@ours.network/notifications 0.1.1 → 0.3.0

package/mufl_code/core/tests/corpus.mjs

@@ -1,139 +0,0 @@
-#!/usr/bin/env node
-// Golden-wire corpus gate (COMPATIBILITY.md §corpus): replay one fixture per
-// REGISTERED version per registry through the a2a_versions try_narrow_* dispatch
-// and assert the branch taken. Fast (single packet, no peer traffic) — run it
-// via tests/run_corpus.sh, or as part of the full suite via tests/run.sh.
-import { resolve } from 'node:path';
-import * as fs from 'node:fs';
-import { adapt_wrapper } from '@adapt-toolkit/sdk/executables';
-import { PacketWrapperConfigurator } from '@adapt-toolkit/sdk/wrappers';
-import { object_to_adapt_value } from '@adapt-toolkit/sdk/wrapper';
-
-const BROKER_URL = process.env.BROKER_URL || 'ws://127.0.0.1:9790';
-const UNIT_DIR = resolve('.');
-const unitHash = fs.readdirSync(UNIT_DIR).find((f) => f.endsWith('.muflo')).slice(0, -'.muflo'.length);
-const UNIT = new Uint8Array(fs.readFileSync(resolve(UNIT_DIR, `${unitHash}.muflo`)));
-const sleep = (ms) => new Promise((r) => setTimeout(r, ms));
-const log = (...a) => process.stderr.write(`[corpus] ${a.join(' ')}\n`);
-const scorecard = [];
-const ok = (c, m) => { if (!c) { scorecard.push(`✗ ${m}`); console.log(`  ✗ FAIL: ${m}`); } else { console.log(`  ✓ ${m}`); } };
-
-async function main() {
-  const wrapper = await adapt_wrapper.start(['--broker_address', BROKER_URL, '--test_mode',
-    '--logger_config', '--level', 'WARNING', '--stdout', 'stderr', '--logger_config_end']);
-  wrapper.start();
-  await sleep(1500);
-
-  const id = { name: 'C', pw: null, pending: [], rejects: [] };
-  id.wire = () => {
-    id.pw.on_return_data = (d) => {
-      const kind = d.Reduce('kind').Visualize();
-      if (kind === 'notify_agent' || kind === 'save_state') return;
-      const p = id.pending.shift(); if (!p) return;
-      clearTimeout(p.timer); p.resolve(d.Reduce('payload'));
-    };
-    id.pw.on_transaction_failure = (msg) => {
-      const p = id.pending.shift();
-      if (p) { clearTimeout(p.timer); p.reject(new Error(msg)); }
-      else { id.rejects.push(String(msg)); }
-    };
-  };
-  const cfg = new PacketWrapperConfigurator();
-  cfg.process_arguments(['--unit_hash', unitHash, '--seed_phrase', 'corpus-gate-01', '--unit_dir_path', UNIT_DIR]);
-  await new Promise((res, rej) => {
-    const t = setTimeout(() => rej(new Error('packet create timeout')), 30000);
-    wrapper.packet_manager.create_packet(cfg, (pw) => { clearTimeout(t); id.pw = pw; id.wire(); res(); }, UNIT);
-  });
-  await sleep(800);
-  const mutate = (name, targ) => new Promise((res, rej) => {
-    const timer = setTimeout(() => rej(new Error(`${name} timed out`)), 20000);
-    id.pending.push({ resolve: res, reject: rej, timer });
-    id.pw.add_client_message(object_to_adapt_value({ name, targ }));
-  });
-
-  const r = await mutate('::actor::qa_corpus_narrow', {});
-  const g = (path) => path.split('.').reduce((v, k) => v.Reduce(k), r).Visualize();
-  const T = (s) => /true/i.test(String(s));
-
-  console.log('=== corpus: registry sir (v2/v3/v5 + floor + shape + future) ===');
-  ok(T(g('sir.v2.ok')) && g('sir.v2.v') === '2' && g('sir.v2.name') === '', 'sir v2: ok, dispatched v2, joiner_name empty (cid fallback branch)');
-  ok(T(g('sir.v3.ok')) && g('sir.v3.v') === '3' && g('sir.v3.name') === 'Bob', 'sir v3: ok, dispatched v3, $name honored');
-  ok(T(g('sir.v5.ok')) && g('sir.v5.v') === '5' && g('sir.v5.name') === 'Carol', 'sir v5: ok, dispatched v5, $name honored');
-  ok(!T(g('sir.old.ok')) && g('sir.old.code') === 'peer_version_unsupported', 'sir $pv=1 (below floor): error-as-data peer_version_unsupported');
-  ok(g('sir.old.peer_v') === '1' && g('sir.old.min') === '2', `sir too-old error carries peer_version=1 min_supported=2`);
-  ok(/too old/.test(g('sir.old.msg')) && /update/.test(g('sir.old.msg')), 'sir too-old error message is human-readable ("too old", "update")');
