@kedge/testing 0.0.0-stage → 0.9.0

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 The Kedge Authors
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/package.json

@@ -1,6 +1,37 @@
 {
   "name": "@kedge/testing",
-  "version": "0.0.0-stage",
-  "stub": true,
-  "description": "Temporary package placeholder for staged publishing"
+  "version": "0.9.0",
+  "license": "MIT",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/chandeldivyam/Kedge.git",
+    "directory": "packages/testing"
+  },
+  "type": "module",
+  "description": "Kedge's test kit (K11): the invariant suite, a scenario DSL in workerd, a D1 request counter, a concurrency helper and the query budget catalog.",
+  "exports": {
+    ".": "./src/index.ts",
+    "./invariants": "./src/invariants.ts",
+    "./http": "./src/http.ts"
+  },
+  "files": [
+    "src"
+  ],
+  "dependencies": {
+    "@kedge/core": "0.9.0",
+    "@kedge/db": "0.9.0"
+  },
+  "devDependencies": {
+    "@cloudflare/vitest-plugin": "1.4.0",
+    "@cloudflare/workers-types": "5.20261024.1",
+    "wrangler": "4.152.0",
+    "@types/node": "24.19.2"
+  },
+  "peerDependencies": {
+    "vitest": "^4.1.12"
+  },
+  "scripts": {
+    "typecheck": "tsc --noEmit -p .",
+    "test": "vitest run"
+  }
 }

package/src/budgets.ts

@@ -0,0 +1,476 @@
+// The query budget catalog (K11). Every statement on the checkout path, with
+// its triggers, is named here with a bound on the rows it may read that
+// depends only on the checkout's own shape (its lines, items, locations,
+// plugins), never on how much history the store has. A statement that scans
+// history passes every small test and then resets D1 on a store with a year
+// of orders (part A: an unindexed integrity scan hit D1's CPU limit). The
+// check runs each statement on a history-inflated fixture and compares D1's
+// own rows_read with the bound.
+
+export interface CheckoutShape {
+  /** Distinct variants in the cart. */
+  variants: number;
+  /** Inventory components per variant, at most. */
+  components: number;
+  /** Stock locations carrying the items, at most. */
+  locations: number;
+  lines: number;
+  reservations: number;
+  /** Installed plugins (plugin_state rows) and participants in this order. */
+  plugins: number;
+  participants: number;
+  facts: number;
+  /** Fee and adjustment rows, and adjustment allocations. */
+  moneyRows: number;
+  allocations: number;
+  // P0.4 (p0.4-dated-capacity.md §2.4, §4.3): capacity's shape.
+  /** Every stock location in the store (the claim reads them, by priority). */
+  storeLocations?: number;
+  /** Pools in the claim's scope, and the buckets it reads over them. */
+  pools?: number;
+  buckets?: number;
+  /** Holds the order inserts, and the buckets they hold. */
+  holds?: number;
+  heldBuckets?: number;
+  /** Components across the order's lines. */
+  orderComponents?: number;
+  /** A relay pass's rows (p0.6a §2.4): the timers it fires, the deliveries it leases. */
+  page?: number;
+}
+
+export interface StatementBudget {
+  name: string;
+  /** Matches the statement's SQL text. */
+  match: RegExp;
+  bound: (s: CheckoutShape) => number;
+  /** Set when the statement is known to read history today, with the slice that fixes it. */
+  exempt?: string;
+}
+
+const items = (s: CheckoutShape) => s.variants * s.components;
+const pools = (s: CheckoutShape) => s.pools ?? 0;
+const buckets = (s: CheckoutShape) => s.buckets ?? 0;
+const holds = (s: CheckoutShape) => s.holds ?? 0;
+const heldBuckets = (s: CheckoutShape) => s.heldBuckets ?? 0;
+const orderComponents = (s: CheckoutShape) => s.orderComponents ?? s.lines * s.components;
+/**
+ * An event's deliveries, written with it by 0026's trigger (p0.6a §2.2): an
+ * index probe, then per live subscription its row, its plugin's state, its
+ * participation and the obligation's unique key. Live subscriptions per event
+ * type are capped at 32 by a trigger, so this holds whatever the store installs.
