- commit
- 9cbfebaed289e73ecea1833aeeb0daf629e394a2
- parent
- ea3f4823befa4b222aae10069b3127c77ae8f8e1
- author
- Dami <dami.etoile@gmail.com>
| A | docs/ | 78 | ++++++++++++++++++++++++++++++ |
| M | docs/ | 9 | +++ |
@@ -0,0 +1,78 @@
1+# 0006: Bound Layer 3 inspection and testing to truthful observable seams2+3+Status: accepted for M2 implementation\4+Date: 2026-07-15\5+Issues: #10, #126+7+## Decision8+9+Layer 3 graduates two developer surfaces:10+11+- a visible development-only inspector backed by a provisional internal snapshot/action adapter;12+- readiness-first Playwright helpers exported from the single package at `@nzip/lofi/testing`.13+14+The inspector is generated runtime machinery, not a public framework facade. `./testing` is the only15+new public package export in this layer. Broader `core`, `ui`, `sync`, `auth`, and `pwa` extraction16+still requires the M4 evidence described by ADR 0005.17+18+The inspector may report only signals lofi can observe:19+20+- device-local identity and the blocked alpha passkey-backup state;21+- requested/open/failed persistent storage plus browser persistence permission;22+- local-only or managed-configured mode;23+- lofi-wrapped per-write local/global durability and mutation failures; and24+- active client, consumer, vendor-subscription, and mutation-listener counts.25+26+The Jazz alpha pin exposes no supported live connection state, vendor queue depth, or multi-tab27+leader/follower role. Those fields remain visibly unavailable. Configuration is never presented as28+connectivity, and checklist writes are not mislabeled as the vendor's complete pending queue.29+30+Inspector transport pause/resume calls Jazz `Db.disconnect()`/`reconnect()` only when managed sync31+is configured and labels the action as a cloud-transport test seam. Real browser offline control is32+owned by `@nzip/lofi/testing` through Playwright `BrowserContext.setOffline()`. Client restart uses33+the existing serialized runtime recreation. Replica clear uses `Db.deleteClientStorage()` behind a34+destructive confirmation; it clears the local OPFS namespace while preserving the localStorage35+identity and warns that unsynced data may be lost.36+37+## Two-client identity rule38+39+The current permissions are creator-only. Two distinct user identities therefore cannot both read40+and edit one row, so claiming distinct-identity convergence would be false. The convergence fixture41+uses two isolated browser contexts and separate OPFS replicas with the same restored identity. The42+first context's Playwright storage state is passed directly to the second context in memory. It is43+never written to reports, traces, snapshots, logs, or screenshots because it contains the bearer44+identity secret.45+46+A truly distinct-user fixture belongs with sharing/invitation and permission-model work, not this47+testing layer.48+49+## Verification boundary50+51+Local acceptance proves readiness predicates, offline restoration in `finally`, restart/reload,52+artifact redaction, inspector actions, and production exclusion. Closing the convergence contract53+also requires a cloud-configured generated-project journey:54+55+1. seed a row and wait for global durability;56+2. boot the second isolated replica with the in-memory restored identity;57+3. take both browser contexts offline;58+4. make orthogonal edits, then reload/recreate while work remains local;59+5. restore network control in `finally` and wait for both visible snapshots to converge; and60+6. remove fixture rows and wait for global durability.61+62+Only the public `JAZZ_APP_ID`/`JAZZ_SERVER_URL` pair reaches the child application. Server secrets63+remain blank, and no configured value is retained in evidence.64+65+Production builds must contain no lofi inspector marker, global bridge, route, or chunk. Jazz's raw66+vendor inspector remains disabled.67+68+## Deferred physical-device evidence69+70+Playwright does not graduate installed-PWA lifecycle, storage eviction, airplane-mode cold launch,71+real passkey custody, or mobile background/foreground recovery. Those remain explicit M3 physical-72+device gates.73+74+## Why75+76+This boundary gives developers useful controls and deterministic tests without inventing vendor77+precision, leaking identity material, weakening creator-only permissions, or prematurely turning the78+M1 runtime into a general framework API.@@ -317,6 +317,15 @@ registry command exists: after source acceptance and explicit publication author
317317 fresh-directory smoke must invoke `deno run -A jsr:@nzip/lofi/create <name>` before #13 and #11 can318318 close.319319 320+Layer 3 keeps inspection and testing semantics distinct. The generated development inspector may321+pause a configured Jazz transport, restart the client, and confirmation-gate an OPFS replica clear;322+it does not call transport pause "browser offline" and does not infer live connectivity, vendor323+queue depth, or leader/follower role. Real network control and readiness-first two-client fixtures324+graduate at `@nzip/lofi/testing`. The convergence fixture uses two isolated OPFS replicas with one325+identity restored only in memory because the current creator-only permissions do not allow two326+distinct identities to edit the same row. See327+[ADR 0006](decisions/0006-bound-layer3-inspection-and-testing.md).328+320329 Layer 1 keeps M1's `lofi-prototype-<appId>` OPFS namespace so existing device rows remain visible to321330 the reviewed notes-to-tasks lens. Jazz discovers that lens and its snapshots beside `schema.ts` in322331 `apps/reference/src/migrations`. `deno task check:migrations` couples the current schema hash,