@substrat-run/adapter-cloudflare 0.143.0 → 0.145.0

package/dist/scope-do.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"scope-do.d.ts","sourceRoot":"","sources":["../src/scope-do.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAC;AA4DnD,OAAO,EA2DL,KAAK,SAAS,EAsBd,KAAK,kBAAkB,EAEvB,KAAK,gBAAgB,EAqGtB,MAAM,sBAAsB,CAAC;AAmD9B,OAAO,EAAW,KAAK,OAAO,EAAE,MAAM,eAAe,CAAC;AAGtD,OAAO,EAkBL,kBAAkB,EAsEnB,MAAM,sBAAsB,CAAC;AA0B9B;;;;;;;;;;;;;GAaG;AAEH,MAAM,WAAW,UAAU;IACzB;;;;;OAKG;IACH,aAAa,CAAC,EAAE,sBAAsB,CAAC;IACvC;;;;;;OAMG;IACH,mBAAmB,CAAC,EAAE,MAAM,CAAC;CAC9B;AAoFD,oFAAoF;AACpF,MAAM,MAAM,aAAa,GAAG,UAAU,GAAG,UAAU,GAAG,SAAS,GAAG,SAAS,CAAC;AAsjB5E;;;GAGG;AACH,MAAM,MAAM,yBAAyB,CAAC,CAAC,IAAI,OAAO,CAAC,CAAC,CAAC,CAAC;AAmBtD;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AAEH;;;;GAIG;AACH,wBAAgB,aAAa,CAAC,GAAG,EAAE,UAAU,GAAG,SAAS,CAOxD;AAED,gHAAgH;AAChH,OAAO,EAAE,kBAAkB,EAAE,CAAC;AA2B9B,wBAAgB,aAAa,CAC3B,OAAO,EAAE,kBAAkB,EAAE,EAC7B,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,gBAAgB,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC,GACxD,KAAK,GAAG,EAAE,kBAAkB,EAAE,GAAG,EAAE,UAAU,KAAK,aAAa,CAAC,UAAU,CAAC,CA46N7E"}
+{"version":3,"file":"scope-do.d.ts","sourceRoot":"","sources":["../src/scope-do.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAC;AA4DnD,OAAO,EA2DL,KAAK,SAAS,EAsBd,KAAK,kBAAkB,EAEvB,KAAK,gBAAgB,EAqGtB,MAAM,sBAAsB,CAAC;AAoD9B,OAAO,EAAW,KAAK,OAAO,EAAE,MAAM,eAAe,CAAC;AAGtD,OAAO,EAkBL,kBAAkB,EA4EnB,MAAM,sBAAsB,CAAC;AA0B9B;;;;;;;;;;;;;GAaG;AAEH,MAAM,WAAW,UAAU;IACzB;;;;;OAKG;IACH,aAAa,CAAC,EAAE,sBAAsB,CAAC;IACvC;;;;;;OAMG;IACH,mBAAmB,CAAC,EAAE,MAAM,CAAC;CAC9B;AAoFD,oFAAoF;AACpF,MAAM,MAAM,aAAa,GAAG,UAAU,GAAG,UAAU,GAAG,SAAS,GAAG,SAAS,CAAC;AA+jB5E;;;GAGG;AACH,MAAM,MAAM,yBAAyB,CAAC,CAAC,IAAI,OAAO,CAAC,CAAC,CAAC,CAAC;AAmBtD;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AAEH;;;;GAIG;AACH,wBAAgB,aAAa,CAAC,GAAG,EAAE,UAAU,GAAG,SAAS,CAOxD;AAED,gHAAgH;AAChH,OAAO,EAAE,kBAAkB,EAAE,CAAC;AA2B9B,wBAAgB,aAAa,CAC3B,OAAO,EAAE,kBAAkB,EAAE,EAC7B,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,gBAAgB,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC,GACxD,KAAK,GAAG,EAAE,kBAAkB,EAAE,GAAG,EAAE,UAAU,KAAK,aAAa,CAAC,UAAU,CAAC,CA2jO7E"}

package/dist/scope-do.js

@@ -7,7 +7,7 @@ import { isUpgradeRequest, readSubscription, LIVE_DECIDE_ATTEMPTS, LIVE_FANOUT_L
 import { replyOf } from './do-reply.js';
 import { OperationQueue } from './serialization.js';
 import { assertNoWorkerdStorage, doScopedSql, doBuiltColumnsOf, doRedactionSql, doSpineSql } from './sql.js';
