@sixb/core 0.1.13 → 0.1.15

package/dist/testing/index.js

@@ -2,13 +2,13 @@
 import {
   AuthStorageError2,
   SYSTEM_PRINCIPAL2
-} from "../chunk-9pfw47qx.js";
+} from "../chunk-qne45xqq.js";
 import {
   defineProjection2,
   agentServiceAccountId2,
   MAX_OBJECT_READ_FACETS2
-} from "../chunk-rzcjp5m2.js";
-import"../chunk-rzkr70gr.js";
+} from "../chunk-8fjmqjyx.js";
+import"../chunk-6fsr7y93.js";
 import"../chunk-z3y5kg1x.js";
 import {
   compileSelectedObjectReadScope2
@@ -17,7 +17,7 @@ import"../chunk-d8yes9yx.js";
 import {
   ref2
 } from "../chunk-drz59ve0.js";
-import"../chunk-0321g649.js";
+import"../chunk-2jntasmh.js";
 import"../chunk-pqajwytd.js";
 import"../chunk-ky7zpbtt.js";
 import"../chunk-gfdh9kqa.js";
@@ -31,7 +31,7 @@ import {
 import {
   AiUsageStorageError2
 } from "../chunk-xnx96gfy.js";
-import"../chunk-xgptywp0.js";
+import"../chunk-y2aq6ag9.js";
 import"../chunk-fc5zfxy1.js";
 import {
   aiLimitCalendarMonth2
@@ -39,7 +39,7 @@ import {
 import {
   DEFAULT_FILE_UPLOAD_TERMINAL_SESSION_TTL_MS2
 } from "../chunk-h89wz928.js";
-import"../chunk-n33e8dz8.js";
+import"../chunk-p0nbkys4.js";
 import"../chunk-tw03bsmb.js";
 import {
   OntologyRegistry2,
@@ -50,7 +50,7 @@ import {
 } from "../chunk-3nx8vj5a.js";
 import {
   createEventId2
-} from "../chunk-ht4a7mjg.js";
+} from "../chunk-g4rbm4a6.js";
 import {
   AGENT_MESSAGE_CONTENT_VERSION2,
   AiCostStorageError2,
@@ -59,30 +59,30 @@ import {
   objectLinkCursor2,
   WorkflowInterventionError2,
   InMemoryStorage2
-} from "../chunk-gc226ten.js";
+} from "../chunk-fjw417jf.js";
 import"../chunk-7ytf06d3.js";
 import"../chunk-mr60an99.js";
 import"../chunk-mmagke4x.js";
-import"../chunk-qma80ych.js";
-import"../chunk-znw0zvy4.js";
+import"../chunk-hn2r7z41.js";
+import"../chunk-4wn7bxxa.js";
 import"../chunk-jmfet9r4.js";
 import"../chunk-qf954wje.js";
-import"../chunk-darm7eeg.js";
+import"../chunk-xr7y35yj.js";
 import {
   ProjectionRegistry2,
   createLinkScopeFingerprint2,
   createOntologyMaterializer2
-} from "../chunk-rqtdtm43.js";
+} from "../chunk-z708gemf.js";
 import {
   bindModelExecutionAttempt,
   isBoundSixb
-} from "../chunk-cvrbhvtr.js";
+} from "../chunk-2tz5vnvz.js";
 import"../chunk-5a4a52tq.js";
 import {
   SixbHost2
-} from "../chunk-mf6hwpzh.js";
-import"../chunk-y6vnvayj.js";
-import"../chunk-ypj2wqtj.js";
+} from "../chunk-dqkd3kdj.js";
+import"../chunk-vjcd8d27.js";
+import"../chunk-70jmg2zx.js";
 import"../chunk-r2y23egw.js";
 import"../chunk-dfm066qg.js";
 import {
@@ -94,18 +94,18 @@ import {
   existsObjects2,
   facetObjects2,
   executeObjectQueryLinks2
-} from "../chunk-898y24dd.js";
-import"../chunk-63fp9x3q.js";
+} from "../chunk-3c90jvfj.js";
+import"../chunk-wem5vqjw.js";
 import"../chunk-3qms4nax.js";
 import"../chunk-f85hpqnm.js";
-import"../chunk-4tnrzqqh.js";
-import"../chunk-gbcrz0gr.js";
-import"../chunk-y487ywrv.js";
+import"../chunk-fj1dvp37.js";
+import"../chunk-ex8s8wsk.js";
+import"../chunk-6q7c68yx.js";
 import"../chunk-fb3feg1e.js";
 import"../chunk-z5rnrmz1.js";
 import"../chunk-85cd7e8c.js";
 import"../chunk-wr8qp979.js";
-import"../chunk-693f3zn8.js";
+import"../chunk-1jvq82rp.js";
 import"../chunk-dsfw1bdr.js";
 import {
   col2,
@@ -115,14 +115,14 @@ import {
 import"../chunk-e1c18xjx.js";
 import"../chunk-9vx5e9g1.js";
 import"../chunk-dmn70ztd.js";
-import"../chunk-cbn96bve.js";
+import"../chunk-r5sc1d2b.js";
 import {
   writeDataset2
 } from "../chunk-91kcnbf0.js";
-import"../chunk-vn3yh259.js";
+import"../chunk-4gmng3vf.js";
 import {
   workflowAgentStepActorId2
-} from "../chunk-s24qbp32.js";
+} from "../chunk-7jc21943.js";
 import {
   BrokerError2,
   InMemoryBroker2
@@ -135,22 +135,22 @@ import"../chunk-mdnw7nj8.js";
 import {
   SandboxNotRunningError2
 } from "../chunk-vef6qa14.js";
-import"../chunk-jhyc777j.js";
-import"../chunk-2hbhn1ff.js";
+import"../chunk-q3grgzp1.js";
+import"../chunk-yfppyaty.js";
 import"../chunk-7n30ybym.js";
-import"../chunk-jmwy25mf.js";
+import"../chunk-wd34wnsy.js";
 import {
   createTestingScope
-} from "../chunk-z9h698s8.js";
+} from "../chunk-a4g5yjm0.js";
 import"../chunk-x9v4cx1d.js";
