@sixb/core 0.1.8 → 0.1.10

package/src/storage/ontology/provider.ts

@@ -164,6 +164,7 @@ function isJsonValue(value: unknown): value is import("../../json").JsonValue {
 }
 
 export interface ProviderReplacementSessionState {
+  readonly incremental?: boolean
   readonly sourceId: string
   readonly candidateMaterializationId: string
   readonly previousMaterializationId: string | null
@@ -654,6 +655,66 @@ export function sourceStageRow(row: StageSourceAssertion): SourceStageRow {
   }
 }
 
+export interface SourceStageRoot {
+  readonly root: StageSourceAssertion["root"]
+  readonly rootKey: string
+  readonly sortKey: string
+  readonly stagingOrdinal: number
+  readonly deleted: boolean
+}
+
+/** Shared root identity rules, including deletions that deliberately have no assertion rows. */
+export function sourceStageRoots(
+  projectionKind: OntologySourceRecord["projectionKind"],
+  input: {
+    readonly rows: readonly StageSourceAssertion[]
+    readonly deletions?: readonly {
+      readonly root: StageSourceAssertion["root"]
+      readonly stagingOrdinal: number
+    }[]
+  }
+): readonly SourceStageRoot[] {
+  for (const row of input.rows) assertSourceStagedRow(projectionKind, row)
+  const roots = new Map<string, SourceStageRoot>()
+  const ordinals = new Map<number, string>()
+  for (const [items, deleted] of [
+    [input.rows, false],
+    [input.deletions ?? [], true],
+  ] as const) {
+    for (const row of items) {
+      assertSourceEntity(row.root, "Source root")
+      if (
+        row.root.kind !== projectionKind ||
+        !Number.isSafeInteger(row.stagingOrdinal) ||
+        row.stagingOrdinal < 0
+      ) {
+        throw new MaterializationValidationError("Source root kind or staging ordinal is invalid.")
+      }
+      const key = projectionEntityKey(row.root)
+      const previous = roots.get(key)
+      const otherRoot = ordinals.get(row.stagingOrdinal)
+      if (
+        (previous &&
+          (previous.deleted !== deleted || previous.stagingOrdinal !== row.stagingOrdinal)) ||
+        (otherRoot !== undefined && otherRoot !== key)
+      ) {
+        throw new MaterializationValidationError(
+          `Source materialization repeats root or stream ordinal ${row.stagingOrdinal} with different content.`
+        )
+      }
+      roots.set(key, {
+        root: row.root,
+        rootKey: key,
+        sortKey: utf8SortKey(key),
+        stagingOrdinal: row.stagingOrdinal,
+        deleted,
+      })
+      ordinals.set(row.stagingOrdinal, key)
+    }
+  }
+  return [...roots.values()]
+}
+
 export function reconcileSourceStageRows(
   rows: readonly SourceStageRow[],
   existingRows: readonly SourceStageRow[]
@@ -732,6 +793,13 @@ export function assertSourceBeginInput(input: BeginSourceMaterializationInput):
   assertNonblank(input.datasetVersion.versionId, "Source dataset version id")
   assertTimestamp(input.datasetVersion.createdAt, "Source dataset version createdAt", true)
   assertTimestamp(input.createdAt, "Source createdAt", true)
+  if (input.base) {
+    assertNonblank(input.base.materializationId, "Source base materialization id")
+    assertNonblank(input.base.lastCommitId, "Source base commit id")
+    if (input.base.materializationId === input.materializationId) {
+      throw new MaterializationValidationError("A source candidate cannot be its own base.")
+    }
+  }
 }
 
 export function assertSourceWriteIdentity(input: {
@@ -863,6 +931,8 @@ export function isExactStagingManifest(
     row.datasetVersion.createdAt === input.datasetVersion.createdAt &&
     row.projectionRevision === input.projectionRevision &&
     row.ownershipHash === input.ownershipHash &&
+    row.base?.materializationId === input.base?.materializationId &&
+    row.base?.lastCommitId === input.base?.lastCommitId &&
     row.ontologyRevision === input.ontologyRevision
   )
 }

package/src/storage/ontology/sources.ts

@@ -3,6 +3,7 @@ import type {
   ProjectionEntityRef,
   ProjectionExecution,
   ProjectionSourceAssertion,
+  ProjectionSourceBase,
   ProjectionSourceRef,
 } from "../../materialization/model"
 
