cursedbelt 2.7.0 → 3.0.0

package/src/server/drivers/jobResults.ts

@@ -1,445 +0,0 @@
-/**
- * Durable job outcomes — the cross-process half of `JobBroker` (03 §7.3).
- *
- * The original broker kept completion in two in-memory maps. That is correct for
- * one process and silently wrong for every other topology: a job enqueued on
- * API node A and executed by worker B completes in **B's heap**, so A's
- * `onComplete` callback never fires and A's `status()` reports "still running"
- * forever. A stateless multi-worker deployment is the whole point of the SaaS
- * profile, so a completion model that only works when enqueuer, worker and
- * subscriber share a heap is not a seam — it is a local implementation detail
- * that the interface promised to hide.
- *
- * The fix is to make the RESULT durable and shared rather than the callback
- * registry: a worker records the terminal outcome where anyone can read it, and
- * waiting is `awaitCompletion` (read-through, optionally push-accelerated)
- * instead of a heap-local callback. `onComplete` survives as sugar over that —
- * the same call now works across processes, which is what "just swap the impl"
- * always claimed.
- */
-import type { Database } from 'bun:sqlite';
-import { createSqliteExecutor, type Statement, type StatementExecutor } from 'cwip/storage';
-import { AppError } from '../errors';
-import type { JobId, JobResult } from './jobBroker';
-
-/**
- * Tenant recorded when a terminal outcome is written by a path that cannot know
- * the job's tenant — a `cancel(id)` from a process that did not enqueue it. It
- * is a sentinel, not a real tenant: a scoped reader must treat it as "not mine",
- * which is why it is a named constant rather than an empty string that could be
- * mistaken for a missing column.
- */
-export const UNSCOPED_TENANT = 'unknown';
-
-/** A terminal outcome plus the routing needed to scope and prune it. */
-export interface RecordedJobResult extends JobResult {
-  tenantId: string;
-  instanceId?: string;
-  /** ISO-8601 UTC. Stamped by the store when absent. */
-  at?: string;
-}
-
-/**
- * Where terminal outcomes live. Local profile: a table in the app's SQLite file.
- * SaaS: the same rows in Postgres, or a Redis hash with a TTL — the contract is
- * the same, which is the point.
- */
-/** What a scoped read of the outcome log asks for (03 §1e, the `orchestration` surface). */
-export interface JobResultQuery {
-  /**
-   * REQUIRED. A job outcome is tenant data, and the one read that lists rows
-   * rather than fetching a known id is exactly where a missing scope becomes a
-   * cross-tenant leak — so there is no "all tenants" overload to forget.
-   * {@link UNSCOPED_TENANT} rows belong to nobody and are never returned.
-   */
-  tenantId: string;
-  /** Cap the page. Default 50; a run log is read from the top, not exhausted. */
-  limit?: number;
-}
-
-/**
- * Every verb is ASYNC, and that is load-bearing rather than stylistic.
- *
- * The interface was synchronous for its first two arcs, which quietly limited
- * it to the two stores that could be: `bun:sqlite` (synchronous, and therefore
- * PER-NODE — it cannot be shared) and a heap map (which is the exact thing this
- * module's docstring rules out). A Postgres or Redis store — the only kind that
- * is actually SHARED, and so the only kind that makes the promise at the top of
- * this file true — cannot implement a synchronous interface at all. So the
- * multi-node completion story was unimplementable as designed: a job completed
- * by worker B was invisible to a waiter on node A, which is precisely the
- * failure this module exists to prevent.
- *
- * `AsyncRevocationStore` is async for exactly the same reason and has been since
- * it landed; this is that shape, applied where it was missed (owner decision E17).
