as process-wide arguments, as launch_ros passes them.
+class ProcessContext {
+ public:
+  explicit ProcessContext(std::vector<std::string> args) : args_(std::move(args)) {
+    args_.insert(args_.begin(), "gateway_node");
+    std::vector<const char *> argv;
+    argv.reserve(args_.size());
+    for (const auto & arg : args_) {
+      argv.push_back(arg.c_str());
+    }
+    context_ = std::make_shared<rclcpp::Context>();
+    context_->init(static_cast<int>(argv.size()), argv.data());
+  }
+
+  ~ProcessContext() {
+    context_->shutdown("test done");
+  }
+
+  ProcessContext(const ProcessContext &) = delete;
+  ProcessContext & operator=(const ProcessContext &) = delete;
+  ProcessContext(ProcessContext &&) = delete;
+  ProcessContext & operator=(ProcessContext &&) = delete;
+
+  rclcpp::NodeOptions options() const {
+    return rclcpp::NodeOptions().context(context_);
+  }
+
+ private:
+  std::vector<std::string> args_;
+  std::shared_ptr<rclcpp::Context> context_;
+};
+
+}  // namespace
+
+TEST(HelperNode, KeepsOwnNameUnderProcessWideNodeRemap) {
+  ProcessContext process({"--ros-args", "-r", "__node:=gateway", "-r", "__ns:=/robot1", "-r", "/in:=/out"});
+  auto host = std::make_shared<rclcpp::Node>("gateway_node", process.options());
+  ASSERT_STREQ(host->get_name(), "gateway");
+
+  auto helper = make_helper_node(*host, "_clients");
+
+  EXPECT_STREQ(helper->get_name(), "_gateway_clients");
+  EXPECT_STREQ(helper->get_namespace(), "/robot1");
+  // Process-wide remaps other than the node name still apply.
+  EXPECT_EQ(helper->get_node_topics_interface()->resolve_topic_name("/in"), "/out");
+}
+
+TEST(HelperNode, InheritsUseSimTimeFromParametersKeyedToHost) {
+  char path[] = "/tmp/helper_node_params_XXXXXX";
+  const int fd = mkstemp(path);
+  ASSERT_NE(fd, -1);
+  close(fd);
+  {
+    std::ofstream file(path);
+    file << "/robot1/gateway:\n  ros__parameters:\n    use_sim_time: true\n";
+  }
+  ProcessContext process({"--ros-args", "-r", "__node:=gateway", "-r", "__ns:=/robot1", "--params-file", path});
+  auto host = std::make_shared<rclcpp::Node>("gateway_node", process.options());
+  ASSERT_TRUE(host->get_parameter("use_sim_time").as_bool());
+
+  auto helper = make_helper_node(*host, "_clients");
+
+  EXPECT_TRUE(helper->get_parameter("use_sim_time").as_bool());
+  std::remove(path);
+}
+
+TEST(HelperNode, UsesNamespaceGivenToHostConstructor) {
+  ProcessContext process({});
+  auto host = std::make_shared<rclcpp::Node>("gateway", "/robot2", process.options());
+
+  auto helper = make_helper_node(*host, "_sub");
+
+  EXPECT_STREQ(helper->get_name(), "_gateway_sub");
+  EXPECT_STREQ(helper->get_namespace(), "/robot2");
+  EXPECT_FALSE(helper->get_parameter("use_sim_time").as_bool());
+}
+
+TEST(HelperNode, ServesNoParameters) {
+  ProcessContext process({"--ros-args", "-r", "__node:=gateway"});
+  auto host = std::make_shared<rclcpp::Node>("gateway_node", process.options());
+
+  auto helper = make_helper_node(*host, "_sub");
+
+  EXPECT_FALSE(helper->get_node_options().start_parameter_services());
+  EXPECT_FALSE(helper->get_node_options().start_parameter_event_publisher());
+}
diff --git a/src/ros2_medkit_gateway/test/test_ros2_subscription_executor.cpp b/src/ros2_medkit_gateway/test/test_ros2_subscription_executor.cpp
index 3a9f5134d..f3b002f01 100644
--- a/src/ros2_medkit_gateway/test/test_ros2_subscription_executor.cpp
+++ b/src/ros2_medkit_gateway/test/test_ros2_subscription_executor.cpp
@@ -156,7 +156,8 @@ TEST_F(Ros2SubscriptionExecutorTest, QueueFullReturnsBackpressure) {
 TEST_F(Ros2SubscriptionExecutorTest, NodeAccessibleWithSuffixedName) {
   auto * n = sub_exec_->node();
   ASSERT_NE(n, nullptr);
-  EXPECT_EQ(std::string(n->get_name()), std::string("test_gateway_node_sub"));
+  // Hidden helper node: leading underscore, then the gateway node name and the suffix.
+  EXPECT_EQ(std::string(n->get_name()), std::string("_test_gateway_node_sub"));
 }
 
 TEST_F(Ros2SubscriptionExecutorTest, StatsTrackCompletedTasks) {
diff --git a/src/ros2_medkit_integration_tests/ros2_medkit_test_utils/launch_helpers.py b/src/ros2_medkit_integration_tests/ros2_medkit_test_utils/launch_helpers.py
index f36a329de..a207ab3ce 100644
--- a/src/ros2_medkit_integration_tests/ros2_medkit_test_utils/launch_helpers.py
+++ b/src/ros2_medkit_integration_tests/ros2_medkit_test_utils/launch_helpers.py
@@ -102,7 +102,8 @@
 
 def create_gateway_node(*, port=DEFAULT_PORT, name='ros2_medkit_gateway',
                         extra_params=None, coverage=True, extra_env=None,
-                        respawn=False, respawn_delay=1.0):
+                        respawn=False, respawn_delay=1.0, namespace=None,
+                        remappings=None):
     """Create a ``gateway_node`` launch action with standard config.
 
     Parameters
@@ -132,6 +133,11 @@ def create_gateway_node(*, port=DEFAULT_PORT, name='ros2_medkit_gateway',
         and the DDS participant are released before the replacement binds
         them, which also gives a test a window in which the port is provably
         down - the only way to tell "restarted" from "never died".
+    namespace : str or None
+        ROS namespace for the gateway. ``None`` leaves it unset, which also
+        keeps launch_ros writing the parameters under ``/**``.
+    remappings : list of (str, str) or None
+        Remap rules. launch_ros passes them to the whole process.
 
     Returns
     -------
@@ -147,6 +153,12 @@ def create_gateway_node(*, port=DEFAULT_PORT, name='ros2_medkit_gateway',
     if extra_env:
         env.update(extra_env)
 
+    optional = {}
+    if namespace is not None:
+        optional['namespace'] = namespace
+    if remappings is not None:
+        optional['remappings'] = remappings
+
     return launch_ros.actions.Node(
         package='ros2_medkit_gateway',
         executable='gateway_node',
@@ -156,6 +168,7 @@ def create_gateway_node(*, port=DEFAULT_PORT, name='ros2_medkit_gateway',
         additional_env=env,
         respawn=respawn,
         respawn_delay=respawn_delay,
+        **optional,
         # Default SIGINT->SIGTERM escalation is 5s and SIGTERM->SIGKILL is 5s.
         # Under TSan/ASan/coverage the gateway shutdown sequence (mdns stop,
         # REST server stop, transport teardown, plugin shutdown, plus flushing
@@ -182,6 +195,7 @@ def create_fault_manager_node(
     extra_params=None,
     coverage=True,
     extra_env=None,
+    namespace=None,
 ):
     """Create a ``fault_manager_node`` with test-friendly defaults.
 
@@ -210,6 +224,8 @@ def create_fault_manager_node(
     extra_env : dict or None
         Additional environment variables merged into ``additional_env`` on
         top of the coverage env (e.g. ``ROS_DOMAIN_ID`` for a peer).
+    namespace : str or None
+        ROS namespace for the fault manager. ``None`` leaves it unset.
 
     Returns
     -------
@@ -240,6 +256,10 @@ def create_fault_manager_node(
     if extra_env:
         env.update(extra_env)
 
