@substrat-run/kernel 0.116.0 → 0.117.0

package/dist/platform-request-query.d.ts

@@ -1,4 +1,4 @@
-import { type PlatformRequestFilter } from '@substrat-run/contracts';
+import { type Actor, type PlatformRequest, type PlatformRequestFilter } from '@substrat-run/contracts';
 /**
  * The one SELECT behind every read of a scope's intent journal (#618).
  *
@@ -16,4 +16,61 @@ export declare function platformRequestHistoryQuery(filter?: PlatformRequestFilt
     sql: string;
     params: (string | number)[];
 };
+/** A stored `_substrat_platform_requests` row — snake_case, the JSON columns still text. */
+export interface PlatformRequestRawRow {
+    id: string;
+    kind: string;
+    payload: string;
+    requested_by: string;
+    impersonation: string | null;
+    status: string;
+    attempts: number;
+    last_error: string | null;
+    last_failure: string | null;
+    result: string | null;
+    requested_at: string;
+    settled_at: string | null;
+}
+/**
+ * What `requestedBy` reads as when the stored actor did not decode. The field is required and
+ * an actor has no empty value, so this is a marker that names itself rather than a plausible
+ * requester: a guessed principal would be the one thing worse than admitting nobody can tell.
+ * The same marker every tolerant spine read uses (#1636), so it is one value, not four.
+ */
+export declare const UNDECODED_REQUESTER: Actor;
+/**
+ * A stored row → the `PlatformRequest` contract shape — TOLERANTLY, and saying so (#1588).
+ *
+ * Every read of the journal returns a LIST, and this decode used to be strict: one row whose
+ * JSON would not parse threw out of the map and took every other intent on the scope with it.
+ * That disabled the drain's own queue, and `listPlatformRequestHistory` too — the read that
+ * exists so a settled intent's failure is legible afterwards (#618), switched off by the row
+ * that failed. Each field is now decoded against its own contract field, and whatever did not
+ * decode is named, by column, in `decodeError`, with the field EMPTY in its place:
+ *
+ * - a JSON column comes back `null`, or {@link UNDECODED_REQUESTER} for the one that cannot be
+ *   null. Never the raw text: a raw `payload` would read as a string payload that was never
+ *   sent, which is a guess dressed as a fact.
+ * - a nullable scalar (`last_error`, `settled_at`) comes back `null`.
+ *
+ * **Every value this returns satisfies the contract.** A field is only ever replaced by a value
+ * its own schema accepts, so the type is not asserting something the published schema would
+ * refuse — a consumer switching on `status` or passing `id` on as a branded id can trust both.
+ * The price is the REQUIRED scalars (`id`, `kind`, `status`, `attempts`, `requested_at`): they
+ * have no empty value, so a row that breaks one of them cannot be a `PlatformRequest` without
+ * lying, and it throws, naming every column it broke — the strict decode this replaced, kept
+ * for exactly the part it cannot honestly be relaxed for. JSON is what a foreign dump actually
+ * gets wrong; representing a row whose identity itself is corrupt needs a variant beside
+ * `PlatformRequest` on every read, which is a contract change of its own.
+ *
+ * A row the kernel wrote decodes whole and carries no `decodeError` at all, so a healthy list
+ * is exactly what it was. This is the READ's half of #1587's rule — strict where work happens,
+ * tolerant where evidence is read; the work half is the drain, which refuses any row carrying
+ * `decodeError` rather than run a handler on it.
+ *
+ * Reachable without a forge: `importDump` replays a dump's rows verbatim, so a dump from
+ * another world, or one edited by hand, is enough. The field-by-field mechanics are
+ * `rowDecoder`'s, shared with the history and denial reads (#1636).
+ */
+export declare function platformRequestOf(row: PlatformRequestRawRow): PlatformRequest;
 //# sourceMappingURL=platform-request-query.d.ts.map

package/dist/platform-request-query.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"platform-request-query.d.ts","sourceRoot":"","sources":["../src/platform-request-query.ts"],"names":[],"mappings":"AAAA,OAAO,EAGL,KAAK,qBAAqB,EAC3B,MAAM,yBAAyB,CAAC;AAEjC;;;;;;;;;;GAUG;AAEH,0FAA0F;AAC1F,eAAO,MAAM,wBAAwB,iIAC2F,CAAC;AAEjI,wBAAgB,2BAA2B,CAAC,MAAM,CAAC,EAAE,qBAAqB,GAAG;IAC3E,GAAG,EAAE,MAAM,CAAC;IACZ,MAAM,EAAE,CAAC,MAAM,GAAG,MAAM,CAAC,EAAE,CAAC;CAC7B,CAoBA"}
+{"version":3,"file":"platform-request-query.d.ts","sourceRoot":"","sources":["../src/platform-request-query.ts"],"names":[],"mappings":"AAAA,OAAO,EAIL,KAAK,KAAK,EACV,KAAK,eAAe,EACpB,KAAK,qBAAqB,EAC3B,MAAM,yBAAyB,CAAC;AAGjC;;;;;;;;;;GAUG;AAEH,0FAA0F;AAC1F,eAAO,MAAM,wBAAwB,iIAC2F,CAAC;AAEjI,wBAAgB,2BAA2B,CAAC,MAAM,CAAC,EAAE,qBAAqB,GAAG;IAC3E,GAAG,EAAE,MAAM,CAAC;IACZ,MAAM,EAAE,CAAC,MAAM,GAAG,MAAM,CAAC,EAAE,CAAC;CAC7B,CAoBA;AAED,4FAA4F;AAC5F,MAAM,WAAW,qBAAqB;IACpC,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;IAChB,YAAY,EAAE,MAAM,CAAC;IACrB,aAAa,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,CAAC;IACjB,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,YAAY,EAAE,MAAM,CAAC;IACrB,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;CAC3B;AAED;;;;;GAKG;AACH,eAAO,MAAM,mBAAmB,EAAE,KAAuB,CAAC;AAE1D;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiCG;AACH,wBAAgB,iBAAiB,CAAC,GAAG,EAAE,qBAAqB,GAAG,eAAe,CAiB7E"}

package/dist/platform-request-query.js

@@ -1,4 +1,5 @@
-import { DEFAULT_PLATFORM_REQUEST_HISTORY_LIMIT, platformRequestFilter, } from '@substrat-run/contracts';
+import { DEFAULT_PLATFORM_REQUEST_HISTORY_LIMIT, platformRequest, platformRequestFilter, } from '@substrat-run/contracts';
+import { rowDecoder, UNDECODED_ACTOR } from './row-decode.js';
 /**
  * The one SELECT behind every read of a scope's intent journal (#618).
  *
@@ -32,4 +33,63 @@ export function platformRequestHistoryQuery(filter) {
         params,
     };
 }
+/**
+ * What `requestedBy` reads as when the stored actor did not decode. The field is required and
+ * an actor has no empty value, so this is a marker that names itself rather than a plausible
+ * requester: a guessed principal would be the one thing worse than admitting nobody can tell.
+ * The same marker every tolerant spine read uses (#1636), so it is one value, not four.
+ */
+export const UNDECODED_REQUESTER = UNDECODED_ACTOR;
+/**
+ * A stored row → the `PlatformRequest` contract shape — TOLERANTLY, and saying so (#1588).
+ *
+ * Every read of the journal returns a LIST, and this decode used to be strict: one row whose
+ * JSON would not parse threw out of the map and took every other intent on the scope with it.
+ * That disabled the drain's own queue, and `listPlatformRequestHistory` too — the read that
+ * exists so a settled intent's failure is legible afterwards (#618), switched off by the row
+ * that failed. Each field is now decoded against its own contract field, and whatever did not
+ * decode is named, by column, in `decodeError`, with the field EMPTY in its place:
+ *
+ * - a JSON column comes back `null`, or {@link UNDECODED_REQUESTER} for the one that cannot be
+ *   null. Never the raw text: a raw `payload` would read as a string payload that was never
+ *   sent, which is a guess dressed as a fact.
+ * - a nullable scalar (`last_error`, `settled_at`) comes back `null`.
