@tokenoftrust/storefront-runner 2.2.125 → 2.3.0

package/apps/storefront/src/styles/global.css

@@ -11,40 +11,50 @@
  * the vars come from the tenant. Swap a tenant -> the whole UI reskins, no
  * component edits.
  *
- * Fallback values below keep the design coherent before/without the injected
- * block (e.g. error pages, prerendered routes).
+ * The values below are the platform defaults. They live in Tailwind's `theme`
+ * layer, so the tenant's injected (unlayered) :root block wins wherever it sets
+ * a token, and an unset token keeps the default here. A declaration here must
+ * never read its own name (`--x: var(--x, …)`): that is a dependency cycle, and
+ * a cycle makes the token invalid instead of falling back. Derived tokens read
+ * OTHER tokens, so they re-derive from whatever the tenant supplied.
  */
 @theme {
-  --color-bg: var(--color-bg, #f4f1ea);
-  --color-surface: var(--color-surface, #fcfaf5);
-  --color-text: var(--color-text, #1c2624);
-  --color-muted: var(--color-muted, #5c6663);
-  --color-primary: var(--color-primary, #1f3a34);
-  --color-primary-contrast: var(--color-primary-contrast, #f4f1ea);
-  --color-accent: var(--color-accent, #b5612f);
-  /* Darkened accent for SMALL text/links on light bg/surface (the bright
-     `accent` is reserved for large display type on the spruce hero, where it
-     reads as the brass spark). Derived from the tenant's own accent so it stays
-     theme-agnostic. Reference value resolves to ~#985127 (≥5:1 on bg/surface).
-     A tenant MAY hand-tune it for exact AA by emitting --color-accent-ink; else
-     it derives from the tenant's own accent so it stays theme-agnostic. */
-  --color-accent-ink: var(--color-accent-ink, color-mix(in srgb, var(--color-accent) 84%, #000));
-  --color-border: var(--color-border, #dcd6c9);
-  --color-success: var(--color-success, #3f6b4f);
-  --color-sale: var(--color-sale, #9e3b2e);
+  --color-bg: #f4f1ea;
+  --color-surface: #fcfaf5;
+  --color-text: #1c2624;
+  --color-muted: #5c6663;
+  --color-primary: #1f3a34;
+  --color-primary-contrast: #f4f1ea;
+  --color-accent: #b5612f;
+  /* Accent for SMALL text/links on light bg/surface (the bright `accent` is
+     reserved for fills and large display type on dark grounds). Derived from the
+     tenant's own accent by capping its OKLCH lightness at 0.5, which keeps
+     ≥5:1 on white and on light bg/surface for any hue — a light accent (gold,
+     amber, cyan) included. The color-mix value is the fallback for browsers
+     without relative color syntax (see the @supports block below). A tenant
+     hand-tunes it by emitting --color-accent-ink. */
+  --color-accent-ink: color-mix(in srgb, var(--color-accent) 84%, #000);
+  /* Readable text/icon color ON an `accent` fill (badges, accent buttons, the
+     accent announcement bar). Derived: black or white, whichever the accent's
+     lightness favours — a light accent gets dark text, a deep one light text.
+     A tenant hand-tunes it by emitting --color-accent-contrast. */
+  --color-accent-contrast: var(--color-primary-contrast);
+  --color-border: #dcd6c9;
+  --color-success: #3f6b4f;
+  --color-sale: #9e3b2e;
 
   /* Semantic/state extensions (token-contract.md). Platform defaults kept
      resolvable here so components can always read them; a tenant theme overrides
      any by emitting the matching --color-* via themeToCssVars. */
-  --color-surface-2: var(--color-surface-2, #ece7db);
-  --color-warning: var(--color-warning, #8a5717);
-  --color-error: var(--color-error, #a22014);
-  --color-info: var(--color-info, #2c5b73);
+  --color-surface-2: #ece7db;
+  --color-warning: #8a5717;
+  --color-error: #a22014;
+  --color-info: #2c5b73;
 
   /* Hover policy: components read --color-{primary,accent}-hover; the default is
      a derived darken of the base, overridable per tenant for hand-tuned values. */
-  --color-primary-hover: var(--color-primary-hover, color-mix(in srgb, var(--color-primary) 88%, #000));
-  --color-accent-hover: var(--color-accent-hover, color-mix(in srgb, var(--color-accent) 88%, #000));
+  --color-primary-hover: color-mix(in srgb, var(--color-primary) 88%, #000);
+  --color-accent-hover: color-mix(in srgb, var(--color-accent) 88%, #000);
 
