@fuzdev/fuz_app 0.98.1 → 0.100.0

package/dist/db/CLAUDE.md

@@ -128,14 +128,16 @@ DO NOTHING`), `_put_fact_refs`, `_get_fact` / `_get_fact_meta` / `_has_fact`
 
 FK dependency dictates order; consumers register via `migration_namespaces`
 on `create_app_backend` (after the built-in `fuz_auth` namespace). The fact
-namespace is independent (no FK to cell) but conventionally sits between cell
-and cell_history:
+namespace is FK-independent so its slot is free; the spine binary and every
+consumer place it last, keeping cell + its `cell_history` FK-child adjacent
+(cross-namespace order is immaterial to the `schema_version` rows — `sequence`
+is assigned per-namespace — so only the cell→cell_history FK constrains it):
 
 ```
 auth_migration_ns (built-in, fuz_auth)
-  → CELL_MIGRATION_NS        (fuz_cell — FKs actor.id)
-  → FACT_MIGRATION_NS        (fuz_facts — no external FK; optional)
+  → CELL_MIGRATION_NS         (fuz_cell — FKs actor.id)
   → CELL_HISTORY_MIGRATION_NS (fuz_cell_history — FKs cell.id)
+  → FACT_MIGRATION_NS         (fuz_facts — no external FK; slot is free)
 ```
 
 ### Pre-stable migration policy

package/dist/db/cell_ddl.d.ts

@@ -27,9 +27,10 @@
  * `_at`-everywhere convention used by `account`, `actor`, `audit_log`,
  * `role_grant`, etc.
  *
- * **Single-migration shape**: `cell_v0` creates the canonical
+ * **Single-migration shape**: `full_cell_schema` creates the canonical
  * cell + cell_grant + cell_field + cell_item layout in one shot from the
- * live exported constants.
+ * live exported constants. The dormant `cell_history` table lives in the
+ * separate `fuz_cell_history` namespace (`cell_history_ddl.ts`).
  *
  * @module
  */

package/dist/db/cell_ddl.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"cell_ddl.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/db/cell_ddl.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkCG;AAGH,OAAO,KAAK,EAAC,SAAS,EAAE,kBAAkB,EAAC,MAAM,cAAc,CAAC;AAEhE;;;;;;;;;;;;GAYG;AACH,eAAO,MAAM,oBAAoB,oIAI1B,CAAC;AAER;;;;;;;;;;;;;GAaG;AACH,eAAO,MAAM,WAAW,4aAYtB,CAAC;AAEH;;;;;;;;;;;;;GAaG;AACH,eAAO,MAAM,YAAY,EAAE,KAAK,CAAC,MAAM,CAYtC,CAAC;AAEF;;;;;;;;GAQG;AACH,eAAO,MAAM,iBAAiB,0iBAc5B,CAAC;AAEH;;;;;;;;;;;;;GAaG;AACH,eAAO,MAAM,kBAAkB,EAAE,KAAK,CAAC,MAAM,CAW5C,CAAC;AAEF;;;;;GAKG;AACH,eAAO,MAAM,iBAAiB,+RAO5B,CAAC;AAEH;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,kBAAkB,EAAE,KAAK,CAAC,MAAM,CAE5C,CAAC;AAEF;;;;;;GAMG;AACH,eAAO,MAAM,gBAAgB,qSAO3B,CAAC;AAEH;;;;;;;GAOG;AACH,eAAO,MAAM,iBAAiB,EAAE,KAAK,CAAC,MAAM,CAG3C,CAAC;AAEF,6EAA6E;AAC7E,eAAO,MAAM,gBAAgB,4DAA6D,CAAC;AAE3F,uBAAuB;AACvB,eAAO,MAAM,eAAe,EAAE,KAAK,CAAC,SAAS,CAuB5C,CAAC;AAEF,gDAAgD;AAChD,eAAO,MAAM,wBAAwB,aAAa,CAAC;AAEnD,wDAAwD;AACxD,eAAO,MAAM,iBAAiB,EAAE,kBAG/B,CAAC"}
+{"version":3,"file":"cell_ddl.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/db/cell_ddl.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmCG;AAGH,OAAO,KAAK,EAAC,SAAS,EAAE,kBAAkB,EAAC,MAAM,cAAc,CAAC;AAEhE;;;;;;;;;;;;GAYG;AACH,eAAO,MAAM,oBAAoB,oIAI1B,CAAC;AAER;;;;;;;;;;;;;GAaG;AACH,eAAO,MAAM,WAAW,4aAYtB,CAAC;AAEH;;;;;;;;;;;;;GAaG;AACH,eAAO,MAAM,YAAY,EAAE,KAAK,CAAC,MAAM,CAYtC,CAAC;AAEF;;;;;;;;GAQG;AACH,eAAO,MAAM,iBAAiB,0iBAc5B,CAAC;AAEH;;;;;;;;;;;;;GAaG;AACH,eAAO,MAAM,kBAAkB,EAAE,KAAK,CAAC,MAAM,CAW5C,CAAC;AAEF;;;;;GAKG;AACH,eAAO,MAAM,iBAAiB,+RAO5B,CAAC;AAEH;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,kBAAkB,EAAE,KAAK,CAAC,MAAM,CAE5C,CAAC;AAEF;;;;;;GAMG;AACH,eAAO,MAAM,gBAAgB,qSAO3B,CAAC;AAEH;;;;;;;GAOG;AACH,eAAO,MAAM,iBAAiB,EAAE,KAAK,CAAC,MAAM,CAG3C,CAAC;AAEF,6EAA6E;AAC7E,eAAO,MAAM,gBAAgB,4DAA6D,CAAC;AAE3F,uBAAuB;AACvB,eAAO,MAAM,eAAe,EAAE,KAAK,CAAC,SAAS,CAuB5C,CAAC;AAEF,gDAAgD;AAChD,eAAO,MAAM,wBAAwB,aAAa,CAAC;AAEnD,wDAAwD;AACxD,eAAO,MAAM,iBAAiB,EAAE,kBAG/B,CAAC"}

package/dist/db/cell_ddl.js

@@ -27,9 +27,10 @@
  * `_at`-everywhere convention used by `account`, `actor`, `audit_log`,
  * `role_grant`, etc.
  *
- * **Single-migration shape**: `cell_v0` creates the canonical
+ * **Single-migration shape**: `full_cell_schema` creates the canonical
  * cell + cell_grant + cell_field + cell_item layout in one shot from the
- * live exported constants.
+ * live exported constants. The dormant `cell_history` table lives in the
+ * separate `fuz_cell_history` namespace (`cell_history_ddl.ts`).
  *
  * @module
  */
@@ -216,7 +217,7 @@ export const CELL_DROP_TABLES = ['cell_field', 'cell_item', 'cell_grant', 'cell'
 /** Cell migrations. */
 export const CELL_MIGRATIONS = [
     {
-        name: 'cell_v0',
+        name: 'full_cell_schema',
         up: async (db) => {
             await db.query(CELL_VISIBILITY_TYPE);
             await db.query(CELL_SCHEMA);

package/dist/db/cell_history_ddl.js

@@ -43,7 +43,7 @@ export const CELL_HISTORY_DROP_TABLES = ['cell_history'];
 /** Cell-history migrations. */
 export const CELL_HISTORY_MIGRATIONS = [
     {
-        name: 'cell_history_v0',
+        name: 'full_cell_history_schema',
         up: async (db) => {
             await db.query(CELL_HISTORY_SCHEMA);
             for (const sql of CELL_HISTORY_INDEXES) {

package/dist/db/fact_ddl.js

@@ -53,7 +53,7 @@ export const FACT_DROP_TABLES = ['memo', 'fact_ref', 'fact'];
 /** Fact + memo migrations. */
 export const FACT_MIGRATIONS = [
     {
-        name: 'facts_v0',
+        name: 'full_fact_schema',
         up: async (db) => {
             await db.query(FACTS_SCHEMA);
             await db.query(FACT_REFS_SCHEMA);

package/dist/db/migrate.d.ts

@@ -6,6 +6,17 @@
  * `(namespace, name, sequence, applied_at)` — and the runner verifies the
  * applied list is a name-prefix of the code's migration array at boot.
  *
+ * **`name` is descriptive identity, not a version ordinal.** The runner orders
+ * by the `sequence` column and matches `name` by array position — it never
+ * parses the name — so `name` carries *what the migration is*
+ * (`full_cell_schema`, `role_grant_offer_and_scoped_role_grants`), and the
+ * redundant `_vN` ordinal is avoided (it would only duplicate `sequence`, and
+ * a `cell_v0` name tempts editing "v0" in place). `name` is half the
+ * `schema_version` PK (with `namespace`), so a rename is an identity change
+ * every already-migrated DB sees as `name-divergence-at-N`. This is also the
+ * cross-impl contract: the TS and Rust spines must record byte-identical
+ * `(namespace, name, sequence)` so a consumer can swap backends over one DB.
+ *
  * **Schema is not stabilized yet — append-only is NOT the rule.** While
  * fuz_app is pre-stable, migration bodies, names, and positions can change
  * freely between versions; consumers upgrading across a schema change are

package/dist/db/migrate.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"migrate.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/db/migrate.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4CG;AAIH,OAAO,KAAK,EAAC,EAAE,EAAC,MAAM,SAAS,CAAC;AAEhC;;;;GAIG;AACH,MAAM,WAAW,SAAS;IACzB,IAAI,EAAE,MAAM,CAAC;IACb,EAAE,EAAE,CAAC,EAAE,EAAE,EAAE,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;CAC9B;AAED;;;;;GAKG;AACH,MAAM,WAAW,kBAAkB;IAClC,SAAS,EAAE,MAAM,CAAC;IAClB,UAAU,EAAE,KAAK,CAAC,SAAS,CAAC,CAAC;CAC7B;AAED,2DAA2D;AAC3D,MAAM,WAAW,eAAe;IAC/B,SAAS,EAAE,MAAM,CAAC;IAClB,+EAA+E;IAC/E,aAAa,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;CAC7B;AAED;;;;;GAKG;AACH,MAAM,MAAM,kBAAkB,GAC3B,sBAAsB,GACtB,sBAAsB,GACtB,mBAAmB,GACnB,kBAAkB,GAClB,2BAA2B,GAC3B,4BAA4B,GAC5B,sCAAsC,CAAC;AAE1C,8DAA8D;AAC9D,MAAM,WAAW,qBAAqB;IACrC,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,aAAa,CAAC,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC;IACtC,KAAK,CAAC,EAAE,OAAO,CAAC;CAChB;AAED;;;;GAIG;AACH,qBAAa,cAAe,SAAQ,KAAK;IACxC,QAAQ,CAAC,IAAI,EAAE,kBAAkB,CAAC;IAClC,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,aAAa,CAAC,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC;gBAEnC,IAAI,EAAE,kBAAkB,EAAE,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,qBAAqB;CAQtF;AA6ED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AACH,eAAO,MAAM,cAAc,GAC1B,IAAI,EAAE,EACN,YAAY,KAAK,CAAC,kBAAkB,CAAC,KACnC,OAAO,CAAC,KAAK,CAAC,eAAe,CAAC,CAuFhC,CAAC;AAEF;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmCG;AACH,eAAO,MAAM,QAAQ,GACpB,IAAI,EAAE,EACN,IAAI,kBAAkB,EACtB,OAAO,aAAa,CAAC,MAAM,CAAC,KAC1B,OAAO,CAAC,IAAI,CA+Dd,CAAC"}
+{"version":3,"file":"migrate.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/db/migrate.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAuDG;AAIH,OAAO,KAAK,EAAC,EAAE,EAAC,MAAM,SAAS,CAAC;AAEhC;;;;GAIG;AACH,MAAM,WAAW,SAAS;IACzB,IAAI,EAAE,MAAM,CAAC;IACb,EAAE,EAAE,CAAC,EAAE,EAAE,EAAE,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;CAC9B;AAED;;;;;GAKG;AACH,MAAM,WAAW,kBAAkB;IAClC,SAAS,EAAE,MAAM,CAAC;IAClB,UAAU,EAAE,KAAK,CAAC,SAAS,CAAC,CAAC;CAC7B;AAED,2DAA2D;AAC3D,MAAM,WAAW,eAAe;IAC/B,SAAS,EAAE,MAAM,CAAC;IAClB,+EAA+E;IAC/E,aAAa,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;CAC7B;AAED;;;;;GAKG;AACH,MAAM,MAAM,kBAAkB,GAC3B,sBAAsB,GACtB,sBAAsB,GACtB,mBAAmB,GACnB,kBAAkB,GAClB,2BAA2B,GAC3B,4BAA4B,GAC5B,sCAAsC,CAAC;AAE1C,8DAA8D;AAC9D,MAAM,WAAW,qBAAqB;IACrC,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,aAAa,CAAC,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC;IACtC,KAAK,CAAC,EAAE,OAAO,CAAC;CAChB;AAED;;;;GAIG;AACH,qBAAa,cAAe,SAAQ,KAAK;IACxC,QAAQ,CAAC,IAAI,EAAE,kBAAkB,CAAC;IAClC,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,aAAa,CAAC,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC;gBAEnC,IAAI,EAAE,kBAAkB,EAAE,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,qBAAqB;CAQtF;AA6ED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AACH,eAAO,MAAM,cAAc,GAC1B,IAAI,EAAE,EACN,YAAY,KAAK,CAAC,kBAAkB,CAAC,KACnC,OAAO,CAAC,KAAK,CAAC,eAAe,CAAC,CAuFhC,CAAC;AAEF;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmCG;AACH,eAAO,MAAM,QAAQ,GACpB,IAAI,EAAE,EACN,IAAI,kBAAkB,EACtB,OAAO,aAAa,CAAC,MAAM,CAAC,KAC1B,OAAO,CAAC,IAAI,CA+Dd,CAAC"}

