@substrat-run/adapter-cloudflare 0.138.0 → 0.140.0

package/dist/host.js

@@ -1,11 +1,11 @@
 import { env as ambientEnv } from 'cloudflare:workers';
 import { isRewindRefusal, REWIND_REFUSED } from './rewind-refusal.js';
 import { isSystemDoorMoved, SYSTEM_DOOR_MOVED, SYSTEM_DOOR_REGATES } from './system-door.js';
-import { delegatedReadParams, operationSeriesCount, fromWireFailure, exportReadInput, exportedBatch, importBatch, importResult, importState, importsOfManifestJson, exportsOfManifestJson, importCursorMove, importCursorMoveAt, importCursorMoved, accessLogEntry, adminLogEntry, opsFailureEntry, opsFailureFingerprint, issueEntry, sweepRunEntry, FRESHNESS_HEARTBEAT_MINUTES, sweepRunsPayload, modelUsageEntry, attachmentRecord, createTenantInput, identityLink, identityPool, createOrgInput, promotionAcknowledgement, bindAcknowledgement, bindHostnameInput, channelHistoryEntry, hostnameBinding, publishVersionInput, AUTO_ADMISSION_NOTE, registerVerticalInput, vertical as verticalSchema, verticalServingState, verticalChannel, verticalVersion, connection, capabilityExchange, mintedCapability, capabilityGrant, principalId, connectionGrant, connectionGrantRecord, connectionSecret, systemGrant, systemSwitch, systemSwitchOutcome, systemScheduleEntry, systemSwitchRecord, entitlementGrant, entitlementGrantInput, capabilityFilter, instant, meterReading, subjectRef, createConnectionInput, projectedConnectionGrant, projectedConnectionKey, moduleManifest, org as orgSchema, orgMembership, resolvedIdentity, identityMembership, roleDefinition, scope as scopeSchema, tenant as tenantSchema, tenantRole, delegatedReadRecord, ownerTransferAudit, copyMarkAudit, subjectShredReceipt, connectorDispatchKind, callsOfManifestJson, outboundOfManifestJson, SCOPE_GATE_REASONS, substratError, redrainEventsInput, coverage, peerCoverage, peerGrantsEntry, peerSwitch, peerSwitchOutcome, verticalCaller, verticalResolution, verticalSlug, entityObjectRef, ATTACHMENT_BLOB_BINDING, blobStoreBindingName, lifecycleDelivery, scopeLifecycle, } from '@substrat-run/contracts';
+import { delegatedReadParams, operationSeriesCount, fromWireFailure, exportReadInput, exportedBatch, importBatch, importResult, importState, importsOfManifestJson, exportsOfManifestJson, importCursorMove, importCursorMoveAt, importCursorMoved, accessLogEntry, adminLogEntry, opsFailureEntry, opsFailureFingerprint, issueEntry, findingEntry, findingRuleEntry, sweepRunEntry, FRESHNESS_HEARTBEAT_MINUTES, sweepRunsPayload, modelUsageEntry, attachmentRecord, createTenantInput, identityLink, identityPool, createOrgInput, promotionAcknowledgement, bindAcknowledgement, bindHostnameInput, channelHistoryEntry, hostnameBinding, publishVersionInput, AUTO_ADMISSION_NOTE, registerVerticalInput, vertical as verticalSchema, verticalServingState, verticalChannel, verticalVersion, connection, capabilityExchange, mintedCapability, capabilityGrant, principalId, connectionGrant, connectionGrantRecord, connectionSecret, systemGrant, systemSwitch, systemSwitchOutcome, systemScheduleEntry, systemSwitchRecord, entitlementGrant, entitlementGrantInput, capabilityFilter, instant, meterReading, subjectRef, createConnectionInput, connectLinkFilter, connectLinkKey, consumeConnectLinkInput, mintConnectLinkInput, projectedConnectionGrant, projectedConnectionKey, moduleManifest, org as orgSchema, orgMembership, resolvedIdentity, identityMembership, roleDefinition, scope as scopeSchema, tenant as tenantSchema, tenantRole, delegatedReadRecord, ownerTransferAudit, memberChangeAudit, peerBindingAudit, copyMarkAudit, subjectShredReceipt, connectorDispatchKind, callsOfManifestJson, outboundOfManifestJson, SCOPE_GATE_REASONS, substratError, redrainEventsInput, coverage, peerCoverage, peerGrantsEntry, peerSwitch, peerSwitchOutcome, verticalCaller, verticalResolution, peerInstanceResolution, peerBinding as peerBindingSchema, verticalSlug, entityObjectRef, ATTACHMENT_BLOB_BINDING, blobStoreBindingName, lifecycleDelivery, scopeLifecycle, } from '@substrat-run/contracts';
 import { normalizeHostname, toRouteTarget } from './route-resolver.js';
-import { attachmentBlobKey, attachmentSha256, entitlementDenial, requiredEntitlementFor, foldMeterReading, parseValidationRecords, resolveScopeRecord, ulid, KEPT_COPY_REFUSAL, capabilityTokenHash, checkBecomeInput, plausibleSessionToken, foldModelUsage, backoffAt, resolveRetryPolicy, executorOutcomeOf, isDeliveryRefusal, refusalJournalText, isSecretBoxConfigured, unconfiguredSecretBox, createSubjectKeys, generateSealingKeyPair, openSealed, ImpersonationRefused, assertSessionUsable, impersonationRowValues, mapImpersonationRow, newImpersonationSession, jobRunOf, assertLeaseMs, runDueJobRuns, SYSTEM_DOOR_WAIT, startJobRun, attachmentTextJob, assertAttachmentExtractors, assertJobRegistrable, isAttachmentTextRun, searchLimit, searchMatchExpression, globalFetch, assertRedrainWindow, platformRequestOf, undrainedEventsOf, inUnitMovesToAudit, staleCarryRevertRow, staleCarryReverts, recordedOffFromWire, peerSubjectRef, SWITCH_KINDS, reassertActionOf, reassertEntry, reassertOffRow, reassertOnRow, switchActionOf, switchAuditSubject, switchNotFoundMessage, recordWriteSuperseded, switchSubjectOf, switchSupersededMessage, withRecorded, systemSwitchedOffMessage, tenantSystemSwitchedOffMessage, CrossVerticalRegistry, importCursorSourceOf, exportBreaksOf, exportBreakRefusal, bindExportBreaksOf, bindExportBreakRefusal, collectPeers, peerSeats, connectorCallRecord, noopConnectorCallRecorder, recordConnectorCall, settleConnectionUse, splitManifestMigrations, unknownRoleError, assertRowLimit, assertRowOffset, emptyImportResult, INERT_SCOPE_REASON, lifecycleReceipt, lifecycleRefusal, isPrimaryScope, isPrimaryScopeRow, asyncInvocationId, asyncLinePass, } from '@substrat-run/kernel';
-import { attributedHost } from '@substrat-run/kernel';
-import { isOrangeToOrange, isUpgradeRequest, LIVE_MODE_HEADER, LIVE_PRINCIPAL_HEADER, LIVE_SCOPE_HEADER, LIVE_SUBSCRIBE_PATH, LIVE_TENANT_HEADER, LIVE_WITHIN_HEADER, encodeLiveWithin, liveWithinOf, } from './live-reads.js';
