@ours.network/notifications 0.1.1

package/mufl_code/core/tests/migapp_actor.mu

@@ -0,0 +1,294 @@
+// App-e2e RECEIVE-path guard-matrix test actor (spec §5.5/§5.6/§4, increment C).
+//
+// SPLIT from mig_actor.mu for the SAME reason mig_actor split from test_actor: the
+// compiler bounds meta-stage type-level reduction PER COMPILED UNIT (~1M steps), and
+// mig_actor (which loads a2a_messaging + the full migration FSM surface) is already AT
+// that ceiling — it cannot take the extra state-synthesis helper this matrix needs. This
+// leaner unit loads a2a_messaging (NOT a2a_notifications) + only the qa surface the
+// app-e2e guard matrix drives, reclaiming budget for qa_mig_set_committed.
+application actor loads libraries
+    identity_proof_document,
+    attestation_document,
+    native_attestation_document,
+    transaction_message_decoder,
+    address_document,
+    address_document_types,
+    key_utils,
+    key_storage,
+    e2e,
+    continuation,
+    encrypted_channel,
+    a2a_versions,
+    a2a_capabilities,
+    a2a_protocol,
+    a2a_messaging,
+    current_transaction_info,
+    protocol_container,
+    version
+    uses transactions
+{
+    hidden
+    {
+        fn _return_data (payload: any) = (transaction::action::return_data ($kind -> $data, $payload -> payload)).
+        _read_or_abort = grab( _read_or_abort ).
+        key_storage::init ($_read_or_abort -> _read_or_abort).
+        encrypted_channel::init ($_read_or_abort -> _read_or_abort).
+        // RECORDING storage hooks — surface the last delivered message/file so the driver can prove
+        // handle_receive_e2e_message/_file decrypted + DELIVERED the plaintext to the app hook.
+        // qa_recv_abort makes the message hook ABORT (must-fix-C rollback probe).
+        qa_recv_text is str = "".
+        qa_recv_wire is str = "".
+        qa_recv_file is str = "".
+        qa_recv_flen is int = 0.
+        qa_recv_count is int = 0.
+        qa_recv_abort is bool = FALSE.
+        a2a_messaging::init (
+            $_read_or_abort      -> _read_or_abort,
+            $on_message_received -> fn (a: any) -> transaction::action::type[] {
+                abort "qa_recv_abort: app hook rejected the message (must-fix-C rollback probe)" WHEN qa_recv_abort.
+                qa_recv_text -> ((a $text) safe str).
+                if (a $wire_id) != NIL { qa_recv_wire -> ((a $wire_id) safe str). }
+                qa_recv_count -> (qa_recv_count + 1).
+                return []. },
+            $on_message_sent     -> fn (_: any) -> transaction::action::type[] { return []. },
+            $on_contact_removed  -> fn (_: any) -> transaction::action::type[] { return []. },
+            $on_file_received    -> fn (a: any) -> transaction::action::type[] {
+                qa_recv_file -> ((a $filename) safe str).
+                qa_recv_flen -> (_binlen ((a $data) safe bin)).
+                qa_recv_count -> (qa_recv_count + 1).
+                return []. },
+            $on_file_sent        -> fn (_: any) -> transaction::action::type[] { return []. },
+            $on_receipt_received -> fn (_: any) -> transaction::action::type[] { return []. }
+        ).
+    }
+
+    // ── e2e crypto-layer wrappers (shuttle opaque envelope fields + the peer ik between packets).
+    trn readonly qa_e2e_bundle _ { return ($bundle -> (_write (e2e::my_public_bundle()))). }
+    trn readonly qa_e2e_ik _ { return ($ik -> ((e2e::my_public_bundle()) $ik_curve)). }
+
+    trn qa_e2e_first_send _:($cid -> cid: global_id, $pt -> pt: bin, $peer -> peer_blob: bin)
+    {
+        peer = (_read_or_abort peer_blob) safe address_document_types::t_e2e_bundle.
+        env = e2e::encrypt_to cid pt peer.
+        e = env $e2e_envelope.
+        return transaction::success [ _return_data ($session_id -> (e $session_id), $olm_type -> (e $olm_type), $ciphertext -> (e $ciphertext)) ].
+    }
+
+    trn qa_e2e_recv _:($from -> from_cid: global_id, $ik -> ik: bin, $olm_type -> ot: int, $ciphertext -> ct: bin)
+    {
+        r = e2e::decrypt_and_commit from_cid ik ot ct.
+        pt is bin+ = NIL.  if r $ok { pt -> (r $plaintext) as bin. }
+        return transaction::success [ _return_data ( $ok -> (r $ok), $plaintext -> pt ) ].
+    }
+
