@substrat-run/adapter-cloudflare 0.145.0 → 0.147.0

package/dist/host.js

@@ -3,9 +3,10 @@ import { isRewindRefusal, REWIND_REFUSED } from './rewind-refusal.js';
 import { isSystemDoorMoved, SYSTEM_DOOR_MOVED, SYSTEM_DOOR_REGATES } from './system-door.js';
 import { delegatedReadParams, operationSeriesCount, fromWireFailure, isSubstratError, exportReadInput, exportedBatch, importBatch, importResult, importState, importsOfManifestJson, exportsOfManifestJson, assertNoBindingShapeBreak, importCursorMove, importCursorMoveAt, importCursorMoved, accessLogEntry, adminLogEntry, opsFailureEntry, opsFailureFingerprint, issueEntry, findingEntry, findingRuleEntry, sweepRunEntry, FRESHNESS_HEARTBEAT_MINUTES, sweepRunsPayload, modelUsageEntry, attachmentRecord, createTenantInput, identityLink, identityPool, createOrgInput, promotionAcknowledgement, bindAcknowledgement, bindHostnameInput, channelHistoryEntry, hostnameBinding, publishVersionInput, AUTO_ADMISSION_NOTE, registerVerticalInput, vertical as verticalSchema, verticalServingState, verticalChannel, verticalVersion, connection, capabilityExchange, mintedCapability, boundedBecomeMint, boundedBecomeRevoke, boundedUnbind, entityRef, becomeLinkState, principalBecomeCapabilityInput, capabilityGrant, principalId, connectionGrant, connectionGrantRecord, connectionSecret, systemGrant, systemSwitch, systemSwitchOutcome, systemScheduleEntry, systemSwitchRecord, entitlementGrant, entitlementGrantInput, capabilityFilter, instant, meterReading, scopeStorageSample, subjectRef, createConnectionInput, connectLinkFilter, connectLinkKey, consumeConnectLinkInput, mintConnectLinkInput, projectedConnectionGrant, projectedConnectionKey, moduleManifest, org as orgSchema, orgMembership, resolvedIdentity, identityMembership, roleDefinition, scope as scopeSchema, tenant as tenantSchema, tenantRole, delegatedReadRecord, ownerTransferAudit, memberChangeAudit, peerBindingAudit, copyMarkAudit, subjectShredReceipt, connectorDispatchKind, callsOfManifestJson, outboundOfManifestJson, SCOPE_GATE_REASONS, substratError, redrainEventsInput, coverage, peerCoverage, peerGrantsEntry, peerSwitch, peerSwitchOutcome, verticalCaller, verticalResolution, peerInstanceResolution, peerBinding as peerBindingSchema, verticalSlug, entityObjectRef, ATTACHMENT_BLOB_BINDING, blobStoreBindingName, lifecycleDelivery, scopeLifecycle, } from '@substrat-run/contracts';
 import { normalizeHostname, toRouteTarget } from './route-resolver.js';
-import { attachmentBlobKey, attachmentSha256, entitlementDenial, requiredEntitlementFor, foldMeterReading, parseValidationRecords, resolveScopeRecord, ulid, KEPT_COPY_REFUSAL, capabilityTokenHash, checkBecomeInput, assertBecomeLinkStateIds, plausibleSessionToken, foldModelUsage, backoffAt, resolveRetryPolicy, executorOutcomeOf, isDeliveryRefusal, refusalJournalText, isSecretBoxConfigured, unconfiguredSecretBox, createSubjectKeys, generateSealingKeyPair, openSealed, ImpersonationRefused, assertSessionUsable, impersonationRowValues, mapImpersonationRow, newImpersonationSession, jobRunOf, assertLeaseMs, runDueJobRuns, SYSTEM_DOOR_WAIT, startJobRun, attachmentTextJob, assertAttachmentExtractors, resolveAttachmentTextBounds, assertJobRegistrable, ATTACHMENT_TEXT_BACKFILL_JOB, ATTACHMENT_TEXT_JOB, kernelJobFor, attachmentTextBackfillJob, searchLimit, searchMatchExpression, globalFetch, assertRedrainWindow, platformRequestOf, undrainedEventsOf, inUnitMovesToAudit, staleCarryRevertRow, staleCarryReverts, recordedOffFromWire, peerSubjectRef, SWITCH_KINDS, reassertActionOf, reassertEntry, reassertOffRow, reassertOnRow, switchActionOf, switchAuditSubject, recordAuditOutcome, auditedCapabilityRevoke, auditWarningOf, switchNotFoundMessage, recordWriteSuperseded, switchSubjectOf, switchSupersededMessage, withRecorded, systemSwitchedOffMessage, tenantSystemSwitchedOffMessage, CrossVerticalRegistry, importCursorSourceOf, exportBreaksOf, exportBreakRefusal, bindExportBreaksOf, bindExportBreakRefusal, scopeMoveOf, runningVersionOf, strandJudgmentsOf, boundShapesOfColumn, installReconciled, collectPeers, peerSeats, connectorCallRecord, noopConnectorCallRecorder, recordConnectorCall, settleConnectionUse, splitManifestMigrations, unknownRoleError, assertRowLimit, assertRowOffset, emptyImportResult, INERT_SCOPE_REASON, lifecycleReceipt, lifecycleRefusal, isPrimaryScope, isPrimaryScopeRow, asyncInvocationId, asyncLinePass, assertNoCallerPurge, purgeReportOf, purgeStillDue, assertBoundOperations, registerTrashTargets, memberAddedAudit, shapeTopUpBatch, } from '@substrat-run/kernel';
