Bump version to 0.1.0-RC.7 [skip ci]

Reading the rule rows a node keeps (classifications, active retention rules,
policies) is a query on a secured-data table, and other code runs inside that
query: a virtual field value provider or a post-query customizer that another
QBit or the host put on the table. When that code runs a query with filter
criteria, core validates the operands of classified fields and asks this QBit
for the classification of the field, which needs the rows that are being
read. The version of the rows was recorded only after the read returned, so
the nested question started the read again, and that read asked again:
StackOverflowError, and the same on every later request, since nothing was
ever recorded. One classification row was enough (core runs no value provider
for an empty result).

- System reads of the QBit's own tables (SystemWrites.query, the audit key
  lookup) name the stored fields of the table. Core fills a virtual field only
  for a query that selects it, so no value provider runs inside a system read.
- RuleRows holds one kind of rule rows and is used for all three kinds, which
  had the same shape. A question asked from inside a read is answered from the
  rows held when the read began (none before the first read) and never starts
  another read. The owner's monitor makes that answer private to the reading
  thread: every other thread waits and gets the rows the read returns.
- A read that fails records nothing and clears the reading mark, so the next
  question reads again. The rows held before are not given to a request in
  place of rows that could not be read.
- RetentionRules.active: a question asked from inside a transaction's read of
  its own rule edits is answered from the rules every thread shares instead
  of reading the edits again.

Who can be given the nested answer: only code on the reading thread, inside
SystemWrites.call, where the session is the system session and the resolver
answers FULL without looking at a classification. No field access decision
for a person is made from it; the request that started the read, and every
request on another thread, gets the rows the read returns.

Tests (SecuredDataRuleReloadTest): 9 of the 11 end in StackOverflowError
without the fix. They cover a value provider and a post-query customizer on
the classification, retention rule and policy tables, the answer a nested
question gets in both directions of a change, the session it is asked in, a
second thread waiting for the read, and failed reads (an exception and an
Error) being read again.

Co-Authored-By: Claude Fable 5.2 <noreply@anthropic.com>

CHANGELOG.md

@@ -4,6 +4,12 @@ All notable changes are documented here, following [Keep a Changelog](https://ke
 
 ## [Unreleased]
 
+### Fixed: rule reads that ask for their own rows
+- Reading the rule rows a node keeps (classifications, active retention rules, policies) no longer recurses when code that runs inside that read asks for the same rows. Another QBit's virtual field value provider, or a post-query customizer, on a secured-data table that ran a query with filter criteria did exactly that: with one classification row present, every request that needed a classification ended in a `StackOverflowError`.
+- The QBit's system reads of its own tables (`SystemWrites.query`, the audit key lookup) name the stored fields of the table, so core runs no virtual field value provider inside them.
+- A question asked from inside a rule read is answered from the rows held when that read began (none before the first read) and starts no other read. Only the reading thread, inside the QBit's system read, can be given that answer; every request gets the rows the read returns. The same holds for a transaction's read of its own retention rule edits.
+- A rule read that fails is tried again by the next question instead of failing or recursing from then on.
+
 ### Fixed: access-log lifecycle
 - The access-log worker and JVM shutdown hook hold the logger weakly, so an instance the host drops (tests, reloads) can be collected; its worker stops at the next tick.
 - `withRegisterShutdownHook(false)` for hosts that call `SecuredDataRuntime.close()` themselves; `SecuredDataAccessLogger.isWorkerRunning()`.

pom.xml

@@ -25,7 +25,7 @@
       <qqq.version>4.1.0-RC.26</qqq.version> <!-- feeds qbit-build-parent's qqq-bom-pom import -->
       <!-- QQQ 4.1.0-RC.15 ships UI API 1.6.0, field access and audit value protection -->
       <qqq.snapshot.version>4.1.0-RC.26</qqq.snapshot.version>
-      <revision>0.1.0-SNAPSHOT</revision>
+      <revision>0.1.0-RC.7</revision>
       <maven.compiler.source>21</maven.compiler.source>
       <maven.compiler.target>21</maven.compiler.target>
       <jacoco.version>0.8.15</jacoco.version>

src/main/java/com/kingsrook/qbits/secureddata/RuleRows.java

@@ -0,0 +1,102 @@
+/*
+ * QQQ - Low-code Application Framework for Engineers.
+ * Copyright (C) 2021-2025.  Kingsrook, LLC
+ * 651 N Broad St Ste 205 # 6917 | Middletown DE 19709 | United States
+ * contact@kingsrook.com
+ * https://github.com/Kingsrook/
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     https://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package com.kingsrook.qbits.secureddata;
+
+
+import java.util.List;
+import java.util.function.Supplier;
+import com.kingsrook.qqq.backend.core.model.data.QRecord;
+
+
+/*******************************************************************************
+ ** One kind of rule rows a node keeps in memory (classifications, policies or
+ ** active retention rules): read once per version, never used unread past
+ ** SecuredDataRuntime.MAX_RULE_AGE, and safe against a read that asks for the
+ ** same rows again.
+ **
+ ** Not synchronized: every call must be made holding the owner's monitor (the
+ ** runtime for classifications and retention rules, the resolver for policies).
+ ** That monitor is what makes the re-entry answer below private to one thread:
+ ** while a read is running, only the thread running it can get in here; every
+ ** other thread waits for the monitor and is given the rows that read returns.
+ **
+ ** Re-entry: reading rule rows is itself a query, and anything that runs inside
+ ** it (a table customizer, a record-security lookup, a value provider) may ask a
+ ** question that needs the very rows being read. Such a nested question is
+ ** answered with the rows this node held when the read began - the answer every
+ ** request was given until now, and no rows before the first read - and never
+ ** starts another read. The request that started the read gets the new rows.
+ **
+ ** Failure: a read that throws leaves the previous rows and version in place
+ ** and is not remembered, so the next question reads again. The previous rows
+ ** are never handed to a request in place of rows that could not be read.
+ *******************************************************************************/
+final class RuleRows
+{
+   private List<QRecord> rows = List.of();
+   private long          version;
+   private long          loadedAt;
+   private boolean       loaded;
+   private boolean       reading;
+
+
+
+   /*******************************************************************************
+    ** The rows of this version, reading them when the rows held are of another
+    ** version, too old, or were never read.
+    **
+    ** @param currentVersion the owner's invalidation clock, read by the caller
+    **                       before this call: a change during the read leaves a
+    **                       version that no longer matches, so the next question
+    **                       reads again
+    ** @param read           the query; whatever it throws is thrown to the caller
+    *******************************************************************************/
+   List<QRecord> get(long currentVersion, Supplier<List<QRecord>> read)
+   {
+      if(loaded && version == currentVersion && !SecuredDataRuntime.tooOld(loadedAt))
+      {
+         return (rows);
+      }
+      if(reading)
+      {
+         ///////////////////////////////////////////////////////////////////////////
+         // the read that is running on this thread asked for its own rows: give //
+         // it the rows held when it began, and do not start another read        //
+         ///////////////////////////////////////////////////////////////////////////
+         return (rows);
+      }
+      reading = true;
+      try
+      {
+         long          startedAt = System.nanoTime();
+         List<QRecord> fresh     = List.copyOf(read.get());
+         rows = fresh;
+         version = currentVersion;
+         loadedAt = startedAt;
+         loaded = true;
+      }
+      finally
+      {
+         reading = false;
+      }
+      return (rows);
+   }
+}

