@substrat-run/kernel 0.114.0 → 0.117.0

package/dist/platform-sweep.d.ts

@@ -1,4 +1,4 @@
-import type { AccessLogEntry, ConnectionId, MigrationProgress, MigrationStraggler, PlatformActorId, ScopeId, TenantId, DrainedEvent } from '@substrat-run/contracts';
+import type { AccessLogEntry, ConnectionId, MigrationProgress, MigrationStraggler, PlatformActorId, Scope, ScopeId, TenantId, DrainedEvent } from '@substrat-run/contracts';
 import type { ExecutorDrainReport, FetchLike, ScopeHost, SweepRunInput } from './scope-host.js';
 /**
  * A connector's reconcile sweep — the unit `runPlatformSweep` calls per live
@@ -118,11 +118,45 @@ export interface PlatformSweepOptions {
      * What makes the phase necessary: a vertical's `onProvision` runs ONCE per scope, at
      * install. Anything the vertical mints for itself there — a service principal, a site
      * registration — therefore never reaches an install that predates it. The new code
-     * deploys, and the thing it depends on was never created. Comparing the scope's bound
-     * version against the one its provision last ran against is how the platform sees that,
-     * and this fn is how it fixes it.
+     * deploys, and the thing it depends on was never created. Comparing the version whose
+     * code RUNS on the scope (`runningVersionOf`, #1653) against the one its provision last
+     * ran against is how the platform sees that, and this fn is how it fixes it.
+     *
+     * `expected` is the version the phase will record on success — the one running on the
+     * scope. A fn whose deployment for the scope runs a DIFFERENT version (its resolver fell
+     * back from the serving script to the bound version's, say) must throw rather than
+     * resolve: the receipt would otherwise name a hook that never ran, and the scope would
+     * read as repaired while the code it runs was never provisioned for. A throw leaves it
+     * unmarked and counted `failed`, which is where it belongs.
+     *
+     * Resolves `'unsupported'` when the vertical answered that it implements no reconcile
+     * (a 501 from `/internal/reconcile`). That is neither a success nor a failure: no
+     * receipt is written, since nothing ran, and it is counted apart from `failed` so a
+     * vertical that simply lacks the route does not drown the refusals somebody must read.
+     */
+    reconcileScopeFn?: (tenantId: TenantId, scopeId: ScopeId, expected: string) => Promise<void | 'unsupported'>;
+    /**
+     * The most scopes the #1172 phase reconciles in ONE pass (#1653). Default
+     * {@link PROVISION_RECONCILE_BATCH}.
+     *
+     * A promote of a LISTED vertical puts every install of it behind at once — each one is
+     * another tenant's scope, and a popular vertical has thousands. Reconciling them all in
+     * one tick is how a cron becomes an incident, so the phase takes at most this many and
+     * the rest wait for the next pass (`deferred`). `0` reconciles nothing: the phase still
+     * counts who is behind, which makes it the pause switch.
      */
-    reconcileScopeFn?: (tenantId: TenantId, scopeId: ScopeId) => Promise<void>;
+    provisionReconcileBatch?: number;
+    /**
+     * Where the #1172 window starts, as a number in [0, 1) — `Math.random` unless given.
+     *
+     * The behind scopes are ordered by id and the pass takes a contiguous window of
+     * `provisionReconcileBatch` from a random starting point, wrapping. A FIXED start would
+     * let installs that fail on every pass hold the same slots forever and starve every
+     * healthy one behind them; a random start gives each behind scope a chance of
+     * batch/behind per pass however many of the others keep failing. Injectable so that
+     * property is tested rather than hoped for.
+     */
+    provisionReconcileRng?: () => number;
     /**
      * Also reap expired snapshots (preview-and-snapshots.md §3/§9): any FORK
      * (`forkedFrom` set) whose `expiresAt` has passed is hard-deleted via
@@ -257,6 +291,63 @@ export interface MigrationSweepReport extends MigrationProgress {
     /** Attempts where this host had nothing pending — the scope's modules run in another deployment. */
     noops: number;
 }
+/**
+ * Which family a `_substrat_schedule_state` row belongs to (#1288) — the two of
+ * `sweepRunKind`'s three names that a SCOPE can hold gating state for. (`connector`
+ * is the third and is deliberately absent: a connection is swept host-wide and its
+ * state lives nowhere in a scope.)
+ */
+export type ScheduleStateKind = 'schedule' | 'freshness';
+/**
+ * The platform sweep's per-scope gating state (#383), as both adapters build it.
+ *
+ * Shared rather than spelled twice because `lint:spine-ddl` can compare the copies
+ * only where they are DDL a `KERNEL_DDL` executes — and this table is also rebuilt
+ * by `SCHEDULE_STATE_REBUILD` below, on a store that predates the key. One
+ * definition is what keeps the rebuilt shape and the created shape the same shape;
+ * the gate then holds each adapter to including it.
+ */
+export declare const SCHEDULE_STATE_DDL = "\n  CREATE TABLE IF NOT EXISTS _substrat_schedule_state (\n    -- #1288: WHICH of the two families this row belongs to, named with the same two\n    -- words _substrat_sweep_runs already records its entries under:\n    --   * 'schedule'  -- keyed by the operation (module/verb). last_run_at and\n    --     last_status are when that operation RAN here and how it ended.\n    --   * 'freshness' -- keyed freshness:<eventType> (#1232). last_run_at and\n    --     last_status are when the evaluator last RECORDED a verdict for that event\n    --     type and what it was. Nothing ran; the row gates what the sweep records.\n    kind TEXT NOT NULL,\n    schedule_op TEXT NOT NULL,\n    last_run_at TEXT,\n    last_status TEXT,\n    -- The key LEADS with kind, and that is the point of #1288 rather than a tidy-up.\n    -- Until it did, the two families were told apart by the spelling of one column:\n    -- a freshness key could never LOOK like an operation (an event type has passed\n    -- contracts' eventType regex -- lowercase ns.verb, no colon, no slash), but the\n    -- other direction was convention only, because scheduleSpec.operation is\n    -- z.string().min(1). A module declaring a schedule literally named\n    -- \"freshness:orders.placed\" shared the evaluator's row and nothing refused it:\n    -- each write clobbered the other's verdict, and the sweep read back whichever\n    -- ran last. With kind in the key those are two rows that cannot meet.\n    PRIMARY KEY (kind, schedule_op)\n  );\n";
+/**
+ * `_substrat_schedule_state`, rebuilt with its #1288 key on a store created before
+ * it. Create-copy-drop-rename, because `kind` joins the PRIMARY KEY and SQLite
+ * cannot widen a key in place — the same shape the directory's `ensureIdentityKey`
+ * uses, and detected the same way (from `sqlite_master.sql`, which DO SQLite serves
+ * and `PRAGMA` does not, so both adapters migrate by one strategy).
+ *
+ * The new table is `SCHEDULE_STATE_DDL` under a temporary name, so the rebuilt shape
+ * cannot drift from the created one.
+ *
+ * The backfill derives `kind` from the `freshness:` prefix because that prefix IS how
+ * the two families were told apart until now: every row the evaluator ever wrote
+ * carries it, and no operation name in existence does. `substr(...) = 'freshness:'`
+ * rather than `LIKE`, which is case-insensitive over ASCII in SQLite and would file a
+ * schedule named `FRESHNESS:x` under the evaluator.
