@canonical/pragma-cli 0.32.0 → 0.34.0

package/src/testing/fixtures/graph/defaultPack.ts

@@ -0,0 +1,179 @@
+/**
+ * The hermetic, vendored "default-pack" fixture — a SMALL but REAL multi-typed
+ * design-system pack, shaped the way a shipped default pack actually is, not the
+ * way the 6-entity single-typed canonical graph was.
+ *
+ * WHY A SECOND GRAPH (the R1 "one graph" discipline notwithstanding): the
+ * canonical fixture (`canonical.ts`) is deliberately clean — every individual is
+ * single-typed (`a ds:Component`), every block carries a tier, every label is a
+ * bare string. That cleanliness is exactly what masked the real-data counter and
+ * classifier bugs the journey harness (AV-231, Backlog E) exists to catch. This
+ * fixture is the ADVERSARIAL default pack: it reproduces the four shapes a real
+ * vendored pack has that the clean graph does not —
+ *
+ *  1. `owl:NamedIndividual` co-typing — every block is
+ *     `a owl:NamedIndividual, ds:<Class>`, the way exported OWL individuals are.
+ *     This is what doubles the per-type instance tally (A1 `entityTotal` 2×): a
+ *     block counts once under `owl:NamedIndividual` AND once under its domain
+ *     class.
+ *  2. Two+ domain classes (`ds:Component` and `ds:Pattern`) so a read that keys
+ *     off the primary domain type is exercised across more than one class.
+ *  3. An UNTIERED block (`ds:orphanWidget` — a `ds:Component` with a `ds:name`
+ *     but NO `ds:tier`). `block list`'s SELECT once inner-joined `?c ds:tier ?t`,
+ *     silently dropping an untiered block from every listing (A2) even though
+ *     `graph query` found it; the declared story's OPTIONAL tier join is what
+ *     the fixture now holds honest.
+ *  4. A multilingual `rdfs:label "Button"@en, "Bouton"@fr` — two same-predicate
+ *     labels whose winner in the single-valued index is store-order-arbitrary
+ *     (A7), a shape a bare-string fixture can never produce.
+ *
+ * The vocabulary is the live `ds:` design-system namespace (same as
+ * `blockGraph.ts`/`canonical.ts`), so `block list`, `ontology list/show`, and
+ * `graph query` all run against real terms — the `block` story's declared SELECT
+ * names `ds:Component`/`ds:Pattern`/`ds:name`/`ds:tier` directly.
+ *
+ * Stable anchors this fixture guarantees (pinned by the journey suite):
+ *  - Exactly 4 blocks in the graph: Button (`ds:Component`, global), Card
+ *    (`ds:Pattern`, global), Beta Badge (`ds:Component`, apps tier, beta
+ *    channel), Orphan Widget (`ds:Component`, UNTIERED).
+ *  - 5 TBox classes, 4 TBox properties, 2 tiers (`global`, `apps`), 2 release
+ *    channels (`stable`, `beta`).
+ *  - `ds:button` carries the multilingual label; every other subject is a bare
+ *    string, so the multilingual path is isolated to one entity.
+ */
+
+/** The prefixes the default-pack fixture store is built and queried with. */
+export const DEFAULT_PACK_PREFIXES: Readonly<Record<string, string>> = {
+  ds: "https://ds.canonical.com/",
+  owl: "http://www.w3.org/2002/07/owl#",
+  rdfs: "http://www.w3.org/2000/01/rdf-schema#",
+  xsd: "http://www.w3.org/2001/XMLSchema#",
+};
+
+/**
+ * The vendored default pack as one Turtle document: TBox (5 classes, 4
+ * properties) + ABox (2 tiers, 2 channels, 4 blocks). Every block is co-typed
+ * `owl:NamedIndividual` — the real-export shape the clean canonical graph omits.
+ */
+export const DEFAULT_PACK_TTL = `
+@prefix ds: <https://ds.canonical.com/> .
+@prefix owl: <http://www.w3.org/2002/07/owl#> .
+@prefix rdfs: <http://www.w3.org/2000/01/rdf-schema#> .
+@prefix xsd: <http://www.w3.org/2001/XMLSchema#> .
+
+# ---- Ontology (TBox): 5 classes, 4 properties ----
+ds:UIBlock a owl:Class ; rdfs:label "UI Block" .
+ds:Component a owl:Class ; rdfs:subClassOf ds:UIBlock ; rdfs:label "Component" .
+ds:Pattern a owl:Class ; rdfs:subClassOf ds:UIBlock ; rdfs:label "Pattern" .
+ds:Tier a owl:Class ; rdfs:label "Tier" .
+ds:ReleaseChannel a owl:Class ; rdfs:label "Release Channel" .
+
+ds:name a owl:DatatypeProperty ; rdfs:domain ds:UIBlock ; rdfs:range xsd:string .
+# Functional (one tier per block), matching the live ontology — a non-functional
