@substrat-run/adapter-cloudflare 0.146.0 → 0.148.0

package/dist/host.js

@@ -1,11 +1,12 @@
 import { env as ambientEnv } from 'cloudflare:workers';
 import { isRewindRefusal, REWIND_REFUSED } from './rewind-refusal.js';
 import { isSystemDoorMoved, SYSTEM_DOOR_MOVED, SYSTEM_DOOR_REGATES } from './system-door.js';
-import { delegatedReadParams, operationSeriesCount, fromWireFailure, isSubstratError, exportReadInput, exportedBatch, importBatch, importResult, importState, importsOfManifestJson, exportsOfManifestJson, assertNoBindingShapeBreak, importCursorMove, importCursorMoveAt, importCursorMoved, accessLogEntry, adminLogEntry, opsFailureEntry, opsFailureFingerprint, issueEntry, findingEntry, findingRuleEntry, sweepRunEntry, FRESHNESS_HEARTBEAT_MINUTES, sweepRunsPayload, modelUsageEntry, attachmentRecord, createTenantInput, identityLink, identityPool, createOrgInput, promotionAcknowledgement, bindAcknowledgement, bindHostnameInput, channelHistoryEntry, hostnameBinding, publishVersionInput, AUTO_ADMISSION_NOTE, registerVerticalInput, vertical as verticalSchema, verticalServingState, verticalChannel, verticalVersion, connection, capabilityExchange, mintedCapability, boundedBecomeMint, boundedBecomeRevoke, boundedUnbind, entityRef, becomeLinkState, principalBecomeCapabilityInput, capabilityGrant, principalId, connectionGrant, connectionGrantRecord, connectionSecret, systemGrant, systemSwitch, systemSwitchOutcome, systemScheduleEntry, systemSwitchRecord, entitlementGrant, entitlementGrantInput, capabilityFilter, instant, meterReading, scopeStorageSample, subjectRef, createConnectionInput, connectLinkFilter, connectLinkKey, consumeConnectLinkInput, mintConnectLinkInput, projectedConnectionGrant, projectedConnectionKey, moduleManifest, org as orgSchema, orgMembership, resolvedIdentity, identityMembership, roleDefinition, scope as scopeSchema, tenant as tenantSchema, tenantRole, delegatedReadRecord, ownerTransferAudit, memberChangeAudit, peerBindingAudit, copyMarkAudit, subjectShredReceipt, connectorDispatchKind, callsOfManifestJson, outboundOfManifestJson, SCOPE_GATE_REASONS, substratError, redrainEventsInput, coverage, peerCoverage, peerGrantsEntry, peerSwitch, peerSwitchOutcome, verticalCaller, verticalResolution, peerInstanceResolution, peerBinding as peerBindingSchema, verticalSlug, entityObjectRef, ATTACHMENT_BLOB_BINDING, blobStoreBindingName, lifecycleDelivery, scopeLifecycle, } from '@substrat-run/contracts';
+import { delegatedReadParams, operationSeriesCount, fromWireFailure, isSubstratError, exportReadInput, exportedBatch, importBatch, importResult, importState, importsOfManifestJson, exportsOfManifestJson, assertNoBindingShapeBreak, importCursorMove, importCursorMoveAt, importCursorMoved, accessLogEntry, adminLogEntry, opsFailureEntry, opsFailureFingerprint, issueEntry, findingEntry, findingRuleEntry, sweepRunEntry, FRESHNESS_HEARTBEAT_MINUTES, sweepRunsPayload, modelUsageEntry, attachmentRecord, createTenantInput, identityLink, identityPool, createOrgInput, promotionAcknowledgement, bindAcknowledgement, bindHostnameInput, channelHistoryEntry, hostnameBinding, publishVersionInput, AUTO_ADMISSION_NOTE, registerVerticalInput, vertical as verticalSchema, verticalServingState, verticalChannel, verticalVersion, connection, capabilityExchange, mintedCapability, boundedBecomeMint, boundedBecomeRevoke, boundedUnbind, entityRef, becomeLinkState, principalBecomeCapabilityInput, capabilityGrant, principalId, connectionGrant, connectionGrantRecord, connectionSecret, systemGrant, systemSwitch, systemSwitchOutcome, systemScheduleEntry, systemSwitchRecord, entitlementGrant, entitlementGrantInput, capabilityFilter, instant, meterReading, scopeStorageSample, subjectRef, createConnectionInput, connectLinkFilter, connectLinkKey, consumeConnectLinkInput, mintConnectLinkInput, projectedConnectionGrant, projectedConnectionKey, moduleManifest, org as orgSchema, orgMembership, resolvedIdentity, identityMembership, roleDefinition, scope as scopeSchema, tenant as tenantSchema, tenantRole, delegatedReadRecord, ownerTransferAudit, memberChangeAudit, peerBindingAudit, connectionBindingAudit, copyMarkAudit, subjectShredReceipt, connectorDispatchKind, callsOfManifestJson, outboundOfManifestJson, SCOPE_GATE_REASONS, substratError, redrainEventsInput, coverage, peerCoverage, peerGrantsEntry, peerSwitch, peerSwitchOutcome, verticalCaller, verticalResolution, peerInstanceResolution, peerBinding as peerBindingSchema, verticalSlug, entityObjectRef, ATTACHMENT_BLOB_BINDING, blobStoreBindingName, lifecycleDelivery, scopeLifecycle, } from '@substrat-run/contracts';
 import { normalizeHostname, toRouteTarget } from './route-resolver.js';
-import { attachmentBlobKey, attachmentSha256, entitlementDenial, requiredEntitlementFor, foldMeterReading, parseValidationRecords, resolveScopeRecord, ulid, KEPT_COPY_REFUSAL, capabilityTokenHash, checkBecomeInput, assertBecomeLinkStateIds, plausibleSessionToken, foldModelUsage, backoffAt, resolveRetryPolicy, executorOutcomeOf, isDeliveryRefusal, refusalJournalText, isSecretBoxConfigured, unconfiguredSecretBox, createSubjectKeys, generateSealingKeyPair, openSealed, ImpersonationRefused, assertSessionUsable, impersonationRowValues, mapImpersonationRow, newImpersonationSession, jobRunOf, assertLeaseMs, runDueJobRuns, SYSTEM_DOOR_WAIT, startJobRun, attachmentTextJob, assertAttachmentExtractors, resolveAttachmentTextBounds, assertJobRegistrable, ATTACHMENT_TEXT_BACKFILL_JOB, ATTACHMENT_TEXT_JOB, kernelJobFor, attachmentTextBackfillJob, searchLimit, searchMatchExpression, globalFetch, assertRedrainWindow, platformRequestOf, undrainedEventsOf, inUnitMovesToAudit, staleCarryRevertRow, staleCarryReverts, recordedOffFromWire, peerSubjectRef, SWITCH_KINDS, reassertActionOf, reassertEntry, reassertOffRow, reassertOnRow, switchActionOf, switchAuditSubject, recordAuditOutcome, auditedCapabilityRevoke, auditWarningOf, switchNotFoundMessage, recordWriteSuperseded, switchSubjectOf, switchSupersededMessage, withRecorded, systemSwitchedOffMessage, tenantSystemSwitchedOffMessage, CrossVerticalRegistry, importCursorSourceOf, exportBreaksOf, exportBreakRefusal, bindExportBreaksOf, bindExportBreakRefusal, scopeMoveOf, runningVersionOf, strandJudgmentsOf, boundShapesOfColumn, installReconciled, collectPeers, peerCallerAt, peerSeats, connectorCallRecord, noopConnectorCallRecorder, recordConnectorCall, settleConnectionUse, splitManifestMigrations, unknownRoleError, assertRowLimit, assertRowOffset, emptyImportResult, INERT_SCOPE_REASON, lifecycleReceipt, lifecycleRefusal, isPrimaryScope, isPrimaryScopeRow, asyncInvocationId, asyncLinePass, assertNoCallerPurge, purgeReportOf, purgeStillDue, assertBoundOperations, registerTrashTargets, memberAddedAudit, shapeTopUpBatch, } from '@substrat-run/kernel';