package/dist/db/migrate.js

@@ -6,6 +6,17 @@
  * `(namespace, name, sequence, applied_at)` — and the runner verifies the
  * applied list is a name-prefix of the code's migration array at boot.
  *
+ * **`name` is descriptive identity, not a version ordinal.** The runner orders
+ * by the `sequence` column and matches `name` by array position — it never
+ * parses the name — so `name` carries *what the migration is*
+ * (`full_cell_schema`, `role_grant_offer_and_scoped_role_grants`), and the
+ * redundant `_vN` ordinal is avoided (it would only duplicate `sequence`, and
+ * a `cell_v0` name tempts editing "v0" in place). `name` is half the
+ * `schema_version` PK (with `namespace`), so a rename is an identity change
+ * every already-migrated DB sees as `name-divergence-at-N`. This is also the
+ * cross-impl contract: the TS and Rust spines must record byte-identical
+ * `(namespace, name, sequence)` so a consumer can swap backends over one DB.
+ *
  * **Schema is not stabilized yet — append-only is NOT the rule.** While
  * fuz_app is pre-stable, migration bodies, names, and positions can change
  * freely between versions; consumers upgrading across a schema change are

package/dist/server/serve_fact_route.d.ts

@@ -14,8 +14,11 @@
  * (filesystem-backed `file:<shard>/<rest>` URLs) either return an
  * `X-Accel-Redirect` header pointing into nginx's internal facts location
  * (production) or stream from disk via the filesystem `FactExternalFetcher`
- * (dev / tests). The runtime mode is selected by the optional
- * `x_accel_redirect_prefix` factory option — set in prod, unset in dev.
+ * (dev / tests). The runtime mode is selected by the optional `x_accel`
+ * factory option — a validated `XAccelConfig` (built via
+ * `create_x_accel_config` in `server/x_accel.ts`) set in prod, unset in dev.
+ * The handle can only be obtained by proving the facts nginx location is
+ * `internal;`, so X-Accel serving can't be enabled against a public location.
  *
  * REST, not RPC: binary responses don't fit the JSON-RPC envelope.
  *
@@ -87,6 +90,7 @@
 import type { Logger } from '@fuzdev/fuz_util/log.ts';
 import { type RouteSpec } from '../http/route_spec.js';
 import type { AppDeps } from '../auth/deps.js';
+import type { XAccelConfig } from './x_accel.js';
 export interface CreateServeFactRouteSpecOptions {
     /**
      * App deps reference. Currently unused at handler time (cell + fact
@@ -100,12 +104,13 @@ export interface CreateServeFactRouteSpecOptions {
     facts_dir: string;
     /**
      * When set, external facts return an `X-Accel-Redirect` pointing at
-     * `${prefix}<shard>/<rest>` — nginx's internal facts location serves
-     * the bytes. When unset, external facts stream from
-     * `<facts_dir>/<shard>/<rest>` directly. Production sets this (e.g.
-     * `/_facts/`); tests + dev leave it unset.
+     * `${x_accel.redirect_prefix}<shard>/<rest>` — nginx's internal facts
+     * location serves the bytes. When unset, external facts stream from
+     * `<facts_dir>/<shard>/<rest>` directly. Production sets a validated
+     * `XAccelConfig` (built via `create_x_accel_config`, which proves the
+     * facts location is `internal;`); tests + dev leave it unset.
      */
-    x_accel_redirect_prefix?: string;
+    x_accel?: XAccelConfig;
     log: Logger;
 }
 /**

package/dist/server/serve_fact_route.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"serve_fact_route.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/server/serve_fact_route.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAqFG;AAMH,OAAO,KAAK,EAAC,MAAM,EAAC,MAAM,yBAAyB,CAAC;AAepD,OAAO,EAAsC,KAAK,SAAS,EAAC,MAAM,uBAAuB,CAAC;AAE1F,OAAO,KAAK,EAAC,OAAO,EAAC,MAAM,iBAAiB,CAAC;AAkE7C,MAAM,WAAW,+BAA+B;IAC/C;;;;;;OAMG;IACH,IAAI,EAAE,OAAO,CAAC;IACd,kFAAkF;IAClF,SAAS,EAAE,MAAM,CAAC;IAClB;;;;;;OAMG;IACH,uBAAuB,CAAC,EAAE,MAAM,CAAC;IACjC,GAAG,EAAE,MAAM,CAAC;CACZ;AAgHD;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,iCAAiC,GAC7C,SAAS,+BAA+B,KACtC,SA8CF,CAAC;AAEF;;;;;;;;;;;;;;;GAeG;AACH,eAAO,MAAM,4BAA4B,GACxC,SAAS,+BAA+B,KACtC,SAgCF,CAAC"}
+{"version":3,"file":"serve_fact_route.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/server/serve_fact_route.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAwFG;AAMH,OAAO,KAAK,EAAC,MAAM,EAAC,MAAM,yBAAyB,CAAC;AAepD,OAAO,EAAsC,KAAK,SAAS,EAAC,MAAM,uBAAuB,CAAC;AAE1F,OAAO,KAAK,EAAC,OAAO,EAAC,MAAM,iBAAiB,CAAC;AAM7C,OAAO,KAAK,EAAC,YAAY,EAAC,MAAM,cAAc,CAAC;AA6D/C,MAAM,WAAW,+BAA+B;IAC/C;;;;;;OAMG;IACH,IAAI,EAAE,OAAO,CAAC;IACd,kFAAkF;IAClF,SAAS,EAAE,MAAM,CAAC;IAClB;;;;;;;OAOG;IACH,OAAO,CAAC,EAAE,YAAY,CAAC;IACvB,GAAG,EAAE,MAAM,CAAC;CACZ;AAgHD;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,iCAAiC,GAC7C,SAAS,+BAA+B,KACtC,SA8CF,CAAC;AAEF;;;;;;;;;;;;;;;GAeG;AACH,eAAO,MAAM,4BAA4B,GACxC,SAAS,+BAA+B,KACtC,SAgCF,CAAC"}

package/dist/server/serve_fact_route.js

@@ -14,8 +14,11 @@
  * (filesystem-backed `file:<shard>/<rest>` URLs) either return an
  * `X-Accel-Redirect` header pointing into nginx's internal facts location
  * (production) or stream from disk via the filesystem `FactExternalFetcher`
- * (dev / tests). The runtime mode is selected by the optional
- * `x_accel_redirect_prefix` factory option — set in prod, unset in dev.
+ * (dev / tests). The runtime mode is selected by the optional `x_accel`
+ * factory option — a validated `XAccelConfig` (built via
+ * `create_x_accel_config` in `server/x_accel.ts`) set in prod, unset in dev.
+ * The handle can only be obtained by proving the facts nginx location is
+ * `internal;`, so X-Accel serving can't be enabled against a public location.
  *
  * REST, not RPC: binary responses don't fit the JSON-RPC envelope.
  *
@@ -167,7 +170,7 @@ const params_400_error = {
  * fact is genuinely absent or merely unviewable.
  */
 const serve_fact_bytes = async (c, route, hash, config) => {
-    const { facts_dir, x_accel_redirect_prefix, log } = config;
+    const { facts_dir, x_accel, log } = config;
     const meta = await query_get_fact_meta({ db: route.db }, hash);
     if (!meta) {
         return c.body(null, 404);
@@ -198,13 +201,13 @@ const serve_fact_bytes = async (c, route, hash, config) => {
         return c.body(null, 404);
     }
     const { shard, rest } = parsed;
-    if (x_accel_redirect_prefix !== undefined) {
-        // Production: hand off to nginx via the internal facts location.
+    if (x_accel !== undefined) {
+        // Production: hand off to nginx via the validated `internal;` facts location.
         return c.body(null, 200, {
             'Content-Type': content_type,
             'Content-Length': size,
             'Cache-Control': CACHE_CONTROL,
-            'X-Accel-Redirect': `${x_accel_redirect_prefix}${shard}/${rest}`,
+            'X-Accel-Redirect': `${x_accel.redirect_prefix}${shard}/${rest}`,
             ...FACT_SECURITY_HEADERS,
         });
     }
@@ -252,8 +255,8 @@ const build_public_request_context = async (c, route) => {
  * from `c.var.account_id` and enforces visibility per-reference.
  */
 export const create_serve_cell_fact_route_spec = (options) => {
-    const { facts_dir, x_accel_redirect_prefix, log } = options;
-    const config = { facts_dir, x_accel_redirect_prefix, log };
+    const { facts_dir, x_accel, log } = options;
+    const config = { facts_dir, x_accel, log };
     return {
         method: 'GET',
         path: '/api/cells/:cell_id/facts/:hash',
@@ -310,8 +313,8 @@ export const create_serve_cell_fact_route_spec = (options) => {
  * hash to a non-admin.
  */
 export const create_serve_fact_route_spec = (options) => {
-    const { facts_dir, x_accel_redirect_prefix, log } = options;
-    const config = { facts_dir, x_accel_redirect_prefix, log };
+    const { facts_dir, x_accel, log } = options;
+    const config = { facts_dir, x_accel, log };
     return {
         method: 'GET',
         path: '/api/facts/:hash',

package/dist/server/x_accel.d.ts

@@ -0,0 +1,83 @@
+/**
+ * Fail-loud validation of the X-Accel facts nginx location.
+ *
+ * The `X-Accel-Redirect` serving path's confidentiality depends on the facts
+ * nginx location being `internal;` — only the authz'd handler's redirect (an
+ * internal subrequest) may reach it. A *public* facts location would serve any
+ * fact's bytes to anyone who guesses the `<shard>/<rest>` path, bypassing every
+ * cell-visibility check. `XAccelConfig` makes that assertion structural: a
+ * consumer can only obtain the redirect prefix by building an `XAccelConfig`,
+ * which runs this check and throws **loudly** on a missing or non-`internal;`
+ * location — it cannot silently fall closed.
+ *
+ * This is a best-effort string check (brace-matched `location` blocks), the TS
+ * twin of the Rust `fuz_fact_serving` `nginx.rs` — not a real nginx parser, but
+ * it catches the security-critical omission. Distinct from
+ * `validate_nginx_config` (`server/validate_nginx.ts`), which validates the
+ * `/api` Authorization-strip + security headers and takes no facts-location
+ * path.
+ *
+ * @module
+ */
+import { z } from 'zod';
+/** Result of the facts-location check. */
+export interface NginxFactsValidation {
+    /** `true` when the facts location exists and is `internal;`. */
+    ok: boolean;
+    /** Fatal issues — a missing or non-`internal` facts location. */
+    errors: Array<string>;
+}
+/**
+ * Assert the nginx `location` serving the X-Accel facts prefix is `internal;`.
+ *
+ * `facts_location` is the path the X-Accel redirect prefix points at (e.g.
+ * `/_facts/`). Returns a fatal error when no matching `location` block exists,
+ * or when the matching block is not marked `internal;` — either is a public
+ * facts location that bypasses cell visibility.
+ *
+ * @param config - the nginx config template string to check
+ * @param facts_location - the facts location path the redirect prefix points at
+ * @returns `{ok, errors}` — `ok` is `true` only when the location exists and is `internal;`
+ */
+export declare const validate_facts_internal_location: (config: string, facts_location: string) => NginxFactsValidation;
+/**
+ * A validated X-Accel redirect configuration — the only handle that enables the
+ * `X-Accel-Redirect` serving path in `server/serve_fact_route.ts`.
+ *
+ * The redirect prefix can be obtained **only** by passing the nginx config
+ * through `validate_facts_internal_location` (via `create_x_accel_config`), so
+ * X-Accel serving is impossible to enable without proving the facts location is
+ * `internal;` at boot — a public facts location would bypass every
+ * cell-visibility check. A Zod-branded type: the brand can't be forged without
+ * an explicit cast, so the factory is the only ordinary construction path.
+ */
+export declare const XAccelConfig: z.core.$ZodBranded<z.ZodObject<{
+    /** The validated redirect prefix the serving path prepends (e.g. `/_facts/`). */
+    redirect_prefix: z.ZodString;
+}, z.core.$strict>, "XAccelConfig", "out">;
+export type XAccelConfig = z.infer<typeof XAccelConfig>;
+/**
+ * A misconfigured X-Accel facts location — a fail-loud boot error thrown by
+ * `create_x_accel_config`.
+ */
+export declare class XAccelConfigError extends Error {
+    /** The validator errors that made the location unsafe. */
+    readonly errors: Array<string>;
+    constructor(errors: Array<string>);
+}
+/**
+ * Build a validated `XAccelConfig`, asserting the nginx `location` serving
+ * `redirect_prefix` is `internal;`.
+ *
+ * The make-impossible-states gate: serving can only emit `X-Accel-Redirect`
+ * into a location proven `internal;` at boot.
+ *
+ * @param redirect_prefix - the X-Accel redirect prefix (e.g. `/_facts/`)
+ * @param nginx_config - the nginx config template string to validate against
+ * @returns the validated `XAccelConfig` carrying `redirect_prefix`
+ * @throws `XAccelConfigError` when `nginx_config` has no matching `location` for
+ *   `redirect_prefix`, or the matching block is not marked `internal;` — either
+ *   is a public facts location that bypasses every cell-visibility check.
+ */
+export declare const create_x_accel_config: (redirect_prefix: string, nginx_config: string) => XAccelConfig;
+//# sourceMappingURL=x_accel.d.ts.map