+# ds:tier compiles to a multi-valued GraphQL field the bundled block lookup rejects.
+ds:tier a owl:ObjectProperty, owl:FunctionalProperty ; rdfs:domain ds:UIBlock ; rdfs:range ds:Tier .
+ds:release a owl:ObjectProperty, owl:FunctionalProperty ; rdfs:domain ds:UIBlock ; rdfs:range ds:ReleaseChannel .
+ds:summary a owl:DatatypeProperty ; rdfs:domain ds:UIBlock ; rdfs:range xsd:string .
+
+# ---- Tiers (a real parent chain: apps -> global) ----
+ds:global a ds:Tier ; ds:name "global" .
+ds:apps a ds:Tier ; ds:name "apps" .
+
+# ---- Release channels ----
+ds:stable a ds:ReleaseChannel ; ds:name "stable" .
+ds:beta a ds:ReleaseChannel ; ds:name "beta" .
+
+# ---- Blocks (ABox) — every one co-typed owl:NamedIndividual (the export shape) ----
+
+# A component on the global tier, carrying a MULTILINGUAL label (A7 shape).
+ds:button a owl:NamedIndividual, ds:Component ;
+  ds:name "Button" ;
+  rdfs:label "Button"@en, "Bouton"@fr ;
+  ds:tier ds:global ;
+  ds:summary "A clickable button control." .
+
+# A second DOMAIN CLASS (ds:Pattern), on the global tier.
+ds:card a owl:NamedIndividual, ds:Pattern ;
+  ds:name "Card" ;
+  rdfs:label "Card" ;
+  ds:tier ds:global ;
+  ds:summary "A content card layout pattern." .
+
+# A component gated to the BETA channel and the non-global apps tier — exercises
+# both channel visibility and tier-chain inheritance.
+ds:betaBadge a owl:NamedIndividual, ds:Component ;
+  ds:name "Beta Badge" ;
+  rdfs:label "Beta Badge" ;
+  ds:tier ds:apps ;
+  ds:release ds:beta ;
+  ds:summary "An experimental badge, gated to the prerelease channel." .
+
+# An UNTIERED component — a real ds:Component with a ds:name but NO ds:tier.
+# It IS in the graph (graph query finds it) but block list's mandatory
+# tier join (?c ds:tier ?t) drops it (A2).
+ds:orphanWidget a owl:NamedIndividual, ds:Component ;
+  ds:name "Orphan Widget" ;
+  rdfs:label "Orphan Widget" ;
+  ds:summary "A component shipped without a tier assignment." .
+`;
+
+/** No-tier viewing config, `normal` channel — hides the beta-only Beta Badge. */
+export const DEFAULT_PACK_CONFIG = { channel: "normal" as const };
+
+/** `prerelease` channel, no tier — the config where every channel-gated block shows. */
+export const DEFAULT_PACK_ALL_VISIBLE_CONFIG = {
+  channel: "prerelease" as const,
+};
+
+/** The names of the 4 blocks the fixture declares, sorted (SPARQL `ORDER BY ?name`). */
+export const DEFAULT_PACK_BLOCK_NAMES = [
+  "Beta Badge",
+  "Button",
+  "Card",
+  "Orphan Widget",
+] as const;
+
+/** The block excluded from `block list` for want of a `ds:tier` (A2 anchor). */
+export const UNTIERED_BLOCK_NAME = "Orphan Widget";
+
+/**
+ * A second, ontology-only pack with NO tiered blocks — drives the EMPTY
+ * `block list` (a calm exit-0 empty result, not an error). It still declares the
+ * `ds:` TBox, so `ontology list` is POPULATED here (the populated/empty pair for
+ * the two list verbs is split across this and {@link INSTANCE_ONLY_TTL}).
+ */
+export const NO_BLOCKS_TTL = `
+@prefix ds: <https://ds.canonical.com/> .
+@prefix owl: <http://www.w3.org/2002/07/owl#> .
+@prefix rdfs: <http://www.w3.org/2000/01/rdf-schema#> .
+@prefix xsd: <http://www.w3.org/2001/XMLSchema#> .
+
+ds:UIBlock a owl:Class .
+ds:Component a owl:Class ; rdfs:subClassOf ds:UIBlock .
+ds:Tier a owl:Class .
+ds:name a owl:DatatypeProperty ; rdfs:domain ds:UIBlock ; rdfs:range xsd:string .
+ds:tier a owl:ObjectProperty ; rdfs:domain ds:UIBlock ; rdfs:range ds:Tier .
+
+ds:global a ds:Tier ; ds:name "global" .
+`;
+
+/**
+ * A pack of pure instance data with NO `owl:Class`/`owl:*Property` declarations —
+ * drives the EMPTY `ontology list` (no namespace has any classes or properties
+ * to group), while `graph query` still resolves its triples.
+ */
+export const INSTANCE_ONLY_TTL = `
+@prefix ex: <https://ex.test/#> .
+ex:alpha ex:relatesTo ex:beta .
+ex:beta ex:name "Beta" .
+`;
+
+/**
+ * A malformed Turtle source — a subject/predicate with no object — drives the
+ * `sources update` data-error classification path (a NAMED `CONFIG_ERROR`, not
+ * an INTERNAL "please report this issue").
+ */
+export const MALFORMED_TTL = `@prefix ex: <https://ex.test/#> .
+ex:One a ex:Widget .
+ex:Two ex:danglingPredicate .
+`;

