@oimlsmart/platform-server 0.1.8 → 0.1.9

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@oimlsmart/platform-server",
-  "version": "0.1.8",
+  "version": "0.1.9",
   "description": "The OIML SMART platform server kernel: the store seam (ServerStore + the D1 and SQLite implementations), the canonical D1 migration set both deployments apply, the instance profile, the mailer, the RBAC map, the OIDC/OAuth client cones, and the shared role/permission vocabulary. Consumed by the smart monorepo (browser/) and the identity service.",
   "type": "module",
   "repository": {

package/src/store/d1.ts

@@ -188,6 +188,73 @@ function toAdminRow(user: UserRecord & { last_login?: string | null; provider?:
  *  store wipes alongside (its rows reference the wiped events). */
 const WIPE_TABLES = ['entity_changes', 'evidence_records', 'entities', 'events', 'instrument_registrations', 'notify_deliveries'] as const
 
+// ── The ensure chains' memo scope (the 2026-09 portal-load audit, R2) ──
+// Every defensive ensure below (a dev-database heal: the PRAGMA probes,
+// the CREATE … IF NOT EXISTS, the idempotent membership backfill) was
+// memoized on the store INSTANCE — but the Worker consumers install a
+// store per request (the binding factory memoizes per binding OBJECT and
+// the Workers runtime hands each request its own env, so the binding's
+// identity is not guaranteed to recur), and the audit measured the
+// ~13-statement chain on every authenticated request (~0.6–0.9 s on the
+// demo hub's D1). The ensures are idempotent by construction, so the
+// honest scope is the (binding, chain) pair held at MODULE scope: the
+// Worker's isolate persists across requests and the consumer pins the
+// binding (the smart repo's server/cloudflare.ts), so the same
+// D1Database object recurs and the chain runs once per isolate. A
+// consumer whose runtime rotates binding objects degrades to the old
+// per-request posture — correct, just unmemoized. A REJECTED ensure
+// evicts itself: the next call retries the heal.
+interface EnsureMemos {
+  usersColumns: Promise<void> | null
+  sessionColumns: Promise<void> | null
+  membershipSupport: Promise<void> | null
+  orgRegistrySupport: Promise<void> | null
+  holderAttributionSupport: Promise<void> | null
+  instrumentRegistrationSupport: Promise<void> | null
+  oidcColumns: Promise<void> | null
+  personalAccessTokenSupport: Promise<void> | null
+  consentGrantSupport: Promise<void> | null
+  accountEmailSupport: Promise<void> | null
+  notifyDeliverySupport: Promise<void> | null
+}
+
+const ensureMemosByBinding = new WeakMap<D1Database, EnsureMemos>()
+
+/** Run the chain once per (binding, slot); a rejection evicts itself so
+ *  the next caller retries. */
+function ensured(binding: D1Database, slot: keyof EnsureMemos, run: () => Promise<void>): Promise<void> {
+  let memos = ensureMemosByBinding.get(binding)
+  if (!memos) {
+    memos = {
+      usersColumns: null, sessionColumns: null, membershipSupport: null,
+      orgRegistrySupport: null, holderAttributionSupport: null,
+      instrumentRegistrationSupport: null, oidcColumns: null,
+      personalAccessTokenSupport: null, consentGrantSupport: null,
+      accountEmailSupport: null, notifyDeliverySupport: null,
+    }
+    ensureMemosByBinding.set(binding, memos)
+  }
+  let pending = memos[slot]
+  if (!pending) {
+    pending = run()
+    memos[slot] = pending
+    pending.catch(() => { if (memos[slot] === pending) memos[slot] = null })
+  }
+  return pending
+}
+
+// TODO.identity/06's last-active stamp (getSessionUser's write): the
+// DB-side 60 s WHERE clause stays the source of truth (a second
+// isolate's write still lands through it); the in-isolate cache below
+// simply never ISSUES the write the row would refuse — the audit's R2
+// measured that write on every authenticated request. Keyed on the
+// session token (per-isolate), capped so a long-lived isolate's map
+// stays bounded (a cap reset only re-issues a write the DB clause then
+// throttles — never a correctness change).
+const lastSeenWrites = new Map<string, number>()
+const LAST_SEEN_THROTTLE_MS = 60_000
+const LAST_SEEN_CACHE_CAP = 4096
+
 export class D1ServerStore implements ServerStore {
   constructor(private readonly db: D1Database) {}
 
@@ -198,43 +265,34 @@ export class D1ServerStore implements ServerStore {
   // TODO.federation/12: the roles/active columns arrive with migration
   // 0002 — a dev D1 migrated from the pre-RBAC 0001 lacks them, so the
   //  user methods ensure them defensively (PRAGMA probe + ALTER),
-  //  memoized per store.
-  private usersColumnsEnsured: Promise<void> | null = null
-
+  //  memoized per (binding, chain) at module scope (the header note).
   private ensureUserColumns(): Promise<void> {
-    if (!this.usersColumnsEnsured) {
-      this.usersColumnsEnsured = (async () => {
-        const cols = await this.db.prepare('PRAGMA table_info(users)').all<{ name: string }>()
-        const names = new Set(cols.results.map(c => c.name))
-        if (!names.has('roles')) await this.db.prepare('ALTER TABLE users ADD COLUMN roles TEXT').run()
-        if (!names.has('active')) await this.db.prepare('ALTER TABLE users ADD COLUMN active INTEGER NOT NULL DEFAULT 1').run()
-        // TODO.identity/06 (the account console): the address's
-        // verification state.
-        if (!names.has('email_verified_at')) await this.db.prepare('ALTER TABLE users ADD COLUMN email_verified_at TEXT').run()
-      })()
-    }
-    return this.usersColumnsEnsured
+    return ensured(this.db, 'usersColumns', async () => {
+      const cols = await this.db.prepare('PRAGMA table_info(users)').all<{ name: string }>()
+      const names = new Set(cols.results.map(c => c.name))
+      if (!names.has('roles')) await this.db.prepare('ALTER TABLE users ADD COLUMN roles TEXT').run()
+      if (!names.has('active')) await this.db.prepare('ALTER TABLE users ADD COLUMN active INTEGER NOT NULL DEFAULT 1').run()
+      // TODO.identity/06 (the account console): the address's
+      // verification state.
+      if (!names.has('email_verified_at')) await this.db.prepare('ALTER TABLE users ADD COLUMN email_verified_at TEXT').run()
+    })
   }
 
