okengine 0.23.1 → 0.23.2

package/src/kernel/boot-bind/store.ts

@@ -24,6 +24,7 @@ import { postgresDriver } from "../../drivers/postgres.ts";
 import { redisDriver } from "../../drivers/redis.ts";
 import { s3Driver } from "../../drivers/s3.ts";
 import type { FilesDriver, IndexDriver, KvDriver, SqlDriver } from "../../drivers/types.ts";
+import { bunRedisCacheClient } from "../../elements/store/cache-bus.ts";
 import { createStoreRuntime, type StoreRuntime } from "../../elements/store.ts";
 import type { SqlRuntimeBinding } from "../../elements/store/runtime.ts";
 import type { StoreDecl } from "../../elements/store/declare.ts";
@@ -171,7 +172,14 @@ export function bindStore(
   const autoPush = resolveAutoPush(options);
   const domainDdl = resolveDomainDdlMode(env, autoPush);
 
-  const store = createStoreRuntime({
+  let store!: StoreRuntime;
+  const cacheBus =
+    kvId === "redis" && kvUrl
+      ? { kind: "redis" as const, redis: bunRedisCacheClient(kvUrl) }
+      : sqlId === "postgres" && sqlUrl
+        ? { kind: "postgres" as const, sql: () => store.primarySql() }
+        : undefined;
+  store = createStoreRuntime({
     drivers: {
       sql: sqlDriverFor(sqlId),
       kv: kvDriverFor(kvId),
@@ -183,6 +191,13 @@ export function bindStore(
     files: filesBindings,
     index: indexBindings,
     now,
+    ...(options.cache?.maxEntries !== undefined
+      ? { cacheMaxEntries: options.cache.maxEntries }
+      : {}),
+    ...(options.cache?.defaultTtlMs !== undefined
+      ? { cacheDefaultTtlMs: options.cache.defaultTtlMs }
+      : {}),
+    ...(cacheBus ? { cacheBus } : {}),
     domainDdl,
     sqlUrl,
   });

package/src/kernel/boot.test.ts

@@ -285,8 +285,8 @@ describe("boot — cron autostart via real timer loop", () => {
     // Drive the wall-clock interval that boot installed — not clock.advance /
     // runNow / dispatchEvery (those prove the harness, not autostart).
     jest.advanceTimersByTime(1000);
-    // Interval callback does `void clock.tick()`; drain the async store walk.
-    for (let i = 0; i < 50; i++) await Promise.resolve();
+    // The tick is guarded and async. Wait until it settles, but not forever.
+    for (let i = 0; i < 50 && ran < 1; i++) await Promise.resolve();
 
     expect(ran).toBeGreaterThanOrEqual(1);
 

package/src/kernel/boot.ts

@@ -182,6 +182,13 @@ export interface BootOptions {
   readonly onDurableResume?: () => void | Promise<void>;
   /** Durable-run lease duration ms (default 30_000 — matches Signal claims). */
   readonly journalLeaseMs?: number;
+  /** Opt-in durable code version. Unset skips the stamp and the check. */
+  readonly codeVersion?: string;
+  /** Tier-1 cache bounds. Defaults: 10_000 entries, 60s TTL. */
+  readonly cache?: {
+    readonly maxEntries?: number;
+    readonly defaultTtlMs?: number;
+  };
   /** Injectable clock for test / frozen harnesses. */
   readonly now?: () => number;
   /**
@@ -539,16 +546,20 @@ export async function bootApplication(input: BootOptions = {}): Promise<BootResu
 
   // 4d. Scheduler — one timer drives clock ticks, durable-run resume, heartbeat.
   let schedulerTimer: ReturnType<typeof setInterval> | undefined;
+  const inflight = new Map<string, Promise<void>>();
+  let stopping = false;
   const startScheduler = options.startScheduler ?? env !== "test";
   const signalBus = signal?.bus ?? undefined;
   let refreshChannel: (() => Promise<void>) | undefined;
+  const pollCache = store?.cacheInvalidation === "postgres";
   if (
     startScheduler &&
     (clock !== undefined ||
       journal !== undefined ||
       instances !== undefined ||
       signalBus !== undefined ||
-      needs.channel)
+      needs.channel ||
+      pollCache)
   ) {
     const period = options.schedulerIntervalMs ?? 1000;
     const clockRt = clock;
@@ -560,18 +571,30 @@ export async function bootApplication(input: BootOptions = {}): Promise<BootResu
       // Unexpected scheduler failures stay visible.
       console.error(err);
     };
+    const spawn = (name: string, task: () => Promise<unknown>): void => {
+      if (stopping || inflight.has(name)) return;
+      const run = Promise.resolve()
+        .then(task)
+        .then(() => undefined)
+        .catch(ignoreBenignSql)
+        .finally(() => {
+          inflight.delete(name);
+        });
+      inflight.set(name, run);
+    };
     schedulerTimer = setInterval(() => {
-      if (signalBus) void signalBus.drain().catch(ignoreBenignSql);
-      if (refreshChannel) void refreshChannel().catch(ignoreBenignSql);
-      if (clockRt) void Promise.resolve(clockRt.tick()).catch(ignoreBenignSql);
-      if (journal && durableResume) void Promise.resolve(durableResume()).catch(ignoreBenignSql);
-      if (fleet) void fleet.maybeHeartbeat().catch(ignoreBenignSql);
+      if (signalBus) spawn("signal", () => signalBus.drain());
+      if (refreshChannel) spawn("channel", () => refreshChannel!());
+      if (clockRt) spawn("clock", () => Promise.resolve(clockRt.tick()));
+      if (journal && durableResume) spawn("durable", () => Promise.resolve(durableResume()));
+      if (fleet) spawn("fleet", () => fleet.maybeHeartbeat());
+      if (pollCache && store) spawn("cache", () => store.pollCacheInvalidations());
       const stem = ["run", "events"].join("-");
-      void import(`../elements/ai/${stem}.ts`)
-        .then((mod: typeof import("../elements/ai/run-events.ts")) =>
-          mod.sweepInstalledAgentEvents(),
-        )
-        .catch(ignoreBenignSql);
+      spawn("agents", () =>
+        import(`../elements/ai/${stem}.ts`).then(
+          (mod: typeof import("../elements/ai/run-events.ts")) => mod.sweepInstalledAgentEvents(),
+        ),
+      );
     }, period);
     schedulerTimer.unref?.();
   }
@@ -653,7 +676,12 @@ export async function bootApplication(input: BootOptions = {}): Promise<BootResu
     instanceId,
     instances,
     capabilities,
+    /**
+     * Stop the scheduler interval and wake timers.
+     * Does not wait for a tick that has already started — {@link BootResult.close} does.
+     */
     stopScheduler() {
+      stopping = true;
       if (schedulerTimer !== undefined) {
         clearInterval(schedulerTimer);
         schedulerTimer = undefined;
@@ -661,11 +689,13 @@ export async function bootApplication(input: BootOptions = {}): Promise<BootResu
       clock?.stopWakes();
     },
     async close() {
+      stopping = true;
       if (schedulerTimer !== undefined) {
         clearInterval(schedulerTimer);
         schedulerTimer = undefined;
       }
       clock?.stopWakes();
+      await Promise.all([...inflight.values()]);
       await signal?.close();
       await vault?.close();
       await runs?.flush();

package/src/kernel/boundary-contract.ts

@@ -30,6 +30,13 @@ export interface BoundaryContract<
    * (`oke doctor --diff` / CI gate).
    */
   readonly breaking?: boolean;
+  /** Per-route body cap in bytes. Falls back to the app `maxRequestBodySize`. */
+  readonly maxBodySize?: number;
+  /**
+   * `required` (default) rejects a JSON-shaped body that is not
+   * `application/json` or `+json`. `any` keeps the previous parse-or-string behavior.
+   */
+  readonly jsonContentType?: "required" | "any";
 }
 
 /** Infer validated input from a {@link BoundaryContract} bag. */

package/src/kernel/builtin-errors.ts

@@ -15,6 +15,7 @@ export const BUILTIN_ERROR_STATUS = {
   Conflict: 409,
   ForeignKey: 409,
   UnsupportedMediaType: 415,
+  PayloadTooLarge: 413,
   RateLimited: 429,
   AuthRateLimited: 429,
   InvalidQuery: 400,
@@ -78,6 +79,7 @@ export type BuiltinErrorMap = {
   readonly Conflict: BuiltinErrorBag;
   readonly ForeignKey: BuiltinErrorBag;
   readonly UnsupportedMediaType: BuiltinErrorBag;
+  readonly PayloadTooLarge: BuiltinErrorBag;
   readonly RateLimited: { readonly retryAfterMs?: number };
   readonly AuthRateLimited: BuiltinErrorBag;
   readonly InvalidQuery: BuiltinErrorBag;

package/src/kernel/call.test.ts

@@ -112,6 +112,7 @@ describe("fx.call — untriggered flows", () => {
     const a = await app.fetch(
       new Request("http://localhost/work", {
         method: "POST",
+        headers: { "content-type": "application/json" },
         body: JSON.stringify({ v: 10 }),
       }),
     );

package/src/kernel/fx-sql-handle.ts

@@ -17,7 +17,7 @@ import { schemaTableName, sqlTableRef } from "../manifest/sql-resource.ts";
 import type { CapabilityToken } from "./capability.ts";
 import { DryRunWriteIsolationError, isDryRun } from "./dry-run.ts";
 import type { EffectExternal } from "./effects.ts";
-import { runInSignalTransaction } from "./signal-tx.ts";
+import { currentSignalTransaction, runInSignalTransaction } from "./signal-tx.ts";
 
 /** Capability-gated effect runner from {@link createFx}. */
 type Gated = <T>(
@@ -253,6 +253,12 @@ export function createGatedSqlHandle(options: GatedSqlHandleOptions): SqlStoreHa
     async transaction(fn) {
       refuseDryRunWrite();
       const h = await ensure();
+      // Already inside a signal transaction: do not begin or commit another
+      // one. sql-session opens a child staging scope and merges it; only the
+      // outermost commit publishes.
+      if (currentSignalTransaction()) {
+        return h.transaction(() => fn(api));
+      }
       const signalTx = options.beginSignal ? await options.beginSignal() : undefined;
       try {
         const result = await h.transaction(async () => {

package/src/kernel/horizontal-child.ts

@@ -20,6 +20,8 @@ import { dirname, join } from "node:path";
 import { createPostgresCronStore } from "../drivers/clock-postgres.ts";
 import { createPostgresJournalStore } from "../drivers/journal-postgres.ts";
 import { memorySignalDriver } from "../drivers/signal-memory.ts";
+import { createBunSignalRedisClient, redisSignalDriver } from "../drivers/signal-redis.ts";
+import { bunRedisCacheClient } from "../elements/store/cache-bus.ts";
 import { postgresDriver } from "../drivers/postgres.ts";
 import { redisDriver } from "../drivers/redis.ts";
 import { clock } from "../elements/clock/declare.ts";
@@ -99,14 +101,40 @@ clockRt.onCron(CRON, async () => {
   await Bun.write(path, prev + line);
 });
 
+const redisSignals = process.env.OKE_HORIZONTAL_REDIS_SIGNALS === "1";
 const signalRt = createSignalRuntime({
-  driver: memorySignalDriver,
+  driver: redisSignals ? redisSignalDriver : memorySignalDriver,
+  ...(redisSignals
+    ? { redis: createBunSignalRedisClient(redisUrl), compete: true, consumerId: instanceId }
+    : {}),
   durablePath: signalPath,
   leaseMs: Number.isFinite(leaseMs) ? leaseMs : 300,
 });
 const job = signal.once(SIG, { retries: 3, deadLetter: true, optional: true });
 signalRt.register(job);
+const news = signal.broadcast("horizontal-news", { optional: true });
+const feed = signal.live("horizontal-feed", { optional: true });
+if (redisSignals) {
+  signalRt.register(news);
+  signalRt.register(feed);
+}
 const bus = await signalRt.start();
+if (redisSignals) {
+  await bus.subscribe("horizontal-news", `news-${instanceId}`, async (msg) => {
+    const line = `${JSON.stringify({ instanceId, kind: "broadcast", id: msg.id, at: Date.now() })}\n`;
+    const path = join(workDir, "broadcast.jsonl");
+    const prev = (await Bun.file(path).exists()) ? await Bun.file(path).text() : "";
+    await Bun.write(path, prev + line);
+  });
+  void (async () => {
+    for await (const event of bus.live("horizontal-feed")) {
+      const line = `${JSON.stringify({ instanceId, kind: "live", id: event.id, at: Date.now() })}\n`;
+      const path = join(workDir, "live.jsonl");
+      const prev = (await Bun.file(path).exists()) ? await Bun.file(path).text() : "";
+      await Bun.write(path, prev + line);
+    }
+  })();
+}
 await bus.subscribe(SIG, `consumer-${instanceId}`, async (msg) => {
   const line = `${JSON.stringify({ instanceId, kind: "signal", id: msg.id, at: Date.now() })}\n`;
   const path = join(workDir, "signal.jsonl");
@@ -129,6 +157,7 @@ const storeRt = createStoreRuntime({
   drivers: { sql: postgresDriver },
   sql: { db: { name: "db", primary: { url: pgUrl } } },
   now: () => Date.now(),
+  cacheBus: { kind: "redis", redis: bunRedisCacheClient(redisUrl), origin: instanceId },
 });
 storeRt.register(db);
 
@@ -138,7 +167,16 @@ const ping = flow("horizontal.ping", {
 const rate = flow("horizontal.rate", {
   do: () => ({ ok: true as const, instanceId }),
 });
+let cachedReads = 0;
+const cached = flow("horizontal.cached", {
+  effects: { reads: ["sql:db"] },
+  do: () => {
+    cachedReads += 1;
+    return { reads: cachedReads, instanceId };
+  },
+});
 const write = flow("horizontal.write", {
+  effects: { writes: ["sql:db"] },
   do: async (_input, fx) => {
     const id = okid();
     await fx
@@ -159,6 +197,18 @@ const emit = flow("horizontal.emit", {
     return { emitted: true as const };
   },
 });
+const publishNews = flow("horizontal.news", {
+  do: async (_input, fx) => {
+    await fx.emit("horizontal-news", { from: instanceId, at: Date.now() });
+    return { emitted: true as const };
+  },
+});
+const publishFeed = flow("horizontal.feed", {
+  do: async (_input, fx) => {
+    await fx.emit("horizontal-feed", { from: instanceId, at: Date.now() });
+    return { emitted: true as const };
+  },
+});
 const charge = flow("horizontal.charge", {
   durable: true,
   do: async (_input, fx) => {
@@ -193,8 +243,11 @@ const charge = flow("horizontal.charge", {
 const bindings: Binding[] = [
   { trigger: http.get("/ping").public(), flow: ping as AnyFlowDef },
   { trigger: http.get("/rate").gate(rateGate), flow: rate as AnyFlowDef },
+  { trigger: http.get("/cached").public(), flow: cached as AnyFlowDef },
   { trigger: http.post("/write").public(), flow: write as AnyFlowDef },
   { trigger: http.post("/emit").public(), flow: emit as AnyFlowDef },
+  { trigger: http.post("/news").public(), flow: publishNews as AnyFlowDef },
+  { trigger: http.post("/feed").public(), flow: publishFeed as AnyFlowDef },
   { trigger: http.post("/charge").public(), flow: charge as AnyFlowDef },
 ];
 

package/src/kernel/horizontal.integration.test.ts

@@ -124,10 +124,26 @@ describe.skipIf(!LIVE)("horizontal — two OS processes, Postgres + Redis", () =
       const traffic = async () => {
         for (let i = 0; i < 8; i++) {
           await Promise.all([
-            fetch(`${urlA}/write`, { method: "POST", body: "{}" }),
-            fetch(`${urlB}/write`, { method: "POST", body: "{}" }),
-            fetch(`${urlA}/emit`, { method: "POST", body: "{}" }),
-            fetch(`${urlB}/emit`, { method: "POST", body: "{}" }),
+            fetch(`${urlA}/write`, {
+              method: "POST",
+              headers: { "content-type": "application/json" },
+              body: "{}",
+            }),
+            fetch(`${urlB}/write`, {
+              method: "POST",
+              headers: { "content-type": "application/json" },
+              body: "{}",
+            }),
+            fetch(`${urlA}/emit`, {
+              method: "POST",
+              headers: { "content-type": "application/json" },
+              body: "{}",
+            }),
+            fetch(`${urlB}/emit`, {
+              method: "POST",
+              headers: { "content-type": "application/json" },
+              body: "{}",
+            }),
             fetch(`${urlA}/ping`),
             fetch(`${urlB}/ping`),
           ]);
@@ -150,7 +166,11 @@ describe.skipIf(!LIVE)("horizontal — two OS processes, Postgres + Redis", () =
       expect(limited).toBeGreaterThanOrEqual(1);
 
       // (2) Start durable on A; hang mid-step.
-      void fetch(`${urlA}/charge`, { method: "POST", body: "{}" });
+      void fetch(`${urlA}/charge`, {
+        method: "POST",
+        headers: { "content-type": "application/json" },
+        body: "{}",
+      });
       expect(await waitForFile(join(dir, "hang-inst-a.json"), 15_000)).toBe(true);
 
       // (5) Kill A mid combined scenario — B keeps serving.
@@ -177,8 +197,24 @@ describe.skipIf(!LIVE)("horizontal — two OS processes, Postgres + Redis", () =
       // Keep traffic going on survivor (no deadlock).
       await trafficPromise.catch(() => {});
       for (let i = 0; i < 4; i++) {
-        expect((await fetch(`${urlB}/write`, { method: "POST", body: "{}" })).status).toBe(200);
-        expect((await fetch(`${urlB}/emit`, { method: "POST", body: "{}" })).status).toBe(200);
+        expect(
+          (
+            await fetch(`${urlB}/write`, {
+              method: "POST",
+              headers: { "content-type": "application/json" },
+              body: "{}",
+            })
+          ).status,
+        ).toBe(200);
+        expect(
+          (
+            await fetch(`${urlB}/emit`, {
+              method: "POST",
+              headers: { "content-type": "application/json" },
+              body: "{}",
+            })
+          ).status,
+        ).toBe(200);
       }
 
       // (1) Cron fired exactly once across both instances.
@@ -220,6 +256,94 @@ describe.skipIf(!LIVE)("horizontal — two OS processes, Postgres + Redis", () =
       await cleanupC.close();
     }
   }, 90_000);
+
+  test("broadcast, live, and cache invalidation reach the other instance", async () => {
+    const pg = LIVE!.pg;
+    const redis = LIVE!.redis;
+    const dir = await mkdtemp(join(tmpdir(), "oke-horizontal-bus-"));
+    const signalPath = join(dir, "signal.json");
+    const post = (url: string) =>
+      fetch(url, {
+        method: "POST",
+        headers: { "content-type": "application/json" },
+        body: "{}",
+      });
+    const spawn = (instanceId: string, port: number) =>
+      Bun.spawn({
+        cmd: [
+          "bun",
+          childPath,
+          "serve",
+          instanceId,
+          String(port),
+          pg,
+          redis,
+          signalPath,
+          dir,
+          "5000",
+        ],
+        stdout: "pipe",
+        stderr: "pipe",
+        env: {
+          ...process.env,
+          DATABASE_URL: pg,
+          REDIS_URL: redis,
+          OKE_HORIZONTAL_REDIS_SIGNALS: "1",
+        },
+      });
+    const a = spawn("bus-a", 0);
+    const b = spawn("bus-b", 0);
+    try {
+      expect(await waitForFile(join(dir, "ready-bus-a.json"))).toBe(true);
+      expect(await waitForFile(join(dir, "ready-bus-b.json"))).toBe(true);
+      const readyA = (await Bun.file(join(dir, "ready-bus-a.json")).json()) as { port: number };
+      const readyB = (await Bun.file(join(dir, "ready-bus-b.json")).json()) as { port: number };
+      const urlA = `http://127.0.0.1:${readyA.port}`;
+      const urlB = `http://127.0.0.1:${readyB.port}`;
+      const first = (await (await fetch(`${urlA}/cached`)).json()) as { data: { reads: number } };
+      const second = (await (await fetch(`${urlA}/cached`)).json()) as { data: { reads: number } };
+      expect(first.data.reads).toBe(1);
+      expect(second.data.reads).toBe(1);
+      expect((await post(`${urlB}/write`)).status).toBe(200);
+      expect(
+        await waitFor(async () => {
+          const body = (await (await fetch(`${urlA}/cached`)).json()) as {
+            data: { reads: number };
+          };
+          return body.data.reads === 2;
+        }),
+      ).toBe(true);
+      expect((await post(`${urlA}/news`)).status).toBe(200);
+      expect((await post(`${urlA}/feed`)).status).toBe(200);
+      expect(
+        await waitFor(async () => {
+          const broadcast = await loadJsonl(join(dir, "broadcast.jsonl"));
+          const live = await loadJsonl(join(dir, "live.jsonl"));
+          const ids = (rows: Array<Record<string, unknown>>) =>
+            new Set(rows.map((row) => row.instanceId));
+          return (
+            ids(broadcast).has("bus-a") &&
+            ids(broadcast).has("bus-b") &&
+            ids(live).has("bus-a") &&
+            ids(live).has("bus-b")
+          );
+        }),
+      ).toBe(true);
+    } finally {
+      try {
+        a.kill(9);
+      } catch {
+        /* already dead */
+      }
+      try {
+        b.kill(9);
+      } catch {
+        /* ignore */
+      }
+      await Promise.allSettled([a.exited, b.exited]);
+      await rm(dir, { recursive: true, force: true });
+    }
+  }, 60_000);
 });
 
 if (!LIVE) {

package/src/kernel/idempotency.test.ts

@@ -349,13 +349,12 @@ describe("HTTP idempotency", () => {
     expect(await durableStore.idempotency!.forfeit(held!, held!.claimToken)).toBe(true);
     await Bun.sleep(120);
     const resumed = durable.fetch(post({ n: 1 }));
-    expect(await waitFor(() => blockers.length === 2)).toBe(true);
-    expect(step1).toEqual(["step1"]);
+    // The holder's heartbeat kept the lease, so the same process does not
+    // start a second session for the run still inside mid-flight.
+    expect((await resumed).status).toBe(409);
+    expect(blockers).toHaveLength(1);
     blockers[0]!();
-    blockers[1]!();
-    // The forfeited holder kept the old lease token. Its later write is rejected.
-    await expect(hung).rejects.toThrow(/OKE1074/);
-    expect((await resumed).status).toBe(200);
+    expect((await hung).status).toBe(200);
     expect(step1).toEqual(["step1"]);
   }, 30_000);
 

package/src/kernel/journal-boot.test.ts

@@ -22,6 +22,7 @@ import {
   type PostgresJournalStore,
 } from "../drivers/journal-postgres.ts";
 import { oke, type OkeApp } from "./app.ts";
+import { clearJournalHeartbeats } from "./journal.ts";
 import type { JournalRuntime } from "./boot-bind/journal.ts";
 import { flow, resetFlowSeq, type AnyFlowDef } from "./flow.ts";
 import type { Binding } from "./on.ts";
@@ -47,6 +48,7 @@ async function bootDurableApp(options: {
   readonly name: string;
   readonly journal: JournalRuntime;
   readonly bindings: readonly Binding[];
+  readonly now?: () => number;
 }): Promise<OkeApp> {
   const app = oke({
     name: options.name,
@@ -57,6 +59,7 @@ async function bootDurableApp(options: {
     // oke() in the process — sibling apps need their own copies.
     bindings: [...options.bindings],
     elements: { journal: options.journal },
+    ...(options.now ? { fx: { now: options.now } } : {}),
   });
   await app.boot();
   return app;
@@ -127,11 +130,18 @@ describe("journal boot — shared store, real boot paths (fake SQL)", () => {
       bindings,
     });
     // Start the run through the real HTTP path; it hangs inside step 2.
-    void appA.fetch(new Request("http://localhost/charge", { method: "POST", body: "{}" }));
+    void appA.fetch(
+      new Request("http://localhost/charge", {
+        method: "POST",
+        headers: { "content-type": "application/json" },
+        body: "{}",
+      }),
+    );
     expect(await waitFor(async () => blockers.length === 1)).toBe(true);
     const runId = (await store.list())[0]!.id;
-    // "Crash": no commit, no release — the lease (120ms) is left to expire.
-    // appA is deliberately never stopped; its promise stays dangling.
+    // "Crash": the process dies, so its heartbeat timers die with it.
+    // The in-flight promise stays dangling and the lease (120ms) expires.
+    clearJournalHeartbeats();
 
