@feltdb/core 0.8.1 → 0.8.3

package/dist/create/server-source/crates/feltdb-server/src/main.rs

@@ -96,7 +96,7 @@ use feltdb_server::{
         ScalingPolicy, SecretReference as DeploymentSecretReference,
     },
     sessions::SessionVerifier,
-    tenancy::{MembershipStatus, TenancyStore},
+    tenancy::{MembershipStatus, QualificationMarker, TenancyStore},
 };
 use serde::{Deserialize, Serialize};
 use serde_json::{json, Map, Value};
@@ -151,11 +151,15 @@ fn api_error_body(status: StatusCode, message: String) -> Value {
     let object = body
         .as_object_mut()
         .expect("normalized error body is an object");
-    let resolved_code = object
-        .get("code")
-        .and_then(Value::as_str)
-        .unwrap_or(code)
-        .to_string();
+    let resolved_code = if status == StatusCode::FORBIDDEN {
+        code.to_string()
+    } else {
+        object
+            .get("code")
+            .and_then(Value::as_str)
+            .unwrap_or(code)
+            .to_string()
+    };
     object.insert("error".into(), json!(resolved_code));
     object.insert("code".into(), json!(resolved_code));
     object.entry("message").or_insert_with(|| {
@@ -230,8 +234,15 @@ struct CreateTenantRequest {
 #[derive(Deserialize)]
 struct CreateApplicationRequest {
     name: String,
+    #[serde(default)]
+    qualification: Option<QualificationMarker>,
 }
 #[derive(Deserialize)]
+struct QualificationDestroyRequest {
+    proof_run_id: String,
+}
+#[derive(Deserialize)]
+#[serde(deny_unknown_fields)]
 struct UpdateApplicationRequest {
     name: String,
 }
@@ -2348,7 +2359,12 @@ async fn create_application_control(
 ) -> Result<(StatusCode, Json<Value>), ApiError> {
     let app = state
         .tenancy
-        .create_application(&principal.key_id, &tenant_id, &input.name)
+        .create_application_with_qualification(
+            &principal.key_id,
+            &tenant_id,
+            &input.name,
+            input.qualification,
+        )
         .map_err(control_error)?;
     Ok((StatusCode::CREATED, Json(json!(app))))
 }
@@ -2378,6 +2394,23 @@ async fn delete_application_control(
     Ok(StatusCode::NO_CONTENT)
 }
 
+async fn delete_qualification_application_control(
+    State(state): State<AppState>,
+    Extension(principal): Extension<Principal>,
+    Path(application_id): Path<String>,
+    Json(input): Json<QualificationDestroyRequest>,
+) -> Result<StatusCode, ApiError> {
+    state
+        .tenancy
+        .delete_qualification_application(&principal.key_id, &application_id, &input.proof_run_id)
+        .map_err(control_error)?;
+    state
+        .applications
+        .purge_application(&application_id)
+        .map_err(control_error)?;
+    Ok(StatusCode::NO_CONTENT)
+}
+
 async fn delete_certification_fixture(
     State(state): State<AppState>,
     Path(application_id): Path<String>,
@@ -5083,52 +5116,292 @@ const INTENT_COLLECTION: &str = "_feltdb_intents";
 const INTENT_EVENT_COLLECTION: &str = "_feltdb_intent_events";
 
 fn require_intent_service(headers: &HeaderMap) -> Result<(), ApiError> {
-    let expected = std::env::var("FELTDB_INTENT_SERVICE_SECRET").map_err(|_| inspection_error(StatusCode::SERVICE_UNAVAILABLE, "intent_service_unconfigured", "Intent Engine service authentication is not configured"))?;
-    let supplied = headers.get("x-feltdb-intent-service").and_then(|value| value.to_str().ok()).unwrap_or_default();
+    let expected = std::env::var("FELTDB_INTENT_SERVICE_SECRET").map_err(|_| {
+        inspection_error(
+            StatusCode::SERVICE_UNAVAILABLE,
+            "intent_service_unconfigured",
+            "Intent Engine service authentication is not configured",
+        )
+    })?;
+    let supplied = headers
+        .get("x-feltdb-intent-service")
+        .and_then(|value| value.to_str().ok())
+        .unwrap_or_default();
     if Sha256::digest(supplied.as_bytes()) != Sha256::digest(expected.as_bytes()) {
-        return Err(inspection_error(StatusCode::FORBIDDEN, "forbidden", "invalid Intent Engine service credential"));
+        return Err(inspection_error(
+            StatusCode::FORBIDDEN,
+            "forbidden",
+            "invalid Intent Engine service credential",
+        ));
     }
     Ok(())
 }
 
 async fn execute_intent(
-    State(state): State<AppState>, Extension(principal): Extension<Principal>, headers: HeaderMap,
+    State(state): State<AppState>,
+    Extension(principal): Extension<Principal>,
+    headers: HeaderMap,
     Json(input): Json<ExecuteIntentRequest>,
 ) -> Result<Json<Value>, ApiError> {
-    application_scope(&state, &principal.key_id, &input.application_id, "application:write")?;
-    if input.request.trim().is_empty() { return Err(inspection_error(StatusCode::BAD_REQUEST, "invalid_intent", "request is required")); }
-    let endpoint = std::env::var("FELTDB_INTENT_ENGINE_URL").map_err(|_| inspection_error(StatusCode::SERVICE_UNAVAILABLE, "intent_engine_unavailable", "managed Intent Engine is not configured"))?;
-    let secret = std::env::var("FELTDB_INTENT_SERVICE_SECRET").map_err(|_| inspection_error(StatusCode::SERVICE_UNAVAILABLE, "intent_engine_unavailable", "managed Intent Engine authentication is not configured"))?;
-    let mut request = state.peer_client.post(format!("{}/internal/v1/intents", endpoint.trim_end_matches('/'))).header("x-feltdb-intent-service", secret).json(&input);
-    if let Some(value) = headers.get("idempotency-key") { request = request.header("idempotency-key", value); }
-    let response = request.send().await.map_err(|error| inspection_error(StatusCode::BAD_GATEWAY, "intent_engine_unavailable", error.to_string()))?;
-    let status = response.status(); let value: Value = response.json().await.map_err(|error| inspection_error(StatusCode::BAD_GATEWAY, "invalid_intent_engine_response", error.to_string()))?;
-    if !status.is_success() { let republish=value.get("error").and_then(Value::as_str)==Some("APPLICATION_REPUBLISH_REQUIRED");return Err(inspection_error(if republish {StatusCode::CONFLICT}else{StatusCode::BAD_GATEWAY},if republish{"application_republish_required"}else{"intent_execution_failed"},value.get("message").and_then(Value::as_str).unwrap_or("Intent Engine failed"))); }
+    application_scope(
+        &state,
+        &principal.key_id,
+        &input.application_id,
+        "application:write",
+    )?;
+    if input.request.trim().is_empty() {
+        return Err(inspection_error(
+            StatusCode::BAD_REQUEST,
+            "invalid_intent",
+            "request is required",
+        ));
+    }
+    let endpoint = std::env::var("FELTDB_INTENT_ENGINE_URL").map_err(|_| {
+        inspection_error(
+            StatusCode::SERVICE_UNAVAILABLE,
+            "intent_engine_unavailable",
+            "managed Intent Engine is not configured",
+        )
+    })?;
+    let secret = std::env::var("FELTDB_INTENT_SERVICE_SECRET").map_err(|_| {
+        inspection_error(
+            StatusCode::SERVICE_UNAVAILABLE,
+            "intent_engine_unavailable",
+            "managed Intent Engine authentication is not configured",
+        )
+    })?;
+    let mut request = state
+        .peer_client
+        .post(format!(
+            "{}/internal/v1/intents",
+            endpoint.trim_end_matches('/')
+        ))
+        .header("x-feltdb-intent-service", secret)
+        .json(&input);
+    if let Some(value) = headers.get("idempotency-key") {
+        request = request.header("idempotency-key", value);
+    }
+    let response = request.send().await.map_err(|error| {
+        inspection_error(
+            StatusCode::BAD_GATEWAY,
+            "intent_engine_unavailable",
+            error.to_string(),
+        )
+    })?;
+    let status = response.status();
+    let value: Value = response.json().await.map_err(|error| {
+        inspection_error(
+            StatusCode::BAD_GATEWAY,
+            "invalid_intent_engine_response",
+            error.to_string(),
+        )
+    })?;
+    if !status.is_success() {
+        let republish =
+            value.get("error").and_then(Value::as_str) == Some("APPLICATION_REPUBLISH_REQUIRED");
+        return Err(inspection_error(
+            if republish {
+                StatusCode::CONFLICT
+            } else {
+                StatusCode::BAD_GATEWAY
+            },
+            if republish {
+                "application_republish_required"
+            } else {
+                "intent_execution_failed"
+            },
+            value
+                .get("message")
+                .and_then(Value::as_str)
+                .unwrap_or("Intent Engine failed"),
+        ));
+    }
     Ok(Json(value))
 }
 