+ */
+const SUBSCRIBER_FANOUT = 4 + 4 * 32;
+
+/**
+ * An event's webhook deliveries, written with it by 0027's trigger (p0.6b
+ * §2.2): a probe of the type's selections, then per selecting endpoint (at
+ * most 16, by trigger) its row and the delivery's unique keys.
+ */
+const WEBHOOK_FANOUT = 4 + 4 * 16;
+
+const FANOUT = SUBSCRIBER_FANOUT + WEBHOOK_FANOUT;
+
+/** The write fence's marker (p0.4 §2.5), first and last in every core batch. */
+const MARKER_BUDGETS: readonly StatementBudget[] = [
+  { name: "batch.marker_open", match: /^INSERT INTO batch_marker/, bound: () => 2 },
+  // Clearing also reads its deferred key's target, commit_obligation (p0.5 §7.1).
+  { name: "batch.marker_close", match: /^DELETE FROM batch_marker$/, bound: () => 3 },
+];
+
+/**
+ * One timer descriptor's statements (p0.6a §3.2), wherever a batch carries
+ * them: checkout's commit, a subscriber's success. Each reads by the timer's
+ * key or the owning order's primary key; the insert's triggers check the
+ * plugin, the order's status and the per-order cap, by primary key.
+ */
+export const TIMER_BUDGETS: readonly StatementBudget[] = [
+  { name: "timer.owner", match: /^INSERT OR IGNORE INTO timer_owner \(order_id\)/, bound: () => 2 },
+  {
+    name: "timer.assert_changed",
+    match: /^INSERT INTO kedge_assert \(code, ok\) SELECT 'KEDGE_TIMER_CHANGED'/,
+    bound: () => 8,
+  },
+  {
+    name: "timer.assert_anchor",
+    match: /^INSERT INTO kedge_assert \(code, ok\) SELECT 'KEDGE_TIMER_ANCHOR'/,
+    bound: () => 8,
+  },
+  {
+    name: "timer.assert_cause",
+    match: /^INSERT INTO kedge_assert \(code, ok\) SELECT 'KEDGE_TIMER_CAUSE_CONFLICT'/,
+    bound: () => 8,
+  },
+  { name: "timer.insert", match: /^INSERT INTO timer \(id, key, plugin, registration/, bound: () => 32 },
+  {
+    name: "timer.reschedule",
+    match: /^UPDATE timer SET generation = generation \+ 1, revision_id = \?2/,
+    bound: () => 24,
+  },
+  {
+    name: "timer.cancel",
+    match: /^UPDATE timer SET state = 'canceled', generation = generation \+ 1/,
+    bound: () => 24,
+  },
+];
+
+/** Core's claim and commit statements, in batch order. */
+export const CHECKOUT_BUDGETS: readonly StatementBudget[] = [
+  ...MARKER_BUDGETS,
+  ...TIMER_BUDGETS,
+  { name: "claim.fence_upsert", match: /^\s*INSERT INTO checkout_fence/, bound: () => 4 },
+  // P0.4: expiry on touch seeks pending_expiry per resource in scope (§4.2);
+  // the orders it expires cost at most the work budget, measured remotely.
+  {
+    name: "claim.expire_on_touch",
+    match: /^UPDATE "order" SET status = 'expired', expired_at = \?5 WHERE id IN \(/,
+    // Per scoped resource, one walk of at most EXPIRY_SEEK seeks on pending_expiry's key.
+    // P0.6b: plus, per order it expires, the webhook fan-out's probe of the
+    // `order.expired` selections (§2.2); the fixture's history expires two.
