@substrat-run/adapter-cloudflare 0.141.0 → 0.143.0

package/dist/host.js

@@ -1,9 +1,9 @@
 import { env as ambientEnv } from 'cloudflare:workers';
 import { isRewindRefusal, REWIND_REFUSED } from './rewind-refusal.js';
 import { isSystemDoorMoved, SYSTEM_DOOR_MOVED, SYSTEM_DOOR_REGATES } from './system-door.js';
-import { delegatedReadParams, operationSeriesCount, fromWireFailure, isSubstratError, exportReadInput, exportedBatch, importBatch, importResult, importState, importsOfManifestJson, exportsOfManifestJson, importCursorMove, importCursorMoveAt, importCursorMoved, accessLogEntry, adminLogEntry, opsFailureEntry, opsFailureFingerprint, issueEntry, findingEntry, findingRuleEntry, sweepRunEntry, FRESHNESS_HEARTBEAT_MINUTES, sweepRunsPayload, modelUsageEntry, attachmentRecord, createTenantInput, identityLink, identityPool, createOrgInput, promotionAcknowledgement, bindAcknowledgement, bindHostnameInput, channelHistoryEntry, hostnameBinding, publishVersionInput, AUTO_ADMISSION_NOTE, registerVerticalInput, vertical as verticalSchema, verticalServingState, verticalChannel, verticalVersion, connection, capabilityExchange, mintedCapability, capabilityGrant, principalId, connectionGrant, connectionGrantRecord, connectionSecret, systemGrant, systemSwitch, systemSwitchOutcome, systemScheduleEntry, systemSwitchRecord, entitlementGrant, entitlementGrantInput, capabilityFilter, instant, meterReading, subjectRef, createConnectionInput, connectLinkFilter, connectLinkKey, consumeConnectLinkInput, mintConnectLinkInput, projectedConnectionGrant, projectedConnectionKey, moduleManifest, org as orgSchema, orgMembership, resolvedIdentity, identityMembership, roleDefinition, scope as scopeSchema, tenant as tenantSchema, tenantRole, delegatedReadRecord, ownerTransferAudit, memberChangeAudit, peerBindingAudit, copyMarkAudit, subjectShredReceipt, connectorDispatchKind, callsOfManifestJson, outboundOfManifestJson, SCOPE_GATE_REASONS, substratError, redrainEventsInput, coverage, peerCoverage, peerGrantsEntry, peerSwitch, peerSwitchOutcome, verticalCaller, verticalResolution, peerInstanceResolution, peerBinding as peerBindingSchema, verticalSlug, entityObjectRef, ATTACHMENT_BLOB_BINDING, blobStoreBindingName, lifecycleDelivery, scopeLifecycle, } from '@substrat-run/contracts';
+import { delegatedReadParams, operationSeriesCount, fromWireFailure, isSubstratError, exportReadInput, exportedBatch, importBatch, importResult, importState, importsOfManifestJson, exportsOfManifestJson, importCursorMove, importCursorMoveAt, importCursorMoved, accessLogEntry, adminLogEntry, opsFailureEntry, opsFailureFingerprint, issueEntry, findingEntry, findingRuleEntry, sweepRunEntry, FRESHNESS_HEARTBEAT_MINUTES, sweepRunsPayload, modelUsageEntry, attachmentRecord, createTenantInput, identityLink, identityPool, createOrgInput, promotionAcknowledgement, bindAcknowledgement, bindHostnameInput, channelHistoryEntry, hostnameBinding, publishVersionInput, AUTO_ADMISSION_NOTE, registerVerticalInput, vertical as verticalSchema, verticalServingState, verticalChannel, verticalVersion, connection, capabilityExchange, mintedCapability, boundedBecomeMint, boundedBecomeRevoke, becomeLinkState, principalBecomeCapabilityInput, capabilityGrant, principalId, connectionGrant, connectionGrantRecord, connectionSecret, systemGrant, systemSwitch, systemSwitchOutcome, systemScheduleEntry, systemSwitchRecord, entitlementGrant, entitlementGrantInput, capabilityFilter, instant, meterReading, scopeStorageSample, subjectRef, createConnectionInput, connectLinkFilter, connectLinkKey, consumeConnectLinkInput, mintConnectLinkInput, projectedConnectionGrant, projectedConnectionKey, moduleManifest, org as