@substrat-run/adapter-cloudflare 0.139.0 → 0.140.0

package/dist/host.js

@@ -1,11 +1,11 @@
 import { env as ambientEnv } from 'cloudflare:workers';
 import { isRewindRefusal, REWIND_REFUSED } from './rewind-refusal.js';
 import { isSystemDoorMoved, SYSTEM_DOOR_MOVED, SYSTEM_DOOR_REGATES } from './system-door.js';
-import { delegatedReadParams, operationSeriesCount, fromWireFailure, exportReadInput, exportedBatch, importBatch, importResult, importState, importsOfManifestJson, exportsOfManifestJson, importCursorMove, importCursorMoveAt, importCursorMoved, accessLogEntry, adminLogEntry, opsFailureEntry, opsFailureFingerprint, issueEntry, findingEntry, findingRuleEntry, sweepRunEntry, FRESHNESS_HEARTBEAT_MINUTES, sweepRunsPayload, modelUsageEntry, attachmentRecord, createTenantInput, identityLink, identityPool, createOrgInput, promotionAcknowledgement, bindAcknowledgement, bindHostnameInput, channelHistoryEntry, hostnameBinding, publishVersionInput, AUTO_ADMISSION_NOTE, registerVerticalInput, vertical as verticalSchema, verticalServingState, verticalChannel, verticalVersion, connection, capabilityExchange, mintedCapability, capabilityGrant, principalId, connectionGrant, connectionGrantRecord, connectionSecret, systemGrant, systemSwitch, systemSwitchOutcome, systemScheduleEntry, systemSwitchRecord, entitlementGrant, entitlementGrantInput, capabilityFilter, instant, meterReading, subjectRef, createConnectionInput, projectedConnectionGrant, projectedConnectionKey, moduleManifest, org as orgSchema, orgMembership, resolvedIdentity, identityMembership, roleDefinition, scope as scopeSchema, tenant as tenantSchema, tenantRole, delegatedReadRecord, ownerTransferAudit, memberChangeAudit, copyMarkAudit, subjectShredReceipt, connectorDispatchKind, callsOfManifestJson, outboundOfManifestJson, SCOPE_GATE_REASONS, substratError, redrainEventsInput, coverage, peerCoverage, peerGrantsEntry, peerSwitch, peerSwitchOutcome, verticalCaller, verticalResolution, verticalSlug, entityObjectRef, ATTACHMENT_BLOB_BINDING, blobStoreBindingName, lifecycleDelivery, scopeLifecycle, } from '@substrat-run/contracts';
+import { delegatedReadParams, operationSeriesCount, fromWireFailure, exportReadInput, exportedBatch, importBatch, importResult, importState, importsOfManifestJson, exportsOfManifestJson, importCursorMove, importCursorMoveAt, importCursorMoved, accessLogEntry, adminLogEntry, opsFailureEntry, opsFailureFingerprint, issueEntry, findingEntry, findingRuleEntry, sweepRunEntry, FRESHNESS_HEARTBEAT_MINUTES, sweepRunsPayload, modelUsageEntry, attachmentRecord, createTenantInput, identityLink, identityPool, createOrgInput, promotionAcknowledgement, bindAcknowledgement, bindHostnameInput, channelHistoryEntry, hostnameBinding, publishVersionInput, AUTO_ADMISSION_NOTE, registerVerticalInput, vertical as verticalSchema, verticalServingState, verticalChannel, verticalVersion, connection, capabilityExchange, mintedCapability, capabilityGrant, principalId, connectionGrant, connectionGrantRecord, connectionSecret, systemGrant, systemSwitch, systemSwitchOutcome, systemScheduleEntry, systemSwitchRecord, entitlementGrant, entitlementGrantInput, capabilityFilter, instant, meterReading, subjectRef, createConnectionInput, connectLinkFilter, connectLinkKey, consumeConnectLinkInput, mintConnectLinkInput, projectedConnectionGrant, projectedConnectionKey, moduleManifest, org as orgSchema, orgMembership, resolvedIdentity, identityMembership, roleDefinition, scope as scopeSchema, tenant as tenantSchema, tenantRole, delegatedReadRecord, ownerTransferAudit, memberChangeAudit, peerBindingAudit, copyMarkAudit, subjectShredReceipt, connectorDispatchKind, callsOfManifestJson, outboundOfManifestJson, SCOPE_GATE_REASONS, substratError, redrainEventsInput, coverage, peerCoverage, peerGrantsEntry, peerSwitch, peerSwitchOutcome, verticalCaller, verticalResolution, peerInstanceResolution, peerBinding as peerBindingSchema, verticalSlug, entityObjectRef, ATTACHMENT_BLOB_BINDING, blobStoreBindingName, lifecycleDelivery, scopeLifecycle, } from '@substrat-run/contracts';
 import { normalizeHostname, toRouteTarget } from './route-resolver.js';
