create-feltdb 0.11.8 → 0.11.9

package/dist/server-source/crates/feltdb/src/state_contract.rs

@@ -21,12 +21,12 @@
 //!    fell back to scan without updating these fields.
 
 use crate::{
+    AtomicMutation, AtomicPrecondition, FeltDb, FlowError, PreconditionFailure, RecordPrecondition,
+    StoredRow,
     application::{ApplicationManifest, ApplicationRevision, FieldDefinition},
     policy_evaluation::{
         Actor, AuthorizationState, PolicyEvaluator, PolicySubject, RecordAuthorizationContext,
     },
-    AtomicMutation, AtomicPrecondition, FeltDb, FlowError, PreconditionFailure, RecordPrecondition,
-    StoredRow,
 };
 use serde::{Deserialize, Serialize};
 use serde_json::{Map, Value};
@@ -625,7 +625,7 @@ pub fn begin_query_read(
     state_namespace: &str,
     authorization: AuthorizationContext,
 ) -> Result<ReadContext, StateFailure> {
-    begin_read_internal(db, schema, state_namespace, authorization, false)
+    build_read_context(db, schema, state_namespace, authorization, Vec::new(), true)
 }
 
 fn begin_read_internal(
@@ -649,6 +649,24 @@ fn begin_read_internal(
     } else {
         Vec::new()
     };
+    build_read_context(
+        db,
+        schema,
+        state_namespace,
+        authorization,
+        snapshot_rows,
+        !capture_snapshot,
+    )
+}
+
+fn build_read_context(
+    db: &FeltDb,
+    schema: &StateSchema,
+    state_namespace: &str,
+    authorization: AuthorizationContext,
+    snapshot_rows: Vec<StoredRow>,
+    live_query: bool,
+) -> Result<ReadContext, StateFailure> {
     Ok(ReadContext {
         application_id: schema.application_id.clone(),
         revision_id: schema.revision_id.clone(),
@@ -662,10 +680,131 @@ fn begin_read_internal(
         state_namespace: state_namespace.into(),
         authorization,
         snapshot_rows,
-        live_query: !capture_snapshot,
+        live_query,
     })
 }
 
