milestone 33: contract closure — samples, file-authority enumeration, dead code, bundle ceiling

The routing rule is global, so the agent it names lives next to it now
(~/.claude/agents/opus-coder.md), at medium effort and without the
milestone-spec wording that only fit this repository.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

.gitea/workflows/gates.yml

@@ -101,11 +101,6 @@ jobs:
           sudo apt-get update -qq
           sudo apt-get install -qq -y --no-install-recommends qemu-user
 
-      # qemu 11.1.0 has a TCG regression: its translation-block optimization
-      # takes the panic branch of Zig's UBSan pointer-overflow check on a
-      # valid in-bounds pointer (11.0.3 and earlier are clean; bisected via
-      # the Arch archive). This image's qemu 8.2 is not affected — do not
-      # upgrade the emulator past 11.0.x until qemu fixes it.
       - name: Run test suite under qemu (plain suite, no -Dintegration)
         run: zig build test-aarch64 -fqemu
 

CHANGELOG.md

@@ -4,7 +4,7 @@ All notable changes to nxdns are recorded here. The format follows [Keep a Chang
 
 Sections are written by hand. Nothing here is generated from commit messages: the point of the file is to say what changed for an operator, which a commit subject rarely does.
 
-## [0.0.9] - 2026-08-22
+## [Unreleased]
 
 Query provenance: every logged query becomes exactly explainable — what the policy decided, what matched, where the answer came from and what the client saw. The handler records all of it as the reply goes out, `query_log` stores it, and a detail page reads one query back in the order the pipeline decided it. Read the upgrade note below first: it resets your query history.
 

admin/src/features/activity/LiveActivity.test.tsx

@@ -8,7 +8,7 @@
 
 import { act, fireEvent, render, screen, waitFor, within } from "@testing-library/react";
 import { QueryClientProvider } from "@tanstack/react-query";
-import { RouterContextProvider, RouterProvider, createMemoryHistory } from "@tanstack/react-router";
+import { RouterProvider, createMemoryHistory } from "@tanstack/react-router";
 import { AuthProvider } from "@/auth/store";
 import { createQueryClient } from "@/lib/queryClient";
 import { createAppRouter } from "@/routes";
@@ -16,17 +16,6 @@ import type { Client } from "@/lib/types";
 import { provenance, queryRow } from "@/features/provenance/provenanceFixture";
 import { health } from "@/lib/healthFixture";
 import { FakeEventSource } from "./fakeEventSource";
-import LiveActivity from "./LiveActivity";
-import type { ActivitySearch } from "./search";
-
-const LIVE_ORIGIN: ActivitySearch = {
-	mode: "live",
-	since: undefined,
-	until: undefined,
-	domain: undefined,
-	client: undefined,
-	blocked: undefined,
-};
 
 function client(ip: string, name: string, learnedName: string): Client {
 	return {
@@ -338,55 +327,23 @@ test("opening a second row moves the expanded state and the focus with it", asyn
 	expect(document.activeElement).toBe(second);
 });
 
-/**
- * The one render that bypasses the route, because the ring capacity is a
- * parameter of the component and the route deliberately never passes it:
- * evicting a row at the real 500 means pushing 500 frames through React state,
- * which proves nothing the fifth frame does not. The real route tree still
- * backs the links inside the detail.
- */
-function renderLiveWithCapacity(capacity: number) {
-	const queryClient = createQueryClient();
-	const router = createAppRouter(createMemoryHistory({ initialEntries: ["/activity?mode=live"] }), queryClient);
-	render(
-		<AuthProvider>
-			<QueryClientProvider client={queryClient}>
-				<RouterContextProvider router={router}>
-					<LiveActivity origin={LIVE_ORIGIN} capacity={capacity} />
-				</RouterContextProvider>
-			</QueryClientProvider>
-		</AuthProvider>,
-	);
-}
-
-test("an open streamed detail survives the row being evicted from the ring buffer", () => {
-	renderLiveWithCapacity(5);
-	act(() => sources[0]!.emit("open"));
+test("an open streamed detail survives the row being evicted from the ring buffer", async () => {
+	await openLive();
 	act(() => sources[0]!.emit("query", frame(1000, "evicted.example")));
 	fireEvent.click(screen.getByRole("button", { name: "evicted.example" }));
 	expect(screen.getByRole("heading", { level: 1, name: "evicted.example" })).toBeTruthy();
 
-	// One ringful more: the ring keeps the newest 5, so the selected row is gone
-	// from the table. The detail is a snapshot, not a lookup into the ring.
+	// 500 more queries: the ring keeps the newest 500, so the selected row is
+	// gone from the table. The detail is a snapshot, not a lookup into the ring.
 	act(() => {
-		for (let index = 0; index < 5; index += 1) {
+		for (let index = 0; index < 500; index += 1) {
 			sources[0]!.emit("query", frame(2000 + index, `filler${index}.example`));
 		}
 	});
-	expect(screen.getAllByRole("row")).toHaveLength(6);
 	expect(screen.queryByRole("button", { name: "evicted.example" })).toBeNull();
 	expect(screen.getByRole("heading", { level: 1, name: "evicted.example" })).toBeTruthy();
 });
 
-test("the route renders the live ring at its production capacity", async () => {
-	await openLive();
-	act(() => sources[0]!.emit("query", frame(1000, "pinned.example")));
-
-	expect(screen.getByText(/last 500 kept/)).toBeTruthy();
-	fireEvent.click(screen.getByRole("button", { name: "Freeze" }));
-	expect(screen.getByText(/newest 500 kept/)).toBeTruthy();
-});
-
 test("an open streamed detail survives Freeze and Resume", async () => {
 	await openLive();
 	act(() => sources[0]!.emit("query", frame(1000, "held.example")));

admin/src/features/activity/LiveActivity.tsx

@@ -276,19 +276,8 @@ function LiveDetail({ row, origin, onClose }: { row: StreamedRow; origin: Activi
 	);
 }
 
-/**
- * `capacity` is the ring size, a parameter only so a test can provoke an
- * eviction with a handful of rows rather than 500 frames through React state.
- * The route renders this without it, so the app is always the 500-row ring.
- */
-export default function LiveActivity({
-	origin,
-	capacity = RING_CAPACITY,
-}: {
-	origin: ActivitySearch;
-	capacity?: number;
-}) {
-	const live = useLiveQueries({ capacity });
+export default function LiveActivity({ origin }: { origin: ActivitySearch }) {
+	const live = useLiveQueries();
 	const clientNames = useClientNames();
 	const [selected, setSelected] = useState<StreamedRow | null>(null);
 	const trigger = useRef<HTMLButtonElement | null>(null);
@@ -323,7 +312,8 @@ export default function LiveActivity({
 
 			{live.frozen && (
 				<p {...stylex.props(styles.note)} role="status">
-					Display frozen — new queries keep buffering ({live.liveCount} in buffer, newest {capacity} kept).
+					Display frozen — new queries keep buffering ({live.liveCount} in buffer, newest {RING_CAPACITY}{" "}
+					kept).
 				</p>
 			)}
 
@@ -423,7 +413,7 @@ export default function LiveActivity({
 					</div>
 					<p {...stylex.props(styles.footnote)}>
 						Showing {live.rows.length} {live.rows.length === 1 ? "query" : "queries"} (newest first, last{" "}
-						{capacity} kept).
+						{RING_CAPACITY} kept).
 					</p>
 				</>
 			)}

admin/src/features/activity/useLiveQueries.ts

@@ -24,12 +24,6 @@ export interface LiveQueriesOptions {
 	fetchSince?: (since: number) => Promise<QueriesPage>;
 	/** Cheap session-gated GET fired once on entering capped, to distinguish an expired session from a real cap. */
 	probeSession?: () => Promise<unknown>;
-	/**
-	 * Ring size. Injectable so a test can provoke an eviction with a handful of
-	 * rows instead of pushing 500 frames through React state; the app never
-	 * passes it, and the operator never sees it.
-	 */
-	capacity?: number;
 }
 
 // A transient drop is invisible to EventSource beyond a bare `error` event;
@@ -40,10 +34,7 @@ export interface LiveQueriesOptions {
 export const CAP_ERROR_THRESHOLD = 3;
 
 const defaultEventSource: EventSourceFactory = (url) => new EventSource(url);
-const defaultFetchSince =
-	(capacity: number) =>
-	(since: number): Promise<QueriesPage> =>
-		api.getQueries({ since, limit: capacity });
+const defaultFetchSince = (since: number): Promise<QueriesPage> => api.getQueries({ since, limit: RING_CAPACITY });
 const defaultProbeSession = (): Promise<unknown> => api.getPause();
 
 function isUnauthorized(error: unknown): boolean {
@@ -88,8 +79,7 @@ export function useLiveQueries(options?: LiveQueriesOptions): LiveQueries {
 		errorsRef.current = 0;
 		setStatus("connecting");
 		const opts = optionsRef.current;
-		const capacity = opts?.capacity ?? RING_CAPACITY;
-		const fetchSince = opts?.fetchSince ?? defaultFetchSince(capacity);
+		const fetchSince = opts?.fetchSince ?? defaultFetchSince;
 		const probeSession = opts?.probeSession ?? defaultProbeSession;
 		const es = (opts?.createEventSource ?? defaultEventSource)(opts?.url ?? api.liveQueriesUrl);
 		esRef.current = es;
@@ -104,7 +94,7 @@ export function useLiveQueries(options?: LiveQueriesOptions): LiveQueries {
 				fetchSince(since).then(
 					(page) => {
 						if (esRef.current !== es) return;
-						const merged = mergeGap(bufferRef.current, page.queries, () => ++keyRef.current, capacity);
+						const merged = mergeGap(bufferRef.current, page.queries, () => ++keyRef.current);
 						bufferRef.current = merged.rows;
 						setRows(merged.rows);
 						setMissed(merged.missed);
@@ -132,11 +122,11 @@ export function useLiveQueries(options?: LiveQueriesOptions): LiveQueries {
 				return;
 			}
 			lastSeenTsRef.current = payload.request.time;
-			bufferRef.current = pushRow(
-				bufferRef.current,
-				{ kind: "streamed", event: payload, key: ++keyRef.current },
-				capacity,
-			);
+			bufferRef.current = pushRow(bufferRef.current, {
+				kind: "streamed",
+				event: payload,
+				key: ++keyRef.current,
+			});
 			setRows(bufferRef.current);
 		});
 

build.zig.zon

@@ -1,6 +1,6 @@
 .{
     .name = .nxdns,
-    .version = "0.0.9",
+    .version = "0.0.8",
     .minimum_zig_version = "0.16.0",
     .paths = .{""},
     .fingerprint = 0x3307b311dded1d91,

src/storage/logger.zig

@@ -1334,13 +1334,6 @@ test "shutdown writes the batch the writer holds and the rest of the queue" {
         &database,
         @as(?*disk_monitor.Monitor, null),
     });
-    // Declared after the `database.close` defer so LIFO stops the writer first:
-    // an early return anywhere below would otherwise close the handle under a
-    // live writer and leave `Threaded.deinit` joining a task nothing ends.
-    defer {
-        logger.shutdown(io);
-        future.await(io) catch {};
-    }
 
     var names: [250][32]u8 = undefined;
     for (&names, 0..) |*name, i| {
@@ -1427,12 +1420,6 @@ test "the writer holds an entry for the length of the flush interval" {
         &database,
         @as(?*disk_monitor.Monitor, null),
     });
-    // See the note in "shutdown writes the batch the writer holds": this must
-    // run before the deferred `database.close`.
-    defer {
-        logger.shutdown(io);
-        future.await(io) catch {};
-    }
 
     logger.log(io, sampleEntry(1, "only.example"));
 
