Command Taxonomy

NOOSChain npm scripts use command prefixes to distinguish current-data health checks, local tools, feature regression tests, E2E tests, and load/stability harnesses.

verify:*

Use verify:* only for health checks against the configured current database or runtime health verification.

Current health commands:

• verify:chain
• verify:chain-auto
• verify:genesis
• verify:protocol
• verify:replay

Database Mutation Behavior

verify:* commands are intended for current-node health checks, but not every one is strictly read-only:

Command	Database target	Persistent mutation
verify:chain	configured current DB	No. Reads canonical chain data.
verify:genesis	configured current DB	No. Reads chain/genesis metadata.
verify:protocol	configured current DB	No. Reads protocol/block metadata.
verify:replay	current DB plus temporary replay schema	Does not mutate canonical data. Creates and drops a temporary replay schema.
verify:chain-auto	configured current DB	Yes. Updates local chain-verification checkpoint/status metadata. It does not mutate blocks, transactions, domain state, SMT roots, or consensus state.

tool:*

Use tool:* for operator/development utilities that perform an action rather than only checking state.

Current tool commands:

• tool:reset-local

tool:reset-local is destructive and requires NOOSCHAIN_ALLOW_DB_RESET=true.

Build/package utilities:

Command	Filesystem target	Persistent mutation
build:raft-go	dist/raft-go/hashicorp-raft(.exe)	Builds only the HashiCorp Raft sidecar binary. No database mutation.
dev:certs	dev-certs/	Generates local development CA/cert/key files for TLS/mTLS verification. No database mutation. The generated private keys are local dev artifacts and should not be committed.
docs:dev	local VitePress dev server	Serves documentation locally. No database mutation.
docs:api	docs/reference/code/	Regenerates TypeScript/JSDoc code reference markdown. No database mutation.
docs:build / test:docs	docs/reference/code/, docs/.vitepress/dist/	Regenerates code reference markdown, then builds static HTML documentation. No database mutation.
docs:preview	local VitePress preview server	Serves the built static documentation. No database mutation.
nooschain-ts:build	apps/nooschain-ts	Type-checks the TypeScript SDK package. No database mutation.
nooschain-ts:test	mocked SDK fetch client	Runs SDK transaction-builder and query-wrapper regression tests. No database mutation.
nooschain-ts:kitchen-sink	running node APIs when configured	Runs the SDK example app. Read-only unless NOOSCHAIN_SDK_SUBMIT=true, in which case it submits a signed transaction through /transactions.
test:swagger	local Fastify instances	Verifies development Swagger/OpenAPI configuration and route coverage. No database mutation beyond isolated test setup.
test:env-example	source tree and .env.example	Verifies that environment variables read by source code are documented in the root environment reference. No database mutation.

Operator CLI:

Command	Target	Persistent mutation
noos / cli	Running node operator/admin APIs and local snapshot tooling	Depends on subcommand. Read commands and doctor are non-mutating; dangerous actions require --yes; supported risky actions also support --dry-run. See Operator CLI.

noos organizations, noos users, and noos validators are read-only operator views. Organization/user registration and validator lifecycle changes must be signed consensus transactions built/submitted with noos tx or another canonical transaction path.

noos tx build reads local DATABASE_URL to resolve signer identity and nonce, then writes or prints a signed transaction. noos tx submit posts that transaction to /transactions and requires --yes; it does not write chain tables directly.

noos node reconcile-payload-availability --dry-run is read-only. With --prune-disallowed --yes, it mutates only local availability-layer ciphertext columns for rows that current policy/permissions say this node should not retain. It does not mutate consensus state, blocks, transactions, or state roots.

noos node payload-store-stats is read-only cached local availability diagnostics. Add --realtime only when troubleshooting counter drift; the realtime variant scans local ciphertext rows exactly and can be expensive on large nodes. noos node payload-store-gc is a retention tool for local ciphertext stored in encrypted_record_payloads and legacy availability columns. Dry-run is the default; confirmed GC requires --yes and deletes only selected local ciphertext bytes. noos node payload-store-repair-counters --yes rebuilds cached payload availability counters from realtime database contents when an operator suspects counter drift after manual repair. None of these commands create transactions, change blocks, update SMT state, or affect replay.

