@fuzdev/fuz_app 0.147.0 → 0.149.0

package/dist/testing/cross_backend/testing_reset_actions.d.ts

@@ -29,13 +29,16 @@ import '../assert_dev_env.js';
  *
  * `_testing_reset` — full DB wipe + keeper re-seed + optional
  * secondary-account seeding. The
- * handler wipes every auth-namespace row (no keeper-preserve filter),
+ * handler first fires the consumer-supplied domain-state callback (domain
+ * rows depend on auth rows, so a domain table with a restricting FK to
+ * `actor` empties before the rows it references go), then wipes every
+ * auth-namespace row (no keeper-preserve filter),
  * flips `bootstrap_lock` back to its post-bootstrap shape, seeds a
  * fresh keeper account inline (reusing `create_test_account_with_credentials`
- * so cross-process matches in-process write semantics), seeds any
- * caller-requested `extra_accounts` (also direct-inserted at this
- * setup step), refreshes the daemon-token cache to point at the new
- * keeper, and fires the consumer-supplied domain-state callback. The
+ * so cross-process matches in-process write semantics), queues the
+ * daemon-token cache refresh to point at the new keeper once the reset
+ * commits, and seeds any caller-requested `extra_accounts` (also
+ * direct-inserted at this setup step). The
  * new keeper + secondary credentials return as the action output so
  * the per-test fixture closes over them.
  *
@@ -177,6 +180,11 @@ export declare const testing_reset_action_spec: {
  * not — nor are eager writes outside `emit` (session touch, token usage),
  * which only the dispatching transport's own flush awaits.
  *
+ * The output's `tracked` is `AuditEmitter.is_tracking_inflight` — whether the
+ * drain could wait on anything. `cross_drain_effects` refuses `tracked: false`,
+ * so a binary whose emitter was built without tracking fails its first audit
+ * read instead of racing it. The Rust twin answers the same shape.
+ *
  * `auth` gates on the daemon-token credential, matching `_testing_reset`.
  */
 export declare const testing_drain_effects_action_spec: {
@@ -192,6 +200,7 @@ export declare const testing_drain_effects_action_spec: {
     readonly input: z.ZodVoid;
     readonly output: z.ZodObject<{
         ok: z.ZodBoolean;
+        tracked: z.ZodBoolean;
     }, z.core.$strict>;
     readonly async: true;
     readonly description: "Test-binary only — await in-flight fire-and-forget audit writes so a following audit_log_list read is authoritative.";
@@ -251,7 +260,8 @@ export declare const testing_mint_session_action_spec: {
  * emitter the backend's handlers emit through (`deps.audit`), built with
  * `track_inflight: true` (see the spec doc). Mount it on any test endpoint
  * whose suite asserts on audit rows (the spine binary bundles it via
- * `create_testing_actions`; in-process suites mount it directly).
+ * `create_testing_actions`; in-process suites mount it directly). Answers
+ * `{ok: true, tracked}`, `tracked` read from `audit.is_tracking_inflight()`.
  *
  * @param audit - the backend's emitter, whose in-flight writes the action awaits
  */
@@ -626,16 +636,22 @@ export interface CreateTestingActionsOptions {
      */
     readonly daemon_token_state: DaemonTokenState;
     /**
-     * Consumer-supplied callback invoked after the auth-table reset, passed
-     * the same transactional `Db` the auth wipes ran on. DB-domain consumers
+     * Consumer-supplied callback invoked first, before the auth-table wipe and
+     * keeper re-seed, passed the same transactional `Db` the auth wipes then
+     * run on. It runs while the previous test's accounts and actors still
+     * exist, so a domain table with a restricting FK to `actor` / `account`
+     * empties before the auth wipe deletes what it references; it must not
+     * depend on the fresh keeper, which doesn't exist yet. DB-domain consumers
      * (e.g. fuz_forge truncating its cell / fact / file tables) MUST use this
      * `db` rather than a separately-pooled connection — under the in-memory
-     * drivers' single connection (pglet, PGlite) a second connection deadlocks against this still-open
-     * transaction. `testing_zzz_server` clears in-memory workspace registry +
-     * terminals + scoped-FS scratch (ignores `db`); `testing_spine_stub` has
-     * no domain layer and omits the option. Runs inside the same RPC dispatch
-     * as the auth-table writes, so a throw surfaces to the caller as a
-     * JSON-RPC error and the per-test fixture short-circuits.
+     * drivers' single connection (pglet, PGlite) a second connection deadlocks
+     * against this still-open transaction. `testing_zzz_server` clears
+     * in-memory workspace registry + terminals + scoped-FS scratch (ignores
+     * `db`); the spine binaries (`testing/cross_backend/full_spine_mount.ts` and
+     * the Rust `testing_spine_stub`) empty the cell and fact tables. Runs inside
+     * the same RPC dispatch as the auth-table writes, so a throw rolls the whole
+     * reset back and surfaces to the caller as a JSON-RPC error and the per-test
+     * fixture short-circuits.
      */
     readonly reset_state?: (db: Db) => Promise<void> | void;
 }