+fn namespace_capability(state_namespace: &str, collection: &str) -> String {
+    format!("{state_namespace}:{collection}")
+}
+
+fn membership_collection_name(schema: &StateSchema) -> Option<String> {
+    AuthorizationState::new(Arc::new(schema.clone()), "", Arc::new(Vec::new()))
+        .find_membership_collection()
+}
+
+fn member_policy_snapshot_rows(
+    db: &FeltDb,
+    schema: &StateSchema,
+    state_namespace: &str,
+) -> Result<Vec<StoredRow>, StateFailure> {
+    let Some(collection) = membership_collection_name(schema) else {
+        return Ok(Vec::new());
+    };
+    db.list_collection(&namespace_capability(state_namespace, &collection))
+        .map_err(StateFailure::storage)
+}
+
+fn load_reference_rows(
+    db: &FeltDb,
+    state_namespace: &str,
+    values: &[Value],
+    references: &[QueryReference],
+) -> Result<BTreeMap<(String, String), Value>, StateFailure> {
+    let mut rows = BTreeMap::new();
+    let mut requested = BTreeMap::<String, BTreeSet<String>>::new();
+    for reference in references {
+        for id in values
+            .iter()
+            .filter_map(|value| value.get(&reference.field).and_then(Value::as_str))
+        {
+            requested
+                .entry(reference.collection.clone())
+                .or_default()
+                .insert(id.to_string());
+        }
+    }
+    for (collection, ids) in requested {
+        let capability = namespace_capability(state_namespace, &collection);
+        let loaded = db
+            .get_collection_records(&capability, ids.iter().map(String::as_str))
+            .map_err(StateFailure::storage)?;
+        let present = loaded
+            .into_iter()
+            .map(|row| (row.key, row.value))
+            .collect::<BTreeMap<_, _>>();
+        for id in ids {
+            rows.insert(
+                (collection.clone(), id.clone()),
+                present.get(&id).cloned().unwrap_or(Value::Null),
+            );
+        }
+    }
+    Ok(rows)
+}
+
+fn transaction_snapshot_rows(
+    db: &FeltDb,
+    schema: &StateSchema,
+    request: &TransactionRequest,
+    uniform_write_policy: Option<&PolicySubject>,
+    collection_write_policies: Option<&BTreeMap<String, PolicySubject>>,
+) -> Result<Vec<StoredRow>, StateFailure> {
+    let namespace = request
+        .state_namespace
+        .as_deref()
+        .unwrap_or(&request.application_id);
+    let mut full_collections = BTreeSet::new();
+    let mut records = BTreeSet::new();
+    for condition in &request.preconditions {
+        if let TransactionPrecondition::CollectionVersion { collection, .. } = condition {
+            full_collections.insert(collection.clone());
+        }
+    }
+    let membership_collection = membership_collection_name(schema);
+    for operation in &request.operations {
+        let substrate = is_substrate_collection(&operation.collection);
+        records.insert((operation.collection.clone(), operation.id.clone()));
+        let write_policy = collection_write_policies
+            .and_then(|policies| policies.get(&operation.collection))
+            .or(uniform_write_policy);
+        if matches!(write_policy, Some(&PolicySubject::Member)) {
+            if let Some(collection) = &membership_collection {
+                full_collections.insert(collection.clone());
+            }
+        }
+        if substrate || matches!(operation.kind, TransactionOperationKind::Delete) {
+            continue;
+        }
+        let definition = collection(schema, &operation.collection)?;
+        if definition.indexes.iter().any(|index| index.unique) {
+            full_collections.insert(operation.collection.clone());
+        }
+    }
+
+    let mut snapshot = Vec::new();
+    let mut materialized = BTreeSet::new();
+    for collection in &full_collections {
+        snapshot.extend(
+            db.list_collection(&namespace_capability(namespace, collection))
+                .map_err(StateFailure::storage)?,
+        );
+        materialized.insert(collection.clone());
+    }
+    for (collection, key) in records {
+        if materialized.contains(&collection) {
+            continue;
+        }
+        if let Some(row) = db
+            .get_collection_record(&namespace_capability(namespace, &collection), &key)
+            .map_err(StateFailure::storage)?
+        {
+            snapshot.push(row);
+        }
+    }
+    Ok(snapshot)
+}
+
 #[derive(Debug, Clone, Serialize, Deserialize)]
 #[serde(tag = "operator", rename_all = "camelCase")]
 pub enum QueryFilter {
@@ -1231,14 +1370,39 @@ pub fn execute_query(
             "read context does not match schema",
         ));
     }
-    let definition = collection(schema, &query.collection)?;
-    if !context.authorization.can("state:read")
-        || (!context.authorization.readable_collections.is_empty()
-            && !context
-                .authorization
-                .readable_collections
-                .contains(&query.collection))
-    {
+    // Substrate collections carry no application schema: their records are
+    // validated by the substrate that writes them, and they are read only
+    // under `composition:read`.
+    let substrate = is_substrate_collection(&query.collection);
+    let substrate_definition;
+    let definition = if substrate {
+        if !query.references.is_empty() {
+            return Err(StateFailure::new(
+                "INVALID_QUERY",
+                "substrate collections do not expand references",
+            ));
+        }
+        substrate_definition = CollectionSchema {
+            name: query.collection.clone(),
+            version: 1,
+            fields: vec![],
+            indexes: vec![],
+        };
+        &substrate_definition
+    } else {
+        collection(schema, &query.collection)?
+    };
+    let readable = if substrate {
+        context.authorization.can("composition:read")
+    } else {
+        context.authorization.can("state:read")
+            && (context.authorization.readable_collections.is_empty()
+                || context
+                    .authorization
+                    .readable_collections
+                    .contains(&query.collection))
+    };
+    if !readable {
         return Err(StateFailure::new(
             "AUTHORIZATION_DENIED",
             "collection is not readable",
@@ -1271,7 +1435,7 @@ pub fn execute_query(
     for reference in &query.references {
         requested.insert(reference.field.clone());
     }
-    if requested.iter().any(|f| !available.contains(f)) {
+    if !substrate && requested.iter().any(|f| !available.contains(f)) {
         return Err(StateFailure::new(
             "UNKNOWN_FIELD",
             "query references an unknown field",
@@ -1341,14 +1505,10 @@ pub fn execute_query(
         }
     }
 
