@reventlessdev/reventless-aws 3.0.0-alpha.305 → 3.0.0-alpha.307

package/CHANGELOG.md

@@ -3,6 +3,27 @@
 All notable changes to this project will be documented in this file.
 See [Conventional Commits](https://conventionalcommits.org) for commit guidelines.
 
+# 3.0.0-alpha.307 (2026-08-18)
+
+### Bug Fixes
+
+* **api:** make the by-index door answer, and let an elevated caller widen it ([0fe0c6f](https://github.com/ReventlessDev/reventless-core/commit/0fe0c6f8dec6228ecaba39577e28d780b4f79c83))
+* **aws:** apply [@owner](https://github.com/owner) on the DynamoDB by-ids and by-index doors ([a6b5afc](https://github.com/ReventlessDev/reventless-core/commit/a6b5afc2923bfa4d3e0b2990367f67e8ffdd8877))
+* **aws:** narrow retirement on every DynamoDB door, not only the list ([d6a799b](https://github.com/ReventlessDev/reventless-core/commit/d6a799b287b28e9c1f75e193adbf3f6328a6bf2d))
+### Features
+
+* **core:** let a reference name a retired row, and let an elevated caller open one ([9e2623a](https://github.com/ReventlessDev/reventless-core/commit/9e2623a4b22487561607fcc0ca19d51726069ee4))
+
+
+# 3.0.0-alpha.306 (2026-08-16)
+
+### Bug Fixes
+
+* **aws:** attach the pre-token trigger through both fields Cognito keeps ([6d6e2e9](https://github.com/ReventlessDev/reventless-core/commit/6d6e2e90e1d6cb3defabaab8ae7f3c9d1955a5df))
+* **aws:** scope by-key reads to the owner, not only lists ([8232fd4](https://github.com/ReventlessDev/reventless-core/commit/8232fd4c09c1098c7265e4a17882ee44884f3bec))
+* **core:** stamp the owner from each DCB slice's own command schema ([6edbdf4](https://github.com/ReventlessDev/reventless-core/commit/6edbdf4680f2535597c3b560215aa514ceed27eb))
+
+
 # 3.0.0-alpha.305 (2026-08-16)
 
 ### Bug Fixes

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@reventlessdev/reventless-aws",
-  "version": "3.0.0-alpha.305",
+  "version": "3.0.0-alpha.307",
   "description": "AWS adapters for Reventless",
   "license": "Apache-2.0",
   "dependencies": {
@@ -12,18 +12,18 @@
     "@aws-sdk/s3-request-presigner": "3.970.0",
     "sury": "11.0.0-alpha.4",
     "uuid": "^13.0.0",
-    "@reventlessdev/rescript-aws-sdk": "3.0.0-alpha.11",
+    "@reventlessdev/rescript-aws-sdk": "3.0.0-alpha.12",
     "@reventlessdev/rescript-effect": "0.1.0-alpha.32",
     "@reventlessdev/rescript-jest": "1.0.0-alpha.10",
-    "@reventlessdev/rescript-node": "2.0.0-alpha.7",
-    "@reventlessdev/rescript-pulumi-aws": "2.4.0-alpha.77",
+    "@reventlessdev/rescript-pulumi-aws": "2.4.0-alpha.79",
+    "@reventlessdev/rescript-node": "2.0.0-alpha.8",
     "@reventlessdev/rescript-pulumi-pulumi": "2.3.0-alpha.19",
     "@reventlessdev/rescript-uuid": "2.0.0-alpha.0",
-    "@reventlessdev/reventless-core": "3.0.0-alpha.237",
-    "@reventlessdev/reventless-infra": "3.0.0-alpha.143",
+    "@reventlessdev/reventless-core": "3.0.0-alpha.239",
     "@reventlessdev/reventless-interop": "3.0.0-alpha.31",
-    "@reventlessdev/reventless-postgres": "3.0.0-alpha.101",
-    "@reventlessdev/reventless-spec": "3.0.0-alpha.115"
+    "@reventlessdev/reventless-postgres": "3.0.0-alpha.103",
+    "@reventlessdev/reventless-infra": "3.0.0-alpha.145",
+    "@reventlessdev/reventless-spec": "3.0.0-alpha.117"
   },
   "devDependencies": {
     "rescript": "12.3.0",

package/src/Platform.res

@@ -656,7 +656,7 @@ module MakeWithConfig = (
   }
   module InboundTranslationSlice = InboundTranslationSlice_Builder.Make(ApiConfig)
 
