@substrat-run/adapter-cloudflare 0.147.0 → 0.149.0

package/dist/control-plane-do.js

@@ -1,9 +1,9 @@
 import { DurableObject } from 'cloudflare:workers';
-import { membershipFencesBackfillSql, MEMBERSHIP_FENCES_DDL, MEMBERSHIP_FENCES_TABLE, membershipFencesTableExists, MEMBERSHIP_FENCE_SINCE_SQL, RAISE_MEMBERSHIP_FENCE_SQL, memberAddedAudit, orgChangeBound, tenantCoverage, IMPERSONATION_COLUMNS, IMPERSONATION_DDL, impersonationByIdQuery, impersonationListQuery, impersonationRowValues, ISSUE_RETENTION_DAYS, telemetryRetentionStatements, FINDINGS_DDL, SCOPE_STORAGE_DDL, forgetScopeStorage, listScopeStorageAttemptRows, listScopeStorageRows, listScopeStoreStorageRows, pruneScopeStorageRows, recordScopeStorageRows, CONNECT_LINKS_DDL, consumeConnectLinkRow, insertConnectLink as insertConnectLinkRow, listConnectLinks as listConnectLinkRows, readConnectLink as readConnectLinkRow, restoreConnectLinkRow, revokeConnectLinkRow, createFindingRule, findingOfOpsFailure, findingOfSweepRun, pruneFindings, listFindingRules, listFindings, observeFinding, revokeFindingRule, setFindingStatus, assertRowLimit, OPS_FAILURE_RETENTION_DAYS, SWEEP_RUN_RETENTION_DAYS, SWEEP_RUNS_INTENT_INDEX, sweepRunsIntentHasKind, PEER_SWITCHES_DDL, PEER_BINDINGS_DDL, SWITCH_OWED_DDL, clearSwitchOwed, markSwitchOwed, scopeOwesSwitch, switchesOwedOf, SWITCH_KINDS, SYSTEM_SWITCHES_DDL, forgetSwitchesOf, listSystemSwitchRecords, recordSwitchedOff, recordSwitchedOn, recordWriteSuperseded, restoreSwitchRecord, scopesSwitchedOffFor, switchRecordStatesOf, switchRecordsOf, switchesBackfillSqlOf, switchesDdlOf, switchesTableExists, switchesTableOf, tenantHeldOf, VERSION_MIGRATIONS_DDL, splitVersionMigrationsBatch, versionMigrationsOf, versionsAwaitSplit, writeVersionMigrations, MODEL_USAGE_RETENTION_DAYS, DO_SQL_LIMITS, ulid, isPrimaryScopeRow, samePeerVertical, peerVerticalSpellings, resolveVerticalInstanceFrom, resolvePeerInstanceFrom, LEGACY_SCOPE_ROWS_BACKFILL, loadDirectoryDump, redactSubjectDirectoryText, ISSUE_EXEMPLAR_OWNER_BACKFILL_SQL, issueExemplarOwner, SETTLE_INTENT_SQL, SETTLE_OUTCOME_SQL, settleOutcomeParamsOf, unknownOutcomeOf, ADMIN_LOG_INDEX_DDL, ADMIN_LOG_INDEXES_SQL, readAuditedOperations, } from '@substrat-run/kernel';
+import { membershipFencesBackfillSql, MEMBERSHIP_FENCES_DDL, MEMBERSHIP_FENCES_TABLE, membershipFencesTableExists, MEMBERSHIP_FENCE_SINCE_SQL, RAISE_MEMBERSHIP_FENCE_SQL, memberAddedAudit, orgChangeBound, tenantCoverage, IMPERSONATION_COLUMNS, IMPERSONATION_DDL, impersonationByIdQuery, impersonationListQuery, impersonationRowValues, ISSUE_RETENTION_DAYS, telemetryRetentionStatements, FINDINGS_DDL, SCOPE_STORAGE_DDL, forgetScopeStorage, listScopeStorageAttemptRows, listScopeStorageRows, listScopeStoreStorageRows, pruneScopeStorageRows, recordScopeStorageRows, CONNECT_LINKS_DDL, consumeConnectLinkRow, insertConnectLink as insertConnectLinkRow, listConnectLinks as listConnectLinkRows, readConnectLink as