@githolon/dsl 0.108.7 → 0.110.1

package/dart/test/adv_realm_interference_test.dart

@@ -1,600 +0,0 @@
-// ADVERSARIAL FINDER — MULTI-WORKSPACE REALM INTERFERENCE (one engine, many sessions).
-// Hammers the cross-session seams of the local holarchy plane (co2's production shape: a
-// dozen+ live workspaces, mixed laws) through the REAL runner + REAL kernel, fully offline:
-//   1. concurrent offers to different sessions (no cross-chain bleed, independent heads)
-//   2. watches on A while B floods (no tick bleed / starvation, per-subscription ordering)
-//   3. acquireSession racing a FAILED connect (the phantom-session window)
-//   4. pendingConflicts/activityLog isolation across same-named queries / sibling floods
-//   5. session re-connect (atomic replace) during in-flight offers — nothing hangs, typed only
-//   6. born child resident-then-session — one consistent view
-//   7. error isolation — one session's refusal never poisons siblings
-//   8. runner-level LRU (maxMounted) — watch survival + state preservation across park/remount
-//
-// A FAILING expectation here is a FINDING (evidence of a seam bug), not necessarily a
-// regression gate. Timing assertions use generous CI margins.
-@TestOn('vm')
-@Timeout(Duration(minutes: 12))
-library;
-
-import 'dart:async';
-import 'dart:convert';
-import 'dart:io';
-
-import 'package:nomos_client/src/nms_conformance_runtime.dart';
-import 'package:nomos_types/nomos_kernel_protocol.dart' as protocol;
-import 'package:nomos_types/src/nomos_ref.dart' show NmsInternalNomosRefs;
-import 'package:test/test.dart';
-
-String get _root => '${Directory.current.path}/../..';
-String get _repoEntry => '$_root/cloud/web-client/runner/node-entry.ts';
-String get _installer => '$_root/cloud/web-client/runner/offline-install.ts';
-String get _guestbook =>
-    '$_root/examples/guestbook/build/guestbook.law.usdz';
-String get _surfaced =>
-    '$_root/bench/scale/fixtures/surfaced/build/surfaced.law.usdz';
-String get _attributed =>
-    '$_root/bench/scale/fixtures/attributed/build/attributed.law.usdz';
-String get _estateBirth =>
-    '$_root/bench/scale/fixtures/estate-birth/build/estate-birth.law.usdz';
-String get _runtimeDir =>
-    Platform.environment['NOMOS_DART_RUNTIME'] ??
-    Platform.environment['NOMOS_OFFLINE_RUNTIME'] ??
-    '${Platform.environment['HOME'] ?? ''}/.holon/runtime';
-
-String? _missingPrereq() {
-  for (final p in [
-    _repoEntry,
-    _installer,
-    _guestbook,
-    _surfaced,
-    _attributed,
-    _estateBirth
-  ]) {
-    if (!File(p).existsSync())
-      return 'missing $p (compile the fixture / example first)';
-  }
-  if (!File('$_runtimeDir/holon-testmint.wasm').existsSync() ||
-      !File('$_runtimeDir/bootstrap.law.usdz').existsSync() ||
-      !File('$_runtimeDir/nomos.law.usdz').existsSync()) {
-    return 'warm ~/.holon/runtime first (run any `githolon` command once)';
-  }
-  return null;
-}
-
-String _nowIso() => DateTime.now().toUtc().toIso8601String();
-
-Future<String> _sign(NomosSession s, String author, String message) =>
-    s.offerDirective(
-        domain: 'guestbook',
-        directiveId: 'signGuestbook',
-        payload: {
-          'author': author,
-          'message': message,
-          'mood': 'delighted',
-          'signedAt': _nowIso()
-        },
-        actor: author);
-
-void main() {
-  final skip = _missingPrereq();
-
-  group('shared cluster (6 workspaces, mixed laws)', () {
-    late NomosTestHarness harness;
-    late NomosBridge plane;
-
-    setUpAll(() async {
-      if (skip != null) return;
-      harness = await NomosTestHarness.cluster(
-        workspaces: {