+    optional = {}
+    if namespace is not None:
+        optional['namespace'] = namespace
+
     return launch_ros.actions.Node(
         package='ros2_medkit_fault_manager',
         executable='fault_manager_node',
@@ -247,6 +267,7 @@ def create_fault_manager_node(
         output='screen',
         additional_env=env,
         parameters=[params],
+        **optional,
         # Same rationale as create_gateway_node: under coverage the node must
         # flush gcov data at shutdown, which can exceed the 5s launch default
         # and get the process SIGKILLed to -9. Widen both windows.
diff --git a/src/ros2_medkit_integration_tests/ros2_medkit_test_utils/ros_graph.py b/src/ros2_medkit_integration_tests/ros2_medkit_test_utils/ros_graph.py
new file mode 100644
index 000000000..6344fcb67
--- /dev/null
+++ b/src/ros2_medkit_integration_tests/ros2_medkit_test_utils/ros_graph.py
@@ -0,0 +1,108 @@
+# Copyright 2026 bburda
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+"""Read node identity from the ROS graph, as an operator's tools see it."""
+
+import collections
+import os
+import subprocess
+import time
+
+from rcl_interfaces.msg import ParameterType
+from rcl_interfaces.srv import GetParameters
+import rclpy
+
+
+def join_fqn(namespace, name):
+    """Return the fully qualified node name for *namespace* and *name*."""
+    return namespace.rstrip('/') + '/' + name
+
+
+def leaf_name(fqn):
+    """Return the node name part of a fully qualified name."""
+    return fqn.rsplit('/', 1)[-1]
+
+
+def node_fqns(node):
+    """Return the FQN of every node in the graph, hidden nodes included."""
+    return [join_fqn(ns, name) for name, ns in node.get_node_names_and_namespaces()]
+
+
+def duplicate_fqns(fqns):
+    """Return the FQNs that appear more than once, sorted."""
+    return sorted(fqn for fqn, count in collections.Counter(fqns).items() if count > 1)
+
+
+def wait_for_graph(node, predicate, *, timeout=30.0, interval=0.2):
+    """Poll the graph until ``predicate(fqns)`` is true; return the last FQN list."""
+    deadline = time.monotonic() + timeout
+    fqns = node_fqns(node)
+    while time.monotonic() < deadline:
+        fqns = node_fqns(node)
+        if predicate(fqns):
+            return fqns
+        time.sleep(interval)
+    return fqns
+
+
+def _split_fqn(fqn):
+    namespace, _, name = fqn.rpartition('/')
+    return name, namespace or '/'
+
+
+def subscribed_topics(node, fqn):
+    """Return the topics the node at *fqn* subscribes to."""
+    return {topic for topic, _ in node.get_subscriber_names_and_types_by_node(*_split_fqn(fqn))}
+
+
+def advertised_services(node, fqn):
+    """Return the services the node at *fqn* advertises."""
+    return {service for service, _ in node.get_service_names_and_types_by_node(*_split_fqn(fqn))}
+
+
+def get_bool_parameter(node, fqn, name, *, timeout=10.0):
+    """Read a bool parameter from the node at *fqn*; None when unreadable."""
+    client = node.create_client(GetParameters, fqn + '/get_parameters')
+    try:
+        if not client.wait_for_service(timeout_sec=timeout):
+            return None
+        future = client.call_async(GetParameters.Request(names=[name]))
+        rclpy.spin_until_future_complete(node, future, timeout_sec=timeout)
+        result = future.result()
+        if result is None or len(result.values) != 1:
+            return None
+        value = result.values[0]
+        if value.type != ParameterType.PARAMETER_BOOL:
+            return None
+        return value.bool_value
+    finally:
+        node.destroy_client(client)
+
+
+def ros2_param_list(fqn, *, timeout=60.0):
+    """Run ``ros2 param list <fqn>`` and return (parameter names, raw stdout).
+
+    Uses ``--no-daemon`` so the answer comes from this process's own discovery
+    on the test domain, not from a daemon started earlier on another one.
+    """
+    result = subprocess.run(
+        ['ros2', 'param', 'list', fqn, '--no-daemon', '--spin-time', '5'],
+        capture_output=True, text=True, timeout=timeout, env=os.environ.copy(),
+        check=False,
+    )
+    names = [
+        line.strip() for line in result.stdout.splitlines()
+        if line.strip() and not line.rstrip().endswith(':')
+    ]
+    return names, result.stdout + result.stderr
diff --git a/src/ros2_medkit_integration_tests/test/features/test_gateway_helper_nodes.test.py b/src/ros2_medkit_integration_tests/test/features/test_gateway_helper_nodes.test.py
new file mode 100644
index 000000000..ca4644de3
--- /dev/null
+++ b/src/ros2_medkit_integration_tests/test/features/test_gateway_helper_nodes.test.py
@@ -0,0 +1,166 @@
+#!/usr/bin/env python3
+# Copyright 2026 bburda
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+"""The gateway's in-process helper nodes keep their own names under launch_ros.
+
+launch_ros ``Node(name=...)`` passes ``-r __node:=<name>`` to the whole
+process. The gateway creates helper nodes of its own (fault service clients,
+lifecycle state reads, topic subscriptions). Each of them must stay distinct
+from the gateway node, stay hidden from discovery, and keep working.
+
+The namespaced, remapped and sim-time launch is covered by
+``test_gateway_helper_nodes_namespaced.test.py``.
+"""
+
+import unittest
+
+import launch_testing
+import rclpy
+from rclpy.node import Node
+
+from ros2_medkit_test_utils.constants import ALLOWED_EXIT_CODES
+from ros2_medkit_test_utils.gateway_test_case import GatewayTestCase
+from ros2_medkit_test_utils.launch_helpers import create_test_launch
+from ros2_medkit_test_utils.ros_graph import (
+    advertised_services,
+    duplicate_fqns,
+    leaf_name,
+    ros2_param_list,
+    wait_for_graph,
+)
+
+GATEWAY_NAME = 'ros2_medkit_gateway'
+GATEWAY_FQN = '/' + GATEWAY_NAME
+LAUNCHED_APPS = {
+    GATEWAY_NAME, 'fault_manager', 'temp_sensor', 'managed_lifecycle',
+    'managed_lifecycle_active',
+}
+
+
+def generate_test_description():
+    return create_test_launch(
+        demo_nodes=['temp_sensor', 'managed_lifecycle', 'managed_lifecycle_active'],
+        fault_manager=True,
+    )
+
+
+class TestGatewayHelperNodes(GatewayTestCase):
+    """One gateway launched through launch_ros is one node in the graph."""
+
+    REQUIRED_APPS = LAUNCHED_APPS
+
+    @classmethod
+    def setUpClass(cls):
+        super().setUpClass()
+        rclpy.init()
+        # Hidden, so the probe itself never becomes an App.
+        cls._probe = Node('_helper_node_probe')
+
+    @classmethod
+    def tearDownClass(cls):
+        cls._probe.destroy_node()
+        rclpy.shutdown()
+        super().tearDownClass()
+
+    def _settled_graph(self):
+        # The fault manager is launched last, so its presence means every
+        # launched node had time to join the graph.
+        return wait_for_graph(
+            self._probe,
+            lambda fqns: GATEWAY_FQN in fqns and '/fault_manager' in fqns,
+        )
+
+    def test_gateway_name_is_unique_in_graph(self):
+        fqns = self._settled_graph()
+        self.assertEqual(
+            fqns.count(GATEWAY_FQN), 1,
+            f'{GATEWAY_FQN} appears {fqns.count(GATEWAY_FQN)} times in {sorted(fqns)}',
+        )
+        self.assertEqual(duplicate_fqns(fqns), [], f'duplicate node names in {sorted(fqns)}')
+
+    def test_helper_nodes_are_hidden(self):
+        fqns = self._settled_graph()
+        own = [f for f in fqns if GATEWAY_NAME in leaf_name(f) and f != GATEWAY_FQN]
+        self.assertTrue(own, f'no helper node of the gateway found in {sorted(fqns)}')
+        visible = [f for f in own if not leaf_name(f).startswith('_')]
+        self.assertEqual(visible, [], f'helper nodes not hidden: {visible}')
+
+    def test_helper_nodes_advertise_no_parameter_services(self):
+        # A helper spun only during its own requests would never answer a
+        # parameter service.
+        fqns = self._settled_graph()
+        own = [f for f in fqns if GATEWAY_NAME in leaf_name(f) and f != GATEWAY_FQN]
+        self.assertTrue(own, f'no helper node of the gateway found in {sorted(fqns)}')
+        for fqn in own:
+            params = [s for s in advertised_services(self._probe, fqn) if 'parameter' in s]
+            self.assertEqual(params, [], f'{fqn} advertises {params}')
+
+    def test_ros2_param_list_lists_each_parameter_once(self):
+        self._settled_graph()
+        names, output = ros2_param_list(GATEWAY_FQN)
+        self.assertIn('server.port', names, output)
+        duplicates = sorted({n for n in names if names.count(n) > 1})
+        self.assertEqual(duplicates, [], f'parameters listed more than once:\n{output}')
+
+    def test_helper_nodes_are_not_apps(self):
+        self._settled_graph()
+        data = self.poll_endpoint_until(
+            '/apps',
+            lambda d: d if LAUNCHED_APPS <= {a['id'] for a in d.get('items', [])} else None,
+            timeout=15.0,
+        )
+        ids = {a['id'] for a in data['items']}
+        own = {i for i in ids if GATEWAY_NAME in i}
+        self.assertEqual(own, {GATEWAY_NAME}, f'gateway-derived apps: {sorted(ids)}')
+
+    def test_fault_client_node_serves_requests(self):
+        data = self.poll_endpoint('/faults', timeout=15.0)
+        self.assertIn('items', data)
+
+    def test_subscription_node_samples_topics(self):
+        topic = self.encode_topic_path('/powertrain/engine/temperature')
+        data = self.poll_endpoint_until(
+            f'/apps/temp_sensor/data/{topic}',
+            lambda d: d if d.get('x-medkit', {}).get('status') == 'data' else None,
+            timeout=15.0,
+        )
+        self.assertEqual(data['x-medkit']['status'], 'data')
+
+    def test_lifecycle_reader_node_reads_states(self):
+        # Graph presence alone reads "ready"; notReady for the unconfigured
+        # node proves a real GetState round trip.
+        unconfigured = self.poll_endpoint_until(
+            '/apps/managed_lifecycle/status',
+            lambda d: d if d.get('status') == 'notReady' else None,
+            timeout=20.0,
+        )
+        self.assertEqual(unconfigured['status'], 'notReady')
+        active = self.poll_endpoint_until(
+            '/apps/managed_lifecycle_active/status',
+            lambda d: d if d.get('status') == 'ready' else None,
+            timeout=20.0,
+        )
+        self.assertEqual(active['status'], 'ready')
+
+
+@launch_testing.post_shutdown_test()
+class TestShutdown(unittest.TestCase):
+
+    def test_exit_codes(self, proc_info):
+        for info in proc_info:
+            self.assertIn(
+                info.returncode, ALLOWED_EXIT_CODES,
+                f'{info.process_name} exited with code {info.returncode}'
+            )
diff --git a/src/ros2_medkit_integration_tests/test/features/test_gateway_helper_nodes_namespaced.test.py b/src/ros2_medkit_integration_tests/test/features/test_gateway_helper_nodes_namespaced.test.py
new file mode 100644
index 000000000..eb30b79ec
--- /dev/null
+++ b/src/ros2_medkit_integration_tests/test/features/test_gateway_helper_nodes_namespaced.test.py
@@ -0,0 +1,197 @@
+#!/usr/bin/env python3
+# Copyright 2026 bburda
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+"""Gateway helper nodes keep the process namespace, remaps and sim time.
+
+The gateway runs in a namespace, with ``use_sim_time`` and with remap rules
+that are the only route to a fault manager in that namespace
+(``fault_manager.namespace`` is left unset on purpose). The gateway's helper
+nodes must keep their own names and still get all of these. With a namespace
+set, launch_ros writes the parameters under the gateway's FQN, so a helper
+with another name does not read them from that file.
+"""
+
+import unittest
+
+from launch import LaunchDescription
+from launch.actions import TimerAction
+import launch_testing
+import launch_testing.actions
+import rclpy
+from rclpy.node import Node
+
+from ros2_medkit_test_utils.constants import ALLOWED_EXIT_CODES
+from ros2_medkit_test_utils.gateway_test_case import GatewayTestCase
+from ros2_medkit_test_utils.launch_helpers import (
+    create_demo_nodes,
+    create_fault_manager_node,
+    create_gateway_node,
+)
+from ros2_medkit_test_utils.ros_graph import (
+    duplicate_fqns,
+    get_bool_parameter,
+    leaf_name,
+    ros2_param_list,
+    subscribed_topics,
+    wait_for_graph,
+)
+
+NAMESPACE = '/robot1'
+GATEWAY_NAME = 'ros2_medkit_gateway'
+GATEWAY_FQN = f'{NAMESPACE}/{GATEWAY_NAME}'
+FAULT_MANAGER_FQN = f'{NAMESPACE}/fault_manager'
+FAULT_SERVICES = [
+    'report_fault', 'get_fault', 'list_faults', 'clear_fault', 'get_snapshots',
+    'get_rosbag', 'list_rosbags',
+]
+LAUNCHED_APPS = {
+    GATEWAY_NAME, 'fault_manager', 'temp_sensor', 'managed_lifecycle',
+    'managed_lifecycle_active',
+}
+
+
+def generate_test_description():
+    gateway = create_gateway_node(
+        namespace=NAMESPACE,
+        remappings=[
+            (f'/fault_manager/{s}', f'{FAULT_MANAGER_FQN}/{s}') for s in FAULT_SERVICES
+        ],
+        extra_params={'use_sim_time': True},
+    )
+    delayed = TimerAction(
+        period=2.0,
+        actions=create_demo_nodes(
+            ['temp_sensor', 'managed_lifecycle', 'managed_lifecycle_active'],
+        ) + [create_fault_manager_node(namespace=NAMESPACE)],
+    )
+    return (
+        LaunchDescription([gateway, delayed, launch_testing.actions.ReadyToTest()]),
+        {'gateway_node': gateway},
+    )
+
+
+class TestNamespacedGatewayHelperNodes(GatewayTestCase):
+    """Helper nodes follow the gateway's namespace, remaps and sim time."""
+
+    REQUIRED_APPS = LAUNCHED_APPS
+
+    @classmethod
+    def setUpClass(cls):
+        super().setUpClass()
+        rclpy.init()
+        # Hidden, so the probe itself never becomes an App.
+        cls._probe = Node('_helper_node_probe')
+
+    @classmethod
+    def tearDownClass(cls):
+        cls._probe.destroy_node()
+        rclpy.shutdown()
+        super().tearDownClass()
+
+    def _settled_graph(self):
+        return wait_for_graph(
+            self._probe,
+            lambda fqns: GATEWAY_FQN in fqns and FAULT_MANAGER_FQN in fqns,
+        )
+
+    def _helper_fqns(self, fqns):
+        return [f for f in fqns if GATEWAY_NAME in leaf_name(f) and f != GATEWAY_FQN]
+
+    def test_gateway_name_is_unique_in_graph(self):
+        fqns = self._settled_graph()
+        self.assertEqual(
+            fqns.count(GATEWAY_FQN), 1,
+            f'{GATEWAY_FQN} appears {fqns.count(GATEWAY_FQN)} times in {sorted(fqns)}',
+        )
+        self.assertEqual(duplicate_fqns(fqns), [], f'duplicate node names in {sorted(fqns)}')
+
+    def test_helper_nodes_live_in_gateway_namespace(self):
+        fqns = self._settled_graph()
+        helpers = self._helper_fqns(fqns)
+        self.assertTrue(helpers, f'no helper node of the gateway found in {sorted(fqns)}')
+        outside = [f for f in helpers if not f.startswith(NAMESPACE + '/')]
+        self.assertEqual(outside, [], f'helper nodes outside {NAMESPACE}: {outside}')
+        visible = [f for f in helpers if not leaf_name(f).startswith('_')]
+        self.assertEqual(visible, [], f'helper nodes not hidden: {visible}')
+
+    def test_helper_nodes_use_sim_time(self):
+        # A node with use_sim_time subscribes to /clock.
+        fqns = self._settled_graph()
+        self.assertIs(get_bool_parameter(self._probe, GATEWAY_FQN, 'use_sim_time'), True)
+        helpers = self._helper_fqns(fqns)
+        self.assertTrue(helpers, f'no helper node of the gateway found in {sorted(fqns)}')
+        for fqn in helpers:
+            topics = subscribed_topics(self._probe, fqn)
+            self.assertIn('/clock', topics, f'{fqn} does not use sim time')
+
+    def test_ros2_param_list_lists_each_parameter_once(self):
+        self._settled_graph()
+        names, output = ros2_param_list(GATEWAY_FQN)
+        self.assertIn('server.port', names, output)
+        duplicates = sorted({n for n in names if names.count(n) > 1})
+        self.assertEqual(duplicates, [], f'parameters listed more than once:\n{output}')
+
+    def test_helper_nodes_are_not_apps(self):
+        self._settled_graph()
+        data = self.poll_endpoint_until(
+            '/apps',
+            lambda d: d if LAUNCHED_APPS <= {a['id'] for a in d.get('items', [])} else None,
+            timeout=15.0,
+        )
+        ids = {a['id'] for a in data['items']}
+        own = {i for i in ids if GATEWAY_NAME in i}
+        self.assertEqual(own, {GATEWAY_NAME}, f'gateway-derived apps: {sorted(ids)}')
+
+    def test_fault_client_node_follows_remaps(self):
+        # Without the remap the fault clients call /fault_manager/*, which
+        # nothing serves, and the gateway answers 503.
+        data = self.poll_endpoint('/faults', timeout=20.0)
+        self.assertIn('items', data)
+
+    def test_subscription_node_samples_topics(self):
+        topic = self.encode_topic_path('/powertrain/engine/temperature')
+        data = self.poll_endpoint_until(
+            f'/apps/temp_sensor/data/{topic}',
+            lambda d: d if d.get('x-medkit', {}).get('status') == 'data' else None,
+            timeout=15.0,
+        )
+        self.assertEqual(data['x-medkit']['status'], 'data')
+
+    def test_lifecycle_reader_node_reads_states(self):
+        # Graph presence alone reads "ready"; notReady for the unconfigured
+        # node proves a real GetState round trip.
+        unconfigured = self.poll_endpoint_until(
+            '/apps/managed_lifecycle/status',
+            lambda d: d if d.get('status') == 'notReady' else None,
+            timeout=20.0,
+        )
+        self.assertEqual(unconfigured['status'], 'notReady')
+        active = self.poll_endpoint_until(
+            '/apps/managed_lifecycle_active/status',
+            lambda d: d if d.get('status') == 'ready' else None,
+            timeout=20.0,
+        )
+        self.assertEqual(active['status'], 'ready')
+
+
+@launch_testing.post_shutdown_test()
+class TestShutdown(unittest.TestCase):
+
+    def test_exit_codes(self, proc_info):
+        for info in proc_info:
+            self.assertIn(
+                info.returncode, ALLOWED_EXIT_CODES,
+                f'{info.process_name} exited with code {info.returncode}'
+            )
diff --git a/src/ros2_medkit_plugins/ros2_medkit_graph_watchdog/CMakeLists.txt b/src/ros2_medkit_plugins/ros2_medkit_graph_watchdog/CMakeLists.txt
index adc0f6463..37e484120 100644
--- a/src/ros2_medkit_plugins/ros2_medkit_graph_watchdog/CMakeLists.txt
+++ b/src/ros2_medkit_plugins/ros2_medkit_graph_watchdog/CMakeLists.txt
@@ -49,7 +49,8 @@ set(GATEWAY_SRC_DIR "${CMAKE_CURRENT_SOURCE_DIR}/../../ros2_medkit_gateway"
 set(GATEWAY_SRC_INCLUDE_DIR "${GATEWAY_SRC_DIR}/include")
 set(LIFECYCLE_STATE_READER_SOURCES
   ${GATEWAY_SRC_DIR}/src/core/status/lifecycle_status_helpers.cpp
-  ${GATEWAY_SRC_DIR}/src/ros2/status/ros2_lifecycle_state_reader.cpp)
+  ${GATEWAY_SRC_DIR}/src/ros2/status/ros2_lifecycle_state_reader.cpp
+  ${GATEWAY_SRC_DIR}/src/ros2_common/helper_node.cpp)
 # Fail early with a clear message if the reused gateway sources are missing
 # (e.g. building the package outside the workspace),
 # instead of a later non-obvious compile error.

