@malloy-publisher/server 0.0.227 → 0.0.229

package/src/service/materialization_service.ts

@@ -14,13 +14,13 @@ import {
    MaterializationMode,
    recordAutoLoadOutcome,
    recordDropTables,
+   recordManifestBindDegraded,
    recordMaterializationRun,
    recordSourceBuildDuration,
    recordSourcesOutcome,
 } from "../materialization_metrics";
 import {
    BuildInstruction,
-   BuildManifest,
    BuildManifestResult,
    BuildPlan,
    FreshnessManifest,
@@ -41,7 +41,12 @@ import {
    iterGraphSources,
 } from "./build_plan";
 import { EnvironmentStore } from "./environment_store";
-import { bareTableName, quoteIdentifier, quoteTablePath } from "./quoting";
+import {
+   bareTableName,
+   quoteIdentifier,
+   quoteManifestTablePath,
+   quoteTablePath,
+} from "./quoting";
 import { resolveEnvironmentId } from "./resolve_environment";
 
 /**
@@ -177,6 +182,38 @@ export class MaterializationService {
       );
    }
 
+   /**
+    * Every materialization across all packages in an environment, newest first.
+    * Each record carries its `packageName`, so an env-scoped view can group or
+    * label by package without a per-package fan-out.
+    */
+   async listEnvironmentMaterializations(
+      environmentName: string,
+      options?: { limit?: number; offset?: number },
+   ): Promise<Materialization[]> {
+      const environmentId = await this.resolveEnvironmentId(environmentName);
+      return this.repository.listMaterializationsByEnvironment(
+         environmentId,
+         options,
+      );
+   }
+
+   /**
+    * `created_at` of the newest scheduler-fired materialization for a package,
+    * or null if none. The standalone scheduler uses this on its first arm to
+    * recover a fire missed during downtime (see MaterializationScheduler.arm).
+    */
+   async getLatestScheduledFireAt(
+      environmentName: string,
+      packageName: string,
+   ): Promise<Date | null> {
+      const environmentId = await this.resolveEnvironmentId(environmentName);
+      return this.repository.getLatestScheduledFireAt(
+         environmentId,
+         packageName,
+      );
+   }
+
    async getMaterialization(
       environmentName: string,
       packageName: string,
@@ -219,6 +256,13 @@ export class MaterializationService {
          buildInstructions?: BuildInstruction[];
          referenceManifest?: ManifestReference[];
          strictUpstreams?: boolean;
+         /**
+          * What initiated this run. `ON_DEMAND` (default) = a manual/API create;
+          * `SCHEDULER` = the standalone materialization scheduler firing a
+          * package's `materialization.schedule` cron. Recorded on the run
+          * metadata so a scheduled rebuild is distinguishable from a manual one.
+          */
+         trigger?: "ON_DEMAND" | "SCHEDULER";
       } = {},
    ): Promise<Materialization> {
       const environmentId = await this.resolveEnvironmentId(environmentName);
@@ -244,10 +288,12 @@ export class MaterializationService {
       }
 
       const forceRefresh = options.forceRefresh ?? false;
+      const trigger = options.trigger ?? "ON_DEMAND";
       const metadata = {
          forceRefresh,
          sourceNames: options.sourceNames ?? null,
          mode: orchestrated ? "orchestrated" : "auto",
+         trigger,
       };
 
