@oimlsmart/platform-server 0.1.7 → 0.1.9

package/src/store/d1.ts

@@ -21,6 +21,8 @@
 import type { D1Database, D1PreparedStatement } from '@cloudflare/workers-types'
 import {
   DEMO_PASSWORD,
+  type AccountEmail,
+  type AddAccountEmailResult,
   type AdvanceCounterResult,
   type AuthUserPayload,
   type CompleteEmailChangeResult,
@@ -186,6 +188,73 @@ function toAdminRow(user: UserRecord & { last_login?: string | null; provider?:
  *  store wipes alongside (its rows reference the wiped events). */
 const WIPE_TABLES = ['entity_changes', 'evidence_records', 'entities', 'events', 'instrument_registrations', 'notify_deliveries'] as const
 
+// ── The ensure chains' memo scope (the 2026-09 portal-load audit, R2) ──
+// Every defensive ensure below (a dev-database heal: the PRAGMA probes,
+// the CREATE … IF NOT EXISTS, the idempotent membership backfill) was
+// memoized on the store INSTANCE — but the Worker consumers install a
+// store per request (the binding factory memoizes per binding OBJECT and
+// the Workers runtime hands each request its own env, so the binding's
+// identity is not guaranteed to recur), and the audit measured the
+// ~13-statement chain on every authenticated request (~0.6–0.9 s on the
+// demo hub's D1). The ensures are idempotent by construction, so the
+// honest scope is the (binding, chain) pair held at MODULE scope: the
+// Worker's isolate persists across requests and the consumer pins the
+// binding (the smart repo's server/cloudflare.ts), so the same
+// D1Database object recurs and the chain runs once per isolate. A
+// consumer whose runtime rotates binding objects degrades to the old
+// per-request posture — correct, just unmemoized. A REJECTED ensure
+// evicts itself: the next call retries the heal.
+interface EnsureMemos {
+  usersColumns: Promise<void> | null
+  sessionColumns: Promise<void> | null
+  membershipSupport: Promise<void> | null
+  orgRegistrySupport: Promise<void> | null
+  holderAttributionSupport: Promise<void> | null
+  instrumentRegistrationSupport: Promise<void> | null
+  oidcColumns: Promise<void> | null
+  personalAccessTokenSupport: Promise<void> | null
+  consentGrantSupport: Promise<void> | null
+  accountEmailSupport: Promise<void> | null
+  notifyDeliverySupport: Promise<void> | null
+}
+
+const ensureMemosByBinding = new WeakMap<D1Database, EnsureMemos>()
+
+/** Run the chain once per (binding, slot); a rejection evicts itself so
+ *  the next caller retries. */
+function ensured(binding: D1Database, slot: keyof EnsureMemos, run: () => Promise<void>): Promise<void> {
+  let memos = ensureMemosByBinding.get(binding)
+  if (!memos) {
+    memos = {
+      usersColumns: null, sessionColumns: null, membershipSupport: null,
+      orgRegistrySupport: null, holderAttributionSupport: null,
+      instrumentRegistrationSupport: null, oidcColumns: null,
+      personalAccessTokenSupport: null, consentGrantSupport: null,
+      accountEmailSupport: null, notifyDeliverySupport: null,
+    }
+    ensureMemosByBinding.set(binding, memos)
+  }
+  let pending = memos[slot]
+  if (!pending) {
+    pending = run()
+    memos[slot] = pending
+    pending.catch(() => { if (memos[slot] === pending) memos[slot] = null })
+  }
+  return pending
+}
+
+// TODO.identity/06's last-active stamp (getSessionUser's write): the
+// DB-side 60 s WHERE clause stays the source of truth (a second
+// isolate's write still lands through it); the in-isolate cache below
+// simply never ISSUES the write the row would refuse — the audit's R2
+// measured that write on every authenticated request. Keyed on the
+// session token (per-isolate), capped so a long-lived isolate's map
+// stays bounded (a cap reset only re-issues a write the DB clause then
+// throttles — never a correctness change).
+const lastSeenWrites = new Map<string, number>()
+const LAST_SEEN_THROTTLE_MS = 60_000
+const LAST_SEEN_CACHE_CAP = 4096
+
 export class D1ServerStore implements ServerStore {
   constructor(private readonly db: D1Database) {}
 
@@ -196,43 +265,34 @@ export class D1ServerStore implements ServerStore {
   // TODO.federation/12: the roles/active columns arrive with migration
   // 0002 — a dev D1 migrated from the pre-RBAC 0001 lacks them, so the
   //  user methods ensure them defensively (PRAGMA probe + ALTER),
-  //  memoized per store.
-  private usersColumnsEnsured: Promise<void> | null = null
-
+  //  memoized per (binding, chain) at module scope (the header note).
   private ensureUserColumns(): Promise<void> {
-    if (!this.usersColumnsEnsured) {
-      this.usersColumnsEnsured = (async () => {
-        const cols = await this.db.prepare('PRAGMA table_info(users)').all<{ name: string }>()
-        const names = new Set(cols.results.map(c => c.name))
-        if (!names.has('roles')) await this.db.prepare('ALTER TABLE users ADD COLUMN roles TEXT').run()
-        if (!names.has('active')) await this.db.prepare('ALTER TABLE users ADD COLUMN active INTEGER NOT NULL DEFAULT 1').run()
-        // TODO.identity/06 (the account console): the address's
-        // verification state.
-        if (!names.has('email_verified_at')) await this.db.prepare('ALTER TABLE users ADD COLUMN email_verified_at TEXT').run()
-      })()
-    }
-    return this.usersColumnsEnsured
+    return ensured(this.db, 'usersColumns', async () => {
+      const cols = await this.db.prepare('PRAGMA table_info(users)').all<{ name: string }>()
+      const names = new Set(cols.results.map(c => c.name))
+      if (!names.has('roles')) await this.db.prepare('ALTER TABLE users ADD COLUMN roles TEXT').run()
+      if (!names.has('active')) await this.db.prepare('ALTER TABLE users ADD COLUMN active INTEGER NOT NULL DEFAULT 1').run()
+      // TODO.identity/06 (the account console): the address's
+      // verification state.
+      if (!names.has('email_verified_at')) await this.db.prepare('ALTER TABLE users ADD COLUMN email_verified_at TEXT').run()
+    })
   }
 
   // TODO.identity/06 (the account console's sessions section): the
   // sign-in context columns arrive with migration 0009 — a dev D1
   // migrated from before it lacks them, so the session methods ensure
-  // them defensively (the ensureUserColumns posture, memoized per store).
-  private sessionColumnsEnsured: Promise<void> | null = null
-
+  // them defensively (the ensureUserColumns posture, memoized per
+  // (binding, chain) at module scope).
   private ensureSessionColumns(): Promise<void> {
-    if (!this.sessionColumnsEnsured) {
-      this.sessionColumnsEnsured = (async () => {
-        const cols = await this.db.prepare('PRAGMA table_info(sessions)').all<{ name: string }>()
-        const names = new Set(cols.results.map(c => c.name))
-        if (!names.has('user_agent')) await this.db.prepare('ALTER TABLE sessions ADD COLUMN user_agent TEXT').run()
-        if (!names.has('ip')) await this.db.prepare('ALTER TABLE sessions ADD COLUMN ip TEXT').run()
-        if (!names.has('last_seen_at')) await this.db.prepare('ALTER TABLE sessions ADD COLUMN last_seen_at TEXT').run()
-        // TODO.identity-sso/02+03: the sign-in provenance.
-        if (!names.has('amr')) await this.db.prepare('ALTER TABLE sessions ADD COLUMN amr TEXT').run()
-      })()
-    }
-    return this.sessionColumnsEnsured
+    return ensured(this.db, 'sessionColumns', async () => {
+      const cols = await this.db.prepare('PRAGMA table_info(sessions)').all<{ name: string }>()
+      const names = new Set(cols.results.map(c => c.name))
+      if (!names.has('user_agent')) await this.db.prepare('ALTER TABLE sessions ADD COLUMN user_agent TEXT').run()
+      if (!names.has('ip')) await this.db.prepare('ALTER TABLE sessions ADD COLUMN ip TEXT').run()
+      if (!names.has('last_seen_at')) await this.db.prepare('ALTER TABLE sessions ADD COLUMN last_seen_at TEXT').run()
+      // TODO.identity-sso/02+03: the sign-in provenance.
+      if (!names.has('amr')) await this.db.prepare('ALTER TABLE sessions ADD COLUMN amr TEXT').run()
+    })
   }
 
