cursedbelt-server 4.20.0 → 4.22.0

package/dist/server/requestLog/requestMetrics.js

@@ -0,0 +1,185 @@
+/**
+ * `cursedbelt-server/request-log` — the request log, "is this app healthy": one row per request
+ * served, in `<APP_DATA_DIR>/metrics.sqlite`, the file station's Metrics page reads for every app on
+ * this Mac (`apps/station/src/server/fleetMetrics.ts`, `METRICS_DB`).
+ *
+ * ── Why it is here (4.21.0) ─────────────────────────────────────────────────
+ * `apps/family` and `apps/roms` held this module byte-identically (task 265's rollout), and
+ * `check-copies` counted it as five copy groups. The API, the header marker and the migration name
+ * are exactly the apps' — a live corpus is recognised by `METRICS_APPLICATION_ID` and by the
+ * `0001_request_metrics` row in its migrations table, so changing either would make every
+ * existing `metrics.sqlite` look inherited and archive it. Bun-only (`bun:sqlite`, `node:fs`): under
+ * Node the export map routes this subpath to `_bunOnly.js`, the way `./engagement` does; it is NOT
+ * part of `./telemetry`, which is Worker-safe (`telemetryIsWorkerSafe.spec.ts`).
+ *
+ * ── Why it came back, 2026-09-23 (task 265) ─────────────────────────────────
+ * `serve.ts` once recorded that request metrics were GONE, on the grounds that the
+ * console that read them was in the retired generation. Station reads them now, and
+ * a measurement found that all eight apps recorded nothing while their
+ * `metrics.sqlite` files — the RETIRED instances' history, inherited at graduation —
+ * rendered as a corpus that had simply gone quiet. This mounts `cursedbelt-server`'s
+ * own seam (`requestLogger` through `createTelemetrySink`, the modules the Worker-safe
+ * `cursedbelt-server/telemetry` leaf re-exports).
+ *
+ * ── 🔴 The inherited file is ARCHIVED, never written ────────────────────────
+ * The file already at `metrics.sqlite` on the live machine is a previous
+ * generation's history under a different schema (`id INTEGER AUTOINCREMENT` plus
+ * `ip`/`country`/`city`/`device`/`form`; this writer inserts `id TEXT` plus
+ * `user_id`). Appending to it would make every future measurement unreadable, so
+ * {@link retireInheritedCorpus} runs at every boot, BEFORE the database is opened:
+ *
+ *   - a file that carries {@link METRICS_APPLICATION_ID} in its header is this
+ *     writer's own, and is left alone — so a second boot is a no-op;
+ *   - anything else is RENAMED, with its `-wal`/`-shm` sidecars, to
+ *     `metrics.retired.sqlite` — or `metrics.retired-2.sqlite`, `-3`, … when that
+ *     name is taken, so two inherited corpora are both kept and nothing is ever
+ *     overwritten. A rename touches no byte of the file, which is the point.
+ *
+ * The marker lives in the SQLite header (`PRAGMA application_id`, offset 68) so it
+ * can be read without opening the database — opening an inherited WAL database
+ * read-write would checkpoint into it on close, which IS writing into it. The
+ * migration checkpoints after stamping it, so the marker is on disk before the
+ * first request is recorded and a crash cannot leave a fresh corpus that the next
+ * boot mistakes for an inherited one.
+ *
+ * ── 🔴 No user id, ever ─────────────────────────────────────────────────────
+ * `cursedbelt-server/engagement`'s header states the split: `metrics/` promises it
+ * holds NO user id, in every app; `engagement.sqlite` is the user-keyed store. The
+ * writer's schema has a `user_id` column and `requestLogger` fills it from
+ * `c.get("userId")`, so the sink here nulls it on every event — whatever any future
+ * middleware puts on the context — and the logger is given no database of its own,
+ * which means it writes no `event_logs` rows either (those carry a `user_id` too,
+ * and nothing in this generation reads them).
+ *
+ * ── Never takes the app down ────────────────────────────────────────────────
+ * {@link openRequestMetricsFromEnv} catches everything and says so on stderr: an
+ * app that cannot record its traffic must still SERVE it. What catches an app that
+ * silently STOPS recording is `requestMetrics.test.ts`, which drives `/healthz`
+ * through a real server and fails when no row lands — `requestMetrics.spec.ts` here, and each
+ * app's own test through its own `createServer`.
+ */
+import { Database } from "bun:sqlite";
+import { closeSync, existsSync, mkdirSync, openSync, readSync, renameSync, statSync } from "node:fs";
+import { join } from "node:path";
+import { applyCcPragmas } from "cwip/sqlite";
+import { createTelemetrySink } from "../metrics/telemetrySink.js";
+import { requestLogger } from "../middleware/requestLogger.js";
+import { runMigrations } from "../migration/runner.js";
+import { isTestRuntime } from "../satellite/door.js";
+/** The file station reads, inside the app's data directory. */
+export const METRICS_DB = "metrics.sqlite";
+/** Where an inherited corpus is moved to — the first free of this and `metrics.retired-<n>.sqlite`. */
