@feltdb/core 0.9.0 → 0.10.0

package/dist/create/server-source/crates/feltdb-server/src/main.rs

@@ -76,7 +76,10 @@ use feltdb_server::{
         create_bundle, create_bundle_with_virtual, restore_bundle, select_bundle_at,
         server_artifacts, verify_bundle,
     },
-    causal::{CausalEvent, CausalStore},
+    causal::{
+        decode_cursor, decode_scoped_cursor, encode_cursor, encode_scoped_cursor, CausalEvent,
+        CanonicalEventAuthority,
+    },
     certification::default_report,
     clock::LeaseClock,
     cluster::{ClusterConfig, ClusterStore, MembershipProposal, ProposalPhase},
@@ -89,7 +92,7 @@ use feltdb_server::{
     leases::LeaseStore,
     metrics::Metrics,
     portable_bundle::{BundleArtifact, BundleStore, ExportOptions, ImportMode, PortableBundle},
-    principals::{PrincipalKind, PrincipalStatus, PrincipalStore},
+    principals::{PrincipalKind, PrincipalStatus},
     providers::{ProviderManifest, ProviderStatus, ProviderStore},
     releases::{
         provider_for, AuthorizedDeploymentContext, DeploymentPlan, DeploymentProfile,
@@ -152,15 +155,18 @@ fn api_error_body(status: StatusCode, message: String) -> Value {
     let object = body
         .as_object_mut()
         .expect("normalized error body is an object");
-    let resolved_code = if status == StatusCode::FORBIDDEN {
-        code.to_string()
+    // A scope-bound cursor has a stable public recovery action, so preserve
+    // that code. Other forbidden details retain the non-disclosing canonical
+    // `FORBIDDEN` wire contract.
+    let explicit_code = object.get("code").and_then(Value::as_str);
+    let resolved_code = if status != StatusCode::FORBIDDEN
+        || explicit_code == Some("CURSOR_SCOPE_VIOLATION")
+    {
+        explicit_code.unwrap_or(code)
     } else {
-        object
-            .get("code")
-            .and_then(Value::as_str)
-            .unwrap_or(code)
-            .to_string()
-    };
+        code
+    }
+    .to_string();
     object.insert("error".into(), json!(resolved_code));
     object.insert("code".into(), json!(resolved_code));
     object.entry("message").or_insert_with(|| {
@@ -185,6 +191,11 @@ struct HealthResponse<'a> {
     status: &'a str,
     version: &'a str,
     git_commit: &'a str,
+    build_timestamp: &'a str,
+    release_id: &'a str,
+    deployment_id: String,
+    public_contract: &'a str,
+    capability_fingerprint: String,
     runtime: &'a str,
     storage: &'a str,
     fabric: &'a str,
@@ -542,6 +553,16 @@ struct PreviewSimulationRequest {
 #[derive(Deserialize, Default)]
 struct EventScopeRequest {
     application_id: Option<String>,
+    cursor: Option<String>,
+}
+#[derive(Deserialize)]
+struct PublicEventReplayRequest {
+    application_id: String,
+    #[serde(default = "production_environment")]
+    environment: String,
+    cursor: Option<String>,
+    #[serde(default)]
+    limit: Option<usize>,
 }
 #[derive(Deserialize)]
 struct SignUpRequest {
@@ -1150,6 +1171,11 @@ async fn push_sync(
             operations: vec![operation.operation.clone()],
             preconditions: vec![],
         };
+        let _transaction_permit = state
+            .state_transaction_admission
+            .acquire()
+            .await
+            .expect("transaction admission is never closed");
         match execute_transaction(&state.db, &schema, &transaction, None) {
             Ok(committed) => {
                 let position = state
@@ -1451,6 +1477,18 @@ fn worker_error(error: feltdb::worker_mesh::WorkerMeshError) -> ApiError {
         serde_json::to_string(&error).unwrap_or(error.message),
     )
 }
+fn release_worker_claim_projection(state: &AppState, workload_id: &str, worker_id: &str, claim_id: &str) {
+    match state.mesh.lock() {
+        Ok(mut mesh) => {
+            if let Err(error) = mesh.release_claim(worker_id, claim_id) {
+                tracing::warn!(%workload_id, %claim_id, %error,
+                    "durable work reached a terminal attempt state but the worker mesh projection did not release its claim");
+            }
+        }
+        Err(_) => tracing::warn!(%workload_id, %claim_id,
+            "durable work reached a terminal attempt state but the worker mesh projection was unavailable"),
+    }
+}
 fn workload_decision(
     state: &AppState,
     subject: GrantSubject,
@@ -1502,6 +1540,7 @@ async fn create_workload(