+import { attachmentBlobKey, attachmentSha256, entitlementDenial, requiredEntitlementFor, foldMeterReading, parseValidationRecords, resolveScopeRecord, ulid, KEPT_COPY_REFUSAL, capabilityTokenHash, checkBecomeInput, assertBecomeLinkStateIds, plausibleSessionToken, foldModelUsage, backoffAt, resolveRetryPolicy, executorOutcomeOf, isDeliveryRefusal, refusalJournalText, isSecretBoxConfigured, unconfiguredSecretBox, createSubjectKeys, generateSealingKeyPair, openSealed, ImpersonationRefused, assertSessionUsable, impersonationRowValues, mapImpersonationRow, newImpersonationSession, jobRunOf, assertLeaseMs, runDueJobRuns, SYSTEM_DOOR_WAIT, startJobRun, attachmentTextJob, assertAttachmentExtractors, resolveAttachmentTextBounds, assertJobRegistrable, ATTACHMENT_TEXT_BACKFILL_JOB, ATTACHMENT_TEXT_JOB, kernelJobFor, attachmentTextBackfillJob, searchLimit, searchMatchExpression, globalFetch, assertRedrainWindow, platformRequestOf, undrainedEventsOf, inUnitMovesToAudit, staleCarryRevertRow, staleCarryReverts, recordedOffFromWire, peerSubjectRef, SWITCH_KINDS, reassertActionOf, reassertEntry, reassertOffRow, reassertOnRow, switchActionOf, switchAuditSubject, recordAuditOutcome, auditedCapabilityRevoke, auditWarningOf, switchNotFoundMessage, recordWriteSuperseded, switchSubjectOf, switchSupersededMessage, withRecorded, systemSwitchedOffMessage, tenantSystemSwitchedOffMessage, CrossVerticalRegistry, importCursorSourceOf, exportBreaksOf, exportBreakRefusal, bindExportBreaksOf, bindExportBreakRefusal, scopeMoveOf, runningVersionOf, strandJudgmentsOf, boundShapesOfColumn, installReconciled, collectPeers, peerCallerAt, peerSeats, connectorCallRecord, noopConnectorCallRecorder, recordConnectorCall, settleConnectionUse, splitManifestMigrations, unknownRoleError, assertRowLimit, assertRowOffset, emptyImportResult, INERT_SCOPE_REASON, lifecycleReceipt, lifecycleRefusal, isPrimaryScope, isPrimaryScopeRow, asyncInvocationId, asyncLinePass, assertNoCallerPurge, purgeReportOf, purgeStillDue, assertBoundOperations, registerTrashTargets, memberAddedAudit, shapeTopUpBatch, } from '@substrat-run/kernel';
 import { COPY_RESTORE_FENCE_LAPSED, scopeScriptCopyOf } from '@substrat-run/kernel';
-import { attributedView, isModuleErasureCounts, moduleErasurePlan, moduleRowsErased } from '@substrat-run/kernel';
+import { attributedView, isModuleErasureCounts, moduleErasurePlan, moduleRowsErased, callReservedStoreOperation, callScopeStore, observeStoreCall, replayStoreErasures, scopeStoreLifecycleOf, scopeStoreRunnersOf } from '@substrat-run/kernel';
+import { PLATFORM_BINDING_PREFIX, scopeStoreBindingName, scopeStoreObjectName, STORE_CALL_URL, StoreError } from '@substrat-run/contracts';
 import { isOrangeToOrange, isUpgradeRequest, LIVE_MODE_HEADER, LIVE_PRINCIPAL_HEADER, LIVE_SCOPE_HEADER, LIVE_SUBSCRIBE_PATH, LIVE_TENANT_HEADER, LIVE_WITHIN_HEADER, LIVE_EXPIRES_HEADER, liveInstant, encodeLiveWithin, liveWithinOf, } from './live-reads.js';
 import { tenantStoreDatabaseName } from './d1.js';
 import { blobStoreBucketName, r2TenantBlobStore } from './r2.js';
@@ -187,8 +188,56 @@ const undeniedMessage = (scopeId, moduleId) => `the deployment serving scope ${s
  * platform's per-tenant binding, read off this script's own env, named by the one shared
  * encoding (`blobStoreBindingName`) for the tenant the caller passed in.
  */
+function ambientRecord() {
+    return ambientEnv;
+}
+function ambientBinding(name) {
+    return ambientRecord()[name] ?? null;
+}
 function ambientAttachmentBucket(tenantId) {
-    return ambientEnv[blobStoreBindingName(ATTACHMENT_BLOB_BINDING, tenantId)] ?? null;
+    return ambientBinding(blobStoreBindingName(ATTACHMENT_BLOB_BINDING, tenantId));
+}
+/**
+ * One store call over an object's fetch, for the vertical's door and the platform's reserved
+ * calls alike. A body that is not JSON is the store's failure, answered as a bad envelope.