-  ok(!T(g('sir.bad.ok')) && g('sir.bad.code') === 'payload_shape_unrecognized', 'sir unrecognized shape: error-as-data payload_shape_unrecognized');
-  ok(!/too old/.test(g('sir.bad.msg')) && /no supported wire shape/.test(g('sir.bad.msg')), 'sir shape error message is DISTINCT from the too-old message (R2)');
-  ok(T(g('sir.fut.ok')) && g('sir.fut.name') === 'Dee' && T(g('sir.fut.stripped_future')), 'sir $pv=7 (future): narrows as newest registered (v5), unknown field stripped');
-  ok(!T(g('sir.wid.ok')) && g('sir.wid.code') === 'payload_shape_unrecognized', 'sir mistyped $invite_id (int): shape error-as-data, no cast abort (M1)');
-  ok(!T(g('sir.wnm.ok')) && g('sir.wnm.code') === 'payload_shape_unrecognized', 'sir mistyped $name (int): shape error-as-data, no cast abort (M1)');
-  ok(T(g('sir.wpv.ok')) && g('sir.wpv.v') === '3' && g('sir.wpv.name') === 'Eve', 'sir mistyped $pv (str): tolerated as unstamped, shape-inferred v3 (M1)');
-  ok(T(g('sir.pv4.ok')) && g('sir.pv4.name') === 'Fay', 'sir synthetic $pv=4 (dead 0.4 line): narrows as v3, $name honored (R3)');
-
-  console.log('=== corpus: registry cin (v2/v5 + floor) ===');
-  ok(T(g('cin.v2.ok')), 'cin v2: ok');
-  ok(T(g('cin.v5.ok')), 'cin v5: ok');
-  ok(!T(g('cin.old.ok')) && g('cin.old.code') === 'peer_version_unsupported', 'cin below floor: error-as-data');
-
-  console.log('=== corpus: registry rst (v2/v5 + floor) ===');
-  ok(T(g('rst.v2.ok')), 'rst v2: ok');
-  ok(T(g('rst.v5.ok')), 'rst v5: ok');
-  ok(!T(g('rst.old.ok')) && g('rst.old.code') === 'peer_version_unsupported', 'rst below floor: error-as-data');
-
-  console.log('=== corpus: registry acc (v2/v3 + floor) ===');
-  ok(T(g('acc.v2.ok')) && g('acc.v2.name') === '', 'acc v2: ok, joiner_name empty (cid fallback branch)');
-  ok(T(g('acc.v3.ok')) && g('acc.v3.name') === 'Joi', 'acc v3: ok, $joiner_name honored');
-  ok(!T(g('acc.old.ok')) && g('acc.old.code') === 'peer_version_unsupported', 'acc below floor: error-as-data');
-
-  console.log('=== corpus: registry e2e (v1 + floor + shape + M1 wrong-domain + future) ===');
-  ok(T(g('e2e.pre.ok')) && g('e2e.pre.v') === '8' && g('e2e.pre.ot') === '0', 'e2e pre-key: ok, dispatched v8, $olm_type=0 round-trips');
-  ok(T(g('e2e.nrm.ok')) && g('e2e.nrm.ot') === '1', 'e2e normal ratchet: ok, $olm_type=1 round-trips');
-  ok(!T(g('e2e.old.ok')) && g('e2e.old.code') === 'peer_version_unsupported', 'e2e $pv=1 (below floor): error-as-data peer_version_unsupported');
-  ok(g('e2e.old.peer_v') === '1' && g('e2e.old.min') === '2' && /too old/.test(g('e2e.old.msg')), 'e2e too-old error carries peer_version=1 min=2, human-readable');
-  ok(!T(g('e2e.bad.ok')) && g('e2e.bad.code') === 'payload_shape_unrecognized' && /no supported wire shape/.test(g('e2e.bad.msg')), 'e2e no $e2e_envelope marker: error-as-data payload_shape_unrecognized (distinct msg)');
-  ok(!T(g('e2e.nos.ok')) && g('e2e.nos.code') === 'payload_shape_unrecognized', 'e2e missing $emsignature: shape error-as-data (variant requires the outer sig)');
-  ok(!T(g('e2e.wsid.ok')) && g('e2e.wsid.code') === 'payload_shape_unrecognized', 'e2e mistyped $session_id (int): shape error-as-data, no cast abort (M1)');
-  ok(!T(g('e2e.wot.ok')) && g('e2e.wot.code') === 'payload_shape_unrecognized', 'e2e mistyped $olm_type (str): shape error-as-data, no cast abort (M1)');
-  ok(!T(g('e2e.wct.ok')) && g('e2e.wct.code') === 'payload_shape_unrecognized', 'e2e mistyped $ciphertext (str): shape error-as-data, no cast abort (M1)');
-  ok(!T(g('e2e.wpv.ok')) && g('e2e.wpv.code') === 'payload_shape_unrecognized', 'e2e mistyped $pv (str): malformed discriminator -> shape error-as-data, no cast abort (M1)');
-  ok(T(g('e2e.uns.ok')) && g('e2e.uns.v') === '8' && g('e2e.uns.ot') === '0', 'e2e unstamped (no $pv): tolerated absent-discriminator, defaults to v8, ok (M1)');
-  ok(T(g('e2e.fut.ok')) && g('e2e.fut.ot') === '1', 'e2e $pv=99 (future): narrows as v1 (single registered version), ok');
