@ultimat3/cli 29.3.2 → 30.0.0

package/src/runtime-render.ts

@@ -3,81 +3,59 @@
 // document (head + the route's component, the surface's CSS LINKED, `style-bundle.ts`), it never
 // decides what a mode means or what headers it earns.
 
-import { actionPathStyle } from '@ultimat3/action';
 import { clientScopeOf } from '@ultimat3/auth';
 import type { Actor, Ctx } from '@ultimat3/core';
-import { CLIENT_SCOPE_HEADER, escapeHtml, singleFlight } from '@ultimat3/core';
+import { CLIENT_SCOPE_HEADER, singleFlight } from '@ultimat3/core';
 import type {
   RouteMeta as HttpRouteMeta,
   RedirectIntent,
   RequestContext,
   Route,
-  RouteParams,
   UltimateRequest,
 } from '@ultimat3/http';
-import { asCtx, html, NO_STORE, redirect, stream, takeRedirect } from '@ultimat3/http';
-import { currentLocale } from '@ultimat3/i18n';
-import type { IslandCollector, RenderResult, RouteData, RouteEntry } from '@ultimat3/render';
 import {
-  clientPathStyleTags,
-  clientPersistTags,
-  clientScopeTag,
-  clientSyncTags,
+  asCtx,
+  html,
+  NO_STORE,
+  redirect,
+  stream,
+  takeRedirect,
+  withAnonymousRequest,
+} from '@ultimat3/http';
+import type { RenderResult, RouteData, RouteEntry } from '@ultimat3/render';
+import {
   documentCarriesScope,
-  headFromMeta,
-  hydrateRuntime,
-  metaContextFor,
-  renderHead,
   routeDataFor,
   routeEntries,
   routeFor,
   routeStatusOf,
-  seoRenderers,
 } from '@ultimat3/render';
 import type { IsrController } from '@ultimat3/render/server';
 import {
   contentHash,
-  ROOT_ELEMENT_ID,
-  renderComponent,
+  holeSink,
   renderSsr,
   ssrHeaders,
   staticHeaders,
   streamResult,
 } from '@ultimat3/render/server';
-import { loadAppConfig } from './app-config-load';
-import type { DocumentOptions } from './document-options';
-import { routeQuery } from './isr-query-guard';
 import {
   type NavigationDocumentHead,
   navigationMetaOf,
-  navigationTagsOf,
   principalRelocation,
 } from './page-navigation';
-import { bootScript, collectorFor } from './route-islands';
+import { collectorFor, streamScripts } from './route-islands';
 import { addressedUrl } from './runtime-address';
 import { attachedIsr } from './runtime-isr';
 import { isrOutcome } from './runtime-isr-outcome';
-import { siteAssetTable } from './site-assets';
+import type { DevRouteData, RenderOptions } from './runtime-render-document';
+import { documentFrom, headFor, lang, routeBody, stylesFor } from './runtime-render-document';
 import type { StaticResult } from './static-document';
 import { createStaticMemo, staticMemoKey, staticResponse } from './static-document';
-import { styleBundle } from './style-bundle';
+import { enterHole } from './stream-hole-scope';
 
 export type { DocumentOptions, IslandResolver } from './document-options';
 