From 0c43f9b0a3606e13c5158a82bfbff5a3c3d29d96 Mon Sep 17 00:00:00 2001
From: Bartosz Burda <bartoszburda93@gmail.com>
Date: Sat, 26 Sep 2026 09:45:51 +0200
Subject: [PATCH 2/5] docs: explain server_host in containers and exact CORS
 origins

bringup.launch.py and gateway.launch.py bind 127.0.0.1. Inside a container
on a bridge network that is the container's loopback, so a published port
answers with "Connection reset by peer" or an empty reply. The image's
default command binds 0.0.0.0. The README, the bringup and Docker tutorials
and the troubleshooting page now say so, show the startup line that names
the bind address, and give the fix with -p 127.0.0.1:8080:8080 to keep the
unauthenticated API off the LAN.

The README no longer tells native users to set cors.allowed_origins: the
launch files already allow http://localhost:3000 and http://localhost:5173.
The pages now state that the origin must match exactly
(http://127.0.0.1:3000 and http://localhost:3000 are different origins)
and that cors_allowed_origins:= replaces the defaults. The bringup
tutorial and the gateway README list that launch argument.

The web UI compose example used ros:jazzy, which has no gateway, and served
the UI on port 80, an origin the defaults reject; it now uses the gateway
image on the host network and the UI on port 3000. The getting started page
quotes the gateway's real startup lines.
---
 README.md                         | 14 ++++++++--
 docs/getting_started.rst          |  4 +--
 docs/troubleshooting.rst          | 44 ++++++++++++++++++++++++++++---
 docs/tutorials/bringup.rst        | 13 +++++++++
 docs/tutorials/docker.rst         | 31 +++++++++++++++++++---
 docs/tutorials/web-ui.rst         | 26 +++++++++++-------
 src/ros2_medkit_gateway/README.md |  1 +
 7 files changed, 112 insertions(+), 21 deletions(-)

diff --git a/README.md b/README.md
index 532571891..25ac811ed 100644
--- a/README.md
+++ b/README.md
@@ -99,6 +99,13 @@ sudo apt install ros-jazzy-ros2-medkit-gateway   # or ros-humble- / ros-lyrical-
 ros2 launch ros2_medkit_gateway bringup.launch.py
 ```
 
+> [!IMPORTANT]
+> `bringup.launch.py` binds the REST API to `127.0.0.1`. Inside a container without
+> `--network host` that is the container's own loopback, and the host gets
+> `Connection reset by peer` or an empty reply on the published port. Pass `server_host:=0.0.0.0`
+> and publish the port. Publishing it as `-p 127.0.0.1:8080:8080` keeps the API, which has no
+> authentication by default, off the LAN.
+
 > [!TIP]
 > That is the whole setup. It auto-discovers every node, topic, service and action and starts
 > emitting structured faults over REST - no instrumentation, no changes to your stack. Prefer
@@ -157,8 +164,11 @@ docker run -p 3000:80 ghcr.io/selfpatch/ros2_medkit_web_ui:latest
 ```
 
 The browser calls the gateway from a different origin, so the gateway must allow that origin via
-CORS (the prebuilt gateway Docker image enables it; for a native bringup set
-`cors.allowed_origins`). See the [web UI tutorial](https://selfpatch.github.io/ros2_medkit/tutorials/web-ui.html).
+CORS. The Docker image and `bringup.launch.py` allow `http://localhost:3000` and
+`http://localhost:5173`. The origin must match exactly: `http://127.0.0.1:3000` is not
+`http://localhost:3000`. To allow other origins, pass the full list, for example
+`cors_allowed_origins:=http://localhost:3000,http://127.0.0.1:3000` (it replaces the defaults).
+See the [web UI tutorial](https://selfpatch.github.io/ros2_medkit/tutorials/web-ui.html).
 
 </details>
 
diff --git a/docs/getting_started.rst b/docs/getting_started.rst
index 7ee1ccd57..3863e565b 100644
--- a/docs/getting_started.rst
+++ b/docs/getting_started.rst
@@ -46,8 +46,8 @@ You should see:
 
 .. code-block:: text
 
-   [gateway_node]: REST server starting on http://127.0.0.1:8080
-   [gateway_node]: REST server started successfully
+   [ros2_medkit_gateway]: Configuration: REST API at 127.0.0.1:8080, backstop refresh interval: 30000ms
+   [ros2_medkit_gateway]: ROS 2 Medkit Gateway ready on HTTP://127.0.0.1:8080
 
 **Terminal 2 - Start demo nodes:**
 
diff --git a/docs/troubleshooting.rst b/docs/troubleshooting.rst
index c0fedb8b6..7e1e3ca9f 100644
--- a/docs/troubleshooting.rst
+++ b/docs/troubleshooting.rst
@@ -73,6 +73,34 @@ For network access, set host to 0.0.0.0:
 
    ros2 launch ros2_medkit_gateway gateway.launch.py server_host:=0.0.0.0
 
+**"Connection reset by peer" or "Empty reply from server" from a container**
+
+.. code-block:: text
+
+   curl: (56) Recv failure: Connection reset by peer
+   curl: (52) Empty reply from server
+
+The gateway runs in a container on a bridge network with a published port
+(``-p 8080:8080``), ``curl`` inside the container works, and ``curl`` on the host
+fails. The gateway listens on the container's loopback: ``bringup.launch.py`` and
+``gateway.launch.py`` default to ``server_host:=127.0.0.1``. The startup log shows
+the bind address:
+
+.. code-block:: text
+
+   Configuration: REST API at 127.0.0.1:8080, backstop refresh interval: 30000ms
+
+Bind all interfaces inside the container:
+
+.. code-block:: bash
+
+   ros2 launch ros2_medkit_gateway bringup.launch.py server_host:=0.0.0.0
+
+Publish the port as ``-p 127.0.0.1:8080:8080`` to keep the API off the LAN;
+authentication is off by default. With ``--network host`` the default bind is
+enough, because the container shares the host's loopback. The Docker image's
+default command already binds ``0.0.0.0``.
+
 **Topic data returns empty or timeout**
 
 Possible causes:
@@ -163,9 +191,19 @@ For development, try ``network_mode: host``.
 
 **Web UI can't connect to gateway in container**
 
-1. Gateway must listen on ``0.0.0.0``, not ``127.0.0.1``
-2. CORS must allow the UI origin
-3. Port must be exposed in docker-compose
+1. Gateway must listen on ``0.0.0.0``, not ``127.0.0.1``. The image's default
+   command does; a launch file needs the argument:
+
+   .. code-block:: bash
+
+      ros2 launch ros2_medkit_gateway bringup.launch.py server_host:=0.0.0.0
+
+2. CORS must allow the UI origin exactly as the browser sends it (scheme, host
+   and port): ``http://127.0.0.1:3000`` is not ``http://localhost:3000``. The
+   defaults are ``http://localhost:3000`` and ``http://localhost:5173``. Pass
+   ``cors_allowed_origins:=<origin>,<origin>`` to the launch file for others; it
+   replaces the defaults, so list every origin you need.
+3. Port must be published (``-p 8080:8080`` or ``ports`` in docker-compose)
 
 Fault Manager Issues
 --------------------
diff --git a/docs/tutorials/bringup.rst b/docs/tutorials/bringup.rst
index 60ec7f083..0e545da24 100644
--- a/docs/tutorials/bringup.rst
+++ b/docs/tutorials/bringup.rst
@@ -48,6 +48,11 @@ launch arguments:
    * - ``server_port``
      - ``8080``
      - Gateway REST API port.
+   * - ``cors_allowed_origins``
+     - ``http://localhost:3000,http://localhost:5173``
+     - Comma-separated browser origins allowed to call the gateway. Each must
+       match exactly (``http://127.0.0.1:3000`` is not ``http://localhost:3000``).
+       A value replaces the defaults; empty disables CORS.
    * - ``enable_fault_manager``
      - ``true``
      - Start the fault_manager node.
@@ -62,6 +67,14 @@ launch arguments:
      - Start the diagnostic_bridge (``/diagnostics`` -> faults). Opt-in, for
        legacy ``diagnostic_updater`` publishers.
 
+.. note::
+
+   In a container without ``--network host``, ``127.0.0.1`` is the container's
+   own loopback: the published port answers with ``Connection reset by peer``
+   or an empty reply. Run ``bringup.launch.py server_host:=0.0.0.0`` and publish
+   the port as ``-p 127.0.0.1:8080:8080`` to keep the API (no authentication by
+   default) off the LAN.
+
 Verify
 ------
 
diff --git a/docs/tutorials/docker.rst b/docs/tutorials/docker.rst
index 84c042e67..abd2ece16 100644
--- a/docs/tutorials/docker.rst
+++ b/docs/tutorials/docker.rst
@@ -67,10 +67,28 @@ Test the gateway:
 Custom Configuration
 --------------------
 
-The default configuration listens on ``0.0.0.0:8080``. CORS is enabled for the
-default web UI origins (``http://localhost:3000`` and ``http://localhost:5173``)
-so the web UI works out of the box; add your own UI origin(s) as needed (see
-`CORS for Web UI`_ below). To use a custom configuration, mount a params file:
+The image's default command runs the gateway alone with
+``/etc/ros2_medkit/params.yaml``, which listens on ``0.0.0.0:8080``. CORS is
+enabled for the default web UI origins (``http://localhost:3000`` and
+``http://localhost:5173``) so the web UI works out of the box; add your own UI
+origin(s) as needed (see `CORS for Web UI`_ below).
+
+.. note::
+
+   A launch file run in the container binds ``127.0.0.1`` unless told
+   otherwise. Without ``--network host`` that is the container's own loopback,
+   and the published port answers with ``Connection reset by peer`` or an empty
+   reply. Pass ``server_host:=0.0.0.0``:
+
+   .. code-block:: bash
+
+      docker run -p 127.0.0.1:8080:8080 ghcr.io/selfpatch/ros2_medkit-jazzy:latest \
+        ros2 launch ros2_medkit_gateway bringup.launch.py server_host:=0.0.0.0
+
+   ``127.0.0.1:8080:8080`` publishes the port on the host's loopback only, which
+   keeps the API (no authentication by default) off the LAN.
+
+To use a custom configuration, mount a params file:
 
 .. code-block:: bash
 
@@ -227,6 +245,11 @@ writes. Add your own UI origin(s):
            - "http://localhost:3000"
            - "https://my-dashboard.example.com"
 
+The origin must match what the browser sends exactly: ``http://127.0.0.1:3000``
+is not ``http://localhost:3000``. When the container runs a launch file, pass
+the origins as ``cors_allowed_origins:=http://localhost:3000,http://127.0.0.1:3000``;
+the argument replaces the defaults.
+
 Health Checks
 -------------
 
diff --git a/docs/tutorials/web-ui.rst b/docs/tutorials/web-ui.rst
index af230fb3f..af2bd7b0c 100644
--- a/docs/tutorials/web-ui.rst
+++ b/docs/tutorials/web-ui.rst
@@ -105,8 +105,11 @@ Connecting to ros2_medkit
 
 .. tip::
 
-   If the gateway runs on a different host, ensure CORS is configured.
-   See :doc:`/config/server` for CORS settings.
+   The web UI is a different origin than the gateway, so the gateway must allow
+   it via CORS. The launch files and the Docker image allow
+   ``http://localhost:3000`` and ``http://localhost:5173``, matched exactly:
+   ``http://127.0.0.1:3000`` is rejected. See :doc:`/config/server` for CORS
+   settings, or pass ``cors_allowed_origins:=`` to the launch file.
 
 Using the Interface
 -------------------
@@ -182,21 +185,24 @@ Run both gateway and web UI together:
 .. code-block:: yaml
 
    # docker-compose.yml
-   version: '3.8'
    services:
      gateway:
-       image: ros:jazzy
-       command: >
-         bash -c "source /opt/ros/jazzy/setup.bash &&
-                  ros2 launch ros2_medkit_gateway gateway.launch.py server_host:=0.0.0.0"
-       ports:
-         - "8080:8080"
+       image: ghcr.io/selfpatch/ros2_medkit-jazzy:latest
+       command: ros2 launch ros2_medkit_gateway bringup.launch.py
        network_mode: host
+       ipc: host
 
      web_ui:
        image: ghcr.io/selfpatch/ros2_medkit_web_ui:latest
        ports:
-         - "80:80"
+         - "3000:80"
+
+The gateway shares the host network, so it joins the robot's DDS graph and its
+default bind ``127.0.0.1:8080`` is the host's loopback. Open
+``http://localhost:3000``: that origin is allowed by default, while
+``http://127.0.0.1:3000`` is not. On a bridge network instead, run
+``bringup.launch.py server_host:=0.0.0.0`` and publish ``8080`` (see
+:doc:`/troubleshooting`).
 
 Docker Image Tags
 -----------------
diff --git a/src/ros2_medkit_gateway/README.md b/src/ros2_medkit_gateway/README.md
index 5c0f55990..8c701130b 100644
--- a/src/ros2_medkit_gateway/README.md
+++ b/src/ros2_medkit_gateway/README.md
@@ -1570,6 +1570,7 @@ ros2 launch ros2_medkit_gateway gateway.launch.py \
 | `server_host`         | `127.0.0.1`                           | Host to bind the REST server (`127.0.0.1` or `0.0.0.0`). Launch-arg only.                           |
 | `server_port`         | `8080`                                | Port for the REST API. Launch-arg only.                                                              |
 | `refresh_interval_ms` | `30000`                               | Safety-backstop refresh interval in ms (graph events drive the primary refresh). Launch-arg only.    |
+| `cors_allowed_origins` | `http://localhost:3000,http://localhost:5173` | Comma-separated browser origins, matched exactly (`http://127.0.0.1:3000` is not `http://localhost:3000`). A value replaces the defaults; empty disables CORS. With a custom `config_file` and this argument unset, CORS comes from the config files only. |
 
 ### Authentication Configuration Examples
 

From affedbf7d7e704b44dfb68e5663cf74bdefb0a27 Mon Sep 17 00:00:00 2001
From: Bartosz Burda <bartoszburda93@gmail.com>
Date: Sat, 26 Sep 2026 15:06:50 +0200
Subject: [PATCH 3/5] test: wait for the executor to spin before a test can
 cancel it

Executor::cancel() only clears the spinning flag, and spin() sets it
again when it starts. A test that starts spin() on its own thread and
cancels it later loses the cancel when the thread has not reached spin()
yet. spin() then never returns and join() blocks until the ctest timeout.
Short cases under parallel load hit this in test_discovery_manager,
test_ros2_topic_data_provider and test_ros2_subscription_executor.

