@sixb/core 0.1.10 → 0.1.12

package/src/connectors/connections/runs.ts

@@ -16,6 +16,7 @@ import {
 } from "./authorizations"
 import {
   assertConnectorConnectionRunInitiator,
+  isConnectorConnectionRunInitiator,
   requireConnectorConnectionCommandActor,
 } from "./command-context"
 import type {
@@ -238,6 +239,42 @@ export class ConnectorConnectionRunService {
     }
   }
 
+  async listPending(
+    command: ConnectorConnectionCommandContext,
+    connectorId: string
+  ): Promise<readonly ConnectorConnectionRunView[]> {
+    const actor = requireConnectorConnectionCommandActor(command.execution, this.projectId)
+    const candidates = await withConnectorStorageBoundary(
+      "Pending connector connection runs could not be read.",
+      () =>
+        this.connectionStorage.listPendingConnectionRuns({ projectId: this.projectId, connectorId })
+    )
+    const runs: ConnectorConnectionRunView[] = []
+    for (const candidate of candidates) {
+      const initiating = await withConnectorStorageBoundary(
+        "Connector connection run initiating execution could not be read.",
+        () =>
+          this.storage.executions.getById({
+            projectId: this.projectId,
+            id: candidate.initiatedByExecutionId,
+          })
+      )
+      if (!isConnectorConnectionRunInitiator(initiating, actor)) continue
+      // Re-read through the normal expiry/cleanup path before exposing accounts.
+      const run = await this.get(command, connectorId, candidate.id)
+      if (
+        run &&
+        (run.status === "running" ||
+          (run.status === "waiting" && run.waitingFor === "account_selection"))
+      )
+        runs.push(run)
+    }
+    return runs.sort(
+      (left, right) =>
+        right.createdAt.getTime() - left.createdAt.getTime() || left.id.localeCompare(right.id)
+    )
+  }
+
   async get(
     command: ConnectorConnectionCommandContext,
     connectorId: string,
@@ -581,7 +618,6 @@ export class ConnectorConnectionRunService {
         status: "waiting",
         waitingFor: "account_selection",
         accounts: authorization.accounts,
-        expiresAt: run.expiresAt,
       }
     }
     if (run.status === "succeeded") {
@@ -645,6 +681,7 @@ export class ConnectorConnectionRunService {
       : CLEANUP_RETRY_DELAY_MS
   ): void {
     this.cancelRunMaintenance(run.id)
+    if (run.status === "waiting" && run.waitingFor === "account_selection") return
     const timer = setTimeout(
       () => void this.maintainRun(run.connectorId, run.id),
       Math.min(delayMs, MAX_TIMER_DELAY_MS)

package/src/connectors/connections/service.ts

@@ -66,6 +66,7 @@ export interface ConnectorConnectionServiceOptions {
   readonly storage?: Storage
   readonly credentialProtector?: ConnectorCredentialProtector
   readonly authorizationAttemptTtlMs?: number
+  /** @deprecated Selection no longer expires; retained for legacy storage metadata only. */
   readonly accountSelectionTtlMs?: number
   readonly credentialMutationLeaseMs?: number
   readonly providerOperationTimeoutMs?: number
@@ -322,6 +323,11 @@ export class ConnectorConnectionService implements ConnectorConnectionProcess {
     })
   }
 
+  listPendingConnectionRuns(command: ConnectorConnectionCommandContext, connectorId: string) {
+    this.requireOAuthDefinition(connectorId)
+    return this.runs.listPending(command, connectorId)
+  }
+
   getConnectionRun(
     command: ConnectorConnectionCommandContext,
     connectorId: string,

package/src/datasets/validation.ts

@@ -1,4 +1,5 @@
 import { isFileRef } from "../blob-storage"
+import { withFailureMessage } from "../errors/failure-message"
 import { isJsonValue, isPlainRecord } from "../json"
 import { isDecimalString } from "../ontology/decimal"
 import { DatasetValidationError } from "./errors"
@@ -233,8 +234,17 @@ export function getDatasetRowValidationError(
   dataset: DatasetDefinition,
   options?: { readonly columns?: Iterable<string> }
 ): string | null {
+  return getDatasetRowValidationFailure(row, dataset, options)?.message ?? null
+}
+
+/** Internal form retains a value-free explanation for the durable failure boundary. */
+export function getDatasetRowValidationFailure(
+  row: unknown,
+  dataset: DatasetDefinition,
+  options?: { readonly columns?: Iterable<string> }
+): Error | null {
   if (!isPlainRecord(row)) {
-    return `Dataset '${dataset.id}' rows must be plain objects.`
+    return rowFailure(`Dataset '${dataset.id}' rows must be plain objects.`)
   }
 
   const columnsByName = new Map(
@@ -251,7 +261,7 @@ export function getDatasetRowValidationError(
         continue
       }
 