+ *
+ * **Every value this returns satisfies the contract.** A field is only ever replaced by a value
+ * its own schema accepts, so the type is not asserting something the published schema would
+ * refuse — a consumer switching on `status` or passing `id` on as a branded id can trust both.
+ * The price is the REQUIRED scalars (`id`, `kind`, `status`, `attempts`, `requested_at`): they
+ * have no empty value, so a row that breaks one of them cannot be a `PlatformRequest` without
+ * lying, and it throws, naming every column it broke — the strict decode this replaced, kept
+ * for exactly the part it cannot honestly be relaxed for. JSON is what a foreign dump actually
+ * gets wrong; representing a row whose identity itself is corrupt needs a variant beside
+ * `PlatformRequest` on every read, which is a contract change of its own.
+ *
+ * A row the kernel wrote decodes whole and carries no `decodeError` at all, so a healthy list
+ * is exactly what it was. This is the READ's half of #1587's rule — strict where work happens,
+ * tolerant where evidence is read; the work half is the drain, which refuses any row carrying
+ * `decodeError` rather than run a handler on it.
+ *
+ * Reachable without a forge: `importDump` replays a dump's rows verbatim, so a dump from
+ * another world, or one edited by hand, is enough. The field-by-field mechanics are
+ * `rowDecoder`'s, shared with the history and denial reads (#1636).
+ */
+export function platformRequestOf(row) {
+    const shape = platformRequest.shape;
+    const d = rowDecoder(`platform request row ${JSON.stringify(row.id)}`, 'PlatformRequest');
+    return d.finish({
+        id: d.required('id', shape.id, row.id),
+        kind: d.required('kind', shape.kind, row.kind),
+        payload: d.json('payload', shape.payload, row.payload, null),
+        requestedBy: d.json('requested_by', shape.requestedBy, row.requested_by, UNDECODED_REQUESTER),
+        impersonation: d.json('impersonation', shape.impersonation, row.impersonation, null),
+        status: d.required('status', shape.status, row.status),
+        attempts: d.required('attempts', shape.attempts, row.attempts),
+        lastError: d.nullable('last_error', shape.lastError, row.last_error),
+        failure: d.json('last_failure', shape.failure, row.last_failure, null),
+        result: d.json('result', shape.result, row.result, null),
+        requestedAt: d.required('requested_at', shape.requestedAt, row.requested_at),
+        settledAt: d.nullable('settled_at', shape.settledAt, row.settled_at),
+    });
+}
 //# sourceMappingURL=platform-request-query.js.map

package/dist/platform-request-query.js.map

@@ -1 +1 @@
-{"version":3,"file":"platform-request-query.js","sourceRoot":"","sources":["../src/platform-request-query.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,sCAAsC,EACtC,qBAAqB,GAEtB,MAAM,yBAAyB,CAAC;AAEjC;;;;;;;;;;GAUG;AAEH,0FAA0F;AAC1F,MAAM,CAAC,MAAM,wBAAwB,GACnC,8HAA8H,CAAC;AAEjI,MAAM,UAAU,2BAA2B,CAAC,MAA8B;IAIxE,MAAM,CAAC,GAAG,qBAAqB,CAAC,KAAK,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC;IACpD,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,MAAM,MAAM,GAAwB,EAAE,CAAC;IACvC,IAAI,CAAC,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;QACzB,KAAK,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;QACvB,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;IACtB,CAAC;IACD,IAAI,CAAC,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;QAC3B,KAAK,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;QACzB,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;IACxB,CAAC;IACD,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,IAAI,sCAAsC,CAAC,CAAC;IAC/D,OAAO;QACL,GAAG,EACD,UAAU,wBAAwB,mCAAmC;YACrE,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,UAAU,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACrD,2BAA2B;QAC7B,MAAM;KACP,CAAC;AACJ,CAAC"}
+{"version":3,"file":"platform-request-query.js","sourceRoot":"","sources":["../src/platform-request-query.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,sCAAsC,EACtC,eAAe,EACf,qBAAqB,GAItB,MAAM,yBAAyB,CAAC;AACjC,OAAO,EAAE,UAAU,EAAE,eAAe,EAAE,MAAM,iBAAiB,CAAC;AAE9D;;;;;;;;;;GAUG;AAEH,0FAA0F;AAC1F,MAAM,CAAC,MAAM,wBAAwB,GACnC,8HAA8H,CAAC;AAEjI,MAAM,UAAU,2BAA2B,CAAC,MAA8B;IAIxE,MAAM,CAAC,GAAG,qBAAqB,CAAC,KAAK,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC;IACpD,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,MAAM,MAAM,GAAwB,EAAE,CAAC;IACvC,IAAI,CAAC,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;QACzB,KAAK,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;QACvB,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;IACtB,CAAC;IACD,IAAI,CAAC,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;QAC3B,KAAK,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;QACzB,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;IACxB,CAAC;IACD,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,IAAI,sCAAsC,CAAC,CAAC;IAC/D,OAAO;QACL,GAAG,EACD,UAAU,wBAAwB,mCAAmC;YACrE,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,UAAU,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACrD,2BAA2B;QAC7B,MAAM;KACP,CAAC;AACJ,CAAC;AAkBD;;;;;GAKG;AACH,MAAM,CAAC,MAAM,mBAAmB,GAAU,eAAe,CAAC;AAE1D;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiCG;AACH,MAAM,UAAU,iBAAiB,CAAC,GAA0B;IAC1D,MAAM,KAAK,GAAG,eAAe,CAAC,KAAK,CAAC;IACpC,MAAM,CAAC,GAAG,UAAU,CAAC,wBAAwB,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,EAAE,iBAAiB,CAAC,CAAC;IAC1F,OAAO,CAAC,CAAC,MAAM,CAAkB;QAC/B,EAAE,EAAE,CAAC,CAAC,QAAQ,CAAwB,IAAI,EAAE,KAAK,CAAC,EAAE,EAAE,GAAG,CAAC,EAAE,CAAC;QAC7D,IAAI,EAAE,CAAC,CAAC,QAAQ,CAAS,MAAM,EAAE,KAAK,CAAC,IAAI,EAAE,GAAG,CAAC,IAAI,CAAC;QACtD,OAAO,EAAE,CAAC,CAAC,IAAI,CAAU,SAAS,EAAE,KAAK,CAAC,OAAO,EAAE,GAAG,CAAC,OAAO,EAAE,IAAI,CAAC;QACrE,WAAW,EAAE,CAAC,CAAC,IAAI,CAAQ,cAAc,EAAE,KAAK,CAAC,WAAW,EAAE,GAAG,CAAC,YAAY,EAAE,mBAAmB,CAAC;QACpG,aAAa,EAAE,CAAC,CAAC,IAAI,CAAmC,eAAe,EAAE,KAAK,CAAC,aAAa,EAAE,GAAG,CAAC,aAAa,EAAE,IAAI,CAAC;QACtH,MAAM,EAAE,CAAC,CAAC,QAAQ,CAA4B,QAAQ,EAAE,KAAK,CAAC,MAAM,EAAE,GAAG,CAAC,MAAM,CAAC;QACjF,QAAQ,EAAE,CAAC,CAAC,QAAQ,CAAS,UAAU,EAAE,KAAK,CAAC,QAAQ,EAAE,GAAG,CAAC,QAAQ,CAAC;QACtE,SAAS,EAAE,CAAC,CAAC,QAAQ,CAAS,YAAY,EAAE,KAAK,CAAC,SAAS,EAAE,GAAG,CAAC,UAAU,CAAC;QAC5E,OAAO,EAAE,CAAC,CAAC,IAAI,CAA6B,cAAc,EAAE,KAAK,CAAC,OAAO,EAAE,GAAG,CAAC,YAAY,EAAE,IAAI,CAAC;QAClG,MAAM,EAAE,CAAC,CAAC,IAAI,CAAU,QAAQ,EAAE,KAAK,CAAC,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,IAAI,CAAC;QACjE,WAAW,EAAE,CAAC,CAAC,QAAQ,CAAiC,cAAc,EAAE,KAAK,CAAC,WAAW,EAAE,GAAG,CAAC,YAAY,CAAC;QAC5G,SAAS,EAAE,CAAC,CAAC,QAAQ,CAAiC,YAAY,EAAE,KAAK,CAAC,SAAS,EAAE,GAAG,CAAC,UAAU,CAAC;KACrG,CAAC,CAAC;AACL,CAAC"}

package/dist/platform-sweep.d.ts

@@ -1,4 +1,4 @@
-import type { AccessLogEntry, ConnectionId, MigrationProgress, MigrationStraggler, PlatformActorId, ScopeId, TenantId, DrainedEvent } from '@substrat-run/contracts';
+import type { AccessLogEntry, ConnectionId, MigrationProgress, MigrationStraggler, PlatformActorId, Scope, ScopeId, TenantId, DrainedEvent } from '@substrat-run/contracts';
 import type { ExecutorDrainReport, FetchLike, ScopeHost, SweepRunInput } from './scope-host.js';
 /**
  * A connector's reconcile sweep — the unit `runPlatformSweep` calls per live
@@ -118,11 +118,45 @@ export interface PlatformSweepOptions {
      * What makes the phase necessary: a vertical's `onProvision` runs ONCE per scope, at
      * install. Anything the vertical mints for itself there — a service principal, a site
      * registration — therefore never reaches an install that predates it. The new code
-     * deploys, and the thing it depends on was never created. Comparing the scope's bound
-     * version against the one its provision last ran against is how the platform sees that,
-     * and this fn is how it fixes it.
