@substrat-run/adapter-cloudflare 0.117.0 → 0.119.0

package/dist/host.js

@@ -1,6 +1,6 @@
-import { fromWireFailure, accessLogEntry, adminLogEntry, opsFailureEntry, opsFailureFingerprint, issueEntry, sweepRunEntry, FRESHNESS_HEARTBEAT_MINUTES, sweepRunsPayload, modelUsageEntry, attachmentRecord, createTenantInput, identityLink, identityPool, createOrgInput, promotionAcknowledgement, bindHostnameInput, channelHistoryEntry, hostnameBinding, publishVersionInput, AUTO_ADMISSION_NOTE, registerVerticalInput, vertical as verticalSchema, verticalServingState, verticalChannel, verticalVersion, connection, capabilityExchange, capabilityGrant, principalId, connectionGrant, connectionGrantRecord, connectionSecret, systemGrant, systemSwitch, systemSwitchOutcome, entitlementGrant, entitlementGrantInput, instant, meterReading, subjectRef, createConnectionInput, projectedConnectionGrant, projectedConnectionKey, moduleManifest, org as orgSchema, orgMembership, resolvedIdentity, identityMembership, roleDefinition, scope as scopeSchema, tenant as tenantSchema, tenantRole, delegatedReadRecord, subjectShredReceipt, connectorDispatchKind, outboundOfManifestJson, substratError, redrainEventsInput, } from '@substrat-run/contracts';
+import { fromWireFailure, exportReadInput, exportedBatch, importBatch, importResult, importState, accessLogEntry, adminLogEntry, opsFailureEntry, opsFailureFingerprint, issueEntry, sweepRunEntry, FRESHNESS_HEARTBEAT_MINUTES, sweepRunsPayload, modelUsageEntry, attachmentRecord, createTenantInput, identityLink, identityPool, createOrgInput, promotionAcknowledgement, bindHostnameInput, channelHistoryEntry, hostnameBinding, publishVersionInput, AUTO_ADMISSION_NOTE, registerVerticalInput, vertical as verticalSchema, verticalServingState, verticalChannel, verticalVersion, connection, capabilityExchange, capabilityGrant, principalId, connectionGrant, connectionGrantRecord, connectionSecret, systemGrant, systemSwitch, systemSwitchOutcome, systemScheduleEntry, entitlementGrant, entitlementGrantInput, instant, meterReading, subjectRef, createConnectionInput, projectedConnectionGrant, projectedConnectionKey, moduleManifest, org as orgSchema, orgMembership, resolvedIdentity, identityMembership, roleDefinition, scope as scopeSchema, tenant as tenantSchema, tenantRole, delegatedReadRecord, subjectShredReceipt, connectorDispatchKind, callsOfManifestJson, outboundOfManifestJson, substratError, redrainEventsInput, peerCoverage, peerGrantsEntry, peerSwitch, peerSwitchOutcome, verticalCaller, verticalResolution, verticalSlug, } from '@substrat-run/contracts';
 import { normalizeHostname, toRouteTarget } from './route-resolver.js';
-import { attachmentBlobKey, entitlementDenial, foldMeterReading, parseValidationRecords, resolveScopeRecord, ulid, capabilityTokenHash, checkBecomeInput, plausibleSessionToken, foldModelUsage, backoffAt, resolveRetryPolicy, isSecretBoxConfigured, unconfiguredSecretBox, createSubjectKeys, generateSealingKeyPair, openSealed, ImpersonationRefused, assertSessionUsable, impersonationRowValues, mapImpersonationRow, newImpersonationSession, jobRunOf, runDueJobRuns, startJobRun, globalFetch, assertRedrainWindow, platformRequestOf, undrainedEventsOf, systemSwitchedOffMessage, } from '@substrat-run/kernel';
+import { attachmentBlobKey, entitlementDenial, foldMeterReading, parseValidationRecords, resolveScopeRecord, ulid, capabilityTokenHash, checkBecomeInput, plausibleSessionToken, foldModelUsage, backoffAt, resolveRetryPolicy, isSecretBoxConfigured, unconfiguredSecretBox, createSubjectKeys, generateSealingKeyPair, openSealed, ImpersonationRefused, assertSessionUsable, impersonationRowValues, mapImpersonationRow, newImpersonationSession, jobRunOf, runDueJobRuns, startJobRun, globalFetch, assertRedrainWindow, platformRequestOf, undrainedEventsOf, systemSwitchedOffMessage, CrossVerticalRegistry, collectPeers, peerSeats, connectorCallRecord, noopConnectorCallRecorder, recordConnectorCall, settleConnectionUse, } from '@substrat-run/kernel';
 import { isOrangeToOrange, isUpgradeRequest, LIVE_MODE_HEADER, LIVE_PRINCIPAL_HEADER, LIVE_SCOPE_HEADER, LIVE_SUBSCRIBE_PATH, LIVE_TENANT_HEADER, } from './live-reads.js';
 import { tenantStoreDatabaseName } from './d1.js';
 import { blobStoreBucketName, r2TenantBlobStore } from './r2.js';
@@ -22,6 +22,12 @@ const toConnection = (r) => connection.parse({
     createdAt: r.created_at,
     revokedAt: r.revoked_at,
 });
+/** Rethrow a capability attachment verb's failure, rebuilt with its code; else its value. */
+function unwrapCapabilityReply(reply) {
+    if (reply.failure)
+        throw fromWireFailure(reply.failure);
+    return reply.value;
+}
 /**
  * A control-plane stand-in for a CP-less vertical (scope-local-permissions.md Phase 3).
  * The hot path a served scope actually touches becomes trust-the-upstream:
@@ -63,8 +69,17 @@ export class CloudflareScopeHost {
     // Registration-mechanics bookkeeping (validation only — the DO executes).
     // Code-time, derived from the bundled modules, NOT durable directory state.
     moduleIds = new Set();
+    /**
+     * #1705: this deployment's cross-vertical declarations. The DO holds the handlers and makes
+     * every decision. The coordinator keeps its own copy for two reasons: registration refuses
+     * bad wiring at the same point as the pure host, and `importState` can answer "imports
+     * nothing" without waking a DO.
+     */
+    crossVertical = new CrossVerticalRegistry();
     /** Module id → its declared recurring schedules (#383), for `registeredSchedules`/`runDueSchedules`. */
     moduleSchedules = new Map();
+    /** #1706: every registered module's `peers`, as declared — read as one union per peer. */
+    peerSources = [];
     /** #1232: declared freshness per module. Registered UNCONDITIONALLY — the schedule
      *  map is only populated for modules WITH schedules, and hanging freshness off it
      *  would drop a freshness-only module at registration. */
@@ -76,6 +91,7 @@ export class CloudflareScopeHost {
     /** Executor id → {eventType, handler} (K-22 §4.2). Coordinator-side, not in the DO. */
     secretBox;
     fetchImpl;
+    connectorCalls;
     /** The live D1 client for per-tenant stores (#301); undefined ⇒ refuse loudly. */
     tenantStores;
     /** The live R2 client for per-tenant blob stores (#473); undefined ⇒ refuse loudly. */
@@ -106,6 +122,8 @@ export class CloudflareScopeHost {
     eventDrainDelegation;
     /** #1666: the schedule kill switch's reach into the deployment serving a scope. */
     systemSwitchDelegation;
+    /** #1706: the peer kill switch's reach into the deployment serving a scope. */
+    peerSwitchDelegation;
     /**
      * MUST be constructed per request. Never cache an instance across requests.
      *
@@ -123,6 +141,7 @@ export class CloudflareScopeHost {
         this.blobStores = options.blobStores;
         this.attachmentBuckets = options.attachmentBuckets;
         this.fetchImpl = options.fetch ?? globalFetch;
+        this.connectorCalls = options.connectorCalls ?? noopConnectorCallRecorder;
         this.scopeLocalPermissions = options.scopeLocalPermissions ?? false;
         this.scopeNs = options.scope;
         this.cpLess = !options.controlPlane;
@@ -132,6 +151,7 @@ export class CloudflareScopeHost {
         this.connectorDelegation = options.connectorDelegation;
         this.eventDrainDelegation = options.eventDrainDelegation;
         this.systemSwitchDelegation = options.systemSwitchDelegation;
+        this.peerSwitchDelegation = options.peerSwitchDelegation;
         this.admin = this.buildAdmin();
     }
     // -- registration mechanics (validation only) -----------------------------
@@ -206,19 +226,18 @@ export class CloudflareScopeHost {
                     // request pending across a rotation still opens.
                     unseal: async (sealed) => openSealed(await this.openSealingKeys(open.id), sealed),
                     fetch: async (input, init) => {
+                        // #1691: timed where the call is made, so the data point carries a duration.
+                        const started = Date.now();
                         try {
                             const res = await fetchImpl(input, {
                                 ...init,
                                 signal: AbortSignal.timeout(timeoutMs),
                             });
-                            await admin.recordConnectionUse(open.id, res.ok ? { ok: true } : { ok: false, error: `HTTP ${res.status} from ${provider}` });
+                            await admin.recordConnectionUse(open.id, settleConnectionUse(provider, Date.now() - started, { response: res }));
                             return res;
                         }
                         catch (err) {
-                            await admin.recordConnectionUse(open.id, {
-                                ok: false,
-                                error: err instanceof Error ? err.message : String(err),
-                            });
+                            await admin.recordConnectionUse(open.id, settleConnectionUse(provider, Date.now() - started, { error: err }));
                             throw err;
                         }
                     },
@@ -667,7 +686,8 @@ export class CloudflareScopeHost {
             }
             seen.add(m.version);
         }
-        const declaredConsumes = new Set(manifest.events.consumes.map((c) => c.type));
+        // IN-SCOPE consumes only (#1705): a `from` entry is an import, handled under `imports`.
+        const declaredConsumes = new Set(manifest.events.consumes.filter((c) => c.from === undefined).map((c) => c.type));
         for (const eventType of Object.keys(registration.consumers ?? {})) {
             if (!declaredConsumes.has(eventType)) {
                 throw new Error(`${manifest.id} registers a consumer for undeclared event type: ${eventType}`);
@@ -680,10 +700,15 @@ export class CloudflareScopeHost {
             }
             this.predicateNames.set(name, manifest.id);
         }
+        // #1705: after the checks above, so a refused module leaves nothing registered here.
+        this.crossVertical.register(manifest, registration.imports);
         this.moduleIds.add(manifest.id);
         if (manifest.schedules && manifest.schedules.length > 0) {
             this.moduleSchedules.set(manifest.id, manifest.schedules);
         }
+        if (manifest.peers && manifest.peers.length > 0) {
+            this.peerSources.push({ peers: manifest.peers });
+        }
         if (manifest.freshness && manifest.freshness.length > 0) {
             this.moduleFreshness.set(manifest.id, manifest.freshness);
         }
@@ -751,6 +776,13 @@ export class CloudflareScopeHost {
                 await this.scopeStub(input.scopeId).seatTuple(`system:${moduleId}`, `granted:${perm}`, `scope:${input.scopeId}`, null);
             }
         }
+        // #1706: every declared PEER holds its keys on the scope from provisioning on — the one
+        // call (`peerSeats`) that makes "declared and installed" mean "live". Same seat as the
+        // schedule grants above, so a grant a switch tombstoned stays tombstoned and a
+        // switched-off peer gets nothing seated.
+        for (const seat of peerSeats(collectPeers(this.peerSources), input.scopeId)) {
+            await this.scopeStub(input.scopeId).seatTuple(seat.subject, seat.relation, seat.object, null);
+        }
         // Audit a real provision only; an idempotent re-provision changed nothing.
         if (created) {
             await this.recordAdmin(actor, 'provisionScope', { tenantId: input.tenantId, scopeId: input.scopeId, vertical: record.vertical }, null, record);
@@ -966,6 +998,27 @@ export class CloudflareScopeHost {
     buildAttachmentSurface(subject, tenantId, scopeId, store, 
     /** The delivery admitting this surface's reads (#726 remedy B), when there is one. */
     forEvent) {
+        const stub = this.scopeStub(scopeId);
+        if ('capabilitySession' in subject) {
+            // #1686: a capability session. Its own ScopeDO verbs rather than a trailing argument
+            // on the principal ones, so a DO that predates them fails the call (no such RPC
+            // method) instead of ignoring the session and checking as someone else. Writes go to
+            // the DO only to be refused and recorded — never to the blob store.
+            const hash = subject.capabilitySession;
+            return {
+                upload: async (input) => unwrapCapabilityReply(await stub.capabilityAttachmentRefuseWrite(hash, tenantId, scopeId, 'attachments.upload', {
+                    entityType: input.entity.entityType,
+                })),
+                list: async (entity) => unwrapCapabilityReply(await stub.capabilityAttachmentList(entity, hash, tenantId, scopeId)),
+                open: async (attachmentId) => {
+                    const record = unwrapCapabilityReply(await stub.capabilityAttachmentOpen(attachmentId, hash, tenantId, scopeId));
+                    return record ? this.openAttachmentBytes(store, scopeId, record) : null;
+                },
+                remove: async (attachmentId) => unwrapCapabilityReply(await stub.capabilityAttachmentRefuseWrite(hash, tenantId, scopeId, 'attachments.remove', {
+                    attachmentId,
+                })),
+            };
+        }
         const connectionId = 'connectionId' in subject ? subject.connectionId : undefined;
         const createdBy = 'principal' in subject ? subject.principal : subject.connectionId;
         // The DO needs SOME principal-shaped value for `ctx.principal`; for a connection it is
@@ -974,11 +1027,6 @@ export class CloudflareScopeHost {
         const asPrincipalId = ('principal' in subject
             ? subject.principal
             : subject.connectionId);
-        const stub = this.scopeStub(scopeId);
-        const sha256Hex = async (body) => {
-            const digest = await crypto.subtle.digest('SHA-256', body);
-            return [...new Uint8Array(digest)].map((b) => b.toString(16).padStart(2, '0')).join('');
-        };
         return {
             upload: async (input) => {
                 const id = ulid();
@@ -1008,17 +1056,7 @@ export class CloudflareScopeHost {
             list: (entity) => stub.attachmentList(entity, asPrincipalId, tenantId, scopeId, connectionId),
             open: async (attachmentId) => {
                 const record = await stub.attachmentAuthorize(attachmentId, 'read', asPrincipalId, tenantId, scopeId, connectionId, forEvent?.eventId);
-                if (!record)
-                    return null;
-                const obj = await store.get(attachmentBlobKey(scopeId, record.id));
-                if (!obj) {
-                    throw new Error(`attachment ${record.id}: bytes missing from the blob store — the metadata row ` +
-                        `survived something the object did not (rewind/reap); see the #473 integrity notes`);
-                }
-                if ((await sha256Hex(obj.body)) !== record.sha256) {
-                    throw new Error(`attachment ${record.id}: bytes do not match the recorded sha256`);
-                }
-                return { record, body: obj.body, contentType: obj.contentType ?? record.contentType };
+                return record ? this.openAttachmentBytes(store, scopeId, record) : null;
             },
             remove: async (attachmentId) => {
                 const removed = await stub.attachmentRemove(attachmentId, asPrincipalId, tenantId, scopeId, connectionId);
@@ -1028,6 +1066,22 @@ export class CloudflareScopeHost {
             },
         };
     }
+    /**
+     * The bytes of an attachment the ScopeDO has already AUTHORIZED, read from the blob store
+     * and held to the record's sha256 — one path for every subject, so a capability's download
+     * meets the same integrity checks a principal's does.
+     */
+    async openAttachmentBytes(store, scopeId, record) {
+        const obj = await store.get(attachmentBlobKey(scopeId, record.id));
+        if (!obj) {
+            throw new Error(`attachment ${record.id}: bytes missing from the blob store — the metadata row ` +
+                `survived something the object did not (rewind/reap); see the #473 integrity notes`);
+        }
+        if ((await sha256Hex(obj.body)) !== record.sha256) {
+            throw new Error(`attachment ${record.id}: bytes do not match the recorded sha256`);
+        }
+        return { record, body: obj.body, contentType: obj.contentType ?? record.contentType };
+    }
     async importScope(actor, input, dump) {
         // Create the destination scope (directory row + DO + lazy migrate); the DO then
         // replaces its provisioned schema with the dump wholesale (drop-then-replay), so
@@ -1227,6 +1281,29 @@ export class CloudflareScopeHost {
         await this.migrateAndRecord(scopeId);
         return this.buildStub(tenantId, scopeId, undefined, undefined, moduleId);
     }
+    /**
+     * #1705: the consumer half. The same lifecycle gate as every door (K-3), then the ScopeDO
+     * applies the batch, and the answer is re-parsed on this side of the RPC. Executors run here
+     * afterwards, as they do after an invoke. A failure to drain them does not un-deliver a batch
+     * that has committed, so it is contained, and the outbox is their backstop.
+     */
+    async deliverToPeer(tenantId, scopeId, raw) {
+        const batch = importBatch.parse(raw);
+        // The peer door's own gate (#1706): K-3's pair check, the refusal for a scope served
+        // elsewhere, the lifecycle check and the migration. A delivery is a write into the
+        // consumer's scope, so it takes the gate an invoke through that door takes.
+        await this.peerScopeGate(tenantId, scopeId, 'deliverToPeer');
+        const result = importResult.parse(await this.scopeStub(scopeId).importApply(batch, tenantId, scopeId));
+        if (result.delivered > 0) {
+            try {
+                await this.drainExecutors(tenantId, scopeId, null);
+            }
+            catch (err) {
+                console.error('substrat: executor drain after a cross-vertical delivery failed', err);
+            }
+        }
+        return result;
+    }
     /**
      * The exchange (#1672) — the same fail-closed (tenant, scope) and lifecycle gate as
      * `getScope`, then the kernel's `exchangeCapability` inside the ScopeDO, where the
@@ -1252,14 +1329,91 @@ export class CloudflareScopeHost {
         const hash = await capabilityTokenHash(sessionToken);
         return this.buildStub(tenantId, scopeId, undefined, undefined, undefined, options, undefined, hash);
     }
+    /**
+     * The peer door (#1706) — mirror of the connection, system and capability doors. `caller`
+     * is the platform's word (the router's, on the hosted path); the pair and lifecycle gate run
+     * here, and the ScopeDO admits the peer inside its queue on every invoke and acknowledges it.
+     */
+    async getVerticalScope(caller, tenantId, scopeId, options) {
+        const parsed = verticalCaller.parse(caller);
+        await this.peerScopeGate(tenantId, scopeId, 'getVerticalScope');
+        return this.buildStub(tenantId, scopeId, undefined, undefined, undefined, options, undefined, undefined, parsed);
+    }
+    /**
+     * Does peer `vertical` hold each key at this scope's node now (#1706) — the ScopeDO's own
+     * checker, so it answers what an invoke would be told, switch included.
+     */
+    async peerCovers(tenantId, scopeId, vertical, permissions) {
+        await this.peerScopeGate(tenantId, scopeId, 'peerCovers');
+        return peerCoverage
+            .array()
+            .parse(await this.scopeStub(scopeId).peerCovers(tenantId, scopeId, verticalSlug.parse(vertical), [...permissions]));
+    }
+    /**
+     * Where a peer verb (#1706) may reach a scope: its own ScopeDO, after the ordinary pair and
+     * lifecycle gate. Refused, loudly, on the SHARED control plane for a scope bound to a
+     * vertical, whose storage lives in that vertical's deployment — reaching through
+     * `this.scopeStub` there would open an empty DO in the wrong namespace. On the hosted path a
+     * peer reaches the target deployment itself, through the platform, never through this host.
+     */
+    async peerScopeGate(tenantId, scopeId, verb) {
+        // K-3's pair check runs HERE, not only inside the ControlPlaneDO (#1714 review). An error
+        // thrown in a Durable Object arrives at the coordinator FLATTENED — its code and
+        // extensions gone — so a typed refusal thrown there reaches a caller untyped, which this
+        // door's own tenant-confinement test proved. A RECORD crosses intact, so the coordinator
+        // reads the record and types the refusal itself. `validateScopeAccess` still runs below
+        // and still owns the lifecycle half (a suspended tenant or scope).
+        if (!this.cpLess) {
+            const record = await this.cp.getScopeRecord(tenantId, scopeId);
+            if (!record) {
+                throw substratError('not_found', `unknown scope for tenant: (${tenantId}, ${scopeId})`);
+            }
+            this.assertServedHere(record, scopeId, verb);
+        }
+        await this.cp.validateScopeAccess(tenantId, scopeId);
+        await this.migrateAndRecord(scopeId);
+    }
+    /**
+     * The capability's attachment door (#1686) — `getCapabilityScope`'s gate, then the
+     * attachment surface with only the session's HASH going on to the ScopeDO. The DO
+     * resolves it inside its queue on every call, checks each read as `{ capability }` and
+     * refuses each write; the bytes stay on this side, as on every attachment path.
+     */
+    async getCapabilityAttachments(sessionToken, tenantId, scopeId) {
+        if (!plausibleSessionToken(sessionToken)) {
+            throw substratError('unauthenticated', 'not a capability session token');
+        }
+        await this.cp.validateScopeAccess(tenantId, scopeId);
+        await this.migrateAndRecord(scopeId);
+        const store = await this.resolveAttachmentStore(tenantId);
+        const capabilitySession = await capabilityTokenHash(sessionToken);
+        return this.buildAttachmentSurface({ capabilitySession }, tenantId, scopeId, store);
+    }
     /**
      * Is this the SHARED control plane's host — the one whose own `SCOPE` namespace holds no
      * hosted scope's storage, and which routes scope writes to the serving deployment? The
      * delegations are set on that host and no other (their own docs say so), so any one of
      * them being present is the signal.
      */
+    /**
+     * Refuse a scope this host does not serve (#1706's door, and #1705's three cross-vertical
+     * verbs).
+     *
+     * On the shared control plane `this.scopeStub` is the module-less placeholder namespace, so
+     * reaching it for a scope bound to a vertical answers from an EMPTY Durable Object: a read
+     * reports a hosted producer as having nothing to export, and a delivery would journal a
+     * batch into a scope that is not the one it names. Both are wrong ANSWERS rather than
+     * failures, which is the shape that goes unnoticed. One refusal, shared by the door's gate
+     * and by the verbs that read a record of their own, so a caller never meets two of them.
+     */
+    assertServedHere(record, scopeId, verb) {
+        if (this.servesScopesElsewhere && record.vertical !== null) {
+            throw substratError('unavailable', `${verb} cannot reach scope ${scopeId}: it is served by the '${record.vertical}' deployment, ` +
+                'which a peer reaches through the platform, not through the shared control plane');
+        }
+    }
     get servesScopesElsewhere() {
-        return Boolean(this.connectorDelegation || this.systemSwitchDelegation || this.eventDrainDelegation);
+        return Boolean(this.connectorDelegation || this.systemSwitchDelegation || this.peerSwitchDelegation || this.eventDrainDelegation);
     }
     /**
      * Where a platform capability verb (#1672) may write: this host's own ScopeDO — refused,
@@ -1280,6 +1434,10 @@ export class CloudflareScopeHost {
         await this.migrateAndRecord(scopeId);
         return { stub: this.scopeStub(scopeId), vertical: rec.vertical };
     }
+    /** #1705: what this deployment imports — the sweep's reason to call no scope when it is empty. */
+    registeredImports() {
+        return this.crossVertical.consumes();
+    }
     registeredSchedules() {
         const out = [];
         for (const [moduleId, schedules] of this.moduleSchedules) {
@@ -1423,7 +1581,12 @@ export class CloudflareScopeHost {
      * the plaintext goes no further. The ScopeDO resolves it on every invoke, inside its
      * queue, and acknowledges it; see the refusal below for why the acknowledgement matters.
      */
-    capabilitySession) {
+    capabilitySession, 
+    /**
+     * #1706: the calling PEER vertical, as the platform named it. The ScopeDO admits it on
+     * every invoke, inside its queue, and acknowledges it — the capability session's pattern.
+     */
+    verticalCaller) {
         const stub = this.scopeStub(scopeId);
         const cp = this.cp;
         const operationEntitlement = this.operationEntitlement;
@@ -1432,10 +1595,14 @@ export class CloudflareScopeHost {
         // honest attribution rides on the event actor instead. For a capability it is a
         // FRESH id nobody holds anything under (#1672): the DO replaces it with the resolved
         // capability, and a DO too old to know that would act as nobody rather than as someone.
+        // A peer vertical (#1706) gets a fresh id too, for the same reason: the DO acts as the
+        // admitted `{ vertical, scope }`, and a DO too old to know that acts as nobody.
         const asPrincipalId = (principal ??
             connectionId ??
             systemModuleId ??
-            (capabilitySession !== undefined ? principalId.parse(ulid()) : undefined));
+            (capabilitySession !== undefined || verticalCaller !== undefined
+                ? principalId.parse(ulid())
+                : undefined));
         return {
             tenantId,
             scopeId,
@@ -1457,7 +1624,7 @@ export class CloudflareScopeHost {
                 }
                 // K-42: resolved per invoke, so expiry and `endImpersonation` both bite.
                 const session = sessionId === undefined ? undefined : await this.resolveImpersonation(sessionId, tenantId, scopeId);
-                const envelope = await stub.invoke(operation, input, asPrincipalId, tenantId, scopeId, connectionId, requiredKey, systemModuleId, true, invokeOptions, session, capabilitySession);
+                const envelope = await stub.invoke(operation, input, asPrincipalId, tenantId, scopeId, connectionId, requiredKey, systemModuleId, true, invokeOptions, session, capabilitySession, verticalCaller);
                 // The operation failed and the DO handed the error back as DATA — so it still
                 // has its code and extensions, which a throw across this boundary would have
                 // stripped down to a message (#113 §3). Rethrown here, where the caller expects
@@ -1499,6 +1666,13 @@ export class CloudflareScopeHost {
                     throw substratError('unavailable', `${operation} ran on a scope host that did not understand capability sessions. ` +
                         'Retry once the scope has been migrated');
                 }
+                // #1706, the same shape: a DO too old to know about peer callers ran the call as the
+                // fresh placeholder principal — without the peer's admission, its allowlist or its
+                // switch. A success decided that way is refused.
+                if (verticalCaller !== undefined && envelope.vertical?.honoured !== true) {
+                    throw substratError('unavailable', `${operation} ran on a scope host that did not understand peer callers. ` +
+                        'Retry once the scope has been migrated');
+                }
                 if (session !== undefined && envelope.impersonation?.honoured !== true) {
                     throw substratError('unavailable', `${operation} ran on a scope host that did not understand impersonation — the ` +
                         'operation may have run unrecorded and unbounded. Retry once the scope has ' +
@@ -1582,6 +1756,7 @@ export class CloudflareScopeHost {
             admissionNote: r.admission_note,
             origin: r.origin_json ? JSON.parse(r.origin_json) : null,
             outbound: outboundOfManifestJson(r.manifest_json),
+            calls: callsOfManifestJson(r.manifest_json),
             createdAt: r.created_at,
         });
         const mapOrg = (r) => orgSchema.parse({
@@ -1664,6 +1839,77 @@ export class CloudflareScopeHost {
          * switch pulled while every schedule kept firing. The audit row is written HERE either
          * way — the deployment's host is CP-less, and its `recordAdmin` is a no-op.
          */
+        /**
+         * #1706: move one PEER's kill switch on one scope — see `HostAdmin.revokeFromPeer`. The
+         * schedule switch's audit discipline (intent first, outcome after, every attempt) and,
+         * since part 3, its delegation: a scope served by a vertical's own deployment is switched
+         * THERE, over `PeerSwitchDelegation`. Without one configured the scope is still refused
+         * `unavailable` (`peerScopeGate`) rather than switched in the placeholder namespace.
+         */
+        const switchPeerAt = async (actor, raw, to) => {
+            const input = peerSwitch.parse(raw);
+            const { tenantId, scopeId } = input.node;
+            let vertical = null;
+            if (!this.cpLess) {
+                const rec = await this.cp.getScopeRecord(tenantId, scopeId);
+                if (!rec)
+                    throw substratError('not_found', `unknown scope for tenant: (${tenantId}, ${scopeId})`);
+                vertical = rec.vertical;
+            }
+            const action = to === 'off' ? 'revokeFromPeer' : 'restoreToPeer';
+            // Where the write lands is the whole point of this branch (#1706 part 3, mirroring
+            // #1666). A scope bound to a vertical is served by that vertical's own deployment, and
+            // its `vertical:<slug>` grants live there; switching it in the shared control plane's
+            // placeholder namespace would tombstone nothing and report a peer cut off while every
+            // call it makes kept being admitted. A scope bound to NO vertical has its store here,
+            // so it switches here — delegating it would throw "no deployment serving scope".
+            // With no delegation configured the old refusal stands, loudly, rather than a write
+            // into the wrong namespace.
+            const delegation = this.cpLess || vertical !== null ? this.peerSwitchDelegation : undefined;
+            if (delegation) {
+                // The gate's lifecycle half still runs (a suspended tenant or scope cannot be
+                // switched); its `scopeStub` half is what the delegation replaces.
+                await this.cp.validateScopeAccess(tenantId, scopeId);
+            }
+            else {
+                await this.peerScopeGate(tenantId, scopeId, action);
+            }
+            const operationId = ulid();
+            const target = { tenantId, scopeId, vertical };
+            const base = { operationId, vertical: input.vertical, calls: to };
+            await this.recordAdmin(actor, action, target, null, { ...base, phase: 'intent', reason: input.reason });
+            let outcome;
+            try {
+                outcome = delegation
+                    ? await delegation.switch({ tenantId, scopeId, vertical: input.vertical, to })
+                    : await this.scopeStub(scopeId).switchPeer(input.vertical, scopeId, to, new Date().toISOString());
+            }
+            catch (err) {
+                await this.recordAdmin(actor, action, target, null, {
+                    ...base,
+                    phase: 'failed',
+                    error: err instanceof Error ? err.message : String(err),
+                }).catch(() => undefined);
+                throw err;
+            }
+            await this.recordAdmin(actor, action, target, null, {
+                ...base,
+                phase: outcome.held ? 'applied' : 'refused',
+                changed: outcome.changed,
+                permissions: outcome.permissions,
+            });
+            if (!outcome.held) {
+                throw substratError('not_found', `scope ${scopeId} holds no grant for peer '${input.vertical}' — nothing to switch ${to} ` +
+                    `(check the slug: it is the calling vertical's registry id, as the target's \`peers\` names it)`);
+            }
+            return {
+                operationId,
+                vertical: input.vertical,
+                calls: to,
+                changed: outcome.changed,
+                permissions: outcome.permissions,
+            };
+        };
         const switchSystem = async (actor, raw, to) => {
             const input = systemSwitch.parse(raw);
             const { tenantId, scopeId } = input.node;
@@ -1723,6 +1969,128 @@ export class CloudflareScopeHost {
                 permissions: outcome.permissions,
             };
         };
+        /**
+         * The status read's admin-log join (#1674): the `intent` row of the `revokeFromSystem`
+         * still in force for each OFF module — actor, reason, when. Paired to its `applied` row
+         * by `operationId`, so a refused or failed attempt is never read as the explanation
+         * (`switchSystemSchedules`'s `held` check means one can only occur on a module this
+         * scope has never switched off before, so it can never be what a currently-off module
+         * is explained by — this is belt-and-braces, not a case that is expected to fire).
+         */
+        const lastSwitchedOffBy = async (tenantId, scopeId, 
+        /** The revoking action, and the payload field naming its subject (#1706). */
+        action, key, subjects) => {
+            const moduleIds = subjects;
+            // `order: 'desc'` is load-bearing: the loop below takes the FIRST intent it sees per
+            // module as the latest one, and `auditLog`'s own default is 'asc' (oldest first).
+            const rows = await this.cp.auditLog({ tenantId, scopeId, action: [action], order: 'desc' });
+            const appliedOps = new Set();
+            for (const row of rows) {
+                const payload = row.after;
+                if (payload?.phase === 'applied' && payload.operationId)
+                    appliedOps.add(payload.operationId);
+            }
+            const result = new Map();
+            for (const row of rows) {
+                if (result.size === moduleIds.size)
+                    break;
+                const payload = row.after;
+                const subject = payload?.[key];
+                if (!payload || payload.phase !== 'intent' || !payload.operationId || typeof subject !== 'string')
+                    continue;
+                if (!moduleIds.has(subject) || result.has(subject))
+                    continue;
+                if (!appliedOps.has(String(payload.operationId)) || typeof payload.reason !== 'string')
+                    continue;
+                result.set(subject, { actor: row.actor, reason: payload.reason, at: row.at });
+            }
+            return result;
+        };
+        /** #1674's join, bound to the schedule switch — the shape every caller here used. */
+        const lastSwitchedOff = async (tenantId, scopeId, moduleIds) => lastSwitchedOffBy(tenantId, scopeId, 'revokeFromSystem', 'moduleId', moduleIds);
+        /**
+         * The status read (#1674): every module this scope holds or has held system authority
+         * for, and where each stands — the SAME predicate `switchSystem` gates its writes on
+         * (`systemScheduleState`, walked over every held subject by the kernel's
+         * `systemGrantsStatus`), so the read and the runner cannot disagree. For a hosted
+         * scope, delegated exactly as the write is (see `switchSystem` above): a deployment
+         * built before #1666's route answers the same "redeploy the vertical", never a wrong
+         * `on`. The admin-log join happens HERE only — never on the deployment, which holds
+         * no admin log of its own.
+         */
+        const systemGrantsStatusOf = async (actor, node) => {
+            const { tenantId, scopeId } = node;
+            let vertical = null;
+            if (!this.cpLess) {
+                const rec = await this.cp.getScopeRecord(tenantId, scopeId);
+                if (!rec)
+                    throw substratError('not_found', `unknown scope for tenant: (${tenantId}, ${scopeId})`);
+                vertical = rec.vertical;
+            }
+            // A hosted scope (a vertical bound, on a non-cpLess host) has no local storage worth
+            // reading — its grants live in the deployment serving it, reachable only through the
+            // delegation. Without one configured, the ternary below would silently fall to THIS
+            // host's own placeholder DO and answer an unrelated (and likely empty) position as
+            // if it were the scope's own — a fail-open wrong answer, not a fail-closed refusal.
+            if (!this.cpLess && vertical !== null && !this.systemSwitchDelegation) {
+                throw substratError('unavailable', `no delegation configured for hosted scope ${scopeId} (vertical '${vertical}') — cannot read its schedule switches`);
+            }
+            const delegation = this.cpLess || vertical !== null ? this.systemSwitchDelegation : undefined;
+            const states = delegation
+                ? await delegation.status({ tenantId, scopeId })
+                : systemScheduleEntry.array().parse(await this.scopeStub(scopeId).systemGrantsStatus());
+            const offModules = new Set(states.filter((s) => s.schedules === 'off').map((s) => s.moduleId));
+            const explanations = offModules.size > 0
+                ? await lastSwitchedOff(tenantId, scopeId, offModules)
+                : new Map();
+            const result = states.map((s) => ({
+                moduleId: s.moduleId,
+                schedules: s.schedules,
+                switchedOff: explanations.get(s.moduleId) ?? null,
+            }));
+            // K-24: reading the switch's position and any live incident reason is itself
+            // access-logged, the same as every other HostAdmin read.
+            await this.recordAccess(actor, 'systemGrantsStatus', { tenantId, scopeId }, null, result.length);
+            return result;
+        };
+        /**
+         * The peer switch's status read (#1706) — `systemGrantsStatusOf` with the subject
+         * swapped, and delegated for the same reason the write is: a hosted scope's
+         * `vertical:<slug>` grants live in the deployment serving it, and this host's own
+         * namespace holds a placeholder no peer call ever consults. Reading the placeholder
+         * would be confidently wrong rather than loudly unavailable, which on a kill switch's
+         * status is the worse of the two, so a hosted scope with no delegation configured is
+         * refused. The admin-log join happens HERE only — the deployment holds no admin log.
+         */
+        const peerGrantsStatusOf = async (actor, node) => {
+            const { tenantId, scopeId } = node;
+            let vertical = null;
+            if (!this.cpLess) {
+                const rec = await this.cp.getScopeRecord(tenantId, scopeId);
+                if (!rec)
+                    throw substratError('not_found', `unknown scope for tenant: (${tenantId}, ${scopeId})`);
+                vertical = rec.vertical;
+            }
+            if (!this.cpLess && vertical !== null && !this.peerSwitchDelegation) {
+                throw substratError('unavailable', `no delegation configured for hosted scope ${scopeId} (vertical '${vertical}') — cannot read which ` +
+                    `peers may call it`);
+            }
+            const delegation = this.cpLess || vertical !== null ? this.peerSwitchDelegation : undefined;
+            const states = delegation
+                ? await delegation.status({ tenantId, scopeId })
+                : peerGrantsEntry.array().parse(await this.scopeStub(scopeId).peerGrantsStatus());
+            const offPeers = new Set(states.filter((p) => p.calls === 'off').map((p) => p.vertical));
+            const explanations = offPeers.size > 0
+                ? await lastSwitchedOffBy(tenantId, scopeId, 'revokeFromPeer', 'vertical', offPeers)
+                : new Map();
+            const result = states.map((p) => ({
+                vertical: p.vertical,
+                calls: p.calls,
+                switchedOff: explanations.get(p.vertical) ?? null,
+            }));
+            await this.recordAccess(actor, 'peerGrantsStatus', { tenantId, scopeId }, null, result.length);
+            return result;
+        };
         return {
             // #603: fixed at construction — a worker deployed without SECRET_BOX_KEY can never
             // store a credential, and saying so is what lets a transport answer 503 instead of 500.
@@ -1879,8 +2247,14 @@ export class CloudflareScopeHost {
             // #1666: the schedule kill switch and its lever back — `system-switch.ts` is the
             // whole rule, shared with the pure adapter; this is the directory check, the reach
             // into the scope's storage, and the audit row around it.
+            peerGrantsStatus: peerGrantsStatusOf,
+            revokeFromPeer: async (actor, raw) => switchPeerAt(actor, raw, 'off'),
+            restoreToPeer: async (actor, raw) => switchPeerAt(actor, raw, 'on'),
             revokeFromSystem: async (actor, raw) => switchSystem(actor, raw, 'off'),
             restoreToSystem: async (actor, raw) => switchSystem(actor, raw, 'on'),
+            // #1674: the switch's status read — same gate, same delegation, and (unlike the
+            // deployment it may delegate to) the admin log to explain an `off` entry.
+            systemGrantsStatus: systemGrantsStatusOf,
             // #1672 — the platform's two capability verbs. Audited AFTER the write, on both, and
             // the failure each leaves is the safe one: a mint whose audit row did not land never
             // returned its secret, so nobody can ever exchange it; a revoke whose row did not land
@@ -2014,6 +2388,9 @@ export class CloudflareScopeHost {
                 await this.recordAccess(actor, 'listHostnames', { tenantId: filter?.tenantId ?? null, scopeId: filter?.scopeId ?? null }, filter, rows.length);
                 return rows.map(mapHostname);
             },
+            // #1706: the directory's answer to "vertical Y in tenant T", in the ControlPlaneDO, by
+            // the kernel's one rule. No actor, not logged — `resolveHostname`'s machine-path reason.
+            resolveVerticalInstance: async (tenantId, vertical) => verticalResolution.parse(await this.cp.resolveVerticalInstance(tenantId, verticalSlug.parse(vertical))),
             resolveHostname: async (raw) => 
             // The router's per-request read. No actor, not logged — the same machine-path
             // carve-out resolveIdentity has (K-24). Shares its mapping with the router's
@@ -2589,6 +2966,35 @@ export class CloudflareScopeHost {
                 await this.recordAccess(actor, 'listScopeTables', { tenantId, scopeId }, null, tables.length);
                 return tables;
             },
+            readExportedEvents: async (actor, tenantId, scopeId, raw) => {
+                // #1705: the producer half. The DO decides what leaves, from its own registered
+                // exports. This side gates the pair (K-3), parses both directions, and writes the
+                // access row, because a platform read of domain data leaving a scope is one.
+                const input = exportReadInput.parse(raw);
+                // The read's own K-3 and reap gate, then the same refusal the door gives: on the
+                // shared control plane this scope's outbox lives in its vertical's deployment, and
+                // the placeholder here would report a hosted producer as having nothing to export.
+                // Not `peerScopeGate`: a read must not migrate, and the phase makes this call once
+                // per edge per pass, where an extra round trip is a fleet-wide cost.
+                this.assertServedHere(await this.scopeRecordForRead(tenantId, scopeId), scopeId, 'readExportedEvents');
+                const batch = exportedBatch.parse(await this.scopeStub(scopeId).exportedEventsRead(input, tenantId, scopeId));
+                await this.recordAccess(actor, 'readExportedEvents', { tenantId, scopeId }, { consumer: input.consumer, after: input.after, limit: input.limit }, batch.events.length);
+                return batch;
+            },
+            importState: async (actor, tenantId, scopeId) => {
+                // Answered with no call at all when this deployment imports nothing: not the directory,
+                // not the DO. "Imports nothing" is a fact about this code, and it names no scope, so it
+                // tells a caller nothing about a (tenant, scope) pair it may not address.
+                if (this.crossVertical.consumes().length === 0)
+                    return { consumes: [], cursors: [] };
+                // Then the read's own gate, and the same refusal: a hosted scope's watermark lives in
+                // its vertical's deployment, and the placeholder here would answer "never read
+                // anything", which a pass would act on by re-delivering that edge from the start.
+                this.assertServedHere(await this.scopeRecordForRead(tenantId, scopeId), scopeId, 'importState');
+                const state = importState.parse(await this.scopeStub(scopeId).importStateRead());
+                await this.recordAccess(actor, 'importState', { tenantId, scopeId }, null, state.cursors.length);
+                return state;
+            },
             readUndrainedEvents: async (actor, tenantId, scopeId, limit) => {
                 const record = await this.scopeRecordForRead(tenantId, scopeId);
                 const bounded = Math.min(Math.max(limit ?? 200, 1), 1000);
@@ -2918,13 +3324,23 @@ export class CloudflareScopeHost {
                         `_substrat_platform_requests — erasing now would destroy the subject key while ` +
                         `leaving their payloads in the intent journal. Redeploy the vertical and re-run.`);
                 }
-                const { events: eventsRedacted, intents: intentsRedacted } = redacted;
+                // A DO from after #1600 and before #1632: it redacted the outbox and the intent
+                // journal and never looked at the job-run tables. Refused BEFORE the key, for the
+                // reason above — its reply read as `jobRuns: 0` would receipt an erasure that left
+                // the person in a step's memo.
+                if (!('jobRuns' in redacted) || typeof redacted.jobRuns !== 'number') {
+                    throw substratError('unavailable', `scope ${scopeId} runs a ScopeDO from before #1632, whose redaction does not reach ` +
+                        `_substrat_job_runs or _substrat_job_steps — erasing now would destroy the subject ` +
+                        `key while leaving their data in the job-run tables. Redeploy the vertical and re-run.`);
+                }
+                const { events: eventsRedacted, intents: intentsRedacted, jobRuns: jobRunsRedacted } = redacted;
                 const at = new Date().toISOString();
                 const { existed } = await this.subjectKeysFor(tenantId, scopeId).destroy(subjectId, at);
                 const receipt = subjectShredReceipt.parse({
                     subjectId,
                     eventsRedacted,
                     intentsRedacted,
+                    jobRunsRedacted,
                     keyDestroyed: existed,
                     tombstoned: true,
                 });
@@ -2934,7 +3350,7 @@ export class CloudflareScopeHost {
                 await this.recordAdmin(actor, 'shredSubject', { tenantId, scopeId }, null, receipt);
                 // BOTH counts: the access log's number is "how much evidence this destroyed", and
                 // an intent payload is a whole event's worth of it.
-                await this.recordAccess(actor, 'shredSubject', { tenantId, scopeId }, { subjectId }, eventsRedacted + intentsRedacted);
+                await this.recordAccess(actor, 'shredSubject', { tenantId, scopeId }, { subjectId }, eventsRedacted + intentsRedacted + jobRunsRedacted);
                 return receipt;
             },
             // -- impersonation (K-42, #868) ----------------------------------------
@@ -3213,7 +3629,11 @@ export class CloudflareScopeHost {
                 };
             },
             recordConnectionUse: async (id, outcome) => {
-                await this.cp.recordConnectionUse(id, outcome.ok ? null : outcome.error, new Date().toISOString());
+                const row = await this.cp.recordConnectionUse(id, outcome.ok ? null : outcome.error, new Date().toISOString());
+                // #1691: the line is settled — now the data point, off the identity the DO read
+                // from the row (never the caller's input), fire-and-forget.
+                if (row)
+                    recordConnectorCall(this.connectorCalls, connectorCallRecord(row, outcome));
             },
             putConnectorState: async (id, key, value) => {
                 // JSON on the coordinator; the DO stores an opaque string, the same
@@ -3946,6 +4366,14 @@ export class CloudflareScopeHost {
                     expires_at: null,
                 }));
             }),
+            // #1706: each declared PEER's grants ride the same unit — the CP-less mirror of
+            // `provisionScope`'s peer seat, through the one function that decides it.
+            ...peerSeats(collectPeers(this.peerSources), input.scopeId).map((seat) => ({
+                subject: seat.subject,
+                relation: seat.relation,
+                object: seat.object,
+                expires_at: null,
+            })),
             // #592: the tenant's connection grants ride the same unit — the provision-time
             // mirror of `connectorGrantLocal`, so the connector return path works on every
             // install, not only the one that existed when `grantToConnection` ran.
@@ -4111,6 +4539,48 @@ export class CloudflareScopeHost {
         // plain strings become the published shape here rather than on trust.
         return systemSwitchOutcome.parse(await this.scopeStub(scopeId).switchSystemSchedules(moduleId, scopeId, to, new Date().toISOString()));
     }
+    /**
+     * The far end of the status read for a scope served HERE (#1674): `/internal/system-grants`
+     * lands on this, from the shared control plane's `systemGrantsStatus`. No admin-log join
+     * happens here — this deployment holds none — so it answers the bare per-module position
+     * only, exactly like `systemSwitchLocal` answers a bare outcome; the platform joins its
+     * own admin log onto this by moduleId once it returns.
+     */
+    async systemGrantsStatusLocal(scopeId) {
+        return systemScheduleEntry.array().parse(await this.scopeStub(scopeId).systemGrantsStatus());
+    }
+    /**
+     * The far end of the peer switch's status read (#1706): `/internal/peer-grants` lands on
+     * this, from the shared control plane's `peerGrantsStatus`. The bare per-peer position
+     * only — who switched a peer off and why is the admin log's, and this deployment holds
+     * none — so the platform joins its own log onto this by slug once it returns.
+     */
+    async peerGrantsStatusLocal(scopeId) {
+        return peerGrantsEntry.array().parse(await this.scopeStub(scopeId).peerGrantsStatus());
+    }
+    // -- the peer door's far end (#1706) ----------------------------------------
+    // The platform identified the calling deployment (the router, at the hop the caller cannot
+    // forge) and resolved THIS scope as the instance of this vertical in the caller's tenant;
+    // it reaches here over the platform-secret-gated `/internal/vertical-invoke`. What runs
+    // HERE is the half only this deployment can enforce: the peer's admission and its grants,
+    // in the scope's own DO, on every call.
+    /** Invoke ONE operation in this deployment as a PEER vertical (#1706). */
+    async verticalInvokeLocal(caller, tenantId, scopeId, operation, input, options) {
+        return (await this.getVerticalScope(caller, tenantId, scopeId)).invoke(operation, input, options);
+    }
+    /**
+     * Move one peer's kill switch on a scope served HERE (#1706) — the far end of
+     * `revokeFromPeer` / `restoreToPeer` for a hosted scope. Nothing is audited here; the
+     * platform writes the admin rows around this call, as for the schedule switch.
+     */
+    async peerSwitchLocal(scopeId, vertical, to) {
+        return peerSwitchOutcome.parse(await this.scopeStub(scopeId).switchPeer(verticalSlug.parse(vertical), scopeId, to, new Date().toISOString()));
+    }
+}
+/** SHA-256 hex of an attachment's bytes — what `AttachmentRecord.sha256` holds. */
+async function sha256Hex(body) {
+    const digest = await crypto.subtle.digest('SHA-256', body);
+    return [...new Uint8Array(digest)].map((b) => b.toString(16).padStart(2, '0')).join('');
 }
 /** A ledger row -> the wire entry, the attribution re-nested (#1054). */
 function modelUsageEntryOf(r) {