-      const error = getColumnValidationError(row, column, dataset)
+      const error = getColumnValidationFailure(row, column, dataset)
       if (error) {
         return error
       }
@@ -262,12 +272,15 @@ export function getDatasetRowValidationError(
 
   for (const columnName of Object.keys(row)) {
     if (!columnsByName.has(columnName)) {
-      return `Dataset '${dataset.id}' row contains unknown column '${columnName}'.`
+      return rowFailure(
+        `Dataset '${dataset.id}' row contains unknown column '${columnName}'.`,
+        `Dataset '${dataset.id}' row contains an undeclared column.`
+      )
     }
   }
 
   for (const column of dataset.schema.columns) {
-    const error = getColumnValidationError(row, column, dataset)
+    const error = getColumnValidationFailure(row, column, dataset)
     if (error) {
       return error
     }
@@ -276,29 +289,37 @@ export function getDatasetRowValidationError(
   return null
 }
 
-function getColumnValidationError(
+function getColumnValidationFailure(
   row: Record<string, unknown>,
   column: DatasetColumnDefinition,
   dataset: DatasetDefinition
-): string | null {
+): Error | null {
   const hasValue = Object.hasOwn(row, column.name)
   const value = row[column.name]
   if (column.name === dataset.sequenceBy) {
-    return getDatasetSequenceValidationError(dataset, value)
+    const message = getDatasetSequenceValidationError(dataset, value)
+    return message === null
+      ? null
+      : rowFailure(
+          message,
+          `Dataset '${dataset.id}' sequence column '${column.name}' must contain a valid ${column.type} source sequence.`
+        )
   }
 
   // Treat `undefined` the same as an omitted field so callers either send a real
   // value or use `null` explicitly on nullable columns.
   if (!hasValue || value === undefined) {
     if (!column.nullable) {
-      return `Dataset '${dataset.id}' row is missing required column '${column.name}'.`
+      return rowFailure(`Dataset '${dataset.id}' row is missing required column '${column.name}'.`)
     }
     return null
   }
 
   if (value === null) {
     if (!column.nullable) {
-      return `Dataset '${dataset.id}' column '${column.name}' does not allow null values.`
+      return rowFailure(
+        `Dataset '${dataset.id}' column '${column.name}' does not allow null values.`
+      )
     }
     return null
   }
@@ -307,13 +328,21 @@ function getColumnValidationError(
   // Reject ambiguous or lossy values before staging, even when another column orders the row.
   if (dataset.sequenceBy !== undefined && column.type === "timestamp") {
     return parseDatasetTimestamp(value) === null
-      ? `Dataset '${dataset.id}' column '${column.name}' must be a valid Date or ISO timestamp with an explicit timezone and at most millisecond precision.`
+      ? rowFailure(
+          `Dataset '${dataset.id}' column '${column.name}' must be a valid Date or ISO timestamp with an explicit timezone and at most millisecond precision.`
+        )
       : null
   }
 
   if (!matchesColumnType(value, column.type)) {
-    return `Dataset '${dataset.id}' column '${column.name}' must match type '${column.type}'.`
+    return rowFailure(
+      `Dataset '${dataset.id}' column '${column.name}' must match type '${column.type}'.`
+    )
   }
 
   return null
 }
+
+function rowFailure(message: string, publicMessage = message): Error {
+  return withFailureMessage(new DatasetValidationError(message), publicMessage)
+}