+     * deploys, and the thing it depends on was never created. Comparing the version whose
+     * code RUNS on the scope (`runningVersionOf`, #1653) against the one its provision last
+     * ran against is how the platform sees that, and this fn is how it fixes it.
+     *
+     * `expected` is the version the phase will record on success — the one running on the
+     * scope. A fn whose deployment for the scope runs a DIFFERENT version (its resolver fell
+     * back from the serving script to the bound version's, say) must throw rather than
+     * resolve: the receipt would otherwise name a hook that never ran, and the scope would
+     * read as repaired while the code it runs was never provisioned for. A throw leaves it
+     * unmarked and counted `failed`, which is where it belongs.
+     *
+     * Resolves `'unsupported'` when the vertical answered that it implements no reconcile
+     * (a 501 from `/internal/reconcile`). That is neither a success nor a failure: no
+     * receipt is written, since nothing ran, and it is counted apart from `failed` so a
+     * vertical that simply lacks the route does not drown the refusals somebody must read.
+     */
+    reconcileScopeFn?: (tenantId: TenantId, scopeId: ScopeId, expected: string) => Promise<void | 'unsupported'>;
+    /**
+     * The most scopes the #1172 phase reconciles in ONE pass (#1653). Default
+     * {@link PROVISION_RECONCILE_BATCH}.
+     *
+     * A promote of a LISTED vertical puts every install of it behind at once — each one is
+     * another tenant's scope, and a popular vertical has thousands. Reconciling them all in
+     * one tick is how a cron becomes an incident, so the phase takes at most this many and
+     * the rest wait for the next pass (`deferred`). `0` reconciles nothing: the phase still
+     * counts who is behind, which makes it the pause switch.
+     */
+    provisionReconcileBatch?: number;
+    /**
+     * Where the #1172 window starts, as a number in [0, 1) — `Math.random` unless given.
+     *
+     * The behind scopes are ordered by id and the pass takes a contiguous window of
+     * `provisionReconcileBatch` from a random starting point, wrapping. A FIXED start would
+     * let installs that fail on every pass hold the same slots forever and starve every
+     * healthy one behind them; a random start gives each behind scope a chance of
+     * batch/behind per pass however many of the others keep failing. Injectable so that
+     * property is tested rather than hoped for.
      */
-    reconcileScopeFn?: (tenantId: TenantId, scopeId: ScopeId) => Promise<void>;
+    provisionReconcileRng?: () => number;
     /**
      * Also reap expired snapshots (preview-and-snapshots.md §3/§9): any FORK
      * (`forkedFrom` set) whose `expiresAt` has passed is hard-deleted via
@@ -332,13 +366,68 @@ export interface ScheduleSweepReport {
 }
 /** What the #1172 phase did — see `reconcileScopeFn`. */
 export interface ProvisionReconcileReport {
-    /** Scopes whose bound version was ahead of their provisioned one this pass. */
+    /**
+     * Scopes whose running version differed from the one their provision last ran against
+     * this pass. Always `reconciled + failed + unsupported + deferred`.
+     */
     behind: number;
     /** Of those, the ones whose reconcile succeeded and were marked. */
     reconciled: number;
     /** Of those, the ones whose reconcile threw. They stay behind and retry next pass. */
     failed: number;
+    /**
+     * Of those, the ones whose vertical implements no reconcile (a 501). Unmarked like a
+     * failure, so they are asked again next pass; counted apart so they cannot pass for one.
+     * `scopeIds` is capped at {@link PROVISION_RECONCILE_REPORTED_IDS}; `count` is exact.
+     */
+    unsupported: {
+        count: number;
+        scopeIds: string[];
+    };
+    /** Of those, the ones past this pass's `provisionReconcileBatch`. Next pass's work. */
+    deferred: number;
 }
+/** The #1172 phase's per-pass bound when `provisionReconcileBatch` is unset (#1653). */
+export declare const PROVISION_RECONCILE_BATCH = 50;
+/** How many `unsupported` scope ids one report carries — the count stays exact. */
+export declare const PROVISION_RECONCILE_REPORTED_IDS = 50;
+/**
+ * A scope the platform may treat as the REAL install, rather than a copy of one (#1172,
+ * #1653). The directory is the only oracle for this, and it takes BOTH tests, not one.
+ *
+ * A fork is an archive or a preview of somebody else's data, and re-provisioning one
+ * runs the vertical's install-side hook against a copy, minting a second set of whatever
+ * it mints — or, since #1656, putting a copy of production on a sweeper that reaps and
+ * assigns. But a CLEAN-ROOM preview (#509) is an empty scope with no source to copy, so
+ * it carries `kind: 'preview'` and NO `forkedFrom` — the reap sweep keys on `kind` for
+ * exactly that reason. Filtering on lineage alone would let those through, which is the
+ * one shape of scope where the hook's effects are least wanted.
+ */
+export declare function isPrimaryScope(scope: Pick<Scope, 'forkedFrom' | 'kind'>): boolean;
+/** What a vertical's stable serving script runs (#286) — `Vertical.servingRef`/`servingVersionId`. */
+export interface ServingPointer {
+    ref: string;
+    versionId: string;
+}
+/**
+ * The version whose code actually executes for `scope` (#1653) — which is not always the
+ * one it is bound to.
+ *
+ * A scope on its vertical's stable serving script (`servingRef`, #286) runs whatever that
+ * script serves, and a promote re-uploads the script in place: the code changes under
+ * the scope at that moment, whatever its version pointer says. For a PRIVATE vertical
+ * the promote moves the pointer too, so the two agree. For a LISTED one it does not —
+ * the pointer is the tenant's, and moves only on their Update — so an install can run
+ * version N+1 with its provision state still at N. Measuring against the running version
+ * is what lets the reconcile follow the code instead of the pointer.
+ *
+ * Falls back to the bound version whenever the serving script cannot be named: a scope
+ * with no `servingRef` (legacy per-version dispatch, where the bound version's own
+ * script IS what runs), a vertical with nothing served in place yet, or a `servingRef`
+ * that is not the vertical's current one. The fallback is exactly the pre-#1653 answer,
+ * so an unknown never manufactures a reconcile.
+ */
+export declare function runningVersionOf(scope: Pick<Scope, 'verticalVersionId' | 'servingRef'>, serving: ServingPointer | null | undefined): string | null;
 export interface PlatformSweepReport {
     /** Active scopes `drainDue` ran on. */
     scopesDrained: number;
@@ -357,8 +446,9 @@ export interface PlatformSweepReport {
     /** Platform-intent drain outcomes summed across scopes (platform-intents.md). */
     platformRequestTotals: PlatformRequestDrainTotals;
     /**
-     * Scopes whose provision was re-run because their bound version had moved past the one
-     * it last ran against (#1172), or null when no `reconcileScopeFn` was supplied.