+    trn qa_e2e_stage_out _:($cid -> cid: global_id, $peer -> peer_blob: bin)
+    {
+        peer = (_read_or_abort peer_blob) safe address_document_types::t_e2e_bundle.
+        return transaction::success [ _return_data ($sid -> (e2e::stage_outbound_rotation cid peer)) ].
+    }
+
+    trn qa_e2e_enc_staged _:($cid -> cid: global_id, $pt -> pt: bin)
+    {
+        env = e2e::encrypt_staged cid pt.
+        e = env $e2e_envelope.
+        return transaction::success [ _return_data ($session_id -> (e $session_id), $olm_type -> (e $olm_type), $ciphertext -> (e $ciphertext)) ].
+    }
+
+    trn qa_e2e_stage_in _:($from -> from_cid: global_id, $ik -> ik: bin, $ciphertext -> ct: bin)
+    {
+        r = e2e::stage_inbound_rotation from_cid ik ct.
+        pt is bin+ = NIL.  if r $ok { pt -> (r $plaintext) as bin. }
+        return transaction::success [ _return_data ( $ok -> (r $ok), $plaintext -> pt ) ].
+    }
+
+    trn qa_e2e_commit _:($cid -> cid: global_id)
+    {
+        sid = e2e::commit_rotation cid.
+        return transaction::success [ _return_data ($sid -> sid, $committed -> (sid != NIL)) ].
+    }
+
+    trn readonly qa_e2e_active _:($cid -> cid: global_id) { return ($sid -> (e2e::active_session_id cid)). }
+    trn readonly qa_e2e_staged _:($cid -> cid: global_id) { return ($sid -> (e2e::staged_session_id cid)). }
+
+    // ── delivery observability + the must-fix-C rollback probe.
+    trn readonly qa_recv_last _ { return ($text -> qa_recv_text, $wire -> qa_recv_wire, $count -> qa_recv_count, $filename -> qa_recv_file, $flen -> qa_recv_flen). }
+    trn qa_recv_reset _ { qa_recv_text -> "".  qa_recv_wire -> "".  qa_recv_file -> "".  qa_recv_flen -> 0.  return transaction::success [ _return_data ($ok -> TRUE) ]. }
+    trn qa_recv_set_abort _:($abort -> ab: bool) { qa_recv_abort -> ab.  return transaction::success [ _return_data ($abort -> qa_recv_abort) ]. }
+
+    // Learn a peer's version/caps (caps incl. "core.e2e" → note_e2e_seen sets contact_e2e_seen).
+    trn qa_learn_peer _:($cid -> cid: global_id, $pv -> pv: int, $caps -> caps: str[])
+    {
+        a2a_messaging::learn_contact_version cid pv caps.
+        return transaction::success [ _return_data ($ok -> TRUE) ].
+    }
+
+    // Advertise a self-cap (e.g. cap_e2e_migrate) WITHOUT the proactive-offer side effect of the real
+    // advertise_migrate tx — so the D-path test can isolate the inbound-e2e trigger from the B-path.
+    trn qa_init_caps _:($advertise -> adv: str[])
+    {
+        a2a_capabilities::init (
+            $describe -> fn (_: any) -> a2a_capabilities::app_manifest_t
+            { return ($version -> 1, $app_id -> "migapp.actor", $name -> "actor", $description -> "", $monitoring_status -> "off", $capabilities -> (,)). },
+            $supported -> [], $handlers -> (,),
+            $on_unknown -> fn (_: any) -> transaction::action::type[] { return []. },
+            $authorizer -> NIL, $advertise -> adv ).
+        return transaction::success [ _return_data ($set -> TRUE) ].
+    }
+
+    // Synthesize a box-only COMMITTED-INITIATOR FSM entry over an already-staged rotation (the
+    // implicit-confirm setup — no live broker handshake). $session_id must equal the staged slot's
+    // id so committed_match holds. $seen=TRUE makes it PRODUCTION-LIKE (a real migrating pair
+    // advertises cap_e2e ⇒ contact_e2e_seen set by `committed`) — the exact state where do_ic must
+    // STILL fire (MigrationReview #3). Fresh-budget unit ⇒ the inline mig_state_t literal fits.
+    trn qa_mig_set_committed _:($cid -> cid: global_id, $session_id -> sid: bin, $seen -> seen: bool)
+    {
+        now = (current_transaction_info::get_transaction_time())?.
+        a2a_messaging::contact_migration cid -> ( $phase -> "committed", $initiator -> TRUE,
+            $local_nonce -> sid, $peer_nonce -> sid, $epoch -> sid, $session_id -> sid,
+            $local_bundle -> sid, $local_fp -> sid, $attempts -> 0, $updated -> now ).
+        if seen { a2a_messaging::contact_e2e_seen cid -> TRUE. }
+        return transaction::success [ _return_data ($ok -> TRUE) ].
+    }
+
+    // Synthesize an ACTIVE responder over an already-PROMOTED rotation (post-commit state): FSM
+    // phase=active + the epoch pin bound to the LIVE active session (so mig_handle_replayed_commit's