-    let query_snapshot;
-    let snapshot_rows = if read_policy.is_some() || !query.references.is_empty() {
-        query_snapshot = _db
-            .state_rows_for_namespace(&context.state_namespace)
-            .map_err(StateFailure::storage)?;
-        &query_snapshot
+    let policy_snapshot = if matches!(read_policy, Some(PolicySubject::Member)) {
+        member_policy_snapshot_rows(_db, schema, &context.state_namespace)?
     } else {
-        &context.snapshot_rows
+        Vec::new()
     };
 
     // Detect unfiltered COUNT(*) for maintained cardinality optimization
@@ -1433,7 +1593,10 @@ pub fn execute_query(
             (false, None, None)
         };
     let used_index = planned_index && context.live_query;
+    // Substrate collections declare no indexes and already live inside the
+    // application's tenant-scoped namespace; their bounded queries are exempt.
     if context.live_query
+        && !substrate
         && query.filter.as_ref().is_some_and(contains_managed_scope)
         && !used_index
     {
@@ -1452,7 +1615,8 @@ pub fn execute_query(
     let execution_before = crate::query_execution_diagnostics::counters();
     let index_lookup_start = Instant::now();
     let selected_rows = if !context.live_query {
-        snapshot_rows
+        context
+            .snapshot_rows
             .iter()
             .filter(|row| {
                 row.capability == capability
@@ -1523,22 +1687,26 @@ pub fn execute_query(
                     .map(|id| Actor::new(id))
             };
 
-        // Create authorization state for policies that need to verify relationships
-        let auth_state = AuthorizationState::new(
-            Arc::new(schema.clone()),
-            context.state_namespace.clone(),
-            Arc::new(snapshot_rows.clone()),
-        );
+        let auth_state = matches!(policy, &PolicySubject::Member).then(|| {
+            AuthorizationState::new(
+                Arc::new(schema.clone()),
+                context.state_namespace.clone(),
+                Arc::new(policy_snapshot.clone()),
+            )
+        });
 
         values.retain(|record_value| {
             if let Some(record_id) = record_value.get("_id").and_then(Value::as_str) {
-                let record_context = RecordAuthorizationContext {
+                let mut record_context = RecordAuthorizationContext {
                     actor: actor.clone(),
                     collection: query.collection.clone(),
                     record_id: record_id.to_string(),
                     record_value: record_value.clone(),
-                    authorization_state: Some(auth_state.clone()),
+                    authorization_state: None,
                 };
+                if let Some(state) = &auth_state {
+                    record_context.authorization_state = Some(state.clone());
+                }
 
                 PolicyEvaluator::evaluate_record(policy.clone(), &record_context).is_ok()
             } else {
@@ -1547,19 +1715,18 @@ pub fn execute_query(
         });
     }
 