+export const RETIRED_METRICS_DB = "metrics.retired.sqlite";
+/** `PRAGMA application_id` of a corpus THIS writer created: "CFRM", cursedforge request metrics. */
+const METRICS_APPLICATION_ID = 0x4346524d;
+const SIDECARS = ["-wal", "-shm", "-journal"];
+/**
+ * The writer's own schema — the columns `cursedbelt-server`'s `metricsBuffer`
+ * inserts, and the ones station's reader asks for (`ts`, `method`, `route`,
+ * `status`, `duration_ms`, `bytes_out`). Append-only: a migration, once applied,
+ * never changes.
+ */
+const REQUEST_METRICS_MIGRATIONS = [
+    {
+        name: "0001_request_metrics",
+        up(db) {
+            db.run(`PRAGMA application_id = ${METRICS_APPLICATION_ID}`);
+            db.run(`CREATE TABLE request_metrics (
+				id TEXT PRIMARY KEY, ts INTEGER NOT NULL, method TEXT, route TEXT,
+				status INTEGER, duration_ms REAL, bytes_out INTEGER, user_id TEXT)`);
+            db.run("CREATE INDEX idx_request_metrics_ts ON request_metrics (ts)");
+        },
+    },
+];
+/** The `application_id` stamped in a SQLite file's header, or null when it has no header yet. */
+function headerApplicationId(path) {
+    const fd = openSync(path, "r");
+    try {
+        const header = Buffer.alloc(72);
+        if (readSync(fd, header, 0, 72, 0) < 72)
+            return null;
+        return header.readUInt32BE(68);
+    }
+    finally {
+        closeSync(fd);
+    }
+}
+const sizeOf = (path) => (existsSync(path) ? statSync(path).size : 0);
+/**
+ * Move an inherited `metrics.sqlite` out of the way, or do nothing. Returns the
+ * path it was archived to, or null when there was nothing to archive. See the
+ * header: never writes a byte of the file, never overwrites anything, idempotent.
+ */
+export function retireInheritedCorpus(dir) {
+    const live = join(dir, METRICS_DB);
+    if (!existsSync(live))
+        return null;
+    // An empty file with no journal holds nothing — SQLite simply initialises it.
+    if (sizeOf(live) === 0 && SIDECARS.every((s) => sizeOf(live + s) === 0))
+        return null;
+    if (headerApplicationId(live) === METRICS_APPLICATION_ID)
+        return null;
+    const present = SIDECARS.filter((s) => existsSync(live + s));
+    let target = join(dir, RETIRED_METRICS_DB);
+    for (let n = 2; existsSync(target) || present.some((s) => existsSync(target + s)); n++) {
+        target = join(dir, RETIRED_METRICS_DB.replace(/\.sqlite$/, `-${n}.sqlite`));
+    }
+    // Sidecars FIRST, then the database: a crash between the two leaves the database
+    // where the next boot finds it again, and — because a moved sidecar is no longer
+    // at the source — the loop above picks this same `target`, so the pair is rejoined.
+    for (const s of present)
+        renameSync(live + s, target + s);
+    renameSync(live, target);
+    return target;
+}
+/** Retire any inherited corpus, then open (creating if need be) this writer's own. */
+function openMetricsDb(dir) {
+    mkdirSync(dir, { recursive: true });
+    const archived = retireInheritedCorpus(dir);
+    const db = new Database(join(dir, METRICS_DB), { create: true });
+    applyCcPragmas(db);
+    if (runMigrations(db, REQUEST_METRICS_MIGRATIONS).length > 0) {
+        // Put the header marker in the main file now, not at some later checkpoint.
+        db.run("PRAGMA wal_checkpoint(TRUNCATE)");
+    }
+    return { db, archived };
+}
+/** Open the corpus in `dir` and build the logger that writes into it. */
+export function openRequestMetrics(dir) {
+    const { db, archived } = openMetricsDb(dir);
+    const inner = createTelemetrySink({ db });
+    // 🔴 No user id — see the header. Nulled here so no context value can reach the row.
+    const sink = {
+        record: (event) => inner.record({ ...event, userId: null }),
+        flush: () => inner.flush(),
+        stop: () => inner.stop(),
+        get size() {
+            return inner.size;
+        },
+    };
+    // `null` database: the logger writes through `sink` only, and no `event_logs`.
+    const middleware = requestLogger(null, { sink });
+    return { db, sink, middleware, archived };
+}
+/**
+ * The request log for a DEPLOYED instance, or null. Deployed means `APP_DATA_DIR`
+ * is set (the launchd plist sets it) and no test runner is in charge. A dev shell
+ * records nothing rather than appending a developer's clicks to the live corpus.
+ * Never throws: a failure is one stderr line and an app that serves unmeasured.
+ */
+export function openRequestMetricsFromEnv(name, env) {
+    const dir = env.APP_DATA_DIR?.trim();
+    if (!dir || isTestRuntime(env))
+        return null;
+    try {
+        const metrics = openRequestMetrics(dir);
+        if (metrics.archived) {
+            console.log(`[${name}] request metrics: archived the inherited corpus to ${metrics.archived}`);
+        }
+        return metrics;
+    }
+    catch (error) {
+        console.error(`[${name}] request metrics disabled: ${error instanceof Error ? error.message : String(error)}`);
+        return null;
+    }
+}

