@cosmicdrift/kumiko-framework 0.305.0 → 0.307.0

package/src/db/queries/__tests__/{unsafe-read-retrying.test.ts → unsafe-read-retrying.integration.test.ts}

@@ -1,16 +1,10 @@
-// #2323: event-store.ts's and projection-rebuild.ts's plain SELECT helpers
-// read via asRawClient(db).unsafe() directly, bypassing the #1163
-// closed-connection retry that only covered bun-db/query.ts's own
-// selectMany/countWhere. Routed the non-locking read call sites through
-// unsafeReadRetrying instead — this test mirrors
-// bun-db/__tests__/select-many-retry.test.ts's fake-client pattern to prove
-// the retry now fires. Writes (insertSubsequentEventRow, upsertSnapshot,
-// markProjectionRebuilding, ...) stay unretried per #1358, and the
-// FOR UPDATE / FOR UPDATE SKIP LOCKED reads in event-consumer.ts are always
-// called inside transaction() (verified against their only call sites) — the
-// retry guard there is a no-op, so those are left as asRawClient calls too.
+// event-store.ts's and projection-rebuild.ts's SELECT helpers run through
+// unsafeReadRetrying; this proves the retry fires using a real captured
+// driver error. Writes and the FOR UPDATE reads inside transaction() stay
+// out of scope — unretried by design.
 
-import { describe, expect, test } from "bun:test";
+import { beforeAll, describe, expect, test } from "bun:test";
+import { captureClosedConnectionError } from "../../../testing/closed-connection-error";
 import {
   selectAggregateMaxVersion,
   selectEventsHighWaterMark,
@@ -22,24 +16,28 @@ import {
   selectEventsForProjectionRebuildBatch,
 } from "../projection-rebuild";
 
-function closedConnectionError(): Error {
-  return Object.assign(new Error("The connection was closed."), { name: "AbortError" });
-}
+let closedConnectionError: unknown;
+
+beforeAll(async () => {
+  closedConnectionError = await captureClosedConnectionError();
+});
 
 type RecordedCall = { readonly sql: string; readonly params: readonly unknown[] | undefined };
 
 type FakeClient = {
   unsafe: (sql: string, params?: readonly unknown[]) => Promise<readonly unknown[]>;
   begin: () => never;
+  options: { max: number };
   calls: number;
   recordedCalls: RecordedCall[];
 };
 
-function fakeClient(failures: Error[], row: Record<string, unknown>): FakeClient {
+function fakeClient(failures: unknown[], row: Record<string, unknown>): FakeClient {
   const remaining = [...failures];
   const client: FakeClient = {
     calls: 0,
     recordedCalls: [],
+    options: { max: 1 },
     unsafe: async (sql, params) => {
       client.calls++;
       client.recordedCalls.push({ sql, params });
@@ -54,9 +52,9 @@ function fakeClient(failures: Error[], row: Record<string, unknown>): FakeClient
   return client;
 }
 
-describe("framework db/queries — closed-connection retry (#2323)", () => {
+describe("framework db/queries — closed-connection retry", () => {
   test("selectStreamMaxVersion retries once and returns the version", async () => {
-    const db = fakeClient([closedConnectionError()], { v: 5 });
+    const db = fakeClient([closedConnectionError], { v: 5 });
     const result = await selectStreamMaxVersion(db as never, "agg1", "t1");
     expect(result).toBe(5);
     expect(db.calls).toBe(2);
@@ -65,28 +63,28 @@ describe("framework db/queries — closed-connection retry (#2323)", () => {
   });
 
   test("selectAggregateMaxVersion retries once and returns the version", async () => {
-    const db = fakeClient([closedConnectionError()], { v: 7 });
+    const db = fakeClient([closedConnectionError], { v: 7 });
     const result = await selectAggregateMaxVersion(db as never, "agg1");
     expect(result).toBe(7);
     expect(db.calls).toBe(2);
   });
 
   test("selectEventsHighWaterMark retries once and returns the max id", async () => {
-    const db = fakeClient([closedConnectionError()], { max: 42n });
+    const db = fakeClient([closedConnectionError], { max: 42n });
     const result = await selectEventsHighWaterMark(db as never);
     expect(result).toBe(42n);
     expect(db.calls).toBe(2);
   });
 