package/src/testing/fixtures/graph/owlExport.ts

@@ -0,0 +1,97 @@
+/**
+ * A realistic multi-typed OWL / Protégé-export fixture graph.
+ *
+ * The other fixture graphs (`canonical.ts`, `defaultPack.ts` — Button/Card/
+ * Dialog, each typed by exactly ONE domain class, every block tiered, every
+ * label untagged) are TOYS: they never exercise the counters/classifiers the way
+ * a real vocabulary does. This graph deliberately carries the shapes that only
+ * bite real packs (audit backlog A):
+ *
+ * - Protégé DUAL-typing: an individual asserted as its domain class AND
+ *   `owl:NamedIndividual` — the multiset that made `entityTotal` run ~2× (A1).
+ * - A MULTI-DOMAIN individual (`ex:toggle`: two domain classes) — so the
+ *   primary-type tie-break must be deterministic, not store-order (A3).
+ * - An UNTIERED block (`ds:datePicker`: a `ds:Component` with no `ds:tier`) —
+ *   which `block list` must surface, not hide (A2; the tier join is OPTIONAL,
+ *   and since L-OPEN-9 there is no tier filter at all).
+ * - A blank-node `rdf:type` (`ex:field`'s anonymous SHACL-style class) — which
+ *   must NOT become a `type:"_:b0"` primary key (A6).
+ * - An OWL-PUNNED subject (`ex:Slider`: a class that is ALSO a metaclass
+ *   individual) — whose abox facet must survive alongside its tbox one (A8).
+ * - MULTILINGUAL labels (`"Button"@en` / `"Bouton"@fr`) — resolved to a stable
+ *   language, never whichever row the store returned first (A7).
+ *
+ * The `ds:` half is a compact but faithful design-system slice (so `block list`
+ * runs against it); the `ex:` half is generic OWL, proving the index is
+ * ontology-agnostic. One document, so a single store answers every read.
+ */
+
+/** The prefixes the OWL-export fixture store is built and queried with. */
+export const OWL_EXPORT_PREFIXES: Readonly<Record<string, string>> = {
+  ds: "https://ds.canonical.com/",
+  ex: "https://ex.test/vocab#",
+  rdf: "http://www.w3.org/1999/02/22-rdf-syntax-ns#",
+  rdfs: "http://www.w3.org/2000/01/rdf-schema#",
+  owl: "http://www.w3.org/2002/07/owl#",
+  xsd: "http://www.w3.org/2001/XMLSchema#",
+};
+
+/** The multi-typed OWL-export fixture ontology + individuals as Turtle. */
+export const OWL_EXPORT_TTL = `
+@prefix ds:   <https://ds.canonical.com/> .
+@prefix ex:   <https://ex.test/vocab#> .
+@prefix rdf:  <http://www.w3.org/1999/02/22-rdf-syntax-ns#> .
+@prefix rdfs: <http://www.w3.org/2000/01/rdf-schema#> .
+@prefix owl:  <http://www.w3.org/2002/07/owl#> .
+@prefix xsd:  <http://www.w3.org/2001/XMLSchema#> .
+
+# ---- Design-system TBox (so \`block list\` has real block types) ----
+ds:UIBlock a owl:Class .
+ds:Component a owl:Class ; rdfs:subClassOf ds:UIBlock ; rdfs:label "Component" .
+ds:Tier a owl:Class .
+ds:name a owl:DatatypeProperty ; rdfs:domain ds:UIBlock ; rdfs:range xsd:string .
+ds:tier a owl:ObjectProperty ; rdfs:domain ds:UIBlock ; rdfs:range ds:Tier .
+ds:global a owl:NamedIndividual, ds:Tier ; ds:name "global" .