 import"../chunk-ffwvdgk1.js";
-import"../chunk-a69fkrtr.js";
-import"../chunk-bep5rrdq.js";
-import"../chunk-gmt22nxx.js";
-import"../chunk-91wthfwe.js";
-import"../chunk-w9bp61e7.js";
+import"../chunk-y0zmae99.js";
+import"../chunk-adbve9zt.js";
+import"../chunk-mmac1mp6.js";
 import"../chunk-bxx3ms5t.js";
-import"../chunk-04h4t2b5.js";
+import"../chunk-py2dw8cw.js";
+import"../chunk-4jph1t3v.js";
+import"../chunk-n5t4mq6z.js";
 import {
   LakeStorageError2
 } from "../chunk-rb143ggb.js";
@@ -160,11 +160,11 @@ import {
 } from "../chunk-a0073121.js";
 import {
   restoreTrustedPrimitiveExecutionScope
-} from "../chunk-m8zkvep1.js";
-import"../chunk-zdkcdshk.js";
+} from "../chunk-8w27xf9e.js";
 import"../chunk-br3k6qbf.js";
+import"../chunk-zdkcdshk.js";
 import"../chunk-s3csryxe.js";
-import"../chunk-bdhfn0ww.js";
+import"../chunk-kkqwzy6h.js";
 import"../chunk-2fv8sajb.js";
 import {
   blobIdFromDigest2
@@ -3931,6 +3931,30 @@ async function createUser(storage, input = {}) {
     createdAt: at4("2026-05-14T10:00:00.000Z")
   });
 }
+async function completeOidcSignInForAva(storage, directoryGroupIds) {
+  await storage.oidcAuthorizationAttempts.create({
+    id: "oidc_directory",
+    projectId: projectId6,
+    strategyId: "entra",
+    audience: "atlas",
+    stateHash: "directory-state",
+    nonceHash: "nonce-hash",
+    codeVerifier: "verifier",
+    createdAt: at4("2026-05-14T10:00:00.000Z"),
+    expiresAt: at4("2026-05-14T10:10:00.000Z")
+  });
+  await storage.completeOidcSignIn({
+    projectId: projectId6,
+    oidcAuthorizationAttemptId: "oidc_directory",
+    stateHash: "directory-state",
+    completedAt: at4("2026-05-14T10:01:00.000Z"),
+    subject: "entra-ava",
+    email: "ava@acme.com",
+    directoryGroupIds,
+    newUserId: "usr_unused",
+    session: sessionInput("ses_directory")
+  });
+}
 function runAuthStorageContractSuite(label, options) {
   const withStorage = async (body) => {
     const storage = await options.createStorage();
@@ -5299,81 +5323,6 @@ function runAuthStorageContractSuite(label, options) {
         await expect6(storage.groupMemberships.listForUser({ projectId: projectId6, userId: "usr_founder" })).resolves.toMatchObject([{ groupId: "security-admins", source: "manual" }]);
       });
     });
-    test6("closes bootstrap user creation when an active user already exists", async () => {
-      await withStorage(async (storage) => {
-        await createUser(storage, {
-          id: "usr_existing",
-          email: "existing@acme.com"
-        });
-        await storage.magicLinks.create({
-          id: "ml_1",
-          projectId: projectId6,
-          strategyId: "magic-link",
-          audience: "atlas",
-          email: "founder@acme.com",
-          tokenHash: "link-hash",
-          createdAt: at4("2026-05-14T10:01:00.000Z"),
-          expiresAt: at4("2026-05-14T10:16:00.000Z")
-        });
-        await expectAuthError(storage.completeMagicLinkSignIn({
-          projectId: projectId6,
-          magicLinkId: "ml_1",
-          tokenHash: "link-hash",
-          completedAt: at4("2026-05-14T10:03:00.000Z"),
-          newUserId: "usr_founder",
-          allowUserCreationWithoutInvitation: true,
-          requireNoActiveUsersForUserCreation: true,
-          session: sessionInput("ses_founder")
-        }), "user_creation_not_allowed");
-        await expect6(storage.users.getByEmail({ projectId: projectId6, email: "founder@acme.com" })).resolves.toBeNull();
-        await expect6(storage.magicLinks.getById({ projectId: projectId6, id: "ml_1" })).resolves.toMatchObject({
-          consumedAt: at4("2026-05-14T10:03:00.000Z")
-        });
-      });
-    });
-    test6("does not apply the bootstrap closure guard to invited user creation", async () => {
-      await withStorage(async (storage) => {
-        await createUser(storage, {
-          id: "usr_existing",
-          email: "existing@acme.com"
-        });
-        await storage.invitations.createOrUpdateActive({
-          id: "inv_1",
-          projectId: projectId6,
-          email: "invited@acme.com",
-          groupIds: ["commercial"],
-          createdAt: at4("2026-05-14T10:00:00.000Z"),