   test("selectNextEventIdAfter retries once and returns the next id", async () => {
-    const db = fakeClient([closedConnectionError()], { id: 43n });
+    const db = fakeClient([closedConnectionError], { id: 43n });
     const result = await selectNextEventIdAfter(db as never, 42n);
     expect(result).toBe(43n);
     expect(db.calls).toBe(2);
   });
 
   test("selectEventsForProjectionRebuildBatch retries once and returns rows", async () => {
-    const db = fakeClient([closedConnectionError()], { id: "1", type: "created" });
+    const db = fakeClient([closedConnectionError], { id: "1", type: "created" });
     const rows = await selectEventsForProjectionRebuildBatch(
       db as never,
       ["user"],
@@ -99,17 +97,19 @@ describe("framework db/queries — closed-connection retry (#2323)", () => {
   });
 
   test("countSubscribedEvents retries once and returns the count", async () => {
-    const db = fakeClient([closedConnectionError()], { n: 12n });
+    const db = fakeClient([closedConnectionError], { n: 12n });
     const result = await countSubscribedEvents(db as never, ["user"], ["user:created"]);
     expect(result).toBe(12n);
     expect(db.calls).toBe(2);
   });
 
-  test("gives up after the single retry when the connection stays closed", async () => {
-    const db = fakeClient([closedConnectionError(), closedConnectionError()], { v: 5 });
-    await expect(selectStreamMaxVersion(db as never, "agg1", "t1")).rejects.toThrow(
-      "connection was closed",
+  test("gives up after exhausting pool-bounded retries (max: 1 → 3 total calls)", async () => {
+    const db = fakeClient([closedConnectionError, closedConnectionError, closedConnectionError], {
+      v: 5,
+    });
+    await expect(selectStreamMaxVersion(db as never, "agg1", "t1")).rejects.toBe(
+      closedConnectionError,
     );
-    expect(db.calls).toBe(2);
+    expect(db.calls).toBe(3);
   });
 });

package/src/db/queries/event-consumer.ts

@@ -1,6 +1,30 @@
+import type { PendingGapEntry } from "../../pipeline/event-consumer-state";
 import type { AnyDb } from "../query";
 import { asRawClient } from "../query";
 
+// Per-turn snapshot bounds for pending-gap finality (event-dispatcher.ts's
+// processConsumer). pg_current_snapshot() is this transaction's MVCC view;
+// xmin is the oldest still-in-progress xact id in it, xmax the next
+// unassigned one. Both travel as strings — bigint/xid8 doesn't round-trip
+// through the driver as a JS number.
+export async function selectSnapshotXmin(db: AnyDb): Promise<string> {
+  const rows = (await asRawClient(db).unsafe(
+    `SELECT pg_snapshot_xmin(pg_current_snapshot())::text AS xmin`,
+  )) as ReadonlyArray<{ xmin: string }>;
+  const xmin = rows[0]?.xmin;
+  if (xmin === undefined) throw new Error("selectSnapshotXmin: no row returned");
+  return xmin;
+}
+
+export async function selectSnapshotXmax(db: AnyDb): Promise<string> {
+  const rows = (await asRawClient(db).unsafe(
+    `SELECT pg_snapshot_xmax(pg_current_snapshot())::text AS xmax`,
+  )) as ReadonlyArray<{ xmax: string }>;
+  const xmax = rows[0]?.xmax;
+  if (xmax === undefined) throw new Error("selectSnapshotXmax: no row returned");
+  return xmax;
+}
+
 /** Serialise against consumer-bootstrap INSERTs during event retention prune. */
 export async function lockEventConsumersShareMode(db: AnyDb): Promise<void> {
   await asRawClient(db).unsafe(`LOCK TABLE "kumiko_event_consumers" IN SHARE MODE`);
@@ -116,6 +140,7 @@ export type ConsumerDeliveryOutcome = {
   readonly lastError: string | null;
   readonly deadLettered: boolean;
   readonly processed: number;
+  readonly pendingGaps: readonly PendingGapEntry[];
 };
 