-          'home-birth': [_estateBirth],
-          'surf': [_surfaced],
-          'attr': [_attributed],
-          'gb-1': [_guestbook],
-          'gb-2': [_guestbook],
-          'gb-3': [_guestbook],
-        },
-        nodeEntry: _repoEntry,
-        runtimeDir: _runtimeDir,
-      );
-      plane = harness.bridge;
-    });
-
-    tearDownAll(() async {
-      if (skip != null) return;
-      await harness.dispose();
-    });
-
-    test(
-        '1. concurrent offers to different sessions: no cross-chain bleed, independent heads',
-        () async {
-      if (skip != null) return markTestSkipped(skip);
-      const gbs = ['gb-1', 'gb-2', 'gb-3'];
-      final sw = Stopwatch()..start();
-      final futs = <Future<Object?>>[
-        for (final ws in gbs)
-          for (var i = 0; i < 4; i++)
-            _sign(harness.session(ws), 'author-$ws', 'm$i'),
-        for (var i = 0; i < 4; i++)
-          harness.session('surf').offerDirective(
-              domain: 'docs',
-              directiveId: 'createDoc',
-              payload: {'owner': 'owner-surf', 'title': 'doc-$i'},
-              actor: 'owner-surf'),
-        for (var i = 0; i < 4; i++)
-          harness.session('attr').offerDirective(
-              domain: 'sites',
-              directiveId: 'createSite',
-              payload: {'owner': 'owner-attr', 'name': 'site-$i'},
-              actor: 'owner-attr'),
-      ];
-      final heads =
-          await Future.wait(futs); // 20 concurrent offers across 5 sessions
-      sw.stop();
-      expect(heads, everyElement(isNotNull));
-      // ack latency stays sane under concurrency (generous CI margin)
-      expect(sw.elapsed, lessThan(const Duration(seconds: 90)),
-          reason: '20 concurrent offers should settle well under 90s');
-
-      // each chain holds ONLY its own writes
-      for (final ws in gbs) {
-        final mine = await harness
-            .session(ws)
-            .query('entriesByAuthor', {'author': 'author-$ws'});
-        expect(mine, hasLength(4), reason: '$ws holds its own 4 writes');
-        for (final other in gbs.where((o) => o != ws)) {
-          final theirs = await harness
-              .session(ws)
-              .query('entriesByAuthor', {'author': 'author-$other'});
-          expect(theirs, isEmpty,
-              reason:
-                  "$ws must not hold $other's writes (cross-session bleed)");
-        }
-      }
-      expect(
-          await harness
-              .session('surf')
-              .query('docsByOwner', {'owner': 'owner-surf'}),
-          hasLength(4));
-      expect(
-          await harness
-              .session('attr')
-              .query('sitesByOwner', {'owner': 'owner-attr'}),
-          hasLength(4));
-
-      // heads are independent per session
-      final tips = <String>{};
-      for (final ws in [...gbs, 'surf', 'attr']) {
-        tips.add(await harness.session(ws).head());
-      }
-      expect(tips, hasLength(5),
-          reason: 'every session has its own ledger tip');
-    });
-
-    test(
-        '2. a watch on session A fires while session B floods (no starvation, no bleed, ordered)',
-        () async {
-      if (skip != null) return markTestSkipped(skip);
-      final a = harness.session('gb-1');
-      final b = harness.session('gb-2');
-      final idle = harness.session('attr');
-
-      final emissionsA = <int>[];
-      final emissionsIdle = <int>[];
-      final subA = a.watch('entriesByAuthor', {'author': 'watched'}).listen(
-          (rows) => emissionsA.add(rows.length));
-      final subIdle = idle
-          .watch('sitesByOwner', {'owner': 'nobody-here'}).listen(