+
+# ---- Generic OWL domain classes (multi-typing lives here) ----
+ex:Interactive a owl:Class ; rdfs:label "Interactive" .
+ex:FormControl a owl:Class ; rdfs:label "Form Control" .
+ex:Category a owl:Class ; rdfs:label "Category" .
+
+# ---- A tiered block, Protégé-style DUAL-typed (domain class + owl:NamedIndividual),
+#      with a multilingual label (A1 + A7). ----
+ds:button a owl:NamedIndividual, ds:Component ;
+  ds:name "Button" ;
+  ds:tier ds:global ;
+  rdfs:label "Button"@en , "Bouton"@fr .
+
+# ---- An UNTIERED block: a ds:Component with NO ds:tier (A2). ----
+ds:datePicker a owl:NamedIndividual, ds:Component ;
+  ds:name "Date Picker" ;
+  rdfs:label "Date Picker"@en , "Sélecteur de date"@fr .
+
+# ---- A MULTI-DOMAIN individual: two domain classes + owl:NamedIndividual (A1 + A3).
+#      The abox primary must be the lexically-smallest: ex:FormControl < ex:Interactive. ----
+ex:toggle a owl:NamedIndividual, ex:Interactive, ex:FormControl ;
+  rdfs:label "Toggle"@en , "Bascule"@fr .
+
+# ---- An OWL-PUNNED subject: a class that is ALSO a metaclass individual (A8).
+#      Must emit BOTH a tbox facet (owl:Class) and an abox facet (ex:Category). ----
+ex:Slider a owl:Class, owl:NamedIndividual, ex:Category ;
+  rdfs:label "Slider" .
+
+# ---- A subject with a BLANK-NODE rdf:type: an anonymous class (A6).
+#      The blank node must NOT become ex:field's primary type. ----
+ex:field a owl:NamedIndividual, ex:FormControl, [ a owl:Class ] ;
+  rdfs:label "Field" .
+`;
+
+/** The distinct abox individuals this fixture declares (the `entityTotal` oracle). */
+export const OWL_EXPORT_ABOX_SUBJECTS: readonly string[] = [
+  "ds:button",
+  "ds:datePicker",
+  "ds:global",
+  "ex:Slider",
+  "ex:field",
+  "ex:toggle",
+];

package/src/testing/helpers/extractSnippets.ts

@@ -0,0 +1,29 @@
+/**
+ * Pull the runnable `pragma` command lines out of a Markdown document.
+ *
+ * Scans fenced `bash` / `sh` / `console` blocks, strips a leading shell prompt
+ * (`$ `), and keeps the lines that invoke `pragma`. Used by the doc-example
+ * tests to prove every command shown in the docs is real grammar and — for the
+ * curated read set — actually runs.
+ */
+
+/** Fenced `bash`/`sh`/`console` blocks, capturing the body between the fences. */
+const FENCE_RE = /```(?:bash|sh|console)\r?\n(?<body>[\s\S]*?)```/g;
+
+/**
+ * Extract every `pragma …` command line from a Markdown string.
+ *
+ * @param markdown - The Markdown source to scan.
+ * @returns The `pragma` command lines, in document order, prompt-stripped.
+ */
+export function extractPragmaCommands(markdown: string): string[] {
+  const commands: string[] = [];
+  for (const match of markdown.matchAll(FENCE_RE)) {
+    const body = match.groups?.body ?? "";
+    for (const rawLine of body.split("\n")) {
+      const line = rawLine.replace(/^\s*\$\s+/, "").trim();
+      if (line.startsWith("pragma ")) commands.push(line);
+    }
+  }
+  return commands;
+}

