test(e2e): apply adversarial-QA review findings across the suite

Second pass on the same fake-passing class of bug, this time catching
weaknesses the previous tighten-up missed:

- install.test.ts: `dot update` now asserts on the actual outcome line
  ("already on latest" / "Updated dot to") instead of just exitCode 0.
  A silent no-op update was previously indistinguishable from a real
  one.

- build.test.ts: each test stages its fixture into a tempdir and runs
  the build there, instead of mutating the source-controlled fixture's
  dist/. This removes a hidden cross-file order dependency where build
  tests would delete the dist that later deploy --no-build tests
  needed. Error-path assertions tightened to the exact strings the
  fixture/runner emit ("Compile error: unexpected token", "No build
  strategy detected") rather than /error|fail|detect/.

- session.test.ts: tightened "no signer" / "logout" assertions to the
  exact "No signer available" / "No account is signed in" strings.

- init.test.ts: the no-session and corrupted-session tests now fail
  loudly when init falls into the "Login skipped" branch (login
  service unreachable from the runner) instead of silently accepting
  it as a pass — which was masking the QR path's testability gap.
  Corrupted-session test additionally asserts the corrupt file is
  unchanged on disk, catching a hypothetical regression where init
  "fixes" parse failures by deleting user data.

- diagnostic.test.ts: both verbose-mode tests now assert on a
  verbose-only marker that proves the env var actually engaged its
  code path (`[+<seconds>s]` for DOT_DEPLOY_VERBOSE,
  `[mem +<seconds>s]` for DOT_MEMORY_TRACE). Previously the tests
  could pass with the env var silently ignored.

- deploy.test.ts:
  - "frontend-only deploy completes end-to-end" now queries the
    registry independently after deploy and verifies the on-chain
    metadata CID matches what the CLI claimed it published.
  - "re-deploy same domain" now mutates the build output between the
    two deploys and asserts the second deploy produced a *different*
    metadata CID. A silently-no-op re-deploy would otherwise still
    print "Deploy complete" and pass.
  - "domain availability check runs before build/upload" now verifies
    the temporal ordering claimed in its name — availability banner
    must precede any build-runner header or storage-phase marker.
  - Multi-contract test renamed; it cannot prove plurality from
    headless output (logHeadlessEvent doesn't surface contract names),
    so the old name was misleading.

- e2e/cli/setup/global.ts: SIGNER funding failure now throws by default
  with a clear message, instead of swallowing into a console.warn that
  let downstream deploy tests fail with cryptic "Invalid Payment"
  errors. Set E2E_ALLOW_OFFLINE_SETUP=1 to opt back into the lenient
  behaviour for local dev on a flaky network.

Author: ottovlotto

e2e/cli/build.test.ts

@@ -1,47 +1,79 @@
-import { describe, test, expect, beforeEach, afterEach } from "vitest";
-import { existsSync, rmSync } from "node:fs";
-import { resolve } from "node:path";
+import { describe, test, expect, afterEach } from "vitest";
+import { cpSync, existsSync, mkdtempSync, rmSync } from "node:fs";
+import { join, resolve } from "node:path";
+import { tmpdir } from "node:os";
 import { dot } from "./helpers/dot.js";
 import { fixturePath } from "./fixtures/templates.js";
 
-describe("dot build", () => {
-	const frontendOnly = fixturePath("frontend-only");
-	const distDir = resolve(frontendOnly, "dist");
+/**
+ * Copy a fixture into a fresh temp dir so the build output lives there,
+ * not inside the source-controlled fixture. This keeps build.test.ts
+ * order-independent: previously we deleted `frontend-only/dist` between
+ * tests, which left the dir absent for any later test that ran with
+ * `--no-build` (deploy, diagnostic). With a copy, the original fixture
+ * is never touched.
+ */
+function stageFixture(name: string): string {
+	const dir = mkdtempSync(join(tmpdir(), `dot-e2e-build-${name}-`));
+	cpSync(fixturePath(name), dir, { recursive: true });
+	return dir;
+}
 
-	beforeEach(() => {
-		if (existsSync(distDir)) {
-			rmSync(distDir, { recursive: true });
-		}
-	});
+describe("dot build", () => {
+	const stagedDirs: string[] = [];
 
 	afterEach(() => {
-		if (existsSync(distDir)) {
-			rmSync(distDir, { recursive: true });
+		for (const d of stagedDirs) {
+			try {
+				rmSync(d, { recursive: true, force: true });
+			} catch { /* best-effort */ }
 		}
+		stagedDirs.length = 0;
 	});
 
