xytara 3.1.13 → 3.1.14

package/scripts/verify_refund_credit.js

@@ -1,106 +1,106 @@
-"use strict";
-
-// Verifies credit-based refund settlement: POST /v1/refunds/<id>/settle-credit returns
-// value to the paying account as re-spendable CREDITS (never an autonomous outbound
-// transfer). Covers: credit-bridge auth is mandatory (403 unset/wrong), refund_units is
-// required (400), the account balance actually increases by the credited units, the
-// operation is idempotent per refund (no double-mint on replay), a terminal refund
-// cannot be re-settled, and the existing refund-action route is unchanged (non-breaking).
-
-const assert = require("assert");
-const http = require("http");
-
-async function req(baseUrl, method, path, body, headers = {}) {
-  const res = await fetch(`${baseUrl}${path}`, {
-    method,
-    headers: { "content-type": "application/json", ...headers },
-    ...(body !== undefined ? { body: JSON.stringify(body) } : {})
-  });
-  let json = null;
-  try { json = await res.json(); } catch (_) { json = null; }
-  return { status: res.status, json };
-}
-
-function availableUnits(balanceJson) {
-  if (!balanceJson) return 0;
-  if (typeof balanceJson.available_units === "number") return balanceJson.available_units;
-  if (balanceJson.balance && typeof balanceJson.balance.available_units === "number") return balanceJson.balance.available_units;
-  if (balanceJson.lifecycle_totals && typeof balanceJson.lifecycle_totals.available_units === "number") return balanceJson.lifecycle_totals.available_units;
-  return 0;
-}
-
-async function main() {
-  const prevToken = process.env.XYTARA_CREDIT_BRIDGE_BEARER_TOKEN;
-  const TOKEN = "test-credit-bridge-token";
-  process.env.XYTARA_CREDIT_BRIDGE_BEARER_TOKEN = TOKEN;
-  const auth = { authorization: `Bearer ${TOKEN}` };
-
-  delete require.cache[require.resolve("../server")];
-  const { createServer } = require("../server");
-  const server = createServer();
-  await new Promise((resolve) => server.listen(0, "127.0.0.1", resolve));
-  const baseUrl = `http://127.0.0.1:${server.address().port}`;
-  const ACCOUNT = "acct_refund_credit_test";
-
-  try {
-    // Create a refund (operator case).
-    let r = await req(baseUrl, "POST", "/v1/refunds", { reason_code: "service_failure", note: "test", requested_by: "operator" });
-    assert.ok(r.json && r.json.refund && r.json.refund.refund_id, "refund created");
-    const refundId = r.json.refund.refund_id;
-
-    const before = availableUnits((await req(baseUrl, "GET", `/v1/economics/accounts/${ACCOUNT}/credit-balance`)).json);
-
-    // 1. Auth mandatory: no bearer -> 403.
-    r = await req(baseUrl, "POST", `/v1/refunds/${refundId}/settle-credit`, { account_id: ACCOUNT, refund_units: 50 });
-    assert.strictEqual(r.status, 403, "settle-credit without bearer must 403");
-
-    // 2. Wrong bearer -> 403.
-    r = await req(baseUrl, "POST", `/v1/refunds/${refundId}/settle-credit`, { account_id: ACCOUNT, refund_units: 50 }, { authorization: "Bearer wrong" });
-    assert.strictEqual(r.status, 403, "settle-credit with wrong bearer must 403");
-
-    // 3. refund_units required -> 400.
-    r = await req(baseUrl, "POST", `/v1/refunds/${refundId}/settle-credit`, { account_id: ACCOUNT }, auth);
-    assert.strictEqual(r.status, 400, "missing refund_units must 400");
-    assert.strictEqual(r.json.reason, "refund_units_required", "400 reason");
-
-    // 4. Authorized settle -> 200, credit minted, refund completed.