orgSchema, orgMembership, resolvedIdentity, identityMembership, roleDefinition, scope as scopeSchema, tenant as tenantSchema, tenantRole, delegatedReadRecord, ownerTransferAudit, memberChangeAudit, peerBindingAudit, copyMarkAudit, subjectShredReceipt, connectorDispatchKind, callsOfManifestJson, outboundOfManifestJson, SCOPE_GATE_REASONS, substratError, redrainEventsInput, coverage, peerCoverage, peerGrantsEntry, peerSwitch, peerSwitchOutcome, verticalCaller, verticalResolution, peerInstanceResolution, peerBinding as peerBindingSchema, verticalSlug, entityObjectRef, ATTACHMENT_BLOB_BINDING, blobStoreBindingName, lifecycleDelivery, scopeLifecycle, } from '@substrat-run/contracts';
 import { normalizeHostname, toRouteTarget } from './route-resolver.js';
-import { attachmentBlobKey, attachmentSha256, entitlementDenial, requiredEntitlementFor, foldMeterReading, parseValidationRecords, resolveScopeRecord, ulid, KEPT_COPY_REFUSAL, capabilityTokenHash, checkBecomeInput, plausibleSessionToken, foldModelUsage, backoffAt, resolveRetryPolicy, executorOutcomeOf, isDeliveryRefusal, refusalJournalText, isSecretBoxConfigured, unconfiguredSecretBox, createSubjectKeys, generateSealingKeyPair, openSealed, ImpersonationRefused, assertSessionUsable, impersonationRowValues, mapImpersonationRow, newImpersonationSession, jobRunOf, assertLeaseMs, runDueJobRuns, SYSTEM_DOOR_WAIT, startJobRun, attachmentTextJob, assertAttachmentExtractors, resolveAttachmentTextBounds, assertJobRegistrable, ATTACHMENT_TEXT_BACKFILL_JOB, ATTACHMENT_TEXT_JOB, kernelJobFor, attachmentTextBackfillJob, searchLimit, searchMatchExpression, globalFetch, assertRedrainWindow, platformRequestOf, undrainedEventsOf, inUnitMovesToAudit, staleCarryRevertRow, staleCarryReverts, recordedOffFromWire, peerSubjectRef, SWITCH_KINDS, reassertActionOf, reassertEntry, reassertOffRow, reassertOnRow, switchActionOf, switchAuditSubject, recordAuditOutcome, auditWarningOf, switchNotFoundMessage, recordWriteSuperseded, switchSubjectOf, switchSupersededMessage, withRecorded, systemSwitchedOffMessage, tenantSystemSwitchedOffMessage, CrossVerticalRegistry, importCursorSourceOf, exportBreaksOf, exportBreakRefusal, bindExportBreaksOf, bindExportBreakRefusal, collectPeers, peerSeats, connectorCallRecord, noopConnectorCallRecorder, recordConnectorCall, settleConnectionUse, splitManifestMigrations, unknownRoleError, assertRowLimit, assertRowOffset, emptyImportResult, INERT_SCOPE_REASON, lifecycleReceipt, lifecycleRefusal, isPrimaryScope, isPrimaryScopeRow, asyncInvocationId, asyncLinePass, assertNoCallerPurge, purgeReportOf, purgeStillDue, registerTrashTargets, memberAddedAudit, shapeTopUpBatch, } from '@substrat-run/kernel';
+import { attachmentBlobKey, attachmentSha256, entitlementDenial, requiredEntitlementFor, foldMeterReading, parseValidationRecords, resolveScopeRecord, ulid, KEPT_COPY_REFUSAL, capabilityTokenHash, checkBecomeInput, assertBecomeLinkStateIds, plausibleSessionToken, foldModelUsage, backoffAt, resolveRetryPolicy, executorOutcomeOf, isDeliveryRefusal, refusalJournalText, isSecretBoxConfigured, unconfiguredSecretBox, createSubjectKeys, generateSealingKeyPair, openSealed, ImpersonationRefused, assertSessionUsable, impersonationRowValues, mapImpersonationRow, newImpersonationSession, jobRunOf, assertLeaseMs, runDueJobRuns, SYSTEM_DOOR_WAIT, startJobRun, attachmentTextJob, assertAttachmentExtractors, resolveAttachmentTextBounds, assertJobRegistrable, ATTACHMENT_TEXT_BACKFILL_JOB, ATTACHMENT_TEXT_JOB, kernelJobFor, attachmentTextBackfillJob, searchLimit, searchMatchExpression, globalFetch, assertRedrainWindow, platformRequestOf, undrainedEventsOf, inUnitMovesToAudit, staleCarryRevertRow, staleCarryReverts, recordedOffFromWire, peerSubjectRef, SWITCH_KINDS, reassertActionOf, reassertEntry, reassertOffRow, reassertOnRow, switchActionOf, switchAuditSubject, recordAuditOutcome, auditedCapabilityRevoke, auditWarningOf, switchNotFoundMessage, recordWriteSuperseded, switchSubjectOf, switchSupersededMessage, withRecorded, systemSwitchedOffMessage, tenantSystemSwitchedOffMessage, CrossVerticalRegistry, importCursorSourceOf, exportBreaksOf, exportBreakRefusal, bindExportBreaksOf, bindExportBreakRefusal, collectPeers, peerSeats, connectorCallRecord, noopConnectorCallRecorder, recordConnectorCall, settleConnectionUse, splitManifestMigrations, unknownRoleError, assertRowLimit, assertRowOffset, emptyImportResult, INERT_SCOPE_REASON, lifecycleReceipt, lifecycleRefusal, isPrimaryScope, isPrimaryScopeRow, asyncInvocationId, asyncLinePass, assertNoCallerPurge, purgeReportOf, purgeStillDue, assertBoundOperations, registerTrashTargets, memberAddedAudit, shapeTopUpBatch, } from '@substrat-run/kernel';
 import { COPY_RESTORE_FENCE_LAPSED, scopeScriptCopyOf } from '@substrat-run/kernel';
 import { attributedView, isModuleErasureCounts, moduleErasurePlan, moduleRowsErased } from '@substrat-run/kernel';
 import { isOrangeToOrange, isUpgradeRequest, LIVE_MODE_HEADER, LIVE_PRINCIPAL_HEADER, LIVE_SCOPE_HEADER, LIVE_SUBSCRIBE_PATH, LIVE_TENANT_HEADER, LIVE_WITHIN_HEADER, LIVE_EXPIRES_HEADER, liveInstant, encodeLiveWithin, liveWithinOf, } from './live-reads.js';
@@ -314,6 +314,7 @@ export class CloudflareScopeHost {
     peerSwitchDelegation;
     /** #1705 PR 3: the replay lever's reach into the deployment serving a consumer scope. */
     importCursorDelegation;
+    capabilityDelegation;
     /**
      * #1819: the last read of the rewind hold, and when it was taken (before the read went out).
      * Per instance, so per pass: the host is built per request, and never outlives one.
@@ -359,6 +360,7 @@ export class CloudflareScopeHost {
         this.lifecycleDelegation = options.lifecycleDelegation;
         this.peerSwitchDelegation = options.peerSwitchDelegation;
         this.importCursorDelegation = options.importCursorDelegation;
+        this.capabilityDelegation = options.capabilityDelegation;
         this.admin = this.buildAdmin();
     }
     // -- registration mechanics (validation only) -----------------------------
@@ -770,7 +772,7 @@ export class CloudflareScopeHost {
     async listPlatformRequests(tenantId, scopeId) {
         await this.validateScopeAccess(tenantId, scopeId);
         await this.migrateAndRecord(scopeId);
-        // Tolerant (#1588): one undecodable row comes back naming why, never throws for the list.
+        // Tolerant (#1588, #1637): an undecodable row comes back naming why, never throws for the list.
         return (await this.scopeStub(scopeId).pendingPlatformRequests()).map(platformRequestOf);
     }
     async listPlatformRequestHistory(tenantId, scopeId, filter) {
@@ -905,12 +907,13 @@ export class CloudflareScopeHost {
     }
     /**
      * The platform's revoke on the CP-less path (#1686) — how a re-minted claim link retires the
-     * previous one. True when the scope held the capability (revoked now, or already); false when
-     * it holds no such capability. No lifecycle gate: a revoke only narrows, so a held scope still
-     * takes one. Idempotent.
+     * previous one, and the far end of the operator's revoke (`CapabilityDelegation`, behind
+     * `/internal/capabilities/revoke`). The record as it stood before (revoked now, or already),
+     * for the control plane's admin log; null when the scope holds no such capability. No
+     * lifecycle gate: a revoke only narrows, so a held scope still takes one. Idempotent.
