@cosmicdrift/kumiko-framework 0.306.0 → 0.307.0

package/src/pipeline/__tests__/public-intake-runtime-gate.integration.test.ts

@@ -4,10 +4,11 @@
 import { afterAll, beforeAll, beforeEach, describe, expect, test } from "bun:test";
 import { z } from "zod";
 import type { SchemaTable } from "../../db";
+import type { DbRunner } from "../../db/connection";
 import { createEventStoreExecutor } from "../../db/event-store-executor";
-import { asRawClient, selectMany } from "../../db/query";
+import { asRawClient, runInSavepoint, selectMany } from "../../db/query";
 import { buildEntityTable } from "../../db/table-builder";
-import type { TenantDb } from "../../db/tenant-db";
+import { createTenantDb, type TenantDb } from "../../db/tenant-db";
 import { createEntity, createSystemUser, createTextField, defineFeature } from "../../engine";
 import { SYSTEM_ROLE } from "../../engine/system-user";
 import type { TenantId } from "../../engine/types";
@@ -273,6 +274,185 @@ const featureA = defineFeature("intakea", (r) => {
     },
     { access: { roles: ["anonymous", "Admin"] }, rateLimit: RATE_LIMIT },
   );
+
+  // (g) createTenantDb() built by the HANDLER ITSELF from ctx.db.unsafeRaw(reason) — the
+  // returned runner carries no TenantDb of its own, so without gate inheritance on the
+  // runner (tenant-db.ts's runnerPersonalDataGates) this fresh TenantDb would have no gate.
+  const UNSAFE_RAW_REASON =
+    "test: proves createTenantDb() built from ctx.db.unsafeRaw() inherits the caller's personal-data gate";
+
+  r.writeHandler(
+    "unsafe-raw-tenant-db-no-declare",
+    z.object({ note: z.string() }),
+    async (event, ctx) => {
+      const raw = ctx.db.unsafeRaw(UNSAFE_RAW_REASON);
+      await createTenantDb(raw, event.user.tenantId, "system").insertOne(
+        contactTable as unknown as SchemaTable,
+        { email: "leak-unsafe-raw@example.com", note: event.payload.note },
+      );
+      return { isSuccess: true as const, data: { ok: true as const } };
+    },
+    {
+      access: { roles: ["anonymous"] },
+      rateLimit: RATE_LIMIT,
+      escapeHatch: { reason: UNSAFE_RAW_REASON },
+    },
+  );
+
+  r.writeHandler(
+    "unsafe-raw-tenant-db-declare",
+    z.object({ note: z.string() }),
+    async (event, ctx) => {
+      const raw = ctx.db.unsafeRaw(UNSAFE_RAW_REASON);
+      await createTenantDb(raw, event.user.tenantId, "system").insertOne(
+        contactTable as unknown as SchemaTable,
+        { email: "leak-unsafe-raw-declared@example.com", note: event.payload.note },
+      );
+      return { isSuccess: true as const, data: { ok: true as const } };
+    },
+    {
+      access: { roles: ["anonymous"], personalData: "public-intake" },
+      rateLimit: RATE_LIMIT,
+      escapeHatch: { reason: UNSAFE_RAW_REASON },
+    },
+  );
+
+  // Nested tx: the handler already runs inside the request's own transaction, so its
+  // unsafeRaw runner is a tx handle (.savepoint, not .begin — see asRawClient's own
+  // comment). The savepoint-scoped tx a callback receives must inherit the same gate,
+  // otherwise a handler could dodge the gate by moving the write inside a savepoint.
+  r.writeHandler(
+    "unsafe-raw-savepoint-tenant-db-no-declare",
+    z.object({ note: z.string() }),
+    async (event, ctx) => {
+      const raw = ctx.db.unsafeRaw(UNSAFE_RAW_REASON);
+      await runInSavepoint(raw, async (sp) => {
+        await createTenantDb(sp as DbRunner, event.user.tenantId, "system").insertOne(
+          contactTable as unknown as SchemaTable,
+          { email: "leak-unsafe-raw-tx@example.com", note: event.payload.note },
+        );
+      });
+      return { isSuccess: true as const, data: { ok: true as const } };
+    },
+    {
+      access: { roles: ["anonymous"] },
+      rateLimit: RATE_LIMIT,
+      escapeHatch: { reason: UNSAFE_RAW_REASON },
+    },
+  );
+
+  r.writeHandler(
+    "unsafe-raw-savepoint-tenant-db-declare",
+    z.object({ note: z.string() }),
+    async (event, ctx) => {
+      const raw = ctx.db.unsafeRaw(UNSAFE_RAW_REASON);
+      await runInSavepoint(raw, async (sp) => {
+        await createTenantDb(sp as DbRunner, event.user.tenantId, "system").insertOne(
+          contactTable as unknown as SchemaTable,
+          { email: "leak-unsafe-raw-tx-declared@example.com", note: event.payload.note },