-    r = await req(baseUrl, "POST", `/v1/refunds/${refundId}/settle-credit`, { account_id: ACCOUNT, refund_units: 50, reason_code: "service_failure" }, auth);
-    assert.strictEqual(r.status, 200, "authorized settle-credit must 200");
-    assert.strictEqual(r.json.ok, true, "settle ok");
-    assert.strictEqual(r.json.units, 50, "credited units echoed");
-    assert.ok(r.json.credit_grant_id && r.json.credit_grant_id.startsWith("refund_credit_"), "idempotent grant id");
-    assert.strictEqual(r.json.refund.status, "completed", "refund marked completed");
-
-    // 5. Balance actually increased by the credited units.
-    const after = availableUnits((await req(baseUrl, "GET", `/v1/economics/accounts/${ACCOUNT}/credit-balance`)).json);
-    assert.strictEqual(after - before, 50, `balance must increase by 50 (before=${before}, after=${after})`);
-
-    // 6. Idempotent: a replayed settle must NOT mint twice.
-    r = await req(baseUrl, "POST", `/v1/refunds/${refundId}/settle-credit`, { account_id: ACCOUNT, refund_units: 50 }, auth);
-    assert.strictEqual(r.status, 200, "replay still 200");
-    assert.strictEqual(r.json.already_settled, true, "replay reports already_settled");
-    const afterReplay = availableUnits((await req(baseUrl, "GET", `/v1/economics/accounts/${ACCOUNT}/credit-balance`)).json);
-    assert.strictEqual(afterReplay, after, "replay must not mint credits twice");
-
-    // 7. A terminal (completed) refund cannot be re-settled under a fresh account.
-    //    (Covered by idempotency above — the completed refund returns already_settled
-    //    for the original grant rather than minting to a different account.)
-
-    // 8. Non-breaking: the existing refund-action route still works on a NEW refund.
-    const r2 = await req(baseUrl, "POST", "/v1/refunds", { reason_code: "other" });
-    const refundId2 = r2.json.refund.refund_id;
-    r = await req(baseUrl, "POST", `/v1/refunds/${refundId2}/actions`, { action: "review", note: "reviewing" });
-    assert.strictEqual(r.status, 200, "existing refund-action route still works");
-    assert.strictEqual(r.json.refund.status, "under_review", "action transitioned status");
-
-    console.log("xytara verify:refund-credit passed");
-  } finally {
-    await new Promise((resolve) => server.close(resolve));
-    if (prevToken === undefined) delete process.env.XYTARA_CREDIT_BRIDGE_BEARER_TOKEN; else process.env.XYTARA_CREDIT_BRIDGE_BEARER_TOKEN = prevToken;
-  }
-}
-
-main().catch((error) => {
-  console.error(error && error.message ? error.message : error);
-  process.exitCode = 1;
-});
+"use strict";
+
+// Verifies credit-based refund settlement: POST /v1/refunds/<id>/settle-credit returns
+// value to the paying account as re-spendable CREDITS (never an autonomous outbound
+// transfer). Covers: credit-bridge auth is mandatory (403 unset/wrong), refund_units is
+// required (400), the account balance actually increases by the credited units, the
+// operation is idempotent per refund (no double-mint on replay), a terminal refund
+// cannot be re-settled, and the existing refund-action route is unchanged (non-breaking).
