@ultimat3/cli 22.15.0 → 24.0.0

package/src/runtime-queue.ts

@@ -7,16 +7,17 @@
 import {
   type PostgresIdempotencyStore,
   postgresIdempotencyStore,
+  requestDeadlineMs,
   resetIdempotency,
   setIdempotencyStore,
 } from '@ultimat3/action';
 import type { DbClient, PgliteClient, PostgresClient, SqlFragment } from '@ultimat3/db';
 import {
+  baseClient,
   createPgliteClient,
   createPostgresClient,
   currentTx,
   pgliteDataDir,
-  raw,
   setDbClient,
 } from '@ultimat3/db';
 import type { Tx } from '@ultimat3/entity';
@@ -26,13 +27,15 @@ import {
   createPgDriver,
   createPgEventBus,
   createPgOutboxStore,
+  resetEventBus,
   resetJobDriver,
   resetJobsFacade,
   setEventBus,
   setJobDriver,
   setJobsFacade,
 } from '@ultimat3/jobs';
-import { applyFrameworkSchema } from './framework-schema';
+import { applyLockedSchema, verifySchema } from './framework-schema-apply';
+import { appExtensions } from './migration-extensions';
 import type { DevServices } from './runtime-bindings';
 import type { RuntimeOverrides } from './runtime-overrides';
 import { attachReplica, type ReplicaEnv, replicaUrlFor } from './runtime-replica';
@@ -93,7 +96,13 @@ export function startDb(services: DevServices, env: ReplicaEnv): StartedDb {
     binding.mode === 'embedded'
       ? // `pgliteDataDir` is `@ultimat3/db`'s own reader of the `pglite://` form; a second parser
         // here is a second thing to keep right when the form changes.
-        createPgliteClient({ dataDir: pgliteDataDir(binding.url) })
+        // Linked at boot, from the app's own migrations: PGlite cannot `create extension` one it
+        // was not handed, and the schema dump's scratch replay already asks this same reader — an
+        // app that replayed in the gate and failed in `x dev` was the two disagreeing.
+        createPgliteClient({
+          dataDir: pgliteDataDir(binding.url),
+          extensions: () => appExtensions(services.root),
+        })
       : createPostgresClient({ url: binding.url });
   const attached = attachReplica(client, replicaUrlFor(binding, env));
   setDbClient(attached.client);
@@ -127,10 +136,18 @@ export function pgExecutorFor(client: DbClient): PgExecutor {
  * `@ultimat3/notify` because a package that holds no database dependency cannot apply its own
  * schema — the same reason `SQL_JOBS_TABLE` is applied by the boot.
  */
-async function applySchema(client: DevDbClient): Promise<void> {
-  await applyFrameworkSchema((statement) => client.execute(raw(statement)));
-}
+/**
+ * `'apply'` — `ROLE=migrate`, `x dev` and every CLI command — runs the DDL under the migration
+ * lock with a bounded `lock_timeout` and stamps the build. `'verify'` — a serving role on an
+ * external database — runs none: an `alter table` queued behind one open transaction stalled every
+ * enqueue in the fleet on each pod start, and racing `create table`s were a first-deploy `23505`.
+ */
+export type SchemaMode = 'apply' | 'verify';
 