+import { attachmentBlobKey, attachmentSha256, entitlementDenial, requiredEntitlementFor, foldMeterReading, parseValidationRecords, resolveScopeRecord, ulid, KEPT_COPY_REFUSAL, capabilityTokenHash, checkBecomeInput, plausibleSessionToken, foldModelUsage, backoffAt, resolveRetryPolicy, executorOutcomeOf, isDeliveryRefusal, refusalJournalText, isSecretBoxConfigured, unconfiguredSecretBox, createSubjectKeys, generateSealingKeyPair, openSealed, ImpersonationRefused, assertSessionUsable, impersonationRowValues, mapImpersonationRow, newImpersonationSession, jobRunOf, assertLeaseMs, runDueJobRuns, SYSTEM_DOOR_WAIT, startJobRun, attachmentTextJob, assertAttachmentExtractors, resolveAttachmentTextBounds, assertJobRegistrable, ATTACHMENT_TEXT_BACKFILL_JOB, ATTACHMENT_TEXT_JOB, kernelJobFor, attachmentTextBackfillJob, searchLimit, searchMatchExpression, globalFetch, assertRedrainWindow, platformRequestOf, undrainedEventsOf, inUnitMovesToAudit, staleCarryRevertRow, staleCarryReverts, recordedOffFromWire, peerSubjectRef, SWITCH_KINDS, reassertActionOf, reassertEntry, reassertOffRow, reassertOnRow, switchActionOf, switchAuditSubject, recordAuditOutcome, auditWarningOf, switchNotFoundMessage, recordWriteSuperseded, switchSubjectOf, switchSupersededMessage, withRecorded, systemSwitchedOffMessage, tenantSystemSwitchedOffMessage, CrossVerticalRegistry, importCursorSourceOf, exportBreaksOf, exportBreakRefusal, bindExportBreaksOf, bindExportBreakRefusal, collectPeers, peerSeats, connectorCallRecord, noopConnectorCallRecorder, recordConnectorCall, settleConnectionUse, splitManifestMigrations, unknownRoleError, assertRowLimit, assertRowOffset, emptyImportResult, INERT_SCOPE_REASON, lifecycleReceipt, lifecycleRefusal, isPrimaryScope, isPrimaryScopeRow, asyncInvocationId, asyncLinePass, assertNoCallerPurge, purgeReportOf, purgeStillDue, registerTrashTargets, memberAddedAudit, shapeTopUpBatch, } from '@substrat-run/kernel';
+import { attributedView, isModuleErasureCounts, moduleErasurePlan, moduleRowsErased } from '@substrat-run/kernel';
+import { isOrangeToOrange, isUpgradeRequest, LIVE_MODE_HEADER, LIVE_PRINCIPAL_HEADER, LIVE_SCOPE_HEADER, LIVE_SUBSCRIBE_PATH, LIVE_TENANT_HEADER, LIVE_WITHIN_HEADER, LIVE_EXPIRES_HEADER, liveInstant, encodeLiveWithin, liveWithinOf, } from './live-reads.js';
 import { tenantStoreDatabaseName } from './d1.js';
 import { blobStoreBucketName, r2TenantBlobStore } from './r2.js';
 import { unwrapReply } from './do-reply.js';
@@ -275,6 +275,7 @@ export class CloudflareScopeHost {
     attachmentBuckets;
     /** The parsers attachment text is extracted with (K-43); the host's own, never imported here. */
     attachmentExtractors;
+    attachmentTextBounds;
     executors = new Map();
     /**
      * `<moduleId>/<job>` → the pass body and its default step policy (#1577). Host
@@ -285,10 +286,10 @@ export class CloudflareScopeHost {
      */
     jobs = new Map();
     /**
-     * The event currently being effected, stamped onto admin rows the executor writes.
-     * Ambient rather than threaded through every HostAdmin signature: set and cleared
-     * around one await, with executors running sequentially, so there is no window
-     * where it belongs to a different event.
+     * The event an executor is effecting, stamped onto the admin rows it writes (K-22). Like
+     * `onBehalfOf`, only ever set on a VIEW (`causedByView`, or `attributed` with a
+     * `causedBy`), never on the host: a field set around the handler's `await` stamped every
+     * admin call the host served meanwhile — a staff call included — with that event (#2055).
      */
     causedBy = null;
     /**
@@ -342,6 +343,7 @@ export class CloudflareScopeHost {
         this.attachmentBuckets = options.attachmentBuckets ?? ambientAttachmentBucket;
         assertAttachmentExtractors(options.attachmentExtractors ?? []);
         this.attachmentExtractors = options.attachmentExtractors ?? [];
+        this.attachmentTextBounds = resolveAttachmentTextBounds(options.attachmentTextBounds);
         this.fetchImpl = options.fetch ?? globalFetch;
         this.connectorCalls = options.connectorCalls ?? noopConnectorCallRecorder;
         this.scopeLocalPermissions = options.scopeLocalPermissions ?? false;
@@ -571,7 +573,8 @@ export class CloudflareScopeHost {
                     lines.write({ ...unitOf(event.id, attempt), startedAt, outcome: 'inert' });
                     continue;
                 }
-                this.causedBy = event.id;
+                // #2055: the handler writes through a view bound to its event, never through the host.
+                const caused = this.causedByView(event.id);
                 try {
                     if (executor.kind === 'connector' && this.cpLess) {
                         // #574 phase 3: this host cannot run a connector — no connection
@@ -589,14 +592,14 @@ export class CloudflareScopeHost {
                         lines.write({ ...unitOf(event.id, 1), startedAt, outcome: 'routed' });
                     }
                     else if (executor.kind === 'connector') {
-                        await executor.handler(await this.connectorContext(tenantId, scopeId, executor.timeoutMs, event.id), event);
+                        await executor.handler(await caused.connectorContext(tenantId, scopeId, executor.timeoutMs, event.id), event);
                         const attempt = await stub.recordExecutorAttempt(event.id, deliveryId, null, null, invocationId);
                         report.delivered += 1;
                         outcomeOf(event, 'delivered');
                         lines.write({ ...unitOf(event.id, attempt), startedAt, outcome: 'delivered' });
                     }
                     else {
-                        const result = await executor.handler(this.admin, event, scope);
+                        const result = await executor.handler(caused.admin, event, scope);
                         // #1184: a refusal is the handler's own terminal decision — journaled with its
                         // reason, no next attempt, listed by `executorDeadLetters` beside an exhausted one.
                         const refused = isDeliveryRefusal(result) ? result : null;
@@ -634,9 +637,6 @@ export class CloudflareScopeHost {
                         error: err,
                     });
                 }
-                finally {
-                    this.causedBy = null;
-                }
             }
         }
     }
@@ -701,7 +701,7 @@ export class CloudflareScopeHost {
             write: (attachmentId, outcome) => stub.attachmentTextRecord(attachmentId, outcome),
         }, 
         // K-43: the host's parsers, handed in — this adapter imports none.
-        this.attachmentExtractors);
+        this.attachmentExtractors, this.attachmentTextBounds);
     }
     async startJobRun(tenantId, scopeId, input) {
         await this.assertLive(tenantId, scopeId);
@@ -713,12 +713,18 @@ export class CloudflareScopeHost {
         // advance, and an archived one's never move again.
         await this.assertLive(tenantId, scopeId);
         await this.migrateAndRecord(scopeId);
-        // #1575: the kernel's extraction job is this host's own, bound to this scope — no
-        // deployment registers it, and none can shadow it.
-        const attachmentText = { handler: this.attachmentTextHandler(tenantId, scopeId) };
+        // #1575: the kernel's extraction jobs are this host's own, bound to this scope — no
+        // deployment registers them, and none can shadow them. The backfill starts here, on
+        // the drive, so a scope's first request never pays for attachments that predate it.
