@rulvar/store-conformance 1.249.0 → 1.250.0

package/dist/index.d.ts

@@ -1,4 +1,4 @@
-import { JournalEntry, JournalStore, LeasableStore, QuotaRule, TranscriptStore } from "@rulvar/core";
+import { AdmissionScheduler, EffectLaneStore, JournalEntry, JournalStore, LeasableStore, MemoryAdmissionOptions, QuotaRule, TranscriptStore } from "@rulvar/core";
 
 //#region src/types.d.ts
 /**
@@ -32,6 +32,8 @@ interface TestRegistrar {
 /** Registers the suite as one `describe` block with one `it` per check. */
 declare function registerConformance(suite: ConformanceSuite, api: TestRegistrar): void;
 declare function makeSuite(name: string, checks: readonly ConformanceCheck[]): ConformanceSuite;
+/** Assertion helper: conformance failures are plain Errors naming the check. */
+declare function ensure(condition: boolean, checkId: string, message: string): asserts condition;
 /** Canonical JSON with recursively sorted keys (fold-state hashing). */
 declare function stableStringify(value: unknown): string;
 //#endregion
@@ -73,6 +75,27 @@ declare function fencedWritesConformance(mk: StoreFactory<LeasableStore>): Confo
 type QuotaLimiterConstructor = (rules: readonly QuotaRule[]) => unknown;
 declare function quotaRulesConformance(mk: QuotaLimiterConstructor): ConformanceSuite;
 //#endregion
+//#region src/effect-lane.d.ts
+/** The store shape under test: the capability plus the restore verb. */
+interface RestorableEffectLaneStore extends EffectLaneStore {
+  bumpRestorationGeneration(): Promise<number>;
+}
+declare function effectLaneStoreConformance(factory: StoreFactory<RestorableEffectLaneStore>): ConformanceSuite;
+//#endregion
+//#region src/admission-matrix.d.ts
+interface AdmissionSchedulerFixture {
+  scheduler: AdmissionScheduler;
+  /** A NEW holder over the same durable state (the crash rows). */
+  reopen(): AdmissionScheduler | Promise<AdmissionScheduler>;
+  close?(): Promise<void>;
+}
+type AdmissionConfig = Omit<MemoryAdmissionOptions, "state" | "now">;
+interface AdmissionConformanceOptions {
+  /** A fresh, isolated scheduler per call, over the config and clock. */
+  make(config: AdmissionConfig, now: () => number): AdmissionSchedulerFixture | Promise<AdmissionSchedulerFixture>;
+}
+declare function admissionConformance(options: AdmissionConformanceOptions): ConformanceSuite;
+//#endregion
 //#region src/fenced-transcripts.d.ts
 /**
 * The paired factory product: the transcript store under test plus the
@@ -515,4 +538,4 @@ declare function foldStateSha256(entries: readonly JournalEntry[]): string;
 /** The reference hash; computed once from the kernel fold and frozen. */
 declare const GOLDEN_FOLD_STATE_SHA256 = "81e6ccff549fb3e6c1de4d34ba65b912162eba6f66403b5d5f23a3e1ec69243c";
 //#endregion
-export { type ConformanceCheck, type ConformanceSuite, DEFAULT_SOAK_QUORUM, type FencedTranscriptsFixture, GOLDEN_FOLD_JOURNAL, GOLDEN_FOLD_STATE_SHA256, KILL_POINT_SCENARIOS, type KillPointConformanceOptions, type KillPointEvent, type KillPointExpectation, type KillPointName, type KillPointObservation, type KillPointPhase, type KillPointScenario, type KillPointScenarioOptions, type KillPointTarget, type KillPointWorkerConfig, type KillPointWorkerHooks, type KillPointWorkflowKind, type MultiProcessSoakOptions, type MultiProcessSoakResult, type QuotaLimiterConstructor, type SoakAcceptSurface, type SoakActivity, type SoakEvent, type SoakProbeSurface, type SoakQuorum, type SoakWriterConfig, type SoakWriterHooks, type StoreFactory, type TestRegistrar, countSoakActivity, fencedTranscriptsConformance, fencedWritesConformance, foldStateSha256, journalStoreConformance, killPointConformance, killPointWorkerConfigFromEnv, leasableStoreConformance, makeSuite, materializeFoldState, parseKillPointReport, parseSoakReport, quotaRulesConformance, registerConformance, runKillPointScenario, runKillPointWorker, runMultiProcessSoak, runSoakWriter, soakWriterConfigFromEnv, stableStringify, verifySoakHistory };