+    let reference_rows =
+        load_reference_rows(_db, &context.state_namespace, &values, &query.references)?;
     for value in &mut values {
         for reference in &query.references {
             let id = value.get(&reference.field).and_then(Value::as_str);
             let related = id
                 .and_then(|id| {
-                    snapshot_rows.iter().find(|row| {
-                        row.capability
-                            == format!("{}:{}", context.state_namespace, reference.collection)
-                            && row.key == id
-                            && !row.deleted
-                    })
+                    reference_rows
+                        .get(&(reference.collection.clone(), id.to_string()))
+                        .filter(|value| !value.is_null())
                 })
-                .map(|row| projected(&row.value, &reference.projection))
+                .map(|value| projected(value, &reference.projection))
                 .unwrap_or(Value::Null);
             if let Some(object) = value.as_object_mut() {
                 object.insert(reference.as_name.clone(), related);
@@ -1826,6 +1993,98 @@ pub struct TransactionRequest {
     pub operations: Vec<TransactionOperation>,
     #[serde(default)]
     pub preconditions: Vec<TransactionPrecondition>,
+    /// Read bases this authority issued for this state namespace
+    /// (`capture_read_basis`), re-evaluated inside the commit lock.
+    #[serde(default, skip_serializing_if = "Vec::is_empty")]
+    pub fences: Vec<crate::ReadBasis>,
+}
+
+/// Collections the composition substrate keeps inside an application's state
+/// namespace. They are not part of the application contract: their records
+/// are validated by the substrate, and reading or writing them requires the
+/// dedicated `composition:read` / `composition:write` capabilities rather
+/// than `state:*`. Every other `_feltdb` name remains unwritable here.
+pub const SUBSTRATE_COLLECTIONS: &[&str] = &[
+    "_feltdb.CompositionContract",
+    "_feltdb.Composition",
+    "_feltdb.CompositionVersion",
+    "_feltdb.CompositionTopology",
+    "_feltdb.StateOwnership",
+    "_feltdb.StateDependency",
+    "_feltdb.StateChange",
+    "_feltdb.StateAttribution",
+    "_feltdb.StateObservation",
+    "_feltdb.StateProposal",
+    "_feltdb.StateImpact",
+    "_feltdb.Intent",
+    "_feltdb.IntentEvent",
+    "_feltdb.ProposalEvent",
+];
+
+pub fn is_substrate_collection(name: &str) -> bool {
+    SUBSTRATE_COLLECTIONS.contains(&name)
+}
+
+/// Capture a read basis over an application state namespace.
+///
+/// Every collection the read set names must be one the caller may read in
+/// full: an application collection readable under `state:read` whose read
+/// policy does not depend on the record, or a substrate collection under
+/// `composition:read`. A token is a digest over every row it covers, so a
+/// basis over rows the caller could not read would disclose them; such a
+/// read set is refused, never digested.
+pub fn capture_read_basis(
+    db: &FeltDb,
+    schema: &StateSchema,
+    state_namespace: &str,
+    reads: &crate::ReadSet,
+    readable: &dyn Fn(&str) -> bool,
+) -> Result<crate::ReadBasis, StateFailure> {
+    let reads = reads
+        .normalised()
+        .map_err(|error| StateFailure::new("VALIDATION_FAILED", &error.to_string()))?;
+    authorize_read_set(schema, &reads, readable)?;
+    db.read_basis_in(
+        &reads,
+        &crate::ReadLayout::Namespace(state_namespace.to_string()),
+    )
+    .map_err(StateFailure::storage)
+}
+
+/// The refusal for a read basis over a collection the caller cannot read in full.
+pub fn read_basis_denied(collection: &str) -> StateFailure {
+    let mut failure = StateFailure::new(
+        "AUTHORIZATION_DENIED",
+        "a read basis may only cover collections the caller can read in full",
+    );
+    failure.resource = Some(collection.to_string());
+    failure
+}
+
+fn authorize_read_set(
+    schema: &StateSchema,
+    reads: &crate::ReadSet,
+    readable: &dyn Fn(&str) -> bool,
+) -> Result<(), StateFailure> {
+    let collections = reads
+        .records
+        .iter()
+        .map(|record| record.collection.as_str())
+        .chain(
+            reads
+                .predicates
+                .iter()
+                .map(|predicate| predicate.collection.as_str()),
+        );
+    for name in collections {
+        if !is_substrate_collection(name) {
+            collection(schema, name)?;
+        }
+        if !readable(name) {
+            return Err(read_basis_denied(name));
+        }
+    }
+    Ok(())
 }
 #[derive(Debug, Clone, Serialize, Deserialize)]
 pub struct TransactionAudit {
@@ -2103,10 +2362,12 @@ fn validate_record(collection: &CollectionSchema, value: &mut Value) -> Result<(
             }
         }
     }
-    if object
-        .keys()
-        .any(|name| name != "__version" && !collection.fields.iter().any(|f| &f.name == name))
-    {
+    // `__version` and `id` are record identity, carried by every client
+    // record whether or not the contract declares them; a declared `id` is
+    // validated by its declaration above.
+    if object.keys().any(|name| {
+        name != "__version" && name != "id" && !collection.fields.iter().any(|f| &f.name == name)