+
+const assert = require("assert");
+const http = require("http");
+
+async function req(baseUrl, method, path, body, headers = {}) {
+  const res = await fetch(`${baseUrl}${path}`, {
+    method,
+    headers: { "content-type": "application/json", ...headers },
+    ...(body !== undefined ? { body: JSON.stringify(body) } : {})
+  });
+  let json = null;
+  try { json = await res.json(); } catch (_) { json = null; }
+  return { status: res.status, json };
+}
+
+function availableUnits(balanceJson) {
+  if (!balanceJson) return 0;
+  if (typeof balanceJson.available_units === "number") return balanceJson.available_units;
+  if (balanceJson.balance && typeof balanceJson.balance.available_units === "number") return balanceJson.balance.available_units;
+  if (balanceJson.lifecycle_totals && typeof balanceJson.lifecycle_totals.available_units === "number") return balanceJson.lifecycle_totals.available_units;
+  return 0;
+}
+
+async function main() {
+  const prevToken = process.env.XYTARA_CREDIT_BRIDGE_BEARER_TOKEN;
+  const TOKEN = "test-credit-bridge-token";
+  process.env.XYTARA_CREDIT_BRIDGE_BEARER_TOKEN = TOKEN;
+  const auth = { authorization: `Bearer ${TOKEN}` };
+
+  delete require.cache[require.resolve("../server")];
+  const { createServer } = require("../server");
+  const server = createServer();
+  await new Promise((resolve) => server.listen(0, "127.0.0.1", resolve));
+  const baseUrl = `http://127.0.0.1:${server.address().port}`;
+  const ACCOUNT = "acct_refund_credit_test";
+
+  try {
+    // Create a refund (operator case).
+    let r = await req(baseUrl, "POST", "/v1/refunds", { reason_code: "service_failure", note: "test", requested_by: "operator" });
+    assert.ok(r.json && r.json.refund && r.json.refund.refund_id, "refund created");
+    const refundId = r.json.refund.refund_id;
+
+    const before = availableUnits((await req(baseUrl, "GET", `/v1/economics/accounts/${ACCOUNT}/credit-balance`)).json);
+
+    // 1. Auth mandatory: no bearer -> 403.
+    r = await req(baseUrl, "POST", `/v1/refunds/${refundId}/settle-credit`, { account_id: ACCOUNT, refund_units: 50 });
+    assert.strictEqual(r.status, 403, "settle-credit without bearer must 403");
+
+    // 2. Wrong bearer -> 403.
+    r = await req(baseUrl, "POST", `/v1/refunds/${refundId}/settle-credit`, { account_id: ACCOUNT, refund_units: 50 }, { authorization: "Bearer wrong" });
+    assert.strictEqual(r.status, 403, "settle-credit with wrong bearer must 403");
+
+    // 3. refund_units required -> 400.
+    r = await req(baseUrl, "POST", `/v1/refunds/${refundId}/settle-credit`, { account_id: ACCOUNT }, auth);
+    assert.strictEqual(r.status, 400, "missing refund_units must 400");
+    assert.strictEqual(r.json.reason, "refund_units_required", "400 reason");
+
+    // 4. Authorized settle -> 200, credit minted, refund completed.
+    r = await req(baseUrl, "POST", `/v1/refunds/${refundId}/settle-credit`, { account_id: ACCOUNT, refund_units: 50, reason_code: "service_failure" }, auth);
+    assert.strictEqual(r.status, 200, "authorized settle-credit must 200");
+    assert.strictEqual(r.json.ok, true, "settle ok");
+    assert.strictEqual(r.json.units, 50, "credited units echoed");
+    assert.ok(r.json.credit_grant_id && r.json.credit_grant_id.startsWith("refund_credit_"), "idempotent grant id");
+    assert.strictEqual(r.json.refund.status, "completed", "refund marked completed");
+
+    // 5. Balance actually increased by the credited units.
+    const after = availableUnits((await req(baseUrl, "GET", `/v1/economics/accounts/${ACCOUNT}/credit-balance`)).json);
+    assert.strictEqual(after - before, 50, `balance must increase by 50 (before=${before}, after=${after})`);
+
+    // 6. Idempotent: a replayed settle must NOT mint twice.
+    r = await req(baseUrl, "POST", `/v1/refunds/${refundId}/settle-credit`, { account_id: ACCOUNT, refund_units: 50 }, auth);
+    assert.strictEqual(r.status, 200, "replay still 200");
+    assert.strictEqual(r.json.already_settled, true, "replay reports already_settled");
+    const afterReplay = availableUnits((await req(baseUrl, "GET", `/v1/economics/accounts/${ACCOUNT}/credit-balance`)).json);
+    assert.strictEqual(afterReplay, after, "replay must not mint credits twice");
+
+    // 7. A terminal (completed) refund cannot be re-settled under a fresh account.
