@substrat-run/adapter-cloudflare 0.158.0 → 0.160.0

package/dist/control-plane-do.js

@@ -1,11 +1,12 @@
 import { DurableObject } from 'cloudflare:workers';
-import { membershipFencesBackfillSql, MEMBERSHIP_FENCES_DDL, MEMBERSHIP_FENCES_TABLE, membershipFencesTableExists, MEMBERSHIP_FENCE_SINCE_SQL, RAISE_MEMBERSHIP_FENCE_SQL, memberAddedAudit, orgChangeBound, reservedRoleRefusal, tenantCoverage, IMPERSONATION_COLUMNS, IMPERSONATION_DDL, impersonationByIdQuery, impersonationListQuery, impersonationRowValues, ISSUE_RETENTION_DAYS, telemetryRetentionStatements, FINDINGS_DDL, SCOPE_STORAGE_DDL, forgetScopeStorage, listScopeStorageAttemptRows, listScopeStorageRows, listScopeStoreStorageRows, pruneScopeStorageRows, recordScopeStorageRows, CONNECT_LINKS_DDL, consumeConnectLinkRow, insertConnectLink as insertConnectLinkRow, listConnectLinks as listConnectLinkRows, readConnectLink as readConnectLinkRow, restoreConnectLinkRow, revokeConnectLinkRow, createFindingRule, findingOfOpsFailure, findingOfSweepRun, pruneFindings, listFindingRules, listFindings, observeFinding, revokeFindingRule, setFindingStatus, assertRowLimit, OPS_FAILURE_RETENTION_DAYS, SWEEP_RUN_RETENTION_DAYS, SWEEP_RUNS_INTENT_INDEX, sweepRunsIntentHasKind, PEER_SWITCHES_DDL, PEER_BINDINGS_DDL, SWITCH_OWED_DDL, clearSwitchOwed, markSwitchOwed, scopeOwesSwitch, switchesOwedOf, SWITCH_KINDS, SYSTEM_SWITCHES_DDL, forgetSwitchesOf, listSystemSwitchRecords, recordSwitchedOff, recordSwitchedOn, recordWriteSuperseded, restoreSwitchRecord, scopesSwitchedOffFor, switchRecordStatesOf, switchRecordsOf, switchesBackfillSqlOf, switchesDdlOf, switchesTableExists, switchesTableOf, tenantHeldOf, VERSION_MIGRATIONS_DDL, VERTICAL_SCOPE_STORES_DDL, STORE_DRIVER_RELEASES_DDL, legacyStoreDriverConflict, legacyStoreDriverRenames, beginStoreDriverRolloutIn, finishStoreDriverRolloutIn, holdStoreDriverIn, advanceStoreDriverRebuildIn, claimStoreDriverRebuildIn, storeDriverRebuildIn, driverDeclarationsOf, recordStoreDriverReleaseIn, releaseStoreDriverHoldIn, storeDriverReleaseIn, storeDriverStateIn, storeDriverRolloutPendingIn, storeDriverRolloutWalkedIn, forgetVerticalScopeStores, indexVersionScopeStores, verticalScopeStoresOf, splitVersionMigrationsBatch, versionMigrationsOf, versionsAwaitSplit, versionsAwaitDigest, deriveMigrationDigestsBatch, deriveVersionMigrationDigest, writeVersionMigrations, MODEL_USAGE_RETENTION_DAYS, DO_SQL_LIMITS, ulid, isPrimaryScopeRow, samePeerVertical, peerVerticalSpellings, resolveVerticalInstanceFrom, resolvePeerInstanceFrom, LEGACY_SCOPE_ROWS_BACKFILL, loadDirectoryDump, redactSubjectDirectoryText, ISSUE_EXEMPLAR_OWNER_BACKFILL_SQL, issueExemplarOwner, SETTLE_INTENT_SQL, SETTLE_OUTCOME_SQL, settleOutcomeParamsOf, unknownOutcomeOf, ADMIN_LOG_INDEX_DDL, ADMIN_LOG_INDEXES_SQL, readAuditedOperations, } from '@substrat-run/kernel';
+import { membershipFencesBackfillSql, MEMBERSHIP_FENCES_DDL, MEMBERSHIP_FENCES_TABLE, membershipFencesTableExists, MEMBERSHIP_FENCE_SINCE_SQL, RAISE_MEMBERSHIP_FENCE_SQL, memberAddedAudit, orgChangeBound, reservedRoleDefinitionRefusal, reservedRoleRefusal, TENANT_SEATED_ROLES_SQL, tenantCoverage, IMPERSONATION_COLUMNS, IMPERSONATION_DDL, impersonationByIdQuery, impersonationListQuery, impersonationRowValues, ISSUE_RETENTION_DAYS, telemetryRetentionStatements, FINDINGS_DDL, SCOPE_STORAGE_DDL, forgetScopeStorage, retireScopeStorage, listScopeStorageAttemptRows, listScopeStorageRows, listScopeAttachmentStorageRows, listScopeStoreStorageRows, pruneScopeStorageRows, recordScopeStorageRows, REQUEST_ROLLUP_DDL, listRequestDayRows, listRequestRollupDayRows, pruneRequestDayRows, recordRequestDayRows, METER_DAYS_DDL, VERTICAL_OWNERS_BACKFILL, VERTICAL_OWNERS_DDL, closeVerticalOwnerRow, listVerticalOwnerRows, openVerticalOwnerRow, verticalOwnerNow, listMeterDayRows, listMeterDayTakeRows, pruneMeterDayRows, recordMeterDayRows, CONNECT_LINKS_DDL, consumeConnectLinkRow, insertConnectLink as insertConnectLinkRow, listConnectLinks as listConnectLinkRows, readConnectLink