@substrat-run/kernel 0.135.0 → 0.137.0

package/dist/refusals.js

@@ -1,11 +1,12 @@
 /**
- * Refused transitions, recorded (#1745).
+ * Refused transitions and refusing guards, recorded (#1745).
  *
  * An illegal move is refused inside the operation by `assertTransition`, which throws a
- * `conflict`. The operation's transaction rolls back with it, so nothing about the attempt
- * survives — the denial log holds permission refusals only, and the outbox only what
- * committed. That made "someone tried to reopen a closed conversation twelve times" a fact
- * nobody could see: not on the process map, not in a finding.
+ * `conflict`; a manifest-declared guard (K-38) refuses the operation it stands before the
+ * same way, before the handler runs. The operation's transaction rolls back with either, so
+ * nothing about the attempt survives — the denial log holds permission refusals only, and
+ * the outbox only what committed. That made "someone tried to reopen a closed conversation
+ * twelve times" a fact nobody could see: not on the process map, not in a finding.
  *
  * Recorded the way a denial is (K-35): on the failure path, AFTER the rollback, as a write
  * of its own, so the attempt survives the transaction that refused it. Kernel-owned and
@@ -14,53 +15,171 @@
  *
  * Only a refusal that FAILED the operation is recorded. One a vertical caught inside
  * `ctx.atomic` and recovered from is the vertical's business — its operation committed.
+ *
+ * **What a row holds, and what it never does.** Keys and vocabulary only: the record's type
+ * (held to the entity-type grammar, `refusalEntityType`) and id, state names, operation and
+ * predicate names, the problem code (held to the `problemReason` grammar), the actor's id
+ * and the call's. Never the error's message, the operation's input, or a guard's config —
+ * any of those can quote what a person typed. So a row has nothing for a subject erasure to rewrite
+ * (master-plan §5.3: pseudonymous keys and transaction facts remain), which is the denial
+ * log's position too, and it is kept the way the denial log is: `drained_at` marks a shipped
+ * row, and rows drain rather than expire.
  */
-import { refusedTransitionOf } from '@substrat-run/contracts';
+import { errorCodeOf, INVALID_TRANSITION, problemReason, UNRECOGNIZED_REFUSAL_REASON, refusalEntityType, refusedRecordOf, refusedTransitionOf, } from '@substrat-run/contracts';
 import { ulid } from './ulid.js';
-export const REFUSALS_DDL = `
+/** The table alone — what `REFUSALS_REBUILD` creates under its scratch name. */
+export const REFUSALS_TABLE_DDL = `
   CREATE TABLE IF NOT EXISTS _substrat_refusals (
     id TEXT PRIMARY KEY,
-    -- 'transition' today; a guard refusal (K-38) is the next kind, recorded the same way.
+    -- 'transition' (assertTransition) or 'guard' (a manifest-declared guard, K-38).
     kind TEXT NOT NULL,
     tenant_id TEXT NOT NULL,
     scope_id TEXT,
-    -- The record the move was refused on. NULL when the caller of assertTransition did
-    -- not name it: the attempt is still recorded, and cannot be counted against an entity.
+    -- The record the refusal was about. NULL when the refusing code did not name it: the
+    -- attempt is still recorded, and cannot be counted against an entity.
     entity_type TEXT,
     entity_id TEXT,
-    from_state TEXT NOT NULL,
+    -- The state the record was in. NULL on a guard row: a guard stands before an operation,
+    -- and the kernel that ran it cannot know the state of the record behind it.
+    from_state TEXT,
     -- Where the operation leads where it IS legal; NULL when that is not one state.
     attempted_state TEXT,
-    -- The lifecycle's operation (what the edge is keyed by) and the invoke() string the
-    -- call ran as; the same today for every caller, kept apart because they need not be.
+    -- The lifecycle's operation (what the edge is keyed by), or the one a guard stands
+    -- before, and the invoke() string the call ran as.
     operation TEXT NOT NULL,
     invoked_operation TEXT,
+    -- The guard's named predicate; NULL on a transition row.
+    guard TEXT,
+    -- The problem code the operation failed with (the 409's reason). NULL on a row written
+    -- before the column, where the kind implies it.
+    reason TEXT,
     actor TEXT NOT NULL,
     impersonation TEXT,
     invocation_id TEXT,
     at TEXT NOT NULL,
     drained_at TEXT
   );
-  -- The process map's read: one entity type's refusals in a window.
+`;
+/** The process map's read: one entity type's refusals in a window. */
+export const REFUSALS_INDEX = `
   CREATE INDEX IF NOT EXISTS _substrat_refusals_entity_at ON _substrat_refusals (entity_type, at);
 `;
+/**
+ * The table and its index. The adapters interpolate the two literals above instead, which
+ * is what `lint:spine-ddl` can resolve; this is for a caller that wants the whole thing.
+ */
+export const REFUSALS_DDL = REFUSALS_TABLE_DDL + REFUSALS_INDEX;
+/**
+ * `_substrat_refusals` rebuilt to the shape above on a store created before guard refusals:
+ * `from_state` loses its NOT NULL and `guard` / `reason` join. Create-copy-drop-rename,
+ * because SQLite cannot relax a constraint in place — `SCHEDULE_STATE_REBUILD`'s shape and
+ * reasons (#1288), detected the same way (`refusalsAdmitGuards`, off `sqlite_master.sql`,
+ * which DO SQLite serves and `PRAGMA` does not).
+ *
+ * The new table is `REFUSALS_TABLE_DDL` under a temporary name, so the rebuilt shape cannot drift
+ * from the created one, and every row is copied verbatim: the two new columns are NULL on a
+ * transition row written before them, which the reader takes as "implied by the kind". The
+ * index is dropped with the old table and created again on the renamed one.
+ *
+ * **Run inside the adapter's transaction API**, as both callers do: un-wrapped, a stop
+ * between the DROP and the RENAME leaves the next wake's `CREATE TABLE IF NOT EXISTS` an
+ * empty table of the new shape, detection reads it as migrated, and the copied rows are
+ * orphaned in the scratch table. The leading `DROP TABLE IF EXISTS` makes a re-run start
+ * clean. A restore never reaches this: it builds the table from the current DDL and loads a
+ * legacy dump's rows by column name.
+ */
+export const REFUSALS_REBUILD = `
+  DROP TABLE IF EXISTS _substrat_refusals_new;
+  ${REFUSALS_TABLE_DDL.replace('CREATE TABLE IF NOT EXISTS _substrat_refusals (', 'CREATE TABLE _substrat_refusals_new (')}
+  INSERT INTO _substrat_refusals_new
+    (id, kind, tenant_id, scope_id, entity_type, entity_id, from_state, attempted_state,
+     operation, invoked_operation, actor, impersonation, invocation_id, at, drained_at)
+    SELECT id, kind, tenant_id, scope_id, entity_type, entity_id, from_state, attempted_state,
+           operation, invoked_operation, actor, impersonation, invocation_id, at, drained_at
+      FROM _substrat_refusals;
+  DROP TABLE _substrat_refusals;
+  ALTER TABLE _substrat_refusals_new RENAME TO _substrat_refusals;
+  ${REFUSALS_INDEX}
+`;
+/**
+ * Whether a store's `_substrat_refusals` already admits a guard row, read off the `sql`
+ * column of `sqlite_master`. `false` means `REFUSALS_REBUILD` is due.
+ */
+export function refusalsAdmitGuards(tableSql) {
+    // Line-anchored: the stored DDL keeps its comments, and a comment may say "guard".
+    return /^\s*guard TEXT,?\s*$/m.test(tableSql);
+}
+const REFUSED_GUARD = Symbol.for('substrat.refused-guard');
+/**
+ * Mark a guard predicate's throw as a refusal, when it is one — called by both adapters'
+ * `runGuards` around each predicate, so the two cannot disagree about what counts.
+ *
+ * A refusal is a `conflict`: what a predicate throws to say "not yet" (`protocol_required`).
+ * Anything else — a validation failure, a bug, a denied check (which the denial log has) —
+ * is not a guard refusing, and is left unmarked. So is a throw that already carries a
+ * refused transition: it is recorded once, as the transition it is.
+ */
+export function markGuardRefusal(err, predicate, operation) {
+    if (err === null || typeof err !== 'object' || refusedTransitionOf(err))
+        return;
+    if (errorCodeOf(err) !== 'conflict')
+        return;
+    const record = refusedRecordOf(err);
+    err[REFUSED_GUARD] = {
+        kind: 'guard',
+        predicate,
+        operation,
+        reason: keptReason(err.extensions?.reason),
+        entityType: record?.entityType ?? null,
+        entityId: record?.entityId ?? null,
+    };
+}
+/**
+ * The reason a row keeps: the problem's code when it is one (`problemReason`), the fixed
+ * `UNRECOGNIZED_REFUSAL_REASON` when it is anything else, null when there was none. The
+ * wire accepts any non-empty string here, so a predicate could put request text in it.
+ */
+function keptReason(reason) {
+    if (reason === undefined || reason === null)
+        return null;
+    return problemReason.safeParse(reason).success ? reason : UNRECOGNIZED_REFUSAL_REASON;
+}
+/** The refusal an operation failed with — a transition, a guard, or null for anything else. */
+export function refusalOf(err) {
+    const transition = refusedTransitionOf(err);
+    if (transition)
+        return transition;
+    if (err === null || typeof err !== 'object')
+        return null;
+    const g = err[REFUSED_GUARD];
+    return g !== null && typeof g === 'object' ? g : null;
+}
 /** The one INSERT both adapters run, so the rows they write cannot differ. */
 export function refusalInsert(row) {
+    const r = row.refused;
+    const guard = 'kind' in r && r.kind === 'guard' ? r : null;
+    const transition = guard ? null : r;
     return {
         sql: `INSERT INTO _substrat_refusals
             (id, kind, tenant_id, scope_id, entity_type, entity_id, from_state, attempted_state,
-             operation, invoked_operation, actor, impersonation, invocation_id, at)
-          VALUES (?, 'transition', ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`,
+             operation, invoked_operation, guard, reason, actor, impersonation, invocation_id, at)
+          VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`,
         params: [
             ulid(),
+            guard ? 'guard' : 'transition',
             row.tenantId,
             row.scopeId,
-            row.refused.entityType,
-            row.refused.entityId,
-            row.refused.from,
-            row.refused.attempted,
-            row.refused.operation,
+            // The type reaches here from code that may be handed request data; kept only when it
+            // is spelled as one. The id stays: it is the record's key, the join every log shares.
+            refusalEntityType(r.entityType),
+            r.entityId,
+            transition?.from ?? null,
+            transition?.attempted ?? null,
+            r.operation,
             row.invokedOperation,
+            guard?.predicate ?? null,
+            // Bounded here too, the one INSERT, so no caller of this function can keep raw text.
+            guard ? keptReason(guard.reason) : INVALID_TRANSITION,
             row.actor,
             row.impersonation,
             row.invocationId,
@@ -68,6 +187,6 @@ export function refusalInsert(row) {
         ],
     };
 }
-/** The refused transition an operation failed with, or null — what the adapters branch on. */
+/** The refused transition an operation failed with, or null. */
 export { refusedTransitionOf };
 //# sourceMappingURL=refusals.js.map