+    //    (Covered by idempotency above — the completed refund returns already_settled
+    //    for the original grant rather than minting to a different account.)
+
+    // 8. Non-breaking: the existing refund-action route still works on a NEW refund.
+    const r2 = await req(baseUrl, "POST", "/v1/refunds", { reason_code: "other" });
+    const refundId2 = r2.json.refund.refund_id;
+    r = await req(baseUrl, "POST", `/v1/refunds/${refundId2}/actions`, { action: "review", note: "reviewing" });
+    assert.strictEqual(r.status, 200, "existing refund-action route still works");
+    assert.strictEqual(r.json.refund.status, "under_review", "action transitioned status");
+
+    console.log("xytara verify:refund-credit passed");
+  } finally {
+    await new Promise((resolve) => server.close(resolve));
+    if (prevToken === undefined) delete process.env.XYTARA_CREDIT_BRIDGE_BEARER_TOKEN; else process.env.XYTARA_CREDIT_BRIDGE_BEARER_TOKEN = prevToken;
+  }
+}
+
+main().catch((error) => {
+  console.error(error && error.message ? error.message : error);
+  process.exitCode = 1;
+});

package/scripts/verify_release_candidate.js

@@ -1,81 +1,81 @@
-"use strict";
-
-const assert = require("assert");
-const fs = require("fs");
-const path = require("path");
-const { execFileSync, execSync } = require("child_process");
-const packageJson = require("../package.json");
-
-function parsePackDryRun() {
-  const output = execSync("npm pack --dry-run --json", {
-    cwd: path.resolve(__dirname, ".."),
-    encoding: "utf8"
-  });
-  const parsed = JSON.parse(output);
-  return Array.isArray(parsed) ? parsed[0] : parsed;
-}
-
-function verifyReleaseNotes() {
-  const notesPath = path.resolve(__dirname, "..", "RELEASE_NOTES.md");
-  const notes = fs.readFileSync(notesPath, "utf8");
-  assert.strictEqual(
-    /^#\s+xytara\s+\d+\.\d+\.\d+\s+Release Notes\s*$/m.test(notes),
-    false,
-    "RELEASE_NOTES.md must not duplicate the GitHub release title as a heading"
-  );
-  assert.strictEqual(
-    notes.includes(`xytara\` ${packageJson.version}`),
-    true,
-    "RELEASE_NOTES.md must mention the current package version"
-  );
-  const mentionedVersions = notes.match(/\b\d+\.\d+\.\d+\b/g) || [];
-  assert.strictEqual(
-    mentionedVersions.every((version) => version === packageJson.version),
-    true,
-    "RELEASE_NOTES.md must not mention prior package versions"
-  );
-}
-
-function main() {
-  const releaseOutput = execFileSync(process.execPath, [
-    path.resolve(__dirname, "..", "bin", "xytara-release.js"),
-    "--candidate",
-    "--summary"
-  ], {
-    cwd: path.resolve(__dirname, ".."),
-    encoding: "utf8"
-  });
-  const releaseCandidate = JSON.parse(releaseOutput);
-  assert.strictEqual(releaseCandidate.product, "xytara", "release candidate product mismatch");
-  assert.strictEqual(releaseCandidate.publish_access, "public", "release candidate publish access mismatch");
-  assert.strictEqual(releaseCandidate.checklist_count >= 5, true, "release candidate checklist count mismatch");
-  verifyReleaseNotes();
-
-  const dryRun = parsePackDryRun();
-  assert.strictEqual(dryRun.name, packageJson.name, "npm pack dry-run name mismatch");
-  assert.strictEqual(dryRun.version, packageJson.version, "npm pack dry-run version mismatch");
-  assert.strictEqual(Array.isArray(dryRun.files), true, "npm pack dry-run file list missing");
-  assert.strictEqual(dryRun.files.some((entry) => entry.path === "bin/xytara-run.js"), true, "npm pack dry-run missing xytara-run");
-  assert.strictEqual(dryRun.files.some((entry) => entry.path === "bin/xytara-first-run.js"), true, "npm pack dry-run missing xytara-first-run");