package/dist/testing/cross_backend/testing_reset_actions.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"testing_reset_actions.d.ts","sourceRoot":"../src/lib/","sources":["../../../src/lib/testing/cross_backend/testing_reset_actions.ts"],"names":[],"mappings":"AAAA,OAAO,sBAAsB,CAAC;AAE9B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2EG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAIxB,OAAO,EAAc,KAAK,SAAS,EAAE,MAAM,6BAA6B,CAAC;AAOzE,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,oBAAoB,CAAC;AAClD,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,6BAA6B,CAAC;AAChE,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,8BAA8B,CAAC;AACnE,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,4BAA4B,CAAC;AACnE,OAAO,KAAK,EAAE,EAAE,EAAE,MAAM,gBAAgB,CAAC;AAsBzC;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,eAAO,MAAM,yBAAyB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAoCQ,CAAC;AAE/C;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,eAAO,MAAM,iCAAiC;;;;;;;;;;;;;;;;CAWA,CAAC;AAE/C;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AACH,eAAO,MAAM,gCAAgC;;;;;;;;;;;;;;;;;;;CAwBC,CAAC;AAE/C;;;;;;;;GAQG;AACH,eAAO,MAAM,mCAAmC,GAAI,OAAO,YAAY,KAAG,SAIvE,CAAC;AAEJ;;;;;;;;;;;;;;;;;;;GAmBG;AACH,eAAO,MAAM,4BAA4B;;;;;;;;;;;;;;;;;;;;;CAkBK,CAAC;AAE/C,kFAAkF;AAClF,eAAO,MAAM,iCAAiC,mBAAmB,CAAC;AAElE;;;;;;GAMG;AACH,eAAO,MAAM,uBAAuB,QAAS,CAAC;AAE9C,sFAAsF;AACtF,eAAO,MAAM,sBAAsB,QAAmB,CAAC;AAEvD;;;;;GAKG;AACH,eAAO,MAAM,6BAA6B,QAAmB,CAAC;AAE9D,8FAA8F;AAC9F,eAAO,MAAM,iCAAiC,kBAAkB,CAAC;AAEjE;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AACH,eAAO,MAAM,uCAAuC;;;;;;;;;;;;;;;;;;;;CAwBN,CAAC;AAE/C;;;;;GAKG;AACH,eAAO,MAAM,yCAAyC,QAAO,SAmB1D,CAAC;AAEJ;;;;;;;;;;;;;;GAcG;AACH,eAAO,MAAM,mCAAmC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAWF,CAAC;AAE/C;;;;GAIG;AACH,eAAO,MAAM,qCAAqC,QAAO,SAGvD,CAAC;AAEH;;;;;;;;;;;;;GAaG;AACH,eAAO,MAAM,qCAAqC;;;;;;;;;;;;;;;;;;;;CAYJ,CAAC;AAE/C;;;;GAIG;AACH,eAAO,MAAM,uCAAuC,QAAO,SAGzD,CAAC;AAEH,0FAA0F;AAC1F,eAAO,MAAM,6CAA6C,IAAI,CAAC;AAE/D;;;;GAIG;AACH,eAAO,MAAM,6CAA6C,KAAK,CAAC;AAShE;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,eAAO,MAAM,6CAA6C;;;;;;;;;;;;;;;;;;;;CA2BZ,CAAC;AAE/C,2FAA2F;AAC3F,eAAO,MAAM,+CAA+C,QAAO,SAYhE,CAAC;AAEJ;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,eAAO,MAAM,mCAAmC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAaF,CAAC;AAkB/C;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,qCAAqC,GACjD,SAAS,aAAa,CAAC,SAAS,CAAC,KAC/B,SAMF,CAAC;AAEF,4CAA4C;AAC5C,MAAM,WAAW,2BAA2B;IAC3C;;;;;OAKG;IACH,QAAQ,CAAC,eAAe,EAAE,cAAc,CAAC,MAAM,CAAC,CAAC;IACjD;;;;;;OAMG;IACH,QAAQ,CAAC,kBAAkB,EAAE,gBAAgB,CAAC;IAC9C;;;;;;;;;;;OAWG;IACH,QAAQ,CAAC,WAAW,CAAC,EAAE,CAAC,EAAE,EAAE,EAAE,KAAK,OAAO,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC;CACxD;AAED;;;;;;;;;;;;;;GAcG;AACH,eAAO,MAAM,sBAAsB,GAClC,MAAM,OAAO,EACb,SAAS,2BAA2B,KAClC,KAAK,CAAC,SAAS,CAkJjB,CAAC"}
+{"version":3,"file":"testing_reset_actions.d.ts","sourceRoot":"../src/lib/","sources":["../../../src/lib/testing/cross_backend/testing_reset_actions.ts"],"names":[],"mappings":"AAAA,OAAO,sBAAsB,CAAC;AAE9B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8EG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAIxB,OAAO,EAAc,KAAK,SAAS,EAAE,MAAM,6BAA6B,CAAC;AAOzE,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,oBAAoB,CAAC;AAClD,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,6BAA6B,CAAC;AAChE,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,8BAA8B,CAAC;AACnE,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,4BAA4B,CAAC;AACnE,OAAO,KAAK,EAAE,EAAE,EAAE,MAAM,gBAAgB,CAAC;AAsBzC;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,eAAO,MAAM,yBAAyB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAoCQ,CAAC;AAE/C;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AACH,eAAO,MAAM,iCAAiC;;;;;;;;;;;;;;;;;CAkBA,CAAC;AAE/C;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AACH,eAAO,MAAM,gCAAgC;;;;;;;;;;;;;;;;;;;CAwBC,CAAC;AAE/C;;;;;;;;;GASG;AACH,eAAO,MAAM,mCAAmC,GAAI,OAAO,YAAY,KAAG,SAIvE,CAAC;AAEJ;;;;;;;;;;;;;;;;;;;GAmBG;AACH,eAAO,MAAM,4BAA4B;;;;;;;;;;;;;;;;;;;;;CAkBK,CAAC;AAE/C,kFAAkF;AAClF,eAAO,MAAM,iCAAiC,mBAAmB,CAAC;AAElE;;;;;;GAMG;AACH,eAAO,MAAM,uBAAuB,QAAS,CAAC;AAE9C,sFAAsF;AACtF,eAAO,MAAM,sBAAsB,QAAmB,CAAC;AAEvD;;;;;GAKG;AACH,eAAO,MAAM,6BAA6B,QAAmB,CAAC;AAE9D,8FAA8F;AAC9F,eAAO,MAAM,iCAAiC,kBAAkB,CAAC;AAEjE;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AACH,eAAO,MAAM,uCAAuC;;;;;;;;;;;;;;;;;;;;CAwBN,CAAC;AAE/C;;;;;GAKG;AACH,eAAO,MAAM,yCAAyC,QAAO,SAmB1D,CAAC;AAEJ;;;;;;;;;;;;;;GAcG;AACH,eAAO,MAAM,mCAAmC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAWF,CAAC;AAE/C;;;;GAIG;AACH,eAAO,MAAM,qCAAqC,QAAO,SAGvD,CAAC;AAEH;;;;;;;;;;;;;GAaG;AACH,eAAO,MAAM,qCAAqC;;;;;;;;;;;;;;;;;;;;CAYJ,CAAC;AAE/C;;;;GAIG;AACH,eAAO,MAAM,uCAAuC,QAAO,SAGzD,CAAC;AAEH,0FAA0F;AAC1F,eAAO,MAAM,6CAA6C,IAAI,CAAC;AAE/D;;;;GAIG;AACH,eAAO,MAAM,6CAA6C,KAAK,CAAC;AAShE;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,eAAO,MAAM,6CAA6C;;;;;;;;;;;;;;;;;;;;CA2BZ,CAAC;AAE/C,2FAA2F;AAC3F,eAAO,MAAM,+CAA+C,QAAO,SAYhE,CAAC;AAEJ;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,eAAO,MAAM,mCAAmC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAaF,CAAC;AAkB/C;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,qCAAqC,GACjD,SAAS,aAAa,CAAC,SAAS,CAAC,KAC/B,SAMF,CAAC;AAEF,4CAA4C;AAC5C,MAAM,WAAW,2BAA2B;IAC3C;;;;;OAKG;IACH,QAAQ,CAAC,eAAe,EAAE,cAAc,CAAC,MAAM,CAAC,CAAC;IACjD;;;;;;OAMG;IACH,QAAQ,CAAC,kBAAkB,EAAE,gBAAgB,CAAC;IAC9C;;;;;;;;;;;;;;;;;OAiBG;IACH,QAAQ,CAAC,WAAW,CAAC,EAAE,CAAC,EAAE,EAAE,EAAE,KAAK,OAAO,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC;CACxD;AAED;;;;;;;;;;;;;;GAcG;AACH,eAAO,MAAM,sBAAsB,GAClC,MAAM,OAAO,EACb,SAAS,2BAA2B,KAClC,KAAK,CAAC,SAAS,CAwJjB,CAAC"}

