@fuzdev/fuz_app 0.118.0 → 0.119.0

package/dist/testing/CLAUDE.md

@@ -31,10 +31,10 @@ time (never runtime), where a throwing guard would break `vite build`.
 - `create_stub_db()` — real `Db` whose `client.query` yields `{rows: []}` and `transaction(fn)` synchronously calls `fn(inner_stub_db)`. Safe for `apply_route_specs`'s declarative transaction wrapper.
 - `stub_handler()` — fresh `Response('stub')`.
 - `stub_mw` — pass-through middleware (`async (_c, next) => next()`).
-- `stub_app_deps` — frozen `AppDeps`, every capability throwing, `audit` a no-op `AuditEmitter` from `create_test_audit_emitter`.
-- `create_stub_app_deps()` — factory: fresh `AppDeps` with no-op keyring/password/`delete_file`, a `read_secure_file` that throws ENOENT (the no-token-file state), a `create_noop_stub` DB, silent `Logger`, no-op `audit`.
+- `stub_app_deps` — frozen `AppDeps`, every capability throwing, `audit` a no-op `AuditEmitter` from `create_test_audit_emitter`, `connection_closer` an empty `RealtimeCloser`.
+- `create_stub_app_deps()` — factory: fresh `AppDeps` with no-op keyring/password/`delete_file`, a `read_secure_file` that throws ENOENT (the no-token-file state), a `create_noop_stub` DB, silent `Logger`, no-op `audit`, an empty `connection_closer`.
 - `create_test_audit_emitter()` — no-op `AuditEmitter`; `emit` / `emit_role_grant_target` no-op, `emit_pool` resolves immediately, `notify` no-op, `add_listener` throws (use `create_recording_audit_emitter` for a listener-accepting emitter), `listener_count` returns 0.
-- `create_stub_audit_sse()` — no-op `AuditLogSse` for surface-test wiring without booting real SSE. `subscribe` returns a no-op cleanup; `on_audit_event` no-op; `registry` is a fresh `SubscriberRegistry` (live `.size` / `.close_*` for registry-state tests, isolated per call). For real SSE plumbing build via `create_audit_log_sse` against `create_test_app`.
+- `create_stub_audit_sse()` — no-op `AuditLogSse` for surface-test wiring without booting real SSE. `on_audit_event` no-op (nothing is broadcast); `registry` is a fresh `SubscriberRegistry` (live `.count` / `.close_*` for registry-state tests, isolated per call). For real SSE plumbing build via `create_audit_log_sse` against `create_test_app`.
 - `create_stub_api_middleware({include_daemon_token?})` — stub `MiddlewareSpec[]` matching `create_auth_middleware_specs`'s output (origin/session/request_context/bearer_auth, optional daemon_token) for surface generation without booting real auth. See `auth/CLAUDE.md` §Middleware for the real stack.
 - `create_stub_app_server_context(session_options)` — stub `AppServerContext`; rate limiters null, `bootstrap_status.available: false`, `app_settings.open_signup: false`.
 - `create_test_app_surface_spec(options)` — builds an `AppSurfaceSpec` mirroring `create_app_server`'s route assembly (consumer routes + stub middleware + surface generation). `CreateTestAppSurfaceSpecOptions`: `session_options`, `create_route_specs`, `env_schema?`, `event_specs?`, `rpc_endpoints?`, `ws_endpoints?`, `transform_middleware?`, `bootstrap?`. Bootstrap is opt-in (symmetric with `create_app_server` — omit to skip; pass the same value as prod to mount routes at `bootstrap.route_prefix ?? '/api/account'`). Single source of truth for attack-surface tests — track `create_app_server` wiring changes here.
@@ -100,16 +100,14 @@ mismatch.
 ### `audit_drift_guard.ts` — audit-emission validation
 
 - `install_audit_drift_guard()` — `beforeEach` resets + `afterEach` zero-checks `audit_metadata_validation_failures` + `audit_unknown_event_type_failures` counters from `auth/audit_log_queries.ts`. Call once at the top of any `describe_db` block firing audit emits — production validation is fail-open, so without this any regression shipping a typo'd `event_type` or undeclared metadata field is silent. Pair with `await_pending_effects: true` (the `create_test_app` default) so fire-and-forget audit writes complete by response time.
-- `create_emit_ordering_audit_factory<E>(seq_ref, events_ref, build_inner)` — returns an `AuditFactory` wrapping `build_inner({db, log})` so every `emit` pushes `{kind: 'emit', at: seq.value++}` into a shared sequence + events array. Pass through `create_test_app({audit_factory: …})` — the test backend invokes it with its `{db, log}` and lands the wrapped emitter on `deps.audit`. Generic `E extends {kind: string; at: number}` so the events array typechecks against the caller's own `close` / custom marker shape. Pair with `create_recording_closer(seq_ref)` for close-vs-emit ordering tests. Scope is `emit` only — `emit_role_grant_target`, `emit_pool`, `notify` forward to the inner emitter unwrapped.
-- `AuditEmitMarker` — `{kind: 'emit'; at: number}`, the marker type pushed.
 - `create_recording_audit_emitter(calls_ref?)` — no-op `AuditEmitter` pushing every `emit` and `emit_pool` call into `calls`. Pass `calls_ref` to write into a caller-owned array; omit to let the helper allocate. Returns `{emitter, calls}` — destructure `emitter` as the `audit` dep and read `calls` to assert. Replaces per-file capturing emitters previously duplicated across `password_change.test.ts`, `audit_log.test.ts`, etc.
 - `RecordingAuditEmitter` — `{emitter: AuditEmitter; calls: Array<AuditLogInput>}`.
 
 ### `connection_closer_helpers.ts` — `ConnectionCloser` test doubles
 
-- `create_recording_closer(seq_ref?)` — `{closer, calls}`; every method on `closer` records `{method, id, at}` into `calls`. Pass `seq_ref` to share the sequence counter with `create_emit_ordering_audit_factory` so close + emit markers compose for ordering tests.
-- `assert_close_call(call, method, id)` — pins `{method, id}` on a recorded close call without baking in the `at: N` sequence number. Use at every "did the closer fire?" site; reserve `at: N` assertions for the dedicated ordering test paired with the capture helper.
-- `RecordedClose` — `{method: 'session' | 'token' | 'account', id, at}`.
+- `create_recording_closer()` — `{closer, calls}`; every method on `closer` records `{method, id}` into `calls` and closes nothing. To see a handler's closes, add it to the backend's closer (`ctx.deps.connection_closer.add(closer)`) or build the factory's deps with it. The closes are queued post-commit, so they have run by the time a `create_test_app` response is in hand (`await_pending_effects: true` flushes both queues).
+- `assert_close_call(call, method, id)` — pins `{method, id}` on a recorded close call; handles the missing-element case.
+- `RecordedClose` — `{method: 'session' | 'token' | 'account', id}`.
 - `RecordingCloser` — `{closer, calls}`.
 
 ## Database — `db.ts`
@@ -171,7 +169,7 @@ pre-keeper, lock unflipped), use `create_test_app_for_bootstrap` — pair with
 Types:
 
 - `TestAppServer extends AppBackend` — adds `account`, `actor`, `api_token`, `session_cookie`, `keyring`, `cleanup()`.
-- `TestAppServerOptions` — `session_options` (required), optional `db`, `db_type`, `migration_namespaces`, `password`, `username`, `password_value`, `roles`, `audit_factory`. `migration_namespaces` runs extra namespaces after auth in the auto-created PGlite (mirrors `create_app_backend`); mutually exclusive with `db` (caller-migrated) — passing both throws. The optional `audit_factory` defaults to `default_audit_factory` (no-listener `create_audit_emitter` over the test backend's `{db, log}`); pass a custom factory to compose `on_audit_event` / `audit_log_config`, wrap with `emit_decorator` (via `create_emit_ordering_audit_factory`), or otherwise replace the emitter. Mirrors `CreateAppBackendOptions` end-to-end — the previous `on_audit_event` / `audit_log_config` sugar was removed alongside the production rename.
+- `TestAppServerOptions` — `session_options` (required), optional `db`, `db_type`, `migration_namespaces`, `password`, `username`, `password_value`, `roles`, `audit_factory`. `migration_namespaces` runs extra namespaces after auth in the auto-created PGlite (mirrors `create_app_backend`); mutually exclusive with `db` (caller-migrated) — passing both throws. The optional `audit_factory` defaults to `default_audit_factory` (no-listener `create_audit_emitter` over the test backend's `{db, log}`); pass a custom factory to compose `on_audit_event` / `audit_log_config`, instrument `emit` with `emit_decorator`, or otherwise replace the emitter. Mirrors `CreateAppBackendOptions` end-to-end — the previous `on_audit_event` / `audit_log_config` sugar was removed alongside the production rename.
 - `CreateTestAppOptions extends TestAppServerOptions` — adds `create_route_specs` (required), `rpc_endpoints?: RpcEndpointsSuiteOption` (top-level only — single source of truth, symmetric with the suite-level option), `bootstrap?: BootstrapServerOptions` (top-level only — same precedent as `rpc_endpoints`), and `app_options?: SuiteAppOptions` (`Partial<AppServerOptions>` excluding the five fields the helper manages: `backend`, `session_options`, `create_route_specs`, `rpc_endpoints`, `bootstrap`).
 - `TestAccount` — `{account, actor, session_cookie, api_token, create_session_headers, create_bearer_headers}`.
 - `TestApp` — `{app, backend, surface_spec, surface, route_specs, create_session_headers, create_bearer_headers, create_daemon_token_headers, create_account, cleanup}`.
@@ -186,6 +184,11 @@ state (no rotation, keeper already set),
 the response returns so tests can assert on side effects inline), and silent
 logger. Override via `app_options`.
 