package/src/datasets/write.ts

@@ -1,6 +1,5 @@
 import type { BlobStorage, FileRef } from "../blob-storage"
 import { isFileRef } from "../blob-storage"
-import { isPlainRecord } from "../json"
 import type { DatasetMergeCommitResult } from "../lake-storage/merge"
 import { getDatasetMergeChangeValidationError } from "../lake-storage/merge-validation"
 import type {
@@ -11,7 +10,7 @@ import type {
 } from "../lake-storage/types"
 import type { MergeChange } from "./changes"
 import type { DatasetDefinition } from "./types"
-import { getDatasetRowValidationError } from "./validation"
+import { getDatasetRowValidationFailure } from "./validation"
 
 export interface DatasetWriteValue {
   readonly value: unknown
@@ -161,19 +160,17 @@ async function validateRow(
   input: WriteDatasetInput,
   itemIndex: number
 ): Promise<DatasetRow> {
-  if (!isPlainRecord(value)) {
-    throw new Error(
-      `${sourceLabel(input)} returned an invalid row at item ${itemIndex}. Dataset rows must be plain objects.`
-    )
-  }
-  const validationError = getDatasetRowValidationError(value, input.dataset)
+  const validationError = getDatasetRowValidationFailure(value, input.dataset)
   if (validationError) {
     throw new Error(
-      `${sourceLabel(input)} returned an invalid row at item ${itemIndex}. ${validationError}`
+      `${sourceLabel(input)} returned an invalid row at item ${itemIndex}. ${validationError.message}`,
+      { cause: validationError }
     )
   }
-  await verifyRowFileRefs(value, input, itemIndex)
-  return value
+  // The validator above establishes the row shape.
+  const row = value as DatasetRow
+  await verifyRowFileRefs(row, input, itemIndex)
+  return row
 }
 
 async function validateMergeChange(

package/src/error-reporting/capability.ts

@@ -4,10 +4,12 @@ import {
   type ReportEventDeliveryFailureInput,
   type ReportRuleEvaluationFailureInput,
   type ReportRunFailureInput,
+  type ReportVectorIndexingFailureInput,
   reportActionPhaseFailure as reportActionPhaseFailureWith,
   reportEventDeliveryFailure as reportEventDeliveryFailureWith,
   reportRuleEvaluationFailure as reportRuleEvaluationFailureWith,
   reportRunFailure as reportRunFailureWith,
+  reportVectorIndexingFailure as reportVectorIndexingFailureWith,
 } from "./reports"
 import type { SixbErrorHandler } from "./types"
 
@@ -48,6 +50,7 @@ export type {
   ReportEventDeliveryFailureInput,
   ReportRuleEvaluationFailureInput,
   ReportRunFailureInput,
+  ReportVectorIndexingFailureInput,
 }
 
 export function reportActionPhaseFailure(
@@ -85,3 +88,11 @@ export function reportRuleEvaluationFailure(
 export async function flushSixbErrors(host: unknown, timeoutMs?: number): Promise<void> {
   await resolveSixbErrorReporter(host).flush(timeoutMs)
 }
+
+export function reportVectorIndexingFailure(
+  host: object,
+  error: unknown,
+  input: ReportVectorIndexingFailureInput
+): void {
+  reportVectorIndexingFailureWith(resolveSixbErrorReporter(host), error, input)
+}

package/src/error-reporting/reports.ts

@@ -2,6 +2,7 @@ import { randomUUID } from "node:crypto"
 import { captureSixbFailure } from "../errors/internal"
 import type { SixbFailure } from "../errors/types"
 import type { ActionRunFailure } from "../storage/action-runs"
+import type { VectorIndexingFailureCode } from "../storage/ontology/vector-indexing"
 import type { ErrorReporter } from "./reporter"
 import type { SixbFailedRun } from "./types"
 
@@ -170,3 +171,25 @@ export function reportRuleEvaluationFailure(
     ...(input.subject === undefined ? {} : { subject: input.subject }),
   })
 }
+
+export interface ReportVectorIndexingFailureInput {
+  readonly projectId: string
+  readonly indexingId: string
+  readonly failure: SixbFailure<VectorIndexingFailureCode>
+  readonly objectTypeId: string
+  readonly primaryId: string
+  readonly profile: string
+}
+
+export function reportVectorIndexingFailure(
+  reporter: ErrorReporter,
+  error: unknown,
+  input: ReportVectorIndexingFailureInput
+): void {
+  reporter.report(error, {
+    ...input,
+    type: "vector.indexing.failed",
+    occurredAt: input.failure.at,
+    notificationId: `vector-indexing:${input.projectId}:${input.indexingId}`,
+  })
+}