-import { attachmentBlobKey, attachmentSha256, entitlementDenial, requiredEntitlementFor, foldMeterReading, parseValidationRecords, resolveScopeRecord, ulid, KEPT_COPY_REFUSAL, capabilityTokenHash, checkBecomeInput, plausibleSessionToken, foldModelUsage, backoffAt, resolveRetryPolicy, executorOutcomeOf, isDeliveryRefusal, refusalJournalText, isSecretBoxConfigured, unconfiguredSecretBox, createSubjectKeys, generateSealingKeyPair, openSealed, ImpersonationRefused, assertSessionUsable, impersonationRowValues, mapImpersonationRow, newImpersonationSession, jobRunOf, assertLeaseMs, runDueJobRuns, SYSTEM_DOOR_WAIT, startJobRun, attachmentTextJob, assertAttachmentExtractors, resolveAttachmentTextBounds, assertJobRegistrable, ATTACHMENT_TEXT_BACKFILL_JOB, ATTACHMENT_TEXT_JOB, kernelJobFor, attachmentTextBackfillJob, searchLimit, searchMatchExpression, globalFetch, assertRedrainWindow, platformRequestOf, undrainedEventsOf, inUnitMovesToAudit, staleCarryRevertRow, staleCarryReverts, recordedOffFromWire, peerSubjectRef, SWITCH_KINDS, reassertActionOf, reassertEntry, reassertOffRow, reassertOnRow, switchActionOf, switchAuditSubject, switchNotFoundMessage, recordWriteSuperseded, switchSubjectOf, switchSupersededMessage, withRecorded, systemSwitchedOffMessage, tenantSystemSwitchedOffMessage, CrossVerticalRegistry, importCursorSourceOf, exportBreaksOf, exportBreakRefusal, bindExportBreaksOf, bindExportBreakRefusal, collectPeers, peerSeats, connectorCallRecord, noopConnectorCallRecorder, recordConnectorCall, settleConnectionUse, splitManifestMigrations, unknownRoleError, assertRowLimit, assertRowOffset, emptyImportResult, INERT_SCOPE_REASON, lifecycleReceipt, lifecycleRefusal, isPrimaryScope, isPrimaryScopeRow, asyncInvocationId, asyncLinePass, memberAddedAudit, } from '@substrat-run/kernel';
-import { attributedView } from '@substrat-run/kernel';
-import { isOrangeToOrange, isUpgradeRequest, LIVE_MODE_HEADER, LIVE_PRINCIPAL_HEADER, LIVE_SCOPE_HEADER, LIVE_SUBSCRIBE_PATH, LIVE_TENANT_HEADER, LIVE_WITHIN_HEADER, encodeLiveWithin, liveWithinOf, } from './live-reads.js';
+import { attachmentBlobKey, attachmentSha256, entitlementDenial, requiredEntitlementFor, foldMeterReading, parseValidationRecords, resolveScopeRecord, ulid, KEPT_COPY_REFUSAL, capabilityTokenHash, checkBecomeInput, plausibleSessionToken, foldModelUsage, backoffAt, resolveRetryPolicy, executorOutcomeOf, isDeliveryRefusal, refusalJournalText, isSecretBoxConfigured, unconfiguredSecretBox, createSubjectKeys, generateSealingKeyPair, openSealed, ImpersonationRefused, assertSessionUsable, impersonationRowValues, mapImpersonationRow, newImpersonationSession, jobRunOf, assertLeaseMs, runDueJobRuns, SYSTEM_DOOR_WAIT, startJobRun, attachmentTextJob, assertAttachmentExtractors, resolveAttachmentTextBounds, assertJobRegistrable, ATTACHMENT_TEXT_BACKFILL_JOB, ATTACHMENT_TEXT_JOB, kernelJobFor, attachmentTextBackfillJob, searchLimit, searchMatchExpression, globalFetch, assertRedrainWindow, platformRequestOf, undrainedEventsOf, inUnitMovesToAudit, staleCarryRevertRow, staleCarryReverts, recordedOffFromWire, peerSubjectRef, SWITCH_KINDS, reassertActionOf, reassertEntry, reassertOffRow, reassertOnRow, switchActionOf, switchAuditSubject, recordAuditOutcome, auditWarningOf, switchNotFoundMessage, recordWriteSuperseded, switchSubjectOf, switchSupersededMessage, withRecorded, systemSwitchedOffMessage, tenantSystemSwitchedOffMessage, CrossVerticalRegistry, importCursorSourceOf, exportBreaksOf, exportBreakRefusal, bindExportBreaksOf, bindExportBreakRefusal, collectPeers, peerSeats, connectorCallRecord, noopConnectorCallRecorder, recordConnectorCall, settleConnectionUse, splitManifestMigrations, unknownRoleError, assertRowLimit, assertRowOffset, emptyImportResult, INERT_SCOPE_REASON, lifecycleReceipt, lifecycleRefusal, isPrimaryScope, isPrimaryScopeRow, asyncInvocationId, asyncLinePass, assertNoCallerPurge, purgeReportOf, purgeStillDue, registerTrashTargets, memberAddedAudit, shapeTopUpBatch, } from '@substrat-run/kernel';
+import { attributedView, isModuleErasureCounts, moduleErasurePlan, moduleRowsErased } from '@substrat-run/kernel';
+import { isOrangeToOrange, isUpgradeRequest, LIVE_MODE_HEADER, LIVE_PRINCIPAL_HEADER, LIVE_SCOPE_HEADER, LIVE_SUBSCRIBE_PATH, LIVE_TENANT_HEADER, LIVE_WITHIN_HEADER, LIVE_EXPIRES_HEADER, liveInstant, encodeLiveWithin, liveWithinOf, } from './live-reads.js';
 import { tenantStoreDatabaseName } from './d1.js';
 import { blobStoreBucketName, r2TenantBlobStore } from './r2.js';
 import { unwrapReply } from './do-reply.js';
@@ -777,6 +777,12 @@ export class CloudflareScopeHost {
     async settlePlatformRequest(tenantId, scopeId, id, outcome) {
         await this.validateScopeAccess(tenantId, scopeId);
         await this.migrateAndRecord(scopeId);
+        // #2102: an outcome event travels by the verb that writes it; every other settle keeps the
+        // positional one, so it still reaches a DO class that predates the event.
