@substrat-run/kernel 0.136.0 → 0.138.0

package/dist/system-switch.d.ts

@@ -19,19 +19,25 @@
  * `scope:<id>` marker. The gate is OFF while that marker is live, whatever grants are
  * live beside it. **Restore is the lever; a grant is not.** The marker is an ordinary
  * K-21 tuple: switching back on tombstones it, so the row stays as evidence of when the
- * switch was last pulled. The permission walk reads only `role:` and `granted:` relations
- * (`permission-eval.ts`), so the marker authorizes nothing and denies nothing by itself.
+ * switch was last pulled. The permission walk reads only `role:` and `granted:` relations,
+ * so the marker authorizes nothing; what it denies, it denies through the one question the
+ * evaluator asks before the walk (below).
  *
  * Switching off ALSO tombstones every live `granted:` tuple the module holds on the scope.
  * That is what makes it a kill switch rather than a schedule pause: anything that acts
  * with the module's system authority — a resumable job run (#1577), a `getSystemScope`
  * invoke — is denied by its own `ctx.check` while the switch is off.
  *
- * **And nothing may write a new one while it is off**, which is what makes that denial
- * hold. The checker is deliberately NOT marker-aware; the switch is closed on the WRITE
- * side instead, at the only two writers of a scope-level `system:` grant:
+ * **And the checker reads the marker too** (#1823), which is what makes that denial hold
+ * against a grant OFF cannot tombstone. A TENANT-level `system:` grant lives in the directory
+ * (and in every scope's projection of it), not at `scope:<id>`, so OFF leaves it live. The
+ * permission evaluator asks the scope reader's `switchedOff` before it reads any tuple, and a
+ * live marker denies the subject on that scope whatever it holds (`permission-eval.ts`). The
+ * write side stays closed as well, so a switched-off scope does not accumulate grants that
+ * ON would then hand back:
  * - `grantToSystem` refuses while the module is switched off on that scope (the adapters
- *   ask `systemSwitchedOff` in the same unit as the write);
+ *   ask `systemSwitchedOff` in the same unit as the write), and a tenant-level grant while
+ *   the directory records it off on any scope (#1743);
  * - provisioning's seat (`seatScopeTuple`) seats nothing for a subject whose marker is
  *   live, so a reconcile cannot create a grant a newer version declares.
  *
@@ -62,6 +68,15 @@ export interface SwitchSql {
  *   write. Quiet, exactly as before the switch existed: no run, no skip, no error.
  */
 export type SystemScheduleState = 'on' | 'off' | 'ungranted';
+/**
+ * Which kill switch: a module's system authority (`system:<module>`, #1666) or a peer
+ * vertical's (`vertical:<slug>`, #1706). Both move the same marker through `switchSubjectGrants`.
+ */
+export type SwitchKind = 'system' | 'peer';
+/** The tuple-subject prefix of a peer vertical (#1706) — `vertical:acme/board-room`. Re-exported by `peer.ts`. */
+export declare const PEER_SUBJECT_PREFIX = "vertical:";
+/** The tuple subject a peer's grants are seated under. The slug only, never the instance. Re-exported by `peer.ts`. */
+export declare const peerSubjectRef: (vertical: string) => string;
 /**
  * "Is this subject's OFF marker live?", as a SQL predicate over ONE bound parameter (the
  * subject). The one spelling the gate, the grant refusal and the provisioning seat share,
@@ -97,8 +112,15 @@ export interface SystemGrantsEntry {
 export declare function systemGrantsStatus(db: SwitchSql, now: string): SystemGrantsEntry[];
 /** Is this module switched off on the scope `db` is? What `grantToSystem` refuses on. */
 export declare function systemSwitchedOff(db: SwitchSql, moduleId: string): boolean;
+/**
+ * `SYSTEM_SWITCH_OFF_PREDICATE` as a whole statement answering `off` (0/1), over the one bound
+ * subject — what `subjectSwitchedOff` runs, and what each adapter's permission reader prepares
+ * once and runs on every check of a switchable subject (#1823).
+ */
+export declare const SYSTEM_SWITCH_OFF_QUERY = "SELECT EXISTS (SELECT 1 FROM _substrat_tuples\n  WHERE subject = ? AND relation = 'switch:off' AND revoked_at IS NULL) AS off";
 /** Is this subject's OFF marker live on the scope `db` is? Any subject — see `switchSubjectGrants`. */
 export declare function subjectSwitchedOff(db: SwitchSql, subject: string): boolean;
+export declare const isSwitchableSubjectKind: (kind: string) => boolean;
 /** The refusal `grantToSystem` throws while the switch is off — one wording, both adapters. */
 export declare function systemSwitchedOffMessage(moduleId: string, scopeId: string): string;
 /**
@@ -111,7 +133,41 @@ export interface SwitchOutcome {
     held: boolean;
     changed: boolean;
     permissions: string[];
+    /**
+     * #1823: this code's evaluator denies a module on a scope whose marker is live, its
+     * TENANT-level grants included. Set by `switchSystemSchedules` on every answer, because it
+     * is a fact about the code that answered, not about the call: a deployment built before
+     * #1823 omits it, and its OFF leaves a tenant-level grant authorizing. The platform reads
+     * its absence on an OFF of a module it found tenant-held as "this deployment cannot hold
+     * that OFF", and refuses it rather than record a scope off that is not.
+     */
+    deniesTenantGrants?: true;
+    /**
+     * #2045: the move was refused, and nothing written, because the scope has already applied a
+     * NEWER switch call on this subject (`SWITCH_FENCES_DDL`). The scope stays where the newer call
+     * put it, which is also where the directory's record is. Absent from a deployment built before
+     * the fence, which applies every move it is sent.
+     */
+    superseded?: true;
+    /**
+     * #2045 (Codex r2): this code honoured the call's fence — set on every answer to a move that
+     * carried one, superseded or not. A deployment built before the fence drops the field and the
+     * fence with it, and would apply an older call's move after a newer one, so the platform refuses
+     * a fenced move whose answer lacks this, as it refuses an OFF without `deniesTenantGrants`.
+     */
+    fenced?: true;
 }
+/**
+ * #2045: the fence a scope keeps per switched subject — the operation id (a ULID) of the newest
+ * switch call it has applied. The directory's record (`system-switch-record.ts`) refuses a write
+ * older than the one it holds, and the scope refuses a move older than the one it applied, so the
+ * two always end on the SAME call's position, whatever order two concurrent calls' writes and moves
+ * arrive in. Without it, operator A recording OFF, then B recording ON and moving ON, then A's OFF
+ * landing, left the record ON beside a scope that is OFF, and a later restore re-admitted the
+ * subject. Keyed by (subject, object) as the marker is, so a copy of another scope's rows fences
+ * nothing here. Part of the scope's own storage: a restore or rewind takes it back with the marker.
+ */
+export declare const SWITCH_FENCES_DDL = "\n  CREATE TABLE IF NOT EXISTS _substrat_switch_fences (\n    subject TEXT NOT NULL,\n    object  TEXT NOT NULL,\n    -- The operation id of the newest switch call applied here. A ULID, so it orders by text.\n    fence   TEXT NOT NULL,\n    PRIMARY KEY (subject, object)\n  );\n";
 /**
  * Move one module's switch on one scope. Idempotent: a repeat changes nothing and says so.
  *
@@ -121,9 +177,13 @@ export interface SwitchOutcome {
  * marker. A repeated OFF re-asserts the whole position: a grant that became live meanwhile
  * (only a raw write can do that now) is tombstoned and recorded too.
  *
- * `held: false`, with nothing written, when the scope holds neither a grant nor a marker
- * for the module: the caller named something this scope never ran, and turning "nothing"
- * off must not write a marker that silently disables a module the day it is installed.
+ * `held: false`, with nothing written, when the module has no authority reaching the scope:
+ * no grant and no marker here, and no live TENANT-level grant (`tenantHeld`, which the caller
+ * reads from the directory, since the scope's storage cannot answer it). The caller named
+ * something this scope never ran, and turning "nothing" off must not write a marker that
+ * silently disables a module the day it is installed. A module whose only authority here is a
+ * tenant-level grant IS held (#1823): OFF writes the marker, which the evaluator then denies
+ * the module on, and tombstones nothing, because nothing of it is here to tombstone.
  *
  * Run it inside one transaction; the reads and writes here are meant to be one unit.
  */
@@ -132,29 +192,87 @@ export declare function switchSystemSchedules(db: SwitchSql, input: {
     scopeId: string;
     to: 'on' | 'off';
     at: string;
+    tenantHeld?: boolean;
+    fence?: string;
 }): SwitchOutcome;
-/** One module `switchRecordedOff` switched off — `SwitchedOffInUnit`'s shape. */
-export interface SwitchedOff extends SwitchOutcome {
+/**
+ * One subject `switchRecordedOff` switched off — `SwitchedOffInUnit`'s shape: a module
+ * (`moduleId`), or since #2029 a peer vertical (`vertical`).
+ */
+export type SwitchedOff = SwitchOutcome & ({
     moduleId: string;
+    vertical?: never;
+} | {
+    vertical: string;
+    moduleId?: never;
+});
+/**
+ * What the platform carries into a unit that re-creates a scope's grants (#1742): the subjects
+ * its directory records OFF on that scope, and of those, the ones held there only by a
+ * tenant-level grant (#1823, #2030). Subjects only, never a scope: the unit names its own.