package/dist/server/x_accel.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"x_accel.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/server/x_accel.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AAEH,OAAO,EAAC,CAAC,EAAC,MAAM,KAAK,CAAC;AAEtB,0CAA0C;AAC1C,MAAM,WAAW,oBAAoB;IACpC,gEAAgE;IAChE,EAAE,EAAE,OAAO,CAAC;IACZ,iEAAiE;IACjE,MAAM,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;CACtB;AAuDD;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,gCAAgC,GAC5C,QAAQ,MAAM,EACd,gBAAgB,MAAM,KACpB,oBAqBF,CAAC;AAEF;;;;;;;;;;GAUG;AACH,eAAO,MAAM,YAAY;IAEvB,iFAAiF;;0CAG5D,CAAC;AACxB,MAAM,MAAM,YAAY,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,YAAY,CAAC,CAAC;AAExD;;;GAGG;AACH,qBAAa,iBAAkB,SAAQ,KAAK;IAC3C,0DAA0D;IAC1D,QAAQ,CAAC,MAAM,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;gBACnB,MAAM,EAAE,KAAK,CAAC,MAAM,CAAC;CAKjC;AAED;;;;;;;;;;;;;GAaG;AACH,eAAO,MAAM,qBAAqB,GACjC,iBAAiB,MAAM,EACvB,cAAc,MAAM,KAClB,YAMF,CAAC"}

package/dist/server/x_accel.js

@@ -0,0 +1,148 @@
+/**
+ * Fail-loud validation of the X-Accel facts nginx location.
+ *
+ * The `X-Accel-Redirect` serving path's confidentiality depends on the facts
+ * nginx location being `internal;` — only the authz'd handler's redirect (an
+ * internal subrequest) may reach it. A *public* facts location would serve any
+ * fact's bytes to anyone who guesses the `<shard>/<rest>` path, bypassing every
+ * cell-visibility check. `XAccelConfig` makes that assertion structural: a
+ * consumer can only obtain the redirect prefix by building an `XAccelConfig`,
+ * which runs this check and throws **loudly** on a missing or non-`internal;`
+ * location — it cannot silently fall closed.
+ *
+ * This is a best-effort string check (brace-matched `location` blocks), the TS
+ * twin of the Rust `fuz_fact_serving` `nginx.rs` — not a real nginx parser, but
+ * it catches the security-critical omission. Distinct from
+ * `validate_nginx_config` (`server/validate_nginx.ts`), which validates the
+ * `/api` Authorization-strip + security headers and takes no facts-location
+ * path.
+ *
+ * @module
+ */
+import { z } from 'zod';
+/** Strip every trailing `/` so `/_facts/` and `/_facts` compare equal. */
+const trim_trailing_slashes = (value) => value.replace(/\/+$/, '');
+/** `true` if a location block body contains an `internal` directive. */
+const is_internal = (content) => content.split(/[;\s]+/).some((token) => token === 'internal');
+/**
+ * Extract `{path, content}` for each `location … { … }` block, brace-matched so
+ * nested blocks are kept whole. `path` is the last whitespace token before the
+ * opening brace (the location path, after any modifier). Best-effort: a stray
+ * `location` token in a comment can produce a spurious block, harmless for this
+ * check.
+ */
+const find_location_blocks = (config) => {
+    const blocks = [];
+    let search = 0;
+    let kw;
+    while ((kw = config.indexOf('location', search)) !== -1) {
+        // Require a token boundary before `location` (start or whitespace) so
+        // `relocation` etc. don't match.
+        const boundary_ok = kw === 0 || /\s/.test(config[kw - 1]);
+        const after = kw + 'location'.length;
+        const brace = config.indexOf('{', after);
+        if (brace === -1)
+            break;
+        if (!boundary_ok) {
+            search = after;
+            continue;
+        }
+        const header = config.slice(after, brace).trim();
+        const tokens = header.split(/\s+/).filter((token) => token.length > 0);
+        const path = tokens.length > 0 ? tokens[tokens.length - 1] : '';
+        // Brace-match the body.
+        let depth = 1;
+        let i = brace + 1;
+        while (i < config.length && depth > 0) {
+            const ch = config[i];
+            if (ch === '{')
+                depth++;
+            else if (ch === '}')
+                depth--;
+            i++;
+        }
+        blocks.push({ path, content: config.slice(brace, i) });
+        search = i;
+    }
+    return blocks;
+};
+/**
+ * Assert the nginx `location` serving the X-Accel facts prefix is `internal;`.
+ *
+ * `facts_location` is the path the X-Accel redirect prefix points at (e.g.
+ * `/_facts/`). Returns a fatal error when no matching `location` block exists,
+ * or when the matching block is not marked `internal;` — either is a public
+ * facts location that bypasses cell visibility.
+ *
+ * @param config - the nginx config template string to check
+ * @param facts_location - the facts location path the redirect prefix points at
+ * @returns `{ok, errors}` — `ok` is `true` only when the location exists and is `internal;`
+ */
+export const validate_facts_internal_location = (config, facts_location) => {
+    const errors = [];
+    const normalized = trim_trailing_slashes(facts_location);
+    const blocks = find_location_blocks(config);
+    const matching = blocks.filter((block) => trim_trailing_slashes(block.path) === normalized);
+    if (matching.length === 0) {
+        errors.push(`No nginx \`location ${facts_location}\` block found — the X-Accel facts location must ` +
+            `exist and be marked \`internal;\` so only the authz'd handler's redirect can reach it. ` +
+            `A public facts location bypasses every cell-visibility check.`);
+    }
+    else if (!matching.some((block) => is_internal(block.content))) {
+        errors.push(`nginx \`location ${facts_location}\` is NOT marked \`internal;\` — a public facts ` +
+            `location serves any fact's bytes to anyone who guesses the path, bypassing every ` +
+            `cell-visibility check. Add \`internal;\` to the block.`);
+    }
+    return { ok: errors.length === 0, errors };
+};
+/**
+ * A validated X-Accel redirect configuration — the only handle that enables the
+ * `X-Accel-Redirect` serving path in `server/serve_fact_route.ts`.
+ *
+ * The redirect prefix can be obtained **only** by passing the nginx config
+ * through `validate_facts_internal_location` (via `create_x_accel_config`), so
+ * X-Accel serving is impossible to enable without proving the facts location is
+ * `internal;` at boot — a public facts location would bypass every
+ * cell-visibility check. A Zod-branded type: the brand can't be forged without
+ * an explicit cast, so the factory is the only ordinary construction path.
+ */
+export const XAccelConfig = z
+    .strictObject({
+    /** The validated redirect prefix the serving path prepends (e.g. `/_facts/`). */
+    redirect_prefix: z.string(),
+})
+    .brand('XAccelConfig');
+/**
+ * A misconfigured X-Accel facts location — a fail-loud boot error thrown by
+ * `create_x_accel_config`.
+ */
+export class XAccelConfigError extends Error {
+    /** The validator errors that made the location unsafe. */
+    errors;
+    constructor(errors) {
+        super(`X-Accel facts location is not safely \`internal;\`: ${errors.join('; ')}`);
+        this.name = 'XAccelConfigError';
+        this.errors = errors;
+    }
+}
+/**
+ * Build a validated `XAccelConfig`, asserting the nginx `location` serving
+ * `redirect_prefix` is `internal;`.
+ *
+ * The make-impossible-states gate: serving can only emit `X-Accel-Redirect`
+ * into a location proven `internal;` at boot.
+ *
+ * @param redirect_prefix - the X-Accel redirect prefix (e.g. `/_facts/`)
+ * @param nginx_config - the nginx config template string to validate against
+ * @returns the validated `XAccelConfig` carrying `redirect_prefix`
+ * @throws `XAccelConfigError` when `nginx_config` has no matching `location` for
+ *   `redirect_prefix`, or the matching block is not marked `internal;` — either
+ *   is a public facts location that bypasses every cell-visibility check.
+ */
+export const create_x_accel_config = (redirect_prefix, nginx_config) => {
+    const validation = validate_facts_internal_location(nginx_config, redirect_prefix);
+    if (!validation.ok) {
+        throw new XAccelConfigError(validation.errors);
+    }
+    return XAccelConfig.parse({ redirect_prefix });
+};

package/dist/testing/CLAUDE.md

@@ -214,6 +214,7 @@ test-only by construction.
 
 - `query_schema_snapshot(db, options?)` — introspects a live DB into a deterministic `SchemaSnapshot` via `pg_catalog` + `information_schema`. Captures tables, columns (with `udt_name` to distinguish int4/int8), indexes (`indexdef`), constraints (`pg_get_constraintdef`), sequences, and enum types (`pg_enum` labels in declared `enumsortorder`, so a `cell_visibility` label-set/order drift is gated). The `schema_version` migration tracker is always excluded — it's framework bookkeeping, not domain schema, and impls organize migration namespaces differently. Twinned by `fuz_db::query_schema_snapshot` (Rust); the `_testing_schema_snapshot` RPC's wire validator is the shared `SchemaSnapshot`, so the enum field must serialize on both sides.
 - `SchemaSnapshot` — the Zod schema is canonical (co-located in `schema_introspect.ts`; the cross-impl `_testing_schema_snapshot` RPC action reuses it as its wire validator, and the type is `z.infer`'d from it). Fully JSON-serializable; every collection deterministically sorted on capture so structural equality is stable across runs.
+- `query_migration_tracker(db)` / `MigrationTracker` — the migration-_identity_ twin of the snapshot: reads the `schema_version` tracker rows (`[{namespace, name, sequence}]`) the snapshot deliberately _excludes_. `MigrationTracker` is the `_testing_migration_tracker` RPC's wire validator; pairs with `assert_migration_trackers_equal` to gate that the two spines record byte-identical migration identity (the swap-freely invariant), catching a migration-name or namespace-partitioning drift the provenance-agnostic schema snapshot can't see.
 
 ### `schema_parity.ts` — `assert_schema_snapshots_equal`
 
@@ -221,6 +222,7 @@ test-only by construction.
 - `format_schema_diffs(diffs, labels?)` — human-readable multi-line rendering; labels name the impl on each side (e.g., `{a: 'deno', b: 'rust'}`).
 - `assert_schema_snapshots_equal(a, b, labels?)` — throws on drift with a fully-formatted diff message.
 - `SchemaDiff` — tagged-union per drift kind: `table_only_in`, `column_only_in`, `column_field_differs`, `index_only_in`, `index_definition_differs`, `constraint_only_in`, `constraint_differs`, `sequence_only_in`, `sequence_data_type_differs`, `enum_only_in`, `enum_labels_differ` (enum labels compared positionally — declared order is significant).
+- `diff_migration_trackers(a, b)` / `format_migration_tracker_diffs(diffs, labels?)` / `assert_migration_trackers_equal(a, b, labels?)` — the migration-identity twins of the snapshot diff/format/assert, over two `MigrationTracker`s. `MigrationTrackerDiff` is keyed on `(namespace, name)` (the `schema_version` PK): `tracker_row_only_in` (a migration rename or namespace re-partition) and `tracker_sequence_differs` (a re-order).
 
 fuz_app's own spine gates this cross-process via the `cross_backend_parity` project (`schema_parity.cross.test.ts` + the dual-spawn `global_setup_schema_parity.ts`), diffing the TS spine ↔ `testing_spine_stub` full schema — `npm run test:cross:parity`. The forge has its own deno↔rust parity gate.
 

package/dist/testing/cross_backend/setup.d.ts

@@ -3,7 +3,7 @@ import { Uuid } from '@fuzdev/fuz_util/id.ts';
 import type { TestAccount } from '../app_server.js';
 import type { BackendCapabilities } from './capabilities.js';
 import { type FetchTransport } from '../transports/fetch_transport.js';
-import type { SchemaSnapshot } from '../schema_introspect.js';
+import { MigrationTracker, type SchemaSnapshot } from '../schema_introspect.js';
 import { ActionManifest } from './action_manifest.js';
 import type { BackendHandle } from './spawn_backend.js';
 /**
@@ -406,6 +406,18 @@ export declare const capture_schema_snapshot: (handle: ReconstructedBootstrapped
  * `fuz_testing` mirror); the normalized shapes match by design.
  */
 export declare const capture_action_manifest: (handle: ReconstructedBootstrappedBackendHandle) => Promise<ActionManifest>;
+/**
+ * Capture a backend's `schema_version` migration tracker over the
+ * `_testing_migration_tracker` RPC action (keeper daemon-token channel). The
+ * provenance twin of `capture_schema_snapshot` — where that reads the
+ * resulting schema (and excludes the tracker), this reads the tracker rows
+ * themselves. Pair two calls with `assert_migration_trackers_equal`
+ * (`testing/schema_parity.ts`) to gate that the TS spine and the Rust
+ * `testing_spine_stub` record byte-identical migration identity
+ * (`namespace` + `name` + `sequence`) — the invariant the schema-snapshot
+ * gate is blind to.
+ */
+export declare const capture_migration_tracker: (handle: ReconstructedBootstrappedBackendHandle) => Promise<MigrationTracker>;
 /**
  * Backdating offset (seconds) the `mint_expired_session` seam passes to
  * `mint_test_session` / `_testing_mint_session`. A minute in the past is

