@lovrozagar/oat 0.12.22 → 0.14.0

package/dist/runtime/checks.js

@@ -8,6 +8,7 @@
 import { canWriteFilterOp, filterTerm, selectTerm, sortTerm, sortTermWithNulls } from "../spec/conventions.js";
 import { CHECK_IDS } from "./check-ids.js";
 import { publicGetCheck } from "./one-shot.js";
+import { contractCallCheck } from "./contract.js";
 import { disposableCheck } from "./disposable.js";
 import { rootReadCheck } from "./root-read.js";
 import { selfIdentityCheck } from "./self.js";
@@ -30,7 +31,7 @@ import { forEachInvocation } from "./upload-each.js";
 import { driveWait } from "./wait.js";
 import { fillPath, isPlanLimitResponse } from "./world.js";
 import { bodyPropertyNames, collisionCreateBody, collisionUpdatePatch, idempotencyHeaderRequired, probeableUniqueSets, uniquifyProbeBody, uniqueProbeHeaders, } from "./unique.js";
-import { bindAfterCreateEffects, bindCreatedScope, applyActionBind, bindActionScope, bindInstanceScope, bindMissingPathParams, readActionBind, readBefore, canFillPath, describeEffectHold, effectHolds, identityPathParam, } from "./effects.js";
+import { bindAfterCreateEffects, bindCreatedScope, applyActionBind, bindActionScope, bindInstanceScope, bindMissingPathParams, readActionBind, readBefore, canFillPath, createdIdKeys, describeEffectHold, effectHolds, findCreatedId, identityPathParam, } from "./effects.js";
 const graded = (ctx, op) => ctx.inScope?.(op) ?? true;
 /* ------------------------------------------------------------------- invented values */
 /** This entity's identifier as its item route takes it: the path parameter's schema, else the record's. */
@@ -100,7 +101,34 @@ function judgeRefusal(ctx, check, reasons, exchange) {
  * from what ordinary traffic got.
  */
 function asProbe(ctx) {
-    return { ...ctx, client: ctx.client.view({ purpose: "probe" }) };
+    const view = ctx.client.view({ purpose: "probe" });
+    const createOp = ctx.createOp;
+    const record = ctx.recordCreated;
+    if (createOp === undefined || record === undefined || !("request" in view))
+        return { ...ctx, client: view };
+    /* A probe sends what should be refused. When the server accepts it anyway, the record it made is
+     * the run's to remove like any other: the finding says what went wrong, the teardown cleans up. */
+    const createPath = fillPath(createOp.path, ctx.scope);
+    const keys = createdIdKeys(ctx.entityName, ctx.identity);
+    const client = new Proxy(view, {
+        get(target, property) {
+            const value = Reflect.get(target, property, target);
+            if (property !== "request" || typeof value !== "function") {
+                return typeof value === "function" ? value.bind(target) : value;
+            }
+            return async (method, path, options) => {
+                const exchange = (await value.call(target, method, path, options));
+                const created = method.toUpperCase() === createOp.method.toUpperCase() && path === createPath;
+                if (created && exchange.status >= 200 && exchange.status < 300) {
+                    const id = findCreatedId(exchange.responseBody, keys);
+                    if (id !== undefined)
+                        record(ctx.entityName, id, { ...ctx.scope });
+                }
+                return exchange;
+            };
+        },
+    });
+    return { ...ctx, client };
 }
 /** A valid value for `field` that differs from `current` — what a write probe changes it to. */
 function changedValue(ctx, field, current, op) {
@@ -583,10 +611,77 @@ async function listAll(ctx, query) {
  * Collects a whole result set — `readSet`, shaped for the set-algebra checks. `null` when a page
  * was refused, so the caller reports the check unresolved rather than reading "refused" as "empty".