+    }) {
         return Err(StateFailure::new(
             "VALIDATION_FAILED",
             "record contains an unknown field",
@@ -2162,17 +2423,34 @@ fn execute_transaction_with_policies(
             "state:write is required",
         ));
     }
-    let canonical = serde_json::to_vec(&(
-        request.tenant_id.as_str(),
-        request.application_id.as_str(),
-        request.revision_id.as_str(),
-        request.schema_version,
-        request.state_namespace.as_deref(),
-        request.causal_parent,
-        &request.authorization.subject,
-        &request.preconditions,
-        &request.operations,
-    ))
+    let canonical = if request.fences.is_empty() {
+        serde_json::to_vec(&(
+            request.tenant_id.as_str(),
+            request.application_id.as_str(),
+            request.revision_id.as_str(),
+            request.schema_version,
+            request.state_namespace.as_deref(),
+            request.causal_parent,
+            &request.authorization.subject,
+            &request.preconditions,
+            &request.operations,
+        ))
+    } else {
+        // Fences are part of what the transaction means, so they bind its
+        // identity. Unfenced transactions hash exactly as they always have.
+        serde_json::to_vec(&(
+            request.tenant_id.as_str(),
+            request.application_id.as_str(),
+            request.revision_id.as_str(),
+            request.schema_version,
+            request.state_namespace.as_deref(),
+            request.causal_parent,
+            &request.authorization.subject,
+            &request.preconditions,
+            &request.operations,
+            &request.fences,
+        ))
+    }
     .map_err(StateFailure::storage)?;
     let transaction_id = request
         .transaction_id
@@ -2252,9 +2530,13 @@ fn execute_transaction_with_policies(
         .as_deref()
         .unwrap_or(&request.application_id)
         .to_string();
-    let snapshot = db
-        .state_rows_for_namespace(&namespace)
-        .map_err(StateFailure::storage)?;
+    let snapshot = transaction_snapshot_rows(
+        db,
+        schema,
+        request,
+        uniform_write_policy,
+        collection_write_policies,
+    )?;
     // Record preconditions are collected here and evaluated by the store,
     // inside the same lock as the writes. Evaluating them against `snapshot`
     // alongside the counters below would reintroduce exactly the gap they
@@ -2371,7 +2653,22 @@ fn execute_transaction_with_policies(
                 "collection is not writable",
             ));
         }
-        let definition = collection(schema, &operation.collection)?;
+        // Substrate collections are validated by the substrate that owns them,
+        // and written only under the dedicated capability.
+        let substrate = is_substrate_collection(&operation.collection);
+        if substrate && !request.authorization.can("composition:write") {
+            let mut failure = StateFailure::new(
+                "AUTHORIZATION_DENIED",
+                "composition:write is required for substrate collections",
+            );
+            failure.resource = Some(operation.collection.clone());
+            return Err(failure);
+        }
+        let definition = if substrate {
+            None
+        } else {
+            Some(collection(schema, &operation.collection)?)
+        };
         let capability = format!(
             "{}:{}",
             request
@@ -2392,7 +2689,8 @@ fn execute_transaction_with_policies(
         // Per-operation record authorization
         let write_policy = collection_write_policies
             .and_then(|policies| policies.get(&operation.collection))
-            .or(uniform_write_policy);
+            .or(uniform_write_policy)
+            .filter(|_| !substrate);
         if let Some(policy) = write_policy {
             let actor = if request.authorization.subject.is_empty()
                 || request.authorization.subject == ":"
@@ -2458,7 +2756,16 @@ fn execute_transaction_with_policies(
                     return Err(StateFailure::new("CONFLICT", "record already exists"));
                 }
                 let mut value = operation.value.clone();
-                validate_record(definition, &mut value)?;
+                match definition {
+                    Some(definition) => validate_record(definition, &mut value)?,
+                    None if value.is_object() => {}
+                    None => {
+                        return Err(StateFailure::new(
+                            "VALIDATION_FAILED",
+                            "record must be an object",
+                        ));
+                    }
+                }
                 Some(value)
             }
             TransactionOperationKind::Update => {
@@ -2474,7 +2781,9 @@ fn execute_transaction_with_policies(
                         .expect("existing object")
                         .insert(k.clone(), v.clone());
                 }
-                validate_record(definition, &mut value)?;
+                if let Some(definition) = definition {
+                    validate_record(definition, &mut value)?;
+                }
                 Some(value)
             }