   // TODO.identity/11 (the multi-org membership model): the
@@ -240,274 +300,267 @@ export class D1ServerStore implements ServerStore {
   // token-flow context columns arrive with migration 0011 — a dev D1
   // migrated from before it lacks them, so the membership/session/token
   // methods ensure them defensively (the ensureUserColumns posture,
-  // memoized per store). The backfill (the migration's twin) is
-  // IDEMPOTENT and rides the ensure: every org-bound account's primary
-  // membership mirrors the legacy columns.
-  private membershipSupportEnsured: Promise<void> | null = null
-
+  // memoized per (binding, chain) at module scope). The backfill (the
+  // migration's twin) is IDEMPOTENT and rides the ensure: every
+  // org-bound account's primary membership mirrors the legacy columns.
   private ensureMembershipSupport(): Promise<void> {
-    if (!this.membershipSupportEnsured) {
-      this.membershipSupportEnsured = (async () => {
-        await this.db.prepare(
-          `CREATE TABLE IF NOT EXISTS org_memberships (
-             id TEXT PRIMARY KEY,
-             user_id TEXT NOT NULL REFERENCES users(id),
-             org_id TEXT NOT NULL,
-             roles TEXT NOT NULL DEFAULT '[]',
-             state TEXT NOT NULL DEFAULT 'active',
-             is_primary INTEGER NOT NULL DEFAULT 0,
-             invited_by TEXT,
-             created_at TEXT NOT NULL DEFAULT (datetime('now')),
-             activated_at TEXT,
-             disabled_at TEXT,
-             disabled_by TEXT,
-             UNIQUE (user_id, org_id)
-           )`,
-        ).run()
-        await this.db.prepare('CREATE INDEX IF NOT EXISTS idx_org_memberships_org ON org_memberships (org_id, state)').run()
-        await this.db.prepare('CREATE INDEX IF NOT EXISTS idx_org_memberships_user ON org_memberships (user_id, state)').run()
-        // TODO.identity-features/09 (the org-member data cone): the cone
-        // column arrives with migration 0017 — a dev D1 predating it
-        // grows the column here. NULL = org-wide: existing memberships
-        // keep their posture silently.
-        const membershipCols = await this.db.prepare('PRAGMA table_info(org_memberships)').all<{ name: string }>()
-        if (!membershipCols.results.some(c => c.name === 'cone')) {
-          await this.db.prepare('ALTER TABLE org_memberships ADD COLUMN cone TEXT').run()
-        }
-        const sessionCols = await this.db.prepare('PRAGMA table_info(sessions)').all<{ name: string }>()
-        if (!sessionCols.results.some(c => c.name === 'active_org')) {
-          await this.db.prepare('ALTER TABLE sessions ADD COLUMN active_org TEXT').run()
-        }
-        const codeCols = await this.db.prepare('PRAGMA table_info(oidc_codes)').all<{ name: string }>()
-        if (!codeCols.results.some(c => c.name === 'context_org')) {
-          await this.db.prepare('ALTER TABLE oidc_codes ADD COLUMN context_org TEXT').run()
-        }
-        const accessCols = await this.db.prepare('PRAGMA table_info(oidc_access_tokens)').all<{ name: string }>()
-        if (!accessCols.results.some(c => c.name === 'context_org')) {
-          await this.db.prepare('ALTER TABLE oidc_access_tokens ADD COLUMN context_org TEXT').run()
-        }
-        await this.db.prepare(
-          `INSERT OR IGNORE INTO org_memberships (id, user_id, org_id, roles, state, is_primary, activated_at)
-           SELECT 'mbr-' || id, id, org_id,
-                  CASE WHEN roles IS NOT NULL AND roles != '' THEN roles ELSE json_array(role) END,
-                  'active', 1, COALESCE(last_login, created_at)
-           FROM users WHERE org_id IS NOT NULL`,
-        ).run()
-      })()
-    }
-    return this.membershipSupportEnsured
+    return ensured(this.db, 'membershipSupport', async () => {
+      await this.db.prepare(
+        `CREATE TABLE IF NOT EXISTS org_memberships (
+           id TEXT PRIMARY KEY,
+           user_id TEXT NOT NULL REFERENCES users(id),
+           org_id TEXT NOT NULL,
+           roles TEXT NOT NULL DEFAULT '[]',
+           state TEXT NOT NULL DEFAULT 'active',
+           is_primary INTEGER NOT NULL DEFAULT 0,
+           invited_by TEXT,
+           created_at TEXT NOT NULL DEFAULT (datetime('now')),
+           activated_at TEXT,
+           disabled_at TEXT,
+           disabled_by TEXT,
+           UNIQUE (user_id, org_id)
+         )`,
+      ).run()
+      await this.db.prepare('CREATE INDEX IF NOT EXISTS idx_org_memberships_org ON org_memberships (org_id, state)').run()
+      await this.db.prepare('CREATE INDEX IF NOT EXISTS idx_org_memberships_user ON org_memberships (user_id, state)').run()
+      // TODO.identity-features/09 (the org-member data cone): the cone
+      // column arrives with migration 0017 — a dev D1 predating it
+      // grows the column here. NULL = org-wide: existing memberships
+      // keep their posture silently.
+      const membershipCols = await this.db.prepare('PRAGMA table_info(org_memberships)').all<{ name: string }>()
+      if (!membershipCols.results.some(c => c.name === 'cone')) {
+        await this.db.prepare('ALTER TABLE org_memberships ADD COLUMN cone TEXT').run()
+      }
+      const sessionCols = await this.db.prepare('PRAGMA table_info(sessions)').all<{ name: string }>()
+      if (!sessionCols.results.some(c => c.name === 'active_org')) {
+        await this.db.prepare('ALTER TABLE sessions ADD COLUMN active_org TEXT').run()
+      }
+      const codeCols = await this.db.prepare('PRAGMA table_info(oidc_codes)').all<{ name: string }>()
+      if (!codeCols.results.some(c => c.name === 'context_org')) {
+        await this.db.prepare('ALTER TABLE oidc_codes ADD COLUMN context_org TEXT').run()
+      }
+      const accessCols = await this.db.prepare('PRAGMA table_info(oidc_access_tokens)').all<{ name: string }>()
+      if (!accessCols.results.some(c => c.name === 'context_org')) {
+        await this.db.prepare('ALTER TABLE oidc_access_tokens ADD COLUMN context_org TEXT').run()
+      }
+      await this.db.prepare(
+        `INSERT OR IGNORE INTO org_memberships (id, user_id, org_id, roles, state, is_primary, activated_at)
+         SELECT 'mbr-' || id, id, org_id,
+                CASE WHEN roles IS NOT NULL AND roles != '' THEN roles ELSE json_array(role) END,
+                'active', 1, COALESCE(last_login, created_at)
+         FROM users WHERE org_id IS NOT NULL`,
+      ).run()
+    })
   }
 