-  ok(T(g('e2e.bin.ok')) && g('e2e.bin.ot') === '1', 'e2e BINARY $session_id (the shipped adapt wire): dual-accept, narrows ok (§5.9-1)');
-
-  console.log('=== corpus: registry mgb (offer/ack + floor + shape + unstamped + future) ===');
-  ok(T(g('mgb.off.ok')) && g('mgb.off.v') === '9' && T(g('mgb.off.pn_absent')), 'mgb offer: ok, dispatched v9, $peer_nonce absent (offer form)');
-  ok(T(g('mgb.ack.ok')) && T(g('mgb.ack.pn_present')), 'mgb ack: ok, $peer_nonce present (echoes offer nonce)');
-  ok(!T(g('mgb.old.ok')) && g('mgb.old.code') === 'peer_version_unsupported' && g('mgb.old.peer_v') === '1' && g('mgb.old.min') === '2', 'mgb $pv=1 (below floor): error-as-data peer_version_unsupported');
-  ok(!T(g('mgb.wn.ok')) && g('mgb.wn.code') === 'payload_shape_unrecognized', 'mgb mistyped $nonce (str): shape error-as-data, no cast abort (M1)');
-  ok(!T(g('mgb.uns.ok')) && g('mgb.uns.code') === 'payload_shape_unrecognized', 'mgb unstamped (no $pv): shape error-as-data (surface requires the $pv stamp)');
-  ok(T(g('mgb.fut.ok')) && g('mgb.fut.v') === '10', 'mgb $pv=10 (future): narrows as v1 (single registered version), ok');
-
-  console.log('=== corpus: registry mgc (commit/confirm + floor + epoch-domain + M1) ===');
-  ok(T(g('mgc.com.ok')) && T(g('mgc.com.has_sid')), 'mgc commit: ok, $session_id present (commit form)');
-  ok(T(g('mgc.con.ok')) && T(g('mgc.con.no_sid')), 'mgc confirm: ok, $session_id absent (confirm form)');
-  ok(!T(g('mgc.old.ok')) && g('mgc.old.code') === 'peer_version_unsupported', 'mgc $pv=1 (below floor): error-as-data peer_version_unsupported');
-  ok(!T(g('mgc.ne.ok')) && g('mgc.ne.code') === 'payload_shape_unrecognized', 'mgc no $epoch: shape error-as-data (epoch-domain required)');
-  ok(!T(g('mgc.we.ok')) && g('mgc.we.code') === 'payload_shape_unrecognized', 'mgc mistyped $epoch (str): shape error-as-data, no cast abort (M1)');
-  ok(!T(g('mgc.ws.ok')) && g('mgc.ws.code') === 'payload_shape_unrecognized', 'mgc mistyped $session_id (int): shape error-as-data, no cast abort (M1)');
-  ok(T(g('mgc.uns.ok')), 'mgc unstamped (no $pv): tolerated (E2E session authenticates), narrows v1');
-
-  console.log('=== corpus: strict narrow aborts with the stable message ===');
-  let strictMsg = '';
-  try { await mutate('::actor::qa_corpus_narrow_strict_old', {}); } catch (e) { strictMsg = String(e.message); }
-  ok(/too old/.test(strictMsg) && /minimum supported is v2/.test(strictMsg),
-    `strict narrow on below-floor payload aborts with the registry message (got: ${strictMsg.split('\n')[0].slice(0, 120)})`);
-
-  // NOTE: the e2e caps/anti-downgrade routing (a2a_messaging::e2e_route) is
-  // production code that compiles clean, but its MUFL unit test cannot live in
-  // the corpus unit — corpus_actor.mu deliberately does not load a2a_messaging
-  // (the meta-stage type-reduction fuel is per compiled unit; see the header
-  // comment in corpus_actor.mu). Routing is covered by the scenario suite
-  // (test_actor.mu / test.mjs), which owns all state-touching trns.
-
-  console.log('\n================ CORPUS ================');
-  if (scorecard.length === 0) console.log('CORPUS: ALL GREEN');
-  else { console.log(`${scorecard.length} FAILURE(S):`); scorecard.forEach((s) => console.log('  ' + s)); }
-  await sleep(300);
-  process.exit(scorecard.length === 0 ? 0 : 1);
-}
-main().catch((e) => { log('DRIVER ERR:', e.stack ?? e.message); process.exit(1); });

package/mufl_code/core/tests/corpus_actor.mu

@@ -1,242 +0,0 @@
-// Corpus actor for the golden-wire registry gate (tests/corpus.mjs).
-//
-// SPLIT from test_actor.mu deliberately: the compiler bounds meta-stage
-// type-level reduction PER COMPILED UNIT (adapt src/eval/meta_reduction_fuel.h,
-// 1M steps — a consensus-deterministic compile-time DoS guard). AD-v2 embeds
-// t_e2e_bundle inside t_container_identity, which deepens every type reduction
-// that touches t_address_document; test_actor plus the corpus fixtures no
-// longer fits a single unit's budget (and Phase-A adds mgb/mgc fixtures here).