  */
-async function collectSet(ctx, requested, extra = {}, order) {
-    const read = await readSet(ctx, extra, { order, size: requested });
+async function collectSet(ctx, requested, extra = {}, order, 
+/* A repeat read that must see the collection as it is now, not as an earlier read saw it. */
+fresh = false) {
+    const read = await readSet(ctx, extra, { ...(fresh ? { fresh: true } : {}), order, size: requested });
     return read.status === "ok" ? read : null;
 }
+/** A read's rows as a set: two reads of one collection agree on it unless the collection moved. */
+function membership(records, identity) {
+    return ids(records, identity).sort().join(",");
+}
+const MOVING_FILTER = "the collection gained or lost rows between the term reads and the combined read (something wrote " +
+    "to it while the check ran), so the reads cannot be compared";
+const MOVING = "the collection gained or lost rows between two reads in the same direction (something wrote to it " +
+    "while the check ran), so the reads cannot be compared";
+/**
+ * Two reads that must hold the same rows and do not. Read the first again: when the same read
+ * now holds other rows, the collection is moving under the check — an append-only log the run
+ * itself writes to — and that is no defect of ordering. When it holds still, read the second again
+ * and compare that fresh pair; only a disagreement that survives it is the backend's.
+ */
+async function settlePair(identity, first, second, again) {
+    if (membership(first.items, identity) === membership(second.items, identity))
+        return { first, second };
+    const firstAgain = await again.first();
+    if (firstAgain === null)
+        return null;
+    if (membership(firstAgain.items, identity) !== membership(first.items, identity))
+        return "moving";
+    const secondAgain = await again.second();
+    if (secondAgain === null)
+        return null;
+    if (membership(secondAgain.items, identity) !== membership(second.items, identity))
+        return "moving";
+    return { first: firstAgain, second: secondAgain };
+}
+/**
+ * Reads each term alone and then combined. A disagreement is read again: when any of the three
+ * reads now holds other rows, another writer moved the collection between them — a record created
+ * after the term reads and before the combined one — and that is no defect of composition. Only a
+ * disagreement the fresh reads repeat is the backend's.
+ */
+async function readComposed(ctx, terms, compose) {
+    const limit = pageSize(ctx);
+    const read = async (fresh) => {
+        const onlyA = await collectSet(ctx, limit, terms.termA, undefined, fresh);
+        const onlyB = await collectSet(ctx, limit, terms.termB, undefined, fresh);
+        const combined = await collectSet(ctx, limit, terms.combined, undefined, fresh);
+        if (onlyA === null || onlyB === null || combined === null)
+            return "rejected";
+        if (!onlyA.complete || !onlyB.complete || !combined.complete)
+            return "incomplete";
+        const setA = new Set(ids(onlyA.items, ctx.identity));
+        const setB = new Set(ids(onlyB.items, ctx.identity));
+        const expected = compose(setA, setB);
+        const got = new Set(ids(combined.items, ctx.identity));
+        const missing = [...expected].filter((id) => !got.has(id));
+        const extra = [...got].filter((id) => !expected.has(id));
+        return { combined, expected, extra, got, missing, onlyA, onlyB, setA, setB };
+    };
+    const first = await read(false);
+    if (typeof first === "string" || (first.missing.length === 0 && first.extra.length === 0))
+        return first;
+    const again = await read(true);
+    if (typeof again === "string")
+        return again;
+    const same = (a, b) => membership(a.items, ctx.identity) === membership(b.items, ctx.identity);
+    if (!same(first.onlyA, again.onlyA) || !same(first.onlyB, again.onlyB) || !same(first.combined, again.combined)) {
+        return "moving";
+    }
+    return again;
+}
 /** Walks pages in order, returning ids as encountered — repeats kept, since they are the finding. */
 async function walkPages(ctx, pageSize, order, maxPages = MAX_WALK_PAGES) {
     const read = await readSet(ctx, {}, { fresh: true, keepRepeats: true, maxPages, order, size: pageSize });
@@ -1084,22 +1179,16 @@ const filterAndComposesAsIntersection = {
     needs: "two filterable fields and a filter parameter or grammar supporting eq",
     subjects: subjectsOf.list,
