@substrat-run/adapter-cloudflare 0.159.0 → 0.160.0

package/dist/host.js

@@ -1,16 +1,16 @@
 import { env as ambientEnv } from 'cloudflare:workers';
 import { isRewindRefusal, REWIND_REFUSED } from './rewind-refusal.js';
 import { isSystemDoorMoved, SYSTEM_DOOR_MOVED, SYSTEM_DOOR_REGATES } from './system-door.js';
-import { delegatedReadParams, operationSeriesCount, fromWireFailure, isSubstratError, exportReadInput, exportedBatch, importBatch, importResult, importState, importsOfManifestJson, connectionLandingsOfManifestJson, exportsOfManifestJson, assertNoBindingShapeBreak, importCursorMove, importCursorMoveAt, importCursorMoved, accessLogEntry, adminLogEntry, opsFailureEntry, opsFailureFingerprint, issueEntry, findingEntry, findingRuleEntry, sweepRunEntry, FRESHNESS_HEARTBEAT_MINUTES, sweepRunsPayload, modelUsageEntry, attachmentRecord, createTenantInput, identityLink, identityPool, createOrgInput, promotionAcknowledgement, bindAcknowledgement, bindHostnameInput, channelHistoryEntry, hostnameBinding, publishVersionInput, AUTO_ADMISSION_NOTE, registerVerticalInput, vertical as verticalSchema, verticalServingState, verticalChannel, verticalVersion, connection, capabilityExchange, mintedCapability, boundedBecomeMint, boundedBecomeRevoke, boundedUnbind, entityRef, becomeLinkState, principalBecomeCapabilityInput, capabilityGrant, principalId, connectionGrant, connectionGrantRecord, connectionSecret, systemGrant, systemSwitch, systemSwitchOutcome, systemScheduleEntry, systemSwitchRecord, entitlementGrant, entitlementGrantInput, capabilityFilter, instant, meterReading, scopeStorageSample, subjectRef, createConnectionInput, connectLinkFilter, connectLinkKey, consumeConnectLinkInput, mintConnectLinkInput, projectedConnectionGrant, projectedConnectionKey, moduleManifest, org as orgSchema, orgMembership, resolvedIdentity, identityMembership, roleDefinition, scope as scopeSchema, tenant as tenantSchema, tenantRole, delegatedReadRecord, ownerTransferAudit, memberChangeAudit, peerBindingAudit, connectionBindingAudit, copyMarkAudit, orphanSweepAudit, subjectShredReceipt, connectorDispatchKind, callsOfManifestJson, outboundOfManifestJson, SCOPE_GATE_REASONS, substratError, redrainEventsInput, coverage, peerCoverage, peerGrantsEntry, peerSwitch, peerSwitchOutcome, verticalCaller, verticalResolution, peerInstanceResolution, peerBinding as peerBindingSchema, verticalSlug, entityObjectRef, ATTACHMENT_BLOB_BINDING, blobStoreBindingName, lifecycleDelivery, scopeLifecycle, } from '@substrat-run/contracts';
+import { delegatedReadParams, operationSeriesCount, fromWireFailure, isSubstratError, exportReadInput, exportedBatch, importBatch, importResult, importState, importsOfManifestJson, connectionLandingsOfManifestJson, exportsOfManifestJson, assertNoBindingShapeBreak, importCursorMove, importCursorMoveAt, importCursorMoved, accessLogEntry, adminLogEntry, opsFailureEntry, opsFailureFingerprint, issueEntry, findingEntry, findingRuleEntry, sweepRunEntry, FRESHNESS_HEARTBEAT_MINUTES, sweepRunsPayload, modelUsageEntry, createTenantInput, identityLink, identityPool, createOrgInput, promotionAcknowledgement, bindAcknowledgement, bindHostnameInput, channelHistoryEntry, hostnameBinding, publishVersionInput, AUTO_ADMISSION_NOTE, registerVerticalInput, vertical as