+import { attachmentBlobKey, UPLOAD_LINK_WRONG_TARGET, attachmentSha256, entitlementDenial, requiredEntitlementFor, foldMeterReading, parseValidationRecords, resolveScopeRecord, ulid, KEPT_COPY_REFUSAL, capabilityTokenHash, checkBecomeInput, assertBecomeLinkStateIds, plausibleSessionToken, foldModelUsage, backoffAt, resolveRetryPolicy, executorOutcomeOf, isDeliveryRefusal, refusalJournalText, isSecretBoxConfigured, unconfiguredSecretBox, createSubjectKeys, generateSealingKeyPair, openSealed, ImpersonationRefused, assertSessionUsable, impersonationRowValues, mapImpersonationRow, newImpersonationSession, jobRunOf, assertLeaseMs, runDueJobRuns, SYSTEM_DOOR_WAIT, startJobRun, attachmentTextJob, assertAttachmentExtractors, resolveAttachmentTextBounds, assertJobRegistrable, ATTACHMENT_TEXT_BACKFILL_JOB, ATTACHMENT_TEXT_JOB, kernelJobFor, attachmentTextBackfillJob, searchLimit, searchMatchExpression, globalFetch, assertRedrainWindow, platformRequestOf, undrainedEventsOf, inUnitMovesToAudit, staleCarryRevertRow, staleCarryReverts, recordedOffFromWire, peerSubjectRef, SWITCH_KINDS, reassertActionOf, reassertEntry, reassertOffRow, reassertOnRow, switchActionOf, switchAuditSubject, recordAuditOutcome, auditedCapabilityRevoke, auditWarningOf, switchNotFoundMessage, recordWriteSuperseded, switchSubjectOf, switchSupersededMessage, withRecorded, systemSwitchedOffMessage, tenantSystemSwitchedOffMessage, CrossVerticalRegistry, importCursorSourceOf, exportBreaksOf, exportBreakRefusal, bindExportBreaksOf, bindExportBreakRefusal, scopeMoveOf, runningVersionOf, strandJudgmentsOf, boundShapesOfColumn, installReconciled, collectPeers, peerCallerAt, peerSeats, connectorCallRecord, noopConnectorCallRecorder, recordConnectorCall, settleConnectionUse, splitManifestMigrations, unknownRoleError, assertRowLimit, assertRowOffset, emptyImportResult, INERT_SCOPE_REASON, lifecycleReceipt, lifecycleRefusal, isPrimaryScope, isPrimaryScopeRow, asyncInvocationId, asyncLinePass, assertNoCallerPurge, purgeReportOf, purgeStillDue, assertBoundOperations, registerTrashTargets, memberAddedAudit, shapeTopUpBatch, } from '@substrat-run/kernel';
 import { COPY_RESTORE_FENCE_LAPSED, scopeScriptCopyOf } from '@substrat-run/kernel';
-import { attributedView, isModuleErasureCounts, moduleErasurePlan, moduleRowsErased } from '@substrat-run/kernel';
+import { attributedView, isModuleErasureCounts, moduleErasurePlan, moduleRowsErased, callReservedStoreOperation, callScopeStore, observeStoreCall, replayStoreErasures, scopeStoreLifecycleOf, scopeStoreRunnersOf } from '@substrat-run/kernel';
+import { PLATFORM_BINDING_PREFIX, scopeStoreBindingName, scopeStoreObjectName, STORE_CALL_URL, StoreError } from '@substrat-run/contracts';
 import { isOrangeToOrange, isUpgradeRequest, LIVE_MODE_HEADER, LIVE_PRINCIPAL_HEADER, LIVE_SCOPE_HEADER, LIVE_SUBSCRIBE_PATH, LIVE_TENANT_HEADER, LIVE_WITHIN_HEADER, LIVE_EXPIRES_HEADER, liveInstant, encodeLiveWithin, liveWithinOf, } from './live-reads.js';
 import { tenantStoreDatabaseName } from './d1.js';
 import { blobStoreBucketName, r2TenantBlobStore } from './r2.js';
@@ -178,6 +179,21 @@ class UnattestedSwitch extends Error {
 const unfencedMessage = (scopeId) => `the deployment serving scope ${scopeId} predates the switch fence (#2045): it cannot refuse an older ` +
     `switch call's OFF landing after this ON, so no switch is turned on there. Switching off still works. ` +
     `Redeploy the vertical, then retry.`;
+/**
+ * The attachment write's compensation, after its bytes are in the store (#2311). The object
+ * is deleted only when the ScopeDO ANSWERED a refusal: `replyOf` turns every DO-side throw
+ * into a `failure` value, and the DO does not let a post-commit drain fault become one, so an
+ * answered failure means the row did not commit. A rejected call is a transport failure with
+ * the commit unknown. A delete there could leave a committed row without its bytes, so the
+ * bytes are kept and the error rethrown. If nothing committed, the object is an orphan that
+ * no row points at, which the sweep of #2314 is for.
+ */
+async function compensatingRefusal(store, key, call) {
+    const reply = await call();
+    if (reply.failure)
+        await store.delete(key).catch(() => { });
+    return reply;
+}
 /** A tenant-held module's OFF answered without `deniesTenantGrants` (#1823). */
 const undeniedMessage = (scopeId, moduleId) => `the deployment serving scope ${scopeId} predates the kill switch's tenant-grant denial (#1823): ` +
     `module '${moduleId}' holds a tenant-level grant that its OFF would leave authorizing there. ` +
@@ -187,8 +203,73 @@ const undeniedMessage = (scopeId, moduleId) => `the deployment serving scope ${s
  * platform's per-tenant binding, read off this script's own env, named by the one shared
  * encoding (`blobStoreBindingName`) for the tenant the caller passed in.
  */
+function ambientRecord() {
+    return ambientEnv;
+}
+function ambientBinding(name) {
+    return ambientRecord()[name] ?? null;
+}
 function ambientAttachmentBucket(tenantId) {
-    return ambientEnv[blobStoreBindingName(ATTACHMENT_BLOB_BINDING, tenantId)] ?? null;
+    return ambientBinding(blobStoreBindingName(ATTACHMENT_BLOB_BINDING, tenantId));
+}
+/**
+ * One store call over an object's fetch, for the vertical's door and the platform's reserved
+ * calls alike. A body that is not JSON is the store's failure, answered as a bad envelope.
+ */
+function storeObjectSend(object) {
+    return async (request) => {
+        const response = await object.fetch('https://scope-store/', {
+            method: 'POST',
+            headers: { 'content-type': 'application/json' },
+            body: JSON.stringify(request),
+        });
+        try {
+            return await response.json();
+        }
+        catch {
+            throw new StoreError({ code: 'bad_envelope', status: 502 });
+        }
+    };
+}
+function isScopeStoreNamespace(value) {
+    return (typeof value === 'object' &&
+        value !== null &&
+        typeof Reflect.get(value, 'idFromName') === 'function' &&
+        typeof Reflect.get(value, 'get') === 'function');
+}
+const SCOPE_STORE_BINDING_PREFIX = `${PLATFORM_BINDING_PREFIX}STORE_`;
+/**
+ * `platform` unless this host was handed another way to reach a store (#2288): a
+ * non-empty `runners` list (in-process), or `transport: 'binding'`, which is the only
+ * thing that reads an ambient `SUBSTRAT_STORE_*` namespace. A control plane does not
+ * change the answer: whoever wants the direct namespace says so. An explicit
+ * `'platform'` beside runners is refused, since the runners would never be used.