-async fn list_intents(State(state): State<AppState>, Extension(principal): Extension<Principal>, Query(input): Query<ProposalScopeRequest>) -> Result<Json<Value>, ApiError> {
-    application_scope(&state,&principal.key_id,&input.application_id,"application:read")?;
-    let mut intents=state.db.list_collection(INTENT_COLLECTION)?.into_iter().map(|row|row.value).filter(|value|proposal_scope_matches(value,&input.application_id,&input.environment)).collect::<Vec<_>>();
-    intents.sort_by(|a,b|a.get("created_at").and_then(Value::as_str).cmp(&b.get("created_at").and_then(Value::as_str)));for value in &mut intents{if let Some(object)=value.as_object_mut(){object.remove("execution_result");}redact_inspection_value(value);}Ok(Json(json!({"intents":intents})))
+async fn list_intents(
+    State(state): State<AppState>,
+    Extension(principal): Extension<Principal>,
+    Query(input): Query<ProposalScopeRequest>,
+) -> Result<Json<Value>, ApiError> {
+    application_scope(
+        &state,
+        &principal.key_id,
+        &input.application_id,
+        "application:read",
+    )?;
+    let mut intents = state
+        .db
+        .list_collection(INTENT_COLLECTION)?
+        .into_iter()
+        .map(|row| row.value)
+        .filter(|value| proposal_scope_matches(value, &input.application_id, &input.environment))
+        .collect::<Vec<_>>();
+    intents.sort_by(|a, b| {
+        a.get("created_at")
+            .and_then(Value::as_str)
+            .cmp(&b.get("created_at").and_then(Value::as_str))
+    });
+    for value in &mut intents {
+        if let Some(object) = value.as_object_mut() {
+            object.remove("execution_result");
+        }
+        redact_inspection_value(value);
+    }
+    Ok(Json(json!({"intents":intents})))
+}
+async fn get_intent(
+    State(state): State<AppState>,
+    Extension(principal): Extension<Principal>,
+    Path((id, operation)): Path<(String, String)>,
+    Query(input): Query<ProposalScopeRequest>,
+) -> Result<Json<Value>, ApiError> {
+    application_scope(
+        &state,
+        &principal.key_id,
+        &input.application_id,
+        "application:read",
+    )?;
+    let intent = required_value(&state, INTENT_COLLECTION, &id, "intent not found")?;
+    if !proposal_scope_matches(&intent, &input.application_id, &input.environment) {
+        return Err(ApiError(StatusCode::NOT_FOUND, "intent not found".into()));
+    }
+    let value = match operation.as_str() {
+        "understanding" => intent.get("understanding").cloned().unwrap_or(Value::Null),
+        "plan" => intent.get("plan").cloned().unwrap_or(Value::Null),
+        "proposal" => intent
+            .get("proposal_id")
+            .and_then(Value::as_str)
+            .map(|id| proposal_value(&state, id))
+            .transpose()?
+            .unwrap_or(Value::Null),
+        "history" => {
+            let mut events = state
+                .db
+                .list_collection(INTENT_EVENT_COLLECTION)?
+                .into_iter()
+                .map(|row| row.value)
+                .filter(|value| value.get("intent_id").and_then(Value::as_str) == Some(id.as_str()))
+                .collect::<Vec<_>>();
+            events.sort_by(|a, b| {
+                a.get("created_at")
+                    .and_then(Value::as_str)
+                    .cmp(&b.get("created_at").and_then(Value::as_str))
+            });
+            json!({"events":events})
+        }
+        _ => {
+            return Err(ApiError(
+                StatusCode::NOT_FOUND,
+                "intent resource not found".into(),
+            ))
+        }
+    };
+    Ok(Json(value))
 }
-async fn get_intent(State(state): State<AppState>, Extension(principal): Extension<Principal>, Path((id,operation)): Path<(String,String)>, Query(input): Query<ProposalScopeRequest>) -> Result<Json<Value>,ApiError>{
-    application_scope(&state,&principal.key_id,&input.application_id,"application:read")?;let intent=required_value(&state,INTENT_COLLECTION,&id,"intent not found")?;if !proposal_scope_matches(&intent,&input.application_id,&input.environment){return Err(ApiError(StatusCode::NOT_FOUND,"intent not found".into()));}
-    let value=match operation.as_str(){"understanding"=>intent.get("understanding").cloned().unwrap_or(Value::Null),"plan"=>intent.get("plan").cloned().unwrap_or(Value::Null),"proposal"=>intent.get("proposal_id").and_then(Value::as_str).map(|id|proposal_value(&state,id)).transpose()?.unwrap_or(Value::Null),"history"=>{let mut events=state.db.list_collection(INTENT_EVENT_COLLECTION)?.into_iter().map(|row|row.value).filter(|value|value.get("intent_id").and_then(Value::as_str)==Some(id.as_str())).collect::<Vec<_>>();events.sort_by(|a,b|a.get("created_at").and_then(Value::as_str).cmp(&b.get("created_at").and_then(Value::as_str)));json!({"events":events})},_=>return Err(ApiError(StatusCode::NOT_FOUND,"intent resource not found".into()))};Ok(Json(value))
+async fn get_intent_root(
+    State(state): State<AppState>,
+    Extension(principal): Extension<Principal>,
+    Path(id): Path<String>,
+    Query(input): Query<ProposalScopeRequest>,
+) -> Result<Json<Value>, ApiError> {
+    application_scope(
+        &state,
+        &principal.key_id,
+        &input.application_id,
+        "application:read",
+    )?;
+    let mut value = required_value(&state, INTENT_COLLECTION, &id, "intent not found")?;
+    if !proposal_scope_matches(&value, &input.application_id, &input.environment) {
+        return Err(ApiError(StatusCode::NOT_FOUND, "intent not found".into()));
+    }
+    if let Some(object) = value.as_object_mut() {
+        object.remove("execution_result");
+    }
+    Ok(Json(value))
+}
+async fn internal_find_intent(
+    State(state): State<AppState>,
+    headers: HeaderMap,
+    Query(input): Query<IntentHashRequest>,
+) -> Result<Json<Value>, ApiError> {
+    require_intent_service(&headers)?;
+    let value = state
+        .db
+        .list_collection(INTENT_COLLECTION)?
+        .into_iter()
+        .map(|row| row.value)
+        .find(|value| {
+            proposal_scope_matches(value, &input.application_id, &input.environment)
+                && value.get("intent_hash").and_then(Value::as_str)
+                    == Some(input.intent_hash.as_str())
+        })
+        .unwrap_or(Value::Null);
+    Ok(Json(value))
+}
+async fn internal_create_intent(
+    State(state): State<AppState>,
+    headers: HeaderMap,
+    Json(value): Json<Value>,
+) -> Result<(StatusCode, Json<Value>), ApiError> {
+    require_intent_service(&headers)?;
+    let id = value.get("id").and_then(Value::as_str).ok_or_else(|| {
+        inspection_error(
+            StatusCode::BAD_REQUEST,
+            "invalid_intent",
+            "intent id is required",
+        )
+    })?;
+    insert_canonical(&state, INTENT_COLLECTION, id, value.clone())?;
+    Ok((StatusCode::CREATED, Json(value)))
+}
+async fn internal_replace_intent(
+    State(state): State<AppState>,
+    headers: HeaderMap,
+    Path(id): Path<String>,
+    Json(value): Json<Value>,
+) -> Result<Json<Value>, ApiError> {
+    require_intent_service(&headers)?;
+    let _ = put_canonical(&state, INTENT_COLLECTION, &id, value.clone())?;
+    Ok(Json(value))
+}
+async fn internal_create_intent_event(
+    State(state): State<AppState>,
+    headers: HeaderMap,
+    Json(value): Json<Value>,
+) -> Result<(StatusCode, Json<Value>), ApiError> {
+    require_intent_service(&headers)?;
+    let id = value.get("id").and_then(Value::as_str).ok_or_else(|| {
+        inspection_error(
+            StatusCode::BAD_REQUEST,
+            "invalid_intent_event",
+            "event id is required",
+        )
+    })?;
+    insert_canonical(&state, INTENT_EVENT_COLLECTION, id, value.clone())?;
+    Ok((StatusCode::CREATED, Json(value)))
 }
-async fn get_intent_root(State(state): State<AppState>, Extension(principal): Extension<Principal>, Path(id):Path<String>, Query(input):Query<ProposalScopeRequest>)->Result<Json<Value>,ApiError>{application_scope(&state,&principal.key_id,&input.application_id,"application:read")?;let mut value=required_value(&state,INTENT_COLLECTION,&id,"intent not found")?;if !proposal_scope_matches(&value,&input.application_id,&input.environment){return Err(ApiError(StatusCode::NOT_FOUND,"intent not found".into()));}if let Some(object)=value.as_object_mut(){object.remove("execution_result");}Ok(Json(value))}
-async fn internal_find_intent(State(state):State<AppState>,headers:HeaderMap,Query(input):Query<IntentHashRequest>)->Result<Json<Value>,ApiError>{require_intent_service(&headers)?;let value=state.db.list_collection(INTENT_COLLECTION)?.into_iter().map(|row|row.value).find(|value|proposal_scope_matches(value,&input.application_id,&input.environment)&&value.get("intent_hash").and_then(Value::as_str)==Some(input.intent_hash.as_str())).unwrap_or(Value::Null);Ok(Json(value))}
-async fn internal_create_intent(State(state):State<AppState>,headers:HeaderMap,Json(value):Json<Value>)->Result<(StatusCode,Json<Value>),ApiError>{require_intent_service(&headers)?;let id=value.get("id").and_then(Value::as_str).ok_or_else(||inspection_error(StatusCode::BAD_REQUEST,"invalid_intent","intent id is required"))?;insert_canonical(&state,INTENT_COLLECTION,id,value.clone())?;Ok((StatusCode::CREATED,Json(value)))}
-async fn internal_replace_intent(State(state):State<AppState>,headers:HeaderMap,Path(id):Path<String>,Json(value):Json<Value>)->Result<Json<Value>,ApiError>{require_intent_service(&headers)?;let _=put_canonical(&state,INTENT_COLLECTION,&id,value.clone())?;Ok(Json(value))}
-async fn internal_create_intent_event(State(state):State<AppState>,headers:HeaderMap,Json(value):Json<Value>)->Result<(StatusCode,Json<Value>),ApiError>{require_intent_service(&headers)?;let id=value.get("id").and_then(Value::as_str).ok_or_else(||inspection_error(StatusCode::BAD_REQUEST,"invalid_intent_event","event id is required"))?;insert_canonical(&state,INTENT_EVENT_COLLECTION,id,value.clone())?;Ok((StatusCode::CREATED,Json(value)))}
 
-fn proposal_contract_snapshot(
-    revision: &ApplicationRevision,
-    environment: &str,
-) -> Value {
-    let contract_hash = revision.manifest.metadata.labels.get("feltdb.contract_hash").unwrap_or(&revision.manifest_hash);
-    let flow_hash = revision.manifest.metadata.labels.get("feltdb.flow_hash").cloned();
-    let dsl_version = revision.manifest.metadata.labels.get("feltdb.dsl_version").and_then(|value| value.parse::<u32>().ok()).unwrap_or(1);
+fn proposal_contract_snapshot(revision: &ApplicationRevision, environment: &str) -> Value {
+    let contract_hash = revision
+        .manifest
+        .metadata
+        .labels
+        .get("feltdb.contract_hash")
+        .unwrap_or(&revision.manifest_hash);
+    let flow_hash = revision
+        .manifest
+        .metadata
+        .labels
+        .get("feltdb.flow_hash")
+        .cloned();
+    let dsl_version = revision
+        .manifest
+        .metadata
+        .labels
+        .get("feltdb.dsl_version")
+        .and_then(|value| value.parse::<u32>().ok())
+        .unwrap_or(1);
     json!({
         "application":{"application_id":revision.application_id,"environment":environment},
         "contract_version":revision.revision_number,"contract_hash":contract_hash,"flow_hash":flow_hash,
@@ -5140,11 +5413,18 @@ fn proposal_contract_snapshot(
 }
 
 fn proposal_hash(value: &Value) -> String {
-    format!("sha256:{:x}", Sha256::digest(serde_json::to_vec(value).unwrap_or_default()))
+    format!(
+        "sha256:{:x}",
+        Sha256::digest(serde_json::to_vec(value).unwrap_or_default())
+    )
 }
 
