@oimlsmart/platform-server 0.1.8 → 0.2.0

package/README.md

@@ -11,8 +11,14 @@ pin IS the contract (TODO.repos/01).
 ## What it is
 
 - `store`, the ServerStore seam: the interface, every row type, the
-  demo-account plan, `installStore`/`getStore`. Worker-safe.
-- `store/d1`, the Cloudflare D1 implementation. Worker-safe.
+  demo-account plan, `installStore`/`getStore`, and `StoreUnavailable`
+  (the bounded writes' honest timeout error). Worker-safe.
+- `store/d1`, the Cloudflare D1 implementation: every write/batch/DDL
+  statement races a confirmation budget (`DEFAULT_STORE_WRITE_BUDGET_MS`
+  = 5 s; the consumer's `STORE_WRITE_BUDGET_MS` env binding retunes it
+  through `resolveStoreWriteBudgetMs` + the `d1StoreFor`/`D1ServerStore`
+  options) — a timeout throws the seam's `StoreUnavailable`. Reads stay
+  unbounded. Worker-safe.
 - `store/sqlite`, the node implementation (better-sqlite3): the server
   store composed from the sync modules, the entity-store verbs, the raw
   driver handle, the schema (`SQLITE_SCHEMA_PATH`), and the migration

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@oimlsmart/platform-server",
-  "version": "0.1.8",
+  "version": "0.2.0",
   "description": "The OIML SMART platform server kernel: the store seam (ServerStore + the D1 and SQLite implementations), the canonical D1 migration set both deployments apply, the instance profile, the mailer, the RBAC map, the OIDC/OAuth client cones, and the shared role/permission vocabulary. Consumed by the smart monorepo (browser/) and the identity service.",
   "type": "module",
   "repository": {

package/src/store/d1.ts

@@ -16,11 +16,22 @@
 // d1-store.test.ts runs this class against a better-sqlite3-backed D1
 // facade (the binding contract with real semantics) plus the real
 // workerd binding through scripts/cloudflare-smoke.ts there.
+//
+// THE BOUNDED-WRITE DISCIPLINE (the 2026-09-01 outage's lesson): every
+// write/batch/DDL statement races a confirmation budget (the default
+// DEFAULT_STORE_WRITE_BUDGET_MS, tunable per deployment through the
+// consumer's STORE_WRITE_BUDGET_MS env binding) — a slow/hung store
+// write answers StoreUnavailable in seconds, never spins the request
+// forever. READS stay unbounded here: the read-path latency story is
+// read replication, not this bound. The constructor wraps the binding
+// in the bounded facade ONCE (boundedD1Writes below); the ensure memos
+// key on the RAW binding (a rejected chain still evicts itself).
 // ═══════════════════════════════════════════════════════════════════
 
 import type { D1Database, D1PreparedStatement } from '@cloudflare/workers-types'
 import {
   DEMO_PASSWORD,
+  StoreUnavailable,
   type AccountEmail,
   type AddAccountEmailResult,
   type AdvanceCounterResult,
@@ -188,8 +199,226 @@ function toAdminRow(user: UserRecord & { last_login?: string | null; provider?:
  *  store wipes alongside (its rows reference the wiped events). */
 const WIPE_TABLES = ['entity_changes', 'evidence_records', 'entities', 'events', 'instrument_registrations', 'notify_deliveries'] as const
 