-          expiresAt: at4("2026-05-21T10:00:00.000Z")
-        });
-        await storage.magicLinks.create({
-          id: "ml_1",
-          projectId: projectId6,
-          strategyId: "magic-link",
-          audience: "atlas",
-          email: "invited@acme.com",
-          tokenHash: "link-hash",
-          createdAt: at4("2026-05-14T10:01:00.000Z"),
-          expiresAt: at4("2026-05-14T10:16:00.000Z")
-        });
-        const result = await storage.completeMagicLinkSignIn({
-          projectId: projectId6,
-          magicLinkId: "ml_1",
-          tokenHash: "link-hash",
-          completedAt: at4("2026-05-14T10:03:00.000Z"),
-          newUserId: "usr_invited",
-          requireNoActiveUsersForUserCreation: true,
-          session: sessionInput("ses_invited")
-        });
-        expect6(result.user).toMatchObject({
-          id: "usr_invited",
-          email: "invited@acme.com"
-        });
-        expect6(result.invitation).toMatchObject({
-          id: "inv_1",
-          status: "accepted"
-        });
-      });
-    });
     test6("consumes valid magic links when an existing user is suspended", async () => {
       await withStorage(async (storage) => {
         await createUser(storage, { status: "suspended" });
@@ -5429,7 +5378,6 @@ function runAuthStorageContractSuite(label, options) {
           completedAt: at4("2026-05-14T10:02:00.000Z"),
           subject: "00u1",
           email: "renamed@acme.com",
-          emailVerified: true,
           claims: { email: "renamed@acme.com" },
           newUserId: "usr_unused",
           session: sessionInput("ses_oidc")
@@ -5445,59 +5393,33 @@ function runAuthStorageContractSuite(label, options) {
         });
       });
     });
-    test6("auto-links OIDC by verified email only when explicitly allowed", async () => {
+    test6("links a new OIDC identity to the existing user with its email", async () => {
       await withStorage(async (storage) => {
         await createUser(storage, { id: "usr_existing", email: "ava@acme.com" });
         await storage.oidcAuthorizationAttempts.create({
-          id: "oidc_blocked",
+          id: "oidc_1",
           projectId: projectId6,
           strategyId: "okta",
           audience: "atlas",
-          stateHash: "blocked-state",
+          stateHash: "state-hash",
           nonceHash: "nonce-hash",
           codeVerifier: "verifier",
           createdAt: at4("2026-05-14T10:00:00.000Z"),
           expiresAt: at4("2026-05-14T10:10:00.000Z")
         });
-        await expectAuthError(storage.completeOidcSignIn({
-          projectId: projectId6,
-          oidcAuthorizationAttemptId: "oidc_blocked",
-          stateHash: "blocked-state",
-          completedAt: at4("2026-05-14T10:01:00.000Z"),
-          subject: "00u1",
-          email: "ava@acme.com",
-          emailVerified: false,
-          autoLinkByVerifiedEmail: true,
-          newUserId: "usr_unused",
-          session: sessionInput("ses_blocked")
-        }), "email_link_not_allowed");
-        await storage.oidcAuthorizationAttempts.create({
-          id: "oidc_allowed",
-          projectId: projectId6,
-          strategyId: "okta",
-          audience: "atlas",
-          stateHash: "allowed-state",
-          nonceHash: "nonce-hash",
-          codeVerifier: "verifier",
-          createdAt: at4("2026-05-14T10:02:00.000Z"),
-          expiresAt: at4("2026-05-14T10:12:00.000Z")
-        });
         const result = await storage.completeOidcSignIn({
           projectId: projectId6,
-          oidcAuthorizationAttemptId: "oidc_allowed",
-          stateHash: "allowed-state",
-          completedAt: at4("2026-05-14T10:03:00.000Z"),
+          oidcAuthorizationAttemptId: "oidc_1",
+          stateHash: "state-hash",
+          completedAt: at4("2026-05-14T10:01:00.000Z"),
           subject: "00u1",
           email: "ava@acme.com",
-          emailVerified: true,
-          autoLinkByVerifiedEmail: true,
           newUserId: "usr_unused",
-          session: sessionInput("ses_allowed")
+          session: sessionInput("ses_oidc")
         });