noos recipe provides guided wrappers around common initialization transactions such as creating organizations, creating users, creating buckets, updating bucket policy, and assigning bucket principals. Recipes still build and submit signed consensus transactions; they do not bypass noos tx semantics or write chain tables directly. See Operator Recipes.

noos governance operator-membership execute may mutate local trusted_peers and, when approved actions include runtime Raft operations, the HashiCorp Raft runtime membership. It does not submit governance transactions or bypass consensus-state validator governance.

noos snapshots export, verify, and import use local DATABASE_URL and stream large snapshot artifacts. Export writes a packaged archive by default, import mutates the selected database, and --dry-run reports the planned steps without writing/importing.

noos incidents doctor, noos doctor --deep, noos doctor --fix-plan, noos raft-go status/health/doctor, and noos support bundle are diagnostic operator commands. They read operator APIs and write only local report files when explicitly requested. noos raft-go restart/start/stop currently exposes a dry-run/manual recovery plan and refuses actual lifecycle mutation because the node API does not yet expose forced sidecar lifecycle control.

tool:reset-local drops and recreates the public schema of the configured local development database, reruns migrations, initializes genesis, commits development test blocks, and verifies the resulting chain.

test:*

Use test:* for focused feature regression scenarios. These tests may create isolated schemas, start local nodes, or mutate a clean development chain.

Output Convention

test:* scripts are CI-friendly by default. They print readable pass/fail lines and set a non-zero exit code on failure; raw JSON is no longer the default stdout format.

Structured summaries remain available for automation and artifact collection:

npm run test:snapshots -- --json
npm run test:snapshots -- --report-dir ./test-results/noos

--json prints only the structured summary JSON to stdout. --report-dir writes the same summary to <report-dir>/<script-name>.json while keeping stdout human-readable. NOOS_TEST_JSON=true and NOOS_TEST_REPORT_DIR=... provide equivalent environment controls.

For a CI-oriented wrapper:

npm run test:ci
npm run test:ci -- --include-e2e
npm run test-e2e:all

test:ci is the only aggregate runner that uses Node's built-in node:test runner. Each existing script is registered as one Node subtest and is still executed through its normal npm run test:* command, so focused test scripts keep their current behavior. The wrapper runs all default test:* feature scripts except test:docs and the opt-in heavy test:snapshots:large, then writes JSON summaries under test-results/noos by default. Add --include-e2e to include the slower test-e2e:* integration harnesses. Soak and stability harnesses are not part of test:ci; they keep their long-running report behavior under soak:* and stability:*.

test-e2e:all is the E2E-only aggregate runner. It uses the same node:test wrapper pattern as test:ci, but registers only test-e2e:* scripts and writes reports to test-results/noos-e2e by default. It supports --list, --fail-fast, and --report-dir.

During test:ci, the node:test spec reporter identifies the active subtest. The wrapper only prints a heartbeat every 30 seconds while long scripts are still active. It also sets NOOS_LOG_API_REQUESTS=false and NOOS_LOG_OBSERVABILITY=false by default, and disables process console logging with NOOS_LOG_CONSOLE_ENABLED=false, so Fastify startup, TLS development warnings, standalone Swagger request logs, subsystem lifecycle logs, and per-file migration progress do not drown out test pass/fail output. Run the individual npm run test:* script directly when you need the normal per-test logs for diagnostics.

Current feature regression commands:

• test:access-rules
• test:atomicity
• test:auth
• test:auth-clock
• test:backfill
• test:block-execution-fanout-report
• test:bucket-key-encryption
• test:bucket-policy
• test:canonical-envelope
• test:cli
• test:conflicts
• test:encryption
• test:env-example
• test:gossip
• test:key-rotation
• test:lifecycle
• test:logging
• test:malformed-sync
• test:observability
• test:observability-counters
• test:payload-availability-reconcile
• test:payload-store
• test:peer-scoring
• test:payload-invariant
• test:permissions
• test:raft
• test:raft:http
• test:raft:go
• test:raft:go:tcp-tls
• test:raft:membership
• test:raft:snapshot
• test:runtime-membership
• test:snapshots
• test:snapshots:large
• test:smt
• test:state-root-activation-readiness
• test:state-root-engine-governance
• test:sync
• test:sync-ingestion-auth-savepoint
• test:tls
• test:validator-governance

Database Mutation Behavior

Feature tests fall into two buckets.