+        if (outcome.event) {
+            await this.scopeStub(scopeId).settlePlatformRequestWithEvent(tenantId, scopeId, id, outcome);
+            return;
+        }
         await this.scopeStub(scopeId).settlePlatformRequest(id, outcome.status, outcome.result === undefined ? null : JSON.stringify(outcome.result), outcome.lastError ?? null, outcome.failure == null ? null : JSON.stringify(outcome.failure));
     }
     migrationFrontier() {
@@ -1219,6 +1225,9 @@ export class CloudflareScopeHost {
         if (this.moduleIds.has(manifest.id)) {
             throw new Error(`module already registered: ${manifest.id}`);
         }
+        // #2068: the same refusal the ScopeDO applies at code time, here at registration, so a
+        // misdeclared erasure fails where it is registered on both hosts.
+        moduleErasurePlan(registration);
         const migrations = registration.migrations ?? [];
         const seen = new Set();
         for (const m of migrations) {
@@ -1241,6 +1250,9 @@ export class CloudflareScopeHost {
             }
             this.predicateNames.set(name, manifest.id);
         }
+        // #119: the trash rules, refused here too so a bad module fails at construction, not at its
+        // scope's first wake. The scope holds the targets; the coordinator only needs the verdict.
+        registerTrashTargets(manifest.id, new Set(Object.keys(registration.operations ?? {})), registration.operationInputs, manifest.entityStates, manifest.schedules);
         // #1705: after the checks above, so a refused module leaves nothing registered here.
         this.crossVertical.register(manifest, registration.imports);
         this.moduleIds.add(manifest.id);
@@ -2450,22 +2462,41 @@ export class CloudflareScopeHost {
             const startedAt = Date.now();
             let emitted;
             let failure;
+            // #119, #2096: more of a purge horizon's lap is due — the schedule stays due, so the next pass continues it.
+            let stillDue = false;
             try {
                 // The gate above already answered for this pass; a fire that meets a restarted scope
                 // is gated again by the door (#1834).
                 door ??= await this.openSystemDoor(moduleId, tenantId, scopeId, gate);
                 const scope = this.buildStub(tenantId, scopeId, undefined, undefined, door);
-                await scope.invoke(schedule.operation, schedule.input, { invocationId, onEmitted: (r) => (emitted = r) });
+                if (schedule.purge) {
+                    // #119: a purge horizon's schedule runs its operation once per due entity, each its own
+                    // call and transaction — and the SCOPE decides which are due and runs them, so purge
+                    // authority is never an argument any stub can pass (`runPurgeSweep`).
+                    const pass = await door.through((instance) => stub.runPurgeSweep(schedule.operation, tenantId, scopeId, instance));
+                    // The purges' events, delivered the way each invoke's own tail delivers them.
+                    await this.drainExecutors(tenantId, scopeId, null);
+                    stillDue = purgeStillDue(pass);
+                    const outcome = purgeReportOf(schedule.operation, schedule.purge.entityType, pass);
+                    report.errors.push(...outcome.errors);
+                    if (outcome.failure)
+                        throw outcome.failure;
+                }
+                else {
+                    await scope.invoke(schedule.operation, schedule.input, { invocationId, onEmitted: (r) => (emitted = r) });
+                }
                 report.fired += 1;
             }
             catch (err) {
                 status = 'failed';
                 failure = { error: err };
                 report.failed += 1;
-                report.errors.push({
-                    operation: schedule.operation,
-                    error: err instanceof Error ? err.message : String(err),
-                });
+                if (!schedule.purge) {
+                    report.errors.push({
+                        operation: schedule.operation,
+                        error: err instanceof Error ? err.message : String(err),
+                    });
+                }
             }
             lines.write({
                 kind: 'schedule',
@@ -2480,10 +2511,12 @@ export class CloudflareScopeHost {
                 latenessMs: lastRun === null ? null : now - dueAt,
                 ...(emitted ? { emitted } : {}),
             });
+            report.runs.push({ operation: schedule.operation, outcome: status === 'ok' ? 'ok' : 'failed' });
+            if (stillDue)
+                continue;
             // #1288: 'schedule', whatever this operation happens to be called — including
             // `freshness:<something>`, which is exactly the row the evaluator no longer eats.
             await stub.recordScheduleRun(schedule.operation, new Date(now).toISOString(), status, 'schedule', invocationId);
-            report.runs.push({ operation: schedule.operation, outcome: status === 'ok' ? 'ok' : 'failed' });
         }
         lines.end();
         return report;
@@ -2548,6 +2581,9 @@ export class CloudflareScopeHost {
                                 ? 'vertical'
                                 : undefined,
             invoke: async (operation, input, invokeOptions) => {
+                // #119: purge authority is never an invoke option — only the scope's own `runPurgeSweep`
+                // purges — and an options object naming a cutoff is refused outright.
+                assertNoCallerPurge(invokeOptions);
                 // Entitlement gate (§4.3): a module loads for a tenant only if the tenant holds its
                 // SKU flag. The COORDINATOR gates the console-managed path against the shared CP
                 // (`cp.tenantHoldsEntitlement`); for a hosted/CP-less scope that call is a trusting
@@ -2950,11 +2986,21 @@ export class CloudflareScopeHost {
             // admin log are separate, so no order makes the pair atomic; this one fails toward
             // "an intent with no recorded outcome" and never toward "a switch that moved with no
             // audit row". A retry after a crash re-audits even though it answers `changed: false`.