as readConnectLinkRow, restoreConnectLinkRow, revokeConnectLinkRow, createFindingRule, findingOfOpsFailure, findingOfSweepRun, pruneFindings, listFindingRules, listFindings, observeFinding, revokeFindingRule, setFindingStatus, assertRowLimit, OPS_FAILURE_RETENTION_DAYS, SWEEP_RUN_RETENTION_DAYS, SWEEP_RUNS_INTENT_INDEX, sweepRunsIntentHasKind, PEER_SWITCHES_DDL, PEER_BINDINGS_DDL, SWITCH_OWED_DDL, clearSwitchOwed, markSwitchOwed, scopeOwesSwitch, switchesOwedOf, SWITCH_KINDS, SYSTEM_SWITCHES_DDL, forgetSwitchesOf, listSystemSwitchRecords, recordSwitchedOff, recordSwitchedOn, recordWriteSuperseded, restoreSwitchRecord, scopesSwitchedOffFor, switchRecordStatesOf, switchRecordsOf, switchesBackfillSqlOf, switchesDdlOf, switchesTableExists, switchesTableOf, tenantHeldOf, VERSION_MIGRATIONS_DDL, VERTICAL_SCOPE_STORES_DDL, DEPLOYMENT_WIRE_AUTH_DDL, deploymentWireAuthOf, forgetVerticalWireAuth, writeDeploymentWireAuth, STORE_DRIVER_RELEASES_DDL, legacyStoreDriverConflict, legacyStoreDriverRenames, beginStoreDriverRolloutIn, finishStoreDriverRolloutIn, holdStoreDriverIn, advanceStoreDriverRebuildIn, claimStoreDriverRebuildIn, storeDriverRebuildIn, driverDeclarationsOf, recordStoreDriverReleaseIn, releaseStoreDriverHoldIn, storeDriverReleaseIn, storeDriverStateIn, storeDriverRolloutPendingIn, storeDriverRolloutWalkedIn, forgetVerticalScopeStores, indexVersionScopeStores, verticalScopeStoresOf, splitVersionMigrationsBatch, versionMigrationsOf, versionsAwaitSplit, versionsAwaitDigest, deriveMigrationDigestsBatch, deriveVersionMigrationDigest, writeVersionMigrations, MODEL_USAGE_RETENTION_DAYS, DO_SQL_LIMITS, ulid, isPrimaryScopeRow, samePeerVertical, peerVerticalSpellings, resolveVerticalInstanceFrom, resolvePeerInstanceFrom, LEGACY_SCOPE_ROWS_BACKFILL, loadDirectoryDump, redactSubjectDirectoryText, ISSUE_EXEMPLAR_OWNER_BACKFILL_SQL, issueExemplarOwner, SETTLE_INTENT_SQL, SETTLE_OUTCOME_SQL, settleOutcomeParamsOf, unknownOutcomeOf, ADMIN_LOG_INDEX_DDL, ADMIN_LOG_INDEXES_SQL, readAuditedOperations, } from '@substrat-run/kernel';
 import { replyOf } from './do-reply.js';
 import { switchSqlOver } from './scope-do.js';
 import { blankSqlComments, boundShapesColumn, executableSqlStatements, installsReconciledOf, PROVISIONED_VERSIONS_SQL, provisionedVersionsParams, } from '@substrat-run/kernel';
 import { COPY_BACKFILL_SCOPE_SQL, COPY_BACKFILL_SQL, COPY_BACKFILL_SUPERSEDE_SQL, COPY_CLAIM_SQL, COPY_EXPIRED_SQL, COPY_MOVE_RENEW_SQL, copyMoveRenewParams, PENDING_COPY_KEEP_ALIVE_SQL, pendingCopyKeepAliveParams, copyBackfillParams, copyBackfillRefusal, SUBJECT_ERASURE_CLAIM_SQL, subjectErasureClaimParams, COPY_MOVE_CONFIRM_SQL, COPY_MOVE_LIVE_PREDICATE, SCOPE_COPY_LEASE_MS, SERVES_NOW_CONDITION, SERVES_NOW_PREDICATE, servesNowParams, SCOPE_SCRIPT_COPY_COLUMNS, copyMoveConfirmParams, copyMoveLiveParams, } from '@substrat-run/kernel';
+import { opsFailureReferenceWhere } from '@substrat-run/kernel';
 import { doBuiltColumnsOf, doRedactionSql } from './sql.js';
-import { assertReplayableDump, opsFailureFingerprint, ROUTE_SCOPE_HOSTNAMES_MAX, SCOPE_GATE_REASONS, substratError } from '@substrat-run/contracts';
+import { assertReplayableDump, instant, opsFailureFingerprint, ROUTE_SCOPE_HOSTNAMES_MAX, SCOPE_GATE_REASONS, substratError } from '@substrat-run/contracts';
 /**
  * The router's per-request directory read (`readRoute`), lifted out so its plan can be asked for
  * (#2005): the scope's hostname set is a correlated subquery on the hot path every request takes,
@@ -315,6 +316,7 @@ const DIRECTORY_DDL = `
   );
   ${VERSION_MIGRATIONS_DDL}
   ${VERTICAL_SCOPE_STORES_DDL}
+  ${DEPLOYMENT_WIRE_AUTH_DDL}
   CREATE TABLE IF NOT EXISTS vertical_channels (
     vertical_slug TEXT NOT NULL,
     channel       TEXT NOT NULL,
@@ -653,6 +655,12 @@ const DIRECTORY_DDL = `
   CREATE INDEX IF NOT EXISTS _substrat_model_usage_at ON _substrat_model_usage (at);
   -- #1524: the stored storage gauge — one row per (scope, UTC day), kernel-owned DDL.