src/main/java/com/kingsrook/qbits/secureddata/SecuredDataKeySource.java

@@ -124,7 +124,7 @@ public final class SecuredDataKeySource implements ClassifiedValueKeySource, Aut
       try
       {
          List<QRecord> rows = SystemWrites.call(() -> new QueryAction().execute(new QueryInput(SecuredDataTables.AUDIT_KEY)
-            .withFilter(recordField(table, field, pk)).withShouldOmitHiddenFields(false)
+            .withFilter(recordField(table, field, pk)).withShouldOmitHiddenFields(false).withFieldNamesToInclude(SystemWrites.storedFields(SecuredDataTables.AUDIT_KEY))
             .withTransaction(QContext.getQBackendTransaction())).getRecords());
          if(rows.isEmpty())
          {

src/main/java/com/kingsrook/qbits/secureddata/SecuredDataResolver.java

@@ -74,8 +74,8 @@ public class SecuredDataResolver implements FieldAccessResolverInterface
    {
    }
 
-   private long cachedVersion;
-   private long policiesLoadedAt;
+   /** Used only inside methods synchronized on this resolver. */
+   private final RuleRows policyRows = new RuleRows();
    private List<QRecord> policies = List.of();
    private final Map<String, UserState> users = new HashMap<>();
 
@@ -292,18 +292,19 @@ public class SecuredDataResolver implements FieldAccessResolverInterface
 
    /*******************************************************************************
     ** Refresh policy rows once per version and matched state per relevant permissions.
+    ** A read that fails throws and is tried again by the next call. A question
+    ** asked from inside the read itself (see RuleRows) is answered from the
+    ** policies held when the read began; whatever it matched for its user is
+    ** dropped with every other user's state when the read returns.
     *******************************************************************************/
    private synchronized UserState state()
    {
-      long version = runtime.policyVersion();
-      if(cachedVersion != version || SecuredDataRuntime.tooOld(policiesLoadedAt))
+      policies = policyRows.get(runtime.policyVersion(), () ->
       {
-         long loadedAt = System.nanoTime();
-         policies = List.copyOf(SystemWrites.query(SecuredDataTables.POLICY, new QQueryFilter()));
+         List<QRecord> rows = SystemWrites.query(SecuredDataTables.POLICY, new QQueryFilter());
          users.clear();
-         cachedVersion = version;
-         policiesLoadedAt = loadedAt;
-      }
+         return (rows);
+      });
       QSession session = QContext.getQSession();
       TreeSet<String> held = new TreeSet<>();
       for(QRecord policy : policies)

src/main/java/com/kingsrook/qbits/secureddata/SecuredDataRuntime.java

@@ -78,12 +78,12 @@ public class SecuredDataRuntime implements QSupplementalInstanceMetaData, AutoCl
    private final transient SecuredDataKeySource keys = new SecuredDataKeySource();
    private final transient SecuredDataAccessLogger logger;
    private final transient SecuredDataAnomalies anomalies;
-   private transient long cachedClassificationVersion;
-   private transient List<com.kingsrook.qqq.backend.core.model.data.QRecord> classificationRows = List.of();
-   private transient long classificationRowsLoadedAt;
-   private transient long cachedRetentionVersion;
-   private transient long retentionRulesLoadedAt;
-   private transient List<QRecord> activeRetentionRules = List.of();
+   /////////////////////////////////////////////////////////////////////////////////
+   // both are used only inside methods synchronized on this runtime: one monitor //
+   // for the two, because reading either may ask for the other                   //
+   /////////////////////////////////////////////////////////////////////////////////
+   private final transient RuleRows classificationRows = new RuleRows();
+   private final transient RuleRows activeRetentionRules = new RuleRows();
 
 
 
@@ -228,20 +228,14 @@ public class SecuredDataRuntime implements QSupplementalInstanceMetaData, AutoCl
    /*******************************************************************************
     ** Every active retention rule, read once per version and at most MAX_RULE_AGE
     ** old. A read that fails throws and leaves nothing in place of the rules:
-    ** callers never see "no rules" because the rules could not be read.
+    ** callers never see "no rules" because the rules could not be read, and the
+    ** next call reads again. A question asked from inside the read itself (see
+    ** RuleRows) is answered with the rules held when the read began.
     *******************************************************************************/
    public synchronized List<QRecord> activeRetentionRules()
    {
-      long version = retentionVersion();
-      if(cachedRetentionVersion != version || tooOld(retentionRulesLoadedAt))
-      {
-         long loadedAt = System.nanoTime();
-         activeRetentionRules = List.copyOf(SystemWrites.query(SecuredDataTables.RETENTION_RULE, new QQueryFilter()
-            .withCriteria(new QFilterCriteria("is_active", QCriteriaOperator.EQUALS, true))));
-         cachedRetentionVersion = version;
-         retentionRulesLoadedAt = loadedAt;
-      }
-      return (activeRetentionRules);
+      return (activeRetentionRules.get(retentionVersion(), () -> SystemWrites.query(SecuredDataTables.RETENTION_RULE, new QQueryFilter()
+         .withCriteria(new QFilterCriteria("is_active", QCriteriaOperator.EQUALS, true)))));
    }
 