-              (rows) => emissionsIdle.add(rows.length));
-      await Future<void>.delayed(
-          const Duration(milliseconds: 600)); // initial emissions
-      final idleBase = emissionsIdle.length;
-
-      // B floods 25 writes while A takes 3 interleaved writes
-      final flood = () async {
-        for (var i = 0; i < 25; i++) {
-          await _sign(b, 'flooder', 'f$i');
-        }
-      }();
-      final aWrites = () async {
-        for (var i = 0; i < 3; i++) {
-          await Future<void>.delayed(const Duration(milliseconds: 60));
-          await _sign(a, 'watched', 'w$i');
-        }
-      }();
-      await Future.wait([flood, aWrites]);
-
-      // A's watch must reach 3 rows promptly despite the sibling flood (generous margin)
-      final deadline = DateTime.now().add(const Duration(seconds: 15));
-      while (DateTime.now().isBefore(deadline) &&
-          (emissionsA.isEmpty || emissionsA.last < 3)) {
-        await Future<void>.delayed(const Duration(milliseconds: 150));
-      }
-      await subA.cancel();
-      await subIdle.cancel();
-      expect(emissionsA.isNotEmpty && emissionsA.last == 3, isTrue,
-          reason:
-              "A's watch starved or missed rows under B's flood: $emissionsA");
-      for (var i = 1; i < emissionsA.length; i++) {
-        expect(emissionsA[i], greaterThanOrEqualTo(emissionsA[i - 1]),
-            reason: 'per-subscription ordering must be monotonic: $emissionsA');
-      }
-      expect(emissionsIdle.length, idleBase,
-          reason:
-              "the idle sibling watch got spurious emissions from B's flood: $emissionsIdle");
-    });
-
-    test('3a. follow(ref) + racing acquireSession during a sibling offer flood',
-        () async {
-      if (skip != null) return markTestSkipped(skip);
-      final flood = () async {
-        for (var i = 0; i < 10; i++) {
-          await _sign(harness.session('gb-3'), 'race-flood', 'f$i');
-        }
-      }();
-      // follow an already-open sibling mid-flood → same handle, functional
-      final followed = await plane.follow(NmsInternalNomosRefs.create<Object?>(
-          workspace: 'gb-1', type: 'nomos.Workspace', id: 'gb-1'));
-      expect(followed.workspace, 'gb-1');
-      expect(await followed.query('entriesByAuthor', {'author': 'nobody'}),
-          isEmpty);
-
-      // concurrent acquireSession single-flights to the SAME handle
-      final pair = await Future.wait([
-        plane.acquireSession('gb-2'),
-        plane.acquireSession('gb-2'),
-      ]);
-      expect(identical(pair[0], pair[1]), isTrue,
-          reason:
-              'two concurrent acquireSession calls must yield the same session');
-      await flood;
-    });
-
-    test(
-        '3b. FINDER: a FAILED connect must not leave a phantom session acquireSession trusts',
-        () async {
-      if (skip != null) return markTestSkipped(skip);
-      // a garbage restoreFrom makes the runner's connect throw AFTER the Dart bridge has
-      // (prematurely?) registered the session name on the plane.
-      Object? err;
-      try {
-        await plane.connect(
-            workspace: 'phantom-ws',
-            session: 'phantom-ws',
-            restoreFrom: '%%%not-base64%%%');
-      } catch (e) {
-        err = e;
-      }
-      expect(err, isNotNull, reason: 'the corrupt-restore connect must throw');
-
-      // CORRECT behavior: acquireSession must either ask for credentials, throw a named
-      // StateError, or return a session whose ops actually work. Returning a handle whose
-      // every op refuses "session not connected" is the phantom-session bug.