-import { actorOf, admitPeer, collectPeers, switchPeer, peerSubjectRef, subjectGrantState, assertNoSecret, CAPABILITY_DDL, COPY_ORIGIN_DDL, ENTITY_STATE_MOVES_DDL, SWITCH_FENCES_DDL, TABLE_OWNERS_DDL, assertMigrationLeavesLedgerAlone, recordOwnershipSteps, runMigrationStatements, splitSqlStatements, executableSqlStatements, blankSqlComments, CAPABILITY_EXCHANGE_OPERATION, CAPABILITY_BECOME_MINT_OPERATION, becomeMintCheck, mintBecomeCapabilityAsPrincipal, revokeBecomeCapabilityAsPrincipal, readBecomeLinkStates, capabilityAttachmentWriteRefused, createCapabilityVerbs, createEntityEdgeVerbs, createEntityStateVerbs, createTrashedReads, CONTINUATION_POSITION_CAP, visibleContinuation, searchStateWhere, uncheckedView, addStatePlans, assertNoCallerPurge, isUnreachableParent, PURGE_BATCH, heldPurgePass, lifecycleRefusal, purgeHeldBy, purgeDueOf, purgeOnlyKeysOf, runPurgePass, refuseTrashedTarget, assertBoundOperations, registerTrashTargets, withheldKeysFor, statefulTablesOf, afterMigration, afterRuntimeDdl, derivesAnything, repairDerivedObjects, StateColumnLost, exchangeCapability, guardSecrets, mintBecomeCapability, redactSecrets, redactSecretText, moduleLog, asyncInvocationId, asyncLinePass, resolveCapabilitySession, revokeCapabilityAsPlatform, readCapabilityPage, domainEventOf, facetEvents, readDeadLetters, readLifecycleFlow, readOperationSeries, readHistory, readInvocation, readUndrainedOutbox, walkEventCause, walkEventEffects, } from '@substrat-run/kernel';
+import { actorOf, admitPeer, collectPeers, switchPeer, peerSubjectRef, subjectGrantState, assertNoSecret, CAPABILITY_DDL, COPY_ORIGIN_DDL, ENTITY_STATE_MOVES_DDL, SWITCH_FENCES_DDL, TABLE_OWNERS_DDL, assertMigrationLeavesLedgerAlone, recordOwnershipSteps, runMigrationStatements, splitSqlStatements, executableSqlStatements, blankSqlComments, CAPABILITY_EXCHANGE_OPERATION, CAPABILITY_BECOME_MINT_OPERATION, becomeMintCheck, mintBecomeCapabilityAsPrincipal, revokeBecomeCapabilityAsPrincipal, readBecomeLinkStates, ENTITY_UNBIND_OPERATION, allowedFor, unbindEntityHolderBounded, capabilityAttachmentWriteRefused, createCapabilityVerbs, createEntityEdgeVerbs, createEntityStateVerbs, createTrashedReads, CONTINUATION_POSITION_CAP, visibleContinuation, searchStateWhere, uncheckedView, addStatePlans, addUpdatedStampPlans, watchUpdatedStamps, assertNoCallerPurge, isUnreachableParent, PURGE_BATCH, heldPurgePass, lifecycleRefusal, purgeHeldBy, purgeDueOf, purgeOnlyKeysOf, runPurgePass, refuseTrashedTarget, assertBoundOperations, registerTrashTargets, withheldKeysFor, statefulTablesOf, afterMigration, afterRuntimeDdl, derivesAnything, repairDerivedObjects, StateColumnLost, exchangeCapability, guardSecrets, mintBecomeCapability, redactSecrets, redactSecretText, moduleLog, asyncInvocationId, asyncLinePass, resolveCapabilitySession, revokeCapabilityAsPlatform, readCapabilityPage, domainEventOf, facetEvents, readDeadLetters, readLifecycleFlow, readOperationSeries, readHistory, readInvocation, readUndrainedOutbox, walkEventCause, walkEventEffects, } from '@substrat-run/kernel';
 import { COPY_RESTORE_FENCE_LAPSED, copyRestoreFenceLapsed } from '@substrat-run/kernel';
 import { createDoTupleChecker, createLocalControlPlaneReader, scopeTupleReader } from './checker.js';
 import { settlePlatformRequestIn } from '@substrat-run/kernel';
@@ -352,9 +352,9 @@ const KERNEL_DDL = `