+            //
+            // #2089: every outcome row goes through the kernel's `recordAuditOutcome`, as the control
+            // plane's audited changes do. One that cannot be written is logged with the operation id,
+            // never swallowed; the call still answers with its own error (or, applied, with success and
+            // `auditWarning`), and the scheduled settle closes the intent as `unknown`.
             const operationId = ulid();
             const target = { tenantId, scopeId, vertical };
             const base = { operationId, ...switchAuditSubject(kind, key, to) };
             await this.recordAdmin(actor, action, target, null, { ...base, phase: 'intent', reason });
             const errorOf = (err) => (err instanceof Error ? err.message : String(err));
+            const recordOutcome = (row) => recordAuditOutcome(() => this.recordAdmin(actor, action, target, null, { ...base, ...row }), {
+                flow: `${kind}-switch`,
+                operationId,
+                phase: row.phase,
+            }, (message, fields) => console.error(message, fields));
             // #2045 (Codex r3): the deployment's fence is attested BEFORE anything is recorded or moved. An
             // ON on a deployment built before it is refused here, with nothing written anywhere but the
             // audit. An OFF goes on: the kill switch must work on every deployment (see `UnattestedSwitch`).
@@ -2964,7 +3010,7 @@ export class CloudflareScopeHost {
                 }
             }
             catch (err) {
-                await this.recordAdmin(actor, action, target, null, { ...base, phase: 'refused', error: errorOf(err) }).catch(() => undefined);
+                await recordOutcome({ phase: 'refused', error: errorOf(err) });
                 throw err;
             }
             // The directory's record (#1674; #2029 for a peer), written BEFORE the scope moves, both
@@ -2982,13 +3028,13 @@ export class CloudflareScopeHost {
                 // Nothing has moved: fail the call here, audited. An ON must not switch a scope on
                 // whose record still says off (the next reconcile would switch it back off), and an
                 // OFF must not leave a scope off that the record does not know of (#1823).
-                await this.recordAdmin(actor, action, target, null, { ...base, phase: 'failed', error: errorOf(err) }).catch(() => undefined);
+                await recordOutcome({ phase: 'failed', error: errorOf(err) });
                 throw err;
             }
             // #2045: a newer call on this subject has recorded its position already: this one writes
             // nothing, here or in the scope, and says so.
             if (recordWriteSuperseded(prior, record)) {
-                await this.recordAdmin(actor, action, target, null, { ...base, phase: 'refused', superseded: true });
+                await recordOutcome({ phase: 'refused', superseded: true });
                 throw substratError('conflict', switchSupersededMessage(kind, scopeId, key, to));
             }
             let outcome;
@@ -3010,13 +3056,12 @@ export class CloudflareScopeHost {
                 // readback can settle the scope and nothing is put back: the record is this call's position
                 // under the newest fence, and its write-ahead mark makes the next re-assert move the scope
                 // to it, under that fence, whichever way it lies now.
-                await this.recordAdmin(actor, action, target, null, {
-                    ...base,
+                await recordOutcome({
                     phase: err instanceof UnattestedSwitch ? 'refused' : 'failed',
                     error: errorOf(err),
                     recordKept: true,
                     reassertOwed: true,
-                }).catch(() => undefined);
+                });
                 if (err instanceof UnattestedSwitch)
                     throw substratError('precondition_failed', err.message);
                 throw err;
@@ -3025,7 +3070,7 @@ export class CloudflareScopeHost {
             // record is that newer call's too (its write overwrote this one's, mark included), so nothing
             // is undone and no mark is this call's to clear.
             if (outcome.superseded) {
-                await this.recordAdmin(actor, action, target, null, { ...base, phase: 'refused', superseded: true });
+                await recordOutcome({ phase: 'refused', superseded: true });
                 throw substratError('conflict', switchSupersededMessage(kind, scopeId, key, to));
             }
             // A call that held nothing moved nothing, so its record write is undone: left `off`, it
@@ -3052,8 +3097,7 @@ export class CloudflareScopeHost {
             else if (!unfenced) {
                 owedError = await this.cp.clearSwitchOwed(kind, tenantId, scopeId, key, operationId).then(() => null, errorOf);
             }
-            await this.recordAdmin(actor, action, target, null, {
-                ...base,
+            const unrecorded = await recordOutcome({
                 phase: outcome.held ? 'applied' : 'refused',
                 changed: outcome.changed,
                 permissions: outcome.permissions,
@@ -3065,30 +3109,32 @@ export class CloudflareScopeHost {
                 throw substratError('not_found', switchNotFoundMessage(kind, scopeId, key, to) +
                     (recordError ? `; and its directory record could not be put back (${recordError})` : ''));
             }
-            return { operationId, outcome };
+            return { operationId, outcome, ...(unrecorded !== null ? { auditWarning: auditWarningOf('the switch', unrecorded) } : {}) };
         };
         /** #1666: move one module's schedule switch on one scope — see `HostAdmin.revokeFromSystem`. */
         const switchSystem = async (actor, raw, to) => {
             const input = systemSwitch.parse(raw);
-            const { operationId, outcome } = await switchSubjectAt(actor, 'system', input.node, input.moduleId, input.reason, to);
+            const { operationId, outcome, auditWarning } = await switchSubjectAt(actor, 'system', input.node, input.moduleId, input.reason, to);
             return {
                 operationId,
                 moduleId: input.moduleId,
                 schedules: to,
                 changed: outcome.changed,
                 permissions: outcome.permissions,
+                ...(auditWarning ? { auditWarning } : {}),
             };
         };
         /** #1706: move one PEER's kill switch on one scope — see `HostAdmin.revokeFromPeer`. */
         const switchPeerAt = async (actor, raw, to) => {
             const input = peerSwitch.parse(raw);
-            const { operationId, outcome } = await switchSubjectAt(actor, 'peer', input.node, input.vertical, input.reason, to);
+            const { operationId, outcome, auditWarning } = await switchSubjectAt(actor, 'peer', input.node, input.vertical, input.reason, to);
             return {
                 operationId,
                 vertical: input.vertical,
                 calls: to,
                 changed: outcome.changed,
                 permissions: outcome.permissions,
+                ...(auditWarning ? { auditWarning } : {}),
             };
         };
         /**
@@ -3355,6 +3401,8 @@ export class CloudflareScopeHost {
             return result;
         };
         return {
+            // #2069: a view of the view this admin was built over — the person added, its event kept.