readConnectLinkRow, restoreConnectLinkRow, revokeConnectLinkRow, createFindingRule, findingOfOpsFailure, findingOfSweepRun, pruneFindings, listFindingRules, listFindings, observeFinding, revokeFindingRule, setFindingStatus, assertRowLimit, OPS_FAILURE_RETENTION_DAYS, SWEEP_RUN_RETENTION_DAYS, SWEEP_RUNS_INTENT_INDEX, sweepRunsIntentHasKind, PEER_SWITCHES_DDL, PEER_BINDINGS_DDL, SWITCH_OWED_DDL, clearSwitchOwed, markSwitchOwed, scopeOwesSwitch, switchesOwedOf, SWITCH_KINDS, SYSTEM_SWITCHES_DDL, forgetSwitchesOf, listSystemSwitchRecords, recordSwitchedOff, recordSwitchedOn, recordWriteSuperseded, restoreSwitchRecord, scopesSwitchedOffFor, switchRecordStatesOf, switchRecordsOf, switchesBackfillSqlOf, switchesDdlOf, switchesTableExists, switchesTableOf, tenantHeldOf, VERSION_MIGRATIONS_DDL, VERTICAL_SCOPE_STORES_DDL, STORE_DRIVER_RELEASES_DDL, legacyStoreDriverConflict, legacyStoreDriverRenames, beginStoreDriverRolloutIn, finishStoreDriverRolloutIn, holdStoreDriverIn, advanceStoreDriverRebuildIn, claimStoreDriverRebuildIn, storeDriverRebuildIn, driverDeclarationsOf, recordStoreDriverReleaseIn, releaseStoreDriverHoldIn, storeDriverReleaseIn, storeDriverStateIn, storeDriverRolloutPendingIn, storeDriverRolloutWalkedIn, forgetVerticalScopeStores, indexVersionScopeStores, verticalScopeStoresOf, splitVersionMigrationsBatch, versionMigrationsOf, versionsAwaitSplit, versionsAwaitDigest, deriveMigrationDigestsBatch, deriveVersionMigrationDigest, writeVersionMigrations, MODEL_USAGE_RETENTION_DAYS, DO_SQL_LIMITS, ulid, isPrimaryScopeRow, samePeerVertical, peerVerticalSpellings, resolveVerticalInstanceFrom, resolvePeerInstanceFrom, LEGACY_SCOPE_ROWS_BACKFILL, loadDirectoryDump, redactSubjectDirectoryText, ISSUE_EXEMPLAR_OWNER_BACKFILL_SQL, issueExemplarOwner, SETTLE_INTENT_SQL, SETTLE_OUTCOME_SQL, settleOutcomeParamsOf, unknownOutcomeOf, ADMIN_LOG_INDEX_DDL, ADMIN_LOG_INDEXES_SQL, readAuditedOperations, } from '@substrat-run/kernel';
 import { replyOf } from './do-reply.js';
 import { switchSqlOver } from './scope-do.js';
 import { blankSqlComments, boundShapesColumn, executableSqlStatements, installsReconciledOf, PROVISIONED_VERSIONS_SQL, provisionedVersionsParams, } from '@substrat-run/kernel';
-import { COPY_BACKFILL_SCOPE_SQL, COPY_BACKFILL_SQL, COPY_BACKFILL_SUPERSEDE_SQL, COPY_CLAIM_SQL, COPY_EXPIRED_SQL, copyBackfillParams, copyBackfillRefusal, COPY_MOVE_CONFIRM_SQL, COPY_MOVE_LIVE_PREDICATE, SCOPE_COPY_LEASE_MS, SCOPE_SCRIPT_COPY_COLUMNS, copyMoveConfirmParams, copyMoveLiveParams, } from '@substrat-run/kernel';
+import { COPY_BACKFILL_SCOPE_SQL, COPY_BACKFILL_SQL, COPY_BACKFILL_SUPERSEDE_SQL, COPY_CLAIM_SQL, COPY_EXPIRED_SQL, copyBackfillParams, copyBackfillRefusal, SUBJECT_ERASURE_CLAIM_SQL, subjectErasureClaimParams, COPY_MOVE_CONFIRM_SQL, COPY_MOVE_LIVE_PREDICATE, SCOPE_COPY_LEASE_MS, SERVES_NOW_CONDITION, SERVES_NOW_PREDICATE, servesNowParams, SCOPE_SCRIPT_COPY_COLUMNS, copyMoveConfirmParams, copyMoveLiveParams, } from '@substrat-run/kernel';
 import { doBuiltColumnsOf, doRedactionSql } from './sql.js';
 import { assertReplayableDump, opsFailureFingerprint, ROUTE_SCOPE_HOSTNAMES_MAX, SCOPE_GATE_REASONS, substratError } from '@substrat-run/contracts';
 /**
@@ -247,6 +247,8 @@ const DIRECTORY_DDL = `
     created_at TEXT NOT NULL,
     PRIMARY KEY (tenant_id, vertical, binding)
   );
+  -- A store driver's stored releases, rollouts and holds (D-63, #2300).