 fn preview_ttl_seconds() -> i64 {
-    std::env::var("FELTDB_PROPOSAL_PREVIEW_TTL_SECONDS").ok().and_then(|value| value.parse().ok()).map(|value: i64| value.clamp(1, 86_400)).unwrap_or(3_600)
+    std::env::var("FELTDB_PROPOSAL_PREVIEW_TTL_SECONDS")
+        .ok()
+        .and_then(|value| value.parse().ok())
+        .map(|value: i64| value.clamp(1, 86_400))
+        .unwrap_or(3_600)
 }
 
 fn preview_artifact(state: &AppState, id: &str) -> Result<Value, ApiError> {
@@ -5153,7 +5433,10 @@ fn preview_artifact(state: &AppState, id: &str) -> Result<Value, ApiError> {
 
 fn preview_available(value: &Value) -> bool {
     value.get("status").and_then(Value::as_str) == Some("ready")
-        && value.get("expires_at").and_then(Value::as_i64).is_some_and(|expires| expires > unix_seconds_i64())
+        && value
+            .get("expires_at")
+            .and_then(Value::as_i64)
+            .is_some_and(|expires| expires > unix_seconds_i64())
 }
 
 fn proposal_event(
@@ -5190,15 +5473,33 @@ async fn create_proposal(
     Json(input): Json<CreateProposalRequest>,
 ) -> Result<(StatusCode, Json<Value>), ApiError> {
     if input.status.is_some() {
-        return Err(inspection_error(StatusCode::BAD_REQUEST, "invalid_proposal", "proposal lifecycle state is server-controlled"));
+        return Err(inspection_error(
+            StatusCode::BAD_REQUEST,
+            "invalid_proposal",
+            "proposal lifecycle state is server-controlled",
+        ));
     }
     if input.proposal_version.unwrap_or(1) != 1 {
-        return Err(inspection_error(StatusCode::UNPROCESSABLE_ENTITY, "invalid_proposal", "proposal_version must be 1"));
+        return Err(inspection_error(
+            StatusCode::UNPROCESSABLE_ENTITY,
+            "invalid_proposal",
+            "proposal_version must be 1",
+        ));
     }
-    if input.contract_diff.as_ref().is_none_or(|value| !value.is_array())
-        || input.source_plan.as_ref().is_none_or(|value| !value.get("files").is_some_and(Value::is_array))
+    if input
+        .contract_diff
+        .as_ref()
+        .is_none_or(|value| !value.is_array())
+        || input
+            .source_plan
+            .as_ref()
+            .is_none_or(|value| !value.get("files").is_some_and(Value::is_array))
     {
-        return Err(inspection_error(StatusCode::UNPROCESSABLE_ENTITY, "invalid_proposal", "contract_diff and source_plan.files are required arrays"));
+        return Err(inspection_error(
+            StatusCode::UNPROCESSABLE_ENTITY,
+            "invalid_proposal",
+            "contract_diff and source_plan.files are required arrays",
+        ));
     }
     let tenant = application_scope(
         &state,
@@ -5243,19 +5544,41 @@ async fn create_proposal(
     if input.metadata.get("created_from").and_then(Value::as_str) == Some("module-intent")
         && input.understanding.is_none()
     {
-        return Err(inspection_error(StatusCode::UNPROCESSABLE_ENTITY, "understanding_required", "module proposals require an evidence-backed understanding snapshot"));
+        return Err(inspection_error(
+            StatusCode::UNPROCESSABLE_ENTITY,
+            "understanding_required",
+            "module proposals require an evidence-backed understanding snapshot",
+        ));
     }
     if input.understanding.is_some()
-        && (input.evidence_hash.as_deref().is_none_or(|value| !value.starts_with("sha256:"))
-            || input.understanding_hash.as_deref().is_none_or(|value| !value.starts_with("sha256:")))
+        && (input
+            .evidence_hash
+            .as_deref()
+            .is_none_or(|value| !value.starts_with("sha256:"))
+            || input
+                .understanding_hash
+                .as_deref()
+                .is_none_or(|value| !value.starts_with("sha256:")))
     {
-        return Err(inspection_error(StatusCode::UNPROCESSABLE_ENTITY, "invalid_understanding", "understanding requires evidence_hash and understanding_hash fingerprints"));
+        return Err(inspection_error(
+            StatusCode::UNPROCESSABLE_ENTITY,
+            "invalid_understanding",
+            "understanding requires evidence_hash and understanding_hash fingerprints",
+        ));
     }
     if let Some(understanding) = input.understanding.as_ref() {
-        if understanding.get("evidence_hash").and_then(Value::as_str) != input.evidence_hash.as_deref()
-            || understanding.get("understanding_hash").and_then(Value::as_str) != input.understanding_hash.as_deref()
+        if understanding.get("evidence_hash").and_then(Value::as_str)
+            != input.evidence_hash.as_deref()
+            || understanding
+                .get("understanding_hash")
+                .and_then(Value::as_str)
+                != input.understanding_hash.as_deref()
         {
-            return Err(inspection_error(StatusCode::UNPROCESSABLE_ENTITY, "invalid_understanding", "understanding fingerprints must match the Proposal fingerprints"));
+            return Err(inspection_error(
+                StatusCode::UNPROCESSABLE_ENTITY,
+                "invalid_understanding",
+                "understanding fingerprints must match the Proposal fingerprints",
+            ));
         }
     }
     let id = format!("p_{}", uuid::Uuid::new_v4().simple());
@@ -5291,35 +5614,92 @@ async fn list_proposals(
     )?;
     let limit = input.limit.unwrap_or(DEFAULT_INSPECTION_LIMIT);
     if limit == 0 || limit > MAX_INSPECTION_LIMIT {
-        return Err(inspection_error(StatusCode::UNPROCESSABLE_ENTITY, "invalid_pagination", format!("limit must be between 1 and {MAX_INSPECTION_LIMIT}")));
+        return Err(inspection_error(
+            StatusCode::UNPROCESSABLE_ENTITY,
+            "invalid_pagination",
+            format!("limit must be between 1 and {MAX_INSPECTION_LIMIT}"),
+        ));
     }
-    if input.status.as_ref().is_some_and(|status| !matches!(status.as_str(), "proposed"|"validated"|"previewed"|"approved"|"applied"|"rejected"|"expired")) {
-        return Err(inspection_error(StatusCode::UNPROCESSABLE_ENTITY, "unsupported_filter", "unsupported proposal status"));
+    if input.status.as_ref().is_some_and(|status| {
+        !matches!(
+            status.as_str(),
+            "proposed"
+                | "validated"
+                | "previewed"
+                | "approved"
+                | "applied"
+                | "rejected"
+                | "expired"
+        )
+    }) {
+        return Err(inspection_error(
+            StatusCode::UNPROCESSABLE_ENTITY,
+            "unsupported_filter",
+            "unsupported proposal status",
+        ));
     }
-    let filter_hash = format!("{}:{}:{}", input.application_id, input.environment, input.status.as_deref().unwrap_or("*"));
+    let filter_hash = format!(
+        "{}:{}:{}",
+        input.application_id,
+        input.environment,
+        input.status.as_deref().unwrap_or("*")
+    );
     let state_version = state.db.sequence()?;
-    let mut after = input.cursor.as_deref().map(|cursor| parse_inspection_cursor(cursor, PROPOSAL_COLLECTION, state_version, &filter_hash)).transpose()?;
+    let mut after = input
+        .cursor
+        .as_deref()
+        .map(|cursor| {
+            parse_inspection_cursor(cursor, PROPOSAL_COLLECTION, state_version, &filter_hash)
+        })
+        .transpose()?;
     let mut accepted = Vec::new();
     let mut exhausted = false;
     while accepted.len() <= limit && !exhausted {
-        let page = state.db.list_collection_page(PROPOSAL_COLLECTION, after.as_deref(), 256)?;
-        if page.len() < 256 { exhausted = true; }
-        if page.is_empty() { break; }
+        let page = state
+            .db
+            .list_collection_page(PROPOSAL_COLLECTION, after.as_deref(), 256)?;
+        if page.len() < 256 {
+            exhausted = true;
+        }
+        if page.is_empty() {
+            break;
+        }
         for row in page {
             after = Some(row.key.clone());
-            if !proposal_scope_matches(&row.value, &input.application_id, &input.environment) { continue; }
-            if input.status.as_ref().is_some_and(|status| row.value.get("status").and_then(Value::as_str) != Some(status)) { continue; }
+            if !proposal_scope_matches(&row.value, &input.application_id, &input.environment) {
+                continue;
+            }
+            if input.status.as_ref().is_some_and(|status| {
+                row.value.get("status").and_then(Value::as_str) != Some(status)
+            }) {
+                continue;
+            }
             let mut value = row.value;
             redact_inspection_value(&mut value);
             accepted.push((row.key, value));
-            if accepted.len() > limit { break; }
+            if accepted.len() > limit {
+                break;
+            }
         }
     }
     let has_more = accepted.len() > limit;
-    let last_key = accepted.get(limit.saturating_sub(1)).map(|entry| entry.0.clone());
-    let proposals = accepted.into_iter().take(limit).map(|entry| entry.1).collect::<Vec<_>>();
-    let next_cursor = if has_more { last_key.map(|key| inspection_cursor(PROPOSAL_COLLECTION, state_version, &key, &filter_hash)) } else { None };
-    Ok(Json(json!({"proposals":proposals,"pagination":{"limit":limit,"nextCursor":next_cursor},"state_version":state_version})))
+    let last_key = accepted
+        .get(limit.saturating_sub(1))
+        .map(|entry| entry.0.clone());
+    let proposals = accepted
+        .into_iter()
+        .take(limit)
+        .map(|entry| entry.1)
+        .collect::<Vec<_>>();
+    let next_cursor = if has_more {
+        last_key
+            .map(|key| inspection_cursor(PROPOSAL_COLLECTION, state_version, &key, &filter_hash))
+    } else {
+        None
+    };
+    Ok(Json(
+        json!({"proposals":proposals,"pagination":{"limit":limit,"nextCursor":next_cursor},"state_version":state_version}),
+    ))
 }
 async fn get_proposal(
     State(state): State<AppState>,
@@ -5361,8 +5741,19 @@ async fn proposal_history(
         .map(|row| row.value)
         .filter(|value| value.get("proposal_id").and_then(Value::as_str) == Some(id.as_str()))
         .collect();
-    events.sort_by(|left, right| left.get("event_sequence").and_then(Value::as_u64).cmp(&right.get("event_sequence").and_then(Value::as_u64)).then_with(|| left.get("id").and_then(Value::as_str).cmp(&right.get("id").and_then(Value::as_str))));
-    for event in &mut events { redact_inspection_value(event); }
+    events.sort_by(|left, right| {
+        left.get("event_sequence")
+            .and_then(Value::as_u64)
+            .cmp(&right.get("event_sequence").and_then(Value::as_u64))
+            .then_with(|| {
+                left.get("id")
+                    .and_then(Value::as_str)
+                    .cmp(&right.get("id").and_then(Value::as_str))
+            })
+    });
+    for event in &mut events {
+        redact_inspection_value(event);
+    }
     Ok(Json(json!({"events":events})))
 }
 fn move_proposal(
@@ -5412,7 +5803,10 @@ fn move_proposal(
 }
 