         expect6(result.user.id).toBe("usr_existing");
-        expect6(result.identity).toMatchObject({
-          userId: "usr_existing"
-        });
+        expect6(result.identity).toMatchObject({ subject: "00u1", userId: "usr_existing" });
+        await expect6(storage.users.getById({ projectId: projectId6, id: "usr_unused" })).resolves.toBeNull();
       });
     });
     test6("creates new OIDC users through active invitations and applies groups", async () => {
@@ -5529,7 +5451,6 @@ function runAuthStorageContractSuite(label, options) {
           subject: "00u1",
           email: "ava@acme.com",
           displayName: "Ava Chen",
-          emailVerified: true,
           newUserId: "usr_oidc",
           session: sessionInput("ses_oidc")
         });
@@ -5570,14 +5491,13 @@ function runAuthStorageContractSuite(label, options) {
           completedAt: at4("2026-05-14T10:01:00.000Z"),
           subject: "00u1",
           email: "ava@acme.com",
-          emailVerified: true,
           newUserId: "usr_oidc",
           session: sessionInput("ses_oidc")
         }), "user_creation_not_allowed");
         await expect6(storage.users.getByEmail({ projectId: projectId6, email: "ava@acme.com" })).resolves.toBeNull();
       });
     });
-    test6("allows first OIDC bootstrap user creation with manual groups", async () => {
+    test6("allows OIDC bootstrap user creation with manual groups", async () => {
       await withStorage(async (storage) => {
         await storage.oidcAuthorizationAttempts.create({
           id: "oidc_bootstrap",
@@ -5597,9 +5517,7 @@ function runAuthStorageContractSuite(label, options) {
           completedAt: at4("2026-05-14T10:01:00.000Z"),
           subject: "00u1",
           email: "founder@acme.com",
-          emailVerified: true,
           allowUserCreationWithoutInvitation: true,
-          requireNoActiveUsersForUserCreation: true,
           manualGroupIds: ["security-admins"],
           newUserId: "usr_founder",
           session: sessionInput("ses_oidc_bootstrap")
@@ -5611,6 +5529,56 @@ function runAuthStorageContractSuite(label, options) {
         await expect6(storage.groupMemberships.listForUser({ projectId: projectId6, userId: "usr_founder" })).resolves.toMatchObject([{ groupId: "security-admins", source: "manual" }]);
       });
     });
+    test6("syncs directory memberships to exactly the groups the provider grants", async () => {
+      await withStorage(async (storage) => {
+        await createUser(storage);
+        for (const [groupId, source] of [
+          ["security-admins", "manual"],
+          ["commercial", "invitation"],
+          ["legacy-team", "directory"]
+        ]) {
+          await storage.groupMemberships.upsert({ projectId: projectId6, userId: "usr_1", groupId, source });
+        }
+        await completeOidcSignInForAva(storage, ["security-admins", "field-ops"]);
+        await expect6(storage.groupMemberships.listForUser({ projectId: projectId6, userId: "usr_1" })).resolves.toMatchObject([
+          { groupId: "commercial", source: "invitation" },
+          { groupId: "field-ops", source: "directory" },
+          { groupId: "security-admins", source: "manual" }
+        ]);
+      });
+    });
+    test6("removes every directory membership when the provider grants no groups", async () => {
+      await withStorage(async (storage) => {
+        await createUser(storage);
+        await storage.groupMemberships.upsert({
+          projectId: projectId6,
+          userId: "usr_1",
+          groupId: "security-admins",
+          source: "manual"
+        });
+        await storage.groupMemberships.upsert({
+          projectId: projectId6,
+          userId: "usr_1",
+          groupId: "field-ops",
+          source: "directory"
+        });
+        await completeOidcSignInForAva(storage, []);
+        await expect6(storage.groupMemberships.listForUser({ projectId: projectId6, userId: "usr_1" })).resolves.toMatchObject([{ groupId: "security-admins", source: "manual" }]);
+      });
+    });
+    test6("leaves directory memberships alone when sign-in syncs no groups", async () => {
