@substrat-run/adapter-cloudflare 0.125.0 → 0.127.0

package/dist/scope-do.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"scope-do.d.ts","sourceRoot":"","sources":["../src/scope-do.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAC;AACnD,OAAO,EAYL,KAAK,WAAW,EAqCjB,MAAM,yBAAyB,CAAC;AACjC,OAAO,EAmCL,KAAK,SAAS,EAmBd,KAAK,kBAAkB,EAEvB,KAAK,gBAAgB,EAoEtB,MAAM,sBAAsB,CAAC;AAiF9B;;;;;;;;;;;;;GAaG;AAEH,MAAM,WAAW,UAAU;IACzB;;;;;OAKG;IACH,aAAa,CAAC,EAAE,sBAAsB,CAAC;IACvC;;;;;;OAMG;IACH,mBAAmB,CAAC,EAAE,MAAM,CAAC;CAC9B;AAwaD;;;GAGG;AACH,MAAM,MAAM,yBAAyB,CAAC,CAAC,IAAI;IAAE,KAAK,EAAE,CAAC,CAAC;IAAC,OAAO,CAAC,EAAE,SAAS,CAAA;CAAE,GAAG;IAAE,OAAO,EAAE,WAAW,CAAA;CAAE,CAAC;AAgDxG;;;;GAIG;AACH,wBAAgB,aAAa,CAAC,GAAG,EAAE,UAAU,GAAG,SAAS,CAOxD;AAED,wBAAgB,kBAAkB,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,EAAE,CAwDxD;AAED,wBAAgB,aAAa,CAC3B,OAAO,EAAE,kBAAkB,EAAE,EAC7B,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,gBAAgB,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC,GACxD,KAAK,GAAG,EAAE,kBAAkB,EAAE,GAAG,EAAE,UAAU,KAAK,aAAa,CA86JjE"}
+{"version":3,"file":"scope-do.d.ts","sourceRoot":"","sources":["../src/scope-do.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAC;AACnD,OAAO,EAcL,KAAK,WAAW,EAqCjB,MAAM,yBAAyB,CAAC;AACjC,OAAO,EAmCL,KAAK,SAAS,EAmBd,KAAK,kBAAkB,EAEvB,KAAK,gBAAgB,EAoEtB,MAAM,sBAAsB,CAAC;AAmF9B;;;;;;;;;;;;;GAaG;AAEH,MAAM,WAAW,UAAU;IACzB;;;;;OAKG;IACH,aAAa,CAAC,EAAE,sBAAsB,CAAC;IACvC;;;;;;OAMG;IACH,mBAAmB,CAAC,EAAE,MAAM,CAAC;CAC9B;AAsbD;;;GAGG;AACH,MAAM,MAAM,yBAAyB,CAAC,CAAC,IAAI;IAAE,KAAK,EAAE,CAAC,CAAC;IAAC,OAAO,CAAC,EAAE,SAAS,CAAA;CAAE,GAAG;IAAE,OAAO,EAAE,WAAW,CAAA;CAAE,CAAC;AAgDxG;;;;GAIG;AACH,wBAAgB,aAAa,CAAC,GAAG,EAAE,UAAU,GAAG,SAAS,CAOxD;AAED,wBAAgB,kBAAkB,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,EAAE,CAwDxD;AAED,wBAAgB,aAAa,CAC3B,OAAO,EAAE,kBAAkB,EAAE,EAC7B,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,gBAAgB,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC,GACxD,KAAK,GAAG,EAAE,kBAAkB,EAAE,GAAG,EAAE,UAAU,KAAK,aAAa,CAs7JjE"}

package/dist/scope-do.js

@@ -1,12 +1,13 @@
 import { REWIND_REFUSED } from './rewind-refusal.js';
 import { DurableObject } from 'cloudflare:workers';
-import { ATTACHMENT_ADDED, ATTACHMENT_REMOVED, attachmentRecord, domainEvent, domainEventInput, eventId, instant, objectRef, entityObjectRef, toWireFailure, grantRefFromProof, principalId, scopeId as scopeIdOf, tenantId as tenantIdOf, platformRequestInput, platformRequestId, MAX_PENDING_PLATFORM_REQUESTS, MAX_PENDING_SWEEP_RUNS, SWEEP_RUNS_KIND, SCOPE_TABLE_PAGE_MAX, SCOPE_QUERY_ROW_MAX, listLimitOf, requestFingerprint, substratError, assertReplayableDump, REDRAIN_BATCH, } from '@substrat-run/contracts';
+import { ATTACHMENT_ADDED, ATTACHMENT_REMOVED, attachmentRecord, domainEvent, domainEventInput, eventId, instant, objectRef, entityObjectRef, assertModuleEmittableType, assertKernelAuthoredType, toWireFailure, grantRefFromProof, principalId, scopeId as scopeIdOf, tenantId as tenantIdOf, platformRequestInput, platformRequestId, MAX_PENDING_PLATFORM_REQUESTS, MAX_PENDING_SWEEP_RUNS, SWEEP_RUNS_KIND, SCOPE_TABLE_PAGE_MAX, SCOPE_QUERY_ROW_MAX, listLimitOf, requestFingerprint, substratError, assertReplayableDump, REDRAIN_BATCH, } from '@substrat-run/contracts';