 export async function updateConsumerDeliveryOutcome(
@@ -136,14 +161,17 @@ export async function updateConsumerDeliveryOutcome(
        "status" = $3,
        "last_error" = $4,
        "rearm_count" = CASE WHEN $5 THEN 0 ELSE "rearm_count" END,
+       -- text param + cast: a JS string bound straight to ::jsonb double-encodes under Bun.SQL
+       "pending_gaps" = $6::text::jsonb,
        "updated_at" = now()
-     WHERE "name" = $6 AND "instance_id" = $7`,
+     WHERE "name" = $7 AND "instance_id" = $8`,
     [
       outcome.cursor,
       outcome.attempts,
       outcome.deadLettered ? "dead" : "idle",
       outcome.lastError,
       resetRearmCount,
+      JSON.stringify(outcome.pendingGaps),
       name,
       instanceId,
     ],
@@ -192,13 +220,14 @@ export async function resetConsumerForMspRebuild(
   instanceId: string,
 ): Promise<void> {
   await asRawClient(db).unsafe(
-    `INSERT INTO "kumiko_event_consumers" ("name", "instance_id", "last_processed_event_id", "status")
-     VALUES ($1, $2, 0, 'idle')
+    `INSERT INTO "kumiko_event_consumers" ("name", "instance_id", "last_processed_event_id", "status", "pending_gaps")
+     VALUES ($1, $2, 0, 'idle', '[]'::jsonb)
      ON CONFLICT ("name", "instance_id") DO UPDATE SET
        "last_processed_event_id" = 0,
        "status" = 'idle',
        "attempts" = 0,
        "last_error" = NULL,
+       "pending_gaps" = '[]'::jsonb,
        "updated_at" = now()`,
     [name, instanceId],
   );
@@ -269,3 +298,28 @@ export async function rearmDeadConsumer(
   )) as ReadonlyArray<Record<string, unknown>>;
   return rows[0];
 }
+
+// skipPoisonEvent's pending-gap branch: the poison is a pending id below the
+// cursor, so it's removed from pending_gaps directly instead of advancing
+// last_processed_event_id (advancing it here would be a regression — the
+// cursor already sits above this id).
+export async function removePendingGapReturning(
+  db: AnyDb,
+  name: string,
+  instanceId: string,
+  newPendingGaps: readonly PendingGapEntry[],
+): Promise<Record<string, unknown> | undefined> {
+  const rows = (await asRawClient(db).unsafe(
+    `UPDATE "kumiko_event_consumers" SET
+       "pending_gaps" = $1::text::jsonb,
+       "status" = 'idle',
+       "attempts" = 0,
+       "last_error" = NULL,
+       "rearm_count" = 0,
+       "updated_at" = now()
+     WHERE "name" = $2 AND "instance_id" = $3
+     RETURNING *`,
+    [JSON.stringify(newPendingGaps), name, instanceId],
+  )) as ReadonlyArray<Record<string, unknown>>;
+  return rows[0];
+}

package/src/db/queries/event-store.ts

@@ -7,6 +7,15 @@ import {
 import type { AnyDb } from "../query";
 import { asRawClient, unsafeReadRetrying } from "../query";
 