      */
     async revokeCapabilityLocal(scopeId, capabilityId, actor) {
-        return (await this.scopeStub(scopeId).revokeCapabilityAsPlatform(capabilityId, actor)) !== null;
+        return this.scopeStub(scopeId).revokeCapabilityAsPlatform(capabilityId, actor);
     }
     /**
      * Copy one scope's data into a fresh scope DO, entirely within THIS deployment —
@@ -1268,9 +1271,11 @@ export class CloudflareScopeHost {
             }
             this.predicateNames.set(name, manifest.id);
         }
+        // #1835: a forged `operations` is refused at construction too, before its scope ever wakes.
+        assertBoundOperations(manifest.id, registration.operations);
         // #119: the trash rules, refused here too so a bad module fails at construction, not at its
         // scope's first wake. The scope holds the targets; the coordinator only needs the verdict.
-        registerTrashTargets(manifest.id, new Set(Object.keys(registration.operations ?? {})), registration.operationInputs, manifest.entityStates, manifest.schedules);
+        registerTrashTargets(manifest.id, new Set(Object.keys(registration.operations?.handlers ?? {})), registration.operations?.inputs, manifest.entityStates, manifest.schedules);
         // #1705: after the checks above, so a refused module leaves nothing registered here.
         this.crossVertical.register(manifest, registration.imports);
         this.moduleIds.add(manifest.id);
@@ -1284,7 +1289,7 @@ export class CloudflareScopeHost {
             this.moduleFreshness.set(manifest.id, manifest.freshness);
         }
         this.migrationTotal += migrations.length;
-        const ownOperations = new Set(Object.keys(registration.operations ?? {}));
+        const ownOperations = new Set(Object.keys(registration.operations?.handlers ?? {}));
         for (const name of manifest.withdraws ?? []) {
             if (ownOperations.has(name)) {
                 throw new Error(`${manifest.id} withdraws its own operation: ${name} (a module cannot withdraw itself — just don't register it)`);
@@ -1296,9 +1301,9 @@ export class CloudflareScopeHost {
         // #893: the facade validates what the DO will enforce. A schema declared for
         // an operation this module does not bind enforces nothing while reading as
         // coverage — refused here so it is caught at registration rather than never.
-        const unboundInputs = Object.keys(registration.operationInputs ?? {}).filter((name) => !ownOperations.has(name));
+        const unboundInputs = Object.keys(registration.operations?.inputs ?? {}).filter((name) => !ownOperations.has(name));
         if (unboundInputs.length > 0) {
-            throw new Error(`${manifest.id} declares operationInputs for unbound operation(s): ` +
+            throw new Error(`${manifest.id} declares operations.inputs for unbound operation(s): ` +
                 `${unboundInputs.sort().join(', ')} — a schema on nothing reads as a parse that is not there`);
         }
         const binding = {
@@ -1306,7 +1311,7 @@ export class CloudflareScopeHost {
             entitlementKey: manifest.entitlementKey,
             scheduledOperations: new Set((manifest.schedules ?? []).map((sch) => sch.operation)),
         };
-        for (const name of Object.keys(registration.operations ?? {})) {
+        for (const name of Object.keys(registration.operations?.handlers ?? {})) {
             this.bindOperation(name);
             this.operationEntitlement.set(name, binding);
         }
@@ -2218,6 +2223,38 @@ export class CloudflareScopeHost {
         const result = await this.scopeStub(scopeId).revokeScopeRolesBoundedFor(tenantId, scopeId, principalId.parse(caller), principalId.parse(principal));
         return { coverage: coverage.parse(result.coverage), revoked: result.revoked };
     }
+    /**
+     * A principal's `become` mint (#1686) — a member invite's link, minted by the member who
+     * invites. The bound (`becomeMintCheck`: the caller holds everything the target holds here)
+     * and the write are one ScopeDO task; a refusal is `{ ok: false, coverage }` and writes
+     * nothing. Same gate as the scope-role verbs, which the invite grants with beside it.
+     */
+    async mintBecomeCapabilityBounded(tenantId, scopeId, caller, input) {
+        await this.scopeRoleGate(tenantId, scopeId, 'mintBecomeCapabilityBounded');
+        return boundedBecomeMint.parse(await this.scopeStub(scopeId).mintBecomeCapabilityBoundedFor(tenantId, scopeId, principalId.parse(caller), principalBecomeCapabilityInput.parse(input)));
+    }
+    /**
+     * Revoke a `become` capability a principal minted (#1686) — what withdrawing a member invite
+     * does to its link. `revoked` is false when it was already revoked or is not such a capability
+     * (a platform-minted claim link, an `act` share). The kernel bounds `by` in the same ScopeDO
+     * task: the link's minter, or someone holding everything its principal holds now.