   -- #1575: attachment text and its FTS5 index, shared from @substrat-run/kernel. After
   -- _substrat_attachments, whose delete trigger it adds.
   ${ATTACHMENT_TEXT_DDL}
-  -- #901: an entity's version is the ULID of the last event about it, so
-  -- MAX(id) per (entity_type, entity_id) is the read. The id column sits last so
-  -- SQLite walks to the end of the matched range instead of aggregating over it.
+  -- #901: an entity's version is the ULID of the last event about it (a state move
+  -- excepted, #2191), so the newest id per (entity_type, entity_id) is the read. The id
+  -- column sits last so SQLite walks the matched range backwards instead of aggregating.
   ${OUTBOX_ENTITY_INDEX}
   -- #116: the request-dedupe table, kernel-owned so no vertical migrates for it.
   ${IDEMPOTENCY_DDL}
@@ -561,6 +561,15 @@ function toRpcError(err) {
     }
     return new Error(String(err));
 }
+/** A throwing RPC kept for a coordinator from before #113: `fn`'s refusal, as `toRpcError` rebuilds it. */
+async function thrownForRpc(fn) {
+    try {
+        return await fn();
+    }
+    catch (err) {
+        throw toRpcError(err);
+    }
+}
 /** The check subject for an attachment gate (#476): the connection when the connector door
  *  set one, else the principal — mirrors the invoke path's subject selection. */
 /**
@@ -737,6 +746,8 @@ export function defineScopeDO(modules, bareOps) {
         listPlans = new Map();
         /** #119: entity type → its archive/trash plan, from every registered module. */
         statePlans = new Map();
+        /** #2166: entity type → the updated stamps the host holds, from every registered module. */
+        updatedStampPlans = new Map();
         /** #2068: each registered module's erasure, in registration order — what `redactSubject` runs. */
         erasurePlans = [];
         /** entityType → the declared attachment gate (#473): read key + write key (default: read). */
@@ -860,6 +871,7 @@ export function defineScopeDO(modules, bareOps) {
             }
             // #119: the archive/trash plans, refusing a second owner of one entity type.
             addStatePlans(this.statePlans, manifest.id, manifest.entityStates, manifest.permissions);
+            addUpdatedStampPlans(this.updatedStampPlans, manifest.id, manifest.updatedStamps);
             // #811: the list indexes `lists` declares, same placement and same reason.
             for (const plan of listIndexPlans(manifest.id, manifest.lists, manifest.entityStates)) {
                 const existing = this.listPlans.get(plan.entityType);
@@ -1358,7 +1370,10 @@ export function defineScopeDO(modules, bareOps) {
                                 // As the producer's principal: real checks against the grants this vertical's
                                 // `peers` gave it; its emits carry `{ vertical, scope }` and what they passed.
                                 // What it emits was emitted BECAUSE of the producer's event (#1237).