+    bound: (s) => 10 * items(s) + 16 * pools(s) + 40 + 2 * 2,
+  },
+  {
+    name: "claim.overdue_remaining",
+    match: /^WITH RECURSIVE[\s\S]*SELECT count\(\*\) AS n FROM \(SELECT 1 FROM overdue v/,
+    bound: (s) => 10 * items(s) + 16 * pools(s) + 40,
+  },
+  { name: "claim.fence_read", match: /^SELECT attempt_id FROM checkout_fence/, bound: () => 2 },
+  { name: "claim.existing_order", match: /^SELECT id FROM "order" WHERE cart_id = \?/, bound: () => 2 },
+  { name: "claim.variants", match: /^SELECT v\.id AS variant_id/, bound: (s) => 4 * items(s) + 4 },
+  {
+    name: "claim.levels",
+    match: /^\s*SELECT l\.inventory_item_id, l\.location_id, s\.priority/,
+    bound: (s) => 6 * items(s) * s.locations + 4,
+  },
+  { name: "claim.plugin_state", match: /^SELECT plugin, state FROM plugin_state$/, bound: (s) => s.plugins + 1 },
+  // P0.3: the tax context (one row) and at most 5 required policies, each one indexed seek.
+  {
+    name: "claim.tax_setting",
+    match: /^SELECT inclusive, rate_revenue_ppm, rate_deposit_ppm FROM tax_setting/,
+    bound: () => 2,
+  },
+  { name: "claim.policies", match: /^SELECT cp\.policy, \(SELECT r\.id FROM policy_revision/, bound: () => 5 * 3 + 2 },
+  // P0.4: the pinned rules, the locations, and the scope's pools, mappings, buffers and free buckets (§2.4).
+  { name: "claim.store_time", match: /^SELECT tz_rules_version FROM store_time/, bound: () => 2 },
+  {
+    name: "claim.locations",
+    match: /^SELECT id, priority FROM stock_location/,
+    bound: (s) => (s.storeLocations ?? s.locations) + 1,
+  },
+  {
+    name: "claim.scope_pools",
+    match: /^WITH RECURSIVE[\s\S]*SELECT p\.id, p\.kind, p\.inventory_item_id/,
+    bound: (s) => 6 * items(s) + 6 * pools(s) + 8,
+  },
+  {
+    name: "claim.scope_map",
+    match: /^WITH RECURSIVE[\s\S]*SELECT DISTINCT mapping, key, pool_id FROM mapped/,
+    bound: (s) => 4 * items(s) + 4 * pools(s) + 8,
+  },
+  {
+    name: "claim.buffers",
+    match: /^WITH RECURSIVE[\s\S]*SELECT b\.kind, b\.pool_kind/,
+    bound: (s) => 4 * items(s) + 2 * s.lines + 8,
+  },
+  {
+    name: "claim.free",
+    match: /^WITH RECURSIVE[\s\S]*buf AS \(SELECT/,
+    // Per bucket: its capacity expression (base step, ceiling, adjustments) and held count;
+    // per pool and window, its first and last labels' seeks into the pinned transitions.
+    bound: (s) => 6 * items(s) + 20 * pools(s) + 16 * buckets(s) + 16,
+  },
+  { name: "commit.order", match: /^\s*INSERT INTO "order" \(/, bound: () => 8 },
+  { name: "commit.lines", match: /^\s*INSERT INTO order_line \(/, bound: (s) => 4 * s.lines + 4 },
+  // P0.4: components, versions and requirements by core SQL (§2.1), each insert checking the seal.
+  {
+    name: "commit.components",
+    match: /^\s*INSERT INTO order_line_component \(/,
+    bound: (s) => 8 * orderComponents(s) + 4 * s.lines + 4,
+  },
+  {
+    name: "commit.component_versions",
+    match: /^\s*INSERT INTO order_line_component_version \(/,
+    bound: (s) => 10 * orderComponents(s) + 4,
+  },
+  {
+    name: "commit.requirements",
+    match: /^\s*INSERT INTO order_line_component_requirement \(/,
+    bound: (s) => 10 * (s.reservations + holds(s) + orderComponents(s)) + 4,
+  },
+  {
+    name: "commit.holds",
+    match: /^\s*INSERT INTO capacity_hold \(/,
+    // Per held bucket: its row materialised, checked against capacity, counted and backstopped.