 fn proposal_is_expired(value: &Value) -> bool {
-    value.get("expires_at").and_then(|expires| expires.as_i64().or_else(|| expires.as_str()?.parse().ok())).is_some_and(|expires| expires <= unix_seconds_i64())
+    value
+        .get("expires_at")
+        .and_then(|expires| expires.as_i64().or_else(|| expires.as_str()?.parse().ok()))
+        .is_some_and(|expires| expires <= unix_seconds_i64())
 }
 
 fn proposal_readiness_value(
@@ -5421,26 +5815,89 @@ fn proposal_readiness_value(
     value: &Value,
     current_evidence_hash: Option<&str>,
 ) -> Result<Value, ApiError> {
-    let application_id = value.get("application_id").and_then(Value::as_str).unwrap_or("");
-    let environment = value.get("environment").and_then(Value::as_str).unwrap_or("production");
-    let revision_id = state.applications.pointers(application_id).get(environment).cloned().ok_or_else(|| inspection_error(StatusCode::NOT_FOUND, "application_not_found", "active application contract not found"))?;
-    let revision = state.applications.revision(tenant, application_id, &revision_id).ok_or_else(|| inspection_error(StatusCode::NOT_FOUND, "application_not_found", "active application revision not found"))?;
-    let current_contract_hash = revision.manifest.metadata.labels.get("feltdb.contract_hash").unwrap_or(&revision.manifest_hash).clone();
-    let current_flow_hash = revision.manifest.metadata.labels.get("feltdb.flow_hash").cloned();
-    let proposal_contract_hash = value.get("base_contract_hash").and_then(Value::as_str).unwrap_or("");
-    let proposal_flow_hash = value.get("base_flow_hash").and_then(Value::as_str).unwrap_or("");
+    let application_id = value
+        .get("application_id")
+        .and_then(Value::as_str)
+        .unwrap_or("");
+    let environment = value
+        .get("environment")
+        .and_then(Value::as_str)
+        .unwrap_or("production");
+    let revision_id = state
+        .applications
+        .pointers(application_id)
+        .get(environment)
+        .cloned()
+        .ok_or_else(|| {
+            inspection_error(
+                StatusCode::NOT_FOUND,
+                "application_not_found",
+                "active application contract not found",
+            )
+        })?;
+    let revision = state
+        .applications
+        .revision(tenant, application_id, &revision_id)
+        .ok_or_else(|| {
+            inspection_error(
+                StatusCode::NOT_FOUND,
+                "application_not_found",
+                "active application revision not found",
+            )
+        })?;
+    let current_contract_hash = revision
+        .manifest
+        .metadata
+        .labels
+        .get("feltdb.contract_hash")
+        .unwrap_or(&revision.manifest_hash)
+        .clone();
+    let current_flow_hash = revision
+        .manifest
+        .metadata
+        .labels
+        .get("feltdb.flow_hash")
+        .cloned();
+    let proposal_contract_hash = value
+        .get("base_contract_hash")
+        .and_then(Value::as_str)
+        .unwrap_or("");
+    let proposal_flow_hash = value
+        .get("base_flow_hash")
+        .and_then(Value::as_str)
+        .unwrap_or("");
     let current_modules = revision.manifest.modules.iter().filter_map(|module| Some(json!({"id":module.get("id")?,"provider":module.get("provider")?,"version":module.get("version")?}))).collect::<Vec<_>>();
     let contract_changed = current_contract_hash != proposal_contract_hash;
-    let flow_changed = current_flow_hash.as_deref().is_some_and(|hash| hash != proposal_flow_hash);
-    let modules_changed = value.get("base_module_versions").and_then(Value::as_array).is_some_and(|modules| modules != &current_modules);
-    let evidence_changed = current_evidence_hash.is_some_and(|current| value.get("evidence_hash").and_then(Value::as_str).is_some_and(|base| base != current));
+    let flow_changed = current_flow_hash
+        .as_deref()
+        .is_some_and(|hash| hash != proposal_flow_hash);
+    let modules_changed = value
+        .get("base_module_versions")
+        .and_then(Value::as_array)
+        .is_some_and(|modules| modules != &current_modules);
+    let evidence_changed = current_evidence_hash.is_some_and(|current| {
+        value
+            .get("evidence_hash")
+            .and_then(Value::as_str)
+            .is_some_and(|base| base != current)
+    });
     let expired = proposal_is_expired(value);
     let mut blockers = Vec::new();
-    if contract_changed { blockers.push("contract_changed"); }
-    if flow_changed { blockers.push("flow_changed"); }
-    if modules_changed { blockers.push("module_versions_changed"); }
-    if evidence_changed { blockers.push("evidence_changed"); }
-    if expired { blockers.push("expired"); }
+    if contract_changed {
+        blockers.push("contract_changed");
+    }
+    if flow_changed {
+        blockers.push("flow_changed");
+    }
+    if modules_changed {
+        blockers.push("module_versions_changed");
+    }
+    if evidence_changed {
+        blockers.push("evidence_changed");
+    }
+    if expired {
+        blockers.push("expired");
+    }
     let stale = contract_changed || flow_changed || modules_changed || evidence_changed;
     Ok(json!({
         "status":value.get("status"), "readiness":if blockers.is_empty(){"ready"}else{"blocked"},
@@ -5449,41 +5906,163 @@ fn proposal_readiness_value(
         "proposal_flow_hash":proposal_flow_hash, "stale":stale, "expires_at":value.get("expires_at")
     }))
 }
-
-async fn proposal_status(
+
+async fn proposal_status(
+    State(state): State<AppState>,
+    Extension(principal): Extension<Principal>,
+    Path(id): Path<String>,
+    Query(input): Query<ProposalScopeRequest>,
+) -> Result<Json<Value>, ApiError> {
+    let tenant = application_scope(
+        &state,
+        &principal.key_id,
+        &input.application_id,
+        "application:read",
+    )?;
+    let mut value = proposal_value(&state, &id)?;
+    if !proposal_scope_matches(&value, &input.application_id, &input.environment) {
+        return Err(inspection_error(
+            StatusCode::NOT_FOUND,
+            "proposal_not_found",
+            "proposal not found",
+        ));
+    }
+    Ok(Json(proposal_readiness_value(
+        &state,
+        &tenant,
+        &value,
+        input.current_evidence_hash.as_deref(),
+    )?))
+}
+async fn record_proposal_convergence(
+    State(state): State<AppState>,
+    Extension(principal): Extension<Principal>,
+    Path(id): Path<String>,
+    Json(mut input): Json<Value>,
+) -> Result<(StatusCode, Json<Value>), ApiError> {
+    let application_id = input
+        .get("application_id")
+        .and_then(Value::as_str)
+        .ok_or_else(|| {
+            inspection_error(
+                StatusCode::BAD_REQUEST,
+                "invalid_convergence",
+                "application_id is required",
+            )
+        })?
+        .to_string();
+    let environment = input
+        .get("environment")
+        .and_then(Value::as_str)
+        .unwrap_or("production")
+        .to_string();
+    application_scope(
+        &state,
+        &principal.key_id,
+        &application_id,
+        "application:write",
+    )?;
+    let proposal = proposal_value(&state, &id)?;
+    if !proposal_scope_matches(&proposal, &application_id, &environment) {
+        return Err(inspection_error(
+            StatusCode::NOT_FOUND,
+            "proposal_not_found",
+            "proposal not found",
+        ));
+    }
+    if proposal.get("status").and_then(Value::as_str) != Some("applied") {
+        return Err(inspection_error(
+            StatusCode::CONFLICT,
+            "proposal_not_applied",
+            "only an applied Proposal can record convergence",
+        ));
+    }
+    if input.get("proposal_id").and_then(Value::as_str) != Some(id.as_str()) {
+        return Err(inspection_error(
+            StatusCode::UNPROCESSABLE_ENTITY,
+            "invalid_convergence",
+            "proposal_id must match the route",
+        ));
+    }
+    let valid_status = input
+        .get("status")
+        .and_then(Value::as_str)
+        .is_some_and(|value| {
+            matches!(
+                value,
+                "pending"
+                    | "checking"
+                    | "converged"
+                    | "partially_converged"
+                    | "diverged"
+                    | "blocked"
+                    | "unverified"
+            )
+        });
+    if !valid_status
+        || input.get("findings").is_none_or(|value| !value.is_array())
+        || input
+            .get("evidence_hash")
+            .and_then(Value::as_str)
+            .is_none_or(|value| !value.starts_with("sha256:"))
+    {
+        return Err(inspection_error(
+            StatusCode::UNPROCESSABLE_ENTITY,
+            "invalid_convergence",
+            "status, findings, and evidence_hash are required",
+        ));
+    }
+    let convergence_id = format!("cv_{}", uuid::Uuid::new_v4().simple());
+    input["id"] = json!(convergence_id);
+    input["created_at"] = json!(unix_seconds_i64());
+    input["verifier_version"] = json!(1);
+    redact_inspection_value(&mut input);
+    insert_canonical(
+        &state,
+        CONVERGENCE_COLLECTION,
+        &convergence_id,
+        input.clone(),
+    )?;
+    Ok((StatusCode::CREATED, Json(input)))
+}
+async fn proposal_convergence(
     State(state): State<AppState>,
     Extension(principal): Extension<Principal>,
     Path(id): Path<String>,
     Query(input): Query<ProposalScopeRequest>,
 ) -> Result<Json<Value>, ApiError> {
-    let tenant = application_scope(&state, &principal.key_id, &input.application_id, "application:read")?;
-    let mut value = proposal_value(&state, &id)?;
-    if !proposal_scope_matches(&value, &input.application_id, &input.environment) {
-        return Err(inspection_error(StatusCode::NOT_FOUND, "proposal_not_found", "proposal not found"));
+    application_scope(
+        &state,
+        &principal.key_id,
+        &input.application_id,
+        "application:read",
+    )?;
+    let proposal = proposal_value(&state, &id)?;
+    if !proposal_scope_matches(&proposal, &input.application_id, &input.environment) {
+        return Err(inspection_error(
+            StatusCode::NOT_FOUND,
+            "proposal_not_found",
+            "proposal not found",
+        ));
     }
-    Ok(Json(proposal_readiness_value(&state, &tenant, &value, input.current_evidence_hash.as_deref())?))
-}
-async fn record_proposal_convergence(
-    State(state): State<AppState>, Extension(principal): Extension<Principal>, Path(id): Path<String>, Json(mut input): Json<Value>,
-) -> Result<(StatusCode, Json<Value>), ApiError> {
-    let application_id=input.get("application_id").and_then(Value::as_str).ok_or_else(||inspection_error(StatusCode::BAD_REQUEST,"invalid_convergence","application_id is required"))?.to_string();
-    let environment=input.get("environment").and_then(Value::as_str).unwrap_or("production").to_string();
-    application_scope(&state,&principal.key_id,&application_id,"application:write")?;let proposal=proposal_value(&state,&id)?;
-    if !proposal_scope_matches(&proposal,&application_id,&environment){return Err(inspection_error(StatusCode::NOT_FOUND,"proposal_not_found","proposal not found"));}
-    if proposal.get("status").and_then(Value::as_str)!=Some("applied"){return Err(inspection_error(StatusCode::CONFLICT,"proposal_not_applied","only an applied Proposal can record convergence"));}
-    if input.get("proposal_id").and_then(Value::as_str)!=Some(id.as_str()){return Err(inspection_error(StatusCode::UNPROCESSABLE_ENTITY,"invalid_convergence","proposal_id must match the route"));}
-    let valid_status=input.get("status").and_then(Value::as_str).is_some_and(|value|matches!(value,"pending"|"checking"|"converged"|"partially_converged"|"diverged"|"blocked"|"unverified"));
-    if !valid_status||input.get("findings").is_none_or(|value|!value.is_array())||input.get("evidence_hash").and_then(Value::as_str).is_none_or(|value|!value.starts_with("sha256:")){return Err(inspection_error(StatusCode::UNPROCESSABLE_ENTITY,"invalid_convergence","status, findings, and evidence_hash are required"));}
-    let convergence_id=format!("cv_{}",uuid::Uuid::new_v4().simple());input["id"]=json!(convergence_id);input["created_at"]=json!(unix_seconds_i64());input["verifier_version"]=json!(1);
