@reventlessdev/reventless-core 3.0.0-alpha.236 → 3.0.0-alpha.238

package/CHANGELOG.md

@@ -3,6 +3,29 @@
 All notable changes to this project will be documented in this file.
 See [Conventional Commits](https://conventionalcommits.org) for commit guidelines.
 
+# 3.0.0-alpha.238 (2026-08-16)
+
+### Bug Fixes
+
+* **core:** stamp the owner from each DCB slice's own command schema ([6edbdf4](https://github.com/ReventlessDev/reventless-core/commit/6edbdf4680f2535597c3b560215aa514ceed27eb))
+### Features
+
+* **core:** check a declared lifecycle edge against the states that exist ([d427d92](https://github.com/ReventlessDev/reventless-core/commit/d427d92f8912b4dc9a9407c3c0cec3200d41a5f1))
+* **core:** report a lifecycle state no command can reach ([eb24dbd](https://github.com/ReventlessDev/reventless-core/commit/eb24dbd90df07185f0f4785c4bb726f5b617e7b2))
+* **ppx:** declare a command's lifecycle edge once, as [@transition](https://github.com/transition) ([dd35130](https://github.com/ReventlessDev/reventless-core/commit/dd3513014f14b71879ee21263c6755d3c3d95096))
+
+
+# 3.0.0-alpha.237 (2026-08-16)
+
+### Features
+
+* **core:** exclude retired rows from reads a caller may not widen ([662f31a](https://github.com/ReventlessDev/reventless-core/commit/662f31abb717bda5154199d349da6dcf8e2d3e78))
+* **core:** let [@retired](https://github.com/retired) name a lifecycle state, not only a boolean ([6bb346b](https://github.com/ReventlessDev/reventless-core/commit/6bb346b4f6a5f33826fc24537953482a76067177))
+* **core:** mark the state that retires a row, and allow more than one ([cb1461f](https://github.com/ReventlessDev/reventless-core/commit/cb1461f024d3ca3b53fd9c8b010a054e3fcc4555))
+* **core:** publish queryableDef.retiredField from the [@retired](https://github.com/retired) annotation ([b44436a](https://github.com/ReventlessDev/reventless-core/commit/b44436a997b6c4ff0531f0b07d793cc858eef94a))
+* **spec:** [@retired](https://github.com/retired) state-field annotation and its schema emission ([2d8234b](https://github.com/ReventlessDev/reventless-core/commit/2d8234b6b3dd8f479031a67eb5b4b47b5c0c2ff9))
+
+
 # 3.0.0-alpha.236 (2026-08-15)
 
 ### Bug Fixes

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@reventlessdev/reventless-core",
-  "version": "3.0.0-alpha.236",
+  "version": "3.0.0-alpha.238",
   "description": "Core package for Reventless framework",
   "license": "Apache-2.0",
   "jest": {
@@ -30,20 +30,20 @@
     "uuid": "^13.0.0",
     "@reventlessdev/rescript-effect": "0.1.0-alpha.32",
     "@reventlessdev/rescript-fast-csv": "2.0.0-alpha.7",
-    "@reventlessdev/rescript-node": "2.0.0-alpha.7",
     "@reventlessdev/rescript-hash-object": "1.2.0-alpha.14",
-    "@reventlessdev/rescript-pulumi-pulumi": "2.3.0-alpha.19",
     "@reventlessdev/rescript-jest": "1.0.0-alpha.10",
+    "@reventlessdev/rescript-node": "2.0.0-alpha.7",
+    "@reventlessdev/rescript-pulumi-pulumi": "2.3.0-alpha.19",
     "@reventlessdev/rescript-ssh2": "2.0.0-alpha.7",
     "@reventlessdev/rescript-uuid": "2.0.0-alpha.0",
-    "@reventlessdev/reventless-infra": "3.0.0-alpha.142",
     "@reventlessdev/reventless-interop": "3.0.0-alpha.31",
-    "@reventlessdev/reventless-spec": "3.0.0-alpha.114"
+    "@reventlessdev/reventless-spec": "3.0.0-alpha.116",
+    "@reventlessdev/reventless-infra": "3.0.0-alpha.144"
   },
   "devDependencies": {
     "rescript": "12.3.0",
     "sury-ppx": "11.0.0-alpha.2",
-    "@reventlessdev/reventless-ppx": "1.0.0-alpha.66"
+    "@reventlessdev/reventless-ppx": "1.0.0-alpha.68"
   },
   "peerDependencies": {
     "rescript": "12.3.0"