+      await withStorage(async (storage) => {
+        await createUser(storage);
+        await storage.groupMemberships.upsert({
+          projectId: projectId6,
+          userId: "usr_1",
+          groupId: "field-ops",
+          source: "directory"
+        });
+        await completeOidcSignInForAva(storage, undefined);
+        await expect6(storage.groupMemberships.listForUser({ projectId: projectId6, userId: "usr_1" })).resolves.toMatchObject([{ groupId: "field-ops", source: "directory" }]);
+      });
+    });
     test6("suspends users and revokes active sessions immediately", async () => {
       await withStorage(async (storage) => {
         await createUser(storage);
@@ -13192,33 +13160,140 @@ function runOntologyStorageContractSuite(label, options) {
           execution,
           abandonedAt: "2026-01-01T00:03:00.000Z"
         })).rejects.toMatchObject({ kind: "execution-lost" });
+        const adopted = await storage.ontology.sources.adopt({
+          projectId: "contract-project",
+          source,
+          execution: reclaimed.execution,
+          adoptedAt: "2026-01-01T00:01:30.000Z"
+        });
+        expect21(adopted).toMatchObject({
+          record: {
+            materializationId: "staging-candidate",
+            status: "ready",
+            executionToken: reclaimed.execution.executionToken,
+            updatedAt: "2026-01-01T00:01:30.000Z"
+          },
+          resumeStagingOrdinal: 1
+        });
+        expect21(await storage.ontology.sources.adopt({
+          projectId: "contract-project",
+          source,
+          execution: reclaimed.execution,
+          adoptedAt: "2026-01-01T00:01:40.000Z"
+        })).toMatchObject({ record: { executionToken: reclaimed.execution.executionToken } });
         const abandoned = await storage.ontology.sources.abandon({
-          kind: "reclaim",
+          kind: "run",
           projectId: "contract-project",
           source,
           execution: reclaimed.execution,
           abandonedAt: "2026-01-01T00:02:00.000Z"
         });
         expect21(abandoned).toMatchObject({ status: "abandoned", executionToken: null });
-        expect21(await storage.ontology.sources.summarizeTerminal({ projectId: "contract-project" })).toEqual({ count: 1, oldestTerminalAt: "2026-01-01T00:02:00.000Z" });
-        expect21(await storage.ontology.sources.cleanupTerminal({
+        expect21(await storage.ontology.sources.abandon({
+          kind: "run",
           projectId: "contract-project",
-          terminalBefore: "2026-02-01T00:00:00.000Z",
-          limit: 1
-        })).toEqual({ rowsDeleted: 1, materializationsDeleted: 0 });
-        expect21(await storage.ontology.sources.cleanupTerminal({
+          source,
+          execution: reclaimed.execution,
+          abandonedAt: "2026-01-01T00:02:00.000Z"
+        })).toBeNull();
+        expect21(await storage.ontology.sources.adopt({
           projectId: "contract-project",
-          terminalBefore: "2026-02-01T00:00:00.000Z",
-          limit: 1
-        })).toEqual({ rowsDeleted: 1, materializationsDeleted: 0 });
+          source,
+          execution: reclaimed.execution,
+          adoptedAt: "2026-01-01T00:02:10.000Z"
+        })).toBeNull();
+        expect21(await storage.ontology.sources.summarizeTerminal({ projectId: "contract-project" })).toEqual({ count: 1, oldestTerminalAt: "2026-01-01T00:02:00.000Z" });
         expect21(await storage.ontology.sources.cleanupTerminal({
           projectId: "contract-project",
           terminalBefore: "2026-02-01T00:00:00.000Z",
-          limit: 1
-        })).toEqual({ rowsDeleted: 0, materializationsDeleted: 1 });
+          limit: 10
+        })).toEqual({ rowsDeleted: 0, materializationsDeleted: 0 });
+        expect21(await storage.ontology.sources.purgeAbandoned({ projectId: "contract-project", limit: 1 })).toEqual({ rowsDeleted: 1, materializationsDeleted: 0 });
+        expect21(await storage.ontology.sources.purgeAbandoned({ projectId: "contract-project", limit: 1 })).toEqual({ rowsDeleted: 1, materializationsDeleted: 0 });