-    redact_inspection_value(&mut input);insert_canonical(&state,CONVERGENCE_COLLECTION,&convergence_id,input.clone())?;Ok((StatusCode::CREATED,Json(input)))
-}
-async fn proposal_convergence(
-    State(state): State<AppState>, Extension(principal): Extension<Principal>, Path(id): Path<String>, Query(input): Query<ProposalScopeRequest>,
-) -> Result<Json<Value>, ApiError> {
-    application_scope(&state,&principal.key_id,&input.application_id,"application:read")?;let proposal=proposal_value(&state,&id)?;
-    if !proposal_scope_matches(&proposal,&input.application_id,&input.environment){return Err(inspection_error(StatusCode::NOT_FOUND,"proposal_not_found","proposal not found"));}
-    let mut values=state.db.list_collection(CONVERGENCE_COLLECTION)?.into_iter().map(|row|row.value).filter(|value|value.get("proposal_id").and_then(Value::as_str)==Some(id.as_str())&&proposal_scope_matches(value,&input.application_id,&input.environment)).collect::<Vec<_>>();
-    values.sort_by_key(|value|value.get("created_at").and_then(Value::as_i64).unwrap_or_default());values.reverse();Ok(Json(json!({"convergence":values})))
+    let mut values = state
+        .db
+        .list_collection(CONVERGENCE_COLLECTION)?
+        .into_iter()
+        .map(|row| row.value)
+        .filter(|value| {
+            value.get("proposal_id").and_then(Value::as_str) == Some(id.as_str())
+                && proposal_scope_matches(value, &input.application_id, &input.environment)
+        })
+        .collect::<Vec<_>>();
+    values.sort_by_key(|value| {
+        value
+            .get("created_at")
+            .and_then(Value::as_i64)
+            .unwrap_or_default()
+    });
+    values.reverse();
+    Ok(Json(json!({"convergence":values})))
 }
 async fn validate_proposal(
     State(state): State<AppState>,
@@ -5620,7 +6199,11 @@ async fn validate_proposal(
         value["proposed_contract"] = serde_json::to_value(&proposed.manifest)
             .map_err(|e| ApiError(StatusCode::INTERNAL_SERVER_ERROR, e.to_string()))?;
     }
-    if !value.pointer("/source_plan/files").and_then(Value::as_array).is_some_and(|files| !files.is_empty()) {
+    if !value
+        .pointer("/source_plan/files")
+        .and_then(Value::as_array)
+        .is_some_and(|files| !files.is_empty())
+    {
         value["source_plan"] = json!({"files":[{"path":"feltdb.flow","operation":"modify"},{"path":"src/feltdb/generated-contract.ts","operation":"modify"}]});
     }
     Ok(Json(move_proposal(
@@ -5647,7 +6230,8 @@ async fn preview_proposal(
     if !proposal_scope_matches(&value, &input.application_id, &input.environment) {
         return Err(ApiError(StatusCode::NOT_FOUND, "proposal not found".into()));
     }
-    let replacing_expired_preview = value.get("status").and_then(Value::as_str) == Some("previewed");
+    let replacing_expired_preview =
+        value.get("status").and_then(Value::as_str) == Some("previewed");
     if replacing_expired_preview {
         if let Some(preview_id) = value.get("preview_id").and_then(Value::as_str) {
             let mut artifact = preview_artifact(&state, preview_id)?;
@@ -5655,42 +6239,131 @@ async fn preview_proposal(
                 let mut proposal = value.clone();
                 redact_inspection_value(&mut proposal);
                 redact_inspection_value(&mut artifact);
-                if let Some(object) = artifact.as_object_mut() { object.remove("namespace"); }
+                if let Some(object) = artifact.as_object_mut() {
+                    object.remove("namespace");
+                }
                 artifact["proposal"] = proposal;
                 return Ok(Json(artifact));
             }
         }
     }
-    if !replacing_expired_preview && value.get("status").and_then(Value::as_str) != Some("validated") {
-        return Err(inspection_error(StatusCode::CONFLICT, "invalid_proposal_transition", "only a validated proposal can be previewed"));
+    if !replacing_expired_preview
+        && value.get("status").and_then(Value::as_str) != Some("validated")
+    {
+        return Err(inspection_error(
+            StatusCode::CONFLICT,
+            "invalid_proposal_transition",
+            "only a validated proposal can be previewed",
+        ));
     }
-    let proposed_manifest: ApplicationManifest = serde_json::from_value(value.get("proposed_contract").cloned().ok_or_else(|| inspection_error(StatusCode::UNPROCESSABLE_ENTITY, "missing_required_semantics", "validated proposal has no proposed contract snapshot"))?).map_err(|error| inspection_error(StatusCode::UNPROCESSABLE_ENTITY, "invalid_proposal", error.to_string()))?;
-    let current_revision_id = state.applications.pointers(&input.application_id).get(&input.environment).cloned().ok_or_else(|| inspection_error(StatusCode::NOT_FOUND, "application_not_found", "active application contract not found"))?;
-    let current_revision = state.applications.revision(&tenant, &input.application_id, &current_revision_id).ok_or_else(|| inspection_error(StatusCode::NOT_FOUND, "application_not_found", "active application revision not found"))?;
+    let proposed_manifest: ApplicationManifest =
+        serde_json::from_value(value.get("proposed_contract").cloned().ok_or_else(|| {
+            inspection_error(
+                StatusCode::UNPROCESSABLE_ENTITY,
+                "missing_required_semantics",
+                "validated proposal has no proposed contract snapshot",
+            )
+        })?)
+        .map_err(|error| {
+            inspection_error(
+                StatusCode::UNPROCESSABLE_ENTITY,
+                "invalid_proposal",
+                error.to_string(),
+            )
+        })?;
+    let current_revision_id = state
+        .applications
+        .pointers(&input.application_id)
+        .get(&input.environment)
+        .cloned()
+        .ok_or_else(|| {
+            inspection_error(
+                StatusCode::NOT_FOUND,
+                "application_not_found",
+                "active application contract not found",
+            )
+        })?;
+    let current_revision = state
+        .applications
+        .revision(&tenant, &input.application_id, &current_revision_id)
+        .ok_or_else(|| {
+            inspection_error(
+                StatusCode::NOT_FOUND,
+                "application_not_found",
+                "active application revision not found",
+            )
+        })?;
     let readiness = proposal_readiness_value(&state, &tenant, &value, None)?;
     if readiness.get("readiness").and_then(Value::as_str) != Some("ready") {
-        return Err(ApiError::structured(StatusCode::CONFLICT, json!({"code":"preview_not_ready","message":"proposal cannot be previewed","readiness":readiness})));
+        return Err(ApiError::structured(
+            StatusCode::CONFLICT,
+            json!({"code":"preview_not_ready","message":"proposal cannot be previewed","readiness":readiness}),
+        ));
     }
     let preview_id = format!("pv_{}", uuid::Uuid::new_v4().simple());
     let preview_environment = format!("preview/proposal/{preview_id}");
-    let proposed_manifest_hash = manifest_hash(&proposed_manifest).map_err(|error| inspection_error(StatusCode::UNPROCESSABLE_ENTITY, "preview_contract_invalid", error))?;
-    let proposed_revision = ApplicationRevision { revision_id:format!("proposal://{id}"), application_id:input.application_id.clone(), tenant_id:tenant,
-        revision_number:value.get("base_contract_version").and_then(Value::as_u64).unwrap_or(current_revision.revision_number)+1,
-        parent_revision_id:Some(current_revision.revision_id.clone()), manifest_hash:proposed_manifest_hash, manifest:proposed_manifest,
-        created_by:principal.key_id.clone(), created_at:unix_seconds_i64() as u64, status:RevisionStatus::Committed };
-    let runtime = resolve_runtime(&proposed_revision, &preview_environment, &RuntimeInventory::default()).map_err(|report| ApiError::structured(StatusCode::UNPROCESSABLE_ENTITY, json!({"code":"preview_contract_invalid","validation":report})))?;
+    let proposed_manifest_hash = manifest_hash(&proposed_manifest).map_err(|error| {
+        inspection_error(
+            StatusCode::UNPROCESSABLE_ENTITY,
+            "preview_contract_invalid",
+            error,
+        )
+    })?;
+    let proposed_revision = ApplicationRevision {
+        revision_id: format!("proposal://{id}"),
+        application_id: input.application_id.clone(),
+        tenant_id: tenant,
+        revision_number: value
+            .get("base_contract_version")
+            .and_then(Value::as_u64)
+            .unwrap_or(current_revision.revision_number)
+            + 1,
+        parent_revision_id: Some(current_revision.revision_id.clone()),
+        manifest_hash: proposed_manifest_hash,
+        manifest: proposed_manifest,
+        created_by: principal.key_id.clone(),
+        created_at: unix_seconds_i64() as u64,
+        status: RevisionStatus::Committed,
+    };
+    let runtime = resolve_runtime(
+        &proposed_revision,
+        &preview_environment,
+        &RuntimeInventory::default(),
+    )
+    .map_err(|report| {
+        ApiError::structured(
+            StatusCode::UNPROCESSABLE_ENTITY,
+            json!({"code":"preview_contract_invalid","validation":report}),
+        )
+    })?;
     let current_contract = proposal_contract_snapshot(&current_revision, &input.environment);
     let mut proposed_contract = proposal_contract_snapshot(&proposed_revision, &input.environment);
     proposed_contract["contract_hash"] = json!(proposal_hash(&proposed_contract));
-    proposed_contract["flow_hash"] = json!(format!("sha256:{:x}", Sha256::digest(value.get("proposed_flow").and_then(Value::as_str).unwrap_or("").replace("\r\n", "\n").as_bytes())));
+    proposed_contract["flow_hash"] = json!(format!(
+        "sha256:{:x}",
+        Sha256::digest(
+            value
+                .get("proposed_flow")
+                .and_then(Value::as_str)
+                .unwrap_or("")
+                .replace("\r\n", "\n")
+                .as_bytes()
+        )
+    ));
     let namespace = runtime.environment.state_namespace.clone();
     let mut seeded_records = Vec::new();
     for collection in &proposed_revision.manifest.collections {
-        if collection.name.starts_with("_feltdb") { continue; }
+        if collection.name.starts_with("_feltdb") {
+            continue;
+        }
         let record_id = format!("preview_{}", collection.name.to_ascii_lowercase());
         let record = json!({"id":record_id,"_preview_data":true,"_preview_source":"synthetic","label":format!("Synthetic {} preview",collection.name)});
-        state.db.capability(&format!("{}:{}", namespace, collection.name)).insert_with_key(&record_id, record)?;
-        seeded_records.push(json!({"collection":collection.name,"id":record_id,"preview_data":true}));
+        state
+            .db
+            .capability(&format!("{}:{}", namespace, collection.name))
+            .insert_with_key(&record_id, record)?;
+        seeded_records
+            .push(json!({"collection":collection.name,"id":record_id,"preview_data":true}));
     }
     let now = unix_seconds_i64();
     let mut artifact = json!({
@@ -5706,7 +6379,15 @@ async fn preview_proposal(
         "seeded_records":seeded_records,"data_classification":"synthetic_preview","external_side_effects":"simulated","readiness":readiness
     });
     redact_inspection_value(&mut artifact);
-    insert_canonical(&state, PROPOSAL_PREVIEW_COLLECTION, artifact.get("preview_id").and_then(Value::as_str).unwrap_or(""), artifact.clone())?;
+    insert_canonical(
+        &state,
+        PROPOSAL_PREVIEW_COLLECTION,
+        artifact
+            .get("preview_id")
+            .and_then(Value::as_str)
+            .unwrap_or(""),
+        artifact.clone(),
+    )?;
     value["preview_id"] = artifact.get("preview_id").cloned().unwrap_or(Value::Null);
     value["preview_expires_at"] = artifact.get("expires_at").cloned().unwrap_or(Value::Null);
     let mut stored_proposal = if replacing_expired_preview {
@@ -5716,76 +6397,209 @@ async fn preview_proposal(
         move_proposal(&state, &id, value, "previewed", &principal.key_id)?
     };
     redact_inspection_value(&mut stored_proposal);
-    if let Some(object) = artifact.as_object_mut() { object.remove("namespace"); }
+    if let Some(object) = artifact.as_object_mut() {
+        object.remove("namespace");
+    }
     artifact["proposal"] = stored_proposal;
     Ok(Json(artifact))
 }
 