+async function applySchema(client: DevDbClient, mode: SchemaMode): Promise<void> {
+  if (mode === 'verify') await verifySchema(client);
+  else await applyLockedSchema(client);
+}
 /**
  * The dev queue is the real Postgres queue on the embedded Postgres — claiming, leases and the
  * one-live-job-per-key index all behave here exactly as in production. A memory queue in dev
@@ -162,9 +179,10 @@ async function applySchema(client: DevDbClient): Promise<void> {
 async function startJobs(
   client: DevDbClient,
   replica: PostgresClient | undefined,
-  overrides?: RuntimeOverrides,
+  overrides: RuntimeOverrides | undefined,
+  schema: SchemaMode,
 ): Promise<RunningQueue> {
-  await applySchema(client);
+  await applySchema(client, schema);
   const executor = pgExecutorFor(client);
   const driver = overrides?.jobs ?? createPgDriver({ executor });
   setJobDriver(driver);
@@ -178,7 +196,14 @@ async function startJobs(
   );
   const events = createPgEventBus({ executor });
   setEventBus(events);
-  const idempotency = postgresIdempotencyStore({ executor });
+  const idempotency = postgresIdempotencyStore({
+    executor,
+    // `baseClient`, read per call and never `client`: a transaction's origin is the AMBIENT client
+    // `startDb` installed, which is the replicated pair when a standby is configured.
+    origin: baseClient,
+    // The app's own `requestTimeoutMs`, read per reservation — it is declared after this boot.
+    reclaimAfterMs: requestDeadlineMs,
+  });
   setIdempotencyStore(idempotency);
   return {
     db: client,
@@ -197,7 +222,8 @@ async function startJobs(
  * startup entirely, so every query it makes fails on a connection this process already dropped.
  *
  * The facade goes with the driver for the same reason: an enqueue routed through a store bound to
- * a closed client is a staged row nothing will ever publish.
+ * a closed client is a staged row nothing will ever publish — and the event bus with both, or a
+ * `publishEvent` after `stop()` runs over the closed pool.
  */
 async function releaseQueue(
   db: DevDbClient,
@@ -208,6 +234,7 @@ async function releaseQueue(
   // holds this client, and the next command in this process would reserve keys over a closed one.
   resetIdempotency();
   resetJobsFacade();
+  resetEventBus();
   resetJobDriver();
   setDbClient(undefined);
   await jobs?.close?.();
@@ -232,13 +259,14 @@ export async function startQueue(
    * this file reads it: see `startDb` for what two readers of one question cost.
    */
   env: ReplicaEnv = process.env,
+  schema: SchemaMode = 'apply',
 ): Promise<RunningQueue> {
   const { client: db, replica } = startDb(services, env);
   try {
     // Pay the Postgres boot here, so the first request is not the slow one and a broken database
     // fails at boot rather than on some later query.
     await db.ping();
-    return await startJobs(db, replica, overrides);
+    return await startJobs(db, replica, overrides, schema);
   } catch (error) {
     // `db.ping()` or `startJobs` is where a broken database is supposed to fail. Without this,
     // the caller exits holding the PGlite lock and the ambient accessors, and nothing is left to

package/src/runtime-realtime.ts

@@ -1,55 +1,19 @@
-// `realtime.enabled`, `realtime.transport` and `realtime.urlEnv`, read out of the app's own
-// `app.config.ts` for the boot. The sibling of `runtime-notify-retention.ts` and `runtime-cache.ts`, and
-// structural for their reason: `startServices` holds no `AppConfig`, and `defineConfig` returns a
-// plain object. Until 22.0.0 no boot read any of the three and `NATS_URL` alone decided the bus.
+// `realtime.enabled`, `realtime.transport` and `realtime.urlEnv` for the boot, out of the config
+// `startServices` loads once (`app-config-load.ts`). Until 22.0.0 no boot read any of the three
+// and `NATS_URL` alone decided the bus.
 
-// why: Bun ships no path-joining API — `Object.keys(Bun)` has `file`, `write`, `Glob`,
-// `pathToFileURL` and `fileURLToPath`, and nothing that joins a path.
-import { join } from 'node:path';
-import { ConfigInvalidError, type RealtimeConfig, type RealtimeTransport } from '@ultimat3/core';
-import { APP_CONFIG_EXPORT } from './app-auth';
-import { APP_CONFIG_FILE } from './app-root';
+import type { AppConfig, RealtimeConfig } from '@ultimat3/core';
 
-/** Core's `defaults()` for the section, restated as the answer for a config that names none. */
+/** Core's `defaults()` for the section — the answer for a root with no `app.config.ts`. */
 export const REALTIME_DEFAULTS: RealtimeConfig = Object.freeze({
   enabled: true,
   transport: 'memory',
   urlEnv: undefined,
 });
 