package/src/error-reporting/types.ts

@@ -1,6 +1,7 @@
 import type { SixbFailure } from "../errors/types"
 import type { ActionRunFailure } from "../storage/action-runs"
 import type { AgentRunFailureCode } from "../storage/agents"
+import type { VectorIndexingFailureCode } from "../storage/ontology/vector-indexing"
 import type { PipelineRunFailureCode } from "../storage/pipeline-runs"
 import type { ProjectionRunFailureCode } from "../storage/projection-runs"
 import type { SyncRunFailureCode } from "../storage/sync-runs"
@@ -166,12 +167,22 @@ export interface SixbRuleEvaluationFailedContext
   readonly subject?: { readonly objectTypeId: string; readonly primaryId: string }
 }
 
+/** A terminal automatic-indexing failure, correlated with its persisted request and profile. */
+export interface SixbVectorIndexingFailedContext
+  extends SixbFailureContext<"vector.indexing.failed"> {
+  readonly failure: SixbFailure<VectorIndexingFailureCode>
+  readonly indexingId: string
+  readonly objectTypeId: string
+  readonly primaryId: string
+  readonly profile: string
+}
+
 /**
  * Context supplied to the global Sixb error handler, discriminated by `type`.
- *
  * Failure notifications never change the outcome of the operation they observe.
  */
 export type SixbErrorContext =
+  | SixbVectorIndexingFailedContext
   | SixbActionPhaseFailedContext
   | SixbRunFailedContext
   | SixbEventDeliveryFailedContext

package/src/errors/catalog.ts

@@ -130,6 +130,18 @@ export const SIXB_ERROR_DEFINITIONS = {
     publicMessage: "Execution was cancelled.",
     retryable: false,
   },
+  "vector.model_unavailable": {
+    publicMessage: "The embedding model configured for this vector profile is unavailable.",
+    retryable: false,
+  },
+  "vector.response_invalid": {
+    publicMessage: "The embedding response is invalid for this vector profile.",
+    retryable: false,
+  },
+  "vector.outcome_unknown": {
+    publicMessage: "The embedding call was interrupted; its outcome and charges may be unknown.",
+    retryable: false,
+  },
   "sync.execution_failed": {
     publicMessage: "Sync execution failed.",
     retryable: false,

package/src/errors/failure-message.ts

@@ -0,0 +1,15 @@
+const messages = new WeakMap<object, string>()
+
+/**
+ * Mark a framework-authored explanation for durable diagnostics. Use schema metadata and fixed
+ * text only, never exception messages, input values, provider payloads, or arbitrary object keys.
+ * Identity-based storage prevents an external error from opting in with a lookalike property.
+ */
+export function withFailureMessage<T extends Error>(error: T, message: string): T {
+  messages.set(error, message)
+  return error
+}
+
+export function failureMessage(error: object): string | undefined {
+  return messages.get(error)
+}

package/src/errors/internal.ts

@@ -1,5 +1,7 @@
 import { cloneJsonValue, isJsonValue, isPlainRecord, type ReadonlyJsonValue } from "../json"
+import { ActionRunFailedError } from "../objects/action/errors"
 import { SIXB_ERROR_CODES, SIXB_ERROR_DEFINITIONS } from "./catalog"
+import { failureMessage } from "./failure-message"
 import { createFailureRedactor } from "./redaction"
 import type { SixbErrorCode, SixbFailure } from "./types"
 