+        const stub = this.scopeStub(scopeId);
+        await stub.attachmentTextBackfillStart();
+        const kernelJobs = {
+            [ATTACHMENT_TEXT_JOB]: this.attachmentTextHandler(tenantId, scopeId),
+            [ATTACHMENT_TEXT_BACKFILL_JOB]: attachmentTextBackfillJob({ queueBatch: (after) => stub.attachmentTextBackfillBatch(after) }),
+        };
         return runDueJobRuns({
             store: this.jobStore(scopeId),
-            handlerFor: (run) => isAttachmentTextRun(run) ? attachmentText : this.jobs.get(`${run.module_id}/${run.job}`),
+            handlerFor: (run) => kernelJobFor(run, kernelJobs) ?? this.jobs.get(`${run.module_id}/${run.job}`),
             now: () => new Date().toISOString(),
             // #1834: the door is opened FOR this pass, so its "not now" is tied to this pass alone.
             openScope: async (run, pass) => this.buildStub(tenantId, scopeId, undefined, undefined, await this.openSystemDoor(run.module_id, tenantId, scopeId, undefined, pass)),
@@ -740,13 +746,9 @@ export class CloudflareScopeHost {
         // ran it. On a CP-less host `connectorContext` throws from the null control plane:
         // fail closed, exactly the hole routing exists to avoid.
         await this.assertLive(tenantId, scopeId);
-        this.causedBy = event.id;
-        try {
-            await handler(await this.connectorContext(tenantId, scopeId, options?.timeoutMs ?? 30_000, event.id), event);
-        }
-        finally {
-            this.causedBy = null;
-        }
+        // Built on a view bound to the event, so its admin rows carry it and nothing else the
+        // host serves does (#2055).
+        await handler(await this.causedByView(event.id).connectorContext(tenantId, scopeId, options?.timeoutMs ?? 30_000, event.id), event);
     }
     async executorDeadLetters(tenantId, scopeId) {
         await this.validateScopeAccess(tenantId, scopeId);
@@ -775,6 +777,12 @@ export class CloudflareScopeHost {
     async settlePlatformRequest(tenantId, scopeId, id, outcome) {
         await this.validateScopeAccess(tenantId, scopeId);
         await this.migrateAndRecord(scopeId);
+        // #2102: an outcome event travels by the verb that writes it; every other settle keeps the
+        // positional one, so it still reaches a DO class that predates the event.
+        if (outcome.event) {
+            await this.scopeStub(scopeId).settlePlatformRequestWithEvent(tenantId, scopeId, id, outcome);
+            return;
+        }
         await this.scopeStub(scopeId).settlePlatformRequest(id, outcome.status, outcome.result === undefined ? null : JSON.stringify(outcome.result), outcome.lastError ?? null, outcome.failure == null ? null : JSON.stringify(outcome.failure));
     }
     migrationFrontier() {
@@ -1217,6 +1225,9 @@ export class CloudflareScopeHost {
         if (this.moduleIds.has(manifest.id)) {
             throw new Error(`module already registered: ${manifest.id}`);
         }
+        // #2068: the same refusal the ScopeDO applies at code time, here at registration, so a
+        // misdeclared erasure fails where it is registered on both hosts.
+        moduleErasurePlan(registration);
         const migrations = registration.migrations ?? [];
         const seen = new Set();
         for (const m of migrations) {
@@ -1239,6 +1250,9 @@ export class CloudflareScopeHost {
             }
             this.predicateNames.set(name, manifest.id);
         }
+        // #119: the trash rules, refused here too so a bad module fails at construction, not at its
+        // scope's first wake. The scope holds the targets; the coordinator only needs the verdict.
+        registerTrashTargets(manifest.id, new Set(Object.keys(registration.operations ?? {})), registration.operationInputs, manifest.entityStates, manifest.schedules);
         // #1705: after the checks above, so a refused module leaves nothing registered here.
         this.crossVertical.register(manifest, registration.imports);
         this.moduleIds.add(manifest.id);
@@ -2167,6 +2181,32 @@ export class CloudflareScopeHost {
             throw unknownRoleError(roleKey);
         return coverage.parse(bound);
     }
+    async listScopeRoleHolders(tenantId, scopeId, principal) {
+        await this.scopeRoleGate(tenantId, scopeId, 'listScopeRoleHolders');
+        return this.scopeStub(scopeId).scopeRoleHoldersFor(scopeId, principal === undefined ? undefined : principalId.parse(principal));
+    }
+    async changeScopeRoleBounded(tenantId, scopeId, caller, principal, from, to) {
+        await this.scopeRoleGate(tenantId, scopeId, 'changeScopeRoleBounded');
+        const target = principalId.parse(principal);
+        const bound = await this.scopeStub(scopeId).changeScopeRoleBoundedFor(tenantId, scopeId, principalId.parse(caller), target, from, to);
+        if (bound === 'not-held')
+            throw substratError('conflict', `${target} does not hold '${from}' at this scope`);
+        if (bound === 'unknown-to')
+            throw unknownRoleError(to);
+        return coverage.parse(bound);
+    }
+    async revokeScopeRolesBounded(tenantId, scopeId, caller, principal) {
+        await this.scopeRoleGate(tenantId, scopeId, 'revokeScopeRolesBounded');
+        const result = await this.scopeStub(scopeId).revokeScopeRolesBoundedFor(tenantId, scopeId, principalId.parse(caller), principalId.parse(principal));
+        return { coverage: coverage.parse(result.coverage), revoked: result.revoked };
+    }
+    /** The (tenant, scope) gate the scope-role verbs share — `assignScopeRoleBounded`'s two checks. */
+    async scopeRoleGate(tenantId, scopeId, verb) {
+        if (this.cpLess && !(await this.scopeStub(scopeId).servesTenant(tenantId))) {
+            throw unknownScopeForTenant(tenantId, scopeId);
+        }
+        await this.peerScopeGate(tenantId, scopeId, verb);
+    }
     /**
      * Where a peer verb (#1706) may reach a scope: its own ScopeDO, after the ordinary pair and
      * lifecycle gate. Refused, loudly, on the SHARED control plane for a scope bound to a
@@ -2422,22 +2462,41 @@ export class CloudflareScopeHost {
             const startedAt = Date.now();
             let emitted;
             let failure;
+            // #119, #2096: more of a purge horizon's lap is due — the schedule stays due, so the next pass continues it.
+            let stillDue = false;
             try {
                 // The gate above already answered for this pass; a fire that meets a restarted scope
                 // is gated again by the door (#1834).
                 door ??= await this.openSystemDoor(moduleId, tenantId, scopeId, gate);
                 const scope = this.buildStub(tenantId, scopeId, undefined, undefined, door);
-                await scope.invoke(schedule.operation, schedule.input, { invocationId, onEmitted: (r) => (emitted = r) });
+                if (schedule.purge) {
+                    // #119: a purge horizon's schedule runs its operation once per due entity, each its own
+                    // call and transaction — and the SCOPE decides which are due and runs them, so purge
+                    // authority is never an argument any stub can pass (`runPurgeSweep`).
+                    const pass = await door.through((instance) => stub.runPurgeSweep(schedule.operation, tenantId, scopeId, instance));
+                    // The purges' events, delivered the way each invoke's own tail delivers them.