+// ── The ensure chains' memo scope (the 2026-09 portal-load audit, R2) ──
+// Every defensive ensure below (a dev-database heal: the PRAGMA probes,
+// the CREATE … IF NOT EXISTS, the idempotent membership backfill) was
+// memoized on the store INSTANCE — but the Worker consumers install a
+// store per request (the binding factory memoizes per binding OBJECT and
+// the Workers runtime hands each request its own env, so the binding's
+// identity is not guaranteed to recur), and the audit measured the
+// ~13-statement chain on every authenticated request (~0.6–0.9 s on the
+// demo hub's D1). The ensures are idempotent by construction, so the
+// honest scope is the (binding, chain) pair held at MODULE scope: the
+// Worker's isolate persists across requests and the consumer pins the
+// binding (the smart repo's server/cloudflare.ts), so the same
+// D1Database object recurs and the chain runs once per isolate. A
+// consumer whose runtime rotates binding objects degrades to the old
+// per-request posture — correct, just unmemoized. A REJECTED ensure
+// evicts itself: the next call retries the heal.
+interface EnsureMemos {
+  usersColumns: Promise<void> | null
+  sessionColumns: Promise<void> | null
+  membershipSupport: Promise<void> | null
+  orgRegistrySupport: Promise<void> | null
+  holderAttributionSupport: Promise<void> | null
+  instrumentRegistrationSupport: Promise<void> | null
+  oidcColumns: Promise<void> | null
+  personalAccessTokenSupport: Promise<void> | null
+  consentGrantSupport: Promise<void> | null
+  accountEmailSupport: Promise<void> | null
+  notifyDeliverySupport: Promise<void> | null
+}
+
+const ensureMemosByBinding = new WeakMap<D1Database, EnsureMemos>()
+
+/** Run the chain once per (binding, slot); a rejection evicts itself so
+ *  the next caller retries. */
+function ensured(binding: D1Database, slot: keyof EnsureMemos, run: () => Promise<void>): Promise<void> {
+  let memos = ensureMemosByBinding.get(binding)
+  if (!memos) {
+    memos = {
+      usersColumns: null, sessionColumns: null, membershipSupport: null,
+      orgRegistrySupport: null, holderAttributionSupport: null,
+      instrumentRegistrationSupport: null, oidcColumns: null,
+      personalAccessTokenSupport: null, consentGrantSupport: null,
+      accountEmailSupport: null, notifyDeliverySupport: null,
+    }
+    ensureMemosByBinding.set(binding, memos)
+  }
+  let pending = memos[slot]
+  if (!pending) {
+    pending = run()
+    memos[slot] = pending
+    pending.catch(() => { if (memos[slot] === pending) memos[slot] = null })
+  }
+  return pending
+}
+
+// TODO.identity/06's last-active stamp (getSessionUser's write): the
+// DB-side 60 s WHERE clause stays the source of truth (a second
+// isolate's write still lands through it); the in-isolate cache below
+// simply never ISSUES the write the row would refuse — the audit's R2
+// measured that write on every authenticated request. Keyed on the
+// session token (per-isolate), capped so a long-lived isolate's map
+// stays bounded (a cap reset only re-issues a write the DB clause then
+// throttles — never a correctness change).
+const lastSeenWrites = new Map<string, number>()
+const LAST_SEEN_THROTTLE_MS = 60_000
+const LAST_SEEN_CACHE_CAP = 4096
+
+// ── The bounded-write discipline (the 2026-09-01 outage's lesson) ────
+// Yesterday's outage: a cross-region path flap hung the identity
+// service's D1 WRITES indefinitely and the login page spun for minutes.
+// The discipline: every write/batch/DDL statement races a confirmation
+// budget and a timeout answers StoreUnavailable — an honest error in
+// seconds, never an infinite spin. READS (SELECT/PRAGMA/…) pass through
+// untouched: the read-path latency story is read replication, a
+// separate fix. The bound wraps the BINDING once at construction (the
+// store's every write path — the 180+ .run() sites, the batches, the
+// ensure chains' DDL — flows through it), so no call site changes.
+
+/** The default write-confirmation budget: D1's healthy write latency is
+ *  tens of ms; 5 s is two orders of magnitude past any honest p99 yet
+ *  still "seconds" to a waiting human — the 503 reaches the login page
+ *  before the browser's own patience ends. Tunable per deployment (the
+ *  consumer's STORE_WRITE_BUDGET_MS env binding). */
+export const DEFAULT_STORE_WRITE_BUDGET_MS = 5_000
+
+export interface D1WriteBudgetOptions {
+  /** The write/batch/DDL confirmation budget in ms. Absent:
+   *  DEFAULT_STORE_WRITE_BUDGET_MS. */
+  writeBudgetMs?: number
+}
+
+/** The consumer-side env resolution (the resolveInstanceProfileFromEnv
+ *  posture — the kernel never reads process.env; the Worker-safe
+ *  modules take the env binding as an argument). Unset/garbage resolves
+ *  undefined — the store's default stands, never a silent 0. */
+export function resolveStoreWriteBudgetMs(env?: { STORE_WRITE_BUDGET_MS?: string }): number | undefined {
+  const raw = env?.STORE_WRITE_BUDGET_MS?.trim()
+  if (!raw) return undefined
+  const parsed = Number.parseInt(raw, 10)
+  return Number.isFinite(parsed) && parsed > 0 ? parsed : undefined
+}
+
+/** The write-classified leading verbs (DDL included). Everything else —
+ *  SELECT, the PRAGMA probes, EXPLAIN — is a read and stays unbounded. */
+const WRITE_STATEMENT = /^\s*(?:insert|update|delete|replace|create|alter|drop|vacuum|reindex)\b/i
+
+/** The statement's idempotency posture for StoreUnavailable.retrySafe:
+ *  the shapes whose replay converges after a write that may have
+ *  landed — keyed UPDATE/DELETE/REPLACE, INSERT OR IGNORE/REPLACE, the
+ *  ON CONFLICT upserts, the IF NOT EXISTS heals. A plain INSERT is NOT
+ *  claimed safe (a retry could double-land). */
+function writeRetrySafe(sql: string): boolean {
+  if (/^\s*(?:update|delete|replace)\b/i.test(sql)) return true
+  if (/^\s*insert\s+or\s+(?:ignore|replace)\b/i.test(sql)) return true
+  if (/^\s*insert\b/i.test(sql) && /\bon\s+conflict\b/i.test(sql)) return true
+  if (/^\s*create\b/i.test(sql) && /\bif\s+not\s+exists\b/i.test(sql)) return true
+  return false
+}
+
+/** The error/log label for a write: the verb phrase + the target object
+ *  ('UPDATE sessions', 'CREATE TABLE IF NOT EXISTS org_memberships').
+ *  Never the bound values — the label is all an error may carry. */
+function sqlWriteLabel(sql: string): string {
+  const flat = sql.trim().replace(/\s+/g, ' ')
+  const m = /^((?:insert(?:\s+or\s+(?:ignore|replace))?\s+into|update|delete\s+from|replace\s+into|create\s+(?:unique\s+)?(?:table|index)(?:\s+if\s+not\s+exists)?|alter\s+table|drop\s+(?:table|index)(?:\s+if\s+exists)?))\s+("?\w+"?)/i.exec(flat)
+  if (m) return `${m[1].toUpperCase()} ${m[2]}`
+  return flat.slice(0, 60)
+}
+
+/** Race a write against its confirmation budget. The in-flight write is
+ *  never cancelled (D1 has no abort) — the race's handlers stay attached
+ *  past the timeout, so a late settling (success OR failure) never
+ *  surfaces as an unhandled rejection. */
+function raceWriteBudget<T>(operation: string, budgetMs: number, retrySafe: boolean, pending: Promise<T>): Promise<T> {
+  return new Promise<T>((resolve, reject) => {
+    const timer = setTimeout(() => reject(new StoreUnavailable(operation, budgetMs, retrySafe)), budgetMs)
+    pending.then(
+      value => { clearTimeout(timer); resolve(value) },
+      (error: unknown) => { clearTimeout(timer); reject(error) },
+    )
+  })
+}
+
+/** The wrapper → the underlying statement (+ its idempotency posture).
+ *  batch() hands the REAL statements back to the binding: the runtime
+ *  reads the SQL off the statement object itself, so a wrapper is not a
+ *  statement to it. WeakMap-keyed — the entries die with the wrappers. */
+const unwrappedStatements = new WeakMap<D1PreparedStatement, { stmt: D1PreparedStatement; retrySafe: boolean }>()
+
+/** The write-bounded statement facade: read-classified SQL returns the
+ *  raw statement untouched; write-classified SQL gets every terminal
+ *  (run/first/all/raw — INSERT … RETURNING reads back through a write)
+ *  raced against the budget. bind() stays chainable on the wrapper. */
+function boundedStatement(stmt: D1PreparedStatement, sql: string, budgetMs: number): D1PreparedStatement {
+  if (!WRITE_STATEMENT.test(sql)) return stmt
+  const operation = sqlWriteLabel(sql)
+  const retrySafe = writeRetrySafe(sql)
+  const wrap = (s: D1PreparedStatement): D1PreparedStatement => {
+    const wrapped = {
+      bind: (...values: unknown[]): D1PreparedStatement => wrap(s.bind(...values)),
+      first: (<T = unknown>(colName?: string) =>
+        raceWriteBudget(operation, budgetMs, retrySafe, (colName === undefined ? s.first<T>() : s.first<T>(colName)) as Promise<T | null>)
+      ) as D1PreparedStatement['first'],
+      run: (<T = Record<string, unknown>>() =>
+        raceWriteBudget(operation, budgetMs, retrySafe, s.run<T>())
+      ) as D1PreparedStatement['run'],
+      all: (<T = Record<string, unknown>>() =>
+        raceWriteBudget(operation, budgetMs, retrySafe, s.all<T>())
+      ) as D1PreparedStatement['all'],
+      raw: (<T = unknown[]>(options?: { columnNames?: boolean }) =>
+        options?.columnNames
+          ? raceWriteBudget(operation, budgetMs, retrySafe, s.raw<T>({ columnNames: true }))
+          : raceWriteBudget(operation, budgetMs, retrySafe, s.raw<T>(options as { columnNames?: false } | undefined))
+      ) as D1PreparedStatement['raw'],
+    }
+    unwrappedStatements.set(wrapped as D1PreparedStatement, { stmt: s, retrySafe })
+    return wrapped as D1PreparedStatement
+  }
+  return wrap(stmt)
+}
+
+/** The binding facade the store holds: prepare() bounds write-classified
+ *  statements, batch()/exec() race their own budget (a D1 batch is ONE
+ *  round-trip — one budget, retry-safe exactly when every member is),
+ *  dump()/the reads pass through, withSession()'s session gets the same
+ *  discipline. One budget per round-trip, never per row. */
+function boundedD1Writes(binding: D1Database, budgetMs: number): D1Database {
+  const boundedBatch = <T>(run: (real: D1PreparedStatement[]) => Promise<T>, statements: D1PreparedStatement[],): Promise<T> => {
+    const real = statements.map(s => unwrappedStatements.get(s)?.stmt ?? s)
+    const retrySafe = statements.length > 0 && statements.every(s => unwrappedStatements.get(s)?.retrySafe === true)
+    return raceWriteBudget(`batch (${statements.length} statements)`, budgetMs, retrySafe, run(real))
+  }
+  return {
+    prepare: (sql: string) => boundedStatement(binding.prepare(sql), sql, budgetMs),
+    batch: <T = unknown>(statements: D1PreparedStatement[]) => boundedBatch(r => binding.batch<T>(r), statements),
+    exec: (sql: string) => raceWriteBudget('exec (DDL script)', budgetMs, false, binding.exec(sql)),
+    dump: () => binding.dump(),
+    withSession: (constraintOrBookmark?: string) => {
+      const session = binding.withSession(constraintOrBookmark)
+      return {
+        prepare: (sql: string) => boundedStatement(session.prepare(sql), sql, budgetMs),
+        batch: <T = unknown>(statements: D1PreparedStatement[]) => boundedBatch(r => session.batch<T>(r), statements),
+        getBookmark: () => session.getBookmark(),
+      }
+    },
+  }
+}
+
 export class D1ServerStore implements ServerStore {
-  constructor(private readonly db: D1Database) {}
+  /** The RAW binding — the ensure memos (and d1StoreFor's map) key on
+   *  it: the facade below is per-instance and would never hit. */
+  private readonly binding: D1Database
+  /** The bounded-write facade over the binding (the discipline note
+   *  above) — every statement/batch the store issues flows through it. */
+  private readonly db: D1Database
+
+  constructor(binding: D1Database, opts?: D1WriteBudgetOptions) {
+    this.binding = binding
+    this.db = boundedD1Writes(binding, opts?.writeBudgetMs ?? DEFAULT_STORE_WRITE_BUDGET_MS)
+  }
 