   // TODO.identity/06 (the account console's sessions section): the
   // sign-in context columns arrive with migration 0009 — a dev D1
   // migrated from before it lacks them, so the session methods ensure
-  // them defensively (the ensureUserColumns posture, memoized per store).
-  private sessionColumnsEnsured: Promise<void> | null = null
-
+  // them defensively (the ensureUserColumns posture, memoized per
+  // (binding, chain) at module scope).
   private ensureSessionColumns(): Promise<void> {
-    if (!this.sessionColumnsEnsured) {
-      this.sessionColumnsEnsured = (async () => {
-        const cols = await this.db.prepare('PRAGMA table_info(sessions)').all<{ name: string }>()
-        const names = new Set(cols.results.map(c => c.name))
-        if (!names.has('user_agent')) await this.db.prepare('ALTER TABLE sessions ADD COLUMN user_agent TEXT').run()
-        if (!names.has('ip')) await this.db.prepare('ALTER TABLE sessions ADD COLUMN ip TEXT').run()
-        if (!names.has('last_seen_at')) await this.db.prepare('ALTER TABLE sessions ADD COLUMN last_seen_at TEXT').run()
-        // TODO.identity-sso/02+03: the sign-in provenance.
-        if (!names.has('amr')) await this.db.prepare('ALTER TABLE sessions ADD COLUMN amr TEXT').run()
-      })()
-    }
-    return this.sessionColumnsEnsured
+    return ensured(this.db, 'sessionColumns', async () => {
+      const cols = await this.db.prepare('PRAGMA table_info(sessions)').all<{ name: string }>()
+      const names = new Set(cols.results.map(c => c.name))
+      if (!names.has('user_agent')) await this.db.prepare('ALTER TABLE sessions ADD COLUMN user_agent TEXT').run()
+      if (!names.has('ip')) await this.db.prepare('ALTER TABLE sessions ADD COLUMN ip TEXT').run()
+      if (!names.has('last_seen_at')) await this.db.prepare('ALTER TABLE sessions ADD COLUMN last_seen_at TEXT').run()
+      // TODO.identity-sso/02+03: the sign-in provenance.
+      if (!names.has('amr')) await this.db.prepare('ALTER TABLE sessions ADD COLUMN amr TEXT').run()
+    })
   }
 