- */
-export interface JobResultStore {
-  /** Record a terminal outcome. Idempotent: the first write for an id wins. */
-  record(result: RecordedJobResult): Promise<void>;
-  /** Read a recorded outcome, or `null` while the job is still in flight. */
-  read(id: JobId): Promise<RecordedJobResult | null>;
-  /** The tenant's most recent outcomes, newest first. */
-  list(query: JobResultQuery): Promise<readonly RecordedJobResult[]>;
-  /** Drop outcomes older than `maxAgeMs`. Returns the number removed. */
-  prune(maxAgeMs: number): Promise<number>;
-}
-
-/** Default page size for {@link JobResultStore.list}. */
-export const JOB_RESULT_PAGE = 50;
-
-export const JOB_RESULTS_TABLE = 'cc_job_results';
-
-/**
- * `ok` is stored as INTEGER because SQLite has no boolean; `output` is JSON
- * because a job's return value is arbitrary. `tenant_id` is NOT NULL under the
- * same law as every other table (01 §2) — a result row is data, and untenanted
- * data is the thing that leaks.
- */
-export const JOB_RESULTS_DDL = `CREATE TABLE IF NOT EXISTS ${JOB_RESULTS_TABLE} (
-  job_id      TEXT PRIMARY KEY NOT NULL,
-  tenant_id   TEXT NOT NULL,
-  instance_id TEXT,
-  ok          INTEGER NOT NULL,
-  output      TEXT,
-  error       TEXT,
-  at          TEXT NOT NULL DEFAULT (strftime('%Y-%m-%dT%H:%M:%fZ','now'))
-)`;
-
-export const JOB_RESULTS_INDEX = `CREATE INDEX IF NOT EXISTS cc_job_results_at ON ${JOB_RESULTS_TABLE}(at)`;
-
-interface JobResultRow {
-  job_id: string;
-  tenant_id: string;
-  instance_id: string | null;
-  /** SQLite INTEGER; Postgres `bigint`, which the driver hands back as a STRING. */
-  ok: number | string;
-  output: string | null;
-  error: string | null;
-  at: string;
-}
-
-const toRecorded = (row: JobResultRow): RecordedJobResult => ({
-  jobId: row.job_id,
-  tenantId: row.tenant_id,
-  instanceId: row.instance_id ?? undefined,
-  // `Number(...)`, not `=== 1`: a pg `bigint` arrives as the string '1', and a
-  // string compared against a number is silently `false` — every outcome would
-  // read as a failure, on the dialect with no local test to catch it.
-  ok: Number(row.ok) === 1,
-  output: row.output === null ? undefined : (JSON.parse(row.output) as unknown),
-  error: row.error ?? undefined,
-  at: row.at,
-});
-
-/**
- * The four statements, authored ONCE.
- *
- * A second copy of this table's SQL for the shared-substrate store is exactly
- * the drift the statement-spec layer exists to prevent (`cwip/sql/statements`):
- * the two would agree on the day they were written and disagree the first time
- * a column moved. Only the insert's SHAPE differs between the dialects, which
- * is what the `pg` field is for; the placeholder numbering and the timestamp
- * spelling are rendering, not authorship.
- */
-const STATEMENTS = {
-  // `OR IGNORE` / `DO NOTHING`, never a replace: a cancelled job whose handler
-  // later returns normally must not overwrite the recorded cancellation. That
-  // is the settle race (§2.3) in its durable form, and it is the ONE property
-  // this table's correctness rests on.
-  insert: (result: RecordedJobResult): Statement => ({
-    sql: `INSERT OR IGNORE INTO ${JOB_RESULTS_TABLE} (job_id, tenant_id, instance_id, ok, output, error, at)
-          VALUES (?, ?, ?, ?, ?, ?, ?)`,
-    pg: `INSERT INTO ${JOB_RESULTS_TABLE} (job_id, tenant_id, instance_id, ok, output, error, at)
-         VALUES (?, ?, ?, ?, ?, ?, ?) ON CONFLICT (job_id) DO NOTHING`,
-    params: [
-      result.jobId,
-      result.tenantId,
-      result.instanceId ?? null,
-      result.ok ? 1 : 0,
-      result.output === undefined ? null : JSON.stringify(result.output),
-      result.error ?? null,
-      result.at ?? new Date().toISOString(),
-    ],
-  }),
-  read: (id: JobId): Statement => ({
-    sql: `SELECT * FROM ${JOB_RESULTS_TABLE} WHERE job_id = ?`,
-    params: [id],
-  }),
-  // The tenant predicate is REQUIRED, not a convenience — this is the only read
-  // that returns rows rather than a known id, so it is exactly where a missing
-  // scope becomes a cross-tenant leak. `at DESC, job_id DESC` because two jobs
-  // recorded inside the same millisecond would otherwise page in an order
-  // either engine is free to change between runs.