package/dist/server/ws/hub.js

@@ -116,8 +116,13 @@ export function createWsHub(opts) {
                 const client = clientFromWs(ws);
                 if (!client)
                     return;
-                channelOf(client.channel)?.onDisconnect?.(client, hub);
+                // 🔴 Remove FIRST, then tell the channel. The recipe every presence app follows is
+                // "broadcast hub.getPresence(channel) from onDisconnect" (cursedbelt's usePresence doc),
+                // and until 4.20.1 this called onDisconnect while the leaver was still registered — so
+                // the roster it broadcast still listed the person who had just left. apps/roms deferred a
+                // microtask to work around it (src/server/presence.ts). hub.spec.ts pins the order.
                 clients.delete(client.id);
+                channelOf(client.channel)?.onDisconnect?.(client, hub);
             },
         },
         broadcast(channel, event, data) {

package/dist/server/ws/types.d.ts

@@ -61,7 +61,8 @@ export interface WsChannel<TMsg = WsMessage> {
     onConnect?(client: WsClient, hub: WsHub): void;
     /** Fired once per inbound frame (the parsed `{ event, data }` envelope). */
     onMessage(client: WsClient, msg: TMsg, hub: WsHub): void;
-    /** Fired when the socket closes (explicit, stale-culled, or peer-dropped). */
+    /** Fired when the socket closes (explicit, stale-culled, or peer-dropped) — AFTER the client is
+     *  removed, so `hub.getPresence()` here is the roster without it (4.20.1). */
     onDisconnect?(client: WsClient, hub: WsHub): void;
     /** Whether this channel contributes to {@link WsHub.getPresence}. Default: false. */
     presence?: boolean;

package/dist/subpathReach.js

@@ -55,4 +55,6 @@ export const MAY_NEED_BUN = {
     // The engagement store IS `engagement.sqlite` on the Mac (4.19.0, task 280) — the recorder
     // runs where the app's own database is. A Worker app records nothing until it has a D1 store.
     './engagement': ['bun:sqlite'],
+    // The request log IS `metrics.sqlite` beside the app's data (4.21.0) — a Mac-hosted server's.
+    './request-log': ['bun:sqlite'],
 };