             TransactionOperationKind::Delete => {
@@ -2509,6 +2818,7 @@ fn execute_transaction_with_policies(
                 .unwrap_or(&request.application_id),
             definition.name
         );
+        let mut referenced_records = BTreeMap::new();
         for ((cap, key), value) in overlay
             .iter()
             .filter(|((cap, _), value)| cap == &capability && value.is_some())
@@ -2525,16 +2835,29 @@ fn execute_transaction_with_policies(
                                 .unwrap_or(&request.application_id),
                             target
                         );
-                        let present = overlay
-                            .get(&(target_capability.clone(), reference.into()))
-                            .map(|v| v.is_some())
-                            .unwrap_or_else(|| {
-                                snapshot.iter().any(|row| {
-                                    row.capability == target_capability
-                                        && row.key == reference
-                                        && !row.deleted
-                                })
-                            });
+                        let present = if let Some(value) =
+                            overlay.get(&(target_capability.clone(), reference.into()))
+                        {
+                            value.is_some()
+                        } else if snapshot.iter().any(|row| {
+                            row.capability == target_capability
+                                && row.key == reference
+                                && !row.deleted
+                        }) {
+                            true
+                        } else {
+                            let cache_key = (target_capability.clone(), reference.to_string());
+                            if let Some(present) = referenced_records.get(&cache_key) {
+                                *present
+                            } else {
+                                let present = db
+                                    .get_collection_record(&target_capability, reference)
+                                    .map_err(StateFailure::storage)?
+                                    .is_some();
+                                referenced_records.insert(cache_key, present);
+                                present
+                            }
+                        };
                         if !present {
                             let mut failure = StateFailure::new(
                                 "VALIDATION_FAILED",
@@ -2583,12 +2906,14 @@ fn execute_transaction_with_policies(
         }
     }
     let commit = db
-        .apply_atomic_transaction_guarded(
+        .apply_atomic_transaction_fenced_in(
             &storage_transaction_id,
             Some(&payload_hash),
             request.causal_parent,
             &preconditions,
             &record_preconditions,
+            &crate::ReadLayout::Namespace(namespace.clone()),
+            &request.fences,
             &mutations,
             Some(serde_json::json!({"transaction_id":transaction_id.clone(),"subject":request.authorization.subject.clone(),"tenant":request.tenant_id.clone(),"application":request.application_id.clone(),"revision":request.revision_id.clone(),"schema_version":request.schema_version,"operations":request.operations.len(),"authorization_decisions":["state:write allowed"],"causal_parent":request.causal_parent,"result":"committed"})),
         )
@@ -2625,6 +2950,12 @@ fn execute_transaction_with_policies(
                 return failure;
             }
             let text = error.to_string();
+            if text.contains("INVALID_READ_SET:") {
+                // A malformed or foreign basis is a caller error, never a lost race.
+                let mut failure = StateFailure::new("VALIDATION_FAILED", &text);
+                failure.transaction = Some(transaction_id.clone());
+                return failure;
+            }
             if text.contains("PRECONDITION_FAILED") {
                 let mut failure = StateFailure::new("PRECONDITION_FAILED", &text);
                 failure.transaction = Some(transaction_id.clone());
@@ -2923,6 +3254,7 @@ mod tests {
                     if_version: None,
                 },
             ],
+            fences: vec![],
         };
         let result = execute_transaction(&db, &schema, &request, None).unwrap();
         assert_eq!(result.state_after, 2);
@@ -2974,6 +3306,7 @@ mod tests {
                         value: serde_json::json!({ "title": title }),
                         if_version: None,
                     }],
+                    fences: vec![],
                 },
                 None,
             )
@@ -3122,6 +3455,7 @@ mod tests {
                     value: serde_json::json!({ "title": "First" }),
                     if_version: None,
                 }],
+                fences: vec![],
             },
             None,
         )
@@ -3160,6 +3494,7 @@ mod tests {
                     if_version: None,
                 },
             ],
+            fences: vec![],
         };
         assert_eq!(
             execute_transaction(&db, &schema, &request, None)
@@ -3194,6 +3529,7 @@ mod tests {