package/dist/refusals.js.map

@@ -1 +1 @@
-{"version":3,"file":"refusals.js","sourceRoot":"","sources":["../src/refusals.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AACH,OAAO,EAAE,mBAAmB,EAA0B,MAAM,yBAAyB,CAAC;AACtF,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAEjC,MAAM,CAAC,MAAM,YAAY,GAAG;;;;;;;;;;;;;;;;;;;;;;;;;;CA0B3B,CAAC;AAcF,8EAA8E;AAC9E,MAAM,UAAU,aAAa,CAAC,GAAe;IAC3C,OAAO;QACL,GAAG,EAAE;;;uEAG8D;QACnE,MAAM,EAAE;YACN,IAAI,EAAE;YACN,GAAG,CAAC,QAAQ;YACZ,GAAG,CAAC,OAAO;YACX,GAAG,CAAC,OAAO,CAAC,UAAU;YACtB,GAAG,CAAC,OAAO,CAAC,QAAQ;YACpB,GAAG,CAAC,OAAO,CAAC,IAAI;YAChB,GAAG,CAAC,OAAO,CAAC,SAAS;YACrB,GAAG,CAAC,OAAO,CAAC,SAAS;YACrB,GAAG,CAAC,gBAAgB;YACpB,GAAG,CAAC,KAAK;YACT,GAAG,CAAC,aAAa;YACjB,GAAG,CAAC,YAAY;YAChB,GAAG,CAAC,EAAE;SACP;KACF,CAAC;AACJ,CAAC;AAED,8FAA8F;AAC9F,OAAO,EAAE,mBAAmB,EAAE,CAAC"}
+{"version":3,"file":"refusals.js","sourceRoot":"","sources":["../src/refusals.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AACH,OAAO,EACL,WAAW,EACX,kBAAkB,EAClB,aAAa,EACb,2BAA2B,EAC3B,iBAAiB,EACjB,eAAe,EACf,mBAAmB,GAEpB,MAAM,yBAAyB,CAAC;AACjC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAEjC,gFAAgF;AAChF,MAAM,CAAC,MAAM,kBAAkB,GAAG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CA+BjC,CAAC;AAEF,sEAAsE;AACtE,MAAM,CAAC,MAAM,cAAc,GAAG;;CAE7B,CAAC;AAEF;;;GAGG;AACH,MAAM,CAAC,MAAM,YAAY,GAAG,kBAAkB,GAAG,cAAc,CAAC;AAEhE;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,CAAC,MAAM,gBAAgB,GAAG;;IAE5B,kBAAkB,CAAC,OAAO,CAAC,iDAAiD,EAAE,uCAAuC,CAAC;;;;;;;;;IAStH,cAAc;CACjB,CAAC;AAEF;;;GAGG;AACH,MAAM,UAAU,mBAAmB,CAAC,QAAgB;IAClD,mFAAmF;IACnF,OAAO,uBAAuB,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;AAChD,CAAC;AAmBD,MAAM,aAAa,GAAG,MAAM,CAAC,GAAG,CAAC,wBAAwB,CAAC,CAAC;AAE3D;;;;;;;;GAQG;AACH,MAAM,UAAU,gBAAgB,CAAC,GAAY,EAAE,SAAiB,EAAE,SAAiB;IACjF,IAAI,GAAG,KAAK,IAAI,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,mBAAmB,CAAC,GAAG,CAAC;QAAE,OAAO;IAChF,IAAI,WAAW,CAAC,GAAG,CAAC,KAAK,UAAU;QAAE,OAAO;IAC5C,MAAM,MAAM,GAAG,eAAe,CAAC,GAAG,CAAC,CAAC;IACnC,GAAoC,CAAC,aAAa,CAAC,GAAG;QACrD,IAAI,EAAE,OAAO;QACb,SAAS;QACT,SAAS;QACT,MAAM,EAAE,UAAU,CAAE,GAA6C,CAAC,UAAU,EAAE,MAAM,CAAC;QACrF,UAAU,EAAE,MAAM,EAAE,UAAU,IAAI,IAAI;QACtC,QAAQ,EAAE,MAAM,EAAE,QAAQ,IAAI,IAAI;KACnC,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,SAAS,UAAU,CAAC,MAAe;IACjC,IAAI,MAAM,KAAK,SAAS,IAAI,MAAM,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC;IACzD,OAAO,aAAa,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC,CAAC,CAAE,MAAiB,CAAC,CAAC,CAAC,2BAA2B,CAAC;AACpG,CAAC;AAED,+FAA+F;AAC/F,MAAM,UAAU,SAAS,CAAC,GAAY;IACpC,MAAM,UAAU,GAAG,mBAAmB,CAAC,GAAG,CAAC,CAAC;IAC5C,IAAI,UAAU;QAAE,OAAO,UAAU,CAAC;IAClC,IAAI,GAAG,KAAK,IAAI,IAAI,OAAO,GAAG,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC;IACzD,MAAM,CAAC,GAAI,GAA+B,CAAC,aAAa,CAAC,CAAC;IAC1D,OAAO,CAAC,KAAK,IAAI,IAAI,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAE,CAAkB,CAAC,CAAC,CAAC,IAAI,CAAC;AAC1E,CAAC;AAeD,8EAA8E;AAC9E,MAAM,UAAU,aAAa,CAAC,GAAe;IAC3C,MAAM,CAAC,GAAG,GAAG,CAAC,OAAO,CAAC;IACtB,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,CAAC,IAAI,KAAK,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IAC3D,MAAM,UAAU,GAAG,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAE,CAAuB,CAAC;IAC3D,OAAO;QACL,GAAG,EAAE;;;kEAGyD;QAC9D,MAAM,EAAE;YACN,IAAI,EAAE;YACN,KAAK,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,YAAY;YAC9B,GAAG,CAAC,QAAQ;YACZ,GAAG,CAAC,OAAO;YACX,qFAAqF;YACrF,sFAAsF;YACtF,iBAAiB,CAAC,CAAC,CAAC,UAAU,CAAC;YAC/B,CAAC,CAAC,QAAQ;YACV,UAAU,EAAE,IAAI,IAAI,IAAI;YACxB,UAAU,EAAE,SAAS,IAAI,IAAI;YAC7B,CAAC,CAAC,SAAS;YACX,GAAG,CAAC,gBAAgB;YACpB,KAAK,EAAE,SAAS,IAAI,IAAI;YACxB,qFAAqF;YACrF,KAAK,CAAC,CAAC,CAAC,UAAU,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,kBAAkB;YACrD,GAAG,CAAC,KAAK;YACT,GAAG,CAAC,aAAa;YACjB,GAAG,CAAC,YAAY;YAChB,GAAG,CAAC,EAAE;SACP;KACF,CAAC;AACJ,CAAC;AAED,gEAAgE;AAChE,OAAO,EAAE,mBAAmB,EAAE,CAAC"}

package/dist/routed-node.d.ts

@@ -16,8 +16,9 @@ export declare const ROUTED_ID: RegExp;
  *
  * The router resolves `hostname → (tenant, scope, surface)` and forwards over a
  * service binding with that resolution in headers. This is the vertical's side of
- * that contract, in the kernel because every vertical needs it and none of them
- * should be re-deriving how to trust it.
+ * that contract, shared because every vertical needs it and none of them should be
+ * re-deriving how to trust it. Moving from the kernel to `vertical-host` (#1978), which
+ * already re-exports it.
  *
  * Web-standard only and structurally typed: the base tsconfig is `ES2023` with no
  * DOM lib, deliberately, so no package assumes a browser. Taking the one method we