+        expect21(await storage.ontology.sources.purgeAbandoned({ projectId: "contract-project", limit: 1 })).toEqual({ rowsDeleted: 0, materializationsDeleted: 1 });
         expect21(await storage.ontology.sources.summarizeTerminal({ projectId: "contract-project" })).toEqual({ count: 0, oldestTerminalAt: null });
       });
     });
+    test21("adopts a staging candidate at its last staged root", async () => {
+      await withStorage(async (storage) => {
+        const identity = replacementIdentity("01");
+        const claimed = await startTestProjectionRun(storage, {
+          id: "resumed-run",
+          projectId: "contract-project",
+          identity,
+          target: { objectTypeId: "ContractDevice" }
+        });
+        const source = { projectionId: identity.projectionId };
+        await storage.ontology.sources.beginMaterialization({
+          projectId: "contract-project",
+          source,
+          materializationId: "resumed-candidate",
+          execution: claimed.execution,
+          projectionKind: "object",
+          protocol: "replacement",
+          datasetVersion: identity.datasetVersion,
+          projectionRevision: identity.projectionRevision,
+          ownershipHash: identity.ownershipHash,
+          ontologyRevision: identity.ontologyRevision,
+          createdAt: "2026-01-01T00:00:00.000Z"
+        });
+        const row = (primaryId, stagingOrdinal) => ({
+          root: { kind: "object", ref: { objectTypeId: "ContractDevice", primaryId } },
+          assertion: {
+            kind: "object",
+            ref: { objectTypeId: "ContractDevice", primaryId },
+            properties: { name: primaryId }
+          },
+          stagingOrdinal
+        });
+        await storage.ontology.sources.stageRows({
+          projectId: "contract-project",
+          source,
+          materializationId: "resumed-candidate",
+          execution: claimed.execution,
+          rows: [row("zero", 0), row("one", 1)]
+        });
+        const reclaimed = await storage.projectionRuns.startOrReclaim({
+          id: claimed.run.id,
+          projectId: claimed.run.projectId,
+          identity,
+          target: { objectTypeId: "ContractDevice" }
+        });
+        const adopted = await storage.ontology.sources.adopt({
+          projectId: "contract-project",
+          source,
+          execution: reclaimed.execution,
+          adoptedAt: "2026-01-01T00:01:00.000Z"
+        });
+        expect21(adopted).toMatchObject({
+          record: { status: "staging", executionToken: reclaimed.execution.executionToken },
+          resumeStagingOrdinal: 1
+        });
+        await expect21(storage.ontology.sources.stageRows({
+          projectId: "contract-project",
+          source,
+          materializationId: "resumed-candidate",
+          execution: claimed.execution,
+          rows: [row("two", 2)]
+        })).rejects.toMatchObject({ kind: "execution-lost" });
+        expect21(await storage.ontology.sources.stageRows({
+          projectId: "contract-project",
+          source,
+          materializationId: "resumed-candidate",
+          execution: reclaimed.execution,
+          rows: [row("one", 1), row("two", 2)]
+        })).toEqual({ inserted: 1, unchanged: 1 });
+        expect21(await storage.ontology.sources.markReady({
+          projectId: "contract-project",
+          source,
+          materializationId: "resumed-candidate",
+          execution: reclaimed.execution,
+          rootCount: 3,
+          assertionCount: 3,
+          readyAt: "2026-01-01T00:02:00.000Z"
+        })).toMatchObject({ status: "ready", rootCount: 3 });
+      });
+    });
     test21("atomically activates explicit empty candidates and rejects competing stale heads", async () => {
       await withStorage(async (storage) => {
         const first = await createReadyEmptyCandidate(storage, "run-one", "candidate-one", "01");
@@ -13257,15 +13332,14 @@ function runOntologyStorageContractSuite(label, options) {
         });
         await expect21(activateEmptyCandidate(storage, stale, currentActive, "commit-stale-activation", "2026-01-06T00:00:00.000Z")).rejects.toThrow("execution token is stale");