+    // "pin.$session_id == active_session_id" evidence rule holds). $epoch is the shared migration
+    // epoch (== the initiator's committed epoch) so the re-confirm this responder emits on a
+    // redelivered commit carries the epoch the initiator gates on. Drives the §5.8 lost-confirm
+    // recovery: the initiator's sweep re-sends its commit → this active responder re-confirms.
+    trn qa_mig_set_active _:($cid -> cid: global_id, $epoch -> ep: bin, $initiator -> ini: bool)
+    {
+        now = (current_transaction_info::get_transaction_time())?.
+        asid = (e2e::active_session_id cid)?.
+        a2a_messaging::contact_migration cid -> ( $phase -> "active", $initiator -> ini,
+            $local_nonce -> ep, $peer_nonce -> ep, $epoch -> ep, $session_id -> asid,
+            $local_bundle -> ep, $local_fp -> ep, $attempts -> 0, $updated -> now ).
+        a2a_messaging::contact_e2e_epoch cid -> ( $epoch -> ep, $session_id -> asid ).
+        a2a_messaging::contact_e2e_seen cid -> TRUE.
+        return transaction::success [ _return_data ($ok -> TRUE, $asid -> asid) ].
+    }
+
+    // Synthesize an ACKNOWLEDGED responder with a stored migration epoch — the pre-commit FSM state
+    // (mig_pending TRUE ⇒ an inbound commit STAGES a fresh session). No epoch pin yet. Drives the
+    // §5.8 forged-commit-at-real-handler row: a crypto-valid commit whose INNER epoch/session is
+    // forged reaches handle_e2e_migrate_commit GATE 3 and is rejected (discard_rotation, stay acknowledged).
+    trn qa_mig_set_acknowledged _:($cid -> cid: global_id, $epoch -> ep: bin)
+    {
+        now = (current_transaction_info::get_transaction_time())?.
+        a2a_messaging::contact_migration cid -> ( $phase -> "acknowledged", $initiator -> FALSE,
+            $local_nonce -> ep, $peer_nonce -> ep, $epoch -> ep, $session_id -> ep,
+            $local_bundle -> ep, $local_fp -> ep, $attempts -> 0, $updated -> now ).
+        return transaction::success [ _return_data ($ok -> TRUE) ].
+    }
+
+    // Send a REAL migration COMMIT (initiator → responder): stage a fresh outbound rotation, encrypt
+    // the commit body (name + {epoch, session_id, pv}) as a PRE_KEY message on the staged session, box
+    // it as e2e_migrate_commit exactly as the initiator's commit leg does. The inner $session_id is
+    // ALWAYS the real staged session (so it matches the responder's carrier), leaving $epoch as the
+    // one caller-controlled gating field: pass the responder's stored epoch for a valid commit, or a
+    // different value to forge it. The crypto stays valid (S1/S2 + decrypt succeed), so a forged epoch
+    // is rejected at handle_e2e_migrate_commit GATE 3 — not at the decode seam. Returns the staged sid.
+    trn qa_send_commit _:($contact -> cref: str, $peer -> peer_blob: bin, $epoch -> ep: bin)
+    {
+        target_id = a2a_messaging::resolve_contact cref.
+        peer = (_read_or_abort peer_blob) safe address_document_types::t_e2e_bundle.
+        sid = e2e::stage_outbound_rotation target_id peer.
+        commit_body = _write ( $name -> "::a2a_messaging::e2e_migrate_commit",
+                               $targ -> ( $epoch -> ep, $session_id -> sid, $pv -> a2a_versions::wire_version ) ).
+        env = e2e::encrypt_staged target_id commit_body.
+        return transaction::success [
+            encrypted_channel::send_encrypted_tx target_id (
+                $name -> "::a2a_messaging::e2e_migrate_commit",
+                $targ -> ( $e2e_envelope -> (env $e2e_envelope), $emsignature -> (env $emsignature) ) ),
+            _return_data ($sid -> sid) ].
+    }
+
+    // Set a migration entry's $attempts (drive the sweep to its cap without 30 real re-drives).
+    trn qa_mig_set_attempts _:($cid -> cid: global_id, $n -> n: int)
+    {
+        st = a2a_messaging::contact_migration cid.
+        a2a_messaging::contact_migration cid -> ( $phase -> ((st?) $phase), $initiator -> ((st?) $initiator),
+            $local_nonce -> ((st?) $local_nonce), $peer_nonce -> ((st?) $peer_nonce), $epoch -> ((st?) $epoch),
+            $session_id -> ((st?) $session_id), $local_bundle -> ((st?) $local_bundle), $local_fp -> ((st?) $local_fp),
+            $attempts -> n, $updated -> ((st?) $updated) ).