Wait for is_spinning() after each spin thread starts, in every test that
cancels an executor spun on its own thread.

Gateway unit suite with ctest -j16: 10 of 40 runs timed out before,
0 of 20 after.
---
 .../test/test_fault_manager.cpp               |  4 +++
 .../test/test_cancel_outcomes.cpp             |  4 +++
 .../test/test_data_access_manager.cpp         |  4 +++
 .../test/test_discovery_manager.cpp           |  4 +++
 .../test/test_entity_freeze_frame_capture.cpp |  4 +++
 .../test/test_fault_manager.cpp               |  8 +++++
 .../test/test_lifecycle_handlers.cpp          | 12 +++++++
 .../test/test_operation_handlers.cpp          |  4 +++
 .../test/test_parameter_error_precedence.cpp  |  4 +++
 .../test/test_ros2_lifecycle_state_reader.cpp |  4 +++
 .../test/test_ros2_log_source.cpp             |  4 +++
 .../test/test_ros2_subscription_executor.cpp  |  4 +++
 .../test/test_ros2_subscription_slot.cpp      |  4 +++
 .../test/test_ros2_topic_data_provider.cpp    |  4 +++
 .../test/test_trigger_topic_subscriber.cpp    |  4 +++
 .../test/test_graph_watchdog_plugin.cpp       | 36 +++++++++++++++++++
 ...test_lifecycle_expectation_integration.cpp |  4 +++
 .../test/test_lifecycle_watcher.cpp           |  8 +++++
 .../test/test_node_death_integration.cpp      |  4 +++
 .../test/test_orphan_integration.cpp          |  4 +++
 .../test/test_param_drift_integration.cpp     | 12 +++++++
 .../test/test_qos_mismatch_integration.cpp    |  4 +++
 .../test/test_opcua_plugin.cpp                |  4 +++
 23 files changed, 148 insertions(+)

diff --git a/src/ros2_medkit_fault_manager/test/test_fault_manager.cpp b/src/ros2_medkit_fault_manager/test/test_fault_manager.cpp
index 92b0abaaf..0efe24dab 100644
--- a/src/ros2_medkit_fault_manager/test/test_fault_manager.cpp
+++ b/src/ros2_medkit_fault_manager/test/test_fault_manager.cpp
@@ -1883,6 +1883,10 @@ class SnapshotCooldownTest : public ::testing::Test {
     spin_thread_ = std::thread([this]() {
       executor_.spin();
     });
+    // A cancel() that lands before spin() starts is lost, and join() would block.
+    while (!executor_.is_spinning()) {
+      std::this_thread::yield();
+    }
 
     ASSERT_TRUE(report_client_->wait_for_service(std::chrono::seconds(5)));
     ASSERT_TRUE(clear_client_->wait_for_service(std::chrono::seconds(5)));
diff --git a/src/ros2_medkit_gateway/test/test_cancel_outcomes.cpp b/src/ros2_medkit_gateway/test/test_cancel_outcomes.cpp
index 1fe4b4ddb..8bc6e862e 100644
--- a/src/ros2_medkit_gateway/test/test_cancel_outcomes.cpp
+++ b/src/ros2_medkit_gateway/test/test_cancel_outcomes.cpp
@@ -292,6 +292,10 @@ class CancelOutcomesFixtureTest : public ::testing::Test {
     spin_thread_ = std::thread([this]() {
       executor_->spin();
     });
+    // A cancel() that lands before spin() starts is lost, and join() would block.
+    while (!executor_->is_spinning()) {
+      std::this_thread::yield();
+    }
 
     ctx_ = std::make_unique<HandlerContext>(gateway_node_.get(), cors_, auth_, tls_, nullptr);
     handlers_ = std::make_unique<OperationHandlers>(*ctx_);
diff --git a/src/ros2_medkit_gateway/test/test_data_access_manager.cpp b/src/ros2_medkit_gateway/test/test_data_access_manager.cpp
index 599e9e56d..d05a991c3 100644
--- a/src/ros2_medkit_gateway/test/test_data_access_manager.cpp
+++ b/src/ros2_medkit_gateway/test/test_data_access_manager.cpp
@@ -168,6 +168,10 @@ class DataAccessManagerWithPublisherTest : public ::testing::Test {
     spin_thread_ = std::thread([this]() {
       executor_->spin();
     });
+    // A cancel() that lands before spin() starts is lost, and join() would block.
+    while (!executor_->is_spinning()) {
+      std::this_thread::yield();
+    }
 
     // Give time for discovery
     std::this_thread::sleep_for(100ms);
diff --git a/src/ros2_medkit_gateway/test/test_discovery_manager.cpp b/src/ros2_medkit_gateway/test/test_discovery_manager.cpp
index 4de5e9bbd..214c2e318 100644
--- a/src/ros2_medkit_gateway/test/test_discovery_manager.cpp
+++ b/src/ros2_medkit_gateway/test/test_discovery_manager.cpp
@@ -50,6 +50,10 @@ class DiscoveryManagerTest : public ::testing::Test {
     spin_thread_ = std::thread([this] {
       executor_->spin();
     });
+    // A cancel() that lands before spin() starts is lost, and join() would block.
+    while (!executor_->is_spinning()) {
+      std::this_thread::yield();
+    }
     sub_exec_ = std::make_shared<Ros2SubscriptionExecutor>(node_);
     serializer_ = std::make_shared<ros2_medkit_serialization::JsonSerializer>();
     topic_provider_ = std::make_unique<Ros2TopicDataProvider>(sub_exec_, serializer_);
diff --git a/src/ros2_medkit_gateway/test/test_entity_freeze_frame_capture.cpp b/src/ros2_medkit_gateway/test/test_entity_freeze_frame_capture.cpp
index b9a44b2e0..93e12135d 100644
--- a/src/ros2_medkit_gateway/test/test_entity_freeze_frame_capture.cpp
+++ b/src/ros2_medkit_gateway/test/test_entity_freeze_frame_capture.cpp
@@ -140,6 +140,10 @@ class EntityFreezeFrameCaptureTest : public ::testing::Test {
     spin_thread_ = std::thread([this] {
       executor_->spin();
     });
+    // A cancel() that lands before spin() starts is lost, and join() would block.
+    while (!executor_->is_spinning()) {
+      std::this_thread::yield();
+    }
     // The capture creates its fault-events subscription on this executor's
     // dedicated _sub node, off the main node (issue #375).
     sub_exec_ = std::make_unique<Ros2SubscriptionExecutor>(node_);
diff --git a/src/ros2_medkit_gateway/test/test_fault_manager.cpp b/src/ros2_medkit_gateway/test/test_fault_manager.cpp
index a2125a806..c7f1cd29a 100644
--- a/src/ros2_medkit_gateway/test/test_fault_manager.cpp
+++ b/src/ros2_medkit_gateway/test/test_fault_manager.cpp
@@ -86,6 +86,10 @@ class FaultManagerTest : public ::testing::Test {
     spin_thread_ = std::thread([this]() {
       executor_->spin();
     });
+    // A cancel() that lands before spin() starts is lost, and join() would block.
+    while (!executor_->is_spinning()) {
+      std::this_thread::yield();
+    }
   }
 
   void stop_spinning() {
@@ -192,6 +196,10 @@ TEST_F(FaultManagerTest, GetSnapshotsDrivesPrivateClientWithoutSpinningHostNode)
   std::thread service_thread([&service_executor]() {
     service_executor.spin();
   });
+  // A cancel() that lands before spin() starts is lost, and join() would block.
+  while (!service_executor.is_spinning()) {
+    std::this_thread::yield();
+  }
 
   // node_ is deliberately never spun by this test.
   FaultManager fault_manager(std::make_shared<ros2_medkit_gateway::ros2::Ros2FaultServiceTransport>(node_.get()));
diff --git a/src/ros2_medkit_gateway/test/test_lifecycle_handlers.cpp b/src/ros2_medkit_gateway/test/test_lifecycle_handlers.cpp
index 08e611979..0ecbcd982 100644
--- a/src/ros2_medkit_gateway/test/test_lifecycle_handlers.cpp
+++ b/src/ros2_medkit_gateway/test/test_lifecycle_handlers.cpp
@@ -111,6 +111,10 @@ class LifecycleHandlersTest : public ::testing::Test {
     spin_thread_ = std::thread([this]() {
       executor_->spin();
     });
+    // A cancel() that lands before spin() starts is lost, and join() would block.
+    while (!executor_->is_spinning()) {
+      std::this_thread::yield();
+    }
 
     ctx_ = std::make_unique<HandlerContext>(gateway_node_.get(), cors_, auth_, tls_, nullptr);
     handlers_ = std::make_unique<LifecycleHandlers>(*ctx_, nullptr);  // no plugin manager
@@ -343,6 +347,10 @@ class EntityDetailStatusLinkTest : public ::testing::Test {
     spin_thread_ = std::thread([this]() {
       executor_->spin();
     });
+    // A cancel() that lands before spin() starts is lost, and join() would block.
+    while (!executor_->is_spinning()) {
+      std::this_thread::yield();
+    }
 
     std::this_thread::sleep_for(std::chrono::milliseconds(200));
 
@@ -488,6 +496,10 @@ class LifecycleHandlersWithProviderTest : public ::testing::Test {
     spin_thread_ = std::thread([this]() {
       executor_->spin();
     });
+    // A cancel() that lands before spin() starts is lost, and join() would block.
+    while (!executor_->is_spinning()) {
+      std::this_thread::yield();
+    }
 
     std::this_thread::sleep_for(std::chrono::milliseconds(200));
 
diff --git a/src/ros2_medkit_gateway/test/test_operation_handlers.cpp b/src/ros2_medkit_gateway/test/test_operation_handlers.cpp
index e5ec51125..448ec130e 100644
--- a/src/ros2_medkit_gateway/test/test_operation_handlers.cpp
+++ b/src/ros2_medkit_gateway/test/test_operation_handlers.cpp
@@ -347,6 +347,10 @@ class OperationHandlersFixtureTest : public ::testing::Test {
     spin_thread_ = std::thread([this]() {
       executor_->spin();
     });
+    // A cancel() that lands before spin() starts is lost, and join() would block.
+    while (!executor_->is_spinning()) {
+      std::this_thread::yield();
+    }
 
     ctx_ = std::make_unique<HandlerContext>(gateway_node_.get(), cors_, auth_, tls_, nullptr);
     handlers_ = std::make_unique<OperationHandlers>(*ctx_);
diff --git a/src/ros2_medkit_gateway/test/test_parameter_error_precedence.cpp b/src/ros2_medkit_gateway/test/test_parameter_error_precedence.cpp
index bb6b0ef02..eff4d221c 100644
--- a/src/ros2_medkit_gateway/test/test_parameter_error_precedence.cpp
+++ b/src/ros2_medkit_gateway/test/test_parameter_error_precedence.cpp
@@ -121,6 +121,10 @@ class ParameterErrorPrecedenceTest : public ::testing::Test {
     spin_thread_ = std::thread([this]() {
       executor_->spin();
     });
+    // A cancel() that lands before spin() starts is lost, and join() would block.
+    while (!executor_->is_spinning()) {
+      std::this_thread::yield();
+    }
 
     ctx_ = std::make_unique<HandlerContext>(gateway_node_.get(), cors_, auth_, tls_, nullptr);
     handlers_ = std::make_unique<ConfigHandlers>(*ctx_);
diff --git a/src/ros2_medkit_gateway/test/test_ros2_lifecycle_state_reader.cpp b/src/ros2_medkit_gateway/test/test_ros2_lifecycle_state_reader.cpp
index c90240f41..c16534c1c 100644
--- a/src/ros2_medkit_gateway/test/test_ros2_lifecycle_state_reader.cpp
+++ b/src/ros2_medkit_gateway/test/test_ros2_lifecycle_state_reader.cpp
@@ -49,6 +49,10 @@ class Ros2LifecycleStateReaderTest : public ::testing::Test {
     spin_ = std::thread([this]() {
       exec_.spin();
     });
+    // A cancel() that lands before spin() starts is lost, and join() would block.
+    while (!exec_.is_spinning()) {
+      std::this_thread::yield();
+    }
     reader_ = std::make_unique<Ros2LifecycleStateReader>(service_node_.get(), std::chrono::seconds(3));
   }
 
diff --git a/src/ros2_medkit_gateway/test/test_ros2_log_source.cpp b/src/ros2_medkit_gateway/test/test_ros2_log_source.cpp
index 8cfe2eae2..6dd127e8d 100644
--- a/src/ros2_medkit_gateway/test/test_ros2_log_source.cpp
+++ b/src/ros2_medkit_gateway/test/test_ros2_log_source.cpp
@@ -49,6 +49,10 @@ class Ros2LogSourceTest : public ::testing::Test {
     spin_thread_ = std::thread([this]() {
       executor_->spin();
     });
+    // A cancel() that lands before spin() starts is lost, and join() would block.
+    while (!executor_->is_spinning()) {
+      std::this_thread::yield();
+    }
   }
 
   void TearDown() override {
diff --git a/src/ros2_medkit_gateway/test/test_ros2_subscription_executor.cpp b/src/ros2_medkit_gateway/test/test_ros2_subscription_executor.cpp
index f3b002f01..f0ab2f541 100644
--- a/src/ros2_medkit_gateway/test/test_ros2_subscription_executor.cpp
+++ b/src/ros2_medkit_gateway/test/test_ros2_subscription_executor.cpp
@@ -56,6 +56,10 @@ class Ros2SubscriptionExecutorTest : public ::testing::Test {
     spin_thread_ = std::thread([this] {
       executor_->spin();
     });
+    // A cancel() that lands before spin() starts is lost, and join() would block.
+    while (!executor_->is_spinning()) {
+      std::this_thread::yield();
+    }
 