package/dist/routed-node.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"routed-node.d.ts","sourceRoot":"","sources":["../src/routed-node.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,yBAAyB,CAAC;AAEjE;;;;;;;;;;GAUG;AACH,eAAO,MAAM,SAAS,QAA6B,CAAC;AAEpD;;;;;;;;;;;;GAYG;AAEH,iFAAiF;AACjF,MAAM,WAAW,YAAY;IAC3B,GAAG,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAAC;CAClC;AAED,MAAM,WAAW,UAAU;IACzB,QAAQ,EAAE,QAAQ,CAAC;IACnB,OAAO,EAAE,OAAO,CAAC;IACjB,oFAAoF;IACpF,OAAO,EAAE,MAAM,CAAC;IAChB,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;CAC7B;AAED,oFAAoF;AACpF,qBAAa,oBAAqB,SAAQ,KAAK;CAAG;AAElD,MAAM,WAAW,qBAAqB;IACpC;;;;OAIG;IACH,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB;;;;;;;;;;;OAWG;IACH,aAAa,CAAC,EAAE,OAAO,CAAC;CACzB;AAED;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,wBAAgB,cAAc,CAC5B,OAAO,EAAE,YAAY,EACrB,OAAO,GAAE,qBAA0B,GAClC,UAAU,GAAG,IAAI,CA6BnB"}
+{"version":3,"file":"routed-node.d.ts","sourceRoot":"","sources":["../src/routed-node.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,yBAAyB,CAAC;AAEjE;;;;;;;;;;GAUG;AACH,eAAO,MAAM,SAAS,QAA6B,CAAC;AAEpD;;;;;;;;;;;;;GAaG;AAEH,iFAAiF;AACjF,MAAM,WAAW,YAAY;IAC3B,GAAG,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAAC;CAClC;AAED,MAAM,WAAW,UAAU;IACzB,QAAQ,EAAE,QAAQ,CAAC;IACnB,OAAO,EAAE,OAAO,CAAC;IACjB,oFAAoF;IACpF,OAAO,EAAE,MAAM,CAAC;IAChB,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;CAC7B;AAED,oFAAoF;AACpF,qBAAa,oBAAqB,SAAQ,KAAK;CAAG;AAElD,MAAM,WAAW,qBAAqB;IACpC;;;;OAIG;IACH,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB;;;;;;;;;;;OAWG;IACH,aAAa,CAAC,EAAE,OAAO,CAAC;CACzB;AAED;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,wBAAgB,cAAc,CAC5B,OAAO,EAAE,YAAY,EACrB,OAAO,GAAE,qBAA0B,GAClC,UAAU,GAAG,IAAI,CA6BnB"}

package/dist/routed-node.js.map

@@ -1 +1 @@
-{"version":3,"file":"routed-node.js","sourceRoot":"","sources":["../src/routed-node.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAC;AAGnD;;;;;;;;;;GAUG;AACH,MAAM,CAAC,MAAM,SAAS,GAAG,0BAA0B,CAAC;AA6BpD,oFAAoF;AACpF,MAAM,OAAO,oBAAqB,SAAQ,KAAK;CAAG;AAwBlD;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,MAAM,UAAU,cAAc,CAC5B,OAAqB,EACrB,OAAO,GAA0B,EAAE;IAEnC,MAAM,SAAS,GAAG,OAAO,CAAC,GAAG,CAAC,mBAAmB,CAAC,CAAC;IACnD,MAAM,QAAQ,GAAG,OAAO,CAAC,GAAG,CAAC,kBAAkB,CAAC,CAAC;IACjD,IAAI,CAAC,SAAS,IAAI,CAAC,QAAQ;QAAE,OAAO,IAAI,CAAC;IAEzC,MAAM,EAAE,cAAc,EAAE,aAAa,GAAG,KAAK,EAAE,GAAG,OAAO,CAAC;IAC1D,IAAI,cAAc,EAAE,CAAC;QACnB,IAAI,CAAC,aAAa,CAAC,OAAO,CAAC,GAAG,CAAC,mBAAmB,CAAC,EAAE,cAAc,CAAC,EAAE,CAAC;YACrE,MAAM,IAAI,oBAAoB,CAAC,kDAAkD,CAAC,CAAC;QACrF,CAAC;IACH,CAAC;SAAM,IAAI,CAAC,aAAa,EAAE,CAAC;QAC1B,MAAM,IAAI,oBAAoB,CAC5B,kFAAkF,CACnF,CAAC;IACJ,CAAC;IACD,IAAI,CAAC,SAAS,IAAI,CAAC,QAAQ,EAAE,CAAC;QAC5B,MAAM,IAAI,oBAAoB,CAAC,gCAAgC,CAAC,CAAC;IACnE,CAAC;IAED,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC5D,MAAM,IAAI,oBAAoB,CAAC,yCAAyC,CAAC,CAAC;IAC5E,CAAC;IAED,OAAO;QACL,QAAQ,EAAE,SAAqB;QAC/B,OAAO,EAAE,QAAmB;QAC5B,OAAO,EAAE,OAAO,CAAC,GAAG,CAAC,oBAAoB,CAAC,IAAI,KAAK;QACnD,YAAY,EAAE,OAAO,CAAC,GAAG,CAAC,qBAAqB,CAAC;KACjD,CAAC;AACJ,CAAC"}
+{"version":3,"file":"routed-node.js","sourceRoot":"","sources":["../src/routed-node.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAC;AAGnD;;;;;;;;;;GAUG;AACH,MAAM,CAAC,MAAM,SAAS,GAAG,0BAA0B,CAAC;AA8BpD,oFAAoF;AACpF,MAAM,OAAO,oBAAqB,SAAQ,KAAK;CAAG;AAwBlD;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,MAAM,UAAU,cAAc,CAC5B,OAAqB,EACrB,OAAO,GAA0B,EAAE;IAEnC,MAAM,SAAS,GAAG,OAAO,CAAC,GAAG,CAAC,mBAAmB,CAAC,CAAC;IACnD,MAAM,QAAQ,GAAG,OAAO,CAAC,GAAG,CAAC,kBAAkB,CAAC,CAAC;IACjD,IAAI,CAAC,SAAS,IAAI,CAAC,QAAQ;QAAE,OAAO,IAAI,CAAC;IAEzC,MAAM,EAAE,cAAc,EAAE,aAAa,GAAG,KAAK,EAAE,GAAG,OAAO,CAAC;IAC1D,IAAI,cAAc,EAAE,CAAC;QACnB,IAAI,CAAC,aAAa,CAAC,OAAO,CAAC,GAAG,CAAC,mBAAmB,CAAC,EAAE,cAAc,CAAC,EAAE,CAAC;YACrE,MAAM,IAAI,oBAAoB,CAAC,kDAAkD,CAAC,CAAC;QACrF,CAAC;IACH,CAAC;SAAM,IAAI,CAAC,aAAa,EAAE,CAAC;QAC1B,MAAM,IAAI,oBAAoB,CAC5B,kFAAkF,CACnF,CAAC;IACJ,CAAC;IACD,IAAI,CAAC,SAAS,IAAI,CAAC,QAAQ,EAAE,CAAC;QAC5B,MAAM,IAAI,oBAAoB,CAAC,gCAAgC,CAAC,CAAC;IACnE,CAAC;IAED,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC5D,MAAM,IAAI,oBAAoB,CAAC,yCAAyC,CAAC,CAAC;IAC5E,CAAC;IAED,OAAO;QACL,QAAQ,EAAE,SAAqB;QAC/B,OAAO,EAAE,QAAmB;QAC5B,OAAO,EAAE,OAAO,CAAC,GAAG,CAAC,oBAAoB,CAAC,IAAI,KAAK;QACnD,YAAY,EAAE,OAAO,CAAC,GAAG,CAAC,qBAAqB,CAAC;KACjD,CAAC;AACJ,CAAC"}