package/src/Message.res

@@ -69,7 +69,7 @@ let toCommandSchema' = (idSchema, commandSchema) =>
 // before a nested `@schema` field existed still decodes instead of bricking the
 // aggregate's log replay. These two entry points thread the memoized envelope schema;
 // `Reventless.Message.decode` (the other central decoder) is tolerant at the source.
-// See docs/plans/platform-infrastructure-in-plugin-list.md (durable fix option 2).
+// See docs/plans/done/platform-infrastructure-in-plugin-list.md (durable fix option 2).
 let decodeEvent' = (json, idSchema, eventSchema) =>
   json->parseJsonTolerant(toEventSchema'(idSchema, eventSchema))
 let decodeCommand' = (json, idSchema, commandSchema) =>

package/src/adapter/Monitoring/Monitoring.res

@@ -10,7 +10,7 @@ concern; this only exposes the choke point through which the framework says
 "I just provisioned an execution unit" and leaves what to do about it to the
 listener.
 
-See `docs/plans/monitoring-hook-seam.md`.
+See `docs/plans/done/monitoring-hook-seam.md`.
 */
 
 /**

package/src/admin/Platform_Admin_Structure.res

@@ -122,7 +122,9 @@ let pluginReadModel: queryableDef = {
   // Hand-rolled rather than resolved, but the rung is the same one
   // `labelFieldsFromStateSchema` would report for a field literally named `name`.
   labelFieldSource: Some("convention"),
-  statusField: Some("status"),
+  // The published wire name stays `status` — it is what the SDL declares and what
+  // stored rows carry. Only the key naming it moved.
+  lifecycleField: Some("status"),
   visibility: None,
   chapter: None,
   // The admin fragment hand-declares its query names rather than deriving them from
@@ -137,6 +139,8 @@ let pluginReadModel: queryableDef = {
   idFieldSource: None,
   requiredAccess: None,
   ownerField: None,
+  retiredField: None,
+  retiredValues: None,
 }
 
 let structure: pluginStructure = {

package/src/admin/Platform_Admin_Structure.res.mjs

@@ -137,7 +137,7 @@ let pluginReadModel_searchableFields = ["name"];
 
 let pluginReadModel_labelFieldSource = "convention";
 
-let pluginReadModel_statusField = "status";
+let pluginReadModel_lifecycleField = "status";
 
 let pluginReadModel_singleQueryField = Api_Naming$ReventlessCore.adminField("Plugin");
 
@@ -150,8 +150,10 @@ let pluginReadModel = {
   labelField: "name",
   searchableFields: pluginReadModel_searchableFields,
   labelFieldSource: pluginReadModel_labelFieldSource,
-  statusField: pluginReadModel_statusField,
+  lifecycleField: pluginReadModel_lifecycleField,
   ownerField: undefined,
+  retiredField: undefined,
+  retiredValues: undefined,
   visibility: undefined,
   chapter: undefined,
   singleQueryField: pluginReadModel_singleQueryField,