+ */
+export interface RecordedOffCarry {
+    moduleIds: readonly string[];
+    tenantHeld?: readonly string[];
+    /** #2029: the recorded-off peers. Absent from a platform that predates the peer record. */
+    verticals?: readonly string[];
+    tenantHeldVerticals?: readonly string[];
+    /**
+     * #2045: the fence of each recorded-off subject, by tuple subject (`system:<m>`, `vertical:<v>`):
+     * the operation id of the call the record holds. A subject the scope has since moved under a newer
+     * call is left as that call put it. Absent from a platform built before the fence.
+     */
+    fences?: Readonly<Record<string, string>>;
 }
 /**
- * Switch the directory's recorded-off modules off again, inside the unit that re-created the
+ * The same carry as it crosses the wire to a vertical's deployment (#1742): the provision,
+ * reconcile and restore bodies, and `SwitchCarry` on the platform side. `switchedOffPeers` and
+ * `tenantHeldPeers` are #2029's; a deployment built before them strips both, and the platform's
+ * re-assert after the call switches those peers off instead.
+ */
+export interface SwitchCarryWire {
+    switchedOff?: readonly string[];
+    tenantHeld?: readonly string[];
+    switchedOffPeers?: readonly string[];
+    tenantHeldPeers?: readonly string[];
+    /** #2045: `RecordedOffCarry.fences`, as it crosses the wire. A deployment built before it strips it. */
+    switchFences?: Readonly<Record<string, string>>;
+}
+/** A wire carry as the unit runs it, or undefined when it names nothing to switch off. */
+export declare function recordedOffFromWire(wire: SwitchCarryWire): RecordedOffCarry | undefined;
+/**
+ * Switch the directory's recorded-off subjects off again, inside the unit that re-created the
  * scope's grants (#1742): a provision's or reconcile's seat, or a restore's replay. The caller
  * runs it in that same unit, AFTER the seat, so the grants the seat created are the ones OFF
  * tombstones and records, and a later restore gives back exactly those (#1674's order). No
- * schedule can run between the seat and this, because nothing can run between them.
+ * schedule can run, and no peer call be admitted, between the seat and this, because nothing
+ * can run between them.
  *
- * `scopeId` is the scope `db` is, and the caller passes the one the request provisions or
- * restores, never a second id: the list names modules, never scopes, so it can only reach
- * the scope that unit is already writing. A module the scope holds nothing for answers
- * `held: false` and writes nothing, as the switch always does. Off only: nothing here turns
- * a module on.
+ * `moduleIds` are the recorded-off modules, `verticals` the recorded-off peers (#2029). `scopeId`
+ * is the scope `db` is, and the caller passes the one the request provisions or restores, never
+ * a second id: the lists name subjects, never scopes, so they can only reach the scope that unit
+ * is already writing. A subject the scope holds nothing for answers `held: false` and writes
+ * nothing, as the switch always does — unless it is in `tenantHeld` / `tenantHeldVerticals`, the
+ * recorded-off subjects the caller found a live tenant-level grant for (#1823, #2030). Off only:
+ * nothing here turns anything on.
  */
-export declare function switchRecordedOff(db: SwitchSql, input: {
+export declare function switchRecordedOff(db: SwitchSql, input: RecordedOffCarry & {
     scopeId: string;
-    moduleIds: readonly string[];
     at: string;
 }): SwitchedOff[];
+/**
+ * Move one kill switch of either kind on one scope (#2029): `switchSystemSchedules` for a
+ * module, `switchSubjectGrants` over `vertical:<key>` for a peer. `key` is the module id or the
+ * peer's slug. The one mover the adapters' shared switch body and their re-asserts call.
+ */
+export declare function moveSwitch(db: SwitchSql, kind: SwitchKind, input: {
+    key: string;
+    scopeId: string;
+    to: 'on' | 'off';
+    at: string;
+    tenantHeld?: boolean;
+    fence?: string;
+}): SwitchOutcome;
 /**
  * The switch itself, for ANY non-person subject's scope-level grants — `switchSystemSchedules`
  * for a schedule (`system:<module>`), and the peer kill switch for another vertical
@@ -169,5 +287,13 @@ export declare function switchSubjectGrants(db: SwitchSql, input: {
     scopeId: string;
     to: 'on' | 'off';
     at: string;
+    tenantHeld?: boolean;
+    /**
+     * #2045: the switch call this move belongs to — its operation id, or for a re-assert the one the
+     * directory's record holds. A move older than the fence the scope keeps is refused (`superseded`);
+     * one at or past it applies and moves the fence to it. Absent, the move applies and leaves the
+     * fence alone: a caller from before the fence.
+     */
+    fence?: string;
 }): SwitchOutcome;
 //# sourceMappingURL=system-switch.d.ts.map

package/dist/system-switch.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"system-switch.d.ts","sourceRoot":"","sources":["../src/system-switch.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4CG;AAEH,4FAA4F;AAC5F,eAAO,MAAM,0BAA0B,eAAe,CAAC;AAKvD,sFAAsF;AACtF,MAAM,WAAW,SAAS;IACxB,GAAG,CAAC,GAAG,EAAE,MAAM,EAAE,GAAG,MAAM,EAAE,CAAC,MAAM,GAAG,MAAM,GAAG,IAAI,CAAC,EAAE,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,CAAC;IACnF,GAAG,CAAC,GAAG,EAAE,MAAM,EAAE,GAAG,MAAM,EAAE,CAAC,MAAM,GAAG,MAAM,GAAG,IAAI,CAAC,EAAE,GAAG,IAAI,CAAC;CAC/D;AAED;;;;;;;;;;GAUG;AACH,MAAM,MAAM,mBAAmB,GAAG,IAAI,GAAG,KAAK,GAAG,WAAW,CAAC;AAI7D;;;;GAIG;AACH,eAAO,MAAM,2BAA2B,oHACmD,CAAC;AAE5F;;;;GAIG;AACH,wBAAgB,mBAAmB,CAAC,EAAE,EAAE,SAAS,EAAE,QAAQ,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,mBAAmB,CAErG;AAED;;;;;GAKG;AACH,wBAAgB,iBAAiB,CAAC,EAAE,EAAE,SAAS,EAAE,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,mBAAmB,CAalG;AAED,4EAA4E;AAC5E,MAAM,WAAW,iBAAiB;IAChC,QAAQ,EAAE,MAAM,CAAC;IACjB,SAAS,EAAE,mBAAmB,CAAC;CAChC;AAED;;;;;;;GAOG;AACH,wBAAgB,kBAAkB,CAAC,EAAE,EAAE,SAAS,EAAE,GAAG,EAAE,MAAM,GAAG,iBAAiB,EAAE,CAWlF;AAED,yFAAyF;AACzF,wBAAgB,iBAAiB,CAAC,EAAE,EAAE,SAAS,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAE1E;AAED,uGAAuG;AACvG,wBAAgB,kBAAkB,CAAC,EAAE,EAAE,SAAS,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAK1E;AAUD,+FAA+F;AAC/F,wBAAgB,wBAAwB,CAAC,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,MAAM,CAElF;AAED;;;GAGG;AACH,wBAAgB,8BAA8B,CAAC,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE,SAAS,MAAM,EAAE,GAAG,MAAM,CAKpG;AAED,2FAA2F;AAC3F,MAAM,WAAW,aAAa;IAC5B,IAAI,EAAE,OAAO,CAAC;IACd,OAAO,EAAE,OAAO,CAAC;IACjB,WAAW,EAAE,MAAM,EAAE,CAAC;CACvB;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,qBAAqB,CACnC,EAAE,EAAE,SAAS,EACb,KAAK,EAAE;IAAE,QAAQ,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC;IAAC,EAAE,EAAE,IAAI,GAAG,KAAK,CAAC;IAAC,EAAE,EAAE,MAAM,CAAA;CAAE,GACzE,aAAa,CAOf;AAED,iFAAiF;AACjF,MAAM,WAAW,WAAY,SAAQ,aAAa;IAChD,QAAQ,EAAE,MAAM,CAAC;CAClB;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,iBAAiB,CAC/B,EAAE,EAAE,SAAS,EACb,KAAK,EAAE;IAAE,OAAO,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,SAAS,MAAM,EAAE,CAAC;IAAC,EAAE,EAAE,MAAM,CAAA;CAAE,GACnE,WAAW,EAAE,CAKf;AAED;;;;;;;;GAQG;AACH,wBAAgB,mBAAmB,CACjC,EAAE,EAAE,SAAS,EACb,KAAK,EAAE;IAAE,OAAO,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC;IAAC,EAAE,EAAE,IAAI,GAAG,KAAK,CAAC;IAAC,EAAE,EAAE,MAAM,CAAA;CAAE,GACxE,aAAa,CA4Ff"}