     async run(ctx, { combined, fieldA, fieldB, termA, termB, valueA, valueB }) {
-        const limit = pageSize(ctx);
-        const onlyA = await collectSet(ctx, limit, termA);
-        const onlyB = await collectSet(ctx, limit, termB);
-        const both = await collectSet(ctx, limit, combined);
-        if (onlyA === null || onlyB === null || both === null) {
+        const composed = await readComposed(ctx, { combined, termA, termB }, (a, b) => new Set([...a].filter((id) => b.has(id))));
+        if (composed === "rejected") {
             return ctx.findings.unresolved(this.id, ctx.entityName, "one of the three listings needed for the intersection was rejected");
         }
-        if (!onlyA.complete || !onlyB.complete || !both.complete) {
+        if (composed === "incomplete") {
             return ctx.findings.unresolved(this.id, ctx.entityName, "the collection is larger than the walk covers, so the intersection cannot be verified");
         }
-        const setA = new Set(ids(onlyA.items, ctx.identity));
-        const setB = new Set(ids(onlyB.items, ctx.identity));
-        const expected = new Set([...setA].filter((id) => setB.has(id)));
-        const got = new Set(ids(both.items, ctx.identity));
-        const missing = [...expected].filter((id) => !got.has(id));
-        const extra = [...got].filter((id) => !expected.has(id));
+        if (composed === "moving")
+            return ctx.findings.unresolved(this.id, ctx.entityName, MOVING_FILTER);
+        const { expected, extra, got, missing, onlyA, onlyB, setA, setB } = composed;
         if (missing.length === 0 && extra.length === 0)
             return ASSERTED;
         return ctx.findings.backend(this.id, ctx.entityName, "and() does not compose as the intersection of its terms", `and(${fieldA}.eq.${valueA},${fieldB}.eq.${valueB}) returned ${got.size} record(s); ` +
@@ -1107,7 +1196,7 @@ const filterAndComposesAsIntersection = {
             `${setB.size}, whose intersection is ${expected.size}. ` +
             (missing.length > 0 ? `Missing from the combined result: ${missing.slice(0, 3).join(", ")}. ` : "") +
             (extra.length > 0 ? `Present but should not match both terms: ${extra.slice(0, 3).join(", ")}. ` : "") +
-            "A conjunction must select exactly the records both terms match individually.", [onlyA.last.exchange, onlyB.last.exchange, both.last.exchange]);
+            "A conjunction must select exactly the records both terms match individually.", [onlyA.last.exchange, onlyB.last.exchange, composed.combined.last.exchange]);
     },
 };
 /**
@@ -1134,22 +1223,16 @@ const filterOrComposesAsUnion = {
     needs: "two filterable fields and an or() combinator (postgrest-shaped filter grammar)",
     subjects: subjectsOf.list,
     async run(ctx, { combined, fieldA, fieldB, termA, termB, valueA, valueB }) {
-        const limit = pageSize(ctx);
-        const onlyA = await collectSet(ctx, limit, termA);
-        const onlyB = await collectSet(ctx, limit, termB);
-        const either = await collectSet(ctx, limit, combined);
-        if (onlyA === null || onlyB === null || either === null) {
+        const composed = await readComposed(ctx, { combined, termA, termB }, (a, b) => new Set([...a, ...b]));
+        if (composed === "rejected") {
             return ctx.findings.unresolved(this.id, ctx.entityName, "one of the three listings needed for the union was rejected");
         }
-        if (!onlyA.complete || !onlyB.complete || !either.complete) {
+        if (composed === "incomplete") {
             return ctx.findings.unresolved(this.id, ctx.entityName, "the collection is larger than the walk covers, so the union cannot be verified");
         }
-        const setA = new Set(ids(onlyA.items, ctx.identity));
-        const setB = new Set(ids(onlyB.items, ctx.identity));
-        const expected = new Set([...setA, ...setB]);
-        const got = new Set(ids(either.items, ctx.identity));
-        const missing = [...expected].filter((id) => !got.has(id));
-        const extra = [...got].filter((id) => !expected.has(id));
+        if (composed === "moving")
+            return ctx.findings.unresolved(this.id, ctx.entityName, MOVING_FILTER);
+        const { expected, extra, got, missing, onlyA, onlyB, setA, setB } = composed;
         if (missing.length === 0 && extra.length === 0)
             return ASSERTED;
         return ctx.findings.backend(this.id, ctx.entityName, "or() does not compose as the union of its terms", `or(${fieldA}.eq.${valueA},${fieldB}.eq.${valueB}) returned ${got.size} record(s); ` +