+// Gap-finality (event-dispatcher pending_gaps) needs every holder of an
+// event id to already have a *real* xact id by the time it inserts — Postgres
+// assigns those lazily on first write, so a bare INSERT alone doesn't
+// guarantee one exists yet for comparison against a later snapshot's
+// xmin/xmax. pg_current_xact_id() forces the allocation.
+export async function claimXactId(db: AnyDb): Promise<void> {
+  await asRawClient(db).unsafe(`SELECT pg_current_xact_id()`);
+}
+
 /** NOTIFY on commit — wakes LISTEN subscribers (event-dispatcher). */
 export async function notifyPgChannel(db: AnyDb, channel: string): Promise<void> {
   await asRawClient(db).unsafe(`SELECT pg_notify($1, '')`, [channel]);
@@ -283,3 +292,63 @@ export async function upsertArchivedStream(db: AnyDb, params: ArchiveStreamParam
     [params.tenantId, params.aggregateId, params.aggregateType, params.archivedBy, params.reason],
   );
 }
+
+export type PendingIdRange = { readonly from: bigint; readonly to: bigint };
+
+// Per-consumer turn fetch: the plain `id > cursor` window plus any ranges the
+// consumer is still watching as pending gaps (ids invisible on an earlier
+// turn that may have become visible since). Raw SQL — the typed builder's
+// WhereObject is an AND of fields, it can't express this OR.
+export async function selectPendingAndNewEventRows(
+  db: AnyDb,
+  cursor: bigint,
+  pendingRanges: readonly PendingIdRange[],
+  batchSize: number,
+): Promise<ReadonlyArray<Record<string, unknown>>> {
+  if (pendingRanges.length === 0) {
+    return unsafeReadRetrying(
+      db,
+      `SELECT * FROM "kumiko_events" WHERE "id" > $1 ORDER BY "id" ASC LIMIT $2`,
+      [cursor, batchSize],
+    );
+  }
+  return unsafeReadRetrying(
+    db,
+    // UNION ALL of two primary-key range scans: an `id > $1 OR EXISTS (…)`
+    // predicate can't use the index and would seq-scan kumiko_events per turn.
+    // Ranges sit below $1, so the branches never overlap.
+    `(SELECT e.* FROM unnest($2::bigint[], $3::bigint[]) AS g(f, t)
+       CROSS JOIN LATERAL (
+         SELECT * FROM "kumiko_events" WHERE "id" BETWEEN g.f AND g.t ORDER BY "id" ASC LIMIT $4
+       ) e)
+     UNION ALL
+     (SELECT * FROM "kumiko_events" WHERE "id" > $1 ORDER BY "id" ASC LIMIT $4)
+     ORDER BY "id" ASC LIMIT $4`,
+    [
+      cursor,
+      pendingRanges.map((r) => r.from.toString()),
+      pendingRanges.map((r) => r.to.toString()),
+      batchSize,
+    ],
+  );
+}
+
+// Smallest committed-and-visible id inside any pending range — lets
+// skipPoisonEvent (event-dispatcher-admin.ts) tell a live poison apart from
+// a still-invisible gap without pulling full rows.
+export async function selectSmallestVisibleIdInRanges(
+  db: AnyDb,
+  pendingRanges: readonly PendingIdRange[],
+): Promise<bigint | null> {
+  if (pendingRanges.length === 0) return null;
+  const rows = (await unsafeReadRetrying(
+    db,
+    `SELECT MIN("id")::text AS id FROM "kumiko_events"
+     WHERE EXISTS (
+       SELECT 1 FROM unnest($1::bigint[], $2::bigint[]) AS g(f, t) WHERE "id" BETWEEN g.f AND g.t
+     )`,
+    [pendingRanges.map((r) => r.from.toString()), pendingRanges.map((r) => r.to.toString())],
+  )) as ReadonlyArray<{ id: string | null }>;
+  const id = rows[0]?.id;
+  return id === null || id === undefined ? null : BigInt(id);
+}

package/src/db/tenant-db.ts

@@ -51,6 +51,41 @@ const declaredUnsafeRawRunners = new WeakMap<
 // (withUnsafeRawGrant, acknowledgeConventionCrossTenant) carry it too.
 const personalDataGates = new WeakMap<TenantDb, PersonalDataGate>();
 