+{"version":3,"file":"system-switch.d.ts","sourceRoot":"","sources":["../src/system-switch.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkDG;AAEH,4FAA4F;AAC5F,eAAO,MAAM,0BAA0B,eAAe,CAAC;AAKvD,sFAAsF;AACtF,MAAM,WAAW,SAAS;IACxB,GAAG,CAAC,GAAG,EAAE,MAAM,EAAE,GAAG,MAAM,EAAE,CAAC,MAAM,GAAG,MAAM,GAAG,IAAI,CAAC,EAAE,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,CAAC;IACnF,GAAG,CAAC,GAAG,EAAE,MAAM,EAAE,GAAG,MAAM,EAAE,CAAC,MAAM,GAAG,MAAM,GAAG,IAAI,CAAC,EAAE,GAAG,IAAI,CAAC;CAC/D;AAED;;;;;;;;;;GAUG;AACH,MAAM,MAAM,mBAAmB,GAAG,IAAI,GAAG,KAAK,GAAG,WAAW,CAAC;AAI7D;;;GAGG;AACH,MAAM,MAAM,UAAU,GAAG,QAAQ,GAAG,MAAM,CAAC;AAE3C,kHAAkH;AAClH,eAAO,MAAM,mBAAmB,cAAc,CAAC;AAE/C,uHAAuH;AACvH,eAAO,MAAM,cAAc,aAAc,MAAM,KAAG,MAA6C,CAAC;AAEhG;;;;GAIG;AACH,eAAO,MAAM,2BAA2B,oHACmD,CAAC;AAE5F;;;;GAIG;AACH,wBAAgB,mBAAmB,CAAC,EAAE,EAAE,SAAS,EAAE,QAAQ,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,mBAAmB,CAErG;AAED;;;;;GAKG;AACH,wBAAgB,iBAAiB,CAAC,EAAE,EAAE,SAAS,EAAE,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,mBAAmB,CAalG;AAED,4EAA4E;AAC5E,MAAM,WAAW,iBAAiB;IAChC,QAAQ,EAAE,MAAM,CAAC;IACjB,SAAS,EAAE,mBAAmB,CAAC;CAChC;AAED;;;;;;;GAOG;AACH,wBAAgB,kBAAkB,CAAC,EAAE,EAAE,SAAS,EAAE,GAAG,EAAE,MAAM,GAAG,iBAAiB,EAAE,CAWlF;AAED,yFAAyF;AACzF,wBAAgB,iBAAiB,CAAC,EAAE,EAAE,SAAS,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAE1E;AAED;;;;GAIG;AACH,eAAO,MAAM,uBAAuB,kIAAiD,CAAC;AAEtF,uGAAuG;AACvG,wBAAgB,kBAAkB,CAAC,EAAE,EAAE,SAAS,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAG1E;AAQD,eAAO,MAAM,uBAAuB,SAAU,MAAM,KAAG,OAAqC,CAAC;AAU7F,+FAA+F;AAC/F,wBAAgB,wBAAwB,CAAC,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,MAAM,CAElF;AAED;;;GAGG;AACH,wBAAgB,8BAA8B,CAAC,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE,SAAS,MAAM,EAAE,GAAG,MAAM,CAKpG;AAED,2FAA2F;AAC3F,MAAM,WAAW,aAAa;IAC5B,IAAI,EAAE,OAAO,CAAC;IACd,OAAO,EAAE,OAAO,CAAC;IACjB,WAAW,EAAE,MAAM,EAAE,CAAC;IACtB;;;;;;;OAOG;IACH,kBAAkB,CAAC,EAAE,IAAI,CAAC;IAC1B;;;;;OAKG;IACH,UAAU,CAAC,EAAE,IAAI,CAAC;IAClB;;;;;OAKG;IACH,MAAM,CAAC,EAAE,IAAI,CAAC;CACf;AAED;;;;;;;;;GASG;AACH,eAAO,MAAM,iBAAiB,2RAQ7B,CAAC;AAEF;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAgB,qBAAqB,CACnC,EAAE,EAAE,SAAS,EACb,KAAK,EAAE;IAAE,QAAQ,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC;IAAC,EAAE,EAAE,IAAI,GAAG,KAAK,CAAC;IAAC,EAAE,EAAE,MAAM,CAAC;IAAC,UAAU,CAAC,EAAE,OAAO,CAAC;IAAC,KAAK,CAAC,EAAE,MAAM,CAAA;CAAE,GAC/G,aAAa,CAIf;AAED;;;GAGG;AACH,MAAM,MAAM,WAAW,GAAG,aAAa,GAAG,CAAC;IAAE,QAAQ,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,EAAE,KAAK,CAAA;CAAE,GAAG;IAAE,QAAQ,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,EAAE,KAAK,CAAA;CAAE,CAAC,CAAC;AAE5H;;;;GAIG;AACH,MAAM,WAAW,gBAAgB;IAC/B,SAAS,EAAE,SAAS,MAAM,EAAE,CAAC;IAC7B,UAAU,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAC/B,2FAA2F;IAC3F,SAAS,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAC9B,mBAAmB,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IACxC;;;;OAIG;IACH,MAAM,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;CAC3C;AAED;;;;;GAKG;AACH,MAAM,WAAW,eAAe;IAC9B,WAAW,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAChC,UAAU,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAC/B,gBAAgB,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IACrC,eAAe,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IACpC,wGAAwG;IACxG,YAAY,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;CACjD;AAED,0FAA0F;AAC1F,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,eAAe,GAAG,gBAAgB,GAAG,SAAS,CASvF;AAED;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,iBAAiB,CAAC,EAAE,EAAE,SAAS,EAAE,KAAK,EAAE,gBAAgB,GAAG;IAAE,OAAO,EAAE,MAAM,CAAC;IAAC,EAAE,EAAE,MAAM,CAAA;CAAE,GAAG,WAAW,EAAE,CA2BzH;AAED;;;;GAIG;AACH,wBAAgB,UAAU,CACxB,EAAE,EAAE,SAAS,EACb,IAAI,EAAE,UAAU,EAChB,KAAK,EAAE;IAAE,GAAG,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC;IAAC,EAAE,EAAE,IAAI,GAAG,KAAK,CAAC;IAAC,EAAE,EAAE,MAAM,CAAC;IAAC,UAAU,CAAC,EAAE,OAAO,CAAC;IAAC,KAAK,CAAC,EAAE,MAAM,CAAA;CAAE,GAC1G,aAAa,CAKf;AAED;;;;;;;;GAQG;AACH,wBAAgB,mBAAmB,CACjC,EAAE,EAAE,SAAS,EACb,KAAK,EAAE;IACL,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,EAAE,MAAM,CAAC;IAChB,EAAE,EAAE,IAAI,GAAG,KAAK,CAAC;IACjB,EAAE,EAAE,MAAM,CAAC;IACX,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB;;;;;OAKG;IACH,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB,GACA,aAAa,CAuBf"}

package/dist/system-switch.js

@@ -19,19 +19,25 @@
  * `scope:<id>` marker. The gate is OFF while that marker is live, whatever grants are
  * live beside it. **Restore is the lever; a grant is not.** The marker is an ordinary
  * K-21 tuple: switching back on tombstones it, so the row stays as evidence of when the
- * switch was last pulled. The permission walk reads only `role:` and `granted:` relations
- * (`permission-eval.ts`), so the marker authorizes nothing and denies nothing by itself.
+ * switch was last pulled. The permission walk reads only `role:` and `granted:` relations,
+ * so the marker authorizes nothing; what it denies, it denies through the one question the
+ * evaluator asks before the walk (below).
  *
  * Switching off ALSO tombstones every live `granted:` tuple the module holds on the scope.
  * That is what makes it a kill switch rather than a schedule pause: anything that acts
  * with the module's system authority — a resumable job run (#1577), a `getSystemScope`
  * invoke — is denied by its own `ctx.check` while the switch is off.
  *
- * **And nothing may write a new one while it is off**, which is what makes that denial
- * hold. The checker is deliberately NOT marker-aware; the switch is closed on the WRITE
- * side instead, at the only two writers of a scope-level `system:` grant:
+ * **And the checker reads the marker too** (#1823), which is what makes that denial hold
+ * against a grant OFF cannot tombstone. A TENANT-level `system:` grant lives in the directory
+ * (and in every scope's projection of it), not at `scope:<id>`, so OFF leaves it live. The
+ * permission evaluator asks the scope reader's `switchedOff` before it reads any tuple, and a
+ * live marker denies the subject on that scope whatever it holds (`permission-eval.ts`). The
+ * write side stays closed as well, so a switched-off scope does not accumulate grants that
+ * ON would then hand back:
  * - `grantToSystem` refuses while the module is switched off on that scope (the adapters
- *   ask `systemSwitchedOff` in the same unit as the write);
+ *   ask `systemSwitchedOff` in the same unit as the write), and a tenant-level grant while
+ *   the directory records it off on any scope (#1743);
  * - provisioning's seat (`seatScopeTuple`) seats nothing for a subject whose marker is
  *   live, so a reconcile cannot create a grant a newer version declares.
  *
@@ -48,6 +54,10 @@ export const SYSTEM_SWITCH_OFF_RELATION = 'switch:off';
 /** `switched:<permission>` — "the switch revoked this grant, and ON gives it back". */
 const SWITCHED_PREFIX = 'switched:';
 const subjectOf = (moduleId) => `system:${moduleId}`;
+/** The tuple-subject prefix of a peer vertical (#1706) — `vertical:acme/board-room`. Re-exported by `peer.ts`. */
+export const PEER_SUBJECT_PREFIX = 'vertical:';
+/** The tuple subject a peer's grants are seated under. The slug only, never the instance. Re-exported by `peer.ts`. */
+export const peerSubjectRef = (vertical) => `${PEER_SUBJECT_PREFIX}${vertical}`;
 /**
  * "Is this subject's OFF marker live?", as a SQL predicate over ONE bound parameter (the
  * subject). The one spelling the gate, the grant refusal and the provisioning seat share,
@@ -101,11 +111,24 @@ export function systemGrantsStatus(db, now) {
 export function systemSwitchedOff(db, moduleId) {
     return subjectSwitchedOff(db, subjectOf(moduleId));
 }
+/**
+ * `SYSTEM_SWITCH_OFF_PREDICATE` as a whole statement answering `off` (0/1), over the one bound
+ * subject — what `subjectSwitchedOff` runs, and what each adapter's permission reader prepares
+ * once and runs on every check of a switchable subject (#1823).