-      var credentialsAsked = false;
-      Object? acquireOutcome;
-      try {
-        final s = await plane.acquireSession('phantom-ws',
-            ifAbsentCredentials: () async {
-          credentialsAsked = true;
-          throw StateError('credentials path taken (correct) — stop here');
-        });
-        // it returned a session: its ops must work, else it's a dead phantom handle
-        await s.query('entriesByAuthor', {'author': 'x'});
-        acquireOutcome = 'live session';
-      } catch (e) {
-        acquireOutcome = e;
-      }
-      final phantom = !credentialsAsked &&
-          acquireOutcome is! StateError &&
-          acquireOutcome != 'live session';
-      expect(phantom, isFalse,
-          reason:
-              'PHANTOM SESSION: after a failed connect, acquireSession("phantom-ws") '
-              'returned a dead handle (ops refuse) without asking for credentials — '
-              'observed: $acquireOutcome');
-    });
-
-    test(
-        '4. pendingConflicts/activityLog on A are unaffected by B (same-named queries isolated)',
-        () async {
-      if (skip != null) return markTestSkipped(skip);
-      final surf = harness.session('surf');
-      final before = await surf.pendingConflicts();
-
-      // sibling activity: a guestbook flood + surfaced-relevant field writes on ANOTHER session's law
-      for (var i = 0; i < 10; i++) {
-        await _sign(harness.session('gb-1'), 'iso-flood', 'f$i');
-      }
-      final after = await surf.pendingConflicts();
-      expect(after, equals(before),
-          reason:
-              "surf's pendingConflicts moved on a sibling's writes (cache/key bleed)");
-
-      // activityLog rows belong to the session's OWN chain only
-      final actGb2 = await harness.session('gb-2').activityLog(limit: 100);
-      final foreign = actGb2.where((r) =>
-          r['directiveId'] == 'createSite' ||
-          r['directiveId'] == 'createDoc' ||
-          (r['payload'] is Map &&
-              (r['payload'] as Map)['author'] == 'iso-flood'));
-      expect(foreign, isEmpty,
-          reason:
-              "gb-2's activityLog carries sibling-session intents: ${foreign.toList()}");
-
-      // the SAME query id with the SAME params on two sessions answers per-session
-      final q1 = await harness
-          .session('gb-1')
-          .query('entriesByAuthor', {'author': 'iso-flood'});
-      final q2 = await harness
-          .session('gb-2')
-          .query('entriesByAuthor', {'author': 'iso-flood'});
-      expect(q1, hasLength(10));
-      expect(q2, isEmpty,
-          reason:
-              'same-named query with same params leaked rows across sessions (cache keying)');
-    });
-
-    test(
-        '5. re-connect (atomic replace) during in-flight offers: everything settles typed',
-        () async {
-      if (skip != null) return markTestSkipped(skip);
-      final s = harness.session('gb-3');
-      // fire 10 offers WITHOUT awaiting, then immediately replace the session (new clientId
-      // → identity change → dispose-then-connect under the hood)
-      final futs = [
-        for (var i = 0; i < 10; i++)
-          _sign(s, 'replace-race', 'r$i')
-              .then<Object?>((h) => 'ok:$h', onError: (Object e) => e)
-      ];
-      await plane.connect(
-          workspace: 'gb-3', session: 'gb-3', clientId: 'replacer-1');
-
-      final settled = await Future.wait(futs).timeout(
-          const Duration(seconds: 60),
-          onTimeout: () => throw StateError(
-              'offers in flight across an atomic replace HUNG (never settled)'));
-      // every outcome is either an admitted head or a TYPED error — never a hang, never null
-      for (final r in settled) {
-        expect(r, isNotNull);
-        if (r is! String) {
-          expect(r, isA<Exception>(),
-              reason: 'a race loser must fail typed, got: $r');
-        }
-      }
-
-      // the replaced session is consistent: chain verifies, reads serve, writes admit
-      final v = await harness.session('gb-3').verifyChain();
-      expect(v['valid'], isTrue,
-          reason:
-              'in-flight offers interleaved with the atomic replace corrupted the chain: $v');
-      final admitted = settled.whereType<String>().length;
-      final rows = await harness
-          .session('gb-3')
-          .query('entriesByAuthor', {'author': 'replace-race'});
-      expect(rows.length, admitted,
-          reason:
-              '$admitted offers acked ok but ${rows.length} rows visible after the replace '