-  // Admin UI-fragment registry slices (docs/plans/event-sourced-fragment-registries.md): the
+  // Admin UI-fragment registry slices (docs/plans/done/event-sourced-fragment-registries.md): the
   // platform UI-fragment registry hosted as admin DCB slices sharing the admin DcbEventLog.
   // Built once at platform-module level and passed into Admin.construct below (registers the
   // slice's command handler exactly once).

package/src/adapter/Api/AppSync_Resolver_Native.res

@@ -1,7 +1,7 @@
 /** AppSync_Resolver_Native — drop-in replacement for
     `PulumiAws.AppSync.Resolver` that uses `@pulumi/aws-native` (Cloud Control
     API) so the CFN handler can internally wait out schema -> resolver
-    propagation. See docs/plans/appsync-resolver-aws-native.md. */
+    propagation. See docs/plans/done/appsync-resolver-aws-native.md. */
 
 module Native = PulumiAws.AwsNative.AppSync.Resolver
 module Functions = PulumiAws.AppSync.Resolver.Functions

package/src/adapter/Api/AppSync_Resolver_Retrying.res

@@ -16,7 +16,7 @@
     `aws-native:appsync/resolver:Resolver` type so existing resources are
     adopted in-place on first deploy (no delete+recreate).
 
-    See docs/plans/appsync-resolver-aws-native-retry.md. */
+    See docs/plans/done/appsync-resolver-aws-native-retry.md. */
 
 // ── AWS SDK bindings ─────────────────────────────────────────────────────────
 //
@@ -198,7 +198,7 @@ let jsThrow: JsExn.t => 'a = %raw(`e => { throw e }`)
 
     - `NotFoundException / No field named` — schema-propagation race after a
       successful `StartSchemaCreation`. Backstop for the per-plugin dedup
-      flow (see `docs/plans/appsync-schema-push-dedup.md`).
+      flow (see `docs/plans/done/appsync-schema-push-dedup.md`).
     - `ConcurrentModificationException / Schema is currently being altered` —
       API-level lock contention with an in-flight `StartSchemaCreation` on
       the same API (admin resolvers racing the platform schema push from

package/src/adapter/Auth/Auth_ActiveRolePoolAttachment.res

@@ -62,8 +62,23 @@ let readOnlyKeys = [
   "EmailConfigurationFailure",
 ]
 
-/** The pool's own configuration, sent back whole with `PreTokenGeneration` set
-    (or, when `preTokenGenerationArn` is `None`, removed).
+/** The version of the pre-token-generation contract this resource attaches at.
+
+    [Auth_ActiveRoleTrigger_Ops] implements `V1_0` — it answers with
+    `claimsOverrideDetails` — and does so deliberately, because `V2_0`/`V3_0` buy
+    access-token customisation it does not need and are gated behind the
+    Essentials and Plus feature plans.
+
+    🚨 **A pool left at a version the handler does not implement does not fail —
+    it silently does nothing.** Cognito sends a `V2_0` event, the handler answers
+    in `V1_0` shape, and the service ignores the answer. Sign-in succeeds, tokens
+    mint, and the role narrowing never happens. So the version is not the pool's
+    to keep: the trigger and the contract it speaks are one unit, and attaching
+    the trigger means attaching its version too. */
+let triggerVersion = "V1_0"
+
+/** The pool's own configuration, sent back whole with the pre-token-generation
+    trigger set (or, when `preTokenGenerationArn` is `None`, removed).
 