+     */
+    async revokeBecomeCapability(tenantId, scopeId, capabilityId, by) {
+        await this.scopeRoleGate(tenantId, scopeId, 'revokeBecomeCapability');
+        return boundedBecomeRevoke.parse(await this.scopeStub(scopeId).revokeBecomeCapabilityFor(tenantId, scopeId, capabilityId, principalId.parse(by)));
+    }
+    /**
+     * Where each named `become` link stands (#1686) — what a pending-invite list shows beside each
+     * invite, so a link the kernel revoked or that expired is never shown as open.
+     */
+    async becomeLinkStates(tenantId, scopeId, ids) {
+        // Refused here, on the near side, where the typed refusal reaches the caller as one.
+        assertBecomeLinkStateIds(ids);
+        await this.scopeRoleGate(tenantId, scopeId, 'becomeLinkStates');
+        if (ids.length === 0)
+            return [];
+        return (await this.scopeStub(scopeId).becomeLinkStatesFor(tenantId, scopeId, [...ids])).map((state) => becomeLinkState.parse(state));
+    }
     /** The (tenant, scope) gate the scope-role verbs share — `assignScopeRoleBounded`'s two checks. */
     async scopeRoleGate(tenantId, scopeId, verb) {
         if (this.cpLess && !(await this.scopeStub(scopeId).servesTenant(tenantId))) {
@@ -2315,26 +2352,34 @@ export class CloudflareScopeHost {
             this.systemSwitchDelegation ||
             this.peerSwitchDelegation ||
             this.eventDrainDelegation ||
-            this.importCursorDelegation);
+            this.importCursorDelegation ||
+            this.capabilityDelegation);
     }
     /**
      * Where a platform capability verb (#1672) may write: this host's own ScopeDO — refused,
      * loudly, on the shared control plane for a scope bound to a vertical, whose storage lives
      * in that vertical's deployment. Writing through `this.scopeStub` there would mint into
-     * an empty DO of the wrong namespace, a capability nobody could ever exchange. Delegating
-     * these verbs to the serving deployment (as the schedule switch is) is a follow-up; the
-     * claim-link migration is the first caller that needs it.
+     * an empty DO of the wrong namespace, a capability nobody could ever exchange. The revoke
+     * reaches a hosted scope through `capabilityDelegation` instead and asks here only when none is
+     * configured; the mint has no such reach and no caller needing one, since an owner claim link
+     * is minted by the deployment itself behind `/internal/owner-claim`.
      */
-    async capabilityScopeStub(tenantId, scopeId, verb) {
-        const rec = await this.cp.getScopeRecord(tenantId, scopeId);
-        if (!rec)
-            throw unknownScopeForTenant(tenantId, scopeId);
+    async capabilityScopeStub(rec, scopeId, verb) {
         if (this.servesScopesElsewhereNow && rec.vertical !== null) {
             throw substratError('unavailable', `${verb} cannot reach scope ${scopeId}: it is served by the '${rec.vertical}' ` +
-                'deployment, and platform capability verbs are not delegated there yet');
+                'deployment, and this host has no reach into it');
         }
         await this.migrateAndRecord(scopeId);
-        return { stub: this.scopeStub(scopeId), vertical: rec.vertical };
+        return this.scopeStub(scopeId);
+    }
+    /**
+     * The directory's record of a scope a platform capability verb addresses: `not_found`, or
+     * `conflict` for a REAPED scope (`scopeRecordForRead`'s refusal). Its row is a tombstone and its
+     * storage is gone, so addressing its DO — here or in the deployment — would construct an empty
+     * one. An archived scope still answers: its bytes, and the capabilities in them, are there.
+     */
+    async capabilityScopeRecord(tenantId, scopeId) {
+        return this.scopeRecordForRead(tenantId, scopeId);
     }
     /** #1705: what this deployment imports — the sweep's reason to call no scope when it is empty. */
     registeredImports() {
@@ -2862,6 +2907,7 @@ export class CloudflareScopeHost {
             expiresAt: r.expires_at,
             ...(r.serving_ref ? { servingRef: r.serving_ref } : {}),
             archivedAt: r.archived_at ?? null,
+            archivedFromStatus: (r.archived_from_status ?? null),
             createdAt: r.created_at,
         });
         // The (version, scope) pair a bind and its impact read both start from, and the refusals
@@ -3508,11 +3554,11 @@ export class CloudflareScopeHost {
                 await this.recordAdmin(actor, 'grantEntityShape', grant.node, null, grant);
             },
             reconcileEntityGrantShapes: async (actor, node, shapes, opts) => {
-                const { toppedUp, retired } = await this.topUpEntityGrantShapesLocal(node.tenantId, node.scopeId, shapes, opts?.batch);
-                if (toppedUp > 0 || retired > 0) {
-                    await this.recordAdmin(actor, 'reconcileEntityGrantShapes', node, null, { shapes, toppedUp, retired });
+                const result = await this.topUpEntityGrantShapesLocal(node.tenantId, node.scopeId, shapes, opts?.batch);
+                if (result.toppedUp > 0 || result.retired > 0) {
+                    await this.recordAdmin(actor, 'reconcileEntityGrantShapes', node, null, { shapes, ...result });
                 }
-                return { toppedUp, retired };
+                return result;
             },
             grantToConnection: async (actor, raw) => {
                 const grant = connectionGrant.parse(raw);
@@ -3644,9 +3690,10 @@ export class CloudflareScopeHost {
                 // two sides cannot disagree about what a valid mint is.
                 checkBecomeInput(input, new Date().toISOString());
                 await this.validateScopeAccess(tenantId, scopeId);
-                const { stub, vertical } = await this.capabilityScopeStub(tenantId, scopeId, 'mintCapability');
+                const rec = await this.capabilityScopeRecord(tenantId, scopeId);
+                const stub = await this.capabilityScopeStub(rec, scopeId, 'mintCapability');
                 const minted = await stub.mintBecomeCapability(input, actor);
-                await this.recordAdmin(actor, 'mintCapability', { tenantId, scopeId, vertical }, null, {
+                await this.recordAdmin(actor, 'mintCapability', { tenantId, scopeId, vertical: rec.vertical }, null, {
                     capabilityId: minted.id,
                     mode: 'become',
                     principal: input.principal,
@@ -3657,14 +3704,29 @@ export class CloudflareScopeHost {
                 return minted;
             },
             revokeCapability: async (actor, tenantId, scopeId, capabilityId) => {
-                const { stub, vertical } = await this.capabilityScopeStub(tenantId, scopeId, 'revokeCapability');
-                const before = await stub.revokeCapabilityAsPlatform(capabilityId, actor);
-                if (!before) {
-                    throw substratError('not_found', `no capability ${capabilityId} in scope ${scopeId}`);
+                // #1686: a hosted scope's directory is in the deployment serving it, reached through the
+                // delegation; this host's own ScopeDO otherwise. Where it lands is settled before the
+                // audit opens: a scope this host cannot reach is refused with nothing written.
+                const rec = await this.capabilityScopeRecord(tenantId, scopeId);
+                const { vertical } = rec;
+                const delegation = this.capabilityDelegation;
+                let revoke;
+                if (vertical !== null && delegation) {
+                    const served = { vertical, verticalVersionId: rec.vertical_version_id, servingRef: rec.serving_ref };
+                    revoke = () => delegation.revoke({ tenantId, scopeId, served, capabilityId, actor });
+                }
+                else {
+                    const stub = await this.capabilityScopeStub(rec, scopeId, 'revokeCapability');
+                    revoke = () => stub.revokeCapabilityAsPlatform(capabilityId, actor);
                 }
-                await this.recordAdmin(actor, 'revokeCapability', { tenantId, scopeId, vertical }, before, {
+                // Intent first, then the outcome (#1666's grammar): a revoke whose answer is lost, or
+                // whose outcome row cannot be written, is still on the admin log, and settles `unknown`.
+                await auditedCapabilityRevoke({
                     capabilityId,
-                    revoked: true,
+                    scopeId,
+                    record: (before, after) => this.recordAdmin(actor, 'revokeCapability', { tenantId, scopeId, vertical }, before, after),
+                    revoke,
+                    logError: (message, fields) => console.error(message, fields),
                 });
             },
             grantToOrg: async (actor, orgId, permission, node, entity) => {
@@ -4165,6 +4227,12 @@ export class CloudflareScopeHost {
                 if (result === 'pending')
                     throw substratError('precondition_failed', `scope ${scopeId} has a copy move in flight; retry reap after it settles`);
             },
+            backfillScopeScriptCopy: async (actor, tenantId, scopeId, scriptRef, opts) => {
+                if (!scriptRef)
+                    throw substratError('conflict', 'a backfilled copy must name a real script');
+                // The audit row is written in the insert's own unit, stamped there with its erasure epoch.