 async fn get_proposal_preview(
-    State(state): State<AppState>, Extension(principal): Extension<Principal>, Path(id): Path<String>,
+    State(state): State<AppState>,
+    Extension(principal): Extension<Principal>,
+    Path(id): Path<String>,
     Query(input): Query<ProposalScopeRequest>,
 ) -> Result<Json<Value>, ApiError> {
-    let tenant = application_scope(&state, &principal.key_id, &input.application_id, "application:read")?;
+    let tenant = application_scope(
+        &state,
+        &principal.key_id,
+        &input.application_id,
+        "application:read",
+    )?;
     let mut artifact = preview_artifact(&state, &id)?;
     if !proposal_scope_matches(&artifact, &input.application_id, &input.environment) {
-        return Err(inspection_error(StatusCode::NOT_FOUND, "preview_not_found", "preview not found"));
+        return Err(inspection_error(
+            StatusCode::NOT_FOUND,
+            "preview_not_found",
+            "preview not found",
+        ));
     }
     if !preview_available(&artifact) {
-        return Err(inspection_error(StatusCode::GONE, "preview_expired", "preview artifact has expired"));
+        return Err(inspection_error(
+            StatusCode::GONE,
+            "preview_expired",
+            "preview artifact has expired",
+        ));
     }
-    let proposal = proposal_value(&state, artifact.get("proposal_id").and_then(Value::as_str).unwrap_or(""))?;
+    let proposal = proposal_value(
+        &state,
+        artifact
+            .get("proposal_id")
+            .and_then(Value::as_str)
+            .unwrap_or(""),
+    )?;
     if proposal.get("preview_id") != artifact.get("preview_id") {
-        return Err(inspection_error(StatusCode::CONFLICT, "preview_invalidated", "preview has been replaced"));
+        return Err(inspection_error(
+            StatusCode::CONFLICT,
+            "preview_invalidated",
+            "preview has been replaced",
+        ));
     }
-    if proposal_readiness_value(&state, &tenant, &proposal, None)?.get("stale").and_then(Value::as_bool) == Some(true) {
-        return Err(inspection_error(StatusCode::CONFLICT, "preview_invalidated", "the application authority changed after preview creation"));
+    if proposal_readiness_value(&state, &tenant, &proposal, None)?
+        .get("stale")
+        .and_then(Value::as_bool)
+        == Some(true)
+    {
+        return Err(inspection_error(
+            StatusCode::CONFLICT,
+            "preview_invalidated",
+            "the application authority changed after preview creation",
+        ));
     }
     redact_inspection_value(&mut artifact);
-    if let Some(object) = artifact.as_object_mut() { object.remove("namespace"); }
+    if let Some(object) = artifact.as_object_mut() {
+        object.remove("namespace");
+    }
     Ok(Json(artifact))
 }
 
 async fn inspect_proposal_preview_data(
-    State(state): State<AppState>, Extension(principal): Extension<Principal>, Path((id, collection)): Path<(String, String)>,
+    State(state): State<AppState>,
+    Extension(principal): Extension<Principal>,
+    Path((id, collection)): Path<(String, String)>,
     Query(input): Query<ProposalScopeRequest>,
 ) -> Result<Json<Value>, ApiError> {
-    application_scope(&state, &principal.key_id, &input.application_id, "application:read")?;
+    application_scope(
+        &state,
+        &principal.key_id,
+        &input.application_id,
+        "application:read",
+    )?;
     let artifact = preview_artifact(&state, &id)?;
     if !proposal_scope_matches(&artifact, &input.application_id, &input.environment) {
-        return Err(inspection_error(StatusCode::NOT_FOUND, "preview_not_found", "preview not found"));
+        return Err(inspection_error(
+            StatusCode::NOT_FOUND,
+            "preview_not_found",
+            "preview not found",
+        ));
+    }
+    if !preview_available(&artifact) {
+        return Err(inspection_error(
+            StatusCode::GONE,
+            "preview_expired",
+            "preview artifact has expired",
+        ));
     }
-    if !preview_available(&artifact) { return Err(inspection_error(StatusCode::GONE, "preview_expired", "preview artifact has expired")); }
-    if collection.starts_with("_feltdb") || !artifact.pointer("/proposed/schema").and_then(Value::as_array).is_some_and(|collections| collections.iter().any(|value| value.get("name").and_then(Value::as_str)==Some(&collection))) {
-        return Err(inspection_error(StatusCode::NOT_FOUND, "collection_not_found", "collection is not part of the proposed contract"));
+    if collection.starts_with("_feltdb")
+        || !artifact
+            .pointer("/proposed/schema")
+            .and_then(Value::as_array)
+            .is_some_and(|collections| {
+                collections
+                    .iter()
+                    .any(|value| value.get("name").and_then(Value::as_str) == Some(&collection))
+            })
+    {
+        return Err(inspection_error(
+            StatusCode::NOT_FOUND,
+            "collection_not_found",
+            "collection is not part of the proposed contract",
+        ));
     }
     let limit = input.limit.unwrap_or(DEFAULT_INSPECTION_LIMIT);
-    if limit == 0 || limit > MAX_INSPECTION_LIMIT { return Err(inspection_error(StatusCode::UNPROCESSABLE_ENTITY, "invalid_pagination", format!("limit must be between 1 and {MAX_INSPECTION_LIMIT}"))); }
+    if limit == 0 || limit > MAX_INSPECTION_LIMIT {
+        return Err(inspection_error(
+            StatusCode::UNPROCESSABLE_ENTITY,
+            "invalid_pagination",
+            format!("limit must be between 1 and {MAX_INSPECTION_LIMIT}"),
+        ));
+    }
     let state_version = state.db.sequence()?;
     let filter_hash = format!("{id}:{collection}");
-    let after = input.cursor.as_deref().map(|cursor| parse_inspection_cursor(cursor, &filter_hash, state_version, "preview-data")).transpose()?;
-    let capability = format!("{}:{}", artifact.get("namespace").and_then(Value::as_str).unwrap_or(""), collection);
-    let mut rows = state.db.list_collection_page(&capability, after.as_deref(), limit.saturating_add(1))?;
+    let after = input
+        .cursor
+        .as_deref()
+        .map(|cursor| parse_inspection_cursor(cursor, &filter_hash, state_version, "preview-data"))
+        .transpose()?;
+    let capability = format!(
+        "{}:{}",
+        artifact
+            .get("namespace")
+            .and_then(Value::as_str)
+            .unwrap_or(""),
+        collection
+    );
+    let mut rows =
+        state
+            .db
+            .list_collection_page(&capability, after.as_deref(), limit.saturating_add(1))?;
     let has_more = rows.len() > limit;
     rows.truncate(limit);
     let last_key = rows.last().map(|row| row.key.clone());
     let mut records = rows.into_iter().map(|row| row.value).collect::<Vec<_>>();
-    for record in &mut records { redact_inspection_value(record); }
-    let next_cursor = if has_more { last_key.map(|key| inspection_cursor(&filter_hash, state_version, &key, "preview-data")) } else { None };
-    Ok(Json(json!({"preview_id":id,"collection":collection,"records":records,"data_classification":"synthetic_preview","pagination":{"limit":limit,"nextCursor":next_cursor}})))
+    for record in &mut records {
+        redact_inspection_value(record);
+    }
+    let next_cursor = if has_more {
+        last_key.map(|key| inspection_cursor(&filter_hash, state_version, &key, "preview-data"))
+    } else {
+        None
+    };
+    Ok(Json(
+        json!({"preview_id":id,"collection":collection,"records":records,"data_classification":"synthetic_preview","pagination":{"limit":limit,"nextCursor":next_cursor}}),
+    ))
 }
 