+ */
+function storeObjectSend(object) {
+    return async (request) => {
+        const response = await object.fetch('https://scope-store/', {
+            method: 'POST',
+            headers: { 'content-type': 'application/json' },
+            body: JSON.stringify(request),
+        });
+        try {
+            return await response.json();
+        }
+        catch {
+            throw new StoreError({ code: 'bad_envelope', status: 502 });
+        }
+    };
+}
+function isScopeStoreNamespace(value) {
+    return (typeof value === 'object' &&
+        value !== null &&
+        typeof Reflect.get(value, 'idFromName') === 'function' &&
+        typeof Reflect.get(value, 'get') === 'function');
+}
+const SCOPE_STORE_BINDING_PREFIX = `${PLATFORM_BINDING_PREFIX}STORE_`;
+/** Bindings this script declares by having a `SUBSTRAT_STORE_*` namespace. */
+function ambientScopeStoreBindings() {
+    const names = [];
+    const env = ambientRecord();
+    for (const key of Object.keys(env)) {
+        if (!key.startsWith(SCOPE_STORE_BINDING_PREFIX))
+            continue;
+        const binding = key.slice(SCOPE_STORE_BINDING_PREFIX.length);
+        if (!/^[A-Z][A-Z0-9_]*$/.test(binding))
+            continue;
+        if (!isScopeStoreNamespace(Reflect.get(env, key)))
+            continue;
+        names.push(binding);
+    }
+    return names;
 }
 /**
  * #2029: scope instances whose door has read the rewind hold and found NO claim on the scope at
@@ -236,6 +285,11 @@ const holdKeyOf = (kind, key) => (kind === 'system' ? key : peerSubjectRef(key))
 export class CloudflareScopeHost {
     admin;
     scopeNs;
+    scopeStoreRunners;
+    scopeStoreVertical;
+    scopeStoreLifecycle;
+    scopeStoreKinds;
+    scopeStoreTransport;
     cp;
     servicePrincipals;
     /** No control plane bound — `this.cp` is the throwing null object (Phase 3, CP-less). */
@@ -350,6 +404,11 @@ export class CloudflareScopeHost {
         this.connectorCalls = options.connectorCalls ?? noopConnectorCallRecorder;
         this.scopeLocalPermissions = options.scopeLocalPermissions ?? false;
         this.scopeNs = options.scope;
+        this.scopeStoreVertical = options.scopeStores?.vertical;
+        this.scopeStoreKinds = options.scopeStores?.kinds ?? {};
+        this.scopeStoreTransport = options.scopeStores?.transport ?? 'binding';
+        this.scopeStoreRunners = scopeStoreRunnersOf(options.scopeStores);
+        this.scopeStoreLifecycle = scopeStoreLifecycleOf(this.scopeStoreRunners);
         this.cpLess = !options.controlPlane;
         this.cp = options.controlPlane
             ? options.controlPlane.get(options.controlPlane.idFromName('control-plane'))
@@ -1124,7 +1183,9 @@ export class CloudflareScopeHost {
      * control plane, which calls the vertical's `/internal/delete-scope` before deleting
      * the row; this end just destroys its own bytes.
      */
-    async deleteScopeLocal(scopeId) {
+    async deleteScopeLocal(scopeId, tenantId) {
+        if (tenantId)
+            await this.wipeScopeStores(tenantId, scopeId);
         await this.scopeStub(scopeId).destroyStorage();
         // #1819: a deleted scope runs nothing; its claims go with it. Best effort, never a failed reap.
         await this.switchHoldsStub()
@@ -1188,6 +1249,27 @@ export class CloudflareScopeHost {
     async databaseSizeLocal(scopeId) {
         return this.scopeStub(scopeId).databaseSize();
     }
+    /**
+     * Each scope store's size in this deployment (#2207). The control plane already
+     * audited the ask; this end does not write the access log again.
+     */
+    async scopeStoreSizesLocal(tenantId, scopeId) {
+        return this.readScopeStoreSizes(tenantId, scopeId);
+    }
+    /**
+     * Erase one subject from each scope store in this deployment (#2068). The control
+     * plane calls this once on the serving script, then destroys the key itself.
+     */
+    async scopeStoreExportLocal(tenantId, scopeId) {
+        return this.exportScopeStores(tenantId, scopeId);
+    }
+    async scopeStoreImportLocal(tenantId, scopeId, stores) {
+        this.refuseUnusableScopeStores(stores);
+        await this.importScopeStores(tenantId, scopeId, stores);
+    }
+    async scopeStoreEraseLocal(tenantId, scopeId, subjectId) {
+        return this.eraseScopeStores(tenantId, scopeId, subjectId);
+    }
     /**
      * The oldest not-yet-drained events of this host's own scope (#1334) — the far end of
      * the control plane's `EventDrainDelegation`. Bounded the same way the audited verb is,
@@ -1706,6 +1788,7 @@ export class CloudflareScopeHost {
         return { record, body: obj.body, contentType: obj.contentType ?? record.contentType };
     }
     async importScope(actor, input, dump) {
+        this.refuseUnusableScopeStores(dump.stores, input.vertical ?? null);
         // Create the destination scope (directory row + DO + lazy migrate); the DO then
         // replaces its provisioned schema with the dump wholesale (drop-then-replay), so
         // the end state is the dump, at the source's frontier. Provenance is stamped from
@@ -1720,6 +1803,7 @@ export class CloudflareScopeHost {
             // A fork: its callers (snapshotScope) hand it a dump the platform exported.