package/dist/testing/cross_backend/setup.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"setup.d.ts","sourceRoot":"../src/lib/","sources":["../../../src/lib/testing/cross_backend/setup.ts"],"names":[],"mappings":"AAAA,OAAO,sBAAsB,CAAC;AA0B9B,OAAO,EAAC,IAAI,EAAC,MAAM,wBAAwB,CAAC;AAK5C,OAAO,KAAK,EAAC,WAAW,EAAC,MAAM,kBAAkB,CAAC;AAClD,OAAO,KAAK,EAAC,mBAAmB,EAAC,MAAM,mBAAmB,CAAC;AAC3D,OAAO,EAAyB,KAAK,cAAc,EAAC,MAAM,kCAAkC,CAAC;AAC7F,OAAO,KAAK,EAAC,cAAc,EAAC,MAAM,yBAAyB,CAAC;AAC5D,OAAO,EAAC,cAAc,EAAC,MAAM,sBAAsB,CAAC;AACpD,OAAO,KAAK,EAAC,aAAa,EAAC,MAAM,oBAAoB,CAAC;AAEtD;;;;;GAKG;AACH,MAAM,WAAW,wBAAwB;IACxC,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,cAAc,CAAC,EAAE,MAAM,CAAC;IACjC,QAAQ,CAAC,KAAK,CAAC,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;IAC/B;;;;;;;OAOG;IACH,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC;CACxB;AAED;;;;;;GAMG;AACH,MAAM,MAAM,kBAAkB,GAAG,WAAW,CAAC;AAE7C;;;;;;;;;;;;GAYG;AACH,MAAM,WAAW,gBAAgB;IAChC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,cAAc,CAAC,EAAE,MAAM,CAAC;IACjC,QAAQ,CAAC,KAAK,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC;CACtC;AAED,sEAAsE;AACtE,MAAM,WAAW,mBAAmB;IACnC,QAAQ,CAAC,OAAO,EAAE;QAAC,QAAQ,CAAC,EAAE,EAAE,IAAI,CAAC;QAAC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAA;KAAC,CAAC;IACjE,QAAQ,CAAC,KAAK,EAAE;QAAC,QAAQ,CAAC,EAAE,EAAE,IAAI,CAAA;KAAC,CAAC;IACpC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;IAChC,QAAQ,CAAC,sBAAsB,EAAE,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,KAAK,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC5F,QAAQ,CAAC,qBAAqB,EAAE,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,KAAK,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CAC3F;AAED;;;;;;;;;;GAUG;AACH,eAAO,MAAM,2BAA2B,GACvC,QAAQ;IACP,OAAO,EAAE;QAAC,EAAE,EAAE,IAAI,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAA;KAAC,CAAC;IACtC,KAAK,EAAE;QAAC,EAAE,EAAE,IAAI,CAAA;KAAC,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;IAClB,cAAc,EAAE,MAAM,CAAC;CACvB,EACD,aAAa,MAAM,KACjB,mBAaD,CAAC;AAEH;;;;;;;;;;;;;GAaG;AACH,MAAM,WAAW,eAAe;IAC/B;;;;;;OAMG;IACH,QAAQ,CAAC,SAAS,EAAE,cAAc,CAAC;IACnC;;;;;;;;;;;;;;;;;;;;;;;OAuBG;IACH,QAAQ,CAAC,eAAe,EAAE,CAAC,OAAO,CAAC,EAAE;QAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;KAAC,KAAK,cAAc,CAAC;IAC1F,+CAA+C;IAC/C,QAAQ,CAAC,OAAO,EAAE;QAAC,QAAQ,CAAC,EAAE,EAAE,IAAI,CAAC;QAAC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAA;KAAC,CAAC;IACjE,8CAA8C;IAC9C,QAAQ,CAAC,KAAK,EAAE;QAAC,QAAQ,CAAC,EAAE,EAAE,IAAI,CAAA;KAAC,CAAC;IACpC,8DAA8D;IAC9D,QAAQ,CAAC,sBAAsB,EAAE,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,KAAK,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC5F,4DAA4D;IAC5D,QAAQ,CAAC,qBAAqB,EAAE,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,KAAK,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC3F,iEAAiE;IACjE,QAAQ,CAAC,2BAA2B,EAAE,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,KAAK,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACjG;;;;;OAKG;IACH,QAAQ,CAAC,cAAc,EAAE,CAAC,OAAO,CAAC,EAAE,wBAAwB,KAAK,OAAO,CAAC,kBAAkB,CAAC,CAAC;IAC7F;;;;;OAKG;IACH,QAAQ,CAAC,cAAc,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,mBAAmB,CAAC,CAAC,CAAC;IACvE;;;;;;;;OAQG;IACH,QAAQ,CAAC,YAAY,EAAE,aAAa,CAAC;QAAC,QAAQ,CAAC,EAAE,EAAE,IAAI,CAAC;QAAC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;KAAC,CAAC,CAAC;IACjF;;;;;;;;;;OAUG;IACH,QAAQ,CAAC,oBAAoB,EAAE,MAAM,OAAO,CAAC,MAAM,CAAC,CAAC;CACrD;AAED;;;;;;;;;;;GAWG;AACH,MAAM,MAAM,WAAW,GAAG,eAAe,CAAC;AAE1C;;;;;GAKG;AACH,MAAM,MAAM,SAAS,GAAG,MAAM,OAAO,CAAC,WAAW,CAAC,CAAC;AAEnD;;;;;;;;;;GAUG;AACH,MAAM,WAAW,iBAAiB;IACjC,wEAAwE;IACxE,QAAQ,CAAC,UAAU,EAAE,SAAS,CAAC;IAC/B,0EAA0E;IAC1E,QAAQ,CAAC,YAAY,EAAE,mBAAmB,CAAC;CAC3C;AAED;;;;;;GAMG;AACH,MAAM,WAAW,wBAAyB,SAAQ,iBAAiB;IAClE,wEAAwE;IACxE,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;CAC3B;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AACH,MAAM,WAAW,yBAA0B,SAAQ,aAAa;IAC/D,iEAAiE;IACjE,QAAQ,CAAC,gBAAgB,EAAE,cAAc,CAAC;IAC1C;;;;;;;;;;OAUG;IACH,QAAQ,CAAC,uBAAuB,EAAE,cAAc,CAAC;IACjD,2DAA2D;IAC3D,QAAQ,CAAC,cAAc,EAAE;QAAC,QAAQ,CAAC,EAAE,EAAE,IAAI,CAAC;QAAC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAA;KAAC,CAAC;IACxE,yDAAyD;IACzD,QAAQ,CAAC,YAAY,EAAE;QAAC,QAAQ,CAAC,EAAE,EAAE,IAAI,CAAA;KAAC,CAAC;IAC3C,wGAAwG;IACxG,QAAQ,CAAC,cAAc,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC;CAC/C;AAED;;;;;;;GAOG;AACH,MAAM,MAAM,sCAAsC,GAAG,IAAI,CACxD,yBAAyB,EACzB,OAAO,GAAG,UAAU,CACpB,CAAC;AAEF;;;;;;;;;;;;;GAaG;AACH,MAAM,WAAW,qCAAqC;IACrD,QAAQ,CAAC,MAAM,EAAE,aAAa,CAAC,QAAQ,CAAC,CAAC;IACzC,QAAQ,CAAC,YAAY,EAAE,aAAa,CAAC,cAAc,CAAC,CAAC;IACrD,QAAQ,CAAC,cAAc,EAAE,yBAAyB,CAAC,gBAAgB,CAAC,CAAC;IACrE,QAAQ,CAAC,YAAY,EAAE,yBAAyB,CAAC,cAAc,CAAC,CAAC;IACjE,QAAQ,CAAC,cAAc,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC;CAC/C;AAED;;;GAGG;AACH,eAAO,MAAM,6BAA6B,GACzC,QAAQ,yBAAyB,KAC/B,qCAMD,CAAC;AAEH;;;;;;;GAOG;AACH,eAAO,MAAM,+BAA+B,GAC3C,YAAY,qCAAqC,KAC/C,sCAmBD,CAAC;AAEH,iDAAiD;AACjD,MAAM,WAAW,wBAAwB;IACxC;;;;;;;;;;;;;;;;;;;OAmBG;IACH,QAAQ,CAAC,kBAAkB,CAAC,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC;IACpD;;;;;OAKG;IACH,QAAQ,CAAC,cAAc,CAAC,EAAE,aAAa,CAAC,gBAAgB,CAAC,CAAC;IAC1D;;;;;;OAMG;IACH,QAAQ,CAAC,YAAY,CAAC,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC;CAC9C;AAqFD;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,uBAAuB,GACnC,QAAQ,sCAAsC,EAC9C,UAAS;IAAC,cAAc,CAAC,EAAE,aAAa,CAAC,MAAM,CAAC,CAAA;CAAM,KACpD,OAAO,CAAC,cAAc,CAcxB,CAAC;AAEF;;;;;;;;;GASG;AACH,eAAO,MAAM,uBAAuB,GACnC,QAAQ,sCAAsC,KAC5C,OAAO,CAAC,cAAc,CAUxB,CAAC;AAEF;;;;;GAKG;AACH,eAAO,MAAM,8BAA8B,MAAM,CAAC;AAuUlD;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,eAAO,MAAM,2BAA2B,GACvC,QAAQ,sCAAsC,EAC9C,UAAU,wBAAwB,KAChC,SA8IF,CAAC"}
+{"version":3,"file":"setup.d.ts","sourceRoot":"../src/lib/","sources":["../../../src/lib/testing/cross_backend/setup.ts"],"names":[],"mappings":"AAAA,OAAO,sBAAsB,CAAC;AA0B9B,OAAO,EAAC,IAAI,EAAC,MAAM,wBAAwB,CAAC;AAK5C,OAAO,KAAK,EAAC,WAAW,EAAC,MAAM,kBAAkB,CAAC;AAClD,OAAO,KAAK,EAAC,mBAAmB,EAAC,MAAM,mBAAmB,CAAC;AAC3D,OAAO,EAAyB,KAAK,cAAc,EAAC,MAAM,kCAAkC,CAAC;AAC7F,OAAO,EAAC,gBAAgB,EAAE,KAAK,cAAc,EAAC,MAAM,yBAAyB,CAAC;AAC9E,OAAO,EAAC,cAAc,EAAC,MAAM,sBAAsB,CAAC;AACpD,OAAO,KAAK,EAAC,aAAa,EAAC,MAAM,oBAAoB,CAAC;AAEtD;;;;;GAKG;AACH,MAAM,WAAW,wBAAwB;IACxC,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,cAAc,CAAC,EAAE,MAAM,CAAC;IACjC,QAAQ,CAAC,KAAK,CAAC,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;IAC/B;;;;;;;OAOG;IACH,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC;CACxB;AAED;;;;;;GAMG;AACH,MAAM,MAAM,kBAAkB,GAAG,WAAW,CAAC;AAE7C;;;;;;;;;;;;GAYG;AACH,MAAM,WAAW,gBAAgB;IAChC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,cAAc,CAAC,EAAE,MAAM,CAAC;IACjC,QAAQ,CAAC,KAAK,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC;CACtC;AAED,sEAAsE;AACtE,MAAM,WAAW,mBAAmB;IACnC,QAAQ,CAAC,OAAO,EAAE;QAAC,QAAQ,CAAC,EAAE,EAAE,IAAI,CAAC;QAAC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAA;KAAC,CAAC;IACjE,QAAQ,CAAC,KAAK,EAAE;QAAC,QAAQ,CAAC,EAAE,EAAE,IAAI,CAAA;KAAC,CAAC;IACpC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;IAChC,QAAQ,CAAC,sBAAsB,EAAE,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,KAAK,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC5F,QAAQ,CAAC,qBAAqB,EAAE,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,KAAK,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CAC3F;AAED;;;;;;;;;;GAUG;AACH,eAAO,MAAM,2BAA2B,GACvC,QAAQ;IACP,OAAO,EAAE;QAAC,EAAE,EAAE,IAAI,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAA;KAAC,CAAC;IACtC,KAAK,EAAE;QAAC,EAAE,EAAE,IAAI,CAAA;KAAC,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;IAClB,cAAc,EAAE,MAAM,CAAC;CACvB,EACD,aAAa,MAAM,KACjB,mBAaD,CAAC;AAEH;;;;;;;;;;;;;GAaG;AACH,MAAM,WAAW,eAAe;IAC/B;;;;;;OAMG;IACH,QAAQ,CAAC,SAAS,EAAE,cAAc,CAAC;IACnC;;;;;;;;;;;;;;;;;;;;;;;OAuBG;IACH,QAAQ,CAAC,eAAe,EAAE,CAAC,OAAO,CAAC,EAAE;QAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;KAAC,KAAK,cAAc,CAAC;IAC1F,+CAA+C;IAC/C,QAAQ,CAAC,OAAO,EAAE;QAAC,QAAQ,CAAC,EAAE,EAAE,IAAI,CAAC;QAAC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAA;KAAC,CAAC;IACjE,8CAA8C;IAC9C,QAAQ,CAAC,KAAK,EAAE;QAAC,QAAQ,CAAC,EAAE,EAAE,IAAI,CAAA;KAAC,CAAC;IACpC,8DAA8D;IAC9D,QAAQ,CAAC,sBAAsB,EAAE,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,KAAK,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC5F,4DAA4D;IAC5D,QAAQ,CAAC,qBAAqB,EAAE,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,KAAK,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC3F,iEAAiE;IACjE,QAAQ,CAAC,2BAA2B,EAAE,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,KAAK,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACjG;;;;;OAKG;IACH,QAAQ,CAAC,cAAc,EAAE,CAAC,OAAO,CAAC,EAAE,wBAAwB,KAAK,OAAO,CAAC,kBAAkB,CAAC,CAAC;IAC7F;;;;;OAKG;IACH,QAAQ,CAAC,cAAc,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,mBAAmB,CAAC,CAAC,CAAC;IACvE;;;;;;;;OAQG;IACH,QAAQ,CAAC,YAAY,EAAE,aAAa,CAAC;QAAC,QAAQ,CAAC,EAAE,EAAE,IAAI,CAAC;QAAC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;KAAC,CAAC,CAAC;IACjF;;;;;;;;;;OAUG;IACH,QAAQ,CAAC,oBAAoB,EAAE,MAAM,OAAO,CAAC,MAAM,CAAC,CAAC;CACrD;AAED;;;;;;;;;;;GAWG;AACH,MAAM,MAAM,WAAW,GAAG,eAAe,CAAC;AAE1C;;;;;GAKG;AACH,MAAM,MAAM,SAAS,GAAG,MAAM,OAAO,CAAC,WAAW,CAAC,CAAC;AAEnD;;;;;;;;;;GAUG;AACH,MAAM,WAAW,iBAAiB;IACjC,wEAAwE;IACxE,QAAQ,CAAC,UAAU,EAAE,SAAS,CAAC;IAC/B,0EAA0E;IAC1E,QAAQ,CAAC,YAAY,EAAE,mBAAmB,CAAC;CAC3C;AAED;;;;;;GAMG;AACH,MAAM,WAAW,wBAAyB,SAAQ,iBAAiB;IAClE,wEAAwE;IACxE,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;CAC3B;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AACH,MAAM,WAAW,yBAA0B,SAAQ,aAAa;IAC/D,iEAAiE;IACjE,QAAQ,CAAC,gBAAgB,EAAE,cAAc,CAAC;IAC1C;;;;;;;;;;OAUG;IACH,QAAQ,CAAC,uBAAuB,EAAE,cAAc,CAAC;IACjD,2DAA2D;IAC3D,QAAQ,CAAC,cAAc,EAAE;QAAC,QAAQ,CAAC,EAAE,EAAE,IAAI,CAAC;QAAC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAA;KAAC,CAAC;IACxE,yDAAyD;IACzD,QAAQ,CAAC,YAAY,EAAE;QAAC,QAAQ,CAAC,EAAE,EAAE,IAAI,CAAA;KAAC,CAAC;IAC3C,wGAAwG;IACxG,QAAQ,CAAC,cAAc,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC;CAC/C;AAED;;;;;;;GAOG;AACH,MAAM,MAAM,sCAAsC,GAAG,IAAI,CACxD,yBAAyB,EACzB,OAAO,GAAG,UAAU,CACpB,CAAC;AAEF;;;;;;;;;;;;;GAaG;AACH,MAAM,WAAW,qCAAqC;IACrD,QAAQ,CAAC,MAAM,EAAE,aAAa,CAAC,QAAQ,CAAC,CAAC;IACzC,QAAQ,CAAC,YAAY,EAAE,aAAa,CAAC,cAAc,CAAC,CAAC;IACrD,QAAQ,CAAC,cAAc,EAAE,yBAAyB,CAAC,gBAAgB,CAAC,CAAC;IACrE,QAAQ,CAAC,YAAY,EAAE,yBAAyB,CAAC,cAAc,CAAC,CAAC;IACjE,QAAQ,CAAC,cAAc,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC;CAC/C;AAED;;;GAGG;AACH,eAAO,MAAM,6BAA6B,GACzC,QAAQ,yBAAyB,KAC/B,qCAMD,CAAC;AAEH;;;;;;;GAOG;AACH,eAAO,MAAM,+BAA+B,GAC3C,YAAY,qCAAqC,KAC/C,sCAmBD,CAAC;AAEH,iDAAiD;AACjD,MAAM,WAAW,wBAAwB;IACxC;;;;;;;;;;;;;;;;;;;OAmBG;IACH,QAAQ,CAAC,kBAAkB,CAAC,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC;IACpD;;;;;OAKG;IACH,QAAQ,CAAC,cAAc,CAAC,EAAE,aAAa,CAAC,gBAAgB,CAAC,CAAC;IAC1D;;;;;;OAMG;IACH,QAAQ,CAAC,YAAY,CAAC,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC;CAC9C;AAqFD;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,uBAAuB,GACnC,QAAQ,sCAAsC,EAC9C,UAAS;IAAC,cAAc,CAAC,EAAE,aAAa,CAAC,MAAM,CAAC,CAAA;CAAM,KACpD,OAAO,CAAC,cAAc,CAcxB,CAAC;AA8BF;;;;;;;;;GASG;AACH,eAAO,MAAM,uBAAuB,GACnC,QAAQ,sCAAsC,KAC5C,OAAO,CAAC,cAAc,CAC8C,CAAC;AAExE;;;;;;;;;;GAUG;AACH,eAAO,MAAM,yBAAyB,GACrC,QAAQ,sCAAsC,KAC5C,OAAO,CAAC,gBAAgB,CACgD,CAAC;AAE5E;;;;;GAKG;AACH,eAAO,MAAM,8BAA8B,MAAM,CAAC;AAuUlD;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,eAAO,MAAM,2BAA2B,GACvC,QAAQ,sCAAsC,EAC9C,UAAU,wBAAwB,KAChC,SA8IF,CAAC"}

