@substrat-run/adapter-cloudflare 0.116.0 → 0.117.0

package/dist/host.js

@@ -1,6 +1,6 @@
-import { fromWireFailure, accessLogEntry, adminLogEntry, opsFailureEntry, opsFailureFingerprint, issueEntry, sweepRunEntry, FRESHNESS_HEARTBEAT_MINUTES, sweepRunsPayload, modelUsageEntry, attachmentRecord, createTenantInput, identityLink, identityPool, createOrgInput, promotionAcknowledgement, bindHostnameInput, channelHistoryEntry, hostnameBinding, publishVersionInput, AUTO_ADMISSION_NOTE, registerVerticalInput, vertical as verticalSchema, verticalServingState, verticalChannel, verticalVersion, connection, capabilityGrant, connectionGrant, connectionGrantRecord, connectionSecret, systemGrant, entitlementGrant, entitlementGrantInput, instant, meterReading, subjectRef, createConnectionInput, projectedConnectionGrant, projectedConnectionKey, moduleManifest, org as orgSchema, orgMembership, resolvedIdentity, identityMembership, roleDefinition, scope as scopeSchema, tenant as tenantSchema, tenantRole, delegatedReadRecord, subjectShredReceipt, platformRequest, connectorDispatchKind, outboundOfManifestJson, substratError, redrainEventsInput, } from '@substrat-run/contracts';
+import { fromWireFailure, accessLogEntry, adminLogEntry, opsFailureEntry, opsFailureFingerprint, issueEntry, sweepRunEntry, FRESHNESS_HEARTBEAT_MINUTES, sweepRunsPayload, modelUsageEntry, attachmentRecord, createTenantInput, identityLink, identityPool, createOrgInput, promotionAcknowledgement, bindHostnameInput, channelHistoryEntry, hostnameBinding, publishVersionInput, AUTO_ADMISSION_NOTE, registerVerticalInput, vertical as verticalSchema, verticalServingState, verticalChannel, verticalVersion, connection, capabilityExchange, capabilityGrant, principalId, connectionGrant, connectionGrantRecord, connectionSecret, systemGrant, systemSwitch, systemSwitchOutcome, entitlementGrant, entitlementGrantInput, instant, meterReading, subjectRef, createConnectionInput, projectedConnectionGrant, projectedConnectionKey, moduleManifest, org as orgSchema, orgMembership, resolvedIdentity, identityMembership, roleDefinition, scope as scopeSchema, tenant as tenantSchema, tenantRole, delegatedReadRecord, subjectShredReceipt, connectorDispatchKind, outboundOfManifestJson, substratError, redrainEventsInput, } from '@substrat-run/contracts';
 import { normalizeHostname, toRouteTarget } from './route-resolver.js';
-import { attachmentBlobKey, entitlementDenial, foldMeterReading, parseValidationRecords, resolveScopeRecord, ulid, foldModelUsage, backoffAt, resolveRetryPolicy, isSecretBoxConfigured, unconfiguredSecretBox, createSubjectKeys, generateSealingKeyPair, openSealed, ImpersonationRefused, assertSessionUsable, impersonationRowValues, mapImpersonationRow, newImpersonationSession, jobRunOf, runDueJobRuns, startJobRun, globalFetch, assertRedrainWindow, } from '@substrat-run/kernel';
+import { attachmentBlobKey, entitlementDenial, foldMeterReading, parseValidationRecords, resolveScopeRecord, ulid, capabilityTokenHash, checkBecomeInput, plausibleSessionToken, foldModelUsage, backoffAt, resolveRetryPolicy, isSecretBoxConfigured, unconfiguredSecretBox, createSubjectKeys, generateSealingKeyPair, openSealed, ImpersonationRefused, assertSessionUsable, impersonationRowValues, mapImpersonationRow, newImpersonationSession, jobRunOf, runDueJobRuns, startJobRun, globalFetch, assertRedrainWindow, platformRequestOf, undrainedEventsOf, systemSwitchedOffMessage, } from '@substrat-run/kernel';
 import { isOrangeToOrange, isUpgradeRequest, LIVE_MODE_HEADER, LIVE_PRINCIPAL_HEADER, LIVE_SCOPE_HEADER, LIVE_SUBSCRIBE_PATH, LIVE_TENANT_HEADER, } from './live-reads.js';
 import { tenantStoreDatabaseName } from './d1.js';
 import { blobStoreBucketName, r2TenantBlobStore } from './r2.js';
@@ -22,23 +22,6 @@ const toConnection = (r) => connection.parse({
     createdAt: r.created_at,
     revokedAt: r.revoked_at,
 });
-/** Map a stored platform-request row to the `PlatformRequest` contract shape (JSON columns parsed). */
-function rowToPlatformRequest(r) {
-    return platformRequest.parse({
-        id: r.id,
-        kind: r.kind,
-        payload: JSON.parse(r.payload),
-        requestedBy: JSON.parse(r.requested_by),
-        impersonation: r.impersonation == null ? null : JSON.parse(r.impersonation),
-        status: r.status,
-        attempts: r.attempts,
-        lastError: r.last_error,
-        failure: r.last_failure == null ? null : JSON.parse(r.last_failure),
-        result: r.result === null ? null : JSON.parse(r.result),
-        requestedAt: r.requested_at,
-        settledAt: r.settled_at,
-    });
-}
 /**
  * A control-plane stand-in for a CP-less vertical (scope-local-permissions.md Phase 3).
  * The hot path a served scope actually touches becomes trust-the-upstream:
@@ -121,6 +104,8 @@ export class CloudflareScopeHost {
     connectorDelegation;
     /** #1334: the Tier-2 drain's reach into the deployment serving a scope. */
     eventDrainDelegation;
+    /** #1666: the schedule kill switch's reach into the deployment serving a scope. */
+    systemSwitchDelegation;
     /**
      * MUST be constructed per request. Never cache an instance across requests.
      *
@@ -146,6 +131,7 @@ export class CloudflareScopeHost {
             : nullControlPlane();
         this.connectorDelegation = options.connectorDelegation;
         this.eventDrainDelegation = options.eventDrainDelegation;
+        this.systemSwitchDelegation = options.systemSwitchDelegation;
         this.admin = this.buildAdmin();
     }
     // -- registration mechanics (validation only) -----------------------------
@@ -276,7 +262,16 @@ export class CloudflareScopeHost {
         const stub = this.scopeStub(scopeId);
         for (const [id, executor] of this.executors) {
             const deliveryId = `executor:${id}`;
-            const events = await stub.pendingExecutorEvents(deliveryId, executor.eventType);
+            const { events, undecodable } = await stub.pendingExecutorDeliveries(deliveryId, executor.eventType);
+            // #1636: an event the DO could not decode is dead-lettered for this executor at once,
+            // and its handler never sees it. Terminal on the FIRST failure, unlike a handler's:
+            // the decode is pure, so a retry cannot succeed. The rows behind it are delivered
+            // below — the decode used to throw the whole list, on every pass.
+            for (const bad of undecodable) {
+                report.attempted += 1;
+                await stub.recordExecutorAttempt(bad.eventId, deliveryId, bad.error, null, invocationId);
+                report.deadLettered += 1;
+            }
             for (const event of events) {
                 report.attempted += 1;
                 this.causedBy = event.id;
@@ -420,12 +415,13 @@ export class CloudflareScopeHost {
     async listPlatformRequests(tenantId, scopeId) {
         await this.cp.validateScopeAccess(tenantId, scopeId);
         await this.migrateAndRecord(scopeId);
-        return (await this.scopeStub(scopeId).pendingPlatformRequests()).map(rowToPlatformRequest);
+        // Tolerant (#1588): one undecodable row comes back naming why, never throws for the list.
+        return (await this.scopeStub(scopeId).pendingPlatformRequests()).map(platformRequestOf);
     }
     async listPlatformRequestHistory(tenantId, scopeId, filter) {
         await this.cp.validateScopeAccess(tenantId, scopeId);
         await this.migrateAndRecord(scopeId);
-        return (await this.scopeStub(scopeId).platformRequestHistory(filter)).map(rowToPlatformRequest);
+        return (await this.scopeStub(scopeId).platformRequestHistory(filter)).map(platformRequestOf);
     }
     async settlePlatformRequest(tenantId, scopeId, id, outcome) {
         await this.cp.validateScopeAccess(tenantId, scopeId);
@@ -604,13 +600,17 @@ export class CloudflareScopeHost {
     async appliedMigrationsLocal(scopeId) {
         return this.scopeStub(scopeId).appliedMigrations();
     }
+    /** This host's own scope's database size in bytes (#1524), the vertical-host read. */
+    async databaseSizeLocal(scopeId) {
+        return this.scopeStub(scopeId).databaseSize();
+    }
     /**
      * The oldest not-yet-drained events of this host's own scope (#1334) — the far end of
      * the control plane's `EventDrainDelegation`. Bounded the same way the audited verb is,
      * so a caller cannot ask this side for more than the other would.
      */
     async undrainedEventsLocal(scopeId, limit) {
-        return this.scopeStub(scopeId).undrainedEvents(Math.min(Math.max(limit, 1), 1000));
+        return undrainedEventsOf(await this.scopeStub(scopeId).undrainedEventsRead(Math.min(Math.max(limit, 1), 1000)));
     }
     /**
      * Stamp `drained_at` on this host's own scope (#1334) — the delegation's other half.
@@ -737,14 +737,18 @@ export class CloudflareScopeHost {
         // holds exactly the permissions its schedules declared, on this scope, so
         // `ctx.check` resolves for scheduled work (the gate stays the check). Written to
         // the scope's own tuples, where the checker reads them — the same place the owner
-        // grant and connection grants land. Idempotent, so a re-provision re-asserts them.
+        // grant and connection grants land. Idempotent, so a re-provision re-asserts them —
+        // SEATED (#1659): a missing grant is recreated, a revoked one stays revoked. The
+        // per-scope schedule kill switch is `revokeFromSystem` (#1666), and its OFF marker is
+        // not a grant, so no reconcile can seat it away; `restoreToSystem` is the only way back.
+        // (`grantToSystem` still clears a tuple's tombstone, but it does not move the switch.)
         for (const [moduleId, schedules] of this.moduleSchedules) {
             const perms = new Set();
             for (const s of schedules)
                 for (const p of s.permissions)
                     perms.add(p);
             for (const perm of perms) {
-                await this.scopeStub(input.scopeId).writeTuple(`system:${moduleId}`, `granted:${perm}`, `scope:${input.scopeId}`, null);
+                await this.scopeStub(input.scopeId).seatTuple(`system:${moduleId}`, `granted:${perm}`, `scope:${input.scopeId}`, null);
             }
         }
         // Audit a real provision only; an idempotent re-provision changed nothing.
@@ -1223,6 +1227,59 @@ export class CloudflareScopeHost {
         await this.migrateAndRecord(scopeId);
         return this.buildStub(tenantId, scopeId, undefined, undefined, moduleId);
     }
+    /**
+     * The exchange (#1672) — the same fail-closed (tenant, scope) and lifecycle gate as
+     * `getScope`, then the kernel's `exchangeCapability` inside the ScopeDO, where the
+     * capability row lives. The answer is re-parsed on this side of the RPC.
+     */
+    async exchangeCapability(tenantId, scopeId, secret, options) {
+        await this.cp.validateScopeAccess(tenantId, scopeId);
+        await this.migrateAndRecord(scopeId);
+        const outcome = await this.scopeStub(scopeId).exchangeCapability(secret, tenantId, scopeId, options?.mode);
+        return capabilityExchange.nullable().parse(outcome);
+    }
+    /**
+     * The capability door (#1672) — mirror of the connection, system and impersonation doors.
+     * The token is shape-checked and hashed HERE; only its hash reaches the ScopeDO, which
+     * re-resolves it to its capability on every invoke and acknowledges that it did.
+     */
+    async getCapabilityScope(sessionToken, tenantId, scopeId, options) {
+        if (!plausibleSessionToken(sessionToken)) {
+            throw substratError('unauthenticated', 'not a capability session token');
+        }
+        await this.cp.validateScopeAccess(tenantId, scopeId);
+        await this.migrateAndRecord(scopeId);
+        const hash = await capabilityTokenHash(sessionToken);
+        return this.buildStub(tenantId, scopeId, undefined, undefined, undefined, options, undefined, hash);
+    }
+    /**
+     * Is this the SHARED control plane's host — the one whose own `SCOPE` namespace holds no
+     * hosted scope's storage, and which routes scope writes to the serving deployment? The
+     * delegations are set on that host and no other (their own docs say so), so any one of
+     * them being present is the signal.
+     */
+    get servesScopesElsewhere() {
+        return Boolean(this.connectorDelegation || this.systemSwitchDelegation || this.eventDrainDelegation);
+    }
+    /**
+     * Where a platform capability verb (#1672) may write: this host's own ScopeDO — refused,
+     * loudly, on the shared control plane for a scope bound to a vertical, whose storage lives
+     * in that vertical's deployment. Writing through `this.scopeStub` there would mint into
+     * an empty DO of the wrong namespace, a capability nobody could ever exchange. Delegating
+     * these verbs to the serving deployment (as the schedule switch is) is a follow-up; the
+     * claim-link migration is the first caller that needs it.
+     */
+    async capabilityScopeStub(tenantId, scopeId, verb) {
+        const rec = await this.cp.getScopeRecord(tenantId, scopeId);
+        if (!rec)
+            throw substratError('not_found', `unknown scope for tenant: (${tenantId}, ${scopeId})`);
+        if (this.servesScopesElsewhere && rec.vertical !== null) {
+            throw substratError('unavailable', `${verb} cannot reach scope ${scopeId}: it is served by the '${rec.vertical}' ` +
+                'deployment, and platform capability verbs are not delegated there yet');
+        }
+        await this.migrateAndRecord(scopeId);
+        return { stub: this.scopeStub(scopeId), vertical: rec.vertical };
+    }
     registeredSchedules() {
         const out = [];
         for (const [moduleId, schedules] of this.moduleSchedules) {
@@ -1304,11 +1361,22 @@ export class CloudflareScopeHost {
                 return report;
         }
         const stub = this.scopeStub(scopeId);
-        // The grant IS the switch (#383): run only where the scope holds a live
-        // `system:<moduleId>` grant. Skips a foreign-vertical scope and a per-tenant
-        // revoke quietly — no run, no error.
-        if (!(await stub.hasSystemGrant(moduleId)))
+        // The grant IS the switch (#383), and the kill switch is its lever (#1666): the
+        // kernel's `systemScheduleState`, the one predicate both adapters run. A scope that
+        // never held the module's grant (a foreign vertical's) is a quiet no-op, exactly as
+        // before. A scope switched OFF reports every schedule `skipped`, never `failed`, and
+        // does not touch its cadence rows — so a restore fires a due schedule on the next pass.
+        const state = await stub.systemScheduleState(moduleId);
+        if (state === 'ungranted')
+            return report;
+        if (state === 'off') {
+            for (const schedule of schedules) {
+                report.skipped += 1;
+                report.runs.push({ operation: schedule.operation, outcome: 'skipped' });
+            }
+            report.switchedOff = true;
             return report;
+        }
         const now = Date.now();
         for (const schedule of schedules) {
             const last = await stub.scheduleLastRun(schedule.operation);
@@ -1349,16 +1417,25 @@ export class CloudflareScopeHost {
      * time box that never runs out for the one caller holding it, and
      * `endImpersonation` would stop nothing.
      */
-    sessionId) {
+    sessionId, 
+    /**
+     * #1672: the HASH of a capability session token — the capability door hashed it and
+     * the plaintext goes no further. The ScopeDO resolves it on every invoke, inside its
+     * queue, and acknowledges it; see the refusal below for why the acknowledgement matters.
+     */
+    capabilitySession) {
         const stub = this.scopeStub(scopeId);
         const cp = this.cp;
         const operationEntitlement = this.operationEntitlement;
         // The DO needs SOME principal-shaped value for `ctx.principal`; for a
         // connection it is the connection id, for a schedule the module id, and the
-        // honest attribution rides on the event actor instead.
+        // honest attribution rides on the event actor instead. For a capability it is a
+        // FRESH id nobody holds anything under (#1672): the DO replaces it with the resolved
+        // capability, and a DO too old to know that would act as nobody rather than as someone.
         const asPrincipalId = (principal ??
             connectionId ??
-            systemModuleId);
+            systemModuleId ??
+            (capabilitySession !== undefined ? principalId.parse(ulid()) : undefined));
         return {
             tenantId,
             scopeId,
@@ -1380,7 +1457,7 @@ export class CloudflareScopeHost {
                 }
                 // K-42: resolved per invoke, so expiry and `endImpersonation` both bite.
                 const session = sessionId === undefined ? undefined : await this.resolveImpersonation(sessionId, tenantId, scopeId);
-                const envelope = await stub.invoke(operation, input, asPrincipalId, tenantId, scopeId, connectionId, requiredKey, systemModuleId, true, invokeOptions, session);
+                const envelope = await stub.invoke(operation, input, asPrincipalId, tenantId, scopeId, connectionId, requiredKey, systemModuleId, true, invokeOptions, session, capabilitySession);
                 // The operation failed and the DO handed the error back as DATA — so it still
                 // has its code and extensions, which a throw across this boundary would have
                 // stripped down to a message (#113 §3). Rethrown here, where the caller expects
@@ -1414,6 +1491,14 @@ export class CloudflareScopeHost {
                 // principal with nothing stamped and no read-only bound. The write has
                 // committed; what this refuses is the SUCCESS, because a support session
                 // believed to be recorded and bounded is worse than no support session.
+                // #1672, the same shape: a DO too old to know about capability sessions ignored the
+                // hash and ran the call as the fresh placeholder principal, who holds nothing — so
+                // the likely outcome is a refusal, but a SUCCESS here would have been decided
+                // without the capability's grant, its allowlist or its liveness, and is refused.
+                if (capabilitySession !== undefined && envelope.capability?.honoured !== true) {
+                    throw substratError('unavailable', `${operation} ran on a scope host that did not understand capability sessions. ` +
+                        'Retry once the scope has been migrated');
+                }
                 if (session !== undefined && envelope.impersonation?.honoured !== true) {
                     throw substratError('unavailable', `${operation} ran on a scope host that did not understand impersonation — the ` +
                         'operation may have run unrecorded and unbounded. Retry once the scope has ' +
@@ -1570,6 +1655,74 @@ export class CloudflareScopeHost {
                 await this.cp.writeTenantTuple(node.tenantId, subject, `granted:${permission}`, `tenant:${node.tenantId}`, expiresAt ?? null);
             }
         };
+        /**
+         * #1666: move one module's schedule switch on one scope — see `HostAdmin.revokeFromSystem`.
+         *
+         * Where the write lands is the whole point of the delegation branch. The shared control
+         * plane's own `SCOPE` namespace is the module-less placeholder, so a hosted scope's
+         * switch has to be moved in the deployment serving it; writing it here would report a
+         * switch pulled while every schedule kept firing. The audit row is written HERE either
+         * way — the deployment's host is CP-less, and its `recordAdmin` is a no-op.
+         */
+        const switchSystem = async (actor, raw, to) => {
+            const input = systemSwitch.parse(raw);
+            const { tenantId, scopeId } = input.node;
+            let vertical = null;
+            if (!this.cpLess) {
+                const rec = await this.cp.getScopeRecord(tenantId, scopeId);
+                if (!rec)
+                    throw substratError('not_found', `unknown scope for tenant: (${tenantId}, ${scopeId})`);
+                vertical = rec.vertical;
+            }
+            // AUDIT FIRST (#1666 review): the intent row lands before anything moves, and the
+            // outcome row after — every attempt, a repeat included. The scope's store and the
+            // admin log are separate, so no order makes the pair atomic; this one fails toward
+            // "an intent with no recorded outcome" and never toward "a switch that moved with no
+            // audit row". A retry after a crash re-audits even though it answers `changed: false`.
+            const operationId = ulid();
+            const action = to === 'off' ? 'revokeFromSystem' : 'restoreToSystem';
+            const target = { tenantId, scopeId, vertical };
+            const base = { operationId, moduleId: input.moduleId, schedules: to };
+            await this.recordAdmin(actor, action, target, null, { ...base, phase: 'intent', reason: input.reason });
+            // A scope bound to no vertical (#1666 review) has no deployment to delegate to: its
+            // store is the DO here, so the switch moves (or answers `held: false`) here too.
+            // Delegating it would throw "no deployment serving scope" instead. A scope WITH a
+            // vertical still delegates, and still fails loudly when none serves it.
+            const delegation = this.cpLess || vertical !== null ? this.systemSwitchDelegation : undefined;
+            let outcome;
+            try {
+                outcome = delegation
+                    ? await delegation.switch({ tenantId, scopeId, moduleId: input.moduleId, to })
+                    : await this.scopeStub(scopeId).switchSystemSchedules(input.moduleId, scopeId, to, new Date().toISOString());
+            }
+            catch (err) {
+                // Best effort: the original error is what the caller must see, and the intent row
+                // already says an attempt was made.
+                await this.recordAdmin(actor, action, target, null, {
+                    ...base,
+                    phase: 'failed',
+                    error: err instanceof Error ? err.message : String(err),
+                }).catch(() => undefined);
+                throw err;
+            }
+            await this.recordAdmin(actor, action, target, null, {
+                ...base,
+                phase: outcome.held ? 'applied' : 'refused',
+                changed: outcome.changed,
+                permissions: outcome.permissions,
+            });
+            if (!outcome.held) {
+                throw substratError('not_found', `scope ${scopeId} holds no system grant for module '${input.moduleId}' — nothing to switch ${to} ` +
+                    `(check the module id: it is the module's manifest id, e.g. '@substrat-run/engine-absence')`);
+            }
+            return {
+                operationId,
+                moduleId: input.moduleId,
+                schedules: to,
+                changed: outcome.changed,
+                permissions: outcome.permissions,
+            };
+        };
         return {
             // #603: fixed at construction — a worker deployed without SECRET_BOX_KEY can never
             // store a credential, and saying so is what lets a transport answer 503 instead of 500.
@@ -1708,11 +1861,59 @@ export class CloudflareScopeHost {
                 // The scheduler's grant (#383) — mirror of grantToConnection. Narrow: one
                 // module, one permission; tombstones on revoke; shows in the permission diff.
                 const grant = systemGrant.parse(raw);
-                await writeGrant(subjectRef({ kind: 'system', id: grant.moduleId }), grant.permission, grant.node, undefined, grant.expiresAt);
+                if (grant.node.scopeId) {
+                    // #1666: refused while the module is switched off on this scope — checked and
+                    // written in one DO unit. Restore is the lever; a grant is not.
+                    const written = await this.scopeStub(grant.node.scopeId).writeSystemGrant(grant.moduleId, `granted:${grant.permission}`, `scope:${grant.node.scopeId}`, grant.expiresAt ?? null);
+                    if (!written) {
+                        throw substratError('conflict', systemSwitchedOffMessage(grant.moduleId, grant.node.scopeId));
+                    }
+                }
+                else {
+                    await writeGrant(subjectRef({ kind: 'system', id: grant.moduleId }), grant.permission, grant.node, undefined, grant.expiresAt);
+                }
                 await this.recordAdmin(actor, 'grantToSystem', { tenantId: grant.node.tenantId, scopeId: grant.node.scopeId }, null, { moduleId: grant.moduleId, permission: grant.permission, node: grant.node });
                 if (!grant.node.scopeId)
                     await this.fanOut(grant.node.tenantId);
             },
+            // #1666: the schedule kill switch and its lever back — `system-switch.ts` is the
+            // whole rule, shared with the pure adapter; this is the directory check, the reach
+            // into the scope's storage, and the audit row around it.
+            revokeFromSystem: async (actor, raw) => switchSystem(actor, raw, 'off'),
+            restoreToSystem: async (actor, raw) => switchSystem(actor, raw, 'on'),
+            // #1672 — the platform's two capability verbs. Audited AFTER the write, on both, and
+            // the failure each leaves is the safe one: a mint whose audit row did not land never
+            // returned its secret, so nobody can ever exchange it; a revoke whose row did not land
+            // has still revoked. Neither the secret nor its hash is ever in before/after.
+            mintCapability: async (actor, tenantId, scopeId, input) => {
+                // Checked HERE as well as in the DO: a typed refusal thrown across the RPC arrives as
+                // a bare message, and the caller would lose `validation_failed`. One function, so the
+                // two sides cannot disagree about what a valid mint is.
+                checkBecomeInput(input, new Date().toISOString());
+                await this.cp.validateScopeAccess(tenantId, scopeId);
+                const { stub, vertical } = await this.capabilityScopeStub(tenantId, scopeId, 'mintCapability');
+                const minted = await stub.mintBecomeCapability(input, actor);
+                await this.recordAdmin(actor, 'mintCapability', { tenantId, scopeId, vertical }, null, {
+                    capabilityId: minted.id,
+                    mode: 'become',
+                    principal: input.principal,
+                    expiresAt: input.expiresAt,
+                    maxUses: input.maxUses,
+                    label: input.label ?? null,
+                });
+                return minted;
+            },
+            revokeCapability: async (actor, tenantId, scopeId, capabilityId) => {
+                const { stub, vertical } = await this.capabilityScopeStub(tenantId, scopeId, 'revokeCapability');
+                const before = await stub.revokeCapabilityAsPlatform(capabilityId, actor);
+                if (!before) {
+                    throw substratError('not_found', `no capability ${capabilityId} in scope ${scopeId}`);
+                }
+                await this.recordAdmin(actor, 'revokeCapability', { tenantId, scopeId, vertical }, before, {
+                    capabilityId,
+                    revoked: true,
+                });
+            },
             grantToOrg: async (actor, orgId, permission, node, entity) => {
                 // The org must exist in the node's tenant. A grant to a phantom org looks
                 // applied, resolves for nobody, and still shows up in the permission diff.
@@ -2223,6 +2424,13 @@ export class CloudflareScopeHost {
                 await this.recordAccess(actor, 'scopeMigrationBookmarks', { tenantId, scopeId }, null, bookmarks.length);
                 return bookmarks;
             },
+            scopeDatabaseSize: async (actor, tenantId, scopeId) => {
+                // Reaped is refused, not read: addressing the deleted DO would recreate it.
+                await this.scopeRecordForRead(tenantId, scopeId);
+                const bytes = await this.scopeStub(scopeId).databaseSize();
+                await this.recordAccess(actor, 'scopeDatabaseSize', { tenantId, scopeId }, null, 1);
+                return bytes;
+            },
             rewindScope: async (actor, tenantId, scopeId, bookmark, opts) => {
                 const scope = await this.cp.getScopeRecord(tenantId, scopeId);
                 if (!scope)
@@ -2396,7 +2604,7 @@ export class CloudflareScopeHost {
                         vertical: record.vertical,
                         limit: bounded,
                     })
-                    : await this.scopeStub(scopeId).undrainedEvents(bounded);
+                    : undrainedEventsOf(await this.scopeStub(scopeId).undrainedEventsRead(bounded));
                 await this.recordAccess(actor, 'readUndrainedEvents', { tenantId, scopeId }, { limit }, events.length);
                 return events;
             },
@@ -2694,12 +2902,29 @@ export class CloudflareScopeHost {
                 // half-done state harms the person: dying after the redaction leaves ciphertext in
                 // a backup that no key opens; destroying the key first would leave their PII in the
                 // live database while the audit log already claims they were erased.
-                const eventsRedacted = await this.scopeStub(scopeId).redactSubject(subjectId);
+                // Both spine copies (#1600): the outbox row AND any platform intent this event was
+                // routed into. One RPC, so a crash cannot land half of it.
+                const redacted = await this.scopeStub(scopeId).redactSubject(subjectId);
+                // An OLD ScopeDO answers with a bare number — it redacted the outbox and never
+                // looked at the intent journal. Refused here, BEFORE the key is destroyed, and
+                // that order is the whole point: the key is the irreversible half, so proceeding
+                // would leave the subject's platform-retained copies permanently unreadable, their
+                // name still sitting in `_substrat_platform_requests`, and no admin-log row at all
+                // (the log is written after this). Refusing leaves an erasure that can simply be
+                // re-run once the scope is redeployed. Loud rather than partial, the way this
+                // interface's reverse skew is left loud on `recordScheduleRun`.
+                if (typeof redacted === 'number') {
+                    throw substratError('unavailable', `scope ${scopeId} runs a ScopeDO from before #1600, whose redaction does not reach ` +
+                        `_substrat_platform_requests — erasing now would destroy the subject key while ` +
+                        `leaving their payloads in the intent journal. Redeploy the vertical and re-run.`);
+                }
+                const { events: eventsRedacted, intents: intentsRedacted } = redacted;
                 const at = new Date().toISOString();
                 const { existed } = await this.subjectKeysFor(tenantId, scopeId).destroy(subjectId, at);
                 const receipt = subjectShredReceipt.parse({
                     subjectId,
                     eventsRedacted,
+                    intentsRedacted,
                     keyDestroyed: existed,
                     tombstoned: true,
                 });
@@ -2707,7 +2932,9 @@ export class CloudflareScopeHost {
                 // because it destroys evidence. An erasure is the one action where "who asked for
                 // this to disappear" is itself part of the record.
                 await this.recordAdmin(actor, 'shredSubject', { tenantId, scopeId }, null, receipt);
-                await this.recordAccess(actor, 'shredSubject', { tenantId, scopeId }, { subjectId }, eventsRedacted);
+                // BOTH counts: the access log's number is "how much evidence this destroyed", and
+                // an intent payload is a whole event's worth of it.
+                await this.recordAccess(actor, 'shredSubject', { tenantId, scopeId }, { subjectId }, eventsRedacted + intentsRedacted);
                 return receipt;
             },
             // -- impersonation (K-42, #868) ----------------------------------------
@@ -3689,15 +3916,22 @@ export class CloudflareScopeHost {
         // used to leave the scope "roles projected, source=local, zero tuples" — enforcing nothing
         // but denials, with no builder-facing lever to fix it. Atomic now: grant and flip land
         // together, and the empty-tuple guard in `applyProjection` refuses the flip if they don't.
+        //
+        // #1659: every tuple here is SEATED — created if missing, left alone if revoked — so a
+        // reconcile no longer undoes an operator's revoke. The owner's seat alone carries
+        // `lockout_reseat`: it comes back over a revoke only when the scope would otherwise hold
+        // no effective role grant — none whose role the vertical still defines — which is the
+        // #332 lockout a reconcile exists to repair.
         [
             {
                 subject: `principal:${input.owner}`,
                 relation: `role:${input.ownerRoleKey}`,
                 object: `scope:${input.scopeId}`,
                 expires_at: null,
+                lockout_reseat: true,
             },
             // #461: each registered module's SCHEDULE grants (#383) ride the same unit —
-            // the CP-less mirror of `provisionScope`'s writeTuple loop. Without them the
+            // the CP-less mirror of `provisionScope`'s seatTuple loop. Without them the
             // grant-is-the-switch check makes every schedule a silent no-op (`fired: 0`,
             // no error — the #49 unfalsifiable zero).
             ...[...this.moduleSchedules].flatMap(([modId, schedules]) => {
@@ -3784,16 +4018,23 @@ export class CloudflareScopeHost {
      * seat is the one that knows what to announce, and it emits from its own operation.
      * Guarded like `assignScopeRole`: at the harness route, not at this seam.
      *
-     * Two things a caller has to know, because the tombstone is only as durable as the next
-     * `INSERT OR REPLACE` on the same row:
-     * - Anything that re-projects the scope's tuples clears it — `provisionScopeLocal` on a
-     *   reconcile re-seats the owner and the `system:` grants, and a vertical's `onProvision`
-     *   hook that re-issues `assignScopeRole` re-seats whatever it names. A revoke of a role
-     *   such a path grants is undone on the next reconcile, silently. Revoke the seats your
-     *   own flow granted, not the ones provisioning did.
-     * - Revoking the LAST live role tuple in a scope leaves nobody who passes a check, and
-     *   the local checker has no way back in (#332 guards the flip to local on the way in
-     *   only). Seat the successor before unseating the last holder.
+     * What survives a reconcile (#1659), because the tombstone is only as durable as the next
+     * write that is allowed to replace it:
+     * - Provisioning does not clear it. `provisionScopeLocal` SEATS its tuples (the owner's
+     *   role, the `system:` grants, the connection grants): it recreates a missing one and
+     *   leaves a revoked one revoked, so a reconcile — every listed promote runs one — keeps
+     *   your revoke.
+     * - With ONE exception: the owner-of-record's seat is re-seated over a revoke when the
+     *   scope would otherwise hold no effective role grant at all — a holder of a role the
+     *   vertical no longer defines passes no check, so it does not count. A scope nobody can
+     *   act in is the #332 lockout the reconcile exists to repair, so revoking the LAST holder
+     *   is undone at the next reconcile. Seat the successor (in a role the vertical defines)
+     *   before unseating the owner, and the revoke stands. The owner re-seated is the one `owner_of_record` names, which is first-write-
+     *   wins — if a successor is later revoked too, the ORIGINAL owner comes back. To lock a
+     *   compromised owner out, suspend the scope; a seat revoke is not that lever.
+     * - An explicit grant does clear it: `assignScopeRole` is `INSERT OR REPLACE`, and so is
+     *   a vertical's `onProvision` hook that re-issues it — which re-seats whatever it names
+     *   on every reconcile. Revoke the seats your own flow granted and does not re-grant.
      * On a CP-less host this records no admin-log row (there is no control plane to hold
      * one), so the row's `revoked_at` is the only evidence, and a re-assign replaces it.
      */
@@ -3857,6 +4098,19 @@ export class CloudflareScopeHost {
     async connectorGrantLocal(connectionId, scopeId, permission, expiresAt) {
         await this.writeScopeTuple(scopeId, subjectRef({ kind: 'connection', id: connectionId }), `granted:${permission}`, `scope:${scopeId}`, expiresAt ?? null);
     }
+    /**
+     * The far end of the schedule kill switch for a scope served HERE (#1666):
+     * `/internal/system-switch` lands on this, from the shared control plane's
+     * `revokeFromSystem` / `restoreToSystem`. It moves the switch in the scope's own DO and
+     * answers what it did; it audits nothing, because the control plane that asked holds the
+     * admin log and writes the row once this returns. `held: false` is an answer, not a
+     * throw — see `systemSwitchOutcome`.
+     */
+    async systemSwitchLocal(scopeId, moduleId, to) {
+        // Parsed on the way out: this is the wire answer the platform reads, and the DO's
+        // plain strings become the published shape here rather than on trust.
+        return systemSwitchOutcome.parse(await this.scopeStub(scopeId).switchSystemSchedules(moduleId, scopeId, to, new Date().toISOString()));
+    }
 }
 /** A ledger row -> the wire entry, the attribution re-nested (#1054). */
 function modelUsageEntryOf(r) {