package/src/admin/Platform_ComponentDefinitionsApi.res

@@ -29,7 +29,7 @@ let sdlTypes: array<string> = [
   // structures persisted before the fields existed decode as `None`, a hand-rolled
   // def may decline to state them, and a state whose key cannot be resolved has no
   // `idField` to report.
-  `type Platform_ReadSideDef {\n  name: String!\n  queryField: String!\n  schema: String!\n  consumedEventTypes: [String!]!\n  linkedWriteSide: [String!]!\n  labelField: String!\n  searchableFields: [String!]!\n  labelFieldSource: String\n  statusField: String\n  visibility: String\n  chapter: String\n  singleQueryField: String\n  idField: String\n  idFieldSource: String\n  requiredAccess: [String!]\n  ownerField: String\n}`,
+  `type Platform_ReadSideDef {\n  name: String!\n  queryField: String!\n  schema: String!\n  consumedEventTypes: [String!]!\n  linkedWriteSide: [String!]!\n  labelField: String!\n  searchableFields: [String!]!\n  labelFieldSource: String\n  lifecycleField: String\n  visibility: String\n  chapter: String\n  singleQueryField: String\n  idField: String\n  idFieldSource: String\n  requiredAccess: [String!]\n  ownerField: String\n  retiredField: String\n  retiredValues: [String!]\n}`,
   `type Platform_AutomationSliceDef {\n  name: String!\n  consumedEventTypes: [String!]!\n  producedCommandTypes: [String!]!\n  targetName: String\n  chapter: String\n}`,
   `type Platform_OutboundTranslationSliceDef {\n  name: String!\n  consumedEventTypes: [String!]!\n  inboundCommandTypes: [String!]!\n  targetName: String\n  externalSystem: String\n  chapter: String\n}`,
   `type Platform_InboundTranslationSliceDef {\n  name: String!\n  commandTypes: [String!]!\n  targetName: String\n  externalSystem: String\n  chapter: String\n}`,
@@ -113,7 +113,7 @@ let encodeQueryableDef = (r: queryableDef): JSON.t =>
       "labelFieldSource",
       r.labelFieldSource->Option.mapOr(JSON.Encode.null, JSON.Encode.string),
     ),
-    ("statusField", r.statusField->Option.mapOr(JSON.Encode.null, JSON.Encode.string)),
+    ("lifecycleField", r.lifecycleField->Option.mapOr(JSON.Encode.null, JSON.Encode.string)),
     // Carried rather than only filtered on: a tooling consumer reading the
     // unfiltered structure needs to know WHICH components are Internal, and a
     // consumer of the filtered query reads null here because nothing Internal
@@ -128,6 +128,8 @@ let encodeQueryableDef = (r: queryableDef): JSON.t =>
     ("idFieldSource", r.idFieldSource->Option.mapOr(JSON.Encode.null, JSON.Encode.string)),
     ("requiredAccess", r.requiredAccess->Option.mapOr(JSON.Encode.null, encodeStrings)),
     ("ownerField", r.ownerField->Option.mapOr(JSON.Encode.null, JSON.Encode.string)),
+    ("retiredField", r.retiredField->Option.mapOr(JSON.Encode.null, JSON.Encode.string)),
+    ("retiredValues", r.retiredValues->Option.mapOr(JSON.Encode.null, encodeStrings)),
   ])->JSON.Encode.object
 
 let encodeEventDef = (e: eventDef): JSON.t =>

package/src/admin/Platform_ComponentDefinitionsApi.res.mjs

@@ -10,7 +10,7 @@ let sdlTypes = [
   `type Platform_EventDef {\n  name: String!\n  schema: String!\n  references: [Platform_FieldReference!]!\n}`,
   `type Platform_ErrorDef {\n  name: String!\n  schema: String!\n  references: [Platform_FieldReference!]!\n}`,
   `type Platform_WriteSideDef {\n  name: String!\n  commands: [Platform_CommandDef!]!\n  linkedViews: [String!]!\n  consistencyRead: String\n  producedEventTypes: [String!]!\n  consumedEventTypes: [String!]!\n  events: [Platform_EventDef!]!\n  errors: [Platform_ErrorDef!]!\n  chapter: String\n}`,
-  `type Platform_ReadSideDef {\n  name: String!\n  queryField: String!\n  schema: String!\n  consumedEventTypes: [String!]!\n  linkedWriteSide: [String!]!\n  labelField: String!\n  searchableFields: [String!]!\n  labelFieldSource: String\n  statusField: String\n  visibility: String\n  chapter: String\n  singleQueryField: String\n  idField: String\n  idFieldSource: String\n  requiredAccess: [String!]\n  ownerField: String\n}`,
+  `type Platform_ReadSideDef {\n  name: String!\n  queryField: String!\n  schema: String!\n  consumedEventTypes: [String!]!\n  linkedWriteSide: [String!]!\n  labelField: String!\n  searchableFields: [String!]!\n  labelFieldSource: String\n  lifecycleField: String\n  visibility: String\n  chapter: String\n  singleQueryField: String\n  idField: String\n  idFieldSource: String\n  requiredAccess: [String!]\n  ownerField: String\n  retiredField: String\n  retiredValues: [String!]\n}`,
   `type Platform_AutomationSliceDef {\n  name: String!\n  consumedEventTypes: [String!]!\n  producedCommandTypes: [String!]!\n  targetName: String\n  chapter: String\n}`,
   `type Platform_OutboundTranslationSliceDef {\n  name: String!\n  consumedEventTypes: [String!]!\n  inboundCommandTypes: [String!]!\n  targetName: String\n  externalSystem: String\n  chapter: String\n}`,
   `type Platform_InboundTranslationSliceDef {\n  name: String!\n  commandTypes: [String!]!\n  targetName: String\n  externalSystem: String\n  chapter: String\n}`,
@@ -130,8 +130,8 @@ function encodeQueryableDef(r) {
       Stdlib_Option.mapOr(r.labelFieldSource, null, prim => prim)
     ],
     [
-      "statusField",
-      Stdlib_Option.mapOr(r.statusField, null, prim => prim)
+      "lifecycleField",
+      Stdlib_Option.mapOr(r.lifecycleField, null, prim => prim)
     ],
     [
       "visibility",
@@ -160,6 +160,14 @@ function encodeQueryableDef(r) {
     [
       "ownerField",
       Stdlib_Option.mapOr(r.ownerField, null, prim => prim)
+    ],
+    [
+      "retiredField",
+      Stdlib_Option.mapOr(r.retiredField, null, prim => prim)
+    ],
+    [
+      "retiredValues",
+      Stdlib_Option.mapOr(r.retiredValues, null, encodeStrings)
     ]
   ]);
 }