   // TODO.identity-features/05 (the organization registry): the
   // org_registry table arrives with migration 0013 — a dev D1 migrated
   // from before it lacks the table, so the registry methods ensure it
   // defensively (the ensureMembershipSupport posture, memoized per
-  // store).
-  private orgRegistrySupportEnsured: Promise<void> | null = null
-
+  // (binding, chain) at module scope).
   private ensureOrgRegistrySupport(): Promise<void> {
-    if (!this.orgRegistrySupportEnsured) {
-      this.orgRegistrySupportEnsured = (async () => {
-        await this.db.prepare(
-          `CREATE TABLE IF NOT EXISTS org_registry (
-             id TEXT PRIMARY KEY,
-             name TEXT NOT NULL,
-             short_name TEXT,
-             kind TEXT,
-             country TEXT,
-             contacts TEXT NOT NULL DEFAULT '[]',
-             participant_ref TEXT,
-             state TEXT NOT NULL DEFAULT 'active',
-             created_at TEXT NOT NULL DEFAULT (datetime('now')),
-             created_by TEXT,
-             updated_at TEXT,
-             updated_by TEXT,
-             disabled_at TEXT,
-             disabled_by TEXT
-           )`,
-        ).run()
-        await this.db.prepare('CREATE INDEX IF NOT EXISTS idx_org_registry_state ON org_registry (state)').run()
-        // TODO.identity-features/10 (the OIML Member category): the
-        // designation links + the CS status facet arrive with migration
-        // 0019 — a dev D1 predating it grows the columns here (the
-        // PRAGMA probe + ALTER posture of ensureUserColumns). NULL = not
-        // recorded: existing rows keep their posture silently.
-        const cols = await this.db.prepare('PRAGMA table_info(org_registry)').all<{ name: string }>()
-        const names = new Set(cols.results.map(c => c.name))
-        if (!names.has('designated_by')) await this.db.prepare('ALTER TABLE org_registry ADD COLUMN designated_by TEXT').run()
-        if (!names.has('proposed_by')) await this.db.prepare('ALTER TABLE org_registry ADD COLUMN proposed_by TEXT').run()
-        if (!names.has('cs_status')) await this.db.prepare('ALTER TABLE org_registry ADD COLUMN cs_status TEXT').run()
-      })()
-    }
-    return this.orgRegistrySupportEnsured
+    return ensured(this.db, 'orgRegistrySupport', async () => {
+      await this.db.prepare(
+        `CREATE TABLE IF NOT EXISTS org_registry (
+           id TEXT PRIMARY KEY,
+           name TEXT NOT NULL,
+           short_name TEXT,
+           kind TEXT,
+           country TEXT,
+           contacts TEXT NOT NULL DEFAULT '[]',
+           participant_ref TEXT,
+           state TEXT NOT NULL DEFAULT 'active',
+           created_at TEXT NOT NULL DEFAULT (datetime('now')),
+           created_by TEXT,
+           updated_at TEXT,
+           updated_by TEXT,
+           disabled_at TEXT,
+           disabled_by TEXT
+         )`,
+      ).run()
+      await this.db.prepare('CREATE INDEX IF NOT EXISTS idx_org_registry_state ON org_registry (state)').run()
+      // TODO.identity-features/10 (the OIML Member category): the
+      // designation links + the CS status facet arrive with migration
+      // 0019 — a dev D1 predating it grows the columns here (the
+      // PRAGMA probe + ALTER posture of ensureUserColumns). NULL = not
+      // recorded: existing rows keep their posture silently.
+      const cols = await this.db.prepare('PRAGMA table_info(org_registry)').all<{ name: string }>()
+      const names = new Set(cols.results.map(c => c.name))
+      if (!names.has('designated_by')) await this.db.prepare('ALTER TABLE org_registry ADD COLUMN designated_by TEXT').run()
+      if (!names.has('proposed_by')) await this.db.prepare('ALTER TABLE org_registry ADD COLUMN proposed_by TEXT').run()
+      if (!names.has('cs_status')) await this.db.prepare('ALTER TABLE org_registry ADD COLUMN cs_status TEXT').run()
+    })
   }
 
   // TODO.register/02 (the register's holder-org attribution): the
   // certificate_holder_orgs / certificate_holder_claims tables arrive with
   // migration 0015 — a dev D1 migrated from before it lacks them, so the
   // attribution/claim methods ensure them defensively (the
-  // ensureOrgRegistrySupport posture, memoized per store).
-  private holderAttributionSupportEnsured: Promise<void> | null = null
-
+  // ensureOrgRegistrySupport posture, memoized per (binding, chain) at
+  // module scope).
   private ensureHolderAttributionSupport(): Promise<void> {
-    if (!this.holderAttributionSupportEnsured) {
-      this.holderAttributionSupportEnsured = (async () => {
-        await this.db.prepare(
-          `CREATE TABLE IF NOT EXISTS certificate_holder_orgs (
-             certificate_id TEXT PRIMARY KEY,
-             org_id TEXT NOT NULL,
-             org_name TEXT NOT NULL,
-             source TEXT NOT NULL,
-             attributed_at TEXT NOT NULL,
-             attributed_by TEXT,
-             claim_id TEXT
-           )`,
-        ).run()
-        await this.db.prepare('CREATE INDEX IF NOT EXISTS idx_certificate_holder_orgs_org ON certificate_holder_orgs (org_id)').run()
-        await this.db.prepare(
-          `CREATE TABLE IF NOT EXISTS certificate_holder_claims (
-             id TEXT PRIMARY KEY,
-             certificate_id TEXT NOT NULL,
-             claimant_org_id TEXT NOT NULL,
-             claimant_org_name TEXT NOT NULL,
-             matched_holder_name TEXT NOT NULL,
-             claimed_by TEXT NOT NULL,
-             state TEXT NOT NULL DEFAULT 'pending',
-             decided_by TEXT,
-             decided_at TEXT,
-             refusal_reason TEXT,
-             created_at TEXT NOT NULL DEFAULT (datetime('now'))
-           )`,
-        ).run()
-        await this.db.prepare('CREATE INDEX IF NOT EXISTS idx_certificate_holder_claims_cert ON certificate_holder_claims (certificate_id)').run()
-        await this.db.prepare('CREATE INDEX IF NOT EXISTS idx_certificate_holder_claims_state ON certificate_holder_claims (state)').run()
-        await this.db.prepare('CREATE INDEX IF NOT EXISTS idx_certificate_holder_claims_org ON certificate_holder_claims (claimant_org_id)').run()
-      })()
-    }
-    return this.holderAttributionSupportEnsured
+    return ensured(this.db, 'holderAttributionSupport', async () => {
+      await this.db.prepare(
+        `CREATE TABLE IF NOT EXISTS certificate_holder_orgs (
+           certificate_id TEXT PRIMARY KEY,
+           org_id TEXT NOT NULL,
+           org_name TEXT NOT NULL,
+           source TEXT NOT NULL,
+           attributed_at TEXT NOT NULL,
+           attributed_by TEXT,
+           claim_id TEXT
+         )`,
+      ).run()
+      await this.db.prepare('CREATE INDEX IF NOT EXISTS idx_certificate_holder_orgs_org ON certificate_holder_orgs (org_id)').run()
+      await this.db.prepare(
+        `CREATE TABLE IF NOT EXISTS certificate_holder_claims (
+           id TEXT PRIMARY KEY,
+           certificate_id TEXT NOT NULL,
+           claimant_org_id TEXT NOT NULL,
+           claimant_org_name TEXT NOT NULL,
+           matched_holder_name TEXT NOT NULL,
+           claimed_by TEXT NOT NULL,
+           state TEXT NOT NULL DEFAULT 'pending',
+           decided_by TEXT,
+           decided_at TEXT,
+           refusal_reason TEXT,
+           created_at TEXT NOT NULL DEFAULT (datetime('now'))
+         )`,
+      ).run()
+      await this.db.prepare('CREATE INDEX IF NOT EXISTS idx_certificate_holder_claims_cert ON certificate_holder_claims (certificate_id)').run()
+      await this.db.prepare('CREATE INDEX IF NOT EXISTS idx_certificate_holder_claims_state ON certificate_holder_claims (state)').run()
+      await this.db.prepare('CREATE INDEX IF NOT EXISTS idx_certificate_holder_claims_org ON certificate_holder_claims (claimant_org_id)').run()
+    })
   }
 