+  ${STORE_DRIVER_RELEASES_DDL}
   CREATE TABLE IF NOT EXISTS verticals (
     slug         TEXT PRIMARY KEY,
     name         TEXT NOT NULL,
@@ -305,10 +307,14 @@ const DIRECTORY_DDL = `
     migration_count   INTEGER,
     -- 1 once the SQL is out of manifest_json. NULL = stored before #1764, not yet backfilled.
     migrations_split  INTEGER,
+    -- 1 once migration_digest is the one derived from the stored migrations (#2339).
+    -- NULL = stored before, still the pushed digest; backfilled, and derived on read until then.
+    migration_digest_derived INTEGER,
     created_at        TEXT NOT NULL,
     UNIQUE (vertical_slug, version)
   );
   ${VERSION_MIGRATIONS_DDL}
+  ${VERTICAL_SCOPE_STORES_DDL}
   CREATE TABLE IF NOT EXISTS vertical_channels (
     vertical_slug TEXT NOT NULL,
     channel       TEXT NOT NULL,
@@ -776,6 +782,22 @@ export const REPLIED_METHODS = [
     'linkIdentity',
     // #1748: refuses an expiry outside its bounds with validation_failed.
     'createFindingRule',
+    // #2286: refuses a scope-store binding moved to another driver with conflict, and an unreadable manifest with unavailable.
+    'insertVersion',
+    'verticalScopeStores',
+    // #2300: a store driver's release, rollout and hold writes refuse with conflict, not_found,
+    // validation_failed or unavailable.
+    'recordStoreDriverRelease',
+    'storeDriverDeclarations',
+    // #2312: a rollout page refuses a limit that is not positive, and an unknown rollout.
+    'storeDriverRolloutPending',
+    'storeDriverRolloutWalked',
+    'holdStoreDriver',
+    'beginStoreDriverRollout',
+    'finishStoreDriverRollout',
+    // #2309: a fleet rebuild's lease write refuses with conflict or validation_failed.
+    'claimStoreDriverRebuild',
+    'advanceStoreDriverRebuild',
 ];
 export class ControlPlaneDO extends DurableObject {
     sql;
@@ -800,7 +822,7 @@ export class ControlPlaneDO extends DurableObject {
      * instead (`importDump`).
      */
     async armVersionMigrationsBackfill() {
-        if (!versionsAwaitSplit(this.kernelSql))
+        if (!versionsAwaitSplit(this.kernelSql) && !versionsAwaitDigest(this.kernelSql))
             return;
         // An alarm already set is kept: it is the backfill's own next run, and a backoff retry
         // pulled forward to 1 s by any ordinary request would make the backoff meaningless.
@@ -821,6 +843,9 @@ export class ControlPlaneDO extends DurableObject {
         let more;
         try {
             more = this.ctx.storage.transactionSync(() => splitVersionMigrationsBatch(this.kernelSql)).more;
+            // #2339: then re-derive the migration digests of versions stored before the server did.