   private stmt(sql: string, ...params: unknown[]): D1PreparedStatement {
     return this.db.prepare(sql).bind(...params)
@@ -198,43 +427,34 @@ export class D1ServerStore implements ServerStore {
   // TODO.federation/12: the roles/active columns arrive with migration
   // 0002 — a dev D1 migrated from the pre-RBAC 0001 lacks them, so the
   //  user methods ensure them defensively (PRAGMA probe + ALTER),
-  //  memoized per store.
-  private usersColumnsEnsured: Promise<void> | null = null
-
+  //  memoized per (binding, chain) at module scope (the header note).
   private ensureUserColumns(): Promise<void> {
-    if (!this.usersColumnsEnsured) {
-      this.usersColumnsEnsured = (async () => {
-        const cols = await this.db.prepare('PRAGMA table_info(users)').all<{ name: string }>()
-        const names = new Set(cols.results.map(c => c.name))
-        if (!names.has('roles')) await this.db.prepare('ALTER TABLE users ADD COLUMN roles TEXT').run()
-        if (!names.has('active')) await this.db.prepare('ALTER TABLE users ADD COLUMN active INTEGER NOT NULL DEFAULT 1').run()
-        // TODO.identity/06 (the account console): the address's
-        // verification state.
-        if (!names.has('email_verified_at')) await this.db.prepare('ALTER TABLE users ADD COLUMN email_verified_at TEXT').run()
-      })()
-    }
-    return this.usersColumnsEnsured
+    return ensured(this.binding, 'usersColumns', async () => {
+      const cols = await this.db.prepare('PRAGMA table_info(users)').all<{ name: string }>()
+      const names = new Set(cols.results.map(c => c.name))
+      if (!names.has('roles')) await this.db.prepare('ALTER TABLE users ADD COLUMN roles TEXT').run()
+      if (!names.has('active')) await this.db.prepare('ALTER TABLE users ADD COLUMN active INTEGER NOT NULL DEFAULT 1').run()
+      // TODO.identity/06 (the account console): the address's
+      // verification state.
+      if (!names.has('email_verified_at')) await this.db.prepare('ALTER TABLE users ADD COLUMN email_verified_at TEXT').run()
+    })
   }
 
   // TODO.identity/06 (the account console's sessions section): the
   // sign-in context columns arrive with migration 0009 — a dev D1
   // migrated from before it lacks them, so the session methods ensure
-  // them defensively (the ensureUserColumns posture, memoized per store).
-  private sessionColumnsEnsured: Promise<void> | null = null
-
+  // them defensively (the ensureUserColumns posture, memoized per
+  // (binding, chain) at module scope).
   private ensureSessionColumns(): Promise<void> {
-    if (!this.sessionColumnsEnsured) {
-      this.sessionColumnsEnsured = (async () => {
-        const cols = await this.db.prepare('PRAGMA table_info(sessions)').all<{ name: string }>()
-        const names = new Set(cols.results.map(c => c.name))
-        if (!names.has('user_agent')) await this.db.prepare('ALTER TABLE sessions ADD COLUMN user_agent TEXT').run()
-        if (!names.has('ip')) await this.db.prepare('ALTER TABLE sessions ADD COLUMN ip TEXT').run()
-        if (!names.has('last_seen_at')) await this.db.prepare('ALTER TABLE sessions ADD COLUMN last_seen_at TEXT').run()
-        // TODO.identity-sso/02+03: the sign-in provenance.
-        if (!names.has('amr')) await this.db.prepare('ALTER TABLE sessions ADD COLUMN amr TEXT').run()
-      })()
-    }
-    return this.sessionColumnsEnsured
+    return ensured(this.binding, 'sessionColumns', async () => {
+      const cols = await this.db.prepare('PRAGMA table_info(sessions)').all<{ name: string }>()
+      const names = new Set(cols.results.map(c => c.name))
+      if (!names.has('user_agent')) await this.db.prepare('ALTER TABLE sessions ADD COLUMN user_agent TEXT').run()
+      if (!names.has('ip')) await this.db.prepare('ALTER TABLE sessions ADD COLUMN ip TEXT').run()
+      if (!names.has('last_seen_at')) await this.db.prepare('ALTER TABLE sessions ADD COLUMN last_seen_at TEXT').run()
+      // TODO.identity-sso/02+03: the sign-in provenance.
+      if (!names.has('amr')) await this.db.prepare('ALTER TABLE sessions ADD COLUMN amr TEXT').run()
+    })
   }
 