@@ -32,7 +33,8 @@ export interface OntologySourceRecord {
   readonly projectionRevision: string
   readonly ownershipHash: string
   readonly ontologyRevision: string
-  /** Null until staging is sealed by markReady; zero explicitly represents an empty output. */
+  readonly base?: ProjectionSourceBase
+  /** Staged roots, including explicit deletions for a delta; null until sealed by markReady. */
   readonly rootCount: number | null
   /** Null until staging is sealed by markReady; zero explicitly represents an empty output. */
   readonly assertionCount: number | null
@@ -78,6 +80,7 @@ export interface BeginSourceMaterializationInput {
   readonly projectionRevision: string
   readonly ownershipHash: string
   readonly ontologyRevision: string
+  readonly base?: ProjectionSourceBase
   readonly createdAt: string
 }
 
@@ -94,6 +97,13 @@ export interface StageSourceRowsInput {
   readonly materializationId: string
   readonly execution: ProjectionExecution
   readonly rows: readonly StageSourceAssertion[]
+  /** Explicit root removals, allowed only for a candidate with a pinned base. */
+  readonly deletions?: readonly StageSourceRoot[]
+}
+
+export interface StageSourceRoot {
+  readonly root: ProjectionEntityRef
+  readonly stagingOrdinal: number
 }
 
 export interface StageSourceRowsResult {
@@ -139,13 +149,14 @@ export type AbandonSourceMaterializationInput =
 
 export interface CleanupTerminalSourceMaterializationsInput {
   readonly projectId: string
-  /** Exclusive cutoff applied only to superseded/abandoned terminalAt. */
+  /** Exclusive cutoff for retired roots in terminal manifests, and for empty terminal manifests. */
   readonly terminalBefore: string
-  /** Maximum total child-row plus manifest deletions performed by one call. */
+  /** Maximum total assertion, root-reference, and manifest deletions performed by one call. */
   readonly limit: number
 }
 
 export interface CleanupTerminalSourceMaterializationsResult {
+  /** Assertion rows and root references deleted. */
   readonly rowsDeleted: number
   readonly materializationsDeleted: number
 }

package/src/storage/projection-runs/lifecycle.ts

@@ -287,7 +287,7 @@ export function mergeProjectionRunProgress(
     const value = patch[key]
     if (value === undefined) continue
     assertProjectionRunCounter(value, key)
-    if (value < current[key]) {
+    if (value < (current[key] ?? 0)) {
       throw new ProjectionRunError(`[Sixb] Projection run ${key} must not decrease.`)
     }
     progress[key] = value
@@ -706,7 +706,10 @@ function projectionTargetsEqual(left: ProjectionTarget, right: ProjectionTarget)
 
 function assertProjectionRunProgress(progress: ProjectionRunProgress): void {
   for (const key of PROJECTION_RUN_PROGRESS_KEYS) {
-    assertProjectionRunCounter(progress[key], key)
+    assertProjectionRunCounter(
+      key === "sourceChangesRead" ? (progress[key] ?? 0) : progress[key],
+      key
+    )
   }
   if (progress.sourceRowsSkipped > progress.sourceRowsRead) {
     throw new ProjectionRunError(

