@fuzdev/fuz_app 0.144.0 → 0.145.0

package/dist/db/CLAUDE.md

@@ -177,9 +177,13 @@ records who holds them. Optional — minimal consumers never migrate it.
 DO NOTHING`), `_put_fact_refs`, `_get_fact` / `_get_fact_meta` / `_has_fact`
   / `_get_fact_refs`, `_delete_fact` (returns `{size, external_url}` for
   external unlink), and the cell-coupled orphan queries `query_orphan_facts_list`
-  / `_select_for_delete` (a fact is orphan when no active `cell.refs` names it).
+  / `_select_for_delete` (a fact is orphan when no active `cell.refs` names it;
+  the `older_than` cutoff keeps a fact whose `created_at` or any
+  `fact_holder.created_at` is within the window, so a deduplicated re-upload
+  survives any sweep whose window covers it).
 - **`fact_holder_queries.ts`** — `FACT_HOLDER_COLUMNS`, `query_put_fact_holder`
-  (idempotent), and the admission reads `query_fact_holder_table_exists` /
+  (idempotent upsert — a repeat put refreshes the row's `created_at` to the
+  most recent put), and the admission reads `query_fact_holder_table_exists` /
   `query_fact_holder_unheld` (answered from holder rows alone).
 - **`fact_store.ts`** — `PgFactStore`, implementing `HeldFactStore` (reads per
   the `@fuzdev/fuz_util/fact_store.ts` `FactStore` contract; puts take
@@ -212,7 +216,7 @@ DO NOTHING`), `_put_fact_refs`, `_get_fact` / `_get_fact_meta` / `_has_fact`
 - **`fact_store_errors.ts`** — `FactPayloadTooLargeError` / `FactStorageFullError` (+
   `is_enospc_error`) thrown by `put_stream`, for a consumer route's 413 / 507.
 - The HTTP serving plumbing lives under `server/` (`serve_fact_route.ts`,
-  `x_accel.ts`).
+  `x_accel.ts`, `fact_security_headers.ts`).
 
 ### Migration namespace order
 

package/dist/db/fact_ddl.d.ts

@@ -48,6 +48,7 @@ export declare const MEMOS_SCHEMA = "\nCREATE TABLE IF NOT EXISTS memo (\n\tfn_i
  * Both FKs cascade: deleting an actor erases its possession, and deleting a
  * fact (the orphan sweep) drops its holders. The primary key leads with
  * `actor_id`, serving the admission lookup and the actor-side cascade.
+ * `created_at` is the holder's most recent put, not the first.
  */
 export declare const FACT_HOLDER_SCHEMA = "\nCREATE TABLE IF NOT EXISTS fact_holder (\n\tactor_id UUID NOT NULL REFERENCES actor(id) ON DELETE CASCADE,\n\thash TEXT NOT NULL REFERENCES fact(hash) ON DELETE CASCADE,\n\tcreated_at TIMESTAMPTZ NOT NULL DEFAULT NOW(),\n\tPRIMARY KEY (actor_id, hash)\n)";
 /** Serves the fact-side cascade of `fact_holder`. */

package/dist/db/fact_ddl.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"fact_ddl.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/db/fact_ddl.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AAGH,OAAO,KAAK,EAAE,SAAS,EAAE,kBAAkB,EAAE,MAAM,cAAc,CAAC;AAElE,mDAAmD;AACnD,eAAO,MAAM,YAAY,qSASvB,CAAC;AAEH;;;;GAIG;AACH,eAAO,MAAM,gBAAgB,6LAK3B,CAAC;AAEH,4DAA4D;AAC5D,eAAO,MAAM,sBAAsB,8EACqC,CAAC;AAEzE,oFAAoF;AACpF,eAAO,MAAM,YAAY,mNAOvB,CAAC;AAEH;;;;;;;GAOG;AACH,eAAO,MAAM,kBAAkB,qQAM7B,CAAC;AAEH,qDAAqD;AACrD,eAAO,MAAM,sBAAsB,2EACkC,CAAC;AAEtE,6EAA6E;AAC7E,eAAO,MAAM,gBAAgB,sDAAuD,CAAC;AAErF,sFAAsF;AACtF,eAAO,MAAM,eAAe,EAAE,KAAK,CAAC,SAAS,CAiB5C,CAAC;AAEF,uDAAuD;AACvD,eAAO,MAAM,wBAAwB,cAAc,CAAC;AAEpD,wDAAwD;AACxD,eAAO,MAAM,iBAAiB,EAAE,kBAG/B,CAAC"}
+{"version":3,"file":"fact_ddl.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/db/fact_ddl.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AAGH,OAAO,KAAK,EAAE,SAAS,EAAE,kBAAkB,EAAE,MAAM,cAAc,CAAC;AAElE,mDAAmD;AACnD,eAAO,MAAM,YAAY,qSASvB,CAAC;AAEH;;;;GAIG;AACH,eAAO,MAAM,gBAAgB,6LAK3B,CAAC;AAEH,4DAA4D;AAC5D,eAAO,MAAM,sBAAsB,8EACqC,CAAC;AAEzE,oFAAoF;AACpF,eAAO,MAAM,YAAY,mNAOvB,CAAC;AAEH;;;;;;;;GAQG;AACH,eAAO,MAAM,kBAAkB,qQAM7B,CAAC;AAEH,qDAAqD;AACrD,eAAO,MAAM,sBAAsB,2EACkC,CAAC;AAEtE,6EAA6E;AAC7E,eAAO,MAAM,gBAAgB,sDAAuD,CAAC;AAErF,sFAAsF;AACtF,eAAO,MAAM,eAAe,EAAE,KAAK,CAAC,SAAS,CAiB5C,CAAC;AAEF,uDAAuD;AACvD,eAAO,MAAM,wBAAwB,cAAc,CAAC;AAEpD,wDAAwD;AACxD,eAAO,MAAM,iBAAiB,EAAE,kBAG/B,CAAC"}