+ *
+ * Keys are copied VERBATIM, prefix included. What changes is which rows can coexist,
+ * not what any row says — so a deployment rolled back to code that looks a freshness
+ * key up under its old name still finds it.
+ *
+ * **Run these inside the adapter's transaction API**, which is what both callers do —
+ * `db.transaction` on the pure side, `ctx.storage.transactionSync` on the DO side.
+ * Un-wrapped, a stop between the CREATE and the DROP leaves the scratch table behind
+ * and the NEXT wake dies on `table _substrat_schedule_state_new already exists`, which
+ * is a scope that cannot open; a stop between the DROP and the RENAME is worse and
+ * quieter, because the next wake's `CREATE TABLE IF NOT EXISTS` puts an EMPTY table
+ * of the new shape in place, the detection below then reads it as already migrated,
+ * and every copied row stays orphaned in the scratch table. Atomically, neither state
+ * is reachable — which is why there is no recovery path here to go with them.
+ *
+ * The leading `DROP TABLE IF EXISTS` is belt to that braces, not the fix: it costs one
+ * statement and makes the rebuild idempotent against a scratch table left by anything
+ * below the transaction (a torn copy of the file, a restore that carried one).
+ */
+export declare const SCHEDULE_STATE_REBUILD: string;
+/**
+ * Whether a store's `_substrat_schedule_state` already carries the #1288 key, read
+ * off the `sql` column of `sqlite_master`. `false` means the rebuild is due.
+ */
+export declare function scheduleStateHasKind(tableSql: string): boolean;
 /**
  * What the recurring-schedule phase did in one pass (#383), summed across every
  * module's live scopes. `null` on `PlatformSweepReport` means the phase was
@@ -275,13 +366,68 @@ export interface ScheduleSweepReport {
 }
 /** What the #1172 phase did — see `reconcileScopeFn`. */
 export interface ProvisionReconcileReport {
-    /** Scopes whose bound version was ahead of their provisioned one this pass. */
+    /**
+     * Scopes whose running version differed from the one their provision last ran against
+     * this pass. Always `reconciled + failed + unsupported + deferred`.
+     */
     behind: number;
     /** Of those, the ones whose reconcile succeeded and were marked. */
     reconciled: number;
     /** Of those, the ones whose reconcile threw. They stay behind and retry next pass. */
     failed: number;
+    /**
+     * Of those, the ones whose vertical implements no reconcile (a 501). Unmarked like a
+     * failure, so they are asked again next pass; counted apart so they cannot pass for one.
+     * `scopeIds` is capped at {@link PROVISION_RECONCILE_REPORTED_IDS}; `count` is exact.
+     */
+    unsupported: {
+        count: number;
+        scopeIds: string[];
+    };
+    /** Of those, the ones past this pass's `provisionReconcileBatch`. Next pass's work. */
+    deferred: number;
+}
+/** The #1172 phase's per-pass bound when `provisionReconcileBatch` is unset (#1653). */
+export declare const PROVISION_RECONCILE_BATCH = 50;
+/** How many `unsupported` scope ids one report carries — the count stays exact. */
+export declare const PROVISION_RECONCILE_REPORTED_IDS = 50;
+/**
+ * A scope the platform may treat as the REAL install, rather than a copy of one (#1172,
+ * #1653). The directory is the only oracle for this, and it takes BOTH tests, not one.
+ *
+ * A fork is an archive or a preview of somebody else's data, and re-provisioning one
+ * runs the vertical's install-side hook against a copy, minting a second set of whatever
+ * it mints — or, since #1656, putting a copy of production on a sweeper that reaps and
+ * assigns. But a CLEAN-ROOM preview (#509) is an empty scope with no source to copy, so
+ * it carries `kind: 'preview'` and NO `forkedFrom` — the reap sweep keys on `kind` for
+ * exactly that reason. Filtering on lineage alone would let those through, which is the
+ * one shape of scope where the hook's effects are least wanted.
+ */
+export declare function isPrimaryScope(scope: Pick<Scope, 'forkedFrom' | 'kind'>): boolean;
+/** What a vertical's stable serving script runs (#286) — `Vertical.servingRef`/`servingVersionId`. */
+export interface ServingPointer {
+    ref: string;
+    versionId: string;
 }
+/**
+ * The version whose code actually executes for `scope` (#1653) — which is not always the
+ * one it is bound to.
+ *
+ * A scope on its vertical's stable serving script (`servingRef`, #286) runs whatever that
+ * script serves, and a promote re-uploads the script in place: the code changes under
+ * the scope at that moment, whatever its version pointer says. For a PRIVATE vertical
+ * the promote moves the pointer too, so the two agree. For a LISTED one it does not —
+ * the pointer is the tenant's, and moves only on their Update — so an install can run
+ * version N+1 with its provision state still at N. Measuring against the running version
+ * is what lets the reconcile follow the code instead of the pointer.
+ *
+ * Falls back to the bound version whenever the serving script cannot be named: a scope
+ * with no `servingRef` (legacy per-version dispatch, where the bound version's own
+ * script IS what runs), a vertical with nothing served in place yet, or a `servingRef`
+ * that is not the vertical's current one. The fallback is exactly the pre-#1653 answer,
+ * so an unknown never manufactures a reconcile.
+ */
+export declare function runningVersionOf(scope: Pick<Scope, 'verticalVersionId' | 'servingRef'>, serving: ServingPointer | null | undefined): string | null;
 export interface PlatformSweepReport {
     /** Active scopes `drainDue` ran on. */
     scopesDrained: number;
@@ -300,8 +446,9 @@ export interface PlatformSweepReport {
     /** Platform-intent drain outcomes summed across scopes (platform-intents.md). */
     platformRequestTotals: PlatformRequestDrainTotals;
     /**
-     * Scopes whose provision was re-run because their bound version had moved past the one
-     * it last ran against (#1172), or null when no `reconcileScopeFn` was supplied.
+     * Scopes whose provision was re-run because the version running on them had moved past
+     * the one it last ran against (#1172, #1653), or null when no `reconcileScopeFn` was
+     * supplied.
      *
      * Null and `{ reconciled: 0 }` are different facts, as everywhere else in this report:
      * the first is "nobody looked".
@@ -349,6 +496,31 @@ export interface EventDrainReport {
      * it. Reported rather than looped, so one busy scope cannot starve the pass.
      */
     incomplete: number;
+    /**
+     * Undrained rows a scope's read stepped over because they would not decode (#1636), plus
+     * any event this sweep refused itself because the published `drainedEvent` schema did not
+     * accept it (#1641 — what an older vertical, which does not validate, can still send),
+     * one entry per scope that had any — ABSENT when no scope did.
+     *
+     * These rows are never shipped and never stamped: the lake is append-only, so a row
+     * built from stand-ins could not be taken back, and the stamp is the only record of
+     * what left. So they are missing from the lake for as long as they stay undecodable,
+     * and every pass reads them again and reports them again. The event is still in
+     * Tier 1, where `readHistory` returns it with a `decodeError`.
+     *
+     * Not an `errors` entry: nothing about this pass failed, and the failure digest mails
+     * every error — a standing condition would be re-sent on every tick.