     Ros2SubscriptionExecutor::Config cfg;
     cfg.max_queue_depth = 16;
diff --git a/src/ros2_medkit_gateway/test/test_ros2_subscription_slot.cpp b/src/ros2_medkit_gateway/test/test_ros2_subscription_slot.cpp
index 8d4264b1f..9761b084f 100644
--- a/src/ros2_medkit_gateway/test/test_ros2_subscription_slot.cpp
+++ b/src/ros2_medkit_gateway/test/test_ros2_subscription_slot.cpp
@@ -57,6 +57,10 @@ class Ros2SubscriptionSlotTest : public ::testing::Test {
     spin_thread_ = std::thread([this] {
       executor_->spin();
     });
+    // A cancel() that lands before spin() starts is lost, and join() would block.
+    while (!executor_->is_spinning()) {
+      std::this_thread::yield();
+    }
     sub_exec_ = std::make_unique<Ros2SubscriptionExecutor>(node_);
   }
 
diff --git a/src/ros2_medkit_gateway/test/test_ros2_topic_data_provider.cpp b/src/ros2_medkit_gateway/test/test_ros2_topic_data_provider.cpp
index d9629bf34..bab03e557 100644
--- a/src/ros2_medkit_gateway/test/test_ros2_topic_data_provider.cpp
+++ b/src/ros2_medkit_gateway/test/test_ros2_topic_data_provider.cpp
@@ -61,6 +61,10 @@ class Ros2TopicDataProviderTest : public ::testing::Test {
     spin_thread_ = std::thread([this] {
       executor_->spin();
     });
+    // A cancel() that lands before spin() starts is lost, and join() would block.
+    while (!executor_->is_spinning()) {
+      std::this_thread::yield();
+    }
     sub_exec_ = std::make_shared<Ros2SubscriptionExecutor>(node_);
     serializer_ = std::make_shared<ros2_medkit_serialization::JsonSerializer>();
     provider_ = std::make_unique<Ros2TopicDataProvider>(sub_exec_, serializer_);
diff --git a/src/ros2_medkit_gateway/test/test_trigger_topic_subscriber.cpp b/src/ros2_medkit_gateway/test/test_trigger_topic_subscriber.cpp
index 4e2a8b174..fe1be1c1f 100644
--- a/src/ros2_medkit_gateway/test/test_trigger_topic_subscriber.cpp
+++ b/src/ros2_medkit_gateway/test/test_trigger_topic_subscriber.cpp
@@ -84,6 +84,10 @@ class TriggerTopicSubscriberTest : public ::testing::Test {
     spin_thread_ = std::thread([this] {
       executor_->spin();
     });
+    // A cancel() that lands before spin() starts is lost, and join() would block.
+    while (!executor_->is_spinning()) {
+      std::this_thread::yield();
+    }
     sub_exec_ = std::make_shared<Ros2SubscriptionExecutor>(node_);
     subscriber_ = std::make_unique<TriggerTopicSubscriber>(node_.get());
   }
diff --git a/src/ros2_medkit_plugins/ros2_medkit_graph_watchdog/test/test_graph_watchdog_plugin.cpp b/src/ros2_medkit_plugins/ros2_medkit_graph_watchdog/test/test_graph_watchdog_plugin.cpp
index 251812d07..ef9910a64 100644
--- a/src/ros2_medkit_plugins/ros2_medkit_graph_watchdog/test/test_graph_watchdog_plugin.cpp
+++ b/src/ros2_medkit_plugins/ros2_medkit_graph_watchdog/test/test_graph_watchdog_plugin.cpp
@@ -497,6 +497,10 @@ TEST_F(GraphWatchdogPluginTest, LifecycleRunsTickAndShutsDownCleanly) {
   std::thread spin([&exec] {
     exec.spin();
   });
+  // A cancel() that lands before spin() starts is lost, and join() would block.
+  while (!exec.is_spinning()) {
+    std::this_thread::yield();
+  }
 
   plugin.configure(nlohmann::json{{"tick_interval_ms", 50}});
   plugin.set_context(ctx);
@@ -533,6 +537,10 @@ run_until_observed(rclcpp::Node::SharedPtr gateway_node, const nlohmann::json &
   std::thread spin([&exec] {
     exec.spin();
   });
+  // A cancel() that lands before spin() starts is lost, and join() would block.
+  while (!exec.is_spinning()) {
+    std::this_thread::yield();
+  }
 
   nlohmann::json config{{"tick_interval_ms", 50}, {"detectors", detectors_config}};
   config["detectors"]["node_death"] = {{"mode", "off"}};
@@ -703,6 +711,10 @@ TEST_F(GraphWatchdogPluginTest, FansOutTicksSkipsOffModeAndIsolatesThrowingDetec
   std::thread spin([&exec] {
     exec.spin();
   });
+  // A cancel() that lands before spin() starts is lost, and join() would block.
+  while (!exec.is_spinning()) {
+    std::this_thread::yield();
+  }
 
   plugin.configure(nlohmann::json{{"tick_interval_ms", 50}, {"detectors", {{"offd", {{"mode", "off"}}}}}});
   plugin.set_context(ctx);
@@ -747,6 +759,10 @@ TEST_F(GraphWatchdogPluginTest, ExposesWatchdogStatusRoute) {
   std::thread spin([&exec] {
     exec.spin();
   });
+  // A cancel() that lands before spin() starts is lost, and join() would block.
+  while (!exec.is_spinning()) {
+    std::this_thread::yield();
+  }
 
   plugin.configure(nlohmann::json{{"tick_interval_ms", 50}, {"warmup_cycles", 2}});
   plugin.set_context(ctx);
@@ -792,6 +808,10 @@ TEST_F(GraphWatchdogPluginTest, WatchdogStatusRouteReportsEntityLifecycleAndArme
   std::thread spin([&exec] {
     exec.spin();
   });
+  // A cancel() that lands before spin() starts is lost, and join() would block.
+  while (!exec.is_spinning()) {
+    std::this_thread::yield();
+  }
 
   // warmup_cycles=1 with a fast tick: "/watched_app" (constant across every snapshot)
   // should be armed well within the poll window below.
@@ -851,6 +871,10 @@ TEST_F(GraphWatchdogPluginTest, MalformedNodeDeathPruneGraceUsesThePluginScopeFa
   std::thread spin([&exec] {
     exec.spin();
   });
+  // A cancel() that lands before spin() starts is lost, and join() would block.
+  while (!exec.is_spinning()) {
+    std::this_thread::yield();
+  }
 
   // tick_interval_ms MUST be 3000: node_death's own wall-clock floor
   // (min_node_death_miss_grace) bumps a fast-tick miss_grace up regardless of what is
@@ -966,6 +990,10 @@ TEST_F(GraphWatchdogPluginTest, FaultClientDeliversRequestsAndDrainsItsOwnRespon
   std::thread sink_spin([&sink_exec] {
     sink_exec.spin();
   });
+  // A cancel() that lands before spin() starts is lost, and join() would block.
+  while (!sink_exec.is_spinning()) {
+    std::this_thread::yield();
+  }
 
   ros2_medkit_graph_watchdog::GraphWatchdogPlugin plugin;
   FakeContextWithApp ctx(gateway_node_.get());  // "/watched_app", the id RaisingDetector reports on
@@ -1014,6 +1042,10 @@ TEST_F(GraphWatchdogPluginTest, TickThreadDeliversRealTransitionEventsToTheGate)
   std::thread spin([&exec] {
     exec.spin();
   });
+  // A cancel() that lands before spin() starts is lost, and join() would block.
+  while (!exec.is_spinning()) {
+    std::this_thread::yield();
+  }
 
   auto pub = gateway_node_->create_publisher<lifecycle_msgs::msg::TransitionEvent>(
       "/managed_app/transition_event", rclcpp::QoS(rclcpp::KeepLast(10)).reliable());
@@ -1071,6 +1103,10 @@ TEST_F(GraphWatchdogPluginTest, StatusHandlerRaceFreeAgainstConcurrentTicks) {
   std::thread spin([&exec] {
     exec.spin();
   });
+  // A cancel() that lands before spin() starts is lost, and join() would block.
+  while (!exec.is_spinning()) {
+    std::this_thread::yield();
+  }
 
   plugin.configure(nlohmann::json{{"tick_interval_ms", 5}, {"warmup_cycles", 1}});
   plugin.set_context(ctx);
diff --git a/src/ros2_medkit_plugins/ros2_medkit_graph_watchdog/test/test_lifecycle_expectation_integration.cpp b/src/ros2_medkit_plugins/ros2_medkit_graph_watchdog/test/test_lifecycle_expectation_integration.cpp
index 6ef245f2b..76bb6bb44 100644
--- a/src/ros2_medkit_plugins/ros2_medkit_graph_watchdog/test/test_lifecycle_expectation_integration.cpp
+++ b/src/ros2_medkit_plugins/ros2_medkit_graph_watchdog/test/test_lifecycle_expectation_integration.cpp
@@ -285,6 +285,10 @@ class LifecycleExpectationIntegrationTest : public ::testing::Test {
     spin_ = std::thread([this]() {
       exec_.spin();
     });
+    // A cancel() that lands before spin() starts is lost, and join() would block.
+    while (!exec_.is_spinning()) {
+      std::this_thread::yield();
+    }
     ASSERT_TRUE(client_->wait_for_service(5s));
   }
 
diff --git a/src/ros2_medkit_plugins/ros2_medkit_graph_watchdog/test/test_lifecycle_watcher.cpp b/src/ros2_medkit_plugins/ros2_medkit_graph_watchdog/test/test_lifecycle_watcher.cpp
index 8d341d6d8..82562fdac 100644
--- a/src/ros2_medkit_plugins/ros2_medkit_graph_watchdog/test/test_lifecycle_watcher.cpp
+++ b/src/ros2_medkit_plugins/ros2_medkit_graph_watchdog/test/test_lifecycle_watcher.cpp
@@ -271,6 +271,10 @@ TEST_F(LifecycleWatcherTest, NodeWideExecutorNeverRunsTheLifecycleCallbacks) {
   std::thread spin([&exec]() {
     exec.spin();
   });
+  // A cancel() that lands before spin() starts is lost, and join() would block.
+  while (!exec.is_spinning()) {
+    std::this_thread::yield();
+  }
 
   // Wait for endpoint matching first: without it, "no callback ran" would prove nothing
   // (the messages would simply never have reached the subscription).
@@ -514,6 +518,10 @@ TEST_F(LifecycleWatcherTest, RebindToALiveNodeDropsTheOldLabelAndSeedsTheNewBind
   std::thread spin([&exec]() {
     exec.spin();
   });
+  // A cancel() that lands before spin() starts is lost, and join() would block.
+  while (!exec.is_spinning()) {
+    std::this_thread::yield();
+  }
   // A fatal assertion below returns straight out of the test body, and a joinable
   // std::thread destroyed that way calls std::terminate - which aborts the whole binary
   // and takes every remaining case in this file with it, hiding the failure that started
diff --git a/src/ros2_medkit_plugins/ros2_medkit_graph_watchdog/test/test_node_death_integration.cpp b/src/ros2_medkit_plugins/ros2_medkit_graph_watchdog/test/test_node_death_integration.cpp
index d6098ead2..b95f04138 100644
--- a/src/ros2_medkit_plugins/ros2_medkit_graph_watchdog/test/test_node_death_integration.cpp
+++ b/src/ros2_medkit_plugins/ros2_medkit_graph_watchdog/test/test_node_death_integration.cpp
@@ -176,6 +176,10 @@ class NodeDeathIntegrationTest : public ::testing::Test {
     spin_ = std::thread([]() {
       exec_->spin();
     });
+    // A cancel() that lands before spin() starts is lost, and join() would block.
+    while (!exec_->is_spinning()) {
+      std::this_thread::yield();
+    }
     ASSERT_TRUE(client_->wait_for_service(5s));
   }
 
diff --git a/src/ros2_medkit_plugins/ros2_medkit_graph_watchdog/test/test_orphan_integration.cpp b/src/ros2_medkit_plugins/ros2_medkit_graph_watchdog/test/test_orphan_integration.cpp
index c370b2308..df536da85 100644
--- a/src/ros2_medkit_plugins/ros2_medkit_graph_watchdog/test/test_orphan_integration.cpp
+++ b/src/ros2_medkit_plugins/ros2_medkit_graph_watchdog/test/test_orphan_integration.cpp
@@ -93,6 +93,10 @@ class OrphanIntegrationTest : public ::testing::Test {
     spin_ = std::thread([this]() {
       exec_.spin();
     });
+    // A cancel() that lands before spin() starts is lost, and join() would block.
+    while (!exec_.is_spinning()) {
+      std::this_thread::yield();
+    }
     ASSERT_TRUE(client_->wait_for_service(5s));
   }
 
diff --git a/src/ros2_medkit_plugins/ros2_medkit_graph_watchdog/test/test_param_drift_integration.cpp b/src/ros2_medkit_plugins/ros2_medkit_graph_watchdog/test/test_param_drift_integration.cpp
index d1bbcadb8..ea143d473 100644
--- a/src/ros2_medkit_plugins/ros2_medkit_graph_watchdog/test/test_param_drift_integration.cpp
+++ b/src/ros2_medkit_plugins/ros2_medkit_graph_watchdog/test/test_param_drift_integration.cpp
@@ -597,6 +597,10 @@ class ParamDriftIntegrationTest : public ::testing::Test {
     spin_ = std::thread([this]() {
       exec_.spin();
     });
+    // A cancel() that lands before spin() starts is lost, and join() would block.
+    while (!exec_.is_spinning()) {
+      std::this_thread::yield();
+    }
     ASSERT_TRUE(client_->wait_for_service(5s));
   }
   void TearDown() override {
@@ -902,6 +906,10 @@ TEST_F(ParamDriftIntegrationTest, AnUnresponsiveNodeDoesNotStallTheReader) {
   std::thread unresp_spin([&unresp_exec] {
     unresp_exec.spin();
   });
+  // A cancel() that lands before spin() starts is lost, and join() would block.
+  while (!unresp_exec.is_spinning()) {
+    std::this_thread::yield();
+  }
   // Declared BEFORE the detector so it is destroyed AFTER it: the wedged handler owns the fake
   // node's only executor thread, so nothing can join that thread until `stop` is set, and the
   // detector's own teardown must happen while the node is still refusing to answer.
@@ -3182,6 +3190,10 @@ TEST_F(ParamDriftIntegrationTest, AReadThatOverrunsThePerReadBoundIsAbandoned) {
   std::thread slow_spin([&slow_exec] {
     slow_exec.spin();
   });
+  // A cancel() that lands before spin() starts is lost, and join() would block.
+  while (!slow_exec.is_spinning()) {
+    std::this_thread::yield();
+  }
   const auto slow_guard = on_scope_exit([&slow_exec, &slow_spin] {
     slow_exec.cancel();
     if (slow_spin.joinable()) {
diff --git a/src/ros2_medkit_plugins/ros2_medkit_graph_watchdog/test/test_qos_mismatch_integration.cpp b/src/ros2_medkit_plugins/ros2_medkit_graph_watchdog/test/test_qos_mismatch_integration.cpp
index b2074a7a4..92e27d5a6 100644
--- a/src/ros2_medkit_plugins/ros2_medkit_graph_watchdog/test/test_qos_mismatch_integration.cpp
+++ b/src/ros2_medkit_plugins/ros2_medkit_graph_watchdog/test/test_qos_mismatch_integration.cpp
@@ -93,6 +93,10 @@ class QosMismatchIntegrationTest : public ::testing::Test {
     spin_ = std::thread([this]() {
       exec_.spin();
     });
+    // A cancel() that lands before spin() starts is lost, and join() would block.
+    while (!exec_.is_spinning()) {
+      std::this_thread::yield();
+    }
     ASSERT_TRUE(client_->wait_for_service(5s));
   }
 
diff --git a/src/ros2_medkit_plugins/ros2_medkit_opcua/test/test_opcua_plugin.cpp b/src/ros2_medkit_plugins/ros2_medkit_opcua/test/test_opcua_plugin.cpp
index 0c6b58b64..a2bfccc00 100644
--- a/src/ros2_medkit_plugins/ros2_medkit_opcua/test/test_opcua_plugin.cpp
+++ b/src/ros2_medkit_plugins/ros2_medkit_opcua/test/test_opcua_plugin.cpp
@@ -1144,6 +1144,10 @@ struct ScopedExecutorSpin {
     thread = std::thread([this] {
       executor.spin();
     });
+    // A cancel() that lands before spin() starts is lost, and join() would block.
+    while (!executor.is_spinning()) {
+      std::this_thread::yield();
+    }
   }
   void stop() {
     executor.cancel();