   // TODO.identity/11 (the multi-org membership model): the
@@ -242,304 +300,267 @@ export class D1ServerStore implements ServerStore {
   // token-flow context columns arrive with migration 0011 — a dev D1
   // migrated from before it lacks them, so the membership/session/token
   // methods ensure them defensively (the ensureUserColumns posture,
-  // memoized per store). The backfill (the migration's twin) is
-  // IDEMPOTENT and rides the ensure: every org-bound account's primary
-  // membership mirrors the legacy columns.
-  private membershipSupportEnsured: Promise<void> | null = null
-
+  // memoized per (binding, chain) at module scope). The backfill (the
+  // migration's twin) is IDEMPOTENT and rides the ensure: every
+  // org-bound account's primary membership mirrors the legacy columns.
   private ensureMembershipSupport(): Promise<void> {
-    if (!this.membershipSupportEnsured) {
-      this.membershipSupportEnsured = (async () => {
-        await this.db.prepare(
-          `CREATE TABLE IF NOT EXISTS org_memberships (
-             id TEXT PRIMARY KEY,
-             user_id TEXT NOT NULL REFERENCES users(id),
-             org_id TEXT NOT NULL,
-             roles TEXT NOT NULL DEFAULT '[]',
-             state TEXT NOT NULL DEFAULT 'active',
-             is_primary INTEGER NOT NULL DEFAULT 0,
-             invited_by TEXT,
-             created_at TEXT NOT NULL DEFAULT (datetime('now')),
-             activated_at TEXT,
-             disabled_at TEXT,
-             disabled_by TEXT,
-             UNIQUE (user_id, org_id)
-           )`,
-        ).run()
-        await this.db.prepare('CREATE INDEX IF NOT EXISTS idx_org_memberships_org ON org_memberships (org_id, state)').run()
-        await this.db.prepare('CREATE INDEX IF NOT EXISTS idx_org_memberships_user ON org_memberships (user_id, state)').run()
-        // TODO.identity-features/09 (the org-member data cone): the cone
-        // column arrives with migration 0017 — a dev D1 predating it
-        // grows the column here. NULL = org-wide: existing memberships
-        // keep their posture silently.
-        const membershipCols = await this.db.prepare('PRAGMA table_info(org_memberships)').all<{ name: string }>()
-        if (!membershipCols.results.some(c => c.name === 'cone')) {
-          await this.db.prepare('ALTER TABLE org_memberships ADD COLUMN cone TEXT').run()
-        }
-        const sessionCols = await this.db.prepare('PRAGMA table_info(sessions)').all<{ name: string }>()
-        if (!sessionCols.results.some(c => c.name === 'active_org')) {
-          await this.db.prepare('ALTER TABLE sessions ADD COLUMN active_org TEXT').run()
-        }
-        const codeCols = await this.db.prepare('PRAGMA table_info(oidc_codes)').all<{ name: string }>()
-        if (!codeCols.results.some(c => c.name === 'context_org')) {
-          await this.db.prepare('ALTER TABLE oidc_codes ADD COLUMN context_org TEXT').run()
-        }
-        const accessCols = await this.db.prepare('PRAGMA table_info(oidc_access_tokens)').all<{ name: string }>()
-        if (!accessCols.results.some(c => c.name === 'context_org')) {
-          await this.db.prepare('ALTER TABLE oidc_access_tokens ADD COLUMN context_org TEXT').run()
-        }
-        await this.db.prepare(
-          `INSERT OR IGNORE INTO org_memberships (id, user_id, org_id, roles, state, is_primary, activated_at)
-           SELECT 'mbr-' || id, id, org_id,
-                  CASE WHEN roles IS NOT NULL AND roles != '' THEN roles ELSE json_array(role) END,
-                  'active', 1, COALESCE(last_login, created_at)
-           FROM users WHERE org_id IS NOT NULL`,
-        ).run()
-      })()
-    }
-    return this.membershipSupportEnsured
+    return ensured(this.db, 'membershipSupport', async () => {
+      await this.db.prepare(
+        `CREATE TABLE IF NOT EXISTS org_memberships (
+           id TEXT PRIMARY KEY,
+           user_id TEXT NOT NULL REFERENCES users(id),
+           org_id TEXT NOT NULL,
+           roles TEXT NOT NULL DEFAULT '[]',
+           state TEXT NOT NULL DEFAULT 'active',
+           is_primary INTEGER NOT NULL DEFAULT 0,
+           invited_by TEXT,
+           created_at TEXT NOT NULL DEFAULT (datetime('now')),
+           activated_at TEXT,
+           disabled_at TEXT,
+           disabled_by TEXT,
+           UNIQUE (user_id, org_id)
+         )`,
+      ).run()
+      await this.db.prepare('CREATE INDEX IF NOT EXISTS idx_org_memberships_org ON org_memberships (org_id, state)').run()
+      await this.db.prepare('CREATE INDEX IF NOT EXISTS idx_org_memberships_user ON org_memberships (user_id, state)').run()
+      // TODO.identity-features/09 (the org-member data cone): the cone
+      // column arrives with migration 0017 — a dev D1 predating it
+      // grows the column here. NULL = org-wide: existing memberships
+      // keep their posture silently.
+      const membershipCols = await this.db.prepare('PRAGMA table_info(org_memberships)').all<{ name: string }>()
+      if (!membershipCols.results.some(c => c.name === 'cone')) {
+        await this.db.prepare('ALTER TABLE org_memberships ADD COLUMN cone TEXT').run()
+      }
+      const sessionCols = await this.db.prepare('PRAGMA table_info(sessions)').all<{ name: string }>()
+      if (!sessionCols.results.some(c => c.name === 'active_org')) {
+        await this.db.prepare('ALTER TABLE sessions ADD COLUMN active_org TEXT').run()
+      }
+      const codeCols = await this.db.prepare('PRAGMA table_info(oidc_codes)').all<{ name: string }>()
+      if (!codeCols.results.some(c => c.name === 'context_org')) {
+        await this.db.prepare('ALTER TABLE oidc_codes ADD COLUMN context_org TEXT').run()
+      }
+      const accessCols = await this.db.prepare('PRAGMA table_info(oidc_access_tokens)').all<{ name: string }>()
+      if (!accessCols.results.some(c => c.name === 'context_org')) {
+        await this.db.prepare('ALTER TABLE oidc_access_tokens ADD COLUMN context_org TEXT').run()
+      }
+      await this.db.prepare(
+        `INSERT OR IGNORE INTO org_memberships (id, user_id, org_id, roles, state, is_primary, activated_at)
+         SELECT 'mbr-' || id, id, org_id,
+                CASE WHEN roles IS NOT NULL AND roles != '' THEN roles ELSE json_array(role) END,
+                'active', 1, COALESCE(last_login, created_at)
+         FROM users WHERE org_id IS NOT NULL`,
+      ).run()
+    })
   }
 
   // TODO.identity-features/05 (the organization registry): the
   // org_registry table arrives with migration 0013 — a dev D1 migrated
   // from before it lacks the table, so the registry methods ensure it
   // defensively (the ensureMembershipSupport posture, memoized per
-  // store).
-  private orgRegistrySupportEnsured: Promise<void> | null = null
-
+  // (binding, chain) at module scope).
   private ensureOrgRegistrySupport(): Promise<void> {
-    if (!this.orgRegistrySupportEnsured) {
-      this.orgRegistrySupportEnsured = (async () => {
-        await this.db.prepare(
-          `CREATE TABLE IF NOT EXISTS org_registry (
-             id TEXT PRIMARY KEY,
-             name TEXT NOT NULL,
-             short_name TEXT,
-             kind TEXT,
-             country TEXT,
-             contacts TEXT NOT NULL DEFAULT '[]',
-             participant_ref TEXT,
-             state TEXT NOT NULL DEFAULT 'active',
-             created_at TEXT NOT NULL DEFAULT (datetime('now')),
-             created_by TEXT,
-             updated_at TEXT,
-             updated_by TEXT,
-             disabled_at TEXT,
-             disabled_by TEXT
-           )`,
-        ).run()
-        await this.db.prepare('CREATE INDEX IF NOT EXISTS idx_org_registry_state ON org_registry (state)').run()
-        // TODO.identity-features/10 (the OIML Member category): the
-        // designation links + the CS status facet arrive with migration
-        // 0019 — a dev D1 predating it grows the columns here (the
-        // PRAGMA probe + ALTER posture of ensureUserColumns). NULL = not
-        // recorded: existing rows keep their posture silently.
-        const cols = await this.db.prepare('PRAGMA table_info(org_registry)').all<{ name: string }>()
-        const names = new Set(cols.results.map(c => c.name))
-        if (!names.has('designated_by')) await this.db.prepare('ALTER TABLE org_registry ADD COLUMN designated_by TEXT').run()
-        if (!names.has('proposed_by')) await this.db.prepare('ALTER TABLE org_registry ADD COLUMN proposed_by TEXT').run()
-        if (!names.has('cs_status')) await this.db.prepare('ALTER TABLE org_registry ADD COLUMN cs_status TEXT').run()
-      })()
-    }
-    return this.orgRegistrySupportEnsured
+    return ensured(this.db, 'orgRegistrySupport', async () => {
+      await this.db.prepare(
+        `CREATE TABLE IF NOT EXISTS org_registry (
+           id TEXT PRIMARY KEY,
+           name TEXT NOT NULL,
+           short_name TEXT,
+           kind TEXT,
+           country TEXT,
+           contacts TEXT NOT NULL DEFAULT '[]',
+           participant_ref TEXT,
+           state TEXT NOT NULL DEFAULT 'active',
+           created_at TEXT NOT NULL DEFAULT (datetime('now')),
+           created_by TEXT,
+           updated_at TEXT,
+           updated_by TEXT,
+           disabled_at TEXT,
+           disabled_by TEXT
+         )`,
+      ).run()
+      await this.db.prepare('CREATE INDEX IF NOT EXISTS idx_org_registry_state ON org_registry (state)').run()
+      // TODO.identity-features/10 (the OIML Member category): the
+      // designation links + the CS status facet arrive with migration
+      // 0019 — a dev D1 predating it grows the columns here (the
+      // PRAGMA probe + ALTER posture of ensureUserColumns). NULL = not
+      // recorded: existing rows keep their posture silently.
+      const cols = await this.db.prepare('PRAGMA table_info(org_registry)').all<{ name: string }>()
+      const names = new Set(cols.results.map(c => c.name))
+      if (!names.has('designated_by')) await this.db.prepare('ALTER TABLE org_registry ADD COLUMN designated_by TEXT').run()
+      if (!names.has('proposed_by')) await this.db.prepare('ALTER TABLE org_registry ADD COLUMN proposed_by TEXT').run()
+      if (!names.has('cs_status')) await this.db.prepare('ALTER TABLE org_registry ADD COLUMN cs_status TEXT').run()
+    })
   }
 
   // TODO.register/02 (the register's holder-org attribution): the
   // certificate_holder_orgs / certificate_holder_claims tables arrive with
   // migration 0015 — a dev D1 migrated from before it lacks them, so the
   // attribution/claim methods ensure them defensively (the
-  // ensureOrgRegistrySupport posture, memoized per store).
-  private holderAttributionSupportEnsured: Promise<void> | null = null
-
+  // ensureOrgRegistrySupport posture, memoized per (binding, chain) at
+  // module scope).
   private ensureHolderAttributionSupport(): Promise<void> {
-    if (!this.holderAttributionSupportEnsured) {
-      this.holderAttributionSupportEnsured = (async () => {
-        await this.db.prepare(
-          `CREATE TABLE IF NOT EXISTS certificate_holder_orgs (
-             certificate_id TEXT PRIMARY KEY,
-             org_id TEXT NOT NULL,
-             org_name TEXT NOT NULL,
-             source TEXT NOT NULL,
-             attributed_at TEXT NOT NULL,
-             attributed_by TEXT,
-             claim_id TEXT
-           )`,
-        ).run()
-        await this.db.prepare('CREATE INDEX IF NOT EXISTS idx_certificate_holder_orgs_org ON certificate_holder_orgs (org_id)').run()
-        await this.db.prepare(
-          `CREATE TABLE IF NOT EXISTS certificate_holder_claims (
-             id TEXT PRIMARY KEY,
-             certificate_id TEXT NOT NULL,
-             claimant_org_id TEXT NOT NULL,
-             claimant_org_name TEXT NOT NULL,
-             matched_holder_name TEXT NOT NULL,
-             claimed_by TEXT NOT NULL,
-             state TEXT NOT NULL DEFAULT 'pending',
-             decided_by TEXT,
-             decided_at TEXT,
-             refusal_reason TEXT,
-             created_at TEXT NOT NULL DEFAULT (datetime('now'))
-           )`,
-        ).run()
-        await this.db.prepare('CREATE INDEX IF NOT EXISTS idx_certificate_holder_claims_cert ON certificate_holder_claims (certificate_id)').run()
-        await this.db.prepare('CREATE INDEX IF NOT EXISTS idx_certificate_holder_claims_state ON certificate_holder_claims (state)').run()
-        await this.db.prepare('CREATE INDEX IF NOT EXISTS idx_certificate_holder_claims_org ON certificate_holder_claims (claimant_org_id)').run()
-      })()
-    }
-    return this.holderAttributionSupportEnsured
+    return ensured(this.db, 'holderAttributionSupport', async () => {
+      await this.db.prepare(
+        `CREATE TABLE IF NOT EXISTS certificate_holder_orgs (
+           certificate_id TEXT PRIMARY KEY,
+           org_id TEXT NOT NULL,
+           org_name TEXT NOT NULL,
+           source TEXT NOT NULL,
+           attributed_at TEXT NOT NULL,
+           attributed_by TEXT,
+           claim_id TEXT
+         )`,
+      ).run()
+      await this.db.prepare('CREATE INDEX IF NOT EXISTS idx_certificate_holder_orgs_org ON certificate_holder_orgs (org_id)').run()
+      await this.db.prepare(
+        `CREATE TABLE IF NOT EXISTS certificate_holder_claims (
+           id TEXT PRIMARY KEY,
+           certificate_id TEXT NOT NULL,
+           claimant_org_id TEXT NOT NULL,
+           claimant_org_name TEXT NOT NULL,
+           matched_holder_name TEXT NOT NULL,
+           claimed_by TEXT NOT NULL,
+           state TEXT NOT NULL DEFAULT 'pending',
+           decided_by TEXT,
+           decided_at TEXT,
+           refusal_reason TEXT,
+           created_at TEXT NOT NULL DEFAULT (datetime('now'))
+         )`,
+      ).run()
+      await this.db.prepare('CREATE INDEX IF NOT EXISTS idx_certificate_holder_claims_cert ON certificate_holder_claims (certificate_id)').run()
+      await this.db.prepare('CREATE INDEX IF NOT EXISTS idx_certificate_holder_claims_state ON certificate_holder_claims (state)').run()
+      await this.db.prepare('CREATE INDEX IF NOT EXISTS idx_certificate_holder_claims_org ON certificate_holder_claims (claimant_org_id)').run()
+    })
   }
 
   // TODO.register/03 (the instrument register): the
   // instrument_registrations table arrives with migration 0016 — a dev
   // D1 migrated from before it lacks the table, so the register methods
   // ensure it defensively (the ensureOrgRegistrySupport posture,
-  // memoized per store).
-  private instrumentRegistrationSupportEnsured: Promise<void> | null = null
-
+  // memoized per (binding, chain) at module scope).
   private ensureInstrumentRegistrationSupport(): Promise<void> {
-    if (!this.instrumentRegistrationSupportEnsured) {
-      this.instrumentRegistrationSupportEnsured = (async () => {
-        await this.db.prepare(
-          `CREATE TABLE IF NOT EXISTS instrument_registrations (
-             id TEXT PRIMARY KEY,
-             certificate_id TEXT NOT NULL,
-             holder_org_id TEXT NOT NULL,
-             standard_id TEXT NOT NULL,
-             serial_number TEXT NOT NULL,
-             manufacture_date TEXT,
-             designations TEXT NOT NULL DEFAULT '{}',
-             scope_status TEXT NOT NULL,
-             scope_detail TEXT,
-             lifecycle TEXT NOT NULL DEFAULT 'registered',
-             registered_at TEXT NOT NULL DEFAULT (datetime('now')),
-             registered_by TEXT,
-             updated_at TEXT,
-             updated_by TEXT,
-             UNIQUE (certificate_id, serial_number)
-           )`,
-        ).run()
-        await this.db.prepare('CREATE INDEX IF NOT EXISTS idx_instrument_registrations_certificate ON instrument_registrations (certificate_id)').run()
-        await this.db.prepare('CREATE INDEX IF NOT EXISTS idx_instrument_registrations_holder ON instrument_registrations (holder_org_id)').run()
-        await this.db.prepare('CREATE INDEX IF NOT EXISTS idx_instrument_registrations_lifecycle ON instrument_registrations (lifecycle)').run()
-      })()
-    }
-    return this.instrumentRegistrationSupportEnsured
+    return ensured(this.db, 'instrumentRegistrationSupport', async () => {
+      await this.db.prepare(
+        `CREATE TABLE IF NOT EXISTS instrument_registrations (
+           id TEXT PRIMARY KEY,
+           certificate_id TEXT NOT NULL,
+           holder_org_id TEXT NOT NULL,
+           standard_id TEXT NOT NULL,
+           serial_number TEXT NOT NULL,
+           manufacture_date TEXT,
+           designations TEXT NOT NULL DEFAULT '{}',
+           scope_status TEXT NOT NULL,
+           scope_detail TEXT,
+           lifecycle TEXT NOT NULL DEFAULT 'registered',
+           registered_at TEXT NOT NULL DEFAULT (datetime('now')),
+           registered_by TEXT,
+           updated_at TEXT,
+           updated_by TEXT,
+           UNIQUE (certificate_id, serial_number)
+         )`,
+      ).run()
+      await this.db.prepare('CREATE INDEX IF NOT EXISTS idx_instrument_registrations_certificate ON instrument_registrations (certificate_id)').run()
+      await this.db.prepare('CREATE INDEX IF NOT EXISTS idx_instrument_registrations_holder ON instrument_registrations (holder_org_id)').run()
+      await this.db.prepare('CREATE INDEX IF NOT EXISTS idx_instrument_registrations_lifecycle ON instrument_registrations (lifecycle)').run()
+    })
   }
 
   // TODO.identity-sso/02+03: the amr provenance columns on the OIDC
   // flow rows arrive with migration 0012 — the OIDC methods ensure them
-  // defensively (the same memoized posture as the session/user columns),
-  // so a dev D1 migrated from before the wave never 500s the core flow.
-  private oidcColumnsEnsured: Promise<void> | null = null
-
+  // defensively (the same memoized posture as the session/user columns,
+  // per (binding, chain) at module scope), so a dev D1 migrated from
+  // before the wave never 500s the core flow.
   private ensureOidcColumns(): Promise<void> {
-    if (!this.oidcColumnsEnsured) {
-      this.oidcColumnsEnsured = (async () => {
-        const codeCols = await this.db.prepare('PRAGMA table_info(oidc_codes)').all<{ name: string }>()
-        if (!codeCols.results.some(c => c.name === 'amr')) {
-          await this.db.prepare('ALTER TABLE oidc_codes ADD COLUMN amr TEXT').run()
-        }
-        const tokenCols = await this.db.prepare('PRAGMA table_info(oidc_access_tokens)').all<{ name: string }>()
-        if (!tokenCols.results.some(c => c.name === 'amr')) {
-          await this.db.prepare('ALTER TABLE oidc_access_tokens ADD COLUMN amr TEXT').run()
-        }
-      })()
-    }
-    return this.oidcColumnsEnsured
+    return ensured(this.db, 'oidcColumns', async () => {
+      const codeCols = await this.db.prepare('PRAGMA table_info(oidc_codes)').all<{ name: string }>()
+      if (!codeCols.results.some(c => c.name === 'amr')) {
+        await this.db.prepare('ALTER TABLE oidc_codes ADD COLUMN amr TEXT').run()
+      }
+      const tokenCols = await this.db.prepare('PRAGMA table_info(oidc_access_tokens)').all<{ name: string }>()
+      if (!tokenCols.results.some(c => c.name === 'amr')) {
+        await this.db.prepare('ALTER TABLE oidc_access_tokens ADD COLUMN amr TEXT').run()
+      }
+    })
   }
 
   // TODO.identity-features/08 (the personal access tokens): the
   // personal_access_tokens table arrives with migration 0020 — a dev D1
   // migrated from before it lacks the table, so the PAT methods ensure
   // it defensively (the ensureOrgRegistrySupport posture, memoized per
-  // store).
-  private personalAccessTokenSupportEnsured: Promise<void> | null = null
-
+  // (binding, chain) at module scope).
   private ensurePersonalAccessTokenSupport(): Promise<void> {
-    if (!this.personalAccessTokenSupportEnsured) {
-      this.personalAccessTokenSupportEnsured = (async () => {
-        await this.db.prepare(
-          `CREATE TABLE IF NOT EXISTS personal_access_tokens (
-             id TEXT PRIMARY KEY,
-             user_id TEXT NOT NULL REFERENCES users(id),
-             name TEXT NOT NULL,
-             token_hash TEXT NOT NULL,
-             token_prefix TEXT NOT NULL,
-             scopes TEXT NOT NULL DEFAULT '[]',
-             org_context TEXT,
-             created_at TEXT NOT NULL DEFAULT (datetime('now')),
-             expires_at TEXT NOT NULL,
-             last_used_at TEXT,
-             last_exchange_audit_at TEXT,
-             expiry_notified_at TEXT,
-             revoked_at TEXT,
-             revoked_by TEXT,
-             UNIQUE (token_hash)
-           )`,
-        ).run()
-        await this.db.prepare('CREATE INDEX IF NOT EXISTS idx_personal_access_tokens_user ON personal_access_tokens (user_id)').run()
-      })()
-    }
-    return this.personalAccessTokenSupportEnsured
+    return ensured(this.db, 'personalAccessTokenSupport', async () => {
+      await this.db.prepare(
+        `CREATE TABLE IF NOT EXISTS personal_access_tokens (
+           id TEXT PRIMARY KEY,
+           user_id TEXT NOT NULL REFERENCES users(id),
+           name TEXT NOT NULL,
+           token_hash TEXT NOT NULL,
+           token_prefix TEXT NOT NULL,
+           scopes TEXT NOT NULL DEFAULT '[]',
+           org_context TEXT,
+           created_at TEXT NOT NULL DEFAULT (datetime('now')),
+           expires_at TEXT NOT NULL,
+           last_used_at TEXT,
+           last_exchange_audit_at TEXT,
+           expiry_notified_at TEXT,
+           revoked_at TEXT,
+           revoked_by TEXT,
+           UNIQUE (token_hash)
+         )`,
+      ).run()
+      await this.db.prepare('CREATE INDEX IF NOT EXISTS idx_personal_access_tokens_user ON personal_access_tokens (user_id)').run()
+    })
   }
 
   // TODO.identity-features/12 (the remembered consent grants): the
   // oidc_consent_grants table arrives with migration 0021 — a dev D1
   // migrated from before it lacks the table, so the grant methods ensure
   // it defensively (the ensurePersonalAccessTokenSupport posture,
-  // memoized per store).
-  private consentGrantSupportEnsured: Promise<void> | null = null
-
+  // memoized per (binding, chain) at module scope).
   private ensureConsentGrantSupport(): Promise<void> {
-    if (!this.consentGrantSupportEnsured) {
-      this.consentGrantSupportEnsured = (async () => {
-        await this.db.prepare(
-          `CREATE TABLE IF NOT EXISTS oidc_consent_grants (
-             id TEXT PRIMARY KEY,
-             user_id TEXT NOT NULL REFERENCES users(id),
-             client_id TEXT NOT NULL,
-             scope TEXT NOT NULL,
-             created_at TEXT NOT NULL DEFAULT (datetime('now')),
-             revoked_at TEXT
-           )`,
-        ).run()
-        await this.db.prepare(
-          'CREATE UNIQUE INDEX IF NOT EXISTS idx_oidc_consent_grants_live ON oidc_consent_grants (user_id, client_id, scope) WHERE revoked_at IS NULL',
-        ).run()
-        await this.db.prepare('CREATE INDEX IF NOT EXISTS idx_oidc_consent_grants_user ON oidc_consent_grants (user_id)').run()
-      })()
-    }
-    return this.consentGrantSupportEnsured
+    return ensured(this.db, 'consentGrantSupport', async () => {
+      await this.db.prepare(
+        `CREATE TABLE IF NOT EXISTS oidc_consent_grants (
+           id TEXT PRIMARY KEY,
+           user_id TEXT NOT NULL REFERENCES users(id),
+           client_id TEXT NOT NULL,
+           scope TEXT NOT NULL,
+           created_at TEXT NOT NULL DEFAULT (datetime('now')),
+           revoked_at TEXT
+         )`,
+      ).run()
+      await this.db.prepare(
+        'CREATE UNIQUE INDEX IF NOT EXISTS idx_oidc_consent_grants_live ON oidc_consent_grants (user_id, client_id, scope) WHERE revoked_at IS NULL',
+      ).run()
+      await this.db.prepare('CREATE INDEX IF NOT EXISTS idx_oidc_consent_grants_user ON oidc_consent_grants (user_id)').run()
+    })
   }
 