+     */
+    skipped?: EventDrainSkipped[];
+}
+/** One scope's share of `EventDrainReport.skipped`. */
+export interface EventDrainSkipped {
+    tenantId: TenantId;
+    scopeId: ScopeId;
+    /** Exact. */
+    count: number;
+    /** The first of them, oldest first; capped (`UNDRAINED_SKIPPED_IDS`), so `count` may be larger. */
+    eventIds: string[];
 }
 export interface AccessLogSweepReport {
     /** Rows handed to the sink and confirmed durable. */

package/dist/platform-sweep.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"platform-sweep.d.ts","sourceRoot":"","sources":["../src/platform-sweep.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EACV,cAAc,EACd,YAAY,EACZ,iBAAiB,EACjB,kBAAkB,EAClB,eAAe,EAEf,OAAO,EACP,QAAQ,EACR,YAAY,EACb,MAAM,yBAAyB,CAAC;AACjC,OAAO,KAAK,EAAE,mBAAmB,EAAE,SAAS,EAAE,SAAS,EAAE,aAAa,EAAE,MAAM,iBAAiB,CAAC;AAUhG;;;;;;;GAOG;AACH,MAAM,WAAW,gBAAgB;IAC/B,CAAC,IAAI,EAAE,SAAS,EAAE,YAAY,EAAE,YAAY,EAAE,IAAI,EAAE;QAAE,KAAK,EAAE,SAAS,CAAA;KAAE,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;CAC7F;AAED;;;;;;;;;;;;;;GAcG;AACH,MAAM,WAAW,aAAa;IAC5B;;;;OAIG;IACH,IAAI,CAAC,OAAO,EAAE,cAAc,EAAE,GAAG,OAAO,CAAC;QAAE,GAAG,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;CAC3D;AAED;;;;;;;;;;;;;;;;;;;GAmBG;AACH,MAAM,WAAW,SAAS;IACxB;;;;OAIG;IACH,IAAI,CAAC,KAAK,EAAE;QAAE,QAAQ,EAAE,QAAQ,CAAC;QAAC,OAAO,EAAE,OAAO,CAAA;KAAE,EAAE,MAAM,EAAE,YAAY,EAAE,GAAG,OAAO,CAAC;QAAE,GAAG,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;CACzG;AAQD,MAAM,WAAW,oBAAoB;IACnC;;;;;;;OAOG;IACH,cAAc,CAAC,EAAE,CAAC,KAAK,EAAE,aAAa,KAAK,IAAI,CAAC;IAChD,wFAAwF;IACxF,KAAK,EAAE,eAAe,CAAC;IACvB,0DAA0D;IAC1D,KAAK,EAAE,SAAS,CAAC;IACjB,+FAA+F;IAC/F,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,gBAAgB,CAAC,CAAC;IAC3C,yEAAyE;IACzE,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB;;;;OAIG;IACH,YAAY,CAAC,EAAE,OAAO,CAAC;IACvB;;;;;;OAMG;IACH,uBAAuB,CAAC,EAAE,CACxB,QAAQ,EAAE,QAAQ,EAClB,OAAO,EAAE,OAAO,KACb,OAAO,CAAC;QAAE,OAAO,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IACjF;;;;;;;;;;;;;OAaG;IACH,gBAAgB,CAAC,EAAE,CAAC,QAAQ,EAAE,QAAQ,EAAE,OAAO,EAAE,OAAO,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IAC3E;;;;;;OAMG;IACH,WAAW,CAAC,EAAE,OAAO,CAAC;IACtB;;;;;;OAMG;IACH,gBAAgB,CAAC,EAAE,CAAC,QAAQ,EAAE,QAAQ,EAAE,OAAO,EAAE,OAAO,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IAC3E;;;;;;;;;OASG;IACH,qBAAqB,CAAC,EAAE,MAAM,CAAC;IAC/B;;;;;;OAMG;IACH,WAAW,CAAC,EAAE,CAAC,QAAQ,EAAE,QAAQ,EAAE,OAAO,EAAE,OAAO,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IACtE;;;;;;;;;;OAUG;IACH,aAAa,CAAC,EAAE,aAAa,CAAC;IAC9B;;;;OAIG;IACH,SAAS,CAAC,EAAE,SAAS,CAAC;IACtB,sDAAsD;IACtD,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,uDAAuD;IACvD,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB;;;;;;;;OAQG;IACH,qBAAqB,CAAC,EAAE,MAAM,CAAC;IAC/B;;;;;;;;OAQG;IACH,YAAY,CAAC,EAAE,CAAC,QAAQ,EAAE,QAAQ,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IACrD;;;;;;OAMG;IACH,mBAAmB,CAAC,EAAE,OAAO,CAAC;IAC9B;;;;;;OAMG;IACH,YAAY,CAAC,EAAE,OAAO,CAAC;IACvB;;;;;;;;;OASG;IACH,gBAAgB,CAAC,EAAE;QAAE,WAAW,CAAC,EAAE,MAAM,CAAC;QAAC,UAAU,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;IACjE,uEAAuE;IACvE,sBAAsB,CAAC,EAAE,MAAM,CAAC;IAChC;;;;;;;OAOG;IACH,mBAAmB,CAAC,EAAE,CAAC,OAAO,EAAE,kBAAkB,EAAE,KAAK,IAAI,CAAC;CAC/D;AAED;;;;GAIG;AACH,MAAM,WAAW,oBAAqB,SAAQ,iBAAiB;IAC7D,sEAAsE;IACtE,SAAS,EAAE,MAAM,CAAC;IAClB,oDAAoD;IACpD,QAAQ,EAAE,MAAM,CAAC;IACjB,8EAA8E;IAC9E,QAAQ,EAAE,MAAM,CAAC;IACjB,oGAAoG;IACpG,KAAK,EAAE,MAAM,CAAC;CACf;AAED;;;;;GAKG;AACH,MAAM,WAAW,mBAAmB;IAClC,kEAAkE;IAClE,MAAM,EAAE,MAAM,CAAC;IACf,sDAAsD;IACtD,KAAK,EAAE,MAAM,CAAC;IACd,uEAAuE;IACvE,OAAO,EAAE,MAAM,CAAC;IAChB,qEAAqE;IACrE,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,yDAAyD;AACzD,MAAM,WAAW,wBAAwB;IACvC,+EAA+E;IAC/E,MAAM,EAAE,MAAM,CAAC;IACf,oEAAoE;IACpE,UAAU,EAAE,MAAM,CAAC;IACnB,sFAAsF;IACtF,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,mBAAmB;IAClC,uCAAuC;IACvC,aAAa,EAAE,MAAM,CAAC;IACtB,2CAA2C;IAC3C,WAAW,EAAE,mBAAmB,CAAC;IACjC,qCAAqC;IACrC,gBAAgB,EAAE,MAAM,CAAC;IACzB,kFAAkF;IAClF,kBAAkB,EAAE,MAAM,CAAC;IAC3B,0DAA0D;IAC1D,eAAe,EAAE,MAAM,CAAC;IACxB,2EAA2E;IAC3E,oBAAoB,EAAE,MAAM,CAAC;IAC7B,+DAA+D;IAC/D,aAAa,EAAE,MAAM,CAAC;IACtB,iFAAiF;IACjF,qBAAqB,EAAE,0BAA0B,CAAC;IAClD;;;;;;OAMG;IACH,kBAAkB,EAAE,wBAAwB,GAAG,IAAI,CAAC;IACpD;;;;;;OAMG;IACH,UAAU,EAAE,oBAAoB,GAAG,IAAI,CAAC;IACxC;;;;;OAKG;IACH,SAAS,EAAE,mBAAmB,GAAG,IAAI,CAAC;IACtC;;;;OAIG;IACH,SAAS,EAAE,oBAAoB,GAAG,IAAI,CAAC;IACvC,kFAAkF;IAClF,UAAU,EAAE,gBAAgB,GAAG,IAAI,CAAC;IACpC,oFAAoF;IACpF,MAAM,EAAE;QACN,IAAI,EACA,OAAO,GACP,OAAO,GACP,IAAI,GACJ,MAAM,GACN,aAAa,GACb,SAAS,GACT,kBAAkB,GAClB,qBAAqB,GACrB,UAAU,GACV,WAAW,GACX,YAAY,GAEZ,aAAa,CAAC;QAClB,EAAE,EAAE,MAAM,CAAC;QACX,KAAK,EAAE,MAAM,CAAC;KACf,EAAE,CAAC;CACL;AAED,sEAAsE;AACtE,4DAA4D;AAC5D,MAAM,WAAW,gBAAgB;IAC/B,qEAAqE;IACrE,MAAM,EAAE,MAAM,CAAC;IACf,uDAAuD;IACvD,OAAO,EAAE,MAAM,CAAC;IAChB;;;OAGG;IACH,UAAU,EAAE,MAAM,CAAC;CACpB;AAED,MAAM,WAAW,oBAAoB;IACnC,qDAAqD;IACrD,OAAO,EAAE,MAAM,CAAC;IAChB,8EAA8E;IAC9E,MAAM,EAAE,MAAM,CAAC;IACf,yDAAyD;IACzD,MAAM,EAAE,MAAM,CAAC;IACf,kFAAkF;IAClF,GAAG,EAAE,MAAM,GAAG,IAAI,CAAC;CACpB;AAED,sEAAsE;AACtE,MAAM,WAAW,0BAA0B;IACzC,0DAA0D;IAC1D,MAAM,EAAE,MAAM,CAAC;IACf,sCAAsC;IACtC,OAAO,EAAE,MAAM,CAAC;IAChB,6BAA6B;IAC7B,IAAI,EAAE,MAAM,CAAC;IACb,mEAAmE;IACnE,MAAM,EAAE,MAAM,CAAC;IACf,0DAA0D;IAC1D,OAAO,EAAE,MAAM,CAAC;CACjB;AAsBD;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAsB,gBAAgB,CACpC,IAAI,EAAE,SAAS,EACf,OAAO,EAAE,oBAAoB,GAC5B,OAAO,CAAC,mBAAmB,CAAC,CAmgB9B;AA4FD,wFAAwF;AACxF,MAAM,WAAW,qBAAqB;IACpC,IAAI,IAAI,IAAI,CAAC;CACd;AAED,MAAM,WAAW,2BAA4B,SAAQ,oBAAoB;IACvE;;;;OAIG;IACH,UAAU,EAAE,MAAM,CAAC;IACnB,sFAAsF;IACtF,MAAM,CAAC,EAAE,CAAC,OAAO,EAAE,mBAAmB,GAAG;QAAE,KAAK,EAAE,MAAM,CAAA;KAAE,KAAK,IAAI,CAAC;IACpE,0DAA0D;IAC1D,QAAQ,CAAC,EAAE,CAAC,EAAE,EAAE,MAAM,IAAI,EAAE,EAAE,EAAE,MAAM,KAAK,OAAO,CAAC;IACnD,UAAU,CAAC,EAAE,CAAC,MAAM,EAAE,OAAO,KAAK,IAAI,CAAC;CACxC;AAED;;;;;;;GAOG;AACH,wBAAgB,oBAAoB,CAClC,IAAI,EAAE,SAAS,EACf,OAAO,EAAE,2BAA2B,GACnC,qBAAqB,CAuBvB"}
+{"version":3,"file":"platform-sweep.d.ts","sourceRoot":"","sources":["../src/platform-sweep.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EACV,cAAc,EACd,YAAY,EACZ,iBAAiB,EACjB,kBAAkB,EAClB,eAAe,EACf,KAAK,EACL,OAAO,EACP,QAAQ,EACR,YAAY,EACb,MAAM,yBAAyB,CAAC;AACjC,OAAO,KAAK,EAAE,mBAAmB,EAAE,SAAS,EAAE,SAAS,EAAE,aAAa,EAAE,MAAM,iBAAiB,CAAC;AAWhG;;;;;;;GAOG;AACH,MAAM,WAAW,gBAAgB;IAC/B,CAAC,IAAI,EAAE,SAAS,EAAE,YAAY,EAAE,YAAY,EAAE,IAAI,EAAE;QAAE,KAAK,EAAE,SAAS,CAAA;KAAE,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;CAC7F;AAED;;;;;;;;;;;;;;GAcG;AACH,MAAM,WAAW,aAAa;IAC5B;;;;OAIG;IACH,IAAI,CAAC,OAAO,EAAE,cAAc,EAAE,GAAG,OAAO,CAAC;QAAE,GAAG,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;CAC3D;AAED;;;;;;;;;;;;;;;;;;;GAmBG;AACH,MAAM,WAAW,SAAS;IACxB;;;;OAIG;IACH,IAAI,CAAC,KAAK,EAAE;QAAE,QAAQ,EAAE,QAAQ,CAAC;QAAC,OAAO,EAAE,OAAO,CAAA;KAAE,EAAE,MAAM,EAAE,YAAY,EAAE,GAAG,OAAO,CAAC;QAAE,GAAG,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;CACzG;AAQD,MAAM,WAAW,oBAAoB;IACnC;;;;;;;OAOG;IACH,cAAc,CAAC,EAAE,CAAC,KAAK,EAAE,aAAa,KAAK,IAAI,CAAC;IAChD,wFAAwF;IACxF,KAAK,EAAE,eAAe,CAAC;IACvB,0DAA0D;IAC1D,KAAK,EAAE,SAAS,CAAC;IACjB,+FAA+F;IAC/F,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,gBAAgB,CAAC,CAAC;IAC3C,yEAAyE;IACzE,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB;;;;OAIG;IACH,YAAY,CAAC,EAAE,OAAO,CAAC;IACvB;;;;;;OAMG;IACH,uBAAuB,CAAC,EAAE,CACxB,QAAQ,EAAE,QAAQ,EAClB,OAAO,EAAE,OAAO,KACb,OAAO,CAAC;QAAE,OAAO,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IACjF;;;;;;;;;;;;;;;;;;;;;;;;;OAyBG;IACH,gBAAgB,CAAC,EAAE,CAAC,QAAQ,EAAE,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,GAAG,aAAa,CAAC,CAAC;IAC7G;;;;;;;;;OASG;IACH,uBAAuB,CAAC,EAAE,MAAM,CAAC;IACjC;;;;;;;;;OASG;IACH,qBAAqB,CAAC,EAAE,MAAM,MAAM,CAAC;IACrC;;;;;;OAMG;IACH,WAAW,CAAC,EAAE,OAAO,CAAC;IACtB;;;;;;OAMG;IACH,gBAAgB,CAAC,EAAE,CAAC,QAAQ,EAAE,QAAQ,EAAE,OAAO,EAAE,OAAO,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IAC3E;;;;;;;;;OASG;IACH,qBAAqB,CAAC,EAAE,MAAM,CAAC;IAC/B;;;;;;OAMG;IACH,WAAW,CAAC,EAAE,CAAC,QAAQ,EAAE,QAAQ,EAAE,OAAO,EAAE,OAAO,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IACtE;;;;;;;;;;OAUG;IACH,aAAa,CAAC,EAAE,aAAa,CAAC;IAC9B;;;;OAIG;IACH,SAAS,CAAC,EAAE,SAAS,CAAC;IACtB,sDAAsD;IACtD,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,uDAAuD;IACvD,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB;;;;;;;;OAQG;IACH,qBAAqB,CAAC,EAAE,MAAM,CAAC