-                                await imp.handler(this.importContext(tenantId, scopeId, peerSubject, { causedBy: e.id, invocationId: unit.invocationId }), event);
+                                const ctx = this.importContext(tenantId, scopeId, peerSubject, { causedBy: e.id, invocationId: unit.invocationId });
+                                const stamps = watchUpdatedStamps(doSpineSql(this.sql), this.updatedStampPlans);
+                                await imp.handler(ctx, event);
+                                stamps?.assertHeld(ctx, `${imp.moduleId} consuming ${e.type}`);
                                 this.sql.exec(`INSERT INTO _substrat_deliveries (event_id, consumer_module, delivered_at, invocation_id)
                    VALUES (?, ?, ?, NULL)`, e.id, imp.moduleId, new Date().toISOString());
                             });
@@ -1675,14 +1690,16 @@ export function defineScopeDO(modules, bareOps) {
                 return { ...one, done: one.next === null };
             }
             let [toppedUp, retired, retirementsLeftOpen, from] = [0, 0, 0, null];
+            let boundEver;
             do {
                 const one = await pass(from);
                 toppedUp += one.toppedUp;
                 retired += one.retired;
                 retirementsLeftOpen += one.retirementsLeftOpen;
                 from = one.next;
+                boundEver = one.boundEver;
             } while (from);
-            return { toppedUp, retired, retirementsLeftOpen, next: null, done: true };
+            return { toppedUp, retired, retirementsLeftOpen, next: null, done: true, ...(boundEver ? { boundEver } : {}) };
         }
         /**
          * The dispatch capability's admission (#726 remedy B): this delivery may read the
@@ -2052,9 +2069,12 @@ export function defineScopeDO(modules, bareOps) {
                                 : undefined;
                             // #119: the host's trash refusal, before the guards and the handler — the pure
                             // adapter's, through the same kernel function.
-                            await refuseTrashedTarget({ sql: doSpineSql(this.sql), plans: this.statePlans, check: ctx.check }, operation, target, parsed, purging ? { now: new Date().toISOString(), gate: this.purgeGateFacts(systemDoor.moduleId, tenantId) } : undefined);
+                            // #2166: what the guards and the handler emit about a stamped entity, held below.
+                            const stamps = watchUpdatedStamps(doSpineSql(this.sql), this.updatedStampPlans);
+                            await refuseTrashedTarget({ sql: doSpineSql(this.sql), plans: this.statePlans, check: ctx.check, now: ctx.now() }, operation, target, parsed, purging ? { gate: this.purgeGateFacts(systemDoor.moduleId, tenantId) } : undefined);
                             await this.runGuards(operation, ctx, parsed);
                             result = await handler(ctx, parsed);
+                            stamps?.assertHeld(ctx, operation);
                             if (guardedRef && invokeOptions?.ifMatch !== undefined) {
                                 assertIfMatch(guardedRef, invokeOptions.ifMatch, seen ?? null);
                             }
@@ -2555,6 +2575,12 @@ export function defineScopeDO(modules, bareOps) {
              * principal holding that root in several tabs is one check, fanned out to each socket.
              */
             const rootChecks = new Map();
+            /**
+             * A row beneath a checked root that the key reaches only through a record whose shape
+             * protects it (#2177): decided by the subscriber's own check of the key on the row, asked
+             * once per (principal, key, row) per pass, under the same epoch rules as `rootChecks`.
+             */
+            const rowChecks = new Map();
             const ancestors = new Map();
             const openEpoch = (now) => ({
                 writes: this.revision.statementsWritten,
@@ -2568,17 +2594,26 @@ export function defineScopeDO(modules, bareOps) {
                 if (!holds(epoch, now)) {
                     epoch = openEpoch(now);
                     rootChecks.clear();
+                    rowChecks.clear();
                     ancestors.clear();
                 }
                 return epoch;
             };
-            const reaches = async (row, root, now) => {
-                let up = ancestors.get(row.id);
+            /**
+             * Is the row beneath the root? With a `key` (#2177), only along a path the key's own check
+             * would climb: it stops at a record whose shape protects the key. Memoised per (row, key),
+             * since the stop depends on it.