       let created: Materialization;
@@ -280,6 +326,7 @@ export class MaterializationService {
                buildInstructions,
                referenceManifest: options.referenceManifest,
                strictUpstreams: options.strictUpstreams,
+               trigger,
             },
             signal,
          ),
@@ -306,6 +353,7 @@ export class MaterializationService {
          buildInstructions: BuildInstruction[] | undefined;
          referenceManifest: ManifestReference[] | undefined;
          strictUpstreams: boolean | undefined;
+         trigger: "ON_DEMAND" | "SCHEDULER";
       },
       signal: AbortSignal,
    ): Promise<void> {
@@ -379,6 +427,7 @@ export class MaterializationService {
             forceRefresh: opts.forceRefresh,
             sourceNames: opts.sourceNames ?? null,
             mode,
+            trigger: opts.trigger,
             sourcesBuilt,
             sourcesReused,
             durationMs,
@@ -466,9 +515,13 @@ export class MaterializationService {
    /**
     * Project the caller-supplied upstream reference manifest into the seed
     * entry map `executeInstructedBuild` consumes. Each reference is keyed by the
-    * compiler's manifest-lookup sourceEntityId and carries only the physical
-    * table name — enough for the build Manifest to resolve a downstream persist
-    * reference to the existing table without rebuilding the upstream.
+    * compiler's manifest-lookup sourceEntityId and carries the physical table
+    * name plus the connection it lives on — enough for the build Manifest to
+    * resolve a downstream persist reference to the existing table, and to quote
+    * that reference for the connection's dialect so it resolves on a
+    * case-folding engine (see {@link quoteSeedTablePath}). `connectionName` is
+    * optional on the wire: an older control plane that omits it seeds unquoted,
+    * exactly as before.
     */
    private referenceManifestToEntries(
       referenceManifest: ManifestReference[] | undefined,
@@ -478,6 +531,7 @@ export class MaterializationService {
          entries[ref.sourceEntityId] = {
             sourceEntityId: ref.sourceEntityId,
             physicalTableName: ref.physicalTableName,
+            connectionName: ref.connectionName,
          };
       }
       return entries;
@@ -524,11 +578,17 @@ export class MaterializationService {
       // stamps freshness (dataAsOf/window/fallback) on the wire manifest it
       // distributes, not on this in-memory post-build load, so these sources are
       // bound un-gated (always serve the freshly-built table).
-      const manifestEntries: BuildManifest["entries"] = {};
+      const manifestEntries: FreshnessManifest = {};
       for (const [sourceEntityId, entry] of Object.entries(entries)) {
          if (entry.physicalTableName) {
             manifestEntries[sourceEntityId] = {
                tableName: entry.physicalTableName,
+               // Carried so the bind step can quote the physical path for the
+               // connection's dialect (Package.quoteBoundTableNames) — the
+               // build CREATEd it quoted, so an unquoted read would miss on a
+               // case-folding engine in the window before the control plane's
+               // wire-manifest rebind.
+               connectionName: entry.connectionName,
             };
          }
       }
@@ -586,6 +646,43 @@ export class MaterializationService {
       }
    }
 
+   /**
+    * Quote a seeded upstream's physical path for the in-memory build Manifest,
+    * mirroring the CREATE side ({@link quoteManifestTablePath}) so a downstream
+    * persist source resolves the reference on a case-folding engine. The seed's
+    * own connection (carried on the entry) supplies the dialect. If it can't be
+    * resolved — an older control plane omitted `connectionName`, or the named
+    * connection isn't part of this build — the path binds unquoted: the build
+    * then fails loudly at the downstream CREATE on a case-folding engine (a
+    * self-signaling miss, unlike the serve path), and is unaffected elsewhere.
+    */
+   private quoteSeedTablePath(
+      sourceEntityId: string,
+      physicalTableName: string,
+      connectionName: string | undefined,
+      connections: Map<string, MalloyConnection>,
+   ): string {
+      const connection = connectionName
+         ? connections.get(connectionName)
+         : undefined;
+      if (!connection) {
+         // A named-but-absent connection is a real gap (the seed can't be
+         // quoted); a missing name is the benign older-CP default. Only the
+         // former is worth a signal.
+         if (connectionName) {
+            recordManifestBindDegraded();
+            logger.warn(
+               "Seeded upstream names a connection not present in this build; " +
+                  "leaving its manifest path unquoted (a downstream build will " +
+                  "fail on a case-folding engine)",
+               { sourceEntityId, connectionName },
+            );
+         }
+         return physicalTableName;
+      }
+      return quoteManifestTablePath(physicalTableName, connection.dialectName);
+   }
+
    /**
     * Shared build loop for both auto-run and orchestrated builds. Seeds the
     * manifest with carried-forward (reused) upstream entries so downstream
@@ -630,8 +727,19 @@ export class MaterializationService {
       const entries: Record<string, ManifestEntry> = {};
       for (const [sourceEntityId, entry] of Object.entries(seedEntries)) {
          if (entry.physicalTableName) {
+            // The build Manifest feeds a downstream persist's `FROM` verbatim,
+            // so a seeded upstream must carry the SAME quoting the builder
+            // CREATEd it with — else the downstream CREATE misses the
+            // case-preserved table on a case-folding engine. The seed keeps its
+            // logical (unquoted) name in `entries` (the committed manifest, in
+            // logical-name space); only the in-memory build Manifest is quoted.
             manifest.update(sourceEntityId, {
-               tableName: entry.physicalTableName,
+               tableName: this.quoteSeedTablePath(
+                  sourceEntityId,
+                  entry.physicalTableName,
+                  entry.connectionName,
+                  connections,
+               ),
             });
          }
          entries[sourceEntityId] = entry;
@@ -733,7 +841,12 @@ export class MaterializationService {
       }
 