package/dist/testing/cross_backend/testing_reset_actions.js

@@ -29,13 +29,16 @@ import '../assert_dev_env.js';
  *
  * `_testing_reset` — full DB wipe + keeper re-seed + optional
  * secondary-account seeding. The
- * handler wipes every auth-namespace row (no keeper-preserve filter),
+ * handler first fires the consumer-supplied domain-state callback (domain
+ * rows depend on auth rows, so a domain table with a restricting FK to
+ * `actor` empties before the rows it references go), then wipes every
+ * auth-namespace row (no keeper-preserve filter),
  * flips `bootstrap_lock` back to its post-bootstrap shape, seeds a
  * fresh keeper account inline (reusing `create_test_account_with_credentials`
- * so cross-process matches in-process write semantics), seeds any
- * caller-requested `extra_accounts` (also direct-inserted at this
- * setup step), refreshes the daemon-token cache to point at the new
- * keeper, and fires the consumer-supplied domain-state callback. The
+ * so cross-process matches in-process write semantics), queues the
+ * daemon-token cache refresh to point at the new keeper once the reset
+ * commits, and seeds any caller-requested `extra_accounts` (also
+ * direct-inserted at this setup step). The
  * new keeper + secondary credentials return as the action output so
  * the per-test fixture closes over them.
  *
@@ -87,7 +90,7 @@ import { query_put_fact_holder } from '../../db/fact_holder_queries.js';
 import { ROLE_ADMIN, ROLE_KEEPER } from '../../auth/role_schema.js';
 import { query_schema_snapshot, SchemaSnapshot, query_migration_tracker, MigrationTracker } from '../schema_introspect.js';
 import { ActionManifest, build_action_manifest } from './action_manifest.js';
-import { query_create_actor } from '../../auth/account_queries.js';
+import { create_test_extra_actor } from '../db_entities.js';
 import { create_test_account_with_credentials, mint_test_session } from '../app_server.js';
 import { DEFAULT_TEST_PASSWORD } from '../test_credentials.js';
 import { TESTING_ACTION_AUTH } from './spine_surface_constants.js';
@@ -179,6 +182,11 @@ export const testing_reset_action_spec = {
  * not — nor are eager writes outside `emit` (session touch, token usage),
  * which only the dispatching transport's own flush awaits.
  *
+ * The output's `tracked` is `AuditEmitter.is_tracking_inflight` — whether the
+ * drain could wait on anything. `cross_drain_effects` refuses `tracked: false`,
+ * so a binary whose emitter was built without tracking fails its first audit
+ * read instead of racing it. The Rust twin answers the same shape.
+ *
  * `auth` gates on the daemon-token credential, matching `_testing_reset`.
  */
 export const testing_drain_effects_action_spec = {
@@ -188,7 +196,13 @@ export const testing_drain_effects_action_spec = {
     auth: TESTING_ACTION_AUTH,
     side_effects: false,
     input: z.void(),
-    output: z.strictObject({ ok: z.boolean() }),
+    output: z.strictObject({
+        ok: z.boolean(),
+        tracked: z.boolean().meta({
+            description: "Whether the backend's audit emitter tracks in-flight writes — false means the drain " +
+                'waited on nothing and is no barrier.'
+        })
+    }),
     async: true,
     description: 'Test-binary only — await in-flight fire-and-forget audit writes so a following audit_log_list read is authoritative.'
 };
@@ -250,13 +264,14 @@ export const testing_mint_session_action_spec = {
  * emitter the backend's handlers emit through (`deps.audit`), built with
  * `track_inflight: true` (see the spec doc). Mount it on any test endpoint
  * whose suite asserts on audit rows (the spine binary bundles it via
- * `create_testing_actions`; in-process suites mount it directly).
+ * `create_testing_actions`; in-process suites mount it directly). Answers
+ * `{ok: true, tracked}`, `tracked` read from `audit.is_tracking_inflight()`.
  *
  * @param audit - the backend's emitter, whose in-flight writes the action awaits
  */
 export const create_testing_drain_effects_action = (audit) => rpc_action(testing_drain_effects_action_spec, async () => {
     await audit.drain_inflight();
-    return { ok: true };
+    return { ok: true, tracked: audit.is_tracking_inflight() };
 });
 /**
  * `_testing_put_fact` — seed an **embedded** fact (`fact.bytes`) for the
@@ -613,8 +628,18 @@ export const create_testing_actions = (deps, options) => {
     const log = deps.log;
     return [
         rpc_action(testing_reset_action_spec, async (input, ctx) => {
-            log.info('[_testing_reset] resetting auth state + re-seeding keeper');
-            // 1. Wipe every auth-namespace row. No keeper-preserve filter —
+            log.info('[_testing_reset] resetting domain + auth state + re-seeding keeper');
+            // 1. Fire domain-state reset (zzz workspaces/terminals/scratch,
+            //    fuz_forge cell/fact/file truncation, the spine binaries' cell +
+            //    fact wipe) first: domain rows depend on auth rows, so a domain
+            //    table with a restricting FK to `actor` would make the auth wipe
+            //    below fail once it holds a row.
+            //    Pass the transactional `ctx.db` so DB-domain truncation runs
+            //    on the same connection — a separate pool connection deadlocks
+            //    against this open transaction under the in-memory drivers.
+            if (reset_state)
+                await reset_state(ctx.db);
+            // 2. Wipe every auth-namespace row. No keeper-preserve filter —
             //    the fresh-keeper-per-test contract means mutation-cascade
             //    tests (password change, revoke-all) and hardcoded-username
             //    signup-uniqueness tests can't leak between cases.
@@ -631,13 +656,13 @@ export const create_testing_actions = (deps, options) => {