+            // Not in the transaction: the digest is computed between its read and its guarded write.
+            more = (await deriveMigrationDigestsBatch(this.kernelSql)).more || more;
         }
         catch (err) {
             const failures = ((await this.ctx.storage.get(BACKFILL_FAILURES_KEY)) ?? 0) + 1;
@@ -895,6 +920,18 @@ export class ControlPlaneDO extends DurableObject {
      * creates each table with its backfill; `holdFences` does the same for #1184's removal fence.
      */
     buildDirectorySchema({ holdSwitchRecords, holdFences = false }) {
+        // A directory built before the store driver rename keeps its rows under the old names (and one
+        // that ran pre-rename code again, a rollback, holds both names), and
+        // the DDL below would only create empty tables beside them. Probed, not attempted: an empty
+        // `SELECT` reads the columns here, and an emptied directory (a restore) has nothing to move.
+        const tables = this.sql.exec(`SELECT name FROM sqlite_master WHERE type = 'table'`).toArray().map((t) => t.name);
+        const hasRows = (table) => this.sql.exec(`SELECT 1 FROM "${table}" LIMIT 1`).toArray().length > 0;
+        // Asked before the moves below, which drop a name with no rows.
+        const bothNames = legacyStoreDriverConflict(tables, hasRows);
+        if (bothNames)
+            console.error(bothNames);
+        for (const stmt of legacyStoreDriverRenames(tables, (table) => doBuiltColumnsOf(this.sql, table), hasRows))
+            this.sql.exec(stmt);
         const held = holdSwitchRecords.map(switchesTableOf);
         for (const stmt of DIRECTORY_DDL_PLAN.loop) {
             if (held.some((table) => stmt.includes(table)))
@@ -907,6 +944,8 @@ export class ControlPlaneDO extends DurableObject {
         // #1764's, held back by `planDirectoryDdl`: its index names a column added just above.
         for (const stmt of DIRECTORY_DDL_PLAN.afterColumns)
             this.sql.exec(stmt);
+        // #2322: a migration's declared moves and discards, on a table created before they were carried.
+        this.addColumn('vertical_version_migrations', 'declarations TEXT');
     }
     /**
      * The directory's own migration path (control-plane.md §7). A singleton DO that
@@ -1124,6 +1163,8 @@ export class ControlPlaneDO extends DurableObject {
         // #1764: the SQL migrations moved out of the manifest, and the backfill's progress.
         this.addColumn('vertical_versions', 'migration_count INTEGER');
         this.addColumn('vertical_versions', 'migrations_split INTEGER');
+        // #2339: whether the migration digest is the derived one; NULL rows are backfilled.
+        this.addColumn('vertical_versions', 'migration_digest_derived INTEGER');
         // #33: the SKU flag learns to express a plan. All nullable — a legacy row
         // reads as a perpetual boolean flag, exactly its pre-widening semantics.
         this.addColumn('_substrat_entitlements', 'expires_at TEXT');
@@ -1246,8 +1287,9 @@ export class ControlPlaneDO extends DurableObject {
         // next construction arms the backfill, since it finds none set.
         try {
             await this.ctx.storage.delete(BACKFILL_FAILURES_KEY);
-            if (versionsAwaitSplit(this.kernelSql))
+            if (versionsAwaitSplit(this.kernelSql) || versionsAwaitDigest(this.kernelSql)) {
                 await this.ctx.storage.setAlarm(Date.now() + BACKFILL_PAUSE_MS);
+            }
         }
         catch (err) {
             console.error('substrat: the restore committed, but its version-migrations backfill was not armed', err);
@@ -1470,6 +1512,48 @@ export class ControlPlaneDO extends DurableObject {
             ' ORDER BY tenant_id, vertical, binding', ...params)
             .toArray();
     }
+    // -- store-driver releases, rollouts and holds (D-63, #2300) ---------------------
+    // Kernel code over the directory (store-driver-releases.ts), shared with the SQLite host. Each
+    // call is one transaction, and the object runs one at a time, so a hold is taken atomically.