-  assert.strictEqual(dryRun.files.some((entry) => entry.path === "bin/xytara-release.js"), true, "npm pack dry-run missing xytara-release");
-  assert.strictEqual(dryRun.files.some((entry) => entry.path === "scripts/verify_release_candidate.js"), true, "npm pack dry-run missing release verifier script");
-  assert.strictEqual(dryRun.files.some((entry) => entry.path === "scripts/verify_framework_provider_promotion.js"), true, "npm pack dry-run missing framework provider promotion verifier script");
-  assert.strictEqual(dryRun.files.some((entry) => entry.path === "scripts/verify_operator_observability_boundary.js"), true, "npm pack dry-run missing operator observability boundary verifier script");
-  assert.strictEqual(dryRun.files.some((entry) => entry.path === "scripts/verify_pricing_experiment_plan.js"), true, "npm pack dry-run missing pricing experiment verifier script");
-  assert.strictEqual(dryRun.files.some((entry) => entry.path === "scripts/verify_treasury_public_boundary.js"), true, "npm pack dry-run missing treasury public boundary verifier script");
-  assert.strictEqual(dryRun.files.some((entry) => entry.path === "scripts/verify_full_catalog.js"), true, "npm pack dry-run missing full catalog verifier script");
-  assert.strictEqual(dryRun.files.some((entry) => entry.path === "scripts/verify_all.js"), true, "npm pack dry-run missing package verifier script");
-  assert.strictEqual(dryRun.files.some((entry) => entry.path === "lib/framework_provider_promotion.js"), true, "npm pack dry-run missing framework provider promotion pack");
-  assert.strictEqual(dryRun.files.some((entry) => entry.path === "README.md"), true, "npm pack dry-run missing README");
-  assert.strictEqual(dryRun.files.some((entry) => entry.path === "RELEASE_NOTES.md"), true, "npm pack dry-run missing release notes");
-  assert.strictEqual(dryRun.files.some((entry) => entry.path === "START_HERE.md"), true, "npm pack dry-run missing start-here");
-  assert.strictEqual(dryRun.files.some((entry) => entry.path === "SERVICE_CONTRACT.md"), true, "npm pack dry-run missing service contract");
-  assert.strictEqual(dryRun.files.some((entry) => entry.path === "OPERATOR_START_HERE.md"), false, "npm pack dry-run should not ship operator start-here");
-  assert.strictEqual(dryRun.files.some((entry) => entry.path === "OPERATIONS_RUNBOOK.md"), false, "npm pack dry-run should not ship operations runbook");
-  assert.strictEqual(dryRun.files.some((entry) => entry.path === "PUBLISH_PLAN.md"), false, "npm pack dry-run should not ship publish plan");
-  assert.strictEqual(dryRun.files.length >= 10, true, "npm pack dry-run file count too small");
-
-  console.log("xytara verify:release-candidate passed");
-}
-
-main();
+"use strict";
+
+const assert = require("assert");
+const fs = require("fs");
+const path = require("path");
+const { execFileSync, execSync } = require("child_process");
+const packageJson = require("../package.json");
+
+function parsePackDryRun() {
+  const output = execSync("npm pack --dry-run --json", {
+    cwd: path.resolve(__dirname, ".."),
+    encoding: "utf8"
+  });
+  const parsed = JSON.parse(output);
+  return Array.isArray(parsed) ? parsed[0] : parsed;
+}
+
+function verifyReleaseNotes() {
+  const notesPath = path.resolve(__dirname, "..", "RELEASE_NOTES.md");
+  const notes = fs.readFileSync(notesPath, "utf8");
+  assert.strictEqual(
+    /^#\s+xytara\s+\d+\.\d+\.\d+\s+Release Notes\s*$/m.test(notes),
+    false,
+    "RELEASE_NOTES.md must not duplicate the GitHub release title as a heading"
+  );
+  assert.strictEqual(
+    notes.includes(`xytara\` ${packageJson.version}`),
+    true,
+    "RELEASE_NOTES.md must mention the current package version"