+`auth_cleanup` is left at its default, **off**, here and in
+`create_test_app_for_bootstrap`: a background pass would delete rows and
+write audit rows mid-test. A suite that opts in through `app_options` has the
+schedule stopped by `cleanup()`, which is the assembled server's `close`.
+
 A fresh Hono app is created on every call because middleware closures bind
 to the server's deps (db, keyring). Hono assembly is cheap (~10–50ms);
 PGlite WASM caching in `db.ts` is where the real savings are.
@@ -515,13 +518,14 @@ bootstrapped keeper) based on `method.auth`; keeper uses the daemon token.
 Per SSE route: open stream with matching auth, assert the
 `SSE_CONNECTED_COMMENT` comment, fire a consumer-supplied `trigger()`,
 validate the next `data:` frame as `{method, params}` against declared
-`EventSpec`s, then (by default) fire `POST /api/account/sessions/revoke-all`
-and assert the stream closes within 2s.
+`EventSpec`s, then (by default) dispatch the `account_session_revoke_all` RPC
+method and assert the stream closes within 2s.
 
 `SseRouteTestSpec` per route: `{path, trigger, event_specs?, assert_closes_on_revoke?}`.
-Pass `on_audit_event` on the suite options to wire a close-on-revoke guard
-(e.g. via `create_sse_auth_guard`) for consumer SSE registries — without it,
-the revoke assertion hangs because the guard never fires.
+A consumer registry closes on the revoke when its route joined it to the
+backend's closer (`ctx.deps.connection_closer.add(create_sse_connection_closer(registry))`)
+or when the suite's `on_audit_event` option wires a guard (e.g. `create_sse_auth_guard`); with
+neither, the revoke assertion fails.
 
 Frame reading is delegated to the shared `create_sse_frame_reader`
 (`transports/sse_frame_reader.ts`) — `\n\n` framing, a 2s per-read timeout
@@ -539,12 +543,12 @@ skipped (the Node test runtime has no `@hono/node-ws` adapter).
 
 Three layers:
 
-1. **Primitives** — `create_fake_ws()`, `create_fake_hono_context(opts)`, `create_stub_upgrade()`, `MinimalActionEnvironment`, `dispatch_ws_message(on_message, event, ws)`.
-2. **Harness** — `create_ws_test_harness({actions, transport?, heartbeat?, log?, on_socket_open?, on_socket_close?})` → `WsTestHarness`. `connect(identity?)` is async and resolves after `on_socket_open` completes, so broadcasts sent immediately after `await harness.connect()` reach the client. The harness threads its own `create_stub_db()` into the dispatcher's `db` slot so handlers declaring `side_effects: true` execute under the same transaction wrap they would in production (the stub's `transaction(fn)` synchronously calls `fn(stub_db)`); domain deps reach handlers via factory closures, the same way HTTP RPC factories already wire them. Audit fan-out runs through whatever `audit` emitter the consumer supplied to its action factory closure (typically `create_test_audit_emitter()` for unit harnesses).
+1. **Primitives** — `create_fake_ws()`, `create_fake_hono_context(opts)`, `create_stub_upgrade()`, `MinimalActionEnvironment`, `dispatch_ws_message(on_message, event, ws)`. The fake context sets the keys the production auth middleware sets — `AUTH_SESSION_TOKEN_HASH_KEY` included, as `hash_session_token(auth_session_id)` — because the dispatcher reads the credential through `get_resolved_auth(c)`; a hand-built upgrade context must do the same.
+2. **Harness** — `create_ws_test_harness({actions, transport?, heartbeat?, log?, on_socket_open?, on_socket_close?})` → `WsTestHarness`. `connect(identity?)` is async and resolves after the connection is admitted and `on_socket_open` completes, so broadcasts sent immediately after `await harness.connect()` reach the client. The harness pre-bakes its `RequestContext` (`TEST_CONTEXT_PRESET_KEY`), which also skips the admission credential re-read — there are no session or token rows behind a harness identity — so tests of the re-read itself drive `register_action_ws` with a real database and no preset (`src/test/actions/register_action_ws.admission.db.test.ts`). The harness threads its own `create_stub_db()` into the dispatcher's `db` slot so handlers declaring `side_effects: true` execute under the same transaction wrap they would in production (the stub's `transaction(fn)` synchronously calls `fn(stub_db)`); domain deps reach handlers via factory closures, the same way HTTP RPC factories already wire them. Audit fan-out runs through whatever `audit` emitter the consumer supplied to its action factory closure (typically `create_test_audit_emitter()` for unit harnesses).
 3. **Round-trip helpers** — predicates + wire-frame types live in `transports/ws_client.ts` (shared with the cross-process `ws_transport.ts` impl): `is_notification(method)`, `is_notification_with<P>(method, match)` (type-guard combinator — narrows `wait_for` return type), `is_response_for(id)`, `JsonrpcNotificationFrame<P>` / `JsonrpcSuccessResponseFrame<R>` / `JsonrpcErrorResponseFrame<D>` (typed wire-frame shapes distinct from the runtime Zod schemas in `http/jsonrpc.ts` — generic over `params` / `result` / `data` so tests narrow without casts). `build_broadcast_api<TApi>({harness, specs})` (in `ws_round_trip.ts`) wires a typed broadcast API against the harness transport.
 
 `WsClient` (in `transports/ws_client.ts`):
-`{send, request<R>, close, messages, wait_for, wait_for_close, close_code}`.
+`{send, request<R>, close, messages, wait_for, wait_for_close, close_code, close_reason}`.
 The harness's `connect()` returns this shape; the cross-process
 `create_ws_transport` in `transports/ws_transport.ts` implements the same
 interface so assertion helpers and suite bodies work against either impl.
@@ -553,7 +557,9 @@ socket within the timeout, `false` on timeout (and `true` immediately when
 already closed) — the signal for server-initiated close (e.g. an auth-guard
 revocation), distinct from client-initiated `close()`. Mirrors the SSE frame
 reader's `wait_for_close`. `close_code` is the connection's close code once
-closed (`1006` for a drop without a close frame), `null` while open.
+closed (`1006` for a drop without a close frame), `null` while open;
+`close_reason` is the text sent with it (empty when the close carried none),
+`null` while open.
 `request` throws with code + message + data on error frames (so asserting `result.foo` on a
 failed request surfaces the real cause, not a `Cannot read property 'foo'
 of undefined`). `wait_for(predicate, timeout_ms?)` checks already-received
@@ -915,9 +921,10 @@ source of truth for wire-shape conformance.
 - `testing/cross_backend/capabilities.ts` — `BackendCapabilities` vocabulary
   (the **gating** flags `ws` / `sse` / `cell_crud` / `cell_relations` /
   `cell_gated_create` / `account_lifecycle` / `fact_serving` / `ready` /
-  `account_status` / `oversized_reject_closes_connection` / `peer_request` —
+  `account_status` / `oversized_reject_closes_connection` / `peer_request` /
+  `ws_handshake_pipelining` / `ws_account_actions` / `ws_self_revocation_reply` —
   each has a `test_if`
-  reader; `peer_request` (server-initiated requests — the ActionPeer
+  reader (`ws_self_revocation_reply` forks one case's assertion instead); `peer_request` (server-initiated requests — the ActionPeer
   `peer/ping` round-trip) is `true` for both the Rust spine and the TS spine
   (`BackendWebsocketTransport.request_connection`); `ts_default_capabilities`
   keeps it `false` like sse/ready until a backend wires the `peer/ping` HTTP +
@@ -962,6 +969,17 @@ source of truth for wire-shape conformance.
   smuggling probe (`true` Node/Deno/Rust — they close on an oversized reject;
   `false` Bun — `Bun.serve` drains + keepalives but frames correctly, so the
   suite's no-desync half still runs).
+  `ws_handshake_pipelining` gates the WS round-trip suite's
+  frames-with-the-handshake case (`true` Node/Deno/Rust — frames written in the
+  same TCP write as the upgrade request reach the socket; `false` Bun, whose
+  HTTP parser answers such a request `400`, and `false` in-process, where there
+  is no socket to write raw bytes to).
+  `ws_account_actions` gates the WS round-trip suite's self-revocation case
+  (the WS endpoint mounts the account actions — `true` on fuz_app's own spine
+  presets, `false` in the family defaults), and `ws_self_revocation_reply`
+  says what that case requires: the reply ahead of the close (`true`, the TS
+  family) or the close alone (`false`, the Rust family, whose socket loop
+  drops the response once the connection is closed — a recorded divergence).
 