                         value: serde_json::json!({"title":title,"status":status}),
                         if_version: None,
                     }],
+                    fences: vec![],
                 },
                 None,
             )
@@ -3285,6 +3621,7 @@ mod tests {
                 value: serde_json::json!({"title":"First"}),
                 if_version: None,
             }],
+            fences: vec![],
         };
         let first = execute_transaction(&db, &schema, &request, None).unwrap();
         let duplicate = execute_transaction(&db, &schema, &request, None).unwrap();
@@ -3324,6 +3661,7 @@ mod tests {
                 value: serde_json::json!({"title":"First"}),
                 if_version: None,
             }],
+            fences: vec![],
         };
         execute_transaction(&db, &schema, &request, None).unwrap();
         request.transaction_id = Some("stale-parent".into());
@@ -3361,6 +3699,7 @@ mod tests {
                 value: serde_json::json!({"title":"Original"}),
                 if_version: None,
             }],
+            fences: vec![],
         };
         {
             let db = crate::open(&path).unwrap();
@@ -3417,6 +3756,7 @@ mod tests {
                     value: serde_json::json!({"title":format!("{app}-{record}")}),
                     if_version: None,
                 }],
+                fences: vec![],
             };
             (schema, request)
         }
@@ -3501,6 +3841,7 @@ mod tests {
                 value: serde_json::json!({"title":id}),
                 if_version: None,
             }],
+            fences: vec![],
         };
         execute_transaction(&db, &schema, &insert("one"), None).unwrap();
         let context = begin_read(&db, &schema, "app", auth()).unwrap();
@@ -3561,6 +3902,7 @@ mod tests {
                         if_version: None,
                     },
                 ],
+                fences: vec![],
             };
             execute_transaction(&db, &schema, &request, None).unwrap();
         }
@@ -3594,6 +3936,7 @@ mod tests {
                     if_version: None,
                 })
                 .collect(),
+            fences: vec![],
         };
         execute_transaction(&db, &schema, &request, None).unwrap();
         let context = begin_query_read(&db, &schema, "app", auth()).unwrap();
@@ -3657,6 +4000,7 @@ mod tests {
                     if_version: None,
                 })
                 .collect(),
+            fences: vec![],
         };
         execute_transaction(&db, &schema, &request, None).unwrap();
         let context = begin_read(&db, &schema, "app", auth()).unwrap();
@@ -3719,6 +4063,7 @@ mod tests {
                 value: serde_json::json!({"title": "Test", "status": "open"}),
                 if_version: None,
             }],
+            fences: vec![],
         };
         execute_transaction(&db, &schema, &request, None).unwrap();
         let context = begin_query_read(&db, &schema, "app", auth()).unwrap();
@@ -3779,6 +4124,7 @@ mod tests {
                     if_version: None,
                 })
                 .collect(),
+            fences: vec![],
         };
         execute_transaction(&db, &schema, &request, None).unwrap();
         let context = begin_query_read(&db, &schema, "app", auth()).unwrap();
@@ -3841,6 +4187,7 @@ mod tests {
                 authorization: auth(),
                 preconditions: vec![],
                 operations,
+                fences: vec![],
             },
             None,
         )
@@ -3867,10 +4214,11 @@ mod tests {
         let first_cursor = loop {
             let page = execute_query(&db, &schema, &context, &query, None).unwrap();
             assert!(page.records.len() <= 25);
-            assert!(page
-                .records
-                .iter()
-                .all(|record| record["status"] == "tenant-a"));
+            assert!(
+                page.records
+                    .iter()
+                    .all(|record| record["status"] == "tenant-a")
+            );
             ids.extend(
                 page.records
                     .iter()
@@ -3946,6 +4294,7 @@ mod tests {
                     value: serde_json::json!({ "title": "First", "status": "open" }),
                     if_version: None,
                 }],
+                fences: vec![],
             },
             None,
         )
@@ -4126,6 +4475,7 @@ mod tests {
                     authorization: auth(),
                     preconditions: vec![],
                     operations,
+                    fences: vec![],
                 },
                 None,
             )
@@ -4188,6 +4538,7 @@ mod tests {
                     value: serde_json::json!({"tenant_id":"tenant-a"}),
                     if_version: None,
                 }],
+                fences: vec![],
             },
             None,
         )
@@ -4322,6 +4673,7 @@ mod tests {
                 authorization: auth_ctx.clone(),
                 preconditions: vec![],
                 operations,
+                fences: vec![],
             };
             execute_transaction(&db, &schema, &request, None).unwrap();
         }
@@ -4505,6 +4857,7 @@ mod tests {
                 if_version: None,
             }],
             preconditions: vec![],
+            fences: vec![],
         };
 