+            attributed: (onBehalfOf) => this.attributed(onBehalfOf).admin,
             // #603: fixed at construction — a worker deployed without SECRET_BOX_KEY can never
             // store a credential, and saying so is what lets a transport answer 503 instead of 500.
             canStoreSecrets: isSecretBoxConfigured(this.secretBox),
@@ -3427,6 +3475,17 @@ export class CloudflareScopeHost {
                 if (!grant.node.scopeId)
                     await this.fanOut(grant.node.tenantId);
             },
+            grantEntityShape: async (actor, grant) => {
+                await this.grantEntityShapeLocal(grant.node.scopeId, grant.principalId, grant.entity, grant.permissions);
+                await this.recordAdmin(actor, 'grantEntityShape', grant.node, null, grant);
+            },
+            reconcileEntityGrantShapes: async (actor, node, shapes, opts) => {
+                const { toppedUp, retired } = await this.topUpEntityGrantShapesLocal(node.tenantId, node.scopeId, shapes, opts?.batch);
+                if (toppedUp > 0 || retired > 0) {
+                    await this.recordAdmin(actor, 'reconcileEntityGrantShapes', node, null, { shapes, toppedUp, retired });
+                }
+                return { toppedUp, retired };
+            },
             grantToConnection: async (actor, raw) => {
                 const grant = connectionGrant.parse(raw);
                 const conn = await this.cp.readConnection(grant.connectionId);
@@ -3683,6 +3742,23 @@ export class CloudflareScopeHost {
             // #1706: the directory's answer to "vertical Y in tenant T", in the ControlPlaneDO, by
             // the kernel's one rule. No actor, not logged — `resolveHostname`'s machine-path reason.
             resolveVerticalInstance: async (tenantId, vertical) => verticalResolution.parse(await this.cp.resolveVerticalInstance(tenantId, verticalSlug.parse(vertical))),
+            resolvePeerInstance: async (tenantId, callerScopeId, vertical) => peerInstanceResolution.parse(await this.cp.resolvePeerInstance(tenantId, callerScopeId, verticalSlug.parse(vertical))),
+            peerBinding: async (actor, tenantId, callerScopeId, vertical) => {
+                const row = await this.cp.peerBinding(tenantId, callerScopeId, verticalSlug.parse(vertical));
+                await this.recordAccess(actor, 'peerBinding', { tenantId, scopeId: callerScopeId }, { vertical }, row ? 1 : 0);
+                return row ? peerBindingSchema.parse({ tenantId, callerScopeId, vertical, targetScopeId: row.target_scope_id, invalidated: row.invalidated === 1 }) : undefined;
+            },
+            peerBindings: async (actor, tenantId, callerScopeId) => {
+                const rows = await this.cp.peerBindings(tenantId, callerScopeId);
+                await this.recordAccess(actor, 'peerBindings', { tenantId, scopeId: callerScopeId }, null, rows.length);
+                return rows.map((r) => peerBindingSchema.parse({ tenantId, callerScopeId, vertical: r.vertical, targetScopeId: r.target_scope_id, invalidated: r.invalidated === 1 }));
+            },
+            setPeerBinding: async (_actor, tenantId, callerScopeId, vertical, targetScopeId) => {
+                const answer = await this.cp.setPeerBinding(tenantId, callerScopeId, verticalSlug.parse(vertical), targetScopeId);
+                if (!answer.ok)
+                    throw substratError(answer.code, answer.message);
+                return { changed: answer.changed, previous: answer.previous };
+            },
             resolveHostname: async (raw) => 
             // The router's per-request read. No actor, not logged — the same machine-path
             // carve-out resolveIdentity has (K-24). Shares its mapping with the router's
@@ -3708,6 +3784,9 @@ export class CloudflareScopeHost {
                 // Declared email-sender intent (#303) — the request half; the grant is its own column.
                 if (parsed.sendsEmail)
                     installSpec.sendsEmail = parsed.sendsEmail;
+                // Where the scope lifecycle is held (#1713) — read by the lifecycle delivery's targets.
+                if (parsed.lifecycle)
+                    installSpec.lifecycle = parsed.lifecycle;
                 const installSpecJson = Object.keys(installSpec).length ? JSON.stringify(installSpec) : null;
                 const existing = await this.cp.readVertical(parsed.slug);
                 if (existing) {
@@ -4710,6 +4789,12 @@ export class CloudflareScopeHost {
                 // Both spine copies (#1600): the outbox row AND any platform intent this event was
                 // routed into. One RPC, so a crash cannot land half of it.
                 const redacted = await this.scopeStub(scopeId).redactSubject(subjectId);
+                // A refusal answered as data (#2068) — a module's `onSubjectErased` hook threw or reached
+                // past its own tables, and the DO rolled the whole redaction back. Rethrown with its code,
+                // before the key.