package/src/admin/UiFragmentRegistry/StateChangeSlice/UiFragmentRegistry.res

@@ -1,6 +1,6 @@
 // UiFragmentRegistry StateChangeSlice — the write side of the platform UI-fragment
 // registry, extracted off the Plugin aggregate (see
-// docs/plans/event-sourced-fragment-registries.md).
+// docs/plans/done/event-sourced-fragment-registries.md).
 //
 // Commands are driven by the plugin runtime's connect handshake and routed here by the
 // admin PluginExtensionPoint's UI-fragment mapping (RegisterUiFragment on ConnectPlugin,

package/src/components/Aggregate/Aggregate_Callback.res

@@ -114,7 +114,7 @@ module Make = (
   // at append time → the conflict branch invalidates the entry and the retry
   // replays cold. Mirrors the StateChangeSlice decision-model cache, including
   // the fixed capacity (a per-aggregate knob is a future refinement — see
-  // docs/plans/aggregate-snapshotting.md).
+  // docs/plans/done/aggregate-snapshotting.md).
   let replayCacheCapacity = 100
   let replayCache: Lru.t<string, (Behavior.state, int)> = Lru.make(
     ~capacity=replayCacheCapacity,
@@ -122,7 +122,7 @@ module Make = (
 
   let resetCache = () => replayCache->Lru.clear
 
-  // Persisted-snapshot configuration (docs/plans/aggregate-snapshotting.md).
+  // Persisted-snapshot configuration (docs/plans/done/aggregate-snapshotting.md).
   // `None` (the default) keeps full replay; `Some({interval, stateSchema})`
   // seeds cold replays from the latest persisted snapshot and writes a fresh
   // one every `interval` events. Snapshots are a read optimization only — the

package/src/components/Api/ApiAllowedStatesHelpers.res

@@ -1,5 +1,5 @@
 // Read per-variant `allowedStates` metadata that the reventless-ppx
-// `@allowedStates([…])` attribute attaches to a command schema. Consumed by
+// an `@transition` from-set attaches to a command schema. Consumed by
 // `Plugin_Structure.toCommandDef` when building the `commandDef` records that
 // land in `Platform_ComponentDefinitions` so AutoUI can filter the per-row command
 // menu by the row's status.
@@ -7,8 +7,7 @@
 open ReventlessInfra.Api
 
 /** Returns the allowed-state list for a given command-variant name, or None
-    when the variant has no `@allowedStates` annotation (back-compat default
-    — the command shows on every row). */
+    when the variant declares no `@transition` (the command shows on every row). */
 let getAllowedStates = (
   commandSchema: S.t<unknown>,
   ~variantName: string,

package/src/components/Api/ApiTargetStateHelpers.res

@@ -1,5 +1,5 @@
 // Read per-variant `targetState` metadata that the reventless-ppx
-// `@targetState("…")` attribute attaches to a command schema. Consumed by
+// an `@transition` target attaches to a command schema. Consumed by
 // `Plugin_Structure.toCommandDef` when building the `commandDef` records that
 // land in `Platform_ComponentDefinitions`, so AutoUI's board drag resolver can
 // move a row by a *declared* transition instead of a name-stem guess. Mirrors
@@ -8,8 +8,9 @@
 open ReventlessInfra.Api
 
 /** Returns the declared target state for a given command-variant name, or None
-    when the variant has no `@targetState` annotation (back-compat default —
-    the resolver falls back to its name-stem heuristic). */
+    when the variant declares no target — either because it carries no
+    `@transition` at all, or because it declares a from-set only, which is a
+    command saying it does not move the row. */
 let getTargetState = (
   commandSchema: S.t<unknown>,
   ~variantName: string,

package/src/components/Api/GraphQL_FragmentGenerator.res

@@ -436,6 +436,19 @@ let deriveByIdsQueryField = (
 ): string =>
   `  ${listFieldName}ByIds(ids: [String!]!): [${returnTypeName}!]!`
 