-/**
- * The app-wide favicon head, from `site.favicon`: the content-hashed URL `asset('assets/….svg')`
- * returns and `/assets/*` serves, never the raw path. Per render, never frozen at boot.
- */
-export async function appFaviconHead(root: string): Promise<string | undefined> {
-  const favicon = (await loadAppConfig(root))?.site.favicon;
-  if (favicon === undefined) return undefined;
-  const url = siteAssetTable(root).resolve(favicon).url;
-  return `<link rel="icon" type="image/svg+xml" href="${escapeHtml(url)}">`;
-}
-
-/** `DocumentOptions`, plus the app root the app's own favicon is resolved against per render. */
-export type RenderOptions = DocumentOptions & { readonly root?: string };
-
 export interface DevRenderOptions extends RenderOptions {
   readonly buildId: string;
   /**
@@ -92,130 +70,6 @@ export interface DevRenderOptions extends RenderOptions {
    */
   readonly memoStatic?: boolean;
 }
-/** What a route's `meta(data)` is given. `url` is a string because that is what `ld.*` embeds. */
-export interface DevRouteData extends Record<string, unknown> {
-  readonly url: string;
-  readonly params: RouteParams;
-}
-/**
- * `<html lang>` is the request's own locale, never a constant: the `locale` stage negotiated it
- * one stage before this handler and published it on the context, so a hardcoded `'en'` shipped
- * every document mislabelled — wrong for a screen reader, wrong for `hreflang`. Outside a request
- * (`x build`'s prerender) it is the app's own configured fallback.
- */
-const lang = (): string => currentLocale();
-
-/**
- * `scope` is present only on a PRIVATE document (a gated `ssr` page, every `stream`): the page's
- * client scope (`@ultimat3/auth`'s `clientScopeOf`), which core's `pageClient()` reads to fence its
- * one store per principal. A shareable document carries NO scope tag — absent means "not rendered
- * for anyone", a different answer from `''`, the anonymous page.
- */
-const headFor = async (
-  entry: RouteEntry,
-  ctx: DevRouteData,
-  data: RouteData,
-  options: RenderOptions,
-  scope?: string,
-): Promise<string> => {
-  const meta = metaContextFor(ctx, data);
-  const url = new URL(ctx.url);
-  const router = navigationTagsOf(options.navigation, entry, meta.t);
-  return (
-    renderHead(
-      headFromMeta(
-        await entry.config.meta(meta),
-        seoRenderers({
-          path: url.pathname,
-          baseUrl: options.origin ?? url.origin,
-          // The default is the cluster's own head (`alternates` is default-first by contract), so
-          // `x-default` comes from the list the hreflang tags do — never a second locale read.
-          localization: {
-            locale: meta.locale,
-            defaultLocale: meta.alternates[0]?.locale ?? meta.locale,
-            alternates: meta.alternates,
-          },
-        }),
-        [
-          ...(options.sync === undefined ? [] : clientSyncTags(options.sync)),
-          // Every document, shareable ones included: the style is the app's, not a visitor's, and
-          // it is the only way an island's `rpc()` learns it. Read per render — `defineApi` may run
-          // after these routes are built. `'resource'`, the default, is no tag.
-          ...clientPathStyleTags(actionPathStyle()),
-          ...router,
-          // The page boot rides the scope tag: its whole job — restoring a principal's persisted