+     * Scopes whose provision was re-run because the version running on them had moved past
+     * the one it last ran against (#1172, #1653), or null when no `reconcileScopeFn` was
+     * supplied.
      *
      * Null and `{ reconciled: 0 }` are different facts, as everywhere else in this report:
      * the first is "nobody looked".
@@ -406,6 +496,31 @@ export interface EventDrainReport {
      * it. Reported rather than looped, so one busy scope cannot starve the pass.
      */
     incomplete: number;
+    /**
+     * Undrained rows a scope's read stepped over because they would not decode (#1636), plus
+     * any event this sweep refused itself because the published `drainedEvent` schema did not
+     * accept it (#1641 — what an older vertical, which does not validate, can still send),
+     * one entry per scope that had any — ABSENT when no scope did.
+     *
+     * These rows are never shipped and never stamped: the lake is append-only, so a row
+     * built from stand-ins could not be taken back, and the stamp is the only record of
+     * what left. So they are missing from the lake for as long as they stay undecodable,
+     * and every pass reads them again and reports them again. The event is still in
+     * Tier 1, where `readHistory` returns it with a `decodeError`.
+     *
+     * Not an `errors` entry: nothing about this pass failed, and the failure digest mails
+     * every error — a standing condition would be re-sent on every tick.
+     */
+    skipped?: EventDrainSkipped[];
+}
+/** One scope's share of `EventDrainReport.skipped`. */
+export interface EventDrainSkipped {
+    tenantId: TenantId;
+    scopeId: ScopeId;
+    /** Exact. */
+    count: number;
+    /** The first of them, oldest first; capped (`UNDRAINED_SKIPPED_IDS`), so `count` may be larger. */
+    eventIds: string[];
 }
 export interface AccessLogSweepReport {
     /** Rows handed to the sink and confirmed durable. */

package/dist/platform-sweep.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"platform-sweep.d.ts","sourceRoot":"","sources":["../src/platform-sweep.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EACV,cAAc,EACd,YAAY,EACZ,iBAAiB,EACjB,kBAAkB,EAClB,eAAe,EAEf,OAAO,EACP,QAAQ,EACR,YAAY,EACb,MAAM,yBAAyB,CAAC;AACjC,OAAO,KAAK,EAAE,mBAAmB,EAAE,SAAS,EAAE,SAAS,EAAE,aAAa,EAAE,MAAM,iBAAiB,CAAC;AAUhG;;;;;;;GAOG;AACH,MAAM,WAAW,gBAAgB;IAC/B,CAAC,IAAI,EAAE,SAAS,EAAE,YAAY,EAAE,YAAY,EAAE,IAAI,EAAE;QAAE,KAAK,EAAE,SAAS,CAAA;KAAE,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;CAC7F;AAED;;;;;;;;;;;;;;GAcG;AACH,MAAM,WAAW,aAAa;IAC5B;;;;OAIG;IACH,IAAI,CAAC,OAAO,EAAE,cAAc,EAAE,GAAG,OAAO,CAAC;QAAE,GAAG,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;CAC3D;AAED;;;;;;;;;;;;;;;;;;;GAmBG;AACH,MAAM,WAAW,SAAS;IACxB;;;;OAIG;IACH,IAAI,CAAC,KAAK,EAAE;QAAE,QAAQ,EAAE,QAAQ,CAAC;QAAC,OAAO,EAAE,OAAO,CAAA;KAAE,EAAE,MAAM,EAAE,YAAY,EAAE,GAAG,OAAO,CAAC;QAAE,GAAG,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;CACzG;AAQD,MAAM,WAAW,oBAAoB;IACnC;;;;;;;OAOG;IACH,cAAc,CAAC,EAAE,CAAC,KAAK,EAAE,aAAa,KAAK,IAAI,CAAC;IAChD,wFAAwF;IACxF,KAAK,EAAE,eAAe,CAAC;IACvB,0DAA0D;IAC1D,KAAK,EAAE,SAAS,CAAC;IACjB,+FAA+F;IAC/F,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,gBAAgB,CAAC,CAAC;IAC3C,yEAAyE;IACzE,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB;;;;OAIG;IACH,YAAY,CAAC,EAAE,OAAO,CAAC;IACvB;;;;;;OAMG;IACH,uBAAuB,CAAC,EAAE,CACxB,QAAQ,EAAE,QAAQ,EAClB,OAAO,EAAE,OAAO,KACb,OAAO,CAAC;QAAE,OAAO,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IACjF;;;;;;;;;;;;;OAaG;IACH,gBAAgB,CAAC,EAAE,CAAC,QAAQ,EAAE,QAAQ,EAAE,OAAO,EAAE,OAAO,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IAC3E;;;;;;OAMG;IACH,WAAW,CAAC,EAAE,OAAO,CAAC;IACtB;;;;;;OAMG;IACH,gBAAgB,CAAC,EAAE,CAAC,QAAQ,EAAE,QAAQ,EAAE,OAAO,EAAE,OAAO,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IAC3E;;;;;;;;;OASG;IACH,qBAAqB,CAAC,EAAE,MAAM,CAAC;IAC/B;;;;;;OAMG;IACH,WAAW,CAAC,EAAE,CAAC,QAAQ,EAAE,QAAQ,EAAE,OAAO,EAAE,OAAO,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IACtE;;;;;;;;;;OAUG;IACH,aAAa,CAAC,EAAE,aAAa,CAAC;IAC9B;;;;OAIG;IACH,SAAS,CAAC,EAAE,SAAS,CAAC;IACtB,sDAAsD;IACtD,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,uDAAuD;IACvD,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB;;;;;;;;OAQG;IACH,qBAAqB,CAAC,EAAE,MAAM,CAAC;IAC/B;;;;;;;;OAQG;IACH,YAAY,CAAC,EAAE,CAAC,QAAQ,EAAE,QAAQ,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IACrD;;;;;;OAMG;IACH,mBAAmB,CAAC,EAAE,OAAO,CAAC;IAC9B;;;;;;OAMG;IACH,YAAY,CAAC,EAAE,OAAO,CAAC;IACvB;;;;;;;;;OASG;IACH,gBAAgB,CAAC,EAAE;QAAE,WAAW,CAAC,EAAE,MAAM,CAAC;QAAC,UAAU,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;IACjE,uEAAuE;IACvE,sBAAsB,CAAC,EAAE,MAAM,CAAC;IAChC;;;;;;;OAOG;IACH,mBAAmB,CAAC,EAAE,CAAC,OAAO,EAAE,kBAAkB,EAAE,KAAK,IAAI,CAAC;CAC/D;AAED;;;;GAIG;AACH,MAAM,WAAW,oBAAqB,SAAQ,iBAAiB;IAC7D,sEAAsE;IACtE,SAAS,EAAE,MAAM,CAAC;IAClB,oDAAoD;IACpD,QAAQ,EAAE,MAAM,CAAC;IACjB,8EAA8E;IAC9E,QAAQ,EAAE,MAAM,CAAC;IACjB,oGAAoG;IACpG,KAAK,EAAE,MAAM,CAAC;CACf;AAED;;;;;GAKG;AACH,MAAM,MAAM,iBAAiB,GAAG,UAAU,GAAG,WAAW,CAAC;AAEzD;;;;;;;;GAQG;AACH,eAAO,MAAM,kBAAkB,4+CAwB9B,CAAC;AAEF;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiCG;AACH,eAAO,MAAM,sBAAsB,QAYlC,CAAC;AAEF;;;GAGG;AACH,wBAAgB,oBAAoB,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAE9D;AAED;;;;;GAKG;AACH,MAAM,WAAW,mBAAmB;IAClC,kEAAkE;IAClE,MAAM,EAAE,MAAM,CAAC;IACf,sDAAsD;IACtD,KAAK,EAAE,MAAM,CAAC;IACd,uEAAuE;IACvE,OAAO,EAAE,MAAM,CAAC;IAChB,qEAAqE;IACrE,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,yDAAyD;AACzD,MAAM,WAAW,wBAAwB;IACvC,+EAA+E;IAC/E,MAAM,EAAE,MAAM,CAAC;IACf,oEAAoE;IACpE,UAAU,EAAE,MAAM,CAAC;IACnB,sFAAsF;IACtF,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,mBAAmB;IAClC,uCAAuC;IACvC,aAAa,EAAE,MAAM,CAAC;IACtB,2CAA2C;IAC3C,WAAW,EAAE,mBAAmB,CAAC;IACjC,qCAAqC;IACrC,gBAAgB,EAAE,MAAM,CAAC;IACzB,kFAAkF;IAClF,kBAAkB,EAAE,MAAM,CAAC;IAC3B,0DAA0D;IAC1D,eAAe,EAAE,MAAM,CAAC;IACxB,2EAA2E;IAC3E,oBAAoB,EAAE,MAAM,CAAC;IAC7B,+DAA+D;IAC/D,aAAa,EAAE,MAAM,CAAC;IACtB,iFAAiF;IACjF,qBAAqB,EAAE,0BAA0B,CAAC;IAClD;;;;;;OAMG;IACH,kBAAkB,EAAE,wBAAwB,GAAG,IAAI,CAAC;IACpD;;;;;;OAMG;IACH,UAAU,EAAE,oBAAoB,GAAG,IAAI,CAAC;IACxC;;;;;OAKG;IACH,SAAS,EAAE,mBAAmB,GAAG,IAAI,CAAC;IACtC;;;;OAIG;IACH,SAAS,EAAE,oBAAoB,GAAG,IAAI,CAAC;IACvC,kFAAkF;IAClF,UAAU,EAAE,gBAAgB,GAAG,IAAI,CAAC;IACpC,oFAAoF;IACpF,MAAM,EAAE;QACN,IAAI,EACA,OAAO,GACP,OAAO,GACP,IAAI,GACJ,MAAM,GACN,aAAa,GACb,SAAS,GACT,kBAAkB,GAClB,qBAAqB,GACrB,UAAU,GACV,WAAW,GACX,YAAY,GAEZ,aAAa,CAAC;QAClB,EAAE,EAAE,MAAM,CAAC;QACX,KAAK,EAAE,MAAM,CAAC;KACf,EAAE,CAAC;CACL;AAED,sEAAsE;AACtE,4DAA4D;AAC5D,MAAM,WAAW,gBAAgB;IAC/B,qEAAqE;IACrE,MAAM,EAAE,MAAM,CAAC;IACf,uDAAuD;IACvD,OAAO,EAAE,MAAM,CAAC;IAChB;;;OAGG;IACH,UAAU,EAAE,MAAM,CAAC;CACpB;AAED,MAAM,WAAW,oBAAoB;IACnC,qDAAqD;IACrD,OAAO,EAAE,MAAM,CAAC;IAChB,8EAA8E;IAC9E,MAAM,EAAE,MAAM,CAAC;IACf,yDAAyD;IACzD,MAAM,EAAE,MAAM,CAAC;IACf,kFAAkF;IAClF,GAAG,EAAE,MAAM,GAAG,IAAI,CAAC;CACpB;AAED,sEAAsE;AACtE,MAAM,WAAW,0BAA0B;IACzC,0DAA0D;IAC1D,MAAM,EAAE,MAAM,CAAC;IACf,sCAAsC;IACtC,OAAO,EAAE,MAAM,CAAC;IAChB,6BAA6B;IAC7B,IAAI,EAAE,MAAM,CAAC;IACb,mEAAmE;IACnE,MAAM,EAAE,MAAM,CAAC;IACf,0DAA0D;IAC1D,OAAO,EAAE,MAAM,CAAC;CACjB;AAsBD;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAsB,gBAAgB,CACpC,IAAI,EAAE,SAAS,EACf,OAAO,EAAE,oBAAoB,GAC5B,OAAO,CAAC,mBAAmB,CAAC,CAmgB9B;AA4FD,wFAAwF;AACxF,MAAM,WAAW,qBAAqB;IACpC,IAAI,IAAI,IAAI,CAAC;CACd;AAED,MAAM,WAAW,2BAA4B,SAAQ,oBAAoB;IACvE;;;;OAIG;IACH,UAAU,EAAE,MAAM,CAAC;IACnB,sFAAsF;IACtF,MAAM,CAAC,EAAE,CAAC,OAAO,EAAE,mBAAmB,GAAG;QAAE,KAAK,EAAE,MAAM,CAAA;KAAE,KAAK,IAAI,CAAC;IACpE,0DAA0D;IAC1D,QAAQ,CAAC,EAAE,CAAC,EAAE,EAAE,MAAM,IAAI,EAAE,EAAE,EAAE,MAAM,KAAK,OAAO,CAAC;IACnD,UAAU,CAAC,EAAE,CAAC,MAAM,EAAE,OAAO,KAAK,IAAI,CAAC;CACxC;AAED;;;;;;;GAOG;AACH,wBAAgB,oBAAoB,CAClC,IAAI,EAAE,SAAS,EACf,OAAO,EAAE,2BAA2B,GACnC,qBAAqB,CAuBvB"}
+{"version":3,"file":"platform-sweep.d.ts","sourceRoot":"","sources":["../src/platform-sweep.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EACV,cAAc,EACd,YAAY,EACZ,iBAAiB,EACjB,kBAAkB,EAClB,eAAe,EACf,KAAK,EACL,OAAO,EACP,QAAQ,EACR,YAAY,EACb,MAAM,yBAAyB,CAAC;AACjC,OAAO,KAAK,EAAE,mBAAmB,EAAE,SAAS,EAAE,SAAS,EAAE,aAAa,EAAE,MAAM,iBAAiB,CAAC;AAWhG;;;;;;;GAOG;AACH,MAAM,WAAW,gBAAgB;IAC/B,CAAC,IAAI,EAAE,SAAS,EAAE,YAAY,EAAE,YAAY,EAAE,IAAI,EAAE;QAAE,KAAK,EAAE,SAAS,CAAA;KAAE,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;CAC7F;AAED;;;;;;;;;;;;;;GAcG;AACH,MAAM,WAAW,aAAa;IAC5B;;;;OAIG;IACH,IAAI,CAAC,OAAO,EAAE,cAAc,EAAE,GAAG,OAAO,CAAC;QAAE,GAAG,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;CAC3D;AAED;;;;;;;;;;;;;;;;;;;GAmBG;AACH,MAAM,WAAW,SAAS;IACxB;;;;OAIG;IACH,IAAI,CAAC,KAAK,EAAE;QAAE,QAAQ,EAAE,QAAQ,CAAC;QAAC,OAAO,EAAE,OAAO,CAAA;KAAE,EAAE,MAAM,EAAE,YAAY,EAAE,GAAG,OAAO,CAAC;QAAE,GAAG,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;CACzG;AAQD,MAAM,WAAW,oBAAoB;IACnC;;;;;;;OAOG;IACH,cAAc,CAAC,EAAE,CAAC,KAAK,EAAE,aAAa,KAAK,IAAI,CAAC;IAChD,wFAAwF;IACxF,KAAK,EAAE,eAAe,CAAC;IACvB,0DAA0D;IAC1D,KAAK,EAAE,SAAS,CAAC;IACjB,+FAA+F;IAC/F,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,gBAAgB,CAAC,CAAC;IAC3C,yEAAyE;IACzE,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB;;;;OAIG;IACH,YAAY,CAAC,EAAE,OAAO,CAAC;IACvB;;;;;;OAMG;IACH,uBAAuB,CAAC,EAAE,CACxB,QAAQ,EAAE,QAAQ,EAClB,OAAO,EAAE,OAAO,KACb,OAAO,CAAC;QAAE,OAAO,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IACjF;;;;;;;;;;;;;;;;;;;;;;;;;OAyBG;IACH,gBAAgB,CAAC,EAAE,CAAC,QAAQ,EAAE,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,GAAG,aAAa,CAAC,CAAC;IAC7G;;;;;;;;;OASG;IACH,uBAAuB,CAAC,EAAE,MAAM,CAAC;IACjC;;;;;;;;;OASG;IACH,qBAAqB,CAAC,EAAE,MAAM,MAAM,CAAC;IACrC;;;;;;OAMG;IACH,WAAW,CAAC,EAAE,OAAO,CAAC;IACtB;;;;;;OAMG;IACH,gBAAgB,CAAC,EAAE,CAAC,QAAQ,EAAE,QAAQ,EAAE,OAAO,EAAE,OAAO,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IAC3E;;;;;;;;;OASG;IACH,qBAAqB,CAAC,EAAE,MAAM,CAAC;IAC/B;;;;;;OAMG;IACH,WAAW,CAAC,EAAE,CAAC,QAAQ,EAAE,QAAQ,EAAE,OAAO,EAAE,OAAO,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IACtE;;;;;;;;;;OAUG;IACH,aAAa,CAAC,EAAE,aAAa,CAAC;IAC9B;;;;OAIG;IACH,SAAS,CAAC,EAAE,SAAS,CAAC;IACtB,sDAAsD;IACtD,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