No current feature test is expected to persist changes to the configured canonical public schema.

This command touches the configured DB but intentionally rolls back its test transaction:

Command	Persistent mutation
test:atomicity	No expected persistent mutation. It creates a failing block execution inside a transaction and rolls it back.

These commands use isolated schemas, in-memory Fastify injection, or separate test node databases. They should not mutate the configured canonical public schema except for creating/dropping their own generated test schemas:

Command	Database target
test:access-rules	isolated schema
test:auth	isolated test node/schema
test:auth-clock	isolated/manual-clock test nodes
test:backfill	isolated two-node schemas
test:block-execution-fanout-report	isolated benchmark schema created by benchmark:block-execution; verifies the fanout report shape for transaction-type and namespace mutation diagnostics
test:bucket-index-schema-update	isolated schema for compatible public-index schema update transactions and state-root leaves
test:bucket-key-encryption	isolated schema
test:bucket-policy	isolated two-node schemas
test:canonical-envelope	isolated two-node schemas
test:cli	isolated schema plus temporary Fastify node; exercises CLI command behavior, auth, dry-run, snapshot streaming, and redaction
test:conflicts	isolated two-node schemas
test:encryption	isolated schema
test:env-example	filesystem-only source scan. No database mutation; verifies .env.example documents discovered environment variables
test:gossip	isolated two-node schemas
test:key-rotation	isolated schema
test:lifecycle	isolated schema
test:logging	filesystem-only temporary log directory. No database mutation; verifies logger sinks, categories, and redaction
test:malformed-sync	isolated schema plus mock malformed peer
test:observability	isolated test node/schema
test:observability-counters	isolated test node/schema for cached-vs-realtime observability counter triggers
test:payload-availability-reconcile	isolated schema for local ciphertext prune/reconcile behavior after policy or permission changes
test:payload-store	isolated schemas for encrypted_record_payloads, legacy fallback, cached/realtime payload counters, prune, and snapshot local-ciphertext export/import
test:peer-scoring	isolated two-node schemas
test:payload-invariant	none. Pure in-memory hashing invariant regression check
test:permissions	isolated schema
test:raft	isolated three-node schemas for Noosraft transport, persistence, restart, failover, and incident behavior
test:raft:http	isolated three-node schemas and real Fastify servers for Noosraft HTTP transport behavior
test:raft:go	isolated schemas plus temporary HashiCorp Raft sidecar data dirs; builds the sidecar when needed and tests leader election, replication, failover, callbacks, and replay
test:raft:go:tcp-tls	isolated schemas, temporary HashiCorp Raft data dirs, and dev-certs inputs for HashiCorp Raft TCP TLS/mTLS behavior
test:raft:membership	isolated schemas plus temporary HashiCorp Raft sidecar data dirs for operator-approved add/remove voter behavior and unsafe quorum rejection
test:raft:snapshot	isolated three-node schemas for Raft snapshot catch-up behavior
test:runtime-membership	isolated schema for governance/runtime Raft membership reconciliation warnings without mutating Raft membership
test:snapshots	isolated schemas/checkpoint import schemas
test:snapshots:large	isolated schemas/checkpoint import schemas with a >32 MiB synthetic snapshot path
test:smt	configured current DB transaction. No persistent mutation; writes to a temporary SMT tree inside a transaction and rolls it back
test:state-root-activation-readiness	isolated schema plus fake sidecar commands; verifies state-root readiness reporting without mutating chain state
test:state-root-engine-governance	isolated schemas plus the Nervos state-root sidecar binary when present; verifies signed activation governance, replay, and snapshot preservation
test:sync	isolated two-node schemas
test:sync-ingestion-auth-savepoint	isolated source/target schemas; verifies committed sync ingestion still enforces signature/nonce auth and rolls back rejected remote blocks after the auth-savepoint optimization
test:tls	isolated TLS test schemas and dev-certs inputs; starts HTTPS/mTLS test nodes and drops temporary schemas
test:validator-governance	isolated schemas for chain-admin governance, validator lifecycle, peer-scoring boundary, snapshots, chain verification, and replay

test:ci is a node:test orchestration command. It does not add new test behavior; it registers the default feature scripts above as Node subtests, streams their readable output, and archives their JSON summaries. Heavy opt-in scripts such as test:snapshots:large are excluded from test:ci.