-          // records and replaying its queued writes — is per principal, and a shareable document
-          // (no scope tag) has neither.
-          ...(scope === undefined
-            ? []
-            : [clientScopeTag(scope), ...clientPersistTags(options.persisted?.() ?? [])]),
-        ],
-      ),
-    ) +
-    (options.themeHead ?? '') +
-    // One mechanism per document: the router prefetches for itself, the browser for the rest.
-    (router.length === 0 ? (options.speculationHead ?? '') : '') +
-    // The app's own favicon: one link, every document, the URL the table resolves NOW.
-    ((options.root === undefined ? options.faviconHead : await appFaviconHead(options.root)) ??
-      '') +
-    // Per locale: each links its own locale's manifest (`PwaArtifacts.headFor`).
-    (typeof options.pwaHead === 'function' ? options.pwaHead(meta.locale) : (options.pwaHead ?? ''))
-  );
-};
-
-/**
- * `<link rel="stylesheet">` for the surface's own stylesheets, or nothing at all when the surface
- * imports none.
- *
- * In `<head>`, which is what keeps this a swap and not a regression: a `<link rel="stylesheet">`
- * there is render-blocking in every browser, exactly as the inline block was, so there is no window
- * in which the document paints unstyled. Moving it to the body, or deferring it, would introduce a
- * flash — never do that here.
- *
- * Read through `styleBundle()` rather than passed in through `DocumentOptions`: the registry it
- * derives from is process-global (importing the app IS what fills it), so a caller that forgot to
- * thread a resolver would serve a document with no CSS at all. One reader, and it is the same one
- * `styleRoutes` serves from.
- */
-const styleTag = (entry: RouteEntry): string => {
-  const href = styleBundle().hrefFor(entry.surface);
-  return href === undefined ? '' : `<link rel="stylesheet" href="${href}">`;
-};
-
-/** The surface stylesheet, then the app's brand — the order that lets the brand win the cascade. */
-const stylesFor = (entry: RouteEntry, options: DocumentOptions): string =>
-  styleTag(entry) + (options.brandHead ?? '');
-
-/**
- * The route's rendered body, inside the hydration root. Every mode goes through here — an empty
- * root is what a module exporting no component renders, and nothing else: `spa` was the one mode
- * that never reached this function, so every `spa` route ever declared served an empty root.
- */
-export async function routeBody(
-  entry: RouteEntry,
-  ctx: DevRouteData,
-  data: RouteData,
-  islands: IslandCollector,
-): Promise<string> {
-  if (entry.component === undefined) return `<div id="${ROOT_ELEMENT_ID}"></div>`;
-  const url = new URL(ctx.url);
-  const html = await renderComponent(
-    entry.component,
-    // `data` is the route's own `load` result and is what `meta` was just given — the same object,
-    // never a second resolution. `query` is supplied because a page that reads `props.query.x`
-    // otherwise dereferences undefined and takes the whole render down.
-    {
-      data,
-      params: ctx.params,
-      url: ctx.url,
-      query: routeQuery(entry, url),
-    },
-    entry.file,
-    { islands },
-  );
-  return `<div id="${ROOT_ELEMENT_ID}">${html}</div>`;
-}
-
 /**
  * Head + body for one route render — the document `x dev` serves, which the build's prerenderer
  * must emit too.
@@ -262,33 +116,6 @@ function documentScope(entry: RouteEntry, buildId: string, actor: Actor): string
   }
 }
 