,uDAAuD;IACvD,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB;;;;;;;;OAQG;IACH,qBAAqB,CAAC,EAAE,MAAM,CAAC;IAC/B;;;;;;;;OAQG;IACH,YAAY,CAAC,EAAE,CAAC,QAAQ,EAAE,QAAQ,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IACrD;;;;;;OAMG;IACH,mBAAmB,CAAC,EAAE,OAAO,CAAC;IAC9B;;;;;;OAMG;IACH,YAAY,CAAC,EAAE,OAAO,CAAC;IACvB;;;;;;;;;OASG;IACH,gBAAgB,CAAC,EAAE;QAAE,WAAW,CAAC,EAAE,MAAM,CAAC;QAAC,UAAU,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;IACjE,uEAAuE;IACvE,sBAAsB,CAAC,EAAE,MAAM,CAAC;IAChC;;;;;;;OAOG;IACH,mBAAmB,CAAC,EAAE,CAAC,OAAO,EAAE,kBAAkB,EAAE,KAAK,IAAI,CAAC;CAC/D;AAED;;;;GAIG;AACH,MAAM,WAAW,oBAAqB,SAAQ,iBAAiB;IAC7D,sEAAsE;IACtE,SAAS,EAAE,MAAM,CAAC;IAClB,oDAAoD;IACpD,QAAQ,EAAE,MAAM,CAAC;IACjB,8EAA8E;IAC9E,QAAQ,EAAE,MAAM,CAAC;IACjB,oGAAoG;IACpG,KAAK,EAAE,MAAM,CAAC;CACf;AAED;;;;;GAKG;AACH,MAAM,MAAM,iBAAiB,GAAG,UAAU,GAAG,WAAW,CAAC;AAEzD;;;;;;;;GAQG;AACH,eAAO,MAAM,kBAAkB,4+CAwB9B,CAAC;AAEF;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiCG;AACH,eAAO,MAAM,sBAAsB,QAYlC,CAAC;AAEF;;;GAGG;AACH,wBAAgB,oBAAoB,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAE9D;AAED;;;;;GAKG;AACH,MAAM,WAAW,mBAAmB;IAClC,kEAAkE;IAClE,MAAM,EAAE,MAAM,CAAC;IACf,sDAAsD;IACtD,KAAK,EAAE,MAAM,CAAC;IACd,uEAAuE;IACvE,OAAO,EAAE,MAAM,CAAC;IAChB,qEAAqE;IACrE,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,yDAAyD;AACzD,MAAM,WAAW,wBAAwB;IACvC;;;OAGG;IACH,MAAM,EAAE,MAAM,CAAC;IACf,oEAAoE;IACpE,UAAU,EAAE,MAAM,CAAC;IACnB,sFAAsF;IACtF,MAAM,EAAE,MAAM,CAAC;IACf;;;;OAIG;IACH,WAAW,EAAE;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,EAAE,CAAA;KAAE,CAAC;IACnD,uFAAuF;IACvF,QAAQ,EAAE,MAAM,CAAC;CAClB;AAED,wFAAwF;AACxF,eAAO,MAAM,yBAAyB,KAAK,CAAC;AAE5C,mFAAmF;AACnF,eAAO,MAAM,gCAAgC,KAAK,CAAC;AAEnD;;;;;;;;;;;GAWG;AACH,wBAAgB,cAAc,CAAC,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,YAAY,GAAG,MAAM,CAAC,GAAG,OAAO,CAEjF;AAED,sGAAsG;AACtG,MAAM,WAAW,cAAc;IAC7B,GAAG,EAAE,MAAM,CAAC;IACZ,SAAS,EAAE,MAAM,CAAC;CACnB;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAgB,gBAAgB,CAC9B,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,mBAAmB,GAAG,YAAY,CAAC,EACtD,OAAO,EAAE,cAAc,GAAG,IAAI,GAAG,SAAS,GACzC,MAAM,GAAG,IAAI,CAGf;AAeD,MAAM,WAAW,mBAAmB;IAClC,uCAAuC;IACvC,aAAa,EAAE,MAAM,CAAC;IACtB,2CAA2C;IAC3C,WAAW,EAAE,mBAAmB,CAAC;IACjC,qCAAqC;IACrC,gBAAgB,EAAE,MAAM,CAAC;IACzB,kFAAkF;IAClF,kBAAkB,EAAE,MAAM,CAAC;IAC3B,0DAA0D;IAC1D,eAAe,EAAE,MAAM,CAAC;IACxB,2EAA2E;IAC3E,oBAAoB,EAAE,MAAM,CAAC;IAC7B,+DAA+D;IAC/D,aAAa,EAAE,MAAM,CAAC;IACtB,iFAAiF;IACjF,qBAAqB,EAAE,0BAA0B,CAAC;IAClD;;;;;;;OAOG;IACH,kBAAkB,EAAE,wBAAwB,GAAG,IAAI,CAAC;IACpD;;;;;;OAMG;IACH,UAAU,EAAE,oBAAoB,GAAG,IAAI,CAAC;IACxC;;;;;OAKG;IACH,SAAS,EAAE,mBAAmB,GAAG,IAAI,CAAC;IACtC;;;;OAIG;IACH,SAAS,EAAE,oBAAoB,GAAG,IAAI,CAAC;IACvC,kFAAkF;IAClF,UAAU,EAAE,gBAAgB,GAAG,IAAI,CAAC;IACpC,oFAAoF;IACpF,MAAM,EAAE;QACN,IAAI,EACA,OAAO,GACP,OAAO,GACP,IAAI,GACJ,MAAM,GACN,aAAa,GACb,SAAS,GACT,kBAAkB,GAClB,qBAAqB,GACrB,UAAU,GACV,WAAW,GACX,YAAY,GAEZ,aAAa,CAAC;QAClB,EAAE,EAAE,MAAM,CAAC;QACX,KAAK,EAAE,MAAM,CAAC;KACf,EAAE,CAAC;CACL;AAED,sEAAsE;AACtE,4DAA4D;AAC5D,MAAM,WAAW,gBAAgB;IAC/B,qEAAqE;IACrE,MAAM,EAAE,MAAM,CAAC;IACf,uDAAuD;IACvD,OAAO,EAAE,MAAM,CAAC;IAChB;;;OAGG;IACH,UAAU,EAAE,MAAM,CAAC;IACnB;;;;;;;;;;;;;;OAcG;IACH,OAAO,CAAC,EAAE,iBAAiB,EAAE,CAAC;CAC/B;AAED,uDAAuD;AACvD,MAAM,WAAW,iBAAiB;IAChC,QAAQ,EAAE,QAAQ,CAAC;IACnB,OAAO,EAAE,OAAO,CAAC;IACjB,aAAa;IACb,KAAK,EAAE,MAAM,CAAC;IACd,mGAAmG;IACnG,QAAQ,EAAE,MAAM,EAAE,CAAC;CACpB;AAED,MAAM,WAAW,oBAAoB;IACnC,qDAAqD;IACrD,OAAO,EAAE,MAAM,CAAC;IAChB,8EAA8E;IAC9E,MAAM,EAAE,MAAM,CAAC;IACf,yDAAyD;IACzD,MAAM,EAAE,MAAM,CAAC;IACf,kFAAkF;IAClF,GAAG,EAAE,MAAM,GAAG,IAAI,CAAC;CACpB;AAED,sEAAsE;AACtE,MAAM,WAAW,0BAA0B;IACzC,0DAA0D;IAC1D,MAAM,EAAE,MAAM,CAAC;IACf,sCAAsC;IACtC,OAAO,EAAE,MAAM,CAAC;IAChB,6BAA6B;IAC7B,IAAI,EAAE,MAAM,CAAC;IACb,mEAAmE;IACnE,MAAM,EAAE,MAAM,CAAC;IACf,0DAA0D;IAC1D,OAAO,EAAE,MAAM,CAAC;CACjB;AAsBD;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAsB,gBAAgB,CACpC,IAAI,EAAE,SAAS,EACf,OAAO,EAAE,oBAAoB,GAC5B,OAAO,CAAC,mBAAmB,CAAC,CAmiB9B;AA8HD,wFAAwF;AACxF,MAAM,WAAW,qBAAqB;IACpC,IAAI,IAAI,IAAI,CAAC;CACd;AAED,MAAM,WAAW,2BAA4B,SAAQ,oBAAoB;IACvE;;;;OAIG;IACH,UAAU,EAAE,MAAM,CAAC;IACnB,sFAAsF;IACtF,MAAM,CAAC,EAAE,CAAC,OAAO,EAAE,mBAAmB,GAAG;QAAE,KAAK,EAAE,MAAM,CAAA;KAAE,KAAK,IAAI,CAAC;IACpE,0DAA0D;IAC1D,QAAQ,CAAC,EAAE,CAAC,EAAE,EAAE,MAAM,IAAI,EAAE,EAAE,EAAE,MAAM,KAAK,OAAO,CAAC;IACnD,UAAU,CAAC,EAAE,CAAC,MAAM,EAAE,OAAO,KAAK,IAAI,CAAC;CACxC;AAED;;;;;;;GAOG;AACH,wBAAgB,oBAAoB,CAClC,IAAI,EAAE,SAAS,EACf,OAAO,EAAE,2BAA2B,GACnC,qBAAqB,CAuBvB"}

package/dist/platform-sweep.js

@@ -1,6 +1,7 @@
-import { instant } from '@substrat-run/contracts';
+import { drainedEvent, instant } from '@substrat-run/contracts';
 import { backoffAt } from './scope-host.js';
 import { MIGRATION_FLAG_THRESHOLD, migrationFleet, migrationProgress, scopeMigrationState } from './migration-progress.js';
+import { UNDRAINED_SKIPPED_IDS } from './outbox-event.js';
 /** How many access rows one pass ships, and one pass prunes, by default. */
 const ACCESS_LOG_BATCH = 500;
