@substrat-run/adapter-cloudflare 0.147.0 → 0.149.0

package/dist/host.js

@@ -1,9 +1,10 @@
 import { env as ambientEnv } from 'cloudflare:workers';
 import { isRewindRefusal, REWIND_REFUSED } from './rewind-refusal.js';
 import { isSystemDoorMoved, SYSTEM_DOOR_MOVED, SYSTEM_DOOR_REGATES } from './system-door.js';
-import { delegatedReadParams, operationSeriesCount, fromWireFailure, isSubstratError, exportReadInput, exportedBatch, importBatch, importResult, importState, importsOfManifestJson, exportsOfManifestJson, assertNoBindingShapeBreak, importCursorMove, importCursorMoveAt, importCursorMoved, accessLogEntry, adminLogEntry, opsFailureEntry, opsFailureFingerprint, issueEntry, findingEntry, findingRuleEntry, sweepRunEntry, FRESHNESS_HEARTBEAT_MINUTES, sweepRunsPayload, modelUsageEntry, attachmentRecord, createTenantInput, identityLink, identityPool, createOrgInput, promotionAcknowledgement, bindAcknowledgement, bindHostnameInput, channelHistoryEntry, hostnameBinding, publishVersionInput, AUTO_ADMISSION_NOTE, registerVerticalInput, vertical as verticalSchema, verticalServingState, verticalChannel, verticalVersion, connection, capabilityExchange, mintedCapability, boundedBecomeMint, boundedBecomeRevoke, boundedUnbind, entityRef, becomeLinkState, principalBecomeCapabilityInput, capabilityGrant, principalId, connectionGrant, connectionGrantRecord, connectionSecret, systemGrant, systemSwitch, systemSwitchOutcome, systemScheduleEntry, systemSwitchRecord, entitlementGrant, entitlementGrantInput, capabilityFilter, instant, meterReading, scopeStorageSample, subjectRef, createConnectionInput, connectLinkFilter, connectLinkKey, consumeConnectLinkInput, mintConnectLinkInput, projectedConnectionGrant, projectedConnectionKey, moduleManifest, org as orgSchema, orgMembership, resolvedIdentity, identityMembership, roleDefinition, scope as scopeSchema, tenant as tenantSchema, tenantRole, delegatedReadRecord, ownerTransferAudit, memberChangeAudit, peerBindingAudit, copyMarkAudit, subjectShredReceipt, connectorDispatchKind, callsOfManifestJson, outboundOfManifestJson, SCOPE_GATE_REASONS, substratError, redrainEventsInput, coverage, peerCoverage, peerGrantsEntry, peerSwitch, peerSwitchOutcome, verticalCaller, verticalResolution, peerInstanceResolution, peerBinding as peerBindingSchema, verticalSlug, entityObjectRef, ATTACHMENT_BLOB_BINDING, blobStoreBindingName, lifecycleDelivery, scopeLifecycle, } from '@substrat-run/contracts';
+import { delegatedReadParams, operationSeriesCount, fromWireFailure, isSubstratError, exportReadInput, exportedBatch, importBatch, importResult, importState, importsOfManifestJson, exportsOfManifestJson, assertNoBindingShapeBreak, importCursorMove, importCursorMoveAt, importCursorMoved, accessLogEntry, adminLogEntry, opsFailureEntry, opsFailureFingerprint, issueEntry, findingEntry, findingRuleEntry, sweepRunEntry, FRESHNESS_HEARTBEAT_MINUTES, sweepRunsPayload, modelUsageEntry, attachmentRecord, createTenantInput, identityLink, identityPool, createOrgInput, promotionAcknowledgement, bindAcknowledgement, bindHostnameInput, channelHistoryEntry, hostnameBinding, publishVersionInput, AUTO_ADMISSION_NOTE, registerVerticalInput, vertical as verticalSchema, verticalServingState, verticalChannel, verticalVersion, connection, capabilityExchange, mintedCapability, boundedBecomeMint, boundedBecomeRevoke, boundedUnbind, entityRef, becomeLinkState, principalBecomeCapabilityInput, capabilityGrant, principalId, connectionGrant, connectionGrantRecord, connectionSecret, systemGrant, systemSwitch, systemSwitchOutcome, systemScheduleEntry, systemSwitchRecord, entitlementGrant, entitlementGrantInput, capabilityFilter, instant, meterReading, scopeStorageSample, subjectRef, createConnectionInput, connectLinkFilter, connectLinkKey, consumeConnectLinkInput, mintConnectLinkInput, projectedConnectionGrant, projectedConnectionKey, moduleManifest, org as orgSchema, orgMembership, resolvedIdentity, identityMembership, roleDefinition, scope as scopeSchema, tenant as tenantSchema, tenantRole, delegatedReadRecord, ownerTransferAudit, memberChangeAudit, peerBindingAudit, connectionBindingAudit, copyMarkAudit, orphanSweepAudit, subjectShredReceipt, connectorDispatchKind, callsOfManifestJson, outboundOfManifestJson, SCOPE_GATE_REASONS, substratError, redrainEventsInput, coverage, peerCoverage, peerGrantsEntry, peerSwitch, peerSwitchOutcome, verticalCaller, verticalResolution, peerInstanceResolution, peerBinding as peerBindingSchema, verticalSlug, entityObjectRef, ATTACHMENT_BLOB_BINDING, blobStoreBindingName, lifecycleDelivery, scopeLifecycle, } from '@substrat-run/contracts';
 import { normalizeHostname, toRouteTarget } from './route-resolver.js';
-import { attachmentBlobKey, attachmentSha256, entitlementDenial, requiredEntitlementFor, foldMeterReading, parseValidationRecords, resolveScopeRecord, ulid, KEPT_COPY_REFUSAL, capabilityTokenHash, checkBecomeInput, assertBecomeLinkStateIds, plausibleSessionToken, foldModelUsage, backoffAt, resolveRetryPolicy, executorOutcomeOf, isDeliveryRefusal, refusalJournalText, isSecretBoxConfigured, unconfiguredSecretBox, createSubjectKeys, generateSealingKeyPair, openSealed, ImpersonationRefused, assertSessionUsable, impersonationRowValues, mapImpersonationRow, newImpersonationSession, jobRunOf, assertLeaseMs, runDueJobRuns, SYSTEM_DOOR_WAIT, startJobRun, attachmentTextJob, assertAttachmentExtractors, resolveAttachmentTextBounds, assertJobRegistrable, ATTACHMENT_TEXT_BACKFILL_JOB, ATTACHMENT_TEXT_JOB, kernelJobFor, attachmentTextBackfillJob, searchLimit, searchMatchExpression, globalFetch, assertRedrainWindow, platformRequestOf, undrainedEventsOf, inUnitMovesToAudit, staleCarryRevertRow, staleCarryReverts, recordedOffFromWire, peerSubjectRef, SWITCH_KINDS, reassertActionOf, reassertEntry, reassertOffRow, reassertOnRow, switchActionOf, switchAuditSubject, recordAuditOutcome, auditedCapabilityRevoke, auditWarningOf, switchNotFoundMessage, recordWriteSuperseded, switchSubjectOf, switchSupersededMessage, withRecorded, systemSwitchedOffMessage, tenantSystemSwitchedOffMessage, CrossVerticalRegistry, importCursorSourceOf, exportBreaksOf, exportBreakRefusal, bindExportBreaksOf, bindExportBreakRefusal, scopeMoveOf, runningVersionOf, strandJudgmentsOf, boundShapesOfColumn, installReconciled, collectPeers, peerCallerAt, peerSeats, connectorCallRecord, noopConnectorCallRecorder, recordConnectorCall, settleConnectionUse, splitManifestMigrations, unknownRoleError, assertRowLimit, assertRowOffset, emptyImportResult, INERT_SCOPE_REASON, lifecycleReceipt, lifecycleRefusal, isPrimaryScope, isPrimaryScopeRow, asyncInvocationId, asyncLinePass, assertNoCallerPurge, purgeReportOf, purgeStillDue, assertBoundOperations, registerTrashTargets, memberAddedAudit, shapeTopUpBatch, } from '@substrat-run/kernel';
+import { attachmentBlobKey, normalizeUploadMediaType, redeemOrReplayUploadLink, attachmentSha256, entitlementDenial, requiredEntitlementFor, foldMeterReading, parseValidationRecords, resolveScopeRecord, ulid, KEPT_COPY_REFUSAL, capabilityTokenHash, checkBecomeInput, assertBecomeLinkStateIds, plausibleSessionToken, foldModelUsage, backoffAt, resolveRetryPolicy, executorOutcomeOf, isDeliveryRefusal, refusalJournalText, isSecretBoxConfigured, unconfiguredSecretBox, createSubjectKeys, generateSealingKeyPair, openSealed, ImpersonationRefused, assertSessionUsable, impersonationRowValues, mapImpersonationRow, newImpersonationSession, jobRunOf, assertLeaseMs, runDueJobRuns, SYSTEM_DOOR_WAIT, startJobRun, attachmentTextJob, assertAttachmentExtractors, resolveAttachmentTextBounds, assertJobRegistrable, ATTACHMENT_TEXT_BACKFILL_JOB, ATTACHMENT_TEXT_JOB, kernelJobFor, attachmentTextBackfillJob, searchLimit, searchMatchExpression, globalFetch, assertRedrainWindow, platformRequestOf, undrainedEventsOf, inUnitMovesToAudit, staleCarryRevertRow, staleCarryReverts, recordedOffFromWire, peerSubjectRef, SWITCH_KINDS, reassertActionOf, reassertEntry, reassertOffRow, reassertOnRow, switchActionOf, switchAuditSubject, recordAuditOutcome, auditedCapabilityRevoke, auditWarningOf, switchNotFoundMessage, recordWriteSuperseded, switchSubjectOf, switchSupersededMessage, withRecorded, systemSwitchedOffMessage, tenantSystemSwitchedOffMessage, CrossVerticalRegistry, importCursorSourceOf, exportBreaksOf, exportBreakRefusal, assertPromoteReviewCurrent, promoteRaceRefusal, rebindRaceRefusal, bindExportBreaksOf, bindExportBreakRefusal, scopeMoveOf, runningVersionOf, strandJudgmentsOf, boundShapesOfColumn, installReconciled, collectPeers, peerCallerAt, peerSeats, connectorCallRecord, noopConnectorCallRecorder, recordConnectorCall, settleConnectionUse, splitManifestMigrations, publishedMigrationDigest, migrationChangeRefusal, unknownRoleError, assertRowLimit, assertRowOffset, emptyImportResult, INERT_SCOPE_REASON, lifecycleReceipt, lifecycleRefusal, isPrimaryScope, isPrimaryScopeRow, asyncInvocationId, asyncLinePass, assertNoCallerPurge, purgeReportOf, purgeStillDue, assertBoundOperations, registerTrashTargets, memberAddedAudit, shapeTopUpBatch, } from '@substrat-run/kernel';
+import { fenceAttachmentSweep, missingAttachmentStore, sweepOrphanAttachments, unsettledCopyRefusal } from '@substrat-run/kernel';
 import { COPY_RESTORE_FENCE_LAPSED, scopeScriptCopyOf } from '@substrat-run/kernel';
 import { attributedView, isModuleErasureCounts, moduleErasurePlan, moduleRowsErased, callReservedStoreOperation, callScopeStore, observeStoreCall, replayStoreErasures, scopeStoreLifecycleOf, scopeStoreRunnersOf } from '@substrat-run/kernel';
 import { PLATFORM_BINDING_PREFIX, scopeStoreBindingName, scopeStoreObjectName, STORE_CALL_URL, StoreError } from '@substrat-run/contracts';
@@ -179,6 +180,21 @@ class UnattestedSwitch extends Error {
 const unfencedMessage = (scopeId) => `the deployment serving scope ${scopeId} predates the switch fence (#2045): it cannot refuse an older ` +
     `switch call's OFF landing after this ON, so no switch is turned on there. Switching off still works. ` +
     `Redeploy the vertical, then retry.`;
+/**
+ * The attachment write's compensation, after its bytes are in the store (#2311). The object
+ * is deleted only when the ScopeDO ANSWERED a refusal: `replyOf` turns every DO-side throw
+ * into a `failure` value, and the DO does not let a post-commit drain fault become one, so an
+ * answered failure means the row did not commit. A rejected call is a transport failure with
+ * the commit unknown. A delete there could leave a committed row without its bytes, so the
+ * bytes are kept and the error rethrown. If nothing committed, the object is an orphan that
+ * no row points at, which the sweep of #2314 is for.
+ */
+async function compensatingRefusal(store, key, call) {
+    const reply = await call();
+    if (reply.failure)
+        await store.delete(key).catch(() => { });
+    return reply;
+}
 /** A tenant-held module's OFF answered without `deniesTenantGrants` (#1823). */
 const undeniedMessage = (scopeId, moduleId) => `the deployment serving scope ${scopeId} predates the kill switch's tenant-grant denial (#1823): ` +
     `module '${moduleId}' holds a tenant-level grant that its OFF would leave authorizing there. ` +
@@ -223,6 +239,23 @@ function isScopeStoreNamespace(value) {
         typeof Reflect.get(value, 'get') === 'function');
 }
 const SCOPE_STORE_BINDING_PREFIX = `${PLATFORM_BINDING_PREFIX}STORE_`;
+/**
+ * `platform` unless this host was handed another way to reach a store (#2288): a
+ * non-empty `runners` list (in-process), or `transport: 'binding'`, which is the only
+ * thing that reads an ambient `SUBSTRAT_STORE_*` namespace. A control plane does not
+ * change the answer: whoever wants the direct namespace says so. An explicit
+ * `'platform'` beside runners is refused, since the runners would never be used.