+        );
+      });
+      return { isSuccess: true as const, data: { ok: true as const } };
+    },
+    {
+      access: { roles: ["anonymous"], personalData: "public-intake" },
+      rateLimit: RATE_LIMIT,
+      escapeHatch: { reason: UNSAFE_RAW_REASON },
+    },
+  );
+
+  // Raw SQL through the gated proxy itself must stay ungated (decision: unsafeRaw's raw SQL
+  // is an escape hatch + audit trail, not something the personal-data gate blocks) — this
+  // just proves the proxy stays transparent for a direct tagged-template call.
+  r.writeHandler(
+    "unsafe-raw-tagged-query-declare",
+    z.object({ note: z.string() }),
+    async (event, ctx) => {
+      const raw = ctx.db.unsafeRaw(UNSAFE_RAW_REASON);
+      // @cast-boundary test-fixture — DbRunner's RawClient arm has no tagged-template call
+      // signature; the underlying driver instance (postgres-js/Bun.SQL) does.
+      const tagged = raw as unknown as (
+        strings: TemplateStringsArray,
+        ...values: unknown[]
+      ) => Promise<readonly Record<string, unknown>[]>;
+      const rows = await tagged`SELECT 1 AS one`;
+      if (rows[0]?.["one"] !== 1) throw new Error("tagged query through the proxy failed");
+      await createTenantDb(raw, event.user.tenantId, "system").insertOne(
+        contactTable as unknown as SchemaTable,
+        { email: "leak-unsafe-raw-tagged@example.com", note: event.payload.note },
+      );
+      return { isSuccess: true as const, data: { ok: true as const } };
+    },
+    {
+      access: { roles: ["anonymous"], personalData: "public-intake" },
+      rateLimit: RATE_LIMIT,
+      escapeHatch: { reason: UNSAFE_RAW_REASON },
+    },
+  );
+
+  // Authenticated session: same ctx.db.unsafeRaw() -> createTenantDb() path, but the root
+  // isn't anonymous, so ctx.db carries no personal-data gate to inherit — unaffected.
+  r.writeHandler(
+    "unsafe-raw-tenant-db-authenticated",
+    z.object({ note: z.string() }),
+    async (event, ctx) => {
+      const raw = ctx.db.unsafeRaw(UNSAFE_RAW_REASON);
+      await createTenantDb(raw, event.user.tenantId, "system").insertOne(
+        contactTable as unknown as SchemaTable,
+        { email: "leak-unsafe-raw-authenticated@example.com", note: event.payload.note },
+      );
+      return { isSuccess: true as const, data: { ok: true as const } };
+    },
+    { access: { roles: ["Admin"] }, escapeHatch: { reason: UNSAFE_RAW_REASON } },
+  );
+
+  // The CRUD executor writes through tenantDbRunner + assertPersonalDataWrite, not
+  // insertOne — a TenantDb inheriting its gate only from the runner (not from an explicit
+  // grants.personalDataGate) must gate the executor path too, not just direct insertOne.
+  r.writeHandler(
+    "unsafe-raw-executor-no-declare",
+    z.object({ note: z.string() }),
+    async (event, ctx) => {
+      const scopedDb = createTenantDb(
+        ctx.db.unsafeRaw(UNSAFE_RAW_REASON),
+        event.user.tenantId,
+        "system",
+      );
+      const crud = createEventStoreExecutor(contactTable, contactEntity, { entityName: "contact" });
+      return crud.create(
+        { email: "leak-unsafe-raw-executor@example.com", note: event.payload.note },
+        event.user,
+        scopedDb,
+      );
+    },
+    {
+      access: { roles: ["anonymous"] },
+      rateLimit: RATE_LIMIT,
+      escapeHatch: { reason: UNSAFE_RAW_REASON },
+    },
+  );
+
+  // Same inherited-gate TenantDb, but only a non-PII field — proves the proxy/executor
+  // combination still appends events and lets the projection run when there is nothing
+  // for the gate to block, not merely that it throws.
+  r.writeHandler(
+    "unsafe-raw-executor-non-pii-no-declare",
+    z.object({ note: z.string() }),
+    async (event, ctx) => {
+      const scopedDb = createTenantDb(
+        ctx.db.unsafeRaw(UNSAFE_RAW_REASON),
+        event.user.tenantId,
+        "system",
+      );
+      const crud = createEventStoreExecutor(probeTable, probeEntity, { entityName: "probe" });
+      return crud.create({ note: event.payload.note }, event.user, scopedDb);
+    },
+    {
+      access: { roles: ["anonymous"] },
+      rateLimit: RATE_LIMIT,
+      escapeHatch: { reason: UNSAFE_RAW_REASON },
+    },
+  );
 });
 