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "cursedbelt-server",
-	"version": "4.20.0",
+	"version": "4.22.0",
 	"license": "ISC",
 	"type": "module",
 	"description": "The app-facing Bun/Hono server tier of the cursedbelt split — storage, sharing, activity, guard, sync. React-free; cursedbelt-core below it.",
@@ -213,6 +213,12 @@
 			"types": "./dist/server/auth/passwordCost.d.ts",
 			"bun": "./src/server/auth/passwordCost.ts",
 			"source": "./src/server/auth/passwordCost.ts",
+			"import": "./dist/server/auth/passwordCost.js"
+		},
+		"./request-log": {
+			"types": "./dist/server/requestLog/requestMetrics.d.ts",
+			"bun": "./src/server/requestLog/requestMetrics.ts",
+			"source": "./src/server/requestLog/requestMetrics.ts",
 			"import": "./dist/server/_bunOnly.js"
 		},
 		"./notifications": {
@@ -296,7 +302,7 @@
 	},
 	"dependencies": {
 		"cursedbelt-core": "^2.1.1",
-		"cursedops": "^0.5.2",
+		"cursedops": "^0.6.0",
 		"cwip": "^4.6.0",
 		"jose": "^6.2.3"
 	},

package/src/server/d1/localBackup.ts

@@ -145,7 +145,11 @@ export {
 	backupTables,
 	chooseBackupSource,
 	type PullD1Options,
+	insertLines,
 	pullD1ToSqlite,
 	servedRuntime,
+	spawnWrangler,
+	stripTrailingNuls,
 	type Wrangler,
+	wranglerArgv,
 } from './pullD1.js';

package/src/server/d1/pullD1.spec.ts

@@ -1,9 +1,17 @@
 import { Database } from 'bun:sqlite';
 import { afterEach, describe, expect, test } from 'bun:test';
-import { mkdtempSync, rmSync, writeFileSync } from 'node:fs';
+import { existsSync, mkdtempSync, readdirSync, readFileSync, rmSync, writeFileSync } from 'node:fs';
 import { tmpdir } from 'node:os';
 import { join } from 'node:path';
-import { backupTables, chooseBackupSource, pullD1ToSqlite, servedRuntime, type Wrangler } from './localBackup.js';
+import {
+	backupTables,
+	chooseBackupSource,
+	pullD1ToSqlite,
+	servedRuntime,
+	stripTrailingNuls,
+	type Wrangler,
+	wranglerArgv,
+} from './localBackup.js';
 
 const dirs: string[] = [];
 const scratch = (): string => {
@@ -198,6 +206,58 @@ describe('pulling D1 down — table by table, because a whole-database export re
 		await expect(pull(dir, run)).rejects.toThrow(/--table meta failed/);
 	});
 
+	test("🔴 bun:sqlite's exec stops at a NUL with no error — the defect, pinned (task 2128)", () => {
+		const db = new Database(':memory:');
+		db.exec('CREATE TABLE t (v TEXT)');
+		db.exec("INSERT INTO t VALUES('a');\n\0\0\nINSERT INTO t VALUES('lost');");
+		expect((db.query('SELECT COUNT(*) AS n FROM t').get() as { n: number }).n).toBe(1);
+		db.close();
+	});
+
+	test('🔴 a NUL-padded export still loads EVERY table (vault, 2026-09-23: vault_keys came back empty)', async () => {
+		const dir = scratch();
+		const { run } = fake((table) =>
+			table === 'items'
+				? `INSERT INTO items (id, name) VALUES ('itm_1', 'a');\n${'\0'.repeat(988)}`
+				: table === 'meta'
+					? "INSERT INTO meta (key, value) VALUES ('k', 'v');\nINSERT INTO meta (key, value) VALUES ('k2', 'v2');"
+					: '',
+		);
+		await pull(dir, run);
+		const db = new Database(join(dir, 'pulled.sqlite'), { readonly: true });
+		expect((db.query('SELECT COUNT(*) AS n FROM meta').get() as { n: number }).n).toBe(2);
+		db.close();
+	});
+
+	test('🔴 a load SHORT of its dump — whatever truncated it — is refused, and leaves no snapshot', async () => {
+		const dir = scratch();
+		// A NUL INSIDE the SQL (not trailing, so not stripped) ends the exec mid-table.
+		const { run } = fake((table) =>
+			table === 'items' ? "INSERT INTO items (id) VALUES ('a');\n\0\nINSERT INTO items (id) VALUES ('b');" : '',
+		);
+		await expect(pull(dir, run)).rejects.toThrow(/items: 1 of 2/);
+		expect(existsSync(join(dir, 'pulled.sqlite'))).toBe(false);
+	});
+
+	test('the per-table dumps are deleted — on success AND on a refusal', async () => {
+		const dir = scratch();
+		const { run } = fake((table) => (table === 'items' ? "INSERT INTO items (id) VALUES ('a');" : ''));
+		await pull(dir, run);
+		expect(readdirSync(dir).filter((f) => f.endsWith('.sql'))).toEqual([]);
+		const bad = fake((table) => (table === 'meta' ? null : "INSERT INTO items (id) VALUES ('x');"));
+		await expect(pull(scratch(), bad.run)).rejects.toThrow();
+	});
+
+	test('stripTrailingNuls strips only TRAILING NULs; wranglerArgv is this bun, never a bare bunx', () => {
+		const dir = scratch();
+		const f = join(dir, 'x.sql');
+		writeFileSync(f, 'a\0b\0\0\0');
+		expect(stripTrailingNuls(f)).toBe(3);
+		expect(readFileSync(f, 'utf8')).toBe('a\0b');
+		expect(stripTrailingNuls(f)).toBe(0);
+		expect(wranglerArgv('/x/bun')).toEqual(['/x/bun', 'x', 'wrangler']);
+	});
+
 	test('🔴 an export with no rows at all THROWS — never an empty library dated today', async () => {
 		const dir = scratch();
 		const { run } = fake(() => '');