 
@@ -290,20 +284,14 @@ public class SecuredDataRuntime implements QSupplementalInstanceMetaData, AutoCl
 
 
    /*******************************************************************************
-    ** Read classification rows once per version, always as the system.
+    ** Read classification rows once per version, always as the system. A read
+    ** that fails throws and is tried again by the next call. A question asked from
+    ** inside the read itself (see RuleRows) is answered with the rows held when
+    ** the read began, and never starts another read.
     *******************************************************************************/
-   synchronized List<com.kingsrook.qqq.backend.core.model.data.QRecord> classificationRows()
+   synchronized List<QRecord> classificationRows()
    {
-      long version = classificationVersion();
-      if(cachedClassificationVersion != version || tooOld(classificationRowsLoadedAt))
-      {
-         long loadedAt = System.nanoTime();
-         classificationRows = List.copyOf(com.kingsrook.qbits.secureddata.support.SystemWrites.query(
-            com.kingsrook.qbits.secureddata.metadata.SecuredDataTables.CLASSIFICATION, new com.kingsrook.qqq.backend.core.model.actions.tables.query.QQueryFilter()));
-         cachedClassificationVersion = version;
-         classificationRowsLoadedAt = loadedAt;
-      }
-      return (classificationRows);
+      return (classificationRows.get(classificationVersion(), () -> SystemWrites.query(SecuredDataTables.CLASSIFICATION, new QQueryFilter())));
    }
 
 

src/main/java/com/kingsrook/qbits/secureddata/retention/RetentionRules.java

@@ -65,6 +65,9 @@ public final class RetentionRules
    ///////////////////////////////////////////////////////////////////////////////
    private static final ThreadLocal<Boolean> EDITED_IN_TRANSACTION = ThreadLocal.withInitial(() -> false);
 
+   /** Set while this thread reads its own edits, so that a question from inside that read does not read them again. */
+   private static final ThreadLocal<Boolean> READING_OWN_EDITS = ThreadLocal.withInitial(() -> false);
+
 
 
    /*******************************************************************************
@@ -74,21 +77,36 @@ public final class RetentionRules
     ** change, and at most MAX_RULE_AGE old) instead of once per call. A committed
     ** change is seen at once on the node that made it and on every node the
     ** cluster event reaches; a transaction that edits rules reads its own edits.
-    ** A failed read throws: it is never "no rules".
+    ** A failed read throws: it is never "no rules". A question asked from inside
+    ** a read of the rules is answered from the rules held before that read (see
+    ** RuleRows) and never starts another.
     *******************************************************************************/
    public static List<QRecord> active(String table, String field)
    {
       SecuredDataRuntime runtime = SecuredDataRuntime.current();
       List<QRecord> rules;
-      if(runtime == null || readsOwnEdits())
+      if(runtime != null && (!readsOwnEdits() || READING_OWN_EDITS.get()))
       {
-         rules = SystemWrites.query(SecuredDataTables.RETENTION_RULE, new QQueryFilter()
-            .withCriteria(new QFilterCriteria("is_active", QCriteriaOperator.EQUALS, true))
-            .withCriteria(new QFilterCriteria("table_name", QCriteriaOperator.EQUALS, table)));
+         //////////////////////////////////////////////////////////////////////////
+         // also the answer to a question asked from inside this thread's read  //
+         // of its own edits (code that runs inside that query): the rules      //
+         // every other thread shares, and never another read of the edits      //
+         //////////////////////////////////////////////////////////////////////////
+         rules = runtime.activeRetentionRules();
       }
       else
       {
-         rules = runtime.activeRetentionRules();
+         READING_OWN_EDITS.set(true);
+         try
+         {
+            rules = SystemWrites.query(SecuredDataTables.RETENTION_RULE, new QQueryFilter()
+               .withCriteria(new QFilterCriteria("is_active", QCriteriaOperator.EQUALS, true))
+               .withCriteria(new QFilterCriteria("table_name", QCriteriaOperator.EQUALS, table)));
+         }
+         finally
+         {
+            READING_OWN_EDITS.remove();
+         }
       }
       return (rules.stream().filter(rule -> table != null && table.equals(rule.getValueString("table_name"))).filter(rule -> fields(rule).contains(field)).toList());
    }

src/main/java/com/kingsrook/qbits/secureddata/support/SystemWrites.java

@@ -21,7 +21,9 @@
 package com.kingsrook.qbits.secureddata.support;
 
 
+import java.util.HashSet;
 import java.util.List;
+import java.util.Set;
 import com.kingsrook.qqq.backend.core.actions.QBackendTransaction;
 import com.kingsrook.qqq.backend.core.actions.permissions.CorePermissionEnforcer;
 import com.kingsrook.qqq.backend.core.actions.tables.InsertAction;
@@ -32,6 +34,7 @@ import com.kingsrook.qqq.backend.core.model.actions.tables.insert.InsertInput;
 import com.kingsrook.qqq.backend.core.model.actions.tables.query.QQueryFilter;
 import com.kingsrook.qqq.backend.core.model.actions.tables.query.QueryInput;
 import com.kingsrook.qqq.backend.core.model.data.QRecord;
+import com.kingsrook.qqq.backend.core.model.metadata.tables.QTableMetaData;
 import com.kingsrook.qqq.backend.core.model.session.QSession;
 import com.kingsrook.qqq.backend.core.model.session.QSystemUserSession;
 