   /* Interaction/quality-bar tokens (token-contract.md · unit F6). Each carries a
      derived default so a component may read it unconditionally; a theme sets one
@@ -53,11 +63,11 @@
        - disabled/-contrast  disabled+loading control fill / text-on-disabled
        - field-border     stronger ≥3:1 input outline than the hairline border
        - star             review/rating star fill (trust/UGC surfaces) */
-  --color-focus-ring: var(--color-focus-ring, var(--color-accent));
-  --color-disabled: var(--color-disabled, color-mix(in srgb, var(--color-muted) 26%, var(--color-surface)));
-  --color-disabled-contrast: var(--color-disabled-contrast, var(--color-muted));
-  --color-field-border: var(--color-field-border, color-mix(in srgb, var(--color-border) 52%, var(--color-text)));
-  --color-star: var(--color-star, var(--color-accent));
+  --color-focus-ring: var(--color-accent);
+  --color-disabled: color-mix(in srgb, var(--color-muted) 26%, var(--color-surface));
+  --color-disabled-contrast: var(--color-muted);
+  --color-field-border: color-mix(in srgb, var(--color-border) 52%, var(--color-text));
+  --color-star: var(--color-accent);
 
   /* Conversion-role aliases (style-concept.md §Semantic tokens). The palette
      above names a COLOR; these name the JOB a color does on a conversion
@@ -67,25 +77,37 @@
      differently until a tenant supplies one — a tenant brand-tunes by emitting
      color.cta / color.cta-hover / color.cta-contrast / color.trust, which
      themeToCssVars serializes like any other --color-<k>. */
-  --color-cta: var(--color-cta, var(--color-primary));
-  --color-cta-hover: var(--color-cta-hover, var(--color-primary-hover));
-  --color-cta-contrast: var(--color-cta-contrast, var(--color-primary-contrast));
-  --color-trust: var(--color-trust, var(--color-success));
+  --color-cta: var(--color-primary);
+  --color-cta-hover: var(--color-primary-hover);
+  --color-cta-contrast: var(--color-primary-contrast);
+  --color-trust: var(--color-success);
 
-  --font-display: var(--font-display, "Space Grotesk"), system-ui, sans-serif;
-  --font-body: var(--font-body, "Source Serif 4"), Georgia, serif;
-  --font-mono: var(--font-mono, "Space Mono"), ui-monospace, monospace;
+  --font-display: "Space Grotesk", system-ui, sans-serif;
+  --font-body: "Source Serif 4", Georgia, serif;
+  --font-mono: "Space Mono", ui-monospace, monospace;
 
-  --radius-sm: var(--radius-sm, 3px);
-  --radius-md: var(--radius-md, 6px);
-  --radius-lg: var(--radius-lg, 12px);
-  --radius-full: var(--radius-full, 999px);
+  --radius-sm: 3px;
+  --radius-md: 6px;
+  --radius-lg: 12px;
+  --radius-full: 999px;
 
-  --shadow-sm: var(--shadow-sm, 0 1px 2px rgba(28, 38, 36, 0.06));
-  --shadow-md: var(--shadow-md, 0 6px 24px -8px rgba(28, 38, 36, 0.14));
-  --shadow-lg: var(--shadow-lg, 0 24px 60px -20px rgba(28, 38, 36, 0.22));
+  --shadow-sm: 0 1px 2px rgba(28, 38, 36, 0.06);
+  --shadow-md: 0 6px 24px -8px rgba(28, 38, 36, 0.14);
+  --shadow-lg: 0 24px 60px -20px rgba(28, 38, 36, 0.22);
 
-  --container-max: var(--container-max, 1240px);
+  --container-max: 1240px;
+}
+
+/* Accent-derived tokens in relative color syntax: exact for every hue, where the
+   @theme fallbacks above are an approximation. Same layer as @theme, so a
+   tenant-supplied value still wins. */
+@layer theme {
+  @supports (color: oklch(from red l c h)) {
+    :root {
+      --color-accent-ink: oklch(from var(--color-accent) min(l, 0.5) c h);
+      --color-accent-contrast: oklch(from var(--color-accent) clamp(0, (0.58 - l) * 1000, 1) 0 0);
+    }
+  }
 }
 