+  );
+  const mentionedVersions = notes.match(/\b\d+\.\d+\.\d+\b/g) || [];
+  assert.strictEqual(
+    mentionedVersions.every((version) => version === packageJson.version),
+    true,
+    "RELEASE_NOTES.md must not mention prior package versions"
+  );
+}
+
+function main() {
+  const releaseOutput = execFileSync(process.execPath, [
+    path.resolve(__dirname, "..", "bin", "xytara-release.js"),
+    "--candidate",
+    "--summary"
+  ], {
+    cwd: path.resolve(__dirname, ".."),
+    encoding: "utf8"
+  });
+  const releaseCandidate = JSON.parse(releaseOutput);
+  assert.strictEqual(releaseCandidate.product, "xytara", "release candidate product mismatch");
+  assert.strictEqual(releaseCandidate.publish_access, "public", "release candidate publish access mismatch");
+  assert.strictEqual(releaseCandidate.checklist_count >= 5, true, "release candidate checklist count mismatch");
+  verifyReleaseNotes();
+
+  const dryRun = parsePackDryRun();
+  assert.strictEqual(dryRun.name, packageJson.name, "npm pack dry-run name mismatch");
+  assert.strictEqual(dryRun.version, packageJson.version, "npm pack dry-run version mismatch");
+  assert.strictEqual(Array.isArray(dryRun.files), true, "npm pack dry-run file list missing");
+  assert.strictEqual(dryRun.files.some((entry) => entry.path === "bin/xytara-run.js"), true, "npm pack dry-run missing xytara-run");
+  assert.strictEqual(dryRun.files.some((entry) => entry.path === "bin/xytara-first-run.js"), true, "npm pack dry-run missing xytara-first-run");
+  assert.strictEqual(dryRun.files.some((entry) => entry.path === "bin/xytara-release.js"), true, "npm pack dry-run missing xytara-release");
+  assert.strictEqual(dryRun.files.some((entry) => entry.path === "scripts/verify_release_candidate.js"), true, "npm pack dry-run missing release verifier script");
+  assert.strictEqual(dryRun.files.some((entry) => entry.path === "scripts/verify_framework_provider_promotion.js"), true, "npm pack dry-run missing framework provider promotion verifier script");
+  assert.strictEqual(dryRun.files.some((entry) => entry.path === "scripts/verify_operator_observability_boundary.js"), true, "npm pack dry-run missing operator observability boundary verifier script");
+  assert.strictEqual(dryRun.files.some((entry) => entry.path === "scripts/verify_pricing_experiment_plan.js"), true, "npm pack dry-run missing pricing experiment verifier script");
+  assert.strictEqual(dryRun.files.some((entry) => entry.path === "scripts/verify_treasury_public_boundary.js"), true, "npm pack dry-run missing treasury public boundary verifier script");
+  assert.strictEqual(dryRun.files.some((entry) => entry.path === "scripts/verify_full_catalog.js"), true, "npm pack dry-run missing full catalog verifier script");
+  assert.strictEqual(dryRun.files.some((entry) => entry.path === "scripts/verify_all.js"), true, "npm pack dry-run missing package verifier script");
+  assert.strictEqual(dryRun.files.some((entry) => entry.path === "lib/framework_provider_promotion.js"), true, "npm pack dry-run missing framework provider promotion pack");
+  assert.strictEqual(dryRun.files.some((entry) => entry.path === "README.md"), true, "npm pack dry-run missing README");
+  assert.strictEqual(dryRun.files.some((entry) => entry.path === "RELEASE_NOTES.md"), true, "npm pack dry-run missing release notes");
+  assert.strictEqual(dryRun.files.some((entry) => entry.path === "START_HERE.md"), true, "npm pack dry-run missing start-here");
+  assert.strictEqual(dryRun.files.some((entry) => entry.path === "SERVICE_CONTRACT.md"), true, "npm pack dry-run missing service contract");
