Deploy AIOS web (React glide grid + FastAPI slice)

RELEASES.json

@@ -1,6 +1,12 @@
 {
- "current": "2b115e5",
+ "current": "v34 (cb4caa1)",
  "releases": [
+  {
+   "version": "v34",
+   "sha": "cb4caa1",
+   "date": "2026-08-21",
+   "subject": "W39 Staging PostgreSQL egress controls"
+  },
   {
    "version": "v33",
    "sha": "2b115e5",

VERSION

@@ -1 +1 @@
-2b115e5
+v34 (cb4caa1)

api/automation_engine.py

@@ -14510,47 +14510,115 @@ def tick(rt, tenant, now=None, log=print):
                     started.append(aid)
             except Exception as e:                                # noqa: BLE001
                 log(f"[aios-auto] email poll {tenant}/{aid} failed: {type(e).__name__}: {e}")
-    # C7's amendment: date-window metrics advance with the tick, so `today` is never staler
-    # than one tick while a scheduler exists. A tenant without metric fields pays a dict scan.
-    try:
-        refresh_metrics(rt, log=log)
-    except Exception as e:                                        # noqa: BLE001
-        log(f"[aios-auto] metric refresh {tenant} failed: {type(e).__name__}: {e}")
-    # ⭐ 2026-08-07 — the relational pass, on the same tick and for the same reason. A rollup on
-    # table A goes stale when table B gains a row, and A cannot know that happened; the tick is
-    # the only place that sees both. ⚠ SEPARATE try/except from the metrics above deliberately —
-    # one pass failing must not silently cancel the other, which a shared block would do.
-    try:
-        refresh_relations(rt, log=log)
-    except Exception as e:                                        # noqa: BLE001
-        log(f"[aios-auto] relation refresh {tenant} failed: {type(e).__name__}: {e}")
-    # ⭐ THE READ-THROUGH ROLLUPS, on the same tick and for a stronger version of the same reason.
-    # A linked rollup goes stale when the LINKED TABLE gains a row; a source-backed one goes stale
-    # when ODOO does — and its window moves on its own besides (a `ytd` column is wrong on 1
-    # January without anybody writing anything). The tick is the only place that sees either.
+    # The automation definitions above are a small, separate `automations` bucket: schedule,
+    # pending-result and email work must still be checked every minute. The THREE passes below
+    # instead read the tenant-wide `user_tables` document (28.6 MB measured for tenant #0). On
+    # Postgres its durable revision is a tiny row-column query, so a repeated minute with neither
+    # a workspace write nor a new calendar day must not download that document merely to discover
+    # that every derived value is unchanged. The day remains an independent trigger: date-window
+    # metric and source-rollup cells may change at midnight without a user-table write.
     #
-    # ⛔ ITS OWN try/except, like the two passes above, and the reason is the same one stated
-    # there: this pass REFUSES loudly on a truncated group set, and a shared block would let that
-    # honest refusal silently cancel the relational pass that had already succeeded.
-    #
-    # ⚠ IT WRITES NOTHING WHEN IT REFUSES — see `rollup_sql`'s header. A half-applied rollup mixes
-    # two vintages of one column and looks completely normal, which is why the refusal is total.
-    try:
-        import rollup_sql
-        for _tk in list((rt.get(UT_STORE_KEY) or {})):
-            if rollup_sql.source_fields((rt.get(UT_STORE_KEY) or {}).get(_tk) or {}):
-                # ⚠ `today` is DEFAULTED INSIDE `compute`, not passed: this scope has no
-                # such local, and `refresh_metrics` above resolves it the same way.
-                n = rollup_sql.compute(rt, _tk)
-                if n:
-                    log(f"[aios-auto] source rollups {tenant}/{_tk}: {n}")
-    except Exception as e:                                        # noqa: BLE001
-        log(f"[aios-auto] source rollup {tenant} failed: {type(e).__name__}: {e}")
+    # This is deliberately Pg-only. The HF revision counter is process-local and cannot witness a
+    # second process's write, while Pg's `rev` is durable and schema-shared. An unavailable/odd
+    # revision fails safe to the established refresh path; a failed derived pass is NOT memoised.
+    # The in-process scheduler and the external tick can arrive together. Recheck the marker
+    # *inside* one tenant lock so they cannot both pay for the same full document before either
+    # has memoised it. The lock covers only the derived tail; schedules above remain independent.
+    with _derived_tick_lock(tenant):
+        _derived_due, _derived_marker = _derived_refresh_due(rt, tenant, now=now)
+        if _derived_due:
+            _derived_ok = True
+            # C7's amendment: date-window metrics advance with the tick, so `today` is never staler
+            # than one tick while a scheduler exists. A tenant without metric fields pays a dict scan.
+            try:
+                refresh_metrics(rt, log=log)
+            except Exception as e:                                # noqa: BLE001
+                _derived_ok = False
+                log(f"[aios-auto] metric refresh {tenant} failed: {type(e).__name__}: {e}")
+            # ⭐ 2026-08-07 — the relational pass, on the same tick and for the same reason. A rollup
+            # on table A goes stale when table B gains a row, and A cannot know that happened; the
+            # tick is the only place that sees both. Separate failure handling is retained.
+            try:
+                refresh_relations(rt, log=log)
+            except Exception as e:                                # noqa: BLE001
+                _derived_ok = False
+                log(f"[aios-auto] relation refresh {tenant} failed: {type(e).__name__}: {e}")
+            # Source-backed rollups move with Odoo and with their own date windows, so they share the
+            # same durable-revision/day gate but retain their independent failure posture.
+            try:
+                _refresh_source_rollups(rt, tenant, log=log)
+            except Exception as e:                                # noqa: BLE001
+                _derived_ok = False
+                log(f"[aios-auto] source rollup {tenant} failed: {type(e).__name__}: {e}")
+            if _derived_ok and _derived_marker is not None:
+                _DERIVED_TICK_STATE[str(tenant)] = _derived_marker
     if started:
         log(f"[aios-auto] tick {tenant}: started {', '.join(started)}")
     return started
 