+                if (typeof redacted === 'object' && 'failure' in redacted && redacted.failure) {
+                    throw fromWireFailure(redacted.failure);
+                }
                 // An OLD ScopeDO answers with a bare number — it redacted the outbox and never
                 // looked at the intent journal. Refused here, BEFORE the key is destroyed, and
                 // that order is the whole point: the key is the irreversible half, so proceeding
@@ -4742,7 +4827,16 @@ export class CloudflareScopeHost {
                         `or a queued sweep-runs intent — erasing now would destroy the subject key while ` +
                         `leaving their data in those rows. Redeploy the vertical and re-run.`);
                 }
-                const { events: eventsRedacted, intents: intentsRedacted, jobRuns: jobRunsRedacted, idempotencyResults, intentIds, } = redacted;
+                // A DO from before the module half (#2068): it redacted the spine and never ran a
+                // module's declared erasure or its `onSubjectErased` hook. Refused before the key, for
+                // the reason above — its reply read as "no module rows" would receipt an erasure that
+                // left the person in the vertical's own tables, with the key already gone.
+                if (!('vertical' in redacted) || !isModuleErasureCounts(redacted.vertical)) {
+                    throw substratError('unavailable', `scope ${scopeId} runs a ScopeDO from before #2068, whose redaction does not reach a module's ` +
+                        `own tables — erasing now would destroy the subject key while leaving their data in the ` +
+                        `vertical's rows. Redeploy the vertical and re-run.`);
+                }
+                const { events: eventsRedacted, intents: intentsRedacted, jobRuns: jobRunsRedacted, idempotencyResults, intentIds, vertical, } = redacted;
                 // The directory's failure text (#1632) — a drain failure quoting one of those intents,
                 // an issue's exemplar, a sweep record's error. Still before the key.
                 await this.cp.redactSubjectText({ tenantId, scopeId, subjectId, intentIds });
@@ -4753,6 +4847,7 @@ export class CloudflareScopeHost {
                     eventsRedacted,
                     intentsRedacted,
                     jobRunsRedacted,
+                    ...vertical,
                     keyDestroyed: existed,
                     tombstoned: true,
                 });
@@ -4762,7 +4857,7 @@ export class CloudflareScopeHost {
                 await this.recordAdmin(actor, 'shredSubject', { tenantId, scopeId }, null, receipt);
                 // BOTH counts: the access log's number is "how much evidence this destroyed", and
                 // an intent payload is a whole event's worth of it.
-                await this.recordAccess(actor, 'shredSubject', { tenantId, scopeId }, { subjectId }, eventsRedacted + intentsRedacted + jobRunsRedacted + idempotencyResults);
+                await this.recordAccess(actor, 'shredSubject', { tenantId, scopeId }, { subjectId }, eventsRedacted + intentsRedacted + jobRunsRedacted + idempotencyResults + moduleRowsErased(vertical));
                 return receipt;
             },
             // -- impersonation (K-42, #868) ----------------------------------------
@@ -5005,12 +5100,12 @@ export class CloudflareScopeHost {
                     throw new Error(`connection not found: ${id}`);
                 const sealed = await this.secretBox.seal(JSON.stringify(connectionSecret.parse(secret)));
                 const now = new Date().toISOString();
-                await this.cp.updateConnectionSecret(id, sealed.keyId, sealed.ciphertext, expiresAt ?? row.expires_at, now);
+                await this.cp.updateConnectionSecret(id, sealed.keyId, sealed.ciphertext, expiresAt === undefined ? row.expires_at : expiresAt, now);
                 await this.recordAdmin(actor, 'updateConnectionSecret', { tenantId: row.tenant_id, vertical: row.vertical }, null, {
                     id,
                     provider: row.provider,
                     rotatedAt: now,
-                    expiresAt: expiresAt ?? row.expires_at,
+                    expiresAt: expiresAt === undefined ? row.expires_at : expiresAt,
                     // §3.5.1's attribution, rotate-side: the authorizing tenant principal,
                     // never laundered into the actor column.
                     ...(opts?.rotatedBy ? { rotatedBy: opts.rotatedBy } : {}),
@@ -5026,6 +5121,55 @@ export class CloudflareScopeHost {
                     return; // idempotent, and a no-op is not audited
                 await this.recordAdmin(actor, 'revokeConnection', { tenantId: row.tenant_id, vertical: row.vertical }, { status: row.status }, { id, provider: row.provider, status: 'revoked', revokedAt: now });
             },
+            // -- a vertical's mailed connect links (connections.md §3.5.4) --------------
+            // Parsed here, run in the ControlPlaneDO as the kernel's statements (shared with
+            // the pure adapter). Each move writes its audit row in the DO's own unit, from the
+            // row minted here (actor, attribution) — so a failed audit write rolls the move back.
+            // The DO has no clock of its own on this path — `now` is the coordinator's, the same
+            // wall clock every other directory write uses.
+            mintConnectLink: async (actor, raw) => {
+                const input = mintConnectLinkInput.parse(raw);
+                return this.cp.insertConnectLink({
+                    id: ulid(),
+                    tenantId: input.tenantId,
+                    scopeId: input.scopeId,
+                    vertical: input.vertical,
+                    provider: input.provider,
+                    createdBy: input.createdBy,
+                    subjectRef: input.subjectRef ?? null,
+                    returnUrl: input.returnUrl ?? null,
+                    createdAt: new Date().toISOString(),
+                    expiresAt: input.expiresAt,
+                }, this.adminEntry(actor, 'mintConnectLink', { tenantId: input.tenantId }, null, null));
+            },
+            getConnectLink: async (actor, raw) => {
+                const key = connectLinkKey.parse(raw);
+                const link = await this.cp.readConnectLink(key);
+                await this.recordAccess(actor, 'getConnectLink', key, { id: key.id }, link ? 1 : 0);
+                return link;
+            },
+            listConnectLinks: async (actor, raw) => {
+                const filter = connectLinkFilter.parse(raw);
+                const links = await this.cp.listConnectLinks(filter, new Date().toISOString());
+                await this.recordAccess(actor, 'listConnectLinks', filter, filter, links.length);
+                return links;
+            },
+            revokeConnectLink: async (actor, raw) => {
+                const key = connectLinkKey.parse(raw);
+                // Idempotent, and a no-op is not audited (the statement hands back no row for one).