+ */
+function scopeStoreTransportOf(options) {
+    const runners = options.scopeStores?.runners?.length ?? 0;
+    const transport = options.scopeStores?.transport;
+    if (transport === 'platform' && runners > 0) {
+        throw substratError('validation_failed', "scopeStores: transport 'platform' takes no runners; they would never be used");
+    }
+    if (transport)
+        return transport;
+    return runners > 0 ? 'binding' : 'platform';
+}
 /** Bindings this script declares by having a `SUBSTRAT_STORE_*` namespace. */
 function ambientScopeStoreBindings() {
     const names = [];
@@ -288,7 +321,7 @@ export class CloudflareScopeHost {
     scopeStoreRunners;
     scopeStoreVertical;
     scopeStoreLifecycle;
-    scopeStoreKinds;
+    scopeStoreDrivers;
     scopeStoreTransport;
     cp;
     servicePrincipals;
@@ -328,6 +361,7 @@ export class CloudflareScopeHost {
     blobStores;
     /** Worker-side attachment-bucket resolver (#473); the ambient per-tenant binding unless overridden (#1995). */
     attachmentBuckets;
+    orphanSweepClock;
     /** The parsers attachment text is extracted with (K-43); the host's own, never imported here. */
     attachmentExtractors;
     attachmentTextBounds;
@@ -397,6 +431,7 @@ export class CloudflareScopeHost {
         this.tenantStores = options.tenantStores;
         this.blobStores = options.blobStores;
         this.attachmentBuckets = options.attachmentBuckets ?? ambientAttachmentBucket;
+        this.orphanSweepClock = options.orphanSweepClock ?? (() => new Date().toISOString());
         assertAttachmentExtractors(options.attachmentExtractors ?? []);
         this.attachmentExtractors = options.attachmentExtractors ?? [];
         this.attachmentTextBounds = resolveAttachmentTextBounds(options.attachmentTextBounds);
@@ -405,8 +440,8 @@ export class CloudflareScopeHost {
         this.scopeLocalPermissions = options.scopeLocalPermissions ?? false;
         this.scopeNs = options.scope;
         this.scopeStoreVertical = options.scopeStores?.vertical;
-        this.scopeStoreKinds = options.scopeStores?.kinds ?? {};
-        this.scopeStoreTransport = options.scopeStores?.transport ?? 'binding';
+        this.scopeStoreDrivers = options.scopeStores?.drivers ?? {};
+        this.scopeStoreTransport = scopeStoreTransportOf(options);
         this.scopeStoreRunners = scopeStoreRunnersOf(options.scopeStores);
         this.scopeStoreLifecycle = scopeStoreLifecycleOf(this.scopeStoreRunners);
         this.cpLess = !options.controlPlane;
@@ -1022,6 +1057,8 @@ export class CloudflareScopeHost {
     opts) {
         if (opts?.markCopy)
             assertCopyLineage(opts.markCopy);
+        // #2314: a load replaces the scope's rows, so the orphan sweep is fenced first, as for a rewind.
+        await this.fenceOrphanSweep(scopeId, opts?.tenantId);
         const carry = opts ? recordedOffFromWire(opts) : undefined;
         const load = {
             switchOff: carry ? { at: new Date().toISOString(), ...carry } : undefined,
@@ -1254,6 +1291,7 @@ export class CloudflareScopeHost {
      * audited the ask; this end does not write the access log again.
      */
     async scopeStoreSizesLocal(tenantId, scopeId) {
+        this.refuseLocalStoresOnPlatform('size');
         return this.readScopeStoreSizes(tenantId, scopeId);
     }
     /**
@@ -1261,6 +1299,7 @@ export class CloudflareScopeHost {
      * plane calls this once on the serving script, then destroys the key itself.
      */
     async scopeStoreExportLocal(tenantId, scopeId) {
+        this.refuseLocalStoresOnPlatform('export');
         return this.exportScopeStores(tenantId, scopeId);
     }
     async scopeStoreImportLocal(tenantId, scopeId, stores) {
@@ -1268,8 +1307,19 @@ export class CloudflareScopeHost {
         await this.importScopeStores(tenantId, scopeId, stores);
     }
     async scopeStoreEraseLocal(tenantId, scopeId, subjectId) {
+        this.refuseLocalStoresOnPlatform('erase');
         return this.eraseScopeStores(tenantId, scopeId, subjectId);
     }
+    /**
+     * On the platform hop this host holds no store object, so it cannot say what its stores
+     * hold: an empty answer would read as "no stores" (#2242). It refuses instead, and the
+     * control plane, which reaches the store script, is the one to ask.
+     */
+    refuseLocalStoresOnPlatform(what) {
+        if (this.scopeStoreTransport === 'platform') {
+            throw substratError('unavailable', `this host reaches its scope stores through the platform and cannot ${what} them here; ask the control plane`);
+        }
+    }
     /**
      * The oldest not-yet-drained events of this host's own scope (#1334) — the far end of
      * the control plane's `EventDrainDelegation`. Bounded the same way the audited verb is,
@@ -1321,7 +1371,119 @@ export class CloudflareScopeHost {
      * run nothing until the switch is back in the scope. See `rewindHolding`.
      */
     async rewindScopeLocal(scopeId, bookmark, opts) {
-        return this.rewindHolding(scopeId, () => this.scopeStub(scopeId).rewindToBookmark(bookmark, opts));
+        // #2314: the orphan sweep's fence first. The rewind can take rows away that a later restore
+        // brings back, so their bytes must outlive the PITR window; no fence, no rewind.
+        try {
+            await this.fenceOrphanSweep(scopeId, opts?.tenantId);
+        }
+        catch (err) {
+            throw new Error(`${REWIND_REFUSED}${err instanceof Error ? err.message : String(err)}`);
+        }
+        return this.rewindHolding(scopeId, () => this.scopeStub(scopeId).rewindToBookmark(bookmark, { force: opts?.force }));
+    }
+    /**
+     * #2314: write the orphan sweep's restore fence for a scope whose state is about to be
+     * replaced, into the tenant's attachment bucket, so no pass deletes its bytes while a row the
+     * replacement takes away can still be restored. The tenant is the one named, else the scope's
+     * own provision receipt. A scope whose tenant is neither holds no row the replacement could
+     * take from it unless it holds an attachment row (a fresh scope, a clean-room preview), and
+     * only then is it refused, because its bucket cannot be found. A tenant this script holds no
+     * bucket for has no bytes here, so nothing is fenced. Throws when the fence cannot be written:
+     * the caller refuses the replacement.
+     */
+    async fenceOrphanSweep(scopeId, named) {
+        let tenantId = named ?? null;
+        if (!tenantId) {
+            const facts = await this.scopeStub(scopeId).sweepFenceFacts();
+            if (!facts.tenant && !facts.holdsAttachments)
+                return;
+            tenantId = facts.tenant;
+        }
+        if (!tenantId) {
+            throw new Error(`the tenant of scope ${scopeId} is unknown (no provision receipt, and none was named), so the ` +
+                `orphan-attachment sweep's restore fence (#2314) cannot be written. Reconcile the scope, or ` +
+                `name its tenant, then retry`);
+        }
+        const bucket = await this.attachmentBuckets(tenantId);
+        if (!bucket)
+            return;
+        try {
+            await fenceAttachmentSweep(r2TenantBlobStore(bucket), scopeId, this.orphanSweepClock());
+        }
+        catch (err) {
+            throw new Error(`the orphan-attachment sweep's restore fence (#2314) could not be written for scope ${scopeId}: ` +
+                `${err instanceof Error ? err.message : String(err)}. Nothing was replaced; retry once the attachment bucket answers`);
+        }
+    }
+    /**
+     * #2314: one orphan-sweep pass over a scope's attachment bytes, judged by THIS deployment's
+     * copy of the scope (`sweepOrphanAttachments` in the kernel has the guards). The caller is the
+     * platform, and only for the deployment that serves the scope: the copy refuses to judge if it
+     * is not the scope's provisioned primary, but a stale copy in an older version's script cannot
+     * tell that it is stale.