package/dist/testing/cross_backend/setup.js

@@ -27,6 +27,7 @@ import { DAEMON_TOKEN_HEADER } from '../../auth/daemon_token.js';
 import { USERNAME_LENGTH_MAX } from '../../primitive_schemas.js';
 import { DEFAULT_TEST_PASSWORD } from '../test_credentials.js';
 import { create_fetch_transport } from '../transports/fetch_transport.js';
+import { MigrationTracker } from '../schema_introspect.js';
 import { ActionManifest } from './action_manifest.js';
 /**
  * Build an `ExtraAccountFixture` from a seeded `{account, actor,
@@ -179,6 +180,22 @@ export const capture_schema_snapshot = async (handle, options = {}) => {
     // reconcile first, so it's left as a follow-up.
     return raw;
 };
+/**
+ * Capture a no-arg daemon-token introspection RPC and validate the wire
+ * response against `schema`. The shared shape behind the parse-based
+ * `capture_*` cross-impl parity probes: call a `_testing_*` introspection
+ * action over the keeper's daemon-token channel, then `parse` so a shape
+ * drift between the TS and Rust answers fails loud at the boundary.
+ *
+ * (`capture_schema_snapshot` deliberately stays separate: it *casts* rather
+ * than parses — narrowing a large snapshot to the Zod model would silently
+ * drop unmodeled fields the parity diff should still see — and it takes an
+ * `exclude_tables` param.)
+ */
+const capture_via_daemon = async (handle, method, schema) => {
+    const raw = await rpc_via_transport(handle.keeper_daemon_transport, handle.config.rpc_path, method, {}, handle.config.name, { [DAEMON_TOKEN_HEADER]: handle.daemon_token });
+    return schema.parse(raw);
+};
 /**
  * Capture a backend's live RPC action manifest over the
  * `_testing_action_manifest` RPC action (keeper daemon-token channel). The
@@ -189,10 +206,19 @@ export const capture_schema_snapshot = async (handle, options = {}) => {
  * own live registry (TS via `build_action_manifest`, Rust via the
  * `fuz_testing` mirror); the normalized shapes match by design.
  */
-export const capture_action_manifest = async (handle) => {
-    const raw = await rpc_via_transport(handle.keeper_daemon_transport, handle.config.rpc_path, '_testing_action_manifest', {}, handle.config.name, { [DAEMON_TOKEN_HEADER]: handle.daemon_token });
-    return ActionManifest.parse(raw);
-};
+export const capture_action_manifest = async (handle) => capture_via_daemon(handle, '_testing_action_manifest', ActionManifest);
+/**
+ * Capture a backend's `schema_version` migration tracker over the
+ * `_testing_migration_tracker` RPC action (keeper daemon-token channel). The
+ * provenance twin of `capture_schema_snapshot` — where that reads the
+ * resulting schema (and excludes the tracker), this reads the tracker rows
+ * themselves. Pair two calls with `assert_migration_trackers_equal`
+ * (`testing/schema_parity.ts`) to gate that the TS spine and the Rust
+ * `testing_spine_stub` record byte-identical migration identity
+ * (`namespace` + `name` + `sequence`) — the invariant the schema-snapshot
+ * gate is blind to.
+ */
+export const capture_migration_tracker = async (handle) => capture_via_daemon(handle, '_testing_migration_tracker', MigrationTracker);
 /**
  * Backdating offset (seconds) the `mint_expired_session` seam passes to
  * `mint_test_session` / `_testing_mint_session`. A minute in the past is

package/dist/testing/cross_backend/testing_backdoor.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"testing_backdoor.d.ts","sourceRoot":"../src/lib/","sources":["../../../src/lib/testing/cross_backend/testing_backdoor.ts"],"names":[],"mappings":"AAAA,OAAO,sBAAsB,CAAC;AA0D9B,OAAO,KAAK,EAAC,wBAAwB,EAAc,MAAM,YAAY,CAAC;AAkEtE,kEAAkE;AAClE,MAAM,MAAM,+BAA+B,GAAG,wBAAwB,CAAC;AAEvE,eAAO,MAAM,qCAAqC,GACjD,SAAS,+BAA+B,KACtC,IAiCF,CAAC"}
+{"version":3,"file":"testing_backdoor.d.ts","sourceRoot":"../src/lib/","sources":["../../../src/lib/testing/cross_backend/testing_backdoor.ts"],"names":[],"mappings":"AAAA,OAAO,sBAAsB,CAAC;AA2D9B,OAAO,KAAK,EAAC,wBAAwB,EAAc,MAAM,YAAY,CAAC;AAqEtE,kEAAkE;AAClE,MAAM,MAAM,+BAA+B,GAAG,wBAAwB,CAAC;AAEvE,eAAO,MAAM,qCAAqC,GACjD,SAAS,+BAA+B,KACtC,IAiCF,CAAC"}

package/dist/testing/cross_backend/testing_backdoor.js

@@ -4,10 +4,11 @@ import '../assert_dev_env.js';
  * actions.
  *
  * `_testing_reset` / `_testing_mint_session` / `_testing_put_fact` /
- * `_testing_schema_snapshot` / `_testing_action_manifest` are privileged
- * test-binary actions the production wire never exposes — three direct DB
- * writes (full auth wipe, forged session row, raw fact insert) plus two
- * introspection reads (the live schema + the live RPC registry, the highest
+ * `_testing_schema_snapshot` / `_testing_migration_tracker` /
+ * `_testing_action_manifest` are privileged test-binary actions the production
+ * wire never exposes — three direct DB writes (full auth wipe, forged session
+ * row, raw fact insert) plus three introspection reads (the live schema, the
+ * `schema_version` migration tracker, and the live RPC registry — the highest
  * info-leak of the set were the gate to break). Their only structural fence
  * is the **daemon-token** credential gate on
  * each spec's `auth` axis. A test binary live-mounts them on its RPC
@@ -67,6 +68,9 @@ const backdoor_methods = [
     // The schema-dump read — `exclude_tables` is optional, so `{}` is valid
     // and clears the 400 phase like the writes above.
     { method: '_testing_schema_snapshot', params: {} },
+    // The migration-tracker-dump read — input is an empty strict object, so `{}`
+    // is valid and clears the 400 phase, reaching the credential gate like the rest.
+    { method: '_testing_migration_tracker', params: {} },
     // The RPC-registry-dump read — input is an empty strict object, so `{}` is
     // valid and clears the 400 phase, reaching the credential gate like the rest.
     { method: '_testing_action_manifest', params: {} },