package/src/storage/projection-runs/types.ts

@@ -23,11 +23,14 @@ export interface ProjectionRunProgress {
   readonly sourceRowsRead: number
   /** Physical rows intentionally skipped because a required mapped value was blank. */
   readonly sourceRowsSkipped: number
+  /** Maximum complete change records consumed by one incremental attempt; not a recovery cursor. */
+  readonly sourceChangesRead?: number
 }
 
 const progressKeyFlags: Record<keyof ProjectionRunProgress, true> = {
   sourceRowsRead: true,
   sourceRowsSkipped: true,
+  sourceChangesRead: true,
 }
 
 export const PROJECTION_RUN_PROGRESS_KEYS = Object.keys(
@@ -35,9 +38,7 @@ export const PROJECTION_RUN_PROGRESS_KEYS = Object.keys(
 ) as readonly (keyof ProjectionRunProgress)[]
 
 export function zeroProjectionRunProgress(): ProjectionRunProgress {
-  const progress = {} as Record<keyof ProjectionRunProgress, number>
-  for (const key of PROJECTION_RUN_PROGRESS_KEYS) progress[key] = 0
-  return progress
+  return { sourceRowsRead: 0, sourceRowsSkipped: 0 }
 }
 
 export interface ProjectionTelemetryCheckpoint {

package/src/storage/workflow-runs/in-memory.ts

@@ -1,4 +1,3 @@
-import { normalizeRequesterGroupIds } from "../../auth/attribution"
 import { parseSixbFailure } from "../../errors/internal"
 import type { SixbFailure } from "../../errors/types"
 import type { AgentRunFailureCode } from "../agents"
@@ -143,7 +142,6 @@ export class InMemoryWorkflowRunStorage implements WorkflowRunStorage {
       queuedAt,
       startedAt: queuedAt,
       attempt: 0,
-      requesterGroupIds: normalizeRequesterGroupIds(input.requesterGroupIds),
     }
 
     this.runs.set(key, cloneRecord(record))

package/src/storage/workflow-runs/types.ts

@@ -144,8 +144,6 @@ export interface WorkflowRunRecord {
   readonly startedAt: Date
   readonly finishedAt?: Date
   readonly error?: SixbFailure<WorkflowRunFailureCode>
-  /** Durable group memberships snapshotted when the workflow run was admitted. */
-  readonly requesterGroupIds: readonly string[]
   readonly attempt: number
   readonly execution?: WorkflowRunExecution
 }
@@ -181,7 +179,6 @@ export interface QueueWorkflowRunInput {
   readonly workflowId: string
   readonly input: WorkflowIOSnapshot
   readonly queuedAt?: Date
-  readonly requesterGroupIds: readonly string[]
 }
 
 export interface ReclaimWorkflowRunInput {

package/src/syncs/run-dispatch.ts

@@ -93,7 +93,10 @@ export class SyncRunDispatcher implements SyncRunDispatchPort {
 /** Persist a Sync execution and queued run before publishing its queue job. */
 export async function dispatchSyncRun(input: DispatchSyncRunInput): Promise<SyncRunRequestResult> {
   const runId = createSyncRunId(input.runId)
-  const persisted = await persistSyncRun(input, runId)
+  let persisted = await persistSyncRun(input, runId)
+  if (!persisted.publish && input.validateExistingRun && persisted.run.status === "queued") {
+    persisted = await reuseSyncRun(input, persisted.run)
+  }
   if (!persisted.publish) return existingSyncRunResult(persisted.run)
   return publishSyncRun(input, persisted)
 }
@@ -151,6 +154,15 @@ async function reuseSyncRun(
 ): Promise<PersistedSyncRun> {
   assertExistingRunMatchesRequest(existing, input)
   await input.validateExistingRun?.(existing, input.storage)
+  if (input.validateExistingRun && existing.status === "queued") {
+    const execution = await input.storage.executions.getById({
+      projectId: input.projectId,
+      id: existing.executionId,
+    })
+    if (!execution)
+      throw new SyncRunError(`[Sixb] Execution '${existing.executionId}' was not found.`)
+    return { publish: true, run: existing, execution, queuedAt: existing.queuedAt, created: false }
+  }
   if (
     existing.status !== "failed" ||
     existing.error?.code !== "queue.enqueue_failed" ||
@@ -200,6 +212,9 @@ async function publishSyncRun(
         },
       ],
     })
+    if (!job || job.id !== persisted.run.id) {
+      throw new SyncRunError(`[Sixb] Queue did not acknowledge Sync run '${persisted.run.id}'.`)
+    }
     return {
       syncId: persisted.run.syncId,
       runId: persisted.run.id,
@@ -208,6 +223,9 @@ async function publishSyncRun(
       created: persisted.created,
     }
   } catch (error) {
+    // Automatic consumers retain the batch and retry. Keep uncertain delivery queued:
+    // a lost reply does not prove that the queue rejected the job.
+    if (input.validateExistingRun) throw error
     const failedAt = new Date()
     const failure = toEnqueueFailure(error, persisted.run, failedAt)
     const failed = await requireSyncRunStorage(input.storage).finish({