-const TRANSPORTS: readonly RealtimeTransport[] = ['memory', 'nats'];
-
-const isRecord = (value: unknown): value is Record<string, unknown> =>
-  typeof value === 'object' && value !== null;
-
-/** A transport this boot can build, or a refusal — never a guess at a bus. */
-function transportOf(section: Record<string, unknown>): RealtimeTransport {
-  const value = section['transport'];
-  if (value === undefined) return REALTIME_DEFAULTS.transport;
-  const known = TRANSPORTS.find((transport) => transport === value);
-  if (known !== undefined) return known;
-  throw new ConfigInvalidError({
-    cause: `realtime.transport in ${APP_CONFIG_FILE} is not one of ${TRANSPORTS.join(', ')}`,
-    fix: `set realtime: { transport: 'memory' } in ${APP_CONFIG_FILE}, or { transport: 'nats', urlEnv: 'NATS_URL' } for more than one node`,
-    meta: { key: 'realtime.transport' },
-  });
-}
-
 /**
- * The section as the boot obeys it. A key the file does not name keeps core's default, the same
- * per-key merge `defineConfig` performs, so the boot and the app's own config object agree.
+ * The section as the boot obeys it — `defineConfig`'s per-key merge, so the boot and the app's own
+ * config object agree, and a transport nothing builds is core's `X_CONFIG_INVALID`.
  */
-export async function loadRealtimeConfig(root: string): Promise<RealtimeConfig> {
-  const path = join(root, APP_CONFIG_FILE);
-  if (!(await Bun.file(path).exists())) return REALTIME_DEFAULTS;
-  const module = (await import(path)) as Record<string, unknown>;
-  const config = module[APP_CONFIG_EXPORT];
-  const section = isRecord(config) ? config['realtime'] : undefined;
-  if (!isRecord(section)) return REALTIME_DEFAULTS;
-  const { enabled, urlEnv } = section;
-  return {
-    enabled: typeof enabled === 'boolean' ? enabled : REALTIME_DEFAULTS.enabled,
-    transport: transportOf(section),
-    urlEnv: typeof urlEnv === 'string' && urlEnv.trim() !== '' ? urlEnv.trim() : undefined,
-  };
-}
+export const realtimeConfigOf = (config: AppConfig | undefined): RealtimeConfig =>
+  config?.realtime ?? REALTIME_DEFAULTS;

package/src/runtime-render.ts

@@ -1,35 +1,28 @@
-// Projecting the route table onto HTTP routes `x dev` can serve. Every mode goes through
+// Projecting the route table onto HTTP routes both boots serve. Every mode goes through
 // `@ultimat3/render`'s own function for that mode — the CLI picks the mode and supplies the
-// document, it never decides what a mode means or what headers it earns.
-//
-// The document is head + the route's own component, rendered by `@ultimat3/render`'s server JSX
-// writer, with the surface's compiled CSS LINKED — one content-hashed file per surface
-// (`style-bundle.ts`), served `immutable`.
-//
-// It was inlined until 2026-09-06, on the argument that a `site/` page is a 0kb-JS artifact a CDN
-// serves as one file and a link would add a round trip. The round trip is real and it is paid
-// once: measured against ai-maxxing, every `app/` document carried the SAME 156,738-byte `<style>`
-// block — 92% of the dashboard document — inside a response the pipeline sends
-// `Cache-Control: private, no-store`, so the trip that argument saved was re-paid in full on every
-// navigation, with a re-parse on top. The static export writes the file (`writeStyles`), so the
-// "second file" cost is one `Bun.write`.
+// document (head + the route's component, the surface's CSS LINKED, `style-bundle.ts`), it never
+// decides what a mode means or what headers it earns.
 
 // why: Bun ships no path API; an island's file is its route file's directory joined to its `src`.
 import { posix } from 'node:path';
+import { actionPathStyle } from '@ultimat3/action';
 import { clientScopeOf } from '@ultimat3/auth';
 import type { Ctx } from '@ultimat3/core';
-import { CLIENT_SCOPE_HEADER } from '@ultimat3/core';
+import { CLIENT_SCOPE_HEADER, createSingleFlight } from '@ultimat3/core';
 import type {
   RouteMeta as HttpRouteMeta,
   RedirectIntent,
+  RequestContext,
   Route,
   RouteParams,
+  UltimateRequest,
 } from '@ultimat3/http';
 import { asCtx, html, NO_STORE, redirect, stream, takeRedirect } from '@ultimat3/http';
 import { currentLocale, localeConfig } from '@ultimat3/i18n';
 import type { IslandCollector, RenderResult, RouteData, RouteEntry } from '@ultimat3/render';
 import {
   clientBootTags,
+  clientPathStyleTags,
   clientPersistTags,
   clientScopeTag,
   clientSyncTags,
@@ -50,7 +43,6 @@ import {
 import type { IsrController } from '@ultimat3/render/server';
 import {
   contentHash,
-  createIsrController,
   isrKey,
   ROOT_ELEMENT_ID,
   renderComponent,
@@ -67,6 +59,7 @@ import {
   navigationTagsOf,
   principalRelocation,
 } from './page-navigation';
+import { attachedIsr } from './runtime-isr';
 import type { StaticResult } from './static-document';
 import { createStaticMemo, staticMemoKey, staticResponse } from './static-document';
 import { styleBundle } from './style-bundle';
@@ -75,7 +68,11 @@ export type { DocumentOptions, IslandResolver } from './document-options';
 