+        return transaction::success [ _return_data ($ok -> TRUE) ].
+    }
+
+    // Drop ALL peer address documents — the spec's "degraded contact" state (a breaking-change
+    // migration / restart lost peer_ads). Drives the §5.6 recovery composition: a pinned-but-degraded
+    // contact must RESTORE first (re-fetch the AD) before the migration route can deliver.
+    trn qa_strip_peer_ads _
+    {
+        a2a_messaging::peer_ads -> (,).
+        return transaction::success [ _return_data ($ok -> TRUE) ].
+    }
+
+    // Downgrade a peer's address document to v1 IN PLACE: keep the AD PRESENT in peer_ads but drop its
+    // $e2e_bundle (typed any+, so NIL is valid). This is the "v1-presenting / self-downgraded" peer —
+    // distinct from qa_strip_peer_ads (which removes the AD entirely = degraded). Drives §5.6 recovery
+    // br2: a pinned peer whose CURRENT AD carries no e2e bundle must fail closed (downgrade_refused),
+    // NOT enter the peer_ads==NIL restore-first branch (which would restore-loop on an AD that is present).
+    trn qa_downgrade_peer_ad _:($cid -> cid: global_id)
+    {
+        ad = a2a_messaging::peer_ads cid.
+        if ad == NIL { return transaction::success [ _return_data ($ok -> FALSE) ]. }
+        a = ad?.
+        a2a_messaging::peer_ads cid -> (
+            $version -> (a $version),
+            $identity -> ( $key_list -> (a $identity $key_list),
+                           $default_keys -> (a $identity $default_keys),
+                           $container_id -> (a $identity $container_id),
+                           $e2e_bundle -> NIL ),
+            $authorizations -> (a $authorizations) ).
+        return transaction::success [ _return_data ($ok -> TRUE) ].
+    }
+
+    trn readonly qa_e2e_route _:($cid -> cid: global_id) { return ($route -> (a2a_messaging::e2e_route cid)). }
+
+    // Synthesize an epoch PIN for a cid (imported-migration state). With NO peer bundle in peer_ads,
+    // e2e_route returns "downgrade_refused" (§5.6: pinned but no v2 bundle → fail closed).
+    trn qa_set_epoch_pin _:($cid -> cid: global_id, $session_id -> sid: bin)
+    {
+        a2a_messaging::contact_e2e_epoch cid -> ( $epoch -> sid, $session_id -> sid ).
+        a2a_messaging::contact_e2e_seen cid -> TRUE.
+        return transaction::success [ _return_data ($ok -> TRUE) ].
+    }
+
+    // Send a REAL explicit migration CONFIRM (responder → initiator) — encrypt the confirm body on
+    // my active (rotation) session and box it as e2e_migrate_confirm, exactly as handle_e2e_migrate_
+    // commit does. Lets the interleave test drive {confirm-then-app} / {app-then-confirm} and assert
+    // exactly ONE promotion. $epoch must equal the initiator's committed epoch.
+    trn qa_send_confirm _:($contact -> cref: str, $peer -> peer_blob: bin, $epoch -> ep: bin)
+    {
+        target_id = a2a_messaging::resolve_contact cref.
+        peer = (_read_or_abort peer_blob) safe address_document_types::t_e2e_bundle.
+        confirm_body = _write ( $name -> "::a2a_messaging::e2e_migrate_confirm", $targ -> ( $epoch -> ep, $pv -> a2a_versions::wire_version ) ).
+        cenv = e2e::encrypt_to target_id confirm_body peer.
+        return transaction::success [
+            encrypted_channel::send_encrypted_tx target_id (
+                $name -> "::a2a_messaging::e2e_migrate_confirm",
+                $targ -> ( $e2e_envelope -> (cenv $e2e_envelope), $emsignature -> (cenv $emsignature) ) ),
+            _return_data ($sent_to -> target_id) ].
+    }
+
+    trn readonly qa_mig_state _:($cid -> cid: global_id)
+    {
+        st = a2a_messaging::contact_migration cid.
+        return (
+            $present   -> (st != NIL),
+            $phase     -> ((st == NIL ?? "" ; ((st?) $phase))),
+            $initiator -> ((st == NIL ?? FALSE ; ((st?) $initiator)))
+        ).
+    }
+    trn readonly qa_mig_pin _:($cid -> cid: global_id)
+    {
+        ep = a2a_messaging::contact_e2e_epoch cid.
+        esid is bin+ = NIL.
+        if ep != NIL { esid -> (ep?) $session_id. }
+        return (
+            $pinned     -> (ep != NIL),
+            $session_id -> esid,
+            $seen       -> ((a2a_messaging::contact_e2e_seen cid) == TRUE)
+        ).
+    }
+}