+                    await this.drainExecutors(tenantId, scopeId, null);
+                    stillDue = purgeStillDue(pass);
+                    const outcome = purgeReportOf(schedule.operation, schedule.purge.entityType, pass);
+                    report.errors.push(...outcome.errors);
+                    if (outcome.failure)
+                        throw outcome.failure;
+                }
+                else {
+                    await scope.invoke(schedule.operation, schedule.input, { invocationId, onEmitted: (r) => (emitted = r) });
+                }
                 report.fired += 1;
             }
             catch (err) {
                 status = 'failed';
                 failure = { error: err };
                 report.failed += 1;
-                report.errors.push({
-                    operation: schedule.operation,
-                    error: err instanceof Error ? err.message : String(err),
-                });
+                if (!schedule.purge) {
+                    report.errors.push({
+                        operation: schedule.operation,
+                        error: err instanceof Error ? err.message : String(err),
+                    });
+                }
             }
             lines.write({
                 kind: 'schedule',
@@ -2452,10 +2511,12 @@ export class CloudflareScopeHost {
                 latenessMs: lastRun === null ? null : now - dueAt,
                 ...(emitted ? { emitted } : {}),
             });
+            report.runs.push({ operation: schedule.operation, outcome: status === 'ok' ? 'ok' : 'failed' });
+            if (stillDue)
+                continue;
             // #1288: 'schedule', whatever this operation happens to be called — including
             // `freshness:<something>`, which is exactly the row the evaluator no longer eats.
             await stub.recordScheduleRun(schedule.operation, new Date(now).toISOString(), status, 'schedule', invocationId);
-            report.runs.push({ operation: schedule.operation, outcome: status === 'ok' ? 'ok' : 'failed' });
         }
         lines.end();
         return report;
@@ -2520,6 +2581,9 @@ export class CloudflareScopeHost {
                                 ? 'vertical'
                                 : undefined,
             invoke: async (operation, input, invokeOptions) => {
+                // #119: purge authority is never an invoke option — only the scope's own `runPurgeSweep`
+                // purges — and an options object naming a cutoff is refused outright.
+                assertNoCallerPurge(invokeOptions);
                 // Entitlement gate (§4.3): a module loads for a tenant only if the tenant holds its
                 // SKU flag. The COORDINATOR gates the console-managed path against the shared CP
                 // (`cp.tenantHoldsEntitlement`); for a hosted/CP-less scope that call is a trusting
@@ -2651,8 +2715,12 @@ export class CloudflareScopeHost {
     }
     // -- admin surface --------------------------------------------------------
     /** #977: this host, with every admin row it writes naming who the actor acted for. */
-    attributed(onBehalfOf) {
-        return attributedHost(this, onBehalfOf, this.buildAdmin);
+    attributed(onBehalfOf, options) {
+        return attributedView(this, { onBehalfOf, causedBy: options?.causedBy }, this.buildAdmin);
+    }
+    /** #2055: this host, with every admin row it writes naming `eventId` as its cause. */
+    causedByView(eventId) {
+        return attributedView(this, { causedBy: eventId }, this.buildAdmin);
     }
     buildAdmin() {
         // The directory row → the `scope` contract. Parsed, not cast: the columns are
@@ -2918,11 +2986,21 @@ export class CloudflareScopeHost {
             // admin log are separate, so no order makes the pair atomic; this one fails toward
             // "an intent with no recorded outcome" and never toward "a switch that moved with no
             // audit row". A retry after a crash re-audits even though it answers `changed: false`.
+            //
+            // #2089: every outcome row goes through the kernel's `recordAuditOutcome`, as the control
+            // plane's audited changes do. One that cannot be written is logged with the operation id,
+            // never swallowed; the call still answers with its own error (or, applied, with success and
+            // `auditWarning`), and the scheduled settle closes the intent as `unknown`.
             const operationId = ulid();
             const target = { tenantId, scopeId, vertical };
             const base = { operationId, ...switchAuditSubject(kind, key, to) };
             await this.recordAdmin(actor, action, target, null, { ...base, phase: 'intent', reason });
             const errorOf = (err) => (err instanceof Error ? err.message : String(err));
+            const recordOutcome = (row) => recordAuditOutcome(() => this.recordAdmin(actor, action, target, null, { ...base, ...row }), {
+                flow: `${kind}-switch`,
+                operationId,
+                phase: row.phase,
+            }, (message, fields) => console.error(message, fields));
             // #2045 (Codex r3): the deployment's fence is attested BEFORE anything is recorded or moved. An
             // ON on a deployment built before it is refused here, with nothing written anywhere but the
             // audit. An OFF goes on: the kill switch must work on every deployment (see `UnattestedSwitch`).
@@ -2932,7 +3010,7 @@ export class CloudflareScopeHost {
                 }
             }
             catch (err) {
-                await this.recordAdmin(actor, action, target, null, { ...base, phase: 'refused', error: errorOf(err) }).catch(() => undefined);
+                await recordOutcome({ phase: 'refused', error: errorOf(err) });
                 throw err;
             }
             // The directory's record (#1674; #2029 for a peer), written BEFORE the scope moves, both
@@ -2950,13 +3028,13 @@ export class CloudflareScopeHost {
                 // Nothing has moved: fail the call here, audited. An ON must not switch a scope on
                 // whose record still says off (the next reconcile would switch it back off), and an
                 // OFF must not leave a scope off that the record does not know of (#1823).
-                await this.recordAdmin(actor, action, target, null, { ...base, phase: 'failed', error: errorOf(err) }).catch(() => undefined);
+                await recordOutcome({ phase: 'failed', error: errorOf(err) });
                 throw err;
             }
             // #2045: a newer call on this subject has recorded its position already: this one writes
             // nothing, here or in the scope, and says so.
             if (recordWriteSuperseded(prior, record)) {
-                await this.recordAdmin(actor, action, target, null, { ...base, phase: 'refused', superseded: true });
+                await recordOutcome({ phase: 'refused', superseded: true });
                 throw substratError('conflict', switchSupersededMessage(kind, scopeId, key, to));
             }
             let outcome;
@@ -2978,13 +3056,12 @@ export class CloudflareScopeHost {
                 // readback can settle the scope and nothing is put back: the record is this call's position
                 // under the newest fence, and its write-ahead mark makes the next re-assert move the scope
                 // to it, under that fence, whichever way it lies now.
-                await this.recordAdmin(actor, action, target, null, {
-                    ...base,
+                await recordOutcome({
                     phase: err instanceof UnattestedSwitch ? 'refused' : 'failed',
                     error: errorOf(err),
                     recordKept: true,
                     reassertOwed: true,
-                }).catch(() => undefined);
+                });
                 if (err instanceof UnattestedSwitch)
                     throw substratError('precondition_failed', err.message);
                 throw err;
@@ -2993,7 +3070,7 @@ export class CloudflareScopeHost {
             // record is that newer call's too (its write overwrote this one's, mark included), so nothing
             // is undone and no mark is this call's to clear.