   ${SCOPE_STORAGE_DDL}
+  -- #2501: the daily request rollup — one row per (UTC day, tenant, vertical, scope), kernel-owned DDL.
+  ${REQUEST_ROLLUP_DDL}
+  -- #2501: the daily meter snapshot — one row per (UTC day, tenant), kernel-owned DDL.
+  ${METER_DAYS_DDL}
+  -- #2501: who owned each vertical slug, period by period — kernel-owned DDL.
+  ${VERTICAL_OWNERS_DDL}
   CREATE INDEX IF NOT EXISTS scopes_tenant ON scopes (tenant_id, scope_id);
   -- #1713: the lifecycle each hosted scope's deployment last acknowledged, as
   -- "<scope status>/<tenant status>" (lifecycleReceipt). A CP-less deployment has no
@@ -1177,6 +1185,8 @@ export class ControlPlaneDO extends DurableObject {
         this.addColumn('_substrat_entitlements', 'granted_by TEXT');
         for (const stmt of LEGACY_SCOPE_ROWS_BACKFILL)
             this.sql.exec(stmt);
+        // #2501: an ownership period for every vertical registered before the history existed.
+        this.sql.exec(VERTICAL_OWNERS_BACKFILL);
         // After the backfill: a UNIQUE index over NULL slugs would permit the
         // duplicates it exists to forbid (SQLite treats NULLs as distinct).
         //
@@ -1316,8 +1326,11 @@ export class ControlPlaneDO extends DurableObject {
             .toArray()[0];
         return row ? this.mapTenant(row) : undefined;
     }
-    /** Idempotent on the id; return the new tenant, or null if it already existed. */
-    createTenant(id, slug, name, createdAt, provisionedByTenant = null) {
+    /**
+     * Idempotent on the id; return the new tenant, or null if it already existed. `audit` is the
+     * coordinator's row, written in the insert's unit with the tenant as its `after`.
+     */
+    createTenant(id, slug, name, createdAt, provisionedByTenant = null, audit) {
         if (this.readTenant(id))
             return null; // idempotent — nothing created
         // Checked explicitly rather than left to `INSERT OR IGNORE` + the
@@ -1330,12 +1343,12 @@ export class ControlPlaneDO extends DurableObject {
         if (slugOwner) {
             throw substratError('conflict', `tenant slug '${slug}' already taken by ${slugOwner.tenant_id} (slugs are unique)`);
         }
-        this.sql.exec(`INSERT INTO tenants (tenant_id, slug, name, status, created_at, provisioned_by_tenant)
-       VALUES (?, ?, ?, 'active', ?, ?)`, id, slug, name, createdAt, provisionedByTenant);
+        this.writeAndAudit(() => this.sql.exec(`INSERT INTO tenants (tenant_id, slug, name, status, created_at, provisioned_by_tenant)
+       VALUES (?, ?, ?, 'active', ?, ?)`, id, slug, name, createdAt, provisionedByTenant).rowsWritten > 0, audit && (() => ({ ...audit, after: this.readTenant(id) })));
         return this.readTenant(id) ?? null;
     }
-    /** Throw if absent; else UPDATE and return the previous status. */
-    setTenantStatus(tenantId, status) {
+    /** Throw if absent; else UPDATE and return the previous status, which `audit`'s `before` records. */
+    setTenantStatus(tenantId, status, audit) {
         const before = this.readTenant(tenantId);
         if (!before)
             throw substratError('not_found', `unknown tenant: ${tenantId}`);
@@ -1348,15 +1361,13 @@ export class ControlPlaneDO extends DurableObject {
         // Stamp/clear deleting_at so the grace-window sweep can age tenants (§4.8):
         // entering `deleting` stamps, leaving it (an un-delete) clears — the same shape
         // transitionScope uses for archived_at.
-        this.ctx.storage.transactionSync(() => {
-            if (status === 'deleting') {
-                this.sql.exec('UPDATE tenants SET status = ?, deleting_at = ? WHERE tenant_id = ?', status, new Date().toISOString(), tenantId);
-            }
-            else {
-                this.sql.exec('UPDATE tenants SET status = ?, deleting_at = NULL WHERE tenant_id = ?', status, tenantId);
-            }
+        this.writeAndAudit(() => {
+            const moved = (status === 'deleting'
+                ? this.sql.exec('UPDATE tenants SET status = ?, deleting_at = ? WHERE tenant_id = ?', status, new Date().toISOString(), tenantId)
+                : this.sql.exec('UPDATE tenants SET status = ?, deleting_at = NULL WHERE tenant_id = ?', status, tenantId)).rowsWritten > 0;
             this.bumpLifecycleRevision(`tenant:${tenantId}`); // #1713, with the change it counts
-        });
+            return moved;
+        }, audit && { ...audit, before: { status: before.status } });
         return before.status;
     }
     /**
@@ -1367,7 +1378,7 @@ export class ControlPlaneDO extends DurableObject {
      * previous status (for the audit before/after). Idempotent: set-to-empty DELETEs
      * plus the status flip converge on a re-run after a partial failure.