-  list: (tenantId: string, limit: number): Statement => ({
-    sql: `SELECT * FROM ${JOB_RESULTS_TABLE} WHERE tenant_id = ? ORDER BY at DESC, job_id DESC LIMIT ?`,
-    params: [tenantId, limit],
-  }),
-  prune: (cutoffIso: string): Statement => ({
-    sql: `DELETE FROM ${JOB_RESULTS_TABLE} WHERE at < ?`,
-    params: [cutoffIso],
-  }),
-} as const;
-
-/**
- * The store over any {@link StatementExecutor} — the ONE implementation.
- *
- * Both the per-node SQLite store and the shared Postgres store are this
- * function with a different executor, which is what makes "the contract is the
- * same, which is the point" (the docstring at the top of this file) a fact
- * about the code rather than an aspiration about two hand-written copies.
- *
- * It does NOT create the table: DDL ownership differs per substrate (the app's
- * own file versus a migration a deployment runs once against a shared
- * database), and a library that quietly issued DDL against a shared Postgres
- * would be a second schema owner.
- */
-export const createStatementJobResultStore = (executor: StatementExecutor): JobResultStore => ({
-  async record(result) {
-    await executor.write(STATEMENTS.insert(result));
-  },
-  async read(id) {
-    const row = await executor.get<JobResultRow>(STATEMENTS.read(id));
-    return row === null ? null : toRecorded(row);
-  },
-  async list({ tenantId, limit }) {
-    const rows = await executor.all<JobResultRow>(STATEMENTS.list(tenantId, limit ?? JOB_RESULT_PAGE));
-    return rows.map(toRecorded);
-  },
-  async prune(maxAgeMs) {
-    const result = await executor.write(STATEMENTS.prune(new Date(Date.now() - maxAgeMs).toISOString()));
-    return result.changes;
-  },
-});
-
-/**
- * SQLite-backed store. Shares the app's DB handle, so a result is committed in
- * the same file the queue journal lives in — a crash between "job done" and
- * "result recorded" is the only remaining gap, and re-leasing re-runs the job.
- *
- * PER-NODE by construction, which is why it is not the saas answer: two API
- * nodes have two files, so a completion recorded by one is invisible to the
- * other. Use the pooled store for that (`createPgJobResultStore`).
- */
-export const createSqliteJobResultStore = (db: Database): JobResultStore => {
-  db.run(JOB_RESULTS_DDL);
-  db.run(JOB_RESULTS_INDEX);
-  return createStatementJobResultStore(createSqliteExecutor(db));
-};
-
-/** In-memory store — tests and single-process hosts with no DB handle. */
-export const createMemoryJobResultStore = (): JobResultStore => {
-  const rows = new Map<JobId, RecordedJobResult>();
-  return {
-    async record(result) {
-      if (rows.has(result.jobId)) return;
-      rows.set(result.jobId, { ...result, at: result.at ?? new Date().toISOString() });
-    },
-    async read(id) {
-      return rows.get(id) ?? null;
-    },
-    async list({ tenantId, limit }) {
-      return [...rows.values()]
-        .filter((row) => row.tenantId === tenantId)
-        .sort((a, b) => (a.at ?? '') < (b.at ?? '') ? 1 : (a.at ?? '') > (b.at ?? '') ? -1 : b.jobId.localeCompare(a.jobId))
-        .slice(0, limit ?? JOB_RESULT_PAGE);
-    },
-    async prune(maxAgeMs) {
-      const cutoff = Date.now() - maxAgeMs;
-      let removed = 0;
-      for (const [id, row] of rows) {
-        if (Date.parse(row.at ?? '') < cutoff) {
-          rows.delete(id);
-          removed += 1;
-        }
-      }
-      return removed;
-    },
-  };
-};
-
-/**
- * Record a stateless worker's terminal outcome in the shared store.