package/src/server/d1/pullD1.ts

@@ -28,7 +28,7 @@
  */
 
 import { Database } from 'bun:sqlite';
-import { existsSync, readFileSync } from 'node:fs';
+import { existsSync, readFileSync, rmSync, writeFileSync } from 'node:fs';
 
 export type BackupSourceChoice = { kind: 'file' | 'd1' | 'refuse'; why: string };
 
@@ -103,6 +103,49 @@ const EXPORT_ATTEMPTS = 3;
 /** One `wrangler` invocation, as {@link pullD1ToSqlite} needs it. Injected so a spec runs none. */
 export type Wrangler = (args: string[]) => { code: number; stdout: string; stderr: string };
 
+/**
+ * The argv that runs `wrangler`: THIS bun binary's `x`, never a bare `bunx` — a launchd job's
+ * PATH has no `bunx` (task 2112), and vault's and patterns' nightly backups each carried this
+ * line until 4.22.0.
+ */
+export const wranglerArgv = (bun: string = process.execPath): string[] => [bun, 'x', 'wrangler'];
+
+/** The real {@link Wrangler}: `bun x wrangler …` in `cwd`, with `env` added to this process's. */
+export function spawnWrangler(options: { cwd: string; env?: Record<string, string | undefined> }): Wrangler {
+	return (args) => {
+		const r = Bun.spawnSync([...wranglerArgv(), ...args], {
+			cwd: options.cwd,
+			env: { ...process.env, ...options.env },
+			stdout: 'pipe',
+			stderr: 'pipe',
+		});
+		return { code: r.exitCode ?? 1, stdout: r.stdout.toString(), stderr: r.stderr.toString() };
+	};
+}
+
+/**
+ * 🔴 Trailing NUL bytes off a `wrangler d1 export` file, in place. Returns how many were removed.
+ *
+ * Measured 2026-09-23 on vault's D1 (wrangler 4.136.3): `wrangler d1 export --table … --output`
+ * INTERMITTENTLY ends the file in hundreds of NUL bytes (`entries` +988, `oplog` +1,369, `sync_ops`
+ * +5,476 across three runs — a different table each time, always trailing). `bun:sqlite`'s `exec`
+ * reads SQL as a C string, so the first NUL silently ended the load: every table after it came back
+ * EMPTY with no error, and vault's real backup held `vault_keys` = 0 rows (task 2128). Only
+ * TRAILING bytes: a NUL inside the SQL is a different fault, and the row-count check refuses it.
+ */
+export function stripTrailingNuls(file: string): number {
+	if (!existsSync(file)) return 0;
+	const bytes = readFileSync(file);
+	let end = bytes.length;
+	while (end > 0 && bytes[end - 1] === 0) end--;
+	if (end === bytes.length) return 0;
+	writeFileSync(file, bytes.subarray(0, end));
+	return bytes.length - end;
+}
+
+/** `^INSERT INTO ` lines — one per row in a `wrangler d1 export --no-schema` dump. */
+export const insertLines = (dump: string): number => (dump.match(/^INSERT INTO /gm) ?? []).length;
+
 /**
  * The tables a snapshot carries, from D1's own `sqlite_master` rows — every real table, and
  * none of what cannot or must not be re-inserted: a virtual table and its shadows (`_config`,
@@ -161,51 +204,77 @@ export async function pullD1ToSqlite(options: PullD1Options): Promise<void> {
 	}
 