 /* ---- base ---------------------------------------------------------------- */
@@ -94,10 +116,10 @@
     /* Fluid modular type scale; overridden by injected --fs-* when present. */
     color-scheme: light;
     /* Minimum interactive tap-target (WCAG 2.2 §2.5.8). Non-@theme token (a size,
-       not a Tailwind color) so it lives here with a self-referential default: the
-       injected --tap-target (schema.ts, from shape.tapTarget) wins when present,
-       else 44px. Components size touch controls with var(--tap-target). (F6.) */
-    --tap-target: var(--tap-target, 44px);
+       not a Tailwind color) so it lives here, in the base layer: the injected
+       --tap-target (schema.ts, from shape.tapTarget) wins when present, else
+       44px. Components size touch controls with var(--tap-target). (F6.) */
+    --tap-target: 44px;
 
     /* Role aliases that are NOT colors and so cannot live in @theme (Tailwind
        v4 owns the --text-* namespace for font sizes — a --text-muted there would
@@ -240,6 +262,22 @@
     color: var(--color-muted);
   }
 
+  /* Home hero status pill (HeroBlock.notice). Layered, so unlayered tenant CSS
+     on `.hero__notice` restyles it without !important. */
+  .hero__notice {
+    display: inline-flex;
+    align-items: center;
+    max-width: 100%;
+    border: 1px solid var(--color-border);
+    border-radius: var(--radius-full);
+    background: var(--color-surface);
+    color: var(--color-text);
+    padding: .35rem .9rem;
+    font-family: var(--font-body);
+    font-size: .875rem;
+    line-height: 1.4;
+  }
+
   /* Eyebrow with the signature leading tick — a single short amber rule, the
      "one brass rivet" motif from DESIGN.md, applied as a quiet structural mark.
      Opt-in via .eyebrow.eyebrow--tick so it never fires where it'd read as noise. */
@@ -258,35 +296,44 @@
 
   /* Fluid display scale, derived from the tenant's emitted modular --fs-* steps
      (the major-third scale in DESIGN.md). One rhythm across every page instead
-     of ad-hoc per-component clamps. min = small step, max = large step. */
+     of ad-hoc per-component clamps. min = small step, max = large step.
+     Each class names its fluid size --display-size; a theme's fixed heading size
+     (type.headings → --heading-hero / --heading-h1..h3) replaces it per level. */
   .display-hero {
     font-family: var(--font-display);
     font-weight: 600;
     line-height: 0.95;
     letter-spacing: -0.03em;
-    font-size: clamp(var(--fs-3xl, 3.05rem), 8vw, var(--fs-5xl, 4.77rem));
+    --display-size: clamp(var(--fs-3xl, 3.05rem), 8vw, var(--fs-5xl, 4.77rem));
+    font-size: var(--heading-hero, var(--display-size));
   }
   .display-xl {
     font-family: var(--font-display);
     font-weight: 600;
     line-height: 1.02;
     letter-spacing: -0.025em;
-    font-size: clamp(var(--fs-2xl, 2.44rem), 5vw, var(--fs-4xl, 3.81rem));
+    --display-size: clamp(var(--fs-2xl, 2.44rem), 5vw, var(--fs-4xl, 3.81rem));
+    font-size: var(--display-size);
   }
   .display-lg {
     font-family: var(--font-display);
     font-weight: 600;
     line-height: 1.05;
     letter-spacing: -0.02em;
-    font-size: clamp(var(--fs-xl, 1.95rem), 3.5vw, var(--fs-3xl, 3.05rem));
+    --display-size: clamp(var(--fs-xl, 1.95rem), 3.5vw, var(--fs-3xl, 3.05rem));
+    font-size: var(--display-size);
   }
   .display-md {
     font-family: var(--font-display);
     font-weight: 600;
     line-height: 1.1;
     letter-spacing: -0.018em;
-    font-size: clamp(var(--fs-lg, 1.56rem), 3vw, var(--fs-2xl, 2.44rem));
+    --display-size: clamp(var(--fs-lg, 1.56rem), 3vw, var(--fs-2xl, 2.44rem));
+    font-size: var(--display-size);
   }
+  h1:is(.display-xl, .display-lg, .display-md) { font-size: var(--heading-h1, var(--display-size)); }
+  h2:is(.display-xl, .display-lg, .display-md) { font-size: var(--heading-h2, var(--display-size)); }
+  h3:is(.display-xl, .display-lg, .display-md) { font-size: var(--heading-h3, var(--display-size)); }
 