 export interface DevRenderOptions extends DocumentOptions {
   readonly buildId: string;
-  /** Injected so a test can drive the ISR store without a timer. */
+  /**
+   * The boot's own controller, attached and released by it (`runtime-isr.ts`). Omitted, one is
+   * built AND attached here, never released — a caller with no stop list (a contract test) still
+   * gets pages a tag bust reaches; the revalidator slot is the latest attach's.
+   */
   readonly isr?: IsrController;
   /**
    * Keep each `static` document after its first render (`static-document.ts`). The container sets
@@ -130,6 +127,10 @@ const headFor = async (
         }),
         [
           ...(options.sync === undefined ? [] : clientSyncTags(options.sync)),
+          // Every document, shareable ones included: the style is the app's, not a visitor's, and
+          // it is the only way an island's `rpc()` learns it. Read per render — `defineApi` may run
+          // after these routes are built. `'resource'`, the default, is no tag.
+          ...clientPathStyleTags(actionPathStyle()),
           ...router,
           // The page boot rides the scope tag: its whole job — restoring a principal's persisted
           // records and replaying its queued writes — is per principal, and a shareable document
@@ -150,7 +151,8 @@ const headFor = async (
 
 /**
  * `<link rel="stylesheet">` for the surface's own stylesheets, or nothing at all when the surface
- * imports none.
+ * imports none. Inlined until 2026-09-06: every `app/` document of ai-maxxing then carried the same
+ * 156,738-byte `<style>` (92% of it) under `no-store`, re-paid on every navigation.
  *
  * In `<head>`, which is what keeps this a swap and not a regression: a `<link rel="stylesheet">`
  * there is render-blocking in every browser, exactly as the inline block was, so there is no
@@ -423,8 +425,11 @@ const metaOf = (entry: RouteEntry, head?: NavigationDocumentHead): HttpRouteMeta
  * only a test does — and then guard and page fall back together.
  */
 export function appRoutes(options: DevRenderOptions): readonly Route[] {
-  const isr = options.isr ?? createIsrController({ buildId: options.buildId });
+  const isr = options.isr ?? attachedIsr({ buildId: options.buildId }).isr;
   const memo = createStaticMemo();
+  // A cold static key is ONE render however many requests arrive during it: the memo alone was
+  // check-then-act, so a burst at boot ran `load` and the render once per request.
+  const firstRender = createSingleFlight();
   return routeEntries().map((registered) => ({
     method: 'GET' as const,
     path: registered.path,
@@ -444,23 +449,51 @@ export function appRoutes(options: DevRenderOptions): readonly Route[] {
           : undefined;
       const kept = key === undefined ? undefined : memo.get(key);
       if (kept !== undefined) return staticResponse(request, kept);
-      const data: DevRouteData = { url: request.url.href, params: ctx.params };
-      // ONCE per request, before the mode is chosen: every branch of `resultFor` reads this same
-      // object, so a route's `load` runs exactly once however its mode splits head from body.
-      const loaded = await routeDataFor(entry.config, data);
-      // `setRedirect()` inside `load` — the same slot an action's handler fills — answers here,
-      // before a document is rendered for a page the visitor is leaving. `withStatus` refuses a
-      // 3xx because a rendered document has no `Location`; this is the path that has one.
-      const to = takeRedirect(ctx);
-      if (to !== undefined) return loadRedirect(entry, to);
-      const result = await resultFor(entry, data, loaded, options, isr, asCtx(ctx));
-      if (entry.config.render !== 'static' || typeof result.body !== 'string') {
-        return responseOf(result);
-      }
-      const document: StaticResult = { ...result, body: result.body };
-      if (key !== undefined) memo.set(key, document);
+      let led = false;
+      const render = async (): Promise<Rendered> => {
+        led = true;
+        const rendered = await renderEntry(entry, request, ctx, options, isr);
+        if (key !== undefined && rendered.document !== undefined) memo.set(key, rendered.document);
+        return rendered;
+      };
+      const shared = key === undefined ? await render() : await firstRender.run(key, render);
+      // Only a DOCUMENT is shared. A redirect `load` decided was its request's own, so a request
+      // that joined one renders for itself rather than answer with another request's `Location`.
+      const rendered = shared.document !== undefined || led ? shared : await render();
       // The ETag was only ever a header: a matching `If-None-Match` is a 304, not the page again.
-      return staticResponse(request, document);
+      return rendered.document === undefined
+        ? rendered.respond()
+        : staticResponse(request, rendered.document);
     },
   }));
 }
+
+/** A static document a joined request can share, or how to answer when there is none. */
+interface Rendered {
+  readonly document?: StaticResult;
+  readonly respond: () => Response;
+}
+
+async function renderEntry(
+  entry: RouteEntry,
+  request: UltimateRequest,
+  ctx: RequestContext,
+  options: DevRenderOptions,
+  isr: IsrController,
+): Promise<Rendered> {
+  const data: DevRouteData = { url: request.url.href, params: ctx.params };
+  // ONCE per request, before the mode is chosen: every branch of `resultFor` reads this same
+  // object, so a route's `load` runs exactly once however its mode splits head from body.
+  const loaded = await routeDataFor(entry.config, data);
+  // `setRedirect()` inside `load` — the same slot an action's handler fills — answers here,
+  // before a document is rendered for a page the visitor is leaving. `withStatus` refuses a
+  // 3xx because a rendered document has no `Location`; this is the path that has one.
+  const to = takeRedirect(ctx);
+  if (to !== undefined) return { respond: () => loadRedirect(entry, to) };
+  const result = await resultFor(entry, data, loaded, options, isr, asCtx(ctx));
+  if (entry.config.render !== 'static' || typeof result.body !== 'string') {
+    return { respond: () => responseOf(result) };
+  }
+  const document: StaticResult = { ...result, body: result.body };
+  return { document, respond: () => responseOf(document) };
+}