test-e2e:all is the matching E2E-only orchestration command. It registers all test-e2e:* scripts as Node subtests, excludes itself, and archives JSON summaries under test-results/noos-e2e unless --report-dir is provided.

test:snapshots:large is an opt-in heavy regression for the snapshot streaming path. It runs test/test-snapshots.ts --large, defaults to 250,000 synthetic streaming rows, and asserts the exported snapshot file is larger than 32 MiB. Tune it with NOOSCHAIN_SNAPSHOT_STREAMING_ROWS=<positive integer> when a runner needs a larger or smaller fixture. Set NOOSCHAIN_SMALL_SNAPSHOT_FAST_PATH_BYTES=0 to force streaming verify/import behavior for small snapshots without generating a large file.

test-e2e:*

Use test-e2e:* for full multi-node application integration tests.

test-e2e:* scripts follow the same output convention as test:*: readable stdout by default, --json for a structured summary, and --report-dir for a JSON artifact.

Current E2E commands:

• test-e2e:simple
• test-e2e:hardness-one-producer
• test-e2e:hardness-multiple-producers-noosraft
• test-e2e:hardness-multiple-producers-hashicorp-go

The E2E commands create isolated PostgreSQL schemas and real local Fastify nodes. They do not intentionally mutate the configured canonical public schema. They drop only generated test schemas unless the harness-specific keep flag is enabled.

test-e2e:hardness-one-producer covers one producer plus observers. test-e2e:hardness-multiple-producers-noosraft covers three validator nodes, Noosraft leader-only production, validator governance/runtime-membership boundaries, replicate-all payload availability repair, and duplicate committed-entry idempotency. When the Nervos sidecar binary is built, it also schedules a governed nervos-smt-v2 activation, checks validator readiness and fail-closed missing-sidecar readiness, verifies the leader cannot produce the activation block while the required sidecar command is broken, commits across the activation boundary after restoring it, and verifies mixed-engine block metadata. test-e2e:hardness-multiple-producers-hashicorp-go runs the same multi-validator/governance hardness path against the external HashiCorp Go Raft sidecar engine and adds sidecar/log/membership status assertions, including the HashiCorp committed callback receiver path. It shares the same state-root activation-boundary coverage when the Nervos sidecar binary is present.

Benchmarks, Stability, And Soak

These prefixes remain separate:

• benchmark:* for bounded performance benchmarks.
• stability:* for failure/size/Raft chaos stress harnesses.
• soak:* for long-running operational soak tests.

soak:* and the currently present stability harnesses use isolated schemas by default and drop only schemas that match their own generated prefixes unless their matching KEEP_DB option is enabled. stability:noosraft-chaos uses noos_raft_chaos_* schemas and writes JSON/JSONL reports under RAFT_CHAOS_LOG_DIR. stability:go-raft-chaos uses isolated temporary schemas, HashiCorp Raft sidecar data directories, and writes reports under GO_RAFT_CHAOS_LOG_DIR. They should not be pointed at production databases.

Current soak commands:

• soak:single-producer: one producer plus sync-only observers, using single_node consensus.
• soak:multiple-producers-noosraft: three Noosraft validator/producers plus three sync-only observers. It also exercises operator reconciliation by applying trusted-peer actions and an explicit Noosraft test config-apply window for runtime membership changes. When the Nervos state-root sidecar binary is built, fast smoke also covers governed nervos-smt-v2 activation, post-activation sidecar restart, observer catch-up, and post-activation snapshot archive round-trip.
• soak:multiple-producers-noosraft:gossip: same Noosraft topology with follower-to-leader transaction gossip probes, duplicate gossip rejection, and leader commit assertions.
• soak:multiple-producers-noosraft:tls: same Noosraft topology with HTTPS and local mTLS certificates enabled for TypeScript node APIs and Noosraft HTTP transport. Run npm run dev:certs first.
• soak:multiple-producers-noosraft:gossip:tls: combines the Noosraft gossip probes with the TLS/mTLS transport mode.
• soak:multiple-producers-noosraft:phase3: combines Noosraft gossip probes with peer-scoring block/restore checks and the operator-emulated runtime membership config-apply under active workload.
• soak:multiple-producers-noosraft:phase4: enables the large payload / large block profile and verifies packaged archive snapshot export, archive verification, archive import into an isolated schema, and replay from the imported checkpoint.
• soak:multiple-producers-hashicorp-go: three HashiCorp Go Raft validator/producers plus three sync-only observers. It exercises the same workload shape with external sidecars and HashiCorp runtime status. When the Nervos state-root sidecar binary is built, fast smoke also covers governed nervos-smt-v2 activation, post-activation state-root sidecar restart, observer catch-up, and post-activation snapshot archive round-trip.
• soak:multiple-producers-hashicorp-go:gossip: same HashiCorp topology with follower-to-leader transaction gossip probes, duplicate gossip rejection, and leader commit assertions.
• soak:multiple-producers-hashicorp-go:tls: same HashiCorp topology with TLS and local mTLS certificates enabled for TypeScript node APIs, Go HTTP control/callback APIs, and the HashiCorp TCP Raft transport. Fast smoke also probes sidecar restart supervision under load.
• soak:multiple-producers-hashicorp-go:gossip:tls: combines the HashiCorp gossip probes with the TLS/mTLS transport mode.
• soak:multiple-producers-hashicorp-go:phase3: combines HashiCorp Go gossip probes with peer-scoring block/restore checks and operator-approved runtime membership changes under active workload. This command disables the sidecar restart probe by default so membership/gossip behavior is isolated unless NOOS_MP_HASHICORP_GO_SOAK_SIDECAR_RESTART_EVERY_STEPS is explicitly set.
• soak:multiple-producers-hashicorp-go:phase4: enables the large payload / large block profile and verifies packaged archive snapshot export, archive verification, archive import into an isolated schema, and replay from the imported checkpoint. It disables the sidecar restart probe by default so the snapshot stress path is isolated unless explicitly combined.

Both multi-producer baseline commands still disable transaction gossip so they can isolate consensus ordering and observer sync. Use the :gossip commands for the first real-life gossip propagation layer. Use the :phase3 commands for gossip under runtime membership mutation and peer-scoring interaction. Use the :phase4 commands for large-record/large-block stress plus packaged archive snapshot import/export validation.

Set NOOS_MP_NOOSRAFT_SOAK_STATE_ROOT_ACTIVATION_ENABLED=true or NOOS_MP_HASHICORP_GO_SOAK_STATE_ROOT_ACTIVATION_ENABLED=true to force the Nervos activation segment in custom non-fast-smoke runs.

benchmark:record-index-search is the focused public-index search benchmark. It creates an isolated schema, loads synthetic encrypted-record metadata, and compares the initial indexes, the production bucket/key/value indexes, and a benchmark-only normalized-key prototype. It is the tool to run before deciding whether a deployment needs additional public-index schema work.

benchmark:db-performance measures broad PostgreSQL read/write hot paths, including observability counters, encrypted-record writes, record indexes, payload backfill scans, mempool reads, SMT upserts, and snapshot metadata.

benchmark:block-execution measures the local block execution hot path: transaction admission, block building, domain handler execution, public-index fanout, SMT materialization, and final commit/finalization timings.

benchmark:v1-readiness runs the release-readiness benchmark matrix: Nervos sidecar build, block execution profiles, state-root engine comparison, archive snapshot import/export, sync/catch-up scenarios, payload backfill, and sidecar checkpoint persistence. benchmark:v1-readiness:check compares the matrix report against test/benchmarks/v1-readiness/v1-performance-budgets.json. Run the fast local smoke with NOOS_V1_READINESS_FAST=true; run the default matrix on production-like hardware before v1 sign-off. See V1 Performance Targets.

benchmark:signing measures canonicalization, PEM parsing, Ed25519 signing and verification, and the optional signature KeyObject cache.

benchmark:smt isolates the sparse Merkle tree adapter from domain handlers. It compares persistent PostgreSQL-backed SMT storage with an in-memory iden3 tree for add, update, delete, proof, cache, pending-write, and flush behavior.