   /* Tasteful scroll-reveal; opt-in via [data-reveal], JS toggles .is-in. */
   [data-reveal] {
@@ -311,8 +358,9 @@
 
   /* Rich text from CMS/description. */
   .rte > * + * { margin-top: 1em; }
-  .rte h2 { font-size: var(--fs-xl, 1.6rem); margin-top: 1.6em; }
-  .rte h3 { font-size: var(--fs-lg, 1.3rem); margin-top: 1.3em; }
+  .rte h1 { font-size: var(--heading-h1, 1em); }
+  .rte h2 { font-size: var(--heading-h2, var(--fs-xl, 1.6rem)); margin-top: 1.6em; }
+  .rte h3 { font-size: var(--heading-h3, var(--fs-lg, 1.3rem)); margin-top: 1.3em; }
   .rte ul, .rte ol { padding-left: 1.4em; }
   .rte ul { list-style: disc; }
   .rte ol { list-style: decimal; }

package/apps/storefront/src/themes/derivedTokens.ts

@@ -0,0 +1,34 @@
+/**
+ * Color tokens the platform DERIVES from other tokens when a theme does not set
+ * them — the same definitions `src/styles/global.css` declares on :root (the
+ * relative-color forms of its @supports block). A custom property computes where
+ * it is declared, so a surface that re-skins a subtree by setting base tokens on
+ * an element (the style guides' `preview.componentVars`) re-declares these on the
+ * same element; otherwise they would keep the values derived from :root's
+ * palette. `derivedTokens.test.ts` pins this list to global.css.
+ */
+export const DERIVED_COLOR_TOKENS: Readonly<Record<string, string>> = {
+  "--color-accent-ink": "oklch(from var(--color-accent) min(l, 0.5) c h)",
+  "--color-accent-contrast": "oklch(from var(--color-accent) clamp(0, (0.58 - l) * 1000, 1) 0 0)",
+  "--color-primary-hover": "color-mix(in srgb, var(--color-primary) 88%, #000)",
+  "--color-accent-hover": "color-mix(in srgb, var(--color-accent) 88%, #000)",
+  "--color-focus-ring": "var(--color-accent)",
+  "--color-disabled": "color-mix(in srgb, var(--color-muted) 26%, var(--color-surface))",
+  "--color-disabled-contrast": "var(--color-muted)",
+  "--color-field-border": "color-mix(in srgb, var(--color-border) 52%, var(--color-text))",
+  "--color-star": "var(--color-accent)",
+  "--color-cta": "var(--color-primary)",
+  "--color-cta-hover": "var(--color-primary-hover)",
+  "--color-cta-contrast": "var(--color-primary-contrast)",
+  "--color-trust": "var(--color-success)",
+};
+
+/**
+ * The derived declarations for a scope whose base tokens are `declared`: every
+ * derived token the scope does not set itself, as `name:value` pairs.
+ */
+export function derivedTokenDeclarations(declared: Readonly<Record<string, string>>): string[] {
+  return Object.entries(DERIVED_COLOR_TOKENS)
+    .filter(([name]) => !(name in declared))
+    .map(([name, value]) => `${name}:${value}`);
+}

package/apps/storefront/src/themes/schema.ts

@@ -6,6 +6,7 @@
  * into the `<style>` block the middleware injects per request, so one component
  * library renders every tenant's identity. See DESIGN.md.
  */
+import { isThemeCssSize, THEME_HEADING_LEVELS } from "@tot/public-runtime";
 import type { DeepPartial, ThemeTokens } from "@tot/public-runtime";
 
 /** Deep-merge tenant overrides over the reference defaults. */
@@ -61,6 +62,11 @@ export function themeToCssVars(t: ThemeTokens): string {
   for (const [name, step] of Object.entries(steps)) {
     push(`fs-${name}`, `${(1 * Math.pow(ratio, step)).toFixed(4)}rem`);
   }
+  // Fixed heading sizes; global.css falls back to the fluid scale per level.
+  for (const level of THEME_HEADING_LEVELS) {
+    const size = t.type.headings?.[level];
+    if (isThemeCssSize(size)) push(`heading-${level}`, size.trim());
+  }
 