+             */
+            const reaches = async (row, root, now, key) => {
+                const memo = `${row.id}\n${key ?? ''}`;
+                let up = ancestors.get(memo);
                 if (!up) {
                     // A walk that cannot answer is a frame not sent — the same fail-closed rule as the check.
                     // Walked at the decision's own instant; remembered only while its epoch holds.
-                    up = ancestorsWithin(parents, { entityType: row.entity_type, entityId: row.entity_id }, now).catch(() => new Set());
-                    ancestors.set(row.id, up);
+                    up = Promise.resolve()
+                        .then(() => ancestorsWithin(parents, { entityType: row.entity_type, entityId: row.entity_id }, now, key))
+                        .catch(() => new Set());
+                    ancestors.set(memo, up);
                 }
                 return (await up).has(`${root.entityType}:${root.entityId}`);
             };
@@ -2646,7 +2681,13 @@ export function defineScopeDO(modules, bareOps) {
                         rootVerdict = undefined;
                     // Narrowing first: it is memoised across sockets, and a row outside the root
                     // is out whatever the principal holds.
-                    if (within && !(await reaches(row, within, now)))
+                    // A checked root walks with its key first (#2177). The keyed walk is the plain walk with
+                    // stops, so whatever it reaches the plain walk reaches too: a hit settles "beneath the
+                    // root" in one walk, and only a miss needs the plain walk to tell a row outside the root
+                    // from one the key reaches only through a record whose shape protects it.
+                    const key = within?.checked;
+                    const keyed = within && key !== undefined ? await reaches(row, within, now, key) : false;
+                    if (within && !keyed && !(await reaches(row, within, now)))
                         return 'skip';
                     if (within?.checked !== undefined) {
                         if (rootVerdict === undefined) {
@@ -2664,6 +2705,27 @@ export function defineScopeDO(modules, bareOps) {
                         }
                         if (!rootVerdict.allowed)
                             return 'revoked';
+                        // The root check speaks for a row the key reaches through the root. A row it reaches
+                        // only through a record whose shape protects the key (#2177) is the subscriber's own
+                        // check on the row: a holder by role or by the record's shape is nudged, a holder by a
+                        // grant above the record is not — the answer `ctx.check` gives, by asking it.
+                        if (!keyed) {
+                            const ask = () => context()
+                                .check(within.checked, { entityType: row.entity_type, entityId: row.entity_id })
+                                .then((d) => d.allowed, () => false);
+                            let allowed;
+                            if (e.remote) {
+                                allowed = ask();
+                            }
+                            else {
+                                const memo = `${subscriber.principal}\n${key}\n${row.id}`;
+                                allowed = rowChecks.get(memo);
+                                if (!allowed)
+                                    rowChecks.set(memo, (allowed = ask()));
+                            }
+                            if (!(await allowed))
+                                return 'skip';
+                        }
                     }
                     if (within?.vouched !== undefined || within?.checked !== undefined) {
                         // The root was vouched for or checked, so the walk above was the row filter —
@@ -2758,8 +2820,42 @@ export function defineScopeDO(modules, bareOps) {
                 .toArray()[0];
             return row ? attachmentRecordOfRow(row) : null;
         }
+        // The attachment verbs (#473) each have two doors onto one private body. The `…Reply`
+        // door answers a refusal as DATA, so its code and extensions survive the hop (#113); the
+        // plain one throws it as the bare `Error` `toRpcError` rebuilds, and is kept for a
+        // coordinator from before #113.