+  assert.strictEqual(dryRun.files.some((entry) => entry.path === "OPERATOR_START_HERE.md"), false, "npm pack dry-run should not ship operator start-here");
+  assert.strictEqual(dryRun.files.some((entry) => entry.path === "OPERATIONS_RUNBOOK.md"), false, "npm pack dry-run should not ship operations runbook");
+  assert.strictEqual(dryRun.files.some((entry) => entry.path === "PUBLISH_PLAN.md"), false, "npm pack dry-run should not ship publish plan");
+  assert.strictEqual(dryRun.files.length >= 10, true, "npm pack dry-run file count too small");
+
+  console.log("xytara verify:release-candidate passed");
+}
+
+main();

package/scripts/verify_runtime_state_guard.js

@@ -0,0 +1,117 @@
+"use strict";
+
+// Verifies the runtime-state WRITE GUARD: when the boot-time restore fails (backend 504), the store
+// must never write (a write would overwrite the good snapshot with near-empty state). It retries the
+// restore, merges the durable snapshot under whatever happened since boot, and only then writes.
+
+const assert = require("assert");
+const http = require("http");
+const { createRuntimeStateStore } = require("../lib/runtime_state_store");
+
+function startFakeSupabase() {
+  const calls = { get: 0, post: 0, lastPostBody: null, keys: [] };
+  let failReads = true;
+  const durable = {
+    providerRegistry: { __runtime_state_kind: "Map", value: [["mcp_executor", { provider_id: "mcp_executor", status: "active" }]] },
+    providerPayouts: [{ payout_id: "provpay_1", status: "settled" }],
+    acceptedPaymentNonces: { __runtime_state_kind: "Set", value: ["n_old"] }
+  };
+  const server = http.createServer((req, res) => {
+    let body = "";
+    req.on("data", (chunk) => { body += chunk; });
+    req.on("end", () => {
+      if (req.method === "GET") {
+        calls.get += 1;
+        if (failReads) { res.writeHead(504, { "content-type": "application/json" }); res.end('{"message":"Gateway Timeout"}'); return; }
+        res.writeHead(200, { "content-type": "application/json" });
+        res.end(JSON.stringify([{ snapshot: durable, persisted_at_iso: "2026-10-17T00:00:00.000Z" }]));
+        return;
+      }
+      calls.post += 1;
+      calls.lastPostBody = JSON.parse(body);
+      calls.keys.push(calls.lastPostBody[0].state_key);
+      res.writeHead(201); res.end();
+    });
+  });
+  return new Promise((resolve) => server.listen(0, "127.0.0.1", () => resolve({ server, calls, recover: () => { failReads = false; } })));
+}
+
+async function main() {
+  const fake = await startFakeSupabase();
+  const store = createRuntimeStateStore({
+    supabaseUrl: `http://127.0.0.1:${fake.server.address().port}`,
+    supabaseServiceRoleKey: "test-key",
+    intervalMs: 1000
+  });
+  const state = { providerRegistry: new Map(), providerPayouts: [], acceptedPaymentNonces: new Set() };
+  try {
+    // 1. Boot restore fails (504) -> writes locked.
+    await assert.rejects(() => store.load(state), /504/, "boot restore surfaces the 504");
+    assert.strictEqual(store.restoreConfirmed(), false, "writes locked after a failed restore");
+    assert.strictEqual(store.inspect().writes_locked_until_restore, true, "inspect reports the lock");
+
+    // 2. The process keeps serving on empty state; a post-boot write lands in memory.
+    state.acceptedPaymentNonces.add("n_new");
+    state.providerPayouts.push({ payout_id: "provpay_2", status: "pending" });
+    store.markDirty();
+    assert.strictEqual(await store.flush(state), false, "flush refused while the restore is unconfirmed");
+    assert.strictEqual(fake.calls.post, 0, "NOTHING was written over the durable snapshot");
+
+    // 3. The interval retries the restore while the backend still fails: still no write.