+ */
+function scopeStoreTransportOf(options) {
+    const runners = options.scopeStores?.runners?.length ?? 0;
+    const transport = options.scopeStores?.transport;
+    if (transport === 'platform' && runners > 0) {
+        throw substratError('validation_failed', "scopeStores: transport 'platform' takes no runners; they would never be used");
+    }
+    if (transport)
+        return transport;
+    return runners > 0 ? 'binding' : 'platform';
+}
+/** Bindings this script declares by having a `SUBSTRAT_STORE_*` namespace. */
+function ambientScopeStoreBindings() {
+    const names = [];
+    const env = ambientRecord();
+    for (const key of Object.keys(env)) {
+        if (!key.startsWith(SCOPE_STORE_BINDING_PREFIX))
+            continue;
+        const binding = key.slice(SCOPE_STORE_BINDING_PREFIX.length);
+        if (!/^[A-Z][A-Z0-9_]*$/.test(binding))
+            continue;
+        if (!isScopeStoreNamespace(Reflect.get(env, key)))
+            continue;
+        names.push(binding);
+    }
+    return names;
 }
 /**
  * #2029: scope instances whose door has read the rewind hold and found NO claim on the scope at
@@ -236,6 +317,11 @@ const holdKeyOf = (kind, key) => (kind === 'system' ? key : peerSubjectRef(key))
 export class CloudflareScopeHost {
     admin;
     scopeNs;
+    scopeStoreRunners;
+    scopeStoreVertical;
+    scopeStoreLifecycle;
+    scopeStoreKinds;
+    scopeStoreTransport;
     cp;
     servicePrincipals;
     /** No control plane bound — `this.cp` is the throwing null object (Phase 3, CP-less). */
@@ -350,6 +436,11 @@ export class CloudflareScopeHost {
         this.connectorCalls = options.connectorCalls ?? noopConnectorCallRecorder;
         this.scopeLocalPermissions = options.scopeLocalPermissions ?? false;
         this.scopeNs = options.scope;
+        this.scopeStoreVertical = options.scopeStores?.vertical;
+        this.scopeStoreKinds = options.scopeStores?.kinds ?? {};
+        this.scopeStoreTransport = scopeStoreTransportOf(options);
+        this.scopeStoreRunners = scopeStoreRunnersOf(options.scopeStores);
+        this.scopeStoreLifecycle = scopeStoreLifecycleOf(this.scopeStoreRunners);
         this.cpLess = !options.controlPlane;
         this.cp = options.controlPlane
             ? options.controlPlane.get(options.controlPlane.idFromName('control-plane'))
@@ -1124,7 +1215,9 @@ export class CloudflareScopeHost {
      * control plane, which calls the vertical's `/internal/delete-scope` before deleting
      * the row; this end just destroys its own bytes.
      */
-    async deleteScopeLocal(scopeId) {
+    async deleteScopeLocal(scopeId, tenantId) {
+        if (tenantId)
+            await this.wipeScopeStores(tenantId, scopeId);
         await this.scopeStub(scopeId).destroyStorage();
         // #1819: a deleted scope runs nothing; its claims go with it. Best effort, never a failed reap.
         await this.switchHoldsStub()
@@ -1188,6 +1281,40 @@ export class CloudflareScopeHost {
     async databaseSizeLocal(scopeId) {
         return this.scopeStub(scopeId).databaseSize();
     }
+    /**
+     * Each scope store's size in this deployment (#2207). The control plane already
+     * audited the ask; this end does not write the access log again.
+     */
+    async scopeStoreSizesLocal(tenantId, scopeId) {
+        this.refuseLocalStoresOnPlatform('size');
+        return this.readScopeStoreSizes(tenantId, scopeId);
+    }
+    /**
+     * Erase one subject from each scope store in this deployment (#2068). The control
+     * plane calls this once on the serving script, then destroys the key itself.
+     */
+    async scopeStoreExportLocal(tenantId, scopeId) {
+        this.refuseLocalStoresOnPlatform('export');
+        return this.exportScopeStores(tenantId, scopeId);
+    }
+    async scopeStoreImportLocal(tenantId, scopeId, stores) {
+        this.refuseUnusableScopeStores(stores);
+        await this.importScopeStores(tenantId, scopeId, stores);
+    }
+    async scopeStoreEraseLocal(tenantId, scopeId, subjectId) {
+        this.refuseLocalStoresOnPlatform('erase');
+        return this.eraseScopeStores(tenantId, scopeId, subjectId);
+    }
+    /**
+     * On the platform hop this host holds no store object, so it cannot say what its stores
+     * hold: an empty answer would read as "no stores" (#2242). It refuses instead, and the
+     * control plane, which reaches the store script, is the one to ask.
+     */
+    refuseLocalStoresOnPlatform(what) {
+        if (this.scopeStoreTransport === 'platform') {
+            throw substratError('unavailable', `this host reaches its scope stores through the platform and cannot ${what} them here; ask the control plane`);
+        }
+    }
     /**
      * The oldest not-yet-drained events of this host's own scope (#1334) — the far end of
      * the control plane's `EventDrainDelegation`. Bounded the same way the audited verb is,
@@ -1519,6 +1646,42 @@ export class CloudflareScopeHost {
         const store = await this.resolveAttachmentStore(tenantId);
         return this.buildAttachmentSurface({ principal }, tenantId, scopeId, store);
     }
+    async inspectUploadLink(tenantId, scopeId, secret) {
+        await this.assertLive(tenantId, scopeId);
+        await this.migrateAndRecord(scopeId);
+        return unwrapReply(await this.scopeStub(scopeId).uploadLinkInspectReply(secret, tenantId, scopeId)).view;
+    }
+    async redeemUploadLink(tenantId, scopeId, secret, input) {
+        await this.assertLive(tenantId, scopeId);
+        await this.migrateAndRecord(scopeId);
+        const stub = this.scopeStub(scopeId);
+        const { view, mintedBy } = unwrapReply(await stub.uploadLinkInspectReply(secret, tenantId, scopeId));
+        if (view.entity.entityType !== input.entity.entityType || view.entity.entityId !== input.entity.entityId) {
+            throw substratError('not_found', 'This upload link is not valid for that target.', {
+                reason: UPLOAD_LINK_WRONG_TARGET,
+            });
+        }
+        const store = await this.resolveAttachmentStore(tenantId);
+        const id = ulid();
+        const key = attachmentBlobKey(scopeId, id);
+        const filename = view.filename ?? input.filename;
+        const record = attachmentRecord.parse({
+            id,
+            entity: view.entity,
+            filename,
+            contentType: input.contentType,
+            size: input.body.byteLength,
+            sha256: await attachmentSha256(input.body),
+            visibility: view.visibility,
+            createdBy: mintedBy,
+            createdAt: new Date().toISOString(),
+        });
+        // Bytes first, row second, exactly as an upload: a refusal (size, type, a lost key, a link
+        // someone else spent first) compensates the object away, and the link is unspent with it.
+        // A lost reply keeps the bytes (`compensatingRefusal`); retrying the link is #2315.
+        await store.put(key, input.body, { contentType: input.contentType });
+        return unwrapReply(await compensatingRefusal(store, key, () => stub.attachmentRedeemUploadLinkReply(record, secret, tenantId, scopeId)));
+    }
     async getSystemAttachments(moduleId, tenantId, scopeId) {
         // Reuse the system invoke door's module, tenant and lifecycle gate, and its rewind gate
         // (#1834). The DO authorizes each open against the attachment target's read permission as
@@ -1657,16 +1820,10 @@ export class CloudflareScopeHost {
                     createdBy,
                     createdAt: new Date().toISOString(),
                 });
-                // Bytes first, row second — a crash between the two leaves an orphaned object
-                // (harmless, GC-able), never a row without bytes; a refused gate compensates.