+    recordStoreDriverRelease(input) {
+        return this.ctx.storage.transactionSync(() => recordStoreDriverReleaseIn(this.kernelSql, input));
+    }
+    getStoreDriverRelease(driver, sha256) {
+        return storeDriverReleaseIn(this.kernelSql, driver, sha256);
+    }
+    storeDriverState(driver) {
+        return this.ctx.storage.transactionSync(() => storeDriverStateIn(this.kernelSql, driver, Date.now()));
+    }
+    storeDriverDeclarations(driver) {
+        return this.ctx.storage.transactionSync(() => driverDeclarationsOf(this.kernelSql, driver));
+    }
+    storeDriverRolloutPending(input) {
+        return this.ctx.storage.transactionSync(() => storeDriverRolloutPendingIn(this.kernelSql, input));
+    }
+    storeDriverRolloutWalked(input) {
+        return this.ctx.storage.transactionSync(() => storeDriverRolloutWalkedIn(this.kernelSql, input));
+    }
+    holdStoreDriver(input) {
+        return this.ctx.storage.transactionSync(() => holdStoreDriverIn(this.kernelSql, { ...input, nowMs: Date.now() }));
+    }
+    releaseStoreDriverHold(input) {
+        releaseStoreDriverHoldIn(this.kernelSql, input);
+    }
+    beginStoreDriverRollout(input) {
+        return this.ctx.storage.transactionSync(() => beginStoreDriverRolloutIn(this.kernelSql, { ...input, nowMs: Date.now() }));
+    }
+    finishStoreDriverRollout(input) {
+        return this.ctx.storage.transactionSync(() => finishStoreDriverRolloutIn(this.kernelSql, { ...input, nowMs: Date.now() }));
+    }
+    storeDriverRebuild(driver) {
+        return storeDriverRebuildIn(this.kernelSql, driver);
+    }
+    claimStoreDriverRebuild(input) {
+        return this.ctx.storage.transactionSync(() => claimStoreDriverRebuildIn(this.kernelSql, { ...input, nowMs: Date.now() }));
+    }
+    advanceStoreDriverRebuild(input) {
+        return this.ctx.storage.transactionSync(() => advanceStoreDriverRebuildIn(this.kernelSql, { ...input, nowMs: Date.now() }));
+    }
     // -- scope lifecycle (control-plane.md §4.1/§4.2) ---------------------------
     /**
      * Mandatory active tenant: a scope with no tenant record is the "tenant is an
@@ -2020,8 +2104,14 @@ export class ControlPlaneDO extends DurableObject {
             this.sql.exec(`UPDATE hostnames SET status = ?, status_note = ?, validation_records = ? WHERE hostname = ?`, fields.status, fields.note, fields.validationRecords, hostname);
         }
     }
-    deleteHostname(hostname) {
-        this.sql.exec('DELETE FROM hostnames WHERE hostname = ?', hostname);
+    /**
+     * Delete a binding and answer the row it removed, or null. With `owner`, only while the row
+     * still names that tenant and scope (#2285): the delete decides it, not an earlier read.
+     */
+    deleteHostname(hostname, owner) {
+        const rows = this.sql.exec(`DELETE FROM hostnames WHERE hostname = ?${owner ? ' AND tenant_id = ? AND scope_id = ?' : ''}
+       RETURNING tenant_id, scope_id, status`, hostname, ...(owner ? [owner.tenantId, owner.scopeId] : [])).toArray();
+        return rows[0] ?? null;
     }
     listHostnames(filter) {
         const where = [];
@@ -2112,6 +2202,7 @@ export class ControlPlaneDO extends DurableObject {
         this.sql.exec('DELETE FROM vertical_channel_history WHERE vertical_slug = ?', slug);
         this.sql.exec(`DELETE FROM vertical_version_migrations
         WHERE version_id IN (SELECT id FROM vertical_versions WHERE vertical_slug = ?)`, slug);
+        forgetVerticalScopeStores(this.kernelSql, slug);
         this.sql.exec('DELETE FROM vertical_versions WHERE vertical_slug = ?', slug);
         this.sql.exec('DELETE FROM verticals WHERE slug = ?', slug);
     }
@@ -2122,10 +2213,17 @@ export class ControlPlaneDO extends DurableObject {
         const sql = 'SELECT * FROM verticals' + (where.length ? ` WHERE ${where.join(' AND ')}` : '') + tail;
         return this.sql.exec(sql, ...params).toArray();
     }
-    readVersion(id) {
-        return this.sql
-            .exec('SELECT * FROM vertical_versions WHERE id = ?', id)
-            .toArray()[0];
+    /**
+     * One version. A version stored before the server derived migration digests (#2339) is derived
+     * first, so a gate never compares the digest its push sent while the backfill has not reached it.
+     */
+    async readVersion(id) {
+        const read = () => this.sql.exec('SELECT * FROM vertical_versions WHERE id = ?', id).toArray()[0];
+        const row = read();
+        if (row?.migration_digest_derived !== null)
+            return row;
+        await deriveVersionMigrationDigest(this.kernelSql, id);
+        return read();
     }
     /**
      * A version and its SQL migrations (#1764), in one transaction. `manifestJson` arrives with
@@ -2137,11 +2235,17 @@ export class ControlPlaneDO extends DurableObject {
             this.sql.exec(`INSERT INTO vertical_versions
            (id, vertical_slug, version, manifest_digest, permission_digest,
             migration_digest, deployment_ref, admission, admission_note, manifest_json,
-            origin_json, migration_count, migrations_split, created_at)
-         VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, 1, ?)`, v.id, v.verticalSlug, v.version, v.manifestDigest, v.permissionDigest, v.migrationDigest, v.deploymentRef, v.admission, v.admissionNote, v.manifestJson, v.originJson, v.migrations?.length ?? null, v.createdAt);
+            origin_json, migration_count, migrations_split, migration_digest_derived, created_at)
+         VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, 1, 1, ?)`, v.id, v.verticalSlug, v.version, v.manifestDigest, v.permissionDigest, v.migrationDigest, v.deploymentRef, v.admission, v.admissionNote, v.manifestJson, v.originJson, v.migrations?.length ?? null, v.createdAt);
             writeVersionMigrations(this.kernelSql, v.id, v.migrations);
+            // #2286: the version's scope-store bindings, refusing one moved to another driver, in the insert's transaction.
+            indexVersionScopeStores(this.kernelSql, v.verticalSlug, v.id, v.manifestJson);
         });
     }
+    /** Every scope-store binding any version of the vertical declared (#2286); indexes versions not indexed yet. */
+    verticalScopeStores(slug) {
+        return this.ctx.storage.transactionSync(() => verticalScopeStoresOf(this.kernelSql, slug));
+    }
     /** One version's SQL migrations (#1764), or `undefined` for no such version. */
     readVersionMigrations(id) {
         return versionMigrationsOf(this.kernelSql, id);
@@ -2162,27 +2266,45 @@ export class ControlPlaneDO extends DurableObject {
     setScopeExpiresAt(scopeId, expiresAt) {
         this.sql.exec('UPDATE scopes SET expires_at = ? WHERE scope_id = ?', expiresAt, scopeId);
     }
-    listVersions(verticalSlug, page) {
+    async listVersions(verticalSlug, page) {
         const where = ['vertical_slug = ?'];
         const params = [verticalSlug];
         const tail = keysetTail(where, params, 'id', page);
         // Named columns, never `manifest_json` itself. `json_valid` first: a manifest that is not
         // JSON lists with null surfaces, as `outboundOfManifestJson` reads it, rather than
         // failing the whole page on `->`.