+// Lets createTenantDb(ctx.db.unsafeRaw(reason), ...) inherit the gate. Keyed by a
+// per-grant proxy, never the shared pool/tx: tagging that would gate every sibling TenantDb.
+const runnerPersonalDataGates = new WeakMap<DbRunner, PersonalDataGate>();
+
+function gatedRunner(runner: DbRunner, gate: PersonalDataGate): DbRunner {
+  const proxy = new Proxy(runner as object, {
+    // Tagged-template calls need the real driver object as `this`.
+    apply(target, _thisArg, args) {
+      return Reflect.apply(target as (...callArgs: unknown[]) => unknown, target, args);
+    },
+    get(target, prop, _receiver) {
+      const value = Reflect.get(target, prop, target);
+      if (typeof value !== "function") return value;
+      if (prop === "begin" || prop === "savepoint") {
+        // createTenantDb(tx, ...) inside the callback must inherit the gate too.
+        return (...args: unknown[]) => {
+          const callback = args[args.length - 1];
+          if (typeof callback !== "function") {
+            return Reflect.apply(value, target, args);
+          }
+          const gatedArgs = [
+            ...args.slice(0, -1),
+            (tx: unknown) => callback(gatedRunner(tx as DbRunner, gate)),
+          ];
+          return Reflect.apply(value, target, gatedArgs);
+        };
+      }
+      return value.bind(target);
+    },
+    // @cast-boundary proxy-erasure — Proxy<object> re-tags as the wrapped DbRunner shape.
+  }) as DbRunner;
+  runnerPersonalDataGates.set(proxy, gate);
+  return proxy;
+}
+
 // The executor passes its entity so the check does not depend on the table-name lookup.
 export function assertPersonalDataWrite(
   db: TenantDb,
@@ -73,25 +108,49 @@ export function unsafeRawForDeclaredStep(
   if (!runner) {
     throw new InternalError({
       message:
-        "unsafeRawForDeclaredStep received a holder not built by createTenantDb or " +
-        "createUncheckedSystemDb — no declared unsafeRaw runner bound.",
+        "unsafeRawForDeclaredStep received a holder not built by createTenantDb, " +
+        "createUncheckedSystemDb, or createSystemDbView — no declared unsafeRaw runner bound.",
     });
   }
   return runner(reason);
 }
 
-// buildHandlerContext (pipeline/dispatch-shared.ts) always builds "system"
-// mode from the caller's own tenantId, never a foreign one.
-//
-// dbOutsideTransaction is optional so every existing single-arg call site
-// (jobs, tests, delivery-service.ts) keeps compiling — those callers have no
-// outside-tx source to hand in and never needed one. Only
-// buildHandlerContext passes it, which is also the only place `.outsideTransaction`
-// is reachable through `ctx.systemDb`.
-export function createUncheckedSystemDb(
+const systemDbRebinders = new WeakMap<
+  UncheckedSystemDb,
+  (grant: EscapeHatchDeclaration | undefined, deniedCallerLabel: string) => UncheckedSystemDb
+>();
+
+// Rebinds a hook's own escapeHatch onto ctx.systemDb, mirroring withUnsafeRawGrant: always
+// rebuilt from the original db/dbOutsideTransaction/report, never stacked onto a prior rebind.
+// Inputs not built by createUncheckedSystemDb pass through unchanged.
+export function withSystemDbUnsafeRawGrant(
+  systemDb: UncheckedSystemDb,
+  grant: EscapeHatchDeclaration | undefined,
+  deniedCallerLabel: string,
+): UncheckedSystemDb {
+  const rebind = systemDbRebinders.get(systemDb);
+  return rebind ? rebind(grant, deniedCallerLabel) : systemDb;
+}
+
+// Ungated when `gate` is absent (the handler's own ctx.systemDb — systemScope() is
+// itself the grant there). Gated by a hook's own escapeHatch when `gate.kind` is
+// "hook-grant": unsafeRaw then denies without `hasGrant(gate.grant)`, same error shape
+// as ctx.db.unsafeRaw's denial in createTenantDb below. Gated by the source TenantDb's
+// own escapeHatch when `gate.kind` is "source-tenant-db" (createSystemDbView): unsafeRaw
+// defers entirely to db's own declared runner (reason/memberReadOnly/grant check and
+// report) — the view's own `report` is never called for unsafe-raw in that mode, and a
+// source not built by createTenantDb fails closed.
+function buildUncheckedSystemDb(
   db: TenantDb,
-  dbOutsideTransaction?: TenantDb,
-  report: EscapeHatchReporter = fallbackEscapeHatchReporter(db.tenantId),
+  dbOutsideTransaction: TenantDb | undefined,
+  report: EscapeHatchReporter,
+  gate?:
+    | {
+        readonly kind: "hook-grant";
+        readonly grant: EscapeHatchDeclaration | undefined;
+        readonly deniedCallerLabel: string;
+      }
+    | { readonly kind: "source-tenant-db" },
 ): UncheckedSystemDb {
   const allowedTenantIds: readonly TenantId[] = [db.tenantId, SYSTEM_TENANT_ID];
 
