@fuzdev/fuz_app 0.133.0 → 0.135.0

package/dist/testing/cross_backend/testing_backdoor.js

@@ -4,10 +4,11 @@ import '../assert_dev_env.js';
  * actions.
  *
  * `_testing_reset` / `_testing_mint_session` / `_testing_put_fact` /
- * `_testing_schema_snapshot` / `_testing_migration_tracker` /
- * `_testing_action_manifest` are privileged test-binary actions the production
- * wire never exposes — three direct DB writes (full auth wipe, forged session
- * row, raw fact insert) plus three introspection reads (the live schema, the
+ * `_testing_flood_notifications` / `_testing_schema_snapshot` /
+ * `_testing_migration_tracker` / `_testing_action_manifest` are privileged
+ * test-binary actions the production wire never exposes — direct DB writes
+ * (full auth wipe, forged session row, raw fact insert), a flood of the
+ * caller's own connection, and introspection reads (the live schema, the
  * `schema_version` migration tracker, and the live RPC registry — the highest
  * info-leak of the set were the gate to break). Their only structural fence
  * is the **daemon-token** credential gate on
@@ -78,6 +79,9 @@ const backdoor_methods = [
     { method: '_testing_reset', params: {} },
     { method: '_testing_mint_session', params: { account_id: NIL_UUID, expires_in_seconds: -60 } },
     { method: '_testing_put_fact', params: { content: 'backdoor-probe' } },
+    // An empty burst — valid input, so it clears the 400 phase; a refused
+    // caller never reaches the handler that would queue it.
+    { method: '_testing_flood_notifications', params: { count: 0, size: 0 } },
     // The schema-dump read — `exclude_tables` is optional, so `{}` is valid
     // and clears the 400 phase like the writes above.
     { method: '_testing_schema_snapshot', params: {} },

package/dist/testing/cross_backend/testing_reset_actions.d.ts

@@ -8,10 +8,12 @@ import '../assert_dev_env.js';
  * expired-by-construction server-side session for the expiry conformance
  * cases), **`_testing_put_fact`** (seed an embedded fact for the fact-serving
  * suite), **`_testing_schema_snapshot`** (introspect the live schema for
- * cross-impl parity diffing against a Rust backend's `fuz_db` snapshot), and
+ * cross-impl parity diffing against a Rust backend's `fuz_db` snapshot),
  * **`_testing_migration_tracker`** (dump the `schema_version` tracker rows for
  * cross-impl migration-identity parity — the provenance half the snapshot gate
- * excludes by design).
+ * excludes by design), and **`_testing_flood_notifications`** (queue a burst
+ * of notifications onto the caller's own WebSocket connection, to push its
+ * outbound queue past its byte budget).
  *
  * A further daemon-token action, **`_testing_action_manifest`** (dump the live
  * RPC registry for cross-impl method-set + auth-shape parity), lives here too
@@ -291,6 +293,84 @@ export declare const testing_put_fact_action_spec: {
     readonly async: true;
     readonly description: string;
 };
+/** The wire method of each notification `_testing_flood_notifications` queues. */
+export declare const TESTING_FLOOD_NOTIFICATION_METHOD = "_testing_flood";
+/**
+ * The most notifications one `_testing_flood_notifications` call queues.
+ * Empty ones at this count are charged more than
+ * `DEFAULT_WS_OUTBOUND_QUEUE_BYTES` between them — each frame's envelope and
+ * its overhead — so a burst of tiny frames can overflow a connection on a
+ * default transport too. Same value as the Rust spine's.
+ */
+export declare const TESTING_FLOOD_MAX_COUNT = 65536;
+/** The largest `payload` one `_testing_flood_notifications` call builds, in bytes. */
+export declare const TESTING_FLOOD_MAX_SIZE: number;
+/**
+ * The most payload bytes one `_testing_flood_notifications` call builds across
+ * all its notifications — the bound on `count` × `size`. The handler
+ * serializes each notification without yielding, so the product is how long
+ * one call holds the event loop.
+ */
+export declare const TESTING_FLOOD_MAX_TOTAL_BYTES: number;
+/** The `data.reason` of the refusal `_testing_flood_notifications` gives a call over HTTP. */
+export declare const ERROR_TESTING_FLOOD_NO_CONNECTION = "no_connection";
+/**
+ * `_testing_flood_notifications` — queue a burst of notifications onto the
+ * **caller's own WebSocket connection**, all in one synchronous run, so a suite
+ * driving the server from outside can push a connection's outbound queue past
+ * its byte budget deterministically — without a second producer, and whether
+ * or not its client is reading: the connection's write pump gets no turn while
+ * the handler runs, so the burst waits at once. Past the budget the server
+ * closes the socket with `WS_CLOSE_OUTBOUND_OVERFLOW`.
+ *
+ * Each notification is
+ * `{"jsonrpc":"2.0","method":"_testing_flood","params":{"index":<i>,"payload":"<size × 'x'>"}}`
+ * with `index` counting from 0, so every frame is a little longer than `size`
+ * bytes and a client can tell which frames reached it.
+ *
+ * The result is `{queued: count}` — the number asked for, not the number that
+ * fit: when the burst overflows the queue the connection is closed and this
+ * response is never written. A burst that fits arrives in order, ahead of the
+ * response.
+ *
+ * A call past `TESTING_FLOOD_MAX_COUNT`, `TESTING_FLOOD_MAX_SIZE`, or
+ * `TESTING_FLOOD_MAX_TOTAL_BYTES` (`count` × `size`) is refused with
+ * `invalid_params` and queues nothing. Over HTTP there is no connection to
+ * queue onto, so the call is refused with `invalid_params`, reason
+ * `ERROR_TESTING_FLOOD_NO_CONNECTION`, rather than answering as though it had
+ * flooded something.
+ *
+ * `auth` gates on the daemon-token credential, matching `_testing_reset`. The
+ * Rust mirror is `fuz_testing::create_testing_flood_notifications_action_spec`.
+ */
+export declare const testing_flood_notifications_action_spec: {
+    readonly method: "_testing_flood_notifications";
+    readonly kind: "request_response";
+    readonly initiator: "frontend";
+    readonly auth: {
+        readonly account: "required";
+        readonly actor: "none";
+        readonly credential_types: readonly ["daemon_token"];
+    };
+    readonly side_effects: false;
+    readonly input: z.ZodObject<{
+        count: z.ZodNumber;
+        size: z.ZodNumber;
+    }, z.core.$strict>;
+    readonly output: z.ZodObject<{
+        queued: z.ZodNumber;
+    }, z.core.$strict>;
+    readonly async: true;
+    readonly error_reasons: readonly ["no_connection"];
+    readonly description: string;
+};
+/**
+ * Build the standalone `_testing_flood_notifications` action (see the spec
+ * doc). The spine binary bundles it via `create_testing_actions`; mount it
+ * directly on an in-process WS endpoint whose suite drives an outbound
+ * overflow.
+ */
+export declare const create_testing_flood_notifications_action: () => RpcAction;
 /**
  * `_testing_schema_snapshot` — introspect the live database into a normalized
  * `SchemaSnapshot` for cross-impl parity diffing. The cross-backend harness
@@ -482,8 +562,8 @@ export interface CreateTestingActionsOptions {
      * Consumer-supplied callback invoked after the auth-table reset, passed
      * the same transactional `Db` the auth wipes ran on. DB-domain consumers
      * (e.g. fuz_forge truncating its cell / fact / file tables) MUST use this
-     * `db` rather than a separately-pooled connection — under PGlite's single
-     * connection a second connection deadlocks against this still-open
+     * `db` rather than a separately-pooled connection — under the in-memory
+     * drivers' single connection (pglet, PGlite) a second connection deadlocks against this still-open
      * transaction. `testing_zzz_server` clears in-memory workspace registry +
      * terminals + scoped-FS scratch (ignores `db`); `testing_spine_stub` has
      * no domain layer and omits the option. Runs inside the same RPC dispatch