package/dist/db/fact_ddl.js

@@ -69,6 +69,7 @@ CREATE TABLE IF NOT EXISTS memo (
  * Both FKs cascade: deleting an actor erases its possession, and deleting a
  * fact (the orphan sweep) drops its holders. The primary key leads with
  * `actor_id`, serving the admission lookup and the actor-side cascade.
+ * `created_at` is the holder's most recent put, not the first.
  */
 export const FACT_HOLDER_SCHEMA = `
 CREATE TABLE IF NOT EXISTS fact_holder (

package/dist/db/fact_holder_queries.d.ts

@@ -9,7 +9,7 @@
  * ref only for a fact the acting actor holds.
  *
  * Same discipline as `db/fact_queries.ts`: `deps: QueryDeps` first (the caller
- * owns the transaction), no audit side effects, idempotent inserts.
+ * owns the transaction), no audit side effects, idempotent writes.
  *
  * @module
  */
@@ -31,13 +31,17 @@ export interface FactHolderRow {
  */
 export declare const FACT_HOLDER_COLUMNS: readonly ["actor_id", "hash", "created_at"];
 /**
- * Record `actor_id` as a holder of `hash`. Idempotent (`ON CONFLICT DO
- * NOTHING`); the `fact` row must already exist (FK).
+ * Record `actor_id` as a holder of `hash`, or refresh the row's `created_at`
+ * when it already holds it. The `fact` row must already exist (FK).
+ *
+ * `created_at` is the holder's most recent put, which the orphan sweep reads
+ * as the fact's grace window: a re-put keeps an old orphan out of any
+ * sweep whose window covers the put.
  *
  * @param deps - query deps
  * @param actor_id - the actor that brought the bytes
  * @param hash - the fact's hash
- * @mutates fact_holder - inserts the `(actor_id, hash)` row when absent
+ * @mutates fact_holder - inserts the `(actor_id, hash)` row, or sets an existing row's `created_at` to now
  */
 export declare const query_put_fact_holder: (deps: QueryDeps, actor_id: Uuid, hash: FactHash) => Promise<void>;
 /**

package/dist/db/fact_holder_queries.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"fact_holder_queries.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/db/fact_holder_queries.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAEH,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,kCAAkC,CAAC;AAEjE,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAC;AACjD,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,yBAAyB,CAAC;AAEpD,kCAAkC;AAClC,MAAM,WAAW,aAAa;IAC7B,QAAQ,EAAE,IAAI,CAAC;IACf,IAAI,EAAE,QAAQ,CAAC;IACf,UAAU,EAAE,IAAI,CAAC;CACjB;AAED;;;;;;GAMG;AACH,eAAO,MAAM,mBAAmB,6CAIuB,CAAC;AAExD;;;;;;;;GAQG;AACH,eAAO,MAAM,qBAAqB,GACjC,MAAM,SAAS,EACf,UAAU,IAAI,EACd,MAAM,QAAQ,KACZ,OAAO,CAAC,IAAI,CAMd,CAAC;AAEF;;;;;;;;GAQG;AACH,eAAO,MAAM,8BAA8B,GAAU,MAAM,SAAS,KAAG,OAAO,CAAC,OAAO,CAQrF,CAAC;AAEF;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,wBAAwB,GACpC,MAAM,SAAS,EACf,UAAU,IAAI,EACd,QAAQ,aAAa,CAAC,MAAM,CAAC,KAC3B,OAAO,CAAC,KAAK,CAAC,MAAM,CAAC,CAQvB,CAAC"}
+{"version":3,"file":"fact_holder_queries.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/db/fact_holder_queries.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAEH,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,kCAAkC,CAAC;AAEjE,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAC;AACjD,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,yBAAyB,CAAC;AAEpD,kCAAkC;AAClC,MAAM,WAAW,aAAa;IAC7B,QAAQ,EAAE,IAAI,CAAC;IACf,IAAI,EAAE,QAAQ,CAAC;IACf,UAAU,EAAE,IAAI,CAAC;CACjB;AAED;;;;;;GAMG;AACH,eAAO,MAAM,mBAAmB,6CAIuB,CAAC;AAExD;;;;;;;;;;;;GAYG;AACH,eAAO,MAAM,qBAAqB,GACjC,MAAM,SAAS,EACf,UAAU,IAAI,EACd,MAAM,QAAQ,KACZ,OAAO,CAAC,IAAI,CAMd,CAAC;AAEF;;;;;;;;GAQG;AACH,eAAO,MAAM,8BAA8B,GAAU,MAAM,SAAS,KAAG,OAAO,CAAC,OAAO,CAQrF,CAAC;AAEF;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,wBAAwB,GACpC,MAAM,SAAS,EACf,UAAU,IAAI,EACd,QAAQ,aAAa,CAAC,MAAM,CAAC,KAC3B,OAAO,CAAC,KAAK,CAAC,MAAM,CAAC,CAQvB,CAAC"}