+export { type AdmissionConfig, type AdmissionConformanceOptions, type AdmissionSchedulerFixture, type ConformanceCheck, type ConformanceSuite, DEFAULT_SOAK_QUORUM, type FencedTranscriptsFixture, GOLDEN_FOLD_JOURNAL, GOLDEN_FOLD_STATE_SHA256, KILL_POINT_SCENARIOS, type KillPointConformanceOptions, type KillPointEvent, type KillPointExpectation, type KillPointName, type KillPointObservation, type KillPointPhase, type KillPointScenario, type KillPointScenarioOptions, type KillPointTarget, type KillPointWorkerConfig, type KillPointWorkerHooks, type KillPointWorkflowKind, type MultiProcessSoakOptions, type MultiProcessSoakResult, type QuotaLimiterConstructor, type RestorableEffectLaneStore, type SoakAcceptSurface, type SoakActivity, type SoakEvent, type SoakProbeSurface, type SoakQuorum, type SoakWriterConfig, type SoakWriterHooks, type StoreFactory, type TestRegistrar, admissionConformance, countSoakActivity, effectLaneStoreConformance, ensure, fencedTranscriptsConformance, fencedWritesConformance, foldStateSha256, journalStoreConformance, killPointConformance, killPointWorkerConfigFromEnv, leasableStoreConformance, makeSuite, materializeFoldState, parseKillPointReport, parseSoakReport, quotaRulesConformance, registerConformance, runKillPointScenario, runKillPointWorker, runMultiProcessSoak, runSoakWriter, soakWriterConfigFromEnv, stableStringify, verifySoakHistory };

package/dist/index.js

@@ -1,4 +1,4 @@
-import { ConfigError, JournalOrderViolation, LeaseHeldError, Replayer, ResolutionFold, agentScope, buildDeriverRegistry, createCanonicalIdMinter, createEngine, defineWorkflow, deriveContentKey, dispositionHook, quotaRuleKey, tool } from "@rulvar/core";
+import { CURRENT_HASH_VERSION, ConfigError, JournalOrderViolation, LeaseHeldError, Replayer, ResolutionFold, agentScope, buildDeriverRegistry, createCanonicalIdMinter, createEngine, defineWorkflow, deriveContentKey, dispositionHook, openEffectLane, quotaRuleKey, tool } from "@rulvar/core";
 import { createHash } from "node:crypto";
 import { spawn } from "node:child_process";
 import { appendFileSync, existsSync, readFileSync, writeFileSync } from "node:fs";
@@ -46,7 +46,7 @@ function stableStringify(value) {
 * requires an explicit hashVersion-bump changeset
 * (scripts/check-frozen-fixtures.mjs).
 */
-function entry(partial) {
+function entry$1(partial) {
 	return {
 		hashVersion: 2,
 		scope: "",
@@ -72,12 +72,12 @@ function entry(partial) {
 * seq 9  abandon of the spawn again: noop (target_abandoned)
 */
 const GOLDEN_FOLD_JOURNAL = [
-	entry({
+	entry$1({
 		seq: 0,
 		kind: "agent",
 		status: "running"
 	}),
-	entry({
+	entry$1({
 		seq: 1,
 		scope: "agent:0",
 		value: {
@@ -90,11 +90,11 @@ const GOLDEN_FOLD_JOURNAL = [
 			}
 		}
 	}),
-	entry({
+	entry$1({
 		seq: 2,
 		value: { key: "gate-b" }
 	}),
-	entry({
+	entry$1({
 		seq: 3,
 		kind: "resolution",
 		status: "ok",
@@ -106,7 +106,7 @@ const GOLDEN_FOLD_JOURNAL = [
 			value: { ok: "yes" }
 		}
 	}),
-	entry({
+	entry$1({
 		seq: 4,
 		kind: "resolution",
 		status: "ok",
@@ -118,7 +118,7 @@ const GOLDEN_FOLD_JOURNAL = [
 			value: { ok: true }
 		}
 	}),
-	entry({
+	entry$1({
 		seq: 5,
 		kind: "resolution",
 		status: "ok",
@@ -130,7 +130,7 @@ const GOLDEN_FOLD_JOURNAL = [
 			value: { ok: false }
 		}
 	}),
-	entry({
+	entry$1({
 		seq: 6,
 		kind: "abandon",
 		status: "ok",
@@ -141,7 +141,7 @@ const GOLDEN_FOLD_JOURNAL = [
 			reason: "golden abandon"
 		}
 	}),
-	entry({
+	entry$1({
 		seq: 7,
 		kind: "resolution",
 		status: "ok",
@@ -152,7 +152,7 @@ const GOLDEN_FOLD_JOURNAL = [
 			value: { go: 1 }
 		}
 	}),
-	entry({
+	entry$1({
 		seq: 8,
 		kind: "abandon",
 		status: "ok",
@@ -163,7 +163,7 @@ const GOLDEN_FOLD_JOURNAL = [
 			reason: "late abandon over a resolved gate"
 		}
 	}),
-	entry({
+	entry$1({
 		seq: 9,
 		kind: "abandon",
 		status: "ok",
@@ -961,6 +961,625 @@ function quotaRulesConformance(mk) {
 	}]);
 }
 //#endregion
+//#region src/effect-lane.ts
+/**
+* Effect lane store conformance (plan 45, rfcs/effects.md section 4.5,
+* item 3): the executable definition of the EffectLaneStore capability
+* and of the writer-store COMPOSITION the RFC's fencing argument rests
+* on. The store half: a restoration generation that lives outside the
+* journal bytes, starts at 0, and bumps monotonically. The composition
+* half: a bumped generation disables every lane append until a fresh
+* epoch cites it (the kill point 25 window), and a lane append under a
+* non-current lease dies on the store's fence with nothing consumed
+* (the kill point 16 shape) — the store cannot recognize lane traffic
+* (obligation A4), so the unleased-append prohibition is enforced by
+* the writer's construction, and THIS suite is where the composition
+* is proven over the real store.