package/dist/testing/cross_backend/testing_reset_actions.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"testing_reset_actions.d.ts","sourceRoot":"../src/lib/","sources":["../../../src/lib/testing/cross_backend/testing_reset_actions.ts"],"names":[],"mappings":"AAAA,OAAO,sBAAsB,CAAC;AAE9B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmEG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAKxB,OAAO,EAAc,KAAK,SAAS,EAAE,MAAM,6BAA6B,CAAC;AAMzE,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,oBAAoB,CAAC;AAClD,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,6BAA6B,CAAC;AAChE,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,8BAA8B,CAAC;AACnE,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,4BAA4B,CAAC;AACnE,OAAO,KAAK,EAAE,EAAE,EAAE,MAAM,gBAAgB,CAAC;AAoCzC;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,eAAO,MAAM,yBAAyB;;;;;;;;;;;;;;;;;QAiBpC;;;;;;;;WAQG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAWyC,CAAC;AAE/C;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,eAAO,MAAM,iCAAiC;;;;;;;;;;;;;;;;CAWA,CAAC;AAE/C;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AACH,eAAO,MAAM,gCAAgC;;;;;;;;;;;;;;;;;;;CAwBC,CAAC;AAE/C;;;;;;;;GAQG;AACH,eAAO,MAAM,mCAAmC,GAAI,OAAO,YAAY,KAAG,SAIvE,CAAC;AAEJ;;;;;;;;;;;;;GAaG;AACH,eAAO,MAAM,4BAA4B;;;;;;;;;;;;;;;;;;;CAeK,CAAC;AAE/C;;;;;;;;;GASG;AACH,eAAO,MAAM,mCAAmC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAWF,CAAC;AAE/C;;;;GAIG;AACH,eAAO,MAAM,qCAAqC,QAAO,SAGvD,CAAC;AAEH;;;;;;;;;;;;;GAaG;AACH,eAAO,MAAM,qCAAqC;;;;;;;;;;;;;;;;;;;;CAYJ,CAAC;AAE/C;;;;GAIG;AACH,eAAO,MAAM,uCAAuC,QAAO,SAGzD,CAAC;AAEH;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,eAAO,MAAM,mCAAmC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAaF,CAAC;AAkB/C;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,qCAAqC,GACjD,SAAS,aAAa,CAAC,SAAS,CAAC,KAC/B,SAMF,CAAC;AAEF,4CAA4C;AAC5C,MAAM,WAAW,2BAA2B;IAC3C;;;;;OAKG;IACH,QAAQ,CAAC,eAAe,EAAE,cAAc,CAAC,MAAM,CAAC,CAAC;IACjD;;;;;;OAMG;IACH,QAAQ,CAAC,kBAAkB,EAAE,gBAAgB,CAAC;IAC9C;;;;;;;;;;;OAWG;IACH,QAAQ,CAAC,WAAW,CAAC,EAAE,CAAC,EAAE,EAAE,EAAE,KAAK,OAAO,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC;CACxD;AAED;;;;;;;;;;;;;;GAcG;AACH,eAAO,MAAM,sBAAsB,GAClC,MAAM,OAAO,EACb,SAAS,2BAA2B,KAClC,KAAK,CAAC,SAAS,CA4IjB,CAAC"}
+{"version":3,"file":"testing_reset_actions.d.ts","sourceRoot":"../src/lib/","sources":["../../../src/lib/testing/cross_backend/testing_reset_actions.ts"],"names":[],"mappings":"AAAA,OAAO,sBAAsB,CAAC;AAE9B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAqEG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAKxB,OAAO,EAAc,KAAK,SAAS,EAAE,MAAM,6BAA6B,CAAC;AAOzE,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,oBAAoB,CAAC;AAClD,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,6BAA6B,CAAC;AAChE,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,8BAA8B,CAAC;AACnE,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,4BAA4B,CAAC;AACnE,OAAO,KAAK,EAAE,EAAE,EAAE,MAAM,gBAAgB,CAAC;AAoCzC;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,eAAO,MAAM,yBAAyB;;;;;;;;;;;;;;;;;QAiBpC;;;;;;;;WAQG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAWyC,CAAC;AAE/C;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,eAAO,MAAM,iCAAiC;;;;;;;;;;;;;;;;CAWA,CAAC;AAE/C;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AACH,eAAO,MAAM,gCAAgC;;;;;;;;;;;;;;;;;;;CAwBC,CAAC;AAE/C;;;;;;;;GAQG;AACH,eAAO,MAAM,mCAAmC,GAAI,OAAO,YAAY,KAAG,SAIvE,CAAC;AAEJ;;;;;;;;;;;;;GAaG;AACH,eAAO,MAAM,4BAA4B;;;;;;;;;;;;;;;;;;;CAeK,CAAC;AAE/C,kFAAkF;AAClF,eAAO,MAAM,iCAAiC,mBAAmB,CAAC;AAElE;;;;;;GAMG;AACH,eAAO,MAAM,uBAAuB,QAAS,CAAC;AAE9C,sFAAsF;AACtF,eAAO,MAAM,sBAAsB,QAAmB,CAAC;AAEvD;;;;;GAKG;AACH,eAAO,MAAM,6BAA6B,QAAmB,CAAC;AAE9D,8FAA8F;AAC9F,eAAO,MAAM,iCAAiC,kBAAkB,CAAC;AAEjE;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AACH,eAAO,MAAM,uCAAuC;;;;;;;;;;;;;;;;;;;;CAwBN,CAAC;AAE/C;;;;;GAKG;AACH,eAAO,MAAM,yCAAyC,QAAO,SAmB1D,CAAC;AAEJ;;;;;;;;;GASG;AACH,eAAO,MAAM,mCAAmC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAWF,CAAC;AAE/C;;;;GAIG;AACH,eAAO,MAAM,qCAAqC,QAAO,SAGvD,CAAC;AAEH;;;;;;;;;;;;;GAaG;AACH,eAAO,MAAM,qCAAqC;;;;;;;;;;;;;;;;;;;;CAYJ,CAAC;AAE/C;;;;GAIG;AACH,eAAO,MAAM,uCAAuC,QAAO,SAGzD,CAAC;AAEH;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,eAAO,MAAM,mCAAmC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAaF,CAAC;AAkB/C;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,qCAAqC,GACjD,SAAS,aAAa,CAAC,SAAS,CAAC,KAC/B,SAMF,CAAC;AAEF,4CAA4C;AAC5C,MAAM,WAAW,2BAA2B;IAC3C;;;;;OAKG;IACH,QAAQ,CAAC,eAAe,EAAE,cAAc,CAAC,MAAM,CAAC,CAAC;IACjD;;;;;;OAMG;IACH,QAAQ,CAAC,kBAAkB,EAAE,gBAAgB,CAAC;IAC9C;;;;;;;;;;;OAWG;IACH,QAAQ,CAAC,WAAW,CAAC,EAAE,CAAC,EAAE,EAAE,EAAE,KAAK,OAAO,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC;CACxD;AAED;;;;;;;;;;;;;;GAcG;AACH,eAAO,MAAM,sBAAsB,GAClC,MAAM,OAAO,EACb,SAAS,2BAA2B,KAClC,KAAK,CAAC,SAAS,CA6IjB,CAAC"}