@@ -1157,7 +1240,7 @@ const filterOrComposesAsUnion = {
             `${setB.size}, whose union is ${expected.size}. ` +
             (missing.length > 0 ? `Missing from the combined result: ${missing.slice(0, 3).join(", ")}. ` : "") +
             (extra.length > 0 ? `Present but matches neither term individually: ${extra.slice(0, 3).join(", ")}. ` : "") +
-            "A disjunction must select exactly the records either term matches alone.", [onlyA.last.exchange, onlyB.last.exchange, either.last.exchange]);
+            "A disjunction must select exactly the records either term matches alone.", [onlyA.last.exchange, onlyB.last.exchange, composed.combined.last.exchange]);
     },
 };
 const sortReverseSymmetry = {
@@ -1190,8 +1273,8 @@ const sortReverseSymmetry = {
         /* Gathered across pages: a collection larger than one page would otherwise leave this
          * property — that a reversal reorders a set without changing its membership — untested on
          * exactly the collections where sorting matters most. */
-        const ascending = await collectSet(ctx, limit, {}, sortTerm(conv(ctx), field, "asc"));
-        const descending = await collectSet(ctx, limit, {}, sortTerm(conv(ctx), field, "desc"));
+        let ascending = await collectSet(ctx, limit, {}, sortTerm(conv(ctx), field, "asc"));
+        let descending = await collectSet(ctx, limit, {}, sortTerm(conv(ctx), field, "desc"));
         if (ascending === null || descending === null) {
             return ctx.findings.unresolved(this.id, ctx.entityName, `ordering by "${field}" was rejected in one direction, so the two cannot be compared`);
         }
@@ -1202,6 +1285,17 @@ const sortReverseSymmetry = {
             return ctx.findings.unresolved(this.id, ctx.entityName, "the collection is larger than the walk covers, so the two directions return " +
                 "different windows of it rather than the same set reversed");
         }
+        const settled = await settlePair(ctx.identity, ascending, descending, {
+            first: () => collectSet(ctx, limit, {}, sortTerm(conv(ctx), field, "asc"), true),
+            second: () => collectSet(ctx, limit, {}, sortTerm(conv(ctx), field, "desc"), true),
+        });
+        if (settled === "moving")
+            return ctx.findings.unresolved(this.id, ctx.entityName, MOVING);
+        if (settled === null) {
+            return ctx.findings.unresolved(this.id, ctx.entityName, `ordering by "${field}" was rejected on a repeat read`);
+        }
+        ascending = settled.first;
+        descending = settled.second;
         const forward = ids(ascending.items, ctx.identity);
         const backward = ids(descending.items, ctx.identity);
         if (forward.length !== backward.length) {
@@ -3511,25 +3605,34 @@ const inviteGrantsThenRevokes = {
         if (inviteOp === undefined || acceptOp === undefined || revokeOp === undefined) {
             return cannot("x-invite operations that exist in the document");
         }
-        return ready({ acceptOp, delegate, inviteAs: delegate.inviteAs, inviteOp, owner, revokeOp, spec });
+        const grantsOp = spec.grants === undefined ? undefined : ctx.model.byOperationId.get(spec.grants);
+        if (spec.grants !== undefined && grantsOp === undefined)
+            return cannot("an x-invite.grants read that exists in the document");
+        return ready({ acceptOp, delegate, grantsOp, inviteAs: delegate.inviteAs, inviteOp, owner, revokeOp, spec });
     },
     dependsOn: ["list.read-after-write", "tenant.item-not-readable-cross-tenant"],
     id: "auth.invite-grants-then-revokes",
     needs: "x-invite naming invite/accept/revoke, a peer principal with inviteAs, and an item or list route",
     subjects: subjectsOf.invite,
-    async run(ctx, { acceptOp, delegate, inviteAs, inviteOp, owner, revokeOp, spec }) {
+    async run(ctx, { acceptOp, delegate, grantsOp, inviteAs, inviteOp, owner, revokeOp, spec }) {
         const target = ctx.records[0];
         const id = target === undefined ? undefined : String(target[ctx.identity]);
         const resource = {
             ...ctx.scope,
             ...(id === undefined ? {} : itemParamFor(ctx, id)),
         };
-        const itemPath = ctx.readOp?.path;
+        const grantRead = grantsOp !== undefined
+            ? { operationId: grantsOp.operationId, path: grantsOp.path }
+            : ctx.readOp === undefined || id === undefined
+                ? undefined