+                // Bytes first, row second — a crash between the two leaves an orphaned object (#2314);
+                // a refused gate compensates, and only an answered refusal does (`compensatingRefusal`).
                 await store.put(key, input.body, { contentType: input.contentType });
-                try {
-                    return unwrapReply(await stub.attachmentAddReply(record, asPrincipalId, tenantId, scopeId, connectionId));
-                }
-                catch (err) {
-                    await store.delete(key).catch(() => { });
-                    throw err;
-                }
+                return unwrapReply(await compensatingRefusal(store, key, () => stub.attachmentAddReply(record, asPrincipalId, tenantId, scopeId, connectionId)));
             },
             list: async (entity) => unwrapReply(await stub.attachmentListReply(entity, asPrincipalId, tenantId, scopeId, connectionId)),
             open: async (attachmentId) => {
@@ -1706,6 +1863,7 @@ export class CloudflareScopeHost {
         return { record, body: obj.body, contentType: obj.contentType ?? record.contentType };
     }
     async importScope(actor, input, dump) {
+        this.refuseUnusableScopeStores(dump.stores, input.vertical ?? null);
         // Create the destination scope (directory row + DO + lazy migrate); the DO then
         // replaces its provisioned schema with the dump wholesale (drop-then-replay), so
         // the end state is the dump, at the source's frontier. Provenance is stamped from
@@ -1720,6 +1878,7 @@ export class CloudflareScopeHost {
             // A fork: its callers (snapshotScope) hand it a dump the platform exported.
             exact: true,
         });
+        await this.importScopeStores(input.tenantId, input.scopeId, dump.stores);
         await this.admin.activateScope(actor, input.tenantId, input.scopeId);
         await this.recordAdmin(actor, 'importScope', { tenantId: input.tenantId, scopeId: input.scopeId }, null, { sourceScopeId: dump.scopeId, tables: dump.tables.length, capturedAt: dump.capturedAt });
     }
@@ -1728,6 +1887,7 @@ export class CloudflareScopeHost {
         const existing = await this.admin.getScopeRecord(actor, tenantId, scopeId);
         if (!existing)
             throw substratError('not_found', `unknown scope ${scopeId} in tenant ${tenantId}`);
+        this.refuseUnusableScopeStores(dump.stores, existing.vertical);
         // #1742: a dump from before a switch was pulled brings the module's grants back live, so
         // the directory's recorded-off modules go back off in the replay's own event. Only where
         // this is the scope's real store, as for the provision's seat above; a hosted scope is
@@ -1739,10 +1899,18 @@ export class CloudflareScopeHost {
             switchOff: carry ? { at: replayAt, ...carry } : undefined,
             sourceScopeId: opts?.sourceScopeId ?? dump.scopeId,
         });
-        await this.recordAdmin(actor, 'restoreScope', { tenantId, scopeId }, null, { sourceScopeId: dump.scopeId, tables: dump.tables.length, capturedAt: dump.capturedAt });
+        await this.importScopeStores(tenantId, scopeId, dump.stores);
+        const replay = await this.replayShreddedStoreErasures(actor, tenantId, scopeId, (opts?.sourceScopeId ?? dump.scopeId));
+        await this.recordAdmin(actor, 'restoreScope', { tenantId, scopeId }, null, {
+            sourceScopeId: dump.scopeId,
+            tables: dump.tables.length,
+            capturedAt: dump.capturedAt,
+            ...replay,
+        });
         if (carry) {
             await this.admin.reassertSystemSwitches(actor, { tenantId, scopeId }, { appliedInUnit: switchedOff });
         }
+        return replay;
     }
     /**
      * #1742, #2029: what this host's own unit carries of the directory's record — the modules and
@@ -1814,6 +1982,7 @@ export class CloudflareScopeHost {
         // Storage BEFORE the directory row: a crash between the two leaves a visible row
         // over empty storage — re-running deleteSnapshot converges — never orphaned bytes
         // with no record (the §9 hazard). Hostname rows go with the directory delete.
+        await this.wipeScopeStores(tenantId, scopeId);
         await this.scopeStub(scopeId).destroyStorage();
         await this.cp.deleteScopeDirectory(scopeId);
         await this.recordAdmin(actor, 'deleteSnapshot', { tenantId, scopeId }, null, {
@@ -1866,6 +2035,306 @@ export class CloudflareScopeHost {
         await this.migrateAndRecord(scopeId);
         return this.buildStub(tenantId, scopeId, principal, undefined, undefined, options);
     }
+    async getScopeStore(_principal, tenantId, scopeId, binding, options) {
+        if (this.scopeStoreTransport === 'platform') {
+            return {
+                tenantId,
+                scopeId,
+                subjectKind: 'principal',
+                invoke: (operation, input, ...extra) => observeStoreCall(binding, operation, () => callScopeStore(async (request) => {
+                    const response = await this.fetchImpl(STORE_CALL_URL, {
+                        method: 'POST',
+                        headers: { 'content-type': 'application/json' },
+                        body: JSON.stringify({ scopeId, binding, operation: request.operation, input: request.input }),
+                    });
+                    try {
+                        return await response.json();
+                    }
+                    catch {
+                        throw new StoreError({ code: 'bad_envelope', status: 502 });
+                    }
+                }, operation, input, ...extra), options?.onStoreCall),
+            };
+        }
+        // A missing binding is answered before any directory read. A CP-less host's
+        // directory throws a plain Error, and a vertical with no store must not meet it.
+        const runner = this.scopeStoreRunners.get(binding);
+        const bound = runner ? undefined : ambientBinding(scopeStoreBindingName(binding));
+        if (!runner && (this.scopeStoreRunners.size > 0 || !isScopeStoreNamespace(bound))) {
+            throw substratError('not_found', `no scope store is bound for '${binding}'`);
+        }
+        const vertical = await this.scopeStoreVerticalOf(tenantId, scopeId);
+        await this.assertLive(tenantId, scopeId);
+        if (runner) {
+            await this.scopeStoreLifecycle.start();
+            return {
+                tenantId,
+                scopeId,
+                subjectKind: 'principal',
+                invoke: (operation, input, ...extra) => observeStoreCall(binding, operation, () => callScopeStore((request) => runner.invoke({ tenantId, vertical, scopeId, binding }, request), operation, input, ...extra), options?.onStoreCall),
+            };
+        }
+        const namespace = bound;
+        const objectName = scopeStoreObjectName(tenantId, vertical, scopeId, binding);
+        const object = namespace.get(namespace.idFromName(objectName));
+        return {
+            tenantId,
+            scopeId,
+            subjectKind: 'principal',
+            invoke: (operation, input, ...extra) => observeStoreCall(binding, operation, () => callScopeStore(storeObjectSend(object), operation, input, ...extra), options?.onStoreCall),
+        };
+    }
+    /**
+     * Which vertical names the store object. With a control plane, the scope row.
+     * Without one, {@link CloudflareScopeHostOptions.scopeStores} — the worker
+     * already knows which vertical it is, and the directory is not there to ask.