 describe("public-intake runtime gate", () => {
@@ -422,4 +602,83 @@ describe("public-intake runtime gate", () => {
     expect(res.status).toBe(200);
     expect(await rowCount()).toBe(1);
   });
+
+  test("(g) createTenantDb(ctx.db.unsafeRaw(reason), ...) — blocked without declaration", async () => {
+    const res = await stack.http.raw("POST", "/api/write", {
+      type: "intakea:write:unsafe-raw-tenant-db-no-declare",
+      payload: { note: "x" },
+    });
+    expect(res.status).toBe(403);
+    const body = (await res.json()) as { error: { details: { reason: string } } };
+    expect(body.error.details.reason).toBe("public_intake_required");
+    expect(await rowCount()).toBe(0);
+  });
+
+  test("(g) createTenantDb(ctx.db.unsafeRaw(reason), ...) — allowed once declared", async () => {
+    const res = await stack.http.raw("POST", "/api/write", {
+      type: "intakea:write:unsafe-raw-tenant-db-declare",
+      payload: { note: "x" },
+    });
+    expect(res.status).toBe(200);
+    expect(await rowCount()).toBe(1);
+  });
+
+  test("(g) createTenantDb(tx, ...) inside savepoint() — blocked without declaration", async () => {
+    const res = await stack.http.raw("POST", "/api/write", {
+      type: "intakea:write:unsafe-raw-savepoint-tenant-db-no-declare",
+      payload: { note: "x" },
+    });
+    expect(res.status).toBe(403);
+    const body = (await res.json()) as { error: { details: { reason: string } } };
+    expect(body.error.details.reason).toBe("public_intake_required");
+    expect(await rowCount()).toBe(0);
+  });
+
+  test("(g) createTenantDb(tx, ...) inside savepoint() — allowed once declared", async () => {
+    const res = await stack.http.raw("POST", "/api/write", {
+      type: "intakea:write:unsafe-raw-savepoint-tenant-db-declare",
+      payload: { note: "x" },
+    });
+    expect(res.status).toBe(200);
+    expect(await rowCount()).toBe(1);
+  });
+
+  test("(g) a tagged-template query through the gated unsafeRaw proxy still works", async () => {
+    const res = await stack.http.raw("POST", "/api/write", {
+      type: "intakea:write:unsafe-raw-tagged-query-declare",
+      payload: { note: "x" },
+    });
+    expect(res.status).toBe(200);
+    expect(await rowCount()).toBe(1);
+  });
+
+  test("(g) authenticated session on the same unsafeRaw->createTenantDb path — unaffected", async () => {
+    const res = await stack.http.write(
+      "intakea:write:unsafe-raw-tenant-db-authenticated",
+      { note: "x" },
+      TestUsers.admin,
+    );
+    expect(res.status).toBe(200);
+    expect(await rowCount()).toBe(1);
+  });
+
+  test("(g) createEventStoreExecutor.create through an inherited-gate TenantDb — blocked without declaration", async () => {
+    const res = await stack.http.raw("POST", "/api/write", {
+      type: "intakea:write:unsafe-raw-executor-no-declare",
+      payload: { note: "x" },
+    });
+    expect(res.status).toBe(403);
+    const body = (await res.json()) as { error: { details: { reason: string } } };
+    expect(body.error.details.reason).toBe("public_intake_required");
+    expect(await rowCount()).toBe(0);
+  });
+
+  test("(g) createEventStoreExecutor.create of a non-PII field through the same inherited-gate TenantDb — allowed", async () => {
+    const res = await stack.http.raw("POST", "/api/write", {
+      type: "intakea:write:unsafe-raw-executor-non-pii-no-declare",
+      payload: { note: "x" },
+    });
+    expect(res.status).toBe(200);
+    expect(await probeRowCount()).toBe(1);
+  });
 });