       // Make this table visible to downstream sources built later in this run.
-      manifest.update(sourceEntityId, { tableName: physicalTableName });
+      // Record the SAME quoted path the CREATE used (not the logical name): the
+      // build Manifest is pasted into a downstream `FROM` verbatim, so on a
+      // case-folding engine an unquoted name would miss the case-preserved table
+      // just written. The returned entry (below) keeps the logical name for the
+      // committed manifest; only this in-memory build Manifest is quoted.
+      manifest.update(sourceEntityId, { tableName: quotedPhysical });
 
       const durationMs = Math.round(performance.now() - startTime);
       recordSourceBuildDuration(durationMs);

package/src/service/materialization_test_fixtures.ts

@@ -120,6 +120,12 @@ export function fakeSource(opts: {
    freshnessSchedule?: FakeFreshnessSchedule;
    /** Model-file-level (`##`) freshness default. */
    modelFreshnessSchedule?: FakeFreshnessSchedule;
+   /**
+    * Spy on the args Malloy's SQL generation is handed — chiefly the
+    * `buildManifest` that resolves upstream persist references — so a test can
+    * assert what physical name a downstream build sees for its upstream.
+    */
+   onGetSQL?: (sqlOpts: unknown) => void;
 }): PersistSource {
    const fields = opts.annotationFields;
    return {
@@ -128,7 +134,10 @@ export function fakeSource(opts: {
       connectionName: opts.connectionName ?? "duckdb",
       dialectName: opts.dialectName ?? "duckdb",
       makeBuildId: () => opts.sourceEntityId,
-      getSQL: () => opts.sql ?? "SELECT 1",
+      getSQL: (sqlOpts?: unknown) => {
+         opts.onGetSQL?.(sqlOpts);
+         return opts.sql ?? "SELECT 1";
+      },
       annotations: {
          parseAsTag: () => ({
             tag: fakeTag(fields, opts.freshnessSchedule),

package/src/service/model.spec.ts

@@ -444,6 +444,55 @@ describe("service/model", () => {
             sinon.restore();
          });
 
+         it("maps a finalized-given rejection (code) to BadRequestError, not 500", async () => {
+            // Malloy throws this (extends Error, not MalloyError, not root-exported)
+            // when a client supplies a given an operator finalized. model.ts
+            // duck-types on `.code`; guard against that mapping regressing.
+            const finalizedErr = Object.assign(
+               new Error(
+                  "Given 'region' is finalized and cannot be overridden",
+               ),
+               { code: "runtime-given-finalized" },
+            );
+            const runnableStub = {
+               getPreparedResult: sinon.stub().rejects(finalizedErr),
+               run: sinon.stub(),
+            };
+            const modelMaterializer = {
+               loadQuery: sinon.stub().returns(runnableStub),
+               loadRestrictedQuery: sinon.stub().returns(runnableStub),
+            };
+
+            const model = new Model(
+               packageName,
+               mockModelPath,
+               {},
+               "model",
+               // eslint-disable-next-line @typescript-eslint/no-explicit-any
+               modelMaterializer as any,
+               // eslint-disable-next-line @typescript-eslint/no-explicit-any
+               { contents: {}, exports: [], queryList: [] } as any,
+               undefined,
+               undefined,
+               undefined,
+               undefined,
+               undefined,
+            );
+
+            await expect(
+               model.getQueryResults(
+                  undefined,
+                  undefined,
+                  "run: orders -> summary",
+                  undefined,
+                  undefined,
+                  { region: "EU" },
+               ),
+            ).rejects.toThrow(BadRequestError);
+
+            sinon.restore();
+         });
+
          /**
           * The row/byte caps live in `model_limits.ts` (unit-tested in
           * `model_limits.spec.ts`); these tests just confirm the wiring —
@@ -684,6 +733,49 @@ describe("service/model", () => {
             sinon.restore();
          });
 