 	let sql = '';
-	for (const table of tables) {
-		const dump = `${destination}.${table}.sql`;
-		// 🔴 `wrangler d1 export` has been measured answering SUCCESS and writing no file —
-		// collections' nightly of 2026-09-23T15:35Z refused on `derivative_retries`, and the same
-		// command wrote the file (32 bytes, an empty table) an hour later. So a missing file is
-		// asked for again, twice, before it is a refusal; a failure that persists still refuses,
-		// because a snapshot missing a table is not a backup.
-		let exported = { code: 1, stdout: '', stderr: 'not attempted' };
-		for (let attempt = 1; attempt <= EXPORT_ATTEMPTS; attempt++) {
-			exported = wrangler(['d1', 'export', database, '--remote', '--env=', '--table', table, '--no-schema', '--output', dump, '-y']);
-			if (exported.code !== 0 || existsSync(dump)) break;
+	const dumps: { table: string; text: string }[] = [];
+	try {
+		for (const table of tables) {
+			const dump = `${destination}.${table}.sql`;
+			// 🔴 `wrangler d1 export` has been measured answering SUCCESS and writing no file —
+			// collections' nightly of 2026-09-23T15:35Z refused on `derivative_retries`, and the same
+			// command wrote the file (32 bytes, an empty table) an hour later. So a missing file is
+			// asked for again, twice, before it is a refusal; a failure that persists still refuses,
+			// because a snapshot missing a table is not a backup.
+			let exported = { code: 1, stdout: '', stderr: 'not attempted' };
+			for (let attempt = 1; attempt <= EXPORT_ATTEMPTS; attempt++) {
+				exported = wrangler(['d1', 'export', database, '--remote', '--env=', '--table', table, '--no-schema', '--output', dump, '-y']);
+				if (exported.code !== 0 || existsSync(dump)) break;
+			}
+			if (exported.code !== 0) {
+				throw new Error(`wrangler d1 export --table ${table} failed: ${exported.stderr.trim() || exported.stdout.trim()}`);
+			}
+			if (!existsSync(dump)) {
+				throw new Error(
+					`wrangler d1 export --table ${table} reported success ${EXPORT_ATTEMPTS} times and wrote no file at ${dump}`,
+				);
+			}
+			stripTrailingNuls(dump);
+			const text = readFileSync(dump, 'utf8');
+			dumps.push({ table, text });
+			sql += `${text}\n`;
 		}
-		if (exported.code !== 0) {
-			throw new Error(`wrangler d1 export --table ${table} failed: ${exported.stderr.trim() || exported.stdout.trim()}`);
+		if (!/INSERT INTO/i.test(sql)) {
+			throw new Error('the D1 export contains no rows — refusing to snapshot an empty database as if it were the library');
 		}
-		if (!existsSync(dump)) {
-			throw new Error(
-				`wrangler d1 export --table ${table} reported success ${EXPORT_ATTEMPTS} times and wrote no file at ${dump}`,
-			);
-		}
-		sql += `${readFileSync(dump, 'utf8')}\n`;
-	}
-	if (!/INSERT INTO/i.test(sql)) {
-		throw new Error('the D1 export contains no rows — refusing to snapshot an empty database as if it were the library');
-	}
 