From f4b3af5c583efb0212f507c94a5751ec8b699010 Mon Sep 17 00:00:00 2001
From: Bartosz Burda <bartoszburda93@gmail.com>
Date: Sat, 26 Sep 2026 15:06:59 +0200
Subject: [PATCH 4/5] test: wait for node_death reports with a service round
 trip

The node_death integration cases slept 5-100 ms after a detector tick
and then read what the fake fault manager had received. Under parallel
load a report can take longer, so a case sees it one tick late (X2
expected the raise at tick 16 and saw 17), or a late report from the
previous case lands in the next one.

flush_reports() sends a marker request on the same client and waits for
the response. The sink serves one request at a time in arrival order,
so every earlier report is recorded by then. SetUp flushes before it
clears the record.

With a 20 ms delay injected into the sink, 9 of 49 cases failed before
and 49 of 49 pass after.
---
 .../test/test_node_death_integration.cpp      | 77 +++++++++++--------
 1 file changed, 47 insertions(+), 30 deletions(-)

diff --git a/src/ros2_medkit_plugins/ros2_medkit_graph_watchdog/test/test_node_death_integration.cpp b/src/ros2_medkit_plugins/ros2_medkit_graph_watchdog/test/test_node_death_integration.cpp
index b95f04138..1c7c45354 100644
--- a/src/ros2_medkit_plugins/ros2_medkit_graph_watchdog/test/test_node_death_integration.cpp
+++ b/src/ros2_medkit_plugins/ros2_medkit_graph_watchdog/test/test_node_death_integration.cpp
@@ -26,6 +26,7 @@
 #include <cstdarg>
 #include <cstddef>
 #include <cstdint>
+#include <future>
 #include <limits>
 #include <memory>
 #include <mutex>
@@ -73,6 +74,8 @@ std::unique_ptr<Detector> make_node_death() {
 // Aggregated fault source: no Component in the test snapshot, so graph_source_id() falls
 // back to this literal (see aggregated_fault.hpp).
 constexpr const char * kGraphSource = "graph_watchdog";
+// fault_code of the flush_reports() request; the sink does not record it.
+constexpr const char * kFlushBarrier = "TEST_FLUSH_BARRIER";
 
 /// Captures rcutils log output for as long as it is alive and restores the console handler
 /// on every exit path.
@@ -159,6 +162,10 @@ class NodeDeathIntegrationTest : public ::testing::Test {
     srv_ = sink_->create_service<ReportFault>(
         "/fault_manager/report_fault",
         [](const std::shared_ptr<ReportFault::Request> & req, const std::shared_ptr<ReportFault::Response> & resp) {
+          if (req->fault_code == kFlushBarrier) {
+            resp->accepted = true;
+            return;
+          }
           {
             std::lock_guard<std::mutex> lk(mtx_);
             received_.push_back(*req);
@@ -200,10 +207,20 @@ class NodeDeathIntegrationTest : public ::testing::Test {
   // Per-test isolation for the shared plumbing above: a stale response delivered late from
   // a PREVIOUS case must never be read as evidence by the NEXT one.
   void SetUp() override {
+    ASSERT_TRUE(flush_reports());
     std::lock_guard<std::mutex> lk(mtx_);
     received_.clear();
   }
 
+  /// Round trip on client_ behind every report sent so far. The sink serves requests one at a
+  /// time in arrival order, so when this returns true every earlier report is in received_.
+  static bool flush_reports() {
+    auto req = std::make_shared<ReportFault::Request>();
+    req->fault_code = kFlushBarrier;
+    auto result = client_->async_send_request(req);
+    return result.wait_for(5s) == std::future_status::ready;
+  }
+
   DetectorContext make_ctx(ReliabilityGate * gate) {
     DetectorContext ctx;
     ctx.gateway_node = gateway_.get();
@@ -343,9 +360,9 @@ TEST_F(NodeDeathIntegrationTest, N9_PeerAggregatedAppsAreNeverTracked) {
   for (int i = 6; i <= 12; ++i) {
     gate.update(snapshot_, static_cast<std::uint64_t>(i));
     det->tick(ctx);
-    std::this_thread::sleep_for(5ms);
+    ASSERT_TRUE(flush_reports());
   }
-  std::this_thread::sleep_for(50ms);
+  ASSERT_TRUE(flush_reports());
   EXPECT_EQ(det->tracked_count_for_test(), 0u);
   EXPECT_EQ(count_faults(kGraphSource, ReportFault::Request::EVENT_FAILED), 0u);
 }
@@ -488,7 +505,7 @@ TEST_F(NodeDeathIntegrationTest, N11_TrackedCountStaysBoundedUnderChurnAndShrink
     run_tick({app_of("alive_a"), app_of("alive_b")});
   }
   EXPECT_EQ(det->tracked_count_for_test(), 2u) << "the allowlisted, durably-suppressed victim must have been reclaimed";
-  std::this_thread::sleep_for(50ms);
+  ASSERT_TRUE(flush_reports());
   EXPECT_FALSE(any_failed_desc_contains(kGraphSource, {"/victim"}))
       << "an allowlisted death must never be reported in the first place";
 }
@@ -535,7 +552,7 @@ TEST_F(NodeDeathIntegrationTest, N11_TrackedNodeCapBoundsUnsuppressedChurnAndKee
   // kCap. Without the cap this would grow past 20, unbounded for the life of the process.
   constexpr std::size_t kCap = 3;
   EXPECT_LE(max_seen, kCap + 1) << "tracked_node_cap must actually engage under scale past it";
-  std::this_thread::sleep_for(50ms);
+  ASSERT_TRUE(flush_reports());
   EXPECT_TRUE(any_failed_desc_contains(kGraphSource, {"more node(s) disappeared"}))
       << "identities the cap forced out of individual tracking must still count as content, "
          "or a death the cap collapsed would silently heal instead of staying raised";
@@ -583,7 +600,7 @@ TEST_F(NodeDeathIntegrationTest, CapC1_GraphLargerThanTheDefaultCapStillReportsA
   gate.update(snapshot_, 2);
   det->tick(ctx);  // misses(1) > miss_grace(0): dead
 
-  std::this_thread::sleep_for(50ms);
+  ASSERT_TRUE(flush_reports());
   EXPECT_TRUE(any_failed_desc_contains(kGraphSource, {"n000"}))
       << "the one node that actually died among 513 present ones must still be reported - a "
          "cap that evicts present entries to make room can lose exactly this death";
@@ -610,7 +627,7 @@ TEST_F(NodeDeathIntegrationTest, CapC2_ChurnUnderCapPressureNeverFabricatesADeat
                    // (3) exceeds tracked_node_cap(2): the exact capacity pressure that used
                    // to force make_room() to collapse entries before grace.
 
-  std::this_thread::sleep_for(50ms);
+  ASSERT_TRUE(flush_reports());
   EXPECT_EQ(count_faults(kGraphSource, ReportFault::Request::EVENT_FAILED), 0u)
       << "none of a/b/c has crossed miss_grace yet - capacity pressure alone must never "
          "report any of them dead early";
@@ -629,7 +646,7 @@ TEST_F(NodeDeathIntegrationTest, CapC2_ChurnUnderCapPressureNeverFabricatesADeat
   det->tick(ctx);  // b, c miss 3 > miss_grace: genuinely, individually dead - the departed
                    // count (2) no longer exceeds the cap(2), so nothing is collapsed
 
-  std::this_thread::sleep_for(50ms);
+  ASSERT_TRUE(flush_reports());
   EXPECT_TRUE(any_failed_desc_contains(kGraphSource, {"/b"}));
   EXPECT_TRUE(any_failed_desc_contains(kGraphSource, {"/c"}));
   EXPECT_EQ(det->tracked_count_for_test(), 4u) << "anchor and a (idle), b and c (departed) - none collapsed";
@@ -659,7 +676,7 @@ TEST_F(NodeDeathIntegrationTest, CapCollapsedDeathClearsOnceTheGraphRecoversAndT
   gate.update(snapshot_, 2);
   det->tick(ctx);  // both miss 1 > miss_grace(0): matured; departed count(2) > cap(1): collapsed
 
-  std::this_thread::sleep_for(50ms);
+  ASSERT_TRUE(flush_reports());
   ASSERT_EQ(det->tracked_count_for_test(), 1u)
       << "precondition: both identities collapsed - only the anchor (idle, uncapped) remains";
   ASSERT_TRUE(any_failed_desc_contains(kGraphSource, {"more node(s) disappeared"}))
@@ -669,7 +686,7 @@ TEST_F(NodeDeathIntegrationTest, CapCollapsedDeathClearsOnceTheGraphRecoversAndT
   gate.update(snapshot_, 3);
   det->tick(ctx);
 
-  std::this_thread::sleep_for(50ms);
+  ASSERT_TRUE(flush_reports());
   EXPECT_EQ(count_faults(kGraphSource, ReportFault::Request::EVENT_PASSED), 0u)
       << "merely returning must NOT by itself clear a collapsed death - collapsed_dead_count_ "
          "stays raised until an operator actually acts on the cap-saturation warning";
@@ -680,7 +697,7 @@ TEST_F(NodeDeathIntegrationTest, CapCollapsedDeathClearsOnceTheGraphRecoversAndT
   gate.update(snapshot_, 4);  // a, b are present in this same, unchanged snapshot
   det->tick(ctx);
 
-  std::this_thread::sleep_for(50ms);
+  ASSERT_TRUE(flush_reports());
   EXPECT_GT(count_faults(kGraphSource, ReportFault::Request::EVENT_PASSED), 0u)
       << "once reconfigured, a clean re-observation of an all-present graph must clear the "
          "fault - ever_raised_ survives reconfigure (see ReconfigureWhileAbsentDoesNot... "
@@ -850,7 +867,7 @@ TEST_F(NodeDeathIntegrationTest, X2_TheFloorMakesAConfiguredMissGraceBehaveDiffe
     det_below->tick(ctx_below);
     gate_above.update(snap_above, static_cast<std::uint64_t>(tick));
     det_above->tick(ctx_above);
-    std::this_thread::sleep_for(5ms);
+    ASSERT_TRUE(flush_reports());
     if (below_raised_at < 0 && any_failed_desc_contains(kGraphSource, {"floor_below_node"})) {
       below_raised_at = tick;
     }
@@ -914,7 +931,7 @@ TEST_F(NodeDeathIntegrationTest, C2_AllowlistNotNamedInSuppressWarnsAndDoesNotSu
     gate.update(snapshot_, t);
     det->tick(ctx);
   }
-  std::this_thread::sleep_for(100ms);
+  ASSERT_TRUE(flush_reports());
   EXPECT_TRUE(any_failed_desc_contains(kGraphSource, {"/x"}))
       << "an allowlist that suppress does not name must not suppress by itself";
 }
@@ -978,7 +995,7 @@ TEST_F(NodeDeathIntegrationTest, CleanShutdownDepartureAtMissGraceBoundaryIsSupp
     gate.update(snapshot_, t);
     det->tick(ctx);
   }
-  std::this_thread::sleep_for(50ms);
+  ASSERT_TRUE(flush_reports());
   EXPECT_EQ(count_faults(kGraphSource, ReportFault::Request::EVENT_FAILED), 0u)
       << "a clean departure must not be reported even at the very first tick suppression is "
          "evaluated for it";
@@ -1030,7 +1047,7 @@ TEST_F(NodeDeathIntegrationTest, CleanShutdownIsStillSuppressedWhenItsServicesLe
     gate.update(snapshot_, t);
     det->tick(ctx);
   }
-  std::this_thread::sleep_for(50ms);
+  ASSERT_TRUE(flush_reports());
   EXPECT_EQ(count_faults(kGraphSource, ReportFault::Request::EVENT_FAILED), 0u)
       << "the label expired before node_death's reclaim tick because the retention clock started "
          "when the SERVICES left, not when the App did - so a cleanly shut-down node was named in "
@@ -1123,7 +1140,7 @@ TEST_F(NodeDeathIntegrationTest, AllowlistIdFormSuppressesOnlyTheCollisionPrefix
   gate.update(snapshot_, 1);
   det->tick(ctx);  // misses(1) > miss_grace(0): both would be dead absent suppression
 
-  std::this_thread::sleep_for(50ms);
+  ASSERT_TRUE(flush_reports());
   EXPECT_TRUE(any_failed_desc_contains(kGraphSource, {"/coll_b/calibration"}))
       << "the sibling the allowlist entry does not name must still be reported dead - "
          "otherwise this test cannot tell a working id-match from a suppressor that "
@@ -1160,7 +1177,7 @@ TEST_F(NodeDeathIntegrationTest, UngatedClearStaysSuppressedWhileAnUnrelatedNode
       << "precondition this test needs: something IS tracked, without this detector having "
          "ever raised anything";
 