package/dist/db/fact_holder_queries.js

@@ -9,7 +9,7 @@
  * ref only for a fact the acting actor holds.
  *
  * Same discipline as `db/fact_queries.ts`: `deps: QueryDeps` first (the caller
- * owns the transaction), no audit side effects, idempotent inserts.
+ * owns the transaction), no audit side effects, idempotent writes.
  *
  * @module
  */
@@ -26,17 +26,21 @@ export const FACT_HOLDER_COLUMNS = [
     'created_at'
 ];
 /**
- * Record `actor_id` as a holder of `hash`. Idempotent (`ON CONFLICT DO
- * NOTHING`); the `fact` row must already exist (FK).
+ * Record `actor_id` as a holder of `hash`, or refresh the row's `created_at`
+ * when it already holds it. The `fact` row must already exist (FK).
+ *
+ * `created_at` is the holder's most recent put, which the orphan sweep reads
+ * as the fact's grace window: a re-put keeps an old orphan out of any
+ * sweep whose window covers the put.
  *
  * @param deps - query deps
  * @param actor_id - the actor that brought the bytes
  * @param hash - the fact's hash
- * @mutates fact_holder - inserts the `(actor_id, hash)` row when absent
+ * @mutates fact_holder - inserts the `(actor_id, hash)` row, or sets an existing row's `created_at` to now
  */
 export const query_put_fact_holder = async (deps, actor_id, hash) => {
     await deps.db.query(`INSERT INTO fact_holder (actor_id, hash) VALUES ($1, $2)
-		 ON CONFLICT (actor_id, hash) DO NOTHING`, [actor_id, hash]);
+		 ON CONFLICT (actor_id, hash) DO UPDATE SET created_at = NOW()`, [actor_id, hash]);
 };
 /**
  * Whether the `fact_holder` table exists — `false` on a database that mounts

package/dist/db/fact_queries.d.ts

@@ -123,14 +123,15 @@ export interface OrphanFactsListResult {
  * outputs? external fact mirrors?) the predicate moves to a generic
  * `fact_consumers` registry; today the cell layer is the only consumer.
  *
- * The `older_than` filter applies to `fact.created_at`. Pass `null`
- * to skip the filter (used by the list-summary preview); the delete
- * handler always passes a non-null cutoff (default 0, meaning "any
- * orphan").
+ * The `older_than` filter is the grace cutoff: a fact passes it when both
+ * its `created_at` and every `fact_holder` row's are older (a re-put
+ * refreshes the holder row). Pass `null` to skip the filter (used by the
+ * list-summary preview); the delete handler always passes a non-null
+ * cutoff (default 0, meaning "any orphan").
  *
  * @param deps - query deps
- * @param older_than - filter to facts created before this Date (or null
- *   to skip)
+ * @param older_than - filter to facts created, and last put by any holder,
+ *   before this Date (or null to skip)
  * @param sample_limit - row cap for the returned `sample`
  */
 export declare const query_orphan_facts_list: (deps: QueryDeps, older_than: Date | null, sample_limit: number) => Promise<OrphanFactsListResult>;
@@ -139,7 +140,9 @@ export declare const query_orphan_facts_list: (deps: QueryDeps, older_than: Date
  * (no row-count limit) — callers iterate to unlink disk files. The
  * `older_than` cutoff is required (non-null) here: bulk delete should
  * always be operator-scoped to a time window. A "delete all" sweep
- * passes a far-future cutoff, not `null`.
+ * passes a far-future cutoff, not `null`. It is the same grace cutoff as
+ * `query_orphan_facts_list`: a fact put — or re-put, deduplicated — by an
+ * actor within the window is kept, whatever its own `created_at`.
  */
 export declare const query_orphan_facts_select_for_delete: (deps: QueryDeps, older_than: Date) => Promise<Array<{
     hash: FactHash;