-/**
- * The document from data ALREADY resolved. Split from `routeDocument` so one request resolves
- * `load` exactly once: `stream` renders head and body separately, and resolving in each would let
- * a `<title>` describe content the body does not contain.
- *
- * The hydration runtime is appended after the body and only after it: what strategies a page needs
- * is a fact about the islands the walk just recorded, so emitting it earlier would guess or ship
- * the whole runtime to a page with no island.
- */
-async function documentFrom(
-  entry: RouteEntry,
-  ctx: DevRouteData,
-  data: RouteData,
-  options: RenderOptions,
-  scope?: string,
-): Promise<string> {
-  const islands = collectorFor(entry, options, scope);
-  const [head, body] = await Promise.all([
-    headFor(entry, ctx, data, options, scope),
-    routeBody(entry, ctx, data, islands),
-  ]);
-  return (
-    `<!doctype html><html lang="${lang()}"><head>${head}${stylesFor(entry, options)}</head>` +
-    `<body>${body}${bootScript(entry, islands, options, scope)}${hydrateRuntime(islands.directives)}</body></html>`
-  );
-}
-
 /** Every mode but `isr`, which `renderIsr` answers: its `load` runs only when the store misses. */
 async function resultFor(
   entry: RouteEntry,
@@ -309,17 +136,18 @@ async function resultFor(
       return { status, headers: staticHeaders(contentHash(body), options.buildId), body };
     }
     case 'stream': {
-      // The shell IS the component: nothing can yet mark a subtree as a hole, and Solid's
-      // `Suspense` cannot be the missing piece — it calls `getContextId()`, which throws outside a
-      // Solid renderer. Until a hole marker of the framework's own exists, the first flush carries
-      // the whole body — correct output, no streaming benefit.
+      // Everything outside a `<Hole>` is the first flush; every hole fills after it, in the
+      // request's context, in completion order. `status` and any redirect were decided by `load`
+      // above: a hole starts after the headers left, so its failure is its own error markup.
       // A stream is always `private, no-store` (`streamResult`), so it always carries the scope.
       const scope = documentScope(entry, options.buildId, ctx.actor);
       const islands = collectorFor(entry, options, scope);
+      const sink = holeSink({ enter: enterHole });
       const [head, shell] = await Promise.all([
         headFor(entry, request, data, options, scope),
-        routeBody(entry, request, data, islands),
+        routeBody(entry, request, data, islands, sink),
       ]);
+      const scripts = streamScripts(entry, islands, options, scope, sink.holes.length > 0);
       return withScope(
         streamResult(
           {
@@ -327,8 +155,8 @@ async function resultFor(
             // The runtime rides the first flush, with the shell it boots. A later chunk would leave
             // the window between flush one and the close with inert islands and no listeners on
             // them — the first-click-lost failure `interaction` replay exists for.
-            shell: `${shell}${bootScript(entry, islands, options, scope)}${hydrateRuntime(islands.directives)}`,
-            holes: [],
+            shell: `${shell}${scripts.first}`,
+            holes: sink.holes.map((hole) => ({ ...hole, after: scripts.after })),
           },
           { buildId: options.buildId },
           status,
@@ -428,7 +256,7 @@ export function appRoutes(options: DevRenderOptions): readonly Route[] {
       // A static page already rendered by this process is answered without `load` or a render.
       const key =
         options.memoStatic === true
-          ? staticMemoKey(entry, addressedUrl(request.url, ctx), asCtx(ctx).locale)
+          ? staticMemoKey(entry, addressedUrl(request.url, ctx), asCtx(ctx).locale, options.origin)
           : undefined;
       const kept = key === undefined ? undefined : memo.get(key);
       if (kept !== undefined) return staticResponse(request, kept);
@@ -468,6 +296,21 @@ async function renderEntry(
   const at = entry.config.render === 'static' ? addressedUrl(request.url, ctx) : request.url;
   const data: DevRouteData = { url: at.href, params: ctx.params };
   if (entry.config.render === 'isr') return renderIsr(entry, data, ctx, options, isr);
+  // A `static` document is kept and answered to every later visitor, so it is rendered as nobody,
+  // `load` and document both: the memo and a CDN would otherwise hold this visitor's answer.
+  if (entry.config.render === 'static') {
+    return withAnonymousRequest(ctx, at, (scope) => loadAndRender(entry, data, scope, options));
+  }
+  return loadAndRender(entry, data, ctx, options);
+}
+
+/** Every mode but `isr`, whose `load` is inside its producer (`runtime-isr-outcome.ts`). */
+async function loadAndRender(
+  entry: RouteEntry,
+  data: DevRouteData,
+  ctx: RequestContext,
+  options: DevRenderOptions,
+): Promise<Rendered> {
   // ONCE per request, before the mode is chosen: every branch of `resultFor` reads this same
   // object, so a route's `load` runs exactly once however its mode splits head from body.
   const loaded = await routeDataFor(entry.config, data);
@@ -494,7 +337,14 @@ async function renderIsr(
 ): Promise<Rendered> {
   const document = (loaded: RouteData, at: DevRouteData): Promise<string> =>
     documentFrom(entry, at, loaded, options);
-  const outcome = await isrOutcome({ entry, data, ctx, isr, document });
+  const outcome = await isrOutcome({
+    entry,
+    data,
+    ctx,
+    isr,
+    document,
+    origin: options.origin,
+  });
   if (outcome.kind === 'redirect') return { respond: () => loadRedirect(entry, outcome.to) };
   return { respond: () => responseOf(outcome.result) };
 }