package/mufl_code/core/tests/mufl_semantics/run.sh

@@ -0,0 +1,69 @@
+#!/usr/bin/env bash
+# Language-semantics pins for the versioned type registry (PLAN Step 4.3 / SPEC Q3-residual).
+#
+# The registry's safety rests on mufl behaviors that are pinned by tests, not yet by written
+# language docs: safe-cast tolerates+strips extra record fields, disjunction casts pick
+# alternatives in CANONICAL (not declaration) order and rebuild the result, and the
+# dispatch-then-exact-cast pattern (t11) works across three wire versions. If the vendored
+# toolchain ever regresses any of these, this runner fails BEFORE the behavioral suite runs.
+#
+#   MUFL_PKG  path to the vendored @adapt-toolkit/mufl package (default: ours-mcp's)
+set -u
+HERE=$(cd "$(dirname "$0")" && pwd)
+MUFL_PKG=${MUFL_PKG:-/home/fleet/ours.network/ours-mcp/node_modules/@adapt-toolkit/mufl}
+RUN="node $MUFL_PKG/bin/mufl.js run"
+fail=0
+
+check () { # file, expected-grep...
+  local f=$1; shift
+  local out
+  out=$(cd "$HERE" && $RUN "$f" 2>&1)
+  for want in "$@"; do
+    if ! grep -qF "$want" <<<"$out"; then
+      echo "✗ $f: missing expected line: $want"
+      echo "$out" | sed 's/^/    /'
+      fail=1
+      return
+    fi
+  done
+  echo "✓ $f"
+}
+
+# safe cast: extra fields tolerated, STRIPPED from the rebuilt result (never abort).
+check t2_extra_fields.mufl \
+  "w \$c = %%NIL" \
+  "same value_id: %%FALSE"
+
+# runtime paths: stripping identical at runtime; disjunction picks by CANONICAL order
+# under BOTH declaration orders (version-specific fields survive either way here, which
+# is exactly why a cast-to-union must never be the version selector — REG-4).
+check t7_runtime.mufl \
+  "runtime extra-field: stripped" \
+  "runtime old-first:   name kept" \
+  "runtime new-first:   name kept"
+
+# disjunction cast REBUILDS (new value id) and strips fields unknown to all alternatives.
+check t9_passthrough.mufl \
+  "disjunction cast: rebuilt" \
+  "unknown extra across union: future field LOST"
+
+# the full registry pattern: three wire versions in, three branches taken.
+check t11_three_version.mufl \
+  "v0.2 way: fallback name from sender cid" \
+  "v0.3 way: name=Bob" \
+  "v0.5 way: name=Carol pv=5"
+
+# string '<' is a STRICT TOTAL ORDER — the invariant the 0.9.0 migration election
+# (str_lt / mig_initiator) depends on; a regression here would split-brain the election.
+check t_str_order.mufl \
+  "irreflexive: F" \
+  "lt: T" \
+  "antisym: F" \
+  "prefix1: T" \
+  "prefix2: T" \
+  "hexlt: T" \
+  "hexeq: F" \
+  "hexgt: F"
+
+[ $fail -eq 0 ] && echo "SEMANTICS PINS: ALL GREEN" || echo "SEMANTICS PINS: FAILURES"
+exit $fail