   // TODO.identity/11 (the multi-org membership model): the
@@ -242,304 +462,267 @@ export class D1ServerStore implements ServerStore {
   // token-flow context columns arrive with migration 0011 — a dev D1
   // migrated from before it lacks them, so the membership/session/token
   // methods ensure them defensively (the ensureUserColumns posture,
-  // memoized per store). The backfill (the migration's twin) is
-  // IDEMPOTENT and rides the ensure: every org-bound account's primary
-  // membership mirrors the legacy columns.
-  private membershipSupportEnsured: Promise<void> | null = null
-
+  // memoized per (binding, chain) at module scope). The backfill (the
+  // migration's twin) is IDEMPOTENT and rides the ensure: every
+  // org-bound account's primary membership mirrors the legacy columns.
   private ensureMembershipSupport(): Promise<void> {
-    if (!this.membershipSupportEnsured) {
-      this.membershipSupportEnsured = (async () => {
-        await this.db.prepare(
-          `CREATE TABLE IF NOT EXISTS org_memberships (
-             id TEXT PRIMARY KEY,
-             user_id TEXT NOT NULL REFERENCES users(id),
-             org_id TEXT NOT NULL,
-             roles TEXT NOT NULL DEFAULT '[]',
-             state TEXT NOT NULL DEFAULT 'active',
-             is_primary INTEGER NOT NULL DEFAULT 0,
-             invited_by TEXT,
-             created_at TEXT NOT NULL DEFAULT (datetime('now')),
-             activated_at TEXT,
-             disabled_at TEXT,
-             disabled_by TEXT,
-             UNIQUE (user_id, org_id)
-           )`,
-        ).run()
-        await this.db.prepare('CREATE INDEX IF NOT EXISTS idx_org_memberships_org ON org_memberships (org_id, state)').run()
-        await this.db.prepare('CREATE INDEX IF NOT EXISTS idx_org_memberships_user ON org_memberships (user_id, state)').run()
-        // TODO.identity-features/09 (the org-member data cone): the cone
-        // column arrives with migration 0017 — a dev D1 predating it
-        // grows the column here. NULL = org-wide: existing memberships
-        // keep their posture silently.
-        const membershipCols = await this.db.prepare('PRAGMA table_info(org_memberships)').all<{ name: string }>()
-        if (!membershipCols.results.some(c => c.name === 'cone')) {
-          await this.db.prepare('ALTER TABLE org_memberships ADD COLUMN cone TEXT').run()
-        }
-        const sessionCols = await this.db.prepare('PRAGMA table_info(sessions)').all<{ name: string }>()
-        if (!sessionCols.results.some(c => c.name === 'active_org')) {
-          await this.db.prepare('ALTER TABLE sessions ADD COLUMN active_org TEXT').run()
-        }
-        const codeCols = await this.db.prepare('PRAGMA table_info(oidc_codes)').all<{ name: string }>()
-        if (!codeCols.results.some(c => c.name === 'context_org')) {
-          await this.db.prepare('ALTER TABLE oidc_codes ADD COLUMN context_org TEXT').run()
-        }
-        const accessCols = await this.db.prepare('PRAGMA table_info(oidc_access_tokens)').all<{ name: string }>()
-        if (!accessCols.results.some(c => c.name === 'context_org')) {
-          await this.db.prepare('ALTER TABLE oidc_access_tokens ADD COLUMN context_org TEXT').run()
-        }
-        await this.db.prepare(
-          `INSERT OR IGNORE INTO org_memberships (id, user_id, org_id, roles, state, is_primary, activated_at)
-           SELECT 'mbr-' || id, id, org_id,
-                  CASE WHEN roles IS NOT NULL AND roles != '' THEN roles ELSE json_array(role) END,
-                  'active', 1, COALESCE(last_login, created_at)
-           FROM users WHERE org_id IS NOT NULL`,
-        ).run()
-      })()
-    }
-    return this.membershipSupportEnsured
+    return ensured(this.binding, 'membershipSupport', async () => {
+      await this.db.prepare(
+        `CREATE TABLE IF NOT EXISTS org_memberships (
+           id TEXT PRIMARY KEY,
+           user_id TEXT NOT NULL REFERENCES users(id),
+           org_id TEXT NOT NULL,
+           roles TEXT NOT NULL DEFAULT '[]',
+           state TEXT NOT NULL DEFAULT 'active',
+           is_primary INTEGER NOT NULL DEFAULT 0,
+           invited_by TEXT,
+           created_at TEXT NOT NULL DEFAULT (datetime('now')),
+           activated_at TEXT,
+           disabled_at TEXT,
+           disabled_by TEXT,
+           UNIQUE (user_id, org_id)
+         )`,
+      ).run()
+      await this.db.prepare('CREATE INDEX IF NOT EXISTS idx_org_memberships_org ON org_memberships (org_id, state)').run()
+      await this.db.prepare('CREATE INDEX IF NOT EXISTS idx_org_memberships_user ON org_memberships (user_id, state)').run()
+      // TODO.identity-features/09 (the org-member data cone): the cone
+      // column arrives with migration 0017 — a dev D1 predating it
+      // grows the column here. NULL = org-wide: existing memberships
+      // keep their posture silently.
+      const membershipCols = await this.db.prepare('PRAGMA table_info(org_memberships)').all<{ name: string }>()
+      if (!membershipCols.results.some(c => c.name === 'cone')) {
+        await this.db.prepare('ALTER TABLE org_memberships ADD COLUMN cone TEXT').run()
+      }
+      const sessionCols = await this.db.prepare('PRAGMA table_info(sessions)').all<{ name: string }>()
+      if (!sessionCols.results.some(c => c.name === 'active_org')) {
+        await this.db.prepare('ALTER TABLE sessions ADD COLUMN active_org TEXT').run()
+      }
+      const codeCols = await this.db.prepare('PRAGMA table_info(oidc_codes)').all<{ name: string }>()
+      if (!codeCols.results.some(c => c.name === 'context_org')) {
+        await this.db.prepare('ALTER TABLE oidc_codes ADD COLUMN context_org TEXT').run()
+      }
+      const accessCols = await this.db.prepare('PRAGMA table_info(oidc_access_tokens)').all<{ name: string }>()
+      if (!accessCols.results.some(c => c.name === 'context_org')) {
+        await this.db.prepare('ALTER TABLE oidc_access_tokens ADD COLUMN context_org TEXT').run()
+      }
+      await this.db.prepare(
+        `INSERT OR IGNORE INTO org_memberships (id, user_id, org_id, roles, state, is_primary, activated_at)
+         SELECT 'mbr-' || id, id, org_id,
+                CASE WHEN roles IS NOT NULL AND roles != '' THEN roles ELSE json_array(role) END,
+                'active', 1, COALESCE(last_login, created_at)
+         FROM users WHERE org_id IS NOT NULL`,
+      ).run()
+    })
   }
 
   // TODO.identity-features/05 (the organization registry): the
   // org_registry table arrives with migration 0013 — a dev D1 migrated
   // from before it lacks the table, so the registry methods ensure it
   // defensively (the ensureMembershipSupport posture, memoized per
-  // store).
-  private orgRegistrySupportEnsured: Promise<void> | null = null
-
+  // (binding, chain) at module scope).
   private ensureOrgRegistrySupport(): Promise<void> {
-    if (!this.orgRegistrySupportEnsured) {
-      this.orgRegistrySupportEnsured = (async () => {
-        await this.db.prepare(
-          `CREATE TABLE IF NOT EXISTS org_registry (
-             id TEXT PRIMARY KEY,
-             name TEXT NOT NULL,
-             short_name TEXT,
-             kind TEXT,
-             country TEXT,
-             contacts TEXT NOT NULL DEFAULT '[]',
-             participant_ref TEXT,
-             state TEXT NOT NULL DEFAULT 'active',
-             created_at TEXT NOT NULL DEFAULT (datetime('now')),
-             created_by TEXT,
-             updated_at TEXT,
-             updated_by TEXT,
-             disabled_at TEXT,
-             disabled_by TEXT
-           )`,
-        ).run()
-        await this.db.prepare('CREATE INDEX IF NOT EXISTS idx_org_registry_state ON org_registry (state)').run()
-        // TODO.identity-features/10 (the OIML Member category): the
-        // designation links + the CS status facet arrive with migration
-        // 0019 — a dev D1 predating it grows the columns here (the
-        // PRAGMA probe + ALTER posture of ensureUserColumns). NULL = not
-        // recorded: existing rows keep their posture silently.
-        const cols = await this.db.prepare('PRAGMA table_info(org_registry)').all<{ name: string }>()
-        const names = new Set(cols.results.map(c => c.name))
-        if (!names.has('designated_by')) await this.db.prepare('ALTER TABLE org_registry ADD COLUMN designated_by TEXT').run()
-        if (!names.has('proposed_by')) await this.db.prepare('ALTER TABLE org_registry ADD COLUMN proposed_by TEXT').run()
-        if (!names.has('cs_status')) await this.db.prepare('ALTER TABLE org_registry ADD COLUMN cs_status TEXT').run()
-      })()
-    }
-    return this.orgRegistrySupportEnsured
+    return ensured(this.binding, 'orgRegistrySupport', async () => {
+      await this.db.prepare(
+        `CREATE TABLE IF NOT EXISTS org_registry (
+           id TEXT PRIMARY KEY,
+           name TEXT NOT NULL,
+           short_name TEXT,
+           kind TEXT,
+           country TEXT,
+           contacts TEXT NOT NULL DEFAULT '[]',
+           participant_ref TEXT,
+           state TEXT NOT NULL DEFAULT 'active',
+           created_at TEXT NOT NULL DEFAULT (datetime('now')),
+           created_by TEXT,
+           updated_at TEXT,
+           updated_by TEXT,
+           disabled_at TEXT,
+           disabled_by TEXT
+         )`,
+      ).run()
+      await this.db.prepare('CREATE INDEX IF NOT EXISTS idx_org_registry_state ON org_registry (state)').run()
+      // TODO.identity-features/10 (the OIML Member category): the
+      // designation links + the CS status facet arrive with migration
+      // 0019 — a dev D1 predating it grows the columns here (the
+      // PRAGMA probe + ALTER posture of ensureUserColumns). NULL = not
+      // recorded: existing rows keep their posture silently.
+      const cols = await this.db.prepare('PRAGMA table_info(org_registry)').all<{ name: string }>()
+      const names = new Set(cols.results.map(c => c.name))
+      if (!names.has('designated_by')) await this.db.prepare('ALTER TABLE org_registry ADD COLUMN designated_by TEXT').run()
+      if (!names.has('proposed_by')) await this.db.prepare('ALTER TABLE org_registry ADD COLUMN proposed_by TEXT').run()
+      if (!names.has('cs_status')) await this.db.prepare('ALTER TABLE org_registry ADD COLUMN cs_status TEXT').run()
+    })
   }
 