+    bound: (s) => 20 * holds(s) + 24 * heldBuckets(s) + 4,
+  },
+  {
+    name: "commit.place_by_sources",
+    match: /^\s*INSERT INTO order_place_by_source \(/,
+    bound: (s) => 6 * (2 * holds(s) + s.lines) + 4,
+  },
+  {
+    name: "commit.period_provenance",
+    match: /^\s*INSERT INTO order_line_period_provenance \(/,
+    bound: (s) => 6 * s.lines + 4,
+  },
+  {
+    name: "commit.reservations",
+    match: /^\s*INSERT INTO inventory_reservation \(/,
+    bound: (s) => 10 * s.reservations + 4,
+  },
+  {
+    name: "commit.participation",
+    match: /^INSERT INTO plugin_participation/,
+    // +1 under 0026: bisected to its order-status triggers (§7), which this
+    // insert doesn't fire; not reproduced in isolation, so stated as measured.
+    // +1 again under 0027, which recreates two of those triggers (p0.6b §5):
+    // the same unexplained step, constant over history, stated as measured.
+    bound: (s) => 4 * s.participants + 8,
+  },
+  { name: "commit.contribution_facts", match: /^\s*INSERT INTO contribution_fact \(/, bound: (s) => 4 * s.facts + 4 },
+  { name: "commit.fees", match: /^\s*INSERT INTO order_fee \(/, bound: (s) => 6 * s.moneyRows + 4 },
+  { name: "commit.adjustments", match: /^\s*INSERT INTO order_adjustment \(/, bound: (s) => 6 * s.moneyRows + 4 },
+  {
+    name: "commit.allocations",
+    match: /^\s*INSERT INTO order_line_adjustment \(/,
+    bound: (s) => 6 * s.allocations + 4,
+  },
+  // P0.3: tax lines and acceptances, each insert checking its owner, revision and the seal.
+  {
+    name: "commit.tax_lines",
+    match: /^\s*INSERT INTO order_tax_line \(/,
+    bound: (s) => 8 * (s.lines + s.moneyRows) + 4,
+  },
+  { name: "commit.acceptances", match: /^\s*INSERT INTO policy_acceptance \(/, bound: () => 5 * 12 + 4 },
+  { name: "commit.order_event", match: /^INSERT INTO order_event/, bound: () => 4 },
+  // P0.4: every outbox insert also runs the shortage queue's trigger (its WHEN, mostly false).
+  // P0.6a: the event's deliveries are written with it.
+  { name: "commit.outbox", match: /^INSERT INTO outbox_event/, bound: () => 8 + FANOUT },
+  {
+    name: "commit.contribution_check",
+    match: /^INSERT INTO contribution_check/,
+    // P0.3's checks, then P0.4's coverage, costs and provenance over the order's own rows.
+    bound: (s) =>
+      4 * (s.facts + s.moneyRows + s.allocations + s.lines) +
+      40 * (orderComponents(s) + s.reservations) +
+      30 * holds(s) +
+      16 * heldBuckets(s) +
+      24,
+  },
+];
+
+/** Staff placement (and, later, the payment settler's): the event, the guarded transition with its triggers, the read-back. */
+export const PLACEMENT_BUDGETS: readonly StatementBudget[] = [
+  ...MARKER_BUDGETS,
+  // Placement's refusals, asserted ahead of its writes (codex code r10, D-058): the order
+  // by primary key, then kedge_assert's own trigger and the fence's marker read.
+  {
+    name: "place.assert_found",
+    match:
+      /^INSERT INTO kedge_assert \(code, ok\) SELECT 'KEDGE_NOT_FOUND', EXISTS \(SELECT 1 FROM "order" WHERE id = \?\)/,
+    bound: () => 8,
+  },
+  {
+    name: "place.assert_placeable",
+    match: /^INSERT INTO kedge_assert \(code, ok\) SELECT 'KEDGE_NOT_PLACEABLE'/,
+    bound: () => 8,
+  },
+  {
+    name: "place.event",
+    match: /^\s*INSERT INTO order_event \(id, order_id, type, actor, created_at\)/,
+    // + the fence's marker read: order_event is fenced from P0.5 (§7.1).
+    bound: () => 3,
+  },
+  // The transition's triggers number the order, snapshot its lines into order.placed,
+  // write the transition row and run participating plugins' acquire SQL.
+  {
+    name: "place.transition",
+    match: /^\s*UPDATE "order" SET status = 'open'/,
+    // P0.4: plus deleting the order's pending_expiry rows, and the outbox trigger's WHEN.
+    // P0.6a: plus `order.placed`'s deliveries and the new status triggers' checks.