@@ -135,10 +137,15 @@ export function toSixbFailure(
   const code = error.code
   const redactor = createFailureRedactor()
   const details = error.details === undefined ? undefined : redactor.context(error.details)
-  const { detail, truncated } = findFailureDetail(error, code)
+  const { detail, truncated, redacted } = findFailureDetail(error, code)
   const summary = SIXB_ERROR_DEFINITIONS[code].publicMessage
+  const explanation = detail?.message ?? summary
   const message = truncateUtf8(
-    redactor.text(detail && detail.message !== summary ? `${summary} ${detail.message}` : summary),
+    redactor.text(
+      explanation === summary || explanation.startsWith(`${summary} `)
+        ? explanation
+        : `${summary} ${explanation}`
+    ),
     SIXB_FAILURE_MAX_MESSAGE_BYTES
   )
   const failure: SixbFailure = {
@@ -148,7 +155,7 @@ export function toSixbFailure(
     at: failureTimestamp(options.at),
     ...(details === undefined ? {} : { details: cloneJsonValue(details, "Sixb failure details") }),
     ...(detail?.httpStatus === undefined ? {} : { httpStatus: detail.httpStatus }),
-    ...(redactor.redacted ? { redacted: true } : {}),
+    ...(redactor.redacted || redacted ? { redacted: true } : {}),
     ...(message.truncated || truncated || redactor.truncated ? { truncated: true } : {}),
   }
 
@@ -177,47 +184,72 @@ function isHttpStatus(value: unknown): value is number {
   return typeof value === "number" && Number.isInteger(value) && value >= 100 && value <= 599
 }
 
-/** Select one explanation along the causal chain; unrelated aggregate errors stay separate. */
+/** Follow the causal chain without exposing arbitrary messages or discarding deeper statuses. */
 function findFailureDetail(
   error: SixbCodedError,
   boundaryCode: SixbErrorCode
-): { detail?: { message: string; httpStatus?: number }; truncated: boolean } {
+): {
+  detail?: { message: string; httpStatus?: number }
+  truncated: boolean
+  redacted: boolean
+} {
   const seen = new Set<object>()
+  const messages = new Set<string>()
+  let catalogMessage: string | undefined
+  let httpStatus: number | undefined
+  let truncated = false
+  let redacted = false
   let current: unknown = error
   while (typeof current === "object" && current !== null && !seen.has(current)) {
-    if (seen.size === 8) return { truncated: true }
-    seen.add(current)
-    if (
-      isSixbError(current) &&
-      current.code !== boundaryCode &&
-      current.code !== "internal.unexpected"
-    ) {
-      return {
-        detail: { message: SIXB_ERROR_DEFINITIONS[current.code].publicMessage },
-        truncated: false,
-      }
+    if (seen.size === 8) {
+      truncated = true
+      break
     }
+    seen.add(current)
+    const explanation = failureMessage(current)
+    if (explanation) messages.add(explanation)
     try {
-      // Read only data properties: arbitrary messages and getters remain private.
+      if (current instanceof ActionRunFailedError) {
+        // This is an already durable child failure, not arbitrary provider prose. Revalidate it
+        // before propagation; do not copy its context over the parent's identity or retry policy.
+        const child = parseSixbFailure(Object.getOwnPropertyDescriptor(current, "error")?.value)
+        messages.add(child.message)
+        httpStatus ??= child.httpStatus
+        redacted ||= child.redacted === true
+        truncated ||= child.truncated === true
+      }
+      if (
+        isSixbError(current) &&
+        current.code !== boundaryCode &&
+        current.code !== "internal.unexpected"
+      ) {
+        catalogMessage = SIXB_ERROR_DEFINITIONS[current.code].publicMessage
+      }
+      // Read data properties only: provider accessors, messages and payloads remain private.
       const status =
         Object.getOwnPropertyDescriptor(current, "status")?.value ??
         Object.getOwnPropertyDescriptor(current, "statusCode")?.value
-      if (isHttpStatus(status)) {
-        return {
-          detail: { message: `Upstream request returned HTTP ${status}.`, httpStatus: status },
-          truncated: false,
-        }
-      }
+      if (httpStatus === undefined && isHttpStatus(status)) httpStatus = status
       const code = Object.getOwnPropertyDescriptor(current, "code")?.value
       if (typeof code === "string" && Object.hasOwn(NETWORK_MESSAGES, code)) {
-        return { detail: { message: NETWORK_MESSAGES[code] }, truncated: false }
+        messages.add(NETWORK_MESSAGES[code])
       }
       current = Object.getOwnPropertyDescriptor(current, "cause")?.value
     } catch {
       break
     }
   }
-  return { truncated: false }
+  if (messages.size === 0 && catalogMessage) messages.add(catalogMessage)
+  if (httpStatus !== undefined) {
+    const statusMessage = `Upstream request returned HTTP ${httpStatus}.`
+    if (![...messages].some((message) => message.includes(statusMessage)))
+      messages.add(statusMessage)
+  }
+  return {
+    ...(messages.size === 0 ? {} : { detail: { message: [...messages].join(" "), httpStatus } }),
+    truncated,
+    redacted,
+  }
 }
 