package/dist/testing/cross_backend/testing_reset_actions.js

@@ -8,10 +8,12 @@ import '../assert_dev_env.js';
  * expired-by-construction server-side session for the expiry conformance
  * cases), **`_testing_put_fact`** (seed an embedded fact for the fact-serving
  * suite), **`_testing_schema_snapshot`** (introspect the live schema for
- * cross-impl parity diffing against a Rust backend's `fuz_db` snapshot), and
+ * cross-impl parity diffing against a Rust backend's `fuz_db` snapshot),
  * **`_testing_migration_tracker`** (dump the `schema_version` tracker rows for
  * cross-impl migration-identity parity — the provenance half the snapshot gate
- * excludes by design).
+ * excludes by design), and **`_testing_flood_notifications`** (queue a burst
+ * of notifications onto the caller's own WebSocket connection, to push its
+ * outbound queue past its byte budget).
  *
  * A further daemon-token action, **`_testing_action_manifest`** (dump the live
  * RPC registry for cross-impl method-set + auth-shape parity), lives here too
@@ -72,6 +74,7 @@ import { Uuid } from '@fuzdev/fuz_util/id.ts';
 import { fact_hash_bytes } from '@fuzdev/fuz_util/fact_hash.ts';
 import { FactHashSchema } from '@fuzdev/fuz_util/hash_schemas.ts';
 import { rpc_action } from '../../actions/action_rpc.js';
+import { jsonrpc_errors } from '../../http/jsonrpc_errors.js';
 import { emit_after_commit } from '../../http/pending_effects.js';
 import { protocol_action_specs } from '../../actions/protocol.js';
 import { query_put_fact } from '../../db/fact_queries.js';
@@ -291,6 +294,101 @@ export const testing_put_fact_action_spec = {
     description: 'Test-binary only — seed an embedded fact (blake3 of the UTF-8 content) and return its hash, ' +
         'so the cross-process fact-serving suite can store bytes without a DB handle.'
 };
+/** The wire method of each notification `_testing_flood_notifications` queues. */
+export const TESTING_FLOOD_NOTIFICATION_METHOD = '_testing_flood';
+/**
+ * The most notifications one `_testing_flood_notifications` call queues.
+ * Empty ones at this count are charged more than
+ * `DEFAULT_WS_OUTBOUND_QUEUE_BYTES` between them — each frame's envelope and
+ * its overhead — so a burst of tiny frames can overflow a connection on a
+ * default transport too. Same value as the Rust spine's.
+ */
+export const TESTING_FLOOD_MAX_COUNT = 65_536;
+/** The largest `payload` one `_testing_flood_notifications` call builds, in bytes. */
+export const TESTING_FLOOD_MAX_SIZE = 16 * 1024 * 1024;
+/**
+ * The most payload bytes one `_testing_flood_notifications` call builds across
+ * all its notifications — the bound on `count` × `size`. The handler
+ * serializes each notification without yielding, so the product is how long
+ * one call holds the event loop.
+ */
+export const TESTING_FLOOD_MAX_TOTAL_BYTES = 64 * 1024 * 1024;
+/** The `data.reason` of the refusal `_testing_flood_notifications` gives a call over HTTP. */
+export const ERROR_TESTING_FLOOD_NO_CONNECTION = 'no_connection';
+/**
+ * `_testing_flood_notifications` — queue a burst of notifications onto the
+ * **caller's own WebSocket connection**, all in one synchronous run, so a suite
+ * driving the server from outside can push a connection's outbound queue past
+ * its byte budget deterministically — without a second producer, and whether
+ * or not its client is reading: the connection's write pump gets no turn while
+ * the handler runs, so the burst waits at once. Past the budget the server
+ * closes the socket with `WS_CLOSE_OUTBOUND_OVERFLOW`.
+ *
+ * Each notification is
+ * `{"jsonrpc":"2.0","method":"_testing_flood","params":{"index":<i>,"payload":"<size × 'x'>"}}`
+ * with `index` counting from 0, so every frame is a little longer than `size`
+ * bytes and a client can tell which frames reached it.
+ *
+ * The result is `{queued: count}` — the number asked for, not the number that