+ */
+export const SYSTEM_SWITCH_OFF_QUERY = `SELECT ${SYSTEM_SWITCH_OFF_PREDICATE} AS off`;
 /** Is this subject's OFF marker live on the scope `db` is? Any subject — see `switchSubjectGrants`. */
 export function subjectSwitchedOff(db, subject) {
-    const row = db.all(`SELECT ${SYSTEM_SWITCH_OFF_PREDICATE} AS off`, subject)[0];
+    const row = db.all(SYSTEM_SWITCH_OFF_QUERY, subject)[0];
     return Number(row?.off) === 1;
 }
+/**
+ * The subject kinds a kill switch can name: a module's system authority (#1666, `system:`) and
+ * a peer vertical's (#1706, `vertical:`). A principal, connection or capability never carries a
+ * marker, so the evaluator asks the switch only for these (#1823).
+ */
+const SWITCHABLE_KINDS = new Set(['system', 'vertical']);
+export const isSwitchableSubjectKind = (kind) => SWITCHABLE_KINDS.has(kind);
 /** How many scopes a tenant-level refusal names before it says "and N more". */
 const NAMED_SCOPES = 5;
 const switchedOffMessage = (moduleId, where, reach) => `module '${moduleId}' is switched off on ${where} (#1666) — restore it first ` +
@@ -125,6 +148,25 @@ export function tenantSystemSwitchedOffMessage(moduleId, scopeIds) {
     const where = scopeIds.length === 1 ? `scope ${named}` : `scopes ${named}${more}`;
     return switchedOffMessage(moduleId, where, 'a tenant-level grant reaches every scope of the tenant, so ');
 }
+/**
+ * #2045: the fence a scope keeps per switched subject — the operation id (a ULID) of the newest
+ * switch call it has applied. The directory's record (`system-switch-record.ts`) refuses a write
+ * older than the one it holds, and the scope refuses a move older than the one it applied, so the
+ * two always end on the SAME call's position, whatever order two concurrent calls' writes and moves
+ * arrive in. Without it, operator A recording OFF, then B recording ON and moving ON, then A's OFF
+ * landing, left the record ON beside a scope that is OFF, and a later restore re-admitted the
+ * subject. Keyed by (subject, object) as the marker is, so a copy of another scope's rows fences
+ * nothing here. Part of the scope's own storage: a restore or rewind takes it back with the marker.
+ */
+export const SWITCH_FENCES_DDL = `
+  CREATE TABLE IF NOT EXISTS _substrat_switch_fences (
+    subject TEXT NOT NULL,
+    object  TEXT NOT NULL,
+    -- The operation id of the newest switch call applied here. A ULID, so it orders by text.
+    fence   TEXT NOT NULL,
+    PRIMARY KEY (subject, object)
+  );
+`;
 /**
  * Move one module's switch on one scope. Idempotent: a repeat changes nothing and says so.
  *
@@ -134,38 +176,87 @@ export function tenantSystemSwitchedOffMessage(moduleId, scopeIds) {
  * marker. A repeated OFF re-asserts the whole position: a grant that became live meanwhile
  * (only a raw write can do that now) is tombstoned and recorded too.
  *
- * `held: false`, with nothing written, when the scope holds neither a grant nor a marker
- * for the module: the caller named something this scope never ran, and turning "nothing"
- * off must not write a marker that silently disables a module the day it is installed.
+ * `held: false`, with nothing written, when the module has no authority reaching the scope:
+ * no grant and no marker here, and no live TENANT-level grant (`tenantHeld`, which the caller
+ * reads from the directory, since the scope's storage cannot answer it). The caller named
+ * something this scope never ran, and turning "nothing" off must not write a marker that
+ * silently disables a module the day it is installed. A module whose only authority here is a
+ * tenant-level grant IS held (#1823): OFF writes the marker, which the evaluator then denies
+ * the module on, and tombstones nothing, because nothing of it is here to tombstone.
  *
  * Run it inside one transaction; the reads and writes here are meant to be one unit.
  */
 export function switchSystemSchedules(db, input) {
-    return switchSubjectGrants(db, {
-        subject: subjectOf(input.moduleId),
-        scopeId: input.scopeId,
-        to: input.to,
-        at: input.at,
-    });
+    const { moduleId, ...rest } = input;
+    const outcome = switchSubjectGrants(db, { subject: subjectOf(moduleId), ...rest });
+    return { ...outcome, deniesTenantGrants: true };
+}
+/** A wire carry as the unit runs it, or undefined when it names nothing to switch off. */
+export function recordedOffFromWire(wire) {
+    if (!wire.switchedOff?.length && !wire.switchedOffPeers?.length)
+        return undefined;
+    return {
+        moduleIds: wire.switchedOff ?? [],
+        tenantHeld: wire.tenantHeld,
+        verticals: wire.switchedOffPeers,
+        tenantHeldVerticals: wire.tenantHeldPeers,
+        fences: wire.switchFences,
+    };
 }
 /**
- * Switch the directory's recorded-off modules off again, inside the unit that re-created the
+ * Switch the directory's recorded-off subjects off again, inside the unit that re-created the
  * scope's grants (#1742): a provision's or reconcile's seat, or a restore's replay. The caller
  * runs it in that same unit, AFTER the seat, so the grants the seat created are the ones OFF
  * tombstones and records, and a later restore gives back exactly those (#1674's order). No
- * schedule can run between the seat and this, because nothing can run between them.
+ * schedule can run, and no peer call be admitted, between the seat and this, because nothing
+ * can run between them.
  *
- * `scopeId` is the scope `db` is, and the caller passes the one the request provisions or
- * restores, never a second id: the list names modules, never scopes, so it can only reach
- * the scope that unit is already writing. A module the scope holds nothing for answers
- * `held: false` and writes nothing, as the switch always does. Off only: nothing here turns
- * a module on.
+ * `moduleIds` are the recorded-off modules, `verticals` the recorded-off peers (#2029). `scopeId`
+ * is the scope `db` is, and the caller passes the one the request provisions or restores, never
+ * a second id: the lists name subjects, never scopes, so they can only reach the scope that unit
+ * is already writing. A subject the scope holds nothing for answers `held: false` and writes
+ * nothing, as the switch always does — unless it is in `tenantHeld` / `tenantHeldVerticals`, the
+ * recorded-off subjects the caller found a live tenant-level grant for (#1823, #2030). Off only:
+ * nothing here turns anything on.
  */
 export function switchRecordedOff(db, input) {
-    return [...new Set(input.moduleIds)].map((moduleId) => ({
+    const tenantHeld = new Set(input.tenantHeld ?? []);
+    const fenceOf = (subject) => input.fences?.[subject];
+    const modules = [...new Set(input.moduleIds)].map((moduleId) => ({
         moduleId,
-        ...switchSystemSchedules(db, { moduleId, scopeId: input.scopeId, to: 'off', at: input.at }),
+        ...switchSystemSchedules(db, {
+            moduleId,
+            scopeId: input.scopeId,
+            to: 'off',
+            at: input.at,
+            tenantHeld: tenantHeld.has(moduleId),
+            fence: fenceOf(subjectOf(moduleId)),
+        }),
+    }));
+    const peersHeld = new Set(input.tenantHeldVerticals ?? []);
+    const peers = [...new Set(input.verticals ?? [])].map((vertical) => ({
+        vertical,
+        ...moveSwitch(db, 'peer', {
+            key: vertical,
+            scopeId: input.scopeId,
+            to: 'off',
+            at: input.at,
+            tenantHeld: peersHeld.has(vertical),
+            fence: fenceOf(peerSubjectRef(vertical)),
+        }),
     }));
+    return [...modules, ...peers];
+}
+/**
+ * Move one kill switch of either kind on one scope (#2029): `switchSystemSchedules` for a
+ * module, `switchSubjectGrants` over `vertical:<key>` for a peer. `key` is the module id or the
+ * peer's slug. The one mover the adapters' shared switch body and their re-asserts call.
+ */
+export function moveSwitch(db, kind, input) {
+    const { key, ...rest } = input;
+    return kind === 'system'
+        ? switchSystemSchedules(db, { moduleId: key, ...rest })
+        : switchSubjectGrants(db, { subject: peerSubjectRef(key), ...rest });
 }
 /**
  * The switch itself, for ANY non-person subject's scope-level grants — `switchSystemSchedules`
@@ -177,13 +268,30 @@ export function switchRecordedOff(db, input) {
  * for exactly the subject it names.
  */
 export function switchSubjectGrants(db, input) {
-    const subject = input.subject;
     const object = `scope:${input.scopeId}`;
+    const stored = input.fence === undefined
+        ? undefined
+        : db.all(`SELECT fence FROM _substrat_switch_fences WHERE subject = ? AND object = ?`, input.subject, object)[0];
+    if (input.fence !== undefined && stored !== undefined && stored.fence > input.fence) {
+        return { held: true, changed: false, permissions: [], superseded: true, fenced: true };
+    }
+    const outcome = applySwitch(db, input, object);
+    if (input.fence !== undefined)
+        outcome.fenced = true;
+    if (input.fence !== undefined && outcome.held) {
+        db.run(`INSERT INTO _substrat_switch_fences (subject, object, fence) VALUES (?, ?, ?)
