okengine 0.11.1 → 0.11.2

package/src/elements/store/index-boot.test.ts

@@ -6,7 +6,7 @@
  * native ANN index — no JS-side full scan survives.
  */
 
-import { afterEach, describe, expect, test } from "bun:test";
+import { afterAll, afterEach, beforeAll, describe, expect, test } from "bun:test";
 import { connectPglite } from "../../drivers/pglite.ts";
 import { openPgvectorIndex } from "../../drivers/pgvector.ts";
 import { connectPostgres } from "../../drivers/postgres.ts";
@@ -22,6 +22,17 @@ const prev = {
   pglite: process.env.OKE_PGLITE_URL,
 };
 
+/** Warmed PGlite for direct openPgvectorIndex cases (boot path opens its own). */
+let sharedPglite: SqlConnection | undefined;
+
+beforeAll(async () => {
+  sharedPglite = await connectPglite({ url: "memory://index-boot-shared" });
+}, 15_000);
+
+afterAll(async () => {
+  await sharedPglite?.close();
+});
+
 afterEach(() => {
   if (prev.pglite === undefined) delete process.env.OKE_PGLITE_URL;
   else process.env.OKE_PGLITE_URL = prev.pglite;
@@ -43,7 +54,8 @@ function recordingConn(conn: SqlConnection): { conn: SqlConnection; statements:
         statements.push(sql);
         return conn.exec(sql, params);
       },
-      close: () => conn.close(),
+      // Never close the underlying shared PGlite — afterAll owns that.
+      close: async () => {},
     },
   };
 }
@@ -63,12 +75,16 @@ describe("store.index boot wiring — memory", () => {
 });
 
 describe("store.index boot wiring — pglite + pgvector", () => {
+  // bindStore opens its own PGlite — cannot inject the shared instance; allow
+  // cold WASM under suite contention (same budget as sql conformance).
   test("boot: sql=pglite + index=pgvector resolves end to end", async () => {
     process.env.OKE_PGLITE_URL = "memory://";
     const kb = declareIndex("kb", { dims: 3 });
     const runtime = bindStore(
       {
-        config: { drivers: { store: { sql: { test: "pglite" }, index: { test: "pgvector" } } } },
+        config: {
+          drivers: { store: { sql: { test: "pglite" }, index: { test: "pgvector" } } },
+        },
         stores: [kb],
       },
       "test",
@@ -86,10 +102,11 @@ describe("store.index boot wiring — pglite + pgvector", () => {
     expect(hits[0]!.meta).toEqual({ label: "near" });
     expect(await handle.delete("farther")).toBe(true);
     await runtime.close();
-  });
+  }, 15_000);
 
   test("pglite runs the shared pgvector HNSW path — real ANN, not a scan", async () => {
-    const real = await connectPglite({ url: "memory://" });
+    const real = sharedPglite!;
+    await real.exec(`DROP TABLE IF EXISTS oke_idx_ann CASCADE`);
     const { conn, statements } = recordingConn(real);
     const idx = await openPgvectorIndex({ name: "ann", dims: 3, sql: conn });
     await idx.upsert("a", [1, 0, 0]);
@@ -106,7 +123,7 @@ describe("store.index boot wiring — pglite + pgvector", () => {
     );
     expect(JSON.stringify(indexes)).toContain("USING hnsw");
     await idx.close();
-    await real.close();
+    // shared connection — closed in afterAll
   });
 });
 

package/src/elements/store/resource.test.ts

@@ -5,18 +5,19 @@
  * client-facing key.
  */
 
-import { afterEach, describe, expect, test } from "bun:test";
+import { afterAll, afterEach, beforeAll, beforeEach, describe, expect, test } from "bun:test";
 import { integer, pgTable, text } from "drizzle-orm/pg-core";
 import { createInsertSchema, createSelectSchema } from "drizzle-zod";
 import { z } from "zod";
 import { pgliteDriver } from "../../drivers/pglite.ts";
+import type { SqlConnection } from "../../drivers/types.ts";
 import { oke } from "../../kernel/app.ts";
 import { resetFlowSeq } from "../../kernel/flow.ts";
 import { on, resetBindings } from "../../kernel/on.ts";
 import { http } from "../../kernel/triggers.ts";
 import { createTestApp } from "../../test/create-test-app.ts";
 import { classify, field, id, now, PII_MASK, store } from "../store.ts";
-import { createSqlStoreHandle } from "./sql-session.ts";
+import { createSqlStoreHandle, type SqlStoreHandle } from "./sql-session.ts";
 import { mapRowToJs, resolveColumns } from "./table.ts";
 
 afterEach(() => {
@@ -24,6 +25,18 @@ afterEach(() => {
   resetFlowSeq();
 });
 
+/** Posts table for the JS-key exit lock (needs real Postgres dialect via PGlite). */
+const jsKeyPosts = pgTable("posts", {
+  id: text("id").primaryKey(),
+  title: text("title").notNull(),
+  createdAt: integer("created_at").notNull(),
+});
+
+/** File-scoped warmed PGlite for the SqlStoreHandle exit describe. */
+let sharedConn: SqlConnection;
+/** Handle over {@link sharedConn}. */
+let sharedHandle: SqlStoreHandle;
+
 describe("mapRowToJs — declared keys only", () => {
   const posts = pgTable("posts", {
     id: text("id").primaryKey(),
@@ -47,40 +60,46 @@ describe("mapRowToJs — declared keys only", () => {
 });
 
 describe("SqlStoreHandle exit — list/get/create return JS keys only", () => {
-  const posts = pgTable("posts", {
-    id: text("id").primaryKey(),
-    title: text("title").notNull(),
-    createdAt: integer("created_at").notNull(),
-  });
-
-  test("select / findById / insert.returning never emit created_at", async () => {
-    const conn = await pgliteDriver.connect({
-      url: "memory://",
+  // Real Postgres dialect (PGlite) — share one warmed instance; TRUNCATE between tests.
+  beforeAll(async () => {
+    sharedConn = await pgliteDriver.connect({
+      url: "memory://resource-js-keys-shared",
       role: "primary",
     });
-    const handle = createSqlStoreHandle("sql:app", {
-      connection: conn,
+    sharedHandle = createSqlStoreHandle("sql:app", {
+      connection: sharedConn,
       classifications: new Map(),
       routedRole: "primary",
       domainDdl: "ensure",
     });
+    // Warm DDL via the insert path (pgTable is not a TableHandle for ensureTable).
+    await sharedHandle.insert(jsKeyPosts).values({ id: "_warmup", title: "x", createdAt: 0 });
+    await sharedConn.exec(`TRUNCATE "posts" RESTART IDENTITY CASCADE`);
+  }, 15_000);
+
+  afterAll(async () => {
+    await sharedConn.close();
+  });
 
-    const [created] = await handle
-      .insert(posts)
+  beforeEach(async () => {
+    await sharedConn.exec(`TRUNCATE "posts" RESTART IDENTITY CASCADE`);
+  });
+
+  test("select / findById / insert.returning never emit created_at", async () => {
+    const [created] = await sharedHandle
+      .insert(jsKeyPosts)
       .values({ id: "p1", title: "one", createdAt: 100 })
       .returning();
     expect(Object.keys(created!).sort()).toEqual(["createdAt", "id", "title"]);
     expect("created_at" in created!).toBe(false);
 
-    const listed = await handle.select().from(posts);
+    const listed = await sharedHandle.select().from(jsKeyPosts);
     expect(Object.keys(listed[0]!).sort()).toEqual(["createdAt", "id", "title"]);
     expect("created_at" in listed[0]!).toBe(false);
 
-    const got = await handle.findById(posts, "p1");
+    const got = await sharedHandle.findById(jsKeyPosts, "p1");
     expect(Object.keys(got!).sort()).toEqual(["createdAt", "id", "title"]);
     expect("created_at" in got!).toBe(false);
-
-    await conn.close();
   });
 });
 

package/src/elements/store/sql-session.test.ts

@@ -4,9 +4,13 @@
  * Relational `with:` / Drizzle RQB (`db.query.*.findMany({ with })`) is a
  * documented limitation: effects, cache keys, and PII masking assume one
  * table per call, so no relational query surface may appear on the handle.
+ *
+ * Upsert / orderBy / like need the real Postgres dialect (PGlite). One warmed
+ * in-memory PGlite is shared for the whole file (cold WASM once); TRUNCATE
+ * isolates each test without a fresh `PGlite.create`.
  */
 
-import { describe, expect, test } from "bun:test";
+import { afterAll, beforeAll, beforeEach, describe, expect, test } from "bun:test";
 import { and, desc, eq, like, lt, or } from "drizzle-orm";
 import { integer, pgTable, text } from "drizzle-orm/pg-core";
 import { pgliteDriver } from "../../drivers/pglite.ts";
@@ -19,31 +23,38 @@ const posts = pgTable("posts", {
   createdAt: integer("created_at").notNull(),
 });
 
-async function openHandle(): Promise<{ handle: SqlStoreHandle; conn: SqlConnection }> {
-  const conn = await pgliteDriver.connect({
-    url: "memory://",
+/** File-scoped warmed PGlite — opened in {@link beforeAll}. */
+let sharedConn: SqlConnection;
+/** Handle over {@link sharedConn}. */
+let sharedHandle: SqlStoreHandle;
+
+beforeAll(async () => {
+  sharedConn = await pgliteDriver.connect({
+    url: "memory://sql-session-shared",
     role: "primary",
   });
-  const handle = createSqlStoreHandle("sql:app", {
-    connection: conn,
+  sharedHandle = createSqlStoreHandle("sql:app", {
+    connection: sharedConn,
     classifications: new Map(),
     routedRole: "primary",
     domainDdl: "ensure",
   });
-  return { handle, conn };
-}
+  // Warm DDL via the insert path (pgTable is not a TableHandle for ensureTable).
+  await sharedHandle.insert(posts).values({ id: "_warmup", title: "x", createdAt: 0 });
+  await sharedConn.exec(`TRUNCATE "posts" RESTART IDENTITY CASCADE`);
+}, 15_000);
+
+afterAll(async () => {
+  await sharedConn.close();
+});
+
+beforeEach(async () => {
+  await sharedConn.exec(`TRUNCATE "posts" RESTART IDENTITY CASCADE`);
+});
 
 describe("SqlStoreHandle — no relational query surface (path b)", () => {
-  test("created handle exposes exactly the single-table surface", async () => {
-    const conn = await pgliteDriver.connect({ url: "memory://", role: "primary" });
-    const handle = createSqlStoreHandle("sql:app", {
-      connection: conn,
-      classifications: new Map(),
-      routedRole: "primary",
-      domainDdl: "ensure",
-    });
-
-    expect(Object.keys(handle).sort()).toEqual(
+  test("created handle exposes exactly the single-table surface", () => {
+    expect(Object.keys(sharedHandle).sort()).toEqual(
       [
         "ref",
         "routedRole",
@@ -64,47 +75,40 @@ describe("SqlStoreHandle — no relational query surface (path b)", () => {
     );
 
     // No Drizzle RQB / with: surface — ever.
-    expect("query" in handle).toBe(false);
-    expect("findMany" in handle).toBe(false);
-    expect("findFirst" in handle).toBe(false);
-    expect("with" in handle).toBe(false);
-
-    await conn.close();
+    expect("query" in sharedHandle).toBe(false);
+    expect("findMany" in sharedHandle).toBe(false);
+    expect("findFirst" in sharedHandle).toBe(false);
+    expect("with" in sharedHandle).toBe(false);
   });
 });
 
 describe("SqlStoreHandle — orderBy / limit select chain", () => {
   test("orderBy + limit without where", async () => {
-    const { handle, conn } = await openHandle();
-    await handle.insert(posts).values({ id: "p1", title: "one", createdAt: 100 });
-    await handle.insert(posts).values({ id: "p2", title: "two", createdAt: 300 });
-    await handle.insert(posts).values({ id: "p3", title: "three", createdAt: 200 });
+    await sharedHandle.insert(posts).values({ id: "p1", title: "one", createdAt: 100 });
+    await sharedHandle.insert(posts).values({ id: "p2", title: "two", createdAt: 300 });
+    await sharedHandle.insert(posts).values({ id: "p3", title: "three", createdAt: 200 });
 
-    const rows = await handle.select().from(posts).orderBy(desc(posts.createdAt)).limit(2);
+    const rows = await sharedHandle.select().from(posts).orderBy(desc(posts.createdAt)).limit(2);
     expect(rows.map((r) => r.id)).toEqual(["p2", "p3"]);
-    await conn.close();
   });
 
   test("limit directly on from() — no where required", async () => {
-    const { handle, conn } = await openHandle();
-    await handle.insert(posts).values({ id: "p1", title: "one", createdAt: 100 });
-    await handle.insert(posts).values({ id: "p2", title: "two", createdAt: 300 });
+    await sharedHandle.insert(posts).values({ id: "p1", title: "one", createdAt: 100 });
+    await sharedHandle.insert(posts).values({ id: "p2", title: "two", createdAt: 300 });
 
-    const rows = await handle.select().from(posts).limit(1);
+    const rows = await sharedHandle.select().from(posts).limit(1);
     expect(rows).toHaveLength(1);
-    await conn.close();
   });
 
   test("composite cursor predicate: where → orderBy → limit", async () => {
-    const { handle, conn } = await openHandle();
-    await handle.insert(posts).values({ id: "p1", title: "one", createdAt: 100 });
-    await handle.insert(posts).values({ id: "p2", title: "two", createdAt: 300 });
-    await handle.insert(posts).values({ id: "p3", title: "three", createdAt: 200 });
+    await sharedHandle.insert(posts).values({ id: "p1", title: "one", createdAt: 100 });
+    await sharedHandle.insert(posts).values({ id: "p2", title: "two", createdAt: 300 });
+    await sharedHandle.insert(posts).values({ id: "p3", title: "three", createdAt: 200 });
     // Tie on createdAt=200 with an id that sorts after the cursor id.
-    await handle.insert(posts).values({ id: "p0", title: "four", createdAt: 200 });
+    await sharedHandle.insert(posts).values({ id: "p0", title: "four", createdAt: 200 });
 
     const order = [desc(posts.createdAt), desc(posts.id)] as const;
-    const page1 = await handle
+    const page1 = await sharedHandle
       .select()
       .from(posts)
       .orderBy(...order)
@@ -112,61 +116,54 @@ describe("SqlStoreHandle — orderBy / limit select chain", () => {
     expect(page1.map((r) => r.id)).toEqual(["p2", "p3"]);
 
     // (createdAt, id) < (200, "p3") — the second page of a keyset cursor.
-    const page2 = await handle
+    const page2 = await sharedHandle
       .select()
       .from(posts)
       .where(or(lt(posts.createdAt, 200), and(eq(posts.createdAt, 200), lt(posts.id, "p3"))))
       .orderBy(...order)
       .limit(2);
     expect(page2.map((r) => r.id)).toEqual(["p0", "p1"]);
-    await conn.close();
   });
 
   test("like filters rows through the session (postgres case-sensitive)", async () => {
-    const { handle, conn } = await openHandle();
-    await handle.insert(posts).values({ id: "p1", title: "alpha", createdAt: 100 });
-    await handle.insert(posts).values({ id: "p2", title: "bravo", createdAt: 200 });
+    await sharedHandle.insert(posts).values({ id: "p1", title: "alpha", createdAt: 100 });
+    await sharedHandle.insert(posts).values({ id: "p2", title: "bravo", createdAt: 200 });
 
-    const rows = await handle.select().from(posts).where(like(posts.title, "a%"));
+    const rows = await sharedHandle.select().from(posts).where(like(posts.title, "a%"));
     expect(rows.map((r) => r.id)).toEqual(["p1"]);
-    await conn.close();
   });
 });
 
 describe("SqlStoreHandle — upsert", () => {
   test("default inserts once then already-existed without touching the row", async () => {
-    const { handle, conn } = await openHandle();
-    const first = await handle.upsert(
+    const first = await sharedHandle.upsert(
       posts,
       { id: "welcome" },
       { id: "welcome", title: "Hello", createdAt: 1 },
     );
     expect(first.status).toBe("upserted");
 
-    const second = await handle.upsert(
+    const second = await sharedHandle.upsert(
       posts,
       { id: "welcome" },
       { id: "welcome", title: "Changed", createdAt: 2 },
     );
     expect(second.status).toBe("already-existed");
 
-    const row = await handle.findById(posts, "welcome");
+    const row = await sharedHandle.findById(posts, "welcome");
     expect(row).toEqual({ id: "welcome", title: "Hello", createdAt: 1 });
-    await conn.close();
   });
 
   test("onExisting update changes matched columns", async () => {
-    const { handle, conn } = await openHandle();
-    await handle.upsert(posts, { id: "n1" }, { id: "n1", title: "one", createdAt: 10 });
-    const updated = await handle.upsert(
+    await sharedHandle.upsert(posts, { id: "n1" }, { id: "n1", title: "one", createdAt: 10 });
+    const updated = await sharedHandle.upsert(
       posts,
       { id: "n1" },
       { id: "n1", title: "two", createdAt: 20 },
       { onExisting: "update" },
     );
     expect(updated.status).toBe("changed");
-    const row = await handle.findById(posts, "n1");
+    const row = await sharedHandle.findById(posts, "n1");
     expect(row).toEqual({ id: "n1", title: "two", createdAt: 20 });
-    await conn.close();
   });
 });

package/src/elements/vault/builtin-adapter.test.ts

@@ -3,9 +3,12 @@
  *
  * Runs against a real PGlite instance so the SQL (DDL, `bytea` round-trip,
  * `DISTINCT ON`, `jsonb`) is exercised rather than mocked.
+ *
+ * One warmed in-memory PGlite is shared for the whole file (cold WASM once);
+ * {@link resetVaultTables} isolates each test without a fresh `PGlite.create`.
  */
 
-import { describe, expect, test } from "bun:test";
+import { afterAll, beforeAll, describe, expect, test } from "bun:test";
 import { connectPglite } from "../../drivers/pglite.ts";
 import type { SqlConnection } from "../../drivers/types.ts";
 import {
@@ -16,10 +19,22 @@ import {
 import { generateMasterKey, masterKeyToBase64 } from "./crypto.ts";
 import { isVaultError, VaultError } from "./errors.ts";
 import type { SqlExec } from "./storage.ts";
+import { resetVaultTables } from "./test-helpers.ts";
 
 const PATH = "prod/api/stripe";
 const VALUE = "sk_live_do_not_log_me";
 
+/** File-scoped warmed PGlite — opened in {@link beforeAll}. */
+let sharedConn: SqlConnection;
+
+beforeAll(async () => {
+  sharedConn = await connectPglite({ url: "memory://vault-adapter-shared" });
+}, 15_000);
+
+afterAll(async () => {
+  await sharedConn.close();
+});
+
 /**
  * Adapt a driver connection to the Vault's {@link SqlExec} surface.
  *
@@ -29,7 +44,7 @@ function asExec(conn: SqlConnection): SqlExec {
   return sqlConnectionAsExec(conn);
 }
 
-/** An adapter over a fresh in-memory PGlite, plus its teardown. */
+/** An initialized, unsealed adapter over the shared PGlite, plus a no-op close. */
 interface Harness {
   readonly adapter: BuiltinVaultAdapter;
   readonly db: SqlExec;
@@ -38,13 +53,13 @@ interface Harness {
 }
 
 /**
- * Boot an initialized, unsealed adapter over a fresh PGlite instance.
+ * Boot an initialized, unsealed adapter over the shared PGlite (tables reset).
  *
  * @param options - Rewrap batch size for rotation tests
  */
 async function harness(options: { batchSize?: number } = {}): Promise<Harness> {
-  const conn = await connectPglite({ url: "memory://vault-test" });
-  const db = asExec(conn);
+  await resetVaultTables(sharedConn);
+  const db = asExec(sharedConn);
   const adapter = createBuiltinVaultAdapter({
     db,
     ...(options.batchSize === undefined ? {} : { kekRewrapBatchSize: options.batchSize }),
@@ -55,31 +70,29 @@ async function harness(options: { batchSize?: number } = {}): Promise<Harness> {
     adapter,
     db,
     masterKey: init.masterKey,
-    close: () => conn.close(),
+    async close() {
+      /* shared connection — closed in afterAll */
+    },
   };
 }
 
 describe("builtin vault adapter — lifecycle", () => {
   test("initialize returns the master key once and refuses a second run", async () => {
-    const conn = await connectPglite({ url: "memory://vault-test" });
-    try {
-      const adapter = createBuiltinVaultAdapter({ db: asExec(conn) });
-      const init = await adapter.initialize();
+    await resetVaultTables(sharedConn);
+    const adapter = createBuiltinVaultAdapter({ db: asExec(sharedConn) });
+    const init = await adapter.initialize();
 
-      expect(init.masterKey).toMatch(/^[A-Za-z0-9+/]+=*$/);
-      expect(init.verifyHash).toMatch(/^[0-9a-f]{64}$/);
-      expect(init.kekVersion).toBe(1);
+    expect(init.masterKey).toMatch(/^[A-Za-z0-9+/]+=*$/);
+    expect(init.verifyHash).toMatch(/^[0-9a-f]{64}$/);
+    expect(init.kekVersion).toBe(1);
 
-      const status = await adapter.status();
-      expect(status.initialized).toBe(true);
-      expect(status.sealed).toBe(true);
-      expect(status.masterKeyPresent).toBe(true);
+    const status = await adapter.status();
+    expect(status.initialized).toBe(true);
+    expect(status.sealed).toBe(true);
+    expect(status.masterKeyPresent).toBe(true);
 
-      const failure = await adapter.initialize().catch((e: unknown) => e);
-      expect(isVaultError(failure, "ALREADY_INITIALIZED")).toBe(true);
-    } finally {
-      await conn.close();
-    }
+    const failure = await adapter.initialize().catch((e: unknown) => e);
+    expect(isVaultError(failure, "ALREADY_INITIALIZED")).toBe(true);
   });
 
   test("unseal + set/get round-trips a secret", async () => {
@@ -303,51 +316,94 @@ describe("builtin vault adapter — master rotation", () => {
     }
   });
 
-  test("continueRotateMaster cold-resumes from rewrap_key_hash after process death", async () => {
-    const conn = await connectPglite({ url: "memory://vault-cold-resume" });
-    const db = asExec(conn);
+  test("rotateMaster: concurrent callers — exactly one wins, loser fails before any DEK rewrite", async () => {
+    const h = await harness({ batchSize: 2 });
     try {
-      const first = createBuiltinVaultAdapter({ db, kekRewrapBatchSize: 2 });
-      const init = await first.initialize();
-      await first.unseal(init.masterKey);
-      for (let i = 0; i < 5; i += 1) {
-        await first.set(`prod/api/key-${i}`, `value-${i}`);
+      for (let i = 0; i < 6; i += 1) {
+        await h.adapter.set(`prod/race/${i}`, `v-${i}`);
       }
+      const other = createBuiltinVaultAdapter({
+        db: h.db,
+        kekRewrapBatchSize: 2,
+        rotateLeaseMs: 5_000,
+      });
+      await other.unseal(h.masterKey);
 
-      const next = generateMasterKey();
-      const nextB64 = masterKeyToBase64(next);
-      let progress = await first.rotateMaster(next);
-      expect(progress.remaining).toBe(3);
-      expect((await first.status()).rewrapTargetKekVersion).toBe(2);
+      const keyA = generateMasterKey();
+      const keyB = generateMasterKey();
+      const before = await h.db.query<{ n: string }>(
+        `SELECT COUNT(*)::text AS n FROM oke_vault_keys WHERE kek_version = 2`,
+      );
+      expect(before[0]?.n).toBe("0");
 
-      // Simulate process death: drop in-memory pending, reopen over the same DB.
-      const second = createBuiltinVaultAdapter({ db, kekRewrapBatchSize: 2 });
-      await second.unseal(init.masterKey);
-      expect((await second.status()).rewrapTargetKekVersion).toBe(2);
+      const [ra, rb] = await Promise.allSettled([
+        h.adapter.rotateMaster(keyA),
+        other.rotateMaster(keyB),
+      ]);
+      expect([ra, rb].filter((r) => r.status === "fulfilled")).toHaveLength(1);
+      expect([ra, rb].filter((r) => r.status === "rejected")).toHaveLength(1);
 
-      const wrong = await second.continueRotateMaster().catch((e: unknown) => e);
-      expect(isVaultError(wrong, "INVALID_KEY")).toBe(true);
+      const loser = ra.status === "rejected" ? ra : rb;
+      expect(
+        loser.status === "rejected" && loser.reason instanceof Error ? loser.reason.message : "",
+      ).toMatch(/lease held|already in progress/i);
 