package/dist/scope-copy.d.ts

@@ -0,0 +1,122 @@
+import type { SwitchSql } from './system-switch.js';
+/**
+ * What a dump leaves behind when it lands in a scope other than the one it was captured from
+ * (#1686). One definition for both adapters' loaders, so the DO and the pure host agree.
+ *
+ * A load is a **copy** when the destination is not the source: a fork, a snapshot, a preview, or
+ * one scope's backup restored onto another. It is a **return** when the dump goes back into the
+ * scope it came from: a backup restore, a carry onto a new version, adopt, rebind. A copy runs as
+ * a scope of its own, so whatever in the dump is bound to being the source (a live link's secret,
+ * a side effect the source asked for) must not work in the copy. A return keeps all of it, because
+ * restoring a backup must not end live links or lose requests that were waiting.
+ *
+ * An unknown source (`sourceScopeId` or `destScopeId` absent) counts as a copy: a load that cannot
+ * say where the dump came from cannot show it is a return. Only a control plane that predates the
+ * field sends a restore with no source.
+ */
+export declare const isCopyLoad: (destScopeId: string | undefined, sourceScopeId: string | undefined) => boolean;
+/**
+ * A dump's tables as a load into `destScopeId` takes them: **capability rows never cross a scope
+ * id.** A copy loads both capability tables empty, so a live link share opens the scope it was
+ * minted in and never a copy of it; a return keeps them.
+ *
+ * Dropped, not loaded as revoked: the copy never minted those links, so a revocation recorded
+ * there would be evidence of something that did not happen in it. Names are matched without
+ * case, as SQLite resolves a table name.
+ */
+export declare function capabilitiesForLoad<T extends {
+    name: string;
+    rows: readonly unknown[];
+}>(tables: T[], destScopeId: string | undefined, sourceScopeId: string | undefined): T[];
+/**
+ * Where a scope's data came from, and whether it is a copy: at most one row, which holds two
+ * facts that are set and corrected apart (#2009).
+ *
+ * - **`events_through`, the copied-events mark.** The highest event id a load brought in from
+ *   another scope, or `''` when it brought none. Every event at or below it was emitted in another
+ *   scope; every event the scope emits itself sorts above it, because a loader re-seeds the
+ *   scope's event-id floor from `MAX(id)` (#1335) once the rows are in. Written by a load into a
+ *   scope id other than the dump's (`settleCopiedWork`), and by nothing else.
+ * - **`is_copy`, the classification.** Whether the scope is a copy (a fork, a snapshot, a
+ *   preview), which a host with no control-plane directory reads for primacy and holds inert
+ *   (#2005). Written on the directory's word only (`markCopyOrigin`), never inferred from a load:
+ *   one install's backup restored onto another install is a cross-scope load, so it carries the
+ *   source's events mark, yet the directory still says primary, and its own effects must run.
+ *   Cleared by staff's correction (`clearCopyMarker`) without touching the events mark.
+ *
+ * A scope that was never loaded from another scope and never marked holds no row. A row written
+ * before the column existed holds `is_copy` NULL, and NULL reads as a copy: such a row meant both
+ * facts at once, so every legacy store keeps exactly the behaviour it had (`IS_COPY_SQL`). The
+ * column is nullable with no DEFAULT for the reason every additive spine column is (#1883,
+ * `lint:spine-ddl`), so its "default" lives in that read. Kernel-owned and shared by both
+ * adapters' `KERNEL_DDL`, so the two cannot part company.
+ */
+export declare const COPY_ORIGIN_DDL = "\n  CREATE TABLE IF NOT EXISTS _substrat_copy_origin (\n    -- Always 1: one origin per scope. No CHECK, because lint:spine-ddl compares none.\n    id INTEGER PRIMARY KEY,\n    source_scope_id TEXT,\n    events_through TEXT NOT NULL,\n    copied_at TEXT NOT NULL,\n    -- #2009: 1 a copy, 0 not one (a load's events mark only, or a cleared marker), NULL a row\n    -- from before the column, which read as a copy and still does.\n    is_copy INTEGER\n  );\n";
+/**
+ * The predicate every read that turns an outbox row into WORK carries (consumer dispatch, executor
+ * dispatch, the Tier-2 drain): the event was emitted in this scope, not copied into it. `alias` is
+ * the outbox's alias in the caller's query (`'o.'`), or empty. A scope that was never a copy has no
+ * key, and every id compares above the empty string.
+ */
+export declare const emittedHere: (alias?: string) => string;
+/**
+ * On a copy, nothing that originated in the source produces an effect in the destination. Run
+ * inside the load's transaction, after the rows are in and BEFORE the loader queues any work of
+ * its own (the attachment-text re-extraction is a job run), or that work is settled with the
+ * source's. The history stays: every row is still
+ * there and reads as what happened at the source; only its power to cause something here goes.
+ *
+ * The platform's drain walks every active scope, and a fork, a snapshot or a preview is one, so
+ * each of these would otherwise run a second time from the copy (an email sent twice, a connector
+ * delivery repeated, a usage line billed twice):
+ *
+ * - **Pending intents** settle `failed`, "not carried", attributed to the platform.
+ * - **Executor retries** (`_substrat_deliveries` rows with a `next_attempt_at`) become terminal,
+ *   with "not carried" as their error, as a dead letter reads.
+ * - **Running job runs** settle `failed`, "not carried"; their step ledger stays as evidence.
+ * - **Events no consumer or executor has reached yet** cannot be settled row by row: an executor is
+ *   registered on the coordinator, not in the scope, so the loader cannot know who still owes one.
+ *   Instead the copy records the highest id it brought in (`_substrat_copy_origin`), and every
+ *   read that dispatches work carries `emittedHere()`. That also keeps the copy from shipping the
+ *   source's events to Tier 2 a second time.
+ *
+ * A return leaves all of it as it was, because the scope that asked for the work is the one it is
+ * back in. Settled rather than dropped: a journal row saying "not carried" explains why the event
+ * that raised it caused nothing here, where a missing row would leave a gap.
+ */
+export declare function settleCopiedWork(sql: SwitchSql, destScopeId: string | undefined, sourceScopeId: string | undefined, now: string): void;
+/**
+ * Mark this scope a copy (#2005), on the directory's word that it is not primary: a load the
+ * platform flags, the `mark-copies` repair, a reactivation, a carry's wipe or release. Sets the
+ * classification and nothing else (#2009): an origin row a load wrote keeps its events mark and
+ * source, and a scope with no row gets one whose events mark is `''`, which passes every event
+ * exactly as no row does, so dispatch is unchanged. Idempotent: answers whether this call changed
+ * anything, and a store that already reads as a copy (a legacy row included) is left as it is.
+ */
+export declare function markCopyOrigin(sql: SwitchSql, now: string): boolean;
+/**
+ * The one statement that marks a store a copy (#2005, #2009): the origin row with no events mark
+ * where none exists, or the classification set on the row that does. It only ever makes a store
+ * MORE restricted — a copy's executors are held inert — and changes no data and no events mark,
+ * which is why the scope DO lets this statement, and no other, through without advancing the
+ * write revision a carry fences on (#1722, `isCopyMarkInsert`). Clearing a marker is the opposite
+ * and is a write like any other.
+ */
+export declare const MARK_COPY_ORIGIN_SQL: string;
+/**
+ * Correct a MISTAKEN copy classification (#2005, #2009): for a scope the directory says is
+ * primary, marked by a misclassification, a race, an operator, or a row from before #2009 that
+ * a cross-scope load wrote (one install's backup restored onto another). Clears the
+ * classification only: the events mark stays, so the source's queued work is still never run
+ * here (`emittedHere()`), and the scope's own effects run again. `absent` when the store does not
+ * read as a copy.
+ */
+export declare function clearCopyMarker(sql: SwitchSql): 'cleared' | 'absent';
+/**
+ * Whether this scope is a copy (#2005, #2009): the classification on its copy-origin row, with
+ * a row from before the column (NULL) read as one. The one primacy fact a host with no
+ * control-plane directory can read from the scope's own storage — a CP-less hosted vertical's
+ * coordinator asks it before it runs an executor.
+ */
+export declare const IS_COPY_SQL = "SELECT 1 AS copy FROM _substrat_copy_origin WHERE id = 1 AND COALESCE(is_copy, 1) = 1";
+//# sourceMappingURL=scope-copy.d.ts.map