package/src/runtime-replica-position.ts

@@ -0,0 +1,62 @@
+// Single responsibility: the replica scope's request frame, and the position it carries. A request
+// that wrote answers with the primary's WAL position (`__Host-x-pos` and `x-ultimate-position`);
+// a later request that brings it back reads a replica only once that replica has replayed it.
+
+import { logger, renderThrowable } from '@ultimat3/core';
+import { db, formatPosition, parsePosition, primaryPosition, withReplicaReads } from '@ultimat3/db';
+import {
+  type Middleware,
+  type RequestContext,
+  setCookie,
+  type UltimateRequest,
+} from '@ultimat3/http';
+
+export const POSITION_COOKIE = '__Host-x-pos';
+export const POSITION_HEADER = 'x-ultimate-position';
+/** How long a write's position is carried: past it, a replica is assumed to have caught up. */
+export const POSITION_STICKY_MS = 30_000;
+
+/**
+ * The position this request carries, parsed — the header an API client echoes, else the cookie a
+ * browser does. Never the raw value: a forged one costs the sender a primary read, nothing more.
+ */
+export function carriedPosition(request: UltimateRequest): bigint | undefined {
+  return (
+    parsePosition(request.header(POSITION_HEADER)) ?? parsePosition(request.cookie(POSITION_COOKIE))
+  );
+}
+
+/**
+ * Stamps the position on the request's response-header bag, which the `response` stage lays onto
+ * whatever Response the handler built — a `Response.redirect`, the write-then-redirect this exists
+ * for, included. The cookie through `setCookie`, so its attributes are core's one serializer's.
+ */
+function stamp(ctx: RequestContext, position: bigint, stickyMs: number): void {
+  const text = formatPosition(position);
+  ctx.headers.set(POSITION_HEADER, text);
+  setCookie(POSITION_COOKIE, text, { maxAge: Math.ceil(stickyMs / 1000) });
+}
+
+/**
+ * Opens the scope with the carried position, runs the request, and — only when it wrote — reads the
+ * primary's position ONCE after every transaction in it committed. Inside the scope, so the read
+ * itself is the primary's: a scope that wrote routes nothing to the replica.
+ */
+export function positionStage(stickyMs: number = POSITION_STICKY_MS): Middleware {
+  return (request, ctx, next) =>
+    withReplicaReads(
+      async (scope) => {
+        const response = await next(request, ctx);
+        if (!scope.wrote) return response;
+        const position = await primaryPosition(db()).catch((error: unknown) => {
+          // The write committed and the answer is ready: a lost position costs the NEXT request a
+          // possibly stale replica read within the sticky window, never this request its answer.
+          logger.warn('db.replica_position_unread', { error: renderThrowable(error) });
+          return undefined;
+        });
+        if (position !== undefined) stamp(ctx, position, stickyMs);
+        return response;
+      },
+      { minPosition: carriedPosition(request) },
+    );
+}

package/src/runtime-replica.ts

@@ -17,10 +17,11 @@
 // what a database is.
 
 import type { DbClient, PoolProfile, PostgresClient } from '@ultimat3/db';
-import { postgresClient, REPLICA_URL_ENV, replicatedClient, withReplicaReads } from '@ultimat3/db';
+import { POOLER_ENV, postgresClient, REPLICA_URL_ENV, replicatedClient } from '@ultimat3/db';
 import type { Middleware } from '@ultimat3/http';
 import type { ServiceBinding } from './runtime-bindings';
 import type { RuntimeOverrides } from './runtime-overrides';
+import { positionStage } from './runtime-replica-position';
 
 export type ReplicaEnv = Readonly<Record<string, string | undefined>>;
 
@@ -44,6 +45,9 @@ export interface ReplicaAttachment {
   readonly replica: PostgresClient | undefined;
 }
 
+const isPool = (client: DbClient): client is PostgresClient =>
+  'profile' in client && 'pooler' in client;
+
 /**
  * The primary as it is, or the primary with a standby behind it. Composed here rather than by
  * calling `defaultClient()`, because that function builds its own primary from `DATABASE_URL` and
@@ -57,7 +61,14 @@ export function attachReplica(
   profile: Partial<PoolProfile> = {},
 ): ReplicaAttachment {
   if (replicaUrl === undefined) return { client: primary, replica: undefined };
-  const replica = postgresClient({ url: replicaUrl, applicationName: 'ultimate-replica', profile });
+  const replica = postgresClient({
+    url: replicaUrl,
+    applicationName: 'ultimate-replica',
+    // The primary's answers, never a second read of the environment: one process, one role's
+    // numbers and one pooler mode. An embedded primary has neither, and the defaults stand.
+    profile: isPool(primary) ? { ...primary.profile, ...profile } : profile,
+    env: { [POOLER_ENV]: isPool(primary) ? primary.pooler : undefined },
+  });
   return { client: replicatedClient(primary, replica), replica };
 }
 