package/src/testing/helpers/fixtureGraph.ts

@@ -1,6 +1,6 @@
 /**
  * Test helper: boot a store-backed {@link PragmaRuntime} at a REAL `cwd` whose
- * `pragma.lock.json` points at a built fixture pack.
+ * active-pack pointer names a built fixture pack.
  *
  * This is distinct from (and complements) `packRuntime.ts#buildFixtureRuntime`:
  * that helper hands back an in-process runtime wired to a custom `LazyStore`,
@@ -8,14 +8,18 @@
  * generalizes the `runtimeFor` + `buildUpdateTask` pattern proven in
  * `capabilities/sources/sources.test.ts`: it writes an actual
  * `pragma.config.ts` + package directory, runs the REAL `sources update` Task
- * (resolve → build → lock), and returns a `cwd`. Because the lock is a real
- * file, EVERY independent runtime construction that resolves config from that
+ * (resolve → build → point), and returns a `cwd`. Because the pointer is a
+ * real file, EVERY independent runtime construction that resolves config from that
  * `cwd` — `bootRuntime(flags, cwd)` (CLI dispatch), `projectMcp(modules, cwd)`
  * (MCP), and `runCli(args, { cwd })` (spawn) — boots the SAME cached pack. That
  * is the property PR4's cross-surface parity tests need and PR3's single-surface
  * parity tests did not: proof that CLI-json and MCP-json agree over a graph
  * built the same way `sources update` builds one for a real project.
  *
+ * A fixture package may also ship `stories/*.json` (the `stories` option), which
+ * `sources update` carries into the built pack — that is the package tier a
+ * third-party noun arrives through.
+ *
  * Hermetic: the pack cache lives under the isolated `$XDG_CACHE_HOME`
  * `setupXdgIsolation` installs; `dispose()` removes the temp directories (the
  * shared content-addressed pack cache itself is left for reuse/cleanup by the
@@ -30,7 +34,7 @@ import { buildUpdateTask } from "../../capabilities/sources/runUpdate.js";
 import { VERSION } from "../../constants.js";
 import type {
   ConfigLayers,
-  PackageEntry,
+  PackDeclaration,
   PragmaConfig,
 } from "../../kernel/config/types.js";
 import { bootRuntime } from "../../kernel/runtime/boot.js";
@@ -52,34 +56,39 @@ export interface FixtureGraphOptions {
   readonly ttl: string;
   /**
    * Config fields to bake into the written `pragma.config.ts`, e.g.
-   * `{ tier: "apps/lxd", channel: "prerelease" }`. `packages` is always set by
+   * `{ tier: "apps/lxd", channel: "prerelease" }`. `packs` is always set by
    * this helper (to the fixture package) — do not override it here.
    */
-  readonly config?: Omit<Partial<PragmaConfig>, "packages">;
+  readonly config?: Omit<Partial<PragmaConfig>, "packs">;
+  /**
+   * `stories/*.json` the fixture PACKAGE ships, as raw text keyed by file name
+   * — deliberately raw, so a test can ship malformed or schema-invalid content
+   * and assert that it is dropped rather than fatal.
+   */
+  readonly stories?: Readonly<Record<string, string>>;
 }
 
 /** A booted fixture runtime plus its `cwd` (usable by any surface) and disposal. */
 export interface FixtureGraph {
   /** A REAL `bootRuntime` at {@link cwd} — the same one CLI dispatch uses. */
   readonly runtime: PragmaRuntime;
-  /** The project directory whose `pragma.lock.json`/`pragma.config.ts` were written. */
+  /** The project directory whose `pragma.config.ts` + active-pack pointer were written. */
   readonly cwd: string;
   /** Remove the temp directories and dispose the store session, if booted. */
   dispose(): Promise<void>;
 }
 
 /** A synthetic runtime with an IN-MEMORY config — used only to drive the build Task. */
-function builderRuntime(cwd: string, packages: PackageEntry[]): PragmaRuntime {
+function builderRuntime(cwd: string, packs: PackDeclaration[]): PragmaRuntime {
   const layers: ConfigLayers = {
-    config: { channel: "normal", packages },
+    config: { channel: "normal", packs },
     origins: {
       tier: "default",
       channel: "default",
       detail: "default",
-      packages: "project",
+      packs: "project",
       stories: "default",
       prefixes: "default",
-      prompts: "default",
     },
     global: { path: "/nonexistent", exists: false },
     project: { exists: false },
@@ -102,8 +111,9 @@ function configField(key: string, value: unknown): string {
 }
 