+                const audit = this.adminEntry(actor, 'revokeConnectLink', { tenantId: key.tenantId }, null, null);
+                return (await this.cp.revokeConnectLink(key, audit))?.link;
+            },
+            consumeConnectLink: async (actor, raw) => {
+                const input = consumeConnectLinkInput.parse(raw);
+                const audit = this.adminEntry(actor, 'consumeConnectLink', { tenantId: input.tenantId }, null, null);
+                return this.cp.consumeConnectLink(input, new Date().toISOString(), audit);
+            },
+            restoreConnectLink: async (actor, raw) => {
+                const key = connectLinkKey.parse(raw);
+                const audit = this.adminEntry(actor, 'restoreConnectLink', { tenantId: key.tenantId }, null, null);
+                return (await this.cp.restoreConnectLink(key, new Date().toISOString(), audit)) !== undefined;
+            },
             openConnection: async (tenantId, vertical, provider, externalAccountRef) => {
                 const row = await this.cp.readLiveConnection(tenantId, vertical, provider, externalAccountRef);
                 if (!row)
@@ -5127,6 +5271,18 @@ export class CloudflareScopeHost {
                 const { tenantId, scopeId, ...after } = memberChangeAudit.parse(entry);
                 await this.recordAdmin(actor, 'manageScopeMember', { tenantId, scopeId }, null, after);
             },
+            recordPeerBindingChange: async (actor, entry) => {
+                const { tenantId, scopeId, ...after } = peerBindingAudit.parse(entry);
+                await this.recordAdmin(actor, 'setPeerBinding', { tenantId, scopeId }, null, after);
+            },
+            /** #2064: an audited operation's rows, by the operation-id index, in bounded batches. */
+            auditedOperations: async (actor, refs) => {
+                const rows = await this.cp.auditedOperations([...refs]);
+                await this.recordAccess(actor, 'auditedOperations', {}, { operations: refs.length }, rows.length);
+                return rows;
+            },
+            /** #2064: settle an intent with no outcome — one unit in the directory DO. */
+            settleUnrecordedOutcome: (actor, input) => this.cp.settleUnrecordedOutcome({ actor, intentId: input.intentId, error: input.error }),
             /** #2005: one change to a scope's copy marker, written around the vertical's own change. */
             recordCopyMark: async (actor, entry) => {
                 const { tenantId, scopeId, action, ...after } = copyMarkAudit.parse(entry);
@@ -5724,7 +5880,7 @@ export class CloudflareScopeHost {
         }));
     }
     async writeScopeTuple(scopeId, subject, relation, object, expiresAt) {
-        await this.scopeStub(scopeId).writeTuple(subject, relation, object, expiresAt);
+        unwrapReply(await this.scopeStub(scopeId).writeTuple(subject, relation, object, expiresAt));
     }
     /**
      * The connection's CURRENT public sealing key, minted on first ask (#687).
@@ -6115,11 +6271,17 @@ export class CloudflareScopeHost {
      * arrive as a different class of answer just because the caller asked for a socket.
      */
     liveReads = {
-        subscribe: async ({ tenantId, scopeId, principal, request, within }) => {
+        subscribe: async ({ tenantId, scopeId, principal, request, within, expiresAt }) => {
             // Decided before anything else, and thrown: a `within` that is neither a plain
             // EntityRef nor a value `vouchedWithin` built is a caller bug, and the two ways of
             // guessing at it both open a feed wider than was asked for (#1853).
             const narrowed = liveWithinOf(within);
+            // The same for an expiry that is not an instant: read as "none", it would keep the
+            // socket open past the session it was meant to end with (#938).
+            const expires = expiresAt === undefined ? undefined : liveInstant(expiresAt);
+            if (expiresAt !== undefined && !expires) {
+                throw substratError('validation_failed', 'live reads: `expiresAt` must be an ISO 8601 instant');
+            }
             if (!isUpgradeRequest(request)) {
                 return new Response('live reads are a WebSocket surface', {
                     status: 426,
@@ -6181,6 +6343,10 @@ export class CloudflareScopeHost {
                 headers.set(LIVE_WITHIN_HEADER, encodeLiveWithin(narrowed));
             else
                 headers.delete(LIVE_WITHIN_HEADER);
+            if (expires)
+                headers.set(LIVE_EXPIRES_HEADER, expires);
+            else
+                headers.delete(LIVE_EXPIRES_HEADER);
             const forwarded = new Request(new URL(LIVE_SUBSCRIBE_PATH, 'https://scope.substrat.internal'), 
             // `new Request(url, { …, headers })` rather than `new Request(request, …)`:
             // the DO is addressed by its own path, not the client's, and the upgrade
@@ -6438,6 +6604,8 @@ export class CloudflareScopeHost {
         // #1742: the recorded-off modules and (#2029) peers, switched off after the seat in the
         // same unit, on the scope this call provisions — the one the seat's tuples name.
         carry ? { scopeId: input.scopeId, at: new Date().toISOString(), ...carry } : undefined, services?.map((id) => `principal:${id}`)));
+        if (input.entityGrants)
+            await this.topUpEntityGrantShapesLocal(input.tenantId, input.scopeId, input.entityGrants);
         return carry ? { switchedOff } : {};
     }
     /**
@@ -6463,7 +6631,7 @@ export class CloudflareScopeHost {
      * already projected (via `provisionScopeLocal`), or the local checker expands it to nothing.