@@ -66,13 +77,17 @@ export function attachReplica(
  * every later read in it to the primary, which is what read-your-writes means. `compose()` wraps
  * each route handler, and every read and write a request makes happens inside one.
  *
+ * The same frame carries read-your-writes ACROSS requests: the position a write produced goes back
+ * as a cookie and a header, and the next request's reads wait for a replica that has replayed it
+ * (`runtime-replica-position.ts`).
+ *
  * EMPTY when no replica is configured, and that is the whole cost argument: a homework app
  * installs no middleware, allocates no scope object and enters no `AsyncLocalStorage` run per
  * request. With one configured, the list is a single frame.
  */
 export function replicaMiddleware(binding: ServiceBinding, env: ReplicaEnv): readonly Middleware[] {
   if (replicaUrlFor(binding, env) === undefined) return [];
-  return [(request, ctx, next) => withReplicaReads(() => next(request, ctx))];
+  return [positionStage()];
 }
 
 /**

package/src/runtime-s3-path-style.ts

@@ -0,0 +1,17 @@
+// Single responsibility: the one reader of `S3_FORCE_PATH_STYLE`. A gateway addressed by host and port
+// needs path style and R2 and AWS do not, so it is declared, never sniffed from the endpoint. It read
+// only `'1'`, so `true` silently selected virtual-host style and every request missed the bucket.
+
+import { ConfigInvalidError, renderCauseValue } from '@ultimat3/core';
+import type { Env } from './runtime-bindings';
+
+/** `1` is on; `0`, unset and blank are off, as a blank `S3_*` is unset everywhere else on the disk. */
+export function s3PathStyleOf(env: Env): boolean {
+  const value = env['S3_FORCE_PATH_STYLE'];
+  if (value === undefined || value === '' || value === '0') return false;
+  if (value === '1') return true;
+  throw new ConfigInvalidError({
+    cause: `S3_FORCE_PATH_STYLE is ${renderCauseValue(value)}, and only 0 and 1 say which addressing the disk uses`,
+    fix: 'S3_FORCE_PATH_STYLE=1   # a gateway addressed by host and port; 0 for AWS and R2',
+  });
+}

package/src/runtime-services.ts

@@ -4,7 +4,14 @@
 // boot installs, only backed by embedded drivers.
 
 import { mkdirSync } from 'node:fs';
-import { configureAuthLimiters, postgresAuthLimiter, resetAuthLimiters } from '@ultimat3/auth';
+import {
+  configureAuthLimiters,
+  configureTotpReplay,
+  postgresAuthLimiter,
+  postgresTotpReplayGuard,
+  resetAuthLimiters,
+  resetTotpReplay,
+} from '@ultimat3/auth';
 import type { PurgeDriver } from '@ultimat3/cache';
 import { isNoopPurgeDriver, selectPurgeDriver } from '@ultimat3/cache';
 import {
@@ -43,9 +50,10 @@ import { inboxRetentionOf } from './runtime-notify-retention';
 import type { RuntimeOverrides } from './runtime-overrides';
 import { installRetentionSweep } from './runtime-purge';
 import { installAppWebPush, selectWebPush } from './runtime-push';
-import type { DevDbClient, SchemaMode } from './runtime-queue';
-import { startQueue } from './runtime-queue';
+import { type DevDbClient, type SchemaMode, startQueue } from './runtime-queue';
 import { realtimeConfigOf } from './runtime-realtime';
+import { s3PathStyleOf } from './runtime-s3-path-style';
+import { reportStatementBound } from './runtime-statement-bound';
 