             if (outcome.superseded) {
-                await this.recordAdmin(actor, action, target, null, { ...base, phase: 'refused', superseded: true });
+                await recordOutcome({ phase: 'refused', superseded: true });
                 throw substratError('conflict', switchSupersededMessage(kind, scopeId, key, to));
             }
             // A call that held nothing moved nothing, so its record write is undone: left `off`, it
@@ -3020,8 +3097,7 @@ export class CloudflareScopeHost {
             else if (!unfenced) {
                 owedError = await this.cp.clearSwitchOwed(kind, tenantId, scopeId, key, operationId).then(() => null, errorOf);
             }
-            await this.recordAdmin(actor, action, target, null, {
-                ...base,
+            const unrecorded = await recordOutcome({
                 phase: outcome.held ? 'applied' : 'refused',
                 changed: outcome.changed,
                 permissions: outcome.permissions,
@@ -3033,30 +3109,32 @@ export class CloudflareScopeHost {
                 throw substratError('not_found', switchNotFoundMessage(kind, scopeId, key, to) +
                     (recordError ? `; and its directory record could not be put back (${recordError})` : ''));
             }
-            return { operationId, outcome };
+            return { operationId, outcome, ...(unrecorded !== null ? { auditWarning: auditWarningOf('the switch', unrecorded) } : {}) };
         };
         /** #1666: move one module's schedule switch on one scope — see `HostAdmin.revokeFromSystem`. */
         const switchSystem = async (actor, raw, to) => {
             const input = systemSwitch.parse(raw);
-            const { operationId, outcome } = await switchSubjectAt(actor, 'system', input.node, input.moduleId, input.reason, to);
+            const { operationId, outcome, auditWarning } = await switchSubjectAt(actor, 'system', input.node, input.moduleId, input.reason, to);
             return {
                 operationId,
                 moduleId: input.moduleId,
                 schedules: to,
                 changed: outcome.changed,
                 permissions: outcome.permissions,
+                ...(auditWarning ? { auditWarning } : {}),
             };
         };
         /** #1706: move one PEER's kill switch on one scope — see `HostAdmin.revokeFromPeer`. */
         const switchPeerAt = async (actor, raw, to) => {
             const input = peerSwitch.parse(raw);
-            const { operationId, outcome } = await switchSubjectAt(actor, 'peer', input.node, input.vertical, input.reason, to);
+            const { operationId, outcome, auditWarning } = await switchSubjectAt(actor, 'peer', input.node, input.vertical, input.reason, to);
             return {
                 operationId,
                 vertical: input.vertical,
                 calls: to,
                 changed: outcome.changed,
                 permissions: outcome.permissions,
+                ...(auditWarning ? { auditWarning } : {}),
             };
         };
         /**
@@ -3323,6 +3401,8 @@ export class CloudflareScopeHost {
             return result;
         };
         return {
+            // #2069: a view of the view this admin was built over — the person added, its event kept.
+            attributed: (onBehalfOf) => this.attributed(onBehalfOf).admin,
             // #603: fixed at construction — a worker deployed without SECRET_BOX_KEY can never
             // store a credential, and saying so is what lets a transport answer 503 instead of 500.
             canStoreSecrets: isSecretBoxConfigured(this.secretBox),
@@ -3395,6 +3475,17 @@ export class CloudflareScopeHost {
                 if (!grant.node.scopeId)
                     await this.fanOut(grant.node.tenantId);
             },
+            grantEntityShape: async (actor, grant) => {
+                await this.grantEntityShapeLocal(grant.node.scopeId, grant.principalId, grant.entity, grant.permissions);
+                await this.recordAdmin(actor, 'grantEntityShape', grant.node, null, grant);
+            },
+            reconcileEntityGrantShapes: async (actor, node, shapes, opts) => {
+                const { toppedUp, retired } = await this.topUpEntityGrantShapesLocal(node.tenantId, node.scopeId, shapes, opts?.batch);
+                if (toppedUp > 0 || retired > 0) {
+                    await this.recordAdmin(actor, 'reconcileEntityGrantShapes', node, null, { shapes, toppedUp, retired });
+                }
+                return { toppedUp, retired };
+            },
             grantToConnection: async (actor, raw) => {
                 const grant = connectionGrant.parse(raw);
                 const conn = await this.cp.readConnection(grant.connectionId);
@@ -3651,6 +3742,23 @@ export class CloudflareScopeHost {
             // #1706: the directory's answer to "vertical Y in tenant T", in the ControlPlaneDO, by
             // the kernel's one rule. No actor, not logged — `resolveHostname`'s machine-path reason.
             resolveVerticalInstance: async (tenantId, vertical) => verticalResolution.parse(await this.cp.resolveVerticalInstance(tenantId, verticalSlug.parse(vertical))),
+            resolvePeerInstance: async (tenantId, callerScopeId, vertical) => peerInstanceResolution.parse(await this.cp.resolvePeerInstance(tenantId, callerScopeId, verticalSlug.parse(vertical))),
+            peerBinding: async (actor, tenantId, callerScopeId, vertical) => {
+                const row = await this.cp.peerBinding(tenantId, callerScopeId, verticalSlug.parse(vertical));
+                await this.recordAccess(actor, 'peerBinding', { tenantId, scopeId: callerScopeId }, { vertical }, row ? 1 : 0);
+                return row ? peerBindingSchema.parse({ tenantId, callerScopeId, vertical, targetScopeId: row.target_scope_id, invalidated: row.invalidated === 1 }) : undefined;
+            },
+            peerBindings: async (actor, tenantId, callerScopeId) => {
+                const rows = await this.cp.peerBindings(tenantId, callerScopeId);
+                await this.recordAccess(actor, 'peerBindings', { tenantId, scopeId: callerScopeId }, null, rows.length);
+                return rows.map((r) => peerBindingSchema.parse({ tenantId, callerScopeId, vertical: r.vertical, targetScopeId: r.target_scope_id, invalidated: r.invalidated === 1 }));
+            },
+            setPeerBinding: async (_actor, tenantId, callerScopeId, vertical, targetScopeId) => {
+                const answer = await this.cp.setPeerBinding(tenantId, callerScopeId, verticalSlug.parse(vertical), targetScopeId);
+                if (!answer.ok)
+                    throw substratError(answer.code, answer.message);
+                return { changed: answer.changed, previous: answer.previous };
+            },
             resolveHostname: async (raw) => 
             // The router's per-request read. No actor, not logged — the same machine-path
             // carve-out resolveIdentity has (K-24). Shares its mapping with the router's
@@ -3676,6 +3784,9 @@ export class CloudflareScopeHost {
                 // Declared email-sender intent (#303) — the request half; the grant is its own column.
                 if (parsed.sendsEmail)
                     installSpec.sendsEmail = parsed.sendsEmail;
+                // Where the scope lifecycle is held (#1713) — read by the lifecycle delivery's targets.
+                if (parsed.lifecycle)
+                    installSpec.lifecycle = parsed.lifecycle;
                 const installSpecJson = Object.keys(installSpec).length ? JSON.stringify(installSpec) : null;
                 const existing = await this.cp.readVertical(parsed.slug);
                 if (existing) {
@@ -4156,21 +4267,25 @@ export class CloudflareScopeHost {
                 await this.recordAccess(actor, 'getOrg', { tenantId }, { orgId }, r ? 1 : 0);
                 return r ? mapOrg(r) : undefined;
             },
-            addMember: async (actor, tenantId, principal, orgId) => {
+            addMember: async (actor, tenantId, principal, orgId, opts) => {
                 await requireOrg(tenantId, orgId);
-                await this.cp.writeTenantTuple(tenantId, `principal:${principal}`, 'member', `org:${orgId}`, null);
-                await this.recordAdmin(actor, 'addMember', { tenantId }, null, { principal, orgId });
+                const expiresAt = opts?.expiresAt ?? null;
+                await this.cp.writeTenantTuple(tenantId, `principal:${principal}`, 'member', `org:${orgId}`, expiresAt);
+                await this.recordAdmin(actor, 'addMember', { tenantId }, null, memberAddedAudit(principal, orgId, expiresAt));
                 await this.fanOut(tenantId); // membership is a tenant-level tuple
             },
             applyMembership: async (actor, change) => {
                 // The row is minted here, where attribution and `causedBy` live, and written by the
                 // ControlPlaneDO in the same synchronous method as the fence, the bound and the tuple
                 // (#1184): one DO unit, so nothing lands between the check and the write.