package/src/testing/action-execution.ts

@@ -10,6 +10,7 @@ export async function createTestActionExecution(
     readonly actionId: string
     readonly runId: string
     readonly executionId?: string
+    readonly requesterGroupIds?: readonly string[]
   }
 ): Promise<string> {
   const parentExecutionId = `test_request_execution:${input.runId}`
@@ -27,6 +28,7 @@ export async function createTestActionExecution(
   if (!parent) {
     await executions.create({
       id: parentExecutionId,
+      requesterGroupIds: input.requesterGroupIds ?? [],
       projectId: input.projectId,
       executor: { type: "request", requestId: `test_request:${input.runId}` },
       source: { type: "http", requestId: `test_request:${input.runId}` },
@@ -36,6 +38,7 @@ export async function createTestActionExecution(
   }
   await executions.create({
     id: executionId,
+    requesterGroupIds: input.requesterGroupIds ?? [],
     projectId: input.projectId,
     executor: { type: "primitive", kind: primitive.kind, runId: primitive.runId },
     source: { type: "execution", executionId: parentExecutionId },
@@ -49,13 +52,17 @@ export async function createTestActionExecution(
 /** Queue an Action run with the valid durable execution fixture required by every provider. */
 export async function queueTestActionRun(
   storage: Pick<Storage, "actionRuns" | "executions">,
-  input: Omit<QueueActionRunInput, "executionId">
+  input: Omit<QueueActionRunInput, "executionId"> & {
+    readonly requesterGroupIds?: readonly string[]
+  }
 ): Promise<ActionRunRecord> {
   if (!storage.actionRuns) throw new Error("Action run storage is not configured for this test.")
   const executionId = await createTestActionExecution(storage.executions, {
     projectId: input.projectId,
     actionId: input.actionId,
     runId: input.id,
+    requesterGroupIds: input.requesterGroupIds,
   })
-  return storage.actionRuns.queue({ ...input, executionId })
+  const { requesterGroupIds: _groups, ...run } = input
+  return storage.actionRuns.queue({ ...run, executionId })
 }

package/src/testing/agent-execution.ts

@@ -13,6 +13,7 @@ export async function createTestAgentExecution(
     readonly runId: string
     readonly executionId?: string
     readonly sourceExecutionId?: string
+    readonly requesterGroupIds?: readonly string[]
     /** Conversational runs inherit authority; workflow fixtures use managed authority. */
     readonly authority?: "managed" | "inherited"
   }
@@ -65,6 +66,7 @@ export async function createTestAgentExecution(
   if (!parent) {
     parent = await storage.executions.create({
       id: sourceExecutionId,
+      requesterGroupIds: input.requesterGroupIds ?? [],
       projectId: input.projectId,
       executor: { type: "request", requestId: `test_request:${input.runId}` },
       source: { type: "http", requestId: `test_request:${input.runId}` },
@@ -74,6 +76,7 @@ export async function createTestAgentExecution(
   }
   await storage.executions.create({
     id: executionId,
+    requesterGroupIds: parent.requesterGroupIds,
     projectId: input.projectId,
     executor: { type: "agent", runId: input.runId },
     source: { type: "execution", executionId: sourceExecutionId },

package/src/testing/agent-storage-contract.ts

@@ -93,7 +93,6 @@ function runInput(overrides: Partial<TestRunInput> = {}): TestRunInput {
     triggerMessageId: "msg_user_1",
     spec: { model: { provider: "test", modelId: "large" } },
     executionId: "test_agent_execution:run_1",
-    requesterGroupIds: ["support", "engineering", "support"],
     execution: execution("exec_1"),
     createdAt: at("2026-06-23T10:00:10.000Z"),
     ...overrides,
@@ -491,7 +490,6 @@ export function runAgentStorageContractSuite<TStorage extends AgentStorageContra
           spawnKey: "research-orders",
           status: "queued",
           attempt: 0,
-          requesterGroupIds: ["engineering", "support"],
           spec: input.spec,
         })
         expect(child).not.toHaveProperty("threadId")
@@ -655,7 +653,6 @@ export function runAgentStorageContractSuite<TStorage extends AgentStorageContra
         const run = await createAndStartRun(storage, fixture, runInput({ id: "run_1" }))
         expect(run).toMatchObject({ status: "running", attempt: 1, threadId: "thr_1" })
         expect(run.executionId).toBe("test_agent_execution:run_1")
-        expect(run.requesterGroupIds).toEqual(["engineering", "support"])
         expect(run.execution?.token).toBe("exec_1")
         await expect(storage.threads.getById({ projectId, id: "thr_1" })).resolves.toMatchObject({
           activeRunId: "run_1",
@@ -791,10 +788,8 @@ export function runAgentStorageContractSuite<TStorage extends AgentStorageContra
           mutableExecution.token = "mutated"
           mutableExecution.queueLeaseExpiresAt.setTime(0)
         }
-        ;(run.requesterGroupIds as string[]).push("mutated")
         const reread = await storage.runs.getById({ projectId, id: "run_1" })
         expect(reread?.execution?.token).toBe("exec_1")
-        expect(reread?.requesterGroupIds).toEqual(["engineering", "support"])
       })
     })
 