         await storage.ontology.sources.abandon({
-          kind: "reclaim",
+          kind: "run",
           projectId: "contract-project",
           source: stale.source,
           execution: reclaimed.execution,
           abandonedAt: "2026-01-06T00:01:00.000Z"
         });
-        const cleanup = await storage.ontology.sources.cleanupTerminal({
+        const cleanup = await storage.ontology.sources.purgeAbandoned({
           projectId: "contract-project",
-          terminalBefore: "2026-02-01T00:00:00.000Z",
           limit: 10
         });
         expect21(cleanup.materializationsDeleted).toBeGreaterThanOrEqual(1);
@@ -13763,6 +13837,12 @@ var failure2 = {
   at: "2026-06-01T12:00:00.000Z",
   details: { projectionId: "contract.devices", runId: "failed-run" }
 };
+var attemptFailure = {
+  code: "storage.unavailable",
+  message: "Storage is temporarily unavailable.",
+  retryable: true,
+  at: "2026-06-01T11:00:00.000Z"
+};
 var replacementIdentity2 = {
   projectionId: "contract.devices",
   projectionKind: "object",
@@ -13850,11 +13930,120 @@ function runProjectionRunStorageContractSuite(label, options) {
           status: "failed",
           error: { code: "queue.enqueue_failed", message: "queue unavailable" }
         });
-        await expect22(context.projectionRuns.queue(admission)).resolves.toMatchObject({
+        const requeued = await context.projectionRuns.queue(admission);
+        expect22(requeued).toMatchObject({
           executionId: admission.executionId,
           status: "queued",
           attempt: 0
         });
+        expect22(requeued.error).toBeUndefined();
+      });
+    });
+    test22("keeps the failure of a retried attempt until the run ends", async () => {
+      await withStorage(async (context) => {
+        const storage = context.projectionRuns;
+        const input = replacementInput("retried-run");
+        await admitProjectionRun(context, input);
+        const first = await storage.startOrReclaim(input);
+        const failed = await storage.recordAttemptFailure({
+          ...executionInput(first),
+          error: attemptFailure
+        });
+        expect22(failed).toMatchObject({ status: "running", error: attemptFailure });
+        const second = await storage.startOrReclaim(input);
+        expect22(second.run).toMatchObject({ attempt: 2, error: attemptFailure });
+        await expect22(storage.recordAttemptFailure({ ...executionInput(first), error: failure2 })).rejects.toThrow("execution token is stale");
+        await expect22(storage.recordAttemptFailure({
+          ...executionInput(second),
+          error: { ...failure2, code: "dataset.not_found" }
+        })).rejects.toThrow("code is not allowed by this failure contract");
+        const succeeded = await storage.finish({
+          ...executionInput(second),
+          protocol: "replacement",
+          status: "succeeded"
+        });
+        expect22(succeeded).toMatchObject({ status: "succeeded" });
+        expect22(succeeded.error).toBeUndefined();
+        await expect22(storage.recordAttemptFailure({ ...executionInput(second), error: failure2 })).rejects.toThrow("already terminal");
+      });
+    });
+    test22("finds the newest later run that still stands to replace a source", async () => {
+      await withStorage(async (context) => {
+        const storage = context.projectionRuns;
+        const current = replacementInput("current-run");
+        const earlier = versionedReplacementInput("earlier-run", "version-0", "2025-12-31");
+        const later = versionedReplacementInput("later-run", "version-2", "2026-01-02");
+        const latest = versionedReplacementInput("latest-run", "version-3", "2026-01-03");
+        const otherProjection = {
+          ...versionedReplacementInput("other-projection-run", "version-4", "2026-01-04"),
+          identity: {
+            ...versionedReplacementInput("other", "version-4", "2026-01-04").identity,
+            projectionId: "contract.rooms"
+          }
+        };
+        for (const input of [current, earlier, later, latest, otherProjection]) {
+          await admitProjectionRun(context, input);