@@ -100,13 +103,15 @@ public final class SystemWrites
 
 
    /*******************************************************************************
-    ** Query without user locks or field access recursion.
+    ** Query without user locks or field access recursion, for the stored fields of
+    ** the table only (see storedFields).
     *******************************************************************************/
    public static List<QRecord> query(String table, QQueryFilter filter)
    {
       try
       {
-         return (call(() -> new QueryAction().execute(new QueryInput(table).withFilter(filter).withTransaction(QContext.getQBackendTransaction())).getRecords()));
+         return (call(() -> new QueryAction().execute(new QueryInput(table).withFilter(filter).withFieldNamesToInclude(storedFields(table))
+            .withTransaction(QContext.getQBackendTransaction())).getRecords()));
       }
       catch(QException e)
       {
@@ -116,6 +121,22 @@ public final class SystemWrites
 
 
 
+   /*******************************************************************************
+    ** The names of the stored fields of a table, as the projection of a system
+    ** read. A query that names its fields is not given virtual fields, so core
+    ** runs none of the value providers another QBit or the host may have added to
+    ** a secured-data table: this QBit reads its own columns and nothing else, and
+    ** a provider cannot be made to run inside a rule read. Null (every field, and
+    ** the error core reports) for a table the instance does not have.
+    *******************************************************************************/
+   public static Set<String> storedFields(String tableName)
+   {
+      QTableMetaData table = QContext.getQInstance().getTable(tableName);
+      return (table == null ? null : new HashSet<>(table.getFields().keySet()));
+   }
+
+
+
    /*******************************************************************************
     ** Insert and reject backend record errors.
     *******************************************************************************/