-                const { tenantId, principal, roleKey, op } = change;
+                const { tenantId, principal, roleKey, op, orgId } = change;
                 const assignment = { principalId: principal, roleKey, node: { tenantId, scopeId: null } };
                 const result = await this.cp.applyMembership(change, op === 'add'
                     ? this.adminEntry(actor, 'assignRole', { tenantId, scopeId: null }, null, assignment)
-                    : this.adminEntry(actor, 'unassignRole', { tenantId, scopeId: null }, assignment, null));
+                    : this.adminEntry(actor, 'unassignRole', { tenantId, scopeId: null }, assignment, null), 
+                // #2047: the org's own row, when the change joins or leaves one. The unit fills in its
+                // `before`/`after` and writes it only for what it does — a join's carries the expiry.
+                orgId ? this.adminEntry(actor, op === 'add' ? 'addMember' : 'removeMember', { tenantId }, null, null) : undefined);
                 // The tenant-level tuple, or its tombstone, reaches the projections.
                 if (result.applied && (op === 'add' || result.changed))
                     await this.fanOut(tenantId);
@@ -4192,6 +4307,7 @@ export class CloudflareScopeHost {
                     principal: r.subject.slice('principal:'.length),
                     orgId,
                     revokedAt: r.revoked_at,
+                    expiresAt: r.expires_at,
                 }));
             },
             createTenant: async (actor, input) => {
@@ -4673,6 +4789,12 @@ export class CloudflareScopeHost {
                 // Both spine copies (#1600): the outbox row AND any platform intent this event was
                 // routed into. One RPC, so a crash cannot land half of it.
                 const redacted = await this.scopeStub(scopeId).redactSubject(subjectId);
+                // A refusal answered as data (#2068) — a module's `onSubjectErased` hook threw or reached
+                // past its own tables, and the DO rolled the whole redaction back. Rethrown with its code,
+                // before the key.
+                if (typeof redacted === 'object' && 'failure' in redacted && redacted.failure) {
+                    throw fromWireFailure(redacted.failure);
+                }
                 // An OLD ScopeDO answers with a bare number — it redacted the outbox and never
                 // looked at the intent journal. Refused here, BEFORE the key is destroyed, and
                 // that order is the whole point: the key is the irreversible half, so proceeding
@@ -4705,7 +4827,16 @@ export class CloudflareScopeHost {
                         `or a queued sweep-runs intent — erasing now would destroy the subject key while ` +
                         `leaving their data in those rows. Redeploy the vertical and re-run.`);
                 }
-                const { events: eventsRedacted, intents: intentsRedacted, jobRuns: jobRunsRedacted, idempotencyResults, intentIds, } = redacted;
+                // A DO from before the module half (#2068): it redacted the spine and never ran a
+                // module's declared erasure or its `onSubjectErased` hook. Refused before the key, for
+                // the reason above — its reply read as "no module rows" would receipt an erasure that
+                // left the person in the vertical's own tables, with the key already gone.
+                if (!('vertical' in redacted) || !isModuleErasureCounts(redacted.vertical)) {
+                    throw substratError('unavailable', `scope ${scopeId} runs a ScopeDO from before #2068, whose redaction does not reach a module's ` +
+                        `own tables — erasing now would destroy the subject key while leaving their data in the ` +
+                        `vertical's rows. Redeploy the vertical and re-run.`);
+                }
+                const { events: eventsRedacted, intents: intentsRedacted, jobRuns: jobRunsRedacted, idempotencyResults, intentIds, vertical, } = redacted;
                 // The directory's failure text (#1632) — a drain failure quoting one of those intents,
                 // an issue's exemplar, a sweep record's error. Still before the key.
                 await this.cp.redactSubjectText({ tenantId, scopeId, subjectId, intentIds });
@@ -4716,6 +4847,7 @@ export class CloudflareScopeHost {
                     eventsRedacted,
                     intentsRedacted,
                     jobRunsRedacted,
+                    ...vertical,
                     keyDestroyed: existed,
                     tombstoned: true,
                 });
@@ -4725,7 +4857,7 @@ export class CloudflareScopeHost {
                 await this.recordAdmin(actor, 'shredSubject', { tenantId, scopeId }, null, receipt);
                 // BOTH counts: the access log's number is "how much evidence this destroyed", and
                 // an intent payload is a whole event's worth of it.
-                await this.recordAccess(actor, 'shredSubject', { tenantId, scopeId }, { subjectId }, eventsRedacted + intentsRedacted + jobRunsRedacted + idempotencyResults);
+                await this.recordAccess(actor, 'shredSubject', { tenantId, scopeId }, { subjectId }, eventsRedacted + intentsRedacted + jobRunsRedacted + idempotencyResults + moduleRowsErased(vertical));
                 return receipt;
             },
             // -- impersonation (K-42, #868) ----------------------------------------
@@ -4968,12 +5100,12 @@ export class CloudflareScopeHost {
                     throw new Error(`connection not found: ${id}`);
                 const sealed = await this.secretBox.seal(JSON.stringify(connectionSecret.parse(secret)));
                 const now = new Date().toISOString();
-                await this.cp.updateConnectionSecret(id, sealed.keyId, sealed.ciphertext, expiresAt ?? row.expires_at, now);
+                await this.cp.updateConnectionSecret(id, sealed.keyId, sealed.ciphertext, expiresAt === undefined ? row.expires_at : expiresAt, now);
                 await this.recordAdmin(actor, 'updateConnectionSecret', { tenantId: row.tenant_id, vertical: row.vertical }, null, {
                     id,
                     provider: row.provider,
                     rotatedAt: now,
-                    expiresAt: expiresAt ?? row.expires_at,
+                    expiresAt: expiresAt === undefined ? row.expires_at : expiresAt,
                     // §3.5.1's attribution, rotate-side: the authorizing tenant principal,
                     // never laundered into the actor column.
                     ...(opts?.rotatedBy ? { rotatedBy: opts.rotatedBy } : {}),
@@ -4989,6 +5121,55 @@ export class CloudflareScopeHost {
                     return; // idempotent, and a no-op is not audited
                 await this.recordAdmin(actor, 'revokeConnection', { tenantId: row.tenant_id, vertical: row.vertical }, { status: row.status }, { id, provider: row.provider, status: 'revoked', revokedAt: now });
             },
+            // -- a vertical's mailed connect links (connections.md §3.5.4) --------------
+            // Parsed here, run in the ControlPlaneDO as the kernel's statements (shared with
+            // the pure adapter). Each move writes its audit row in the DO's own unit, from the
+            // row minted here (actor, attribution) — so a failed audit write rolls the move back.
+            // The DO has no clock of its own on this path — `now` is the coordinator's, the same
+            // wall clock every other directory write uses.