+// `includeRetired` sits beside the paging arguments rather than inside `filter`,
+// and that placement is the point. `filter` is the caller's description of the
+// rows they want; this is a request to lift a restriction the server placed on
+// them, which the server grants or ignores on its own terms. Putting it in the
+// filter input would also require the field to be a declared filter field, which
+// would publish `<field>Eq` to callers who can only ever get an empty page from
+// it.
+//
+// Emitted unconditionally, on every connection field, whether or not the view
+// declares a retirement flag. A view that declares none ignores it, and the
+// alternative — an argument that appears and disappears with the annotation —
+// makes adding `@retired` a breaking schema change for every client that had
+// already learned the field's shape.
 let deriveConnectionQueryField = (
   ~listFieldName: string,
   ~singularTypeName: string,
@@ -443,7 +456,7 @@ let deriveConnectionQueryField = (
   ~hasOrderBy: bool=false,
 ): string => {
   let orderByArg = hasOrderBy ? `, orderBy: ${singularTypeName}OrderBy` : ""
-  `  ${listFieldName}(filter: ${filterTypeName}${orderByArg}, first: Int, after: String, last: Int, before: String): ${singularTypeName}Connection!`
+  `  ${listFieldName}(filter: ${filterTypeName}${orderByArg}, first: Int, after: String, last: Int, before: String, includeRetired: Boolean): ${singularTypeName}Connection!`
 }
 
 // ── Mutation field derivation ──────────────────────────────────────────────

package/src/components/Api/GraphQL_FragmentGenerator.res.mjs

@@ -374,7 +374,7 @@ function deriveByIdsQueryField(listFieldName, returnTypeName) {
 function deriveConnectionQueryField(listFieldName, singularTypeName, filterTypeName, hasOrderByOpt) {
   let hasOrderBy = hasOrderByOpt !== undefined ? hasOrderByOpt : false;
   let orderByArg = hasOrderBy ? `, orderBy: ` + singularTypeName + `OrderBy` : "";
-  return `  ` + listFieldName + `(filter: ` + filterTypeName + orderByArg + `, first: Int, after: String, last: Int, before: String): ` + singularTypeName + `Connection!`;
+  return `  ` + listFieldName + `(filter: ` + filterTypeName + orderByArg + `, first: Int, after: String, last: Int, before: String, includeRetired: Boolean): ` + singularTypeName + `Connection!`;
 }
 
 function deriveMutationFieldFromObject(fieldName, collectedTypes, seenTypes, variantSchema) {

package/src/components/Api/QueryDbListQuery.res

@@ -35,6 +35,17 @@ let getId = (item: JSON.t): string =>
 // String form of a field for comparison / cursor purposes: the string itself,
 // or a number rendered via Float.toString, else None. The push-down must render
 // the same string in SQL (CAST … AS TEXT) for cursor/order parity.
+// A boolean field's value, or None when the row does not carry one. Separate
+// from `getFieldString` rather than reusing it: JSON `true` stringifies to
+// nothing useful, and a retirement predicate read off a coerced string would
+// treat `"false"` — a legitimate value for a field someone stored as text — as
+// truthy and hide the row.
+let getFieldBool = (item: JSON.t, field: string): option<bool> =>
+  item
+  ->JSON.Decode.object
+  ->Option.flatMap(d => d->Dict.get(field))
+  ->Option.flatMap(JSON.Decode.bool)
+
 let getFieldString = (item: JSON.t, field: string): option<string> =>
   item
   ->JSON.Decode.object
@@ -97,6 +108,7 @@ let run = (
   ~labelField: string,
   ~decodeLocalId: string => option<string>=Api_Ids.toLocalId,
   ~ownerScope: option<(string, string)>=?,
+  ~retiredScope: option<Reventless.OwnerScope.retiredScope>=?,
 ): JSON.t => {
   let filterDict =
     argsDict->Dict.get("filter")->Option.flatMap(JSON.Decode.object)->Option.getOr(Dict.make())
@@ -185,7 +197,19 @@ let run = (
       getFieldString(item, field)->Option.mapOr(false, v => v == required)
     | None => true
     }
-    passSearch && passPrefix && passIds && passPerField && passOwner
+    // The missing-field rule lives in `OwnerScope.isRetiredValue`, beside the two
+    // forms it has to answer for; the note on why it lands the opposite way from
+    // `passOwner` is there.
+    let passRetired = switch retiredScope {
+    | Some(scope) =>
+      !(
+        scope->Reventless.OwnerScope.isRetiredValue(
+          item->JSON.Decode.object->Option.flatMap(d => d->Dict.get(scope.field)),
+        )
+      )
+    | None => true
+    }
+    passSearch && passPrefix && passIds && passPerField && passOwner && passRetired
   })
 