- *
- * A SaaS worker owns no waiter registry and no callback map — it runs in a
- * different process from every enqueuer and subscriber. Writing the row IS its
- * only completion notification: API nodes read it through {@link
- * awaitRecordedCompletion}, and the backend's own `completed` event (fired when
- * the worker acks the lease AFTER this write) is what wakes them from a poll to
- * an immediate re-read. Hence the ordering law the worker must honor — record
- * here, THEN ack the lease — so a waiter woken by the completed event always
- * finds the row already durable.
- *
- * `record` is first-writer-wins (the store's law), which is exactly what makes
- * this safe to call after a `cancel(id)` already wrote a `cancelled` row: a
- * handler that finishes normally moments after being cancelled does not
- * resurrect the job. The helper exists as a named seam so that law has one
- * documented call site rather than a bare `store.record` scattered through the
- * worker loop.
- */
-export const recordWorkerResult = async (store: JobResultStore, result: RecordedJobResult): Promise<void> => {
-  await store.record(result);
-};
-
-/* ---------------------------------------------------------------- waiting */
-
-export interface AwaitCompletionOptions {
-  /** Give up after this long. Default 5 minutes. */
-  timeoutMs?: number;
-  /** Read-through interval. Default 250ms. */
-  pollMs?: number;
-  /** Abort the wait (request cancelled, server stopping). */
-  signal?: AbortSignal;
-}
-
-/**
- * Wait for a terminal outcome by READING the shared store.
- *
- * Polling is the floor, not the mechanism: a broker with a completion bus wakes
- * the wait immediately and the poll is only the safety net for a missed
- * notification. Getting that ordering right is what makes the contract
- * identical in-process and across a Redis-backed fleet — the caller cannot tell
- * which one delivered.
- */
-export const awaitRecordedCompletion = async (
-  store: JobResultStore,
-  id: JobId,
-  options: AwaitCompletionOptions & { subscribe?: (cb: () => void) => () => void } = {},
-): Promise<RecordedJobResult> => {
-  const timeoutMs = options.timeoutMs ?? 300_000;
-  const pollMs = options.pollMs ?? 250;
-  const deadline = Date.now() + timeoutMs;
-
-  // The pre-read is what makes an already-finished job replay instead of hang.
-  // It is tolerated rather than propagated for the same reason the polled reads
-  // are: a shared store answers over a network, and a blip on the FIRST read is
-  // not evidence that the job did not finish. The error is remembered so it can
-  // ride the timeout if nothing ever answers.
-  let firstReadError: unknown = null;
-  try {
-    const immediate = await store.read(id);
-    if (immediate) return immediate;
-  } catch (error) {
-    firstReadError = error;
-  }
-
-  return await new Promise<RecordedJobResult>((resolve, reject) => {
-    let settled = false;
-    let timer: ReturnType<typeof setTimeout> | null = null;
-    let unsubscribe: (() => void) | null = null;
-    /**
-     * The most recent store failure, if any. A shared store lives across a
-     * network now, so a read CAN fail transiently; giving up on the first blip
-     * would make a 24h wait a coin flip. But swallowing it entirely would turn
-     * a permanently broken store into an unexplainable `JOB_WAIT_TIMEOUT` — the
-     * exact "a timeout is an unsettled promise" trap — so the last error rides
-     * the timeout when we finally give up.