-              '(an acked write was lost or duplicated across the replace window)');
-      await _sign(harness.session('gb-3'), 'post-replace', 'alive');
-      expect(
-          await harness
-              .session('gb-3')
-              .query('entriesByAuthor', {'author': 'post-replace'}),
-          hasLength(1));
-      // siblings untouched by gb-3's replace
-      expect(
-          await harness
-              .session('gb-1')
-              .query('entriesByAuthor', {'author': 'nobody'}),
-          isEmpty);
-    });
-
-    test(
-        '6. born child resident-then-session: one consistent view, replace-safe',
-        () async {
-      if (skip != null) return markTestSkipped(skip);
-      final fw = harness.frameworkHash;
-      final law = harness.lawHashes('home-birth').first;
-      final outcome = await harness.session('home-birth').offerCreates(
-            domain: 'home',
-            directiveId: 'birthEstateWorkspace',
-            payload: {
-              'owner': 'adv-owner',
-              'frameworkHash': fw,
-              'lawHash': law,
-              'bornAt': _nowIso(),
-            },
-            actor: 'adv-owner',
-          );
-      expect(outcome.born, hasLength(1));
-      expect(outcome.birthOutcomes.first.status,
-          NomosBirthOutcomeStatus.BIRTH_OUTCOME_STATUS_BORN);
-      final child = outcome.born.single;
-
-      // the child is resident BEFORE any session opens it — listWorkspaces sees it
-      final listedPre = await plane.listWorkspaces();
-      expect(listedPre.map((workspace) => workspace.workspace), contains(child),
-          reason:
-              'a born child is resident on the plane before it is connected');
-
-      // open it as a session (mount in place) and read the genesis seed
-      await plane.connect(workspace: child, session: child);
-      final rows1 = await plane
-          .session(child)
-          .query('estatesByOwner', {'owner': 'adv-owner'});
-      expect(rows1, hasLength(1));
-
-      // write into the child, then RE-open it with a new clientId (identity replace on a
-      // born-resident workspace) — the write must survive (one holon's truth, not two)
-      await plane
-          .session(child)
-          .offerDirective(
-              domain: 'estate',
-              directiveId: 'renameEstate',
-              payload: {'estateName': child, 'newName': 'renamed'},
-              actor: 'adv-owner')
-          .catchError(
-              (Object _) => ''); // directive may not exist — best-effort
-      await _noThrow(() => plane.connect(
-          workspace: child, session: child, clientId: 'child-re'));
-      final rows2 = await plane
-          .session(child)
-          .query('estatesByOwner', {'owner': 'adv-owner'});
-      expect(rows2, hasLength(1),
-          reason:
-              're-opening a born-resident child must present the SAME holon truth');
-
-      // the parent is unaffected
-      expect(
-          await plane
-              .session('home-birth')
-              .verifyChain()
-              .then((v) => v['valid']),
-          isTrue);
-    });
-
-    test('7. error isolation: a refusal on one session never poisons siblings',
-        () async {
-      if (skip != null) return markTestSkipped(skip);
-      // unknown directive → typed refusal
-      await expectLater(
-          harness.session('gb-1').offerDirective(
-              domain: 'guestbook',
-              directiveId: 'noSuchDirective',
-              payload: {'x': 1}),
-          throwsA(anything));
-      // schema-violating payload → typed refusal
-      await expectLater(
-          harness.session('attr').offerDirective(
-              domain: 'sites',
-              directiveId: 'createSite',
-              payload: {'owner': '', 'name': ''}),
-          throwsA(anything));
-      // unknown query → typed refusal, not a hang
-      await expectLater(
-          harness.session('surf').query('noSuchQuery', {'k': 'v'}),
-          throwsA(anything));
-
-      // every sibling still serves reads AND admits writes
-      for (final ws in ['gb-1', 'gb-2', 'gb-3', 'surf', 'attr', 'home-birth']) {
-        final h = await harness.session(ws).head();
-        expect(h, isNotEmpty,
-            reason: '$ws must still answer after a sibling refusal');
-      }
-      await _sign(harness.session('gb-2'), 'healthy', 'still-alive');
-      expect(
-          await harness
-              .session('gb-2')