      */
-    reapTenant(tenantId) {
+    reapTenant(tenantId, audit) {
         const before = this.readTenant(tenantId);
         if (!before)
             throw substratError('not_found', `unknown tenant: ${tenantId}`);
@@ -1376,40 +1387,47 @@ export class ControlPlaneDO extends DurableObject {
         }
         // KEPT as the tombstone: the `tenants` row itself and `_substrat_admin_log` (the
         // compliance witness — never swept). Scope rows were already reaped individually.
-        for (const table of [
-            '_substrat_identities', // PII: external subjects/emails bound to principals
-            '_substrat_identity_pools', // the tenant's IdP topology declarations
-            '_substrat_tenant_tuples', // membership + tenant-level grants
-            '_substrat_roles', // operator-defined roles
-            '_substrat_entitlements', // per-tenant SKU flags
-            'orgs', // K-22 org records
-            '_substrat_system_switches', // #1674: the schedule switch's record, per scope
-            '_substrat_membership_fences', // #1184: the latest removal, per principal
-            '_substrat_peer_switches', // #2029: the peer switch's record, per scope
-            'peer_bindings', // #1720: a tenant's explicit caller-to-target choices
-            '_substrat_switch_owed', // #2045: subjects owed a re-assert, per scope
-            '_substrat_findings', // #1748: the tenant's findings
-            '_substrat_finding_rules', // #1748: the tenant's suppress rules
-            '_substrat_scope_storage', // #1524: storage samples of scopes whose storage is gone
-            '_substrat_scope_storage_attempts', // #1524: and the phase's last try at each
-            '_substrat_scope_store_storage', // #2212: scope-store samples, gone with the tenant
-        ]) {
-            this.sql.exec(`DELETE FROM ${table} WHERE tenant_id = ?`, tenantId);
-        }
-        this.ctx.storage.transactionSync(() => {
-            this.sql.exec("UPDATE tenants SET status = 'reaped', deleting_at = NULL WHERE tenant_id = ?", tenantId);
+        // One unit with the flip and `audit`, whose `before` is the status read here.
+        this.writeAndAudit(() => {
+            for (const table of [
+                '_substrat_identities', // PII: external subjects/emails bound to principals
+                '_substrat_identity_pools', // the tenant's IdP topology declarations
+                '_substrat_tenant_tuples', // membership + tenant-level grants
+                '_substrat_roles', // operator-defined roles
+                '_substrat_entitlements', // per-tenant SKU flags
+                'orgs', // K-22 org records
+                '_substrat_system_switches', // #1674: the schedule switch's record, per scope
+                '_substrat_membership_fences', // #1184: the latest removal, per principal
+                '_substrat_peer_switches', // #2029: the peer switch's record, per scope
+                'peer_bindings', // #1720: a tenant's explicit caller-to-target choices
+                '_substrat_switch_owed', // #2045: subjects owed a re-assert, per scope
+                '_substrat_findings', // #1748: the tenant's findings
+                '_substrat_finding_rules', // #1748: the tenant's suppress rules
+                '_substrat_scope_storage', // #1524: storage samples of scopes whose storage is gone
+                '_substrat_scope_storage_attempts', // #1524: and the phase's last try at each
+                '_substrat_scope_store_storage', // #2212: scope-store samples, gone with the tenant
+                '_substrat_scope_attachment_storage', // #2501: attachment samples, gone with the tenant
+            ]) {
+                this.sql.exec(`DELETE FROM ${table} WHERE tenant_id = ?`, tenantId);
+            }
+            const reaped = this.sql.exec("UPDATE tenants SET status = 'reaped', deleting_at = NULL WHERE tenant_id = ?", tenantId).rowsWritten > 0;
             // Its scopes were reaped one by one, each forgetting its own; any left over go here.
             this.forgetLifecycleDeliveries('scope_id IN (SELECT scope_id FROM scopes WHERE tenant_id = ?)', tenantId);
             this.bumpLifecycleRevision(`tenant:${tenantId}`); // #1713
-        });
+            return reaped;
+        }, audit && { ...audit, before: { status: before.status } });
         return before.status;
     }
-    /** Rename the DISPLAY name (never the slug); throw if absent; return the previous name. */
-    setTenantName(tenantId, name) {
+    /**
+     * Rename the DISPLAY name (never the slug); throw if absent; return the previous name. A rename
+     * to the name it already has writes nothing, `audit` included; otherwise `audit`'s `before` is
+     * the name read here.
+     */
+    setTenantName(tenantId, name, audit) {
         const before = this.readTenant(tenantId);
         if (!before)
             throw substratError('not_found', `unknown tenant: ${tenantId}`);
-        this.sql.exec('UPDATE tenants SET name = ? WHERE tenant_id = ?', name, tenantId);
+        this.writeAndAudit(() => before.name !== name && this.sql.exec('UPDATE tenants SET name = ? WHERE tenant_id = ?', name, tenantId).rowsWritten > 0, audit && { ...audit, before: { name: before.name } });
         return before.name;
     }
     getTenant(tenantId) {
@@ -1805,20 +1823,53 @@ export class ControlPlaneDO extends DurableObject {
             if (to === 'reaped') {
                 forgetSwitchesOf(this.kernelSql, scopeId);
                 this.forgetLifecycleDeliveries('scope_id = ?', scopeId);
-                // #1524: its storage is gone, so its samples describe nothing.
-                forgetScopeStorage(doRedactionSql(this.sql), scopeId);
+                // #2515: its storage is gone, and its measured days are kept for the invoice (retention ends them).
+                retireScopeStorage(doRedactionSql(this.sql), scopeId);
             }
             this.bumpLifecycleRevision(`scope:${scopeId}`); // #1713, with the status it counts
         });
         return { ok: true, status: row.status, vertical: row.vertical };
     }
     // -- roles (checker rule 1) -------------------------------------------------
-    /** INSERT OR REPLACE; return the previous role (for the audit `before`) or null. */
+    /**
+     * Kept for a coordinator from before #2447, which calls it and reads the previous role (for the
+     * audit `before`) or null. The definition is judged as `defineRoleOrRefusal` judges it, and a
+     * refusal is THROWN, so such a coordinator cannot read it as the previous role and audit a change
+     * that never happened.
+     */
     defineRole(tenantId, role) {
+        const outcome = this.defineRoleOrRefusal(tenantId, role);
+        if ('refused' in outcome)
+            throw new Error(outcome.refused);
+        return outcome.before;
+    }
+    /**
+     * INSERT OR REPLACE; answer the previous role (for the audit `before`) or null. Judged first, in
+     * the same unit (#2447, `reservedRoleDefinitionRefusal`): against `reservation`, what the
+     * coordinator's modules reserve and declare, and the tenant's roles as stored now, so no
+     * concurrent definition lands between the read and the write. Whether the key is seated decides a
+     * system-held definition of a key with no system-held definition stored (none at all included): its tenant-level seats are read here, in the unit, and
+     * `seatedInScopes` carries what the coordinator read off the tenant's scopes. A refusal is answered
+     * as data, so its text survives the hop, and writes nothing. The current coordinator calls this one
+     * (the same split as `transitionScope` and `transitionScopeOrRefusal`).
+     */
+    defineRoleOrRefusal(tenantId, role, reservation = { reserved: [], declared: [] }, seatedInScopes = false) {
+        const tenantRoles = this.listRoles({ tenantId }).map((r) => ({
+            key: r.role_key,
+            permissions: JSON.parse(r.permissions),
+            holder: r.holder ?? undefined,
+        }));
+        const stored = tenantRoles.find((r) => r.key === role.key);
+        const seated = stored?.holder !== 'system' && role.holder === 'system' &&
+            (seatedInScopes ||
+                this.sql.exec(TENANT_SEATED_ROLES_SQL, tenantId, new Date().toISOString()).toArray().some((r) => r.role_key === role.key));
+        const refused = reservedRoleDefinitionRefusal(role, { reserved: new Set(reservation.reserved), declared: new Set(reservation.declared) }, tenantRoles, seated);
+        if (refused)
+            return { refused };
         const before = this.getRole(tenantId, role.key) ?? null;
         this.sql.exec(`INSERT OR REPLACE INTO _substrat_roles (tenant_id, role_key, permissions, source, holder)
        VALUES (?, ?, ?, ?, ?)`, tenantId, role.key, JSON.stringify(role.permissions), String(role.source), role.holder ?? 'person');
-        return before;
+        return { before };
     }
     /** Raw rows; the coordinator parses them through the `tenantRole` contract. */
     listRoles(filter) {
@@ -2149,8 +2200,14 @@ export class ControlPlaneDO extends DurableObject {
             .exec('SELECT * FROM verticals WHERE slug = ?', slug)
             .toArray()[0];
     }
-    insertVertical(slug, name, source, ownerTenant, envSpec, installSpec, listed, createdAt) {
-        this.sql.exec('INSERT INTO verticals (slug, name, source, owner_tenant, env_spec, install_spec, listed, created_at) VALUES (?, ?, ?, ?, ?, ?, ?, ?)', slug, name, source, ownerTenant, envSpec, installSpec, listed, createdAt);
+    insertVertical(slug, name, source, ownerTenant, envSpec, installSpec, listed, createdAt, audit) {
+        // #2501: the slug's ownership period opens with its row, in the same transaction.
+        this.writeAndAudit(() => {
+            const changed = this.sql.exec('INSERT INTO verticals (slug, name, source, owner_tenant, env_spec, install_spec, listed, created_at) VALUES (?, ?, ?, ?, ?, ?, ?, ?)', slug, name, source, ownerTenant, envSpec, installSpec, listed, createdAt).rowsWritten > 0;
+            if (changed)
+                openVerticalOwnerRow(doRedactionSql(this.sql), slug, ownerTenant, createdAt);
+            return changed;
+        }, audit);
     }
     /** Refresh a vertical's declared env-spec + install-spec (both evolve with the manifest).