 ### `cross_backend/standard.ts` — `describe_standard_cross_process_tests`
 
@@ -1084,20 +1102,32 @@ base_url, ws_path, origin?, rpc_path?, max_message_bytes?})` opens a live
 `WebSocket` via `create_ws_transport` (the `ws` npm package) and asserts
 cases against the upgrade stack `register_ws_endpoint` wires (origin →
 `require_auth` → dispatch): authed upgrade round-trips `heartbeat`,
+requests sent the moment the socket opens are all answered (both spines admit a
+connection only after re-reading its credential; frames that arrive first wait
+for that, they are not dropped) — and, gated on
+`capabilities.ws_handshake_pipelining`, the same with the ordering forced:
+frames written in the same TCP write as the upgrade request (`connect_raw_ws`)
+are all answered,
 `heartbeat` admits only the parameterless shapes (a declared param →
 `invalid_params`), a message past `max_message_bytes` (default
 `DEFAULT_WS_MAX_MESSAGE_BYTES`) closes with `WS_CLOSE_MESSAGE_TOO_BIG`,
 anonymous upgrade refused, disallowed-origin upgrade refused, and — gated on
 `rpc_path` — a live socket drops when the account's sessions are revoked
-mid-connection (`account_session_revoke_all` over the keeper session channel
-emits `session_revoke_all`, which `create_ws_auth_guard` closes on; asserted
-via `WsClient.wait_for_close`). Per-connection auth is enforced **at upgrade
+mid-connection (`account_session_revoke_all` over the keeper session channel;
+asserted via `WsClient.wait_for_close`) and when its account is deleted
+(`account_delete` by the keeper, also gated on
+`capabilities.account_lifecycle`; the close code is
+`WS_CLOSE_SESSION_REVOKED`). Per-connection auth is enforced **at upgrade
 time**, so the negative upgrade cases assert the upgrade itself rejects, not
-a per-message error; the close-on-revoke case proves the audit-fed guard is
-the revocation seam for an already-open socket, since per-message dispatch
-never re-checks credential validity. Omit `rpc_path` to skip the close case
-(consumers without the standard account actions on their RPC endpoint).
-**Consumer-agnostic** — it drives only the `heartbeat` protocol action
+a per-message error; the close cases prove a revocation closes an
+already-open socket, since per-message dispatch never re-checks credential
+validity. Omit `rpc_path` to skip the close cases (consumers without the
+standard account and admin actions on their RPC endpoint). One case is gated
+on `capabilities.ws_account_actions` (the WS endpoint mounts the account
+actions): a socket that revokes its own sessions over that socket is closed
+with `WS_CLOSE_SESSION_REVOKED`, and — where the backend declares
+`capabilities.ws_self_revocation_reply` — reads the reply first.
+Otherwise **consumer-agnostic** — it drives only the `heartbeat` protocol action
 (guaranteed on every WS endpoint by `assert_ws_endpoints_include_protocol_actions`),
 so it validates the transport without touching domain WS methods. Gated on
 `capabilities.ws`; cross-process only (needs a real bound socket — wire from
@@ -1114,7 +1144,9 @@ the seven server-initiated notifications (`received` → recipient,
 superseded sibling's grantor on **both** the accept- and revoke-cascade paths).
 `describe_role_grant_offer_notification_ws_tests({setup_test, capabilities,
 base_url, ws_path})` opens the affected counterparty's socket
-(`create_ws_transport`), drives the lifecycle RPC over `fixture.transport`, then
+(`create_admitted_ws_transport` — a targeted notification reaches only an
+admitted connection, and the handshake alone doesn't say it is one), drives the
+lifecycle RPC over `fixture.transport`, then
 strict-parses the delivered frame against its canonical params schema from
 `auth/role_grant_offer_notifications.ts` (the guard against serialization drift —
 field / null / datetime / the flat revoke shape / the supersede `reason` +
@@ -1159,6 +1191,48 @@ action (manifest-excluded), so parity is behavioral here, not via the manifest
 gate. Cross-process only; fuz_app's own wiring is
 `src/test/cross_backend/peer_ping_ws.cross.test.ts`.
 
+### `cross_backend/ws_connection_cap.ts` — `describe_ws_connection_cap_cross_tests`
+
+Real-upgrade parity for the **per-account WebSocket connection cap** — the
+evict-oldest policy both spines apply (`BackendWebsocketTransport`'s
+`max_connections_per_account`, the Rust `fuz_realtime` `ConnectionRegistry`).
+The close code, its reason, and which socket closes are wire contract — a
+client reads `WS_CLOSE_CONNECTION_LIMIT` as "superseded, don't reconnect" — so
+this is the pin that runs on both.
+`describe_ws_connection_cap_cross_tests({setup_test, capabilities, base_url,
+ws_path, origin?, max_connections_per_account?})` opens every socket with the
+fresh-per-test keeper's session cookies (one account), each answering a
+`heartbeat` before the next opens (`create_admitted_ws_transport`) so the
+backend registered them in order and
+"oldest" names the same socket on both spines. Cases: one connection past the
+cap closes exactly the oldest with `WS_CLOSE_CONNECTION_LIMIT` + reason
+`connection limit` while every other socket, the newest included, keeps
+dispatching — and the session then upgrades again (a revoked session couldn't),
+superseding the next-oldest; and a socket held open while a cap's worth of
+others open and close in sequence is never evicted (a backend that leaks closed
+connections in its registry counts them toward the cap, which is what this
+catches). `max_connections_per_account` defaults to
+`DEFAULT_MAX_CONNECTIONS_PER_ACCOUNT`, the cap both spines apply unless
+overridden; pass the consumer's value when it sets one, `null` (cap disabled)
+to skip. **Consumer-agnostic** like the WS round-trip suite (`heartbeat` only).
+A separate call rather than more cases on that suite because each case opens
+more than a cap's worth of real sockets. Gated on `capabilities.ws`;
+cross-process only. fuz_app's own wiring is
+`src/test/cross_backend/ws_connection_cap.cross.test.ts`.
+
+### `cross_backend/session_cap.ts` — `describe_session_cap_cross_tests`
+
+Parity for the per-account session cap over real HTTP: logging in past
+`max_sessions` (default `DEFAULT_MAX_SESSIONS`) never refuses a login and
+evicts the oldest session.
+`describe_session_cap_cross_tests({setup_test, max_sessions?, login_path?,
+status_path?, ws?})` — pass `ws` (`{base_url, ws_path, origin?}`) to also
+assert that the evicted session's socket is closed with
+`WS_CLOSE_SESSION_REVOKED` once the evicting login commits; omitted, that case
+is skipped, so a caller passes it only for a backend with `capabilities.ws`.
+Cross-process only. fuz_app's own wiring is
+`src/test/cross_backend/session_cap.cross.test.ts`.
+
 ### `cross_backend/sse_round_trip.ts` — `describe_cross_process_sse_tests`
 