+*/
+const NOW = "2026-08-24T10:00:00.000Z";
+const entry = (seq, rest) => ({
+	hashVersion: CURRENT_HASH_VERSION,
+	seq,
+	scope: "run",
+	key: `k${String(seq)}`,
+	ordinal: 0,
+	spanId: "s",
+	startedAt: NOW,
+	...rest
+});
+const seedApproval = async (store, runId, seq, licensedKey) => {
+	await store.append(runId, entry(seq, {
+		kind: "approval",
+		status: "suspended",
+		deadlineAt: "2026-08-24T12:00:00.000Z",
+		value: {
+			flavor: "approval",
+			toolName: "payout",
+			effectLogicalKey: licensedKey
+		}
+	}));
+	await store.append(runId, entry(seq + 1, {
+		kind: "resolution",
+		status: "ok",
+		ref: seq,
+		resolution: {
+			target: seq,
+			by: "external",
+			value: { decision: "allow" }
+		}
+	}));
+};
+const BUDGETS = {
+	attempts: 3,
+	lookups: 5,
+	receiptWaitMs: 6e4,
+	reconcileBy: "2026-08-25T00:00:00.000Z"
+};
+function effectLaneStoreConformance(factory) {
+	return makeSuite("effect-lane-store-conformance", [
+		{
+			id: "ELS1",
+			title: "the restoration generation starts at 0 and reads stably",
+			async run() {
+				const store = await factory();
+				ensure(store.effectLane === true, "ELS1", "the store must declare effectLane: true");
+				ensure(await store.restorationGeneration() === 0, "ELS1", "a store no restore ever touched must report generation 0");
+				ensure(await store.restorationGeneration() === 0, "ELS1", "the read must be stable across calls");
+			}
+		},
+		{
+			id: "ELS2",
+			title: "the bump is monotonic and durable in the same database",
+			async run() {
+				const store = await factory();
+				ensure(await store.bumpRestorationGeneration() === 1, "ELS2", "the first bump must return 1");
+				ensure(await store.bumpRestorationGeneration() === 2, "ELS2", "the second bump must return 2 (monotonic, never a reset)");
+				ensure(await store.restorationGeneration() === 2, "ELS2", "the read after two bumps must be 2");
+			}
+		},
+		{
+			id: "ELS3",
+			title: "a bumped generation disables the lane until a fresh epoch cites it (kill 25)",
+			async run() {
+				const store = await factory();
+				const runId = "ELS3-RUN";
+				await seedApproval(store, runId, 0, "pay-1");
+				const writer = await openEffectLane({
+					store,
+					runId,
+					owner: "els3",
+					now: () => NOW
+				});
+				try {
+					await writer.ensureEpoch("gen-1");
+					ensure((await writer.consumeApprovalAndRecordIntent({
+						opId: "els3-intent-1",
+						logicalKey: "pay-1",
+						approvalRef: 0,
+						effectClass: "monetary",
+						capabilityRow: "idempotency-key",
+						argumentsHash: "deadbeef",
+						budgets: BUDGETS
+					})).machine.consumed, "ELS3", "the pre-restore consumption must land");
+					await store.bumpRestorationGeneration();
+					let refused;
+					try {
+						await writer.consumeApprovalAndRecordIntent({
+							opId: "els3-intent-2",
+							logicalKey: "pay-1",
+							approvalRef: 0,
+							effectClass: "monetary",
+							capabilityRow: "idempotency-key",
+							argumentsHash: "deadbeef",
+							budgets: BUDGETS
+						});
+					} catch (thrown) {
+						refused = thrown;
+					}
+					ensure(refused?.rule === "restoration-generation-stale", "ELS3", "the post-restore window must refuse every lane append typed");
+					ensure(!(await writer.ensureEpoch("gen-1")).replayed, "ELS3", "the operator epoch append must be a new entry");
+					ensure(writer.view().currentEpoch()?.restorationGeneration === 1, "ELS3", "the fresh epoch must cite the bumped generation");
+				} finally {
+					await writer.close();
+				}
+			}
+		},
+		{
+			id: "ELS4",
+			title: "a lane append under a non-current lease dies on the fence, nothing consumed (kill 16)",
+			async run() {
+				const store = await factory();
+				const runId = "ELS4-RUN";
+				await seedApproval(store, runId, 0, "pay-1");
+				const lease = await store.acquire(runId, "holder");
+				try {
+					let refused;
+					try {
+						await store.append(runId, entry(2, {
+							kind: "decision",
+							status: "ok",
+							value: {
+								decisionType: "effect_epoch",
+								opId: "ghost-epoch",
+								generation: "gen-ghost"
+							}
+						}), {
+							runId,
+							owner: "ghost",
+							epoch: 0
+						});
+					} catch (thrown) {
+						refused = thrown;
+					}