src/test/java/com/kingsrook/qbits/secureddata/SecuredDataRuleReloadTest.java

@@ -0,0 +1,682 @@
+/*
+ * QQQ - Low-code Application Framework for Engineers.
+ * Copyright (C) 2021-2025.  Kingsrook, LLC
+ * 651 N Broad St Ste 205 # 6917 | Middletown DE 19709 | United States
+ * contact@kingsrook.com
+ * https://github.com/Kingsrook/
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     https://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package com.kingsrook.qbits.secureddata;
+
+
+import java.util.ArrayList;
+import java.util.List;
+import java.util.concurrent.Callable;
+import java.util.concurrent.CountDownLatch;
+import java.util.concurrent.ExecutorService;
+import java.util.concurrent.Executors;
+import java.util.concurrent.Future;
+import java.util.concurrent.TimeUnit;
+import java.util.concurrent.TimeoutException;
+import java.util.concurrent.atomic.AtomicInteger;
+import com.kingsrook.qbits.secureddata.metadata.SecuredDataTables;
+import com.kingsrook.qbits.secureddata.retention.RetentionRules;
+import com.kingsrook.qbits.secureddata.support.SystemWrites;
+import com.kingsrook.qqq.backend.core.actions.QBackendTransaction;
+import com.kingsrook.qqq.backend.core.actions.ai.DataClassification;
+import com.kingsrook.qqq.backend.core.actions.customizers.TableCustomizerInterface;
+import com.kingsrook.qqq.backend.core.actions.customizers.TableCustomizers;
+import com.kingsrook.qqq.backend.core.actions.permissions.fieldaccess.FieldAccessDecision;
+import com.kingsrook.qqq.backend.core.actions.tables.QueryAction;
+import com.kingsrook.qqq.backend.core.actions.tables.query.VirtualFieldValueProviderInterface;
+import com.kingsrook.qqq.backend.core.context.QContext;
+import com.kingsrook.qqq.backend.core.exceptions.QException;
+import com.kingsrook.qqq.backend.core.model.actions.tables.QueryOrGetInputInterface;
+import com.kingsrook.qqq.backend.core.model.actions.tables.insert.InsertInput;
+import com.kingsrook.qqq.backend.core.model.actions.tables.query.QCriteriaOperator;
+import com.kingsrook.qqq.backend.core.model.actions.tables.query.QFilterCriteria;
+import com.kingsrook.qqq.backend.core.model.actions.tables.query.QQueryFilter;
+import com.kingsrook.qqq.backend.core.model.actions.tables.query.QueryInput;
+import com.kingsrook.qqq.backend.core.model.actions.tables.update.UpdateInput;
+import com.kingsrook.qqq.backend.core.model.data.QRecord;
+import com.kingsrook.qqq.backend.core.model.metadata.QInstance;
+import com.kingsrook.qqq.backend.core.model.metadata.code.QCodeReference;
+import com.kingsrook.qqq.backend.core.model.metadata.fields.QFieldMetaData;
+import com.kingsrook.qqq.backend.core.model.metadata.fields.QFieldType;
+import com.kingsrook.qqq.backend.core.model.metadata.fields.QVirtualFieldMetaData;
+import com.kingsrook.qqq.backend.core.model.metadata.tables.QTableMetaData;
+import com.kingsrook.qqq.backend.core.model.session.QSystemUserSession;
+import com.kingsrook.qqq.backend.core.modules.backend.implementations.memory.MemoryRecordStore;
+import org.junit.jupiter.api.AfterEach;
+import org.junit.jupiter.api.BeforeEach;
+import org.junit.jupiter.api.Test;
+import static com.kingsrook.qbits.secureddata.SecuredDataTestSupport.classification;
+import static com.kingsrook.qbits.secureddata.SecuredDataTestSupport.close;
+import static com.kingsrook.qbits.secureddata.SecuredDataTestSupport.policyRow;
+import static com.kingsrook.qbits.secureddata.SecuredDataTestSupport.setup;
+import static com.kingsrook.qbits.secureddata.SecuredDataTestSupport.user;
+import static org.assertj.core.api.Assertions.assertThat;
+import static org.assertj.core.api.Assertions.assertThatThrownBy;
+
+
+/*******************************************************************************
+ ** Reading rule rows (classifications, retention rules, policies) is a query on
+ ** a secured-data table, and other code runs inside that query: a virtual field
+ ** value provider or a post-query customizer that another QBit or the host put
+ ** on the table. When that code runs a query with filter criteria, core asks
+ ** this QBit for a classification - which needs the rows being read.
+ **
+ ** These tests put such code on the rule tables and prove: the read asks for
+ ** stored fields only, so no value provider runs inside it; a question asked
+ ** inside a read is answered from the rows held before and starts no other
+ ** read; only the reading thread, as the system, can be given that answer; and
+ ** a read that fails is tried again by the next question.
+ *******************************************************************************/
+class SecuredDataRuleReloadTest
+{
+   QInstance          instance;
+   QTableMetaData     person;
+   SecuredDataRuntime runtime;
+
+
+
+   /*******************************************************************************
+    ** Something to do inside a query on a rule table.
+    *******************************************************************************/
+   @FunctionalInterface
+   interface NestedWork
+   {
+      /*******************************************************************************
+       ** Do it.
+       *******************************************************************************/
+      void run() throws Exception;
+   }
+
+
+
+   /*******************************************************************************
+    ** Stands in for another QBit's virtual field on a secured-data table: filling
+    ** it runs a query that has filter criteria.
+    *******************************************************************************/
+   public static class NestedQueryProvider implements VirtualFieldValueProviderInterface
+   {
+      static final AtomicInteger RUNS = new AtomicInteger();
+
+
+
+      /*******************************************************************************
+       ** Fill the field from a query with criteria, as a real provider does.
+       *******************************************************************************/
+      @Override
+      public void fill(QTableMetaData table, String fieldName, List<QRecord> records, QueryInput input) throws QException
+      {
+         RUNS.incrementAndGet();
+         queryWithCriteria();
+         records.forEach(record -> record.setValue(fieldName, "filled"));
+      }
+   }
+
+
+
+   /*******************************************************************************
+    ** A post-query customizer on a secured-data table. Core runs it for every
+    ** query on the table, whatever fields the query names.
+    *******************************************************************************/
+   public static class NestedWorkCustomizer implements TableCustomizerInterface
+   {
+      static final AtomicInteger RUNS = new AtomicInteger();
+      static volatile NestedWork work;
+
+
+
+      /*******************************************************************************
+       ** Run the work the test asked for, inside the query.
+       *******************************************************************************/
+      @Override
+      public List<QRecord> postQuery(QueryOrGetInputInterface queryInput, List<QRecord> records) throws QException
+      {
+         NestedWork toRun = work;
+         if(toRun != null)
+         {
+            RUNS.incrementAndGet();
+            try
+            {
+               toRun.run();
+            }
+            catch(QException | RuntimeException e)
+            {
+               throw (e);
+            }
+            catch(Exception e)
+            {
+               throw (new QException("Nested work failed", e));
+            }
+         }
+         return (records);
+      }
+   }
+
+
+
+   /*******************************************************************************