 Cross-process counterpart to the in-process `sse_round_trip.ts` harness —
@@ -1167,23 +1241,26 @@ endpoint via `create_sse_transport` (built-in `fetch` + `TextDecoder`, no
 dep), threading the fresh-per-test keeper's session cookie. Kept a separate
 call (not folded into `describe_standard_cross_process_tests`) for the same
 reason the WS suite is — it needs raw `base_url` / `sse_path` the standard
-bundle doesn't carry. Up to three cases, mirroring the in-process audit-log
-self-test: the stream emits the `: connected` comment; a minted secondary's
-sessions are revoked over the keeper's admin channel (`admin_session_revoke_all`),
+bundle doesn't carry. The cases mirror the in-process audit-log self-test:
+the stream emits the `: connected` comment; a minted secondary's sessions are
+revoked over the keeper's admin channel (`admin_session_revoke_all`),
 broadcasting one `session_revoke_all` audit `data:` frame **without** closing
 the keeper's stream (target ≠ subscriber — secondary minted before the stream
-opens so its `create_account` audit events stay off it); and the subscriber's
-_own_ sessions are revoked (`account_session_revoke_all`) so the audit guard
-drops the live stream (asserted via `SseTransport.wait_for_close`). The
-data-frame + close cases gate on `rpc_path` (they drive the standard
-account/admin actions); all cases gate on `capabilities.sse`. Cross-process
-only — wire from a `*.cross.test.ts`. fuz*app's own wiring is
-`src/test/cross_backend/sse.cross.test.ts`; only the TS spines advertise
-`sse` (they wire `audit_log_sse`), so the Rust `spine_stub` cases `.skip`.
-That file also registers one `xfail_until` (only when `sse: false`) asserting
-the stream \_can't* open on a spine without SSE — a self-cleaning tripwire for
-the spine that should grow it, distinct from the consumer-legit capability
-skip the shared suite emits.
+opens so its `create_account` audit events stay off it); the subscriber's
+_own_ sessions are revoked, all of them (`account_session_revoke_all`, the
+account-wide close) and then just the one (`account_session_revoke`, the
+session-scoped close), each dropping the live stream (asserted via
+`SseTransport.wait_for_close`); the keeper soft-deletes a second admin whose
+stream is open (`account_delete`, also gated on
+`capabilities.account_lifecycle`), dropping it; and one stream past the per-session cap
+(`max_per_scope`, default `AUDIT_LOG_SSE_MAX_PER_SCOPE`; `null` skips) on one
+session closes the oldest and leaves the rest open. The data-frame + close
+cases gate on `rpc_path` (they drive the standard account/admin actions); all
+cases gate on `capabilities.sse`. Cross-process only — wire from a
+`*.cross.test.ts`. fuz_app's own wiring is
+`src/test/cross_backend/sse.cross.test.ts`, which runs on every backend — the
+TS spines wire `audit_log_sse` and the Rust `spine_stub` serves the same
+stream.
 
 ### `cross_backend/cell_crud.ts` + `cell_relations.ts` + `cell_gated_create.ts` — cell parity suites
 
@@ -1292,7 +1369,8 @@ are `src/test/auth/cell_crud_parity.db.test.ts`
   transport carries the keeper session cookie in its jar after this call
   resolves.
 - `testing/transports/ws_client.ts` — shared `WsClient` interface (`send` /
-  `request` / `close` / `messages` / `wait_for` / `wait_for_close` / `close_code`),
+  `request` / `close` / `messages` / `wait_for` / `wait_for_close` / `close_code` /
+  `close_reason`),
   wire-frame types, and
   predicates (`is_notification`, `is_response_for`, ...). Both in-process
   (`ws_round_trip.ts`) and cross-process (`ws_transport.ts`) impls satisfy
@@ -1309,6 +1387,20 @@ are `src/test/auth/cell_crud_parity.db.test.ts`
   Threads the keeper cookie onto the upgrade so per-action auth succeeds on
   the first message. `on_request` (attached at construction, before the upgrade
   completes) answers server-initiated requests via the shared `deliver_inbound`.
+  An open socket is not yet an *admitted* connection — both spines answer the
+  handshake, then re-read the credential, then admit, and deliver no
+  server-initiated message until then. `create_admitted_ws_transport(options)`
+  opens and round-trips `heartbeat` (response id `WS_ADMISSION_PROBE_ID`) so the
+  connection is admitted when it resolves; suites that wait for a push, or need
+  connections registered in a known order, open through it.
+- `testing/transports/ws_raw_client.ts` — `connect_raw_ws({port, hostname?, path, headers?, pipelined?})`
+  → `RawWsClient` (`{frames, send_text, wait_for, destroy}`), a WebSocket client
+  over a raw `node:net` socket for the two things a client library can't do:
+  **withhold the close frame** (it never answers one) and put frames in the
+  server's hands **with the handshake** (`pipelined` — written in the same TCP
+  write as the upgrade request, so before the connection can have been
+  admitted). Small unfragmented text frames only. Helpers `is_raw_ws_close`,
+  `raw_ws_close_code`, `RAW_WS_OPCODE_TEXT` / `_CLOSE`.
 - `testing/transports/sse_frame_reader.ts` — `create_sse_frame_reader(reader, default_timeout_ms?)`,
   the transport-agnostic SSE framing core over a
   `ReadableStreamDefaultReader<Uint8Array>`: `\n\n` framing, per-read timeout,
@@ -1658,7 +1750,7 @@ re-roll the serve / daemon-info / WS-attach / drain boilerplate:
 - `testing/cross_backend/full_spine_mount.ts` — `build_full_spine_rpc_actions(deps, options)` / `full_spine_rpc_endpoints(ctx, options)` — the **full** live RPC mount: the declared bundle **plus** the off-declared-surface families the binary live-mounts (`_testing_*` backdoors, the cell verb set, the opt-in `actor_lookup` / `actor_search` resolvers). Single-sources what was an inline assembly in `testing_spine_server.ts`, so the binary and the `spine_method_coverage` reconciliation test build the same list. Also `$lib`-free.
 - `testing/cross_backend/ts_spine_backend_config.ts` — `ts_spine_node_backend_config()` / `ts_spine_deno_backend_config()` / `ts_spine_bun_backend_config()` presets (in-memory PGlite, no external infra), the TS analog of `rust_spine_stub_backend_config()`.
 
-fuz_app's own binary wiring (`src/test/cross_backend/testing_spine_server{,_node,_deno,_bun}.ts`) is the worked example: ~one `build_app` over `create_app_backend` + `create_app_server` + `full_spine_rpc_endpoints` + a WS mount, reusing `default_spine_surface`. The `_node`/`_deno`/`_bun` entries differ only in which adapter they wire — `build_spine_app` is runtime-agnostic.
+fuz_app's own binary wiring (`src/test/cross_backend/testing_spine_server{,_node,_deno,_bun}.ts`) is the worked example: ~one `build_app` over `create_app_backend` + `create_app_server` + `full_spine_rpc_endpoints` + a WS mount, reusing `default_spine_surface`. The `_node`/`_deno`/`_bun` entries differ only in which adapter they wire — `build_spine_app` is runtime-agnostic. It leaves `create_app_server`'s `auth_cleanup` off, as the Rust `testing_spine_stub` leaves its twin unscheduled: a background pass would delete rows and write audit rows under a running suite. A consumer's cross-process test binary may schedule it when nothing its suites seed is already expired (the conformance table's `expired_session` principal seeds a backdated session row); an in-process harness leaves it off.
 
 ### Live-method coverage reconciliation — `method_coverage.ts`
 
@@ -1687,8 +1779,8 @@ no-DB reconciliation test `spine_method_coverage.test.ts`, which enumerates
 The in-process `ws_round_trip` harness stays (it drives the dispatcher
 against a fake upgrade, no wire), but the real-upgrade coverage now lives in
 the cross-process `cross_backend/ws_round_trip.ts` suite below — including
-close-on-revoke (`WsClient.wait_for_close` asserts the audit-guard drops a
-live socket on `session_revoke_all`).
+close-on-revoke (`WsClient.wait_for_close` asserts a live socket is dropped
+once `account_session_revoke_all` commits).
 
 `audit_completeness` is in-process by design (FK-structural introspection
 beyond the `audit_log_list` RPC reads — structurally in-process).

package/dist/testing/app_server.d.ts

@@ -196,7 +196,7 @@ export interface TestAppServerOptions {
      * needs:
      * - to capture audit events (compose `on_audit_event` inside the body)
      * - to register consumer event-type schemas (pass `audit_log_config`)
-     * - to instrument `emit` ordering (`create_emit_ordering_audit_factory`)
+     * - to instrument `emit` (`emit_decorator`)
      * - to wrap or replace the emitter for some other reason
      *
      * Matches the production shape — `create_app_backend` requires an
@@ -302,7 +302,7 @@ export interface TestApp {
     create_daemon_token_headers: (extra?: Record<string, string>) => Record<string, string>;
     /** Create an additional account with credentials. */
     create_account: (options?: CreateTestAppAccountArgs) => Promise<TestAccount>;
-    /** Cleanup resources (delegates to TestAppServer.cleanup). */
+    /** Cleanup resources (`AppServer.close`: stops an opted-in auth cleanup schedule, then the backend's `close`). */
     cleanup: () => Promise<void>;
 }
 /**