+         it("maps a finalized-given rejection (code) to BadRequestError, not 500", async () => {
+            const finalizedErr = Object.assign(
+               new Error(
+                  "Given 'target_code' is finalized and cannot be overridden",
+               ),
+               { code: "runtime-given-finalized" },
+            );
+            const cellRunnable = {
+               getPreparedResult: sinon.stub().rejects(finalizedErr),
+               run: sinon.stub(),
+            };
+            const runnableCells = [
+               {
+                  type: "code" as const,
+                  text: "run: orders -> by_code",
+                  runnable: cellRunnable,
+               },
+            ];
+
+            const model = new Model(
+               packageName,
+               "test.malloynb",
+               {},
+               "notebook",
+               undefined,
+               undefined,
+               undefined,
+               undefined,
+               undefined,
+               // eslint-disable-next-line @typescript-eslint/no-explicit-any
+               runnableCells as any,
+               undefined,
+            );
+
+            await expect(
+               model.executeNotebookCell(0, undefined, undefined, {
+                  target_code: "AA",
+               }),
+            ).rejects.toThrow(BadRequestError);
+
+            sinon.restore();
+         });
+
          it("embeds model-level givens in executed cell newSources", async () => {
             const sourceInfo = { name: "carriers", schema: { fields: [] } };
             const givens = [

package/src/service/model.ts

@@ -1147,6 +1147,7 @@ export class Model {
             `Model compilation failed: ${this.compilationError.message}`,
          );
       }
+
       let runnable: QueryMaterializer;
       if (!this.modelMaterializer || !this.modelDef || !this.modelInfo)
          throw new BadRequestError("Model has no queryable entities.");
@@ -1309,16 +1310,23 @@ export class Model {
       // (for the row limit) and the run so a stale persist source falls back per
       // its declared policy — and prep/run agree on the same substitution.
       const buildManifest = this.resolveFreshBuildManifest();
-      const rowLimit = resolveModelQueryRowLimit(
-         (await runnable.getPreparedResult({ givens, buildManifest }))
-            .resultExplore.limit,
-         { defaultLimit: getDefaultQueryRowLimit(), maxRows },
-      );
-      const endTime = performance.now();
-      const executionTime = endTime - startTime;
 
+      // Prepare INSIDE the run try/catch: a bad-given / value-type throw at
+      // prepare time (getPreparedResult binds the givens) gets the same
+      // MalloyError→rethrow / else→400 handling as run, instead of escaping as
+      // a 500. `executionTime` is still captured after prepare and before run,
+      // preserving the pre-existing timing recorded by the success histogram.
+      let rowLimit = 0;
+      let executionTime = 0;
       let queryResults;
       try {
+         rowLimit = resolveModelQueryRowLimit(
+            (await runnable.getPreparedResult({ givens, buildManifest }))
+               .resultExplore.limit,
+            { defaultLimit: getDefaultQueryRowLimit(), maxRows },
+         );
+         executionTime = performance.now() - startTime;
+
          queryResults = await runnable.run({
             rowLimit,
             givens,
@@ -1337,6 +1345,31 @@ export class Model {
             "malloy.model.query.status": "error",
          });
 
+         // Bad client-supplied givens (unknown name, wrong-typed value, an
+         // operator-finalized override, ...) all surface as a Malloy
+         // `runtime-given-*` error. Malloy is the single validator; the publisher
+         // just maps its rejection to a clean 400. Duck-type on `.code`
+         // (MalloyCompileError extends Error, not MalloyError, and isn't
+         // root-exported). The `runtime-given-` prefix is a pinned coupling to
+         // Malloy's error codes (@malloydata/malloy given_binding.ts / runtime.ts);
+         // if they're renamed upstream, update it here (and in environment.ts) —
+         // otherwise these fall through to the generic 400 below with a worse
+         // message, and the /compile path silently omits `sql`.
+         const givenCode = (error as { code?: string })?.code;
+         if (
+            typeof givenCode === "string" &&
+            givenCode.startsWith("runtime-given-")
+         ) {
+            logger.debug("Rejected client-supplied given", {
+               environmentName: this.packageName,
+               modelPath: this.modelPath,
+               error: error instanceof Error ? error.message : String(error),
+            });
+            throw new BadRequestError(
+               error instanceof Error ? error.message : String(error),
+            );
+         }
+
          // Re-throw Malloy errors as-is (they will be handled by error handler)
          if (error instanceof MalloyError) {
             throw error;
@@ -1607,6 +1640,24 @@ export class Model {
             if (error instanceof FilterValidationError) {
                throw new BadRequestError(error.message);
             }
+            // Bad client-supplied givens (unknown name, wrong-typed value,
+            // finalized override, ...) surface as a Malloy `runtime-given-*`
+            // error; see getQueryResults. Malloy validates, the publisher maps
+            // to 400. Duck-type on `.code` (not a MalloyError, not root-exported).
+            const givenCode = (error as { code?: string })?.code;
+            if (
+               typeof givenCode === "string" &&
+               givenCode.startsWith("runtime-given-")
+            ) {
+               logger.debug("Rejected client-supplied given", {
+                  environmentName: this.packageName,
+                  modelPath: this.modelPath,
+                  error: error instanceof Error ? error.message : String(error),
+               });
+               throw new BadRequestError(
+                  error instanceof Error ? error.message : String(error),
+               );
+            }
             if (error instanceof MalloyError) {
                throw error;
             }