   // TODO.identity-features/01 (multiple emails per account): the
   // account_emails table + the email_change_tokens.kind column arrive
   // with migration 0022 — a dev D1 migrated from before it lacks both,
   // so the address methods ensure them defensively (the
-  // ensureConsentGrantSupport posture, memoized per store).
-  private accountEmailSupportEnsured: Promise<void> | null = null
-
+  // ensureConsentGrantSupport posture, memoized per (binding, chain) at
+  // module scope).
   private ensureAccountEmailSupport(): Promise<void> {
-    if (!this.accountEmailSupportEnsured) {
-      this.accountEmailSupportEnsured = (async () => {
-        await this.db.prepare(
-          `CREATE TABLE IF NOT EXISTS account_emails (
-             user_id TEXT NOT NULL REFERENCES users(id),
-             email TEXT NOT NULL,
-             verified_at TEXT,
-             added_by TEXT,
-             created_at TEXT NOT NULL DEFAULT (datetime('now')),
-             PRIMARY KEY (user_id, email)
-           )`,
-        ).run()
-        await this.db.prepare('CREATE UNIQUE INDEX IF NOT EXISTS idx_account_emails_email ON account_emails (email)').run()
-        const tokenCols = await this.db.prepare('PRAGMA table_info(email_change_tokens)').all<{ name: string }>()
-        if (!tokenCols.results.some(c => c.name === 'kind')) {
-          await this.db.prepare("ALTER TABLE email_change_tokens ADD COLUMN kind TEXT NOT NULL DEFAULT 'change'").run()
-        }
-      })()
-    }
-    return this.accountEmailSupportEnsured
+    return ensured(this.db, 'accountEmailSupport', async () => {
+      await this.db.prepare(
+        `CREATE TABLE IF NOT EXISTS account_emails (
+           user_id TEXT NOT NULL REFERENCES users(id),
+           email TEXT NOT NULL,
+           verified_at TEXT,
+           added_by TEXT,
+           created_at TEXT NOT NULL DEFAULT (datetime('now')),
+           PRIMARY KEY (user_id, email)
+         )`,
+      ).run()
+      await this.db.prepare('CREATE UNIQUE INDEX IF NOT EXISTS idx_account_emails_email ON account_emails (email)').run()
+      const tokenCols = await this.db.prepare('PRAGMA table_info(email_change_tokens)').all<{ name: string }>()
+      if (!tokenCols.results.some(c => c.name === 'kind')) {
+        await this.db.prepare("ALTER TABLE email_change_tokens ADD COLUMN kind TEXT NOT NULL DEFAULT 'change'").run()
+      }
+    })
   }
 
   // ── users / sessions ─────────────────────────────────────────────
@@ -648,7 +669,28 @@ export class D1ServerStore implements ServerStore {
     return row?.id_token_hint ?? null
   }
 
+  /** TODO.identity/06's last-active stamp, throttled to one ISSUED write
+   *  per minute per session per isolate — the DB-side 60 s WHERE clause
+   *  stays the source of truth across isolates (the module-scope note);
+   *  the in-isolate cache only skips issuing a write the row would
+   *  refuse. A failed write is never cached (the cache set follows the
+   *  await), so the next request retries. */
+  private async stampSessionLastSeen(token: string): Promise<void> {
+    const now = Date.now()
+    if (now - (lastSeenWrites.get(token) ?? 0) < LAST_SEEN_THROTTLE_MS) return
+    await this.stmt(
+      "UPDATE sessions SET last_seen_at = datetime('now') WHERE token = ? AND (last_seen_at IS NULL OR last_seen_at < datetime('now', '-60 seconds'))",
+      token,
+    ).run()
+    if (lastSeenWrites.size >= LAST_SEEN_CACHE_CAP) lastSeenWrites.clear()
+    lastSeenWrites.set(token, now)
+  }
+
   async getSessionUser(token: string): Promise<AuthUserPayload | null> {
+    // The ensure chains are memoized per (binding, chain) at module scope
+    // (the header note) — past the isolate's first request these three
+    // awaits are memo hits, and the per-request work that remains is the
+    // session read itself.
     await this.ensureUserColumns()
     await this.ensureSessionColumns()
     await this.ensureMembershipSupport()
@@ -662,12 +704,6 @@ export class D1ServerStore implements ServerStore {
       token,
     ).first<{ user_id: string; active_org: string | null; amr: string | null; email: string; name: string; role: string; roles: string | null; org_id: string | null; avatar_url: string | null; provider: string; email_verified_at: string | null }>()
     if (!session) return null
-    // TODO.identity/06: the last-active stamp, throttled to one write
-    // per minute per session (the sessions section shows it).
-    await this.stmt(
-      "UPDATE sessions SET last_seen_at = datetime('now') WHERE token = ? AND (last_seen_at IS NULL OR last_seen_at < datetime('now', '-60 seconds'))",
-      token,
-    ).run()
     const amr = parseRoles(session.amr)
     const payload: AuthUserPayload = {
       id: session.user_id,
@@ -682,10 +718,16 @@ export class D1ServerStore implements ServerStore {
       ...(amr?.length ? { amr } : {}),
     }
     // TODO.identity/11: the active-org context (the membership model) —
-    // the payload's org/roles follow the session's stamped context.
+    // the payload's org/roles follow the session's stamped context. The
+    // three post-JOIN statements (the throttled last-active stamp, the
+    // two membership reads) are independent, so they round-trip together
+    // (the audit's R2: sequential statements are the latency).
     const activeOrg = session.active_org ?? null
-    const active = activeOrg ? await this.getOrgMembership(payload.id, activeOrg) : null
-    const primary = payload.orgId ? await this.getOrgMembership(payload.id, payload.orgId) : null
+    const [, active, primary] = await Promise.all([
+      this.stampSessionLastSeen(token),
+      activeOrg ? this.getOrgMembership(payload.id, activeOrg) : null,
+      payload.orgId ? this.getOrgMembership(payload.id, payload.orgId) : null,
+    ])
     const resolved = resolveOrgContext(payload, { activeOrg, active, primary })
     if (activeOrg && !(active && active.state === 'active')) {
       // The stale stamp never lingers (the membership ended mid-session).
@@ -2526,6 +2568,14 @@ export class D1ServerStore implements ServerStore {
     return res.results.map(D1ServerStore.toOrgMembership)
   }
 