 /**
- * Build a store-backed runtime whose `cwd` carries a real lock file — the ONE
- * shared store-backed fixture path for cross-surface (CLI/MCP/spawn) tests.
+ * Build a store-backed runtime whose `cwd` is pointed at a real built pack —
+ * the ONE shared store-backed fixture path for cross-surface (CLI/MCP/spawn)
+ * tests.
  *
  * @param options - The fixture graph TTL and any config overrides.
  * @returns The runtime, its cwd, and a disposer.
@@ -116,11 +126,18 @@ export async function bootFixtureRuntime(
   const pkgDir = mkdtempSync(join(tmpdir(), "pragma-fixture-pkg-"));
   mkdirSync(join(pkgDir, "definitions"), { recursive: true });
   writeFileSync(join(pkgDir, "definitions", "fixture.ttl"), options.ttl);
+  const stories = Object.entries(options.stories ?? {});
+  if (stories.length > 0) {
+    mkdirSync(join(pkgDir, "stories"), { recursive: true });
+    for (const [file, content] of stories) {
+      writeFileSync(join(pkgDir, "stories", file), content);
+    }
+  }
 
-  const packages: PackageEntry[] = [
+  const packs: PackDeclaration[] = [
     { name: "fixture", source: `file://${pkgDir}` },
   ];
-  const fields = [configField("packages", packages)];
+  const fields = [configField("packs", packs)];
   for (const [key, value] of Object.entries(options.config ?? {})) {
     fields.push(configField(key, value));
   }
@@ -129,7 +146,7 @@ export async function bootFixtureRuntime(
     `export default {\n${fields.join("\n")}\n};\n`,
   );
 
-  await runTask(await buildUpdateTask(builderRuntime(cwd, packages), false));
+  await runTask(await buildUpdateTask(builderRuntime(cwd, packs)));
 
   const runtime = bootRuntime(FIXTURE_FLAGS, cwd);
 

package/src/testing/helpers/golden.ts

@@ -14,7 +14,7 @@ import { fileURLToPath } from "node:url";
 // biome-ignore lint/suspicious/noControlCharactersInRegex: matching the literal ESC byte is the point
 const ANSI_PATTERN = /\x1b\[[0-9;]*m/g;
 
-/** The package repo root (`packages/cli/next`), for tokenizing absolute paths. */
+/** The package repo root (`packages/cli/pragma`), for tokenizing absolute paths. */
 const REPO_ROOT = fileURLToPath(new URL("../../../", import.meta.url)).replace(
   /\/$/,
   "",

package/src/testing/helpers/packRuntime.ts

@@ -36,7 +36,7 @@ export interface FixtureRuntimeOptions {
   /** Explicit `--detail` level for this invocation. */
   readonly detail?: DetailLevel;
   /** Config `detail` value and its origin (drives {@link resolvePackDetail}). */
-  readonly configDetail?: string;
+  readonly configDetail?: DetailLevel;
   /** Origin of the config `detail` (default `"default"`). */
   readonly detailOrigin?: ConfigOrigin;
 }
@@ -93,10 +93,9 @@ export async function buildFixtureRuntime(
       tier: "default",
       channel: "default",
       detail: options.detailOrigin ?? "default",
-      packages: "default",
+      packs: "default",
       stories: "default",
       prefixes: "default",
-      prompts: "default",
     },
     global: { path: "", exists: false },
     project: { exists: false },

package/src/testing/helpers/projectCli.ts

@@ -7,6 +7,7 @@
  */
 
 import type { Command } from "commander";
+import { BIN_NAME } from "../../constants.js";
 import { buildProgram } from "../../kernel/project/cli/buildProgram.js";
 import type { GlobalFlags } from "../../kernel/runtime/types.js";
 import type { CapabilityModule, VerbSpec } from "../../kernel/spec/types.js";
@@ -31,5 +32,5 @@ export function projectCli(
   globalFlags: GlobalFlags = TEST_FLAGS,
 ): Command {
   const verbs: VerbSpec[] = modules.flatMap((module) => [...module.verbs]);
-  return buildProgram(verbs, { globalFlags, programName: "pragma" });
+  return buildProgram(verbs, { globalFlags, programName: BIN_NAME });
 }