             await ctx.db.query('DELETE FROM role_grant');
             await ctx.db.query('DELETE FROM actor');
             await ctx.db.query('DELETE FROM account');
-            // 2. Reset singleton `app_settings` to production defaults
+            // 3. Reset singleton `app_settings` to production defaults
             //    (matches in-process `_build_test_backend` behavior in
             //    `app_server.ts`). Tests that flipped `open_signup` mid-run
             //    revert.
             await ctx.db.query('UPDATE app_settings SET open_signup = false, updated_at = NULL, updated_by = NULL ' +
                 'WHERE open_signup = true OR updated_at IS NOT NULL');
-            // 3. Flip `bootstrap_lock` to its post-bootstrap shape. Production
+            // 4. Flip `bootstrap_lock` to its post-bootstrap shape. Production
             //    `bootstrap_account` flips this to `true` on success; the
             //    in-process `bootstrap_test_keeper` mirrors the flip. We're
             //    about to seed the keeper here, so the final state needs to
@@ -645,7 +670,7 @@ export const create_testing_actions = (deps, options) => {
             //    to `false` — nothing reads it between our DELETEs and the
             //    UPDATE.
             await ctx.db.query('UPDATE bootstrap_lock SET bootstrapped = true WHERE id = 1');
-            // 4. Seed the fresh keeper inline. Reuses the same primitive
+            // 5. Seed the fresh keeper inline. Reuses the same primitive
             //    in-process tests use (`create_test_account_with_credentials`)
             //    so cross-process and in-process write semantics stay in
             //    parity — same hash, same account+actor+role_grants+
@@ -662,7 +687,19 @@ export const create_testing_actions = (deps, options) => {
                 password_value: DEFAULT_TEST_PASSWORD,
                 roles: [ROLE_KEEPER, ROLE_ADMIN, ...(input.extra_keeper_roles ?? [])]
             });
-            // 5. Seed any caller-requested extras. These are bootstrap-time
+            // 6. Refresh the daemon-token cache so subsequent daemon-token
+            //    requests resolve to the freshly seeded keeper. The
+            //    middleware's lazy-refresh path only fires when the cached
+            //    id is null, so the reset sets it — after the commit, queued as
+            //    soon as the keeper exists, so a reset that rolls back after it
+            //    (a failing extra seed, a failed COMMIT) leaves the cache on the
+            //    keeper still in the database rather than one that never
+            //    landed, and the next reset can still authenticate.
+            const keeper_account_id = keeper.account.id;
+            emit_after_commit(ctx, () => {
+                daemon_token_state.keeper_account_id = keeper_account_id;
+            });
+            // 7. Seed any caller-requested extras. These are bootstrap-time
             //    secondaries — the bypass exists in the same cradle the
             //    keeper does, not as a free-form runtime action.
             const extras = [];
@@ -678,35 +715,19 @@ export const create_testing_actions = (deps, options) => {
                 });
                 extras.push(seeded);
             }
-            // 5b. Seed any additional keeper actors. Same bootstrap-cradle
+            // 8. Seed any additional keeper actors. Same bootstrap-cradle
             //    bypass as extra_accounts — no production wire path mints a
             //    second actor, so the multi-actor `acting` branches need this
             //    direct insert. Order-preserving so the fixture can address
-            //    them positionally.
+            //    them positionally, and seeded at the wall clock so they sort
+            //    after the keeper's bootstrap actor in insert order
+            //    (`create_test_extra_actor`), as on the Rust spine
+            //    (`query_create_actor_with_clock_timestamp`).
             const extra_actors = [];
             for (const name of input.extra_actors ?? []) {
-                const seeded_actor = await query_create_actor({ db: ctx.db }, keeper.account.id, name);
+                const seeded_actor = await create_test_extra_actor(ctx.db, keeper.account.id, name);
                 extra_actors.push({ id: seeded_actor.id, name: seeded_actor.name });
             }
-            // 6. Refresh the daemon-token cache so subsequent daemon-token
-            //    requests resolve to the freshly seeded keeper. The
-            //    middleware's lazy-refresh path only fires when the cached
-            //    id is null, so the reset sets it — after the commit, so a
-            //    reset that rolls back (a throwing `reset_state`, a failed
-            //    COMMIT) leaves the cache on the keeper still in the database
-            //    rather than one that never landed, and the next reset can
-            //    still authenticate.
-            const keeper_account_id = keeper.account.id;
-            emit_after_commit(ctx, () => {
-                daemon_token_state.keeper_account_id = keeper_account_id;
-            });
-            // 7. Fire domain-state reset (zzz workspaces/terminals/scratch,
-            //    fuz_forge cell/fact/file truncation, or no-op for spine_stub).
-            //    Pass the transactional `ctx.db` so DB-domain truncation runs
-            //    on the same connection — a separate pool connection deadlocks
-            //    against this open transaction under the in-memory drivers.
-            if (reset_state)
-                await reset_state(ctx.db);
             return { ...keeper, extra_accounts: extras, extra_actors };
         }),
         rpc_action(testing_mint_session_action_spec, async (input, ctx) => {