+  async listAllOrgMemberships(): Promise<OrgMembership[]> {
+    await this.ensureMembershipSupport()
+    const res = await this.stmt(
+      'SELECT * FROM org_memberships ORDER BY org_id, created_at',
+    ).all<Record<string, unknown>>()
+    return res.results.map(D1ServerStore.toOrgMembership)
+  }
+
   async getOrgMembership(userId: string, orgId: string): Promise<OrgMembership | null> {
     await this.ensureMembershipSupport()
     const row = await this.stmt('SELECT * FROM org_memberships WHERE user_id = ? AND org_id = ?', userId, orgId)
@@ -3320,31 +3370,27 @@ export class D1ServerStore implements ServerStore {
   // The SAME statements as sqlite/notify.ts's sync half (D1 is SQLite).
   // The defensive ensure mirrors the instrument_registrations posture:
   // a dev D1 migrated from before migration 0018 lacks the table.
-
-  private notifyDeliverySupportEnsured: Promise<void> | null = null
+  // (Memoized per (binding, chain) at module scope — the header note.)
 
   private ensureNotifyDeliverySupport(): Promise<void> {
-    if (!this.notifyDeliverySupportEnsured) {
-      this.notifyDeliverySupportEnsured = (async () => {
-        await this.db.prepare(
-          `CREATE TABLE IF NOT EXISTS notify_deliveries (
-             id TEXT PRIMARY KEY,
-             event_id TEXT NOT NULL,
-             user_id TEXT NOT NULL,
-             reason TEXT NOT NULL,
-             email TEXT NOT NULL,
-             email_status TEXT,
-             email_at TEXT,
-             created_at TEXT NOT NULL DEFAULT (datetime('now')),
-             UNIQUE (event_id, user_id)
-           )`,
-        ).run()
-        await this.db.prepare('CREATE INDEX IF NOT EXISTS idx_notify_deliveries_event ON notify_deliveries (event_id)').run()
-        await this.db.prepare('CREATE INDEX IF NOT EXISTS idx_notify_deliveries_user ON notify_deliveries (user_id)').run()
-        await this.db.prepare('CREATE INDEX IF NOT EXISTS idx_notify_deliveries_status ON notify_deliveries (email_status)').run()
-      })()
-    }
-    return this.notifyDeliverySupportEnsured
+    return ensured(this.db, 'notifyDeliverySupport', async () => {
+      await this.db.prepare(
+        `CREATE TABLE IF NOT EXISTS notify_deliveries (
+           id TEXT PRIMARY KEY,
+           event_id TEXT NOT NULL,
+           user_id TEXT NOT NULL,
+           reason TEXT NOT NULL,
+           email TEXT NOT NULL,
+           email_status TEXT,
+           email_at TEXT,
+           created_at TEXT NOT NULL DEFAULT (datetime('now')),
+           UNIQUE (event_id, user_id)
+         )`,
+      ).run()
+      await this.db.prepare('CREATE INDEX IF NOT EXISTS idx_notify_deliveries_event ON notify_deliveries (event_id)').run()
+      await this.db.prepare('CREATE INDEX IF NOT EXISTS idx_notify_deliveries_user ON notify_deliveries (user_id)').run()
+      await this.db.prepare('CREATE INDEX IF NOT EXISTS idx_notify_deliveries_status ON notify_deliveries (email_status)').run()
+    })
   }
 
   private static toNotifyDelivery(row: Record<string, unknown>): NotifyDelivery {

package/src/store/sqlite/store.ts

@@ -903,6 +903,13 @@ export function listOrgMembers(orgId: string): OrgMembership[] {
   return rows.map(membershipPayload)
 }
 
+export function listAllOrgMemberships(): OrgMembership[] {
+  const rows = getDb().prepare(
+    'SELECT * FROM org_memberships ORDER BY org_id, created_at',
+  ).all() as OrgMembershipRow[]
+  return rows.map(membershipPayload)
+}
+
 export function getOrgMembership(userId: string, orgId: string): OrgMembership | null {
   const row = getDb().prepare('SELECT * FROM org_memberships WHERE user_id = ? AND org_id = ?')
     .get(userId, orgId) as OrgMembershipRow | undefined

package/src/store/sqlite.ts

@@ -56,6 +56,7 @@ import {
   listInstrumentRegistrationsForCertificate,
   listInstrumentRegistrationsForHolder,
   listOrgJoinRequests,
+  listAllOrgMemberships,
   listOrgMembers,
   listOrgMemberships,
   listOrgRegistryOrgs,
@@ -420,6 +421,9 @@ export function createSqliteServerStore(): ServerStore {
     async listOrgMembers(orgId: string): Promise<OrgMembership[]> {
       return listOrgMembers(orgId)
     },
+    async listAllOrgMemberships(): Promise<OrgMembership[]> {
+      return listAllOrgMemberships()
+    },
     async getOrgMembership(userId: string, orgId: string): Promise<OrgMembership | null> {
       return getOrgMembership(userId, orgId)
     },

package/src/store.ts

@@ -1965,6 +1965,11 @@ export interface ServerStore {
   listOrgMemberships(userId: string): Promise<OrgMembership[]>
   /** One org's memberships (the per-org view), every state. */
   listOrgMembers(orgId: string): Promise<OrgMembership[]>
+  /** EVERY membership across organizations, every state (the admin
+   *  registry's org list groups it in memory — one read, never a
+   *  per-org loop of listOrgMembers). Org- then creation-ordered, so a
+   *  caller's group-by-org keeps listOrgMembers' per-org ordering. */
+  listAllOrgMemberships(): Promise<OrgMembership[]>
   getOrgMembership(userId: string, orgId: string): Promise<OrgMembership | null>
   /** Create the membership — the org's admin inviting an EXISTING
    *  account (state 'invited': the holder accepts from the account