cursedbelt-server 4.21.0 → 4.23.0

package/dist/server/bench/budget.d.ts

@@ -74,6 +74,47 @@ export declare const DAYS_PER_MONTH = 30.4375;
  * the default may never drift ABOVE the measured allowance without a red build.
  */
 export declare const MEASURED_FLEET_REQUESTS_PER_DAY = 42971;
+/**
+ * 🔴 The WORKER re-derivation — 2026-09-23 (task 083, bullet 3). Cloudflare's own numbers,
+ * not a proxy: the account's `workersInvocationsAdaptive` dataset (GraphQL Analytics API,
+ * `sum { requests cpuTimeUs }` by `scriptName`) over the seven whole days
+ * 2026-09-16T00:00Z → 2026-09-23T00:00Z, while `patterns` (since 09-18) and `collections`
+ * (since 09-22) served from Workers:
+ *
+ * ```
+ * script                    requests    billed CPU-ms   mean
+ * binary-server-edge-gate    754,974       1,805,750    2.39
+ * collections                    350         171,228  489.2   (09-22: p99 15.2 s — one-off imports)
+ * collections-stage               61          96,081   1575    (stage: seeding and gate runs)
+ * patterns                       424          12,718   30.0    (09-18: p99 2.9 s, first boot)
+ * 3 others                       196             126
+ * ACCOUNT                    756,005       2,085,903    2.76  →  108,001 req/day, 9.07 M CPU-ms/month (30 %)
+ * ```
+ *
+ * **What the call says.** `deriveCpuBudgetMs({ requestsPerDay: 108_001 })` = **9.1**, i.e.
+ * BELOW the shipped 9.9 — the account already carries more requests than the owner's
+ * 100,000/day projection. **The default did not move, and this is why:** 99.9 % of those
+ * requests are the binary server's edge gate, a fixed-cost auth check at 2.39 CPU-ms mean
+ * that no app route budget governs. Averaging them in hands the app routes an allowance
+ * those requests never use. The question the default answers is what an APP request may
+ * spend once the measured non-app spend is set aside:
+ * `deriveCpuBudgetMs({ requestsPerDay: MEASURED_FLEET_REQUESTS_PER_DAY, reservedCpuMsPerMonth: edge gate })`
+ * = **16.9** CPU-ms — the fleet's whole app traffic (42,971/day, above) on Workers, with the
+ * edge gate still running beside it. 9.9 stays under that with 1.7× headroom, and the
+ * account is at 30 % of its CPU allowance, so there is no evidence for tightening it either.
+ * App-Worker traffic itself (~111/day, mostly agent deploy checks) is too small to derive
+ * anything from yet. `budget.spec.ts` holds both orderings as assertions.
+ */
+export declare const MEASURED_WORKER_TRAFFIC: {
+    readonly from: "2026-09-16T00:00:00Z";
+    readonly until: "2026-09-23T00:00:00Z";
+    readonly days: 7;
+    readonly requests: 756005;
+    readonly cpuMs: 2085903;
+    /** The binary server's edge gate — fixed-cost traffic no app route budget governs. */
+    readonly edgeGateRequests: 754974;
+    readonly edgeGateCpuMs: 1805750;
+};
 /**
  * Derive the average CPU-ms a single request may spend before the fleet exceeds its
  * included CPU allowance.
@@ -90,6 +131,12 @@ export declare function deriveCpuBudgetMs(opts?: {
     requestsPerMonth?: number;
     /** Measured (or projected) requests per day — converted with {@link DAYS_PER_MONTH}. */
     requestsPerDay?: number;
+    /**
+     * CPU-ms per month already spent by traffic OUTSIDE the budgeted routes (measured —
+     * the edge gate in {@link MEASURED_WORKER_TRAFFIC}), taken off the allowance first.
+     * Default: 0.
+     */
+    reservedCpuMsPerMonth?: number;
 }): number;
 /**
  * What a month costs in overage once the included allowances are spent. Used by the
@@ -112,6 +159,9 @@ export declare function monthlyOverageUsd(opts: {
  *
  * 🔴 Deliberately kept BELOW the ~22.9 ms that {@link MEASURED_FLEET_REQUESTS_PER_DAY}
  * derives; that constant says why, and `budget.spec.ts` reddens if the two ever swap.
+ *
+ * Re-derived from WORKER traffic on 2026-09-23 and kept: {@link MEASURED_WORKER_TRAFFIC}
+ * has the numbers (16.9 ms per app request after the edge gate's measured spend).
  */
 export declare const DEFAULT_ROUTE_CPU_BUDGET_MS: number;
 /** A route that is measured against a number. */