+       ON CONFLICT (subject, object) DO UPDATE SET fence = excluded.fence`, input.subject, object, input.fence);
+    }
+    return outcome;
+}
+/** `switchSubjectGrants`' move itself, once the fence has let it through. */
+function applySwitch(db, input, object) {
+    const subject = input.subject;
     const grants = db.all(`SELECT relation, revoked_at FROM _substrat_tuples
       WHERE subject = ? AND object = ? AND substr(relation, 1, 8) = 'granted:'
       ORDER BY relation`, subject, object);
     const marker = db.all(`SELECT revoked_at FROM _substrat_tuples WHERE subject = ? AND relation = ? AND object = ?`, subject, SYSTEM_SWITCH_OFF_RELATION, object)[0];
-    if (grants.length === 0 && !marker)
+    if (grants.length === 0 && !marker && !input.tenantHeld)
         return { held: false, changed: false, permissions: [] };
     const permissionOf = (relation) => relation.slice('granted:'.length);
     if (input.to === 'off') {

package/dist/system-switch.js.map

@@ -1 +1 @@
-{"version":3,"file":"system-switch.js","sourceRoot":"","sources":["../src/system-switch.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4CG;AAEH,4FAA4F;AAC5F,MAAM,CAAC,MAAM,0BAA0B,GAAG,YAAY,CAAC;AAEvD,uFAAuF;AACvF,MAAM,eAAe,GAAG,WAAW,CAAC;AAqBpC,MAAM,SAAS,GAAG,CAAC,QAAgB,EAAU,EAAE,CAAC,UAAU,QAAQ,EAAE,CAAC;AAErE;;;;GAIG;AACH,MAAM,CAAC,MAAM,2BAA2B,GAAG;sCACL,0BAA0B,2BAA2B,CAAC;AAE5F;;;;GAIG;AACH,MAAM,UAAU,mBAAmB,CAAC,EAAa,EAAE,QAAgB,EAAE,GAAW;IAC9E,OAAO,iBAAiB,CAAC,EAAE,EAAE,SAAS,CAAC,QAAQ,CAAC,EAAE,GAAG,CAAC,CAAC;AACzD,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,iBAAiB,CAAC,EAAa,EAAE,OAAe,EAAE,GAAW;IAC3E,MAAM,GAAG,GAAG,EAAE,CAAC,GAAG,CAChB;SACK,2BAA2B;;;gGAG4D,EAC5F,OAAO,EACP,OAAO,EACP,GAAG,CACJ,CAAC,CAAC,CAAiD,CAAC;IACrD,IAAI,MAAM,CAAC,GAAG,EAAE,GAAG,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IACzC,OAAO,MAAM,CAAC,GAAG,EAAE,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,WAAW,CAAC;AACzD,CAAC;AAQD;;;;;;;GAOG;AACH,MAAM,UAAU,kBAAkB,CAAC,EAAa,EAAE,GAAW;IAC3D,MAAM,IAAI,GAAG,EAAE,CAAC,GAAG,CACjB;;kEAE8D,0BAA0B;uBACrE,CACK,CAAC;IAC3B,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE;QACtB,MAAM,QAAQ,GAAG,GAAG,CAAC,OAAO,CAAC,KAAK,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;QACrD,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAE,mBAAmB,CAAC,EAAE,EAAE,QAAQ,EAAE,GAAG,CAAC,EAAE,CAAC;IACzE,CAAC,CAAC,CAAC;AACL,CAAC;AAED,yFAAyF;AACzF,MAAM,UAAU,iBAAiB,CAAC,EAAa,EAAE,QAAgB;IAC/D,OAAO,kBAAkB,CAAC,EAAE,EAAE,SAAS,CAAC,QAAQ,CAAC,CAAC,CAAC;AACrD,CAAC;AAED,uGAAuG;AACvG,MAAM,UAAU,kBAAkB,CAAC,EAAa,EAAE,OAAe;IAC/D,MAAM,GAAG,GAAG,EAAE,CAAC,GAAG,CAAC,UAAU,2BAA2B,SAAS,EAAE,OAAO,CAAC,CAAC,CAAC,CAEhE,CAAC;IACd,OAAO,MAAM,CAAC,GAAG,EAAE,GAAG,CAAC,KAAK,CAAC,CAAC;AAChC,CAAC;AAED,gFAAgF;AAChF,MAAM,YAAY,GAAG,CAAC,CAAC;AAEvB,MAAM,kBAAkB,GAAG,CAAC,QAAgB,EAAE,KAAa,EAAE,KAAa,EAAU,EAAE,CACpF,WAAW,QAAQ,wBAAwB,KAAK,8BAA8B;IAC9E,gDAAgD,KAAK,0CAA0C;IAC/F,+DAA+D,CAAC;AAElE,+FAA+F;AAC/F,MAAM,UAAU,wBAAwB,CAAC,QAAgB,EAAE,OAAe;IACxE,OAAO,kBAAkB,CAAC,QAAQ,EAAE,SAAS,OAAO,EAAE,EAAE,EAAE,CAAC,CAAC;AAC9D,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,8BAA8B,CAAC,QAAgB,EAAE,QAA2B;IAC1F,MAAM,KAAK,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,YAAY,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACzD,MAAM,IAAI,GAAG,QAAQ,CAAC,MAAM,GAAG,YAAY,CAAC,CAAC,CAAC,QAAQ,QAAQ,CAAC,MAAM,GAAG,YAAY,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC;IACjG,MAAM,KAAK,GAAG,QAAQ,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,SAAS,KAAK,EAAE,CAAC,CAAC,CAAC,UAAU,KAAK,GAAG,IAAI,EAAE,CAAC;IAClF,OAAO,kBAAkB,CAAC,QAAQ,EAAE,KAAK,EAAE,6DAA6D,CAAC,CAAC;AAC5G,CAAC;AASD;;;;;;;;;;;;;;GAcG;AACH,MAAM,UAAU,qBAAqB,CACnC,EAAa,EACb,KAA0E;IAE1E,OAAO,mBAAmB,CAAC,EAAE,EAAE;QAC7B,OAAO,EAAE,SAAS,CAAC,KAAK,CAAC,QAAQ,CAAC;QAClC,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,EAAE,EAAE,KAAK,CAAC,EAAE;QACZ,EAAE,EAAE,KAAK,CAAC,EAAE;KACb,CAAC,CAAC;AACL,CAAC;AAOD;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,iBAAiB,CAC/B,EAAa,EACb,KAAoE;IAEpE,OAAO,CAAC,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC;QACtD,QAAQ;QACR,GAAG,qBAAqB,CAAC,EAAE,EAAE,EAAE,QAAQ,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC;KAC5F,CAAC,CAAC,CAAC;AACN,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,mBAAmB,CACjC,EAAa,EACb,KAAyE;IAEzE,MAAM,OAAO,GAAG,KAAK,CAAC,OAAO,CAAC;IAC9B,MAAM,MAAM,GAAG,SAAS,KAAK,CAAC,OAAO,EAAE,CAAC;IACxC,MAAM,MAAM,GAAG,EAAE,CAAC,GAAG,CACnB;;wBAEoB,EACpB,OAAO,EACP,MAAM,CAC8C,CAAC;IACvD,MAAM,MAAM,GAAG,EAAE,CAAC,GAAG,CACnB,2FAA2F,EAC3F,OAAO,EACP,0BAA0B,EAC1B,MAAM,CACP,CAAC,CAAC,CAA8C,CAAC;IAClD,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,IAAI,CAAC,MAAM;QAAE,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,WAAW,EAAE,EAAE,EAAE,CAAC;IAE5F,MAAM,YAAY,GAAG,CAAC,QAAgB,EAAU,EAAE,CAAC,QAAQ,CAAC,KAAK,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC;IACrF,IAAI,KAAK,CAAC,EAAE,KAAK,KAAK,EAAE,CAAC;QACvB,MAAM,IAAI,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,KAAK,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,YAAY,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC;QAC9F,KAAK,MAAM,UAAU,IAAI,IAAI,EAAE,CAAC;YAC9B,EAAE,CAAC,GAAG,CACJ,8FAA8F,EAC9F,KAAK,CAAC,EAAE,EACR,OAAO,EACP,WAAW,UAAU,EAAE,EACvB,MAAM,CACP,CAAC;YACF,kFAAkF;YAClF,2DAA2D;YAC3D,EAAE,CAAC,GAAG,CACJ;sCAC8B,EAC9B,OAAO,EACP,GAAG,eAAe,GAAG,UAAU,EAAE,EACjC,MAAM,CACP,CAAC;QACJ,CAAC;QACD,MAAM,WAAW,GAAG,CAAC,MAAM,IAAI,MAAM,CAAC,UAAU,KAAK,IAAI,CAAC;QAC1D,IAAI,WAAW,EAAE,CAAC;YAChB,EAAE,CAAC,GAAG,CACJ;sCAC8B,EAC9B,OAAO,EACP,0BAA0B,EAC1B,MAAM,CACP,CAAC;QACJ,CAAC;QACD,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,OAAO,EAAE,WAAW,IAAI,IAAI,CAAC,MAAM,GAAG,CAAC,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC;IACpF,CAAC;IAED,MAAM,OAAO,GAAG,EAAE,CAAC,GAAG,CACpB;;wBAEoB,EACpB,OAAO,EACP,MAAM,EACN,eAAe,CACU,CAAC;IAC5B,MAAM,QAAQ,GAAa,EAAE,CAAC;IAC9B,KAAK,MAAM,EAAE,QAAQ,EAAE,IAAI,OAAO,EAAE,CAAC;QACnC,MAAM,UAAU,GAAG,QAAQ,CAAC,KAAK,CAAC,eAAe,CAAC,MAAM,CAAC,CAAC;QAC1D,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,WAAW,UAAU,EAAE,IAAI,CAAC,CAAC,UAAU,KAAK,IAAI,CAAC,CAAC;QACpG,IAAI,OAAO,EAAE,CAAC;YACZ,EAAE,CAAC,GAAG,CACJ,iGAAiG,EACjG,OAAO,EACP,WAAW,UAAU,EAAE,EACvB,MAAM,CACP,CAAC;YACF,QAAQ,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;QAC5B,CAAC;QACD,EAAE,CAAC,GAAG,CACJ,8FAA8F,EAC9F,KAAK,CAAC,EAAE,EACR,OAAO,EACP,QAAQ,EACR,MAAM,CACP,CAAC;IACJ,CAAC;IACD,MAAM,WAAW,GAAG,MAAM,KAAK,SAAS,IAAI,MAAM,CAAC,UAAU,KAAK,IAAI,CAAC;IACvE,IAAI,WAAW,EAAE,CAAC;QAChB,EAAE,CAAC,GAAG,CACJ,8FAA8F,EAC9F,KAAK,CAAC,EAAE,EACR,OAAO,EACP,0BAA0B,EAC1B,MAAM,CACP,CAAC;IACJ,CAAC;IACD,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,OAAO,EAAE,WAAW,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,WAAW,EAAE,QAAQ,EAAE,CAAC;AAC5F,CAAC"}
+{"version":3,"file":"system-switch.js","sourceRoot":"","sources":["../src/system-switch.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkDG;AAEH,4FAA4F;AAC5F,MAAM,CAAC,MAAM,0BAA0B,GAAG,YAAY,CAAC;AAEvD,uFAAuF;AACvF,MAAM,eAAe,GAAG,WAAW,CAAC;AAqBpC,MAAM,SAAS,GAAG,CAAC,QAAgB,EAAU,EAAE,CAAC,UAAU,QAAQ,EAAE,CAAC;AAQrE,kHAAkH;AAClH,MAAM,CAAC,MAAM,mBAAmB,GAAG,WAAW,CAAC;AAE/C,uHAAuH;AACvH,MAAM,CAAC,MAAM,cAAc,GAAG,CAAC,QAAgB,EAAU,EAAE,CAAC,GAAG,mBAAmB,GAAG,QAAQ,EAAE,CAAC;AAEhG;;;;GAIG;AACH,MAAM,CAAC,MAAM,2BAA2B,GAAG;sCACL,0BAA0B,2BAA2B,CAAC;AAE5F;;;;GAIG;AACH,MAAM,UAAU,mBAAmB,CAAC,EAAa,EAAE,QAAgB,EAAE,GAAW;IAC9E,OAAO,iBAAiB,CAAC,EAAE,EAAE,SAAS,CAAC,QAAQ,CAAC,EAAE,GAAG,CAAC,CAAC;AACzD,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,iBAAiB,CAAC,EAAa,EAAE,OAAe,EAAE,GAAW;IAC3E,MAAM,GAAG,GAAG,EAAE,CAAC,GAAG,CAChB;SACK,2BAA2B;;;gGAG4D,EAC5F,OAAO,EACP,OAAO,EACP,GAAG,CACJ,CAAC,CAAC,CAAiD,CAAC;IACrD,IAAI,MAAM,CAAC,GAAG,EAAE,GAAG,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IACzC,OAAO,MAAM,CAAC,GAAG,EAAE,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,WAAW,CAAC;AACzD,CAAC;AAQD;;;;;;;GAOG;AACH,MAAM,UAAU,kBAAkB,CAAC,EAAa,EAAE,GAAW;IAC3D,MAAM,IAAI,GAAG,EAAE,CAAC,GAAG,CACjB;;kEAE8D,0BAA0B;uBACrE,CACK,CAAC;IAC3B,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE;QACtB,MAAM,QAAQ,GAAG,GAAG,CAAC,OAAO,CAAC,KAAK,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;QACrD,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAE,mBAAmB,CAAC,EAAE,EAAE,QAAQ,EAAE,GAAG,CAAC,EAAE,CAAC;IACzE,CAAC,CAAC,CAAC;AACL,CAAC;AAED,yFAAyF;AACzF,MAAM,UAAU,iBAAiB,CAAC,EAAa,EAAE,QAAgB;IAC/D,OAAO,kBAAkB,CAAC,EAAE,EAAE,SAAS,CAAC,QAAQ,CAAC,CAAC,CAAC;AACrD,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,MAAM,uBAAuB,GAAG,UAAU,2BAA2B,SAAS,CAAC;AAEtF,uGAAuG;AACvG,MAAM,UAAU,kBAAkB,CAAC,EAAa,EAAE,OAAe;IAC/D,MAAM,GAAG,GAAG,EAAE,CAAC,GAAG,CAAC,uBAAuB,EAAE,OAAO,CAAC,CAAC,CAAC,CAAgC,CAAC;IACvF,OAAO,MAAM,CAAC,GAAG,EAAE,GAAG,CAAC,KAAK,CAAC,CAAC;AAChC,CAAC;AAED;;;;GAIG;AACH,MAAM,gBAAgB,GAAwB,IAAI,GAAG,CAAC,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAC,CAAC;AAC9E,MAAM,CAAC,MAAM,uBAAuB,GAAG,CAAC,IAAY,EAAW,EAAE,CAAC,gBAAgB,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;AAE7F,gFAAgF;AAChF,MAAM,YAAY,GAAG,CAAC,CAAC;AAEvB,MAAM,kBAAkB,GAAG,CAAC,QAAgB,EAAE,KAAa,EAAE,KAAa,EAAU,EAAE,CACpF,WAAW,QAAQ,wBAAwB,KAAK,8BAA8B;IAC9E,gDAAgD,KAAK,0CAA0C;IAC/F,+DAA+D,CAAC;AAElE,+FAA+F;AAC/F,MAAM,UAAU,wBAAwB,CAAC,QAAgB,EAAE,OAAe;IACxE,OAAO,kBAAkB,CAAC,QAAQ,EAAE,SAAS,OAAO,EAAE,EAAE,EAAE,CAAC,CAAC;AAC9D,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,8BAA8B,CAAC,QAAgB,EAAE,QAA2B;IAC1F,MAAM,KAAK,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,YAAY,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACzD,MAAM,IAAI,GAAG,QAAQ,CAAC,MAAM,GAAG,YAAY,CAAC,CAAC,CAAC,QAAQ,QAAQ,CAAC,MAAM,GAAG,YAAY,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC;IACjG,MAAM,KAAK,GAAG,QAAQ,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,SAAS,KAAK,EAAE,CAAC,CAAC,CAAC,UAAU,KAAK,GAAG,IAAI,EAAE,CAAC;IAClF,OAAO,kBAAkB,CAAC,QAAQ,EAAE,KAAK,EAAE,6DAA6D,CAAC,CAAC;AAC5G,CAAC;AAgCD;;;;;;;;;GASG;AACH,MAAM,CAAC,MAAM,iBAAiB,GAAG;;;;;;;;CAQhC,CAAC;AAEF;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,UAAU,qBAAqB,CACnC,EAAa,EACb,KAAgH;IAEhH,MAAM,EAAE,QAAQ,EAAE,GAAG,IAAI,EAAE,GAAG,KAAK,CAAC;IACpC,MAAM,OAAO,GAAG,mBAAmB,CAAC,EAAE,EAAE,EAAE,OAAO,EAAE,SAAS,CAAC,QAAQ,CAAC,EAAE,GAAG,IAAI,EAAE,CAAC,CAAC;IACnF,OAAO,EAAE,GAAG,OAAO,EAAE,kBAAkB,EAAE,IAAI,EAAE,CAAC;AAClD,CAAC;AA0CD,0FAA0F;AAC1F,MAAM,UAAU,mBAAmB,CAAC,IAAqB;IACvD,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,MAAM,IAAI,CAAC,IAAI,CAAC,gBAAgB,EAAE,MAAM;QAAE,OAAO,SAAS,CAAC;IAClF,OAAO;QACL,SAAS,EAAE,IAAI,CAAC,WAAW,IAAI,EAAE;QACjC,UAAU,EAAE,IAAI,CAAC,UAAU;QAC3B,SAAS,EAAE,IAAI,CAAC,gBAAgB;QAChC,mBAAmB,EAAE,IAAI,CAAC,eAAe;QACzC,MAAM,EAAE,IAAI,CAAC,YAAY;KAC1B,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;;;;;GAeG;AACH,MAAM,UAAU,iBAAiB,CAAC,EAAa,EAAE,KAAyD;IACxG,MAAM,UAAU,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,UAAU,IAAI,EAAE,CAAC,CAAC;IACnD,MAAM,OAAO,GAAG,CAAC,OAAe,EAAsB,EAAE,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,CAAC;IACjF,MAAM,OAAO,GAAkB,CAAC,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC;QAC9E,QAAQ;QACR,GAAG,qBAAqB,CAAC,EAAE,EAAE;YAC3B,QAAQ;YACR,OAAO,EAAE,KAAK,CAAC,OAAO;YACtB,EAAE,EAAE,KAAK;YACT,EAAE,EAAE,KAAK,CAAC,EAAE;YACZ,UAAU,EAAE,UAAU,CAAC,GAAG,CAAC,QAAQ,CAAC;YACpC,KAAK,EAAE,OAAO,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC;SACpC,CAAC;KACH,CAAC,CAAC,CAAC;IACJ,MAAM,SAAS,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,mBAAmB,IAAI,EAAE,CAAC,CAAC;IAC3D,MAAM,KAAK,GAAkB,CAAC,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,SAAS,IAAI,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC;QAClF,QAAQ;QACR,GAAG,UAAU,CAAC,EAAE,EAAE,MAAM,EAAE;YACxB,GAAG,EAAE,QAAQ;YACb,OAAO,EAAE,KAAK,CAAC,OAAO;YACtB,EAAE,EAAE,KAAK;YACT,EAAE,EAAE,KAAK,CAAC,EAAE;YACZ,UAAU,EAAE,SAAS,CAAC,GAAG,CAAC,QAAQ,CAAC;YACnC,KAAK,EAAE,OAAO,CAAC,cAAc,CAAC,QAAQ,CAAC,CAAC;SACzC,CAAC;KACH,CAAC,CAAC,CAAC;IACJ,OAAO,CAAC,GAAG,OAAO,EAAE,GAAG,KAAK,CAAC,CAAC;AAChC,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,UAAU,CACxB,EAAa,EACb,IAAgB,EAChB,KAA2G;IAE3G,MAAM,EAAE,GAAG,EAAE,GAAG,IAAI,EAAE,GAAG,KAAK,CAAC;IAC/B,OAAO,IAAI,KAAK,QAAQ;QACtB,CAAC,CAAC,qBAAqB,CAAC,EAAE,EAAE,EAAE,QAAQ,EAAE,GAAG,EAAE,GAAG,IAAI,EAAE,CAAC;QACvD,CAAC,CAAC,mBAAmB,CAAC,EAAE,EAAE,EAAE,OAAO,EAAE,cAAc,CAAC,GAAG,CAAC,EAAE,GAAG,IAAI,EAAE,CAAC,CAAC;AACzE,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,mBAAmB,CACjC,EAAa,EACb,KAaC;IAED,MAAM,MAAM,GAAG,SAAS,KAAK,CAAC,OAAO,EAAE,CAAC;IACxC,MAAM,MAAM,GACV,KAAK,CAAC,KAAK,KAAK,SAAS;QACvB,CAAC,CAAC,SAAS;QACX,CAAC,CAAE,EAAE,CAAC,GAAG,CAAC,4EAA4E,EAAE,KAAK,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC,CAAC,CAEhG,CAAC;IACrB,IAAI,KAAK,CAAC,KAAK,KAAK,SAAS,IAAI,MAAM,KAAK,SAAS,IAAI,MAAM,CAAC,KAAK,GAAG,KAAK,CAAC,KAAK,EAAE,CAAC;QACpF,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,WAAW,EAAE,EAAE,EAAE,UAAU,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;IACzF,CAAC;IACD,MAAM,OAAO,GAAkB,WAAW,CAAC,EAAE,EAAE,KAAK,EAAE,MAAM,CAAC,CAAC;IAC9D,IAAI,KAAK,CAAC,KAAK,KAAK,SAAS;QAAE,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC;IACrD,IAAI,KAAK,CAAC,KAAK,KAAK,SAAS,IAAI,OAAO,CAAC,IAAI,EAAE,CAAC;QAC9C,EAAE,CAAC,GAAG,CACJ;0EACoE,EACpE,KAAK,CAAC,OAAO,EACb,MAAM,EACN,KAAK,CAAC,KAAK,CACZ,CAAC;IACJ,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,6EAA6E;AAC7E,SAAS,WAAW,CAClB,EAAa,EACb,KAA8E,EAC9E,MAAc;IAEd,MAAM,OAAO,GAAG,KAAK,CAAC,OAAO,CAAC;IAC9B,MAAM,MAAM,GAAG,EAAE,CAAC,GAAG,CACnB;;wBAEoB,EACpB,OAAO,EACP,MAAM,CAC8C,CAAC;IACvD,MAAM,MAAM,GAAG,EAAE,CAAC,GAAG,CACnB,2FAA2F,EAC3F,OAAO,EACP,0BAA0B,EAC1B,MAAM,CACP,CAAC,CAAC,CAA8C,CAAC;IAClD,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,IAAI,CAAC,MAAM,IAAI,CAAC,KAAK,CAAC,UAAU;QAAE,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,WAAW,EAAE,EAAE,EAAE,CAAC;IAEjH,MAAM,YAAY,GAAG,CAAC,QAAgB,EAAU,EAAE,CAAC,QAAQ,CAAC,KAAK,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC;IACrF,IAAI,KAAK,CAAC,EAAE,KAAK,KAAK,EAAE,CAAC;QACvB,MAAM,IAAI,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,KAAK,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,YAAY,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC;QAC9F,KAAK,MAAM,UAAU,IAAI,IAAI,EAAE,CAAC;YAC9B,EAAE,CAAC,GAAG,CACJ,8FAA8F,EAC9F,KAAK,CAAC,EAAE,EACR,OAAO,EACP,WAAW,UAAU,EAAE,EACvB,MAAM,CACP,CAAC;YACF,kFAAkF;YAClF,2DAA2D;YAC3D,EAAE,CAAC,GAAG,CACJ;sCAC8B,EAC9B,OAAO,EACP,GAAG,eAAe,GAAG,UAAU,EAAE,EACjC,MAAM,CACP,CAAC;QACJ,CAAC;QACD,MAAM,WAAW,GAAG,CAAC,MAAM,IAAI,MAAM,CAAC,UAAU,KAAK,IAAI,CAAC;QAC1D,IAAI,WAAW,EAAE,CAAC;YAChB,EAAE,CAAC,GAAG,CACJ;sCAC8B,EAC9B,OAAO,EACP,0BAA0B,EAC1B,MAAM,CACP,CAAC;QACJ,CAAC;QACD,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,OAAO,EAAE,WAAW,IAAI,IAAI,CAAC,MAAM,GAAG,CAAC,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC;IACpF,CAAC;IAED,MAAM,OAAO,GAAG,EAAE,CAAC,GAAG,CACpB;;wBAEoB,EACpB,OAAO,EACP,MAAM,EACN,eAAe,CACU,CAAC;IAC5B,MAAM,QAAQ,GAAa,EAAE,CAAC;IAC9B,KAAK,MAAM,EAAE,QAAQ,EAAE,IAAI,OAAO,EAAE,CAAC;QACnC,MAAM,UAAU,GAAG,QAAQ,CAAC,KAAK,CAAC,eAAe,CAAC,MAAM,CAAC,CAAC;QAC1D,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,WAAW,UAAU,EAAE,IAAI,CAAC,CAAC,UAAU,KAAK,IAAI,CAAC,CAAC;QACpG,IAAI,OAAO,EAAE,CAAC;YACZ,EAAE,CAAC,GAAG,CACJ,iGAAiG,EACjG,OAAO,EACP,WAAW,UAAU,EAAE,EACvB,MAAM,CACP,CAAC;YACF,QAAQ,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;QAC5B,CAAC;QACD,EAAE,CAAC,GAAG,CACJ,8FAA8F,EAC9F,KAAK,CAAC,EAAE,EACR,OAAO,EACP,QAAQ,EACR,MAAM,CACP,CAAC;IACJ,CAAC;IACD,MAAM,WAAW,GAAG,MAAM,KAAK,SAAS,IAAI,MAAM,CAAC,UAAU,KAAK,IAAI,CAAC;IACvE,IAAI,WAAW,EAAE,CAAC;QAChB,EAAE,CAAC,GAAG,CACJ,8FAA8F,EAC9F,KAAK,CAAC,EAAE,EACR,OAAO,EACP,0BAA0B,EAC1B,MAAM,CACP,CAAC;IACJ,CAAC;IACD,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,OAAO,EAAE,WAAW,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,WAAW,EAAE,QAAQ,EAAE,CAAC;AAC5F,CAAC"}

package/dist/timeline.d.ts

@@ -240,6 +240,29 @@ export declare function readInvocation(ctx: TimelineReader, invocationId: string
  * Same permission posture as every read here: the caller checks, this does not.
  */
 export declare function readDeadLetters(ctx: TimelineReader, page?: Pick<ListPage, 'limit' | 'cursor'>): Page<DeadLetter>;
+/** What one executor did with one event, as `readExecutorDelivery` reads it (#1184). */
+export type ExecutorDeliveryState = 'unattempted' | 'retrying' | 'delivered' | 'refused' | 'dead-lettered';
+export interface ExecutorDelivery {
+    eventId: string;
+    state: ExecutorDeliveryState;
+    /** A refusal's reason, or the last failure. Null when nothing has failed. */
+    error: string | null;
+}
+/**
+ * The newest `eventType` event about `entity`, and what executor `executorId` did with it
+ * (#1184) — or null when there is no such event. What a module reads to show the effect it
+ * asked for as it actually stands: still pending, refused and why, or done.
+ *
+ * The journal's own predicates, in one place: no delivery row is `unattempted`; a next
+ * attempt is `retrying`; no error is `delivered`; an error with no next attempt is `refused`
+ * when the handler refused it (`REFUSAL_JOURNAL_PREFIX`) and `dead-lettered` when retries ran
+ * out. Same permission posture as every read here: the caller checks, this does not.
+ */
+export declare function readExecutorDelivery(ctx: TimelineReader, input: {
+    executorId: string;
+    eventType: string;
+    entity: EntityRef;
+}): ExecutorDelivery | null;
 /**
  * Facet a scope's own outbox (#1239 stage 1): narrow by type and window, group by
  * one envelope column or one payload field, count.