+        }
+        const superseding = () => storage.findSupersedingRun({ projectId: projectId13, id: current.id });
+        await expect22(superseding()).resolves.toMatchObject({ id: latest.id, status: "queued" });
+        await expect22(storage.findSupersedingRun({ projectId: projectId13, id: latest.id })).resolves.toBeNull();
+        await finishClaimed(context, latest, "failed");
+        await expect22(superseding()).resolves.toMatchObject({ id: later.id });
+        await finishClaimed(context, later, "cancelled");
+        await expect22(superseding()).resolves.toBeNull();
+        const telemetry = {
+          id: "telemetry-run",
+          projectId: projectId13,
+          identity: telemetryIdentity,
+          target: objectTarget,
+          fixedBatchSize: 2
+        };
+        await admitProjectionRun(context, telemetry);
+        await expect22(storage.findSupersedingRun({ projectId: projectId13, id: telemetry.id })).resolves.toBeNull();
+        await expect22(storage.findSupersedingRun({ projectId: projectId13, id: "missing-run" })).rejects.toThrow("not found");
+      });
+    });
+    test22("ends a superseded run without a failure and never reports it as the latest", async () => {
+      await withStorage(async (context) => {
+        const storage = context.projectionRuns;
+        const stale = replacementInput("stale-run");
+        const newer = versionedReplacementInput("newer-run", "version-2", "2026-01-02");
+        await admitProjectionRun(context, stale);
+        await admitProjectionRun(context, newer);
+        const claim = await storage.startOrReclaim({
+          ...stale,
+          startedAt: new Date("2026-01-01T00:00:05.000Z")
+        });
+        const superseded = await storage.finish({
+          ...executionInput(claim),
+          protocol: "replacement",
+          status: "superseded"
+        });
+        expect22(superseded).toMatchObject({ status: "superseded", attempt: 1 });
+        expect22(superseded.error).toBeUndefined();
+        expect22(superseded.finishedAt).toBeInstanceOf(Date);
+        await expect22(storage.listLatestByProjectionIds({
+          projectId: projectId13,
+          projectionIds: [replacementIdentity2.projectionId]
+        })).resolves.toMatchObject({ runs: [{ id: newer.id, status: "queued" }] });
+        await expect22(storage.list({ projectId: projectId13, statuses: ["superseded"] })).resolves.toMatchObject({
+          runs: [{ id: stale.id }],
+          total: 1
+        });
+        const telemetry = {
+          id: "telemetry-run",
+          projectId: projectId13,
+          identity: telemetryIdentity,
+          target: objectTarget,
+          fixedBatchSize: 2
+        };
+        await admitProjectionRun(context, telemetry);
+        const telemetryClaim = await storage.startOrReclaim(telemetry);
+        await expect22(storage.finish({
+          ...executionInput(telemetryClaim),
+          protocol: "telemetry",
+          status: "superseded"
+        })).rejects.toThrow("cannot be superseded");
       });
     });
     test22("keeps one run while reclaim rotates its execution", async () => {
@@ -14196,6 +14385,27 @@ async function admitProjectionRun(context, input) {
 function replacementInput(id) {
   return { id, projectId: projectId13, identity: replacementIdentity2, target: objectTarget };
 }
+function versionedReplacementInput(id, versionId, day) {
+  return {
+    ...replacementInput(id),
+    identity: {
+      ...replacementIdentity2,
+      datasetVersion: {
+        ...replacementIdentity2.datasetVersion,
+        versionId,
+        createdAt: `${day}T00:00:00.000Z`
+      }
+    }
+  };
+}
+async function finishClaimed(context, input, status) {
+  const claim = await context.projectionRuns.startOrReclaim(input);
+  await context.projectionRuns.finish({
+    ...executionInput(claim),
+    protocol: "replacement",
+    status
+  });
+}
 function executionInput(claim) {
   return {
     id: claim.run.id,
@@ -16024,4 +16234,4 @@ export {
   startTestWebhookRun
 };
 
-//# debugId=02F2DAA06B348FD164756E2164756E21
+//# debugId=9B51DDEB1A1D8F0764756E2164756E21