package/dist/testing/app_server.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"app_server.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/testing/app_server.ts"],"names":[],"mappings":"AAAA,OAAO,qBAAqB,CAAC;AAE7B;;;;;;;;;;;;;GAaG;AAEH,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAGjC,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,wBAAwB,CAAC;AAInD,OAAO,EAA4B,KAAK,OAAO,EAAE,MAAM,oBAAoB,CAAC;AAE5E,OAAO,KAAK,EAAE,EAAE,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AAC9C,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,qBAAqB,CAAC;AAU5D,OAAO,EAA+B,KAAK,cAAc,EAAE,MAAM,2BAA2B,CAAC;AAC7F,OAAO,EAAkB,KAAK,kBAAkB,EAAE,MAAM,kBAAkB,CAAC;AAE3E,OAAO,EAEN,KAAK,UAAU,EACf,KAAK,YAAY,EACjB,MAAM,0BAA0B,CAAC;AAClC,OAAO,EAEN,KAAK,gBAAgB,EACrB,KAAK,sBAAsB,EAC3B,KAAK,oBAAoB,EACzB,MAAM,yBAAyB,CAAC;AACjC,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,iCAAiC,CAAC;AACxE,OAAO,KAAK,EAAE,UAAU,EAAE,cAAc,EAAE,MAAM,oBAAoB,CAAC;AACrE,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,uBAAuB,CAAC;AAOvD,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,kBAAkB,CAAC;AAGhE;;;;;GAKG;AACH,eAAO,MAAM,kBAAkB,EAAE,gBAIhC,CAAC;AAEF,gFAAgF;AAChF,eAAO,MAAM,kBAAkB,QAAiB,CAAC;AA0CjD;;;;;GAKG;AACH,MAAM,WAAW,uCAAuC;IACvD,EAAE,EAAE,EAAE,CAAC;IACP,OAAO,EAAE,OAAO,CAAC;IACjB,eAAe,EAAE,cAAc,CAAC,MAAM,CAAC,CAAC;IACxC,QAAQ,EAAE,gBAAgB,CAAC;IAC3B,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,KAAK,CAAC,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;IACtB,+FAA+F;IAC/F,KAAK,CAAC,EAAE,MAAM,CAAC;CACf;AAED,2DAA2D;AAC3D,MAAM,MAAM,0BAA0B,GAAG,uCAAuC,CAAC;AAEjF;;;;;;;;;;;;GAYG;AACH,eAAO,MAAM,oCAAoC,GAChD,SAAS,uCAAuC,KAC9C,OAAO,CAAC;IACV,OAAO,EAAE;QAAE,EAAE,EAAE,IAAI,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAA;KAAE,CAAC;IACxC,KAAK,EAAE;QAAE,EAAE,EAAE,IAAI,CAAA;KAAE,CAAC;IACpB,SAAS,EAAE,MAAM,CAAC;IAClB,cAAc,EAAE,MAAM,CAAC;CACvB,CAqDA,CAAC;AAEF,uCAAuC;AACvC,MAAM,WAAW,sBAAsB;IACtC,EAAE,EAAE,EAAE,CAAC;IACP,OAAO,EAAE,OAAO,CAAC;IACjB,eAAe,EAAE,cAAc,CAAC,MAAM,CAAC,CAAC;IACxC,6CAA6C;IAC7C,UAAU,EAAE,MAAM,CAAC;IACnB;;;;;;;;;OASG;IACH,kBAAkB,EAAE,MAAM,CAAC;CAC3B;AAED;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,iBAAiB,GAC7B,SAAS,sBAAsB,KAC7B,OAAO,CAAC;IAAE,cAAc,EAAE,MAAM,CAAA;CAAE,CAQpC,CAAC;AAEF;;;;;;;;;;;;;;GAcG;AACH,eAAO,MAAM,qBAAqB,GACjC,SAAS,0BAA0B,KACjC,OAAO,CAAC;IACV,OAAO,EAAE;QAAE,EAAE,EAAE,IAAI,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAA;KAAE,CAAC;IACxC,KAAK,EAAE;QAAE,EAAE,EAAE,IAAI,CAAA;KAAE,CAAC;IACpB,SAAS,EAAE,MAAM,CAAC;IAClB,cAAc,EAAE,MAAM,CAAC;CACvB,CAQA,CAAC;AAEF;;GAEG;AACH,MAAM,WAAW,aAAc,SAAQ,UAAU;IAChD,gCAAgC;IAChC,OAAO,EAAE;QAAE,EAAE,EAAE,IAAI,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAA;KAAE,CAAC;IACxC,uCAAuC;IACvC,KAAK,EAAE;QAAE,EAAE,EAAE,IAAI,CAAA;KAAE,CAAC;IACpB,qCAAqC;IACrC,SAAS,EAAE,MAAM,CAAC;IAClB,mDAAmD;IACnD,cAAc,EAAE,MAAM,CAAC;IACvB,+FAA+F;IAC/F,OAAO,EAAE,OAAO,CAAC;IACjB,4EAA4E;IAC5E,OAAO,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;CAC7B;AAED;;GAEG;AACH,MAAM,WAAW,oBAAoB;IACpC,mDAAmD;IACnD,eAAe,EAAE,cAAc,CAAC,MAAM,CAAC,CAAC;IACxC,kGAAkG;IAClG,EAAE,CAAC,EAAE,EAAE,CAAC;IACR,0FAA0F;IAC1F,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB;;;;;;;;;OASG;IACH,oBAAoB,CAAC,EAAE,aAAa,CAAC,kBAAkB,CAAC,CAAC;IACzD,yHAAyH;IACzH,QAAQ,CAAC,EAAE,gBAAgB,CAAC;IAC5B,kEAAkE;IAClE,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,+EAA+E;IAC/E,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,gDAAgD;IAChD,KAAK,CAAC,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;IACtB;;;;;;;;;;;;;;OAcG;IACH,aAAa,CAAC,EAAE,YAAY,CAAC;CAC7B;AAgJD,eAAO,MAAM,sBAAsB,GAClC,SAAS,oBAAoB,KAC3B,OAAO,CAAC,aAAa,CA2BvB,CAAC;AAEF;;GAEG;AACH,MAAM,WAAW,oBAAqB,SAAQ,oBAAoB;IACjE,yEAAyE;IACzE,kBAAkB,EAAE,CAAC,OAAO,EAAE,gBAAgB,KAAK,KAAK,CAAC,SAAS,CAAC,CAAC;IACpE;;;;;;;OAOG;IACH,aAAa,CAAC,EAAE,uBAAuB,CAAC;IACxC;;;;;;;;;;;OAWG;IACH,SAAS,CAAC,EAAE,sBAAsB,CAAC;IACnC;;;;;OAKG;IACH,WAAW,CAAC,EAAE,eAAe,CAAC;CAC9B;AAED;;;;;;;GAOG;AACH,MAAM,MAAM,eAAe,GAAG,OAAO,CACpC,IAAI,CACH,gBAAgB,EAChB,SAAS,GAAG,iBAAiB,GAAG,oBAAoB,GAAG,eAAe,GAAG,WAAW,CACpF,CACD,CAAC;AAEF;;GAEG;AACH,MAAM,WAAW,WAAW;IAC3B,OAAO,EAAE;QAAE,EAAE,EAAE,IAAI,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAA;KAAE,CAAC;IACxC,KAAK,EAAE;QAAE,EAAE,EAAE,IAAI,CAAA;KAAE,CAAC;IACpB,mCAAmC;IACnC,cAAc,EAAE,MAAM,CAAC;IACvB,qCAAqC;IACrC,SAAS,EAAE,MAAM,CAAC;IAClB,gEAAgE;IAChE,sBAAsB,EAAE,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,KAAK,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACnF,8DAA8D;IAC9D,qBAAqB,EAAE,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,KAAK,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CAClF;AAED;;;;;GAKG;AACH,MAAM,WAAW,wBAAwB;IACxC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,KAAK,CAAC,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;IACtB,+FAA+F;IAC/F,KAAK,CAAC,EAAE,MAAM,CAAC;CACf;AAED;;GAEG;AACH,MAAM,WAAW,OAAO;IACvB,GAAG,EAAE,IAAI,CAAC;IACV,OAAO,EAAE,aAAa,CAAC;IACvB,YAAY,EAAE,cAAc,CAAC;IAC7B,OAAO,EAAE,UAAU,CAAC;IACpB,WAAW,EAAE,KAAK,CAAC,SAAS,CAAC,CAAC;IAC9B,kEAAkE;IAClE,sBAAsB,EAAE,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,KAAK,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACnF,gEAAgE;IAChE,qBAAqB,EAAE,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,KAAK,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAClF,iEAAiE;IACjE,2BAA2B,EAAE,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,KAAK,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACxF,qDAAqD;IACrD,cAAc,EAAE,CAAC,OAAO,CAAC,EAAE,wBAAwB,KAAK,OAAO,CAAC,WAAW,CAAC,CAAC;IAC7E,8DAA8D;IAC9D,OAAO,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;CAC7B;AAED;;;;;;;;;;;;GAYG;AACH,eAAO,MAAM,eAAe,GAAU,SAAS,oBAAoB,KAAG,OAAO,CAAC,OAAO,CAoGpF,CAAC;AAEF;;;;;;GAMG;AACH,MAAM,WAAW,gCAAgC;IAChD,eAAe,EAAE,cAAc,CAAC,MAAM,CAAC,CAAC;IACxC,kBAAkB,EAAE,CAAC,OAAO,EAAE,gBAAgB,KAAK,KAAK,CAAC,SAAS,CAAC,CAAC;IACpE,aAAa,CAAC,EAAE,uBAAuB,CAAC;IACxC,WAAW,CAAC,EAAE,eAAe,CAAC;IAC9B,8EAA8E;IAC9E,SAAS,EAAE,oBAAoB,CAAC;IAChC;;;;OAIG;IACH,eAAe,EAAE,MAAM,CAAC;IACxB,EAAE,CAAC,EAAE,EAAE,CAAC;IACR,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,QAAQ,CAAC,EAAE,gBAAgB,CAAC;IAC5B,aAAa,CAAC,EAAE,YAAY,CAAC;CAC7B;AAED;;;;GAIG;AACH,MAAM,WAAW,mBAAmB;IACnC,GAAG,EAAE,IAAI,CAAC;IACV,OAAO,EAAE,UAAU,CAAC;IACpB,YAAY,EAAE,cAAc,CAAC;IAC7B,OAAO,EAAE,UAAU,CAAC;IACpB,WAAW,EAAE,KAAK,CAAC,SAAS,CAAC,CAAC;IAC9B,0EAA0E;IAC1E,sBAAsB,EAAE,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,KAAK,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACnF,4EAA4E;IAC5E,OAAO,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;CAC7B;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,eAAO,MAAM,6BAA6B,GACzC,SAAS,gCAAgC,KACvC,OAAO,CAAC,mBAAmB,CA0E7B,CAAC"}