      */
     async assignScopeRole(scopeId, principal, roleKey) {
-        await this.scopeStub(scopeId).writeTuple(`principal:${principal}`, `role:${roleKey}`, `scope:${scopeId}`, null);
+        unwrapReply(await this.scopeStub(scopeId).writeTuple(`principal:${principal}`, `role:${roleKey}`, `scope:${scopeId}`, null));
     }
     /**
      * Take a scope-level role back — the counterpart `assignScopeRole` went without (#1161).
@@ -6522,8 +6690,41 @@ export class CloudflareScopeHost {
      * (writeTuple is INSERT OR REPLACE), so it is safe to re-issue on every link.
      */
     async grantEntityLocal(scopeId, principal, permission, entity) {
-        await this.scopeStub(scopeId).writeTuple(`principal:${principal}`, `granted:${permission}`, entityObjectRef(entity, 'grantEntityLocal'), // #1856
-        null);
+        unwrapReply(await this.scopeStub(scopeId).writeTuple(`principal:${principal}`, `granted:${permission}`, entityObjectRef(entity, 'grantEntityLocal'), // #1856
+        null));
+    }
+    /**
+     * Give a person a declared entity-grant SHAPE on one entity in a CP-less vertical (#2071) —
+     * `grantEntityLocal` for every key of the shape, plus the marker that makes them a holder of
+     * it, in one unit. What a vertical calls where it used to loop `grantEntityLocal` over its
+     * `ENTITY_GRANTS` keys: a key the shape gains later then reaches this person at the next
+     * provision or reconcile (`provisionScopeLocal`'s `entityGrants`). Idempotent, and explicit
+     * like `grantEntityLocal`: it brings back a key or a marker a revoke tombstoned.
+     */
+    async grantEntityShapeLocal(scopeId, principal, entity, permissions) {
+        await this.scopeStub(scopeId).grantEntityShape(principal, entity, permissions);
+    }
+    /**
+     * Top every holder of each declared shape up to the shape as it is now (#2071), in bounded
+     * passes — at most `batch` rows of work per scope transaction (default 500, at most 5000;
+     * anything else is `validation_failed`), repeated until a pass finishes. Never re-grants a revoked
+     * key; takes back only a key the shape declares `retired` (#2082). Returns how many
+     * (person, entity) it topped up, and how many it took retired keys from.
+     */
+    async topUpEntityGrantShapesLocal(tenantId, scopeId, shapes, batch) {
+        const limit = shapeTopUpBatch(batch);
+        let toppedUp = 0;
+        let retired = 0;
+        if (shapes.length === 0)
+            return { toppedUp, retired };
+        const stub = this.scopeStub(scopeId);
+        for (let done = false; !done;) {
+            const pass = await stub.topUpEntityGrantShapes(tenantId, scopeId, shapes, limit);
+            toppedUp += pass.toppedUp;
+            retired += pass.retired;
+            done = pass.done;
+        }
+        return { toppedUp, retired };
     }
     // -- the connector write-back's far end (#574) -----------------------------
     // A CP-less dispatch vertical cannot run a connector, so the shared control
@@ -6722,10 +6923,21 @@ export class CloudflareScopeHost {
         if (!delegation)
             this.assertServedHere(rec, scopeId, 'moveImportCursor');
         await this.validateScopeAccess(tenantId, scopeId);
+        // #2114: the replay's id is also its audit `operationId`, so the scheduled settle pairs and
+        // closes the lever's rows exactly as it does the kill switches'.
         const replayId = ulid();
         const target = { tenantId, scopeId, vertical: rec.vertical };
-        const base = { replayId, mode: move.mode, from: move.from, source: source.scopeId };
+        const base = { operationId: replayId, replayId, mode: move.mode, from: move.from, source: source.scopeId };
         await this.recordAdmin(actor, 'moveImportCursor', target, null, { ...base, phase: 'intent', reason: move.reason });
+        // #2114: every outcome row goes through the kernel's `recordAuditOutcome`, as the kill
+        // switches' do (#2089). One that cannot be written is logged with the replay id, never
+        // swallowed; the call still answers with the move's own error (or, applied, with the move and
+        // `auditWarning`), and the scheduled settle closes the intent as `unknown`.
+        const recordOutcome = (row) => recordAuditOutcome(() => this.recordAdmin(actor, 'moveImportCursor', target, null, { ...base, ...row }), {
+            flow: 'import-cursor',
+            operationId: replayId,
+            phase: row.phase,
+        }, (message, fields) => console.error(message, fields));
         const at = { move, source: source, replayId };
         let moved;
         try {
@@ -6734,21 +6946,16 @@ export class CloudflareScopeHost {
                 : await this.moveInScope(scopeId, at);
         }
         catch (err) {
-            await this.recordAdmin(actor, 'moveImportCursor', target, null, {
-                ...base,
-                phase: 'failed',
-                error: err instanceof Error ? err.message : String(err),
-            }).catch(() => undefined);
+            await recordOutcome({ phase: 'failed', error: err instanceof Error ? err.message : String(err) });
             throw err;
         }
-        await this.recordAdmin(actor, 'moveImportCursor', target, null, {
-            ...base,
+        const unrecorded = await recordOutcome({
             phase: 'applied',
             previous: moved.previous,
             cursor: moved.cursor,
             archived: moved.archived,
         });
-        return moved;
+        return unrecorded === null ? moved : { ...moved, auditWarning: auditWarningOf('the move', unrecorded) };
     }
     /** #1705 PR 3: the promote gate's question, over two stored manifests (`exportBreaksOf`). */
     exportBreaksBetween(actor, producer, outgoingManifest, incomingManifest) {