+                : { operationId: ctx.readOp.operationId, path: ctx.readOp.path };
+        const subject = grantsOp === undefined ? `${ctx.entityName} ${id}` : `${grantsOp.operationId} on the inviter's scope`;
         const canRead = async () => {
-            if (itemPath === undefined || id === undefined)
+            if (grantRead === undefined)
                 return null;
-            const exchange = await ctx.client.get(fillPath(itemPath, { ...delegate.roots, ...resource }), {
+            const exchange = await ctx.client.get(fillPath(grantRead.path, { ...delegate.roots, ...resource }), {
                 headers: delegate.headers(),
+                operationId: grantRead.operationId,
             });
             return exchange.status < 300;
         };
@@ -3550,9 +3653,16 @@ const inviteGrantsThenRevokes = {
         const grantId = pointerValue(invited.responseBody, spec.grantPointer);
         let token;
         let revokedAlready = false;
+        /* The grant is its own record: revoke addresses it, not the record the check read first. */
+        const revokeParam = revokeOp.pathParams.at(-1);
         const revoke = async (grant) => {
             revokedAlready = true;
-            const revokeScope = { ...resource, grant_id: grant, ...(token === undefined ? {} : { token }) };
+            const revokeScope = {
+                ...resource,
+                ...(revokeParam === undefined || revokeParam in ctx.scope ? {} : { [revokeParam]: grant }),
+                grant_id: grant,
+                ...(token === undefined ? {} : { token }),
+            };
             const revokeBody = documentedJsonBody(ctx, revokeOp, revokeScope);
             return ctx.client.request(revokeOp.method, fillPath(revokeOp.path, revokeScope), {
                 ...(revokeBody === undefined ? {} : { body: revokeBody }),
@@ -3567,7 +3677,7 @@ const inviteGrantsThenRevokes = {
          * handed out is taken back before it returns. */
         try {
             if ((await canRead()) === true) {
-                return ctx.findings.backend(this.id, ctx.entityName, "an invite grants access before it is accepted", `inviting ${delegate.id} made ${ctx.entityName} ${id} readable immediately. The accept ` +
+                return ctx.findings.backend(this.id, ctx.entityName, "an invite grants access before it is accepted", `inviting ${delegate.id} made ${subject} readable immediately. The accept ` +
                     "step is then theatre — anyone who can be named in an invite body is already in.", [invited]);
             }
             if (spec.tokenFrom === "outOfBand") {
@@ -3622,7 +3732,7 @@ const inviteGrantsThenRevokes = {
             if (issued !== undefined)
                 delegate.adoptCredential?.(issued);
             if ((await canRead()) === false) {
-                return ctx.findings.backend(this.id, ctx.entityName, "accepting an invite does not grant access", `${delegate.id} accepted an invite to ${ctx.entityName} ${id} and still cannot read it. ` +
+                return ctx.findings.backend(this.id, ctx.entityName, "accepting an invite does not grant access", `${delegate.id} accepted an invite and still cannot read ${subject}. ` +
                     "The invite flow completed; the grant did not.", [invited, accepted]);
             }
             if (grantId === undefined) {
@@ -3635,7 +3745,7 @@ const inviteGrantsThenRevokes = {
                 return ctx.findings.unresolved(this.id, ctx.entityName, `revoke returned ${revoked.status}`);
             }
             if ((await canRead()) === true) {
-                ctx.findings.backend(this.id, ctx.entityName, "revoking an invite does not remove access", `${delegate.id} can still read ${ctx.entityName} ${id} after the grant was revoked. ` +
+                ctx.findings.backend(this.id, ctx.entityName, "revoking an invite does not remove access", `${delegate.id} can still read ${subject} after the grant was revoked. ` +
                     "A share that cannot be taken back is a standing leak.", [invited, accepted, revoked]);
             }
             return ASSERTED;
@@ -4653,6 +4763,25 @@ function writableStringFields(ctx, record) {
     }
     return out;
 }
+/**
+ * The instance an action binds from, as it is now. An earlier action — or this one's x-before —
+ * may have changed it since it was seeded: a reorder bound to every column the seed held refuses
+ * the column added since. The fresh read leads; the seeded records stay behind it for whatever the
+ * read does not hold.