+					ensure(refused instanceof LeaseHeldError, "ELS4", "a lane append carrying a non-current lease must reject with LeaseHeldError");
+					ensure(!(await store.load(runId)).some((e) => e.seq === 2), "ELS4", "the fenced-off append must never become visible");
+				} finally {
+					await store.release(lease);
+				}
+			}
+		}
+	]);
+}
+//#endregion
+//#region src/admission-matrix.ts
+/**
+* The durable admission conformance matrix (plan 45, rfcs/admission.md
+* section 7): all twelve rows as named executable checks over a
+* scheduler factory, so a deployment proves ITS durable admission
+* behaves like the reference. The fairness rows measure GRANTED RAW
+* SERVICE, which is what the algorithm actually guarantees; wait times
+* are reported nowhere as acceptance metrics. The expiry row runs the
+* fenced-covers arm; the "without fenced covers, auto-refund nothing"
+* arm is excluded here by design, because every shipped scheduler
+* fences covers (the in-process reference, and the durable documents
+* whose cover writes ride the same CASed transaction), and the
+* exclusion is recorded in this sentence.
+*/
+/**
+* Saturates every tenant's window with a plug ticket so a whole burst
+* can queue FIRST and one pump then measures pure SFQ order over the
+* assembled queue, not the accident of who enqueued while capacity was
+* free. Releasing a plug with zero actuals refunds its whole
+* reservation, so the burst's own arithmetic is untouched.
+*/
+async function plugTenants(scheduler, tenants, capWires) {
+	for (const tenant of tenants) ensure((await scheduler.enqueue({
+		unitId: `plug-${tenant}`,
+		generation: "g1",
+		resolvedTenant: tenant,
+		scope: { tenant },
+		weight: capWires,
+		reservation: { wires: capWires }
+	}, `op-plug-${tenant}`)).state === "granted", "admission.plug", `the ${tenant} plug holds the window`);
+}
+async function unplugTenants(scheduler, tenants) {
+	for (const tenant of tenants) await scheduler.release(`plug-${tenant}`, "g1", { wires: 0 }, `op-unplug-${tenant}`);
+}
+const request = (unitId, overrides = {}) => ({
+	unitId,
+	generation: "g1",
+	resolvedTenant: "acme",
+	scope: {
+		tenant: "acme",
+		providerAccount: "shared"
+	},
+	reservation: { wires: 1 },
+	...overrides
+});
+/** Drains every ticket through grant+release; returns the grant order. */
+async function drainGrantOrder(scheduler, expected) {
+	const order = [];
+	let stalls = 0;
+	while (order.length < expected && stalls < expected + 10) {
+		const granted = await scheduler.pump(`pump-${String(order.length)}-${String(stalls)}`);
+		if (granted.length === 0) {
+			stalls += 1;
+			continue;
+		}
+		for (const ticket of granted) {
+			order.push(ticket.resolvedTenant ?? ticket.unitId);
+			await scheduler.release(ticket.unitId, ticket.generation, ticket.reservation, `release-${ticket.unitId}`);
+		}
+	}
+	return order;
+}
+function admissionConformance(options) {
+	return makeSuite("admission-conformance", [
+		{
+			id: "admission.fairness.sixty-tenant-synchronized-burst",
+			title: "sixty equal tenants: granted raw service equalizes and no inter-grant gap explodes",
+			async run() {
+				const now = { ms: 0 };
+				const perTenant = 2;
+				const fixture = await options.make({
+					levels: { tenant: {
+						algorithm: "sliding-window",
+						capWires: perTenant
+					} },
+					leaseTtlMs: 36e5
+				}, () => now.ms);
+				const tenants = Array.from({ length: 60 }, (_, index) => `t${String(index).padStart(2, "0")}`);
+				await plugTenants(fixture.scheduler, tenants, perTenant);
+				for (let round = 0; round < perTenant; round += 1) for (const tenant of tenants) await fixture.scheduler.enqueue(request(`${tenant}-r${String(round)}`, {
+					resolvedTenant: tenant,
+					scope: { tenant }
+				}), `op-${tenant}-${String(round)}`);
+				await unplugTenants(fixture.scheduler, tenants);
+				const order = await drainGrantOrder(fixture.scheduler, tenants.length * perTenant);
+				ensure(order.length === tenants.length * perTenant, "admission.fairness.1", "every ticket eventually granted");
+				for (const tenant of tenants) ensure(order.filter((granted) => granted === tenant).length === perTenant, "admission.fairness.1", `tenant ${tenant} received its exact share`);