-	const db = new Database(destination, { create: true });
-	try {
-		// `exec`, not `run`: each is many statements and `run` would execute only the first,
-		// leaving a file with a schema and no rows that looks perfectly valid.
-		db.exec(options.schemaSql);
-		// 🔴 A table D1 holds that the schema does not declare is created from D1's OWN DDL, never
-		// dropped: measured on music's first post-cutover pull (2026-09-23), `art_lookups` — a
-		// cache its art job creates where it first needs it — made the whole pull refuse with
-		// `no such table`, because its rows were exported and its table was not in the schema.
-		const have = new Set(
-			(db.query("SELECT name FROM sqlite_master WHERE type = 'table'").all() as { name: string }[]).map((r) => r.name),
-		);
-		for (const row of rows) {
-			if (!tables.includes(row.name) || have.has(row.name) || !row.sql) continue;
-			db.exec(row.sql.replace(/^\s*CREATE\s+TABLE\s+(?!IF\s+NOT\s+EXISTS)/i, 'CREATE TABLE IF NOT EXISTS '));
+		const db = new Database(destination, { create: true });
+		try {
+			// `exec`, not `run`: each is many statements and `run` would execute only the first,
+			// leaving a file with a schema and no rows that looks perfectly valid.
+			db.exec(options.schemaSql);
+			// 🔴 A table D1 holds that the schema does not declare is created from D1's OWN DDL, never
+			// dropped: measured on music's first post-cutover pull (2026-09-23), `art_lookups` — a
+			// cache its art job creates where it first needs it — made the whole pull refuse with
+			// `no such table`, because its rows were exported and its table was not in the schema.
+			const have = new Set(
+				(db.query("SELECT name FROM sqlite_master WHERE type = 'table'").all() as { name: string }[]).map((r) => r.name),
+			);
+			for (const row of rows) {
+				if (!tables.includes(row.name) || have.has(row.name) || !row.sql) continue;
+				db.exec(row.sql.replace(/^\s*CREATE\s+TABLE\s+(?!IF\s+NOT\s+EXISTS)/i, 'CREATE TABLE IF NOT EXISTS '));
+			}
+			// One table at a time, so a fault is located rather than smeared over the whole load.
+			for (const { text } of dumps) if (text.trim()) db.exec(text);
+			if (options.afterLoadSql) db.exec(options.afterLoadSql);
+			// 🔴 Every table holds as many rows as its dump has INSERTs, or this is not a backup: the
+			// check that makes a silently truncated load — the NUL padding, or whatever does it next —
+			// a REFUSAL. A row count only; nothing here reads what the rows hold.
+			const short: string[] = [];
+			for (const { table, text } of dumps) {
+				if (table === 'sqlite_sequence') continue;
+				const expected = insertLines(text);
+				const loaded = (db.query(`SELECT COUNT(*) AS n FROM "${table.replaceAll('"', '""')}"`).get() as { n: number }).n;
+				if (loaded < expected) short.push(`${table}: ${loaded} of ${expected}`);
+			}
+			if (short.length > 0) {
+				db.close();
+				rmSync(destination, { force: true });
+				throw new Error(`the D1 pull did not load every exported row — ${short.join('; ')}. Refusing the snapshot.`);
+			}
+		} finally {
+			db.close();
 		}
-		db.exec(sql);
-		if (options.afterLoadSql) db.exec(options.afterLoadSql);
 	} finally {
-		db.close();
+		// The per-table dumps are a second, unmanaged copy of the data that no retention rule
+		// would ever delete — eighteen were found beside vault's snapshot (task 2128).
+		for (const table of tables) rmSync(`${destination}.${table}.sql`, { force: true });
 	}
 }

package/src/server/master-lock/accountsPage.ts

@@ -33,7 +33,7 @@
  * only be watching one of them.
  */
 import { MASTER_LOCK_PATHS, MASTER_LOCK_PREFIX } from "cursedbelt-core/master-lock";
-import { MASTER_LOCK_DERIVE_SOURCE, type LockPageOptions } from "./lockPage.js";
+import { MASTER_LOCK_DERIVE_SOURCE, MASTER_LOCK_REVEAL_SOURCE, type LockPageOptions, withRevealToggles } from "./lockPage.js";
 
 /**
  * The page's own two assets.
@@ -67,7 +67,7 @@ export const MASTER_LOCK_MIN_PASSWORD_LENGTH = 10;
 export function accountsPageHtml(options: LockPageOptions): string {
 	const label = escapeHtml(options.appLabel);
 	const min = MASTER_LOCK_MIN_PASSWORD_LENGTH;
-	return `<!doctype html>
+	return withRevealToggles(`<!doctype html>
 <html lang="en">
 <head>
 <meta charset="utf-8">
@@ -164,7 +164,7 @@ export function accountsPageHtml(options: LockPageOptions): string {
 <script type="module" src="${MASTER_LOCK_ACCOUNTS_PAGE_PATHS.script}"></script>
 </body>
 </html>
-`;
+`);
 }
 
 /**
@@ -222,6 +222,10 @@ const MIN_LENGTH = ${MASTER_LOCK_MIN_PASSWORD_LENGTH};
 // ── derivation ───────────────────────────────────────────────────────────────
 ${MASTER_LOCK_DERIVE_SOURCE}
 