package/dist/server/bench/budget.js

@@ -74,6 +74,47 @@ export const DAYS_PER_MONTH = 30.4375;
  * the default may never drift ABOVE the measured allowance without a red build.
  */
 export const MEASURED_FLEET_REQUESTS_PER_DAY = 42_971;
+/**
+ * 🔴 The WORKER re-derivation — 2026-09-23 (task 083, bullet 3). Cloudflare's own numbers,
+ * not a proxy: the account's `workersInvocationsAdaptive` dataset (GraphQL Analytics API,
+ * `sum { requests cpuTimeUs }` by `scriptName`) over the seven whole days
+ * 2026-09-16T00:00Z → 2026-09-23T00:00Z, while `patterns` (since 09-18) and `collections`
+ * (since 09-22) served from Workers:
+ *
+ * ```
+ * script                    requests    billed CPU-ms   mean
+ * binary-server-edge-gate    754,974       1,805,750    2.39
+ * collections                    350         171,228  489.2   (09-22: p99 15.2 s — one-off imports)
+ * collections-stage               61          96,081   1575    (stage: seeding and gate runs)
+ * patterns                       424          12,718   30.0    (09-18: p99 2.9 s, first boot)
+ * 3 others                       196             126
+ * ACCOUNT                    756,005       2,085,903    2.76  →  108,001 req/day, 9.07 M CPU-ms/month (30 %)
+ * ```
+ *
+ * **What the call says.** `deriveCpuBudgetMs({ requestsPerDay: 108_001 })` = **9.1**, i.e.
+ * BELOW the shipped 9.9 — the account already carries more requests than the owner's
+ * 100,000/day projection. **The default did not move, and this is why:** 99.9 % of those
+ * requests are the binary server's edge gate, a fixed-cost auth check at 2.39 CPU-ms mean
+ * that no app route budget governs. Averaging them in hands the app routes an allowance
+ * those requests never use. The question the default answers is what an APP request may
+ * spend once the measured non-app spend is set aside:
+ * `deriveCpuBudgetMs({ requestsPerDay: MEASURED_FLEET_REQUESTS_PER_DAY, reservedCpuMsPerMonth: edge gate })`
+ * = **16.9** CPU-ms — the fleet's whole app traffic (42,971/day, above) on Workers, with the
+ * edge gate still running beside it. 9.9 stays under that with 1.7× headroom, and the
+ * account is at 30 % of its CPU allowance, so there is no evidence for tightening it either.
+ * App-Worker traffic itself (~111/day, mostly agent deploy checks) is too small to derive
+ * anything from yet. `budget.spec.ts` holds both orderings as assertions.
+ */
+export const MEASURED_WORKER_TRAFFIC = {
+    from: '2026-09-16T00:00:00Z',
+    until: '2026-09-23T00:00:00Z',
+    days: 7,
+    requests: 756_005,
+    cpuMs: 2_085_903,
+    /** The binary server's edge gate — fixed-cost traffic no app route budget governs. */
+    edgeGateRequests: 754_974,
+    edgeGateCpuMs: 1_805_750,
+};
 /**
  * Derive the average CPU-ms a single request may spend before the fleet exceeds its
  * included CPU allowance.
@@ -84,7 +125,11 @@ export const MEASURED_FLEET_REQUESTS_PER_DAY = 42_971;
  * allowed to become the common case.
  */
 export function deriveCpuBudgetMs(opts = {}) {
-    const includedCpuMs = opts.includedCpuMs ?? WORKERS_PAID_INCLUDED_CPU_MS;
+    const reserved = opts.reservedCpuMsPerMonth ?? 0;
+    const includedCpuMs = (opts.includedCpuMs ?? WORKERS_PAID_INCLUDED_CPU_MS) - reserved;
+    if (!(reserved >= 0) || !(includedCpuMs > 0)) {
+        throw new Error(`deriveCpuBudgetMs: reservedCpuMsPerMonth (${reserved}) must be ≥ 0 and leave some allowance`);
+    }
     const requestsPerMonth = opts.requestsPerMonth ??
         (opts.requestsPerDay ?? OWNER_PROJECTED_REQUESTS_PER_DAY) * DAYS_PER_MONTH;
     if (!(requestsPerMonth > 0)) {
@@ -113,6 +158,9 @@ export function monthlyOverageUsd(opts) {
  *
  * 🔴 Deliberately kept BELOW the ~22.9 ms that {@link MEASURED_FLEET_REQUESTS_PER_DAY}
  * derives; that constant says why, and `budget.spec.ts` reddens if the two ever swap.
+ *
+ * Re-derived from WORKER traffic on 2026-09-23 and kept: {@link MEASURED_WORKER_TRAFFIC}
+ * has the numbers (16.9 ms per app request after the edge gate's measured spend).
  */
 export const DEFAULT_ROUTE_CPU_BUDGET_MS = Math.round(deriveCpuBudgetMs() * 10) / 10;
 export function isExemption(b) {

package/dist/server/bench/index.d.ts

@@ -33,7 +33,7 @@
  * alternative is a number that gets quoted as a billing fact.
  */
 export { type AssertCpuBudgetsOpts, assertCpuBudgets, checkCpuBudgets, type CpuViolation, type CpuViolationKind, formatCpuBudgetReport, } from './assert.js';
-export { type CpuBudgetConfig, type CpuBudgetExemption, type CpuBudgetLimit, DAYS_PER_MONTH, DEFAULT_ROUTE_CPU_BUDGET_MS, deriveCpuBudgetMs, isExemption, MEASURED_FLEET_REQUESTS_PER_DAY, monthlyOverageUsd, OWNER_PROJECTED_REQUESTS_PER_DAY, type ResolvedBudget, resolveBudget, type RouteBudget, validateCpuBudgetConfig, WORKERS_PAID_INCLUDED_CPU_MS, WORKERS_PAID_INCLUDED_REQUESTS, WORKERS_PAID_USD_PER_MILLION_CPU_MS, WORKERS_PAID_USD_PER_MILLION_REQUESTS, } from './budget.js';
+export { type CpuBudgetConfig, type CpuBudgetExemption, type CpuBudgetLimit, DAYS_PER_MONTH, DEFAULT_ROUTE_CPU_BUDGET_MS, deriveCpuBudgetMs, isExemption, MEASURED_FLEET_REQUESTS_PER_DAY, MEASURED_WORKER_TRAFFIC, monthlyOverageUsd, OWNER_PROJECTED_REQUESTS_PER_DAY, type ResolvedBudget, resolveBudget, type RouteBudget, validateCpuBudgetConfig, WORKERS_PAID_INCLUDED_CPU_MS, WORKERS_PAID_INCLUDED_REQUESTS, WORKERS_PAID_USD_PER_MILLION_CPU_MS, WORKERS_PAID_USD_PER_MILLION_REQUESTS, } from './budget.js';
 export { type CpuBudgetOpts, cpuBudget } from './cpuBudget.js';
 export { type CpuClock, type CpuSpan, fixedCpuClock, processCpuClock, resolveCpuClock, unavailableCpuClock, workerCpuClock, } from './cpuClock.js';
 export { type CpuBudgetReport, type CpuRecorder, type CpuRecorderOpts, createCpuRecorder, percentile, type RouteCpuStats, } from './recorder.js';