-              .query('entriesByAuthor', {'author': 'healthy'}),
-          hasLength(1));
-    });
-  });
-
-  group('runner-level LRU (maxMounted: 2)', () {
-    test('8. FINDER: watches + session state across LRU park/remount',
-        () async {
-      if (skip != null) return markTestSkipped(skip);
-      final workdir = await Directory.systemTemp.createTemp('adv-lru-');
-      NodeRunnerTransport? transport;
-      try {
-        // build 3 guestbook snapshots via the proven offline install lane
-        final snaps = <String, String>{};
-        for (final ws in ['lru-1', 'lru-2', 'lru-3']) {
-          final out = '${workdir.path}/$ws.bin';
-          final r = await Process.run('node', [
-            _installer,
-            '--law',
-            _guestbook,
-            '--workspace',
-            ws,
-            '--out',
-            out,
-            '--runtime',
-            _runtimeDir,
-          ]);
-          expect(r.exitCode, 0,
-              reason: 'offline install of $ws failed: ${r.stderr}');
-          snaps[ws] = base64Encode(await File(out).readAsBytes());
-        }
-        transport = await NodeRunnerTransport.start(
-            entry: _repoEntry,
-            node: 'node',
-            environment: {'NOMOS_OFFLINE': '1'});
-        final bridge = NomosBridge(transport);
-        await bridge.ready.timeout(const Duration(seconds: 30));
-
-        // FIRST connect fixes the realm budget: maxMounted 2
-        await bridge.connect(
-            workspace: 'lru-1',
-            session: 'lru-1',
-            restoreFrom: snaps['lru-1'],
-            allowUnborn: true,
-            maxMounted: 2);
-        final s1 = bridge.session('lru-1');
-        await _sign(s1, 'survivor', 'before-eviction'); // un-synced local write
-
-        final emissions = <int>[];
-        Object? watchError;
-        final sub = s1.watch('entriesByAuthor', {'author': 'survivor'}).listen(
-            (rows) => emissions.add(rows.length),
-            onError: (Object e) => watchError = e);
-        await Future<void>.delayed(const Duration(milliseconds: 800));
-        expect(emissions.isNotEmpty && emissions.last == 1, isTrue,
-            reason:
-                'precondition: the watch saw the pre-eviction row: $emissions');
-
-        // mount two more workspaces → lru-1 is LRU-evicted (parked)
-        await bridge.connect(
-            workspace: 'lru-2',
-            session: 'lru-2',
-            restoreFrom: snaps['lru-2'],
-            allowUnborn: true);
-        await bridge.connect(
-            workspace: 'lru-3',
-            session: 'lru-3',
-            restoreFrom: snaps['lru-3'],
-            allowUnborn: true);
-        final listed = await bridge.listWorkspaces();
-        final l1 = listed.firstWhere((workspace) => workspace.workspace == 'lru-1');
-        expect(l1.residency, protocol.WorkspaceResidency.WORKSPACE_RESIDENCY_PARKED,
-            reason: 'lru-1 should be LRU-parked: $listed');
-
-        // (a) session ops transparently remount from the parked snapshot, state intact
-        final rows = await s1.query('entriesByAuthor', {'author': 'survivor'});
-        expect(rows, hasLength(1),
-            reason:
-                'the un-synced local write must survive the park/remount cycle');
-
-        // (b) the watch must SURVIVE the eviction+remount (or at least error TYPED —
-        //     a silently-dead stream is the bug)
-        await _sign(s1, 'survivor', 'after-remount');
-        final deadline = DateTime.now().add(const Duration(seconds: 10));
-        while (DateTime.now().isBefore(deadline) &&
-            (emissions.isEmpty || emissions.last < 2) &&
-            watchError == null) {
-          await Future<void>.delayed(const Duration(milliseconds: 200));
-        }
-        await sub.cancel();
-        final died =
-            (emissions.isEmpty || emissions.last < 2) && watchError == null;
-        expect(died, isFalse,
-            reason:
-                'SILENT WATCH DEATH: the lru-1 watch stopped emitting after an LRU '
-                'eviction+remount, with NO error event — emissions=$emissions '
-                '(a Flutter app bound to this stream shows stale data forever)');
-      } finally {
-        try {
-          await transport?.dispose();
-        } catch (_) {}
-        try {
-          await workdir.delete(recursive: true);
-        } catch (_) {}
-      }
-    });
-  });
-}
-
-Future<void> _noThrow(Future<void> Function() fn) async {
-  try {
-    await fn();
-  } catch (_) {}
-}