      *  `listed` rides along ONLY for builtin re-seeds (null ⇒ leave it alone): a pushed
@@ -2162,24 +2219,29 @@ export class ControlPlaneDO extends DurableObject {
         }
     }
     /** Publish/unpublish a vertical to the public marketplace + resolve any pending request. */
-    updateVerticalListed(slug, listed) {
-        this.sql.exec('UPDATE verticals SET listed = ?, publish_requested_at = NULL WHERE slug = ?', listed, slug);
+    updateVerticalListed(slug, listed, audit) {
+        this.writeAndAudit(() => this.sql.exec('UPDATE verticals SET listed = ?, publish_requested_at = NULL WHERE slug = ?', listed, slug)
+            .rowsWritten > 0, audit);
     }
     /** Record a builder's pending publish request (marketplace-publish.md §5). */
-    updateVerticalPublishRequest(slug, requestedAt) {
-        this.sql.exec('UPDATE verticals SET publish_requested_at = ? WHERE slug = ?', requestedAt, slug);
+    updateVerticalPublishRequest(slug, requestedAt, audit) {
+        this.writeAndAudit(() => this.sql.exec('UPDATE verticals SET publish_requested_at = ? WHERE slug = ?', requestedAt, slug)
+            .rowsWritten > 0, audit);
     }
     /** Block/unblock new installs of a vertical (staff kill-switch). */
-    updateVerticalInstallsBlocked(slug, blocked) {
-        this.sql.exec('UPDATE verticals SET installs_blocked = ? WHERE slug = ?', blocked, slug);
+    updateVerticalInstallsBlocked(slug, blocked, audit) {
+        this.writeAndAudit(() => this.sql.exec('UPDATE verticals SET installs_blocked = ? WHERE slug = ?', blocked, slug)
+            .rowsWritten > 0, audit);
     }
     /** Grant/revoke the tenant-provisioner capability (#412, staff grant). */
-    updateVerticalTenantProvisioner(slug, granted) {
-        this.sql.exec('UPDATE verticals SET tenant_provisioner = ? WHERE slug = ?', granted, slug);
+    updateVerticalTenantProvisioner(slug, granted, audit) {
+        this.writeAndAudit(() => this.sql.exec('UPDATE verticals SET tenant_provisioner = ? WHERE slug = ?', granted, slug)
+            .rowsWritten > 0, audit);
     }
     /** Grant/revoke the email-sender capability (#303, staff grant). */
-    updateVerticalEmailSender(slug, granted) {
-        this.sql.exec('UPDATE verticals SET email_sender = ? WHERE slug = ?', granted, slug);
+    updateVerticalEmailSender(slug, granted, audit) {
+        this.writeAndAudit(() => this.sql.exec('UPDATE verticals SET email_sender = ? WHERE slug = ?', granted, slug)
+            .rowsWritten > 0, audit);
     }
     /**
      * How many scopes a vertical still backs, split by liveness — deleteVertical's refusal
@@ -2201,14 +2263,29 @@ export class ControlPlaneDO extends DurableObject {
      * Remove a vertical's registry presence: channels, versions, the row. The bound-scope
      * refusal lives host-side (the audited seam), not here — this is the storage verb.
      */
-    deleteVertical(slug) {
-        this.sql.exec('DELETE FROM vertical_channels WHERE vertical_slug = ?', slug);
-        this.sql.exec('DELETE FROM vertical_channel_history WHERE vertical_slug = ?', slug);
-        this.sql.exec(`DELETE FROM vertical_version_migrations
-        WHERE version_id IN (SELECT id FROM vertical_versions WHERE vertical_slug = ?)`, slug);
-        forgetVerticalScopeStores(this.kernelSql, slug);
-        this.sql.exec('DELETE FROM vertical_versions WHERE vertical_slug = ?', slug);
-        this.sql.exec('DELETE FROM verticals WHERE slug = ?', slug);
+    deleteVertical(slug, audit, until) {
+        // #2501: one transaction, so the row and its ownership period close together. `until` is the
+        // host's stamp, on the clock the period's `since` (the row's created_at) was read on. It is
+        // optional and trailing so a caller from before it, sending (slug, audit), still closes the
+        // period, on this DO's own reading of that clock; anything but an instant is refused.
+        const closedAt = until === undefined ? verticalOwnerNow() : instant.parse(until);
+        this.writeAndAudit(() => {
+            this.sql.exec('DELETE FROM vertical_channels WHERE vertical_slug = ?', slug);
+            this.sql.exec('DELETE FROM vertical_channel_history WHERE vertical_slug = ?', slug);
+            this.sql.exec(`DELETE FROM vertical_version_migrations
+          WHERE version_id IN (SELECT id FROM vertical_versions WHERE vertical_slug = ?)`, slug);
+            forgetVerticalScopeStores(this.kernelSql, slug);
+            forgetVerticalWireAuth(this.kernelSql, slug);
+            this.sql.exec('DELETE FROM vertical_versions WHERE vertical_slug = ?', slug);
+            const changed = this.sql.exec('DELETE FROM verticals WHERE slug = ?', slug).rowsWritten > 0;
+            if (changed)
+                closeVerticalOwnerRow(doRedactionSql(this.sql), slug, closedAt);
+            return changed;
+        }, audit);
+    }
+    /** #2501: every period of a slug's ownership, oldest first — kernel `vertical-owners.ts`. */
+    listVerticalOwners(slug) {
+        return listVerticalOwnerRows(doRedactionSql(this.sql), slug);
     }
     listVerticals(page) {
         const where = [];
@@ -2234,8 +2311,8 @@ export class ControlPlaneDO extends DurableObject {
      * the SQL already split off (`splitManifestMigrations`); `migrations` is null for a version
      * that carries none to show.