+				for (let start = 0; start + tenants.length <= order.length; start += tenants.length) ensure(new Set(order.slice(start, start + tenants.length)).size === tenants.length, "admission.fairness.1", "no tenant waits past one full round");
+				await fixture.close?.();
+			}
+		},
+		{
+			id: "admission.fairness.weighted-shares",
+			title: "weights 1/2/4: granted raw service converges to 1:2:4 and weight 1 never starves",
+			async run() {
+				const now = { ms: 0 };
+				const perTenant = 14;
+				const fixture = await options.make({
+					levels: { tenant: {
+						algorithm: "sliding-window",
+						capWires: perTenant
+					} },
+					weights: {
+						x: 1,
+						y: 2,
+						z: 4
+					},
+					leaseTtlMs: 36e5
+				}, () => now.ms);
+				await plugTenants(fixture.scheduler, [
+					"x",
+					"y",
+					"z"
+				], perTenant);
+				for (let round = 0; round < perTenant; round += 1) for (const tenant of [
+					"x",
+					"y",
+					"z"
+				]) await fixture.scheduler.enqueue(request(`${tenant}-r${String(round)}`, {
+					resolvedTenant: tenant,
+					scope: { tenant }
+				}), `op-${tenant}-${String(round)}`);
+				await unplugTenants(fixture.scheduler, [
+					"x",
+					"y",
+					"z"
+				]);
+				const order = await drainGrantOrder(fixture.scheduler, perTenant * 3);
+				const first7 = order.slice(0, 7);
+				ensure(first7.filter((t) => t === "z").length === 4 && first7.filter((t) => t === "y").length === 2 && first7.filter((t) => t === "x").length === 1, "admission.fairness.2", "the first virtual-time cycle grants exactly 1:2:4");
+				ensure(order.slice(0, 14).filter((t) => t === "x").length === 2, "admission.fairness.2", "weight 1 never starves");
+				await fixture.close?.();
+			}
+		},
+		{
+			id: "admission.window.minute-boundary",
+			title: "the sliding window bounds the epoch boundary burst to the sub-window allowance",
+			async run() {
+				const now = { ms: 55e3 };
+				const fixture = await options.make({
+					levels: { tenant: {
+						algorithm: "sliding-window",
+						capWires: 10,
+						windowMs: 6e4,
+						slots: 6
+					} },
+					leaseTtlMs: 36e5
+				}, () => now.ms);
+				for (let index = 0; index < 10; index += 1) ensure((await fixture.scheduler.enqueue(request(`burst-${String(index)}`, { scope: { tenant: "acme" } }), `op-${String(index)}`)).state === "granted", "admission.window.3", "the cap admits the burst");
+				ensure((await fixture.scheduler.enqueue(request("boundary", { scope: { tenant: "acme" } }), "op-boundary")).state === "queued", "admission.window.3", "the cap is spent");
+				now.ms = 65e3;
+				ensure((await fixture.scheduler.pump("op-p1")).length === 0, "admission.window.3", "no double burst across the boundary");
+				now.ms = 105e3;
+				ensure((await fixture.scheduler.pump("op-p2")).length === 0, "admission.window.3", "the trailing window still holds the spend");
+				now.ms = 115e3;
+				ensure((await fixture.scheduler.pump("op-p3")).length === 1, "admission.window.3", "capacity returns only as the trailing window slides past it");
+				await fixture.close?.();
+			}
+		},
+		{
+			id: "admission.crash.queued-ticket-survives",
+			title: "a queued ticket reloads with its arrival seq and position; same unit, same ticket",
+			async run() {
+				const now = { ms: 0 };
+				const fixture = await options.make({
+					levels: {
+						tenant: {
+							algorithm: "sliding-window",
+							capWires: 1e4
+						},
+						providerAccount: {
+							algorithm: "sliding-window",
+							capWires: 1e4,
+							concurrency: 1
+						}
+					},
+					leaseTtlMs: 36e5
+				}, () => now.ms);
+				ensure((await fixture.scheduler.enqueue(request("a"), "op-a")).state === "granted", "admission.crash.4", "a grants");
+				const queued = await fixture.scheduler.enqueue(request("b"), "op-b");
+				ensure(queued.state === "queued", "admission.crash.4", "b queues on the semaphore");
+				const arrivalSeq = queued.state === "queued" ? queued.ticket.arrivalSeq : -1;
+				const successor = await fixture.reopen();
+				const recovered = await successor.recover("b", "g1", "op-r");
+				ensure(recovered.state === "queued", "admission.crash.4", "the queued ticket survives");
+				ensure(recovered.state === "queued" && recovered.ticket.arrivalSeq === arrivalSeq, "admission.crash.4", "no queue jump, no loss: the arrival seq is intact");
