@githolon/testing 0.16.0 → 0.16.1

package/build.mjs

@@ -1,31 +1,22 @@
-// Vendor THE ENGINE PLANE (cloud/cloudflare-shell/src/{engine,git-fs,tree}.mjs — the
-// exact machinery the edge DO and the heavy container run) into this package so
-// `testHolon()` boots holons in-process with the same code path the cloud uses.
-// Sync-at-build keeps it un-forked (the cli/build.mjs / deploy.sh pattern); the
-// published package ships the vendored copies and skips the sync when the
-// monorepo source is absent.
+// Vendor THE SHARED ADAPTER (adapter/{engine,custody-transport,git-fs,tree}.mjs — the one JS plumbing the
+// Cloudflare shell, the CLI, and this harness all wrap) into this package so `testHolon()` boots holons
+// in-process with the same code path the cloud uses. The CLI/testing/cloud all consume the ADAPTER, never a
+// platform shell. Sync-at-build keeps it un-forked; the published package ships the vendored copies and skips
+// the sync when the monorepo source is absent. engine.mjs imports its siblings by `./`, so they vendor flat.
 import { existsSync, mkdirSync, readFileSync, writeFileSync } from "node:fs";
 import { dirname, join } from "node:path";
 import { fileURLToPath } from "node:url";
 
 const HERE = dirname(fileURLToPath(import.meta.url));
-const ENGINE_SRC = join(HERE, "..", "cloud", "cloudflare-shell", "src");
-const ADAPTER_SRC = join(HERE, "..", "adapter"); // git-fs.mjs + tree.mjs are the SHARED adapter now
+const ADAPTER_SRC = join(HERE, "..", "adapter");
 const VENDOR = join(HERE, "vendor", "engine");
 
-if (existsSync(ENGINE_SRC)) {
+if (existsSync(ADAPTER_SRC)) {
   mkdirSync(VENDOR, { recursive: true });
-  // The shell's engine plane (engine.mjs + its custody-transport sibling). Rewrite the repo-relative adapter
-  // import (../../../adapter/) to local so the vendored copies resolve side-by-side (the deploy.sh pattern).
-  for (const f of ["engine.mjs", "custody-transport.mjs"]) {
-    const body = readFileSync(join(ENGINE_SRC, f), "utf8").replace(/\.\.\/\.\.\/\.\.\/adapter\//g, "./");
-    writeFileSync(join(VENDOR, f), `// AUTO-SYNCED from cloud/cloudflare-shell/src/${f} by testing/build.mjs — DO NOT EDIT HERE.\n${body}`, "utf8");
-  }
-  // The shared adapter primitives the engine imports.
-  for (const f of ["git-fs.mjs", "tree.mjs"]) {
+  for (const f of ["engine.mjs", "custody-transport.mjs", "git-fs.mjs", "tree.mjs"]) {
     const body = readFileSync(join(ADAPTER_SRC, f), "utf8");
     writeFileSync(join(VENDOR, f), `// AUTO-SYNCED from adapter/${f} by testing/build.mjs — DO NOT EDIT HERE.\n${body}`, "utf8");
   }
 } else if (!existsSync(join(VENDOR, "engine.mjs"))) {
-  throw new Error("engine plane not found: neither ../cloud/cloudflare-shell/src nor vendor/engine exists");
+  throw new Error("the shared adapter (../adapter) is not present and no vendored engine exists");
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@githolon/testing",
-  "version": "0.16.0",
+  "version": "0.16.1",
   "type": "module",
   "description": "@githolon/testing — law TDD for Nomos domains: boot the REAL engine plane in-process (the exact machinery every cloud DO, heavy container and web client runs), dispatch directives, assert rows, assert TYPED REFUSALS, fork for what-ifs — fully offline inside vitest.",
   "license": "SEE LICENSE IN LICENSE.md",

package/src/index.mjs

@@ -1,7 +1,7 @@
 // @githolon/testing — LAW TDD for Nomos domains.
 //
 // `testHolon({ deploy })` boots THE ENGINE PLANE in-process (the vendored
-// cloud/cloudflare-shell/src/engine.mjs — the exact machinery every cloud DO, heavy
+// adapter/engine.mjs — the exact machinery every cloud DO, heavy
 // container and web client runs) over the one wasm32-wasip1 artifact, installs
 // your compiled law at genesis, and hands back a holon you drive from a test:
 // dispatch directives, read rows/queries/counts/sums, assert TYPED REFUSALS

package/vendor/engine/custody-transport.mjs

@@ -1,4 +1,4 @@
-// AUTO-SYNCED from cloud/cloudflare-shell/src/custody-transport.mjs by testing/build.mjs — DO NOT EDIT HERE.
+// AUTO-SYNCED from adapter/custody-transport.mjs by testing/build.mjs — DO NOT EDIT HERE.
 // THE CLOUD SHELL'S DUMB-PIPE CUSTODY TRANSPORT — raw git smart-HTTP over fetch(), ZERO isomorphic-git.
 //
 // Custody (Cloudflare Artifacts) is a git smart-HTTP remote. The KERNEL owns all git semantics (gix builds