+     */
+    async scopeStoreVerticalOf(tenantId, scopeId) {
+        if (this.cpLess) {
+            if (!this.scopeStoreVertical) {
+                throw substratError('unavailable', 'a scope store on a host with no control plane needs scopeStores.vertical');
+            }
+            return this.scopeStoreVertical;
+        }
+        const scope = await this.cp.getScopeRecord(tenantId, scopeId);
+        const vertical = scope?.vertical;
+        if (!vertical) {
+            throw substratError('not_found', `scope ${scopeId} has no vertical, so it has no scope store`);
+        }
+        if (this.scopeStoreVertical !== undefined && vertical !== this.scopeStoreVertical) {
+            throw substratError('forbidden', `this host serves vertical '${this.scopeStoreVertical}', and scope ${scopeId} runs '${vertical}'`);
+        }
+        return vertical;
+    }
+    /**
+     * Configured runners, or the ambient namespaces when this host was told to use a
+     * direct binding. The platform hop holds no object in this isolate, so an ambient
+     * namespace is not one of its stores, and the admin's store paths answer for none: the
+     * control plane reaches the platform's stores itself (see `eraseScopeStores`).
+     */
+    scopeStoreBindingNames() {
+        if (this.scopeStoreTransport === 'platform')
+            return [];
+        if (this.scopeStoreRunners.size > 0)
+            return [...this.scopeStoreRunners.keys()];
+        return ambientScopeStoreBindings();
+    }
+    /**
+     * One reserved call. A configured runner is preferred; otherwise the ambient
+     * namespace. `callReservedStoreOperation` refuses a name that is not reserved.
+     */
+    async invokeReservedStore(address, operation, input) {
+        const runner = this.scopeStoreRunners.get(address.binding);
+        if (runner) {
+            await this.scopeStoreLifecycle.start();
+            return callReservedStoreOperation((request) => runner.invoke(address, request), operation, input);
+        }
+        if (this.scopeStoreRunners.size > 0) {
+            throw substratError('not_found', `no scope store is bound for '${address.binding}'`);
+        }
+        const bound = ambientBinding(scopeStoreBindingName(address.binding));
+        if (!isScopeStoreNamespace(bound)) {
+            throw substratError('not_found', `no scope store is bound for '${address.binding}'`);
+        }
+        const objectName = scopeStoreObjectName(address.tenantId, address.vertical, address.scopeId, address.binding);
+        const object = bound.get(bound.idFromName(objectName));
+        return callReservedStoreOperation(storeObjectSend(object), operation, input);
+    }
+    /**
+     * Each declared binding's `substrat.size`. No bindings means an empty list,
+     * and that answer does not read the directory: a host with no store, including
+     * one with no control plane, has nothing to size. Once a binding exists, the
+     * scope is gated before any object is addressed: by the directory with a control
+     * plane, and without one by the door's own gate (`assertLive`: the scope's
+     * admission of the tenant and its delivered lifecycle), as `getScopeStore` is.
+     */
+    async readScopeStoreSizes(tenantId, scopeId) {
+        const bindings = this.scopeStoreBindingNames();
+        if (bindings.length === 0)
+            return [];
+        if (!this.cpLess)
+            await this.scopeRecordForRead(tenantId, scopeId);
+        const vertical = await this.scopeStoreVerticalOf(tenantId, scopeId);
+        if (this.cpLess)
+            await this.assertLive(tenantId, scopeId);
+        const sizes = [];
+        for (const binding of bindings) {
+            const { bytes } = await this.invokeReservedStore({ tenantId, vertical, scopeId, binding }, 'substrat.size');
+            sizes.push({ binding, bytes });
+        }
+        return sizes;
+    }
+    /**
+     * `substrat.erase` on each declared binding (#2068). A store error throws so the
+     * caller can leave the subject key untouched. An empty answer means this host holds no
+     * store object for the scope, never that it could not tell. On the platform hop that is
+     * true by construction (`scopeStoreBindingNames` is empty): the stores live behind the
+     * store script, and control-plane-api erases, exports, sizes and wipes them itself around
+     * its calls to this host's admin (`shredSubject`, `exportScope`, `scopeStoreSizes`, the
+     * wipe and the replay); an erasure reaches them before the host's shred destroys the key. Only the vertical-host `*Local` reads, which no control plane fronts,
+     * refuse on the hop instead (`refuseLocalStoresOnPlatform`).
+     */
+    async eraseScopeStores(tenantId, scopeId, subjectId) {
+        const bindings = this.scopeStoreBindingNames();
+        if (bindings.length === 0)
+            return [];
+        const vertical = await this.erasureStoreVertical(tenantId, scopeId);
+        if (!vertical)
+            return [];
+        const erasures = [];
+        for (const binding of bindings) {
+            const { erased } = await this.invokeReservedStore({ tenantId, vertical, scopeId, binding }, 'substrat.erase', { subjectId });
+            erasures.push({ binding, erased });
+        }
+        return erasures;
+    }
+    /** A runner's kind, or the kind declared for an ambient binding. Never invented. */
+    scopeStoreKind(binding) {
+        const kind = this.scopeStoreRunners.get(binding)?.kind ?? this.scopeStoreKinds[binding];
+        if (!kind) {
+            throw substratError('unavailable', `scope store '${binding}' has no declared kind`);
+        }
+        return kind;
+    }
+    /**
+     * A dump's stores this host cannot load are refused before any write (#2211, L8): a
+     * binding that is not bound, a kind other than the bound one, or any store at all for
+     * a destination with no vertical (no store object can be named for it, so loading would
+     * drop them), or a destination on a vertical other than the one this host is pinned to.
+     * `vertical` undefined is a caller that cannot read the destination here;
+     * `importScopeStores` then refuses a scope with no vertical itself, still before a store
+     * write. A store with no `kind` is refused: the dump contract requires one, and an
+     * unparsed dump would otherwise skip the kind comparison.
+     */
+    refuseUnusableScopeStores(stores, vertical) {
+        const listed = stores ?? [];
+        if (listed.length === 0)
+            return;
+        if (vertical === null) {
+            throw substratError('conflict', 'dump carries scope stores, and the destination scope has no vertical to hold them');
+        }
+        if (vertical !== undefined && this.scopeStoreVertical !== undefined && vertical !== this.scopeStoreVertical) {
+            throw substratError('forbidden', `this host serves vertical '${this.scopeStoreVertical}', and the destination scope runs '${vertical}'`);
+        }
+        const bound = new Set(this.scopeStoreBindingNames());
+        for (const store of listed) {
+            if (!bound.has(store.binding)) {
+                throw substratError('not_found', `dump names scope store '${store.binding}', which is not bound`);
+            }
+            if (!store.kind) {
+                throw substratError('validation_failed', `dump's scope store '${store.binding}' names no kind`);
+            }
+            const kind = this.scopeStoreRunners.get(store.binding)?.kind ?? this.scopeStoreKinds[store.binding];
+            if (store.kind !== kind) {
+                throw substratError('conflict', `dump's scope store '${store.binding}' is kind '${store.kind}', and this host binds kind '${kind ?? 'undeclared'}'`);
+            }
+        }
+    }
+    async exportScopeStores(tenantId, scopeId) {
+        // No binding is no store, answered before the directory read: a host with no control
+        // plane cannot make that read, and a deployment with no store must not fail an export.
+        const bindings = this.scopeStoreBindingNames();
+        if (bindings.length === 0)
+            return [];
+        const vertical = await this.lifecycleStoreVertical(tenantId, scopeId);
+        if (!vertical)
+            return [];
+        const stores = [];
+        for (const binding of bindings) {
+            const exported = await this.invokeReservedStore({ tenantId, vertical, scopeId, binding }, 'substrat.export');
+            stores.push({
+                binding,
+                kind: this.scopeStoreKind(binding),
+                tables: exported.tables,
+            });
+        }
+        return stores;
+    }
+    async importScopeStores(tenantId, scopeId, stores) {
+        const listed = stores ?? [];
+        if (listed.length === 0)
+            return;
+        const vertical = await this.lifecycleStoreVertical(tenantId, scopeId);
+        if (!vertical) {
+            throw substratError('conflict', `dump carries scope stores, and scope ${scopeId} has no vertical to hold them`);
+        }
+        for (const store of listed) {
+            await this.invokeReservedStore({ tenantId, vertical, scopeId, binding: store.binding }, 'substrat.import', { tables: store.tables });
+        }
+    }
+    /**
+     * `substrat.erase` again for every tombstoned subject (#2207), on the target's and the
+     * source's marks (`replayStoreErasures`). A target this host names no store for (no
+     * binding, or no vertical a store is kept for) has nothing to replay into: nothing is read.
+     */
+    async replayShreddedStoreErasures(actor, tenantId, target, source) {
+        if (this.scopeStoreBindingNames().length === 0)
+            return undefined;
+        if (!(await this.erasureStoreVertical(tenantId, target)))
+            return undefined;
+        return replayStoreErasures({
+            admin: this.admin,
+            actor,
+            tenantId,
+            target,
+            source,
+            erase: async (subjectId) => (await this.eraseScopeStores(tenantId, target, subjectId)).length,
+        });
+    }
+    /** `substrat.wipe` on each declared binding, before the scope's own storage goes. */
+    async wipeScopeStores(tenantId, scopeId) {
+        const bindings = this.scopeStoreBindingNames();
+        if (bindings.length === 0)
+            return;
+        const vertical = await this.lifecycleStoreVertical(tenantId, scopeId);
+        if (!vertical)
+            return;
+        for (const binding of bindings) {
+            await this.invokeReservedStore({ tenantId, vertical, scopeId, binding }, 'substrat.wipe');
+        }
+    }
+    /**
+     * The vertical a store export, import or wipe names. With a control plane, the scope row
+     * (`scopeRecordForRead`: unknown and reaped scopes refused, `null` for a scope with no
+     * vertical, a vertical this host is not pinned to refused). Without one, there is no
+     * directory to read: the host's configured vertical (`scopeStoreVerticalOf`).
+     *
+     * Never gated on the scope being active, on either host. These calls are the platform's own
+     * lifecycle work on scopes that often are not: a reap backs up and wipes an archived scope, a
+     * snapshot or a full pull may copy a suspended one, and a fork's stores land before it is
+     * activated. The scope's tables are exported and imported on the same terms.
+     */
+    async lifecycleStoreVertical(tenantId, scopeId) {
+        if (this.cpLess)
+            return this.scopeStoreVerticalOf(tenantId, scopeId);
+        const scope = await this.scopeRecordForRead(tenantId, scopeId);
+        if (!scope.vertical)
+            return null;
+        if (this.scopeStoreVertical !== undefined && scope.vertical !== this.scopeStoreVertical) {
+            throw substratError('forbidden', `this host serves vertical '${this.scopeStoreVertical}', and scope ${scopeId} runs '${scope.vertical}'`);
+        }
+        return scope.vertical;
+    }
+    /**
+     * The vertical an erasure names a store for. With a control plane, the scope row
+     * decides: no vertical, or not the vertical this host is pinned to, means no
+     * store object of this host's is the scope's — an empty answer, which shred
+     * needs for a scope that never had a vertical. With no control plane and no
+     * `scopeStores.vertical`, the host cannot tell which objects are the scope's, so
+     * it refuses `unavailable` as the size read and the door do, and the subject key
+     * survives until the stores can be erased.
+     */
+    async erasureStoreVertical(tenantId, scopeId) {
+        if (this.cpLess)
+            return this.scopeStoreVerticalOf(tenantId, scopeId);
+        const scope = await this.cp.getScopeRecord(tenantId, scopeId);
+        const vertical = scope?.vertical ?? undefined;
+        if (!vertical)
+            return undefined;
+        if (this.scopeStoreVertical !== undefined && vertical !== this.scopeStoreVertical)
+            return undefined;
+        return vertical;
+    }
     /**
      * A scope stub whose authority is a CONNECTION (#97).
      *
@@ -2795,7 +3264,7 @@ export class CloudflareScopeHost {
         };
     }
     async close() {
-        // Nothing to drain: every admin write awaits its RPC to completion inline.
+        await this.scopeStoreLifecycle.stop();
     }
     // -- admin surface --------------------------------------------------------
     /** #977: this host, with every admin row it writes naming who the actor acted for. */
@@ -3823,12 +4292,12 @@ export class CloudflareScopeHost {
                 });
                 await this.recordAdmin(actor, 'setHostnameIssuance', { tenantId: row.tenant_id, scopeId: row.scope_id }, { status: row.status }, { status: fields.status, note: fields.note ?? null });
             },
-            unbindHostname: async (actor, raw) => {
+            unbindHostname: async (actor, raw, owner) => {
                 const hostname = raw.toLowerCase(); // DNS is case-insensitive; the map is normalized
-                const row = await this.cp.readHostname(hostname);
+                // The row the delete removed, so an owner is judged by the delete itself (#2285).
+                const row = await this.cp.deleteHostname(hostname, owner);
                 if (!row)
                     return; // idempotent, and a no-op is not audited
-                await this.cp.deleteHostname(hostname);
                 await this.recordAdmin(actor, 'unbindHostname', { tenantId: row.tenant_id, scopeId: row.scope_id }, { hostname, status: row.status }, null);
             },
             listHostnames: async (actor, filter) => {
@@ -3939,7 +4408,7 @@ export class CloudflareScopeHost {
                 // The SQL migrations are stored apart from the manifest (#1764), so no read of the
                 // version but the promote review's carries them.
                 const split = splitManifestMigrations(manifestJson ?? null, 'push');
-                await this.cp.insertVersion({
+                await this.directory('insertVersion', {
                     ...audited,
                     manifestJson: split.manifestJson,
                     migrations: split.migrations,
@@ -3954,6 +4423,11 @@ export class CloudflareScopeHost {
                     admission: selfAdmits ? 'admitted' : 'pending',
                 });
             },
+            verticalScopeStores: async (actor, verticalSlug) => {
+                const stores = await this.directory('verticalScopeStores', verticalSlug);
+                await this.recordAccess(actor, 'verticalScopeStores', {}, { verticalSlug }, stores.length);
+                return stores;
+            },
             listVersions: async (actor, verticalSlug, page) => {
                 const rows = await this.cp.listVersions(verticalSlug, page);
                 await this.recordAccess(actor, 'listVersions', {}, { verticalSlug }, rows.length);
@@ -4401,6 +4875,11 @@ export class CloudflareScopeHost {
                 await this.recordAccess(actor, 'scopeDatabaseSize', { tenantId, scopeId }, null, 1);
                 return bytes;
             },
+            scopeStoreSizes: async (actor, tenantId, scopeId) => {
+                const sizes = await this.readScopeStoreSizes(tenantId, scopeId);
+                await this.recordAccess(actor, 'scopeStoreSizes', { tenantId, scopeId }, null, sizes.length);
+                return sizes;
+            },
             rewindScope: async (actor, tenantId, scopeId, bookmark, opts) => {
                 const scope = await this.cp.getScopeRecord(tenantId, scopeId);
                 if (!scope)
@@ -4571,6 +5050,43 @@ export class CloudflareScopeHost {
                     createdAt: r.created_at,
                 }));
             },
+            // -- store-kind releases, rollouts and holds (D-63, #2300) -------------------
+            recordStoreKindRelease: async (actor, input) => {
+                const at = new Date().toISOString();
+                const { record, created } = await this.directory('recordStoreKindRelease', { ...input, actor, at });
+                if (created)
+                    await this.recordAdmin(actor, 'uploadStoreKindRelease', { tenantId: null }, null, record);
+                return record;
+            },
+            getStoreKindRelease: async (actor, kind, sha256) => {
+                const record = await this.cp.getStoreKindRelease(kind, sha256);
+                await this.recordAccess(actor, 'getStoreKindRelease', { tenantId: null }, { kind, sha256 }, record ? 1 : 0);
+                return record;
+            },
+            storeKindState: async (actor, kind) => {
+                const state = await this.cp.storeKindState(kind);
+                await this.recordAccess(actor, 'storeKindState', { tenantId: null }, { kind }, state.rollouts.length);
+                return state;
+            },
+            storeKindDeclarations: async (actor, kind) => {
+                const declared = await this.directory('storeKindDeclarations', kind);
+                await this.recordAccess(actor, 'storeKindDeclarations', { tenantId: null }, { kind }, declared.verticals.length);
+                return declared;
+            },
+            holdStoreKind: async (_actor, input) => this.directory('holdStoreKind', input),
+            releaseStoreKindHold: async (_actor, input) => {
+                await this.cp.releaseStoreKindHold(input);
+            },
+            beginStoreKindRollout: async (actor, input) => {
+                const row = await this.directory('beginStoreKindRollout', { ...input, actor, at: new Date().toISOString() });
+                await this.recordAdmin(actor, input.action === 'rollback' ? 'rollBackStoreKind' : 'rollOutStoreKind', { tenantId: null }, null, row);
+                return row;
+            },
+            finishStoreKindRollout: async (actor, input) => {
+                const row = await this.directory('finishStoreKindRollout', { ...input, at: new Date().toISOString() });
+                await this.recordAdmin(actor, row.action === 'rollback' ? 'rollBackStoreKind' : 'rollOutStoreKind', { tenantId: null }, null, row);
+                return row;
+            },
             listScopeTables: async (actor, tenantId, scopeId) => {
                 // K-3 cross-check on the shared directory BEFORE reaching the scope DO: a pair
                 // that does not resolve is unreachable, never another tenant's database.