   let orderByDict = argsDict->Dict.get("orderBy")->Option.flatMap(JSON.Decode.object)

package/src/components/Api/QueryDbListQuery.res.mjs

@@ -5,6 +5,7 @@ import * as Stdlib_Array from "@rescript/runtime/lib/es6/Stdlib_Array.js";
 import * as Stdlib_Option from "@rescript/runtime/lib/es6/Stdlib_Option.js";
 import * as Stdlib_Nullable from "@rescript/runtime/lib/es6/Stdlib_Nullable.js";
 import * as Primitive_object from "@rescript/runtime/lib/es6/Primitive_object.js";
+import * as OwnerScope$Reventless from "@reventlessdev/reventless-spec/src/types/OwnerScope.res.mjs";
 import * as Api_Ids$ReventlessCore from "./Api_Ids.res.mjs";
 
 function encodeCursor(value) {
@@ -19,6 +20,10 @@ function getId(item) {
   return Stdlib_Option.getOr(Stdlib_Option.flatMap(Stdlib_Option.flatMap(Stdlib_JSON.Decode.object(item), d => d["id"]), Stdlib_JSON.Decode.string), "");
 }
 
+function getFieldBool(item, field) {
+  return Stdlib_Option.flatMap(Stdlib_Option.flatMap(Stdlib_JSON.Decode.object(item), d => d[field]), Stdlib_JSON.Decode.bool);
+}
+
 function getFieldString(item, field) {
   return Stdlib_Option.flatMap(Stdlib_Option.flatMap(Stdlib_JSON.Decode.object(item), d => d[field]), v => {
     let s = Stdlib_JSON.Decode.string(v);
@@ -48,7 +53,7 @@ function buildConnection(pageItems, hasNextPage, hasPreviousPage, cursorValueOf)
   };
 }
 
-function run(items, argsDict, capability, labelField, decodeLocalIdOpt, ownerScope) {
+function run(items, argsDict, capability, labelField, decodeLocalIdOpt, ownerScope, retiredScope) {
   let decodeLocalId = decodeLocalIdOpt !== undefined ? decodeLocalIdOpt : Api_Ids$ReventlessCore.toLocalId;
   let filterDict = Stdlib_Option.getOr(Stdlib_Option.flatMap(argsDict["filter"], Stdlib_JSON.Decode.object), {});
   let search = Stdlib_Option.flatMap(filterDict["search"], Stdlib_JSON.Decode.string);
@@ -102,8 +107,9 @@ function run(items, argsDict, capability, labelField, decodeLocalIdOpt, ownerSco
     } else {
       passOwner = true;
     }
-    if (passSearch && passPrefix && passIds && passPerField) {
-      return passOwner;
+    let passRetired = retiredScope !== undefined ? !OwnerScope$Reventless.isRetiredValue(retiredScope, Stdlib_Option.flatMap(Stdlib_JSON.Decode.object(item), d => d[retiredScope.field])) : true;
+    if (passSearch && passPrefix && passIds && passPerField && passOwner) {
+      return passRetired;
     } else {
       return false;
     }
@@ -214,8 +220,9 @@ export {
   decodeCursor,
   defaultListPageSize,
   getId,
+  getFieldBool,
   getFieldString,
   buildConnection,
   run,
 }
-/* No side effect */
+/* OwnerScope-Reventless Not a pure module */

package/src/components/Api/SuryToJsonSchema.res

@@ -101,6 +101,45 @@ let mergeAnnotations = (
       }
     | None => ()
     }
+    switch spec.retired {
+    | Some(r) if r.field === fieldName =>
+      // `x-reventless-retired: {label?, showWhenFalse, values?, value?}`. The
+      // label is omitted when empty, the way `x-reventless-metric` omits its own,
+      // so a consumer deriving one from the field name can tell "not stated" from
+      // "stated as empty". `showWhenFalse` always travels: it is a decision the
+      // annotation author made either way, and its default is not the consumer's
+      // to pick.
+      //
+      // `values` follows the same omit-rather-than-write-empty rule, and its
+      // absence is what says which form this is: absent ⇒ the row is retired when
+      // the field is `true`; present ⇒ retired when the field's value is in the
+      // set, and the field is the record's lifecycle.
+      //
+      // The singular `value` rides alongside for one release, and only where the
+      // set has exactly one member — there is no singular reading of two. It
+      // exists to close a window, not to support two shapes: a consumer pinned
+      // before the set degrades to nothing at all rather than to a missing badge.
+      // Enforcement never depended on it — the resolvers exclude retired rows
+      // whatever the consumer understands — so the whole of the lag is cosmetic.
+      // Drop it once no consumer predating the set can be reached.
+      let entries = [("showWhenFalse", JSON.Encode.bool(r.showWhenFalse))]
+      let entries = switch r.values {
+      | Some(vs) =>
+        let entries = Array.concat(
+          entries,
+          [("values", JSON.Encode.array(vs->Array.map(JSON.Encode.string)))],
+        )
+        switch vs {
+        | [only] => Array.concat(entries, [("value", JSON.Encode.string(only))])
+        | _ => entries
+        }
+      | None => entries
+      }
+      let entries =
+        r.label === "" ? entries : Array.concat([("label", JSON.Encode.string(r.label))], entries)
+      obj->Dict.set("x-reventless-retired", JSON.Encode.object(Dict.fromArray(entries)))
+    | _ => ()
+    }
     switch spec.metric->Array.find(((field, _)) => field === fieldName) {
     | Some((_, m)) =>
       // `x-reventless-metric: {aggregate, label}`. Omit an empty label so the