 /** How many events one pass drains PER SCOPE by default. */
@@ -90,6 +91,62 @@ export const SCHEDULE_STATE_REBUILD = `
 export function scheduleStateHasKind(tableSql) {
     return tableSql.includes('PRIMARY KEY (kind, schedule_op)');
 }
+/** The #1172 phase's per-pass bound when `provisionReconcileBatch` is unset (#1653). */
+export const PROVISION_RECONCILE_BATCH = 50;
+/** How many `unsupported` scope ids one report carries — the count stays exact. */
+export const PROVISION_RECONCILE_REPORTED_IDS = 50;
+/**
+ * A scope the platform may treat as the REAL install, rather than a copy of one (#1172,
+ * #1653). The directory is the only oracle for this, and it takes BOTH tests, not one.
+ *
+ * A fork is an archive or a preview of somebody else's data, and re-provisioning one
+ * runs the vertical's install-side hook against a copy, minting a second set of whatever
+ * it mints — or, since #1656, putting a copy of production on a sweeper that reaps and
+ * assigns. But a CLEAN-ROOM preview (#509) is an empty scope with no source to copy, so
+ * it carries `kind: 'preview'` and NO `forkedFrom` — the reap sweep keys on `kind` for
+ * exactly that reason. Filtering on lineage alone would let those through, which is the
+ * one shape of scope where the hook's effects are least wanted.
+ */
+export function isPrimaryScope(scope) {
+    return !scope.forkedFrom && scope.kind !== 'preview';
+}
+/**
+ * The version whose code actually executes for `scope` (#1653) — which is not always the
+ * one it is bound to.
+ *
+ * A scope on its vertical's stable serving script (`servingRef`, #286) runs whatever that
+ * script serves, and a promote re-uploads the script in place: the code changes under
+ * the scope at that moment, whatever its version pointer says. For a PRIVATE vertical
+ * the promote moves the pointer too, so the two agree. For a LISTED one it does not —
+ * the pointer is the tenant's, and moves only on their Update — so an install can run
+ * version N+1 with its provision state still at N. Measuring against the running version
+ * is what lets the reconcile follow the code instead of the pointer.
+ *
+ * Falls back to the bound version whenever the serving script cannot be named: a scope
+ * with no `servingRef` (legacy per-version dispatch, where the bound version's own
+ * script IS what runs), a vertical with nothing served in place yet, or a `servingRef`
+ * that is not the vertical's current one. The fallback is exactly the pre-#1653 answer,
+ * so an unknown never manufactures a reconcile.
+ */
+export function runningVersionOf(scope, serving) {
+    if (scope.servingRef && serving && scope.servingRef === serving.ref)
+        return serving.versionId;
+    return scope.verticalVersionId;
+}
+/**
+ * This pass's share of the behind scopes: at most `batch`, as a contiguous window over
+ * the id order, starting at `rng()` of the way round and wrapping. Deterministic for a
+ * given `rng`, which is what makes the fairness claim testable.
+ */
+function reconcileWindow(behind, batch, rng) {
+    if (behind.length <= batch)
+        return [...behind];
+    if (batch <= 0)
+        return [];
+    const ordered = [...behind].sort((a, b) => (a.id < b.id ? -1 : a.id > b.id ? 1 : 0));
+    const start = Math.min(ordered.length - 1, Math.max(0, Math.floor(rng() * ordered.length)));
+    return Array.from({ length: batch }, (_, i) => ordered[(start + i) % ordered.length]);
+}
 const message = (err) => (err instanceof Error ? err.message : String(err));
 /**
  * Run `fn` over `items` with at most `limit` in flight. `fn` owns its errors —
@@ -283,53 +340,81 @@ export async function runPlatformSweep(host, options) {
             }
         });
     }
-    // -- provision reconcile (#1172) --------------------------------------------
+    // -- provision reconcile (#1172, #1653) -------------------------------------
     // A vertical's `onProvision` runs once per scope, at install. So a scope serving code
     // whose provision hook never ran against it is missing whatever that hook creates —
     // and no other path will ever deliver it. This phase is what makes a push repair its
-    // own installs: bound version != provisioned version ⇒ reconcile once, then record it.
+    // own installs: running version != provisioned version ⇒ reconcile once, then record it.
+    //
+    // RUNNING, not bound (#1653): a listed vertical's promote re-serves every install in
+    // place and moves none of their pointers, so comparing against the pointer never saw
+    // those installs at all. See `runningVersionOf`.
     //
     // AFTER the migration phase and skipping what failed there, like every phase that
     // touches a vertical: a fail-closed scope would only re-throw its migration error.
     if (options.reconcileScopeFn) {
         const reconcile = options.reconcileScopeFn;
-        const provisionReconcile = { behind: 0, reconciled: 0, failed: 0 };
-        /**
-         * Primaries only — and that takes BOTH tests, not one.