   // TODO.register/03 (the instrument register): the
   // instrument_registrations table arrives with migration 0016 — a dev
   // D1 migrated from before it lacks the table, so the register methods
   // ensure it defensively (the ensureOrgRegistrySupport posture,
-  // memoized per store).
-  private instrumentRegistrationSupportEnsured: Promise<void> | null = null
-
+  // memoized per (binding, chain) at module scope).
   private ensureInstrumentRegistrationSupport(): Promise<void> {
-    if (!this.instrumentRegistrationSupportEnsured) {
-      this.instrumentRegistrationSupportEnsured = (async () => {
-        await this.db.prepare(
-          `CREATE TABLE IF NOT EXISTS instrument_registrations (
-             id TEXT PRIMARY KEY,
-             certificate_id TEXT NOT NULL,
-             holder_org_id TEXT NOT NULL,
-             standard_id TEXT NOT NULL,
-             serial_number TEXT NOT NULL,
-             manufacture_date TEXT,
-             designations TEXT NOT NULL DEFAULT '{}',
-             scope_status TEXT NOT NULL,
-             scope_detail TEXT,
-             lifecycle TEXT NOT NULL DEFAULT 'registered',
-             registered_at TEXT NOT NULL DEFAULT (datetime('now')),
-             registered_by TEXT,
-             updated_at TEXT,
-             updated_by TEXT,
-             UNIQUE (certificate_id, serial_number)
-           )`,
-        ).run()
-        await this.db.prepare('CREATE INDEX IF NOT EXISTS idx_instrument_registrations_certificate ON instrument_registrations (certificate_id)').run()
-        await this.db.prepare('CREATE INDEX IF NOT EXISTS idx_instrument_registrations_holder ON instrument_registrations (holder_org_id)').run()
-        await this.db.prepare('CREATE INDEX IF NOT EXISTS idx_instrument_registrations_lifecycle ON instrument_registrations (lifecycle)').run()
-      })()
-    }
-    return this.instrumentRegistrationSupportEnsured
+    return ensured(this.db, 'instrumentRegistrationSupport', async () => {
+      await this.db.prepare(
+        `CREATE TABLE IF NOT EXISTS instrument_registrations (
+           id TEXT PRIMARY KEY,
+           certificate_id TEXT NOT NULL,
+           holder_org_id TEXT NOT NULL,
+           standard_id TEXT NOT NULL,
+           serial_number TEXT NOT NULL,
+           manufacture_date TEXT,
+           designations TEXT NOT NULL DEFAULT '{}',
+           scope_status TEXT NOT NULL,
+           scope_detail TEXT,
+           lifecycle TEXT NOT NULL DEFAULT 'registered',
+           registered_at TEXT NOT NULL DEFAULT (datetime('now')),
+           registered_by TEXT,
+           updated_at TEXT,
+           updated_by TEXT,
+           UNIQUE (certificate_id, serial_number)
+         )`,
+      ).run()
+      await this.db.prepare('CREATE INDEX IF NOT EXISTS idx_instrument_registrations_certificate ON instrument_registrations (certificate_id)').run()
+      await this.db.prepare('CREATE INDEX IF NOT EXISTS idx_instrument_registrations_holder ON instrument_registrations (holder_org_id)').run()
+      await this.db.prepare('CREATE INDEX IF NOT EXISTS idx_instrument_registrations_lifecycle ON instrument_registrations (lifecycle)').run()
+    })
   }
 
   // TODO.identity-sso/02+03: the amr provenance columns on the OIDC
   // flow rows arrive with migration 0012 — the OIDC methods ensure them
-  // defensively (the same memoized posture as the session/user columns),
-  // so a dev D1 migrated from before the wave never 500s the core flow.
-  private oidcColumnsEnsured: Promise<void> | null = null
-
+  // defensively (the same memoized posture as the session/user columns,
+  // per (binding, chain) at module scope), so a dev D1 migrated from
+  // before the wave never 500s the core flow.
   private ensureOidcColumns(): Promise<void> {
-    if (!this.oidcColumnsEnsured) {
-      this.oidcColumnsEnsured = (async () => {
-        const codeCols = await this.db.prepare('PRAGMA table_info(oidc_codes)').all<{ name: string }>()
-        if (!codeCols.results.some(c => c.name === 'amr')) {
-          await this.db.prepare('ALTER TABLE oidc_codes ADD COLUMN amr TEXT').run()
-        }
-        const tokenCols = await this.db.prepare('PRAGMA table_info(oidc_access_tokens)').all<{ name: string }>()
-        if (!tokenCols.results.some(c => c.name === 'amr')) {
-          await this.db.prepare('ALTER TABLE oidc_access_tokens ADD COLUMN amr TEXT').run()
-        }
-      })()
-    }
-    return this.oidcColumnsEnsured
+    return ensured(this.db, 'oidcColumns', async () => {
+      const codeCols = await this.db.prepare('PRAGMA table_info(oidc_codes)').all<{ name: string }>()
+      if (!codeCols.results.some(c => c.name === 'amr')) {
+        await this.db.prepare('ALTER TABLE oidc_codes ADD COLUMN amr TEXT').run()
+      }
+      const tokenCols = await this.db.prepare('PRAGMA table_info(oidc_access_tokens)').all<{ name: string }>()
+      if (!tokenCols.results.some(c => c.name === 'amr')) {
+        await this.db.prepare('ALTER TABLE oidc_access_tokens ADD COLUMN amr TEXT').run()
+      }
+    })
   }
 