package/src/components/Api/SuryToJsonSchema.res.mjs

@@ -90,18 +90,49 @@ function mergeAnnotations(fieldSchema, fieldName, spec) {
       obj["x-reventless-semantic"] = semanticId;
     }
   }
+  let r = spec.retired;
+  if (r !== undefined && r.field === fieldName) {
+    let entries = [[
+        "showWhenFalse",
+        r.showWhenFalse
+      ]];
+    let vs = r.values;
+    let entries$1;
+    if (vs !== undefined) {
+      let entries$2 = entries.concat([[
+          "values",
+          vs.map(prim => prim)
+        ]]);
+      if (vs.length !== 1) {
+        entries$1 = entries$2;
+      } else {
+        let only = vs[0];
+        entries$1 = entries$2.concat([[
+            "value",
+            only
+          ]]);
+      }
+    } else {
+      entries$1 = entries;
+    }
+    let entries$3 = r.label === "" ? entries$1 : [[
+          "label",
+          r.label
+        ]].concat(entries$1);
+    obj["x-reventless-retired"] = Object.fromEntries(entries$3);
+  }
   let match$4 = spec.metric.find(param => param[0] === fieldName);
   if (match$4 !== undefined) {
     let m = match$4[1];
-    let entries = [[
+    let entries$4 = [[
         "aggregate",
         m.aggregate
       ]];
-    let entries$1 = m.label === "" ? entries : entries.concat([[
+    let entries$5 = m.label === "" ? entries$4 : entries$4.concat([[
           "label",
           m.label
         ]]);
-    obj["x-reventless-metric"] = Object.fromEntries(entries$1);
+    obj["x-reventless-metric"] = Object.fromEntries(entries$5);
   }
   return obj;
 }

package/src/components/Dcb/Dcb_Builder.res

@@ -312,7 +312,7 @@ module Make = (
         // sweeps up sibling products. Cross-partition fan-out and capacity reads are
         // preserved (generalised rule 3). Safety guard: if any slice's partition is
         // ambiguous we keep the annotated values for the whole boundary rather than
-        // thread a partial inference. See docs/plans/dcb-tag-scope-inference.md.
+        // thread a partial inference. See docs/plans/done/dcb-tag-scope-inference.md.
         let inferenceShapes =
           stateChangeSlices->Array.map((module(Sc: StateChangeSlice.T)) =>
             Reventless.DcbTag.sliceShapeFromSchemas(
@@ -761,28 +761,80 @@ module Make = (
         // + AppSync direct invocations (CommandGenerator.payload format)
         let dcbHandlerBase = DcbCommandTopic.makeFilteringHandler(dcbCommandTopic)
 