package/dist/db/fact_queries.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"fact_queries.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/db/fact_queries.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAC;AAEjD,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,kCAAkC,CAAC;AAGjE,0CAA0C;AAC1C,MAAM,WAAW,OAAO;IACvB,IAAI,EAAE,QAAQ,CAAC;IACf,KAAK,EAAE,UAAU,GAAG,IAAI,CAAC;IACzB,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;IAK5B,IAAI,EAAE,MAAM,GAAG,MAAM,CAAC;IACtB,UAAU,EAAE,IAAI,CAAC;CACjB;AAED;;;;;GAKG;AACH,eAAO,MAAM,YAAY,kFAOwB,CAAC;AAYlD,qEAAqE;AACrE,MAAM,WAAW,WAAW;IAC3B,IAAI,EAAE,QAAQ,CAAC;IACf,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;IAE5B,IAAI,EAAE,MAAM,GAAG,MAAM,CAAC;IACtB,UAAU,EAAE,IAAI,CAAC;CACjB;AAED,oFAAoF;AACpF,MAAM,WAAW,YAAY;IAC5B,IAAI,EAAE,QAAQ,CAAC;IACf,KAAK,EAAE,UAAU,GAAG,IAAI,CAAC;IACzB,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,IAAI,EAAE,MAAM,CAAC;CACb;AAED;;;;;;;;GAQG;AACH,eAAO,MAAM,cAAc,GAAU,MAAM,SAAS,EAAE,OAAO,YAAY,KAAG,OAAO,CAAC,OAAO,CAS1F,CAAC;AAEF;;;;GAIG;AACH,eAAO,MAAM,mBAAmB,GAC/B,MAAM,SAAS,EACf,aAAa,QAAQ,EACrB,eAAe,KAAK,CAAC,QAAQ,CAAC,KAC5B,OAAO,CAAC,IAAI,CAQd,CAAC;AAEF;;;GAGG;AACH,eAAO,MAAM,cAAc,GAAU,MAAM,SAAS,EAAE,MAAM,QAAQ,KAAG,OAAO,CAAC,OAAO,GAAG,IAAI,CAO5F,CAAC;AAEF;;GAEG;AACH,eAAO,MAAM,mBAAmB,GAC/B,MAAM,SAAS,EACf,MAAM,QAAQ,KACZ,OAAO,CAAC,WAAW,GAAG,IAAI,CAO5B,CAAC;AAEF;;GAEG;AACH,eAAO,MAAM,cAAc,GAAU,MAAM,SAAS,EAAE,MAAM,QAAQ,KAAG,OAAO,CAAC,OAAO,CAMrF,CAAC;AAEF;;;GAGG;AACH,eAAO,MAAM,mBAAmB,GAC/B,MAAM,SAAS,EACf,aAAa,QAAQ,KACnB,OAAO,CAAC,KAAK,CAAC,QAAQ,CAAC,CAMzB,CAAC;AAEF;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,iBAAiB,GAC7B,MAAM,SAAS,EACf,MAAM,QAAQ,KACZ,OAAO,CAAC;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,YAAY,EAAE,MAAM,GAAG,IAAI,CAAA;CAAE,GAAG,IAAI,CAQ9D,CAAC;AAEF;;;;;;GAMG;AACH,MAAM,WAAW,qBAAqB;IACrC,KAAK,EAAE,MAAM,CAAC;IACd,gBAAgB,EAAE,MAAM,CAAC;IACzB,MAAM,EAAE,KAAK,CAAC;QACb,IAAI,EAAE,QAAQ,CAAC;QACf,IAAI,EAAE,MAAM,CAAC;QACb,UAAU,EAAE,MAAM,CAAC;QACnB,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;KAC5B,CAAC,CAAC;CACH;AAED;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,eAAO,MAAM,uBAAuB,GACnC,MAAM,SAAS,EACf,YAAY,IAAI,GAAG,IAAI,EACvB,cAAc,MAAM,KAClB,OAAO,CAAC,qBAAqB,CA2C/B,CAAC;AAEF;;;;;;GAMG;AACH,eAAO,MAAM,oCAAoC,GAChD,MAAM,SAAS,EACf,YAAY,IAAI,KACd,OAAO,CAAC,KAAK,CAAC;IAAE,IAAI,EAAE,QAAQ,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,YAAY,EAAE,MAAM,GAAG,IAAI,CAAA;CAAE,CAAC,CAiB9E,CAAC"}
+{"version":3,"file":"fact_queries.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/db/fact_queries.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAC;AAEjD,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,kCAAkC,CAAC;AAGjE,0CAA0C;AAC1C,MAAM,WAAW,OAAO;IACvB,IAAI,EAAE,QAAQ,CAAC;IACf,KAAK,EAAE,UAAU,GAAG,IAAI,CAAC;IACzB,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;IAK5B,IAAI,EAAE,MAAM,GAAG,MAAM,CAAC;IACtB,UAAU,EAAE,IAAI,CAAC;CACjB;AAED;;;;;GAKG;AACH,eAAO,MAAM,YAAY,kFAOwB,CAAC;AAYlD,qEAAqE;AACrE,MAAM,WAAW,WAAW;IAC3B,IAAI,EAAE,QAAQ,CAAC;IACf,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;IAE5B,IAAI,EAAE,MAAM,GAAG,MAAM,CAAC;IACtB,UAAU,EAAE,IAAI,CAAC;CACjB;AAED,oFAAoF;AACpF,MAAM,WAAW,YAAY;IAC5B,IAAI,EAAE,QAAQ,CAAC;IACf,KAAK,EAAE,UAAU,GAAG,IAAI,CAAC;IACzB,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,IAAI,EAAE,MAAM,CAAC;CACb;AAED;;;;;;;;GAQG;AACH,eAAO,MAAM,cAAc,GAAU,MAAM,SAAS,EAAE,OAAO,YAAY,KAAG,OAAO,CAAC,OAAO,CAS1F,CAAC;AAEF;;;;GAIG;AACH,eAAO,MAAM,mBAAmB,GAC/B,MAAM,SAAS,EACf,aAAa,QAAQ,EACrB,eAAe,KAAK,CAAC,QAAQ,CAAC,KAC5B,OAAO,CAAC,IAAI,CAQd,CAAC;AAEF;;;GAGG;AACH,eAAO,MAAM,cAAc,GAAU,MAAM,SAAS,EAAE,MAAM,QAAQ,KAAG,OAAO,CAAC,OAAO,GAAG,IAAI,CAO5F,CAAC;AAEF;;GAEG;AACH,eAAO,MAAM,mBAAmB,GAC/B,MAAM,SAAS,EACf,MAAM,QAAQ,KACZ,OAAO,CAAC,WAAW,GAAG,IAAI,CAO5B,CAAC;AAEF;;GAEG;AACH,eAAO,MAAM,cAAc,GAAU,MAAM,SAAS,EAAE,MAAM,QAAQ,KAAG,OAAO,CAAC,OAAO,CAMrF,CAAC;AAEF;;;GAGG;AACH,eAAO,MAAM,mBAAmB,GAC/B,MAAM,SAAS,EACf,aAAa,QAAQ,KACnB,OAAO,CAAC,KAAK,CAAC,QAAQ,CAAC,CAMzB,CAAC;AAEF;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,iBAAiB,GAC7B,MAAM,SAAS,EACf,MAAM,QAAQ,KACZ,OAAO,CAAC;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,YAAY,EAAE,MAAM,GAAG,IAAI,CAAA;CAAE,GAAG,IAAI,CAQ9D,CAAC;AAkBF;;;;;;GAMG;AACH,MAAM,WAAW,qBAAqB;IACrC,KAAK,EAAE,MAAM,CAAC;IACd,gBAAgB,EAAE,MAAM,CAAC;IACzB,MAAM,EAAE,KAAK,CAAC;QACb,IAAI,EAAE,QAAQ,CAAC;QACf,IAAI,EAAE,MAAM,CAAC;QACb,UAAU,EAAE,MAAM,CAAC;QACnB,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;KAC5B,CAAC,CAAC;CACH;AAED;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,eAAO,MAAM,uBAAuB,GACnC,MAAM,SAAS,EACf,YAAY,IAAI,GAAG,IAAI,EACvB,cAAc,MAAM,KAClB,OAAO,CAAC,qBAAqB,CA6C/B,CAAC;AAEF;;;;;;;;GAQG;AACH,eAAO,MAAM,oCAAoC,GAChD,MAAM,SAAS,EACf,YAAY,IAAI,KACd,OAAO,CAAC,KAAK,CAAC;IAAE,IAAI,EAAE,QAAQ,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,YAAY,EAAE,MAAM,GAAG,IAAI,CAAA;CAAE,CAAC,CAkB9E,CAAC"}