 ) -> Result<(StatusCode, Json<Value>), ApiError> {
     let subject = grant_subject(&principal);
     input.requested_by = subject.clone();
+    input.session_id = principal.session_id.clone();
     let resource = format!("flow://{}/workloads", input.application_id);
     workload_decision(
         &state,
@@ -1754,6 +1793,12 @@ async fn complete_workload(
             unix_seconds_i64(),
         )
         .map_err(workload_error)?;
+    release_worker_claim_projection(
+        &state,
+        &id,
+        &input.fence.worker_id,
+        &input.fence.claim_id,
+    );
     Ok(Json(json!(result)))
 }
 async fn fail_workload(
@@ -1777,6 +1822,12 @@ async fn fail_workload(
             unix_seconds_i64(),
         )
         .map_err(workload_error)?;
+    release_worker_claim_projection(
+        &state,
+        &id,
+        &input.fence.worker_id,
+        &input.fence.claim_id,
+    );
     Ok(Json(json!({"state":status})))
 }
 async fn confirm_workload_cancelled(
@@ -3103,7 +3154,7 @@ async fn append_causal_event(
     event.subject_id = principal.key_id;
     Ok((
         StatusCode::CREATED,
-        Json(json!(state.causal.append(event).map_err(control_error)?)),
+        Json(json!(state.events.append(event).map_err(control_error)?)),
     ))
 }
 async fn certification_report() -> Json<Value> {
@@ -3172,32 +3223,32 @@ async fn causal_events(
         "applications:read",
     )?;
     Ok(Json(
-        json!({"events":state.causal.all().into_iter().filter(|e|e.application_id==scope.application_id).collect::<Vec<_>>() }),
+        json!({"events":state.events.all().map_err(control_error)?.into_iter().filter(|e|e.application_id==scope.application_id).collect::<Vec<_>>() }),
     ))
 }
 async fn causal_chain(
     State(state): State<AppState>,
     Path(id): Path<String>,
 ) -> Result<Json<Value>, ApiError> {
-    Ok(Json(json!({"events":state.causal.list(&id)})))
+    Ok(Json(json!({"events":state.events.list(&id).map_err(control_error)?})))
 }
 async fn workload_timeline(
     State(state): State<AppState>,
     Path(id): Path<String>,
 ) -> Result<Json<Value>, ApiError> {
-    Ok(Json(json!({"events":state.causal.workload(&id)})))
+    Ok(Json(json!({"events":state.events.workload(&id).map_err(control_error)?})))
 }
 async fn execution_timeline(
     State(state): State<AppState>,
     Path(id): Path<String>,
 ) -> Result<Json<Value>, ApiError> {
-    Ok(Json(json!({"events":state.causal.execution(&id)})))
+    Ok(Json(json!({"events":state.events.execution(&id).map_err(control_error)?})))
 }
 async fn revision_timeline(
     State(state): State<AppState>,
     Path(id): Path<String>,
 ) -> Result<Json<Value>, ApiError> {
-    Ok(Json(json!({"events":state.causal.revision(&id)})))
+    Ok(Json(json!({"events":state.events.revision(&id).map_err(control_error)?})))
 }
 async fn export_bundle(
     State(state): State<AppState>,
@@ -5450,14 +5501,13 @@ fn proposal_event(
 ) -> Result<(), ApiError> {
     let id = format!("pe_{}", uuid::Uuid::new_v4().simple());
     let proposal = proposal_value(state, proposal_id).unwrap_or(Value::Null);
-    let event_sequence = state.db.sequence()?.saturating_add(1);
     insert_canonical(
         state,
         PROPOSAL_EVENT_COLLECTION,
         &id,
         json!({ "id":id, "event_id":id, "proposal_id":proposal_id, "event_type":to,
         "from_status":from, "to_status":to, "actor":actor, "created_at":unix_seconds_i64(),
-        "timestamp":unix_seconds_i64(), "event_sequence":event_sequence, "contract_hash":proposal.get("base_contract_hash"),
+        "timestamp":unix_seconds_i64(), "contract_hash":proposal.get("base_contract_hash"),
         "flow_hash":proposal.get("base_flow_hash"), "metadata":{} }),
     )?;
     Ok(())
@@ -5743,15 +5793,25 @@ async fn proposal_history(
         .map(|row| row.value)
         .filter(|value| value.get("proposal_id").and_then(Value::as_str) == Some(id.as_str()))
         .collect();
-    events.sort_by(|left, right| {
-        left.get("event_sequence")
-            .and_then(Value::as_u64)
-            .cmp(&right.get("event_sequence").and_then(Value::as_u64))
-            .then_with(|| {
-                left.get("id")
-                    .and_then(Value::as_str)
-                    .cmp(&right.get("id").and_then(Value::as_str))
-            })
+    let canonical_order = state
+        .db
+        .committed_transactions_after(0, usize::MAX)?
+        .into_iter()
+        .flat_map(|transaction| {
+            transaction
+                .keys
+                .into_iter()
+                .map(move |key| (key, transaction.commit_revision))
+        })
+        .collect::<HashMap<_, _>>();
+    events.sort_by_key(|event| {
+        let key = event
+            .get("id")
+            .and_then(Value::as_str)
+            .and_then(|event_id| record_key(PROPOSAL_EVENT_COLLECTION, event_id).ok())
+            .map(|key| format!("{PROPOSAL_EVENT_COLLECTION}:{key}"));
+        key.and_then(|key| canonical_order.get(&key).copied())
+            .unwrap_or(u64::MAX)
     });
     for event in &mut events {
         redact_inspection_value(event);
@@ -7116,6 +7176,11 @@ async fn run_runtime_action(
         .iter()
         .find(|p| p.resource == definition.collection)
         .and_then(|p| p.write.as_ref().and_then(|s| PolicySubject::from_str(s)));
+    let _transaction_permit = state
+        .state_transaction_admission
+        .acquire()
+        .await
+        .expect("transaction admission is never closed");
     Ok(Json(json!(execute_transaction(
         &state.db,
         &contract.state.schema,
@@ -7448,7 +7513,7 @@ fn state_authorization_legacy(
 fn state_contract_error(error: feltdb::state_contract::StateFailure) -> ApiError {
     let status = match error.code.as_str() {
         "AUTHORIZATION_DENIED" => StatusCode::FORBIDDEN,
-        "PRECONDITION_FAILED" | "CONFLICT" => StatusCode::CONFLICT,
+        "PRECONDITION_FAILED" | "CONFLICT" | "IDEMPOTENCY_CONFLICT" => StatusCode::CONFLICT,
         "UNKNOWN_COLLECTION" => StatusCode::NOT_FOUND,
         "STORAGE_FAILURE" | "STATE_UNAVAILABLE" => StatusCode::SERVICE_UNAVAILABLE,
         _ => StatusCode::UNPROCESSABLE_ENTITY,
@@ -7513,17 +7578,29 @@ async fn get_state_version(
         json!({"application_id":target.application_id,"revision_id":contract.revision_id,"schema_version":contract.state.schema.schema_version,"state_version":state.db.sequence()?,"causal_cursor":state.db.operation_versions()?,"state_namespace":contract.environment.state_namespace}),
     ))
 }
+fn require_bound_tenant(headers: &HeaderMap, tenant: &str) -> Result<(), ApiError> {
+    let Some(bound) = headers.get("feltdb-tenant-id") else { return Ok(()); };
+    if bound.to_str().ok() == Some(tenant) { return Ok(()); }
+    Err(ApiError(StatusCode::FORBIDDEN, json!({
+        "code":"AUTHORITY_SCOPE_MISMATCH",
+        "message":"request tenant does not match the authenticated application authority",
+        "http_status":403
+    }).to_string()))
+}
+
 async fn execute_canonical_query(
     State(state): State<AppState>,
     Extension(principal): Extension<Principal>,
+    headers: HeaderMap,
     Json(input): Json<CanonicalQueryRequest>,
 ) -> Result<Json<Value>, ApiError> {
-    let _ = application_scope(
+    let tenant = application_scope(
         &state,
         &principal.key_id,
         &input.application_id,
         "state:read",
     )?;
+    require_bound_tenant(&headers, &tenant)?;
     let contract = revision_contract(
         &state,
         &principal.key_id,
@@ -7718,6 +7795,7 @@ async fn execute_revision_recovery(
 async fn execute_canonical_transaction(
     State(state): State<AppState>,
     Extension(principal): Extension<Principal>,
+    headers: HeaderMap,
     Json(mut input): Json<CanonicalTransactionRequest>,
 ) -> Result<Json<Value>, ApiError> {
     let tenant = application_scope(
@@ -7726,6 +7804,7 @@ async fn execute_canonical_transaction(
         &input.application_id,
         "state:write",
     )?;
+    require_bound_tenant(&headers, &tenant)?;
     let contract = revision_contract(
         &state,
         &principal.key_id,
@@ -7733,6 +7812,13 @@ async fn execute_canonical_transaction(
         &input.revision_id,
         &input.environment,
     )?;
+    if !input.transaction.tenant_id.is_empty() && input.transaction.tenant_id != tenant {
+        return Err(ApiError(StatusCode::FORBIDDEN, json!({
+            "code":"AUTHORITY_SCOPE_MISMATCH",
+            "message":"transaction tenant does not match the bound authority",
+            "http_status":403
+        }).to_string()));
+    }
     input.transaction.tenant_id = tenant.clone();
     input.transaction.application_id = input.application_id.clone();
     input.transaction.revision_id = contract.revision_id.clone();
@@ -7757,6 +7843,11 @@ async fn execute_canonical_transaction(
             "state:denied"
         },
     );
+    let _transaction_permit = state
+        .state_transaction_admission
+        .acquire()
+        .await
+        .expect("transaction admission is never closed");
     let result = execute_transaction_with_collection_policies(
         &state.db,
         &contract.state.schema,
@@ -7772,7 +7863,13 @@ async fn execute_canonical_transaction(
         "allowed",
         201,
     );
-    Ok(Json(json!(result)))
+    let attribution = state.db.transaction_attribution(&result.transaction_id)?;
+    let mut response = json!(result);
+    response["revision_id"] = json!(format!("revision-{}", result.commit_revision));
+    response["operation_ids"] = json!(attribution
+        .map(|value| value.operation_ids)
+        .unwrap_or_default());
+    Ok(Json(response))
 }
 
 async fn get_cardinality_diagnostic(
@@ -8367,7 +8464,12 @@ async fn main() -> Result<(), Box<dyn std::error::Error>> {
     let grant_signer = GrantSigner::new("feltdb-primary-v1", grant_key.to_vec())?;
     let grant_store = GrantStore::load(config.data.with_extension("grants.json"))?;
     let sync_store = SyncStore::load(config.data.with_extension("sync.json"))?;
-    let workload_store = WorkloadStore::load(config.data.with_extension("workloads.json"))?;
+    let legacy_workloads = config.data.with_extension("workloads.json");
+    let workload_store = if legacy_workloads.exists() {
+        WorkloadStore::migrate_legacy_file(db.clone(), &legacy_workloads)?
+    } else {
+        WorkloadStore::from_db(db.clone())?
+    };
     let state_trigger_store = StateTriggerStore::load(config.data.with_extension("triggers.json"))?;
     let mesh_store = WorkerMeshStore::load(config.data.with_extension("workers.json"))?;
     let content_store = ContentStore::new(config.data.with_extension("content"))?;
@@ -8377,9 +8479,28 @@ async fn main() -> Result<(), Box<dyn std::error::Error>> {
     )?;
     let bundle_store = BundleStore::load(config.data.with_extension("bundles.json"))?;
     let release_store = ReleaseStore::load(config.data.with_extension("releases.json"))?;
-    let causal_store = CausalStore::load(config.data.with_extension("causal-events.json"))?;
+    let event_authority = CanonicalEventAuthority::new(db.clone());
+    let legacy_causal = config.data.with_extension("causal-events.json");
+    if legacy_causal.exists() {
+        event_authority.migrate_legacy_file(&legacy_causal)?;
+    }
     let provider_store = ProviderStore::load(config.data.with_extension("providers.json"))?;
     let readiness_probe = config.data.with_extension("readiness");
+    let tenancy_store = TenancyStore::load(config.data.with_extension("platform.json"))?;
+    let application_store = ApplicationStore::load(config.data.with_extension("applications.json"))?;
+    let principal_authority =
+        feltdb_server::canonical_principals::CanonicalPrincipalAuthority::new(db.clone());
+    let legacy_principals = config.data.with_extension("principals.json");
+    if legacy_principals.exists() {
+        principal_authority.migrate_legacy_file(&legacy_principals, |application_id| {
+            feltdb_server::canonical_principals::resolve_principal_tenant(
+                application_id,
+                &tenancy_store,
+                &application_store,
+                &db,
+            )
+        })?;
+    }
     // Constructed before the state so the same handle can be stopped after
     // serving: the pipeline outlives the router by exactly one shutdown.
     let audit_handle = AuditLog::new(config.audit.clone());
@@ -8405,13 +8526,14 @@ async fn main() -> Result<(), Box<dyn std::error::Error>> {
         peer_client,
         peer_token,
         lifecycle_lock: Arc::new(tokio::sync::Mutex::new(())),
+        state_transaction_admission: Arc::new(tokio::sync::Semaphore::new(2)),
         worker_enabled: config.worker_enabled,
         leases: LeaseStore::load(config.data.with_extension("leases.json"))?,
         content: content_store,
         artifacts: artifact_store,
         bundles: bundle_store,
         releases: release_store,
-        causal: causal_store,
+        events: event_authority,
         providers: provider_store,
         contracts: ApplicationContractStore::load(
             config.data.with_extension("application-contracts.json"),
@@ -8420,14 +8542,14 @@ async fn main() -> Result<(), Box<dyn std::error::Error>> {
         lease_clock: LeaseClock::new(config.maximum_clock_drift_ms),
         backup_barrier: Arc::new(tokio::sync::RwLock::new(())),
         backup_artifacts: Arc::new(backup_artifacts),
-        tenancy: TenancyStore::load(config.data.with_extension("platform.json"))?,
+        tenancy: tenancy_store,
         sessions: SessionVerifier::load(
             std::env::var("FELTDB_SESSION_SECRET")
                 .unwrap_or_else(|_| "feltdb-development-session-secret-change-me".into())
                 .into_bytes(),
             config.data.with_extension("revoked-sessions.json"),
         )?,
-        principals: PrincipalStore::load(config.data.with_extension("principals.json"))?,
+        principals: principal_authority,
         connections: ConnectionStore::load_with_provider(
             config.data.with_extension("connections.json"),
             provider_from_environment(
@@ -8436,7 +8558,7 @@ async fn main() -> Result<(), Box<dyn std::error::Error>> {
             )?,
         )?,
         identities: IdentityStore::load(config.data.with_extension("identities.json"))?,
-        applications: ApplicationStore::load(config.data.with_extension("applications.json"))?,
+        applications: application_store,
         runtimes: RuntimeStore::load(config.data.with_extension("application-runtimes.json"))?,
         grant_signer,
         grants: Arc::new(std::sync::Mutex::new(grant_store)),
@@ -8775,6 +8897,7 @@ async fn main() -> Result<(), Box<dyn std::error::Error>> {
         .route("/v1/auth/session", get(auth_session))
         .route("/v1/auth/signout", axum::routing::post(auth_sign_out))
         .route("/v1/events", get(events))
+        .route("/v1/public/events/replay", get(public_event_replay))
         .route(
             "/v1/workflows/{name}/run",
             axum::routing::post(start_workflow_run),
@@ -9810,6 +9933,13 @@ async fn health(State(state): State<AppState>) -> Json<HealthResponse<'static>>
         status: overall_status(membership == "healthy", clock, &database.storage),
         version: env!("CARGO_PKG_VERSION"),
         git_commit: option_env!("FELTDB_GIT_COMMIT").unwrap_or("unknown"),
+        build_timestamp: option_env!("FELTDB_BUILD_TIMESTAMP").unwrap_or("unknown"),
+        release_id: option_env!("FELTDB_RELEASE_ID").unwrap_or("unknown"),
+        deployment_id: std::env::var("FELTDB_DEPLOYMENT_ID")
+            .or_else(|_| std::env::var("FLY_IMAGE_REF"))
+            .unwrap_or_else(|_| "unknown".into()),
+        public_contract: "feltdb.public.substrate@1.0",
+        capability_fingerprint: control_plane::public_contract_capability_fingerprint(),
         runtime: "self-hosted",
         storage: database.storage.label(),
         fabric: "healthy",
@@ -10051,8 +10181,7 @@ fn manage_workloads() -> Result<bool, Box<dyn std::error::Error>> {
             .and_then(|i| arguments.get(i + 1))
             .cloned()
     };
-    let path =
-        PathBuf::from(option("--store").unwrap_or_else(|| "./data/feltdb.workloads.json".into()));
+    let path = PathBuf::from(option("--data").unwrap_or_else(|| "./data/feltdb.log".into()));
     let mut store = WorkloadStore::load(path)?;
     if family == "worker" || family == "mesh" {
         let mesh_path = PathBuf::from(
@@ -10105,17 +10234,13 @@ fn manage_state_triggers() -> Result<bool, Box<dyn std::error::Error>> {
         ),
         "evaluate" => {
             let db = FeltDb::open(&data)?;
-            let workload_path = PathBuf::from(
-                option("--workload-store")
-                    .unwrap_or_else(|| data.with_extension("workloads.json").to_string_lossy().into_owned()),
-            );
-            let mut workloads = WorkloadStore::load(workload_path)?;
+            let mut workloads = WorkloadStore::from_db(db.clone())?;
             let produced = triggers.evaluate(&db, &mut workloads, unix_seconds_i64())?;
             println!("{}", serde_json::to_string_pretty(&produced)?);
         }
         _ => {
             return Err(
-                "usage: feltdb-server trigger <define|list|status|evaluate> [--data path] [--store path] [--workload-store path] [--input trigger.json]"
+                "usage: feltdb-server trigger <define|list|status|evaluate> [--data path] [--store path] [--input trigger.json]"
                     .into(),
             )
         }
@@ -13126,7 +13251,7 @@ async fn get_record(
 }
 
 /// One operation inside an application transaction.
-#[derive(Deserialize)]
+#[derive(Deserialize, Serialize)]
 #[serde(rename_all = "camelCase")]
 struct AtomicTxOperationRequest {
     collection: String,
@@ -13156,7 +13281,7 @@ struct AtomicTxOperationRequest {
 /// fencing routinely guards on a record it does not modify -- a session
 /// generation, an ownership epoch -- and expressing that as a no-op write would
 /// make the guard a mutation.
-#[derive(Deserialize)]
+#[derive(Deserialize, Serialize)]
 #[serde(rename_all = "camelCase")]
 struct AtomicTxPreconditionRequest {
     collection: String,
@@ -13171,7 +13296,7 @@ struct AtomicTxPreconditionRequest {
     expected_lease_id: Option<String>,
 }
 
-#[derive(Deserialize)]
+#[derive(Deserialize, Serialize)]
 #[serde(rename_all = "camelCase")]
 struct AtomicTxRequest {
     /// Caller-supplied identity. Reusing one makes the commit idempotent.
@@ -13196,6 +13321,8 @@ struct AtomicTxResponse {
     operations: usize,
     state_before: u64,
     state_after: u64,
+    revision_id: String,
+    operation_ids: Vec<String>,
 }
 
 /// Commit several operations as one atomic, durable transaction.
@@ -13224,6 +13351,16 @@ async fn commit_transaction(
         ));
     }
 
+    // The authority, not the adapter, binds idempotency identity to semantic
+    // input. This digest is written in the same transaction record as the
+    // mutations and retained across compaction.
+    let payload_hash = format!(
+        "sha256:{:x}",
+        Sha256::digest(serde_json::to_vec(&request).map_err(|error| {
+            ApiError(StatusCode::BAD_REQUEST, error.to_string())
+        })?)
+    );
+
     // Validate every operation before any of them is turned into a mutation, so
     // a malformed request cannot commit a prefix of the transaction.
     let mut mutations = Vec::with_capacity(request.operations.len());
@@ -13309,7 +13446,7 @@ async fn commit_transaction(
         .db
         .apply_atomic_transaction_guarded(
             &request.transaction_id,
-            None,
+            Some(&payload_hash),
             None,
             &[],
             &record_preconditions,
@@ -13332,9 +13469,27 @@ async fn commit_transaction(
                         "failure": *failure,
                     }),
                 ),
+                FlowError::CapabilityError(message)
+                    if message.starts_with("TRANSACTION_ID_PAYLOAD_MISMATCH:") =>
+                {
+                    ApiError::structured(
+                        StatusCode::CONFLICT,
+                        json!({
+                            "committed": false,
+                            "code": "IDEMPOTENCY_CONFLICT",
+                            "error": "transaction identity is already bound to different semantic input",
+                            "transaction_id": request.transaction_id,
+                        }),
+                    )
+                }
                 other => ApiError(StatusCode::CONFLICT, other.to_string()),
             }
         })?;
+    let operation_ids = state
+        .db
+        .transaction_attribution(&commit.transaction_id)?
+        .map(|value| value.operation_ids)
+        .unwrap_or_default();
 
     Ok((
         if commit.duplicate {
@@ -13351,6 +13506,8 @@ async fn commit_transaction(
             operations,
             state_before: commit.state_before,
             state_after: commit.state_after,
+            revision_id: format!("revision-{}", commit.commit_revision),
+            operation_ids,
         }),
     ))
 }
@@ -13563,6 +13720,7 @@ async fn delete_record(
 async fn events(
     State(state): State<AppState>,
     Extension(principal): Extension<Principal>,
+    headers: HeaderMap,
     Query(scope): Query<EventScopeRequest>,
 ) -> Result<Sse<impl futures_core::Stream<Item = Result<Event, Infallible>>>, ApiError> {
     if !principal.permits("events:read") {
@@ -13571,39 +13729,137 @@ async fn events(
             "event access is not permitted".into(),
         ));
     }
-    if let Some(application_id) = scope.application_id {
+    if let Some(application_id) = scope.application_id.as_ref() {
         application_scope(&state, &principal.key_id, &application_id, "events:read")?;
     }
-    let mut receiver = state.db.subscribe_changes();
-    let namespace = state.namespace.clone();
-    let actor = principal.key_id;
+    let requested_cursor = scope.cursor.as_deref().or_else(|| {
+        headers
+            .get("last-event-id")
+            .and_then(|value| value.to_str().ok())
+    });
+    let mut revision = requested_cursor
+        .map(decode_cursor)
+        .transpose()
+        .map_err(control_error)?
+        .unwrap_or_default();
+    let authority = state.events.clone();
+    let application_id = scope.application_id;
+    let mut pending = authority.after(revision, 256).map_err(control_error)?;
     let stream = async_stream::stream! {
         loop {
-            match receiver.recv().await {
-                Ok(change) => {
-                    let resource = change.capability.clone();
-                    let resource_id = change.key.split_once(':').map(|(_, id)| id).unwrap_or(&change.key);
-                    let data = json!({
-                        "event_id": uuid::Uuid::new_v4().to_string(),
-                        "type": "state.changed",
-                        "resource": resource,
-                        "resource_id": resource_id,
-                        "actor": actor,
-                        "timestamp": unix_seconds_i64().max(0) as u64,
-                        "payload": { "operation": "mutation", "namespace": namespace.as_ref() }
-                    });
-                    yield Ok(Event::default().event("state.changed").json_data(data).expect("serializable event"));
-                }
-                Err(tokio::sync::broadcast::error::RecvError::Lagged(skipped)) => {
-                    yield Ok(Event::default().event("stream.lagged").data(skipped.to_string()));
+            for event in pending.drain(..) {
+                let event_revision = event
+                    .state_version
+                    .as_deref()
+                    .and_then(|value| value.parse::<u64>().ok())
+                    .unwrap_or(revision);
+                revision = revision.max(event_revision);
+                if application_id
+                    .as_ref()
+                    .is_some_and(|application| event.application_id != *application)
+                {
+                    continue;
                 }
-                Err(tokio::sync::broadcast::error::RecvError::Closed) => break,
+                let cursor = encode_cursor(revision);
+                yield Ok(Event::default()
+                    .id(cursor)
+                    .event("state.committed")
+                    .json_data(event)
+                    .expect("serializable event"));
             }
+            tokio::time::sleep(Duration::from_millis(250)).await;
+            pending = match authority.after(revision, 256) {
+                Ok(committed) => committed,
+                Err(error) => {
+                    yield Ok(Event::default().event("authority.error").data(error));
+                    break;
+                }
+            };
         }
     };
     Ok(Sse::new(stream).keep_alive(KeepAlive::new().interval(Duration::from_secs(15))))
 }
 
+/// Bounded JSON replay over canonical committed history.
+///
+/// The cursor is bound to this authority and application. It is deliberately
+/// not interchangeable with a cursor from another tenant/application scope.
+async fn public_event_replay(
+    State(state): State<AppState>,
+    Extension(principal): Extension<Principal>,
+    headers: HeaderMap,
+    Query(request): Query<PublicEventReplayRequest>,
+) -> Result<Json<Value>, ApiError> {
+    if !principal.permits("events:read") {
+        return Err(ApiError::structured(
+            StatusCode::FORBIDDEN,
+            json!({"code":"FORBIDDEN","message":"event access is not permitted"}),
+        ));
+    }
+    let tenant = application_scope(
+        &state,
+        &principal.key_id,
+        &request.application_id,
+        "events:read",
+    )?;
+    require_bound_tenant(&headers, &tenant)?;
+    let instance_id = state.db.instance_id()?;
+    let cursor_scope = format!("{instance_id}:{tenant}:{}", request.application_id);
+    let mut revision = match request.cursor.as_deref() {
+        Some(cursor) => decode_scoped_cursor(&cursor_scope, cursor).map_err(|code| {
+            let status = if code == "CURSOR_SCOPE_VIOLATION" {
+                StatusCode::FORBIDDEN
+            } else {
+                StatusCode::BAD_REQUEST
+            };
+            ApiError::structured(
+                status,
+                json!({"code":code,"message":"event cursor is invalid for this authority scope"}),
+            )
+        })?,
+        None => 0,
+    };
+    let limit = request.limit.unwrap_or(100).clamp(1, 256);
+    let mut projected = Vec::new();
+    loop {
+        let batch = state.events.after(revision, 256).map_err(control_error)?;
+        let batch_len = batch.len();
+        if batch_len == 0 {
+            break;
+        }
+        for mut event in batch {
+            let event_revision = event
+                .state_version
+                .as_deref()
+                .and_then(|value| value.parse::<u64>().ok())
+                .unwrap_or(revision);
+            revision = revision.max(event_revision);
+            if event.application_id != request.application_id {
+                continue;
+            }
+            event.metadata.insert(
+                "cursor".into(),
+                Value::String(encode_scoped_cursor(&cursor_scope, event_revision)),
+            );
+            projected.push(event);
+            if projected.len() == limit {
+                break;
+            }
+        }
+        if projected.len() == limit || batch_len < 256 {
+            break;
+        }
+    }
+    Ok(Json(json!({
+        "contract_version":"1.0",
+        "cursor_format":"fh1",
+        "application_id":request.application_id,
+        "environment":request.environment,
+        "events":projected,
+        "next_cursor":encode_scoped_cursor(&cursor_scope, revision),
+    })))
+}
+
 fn record_response(row: StoredRow) -> RecordResponse {
     let id = row
         .key
@@ -13690,19 +13946,84 @@ struct ControlPlaneScope {
     environment: String,
 }
 
+fn authority_state_summary(
+    current_sequence: u64,
+    events: u64,
+    cardinalities: &[(String, u64)],
+    namespace_prefix: &str,
+) -> Value {
+    let collections = cardinalities
+        .iter()
+        .filter(|(capability, count)| *capability != "state" && *count > 0)
+        .map(|(capability, count)| {
+            json!({
+                "collection": capability.strip_prefix(namespace_prefix).unwrap_or(capability),
+                "records": count,
+            })
+        })
+        .collect::<Vec<_>>();
+    let records = collections
+        .iter()
+        .filter_map(|entry| entry["records"].as_u64())
+        .sum::<u64>();
+    json!({
+        "current_sequence": current_sequence,
+        "records": records,
+        "events": events,
+        "collections": collections,
+    })
+}
+
+#[cfg(test)]
+mod studio_state_summary_tests {
+    use super::authority_state_summary;
+    use serde_json::json;
+
+    #[test]
+    fn fresh_authority_is_a_truthful_zero_summary() {
+        assert_eq!(
+            authority_state_summary(0, 0, &[], "default:"),
+            json!({"current_sequence":0,"records":0,"events":0,"collections":[]})
+        );
+    }
+
+    #[test]
+    fn summary_counts_live_authority_rows_without_counting_revision_infrastructure() {
+        let cardinalities = vec![
+            ("_feltdb.Intent".to_string(), 1),
+            ("_feltdb.IntentEvent".to_string(), 2),
+            ("state".to_string(), 7),
+            ("empty".to_string(), 0),
+        ];
+        assert_eq!(
+            authority_state_summary(4, 4, &cardinalities, "default:"),
+            json!({
+                "current_sequence":4,
+                "records":3,
+                "events":4,
+                "collections":[
+                    {"collection":"_feltdb.Intent","records":1},
+                    {"collection":"_feltdb.IntentEvent","records":2}
+                ]
+            })
+        );
+    }
+}
+
 /// Instance, authority, runtime, storage and activity in one document.
 ///
 /// One request rather than eight, because an overview whose panels arrive
 /// independently shows eight moments and calls them one instant.
 async fn control_plane_overview(State(state): State<AppState>) -> Result<Json<Value>, ApiError> {
     let db = state.db.clone();
-    let (state_version, authority_revision, instance_id, cardinalities, log) =
+    let (state_version, authority_revision, instance_id, cardinalities, events, log) =
         tokio::task::spawn_blocking(move || {
             Ok::<_, FlowError>((
                 db.sequence()?,
                 db.current_revision()?,
                 db.instance_id()?,
                 db.list_cardinalities()?,
+                db.operations_since(&HashMap::new())?.len() as u64,
                 db.log_recovery(),
             ))
         })
@@ -13730,6 +14051,12 @@ async fn control_plane_overview(State(state): State<AppState>) -> Result<Json<Va
         .find(|(capability, _)| capability == "state")
         .map(|(_, count)| *count)
         .unwrap_or(0);
+    // This is the authority-wide materialized view used by Studio's State
+    // summary. Unlike the application-oriented `storage.collections` above,
+    // it deliberately includes `_feltdb.*` system collections. State revision
+    // rows are history infrastructure rather than current materialized records
+    // and remain reported separately as `storage.state_revisions`.
+    let authority_state = authority_state_summary(state_version, events, &cardinalities, &prefix);
     Ok(Json(json!({
         "instance": {
             "instance_id": instance_id,
@@ -13745,6 +14072,7 @@ async fn control_plane_overview(State(state): State<AppState>) -> Result<Json<Va
             "lease_clock_healthy": state.lease_clock.is_healthy(),
             "advertise_url": state.advertise_url.as_ref().map(|value| value.to_string()),
         },
+        "authority_state": authority_state,
         "storage": {
             "records": records,
             "state_revisions": revisions,
@@ -14232,10 +14560,37 @@ async fn control_plane_transaction(
     let db = state.db.clone();
     let id = transaction_id.clone();
     let (applied, attribution) = tokio::task::spawn_blocking(move || {
-        Ok::<_, FlowError>((
-            db.has_applied_transaction(&id)?,
-            db.transaction_attribution(&id)?,
-        ))
+        let direct = db.transaction_attribution(&id)?;
+        let mut public_matches = if direct.is_none() {
+            db.committed_transactions_after(0, usize::MAX)?
+                .into_iter()
+                .filter(|value| {
+                    value
+                        .audit
+                        .as_ref()
+                        .and_then(|audit| audit.get("transaction_id"))
+                        .and_then(Value::as_str)
+                        == Some(id.as_str())
+                })
+                .collect::<Vec<_>>()
+        } else {
+            Vec::new()
+        };
+        if public_matches.len() > 1 {
+            return Err(FlowError::CapabilityError(
+                "PUBLIC_TRANSACTION_ID_AMBIGUOUS".into(),
+            ));
+        }
+        let mut attribution = direct.or_else(|| public_matches.pop());
+        let storage_id = attribution
+            .as_ref()
+            .map(|value| value.transaction_id.as_str())
+            .unwrap_or(id.as_str());
+        let applied = db.has_applied_transaction(storage_id)?;
+        if let Some(value) = attribution.as_mut() {
+            value.transaction_id = id;
+        }
+        Ok::<_, FlowError>((applied, attribution))
     })
     .await
     .map_err(|error| ApiError(StatusCode::INTERNAL_SERVER_ERROR, error.to_string()))??;
@@ -15002,8 +15357,8 @@ mod worker_identity_tests {
 
 #[cfg(test)]
 mod authority_gate_tests {
-    use super::{api_error_body, authorize_transaction_collections, state_authorization};
-    use axum::http::StatusCode;
+    use super::{api_error_body, authorize_transaction_collections, require_bound_tenant, state_authorization};
+    use axum::http::{HeaderMap, HeaderValue, StatusCode};
     use feltdb::{
         application::{
             manifest_hash, ApplicationManifest, ApplicationRevision, PolicyDefinition,
@@ -15111,6 +15466,17 @@ mod authority_gate_tests {
         assert!(!allowed);
     }
 
+    #[test]
+    fn bound_tenant_header_fails_closed_on_mismatch() {
+        let mut headers = HeaderMap::new();
+        headers.insert("feltdb-tenant-id", HeaderValue::from_static("tenant-a"));
+        assert!(require_bound_tenant(&headers, "tenant-a").is_ok());
+        let error = require_bound_tenant(&headers, "tenant-b").unwrap_err();
+        assert_eq!(error.0, StatusCode::FORBIDDEN);
+        let body: serde_json::Value = serde_json::from_str(&error.1).unwrap();
+        assert_eq!(body.get("code").and_then(serde_json::Value::as_str), Some("AUTHORITY_SCOPE_MISMATCH"));
+    }
+
     #[test]
     fn every_forbidden_error_uses_the_canonical_wire_contract() {
         for internal_message in [