-      progress = await second.continueRotateMaster(nextB64);
-      while (progress.remaining > 0) {
-        progress = await second.continueRotateMaster(nextB64);
-      }
-      expect(progress.remaining).toBe(0);
-      expect((await second.status()).kekVersion).toBe(2);
-      expect((await second.status()).rewrapTargetKekVersion).toBeUndefined();
+      // Loser must not have wrapped any DEK under its key: at most the winner's batch.
+      const mid = await h.db.query<{ kek_version: string; n: string }>(
+        `SELECT kek_version::text, COUNT(*)::text AS n FROM oke_vault_keys GROUP BY kek_version ORDER BY 1`,
+      );
+      const v2 = mid.find((r) => r.kek_version === "2");
+      expect(Number(v2?.n ?? "0")).toBeLessThanOrEqual(2);
+    } finally {
+      await h.close();
+    }
+  });
 
-      for (let i = 0; i < 5; i += 1) {
-        expect((await second.get(`prod/api/key-${i}`))?.value).toBe(`value-${i}`);
-      }
+  test("continueRotateMaster cold-resumes from rewrap_key_hash after process death", async () => {
+    await resetVaultTables(sharedConn);
+    const db = asExec(sharedConn);
+    const first = createBuiltinVaultAdapter({ db, kekRewrapBatchSize: 2 });
+    const init = await first.initialize();
+    await first.unseal(init.masterKey);
+    for (let i = 0; i < 5; i += 1) {
+      await first.set(`prod/api/key-${i}`, `value-${i}`);
+    }
 
-      await second.seal();
-      const stale = await second.unseal(init.masterKey).catch((e: unknown) => e);
-      expect(isVaultError(stale, "INVALID_KEY")).toBe(true);
-      await second.unseal(nextB64);
-      expect((await second.get("prod/api/key-0"))?.value).toBe("value-0");
-    } finally {
-      await conn.close();
+    const next = generateMasterKey();
+    const nextB64 = masterKeyToBase64(next);
+    let progress = await first.rotateMaster(next);
+    expect(progress.remaining).toBe(3);
+    expect((await first.status()).rewrapTargetKekVersion).toBe(2);
+
+    // Simulate process death: drop in-memory pending, expire the rotate lease
+    // (lazy reclaim — same physics as SIGKILL + lease TTL).
+    await db.execute(`UPDATE oke_vault_status SET rotate_lease_expires_at = $1 WHERE id = 1`, [
+      Date.now() - 1,
+    ]);
+    const second = createBuiltinVaultAdapter({ db, kekRewrapBatchSize: 2 });
+    await second.unseal(init.masterKey);
+    expect((await second.status()).rewrapTargetKekVersion).toBe(2);
+
+    const wrong = await second.continueRotateMaster().catch((e: unknown) => e);
+    expect(isVaultError(wrong, "INVALID_KEY")).toBe(true);
+
+    progress = await second.continueRotateMaster(nextB64);
+    while (progress.remaining > 0) {
+      progress = await second.continueRotateMaster(nextB64);
+    }
+    expect(progress.remaining).toBe(0);
+    expect((await second.status()).kekVersion).toBe(2);
+    expect((await second.status()).rewrapTargetKekVersion).toBeUndefined();
+
+    for (let i = 0; i < 5; i += 1) {
+      expect((await second.get(`prod/api/key-${i}`))?.value).toBe(`value-${i}`);
     }
+
+    await second.seal();
+    const stale = await second.unseal(init.masterKey).catch((e: unknown) => e);
+    expect(isVaultError(stale, "INVALID_KEY")).toBe(true);
+    await second.unseal(nextB64);
+    expect((await second.get("prod/api/key-0"))?.value).toBe("value-0");
   });
 });
 
@@ -458,6 +514,7 @@ describe("builtin vault adapter — audit and backup", () => {
 
       const blob = await h.adapter.exportBackup();
       expect(Buffer.from(blob).toString("utf8")).toStartWith("oke-vault-backup-v1\n");
+      expect(Buffer.from(blob).toString("utf8")).toEndWith("oke-vault-backup-end\n");
       expect(Buffer.from(blob).toString("utf8")).not.toContain("prod/db/main");
 
       await h.adapter.delete("prod/api/stripe");