package/src/service/package.ts

@@ -28,7 +28,10 @@ import {
    ServiceUnavailableError,
 } from "../errors";
 import { formatDuration, logger } from "../logger";
-import { recordBuildPlanComputeDuration } from "../materialization_metrics";
+import {
+   recordBuildPlanComputeDuration,
+   recordManifestBindDegraded,
+} from "../materialization_metrics";
 import {
    LOAD_DURATION_BUCKETS_MS,
    recordPackageLoadPhases,
@@ -42,7 +45,9 @@ import {
 } from "../storage/DatabaseInterface";
 import { errMessage, ignoreDotfiles } from "../utils";
 import { computePackageBuildPlan } from "./build_plan";
+import { CronEvaluator } from "./cron_evaluator";
 import { filterFreshManifest } from "./freshness";
+import { isQuotedIdentifierPath, quoteManifestTablePath } from "./quoting";
 import { Model } from "./model";
 import { assertPersistNamesQuoted } from "./persist_annotation_validation";
 
@@ -237,6 +242,17 @@ export class Package {
       packageName: string,
       packagePath: string,
       environmentMalloyConfig: PackageConnectionInput,
+      /**
+       * Delete `packagePath` if the load fails. Opt-in, and only correct for a
+       * caller that created the directory itself (an install staged into place),
+       * where the half-built tree is Publisher's to clean up and `installPackage`
+       * rolls the previous one back. Every other caller loads a directory that
+       * already existed: a reload of a package that is currently serving, or a
+       * user directory registered via addPackage. Deleting those on a transient
+       * compile error destroys the source and takes the package offline, so the
+       * default is to leave the directory alone.
+       */
+      cleanupDirectoryOnFailure: boolean = false,
    ): Promise<Package> {
       assertSafeEnvironmentPath(packagePath);
       const startTime = performance.now();
@@ -278,23 +294,30 @@ export class Package {
             malloy_package_name: packageName,
             status: packageLoadFailureStatus(error),
          });
-         // Clean up the package directory on failure, but NOT when packagePath
-         // is an in-place mount symlink (watch mode). Removing it would unmount
-         // the package, so a transient compile error from a half-typed model
-         // saved mid-edit would brick the package until a restart. The symlink
-         // points at the user's live source, which is left untouched; the next
-         // save recompiles against it.
+         // Clean up the package directory only when the caller opted in (an
+         // install that staged this tree), and never when packagePath is an
+         // in-place mount symlink (watch mode). Removing it would unmount the
+         // package, so a transient compile error from a half-typed model saved
+         // mid-edit would brick the package until a restart. The symlink points
+         // at the user's live source, which is left untouched; the next save
+         // recompiles against it.
          try {
-            const stat = await fs.lstat(packagePath).catch(() => null);
-            if (stat?.isSymbolicLink()) {
+            if (!cleanupDirectoryOnFailure) {
                logger.info(
-                  `Skipping cleanup of symlinked package path on failure: ${packagePath}`,
+                  `Preserving existing package directory after failed load: ${packagePath}`,
                );
             } else {
-               await fs.rm(packagePath, { recursive: true, force: true });
-               logger.info(
-                  `Cleaned up failed package directory: ${packagePath}`,
-               );
+               const stat = await fs.lstat(packagePath).catch(() => null);
+               if (stat?.isSymbolicLink()) {
+                  logger.info(
+                     `Skipping cleanup of symlinked package path on failure: ${packagePath}`,
+                  );
+               } else {
+                  await fs.rm(packagePath, { recursive: true, force: true });
+                  logger.info(
+                     `Cleaned up failed package directory: ${packagePath}`,
+                  );
+               }
             }
          } catch (cleanupError) {
             logger.warn(`Failed to clean up package directory ${packagePath}`, {
@@ -847,6 +870,20 @@ export class Package {
          }
       }
 
+      // Rule 4: the cron must be a valid 5-field UNIX expression (no L/W/#/?
+      // extensions — see CronEvaluator). Enforced here so publish (strict),
+      // PATCH (strict), package load (warn), and the standalone scheduler all
+      // apply the identical rule — a garbage cron can no longer pass publish
+      // and then silently never arm.
+      if (packageSchedule && !new CronEvaluator().isValid(packageSchedule)) {
+         warnings.push(
+            `materialization.schedule in ${PACKAGE_MANIFEST_NAME} is not a valid ` +
+               `5-field UNIX cron: ${JSON.stringify(packageSchedule)}. Use ` +
+               `"minute hour day-of-month month day-of-week" (no L/W/#/? ` +
+               `extensions).`,
+         );
+      }
+
       return warnings;
    }
 
@@ -910,6 +947,71 @@ export class Package {
       return this.malloyConfig.connections.lookupConnection(connectionName);
    }
 
+   /**
+    * Quote each manifest entry's physical table path for its connection's
+    * dialect, mirroring the build side: the builder CREATEs the table with
+    * {@link quoteTablePath} (per-segment, case-preserved), so on a case-folding
+    * engine (Snowflake uppercases unquoted identifiers) the stored name is only
+    * reachable through the same quoting. Malloy pastes a manifest `tableName`
+    * into `FROM` verbatim by contract (a bare name means "let the engine
+    * fold"), so the case-preserving producer — us — must hand it the quoted
+    * form. Same module quotes CREATE and read: the two sides cannot drift.
+    *
+    * A name already carrying a quote character is passed through verbatim (it
+    * is already canonical SQL; control-plane-assigned names are sanitized to
+    * `[A-Za-z0-9_\-.]` and can never contain one).
+    *
+    * Two cases bind verbatim, and they are NOT the same signal:
+    * - No `connectionName`: a bare/engine-folding producer that never recorded
+    *   a connection (simple_builder / malloy-cli). Expected and benign — the
+    *   pre-change behavior, bound silently, nothing regresses.
+    * - `connectionName` present but unresolvable: a genuine misconfiguration
+    *   (the connection was renamed/removed, or the manifest is out of sync with
+    *   this package's config). This one entry is degraded — but the source
+    *   would not serve regardless of quoting, since Malloy needs the connection
+    *   to run any query against it, so we degrade just this entry rather than
+    *   fail the whole package bind, and log at ERROR with a fix.
+    */
+   private async quoteBoundTableNames(
+      entries: FreshnessManifest,
+   ): Promise<FreshnessManifest> {
+      const out: FreshnessManifest = {};
+      for (const [sourceEntityId, entry] of Object.entries(entries)) {
+         let tableName = entry.tableName;
+         if (entry.connectionName && !isQuotedIdentifierPath(tableName)) {
+            try {
+               const connection = await this.getMalloyConnection(
+                  entry.connectionName,
+               );
+               tableName = quoteManifestTablePath(
+                  tableName,
+                  connection.dialectName,
+               );
+            } catch (err) {
+               recordManifestBindDegraded();
+               logger.error(
+                  `Manifest entry '${sourceEntityId}' names connection ` +
+                     `'${entry.connectionName}', which this package cannot ` +
+                     `resolve: binding its table path unquoted, so this source ` +
+                     `will not serve on a case-folding engine (and queries ` +
+                     `against it fail regardless, since Malloy needs the ` +
+                     `connection to run them). Fix: ensure a connection named ` +
+                     `'${entry.connectionName}' exists in this package's ` +
+                     `config, or rebuild the manifest against the current config.`,
+                  {
+                     packageName: this.packageName,
+                     sourceEntityId,
+                     connectionName: entry.connectionName,
+                     error: err instanceof Error ? err.message : String(err),
+                  },
+               );
+            }
+         }
+         out[sourceEntityId] = { ...entry, tableName };
+      }
+      return out;
+   }
+
    public getMalloyConfig(): MalloyConfig {
       return this.malloyConfig;
    }
@@ -938,6 +1040,11 @@ export class Package {
     * — the caller (manifest service) decides how to retry.
     */
    public async reloadAllModels(entries: FreshnessManifest): Promise<void> {
+      // Quote each bound physical name for its connection's dialect BEFORE any
+      // projection: everything downstream (model hydration, the per-query
+      // freshness gate, /compile, /status) reads the entries recorded here, so
+      // this is the one place the write side's quoting is mirrored onto reads.
+      entries = await this.quoteBoundTableNames(entries);
       // Models are hydrated against the tableName-only projection; the freshness
       // fields gate the serve path per query (via getFreshBuildManifest), not
       // model hydration.