+     */
+    async sweepOrphanAttachments(tenantId, scopeId, request = {}) {
+        // With a directory, it is the word on the scope, and it is read BEFORE the object is addressed,
+        // since addressing a reaped or never-held object would wake an empty one: this tenant's, active,
+        // a primary, and with no other script's copy that may hold rows this one lacks. A CP-less
+        // deployment has none: its scope's own storage is the word (receipt, lifecycle, copy markers,
+        // in the DO), and the copy ledger is the caller's to have read.
+        let vouched = false;
+        if (!this.cpLess) {
+            const record = await this.cp.getScopeRecord(tenantId, scopeId);
+            if (!record)
+                throw substratError('not_found', `unknown scope ${scopeId} in tenant ${tenantId}`);
+            if (record.status !== 'active') {
+                throw substratError('conflict', `refused: scope ${scopeId} is ${record.status}, and only an active scope's bytes are swept`);
+            }
+            if (!isPrimaryScopeRow(record)) {
+                throw substratError('conflict', `refused: scope ${scopeId} is a copy, and a copy may not judge orphan attachments`);
+            }
+            // Every ledger entry of the scope, page by page, so no page can hide one: a pass needs all of
+            // them settled (`SETTLED_COPY_STATES` is an allowlist), and stops at the first that is not.
+            let after;
+            for (;;) {
+                const page = (await this.cp.listScopeScriptCopies({ tenantId, scopeId, limit: 100, ...(after ? { after } : {}) })).map(scopeScriptCopyOf);
+                const unsettled = unsettledCopyRefusal(scopeId, page);
+                if (unsettled)
+                    throw unsettled;
+                const last = page[page.length - 1];
+                if (page.length < 100 || !last)
+                    break;
+                after = { scriptRef: last.scriptRef, moveId: last.moveId };
+            }
+            // The tenant's status too, as every door into a scope asks.
+            await this.assertLive(tenantId, scopeId);
+            vouched = true;
+        }
+        else if (request.copiesSettled !== true) {
+            throw substratError('conflict', `refused: this deployment cannot read the copy ledger, so a pass over scope ${scopeId} needs its caller ` +
+                'to have found no unsettled copy of it (copiesSettled)');
+        }
+        const stub = this.scopeStub(scopeId);
+        const now = this.orphanSweepClock();
+        const expected = request.expectedVersionId;
+        const judge = (condemn) => async (ids, at) => unwrapReply(await stub.orphanAttachmentsReply([...ids], at, tenantId, condemn, vouched, expected));
+        // The scope's copy gives its verdict first, with no ids: every refusal it makes, and whether this
+        // script is the one the platform routed the pass to, in the pass's own mode. So a destructive
+        // pass routed to the wrong script is refused even when there is nothing to condemn.
+        await judge(request.dryRun !== true)([], now);
+        // A script with no attachment store for the tenant holds none of its bytes: a vertical whose
+        // modules keep no files. Answered as that, marked, rather than the throw `resolveAttachmentStore`
+        // makes for a write, so the platform's pass can tell it from a failure and from a store that held
+        // nothing. A scope that holds an attachment row does keep files, so its missing store is a
+        // misconfiguration, and it fails.
+        const bucket = await this.attachmentBuckets(tenantId);
+        if (!bucket) {
+            if ((await stub.sweepFenceFacts()).holdsAttachments)
+                throw missingAttachmentStore(tenantId, scopeId);
+            return { listed: 0, candidates: 0, orphans: 0, deleted: 0, keys: [], dryRun: request.dryRun === true, bucket: 'none' };
+        }
+        const store = r2TenantBlobStore(bucket);
+        return sweepOrphanAttachments(store, scopeId, {
+            rowless: (ids) => judge(false)(ids, now),
+            condemn: judge(true),
+        }, { now, ...(request.dryRun ? { dryRun: true } : {}), ...(request.limit !== undefined ? { limit: request.limit } : {}) });
     }
     registerModule(registration) {
         const manifest = moduleManifest.parse(registration.manifest);
@@ -1601,6 +1763,46 @@ export class CloudflareScopeHost {
         const store = await this.resolveAttachmentStore(tenantId);
         return this.buildAttachmentSurface({ principal }, tenantId, scopeId, store);
     }
+    async inspectUploadLink(tenantId, scopeId, secret, target, idempotencyKey) {
+        await this.assertLive(tenantId, scopeId);
+        await this.migrateAndRecord(scopeId);
+        return unwrapReply(await this.scopeStub(scopeId).uploadLinkInspectReply(secret, tenantId, scopeId, target, idempotencyKey)).view;
+    }
+    async redeemUploadLink(tenantId, scopeId, secret, input) {
+        await this.assertLive(tenantId, scopeId);
+        await this.migrateAndRecord(scopeId);
+        const stub = this.scopeStub(scopeId);
+        // The target first (the kernel judges it before the state), so a wrong path never reads as
+        // gone; a replay (#2315) is answered from the inspection and never reaches the write.
+        const inspect = async () => unwrapReply(await stub.uploadLinkInspectReply(secret, tenantId, scopeId, input.entity, input.idempotencyKey));
+        return redeemOrReplayUploadLink(inspect, input, async ({ view, mintedBy }) => {
+            const store = await this.resolveAttachmentStore(tenantId);
+            // A fresh id per request, so its key is its own: compensating a refusal can never remove
+            // the bytes of the redemption that won the link.
+            const id = ulid();
+            const key = attachmentBlobKey(scopeId, id);
+            const filename = view.filename ?? input.filename;
+            // Recorded as it is judged: the essence, never a parameter or a stray space.
+            const contentType = normalizeUploadMediaType(input.contentType);
+            const record = attachmentRecord.parse({
+                id,
+                entity: view.entity,
+                filename,
+                contentType,
+                size: input.body.byteLength,
+                sha256: await attachmentSha256(input.body),
+                visibility: view.visibility,
+                createdBy: mintedBy,
+                createdAt: new Date().toISOString(),
+            });
+            // Bytes first, row second, exactly as an upload: a refusal (size, type, a lost key, a link
+            // someone else spent first) compensates the object away, and the link is unspent with it.
+            // A lost reply keeps the bytes (`compensatingRefusal`), and a retry carrying the same
+            // `Idempotency-Key` is answered as a replay (#2315).