+	function stage(name: string): string {
+		const d = stageFixture(name);
+		stagedDirs.push(d);
+		return d;
+	}
+
 	test("builds a frontend-only project", async () => {
-		const result = await dot(["build", "--dir", frontendOnly]);
-		expect(result.exitCode).toBe(0);
+		const project = stage("frontend-only");
+		// The fixture ships a pre-built dist for use by deploy tests.
+		// Remove it from the staged copy so we can assert that *this*
+		// build invocation produced the artifacts.
+		const distDir = resolve(project, "dist");
+		if (existsSync(distDir)) rmSync(distDir, { recursive: true });
+
+		const result = await dot(["build", "--dir", project]);
+		expect(
+			result.exitCode,
+			`build failed: ${result.stdout}\n${result.stderr}`,
+		).toBe(0);
 		expect(result.stdout).toContain("Build succeeded");
 		expect(existsSync(resolve(distDir, "index.html"))).toBe(true);
 	});
 
 	test("exits non-zero on build failure with error output", async () => {
-		const broken = fixturePath("broken-contract");
-		const result = await dot(["build", "--dir", broken]);
+		const project = stage("broken-contract");
+		const result = await dot(["build", "--dir", project]);
 		expect(result.exitCode).not.toBe(0);
-		// The broken-contract fixture's build script writes to stderr
+		// The fixture's package.json runs:
+		//   "build": "echo 'Compile error: unexpected token' >&2 && exit 1"
+		// Match the exact text — proves the runner invoked the user's script
+		// and surfaced its stderr, not just any pipeline-level error.
 		const output = result.stdout + result.stderr;
-		expect(output).toMatch(/error|fail/i);
+		expect(output).toContain("Compile error: unexpected token");
 	});
 
 	test("exits non-zero when no build strategy can be detected", async () => {
-		const contractsOnly = fixturePath("contracts-only");
-		const result = await dot(["build", "--dir", contractsOnly]);
+		const project = stage("contracts-only");
+		const result = await dot(["build", "--dir", project]);
 		expect(result.exitCode).not.toBe(0);
-		// contracts-only has no package.json — no build strategy
+		// Exact wording from src/utils/build/detect.ts:
+		//   `No build strategy detected. Add a "build" script to package.json,
+		//    or install vite/next/typescript.`
 		const output = result.stdout + result.stderr;
-		expect(output).toMatch(/no build|detect|strategy|package\.json/i);
+		expect(output).toContain("No build strategy detected");
 	});
 });

e2e/cli/deploy.test.ts

@@ -14,10 +14,21 @@
  */
 
 import { describe, test, expect } from "vitest";
+import { readFileSync, writeFileSync } from "node:fs";
 import { resolve } from "node:path";
 import { dot } from "./helpers/dot.js";
 import { SIGNER, BOB, E2E_DOMAINS } from "./fixtures/accounts.js";
 import { fixturePath } from "./fixtures/templates.js";
+import { getApp } from "./fixtures/registry.js";
+
+/** Pull the metadata CID out of the headless deploy summary. The CLI
+ *  prints `  Metadata CID    bafy...` once per successful deploy
+ *  (see src/commands/deploy/index.ts printFinalResult). Returns null
+ *  if absent — that itself is a meaningful signal. */
+function extractMetadataCid(stdout: string): string | null {
+	const m = stdout.match(/Metadata CID\s+(\S+)/);
+	return m ? m[1] : null;
+}
 
 const frontendOnly = fixturePath("frontend-only");
 const foundry = fixturePath("foundry");
@@ -128,7 +139,14 @@ describe("dot deploy — preflight and validation", () => {
 		).toContain("Checking availability");
 	});
 
-	test("detects multiple contracts in multi-contract project", async () => {
+	test("--contracts works on a multi-contract project", async () => {
+		// Renamed from "detects multiple contracts" — the headless logger
+		// (logHeadlessEvent in src/commands/deploy/index.ts) does not
+		// surface the per-contract names that compile-detected events
+		// carry, so the CLI output cannot prove plurality. We can only
+		// prove the contract-type detector accepted the project. If
+		// per-contract names get logged in headless mode in future, add
+		// `expect(output).toContain("TokenA")` + `"TokenB"` here.
 		const result = await dot([
 			"deploy",
 			"--signer", "dev",
@@ -183,7 +201,32 @@ describe("dot deploy — preflight and validation", () => {
 		// Availability banner names the domain; this is the strongest signal we
 		// have that the availability check actually executed against this run's
 		// domain (rather than echoing the arg in a usage/error string).
-		expect(output).toContain(`Checking availability of ${domain}.dot`);
+		const availIdx = output.indexOf(`Checking availability of ${domain}.dot`);
+		expect(
+			availIdx,
+			`availability banner not found:\n${output}`,
+		).toBeGreaterThan(-1);
+		// Verify the *ordering* claim in the test name: availability must
+		// precede any build-runner output. Without this, the test only proves
+		// availability ran, not that it ran first. Build runners emit the
+		// header `> <strategy description>` (see src/commands/build.ts:14)
+		// and bulletin-deploy's storage phase emits `▸ storage-and-dotns…`
+		// (logHeadlessEvent). Either appearing before availability would
+		// break the contract.
+		const buildIdx = output.search(/\n>\s+\w/);
+		const storageIdx = output.indexOf("▸ storage-and-dotns");
+		if (buildIdx > -1) {
+			expect(
+				availIdx,
+				`build header appeared before availability check:\n${output}`,
+			).toBeLessThan(buildIdx);
+		}
+		if (storageIdx > -1) {
+			expect(
+				availIdx,
+				`storage phase started before availability check:\n${output}`,
+			).toBeLessThan(storageIdx);
+		}
 	});
 });
 
