test: bound all-op permutations and verify exact link ports

[christian-byrne]

Bounds the normal all-op run.
Preserves the larger opt-in corpus.
Detects misplaced link references.

Full context for agent readers

Scope and authority

Christian Byrne approved stamped link ownership and broader operation interactions in the link-ownership and all-op request. The production ownership implementation already landed in the stamped-link fix, followed by the all-op corpus and promoted-connect coverage. This PR does not duplicate or alter the applier.

The standalone retirement notice is superseded by Christian's later decision to keep this repository canonical. The frontend migration remains open. No ownership, workflow, reviewer, or frontend changes are included. Leave this PR unmerged.

Bounded corpus and retained extended coverage

The original corpus exceeded the contributor guide's normal 20,000-case/eight-minute budget. The default now evaluates exactly:

49 ordered kind pairs × 8 preconditions × 2 ordered actor pairs × 3 stamp relations × 2 arrival orders × 2 batch modes = 9,408 executions.

The kinds come from the package declarations: add_node, connect, disconnect, set_widget, delete_node, clear, and deferred/rejected reset_doc. Preconditions remain present-valid, missing source, missing destination, source/destination slot out of range, occupied input, interior/inputcount, and promoted/autogrow. Actor classes are one agent and one human, in both directions; stamp relations are equal, lower, and higher.

Another 5,000 fixed-seed length-3-to-6 streams run in original and permuted orders: 10,000 executions. Seed is 83297540, shrinking remains enabled, and nonzero per-kind hit checks remain mandatory. Total: 19,408 primary stream executions, with a 20,000-execution/eight-minute file budget. Auxiliary retry and rejection probes are not counted as primary streams. The budget checks run between synchronous executions and after each test; exhaustion fails, never returns a partial green result. These are cooperative deadline checks, not preemption of a single stuck applier call.

The existing 200,000-execution corpus remains available with CMP_PERMUTATION_PROFILE=extended: 150,528 pair executions plus 24,736 sampled streams × two orders. Its original actor/stamp domains and seed are preserved. The whole file has an explicit 30-minute ceiling, replacing two separate 15-minute allowances.

declared kinds + eight document states
                 |
        +--------+---------+
        |                  |
  bounded default     opt-in extended
  19,408 executions   200,000 executions
  8-minute cap        30-minute cap
        |                  |
        +--------+---------+
                 |
 existing projection-difference classifier

Stronger link coherence

The duplicate-link matrix previously checked the winning tuple, unique link identity, and two live references. It now asserts exactly which input/output ports own those references and requires every other port to be empty. This strengthens the existing 12,288 both-order/both-batching executions and six language-neutral parity executions.

The independently expected owner still follows the embedded stamp, including the fixture where envelope ordering implies the opposite winner. Production code and fixtures are unchanged.

Exact-head verification

Head: bounded corpus and exact-port assertions. Base: standalone main.

• Node 22.22.1: npm test -- --maxWorkers=2 passed, 77 files / 976 tests, 109.24 seconds.
• Focused bounded corpus: 19,408 executions in 63.07 seconds. Every declared kind was sampled at least 3,164 times. Strengthened link matrix also passed; combined focused command took 63.72 seconds.
• Extended profile: passed both tests, exactly 200,000 executions in 505.85 seconds (507.88 seconds command duration). Every declared kind was sampled at least 15,755 times.
• Build/typecheck, targeted ESLint, purity, import graph, offline pins, profile claims, generated bot configuration, and conformance fixture verification passed. ESLint: zero errors, 124 warnings; no suppressions. Import graph inspected 18 modules / 50 dependencies. Fixture verifier checked eight files.
• Before changes, the full suite passed 77 files / 976 tests in 534.63 seconds. The shorter default run uses a smaller named domain; this is not an applier performance claim.

Three local fault probes were restored before final verification:

1. Misplace the input reference at (toIdx + 1) % ins.length while leaving the tuple intact. Predicted: old parity test passes, strengthened parity test fails. Observed: exactly one pass / one failure, with expected '700' to be null at the new exact-port assertion. The two unselected matrix tests were skipped only for this probe.
2. Start the file clock eight minutes in the past. Predicted and observed: both corpus tests fail, bounded runtime budget (ms): expected 480002.9544 to be less than 480000.
3. Start at the case ceiling. Predicted and observed: both corpus tests fail, bounded execution budget: expected 20001 to be less than or equal to 20000.

No production mutation remains. These are local mutation reds on already-shipped behavior, not a new production fix or a hosted red/green claim. Standalone build/test CI remains retired; no hosted green claim is made and no workflows are restored or manually triggered.

Reproduce:

npm ci
npm test -- --maxWorkers=2
CMP_PERMUTATION_PROFILE=extended npm exec vitest run test/permutation/full-op-pool.permutation.test.ts -- --reporter=verbose

Limits and overlap

Neither mode exhausts arbitrary graphs, payloads, histories, or all causal interleavings. The existing classifier still permits declared state-dependent/batch-abort differences and narrowly normalizes known divergence families. The bounded run observed 12 pair comparisons and seven sampled comparisons with unrelated-delete link aliases, plus four sampled inputcount/link-reuse differences. Passing does not certify global convergence or retire those risks. No classifier or invariant exceptions were changed.

The concurrently opened lifecycle/continuation extension changes a different test file and leaves this generator/classifier untouched. The changes are complementary, not duplicate PRs. No review threads are addressed by this PR.

Affected invariants: KA-2 (embedded offline-evaluable ordering), KA-4 (determinism/idempotency), and KA-3 / FC-3 (one portable applier, no server-only dependency). Production behavior is unchanged; no browser-visible or cross-language runtime claim is made.

Glossary: corpus = selected test scenarios; stamp = ordered counter/actor/operation-ID key; normalized link identity = String(link_id); parity vector = language-neutral expected case; oracle = correctness assertions; shrinking = reducing a failing generated case; KA/FC = keep-alive/foreclose invariant identifiers; CI = hosted automated checks; PR = pull request.

[coderabbitai]

Important

Draft PR not reviewed

Draft PRs are not automatically reviewed by default.

• Trigger a manual review

To automatically review draft PRs, update your CodeRabbit configuration:

reviews:
  auto_review:
    drafts: true

---

_{Comment @coderabbitai help to get the list of available commands.}