+// ── show / hide ──────────────────────────────────────────────────────────────
+${MASTER_LOCK_REVEAL_SOURCE}
+wireMasterLockReveal(document);
+
 const rotateForm = document.getElementById("ml-rotate");
 const addForm = document.getElementById("ml-add");
 const list = document.getElementById("ml-accounts");

package/src/server/master-lock/lockPage.spec.ts

@@ -13,8 +13,16 @@
  */
 import { describe, expect, test } from "bun:test";
 import { MASTER_LOCK_PATHS, type MasterLockKdfParams, deriveMasterLockVerifier } from "cursedbelt-core/master-lock";
-import { MASTER_LOCK_ACCOUNTS_SCRIPT } from "./accountsPage.js";
-import { LOCK_SCRIPT, LOCK_STYLE, MASTER_LOCK_DERIVE_SOURCE, lockPageHtml } from "./lockPage.js";
+import { accountsPageHtml, MASTER_LOCK_ACCOUNTS_SCRIPT } from "./accountsPage.js";
+import { MASTER_LOCK_CSP } from "./guard.js";
+import {
+	LOCK_SCRIPT,
+	LOCK_STYLE,
+	MASTER_LOCK_DERIVE_SOURCE,
+	MASTER_LOCK_REVEAL_SOURCE,
+	lockPageHtml,
+	withRevealToggles,
+} from "./lockPage.js";
 
 const KDF: MasterLockKdfParams = {
 	v: 1,
@@ -90,3 +98,55 @@ describe("the page itself", () => {
 		expect(LOCK_STYLE).not.toContain("@import");
 	});
 });
+
+describe("🔴 every password field on the wall can be shown and hidden (task 077-438)", () => {
+	const pages = {
+		"lock (unlock)": lockPageHtml({ appLabel: "Vault" }),
+		"lock (enroll)": lockPageHtml({ appLabel: "Vault", enroll: true }),
+		accounts: accountsPageHtml({ appLabel: "Vault" }),
+	};
+
+	for (const [name, html] of Object.entries(pages)) {
+		test(`${name}: one Show control per password input, each input keeping its autocomplete`, () => {
+			const inputs = [...html.matchAll(/<input\b[^>]*\btype="password"[^>]*>/g)].map((m) => m[0]);
+			expect(inputs.length).toBeGreaterThan(0);
+			expect((html.match(/data-reveal/g) ?? []).length).toBe(inputs.length);
+			for (const input of inputs) expect(input).toMatch(/autocomplete="(current|new)-password"/);
+			// …and still no inline script: the behaviour ships in the same-origin file.
+			expect(html).not.toMatch(/<script(?![^>]*\bsrc=)[^>]*>/);
+		});
+	}
+
+	test("both served scripts carry the ONE reveal source and call it", () => {
+		for (const script of [LOCK_SCRIPT, MASTER_LOCK_ACCOUNTS_SCRIPT]) {
+			expect(script).toContain(MASTER_LOCK_REVEAL_SOURCE);
+			expect(script).toContain("wireMasterLockReveal(document);");
+		}
+	});
+
+	test("clicking shows, clicking again hides, and a submit returns the field to a password", () => {
+		document.body.innerHTML = withRevealToggles(
+			'<form><input type="password" name="p" autocomplete="current-password"><button type="submit">Go</button></form>',
+		);
+		const wire = new Function(`${MASTER_LOCK_REVEAL_SOURCE}\nreturn globalThis.wireMasterLockReveal;`)() as (d: Document) => number;
+		expect(wire(document)).toBe(1);
+		const input = document.querySelector("input") as HTMLInputElement;
+		const button = document.querySelector("[data-reveal]") as HTMLButtonElement;
+		button.click();
+		expect(input.type).toBe("text");
+		expect(button.getAttribute("aria-pressed")).toBe("true");
+		expect(button.getAttribute("aria-label")).toBe("Hide password");
+		button.click();
+		expect(input.type).toBe("password");
+		button.click();
+		(document.querySelector("form") as HTMLFormElement).dispatchEvent(new Event("submit", { cancelable: true }));
+		expect(input.type).toBe("password");
+		expect(button.type).toBe("button"); // never submits the form itself
+	});
+
+	test("🔴 the CSP is unchanged — still no inline script and nothing off-origin", () => {
+		expect(MASTER_LOCK_CSP).toContain("script-src 'self'");
+		expect(MASTER_LOCK_CSP).not.toContain("unsafe-inline");
+		expect(MASTER_LOCK_CSP).not.toMatch(/nonce-|sha256-/);
+	});
+});