 import { ulid, DO_SQL_LIMITS, createUlid, assertAllowed, ConnectionSealingKeyUnavailableError, noSealingKeyMessage, sealTo, assertReadOnlyQuery, entitlementDenial, platformRequestHistoryQuery, platformRequestOf, PLATFORM_REQUEST_COLUMNS, PLATFORM_REQUEST_REDACTION_SQL, platformRequestRedactionParams, platformRequestRedactionQuery, intentPayloadCarriesSubject, redactSubjectJobRuns, JOB_RUN_PATCH_SQL, JOB_STEP_RECORD_SQL, DELIVERY_ERROR_REDACTION_SQL, REDACTED_DELIVERY_NOTE, seatScopeTuple, effectiveRoleGrantQuery, switchRecordedOff, switchSystemSchedules, peerGrantsStatus, systemGrantsStatus, systemScheduleState, systemSwitchedOff, denialListQuery, denialSummaryQuery, denialTotalsQuery, DENIAL_WINDOW_QUERY, mapDenialRow, mapDenialSummaryBuckets, PermissionDenied, assertImpersonationWrites, assertModuleEnqueueableKind, impersonationStampOf, createAtomic, NotSearchable, isSearchIndexTable, searchIndexDdl, searchIndexPlans, NotListable, listIndexPlans, moduleMigrations, listQuery, cursorOf, searchLimit, searchMatchExpression, searchQuery, IDEMPOTENCY_DDL, assertIdempotencyKey, assertPermissionKey, idempotencyLookupQuery, idempotencyPruneStatement, idempotencyRecordStatement, idempotencyOptedOutMessage, replayFor, entityVersionQuery, entityVersionOf, assertIfMatch, OUTBOX_ENTITY_INDEX, SCHEDULE_STATE_DDL, SCHEDULE_STATE_REBUILD, scheduleStateHasKind, VERTICAL_EVENTS_DDL, EXPORT_HOPS_SQL, IMPORT_CURSORS_SQL, IMPORT_CURSOR_OF_SQL, OUTBOX_MARK_SQL, exportedSinceQuery, emittedSinceQuery, emittedReportOf, EMITTED_REPORT_CAP, IMPORT_CURSOR_ADVANCE_SQL, IMPORT_RECORD_SQL, moveImportCursor, CrossVerticalRegistry, exportReadPlan, exportReadQuery, planExportBatch, withheldNote, JOB_RUN_DDL, jobRunListLimit, } from '@substrat-run/kernel';
 import { isUpgradeRequest, readSubscription, LIVE_FANOUT_LIMIT, LIVE_MODE_HEADER, LIVE_PRINCIPAL_HEADER, LIVE_SCOPE_HEADER, LIVE_SUBSCRIBE_PATH, LIVE_TENANT_HEADER, } from './live-reads.js';
 import { OperationQueue } from './serialization.js';
 import { doScopedSql, doSpineSql } from './sql.js';
-import { actorOf, admitPeer, collectPeers, switchPeer, assertNoSecret, CAPABILITY_DDL, CAPABILITY_EXCHANGE_OPERATION, capabilityAttachmentWriteRefused, createCapabilityVerbs, exchangeCapability, guardSecrets, mintBecomeCapability, redactSecrets, redactSecretText, moduleLog, resolveCapabilitySession, revokeCapabilityAsPlatform, domainEventOf, facetEvents, readDeadLetters, readHistory, readInvocation, readUndrainedOutbox, walkEventCause, walkEventEffects, } from '@substrat-run/kernel';
+import { actorOf, admitPeer, collectPeers, switchPeer, assertNoSecret, CAPABILITY_DDL, CAPABILITY_EXCHANGE_OPERATION, capabilityAttachmentWriteRefused, createCapabilityVerbs, createEntityEdgeVerbs, exchangeCapability, guardSecrets, mintBecomeCapability, redactSecrets, redactSecretText, moduleLog, resolveCapabilitySession, revokeCapabilityAsPlatform, domainEventOf, facetEvents, readDeadLetters, readHistory, readInvocation, readUndrainedOutbox, walkEventCause, walkEventEffects, } from '@substrat-run/kernel';
 import { createDoTupleChecker, createLocalControlPlaneReader } from './checker.js';
+import { repointScopeGrants } from '@substrat-run/kernel';
 /**
  * The key marking a scope DO whose storage was destroyed (`destroyStorage`).