package/src/pipeline/dispatch-batch.ts

@@ -1,4 +1,5 @@
-import { requestContext } from "../api/request-context";
+import type { WriteOrigin } from "@cosmicdrift/kumiko-types/event-store-types";
+import { requestContext, runWithWriteOrigin } from "../api/request-context";
 import type { DbConnection } from "../db/connection";
 import { transaction } from "../db/query";
 import type { DeleteContext, SaveContext, SessionUser, WriteResult } from "../engine/types";
@@ -14,7 +15,20 @@ import {
   isLifecycleResult,
   wrapToKumiko,
 } from "./dispatcher-utils";
-import { rootWriteOrigin } from "./write-origin";
+import { effectiveWriteOrigin, isPersonalDataGated, rootWriteOrigin } from "./write-origin";
+
+// afterCommit hooks fire in flushAfterCommit, outside the command's scope.
+function rewrapHooksWithOrigin(
+  afterCommitHooks: AfterCommitHook[],
+  fromIndex: number,
+  origin: WriteOrigin,
+): void {
+  for (let i = fromIndex; i < afterCommitHooks.length; i++) {
+    const original = afterCommitHooks[i];
+    if (!original) continue;
+    afterCommitHooks[i] = () => runWithWriteOrigin(origin, original);
+  }
+}
 
 // Core batch logic extracted so write() and command() can reuse it
 // (a single write = batch of one, running in its own transaction).
@@ -23,15 +37,18 @@ export async function runBatch(
   commands: readonly BatchCommand[],
   user: SessionUser,
   requestId?: string,
+  inheritedOrigin?: WriteOrigin,
 ): Promise<BatchResult> {
   const current = requestContext.get();
   if (!current?.signal) {
-    return runBatchBody(ctx, commands, user, requestId);
+    return runBatchBody(ctx, commands, user, requestId, inheritedOrigin);
   }
   // Strip the signal: a disconnect would roll back the tx, idempotency would
   // cache a 500 for the uncommitted write and afterCommit effects would be lost.
   const { signal: _signal, ...withoutSignal } = current;
-  return requestContext.run(withoutSignal, () => runBatchBody(ctx, commands, user, requestId));
+  return requestContext.run(withoutSignal, () =>
+    runBatchBody(ctx, commands, user, requestId, inheritedOrigin),
+  );
 }
 
 async function runBatchBody(
@@ -39,6 +56,7 @@ async function runBatchBody(
   commands: readonly BatchCommand[],
   user: SessionUser,
   requestId?: string,
+  inheritedOrigin?: WriteOrigin,
 ): Promise<BatchResult> {
   const { idempotency, lifecycle, appContext: context } = ctx;
   if (commands.length === 0) {
@@ -109,10 +127,12 @@ async function runBatchBody(
     }
   };
 
+  const origins: WriteOrigin[] = [];
+
   // Fires the batch-level system hooks with every successful save/delete
   // context from this run. Called after flushAfterCommit so per-save hooks
   // have all completed first; errors are isolated inside lifecycleHooks.
-  const flushBatchHooks = async () => {
+  const flushBatchHooksInner = async () => {
     try {
       const saves: SaveContext[] = [];
       const deletes: DeleteContext[] = [];
@@ -133,6 +153,14 @@ async function runBatchBody(
     }
   };
 