+            await store.put(key, input.body, { contentType });
+            return unwrapReply(await compensatingRefusal(store, key, () => stub.attachmentRedeemUploadLinkReply(record, secret, tenantId, scopeId, input.idempotencyKey)));
+        });
+    }
     async getSystemAttachments(moduleId, tenantId, scopeId) {
         // Reuse the system invoke door's module, tenant and lifecycle gate, and its rewind gate
         // (#1834). The DO authorizes each open against the attachment target's read permission as
@@ -1739,16 +1941,10 @@ export class CloudflareScopeHost {
                     createdBy,
                     createdAt: new Date().toISOString(),
                 });
-                // Bytes first, row second — a crash between the two leaves an orphaned object
-                // (harmless, GC-able), never a row without bytes; a refused gate compensates.
+                // Bytes first, row second — a crash between the two leaves an orphaned object (#2314);
+                // a refused gate compensates, and only an answered refusal does (`compensatingRefusal`).
                 await store.put(key, input.body, { contentType: input.contentType });
-                try {
-                    return unwrapReply(await stub.attachmentAddReply(record, asPrincipalId, tenantId, scopeId, connectionId));
-                }
-                catch (err) {
-                    await store.delete(key).catch(() => { });
-                    throw err;
-                }
+                return unwrapReply(await compensatingRefusal(store, key, () => stub.attachmentAddReply(record, asPrincipalId, tenantId, scopeId, connectionId)));
             },
             list: async (entity) => unwrapReply(await stub.attachmentListReply(entity, asPrincipalId, tenantId, scopeId, connectionId)),
             open: async (attachmentId) => {
@@ -1813,6 +2009,8 @@ export class CloudflareScopeHost {
         if (!existing)
             throw substratError('not_found', `unknown scope ${scopeId} in tenant ${tenantId}`);
         this.refuseUnusableScopeStores(dump.stores, existing.vertical);
+        // #2314: the load replaces the scope's rows, so the orphan sweep is fenced first.
+        await this.fenceOrphanSweep(scopeId, tenantId);
         // #1742: a dump from before a switch was pulled brings the module's grants back live, so
         // the directory's recorded-off modules go back off in the replay's own event. Only where
         // this is the scope's real store, as for the provision's seat above; a hosted scope is
@@ -2031,8 +2229,15 @@ export class CloudflareScopeHost {
         }
         return vertical;
     }
-    /** Configured runners, or the ambient namespaces when none were handed in. */
+    /**
+     * Configured runners, or the ambient namespaces when this host was told to use a
+     * direct binding. The platform hop holds no object in this isolate, so an ambient
+     * namespace is not one of its stores, and the admin's store paths answer for none: the
+     * control plane reaches the platform's stores itself (see `eraseScopeStores`).
+     */
     scopeStoreBindingNames() {
+        if (this.scopeStoreTransport === 'platform')
+            return [];
         if (this.scopeStoreRunners.size > 0)
             return [...this.scopeStoreRunners.keys()];
         return ambientScopeStoreBindings();
@@ -2084,8 +2289,13 @@ export class CloudflareScopeHost {
     }
     /**
      * `substrat.erase` on each declared binding (#2068). A store error throws so the
-     * caller can leave the subject key untouched. Fail closed: an empty answer means
-     * this host KNOWS it holds nothing for the scope, never that it could not tell.
+     * caller can leave the subject key untouched. An empty answer means this host holds no
+     * store object for the scope, never that it could not tell. On the platform hop that is
+     * true by construction (`scopeStoreBindingNames` is empty): the stores live behind the
+     * store script, and control-plane-api erases, exports, sizes and wipes them itself around
+     * its calls to this host's admin (`shredSubject`, `exportScope`, `scopeStoreSizes`, the
+     * wipe and the replay); an erasure reaches them before the host's shred destroys the key. Only the vertical-host `*Local` reads, which no control plane fronts,
+     * refuse on the hop instead (`refuseLocalStoresOnPlatform`).
      */
     async eraseScopeStores(tenantId, scopeId, subjectId) {
         const bindings = this.scopeStoreBindingNames();
@@ -2101,23 +2311,23 @@ export class CloudflareScopeHost {
         }
         return erasures;
     }
-    /** A runner's kind, or the kind declared for an ambient binding. Never invented. */
-    scopeStoreKind(binding) {
-        const kind = this.scopeStoreRunners.get(binding)?.kind ?? this.scopeStoreKinds[binding];
-        if (!kind) {
-            throw substratError('unavailable', `scope store '${binding}' has no declared kind`);
+    /** A runner's driver, or the driver declared for an ambient binding. Never invented. */
+    scopeStoreDriver(binding) {
+        const driver = this.scopeStoreRunners.get(binding)?.driver ?? this.scopeStoreDrivers[binding];
+        if (!driver) {
+            throw substratError('unavailable', `scope store '${binding}' has no declared driver`);
         }
-        return kind;
+        return driver;
     }
     /**
      * A dump's stores this host cannot load are refused before any write (#2211, L8): a
-     * binding that is not bound, a kind other than the bound one, or any store at all for
+     * binding that is not bound, a driver other than the bound one, or any store at all for
      * a destination with no vertical (no store object can be named for it, so loading would
      * drop them), or a destination on a vertical other than the one this host is pinned to.
      * `vertical` undefined is a caller that cannot read the destination here;
      * `importScopeStores` then refuses a scope with no vertical itself, still before a store
-     * write. A store with no `kind` is refused: the dump contract requires one, and an
-     * unparsed dump would otherwise skip the kind comparison.
+     * write. A store with no `driver` is refused: the dump contract requires one, and an
+     * unparsed dump would otherwise skip the driver comparison.
      */
     refuseUnusableScopeStores(stores, vertical) {
         const listed = stores ?? [];
@@ -2134,12 +2344,12 @@ export class CloudflareScopeHost {
             if (!bound.has(store.binding)) {
                 throw substratError('not_found', `dump names scope store '${store.binding}', which is not bound`);
             }
-            if (!store.kind) {
-                throw substratError('validation_failed', `dump's scope store '${store.binding}' names no kind`);
+            if (!store.driver) {
+                throw substratError('validation_failed', `dump's scope store '${store.binding}' names no driver`);
             }
-            const kind = this.scopeStoreRunners.get(store.binding)?.kind ?? this.scopeStoreKinds[store.binding];
-            if (store.kind !== kind) {
-                throw substratError('conflict', `dump's scope store '${store.binding}' is kind '${store.kind}', and this host binds kind '${kind ?? 'undeclared'}'`);
+            const driver = this.scopeStoreRunners.get(store.binding)?.driver ?? this.scopeStoreDrivers[store.binding];
+            if (store.driver !== driver) {
+                throw substratError('conflict', `dump's scope store '${store.binding}' is driver '${store.driver}', and this host binds driver '${driver ?? 'undeclared'}'`);
             }
         }
     }
@@ -2157,7 +2367,7 @@ export class CloudflareScopeHost {
             const exported = await this.invokeReservedStore({ tenantId, vertical, scopeId, binding }, 'substrat.export');
             stores.push({
                 binding,
-                kind: this.scopeStoreKind(binding),
+                driver: this.scopeStoreDriver(binding),
                 tables: exported.tables,
             });
         }
@@ -2931,9 +3141,10 @@ export class CloudflareScopeHost {
                     // #119: a purge horizon's schedule runs its operation once per due entity, each its own
                     // call and transaction — and the SCOPE decides which are due and runs them, so purge
                     // authority is never an argument any stub can pass (`runPurgeSweep`).
