feat: gate the pruned answer on the query hook

An actor's remembered idempotency keys are actor state, so a caller the
policy refuses must not learn from them that a key was used. The pruned
answer now runs `authorize_query` with the same `__snapshot__` operation
that `snapshot` uses, and a refused caller reads `nil` for a pruned
message and for one that never existed alike.

Without the gate the new test fails with:

    SolidObjects::MessagePruned: the message for idempotency key
    "checkout-7f3a" was pruned

Validation: bundle exec rake (781 runs, 0 failures).

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

Author: cardmagic

CHANGELOG.md

@@ -23,6 +23,8 @@
   store and no second write. `reference.find_by(idempotency_key:)` raises
   `SolidObjects::MessagePruned` for a key the actor remembers and whose message
   retention removed, and still answers `nil` for a key no caller ever sent.
+  The memory is actor state, so `authorize_query` gates the pruned answer and a
+  caller the policy refuses reads `nil` for both.
   `retained_idempotency_keys` bounds the memory and defaults to 64 keys for
   each actor. A lookup by request id cannot make the distinction, because the
   runtime, not the caller, generates a request id and no actor remembers one.

docs/architecture.md

@@ -442,7 +442,9 @@ than in a separate tombstone table, which needs no second store, no second
 write, and no separate retention. `reference.find_by(idempotency_key:)` raises
 `MessagePruned` for a key the actor remembers and whose message retention
 removed, and answers `nil` for a key no caller ever sent, so a client can tell
-a lost result from a request that never arrived.
+a lost result from a request that never arrived. The memory is actor state, so
+`authorize_query` gates the pruned answer the way it gates `snapshot`, and a
+caller the policy refuses reads `nil` for both.
 `retained_idempotency_keys` bounds the memory and defaults to 64 keys for each
 actor. Only a lookup by idempotency key can make the distinction. A request id
 is generated by the runtime rather than by the caller, so no actor remembers

docs/operations.md

@@ -549,7 +549,8 @@ observe it.
 names survives retention. A lookup by idempotency key still tells the two cases
 apart after pruning, because the actor remembers the keys of its own last
 `retained_idempotency_keys` finished turns: it raises `MessagePruned` for a key
-the actor remembers and answers `nil` for a key no caller ever sent. Raise
+the actor remembers and answers `nil` for a key no caller ever sent. The
+memory is actor state, so `authorize_query` gates the pruned answer. Raise
 `retained_idempotency_keys` above the default of 64 when an actor finishes more
 keyed turns than that inside the window in which a caller may retry. A lookup
 by request id answers `nil` in both cases, so a caller that must tell them apart

lib/solid_objects/client.rb

@@ -105,7 +105,10 @@ def find_by(reference: nil, request_id: nil, idempotency_key: nil, authorization
 
       return readable_message(requested_message(request_id), authorization_context:) if request_id
 
-      readable_message(remembered_message(reference, idempotency_key), authorization_context:)
+      readable_message(
+        remembered_message(reference, idempotency_key, authorization_context:),
+        authorization_context:
+      )
     end
 
     # @rbs (Reference, ?authorization_context: untyped) -> StateSnapshot
@@ -183,8 +186,8 @@ def requested_message(request_id)
       Message.uncached { Message.find_by(request_id:) }
     end
 
-    # @rbs (Reference, String) -> Message?
-    def remembered_message(reference, idempotency_key)
+    # @rbs (Reference, String, authorization_context: untyped) -> Message?
+    def remembered_message(reference, idempotency_key, authorization_context:)
       instance = Instance.find_by(
         actor_type: reference.actor_type,
         actor_id: reference.actor_id
@@ -193,9 +196,24 @@ def remembered_message(reference, idempotency_key)
 
       message = Message.uncached { Message.find_by(instance_id: instance.id, idempotency_key:) }
       return message if message
-      raise MessagePruned, idempotency_key if Array(instance.completed_idempotency_keys).include?(idempotency_key)
+      return nil unless Array(instance.completed_idempotency_keys).include?(idempotency_key)
+      return nil unless readable_state?(reference, authorization_context:)
+
+      raise MessagePruned, idempotency_key
+    end
 
-      nil
+    # @rbs (Reference, authorization_context: untyped) -> bool
+    def readable_state?(reference, authorization_context:)
+      authorize!(
+        hook: SolidObjects.configuration.authorize_query,
+        reference:,
+        operation: "__snapshot__",
+        arguments: {},
+        authorization_context:
+      )
+      true
+    rescue Unauthorized
+      false
     end
 
     # @rbs (Message?, authorization_context: untyped) -> MessageReference?

sig/generated/lib/solid_objects/client.rbs

@@ -35,8 +35,11 @@ module SolidObjects
     # @rbs (String) -> Message?
     def requested_message: (String) -> Message?
 
-    # @rbs (Reference, String) -> Message?
-    def remembered_message: (Reference, String) -> Message?
+    # @rbs (Reference, String, authorization_context: untyped) -> Message?
+    def remembered_message: (Reference, String, authorization_context: untyped) -> Message?
+
+    # @rbs (Reference, authorization_context: untyped) -> bool
+    def readable_state?: (Reference, authorization_context: untyped) -> bool
 
     # @rbs (Message?, authorization_context: untyped) -> MessageReference?
     def readable_message: (Message?, authorization_context: untyped) -> MessageReference?

test/integration/result_lookup_test.rb

@@ -234,6 +234,19 @@ def reject_checkout
     assert_nil reference.find_by(idempotency_key: "never-used")
   end
 
+  test "does not tell a refused caller that a key was pruned" do
+    reference = CartActor.ref("alice")
+    reference.async(idempotency_key: "checkout-7f3a").checkout(order_id: 1)
+    run_actors
+    SolidObjects::Message.delete_all
+    SolidObjects.configuration.authorize_query = ->(**) { false }
+
+    assert_nil reference.find_by(
+      idempotency_key: "checkout-7f3a",
+      authorization_context: "stranger"
+    )
+  end
+
   test "remembers a key whose message was rejected" do
     reference = CartActor.ref("alice")
     reference.async(idempotency_key: "rejected-7f3a").reject_checkout