-     */
-    let lastReadError: unknown = firstReadError;
-
-    const finish = (fn: () => void): void => {
-      if (settled) return;
-      settled = true;
-      if (timer !== null) clearTimeout(timer);
-      unsubscribe?.();
-      options.signal?.removeEventListener('abort', onAbort);
-      fn();
-    };
-
-    function onAbort(): void {
-      finish(() =>
-        reject(
-          new AppError(`Wait for job '${id}' was aborted.`, {
-            code: 'JOB_WAIT_ABORTED',
-            status: 499,
-            context: { jobId: id },
-          }),
-        ),
-      );
-    }
-
-    const check = async (): Promise<void> => {
-      if (settled) return;
-      let recorded: RecordedJobResult | null = null;
-      try {
-        recorded = await store.read(id);
-      } catch (error) {
-        lastReadError = error;
-      }
-      // The read is a suspension point now: an abort or a competing wake may
-      // have settled us while it was in flight, and re-arming a timer after
-      // that would leak one per poll for the life of the process.
-      if (settled) return;
-      if (recorded) {
-        const found = recorded;
-        finish(() => resolve(found));
-        return;
-      }
-      if (Date.now() >= deadline) {
-        finish(() =>
-          reject(
-            new AppError(`Job '${id}' did not complete within ${timeoutMs}ms.`, {
-              code: 'JOB_WAIT_TIMEOUT',
-              status: 504,
-              context: {
-                jobId: id,
-                timeoutMs,
-                ...(lastReadError === null ? {} : { lastReadError: String(lastReadError) }),
-              },
-              cause: lastReadError ?? undefined,
-            }),
-          ),
-        );
-        return;
-      }
-      timer = setTimeout(poll, pollMs);
-    };
-
-    /**
-     * The ONE entry point to `check` — the timer and the push subscription both
-     * come through here, and only one check may be in flight.
-     *
-     * Serializing matters more than it looks. `check` now suspends on the store
-     * read, so a push wake arriving mid-read would start a second chain, and
-     * each chain arms its own `setTimeout` while only one handle survives in
-     * `timer` — an orphaned timer per wake, forever, on a wait that may legitimately
-     * run for 24 hours. A wake during a read is instead remembered and re-polled
-     * the moment that read lands, which is also strictly more responsive than
-     * racing two reads.
-     */
-    let running = false;
-    let wakeRequested = false;
-    const poll = (): void => {
-      if (settled) return;
-      if (running) {
-        wakeRequested = true;
-        return;
-      }
-      if (timer !== null) {
-        clearTimeout(timer);
-        timer = null;
-      }
-      running = true;
-      void check()
-        .catch((error) => {
-          finish(() => reject(error));
-        })
-        .finally(() => {
-          running = false;
-          if (wakeRequested && !settled) {
-            wakeRequested = false;
-            poll();
-          }
-        });
-    };
-
-    if (options.signal) {
-      if (options.signal.aborted) {
-        onAbort();
-        return;
-      }
-      options.signal.addEventListener('abort', onAbort, { once: true });
-    }
-    unsubscribe = options.subscribe?.(poll) ?? null;
-    timer = setTimeout(poll, pollMs);
-  });
-};

package/src/server/drivers/pooledControlStores.pg.test.ts

@@ -1,162 +0,0 @@
-/**
- * The SHARED control-plane stores against a REAL Postgres (04 §1).
- *
- * These two stores exist for exactly one reason — to be the same rows on every
- * node — and that claim is a claim about Postgres, not about TypeScript. A fake
- * pool can prove the plumbing (one pool, a connection per call, a tenant
- * predicate on the listing) and `pooledControlStores.spec.ts` does. It cannot
- * prove the SQL: `ON CONFLICT DO NOTHING`, `GREATEST`, `bigint`-as-string, and
- * the compiled DDL are all things only the engine can answer for, and a fake
- * that answered them would be answering with our own assumptions.
- *
- *   bun run test:pg          (starts a disposable container, runs, tears down)
- *   CC_PG_URL=postgres://…   (or point it at any throwaway database)
- *
- * SKIPPED, loudly, when `CC_PG_URL` is absent — the skip is a missing proof,
- * never a passing one. It runs nightly (`.github/workflows/nightly.yml`).