+    ** A person table with a date, so a retention rule on it is valid.
+    *******************************************************************************/
+   @BeforeEach
+   void init() throws Exception
+   {
+      instance = setup();
+      person = instance.getTable("person");
+      person.withField(new QFieldMetaData("createDate", QFieldType.DATE_TIME).withBackendName("createDate"));
+      runtime = SecuredDataRuntime.current();
+      NestedQueryProvider.RUNS.set(0);
+      NestedWorkCustomizer.RUNS.set(0);
+      NestedWorkCustomizer.work = null;
+   }
+
+
+
+   /*******************************************************************************
+    ** Cleanup.
+    *******************************************************************************/
+   @AfterEach
+   void cleanup()
+   {
+      NestedWorkCustomizer.work = null;
+      close();
+   }
+
+
+
+   /*******************************************************************************
+    ** A query with filter criteria on a host table: core validates the operand
+    ** of a classified field, so it asks for the field's classification - and
+    ** this QBit then asks whether a retention rule names the field.
+    *******************************************************************************/
+   private static void queryWithCriteria() throws QException
+   {
+      new QueryAction().execute(new QueryInput("person").withFilter(new QQueryFilter(new QFilterCriteria("id", QCriteriaOperator.EQUALS, 1))));
+   }
+
+
+
+   /*******************************************************************************
+    ** Another QBit's virtual field on a secured-data table.
+    *******************************************************************************/
+   private void addProvider(String table)
+   {
+      instance.getTable(table).addVirtualField(new QVirtualFieldMetaData("labels", QFieldType.STRING).withIsQuerySelectable(true)
+         .withValueProvider(new QCodeReference(NestedQueryProvider.class)));
+   }
+
+
+
+   /*******************************************************************************
+    ** A post-query customizer on a secured-data table.
+    *******************************************************************************/
+   private void addCustomizer(String table)
+   {
+      instance.getTable(table).withCustomizer(TableCustomizers.POST_QUERY_RECORD, new QCodeReference(NestedWorkCustomizer.class));
+   }
+
+
+
+   /*******************************************************************************
+    ** A row as another node writes it: straight into the store. None of this
+    ** node's customizers run and nothing here reads the rule rows; this node
+    ** learns of the change when its version moves (the cluster event).
+    *******************************************************************************/
+   private static QRecord writtenElsewhere(String table, QRecord row) throws QException
+   {
+      return (MemoryRecordStore.getInstance().insert(new InsertInput(table).withRecord(row), true).getFirst());
+   }
+
+
+
+   /*******************************************************************************
+    ** A classification of a person field, written by another node.
+    *******************************************************************************/
+   private QRecord classifiedElsewhere(String field, String classification) throws QException
+   {
+      QRecord row = writtenElsewhere(SecuredDataTables.CLASSIFICATION, new QRecord().withValue("table_name", "person")
+         .withValue("field_name", field).withValue("classification", classification));
+      runtime.invalidateClassifications();
+      return (row);
+   }
+
+
+
+   /*******************************************************************************
+    ** A classification row changed by another node.
+    *******************************************************************************/
+   private void reclassifiedElsewhere(QRecord row, String classification) throws QException
+   {
+      MemoryRecordStore.getInstance().update(new UpdateInput(SecuredDataTables.CLASSIFICATION).withRecord(new QRecord()
+         .withValue("id", row.getValue("id")).withValue("classification", classification)), false);
+      runtime.invalidateClassifications();
+   }
+
+
+
+   /*******************************************************************************
+    ** An active retention rule on one field of the person table, written by
+    ** another node.
+    *******************************************************************************/
+   private void ruleWrittenElsewhere(String field) throws QException
+   {
+      writtenElsewhere(SecuredDataTables.RETENTION_RULE, new QRecord().withValue("name", "30 days: " + field).withValue("table_name", "person")
+         .withValue("field_names", field).withValue("age_field_name", "createDate").withValue("age_days", 30).withValue("action", "NULL_WITH_MARKER")
+         .withValue("audit_treatment", "SHREDDABLE").withValue("is_active", true));
+      runtime.invalidateRetentionRules();
+   }
+
+
+
+   /*******************************************************************************
+    ** The classification of a person field.
+    *******************************************************************************/
+   private DataClassification classificationOf(String field)
+   {
+      return (SecuredDataClassifications.effective(person, field));
+   }
+
+
+
+   /*******************************************************************************
+    ** The reported failure: a value provider on the classification table whose
+    ** work is a query with criteria, and one classification row. Before the fix
+    ** the next classification question recursed until the stack overflowed, and
+    ** so did every question after it. Now the rule read names its stored fields,
+    ** so the provider does not run inside it at all.
+    *******************************************************************************/
+   @Test
+   void aValueProviderOnTheClassificationTableDoesNotRunInsideTheRuleRead() throws Exception
+   {
+      addProvider(SecuredDataTables.CLASSIFICATION);
+      classification("notes", "PHI");
+
+      assertThat(classificationOf("notes")).isEqualTo(DataClassification.PHI);
+      queryWithCriteria();
+      assertThat(NestedQueryProvider.RUNS).hasValue(0);
+      assertThat(SystemWrites.query(SecuredDataTables.CLASSIFICATION, new QQueryFilter())).singleElement()
+         .satisfies(row -> assertThat(row.getValues()).doesNotContainKey("labels").containsEntry("field_name", "notes"));
+   }
+
+
+
+   /*******************************************************************************
+    ** The virtual field is still there for a query that asks for every field (a
+    ** screen listing the classifications). Its provider's query with criteria
+    ** asks for a classification while the rows are out of date: the rows are
+    ** read once, inside the provider, and nothing recurses.
+    *******************************************************************************/
+   @Test
+   void anOrdinaryQueryOnTheClassificationTableStillFillsTheVirtualField() throws Exception
+   {
+      addProvider(SecuredDataTables.CLASSIFICATION);
+      classifiedElsewhere("notes", "PHI");
+
+      List<QRecord> rows = SystemWrites.call(() -> new QueryAction().execute(new QueryInput(SecuredDataTables.CLASSIFICATION)).getRecords());
+      assertThat(rows).singleElement().satisfies(row -> assertThat(row.getValueString("labels")).isEqualTo("filled"));
+      assertThat(NestedQueryProvider.RUNS).hasValue(1);
+      assertThat(classificationOf("notes")).isEqualTo(DataClassification.PHI);
+   }
+
+
+