-        return this.sql
+        const read = () => this.sql
             .exec(`SELECT id, vertical_slug, version, manifest_digest, permission_digest, migration_digest,
-                deployment_ref, admission, admission_note, origin_json, created_at,
-                CASE WHEN json_valid(manifest_json) THEN manifest_json -> '$.outbound' END AS outbound_json,
-                CASE WHEN json_valid(manifest_json) THEN manifest_json -> '$.calls' END AS calls_json
-           FROM vertical_versions WHERE ${where.join(' AND ')}${tail}`, ...params)
+                  migration_digest_derived, deployment_ref, admission, admission_note, origin_json, created_at,
+                  CASE WHEN json_valid(manifest_json) THEN manifest_json -> '$.outbound' END AS outbound_json,
+                  CASE WHEN json_valid(manifest_json) THEN manifest_json -> '$.calls' END AS calls_json
+             FROM vertical_versions WHERE ${where.join(' AND ')}${tail}`, ...params)
             .toArray();
+        const rows = read();
+        // #2339: a page holding versions whose digest is still the pushed one derives them first.
+        const underived = rows.filter((r) => r.migration_digest_derived === null);
+        if (underived.length === 0)
+            return rows;
+        for (const r of underived)
+            await deriveVersionMigrationDigest(this.kernelSql, r.id);
+        return read();
     }
     setAdmission(id, admission, note) {
         this.sql.exec('UPDATE vertical_versions SET admission = ?, admission_note = ? WHERE id = ?', admission, note, id);
     }
-    /** False when a conditional bind lost its compare-and-set (the host throws, as above). */
-    bindScopeVersion(scopeId, versionId, verticalSlug, expectedVersionId, expectedErasureEpoch, confirmMove) {
-        return this.moveScopeRow('vertical_version_id = ?, vertical = ?', [versionId, verticalSlug], scopeId, { expectedVersionId, expectedErasureEpoch, confirmMove });
+    /**
+     * False when a conditional bind lost its compare-and-set (the host throws, as above). #2347:
+     * `servingRef` moves the route in the same write, and `expectedServing` holds it to what the
+     * target lineage's serving script runs, read in this same synchronous transaction.
+     */
+    bindScopeVersion(scopeId, versionId, verticalSlug, expectedVersionId, expectedErasureEpoch, confirmMove, servingRef, expectedServing) {
+        return servingRef === undefined
+            ? this.moveScopeRow('vertical_version_id = ?, vertical = ?', [versionId, verticalSlug], scopeId, { expectedVersionId, expectedErasureEpoch, confirmMove, expectedServing })
+            : this.moveScopeRow('vertical_version_id = ?, vertical = ?, serving_ref = ?', [versionId, verticalSlug, servingRef], scopeId, { expectedVersionId, expectedErasureEpoch, confirmMove, expectedServing });
+    }
+    /** #2347: whether a lineage's serving script still runs the version a rebind was judged against. */
+    servesNow(expected) {
+        return this.sql.exec(`SELECT 1 FROM verticals WHERE ${SERVES_NOW_CONDITION}`, ...servesNowParams(expected)).toArray().length > 0;
     }
     /**
      * Move a scope's binding or route (#1722), conditionally: on the binding the caller read, on
@@ -2196,7 +2318,8 @@ export class ControlPlaneDO extends DurableObject {
             const moved = this.sql.exec(`UPDATE scopes SET ${set} WHERE scope_id = ?