     Pure and total so the property that matters — a pool carrying non-default
     settings still carries them afterwards — is checkable without a pool. */
@@ -89,21 +104,64 @@ let mergedUpdateInput = (
     ->Dict.get("LambdaConfig")
     ->Option.flatMap(JSON.Decode.object)
     ->Option.mapOr(Dict.make(), existing => Dict.fromArray(existing->Dict.toArray))
+  // 🚨 Cognito carries this one trigger in TWO fields: the legacy
+  // `PreTokenGeneration` string and the `PreTokenGenerationConfig` object.
+  // `UpdateUserPool` rejects the call outright when both are present naming
+  // different functions, so both are written, together, naming the same one.
+  //
+  // Writing only one and letting the other ride through on the copy above cannot
+  // work, and not merely because a customer might have set it: **AWS
+  // materialises the field we did not write.** Attach via the legacy field alone
+  // and the next `DescribeUserPool` reports a `PreTokenGenerationConfig` the
+  // service populated, which the merge would then feed back on the following
+  // deploy — so an attachment that succeeded once fails the next time with
+  // nothing changed but AWS normalising its own record. Writing the pair in
+  // agreement is the only form stable under repeated describe → merge → update.
   switch preTokenGenerationArn {
-  | Some(arn) => lambdaConfig->Dict.set("PreTokenGeneration", JSON.Encode.string(arn))
-  | None => lambdaConfig->Dict.delete("PreTokenGeneration")
+  | Some(arn) =>
+    let config = Dict.make()
+    config->Dict.set("LambdaArn", JSON.Encode.string(arn))
+    config->Dict.set("LambdaVersion", JSON.Encode.string(triggerVersion))
+    lambdaConfig->Dict.set("PreTokenGeneration", JSON.Encode.string(arn))
+    lambdaConfig->Dict.set("PreTokenGenerationConfig", JSON.Encode.object(config))
+  | None =>
+    // Both, or the destroyed function stays attached through whichever field was
+    // left behind — the "every sign-in fails on a pool nothing here would fix"
+    // hazard [delete_] exists to prevent.
+    lambdaConfig->Dict.delete("PreTokenGeneration")
+    lambdaConfig->Dict.delete("PreTokenGenerationConfig")
   }
   out->Dict.set("LambdaConfig", lambdaConfig->JSON.Encode.object)
   out
 }
 
-/** The trigger currently attached to a described pool, if any. */
-let attachedTrigger = (~described: dict<JSON.t>): option<string> =>
-  described
-  ->Dict.get("LambdaConfig")
-  ->Option.flatMap(JSON.Decode.object)
-  ->Option.flatMap(c => c->Dict.get("PreTokenGeneration"))
-  ->Option.flatMap(JSON.Decode.string)
+/** The trigger currently attached to a described pool, if any.
+
+    Prefers `PreTokenGenerationConfig`, since that is the field AWS populates and
+    the one that carries the version.
+
+    A pool whose `LambdaVersion` names a contract [triggerVersion] does not
+    implement reports `None` — *not attached* — even when it points at our own
+    function. That is what turns the silent-no-op case into ordinary drift:
+    refresh records nothing attached, and the next `up` rewrites the pair at the
+    right version. Reporting the ARN instead would leave a pool that mints
+    un-narrowed tokens looking correct forever. */
+let attachedTrigger = (~described: dict<JSON.t>): option<string> => {
+  let lambdaConfig = described->Dict.get("LambdaConfig")->Option.flatMap(JSON.Decode.object)
+  switch lambdaConfig
+  ->Option.flatMap(c => c->Dict.get("PreTokenGenerationConfig"))
+  ->Option.flatMap(JSON.Decode.object) {
+  | Some(config) =>
+    switch config->Dict.get("LambdaVersion")->Option.flatMap(JSON.Decode.string) {
+    | Some(version) if version != triggerVersion => None
+    | _ => config->Dict.get("LambdaArn")->Option.flatMap(JSON.Decode.string)
+    }
+  | None =>
+    lambdaConfig
+    ->Option.flatMap(c => c->Dict.get("PreTokenGeneration"))
+    ->Option.flatMap(JSON.Decode.string)
+  }
+}
 
 // ── AWS SDK bindings (lazily imported — see AppSync_SourceApiAssociation_Retrying) ──
 

package/src/adapter/Auth/Auth_ActiveRolePoolAttachment.res.mjs

@@ -30,6 +30,8 @@ let readOnlyKeys = [
   "EmailConfigurationFailure"
 ];
 