;IAC/B;;;;;;;;OAQG;IACH,YAAY,CAAC,EAAE,CAAC,QAAQ,EAAE,QAAQ,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IACrD;;;;;;OAMG;IACH,mBAAmB,CAAC,EAAE,OAAO,CAAC;IAC9B;;;;;;OAMG;IACH,YAAY,CAAC,EAAE,OAAO,CAAC;IACvB;;;;;;;;;OASG;IACH,gBAAgB,CAAC,EAAE;QAAE,WAAW,CAAC,EAAE,MAAM,CAAC;QAAC,UAAU,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;IACjE,uEAAuE;IACvE,sBAAsB,CAAC,EAAE,MAAM,CAAC;IAChC;;;;;;;OAOG;IACH,mBAAmB,CAAC,EAAE,CAAC,OAAO,EAAE,kBAAkB,EAAE,KAAK,IAAI,CAAC;CAC/D;AAED;;;;GAIG;AACH,MAAM,WAAW,oBAAqB,SAAQ,iBAAiB;IAC7D,sEAAsE;IACtE,SAAS,EAAE,MAAM,CAAC;IAClB,oDAAoD;IACpD,QAAQ,EAAE,MAAM,CAAC;IACjB,8EAA8E;IAC9E,QAAQ,EAAE,MAAM,CAAC;IACjB,oGAAoG;IACpG,KAAK,EAAE,MAAM,CAAC;CACf;AAED;;;;;GAKG;AACH,MAAM,MAAM,iBAAiB,GAAG,UAAU,GAAG,WAAW,CAAC;AAEzD;;;;;;;;GAQG;AACH,eAAO,MAAM,kBAAkB,4+CAwB9B,CAAC;AAEF;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiCG;AACH,eAAO,MAAM,sBAAsB,QAYlC,CAAC;AAEF;;;GAGG;AACH,wBAAgB,oBAAoB,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAE9D;AAED;;;;;GAKG;AACH,MAAM,WAAW,mBAAmB;IAClC,kEAAkE;IAClE,MAAM,EAAE,MAAM,CAAC;IACf,sDAAsD;IACtD,KAAK,EAAE,MAAM,CAAC;IACd,uEAAuE;IACvE,OAAO,EAAE,MAAM,CAAC;IAChB,qEAAqE;IACrE,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,yDAAyD;AACzD,MAAM,WAAW,wBAAwB;IACvC;;;OAGG;IACH,MAAM,EAAE,MAAM,CAAC;IACf,oEAAoE;IACpE,UAAU,EAAE,MAAM,CAAC;IACnB,sFAAsF;IACtF,MAAM,EAAE,MAAM,CAAC;IACf;;;;OAIG;IACH,WAAW,EAAE;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,EAAE,CAAA;KAAE,CAAC;IACnD,uFAAuF;IACvF,QAAQ,EAAE,MAAM,CAAC;CAClB;AAED,wFAAwF;AACxF,eAAO,MAAM,yBAAyB,KAAK,CAAC;AAE5C,mFAAmF;AACnF,eAAO,MAAM,gCAAgC,KAAK,CAAC;AAEnD;;;;;;;;;;;GAWG;AACH,wBAAgB,cAAc,CAAC,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,YAAY,GAAG,MAAM,CAAC,GAAG,OAAO,CAEjF;AAED,sGAAsG;AACtG,MAAM,WAAW,cAAc;IAC7B,GAAG,EAAE,MAAM,CAAC;IACZ,SAAS,EAAE,MAAM,CAAC;CACnB;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAgB,gBAAgB,CAC9B,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,mBAAmB,GAAG,YAAY,CAAC,EACtD,OAAO,EAAE,cAAc,GAAG,IAAI,GAAG,SAAS,GACzC,MAAM,GAAG,IAAI,CAGf;AAeD,MAAM,WAAW,mBAAmB;IAClC,uCAAuC;IACvC,aAAa,EAAE,MAAM,CAAC;IACtB,2CAA2C;IAC3C,WAAW,EAAE,mBAAmB,CAAC;IACjC,qCAAqC;IACrC,gBAAgB,EAAE,MAAM,CAAC;IACzB,kFAAkF;IAClF,kBAAkB,EAAE,MAAM,CAAC;IAC3B,0DAA0D;IAC1D,eAAe,EAAE,MAAM,CAAC;IACxB,2EAA2E;IAC3E,oBAAoB,EAAE,MAAM,CAAC;IAC7B,+DAA+D;IAC/D,aAAa,EAAE,MAAM,CAAC;IACtB,iFAAiF;IACjF,qBAAqB,EAAE,0BAA0B,CAAC;IAClD;;;;;;;OAOG;IACH,kBAAkB,EAAE,wBAAwB,GAAG,IAAI,CAAC;IACpD;;;;;;OAMG;IACH,UAAU,EAAE,oBAAoB,GAAG,IAAI,CAAC;IACxC;;;;;OAKG;IACH,SAAS,EAAE,mBAAmB,GAAG,IAAI,CAAC;IACtC;;;;OAIG;IACH,SAAS,EAAE,oBAAoB,GAAG,IAAI,CAAC;IACvC,kFAAkF;IAClF,UAAU,EAAE,gBAAgB,GAAG,IAAI,CAAC;IACpC,oFAAoF;IACpF,MAAM,EAAE;QACN,IAAI,EACA,OAAO,GACP,OAAO,GACP,IAAI,GACJ,MAAM,GACN,aAAa,GACb,SAAS,GACT,kBAAkB,GAClB,qBAAqB,GACrB,UAAU,GACV,WAAW,GACX,YAAY,GAEZ,aAAa,CAAC;QAClB,EAAE,EAAE,MAAM,CAAC;QACX,KAAK,EAAE,MAAM,CAAC;KACf,EAAE,CAAC;CACL;AAED,sEAAsE;AACtE,4DAA4D;AAC5D,MAAM,WAAW,gBAAgB;IAC/B,qEAAqE;IACrE,MAAM,EAAE,MAAM,CAAC;IACf,uDAAuD;IACvD,OAAO,EAAE,MAAM,CAAC;IAChB;;;OAGG;IACH,UAAU,EAAE,MAAM,CAAC;IACnB;;;;;;;;;;;;;;OAcG;IACH,OAAO,CAAC,EAAE,iBAAiB,EAAE,CAAC;CAC/B;AAED,uDAAuD;AACvD,MAAM,WAAW,iBAAiB;IAChC,QAAQ,EAAE,QAAQ,CAAC;IACnB,OAAO,EAAE,OAAO,CAAC;IACjB,aAAa;IACb,KAAK,EAAE,MAAM,CAAC;IACd,mGAAmG;IACnG,QAAQ,EAAE,MAAM,EAAE,CAAC;CACpB;AAED,MAAM,WAAW,oBAAoB;IACnC,qDAAqD;IACrD,OAAO,EAAE,MAAM,CAAC;IAChB,8EAA8E;IAC9E,MAAM,EAAE,MAAM,CAAC;IACf,yDAAyD;IACzD,MAAM,EAAE,MAAM,CAAC;IACf,kFAAkF;IAClF,GAAG,EAAE,MAAM,GAAG,IAAI,CAAC;CACpB;AAED,sEAAsE;AACtE,MAAM,WAAW,0BAA0B;IACzC,0DAA0D;IAC1D,MAAM,EAAE,MAAM,CAAC;IACf,sCAAsC;IACtC,OAAO,EAAE,MAAM,CAAC;IAChB,6BAA6B;IAC7B,IAAI,EAAE,MAAM,CAAC;IACb,mEAAmE;IACnE,MAAM,EAAE,MAAM,CAAC;IACf,0DAA0D;IAC1D,OAAO,EAAE,MAAM,CAAC;CACjB;AAsBD;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAsB,gBAAgB,CACpC,IAAI,EAAE,SAAS,EACf,OAAO,EAAE,oBAAoB,GAC5B,OAAO,CAAC,mBAAmB,CAAC,CAmiB9B;AA8HD,wFAAwF;AACxF,MAAM,WAAW,qBAAqB;IACpC,IAAI,IAAI,IAAI,CAAC;CACd;AAED,MAAM,WAAW,2BAA4B,SAAQ,oBAAoB;IACvE;;;;OAIG;IACH,UAAU,EAAE,MAAM,CAAC;IACnB,sFAAsF;IACtF,MAAM,CAAC,EAAE,CAAC,OAAO,EAAE,mBAAmB,GAAG;QAAE,KAAK,EAAE,MAAM,CAAA;KAAE,KAAK,IAAI,CAAC;IACpE,0DAA0D;IAC1D,QAAQ,CAAC,EAAE,CAAC,EAAE,EAAE,MAAM,IAAI,EAAE,EAAE,EAAE,MAAM,KAAK,OAAO,CAAC;IACnD,UAAU,CAAC,EAAE,CAAC,MAAM,EAAE,OAAO,KAAK,IAAI,CAAC;CACxC;AAED;;;;;;;GAOG;AACH,wBAAgB,oBAAoB,CAClC,IAAI,EAAE,SAAS,EACf,OAAO,EAAE,2BAA2B,GACnC,qBAAqB,CAuBvB"}