package/dist/testing/cross_backend/testing_reset_actions.d.ts

@@ -2,15 +2,18 @@ import '../assert_dev_env.js';
 /**
  * Test-binary RPC actions for cross-process integration tests.
  *
- * Five daemon-token-authed actions, bundled by `create_testing_actions`:
+ * Six daemon-token-authed actions, bundled by `create_testing_actions`:
  * **`_testing_reset`** (DB wipe + keeper re-seed), **`_testing_drain_effects`**
  * (audit barrier), **`_testing_mint_session`** (forge an
  * expired-by-construction server-side session for the expiry conformance
  * cases), **`_testing_put_fact`** (seed an embedded fact for the fact-serving
- * suite), and **`_testing_schema_snapshot`** (introspect the live schema for
- * cross-impl parity diffing against a Rust backend's `fuz_db` snapshot).
+ * suite), **`_testing_schema_snapshot`** (introspect the live schema for
+ * cross-impl parity diffing against a Rust backend's `fuz_db` snapshot), and
+ * **`_testing_migration_tracker`** (dump the `schema_version` tracker rows for
+ * cross-impl migration-identity parity — the provenance half the snapshot gate
+ * excludes by design).
  *
- * A sixth daemon-token action, **`_testing_action_manifest`** (dump the live
+ * A further daemon-token action, **`_testing_action_manifest`** (dump the live
  * RPC registry for cross-impl method-set + auth-shape parity), lives here too
  * but is **not** bundled by `create_testing_actions` — it must enumerate
  * *every* mounted method, so it's appended at the full-mount layer
@@ -336,6 +339,47 @@ export declare const testing_schema_snapshot_action_spec: {
  * `create_testing_actions`; mount directly for in-process use.
  */
 export declare const create_testing_schema_snapshot_action: () => RpcAction;
+/**
+ * `_testing_migration_tracker` — dump the `schema_version` tracker rows as a
+ * normalized `MigrationTracker` (`[{namespace, name, sequence}]`) for
+ * cross-impl migration-identity diffing. The provenance half of
+ * `_testing_schema_snapshot`: where that captures the resulting *schema*
+ * (and excludes the tracker by design), this captures the tracker *itself*,
+ * so the cross-backend harness can assert the two spines record byte-identical
+ * migration identity. This closes the gap that let the cell/fact
+ * migration-name divergence reach the visiones cutover undetected
+ * (`name-divergence-at-N` — same schema, divergent recorded names).
+ *
+ * `auth` gates on the daemon-token credential, matching `_testing_reset`. The
+ * Rust mirror is `fuz_testing::create_testing_migration_tracker_action_spec`.
+ */
+export declare const testing_migration_tracker_action_spec: {
+    readonly method: "_testing_migration_tracker";
+    readonly kind: "request_response";
+    readonly initiator: "frontend";
+    readonly auth: {
+        readonly account: "required";
+        readonly actor: "none";
+        readonly credential_types: readonly ["daemon_token"];
+    };
+    readonly side_effects: false;
+    readonly input: z.ZodObject<{}, z.core.$strict>;
+    readonly output: z.ZodObject<{
+        entries: z.ZodArray<z.ZodObject<{
+            namespace: z.ZodString;
+            name: z.ZodString;
+            sequence: z.ZodNumber;
+        }, z.core.$strip>>;
+    }, z.core.$strip>;
+    readonly async: true;
+    readonly description: string;
+};
+/**
+ * Build the standalone `_testing_migration_tracker` action. No deps — reads
+ * `ctx.db`'s `schema_version` via `query_migration_tracker`. Bundled by
+ * `create_testing_actions`; mount directly for in-process use.
+ */
+export declare const create_testing_migration_tracker_action: () => RpcAction;
 /**
  * `_testing_action_manifest` — dump the backend's live RPC method set as a
  * normalized `ActionManifest` (one entry per method: `{method, side_effects,

package/dist/testing/cross_backend/testing_reset_actions.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"testing_reset_actions.d.ts","sourceRoot":"../src/lib/","sources":["../../../src/lib/testing/cross_backend/testing_reset_actions.ts"],"names":[],"mappings":"AAAA,OAAO,sBAAsB,CAAC;AAE9B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiEG;AAEH,OAAO,EAAC,CAAC,EAAC,MAAM,KAAK,CAAC;AAItB,OAAO,EAAa,KAAK,SAAS,EAAC,MAAM,6BAA6B,CAAC;AAKvE,OAAO,KAAK,EAAC,OAAO,EAAC,MAAM,oBAAoB,CAAC;AAChD,OAAO,KAAK,EAAC,cAAc,EAAC,MAAM,8BAA8B,CAAC;AACjE,OAAO,KAAK,EAAC,gBAAgB,EAAC,MAAM,4BAA4B,CAAC;AACjE,OAAO,KAAK,EAAC,EAAE,EAAC,MAAM,gBAAgB,CAAC;AAgCvC;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,eAAO,MAAM,yBAAyB;;;;;;;;;;;;;;;;;QAiBpC;;;;;;;;WAQG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAWyC,CAAC;AAE/C;;;;;;;;;;;;;;;GAeG;AACH,eAAO,MAAM,iCAAiC;;;;;;;;;;;;;;;;CAWA,CAAC;AAE/C;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AACH,eAAO,MAAM,gCAAgC;;;;;;;;;;;;;;;;;;;CAwBC,CAAC;AAE/C;;;;;;GAMG;AACH,eAAO,MAAM,mCAAmC,QAAO,SACiB,CAAC;AAEzE;;;;;;;;;;;;;GAaG;AACH,eAAO,MAAM,4BAA4B;;;;;;;;;;;;;;;;;;;CAeK,CAAC;AAE/C;;;;;;;;;GASG;AACH,eAAO,MAAM,mCAAmC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAWF,CAAC;AAE/C;;;;GAIG;AACH,eAAO,MAAM,qCAAqC,QAAO,SAGvD,CAAC;AAEH;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,eAAO,MAAM,mCAAmC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAYF,CAAC;AAyB/C,eAAO,MAAM,qCAAqC,GACjD,SAAS,aAAa,CAAC,SAAS,CAAC,KAC/B,SAMF,CAAC;AAEF,4CAA4C;AAC5C,MAAM,WAAW,2BAA2B;IAC3C;;;;;OAKG;IACH,QAAQ,CAAC,eAAe,EAAE,cAAc,CAAC,MAAM,CAAC,CAAC;IACjD;;;;;OAKG;IACH,QAAQ,CAAC,kBAAkB,EAAE,gBAAgB,CAAC;IAC9C;;;;;;;;;;;OAWG;IACH,QAAQ,CAAC,WAAW,CAAC,EAAE,CAAC,EAAE,EAAE,EAAE,KAAK,OAAO,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC;CACxD;AAED;;;;;;;;;;;;;GAaG;AACH,eAAO,MAAM,sBAAsB,GAClC,MAAM,OAAO,EACb,SAAS,2BAA2B,KAClC,KAAK,CAAC,SAAS,CAqIjB,CAAC;AAEF,0FAA0F;AAC1F,eAAO,MAAM,0BAA0B,UAAmC,CAAC"}
+{"version":3,"file":"testing_reset_actions.d.ts","sourceRoot":"../src/lib/","sources":["../../../src/lib/testing/cross_backend/testing_reset_actions.ts"],"names":[],"mappings":"AAAA,OAAO,sBAAsB,CAAC;AAE9B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAoEG;AAEH,OAAO,EAAC,CAAC,EAAC,MAAM,KAAK,CAAC;AAItB,OAAO,EAAa,KAAK,SAAS,EAAC,MAAM,6BAA6B,CAAC;AAKvE,OAAO,KAAK,EAAC,OAAO,EAAC,MAAM,oBAAoB,CAAC;AAChD,OAAO,KAAK,EAAC,cAAc,EAAC,MAAM,8BAA8B,CAAC;AACjE,OAAO,KAAK,EAAC,gBAAgB,EAAC,MAAM,4BAA4B,CAAC;AACjE,OAAO,KAAK,EAAC,EAAE,EAAC,MAAM,gBAAgB,CAAC;AAqCvC;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,eAAO,MAAM,yBAAyB;;;;;;;;;;;;;;;;;QAiBpC;;;;;;;;WAQG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAWyC,CAAC;AAE/C;;;;;;;;;;;;;;;GAeG;AACH,eAAO,MAAM,iCAAiC;;;;;;;;;;;;;;;;CAWA,CAAC;AAE/C;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AACH,eAAO,MAAM,gCAAgC;;;;;;;;;;;;;;;;;;;CAwBC,CAAC;AAE/C;;;;;;GAMG;AACH,eAAO,MAAM,mCAAmC,QAAO,SACiB,CAAC;AAEzE;;;;;;;;;;;;;GAaG;AACH,eAAO,MAAM,4BAA4B;;;;;;;;;;;;;;;;;;;CAeK,CAAC;AAE/C;;;;;;;;;GASG;AACH,eAAO,MAAM,mCAAmC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAWF,CAAC;AAE/C;;;;GAIG;AACH,eAAO,MAAM,qCAAqC,QAAO,SAGvD,CAAC;AAEH;;;;;;;;;;;;;GAaG;AACH,eAAO,MAAM,qCAAqC;;;;;;;;;;;;;;;;;;;;CAYJ,CAAC;AAE/C;;;;GAIG;AACH,eAAO,MAAM,uCAAuC,QAAO,SAGzD,CAAC;AAEH;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,eAAO,MAAM,mCAAmC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAYF,CAAC;AAyB/C,eAAO,MAAM,qCAAqC,GACjD,SAAS,aAAa,CAAC,SAAS,CAAC,KAC/B,SAMF,CAAC;AAEF,4CAA4C;AAC5C,MAAM,WAAW,2BAA2B;IAC3C;;;;;OAKG;IACH,QAAQ,CAAC,eAAe,EAAE,cAAc,CAAC,MAAM,CAAC,CAAC;IACjD;;;;;OAKG;IACH,QAAQ,CAAC,kBAAkB,EAAE,gBAAgB,CAAC;IAC9C;;;;;;;;;;;OAWG;IACH,QAAQ,CAAC,WAAW,CAAC,EAAE,CAAC,EAAE,EAAE,EAAE,KAAK,OAAO,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC;CACxD;AAED;;;;;;;;;;;;;GAaG;AACH,eAAO,MAAM,sBAAsB,GAClC,MAAM,OAAO,EACb,SAAS,2BAA2B,KAClC,KAAK,CAAC,SAAS,CAsIjB,CAAC;AAEF,0FAA0F;AAC1F,eAAO,MAAM,0BAA0B,UAAmC,CAAC"}

package/dist/testing/cross_backend/testing_reset_actions.js

@@ -2,15 +2,18 @@ import '../assert_dev_env.js';
 /**
  * Test-binary RPC actions for cross-process integration tests.
  *
- * Five daemon-token-authed actions, bundled by `create_testing_actions`:
+ * Six daemon-token-authed actions, bundled by `create_testing_actions`:
  * **`_testing_reset`** (DB wipe + keeper re-seed), **`_testing_drain_effects`**
  * (audit barrier), **`_testing_mint_session`** (forge an
  * expired-by-construction server-side session for the expiry conformance
  * cases), **`_testing_put_fact`** (seed an embedded fact for the fact-serving
- * suite), and **`_testing_schema_snapshot`** (introspect the live schema for
- * cross-impl parity diffing against a Rust backend's `fuz_db` snapshot).
+ * suite), **`_testing_schema_snapshot`** (introspect the live schema for
+ * cross-impl parity diffing against a Rust backend's `fuz_db` snapshot), and
+ * **`_testing_migration_tracker`** (dump the `schema_version` tracker rows for
+ * cross-impl migration-identity parity — the provenance half the snapshot gate
+ * excludes by design).
  *
- * A sixth daemon-token action, **`_testing_action_manifest`** (dump the live
+ * A further daemon-token action, **`_testing_action_manifest`** (dump the live
  * RPC registry for cross-impl method-set + auth-shape parity), lives here too
  * but is **not** bundled by `create_testing_actions` — it must enumerate
  * *every* mounted method, so it's appended at the full-mount layer
@@ -73,7 +76,7 @@ import { protocol_action_specs } from '../../actions/protocol.js';
 import { query_put_fact } from '../../db/fact_queries.js';
 import { ROLE_ADMIN, ROLE_KEEPER } from '../../auth/role_schema.js';
 import { auth_integration_truncate_tables } from '../db.js';
-import { query_schema_snapshot, SchemaSnapshot } from '../schema_introspect.js';
+import { query_schema_snapshot, SchemaSnapshot, query_migration_tracker, MigrationTracker, } from '../schema_introspect.js';
 import { ActionManifest, build_action_manifest } from './action_manifest.js';
 import { query_create_actor } from '../../auth/account_queries.js';
 import { create_test_account_with_credentials, mint_test_session } from '../app_server.js';
@@ -302,6 +305,38 @@ export const testing_schema_snapshot_action_spec = {
  * `create_testing_actions`; mount directly for in-process use.
  */
 export const create_testing_schema_snapshot_action = () => rpc_action(testing_schema_snapshot_action_spec, async (input, ctx) => query_schema_snapshot(ctx.db, { exclude_tables: input.exclude_tables }));
+/**
+ * `_testing_migration_tracker` — dump the `schema_version` tracker rows as a
+ * normalized `MigrationTracker` (`[{namespace, name, sequence}]`) for
+ * cross-impl migration-identity diffing. The provenance half of
+ * `_testing_schema_snapshot`: where that captures the resulting *schema*
+ * (and excludes the tracker by design), this captures the tracker *itself*,
+ * so the cross-backend harness can assert the two spines record byte-identical
+ * migration identity. This closes the gap that let the cell/fact
+ * migration-name divergence reach the visiones cutover undetected
+ * (`name-divergence-at-N` — same schema, divergent recorded names).
+ *
+ * `auth` gates on the daemon-token credential, matching `_testing_reset`. The
+ * Rust mirror is `fuz_testing::create_testing_migration_tracker_action_spec`.
+ */
+export const testing_migration_tracker_action_spec = {
+    method: '_testing_migration_tracker',
+    kind: 'request_response',
+    initiator: 'frontend',
+    auth: TESTING_ACTION_AUTH,
+    side_effects: false,
+    input: z.strictObject({}),
+    output: MigrationTracker,
+    async: true,
+    description: 'Test-binary only — dump the schema_version tracker rows as a normalized {namespace, name, ' +
+        'sequence} list for cross-impl migration-identity parity diffing.',
+};
+/**
+ * Build the standalone `_testing_migration_tracker` action. No deps — reads
+ * `ctx.db`'s `schema_version` via `query_migration_tracker`. Bundled by
+ * `create_testing_actions`; mount directly for in-process use.
+ */
+export const create_testing_migration_tracker_action = () => rpc_action(testing_migration_tracker_action_spec, async (_input, ctx) => query_migration_tracker(ctx.db));
 /**
  * `_testing_action_manifest` — dump the backend's live RPC method set as a
  * normalized `ActionManifest` (one entry per method: `{method, side_effects,
@@ -495,6 +530,7 @@ export const create_testing_actions = (deps, options) => {
         }),
         create_testing_drain_effects_action(),
         create_testing_schema_snapshot_action(),
+        create_testing_migration_tracker_action(),
     ];
 };
 /** Set of auth-namespace tables `_testing_reset` wipes. Mirrored by the coverage test. */