@@ -1479,12 +1466,6 @@ test "a full batch flushes without waiting for the interval" {
         &database,
         @as(?*disk_monitor.Monitor, null),
     });
-    // See the note in "shutdown writes the batch the writer holds": this must
-    // run before the deferred `database.close`.
-    defer {
-        logger.shutdown(io);
-        future.await(io) catch {};
-    }
 
     for (0..150) |i| logger.log(io, sampleEntry(@intCast(i), "burst.example"));
 
@@ -1532,12 +1513,6 @@ test "a gated flush holds the batch until the disk recovers" {
         @as([]const Entry, &entries),
         @as(?*disk_monitor.Monitor, &monitor),
     });
-    // This task is `flush`, not `runWriter`: no queue shutdown can release it,
-    // so only cancellation ends it on an early return. Declared after the
-    // `writer.deinit`/`database.close` defers so LIFO runs it first.
-    defer {
-        _ = future.cancel(io) catch {};
-    }
 
     const poll: std.Io.Clock.Duration = .{ .raw = .fromMilliseconds(5), .clock = .awake };
     var waited: usize = 0;
@@ -1659,12 +1634,6 @@ test "the gating episode opens on the gate, turns losing on a drop, and clears o
         &database,
         @as(?*disk_monitor.Monitor, &monitor),
     });
-    // See the note in "shutdown writes the batch the writer holds": this must
-    // run before the deferred `database.close`.
-    defer {
-        logger.shutdown(io);
-        future.await(io) catch {};
-    }
 
     const poll: std.Io.Clock.Duration = .{ .raw = .fromMilliseconds(5), .clock = .awake };
     var waited: usize = 0;
@@ -1688,14 +1657,11 @@ test "the gating episode opens on the gate, turns losing on a drop, and clears o
     // The disk recovers: the held batch goes out and the episode ends.
     monitor.state_raw.store(@intFromEnum(disk_monitor.State.ok), .monotonic);
     waited = 0;
-    // The write is the completion condition, not the episode: `flush` reopens
-    // the gate before it calls `writeBatch`, so a poll on the episode alone
-    // returns while the row is still in flight and `rows_written` is still 0.
-    while (logger.rows_written.load(.monotonic) == 0) : (waited += 1) {
+    while (logger.gateEpisode() != .open) : (waited += 1) {
         try testing.expect(waited < 400);
         try poll.sleep(io);
     }
-    try testing.expectEqual(GateEpisode.open, logger.gateEpisode());
+    try testing.expect(logger.rows_written.load(.monotonic) > 0);
     // The count keeps the history the state does not.
     try testing.expect(logger.queries_dropped.load(.monotonic) > 0);
 
@@ -1770,13 +1736,6 @@ test "a gate that closes mid-enqueue still gets the discard that follows it" {
     // The producer enters `enqueue` with the gate open — which is the reading a
     // sample taken before the loop would keep for the rest of the call.
     var producer = try io.concurrent(logOne, .{ &logger, io });
-    // The producer parks inside `enqueue` and only `release` frees it: an early
-    // return below would otherwise leave `Threaded.deinit` joining it forever.
-    defer {
-        discard_stall.armed = false;
-        discard_stall.release.set(io);
-        producer.await(io);
-    }
     discard_stall.parked.waitUncancelable(io);
 