-                    const pass = await door.through((instance) => stub.runPurgeSweep(schedule.operation, tenantId, scopeId, instance));
+                    // #2192: under the run's own id, so the purges and their deliveries join this run's line.
+                    const pass = await door.through((instance) => stub.runPurgeSweep(schedule.operation, tenantId, scopeId, instance, invocationId));
                     // The purges' events, delivered the way each invoke's own tail delivers them.
-                    await this.drainExecutors(tenantId, scopeId, null);
+                    await this.drainExecutors(tenantId, scopeId, invocationId);
                     stillDue = purgeStillDue(pass);
                     const outcome = purgeReportOf(schedule.operation, schedule.purge.entityType, pass);
                     report.errors.push(...outcome.errors);
@@ -4205,12 +4416,12 @@ export class CloudflareScopeHost {
                 });
                 await this.recordAdmin(actor, 'setHostnameIssuance', { tenantId: row.tenant_id, scopeId: row.scope_id }, { status: row.status }, { status: fields.status, note: fields.note ?? null });
             },
-            unbindHostname: async (actor, raw) => {
+            unbindHostname: async (actor, raw, owner) => {
                 const hostname = raw.toLowerCase(); // DNS is case-insensitive; the map is normalized
-                const row = await this.cp.readHostname(hostname);
+                // The row the delete removed, so an owner is judged by the delete itself (#2285).
+                const row = await this.cp.deleteHostname(hostname, owner);
                 if (!row)
                     return; // idempotent, and a no-op is not audited
-                await this.cp.deleteHostname(hostname);
                 await this.recordAdmin(actor, 'unbindHostname', { tenantId: row.tenant_id, scopeId: row.scope_id }, { hostname, status: row.status }, null);
             },
             listHostnames: async (actor, filter) => {
@@ -4321,8 +4532,13 @@ export class CloudflareScopeHost {
                 // The SQL migrations are stored apart from the manifest (#1764), so no read of the
                 // version but the promote review's carries them.
                 const split = splitManifestMigrations(manifestJson ?? null, 'push');
-                await this.cp.insertVersion({
+                // #2339: the digest a promote compares is the one derived from what is stored, never the pushed one.
+                const migrationDigest = await publishedMigrationDigest({
+                    id: audited.id, migrationDigest: audited.migrationDigest, manifestJson: manifestJson ?? null, migrations: split.migrations,
+                });
+                await this.directory('insertVersion', {
                     ...audited,
+                    migrationDigest,
                     manifestJson: split.manifestJson,
                     migrations: split.migrations,
                     originJson: origin ? JSON.stringify(origin) : null,
@@ -4332,10 +4548,17 @@ export class CloudflareScopeHost {
                 });
                 await this.recordAdmin(actor, 'publishVersion', { tenantId: null }, null, {
                     ...audited,
+                    // The digest the registry holds, which differs from the pushed one only for an unheld version.
+                    migrationDigest,
                     ...(origin ? { origin } : {}),
                     admission: selfAdmits ? 'admitted' : 'pending',
                 });
             },
+            verticalScopeStores: async (actor, verticalSlug) => {
+                const stores = await this.directory('verticalScopeStores', verticalSlug);
+                await this.recordAccess(actor, 'verticalScopeStores', {}, { verticalSlug }, stores.length);
+                return stores;
+            },
             listVersions: async (actor, verticalSlug, page) => {
                 const rows = await this.cp.listVersions(verticalSlug, page);
                 await this.recordAccess(actor, 'listVersions', {}, { verticalSlug }, rows.length);
@@ -4493,6 +4716,20 @@ export class CloudflareScopeHost {
                 ], incoming.id, incoming, served || owned.length > 0
                     ? await this.cp.provisionedVersionsOf(verticalSlug, served, owned.length > 0 ? owning.owner_tenant : null)
                     : []);
+                // #2333: the acknowledgements answer the review they were given against, or none at all.
+                const reviewed = async (v) => ({
+                    id: v.id,
+                    permissionDigest: v.permission_digest,
+                    migrationDigest: v.migration_digest,
+                    migrations: (await this.cp.readVersionMigrations(v.id))?.migrations ?? null,
+                });
+                await assertPromoteReviewCurrent({
+                    ack,
+                    channel,
+                    baseId: outgoing?.id ?? null,
+                    migrationsChange: outgoing !== undefined && outgoing.migration_digest !== incoming.migration_digest,
+                    read: async () => ({ base: outgoing ? await reviewed(outgoing) : null, incoming: await reviewed(incoming) }),
+                });
                 // §4's checkpoints, at the moment of exposure. A first promotion has
                 // nothing to diff against — the gate is about change, not existence.
                 if (outgoing) {
@@ -4501,8 +4738,7 @@ export class CloudflareScopeHost {
                             `${incoming.permission_digest}) — acknowledge it explicitly to promote`);
                     }
                     if (outgoing.migration_digest !== incoming.migration_digest && !ack.migrationChange) {
-                        throw substratError('conflict', `promotion changes migrations (${outgoing.migration_digest} → ` +
-                            `${incoming.migration_digest}) — acknowledge it explicitly to promote`);
+                        throw substratError('conflict', migrationChangeRefusal(outgoing.migration_digest, incoming.migration_digest));
                     }
                     // #1705 PR 3: an export an installed consumer imports, dropped or re-versioned.
                     if (!ack.exportBreak) {
@@ -4512,10 +4748,13 @@ export class CloudflareScopeHost {
                     }
                 }
                 const promotedAt = new Date().toISOString();
-                await this.cp.setChannel(verticalSlug, channel, versionId, promotedAt);
-                // The timeline row: what makes rollback a choice among recorded moments, and
-                // `at` the PITR anchor a data rollback would rewind to.
-                await this.cp.insertChannelHistory({
+                // #2333: a compare-and-set. Every gate above — the review binding, the digest checkpoints,
+                // the export breaks — was judged against `outgoing`, across awaits another promote can run
+                // in. The control plane moves the pointer, and writes the timeline row (what makes rollback a
+                // choice among recorded moments, and `at` the PITR anchor a data rollback would rewind to),
+                // only if the pointer still names `outgoing`; the promote that lost the race is refused as
+                // stale and writes nothing.
+                const moved = await this.cp.moveChannel(outgoing?.id ?? null, {
                     id: ulid(),
                     vertical_slug: verticalSlug,
                     channel,
@@ -4524,6 +4763,8 @@ export class CloudflareScopeHost {
                     actor,
                     at: promotedAt,
                 });
+                if (!moved)
+                    throw promoteRaceRefusal(channel);
                 // For a PRIVATE vertical, prod IS what the owner's apps run: re-point the
                 // owning tenant's live scopes in the same act, so merge-to-main (push +
                 // promote) is a complete deploy and a rollback promote reaches the running
@@ -4596,19 +4837,27 @@ export class CloudflareScopeHost {
             },
             bindScopeVersion: async (actor, tenantId, scopeId, versionId, opts) => {
                 const { v, scope } = await bindTarget(tenantId, scopeId, versionId);
-                if (opts?.expectedVersionId !== undefined && scope.vertical_version_id !== opts.expectedVersionId) {
-                    throw substratError('precondition_failed', 'scope binding changed; reload the scope and retry');
-                }
+                // #2347: a rebind judged against both lineages loses its race as stale, so its client reads
+                // the review again; any other conditional bind keeps the refusal it always had.