- */
-import { SQL } from 'bun';
-import { afterAll, beforeAll, describe, expect, it } from 'bun:test';
-import type { SaasConnection, SaasPool } from 'cwip/storage';
-import { JOB_RESULTS_TABLE, UNSCOPED_TENANT } from './jobResults';
-import {
-  createPgJobResultStore,
-  createPgRevocationStore,
-  ensureSaasControlPlaneSchema,
-  REVOCATIONS_TABLE,
-} from './pooledControlStores';
-
-const URL_ = process.env.CC_PG_URL;
-
-let sql: SQL;
-let pool: SaasPool;
-
-// SKIPPED unless CC_PG_URL names a throwaway Postgres — this suite's subject IS the engine. `bun run test:pg` supplies one.
-describe.skipIf(!URL_)('the shared control-plane stores against a real Postgres (04 §1)', () => {
-  // 120s, not Bun's default 5s. This hook drops and re-creates a role, a database
-  // and a whole migration chain against a REAL Postgres; on a shared 4-core CI
-  // runner that has been measured at over five seconds, and the failure it
-  // produces is deeply misleading — the hook times out, the runner closes the
-  // connection mid-migration, and the log reads `MIGRATION_FAILED` /
-  // `ERR_POSTGRES_CONNECTION_CLOSED` as though the SQL were wrong. Observed on
-  // the 2026-07-27 nightly, one run after a green one.
-  beforeAll(async () => {
-    sql = new SQL(URL_ as string);
-    // A connection per call, checked out and returned — the same discipline the
-    // real `pg` pool adapter has, so the stores are exercised through the shape
-    // they ship with rather than a long-lived handle a test happens to hold.
-    const connection: SaasConnection = {
-      async query<R>(text: string, params: readonly unknown[] = []): Promise<R[]> {
-        return (await sql.unsafe(text, [...params])) as R[];
-      },
-      async execute(text: string, params: readonly unknown[] = []) {
-        const result = await sql.unsafe(text, [...params]);
-        return { rowCount: (result as { count?: number }).count ?? 0 };
-      },
-    };
-    pool = { async withConnection(fn) { return await fn(connection); } };
-
-    await sql.unsafe(`DROP TABLE IF EXISTS ${JOB_RESULTS_TABLE}`);
-    await sql.unsafe(`DROP TABLE IF EXISTS ${REVOCATIONS_TABLE}`);
-    await ensureSaasControlPlaneSchema(pool);
-  }, 120_000);
-
-  afterAll(async () => {
-    await sql?.end();
-  });
-
-  it('creates its schema idempotently — the chain is COMPILED, not hand-written', async () => {
-    // The second run is the assertion: the `IF NOT EXISTS` guard has to survive
-    // compilation from the SQLite source, or a deployment's second migration
-    // run is a hard failure.
-    await ensureSaasControlPlaneSchema(pool);
-    await ensureSaasControlPlaneSchema(pool);
-  });
-
-  /* ------------------------------------------------------- job results */
-
-  it('round-trips an outcome, keeping ok as a BOOLEAN across the bigint boundary', async () => {
-    const store = createPgJobResultStore(pool);
-    await store.record({ jobId: 'pg_1', ok: true, output: { files: 3 }, tenantId: 't_a', instanceId: 'gallery' });
-
-    // `ok` is a pg `bigint`, which the driver hands back as the STRING '1'. A
-    // `=== 1` comparison would be silently false and every outcome would read
-    // as a failure — on the dialect with no local test to catch it.
-    await expect(store.read('pg_1')).resolves.toMatchObject({
-      jobId: 'pg_1',
-      ok: true,
-      output: { files: 3 },
-      tenantId: 't_a',
-      instanceId: 'gallery',
-    });
-  });
-
-  it('keeps the FIRST outcome — ON CONFLICT DO NOTHING, not an upsert', async () => {
-    const store = createPgJobResultStore(pool);
-    await store.record({ jobId: 'pg_race', ok: false, error: 'cancelled', tenantId: 't_a' });
-    await store.record({ jobId: 'pg_race', ok: true, output: 'finished anyway', tenantId: 't_a' });
-
-    // The durable form of the settle race: a handler that returns normally
-    // moments after an API node recorded a cancel must not resurrect the job.