package/dist/scope-copy.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"scope-copy.d.ts","sourceRoot":"","sources":["../src/scope-copy.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAC;AAEpD;;;;;;;;;;;;;;GAcG;AACH,eAAO,MAAM,UAAU,gBAAiB,MAAM,GAAG,SAAS,iBAAiB,MAAM,GAAG,SAAS,KAAG,OACpC,CAAC;AAK7D;;;;;;;;GAQG;AACH,wBAAgB,mBAAmB,CAAC,CAAC,SAAS;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,SAAS,OAAO,EAAE,CAAA;CAAE,EACtF,MAAM,EAAE,CAAC,EAAE,EACX,WAAW,EAAE,MAAM,GAAG,SAAS,EAC/B,aAAa,EAAE,MAAM,GAAG,SAAS,GAChC,CAAC,EAAE,CAGL;AAcD;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,eAAO,MAAM,eAAe,8cAW3B,CAAC;AAEF;;;;;GAKG;AACH,eAAO,MAAM,WAAW,sBAAiB,MACqD,CAAC;AAE/F;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,wBAAgB,gBAAgB,CAC9B,GAAG,EAAE,SAAS,EACd,WAAW,EAAE,MAAM,GAAG,SAAS,EAC/B,aAAa,EAAE,MAAM,GAAG,SAAS,EACjC,GAAG,EAAE,MAAM,GACV,IAAI,CAiDN;AAED;;;;;;;GAOG;AACH,wBAAgB,cAAc,CAAC,GAAG,EAAE,SAAS,EAAE,GAAG,EAAE,MAAM,GAAG,OAAO,CAInE;AAED;;;;;;;GAOG;AACH,eAAO,MAAM,oBAAoB,QAEa,CAAC;AAE/C;;;;;;;GAOG;AACH,wBAAgB,eAAe,CAAC,GAAG,EAAE,SAAS,GAAG,SAAS,GAAG,QAAQ,CAIpE;AAED;;;;;GAKG;AACH,eAAO,MAAM,WAAW,0FAA0F,CAAC"}