+            mintConnectLink: async (actor, raw) => {
+                const input = mintConnectLinkInput.parse(raw);
+                return this.cp.insertConnectLink({
+                    id: ulid(),
+                    tenantId: input.tenantId,
+                    scopeId: input.scopeId,
+                    vertical: input.vertical,
+                    provider: input.provider,
+                    createdBy: input.createdBy,
+                    subjectRef: input.subjectRef ?? null,
+                    returnUrl: input.returnUrl ?? null,
+                    createdAt: new Date().toISOString(),
+                    expiresAt: input.expiresAt,
+                }, this.adminEntry(actor, 'mintConnectLink', { tenantId: input.tenantId }, null, null));
+            },
+            getConnectLink: async (actor, raw) => {
+                const key = connectLinkKey.parse(raw);
+                const link = await this.cp.readConnectLink(key);
+                await this.recordAccess(actor, 'getConnectLink', key, { id: key.id }, link ? 1 : 0);
+                return link;
+            },
+            listConnectLinks: async (actor, raw) => {
+                const filter = connectLinkFilter.parse(raw);
+                const links = await this.cp.listConnectLinks(filter, new Date().toISOString());
+                await this.recordAccess(actor, 'listConnectLinks', filter, filter, links.length);
+                return links;
+            },
+            revokeConnectLink: async (actor, raw) => {
+                const key = connectLinkKey.parse(raw);
+                // Idempotent, and a no-op is not audited (the statement hands back no row for one).
+                const audit = this.adminEntry(actor, 'revokeConnectLink', { tenantId: key.tenantId }, null, null);
+                return (await this.cp.revokeConnectLink(key, audit))?.link;
+            },
+            consumeConnectLink: async (actor, raw) => {
+                const input = consumeConnectLinkInput.parse(raw);
+                const audit = this.adminEntry(actor, 'consumeConnectLink', { tenantId: input.tenantId }, null, null);
+                return this.cp.consumeConnectLink(input, new Date().toISOString(), audit);
+            },
+            restoreConnectLink: async (actor, raw) => {
+                const key = connectLinkKey.parse(raw);
+                const audit = this.adminEntry(actor, 'restoreConnectLink', { tenantId: key.tenantId }, null, null);
+                return (await this.cp.restoreConnectLink(key, new Date().toISOString(), audit)) !== undefined;
+            },
             openConnection: async (tenantId, vertical, provider, externalAccountRef) => {
                 const row = await this.cp.readLiveConnection(tenantId, vertical, provider, externalAccountRef);
                 if (!row)
@@ -5085,6 +5266,23 @@ export class CloudflareScopeHost {
                 const { tenantId, scopeId, ...after } = ownerTransferAudit.parse(entry);
                 await this.recordAdmin(actor, 'transferOwner', { tenantId, scopeId }, null, after);
             },
+            /** #1150: one phase of a dashboard member change, written around the vertical's own. */
+            recordMemberChange: async (actor, entry) => {
+                const { tenantId, scopeId, ...after } = memberChangeAudit.parse(entry);
+                await this.recordAdmin(actor, 'manageScopeMember', { tenantId, scopeId }, null, after);
+            },
+            recordPeerBindingChange: async (actor, entry) => {
+                const { tenantId, scopeId, ...after } = peerBindingAudit.parse(entry);
+                await this.recordAdmin(actor, 'setPeerBinding', { tenantId, scopeId }, null, after);
+            },
+            /** #2064: an audited operation's rows, by the operation-id index, in bounded batches. */
+            auditedOperations: async (actor, refs) => {
+                const rows = await this.cp.auditedOperations([...refs]);
+                await this.recordAccess(actor, 'auditedOperations', {}, { operations: refs.length }, rows.length);
+                return rows;
+            },
+            /** #2064: settle an intent with no outcome — one unit in the directory DO. */
+            settleUnrecordedOutcome: (actor, input) => this.cp.settleUnrecordedOutcome({ actor, intentId: input.intentId, error: input.error }),
             /** #2005: one change to a scope's copy marker, written around the vertical's own change. */
             recordCopyMark: async (actor, entry) => {
                 const { tenantId, scopeId, action, ...after } = copyMarkAudit.parse(entry);
@@ -5241,6 +5439,8 @@ export class CloudflareScopeHost {
             },
             // Checked here as well as in the directory, so the refusal keeps its code across the hop.
             pruneTelemetry: async (_actor, limit) => this.cp.pruneTelemetry(assertRowLimit('limit', limit)),
+            // #1748: the DO writes each stale resolution's audit row in the same unit, from this one.
+            pruneFindings: async (actor, limit) => this.cp.pruneFindings(assertRowLimit('limit', limit), this.adminEntry(actor, 'resolveStaleFinding', { tenantId: null }, null, null)),
             listIssues: async (actor, filter) => {
                 const rows = await this.cp.listIssues({
                     status: filter?.status,
@@ -5262,6 +5462,33 @@ export class CloudflareScopeHost {
                 await this.recordAdmin(actor, 'setIssueStatus', { tenantId: null, vertical: after.lastVertical }, { fingerprint, status: before.status }, { fingerprint, status: after.status });
                 return after;
             },
+            listFindings: async (actor, filter) => {
+                const rows = await this.cp.listFindings({ ...filter });
+                await this.recordAccess(actor, 'listFindings', { tenantId: filter?.tenantId ?? null }, filter, rows.length);
+                return rows.map((r) => findingEntry.parse(r));
+            },
+            // #1748: each findings mutation writes its audit row in the DO's own unit, from the row
+            // minted here (actor, attribution) — so a failed audit write rolls the mutation back.
+            setFindingStatus: async (actor, tenantId, id, status) => {
+                const audit = this.adminEntry(actor, 'setFindingStatus', { tenantId }, null, null);
+                const change = await this.cp.setFindingStatus(tenantId, id, status, new Date().toISOString(), audit);
+                return change ? findingEntry.parse(change.after) : undefined;
+            },
+            createFindingRule: async (actor, tenantId, input) => {
+                const audit = this.adminEntry(actor, 'createFindingRule', { tenantId }, null, null);
+                const created = await this.directory('createFindingRule', tenantId, input, actor, new Date().toISOString(), audit);
+                return { rule: findingRuleEntry.parse(created.rule), suppressed: created.suppressed.length };
+            },
+            revokeFindingRule: async (actor, tenantId, ruleId) => {
+                const audit = this.adminEntry(actor, 'revokeFindingRule', { tenantId }, null, null);
+                const change = await this.cp.revokeFindingRule(tenantId, ruleId, new Date().toISOString(), audit);
+                return change ? findingRuleEntry.parse(change.after) : undefined;
+            },
+            listFindingRules: async (actor, tenantId, filter) => {
+                const rows = await this.cp.listFindingRules(tenantId, filter?.active ? new Date().toISOString() : undefined, filter?.limit);
+                await this.recordAccess(actor, 'listFindingRules', { tenantId }, filter, rows.length);
+                return rows.map((r) => findingRuleEntry.parse(r));
+            },
             recordModelUsage: async (input) => {
                 const l = input.line;
                 return this.cp.recordModelUsage({
@@ -5653,7 +5880,7 @@ export class CloudflareScopeHost {
         }));
     }
     async writeScopeTuple(scopeId, subject, relation, object, expiresAt) {
-        await this.scopeStub(scopeId).writeTuple(subject, relation, object, expiresAt);
+        unwrapReply(await this.scopeStub(scopeId).writeTuple(subject, relation, object, expiresAt));
     }
     /**
      * The connection's CURRENT public sealing key, minted on first ask (#687).
@@ -6044,11 +6271,17 @@ export class CloudflareScopeHost {
      * arrive as a different class of answer just because the caller asked for a socket.
      */
     liveReads = {
-        subscribe: async ({ tenantId, scopeId, principal, request, within }) => {
+        subscribe: async ({ tenantId, scopeId, principal, request, within, expiresAt }) => {
             // Decided before anything else, and thrown: a `within` that is neither a plain
             // EntityRef nor a value `vouchedWithin` built is a caller bug, and the two ways of
             // guessing at it both open a feed wider than was asked for (#1853).
             const narrowed = liveWithinOf(within);
+            // The same for an expiry that is not an instant: read as "none", it would keep the
+            // socket open past the session it was meant to end with (#938).