package/src/testing/ai-model-call-groups-contract.ts

@@ -22,6 +22,80 @@ export function runAiModelCallGroupsContractSuite<T extends AiModelCallGroupsCon
   options: AiStorageContractSuiteOptions<T>
 ): void {
   describe(name, () => {
+    test("attributes direct calls and retries to requests, actions, and workflows", async () => {
+      // Removal proof: return undefined from directModelCallAttribution and run this suite.
+      const storage = await options.createStorage()
+      try {
+        await options.setup?.(storage)
+        const expected = [
+          { kind: "request", requestId: "request" },
+          { kind: "action", actionId: "summarize", actionRunId: "action" },
+          { kind: "workflow", workflowId: "summarize", workflowRunId: "workflow" },
+        ] as const
+        for (const attribution of expected) {
+          const kind = attribution.kind
+          const primitive = {
+            kind: kind === "action" ? ("action" as const) : ("workflow" as const),
+            id: "summarize",
+            runId: kind,
+          }
+          const execution = await storage.executions.create({
+            projectId,
+            id: kind,
+            executor:
+              kind === "request"
+                ? { type: "request", requestId: kind }
+                : { type: "primitive", kind, runId: kind },
+            source:
+              kind === "request"
+                ? { type: "http", requestId: kind }
+                : { type: "event", eventId: kind },
+            correlationId: kind,
+            authorizationRef:
+              kind === "request" ? { type: "disabled" } : { type: "trustedPrimitive", primitive },
+          })
+          for (const attempt of [1, 2]) {
+            await storage.aiUsage.recordModelCall({
+              projectId,
+              id: `${kind}:${attempt}`,
+              executionId: execution.id,
+              attempt,
+              callId: `${kind}:${attempt}`,
+              requesterGroupIds: execution.requesterGroupIds,
+              providerId: "test",
+              requestedModelId: "small",
+              responseId: `${kind}:${attempt}`,
+              usage: { inputTokens: 2, outputTokens: 3 },
+              occurredAt: new Date("2026-09-01T12:00:00Z"),
+            })
+          }
+          const calls = await storage.aiCosts.listModelCalls({
+            ...range,
+            executionId: execution.id,
+          })
+          expect(calls.total).toBe(2)
+          expect(calls.items.map((call) => call.attribution)).toEqual([attribution, attribution])
+        }
+        const groups = await storage.aiCosts.listModelCallGroups(range)
+        expect(groups.total).toBe(3)
+        for (const attribution of expected) {
+          const group = groups.items.find((item) => item.executionId === attribution.kind)
+          expect(group).toMatchObject({
+            attribution,
+            modelCallCount: 2,
+            totalTokens: 10,
+            executions: [{ attribution, modelCallCount: 2 }],
+          })
+        }
+        const overview = await storage.aiCosts.queryProjectOverview({ ...range, bucket: "day" })
+        expect(overview.totals.modelCallCount).toBe(6)
+        expect(overview.agents).toEqual([])
+        expect(overview.workflows).toMatchObject([{ workflowId: "summarize", modelCallCount: 2 }])
+      } finally {
+        await options.cleanup?.(storage)
+      }
+    })
+
     test("attributes workflow usage to step references and keeps same-named steps separate", async () => {
       const storage = await options.createStorage()
       try {
@@ -195,7 +269,6 @@ async function seedWorkflowCall(
     workflowId,
     executionId: sourceExecutionId,
     input: {},
-    requesterGroupIds: [],
   })
   await storage.workflowRuns.start({ projectId, id: runId })
   const nodeRunId = `${runId}:node:0`
@@ -275,7 +348,6 @@ async function seed(storage: AiModelCallGroupsContractStorage) {
       threadId: "thread",
       triggerMessageId: `message_${runId}`,
       spec: { model: { provider: "parent-provider", modelId: "large" } },
-      requesterGroupIds: [],
     })
     await storage.agents.runs.start({
       id: runId,

package/src/testing/broker-contract.ts

@@ -446,6 +446,101 @@ export function runBrokerContractSuite<TBroker extends Broker>(
     })
 