package/dist/testing/schema_introspect.d.ts

@@ -109,6 +109,45 @@ export declare const SchemaSnapshot: z.ZodObject<{
     }, z.core.$strip>>;
 }, z.core.$strip>;
 export type SchemaSnapshot = z.infer<typeof SchemaSnapshot>;
+/**
+ * A single `schema_version` tracker row — the migration-identity primitive.
+ *
+ * Where `SchemaSnapshot` is provenance-agnostic (it captures the resulting
+ * tables and deliberately *excludes* the tracker), this **is** the tracker:
+ * the `(namespace, name, sequence)` the migration runner records per applied
+ * migration. `sequence` carries order; `name` carries identity (the PK is
+ * `(namespace, name)`). The cross-impl gate diffs these between the two
+ * bootstrapped spines so a migration-name or partitioning drift — invisible
+ * to the schema snapshot — is a gated fact, not a latent interop break.
+ */
+export declare const MigrationTrackerEntry: z.ZodObject<{
+    namespace: z.ZodString;
+    name: z.ZodString;
+    sequence: z.ZodNumber;
+}, z.core.$strip>;
+export type MigrationTrackerEntry = z.infer<typeof MigrationTrackerEntry>;
+/**
+ * The full `schema_version` tracker as a deterministically-ordered list,
+ * wrapped in an object so it round-trips cleanly as a JSON-RPC result.
+ * Sorted by `(namespace, sequence)` on capture.
+ */
+export declare const MigrationTracker: z.ZodObject<{
+    entries: z.ZodArray<z.ZodObject<{
+        namespace: z.ZodString;
+        name: z.ZodString;
+        sequence: z.ZodNumber;
+    }, z.core.$strip>>;
+}, z.core.$strip>;
+export type MigrationTracker = z.infer<typeof MigrationTracker>;
+/**
+ * Read every `schema_version` row into a deterministic `MigrationTracker`.
+ *
+ * The migration-identity twin of `query_schema_snapshot`: that captures the
+ * resulting schema (and excludes this tracker); this captures the tracker
+ * rows themselves, so the cross-impl gate can assert the two spines record
+ * byte-identical migration identity.
+ */
+export declare const query_migration_tracker: (db: Db) => Promise<MigrationTracker>;
 /** Filter options for `query_schema_snapshot`. */
 export interface QuerySchemaSnapshotOptions {
     /**

package/dist/testing/schema_introspect.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"schema_introspect.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/testing/schema_introspect.ts"],"names":[],"mappings":"AAAA,OAAO,qBAAqB,CAAC;AAE7B;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAEH,OAAO,EAAC,CAAC,EAAC,MAAM,KAAK,CAAC;AAEtB,OAAO,KAAK,EAAC,EAAE,EAAC,MAAM,aAAa,CAAC;AAEpC;;;;;GAKG;AACH,eAAO,MAAM,cAAc;;;;;;iBAWzB,CAAC;AACH,MAAM,MAAM,cAAc,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,cAAc,CAAC,CAAC;AAE5D,qCAAqC;AACrC,eAAO,MAAM,aAAa;;;;;;;;;;;;;;;;;iBAOxB,CAAC;AACH,MAAM,MAAM,aAAa,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,aAAa,CAAC,CAAC;AAE1D,qFAAqF;AACrF,eAAO,MAAM,gBAAgB;;iBAE3B,CAAC;AACH,MAAM,MAAM,gBAAgB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,gBAAgB,CAAC,CAAC;AAEhE;;;;;GAKG;AACH,eAAO,MAAM,gBAAgB;;iBAG3B,CAAC;AACH,MAAM,MAAM,gBAAgB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,gBAAgB,CAAC,CAAC;AAEhE;;;;;;;;GAQG;AACH,eAAO,MAAM,cAAc;;;;;;;;;;;;;;;;;;;;;;;;;iBAOzB,CAAC;AACH,MAAM,MAAM,cAAc,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,cAAc,CAAC,CAAC;AAE5D,kDAAkD;AAClD,MAAM,WAAW,0BAA0B;IAC1C;;;OAGG;IACH,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IACzB;;;;;OAKG;IACH,QAAQ,CAAC,cAAc,CAAC,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC;CAChD;AA8DD;;;;;;;;;GASG;AACH,eAAO,MAAM,qBAAqB,GACjC,IAAI,EAAE,EACN,UAAS,0BAA+B,KACtC,OAAO,CAAC,cAAc,CAyHxB,CAAC"}
+{"version":3,"file":"schema_introspect.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/testing/schema_introspect.ts"],"names":[],"mappings":"AAAA,OAAO,qBAAqB,CAAC;AAE7B;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAEH,OAAO,EAAC,CAAC,EAAC,MAAM,KAAK,CAAC;AAEtB,OAAO,KAAK,EAAC,EAAE,EAAC,MAAM,aAAa,CAAC;AAEpC;;;;;GAKG;AACH,eAAO,MAAM,cAAc;;;;;;iBAWzB,CAAC;AACH,MAAM,MAAM,cAAc,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,cAAc,CAAC,CAAC;AAE5D,qCAAqC;AACrC,eAAO,MAAM,aAAa;;;;;;;;;;;;;;;;;iBAOxB,CAAC;AACH,MAAM,MAAM,aAAa,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,aAAa,CAAC,CAAC;AAE1D,qFAAqF;AACrF,eAAO,MAAM,gBAAgB;;iBAE3B,CAAC;AACH,MAAM,MAAM,gBAAgB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,gBAAgB,CAAC,CAAC;AAEhE;;;;;GAKG;AACH,eAAO,MAAM,gBAAgB;;iBAG3B,CAAC;AACH,MAAM,MAAM,gBAAgB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,gBAAgB,CAAC,CAAC;AAEhE;;;;;;;;GAQG;AACH,eAAO,MAAM,cAAc;;;;;;;;;;;;;;;;;;;;;;;;;iBAOzB,CAAC;AACH,MAAM,MAAM,cAAc,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,cAAc,CAAC,CAAC;AAE5D;;;;;;;;;;GAUG;AACH,eAAO,MAAM,qBAAqB;;;;iBAOhC,CAAC;AACH,MAAM,MAAM,qBAAqB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,qBAAqB,CAAC,CAAC;AAE1E;;;;GAIG;AACH,eAAO,MAAM,gBAAgB;;;;;;iBAE3B,CAAC;AACH,MAAM,MAAM,gBAAgB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,gBAAgB,CAAC,CAAC;AAEhE;;;;;;;GAOG;AACH,eAAO,MAAM,uBAAuB,GAAU,IAAI,EAAE,KAAG,OAAO,CAAC,gBAAgB,CAa9E,CAAC;AAEF,kDAAkD;AAClD,MAAM,WAAW,0BAA0B;IAC1C;;;OAGG;IACH,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IACzB;;;;;OAKG;IACH,QAAQ,CAAC,cAAc,CAAC,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC;CAChD;AA8DD;;;;;;;;;GASG;AACH,eAAO,MAAM,qBAAqB,GACjC,IAAI,EAAE,EACN,UAAS,0BAA+B,KACtC,OAAO,CAAC,cAAc,CAyHxB,CAAC"}

package/dist/testing/schema_introspect.js

@@ -81,6 +81,53 @@ export const SchemaSnapshot = z.object({
     /** Enum types (`CREATE TYPE ... AS ENUM`) keyed by name; labels in declared order. */
     enums: z.record(z.string(), EnumTypeSnapshot),
 });
+/**
+ * A single `schema_version` tracker row — the migration-identity primitive.
+ *
+ * Where `SchemaSnapshot` is provenance-agnostic (it captures the resulting
+ * tables and deliberately *excludes* the tracker), this **is** the tracker:
+ * the `(namespace, name, sequence)` the migration runner records per applied
+ * migration. `sequence` carries order; `name` carries identity (the PK is
+ * `(namespace, name)`). The cross-impl gate diffs these between the two
+ * bootstrapped spines so a migration-name or partitioning drift — invisible
+ * to the schema snapshot — is a gated fact, not a latent interop break.
+ */
+export const MigrationTrackerEntry = z.object({
+    /** Migration namespace (e.g. `fuz_cell`, `fuz_cell_history`). */
+    namespace: z.string(),
+    /** Migration name within the namespace (e.g. `full_cell_schema`). */
+    name: z.string(),
+    /** Per-namespace apply order, starting at 0. */
+    sequence: z.number().int(),
+});
+/**
+ * The full `schema_version` tracker as a deterministically-ordered list,
+ * wrapped in an object so it round-trips cleanly as a JSON-RPC result.
+ * Sorted by `(namespace, sequence)` on capture.
+ */
+export const MigrationTracker = z.object({
+    entries: z.array(MigrationTrackerEntry),
+});
+/**
+ * Read every `schema_version` row into a deterministic `MigrationTracker`.
+ *
+ * The migration-identity twin of `query_schema_snapshot`: that captures the
+ * resulting schema (and excludes this tracker); this captures the tracker
+ * rows themselves, so the cross-impl gate can assert the two spines record
+ * byte-identical migration identity.
+ */
+export const query_migration_tracker = async (db) => {
+    const rows = await db.query(`SELECT namespace, name, sequence
+		 FROM schema_version
+		 ORDER BY namespace ASC, sequence ASC`);
+    return {
+        entries: rows.map((r) => ({
+            namespace: r.namespace,
+            name: r.name,
+            sequence: r.sequence,
+        })),
+    };
+};
 const sort_keys = (record) => {
     const sorted = {};
     for (const key of Object.keys(record).sort()) {