package/dist/testing/cross_backend/testing_server_bun.js

@@ -72,7 +72,7 @@ export const create_bun_testing_adapter = () => {
                 // hang), and the client runtime — a single server-closed WS is
                 // necessary and sufficient. Client-initiated close or leaving the
                 // socket open both stop cleanly in ~0ms. In this suite the trigger is
-                // any server-initiated WS close — a revocation's (the `ws.cross.test.ts`
+                // any server-initiated WS close — a revocation's (the WS round-trip suite's
                 // close-on-revoke cases), a cap eviction's, an oversized message's —
                 // which is why teardown hangs after those and not under HTTP-only or
                 // client-closed WS traffic.

package/dist/testing/cross_backend/token_lifetime.js

@@ -37,7 +37,7 @@ import '../assert_dev_env.js';
  */
 import { describe, test, assert } from 'vitest';
 import { account_token_create_action_spec, account_token_list_action_spec, API_TOKEN_NAME_LENGTH_MAX, TokenCreateOutput, TokenListOutput } from '../../auth/account_action_specs.js';
-import { cross_rpc_call, error_reason, expect_output } from './cell_cross_helpers.js';
+import { cross_rpc_call, error_reason, expect_output } from './cross_rpc.js';
 import { assert_iso8601_seconds } from './wire_shapes.js';
 import { SPINE_RPC_PATH } from './spine_surface_constants.js';
 /** TTL used by the bounded-mint case. */