+ */
+async function currentRecords(ctx, scope) {
+    const readOp = ctx.readOp;
+    if (readOp === undefined || !canFillPath(readOp.path, scope))
+        return ctx.records;
+    const read = await ctx.client.get(fillPath(readOp.path, scope), {
+        headers: ctx.auth(),
+        operationId: readOp.operationId,
+    });
+    const body = read.responseBody;
+    if (read.status >= 300 || body === null || typeof body !== "object" || Array.isArray(body))
+        return ctx.records;
+    return [body, ...ctx.records];
+}
 const declaredEffectsOccur = {
     plan: (ctx) => when(ctx.effectOps.length > 0),
     /* An effect is counted by reading whole sets before and after, across pages. */
@@ -4699,8 +4828,17 @@ const declaredEffectsOccur = {
                         return;
                     }
                     beforeBody = beforeInvoked.responseBody;
+                    /* A prelude that creates is the run's to remove. One through the entity's own create is
+                     * already tracked; an invite is not, since an invite POST is never an entity's create. */
+                    const made = beforeOp.action === "create" ? ctx.model.entities.get(beforeOp.entity ?? "") : undefined;
+                    if (made !== undefined && made.delete !== undefined) {
+                        const id = findCreatedId(beforeBody, createdIdKeys(made.name, made.identity));
+                        if (id !== undefined)
+                            ctx.recordCreated?.(made.name, id, { ...beforeScope });
+                    }
                 }
-                scope = bindActionScope(op.pathParams, ctx.records, scope, actionBind, beforeBody);
+                const current = await currentRecords(ctx, scope);
+                scope = bindActionScope(op.pathParams, current, scope, actionBind, beforeBody);
                 if (!canFillPath(op.path, scope)) {
                     const missing = op.pathParams.filter((name) => scope[name] === undefined);
                     ctx.findings.gap(this.id, subject(ctx.entityName, op.operationId, fixture), `${op.operationId} could not be invoked`, `missing ${missing.map((name) => `{${name}}`).join(", ")}`, fixture);
@@ -4715,7 +4853,7 @@ const declaredEffectsOccur = {
                         continue;
                     befores.set(effect.entity, await observe(ctx, listOp, scope));
                 }
-                const prepared = applyActionBind(actionBind, ctx.records, beforeBody, op.hasRequestBody ? bodyForOp(ctx, op) : undefined);
+                const prepared = applyActionBind(actionBind, current, beforeBody, op.hasRequestBody ? bodyForOp(ctx, op) : undefined);
                 const body = prepared.body;
                 const invoked = await ctx.client.request(op.method, fillPath(op.path, scope), {
                     headers: ctx.auth(),
@@ -5333,7 +5471,13 @@ const declaredRateLimitHonoured = {
     subjects: (entity, model) => ownOps(entity, model, (op) => op.rateLimit !== null && op.rateLimit.rps !== null),
     async run(ctx) {
         const byCategory = new Map();
+        /* Only a route something actually sent was paced and judged. Claiming the rest would mark
+         * them graded with no request behind them, and the contract tier never calls a graded one. */
+        const observed = new Set();
         for (const exchange of ctx.client.exchangesForEntity(ctx.entityName)) {
+            const op = exchange.operationId === undefined ? undefined : ctx.model.byOperationId.get(exchange.operationId);
+            if (op?.rateLimit?.rps !== null && op?.rateLimit?.rps !== undefined)
+                observed.add(op.operationId);
             if (exchange.status !== 429)
                 continue;