package/src/runtime-services.ts

@@ -4,7 +4,6 @@
 // boot installs, only backed by embedded drivers.
 
 import { mkdirSync } from 'node:fs';
-import { dirname } from 'node:path';
 import { configureAuthLimiters, postgresAuthLimiter, resetAuthLimiters } from '@ultimat3/auth';
 import type { PurgeDriver } from '@ultimat3/cache';
 import { isNoopPurgeDriver, selectPurgeDriver } from '@ultimat3/cache';
@@ -31,17 +30,18 @@ import type { Transport, TransportSelection } from '@ultimat3/realtime/server';
 import { selectTransport } from '@ultimat3/realtime/server';
 import type { Storage } from '@ultimat3/storage';
 import { defineStorage, localDriver, s3Driver, usesDevStorageSecret } from '@ultimat3/storage';
+import { loadAppConfig } from './app-config-load';
 import { LocalDiskUnsafeError, StorageUnwritableError } from './errors';
 import { msg } from './messages';
 import type { DevServices, Env } from './runtime-bindings';
-import { loadCacheTiers, startCacheTiers } from './runtime-cache';
-import { loadWorkerConfig, type WorkerConfig } from './runtime-jobs';
-import { loadInboxRetention } from './runtime-notify-retention';
+import { cacheTiersOf, startCacheTiers } from './runtime-cache';
+import { type WorkerConfig, workerConfigOf } from './runtime-jobs';
+import { inboxRetentionOf } from './runtime-notify-retention';
 import type { RuntimeOverrides } from './runtime-overrides';
 import { installRetentionSweep } from './runtime-purge';
-import type { DevDbClient } from './runtime-queue';
+import type { DevDbClient, SchemaMode } from './runtime-queue';
 import { pgExecutorFor, startQueue } from './runtime-queue';
-import { loadRealtimeConfig } from './runtime-realtime';
+import { realtimeConfigOf } from './runtime-realtime';
 