+{"version":3,"file":"app_server.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/testing/app_server.ts"],"names":[],"mappings":"AAAA,OAAO,qBAAqB,CAAC;AAE7B;;;;;;;;;;;;;GAaG;AAEH,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAGjC,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,wBAAwB,CAAC;AAInD,OAAO,EAA4B,KAAK,OAAO,EAAE,MAAM,oBAAoB,CAAC;AAE5E,OAAO,KAAK,EAAE,EAAE,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AAC9C,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,qBAAqB,CAAC;AAU5D,OAAO,EAA+B,KAAK,cAAc,EAAE,MAAM,2BAA2B,CAAC;AAC7F,OAAO,EAAkB,KAAK,kBAAkB,EAAE,MAAM,kBAAkB,CAAC;AAG3E,OAAO,EAEN,KAAK,UAAU,EACf,KAAK,YAAY,EACjB,MAAM,0BAA0B,CAAC;AAClC,OAAO,EAEN,KAAK,gBAAgB,EACrB,KAAK,sBAAsB,EAC3B,KAAK,oBAAoB,EACzB,MAAM,yBAAyB,CAAC;AACjC,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,iCAAiC,CAAC;AACxE,OAAO,KAAK,EAAE,UAAU,EAAE,cAAc,EAAE,MAAM,oBAAoB,CAAC;AACrE,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,uBAAuB,CAAC;AAOvD,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,kBAAkB,CAAC;AAGhE;;;;;GAKG;AACH,eAAO,MAAM,kBAAkB,EAAE,gBAIhC,CAAC;AAEF,gFAAgF;AAChF,eAAO,MAAM,kBAAkB,QAAiB,CAAC;AA0CjD;;;;;GAKG;AACH,MAAM,WAAW,uCAAuC;IACvD,EAAE,EAAE,EAAE,CAAC;IACP,OAAO,EAAE,OAAO,CAAC;IACjB,eAAe,EAAE,cAAc,CAAC,MAAM,CAAC,CAAC;IACxC,QAAQ,EAAE,gBAAgB,CAAC;IAC3B,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,KAAK,CAAC,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;IACtB,+FAA+F;IAC/F,KAAK,CAAC,EAAE,MAAM,CAAC;CACf;AAED,2DAA2D;AAC3D,MAAM,MAAM,0BAA0B,GAAG,uCAAuC,CAAC;AAEjF;;;;;;;;;;;;GAYG;AACH,eAAO,MAAM,oCAAoC,GAChD,SAAS,uCAAuC,KAC9C,OAAO,CAAC;IACV,OAAO,EAAE;QAAE,EAAE,EAAE,IAAI,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAA;KAAE,CAAC;IACxC,KAAK,EAAE;QAAE,EAAE,EAAE,IAAI,CAAA;KAAE,CAAC;IACpB,SAAS,EAAE,MAAM,CAAC;IAClB,cAAc,EAAE,MAAM,CAAC;CACvB,CAqDA,CAAC;AAEF,uCAAuC;AACvC,MAAM,WAAW,sBAAsB;IACtC,EAAE,EAAE,EAAE,CAAC;IACP,OAAO,EAAE,OAAO,CAAC;IACjB,eAAe,EAAE,cAAc,CAAC,MAAM,CAAC,CAAC;IACxC,6CAA6C;IAC7C,UAAU,EAAE,MAAM,CAAC;IACnB;;;;;;;;;OASG;IACH,kBAAkB,EAAE,MAAM,CAAC;CAC3B;AAED;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,iBAAiB,GAC7B,SAAS,sBAAsB,KAC7B,OAAO,CAAC;IAAE,cAAc,EAAE,MAAM,CAAA;CAAE,CAQpC,CAAC;AAEF;;;;;;;;;;;;;;GAcG;AACH,eAAO,MAAM,qBAAqB,GACjC,SAAS,0BAA0B,KACjC,OAAO,CAAC;IACV,OAAO,EAAE;QAAE,EAAE,EAAE,IAAI,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAA;KAAE,CAAC;IACxC,KAAK,EAAE;QAAE,EAAE,EAAE,IAAI,CAAA;KAAE,CAAC;IACpB,SAAS,EAAE,MAAM,CAAC;IAClB,cAAc,EAAE,MAAM,CAAC;CACvB,CAQA,CAAC;AAEF;;GAEG;AACH,MAAM,WAAW,aAAc,SAAQ,UAAU;IAChD,gCAAgC;IAChC,OAAO,EAAE;QAAE,EAAE,EAAE,IAAI,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAA;KAAE,CAAC;IACxC,uCAAuC;IACvC,KAAK,EAAE;QAAE,EAAE,EAAE,IAAI,CAAA;KAAE,CAAC;IACpB,qCAAqC;IACrC,SAAS,EAAE,MAAM,CAAC;IAClB,mDAAmD;IACnD,cAAc,EAAE,MAAM,CAAC;IACvB,+FAA+F;IAC/F,OAAO,EAAE,OAAO,CAAC;IACjB,4EAA4E;IAC5E,OAAO,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;CAC7B;AAED;;GAEG;AACH,MAAM,WAAW,oBAAoB;IACpC,mDAAmD;IACnD,eAAe,EAAE,cAAc,CAAC,MAAM,CAAC,CAAC;IACxC,kGAAkG;IAClG,EAAE,CAAC,EAAE,EAAE,CAAC;IACR,0FAA0F;IAC1F,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB;;;;;;;;;OASG;IACH,oBAAoB,CAAC,EAAE,aAAa,CAAC,kBAAkB,CAAC,CAAC;IACzD,yHAAyH;IACzH,QAAQ,CAAC,EAAE,gBAAgB,CAAC;IAC5B,kEAAkE;IAClE,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,+EAA+E;IAC/E,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,gDAAgD;IAChD,KAAK,CAAC,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;IACtB;;;;;;;;;;;;;;OAcG;IACH,aAAa,CAAC,EAAE,YAAY,CAAC;CAC7B;AAkJD,eAAO,MAAM,sBAAsB,GAClC,SAAS,oBAAoB,KAC3B,OAAO,CAAC,aAAa,CA2BvB,CAAC;AAEF;;GAEG;AACH,MAAM,WAAW,oBAAqB,SAAQ,oBAAoB;IACjE,yEAAyE;IACzE,kBAAkB,EAAE,CAAC,OAAO,EAAE,gBAAgB,KAAK,KAAK,CAAC,SAAS,CAAC,CAAC;IACpE;;;;;;;OAOG;IACH,aAAa,CAAC,EAAE,uBAAuB,CAAC;IACxC;;;;;;;;;;;OAWG;IACH,SAAS,CAAC,EAAE,sBAAsB,CAAC;IACnC;;;;;OAKG;IACH,WAAW,CAAC,EAAE,eAAe,CAAC;CAC9B;AAED;;;;;;;GAOG;AACH,MAAM,MAAM,eAAe,GAAG,OAAO,CACpC,IAAI,CACH,gBAAgB,EAChB,SAAS,GAAG,iBAAiB,GAAG,oBAAoB,GAAG,eAAe,GAAG,WAAW,CACpF,CACD,CAAC;AAEF;;GAEG;AACH,MAAM,WAAW,WAAW;IAC3B,OAAO,EAAE;QAAE,EAAE,EAAE,IAAI,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAA;KAAE,CAAC;IACxC,KAAK,EAAE;QAAE,EAAE,EAAE,IAAI,CAAA;KAAE,CAAC;IACpB,mCAAmC;IACnC,cAAc,EAAE,MAAM,CAAC;IACvB,qCAAqC;IACrC,SAAS,EAAE,MAAM,CAAC;IAClB,gEAAgE;IAChE,sBAAsB,EAAE,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,KAAK,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACnF,8DAA8D;IAC9D,qBAAqB,EAAE,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,KAAK,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CAClF;AAED;;;;;GAKG;AACH,MAAM,WAAW,wBAAwB;IACxC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,KAAK,CAAC,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;IACtB,+FAA+F;IAC/F,KAAK,CAAC,EAAE,MAAM,CAAC;CACf;AAED;;GAEG;AACH,MAAM,WAAW,OAAO;IACvB,GAAG,EAAE,IAAI,CAAC;IACV,OAAO,EAAE,aAAa,CAAC;IACvB,YAAY,EAAE,cAAc,CAAC;IAC7B,OAAO,EAAE,UAAU,CAAC;IACpB,WAAW,EAAE,KAAK,CAAC,SAAS,CAAC,CAAC;IAC9B,kEAAkE;IAClE,sBAAsB,EAAE,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,KAAK,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACnF,gEAAgE;IAChE,qBAAqB,EAAE,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,KAAK,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAClF,iEAAiE;IACjE,2BAA2B,EAAE,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,KAAK,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACxF,qDAAqD;IACrD,cAAc,EAAE,CAAC,OAAO,CAAC,EAAE,wBAAwB,KAAK,OAAO,CAAC,WAAW,CAAC,CAAC;IAC7E,kHAAkH;IAClH,OAAO,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;CAC7B;AAED;;;;;;;;;;;;GAYG;AACH,eAAO,MAAM,eAAe,GAAU,SAAS,oBAAoB,KAAG,OAAO,CAAC,OAAO,CAyGpF,CAAC;AAEF;;;;;;GAMG;AACH,MAAM,WAAW,gCAAgC;IAChD,eAAe,EAAE,cAAc,CAAC,MAAM,CAAC,CAAC;IACxC,kBAAkB,EAAE,CAAC,OAAO,EAAE,gBAAgB,KAAK,KAAK,CAAC,SAAS,CAAC,CAAC;IACpE,aAAa,CAAC,EAAE,uBAAuB,CAAC;IACxC,WAAW,CAAC,EAAE,eAAe,CAAC;IAC9B,8EAA8E;IAC9E,SAAS,EAAE,oBAAoB,CAAC;IAChC;;;;OAIG;IACH,eAAe,EAAE,MAAM,CAAC;IACxB,EAAE,CAAC,EAAE,EAAE,CAAC;IACR,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,QAAQ,CAAC,EAAE,gBAAgB,CAAC;IAC5B,aAAa,CAAC,EAAE,YAAY,CAAC;CAC7B;AAED;;;;GAIG;AACH,MAAM,WAAW,mBAAmB;IACnC,GAAG,EAAE,IAAI,CAAC;IACV,OAAO,EAAE,UAAU,CAAC;IACpB,YAAY,EAAE,cAAc,CAAC;IAC7B,OAAO,EAAE,UAAU,CAAC;IACpB,WAAW,EAAE,KAAK,CAAC,SAAS,CAAC,CAAC;IAC9B,0EAA0E;IAC1E,sBAAsB,EAAE,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,KAAK,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACnF,4EAA4E;IAC5E,OAAO,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;CAC7B;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,eAAO,MAAM,6BAA6B,GACzC,SAAS,gCAAgC,KACvC,OAAO,CAAC,mBAAmB,CA2E7B,CAAC"}