-// Two units = two budgets; the corpus unit stays small and cheap by loading
-// only what try_narrow_* dispatch needs (no a2a_messaging/a2a_protocol).
-application actor loads libraries
-    address_document,
-    address_document_types,
-    key_utils,
-    key_storage,
-    a2a_versions,
-    current_transaction_info,
-    protocol_container,
-    version
-    uses transactions
-{
-    hidden
-    {
-        fn _return_data (payload: any) = (transaction::action::return_data ($kind -> $data, $payload -> payload)).
-    }
-
-    // ---- golden-wire corpus probes (COMPATIBILITY.md release gate) ----
-    // One fixture per REGISTERED version per registry, built as the EXACT wire
-    // shape that version's sender emits (fixtures-as-code: the payloads carry
-    // real global_ids + a real AD, which JSON fixtures cannot encode), replayed
-    // through the registry try_narrow_* dispatch. The driver asserts the branch
-    // taken for every registered version — a release is green only if all pass.
-    trn qa_corpus_narrow _
-    {
-        current_transaction_info::validate_origin_or_abort (transaction::envelope::origin::user,).
-        // Upcast once: AD-v2 embeds t_e2e_bundle, making the full t_address_document
-        // type deep enough that ~40 fixture record literals carrying it exhaust the
-        // compiler's meta-stage type-reduction budget. Fixtures only ever feed
-        // try_narrow_* as `any`; binding my_ad as any keeps every literal's type flat.
-        my_ad = (address_document::get_my_address_document()) as any.
-        iid = _new_id "qa corpus invite".
-        rid = _new_id "qa corpus rid".
-
-        // registry "sir" — leg-1 boxed bundle: v2 (no $name), v3 (+$name),
-        // v5 (+$pv/$caps), a below-floor dialect ($pv -> 1), an unrecognized
-        // shape, and a FUTURE dialect ($pv -> 7, v5 shape + unknown field).
-        sir_v2  = ($ad -> my_ad, $cert -> NIL, $root_profile -> NIL, $cp_binding -> NIL, $invite_id -> iid).
-        sir_v3  = ($ad -> my_ad, $cert -> NIL, $root_profile -> NIL, $cp_binding -> NIL, $invite_id -> iid, $name -> "Bob").
-        sir_v5  = ($ad -> my_ad, $cert -> NIL, $root_profile -> NIL, $cp_binding -> NIL, $invite_id -> iid, $name -> "Carol", $pv -> 5, $caps -> ["core.notifications"]).
-        sir_old = ($ad -> my_ad, $cert -> NIL, $root_profile -> NIL, $cp_binding -> NIL, $invite_id -> iid, $pv -> 1).
-        sir_bad = ($nope -> 1).
-        sir_fut = ($ad -> my_ad, $cert -> NIL, $root_profile -> NIL, $cp_binding -> NIL, $invite_id -> iid, $name -> "Dee", $pv -> 7, $caps -> ["core.notifications"], $future_field -> "F").
-        // M1 wrong-domain fixtures: present-but-mistyped NON-nullable fields
-        // must classify as shape errors (error-as-data), never abort the cast.
-        sir_wid = ($ad -> my_ad, $cert -> NIL, $root_profile -> NIL, $cp_binding -> NIL, $invite_id -> 42).
-        sir_wnm = ($ad -> my_ad, $cert -> NIL, $root_profile -> NIL, $cp_binding -> NIL, $invite_id -> iid, $name -> 42).
-        // Mistyped $pv: tolerated as UNSTAMPED (shape inference applies) — this
-        // one carries $name so it dispatches v3.
-        sir_wpv = ($ad -> my_ad, $cert -> NIL, $root_profile -> NIL, $cp_binding -> NIL, $invite_id -> iid, $name -> "Eve", $pv -> "five").
-        // Synthetic $pv=4 (dead 0.4 line, wire-identical to 0.3): narrows as v3.
-        sir_pv4 = ($ad -> my_ad, $cert -> NIL, $root_profile -> NIL, $cp_binding -> NIL, $invite_id -> iid, $name -> "Fay", $pv -> 4).
-
-        r2 = a2a_versions::try_narrow_sir (sir_v2 as any).
-        r3 = a2a_versions::try_narrow_sir (sir_v3 as any).
-        r5 = a2a_versions::try_narrow_sir (sir_v5 as any).
-        ro = a2a_versions::try_narrow_sir (sir_old as any).
-        rb = a2a_versions::try_narrow_sir (sir_bad as any).
-        rf = a2a_versions::try_narrow_sir (sir_fut as any).
-        rwid = a2a_versions::try_narrow_sir (sir_wid as any).
-        rwnm = a2a_versions::try_narrow_sir (sir_wnm as any).
-        rwpv = a2a_versions::try_narrow_sir (sir_wpv as any).
-        rpv4 = a2a_versions::try_narrow_sir (sir_pv4 as any).
-
-        // registry "cin" — leg-3 boxed bundle: v2 / v5.
-        c2 = a2a_versions::try_narrow_cin ($ad -> my_ad, $cert -> NIL, $root_profile -> NIL, $cp_binding -> NIL, $invite_id -> iid).