package/dist/scope-copy.js

@@ -0,0 +1,187 @@
+import { CAPABILITY_TABLE_NAMES } from './capability.js';
+/**
+ * What a dump leaves behind when it lands in a scope other than the one it was captured from
+ * (#1686). One definition for both adapters' loaders, so the DO and the pure host agree.
+ *
+ * A load is a **copy** when the destination is not the source: a fork, a snapshot, a preview, or
+ * one scope's backup restored onto another. It is a **return** when the dump goes back into the
+ * scope it came from: a backup restore, a carry onto a new version, adopt, rebind. A copy runs as
+ * a scope of its own, so whatever in the dump is bound to being the source (a live link's secret,
+ * a side effect the source asked for) must not work in the copy. A return keeps all of it, because
+ * restoring a backup must not end live links or lose requests that were waiting.
+ *
+ * An unknown source (`sourceScopeId` or `destScopeId` absent) counts as a copy: a load that cannot
+ * say where the dump came from cannot show it is a return. Only a control plane that predates the
+ * field sends a restore with no source.
+ */
+export const isCopyLoad = (destScopeId, sourceScopeId) => destScopeId === undefined || sourceScopeId !== destScopeId;
+/** The capability tables, as `capabilitiesForLoad` matches a dump's (lowercased) names. */
+const CAPABILITY_TABLES = new Set(CAPABILITY_TABLE_NAMES);
+/**
+ * A dump's tables as a load into `destScopeId` takes them: **capability rows never cross a scope
+ * id.** A copy loads both capability tables empty, so a live link share opens the scope it was
+ * minted in and never a copy of it; a return keeps them.
+ *
+ * Dropped, not loaded as revoked: the copy never minted those links, so a revocation recorded
+ * there would be evidence of something that did not happen in it. Names are matched without
+ * case, as SQLite resolves a table name.
+ */
+export function capabilitiesForLoad(tables, destScopeId, sourceScopeId) {
+    if (!isCopyLoad(destScopeId, sourceScopeId))
+        return tables;
+    return tables.map((t) => (CAPABILITY_TABLES.has(t.name.toLowerCase()) ? { ...t, rows: [] } : t));
+}
+/** The reason copied work is settled with. Names the source, so the journal says where it runs. */
+const notCarried = (sourceScopeId) => `not carried: copied from ${sourceScopeId ? `scope ${sourceScopeId}` : 'another scope'} before it ran; ` +
+    'it runs in the scope that asked for it, never in a copy';
+/** A copied intent's failure: the platform's own refusal, never the provider's answer. */
+const NOT_CARRIED_FAILURE = JSON.stringify({
+    origin: 'platform',
+    code: 'precondition_failed',
+    permission: null,
+});
+/**
+ * Where a scope's data came from, and whether it is a copy: at most one row, which holds two
+ * facts that are set and corrected apart (#2009).
+ *
+ * - **`events_through`, the copied-events mark.** The highest event id a load brought in from
+ *   another scope, or `''` when it brought none. Every event at or below it was emitted in another
+ *   scope; every event the scope emits itself sorts above it, because a loader re-seeds the
+ *   scope's event-id floor from `MAX(id)` (#1335) once the rows are in. Written by a load into a
+ *   scope id other than the dump's (`settleCopiedWork`), and by nothing else.
+ * - **`is_copy`, the classification.** Whether the scope is a copy (a fork, a snapshot, a
+ *   preview), which a host with no control-plane directory reads for primacy and holds inert
+ *   (#2005). Written on the directory's word only (`markCopyOrigin`), never inferred from a load:
+ *   one install's backup restored onto another install is a cross-scope load, so it carries the
+ *   source's events mark, yet the directory still says primary, and its own effects must run.
+ *   Cleared by staff's correction (`clearCopyMarker`) without touching the events mark.
+ *
+ * A scope that was never loaded from another scope and never marked holds no row. A row written
+ * before the column existed holds `is_copy` NULL, and NULL reads as a copy: such a row meant both
+ * facts at once, so every legacy store keeps exactly the behaviour it had (`IS_COPY_SQL`). The
+ * column is nullable with no DEFAULT for the reason every additive spine column is (#1883,
+ * `lint:spine-ddl`), so its "default" lives in that read. Kernel-owned and shared by both
+ * adapters' `KERNEL_DDL`, so the two cannot part company.
+ */
+export const COPY_ORIGIN_DDL = `
+  CREATE TABLE IF NOT EXISTS _substrat_copy_origin (
+    -- Always 1: one origin per scope. No CHECK, because lint:spine-ddl compares none.
+    id INTEGER PRIMARY KEY,
+    source_scope_id TEXT,
+    events_through TEXT NOT NULL,
+    copied_at TEXT NOT NULL,
+    -- #2009: 1 a copy, 0 not one (a load's events mark only, or a cleared marker), NULL a row
+    -- from before the column, which read as a copy and still does.
+    is_copy INTEGER
+  );
+`;
+/**
+ * The predicate every read that turns an outbox row into WORK carries (consumer dispatch, executor
+ * dispatch, the Tier-2 drain): the event was emitted in this scope, not copied into it. `alias` is
+ * the outbox's alias in the caller's query (`'o.'`), or empty. A scope that was never a copy has no
+ * key, and every id compares above the empty string.
+ */
+export const emittedHere = (alias = '') => `${alias}id > COALESCE((SELECT events_through FROM _substrat_copy_origin WHERE id = 1), '')`;
+/**
+ * On a copy, nothing that originated in the source produces an effect in the destination. Run
+ * inside the load's transaction, after the rows are in and BEFORE the loader queues any work of
+ * its own (the attachment-text re-extraction is a job run), or that work is settled with the
+ * source's. The history stays: every row is still
+ * there and reads as what happened at the source; only its power to cause something here goes.
+ *
+ * The platform's drain walks every active scope, and a fork, a snapshot or a preview is one, so
+ * each of these would otherwise run a second time from the copy (an email sent twice, a connector