+ * fit: when the burst overflows the queue the connection is closed and this
+ * response is never written. A burst that fits arrives in order, ahead of the
+ * response.
+ *
+ * A call past `TESTING_FLOOD_MAX_COUNT`, `TESTING_FLOOD_MAX_SIZE`, or
+ * `TESTING_FLOOD_MAX_TOTAL_BYTES` (`count` × `size`) is refused with
+ * `invalid_params` and queues nothing. Over HTTP there is no connection to
+ * queue onto, so the call is refused with `invalid_params`, reason
+ * `ERROR_TESTING_FLOOD_NO_CONNECTION`, rather than answering as though it had
+ * flooded something.
+ *
+ * `auth` gates on the daemon-token credential, matching `_testing_reset`. The
+ * Rust mirror is `fuz_testing::create_testing_flood_notifications_action_spec`.
+ */
+export const testing_flood_notifications_action_spec = {
+    method: '_testing_flood_notifications',
+    kind: 'request_response',
+    initiator: 'frontend',
+    auth: TESTING_ACTION_AUTH,
+    side_effects: false,
+    input: z.strictObject({
+        count: z.number().int().min(0).max(TESTING_FLOOD_MAX_COUNT).meta({
+            description: 'How many notifications to queue.'
+        }),
+        size: z.number().int().min(0).max(TESTING_FLOOD_MAX_SIZE).meta({
+            description: "The byte length of each notification's `payload` string."
+        })
+    }),
+    output: z.strictObject({
+        queued: z.number().int().meta({
+            description: 'The number of notifications asked for — not the number that fit.'
+        })
+    }),
+    async: true,
+    error_reasons: [ERROR_TESTING_FLOOD_NO_CONNECTION],
+    description: "Test-binary only — queue a burst of notifications onto the caller's own WebSocket " +
+        'connection in one synchronous run, to push its outbound queue past its byte budget.'
+};
+/**
+ * Build the standalone `_testing_flood_notifications` action (see the spec
+ * doc). The spine binary bundles it via `create_testing_actions`; mount it
+ * directly on an in-process WS endpoint whose suite drives an outbound
+ * overflow.
+ */
+export const create_testing_flood_notifications_action = () => 
+// not `async`: the burst must be queued in one synchronous run
+rpc_action(testing_flood_notifications_action_spec, ({ count, size }, ctx) => {
+    if (count * size > TESTING_FLOOD_MAX_TOTAL_BYTES) {
+        throw jsonrpc_errors.invalid_params(`count * size must be at most ${TESTING_FLOOD_MAX_TOTAL_BYTES}`);
+    }
+    if (ctx.connection_id === undefined) {
+        throw jsonrpc_errors.invalid_params('_testing_flood_notifications needs a WebSocket connection', { reason: ERROR_TESTING_FLOOD_NO_CONNECTION });
+    }
+    const payload = 'x'.repeat(size);
+    for (let index = 0; index < count; index++) {
+        ctx.notify(TESTING_FLOOD_NOTIFICATION_METHOD, { index, payload });
+    }
+    return { queued: count };
+});
 /**
  * `_testing_schema_snapshot` — introspect the live database into a normalized
  * `SchemaSnapshot` for cross-impl parity diffing. The cross-backend harness
@@ -527,7 +625,7 @@ export const create_testing_actions = (deps, options) => {
             //    fuz_forge cell/fact/file truncation, or no-op for spine_stub).
             //    Pass the transactional `ctx.db` so DB-domain truncation runs
             //    on the same connection — a separate pool connection deadlocks
-            //    against this open transaction under PGlite.
+            //    against this open transaction under the in-memory drivers.
             if (reset_state)
                 await reset_state(ctx.db);
             return { ...keeper, extra_accounts: extras, extra_actors };
@@ -555,6 +653,7 @@ export const create_testing_actions = (deps, options) => {
             return { hash };
         }),
         create_testing_drain_effects_action(deps.audit),
+        create_testing_flood_notifications_action(),
         create_testing_schema_snapshot_action(),
         create_testing_migration_tracker_action()
     ];