package/dist/testing/app_server.js

@@ -12,6 +12,7 @@ import { query_create_api_token } from '../auth/api_token_queries.js';
 import { create_session_cookie_value } from '../auth/session_cookie.js';
 import { run_migrations } from '../db/migrate.js';
 import { auth_migration_ns } from '../auth/migrations.js';
+import { create_realtime_closer } from '../actions/connection_closer.js';
 import { default_audit_factory } from '../server/app_backend.js';
 import { create_app_server } from '../server/app_server.js';
 import { generate_daemon_token, DAEMON_TOKEN_HEADER } from '../auth/daemon_token.js';
@@ -200,6 +201,7 @@ const _build_test_backend = async (options) => {
                 db: existing_db,
                 log: test_log,
                 audit,
+                connection_closer: create_realtime_closer(),
                 ...fs_stubs
             }
         };
@@ -228,6 +230,7 @@ const _build_test_backend = async (options) => {
                 db,
                 log: test_log,
                 audit,
+                connection_closer: create_realtime_closer(),
                 ...fs_stubs
             }
         };
@@ -292,6 +295,9 @@ export const create_test_app = async (options) => {
         daemon_token_state,
         rpc_endpoints: options.rpc_endpoints,
         bootstrap: options.bootstrap,
+        // `auth_cleanup` stays at its default, off: a background pass would
+        // delete rows and write audit rows mid-test. A suite that opts in
+        // through `app_options` has the schedule stopped by `cleanup`.
         ...options.app_options,
         create_route_specs: options.create_route_specs
     });
@@ -352,7 +358,9 @@ export const create_test_app = async (options) => {
         create_bearer_headers,
         create_daemon_token_headers,
         create_account,
-        cleanup: () => test_server.cleanup()
+        // the server's `close`, not the backend's: it also stops an auth cleanup
+        // schedule a suite opted into
+        cleanup: () => result.close()
     };
 };
 /**
@@ -438,6 +446,7 @@ export const create_test_app_for_bootstrap = async (options) => {
         surface: result.surface_spec.surface,
         route_specs: result.surface_spec.route_specs,
         create_request_headers,
-        cleanup: () => backend.close()
+        // `AppServer.close`, so an opted-in auth cleanup schedule stops too
+        cleanup: () => result.close()
     };
 };

package/dist/testing/audit_drift_guard.d.ts

@@ -1,7 +1,6 @@
 import './assert_dev_env.js';
-import { type AuditEmitter, type CreateAuditEmitterOptions } from '../auth/audit_emitter.js';
+import type { AuditEmitter } from '../auth/audit_emitter.js';
 import type { AuditLogInput } from '../auth/audit_log_schema.js';
-import type { AuditFactory } from '../server/app_backend.js';
 /**
  * Register per-test `beforeEach` + `afterEach` hooks that catch any audit
  * emission with a metadata shape that fails its `audit_metadata_schemas`
@@ -22,16 +21,6 @@ import type { AuditFactory } from '../server/app_backend.js';
  * the time the after-each check observes counter state.
  */
 export declare const install_audit_drift_guard: () => void;
-/**
- * Marker pushed into a shared sequence array by an emit-recording
- * `audit_factory`. Pair with `RecordedClose` from
- * `testing/connection_closer_helpers.ts` to test close-vs-emit ordering at
- * handler call sites — see `create_emit_ordering_audit_factory` below.
- */
-export interface AuditEmitMarker {
-    kind: 'emit';
-    at: number;
-}
 /**
  * Pair returned by {@link create_recording_audit_emitter} — the
  * `AuditEmitter` to inject as `deps.audit`, plus the shared `calls`
@@ -77,40 +66,4 @@ export interface RecordingAuditEmitter {
  * so the freeze isn't load-bearing here.
  */
 export declare const create_recording_audit_emitter: (calls_ref?: Array<AuditLogInput>) => RecordingAuditEmitter;
-/**
- * Build an `audit_factory` that produces a real `create_audit_emitter`
- * with its `emit` decorated to push a `{kind: 'emit', at: seq.value++}`
- * marker into a shared sequence + events array. Used by the close-vs-emit
- * ordering test to compose against a shared sequence counter (typically
- * `create_recording_closer(seq_ref)` capturing eager-close calls).
- *
- * Pass the returned factory through `create_test_app({audit_factory: …})`
- * — the test backend invokes it with its constructed `{db, log}` and
- * lands the decorated emitter on `backend.deps.audit`. Production
- * handlers dereference `deps.audit.emit` at call time, so the decorator
- * sees every subsequent handler invocation. The underlying `emit` still
- * runs — the decorator records the call, it does not suppress side
- * effects.
- *
- * **Scope — both `emit` and `emit_role_grant_target`.** The decorator
- * is captured by `emit_role_grant_target`'s closure inside
- * `create_audit_emitter` (and re-exposed as the outer `emit` slot), so
- * role-grant-shape emissions land in `events_ref` alongside bare `emit`
- * calls. `emit_pool` and `notify` are not decorated — they take
- * `AuditLogInput` / `AuditLogEvent` directly without going through
- * `emit`, so `emit_pool` writes skip capture. Close-firing handlers all reach for
- * `emit` or `emit_role_grant_target`, so the ordering test sees them
- * regardless of which entry point a future refactor picks.
- *
- * Optionally accept `extra_options` to thread `on_audit_event` /
- * `audit_log_config` into the inner emitter — useful when a test wants
- * both ordering capture and a real SSE/WS guard wired into the same
- * emitter chain.
- */
-export declare const create_emit_ordering_audit_factory: <E extends {
-    kind: string;
-    at: number;
-}>(seq_ref: {
-    value: number;
-}, events_ref: Array<AuditEmitMarker | E>, extra_options?: Omit<CreateAuditEmitterOptions, "db" | "log" | "emit_decorator">) => AuditFactory;
 //# sourceMappingURL=audit_drift_guard.d.ts.map