             exact: true,
         });
+        await this.importScopeStores(input.tenantId, input.scopeId, dump.stores);
         await this.admin.activateScope(actor, input.tenantId, input.scopeId);
         await this.recordAdmin(actor, 'importScope', { tenantId: input.tenantId, scopeId: input.scopeId }, null, { sourceScopeId: dump.scopeId, tables: dump.tables.length, capturedAt: dump.capturedAt });
     }
@@ -1728,6 +1812,7 @@ export class CloudflareScopeHost {
         const existing = await this.admin.getScopeRecord(actor, tenantId, scopeId);
         if (!existing)
             throw substratError('not_found', `unknown scope ${scopeId} in tenant ${tenantId}`);
+        this.refuseUnusableScopeStores(dump.stores, existing.vertical);
         // #1742: a dump from before a switch was pulled brings the module's grants back live, so
         // the directory's recorded-off modules go back off in the replay's own event. Only where
         // this is the scope's real store, as for the provision's seat above; a hosted scope is
@@ -1739,10 +1824,18 @@ export class CloudflareScopeHost {
             switchOff: carry ? { at: replayAt, ...carry } : undefined,
             sourceScopeId: opts?.sourceScopeId ?? dump.scopeId,
         });
-        await this.recordAdmin(actor, 'restoreScope', { tenantId, scopeId }, null, { sourceScopeId: dump.scopeId, tables: dump.tables.length, capturedAt: dump.capturedAt });
+        await this.importScopeStores(tenantId, scopeId, dump.stores);
+        const replay = await this.replayShreddedStoreErasures(actor, tenantId, scopeId, (opts?.sourceScopeId ?? dump.scopeId));
+        await this.recordAdmin(actor, 'restoreScope', { tenantId, scopeId }, null, {
+            sourceScopeId: dump.scopeId,
+            tables: dump.tables.length,
+            capturedAt: dump.capturedAt,
+            ...replay,
+        });
         if (carry) {
             await this.admin.reassertSystemSwitches(actor, { tenantId, scopeId }, { appliedInUnit: switchedOff });
         }
+        return replay;
     }
     /**
      * #1742, #2029: what this host's own unit carries of the directory's record — the modules and
@@ -1814,6 +1907,7 @@ export class CloudflareScopeHost {
         // Storage BEFORE the directory row: a crash between the two leaves a visible row
         // over empty storage — re-running deleteSnapshot converges — never orphaned bytes
         // with no record (the §9 hazard). Hostname rows go with the directory delete.
+        await this.wipeScopeStores(tenantId, scopeId);
         await this.scopeStub(scopeId).destroyStorage();
         await this.cp.deleteScopeDirectory(scopeId);
         await this.recordAdmin(actor, 'deleteSnapshot', { tenantId, scopeId }, null, {
@@ -1866,6 +1960,294 @@ export class CloudflareScopeHost {
         await this.migrateAndRecord(scopeId);
         return this.buildStub(tenantId, scopeId, principal, undefined, undefined, options);
     }
+    async getScopeStore(_principal, tenantId, scopeId, binding, options) {
+        if (this.scopeStoreTransport === 'platform') {
+            return {
+                tenantId,
+                scopeId,
+                subjectKind: 'principal',
+                invoke: (operation, input, ...extra) => observeStoreCall(binding, operation, () => callScopeStore(async (request) => {
+                    const response = await this.fetchImpl(STORE_CALL_URL, {
+                        method: 'POST',
+                        headers: { 'content-type': 'application/json' },
+                        body: JSON.stringify({ scopeId, binding, operation: request.operation, input: request.input }),
+                    });
+                    try {
+                        return await response.json();
+                    }
+                    catch {
+                        throw new StoreError({ code: 'bad_envelope', status: 502 });
+                    }
+                }, operation, input, ...extra), options?.onStoreCall),
+            };
+        }
+        // A missing binding is answered before any directory read. A CP-less host's
+        // directory throws a plain Error, and a vertical with no store must not meet it.
+        const runner = this.scopeStoreRunners.get(binding);
+        const bound = runner ? undefined : ambientBinding(scopeStoreBindingName(binding));
+        if (!runner && (this.scopeStoreRunners.size > 0 || !isScopeStoreNamespace(bound))) {
+            throw substratError('not_found', `no scope store is bound for '${binding}'`);
+        }
+        const vertical = await this.scopeStoreVerticalOf(tenantId, scopeId);
+        await this.assertLive(tenantId, scopeId);
+        if (runner) {
+            await this.scopeStoreLifecycle.start();
+            return {
+                tenantId,
+                scopeId,
+                subjectKind: 'principal',
+                invoke: (operation, input, ...extra) => observeStoreCall(binding, operation, () => callScopeStore((request) => runner.invoke({ tenantId, vertical, scopeId, binding }, request), operation, input, ...extra), options?.onStoreCall),
+            };
+        }
+        const namespace = bound;
+        const objectName = scopeStoreObjectName(tenantId, vertical, scopeId, binding);
+        const object = namespace.get(namespace.idFromName(objectName));
+        return {
+            tenantId,
+            scopeId,
+            subjectKind: 'principal',
+            invoke: (operation, input, ...extra) => observeStoreCall(binding, operation, () => callScopeStore(storeObjectSend(object), operation, input, ...extra), options?.onStoreCall),
+        };
+    }
+    /**
+     * Which vertical names the store object. With a control plane, the scope row.
+     * Without one, {@link CloudflareScopeHostOptions.scopeStores} — the worker
+     * already knows which vertical it is, and the directory is not there to ask.
+     */
+    async scopeStoreVerticalOf(tenantId, scopeId) {
+        if (this.cpLess) {
+            if (!this.scopeStoreVertical) {
+                throw substratError('unavailable', 'a scope store on a host with no control plane needs scopeStores.vertical');
+            }
+            return this.scopeStoreVertical;
+        }
+        const scope = await this.cp.getScopeRecord(tenantId, scopeId);
+        const vertical = scope?.vertical;
+        if (!vertical) {
+            throw substratError('not_found', `scope ${scopeId} has no vertical, so it has no scope store`);
+        }
+        if (this.scopeStoreVertical !== undefined && vertical !== this.scopeStoreVertical) {
+            throw substratError('forbidden', `this host serves vertical '${this.scopeStoreVertical}', and scope ${scopeId} runs '${vertical}'`);
+        }
+        return vertical;
+    }
+    /** Configured runners, or the ambient namespaces when none were handed in. */
+    scopeStoreBindingNames() {
+        if (this.scopeStoreRunners.size > 0)
+            return [...this.scopeStoreRunners.keys()];
+        return ambientScopeStoreBindings();
+    }
+    /**
+     * One reserved call. A configured runner is preferred; otherwise the ambient
+     * namespace. `callReservedStoreOperation` refuses a name that is not reserved.
+     */
+    async invokeReservedStore(address, operation, input) {
+        const runner = this.scopeStoreRunners.get(address.binding);
+        if (runner) {
+            await this.scopeStoreLifecycle.start();
+            return callReservedStoreOperation((request) => runner.invoke(address, request), operation, input);
+        }
+        if (this.scopeStoreRunners.size > 0) {
+            throw substratError('not_found', `no scope store is bound for '${address.binding}'`);
+        }
+        const bound = ambientBinding(scopeStoreBindingName(address.binding));
+        if (!isScopeStoreNamespace(bound)) {
+            throw substratError('not_found', `no scope store is bound for '${address.binding}'`);
+        }
+        const objectName = scopeStoreObjectName(address.tenantId, address.vertical, address.scopeId, address.binding);
+        const object = bound.get(bound.idFromName(objectName));
+        return callReservedStoreOperation(storeObjectSend(object), operation, input);
+    }
+    /**
+     * Each declared binding's `substrat.size`. No bindings means an empty list,
+     * and that answer does not read the directory: a host with no store, including
+     * one with no control plane, has nothing to size. Once a binding exists, the
+     * scope is gated before any object is addressed: by the directory with a control
+     * plane, and without one by the door's own gate (`assertLive`: the scope's
+     * admission of the tenant and its delivered lifecycle), as `getScopeStore` is.
+     */
+    async readScopeStoreSizes(tenantId, scopeId) {
+        const bindings = this.scopeStoreBindingNames();
+        if (bindings.length === 0)
+            return [];
+        if (!this.cpLess)
+            await this.scopeRecordForRead(tenantId, scopeId);
+        const vertical = await this.scopeStoreVerticalOf(tenantId, scopeId);
+        if (this.cpLess)
+            await this.assertLive(tenantId, scopeId);
+        const sizes = [];
+        for (const binding of bindings) {
+            const { bytes } = await this.invokeReservedStore({ tenantId, vertical, scopeId, binding }, 'substrat.size');
+            sizes.push({ binding, bytes });
+        }
+        return sizes;
+    }
+    /**
+     * `substrat.erase` on each declared binding (#2068). A store error throws so the
+     * caller can leave the subject key untouched. Fail closed: an empty answer means
+     * this host KNOWS it holds nothing for the scope, never that it could not tell.
+     */
+    async eraseScopeStores(tenantId, scopeId, subjectId) {
+        const bindings = this.scopeStoreBindingNames();
+        if (bindings.length === 0)
+            return [];
+        const vertical = await this.erasureStoreVertical(tenantId, scopeId);
+        if (!vertical)
+            return [];
+        const erasures = [];
+        for (const binding of bindings) {
+            const { erased } = await this.invokeReservedStore({ tenantId, vertical, scopeId, binding }, 'substrat.erase', { subjectId });
+            erasures.push({ binding, erased });
+        }
+        return erasures;
+    }
+    /** A runner's kind, or the kind declared for an ambient binding. Never invented. */
+    scopeStoreKind(binding) {
+        const kind = this.scopeStoreRunners.get(binding)?.kind ?? this.scopeStoreKinds[binding];
+        if (!kind) {
+            throw substratError('unavailable', `scope store '${binding}' has no declared kind`);
+        }
+        return kind;
+    }
+    /**
+     * A dump's stores this host cannot load are refused before any write (#2211, L8): a
+     * binding that is not bound, a kind other than the bound one, or any store at all for
+     * a destination with no vertical (no store object can be named for it, so loading would
+     * drop them), or a destination on a vertical other than the one this host is pinned to.
+     * `vertical` undefined is a caller that cannot read the destination here;
+     * `importScopeStores` then refuses a scope with no vertical itself, still before a store
+     * write. A store with no `kind` is refused: the dump contract requires one, and an
+     * unparsed dump would otherwise skip the kind comparison.
+     */
+    refuseUnusableScopeStores(stores, vertical) {
+        const listed = stores ?? [];
+        if (listed.length === 0)
+            return;
+        if (vertical === null) {
+            throw substratError('conflict', 'dump carries scope stores, and the destination scope has no vertical to hold them');
+        }
+        if (vertical !== undefined && this.scopeStoreVertical !== undefined && vertical !== this.scopeStoreVertical) {
+            throw substratError('forbidden', `this host serves vertical '${this.scopeStoreVertical}', and the destination scope runs '${vertical}'`);
+        }
+        const bound = new Set(this.scopeStoreBindingNames());
+        for (const store of listed) {
+            if (!bound.has(store.binding)) {
+                throw substratError('not_found', `dump names scope store '${store.binding}', which is not bound`);
+            }
+            if (!store.kind) {
+                throw substratError('validation_failed', `dump's scope store '${store.binding}' names no kind`);
+            }
+            const kind = this.scopeStoreRunners.get(store.binding)?.kind ?? this.scopeStoreKinds[store.binding];
+            if (store.kind !== kind) {
+                throw substratError('conflict', `dump's scope store '${store.binding}' is kind '${store.kind}', and this host binds kind '${kind ?? 'undeclared'}'`);
+            }
+        }
+    }
+    async exportScopeStores(tenantId, scopeId) {
+        // No binding is no store, answered before the directory read: a host with no control
+        // plane cannot make that read, and a deployment with no store must not fail an export.