-        c5 = a2a_versions::try_narrow_cin ($ad -> my_ad, $cert -> NIL, $root_profile -> NIL, $cp_binding -> NIL, $invite_id -> iid, $pv -> 5, $caps -> []).
-        co = a2a_versions::try_narrow_cin ($ad -> my_ad, $cert -> NIL, $root_profile -> NIL, $cp_binding -> NIL, $invite_id -> iid, $pv -> 1).
-
-        // registry "rst" — restore boxed bundle: v2 / v5.
-        s2 = a2a_versions::try_narrow_rst ($ad -> my_ad, $cert -> NIL, $root_profile -> NIL, $cp_binding -> NIL, $rid -> rid).
-        s5 = a2a_versions::try_narrow_rst ($ad -> my_ad, $cert -> NIL, $root_profile -> NIL, $cp_binding -> NIL, $rid -> rid, $pv -> 5, $caps -> []).
-        so = a2a_versions::try_narrow_rst ($ad -> my_ad, $cert -> NIL, $root_profile -> NIL, $cp_binding -> NIL, $rid -> rid, $pv -> 1).
-
-        // registry "acc" — legacy accept_contact args: v2 (no $joiner_name) / v3.
-        a2 = a2a_versions::try_narrow_acc ($invite_id -> iid, $joiner_ad -> my_ad).
-        a3 = a2a_versions::try_narrow_acc ($invite_id -> iid, $joiner_ad -> my_ad, $joiner_name -> "Joi").
-        ao = a2a_versions::try_narrow_acc ($invite_id -> iid, $joiner_ad -> my_ad, $pv -> 1).
-
-        // registry "e2e" — e2e_signed_message VARIANT ($e2e_envelope -> t_e2e_envelope,
-        // $emsignature): single version, LOAD-BEARING (sir-style payload cast). The $pv
-        // discriminator rides inside $e2e_envelope. Cases mirror sir's abort-free (M1) matrix.
-        ct = _hex_string_to_binary "00112233445566778899aabbccddeeff".
-        sid = _new_id "qa e2e session".
-        sig = key_storage::default_sign (_value_id sid).
-        e_pre = ($e2e_envelope -> ($session_id -> sid, $olm_type -> 0, $ciphertext -> ct, $pv -> 8), $emsignature -> sig).  // PRE_KEY
-        e_nrm = ($e2e_envelope -> ($session_id -> sid, $olm_type -> 1, $ciphertext -> ct, $pv -> 8), $emsignature -> sig).  // normal ratchet
-        e_old = ($e2e_envelope -> ($session_id -> sid, $olm_type -> 1, $ciphertext -> ct, $pv -> 1), $emsignature -> sig).  // inner $pv below floor
-        e_bad = ($nope -> 1).                                                                                              // no $e2e_envelope marker
-        e_nos = ($e2e_envelope -> ($session_id -> sid, $olm_type -> 0, $ciphertext -> ct, $pv -> 8)).                      // missing $emsignature
-        // M1 wrong-domain: present-but-mistyped NON-nullable inner fields -> shape error, never a cast abort.
-        e_wsid = ($e2e_envelope -> ($session_id -> 42,  $olm_type -> 1, $ciphertext -> ct, $pv -> 8), $emsignature -> sig).  // $session_id int
-        e_wot  = ($e2e_envelope -> ($session_id -> sid, $olm_type -> "one", $ciphertext -> ct, $pv -> 8), $emsignature -> sig). // $olm_type str
-        e_wct  = ($e2e_envelope -> ($session_id -> sid, $olm_type -> 1, $ciphertext -> "notbin", $pv -> 8), $emsignature -> sig). // $ciphertext str
-        // Mistyped inner $pv (str): every e2e sender stamps an int $pv, so a present-non-int is
-        // malformed -> shape_error (error-as-data, abort-free), NOT tolerated as unstamped.
-        e_wpv  = ($e2e_envelope -> ($session_id -> sid, $olm_type -> 0, $ciphertext -> ct, $pv -> "eight"), $emsignature -> sig).
-        // Unstamped inner (no $pv): the tolerated absent-discriminator path -> defaults to v8, ok.
-        e_uns  = ($e2e_envelope -> ($session_id -> sid, $olm_type -> 0, $ciphertext -> ct), $emsignature -> sig).
-        // Future dialect (inner $pv=99): single registered version -> narrows as v1 (class-A forward compat).
-        e_fut  = ($e2e_envelope -> ($session_id -> sid, $olm_type -> 1, $ciphertext -> ct, $pv -> 99), $emsignature -> sig).
-        // §5.9-1 dual-accept: the SHIPPED adapt wire carries a BINARY $session_id (session_id()
-        // bytes), NOT a hex string. The core registry must classify it as OK (was is_str-only).
-        bsid   = _hex_string_to_binary "cafebabecafebabecafebabecafebabe".
-        e_bin  = ($e2e_envelope -> ($session_id -> bsid, $olm_type -> 1, $ciphertext -> ct, $pv -> 8), $emsignature -> sig).