package/dist/testing/cross_backend/ts_spine_backend_config.d.ts

@@ -7,7 +7,7 @@ import '../assert_dev_env.js';
  * these spawn fuz_app's own TS impl over real HTTP with no domain layer, so
  * the `cross_backend_ts_node` / `cross_backend_ts_deno` / `cross_backend_ts_bun`
  * self-test projects verify fuz_app's wire path in its own repo across all
- * three JS runtimes. All run against in-memory PGlite (`memory://`) — no
+ * three JS runtimes. All run against in-memory pglet (`memory://`) — no
  * external Postgres, unlike the Rust path.
  *
  * The binary writes its daemon token to `{FUZ_TESTING_TS_SPINE_DIR}/run/daemon_token`;
@@ -32,7 +32,7 @@ export declare const TS_SPINE_BUN_ENTRY = "src/test/cross_backend/testing_spine_
 export interface TsSpineBackendConfigOptions {
     /** Listening port. Defaults per runtime (`1178` Node, `1179` Deno, `1180` Bun). */
     readonly port?: number;
-    /** Database URL. Default `'memory://'` (in-memory PGlite). */
+    /** Database URL. Default `'memory://'` (in-memory pglet). */
     readonly database_url?: string;
     /**
      * Enable the per-IP + per-account login rate limiters on the spawned binary

package/dist/testing/cross_backend/ts_spine_backend_config.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"ts_spine_backend_config.d.ts","sourceRoot":"../src/lib/","sources":["../../../src/lib/testing/cross_backend/ts_spine_backend_config.ts"],"names":[],"mappings":"AAAA,OAAO,sBAAsB,CAAC;AAE9B;;;;;;;;;;;;;;;;GAgBG;AAEH,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AAsDzD,6FAA6F;AAC7F,eAAO,MAAM,0BAA0B,OAAO,CAAC;AAE/C,iDAAiD;AACjD,eAAO,MAAM,0BAA0B,OAAO,CAAC;AAE/C,gDAAgD;AAChD,eAAO,MAAM,yBAAyB,OAAO,CAAC;AAE9C,yDAAyD;AACzD,eAAO,MAAM,mBAAmB,wDAAwD,CAAC;AAEzF,yDAAyD;AACzD,eAAO,MAAM,mBAAmB,wDAAwD,CAAC;AAEzF,wDAAwD;AACxD,eAAO,MAAM,kBAAkB,uDAAuD,CAAC;AAEvF,MAAM,WAAW,2BAA2B;IAC3C,mFAAmF;IACnF,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;IACvB,8DAA8D;IAC9D,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAC;IAC/B;;;;;;;;;OASG;IACH,QAAQ,CAAC,uBAAuB,CAAC,EAAE,OAAO,CAAC;IAC3C;;;;;;OAMG;IACH,QAAQ,CAAC,wBAAwB,CAAC,EAAE,OAAO,CAAC;IAC5C;;;;;OAKG;IACH,QAAQ,CAAC,8BAA8B,CAAC,EAAE,MAAM,CAAC;CACjD;AAWD;;;GAGG;AACH,eAAO,MAAM,4BAA4B,GACxC,UAAS,2BAAgC,KACvC,aAoBF,CAAC;AAEF;;;;;;GAMG;AACH,eAAO,MAAM,2BAA2B,GACvC,UAAS,2BAAgC,KACvC,aAoBF,CAAC;AAEF;;;;;;;;;;GAUG;AACH,eAAO,MAAM,4BAA4B,GACxC,UAAS,2BAAgC,KACvC,aAiCF,CAAC"}
+{"version":3,"file":"ts_spine_backend_config.d.ts","sourceRoot":"../src/lib/","sources":["../../../src/lib/testing/cross_backend/ts_spine_backend_config.ts"],"names":[],"mappings":"AAAA,OAAO,sBAAsB,CAAC;AAE9B;;;;;;;;;;;;;;;;GAgBG;AAEH,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AAwDzD,6FAA6F;AAC7F,eAAO,MAAM,0BAA0B,OAAO,CAAC;AAE/C,iDAAiD;AACjD,eAAO,MAAM,0BAA0B,OAAO,CAAC;AAE/C,gDAAgD;AAChD,eAAO,MAAM,yBAAyB,OAAO,CAAC;AAE9C,yDAAyD;AACzD,eAAO,MAAM,mBAAmB,wDAAwD,CAAC;AAEzF,yDAAyD;AACzD,eAAO,MAAM,mBAAmB,wDAAwD,CAAC;AAEzF,wDAAwD;AACxD,eAAO,MAAM,kBAAkB,uDAAuD,CAAC;AAEvF,MAAM,WAAW,2BAA2B;IAC3C,mFAAmF;IACnF,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;IACvB,6DAA6D;IAC7D,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAC;IAC/B;;;;;;;;;OASG;IACH,QAAQ,CAAC,uBAAuB,CAAC,EAAE,OAAO,CAAC;IAC3C;;;;;;OAMG;IACH,QAAQ,CAAC,wBAAwB,CAAC,EAAE,OAAO,CAAC;IAC5C;;;;;OAKG;IACH,QAAQ,CAAC,8BAA8B,CAAC,EAAE,MAAM,CAAC;CACjD;AAWD;;;GAGG;AACH,eAAO,MAAM,4BAA4B,GACxC,UAAS,2BAAgC,KACvC,aAoBF,CAAC;AAEF;;;;;;GAMG;AACH,eAAO,MAAM,2BAA2B,GACvC,UAAS,2BAAgC,KACvC,aAoBF,CAAC;AAEF;;;;;;;;;;GAUG;AACH,eAAO,MAAM,4BAA4B,GACxC,UAAS,2BAAgC,KACvC,aAiCF,CAAC"}