   // TODO.identity-features/08 (the personal access tokens): the
   // personal_access_tokens table arrives with migration 0020 — a dev D1
   // migrated from before it lacks the table, so the PAT methods ensure
   // it defensively (the ensureOrgRegistrySupport posture, memoized per
-  // store).
-  private personalAccessTokenSupportEnsured: Promise<void> | null = null
-
+  // (binding, chain) at module scope).
   private ensurePersonalAccessTokenSupport(): Promise<void> {
-    if (!this.personalAccessTokenSupportEnsured) {
-      this.personalAccessTokenSupportEnsured = (async () => {
-        await this.db.prepare(
-          `CREATE TABLE IF NOT EXISTS personal_access_tokens (
-             id TEXT PRIMARY KEY,
-             user_id TEXT NOT NULL REFERENCES users(id),
-             name TEXT NOT NULL,
-             token_hash TEXT NOT NULL,
-             token_prefix TEXT NOT NULL,
-             scopes TEXT NOT NULL DEFAULT '[]',
-             org_context TEXT,
-             created_at TEXT NOT NULL DEFAULT (datetime('now')),
-             expires_at TEXT NOT NULL,
-             last_used_at TEXT,
-             last_exchange_audit_at TEXT,
-             expiry_notified_at TEXT,
-             revoked_at TEXT,
-             revoked_by TEXT,
-             UNIQUE (token_hash)
-           )`,
-        ).run()
-        await this.db.prepare('CREATE INDEX IF NOT EXISTS idx_personal_access_tokens_user ON personal_access_tokens (user_id)').run()
-      })()
-    }
-    return this.personalAccessTokenSupportEnsured
+    return ensured(this.db, 'personalAccessTokenSupport', async () => {
+      await this.db.prepare(
+        `CREATE TABLE IF NOT EXISTS personal_access_tokens (
+           id TEXT PRIMARY KEY,
+           user_id TEXT NOT NULL REFERENCES users(id),
+           name TEXT NOT NULL,
+           token_hash TEXT NOT NULL,
+           token_prefix TEXT NOT NULL,
+           scopes TEXT NOT NULL DEFAULT '[]',
+           org_context TEXT,
+           created_at TEXT NOT NULL DEFAULT (datetime('now')),
+           expires_at TEXT NOT NULL,
+           last_used_at TEXT,
+           last_exchange_audit_at TEXT,
+           expiry_notified_at TEXT,
+           revoked_at TEXT,
+           revoked_by TEXT,
+           UNIQUE (token_hash)
+         )`,
+      ).run()
+      await this.db.prepare('CREATE INDEX IF NOT EXISTS idx_personal_access_tokens_user ON personal_access_tokens (user_id)').run()
+    })
   }
 
   // TODO.identity-features/12 (the remembered consent grants): the
   // oidc_consent_grants table arrives with migration 0021 — a dev D1
   // migrated from before it lacks the table, so the grant methods ensure
   // it defensively (the ensurePersonalAccessTokenSupport posture,
-  // memoized per store).
-  private consentGrantSupportEnsured: Promise<void> | null = null
-
+  // memoized per (binding, chain) at module scope).
   private ensureConsentGrantSupport(): Promise<void> {
-    if (!this.consentGrantSupportEnsured) {
-      this.consentGrantSupportEnsured = (async () => {
-        await this.db.prepare(
-          `CREATE TABLE IF NOT EXISTS oidc_consent_grants (
-             id TEXT PRIMARY KEY,
-             user_id TEXT NOT NULL REFERENCES users(id),
-             client_id TEXT NOT NULL,
-             scope TEXT NOT NULL,
-             created_at TEXT NOT NULL DEFAULT (datetime('now')),
-             revoked_at TEXT
-           )`,
-        ).run()
-        await this.db.prepare(
-          'CREATE UNIQUE INDEX IF NOT EXISTS idx_oidc_consent_grants_live ON oidc_consent_grants (user_id, client_id, scope) WHERE revoked_at IS NULL',
-        ).run()
-        await this.db.prepare('CREATE INDEX IF NOT EXISTS idx_oidc_consent_grants_user ON oidc_consent_grants (user_id)').run()
-      })()
-    }
-    return this.consentGrantSupportEnsured
+    return ensured(this.db, 'consentGrantSupport', async () => {
+      await this.db.prepare(
+        `CREATE TABLE IF NOT EXISTS oidc_consent_grants (
+           id TEXT PRIMARY KEY,
+           user_id TEXT NOT NULL REFERENCES users(id),
+           client_id TEXT NOT NULL,
+           scope TEXT NOT NULL,
+           created_at TEXT NOT NULL DEFAULT (datetime('now')),
+           revoked_at TEXT
+         )`,
+      ).run()
+      await this.db.prepare(
+        'CREATE UNIQUE INDEX IF NOT EXISTS idx_oidc_consent_grants_live ON oidc_consent_grants (user_id, client_id, scope) WHERE revoked_at IS NULL',
+      ).run()
+      await this.db.prepare('CREATE INDEX IF NOT EXISTS idx_oidc_consent_grants_user ON oidc_consent_grants (user_id)').run()
+    })
+  }
+
+  // TODO.identity-features/01 (multiple emails per account): the
+  // account_emails table + the email_change_tokens.kind column arrive
+  // with migration 0022 — a dev D1 migrated from before it lacks both,
+  // so the address methods ensure them defensively (the
+  // ensureConsentGrantSupport posture, memoized per (binding, chain) at
+  // module scope).
+  private ensureAccountEmailSupport(): Promise<void> {
+    return ensured(this.db, 'accountEmailSupport', async () => {
+      await this.db.prepare(
+        `CREATE TABLE IF NOT EXISTS account_emails (
+           user_id TEXT NOT NULL REFERENCES users(id),
+           email TEXT NOT NULL,
+           verified_at TEXT,
+           added_by TEXT,
+           created_at TEXT NOT NULL DEFAULT (datetime('now')),
+           PRIMARY KEY (user_id, email)
+         )`,
+      ).run()
+      await this.db.prepare('CREATE UNIQUE INDEX IF NOT EXISTS idx_account_emails_email ON account_emails (email)').run()
+      const tokenCols = await this.db.prepare('PRAGMA table_info(email_change_tokens)').all<{ name: string }>()
+      if (!tokenCols.results.some(c => c.name === 'kind')) {
+        await this.db.prepare("ALTER TABLE email_change_tokens ADD COLUMN kind TEXT NOT NULL DEFAULT 'change'").run()
+      }
+    })
   }
 
   // ── users / sessions ─────────────────────────────────────────────
@@ -616,7 +669,28 @@ export class D1ServerStore implements ServerStore {
     return row?.id_token_hint ?? null
   }
 