package/dist/db/fact_queries.js

@@ -113,6 +113,21 @@ export const query_delete_fact = async (deps, hash) => {
         return null;
     return { size: Number(row.size), external_url: row.external_url };
 };
+/**
+ * The grace-window half of the orphan cutoff: no `fact_holder` row was
+ * recorded (or refreshed) at or after `$1`. A dedup put adds no `fact` row,
+ * so `fact.created_at` stays at the first insert — without this, an old
+ * orphan an actor re-uploads looks stale, and a sweep between the upload and
+ * the cell write that references it deletes the fact (and, by cascade, the
+ * possession the write needs). A fact counts as recent when its own
+ * `created_at` or any holder's is within the window. Served by
+ * `idx_fact_holder_hash`. Twin of the Rust `ORPHAN_FACT_NOT_RECENTLY_HELD`.
+ */
+const ORPHAN_FACT_NOT_RECENTLY_HELD = `NOT EXISTS (
+		   SELECT 1 FROM fact_holder h
+		   WHERE h.hash = f.hash
+		     AND h.created_at >= $1::timestamptz
+		 )`;
 /**
  * Compute the "orphan facts" set: rows in `fact` where no active
  * (non-tombstone) `cell.refs` array contains the hash.
@@ -124,14 +139,15 @@ export const query_delete_fact = async (deps, hash) => {
  * outputs? external fact mirrors?) the predicate moves to a generic
  * `fact_consumers` registry; today the cell layer is the only consumer.
  *
- * The `older_than` filter applies to `fact.created_at`. Pass `null`
- * to skip the filter (used by the list-summary preview); the delete
- * handler always passes a non-null cutoff (default 0, meaning "any
- * orphan").
+ * The `older_than` filter is the grace cutoff: a fact passes it when both
+ * its `created_at` and every `fact_holder` row's are older (a re-put
+ * refreshes the holder row). Pass `null` to skip the filter (used by the
+ * list-summary preview); the delete handler always passes a non-null
+ * cutoff (default 0, meaning "any orphan").
  *
  * @param deps - query deps
- * @param older_than - filter to facts created before this Date (or null
- *   to skip)
+ * @param older_than - filter to facts created, and last put by any holder,
+ *   before this Date (or null to skip)
  * @param sample_limit - row cap for the returned `sample`
  */
 export const query_orphan_facts_list = async (deps, older_than, sample_limit) => {
@@ -142,7 +158,8 @@ export const query_orphan_facts_list = async (deps, older_than, sample_limit) =>
 		   WHERE c.refs @> ARRAY[f.hash]::text[]
 		     AND c.deleted_at IS NULL
 		 )
-		 AND ($1::timestamptz IS NULL OR f.created_at < $1::timestamptz)`, [older_than]);
+		 AND ($1::timestamptz IS NULL
+		      OR (f.created_at < $1::timestamptz AND ${ORPHAN_FACT_NOT_RECENTLY_HELD}))`, [older_than]);
     const sample_rows = await deps.db.query(`SELECT hash, size, ${iso8601_timestamp_column('f', 'created_at')} AS created_at, external_url
 		 FROM fact f
 		 WHERE NOT EXISTS (
@@ -150,7 +167,8 @@ export const query_orphan_facts_list = async (deps, older_than, sample_limit) =>
 		   WHERE c.refs @> ARRAY[f.hash]::text[]
 		     AND c.deleted_at IS NULL
 		 )
-		 AND ($1::timestamptz IS NULL OR f.created_at < $1::timestamptz)
+		 AND ($1::timestamptz IS NULL
+		      OR (f.created_at < $1::timestamptz AND ${ORPHAN_FACT_NOT_RECENTLY_HELD}))
 		 ORDER BY f.created_at ASC
 		 LIMIT $2`, [older_than, sample_limit]);
     return {
@@ -169,7 +187,9 @@ export const query_orphan_facts_list = async (deps, older_than, sample_limit) =>
  * (no row-count limit) — callers iterate to unlink disk files. The
  * `older_than` cutoff is required (non-null) here: bulk delete should
  * always be operator-scoped to a time window. A "delete all" sweep
- * passes a far-future cutoff, not `null`.
+ * passes a far-future cutoff, not `null`. It is the same grace cutoff as
+ * `query_orphan_facts_list`: a fact put — or re-put, deduplicated — by an
+ * actor within the window is kept, whatever its own `created_at`.
  */
 export const query_orphan_facts_select_for_delete = async (deps, older_than) => {
     const rows = await deps.db.query(`SELECT hash, size, external_url
@@ -179,6 +199,7 @@ export const query_orphan_facts_select_for_delete = async (deps, older_than) =>
 		   WHERE c.refs @> ARRAY[f.hash]::text[]
 		     AND c.deleted_at IS NULL
 		 )
-		 AND f.created_at < $1::timestamptz`, [older_than]);
+		 AND f.created_at < $1::timestamptz
+		 AND ${ORPHAN_FACT_NOT_RECENTLY_HELD}`, [older_than]);
     return rows.map((r) => ({ hash: r.hash, size: Number(r.size), external_url: r.external_url }));
 };