+        attachmentAdd(...args) {
+            return thrownForRpc(() => this.addAttachment(...args));
+        }
+        attachmentAddReply(...args) {
+            return replyOf(() => this.addAttachment(...args));
+        }
+        attachmentList(...args) {
+            return thrownForRpc(() => this.listAttachments(...args));
+        }
+        attachmentListReply(...args) {
+            return replyOf(() => this.listAttachments(...args));
+        }
+        attachmentAuthorize(...args) {
+            return thrownForRpc(() => this.authorizeAttachment(...args));
+        }
+        attachmentAuthorizeReply(...args) {
+            return replyOf(() => this.authorizeAttachment(...args));
+        }
+        systemAttachmentAuthorize(...args) {
+            return thrownForRpc(() => this.authorizeSystemAttachment(...args));
+        }
+        systemAttachmentAuthorizeReply(...args) {
+            return replyOf(() => this.authorizeSystemAttachment(...args));
+        }
+        attachmentRemove(...args) {
+            return thrownForRpc(() => this.removeAttachment(...args));
+        }
+        attachmentRemoveReply(...args) {
+            return replyOf(() => this.removeAttachment(...args));
+        }
         /** Record an uploaded attachment: write gate + row + `attachment.added`, one txn. */
-        async attachmentAdd(record, principal, tenantId, scopeId, 
+        async addAttachment(record, principal, tenantId, scopeId, 
         // #476: when set, the gate is checked as this CONNECTION (not `principal`, which is
         // then only the ctx.principal placeholder the connector door passes).
         connectionId) {
@@ -2795,7 +2891,7 @@ export function defineScopeDO(modules, bareOps) {
                     if (err instanceof PermissionDenied) {
                         this.recordDenial(attachSubject(principal, connectionId), tenantId, 'attachments.upload', err, null);
                     }
-                    throw toRpcError(err);
+                    throw err;
                 }
                 // #1525: null. An attachment RPC carries no invocation, exactly as its denial
                 // records none — so the deliveries it drains name no call rather than a wrong one.
@@ -2804,7 +2900,7 @@ export function defineScopeDO(modules, bareOps) {
             });
         }
         /** Records for one entity, newest first — read gate first. */
-        async attachmentList(entity, principal, tenantId, scopeId, connectionId) {
+        async listAttachments(entity, principal, tenantId, scopeId, connectionId) {
             await this.ensureMigrations();
             const gate = this.attachmentGate(entity.entityType);
             try {
@@ -2815,7 +2911,7 @@ export function defineScopeDO(modules, bareOps) {
                 if (err instanceof PermissionDenied) {
                     this.recordDenial(attachSubject(principal, connectionId), tenantId, 'attachments.list', err, null);
                 }
-                throw toRpcError(err);
+                throw err;
             }
             const rows = this.sql
                 .exec(`SELECT id FROM _substrat_attachments WHERE entity_type = ? AND entity_id = ?
@@ -2827,7 +2923,7 @@ export function defineScopeDO(modules, bareOps) {
          * Authorize one attachment (`read` before bytes are served, `write` before a remove is
          * attempted elsewhere) and return its record — null for an id this scope does not know.