             if (exchange.rateLimitSource !== "tag" || exchange.rateLimitHadRoom !== true)
@@ -5348,6 +5492,7 @@ const declaredRateLimitHonoured = {
                 `the declared rate is wrong, or the backend enforces a stricter one than "${category}" ` +
                 "documents.", exchanges.slice(0, 3));
         }
+        ctx.judged?.([...observed]);
         return ASSERTED;
     },
 };
@@ -6312,11 +6457,21 @@ const sortDefaultOrderApplied = {
     subjects: subjectsOf.list,
     async run(ctx, { declared }) {
         const limit = pageSize(ctx);
-        const implicit = await collectSet(ctx, limit);
-        const explicit = await collectSet(ctx, limit, {}, declared);
+        let implicit = await collectSet(ctx, limit);
+        let explicit = await collectSet(ctx, limit, {}, declared);
         if (implicit === null || explicit === null) {
             return ctx.findings.unresolved(this.id, ctx.entityName, "default-order walk was rejected");
         }
+        const settled = await settlePair(ctx.identity, implicit, explicit, {
+            first: () => collectSet(ctx, limit, {}, undefined, true),
+            second: () => collectSet(ctx, limit, {}, declared, true),
+        });
+        if (settled === "moving")
+            return ctx.findings.unresolved(this.id, ctx.entityName, MOVING);
+        if (settled === null)
+            return ctx.findings.unresolved(this.id, ctx.entityName, "default-order walk was rejected");
+        implicit = settled.first;
+        explicit = settled.second;
         if (!implicit.complete || !explicit.complete) {
             return ctx.findings.unresolved(this.id, ctx.entityName, "the walk is incomplete, so default order cannot be compared");
         }
@@ -6343,10 +6498,20 @@ const sortStableTiebreak = {
     async run(ctx, { primary, tiebreak }) {
         const order = sortTerm(conv(ctx), primary, "asc");
         /* Two independent reads: a shared one would compare a walk with itself. */
-        const first = await readSet(ctx, {}, { fresh: true, order });
-        const second = await readSet(ctx, {}, { fresh: true, order });
-        if (first.status !== "ok" || second.status !== "ok")
+        const read = async () => {
+            const result = await readSet(ctx, {}, { fresh: true, order });
+            return result.status === "ok" ? result : null;
+        };
+        const firstRead = await read();
+        const secondRead = await read();
+        if (firstRead === null || secondRead === null)
+            return ctx.findings.unresolved(this.id, ctx.entityName, "repeat sort was rejected");
+        const settled = await settlePair(ctx.identity, firstRead, secondRead, { first: read, second: read });
+        if (settled === "moving")
+            return ctx.findings.unresolved(this.id, ctx.entityName, MOVING);
+        if (settled === null)
             return ctx.findings.unresolved(this.id, ctx.entityName, "repeat sort was rejected");
+        const { first, second } = settled;
         if (ids(first.items, ctx.identity).join(",") !== ids(second.items, ctx.identity).join(",")) {
             return ctx.findings.backend(this.id, ctx.entityName, "the same order is not deterministic across two walks", `order=${order} (stableTiebreak=${tiebreak}) returned two different sequences.`, [first.last.exchange, second.last.exchange]);
         }
@@ -7126,6 +7291,7 @@ export const CHECKS = [
     rootReadCheck,
     disposableCheck,
     publicGetCheck,
+    contractCallCheck,
     /* declared side effects and async lifecycles, last: both invoke operations that change the
      * world, and both are meaningless if the read surface above is already known broken */
     declaredEffectsOccur,