+				const again = await successor.enqueue(request("b"), "op-b-retry");
+				ensure(again.state === "queued" && again.ticket.arrivalSeq === arrivalSeq, "admission.crash.4", "re-enqueueing the same unit returns the SAME ticket, never a duplicate");
+				await successor.release("a", "g1", { wires: 1 }, "op-release-a");
+				ensure((await successor.pump("op-pump")).some((ticket) => ticket.unitId === "b"), "admission.crash.4", "the surviving ticket grants in order");
+				await fixture.close?.();
+			}
+		},
+		{
+			id: "admission.crash.granted-lease-expiry-settles-conservatively",
+			title: "expiry refunds reservation minus the fenced cover; a late settlement lands as debt",
+			async run() {
+				const now = { ms: 0 };
+				const fixture = await options.make({
+					levels: { tenant: {
+						algorithm: "sliding-window",
+						capWires: 4,
+						windowMs: 36e5
+					} },
+					leaseTtlMs: 3e4
+				}, () => now.ms);
+				await fixture.scheduler.enqueue(request("holder", {
+					reservation: { wires: 4 },
+					scope: { tenant: "acme" }
+				}), "op-h");
+				await fixture.scheduler.checkpointCover("holder", "g1", { wires: 2 }, "op-c");
+				now.ms = 31e3;
+				await fixture.scheduler.pump("op-expire");
+				let fenced = false;
+				try {
+					await fixture.scheduler.checkpointCover("holder", "g1", { wires: 4 }, "op-c2");
+				} catch {
+					fenced = true;
+				}
+				ensure(fenced, "admission.crash.5", "the expired lease cover write is fenced off");
+				ensure((await fixture.scheduler.enqueue(request("two", {
+					reservation: { wires: 2 },
+					scope: { tenant: "acme" }
+				}), "op-2")).state === "granted", "admission.crash.5", "the provable refund admits");
+				ensure((await fixture.scheduler.enqueue(request("probe", {
+					reservation: { wires: 1 },
+					scope: { tenant: "acme" }
+				}), "op-probe")).state === "queued", "admission.crash.5", "the refund was exactly the uncovered half, never a blind full refund");
+				await fixture.scheduler.release("holder", "g1", { wires: 3 }, "op-late");
+				await fixture.scheduler.release("holder", "g1", { wires: 3 }, "op-late");
+				await fixture.close?.();
+			}
+		},
+		{
+			id: "admission.deny.429-parity",
+			title: "the terminal denied verdict is distinguishable from queued by STATE, never timeout",
+			async run() {
+				const now = { ms: 0 };
+				const fixture = await options.make({
+					levels: { tenant: {
+						algorithm: "sliding-window",
+						capWires: 2
+					} },
+					leaseTtlMs: 36e5
+				}, () => now.ms);
+				ensure((await fixture.scheduler.enqueue(request("huge", {
+					reservation: { wires: 5 },
+					scope: { tenant: "acme" }
+				}), "op-huge")).state === "denied", "admission.deny.6", "infeasible refuses terminally");
+				await fixture.scheduler.enqueue(request("fill", {
+					reservation: { wires: 2 },
+					scope: { tenant: "acme" }
+				}), "op-fill");
+				const queued = await fixture.scheduler.enqueue(request("wait", { scope: { tenant: "acme" } }), "op-wait");
+				ensure(queued.state === "queued" && typeof queued.position === "number", "admission.deny.6", "a waiting verdict carries its position; the caller backoff owns the retry");
+				await fixture.close?.();
+			}
+		},
+		{
+			id: "admission.region.loss",
+			title: "losing a region re-routes admission without double granting in-flight tickets",
+			async run() {
+				const now = { ms: 0 };
+				const fixture = await options.make({
+					levels: {
+						tenant: {
+							algorithm: "sliding-window",
+							capWires: 100
+						},
+						scope: {
+							algorithm: "sliding-window",
+							capWires: 100
+						}
+					},
+					leaseTtlMs: 36e5
+				}, () => now.ms);
+				ensure((await fixture.scheduler.enqueue(request("in-flight", { scope: {
+					tenant: "acme",
+					region: "eu-lost"
+				} }), "op-a")).state === "granted", "admission.region.7", "the in-flight grant");
+				const successor = await fixture.reopen();
+				ensure((await successor.enqueue(request("rerouted", { scope: {
+					tenant: "acme",
+					region: "us-alive"
+				} }), "op-b")).state === "granted", "admission.region.7", "admission re-routes");
+				ensure((await successor.recover("in-flight", "g1", "op-r")).state === "granted", "admission.region.7", "the in-flight ticket stays granted exactly once");