 export interface RunningServices {
   readonly services: DevServices;
@@ -182,7 +182,8 @@ export function startStorage(services: DevServices, env: Env, override?: Storage
           bucket,
           endpoint: binding.url,
           ...(env['S3_REGION'] === undefined ? {} : { region: env['S3_REGION'] }),
-          // MinIO needs path style; R2 and AWS do not. Declared, never sniffed from the endpoint.
+          // A gateway addressed by host and port needs path style; R2 and AWS do not. Declared,
+          // never sniffed from the endpoint.
           forcePathStyle: env['S3_FORCE_PATH_STYLE'] === '1',
         }),
       },
@@ -304,6 +305,8 @@ export async function startServices(
   services: DevServices,
   env: Env,
   overrides?: RuntimeOverrides,
+  /** `'verify'` for a serving role on an external database — `runtime-queue.ts`'s `SchemaMode`. */
+  schema: SchemaMode = 'apply',
 ): Promise<RunningServices> {
   // Before the queue: selection is pure — it parses `SMTP_URL` and builds a transport, it does
   // not dial. A typo'd credential must fail on the spot rather than after PGlite has started and
@@ -317,14 +320,16 @@ export async function startServices(
   // service starts, rather than quietly keeping the in-process bus. Which transport, which KV
   // bucket and which presence TTL is `@ultimat3/realtime`'s decision, and it is the same call a
   // `ROLE=sync` container makes, so this process cannot resolve the bus differently from the
-  // container it stands in for. The root is `dirname(stateDir)`, as `loadCacheTiers` reads it.
-  const realtime = await loadRealtimeConfig(dirname(services.stateDir));
-  const workerConfig = await loadWorkerConfig(dirname(services.stateDir));
+  // container it stands in for. The app's config is loaded ONCE, here, and every section below is
+  // read out of that one validated object.
+  const config = await loadAppConfig(services.root);
+  const realtime = realtimeConfigOf(config);
+  const workerConfig = workerConfigOf(config);
   const bus: TransportSelection = selectTransport(env, realtime);
   // `env`, not the ambient one: this function is HANDED the boot's environment and every other
   // reader here already uses it, so a queue that asked `process.env` would decide the standby from
   // a different answer than the middleware that routes to it.
-  const queue = await startQueue(services, overrides, env);
+  const queue = await startQueue(services, overrides, env, schema);
   const { db, jobs, outbox, events } = queue;
   // The same executor the jobs driver, the outbox, the event bus and the idempotency store run
   // on — one pool, one `Bun.sql` that does NOT satisfy `PgExecutor` (`Bun.sql.query` is
@@ -358,13 +363,14 @@ export async function startServices(
     // `x_rate_limit` takes one upsert per request the web role serves, assets included.
     //
     // `inboxRetention` is READ HERE and not defaulted in `runtime-purge.ts`: the two windows are the
-    // app's, `startServices` holds no `AppConfig`, and a loader that silently answered "never
-    // sweep" from inside the sweep would be indistinguishable from an app that chose it.
+    // app's, and a loader that silently answered "never sweep" from inside the sweep would be
+    // indistinguishable from an app that chose it.
     started.push(
       installRetentionSweep({
         idempotency: queue.idempotency,
         rateLimit: rateLimitStore,
-        inboxRetention: await loadInboxRetention(services.root),
+        events,
+        inboxRetention: inboxRetentionOf(config),
       }),
     );
     // One readiness check per resource this boot OWNS, released with it. Nothing in the tree
@@ -408,10 +414,8 @@ export async function startServices(
     // process that has stopped.
     // The ladder is the app's declaration, never the environment's. `cache.tiers` was declared,
     // validated and documented while NOTHING read it — so an app asking for one rung got four,
-    // and one asking for a shared tier got whatever `REDIS_URL` happened to say. `.x` is
-    // `resolveServices`' own join, so its parent is the app root: the one fact this function needs
-    // and does not already carry.
-    const tiers = await loadCacheTiers(dirname(services.stateDir));
+    // and one asking for a shared tier got whatever `REDIS_URL` happened to say.
+    const tiers = cacheTiersOf(config);
     started.push(startCacheTiers({ env, purge, transport, tiers }));
 
     return {

package/src/runtime-storage.ts

@@ -24,6 +24,7 @@ import {
   orgMismatch,
 } from '@ultimat3/storage';
 import { storageUploadRoute } from './runtime-storage-upload';
+import { storedObjectHeaders } from './stored-object-headers';
 