-         *
-         * A fork is an archive or a preview of somebody else's data, and re-provisioning one
-         * runs the vertical's install-side hook against a copy, minting a second set of
-         * whatever it mints. But a CLEAN-ROOM preview (#509) is an empty scope with no source
-         * to copy, so it carries `kind: 'preview'` and NO `forkedFrom` — the reap sweep keys
-         * on `kind` for exactly that reason. Filtering on lineage alone would let those
-         * through, which is the one shape of scope where the hook's effects are least wanted.
-         */
-        const scopes = (await host.admin.listScopes(options.actor, { status: 'active' })).filter((s) => !s.forkedFrom && s.kind !== 'preview');
-        await mapBounded(scopes, concurrency, async (s) => {
-            if (failedThisPass.has(s.id))
-                return;
-            // No bound version ⇒ nothing to compare, and nothing a reconcile could target.
-            if (!s.verticalVersionId)
-                return;
+        const provisionReconcile = {
+            behind: 0,
+            reconciled: 0,
+            failed: 0,
+            unsupported: { count: 0, scopeIds: [] },
+            deferred: 0,
+        };
+        const scopes = (await host.admin.listScopes(options.actor, { status: 'active' })).filter((s) => isPrimaryScope(s) && !failedThisPass.has(s.id));
+        // One directory read for every vertical's serving pointer — and only when some scope
+        // is actually on a serving script, since nothing else can differ from its binding.
+        const serving = new Map();
+        if (scopes.some((s) => s.servingRef)) {
+            for (const v of await host.admin.listVerticals(options.actor)) {
+                if (v.servingRef && v.servingVersionId) {
+                    serving.set(v.slug, { ref: v.servingRef, versionId: v.servingVersionId });
+                }
+            }
+        }
+        const behind = [];
+        for (const s of scopes) {
+            const running = runningVersionOf(s, s.vertical ? serving.get(s.vertical) : null);
+            // No running version ⇒ nothing to compare, and nothing a reconcile could target.
+            if (!running)
+                continue;
             // A null receipt is "unknown", NOT "up to date": a scope provisioned before the
             // platform recorded this has no evidence either way, and guessing the optimistic
             // answer leaves exactly the broken installs this phase exists to heal. It costs
             // one reconcile per pre-existing scope, once, and then the receipt is there.
-            if (s.provisionedVersionId === s.verticalVersionId)
-                return;
-            provisionReconcile.behind += 1;
-            const target = s.verticalVersionId;
+            if (s.provisionedVersionId === running)
+                continue;
+            behind.push({ id: s.id, tenantId: s.tenantId, target: running });
+        }
+        provisionReconcile.behind = behind.length;
+        const batch = options.provisionReconcileBatch ?? PROVISION_RECONCILE_BATCH;
+        const window = reconcileWindow(behind, batch, options.provisionReconcileRng ?? Math.random);
+        provisionReconcile.deferred = behind.length - window.length;
+        await mapBounded(window, concurrency, async (s) => {
             try {
-                await reconcile(s.tenantId, s.id);
+                const outcome = await reconcile(s.tenantId, s.id, s.target);
+                if (outcome === 'unsupported') {
+                    // Nothing ran, so there is nothing true to record: left unmarked, like a
+                    // failure, and asked again next pass. Not an error — the vertical answered
+                    // exactly, and it is not the kind of refusal a person has to act on per pass.
+                    provisionReconcile.unsupported.count += 1;
+                    if (provisionReconcile.unsupported.scopeIds.length < PROVISION_RECONCILE_REPORTED_IDS) {
+                        provisionReconcile.unsupported.scopeIds.push(s.id);
+                    }
+                    return;
+                }
                 // Marked with the version we RECONCILED against, read before the call — not
-                // whatever the scope happens to be bound to now. A push that lands mid-pass must
-                // not have its new version marked by a reconcile that ran against the old one.
-                await host.admin.markScopeProvisioned(options.actor, s.tenantId, s.id, target);
+                // whatever the scope runs now. A promote that lands mid-pass must not have its
+                // new version marked by a reconcile that ran against the old one. The serving
+                // pointer is written only after its upload succeeds, so the version read here is
+                // one the script was already running when the pass read it.
+                await host.admin.markScopeProvisioned(options.actor, s.tenantId, s.id, s.target);
                 provisionReconcile.reconciled += 1;
             }
             catch (err) {
                 // Left unmarked on purpose: it stays behind and is retried next pass, which is
-                // the whole difference between a backstop and a one-shot.
+                // the whole difference between a backstop and a one-shot. One scope's failure
+                // is its own: the rest of the window carries on.
                 provisionReconcile.failed += 1;
                 report.errors.push({ kind: 'provision-reconcile', id: s.id, error: message(err) });
             }
@@ -585,11 +670,14 @@ export async function runPlatformSweep(host, options) {
         const drainable = await host.admin.listScopes(options.actor, { status: 'active' });
         await mapBounded(drainable, concurrency, async (s) => {
             try {
-                const shipped = await drainScopeEvents(host, options, sink, {
+                const { shipped, skipped } = await drainScopeEvents(host, options, sink, {
                     tenantId: s.tenantId,
                     scopeId: s.id,
                     budget,
                 });
+                if (skipped) {
+                    (report.eventDrain.skipped ??= []).push({ tenantId: s.tenantId, scopeId: s.id, ...skipped });
+                }
                 if (shipped === 0)
                     return;
                 report.eventDrain.scopes += 1;
@@ -643,14 +731,50 @@ export async function runPlatformSweep(host, options) {
  *
  * Nothing is pruned. The outbox is still read by consumers, replay and
  * `readHistory`; what the stamp buys today is knowing what has left.
+ *
+ * What the read stepped over (#1636) comes back beside the count, for the report —
+ * and ONLY for the report: those rows were never in `events`, so nothing here can
+ * ship or stamp them. A host too old to say leaves it undefined.
+ *
+ * **And every event is parsed here, by the published `drainedEvent`, before the sink sees
+ * it** (#1641). This is the last point before an append-only lake, and it is the control
+ * plane's: a hosted scope's events arrive over HTTP from the vertical's own deployment,
+ * decoded by whatever adapter version that vertical was pushed with. A vertical older
+ * than #1636 decodes the envelope and copies its lifted columns unvalidated, so without
+ * this parse a corrupt one would still ship — the invariant would hold only for verticals
+ * new enough to hold it themselves. An event that fails is treated exactly as the read's
+ * own skips are: not shipped, not stamped, and folded into `skipped`.
  */
 async function drainScopeEvents(host, options, sink, input) {
-    const events = await host.admin.readUndrainedEvents(options.actor, input.tenantId, input.scopeId, input.budget);
+    const read = await host.admin.readUndrainedEvents(options.actor, input.tenantId, input.scopeId, input.budget);
+    // A plain array to the sink, of the published schema's own output: nothing typed as a
+    // DrainedEvent reaches the lake unless the schema accepted it here.
+    const events = [];
+    const refused = [];
+    for (const event of read) {
+        const parsed = drainedEvent.safeParse(event);
+        if (parsed.success)
+            events.push(parsed.data);
+        else
+            refused.push(String(event?.id));
+    }
+    const skipped = skippedOf(read.skipped, refused);
     if (events.length === 0)
-        return 0;
+        return { shipped: 0, skipped };
     await sink.ship({ tenantId: input.tenantId, scopeId: input.scopeId }, events);
     await host.admin.markEventsDrained(options.actor, input.tenantId, input.scopeId, events.map((e) => e.id));
-    return events.length;
+    return { shipped: events.length, skipped };
+}
+/**
+ * The read's own skip, plus the events this side refused (#1641): one count, exact, and the
+ * ids capped as the read caps them. Undefined when there was neither — a clean pass reports
+ * nothing rather than a zero.
+ */
+function skippedOf(read, refused) {
+    const count = (read?.count ?? 0) + refused.length;
+    if (count === 0)
+        return undefined;
+    return { count, eventIds: [...(read?.eventIds ?? []), ...refused].slice(0, UNDRAINED_SKIPPED_IDS) };
 }
 /**
  * One ship→stamp→prune cycle over the access log. Split out because the ORDER is the