+  // Batch hooks see every command's saves, so they run under the strictest origin.
+  const flushBatchHooks = async () => {
+    const strictest = origins.find(isPersonalDataGated) ?? origins[0];
+    // skip: no command ran, so batch hooks have no saves or deletes to see
+    if (!strictest) return;
+    await runWithWriteOrigin(strictest, flushBatchHooksInner);
+  };
+
   // batch() opens its own outer transaction — needs the top-level
   // connection's `.begin()` (TransactionSql exposes only `.savepoint()`).
   const db = resolveDbSource(ctx, undefined) as DbConnection | undefined;
@@ -143,15 +171,16 @@ async function runBatchBody(
     for (let i = 0; i < commands.length; i++) {
       const cmd = commands[i];
       if (!cmd) continue;
-      const res = await executeNestedWrite(
-        ctx,
-        cmd.type,
-        cmd.payload,
-        user,
+      const origin = effectiveWriteOrigin(
         rootWriteOrigin(ctx.registry, cmd.type, user),
-        undefined,
-        afterCommitHooks,
+        inheritedOrigin,
       );
+      origins.push(origin);
+      const hookStart = afterCommitHooks.length;
+      const res = await runWithWriteOrigin(origin, () =>
+        executeNestedWrite(ctx, cmd.type, cmd.payload, user, origin, undefined, afterCommitHooks),
+      );
+      rewrapHooksWithOrigin(afterCommitHooks, hookStart, origin);
       results.push(res);
       if (!res.isSuccess) {
         // No tx means no rollback — but we still drop afterCommit hooks,
@@ -170,15 +199,16 @@ async function runBatchBody(
       for (let i = 0; i < commands.length; i++) {
         const cmd = commands[i];
         if (!cmd) continue;
-        const res = await executeNestedWrite(
-          ctx,
-          cmd.type,
-          cmd.payload,
-          user,
+        const origin = effectiveWriteOrigin(
           rootWriteOrigin(ctx.registry, cmd.type, user),
-          tx,
-          afterCommitHooks,
+          inheritedOrigin,
+        );
+        origins.push(origin);
+        const hookStart = afterCommitHooks.length;
+        const res = await runWithWriteOrigin(origin, () =>
+          executeNestedWrite(ctx, cmd.type, cmd.payload, user, origin, tx, afterCommitHooks),
         );
+        rewrapHooksWithOrigin(afterCommitHooks, hookStart, origin);
         results.push(res);
         if (!res.isSuccess) {
           throw new BatchRollback(i, res.error);

package/src/pipeline/dispatch-stream.ts

@@ -74,9 +74,13 @@ async function* executeStreamInner(
   const invalidated = new Promise<void>((resolve) => {
     resolveInvalidated = resolve;
   });
-  const unsubscribeAccessInvalidation = ctx.sseBroker?.subscribeAccessInvalidation(user.id, () => {
-    resolveInvalidated?.();
-  });
+  const unsubscribeAccessInvalidation = ctx.sseBroker?.subscribeAccessInvalidation(
+    user.id,
+    () => {
+      resolveInvalidated?.();
+    },
+    user.sid,
+  );
 
   let iterator: AsyncIterator<unknown> | undefined;
   // When access is revoked mid-pull, `iterator.next()` is still in flight.

package/src/pipeline/dispatcher-utils.ts

@@ -6,7 +6,14 @@ import type {
   SessionUser,
   WriteResult,
 } from "../engine/types";
-import { type FieldIssue, toKumikoError, type WriteErrorInfo } from "../errors";
+import {
+  type FieldIssue,
+  type KumikoError,
+  toKumikoError,
+  VersionConflictError,
+  type WriteErrorInfo,
+} from "../errors";
+import { VersionConflictError as EventStoreVersionConflictError } from "../event-store/errors";
 
 export type FailedWriteResult = Extract<WriteResult, { isSuccess: false }>;
 
@@ -177,4 +184,16 @@ export function resolveType(type: HandlerType): string {
   return typeof type === "string" ? type : type.name;
 }
 