+  /** TODO.identity/06's last-active stamp, throttled to one ISSUED write
+   *  per minute per session per isolate — the DB-side 60 s WHERE clause
+   *  stays the source of truth across isolates (the module-scope note);
+   *  the in-isolate cache only skips issuing a write the row would
+   *  refuse. A failed write is never cached (the cache set follows the
+   *  await), so the next request retries. */
+  private async stampSessionLastSeen(token: string): Promise<void> {
+    const now = Date.now()
+    if (now - (lastSeenWrites.get(token) ?? 0) < LAST_SEEN_THROTTLE_MS) return
+    await this.stmt(
+      "UPDATE sessions SET last_seen_at = datetime('now') WHERE token = ? AND (last_seen_at IS NULL OR last_seen_at < datetime('now', '-60 seconds'))",
+      token,
+    ).run()
+    if (lastSeenWrites.size >= LAST_SEEN_CACHE_CAP) lastSeenWrites.clear()
+    lastSeenWrites.set(token, now)
+  }
+
   async getSessionUser(token: string): Promise<AuthUserPayload | null> {
+    // The ensure chains are memoized per (binding, chain) at module scope
+    // (the header note) — past the isolate's first request these three
+    // awaits are memo hits, and the per-request work that remains is the
+    // session read itself.
     await this.ensureUserColumns()
     await this.ensureSessionColumns()
     await this.ensureMembershipSupport()
@@ -630,12 +704,6 @@ export class D1ServerStore implements ServerStore {
       token,
     ).first<{ user_id: string; active_org: string | null; amr: string | null; email: string; name: string; role: string; roles: string | null; org_id: string | null; avatar_url: string | null; provider: string; email_verified_at: string | null }>()
     if (!session) return null
-    // TODO.identity/06: the last-active stamp, throttled to one write
-    // per minute per session (the sessions section shows it).
-    await this.stmt(
-      "UPDATE sessions SET last_seen_at = datetime('now') WHERE token = ? AND (last_seen_at IS NULL OR last_seen_at < datetime('now', '-60 seconds'))",
-      token,
-    ).run()
     const amr = parseRoles(session.amr)
     const payload: AuthUserPayload = {
       id: session.user_id,
@@ -650,10 +718,16 @@ export class D1ServerStore implements ServerStore {
       ...(amr?.length ? { amr } : {}),
     }
     // TODO.identity/11: the active-org context (the membership model) —
-    // the payload's org/roles follow the session's stamped context.
+    // the payload's org/roles follow the session's stamped context. The
+    // three post-JOIN statements (the throttled last-active stamp, the
+    // two membership reads) are independent, so they round-trip together
+    // (the audit's R2: sequential statements are the latency).
     const activeOrg = session.active_org ?? null
-    const active = activeOrg ? await this.getOrgMembership(payload.id, activeOrg) : null
-    const primary = payload.orgId ? await this.getOrgMembership(payload.id, payload.orgId) : null
+    const [, active, primary] = await Promise.all([
+      this.stampSessionLastSeen(token),
+      activeOrg ? this.getOrgMembership(payload.id, activeOrg) : null,
+      payload.orgId ? this.getOrgMembership(payload.id, payload.orgId) : null,
+    ])
     const resolved = resolveOrgContext(payload, { activeOrg, active, primary })
     if (activeOrg && !(active && active.state === 'active')) {
       // The stale stamp never lingers (the membership ended mid-session).
@@ -1374,6 +1448,13 @@ export class D1ServerStore implements ServerStore {
     createdBy?: string | null
   }): Promise<UserAdminRow | null> {
     const id = crypto.randomUUID()
+    // TODO.identity-features/01: the address must be free across BOTH
+    // address tables — an additional on another account blocks the
+    // address as a new account's primary (an address names at most one
+    // account; the users.email UNIQUE remains the race backstop).
+    await this.ensureAccountEmailSupport()
+    const additional = await this.stmt('SELECT user_id FROM account_emails WHERE email = ?', input.email.trim().toLowerCase()).first<{ user_id: string }>()
+    if (additional) return null
     try {
       await this.stmt(
         "INSERT INTO users (id, email, name, provider, role) VALUES (?, ?, ?, 'password', ?)",
@@ -1388,14 +1469,28 @@ export class D1ServerStore implements ServerStore {
   }
 
   /** The password sign-in's lookup: the credential + the active flag, by
-   *  (normalized) email. The credential's EXISTENCE is the qualifier. */
+   *  (normalized) email. The credential's EXISTENCE is the qualifier.
+   *  TODO.identity-features/01: the address resolves by ANY of the
+   *  account's VERIFIED addresses — the primary first (the primary owner
+   *  always wins, the deterministic rule), then a proven account_emails
+   *  row; an unverified additional never resolves. */
   async getPasswordLogin(email: string): Promise<{ userId: string; hash: string; active: boolean } | null> {
-    const row = await this.stmt(
+    await this.ensureAccountEmailSupport()
+    const normalized = email.trim().toLowerCase()
+    let row = await this.stmt(
       `SELECT u.id AS user_id, u.active AS active, p.hash AS hash
        FROM users u JOIN passwords p ON p.user_id = u.id
        WHERE u.email = ?`,
-      email.trim().toLowerCase(),
+      normalized,
     ).first<{ user_id: string; active: number; hash: string }>()
+    if (!row) {
+      row = await this.stmt(
+        `SELECT u.id AS user_id, u.active AS active, p.hash AS hash
+         FROM users u JOIN passwords p ON p.user_id = u.id
+         WHERE u.id = (SELECT user_id FROM account_emails WHERE email = ? AND verified_at IS NOT NULL)`,
+        normalized,
+      ).first<{ user_id: string; active: number; hash: string }>()
+    }
     if (!row) return null
     return { userId: row.user_id, hash: row.hash, active: row.active !== 0 }
   }
@@ -1620,6 +1715,10 @@ export class D1ServerStore implements ServerStore {
     // the account (a tombstone never skips a consent page again).
     await this.ensureConsentGrantSupport()
     const consentGrants = await this.stmt('DELETE FROM oidc_consent_grants WHERE user_id = ?', userId).run()
+    // TODO.identity-features/01: the additional addresses die with the
+    // account (a tombstone's addresses never resolve a sign-in again).
+    await this.ensureAccountEmailSupport()
+    const emails = await this.stmt('DELETE FROM account_emails WHERE user_id = ?', userId).run()
     await this.stmt(
       `UPDATE users SET
          email = ?, name = 'Deleted account', provider = 'erased',
@@ -1638,13 +1737,20 @@ export class D1ServerStore implements ServerStore {
         + (challenges.meta.changes ?? 0) + (mfa.meta.changes ?? 0),
       personalAccessTokens: personalAccessTokens.meta.changes ?? 0,
       consentGrants: consentGrants.meta.changes ?? 0,
+      emails: emails.meta.changes ?? 0,
     }
   }
 
   /** The registry's edit act (name/email). The email UNIQUE conflict
-   *  throws 'unique' (the route maps it to a 409, never a silent take). */
+   *  throws 'unique' (the route maps it to a 409, never a silent take).
+   *  TODO.identity-features/01: the conflict read spans BOTH address
+   *  tables — an additional row (on any account, this one included)
+   *  holds the address too. */
   async updateOpAccount(id: string, input: { name?: string; email?: string }): Promise<boolean> {
     if (input.email !== undefined) {
+      await this.ensureAccountEmailSupport()
+      const additional = await this.stmt('SELECT user_id FROM account_emails WHERE email = ?', input.email.trim().toLowerCase()).first<{ user_id: string }>()
+      if (additional) throw new Error(`unique: ${input.email}`)
       try {
         // TODO.identity/06: an admin-set address never went through the
         // verify-new-email ceremony, so the verification state resets.
@@ -1717,29 +1823,46 @@ export class D1ServerStore implements ServerStore {
       userId: row.user_id as string,
       newEmail: row.new_email as string,
       deliveredBy: row.delivered_by === 'mailer' ? 'mailer' : 'shown',
+      // TODO.identity-features/01: rows predating the kind column (or a
+      // store over a pre-0022 database) read as the legacy ceremony.
+      kind: row.kind === 'add' ? 'add' : 'change',
       createdAt: row.created_at as string,
       expiresAt: row.expires_at as string,
       consumedAt: (row.consumed_at as string | null) ?? null,
     }
   }
 