         let result = execute_transaction(&db, &schema, &request, None);
@@ -4543,6 +4896,7 @@ mod tests {
                 if_version: None,
             }],
             preconditions: vec![],
+            fences: vec![],
         };
         execute_transaction(&db, &schema, &insert_request, None).unwrap();
 
@@ -4612,6 +4966,7 @@ mod tests {
                 if_version: None,
             }],
             preconditions: vec![],
+            fences: vec![],
         };
 
         let result = execute_transaction(&db, &schema, &request, None);
@@ -4643,6 +4998,7 @@ mod tests {
                 if_version: None,
             }],
             preconditions: vec![],
+            fences: vec![],
         };
         execute_transaction(&db, &schema, &insert_request, None).unwrap();
 
@@ -4716,6 +5072,7 @@ mod tests {
                 if_version: None,
             }],
             preconditions: vec![],
+            fences: vec![],
         };
 
         let result = execute_transaction(&db, &schema, &request, None);
@@ -4750,6 +5107,7 @@ mod tests {
                 if_version: None,
             }],
             preconditions: vec![],
+            fences: vec![],
         };
         let initial_result = execute_transaction(&db, &schema, &insert_initial, None).unwrap();
         let state_before_denied_tx = initial_result.state_after;
@@ -4783,6 +5141,7 @@ mod tests {
                 if_version: None,
             }],
             preconditions: vec![],
+            fences: vec![],
         };
 
         let denied_result = execute_transaction(&db, &schema, &denied_request, None);
@@ -4848,6 +5207,7 @@ mod tests {
                 if_version: None,
             }],
             preconditions: vec![],
+            fences: vec![],
         };
 
         let result = execute_transaction(&db, &schema, &write_request, None);
@@ -4893,6 +5253,7 @@ mod tests {
                 if_version: None,
             }],
             preconditions: vec![],
+            fences: vec![],
         };
 
         let _ = execute_transaction(&db, &schema, &insert_request, None);
@@ -5005,6 +5366,7 @@ mod tests {
                 if_version: None,
             }],
             preconditions: vec![],
+            fences: vec![],
         };
 
         let result = execute_transaction(&db, &schema, &write_request, None);
@@ -5048,6 +5410,7 @@ mod tests {
                 if_version: None,
             }],
             preconditions: vec![],
+            fences: vec![],
         };
 
         let result = execute_transaction(&db, &schema, &write_request, None);
@@ -5095,6 +5458,7 @@ mod tests {
                 if_version: None,
             }],
             preconditions: vec![],
+            fences: vec![],
         };
 
         let _ = execute_transaction(&db, &schema, &insert_in_org2, None);
@@ -5130,6 +5494,7 @@ mod tests {
                 if_version: Some(0),
             }],
             preconditions: vec![],
+            fences: vec![],
         };
 
         let result = execute_transaction(&db, &schema, &cross_org_mutation, None);
@@ -5211,6 +5576,7 @@ mod tests {
                 },
             ],
             preconditions: vec![],
+            fences: vec![],
         };
 
         execute_transaction(&db, &schema, &insert_records, None).expect("insert should succeed");
@@ -5304,6 +5670,7 @@ mod tests {
                 if_version: None,
             }],
             preconditions: vec![],
+            fences: vec![],
         };
 
         execute_transaction(&db, &schema, &insert_request, None).expect("insert should succeed");
@@ -5395,6 +5762,7 @@ mod tests {
                 },
             ],
             preconditions: vec![],
+            fences: vec![],
         };
 
         execute_transaction(&db, &schema, &insert_records, None).expect("insert should succeed");
@@ -5482,6 +5850,7 @@ mod tests {
             authorization: admin_context,
             operations: ops,
             preconditions: vec![],
+            fences: vec![],
         };
 
         execute_transaction(&db, &schema, &insert_request, None).expect("insert should succeed");