-export const wrapToKumiko = toKumikoError;
+// A custom write losing an append race (ctx.appendEvent, stream.append) is a
+// retryable 409 like the CRUD executor's, not an internal error. Mapped here
+// because errors/ is client code and must not import the event store.
+// currentVersion -1 is the executor's "not looked up" sentinel.
+export function wrapToKumiko(e: unknown): KumikoError {
+  if (e instanceof EventStoreVersionConflictError) {
+    return new VersionConflictError(
+      { entityId: e.aggregateId, expectedVersion: e.expectedVersion, currentVersion: -1 },
+      { cause: e },
+    );
+  }
+  return toKumikoError(e);
+}

package/src/pipeline/dispatcher.ts

@@ -1,3 +1,5 @@
+import type { WriteOrigin } from "@cosmicdrift/kumiko-types/event-store-types";
+import { runWithWriteOrigin } from "../api/request-context";
 import type { SseBroker } from "../api/sse-broker";
 import type { buildEntityTable } from "../db/table-builder";
 import {
@@ -18,7 +20,7 @@ import type {
   WriteResult,
 } from "../engine/types";
 import type { TenantId } from "../engine/types/identifiers";
-import { reraiseAsKumikoError } from "../errors";
+import { InternalError, reraiseAsKumikoError } from "../errors";
 import { getFallbackMeter, getFallbackTracer, registerStandardMetrics } from "../observability";
 import { createEscapeHatchReportWindow } from "../observability/escape-hatch-report";
 import { INTERACTIVE_SIGN_IN_POLICY, resolveActiveMembershipFn } from "./active-membership";
@@ -32,7 +34,7 @@ import type { IdempotencyGuard } from "./idempotency";
 import type { LifecycleHooks } from "./lifecycle-pipeline";
 import { createMemberReaderFn } from "./member-reader";
 import { createTenantTimezoneCache } from "./tenant-timezone-cache";
-import { rootWriteOrigin } from "./write-origin";
+import { effectiveWriteOrigin, isPersonalDataGated, rootWriteOrigin } from "./write-origin";
 
 // Re-export for callers that reach for dispatcher-adjacent types (tests,
 // HTTP-layer stubs) — dispatch consumes these, grouping the type-surface
@@ -111,12 +113,55 @@ export type Dispatcher = {
   createMemberReader(tenantId: TenantId): MemberReader;
 };
 
+// Kept off the public Dispatcher type: only a job may pass an inherited origin.
+type DispatcherInternals = {
+  writeWithOrigin: (
+    type: string,
+    payload: unknown,
+    user: SessionUser,
+    inheritedOrigin: WriteOrigin,
+  ) => Promise<WriteResult>;
+  queryWithOrigin: (
+    type: string,
+    payload: unknown,
+    user: SessionUser,
+    inheritedOrigin: WriteOrigin,
+  ) => Promise<unknown>;
+};
+
+const dispatcherInternals = new WeakMap<Dispatcher, DispatcherInternals>();
+
 // Adapts Dispatcher's (type, payload, user) call shape to DispatchWriteRef's
 // (user, qn, payload) — JobRunner.attachDispatcher needs the latter.
 export function dispatcherToWriteRef(dispatcher: Dispatcher): DispatchWriteRef {
+  const internals = dispatcherInternals.get(dispatcher);
   return {
-    write: (user, qn, payload) => dispatcher.write(qn, payload, user),
-    queryAs: (user, qn, payload) => dispatcher.query(qn, payload, user),
+    write: (user, qn, payload, inheritedOrigin) => {
+      if (inheritedOrigin && isPersonalDataGated(inheritedOrigin)) {
+        if (!internals) {
+          throw new InternalError({
+            message:
+              `JobContext.write("${qn}") carries a gated origin but this dispatcher has no ` +
+              "registered origin-aware internals — refusing to fall open to the ungated path.",
+          });
+        }
+        return internals.writeWithOrigin(qn, payload, user, inheritedOrigin);
+      }
+      return dispatcher.write(qn, payload, user);
+    },
+    queryAs: (user, qn, payload, inheritedOrigin) => {
+      if (inheritedOrigin && isPersonalDataGated(inheritedOrigin)) {
+        if (!internals) {
+          throw new InternalError({
+            message:
+              `JobContext.queryAs("${qn}") carries a gated origin but this dispatcher has no ` +
+              "registered origin-aware internals — refusing to fall open to the ungated path.",
+          });
+        }
+        return internals.queryWithOrigin(qn, payload, user, inheritedOrigin);
+      }
+      return dispatcher.query(qn, payload, user);
+    },
     createMemberReader: (tenantId) => dispatcher.createMemberReader(tenantId),
   };
 }
@@ -173,7 +218,7 @@ export function createDispatcher(
     membershipQuery,
   };
 