   // Space
   push("space-base", `${t.space.base}px`);

package/apps/storefront/test/pipeline/harness.ts

@@ -0,0 +1,164 @@
+/** Shared helpers for the TenantPipeline harness tests (run inside workerd). */
+import { env } from "cloudflare:test";
+import { expect } from "vitest";
+import type { JobState, JobView, TransitionView } from "../../src/lib/pipeline/job-runner";
+import type { TenantPipeline } from "./pipeline-host";
+import { S3_CHUNKS, SYNTHETIC_KIND, type Fault } from "./synthetic-job";
+
+interface Fetcher {
+  fetch(input: string, init?: RequestInit): Promise<Response>;
+}
+
+interface HarnessEnv {
+  TENANT_PIPELINE: {
+    idFromName(name: string): unknown;
+    get(id: unknown): TenantPipelineStub;
+  };
+  /** Intake through the Worker hosting the object (its own isolate). */
+  PIPELINE_HOST: Fetcher;
+  /** Intake through a second Worker (another isolate) bound to the same namespace. */
+  INTAKE_B: Fetcher;
+}
+
+type TenantPipelineStub = {
+  [K in "submit" | "job" | "jobs" | "transitions" | "facts" | "harness" | "probeStaleWrites"]: TenantPipeline[K];
+};
+
+export const harnessEnv = env as unknown as HarnessEnv;
+
+export function pipelineFor(tenant: string): TenantPipelineStub {
+  return harnessEnv.TENANT_PIPELINE.get(harnessEnv.TENANT_PIPELINE.idFromName(tenant));
+}
+
+let counter = 0;
+export function uniqueTenant(label: string): string {
+  counter += 1;
+  return `${label}-${counter}-${crypto.randomUUID().slice(0, 8)}.example`;
+}
+
+export interface Submitted {
+  status: number;
+  jobId: string;
+  ms: number;
+  intake: string | null;
+  /** The job's state in the 202 body. */
+  state: string;
+}
+
+export async function submit(
+  tenant: string,
+  faults: Fault[] = [],
+  opts: { kind?: string; via?: Fetcher; idempotencyKey?: string } = {},
+): Promise<Submitted> {
+  const via = opts.via ?? harnessEnv.PIPELINE_HOST;
+  const started = performance.now();
+  const res = await via.fetch(`https://pipeline.test/intents/${encodeURIComponent(tenant)}`, {
+    method: "POST",
+    headers: { "content-type": "application/json" },
+    body: JSON.stringify({
+      kind: opts.kind ?? SYNTHETIC_KIND,
+      input: { faults },
+      actor: { type: "test", id: "harness" },
+      admissionDecisionId: null,
+      ...(opts.idempotencyKey ? { idempotencyKey: opts.idempotencyKey } : {}),
+    }),
+  });
+  const ms = performance.now() - started;
+  const body = (await res.json()) as { jobId: string; state: string };
+  return { status: res.status, jobId: body.jobId, ms, intake: res.headers.get("x-intake"), state: body.state };
+}
+
+const TERMINAL = new Set<JobState>(["succeeded", "failed", "stuck"]);
+
+/**
+ * Polls until every job is terminal. On every sample asserts the tenant never has more than one
+ * running job. Create stubs for later reads after this returns (see the eviction note below).
+ */
+export async function waitTerminal(tenant: string, jobIds: string[], timeoutMs = 20_000): Promise<JobView[]> {
+  const deadline = Date.now() + timeoutMs;
+  let maxRunning = 0;
+  for (;;) {
+    let jobs: JobView[];
+    try {
+      // A fresh stub per read: a stub to an object that was evicted (ctx.abort) stays broken,
+      // and a real caller re-creates it the same way.
+      jobs = await pipelineFor(tenant).jobs(1_000);
+    } catch (err) {
+      if (!String((err as Error).message).includes("synthetic eviction")) throw err;
+      await new Promise((resolve) => setTimeout(resolve, 25));
+      continue;
+    }
+    const running = jobs.filter((j) => j.state === "running").length;
+    maxRunning = Math.max(maxRunning, running);