package/src/testing/helpers/projectMcp.ts

@@ -42,6 +42,8 @@ export interface McpHarness {
   completeResource(partial: string): Promise<string[]>;
   /** The server capabilities negotiated at initialize (tools/resources/prompts). */
   serverCapabilities(): ServerCapabilities | undefined;
+  /** The `serverInfo` the server introduced itself with at initialize. */
+  serverInfo(): { name: string; version: string } | undefined;
   /** The server `instructions` string sent at initialize. */
   instructions(): string | undefined;
   /** List the native MCP prompts (`prompts/list`). */
@@ -120,6 +122,10 @@ export async function projectMcp(
     serverCapabilities() {
       return client.getServerCapabilities();
     },
+    serverInfo() {
+      const info = client.getServerVersion();
+      return info ? { name: info.name, version: info.version } : undefined;
+    },
     instructions() {
       return client.getInstructions();
     },

package/src/testing/perf/budgets.test.ts

@@ -96,6 +96,10 @@ describe("perf budgets (PROTECTED)", () => {
     // __store-probe boots the embedded pack from its n-quads cache and queries
     // it — the full store-backed verb cost in the compiled binary. The first
     // spawn materializes the pack; warmups absorb it, then it is a cache hit.
+    // Note that with 9 kept samples a nearest-rank p95 IS the maximum (see
+    // BUDGETS.md's p95-stabilization section) — deliberately kept, because the
+    // honest statistic here is the one that catches real cost, and the ceiling
+    // is sized with a 1.25× margin over a projected p95 to absorb it.
     const result = measureCommand(BINARY, ["__store-probe"], {
       runs: 12,
       warmups: 3,

package/src/testing/perf/budgets.ts

@@ -4,9 +4,12 @@
  * The ceilings the protected budget tests assert against. The surface
  * covenant's designed target for `--help`/`__complete` is 50 ms; the day-1 perf
  * spike (commit 6) found that unrealistic on the build hardware (cold Bun
- * process start alone is ~45 ms here), so — per the plan — each ceiling is set
- * to roughly 2× the measured median rather than silently weakening the target.
- * Measured numbers and environment are recorded in BUDGETS.md.
+ * process start alone is ~45 ms here), so — per the plan — those ceilings are
+ * set to roughly 2× the measured median rather than silently weakening the
+ * target. {@link BUDGET_WARM_STORE_MS} is derived differently (from a projected
+ * p95, and it lands TIGHTER than 2× its median); its arithmetic is written out
+ * in full in BUDGETS.md, as are the measurements and environment for all of
+ * them.
  */
 
 /** `pragma --help` ceiling (ms). Designed 50; measured median ~61 → 2×. */
@@ -20,11 +23,23 @@ export const BUDGET_PROJECT_CONFIG_MS = 10;
 
 /**
  * Warm store-backed verb ceiling (ms) — a store boot from the cached n-quads
- * dump plus a query, in the compiled binary. The designed 300 ms holds: the
- * measured median (`__store-probe`) is ~150 ms here, so 300 is already ~2× the
- * measured median and needs no relaxation (see BUDGETS.md).
+ * dump plus a query, in the compiled binary.
+ *
+ * Re-derived when the embed became the distribution's real 8 479-triple graph
+ * instead of a 23-triple sample. Netted against a `--version` control from the
+ * SAME binary in the SAME run (this box's process start swings 60–287 ms with
+ * page-cache state alone), the real pack's store work is 2.83× the sample's —
+ * the median of five repetitions across two protocols. Projected onto the
+ * reference box, whose own toy store work is 147 − 45.5 = 101.5 ms: 45.5 +
+ * 101.5 × 2.83 ≈ 333 ms median, and 333 × (176/147) ≈ 398 ms p95 using the
+ * reference box's own dispersion for this command. `ceil(398 × 1.25 / 50) × 50`
+ * = 500 — which is 1.6× the projected median, i.e. tighter than the
+ * 2×-of-median rule the ceilings above use. Every input, every step, and the
+ * raw measurements are in BUDGETS.md; the designed `<300ms` target stays in the
+ * surface covenant, exactly as the 50 ms `help` target survived its 130 ms
+ * ceiling.
  */
-export const BUDGET_WARM_STORE_MS = 300;
+export const BUDGET_WARM_STORE_MS = 500;
 
 /**
  * Warm in-process MCP tool-call ceiling (ms) — PR7 graduates this from seeded to