ci(demo): test the package built from each commit

.github/workflows/ci.yml

@@ -73,8 +73,12 @@ jobs:
       - run: node --test packages/core/src/*.test.js
 
   assistant-ui-demo:
-    name: Assistant UI demo
+    name: Assistant UI demo (${{ matrix.package }})
     runs-on: ubuntu-latest
+    strategy:
+      fail-fast: false
+      matrix:
+        package: [published, candidate]
     defaults:
       run:
         working-directory: examples/assistant-ui-demo
@@ -84,7 +88,21 @@ jobs:
         with:
           runtime: node@24
           install: false
+      - uses: dtolnay/rust-toolchain@stable
+        if: matrix.package == 'candidate'
+        with:
+          toolchain: 1.97.1
+          targets: wasm32-unknown-unknown
+      - name: Pack the candidate package
+        if: matrix.package == 'candidate'
+        working-directory: packages/core
+        run: |
+          mkdir "$RUNNER_TEMP/streamfold-candidate"
+          npm pack --pack-destination "$RUNNER_TEMP/streamfold-candidate"
       - run: npm ci
+      - name: Install the candidate package
+        if: matrix.package == 'candidate'
+        run: npm install --no-save --ignore-scripts "$RUNNER_TEMP"/streamfold-candidate/streamfold-*.tgz
       - run: npm test
       - run: npm run build
       - run: npx playwright install --with-deps chromium

CONTRIBUTING.md

@@ -46,7 +46,11 @@ modes. Three alternating trials use fresh Node processes and explicit garbage
 collection, with final values checked against the source JSON. Results are
 written to `artifacts/final-value-memory.json`.
 
-The standalone assistant-ui demo has its own locked dependencies and CI job.
+The standalone assistant-ui demo has its own locked dependencies. CI runs its
+unit tests, production build, and browser tests against both the pinned npm
+release and a freshly built tarball from the commit under test. The candidate
+lane runs the package's `prepack` WASM build and installs the tarball without
+changing the demo's manifest or lockfile.
 From `examples/assistant-ui-demo`, run `npm ci`, `npm test`, and `npm run build`.
 Start a production preview on port 4173 and run `npm run test:browser` to check
 the UI. Set `CHROME_EXECUTABLE` to use an installed Chrome binary instead of

examples/assistant-ui-demo/README.md

@@ -234,6 +234,10 @@ to match the test default.
 
 The standalone install is intentional: this demo consumes the npm release
 instead of a workspace link and adds no React dependencies to Streamfold core.
+CI also installs a tarball built from the commit under test in a separate lane,
+then runs the same unit tests, production build, and browser tests. This catches
+integration regressions before release while retaining the published-version
+coverage. The candidate install does not change this demo's manifest or lockfile.
 
 ## Hosting