package/vendor/engine/engine.mjs

@@ -1,4 +1,4 @@
-// AUTO-SYNCED from cloud/cloudflare-shell/src/engine.mjs by testing/build.mjs — DO NOT EDIT HERE.
+// AUTO-SYNCED from adapter/engine.mjs by testing/build.mjs — DO NOT EDIT HERE.
 // Nomos — THE CLOUDFLARE SHELL's ENGINE PLANE (the adapter logic that boots + drives the offer-kernel).
 //
 // Everything that boots the offer-kernel wasm + drives its /work tree lives HERE (the adapter the
@@ -21,6 +21,9 @@ import { lsRefs, fetchPack, pushPack, ZERO_OID } from "./custody-transport.mjs";
 
 const enc = new TextEncoder(), dec = new TextDecoder();
 const BRANCH = "main";
+// The largest result-delta the offer response will carry inline (settle perf — saves the client a second
+// round-trip). A normal write's delta is a few KiB; a far-behind client exceeds this and falls back to GET /pack.
+const RESULT_PACK_INLINE_MAX = 256 * 1024;
 export const repoArgOf = (ws) => `/work/ws/${ws}`;
 export const gitdirOf = (ws) => `/work/ws/${ws}/nomos.git`;
 function b64Bytes(bytes) {
@@ -1115,10 +1118,22 @@ export async function admitIntentOffers(eng, ws, ledger, offers, { refuseDomains
   // The coalesced §5.2 delta of this batch (null when no scoped read moved) — the adapter closes it onto the
   // coordinator (`_postAdmissionHooks` → `_emitSummary`), exactly as the session-branch lane does.
   const summary = summaryCtx ? summaryOfCapture(summaryCtx, headBefore, head) : null;
-  // (The legacy inline `mainDelta` perf hack is GONE: the client pulls the delta itself via GET /pack +
-  // the kernel's gix apply_pack — one byte-pipe lane, no adapter-side loose-object walk.)
-  log("admit-intent-offers", { ws, sessions: sessions.size, admitted: admittedTotal, rejected: [...sessions.values()].reduce((n, s) => n + s.rejected.length, 0) });
-  return { sessions: [...sessions.values()].map((s) => ({ ...s, ...(s.skipped.length ? {} : { skipped: undefined }) })), main: head, deadLetters, timings, ...(summary ? { summary } : {}), ...(deferDurability && admittedTotal && head ? { deferred: true, head } : {}) };
+  // RESULT-PACK PIGGYBACK (settle perf): the offer RE-SEALS the intent onto main (a NEW commit oid the
+  // client lacks), so the client otherwise makes a SECOND round-trip (GET /pack?have=base) just to pull
+  // what this admit produced — the ~500ms "prefetch" phase. Since we already hold every object, carry that
+  // exact delta (base→head) BACK in the offer response so the client applies it with zero extra network.
+  // Bounded: only inline a small delta (a normal write is one commit + tree); a far-behind client's large
+  // delta falls back to GET /pack (no worse than today). The kernel odb has `head` post-fold even under
+  // deferred durability (custody push is write-behind; the objects are resident), so this is available now.
+  let resultPackB64 = null;
+  if (admittedTotal && head && /^[0-9a-f]{40}$/i.test(clientBase || "") && clientBase !== head) {
+    try {
+      const p = servePack(eng, ws, clientBase);
+      if (p && p.packB64 && p.bytes && p.bytes <= RESULT_PACK_INLINE_MAX) resultPackB64 = p.packB64;
+    } catch { /* fall back to the client's own GET /pack */ }
+  }
+  log("admit-intent-offers", { ws, sessions: sessions.size, admitted: admittedTotal, rejected: [...sessions.values()].reduce((n, s) => n + s.rejected.length, 0), resultPack: resultPackB64 ? "inline" : "none" });
+  return { sessions: [...sessions.values()].map((s) => ({ ...s, ...(s.skipped.length ? {} : { skipped: undefined }) })), main: head, deadLetters, timings, ...(summary ? { summary } : {}), ...(resultPackB64 ? { resultPackB64, resultBase: clientBase } : {}), ...(deferDurability && admittedTotal && head ? { deferred: true, head } : {}) };
 }
 
 /**
@@ -2489,10 +2504,18 @@ export async function deploy(eng, ws, ledger, usda, domainHash, dispositions) {
   // adjudicates the stable-id diff against. Absent for the common (non-destructive)
   // upgrade; the gate's typed refusal names the remedy when one is needed.
   const result = author(eng, ws, "nomos", "installDomain", installPayload(domainHash, usda, eng.installedBy, dispositions), eng.hashes.nomos);
+  // ATOMICITY: VALIDATE the post-install projection BEFORE committing to custody. The install's
+  // read manifest is re-derived on this read; if it cannot fold (e.g. a divergent read-projection
+  // declaration the kernel refuses), this THROWS — and because we have NOT yet pushed, custody
+  // stays clean (the durable source of truth never holds an unfoldable install; the in-memory mount
+  // is evicted + re-mounted from clean custody on the error). A bad install must FAIL CLOSED, never
+  // persist in the chain. (Was: commitAndPush THEN qById — a fold failure left the install pushed,
+  // wedging every later fold. See read-manifest-evolution-gap.)
+  const installation = qById(eng, ws, `domain-installation:${domainHash}`);
   // Shard identity used to be inferred from adapter-side taxonomy. That is retired:
   // if sharding needs declaration, the holon must derive and author it itself.
   await commitAndPush(eng, ws, ledger);
-  return { head: result.head, installation: qById(eng, ws, `domain-installation:${domainHash}`) };
+  return { head: result.head, installation };
 }
 
 export function snapshot(eng, ws) {