+   /*******************************************************************************
+    ** A post-query customizer runs inside the rule read whatever fields the read
+    ** names. Its query with criteria asks for a classification in the middle of
+    ** the read of the classifications: before the fix that started the read again
+    ** and recursed until the stack overflowed. Now the rows are read once.
+    *******************************************************************************/
+   @Test
+   void aQuestionAskedInsideTheClassificationReadDoesNotStartAnotherRead() throws Exception
+   {
+      addCustomizer(SecuredDataTables.CLASSIFICATION);
+      classifiedElsewhere("notes", "PHI");
+
+      NestedWorkCustomizer.work = SecuredDataRuleReloadTest::queryWithCriteria;
+      assertThat(classificationOf("notes")).isEqualTo(DataClassification.PHI);
+      assertThat(NestedWorkCustomizer.RUNS).hasValue(1);
+
+      assertThat(classificationOf("email")).isEqualTo(DataClassification.PII);
+      assertThat(NestedWorkCustomizer.RUNS).hasValue(1);
+   }
+
+
+
+   /*******************************************************************************
+    ** What a question asked inside the read is told, and who can ask it.
+    **
+    ** The nested question gets the rows this node held when the read began (no
+    ** rows, the first time; then the rows of the previous version), in both
+    ** directions of a change. It can only be asked by the thread doing the read,
+    ** which is inside the QBit's system read: the session is the system session
+    ** and the resolver answers FULL there without looking at any classification,
+    ** so no person's field access is decided from that answer. The question that
+    ** started the read gets the new rows.
+    *******************************************************************************/
+   @Test
+   void aQuestionAskedInsideTheReadIsAnsweredFromTheRowsHeldBefore() throws Exception
+   {
+      addCustomizer(SecuredDataTables.CLASSIFICATION);
+      assertThat(classificationOf("notes")).isNull();
+
+      List<DataClassification> nestedAnswers = new ArrayList<>();
+      List<Boolean> nestedAsSystem = new ArrayList<>();
+      List<FieldAccessDecision> nestedDecisions = new ArrayList<>();
+      NestedWork ask = () ->
+      {
+         nestedAnswers.add(classificationOf("notes"));
+         nestedAsSystem.add(QContext.getQSession() instanceof QSystemUserSession && SystemWrites.active());
+         nestedDecisions.add(runtime.resolver().resolve(person, person.getField("notes")));
+      };
+
+      /////////////////////////////////////////////////////////////////////////
+      // a row raises the field: inside the read it is still unclassified,   //
+      // and the question that started the read is answered PHI              //
+      /////////////////////////////////////////////////////////////////////////
+      QRecord row = classifiedElsewhere("notes", "PHI");
+      NestedWorkCustomizer.work = ask;
+      assertThat(classificationOf("notes")).isEqualTo(DataClassification.PHI);
+      NestedWorkCustomizer.work = null;
+      assertThat(nestedAnswers).containsExactly((DataClassification) null);
+
+      /////////////////////////////////////////////////////////////////////////
+      // the row is changed to lower the field: inside the read it is still  //
+      // PHI, and the question that started the read is answered PUBLIC      //
+      /////////////////////////////////////////////////////////////////////////
+      reclassifiedElsewhere(row, "PUBLIC");
+      NestedWorkCustomizer.work = ask;
+      assertThat(classificationOf("notes")).isEqualTo(DataClassification.PUBLIC);
+      NestedWorkCustomizer.work = null;
+      assertThat(nestedAnswers).containsExactly(null, DataClassification.PHI);
+
+      assertThat(nestedAsSystem).containsExactly(true, true);
+      assertThat(nestedDecisions).containsExactly(FieldAccessDecision.FULL, FieldAccessDecision.FULL);
+      assertThat(NestedWorkCustomizer.RUNS).hasValue(2);
+   }
+
+
+
+   /*******************************************************************************
+    ** A request on another thread is never given the rows held before: while the
+    ** read is running it waits, and then it is answered from the rows the read
+    ** returned.
+    *******************************************************************************/
+   @Test
+   void aRequestOnAnotherThreadWaitsForTheReadAndIsGivenItsRows() throws Exception
+   {
+      addCustomizer(SecuredDataTables.CLASSIFICATION);
+      QRecord row = classifiedElsewhere("notes", "PUBLIC");
+      assertThat(classificationOf("notes")).isEqualTo(DataClassification.PUBLIC);
+      reclassifiedElsewhere(row, "PHI");
+
+      CountDownLatch readIsRunning = new CountDownLatch(1);
+      CountDownLatch letReadFinish = new CountDownLatch(1);
+      NestedWorkCustomizer.work = () ->
+      {
+         readIsRunning.countDown();
+         assertThat(letReadFinish.await(30, TimeUnit.SECONDS)).isTrue();
+      };
+
+      ExecutorService pool = Executors.newFixedThreadPool(2);
+      try
+      {
+         Future<DataClassification> reader = pool.submit(asUser("u2", () -> classificationOf("notes")));
+         assertThat(readIsRunning.await(30, TimeUnit.SECONDS)).isTrue();
+
+         Future<DataClassification> other = pool.submit(asUser("u3", () -> classificationOf("notes")));
+         assertThatThrownBy(() -> other.get(500, TimeUnit.MILLISECONDS)).isInstanceOf(TimeoutException.class);
+
+         letReadFinish.countDown();
+         assertThat(reader.get(30, TimeUnit.SECONDS)).isEqualTo(DataClassification.PHI);
+         assertThat(other.get(30, TimeUnit.SECONDS)).isEqualTo(DataClassification.PHI);
+         assertThat(NestedWorkCustomizer.RUNS).hasValue(1);
+      }
+      finally
+      {
+         letReadFinish.countDown();
+         pool.shutdownNow();
+      }
+   }
+
+
+
+   /*******************************************************************************
+    ** A person's request on its own thread.
+    *******************************************************************************/
+   private <T> Callable<T> asUser(String id, Callable<T> work)
+   {
+      return (() ->
+      {
+         QContext.init(instance, user(id));
+         try
+         {
+            return (work.call());
+         }
+         finally
+         {
+            QContext.clear();
+         }
+      });
+   }
+
+
+
+   /*******************************************************************************
+    ** A read that fails (here, in code running inside it, after that code asked a
+    ** nested question) throws to the request that started it and leaves nothing
+    ** behind: the next request reads again and gets the current rows - not the
+    ** rows held before, and not another failure. An Error, such as the stack
+    ** overflow this defect used to end in, is no different.
+    *******************************************************************************/
+   @Test
+   void aClassificationReadThatFailsIsTriedAgainByTheNextQuestion() throws Exception
+   {
+      addCustomizer(SecuredDataTables.CLASSIFICATION);
+      QRecord row = classifiedElsewhere("notes", "PUBLIC");
+      assertThat(classificationOf("notes")).isEqualTo(DataClassification.PUBLIC);
+      reclassifiedElsewhere(row, "PHI");
+
+      NestedWorkCustomizer.work = () ->
+      {
+         classificationOf("notes");
+         throw (new QException("The store is unavailable"));
+      };
+      assertThatThrownBy(() -> classificationOf("notes")).isInstanceOf(IllegalStateException.class);
+
+      NestedWorkCustomizer.work = () ->
+      {
+         classificationOf("notes");
+         throw (new StackOverflowError());
+      };