+ * delivery repeated, a usage line billed twice):
+ *
+ * - **Pending intents** settle `failed`, "not carried", attributed to the platform.
+ * - **Executor retries** (`_substrat_deliveries` rows with a `next_attempt_at`) become terminal,
+ *   with "not carried" as their error, as a dead letter reads.
+ * - **Running job runs** settle `failed`, "not carried"; their step ledger stays as evidence.
+ * - **Events no consumer or executor has reached yet** cannot be settled row by row: an executor is
+ *   registered on the coordinator, not in the scope, so the loader cannot know who still owes one.
+ *   Instead the copy records the highest id it brought in (`_substrat_copy_origin`), and every
+ *   read that dispatches work carries `emittedHere()`. That also keeps the copy from shipping the
+ *   source's events to Tier 2 a second time.
+ *
+ * A return leaves all of it as it was, because the scope that asked for the work is the one it is
+ * back in. Settled rather than dropped: a journal row saying "not carried" explains why the event
+ * that raised it caused nothing here, where a missing row would leave a gap.
+ */
+export function settleCopiedWork(sql, destScopeId, sourceScopeId, now) {
+    if (!isCopyLoad(destScopeId, sourceScopeId))
+        return;
+    const reason = notCarried(sourceScopeId);
+    sql.run(`UPDATE _substrat_platform_requests
+        SET status = 'failed', last_error = ?, last_failure = ?, settled_at = ?
+      WHERE status = 'pending'`, reason, NOT_CARRIED_FAILURE, now);
+    sql.run(`UPDATE _substrat_deliveries SET next_attempt_at = NULL, error = ?, delivered_at = ?
+      WHERE next_attempt_at IS NOT NULL`, reason, now);
+    sql.run(`UPDATE _substrat_job_runs
+        SET status = 'failed', last_error = ?, next_attempt_at = NULL, updated_at = ?, ended_at = ?
+      WHERE status = 'running'`, reason, now, now);
+    const highest = sql.all('SELECT MAX(id) AS id FROM _substrat_outbox')[0]?.id;
+    // Written for an empty copy too: `''` is below every id, so `emittedHere()` passes all of the
+    // scope's own events exactly as no row would. An origin the dump already carried with the same
+    // source and mark is kept as it was, its `copied_at` included, so re-loading the same export
+    // changes nothing in it.
+    //
+    // `is_copy` is 0 (#2009): the load moves the events mark and does not classify. Whatever the
+    // dump's row said described the scope it came FROM; whether THIS scope is a copy is the
+    // directory's to say, through `markCopyOrigin`, which the loader runs after this when the
+    // directory says so.
+    sql.run(`INSERT INTO _substrat_copy_origin (id, source_scope_id, events_through, copied_at, is_copy) VALUES (1, ?, ?, ?, 0)
+       ON CONFLICT (id) DO UPDATE SET
+         source_scope_id = excluded.source_scope_id,
+         events_through = excluded.events_through,
+         copied_at = excluded.copied_at,
+         is_copy = excluded.is_copy
+       WHERE _substrat_copy_origin.source_scope_id IS NOT excluded.source_scope_id
+          OR _substrat_copy_origin.events_through IS NOT excluded.events_through
+          OR _substrat_copy_origin.is_copy IS NOT excluded.is_copy`, sourceScopeId ?? null, typeof highest === 'string' ? highest : '', now);
+}
+/**
+ * Mark this scope a copy (#2005), on the directory's word that it is not primary: a load the
+ * platform flags, the `mark-copies` repair, a reactivation, a carry's wipe or release. Sets the
+ * classification and nothing else (#2009): an origin row a load wrote keeps its events mark and
+ * source, and a scope with no row gets one whose events mark is `''`, which passes every event
+ * exactly as no row does, so dispatch is unchanged. Idempotent: answers whether this call changed
+ * anything, and a store that already reads as a copy (a legacy row included) is left as it is.
+ */
+export function markCopyOrigin(sql, now) {
+    if (sql.all(IS_COPY_SQL).length > 0)
+        return false;
+    sql.run(MARK_COPY_ORIGIN_SQL, now);
+    return true;
+}
+/**
+ * The one statement that marks a store a copy (#2005, #2009): the origin row with no events mark
+ * where none exists, or the classification set on the row that does. It only ever makes a store
+ * MORE restricted — a copy's executors are held inert — and changes no data and no events mark,
+ * which is why the scope DO lets this statement, and no other, through without advancing the
+ * write revision a carry fences on (#1722, `isCopyMarkInsert`). Clearing a marker is the opposite
+ * and is a write like any other.
+ */
+export const MARK_COPY_ORIGIN_SQL = "INSERT INTO _substrat_copy_origin (id, source_scope_id, events_through, copied_at, is_copy) VALUES (1, NULL, '', ?, 1) " +
+    'ON CONFLICT (id) DO UPDATE SET is_copy = 1';
+/**
+ * Correct a MISTAKEN copy classification (#2005, #2009): for a scope the directory says is
+ * primary, marked by a misclassification, a race, an operator, or a row from before #2009 that
+ * a cross-scope load wrote (one install's backup restored onto another). Clears the
+ * classification only: the events mark stays, so the source's queued work is still never run
+ * here (`emittedHere()`), and the scope's own effects run again. `absent` when the store does not
+ * read as a copy.
+ */
+export function clearCopyMarker(sql) {
+    if (sql.all(IS_COPY_SQL).length === 0)
+        return 'absent';
+    sql.run('UPDATE _substrat_copy_origin SET is_copy = 0 WHERE id = 1');
+    return 'cleared';
+}
+/**
+ * Whether this scope is a copy (#2005, #2009): the classification on its copy-origin row, with
+ * a row from before the column (NULL) read as one. The one primacy fact a host with no
+ * control-plane directory can read from the scope's own storage — a CP-less hosted vertical's
+ * coordinator asks it before it runs an executor.
+ */
+export const IS_COPY_SQL = 'SELECT 1 AS copy FROM _substrat_copy_origin WHERE id = 1 AND COALESCE(is_copy, 1) = 1';
+//# sourceMappingURL=scope-copy.js.map