+                const lost = () => opts?.expectedServing
+                    ? rebindRaceRefusal(opts.expectedServing.vertical)
+                    : substratError('precondition_failed', 'scope binding changed; reload the scope and retry');
+                if (opts?.expectedVersionId !== undefined && scope.vertical_version_id !== opts.expectedVersionId)
+                    throw lost();
+                if (opts?.expectedServing && !await this.cp.servesNow(opts.expectedServing))
+                    throw lost();
                 if (opts?.expectedErasureEpoch !== undefined && await this.cp.scopeErasureEpoch(tenantId, scopeId) !== opts.expectedErasureEpoch) {
                     throw substratError('precondition_failed', 'scope erasure changed; reload the scope and retry');
                 }
                 const ack = bindAcknowledgement.parse(opts?.acknowledge ?? {});
+                // #2347: a route moving in the same write is judged with it, as `bindingImpact` is.
+                const servingRef = opts?.servingRef;
                 // #2178 first: no acknowledgement passes it, so none should be asked for ahead of it.
-                await this.assertBindingShapesKept(mapScope(scope), v);
+                await this.assertBindingShapesKept(mapScope(scope), v, servingRef);
                 // #1756: an export an app in this tenant imports, dropped or re-versioned by what this
                 // scope would run. Before the snapshot, so a refused bind leaves nothing behind.
                 if (!ack.exportBreak) {
-                    const breaks = await this.bindBreaks(actor, mapScope(scope), v);
+                    const breaks = await this.bindBreaks(actor, mapScope(scope), v, servingRef);
                     if (breaks.length > 0)
                         throw substratError('precondition_failed', bindExportBreakRefusal(breaks));
                 }
@@ -4620,12 +4869,19 @@ export class CloudflareScopeHost {
                         await this.snapshotScope(actor, tenantId, scopeId);
                     }
                 }
-                if (!await this.cp.bindScopeVersion(scopeId, versionId, v.vertical_slug, opts?.expectedVersionId, opts?.expectedErasureEpoch, opts?.confirmMove)) {
-                    throw substratError('precondition_failed', 'scope binding changed; reload the scope and retry');
+                if (!await this.cp.bindScopeVersion(scopeId, versionId, v.vertical_slug, opts?.expectedVersionId, opts?.expectedErasureEpoch, opts?.confirmMove, servingRef, opts?.expectedServing)) {
+                    // The erasure and copy-move conditions keep their own refusal: only a moved binding or a
+                    // moved serving version is the race a rebind's review answers.
+                    const now = await this.cp.getScopeRecord(tenantId, scopeId);
+                    const raced = (opts?.expectedVersionId !== undefined && (now?.vertical_version_id ?? null) !== opts.expectedVersionId)
+                        || (opts?.expectedServing !== undefined && !await this.cp.servesNow(opts.expectedServing));
+                    throw raced ? lost() : substratError('precondition_failed', 'scope binding changed; reload the scope and retry');
                 }
-                await this.recordAdmin(actor, 'bindScopeVersion', { tenantId, scopeId }, null, {
+                await this.recordAdmin(actor, 'bindScopeVersion', { tenantId, scopeId }, servingRef === undefined ? null : { servingRef: scope.serving_ref ?? null }, {
                     versionId, vertical: v.vertical_slug, version: v.version,
+                    ...(servingRef !== undefined ? { servingRef } : {}),
                     ...(opts?.expectedVersionId !== undefined ? { expectedVersionId: opts.expectedVersionId } : {}),
+                    ...(opts?.expectedServing ? { expectedServing: opts.expectedServing } : {}),
                     ...(ack.exportBreak ? { acknowledged: ack } : {}),
                 });
             },
@@ -4806,7 +5062,7 @@ export class CloudflareScopeHost {
                     return { rewindingTo: bookmark };
                 }
                 // #1819: the same rewind a dispatched vertical runs, holding what the scope switched off.
-                return this.rewindScopeLocal(scopeId, bookmark, { force: opts?.force });
+                return this.rewindScopeLocal(scopeId, bookmark, { force: opts?.force, tenantId });
             },
             createOrg: async (actor, input) => {
                 const parsed = createOrgInput.parse(input);
@@ -4958,6 +5214,63 @@ export class CloudflareScopeHost {
                     createdAt: r.created_at,
                 }));
             },
+            // -- store-driver releases, rollouts and holds (D-63, #2300) -------------------
+            recordStoreDriverRelease: async (actor, input) => {
+                const at = new Date().toISOString();
+                const { record, created } = await this.directory('recordStoreDriverRelease', { ...input, actor, at });
+                if (created)
+                    await this.recordAdmin(actor, 'uploadStoreDriverRelease', { tenantId: null }, null, record);
+                return record;
+            },
+            getStoreDriverRelease: async (actor, driver, sha256) => {
+                const record = await this.cp.getStoreDriverRelease(driver, sha256);
+                await this.recordAccess(actor, 'getStoreDriverRelease', { tenantId: null }, { driver, sha256 }, record ? 1 : 0);
+                return record;
+            },
+            storeDriverState: async (actor, driver) => {
+                const state = await this.cp.storeDriverState(driver);
+                await this.recordAccess(actor, 'storeDriverState', { tenantId: null }, { driver }, state.rollouts.length);
+                return state;
+            },
+            storeDriverDeclarations: async (actor, driver) => {
+                const declared = await this.directory('storeDriverDeclarations', driver);
+                await this.recordAccess(actor, 'storeDriverDeclarations', { tenantId: null }, { driver }, declared.verticals.length);
+                return declared;
+            },
+            storeDriverRolloutPending: async (actor, input) => {
+                const page = await this.directory('storeDriverRolloutPending', input);
+                await this.recordAccess(actor, 'storeDriverRolloutPending', { tenantId: null }, { driver: input.driver, sha256: input.sha256, action: input.action }, page.verticals.length);
+                return page;
+            },
+            storeDriverRolloutWalked: async (actor, input) => {
+                const walked = await this.directory('storeDriverRolloutWalked', input);
+                await this.recordAccess(actor, 'storeDriverRolloutWalked', { tenantId: null }, { driver: input.driver, seq: input.seq }, walked.verticals.length);
+                return walked;
+            },
+            holdStoreDriver: async (_actor, input) => this.directory('holdStoreDriver', input),
+            releaseStoreDriverHold: async (_actor, input) => {
+                await this.cp.releaseStoreDriverHold(input);
+            },
+            beginStoreDriverRollout: async (actor, input) => {
+                const row = await this.directory('beginStoreDriverRollout', { ...input, actor, at: new Date().toISOString() });
+                await this.recordAdmin(actor, input.action === 'rollback' ? 'rollBackStoreDriver' : 'rollOutStoreDriver', { tenantId: null }, null, row);
+                return row;
+            },
+            finishStoreDriverRollout: async (actor, input) => {
+                const row = await this.directory('finishStoreDriverRollout', { ...input, at: new Date().toISOString() });
+                await this.recordAdmin(actor, row.action === 'rollback' ? 'rollBackStoreDriver' : 'rollOutStoreDriver', { tenantId: null }, null, row);
+                return row;
+            },
+            storeDriverRebuild: async (actor, driver) => {
+                const rebuild = await this.cp.storeDriverRebuild(driver);
+                await this.recordAccess(actor, 'storeDriverRebuild', { tenantId: null }, { driver }, rebuild ? 1 : 0);
+                return rebuild;
+            },
+            claimStoreDriverRebuild: async (_actor, input) => this.directory('claimStoreDriverRebuild', { ...input, at: new Date().toISOString() }),
+            advanceStoreDriverRebuild: async (_actor, input) => this.directory('advanceStoreDriverRebuild', { ...input, at: new Date().toISOString() }),
+            recordStoreDriverRebuildRun: async (actor, entry) => {
+                await this.recordAdmin(actor, 'rebuildStoreDriver', { tenantId: null }, null, entry);
+            },
             listScopeTables: async (actor, tenantId, scopeId) => {
                 // K-3 cross-check on the shared directory BEFORE reaching the scope DO: a pair
                 // that does not resolve is unreachable, never another tenant's database.