     // The producer is parked with the row it will evict still on the queue, so
@@ -1840,12 +1799,6 @@ test "a canceled writer counts the batch it was holding" {
         &database,
         @as(?*disk_monitor.Monitor, &monitor),
     });
-    // Cancellation is this case's subject, so the guard is the same operation
-    // the body performs; declared after the `database.close` defer so LIFO ends
-    // the writer before the handle goes away.
-    defer {
-        _ = future.cancel(io) catch {};
-    }
 
     const poll: std.Io.Clock.Duration = .{ .raw = .fromMilliseconds(5), .clock = .awake };
     var waited: usize = 0;
@@ -1889,12 +1842,6 @@ test "a disk-gated writer drops what it holds at shutdown instead of hanging" {
         &database,
         @as(?*disk_monitor.Monitor, &monitor),
     });
-    // See the note in "shutdown writes the batch the writer holds": this must
-    // run before the deferred `fx.deinit` and `database.close`.
-    defer {
-        logger.shutdown(io);
-        future.await(io) catch {};
-    }
 
     const poll: std.Io.Clock.Duration = .{ .raw = .fromMilliseconds(5), .clock = .awake };
     var waited: usize = 0;

src/storage/phase6_integration_test.zig

@@ -211,13 +211,6 @@ test "S8 case 1: the logger writes a real querylog.db end to end" {
         log_db.database(),
         @as(?*disk_monitor.Monitor, null),
     });
-    // Declared after the `log_db.deinit` defer so LIFO stops the writer first:
-    // an early return below would otherwise close the database under a live
-    // writer and leave the never-closed queue parking it forever.
-    defer {
-        query_log.shutdown(io);
-        future.await(io) catch {};
-    }
 
     var name_buf: [32]u8 = undefined;
     for (0..250) |i| {
@@ -259,13 +252,6 @@ test "S8 case 2: a single entry reaches the file once the flush interval passes"
         log_db.database(),
         @as(?*disk_monitor.Monitor, null),
     });
-    // Declared after the `log_db.deinit` defer so LIFO stops the writer first:
-    // an early return below would otherwise close the database under a live
-    // writer and leave the never-closed queue parking it forever.
-    defer {
-        query_log.shutdown(io);
-        future.await(io) catch {};
-    }
 
     query_log.log(io, entryAt(1, "only.example"));
 
@@ -314,13 +300,6 @@ test "S8 case 3: a full queue drops the oldest entries and the newest survive" {
         log_db.database(),
         @as(?*disk_monitor.Monitor, &monitor),
     });
-    // Declared after the `log_db.deinit` defer so LIFO stops the writer first:
-    // an early return below would otherwise close the database under a live
-    // writer and leave the never-closed queue parking it forever.
-    defer {
-        query_log.shutdown(io);
-        future.await(io) catch {};
-    }
 
     try awaitCount(&query_log.batches_gated, 1, 200);
     try testing.expectEqual(@as(i64, 0), try queries_repo.countRows(log_db.database()));
@@ -362,13 +341,6 @@ test "S8 case 4: the privacy transforms reach the stored rows" {
         log_db.database(),
         @as(?*disk_monitor.Monitor, null),
     });
-    // Declared after the `log_db.deinit` defer so LIFO stops the writer first:
-    // an early return below would otherwise close the database under a live
-    // writer and leave the never-closed queue parking it forever.
-    defer {
-        query_log.shutdown(io);
-        future.await(io) catch {};
-    }
 
     var name_buf: [32]u8 = undefined;
     for (0..20) |i| {
@@ -461,13 +433,6 @@ test "S8 case 6: a critical disk gates the flushes and recovery releases them" {
         log_db.database(),
         @as(?*disk_monitor.Monitor, &monitor),
     });
-    // Declared after the `log_db.deinit` defer so LIFO stops the writer first:
-    // an early return below would otherwise close the database under a live
-    // writer and leave the never-closed queue parking it forever.
-    defer {
-        query_log.shutdown(io);
-        future.await(io) catch {};
-    }
 
     try awaitCount(&query_log.batches_gated, 1, 200);
     try testing.expectEqual(@as(u64, 0), query_log.rows_written.load(.monotonic));