-  std::this_thread::sleep_for(50ms);
+  ASSERT_TRUE(flush_reports());
   EXPECT_EQ(count_faults(kGraphSource, ReportFault::Request::EVENT_PASSED), 0u)
       << "a fresh instance that has never itself raised GRAPH_NODE_DISAPPEARED must never "
          "clear it either, however many unrelated entities become tracked";
@@ -1203,7 +1220,7 @@ TEST_F(NodeDeathIntegrationTest, RestartedInstanceNeverClearsAFaultItDidNotRaise
       << "the returned node must be tracked and healthy, or this test is not about the quadrant "
          "where the node came back";
 
-  std::this_thread::sleep_for(50ms);
+  ASSERT_TRUE(flush_reports());
   EXPECT_EQ(count_faults(kGraphSource, ReportFault::Request::EVENT_PASSED), 0u)
       << "a fresh instance emitted PASSED for a fault it never raised - it cannot know which "
          "node the stored record names, so this clear would be just as wrong for a node that "
@@ -1247,7 +1264,7 @@ TEST_F(NodeDeathIntegrationTest, AnEarnedKeyKeepsItsGroundAcrossTheOutageSoTheNe
   set_apps({anchor_app()});  // first death
   gate.update(snapshot_, 1);
   det->tick(ctx);
-  std::this_thread::sleep_for(50ms);
+  ASSERT_TRUE(flush_reports());
   const auto after_first = count_faults(kGraphSource, ReportFault::Request::EVENT_FAILED);
   ASSERT_GT(after_first, 0u) << "the first death was never reported, so there is no loop here yet";
 
@@ -1261,7 +1278,7 @@ TEST_F(NodeDeathIntegrationTest, AnEarnedKeyKeepsItsGroundAcrossTheOutageSoTheNe
   set_apps({anchor_app()});  // and it crashes again
   gate.update(snapshot_, 3);
   det->tick(ctx);
-  std::this_thread::sleep_for(50ms);
+  ASSERT_TRUE(flush_reports());
   EXPECT_GT(count_faults(kGraphSource, ReportFault::Request::EVENT_FAILED), after_first)
       << "the second death of a crash-looping node was reported by nobody - the key was handed "
          "back on the respawn because its earned ground had been pruned during the outage, and "
@@ -1327,7 +1344,7 @@ TEST_F(NodeDeathIntegrationTest, AnOfflineFlickerDoesNotEraseTheWithheldKeysWind
     det->tick(ctx);
   }
 
-  std::this_thread::sleep_for(50ms);
+  ASSERT_TRUE(flush_reports());
   EXPECT_EQ(count_faults(kGraphSource, ReportFault::Request::EVENT_FAILED), failed_before)
       << "an offline tick erased the withheld key and its window, so the flicker back online "
          "re-admitted a node the graph had measured as another detector's - and this detector "
@@ -1371,7 +1388,7 @@ TEST_F(NodeDeathIntegrationTest, AReleasedKeyIsTakenBackOnceItOutlivesTheDeathWi
   const auto failed_before = count_faults(kGraphSource, ReportFault::Request::EVENT_FAILED);
   det->tick(ctx);  // misses(1) > miss_grace(0)
 
-  std::this_thread::sleep_for(50ms);
+  ASSERT_TRUE(flush_reports());
   EXPECT_GT(count_faults(kGraphSource, ReportFault::Request::EVENT_FAILED), failed_before)
       << "a node that stopped being managed and then died was reported by nobody - this detector "
          "refused it for the rest of its life over a lifecycle record that had been gone for "
@@ -1413,7 +1430,7 @@ TEST_F(NodeDeathIntegrationTest, AReleasedKeyIsNotReAdmittedWhenItsLifecycleReco
   const auto failed_before = count_faults(kGraphSource, ReportFault::Request::EVENT_FAILED);
   det->tick(ctx);  // misses(1) > miss_grace(0)
 
-  std::this_thread::sleep_for(50ms);
+  ASSERT_TRUE(flush_reports());
   EXPECT_EQ(count_faults(kGraphSource, ReportFault::Request::EVENT_FAILED), failed_before)
       << "the key was handed back to lifecycle_expectation and then reported dead anyway - "
          "losing a lifecycle record is not a measurement that the node became this detector's, "
@@ -1435,7 +1452,7 @@ TEST_F(NodeDeathIntegrationTest, ClearFlowsOnceThisInstanceHasGenuinelyRaised) {
   gate.update(snapshot_, 1);
   det->tick(ctx);  // misses(1) > miss_grace(0): genuinely dead, genuinely raised
 
-  std::this_thread::sleep_for(50ms);
+  ASSERT_TRUE(flush_reports());
   ASSERT_GT(count_faults(kGraphSource, ReportFault::Request::EVENT_FAILED), 0u)
       << "precondition: this instance must have genuinely raised before the recovery below "
          "can prove anything about clearing";
@@ -1444,7 +1461,7 @@ TEST_F(NodeDeathIntegrationTest, ClearFlowsOnceThisInstanceHasGenuinelyRaised) {
   gate.update(snapshot_, 2);
   det->tick(ctx);
 
-  std::this_thread::sleep_for(50ms);
+  ASSERT_TRUE(flush_reports());
   EXPECT_GT(count_faults(kGraphSource, ReportFault::Request::EVENT_PASSED), 0u)
       << "a genuine recovery after this instance has itself raised must still clear - the "
          "ungated-clear guard must suppress an UNEARNED clear, not an earned one";
@@ -1473,7 +1490,7 @@ TEST_F(NodeDeathIntegrationTest, EverRaisedTracksDeliveryNotIntentSoAnUndelivere
   gate.update(snapshot_, 1);
   det->tick(ctx);  // report.dead is non-empty, but Advisory mode declines to send it
 
-  std::this_thread::sleep_for(50ms);
+  ASSERT_TRUE(flush_reports());
   ASSERT_EQ(count_faults(kGraphSource, ReportFault::Request::EVENT_FAILED), 0u)
       << "precondition: Advisory mode must have genuinely suppressed the raise";
 
@@ -1486,7 +1503,7 @@ TEST_F(NodeDeathIntegrationTest, EverRaisedTracksDeliveryNotIntentSoAnUndelivere
   gate.update(snapshot_, 2);
   det->tick(ctx);
 
-  std::this_thread::sleep_for(50ms);
+  ASSERT_TRUE(flush_reports());
   EXPECT_EQ(count_faults(kGraphSource, ReportFault::Request::EVENT_PASSED), 0u)
       << "no FAILED for this occurrence ever reached the wire, so no PASSED may either";
 }
@@ -1522,7 +1539,7 @@ TEST_F(NodeDeathIntegrationTest, AdvisoryModeStillObservesAndAccumulatesMissesWi
   EXPECT_EQ(det->tracked_count_for_test(), 2u)
       << "Advisory mode must still track victim and anchor exactly as Raise mode would";
 
-  std::this_thread::sleep_for(50ms);
+  ASSERT_TRUE(flush_reports());
   ASSERT_EQ(count_faults(kGraphSource, ReportFault::Request::EVENT_FAILED), 0u)
       << "precondition: Advisory mode must have genuinely suppressed the raise so far";
 
@@ -1530,7 +1547,7 @@ TEST_F(NodeDeathIntegrationTest, AdvisoryModeStillObservesAndAccumulatesMissesWi
   gate.update(snapshot_, 4);  // victim still absent - no recovery here
   det->tick(ctx);
 
-  std::this_thread::sleep_for(50ms);
+  ASSERT_TRUE(flush_reports());
   EXPECT_GT(count_faults(kGraphSource, ReportFault::Request::EVENT_FAILED), 0u)
       << "the very first Raise-mode tick must already raise, proving the miss count had "
          "already crossed miss_grace DURING the Advisory window rather than starting fresh";
@@ -1557,7 +1574,7 @@ TEST_F(NodeDeathIntegrationTest, ReconfigureWhileAbsentDoesNotWithholdAnEarnedCl
   gate.update(snapshot_, 1);
   det->tick(ctx);  // genuinely raised
 
-  std::this_thread::sleep_for(50ms);
+  ASSERT_TRUE(flush_reports());
   ASSERT_GT(count_faults(kGraphSource, ReportFault::Request::EVENT_FAILED), 0u)
       << "precondition: this instance must have genuinely raised before the reconfigure below";
 
@@ -1569,7 +1586,7 @@ TEST_F(NodeDeathIntegrationTest, ReconfigureWhileAbsentDoesNotWithholdAnEarnedCl
   gate.update(snapshot_, 2);
   det->tick(ctx);
 
-  std::this_thread::sleep_for(50ms);
+  ASSERT_TRUE(flush_reports());
   EXPECT_GT(count_faults(kGraphSource, ReportFault::Request::EVENT_PASSED), 0u)
       << "a genuine recovery after a live reconfigure must still clear - the standing fault "
          "must not be stuck unable to ever heal for the rest of the process's life";

From 3b1469948ec85397ed2b5c3077b57d0189ea96b0 Mon Sep 17 00:00:00 2001
From: Bartosz Burda <bartoszburda93@gmail.com>
Date: Sat, 26 Sep 2026 15:27:05 +0200
Subject: [PATCH 5/5] test: clear clang-tidy findings in test files this branch
 touches

container-size-empty, unnecessary-value-param, named-parameter,
inefficient-vector-operation and special-member-functions in
test_fault_manager (fault manager), test_ros2_subscription_slot,
test_graph_watchdog_plugin and test_opcua_plugin. No behaviour change.
---
 .../test/test_fault_manager.cpp               | 28 +++++++++----------
 .../test/test_ros2_subscription_slot.cpp      | 23 +++++++--------
 .../test/test_graph_watchdog_plugin.cpp       |  3 +-
 .../test/test_opcua_plugin.cpp                | 24 ++++++++++------
 4 files changed, 43 insertions(+), 35 deletions(-)

diff --git a/src/ros2_medkit_fault_manager/test/test_fault_manager.cpp b/src/ros2_medkit_fault_manager/test/test_fault_manager.cpp
index 0efe24dab..8654a9d7c 100644
--- a/src/ros2_medkit_fault_manager/test/test_fault_manager.cpp
+++ b/src/ros2_medkit_fault_manager/test/test_fault_manager.cpp
@@ -1060,7 +1060,7 @@ class FaultEventPublishingTest : public ::testing::Test {
     std::string events_topic = ns + "/fault_manager/events";
     auto qos = rclcpp::QoS(100).reliable().durability_volatile();
     event_subscription_ =
-        test_node_->create_subscription<FaultEvent>(events_topic, qos, [this](const FaultEvent::SharedPtr msg) {
+        test_node_->create_subscription<FaultEvent>(events_topic, qos, [this](const FaultEvent::ConstSharedPtr & msg) {
           received_events_.push_back(*msg);
         });
 
@@ -1206,7 +1206,7 @@ TEST_F(FaultEventPublishingTest, NewFaultPublishesConfirmedEvent) {
 
   // Wait for event to arrive (polling, robust under CPU contention)
   ASSERT_TRUE(spin_until([this]() {
-    return received_events_.size() >= 1;
+    return !received_events_.empty();
   }));
 
   // Verify EVENT_CONFIRMED was published
@@ -1221,7 +1221,7 @@ TEST_F(FaultEventPublishingTest, UpdateExistingFaultPublishesUpdatedEvent) {
   // Report a new fault first
   ASSERT_TRUE(call_report_fault("TEST_FAULT_2", Fault::SEVERITY_WARN, "/test_node1"));
   ASSERT_TRUE(spin_until([this]() {
-    return received_events_.size() >= 1;
+    return !received_events_.empty();
   }));
 
   // Clear received events
@@ -1230,7 +1230,7 @@ TEST_F(FaultEventPublishingTest, UpdateExistingFaultPublishesUpdatedEvent) {
   // Report same fault again - should trigger EVENT_UPDATED
   ASSERT_TRUE(call_report_fault("TEST_FAULT_2", Fault::SEVERITY_ERROR, "/test_node2"));
   ASSERT_TRUE(spin_until([this]() {
-    return received_events_.size() >= 1;
+    return !received_events_.empty();
   }));
 
   // Verify EVENT_UPDATED was published (severity/sources changed; still one occurrence)
@@ -1244,7 +1244,7 @@ TEST_F(FaultEventPublishingTest, ClearFaultPublishesClearedEvent) {
   // Report a fault first
   ASSERT_TRUE(call_report_fault("TEST_FAULT_3", Fault::SEVERITY_ERROR, "/test_node"));
   ASSERT_TRUE(spin_until([this]() {
-    return received_events_.size() >= 1;
+    return !received_events_.empty();
   }));
 
   // Clear received events
@@ -1253,7 +1253,7 @@ TEST_F(FaultEventPublishingTest, ClearFaultPublishesClearedEvent) {
   // Clear the fault
   ASSERT_TRUE(call_clear_fault("TEST_FAULT_3"));
   ASSERT_TRUE(spin_until([this]() {
-    return received_events_.size() >= 1;
+    return !received_events_.empty();
   }));
 
   // Verify EVENT_CLEARED was published
@@ -1280,7 +1280,7 @@ class HealingFaultEventPublishingTest : public FaultEventPublishingTest {
 TEST_F(HealingFaultEventPublishingTest, HealPublishesClearedEventSoStreamConsumersSeeTheEnd) {
   ASSERT_TRUE(call_report_fault("HEAL_ME", Fault::SEVERITY_ERROR, "/test_node"));
   ASSERT_TRUE(spin_until([this]() {
-    return received_events_.size() >= 1;
+    return !received_events_.empty();
   }));
   received_events_.clear();
 
@@ -1323,7 +1323,7 @@ TEST_F(FaultEventPublishingTest, EventContainsCorrectTimestamp) {
 
   ASSERT_TRUE(call_report_fault("TEST_FAULT_4", Fault::SEVERITY_WARN, "/test_node"));
   ASSERT_TRUE(spin_until([this]() {
-    return received_events_.size() >= 1;
+    return !received_events_.empty();
   }));
 
   auto after = fault_manager_->now();
@@ -1339,7 +1339,7 @@ TEST_F(FaultEventPublishingTest, EventContainsCorrectTimestamp) {
 TEST_F(FaultEventPublishingTest, EventContainsFullFaultData) {
   ASSERT_TRUE(call_report_fault("FULL_DATA_TEST", Fault::SEVERITY_CRITICAL, "/sensor/temperature"));
   ASSERT_TRUE(spin_until([this]() {
-    return received_events_.size() >= 1;
+    return !received_events_.empty();
   }));
 