+let triggerVersion = "V1_0";
+
 function mergedUpdateInput(described, userPoolId, preTokenGenerationArn) {
   let out = {};
   Stdlib_Dict.forEachWithKey(described, (value, key) => {
@@ -44,16 +46,31 @@ function mergedUpdateInput(described, userPoolId, preTokenGenerationArn) {
   out["UserPoolId"] = userPoolId;
   let lambdaConfig = Stdlib_Option.mapOr(Stdlib_Option.flatMap(described["LambdaConfig"], Stdlib_JSON.Decode.object), {}, existing => Object.fromEntries(Object.entries(existing)));
   if (preTokenGenerationArn !== undefined) {
+    let config = {};
+    config["LambdaArn"] = preTokenGenerationArn;
+    config["LambdaVersion"] = triggerVersion;
     lambdaConfig["PreTokenGeneration"] = preTokenGenerationArn;
+    lambdaConfig["PreTokenGenerationConfig"] = config;
   } else {
     Stdlib_Dict.$$delete(lambdaConfig, "PreTokenGeneration");
+    Stdlib_Dict.$$delete(lambdaConfig, "PreTokenGenerationConfig");
   }
   out["LambdaConfig"] = lambdaConfig;
   return out;
 }
 
 function attachedTrigger(described) {
-  return Stdlib_Option.flatMap(Stdlib_Option.flatMap(Stdlib_Option.flatMap(described["LambdaConfig"], Stdlib_JSON.Decode.object), c => c["PreTokenGeneration"]), Stdlib_JSON.Decode.string);
+  let lambdaConfig = Stdlib_Option.flatMap(described["LambdaConfig"], Stdlib_JSON.Decode.object);
+  let config = Stdlib_Option.flatMap(Stdlib_Option.flatMap(lambdaConfig, c => c["PreTokenGenerationConfig"]), Stdlib_JSON.Decode.object);
+  if (config === undefined) {
+    return Stdlib_Option.flatMap(Stdlib_Option.flatMap(lambdaConfig, c => c["PreTokenGeneration"]), Stdlib_JSON.Decode.string);
+  }
+  let version = Stdlib_Option.flatMap(config["LambdaVersion"], Stdlib_JSON.Decode.string);
+  if (version !== undefined && version !== triggerVersion) {
+    return;
+  } else {
+    return Stdlib_Option.flatMap(config["LambdaArn"], Stdlib_JSON.Decode.string);
+  }
 }
 
 let newOf1 = ((C, x) => new C(x));
@@ -310,6 +327,7 @@ function make(nameOpt, props, opts) {
 export {
   log,
   readOnlyKeys,
+  triggerVersion,
   mergedUpdateInput,
   attachedTrigger,
   newOf1,

package/src/adapter/DcbEventLog/DcbEventLogStorage_DynamoDb_Runtime.res

@@ -704,7 +704,7 @@ let collectEventTags = (
 // local backends' true DCB query semantics (and fixing analysis Issue 4 — the
 // one-event-type-per-attribute deadlock). It also folds the create guard into the
 // fence (see `buildConditionalFenceUpdate`), retiring the `create#` rows.
-// Plan: docs/plans/dcb-fence-event-type-granularity.md.
+// Plan: docs/plans/done/dcb-fence-event-type-granularity.md.
 let fenceTypeAttr = (eventType: string) => `pos#${eventType}`
 
 let dedupStrings = (xs: array<string>): array<string> => {
@@ -975,7 +975,7 @@ let appendUnconditional = async (
 // fan-out sharing those prefixes turns into a hot partition → `TransactionConflict`
 // → `retries exhausted`; it also over-fenced (two DISTINCT composite entities
 // sharing a member value serialized needlessly). Plan:
-// docs/plans/Backlog/dcb-hot-tag-fence-contention.md § "Root-cause correction".
+// docs/plans/done/dcb-hot-tag-fence-contention.md § "Root-cause correction".
 let compositeFenceTagKey = "__dcb_composite__"
 
 let makeCompositeFenceTag = (

package/src/adapter/DcbEventLog/DcbEventLogStorage_Postgres.res

@@ -11,7 +11,7 @@
 // The pool is lazy (`PgRuntime.poolFor`), so binding ops inside the deploy-time
 // `Output.apply` opens no connection during `pulumi up` — a real query only runs
 // inside the DcbCommandTopic Lambda at runtime. See
-// docs/plans/aws-postgres-change-feed-bridge.md.
+// docs/plans/done/aws-postgres-change-feed-bridge.md.
 