package/dist/server/bench/index.js

@@ -33,7 +33,7 @@
  * alternative is a number that gets quoted as a billing fact.
  */
 export { assertCpuBudgets, checkCpuBudgets, formatCpuBudgetReport, } from './assert.js';
-export { DAYS_PER_MONTH, DEFAULT_ROUTE_CPU_BUDGET_MS, deriveCpuBudgetMs, isExemption, MEASURED_FLEET_REQUESTS_PER_DAY, monthlyOverageUsd, OWNER_PROJECTED_REQUESTS_PER_DAY, resolveBudget, validateCpuBudgetConfig, WORKERS_PAID_INCLUDED_CPU_MS, WORKERS_PAID_INCLUDED_REQUESTS, WORKERS_PAID_USD_PER_MILLION_CPU_MS, WORKERS_PAID_USD_PER_MILLION_REQUESTS, } from './budget.js';
+export { DAYS_PER_MONTH, DEFAULT_ROUTE_CPU_BUDGET_MS, deriveCpuBudgetMs, isExemption, MEASURED_FLEET_REQUESTS_PER_DAY, MEASURED_WORKER_TRAFFIC, monthlyOverageUsd, OWNER_PROJECTED_REQUESTS_PER_DAY, resolveBudget, validateCpuBudgetConfig, WORKERS_PAID_INCLUDED_CPU_MS, WORKERS_PAID_INCLUDED_REQUESTS, WORKERS_PAID_USD_PER_MILLION_CPU_MS, WORKERS_PAID_USD_PER_MILLION_REQUESTS, } from './budget.js';
 export { cpuBudget } from './cpuBudget.js';
 export { fixedCpuClock, processCpuClock, resolveCpuClock, unavailableCpuClock, workerCpuClock, } from './cpuClock.js';
 export { createCpuRecorder, percentile, } from './recorder.js';

package/dist/server/d1/localBackup.d.ts

@@ -82,4 +82,4 @@ export declare function createLocalBackup(opts: LocalBackupOpts): DatabaseBackup
  * a host that genuinely has both.
  */
 export declare function backupFor(flavor: 'local' | 'd1', local: () => LocalBackupOpts, remote: () => TimeTravelOpts): DatabaseBackup;
-export { type BackupSourceChoice, type BackupSourceInput, backupTables, chooseBackupSource, type PullD1Options, pullD1ToSqlite, servedRuntime, type Wrangler, } from './pullD1.js';
+export { type BackupSourceChoice, type BackupSourceInput, backupTables, chooseBackupSource, type PullD1Options, insertLines, pullD1ToSqlite, servedRuntime, spawnWrangler, stripTrailingNuls, type Wrangler, wranglerArgv, } from './pullD1.js';

package/dist/server/d1/localBackup.js

@@ -111,4 +111,4 @@ export function backupFor(flavor, local, remote) {
 // After a Worker cutover the live rows are D1's, and a Mac-hosted backup must pull them down
 // rather than snapshot the frozen file — see `./pullD1.ts`. Here, not in the `./d1` barrel,
 // for the reason this file's header gives: it reaches `bun:sqlite`.
-export { backupTables, chooseBackupSource, pullD1ToSqlite, servedRuntime, } from './pullD1.js';
+export { backupTables, chooseBackupSource, insertLines, pullD1ToSqlite, servedRuntime, spawnWrangler, stripTrailingNuls, wranglerArgv, } from './pullD1.js';

package/dist/server/d1/pullD1.d.ts

@@ -56,6 +56,30 @@ export type Wrangler = (args: string[]) => {
     stdout: string;
     stderr: string;
 };
+/**
+ * The argv that runs `wrangler`: THIS bun binary's `x`, never a bare `bunx` — a launchd job's
+ * PATH has no `bunx` (task 2112), and vault's and patterns' nightly backups each carried this
+ * line until 4.22.0.
+ */
+export declare const wranglerArgv: (bun?: string) => string[];
+/** The real {@link Wrangler}: `bun x wrangler …` in `cwd`, with `env` added to this process's. */
+export declare function spawnWrangler(options: {
+    cwd: string;
+    env?: Record<string, string | undefined>;
+}): Wrangler;
+/**
+ * 🔴 Trailing NUL bytes off a `wrangler d1 export` file, in place. Returns how many were removed.
+ *
+ * Measured 2026-09-23 on vault's D1 (wrangler 4.136.3): `wrangler d1 export --table … --output`
+ * INTERMITTENTLY ends the file in hundreds of NUL bytes (`entries` +988, `oplog` +1,369, `sync_ops`
+ * +5,476 across three runs — a different table each time, always trailing). `bun:sqlite`'s `exec`
+ * reads SQL as a C string, so the first NUL silently ended the load: every table after it came back
+ * EMPTY with no error, and vault's real backup held `vault_keys` = 0 rows (task 2128). Only
+ * TRAILING bytes: a NUL inside the SQL is a different fault, and the row-count check refuses it.
+ */
+export declare function stripTrailingNuls(file: string): number;
+/** `^INSERT INTO ` lines — one per row in a `wrangler d1 export --no-schema` dump. */
+export declare const insertLines: (dump: string) => number;
 /**
  * The tables a snapshot carries, from D1's own `sqlite_master` rows — every real table, and
  * none of what cannot or must not be re-inserted: a virtual table and its shadows (`_config`,