package/dist/testing/cross_backend/token_scope_surface.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"token_scope_surface.d.ts","sourceRoot":"../src/lib/","sources":["../../../src/lib/testing/cross_backend/token_scope_surface.ts"],"names":[],"mappings":"AAAA,OAAO,sBAAsB,CAAC;AAgF9B,OAAO,KAAK,EAAE,uCAAuC,EAAE,MAAM,YAAY,CAAC;AAqB1E,wDAAwD;AACxD,MAAM,WAAW,iCAAkC,SAAQ,uCAAuC;IACjG,6DAA6D;IAC7D,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;CAC3B;AA6DD,eAAO,MAAM,wCAAwC,GACpD,SAAS,iCAAiC,KACxC,IA+JF,CAAC"}
+{"version":3,"file":"token_scope_surface.d.ts","sourceRoot":"../src/lib/","sources":["../../../src/lib/testing/cross_backend/token_scope_surface.ts"],"names":[],"mappings":"AAAA,OAAO,sBAAsB,CAAC;AAgF9B,OAAO,KAAK,EAAE,uCAAuC,EAAE,MAAM,YAAY,CAAC;AAmB1E,wDAAwD;AACxD,MAAM,WAAW,iCAAkC,SAAQ,uCAAuC;IACjG,6DAA6D;IAC7D,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;CAC3B;AA6DD,eAAO,MAAM,wCAAwC,GACpD,SAAS,iCAAiC,KACxC,IAqKF,CAAC"}

package/dist/testing/cross_backend/token_scope_surface.js

@@ -70,13 +70,9 @@ import '../assert_dev_env.js';
 import { describe, assert } from 'vitest';
 import { ERROR_CREDENTIAL_TYPE_REQUIRED, ERROR_TOKEN_SCOPE_REQUIRED } from '../../http/error_schemas.js';
 import { test_if } from './capabilities.js';
-import { cross_rpc_call } from './cell_cross_helpers.js';
+import { cross_rpc_call } from './cross_rpc.js';
 import { mint_narrowed_api_token } from './narrowed_api_token.js';
-import { SPINE_RPC_PATH } from './spine_surface_constants.js';
-/** Default audit-log SSE path — the `audit_stream` surface. */
-const DEFAULT_SSE_PATH = '/api/admin/audit/stream';
-/** The account status read, which answers a narrowed token as anonymous. */
-const STATUS_PATH = '/api/account/status';
+import { SPINE_ACCOUNT_STATUS_PATH, SPINE_RPC_PATH, SPINE_SSE_PATH } from './spine_surface_constants.js';
 /**
  * A well-formed hash that no fact has. The scope gate is a pre-authorization
  * guard, so it fires before the handler ever looks the hash up — but *params*
@@ -127,7 +123,7 @@ const assert_channel_denied = async (fresh_transport, path, token, credential_ty
 export const describe_token_scope_surface_cross_tests = (options) => {
     const { setup_test, capabilities } = options;
     const rpc_path = options.rpc_path ?? SPINE_RPC_PATH;
-    const sse_path = options.sse_path ?? DEFAULT_SSE_PATH;
+    const sse_path = options.sse_path ?? SPINE_SSE_PATH;
     describe('token scope non-RPC surface parity', () => {
         /**
          * The non-vacuity control for every denial below: a narrowed token is
@@ -155,7 +151,7 @@ export const describe_token_scope_surface_cross_tests = (options) => {
             });
             await assert_channel_denied(fixture.fresh_transport, sse_path, token, ['session']);
         });
-        test_if(capabilities.fact_serving, 'a narrowed token is refused the bare-hash fact read (surface:fact_bare)', async () => {
+        test_if(capabilities.fact_serving_admin_hash, 'a narrowed token is refused the bare-hash fact read (surface:fact_bare)', async () => {
             const fixture = await setup_test();
             const token = await mint_narrowed_api_token({
                 app: fixture.transport,
@@ -173,7 +169,7 @@ export const describe_token_scope_surface_cross_tests = (options) => {
          * scope denial satisfies the property, so the assertion is on what the
          * response must *not* be.
          */
-        test_if(capabilities.fact_serving, 'a full token is not refused by the scope gate on the same route', async () => {
+        test_if(capabilities.fact_serving_admin_hash, 'a full token is not refused by the scope gate on the same route', async () => {
             const fixture = await setup_test();
             const res = await fixture.fresh_transport({ origin: null })(`/api/facts/${ABSENT_FACT_HASH}`, { headers: fixture.create_bearer_headers() });
             const body = (await res.json().catch(() => undefined));
@@ -193,14 +189,14 @@ export const describe_token_scope_surface_cross_tests = (options) => {
                 session_headers: fixture.create_session_headers(),
                 methods: [ADMITTED_METHOD]
             });
-            const anonymous = await fixture.fresh_transport({ origin: null })(STATUS_PATH, {});
-            const narrowed = await fixture.fresh_transport({ origin: null })(STATUS_PATH, {
+            const anonymous = await fixture.fresh_transport({ origin: null })(SPINE_ACCOUNT_STATUS_PATH, {});
+            const narrowed = await fixture.fresh_transport({ origin: null })(SPINE_ACCOUNT_STATUS_PATH, {
                 headers: { authorization: `Bearer ${token}` }
             });
             assert.strictEqual(anonymous.status, 401, 'anonymous status must be 401');
             assert.strictEqual(narrowed.status, 401, 'a narrowed token must read status as anonymous');
             assert.strictEqual(await narrowed.text(), await anonymous.text(), 'the narrowed answer must be the anonymous one, byte for byte');
-            const full = await fixture.fresh_transport({ origin: null })(STATUS_PATH, {
+            const full = await fixture.fresh_transport({ origin: null })(SPINE_ACCOUNT_STATUS_PATH, {
                 headers: fixture.create_bearer_headers()
             });
             assert.strictEqual(full.status, 200, 'a full-scope bearer must read the account');
@@ -218,7 +214,7 @@ export const describe_token_scope_surface_cross_tests = (options) => {
          * *holds* the role — so both orderings look identical there, which is
          * exactly why this divergence survived as long as it did.
          */
-        test_if(capabilities.fact_serving, 'scope outranks role — a narrowed token lacking the role hears about its scope', async () => {
+        test_if(capabilities.fact_serving_admin_hash, 'scope outranks role — a narrowed token lacking the role hears about its scope', async () => {
             const fixture = await setup_test();
             const non_admin = await fixture.create_account({ username: 'scope_before_role' });
             const token = await mint_narrowed_api_token({