 let make: ReventlessCore.DcbEventLog_Adapter.storageMaker = (
   ~name,

package/src/adapter/EventLog/EventLogStorage_DynamoDb_Runtime.res

@@ -71,7 +71,7 @@ let append = table =>
     )
     ->Effect.runPromise
 
-// ─── Aggregate snapshots (docs/plans/aggregate-snapshotting.md) ───
+// ─── Aggregate snapshots (docs/plans/done/aggregate-snapshotting.md) ───
 // A snapshot lives in the SAME table as the events, on the reserved sort key
 // `position = "SNAPSHOT"`. Event positions are 9-digit zero-padded numbers, so
 // bounding the replay query to the all-digit range excludes the snapshot row

package/src/adapter/Postgres/PgChangeFeedRelay_Runtime.res

@@ -5,7 +5,7 @@
 // consumes — onto that queue. The plugin EventCollector (`EventCollectorEntryPoint`)
 // then drives the full fan-out: read-model projections, aggregate command topics,
 // and the cross-plugin SNS EventTopic. See
-// docs/plans/aws-postgres-change-feed-bridge.md.
+// docs/plans/done/aws-postgres-change-feed-bridge.md.
 //
 // The transform reuses the canonical DynamoDB shape producers
 // (`derivePartitionKey` + `buildJsonEvent'`) so the emitted body is byte-identical

package/src/adapter/Postgres/PgProjectionFeed.res

@@ -1,5 +1,5 @@
 // B3.0 — projection delivery on Postgres platforms
-// (docs/plans/aws-postgres-querydb-adapter.md).
+// (docs/plans/done/aws-postgres-querydb-adapter.md).
 //
 // On DynamoDB platforms the ReadModel / StateViewSlice Lambdas consume their
 // source event logs via DynamoDB-stream event-source mappings. Postgres logs have

package/src/adapter/QueryDb/PgQueryResolver_Lambda.res

@@ -99,6 +99,10 @@ type binding = {
   ownerField: option<string>,
   retiredField: option<string>,
   retiredValues: option<array<string>>,
+  /** Whether a reference to a retired row of this read model still resolves its
+      name — the `@namedWhenRetired` opt-in. Read only by the reference door;
+      every other door narrows as it always did. */
+  namedWhenRetired: bool,
 }
 
 // -- arg helpers -------------------------------------------------------------
@@ -253,6 +257,66 @@ let dispatch = async (
         Array.concat(found, extra)->Array.filter(item => ownerAllows(item) && retiredAllows(item)),
       )
 
+    | "refs" =>
+      // The reference door. The same by-ids read, projected on the way out to
+      // what naming a row needs, with the retirement lifted for a view that said
+      // its retired rows keep their names — and the owner rule left exactly where
+      // it was, so a row that is somebody's is still only theirs.
+      let ids = payload.arguments->argStrs("ids")
+      let found = await binding.pushdowns.byIds(~readModelName=rm, ids)
+      let missing =
+        found->Array.length < ids->Array.length
+          ? ids->Array.filterMap(ReventlessCore.Api_Ids.alternateKey)
+          : []
+      let extra = missing->Array.length > 0
+        ? await binding.pushdowns.byIds(~readModelName=rm, missing)
+        : []
+      let retirementOf = (item: JSON.t) =>
+        switch binding.retiredField {
+        | None => (false, None)
+        | Some(field) =>
+          let cell = item->JSON.Decode.object->Option.flatMap(d => d->Dict.get(field))
+          let scope: Reventless.OwnerScope.retiredScope = {
+            field,
+            values: binding.retiredValues,
+          }
+          let retired = scope->Reventless.OwnerScope.isRetiredValue(cell)
+          (
+            retired,
+            retired && binding.retiredValues->Option.isSome
+              ? cell->Option.flatMap(JSON.Decode.string)
+              : None,
+          )
+        }
+      JSON.Encode.array(
+        Array.concat(found, extra)
+        ->Array.filter(ownerAllows)
+        ->Array.filterMap(item => {
+          let (retired, state) = retirementOf(item)
+          if retired && !binding.namedWhenRetired {
+            None
+          } else {
+            let get = key => item->JSON.Decode.object->Option.flatMap(d => d->Dict.get(key))
+            let id = get("id")->Option.flatMap(JSON.Decode.string)->Option.getOr("")
+            Some(
+              Dict.fromArray([
+                ("id", JSON.Encode.string(id)),
+                (
+                  "label",
+                  JSON.Encode.string(
+                    get(binding.labelField)
+                    ->Option.flatMap(JSON.Decode.string)
+                    ->Option.getOr(id),
+                  ),
+                ),
+                ("retired", JSON.Encode.bool(retired)),
+                ("retiredState", state->Option.mapOr(JSON.Encode.null, JSON.Encode.string)),
+              ])->JSON.Encode.object,
+            )
+          }
+        }),
+      )
+
     | "items" =>
       // Sub-id connection: {single}Items(id, filter, first/after/last/before).
       // Requires a subIdField; without one it's an empty connection.