 /** Serializes a validated failure for durable storage. */

package/src/events/outbox-dispatcher.ts

@@ -46,6 +46,7 @@ export interface OntologyOutboxDispatcherOptions {
   readonly maxIsolationAttempts?: number
   /** Maximum claimed batches handled by one drain pass. */
   readonly maxClaimsPerDrain?: number
+  /** Broker grace period. Shutdown still waits for outstanding storage operations afterward. */
   readonly shutdownTimeoutMs?: number
   readonly now?: () => Date
   readonly random?: () => number
@@ -100,10 +101,10 @@ export class OntologyOutboxDispatcher {
   private readonly createLeaseId: () => string
   private readonly onDeliveryFailure?: OntologyOutboxDispatcherOptions["onDeliveryFailure"]
   private readonly onError: (error: unknown) => void
-  private readonly inFlight = new Set<ClaimedBatch>()
   private draining: Promise<void> | null = null
   private pendingDrain: Promise<void> | null = null
   private stopping: Promise<void> | null = null
+  private closing = false
   private stopRequested = false
   private readonly forcedStop = new AbortController()
 
@@ -166,7 +167,7 @@ export class OntologyOutboxDispatcher {
    * mutation.
    */
   drain(): Promise<void> {
-    if (this.stopRequested) return Promise.resolve()
+    if (this.closing || this.stopRequested) return Promise.resolve()
     if (!this.draining) return this.startDrainPass()
 
     this.pendingDrain ??= settled(this.draining).then(() => {
@@ -178,7 +179,7 @@ export class OntologyOutboxDispatcher {
 
   /** Starts a tracked, best-effort drain without extending mutation latency. */
   notify(): void {
-    if (this.stopRequested) return
+    if (this.closing || this.stopRequested) return
     void this.drain().catch((error) => this.reportError(error))
   }
 
@@ -193,19 +194,16 @@ export class OntologyOutboxDispatcher {
     // Include one final bounded pass so commits whose notifications were coalesced immediately
     // before shutdown are not left pending merely because the process is stopping.
     const gracefulDrain = this.drain().catch((error) => this.reportError(error))
-    if (await settlesWithin(gracefulDrain, this.shutdownTimeoutMs)) {
-      this.stopRequested = true
-      return
-    }
-
+    this.closing = true
+    const finished = await settlesWithin(gracefulDrain, this.shutdownTimeoutMs)
     this.stopRequested = true
-    this.forcedStop.abort()
-    await settlesWithin(
-      this.rescheduleUnsettledForShutdown(),
-      Math.min(this.shutdownTimeoutMs, 1_000)
-    )
-    this.draining = null
-    this.pendingDrain = null
+    if (!finished) this.forcedStop.abort()
+    // Storage operations cannot be cancelled by this contract. A late claim must release its
+    // lease, and an acknowledgement already started must finish before callers close storage.
+    // publishClaim owns settlement, including forced stop; never race a second cleanup against it.
+    await gracefulDrain
+    if (this.draining) await settled(this.draining)
+    if (this.pendingDrain) await settled(this.pendingDrain)
   }
 
   private startDrainPass(): Promise<void> {
@@ -224,11 +222,14 @@ export class OntologyOutboxDispatcher {
       if (rows.length === 0) return
       const publishedCount = await this.publishClaim(rows)
       if (this.stopRequested || publishedCount === 0 || rows.length < this.batchSize) return
+      // In-memory/SQLite can resolve without I/O. Yield between full batches so catch-up cannot
+      // monopolize the event loop, while keeping small post-commit deliveries immediate.
+      await new Promise<void>((resolve) => setImmediate(resolve))
     }
 