-
-        ep = a2a_versions::try_narrow_e2e (e_pre as any).
-        en = a2a_versions::try_narrow_e2e (e_nrm as any).
-        eo = a2a_versions::try_narrow_e2e (e_old as any).
-        eb = a2a_versions::try_narrow_e2e (e_bad as any).
-        ens = a2a_versions::try_narrow_e2e (e_nos as any).
-        ews = a2a_versions::try_narrow_e2e (e_wsid as any).
-        ewo = a2a_versions::try_narrow_e2e (e_wot as any).
-        ewc = a2a_versions::try_narrow_e2e (e_wct as any).
-        ewp = a2a_versions::try_narrow_e2e (e_wpv as any).
-        eu = a2a_versions::try_narrow_e2e (e_uns as any).
-        ef = a2a_versions::try_narrow_e2e (e_fut as any).
-        ebin = a2a_versions::try_narrow_e2e (e_bin as any).
-
-        // registry "mgb" — e2e-migration offer/ack bundle (wire 9, single version).
-        // sir-shape identity bundle ($ad any) + agreement fields: the offer omits
-        // $peer_nonce, the ack echoes the offer nonce. Introduction dialect 9, so
-        // an unstamped body (no $pv) is malformed on this surface -> shape error.
-        mna = _hex_string_to_binary "a0a1a2a3a4a5a6a7a8a9aaabacadaeaf".   // offer nonce (bin)
-        mnb = _hex_string_to_binary "b0b1b2b3b4b5b6b7b8b9babbbcbdbebf".   // ack nonce (bin)
-        mgb_off = ($ad -> my_ad, $cert -> NIL, $root_profile -> NIL, $cp_binding -> NIL, $nonce -> mna, $peer_nonce -> NIL, $pv -> 9, $caps -> ["core.e2e.migrate"]).  // offer form
-        mgb_ack = ($ad -> my_ad, $cert -> NIL, $root_profile -> NIL, $cp_binding -> NIL, $nonce -> mnb, $peer_nonce -> mna, $pv -> 9, $caps -> ["core.e2e.migrate"]).  // ack form (echoes offer nonce)
-        mgb_old = ($ad -> my_ad, $cert -> NIL, $root_profile -> NIL, $cp_binding -> NIL, $nonce -> mna, $peer_nonce -> NIL, $pv -> 1, $caps -> []).       // below floor
-        mgb_wn  = ($ad -> my_ad, $cert -> NIL, $root_profile -> NIL, $cp_binding -> NIL, $nonce -> "notbin", $peer_nonce -> NIL, $pv -> 9, $caps -> []).  // mistyped $nonce (str)
-        mgb_uns = ($ad -> my_ad, $cert -> NIL, $root_profile -> NIL, $cp_binding -> NIL, $nonce -> mna, $peer_nonce -> NIL, $caps -> []).                 // unstamped (no $pv)
-        mgb_fut = ($ad -> my_ad, $cert -> NIL, $root_profile -> NIL, $cp_binding -> NIL, $nonce -> mna, $peer_nonce -> NIL, $pv -> 10, $caps -> []).      // future dialect
-
-        gmo   = a2a_versions::try_narrow_mgb (mgb_off as any).
-        gma   = a2a_versions::try_narrow_mgb (mgb_ack as any).
-        gmold = a2a_versions::try_narrow_mgb (mgb_old as any).
-        gmwn  = a2a_versions::try_narrow_mgb (mgb_wn as any).
-        gmuns = a2a_versions::try_narrow_mgb (mgb_uns as any).
-        gmfut = a2a_versions::try_narrow_mgb (mgb_fut as any).
-
-        // registry "mgc" — e2e-migration commit/confirm inner $targ (wire 9). The
-        // commit carries $session_id; the confirm omits it. $epoch is the required
-        // domain-checked field; $pv is nullable (the E2E session authenticates).
-        mep = _hex_string_to_binary "c0c1c2c3c4c5c6c7c8c9cacbcccdcecf".   // epoch (bin)
-        msd = _hex_string_to_binary "d0d1d2d3d4d5d6d7d8d9dadbdcdddedf".   // session_id (bin)
-        mgc_com = ($epoch -> mep, $session_id -> msd, $pv -> 9).          // COMMIT form
-        mgc_con = ($epoch -> mep, $pv -> 9).                             // CONFIRM form (no $session_id)
-        mgc_old = ($epoch -> mep, $session_id -> msd, $pv -> 1).          // below floor
-        mgc_ne  = ($session_id -> msd, $pv -> 9).                        // no $epoch -> shape err (epoch-domain)
-        mgc_we  = ($epoch -> "notbin", $session_id -> msd, $pv -> 9).     // mistyped $epoch (str) -> shape err
-        mgc_ws  = ($epoch -> mep, $session_id -> 42, $pv -> 9).           // mistyped $session_id (int) -> shape err (M1)
-        mgc_uns = ($epoch -> mep, $session_id -> msd).                   // unstamped (no $pv) -> tolerated, ok
-
-        cco   = a2a_versions::try_narrow_mgc (mgc_com as any).
-        ccn   = a2a_versions::try_narrow_mgc (mgc_con as any).
-        ccold = a2a_versions::try_narrow_mgc (mgc_old as any).
-        ccne  = a2a_versions::try_narrow_mgc (mgc_ne as any).
-        ccwe  = a2a_versions::try_narrow_mgc (mgc_we as any).
-        ccws  = a2a_versions::try_narrow_mgc (mgc_ws as any).
-        ccuns = a2a_versions::try_narrow_mgc (mgc_uns as any).
-
-        return transaction::success [ _return_data (
-            $sir -> (
-                $v2  -> ($ok -> (r2 $ok), $v -> (a2a_versions::sir_version_of (sir_v2 as any)), $name -> (a2a_versions::sir_joiner_name ((r2 $payload)?))),
-                $v3  -> ($ok -> (r3 $ok), $v -> (a2a_versions::sir_version_of (sir_v3 as any)), $name -> (a2a_versions::sir_joiner_name ((r3 $payload)?))),
-                $v5  -> ($ok -> (r5 $ok), $v -> (a2a_versions::sir_version_of (sir_v5 as any)), $name -> (a2a_versions::sir_joiner_name ((r5 $payload)?))),
-                $old -> ($ok -> (ro $ok), $code -> (((ro $err)?) $code), $msg -> (((ro $err)?) $message), $peer_v -> (((ro $err)?) $peer_version), $min -> (((ro $err)?) $min_supported)),
-                $bad -> ($ok -> (rb $ok), $code -> (((rb $err)?) $code), $msg -> (((rb $err)?) $message)),
-                $fut -> ($ok -> (rf $ok), $name -> (a2a_versions::sir_joiner_name ((rf $payload)?)), $stripped_future -> ((((rf $payload)?) as any) $future_field == NIL)),
-                $wid -> ($ok -> (rwid $ok), $code -> (((rwid $err)?) $code)),
-                $wnm -> ($ok -> (rwnm $ok), $code -> (((rwnm $err)?) $code)),
-                $wpv -> ($ok -> (rwpv $ok), $name -> (a2a_versions::sir_joiner_name ((rwpv $payload)?)), $v -> (a2a_versions::sir_version_of (sir_wpv as any))),
-                $pv4 -> ($ok -> (rpv4 $ok), $name -> (a2a_versions::sir_joiner_name ((rpv4 $payload)?)))
-            ),
-            $cin -> (
-                $v2  -> ($ok -> (c2 $ok)),
-                $v5  -> ($ok -> (c5 $ok)),
-                $old -> ($ok -> (co $ok), $code -> (((co $err)?) $code))
-            ),
-            $rst -> (
-                $v2  -> ($ok -> (s2 $ok)),
-                $v5  -> ($ok -> (s5 $ok)),
-                $old -> ($ok -> (so $ok), $code -> (((so $err)?) $code))
-            ),
-            $acc -> (
-                $v2  -> ($ok -> (a2 $ok), $name -> (a2a_versions::acc_joiner_name ((a2 $payload)?))),
-                $v3  -> ($ok -> (a3 $ok), $name -> (a2a_versions::acc_joiner_name ((a3 $payload)?))),
-                $old -> ($ok -> (ao $ok), $code -> (((ao $err)?) $code))
-            ),
-            $e2e -> (
-                $pre -> ($ok -> (ep $ok), $v -> (a2a_versions::e2e_version_of (e_pre as any)), $ot -> (((ep $payload)?) $e2e_envelope $olm_type)),
-                $nrm -> ($ok -> (en $ok), $ot -> (((en $payload)?) $e2e_envelope $olm_type)),
-                $old -> ($ok -> (eo $ok), $code -> (((eo $err)?) $code), $peer_v -> (((eo $err)?) $peer_version), $min -> (((eo $err)?) $min_supported), $msg -> (((eo $err)?) $message)),
-                $bad -> ($ok -> (eb $ok), $code -> (((eb $err)?) $code), $msg -> (((eb $err)?) $message)),
-                $nos -> ($ok -> (ens $ok), $code -> (((ens $err)?) $code)),
-                $wsid -> ($ok -> (ews $ok), $code -> (((ews $err)?) $code)),
-                $wot -> ($ok -> (ewo $ok), $code -> (((ewo $err)?) $code)),
-                $wct -> ($ok -> (ewc $ok), $code -> (((ewc $err)?) $code)),
-                $wpv -> ($ok -> (ewp $ok), $code -> (((ewp $err)?) $code)),
-                $uns -> ($ok -> (eu $ok), $v -> (a2a_versions::e2e_version_of (e_uns as any)), $ot -> (((eu $payload)?) $e2e_envelope $olm_type)),
-                $fut -> ($ok -> (ef $ok), $ot -> (((ef $payload)?) $e2e_envelope $olm_type)),
-                $bin -> ($ok -> (ebin $ok), $ot -> (((ebin $payload)?) $e2e_envelope $olm_type))
-            ),
-            $mgb -> (
-                $off -> ($ok -> (gmo $ok), $v -> (a2a_versions::mgb_version_of (mgb_off as any)), $pn_absent -> ((((gmo $payload)?) as any) $peer_nonce == NIL)),
-                $ack -> ($ok -> (gma $ok), $pn_present -> ((((gma $payload)?) as any) $peer_nonce != NIL)),
-                $old -> ($ok -> (gmold $ok), $code -> (((gmold $err)?) $code), $peer_v -> (((gmold $err)?) $peer_version), $min -> (((gmold $err)?) $min_supported)),
-                $wn  -> ($ok -> (gmwn $ok), $code -> (((gmwn $err)?) $code)),
-                $uns -> ($ok -> (gmuns $ok), $code -> (((gmuns $err)?) $code)),
-                $fut -> ($ok -> (gmfut $ok), $v -> (a2a_versions::mgb_version_of (mgb_fut as any)))
-            ),
-            $mgc -> (
-                $com -> ($ok -> (cco $ok), $has_sid -> ((((cco $payload)?) as any) $session_id != NIL)),
-                $con -> ($ok -> (ccn $ok), $no_sid -> ((((ccn $payload)?) as any) $session_id == NIL)),
-                $old -> ($ok -> (ccold $ok), $code -> (((ccold $err)?) $code)),
-                $ne  -> ($ok -> (ccne $ok), $code -> (((ccne $err)?) $code)),
-                $we  -> ($ok -> (ccwe $ok), $code -> (((ccwe $err)?) $code)),
-                $ws  -> ($ok -> (ccws $ok), $code -> (((ccws $err)?) $code)),
-                $uns -> ($ok -> (ccuns $ok))
-            )
-        ) ].
-    }
-
-    // The STRICT narrow on a below-floor payload must abort with the stable
-    // error message (never a raw NIL-cast EVAL_ERROR) — driver asserts the text.
-    trn qa_corpus_narrow_strict_old _
-    {
-        current_transaction_info::validate_origin_or_abort (transaction::envelope::origin::user,).
-        my_ad = address_document::get_my_address_document().
-        iid = _new_id "qa strict".
-        p = a2a_versions::narrow_sir ($ad -> my_ad, $cert -> NIL, $root_profile -> NIL, $cp_binding -> NIL, $invite_id -> iid, $pv -> 1).
-        return transaction::success [ _return_data ($unreachable -> ((p as any) $invite_id)) ].
-    }
-}

package/mufl_code/core/tests/fatcompile_actor.mu

@@ -1,52 +0,0 @@
-// COMPILE-ONLY regression guard for the daemon build path (issue: the migration core
-// overflowed the per-unit meta-stage reduction fuel — adapt src/eval/meta_reduction_fuel.h,
-// 1M steps — when compiled into a FULL ours-mcp daemon packet, because a dead 5th
-// transaction::type wire-union variant (e2e_signed_message, Option A) inflated __t_wrapper's
-// per-transaction body SAFE-cast reduction; fixed by dropping the variant → 4 variants).
-//
-// This actor deliberately loads the HEAVY daemon-side libraries TOGETHER —
-//   a2a_messaging (the migration surface) + a2a_cluster + a2a_capabilities —
-// which is the composition the real ours-mcp daemon actor.mu uses (per its compile trace: it loads
-// a2a_messaging + a2a_cluster). It goes through the SAME __t_wrapper meta path at ~daemon
-// transaction-count scale that no other test unit exercised (mig/migapp/test/notif each load a
-// SUBSET, and none combine messaging+cluster). If the migration core ever re-inflates __t_wrapper's
-// per-transaction body SAFE-cast reduction past the ceiling, THIS compile fails — catching it in-repo
-// instead of at the daemon. It defines NO qa probes and runs no driver; producing a .muflo IS the
-// whole test (see run_fatcompile.sh). Keep it lean: it stresses type-level reduction, not runtime.
-application actor loads libraries
-    identity_proof_document,
-    attestation_document,
-    native_attestation_document,
-    transaction_message_decoder,
-    address_document,
-    address_document_types,
-    key_utils,
-    key_storage,
-    continuation,
-    encrypted_channel,
-    a2a_versions,
-    a2a_capabilities,
-    a2a_protocol,
-    a2a_messaging,
-    a2a_cluster,
-    current_transaction_info,
-    protocol_container,
-    version
-    uses transactions
-{
-    hidden
-    {
-        _read_or_abort = grab( _read_or_abort ).
-        key_storage::init ($_read_or_abort -> _read_or_abort).
-        encrypted_channel::init ($_read_or_abort -> _read_or_abort).
-        a2a_messaging::init (
-            $_read_or_abort      -> _read_or_abort,
-            $on_message_received -> fn (_: any) -> transaction::action::type[] { return []. },
-            $on_message_sent     -> fn (_: any) -> transaction::action::type[] { return []. },
-            $on_contact_removed  -> fn (_: any) -> transaction::action::type[] { return []. },
-            $on_file_received    -> fn (_: any) -> transaction::action::type[] { return []. },
-            $on_file_sent        -> fn (_: any) -> transaction::action::type[] { return []. },
-            $on_receipt_received -> fn (_: any) -> transaction::action::type[] { return []. }
-        ).
-    }
-}