@@ -5347,11 +5660,12 @@ export class CloudflareScopeHost {
                 await this.recordAccess(actor, 'listShreddedSubjects', { tenantId, scopeId }, null, subjects.length);
                 return { subjects, nextCursor };
             },
-            shredSubject: async (actor, tenantId, scopeId, subjectId) => {
+            shredSubject: async (actor, tenantId, scopeId, subjectId, fence) => {
                 await this.assertScope(tenantId, scopeId);
-                // #1722: a direct shred claims nothing; it records the epoch it ran under, as an orchestrated
-                // one records the epoch its claim compared, so the backfill can order every erasure.
-                const stamp = { erasureEpoch: await this.cp.scopeErasureEpoch(tenantId, scopeId), path: 'direct' };
+                // #1722: a direct shred records the epoch it ran under, as an orchestrated one records the
+                // epoch its claim compared, so the backfill can order every erasure. With a fence (#2285) it
+                // claims what it read just before the key goes, and records the epoch that claim compared.
+                const stamp = { erasureEpoch: fence?.epoch ?? await this.cp.scopeErasureEpoch(tenantId, scopeId), path: 'direct' };
                 // Redact the live spine FIRST, destroy the key LAST. Both halves are idempotent and
                 // a crash between them converges on retry, so the order is decided by which
                 // half-done state harms the person: dying after the redaction leaves ciphertext in
@@ -5413,6 +5727,8 @@ export class CloudflareScopeHost {
                 await this.cp.redactSubjectText({ tenantId, scopeId, subjectId, intentIds });
                 // Scope stores after the scope-side redaction and before the key (#2068).
                 const storeErasures = await this.eraseScopeStores(tenantId, scopeId, subjectId);
+                if (fence)
+                    await this.claimSubjectErasure(tenantId, scopeId, fence);
                 const at = new Date().toISOString();
                 const { existed } = await this.subjectKeysFor(tenantId, scopeId).destroy(subjectId, at);
                 const receipt = subjectShredReceipt.parse({
@@ -5439,9 +5755,7 @@ export class CloudflareScopeHost {
                 await this.assertScope(tenantId, scopeId);
                 if (redactions.length === 0)
                     throw substratError('conflict', 'subject erasure has no confirmed scope redaction');
-                if (!await this.cp.claimSubjectErasure(tenantId, scopeId, expected.versionId, expected.servingRef, expected.epoch, expected.copyCount)) {
-                    throw substratError('precondition_failed', 'scope route or copy inventory changed during subject erasure; retry after it settles');
-                }
+                await this.claimSubjectErasure(tenantId, scopeId, expected);
                 const intentIds = [...new Set(redactions.flatMap((r) => r.intentIds))];
                 await this.cp.redactSubjectText({ tenantId, scopeId, subjectId, intentIds });
                 const { existed } = await this.subjectKeysFor(tenantId, scopeId).destroy(subjectId, new Date().toISOString());
@@ -5877,6 +6191,10 @@ export class CloudflareScopeHost {
                 const { tenantId, scopeId, ...after } = memberChangeAudit.parse(entry);
                 await this.recordAdmin(actor, 'manageScopeMember', { tenantId, scopeId }, null, after);
             },
+            recordConnectionBindingChange: async (actor, entry) => {
+                const { tenantId, scopeId, ...after } = connectionBindingAudit.parse(entry);
+                await this.recordAdmin(actor, 'bindConnectionScope', { tenantId, scopeId }, null, after);
+            },
             recordPeerBindingChange: async (actor, entry) => {
                 const { tenantId, scopeId, ...after } = peerBindingAudit.parse(entry);
                 await this.recordAdmin(actor, 'setPeerBinding', { tenantId, scopeId }, null, after);
@@ -5896,6 +6214,11 @@ export class CloudflareScopeHost {
                 const { tenantId, scopeId, action, ...after } = copyMarkAudit.parse(entry);
                 await this.recordAdmin(actor, action === 'mark' ? 'markScopeCopy' : 'clearScopeCopyMark', { tenantId, scopeId }, null, after);
             },
+            /** #2314: one orphan-attachment pass over a scope, written after the vertical's own pass. */
+            recordOrphanSweep: async (actor, entry) => {
+                const { tenantId, scopeId, ...after } = orphanSweepAudit.parse(entry);
+                await this.recordAdmin(actor, 'sweepOrphanAttachments', { tenantId, scopeId }, null, after);
+            },
             accessLog: async (actor, filter) => {
                 const rows = await this.cp.accessLog({
                     actor: filter?.actor,
@@ -6381,6 +6704,12 @@ export class CloudflareScopeHost {
      * subject-key operation touches anything. Without it a caller could reach another
      * tenant's keys by naming their scope id.
      */
+    /** The erasure claim (`SUBJECT_ERASURE_CLAIM_SQL`); a scope that moved refuses with the key kept. */
+    async claimSubjectErasure(tenantId, scopeId, fence) {
+        if (!await this.cp.claimSubjectErasure(tenantId, scopeId, fence)) {
+            throw substratError('precondition_failed', 'scope route or copy inventory changed during subject erasure; retry after it settles');
+        }
+    }
     async assertScope(tenantId, scopeId) {
         const rec = await this.cp.getScopeRecord(tenantId, scopeId);
         if (!rec)
@@ -6465,6 +6794,11 @@ export class CloudflareScopeHost {
      */
     async connectionGrantsInScope(tenantId, scopeId) {
         await this.validateScopeAccess(tenantId, scopeId);
+        if (this.connectorDelegation) {
+            if (!this.connectorDelegation.grants)
+                throw new Error('connector grant inspection is not configured for the serving deployment');
+            return this.connectorDelegation.grants({ tenantId, scopeId });
+        }
         await this.migrateAndRecord(scopeId);
         const now = new Date().toISOString();
         // Both stores again, but the CF split is not the pure adapter's. The DO holds the