     // A healthy full slice means more due rows may remain. Reuse the existing coalescing path so
     // catch-up continues without recursion, an idle polling loop, or an unbounded individual pass.
-    if (!this.stopRequested) this.notify()
+    if (!this.closing && !this.stopRequested) this.notify()
   }
 
   private claimBatch(): Promise<readonly ClaimedOntologyOutboxRow[]> {
@@ -247,7 +248,6 @@ export class OntologyOutboxDispatcher {
   private async publishClaim(rows: readonly ClaimedOntologyOutboxRow[]): Promise<number> {
     const claim = new ClaimedBatch(rows)
     const failures = new DeliveryFailureAccumulator()
-    this.inFlight.add(claim)
     const pending: PublicationGroup[] = [{ rows }]
     let publishAttempts = 0
     let publishedCount = 0
@@ -288,7 +288,6 @@ export class OntologyOutboxDispatcher {
       if (this.stopRequested) {
         await this.rescheduleClaimedForShutdown(claim.close())
       }
-      this.inFlight.delete(claim)
       for (const failure of failures.list()) {
         this.reportDeliveryFailure(failure.error, failure.context)
       }
@@ -378,15 +377,10 @@ export class OntologyOutboxDispatcher {
     }
   }
 
-  private async rescheduleUnsettledForShutdown(): Promise<void> {
-    for (const claim of [...this.inFlight]) {
-      await this.rescheduleClaimedForShutdown(claim.close())
-      this.inFlight.delete(claim)
-    }
-  }
-
   private withOutbox<T>(run: (outbox: OntologyOutboxStorage) => Promise<T> | T): Promise<T> {
-    return this.storage.transaction((tx) => run(tx.ontology.outbox))
+    // Every outbox method owns its atomic provider operation. A framework-wide transaction
+    // adds no guarantee here and copies the entire InMemoryStorage state for every batch.
+    return Promise.resolve(run(this.storage.ontology.outbox))
   }
 
   private reportDeliveryFailure(error: unknown, failure: OntologyOutboxDeliveryFailure): void {

package/src/execution/authorization.ts

@@ -14,6 +14,7 @@ import type {
   CompiledSelectedObjectReadScope,
   SelectedObjectReadScope,
 } from "../storage/objects/types"
+import { kernelOperationFromId, kernelOperationId } from "./kernel-operation"
 import {
   type AuthorizablePrincipal,
   type AuthorizationRef,
@@ -443,7 +444,8 @@ function assertResolvedAuthorizationMatchesExecution(
         resolved.ref.type !== "kernel" ||
         execution.requestedBy !== undefined ||
         resolved.ref.operation.type !== execution.executor.operation.type ||
-        resolved.ref.operation.recoveryId !== execution.executor.operation.recoveryId
+        kernelOperationId(resolved.ref.operation) !==
+          kernelOperationId(execution.executor.operation)
       ) {
         throw invalidExecutionAuthority(
           execution.id,
@@ -546,6 +548,9 @@ function snapshotExecutionExecutor(
 
 function snapshotExecutionSource(source: ExecutionContext["source"]): ExecutionContext["source"] {
   switch (source.type) {
+    case "ontologyCommit":
+      assertNonEmpty(source.commitId, "Execution source commit id")
+      return Object.freeze({ type: source.type, commitId: source.commitId })
     case "http":
       assertNonEmpty(source.requestId, "Execution source request id")
       return Object.freeze({ type: "http", requestId: source.requestId })
@@ -704,11 +709,13 @@ function snapshotTrustedPrimitive(primitive: TrustedPrimitiveRef): TrustedPrimit
 }
 
 function snapshotKernelOperation(operation: KernelOperation): KernelOperation {
-  if (operation.type !== "ontology.recover") {
-    throw new Error(`[Sixb] Unknown kernel operation '${operation.type}'.`)
+  if (operation.type !== "ontology.recover" && operation.type !== "ontology.indexVectors") {
+    throw new Error(
+      `[Sixb] Unknown kernel operation '${String((operation as { type?: unknown }).type)}'.`
+    )
   }
-  assertNonEmpty(operation.recoveryId, "Kernel recovery id")
-  return Object.freeze({ type: operation.type, recoveryId: operation.recoveryId })
+  assertNonEmpty(kernelOperationId(operation), "Kernel operation id")
+  return Object.freeze(kernelOperationFromId(operation.type, kernelOperationId(operation)))
 }
 
 /** Validate, bound, and detach exact delegated Action targets before registering authority. */