-        // Shared generateCommand for AppSync direct invocations — all sync StateChangeSlices
-        // share the same DCB CommandTopic's publishJsons, so a single function suffices.
-        // commandSchema validation is skipped (permissive JSON.t schema) because AppSync
-        // already validates input against the SDL.
+        // generateCommand for AppSync direct invocations, one per command constructor.
+        //
+        // Every one of them shares this CommandTopic's publishJsons — the reason a
+        // single function used to suffice — and they differ in exactly one argument:
+        // the schema. That argument is not only a validator. `makeGenerateCommand`
+        // also reads it to find the fields a command marks as its owner, and stamps
+        // them with the caller. Handing it the permissive `S.json` (as this did, on
+        // the still-true grounds that AppSync has already validated against the SDL)
+        // makes that lookup answer "no owner fields" for every command there is — so
+        // the write publishes whatever owner the CLIENT sent, silently, and the row
+        // is wrong from then on.
+        //
+        // Per-slice decoding still happens inside `buildSliceHandler`; nothing here
+        // re-validates. The schema travels for what it says about ownership.
+        let dcbCommandSchemasByTag = {
+          let byTag = Dict.make()
+          stateChangeSlices->Array.forEach((module(S: StateChangeSlice.T)) => {
+            let commandSchema = S.Spec.commandSchema->Reventless.DcbTag.toUnknownSchema
+            if !(ApiNoApiHelpers.isNoApi(commandSchema)) {
+              Api_Naming.sliceMutationFields(
+                ~plugin=apiNamePrefix,
+                ~slice=S.Spec.name,
+                ~commandSchema,
+              )->Array.forEach(((_, tag)) => {
+                // The resolver injects the TAG alone, so two slices claiming one
+                // constructor name would make the stamp ambiguous — and the wrong
+                // arm of that ambiguity writes a row owned by nobody's decision.
+                // Multi-command slices cannot reach here (their mutation fields
+                // collide first), which leaves single-command slices, where the
+                // field names differ and nothing else would notice.
+                switch byTag->Dict.get(tag) {
+                | Some(_) =>
+                  log.error(
+                    ~comp="Dcb_Builder",
+                    `Two DCB slices in "${name}" both declare the command "${tag}". ` ++
+                    "Owner stamping resolves a command by that name alone, so it cannot " ++
+                    "tell them apart. Rename one of the constructors.",
+                  )
+                | None => byTag->Dict.set(tag, commandSchema)
+                }
+              })
+            }
+          })
+          byTag
+        }
+
         let dcbGenerateCommandOutput =
           dcbCommandTopic
           ->Component.operations
-          ->Pulumi.Output.apply(ops =>
-            CommandGenerator_Callback.makeGenerateCommand(
-              ~publishJsons=ops.publishJsons,
-              ~publishJsonsAndWait=?ops.publishJsonsAndWait,
-              ~serviceName=name,
-              ~commandSchema=S.json->S.castToUnknown,
-              ~componentKind=CommandGenerator_Callback.StateChangeSlice,
-              ~stripIdFromParams=false,
-            )
-          )
+          ->Pulumi.Output.apply(ops => {
+            let make = commandSchema =>
+              CommandGenerator_Callback.makeGenerateCommand(
+                ~publishJsons=ops.publishJsons,
+                ~publishJsonsAndWait=?ops.publishJsonsAndWait,
+                ~serviceName=name,
+                ~commandSchema,
+                ~componentKind=CommandGenerator_Callback.StateChangeSlice,
+                ~stripIdFromParams=false,
+              )
+            let byTag = Dict.make()
+            dcbCommandSchemasByTag
+            ->Dict.toArray
+            ->Array.forEach(((tag, schema)) => byTag->Dict.set(tag, make(schema)))
+            // A command no slice claims keeps the permissive generator — what every
+            // command got before this change — so nothing that reaches this handler
+            // by another route starts failing. It also cannot stamp, which is why
+            // the unknown case is logged rather than left to look like a success.
+            (byTag, make(S.json->S.castToUnknown))
+          })
 
         let dcbHandler =
           (dcbHandlerBase, inboundReceiversOutput, dcbGenerateCommandOutput)
           ->Pulumi.Output.all3
-          ->Pulumi.Output.apply(((baseHandler, receivers, generateCommand)) => {
+          ->Pulumi.Output.apply(((baseHandler, receivers, (generatorsByTag, generateFallback))) => {
             let composite = (event, ctx) => {
               let raw: dict<JSON.t> = event->Obj.magic
               switch raw->Dict.get("__inboundTranslation") {
@@ -810,6 +862,17 @@ module Make = (
                 switch (raw->Dict.get("command"), raw->Dict.get("arguments")) {
                 | (Some(JSON.String(_)), Some(_)) =>
                   let payload: CommandGenerator.payload = event->Obj.magic
+                  let generateCommand = switch generatorsByTag->Dict.get(payload.command) {
+                  | Some(g) => g
+                  | None =>
+                    log.warn(
+                      ~comp="Dcb_Builder",
+                      `No DCB slice in "${name}" declares the command "${payload.command}", ` ++
+                      "so it is dispatched without an owner stamp. Any field the command " ++
+                      "marks as its owner keeps the value the caller sent.",
+                    )
+                    generateFallback
+                  }
                   (generateCommand(payload)->Effect.map(msgId => msgId->Obj.magic))->Obj.magic
                 | _ => baseHandler(event, ctx)
                 }