package/dist/server/fact_security_headers.d.ts

@@ -0,0 +1,54 @@
+/**
+ * The untrusted-content hardening headers every served fact carries.
+ *
+ * Fact bytes are served with a producer-supplied `content_type` emitted
+ * verbatim, inline. To stop a fact stored as (or sniffable to) `text/html` from
+ * executing as stored XSS for any reader of a referencing cell, every fact
+ * response carries `FACT_SECURITY_HEADERS`: `X-Content-Type-Options: nosniff` +
+ * `Content-Security-Policy: default-src 'none'; sandbox`.
+ *
+ * The embedded and disk-stream branches of `server/serve_fact_route.ts` set them
+ * on the response directly. On the `X-Accel-Redirect` branch nginx serves the
+ * bytes from its internal facts location, and a location with its own
+ * `add_header` stops the server-level headers from applying — so that location
+ * must carry the set itself, as the lines `fact_security_header_directives`
+ * renders. The X-Accel validator (`server/x_accel.ts`) refuses a facts location
+ * without them.
+ *
+ * The Rust twin is `fuz_fact_serving::fact_security_headers`; both pin the same
+ * literals.
+ *
+ * @module
+ */
+/**
+ * `X-Content-Type-Options` for fact responses — block MIME sniffing so an
+ * `application/octet-stream` fact can't be sniffed into executable HTML.
+ */
+export declare const FACT_X_CONTENT_TYPE_OPTIONS = "nosniff";
+/**
+ * `Content-Security-Policy` for fact responses. A fact stored as (or sniffable
+ * to) `text/html` would otherwise execute as stored XSS for any reader of a
+ * referencing cell. `default-src 'none'; sandbox` neutralizes script execution
+ * and sub-resource loads even when a fact is rendered inline; harmless for
+ * directly-served images (they load no sub-resources).
+ */
+export declare const FACT_CONTENT_SECURITY_POLICY = "default-src 'none'; sandbox";
+/**
+ * The fact hardening headers, in render order. `Content-Disposition:
+ * attachment` is deliberately absent — it would force-download and break
+ * legitimate inline image rendering.
+ */
+export declare const FACT_SECURITY_HEADERS: {
+    readonly 'X-Content-Type-Options': "nosniff";
+    readonly 'Content-Security-Policy': "default-src 'none'; sandbox";
+};
+/**
+ * The exact nginx `add_header … always;` lines the internal facts location must
+ * carry, rendered from `FACT_SECURITY_HEADERS`. `always` makes nginx add the
+ * header on every status, not just 2xx/3xx. The X-Accel validator refuses a
+ * facts location missing any of them.
+ *
+ * @returns one `add_header` directive per header, each ending in `always;`
+ */
+export declare const fact_security_header_directives: () => Array<string>;
+//# sourceMappingURL=fact_security_headers.d.ts.map

package/dist/server/fact_security_headers.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"fact_security_headers.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/server/fact_security_headers.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AAEH;;;GAGG;AACH,eAAO,MAAM,2BAA2B,YAAY,CAAC;AAErD;;;;;;GAMG;AACH,eAAO,MAAM,4BAA4B,gCAAgC,CAAC;AAE1E;;;;GAIG;AACH,eAAO,MAAM,qBAAqB;;;CAGxB,CAAC;AAEX;;;;;;;GAOG;AACH,eAAO,MAAM,+BAA+B,QAAO,KAAK,CAAC,MAAM,CAG7D,CAAC"}