benchmark:smt:evaluation generates deterministic SMT operation vectors and runs candidate adapters against them. Today it verifies the current iden3 JS baseline twice and, by default, profiles adapter/internal timings such as NOOSChain hash-to-field conversion, iden3 mutation calls, root extraction, and proof serialization. Future established Rust/WASM candidates can be plugged into the same vector contract through NOOS_SMT_EVAL_EXTERNAL_CANDIDATE_COMMAND before any consensus-critical replacement is considered.

benchmark:smt:evaluation:external-fixture runs the same harness with an out-of-process iden3 fixture. It proves the candidate process contract and Windows/Linux launcher behavior; it is not an alternative SMT implementation.

build:state-root-sidecar-nervos-benchmark builds the Rust benchmark utility under external/state-root-sidecar-nervos-tools. It wraps the maintained sparse-merkle-tree crate and is used by vector/benchmark tooling, not normal block execution.

build:state-root-tools builds both Rust state-root binaries: the Nervos benchmark utility and the runtime Nervos state-root sidecar.

build:state-root-sidecar-nervos builds the persistent Nervos state-root sidecar under external/state-root-sidecar-nervos. It is the runtime sidecar used by the nervos-smt-v2 state-root engine.

benchmark:state-root-engine runs a higher-level state-root engine benchmark. It compares the iden3 adapter with native sidecar execution by applying a block-style mutation batch and rebuilding from final leaves.

benchmark:state-root-real-vectors creates an isolated replay schema, commits real NOOSChain transactions, extracts block_state_changes and state_leaves, and checks whether external state-root utilities produce matching replay and snapshot roots for real chain state shapes.

benchmark:state-root-persistent-sidecar starts the Nervos persistent sidecar as a long-running process, loads synthetic leaves in batches, exports checkpoints, restarts and reloads a checkpoint, and reports checkpoint size/load/export timing plus memory samples.

test:state-root-sidecar-lifecycle is a process-boundary regression test for future state-root sidecars. It uses tiny fake local candidates to verify that missing binaries, non-zero exits, malformed JSON, invalid roots, hung processes, and temporary vector cleanup are handled without accepting an unsafe root. It also checks the persistent sidecar wrapper reports supervision status and can auto-restart after an unexpected process exit.

test:state-root-persistent-sidecar starts the Nervos persistent sidecar when the binary is built, applies real NOOSChain state mutations, exports a checkpoint, restarts and reloads it, checks abrupt process-death recovery around checkpoint boundaries, verifies the sidecar version/health contract, verifies compiled proof generation/verification, and rejects corrupt or wrong-version checkpoints. It reports skipped when the Rust binary is absent.

test:state-root-engine-version verifies the metadata rail for future state-root engine migration. It confirms current blocks and snapshots record iden3-v1 and that chain/snapshot verification reject unknown engine versions.

test:state-root-engine-safety verifies the state-root engine safety gates: Nervos is the default engine for new chains, invalid activation heights are rejected, and accidental iden3-to-Nervos continuation is refused unless an explicit activation boundary exists.

test:state-root-nervos-vectors starts the Nervos sidecar and applies pinned mutation vectors. It asserts the empty root and subsequent batch roots match the committed nervos-smt-v2 compatibility values.

test:state-root-nervos verifies the NOOS_STATE_ROOT_ENGINE=nervos-smt-v2 path. When the Rust sidecar binary is built, it executes genesis and normal transactions through the TypeScript state machine, records nervos-smt-v2 on blocks/snapshots, recomputes the snapshot root through the same sidecar, and verifies Nervos proof generation/verification. It reports skipped when the sidecar binary is absent.

test:state-root-proofs exercises the public proof boundary. It generates and verifies inclusion and non-inclusion proofs through the Nervos sidecar, rejects tampered roots/keys/values, checks the HTTP proof routes, and proves snapshot import preserves enough state-root metadata to continue serving proofs.

test:state-root-engine-activation verifies the mixed-engine migration test model. It configures a local activation height, commits blocks before and after the boundary, replays each block using stored engine metadata, and confirms post-activation snapshots/imported checkpoints preserve nervos-smt-v2.