+    bound: (s) => 8 * s.lines + 4 * s.reservations + 4 * (holds(s) + 1) + 24 + FANOUT,
+  },
+  { name: "place.order_read", match: /^SELECT id, cart_id, status, payment_status/, bound: () => 2 },
+  {
+    name: "place.lines_read",
+    match: /^SELECT id, variant_id, sku, title, unit_price, quantity, kind, parent_line_id/,
+    bound: (s) => s.lines + 1,
+  },
+];
+
+/** The minute cron's expiry chunk: seeks pending orders by (status, expires_at), bounded by its LIMIT. */
+export const EXPIRY_BUDGETS: readonly StatementBudget[] = [
+  ...MARKER_BUDGETS,
+  {
+    name: "cron.expire_due",
+    match: /^\s*UPDATE "order" SET status = 'expired', expired_at = \? WHERE id IN \(\s*SELECT id FROM \(/,
+    // Per expired order: its reservations and holds released, its costs, transition and obligations.
+    // P0.6a: plus `order.expired` and its deliveries, and the timers' epoch checks.
+    bound: (s) => 12 * (s.reservations + s.participants) + 16 * (holds(s) + heldBuckets(s)) + 32 + FANOUT,
+  },
+];
+
+export interface Measured {
+  sql: string;
+  rowsRead: number;
+}
+
+/** Records each statement's SQL and D1's rows_read, for batches and single statements. */
+export function measureRows(real: D1Database): { db: D1Database; log: Measured[]; reset(): void } {
+  const log: Measured[] = [];
+  const sqlOf = new WeakMap<object, string>();
+  const realOf = new WeakMap<object, D1PreparedStatement>();
+  const wrap = (s: D1PreparedStatement, sql: string): D1PreparedStatement => {
+    const w = new Proxy(s, {
+      get(target, prop, receiver) {
+        if (prop === "bind") return (...a: unknown[]) => wrap(target.bind(...a), sql);
+        if (prop === "run" || prop === "all") {
+          return async (...a: unknown[]) => {
+            const r = (await (Reflect.get(target, prop, receiver) as (...x: unknown[]) => Promise<D1Result>).apply(
+              target,
+              a,
+            )) as D1Result;
+            log.push({ sql, rowsRead: r.meta.rows_read ?? 0 });
+            return r;
+          };
+        }
+        const v = Reflect.get(target, prop, receiver);
+        return typeof v === "function" ? v.bind(target) : v;
+      },
+    });
+    sqlOf.set(w, sql);
+    realOf.set(w, s);
+    return w;
+  };
+  const db = new Proxy(real, {
+    get(target, prop, receiver) {
+      if (prop === "prepare") return (q: string) => wrap(target.prepare(q), q);
+      if (prop === "batch") {
+        return async (stmts: D1PreparedStatement[]) => {
+          const results = await target.batch(stmts.map((s) => realOf.get(s) ?? s));
+          results.forEach((r, i) => {
+            log.push({ sql: sqlOf.get(stmts[i] as object) ?? "?", rowsRead: r.meta.rows_read ?? 0 });
+          });
+          return results;
+        };
+      }
+      const v = Reflect.get(target, prop, receiver);
+      return typeof v === "function" ? v.bind(target) : v;
+    },
+  });
+  return {
+    db,
+    log,
+    reset: () => {
+      log.length = 0;
+    },
+  };
+}
+
+export interface BudgetViolation {
+  name: string;
+  sql: string;
+  rowsRead: number;
+  bound: number | "unnamed";
+}
+
+/**
+ * Checks measured statements against the catalog. A statement no budget names
+ * is a violation too: every statement on the path must be catalogued. Plugin
+ * statements (on plg_ tables or kedge_v1_ views) are checked against the
+ * plugin's declared `rowBudget`.