+    expect(running, "running jobs observed at once").toBeLessThanOrEqual(1);
+    const wanted = jobIds.map((id) => jobs.find((j) => j.jobId === id));
+    if (wanted.every((j) => j && TERMINAL.has(j.state))) return wanted as JobView[];
+    if (Date.now() > deadline) {
+      throw new Error(`jobs not terminal after ${timeoutMs} ms: ${JSON.stringify(wanted.map((j) => j && [j.step, j.state, j.attempt]))}`);
+    }
+    await new Promise((resolve) => setTimeout(resolve, 25));
+  }
+}
+
+const OUTCOME_NOTES = ["step-done", "checkpoint", "lease-expired"];
+
+/**
+ * The job's transition log is a complete chain: created queued, started once, every step start
+ * has exactly one recorded outcome (or is superseded by a resume after an eviction), each step
+ * finished exactly once and in order, and it ends at `terminal` with nothing after it.
+ */
+export function assertCompleteLog(log: TransitionView[], terminal: JobState, stepNames = ["s1", "s2", "s3", "s4", "s5"]): void {
+  expect(log.length).toBeGreaterThan(2);
+  expect([log[0]!.from, log[0]!.to]).toEqual(["none", "queued"]);
+  expect([log[1]!.from, log[1]!.to]).toEqual(["queued", "running"]);
+  for (let i = 1; i < log.length; i += 1) {
+    expect(log[i]!.seq).toBeGreaterThan(log[i - 1]!.seq);
+    expect(log[i]!.from, `transition ${i} continues the chain`).toBe(log[i - 1]!.to);
+  }
+  const last = log[log.length - 1]!;
+  expect(last.to).toBe(terminal);
+  expect(log.filter((t) => TERMINAL.has(t.to as JobState))).toHaveLength(1);
+
+  // Pair each step start with what happened to it.
+  for (let i = 0; i < log.length; i += 1) {
+    const t = log[i]!;
+    if (!t.note?.startsWith("step-start")) continue;
+    const next = log[i + 1];
+    expect(next, `step-start ${t.step}#${t.attempt} has a recorded outcome`).toBeDefined();
+    const resolved =
+      (next!.step === t.step && next!.attempt === t.attempt &&
+        (OUTCOME_NOTES.includes(next!.note ?? "") || next!.note?.startsWith("step-failed"))) ||
+      next!.note === "step-start; previous execution did not finish" ||
+      TERMINAL.has(next!.to as JobState);
+    expect(resolved, `outcome of step-start ${t.step}#${t.attempt}: ${JSON.stringify(next)}`).toBe(true);
+  }
+
+  if (terminal === "succeeded") {
+    const done = log.filter((t) => t.note === "step-done").map((t) => t.step);
+    expect(done).toEqual(stepNames);
+    expect(log.filter((t) => t.note === "checkpoint" && t.step === "s3")).toHaveLength(S3_CHUNKS - 1);
+  }
+}
+
+/** Job B was started only after job A reached its terminal state. */
+export function assertSerialized(all: TransitionView[], jobIds: string[]): void {
+  const spans = jobIds.map((jobId) => {
+    const own = all.filter((t) => t.jobId === jobId);
+    const start = own.find((t) => t.from === "queued" && t.to === "running");
+    const end = own.find((t) => TERMINAL.has(t.to as JobState));
+    expect(start, `job ${jobId} started`).toBeDefined();
+    expect(end, `job ${jobId} finished`).toBeDefined();
+    return { jobId, start: start!.seq, end: end!.seq };
+  });
+  spans.sort((a, b) => a.start - b.start);
+  for (let i = 1; i < spans.length; i += 1) {
+    expect(spans[i]!.start, `job ${spans[i]!.jobId} started before ${spans[i - 1]!.jobId} finished`).toBeGreaterThan(spans[i - 1]!.end);
+  }
+  // Every transition of a job lies inside its own span: no step of one job ran while another was running.
+  for (const span of spans) {
+    for (const t of all.filter((x) => x.jobId === span.jobId && x.from === "running")) {
+      expect(t.seq).toBeGreaterThan(span.start);
+      expect(t.seq).toBeLessThanOrEqual(span.end);
+    }
+  }
+}