+				ensure((await successor.pump("op-p")).length === 0, "admission.region.7", "no double grant of the surviving ticket");
+				await fixture.close?.();
+			}
+		},
+		{
+			id: "admission.repair.hundred-percent",
+			title: "a workload of 100 percent repair amplification stays inside caps through debt",
+			async run() {
+				const now = { ms: 0 };
+				const fixture = await options.make({
+					levels: { tenant: {
+						algorithm: "sliding-window",
+						capWires: 4,
+						windowMs: 36e5
+					} },
+					leaseTtlMs: 36e5
+				}, () => now.ms);
+				for (const unit of ["r1", "r2"]) {
+					ensure((await fixture.scheduler.enqueue(request(unit, { scope: { tenant: "acme" } }), `op-${unit}`)).state === "granted", "admission.repair.8", `${unit} admitted`);
+					await fixture.scheduler.release(unit, "g1", { wires: 2 }, `op-release-${unit}`);
+				}
+				ensure((await fixture.scheduler.enqueue(request("r3", { scope: { tenant: "acme" } }), "op-r3")).state === "queued", "admission.repair.8", "the amplified spend depresses the bucket instead of blowing the cap");
+				await fixture.close?.();
+			}
+		},
+		{
+			id: "admission.scope.foreign-scope-never-consumes",
+			title: "a request that cannot key a configured level refuses fail closed, consuming nothing",
+			async run() {
+				const now = { ms: 0 };
+				const fixture = await options.make({
+					levels: { tenant: {
+						algorithm: "sliding-window",
+						capWires: 2
+					} },
+					leaseTtlMs: 36e5
+				}, () => now.ms);
+				ensure((await fixture.scheduler.enqueue({
+					unitId: "foreign",
+					generation: "g1",
+					reservation: { wires: 2 }
+				}, "op-foreign")).state === "denied", "admission.scope.9", "fail closed, never global");
+				ensure((await fixture.scheduler.enqueue(request("proper", {
+					reservation: { wires: 2 },
+					scope: { tenant: "acme" }
+				}), "op-proper")).state === "granted", "admission.scope.9", "full capacity intact");
+				await fixture.close?.();
+			}
+		},
+		{
+			id: "admission.atomicity.multi-level-all-or-nothing",
+			title: "a denial at level 2 leaves level 1 and level 3 counters untouched",
+			async run() {
+				const now = { ms: 0 };
+				const fixture = await options.make({
+					levels: {
+						tenant: {
+							algorithm: "sliding-window",
+							capWires: 2,
+							windowMs: 36e5
+						},
+						providerAccount: {
+							algorithm: "sliding-window",
+							capWires: 100,
+							concurrency: 1
+						}
+					},
+					leaseTtlMs: 36e5
+				}, () => now.ms);
+				ensure((await fixture.scheduler.enqueue(request("a", { scope: {
+					tenant: "acme",
+					providerAccount: "acct-1"
+				} }), "op-a")).state === "granted", "admission.atomicity.10", "a grants");
+				ensure((await fixture.scheduler.enqueue(request("b", { scope: {
+					tenant: "acme",
+					providerAccount: "acct-1"
+				} }), "op-b")).state === "queued", "admission.atomicity.10", "b queues on level 2");
+				ensure((await fixture.scheduler.enqueue(request("c", { scope: {
+					tenant: "acme",
+					providerAccount: "acct-2"
+				} }), "op-c")).state === "granted", "admission.atomicity.10", "the denial consumed nothing at any level");
+				await fixture.close?.();
+			}
+		},
+		{
+			id: "admission.failover.rebind-before-dispatch",
+			title: "the transfer acquires the target slot before the source releases, atomically",
+			async run() {
+				const now = { ms: 0 };
+				const fixture = await options.make({
+					levels: {
+						tenant: {
+							algorithm: "sliding-window",
+							capWires: 100
+						},
+						providerAccount: {
+							algorithm: "sliding-window",
+							capWires: 100,
+							concurrency: 1
+						}
+					},
+					leaseTtlMs: 36e5
+				}, () => now.ms);
+				ensure((await fixture.scheduler.enqueue(request("a", { scope: {
+					tenant: "acme",
+					providerAccount: "acct-1"
+				} }), "op-a")).state === "granted", "admission.failover.11", "a holds acct-1");
+				ensure((await fixture.scheduler.enqueue(request("d", { scope: {
+					tenant: "acme",
+					providerAccount: "acct-2"
+				} }), "op-d")).state === "granted", "admission.failover.11", "d holds acct-2");
+				ensure((await fixture.scheduler.rebind("a", "g1", { scope: {
+					tenant: "acme",
+					providerAccount: "acct-2"