package/dist/platform-sweep.js

@@ -1,10 +1,152 @@
-import { instant } from '@substrat-run/contracts';
+import { drainedEvent, instant } from '@substrat-run/contracts';
 import { backoffAt } from './scope-host.js';
 import { MIGRATION_FLAG_THRESHOLD, migrationFleet, migrationProgress, scopeMigrationState } from './migration-progress.js';
+import { UNDRAINED_SKIPPED_IDS } from './outbox-event.js';
 /** How many access rows one pass ships, and one pass prunes, by default. */
 const ACCESS_LOG_BATCH = 500;
 /** How many events one pass drains PER SCOPE by default. */
 const EVENT_DRAIN_BATCH = 200;
+/**
+ * The platform sweep's per-scope gating state (#383), as both adapters build it.
+ *
+ * Shared rather than spelled twice because `lint:spine-ddl` can compare the copies
+ * only where they are DDL a `KERNEL_DDL` executes — and this table is also rebuilt
+ * by `SCHEDULE_STATE_REBUILD` below, on a store that predates the key. One
+ * definition is what keeps the rebuilt shape and the created shape the same shape;
+ * the gate then holds each adapter to including it.
+ */
+export const SCHEDULE_STATE_DDL = `
+  CREATE TABLE IF NOT EXISTS _substrat_schedule_state (
+    -- #1288: WHICH of the two families this row belongs to, named with the same two
+    -- words _substrat_sweep_runs already records its entries under:
+    --   * 'schedule'  -- keyed by the operation (module/verb). last_run_at and
+    --     last_status are when that operation RAN here and how it ended.
+    --   * 'freshness' -- keyed freshness:<eventType> (#1232). last_run_at and
+    --     last_status are when the evaluator last RECORDED a verdict for that event
+    --     type and what it was. Nothing ran; the row gates what the sweep records.
+    kind TEXT NOT NULL,
+    schedule_op TEXT NOT NULL,
+    last_run_at TEXT,
+    last_status TEXT,
+    -- The key LEADS with kind, and that is the point of #1288 rather than a tidy-up.
+    -- Until it did, the two families were told apart by the spelling of one column:
+    -- a freshness key could never LOOK like an operation (an event type has passed
+    -- contracts' eventType regex -- lowercase ns.verb, no colon, no slash), but the
+    -- other direction was convention only, because scheduleSpec.operation is
+    -- z.string().min(1). A module declaring a schedule literally named
+    -- "freshness:orders.placed" shared the evaluator's row and nothing refused it:
+    -- each write clobbered the other's verdict, and the sweep read back whichever
+    -- ran last. With kind in the key those are two rows that cannot meet.
+    PRIMARY KEY (kind, schedule_op)
+  );
+`;
+/**
+ * `_substrat_schedule_state`, rebuilt with its #1288 key on a store created before
+ * it. Create-copy-drop-rename, because `kind` joins the PRIMARY KEY and SQLite
+ * cannot widen a key in place — the same shape the directory's `ensureIdentityKey`
+ * uses, and detected the same way (from `sqlite_master.sql`, which DO SQLite serves
+ * and `PRAGMA` does not, so both adapters migrate by one strategy).
+ *
+ * The new table is `SCHEDULE_STATE_DDL` under a temporary name, so the rebuilt shape
+ * cannot drift from the created one.
+ *
+ * The backfill derives `kind` from the `freshness:` prefix because that prefix IS how
+ * the two families were told apart until now: every row the evaluator ever wrote
+ * carries it, and no operation name in existence does. `substr(...) = 'freshness:'`
+ * rather than `LIKE`, which is case-insensitive over ASCII in SQLite and would file a
+ * schedule named `FRESHNESS:x` under the evaluator.
+ *
+ * Keys are copied VERBATIM, prefix included. What changes is which rows can coexist,
+ * not what any row says — so a deployment rolled back to code that looks a freshness
+ * key up under its old name still finds it.
+ *
+ * **Run these inside the adapter's transaction API**, which is what both callers do —
+ * `db.transaction` on the pure side, `ctx.storage.transactionSync` on the DO side.