package/apps/storefront/test/pipeline/intake-worker.mjs

@@ -0,0 +1,14 @@
+// A second intake Worker (its own isolate) that submits intents to the same TenantPipeline
+// namespace as the host Worker, so concurrent intake is exercised across isolates.
+export default {
+  async fetch(request, env) {
+    const match = /^\/intents\/([^/]+)$/.exec(new URL(request.url).pathname);
+    if (request.method !== "POST" || !match) return new Response("not found", { status: 404 });
+    const tenantId = decodeURIComponent(match[1]);
+    const stub = env.TENANT_PIPELINE.get(env.TENANT_PIPELINE.idFromName(tenantId));
+    const result = await stub.submit(tenantId, await request.json());
+    const headers = { "x-intake": "pipeline-intake-b" };
+    if (!result.ok) return Response.json({ error: result.code, reason: result.reason }, { status: 400, headers });
+    return Response.json({ jobId: result.jobId, state: result.state, duplicate: result.duplicate }, { status: 202, headers });
+  },
+};

package/apps/storefront/test/pipeline/pipeline-host.ts

@@ -0,0 +1,77 @@
+/**
+ * The Worker that hosts the TenantPipeline Durable Object for the harness, in its own isolate
+ * (as in production, where callers never share the object's isolate — and where an eviction
+ * restarts the object without touching its callers). It runs the production engine with the
+ * synthetic job kinds registered and answers intents through `submitIntent`.
+ */
+import type { DurableObjectState } from "cloudflare:workers";
+import { TenantPipeline as DeployedTenantPipeline } from "../../src/lib/pipeline/tenant-pipeline";
+import { submitIntent, type TenantPipelineNamespace } from "../../src/lib/pipeline/intake";
+import { StaleExecutionError, type JobKindRegistry, type PipelineIntent } from "../../src/lib/pipeline/job-runner";
+import { abandonedContexts, syntheticJobKinds } from "./synthetic-job";
+
+export class TenantPipeline extends DeployedTenantPipeline {
+  protected override jobKinds(ctx: DurableObjectState): JobKindRegistry {
+    return syntheticJobKinds(ctx);
+  }
+
+  /** Harness-only reads of the synthetic step log. */
+  async harness(jobId: string): Promise<{
+    runs: { step: number; chunk: number; attempt: number }[];
+    effects: { step: number; chunk: number }[];
+    zombieWrites: string[];
+  }> {
+    const { sql } = this.ctx.storage;
+    return {
+      runs: sql
+        .exec<{ step: number; chunk: number; attempt: number }>(
+          `SELECT step, chunk, attempt FROM synthetic_runs WHERE job_id = ? ORDER BY seq`,
+          jobId,
+        )
+        .toArray(),
+      effects: sql
+        .exec<{ step: number; chunk: number }>(`SELECT step, chunk FROM synthetic_effects WHERE job_id = ? ORDER BY step, chunk`, jobId)
+        .toArray(),
+      zombieWrites: sql
+        .exec<{ outcome: string }>(`SELECT outcome FROM synthetic_zombie_writes WHERE job_id = ?`, jobId)
+        .toArray()
+        .map((r) => r.outcome),
+    };
+  }
+
+  /** Writes through the context of an execution abandoned at its lease; reports each outcome. */
+  async probeStaleWrites(jobId: string): Promise<string[]> {
+    const stale = abandonedContexts.find((c) => c.jobId === jobId);
+    if (!stale) return ["no-abandoned-execution"];
+    const attempts: [string, () => void][] = [
+      ["saveCheckpoint", () => stale.saveCheckpoint({ late: true })],
+      ["recordCommit", () => stale.recordCommit("sha-late", [])],
+      ["recordEvidence", () => stale.recordEvidence("sha-late", "digest-late", true)],
+      ["recordLive", () => stale.recordLive("s3-overwrite", "sha-late", "rcpt-late", null)],
+    ];
+    return attempts.map(([name, write]) => {
+      try {
+        write();
+        return `${name}:accepted`;
+      } catch (err) {
+        return `${name}:${err instanceof StaleExecutionError ? "refused" : (err as Error).name}`;
+      }
+    });
+  }
+}
+
+interface Env {
+  TENANT_PIPELINE: TenantPipelineNamespace;
+}
+
+export default {
+  async fetch(request: Request, env: Env): Promise<Response> {
+    const match = /^\/intents\/([^/]+)$/.exec(new URL(request.url).pathname);
+    if (request.method !== "POST" || !match) return new Response("not found", { status: 404 });
+    const response = await submitIntent(env.TENANT_PIPELINE, decodeURIComponent(match[1]!), (await request.json()) as PipelineIntent);
+    return new Response(response.body, {
+      status: response.status,
+      headers: { ...Object.fromEntries(response.headers), "x-intake": "pipeline-host" },
+    });
+  },
+};