@@ -113,11 +172,23 @@ export function createUncheckedSystemDb(
   }
 
   function grantedUnsafeRawRunner(reason: string): DbRunner {
+    if (gate?.kind === "source-tenant-db") {
+      return unsafeRawForDeclaredStep(db, reason);
+    }
     if (reason.trim().length === 0) {
       throw new Error("unsafeRaw requires a non-empty reason");
     }
+    if (gate && !hasGrant(gate.grant)) {
+      throw new AccessDeniedError({
+        message:
+          'ctx.systemDb.unsafeRaw(reason): rejected — declare `escapeHatch: { reason: "..." }` on ' +
+          `${gate.deniedCallerLabel} to allow unsafeRaw.`,
+      });
+    }
     report("unsafe-raw", reason);
-    return tenantDbRunner(db);
+    const runner = tenantDbRunner(db);
+    const personalDataGate = personalDataGates.get(db);
+    return personalDataGate ? gatedRunner(runner, personalDataGate) : runner;
   }
 
   const uncheckedSystemDb: UncheckedSystemDb = {
@@ -178,9 +249,52 @@ export function createUncheckedSystemDb(
     },
   };
   declaredUnsafeRawRunners.set(uncheckedSystemDb, grantedUnsafeRawRunner);
+  if (gate?.kind !== "source-tenant-db") {
+    systemDbRebinders.set(uncheckedSystemDb, (grant, deniedCallerLabel) =>
+      buildUncheckedSystemDb(
+        withUnsafeRawGrant(db, grant),
+        dbOutsideTransaction && withUnsafeRawGrant(dbOutsideTransaction, grant),
+        report,
+        { kind: "hook-grant", grant, deniedCallerLabel },
+      ),
+    );
+  }
   return uncheckedSystemDb;
 }
 
+// Framework-private (not re-exported from db/index.ts): buildHandlerContext
+// (pipeline/dispatch-shared.ts) always builds "system" mode from the caller's
+// own tenantId, never a foreign one.
+//
+// dbOutsideTransaction is optional so every existing single-arg call site
+// (jobs/job-runner.ts, tests) keeps compiling — those callers have no
+// outside-tx source to hand in and never needed one. Only
+// buildHandlerContext passes it, which is also the only place `.outsideTransaction`
+// is reachable through `ctx.systemDb`.
+//
+// Ungated here (the handler's own systemScope() is the grant); a hook's own
+// escapeHatch is layered on afterwards via withSystemDbUnsafeRawGrant. Public
+// callers use createSystemDbView instead, whose unsafeRaw follows the source
+// TenantDb's own escapeHatch gate.
+export function createUncheckedSystemDb(
+  db: TenantDb,
+  dbOutsideTransaction?: TenantDb,
+  report: EscapeHatchReporter = fallbackEscapeHatchReporter(db.tenantId),
+): UncheckedSystemDb {
+  return buildUncheckedSystemDb(db, dbOutsideTransaction, report);
+}
+
+// Public: must never grant more raw access than the source TenantDb — unlike
+// createUncheckedSystemDb (framework-private; r.systemScope()/a job IS the
+// declaration), this view's unsafeRaw defers entirely to db's own escapeHatch gate.
+export function createSystemDbView(
+  db: TenantDb,
+  dbOutsideTransaction?: TenantDb,
+  report: EscapeHatchReporter = fallbackEscapeHatchReporter(db.tenantId),
+): UncheckedSystemDb {
+  return buildUncheckedSystemDb(db, dbOutsideTransaction, report, { kind: "source-tenant-db" });
+}
+
 // @cast-boundary tenant-db-row
 export function castTenantRows<T>(rows: readonly Record<string, unknown>[]): readonly T[] {
   return rows as unknown as readonly T[];
@@ -275,6 +389,7 @@ export function createTenantDb(
 ): TenantDb {
   if (meter) registerStandardMetrics(meter);
   const report = grants?.report ?? fallbackEscapeHatchReporter(tenantId);
+  const personalDataGate = grants?.personalDataGate ?? runnerPersonalDataGates.get(db);
 