 
+#: Postgres-only memo for the expensive derived half of `tick`. The key is the tenant slug; the
+#: marker contains both the durable bucket revision and the UTC calendar date. It is process
+#: memory by design: a new container pays one correct refresh, then resumes the no-idle-egress
+#: posture. Do not use it for schedules — those stay on the minute loop above.
+_DERIVED_TICK_STATE = {}
+_DERIVED_TICK_LOCKS = {}
+_DERIVED_TICK_LOCKS_GUARD = threading.Lock()
+
+
+def _derived_tick_lock(tenant):
+    """The one derived-work lock for this process and tenant, created without a map race."""
+    key = str(tenant)
+    with _DERIVED_TICK_LOCKS_GUARD:
+        return _DERIVED_TICK_LOCKS.setdefault(key, threading.Lock())
+
+
+def _derived_refresh_due(rt, tenant, now=None, state=None, backend=None):
+    """Return `(due, marker)` for full-document derived work on a scheduler tick.
+
+    `marker is None` means no safe durable observation exists, so callers must preserve the
+    previous behaviour. The helper is side-effect free; `tick` records a marker only after all
+    three isolated passes completed, making a transient failure retry on the next minute.
+    """
+    actual_backend = backend if backend is not None else os.environ.get("STORE_BACKEND", "hf")
+    if str(actual_backend).strip().lower() != "pg":
+        return True, None
+    try:
+        rev = (rt.revision(UT_STORE_KEY) or {}).get("token")
+        if not rev:
+            return True, None
+    except Exception:
+        return True, None
+    # The deployed workers need one calendar, not their host-local timezone. Naive test times
+    # represent UTC; an aware injected time is normalised before choosing the daily window.
+    stamp = now or _dt.datetime.now(_dt.timezone.utc)
+    if isinstance(stamp, _dt.datetime):
+        if stamp.tzinfo is None:
+            stamp = stamp.replace(tzinfo=_dt.timezone.utc)
+        else:
+            stamp = stamp.astimezone(_dt.timezone.utc)
+    day = stamp.date().isoformat() if hasattr(stamp, "date") else str(stamp)[:10]
+    marker = (str(rev), day)
+    memo = _DERIVED_TICK_STATE if state is None else state
+    return memo.get(str(tenant)) != marker, marker
+
+
+def _refresh_source_rollups(rt, tenant, log=print):
+    """Refresh every source-backed rollup; callers provide the no-op policy.
+
+    The existing per-pass error boundary lives in :func:`tick`. Keeping this helper focused on
+    the actual full-document work makes the Postgres revision/day policy testable without a
+    schedule, vendor call, or a hidden duplicate of the loop.
+    """
+    import rollup_sql
+    for _tk in list((rt.get(UT_STORE_KEY) or {})):
+        if rollup_sql.source_fields((rt.get(UT_STORE_KEY) or {}).get(_tk) or {}):
+            # `today` is DEFAULTED INSIDE `compute`, matching `refresh_metrics` above.
+            n = rollup_sql.compute(rt, _tk)
+            if n:
+                log(f"[aios-auto] source rollups {tenant}/{_tk}: {n}")
+
+
 def _pg_tick_refusal(tenant_slug, backend=None, write_refusal=None):
     """The Pg write wall, before a background tick reads a tenant's whole workspace.
 