package/dist/scope-copy.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"scope-copy.js","sourceRoot":"","sources":["../src/scope-copy.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,sBAAsB,EAAE,MAAM,iBAAiB,CAAC;AAGzD;;;;;;;;;;;;;;GAcG;AACH,MAAM,CAAC,MAAM,UAAU,GAAG,CAAC,WAA+B,EAAE,aAAiC,EAAW,EAAE,CACxG,WAAW,KAAK,SAAS,IAAI,aAAa,KAAK,WAAW,CAAC;AAE7D,2FAA2F;AAC3F,MAAM,iBAAiB,GAAwB,IAAI,GAAG,CAAC,sBAAsB,CAAC,CAAC;AAE/E;;;;;;;;GAQG;AACH,MAAM,UAAU,mBAAmB,CACjC,MAAW,EACX,WAA+B,EAC/B,aAAiC;IAEjC,IAAI,CAAC,UAAU,CAAC,WAAW,EAAE,aAAa,CAAC;QAAE,OAAO,MAAM,CAAC;IAC3D,OAAO,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,iBAAiB,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AACnG,CAAC;AAED,mGAAmG;AACnG,MAAM,UAAU,GAAG,CAAC,aAAiC,EAAU,EAAE,CAC/D,4BAA4B,aAAa,CAAC,CAAC,CAAC,SAAS,aAAa,EAAE,CAAC,CAAC,CAAC,eAAe,kBAAkB;IACxG,yDAAyD,CAAC;AAE5D,0FAA0F;AAC1F,MAAM,mBAAmB,GAAG,IAAI,CAAC,SAAS,CAAC;IACzC,MAAM,EAAE,UAAU;IAClB,IAAI,EAAE,qBAAqB;IAC3B,UAAU,EAAE,IAAI;CACgB,CAAC,CAAC;AAEpC;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,MAAM,CAAC,MAAM,eAAe,GAAG;;;;;;;;;;;CAW9B,CAAC;AAEF;;;;;GAKG;AACH,MAAM,CAAC,MAAM,WAAW,GAAG,CAAC,KAAK,GAAG,EAAE,EAAU,EAAE,CAChD,GAAG,KAAK,oFAAoF,CAAC;AAE/F;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,MAAM,UAAU,gBAAgB,CAC9B,GAAc,EACd,WAA+B,EAC/B,aAAiC,EACjC,GAAW;IAEX,IAAI,CAAC,UAAU,CAAC,WAAW,EAAE,aAAa,CAAC;QAAE,OAAO;IACpD,MAAM,MAAM,GAAG,UAAU,CAAC,aAAa,CAAC,CAAC;IACzC,GAAG,CAAC,GAAG,CACL;;+BAE2B,EAC3B,MAAM,EACN,mBAAmB,EACnB,GAAG,CACJ,CAAC;IACF,GAAG,CAAC,GAAG,CACL;wCACoC,EACpC,MAAM,EACN,GAAG,CACJ,CAAC;IACF,GAAG,CAAC,GAAG,CACL;;+BAE2B,EAC3B,MAAM,EACN,GAAG,EACH,GAAG,CACJ,CAAC;IACF,MAAM,OAAO,GAAG,GAAG,CAAC,GAAG,CAAC,4CAA4C,CAAC,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC;IAC7E,8FAA8F;IAC9F,+FAA+F;IAC/F,6FAA6F;IAC7F,yBAAyB;IACzB,EAAE;IACF,6FAA6F;IAC7F,wFAAwF;IACxF,0FAA0F;IAC1F,qBAAqB;IACrB,GAAG,CAAC,GAAG,CACL;;;;;;;;mEAQ+D,EAC/D,aAAa,IAAI,IAAI,EACrB,OAAO,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,EAC1C,GAAG,CACJ,CAAC;AACJ,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,cAAc,CAAC,GAAc,EAAE,GAAW;IACxD,IAAI,GAAG,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,KAAK,CAAC;IAClD,GAAG,CAAC,GAAG,CAAC,oBAAoB,EAAE,GAAG,CAAC,CAAC;IACnC,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAC/B,yHAAyH;IACzH,4CAA4C,CAAC;AAE/C;;;;;;;GAOG;AACH,MAAM,UAAU,eAAe,CAAC,GAAc;IAC5C,IAAI,GAAG,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,QAAQ,CAAC;IACvD,GAAG,CAAC,GAAG,CAAC,2DAA2D,CAAC,CAAC;IACrE,OAAO,SAAS,CAAC;AACnB,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,MAAM,WAAW,GAAG,uFAAuF,CAAC"}