          */
-        async attachmentAuthorize(attachmentId, mode, principal, tenantId, scopeId, connectionId, forEventId) {
+        async authorizeAttachment(attachmentId, mode, principal, tenantId, scopeId, connectionId, forEventId) {
             await this.ensureMigrations();
             const record = this.attachmentRow(attachmentId);
             if (!record)
@@ -2846,7 +2942,7 @@ export function defineScopeDO(modules, bareOps) {
                     if (err instanceof PermissionDenied) {
                         this.recordDenial(attachSubject(principal, connectionId), tenantId, 'attachments.open', err, null);
                     }
-                    throw toRpcError(err);
+                    throw err;
                 }
                 return record;
             }
@@ -2859,12 +2955,12 @@ export function defineScopeDO(modules, bareOps) {
                 if (err instanceof PermissionDenied) {
                     this.recordDenial(attachSubject(principal, connectionId), tenantId, 'attachments.open', err, null);
                 }
-                throw toRpcError(err);
+                throw err;
             }
             return record;
         }
         /** Authorize a job's read as its registered module, never as a person. */
-        async systemAttachmentAuthorize(attachmentId, moduleId, tenantId, scopeId, 
+        async authorizeSystemAttachment(attachmentId, moduleId, tenantId, scopeId, 
         /** #1834: the instance the system door's gate read; see `invoke`. */
         systemDoorInstance) {
             await this.ensureMigrations();
@@ -2875,10 +2971,10 @@ export function defineScopeDO(modules, bareOps) {
             catch (err) {
                 if (err instanceof SystemDoorMovedError)
                     return SYSTEM_DOOR_MOVED;
-                throw toRpcError(err);
+                throw err;
             }
             if (!this.modules.has(moduleId)) {
-                throw toRpcError(substratError('not_found', `module not registered in this scope: ${moduleId}`));
+                throw substratError('not_found', `module not registered in this scope: ${moduleId}`);
             }
             const record = this.attachmentRow(attachmentId);
             if (!record)
@@ -2892,12 +2988,12 @@ export function defineScopeDO(modules, bareOps) {
                 if (err instanceof PermissionDenied) {
                     this.recordDenial({ kind: 'system', id: moduleId }, tenantId, 'attachments.open', err, null);
                 }
-                throw toRpcError(err);
+                throw err;
             }
             return record;
         }
         /** Remove an attachment's metadata fact: write gate + delete + `attachment.removed`. */
-        async attachmentRemove(attachmentId, principal, tenantId, scopeId, connectionId) {
+        async removeAttachment(attachmentId, principal, tenantId, scopeId, connectionId) {
             await this.ensureMigrations();
             return this.queue.enqueue(async () => {
                 const record = this.attachmentRow(attachmentId);
@@ -2924,7 +3020,7 @@ export function defineScopeDO(modules, bareOps) {
                     if (err instanceof PermissionDenied) {
                         this.recordDenial(attachSubject(principal, connectionId), tenantId, 'attachments.remove', err, null);
                     }
-                    throw toRpcError(err);
+                    throw err;
                 }
                 // #1525: null. An attachment RPC carries no invocation, exactly as its denial
                 // records none — so the deliveries it drains name no call rather than a wrong one.
@@ -3530,6 +3626,7 @@ export function defineScopeDO(modules, bareOps) {
                         holdings: this.checker.holdings
                             ? (principal) => this.checker.holdings({ kind: 'principal', id: principal }, { tenantId, scopeId })
                             : undefined,
+                        allowed: (principal, permission, entity) => allowedFor(this.checker, principal, { tenantId, scopeId })(permission, entity),
                     }, secret, mode);
                 });
                 if (outcome)
@@ -3548,7 +3645,7 @@ export function defineScopeDO(modules, bareOps) {
             const minter = principalId.parse(caller);
             const parsed = principalBecomeCapabilityInput.parse(input);
             return await this.queue.enqueue(async () => {
-                const checked = await becomeMintCheck({ sql: doSpineSql(this.sql), checker: this.checker }, minter, parsed.principal, { tenantId, scopeId });
+                const checked = await becomeMintCheck({ sql: doSpineSql(this.sql), checker: this.checker }, minter, parsed.principal, { tenantId, scopeId }, parsed.bind);
                 if (!checked.ok)
                     return checked;
                 const liveSince = this.liveHighWaterMark();
@@ -3565,6 +3662,32 @@ export function defineScopeDO(modules, bareOps) {
                 return { ok: true, minted: minted };
             });
         }
+        /**
+         * Unbind a binding shape's record (#1686) — its column cleared and the shape its person held
+         * there through it taken back — as `caller`, who must hold the binding's key on the record. The
+         * kernel's bound and the write in ONE queued body and one storage transaction; a refusal writes
+         * nothing. On the spine as `entity.holder-unbound`, the caller its actor.