 async fn simulate_proposal_preview(
-    State(state): State<AppState>, Extension(principal): Extension<Principal>, Path(id): Path<String>,
-    Query(input): Query<ProposalScopeRequest>, Json(simulation): Json<PreviewSimulationRequest>,
+    State(state): State<AppState>,
+    Extension(principal): Extension<Principal>,
+    Path(id): Path<String>,
+    Query(input): Query<ProposalScopeRequest>,
+    Json(simulation): Json<PreviewSimulationRequest>,
 ) -> Result<Json<Value>, ApiError> {
-    application_scope(&state, &principal.key_id, &input.application_id, "application:write")?;
+    application_scope(
+        &state,
+        &principal.key_id,
+        &input.application_id,
+        "application:write",
+    )?;
     let artifact = preview_artifact(&state, &id)?;
-    if !proposal_scope_matches(&artifact, &input.application_id, &input.environment) { return Err(inspection_error(StatusCode::NOT_FOUND, "preview_not_found", "preview not found")); }
-    if !preview_available(&artifact) { return Err(inspection_error(StatusCode::GONE, "preview_expired", "preview artifact has expired")); }
-    let known = artifact.get("events").and_then(Value::as_array).is_some_and(|events| events.iter().any(|event| event.as_str()==Some(&simulation.event)));
-    if !known { return Err(inspection_error(StatusCode::UNPROCESSABLE_ENTITY, "unsupported_preview_event", "event is not part of the proposal")); }
-    let state_flow = artifact.get("state_flow").cloned().unwrap_or_else(||json!([]));
-    Ok(Json(json!({"preview_id":id,"event":simulation.event,"status":"simulated","external_side_effects":"none","trace":state_flow,"writes":"isolated_preview_namespace_only"})))
+    if !proposal_scope_matches(&artifact, &input.application_id, &input.environment) {
+        return Err(inspection_error(
+            StatusCode::NOT_FOUND,
+            "preview_not_found",
+            "preview not found",
+        ));
+    }
+    if !preview_available(&artifact) {
+        return Err(inspection_error(
+            StatusCode::GONE,
+            "preview_expired",
+            "preview artifact has expired",
+        ));
+    }
+    let known = artifact
+        .get("events")
+        .and_then(Value::as_array)
+        .is_some_and(|events| {
+            events
+                .iter()
+                .any(|event| event.as_str() == Some(&simulation.event))
+        });
+    if !known {
+        return Err(inspection_error(
+            StatusCode::UNPROCESSABLE_ENTITY,
+            "unsupported_preview_event",
+            "event is not part of the proposal",
+        ));
+    }
+    let state_flow = artifact
+        .get("state_flow")
+        .cloned()
+        .unwrap_or_else(|| json!([]));
+    Ok(Json(
+        json!({"preview_id":id,"event":simulation.event,"status":"simulated","external_side_effects":"none","trace":state_flow,"writes":"isolated_preview_namespace_only"}),
+    ))
 }
 async fn transition_proposal(
     State(state): State<AppState>,
@@ -5814,29 +6628,70 @@ async fn transition_proposal(
         ));
     }
     if proposal_is_expired(&value) && input.status != "expired" {
-        return Err(inspection_error(StatusCode::CONFLICT, "proposal_expired", "proposal has expired"));
+        return Err(inspection_error(
+            StatusCode::CONFLICT,
+            "proposal_expired",
+            "proposal has expired",
+        ));
     }
     if input.status == "approved" {
         let readiness = proposal_readiness_value(&state, &tenant, &value, None)?;
         if readiness.get("readiness").and_then(Value::as_str) != Some("ready") {
-            return Err(ApiError::structured(StatusCode::CONFLICT, json!({"code":"stale_proposal","message":"proposal is no longer applicable","readiness":readiness})));
+            return Err(ApiError::structured(
+                StatusCode::CONFLICT,
+                json!({"code":"stale_proposal","message":"proposal is no longer applicable","readiness":readiness}),
+            ));
         }
-        let preview_id = value.get("preview_id").and_then(Value::as_str).ok_or_else(|| inspection_error(StatusCode::CONFLICT, "preview_required", "approval requires a ready preview artifact"))?;
+        let preview_id = value
+            .get("preview_id")
+            .and_then(Value::as_str)
+            .ok_or_else(|| {
+                inspection_error(
+                    StatusCode::CONFLICT,
+                    "preview_required",
+                    "approval requires a ready preview artifact",
+                )
+            })?;
         let artifact = preview_artifact(&state, preview_id)?;
         let bound = preview_available(&artifact)
             && artifact.get("proposal_id").and_then(Value::as_str) == Some(id.as_str())
             && artifact.get("proposal_contract_hash") == value.get("base_contract_hash")
             && artifact.get("proposal_flow_hash") == value.get("base_flow_hash")
             && artifact.get("module_versions") == value.get("module_versions");
-        if !bound { return Err(inspection_error(StatusCode::CONFLICT, "preview_invalid", "approval requires a current preview bound to this proposal")); }
+        if !bound {
+            return Err(inspection_error(
+                StatusCode::CONFLICT,
+                "preview_invalid",
+                "approval requires a current preview bound to this proposal",
+            ));
+        }
     }
     if input.status == "applied" {
         let configured = std::env::var("FELTDB_PROPOSAL_AUTHORITY_TOKEN").ok();
-        let supplied = headers.get("FeltDB-Proposal-Authority").and_then(|value| value.to_str().ok());
-        let repository_apply = headers.get("FeltDB-Repository-Apply").and_then(|value| value.to_str().ok()) == Some("1");
-        let authorized = configured.as_deref().zip(supplied).is_some_and(|(expected, actual)| expected.len() == actual.len() && ring::constant_time::verify_slices_are_equal(expected.as_bytes(), actual.as_bytes()).is_ok());
+        let supplied = headers
+            .get("FeltDB-Proposal-Authority")
+            .and_then(|value| value.to_str().ok());
+        let repository_apply = headers
+            .get("FeltDB-Repository-Apply")
+            .and_then(|value| value.to_str().ok())
+            == Some("1");
+        let authorized = configured
+            .as_deref()
+            .zip(supplied)
+            .is_some_and(|(expected, actual)| {
+                expected.len() == actual.len()
+                    && ring::constant_time::verify_slices_are_equal(
+                        expected.as_bytes(),
+                        actual.as_bytes(),
+                    )
+                    .is_ok()
+            });
         if !repository_apply || !authorized {
-            return Err(inspection_error(StatusCode::FORBIDDEN, "repository_authority_required", "valid repository application authority is required"));
+            return Err(inspection_error(
+                StatusCode::FORBIDDEN,
+                "repository_authority_required",
+                "valid repository application authority is required",
+            ));
         }
     }
     if input.status == "approved"
@@ -5857,37 +6712,59 @@ async fn transition_proposal(
         ));
     }
     if input.status == "rejected" {
-        if let Some(reason) = input.reason { value["rejection_reason"] = json!(reason); }
+        if let Some(reason) = input.reason {
+            value["rejection_reason"] = json!(reason);
+        }
     }
-    let mut moved = move_proposal(
-        &state,
-        &id,
-        value,
-        &input.status,
-        &principal.key_id,
-    )?;
+    let mut moved = move_proposal(&state, &id, value, &input.status, &principal.key_id)?;
     redact_inspection_value(&mut moved);
     Ok(Json(moved))
 }
 
 async fn approve_proposal(
-    state: State<AppState>, principal: Extension<Principal>, headers: HeaderMap,
-    path: Path<String>, Json(input): Json<ProposalLifecycleRequest>,
+    state: State<AppState>,
+    principal: Extension<Principal>,
+    headers: HeaderMap,
+    path: Path<String>,
+    Json(input): Json<ProposalLifecycleRequest>,
 ) -> Result<Json<Value>, ApiError> {
-    transition_proposal(state, principal, headers, path, Json(ProposalStatusRequest {
-        application_id: input.application_id, environment: input.environment, status: "approved".into(),
-        approve_authorization: input.approve_authorization, reason: input.reason,
-    })).await
+    transition_proposal(
+        state,
+        principal,
+        headers,
+        path,
+        Json(ProposalStatusRequest {
+            application_id: input.application_id,
+            environment: input.environment,
+            status: "approved".into(),
+            approve_authorization: input.approve_authorization,
+            reason: input.reason,
+        }),
+    )
+    .await
 }
 
 async fn reject_proposal(
-    state: State<AppState>, principal: Extension<Principal>, headers: HeaderMap,
-    path: Path<String>, Json(input): Json<ProposalLifecycleRequest>,
+    state: State<AppState>,
+    principal: Extension<Principal>,
+    headers: HeaderMap,
+    path: Path<String>,
+    Json(input): Json<ProposalLifecycleRequest>,
 ) -> Result<Json<Value>, ApiError> {
-    transition_proposal(state, principal, headers, path, Json(ProposalStatusRequest {
-        application_id: input.application_id, environment: input.environment, status: "rejected".into(),
-        approve_authorization: false, reason: input.reason,
-    })).await
+    transition_proposal(
+        state,
+        principal,
+        headers,
+        path,
+        Json(ProposalStatusRequest {
+            application_id: input.application_id,
+            environment: input.environment,
+            status: "rejected".into(),
+            approve_authorization: false,
+            reason: input.reason,
+        }),
+    )
+    .await
 }
 fn auth_response(
     identity: feltdb_server::identity::Identity,
@@ -5916,17 +6793,18 @@ async fn auth_sign_up(
             "application not found".into(),
         ));
     }
-    let (identity, session, token) = match state
-        .identities
-        .sign_up(&input.email, &input.password, input.display_name)
-    {
-        Ok(created) => created,
-        Err(error) if error == "identity already exists" => state
+    let (identity, session, token) =
+        match state
             .identities
-            .sign_in(&input.email, &input.password)
-            .map_err(|_| ApiError(StatusCode::UNAUTHORIZED, "invalid credentials".into()))?,
-        Err(error) => return Err(ApiError(StatusCode::BAD_REQUEST, error)),
-    };
+            .sign_up(&input.email, &input.password, input.display_name)
+        {
+            Ok(created) => created,
+            Err(error) if error == "identity already exists" => state
+                .identities
+                .sign_in(&input.email, &input.password)
+                .map_err(|_| ApiError(StatusCode::UNAUTHORIZED, "invalid credentials".into()))?,
+            Err(error) => return Err(ApiError(StatusCode::BAD_REQUEST, error)),
+        };
     state
         .tenancy
         .register_platform_user(
@@ -5950,7 +6828,10 @@ async fn auth_sign_in(
         .map_err(|_| ApiError(StatusCode::UNAUTHORIZED, "invalid credentials".into()))?;
     if let Some(application_id) = input.application_id {
         if state.tenancy.application_tenant(&application_id).is_none() {
-            return Err(ApiError(StatusCode::NOT_FOUND, "application not found".into()));
+            return Err(ApiError(
+                StatusCode::NOT_FOUND,
+                "application not found".into(),
+            ));
         }
         state
             .tenancy
@@ -7341,7 +8222,9 @@ fn validate_production_configuration(config: &Config) -> Result<(), Box<dyn std:
     Ok(())
 }
 