+        const bindings = this.scopeStoreBindingNames();
+        if (bindings.length === 0)
+            return [];
+        const vertical = await this.lifecycleStoreVertical(tenantId, scopeId);
+        if (!vertical)
+            return [];
+        const stores = [];
+        for (const binding of bindings) {
+            const exported = await this.invokeReservedStore({ tenantId, vertical, scopeId, binding }, 'substrat.export');
+            stores.push({
+                binding,
+                kind: this.scopeStoreKind(binding),
+                tables: exported.tables,
+            });
+        }
+        return stores;
+    }
+    async importScopeStores(tenantId, scopeId, stores) {
+        const listed = stores ?? [];
+        if (listed.length === 0)
+            return;
+        const vertical = await this.lifecycleStoreVertical(tenantId, scopeId);
+        if (!vertical) {
+            throw substratError('conflict', `dump carries scope stores, and scope ${scopeId} has no vertical to hold them`);
+        }
+        for (const store of listed) {
+            await this.invokeReservedStore({ tenantId, vertical, scopeId, binding: store.binding }, 'substrat.import', { tables: store.tables });
+        }
+    }
+    /**
+     * `substrat.erase` again for every tombstoned subject (#2207), on the target's and the
+     * source's marks (`replayStoreErasures`). A target this host names no store for (no
+     * binding, or no vertical a store is kept for) has nothing to replay into: nothing is read.
+     */
+    async replayShreddedStoreErasures(actor, tenantId, target, source) {
+        if (this.scopeStoreBindingNames().length === 0)
+            return undefined;
+        if (!(await this.erasureStoreVertical(tenantId, target)))
+            return undefined;
+        return replayStoreErasures({
+            admin: this.admin,
+            actor,
+            tenantId,
+            target,
+            source,
+            erase: async (subjectId) => (await this.eraseScopeStores(tenantId, target, subjectId)).length,
+        });
+    }
+    /** `substrat.wipe` on each declared binding, before the scope's own storage goes. */
+    async wipeScopeStores(tenantId, scopeId) {
+        const bindings = this.scopeStoreBindingNames();
+        if (bindings.length === 0)
+            return;
+        const vertical = await this.lifecycleStoreVertical(tenantId, scopeId);
+        if (!vertical)
+            return;
+        for (const binding of bindings) {
+            await this.invokeReservedStore({ tenantId, vertical, scopeId, binding }, 'substrat.wipe');
+        }
+    }
+    /**
+     * The vertical a store export, import or wipe names. With a control plane, the scope row
+     * (`scopeRecordForRead`: unknown and reaped scopes refused, `null` for a scope with no
+     * vertical, a vertical this host is not pinned to refused). Without one, there is no
+     * directory to read: the host's configured vertical (`scopeStoreVerticalOf`).
+     *
+     * Never gated on the scope being active, on either host. These calls are the platform's own
+     * lifecycle work on scopes that often are not: a reap backs up and wipes an archived scope, a
+     * snapshot or a full pull may copy a suspended one, and a fork's stores land before it is
+     * activated. The scope's tables are exported and imported on the same terms.
+     */
+    async lifecycleStoreVertical(tenantId, scopeId) {
+        if (this.cpLess)
+            return this.scopeStoreVerticalOf(tenantId, scopeId);
+        const scope = await this.scopeRecordForRead(tenantId, scopeId);
+        if (!scope.vertical)
+            return null;
+        if (this.scopeStoreVertical !== undefined && scope.vertical !== this.scopeStoreVertical) {
+            throw substratError('forbidden', `this host serves vertical '${this.scopeStoreVertical}', and scope ${scopeId} runs '${scope.vertical}'`);
+        }
+        return scope.vertical;
+    }
+    /**
+     * The vertical an erasure names a store for. With a control plane, the scope row
+     * decides: no vertical, or not the vertical this host is pinned to, means no
+     * store object of this host's is the scope's — an empty answer, which shred
+     * needs for a scope that never had a vertical. With no control plane and no
+     * `scopeStores.vertical`, the host cannot tell which objects are the scope's, so
+     * it refuses `unavailable` as the size read and the door do, and the subject key
+     * survives until the stores can be erased.
+     */
+    async erasureStoreVertical(tenantId, scopeId) {
+        if (this.cpLess)
+            return this.scopeStoreVerticalOf(tenantId, scopeId);
+        const scope = await this.cp.getScopeRecord(tenantId, scopeId);
+        const vertical = scope?.vertical ?? undefined;
+        if (!vertical)
+            return undefined;
+        if (this.scopeStoreVertical !== undefined && vertical !== this.scopeStoreVertical)
+            return undefined;
+        return vertical;
+    }
     /**
      * A scope stub whose authority is a CONNECTION (#97).
      *
@@ -2148,7 +2530,9 @@ export class CloudflareScopeHost {
      * here, and the ScopeDO admits the peer inside its queue on every invoke and acknowledges it.
      */
     async getVerticalScope(caller, tenantId, scopeId, options) {
-        const parsed = verticalCaller.parse(caller);
+        // #2252: the caller as this vertical's `peers` names it, before the door's pin or the DO
+        // reads it — so both key on the declared name, exactly as the seats and the switch do.