@@ -4836,7 +5352,8 @@ export class CloudflareScopeHost {
                 await this.scopeRecordForRead(tenantId, scopeId);
                 const tables = await this.scopeStub(scopeId).exportDump();
                 await this.recordAccess(actor, 'exportScope', { tenantId, scopeId }, null, tables.length);
-                return { tenantId, scopeId, capturedAt: new Date().toISOString(), tables };
+                const stores = await this.exportScopeStores(tenantId, scopeId);
+                return { tenantId, scopeId, capturedAt: new Date().toISOString(), tables, stores };
             },
             exportDirectory: async (actor) => {
                 // No K-3 cross-check to make: there is one directory, and it is the thing that
@@ -4930,6 +5447,7 @@ export class CloudflareScopeHost {
                     throw substratError('conflict', `scope ${scopeId} still resolves hostname '${bound[0].hostname}' — ` +
                         `unbind it before reaping (reap wipes storage and cannot be undone)`);
                 }
+                await this.wipeScopeStores(tenantId, scopeId);
                 await this.scopeStub(scopeId).destroyStorage();
                 // The recoverable copy the caller stored first (#493), named in the audit entry so
                 // the trail answers "was there a backup" without correlating two timestamps.
@@ -4950,11 +5468,20 @@ export class CloudflareScopeHost {
                 await this.recordAccess(actor, 'openSubjectPayloads', { tenantId, scopeId }, { subjects: new Set(items.map((i) => i.subjectId)).size }, opened.filter((o) => o !== null).length);
                 return opened;
             },
-            shredSubject: async (actor, tenantId, scopeId, subjectId) => {
+            listShreddedSubjects: async (actor, tenantId, scopeId, cursor) => {
                 await this.assertScope(tenantId, scopeId);
-                // #1722: a direct shred claims nothing; it records the epoch it ran under, as an orchestrated
-                // one records the epoch its claim compared, so the backfill can order every erasure.
-                const stamp = { erasureEpoch: await this.cp.scopeErasureEpoch(tenantId, scopeId), path: 'direct' };
+                const rows = await this.cp.listShreddedSubjects(scopeId, tenantId, cursor ?? null);
+                const subjects = rows.slice(0, 100);
+                const nextCursor = rows.length > 100 ? (subjects[99] ?? null) : null;
+                await this.recordAccess(actor, 'listShreddedSubjects', { tenantId, scopeId }, null, subjects.length);
+                return { subjects, nextCursor };
+            },
+            shredSubject: async (actor, tenantId, scopeId, subjectId, fence) => {
+                await this.assertScope(tenantId, scopeId);
+                // #1722: a direct shred records the epoch it ran under, as an orchestrated one records the
+                // epoch its claim compared, so the backfill can order every erasure. With a fence (#2285) it
+                // claims what it read just before the key goes, and records the epoch that claim compared.
+                const stamp = { erasureEpoch: fence?.epoch ?? await this.cp.scopeErasureEpoch(tenantId, scopeId), path: 'direct' };
                 // Redact the live spine FIRST, destroy the key LAST. Both halves are idempotent and
                 // a crash between them converges on retry, so the order is decided by which
                 // half-done state harms the person: dying after the redaction leaves ciphertext in
@@ -5014,6 +5541,10 @@ export class CloudflareScopeHost {
                 // The directory's failure text (#1632) — a drain failure quoting one of those intents,
                 // an issue's exemplar, a sweep record's error. Still before the key.
                 await this.cp.redactSubjectText({ tenantId, scopeId, subjectId, intentIds });
+                // Scope stores after the scope-side redaction and before the key (#2068).
+                const storeErasures = await this.eraseScopeStores(tenantId, scopeId, subjectId);
+                if (fence)
+                    await this.claimSubjectErasure(tenantId, scopeId, fence);
                 const at = new Date().toISOString();
                 const { existed } = await this.subjectKeysFor(tenantId, scopeId).destroy(subjectId, at);
                 const receipt = subjectShredReceipt.parse({
@@ -5022,6 +5553,7 @@ export class CloudflareScopeHost {
                     intentsRedacted,
                     jobRunsRedacted,
                     ...vertical,
+                    storeErasures,
                     keyDestroyed: existed,
                     tombstoned: true,
                 });
@@ -5035,13 +5567,11 @@ export class CloudflareScopeHost {
                 return receipt;
             },
             scopeErasureEpoch: async (_actor, tenantId, scopeId) => this.cp.scopeErasureEpoch(tenantId, scopeId),
-            finalizeSubjectShred: async (actor, tenantId, scopeId, subjectId, redactions, expected) => {
+            finalizeSubjectShred: async (actor, tenantId, scopeId, subjectId, redactions, expected, storeErasures = []) => {
                 await this.assertScope(tenantId, scopeId);
                 if (redactions.length === 0)
                     throw substratError('conflict', 'subject erasure has no confirmed scope redaction');
-                if (!await this.cp.claimSubjectErasure(tenantId, scopeId, expected.versionId, expected.servingRef, expected.epoch, expected.copyCount)) {
-                    throw substratError('precondition_failed', 'scope route or copy inventory changed during subject erasure; retry after it settles');
-                }
+                await this.claimSubjectErasure(tenantId, scopeId, expected);
                 const intentIds = [...new Set(redactions.flatMap((r) => r.intentIds))];
                 await this.cp.redactSubjectText({ tenantId, scopeId, subjectId, intentIds });
                 const { existed } = await this.subjectKeysFor(tenantId, scopeId).destroy(subjectId, new Date().toISOString());
@@ -5053,6 +5583,7 @@ export class CloudflareScopeHost {
                     verticalRows: redactions.flatMap((r) => r.vertical.verticalRows),
                     hookRows: redactions.flatMap((r) => r.vertical.hookRows),
                     unreachedEntities: redactions.flatMap((r) => r.vertical.unreachedEntities),
+                    storeErasures,
                     keyDestroyed: existed,
                     tombstoned: true,
                 });
@@ -5166,6 +5697,7 @@ export class CloudflareScopeHost {
                     })),
                     storage: rows.storage,
                     storageAttempts: rows.storageAttempts,
+                    storeStorage: rows.storeStorage,
                 });
                 // Tenants covered, not totals: "read one tenant's meter" and "metered the whole
                 // fleet" are different acts, and K-24 exists to tell them apart.