package/dist/server/d1/pullD1.js

@@ -27,7 +27,7 @@
  * (`./http.ts` has the measurement), and a restore must put back what was there.
  */
 import { Database } from 'bun:sqlite';
-import { existsSync, readFileSync } from 'node:fs';
+import { existsSync, readFileSync, rmSync, writeFileSync } from 'node:fs';
 /** Which side a backup must read. Pure, so every branch is testable without a network. */
 export function chooseBackupSource(input) {
     if (input.fromFileFlag) {
@@ -84,6 +84,48 @@ export async function servedRuntime(url, { attempts = 3, sleep = (ms) => new Pro
 }
 /** How many times one table's export is asked for when wrangler says success and writes nothing. */
 const EXPORT_ATTEMPTS = 3;
+/**
+ * The argv that runs `wrangler`: THIS bun binary's `x`, never a bare `bunx` — a launchd job's
+ * PATH has no `bunx` (task 2112), and vault's and patterns' nightly backups each carried this
+ * line until 4.22.0.
+ */
+export const wranglerArgv = (bun = process.execPath) => [bun, 'x', 'wrangler'];
+/** The real {@link Wrangler}: `bun x wrangler …` in `cwd`, with `env` added to this process's. */
+export function spawnWrangler(options) {
+    return (args) => {
+        const r = Bun.spawnSync([...wranglerArgv(), ...args], {
+            cwd: options.cwd,
+            env: { ...process.env, ...options.env },
+            stdout: 'pipe',
+            stderr: 'pipe',
+        });
+        return { code: r.exitCode ?? 1, stdout: r.stdout.toString(), stderr: r.stderr.toString() };
+    };
+}
+/**
+ * 🔴 Trailing NUL bytes off a `wrangler d1 export` file, in place. Returns how many were removed.
+ *
+ * Measured 2026-09-23 on vault's D1 (wrangler 4.136.3): `wrangler d1 export --table … --output`
+ * INTERMITTENTLY ends the file in hundreds of NUL bytes (`entries` +988, `oplog` +1,369, `sync_ops`
+ * +5,476 across three runs — a different table each time, always trailing). `bun:sqlite`'s `exec`
+ * reads SQL as a C string, so the first NUL silently ended the load: every table after it came back
+ * EMPTY with no error, and vault's real backup held `vault_keys` = 0 rows (task 2128). Only
+ * TRAILING bytes: a NUL inside the SQL is a different fault, and the row-count check refuses it.
+ */
+export function stripTrailingNuls(file) {
+    if (!existsSync(file))
+        return 0;
+    const bytes = readFileSync(file);
+    let end = bytes.length;
+    while (end > 0 && bytes[end - 1] === 0)
+        end--;
+    if (end === bytes.length)
+        return 0;
+    writeFileSync(file, bytes.subarray(0, end));
+    return bytes.length - end;
+}
+/** `^INSERT INTO ` lines — one per row in a `wrangler d1 export --no-schema` dump. */
+export const insertLines = (dump) => (dump.match(/^INSERT INTO /gm) ?? []).length;
 /**
  * The tables a snapshot carries, from D1's own `sqlite_master` rows — every real table, and
  * none of what cannot or must not be re-inserted: a virtual table and its shadows (`_config`,
@@ -123,50 +165,82 @@ export async function pullD1ToSqlite(options) {
         throw new Error(`D1 lists no \`${options.requiredTable}\` table (saw: ${rows.map((r) => r.name).join(', ') || 'nothing'})`);
     }
     let sql = '';
-    for (const table of tables) {
-        const dump = `${destination}.${table}.sql`;
-        // 🔴 `wrangler d1 export` has been measured answering SUCCESS and writing no file —
-        // collections' nightly of 2026-09-23T15:35Z refused on `derivative_retries`, and the same
-        // command wrote the file (32 bytes, an empty table) an hour later. So a missing file is
-        // asked for again, twice, before it is a refusal; a failure that persists still refuses,
-        // because a snapshot missing a table is not a backup.
-        let exported = { code: 1, stdout: '', stderr: 'not attempted' };
-        for (let attempt = 1; attempt <= EXPORT_ATTEMPTS; attempt++) {
-            exported = wrangler(['d1', 'export', database, '--remote', '--env=', '--table', table, '--no-schema', '--output', dump, '-y']);
-            if (exported.code !== 0 || existsSync(dump))
-                break;
+    const dumps = [];
+    try {
+        for (const table of tables) {
+            const dump = `${destination}.${table}.sql`;
+            // 🔴 `wrangler d1 export` has been measured answering SUCCESS and writing no file —
+            // collections' nightly of 2026-09-23T15:35Z refused on `derivative_retries`, and the same
+            // command wrote the file (32 bytes, an empty table) an hour later. So a missing file is
+            // asked for again, twice, before it is a refusal; a failure that persists still refuses,
+            // because a snapshot missing a table is not a backup.
+            let exported = { code: 1, stdout: '', stderr: 'not attempted' };
+            for (let attempt = 1; attempt <= EXPORT_ATTEMPTS; attempt++) {
+                exported = wrangler(['d1', 'export', database, '--remote', '--env=', '--table', table, '--no-schema', '--output', dump, '-y']);
+                if (exported.code !== 0 || existsSync(dump))
+                    break;
+            }
+            if (exported.code !== 0) {
+                throw new Error(`wrangler d1 export --table ${table} failed: ${exported.stderr.trim() || exported.stdout.trim()}`);
+            }
+            if (!existsSync(dump)) {
+                throw new Error(`wrangler d1 export --table ${table} reported success ${EXPORT_ATTEMPTS} times and wrote no file at ${dump}`);
+            }
+            stripTrailingNuls(dump);
+            const text = readFileSync(dump, 'utf8');
+            dumps.push({ table, text });
+            sql += `${text}\n`;
         }
-        if (exported.code !== 0) {
-            throw new Error(`wrangler d1 export --table ${table} failed: ${exported.stderr.trim() || exported.stdout.trim()}`);
+        if (!/INSERT INTO/i.test(sql)) {
+            throw new Error('the D1 export contains no rows — refusing to snapshot an empty database as if it were the library');
         }
-        if (!existsSync(dump)) {
-            throw new Error(`wrangler d1 export --table ${table} reported success ${EXPORT_ATTEMPTS} times and wrote no file at ${dump}`);
+        const db = new Database(destination, { create: true });
+        try {
+            // `exec`, not `run`: each is many statements and `run` would execute only the first,
+            // leaving a file with a schema and no rows that looks perfectly valid.
+            db.exec(options.schemaSql);
+            // 🔴 A table D1 holds that the schema does not declare is created from D1's OWN DDL, never
+            // dropped: measured on music's first post-cutover pull (2026-09-23), `art_lookups` — a
+            // cache its art job creates where it first needs it — made the whole pull refuse with
+            // `no such table`, because its rows were exported and its table was not in the schema.
+            const have = new Set(db.query("SELECT name FROM sqlite_master WHERE type = 'table'").all().map((r) => r.name));
+            for (const row of rows) {
+                if (!tables.includes(row.name) || have.has(row.name) || !row.sql)
+                    continue;
+                db.exec(row.sql.replace(/^\s*CREATE\s+TABLE\s+(?!IF\s+NOT\s+EXISTS)/i, 'CREATE TABLE IF NOT EXISTS '));
+            }
+            // One table at a time, so a fault is located rather than smeared over the whole load.
+            for (const { text } of dumps)
+                if (text.trim())
+                    db.exec(text);
+            if (options.afterLoadSql)
+                db.exec(options.afterLoadSql);
+            // 🔴 Every table holds as many rows as its dump has INSERTs, or this is not a backup: the
+            // check that makes a silently truncated load — the NUL padding, or whatever does it next —
+            // a REFUSAL. A row count only; nothing here reads what the rows hold.
+            const short = [];
+            for (const { table, text } of dumps) {
+                if (table === 'sqlite_sequence')
+                    continue;
+                const expected = insertLines(text);
+                const loaded = db.query(`SELECT COUNT(*) AS n FROM "${table.replaceAll('"', '""')}"`).get().n;
+                if (loaded < expected)
+                    short.push(`${table}: ${loaded} of ${expected}`);
+            }
+            if (short.length > 0) {
+                db.close();
+                rmSync(destination, { force: true });
+                throw new Error(`the D1 pull did not load every exported row — ${short.join('; ')}. Refusing the snapshot.`);
+            }
         }
-        sql += `${readFileSync(dump, 'utf8')}\n`;
-    }
-    if (!/INSERT INTO/i.test(sql)) {
-        throw new Error('the D1 export contains no rows — refusing to snapshot an empty database as if it were the library');
-    }
-    const db = new Database(destination, { create: true });
-    try {
-        // `exec`, not `run`: each is many statements and `run` would execute only the first,
-        // leaving a file with a schema and no rows that looks perfectly valid.
-        db.exec(options.schemaSql);
-        // 🔴 A table D1 holds that the schema does not declare is created from D1's OWN DDL, never
-        // dropped: measured on music's first post-cutover pull (2026-09-23), `art_lookups` — a
-        // cache its art job creates where it first needs it — made the whole pull refuse with
-        // `no such table`, because its rows were exported and its table was not in the schema.
-        const have = new Set(db.query("SELECT name FROM sqlite_master WHERE type = 'table'").all().map((r) => r.name));
-        for (const row of rows) {
-            if (!tables.includes(row.name) || have.has(row.name) || !row.sql)
-                continue;
-            db.exec(row.sql.replace(/^\s*CREATE\s+TABLE\s+(?!IF\s+NOT\s+EXISTS)/i, 'CREATE TABLE IF NOT EXISTS '));
+        finally {
+            db.close();
         }
-        db.exec(sql);
-        if (options.afterLoadSql)
-            db.exec(options.afterLoadSql);
     }
     finally {
-        db.close();
+        // The per-table dumps are a second, unmanaged copy of the data that no retention rule
+        // would ever delete — eighteen were found beside vault's snapshot (task 2128).
+        for (const table of tables)
+            rmSync(`${destination}.${table}.sql`, { force: true });
     }
 }