+        const parsed = peerCallerAt(collectPeers(this.peerSources), verticalCaller.parse(caller));
         await this.peerScopeGate(tenantId, scopeId, 'getVerticalScope');
         // #2029: gated against the rewind hold and pinned, as the system door is.
         const door = await this.openDoor('peer', parsed.vertical, scopeId);
@@ -2793,7 +3177,7 @@ export class CloudflareScopeHost {
         };
     }
     async close() {
-        // Nothing to drain: every admin write awaits its RPC to completion inline.
+        await this.scopeStoreLifecycle.stop();
     }
     // -- admin surface --------------------------------------------------------
     /** #977: this host, with every admin row it writes naming who the actor acted for. */
@@ -4399,6 +4783,11 @@ export class CloudflareScopeHost {
                 await this.recordAccess(actor, 'scopeDatabaseSize', { tenantId, scopeId }, null, 1);
                 return bytes;
             },
+            scopeStoreSizes: async (actor, tenantId, scopeId) => {
+                const sizes = await this.readScopeStoreSizes(tenantId, scopeId);
+                await this.recordAccess(actor, 'scopeStoreSizes', { tenantId, scopeId }, null, sizes.length);
+                return sizes;
+            },
             rewindScope: async (actor, tenantId, scopeId, bookmark, opts) => {
                 const scope = await this.cp.getScopeRecord(tenantId, scopeId);
                 if (!scope)
@@ -4834,7 +5223,8 @@ export class CloudflareScopeHost {
                 await this.scopeRecordForRead(tenantId, scopeId);
                 const tables = await this.scopeStub(scopeId).exportDump();
                 await this.recordAccess(actor, 'exportScope', { tenantId, scopeId }, null, tables.length);
-                return { tenantId, scopeId, capturedAt: new Date().toISOString(), tables };
+                const stores = await this.exportScopeStores(tenantId, scopeId);
+                return { tenantId, scopeId, capturedAt: new Date().toISOString(), tables, stores };
             },
             exportDirectory: async (actor) => {
                 // No K-3 cross-check to make: there is one directory, and it is the thing that
@@ -4928,6 +5318,7 @@ export class CloudflareScopeHost {
                     throw substratError('conflict', `scope ${scopeId} still resolves hostname '${bound[0].hostname}' — ` +
                         `unbind it before reaping (reap wipes storage and cannot be undone)`);
                 }
+                await this.wipeScopeStores(tenantId, scopeId);
                 await this.scopeStub(scopeId).destroyStorage();
                 // The recoverable copy the caller stored first (#493), named in the audit entry so
                 // the trail answers "was there a backup" without correlating two timestamps.
@@ -4948,6 +5339,14 @@ export class CloudflareScopeHost {
                 await this.recordAccess(actor, 'openSubjectPayloads', { tenantId, scopeId }, { subjects: new Set(items.map((i) => i.subjectId)).size }, opened.filter((o) => o !== null).length);
                 return opened;
             },
+            listShreddedSubjects: async (actor, tenantId, scopeId, cursor) => {
+                await this.assertScope(tenantId, scopeId);
+                const rows = await this.cp.listShreddedSubjects(scopeId, tenantId, cursor ?? null);
+                const subjects = rows.slice(0, 100);
+                const nextCursor = rows.length > 100 ? (subjects[99] ?? null) : null;
+                await this.recordAccess(actor, 'listShreddedSubjects', { tenantId, scopeId }, null, subjects.length);
+                return { subjects, nextCursor };
+            },
             shredSubject: async (actor, tenantId, scopeId, subjectId) => {
                 await this.assertScope(tenantId, scopeId);
                 // #1722: a direct shred claims nothing; it records the epoch it ran under, as an orchestrated
@@ -5012,6 +5411,8 @@ export class CloudflareScopeHost {
                 // The directory's failure text (#1632) — a drain failure quoting one of those intents,
                 // an issue's exemplar, a sweep record's error. Still before the key.
                 await this.cp.redactSubjectText({ tenantId, scopeId, subjectId, intentIds });
+                // Scope stores after the scope-side redaction and before the key (#2068).
+                const storeErasures = await this.eraseScopeStores(tenantId, scopeId, subjectId);
                 const at = new Date().toISOString();
                 const { existed } = await this.subjectKeysFor(tenantId, scopeId).destroy(subjectId, at);
                 const receipt = subjectShredReceipt.parse({
@@ -5020,6 +5421,7 @@ export class CloudflareScopeHost {
                     intentsRedacted,
                     jobRunsRedacted,
                     ...vertical,
+                    storeErasures,
                     keyDestroyed: existed,
                     tombstoned: true,
                 });
@@ -5033,7 +5435,7 @@ export class CloudflareScopeHost {
                 return receipt;
             },
             scopeErasureEpoch: async (_actor, tenantId, scopeId) => this.cp.scopeErasureEpoch(tenantId, scopeId),
-            finalizeSubjectShred: async (actor, tenantId, scopeId, subjectId, redactions, expected) => {
+            finalizeSubjectShred: async (actor, tenantId, scopeId, subjectId, redactions, expected, storeErasures = []) => {
                 await this.assertScope(tenantId, scopeId);
                 if (redactions.length === 0)
                     throw substratError('conflict', 'subject erasure has no confirmed scope redaction');
@@ -5051,6 +5453,7 @@ export class CloudflareScopeHost {
                     verticalRows: redactions.flatMap((r) => r.vertical.verticalRows),
                     hookRows: redactions.flatMap((r) => r.vertical.hookRows),
                     unreachedEntities: redactions.flatMap((r) => r.vertical.unreachedEntities),
+                    storeErasures,
                     keyDestroyed: existed,
                     tombstoned: true,
                 });
@@ -5164,6 +5567,7 @@ export class CloudflareScopeHost {
                     })),
                     storage: rows.storage,
                     storageAttempts: rows.storageAttempts,
+                    storeStorage: rows.storeStorage,
                 });
                 // Tenants covered, not totals: "read one tenant's meter" and "metered the whole
                 // fleet" are different acts, and K-24 exists to tell them apart.