package/dist/testing/cross_backend/transport_composition.d.ts

@@ -1,10 +1,10 @@
 import '../assert_dev_env.js';
 import { type BackendCapabilities } from './capabilities.js';
-import type { RpcPathCapabilityGatedCrossSuiteOptions } from './setup.js';
+import type { RpcPathCapabilityGatedCrossSuiteOptions, SetupTest } from './setup.js';
 /** A transport's front door, as the table's rows name it. */
 export type TransportCompositionSurface = 'rest_post' | 'rest_password' | 'rpc_post' | 'rpc_get' | 'ws_upgrade' | 'sse';
 /** What a probe sends, as the table's columns name it. */
-export type TransportCompositionProbe = 'foreign_origin' | 'unreadable_origin' | 'duplicated_origin' | 'over_cap_foreign_origin' | 'no_credential' | 'narrowed_token';
+export type TransportCompositionProbe = 'foreign_origin' | 'unreadable_origin' | 'duplicated_origin' | 'over_cap_foreign_origin' | 'no_credential' | 'narrowed_token' | 'multi_actor_no_acting';
 /** The refusal a case expects. */
 export interface TransportCompositionExpect {
     readonly status: number;
@@ -25,6 +25,21 @@ export interface TransportCompositionCase {
 }
 /** The front-door table — one case per cell of the module doc's matrix. */
 export declare const transport_composition_cases: ReadonlyArray<TransportCompositionCase>;
+/**
+ * The rows that need a multi-actor keeper — run only given
+ * `TransportCompositionCrossTestOptions.multi_actor`, on its fixture.
+ */
+export declare const transport_composition_multi_actor_cases: ReadonlyArray<TransportCompositionCase>;
+/** The multi-actor rows' fixture, and how a backend known to diverge runs them. */
+export interface TransportCompositionMultiActorOptions {
+    /** Per-test fixture whose keeper is seeded with at least one `extra_actors` entry. */
+    readonly setup_test: SetupTest;
+    /** Run the multi-actor rows as `xfail_until` — for a backend known to admit them. */
+    readonly xfail?: {
+        readonly tracking_id: string;
+        readonly reason: string;
+    };
+}
 /** Options for `describe_transport_composition_cross_tests`. */
 export interface TransportCompositionCrossTestOptions extends RpcPathCapabilityGatedCrossSuiteOptions {
     /**
@@ -47,6 +62,15 @@ export interface TransportCompositionCrossTestOptions extends RpcPathCapabilityG
     readonly ws_path?: string;
     /** Audit-log SSE path. Default `/api/admin/audit/stream`. */
     readonly sse_path?: string;
+    /** Run the multi-actor rows (`transport_composition_multi_actor_cases`). */
+    readonly multi_actor?: TransportCompositionMultiActorOptions;
+    /**
+     * The backend's request-body cap on `rpc_path`, in bytes; the RPC row's
+     * over-cap probe declares a length one past it. Default
+     * `SPINE_BODY_LIMIT_DEFAULT_BYTES`. The REST rows probe past that default,
+     * the cap a backend keeps off its RPC path.
+     */
+    readonly rpc_max_body_bytes?: number;
 }
 /**
  * Register the front-door table's cases — one test per cell, each on a fresh