package/dist/server/master-lock/accountsPage.js

@@ -33,7 +33,7 @@
  * only be watching one of them.
  */
 import { MASTER_LOCK_PATHS, MASTER_LOCK_PREFIX } from "cursedbelt-core/master-lock";
-import { MASTER_LOCK_DERIVE_SOURCE } from "./lockPage.js";
+import { MASTER_LOCK_DERIVE_SOURCE, MASTER_LOCK_REVEAL_SOURCE, withRevealToggles } from "./lockPage.js";
 /**
  * The page's own two assets.
  *
@@ -59,7 +59,7 @@ export const MASTER_LOCK_MIN_PASSWORD_LENGTH = 10;
 export function accountsPageHtml(options) {
     const label = escapeHtml(options.appLabel);
     const min = MASTER_LOCK_MIN_PASSWORD_LENGTH;
-    return `<!doctype html>
+    return withRevealToggles(`<!doctype html>
 <html lang="en">
 <head>
 <meta charset="utf-8">
@@ -156,7 +156,7 @@ export function accountsPageHtml(options) {
 <script type="module" src="${MASTER_LOCK_ACCOUNTS_PAGE_PATHS.script}"></script>
 </body>
 </html>
-`;
+`);
 }
 /**
  * The page-specific stylesheet. Loaded AFTER `lock.css` and inheriting every `--ml-*` token
@@ -212,6 +212,10 @@ const MIN_LENGTH = ${MASTER_LOCK_MIN_PASSWORD_LENGTH};
 // ── derivation ───────────────────────────────────────────────────────────────
 ${MASTER_LOCK_DERIVE_SOURCE}
 