package/mufl_code/core/tests/mufl_semantics/t11_three_version.mufl

@@ -0,0 +1,47 @@
+// The real worked example: submit_invite_response across 0.2 / 0.3 / 0.5
+script
+{
+    // ---- versioned input types (the registry entries) ----
+    metadef sir_input_v02_t: ($invite_id -> str, $data -> str).
+    metadef sir_input_v03_t: ($invite_id -> str, $data -> str, $name -> str).
+    metadef sir_input_v05_t: ($invite_id -> str, $data -> str, $name -> str, $pv -> int).
+    // union of supported versions (type-level registry face)
+    metadef sir_input_t: sir_input_v05_t || sir_input_v03_t || sir_input_v02_t.
+    // ordered version vector (type-level list of registered versions)
+    metadef sir_versions_t: [sir_input_v02_t, sir_input_v03_t, sir_input_v05_t].
+
+    fn version_of (raw: any) -> int {
+        pvv = raw $pv.
+        if pvv != NIL { return pvv SAFE(int). }
+        return ((raw $name) != NIL ?? 3 ; 2).   // pre-$pv versions: distinguish by shape
+    }
+
+    fn handle_sir (input: sir_input_t) -> str {
+        raw = input as any.
+        v = version_of raw.
+        if v >= 5 {
+            p = raw SAFE(sir_input_v05_t).
+            return "v0.5 way: name=" + (p $name) + " pv=" + (_str (p $pv)).
+        }
+        if v == 3 {
+            p = raw SAFE(sir_input_v03_t).
+            return "v0.3 way: name=" + (p $name).
+        }
+        p = raw SAFE(sir_input_v02_t).
+        return "v0.2 way: fallback name from sender cid".
+    }
+
+    fn narrow (raw: any) -> sir_input_t {
+        v = version_of raw.
+        if v >= 5 { return raw SAFE(sir_input_v05_t). }
+        if v == 3 { return raw SAFE(sir_input_v03_t). }
+        return raw SAFE(sir_input_v02_t).
+    }
+
+    p02 = ($invite_id -> "I", $data -> "D").
+    p03 = ($invite_id -> "I", $data -> "D", $name -> "Bob").
+    p05 = ($invite_id -> "I", $data -> "D", $name -> "Carol", $pv -> 5).
+    _print (handle_sir (narrow p02)) "\n".
+    _print (handle_sir (narrow p03)) "\n".
+    _print (handle_sir (narrow p05)) "\n".
+}

package/mufl_code/core/tests/mufl_semantics/t2_extra_fields.mufl

@@ -0,0 +1,11 @@
+// T-B: safe cast of a record with EXTRA fields; is the extra field kept or stripped?
+script
+{
+    metadef small_t: ($a -> int, $b -> str).
+    v = ($a -> 1, $b -> "x", $c -> "EXTRA").
+    w = v SAFE(small_t).
+    _print "cast ok; w = " w "\n".
+    c = (w as any) $c.
+    _print "w $c = " c "\n".
+    _print "same value_id: " (_value_id v == _value_id w) "\n".
+}