 /**
  * The one capability that gates reading a stored object, on every disk. A permission and not a
@@ -103,11 +104,10 @@ export function authorizeStorageRead(input: StorageReadInput, ctx: RequestContex
  */
 export function assertReadableKey(key: string, actor: Actor): string {
   const safe = assertSafeKey(key);
-  // An actor with no org is inside no org, so every tenant-scoped key is somebody else's. Checked
-  // before `isWithinOrg`, which reads an empty org as a malformed key and would blame the caller's
-  // URL for the actor's missing claim.
+  // An actor with no org is inside no org, so every tenant-scoped key is somebody else's —
+  // `isWithinOrg` answers exactly that for an empty org, without throwing.
   const orgId = actor.orgId ?? '';
-  if (isTenantScoped(safe) && (orgId === '' || !isWithinOrg(safe, orgId))) {
+  if (isTenantScoped(safe) && !isWithinOrg(safe, orgId)) {
     throw orgMismatch(safe, orgId);
   }
   return safe;
@@ -185,9 +185,14 @@ export function storageResponse(request: UltimateRequest, read: StorageRead): Re
   const headers = new Headers({
     'content-type': read.object.contentType,
     etag,
-    'last-modified': read.object.lastModified.toUTCString(),
     'accept-ranges': 'bytes',
+    // A type a browser would RUN (html, svg, xml) is a download, never a page on this origin.
+    ...storedObjectHeaders(read.object.contentType),
   });
+  // Omitted, never invented: a disk whose provider reported no date has none, and a `Last-Modified`
+  // made up for it is a validator a cache would go on to trust.
+  const modified = read.object.lastModified;
+  if (modified !== undefined) headers.set('last-modified', modified.toUTCString());
   // Revalidation costs a request and no bytes, which is the trade an authorized response wants:
   // the bytes never change under a key, but the actor's permission to read them can be revoked.
   if (etagMatches(request.header('if-none-match'), etag)) {

package/src/scaffold-typecheck.ts

@@ -151,6 +151,7 @@ const overlay = (root: string, app: string): string =>
           // name, and `cli/serve` as `packages/cli/serve`. Longest prefix wins, so these are
           // consulted first. `@ultimat3/cli/serve` is what `x new`'s `apps/web/server.ts` imports.
           '@ultimat3/ui/icons/*': [`${root}/packages/ui/src/icons/glyphs/*`],
+          '@ultimat3/query/client': [`${root}/packages/query/src/client`],
           '@ultimat3/render/server': [`${root}/packages/render/src/server`],
           '@ultimat3/cli/serve': [`${root}/packages/cli/src/serve-entry`],
           '@ultimat3/testing/test-types': [`${root}/packages/testing/src/test-types`],

package/src/schema-diff.ts

@@ -40,6 +40,11 @@ export interface SchemaDifference {
 
 const DECLARED_ONLY = 'is declared by the entities and no migration recorded it';
 const RECORDED_ONLY = 'was recorded by the newest migration and no entity declares it';
+/** The difference's name — what `x db gen "record …"` is told to write down. */
+const REPLICA_IDENTITY_FULL = 'replica identity full';
+const REPLICA_IDENTITY_UNRECORDED =
+  'needs REPLICA IDENTITY FULL — a channel with params or a live query subscribes to it — and no ' +
+  'migration recorded it';
 
 const columns = (names: readonly string[]): string => names.join(', ');
 
@@ -187,6 +192,17 @@ function compareTable(declared: TableDescription, recorded: TableDescription): S
       detail: `declares primary key (${columns(declared.primaryKey)}) and the migration recorded (${columns(recorded.primaryKey)})`,
     });
   }
+  // One direction: `replica-identity.ts` never reverts the identity, so a recorded FULL nothing
+  // needs any more is what `x db gen` leaves behind on purpose, not a difference.
+  if (declared.replicaIdentityFull === true && recorded.replicaIdentityFull !== true) {
+    out.push({
+      direction: 'unmigrated',
+      part: 'table',
+      table,
+      name: REPLICA_IDENTITY_FULL,
+      detail: REPLICA_IDENTITY_UNRECORDED,
+    });
+  }
   out.push(
     ...compareList({
       part: 'column',