+         */
+        async unbindEntityHolderBoundedFor(tenantId, scopeId, caller, entity) {
+            await this.ensureMigrations();
+            const by = principalId.parse(caller);
+            return await this.queue.enqueue(async () => {
+                const liveSince = this.liveHighWaterMark();
+                const now = instant.parse(new Date().toISOString());
+                let answer = { ok: true, unbound: [] };
+                await this.revision.transaction(async () => {
+                    answer = await unbindEntityHolderBounded({
+                        sql: doSpineSql(this.sql),
+                        now,
+                        allowed: allowedFor(this.checker, by, { tenantId, scopeId }),
+                        emit: (event) => kernelEmit(this.operationContext(by, tenantId, scopeId, undefined, undefined, undefined, undefined, undefined, ENTITY_UNBIND_OPERATION, undefined, [], now), event),
+                    }, entity);
+                });
+                if (answer.ok && answer.unbound.length > 0)
+                    await this.settleCommitted(tenantId, scopeId, liveSince, null);
+                return answer;
+            });
+        }
         /** Where each named `become` link stands (#1686) — a pending-invite list's read. */
         async becomeLinkStatesFor(tenantId, scopeId, ids) {
             await this.ensureMigrations();
@@ -4510,12 +4633,7 @@ export function defineScopeDO(modules, bareOps) {
         /** A bounded page of one table. Unknown table names throw — never queried blind. Kept for a
          *  coordinator from before #113; the current one calls `introspectTableReply`. */
         introspectTable(table, limit, offset) {
-            try {
-                return this.tablePage(table, limit, offset);
-            }
-            catch (e) {
-                throw toRpcError(e);
-            }
+            return thrownForRpc(async () => this.tablePage(table, limit, offset));
         }
         /** `introspectTable`, its refusal answered as DATA so its code survives the hop (#113). */
         introspectTableReply(table, limit, offset) {
@@ -4547,13 +4665,8 @@ export function defineScopeDO(modules, bareOps) {
          * at SCOPE_QUERY_ROW_MAX with `truncated` set, never an error.
          * Kept for a coordinator from before #113; the current one calls `introspectQueryReply`.
          */
-        async introspectQuery(sql) {
-            try {
-                return await this.readOnlyQuery(sql);
-            }
-            catch (e) {
-                throw toRpcError(e);
-            }
+        introspectQuery(sql) {
+            return thrownForRpc(() => this.readOnlyQuery(sql));
         }
         /** `introspectQuery`, its refusal answered as DATA so its code survives the hop (#113). */
         introspectQueryReply(sql) {
@@ -4711,6 +4824,8 @@ export function defineScopeDO(modules, bareOps) {
                 'ALTER TABLE _substrat_capabilities ADD COLUMN target_digest TEXT',
                 // #1686: why the kernel revoked a link itself; NULL for every revoke already there.
                 'ALTER TABLE _substrat_capabilities ADD COLUMN revoked_reason TEXT',
+                // #1686: the action a become carries; NULL on every row already there — none carries one.
+                'ALTER TABLE _substrat_capabilities ADD COLUMN action TEXT',
                 // #1632: legacy runs retain an unknown subject; no content-based backfill.
                 'ALTER TABLE _substrat_job_runs ADD COLUMN subject_id TEXT',
                 // #2034: the lease. NULL = nobody holds the run, which is right for every row already there.
@@ -5479,7 +5594,9 @@ export function defineScopeDO(modules, bareOps) {
                                         causedBy: event.id,
                                         invocationId: unit.invocationId,
                                     });
+                                    const stamps = watchUpdatedStamps(doSpineSql(this.sql), this.updatedStampPlans);
                                     await consumer.handler(ctx, event);
+                                    stamps?.assertHeld(ctx, `${mod.id} consuming ${event.type}`);
                                     this.sql.exec(`INSERT INTO _substrat_deliveries
                        (event_id, consumer_module, delivered_at, invocation_id)
                      VALUES (?, ?, ?, ?)`, event.id, mod.id, new Date().toISOString(), invocationId);