@@ -207,6 +250,19 @@ describe("dot deploy --playground — full pipeline (requires Paseo + IPFS)", ()
 		expect(result.stdout).toContain("Deploy complete");
 		expect(result.stdout).toContain("URL");
 		expect(result.stdout).toContain(domain);
+
+		// Don't trust the CLI's own success message — query the registry
+		// independently to prove the entry was actually written. A regression
+		// where deploy prints "Deploy complete" but never sends the registry
+		// extrinsic would otherwise pass.
+		const cliCid = extractMetadataCid(result.stdout);
+		expect(cliCid, "CLI did not print Metadata CID").not.toBeNull();
+		const entry = await getApp(`${domain}.dot`);
+		expect(entry, `registry has no entry for ${domain}.dot`).not.toBeNull();
+		// Belt-and-braces: the on-chain CID should match what the CLI claims
+		// it published. A divergence here means the CLI is reporting one CID
+		// to the user while writing a different one to the chain.
+		expect(entry!.metadataUri).toContain(cliCid!);
 	});
 
 	test("re-deploy same domain succeeds for same owner", { timeout: 900_000 }, async () => {
@@ -222,22 +278,53 @@ describe("dot deploy --playground — full pipeline (requires Paseo + IPFS)", ()
 		], { timeout: 400_000 });
 		expect(first.exitCode, `first deploy failed: ${first.stdout}\n${first.stderr}`).toBe(0);
 		expect(first.stdout).toContain("Deploy complete");
+		const firstCid = extractMetadataCid(first.stdout);
+		expect(firstCid, "first deploy did not print Metadata CID").not.toBeNull();
 
-		const second = await dot([
-			"deploy",
-			"--signer", "dev",
-			"--domain", domain,
-			"--buildDir", absBuildDir(frontendOnly),
-			"--no-build",
-			"--playground",
-			"--suri", SIGNER.suri,
-			"--dir", frontendOnly,
-		], { timeout: 400_000 });
-		expect(
-			second.exitCode,
-			`re-deploy failed: ${second.stdout}\n${second.stderr}`,
-		).toBe(0);
-		expect(second.stdout).toContain("Deploy complete");
+		// Mutate the build output between the two deploys so the second
+		// deploy must produce a DIFFERENT metadata CID. Without this, a
+		// regression where the second deploy silently no-ops (returns the
+		// previous result without re-publishing) would still print
+		// "Deploy complete" with the old CID and the test would pass.
+		const indexHtml = resolve(absBuildDir(frontendOnly), "index.html");
+		const original = readFileSync(indexHtml, "utf8");
+		writeFileSync(
+			indexHtml,
+			`${original}\n<!-- redeploy marker ${Date.now()} -->\n`,
+		);
+
+		try {
+			const second = await dot([
+				"deploy",
+				"--signer", "dev",
+				"--domain", domain,
+				"--buildDir", absBuildDir(frontendOnly),
+				"--no-build",
+				"--playground",
+				"--suri", SIGNER.suri,
+				"--dir", frontendOnly,
+			], { timeout: 400_000 });
+			expect(
+				second.exitCode,
+				`re-deploy failed: ${second.stdout}\n${second.stderr}`,
+			).toBe(0);
+			expect(second.stdout).toContain("Deploy complete");
+			const secondCid = extractMetadataCid(second.stdout);
+			expect(secondCid, "re-deploy did not print Metadata CID").not.toBeNull();
+			// Different content → different metadata CID. If these match,
+			// the second deploy didn't actually re-publish.
+			expect(
+				secondCid,
+				`re-deploy produced same CID as first — content didn't change on chain`,
+			).not.toBe(firstCid);
+			// And the registry should reflect the latest publish.
+			const entry = await getApp(`${domain}.dot`);
+			expect(entry).not.toBeNull();
+			expect(entry!.metadataUri).toContain(secondCid!);
+		} finally {
+			// Restore so subsequent tests see the original fixture content.
+			writeFileSync(indexHtml, original);
+		}
 	});
 