api/rollup_sql.py

@@ -126,7 +126,14 @@ def _today():
 
 
 def compute(rt, table_key, today=None, tables=None):
-    """Write every source-backed rollup cell on `table_key`. Returns `{field_key: cells_written}`.
+    """Write changed source-backed rollup cells on `table_key`.
+
+    Returns ``{field_key: cells_changed}``. A store-backed call first applies the already-resolved
+    plans to its read snapshot. If no cell would change it deliberately never enters ``update``:
+    Pg's read-modify-write increments the document revision even when its JSON payload is byte-for-
+    byte equal, which would make an unchanged scheduler tick look like new source data forever.
+    When cells do differ, the plans are applied again inside the store's normal locked update so a
+    concurrent row edit is preserved and is picked up by the next revision-driven pass.
 
     `tables` (a live `user_tables` dict) is the gate's injection point — the same shape
     `automation_engine.compute_relation_cells` takes, so this can be proven against a fixture
@@ -167,13 +174,23 @@ def compute(rt, table_key, today=None, tables=None):
                 hit = values.get(join)
                 if hit is None and join.endswith(".0"):
                     hit = values.get(join[:-2])
-                row[fkey] = "" if hit is None else str(hit)
-                n += 1
+                value = "" if hit is None else str(hit)
+                if row.get(fkey) != value:
+                    row[fkey] = value
+                    n += 1
             written[fkey] = n
         return cur
 
     if owned:
         _apply(blob)
-    else:
-        rt.update(ut.STORE_KEY, _apply, flush="async")
-    return written
+        return {k: n for k, n in written.items() if n}
+
+    # A snapshot preflight costs one full read only on a due source-rollup pass. It avoids the far
+    # more expensive outcome on an idle tenant: a locked JSONB RMW, revision bump and then another
+    # full derived pass every minute because the scheduler can never observe a stable revision.
+    _apply(blob)
+    if not any(written.values()):
+        return {}
+    written.clear()
+    rt.update(ut.STORE_KEY, _apply, flush="async")
+    return {k: n for k, n in written.items() if n}

api/routes_changes.py

@@ -182,7 +182,12 @@ def _may_watch(session, scope):
     hit = _WALL_CACHE.get(key)
     if hit and hit[0] > now:
         return hit[1]
-    verdict = bool(user_tables.may_open(scope, session.uname, session.admin, st=session.runtime))
+    # `may_open` reads only a table definition (and, for a non-owner, the small shares bucket).
+    # Lend it the existing rows-free projection rather than a raw runtime: a cache miss remains
+    # the SAME ACL resolver and the same 30 s revocation bound, but Pg never sends the 28.6 MB
+    # `rows` payload just to decide whether this signed-in tab may watch its open database.
+    verdict = bool(user_tables.may_open(
+        scope, session.uname, session.admin, st=user_tables.lend_defs(session.runtime)))
     # ⛔ ONLY A `True` IS CACHED, and the asymmetry is deliberate. `user_tables.all_tables()`
     # SWALLOWS a store error and answers `{}`, which makes `may_open` False — so caching a
     # negative would turn one transient store hiccup into "no database <name> here" for the whole

platform/harness/runtime.py

@@ -179,6 +179,16 @@ class TenantRuntime:
         """
         return self._store().get_projection(self.store_key(name), drop=drop)
 
+    def revision(self, name):
+        """The tiny durable change token for this tenant's addressed bucket.
+
+        `get_projection` is for a rows-free document; this is deliberately smaller still.  It
+        delegates through the same bound store and `store_key()` seam as every other operation so
+        a shared-repository tenant asks for ``t/<tenant>/user_tables`` rather than tenant #0's
+        bucket.  The Pg implementation reads only ``rev, updated_at`` from ``store_kv``.
+        """
+        return self._store().revision(self.store_key(name))
+
     def put(self, name, data):
         return self._store().put(self.store_key(name), data)