     await Bun.sleep(300);
     const appB = await bootDurableApp({
@@ -165,7 +175,11 @@ describe("journal boot — shared store, real boot paths (fake SQL)", () => {
       bindings,
     });
     const parked = await appA.fetch(
-      new Request("http://localhost/sleep", { method: "POST", body: "{}" }),
+      new Request("http://localhost/sleep", {
+        method: "POST",
+        headers: { "content-type": "application/json" },
+        body: "{}",
+      }),
     );
     expect(parked.status).toBe(204); // durable park — lease released, row sleeping
     const runId = (await store.list())[0]!.id;
@@ -198,7 +212,13 @@ describe("journal boot — shared store, real boot paths (fake SQL)", () => {
       journal: journalRuntime(store, "A", 5_000),
       bindings,
     });
-    await appA.fetch(new Request("http://localhost/sleep", { method: "POST", body: "{}" }));
+    await appA.fetch(
+      new Request("http://localhost/sleep", {
+        method: "POST",
+        headers: { "content-type": "application/json" },
+        body: "{}",
+      }),
+    );
     await appA.stop();
 
     // Both survivors boot while the sleep is future (orphan scan skips it).
@@ -217,10 +237,61 @@ describe("journal boot — shared store, real boot paths (fake SQL)", () => {
     await Promise.all([appB.resumeDurable(), appC.resumeDurable()]);
 
     expect(confirms).toHaveLength(1);
+
     await appB.stop();
     await appC.stop();
   });
 
+  test("resume uses a live clock: a lease written after the tick sample is not already expired", async () => {
+    let clock = 10_000_000;
+    const store = await createPostgresJournalStore({ sql: createPostgresJournalFake() });
+    const confirms: string[] = [];
+    const bindings = [sleeperBinding("120ms", confirms)];
+    const acquiredAt: number[] = [];
+    const acquire = store.acquireLease.bind(store);
+    store.acquireLease = async (runId, instanceId, at, leaseMs) => {
+      acquiredAt.push(at);
+      return acquire(runId, instanceId, at, leaseMs);
+    };
+    const claim = store.claimDueSleep.bind(store);
+    store.claimDueSleep = async (instanceId, at, leaseMs) => {
+      const due = await claim(instanceId, at, leaseMs);
+      // The tick already sampled `at`. A live run clock must see this jump.
+      if (due) clock += 2_700;
+      return due;
+    };
+
+    const appA = await bootDurableApp({
+      name: "clock-a",
+      journal: journalRuntime(store, "A", 5_000),
+      bindings,
+      now: () => clock,
+    });
+    await appA.fetch(
+      new Request("http://localhost/sleep", {
+        method: "POST",
+        headers: { "content-type": "application/json" },
+        body: "{}",
+      }),
+    );
+    await appA.stop();
+
+    const appB = await bootDurableApp({
+      name: "clock-b",
+      journal: journalRuntime(store, "B", 5_000),
+      bindings,
+      now: () => clock,
+    });
+    const before = clock;
+    clock = before + 500;
+    acquiredAt.length = 0;
+    await appB.resumeDurable();
+
+    const stamped = acquiredAt.find((at) => at >= before + 2_700);
+    expect(stamped).toBeDefined();
+    await appB.stop();
+  });
+
   test("boot orphan scan skips runs held under a live lease", async () => {
     const store = await createPostgresJournalStore({ sql: createPostgresJournalFake() });
     const step1Calls: string[] = [];
@@ -233,7 +304,13 @@ describe("journal boot — shared store, real boot paths (fake SQL)", () => {
       journal: journalRuntime(store, "A", 30_000),
       bindings,
     });
-    void appA.fetch(new Request("http://localhost/charge", { method: "POST", body: "{}" }));
+    void appA.fetch(
+      new Request("http://localhost/charge", {
+        method: "POST",
+        headers: { "content-type": "application/json" },
+        body: "{}",
+      }),
+    );
     expect(await waitFor(async () => blockers.length === 1)).toBe(true);
 
     // B boots while A's lease is live — must not steal the run.