   // TODO.register/02 (the register's holder-org attribution): the
   // certificate_holder_orgs / certificate_holder_claims tables arrive with
   // migration 0015 — a dev D1 migrated from before it lacks them, so the
   // attribution/claim methods ensure them defensively (the
-  // ensureOrgRegistrySupport posture, memoized per store).
-  private holderAttributionSupportEnsured: Promise<void> | null = null
-
+  // ensureOrgRegistrySupport posture, memoized per (binding, chain) at
+  // module scope).
   private ensureHolderAttributionSupport(): Promise<void> {
-    if (!this.holderAttributionSupportEnsured) {
-      this.holderAttributionSupportEnsured = (async () => {
-        await this.db.prepare(
-          `CREATE TABLE IF NOT EXISTS certificate_holder_orgs (
-             certificate_id TEXT PRIMARY KEY,
-             org_id TEXT NOT NULL,
-             org_name TEXT NOT NULL,
-             source TEXT NOT NULL,
-             attributed_at TEXT NOT NULL,
-             attributed_by TEXT,
-             claim_id TEXT
-           )`,
-        ).run()
-        await this.db.prepare('CREATE INDEX IF NOT EXISTS idx_certificate_holder_orgs_org ON certificate_holder_orgs (org_id)').run()
-        await this.db.prepare(
-          `CREATE TABLE IF NOT EXISTS certificate_holder_claims (
-             id TEXT PRIMARY KEY,
-             certificate_id TEXT NOT NULL,
-             claimant_org_id TEXT NOT NULL,
-             claimant_org_name TEXT NOT NULL,
-             matched_holder_name TEXT NOT NULL,
-             claimed_by TEXT NOT NULL,
-             state TEXT NOT NULL DEFAULT 'pending',
-             decided_by TEXT,
-             decided_at TEXT,
-             refusal_reason TEXT,
-             created_at TEXT NOT NULL DEFAULT (datetime('now'))
-           )`,
-        ).run()
-        await this.db.prepare('CREATE INDEX IF NOT EXISTS idx_certificate_holder_claims_cert ON certificate_holder_claims (certificate_id)').run()
-        await this.db.prepare('CREATE INDEX IF NOT EXISTS idx_certificate_holder_claims_state ON certificate_holder_claims (state)').run()
-        await this.db.prepare('CREATE INDEX IF NOT EXISTS idx_certificate_holder_claims_org ON certificate_holder_claims (claimant_org_id)').run()
-      })()
-    }
-    return this.holderAttributionSupportEnsured
+    return ensured(this.binding, 'holderAttributionSupport', async () => {
+      await this.db.prepare(
+        `CREATE TABLE IF NOT EXISTS certificate_holder_orgs (
+           certificate_id TEXT PRIMARY KEY,
+           org_id TEXT NOT NULL,
+           org_name TEXT NOT NULL,
+           source TEXT NOT NULL,
+           attributed_at TEXT NOT NULL,
+           attributed_by TEXT,
+           claim_id TEXT
+         )`,
+      ).run()
+      await this.db.prepare('CREATE INDEX IF NOT EXISTS idx_certificate_holder_orgs_org ON certificate_holder_orgs (org_id)').run()
+      await this.db.prepare(
+        `CREATE TABLE IF NOT EXISTS certificate_holder_claims (
+           id TEXT PRIMARY KEY,
+           certificate_id TEXT NOT NULL,
+           claimant_org_id TEXT NOT NULL,
+           claimant_org_name TEXT NOT NULL,
+           matched_holder_name TEXT NOT NULL,
+           claimed_by TEXT NOT NULL,
+           state TEXT NOT NULL DEFAULT 'pending',
+           decided_by TEXT,
+           decided_at TEXT,
+           refusal_reason TEXT,
+           created_at TEXT NOT NULL DEFAULT (datetime('now'))
+         )`,
+      ).run()
+      await this.db.prepare('CREATE INDEX IF NOT EXISTS idx_certificate_holder_claims_cert ON certificate_holder_claims (certificate_id)').run()
+      await this.db.prepare('CREATE INDEX IF NOT EXISTS idx_certificate_holder_claims_state ON certificate_holder_claims (state)').run()
+      await this.db.prepare('CREATE INDEX IF NOT EXISTS idx_certificate_holder_claims_org ON certificate_holder_claims (claimant_org_id)').run()
+    })
   }
 
   // TODO.register/03 (the instrument register): the
   // instrument_registrations table arrives with migration 0016 — a dev
   // D1 migrated from before it lacks the table, so the register methods
   // ensure it defensively (the ensureOrgRegistrySupport posture,
-  // memoized per store).
-  private instrumentRegistrationSupportEnsured: Promise<void> | null = null
-
+  // memoized per (binding, chain) at module scope).
   private ensureInstrumentRegistrationSupport(): Promise<void> {
-    if (!this.instrumentRegistrationSupportEnsured) {
-      this.instrumentRegistrationSupportEnsured = (async () => {
-        await this.db.prepare(
-          `CREATE TABLE IF NOT EXISTS instrument_registrations (
-             id TEXT PRIMARY KEY,
-             certificate_id TEXT NOT NULL,
-             holder_org_id TEXT NOT NULL,
-             standard_id TEXT NOT NULL,
-             serial_number TEXT NOT NULL,
-             manufacture_date TEXT,
-             designations TEXT NOT NULL DEFAULT '{}',
-             scope_status TEXT NOT NULL,
-             scope_detail TEXT,
-             lifecycle TEXT NOT NULL DEFAULT 'registered',
-             registered_at TEXT NOT NULL DEFAULT (datetime('now')),
-             registered_by TEXT,
-             updated_at TEXT,
-             updated_by TEXT,
-             UNIQUE (certificate_id, serial_number)
-           )`,
-        ).run()
-        await this.db.prepare('CREATE INDEX IF NOT EXISTS idx_instrument_registrations_certificate ON instrument_registrations (certificate_id)').run()
-        await this.db.prepare('CREATE INDEX IF NOT EXISTS idx_instrument_registrations_holder ON instrument_registrations (holder_org_id)').run()
-        await this.db.prepare('CREATE INDEX IF NOT EXISTS idx_instrument_registrations_lifecycle ON instrument_registrations (lifecycle)').run()
-      })()
-    }
-    return this.instrumentRegistrationSupportEnsured
+    return ensured(this.binding, 'instrumentRegistrationSupport', async () => {
+      await this.db.prepare(
+        `CREATE TABLE IF NOT EXISTS instrument_registrations (
+           id TEXT PRIMARY KEY,
+           certificate_id TEXT NOT NULL,
+           holder_org_id TEXT NOT NULL,
+           standard_id TEXT NOT NULL,
+           serial_number TEXT NOT NULL,
+           manufacture_date TEXT,
+           designations TEXT NOT NULL DEFAULT '{}',
+           scope_status TEXT NOT NULL,
+           scope_detail TEXT,
+           lifecycle TEXT NOT NULL DEFAULT 'registered',
+           registered_at TEXT NOT NULL DEFAULT (datetime('now')),
+           registered_by TEXT,
+           updated_at TEXT,
+           updated_by TEXT,
+           UNIQUE (certificate_id, serial_number)
+         )`,
+      ).run()
+      await this.db.prepare('CREATE INDEX IF NOT EXISTS idx_instrument_registrations_certificate ON instrument_registrations (certificate_id)').run()
+      await this.db.prepare('CREATE INDEX IF NOT EXISTS idx_instrument_registrations_holder ON instrument_registrations (holder_org_id)').run()
+      await this.db.prepare('CREATE INDEX IF NOT EXISTS idx_instrument_registrations_lifecycle ON instrument_registrations (lifecycle)').run()
+    })
   }
 