   function withDbSpan<T>(
     operation: "select" | "insert" | "update" | "delete",
@@ -375,9 +490,9 @@ export function createTenantDb(
     table: Table | EntityTableMeta,
     keys: readonly string[],
   ): AccessDeniedError | undefined {
-    if (!grants?.personalDataGate) return undefined;
+    if (!personalDataGate) return undefined;
     try {
-      grants.personalDataGate(tableNameOf(table), keys);
+      personalDataGate(tableNameOf(table), keys);
       return undefined;
     } catch (e) {
       if (e instanceof AccessDeniedError) return e;
@@ -476,7 +591,7 @@ export function createTenantDb(
       });
     }
     report("unsafe-raw", reason);
-    return db;
+    return personalDataGate ? gatedRunner(db, personalDataGate) : db;
   }
 
   const tenantDb: TenantDb = {
@@ -571,7 +686,7 @@ export function createTenantDb(
     return createTenantDb(db, tenantId, "system", tracer, meter, signal, grants);
   });
   bindTenantDbRunner(tenantDb, db);
-  if (grants?.personalDataGate) personalDataGates.set(tenantDb, grants.personalDataGate);
+  if (personalDataGate) personalDataGates.set(tenantDb, personalDataGate);
   return tenantDb;
 }
 

package/src/engine/__tests__/boot-validator-gdpr-storage.test.ts

@@ -15,7 +15,12 @@ import { defineFeature } from "../define-feature";
 const udr = () => defineFeature("user-data-rights", () => {});
 const fileProvider = (name: string) =>
   defineFeature(`file-provider-${name}`, (r) => {
-    r.useExtension("fileProvider", name);
+    // build is never invoked here — the boot check only cares that a provider is mounted.
+    r.useExtension("fileProvider", name, {
+      build: async () => {
+        throw new Error("test stub — never invoked");
+      },
+    });
   });
 
 const S3_ENV = ["S3_BUCKET", "S3_REGION", "S3_ACCESS_KEY", "S3_SECRET_KEY"] as const;

package/src/engine/__tests__/boot-validator-s0-integration.test.ts

@@ -104,8 +104,8 @@ describe("S0 Integration — full surface stack", () => {
         access: { openToAll: { reason: "test handler callable by any signed-in test user" } },
       });
 
-      r.useExtension(EXT_USER_DATA, "user", {});
-      r.useExtension(EXT_USER_DATA, "comment", {});
+      r.useExtension(EXT_USER_DATA, "user", { export: async () => null });
+      r.useExtension(EXT_USER_DATA, "comment", { export: async () => null });
 
       r.writeHandler({
         name: "user:rename",

package/src/engine/__tests__/boot-validator.test.ts

@@ -358,7 +358,7 @@ describe("boot-validator", () => {
     const self = defineFeature("tier-stub", (r) => {
       r.extendsRegistrar("tenantTierResolver", { onRegister: () => {} });
       r.entity("dummy", createEntity({ table: "Dummies", fields: {} }));
-      r.useExtension("tenantTierResolver", "dummy");
+      r.useExtension("tenantTierResolver", "dummy", { build: async () => () => new Set() });
     });
     expect(() => validateBoot([self])).not.toThrow();
   });

package/src/engine/__tests__/tier-resolver-extension.test.ts

@@ -15,7 +15,7 @@ function tierResolverFeature(name: string) {
   return defineFeature(name, (r) => {
     r.extendsRegistrar(TENANT_TIER_RESOLVER_EXT, { onRegister: () => {} });
     r.entity("dummy", createEntity({ table: "Dummies", fields: {} }));
-    r.useExtension(TENANT_TIER_RESOLVER_EXT, "dummy");
+    r.useExtension(TENANT_TIER_RESOLVER_EXT, "dummy", { build: async () => () => new Set() });
   });
 }