   ASSERT_EQ(received_events_.size(), 1u);
@@ -1362,7 +1362,7 @@ TEST_F(FaultEventPublishingTest, TimestampUsesWallClockNotSimTime) {
 
   ASSERT_TRUE(call_report_fault("WALL_CLOCK_TEST", Fault::SEVERITY_WARN, "/test_node"));
   ASSERT_TRUE(spin_until([this]() {
-    return received_events_.size() >= 1;
+    return !received_events_.empty();
   }));
 
   auto wall_after = std::chrono::system_clock::now();
@@ -1390,7 +1390,7 @@ TEST_F(FaultEventPublishingTest, GetFaultReturnsExpectedFault) {
   // Report a fault first
   ASSERT_TRUE(call_report_fault("GET_FAULT_TEST", Fault::SEVERITY_ERROR, "/test_node"));
   ASSERT_TRUE(spin_until([this]() {
-    return received_events_.size() >= 1;
+    return !received_events_.empty();
   }));
 
   // Get fault via service
@@ -1414,7 +1414,7 @@ TEST_F(FaultEventPublishingTest, GetFaultReturnsEnvironmentData) {
   // Report a fault
   ASSERT_TRUE(call_report_fault("ENV_DATA_TEST", Fault::SEVERITY_WARN, "/sensor/temp"));
   ASSERT_TRUE(spin_until([this]() {
-    return received_events_.size() >= 1;
+    return !received_events_.empty();
   }));
 
   auto response = call_get_fault("ENV_DATA_TEST");
@@ -1434,7 +1434,7 @@ TEST_F(FaultEventPublishingTest, GetFaultReturnsExtendedDataRecords) {
   // Report fault twice to have first and last occurrence timestamps differ
   ASSERT_TRUE(call_report_fault("EDR_TEST", Fault::SEVERITY_ERROR, "/node1"));
   ASSERT_TRUE(spin_until([this]() {
-    return received_events_.size() >= 1;
+    return !received_events_.empty();
   }));
   ASSERT_TRUE(call_report_fault("EDR_TEST", Fault::SEVERITY_ERROR, "/node2"));
   ASSERT_TRUE(spin_until([this]() {
@@ -1482,7 +1482,7 @@ TEST_F(FaultEventPublishingTest, ListFaultsForEntityEmptyResult) {
   // Report faults from a different entity
   ASSERT_TRUE(call_report_fault("SOME_FAULT", Fault::SEVERITY_ERROR, "/some/other_entity"));
   ASSERT_TRUE(spin_until([this]() {
-    return received_events_.size() >= 1;
+    return !received_events_.empty();
   }));
 
   // Query faults for non-existent entity
diff --git a/src/ros2_medkit_gateway/test/test_ros2_subscription_slot.cpp b/src/ros2_medkit_gateway/test/test_ros2_subscription_slot.cpp
index 9761b084f..41013304a 100644
--- a/src/ros2_medkit_gateway/test/test_ros2_subscription_slot.cpp
+++ b/src/ros2_medkit_gateway/test/test_ros2_subscription_slot.cpp
@@ -87,7 +87,7 @@ class Ros2SubscriptionSlotTest : public ::testing::Test {
 TEST_F(Ros2SubscriptionSlotTest, CreateTypedSucceedsAndCallbackFires) {
   std::atomic<int> received{0};
   auto slot = Ros2SubscriptionSlot::create_typed<std_msgs::msg::Int32>(
-      *sub_exec_, "/slot_typed", rclcpp::QoS(10), [&received](std::shared_ptr<const std_msgs::msg::Int32> msg) {
+      *sub_exec_, "/slot_typed", rclcpp::QoS(10), [&received](const std::shared_ptr<const std_msgs::msg::Int32> & msg) {
         received.store(msg->data);
       });
   ASSERT_TRUE(slot.has_value()) << slot.error();
@@ -107,11 +107,11 @@ TEST_F(Ros2SubscriptionSlotTest, CreateTypedSucceedsAndCallbackFires) {
 
 TEST_F(Ros2SubscriptionSlotTest, CreateGenericSucceedsAndCallbackFires) {
   std::atomic<int> received{0};
-  auto slot =
-      Ros2SubscriptionSlot::create_generic(*sub_exec_, "/slot_generic", "std_msgs/msg/String", rclcpp::QoS(10),
-                                           [&received](std::shared_ptr<const rclcpp::SerializedMessage> /*msg*/) {
-                                             received.fetch_add(1);
-                                           });
+  auto slot = Ros2SubscriptionSlot::create_generic(
+      *sub_exec_, "/slot_generic", "std_msgs/msg/String", rclcpp::QoS(10),
+      [&received](const std::shared_ptr<const rclcpp::SerializedMessage> & /*msg*/) {
+        received.fetch_add(1);
+      });
   ASSERT_TRUE(slot.has_value()) << slot.error();
   EXPECT_EQ((*slot)->type_name(), "std_msgs/msg/String");
 
@@ -128,7 +128,7 @@ TEST_F(Ros2SubscriptionSlotTest, CreateGenericSucceedsAndCallbackFires) {
 
 TEST_F(Ros2SubscriptionSlotTest, DestructorRemovesSubscriberFromGraph) {
   auto slot = Ros2SubscriptionSlot::create_typed<std_msgs::msg::Int32>(
-      *sub_exec_, "/slot_removed", rclcpp::QoS(10), [](std::shared_ptr<const std_msgs::msg::Int32>) {});
+      *sub_exec_, "/slot_removed", rclcpp::QoS(10), [](const std::shared_ptr<const std_msgs::msg::Int32> &) {});
   ASSERT_TRUE(slot.has_value());
 
   // Verify graph has 1 subscriber for our topic.
@@ -149,7 +149,7 @@ TEST_F(Ros2SubscriptionSlotTest, DestructorRemovesSubscriberFromGraph) {
 
 TEST_F(Ros2SubscriptionSlotTest, DestructorOnShuttingDownExecutorDoesNotCrash) {
   auto slot = Ros2SubscriptionSlot::create_typed<std_msgs::msg::Int32>(
-      *sub_exec_, "/slot_shutdown", rclcpp::QoS(10), [](std::shared_ptr<const std_msgs::msg::Int32>) {});
+      *sub_exec_, "/slot_shutdown", rclcpp::QoS(10), [](const std::shared_ptr<const std_msgs::msg::Int32> &) {});
   ASSERT_TRUE(slot.has_value());
 
   // Order matters: tear down executor first (so slot sees is_shutting_down()).
@@ -164,11 +164,11 @@ TEST_F(Ros2SubscriptionSlotTest, MultipleSlotsOnSameTopicBothReceive) {
   std::atomic<int> b{0};
 
   auto s1 = Ros2SubscriptionSlot::create_typed<std_msgs::msg::Int32>(
-      *sub_exec_, "/slot_shared", rclcpp::QoS(10), [&a](std::shared_ptr<const std_msgs::msg::Int32> msg) {
+      *sub_exec_, "/slot_shared", rclcpp::QoS(10), [&a](const std::shared_ptr<const std_msgs::msg::Int32> & msg) {
         a.store(msg->data);
       });
   auto s2 = Ros2SubscriptionSlot::create_typed<std_msgs::msg::Int32>(
-      *sub_exec_, "/slot_shared", rclcpp::QoS(10), [&b](std::shared_ptr<const std_msgs::msg::Int32> msg) {
+      *sub_exec_, "/slot_shared", rclcpp::QoS(10), [&b](const std::shared_ptr<const std_msgs::msg::Int32> & msg) {
         b.store(msg->data);
       });
   ASSERT_TRUE(s1.has_value());
@@ -203,7 +203,8 @@ TEST_F(Ros2SubscriptionSlotTest, DestructorSafeWhenDestroyTaskDrainsAfterSlotFre
   // the executor while the slot's destroy task is still queued. If the task
   // still captured `this`, TSan (or ASan) would flag UAF during queue drain.
   auto slot_local = Ros2SubscriptionSlot::create_typed<std_msgs::msg::Int32>(
-      *sub_exec_, "/slot_drain_after_dtor", rclcpp::QoS(10), [](std::shared_ptr<const std_msgs::msg::Int32>) {});
+      *sub_exec_, "/slot_drain_after_dtor", rclcpp::QoS(10),
+      [](const std::shared_ptr<const std_msgs::msg::Int32> &) {});
   ASSERT_TRUE(slot_local.has_value());
 
   // Serialize the worker behind a gate so the destroy task we post next
diff --git a/src/ros2_medkit_plugins/ros2_medkit_graph_watchdog/test/test_graph_watchdog_plugin.cpp b/src/ros2_medkit_plugins/ros2_medkit_graph_watchdog/test/test_graph_watchdog_plugin.cpp
index ef9910a64..8b713973d 100644
--- a/src/ros2_medkit_plugins/ros2_medkit_graph_watchdog/test/test_graph_watchdog_plugin.cpp
+++ b/src/ros2_medkit_plugins/ros2_medkit_graph_watchdog/test/test_graph_watchdog_plugin.cpp
@@ -526,7 +526,8 @@ namespace {
 /// view of its own, and the publication loop takes the FIRST emitting detector that has one -
 /// which would make these tests depend on static-init order ACROSS translation units.
 std::pair<std::vector<std::optional<std::set<std::string>>>, std::vector<std::optional<std::set<std::string>>>>
-run_until_observed(rclcpp::Node::SharedPtr gateway_node, const nlohmann::json & detectors_config, std::size_t sweeps) {
+run_until_observed(const rclcpp::Node::SharedPtr & gateway_node, const nlohmann::json & detectors_config,
+                   std::size_t sweeps) {
   reset_view_logs();
   g_owner_ticks.store(0);
 
diff --git a/src/ros2_medkit_plugins/ros2_medkit_opcua/test/test_opcua_plugin.cpp b/src/ros2_medkit_plugins/ros2_medkit_opcua/test/test_opcua_plugin.cpp
index a2bfccc00..10cf61447 100644
--- a/src/ros2_medkit_plugins/ros2_medkit_opcua/test/test_opcua_plugin.cpp
+++ b/src/ros2_medkit_plugins/ros2_medkit_opcua/test/test_opcua_plugin.cpp
@@ -47,10 +47,10 @@ namespace ros2_medkit_gateway {
 
 PluginRequest::PluginRequest(const void * impl) : impl_(impl) {
 }
-std::string PluginRequest::path_param(size_t) const {
+std::string PluginRequest::path_param(size_t /*unused*/) const {
   return {};
 }
-std::string PluginRequest::header(const std::string &) const {
+std::string PluginRequest::header(const std::string & /*unused*/) const {
   return {};
 }
 const std::string & PluginRequest::path() const {
@@ -61,15 +61,16 @@ const std::string & PluginRequest::body() const {
   static const std::string empty;
   return empty;
 }
-std::string PluginRequest::query_param(const std::string &) const {
+std::string PluginRequest::query_param(const std::string & /*unused*/) const {
   return {};
 }
 
 PluginResponse::PluginResponse(void * impl) : impl_(impl) {
 }
-void PluginResponse::send_json(const nlohmann::json &) {
+void PluginResponse::send_json(const nlohmann::json & /*unused*/) {
 }
-void PluginResponse::send_error(int, const std::string &, const std::string &, const nlohmann::json &) {
+void PluginResponse::send_error(int /*unused*/, const std::string & /*unused*/, const std::string & /*unused*/,
+                                const nlohmann::json & /*unused*/) {
 }
 
 // -- FakePluginContext --
@@ -1129,6 +1130,8 @@ struct ScopedRclcpp {
   }
   ScopedRclcpp(const ScopedRclcpp &) = delete;
   ScopedRclcpp & operator=(const ScopedRclcpp &) = delete;
+  ScopedRclcpp(ScopedRclcpp &&) = delete;
+  ScopedRclcpp & operator=(ScopedRclcpp &&) = delete;
 };
 
 // RAII: owns the executor and its spin thread so cleanup cannot be skipped by an
@@ -1160,6 +1163,8 @@ struct ScopedExecutorSpin {
   }
   ScopedExecutorSpin(const ScopedExecutorSpin &) = delete;
   ScopedExecutorSpin & operator=(const ScopedExecutorSpin &) = delete;
+  ScopedExecutorSpin(ScopedExecutorSpin &&) = delete;
+  ScopedExecutorSpin & operator=(ScopedExecutorSpin &&) = delete;
 };
 
 // The SOVD DELETE /faults/{code} route lands on FaultProvider::clear_fault(),
@@ -1190,14 +1195,14 @@ TEST(OpcuaPluginConcurrency, ClearFaultBufferIsThreadSafe) {
   auto fault_manager = std::make_shared<rclcpp::Node>("opcua_pending_reports_faultmgr");
   std::atomic<int> cleared_received{0};
   auto report_srv = fault_manager->create_service<ros2_medkit_msgs::srv::ReportFault>(
-      "/fault_manager/report_fault", [](const std::shared_ptr<ros2_medkit_msgs::srv::ReportFault::Request>,
-                                        std::shared_ptr<ros2_medkit_msgs::srv::ReportFault::Response> res) {
+      "/fault_manager/report_fault", [](const std::shared_ptr<ros2_medkit_msgs::srv::ReportFault::Request> & /*req*/,
+                                        const std::shared_ptr<ros2_medkit_msgs::srv::ReportFault::Response> & res) {
         res->accepted = true;
       });
   auto clear_srv = fault_manager->create_service<ros2_medkit_msgs::srv::ClearFault>(
       "/fault_manager/clear_fault",
-      [&cleared_received](const std::shared_ptr<ros2_medkit_msgs::srv::ClearFault::Request>,
-                          std::shared_ptr<ros2_medkit_msgs::srv::ClearFault::Response> res) {
+      [&cleared_received](const std::shared_ptr<ros2_medkit_msgs::srv::ClearFault::Request> & /*req*/,
+                          const std::shared_ptr<ros2_medkit_msgs::srv::ClearFault::Response> & res) {
         cleared_received.fetch_add(1, std::memory_order_relaxed);
         res->success = true;
       });
@@ -1248,6 +1253,7 @@ component_id: race_runtime
 
   std::atomic<bool> stop{false};
   std::vector<std::thread> threads;
+  threads.reserve(6);
   for (int t = 0; t < 6; ++t) {
     threads.emplace_back([&plugin, &stop, t] {
       int i = 0;