+                return this.cp.backfillScopeScriptCopy(tenantId, scopeId, scriptRef, this.adminEntry(actor, 'backfillScopeCopy', { tenantId, scopeId }, null, { scriptRef, fromLogId: opts?.fromLogId ?? null }));
+            },
             claimExpiredScopeScriptCopies: async (_actor, input) => (await this.cp.claimExpiredScopeScriptCopies(input)).map(scopeScriptCopyOf),
             settleScopeScriptCopy: async (_actor, tenantId, scopeId, scriptRef, moveId, state, marker, opts) => this.cp.settleScopeScriptCopy(tenantId, scopeId, scriptRef, moveId, state, marker?.loadStamp ?? null, marker?.revision ?? null, opts?.claimedBy),
             touchScopeScriptCopy: async (_actor, tenantId, scopeId, scriptRef, moveId) => this.cp.touchScopeScriptCopy(tenantId, scopeId, scriptRef, moveId),
@@ -4836,6 +4904,9 @@ export class CloudflareScopeHost {
             },
             shredSubject: async (actor, tenantId, scopeId, subjectId) => {
                 await this.assertScope(tenantId, scopeId);
+                // #1722: a direct shred claims nothing; it records the epoch it ran under, as an orchestrated
+                // one records the epoch its claim compared, so the backfill can order every erasure.
+                const stamp = { erasureEpoch: await this.cp.scopeErasureEpoch(tenantId, scopeId), path: 'direct' };
                 // Redact the live spine FIRST, destroy the key LAST. Both halves are idempotent and
                 // a crash between them converges on retry, so the order is decided by which
                 // half-done state harms the person: dying after the redaction leaves ciphertext in
@@ -4909,7 +4980,7 @@ export class CloudflareScopeHost {
                 // BOTH logs, deliberately: the admin log because this is a mutation, the access log
                 // because it destroys evidence. An erasure is the one action where "who asked for
                 // this to disappear" is itself part of the record.
-                await this.recordAdmin(actor, 'shredSubject', { tenantId, scopeId }, null, receipt);
+                await this.recordAdmin(actor, 'shredSubject', { tenantId, scopeId }, stamp, receipt);
                 // BOTH counts: the access log's number is "how much evidence this destroyed", and
                 // an intent payload is a whole event's worth of it.
                 await this.recordAccess(actor, 'shredSubject', { tenantId, scopeId }, { subjectId }, eventsRedacted + intentsRedacted + jobRunsRedacted + idempotencyResults + moduleRowsErased(vertical));
@@ -4937,7 +5008,8 @@ export class CloudflareScopeHost {
                     keyDestroyed: existed,
                     tombstoned: true,
                 });
-                await this.recordAdmin(actor, 'shredSubject', { tenantId, scopeId }, null, receipt);
+                // The epoch the claim compared (#1722): the backfill orders itself against this erasure by it.
+                await this.recordAdmin(actor, 'shredSubject', { tenantId, scopeId }, { erasureEpoch: expected.epoch, path: 'orchestrated' }, receipt);
                 await this.recordAccess(actor, 'shredSubject', { tenantId, scopeId }, { subjectId }, redactions.reduce((n, r) => n + r.events + r.intents + r.jobRuns + r.idempotencyResults + moduleRowsErased(r.vertical), 0));
                 return receipt;
             },
@@ -5036,6 +5108,7 @@ export class CloudflareScopeHost {
                     scopes: rows.scopes.map((r) => ({
                         tenantId: r.tenant_id,
                         status: r.status,
+                        archivedFromStatus: r.archived_from_status,
                     })),
                     entitlements: rows.entitlements.map((r) => ({
                         tenantId: r.tenant_id,
@@ -5043,6 +5116,8 @@ export class CloudflareScopeHost {
                         plan: r.plan,
                         expiresAt: r.expires_at,
                     })),
+                    storage: rows.storage,
+                    storageAttempts: rows.storageAttempts,
                 });
                 // Tenants covered, not totals: "read one tenant's meter" and "metered the whole
                 // fleet" are different acts, and K-24 exists to tell them apart.