test:state-root-activation-readiness verifies the operator readiness report for state-root engine activations. It checks that iden3-v1 needs no sidecar, that a scheduled Nervos activation reports not ready when the configured binary is missing, rejects wrong-version, bad-checkpoint, and unresponsive sidecar behavior, rejects sidecars that report the wrong protocol version, and, when the Rust sidecar has been built, verifies the real sidecar version, health, mutation, and checkpoint round-trip checks pass.

test:state-root-engine-governance verifies the consensus-governed activation path. It checks non-admin scheduling is rejected, chain-admin scheduling writes state_root_engine_activations, blocks switch engine only at the committed activation height, replay follows the committed schedule, and snapshots export and import the activation row.

noos production report, noos production monitor-report, noos production profile, noos production preflight, and noos production backup-drill are operator CLI commands, not tests. report returns a read-only production readiness checklist. profile returns the role/compatibility subset, including expected profile, inferred profile, node/CLI version, migration compatibility, and snapshot archive format support. preflight fails closed when required launch checks are red: HTTPS operator access, production node environment, node TLS, profile mismatch, node/CLI version mismatch, pending/unknown migrations, health, incidents, consensus/sidecar status, Raft TCP TLS, governance/runtime membership, state-root readiness, backup metadata, payload availability, and sync/backfill status. monitor-report is a polling-friendly alert report that derives critical/warning/info alerts from the same observability surface without mutating the node. backup-drill is a local DB-backed restore proof: it exports a packaged archive snapshot, verifies it, restores it into generated isolated schemas, and writes backup-drill-report.json.

Actual node restore remains a runbook-guided operation because the correct procedure depends on node role and failure mode. See Backup, Restore, And Recovery for observer restore, validator restore with intact HashiCorp Raft data, validator total data loss, single-node restore, and operator-restore safeguards.

benchmark:payload-backfill isolates encrypted-payload availability recovery. It seeds one target schema with missing payload metadata across all-nodes, authorized-only, metadata-only, and unauthorized buckets, serves deterministic ciphertext from a local peer, and reports peer HTTP batch counts, DB update batch counts, reasonCounts, and payloads/sec. Use it to tune PAYLOAD_BACKFILL_HTTP_BATCH_SIZE and PAYLOAD_BACKFILL_DB_UPDATE_BATCH_SIZE after benchmark:sync-catchup shows payload phases are dominant.

benchmark:payload-store isolates local payload-store read behavior after ciphertext is already present in encrypted_record_payloads. It measures single-record lookup, batch lookup, operator stats, GC dry-run, bounded prune, restore, and an export-like ciphertext scan. Use it before adding retention indexes or cached payload-store byte/age counters.

benchmark:sync-catchup measures HTTP block catch-up and payload backfill for fresh or lagged observers. It uses isolated schemas and real sync/backfill services, then reports blocks/sec, transactions/sec, payloads/sec, phase timings, block-execution sub-timings, peer request counts, and final head/state-root verification. Use its executionTimings section to determine whether catch-up is limited by HTTP range fetches, payload recovery, protocol handlers, SMT state application, or finalization. Set NOOS_SYNC_CATCHUP_BENCH_RUN_PAYLOAD_BACKFILL=false for an execution-only profile that intentionally excludes availability-layer payload recovery. Set NOOS_SYNC_CATCHUP_BENCH_PAYLOAD_PROFILE=multi-policy to exercise all-nodes, authorized-only, and metadata-only payload replication policies in one run. Set NOOS_SYNC_CATCHUP_BENCH_SCENARIO=snapshot-bootstrap to compare snapshot checkpoint bootstrap plus tail sync/backfill against full block catch-up.

benchmark:snapshots measures archive snapshot export, verification, and large-file import/checkpoint bootstrap by default. Set NOOS_SNAPSHOT_BENCH_FORMAT=json only when comparing against the legacy JSON path. Use the benchmark before tuning snapshot batch sizes or SMT rebuild settings for files larger than 32 MiB.

Current workspace caveat: benchmark:performance, stability:failure-stress, stability:size, and stability:size:10m are still listed in package.json, but their referenced runner files under src/stability-test/benchmarks, src/stability-test/failure-stress, and src/stability-test/size-stress are not present. Their docs describe the intended designs rather than runnable commands in this tree.