+ * Un-wrapped, a stop between the CREATE and the DROP leaves the scratch table behind
+ * and the NEXT wake dies on `table _substrat_schedule_state_new already exists`, which
+ * is a scope that cannot open; a stop between the DROP and the RENAME is worse and
+ * quieter, because the next wake's `CREATE TABLE IF NOT EXISTS` puts an EMPTY table
+ * of the new shape in place, the detection below then reads it as already migrated,
+ * and every copied row stays orphaned in the scratch table. Atomically, neither state
+ * is reachable — which is why there is no recovery path here to go with them.
+ *
+ * The leading `DROP TABLE IF EXISTS` is belt to that braces, not the fix: it costs one
+ * statement and makes the rebuild idempotent against a scratch table left by anything
+ * below the transaction (a torn copy of the file, a restore that carried one).
+ */
+export const SCHEDULE_STATE_REBUILD = `
+  DROP TABLE IF EXISTS _substrat_schedule_state_new;
+  ${SCHEDULE_STATE_DDL.replace('CREATE TABLE IF NOT EXISTS _substrat_schedule_state', 'CREATE TABLE _substrat_schedule_state_new')}
+  INSERT INTO _substrat_schedule_state_new (kind, schedule_op, last_run_at, last_status)
+    SELECT CASE WHEN substr(schedule_op, 1, 10) = 'freshness:' THEN 'freshness' ELSE 'schedule' END,
+           schedule_op, last_run_at, last_status
+      FROM _substrat_schedule_state;
+  DROP TABLE _substrat_schedule_state;
+  ALTER TABLE _substrat_schedule_state_new RENAME TO _substrat_schedule_state;
+`;
+/**
+ * Whether a store's `_substrat_schedule_state` already carries the #1288 key, read
+ * off the `sql` column of `sqlite_master`. `false` means the rebuild is due.
+ */
+export function scheduleStateHasKind(tableSql) {
+    return tableSql.includes('PRIMARY KEY (kind, schedule_op)');
+}
+/** The #1172 phase's per-pass bound when `provisionReconcileBatch` is unset (#1653). */
+export const PROVISION_RECONCILE_BATCH = 50;
+/** How many `unsupported` scope ids one report carries — the count stays exact. */
+export const PROVISION_RECONCILE_REPORTED_IDS = 50;
+/**
+ * A scope the platform may treat as the REAL install, rather than a copy of one (#1172,
+ * #1653). The directory is the only oracle for this, and it takes BOTH tests, not one.
+ *
+ * A fork is an archive or a preview of somebody else's data, and re-provisioning one
+ * runs the vertical's install-side hook against a copy, minting a second set of whatever
+ * it mints — or, since #1656, putting a copy of production on a sweeper that reaps and
+ * assigns. But a CLEAN-ROOM preview (#509) is an empty scope with no source to copy, so
+ * it carries `kind: 'preview'` and NO `forkedFrom` — the reap sweep keys on `kind` for
+ * exactly that reason. Filtering on lineage alone would let those through, which is the
+ * one shape of scope where the hook's effects are least wanted.
+ */
+export function isPrimaryScope(scope) {
+    return !scope.forkedFrom && scope.kind !== 'preview';
+}
+/**
+ * The version whose code actually executes for `scope` (#1653) — which is not always the
+ * one it is bound to.
+ *
+ * A scope on its vertical's stable serving script (`servingRef`, #286) runs whatever that
+ * script serves, and a promote re-uploads the script in place: the code changes under
+ * the scope at that moment, whatever its version pointer says. For a PRIVATE vertical
+ * the promote moves the pointer too, so the two agree. For a LISTED one it does not —
+ * the pointer is the tenant's, and moves only on their Update — so an install can run
+ * version N+1 with its provision state still at N. Measuring against the running version
+ * is what lets the reconcile follow the code instead of the pointer.
+ *
+ * Falls back to the bound version whenever the serving script cannot be named: a scope
+ * with no `servingRef` (legacy per-version dispatch, where the bound version's own
+ * script IS what runs), a vertical with nothing served in place yet, or a `servingRef`
+ * that is not the vertical's current one. The fallback is exactly the pre-#1653 answer,
+ * so an unknown never manufactures a reconcile.
+ */
+export function runningVersionOf(scope, serving) {
+    if (scope.servingRef && serving && scope.servingRef === serving.ref)
+        return serving.versionId;
+    return scope.verticalVersionId;
+}
+/**
+ * This pass's share of the behind scopes: at most `batch`, as a contiguous window over
+ * the id order, starting at `rng()` of the way round and wrapping. Deterministic for a
+ * given `rng`, which is what makes the fairness claim testable.
+ */
+function reconcileWindow(behind, batch, rng) {
+    if (behind.length <= batch)
+        return [...behind];
+    if (batch <= 0)
+        return [];
+    const ordered = [...behind].sort((a, b) => (a.id < b.id ? -1 : a.id > b.id ? 1 : 0));
+    const start = Math.min(ordered.length - 1, Math.max(0, Math.floor(rng() * ordered.length)));
+    return Array.from({ length: batch }, (_, i) => ordered[(start + i) % ordered.length]);
+}
 const message = (err) => (err instanceof Error ? err.message : String(err));
 /**
  * Run `fn` over `items` with at most `limit` in flight. `fn` owns its errors —
@@ -198,53 +340,81 @@ export async function runPlatformSweep(host, options) {
             }
         });
     }
-    // -- provision reconcile (#1172) --------------------------------------------
+    // -- provision reconcile (#1172, #1653) -------------------------------------
     // A vertical's `onProvision` runs once per scope, at install. So a scope serving code
     // whose provision hook never ran against it is missing whatever that hook creates —
     // and no other path will ever deliver it. This phase is what makes a push repair its
-    // own installs: bound version != provisioned version ⇒ reconcile once, then record it.
+    // own installs: running version != provisioned version ⇒ reconcile once, then record it.
+    //
+    // RUNNING, not bound (#1653): a listed vertical's promote re-serves every install in
+    // place and moves none of their pointers, so comparing against the pointer never saw
+    // those installs at all. See `runningVersionOf`.
     //
     // AFTER the migration phase and skipping what failed there, like every phase that
     // touches a vertical: a fail-closed scope would only re-throw its migration error.
     if (options.reconcileScopeFn) {
         const reconcile = options.reconcileScopeFn;
-        const provisionReconcile = { behind: 0, reconciled: 0, failed: 0 };
-        /**
-         * Primaries only — and that takes BOTH tests, not one.
-         *
-         * A fork is an archive or a preview of somebody else's data, and re-provisioning one
-         * runs the vertical's install-side hook against a copy, minting a second set of
-         * whatever it mints. But a CLEAN-ROOM preview (#509) is an empty scope with no source
-         * to copy, so it carries `kind: 'preview'` and NO `forkedFrom` — the reap sweep keys
-         * on `kind` for exactly that reason. Filtering on lineage alone would let those
-         * through, which is the one shape of scope where the hook's effects are least wanted.
-         */
-        const scopes = (await host.admin.listScopes(options.actor, { status: 'active' })).filter((s) => !s.forkedFrom && s.kind !== 'preview');
-        await mapBounded(scopes, concurrency, async (s) => {
-            if (failedThisPass.has(s.id))
-                return;
-            // No bound version ⇒ nothing to compare, and nothing a reconcile could target.