package/dist/server/fact_security_headers.js

@@ -0,0 +1,53 @@
+/**
+ * The untrusted-content hardening headers every served fact carries.
+ *
+ * Fact bytes are served with a producer-supplied `content_type` emitted
+ * verbatim, inline. To stop a fact stored as (or sniffable to) `text/html` from
+ * executing as stored XSS for any reader of a referencing cell, every fact
+ * response carries `FACT_SECURITY_HEADERS`: `X-Content-Type-Options: nosniff` +
+ * `Content-Security-Policy: default-src 'none'; sandbox`.
+ *
+ * The embedded and disk-stream branches of `server/serve_fact_route.ts` set them
+ * on the response directly. On the `X-Accel-Redirect` branch nginx serves the
+ * bytes from its internal facts location, and a location with its own
+ * `add_header` stops the server-level headers from applying — so that location
+ * must carry the set itself, as the lines `fact_security_header_directives`
+ * renders. The X-Accel validator (`server/x_accel.ts`) refuses a facts location
+ * without them.
+ *
+ * The Rust twin is `fuz_fact_serving::fact_security_headers`; both pin the same
+ * literals.
+ *
+ * @module
+ */
+/**
+ * `X-Content-Type-Options` for fact responses — block MIME sniffing so an
+ * `application/octet-stream` fact can't be sniffed into executable HTML.
+ */
+export const FACT_X_CONTENT_TYPE_OPTIONS = 'nosniff';
+/**
+ * `Content-Security-Policy` for fact responses. A fact stored as (or sniffable
+ * to) `text/html` would otherwise execute as stored XSS for any reader of a
+ * referencing cell. `default-src 'none'; sandbox` neutralizes script execution
+ * and sub-resource loads even when a fact is rendered inline; harmless for
+ * directly-served images (they load no sub-resources).
+ */
+export const FACT_CONTENT_SECURITY_POLICY = "default-src 'none'; sandbox";
+/**
+ * The fact hardening headers, in render order. `Content-Disposition:
+ * attachment` is deliberately absent — it would force-download and break
+ * legitimate inline image rendering.
+ */
+export const FACT_SECURITY_HEADERS = {
+    'X-Content-Type-Options': FACT_X_CONTENT_TYPE_OPTIONS,
+    'Content-Security-Policy': FACT_CONTENT_SECURITY_POLICY
+};
+/**
+ * The exact nginx `add_header … always;` lines the internal facts location must
+ * carry, rendered from `FACT_SECURITY_HEADERS`. `always` makes nginx add the
+ * header on every status, not just 2xx/3xx. The X-Accel validator refuses a
+ * facts location missing any of them.
+ *
+ * @returns one `add_header` directive per header, each ending in `always;`
+ */
+export const fact_security_header_directives = () => Object.entries(FACT_SECURITY_HEADERS).map(([name, value]) => `add_header ${name} "${value}" always;`);

package/dist/server/serve_fact_route.d.ts

@@ -20,7 +20,8 @@
  * `XAccelConfig` (built via
  * `create_x_accel_config` in `server/x_accel.ts`) set in prod, unset in dev.
  * The handle can only be obtained by proving the facts nginx location is
- * `internal;`, so X-Accel serving can't be enabled against a public location.
+ * `internal;` and carries the fact hardening headers, so X-Accel serving can't
+ * be enabled against a public or header-less location.
  *
  * REST, not RPC: binary responses don't fit the JSON-RPC envelope.
  *
@@ -96,8 +97,13 @@
  * from executing as stored XSS for any reader of a referencing cell, **every**
  * served-fact response carries `X-Content-Type-Options: nosniff` +
  * `Content-Security-Policy: default-src 'none'; sandbox` (the
- * `FACT_SECURITY_HEADERS` set, applied in all three serve branches). The same
- * pair, byte-identical, is set by the Rust twin (`fuz_fact_serving::serve`).
+ * `FACT_SECURITY_HEADERS` set from `server/fact_security_headers.ts`,
+ * byte-identical with the Rust twin `fuz_fact_serving`). The embedded and
+ * disk-stream branches set them on the response. On the `X-Accel-Redirect`
+ * branch nginx serves the bytes, and the headers the client sees come from the
+ * internal facts location, not this response — that location must carry the
+ * lines `fact_security_header_directives` renders, which `create_x_accel_config`
+ * enforces.
  * `Content-Disposition: attachment` is deliberately **not** added — it would
  * force-download and break legitimate inline image rendering.
  *