+// ── show / hide ──────────────────────────────────────────────────────────────
+${MASTER_LOCK_REVEAL_SOURCE}
+wireMasterLockReveal(document);
+
 const rotateForm = document.getElementById("ml-rotate");
 const addForm = document.getElementById("ml-add");
 const list = document.getElementById("ml-accounts");

package/dist/server/master-lock/lockPage.d.ts

@@ -21,7 +21,26 @@ export interface LockPageOptions {
  */
 export declare function lockPageHtml(options: LockPageOptions): string;
 /** The stylesheet. Follows the viewer's theme and commits to nothing else. */
-export declare const LOCK_STYLE = ":root{color-scheme:light dark;\n  --ml-bg:#f4f5f7;--ml-card:#ffffff;--ml-text:#14171c;--ml-muted:#69707c;--ml-border:#d9dde3;\n  --ml-accent:#1f6feb;--ml-accent-text:#ffffff;--ml-danger:#b42318;\n  --ml-shadow:0 18px 48px rgba(16,18,22,.14)}\n@media (prefers-color-scheme:dark){:root{\n  --ml-bg:#0d0f13;--ml-card:#171a20;--ml-text:#e7eaef;--ml-muted:#8b93a1;--ml-border:#2b3039;\n  --ml-accent:#4f8cf7;--ml-accent-text:#0b0d11;--ml-danger:#f97066;\n  --ml-shadow:0 18px 48px rgba(0,0,0,.55)}}\n*{box-sizing:border-box}\nbody{margin:0;min-height:100vh;display:flex;align-items:center;justify-content:center;padding:24px;\n  background:var(--ml-bg);color:var(--ml-text);\n  font:15px/1.55 ui-sans-serif,system-ui,-apple-system,\"Segoe UI\",sans-serif}\n.card{width:100%;max-width:23rem;background:var(--ml-card);border:1px solid var(--ml-border);\n  border-radius:16px;padding:28px 26px 24px;box-shadow:var(--ml-shadow);text-align:center}\n.glyph{font-size:30px;line-height:1;margin-bottom:10px}\nh1{margin:0 0 6px;font-size:18px;font-weight:650;letter-spacing:-.01em}\n.note{margin:0 0 20px;font-size:13px;color:var(--ml-muted)}\n.field{display:block;text-align:left;margin-bottom:14px}\n.field span{display:block;font-size:12px;font-weight:600;color:var(--ml-muted);margin-bottom:6px}\ninput{width:100%;height:40px;padding:0 12px;border:1px solid var(--ml-border);border-radius:9px;\n  background:var(--ml-bg);color:inherit;font:inherit}\ninput:focus{outline:2px solid var(--ml-accent);outline-offset:1px;border-color:transparent}\nbutton{width:100%;height:40px;border:0;border-radius:9px;background:var(--ml-accent);\n  color:var(--ml-accent-text);font:inherit;font-weight:600;cursor:pointer}\nbutton[disabled]{opacity:.6;cursor:progress}\n.status{margin:14px 0 0;min-height:1.2em;font-size:12.5px;color:var(--ml-muted)}\n.status[data-tone=\"error\"]{color:var(--ml-danger)}\n.field span em{font-style:normal;font-weight:500;text-transform:none;opacity:.7}\nbutton.quiet{margin-top:10px;height:32px;background:none;color:var(--ml-muted);font-weight:500;\n  font-size:12.5px;text-decoration:underline;text-underline-offset:3px}\nbutton.quiet:hover{color:var(--ml-text)}\nbutton.quiet[disabled]{opacity:.5}\n.hints{margin:10px 0 0;padding:12px 14px;text-align:left;border:1px solid var(--ml-border);\n  border-radius:10px;background:var(--ml-bg);font-size:12.5px}\n.hints dt{font-weight:650;color:var(--ml-text)}\n.hints dd{margin:2px 0 10px;color:var(--ml-muted);overflow-wrap:anywhere}\n.hints dd:last-child{margin-bottom:0}\n";
+export declare const LOCK_STYLE = ":root{color-scheme:light dark;\n  --ml-bg:#f4f5f7;--ml-card:#ffffff;--ml-text:#14171c;--ml-muted:#69707c;--ml-border:#d9dde3;\n  --ml-accent:#1f6feb;--ml-accent-text:#ffffff;--ml-danger:#b42318;\n  --ml-shadow:0 18px 48px rgba(16,18,22,.14)}\n@media (prefers-color-scheme:dark){:root{\n  --ml-bg:#0d0f13;--ml-card:#171a20;--ml-text:#e7eaef;--ml-muted:#8b93a1;--ml-border:#2b3039;\n  --ml-accent:#4f8cf7;--ml-accent-text:#0b0d11;--ml-danger:#f97066;\n  --ml-shadow:0 18px 48px rgba(0,0,0,.55)}}\n*{box-sizing:border-box}\nbody{margin:0;min-height:100vh;display:flex;align-items:center;justify-content:center;padding:24px;\n  background:var(--ml-bg);color:var(--ml-text);\n  font:15px/1.55 ui-sans-serif,system-ui,-apple-system,\"Segoe UI\",sans-serif}\n.card{width:100%;max-width:23rem;background:var(--ml-card);border:1px solid var(--ml-border);\n  border-radius:16px;padding:28px 26px 24px;box-shadow:var(--ml-shadow);text-align:center}\n.glyph{font-size:30px;line-height:1;margin-bottom:10px}\nh1{margin:0 0 