+				} }, "op-rebind-1")).state === "denied", "admission.failover.11", "a failed transfer refuses: the target slot is held");
+				ensure((await fixture.scheduler.recover("a", "g1", "op-r")).state === "granted", "admission.failover.11", "the source binding is unchanged after the refusal");
+				ensure((await fixture.scheduler.enqueue(request("e", { scope: {
+					tenant: "acme",
+					providerAccount: "acct-1"
+				} }), "op-e")).state === "queued", "admission.failover.11", "the source slot is STILL held: no window without a slot");
+				await fixture.scheduler.release("d", "g1", { wires: 1 }, "op-release-d");
+				ensure((await fixture.scheduler.rebind("a", "g1", { scope: {
+					tenant: "acme",
+					providerAccount: "acct-2"
+				} }, "op-rebind-2")).state === "granted", "admission.failover.11", "the transfer lands");
+				ensure((await fixture.scheduler.pump("op-pump")).some((ticket) => ticket.unitId === "e"), "admission.failover.11", "the released source slot admits the waiter in the same transition set");
+				await fixture.close?.();
+			}
+		},
+		{
+			id: "admission.tenant.resolution-parity",
+			title: "the effective tenant matches the limiter posture; a conflicting pair refuses typed",
+			async run() {
+				const now = { ms: 0 };
+				const fixture = await options.make({
+					levels: { tenant: {
+						algorithm: "sliding-window",
+						capWires: 2,
+						windowMs: 36e5
+					} },
+					leaseTtlMs: 36e5
+				}, () => now.ms);
+				let refused = false;
+				try {
+					await fixture.scheduler.enqueue(request("conflict", {
+						resolvedTenant: "engine-t",
+						scope: { tenant: "other" }
+					}), "op-conflict");
+				} catch (thrown) {
+					refused = thrown instanceof ConfigError || thrown instanceof Error;
+				}
+				ensure(refused, "admission.tenant.12", "the conflicting pair refuses typed");
+				ensure((await fixture.scheduler.enqueue(request("u1", {
+					resolvedTenant: "engine-t",
+					scope: {
+						tenant: "engine-t",
+						project: "p1"
+					},
+					reservation: { wires: 2 }
+				}), "op-u1")).state === "granted", "admission.tenant.12", "the first unit fills the cap");
+				ensure((await fixture.scheduler.enqueue(request("u2", {
+					resolvedTenant: "engine-t",
+					scope: {
+						tenant: "engine-t",
+						project: "p2"
+					}
+				}), "op-u2")).state === "queued", "admission.tenant.12", "the SAME identity debits the SAME bucket, whatever the project");
+				await fixture.close?.();
+			}
+		}
+	]);
+}
+//#endregion
 //#region src/fenced-transcripts.ts
 /**
 * fencedTranscriptsConformance (the fenced run state RFC, F2): the
@@ -2377,4 +2996,4 @@ function killPointConformance(options) {
 	})));
 }
 //#endregion
-export { DEFAULT_SOAK_QUORUM, GOLDEN_FOLD_JOURNAL, GOLDEN_FOLD_STATE_SHA256, KILL_POINT_SCENARIOS, countSoakActivity, fencedTranscriptsConformance, fencedWritesConformance, foldStateSha256, journalStoreConformance, killPointConformance, killPointWorkerConfigFromEnv, leasableStoreConformance, makeSuite, materializeFoldState, parseKillPointReport, parseSoakReport, quotaRulesConformance, registerConformance, runKillPointScenario, runKillPointWorker, runMultiProcessSoak, runSoakWriter, soakWriterConfigFromEnv, stableStringify, verifySoakHistory };
+export { DEFAULT_SOAK_QUORUM, GOLDEN_FOLD_JOURNAL, GOLDEN_FOLD_STATE_SHA256, KILL_POINT_SCENARIOS, admissionConformance, countSoakActivity, effectLaneStoreConformance, ensure, fencedTranscriptsConformance, fencedWritesConformance, foldStateSha256, journalStoreConformance, killPointConformance, killPointWorkerConfigFromEnv, leasableStoreConformance, makeSuite, materializeFoldState, parseKillPointReport, parseSoakReport, quotaRulesConformance, registerConformance, runKillPointScenario, runKillPointWorker, runMultiProcessSoak, runSoakWriter, soakWriterConfigFromEnv, stableStringify, verifySoakHistory };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@rulvar/store-conformance",
-  "version": "1.249.0",
+  "version": "1.250.0",
   "description": "Rulvar executable store conformance kit (DEF-4).",
   "type": "module",
   "license": "Apache-2.0",
@@ -22,7 +22,7 @@
     "access": "public"
   },
   "dependencies": {
-    "@rulvar/core": "1.249.0"
+    "@rulvar/core": "1.250.0"
   },
   "devDependencies": {
     "@types/node": "^22.20.1",