+    let restoredCallback = false;
+    store.start(state, () => { restoredCallback = true; });
+    await new Promise((r) => setTimeout(r, 2300));
+    assert.ok(fake.calls.get >= 2, "restore retried in the background");
+    assert.strictEqual(fake.calls.post, 0, "still no write while the backend is down");
+
+    // 4. Backend recovers: restore merges the snapshot UNDER the post-boot changes, then writes.
+    fake.recover();
+    await new Promise((r) => setTimeout(r, 2600));
+    assert.strictEqual(restoredCallback, true, "onRestored fired");
+    assert.strictEqual(store.restoreConfirmed(), true, "writes unlocked after a successful restore");
+    assert.strictEqual(state.providerRegistry.get("mcp_executor").status, "active", "durable provider restored");
+    assert.ok(state.acceptedPaymentNonces.has("n_old") && state.acceptedPaymentNonces.has("n_new"), "nonce sets unioned");
+    assert.deepStrictEqual(state.providerPayouts.map((p) => p.payout_id), ["provpay_1", "provpay_2"], "ledger keeps durable + post-boot rows");
+    assert.ok(fake.calls.post >= 1, "the merged state is persisted once writes unlock");
+    const written = fake.calls.lastPostBody[0].snapshot;
+    assert.strictEqual(written.providerRegistry.value[0][0], "mcp_executor", "the write carries the restored provider (no clobber)");
+
+    // 5. Unchanged state is never rewritten (a read-only POST marks dirty but changes nothing).
+    const postsBefore = fake.calls.post;
+    store.markDirty();
+    assert.strictEqual(await store.flush(state), false, "unchanged snapshot skipped");
+    assert.strictEqual(fake.calls.post, postsBefore, "no write for an unchanged snapshot");
+    assert.ok(store.inspect().skipped_unchanged_writes >= 1, "skip counted");
+    state.acceptedPaymentNonces.add("n_newer");
+    store.markDirty();
+    assert.strictEqual(await store.flush(state), true, "a real change is written");
+
+    // 6. Rolling history copy: written alongside the main row, under a ::history:: key.
+    assert.ok(fake.calls.keys.some((key) => /^default::history::\d+$/.test(key)), "rolling history row written");
+    assert.ok(fake.calls.keys.includes("default"), "main row written");
+    assert.strictEqual(store.inspect().last_history_error, null, "history write succeeded");
+    await store.stop(state);
+  } finally {
+    fake.server.close();
+  }
+  // 7. Quote pruning: expired never-paid quotes older than the retention are dropped; executed and
+  //    recent ones are kept.
+  const { pruneStaleQuotes } = require("../lib/commerce_quotes");
+  const day = 24 * 60 * 60 * 1000;
+  const now = Date.parse("2026-10-17T00:00:00.000Z");
+  const qs = { quotes: new Map([
+    ["q_old_expired", { status: "expired", expires_at_iso: new Date(now - 10 * day).toISOString() }],
+    ["q_recent_expired", { status: "expired", expires_at_iso: new Date(now - 2 * day).toISOString() }],
+    ["q_old_executed", { status: "executed", transaction_id: "txn_1", expires_at_iso: new Date(now - 30 * day).toISOString() }],
+    ["q_live", { status: "quoted", expires_at_iso: new Date(now + day).toISOString() }]
+  ]) };
+  assert.strictEqual(pruneStaleQuotes(qs, now), 1, "exactly one stale quote pruned");
+  assert.deepStrictEqual(Array.from(qs.quotes.keys()).sort(), ["q_live", "q_old_executed", "q_recent_expired"], "executed / recent / live quotes kept");
+
+  console.log("xytara verify:runtime-state-guard passed");
+}
+
+main().catch((error) => {
+  console.error(error && error.message ? error.message : error);
+  process.exitCode = 1;
+});