@@ -6760,39 +7164,7 @@ export class CloudflareScopeHost {
                 expires_at: null,
                 lockout_reseat: true,
             },
-            // #461: each registered module's SCHEDULE grants (#383) ride the same unit —
-            // the CP-less mirror of `provisionScope`'s seatTuple loop. Without them the
-            // grant-is-the-switch check makes every schedule a silent no-op (`fired: 0`,
-            // no error — the #49 unfalsifiable zero).
-            ...[...this.moduleSchedules].flatMap(([modId, schedules]) => {
-                const perms = new Set();
-                for (const s of schedules)
-                    for (const p of s.permissions)
-                        perms.add(p);
-                return [...perms].map((perm) => ({
-                    subject: `system:${modId}`,
-                    relation: `granted:${perm}`,
-                    object: `scope:${input.scopeId}`,
-                    expires_at: null,
-                }));
-            }),
-            // #1706: each declared PEER's grants ride the same unit — the CP-less mirror of
-            // `provisionScope`'s peer seat, through the one function that decides it.
-            ...peerSeats(collectPeers(this.peerSources), input.scopeId).map((seat) => ({
-                subject: seat.subject,
-                relation: seat.relation,
-                object: seat.object,
-                expires_at: null,
-            })),
-            // #592: the tenant's connection grants ride the same unit — the provision-time
-            // mirror of `connectorGrantLocal`, so the connector return path works on every
-            // install, not only the one that existed when `grantToConnection` ran.
-            ...(input.connectionGrants ?? []).map((g) => ({
-                subject: `connection:${g.connectionId}`,
-                relation: `granted:${g.permission}`,
-                object: `scope:${input.scopeId}`,
-                expires_at: g.expiresAt ?? null,
-            })),
+            ...this.declaredSeatsLocal(input.scopeId, input.connectionGrants),
         ], 
         // #406: identity links, delivered by the platform with provisioning exactly as
         // entitlements are (#310). Preserve-on-undefined, so an absent field never wipes
@@ -6829,6 +7201,53 @@ export class CloudflareScopeHost {
             ...(shapes?.boundEver ? { boundShapeTypes: shapes.boundEver } : {}),
         };
     }
+    /**
+     * The tuples this deployment's code declares for one scope, seated by every provision and
+     * reconcile: each module's SCHEDULE grants (#383, #461 — without them the grant-is-the-switch
+     * check makes every schedule a silent no-op), each declared PEER's keys (#1706, through the one
+     * function that decides them), and the tenant's connection grants the platform delivered (#592,
+     * the provision-time mirror of `connectorGrantLocal`).
+     */
+    declaredSeatsLocal(scopeId, connectionGrants) {
+        return [
+            ...[...this.moduleSchedules].flatMap(([modId, schedules]) => {
+                const perms = new Set();
+                for (const s of schedules)
+                    for (const p of s.permissions)
+                        perms.add(p);
+                return [...perms].map((perm) => ({ subject: `system:${modId}`, relation: `granted:${perm}`, object: `scope:${scopeId}`, expires_at: null }));
+            }),
+            ...peerSeats(collectPeers(this.peerSources), scopeId).map((seat) => ({ ...seat, expires_at: null })),
+            ...(connectionGrants ?? []).map((g) => ({
+                subject: `connection:${g.connectionId}`,
+                relation: `granted:${g.permission}`,
+                object: `scope:${scopeId}`,
+                expires_at: g.expiresAt ?? null,
+            })),
+        ];
+    }
+    /**
+     * The ownerless reconcile (#2263): what a reconcile does for a vertical that keeps no owner of
+     * record, so a scope provisioned before a version's declarations still receives them. It SEATS
+     * `declaredSeatsLocal` and re-applies the directory's recorded-off positions in the same unit
+     * (#1742), and does nothing else: no owner seat, no projection (roles, entitlements, identity
+     * links, sealing keys and tenant tuples are left exactly as they are), and no entity-grant
+     * shape top-up or retirement. Every seat is `seatScopeTuple`'s, so a revoked grant stays revoked
+     * and a switched-off subject gets nothing. It can therefore only add what the running code
+     * declares, and never takes anything away but a recorded OFF.
+     *
+     * Only a scope already provisioned for `tenantId` is seated (`servesTenant`, K-3): this never
+     * provisions a scope, and never writes into another tenant's.
+     */
+    async seatScopeLocal(input) {
+        const stub = this.scopeStub(input.scopeId);
+        if (!(await stub.servesTenant(input.tenantId)))
+            throw unknownScopeForTenant(input.tenantId, input.scopeId);
+        const carry = recordedOffFromWire(input);
+        await this.migrateAndRecord(input.scopeId);
+        const switchedOff = await stub.seatTuples(this.declaredSeatsLocal(input.scopeId, input.connectionGrants), carry ? { scopeId: input.scopeId, at: new Date().toISOString(), ...carry } : undefined);
+        return carry ? { switchedOff } : {};
+    }
     /**
      * Resolve an external identity from a scope's PROJECTED links (#406) — the CP-less
      * auth adapter's read path, the local equivalent of `HostAdmin.resolveIdentity` (same