package/dist/testing/cross_backend/transport_composition.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"transport_composition.d.ts","sourceRoot":"../src/lib/","sources":["../../../src/lib/testing/cross_backend/transport_composition.ts"],"names":[],"mappings":"AAAA,OAAO,sBAAsB,CAAC;AA+E9B,OAAO,EAAW,KAAK,mBAAmB,EAAE,MAAM,mBAAmB,CAAC;AAEtE,OAAO,KAAK,EAAE,uCAAuC,EAAe,MAAM,YAAY,CAAC;AAGvF,6DAA6D;AAC7D,MAAM,MAAM,2BAA2B,GACtC,WAAW,GAAG,eAAe,GAAG,UAAU,GAAG,SAAS,GAAG,YAAY,GAAG,KAAK,CAAC;AAE/E,0DAA0D;AAC1D,MAAM,MAAM,yBAAyB,GAClC,gBAAgB,GAChB,mBAAmB,GACnB,mBAAmB,GACnB,yBAAyB,GACzB,eAAe,GACf,gBAAgB,CAAC;AAEpB,kCAAkC;AAClC,MAAM,WAAW,0BAA0B;IAC1C,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,2FAA2F;IAC3F,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,gEAAgE;IAChE,QAAQ,CAAC,MAAM,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;IACpD,8FAA8F;IAC9F,QAAQ,CAAC,QAAQ,CAAC,EAAE,OAAO,CAAC;CAC5B;AAED,wCAAwC;AACxC,MAAM,WAAW,wBAAwB;IACxC,QAAQ,CAAC,OAAO,EAAE,2BAA2B,CAAC;IAC9C,QAAQ,CAAC,KAAK,EAAE,yBAAyB,CAAC;IAC1C,QAAQ,CAAC,MAAM,EAAE,0BAA0B,CAAC;IAC5C,gFAAgF;IAChF,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,mBAAmB,CAAC;CAC1C;AAsCD,2EAA2E;AAC3E,eAAO,MAAM,2BAA2B,EAAE,aAAa,CAAC,wBAAwB,CA4C/E,CAAC;AAEF,gEAAgE;AAChE,MAAM,WAAW,oCAAqC,SAAQ,uCAAuC;IACpG;;;;OAIG;IACH,QAAQ,CAAC,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;IACjC;;;;OAIG;IACH,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IACzB,yFAAyF;IACzF,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAC5B,yFAAyF;IACzF,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,CAAC;IAChC,kDAAkD;IAClD,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;IAC1B,6DAA6D;IAC7D,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;CAC3B;AAwFD;;;;;;;GAOG;AACH,eAAO,MAAM,0CAA0C,GACtD,SAAS,oCAAoC,KAC3C,IA2KF,CAAC"}
+{"version":3,"file":"transport_composition.d.ts","sourceRoot":"../src/lib/","sources":["../../../src/lib/testing/cross_backend/transport_composition.ts"],"names":[],"mappings":"AAAA,OAAO,sBAAsB,CAAC;AAgG9B,OAAO,EAAW,KAAK,mBAAmB,EAAE,MAAM,mBAAmB,CAAC;AAEtE,OAAO,KAAK,EAAE,uCAAuC,EAAE,SAAS,EAAe,MAAM,YAAY,CAAC;AAWlG,6DAA6D;AAC7D,MAAM,MAAM,2BAA2B,GACtC,WAAW,GAAG,eAAe,GAAG,UAAU,GAAG,SAAS,GAAG,YAAY,GAAG,KAAK,CAAC;AAE/E,0DAA0D;AAC1D,MAAM,MAAM,yBAAyB,GAClC,gBAAgB,GAChB,mBAAmB,GACnB,mBAAmB,GACnB,yBAAyB,GACzB,eAAe,GACf,gBAAgB,GAChB,uBAAuB,CAAC;AAE3B,kCAAkC;AAClC,MAAM,WAAW,0BAA0B;IAC1C,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,2FAA2F;IAC3F,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,gEAAgE;IAChE,QAAQ,CAAC,MAAM,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;IACpD,8FAA8F;IAC9F,QAAQ,CAAC,QAAQ,CAAC,EAAE,OAAO,CAAC;CAC5B;AAED,wCAAwC;AACxC,MAAM,WAAW,wBAAwB;IACxC,QAAQ,CAAC,OAAO,EAAE,2BAA2B,CAAC;IAC9C,QAAQ,CAAC,KAAK,EAAE,yBAAyB,CAAC;IAC1C,QAAQ,CAAC,MAAM,EAAE,0BAA0B,CAAC;IAC5C,gFAAgF;IAChF,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,mBAAmB,CAAC;CAC1C;AAsCD,2EAA2E;AAC3E,eAAO,MAAM,2BAA2B,EAAE,aAAa,CAAC,wBAAwB,CA4C/E,CAAC;AAEF;;;GAGG;AACH,eAAO,MAAM,uCAAuC,EAAE,aAAa,CAAC,wBAAwB,CAO3F,CAAC;AAEF,mFAAmF;AACnF,MAAM,WAAW,qCAAqC;IACrD,sFAAsF;IACtF,QAAQ,CAAC,UAAU,EAAE,SAAS,CAAC;IAC/B,qFAAqF;IACrF,QAAQ,CAAC,KAAK,CAAC,EAAE;QAAE,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC;CAC3E;AAED,gEAAgE;AAChE,MAAM,WAAW,oCAAqC,SAAQ,uCAAuC;IACpG;;;;OAIG;IACH,QAAQ,CAAC,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;IACjC;;;;OAIG;IACH,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IACzB,yFAAyF;IACzF,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAC5B,yFAAyF;IACzF,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,CAAC;IAChC,kDAAkD;IAClD,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;IAC1B,6DAA6D;IAC7D,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAC3B,4EAA4E;IAC5E,QAAQ,CAAC,WAAW,CAAC,EAAE,qCAAqC,CAAC;IAC7D;;;;;OAKG;IACH,QAAQ,CAAC,kBAAkB,CAAC,EAAE,MAAM,CAAC;CACrC;AAqED;;;;;;;GAOG;AACH,eAAO,MAAM,0CAA0C,GACtD,SAAS,oCAAoC,KAC3C,IAiMF,CAAC"}