package/src/adapter/QueryDb/PgQueryResolver_Lambda.res.mjs

@@ -185,11 +185,63 @@ async function dispatch(binding, lookupBindingOpt, payload) {
         let items$1 = await binding.pushdowns.scanAll(rm);
         return QueryDbListQuery$ReventlessCore.run(items$1, argsDict, binding.capability, binding.labelField, undefined, ownerScope, retiredScope);
         break;
+      case "refs" :
+        let ids$1 = argStrs(payload.arguments, "ids");
+        let found$2 = await binding.pushdowns.byIds(rm, ids$1);
+        let missing$1 = found$2.length < ids$1.length ? Stdlib_Array.filterMap(ids$1, Api_Ids$ReventlessCore.alternateKey) : [];
+        let extra$1 = missing$1.length !== 0 ? await binding.pushdowns.byIds(rm, missing$1) : [];
+        let retirementOf = item => {
+          let field = binding.retiredField;
+          if (field === undefined) {
+            return [
+              false,
+              undefined
+            ];
+          }
+          let cell = Stdlib_Option.flatMap(Stdlib_JSON.Decode.object(item), d => d[field]);
+          let scope_values = binding.retiredValues;
+          let scope = {
+            field: field,
+            values: scope_values
+          };
+          let retired = OwnerScope$Reventless.isRetiredValue(scope, cell);
+          return [
+            retired,
+            retired && Stdlib_Option.isSome(binding.retiredValues) ? Stdlib_Option.flatMap(cell, Stdlib_JSON.Decode.string) : undefined
+          ];
+        };
+        return Stdlib_Array.filterMap(found$2.concat(extra$1).filter(ownerAllows), item => {
+          let match = retirementOf(item);
+          let retired = match[0];
+          if (retired && !binding.namedWhenRetired) {
+            return;
+          }
+          let get = key => Stdlib_Option.flatMap(Stdlib_JSON.Decode.object(item), d => d[key]);
+          let id = Stdlib_Option.getOr(Stdlib_Option.flatMap(get("id"), Stdlib_JSON.Decode.string), "");
+          return Object.fromEntries([
+            [
+              "id",
+              id
+            ],
+            [
+              "label",
+              Stdlib_Option.getOr(Stdlib_Option.flatMap(get(binding.labelField), Stdlib_JSON.Decode.string), id)
+            ],
+            [
+              "retired",
+              retired
+            ],
+            [
+              "retiredState",
+              Stdlib_Option.mapOr(match[1], null, prim => prim)
+            ]
+          ]);
+        });
       case "resolveMany" :
         let target = Stdlib_Option.getOr(payload.target, rm);
         let source = Stdlib_Option.getOr(payload.source, null);
-        let ids$1 = argStrs(source, Stdlib_Option.getOr(payload.sourceIdsField, ""));
-        return await binding.pushdowns.byIds(target, ids$1);
+        let ids$2 = argStrs(source, Stdlib_Option.getOr(payload.sourceIdsField, ""));
+        return await binding.pushdowns.byIds(target, ids$2);
       case "resolveOne" :
         let target$1 = Stdlib_Option.getOr(payload.target, rm);
         let source$1 = Stdlib_Option.getOr(payload.source, null);

package/src/adapter/QueryDb/QueryDbBackend.res

@@ -1,6 +1,6 @@
 // AWS-side selection for the QueryDb (read model) storage backend — the QueryDb
 // analogue of `EventLogBackend` / `DcbBackend` (B3.1,
-// docs/plans/aws-postgres-querydb-adapter.md).
+// docs/plans/done/aws-postgres-querydb-adapter.md).
 //
 // When `Platform.MakeWithConfig` is given a `~pgConnection`, it records the
 // resolved selection here BEFORE any admin/plugin `construct` runs. Read by: