@reventlessdev/reventless-aws 3.0.0-alpha.181 → 3.0.0-alpha.183

package/CHANGELOG.md

@@ -3,6 +3,20 @@
 All notable changes to this project will be documented in this file.
 See [Conventional Commits](https://conventionalcommits.org) for commit guidelines.
 
+# 3.0.0-alpha.183 (2026-07-08)
+
+### Bug Fixes
+
+* **reventless-aws:** stop admin-base schema clobber of split-mode DomainApi ([afce85f](https://github.com/ReventlessDev/reventless-core/commit/afce85fa57474735cea3dcb1c2a151c2d8804f0e))
+
+
+# 3.0.0-alpha.182 (2026-07-07)
+
+### Bug Fixes
+
+* **reventless-aws:** fence composite-partition DCB slices on one composite key ([e5f2d95](https://github.com/ReventlessDev/reventless-core/commit/e5f2d95652d795e4dea60e28548f96100a997e78))
+
+
 # 3.0.0-alpha.181 (2026-07-07)
 
 ### Bug Fixes

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@reventlessdev/reventless-aws",
-  "version": "3.0.0-alpha.181",
+  "version": "3.0.0-alpha.183",
   "description": "AWS adapters for Reventless",
   "license": "Apache-2.0",
   "dependencies": {
@@ -9,16 +9,16 @@
     "sury": "11.0.0-alpha.4",
     "uuid": "^13.0.0",
     "@reventlessdev/rescript-aws-sdk": "2.2.0-alpha.20",
-    "@reventlessdev/rescript-jest": "1.0.0-alpha.6",
     "@reventlessdev/rescript-effect": "0.1.0-alpha.25",
+    "@reventlessdev/rescript-jest": "1.0.0-alpha.6",
     "@reventlessdev/rescript-pulumi-aws": "2.4.0-alpha.46",
     "@reventlessdev/rescript-pulumi-pulumi": "2.3.0-alpha.14",
     "@reventlessdev/rescript-uuid": "1.1.0-alpha.14",
-    "@reventlessdev/reventless-core": "3.0.0-alpha.144",
+    "@reventlessdev/reventless-core": "3.0.0-alpha.145",
+    "@reventlessdev/reventless-infra": "3.0.0-alpha.90",
     "@reventlessdev/reventless-interop": "3.0.0-alpha.24",
-    "@reventlessdev/reventless-spec": "3.0.0-alpha.68",
-    "@reventlessdev/reventless-postgres": "3.0.0-alpha.8",
-    "@reventlessdev/reventless-infra": "3.0.0-alpha.90"
+    "@reventlessdev/reventless-postgres": "3.0.0-alpha.9",
+    "@reventlessdev/reventless-spec": "3.0.0-alpha.68"
   },
   "devDependencies": {
     "rescript": "^12.3.0",

package/src/Platform.res

@@ -689,37 +689,56 @@ module MakeWithConfig = (
     //   - split mode: platformApi from splitApiOutputsRef
     //   - unified mode / not-yet-populated: domainApi
     preAdminResolversSchemaHook: (~adminBarrier) => {
-      let targetApi = switch splitApiOutputsRef.contents {
-      | Some({platformApi}) => platformApi
-      | None => domainApi
+      // The admin-base SDL stitches AdminApi.baseFragment with an EMPTY plugin
+      // list, and startSchemaCreation REPLACES the whole schema. In split mode
+      // the admin schema belongs on the PlatformApi ONLY — the DomainApi carries
+      // plugin fields (emptyBaseFragment). If we pushed the admin-base-only SDL
+      // to the DomainApi it would wipe every plugin field, leaving exactly the
+      // admin-base set (the alpha 2026-07-08 clobber). So in split mode we push
+      // ONLY when the PlatformApi is known; if the ref is not yet populated we
+      // SKIP (never fall back to domainApi). Unified mode legitimately shares one
+      // API, so an unpopulated ref there means domainApi.
+      let targetApiOpt = switch (Config.splitApi, splitApiOutputsRef.contents) {
+      | (_, Some({platformApi})) => Some(platformApi)
+      | (false, None) => Some(domainApi)
+      | (true, None) => None
       }
-      let adminBaseFragment = AppSync_Adapter.injectAwsAuthAll(
-        ReventlessCore.AdminApi.baseFragment(~cloner=Config.cloner),
-        ~group="Admin",
-      )
-      let sdl = ReventlessCore.GraphQL_Stitcher.stitch(
-        ~baseFragment=adminBaseFragment,
-        ~pluginFragments=[],
-      )->AppSync_Adapter.stampSharedIamTypes
-      (targetApi, adminBarrier)
-      ->Pulumi.Output.all2
-      ->Pulumi.Output.flatMap(((api, _)) =>
-        api.id->Pulumi.Output.flatMap(apiId => {
-          log.info(~comp="preAdminResolversSchemaHook", `Pushing admin schema to ${apiId}`)
-          let client = AppSync_Adapter.getClient()
-          client
-          ->AppSync_Adapter.startSchemaCreationRetrying({apiId, definition: sdl})
-          ->Promise.then(async _ => {
-            log.info(
-              ~comp="preAdminResolversSchemaHook",
-              "startSchemaCreation called, waiting for ACTIVE",
-            )
-            await AppSync_Adapter.waitForSchemaActive(client, apiId)
-            log.info(~comp="preAdminResolversSchemaHook", "schema is ACTIVE")
+      switch targetApiOpt {
+      | None =>
+        log.error(
+          ~comp="preAdminResolversSchemaHook",
+          "split mode but the PlatformApi is not available at hook time — SKIPPING the admin schema push to avoid clobbering the DomainApi (pushing admin-base here would wipe every plugin field)",
+        )
+        adminBarrier
+      | Some(targetApi) =>
+        let adminBaseFragment = AppSync_Adapter.injectAwsAuthAll(
+          ReventlessCore.AdminApi.baseFragment(~cloner=Config.cloner),
+          ~group="Admin",
+        )
+        let sdl = ReventlessCore.GraphQL_Stitcher.stitch(
+          ~baseFragment=adminBaseFragment,
+          ~pluginFragments=[],
+        )->AppSync_Adapter.stampSharedIamTypes
+        (targetApi, adminBarrier)
+        ->Pulumi.Output.all2
+        ->Pulumi.Output.flatMap(((api, _)) =>
+          api.id->Pulumi.Output.flatMap(apiId => {
+            log.info(~comp="preAdminResolversSchemaHook", `Pushing admin schema to ${apiId}`)
+            let client = AppSync_Adapter.getClient()
+            client
+            ->AppSync_Adapter.startSchemaCreationRetrying({apiId, definition: sdl})
+            ->Promise.then(async _ => {
+              log.info(
+                ~comp="preAdminResolversSchemaHook",
+                "startSchemaCreation called, waiting for ACTIVE",
+              )
+              await AppSync_Adapter.waitForSchemaActive(client, apiId)
+              log.info(~comp="preAdminResolversSchemaHook", "schema is ACTIVE")
+            })
+            ->Pulumi.Output.fromPromise
           })
-          ->Pulumi.Output.fromPromise
-        })
-      )
+        )
+      }
     },
 
     // Accumulate fragments across independent plugin deployments: each plugin
@@ -957,26 +976,44 @@ module MakeWithConfig = (
                   ~sdl=s,
                   ~typeName="Subscription",
                 )
+              // Identity-aware drift check (not a bare count): the live schema is
+              // "intact" only when it is a SUPERSET of every root field we would
+              // push. Comparing name SETS heals equal-cardinality drift and field
+              // *swaps* — an admin-base clobber that leaves the DomainApi with the
+              // SAME number of root fields but the WRONG ones (admin-base instead
+              // of plugin fields) has a matching count yet is missing every
+              // expected plugin field, so a count test would wrongly skip.
+              let missingFields = ReventlessCore.GraphQL_Stitcher.missingRootFields(
+                ~expectedSdl=sdl,
+                ~liveSdl,
+              )
               let skipPush = switch storedHash {
               | Some(prev) if prev == currentHash =>
-                let expected = countRoots(sdl)
-                let live = countRoots(liveSdl)
                 if liveSdl == "" {
                   log.info(
                     ~comp="preResolversSchemaHook",
                     `hash matches but live schema could not be introspected — forcing repair push (check appsync:GetIntrospectionSchema permission)`,
                   )
                   false
-                } else if live < expected {
+                } else if missingFields->Array.length > 0 {
                   log.info(
                     ~comp="preResolversSchemaHook",
-                    `hash matches but live schema drifted (${live->Int.toString} root field(s) live vs ${expected->Int.toString} expected) — forcing repair push`,
+                    `hash matches but live schema is missing ${missingFields
+                      ->Array.length
+                      ->Int.toString} expected root field(s) (e.g. ${missingFields
+                      ->Array.slice(~start=0, ~end=5)
+                      ->Array.join(", ")}) — forcing repair push`,
                   )
                   false
                 } else {
                   log.info(
                     ~comp="preResolversSchemaHook",
-                    `SDL unchanged (hash ${currentHash->String.slice(~start=0, ~end=12)}…) and live schema intact (${live->Int.toString} root fields); skipping push`,
+                    `SDL unchanged (hash ${currentHash->String.slice(
+                        ~start=0,
+                        ~end=12,
+                      )}…) and live schema is a superset of the expected root fields (${countRoots(
+                        liveSdl,
+                      )->Int.toString} live); skipping push`,
                   )
                   true
                 }

package/src/Platform.res.mjs

@@ -645,23 +645,12 @@ function MakeWithConfig(Config) {
           let client = AppSync_Adapter$ReventlessAws.getClient();
           let liveSdl = await AppSync_Adapter$ReventlessAws.getIntrospectionSdl(client, apiId);
           let countRoots = s => (GraphQL_Stitcher$ReventlessCore.countRootTypeFields(s, "Mutation") + GraphQL_Stitcher$ReventlessCore.countRootTypeFields(s, "Query") | 0) + GraphQL_Stitcher$ReventlessCore.countRootTypeFields(s, "Subscription") | 0;
-          let skipPush;
-          if (storedHash !== undefined && storedHash === currentHash) {
-            let expected = countRoots(sdl);
-            let live = countRoots(liveSdl);
-            if (liveSdl === "") {
-              log.info("preResolversSchemaHook", undefined, `hash matches but live schema could not be introspected — forcing repair push (check appsync:GetIntrospectionSchema permission)`);
-              skipPush = false;
-            } else if (live < expected) {
-              log.info("preResolversSchemaHook", undefined, `hash matches but live schema drifted (` + live.toString() + ` root field(s) live vs ` + expected.toString() + ` expected) — forcing repair push`);
-              skipPush = false;
-            } else {
-              log.info("preResolversSchemaHook", undefined, `SDL unchanged (hash ` + currentHash.slice(0, 12) + `…) and live schema intact (` + live.toString() + ` root fields); skipping push`);
-              skipPush = true;
-            }
-          } else {
-            skipPush = false;
-          }
+          let missingFields = GraphQL_Stitcher$ReventlessCore.missingRootFields(sdl, liveSdl);
+          let skipPush = storedHash !== undefined && storedHash === currentHash ? (
+              liveSdl === "" ? (log.info("preResolversSchemaHook", undefined, `hash matches but live schema could not be introspected — forcing repair push (check appsync:GetIntrospectionSchema permission)`), false) : (
+                  missingFields.length !== 0 ? (log.info("preResolversSchemaHook", undefined, `hash matches but live schema is missing ` + missingFields.length.toString() + ` expected root field(s) (e.g. ` + missingFields.slice(0, 5).join(", ") + `) — forcing repair push`), false) : (log.info("preResolversSchemaHook", undefined, `SDL unchanged (hash ` + currentHash.slice(0, 12) + `…) and live schema is a superset of the expected root fields (` + countRoots(liveSdl).toString() + ` live); skipping push`), true)
+                )
+            ) : false;
           if (!skipPush) {
             if (GraphQL_Stitcher$ReventlessCore.isCatastrophicSchemaShrink(liveSdl, sdl, deploySchemaShrinkThreshold)) {
               return log.error("preResolversSchemaHook", undefined, `ABORTED schema push for ` + apiId + `: stitched SDL (` + countRoots(sdl).toString() + ` root field(s)) would catastrophically shrink the live schema (` + countRoots(liveSdl).toString() + ` root field(s), threshold ` + deploySchemaShrinkThreshold.toString() + `) — refusing to clobber resolvers (likely a stale concurrent-deploy scan)`);
@@ -692,24 +681,30 @@ function MakeWithConfig(Config) {
   };
   let hooks_preAdminResolversSchemaHook = adminBarrier => {
     let match = splitApiOutputsRef.contents;
-    let targetApi = match !== undefined ? match.platformApi : domainApi;
-    let adminBaseFragment = AppSync_Adapter$ReventlessAws.injectAwsAuthAll(AdminApi$ReventlessCore.baseFragment(Config.cloner), "Admin", undefined);
-    let sdl = AppSync_Adapter$ReventlessAws.stampSharedIamTypes(GraphQL_Stitcher$ReventlessCore.stitch(adminBaseFragment, []));
-    return Output$Pulumi.flatMap(Pulumi.all([
-      targetApi,
-      adminBarrier
-    ]), param => Output$Pulumi.flatMap(param[0].id, apiId => {
-      log.info("preAdminResolversSchemaHook", undefined, `Pushing admin schema to ` + apiId);
-      let client = AppSync_Adapter$ReventlessAws.getClient();
-      return AppSync_Adapter$ReventlessAws.startSchemaCreationRetrying(client, {
-        apiId: apiId,
-        definition: sdl
-      }).then(async () => {
-        log.info("preAdminResolversSchemaHook", undefined, "startSchemaCreation called, waiting for ACTIVE");
-        await AppSync_Adapter$ReventlessAws.waitForSchemaActive(client, apiId, undefined, undefined);
-        return log.info("preAdminResolversSchemaHook", undefined, "schema is ACTIVE");
-      });
-    }));
+    let targetApiOpt = match !== undefined ? match.platformApi : (
+        Config.splitApi ? undefined : domainApi
+      );
+    if (targetApiOpt !== undefined) {
+      let adminBaseFragment = AppSync_Adapter$ReventlessAws.injectAwsAuthAll(AdminApi$ReventlessCore.baseFragment(Config.cloner), "Admin", undefined);
+      let sdl = AppSync_Adapter$ReventlessAws.stampSharedIamTypes(GraphQL_Stitcher$ReventlessCore.stitch(adminBaseFragment, []));
+      return Output$Pulumi.flatMap(Pulumi.all([
+        targetApiOpt,
+        adminBarrier
+      ]), param => Output$Pulumi.flatMap(param[0].id, apiId => {
+        log.info("preAdminResolversSchemaHook", undefined, `Pushing admin schema to ` + apiId);
+        let client = AppSync_Adapter$ReventlessAws.getClient();
+        return AppSync_Adapter$ReventlessAws.startSchemaCreationRetrying(client, {
+          apiId: apiId,
+          definition: sdl
+        }).then(async () => {
+          log.info("preAdminResolversSchemaHook", undefined, "startSchemaCreation called, waiting for ACTIVE");
+          await AppSync_Adapter$ReventlessAws.waitForSchemaActive(client, apiId, undefined, undefined);
+          return log.info("preAdminResolversSchemaHook", undefined, "schema is ACTIVE");
+        });
+      }));
+    }
+    log.error("preAdminResolversSchemaHook", undefined, "split mode but the PlatformApi is not available at hook time — SKIPPING the admin schema push to avoid clobbering the DomainApi (pushing admin-base here would wipe every plugin field)");
+    return adminBarrier;
   };
   let hooks_inboundAppSyncResolverHook = param => InboundTranslationResolvers_AppSync$ReventlessAws.make(resolveHookedApi(), param.runtime, param.fieldNames, param.opts);
   let hooks_dcbAppSyncResolverHook = param => CommandGeneratorResolvers_AppSync$ReventlessAws.makeDcb(resolveHookedApi(), param.runtime, param.fieldNames, param.tags, param.opts);
@@ -1876,23 +1871,12 @@ function Make($star) {
           let client = AppSync_Adapter$ReventlessAws.getClient();
           let liveSdl = await AppSync_Adapter$ReventlessAws.getIntrospectionSdl(client, apiId);
           let countRoots = s => (GraphQL_Stitcher$ReventlessCore.countRootTypeFields(s, "Mutation") + GraphQL_Stitcher$ReventlessCore.countRootTypeFields(s, "Query") | 0) + GraphQL_Stitcher$ReventlessCore.countRootTypeFields(s, "Subscription") | 0;
-          let skipPush;
-          if (storedHash !== undefined && storedHash === currentHash) {
-            let expected = countRoots(sdl);
-            let live = countRoots(liveSdl);
-            if (liveSdl === "") {
-              log.info("preResolversSchemaHook", undefined, `hash matches but live schema could not be introspected — forcing repair push (check appsync:GetIntrospectionSchema permission)`);
-              skipPush = false;
-            } else if (live < expected) {
-              log.info("preResolversSchemaHook", undefined, `hash matches but live schema drifted (` + live.toString() + ` root field(s) live vs ` + expected.toString() + ` expected) — forcing repair push`);
-              skipPush = false;
-            } else {
-              log.info("preResolversSchemaHook", undefined, `SDL unchanged (hash ` + currentHash.slice(0, 12) + `…) and live schema intact (` + live.toString() + ` root fields); skipping push`);
-              skipPush = true;
-            }
-          } else {
-            skipPush = false;
-          }
+          let missingFields = GraphQL_Stitcher$ReventlessCore.missingRootFields(sdl, liveSdl);
+          let skipPush = storedHash !== undefined && storedHash === currentHash ? (
+              liveSdl === "" ? (log.info("preResolversSchemaHook", undefined, `hash matches but live schema could not be introspected — forcing repair push (check appsync:GetIntrospectionSchema permission)`), false) : (
+                  missingFields.length !== 0 ? (log.info("preResolversSchemaHook", undefined, `hash matches but live schema is missing ` + missingFields.length.toString() + ` expected root field(s) (e.g. ` + missingFields.slice(0, 5).join(", ") + `) — forcing repair push`), false) : (log.info("preResolversSchemaHook", undefined, `SDL unchanged (hash ` + currentHash.slice(0, 12) + `…) and live schema is a superset of the expected root fields (` + countRoots(liveSdl).toString() + ` live); skipping push`), true)
+                )
+            ) : false;
           if (!skipPush) {
             if (GraphQL_Stitcher$ReventlessCore.isCatastrophicSchemaShrink(liveSdl, sdl, deploySchemaShrinkThreshold)) {
               return log.error("preResolversSchemaHook", undefined, `ABORTED schema push for ` + apiId + `: stitched SDL (` + countRoots(sdl).toString() + ` root field(s)) would catastrophically shrink the live schema (` + countRoots(liveSdl).toString() + ` root field(s), threshold ` + deploySchemaShrinkThreshold.toString() + `) — refusing to clobber resolvers (likely a stale concurrent-deploy scan)`);
@@ -1923,24 +1907,28 @@ function Make($star) {
   };
   let hooks_preAdminResolversSchemaHook = adminBarrier => {
     let match = splitApiOutputsRef.contents;
-    let targetApi = match !== undefined ? match.platformApi : domainApi;
-    let adminBaseFragment = AppSync_Adapter$ReventlessAws.injectAwsAuthAll(AdminApi$ReventlessCore.baseFragment(false), "Admin", undefined);
-    let sdl = AppSync_Adapter$ReventlessAws.stampSharedIamTypes(GraphQL_Stitcher$ReventlessCore.stitch(adminBaseFragment, []));
-    return Output$Pulumi.flatMap(Pulumi.all([
-      targetApi,
-      adminBarrier
-    ]), param => Output$Pulumi.flatMap(param[0].id, apiId => {
-      log.info("preAdminResolversSchemaHook", undefined, `Pushing admin schema to ` + apiId);
-      let client = AppSync_Adapter$ReventlessAws.getClient();
-      return AppSync_Adapter$ReventlessAws.startSchemaCreationRetrying(client, {
-        apiId: apiId,
-        definition: sdl
-      }).then(async () => {
-        log.info("preAdminResolversSchemaHook", undefined, "startSchemaCreation called, waiting for ACTIVE");
-        await AppSync_Adapter$ReventlessAws.waitForSchemaActive(client, apiId, undefined, undefined);
-        return log.info("preAdminResolversSchemaHook", undefined, "schema is ACTIVE");
-      });
-    }));
+    let targetApiOpt = match !== undefined ? match.platformApi : undefined;
+    if (targetApiOpt !== undefined) {
+      let adminBaseFragment = AppSync_Adapter$ReventlessAws.injectAwsAuthAll(AdminApi$ReventlessCore.baseFragment(false), "Admin", undefined);
+      let sdl = AppSync_Adapter$ReventlessAws.stampSharedIamTypes(GraphQL_Stitcher$ReventlessCore.stitch(adminBaseFragment, []));
+      return Output$Pulumi.flatMap(Pulumi.all([
+        targetApiOpt,
+        adminBarrier
+      ]), param => Output$Pulumi.flatMap(param[0].id, apiId => {
+        log.info("preAdminResolversSchemaHook", undefined, `Pushing admin schema to ` + apiId);
+        let client = AppSync_Adapter$ReventlessAws.getClient();
+        return AppSync_Adapter$ReventlessAws.startSchemaCreationRetrying(client, {
+          apiId: apiId,
+          definition: sdl
+        }).then(async () => {
+          log.info("preAdminResolversSchemaHook", undefined, "startSchemaCreation called, waiting for ACTIVE");
+          await AppSync_Adapter$ReventlessAws.waitForSchemaActive(client, apiId, undefined, undefined);
+          return log.info("preAdminResolversSchemaHook", undefined, "schema is ACTIVE");
+        });
+      }));
+    }
+    log.error("preAdminResolversSchemaHook", undefined, "split mode but the PlatformApi is not available at hook time — SKIPPING the admin schema push to avoid clobbering the DomainApi (pushing admin-base here would wipe every plugin field)");
+    return adminBarrier;
   };
   let hooks_inboundAppSyncResolverHook = param => InboundTranslationResolvers_AppSync$ReventlessAws.make(resolveHookedApi(), param.runtime, param.fieldNames, param.opts);
   let hooks_dcbAppSyncResolverHook = param => CommandGeneratorResolvers_AppSync$ReventlessAws.makeDcb(resolveHookedApi(), param.runtime, param.fieldNames, param.tags, param.opts);

package/src/adapter/DcbEventLog/DcbEventLogStorage_DynamoDb_Runtime.res

@@ -3,10 +3,33 @@ open AwsSdk.DynamoDb.DocumentClient
 
 // --- Position Generation ---
 
+// Hybrid-logical-clock minimal variant. The module-level refs live for the life of
+// a warm Lambda container (reset on cold start), giving strictly-monotonic positions
+// per call WITHIN a container: same-millisecond calls increment `counter`; a forward
+// tick resets it to 0. No cross-container coordination — two same-ms writers on
+// different containers both start at counter 0 and are ordered by the UUID tiebreaker
+// (best-effort, exactly as the old `<ms>-<uuid>` format was). Format:
+// `<ms>-<6-digit counter>-<uuid>`. Correctness never depends on this — fence
+// comparisons anchor to what a slice observed, and `TransactWriteItems` serialises
+// commits; this only makes reader/replay ordering predictable per container. Old
+// `<ms>-<uuid>` positions remain valid: the ms prefix keeps the same 13-digit width,
+// so cross-format comparison still orders by timestamp. See
+// docs/plans/done/dcb-monotonic-position-generation.md.
+let lastMs = ref(0.0)
+let counter = ref(0)
+
 let generatePosition = () => {
-  let timestamp = Date.make()->Date.getTime->Float.toString
+  let now = Date.make()->Date.getTime
+  if now == lastMs.contents {
+    counter := counter.contents + 1
+  } else {
+    lastMs := now
+    counter := 0
+  }
+  let ms = now->Float.toString
+  let counterStr = counter.contents->Int.toString->String.padStart(6, "0")
   let uuid = Uuid.v4()
-  `${timestamp}-${uuid}`
+  `${ms}-${counterStr}-${uuid}`
 }
 
 let generatePositionForBatch = (basePosition, index) => {
@@ -915,20 +938,39 @@ let appendUnconditional = async (
   }
 }
 
+// A Composite partition fences on the WHOLE composite value, not on each member.
+// The synthetic fence tag is keyed on `getCompositePartitionKeyValue` — the same
+// value `derivePartitionKey` uses for the base-table `id` — so it is exactly as
+// selective as the entity's storage partition (and the `tag_composite` read
+// scope). Fencing per-member (the historical behaviour) gave every low-cardinality
+// member (e.g. `environment`, `platformName`) its own fence, which a deploy-time
+// fan-out sharing those prefixes turns into a hot partition → `TransactionConflict`
+// → `retries exhausted`; it also over-fenced (two DISTINCT composite entities
+// sharing a member value serialized needlessly). Plan:
+// docs/plans/Backlog/dcb-hot-tag-fence-contention.md § "Root-cause correction".
+let compositeFenceTagKey = "__dcb_composite__"
+
+let makeCompositeFenceTag = (
+  tags: array<Reventless.DcbTag.tag>,
+  spec: Reventless.DcbTag.compositePartitionSpec,
+): Reventless.DcbTag.tag => {
+  key: compositeFenceTagKey,
+  value: Reventless.DcbTag.getCompositePartitionKeyValue(tags, spec),
+}
+
 // The partition tag(s) of a written event — the ONLY fences an append may BUMP.
 // A tag's fence must track exactly the partition-scoped events a single-tag read
 // of that tag observes (events are stored under `id="<partitionKey>:<value>"`),
 // so only the partition tag may advance it. Mirrors `derivePartitionKey`.
 //
-// For a Composite partition tag there is no single fence key that represents the
-// partition, so we keep the historical behaviour (treat every tag as a partition
-// tag) rather than risk under-fencing composite-partition slices.
+// A Composite partition collapses to a single synthetic composite fence tag (see
+// `makeCompositeFenceTag`) — one fence per composite entity, not one per member.
 let eventPartitionTags = (
   event: ReventlessCore.DcbEventLog_Adapter.rawStoredEvent,
   ~partitionTag: option<Reventless.DcbTag.derivedPartitionTag>,
 ): array<Reventless.DcbTag.tag> =>
   switch partitionTag {
-  | Some(Composite(_)) => event.tags
+  | Some(Composite(spec)) => [makeCompositeFenceTag(event.tags, spec)]
   | Some(Simple(pt)) =>
     switch event.tags->Array.find(t => t.key == pt.key) {
     | Some(t) => [t]
@@ -994,6 +1036,32 @@ let buildConditionalTransactItems = (
   ~partitionTag: option<Reventless.DcbTag.derivedPartitionTag>=?,
   ~crossPartitionTagKeys: array<string>=[],
 ): array<TransactWriteCommand.transactWriteItem> => {
+  // For a Composite partition, fold the multi-tag composite read clause into a
+  // single synthetic composite fence tag (`makeCompositeFenceTag`) so the rest of
+  // this function fences it exactly like a Simple partition — one fence per
+  // composite entity — instead of once per member (the hot-fence source). Only the
+  // FENCE view of the query is rewritten here; the read path (`readStream`) keeps
+  // the original member tags and its `tag_composite` GSI lookup. Gated on
+  // `Composite`: Simple-partition composite-read slices (e.g. RecordProductDemand's
+  // `{productId, orderId}` pair, where `productId` is a real independent partition)
+  // are left untouched. `@crossPartition` carriers are unaffected — they are
+  // handled by `crossPartitionEventTags` below, not by this composite clause.
+  let cond = switch partitionTag {
+  | Some(Composite(spec)) => {
+      ...cond,
+      query: cond.query->Array.map(qi =>
+        switch qi.tags {
+        | Some(clauseTags) if clauseTags->Array.length > 1 => {
+            ...qi,
+            tags: [makeCompositeFenceTag(clauseTags, spec)],
+          }
+        | _ => qi
+        }
+      ),
+    }
+  | _ => cond
+  }
+
   // The partitions this append writes into — the only fences it may BUMP
   // (partition-scoped tags only; cross-partition tags below override this).
   let partitionTags = collectEventPartitionTags(events, ~partitionTag)

package/src/adapter/DcbEventLog/DcbEventLogStorage_DynamoDb_Runtime.res.mjs

@@ -20,10 +20,26 @@ import * as DynamoDb_Error$ReventlessAws from "../../errors/DynamoDb_Error.res.m
 import * as DynamoDb_DocumentClient$AwsSdk from "@reventlessdev/rescript-aws-sdk/src/DynamoDb_DocumentClient.res.mjs";
 import * as Util_DynamoDb_Runtime$ReventlessAws from "../../util/Util_DynamoDb_Runtime.res.mjs";
 
+let lastMs = {
+  contents: 0.0
+};
+
+let counter = {
+  contents: 0
+};
+
 function generatePosition() {
-  let timestamp = new Date().getTime().toString();
+  let now = new Date().getTime();
+  if (now === lastMs.contents) {
+    counter.contents = counter.contents + 1 | 0;
+  } else {
+    lastMs.contents = now;
+    counter.contents = 0;
+  }
+  let ms = now.toString();
+  let counterStr = counter.contents.toString().padStart(6, "0");
   let uuid = Uuid.v4();
-  return timestamp + `-` + uuid;
+  return ms + `-` + counterStr + `-` + uuid;
 }
 
 function generatePositionForBatch(basePosition, index) {
@@ -695,10 +711,19 @@ async function appendUnconditional(table, events, partitionTag) {
   return await runTransactWrite(input, basePosition, "DCB append failed");
 }
 
+let compositeFenceTagKey = "__dcb_composite__";
+
+function makeCompositeFenceTag(tags, spec) {
+  return {
+    key: compositeFenceTagKey,
+    value: DcbTag$Reventless.getCompositePartitionKeyValue(tags, spec)
+  };
+}
+
 function eventPartitionTags(event, partitionTag) {
   if (partitionTag !== undefined) {
     if (partitionTag.TAG !== "Simple") {
-      return event.tags;
+      return [makeCompositeFenceTag(event.tags, partitionTag._0)];
     }
     let pt = partitionTag._0;
     let t = event.tags.find(t => t.key === pt.key);
@@ -753,6 +778,26 @@ function partitionTypesByTag(events, partitionTag) {
 
 function buildConditionalTransactItems(table, events, cond, basePosition, partitionTag, crossPartitionTagKeysOpt) {
   let crossPartitionTagKeys = crossPartitionTagKeysOpt !== undefined ? crossPartitionTagKeysOpt : [];
+  let cond$1;
+  if (partitionTag !== undefined && partitionTag.TAG !== "Simple") {
+    let spec = partitionTag._0;
+    let newrecord = {...cond};
+    newrecord.query = cond.query.map(qi => {
+      let clauseTags = qi.tags;
+      if (clauseTags === undefined) {
+        return qi;
+      }
+      if (clauseTags.length <= 1) {
+        return qi;
+      }
+      let newrecord = {...qi};
+      newrecord.tags = [makeCompositeFenceTag(clauseTags, spec)];
+      return newrecord;
+    });
+    cond$1 = newrecord;
+  } else {
+    cond$1 = cond;
+  }
   let partitionTags = collectEventPartitionTags(events, partitionTag);
   let partitionKeySet = new Set();
   partitionTags.forEach(t => {
@@ -770,7 +815,7 @@ function buildConditionalTransactItems(table, events, cond, basePosition, partit
       )[k], []);
   };
   let consumedMap = {};
-  cond.query.forEach(qi => {
+  cond$1.query.forEach(qi => {
     let match = qi.tags;
     let match$1 = qi.eventTypes;
     if (match !== undefined && match$1 !== undefined) {
@@ -785,7 +830,7 @@ function buildConditionalTransactItems(table, events, cond, basePosition, partit
   let consumedTypesFor = t => Stdlib_Option.getOr(consumedMap[t.key + `:` + t.value], []);
   let compositeKeySet = new Set();
   let compositeQueryTags = [];
-  cond.query.forEach(qi => {
+  cond$1.query.forEach(qi => {
     let tags = qi.tags;
     if (tags !== undefined && tags.length > 1) {
       tags.forEach(tag => {
@@ -812,7 +857,7 @@ function buildConditionalTransactItems(table, events, cond, basePosition, partit
       return;
     }
   };
-  cond.query.forEach(qi => {
+  cond$1.query.forEach(qi => {
     let tags = qi.tags;
     if (tags === undefined) {
       return;
@@ -821,7 +866,7 @@ function buildConditionalTransactItems(table, events, cond, basePosition, partit
       if (tags.length <= 1) {
         return;
       }
-      let match = cond.after;
+      let match = cond$1.after;
       if (match !== undefined) {
         tags.forEach(pushUpdate);
         return;
@@ -833,7 +878,7 @@ function buildConditionalTransactItems(table, events, cond, basePosition, partit
     if (crossPartitionTagKeys.includes(tag.key)) {
       return pushUpdate(tag);
     }
-    let match$1 = cond.after;
+    let match$1 = cond$1.after;
     if (match$1 !== undefined) {
       if (isPartition(tag) || isCompositeQueryTag(tag)) {
         return pushUpdate(tag);
@@ -853,7 +898,7 @@ function buildConditionalTransactItems(table, events, cond, basePosition, partit
       return;
     }
   });
-  let match = cond.after;
+  let match = cond$1.after;
   if (match !== undefined) {
     
   } else {
@@ -864,7 +909,7 @@ function buildConditionalTransactItems(table, events, cond, basePosition, partit
     bumpSeen.add(t.key + `:` + t.value);
   });
   let bumpTags = [];
-  let match$1 = cond.after;
+  let match$1 = cond$1.after;
   let candidateBumps = match$1 !== undefined ? partitionTags.concat(crossPartitionEventTags) : partitionTags.concat(compositeQueryTags.concat(crossPartitionEventTags));
   candidateBumps.forEach(tag => {
     let k = tag.key + `:` + tag.value;
@@ -881,7 +926,7 @@ function buildConditionalTransactItems(table, events, cond, basePosition, partit
       return;
     } else {
       return {
-        Update: buildConditionalFenceUpdate(table.name, tag, consumedTypesFor(tag), producedTypes, basePosition, cond.after)
+        Update: buildConditionalFenceUpdate(table.name, tag, consumedTypesFor(tag), producedTypes, basePosition, cond$1.after)
       };
     }
   });
@@ -891,7 +936,7 @@ function buildConditionalTransactItems(table, events, cond, basePosition, partit
       return;
     } else {
       return {
-        ConditionCheck: buildFenceConditionCheck(table.name, tag, consumedTypes, cond.after)
+        ConditionCheck: buildFenceConditionCheck(table.name, tag, consumedTypes, cond$1.after)
       };
     }
   });
@@ -1102,6 +1147,8 @@ function readStream(table, $staropt$star) {
 let transactWriteItemsLimit = 100;
 
 export {
+  lastMs,
+  counter,
   generatePosition,
   generatePositionForBatch,
   tagToAttributeName,
@@ -1140,6 +1187,8 @@ export {
   buildEventPuts,
   runTransactWrite,
   appendUnconditional,
+  compositeFenceTagKey,
+  makeCompositeFenceTag,
   eventPartitionTags,
   collectEventPartitionTags,
   partitionTypesByTag,