  * Written after `deleteAll()` so it survives the wipe, and never cleared: `reaped`
@@ -341,6 +342,19 @@ const KERNEL_DDL = `
  * In-process — the SQLite adapter, a handler in the same isolate — the real class
  * arrives and `errorCodeOf` reads it directly.
  */
+/**
+ * #1864: the kernel's own events (attachments, capability exchanges) written through the
+ * context an operation runs in, WITHOUT `ctx.emit`'s refusal of kernel-authored types. Keyed
+ * by the context object and never exported, so module code — which can reach `ctx` but not
+ * this map — cannot write one. Registered as each context is built.
+ */
+const kernelEmitters = new WeakMap();
+function kernelEmit(ctx, event) {
+    const write = kernelEmitters.get(ctx);
+    if (!write)
+        throw new Error('kernelEmit: not an operation context this host built');
+    write(event);
+}
 function toRpcError(err) {
     if (err instanceof Error) {
         return err.constructor === Error ? err : new Error(err.message);
@@ -1245,16 +1259,17 @@ export function defineScopeDO(modules, bareOps) {
                 // BOTH stores, because a scope check consults both: rule 2 inheritance makes a
                 // tenant-level grant enforceable here exactly as a scope-level one is, and the
                 // projected `_substrat_tenant_tuples` is where this DO holds them. A read-back
-                // that disagreed with enforcement would be worse than none.
+                // that disagreed with enforcement would be worse than none. GLOB, not LIKE (#1869):
+                // case-sensitive, as the checker's match is.
                 const rows = [
                     ...this.sql
                         .exec(`SELECT subject, relation, expires_at FROM _substrat_tuples
-               WHERE subject LIKE 'connection:%' AND relation LIKE 'granted:%'
+               WHERE subject GLOB 'connection:*' AND relation GLOB 'granted:*'
                  AND revoked_at IS NULL AND (expires_at IS NULL OR expires_at > ?)`, now)
                         .toArray(),
                     ...this.sql
                         .exec(`SELECT subject, relation, expires_at FROM _substrat_tenant_tuples
-               WHERE subject LIKE 'connection:%' AND relation LIKE 'granted:%'
+               WHERE subject GLOB 'connection:*' AND relation GLOB 'granted:*'
                  AND revoked_at IS NULL AND (expires_at IS NULL OR expires_at > ?)`, now)
                         .toArray(),
                 ];
@@ -2089,7 +2104,7 @@ export function defineScopeDO(modules, bareOps) {
                  (id, entity_type, entity_id, filename, content_type, size, sha256,
                   visibility, created_by, created_at)
                VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`, parsed.id, parsed.entity.entityType, parsed.entity.entityId, parsed.filename, parsed.contentType, parsed.size, parsed.sha256, parsed.visibility, parsed.createdBy, parsed.createdAt);
-                        ctx.emit({
+                        kernelEmit(ctx, {
                             type: ATTACHMENT_ADDED,
                             schemaVersion: 1,
                             entity: parsed.entity,
@@ -2185,7 +2200,7 @@ export function defineScopeDO(modules, bareOps) {
                         const ctx = this.operationContext(principal, tenantId, scopeId, undefined, connectionId, undefined, undefined, undefined, 'attachments.remove');
                         assertAllowed(await ctx.check(gate.write, record.entity));
                         this.sql.exec('DELETE FROM _substrat_attachments WHERE id = ?', attachmentId);
-                        ctx.emit({
+                        kernelEmit(ctx, {
                             type: ATTACHMENT_REMOVED,
                             schemaVersion: 1,
                             entity: record.entity,
@@ -2592,7 +2607,7 @@ export function defineScopeDO(modules, bareOps) {
                         // Stamped `{ capability }` by the ordinary emit path, under the exchange's own
                         // pseudo-operation name — the actor is the capability, as on every event it
                         // goes on to cause.
-                        emit: (capability, event) => this.operationContext(principalId.parse(ulid()), tenantId, scopeId, undefined, undefined, undefined, undefined, undefined, CAPABILITY_EXCHANGE_OPERATION, capability, [], now).emit(event),
+                        emit: (capability, event) => kernelEmit(this.operationContext(principalId.parse(ulid()), tenantId, scopeId, undefined, undefined, undefined, undefined, undefined, CAPABILITY_EXCHANGE_OPERATION, capability, [], now), event),
                     }, secret, mode);
                 });
                 if (outcome)
@@ -3404,11 +3419,7 @@ export function defineScopeDO(modules, bareOps) {
                     this.sql.exec(stmt);
             });
         }
-        async importDump(tables, destScopeId, 
-        /** The directory's recorded-off modules (#1742), switched off on `destScopeId` right after
-         *  the replay re-points the grants, in the same event: a dump from before the switch was
-         *  pulled carries the grants live and no marker. Needs `destScopeId`, the scope restored. */
-        switchOff) {
+        async importDump(tables, destScopeId, { switchOff, sourceScopeId, exact, } = {}) {
             // The WHOLE drop-then-replay runs under deferred foreign keys, in one transaction.
             //
             // Two distinct FK hazards, and both need the deferral — the second is why it cannot
@@ -3437,6 +3448,10 @@ export function defineScopeDO(modules, bareOps) {
             // only the first statement, so the text itself has to be the one statement.
             // Pure input validation, so it runs before the first DROP: a refused dump touches nothing.
             assertReplayableDump(replayable, { maxColumns: DO_SQL_LIMITS.columns });
+            // #1869: `exact` vouches for a named source; without one it would silently fall back.
+            if (exact && !sourceScopeId) {
+                throw substratError('validation_failed', 'restore refused: `exact` needs the scope the dump came from');
+            }
             const switched = await this.ctx.storage.transaction(async () => {
                 this.sql.exec('PRAGMA defer_foreign_keys = ON');
                 // Real tables only; `sqlite_*` internals are auto-managed and un-droppable.
@@ -3487,7 +3502,7 @@ export function defineScopeDO(modules, bareOps) {
                 // Re-point the restored grants at THIS scope (after the spine exists, so a dump
                 // that carried no tuples table still finds one here).
                 if (destScopeId)
-                    this.rewriteScopeTuples(destScopeId);
+                    this.rewriteScopeTuples(destScopeId, sourceScopeId && { scopeId: sourceScopeId, exact });
                 // #1742: the recorded-off modules go back off INSIDE the replay's transaction, with
                 // the spine and the re-point. A switch that throws rolls the whole restore back, so
                 // the dump's grants never commit live without the switch that should cover them.
@@ -3557,14 +3572,14 @@ export function defineScopeDO(modules, bareOps) {
          * `_substrat_tenant_tuples`, which this does not attempt — a cross-tenant restore is a
          * governed copy, not a repair.
          *
+         * Which rows move is `repointScopeGrants`'s (#1869): the dump's source scope, exactly.
+         *
          * `UPDATE OR REPLACE` because (subject, relation, object) is the primary key: if the
          * dump already held a tuple for the destination scope, the rewritten row collapses
          * onto it instead of failing the whole restore.
          */
-        rewriteScopeTuples(destScopeId) {
-            this.sql.exec(`UPDATE OR REPLACE _substrat_tuples
-            SET object = ?
-          WHERE object LIKE 'scope:%' AND object <> ?`, `scope:${destScopeId}`, `scope:${destScopeId}`);
+        rewriteScopeTuples(destScopeId, source) {
+            repointScopeGrants(this.switchSql(), destScopeId, source);
         }
         /**
          * Wipe this scope's storage — the reap half of deleteSnapshot (preview-and-
@@ -3936,6 +3951,51 @@ export function defineScopeDO(modules, bareOps) {
                 }
                 return checker.covers(subject, role.permissions, { tenantId, scopeId });
             };
+            // ctx.emit's writer, and the kernel's own events' (#1864): one path to the outbox, with the
+            // reserved-type refusal applied to module code only. Never handed to module code as-is.
+            const writeEvent = (event, author) => {
+                assertImpersonationWrites(impersonation, 'ctx.emit');
+                const parsed = domainEventInput.parse(event);
+                // #1864: a kernel-authored type is the kernel's to write — module code cannot forge one.
+                if (author === 'module')
+                    assertModuleEmittableType(parsed.type);
+                else
+                    assertKernelAuthoredType(parsed.type); // a new kernel event must join the reserved set
+                // #1672: the COMPLETE parsed event — entity id, type and subject as well as payload.
+                assertNoSecret('ctx.emit', parsed, minted);
+                const full = domainEvent.parse({
+                    ...parsed,
+                    // #956: from the operation's instant, not a second reading of the clock.
+                    // `ORDER BY id` is how the outbox and every timeline page, so an id whose
+                    // timestamp disagreed with its own `occurredAt` sorted the log by a clock
+                    // nothing else in the operation used.
+                    id: eventId.parse(mintEventId(Date.parse(at))),
+                    occurredAt: at,
+                    tenantId,
+                    scopeId,
+                    actor: systemActor ?? derivedActor,
+                    ...(passed.length ? { authorization: passed.map((p) => ({ ...p })) } : {}),
+                    ...(stamp ? { impersonation: stamp } : {}),
+                    // #1231: kernel-stamped like the two above — `domainEventInput.parse`
+                    // already stripped anything module code tried to smuggle under this key.
+                    ...(operation ? { operation } : {}),
+                });
+                sql.exec(`INSERT INTO _substrat_outbox
+             (id, type, schema_version, occurred_at, tenant_id, scope_id, actor,
+              entity_type, entity_id, pii_class, subject_id, authorization,
+              impersonation, operation, version, caused_by, invocation_id, payload)
+           VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`, full.id, full.type, full.schemaVersion, full.occurredAt, full.tenantId, full.scopeId, JSON.stringify(full.actor), full.entity.entityType, full.entity.entityId, full.piiClass, full.subjectId ?? null, full.authorization ? JSON.stringify(full.authorization) : null, full.impersonation ? JSON.stringify(full.impersonation) : null, full.operation ?? null, 
+                // #1242: script configuration, not envelope data — the version is a fact
+                // about the deploy, so it never rides `DomainEvent` for module code to
+                // branch on; it exists for the observability joins the column serves.
+                this.env.SUBSTRAT_VERSION_ID ?? null, 
+                // #1237: whatever delivery is in flight, if any — read off the DO the same
+                // way the version is read off its env. A fact about the surrounding
+                // dispatch, never envelope data module code could set or branch on.
+                this.causedBy, 
+                // #1237: a fact about the surrounding CALL, like the version above.
+                this.invocationId, full.payload === undefined ? null : JSON.stringify(full.payload));
+            };
             const ctxRef = {
                 tenantId,
                 scopeId,
@@ -3957,44 +4017,7 @@ export function defineScopeDO(modules, bareOps) {
                     // log's text is not JSON.
                     redact: (text) => redactSecretText(text, minted),
                 }),
-                emit: (event) => {
-                    assertImpersonationWrites(impersonation, 'ctx.emit');
-                    const parsed = domainEventInput.parse(event);
-                    // #1672: the COMPLETE parsed event — entity id, type and subject as well as payload.
-                    assertNoSecret('ctx.emit', parsed, minted);
-                    const full = domainEvent.parse({
-                        ...parsed,
-                        // #956: from the operation's instant, not a second reading of the clock.
-                        // `ORDER BY id` is how the outbox and every timeline page, so an id whose
-                        // timestamp disagreed with its own `occurredAt` sorted the log by a clock
-                        // nothing else in the operation used.