+ */
+export function overBudget(
+  measured: readonly Measured[],
+  shape: CheckoutShape,
+  pluginBudgets: Readonly<Record<string, number>> = {},
+  budgets: readonly StatementBudget[] = CHECKOUT_BUDGETS,
+): BudgetViolation[] {
+  const out: BudgetViolation[] = [];
+  for (const m of measured) {
+    const sql = m.sql.trim();
+    const b = budgets.find((x) => x.match.test(m.sql));
+    if (b) {
+      if (b.exempt) continue;
+      const bound = b.bound(shape);
+      if (m.rowsRead > bound) out.push({ name: b.name, sql, rowsRead: m.rowsRead, bound });
+      continue;
+    }
+    const plugin = Object.keys(pluginBudgets).find((p) => sql.includes(`plg_${p}_`));
+    if (plugin !== undefined) {
+      const bound = pluginBudgets[plugin] as number;
+      if (m.rowsRead > bound) out.push({ name: `plugin:${plugin}`, sql, rowsRead: m.rowsRead, bound });
+      continue;
+    }
+    out.push({ name: "unnamed", sql: sql.slice(0, 120), rowsRead: m.rowsRead, bound: "unnamed" });
+  }
+  return out;
+}
+
+const page = (s: CheckoutShape) => s.page ?? 0;
+
+/**
+ * The relay's statements (p0.6a §2.3, §3.3, §7): the clock's pass seeks timers
+ * by (state, due_at) and deliveries by (state, next_attempt_at), so its reads
+ * grow with the page it takes, never with the rows already done; a run's
+ * statements are by primary key.
+ */
+export const RELAY_BUDGETS: readonly StatementBudget[] = [
+  ...MARKER_BUDGETS,
+  ...TIMER_BUDGETS,
+  {
+    name: "clock.due_timers",
+    match: /^SELECT id, generation FROM timer WHERE state = 'scheduled' AND due_at <= \? ORDER BY due_at LIMIT \?$/,
+    bound: (s) => page(s) + 1,
+  },
+  // A firing's triggers write timer_firing, the event, its outbox row and its one delivery.
+  { name: "clock.fire", match: /^\s*UPDATE timer SET state = 'fired', fired_at = \?1/, bound: () => 32 },
+  {
+    name: "clock.clean_dead",
+    match: /^\s*UPDATE timer SET state = 'canceled', generation = generation \+ 1, updated_at = \?1\s+WHERE id = \?2/,
+    bound: () => 16,
+  },
+  {
+    name: "clock.due_deliveries",
+    match:
+      /^SELECT seq, next_attempt_at FROM \w+ WHERE state = \? AND next_attempt_at <= \? ORDER BY next_attempt_at LIMIT \?$/,
+    bound: (s) => page(s) + 1,
+  },
+  {
+    name: "clock.abandon_at_max",
+    match: /^\s*UPDATE \w+ SET state = 'failed', last_code = 'run_abandoned'/,
+    bound: (s) => 6 * page(s) + 4,
+  },
+  {
+    name: "clock.lease",
+    match: /^\s*UPDATE \w+ SET lease_token = \?1, run_token = NULL/,
+    bound: (s) => 12 * page(s) + 8,
+  },
+  {
+    name: "clock.next_due",
+    match: /^\s*SELECT \(SELECT min\(due_at\) FROM timer WHERE state = 'scheduled'\) AS timer/,
+    bound: () => 16,
+  },
+  { name: "run.claim", match: /^\s*UPDATE \w+ SET run_token = \?1, lease_token = NULL,/, bound: () => 8 },
+  {
+    name: "run.fail",
+    match: /^\s*UPDATE \w+ SET run_token = NULL, lease_token = NULL, last_code = \?1/,
+    bound: () => 8,
+  },
+  // A success's batch: the run still owns it, its receipt, its end state.
+  {
+    name: "run.assert_owned",
+    match: /^INSERT INTO kedge_assert \(code, ok\) SELECT 'KEDGE_RUN_LOST'/,
+    bound: () => 10,
+  },
+  { name: "run.receipt", match: /^INSERT INTO (subscriber|release|resolution)_delivery \(seq, /, bound: () => 8 },
+  {
+    name: "run.finalizing",
+    match: /^\s*UPDATE subscriber_obligation SET state = 'finalizing', final_reason = /,
+    bound: () => 8,
+  },
+  {
+    name: "run.done",
+    match: /^\s*UPDATE \w+ SET state = 'done', run_token = NULL, lease_token = NULL/,
+    bound: () => 8,
+  },
+];