 export interface RunningServices {
   readonly services: DevServices;
@@ -194,9 +202,7 @@ export function startStorage(services: DevServices, env: Env, override?: Storage
           bucket,
           endpoint: binding.url,
           ...(env['S3_REGION'] === undefined ? {} : { region: env['S3_REGION'] }),
-          // A gateway addressed by host and port needs path style; R2 and AWS do not. Declared,
-          // never sniffed from the endpoint.
-          forcePathStyle: env['S3_FORCE_PATH_STYLE'] === '1',
+          forcePathStyle: s3PathStyleOf(env),
         }),
       },
       default: 'object',
@@ -361,6 +367,7 @@ export async function startServices(
   // a different answer than the middleware that routes to it.
   const queue = await startQueue(services, overrides, env, schema);
   const { db, jobs, outbox, events } = queue;
+  await reportStatementBound(db);
   // The same executor the jobs driver, the outbox, the event bus and the idempotency store run
   // on — one pool, one `Bun.sql` that does NOT satisfy `PgExecutor` (`Bun.sql.query` is
   // `undefined`), one wrapper.
@@ -388,6 +395,11 @@ export async function startServices(
       postgresAuthLimiter({ executor, clock: systemClock, policy }),
     );
     started.push(() => resetAuthLimiters());
+    // Where spent TOTP steps are kept, for the same reason: a code one replica accepted must be
+    // refused by the rest, and `defineAuth` runs when the app's modules import.
+    const totpReplay = postgresTotpReplayGuard({ executor });
+    configureTotpReplay(() => totpReplay);
+    started.push(() => resetTotpReplay());
     // Where an action's or a query's declared `rateLimit:` is counted — on every surface, so a
     // task or a one-off command spends from the fleet's table too, not one process' memory. Before
     // `loadApp` for the auth limiters' reason; `startRoles` stacks a deployment's override over it.
@@ -403,6 +415,7 @@ export async function startServices(
       installRetentionSweep({
         idempotency: queue.idempotency,
         rateLimit: rateLimitStore,
+        totpReplay,
         events,
         ...jobsRetentionTargets(executor, config),
         inboxRetention: inboxRetentionOf(config),

package/src/runtime-statement-bound.ts

@@ -0,0 +1,22 @@
+// Single responsibility: the one boot line for a statement bound that is not the role's. A report,
+// never a refusal: a fleet already running on a pooler that drops the bound must not stop on upgrade.
+
+import { logger, renderThrowable, resolveRole } from '@ultimat3/core';
+import type { DbClient, PostgresClient } from '@ultimat3/db';
+import { lostStatementBound, statementBound } from '@ultimat3/db';
+
+/** PGlite has no profile and no `options`, and a replica's bound is read by nothing at boot. */
+const isPool = (db: DbClient): db is PostgresClient => 'profile' in db && 'pooler' in db;
+
+/** Total: a boot that got past `db.ping()` does not fail on a report about itself. */
+export async function reportStatementBound(db: DbClient): Promise<void> {
+  if (!isPool(db)) return;
+  try {
+    const lost = lostStatementBound(await statementBound(db), resolveRole(), db.pooler);
+    if (lost !== undefined) {
+      logger.error(lost.format(), { code: lost.code, ...lost.meta });
+    }
+  } catch (error) {
+    logger.debug('db.statement_bound_unread', { error: renderThrowable(error) });
+  }
+}

package/src/runtime-storage-upload.ts

@@ -8,6 +8,7 @@ import type { RequestContext, Route, UltimateRequest } from '@ultimat3/http';
 import { jsonResponse, NO_STORE } from '@ultimat3/http';
 import type { Storage } from '@ultimat3/storage';
 import {
+  acceptSignedPart,
   acceptSignedUpload,
   DEFAULT_MAX_UPLOAD_BYTES,
   DEFAULT_SIGNED_URL_BASE,
@@ -61,6 +62,14 @@ async function acceptUpload(
   const read = await readWithinLimit(request.raw.body, ceiling);
   if ('over' in read) throw tooLarge(constraints.key, read.over, ceiling);
 
+  // A part URL (`signPart` on a local disk) writes one part into its open session — never the
+  // object, which `completeUpload` assembles. The signature says which, so the one PUT route
+  // serves both: a second route on the same path could only shadow this one.
+  if (constraints.part !== undefined) {
+    const part = await acceptSignedPart({ url, disk, orgId, bytes: read.bytes });
+    return jsonResponse(part, { status: 200 });
+  }
+
   const stored = await acceptSignedUpload({
     url,
     disk,