-  return {
+  const dispatcher: Dispatcher = {
     async write(typeOrRef, payload, user, requestId?) {
       const type = resolveType(typeOrRef);
       // Idempotency handled inside runBatch (caches BatchResult under requestId).
@@ -185,7 +230,8 @@ export function createDispatcher(
 
     query: (typeOrRef, payload, user) => {
       const type = resolveType(typeOrRef);
-      return executeQuery(ctx, type, payload, user, rootWriteOrigin(registry, type, user));
+      const origin = rootWriteOrigin(registry, type, user);
+      return runWithWriteOrigin(origin, () => executeQuery(ctx, type, payload, user, origin));
     },
 
     stream: (typeOrRef, payload, user) => {
@@ -210,4 +256,23 @@ export function createDispatcher(
 
     createMemberReader: (tenantId) => createMemberReaderFn(ctx, tenantId),
   };
+
+  dispatcherInternals.set(dispatcher, {
+    writeWithOrigin: async (type, payload, user, inheritedOrigin) => {
+      const batchResult = await runBatch(
+        ctx,
+        [{ type, payload }],
+        user,
+        undefined,
+        inheritedOrigin,
+      );
+      return unwrapSingle(batchResult);
+    },
+    queryWithOrigin: (type, payload, user, inheritedOrigin) => {
+      const origin = effectiveWriteOrigin(rootWriteOrigin(registry, type, user), inheritedOrigin);
+      return runWithWriteOrigin(origin, () => executeQuery(ctx, type, payload, user, origin));
+    },
+  });
+
+  return dispatcher;
 }

package/src/pipeline/event-consumer-state.ts

@@ -5,6 +5,7 @@ import {
   index,
   instant,
   integer,
+  jsonb,
   table as pgTable,
   primaryKey,
   sql,
@@ -64,6 +65,21 @@ export const SHARED_INSTANCE_SENTINEL = "__shared__";
 // The default(sql`0`) on lastProcessedEventId mirrors projection-state.ts:
 // drizzle-kit's JSON snapshot generator can't serialise a bigint literal, so
 // the server-side default is specified as raw SQL instead of .default(0n).
+
+// A contiguous run of ids below the cursor invisible on some earlier turn,
+// not yet resolved (delivered) or proven burnt (see event-dispatcher.ts's
+// processConsumer). Ranges, not individual ids — a large historical gap
+// (retention prune, or a new consumer starting "beginning" over pruned
+// history) then costs O(1) entries instead of one per missing id. xmax is
+// the pg_snapshot_xmax() captured when the range was recorded: once a later
+// turn's xmin passes it, every xact that could still produce a row in this
+// range has finished, so it's provably rolled back, not just slow.
+// bigint/xid8 travel as strings — JS bigint doesn't round-trip through jsonb.
+export type PendingGapEntry = {
+  readonly from: string;
+  readonly to: string;
+  readonly xmax: string;
+};
 export const eventConsumerStateTable = pgTable(
   "kumiko_event_consumers",
   {
@@ -82,6 +98,7 @@ export const eventConsumerStateTable = pgTable(
     // poisoned), as does a manual restartConsumer()/enableConsumer()/
     // skipPoisonEvent() — an operator vouching the consumer is healthy.
     rearmCount: integer("rearm_count").notNull().default(0),
+    pendingGaps: jsonb("pending_gaps").$type<PendingGapEntry[]>().default([]).notNull(),
     lastError: text("last_error"),
     updatedAt: instant("updated_at", { precision: 3 }).notNull().default(sql`now()`),
   },
@@ -142,6 +159,15 @@ export async function createEventConsumerStateTable(db: DbConnection): Promise<v
       " NOT NULL",
       /* ifNotExists */ true,
     );
+    await alterTableAddColumn(
+      db,
+      "kumiko_event_consumers",
+      "pending_gaps",
+      "jsonb",
+      " DEFAULT '[]'::jsonb",
+      " NOT NULL",
+      /* ifNotExists */ true,
+    );
     // Runs on every boot, including mid-rolling-deploy: a new pod can delete
     // an old pod's still-in-use per-instance row out from under it. That old
     // pod's next acquireConsumer then finds no row, delivers no more SSE/