          ${cond.expectedVersionId === undefined ? '' : 'AND vertical_version_id IS ?'}
          ${cond.expectedErasureEpoch === undefined ? '' : 'AND COALESCE(erasure_epoch, 0) = ? AND reap_claimed_at IS NULL'}
-         ${cond.confirmMove === undefined ? '' : COPY_MOVE_LIVE_PREDICATE}`, ...setArgs, scopeId, ...(cond.expectedVersionId === undefined ? [] : [cond.expectedVersionId]), ...(cond.expectedErasureEpoch === undefined ? [] : [cond.expectedErasureEpoch]), ...(cond.confirmMove === undefined ? [] : copyMoveLiveParams(cond.confirmMove, now)));
+         ${cond.confirmMove === undefined ? '' : COPY_MOVE_LIVE_PREDICATE}
+         ${cond.expectedServing === undefined ? '' : SERVES_NOW_PREDICATE}`, ...setArgs, scopeId, ...(cond.expectedVersionId === undefined ? [] : [cond.expectedVersionId]), ...(cond.expectedErasureEpoch === undefined ? [] : [cond.expectedErasureEpoch]), ...(cond.confirmMove === undefined ? [] : copyMoveLiveParams(cond.confirmMove, now)), ...(cond.expectedServing === undefined ? [] : servesNowParams(cond.expectedServing)));
             if (moved.rowsWritten === 0)
                 return false;
             if (cond.confirmMove) {
@@ -2215,15 +2338,9 @@ export class ControlPlaneDO extends DurableObject {
             throw substratError('not_found', `unknown scope ${scopeId} in tenant ${tenantId}`);
         return row.erasure_epoch;
     }
-    claimSubjectErasure(tenantId, scopeId, expectedVersionId, expectedServingRef, expectedEpoch, expectedCopyCount) {
-        return this.sql.exec(`UPDATE scopes SET erasure_epoch = COALESCE(erasure_epoch, 0) + 1
-       WHERE tenant_id = ? AND scope_id = ? AND vertical_version_id IS ?
-         AND serving_ref IS ? AND COALESCE(erasure_epoch, 0) = ?
-         AND NOT EXISTS (SELECT 1 FROM scope_script_copies AS copy
-           WHERE copy.tenant_id = scopes.tenant_id AND copy.scope_id = scopes.scope_id
-             AND copy.state = 'pending')
-         AND (SELECT COUNT(*) FROM scope_script_copies AS copy
-           WHERE copy.tenant_id = scopes.tenant_id AND copy.scope_id = scopes.scope_id) = ?`, tenantId, scopeId, expectedVersionId, expectedServingRef, expectedEpoch, expectedCopyCount).rowsWritten > 0;
+    /** The erasure claim (`SUBJECT_ERASURE_CLAIM_SQL`): false when the scope moved since the fence was read. */
+    claimSubjectErasure(tenantId, scopeId, fence) {
+        return this.sql.exec(SUBJECT_ERASURE_CLAIM_SQL, ...subjectErasureClaimParams(tenantId, scopeId, fence)).rowsWritten > 0;
     }
     recordScopeScriptCopy(tenantId, scopeId, scriptRef, moveId, role = null, loadStamp = null, leaseMs = SCOPE_COPY_LEASE_MS) {
         if (!scriptRef || !moveId)
@@ -2376,10 +2493,23 @@ export class ControlPlaneDO extends DurableObject {
             .exec('SELECT * FROM vertical_channels WHERE vertical_slug = ? AND channel = ?', verticalSlug, channel)
             .toArray()[0];
     }
-    setChannel(verticalSlug, channel, versionId, updatedAt) {
-        this.sql.exec(`INSERT INTO vertical_channels (vertical_slug, channel, version_id, updated_at)
-       VALUES (?, ?, ?, ?)
-       ON CONFLICT (vertical_slug, channel) DO UPDATE SET version_id = ?, updated_at = ?`, verticalSlug, channel, versionId, updatedAt, versionId, updatedAt);
+    /**
+     * #2333: move a channel's pointer, and record the move, only if it still names `from` (null: the
+     * channel has none yet). A compare-and-set in one synchronous transaction, so no other promote
+     * runs between the read and the write: a promote judged its gates against `from` across awaits,
+     * and the one that lost the race is told so (`false`) and writes nothing.
+     */
+    moveChannel(from, history) {
+        return this.ctx.storage.transactionSync(() => {
+            const now = this.readChannel(history.vertical_slug, history.channel);
+            if ((now?.version_id ?? null) !== from)
+                return false;
+            this.sql.exec(`INSERT INTO vertical_channels (vertical_slug, channel, version_id, updated_at)
+         VALUES (?, ?, ?, ?)
+         ON CONFLICT (vertical_slug, channel) DO UPDATE SET version_id = ?, updated_at = ?`, history.vertical_slug, history.channel, history.version_id, history.at, history.version_id, history.at);
+            this.insertChannelHistory(history);
+            return true;
+        });
     }
     listChannels(verticalSlug, page) {
         const where = ['vertical_slug = ?'];