 	test("domain taken by another account shows unavailable", { timeout: 900_000 }, async () => {

e2e/cli/diagnostic.test.ts

@@ -14,10 +14,50 @@ import { fixturePath } from "./fixtures/templates.js";
 const frontendOnly = fixturePath("frontend-only");
 
 describe("diagnostic mode", () => {
-	test("DOT_DEPLOY_VERBOSE=1 does not break deploy preflight", async () => {
-		// Use SIGNER (funded by globalSetup) so preflight reaches the
-		// availability check; ALICE's balance is too low and the run would
-		// abort before producing any verbose-eligible output.
+	test(
+		"DOT_DEPLOY_VERBOSE=1 produces timestamped log lines during storage phase",
+		{ timeout: 300_000 },
+		async () => {
+			// Need a deploy that actually reaches the storage phase — that's
+			// where bulletin-deploy logs and verbose-mode wraps its output
+			// with "[+<seconds>s] " timestamps (see src/utils/deploy/storage.ts).
+			// Re-deploying a domain SIGNER already owns is the cheapest way
+			// to get there.
+			const result = await dot([
+				"deploy",
+				"--signer", "dev",
+				"--domain", E2E_DOMAINS.preflight,
+				"--buildDir", resolve(frontendOnly, "dist"),
+				"--no-build",
+				"--playground",
+				"--suri", SIGNER.suri,
+				"--dir", frontendOnly,
+			], {
+				env: { DOT_DEPLOY_VERBOSE: "1" },
+				timeout: 280_000,
+			});
+			const output = result.stdout + result.stderr;
+			// Real preflight checkpoint — only printed after signer/mapping
+			// passes.
+			expect(
+				output,
+				`expected to reach availability check with verbose on\n${output}`,
+			).toContain("Checking availability");
+			// Verbose-only marker. Format: "[+12.3s] <line>". This prefix
+			// appears nowhere else, so matching it is the only way to prove
+			// DOT_DEPLOY_VERBOSE wasn't silently ignored.
+			expect(
+				output,
+				`expected verbose-only "[+Ns] ..." marker in output\n${output}`,
+			).toMatch(/\[\+\d+\.\d+s\]/);
+		},
+	);
+
+	test("DOT_MEMORY_TRACE=1 produces RSS sample lines during a real command", async () => {
+		// `--help` exits before the memory watchdog has a chance to sample.
+		// Run a deploy preflight instead — the watchdog samples once per
+		// second and writes RSS/heap/external lines to stderr when the env
+		// var is set (see src/utils/process-guard.ts startMemoryWatchdog).
 		const result = await dot([
 			"deploy",
 			"--signer", "dev",
@@ -28,30 +68,18 @@ describe("diagnostic mode", () => {
 			"--suri", SIGNER.suri,
 			"--dir", frontendOnly,
 		], {
-			env: { DOT_DEPLOY_VERBOSE: "1" },
+			env: { DOT_MEMORY_TRACE: "1" },
 			timeout: 120_000,
 		});
 		const output = result.stdout + result.stderr;
-		// Reaching this banner is the real signal that preflight survived.
-		// Earlier this asserted /checking availability|deploy|mainnet/i — the
-		// `deploy` alternative matched the command name itself, so the test
-		// passed even when nothing of substance ran.
+		// Verbose-only prefix from src/utils/process-guard.ts watchdog worker:
+		//   "[mem +<seconds>s] rss=<bytes> heap=<used>/<total> external=... peak=..."
+		// That bracketed prefix is unique to this code path, so matching it
+		// proves DOT_MEMORY_TRACE actually engaged the sampler — not just
+		// that some other code wrote the word "rss" somewhere.
 		expect(
 			output,
-			`expected to reach availability check with verbose on\n${output}`,
-		).toContain("Checking availability");
-	});
-
-	test("DOT_MEMORY_TRACE=1 does not prevent normal operation", async () => {
-		const result = await dot(["--help"], {
-			env: { DOT_MEMORY_TRACE: "1" },
-			timeout: 15_000,
-		});
-		expect(result.exitCode).toBe(0);
-		// `deploy` appears in the subcommand list — that's the meaningful
-		// signal here. Pair with another known help string to make sure
-		// we got real `--help` output, not a stray match.
-		expect(result.stdout).toContain("deploy");
-		expect(result.stdout).toContain("Usage:");
+			`expected memory-trace markers in output\n${output}`,
+		).toMatch(/\[mem \+\d+\.\d+s\]/);
 	});
 });