   // TODO.identity-sso/02+03: the amr provenance columns on the OIDC
   // flow rows arrive with migration 0012 — the OIDC methods ensure them
-  // defensively (the same memoized posture as the session/user columns),
-  // so a dev D1 migrated from before the wave never 500s the core flow.
-  private oidcColumnsEnsured: Promise<void> | null = null
-
+  // defensively (the same memoized posture as the session/user columns,
+  // per (binding, chain) at module scope), so a dev D1 migrated from
+  // before the wave never 500s the core flow.
   private ensureOidcColumns(): Promise<void> {
-    if (!this.oidcColumnsEnsured) {
-      this.oidcColumnsEnsured = (async () => {
-        const codeCols = await this.db.prepare('PRAGMA table_info(oidc_codes)').all<{ name: string }>()
-        if (!codeCols.results.some(c => c.name === 'amr')) {
-          await this.db.prepare('ALTER TABLE oidc_codes ADD COLUMN amr TEXT').run()
-        }
-        const tokenCols = await this.db.prepare('PRAGMA table_info(oidc_access_tokens)').all<{ name: string }>()
-        if (!tokenCols.results.some(c => c.name === 'amr')) {
-          await this.db.prepare('ALTER TABLE oidc_access_tokens ADD COLUMN amr TEXT').run()
-        }
-      })()
-    }
-    return this.oidcColumnsEnsured
+    return ensured(this.binding, 'oidcColumns', async () => {
+      const codeCols = await this.db.prepare('PRAGMA table_info(oidc_codes)').all<{ name: string }>()
+      if (!codeCols.results.some(c => c.name === 'amr')) {
+        await this.db.prepare('ALTER TABLE oidc_codes ADD COLUMN amr TEXT').run()
+      }
+      const tokenCols = await this.db.prepare('PRAGMA table_info(oidc_access_tokens)').all<{ name: string }>()
+      if (!tokenCols.results.some(c => c.name === 'amr')) {
+        await this.db.prepare('ALTER TABLE oidc_access_tokens ADD COLUMN amr TEXT').run()
+      }
+    })
   }
 
   // TODO.identity-features/08 (the personal access tokens): the
   // personal_access_tokens table arrives with migration 0020 — a dev D1
   // migrated from before it lacks the table, so the PAT methods ensure
   // it defensively (the ensureOrgRegistrySupport posture, memoized per
-  // store).
-  private personalAccessTokenSupportEnsured: Promise<void> | null = null
-
+  // (binding, chain) at module scope).
   private ensurePersonalAccessTokenSupport(): Promise<void> {
-    if (!this.personalAccessTokenSupportEnsured) {
-      this.personalAccessTokenSupportEnsured = (async () => {
-        await this.db.prepare(
-          `CREATE TABLE IF NOT EXISTS personal_access_tokens (
-             id TEXT PRIMARY KEY,
-             user_id TEXT NOT NULL REFERENCES users(id),
-             name TEXT NOT NULL,
-             token_hash TEXT NOT NULL,
-             token_prefix TEXT NOT NULL,
-             scopes TEXT NOT NULL DEFAULT '[]',
-             org_context TEXT,
-             created_at TEXT NOT NULL DEFAULT (datetime('now')),
-             expires_at TEXT NOT NULL,
-             last_used_at TEXT,
-             last_exchange_audit_at TEXT,
-             expiry_notified_at TEXT,
-             revoked_at TEXT,
-             revoked_by TEXT,
-             UNIQUE (token_hash)
-           )`,
-        ).run()
-        await this.db.prepare('CREATE INDEX IF NOT EXISTS idx_personal_access_tokens_user ON personal_access_tokens (user_id)').run()
-      })()
-    }
-    return this.personalAccessTokenSupportEnsured
+    return ensured(this.binding, 'personalAccessTokenSupport', async () => {
+      await this.db.prepare(
+        `CREATE TABLE IF NOT EXISTS personal_access_tokens (
+           id TEXT PRIMARY KEY,
+           user_id TEXT NOT NULL REFERENCES users(id),
+           name TEXT NOT NULL,
+           token_hash TEXT NOT NULL,
+           token_prefix TEXT NOT NULL,
+           scopes TEXT NOT NULL DEFAULT '[]',
+           org_context TEXT,
+           created_at TEXT NOT NULL DEFAULT (datetime('now')),
+           expires_at TEXT NOT NULL,
+           last_used_at TEXT,
+           last_exchange_audit_at TEXT,
+           expiry_notified_at TEXT,
+           revoked_at TEXT,
+           revoked_by TEXT,
+           UNIQUE (token_hash)
+         )`,
+      ).run()
+      await this.db.prepare('CREATE INDEX IF NOT EXISTS idx_personal_access_tokens_user ON personal_access_tokens (user_id)').run()
+    })
   }
 
   // TODO.identity-features/12 (the remembered consent grants): the
   // oidc_consent_grants table arrives with migration 0021 — a dev D1
   // migrated from before it lacks the table, so the grant methods ensure
   // it defensively (the ensurePersonalAccessTokenSupport posture,
-  // memoized per store).
-  private consentGrantSupportEnsured: Promise<void> | null = null
-
+  // memoized per (binding, chain) at module scope).
   private ensureConsentGrantSupport(): Promise<void> {
-    if (!this.consentGrantSupportEnsured) {
-      this.consentGrantSupportEnsured = (async () => {
-        await this.db.prepare(
-          `CREATE TABLE IF NOT EXISTS oidc_consent_grants (
-             id TEXT PRIMARY KEY,
-             user_id TEXT NOT NULL REFERENCES users(id),
-             client_id TEXT NOT NULL,
-             scope TEXT NOT NULL,
-             created_at TEXT NOT NULL DEFAULT (datetime('now')),
-             revoked_at TEXT
-           )`,
-        ).run()
-        await this.db.prepare(
-          'CREATE UNIQUE INDEX IF NOT EXISTS idx_oidc_consent_grants_live ON oidc_consent_grants (user_id, client_id, scope) WHERE revoked_at IS NULL',
-        ).run()
-        await this.db.prepare('CREATE INDEX IF NOT EXISTS idx_oidc_consent_grants_user ON oidc_consent_grants (user_id)').run()
-      })()
-    }
-    return this.consentGrantSupportEnsured
+    return ensured(this.binding, 'consentGrantSupport', async () => {
+      await this.db.prepare(
+        `CREATE TABLE IF NOT EXISTS oidc_consent_grants (
+           id TEXT PRIMARY KEY,
+           user_id TEXT NOT NULL REFERENCES users(id),
+           client_id TEXT NOT NULL,
+           scope TEXT NOT NULL,
+           created_at TEXT NOT NULL DEFAULT (datetime('now')),
+           revoked_at TEXT
+         )`,
+      ).run()
+      await this.db.prepare(
+        'CREATE UNIQUE INDEX IF NOT EXISTS idx_oidc_consent_grants_live ON oidc_consent_grants (user_id, client_id, scope) WHERE revoked_at IS NULL',
+      ).run()
+      await this.db.prepare('CREATE INDEX IF NOT EXISTS idx_oidc_consent_grants_user ON oidc_consent_grants (user_id)').run()
+    })
   }
 
   // TODO.identity-features/01 (multiple emails per account): the
   // account_emails table + the email_change_tokens.kind column arrive
   // with migration 0022 — a dev D1 migrated from before it lacks both,
   // so the address methods ensure them defensively (the
-  // ensureConsentGrantSupport posture, memoized per store).
-  private accountEmailSupportEnsured: Promise<void> | null = null
-
+  // ensureConsentGrantSupport posture, memoized per (binding, chain) at
+  // module scope).
   private ensureAccountEmailSupport(): Promise<void> {
-    if (!this.accountEmailSupportEnsured) {
-      this.accountEmailSupportEnsured = (async () => {
-        await this.db.prepare(
-          `CREATE TABLE IF NOT EXISTS account_emails (
-             user_id TEXT NOT NULL REFERENCES users(id),
-             email TEXT NOT NULL,
-             verified_at TEXT,
-             added_by TEXT,
-             created_at TEXT NOT NULL DEFAULT (datetime('now')),
-             PRIMARY KEY (user_id, email)
-           )`,
-        ).run()
-        await this.db.prepare('CREATE UNIQUE INDEX IF NOT EXISTS idx_account_emails_email ON account_emails (email)').run()
-        const tokenCols = await this.db.prepare('PRAGMA table_info(email_change_tokens)').all<{ name: string }>()
-        if (!tokenCols.results.some(c => c.name === 'kind')) {
-          await this.db.prepare("ALTER TABLE email_change_tokens ADD COLUMN kind TEXT NOT NULL DEFAULT 'change'").run()
-        }
-      })()
-    }
-    return this.accountEmailSupportEnsured
+    return ensured(this.binding, 'accountEmailSupport', async () => {
+      await this.db.prepare(
+        `CREATE TABLE IF NOT EXISTS account_emails (
+           user_id TEXT NOT NULL REFERENCES users(id),
+           email TEXT NOT NULL,
+           verified_at TEXT,
+           added_by TEXT,
+           created_at TEXT NOT NULL DEFAULT (datetime('now')),
+           PRIMARY KEY (user_id, email)
+         )`,
+      ).run()
+      await this.db.prepare('CREATE UNIQUE INDEX IF NOT EXISTS idx_account_emails_email ON account_emails (email)').run()
+      const tokenCols = await this.db.prepare('PRAGMA table_info(email_change_tokens)').all<{ name: string }>()
+      if (!tokenCols.results.some(c => c.name === 'kind')) {
+        await this.db.prepare("ALTER TABLE email_change_tokens ADD COLUMN kind TEXT NOT NULL DEFAULT 'change'").run()
+      }
+    })
   }
 
   // ── users / sessions ─────────────────────────────────────────────
@@ -648,7 +831,28 @@ export class D1ServerStore implements ServerStore {
     return row?.id_token_hint ?? null
   }
 
+  /** TODO.identity/06's last-active stamp, throttled to one ISSUED write
+   *  per minute per session per isolate — the DB-side 60 s WHERE clause
+   *  stays the source of truth across isolates (the module-scope note);
+   *  the in-isolate cache only skips issuing a write the row would
+   *  refuse. A failed write is never cached (the cache set follows the
+   *  await), so the next request retries. */
+  private async stampSessionLastSeen(token: string): Promise<void> {
+    const now = Date.now()
+    if (now - (lastSeenWrites.get(token) ?? 0) < LAST_SEEN_THROTTLE_MS) return
+    await this.stmt(
+      "UPDATE sessions SET last_seen_at = datetime('now') WHERE token = ? AND (last_seen_at IS NULL OR last_seen_at < datetime('now', '-60 seconds'))",
+      token,
+    ).run()
+    if (lastSeenWrites.size >= LAST_SEEN_CACHE_CAP) lastSeenWrites.clear()
+    lastSeenWrites.set(token, now)
+  }
+
   async getSessionUser(token: string): Promise<AuthUserPayload | null> {
+    // The ensure chains are memoized per (binding, chain) at module scope
+    // (the header note) — past the isolate's first request these three
+    // awaits are memo hits, and the per-request work that remains is the
+    // session read itself.
     await this.ensureUserColumns()
     await this.ensureSessionColumns()
     await this.ensureMembershipSupport()
@@ -662,12 +866,6 @@ export class D1ServerStore implements ServerStore {
       token,
     ).first<{ user_id: string; active_org: string | null; amr: string | null; email: string; name: string; role: string; roles: string | null; org_id: string | null; avatar_url: string | null; provider: string; email_verified_at: string | null }>()
     if (!session) return null
-    // TODO.identity/06: the last-active stamp, throttled to one write
-    // per minute per session (the sessions section shows it).
-    await this.stmt(
-      "UPDATE sessions SET last_seen_at = datetime('now') WHERE token = ? AND (last_seen_at IS NULL OR last_seen_at < datetime('now', '-60 seconds'))",
-      token,
-    ).run()
     const amr = parseRoles(session.amr)
     const payload: AuthUserPayload = {
       id: session.user_id,
@@ -682,10 +880,16 @@ export class D1ServerStore implements ServerStore {
       ...(amr?.length ? { amr } : {}),
     }
     // TODO.identity/11: the active-org context (the membership model) —
-    // the payload's org/roles follow the session's stamped context.
+    // the payload's org/roles follow the session's stamped context. The
+    // three post-JOIN statements (the throttled last-active stamp, the
+    // two membership reads) are independent, so they round-trip together
+    // (the audit's R2: sequential statements are the latency).
     const activeOrg = session.active_org ?? null
-    const active = activeOrg ? await this.getOrgMembership(payload.id, activeOrg) : null
-    const primary = payload.orgId ? await this.getOrgMembership(payload.id, payload.orgId) : null
+    const [, active, primary] = await Promise.all([
+      this.stampSessionLastSeen(token),
+      activeOrg ? this.getOrgMembership(payload.id, activeOrg) : null,
+      payload.orgId ? this.getOrgMembership(payload.id, payload.orgId) : null,
+    ])
     const resolved = resolveOrgContext(payload, { activeOrg, active, primary })
     if (activeOrg && !(active && active.state === 'active')) {
       // The stale stamp never lingers (the membership ended mid-session).
@@ -2526,6 +2730,14 @@ export class D1ServerStore implements ServerStore {
     return res.results.map(D1ServerStore.toOrgMembership)
   }
 
+  async listAllOrgMemberships(): Promise<OrgMembership[]> {
+    await this.ensureMembershipSupport()
+    const res = await this.stmt(
+      'SELECT * FROM org_memberships ORDER BY org_id, created_at',
+    ).all<Record<string, unknown>>()
+    return res.results.map(D1ServerStore.toOrgMembership)
+  }
+
   async getOrgMembership(userId: string, orgId: string): Promise<OrgMembership | null> {
     await this.ensureMembershipSupport()
     const row = await this.stmt('SELECT * FROM org_memberships WHERE user_id = ? AND org_id = ?', userId, orgId)
@@ -3320,31 +3532,27 @@ export class D1ServerStore implements ServerStore {
   // The SAME statements as sqlite/notify.ts's sync half (D1 is SQLite).
   // The defensive ensure mirrors the instrument_registrations posture:
   // a dev D1 migrated from before migration 0018 lacks the table.
-
-  private notifyDeliverySupportEnsured: Promise<void> | null = null
+  // (Memoized per (binding, chain) at module scope — the header note.)
 