package/dist/testing/schema_parity.d.ts

@@ -39,7 +39,7 @@ import './assert_dev_env.js';
  *
  * @module
  */
-import type { ColumnSnapshot, SchemaSnapshot } from './schema_introspect.js';
+import type { ColumnSnapshot, MigrationTracker, SchemaSnapshot } from './schema_introspect.js';
 /** Structured drift entry. `where` is the named source impl ('a' or 'b'). */
 export type SchemaDiff = {
     readonly kind: 'table_only_in';
@@ -139,4 +139,45 @@ export declare const format_schema_diffs: (diffs: ReadonlyArray<SchemaDiff>, lab
  * ```
  */
 export declare const assert_schema_snapshots_equal: (a: SchemaSnapshot, b: SchemaSnapshot, labels?: SchemaDiffLabels) => void;
+/**
+ * Structured migration-identity drift entry. Keyed on `(namespace, name)` —
+ * the `schema_version` PK — so a name rename and a partitioning change both
+ * surface as `tracker_row_only_in`, and a re-order surfaces as
+ * `tracker_sequence_differs`.
+ */
+export type MigrationTrackerDiff = {
+    readonly kind: 'tracker_row_only_in';
+    readonly where: 'a' | 'b';
+    readonly namespace: string;
+    readonly name: string;
+} | {
+    readonly kind: 'tracker_sequence_differs';
+    readonly namespace: string;
+    readonly name: string;
+    readonly a: number;
+    readonly b: number;
+};
+/**
+ * Structural diff between two migration trackers — empty array means the two
+ * spines recorded byte-identical migration identity. Keyed on
+ * `(namespace, name)`; sequence mismatches on a shared key are reported too.
+ * Deterministic order: shared/missing rows in sorted `(namespace, name)` order.
+ */
+export declare const diff_migration_trackers: (a: MigrationTracker, b: MigrationTracker) => Array<MigrationTrackerDiff>;
+/**
+ * Render migration-tracker diffs as a human-readable multi-line string.
+ * Empty diffs produce an empty string.
+ */
+export declare const format_migration_tracker_diffs: (diffs: ReadonlyArray<MigrationTrackerDiff>, labels?: SchemaDiffLabels) => string;
+/**
+ * Throw if the two spines' `schema_version` trackers disagree — the gate for
+ * the swap-freely invariant (any consumer can swap TS↔Rust over one DB without
+ * re-bootstrapping). This catches what `assert_schema_snapshots_equal` is blind
+ * to by design: the snapshot excludes the tracker, so a migration-name or
+ * partitioning divergence that yields an identical *schema* (e.g. `cell_v0` vs
+ * `full_cell_schema`, or `cell_history` bundled vs isolated) passes schema
+ * parity but breaks the runner's positional name-prefix check at boot
+ * (`name-divergence-at-N`). The error names the impls and lists every diff.
+ */
+export declare const assert_migration_trackers_equal: (a: MigrationTracker, b: MigrationTracker, labels?: SchemaDiffLabels) => void;
 //# sourceMappingURL=schema_parity.d.ts.map

package/dist/testing/schema_parity.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"schema_parity.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/testing/schema_parity.ts"],"names":[],"mappings":"AAAA,OAAO,qBAAqB,CAAC;AAE7B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAuCG;AAEH,OAAO,KAAK,EACX,cAAc,EAEd,cAAc,EAGd,MAAM,wBAAwB,CAAC;AAEhC,6EAA6E;AAC7E,MAAM,MAAM,UAAU,GACnB;IAAC,QAAQ,CAAC,IAAI,EAAE,eAAe,CAAC;IAAC,QAAQ,CAAC,KAAK,EAAE,GAAG,GAAG,GAAG,CAAC;IAAC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;CAAC,GACnF;IACA,QAAQ,CAAC,IAAI,EAAE,gBAAgB,CAAC;IAChC,QAAQ,CAAC,KAAK,EAAE,GAAG,GAAG,GAAG,CAAC;IAC1B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;CACvB,GACD;IACA,QAAQ,CAAC,IAAI,EAAE,sBAAsB,CAAC;IACtC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,KAAK,EAAE,MAAM,cAAc,CAAC;IACrC,QAAQ,CAAC,CAAC,EAAE,OAAO,CAAC;IACpB,QAAQ,CAAC,CAAC,EAAE,OAAO,CAAC;CACnB,GACD;IACA,QAAQ,CAAC,IAAI,EAAE,eAAe,CAAC;IAC/B,QAAQ,CAAC,KAAK,EAAE,GAAG,GAAG,GAAG,CAAC;IAC1B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;CACtB,GACD;IACA,QAAQ,CAAC,IAAI,EAAE,0BAA0B,CAAC;IAC1C,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,CAAC,EAAE,MAAM,CAAC;IACnB,QAAQ,CAAC,CAAC,EAAE,MAAM,CAAC;CAClB,GACD;IACA,QAAQ,CAAC,IAAI,EAAE,oBAAoB,CAAC;IACpC,QAAQ,CAAC,KAAK,EAAE,GAAG,GAAG,GAAG,CAAC;IAC1B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;CAC3B,GACD;IACA,QAAQ,CAAC,IAAI,EAAE,oBAAoB,CAAC;IACpC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,CAAC,EAAE;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,UAAU,EAAE,MAAM,CAAA;KAAC,CAAC;IAC/C,QAAQ,CAAC,CAAC,EAAE;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,UAAU,EAAE,MAAM,CAAA;KAAC,CAAC;CAC9C,GACD;IAAC,QAAQ,CAAC,IAAI,EAAE,kBAAkB,CAAC;IAAC,QAAQ,CAAC,KAAK,EAAE,GAAG,GAAG,GAAG,CAAC;IAAC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAA;CAAC,GACzF;IACA,QAAQ,CAAC,IAAI,EAAE,4BAA4B,CAAC;IAC5C,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,CAAC,EAAE,MAAM,CAAC;IACnB,QAAQ,CAAC,CAAC,EAAE,MAAM,CAAC;CAClB,GACD;IAAC,QAAQ,CAAC,IAAI,EAAE,cAAc,CAAC;IAAC,QAAQ,CAAC,KAAK,EAAE,GAAG,GAAG,GAAG,CAAC;IAAC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;CAAC,GACtF;IACA,QAAQ,CAAC,IAAI,EAAE,oBAAoB,CAAC;IACpC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,CAAC,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC;IAClC,QAAQ,CAAC,CAAC,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC;CACjC,CAAC;AAEL;;;;;;GAMG;AACH,eAAO,MAAM,qBAAqB,GAAI,GAAG,cAAc,EAAE,GAAG,cAAc,KAAG,KAAK,CAAC,UAAU,CAiD5F,CAAC;AAqHF,qEAAqE;AACrE,MAAM,WAAW,gBAAgB;IAChC,QAAQ,CAAC,CAAC,CAAC,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,CAAC,CAAC,EAAE,MAAM,CAAC;CACpB;AAED;;;GAGG;AACH,eAAO,MAAM,mBAAmB,GAC/B,OAAO,aAAa,CAAC,UAAU,CAAC,EAChC,SAAQ,gBAAqB,KAC3B,MAoEF,CAAC;AAEF;;;;;;;;;;;;;;;GAeG;AACH,eAAO,MAAM,6BAA6B,GACzC,GAAG,cAAc,EACjB,GAAG,cAAc,EACjB,SAAQ,gBAAqB,KAC3B,IAUF,CAAC"}
+{"version":3,"file":"schema_parity.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/testing/schema_parity.ts"],"names":[],"mappings":"AAAA,OAAO,qBAAqB,CAAC;AAE7B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAuCG;AAEH,OAAO,KAAK,EACX,cAAc,EAEd,gBAAgB,EAChB,cAAc,EAGd,MAAM,wBAAwB,CAAC;AAEhC,6EAA6E;AAC7E,MAAM,MAAM,UAAU,GACnB;IAAC,QAAQ,CAAC,IAAI,EAAE,eAAe,CAAC;IAAC,QAAQ,CAAC,KAAK,EAAE,GAAG,GAAG,GAAG,CAAC;IAAC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;CAAC,GACnF;IACA,QAAQ,CAAC,IAAI,EAAE,gBAAgB,CAAC;IAChC,QAAQ,CAAC,KAAK,EAAE,GAAG,GAAG,GAAG,CAAC;IAC1B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;CACvB,GACD;IACA,QAAQ,CAAC,IAAI,EAAE,sBAAsB,CAAC;IACtC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,KAAK,EAAE,MAAM,cAAc,CAAC;IACrC,QAAQ,CAAC,CAAC,EAAE,OAAO,CAAC;IACpB,QAAQ,CAAC,CAAC,EAAE,OAAO,CAAC;CACnB,GACD;IACA,QAAQ,CAAC,IAAI,EAAE,eAAe,CAAC;IAC/B,QAAQ,CAAC,KAAK,EAAE,GAAG,GAAG,GAAG,CAAC;IAC1B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;CACtB,GACD;IACA,QAAQ,CAAC,IAAI,EAAE,0BAA0B,CAAC;IAC1C,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,CAAC,EAAE,MAAM,CAAC;IACnB,QAAQ,CAAC,CAAC,EAAE,MAAM,CAAC;CAClB,GACD;IACA,QAAQ,CAAC,IAAI,EAAE,oBAAoB,CAAC;IACpC,QAAQ,CAAC,KAAK,EAAE,GAAG,GAAG,GAAG,CAAC;IAC1B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;CAC3B,GACD;IACA,QAAQ,CAAC,IAAI,EAAE,oBAAoB,CAAC;IACpC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,CAAC,EAAE;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,UAAU,EAAE,MAAM,CAAA;KAAC,CAAC;IAC/C,QAAQ,CAAC,CAAC,EAAE;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,UAAU,EAAE,MAAM,CAAA;KAAC,CAAC;CAC9C,GACD;IAAC,QAAQ,CAAC,IAAI,EAAE,kBAAkB,CAAC;IAAC,QAAQ,CAAC,KAAK,EAAE,GAAG,GAAG,GAAG,CAAC;IAAC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAA;CAAC,GACzF;IACA,QAAQ,CAAC,IAAI,EAAE,4BAA4B,CAAC;IAC5C,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,CAAC,EAAE,MAAM,CAAC;IACnB,QAAQ,CAAC,CAAC,EAAE,MAAM,CAAC;CAClB,GACD;IAAC,QAAQ,CAAC,IAAI,EAAE,cAAc,CAAC;IAAC,QAAQ,CAAC,KAAK,EAAE,GAAG,GAAG,GAAG,CAAC;IAAC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;CAAC,GACtF;IACA,QAAQ,CAAC,IAAI,EAAE,oBAAoB,CAAC;IACpC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,CAAC,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC;IAClC,QAAQ,CAAC,CAAC,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC;CACjC,CAAC;AAEL;;;;;;GAMG;AACH,eAAO,MAAM,qBAAqB,GAAI,GAAG,cAAc,EAAE,GAAG,cAAc,KAAG,KAAK,CAAC,UAAU,CAiD5F,CAAC;AAqHF,qEAAqE;AACrE,MAAM,WAAW,gBAAgB;IAChC,QAAQ,CAAC,CAAC,CAAC,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,CAAC,CAAC,EAAE,MAAM,CAAC;CACpB;AAED;;;GAGG;AACH,eAAO,MAAM,mBAAmB,GAC/B,OAAO,aAAa,CAAC,UAAU,CAAC,EAChC,SAAQ,gBAAqB,KAC3B,MAoEF,CAAC;AAEF;;;;;;;;;;;;;;;GAeG;AACH,eAAO,MAAM,6BAA6B,GACzC,GAAG,cAAc,EACjB,GAAG,cAAc,EACjB,SAAQ,gBAAqB,KAC3B,IAUF,CAAC;AAEF;;;;;GAKG;AACH,MAAM,MAAM,oBAAoB,GAC7B;IACA,QAAQ,CAAC,IAAI,EAAE,qBAAqB,CAAC;IACrC,QAAQ,CAAC,KAAK,EAAE,GAAG,GAAG,GAAG,CAAC;IAC1B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;CACrB,GACD;IACA,QAAQ,CAAC,IAAI,EAAE,0BAA0B,CAAC;IAC1C,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,CAAC,EAAE,MAAM,CAAC;IACnB,QAAQ,CAAC,CAAC,EAAE,MAAM,CAAC;CAClB,CAAC;AAIL;;;;;GAKG;AACH,eAAO,MAAM,uBAAuB,GACnC,GAAG,gBAAgB,EACnB,GAAG,gBAAgB,KACjB,KAAK,CAAC,oBAAoB,CAwC5B,CAAC;AAEF;;;GAGG;AACH,eAAO,MAAM,8BAA8B,GAC1C,OAAO,aAAa,CAAC,oBAAoB,CAAC,EAC1C,SAAQ,gBAAqB,KAC3B,MAyBF,CAAC;AAEF;;;;;;;;;GASG;AACH,eAAO,MAAM,+BAA+B,GAC3C,GAAG,gBAAgB,EACnB,GAAG,gBAAgB,EACnB,SAAQ,gBAAqB,KAC3B,IAUF,CAAC"}

package/dist/testing/schema_parity.js

@@ -225,3 +225,94 @@ export const assert_schema_snapshots_equal = (a, b, labels = {}) => {
     const label_b = labels.b ?? 'b';
     throw new Error(`Schema parity failed: ${diffs.length} diff(s) between ${label_a} and ${label_b}\n${format_schema_diffs(diffs, labels)}`);
 };
+const tracker_key = (namespace, name) => `${namespace}${name}`;
+/**
+ * Structural diff between two migration trackers — empty array means the two
+ * spines recorded byte-identical migration identity. Keyed on
+ * `(namespace, name)`; sequence mismatches on a shared key are reported too.
+ * Deterministic order: shared/missing rows in sorted `(namespace, name)` order.
+ */
+export const diff_migration_trackers = (a, b) => {
+    const diffs = [];
+    const a_by_key = new Map(a.entries.map((e) => [tracker_key(e.namespace, e.name), e]));
+    const b_by_key = new Map(b.entries.map((e) => [tracker_key(e.namespace, e.name), e]));
+    // Union keyed by `(namespace, name)`; the value is a reference entry (from
+    // whichever side has it) used to recover namespace/name for the diff — so a
+    // row present on only one side needs no non-null assertion.
+    const by_key = new Map([...a_by_key, ...b_by_key]);
+    for (const [key, ref] of [...by_key].sort((x, y) => (x[0] < y[0] ? -1 : x[0] > y[0] ? 1 : 0))) {
+        const ea = a_by_key.get(key);
+        const eb = b_by_key.get(key);
+        if (!ea) {
+            diffs.push({
+                kind: 'tracker_row_only_in',
+                where: 'b',
+                namespace: ref.namespace,
+                name: ref.name,
+            });
+            continue;
+        }
+        if (!eb) {
+            diffs.push({
+                kind: 'tracker_row_only_in',
+                where: 'a',
+                namespace: ref.namespace,
+                name: ref.name,
+            });
+            continue;
+        }
+        if (ea.sequence !== eb.sequence) {
+            diffs.push({
+                kind: 'tracker_sequence_differs',
+                namespace: ea.namespace,
+                name: ea.name,
+                a: ea.sequence,
+                b: eb.sequence,
+            });
+        }
+    }
+    return diffs;
+};
+/**
+ * Render migration-tracker diffs as a human-readable multi-line string.
+ * Empty diffs produce an empty string.
+ */
+export const format_migration_tracker_diffs = (diffs, labels = {}) => {
+    if (diffs.length === 0)
+        return '';
+    const label_a = labels.a ?? 'a';
+    const label_b = labels.b ?? 'b';
+    const lines = [];
+    for (const d of diffs) {
+        switch (d.kind) {
+            case 'tracker_row_only_in':
+                lines.push(`  migration ${d.namespace}/${d.name} only in ${d.where === 'a' ? label_a : label_b}`);
+                break;
+            case 'tracker_sequence_differs':
+                lines.push(`  migration ${d.namespace}/${d.name} sequence differs: ${label_a}=${d.a}, ${label_b}=${d.b}`);
+                break;
+            default:
+                d;
+                break;
+        }
+    }
+    return lines.join('\n');
+};
+/**
+ * Throw if the two spines' `schema_version` trackers disagree — the gate for
+ * the swap-freely invariant (any consumer can swap TS↔Rust over one DB without
+ * re-bootstrapping). This catches what `assert_schema_snapshots_equal` is blind
+ * to by design: the snapshot excludes the tracker, so a migration-name or
+ * partitioning divergence that yields an identical *schema* (e.g. `cell_v0` vs
+ * `full_cell_schema`, or `cell_history` bundled vs isolated) passes schema
+ * parity but breaks the runner's positional name-prefix check at boot
+ * (`name-divergence-at-N`). The error names the impls and lists every diff.
+ */
+export const assert_migration_trackers_equal = (a, b, labels = {}) => {
+    const diffs = diff_migration_trackers(a, b);
+    if (diffs.length === 0)
+        return;
+    const label_a = labels.a ?? 'a';
+    const label_b = labels.b ?? 'b';
+    throw new Error(`Migration-identity parity failed: ${diffs.length} diff(s) between ${label_a} and ${label_b}\n${format_migration_tracker_diffs(diffs, labels)}`);
+};

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@fuzdev/fuz_app",
-  "version": "0.98.1",
+  "version": "0.100.0",
   "description": "fullstack app library",
   "glyph": "🗝",
   "logo": "logo.svg",