-  /** Mint the ceremony's token; the account's earlier pending rows are
-   *  VOIDED first (only the newest link works). */
+  /** Mint the ceremony's token. The void rule keeps ONE live link per
+   *  ceremony target: a 'change' request voids the account's earlier
+   *  pending 'change' rows (only the newest change link works — the
+   *  pre-01 doctrine); an 'add' request voids the account's earlier
+   *  pending 'add' rows FOR THE SAME address (other addresses' links
+   *  stand). */
   async createEmailChangeToken(input: {
     token: string
     userId: string
     newEmail: string
     deliveredBy: 'mailer' | 'shown'
+    kind?: 'change' | 'add'
     ttlMs: number
   }): Promise<EmailChangeToken> {
-    await this.stmt(
-      "UPDATE email_change_tokens SET consumed_at = datetime('now') WHERE user_id = ? AND consumed_at IS NULL",
-      input.userId,
-    ).run()
+    await this.ensureAccountEmailSupport()
+    const kind = input.kind ?? 'change'
+    if (kind === 'change') {
+      await this.stmt(
+        "UPDATE email_change_tokens SET consumed_at = datetime('now') WHERE user_id = ? AND kind = 'change' AND consumed_at IS NULL",
+        input.userId,
+      ).run()
+    } else {
+      await this.stmt(
+        "UPDATE email_change_tokens SET consumed_at = datetime('now') WHERE user_id = ? AND kind = 'add' AND new_email = ? AND consumed_at IS NULL",
+        input.userId, input.newEmail.trim().toLowerCase(),
+      ).run()
+    }
     const expiresAt = new Date(Date.now() + input.ttlMs).toISOString()
     await this.stmt(
-      'INSERT INTO email_change_tokens (token, user_id, new_email, delivered_by, expires_at) VALUES (?, ?, ?, ?, ?)',
-      input.token, input.userId, input.newEmail.trim().toLowerCase(), input.deliveredBy, expiresAt,
+      'INSERT INTO email_change_tokens (token, user_id, new_email, delivered_by, kind, expires_at) VALUES (?, ?, ?, ?, ?, ?)',
+      input.token, input.userId, input.newEmail.trim().toLowerCase(), input.deliveredBy, kind, expiresAt,
     ).run()
     return (await this.getEmailChangeToken(input.token))!
   }
@@ -1749,12 +1872,15 @@ export class D1ServerStore implements ServerStore {
     return row ? D1ServerStore.toEmailChangeToken(row) : null
   }
 
-  /** The account's pending change (the newest live row), so the console
-   *  can show it. */
+  /** The account's pending PRIMARY change (the newest live 'change'
+   *  row), so the console can show it. The per-address verifications are
+   *  the account_emails rows' own state (verified_at NULL = waiting),
+   *  never a pending read here. */
   async getPendingEmailChange(userId: string): Promise<EmailChangeToken | null> {
+    await this.ensureAccountEmailSupport()
     const row = await this.stmt(
       `SELECT * FROM email_change_tokens
-       WHERE user_id = ? AND consumed_at IS NULL AND expires_at > datetime('now')
+       WHERE user_id = ? AND kind = 'change' AND consumed_at IS NULL AND expires_at > datetime('now')
        ORDER BY created_at DESC LIMIT 1`,
       userId,
     ).first<Record<string, unknown>>()
@@ -1762,20 +1888,34 @@ export class D1ServerStore implements ServerStore {
   }
 
   /** Complete the ceremony: consume ATOMICALLY (a presented link works
-   *  exactly once, expired or not), judge the expiry, re-check the
-   *  address's uniqueness (a conflict burns the token honestly), then
-   *  move the account's email. A 'mailer'-delivered token verifies the
-   *  address; a shown one never does. */
+   *  exactly once, expired or not), judge the expiry, then act on the
+   *  kind. 'change' (the pre-01 primary replacement): re-check the
+   *  address's uniqueness across BOTH address tables (a conflict burns
+   *  the token honestly — an additional row anywhere holds the address
+   *  too, this account's included), then move users.email. 'add' (the
+   *  per-address verification): the account_emails row landed unverified
+   *  at the request; the completion stamps it (a row removed meanwhile
+   *  burns the link as 'unknown'). A 'mailer'-delivered token verifies
+   *  the address; a shown one never does. */
   async completeEmailChange(token: string): Promise<CompleteEmailChangeResult> {
+    await this.ensureAccountEmailSupport()
     const res = await this.stmt(
       "UPDATE email_change_tokens SET consumed_at = datetime('now') WHERE token = ? AND consumed_at IS NULL", token,
     ).run()
     if ((res.meta.changes ?? 0) === 0) return { kind: 'unknown' }
     const row = (await this.getEmailChangeToken(token))!
     if (new Date(row.expiresAt).getTime() <= Date.now()) return { kind: 'expired' }
+    const verified = row.deliveredBy === 'mailer'
+    if (row.kind === 'add') {
+      const standing = await this.stmt('SELECT 1 AS ok FROM account_emails WHERE user_id = ? AND email = ?', row.userId, row.newEmail).first<{ ok: number }>()
+      if (!standing) return { kind: 'unknown' }
+      if (verified) await this.markAccountEmailVerified(row.userId, row.newEmail)
+      return { kind: 'ok', userId: row.userId, newEmail: row.newEmail, verified }
+    }
     const taken = await this.stmt('SELECT id FROM users WHERE email = ?', row.newEmail).first<{ id: string }>()
     if (taken) return { kind: 'conflict' }
-    const verified = row.deliveredBy === 'mailer'
+    const takenAdditional = await this.stmt('SELECT user_id FROM account_emails WHERE email = ?', row.newEmail).first<{ user_id: string }>()
+    if (takenAdditional) return { kind: 'conflict' }
     await this.stmt(
       `UPDATE users SET email = ?, email_verified_at = ${verified ? "datetime('now')" : 'NULL'} WHERE id = ?`,
       row.newEmail, row.userId,
@@ -1783,6 +1923,116 @@ export class D1ServerStore implements ServerStore {
     return { kind: 'ok', userId: row.userId, newEmail: row.newEmail, verified }
   }
 