      */
-    insertVersion(v) {
-        this.ctx.storage.transactionSync(() => {
+    insertVersion(v, audit) {
+        this.writeAndAudit(() => {
             this.sql.exec(`INSERT INTO vertical_versions
            (id, vertical_slug, version, manifest_digest, permission_digest,
             migration_digest, deployment_ref, admission, admission_note, manifest_json,
@@ -2244,7 +2321,8 @@ export class ControlPlaneDO extends DurableObject {
             writeVersionMigrations(this.kernelSql, v.id, v.migrations);
             // #2286: the version's scope-store bindings, refusing one moved to another driver, in the insert's transaction.
             indexVersionScopeStores(this.kernelSql, v.verticalSlug, v.id, v.manifestJson);
-        });
+            return true;
+        }, audit);
     }
     /** Every scope-store binding any version of the vertical declared (#2286); indexes versions not indexed yet. */
     verticalScopeStores(slug) {
@@ -2256,9 +2334,25 @@ export class ControlPlaneDO extends DurableObject {
     }
     /** Record what the serving script now runs — written only after a successful
      *  in-place upload, so a failed serve leaves the trailing state visible. */
-    setVerticalServing(slug, s) {
-        this.sql.exec(`UPDATE verticals SET serving_ref = ?, serving_version_id = ?,
-              serving_do_classes = ?, serving_migration_tag = ? WHERE slug = ?`, s.ref, s.versionId, s.doClassesJson, s.migrationTag, slug);
+    setVerticalServing(slug, s, audit) {
+        this.writeAndAudit(() => this.sql.exec(`UPDATE verticals SET serving_ref = ?, serving_version_id = ?,
+              serving_do_classes = ?, serving_migration_tag = ? WHERE slug = ?`, s.ref, s.versionId, s.doClassesJson, s.migrationTag, slug).rowsWritten > 0, audit);
+    }
+    /** One upload's capability record (RFC wire-signing §7, Q8), replacing the script's earlier one. */
+    recordWireAuth(row, audit) {
+        this.writeAndAudit(() => {
+            writeDeploymentWireAuth(this.kernelSql, row);
+            return true;
+        }, audit);
+    }
+    /**
+     * One page of the stored capability records the filter's reach confines it to (one tenant's
+     * verticals, or the fleet), by script name. The host judged the filter before the call; it is judged
+     * again here (`deploymentWireAuthOf`), so no caller of the object reaches the table unconfined or
+     * unbounded.
+     */
+    listWireAuth(filter) {
+        return deploymentWireAuthOf(this.kernelSql, filter);
     }
     /** Point a scope's routing at the serving script its data now lives in (#286). False when a
      *  conditional move lost its compare-and-set: the host throws, since a refusal thrown here
@@ -2297,8 +2391,8 @@ export class ControlPlaneDO extends DurableObject {
             await deriveVersionMigrationDigest(this.kernelSql, r.id);
         return read();
     }
-    setAdmission(id, admission, note) {
-        this.sql.exec('UPDATE vertical_versions SET admission = ?, admission_note = ? WHERE id = ?', admission, note, id);
+    setAdmission(id, admission, note, audit) {
+        this.writeAndAudit(() => this.sql.exec('UPDATE vertical_versions SET admission = ?, admission_note = ? WHERE id = ?', admission, note, id).rowsWritten > 0, audit);
     }
     /**
      * False when a conditional bind lost its compare-and-set (the host throws, as above). #2347:
@@ -2338,12 +2432,15 @@ export class ControlPlaneDO extends DurableObject {
             return true;
         }, audit);
     }
-    /** The directory effect and its admin row either both commit or both roll back. */
+    /**
+     * The directory effect and its admin row either both commit or both roll back. A thunk is
+     * read after the write, in the same unit, for a row that carries what only the write knows.
+     */
     writeAndAudit(write, audit) {
         return this.ctx.storage.transactionSync(() => {
             const changed = write();
             if (changed && audit)
-                this.recordAdmin(audit);
+                this.recordAdmin(typeof audit === 'function' ? audit() : audit);
             return changed;
         });
     }
@@ -2521,10 +2618,10 @@ export class ControlPlaneDO extends DurableObject {
      * #2333: move a channel's pointer, and record the move, only if it still names `from` (null: the
      * channel has none yet). A compare-and-set in one synchronous transaction, so no other promote
      * runs between the read and the write: a promote judged its gates against `from` across awaits,
-     * and the one that lost the race is told so (`false`) and writes nothing.
+     * and the one that lost the race is told so (`false`) and writes nothing, `audit` included.
      */
-    moveChannel(from, history) {
-        return this.ctx.storage.transactionSync(() => {
+    moveChannel(from, history, audit) {
+        return this.writeAndAudit(() => {
             const now = this.readChannel(history.vertical_slug, history.channel);
             if ((now?.version_id ?? null) !== from)
                 return false;
@@ -2533,7 +2630,7 @@ export class ControlPlaneDO extends DurableObject {
          ON CONFLICT (vertical_slug, channel) DO UPDATE SET version_id = ?, updated_at = ?`, history.vertical_slug, history.channel, history.version_id, history.at, history.version_id, history.at);
             this.insertChannelHistory(history);
             return true;
-        });
+        }, audit);
     }
     listChannels(verticalSlug, page) {
         const where = ['vertical_slug = ?'];
@@ -2819,6 +2916,7 @@ export class ControlPlaneDO extends DurableObject {
             storage: listScopeStorageRows(doRedactionSql(this.sql), { tenantId: tenantId, latest: true }),
             storageAttempts: listScopeStorageAttemptRows(doRedactionSql(this.sql), tenantId),
             storeStorage: listScopeStoreStorageRows(doRedactionSql(this.sql), tenantId),
+            attachmentStorage: listScopeAttachmentStorageRows(doRedactionSql(this.sql), tenantId),
         };
     }
     // -- the stored storage gauge (#1524) — kernel `storage-gauge.ts` --------------
@@ -2834,6 +2932,33 @@ export class ControlPlaneDO extends DurableObject {
     pruneScopeStorage(limit) {
         return pruneScopeStorageRows(doRedactionSql(this.sql), Date.now(), limit);
     }
+    // -- the daily request rollup (#2501) — kernel `request-rollup.ts` -------------
+    recordRequestDay(input) {
+        return { recorded: this.ctx.storage.transactionSync(() => recordRequestDayRows(doRedactionSql(this.sql), input)) };
+    }
+    listRequestDays(filter) {
+        return listRequestDayRows(doRedactionSql(this.sql), filter);
+    }
+    listRequestRollupDays(filter) {
+        return listRequestRollupDayRows(doRedactionSql(this.sql), filter);
+    }
+    pruneRequestDays(limit, retentionMonths) {
+        return this.ctx.storage.transactionSync(() => pruneRequestDayRows(doRedactionSql(this.sql), Date.now(), limit, retentionMonths));
+    }
+    // -- the daily meter snapshot (#2501) — kernel `meter-days.ts` -------------------
+    // One transaction: the snapshot's reads and its rows are one instant of the directory.