6px;font-size:18px;font-weight:650;letter-spacing:-.01em}\n.note{margin:0 0 20px;font-size:13px;color:var(--ml-muted)}\n.field{display:block;text-align:left;margin-bottom:14px}\n.field span{display:block;font-size:12px;font-weight:600;color:var(--ml-muted);margin-bottom:6px}\ninput{width:100%;height:40px;padding:0 12px;border:1px solid var(--ml-border);border-radius:9px;\n  background:var(--ml-bg);color:inherit;font:inherit}\ninput:focus{outline:2px solid var(--ml-accent);outline-offset:1px;border-color:transparent}\nbutton{width:100%;height:40px;border:0;border-radius:9px;background:var(--ml-accent);\n  color:var(--ml-accent-text);font:inherit;font-weight:600;cursor:pointer}\nbutton[disabled]{opacity:.6;cursor:progress}\n.status{margin:14px 0 0;min-height:1.2em;font-size:12.5px;color:var(--ml-muted)}\n.status[data-tone=\"error\"]{color:var(--ml-danger)}\n.field span em{font-style:normal;font-weight:500;text-transform:none;opacity:.7}\nbutton.quiet{margin-top:10px;height:32px;background:none;color:var(--ml-muted);font-weight:500;\n  font-size:12.5px;text-decoration:underline;text-underline-offset:3px}\nbutton.quiet:hover{color:var(--ml-text)}\nbutton.quiet[disabled]{opacity:.5}\n.hints{margin:10px 0 0;padding:12px 14px;text-align:left;border:1px solid var(--ml-border);\n  border-radius:10px;background:var(--ml-bg);font-size:12.5px}\n.hints dt{font-weight:650;color:var(--ml-text)}\n.hints dd{margin:2px 0 10px;color:var(--ml-muted);overflow-wrap:anywhere}\n.hints dd:last-child{margin-bottom:0}\n.secret{position:relative;display:block}\n.secret input{padding-right:68px}\n.secret .reveal{position:absolute;right:5px;top:50%;transform:translateY(-50%);width:auto;height:30px;\n  min-width:56px;padding:0 10px;border-radius:7px;background:none;color:var(--ml-muted);\n  font-size:12.5px;font-weight:600}\n.secret .reveal:hover{color:var(--ml-text);background:var(--ml-card)}\n.secret .reveal:focus-visible{outline:2px solid var(--ml-accent);outline-offset:1px}\n";
+/**
+ * 🔴 Every password field on the wall gets a Show/Hide control (task 077-438's library share) — a
+ * master password is long, typed once and never recoverable, and a typo in "choose" is a lock-out.
+ *
+ * Markup: {@link withRevealToggles} wraps each `type="password"` input in `.secret` with a
+ * `<button type="button" data-reveal>` after it — the inputs keep every attribute, `autocomplete`
+ * included, so a password manager still sees a password field. Behaviour:
+ * {@link MASTER_LOCK_REVEAL_SOURCE}, interpolated into BOTH same-origin scripts, because the wall's
+ * CSP is `script-src 'self'` and allows no inline script (`MASTER_LOCK_CSP`, pinned by
+ * `beaconNeverReachesTheWall.spec.ts`). Nothing about the CSP changes for this.
+ */
+export declare function withRevealToggles(html: string): string;
+/**
+ * The toggle's behaviour, as browser source. It flips the input BEFORE it to `text` and back,
+ * keeps `aria-pressed`/`aria-label` true to what is on screen, and returns every field to
+ * `password` when its form submits — so a manager saving the credential sees a password field.
+ * Publishes itself on `globalThis`, the seam `lockPage.spec.ts` drives it through.
+ */
+export declare const MASTER_LOCK_REVEAL_SOURCE = "function wireMasterLockReveal(doc) {\n  const buttons = doc.querySelectorAll(\"[data-reveal]\");\n  for (const button of buttons) {\n    const input = button.previousElementSibling;\n    if (!input || input.tagName !== \"INPUT\") continue;\n    const show = (on) => {\n      input.type = on ? \"text\" : \"password\";\n      button.setAttribute(\"aria-pressed\", on ? \"true\" : \"false\");\n      button.setAttribute(\"aria-label\", on ? \"Hide password\" : \"Show password\");\n      button.textContent = on ? \"Hide\" : \"Show\";\n    };\n    button.addEventListener(\"click\", () => {\n      show(input.type === \"password\");\n      input.focus();\n    });\n    input.form?.addEventListener(\"submit\", () => show(false), true);\n  }\n  return buttons.length;\n}\nglobalThis.wireMasterLockReveal = wireMasterLockReveal;";
 /**
  * 🔴 The ONE browser copy of `deriveMasterLockVerifier`, shared by every page this feature
  * serves. Pinned by `lockPage.spec.ts`, which evaluates it and compares against the