package/dist/testing/cross_backend/ts_spine_backend_config.js

@@ -23,13 +23,15 @@ const ts_spine_capabilities = Object.freeze({
 /**
  * Capabilities for the **Bun** spine binary — `ts_spine_capabilities` with
  * `oversized_reject_closes_connection: false` and
- * `ws_handshake_pipelining: false`. `Bun.serve` drains the declared
- * `Content-Length` of an oversized-body `413` reject and keeps the socket
- * alive (processing the correctly-framed pipelined request) even when the
- * response carries `Connection: close`, unlike `@hono/node-server` / Deno /
- * hyper, which close. Bun is not insecure — it frames on `Content-Length`, so
- * there is no desync — but the smuggling suite's strong "connection closes"
- * assertion doesn't hold; this flag routes Bun onto the suite's no-desync arm.
+ * `ws_handshake_pipelining: false`.
+ *
+ * `Bun.serve` does not close the connection after an oversized-body `413`:
+ * the response carries `Connection: close`, and Bun keeps the socket open,
+ * skips the declared body, and serves the request that follows it (observed
+ * on Bun 1.3.11). The next request is framed on `Content-Length`, so nothing
+ * is desynchronized, but the smuggling suite's "the pipelined request is never
+ * served" assertion does not hold; the flag puts Bun on the suite's no-desync
+ * arm, which requires exactly the 413 and the reply to the pipelined request.
  * See `docs/security.md` §"Body Size Limiting".
  *
  * `Bun.serve` also answers `400` to an upgrade request that carries WebSocket

package/dist/testing/cross_backend/ws_outbound_overflow.d.ts

@@ -0,0 +1,29 @@
+import '../assert_dev_env.js';
+import { type BackendCapabilities } from './capabilities.js';
+import type { SetupTest } from './setup.js';
+/** Options for the outbound-overflow parity suite. */
+export interface WsOutboundOverflowCrossTestOptions {
+    /** Per-test fixture producer (`default_cross_process_setup(handle)`). */
+    readonly setup_test: SetupTest;
+    /** Backend capability flags; every WebSocket case gates on `capabilities.ws`. */
+    readonly capabilities: BackendCapabilities;
+    /** Base URL the backend is reachable at (e.g. `http://localhost:1178`). */
+    readonly base_url: string;
+    /** WebSocket endpoint path on the backend (e.g. `/api/ws`). */
+    readonly ws_path: string;
+    /** Origin for the session socket's upgrade. Defaults to `base_url`. */
+    readonly origin?: string;
+    /**
+     * The backend's RPC endpoint path, for the over-HTTP refusal. Omitted, that
+     * case is skipped.
+     */
+    readonly rpc_path?: string;
+}
+/**
+ * Register the outbound-overflow parity suite over a real upgrade: a burst
+ * within the budget arrives whole, one past it closes the socket with
+ * `WS_CLOSE_OUTBOUND_OVERFLOW` and no response, and the account's other
+ * connection is unaffected.
+ */
+export declare const describe_ws_outbound_overflow_cross_tests: (options: WsOutboundOverflowCrossTestOptions) => void;
+//# sourceMappingURL=ws_outbound_overflow.d.ts.map

package/dist/testing/cross_backend/ws_outbound_overflow.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"ws_outbound_overflow.d.ts","sourceRoot":"../src/lib/","sources":["../../../src/lib/testing/cross_backend/ws_outbound_overflow.ts"],"names":[],"mappings":"AAAA,OAAO,sBAAsB,CAAC;AAiE9B,OAAO,EAAE,KAAK,mBAAmB,EAAW,MAAM,mBAAmB,CAAC;AAEtE,OAAO,KAAK,EAAE,SAAS,EAAe,MAAM,YAAY,CAAC;AAiCzD,sDAAsD;AACtD,MAAM,WAAW,kCAAkC;IAClD,yEAAyE;IACzE,QAAQ,CAAC,UAAU,EAAE,SAAS,CAAC;IAC/B,iFAAiF;IACjF,QAAQ,CAAC,YAAY,EAAE,mBAAmB,CAAC;IAC3C,2EAA2E;IAC3E,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,+DAA+D;IAC/D,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,uEAAuE;IACvE,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IACzB;;;OAGG;IACH,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;CAC3B;AAED;;;;;GAKG;AACH,eAAO,MAAM,yCAAyC,GACrD,SAAS,kCAAkC,KACzC,IA0LF,CAAC"}