package/mufl_code/core/tests/mufl_semantics/t7_runtime.mufl

@@ -0,0 +1,30 @@
+// Runtime (any-typed) behavior: stripping, disjunction ordering, union param check
+script
+{
+    metadef small_t: ($a -> int, $b -> str).
+    metadef sir_v0_t: ($invite_id -> str, $data -> str).
+    metadef sir_v1_t: ($invite_id -> str, $data -> str, $name -> str, $pv -> int).
+    metadef old_first_t: sir_v0_t || sir_v1_t.
+    metadef new_first_t: sir_v1_t || sir_v0_t.
+
+    fn strip_probe (v: any) -> str {
+        w = v SAFE(small_t).
+        c = (w as any) $c.
+        return (c == NIL ?? "stripped" ; "kept").
+    }
+    fn old_first_probe (v: any) -> str {
+        u = v SAFE(old_first_t).
+        n = (u as any) $name.
+        return (n == NIL ?? "name LOST" ; "name kept").
+    }
+    fn new_first_probe (v: any) -> str {
+        u = v SAFE(new_first_t).
+        n = (u as any) $name.
+        return (n == NIL ?? "name LOST" ; "name kept").
+    }
+
+    _print "runtime extra-field: " (strip_probe ($a -> 1, $b -> "x", $c -> "EXTRA")) "\n".
+    np = ($invite_id -> "I2", $data -> "D", $name -> "Alice", $pv -> 1).
+    _print "runtime old-first:   " (old_first_probe np) "\n".
+    _print "runtime new-first:   " (new_first_probe np) "\n".
+}

package/mufl_code/core/tests/mufl_semantics/t9_passthrough.mufl

@@ -0,0 +1,19 @@
+// Disjunction result identity: pass-through (same value) or rebuilt?
+script
+{
+    metadef sir_v0_t: ($invite_id -> str, $data -> str).
+    metadef sir_v1_t: ($invite_id -> str, $data -> str, $name -> str, $pv -> int).
+    metadef union_t: sir_v1_t || sir_v0_t.
+    fn probe (v: any) -> str {
+        u = v SAFE(union_t).
+        return (_value_id u == _value_id v ?? "pass-through (same value_id)" ; "rebuilt").
+    }
+    np = ($invite_id -> "I2", $data -> "D", $name -> "Alice", $pv -> 1, $future -> "F").
+    _print "disjunction cast: " (probe np) "\n".
+    fn probe2 (v: any) -> str {
+        u = v SAFE(union_t).
+        f = (u as any) $future.
+        return (f == NIL ?? "future field LOST" ; "future field kept").
+    }
+    _print "unknown extra across union: " (probe2 np) "\n".
+}

package/mufl_code/core/tests/mufl_semantics/t_str_order.mufl

@@ -0,0 +1,19 @@
+// Language-semantics pin: MUFL string '<' is a STRICT TOTAL ORDER.
+// The 0.9.0 migration election (a2a_messaging::str_lt / mig_initiator) rests on this:
+// side A computes myCid < peerCid, side B computes peerCid < myCid; for exactly one
+// proposer to be elected, '<' must be irreflexive + antisymmetric + a total order over
+// the hex container-id space. If the vendored toolchain ever regressed string '<' to a
+// non-order, the election would split-brain (both or neither propose). This fails BEFORE
+// the behavioral suite so that never ships silently.
+script
+{
+    _print "irreflexive: " (("a" < "a") ?? "T" ; "F") "\n".       // F — nothing is < itself
+    _print "lt: "          (("a" < "b") ?? "T" ; "F") "\n".       // T
+    _print "antisym: "     (("b" < "a") ?? "T" ; "F") "\n".       // F — a<b implies not b<a
+    _print "prefix1: "     (("a" < "ab") ?? "T" ; "F") "\n".      // T — proper prefix is smaller
+    _print "prefix2: "     (("ab" < "b") ?? "T" ; "F") "\n".      // T
+    // Equal-length hex — the actual container-id case (cids are fixed-length hex):
+    _print "hexlt: "       (("0a1f" < "0a20") ?? "T" ; "F") "\n". // T
+    _print "hexeq: "       (("deadbeef" < "deadbeef") ?? "T" ; "F") "\n". // F — irreflexive on hex too
+    _print "hexgt: "       (("ff" < "00") ?? "T" ; "F") "\n".     // F
+}