package/dist/testing/audit_drift_guard.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"audit_drift_guard.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/testing/audit_drift_guard.ts"],"names":[],"mappings":"AAAA,OAAO,qBAAqB,CAAC;AAU7B,OAAO,EAEN,KAAK,YAAY,EACjB,KAAK,yBAAyB,EAC9B,MAAM,0BAA0B,CAAC;AAClC,OAAO,KAAK,EAAiB,aAAa,EAAE,MAAM,6BAA6B,CAAC;AAChF,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,0BAA0B,CAAC;AAE7D;;;;;;;;;;;;;;;;;;GAkBG;AACH,eAAO,MAAM,yBAAyB,QAAO,IAiB5C,CAAC;AAEF;;;;;GAKG;AACH,MAAM,WAAW,eAAe;IAC/B,IAAI,EAAE,MAAM,CAAC;IACb,EAAE,EAAE,MAAM,CAAC;CACX;AAED;;;;;;GAMG;AACH,MAAM,WAAW,qBAAqB;IACrC,OAAO,EAAE,YAAY,CAAC;IACtB,KAAK,EAAE,KAAK,CAAC,aAAa,CAAC,CAAC;CAC5B;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AACH,eAAO,MAAM,8BAA8B,GAC1C,YAAY,KAAK,CAAC,aAAa,CAAC,KAC9B,qBA8BF,CAAC;AAEF;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AACH,eAAO,MAAM,kCAAkC,GAAI,CAAC,SAAS;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,EAAE,EAAE,MAAM,CAAA;CAAE,EACxF,SAAS;IAAE,KAAK,EAAE,MAAM,CAAA;CAAE,EAC1B,YAAY,KAAK,CAAC,eAAe,GAAG,CAAC,CAAC,EACtC,gBAAgB,IAAI,CAAC,yBAAyB,EAAE,IAAI,GAAG,KAAK,GAAG,gBAAgB,CAAC,KAC9E,YAWF,CAAC"}
+{"version":3,"file":"audit_drift_guard.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/testing/audit_drift_guard.ts"],"names":[],"mappings":"AAAA,OAAO,qBAAqB,CAAC;AAU7B,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,0BAA0B,CAAC;AAC7D,OAAO,KAAK,EAAiB,aAAa,EAAE,MAAM,6BAA6B,CAAC;AAEhF;;;;;;;;;;;;;;;;;;GAkBG;AACH,eAAO,MAAM,yBAAyB,QAAO,IAiB5C,CAAC;AAEF;;;;;;GAMG;AACH,MAAM,WAAW,qBAAqB;IACrC,OAAO,EAAE,YAAY,CAAC;IACtB,KAAK,EAAE,KAAK,CAAC,aAAa,CAAC,CAAC;CAC5B;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AACH,eAAO,MAAM,8BAA8B,GAC1C,YAAY,KAAK,CAAC,aAAa,CAAC,KAC9B,qBA8BF,CAAC"}

package/dist/testing/audit_drift_guard.js

@@ -1,7 +1,6 @@
 import './assert_dev_env.js';
 import { assert, beforeEach, afterEach } from 'vitest';
 import { get_audit_metadata_validation_failures, get_audit_unknown_event_type_failures, reset_audit_metadata_validation_failures, reset_audit_unknown_event_type_failures } from '../auth/audit_log_queries.js';
-import { create_audit_emitter } from '../auth/audit_emitter.js';
 /**
  * Register per-test `beforeEach` + `afterEach` hooks that catch any audit
  * emission with a metadata shape that fails its `audit_metadata_schemas`
@@ -95,44 +94,3 @@ export const create_recording_audit_emitter = (calls_ref) => {
     };
     return { emitter, calls };
 };
-/**
- * Build an `audit_factory` that produces a real `create_audit_emitter`
- * with its `emit` decorated to push a `{kind: 'emit', at: seq.value++}`
- * marker into a shared sequence + events array. Used by the close-vs-emit
- * ordering test to compose against a shared sequence counter (typically
- * `create_recording_closer(seq_ref)` capturing eager-close calls).
- *
- * Pass the returned factory through `create_test_app({audit_factory: …})`
- * — the test backend invokes it with its constructed `{db, log}` and
- * lands the decorated emitter on `backend.deps.audit`. Production
- * handlers dereference `deps.audit.emit` at call time, so the decorator
- * sees every subsequent handler invocation. The underlying `emit` still
- * runs — the decorator records the call, it does not suppress side
- * effects.
- *
- * **Scope — both `emit` and `emit_role_grant_target`.** The decorator
- * is captured by `emit_role_grant_target`'s closure inside
- * `create_audit_emitter` (and re-exposed as the outer `emit` slot), so
- * role-grant-shape emissions land in `events_ref` alongside bare `emit`
- * calls. `emit_pool` and `notify` are not decorated — they take
- * `AuditLogInput` / `AuditLogEvent` directly without going through
- * `emit`, so `emit_pool` writes skip capture. Close-firing handlers all reach for
- * `emit` or `emit_role_grant_target`, so the ordering test sees them
- * regardless of which entry point a future refactor picks.
- *
- * Optionally accept `extra_options` to thread `on_audit_event` /
- * `audit_log_config` into the inner emitter — useful when a test wants
- * both ordering capture and a real SSE/WS guard wired into the same
- * emitter chain.
- */
-export const create_emit_ordering_audit_factory = (seq_ref, events_ref, extra_options) => {
-    return ({ db, log }) => create_audit_emitter({
-        ...extra_options,
-        db,
-        log,
-        emit_decorator: (inner) => (ctx, input) => {
-            events_ref.push({ kind: 'emit', at: seq_ref.value++ });
-            inner(ctx, input);
-        }
-    });
-};

package/dist/testing/connection_closer_helpers.d.ts

@@ -1,15 +1,9 @@
 import './assert_dev_env.js';
 import type { ConnectionCloser } from '../actions/connection_closer.js';
-/**
- * Record of a single `ConnectionCloser` method invocation. `at` is the
- * value of a monotonically-increasing sequence counter at the time of
- * the call — pair with `create_emit_ordering_audit_factory` to record both
- * close + audit emit calls into the same sequence for ordering tests.
- */
+/** Record of a single `ConnectionCloser` method invocation. */
 export interface RecordedClose {
     method: 'session' | 'token' | 'account';
     id: string;
-    at: number;
 }
 export interface RecordingCloser {
     closer: ConnectionCloser;
@@ -17,24 +11,17 @@ export interface RecordingCloser {
 }
 /**
  * Build a `ConnectionCloser` that records every call into `calls` rather
- * than touching real transports. Each method returns 1 ("one socket
- * closed") regardless of whether a real socket exists — handlers
- * typically ignore the return value.
+ * than touching real transports. Each method returns 1 ("one connection
+ * closed") regardless of whether a real connection exists — handlers
+ * ignore the return value.
  *
- * Pass `seq_ref` to share the sequence counter with a sibling
- * `create_emit_ordering_audit_factory` so tests can pin close-vs-emit
- * ordering at the handler call site. Without `seq_ref`, the closer
- * uses a fresh internal counter — `at: N` values within a single test
- * are meaningful, but cannot be compared against audit emit ordering.
+ * To see a handler's closes, add the closer to the backend's
+ * `deps.connection_closer` (`RealtimeCloser.add`), or build the action
+ * factory's deps with it.
  */
-export declare const create_recording_closer: (seq_ref?: {
-    value: number;
-}) => RecordingCloser;
+export declare const create_recording_closer: () => RecordingCloser;
 /**
- * Pin `{method, id}` on a single recorded close call without baking in
- * the `at: N` sequence number. Use at every "did the closer fire?"
- * assertion site; the sequence number is only meaningful for dedicated
- * ordering tests (paired with `create_emit_ordering_audit_factory`).
+ * Pin `{method, id}` on a single recorded close call.
  *
  * Throws via `assert.ok` if `call` is `undefined` — index a recorded
  * `calls` array directly (`calls[0]`) and let this helper handle the