+            const expires = expiresAt === undefined ? undefined : liveInstant(expiresAt);
+            if (expiresAt !== undefined && !expires) {
+                throw substratError('validation_failed', 'live reads: `expiresAt` must be an ISO 8601 instant');
+            }
             if (!isUpgradeRequest(request)) {
                 return new Response('live reads are a WebSocket surface', {
                     status: 426,
@@ -6110,6 +6343,10 @@ export class CloudflareScopeHost {
                 headers.set(LIVE_WITHIN_HEADER, encodeLiveWithin(narrowed));
             else
                 headers.delete(LIVE_WITHIN_HEADER);
+            if (expires)
+                headers.set(LIVE_EXPIRES_HEADER, expires);
+            else
+                headers.delete(LIVE_EXPIRES_HEADER);
             const forwarded = new Request(new URL(LIVE_SUBSCRIBE_PATH, 'https://scope.substrat.internal'), 
             // `new Request(url, { …, headers })` rather than `new Request(request, …)`:
             // the DO is addressed by its own path, not the client's, and the upgrade
@@ -6367,6 +6604,8 @@ export class CloudflareScopeHost {
         // #1742: the recorded-off modules and (#2029) peers, switched off after the seat in the
         // same unit, on the scope this call provisions — the one the seat's tuples name.
         carry ? { scopeId: input.scopeId, at: new Date().toISOString(), ...carry } : undefined, services?.map((id) => `principal:${id}`)));
+        if (input.entityGrants)
+            await this.topUpEntityGrantShapesLocal(input.tenantId, input.scopeId, input.entityGrants);
         return carry ? { switchedOff } : {};
     }
     /**
@@ -6392,7 +6631,7 @@ export class CloudflareScopeHost {
      * already projected (via `provisionScopeLocal`), or the local checker expands it to nothing.
      */
     async assignScopeRole(scopeId, principal, roleKey) {
-        await this.scopeStub(scopeId).writeTuple(`principal:${principal}`, `role:${roleKey}`, `scope:${scopeId}`, null);
+        unwrapReply(await this.scopeStub(scopeId).writeTuple(`principal:${principal}`, `role:${roleKey}`, `scope:${scopeId}`, null));
     }
     /**
      * Take a scope-level role back — the counterpart `assignScopeRole` went without (#1161).
@@ -6451,8 +6690,41 @@ export class CloudflareScopeHost {
      * (writeTuple is INSERT OR REPLACE), so it is safe to re-issue on every link.
      */
     async grantEntityLocal(scopeId, principal, permission, entity) {
-        await this.scopeStub(scopeId).writeTuple(`principal:${principal}`, `granted:${permission}`, entityObjectRef(entity, 'grantEntityLocal'), // #1856
-        null);
+        unwrapReply(await this.scopeStub(scopeId).writeTuple(`principal:${principal}`, `granted:${permission}`, entityObjectRef(entity, 'grantEntityLocal'), // #1856
+        null));
+    }
+    /**
+     * Give a person a declared entity-grant SHAPE on one entity in a CP-less vertical (#2071) —
+     * `grantEntityLocal` for every key of the shape, plus the marker that makes them a holder of
+     * it, in one unit. What a vertical calls where it used to loop `grantEntityLocal` over its
+     * `ENTITY_GRANTS` keys: a key the shape gains later then reaches this person at the next
+     * provision or reconcile (`provisionScopeLocal`'s `entityGrants`). Idempotent, and explicit
+     * like `grantEntityLocal`: it brings back a key or a marker a revoke tombstoned.
+     */
+    async grantEntityShapeLocal(scopeId, principal, entity, permissions) {
+        await this.scopeStub(scopeId).grantEntityShape(principal, entity, permissions);
+    }
+    /**
+     * Top every holder of each declared shape up to the shape as it is now (#2071), in bounded
+     * passes — at most `batch` rows of work per scope transaction (default 500, at most 5000;
+     * anything else is `validation_failed`), repeated until a pass finishes. Never re-grants a revoked
+     * key; takes back only a key the shape declares `retired` (#2082). Returns how many
+     * (person, entity) it topped up, and how many it took retired keys from.
+     */
+    async topUpEntityGrantShapesLocal(tenantId, scopeId, shapes, batch) {
+        const limit = shapeTopUpBatch(batch);
+        let toppedUp = 0;
+        let retired = 0;
+        if (shapes.length === 0)
+            return { toppedUp, retired };
+        const stub = this.scopeStub(scopeId);
+        for (let done = false; !done;) {
+            const pass = await stub.topUpEntityGrantShapes(tenantId, scopeId, shapes, limit);
+            toppedUp += pass.toppedUp;
+            retired += pass.retired;
+            done = pass.done;
+        }
+        return { toppedUp, retired };
     }
     // -- the connector write-back's far end (#574) -----------------------------
     // A CP-less dispatch vertical cannot run a connector, so the shared control
@@ -6651,10 +6923,21 @@ export class CloudflareScopeHost {
         if (!delegation)
             this.assertServedHere(rec, scopeId, 'moveImportCursor');
         await this.validateScopeAccess(tenantId, scopeId);
+        // #2114: the replay's id is also its audit `operationId`, so the scheduled settle pairs and
+        // closes the lever's rows exactly as it does the kill switches'.
         const replayId = ulid();
         const target = { tenantId, scopeId, vertical: rec.vertical };
-        const base = { replayId, mode: move.mode, from: move.from, source: source.scopeId };
+        const base = { operationId: replayId, replayId, mode: move.mode, from: move.from, source: source.scopeId };
         await this.recordAdmin(actor, 'moveImportCursor', target, null, { ...base, phase: 'intent', reason: move.reason });
+        // #2114: every outcome row goes through the kernel's `recordAuditOutcome`, as the kill
+        // switches' do (#2089). One that cannot be written is logged with the replay id, never
+        // swallowed; the call still answers with the move's own error (or, applied, with the move and
+        // `auditWarning`), and the scheduled settle closes the intent as `unknown`.
+        const recordOutcome = (row) => recordAuditOutcome(() => this.recordAdmin(actor, 'moveImportCursor', target, null, { ...base, ...row }), {
+            flow: 'import-cursor',
+            operationId: replayId,
+            phase: row.phase,
+        }, (message, fields) => console.error(message, fields));
         const at = { move, source: source, replayId };
         let moved;
         try {
@@ -6663,21 +6946,16 @@ export class CloudflareScopeHost {
                 : await this.moveInScope(scopeId, at);
         }
         catch (err) {
-            await this.recordAdmin(actor, 'moveImportCursor', target, null, {
-                ...base,
-                phase: 'failed',
-                error: err instanceof Error ? err.message : String(err),
-            }).catch(() => undefined);
+            await recordOutcome({ phase: 'failed', error: err instanceof Error ? err.message : String(err) });
             throw err;
         }
-        await this.recordAdmin(actor, 'moveImportCursor', target, null, {
-            ...base,
+        const unrecorded = await recordOutcome({
             phase: 'applied',
             previous: moved.previous,
             cursor: moved.cursor,
             archived: moved.archived,
         });
-        return moved;
+        return unrecorded === null ? moved : { ...moved, auditWarning: auditWarningOf('the move', unrecorded) };
     }
     /** #1705 PR 3: the promote gate's question, over two stored manifests (`exportBreaksOf`). */
     exportBreaksBetween(actor, producer, outgoingManifest, incomingManifest) {