package/dist/timeline.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"timeline.d.ts","sourceRoot":"","sources":["../src/timeline.ts"],"names":[],"mappings":"AAAA,OAAO,EAQL,KAAK,SAAS,EACd,KAAK,OAAO,EAEZ,KAAK,YAAY,EACjB,KAAK,UAAU,EACf,KAAK,WAAW,EAEhB,KAAK,gBAAgB,EACrB,KAAK,UAAU,EAMf,KAAK,QAAQ,EACb,KAAK,IAAI,EACT,KAAK,aAAa,EAClB,KAAK,kBAAkB,EACvB,KAAK,iBAAiB,EACtB,KAAK,eAAe,EACpB,KAAK,gBAAgB,EACtB,MAAM,yBAAyB,CAAC;AAEjC,OAAO,KAAK,EAAE,SAAS,EAAY,MAAM,iBAAiB,CAAC;AAE3D;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAuDG;AAEH,oFAAoF;AACpF,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,GAAG,EAAE,IAAI,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC;CACxC;AAmID;;;;;;;;;;;GAWG;AACH,wBAAgB,YAAY,CAC1B,GAAG,EAAE,cAAc,EACnB,MAAM,EAAE,SAAS,EACjB,IAAI,CAAC,EAAE,QAAQ,GACd,IAAI,CAAC,aAAa,CAAC,CAKrB;AAED;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,wBAAgB,WAAW,CACzB,GAAG,EAAE,cAAc,EACnB,MAAM,EAAE,SAAS,EACjB,IAAI,CAAC,EAAE,QAAQ,GACd,IAAI,CAAC,YAAY,CAAC,CAKpB;AAED;;;;;;;;GAQG;AACH,MAAM,WAAW,aAAc,SAAQ,QAAQ;IAC7C,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AA4ED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiCG;AACH,wBAAgB,iBAAiB,CAC/B,GAAG,EAAE,cAAc,EACnB,IAAI,CAAC,EAAE,aAAa,GACnB,IAAI,CAAC,kBAAkB,CAAC,CAS1B;AAED;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,gBAAgB,CAC9B,GAAG,EAAE,cAAc,EACnB,IAAI,CAAC,EAAE,aAAa,GACnB,IAAI,CAAC,iBAAiB,CAAC,CAazB;AAED;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,wBAAgB,cAAc,CAC5B,GAAG,EAAE,cAAc,EACnB,OAAO,EAAE,OAAO,EAChB,QAAQ,SAAK,GACZ,UAAU,CAiEZ;AAkDD;;;;;;;;;;;;;GAaG;AACH,wBAAgB,gBAAgB,CAC9B,GAAG,EAAE,cAAc,EACnB,OAAO,EAAE,OAAO,EAChB,QAAQ,SAAK,GACZ,WAAW,CAoFb;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,cAAc,CAC5B,GAAG,EAAE,cAAc,EACnB,YAAY,EAAE,MAAM,EACpB,KAAK,SAAM,GACV,gBAAgB,CAOlB;AA+DD;;;;;;;;;;;;;;;;;;;GAmBG;AACH,wBAAgB,eAAe,CAAC,GAAG,EAAE,cAAc,EAAE,IAAI,CAAC,EAAE,IAAI,CAAC,QAAQ,EAAE,OAAO,GAAG,QAAQ,CAAC,GAAG,IAAI,CAAC,UAAU,CAAC,CAwChH;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA0CG;AACH,wBAAgB,WAAW,CAAC,GAAG,EAAE,cAAc,EAAE,KAAK,EAAE,eAAe,GAAG,gBAAgB,CA6EzF"}
+{"version":3,"file":"timeline.d.ts","sourceRoot":"","sources":["../src/timeline.ts"],"names":[],"mappings":"AAAA,OAAO,EAQL,KAAK,SAAS,EACd,KAAK,OAAO,EAEZ,KAAK,YAAY,EACjB,KAAK,UAAU,EACf,KAAK,WAAW,EAEhB,KAAK,gBAAgB,EACrB,KAAK,UAAU,EAMf,KAAK,QAAQ,EACb,KAAK,IAAI,EACT,KAAK,aAAa,EAClB,KAAK,kBAAkB,EACvB,KAAK,iBAAiB,EACtB,KAAK,eAAe,EACpB,KAAK,gBAAgB,EACtB,MAAM,yBAAyB,CAAC;AAEjC,OAAO,KAAK,EAAE,SAAS,EAAY,MAAM,iBAAiB,CAAC;AAG3D;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAuDG;AAEH,oFAAoF;AACpF,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,GAAG,EAAE,IAAI,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC;CACxC;AAmID;;;;;;;;;;;GAWG;AACH,wBAAgB,YAAY,CAC1B,GAAG,EAAE,cAAc,EACnB,MAAM,EAAE,SAAS,EACjB,IAAI,CAAC,EAAE,QAAQ,GACd,IAAI,CAAC,aAAa,CAAC,CAKrB;AAED;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,wBAAgB,WAAW,CACzB,GAAG,EAAE,cAAc,EACnB,MAAM,EAAE,SAAS,EACjB,IAAI,CAAC,EAAE,QAAQ,GACd,IAAI,CAAC,YAAY,CAAC,CAKpB;AAED;;;;;;;;GAQG;AACH,MAAM,WAAW,aAAc,SAAQ,QAAQ;IAC7C,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AA4ED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiCG;AACH,wBAAgB,iBAAiB,CAC/B,GAAG,EAAE,cAAc,EACnB,IAAI,CAAC,EAAE,aAAa,GACnB,IAAI,CAAC,kBAAkB,CAAC,CAS1B;AAED;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,gBAAgB,CAC9B,GAAG,EAAE,cAAc,EACnB,IAAI,CAAC,EAAE,aAAa,GACnB,IAAI,CAAC,iBAAiB,CAAC,CAazB;AAED;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,wBAAgB,cAAc,CAC5B,GAAG,EAAE,cAAc,EACnB,OAAO,EAAE,OAAO,EAChB,QAAQ,SAAK,GACZ,UAAU,CAiEZ;AAkDD;;;;;;;;;;;;;GAaG;AACH,wBAAgB,gBAAgB,CAC9B,GAAG,EAAE,cAAc,EACnB,OAAO,EAAE,OAAO,EAChB,QAAQ,SAAK,GACZ,WAAW,CAoFb;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,cAAc,CAC5B,GAAG,EAAE,cAAc,EACnB,YAAY,EAAE,MAAM,EACpB,KAAK,SAAM,GACV,gBAAgB,CAOlB;AA+DD;;;;;;;;;;;;;;;;;;;GAmBG;AACH,wBAAgB,eAAe,CAAC,GAAG,EAAE,cAAc,EAAE,IAAI,CAAC,EAAE,IAAI,CAAC,QAAQ,EAAE,OAAO,GAAG,QAAQ,CAAC,GAAG,IAAI,CAAC,UAAU,CAAC,CAwChH;AAED,wFAAwF;AACxF,MAAM,MAAM,qBAAqB,GAAG,aAAa,GAAG,UAAU,GAAG,WAAW,GAAG,SAAS,GAAG,eAAe,CAAC;AAE3G,MAAM,WAAW,gBAAgB;IAC/B,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,EAAE,qBAAqB,CAAC;IAC7B,6EAA6E;IAC7E,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;CACtB;AAED;;;;;;;;;GASG;AACH,wBAAgB,oBAAoB,CAClC,GAAG,EAAE,cAAc,EACnB,KAAK,EAAE;IAAE,UAAU,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,SAAS,CAAA;CAAE,GAClE,gBAAgB,GAAG,IAAI,CAiBzB;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA0CG;AACH,wBAAgB,WAAW,CAAC,GAAG,EAAE,cAAc,EAAE,KAAK,EAAE,eAAe,GAAG,gBAAgB,CA6EzF"}

package/dist/timeline.js

@@ -1,5 +1,6 @@
 import { deadLetter, entityRef, eventDelivery, historyEntry, listLimitOf, pageOf, timelineEntry, } from '@substrat-run/contracts';
 import { rowDecoder, UNDECODED_ACTOR } from './row-decode.js';
+import { REFUSAL_JOURNAL_PREFIX } from './delivery-refusal.js';
 /** The envelope columns, in the order `mapTimelineRow` expects. */
 const TIMELINE_COLUMNS = 'id, type, occurred_at, actor';
 /** …plus what a history VIEW needs. See `historyEntry` for why two are nullable. */
@@ -600,6 +601,35 @@ export function readDeadLetters(ctx, page) {
     const entries = rows.map(deadLetterOf);
     return pageOf(entries, limit, (e) => `${e.eventId}${DEAD_LETTER_CURSOR_SEPARATOR}${e.consumer}`);
 }
+/**
+ * The newest `eventType` event about `entity`, and what executor `executorId` did with it
+ * (#1184) — or null when there is no such event. What a module reads to show the effect it
+ * asked for as it actually stands: still pending, refused and why, or done.
+ *
+ * The journal's own predicates, in one place: no delivery row is `unattempted`; a next
+ * attempt is `retrying`; no error is `delivered`; an error with no next attempt is `refused`
+ * when the handler refused it (`REFUSAL_JOURNAL_PREFIX`) and `dead-lettered` when retries ran
+ * out. Same permission posture as every read here: the caller checks, this does not.
+ */
+export function readExecutorDelivery(ctx, input) {
+    const row = ctx.sql.query(`SELECT o.id, d.event_id AS journaled, d.error, d.next_attempt_at
+       FROM _substrat_outbox o
+       LEFT JOIN _substrat_deliveries d ON d.event_id = o.id AND d.consumer_module = ?
+      WHERE o.entity_type = ? AND o.entity_id = ? AND o.type = ?
+      ORDER BY o.id DESC
+      LIMIT 1`, [`executor:${input.executorId}`, input.entity.entityType, input.entity.entityId, input.eventType])[0];
+    if (!row)
+        return null;
+    if (row.journaled === null)
+        return { eventId: row.id, state: 'unattempted', error: null };
+    if (row.next_attempt_at !== null)
+        return { eventId: row.id, state: 'retrying', error: row.error };
+    if (row.error === null)
+        return { eventId: row.id, state: 'delivered', error: null };
+    return row.error.startsWith(REFUSAL_JOURNAL_PREFIX)
+        ? { eventId: row.id, state: 'refused', error: row.error.slice(REFUSAL_JOURNAL_PREFIX.length) }
+        : { eventId: row.id, state: 'dead-lettered', error: row.error };
+}
 /**
  * Facet a scope's own outbox (#1239 stage 1): narrow by type and window, group by
  * one envelope column or one payload field, count.