package/dist/testing/cross_backend/ws_outbound_overflow.js

@@ -0,0 +1,211 @@
+import '../assert_dev_env.js';
+/**
+ * Cross-backend parity suite for the **per-connection outbound bound** over a
+ * real upgrade.
+ *
+ * Both spines hold what waits to be written to one WebSocket to a byte budget
+ * (`BackendWebsocketTransport`'s `outbound_queue_bytes` on the TS side, the
+ * Rust `fuz_realtime` outbound queue on the other; both default to 4 MiB, each
+ * waiting frame charged its UTF-8 length plus 64 bytes). A frame that does not
+ * fit closes the socket with `WS_CLOSE_OUTBOUND_OVERFLOW` and the reason
+ * `outbound queue overflow`; the credential stays good, so a client reconnects
+ * under its ordinary backoff. The code and the reason are therefore wire
+ * contract, and this suite is the pin that runs on both.
+ *
+ * It drives the backend's `_testing_flood_notifications` action, which queues
+ * a burst of notifications onto the caller's own connection in one synchronous
+ * run — so the burst waits at once whether or not the client is reading, and
+ * the overflow is deterministic. The cases:
+ *
+ * - **within the budget** — a small burst arrives whole and in order, ahead of
+ *   its response, and the socket stays open.
+ * - **large, within the budget** — a burst of a few mebibytes, most of the
+ *   default budget, arrives the same way: every frame whole, in order, the
+ *   response last. Megabyte frames can outrun a socket's buffer, and where
+ *   they do — the Deno TS spine, as observed; Node and Bun write the burst
+ *   through — the frames behind the first wait on the backend's write pump.
+ * - **overflow** — a burst far past the budget closes the socket with the code
+ *   and the exact reason; the response of the flooding request never arrives;
+ *   any flood frames that did arrive form a contiguous prefix of the burst.
+ *   A second connection on the same account keeps dispatching throughout.
+ * - **refusal** — a burst past the action's own size limit is refused with
+ *   `invalid_params`, and the socket stays open.
+ * - **no connection** — over HTTP RPC the action refuses with `invalid_params`
+ *   and reason `no_connection`, rather than answering as though it flooded.
+ *
+ * What the suite does **not** assert, because it is each implementation's own:
+ * how many frames accepted before the overflow reach the client (the Rust
+ * spine discards them all; the TS spine may deliver the first), and the exact
+ * boundary a burst of tiny frames overflows at.
+ *
+ * The wire literals are deliberate independent copies of the producers'
+ * constants — parity by test, so a value changed on one side fails here
+ * instead of moving both at once.
+ *
+ * The flood action is gated on the daemon token, so the flooding socket
+ * upgrades with it and no `Origin` (both spines discard a daemon token
+ * presented in a browser context). Gated on `capabilities.ws`; cross-process
+ * only (`create_ws_transport` needs a real bound socket), and only for a
+ * backend that mounts `_testing_flood_notifications` on its WS endpoint.
+ *
+ * @module
+ */
+import { assert, describe } from 'vitest';
+import { create_jsonrpc_request } from '../../http/jsonrpc_helpers.js';
+import { create_admitted_ws_transport } from '../transports/ws_transport.js';
+import { is_notification, is_response_for } from '../transports/ws_client.js';
+import { test_if } from './capabilities.js';
+import { cross_rpc_call } from './cell_cross_helpers.js';
+/** The close code both spines send on an outbound overflow. */
+const WS_CLOSE_OUTBOUND_OVERFLOW = 4005;
+/** The close reason both spines send with it. */
+const OUTBOUND_OVERFLOW_REASON = 'outbound queue overflow';
+const FLOOD_METHOD = '_testing_flood_notifications';
+const FLOOD_NOTIFICATION_METHOD = '_testing_flood';
+const HEARTBEAT_METHOD = 'heartbeat';
+const INVALID_PARAMS = -32602;
+const REASON_NO_CONNECTION = 'no_connection';
+const MIB = 1024 * 1024;
+/** A burst within any budget. */
+const FITS = { count: 3, size: 8 };
+/**
+ * A burst of 3 MiB in megabyte frames: charged a little over 3 MiB with its
+ * envelopes and overhead, inside the 4 MiB default budget.
+ */
+const LARGE_FITS = { count: 3, size: MIB };
+/** A burst of 32 MiB — eight times the default budget. */
+const OVERFLOWS = { count: 32, size: MIB };
+/** One mebibyte past the action's `count` × `size` limit. */
+const REFUSED = { count: 65, size: MIB };
+/** How long the test waits for the megabyte burst and its response. */
+const LARGE_BURST_TIMEOUT_MS = 15_000;
+/** How long the test waits for the overflow close. */
+const CLOSE_TIMEOUT_MS = 15_000;
+/**
+ * Register the outbound-overflow parity suite over a real upgrade: a burst
+ * within the budget arrives whole, one past it closes the socket with
+ * `WS_CLOSE_OUTBOUND_OVERFLOW` and no response, and the account's other
+ * connection is unaffected.
+ */
+export const describe_ws_outbound_overflow_cross_tests = (options) => {
+    const { setup_test, capabilities, base_url, ws_path, origin, rpc_path } = options;
+    /** A daemon-token socket the backend has admitted — the one that floods itself. */
+    const open_flooder = (fixture) => create_admitted_ws_transport({
+        base_url,
+        ws_path,
+        cookies: [],
+        origin: null,
+        headers: fixture.create_daemon_token_headers()
+    });
+    /** The `index` of every flood notification `client` received, in arrival order. */
+    const flood_indices = (client) => client.messages
+        .filter(is_notification(FLOOD_NOTIFICATION_METHOD))
+        .map((msg) => msg.params.index);
+    const assert_open_and_answering = async (client, id, message) => {
+        assert.deepStrictEqual(await client.request(id, HEARTBEAT_METHOD, {}), {}, message);
+        assert.strictEqual(client.close_code, null, message);
+    };
+    describe('websocket outbound overflow parity', { timeout: 30_000 }, () => {
+        test_if(capabilities.ws, 'a burst within the budget arrives in order, ahead of its response', async () => {
+            const fixture = await setup_test();
+            const client = await open_flooder(fixture);
+            try {
+                const result = await client.request('fits', FLOOD_METHOD, FITS);
+                assert.deepStrictEqual(result, { queued: FITS.count });