     describe("subscribe", () => {
+      // Removing awaited provider delivery makes the second callback enter before release.
+      test("awaits async handlers without blocking publishers or other subscribers", async () => {
+        await withBroker(async (broker) => {
+          await broker.ensureStream({ projectId: "project-a", stream: eventsStream })
+          let release!: () => void
+          const blocked = new Promise<void>((resolve) => {
+            release = resolve
+          })
+          const received: string[] = []
+          const observer: string[] = []
+          const unsubscribe = await broker.subscribe(
+            { projectId: "project-a", streamId: eventsStream.id },
+            async (records) => {
+              received.push(...records.map((record) => String(record.payload)))
+              await blocked
+            }
+          )
+          const observe = await broker.subscribe(
+            { projectId: "project-a", streamId: eventsStream.id },
+            (records) => {
+              observer.push(...records.map((record) => String(record.payload)))
+            }
+          )
+          const wait = (predicate: () => boolean) =>
+            waitUntil(predicate, {
+              timeoutMs: subscriptionDeliveryTimeoutMs,
+              intervalMs: subscriptionPollIntervalMs,
+              message: "Async broker subscription did not progress",
+            })
+          try {
+            if (subscriptionSetupMs > 0) await Bun.sleep(subscriptionSetupMs)
+            await broker.append({
+              projectId: "project-a",
+              streamId: eventsStream.id,
+              records: [{ payload: "one" }],
+            })
+            await wait(() => received.length === 1)
+            await broker.append({
+              projectId: "project-a",
+              streamId: eventsStream.id,
+              records: [{ payload: "two" }],
+            })
+            await wait(() => observer.length === 2)
+            await Bun.sleep(30)
+            expect(received).toEqual(["one"])
+            release()
+            await wait(() => received.length === 2)
+            expect(received).toEqual(["one", "two"])
+          } finally {
+            release()
+            unsubscribe()
+            observe()
+          }
+        })
+      })
+
+      test("isolates rejected async handlers and permits appending from a handler", async () => {
+        await withBroker(async (broker) => {
+          await broker.ensureStream({ projectId: "project-a", stream: eventsStream })
+          const received: string[] = []
+          const unsubscribe = await broker.subscribe(
+            { projectId: "project-a", streamId: eventsStream.id },
+            async (records) => {
+              for (const record of records) {
+                received.push(String(record.payload))
+                if (record.payload === "one") {
+                  await broker.append({
+                    projectId: "project-a",
+                    streamId: eventsStream.id,
+                    records: [{ payload: "two" }],
+                  })
+                  throw new Error("observer failure")
+                }
+              }
+            }
+          )
+          try {
+            if (subscriptionSetupMs > 0) await Bun.sleep(subscriptionSetupMs)
+            await broker.append({
+              projectId: "project-a",
+              streamId: eventsStream.id,
+              records: [{ payload: "one" }],
+            })
+            await waitUntil(() => received.length === 2, {
+              timeoutMs: subscriptionDeliveryTimeoutMs,
+              intervalMs: subscriptionPollIntervalMs,
+              message: "Rejected async observer blocked later delivery",
+            })
+            expect(received).toEqual(["one", "two"])
+          } finally {
+            unsubscribe()
+          }
+        })
+      })
+
       test("requires streams to be ensured before subscribing", async () => {
         await withBroker(async (broker) => {
           await expect(

package/src/testing/connector-connection-storage-contract.ts

@@ -90,6 +90,22 @@ export function runConnectorConnectionStorageContractSuite<
       })
     })
 
+    test("persists explicitly non-PKCE attempts without a verifier", async () => {
+      // Removal proof: restore required code_verifier storage or omit migration 038; SQL providers fail.
+      await withStorage(async (storage) => {
+        const { codeVerifier: _verifier, ...input } = authorizationAttempt()
+        const created = await storage.createAuthorizationAttempt(input)
+        expect(created).not.toHaveProperty("codeVerifier")
+        const consumed = await storage.consumeAuthorizationAttempt(
+          authorizationAttemptConsumption()
+        )
+        expect(consumed).not.toHaveProperty("codeVerifier")
+        await expect(
+          storage.consumeAuthorizationAttempt(authorizationAttemptConsumption())
+        ).rejects.toThrow("invalid, expired, or already used")
+      })
+    })
+
     test("expires authorization attempts from the authoritative storage clock", async () => {
       await withStorage(async (storage, root) => {
         const ttlMs = 60_000
@@ -110,12 +126,13 @@ export function runConnectorConnectionStorageContractSuite<
     test("returns detached authorization attempt records", async () => {
       await withStorage(async (storage) => {
         const created = await storage.createAuthorizationAttempt(authorizationAttempt())
+        if (!created.codeVerifier) throw new Error("Expected a stored PKCE verifier.")
         Object.assign(created.codeVerifier, { ciphertext: "mutated" })
 
         const consumed = await storage.consumeAuthorizationAttempt(
           authorizationAttemptConsumption()
         )
-        expect(consumed.codeVerifier.ciphertext).toBe(credentials.ciphertext)
+        expect(consumed.codeVerifier?.ciphertext).toBe(credentials.ciphertext)
       })
     })