   private ensureNotifyDeliverySupport(): Promise<void> {
-    if (!this.notifyDeliverySupportEnsured) {
-      this.notifyDeliverySupportEnsured = (async () => {
-        await this.db.prepare(
-          `CREATE TABLE IF NOT EXISTS notify_deliveries (
-             id TEXT PRIMARY KEY,
-             event_id TEXT NOT NULL,
-             user_id TEXT NOT NULL,
-             reason TEXT NOT NULL,
-             email TEXT NOT NULL,
-             email_status TEXT,
-             email_at TEXT,
-             created_at TEXT NOT NULL DEFAULT (datetime('now')),
-             UNIQUE (event_id, user_id)
-           )`,
-        ).run()
-        await this.db.prepare('CREATE INDEX IF NOT EXISTS idx_notify_deliveries_event ON notify_deliveries (event_id)').run()
-        await this.db.prepare('CREATE INDEX IF NOT EXISTS idx_notify_deliveries_user ON notify_deliveries (user_id)').run()
-        await this.db.prepare('CREATE INDEX IF NOT EXISTS idx_notify_deliveries_status ON notify_deliveries (email_status)').run()
-      })()
-    }
-    return this.notifyDeliverySupportEnsured
+    return ensured(this.binding, 'notifyDeliverySupport', async () => {
+      await this.db.prepare(
+        `CREATE TABLE IF NOT EXISTS notify_deliveries (
+           id TEXT PRIMARY KEY,
+           event_id TEXT NOT NULL,
+           user_id TEXT NOT NULL,
+           reason TEXT NOT NULL,
+           email TEXT NOT NULL,
+           email_status TEXT,
+           email_at TEXT,
+           created_at TEXT NOT NULL DEFAULT (datetime('now')),
+           UNIQUE (event_id, user_id)
+         )`,
+      ).run()
+      await this.db.prepare('CREATE INDEX IF NOT EXISTS idx_notify_deliveries_event ON notify_deliveries (event_id)').run()
+      await this.db.prepare('CREATE INDEX IF NOT EXISTS idx_notify_deliveries_user ON notify_deliveries (user_id)').run()
+      await this.db.prepare('CREATE INDEX IF NOT EXISTS idx_notify_deliveries_status ON notify_deliveries (email_status)').run()
+    })
   }
 
   private static toNotifyDelivery(row: Record<string, unknown>): NotifyDelivery {
@@ -3476,14 +3684,21 @@ export class D1ServerStore implements ServerStore {
 
 /** The worker entry's install: one store per binding, memoized (the
  *  store is a stateless facade over the binding — safe to share across
- *  the isolate's concurrent requests). */
+ *  the isolate's concurrent requests). The write budget comes from the
+ *  FIRST resolution's opts: the memoized store keeps it (the
+ *  deployment's env is constant, so every request passes the same
+ *  value — a changed budget needs a fresh binding/isolate). */
 const byBinding = new WeakMap<D1Database, D1ServerStore>()
 
-export function d1StoreFor(binding: D1Database): D1ServerStore {
+export function d1StoreFor(binding: D1Database, opts?: D1WriteBudgetOptions): D1ServerStore {
   let store = byBinding.get(binding)
   if (!store) {
-    store = new D1ServerStore(binding)
+    store = new D1ServerStore(binding, opts)
     byBinding.set(binding, store)
   }
   return store
 }
+
+// The seam's honest-unavailable error, re-exported where the consumer's
+// route surface already imports the D1 half from.
+export { StoreUnavailable }

package/src/store/sqlite/store.ts

@@ -903,6 +903,13 @@ export function listOrgMembers(orgId: string): OrgMembership[] {
   return rows.map(membershipPayload)
 }
 
+export function listAllOrgMemberships(): OrgMembership[] {
+  const rows = getDb().prepare(
+    'SELECT * FROM org_memberships ORDER BY org_id, created_at',
+  ).all() as OrgMembershipRow[]
+  return rows.map(membershipPayload)
+}
+
 export function getOrgMembership(userId: string, orgId: string): OrgMembership | null {
   const row = getDb().prepare('SELECT * FROM org_memberships WHERE user_id = ? AND org_id = ?')
     .get(userId, orgId) as OrgMembershipRow | undefined

package/src/store/sqlite.ts

@@ -56,6 +56,7 @@ import {
   listInstrumentRegistrationsForCertificate,
   listInstrumentRegistrationsForHolder,
   listOrgJoinRequests,
+  listAllOrgMemberships,
   listOrgMembers,
   listOrgMemberships,
   listOrgRegistryOrgs,
@@ -420,6 +421,9 @@ export function createSqliteServerStore(): ServerStore {
     async listOrgMembers(orgId: string): Promise<OrgMembership[]> {
       return listOrgMembers(orgId)
     },
+    async listAllOrgMemberships(): Promise<OrgMembership[]> {
+      return listAllOrgMemberships()
+    },
     async getOrgMembership(userId: string, orgId: string): Promise<OrgMembership | null> {
       return getOrgMembership(userId, orgId)
     },

package/src/store.ts

@@ -1354,6 +1354,38 @@ export const DEMO_ACCOUNTS = [
 
 export const DEMO_PASSWORD = 'demo2026'
 
+/** The store's honest unavailable answer (the 2026-09-01 lesson — a
+ *  hung store write must answer in seconds, never spin the caller
+ *  forever): a bounded WRITE's confirmation did not arrive within its
+ *  budget. The route surface maps it to a 503 naming the store's
+ *  TEMPORARY unavailability + the retryability.
+ *
+ *  The timed-out write may STILL land — the store accepted the
+ *  statement and it was the confirmation path that hung, so the error
+ *  never claims the write was lost. `retrySafe` names the statement's
+ *  own idempotency posture: true (an upsert, a keyed UPDATE/DELETE, an
+ *  IF NOT EXISTS heal) — a retry converges; false (a plain INSERT) —
+ *  reconcile before retrying. The reads are NOT bounded by this
+ *  discipline (the read-path latency story is read replication); only
+ *  write/batch/DDL statements throw this. */
+export class StoreUnavailable extends Error {
+  constructor(
+    /** The write's label — the verb + the target (e.g.
+     *  'UPDATE sessions', 'batch (6 statements)'); never row data. */
+    readonly operation: string,
+    /** The confirmation budget the write exceeded, in ms. */
+    readonly budgetMs: number,
+    /** The statement's idempotency posture (the class note). */
+    readonly retrySafe: boolean,
+  ) {
+    super(
+      `the store write did not confirm within ${budgetMs} ms (${operation}) — the store is briefly unavailable; `
+      + `the write may have landed — retry is safe for idempotent operations${retrySafe ? ' (this one is)' : ''}`,
+    )
+    this.name = 'StoreUnavailable'
+  }
+}
+
 /** The async store contract the routes consume. Every method mirrors a
  *  sync counterpart in store.ts / entities.ts — same SQL, same
  *  semantics, awaited. */
@@ -1965,6 +1997,11 @@ export interface ServerStore {
   listOrgMemberships(userId: string): Promise<OrgMembership[]>
   /** One org's memberships (the per-org view), every state. */
   listOrgMembers(orgId: string): Promise<OrgMembership[]>
+  /** EVERY membership across organizations, every state (the admin
+   *  registry's org list groups it in memory — one read, never a
+   *  per-org loop of listOrgMembers). Org- then creation-ordered, so a
+   *  caller's group-by-org keeps listOrgMembers' per-org ordering. */
+  listAllOrgMemberships(): Promise<OrgMembership[]>
   getOrgMembership(userId: string, orgId: string): Promise<OrgMembership | null>
   /** Create the membership — the org's admin inviting an EXISTING
    *  account (state 'invited': the holder accepts from the account