+                assert.deepStrictEqual(flood_indices(client), [0, 1, 2]);
+                const frames = client.messages.filter(is_notification(FLOOD_NOTIFICATION_METHOD));
+                for (const frame of frames) {
+                    assert.strictEqual(frame.params.payload, 'x'.repeat(FITS.size));
+                }
+                // the whole burst is ahead of the response
+                const response_at = client.messages.findIndex(is_response_for('fits'));
+                const last_flood_at = client.messages.lastIndexOf(frames.at(-1));
+                assert.ok(last_flood_at < response_at, 'the burst precedes its response');
+                await assert_open_and_answering(client, 'after_fits', 'the socket stays open');
+            }
+            finally {
+                await client.close().catch(() => { });
+            }
+        });
+        test_if(capabilities.ws, 'a multi-megabyte burst within the budget arrives whole and in order, the response last', async () => {
+            const fixture = await setup_test();
+            const client = await open_flooder(fixture);
+            try {
+                const result = await client.request('large_fits', FLOOD_METHOD, LARGE_FITS, LARGE_BURST_TIMEOUT_MS);
+                assert.deepStrictEqual(result, { queued: LARGE_FITS.count });
+                assert.deepStrictEqual(flood_indices(client), [0, 1, 2]);
+                const frames = client.messages.filter(is_notification(FLOOD_NOTIFICATION_METHOD));
+                const payload = 'x'.repeat(LARGE_FITS.size);
+                for (const frame of frames) {
+                    // compared by length first: a mismatch would otherwise print a mebibyte
+                    assert.strictEqual(frame.params.payload.length, LARGE_FITS.size);
+                    assert.ok(frame.params.payload === payload, 'the payload arrived intact');
+                }
+                // nothing follows the response: the whole burst is ahead of it
+                const response_at = client.messages.findIndex(is_response_for('large_fits'));
+                const last_flood_at = client.messages.lastIndexOf(frames.at(-1));
+                assert.ok(last_flood_at < response_at, 'the burst precedes its response');
+                assert.strictEqual(client.close_code, null, 'a burst within the budget closes nothing');
+                await assert_open_and_answering(client, 'after_large_fits', 'the socket stays open');
+            }
+            finally {
+                await client.close().catch(() => { });
+            }
+        });
+        test_if(capabilities.ws, 'a burst past the budget closes the socket with WS_CLOSE_OUTBOUND_OVERFLOW and no response', async () => {
+            const fixture = await setup_test();
+            // a second connection on the same account (the keeper's session)
+            const bystander = await create_admitted_ws_transport({
+                base_url,
+                ws_path,
+                cookies: fixture.transport.cookies(),
+                origin
+            });
+            const client = await open_flooder(fixture);
+            try {
+                await client.send(create_jsonrpc_request(FLOOD_METHOD, OVERFLOWS, 'overflows'));
+                const closed = await client.wait_for_close(CLOSE_TIMEOUT_MS);
+                assert.ok(closed, 'the flooded socket did not close');
+                assert.strictEqual(client.close_code, WS_CLOSE_OUTBOUND_OVERFLOW);
+                assert.strictEqual(client.close_reason, OUTBOUND_OVERFLOW_REASON);
+                // the response of the request whose handler overflowed is not sent
+                assert.strictEqual(client.messages.some(is_response_for('overflows')), false, 'no response may follow an overflow');
+                // frames accepted before the overflow may or may not arrive; any
+                // that do are a contiguous prefix of the burst, and never all of it
+                const indices = flood_indices(client);
+                assert.ok(indices.length < OVERFLOWS.count, `${indices.length} flood frames arrived`);
+                assert.deepStrictEqual(indices, indices.map((_, i) => i), 'the flood frames that arrived are a contiguous prefix from index 0');
+                // the account's other connection kept working through it
+                await assert_open_and_answering(bystander, 'bystander', "another connection on the account is untouched by the first one's overflow");
+                // not a revocation: the daemon token still upgrades
+                const again = await open_flooder(fixture);
+                await again.close();
+            }
+            finally {
+                await Promise.all([client.close().catch(() => { }), bystander.close().catch(() => { })]);
+            }
+        });
+        test_if(capabilities.ws, 'a burst past the flood action size limit is refused, and the socket stays open', async () => {
+            const fixture = await setup_test();
+            const client = await open_flooder(fixture);
+            try {
+                await client.send(create_jsonrpc_request(FLOOD_METHOD, REFUSED, 'refused'));
+                const frame = await client.wait_for(is_response_for('refused'));
+                assert.ok(frame.error, 'expected invalid_params but the call succeeded');
+                assert.strictEqual(frame.error.code, INVALID_PARAMS);
+                assert.deepStrictEqual(flood_indices(client), [], 'a refused burst queues nothing');
+                await assert_open_and_answering(client, 'after_refused', 'the socket stays open');
+            }
+            finally {
+                await client.close().catch(() => { });
+            }
+        });
+        test_if(rpc_path !== undefined, 'over HTTP the flood action refuses with invalid_params, reason no_connection', async () => {
+            const fixture = await setup_test();
+            const res = await cross_rpc_call(fixture.fresh_transport({ origin: null }), rpc_path, FLOOD_METHOD, FITS, fixture.create_daemon_token_headers());
+            assert.strictEqual(res.ok, false, 'expected a refusal over HTTP');
+            assert.strictEqual(res.error?.code, INVALID_PARAMS);
+            assert.strictEqual(res.error?.data?.reason, REASON_NO_CONNECTION);
+        });
+    });
+};