package/dist/server/serve_fact_route.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"serve_fact_route.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/server/serve_fact_route.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkHG;AAMH,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,yBAAyB,CAAC;AAetD,OAAO,EAAuC,KAAK,SAAS,EAAE,MAAM,uBAAuB,CAAC;AAE5F,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,iBAAiB,CAAC;AAO/C,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,cAAc,CAAC;AAkEjD,MAAM,WAAW,+BAA+B;IAC/C;;;;;;OAMG;IACH,IAAI,EAAE,OAAO,CAAC;IACd,kFAAkF;IAClF,SAAS,EAAE,MAAM,CAAC;IAClB;;;;;;;OAOG;IACH,OAAO,CAAC,EAAE,YAAY,CAAC;IACvB,GAAG,EAAE,MAAM,CAAC;CACZ;AAkHD;;;;;;;;;;;;GAYG;AACH,eAAO,MAAM,iCAAiC,GAC7C,SAAS,+BAA+B,KACtC,SAuDF,CAAC;AAEF;;;;;;;;;;;;;;;;;GAiBG;AACH,eAAO,MAAM,4BAA4B,GACxC,SAAS,+BAA+B,KACtC,SA2CF,CAAC"}
+{"version":3,"file":"serve_fact_route.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/server/serve_fact_route.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAwHG;AAMH,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,yBAAyB,CAAC;AAetD,OAAO,EAAuC,KAAK,SAAS,EAAE,MAAM,uBAAuB,CAAC;AAE5F,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,iBAAiB,CAAC;AAO/C,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,cAAc,CAAC;AAuCjD,MAAM,WAAW,+BAA+B;IAC/C;;;;;;OAMG;IACH,IAAI,EAAE,OAAO,CAAC;IACd,kFAAkF;IAClF,SAAS,EAAE,MAAM,CAAC;IAClB;;;;;;;OAOG;IACH,OAAO,CAAC,EAAE,YAAY,CAAC;IACvB,GAAG,EAAE,MAAM,CAAC;CACZ;AAoHD;;;;;;;;;;;;GAYG;AACH,eAAO,MAAM,iCAAiC,GAC7C,SAAS,+BAA+B,KACtC,SAuDF,CAAC;AAEF;;;;;;;;;;;;;;;;;GAiBG;AACH,eAAO,MAAM,4BAA4B,GACxC,SAAS,+BAA+B,KACtC,SA2CF,CAAC"}

package/dist/server/serve_fact_route.js

@@ -20,7 +20,8 @@
  * `XAccelConfig` (built via
  * `create_x_accel_config` in `server/x_accel.ts`) set in prod, unset in dev.
  * The handle can only be obtained by proving the facts nginx location is
- * `internal;`, so X-Accel serving can't be enabled against a public location.
+ * `internal;` and carries the fact hardening headers, so X-Accel serving can't
+ * be enabled against a public or header-less location.
  *
  * REST, not RPC: binary responses don't fit the JSON-RPC envelope.
  *
@@ -96,8 +97,13 @@
  * from executing as stored XSS for any reader of a referencing cell, **every**
  * served-fact response carries `X-Content-Type-Options: nosniff` +
  * `Content-Security-Policy: default-src 'none'; sandbox` (the
- * `FACT_SECURITY_HEADERS` set, applied in all three serve branches). The same
- * pair, byte-identical, is set by the Rust twin (`fuz_fact_serving::serve`).
+ * `FACT_SECURITY_HEADERS` set from `server/fact_security_headers.ts`,
+ * byte-identical with the Rust twin `fuz_fact_serving`). The embedded and
+ * disk-stream branches set them on the response. On the `X-Accel-Redirect`
+ * branch nginx serves the bytes, and the headers the client sees come from the
+ * internal facts location, not this response — that location must carry the
+ * lines `fact_security_header_directives` renders, which `create_x_accel_config`
+ * enforces.
  * `Content-Disposition: attachment` is deliberately **not** added — it would
  * force-download and break legitimate inline image rendering.
  *
@@ -131,33 +137,9 @@ import { query_cell_grant_list_for_cell } from '../db/cell_grant_queries.js';
 import { can_view_cell } from '../auth/cell_authorize.js';
 import { cell_steward_admits } from '../auth/cell_steward.js';
 import { parse_file_fact_url } from '../db/file_fact_url.js';
+import { FACT_SECURITY_HEADERS } from './fact_security_headers.js';
 /** `Cache-Control` for fact responses — 5 min revocation window. */
 const CACHE_CONTROL = 'private, max-age=300';
-/**
- * `X-Content-Type-Options` for fact responses — block MIME sniffing so an
- * `application/octet-stream` fact can't be sniffed into executable HTML.
- */
-const X_CONTENT_TYPE_OPTIONS = 'nosniff';
-/**
- * `Content-Security-Policy` for fact responses. Fact bytes carry a
- * producer-supplied `content_type` served verbatim inline, so a fact stored as
- * (or sniffable to) `text/html` would otherwise execute as stored XSS for any
- * reader of a referencing cell. `default-src 'none'; sandbox` neutralizes
- * script execution and sub-resource loads even when a fact is rendered inline;
- * harmless for directly-served images (they load no sub-resources). The same
- * pair, byte-identical, is set by the Rust twin (`fuz_fact_serving::serve`).
- */
-const CONTENT_SECURITY_POLICY = "default-src 'none'; sandbox";
-/**
- * The untrusted-content hardening headers applied to every served-fact
- * response across all three branches (embedded, `X-Accel-Redirect`,
- * disk-stream). `Content-Disposition: attachment` is deliberately omitted — it
- * would force-download and break legitimate inline image rendering.
- */
-const FACT_SECURITY_HEADERS = {
-    'X-Content-Type-Options': X_CONTENT_TYPE_OPTIONS,
-    'Content-Security-Policy': CONTENT_SECURITY_POLICY
-};
 /**
  * Path-param schema for the bare-hash route. Matching the canonical
  * fact-hash form here pushes malformed-hash 400s through the framework's
@@ -234,6 +216,8 @@ const serve_fact_bytes = async (c, route, hash, config) => {
     const { shard, rest } = parsed;
     if (x_accel !== undefined) {
         // Production: hand off to nginx via the validated `internal;` facts location.
+        // nginx answers with that location's own `add_header` set, not these
+        // headers, which is why the validator requires the fact pair there.
         return c.body(null, 200, {
             'Content-Type': content_type,
             'Content-Length': size,