@@ -5140,7 +5215,7 @@ export class CloudflareScopeHost {
                     createdBy: input.createdBy ?? actor,
                 });
             },
-            connectionSealingKey: (id) => this.ensureSealingKey(id),
+            connectionSealingKey: async (id) => this.ensureSealingKey(id),
             connectionSealingKeys: async (tenantId, vertical) => {
                 // LIVE connections only. A revoked connection's key is KEPT (its pending
                 // ciphertext must still open) but stops being projected, so a scope can no
@@ -5363,7 +5438,9 @@ export class CloudflareScopeHost {
                 return rows;
             },
             /** #2064: settle an intent with no outcome — one unit in the directory DO. */
-            settleUnrecordedOutcome: (actor, input) => this.cp.settleUnrecordedOutcome({ actor, intentId: input.intentId, error: input.error }),
+            // `async`, like every other method here: a bare stub call hands the caller workerd's RPC
+            // promise, which is callable (for pipelining) where `Promise<boolean>` is not (#2131).
+            settleUnrecordedOutcome: async (actor, input) => this.cp.settleUnrecordedOutcome({ actor, intentId: input.intentId, error: input.error }),
             /** #2005: one change to a scope's copy marker, written around the vertical's own change. */
             recordCopyMark: async (actor, entry) => {
                 const { tenantId, scopeId, action, ...after } = copyMarkAudit.parse(entry);
@@ -5570,6 +5647,18 @@ export class CloudflareScopeHost {
                 await this.recordAccess(actor, 'listFindingRules', { tenantId }, filter, rows.length);
                 return rows.map((r) => findingRuleEntry.parse(r));
             },
+            recordScopeStorage: async (_actor, readings) => this.cp.recordScopeStorage(readings),
+            listScopeStorage: async (actor, filter) => {
+                const rows = (await this.cp.listScopeStorage(filter)).map((r) => scopeStorageSample.parse(r));
+                await this.recordAccess(actor, 'listScopeStorage', { tenantId: filter?.tenantId ?? null, scopeId: filter?.scopeId ?? null }, filter ?? null, rows.length);
+                return rows;
+            },
+            listScopeStorageAttempts: async (actor) => {
+                const rows = await this.cp.listScopeStorageAttempts();
+                await this.recordAccess(actor, 'listScopeStorageAttempts', { tenantId: null }, null, rows.length);
+                return rows;
+            },
+            pruneScopeStorage: async (_actor, limit) => this.cp.pruneScopeStorage(assertRowLimit('limit', limit)),
             recordModelUsage: async (input) => {
                 const l = input.line;
                 return this.cp.recordModelUsage({
@@ -6790,22 +6879,29 @@ export class CloudflareScopeHost {
      * passes — at most `batch` rows of work per scope transaction (default 500, at most 5000;
      * anything else is `validation_failed`), repeated until a pass finishes. Never re-grants a revoked
      * key; takes back only a key the shape declares `retired` (#2082). Returns how many
-     * (person, entity) it topped up, and how many it took retired keys from.
+     * (person, entity) it topped up, how many it took retired keys from, and (only when nonzero) how
+     * many shapes' retirements it left open for the next reconcile.
      */
     async topUpEntityGrantShapesLocal(tenantId, scopeId, shapes, batch) {
         const limit = shapeTopUpBatch(batch);
         let toppedUp = 0;
         let retired = 0;
+        let retirementsLeftOpen = 0;
         if (shapes.length === 0)
             return { toppedUp, retired };
         const stub = this.scopeStub(scopeId);
-        for (let done = false; !done;) {
-            const pass = await stub.topUpEntityGrantShapes(tenantId, scopeId, shapes, limit);
+        // Each pass resumes where the last one stopped (#2083), until one reports nothing left. A DO
+        // from before the cursor answers no `next`: its passes each start over, until it says `done`.
+        let after = null;
+        for (let more = true; more;) {
+            const pass = await stub.topUpEntityGrantShapes(tenantId, scopeId, shapes, limit, after);
             toppedUp += pass.toppedUp;
             retired += pass.retired;
-            done = pass.done;
+            retirementsLeftOpen += pass.retirementsLeftOpen ?? 0; // a DO from before the cap reports none
+            after = pass.next ?? null;
+            more = pass.next === undefined ? !pass.done : pass.next !== null;
         }
-        return { toppedUp, retired };
+        return { toppedUp, retired, ...(retirementsLeftOpen > 0 ? { retirementsLeftOpen } : {}) };
     }
     // -- the connector write-back's far end (#574) -----------------------------
     // A CP-less dispatch vertical cannot run a connector, so the shared control