@@ -5475,6 +6007,10 @@ export class CloudflareScopeHost {
                 const { tenantId, scopeId, ...after } = memberChangeAudit.parse(entry);
                 await this.recordAdmin(actor, 'manageScopeMember', { tenantId, scopeId }, null, after);
             },
+            recordConnectionBindingChange: async (actor, entry) => {
+                const { tenantId, scopeId, ...after } = connectionBindingAudit.parse(entry);
+                await this.recordAdmin(actor, 'bindConnectionScope', { tenantId, scopeId }, null, after);
+            },
             recordPeerBindingChange: async (actor, entry) => {
                 const { tenantId, scopeId, ...after } = peerBindingAudit.parse(entry);
                 await this.recordAdmin(actor, 'setPeerBinding', { tenantId, scopeId }, null, after);
@@ -5979,6 +6515,12 @@ export class CloudflareScopeHost {
      * subject-key operation touches anything. Without it a caller could reach another
      * tenant's keys by naming their scope id.
      */
+    /** The erasure claim (`SUBJECT_ERASURE_CLAIM_SQL`); a scope that moved refuses with the key kept. */
+    async claimSubjectErasure(tenantId, scopeId, fence) {
+        if (!await this.cp.claimSubjectErasure(tenantId, scopeId, fence)) {
+            throw substratError('precondition_failed', 'scope route or copy inventory changed during subject erasure; retry after it settles');
+        }
+    }
     async assertScope(tenantId, scopeId) {
         const rec = await this.cp.getScopeRecord(tenantId, scopeId);
         if (!rec)
@@ -6063,6 +6605,11 @@ export class CloudflareScopeHost {
      */
     async connectionGrantsInScope(tenantId, scopeId) {
         await this.validateScopeAccess(tenantId, scopeId);
+        if (this.connectorDelegation) {
+            if (!this.connectorDelegation.grants)
+                throw new Error('connector grant inspection is not configured for the serving deployment');
+            return this.connectorDelegation.grants({ tenantId, scopeId });
+        }
         await this.migrateAndRecord(scopeId);
         const now = new Date().toISOString();
         // Both stores again, but the CF split is not the pure adapter's. The DO holds the
@@ -6762,39 +7309,7 @@ export class CloudflareScopeHost {
                 expires_at: null,
                 lockout_reseat: true,
             },
-            // #461: each registered module's SCHEDULE grants (#383) ride the same unit —
-            // the CP-less mirror of `provisionScope`'s seatTuple loop. Without them the
-            // grant-is-the-switch check makes every schedule a silent no-op (`fired: 0`,
-            // no error — the #49 unfalsifiable zero).
-            ...[...this.moduleSchedules].flatMap(([modId, schedules]) => {
-                const perms = new Set();
-                for (const s of schedules)
-                    for (const p of s.permissions)
-                        perms.add(p);
-                return [...perms].map((perm) => ({
-                    subject: `system:${modId}`,
-                    relation: `granted:${perm}`,
-                    object: `scope:${input.scopeId}`,
-                    expires_at: null,
-                }));
-            }),
-            // #1706: each declared PEER's grants ride the same unit — the CP-less mirror of
-            // `provisionScope`'s peer seat, through the one function that decides it.
-            ...peerSeats(collectPeers(this.peerSources), input.scopeId).map((seat) => ({
-                subject: seat.subject,
-                relation: seat.relation,
-                object: seat.object,
-                expires_at: null,
-            })),
-            // #592: the tenant's connection grants ride the same unit — the provision-time
-            // mirror of `connectorGrantLocal`, so the connector return path works on every
-            // install, not only the one that existed when `grantToConnection` ran.
-            ...(input.connectionGrants ?? []).map((g) => ({
-                subject: `connection:${g.connectionId}`,
-                relation: `granted:${g.permission}`,
-                object: `scope:${input.scopeId}`,
-                expires_at: g.expiresAt ?? null,
-            })),
+            ...this.declaredSeatsLocal(input.scopeId, input.connectionGrants),
         ], 
         // #406: identity links, delivered by the platform with provisioning exactly as
         // entitlements are (#310). Preserve-on-undefined, so an absent field never wipes
@@ -6831,6 +7346,53 @@ export class CloudflareScopeHost {
             ...(shapes?.boundEver ? { boundShapeTypes: shapes.boundEver } : {}),
         };
     }
+    /**
+     * The tuples this deployment's code declares for one scope, seated by every provision and
+     * reconcile: each module's SCHEDULE grants (#383, #461 — without them the grant-is-the-switch
+     * check makes every schedule a silent no-op), each declared PEER's keys (#1706, through the one
+     * function that decides them), and the tenant's connection grants the platform delivered (#592,
+     * the provision-time mirror of `connectorGrantLocal`).
+     */
+    declaredSeatsLocal(scopeId, connectionGrants) {
+        return [
+            ...[...this.moduleSchedules].flatMap(([modId, schedules]) => {
+                const perms = new Set();
+                for (const s of schedules)
+                    for (const p of s.permissions)
+                        perms.add(p);
+                return [...perms].map((perm) => ({ subject: `system:${modId}`, relation: `granted:${perm}`, object: `scope:${scopeId}`, expires_at: null }));
+            }),
+            ...peerSeats(collectPeers(this.peerSources), scopeId).map((seat) => ({ ...seat, expires_at: null })),
+            ...(connectionGrants ?? []).map((g) => ({
+                subject: `connection:${g.connectionId}`,
+                relation: `granted:${g.permission}`,
+                object: `scope:${scopeId}`,
+                expires_at: g.expiresAt ?? null,
+            })),
+        ];
+    }
+    /**
+     * The ownerless reconcile (#2263): what a reconcile does for a vertical that keeps no owner of
+     * record, so a scope provisioned before a version's declarations still receives them. It SEATS
+     * `declaredSeatsLocal` and re-applies the directory's recorded-off positions in the same unit
+     * (#1742), and does nothing else: no owner seat, no projection (roles, entitlements, identity
+     * links, sealing keys and tenant tuples are left exactly as they are), and no entity-grant
+     * shape top-up or retirement. Every seat is `seatScopeTuple`'s, so a revoked grant stays revoked
+     * and a switched-off subject gets nothing. It can therefore only add what the running code
+     * declares, and never takes anything away but a recorded OFF.
+     *
+     * Only a scope already provisioned for `tenantId` is seated (`servesTenant`, K-3): this never
+     * provisions a scope, and never writes into another tenant's.
+     */
+    async seatScopeLocal(input) {
+        const stub = this.scopeStub(input.scopeId);
+        if (!(await stub.servesTenant(input.tenantId)))
+            throw unknownScopeForTenant(input.tenantId, input.scopeId);
+        const carry = recordedOffFromWire(input);
+        await this.migrateAndRecord(input.scopeId);
+        const switchedOff = await stub.seatTuples(this.declaredSeatsLocal(input.scopeId, input.connectionGrants), carry ? { scopeId: input.scopeId, at: new Date().toISOString(), ...carry } : undefined);
+        return carry ? { switchedOff } : {};
+    }
     /**
      * Resolve an external identity from a scope's PROJECTED links (#406) — the CP-less
      * auth adapter's read path, the local equivalent of `HostAdmin.resolveIdentity` (same