-            if (!s.verticalVersionId)
-                return;
+        const provisionReconcile = {
+            behind: 0,
+            reconciled: 0,
+            failed: 0,
+            unsupported: { count: 0, scopeIds: [] },
+            deferred: 0,
+        };
+        const scopes = (await host.admin.listScopes(options.actor, { status: 'active' })).filter((s) => isPrimaryScope(s) && !failedThisPass.has(s.id));
+        // One directory read for every vertical's serving pointer — and only when some scope
+        // is actually on a serving script, since nothing else can differ from its binding.
+        const serving = new Map();
+        if (scopes.some((s) => s.servingRef)) {
+            for (const v of await host.admin.listVerticals(options.actor)) {
+                if (v.servingRef && v.servingVersionId) {
+                    serving.set(v.slug, { ref: v.servingRef, versionId: v.servingVersionId });
+                }
+            }
+        }
+        const behind = [];
+        for (const s of scopes) {
+            const running = runningVersionOf(s, s.vertical ? serving.get(s.vertical) : null);
+            // No running version ⇒ nothing to compare, and nothing a reconcile could target.
+            if (!running)
+                continue;
             // A null receipt is "unknown", NOT "up to date": a scope provisioned before the
             // platform recorded this has no evidence either way, and guessing the optimistic
             // answer leaves exactly the broken installs this phase exists to heal. It costs
             // one reconcile per pre-existing scope, once, and then the receipt is there.
-            if (s.provisionedVersionId === s.verticalVersionId)
-                return;
-            provisionReconcile.behind += 1;
-            const target = s.verticalVersionId;
+            if (s.provisionedVersionId === running)
+                continue;
+            behind.push({ id: s.id, tenantId: s.tenantId, target: running });
+        }
+        provisionReconcile.behind = behind.length;
+        const batch = options.provisionReconcileBatch ?? PROVISION_RECONCILE_BATCH;
+        const window = reconcileWindow(behind, batch, options.provisionReconcileRng ?? Math.random);
+        provisionReconcile.deferred = behind.length - window.length;
+        await mapBounded(window, concurrency, async (s) => {
             try {
-                await reconcile(s.tenantId, s.id);
+                const outcome = await reconcile(s.tenantId, s.id, s.target);
+                if (outcome === 'unsupported') {
+                    // Nothing ran, so there is nothing true to record: left unmarked, like a
+                    // failure, and asked again next pass. Not an error — the vertical answered
+                    // exactly, and it is not the kind of refusal a person has to act on per pass.
+                    provisionReconcile.unsupported.count += 1;
+                    if (provisionReconcile.unsupported.scopeIds.length < PROVISION_RECONCILE_REPORTED_IDS) {
+                        provisionReconcile.unsupported.scopeIds.push(s.id);
+                    }
+                    return;
+                }
                 // Marked with the version we RECONCILED against, read before the call — not
-                // whatever the scope happens to be bound to now. A push that lands mid-pass must
-                // not have its new version marked by a reconcile that ran against the old one.
-                await host.admin.markScopeProvisioned(options.actor, s.tenantId, s.id, target);
+                // whatever the scope runs now. A promote that lands mid-pass must not have its
+                // new version marked by a reconcile that ran against the old one. The serving
+                // pointer is written only after its upload succeeds, so the version read here is
+                // one the script was already running when the pass read it.
+                await host.admin.markScopeProvisioned(options.actor, s.tenantId, s.id, s.target);
                 provisionReconcile.reconciled += 1;
             }
             catch (err) {
                 // Left unmarked on purpose: it stays behind and is retried next pass, which is
-                // the whole difference between a backstop and a one-shot.
+                // the whole difference between a backstop and a one-shot. One scope's failure
+                // is its own: the rest of the window carries on.
                 provisionReconcile.failed += 1;
                 report.errors.push({ kind: 'provision-reconcile', id: s.id, error: message(err) });
             }
@@ -500,11 +670,14 @@ export async function runPlatformSweep(host, options) {
         const drainable = await host.admin.listScopes(options.actor, { status: 'active' });
         await mapBounded(drainable, concurrency, async (s) => {
             try {
-                const shipped = await drainScopeEvents(host, options, sink, {
+                const { shipped, skipped } = await drainScopeEvents(host, options, sink, {
                     tenantId: s.tenantId,
                     scopeId: s.id,
                     budget,
                 });
+                if (skipped) {
+                    (report.eventDrain.skipped ??= []).push({ tenantId: s.tenantId, scopeId: s.id, ...skipped });
+                }
                 if (shipped === 0)
                     return;
                 report.eventDrain.scopes += 1;
@@ -558,14 +731,50 @@ export async function runPlatformSweep(host, options) {
  *
  * Nothing is pruned. The outbox is still read by consumers, replay and
  * `readHistory`; what the stamp buys today is knowing what has left.
+ *
+ * What the read stepped over (#1636) comes back beside the count, for the report —
+ * and ONLY for the report: those rows were never in `events`, so nothing here can
+ * ship or stamp them. A host too old to say leaves it undefined.
+ *
+ * **And every event is parsed here, by the published `drainedEvent`, before the sink sees
+ * it** (#1641). This is the last point before an append-only lake, and it is the control
+ * plane's: a hosted scope's events arrive over HTTP from the vertical's own deployment,
+ * decoded by whatever adapter version that vertical was pushed with. A vertical older
+ * than #1636 decodes the envelope and copies its lifted columns unvalidated, so without
+ * this parse a corrupt one would still ship — the invariant would hold only for verticals
+ * new enough to hold it themselves. An event that fails is treated exactly as the read's
+ * own skips are: not shipped, not stamped, and folded into `skipped`.
  */
 async function drainScopeEvents(host, options, sink, input) {
-    const events = await host.admin.readUndrainedEvents(options.actor, input.tenantId, input.scopeId, input.budget);
+    const read = await host.admin.readUndrainedEvents(options.actor, input.tenantId, input.scopeId, input.budget);
+    // A plain array to the sink, of the published schema's own output: nothing typed as a
+    // DrainedEvent reaches the lake unless the schema accepted it here.
+    const events = [];
+    const refused = [];
+    for (const event of read) {
+        const parsed = drainedEvent.safeParse(event);
+        if (parsed.success)
+            events.push(parsed.data);
+        else
+            refused.push(String(event?.id));
+    }
+    const skipped = skippedOf(read.skipped, refused);
     if (events.length === 0)
-        return 0;
+        return { shipped: 0, skipped };
     await sink.ship({ tenantId: input.tenantId, scopeId: input.scopeId }, events);
     await host.admin.markEventsDrained(options.actor, input.tenantId, input.scopeId, events.map((e) => e.id));
-    return events.length;
+    return { shipped: events.length, skipped };
+}
+/**
+ * The read's own skip, plus the events this side refused (#1641): one count, exact, and the
+ * ids capped as the read caps them. Undefined when there was neither — a clean pass reports
+ * nothing rather than a zero.
+ */
+function skippedOf(read, refused) {
+    const count = (read?.count ?? 0) + refused.length;
+    if (count === 0)
+        return undefined;
+    return { count, eventIds: [...(read?.eventIds ?? []), ...refused].slice(0, UNDRAINED_SKIPPED_IDS) };
 }
 /**
  * One ship→stamp→prune cycle over the access log. Split out because the ORDER is the