package/dist/server/master-lock/lockPage.js

@@ -41,7 +41,7 @@ export function lockPageHtml(options) {
                 "Choose one now. Nobody else can see it and nobody else can reset it — " +
                 "if you forget it, it cannot be recovered, so leave yourself a hint."
             : "This site is locked. Signing in is not enough — enter the master password to continue."));
-    return `<!doctype html>
+    return withRevealToggles(`<!doctype html>
 <html lang="en">
 <head>
 <meta charset="utf-8">
@@ -88,7 +88,7 @@ export function lockPageHtml(options) {
 <script type="module" src="${MASTER_LOCK_PATHS.script}"></script>
 </body>
 </html>
-`;
+`);
 }
 /** The stylesheet. Follows the viewer's theme and commits to nothing else. */
 export const LOCK_STYLE = `:root{color-scheme:light dark;
@@ -128,7 +128,54 @@ button.quiet[disabled]{opacity:.5}
 .hints dt{font-weight:650;color:var(--ml-text)}
 .hints dd{margin:2px 0 10px;color:var(--ml-muted);overflow-wrap:anywhere}
 .hints dd:last-child{margin-bottom:0}
+.secret{position:relative;display:block}
+.secret input{padding-right:68px}
+.secret .reveal{position:absolute;right:5px;top:50%;transform:translateY(-50%);width:auto;height:30px;
+  min-width:56px;padding:0 10px;border-radius:7px;background:none;color:var(--ml-muted);
+  font-size:12.5px;font-weight:600}
+.secret .reveal:hover{color:var(--ml-text);background:var(--ml-card)}
+.secret .reveal:focus-visible{outline:2px solid var(--ml-accent);outline-offset:1px}
 `;
+/**
+ * 🔴 Every password field on the wall gets a Show/Hide control (task 077-438's library share) — a
+ * master password is long, typed once and never recoverable, and a typo in "choose" is a lock-out.
+ *
+ * Markup: {@link withRevealToggles} wraps each `type="password"` input in `.secret` with a
+ * `<button type="button" data-reveal>` after it — the inputs keep every attribute, `autocomplete`
+ * included, so a password manager still sees a password field. Behaviour:
+ * {@link MASTER_LOCK_REVEAL_SOURCE}, interpolated into BOTH same-origin scripts, because the wall's
+ * CSP is `script-src 'self'` and allows no inline script (`MASTER_LOCK_CSP`, pinned by
+ * `beaconNeverReachesTheWall.spec.ts`). Nothing about the CSP changes for this.
+ */
+export function withRevealToggles(html) {
+    return html.replace(/(<input\b[^>]*\btype="password"[^>]*>)/g, '<span class="secret">$1<button type="button" class="reveal" data-reveal aria-label="Show password" aria-pressed="false">Show</button></span>');
+}
+/**
+ * The toggle's behaviour, as browser source. It flips the input BEFORE it to `text` and back,
+ * keeps `aria-pressed`/`aria-label` true to what is on screen, and returns every field to
+ * `password` when its form submits — so a manager saving the credential sees a password field.
+ * Publishes itself on `globalThis`, the seam `lockPage.spec.ts` drives it through.
+ */
+export const MASTER_LOCK_REVEAL_SOURCE = `function wireMasterLockReveal(doc) {
+  const buttons = doc.querySelectorAll("[data-reveal]");
+  for (const button of buttons) {
+    const input = button.previousElementSibling;
+    if (!input || input.tagName !== "INPUT") continue;
+    const show = (on) => {
+      input.type = on ? "text" : "password";
+      button.setAttribute("aria-pressed", on ? "true" : "false");
+      button.setAttribute("aria-label", on ? "Hide password" : "Show password");
+      button.textContent = on ? "Hide" : "Show";
+    };
+    button.addEventListener("click", () => {
+      show(input.type === "password");
+      input.focus();
+    });
+    input.form?.addEventListener("submit", () => show(false), true);
+  }
+  return buttons.length;
+}
+globalThis.wireMasterLockReveal = wireMasterLockReveal;`;
 /**
  * 🔴 The ONE browser copy of `deriveMasterLockVerifier`, shared by every page this feature
  * serves. Pinned by `lockPage.spec.ts`, which evaluates it and compares against the
@@ -179,6 +226,10 @@ export const LOCK_SCRIPT = `const paths = ${JSON.stringify(MASTER_LOCK_PATHS)};
 // ── derivation ───────────────────────────────────────────────────────────────
 ${MASTER_LOCK_DERIVE_SOURCE}
 
+// ── show / hide ──────────────────────────────────────────────────────────────
+${MASTER_LOCK_REVEAL_SOURCE}
+wireMasterLockReveal(document);
+
 const form = document.getElementById("ml-form");
 const input = document.getElementById("ml-input");
 const confirmInput = document.getElementById("ml-confirm");

package/dist/server/metrics/metricsBuffer.d.ts

@@ -18,7 +18,17 @@ export interface MetricRow {
     durationMs: number | null;
     bytesOut: number | null;
     userId: string | null;
+    /**
+     * Where the request came from — a PLACE, never an address (4.23.0). Filled by
+     * `requestLogger`'s `locate` hook; absent/null when nothing could place it. There is
+     * deliberately no `ip` field: the raw address is never stored, anywhere.
+     */
+    country?: string | null;
+    region?: string | null;
+    city?: string | null;
 }
+/** The optional place columns, in insert order. Each is written only when the table HAS it. */
+export declare const PLACE_COLUMNS: readonly ["country", "region", "city"];
 export interface MetricsBufferOptions {
     db: Database;
     /** Flush cadence in ms. Default: 1500. */

package/dist/server/metrics/metricsBuffer.js

@@ -1,11 +1,19 @@
+/** The optional place columns, in insert order. Each is written only when the table HAS it. */
+export const PLACE_COLUMNS = ['country', 'region', 'city'];
 export function createMetricsBuffer(opts) {
     const { db, flushIntervalMs = 1500, maxSize = 5000 } = opts;
     let buffer = [];
-    const insert = db.prepare(`INSERT INTO request_metrics (id, ts, method, route, status, duration_ms, bytes_out, user_id)
-     VALUES (?, ?, ?, ?, ?, ?, ?, ?)`);
+    // 🔴 The place columns are written only where the table has them (4.23.0). An app that
+    // created `request_metrics` with its own DDL before they existed keeps working unchanged —
+    // a fixed column list would make `prepare` throw on its first boot after the bump.
+    const present = new Set(db.query('PRAGMA table_info(request_metrics)').all().map((c) => c.name));
+    const place = PLACE_COLUMNS.filter((c) => present.has(c));
+    const columns = ['id', 'ts', 'method', 'route', 'status', 'duration_ms', 'bytes_out', 'user_id', ...place];
+    const insert = db.prepare(`INSERT INTO request_metrics (${columns.join(', ')})
+     VALUES (${columns.map(() => '?').join(', ')})`);
     const insertMany = db.transaction((rows) => {
         for (const r of rows) {
-            insert.run(crypto.randomUUID(), r.ts, r.method, r.route, r.status, r.durationMs, r.bytesOut, r.userId);
+            insert.run(crypto.randomUUID(), r.ts, r.method, r.route, r.status, r.durationMs, r.bytesOut, r.userId, ...place.map((c) => r[c] ?? null));
         }
     });
     const flush = () => {