+      assertThatThrownBy(() -> classificationOf("notes")).isInstanceOf(StackOverflowError.class);
+
+      NestedWorkCustomizer.work = null;
+      assertThat(classificationOf("notes")).isEqualTo(DataClassification.PHI);
+   }
+
+
+
+   /*******************************************************************************
+    ** The active retention rules have the same shape: core's classification
+    ** question for a host field also asks whether a retention rule names the
+    ** field. A value provider on the retention rule table, with one active rule,
+    ** recursed the same way before the fix; it does not run inside the rule read.
+    *******************************************************************************/
+   @Test
+   void aValueProviderOnTheRetentionRuleTableDoesNotRunInsideTheRuleRead() throws Exception
+   {
+      addProvider(SecuredDataTables.RETENTION_RULE);
+      ruleWrittenElsewhere("notes");
+
+      assertThat(RetentionRules.active("person", "notes")).hasSize(1);
+      queryWithCriteria();
+      assertThat(NestedQueryProvider.RUNS).hasValue(0);
+   }
+
+
+
+   /*******************************************************************************
+    ** A question asked inside the read of the retention rules starts no other
+    ** read and is answered from the rules held before; the question that started
+    ** the read gets the new rules. A read that fails is tried again.
+    *******************************************************************************/
+   @Test
+   void aQuestionAskedInsideTheRetentionRuleReadIsAnsweredFromTheRulesHeldBefore() throws Exception
+   {
+      addCustomizer(SecuredDataTables.RETENTION_RULE);
+      assertThat(RetentionRules.active("person", "notes")).isEmpty();
+      ruleWrittenElsewhere("notes");
+
+      List<Integer> nestedAnswers = new ArrayList<>();
+      NestedWorkCustomizer.work = () ->
+      {
+         queryWithCriteria();
+         nestedAnswers.add(RetentionRules.active("person", "notes").size());
+         if(nestedAnswers.size() == 1)
+         {
+            throw (new QException("The store is unavailable"));
+         }
+      };
+      assertThatThrownBy(() -> RetentionRules.active("person", "notes")).isInstanceOf(IllegalStateException.class);
+      assertThat(RetentionRules.active("person", "notes")).hasSize(1);
+      assertThat(nestedAnswers).containsExactly(0, 0);
+      assertThat(NestedWorkCustomizer.RUNS).hasValue(2);
+
+      assertThat(RetentionRules.active("person", "notes")).hasSize(1);
+      assertThat(NestedWorkCustomizer.RUNS).hasValue(2);
+   }
+
+
+
+   /*******************************************************************************
+    ** A transaction that edited a rule reads the rules through itself, not from
+    ** the rules the node keeps. A question asked inside that read is answered
+    ** from the rules every thread shares: before the fix it read the edits again,
+    ** and recursed until the stack overflowed.
+    *******************************************************************************/
+   @Test
+   void aQuestionAskedInsideAReadOfATransactionsOwnEditsDoesNotReadThemAgain() throws Exception
+   {
+      addCustomizer(SecuredDataTables.RETENTION_RULE);
+      ruleWrittenElsewhere("notes");
+      assertThat(RetentionRules.active("person", "notes")).hasSize(1);
+
+      QContext.setTransaction(new QBackendTransaction());
+      RetentionRules.editedInTransaction();
+      try
+      {
+         NestedWorkCustomizer.work = SecuredDataRuleReloadTest::queryWithCriteria;
+         assertThat(RetentionRules.active("person", "notes")).hasSize(1);
+         assertThat(NestedWorkCustomizer.RUNS).hasValue(1);
+      }
+      finally
+      {
+         ////////////////////////////////////////////////////////////////////////
+         // the next question outside a transaction ends this thread's edits  //
+         ////////////////////////////////////////////////////////////////////////
+         NestedWorkCustomizer.work = null;
+         QContext.setTransaction(null);
+         RetentionRules.active("person", "notes");
+      }
+   }
+
+
+
+   /*******************************************************************************
+    ** The policies are read the same way (rows first, version afterwards), so
+    ** they are guarded the same way: code inside the policy read that asks the
+    ** resolver a policy question starts no other read, and a read that fails is
+    ** tried again.
+    *******************************************************************************/
+   @Test
+   void aQuestionAskedInsideThePolicyReadDoesNotStartAnotherRead() throws Exception
+   {
+      addCustomizer(SecuredDataTables.POLICY);
+      addProvider(SecuredDataTables.POLICY);
+      assertThat(runtime.resolver().revealPolicies(person, "email")).isEmpty();
+      writtenElsewhere(SecuredDataTables.POLICY, policyRow("cs_admin", "PII", "REVEALABLE"));
+      runtime.invalidatePolicies();
+
+      List<Integer> nestedAnswers = new ArrayList<>();
+      NestedWorkCustomizer.work = () ->
+      {
+         nestedAnswers.add(runtime.resolver().revealPolicies(person, "email").size());
+         if(nestedAnswers.size() == 1)
+         {
+            throw (new QException("The store is unavailable"));
+         }
+      };
+      assertThatThrownBy(() -> runtime.resolver().revealPolicies(person, "email")).isInstanceOf(IllegalStateException.class);
+      assertThat(runtime.resolver().revealPolicies(person, "email")).hasSize(1);
+      assertThat(nestedAnswers).containsExactly(0, 0);
+      assertThat(NestedQueryProvider.RUNS).hasValue(0);
+
+      NestedWorkCustomizer.RUNS.set(0);
+      assertThat(runtime.resolver().revealPolicies(person, "email")).hasSize(1);
+      assertThat(NestedWorkCustomizer.RUNS).hasValue(0);
+   }
+
+
+
+   /*******************************************************************************
+    ** The rows themselves, without a table: nothing is held before the first
+    ** read, a nested question never reads, a failed read is forgotten, and a new
+    ** version is read once.
+    *******************************************************************************/
+   @Test
+   void ruleRowsAreReadOncePerVersionAndNeverFromInsideTheirOwnRead()
+   {
+      RuleRows rows = new RuleRows();
+      AtomicInteger reads = new AtomicInteger();
+      List<QRecord> first = List.of(new QRecord().withValue("id", 1));
+      List<QRecord> second = List.of(new QRecord().withValue("id", 2));
+
+      assertThatThrownBy(() -> rows.get(1, () ->
+      {
+         reads.incrementAndGet();
+         assertThat(rows.get(1, () -> fail("a nested question must not read"))).isEmpty();
+         throw (new IllegalStateException("The store is unavailable"));
+      })).isInstanceOf(IllegalStateException.class);
+
+      assertThat(rows.get(1, () ->
+      {
+         reads.incrementAndGet();
+         assertThat(rows.get(1, () -> fail("a nested question must not read"))).isEmpty();
+         return (first);
+      })).isEqualTo(first);
+      assertThat(rows.get(1, () -> fail("rows of this version are held"))).isEqualTo(first);
+
+      assertThat(rows.get(2, () ->
+      {
+         reads.incrementAndGet();
+         assertThat(rows.get(2, () -> fail("a nested question must not read"))).isEqualTo(first);
+         return (second);
+      })).isEqualTo(second);
+      assertThat(reads).hasValue(3);
+   }
+
+
+
+   /*******************************************************************************
+    ** A read that must not happen.
+    *******************************************************************************/
+   private static List<QRecord> fail(String why)
+   {
+      throw (new AssertionError(why));
+   }
+}