+    recordMeterDay(input) {
+        return this.ctx.storage.transactionSync(() => recordMeterDayRows(doRedactionSql(this.sql), input));
+    }
+    listMeterDays(filter) {
+        return listMeterDayRows(doRedactionSql(this.sql), filter);
+    }
+    listMeterDayTakes(filter) {
+        return listMeterDayTakeRows(doRedactionSql(this.sql), filter);
+    }
+    pruneMeterDays(limit, retentionMonths) {
+        return this.ctx.storage.transactionSync(() => pruneMeterDayRows(doRedactionSql(this.sql), Date.now(), limit, retentionMonths));
+    }
     // -- identity pools (K-23) --------------------------------------------------
     readPool(provider) {
         return this.sql
@@ -3607,9 +3732,15 @@ export class ControlPlaneDO extends DurableObject {
     }
     /** The body of `recordOpsFailure`, for a caller already inside a transaction. */
     insertOpsFailure(row) {
-        this.sql.exec(`INSERT INTO _substrat_ops_failures
-         (id, actor, operation, stage, tenant_id, scope_id, vertical, version, status, message, reference, origin, code, fingerprint, at)
-       VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`, row.id, row.actor, row.operation, row.stage, row.tenant_id, row.scope_id, row.vertical, row.version, row.status, row.message, row.reference, row.origin, row.code, row.fingerprint, row.at);
+        // #2540: a tenant's row with a `detail` is a pair — the tenant's row says what was answered, and
+        // a row with no tenant, which only staff read, carries the failure's own text. Counted once.
+        const detail = row.tenant_id && row.detail_id && typeof row.detail === 'string' ? row.detail.slice(0, 2000) : null;
+        const insert = (id, tenantId, message) => this.sql.exec(`INSERT INTO _substrat_ops_failures
+           (id, actor, operation, stage, tenant_id, scope_id, vertical, version, status, message, reference, origin, code, fingerprint, at)
+         VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`, id, row.actor, row.operation, row.stage, tenantId, row.scope_id, row.vertical, row.version, row.status, message, row.reference, row.origin, row.code, row.fingerprint, row.at);
+        if (detail !== null)
+            insert(row.detail_id, null, detail);
+        insert(row.id, row.tenant_id, row.message);
         // Prune-on-write (#559): the retention lives HERE, not in a cron — every insert
         // pays for its own housekeeping, so the table stays bounded even on a deployment
         // whose scheduled pass is broken (the exact circumstance this table records).
@@ -3632,7 +3763,11 @@ export class ControlPlaneDO extends DurableObject {
            last_vertical = COALESCE(excluded.last_vertical, last_vertical),
            last_version = COALESCE(excluded.last_version, last_version),
            origin = COALESCE(excluded.origin, origin),
-           status = CASE WHEN status = 'resolved' THEN 'regressed' ELSE status END`, row.fingerprint, row.operation, row.stage, row.origin, row.code, row.at, row.at, row.message, row.tenant_id, issueExemplarOwner(row.tenant_id), row.vertical, row.version);
+           status = CASE WHEN status = 'resolved' THEN 'regressed' ELSE status END`, row.fingerprint, row.operation, row.stage, row.origin, row.code, row.at, row.at, 
+            // The issues are staff's (#2540): a pair's exemplar is its own text, not the tenant's
+            // sentence, and it is owned as the row it is copied from is, the platform's — so erasure
+            // reaches it on an id match, as it reaches that row.
+            detail ?? row.message, detail !== null ? null : row.tenant_id, issueExemplarOwner(detail !== null ? null : row.tenant_id), row.vertical, row.version);
             const issueHorizon = new Date(Date.now() - ISSUE_RETENTION_DAYS * 86_400_000).toISOString();
             this.sql.exec('DELETE FROM _substrat_issues WHERE last_seen < ?', issueHorizon);
             // #1748: the tenant's Recurring finding, over the tenant's own occurrences only.
@@ -3688,8 +3823,9 @@ export class ControlPlaneDO extends DurableObject {
             params.push(query.fingerprint);
         }
         if (query.reference) {
-            where.push('reference = ?');
-            params.push(query.reference);
+            const byReference = opsFailureReferenceWhere(query.reference, query.referenceInText === true);
+            where.push(byReference.sql);
+            params.push(...byReference.params);
         }
         if (query.since) {
             where.push('at >= ?');