+  // ── multiple emails per account (TODO.identity-features/01) ────────
+
+  private static toAccountEmail(row: Record<string, unknown>, isPrimary: boolean): AccountEmail {
+    return {
+      userId: row.user_id as string,
+      email: row.email as string,
+      verifiedAt: (row.verified_at as string | null) ?? null,
+      isPrimary,
+      addedBy: (row.added_by as string | null) ?? null,
+      createdAt: row.created_at as string,
+    }
+  }
+
+  /** The account's addresses: the PRIMARY first (the users row's email +
+   *  its verification stamp), then the additional account_emails rows
+   *  (oldest first). */
+  async listAccountEmails(userId: string): Promise<AccountEmail[]> {
+    await this.ensureAccountEmailSupport()
+    const primary = await this.stmt(
+      'SELECT id AS user_id, email, email_verified_at AS verified_at, created_at FROM users WHERE id = ?', userId,
+    ).first<Record<string, unknown>>()
+    const res = await this.stmt(
+      'SELECT * FROM account_emails WHERE user_id = ? ORDER BY created_at, email', userId,
+    ).all<Record<string, unknown>>()
+    const out: AccountEmail[] = []
+    if (primary) out.push(D1ServerStore.toAccountEmail(primary, true))
+    out.push(...res.results.map(r => D1ServerStore.toAccountEmail(r, false)))
+    return out
+  }
+
+  /** Resolve the account by ANY of its addresses: the primary always
+   *  names it (and the primary owner always wins — the deterministic
+   *  rule); an additional ONLY when verified. */
+  async findUserByAnyEmail(email: string): Promise<AuthUserPayload | null> {
+    await this.ensureAccountEmailSupport()
+    const normalized = email.trim().toLowerCase()
+    const primary = await this.stmt('SELECT * FROM users WHERE email = ?', normalized).first<UserRecord>()
+    if (primary) return toPayload(primary)
+    const owner = await this.stmt(
+      'SELECT user_id FROM account_emails WHERE email = ? AND verified_at IS NOT NULL', normalized,
+    ).first<{ user_id: string }>()
+    if (!owner) return null
+    const user = await this.stmt('SELECT * FROM users WHERE id = ?', owner.user_id).first<UserRecord>()
+    return user ? toPayload(user) : null
+  }
+
+  /** Add an ADDITIONAL address (normalized lowercase; the row lands
+   *  UNVERIFIED). The account's own existing row answers 'present' (the
+   *  idempotent re-add); any other hold of the address — a primary
+   *  anywhere (this account's included) or another account's additional
+   *  — answers 'conflict'. The unique index is the race backstop. */
+  async addAccountEmail(userId: string, email: string, addedBy?: string | null): Promise<AddAccountEmailResult> {
+    await this.ensureAccountEmailSupport()
+    const normalized = email.trim().toLowerCase()
+    const takenPrimary = await this.stmt('SELECT id FROM users WHERE email = ?', normalized).first<{ id: string }>()
+    if (takenPrimary) return 'conflict'
+    const existing = await this.stmt('SELECT user_id FROM account_emails WHERE email = ?', normalized).first<{ user_id: string }>()
+    if (existing) return existing.user_id === userId ? 'present' : 'conflict'
+    try {
+      await this.stmt(
+        'INSERT INTO account_emails (user_id, email, added_by) VALUES (?, ?, ?)',
+        userId, normalized, addedBy ?? null,
+      ).run()
+    } catch (e) {
+      if (String((e as Error).message).includes('UNIQUE')) return 'conflict'
+      throw e
+    }
+    return 'added'
+  }
+
+  /** The verification ceremony's stamp on the account's OWN row: the
+   *  guarded UPDATE flips verified_at, once. */
+  async markAccountEmailVerified(userId: string, email: string): Promise<boolean> {
+    await this.ensureAccountEmailSupport()
+    const res = await this.stmt(
+      "UPDATE account_emails SET verified_at = datetime('now') WHERE user_id = ? AND email = ? AND verified_at IS NULL",
+      userId, email.trim().toLowerCase(),
+    ).run()
+    return (res.meta.changes ?? 0) > 0
+  }
+
+  /** Promote a VERIFIED additional to primary: the promoted address
+   *  becomes users.email with its verification stamp; the outgoing
+   *  primary takes the row's place in account_emails with ITS stamp
+   *  (it stays a verified additional — sign-in by it keeps working). */
+  async setPrimaryAccountEmail(userId: string, email: string): Promise<'ok' | 'unknown' | 'unverified'> {
+    await this.ensureAccountEmailSupport()
+    const normalized = email.trim().toLowerCase()
+    const row = await this.stmt('SELECT * FROM account_emails WHERE user_id = ? AND email = ?', userId, normalized).first<Record<string, unknown>>()
+    if (!row) return 'unknown'
+    if (!row.verified_at) return 'unverified'
+    const current = await this.stmt('SELECT email, email_verified_at FROM users WHERE id = ?', userId).first<{ email: string; email_verified_at: string | null }>()
+    if (!current) return 'unknown'
+    await this.stmt('UPDATE users SET email = ?, email_verified_at = ? WHERE id = ?', normalized, row.verified_at as string, userId).run()
+    await this.stmt('DELETE FROM account_emails WHERE user_id = ? AND email = ?', userId, normalized).run()
+    await this.stmt('INSERT INTO account_emails (user_id, email, verified_at) VALUES (?, ?, ?)', userId, current.email, current.email_verified_at).run()
+    return 'ok'
+  }
+
+  /** Remove an ADDITIONAL address. The primary refuses honestly
+   *  ('primary' — promote another address first). */
+  async removeAccountEmail(userId: string, email: string): Promise<'ok' | 'primary' | 'unknown'> {
+    await this.ensureAccountEmailSupport()
+    const normalized = email.trim().toLowerCase()
+    const current = await this.stmt('SELECT email FROM users WHERE id = ?', userId).first<{ email: string }>()
+    if (current?.email === normalized) return 'primary'
+    const res = await this.stmt('DELETE FROM account_emails WHERE user_id = ? AND email = ?', userId, normalized).run()
+    return (res.meta.changes ?? 0) > 0 ? 'ok' : 'unknown'
+  }
+
   // ── strong authentication: the factor registry (TODO.identity-sso/02 + /03) ──
   // The same SQL as the SQLite half (store/sqlite/factors-store.ts): the
   // one-time consumes are guarded UPDATEs, the counter advance is the
@@ -2318,6 +2568,14 @@ export class D1ServerStore implements ServerStore {
     return res.results.map(D1ServerStore.toOrgMembership)
   }
 
+  async listAllOrgMemberships(): Promise<OrgMembership[]> {
+    await this.ensureMembershipSupport()
+    const res = await this.stmt(
+      'SELECT * FROM org_memberships ORDER BY org_id, created_at',
+    ).all<Record<string, unknown>>()
+    return res.results.map(D1ServerStore.toOrgMembership)
+  }
+
   async getOrgMembership(userId: string, orgId: string): Promise<OrgMembership | null> {
     await this.ensureMembershipSupport()
     const row = await this.stmt('SELECT * FROM org_memberships WHERE user_id = ? AND org_id = ?', userId, orgId)
@@ -3112,31 +3370,27 @@ export class D1ServerStore implements ServerStore {
   // The SAME statements as sqlite/notify.ts's sync half (D1 is SQLite).
   // The defensive ensure mirrors the instrument_registrations posture:
   // a dev D1 migrated from before migration 0018 lacks the table.
-
-  private notifyDeliverySupportEnsured: Promise<void> | null = null
+  // (Memoized per (binding, chain) at module scope — the header note.)
 
   private ensureNotifyDeliverySupport(): Promise<void> {
-    if (!this.notifyDeliverySupportEnsured) {
-      this.notifyDeliverySupportEnsured = (async () => {
-        await this.db.prepare(
-          `CREATE TABLE IF NOT EXISTS notify_deliveries (
-             id TEXT PRIMARY KEY,
-             event_id TEXT NOT NULL,
-             user_id TEXT NOT NULL,
-             reason TEXT NOT NULL,
-             email TEXT NOT NULL,
-             email_status TEXT,
-             email_at TEXT,
-             created_at TEXT NOT NULL DEFAULT (datetime('now')),
-             UNIQUE (event_id, user_id)
-           )`,
-        ).run()
-        await this.db.prepare('CREATE INDEX IF NOT EXISTS idx_notify_deliveries_event ON notify_deliveries (event_id)').run()
-        await this.db.prepare('CREATE INDEX IF NOT EXISTS idx_notify_deliveries_user ON notify_deliveries (user_id)').run()
-        await this.db.prepare('CREATE INDEX IF NOT EXISTS idx_notify_deliveries_status ON notify_deliveries (email_status)').run()
-      })()
-    }
-    return this.notifyDeliverySupportEnsured
+    return ensured(this.db, 'notifyDeliverySupport', async () => {
+      await this.db.prepare(
+        `CREATE TABLE IF NOT EXISTS notify_deliveries (
+           id TEXT PRIMARY KEY,
+           event_id TEXT NOT NULL,
+           user_id TEXT NOT NULL,
+           reason TEXT NOT NULL,
+           email TEXT NOT NULL,
+           email_status TEXT,
+           email_at TEXT,
+           created_at TEXT NOT NULL DEFAULT (datetime('now')),
+           UNIQUE (event_id, user_id)
+         )`,
+      ).run()
+      await this.db.prepare('CREATE INDEX IF NOT EXISTS idx_notify_deliveries_event ON notify_deliveries (event_id)').run()
+      await this.db.prepare('CREATE INDEX IF NOT EXISTS idx_notify_deliveries_user ON notify_deliveries (user_id)').run()
+      await this.db.prepare('CREATE INDEX IF NOT EXISTS idx_notify_deliveries_status ON notify_deliveries (email_status)').run()
+    })
   }
 
   private static toNotifyDelivery(row: Record<string, unknown>): NotifyDelivery {