Prove fewer retries. Prove no replay.

Run the current unit tests and simulator, then treat their output as reference behavior rather than a production benchmark.

Run everything

npm run check

This invokes the Node suites, payment adapter checks, strict Worker type checks, v2 unit and workerd suites, controlled exact-settlement suite, bounded no-money hot-object load smoke, existing-site and greenfield origin integration suites, package tarball smoke tests, and the simulator. None of these commands moves real funds.

Targeted suites

npm run test
npm run test:worker:unit
npm run test:worker
npm run test:worker:exact
npm run worker:test:signing-failure
npm run worker:test:ledger
npm run worker:load:local
npm run origin:examples
npm run check --workspace @x429/payment-x402

The included suites target the non-negotiable core properties. Retain a successful clean run for the exact release commit; the presence of a test file is not a passing result.

Proof, ticket, award, payment intent, and origin assertion binding and replay behavior.
Finite free and paid allocation, research/mock uniform clearing, the deployed fixed-price safety profile, and concurrent single-use redemption.
Standard x402 v2 challenge/signature/response headers and exact EIP-3009 economics.
Indeterminate settlement locking; matching Base safe boundary number/hash, depth-within-boundary, receipt, and event evidence from two providers; and four-attempt/40-RPC automatic proof bounds.
Finalized expired-unspent/refund paths and bounded lost-transaction discovery across at most 2,048 blocks and eight discovery RPC requests, followed by normal transaction verification.
Post-signature transport/5xx/malformed-response recovery, one same-authorization persistence retry, late-confirmation capacity rescheduling, and payment resume without a wallet signer.
Execution leases and signed upstream assertions around admitted requests.
Signer failure after coordinator mutation releases unsigned instant capacity and unpublished reservations.
Poison-auction isolation, bounded alarm backoff, global rescheduling, terminal exact-record retention, fixed export watermarks, and authenticated maintenance evidence.

worker:test:ledger tests an undeployed append-only ledger foundation. It is not proof of production accounting: source outboxes, replay reconciliation, scale, privacy/retention approval, and external close evidence remain required.

The exact suite includes a dedicated full-recovery-horizon case: it reserves every eligible future paid window, proves the confirmed payment remains recorded while admission fails closed, then releases one window and proves the same payment receives only that capacity-backed permit. A successful clean run for the release commit still has to be retained; test presence is not a passing result.

No-money capacity load

npm run worker:load:local

The Workerd smoke drives 30 concurrent clients into one hot capacity pool, requires both instant and scheduled free admissions, verifies every receipt signature and context, checks per-window SQL capacity plus zero bids/awards, and constructs a machine-readable x429.no-money-load.v2 report. Its network guard rejects mutation methods, protocol endpoints, cross-origin requests, and payment headers.

Remote mode requires an operator-declared and health-reported staging environment, explicit issuer/key/configuration/payment-mode pins, a shared run deadline, start-rate cap, failure circuit breaker, and --allow-remote --acknowledge-load-impact. The environment label is not part of the configuration hash, so keep the reviewed staging deployment record. A passing bounded smoke is not a sustained soak or production latency claim.

100-agent simulator

npm run simulate

Agent group	Policy	Expected result
50 loose-deadline agents	Can wait 15 seconds	Wait when the assigned window fits; otherwise exit at the deadline.
30 urgent budgeted agents	Deadline 2.5 seconds, budget 0.01 display units	Use the simulated priority path; the simulator moves no funds.
20 urgent unbudgeted agents	Deadline 2.5 seconds, no budget	Fail cleanly.

Interpreting simulator output

Metric	What good looks like	Why it matters
`retryReductionPercent`	80% or higher versus naive retry.	This is the simulator's enforced request-reduction gate.
`successes`	Count of clients that completed inside their configured policy.	Shows how deadlines and upgrade policy affect completion.
`paid` / `free`	Counts for simulated-priority and free-window completions.	Separates admission paths without implying a funded transaction.
`paidP95Ms` / `freeP95Ms`	Simulated priority is faster under the default scenario.	Checks that the configured earlier class behaves as designed.

Current automated gates

At least 80% fewer requests than naive retry.
Tampered tickets fail signature verification.
A spent nonce cannot redeem twice.
Simulated-priority p95 is below free-window p95 in the default scenario.

Controlled tests are implementation evidence, not production evidence. They do not establish public-chain funding, facilitator availability, production latency, real-load window accuracy, or independent security assurance.