-#[tokio::main]
+// Durable stores currently perform bounded synchronous filesystem operations.
+// Keep independent health and API requests schedulable on single-vCPU hosts.
+#[tokio::main(flavor = "multi_thread", worker_threads = 4)]
 async fn main() -> Result<(), Box<dyn std::error::Error>> {
     tracing_subscriber::fmt()
         .with_env_filter(tracing_subscriber::EnvFilter::from_default_env())
@@ -7536,6 +8419,10 @@ async fn main() -> Result<(), Box<dyn std::error::Error>> {
                 .patch(update_application_control)
                 .delete(delete_application_control),
         )
+        .route(
+            "/api/applications/{application_id}/qualification/destroy",
+            axum::routing::post(delete_qualification_application_control),
+        )
         .route(
             "/api/applications/{application_id}/members",
             get(list_application_members),
@@ -7715,10 +8602,19 @@ async fn main() -> Result<(), Box<dyn std::error::Error>> {
             "/v1/proposals/{id}/status",
             get(proposal_status).patch(transition_proposal),
         )
-        .route("/v1/proposals/{id}/convergence", get(proposal_convergence).post(record_proposal_convergence))
+        .route(
+            "/v1/proposals/{id}/convergence",
+            get(proposal_convergence).post(record_proposal_convergence),
+        )
         .route("/v1/previews/{id}", get(get_proposal_preview))
-        .route("/v1/previews/{id}/data/{collection}", get(inspect_proposal_preview_data))
-        .route("/v1/previews/{id}/simulate", axum::routing::post(simulate_proposal_preview))
+        .route(
+            "/v1/previews/{id}/data/{collection}",
+            get(inspect_proposal_preview_data),
+        )
+        .route(
+            "/v1/previews/{id}/simulate",
+            axum::routing::post(simulate_proposal_preview),
+        )
         .route("/v1/auth/session", get(auth_session))
         .route("/v1/auth/signout", axum::routing::post(auth_sign_out))
         .route("/v1/events", get(events))
@@ -8103,9 +8999,15 @@ async fn main() -> Result<(), Box<dyn std::error::Error>> {
         .route("/v1/auth/signup", axum::routing::post(auth_sign_up))
         .route("/v1/auth/signin", axum::routing::post(auth_sign_in))
         .route("/internal/intents/by-hash", get(internal_find_intent))
-        .route("/internal/intents", axum::routing::post(internal_create_intent))
+        .route(
+            "/internal/intents",
+            axum::routing::post(internal_create_intent),
+        )
         .route("/internal/intents/{id}", put(internal_replace_intent))
-        .route("/internal/intent-events", axum::routing::post(internal_create_intent_event))
+        .route(
+            "/internal/intent-events",
+            axum::routing::post(internal_create_intent_event),
+        )
         .route("/ready", get(readiness))
         .route("/runtime", get(runtime))
         .route("/metrics", get(network_metrics))
@@ -8186,7 +9088,14 @@ async fn authenticate(
             .and_then(|header| header.to_str().ok())
             .and_then(|header| header.strip_prefix("Bearer "));
         let machine = token.and_then(|token| state.keys.authenticate(token, &state.namespace));
-        let actor = token.and_then(|token| state.identities.authenticate_session(token));
+        // A valid service key is already authoritative. Do not feed that
+        // high-entropy bearer token through the Argon2-backed human-session
+        // verifier as well; doing so blocks the request worker needlessly.
+        let actor = if machine.is_none() {
+            token.and_then(|token| state.identities.authenticate_session(token))
+        } else {
+            None
+        };
         let human = request
             .headers()
             .get(COOKIE)
@@ -10787,10 +11696,9 @@ fn put_canonical(
 
 /// The authority's current committed-state revision.
 ///
-/// This is the value `apply_atomic_transaction` advances and writes into each
-/// durable transaction record as `state_after`. It already survived restart and
-/// already refused to move backwards; the only thing missing was a way to read
-/// it without performing a write, which is what a cache needs.
+/// This is the commit-level value `apply_atomic_transaction` advances exactly
+/// once per successful transaction. It survives restart and never moves
+/// backwards.
 ///
 /// `scope` is the store's instance id. A revision is comparable only against
 /// another revision carrying the same scope, so a client that fails over to a
@@ -10804,7 +11712,7 @@ struct RevisionResponse {
 
 async fn get_revision(State(state): State<AppState>) -> Result<Json<RevisionResponse>, ApiError> {
     Ok(Json(RevisionResponse {
-        revision: state.db.sequence()?,
+        revision: state.db.current_revision()?,
         scope: state.db.instance_id()?,
     }))
 }
@@ -11087,7 +11995,12 @@ async fn list_records(
     State(state): State<AppState>,
     Path(collection): Path<String>,
 ) -> Result<Json<Vec<RecordResponse>>, ApiError> {
-    if collection == PROPOSAL_COLLECTION || collection == PROPOSAL_EVENT_COLLECTION || collection == CONVERGENCE_COLLECTION || collection == INTENT_COLLECTION || collection == INTENT_EVENT_COLLECTION {
+    if collection == PROPOSAL_COLLECTION
+        || collection == PROPOSAL_EVENT_COLLECTION
+        || collection == CONVERGENCE_COLLECTION
+        || collection == INTENT_COLLECTION
+        || collection == INTENT_EVENT_COLLECTION
+    {
         return Err(ApiError(
             StatusCode::FORBIDDEN,
             "system collection requires proposal service".into(),
@@ -11102,7 +12015,12 @@ async fn get_record(
     State(state): State<AppState>,
     Path((collection, id)): Path<(String, String)>,
 ) -> Result<Json<RecordResponse>, ApiError> {
-    if collection == PROPOSAL_COLLECTION || collection == PROPOSAL_EVENT_COLLECTION || collection == CONVERGENCE_COLLECTION || collection == INTENT_COLLECTION || collection == INTENT_EVENT_COLLECTION {
+    if collection == PROPOSAL_COLLECTION
+        || collection == PROPOSAL_EVENT_COLLECTION
+        || collection == CONVERGENCE_COLLECTION
+        || collection == INTENT_COLLECTION
+        || collection == INTENT_EVENT_COLLECTION
+    {
         return Err(ApiError(
             StatusCode::FORBIDDEN,
             "system collection requires proposal service".into(),
@@ -11184,6 +12102,9 @@ struct AtomicTxRequest {
 #[serde(rename_all = "camelCase")]
 struct AtomicTxResponse {
     transaction_id: String,
+    base_revision: u64,
+    commit_revision: u64,
+    status: feltdb::TransactionStatus,
     /// True when this id had already been committed; nothing was reapplied.
     duplicate: bool,
     operations: usize,
@@ -11335,6 +12256,9 @@ async fn commit_transaction(
         },
         Json(AtomicTxResponse {
             transaction_id: commit.transaction_id,
+            base_revision: commit.base_revision,
+            commit_revision: commit.commit_revision,
+            status: commit.status,
             duplicate: commit.duplicate,
             operations,
             state_before: commit.state_before,
@@ -11348,7 +12272,12 @@ async fn create_record(
     Path(collection): Path<String>,
     Json(mut record): Json<CreateRecord>,
 ) -> Result<(StatusCode, Json<RecordResponse>), ApiError> {
-    if collection == PROPOSAL_COLLECTION || collection == PROPOSAL_EVENT_COLLECTION || collection == CONVERGENCE_COLLECTION || collection == INTENT_COLLECTION || collection == INTENT_EVENT_COLLECTION {
+    if collection == PROPOSAL_COLLECTION
+        || collection == PROPOSAL_EVENT_COLLECTION
+        || collection == CONVERGENCE_COLLECTION
+        || collection == INTENT_COLLECTION
+        || collection == INTENT_EVENT_COLLECTION
+    {
         return Err(ApiError(
             StatusCode::FORBIDDEN,
             "system collection requires proposal service".into(),
@@ -11387,7 +12316,12 @@ async fn update_record(
     Path((collection, id)): Path<(String, String)>,
     Json(changes): Json<Map<String, Value>>,
 ) -> Result<Json<RecordResponse>, ApiError> {
-    if collection == PROPOSAL_COLLECTION || collection == PROPOSAL_EVENT_COLLECTION || collection == CONVERGENCE_COLLECTION || collection == INTENT_COLLECTION || collection == INTENT_EVENT_COLLECTION {
+    if collection == PROPOSAL_COLLECTION
+        || collection == PROPOSAL_EVENT_COLLECTION
+        || collection == CONVERGENCE_COLLECTION
+        || collection == INTENT_COLLECTION
+        || collection == INTENT_EVENT_COLLECTION
+    {
         return Err(ApiError(
             StatusCode::FORBIDDEN,
             "system collection requires proposal service".into(),
@@ -11508,7 +12442,12 @@ async fn delete_record(
     State(state): State<AppState>,
     Path((collection, id)): Path<(String, String)>,
 ) -> Result<StatusCode, ApiError> {
-    if collection == PROPOSAL_COLLECTION || collection == PROPOSAL_EVENT_COLLECTION || collection == CONVERGENCE_COLLECTION || collection == INTENT_COLLECTION || collection == INTENT_EVENT_COLLECTION {
+    if collection == PROPOSAL_COLLECTION
+        || collection == PROPOSAL_EVENT_COLLECTION
+        || collection == CONVERGENCE_COLLECTION
+        || collection == INTENT_COLLECTION
+        || collection == INTENT_EVENT_COLLECTION
+    {
         return Err(ApiError(
             StatusCode::FORBIDDEN,
             "system collection requires proposal service".into(),