-    await expect(store.read('pg_race')).resolves.toMatchObject({ ok: false, error: 'cancelled' });
-  });
-
-  it('lists only the named tenant’s outcomes, newest first', async () => {
-    const store = createPgJobResultStore(pool);
-    await store.record({ jobId: 'pg_old', ok: true, tenantId: 't_list', at: '2026-07-25T10:00:00.000Z' });
-    await store.record({ jobId: 'pg_new', ok: true, tenantId: 't_list', at: '2026-07-25T12:00:00.000Z' });
-    await store.record({ jobId: 'pg_mid', ok: true, tenantId: 't_list', at: '2026-07-25T11:00:00.000Z' });
-    await store.record({ jobId: 'pg_theirs', ok: true, tenantId: 't_other', at: '2026-07-25T13:00:00.000Z' });
-    await store.record({ jobId: 'pg_nobody', ok: true, tenantId: UNSCOPED_TENANT, at: '2026-07-25T14:00:00.000Z' });
-
-    const rows = await store.list({ tenantId: 't_list' });
-    expect(rows.map((row) => row.jobId)).toEqual(['pg_new', 'pg_mid', 'pg_old']);
-    // The one read that returns ROWS rather than a known id — so it is exactly
-    // where a missing scope becomes a cross-tenant leak.
-    expect(rows.some((row) => row.jobId === 'pg_theirs' || row.jobId === 'pg_nobody')).toBe(false);
-  });
-
-  it('caps the page', async () => {
-    const store = createPgJobResultStore(pool);
-    expect((await store.list({ tenantId: 't_list', limit: 2 })).length).toBe(2);
-  });
-
-  it('prunes by age, across every tenant', async () => {
-    const store = createPgJobResultStore(pool);
-    await store.record({ jobId: 'pg_ancient', ok: true, tenantId: 't_a', at: '2000-01-01T00:00:00.000Z' });
-    await store.record({ jobId: 'pg_fresh', ok: true, tenantId: 't_a' });
-
-    const removed = await store.prune(60_000);
-    expect(removed).toBeGreaterThanOrEqual(1);
-    await expect(store.read('pg_ancient')).resolves.toBeNull();
-    await expect(store.read('pg_fresh')).resolves.not.toBeNull();
-  });
-
-  /* --------------------------------------------------------- revocation */
-
-  it('records a revoked jti and reads its exp back as a NUMBER', async () => {
-    const store = createPgRevocationStore(pool);
-    await store.set('jti_a', 1_800_000_000);
-    await expect(store.get('jti_a')).resolves.toBe(1_800_000_000);
-    await expect(store.get('jti_never')).resolves.toBeNull();
-  });
-
-  it('keeps the LATER exp — two nodes with skewed clocks must not shorten the window', async () => {
-    const store = createPgRevocationStore(pool);
-    await store.set('jti_skew', 1_800_000_100);
-    await store.set('jti_skew', 1_800_000_000); // an earlier clock revoking the same jti
-    // GREATEST, not "last write wins": the shorter window would let a revoked
-    // token become valid again for the difference between the two clocks.
-    await expect(store.get('jti_skew')).resolves.toBe(1_800_000_100);
-  });
-
-  it('prunes only entries whose token could no longer be presented', async () => {
-    const store = createPgRevocationStore(pool);
-    await store.set('jti_expired', 1_000);
-    await store.set('jti_live', 1_900_000_000);
-
-    expect(await store.prune(2_000)).toBeGreaterThanOrEqual(1);
-    await expect(store.get('jti_expired')).resolves.toBeNull();
-    await expect(store.get('jti_live')).resolves.toBe(1_900_000_000);
-  });
-});