-                        id: eventId.parse(mintEventId(Date.parse(at))),
-                        occurredAt: at,
-                        tenantId,
-                        scopeId,
-                        actor: systemActor ?? derivedActor,
-                        ...(passed.length ? { authorization: passed.map((p) => ({ ...p })) } : {}),
-                        ...(stamp ? { impersonation: stamp } : {}),
-                        // #1231: kernel-stamped like the two above — `domainEventInput.parse`
-                        // already stripped anything module code tried to smuggle under this key.
-                        ...(operation ? { operation } : {}),
-                    });
-                    sql.exec(`INSERT INTO _substrat_outbox
-               (id, type, schema_version, occurred_at, tenant_id, scope_id, actor,
-                entity_type, entity_id, pii_class, subject_id, authorization,
-                impersonation, operation, version, caused_by, invocation_id, payload)
-             VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`, full.id, full.type, full.schemaVersion, full.occurredAt, full.tenantId, full.scopeId, JSON.stringify(full.actor), full.entity.entityType, full.entity.entityId, full.piiClass, full.subjectId ?? null, full.authorization ? JSON.stringify(full.authorization) : null, full.impersonation ? JSON.stringify(full.impersonation) : null, full.operation ?? null, 
-                    // #1242: script configuration, not envelope data — the version is a fact
-                    // about the deploy, so it never rides `DomainEvent` for module code to
-                    // branch on; it exists for the observability joins the column serves.
-                    this.env.SUBSTRAT_VERSION_ID ?? null, 
-                    // #1237: whatever delivery is in flight, if any — read off the DO the same
-                    // way the version is read off its env. A fact about the surrounding
-                    // dispatch, never envelope data module code could set or branch on.
-                    this.causedBy, 
-                    // #1237: a fact about the surrounding CALL, like the version above.
-                    this.invocationId, full.payload === undefined ? null : JSON.stringify(full.payload));
-                },
+                emit: (event) => writeEvent(event, 'module'),
                 requestPlatform: (request) => {
                     assertImpersonationWrites(impersonation, 'ctx.requestPlatform');
                     const input = platformRequestInput.parse(request);
@@ -4122,23 +4145,19 @@ export function defineScopeDO(modules, bareOps) {
                     subject: systemActor ? { kind: 'system', id: systemActor.system } : subject,
                     now: at,
                     check: runCheck,
-                    emit: (event) => ctxRef.emit(event),
+                    emit: (event) => writeEvent(event, 'kernel'),
                     isOperation: (name) => this.operations.has(name),
                     assertWrites: (verb) => assertImpersonationWrites(impersonation, verb),
                     minted,
                 }),
-                link: (child, parent) => {
-                    assertImpersonationWrites(impersonation, 'ctx.link');
-                    entityObjectRef(child, 'ctx.link'); // #1856: an edge the walk can read back
-                    entityObjectRef(parent, 'ctx.link');
-                    const allowed = relations.get(child.entityType);
-                    if (!allowed?.has(parent.entityType)) {
-                        throw new Error(`undeclared entity relation: ${child.entityType} → ${parent.entityType} ` +
-                            `(declare it in a module manifest's entityRelations)`);
-                    }
-                    sql.exec(`INSERT OR IGNORE INTO _substrat_tuples (subject, relation, object)
-             VALUES (?, 'parent', ?)`, `${child.entityType}:${child.entityId}`, `${parent.entityType}:${parent.entityId}`);
-                },
+                // K-16 / #1864: link and relink, written once in the kernel over the raw spine seam.
+                ...createEntityEdgeVerbs({
+                    sql: doSpineSql(sql),
+                    relations,
+                    now: at,
+                    emit: (event) => writeEvent(event, 'kernel'),
+                    assertWrites: (verb) => assertImpersonationWrites(impersonation, verb),
+                }),
                 entitlement: async (key) => {
                     const held = await entitlementReader().listEntitlements(tenantId);
                     return held.find((e) => e.key === key) ?? null;
@@ -4162,6 +4181,7 @@ export function defineScopeDO(modules, bareOps) {
                     return sealTo({ keyId: row.key_id, publicKey: row.public_key }, plaintext);
                 },
             };
+            kernelEmitters.set(ctxRef, (event) => writeEvent(event, 'kernel'));
             return ctxRef;
         }
         /** True once this scope has had entitlements projected at least once (#304) — the switch