verticalSchema, verticalServingState, deploymentWireAuth, verticalChannel, verticalVersion, connection, capabilityExchange, mintedCapability, boundedBecomeMint, boundedBecomeRevoke, boundedUnbind, entityRef, becomeLinkState, principalBecomeCapabilityInput, capabilityGrant, principalId, connectionGrant, connectionGrantRecord, connectionSecret, systemGrant, systemSwitch, systemSwitchOutcome, systemScheduleEntry, systemSwitchRecord, entitlementGrant, entitlementGrantInput, capabilityFilter, instant, meterReading, scopeStorageSample, requestDay, requestRollupDay, meterDay, meterDayTake, verticalOwnerPeriod, subjectRef, createConnectionInput, connectLinkFilter, connectLinkKey, consumeConnectLinkInput, mintConnectLinkInput, projectedConnectionGrant, projectedConnectionKey, moduleManifest, org as orgSchema, orgMembership, resolvedIdentity, identityMembership, roleDefinition, scope as scopeSchema, tenant as tenantSchema, tenantRole, delegatedReadRecord, ownerTransferAudit, memberChangeAudit, peerBindingAudit, connectionBindingAudit, copyMarkAudit, orphanSweepAudit, subjectShredReceipt, connectorDispatchKind, callsOfManifestJson, outboundOfManifestJson, SCOPE_GATE_REASONS, substratError, redrainEventsInput, coverage, peerCoverage, peerGrantsEntry, peerSwitch, peerSwitchOutcome, verticalCaller, verticalResolution, peerInstanceResolution, peerBinding as peerBindingSchema, verticalSlug, entityObjectRef, ATTACHMENT_BLOB_BINDING, blobStoreBindingName, lifecycleDelivery, scopeLifecycle, } from '@substrat-run/contracts';
 import { normalizeHostname, toRouteTarget } from './route-resolver.js';
-import { attachmentBlobKey, normalizeUploadMediaType, redeemOrReplayUploadLink, attachmentSha256, entitlementDenial, requiredEntitlementFor, foldMeterReading, parseValidationRecords, resolveScopeRecord, ulid, KEPT_COPY_REFUSAL, capabilityTokenHash, checkBecomeInput, assertBecomeLinkStateIds, plausibleSessionToken, foldModelUsage, backoffAt, resolveRetryPolicy, executorOutcomeOf, isDeliveryRefusal, refusalJournalText, isSecretBoxConfigured, unconfiguredSecretBox, createSubjectKeys, generateSealingKeyPair, openSealed, ImpersonationRefused, assertSessionUsable, impersonationRowValues, mapImpersonationRow, newImpersonationSession, jobRunOf, assertLeaseMs, runDueJobRuns, SYSTEM_DOOR_WAIT, startJobRun, attachmentTextJob, assertAttachmentExtractors, resolveAttachmentTextBounds, assertJobRegistrable, ATTACHMENT_TEXT_BACKFILL_JOB, ATTACHMENT_TEXT_JOB, kernelJobFor, attachmentTextBackfillJob, searchLimit, searchMatchExpression, globalFetch, assertRedrainWindow, platformRequestOf, undrainedEventsOf, inUnitMovesToAudit, staleCarryRevertRow, staleCarryReverts, recordedOffFromWire, peerSubjectRef, SWITCH_KINDS, reassertActionOf, reassertEntry, reassertOffRow, reassertOnRow, switchActionOf, switchAuditSubject, recordAuditOutcome, auditedCapabilityRevoke, auditWarningOf, switchNotFoundMessage, recordWriteSuperseded, switchSubjectOf, switchSupersededMessage, withRecorded, systemSwitchedOffMessage, tenantSystemSwitchedOffMessage, CrossVerticalRegistry, importCursorSourceOf, exportBreaksOf, exportBreakRefusal, assertPromoteReviewCurrent, promoteRaceRefusal, rebindRaceRefusal, bindExportBreaksOf, bindExportBreakRefusal, scopeMoveOf, runningVersionOf, strandJudgmentsOf, boundShapesOfColumn, installReconciled, collectPeers, peerCallerAt, peerSeats, connectorCallRecord, noopConnectorCallRecorder, recordConnectorCall, settleConnectionUse, splitManifestMigrations, publishedMigrationDigest, migrationChangeRefusal, unknownRoleError, assertRowLimit, assertRowOffset, emptyImportResult, INERT_SCOPE_REASON, lifecycleReceipt, lifecycleRefusal, isPrimaryScope, isPrimaryScopeRow, asyncInvocationId, asyncLinePass, assertNoCallerPurge, purgeReportOf, purgeStillDue, assertBoundOperations, registerTrashTargets, assertModuleDeclared, noteReservedKeys, reservedGrantRefusal, reservedRoleRefusal, reservedShapeRefusal, memberAddedAudit, shapeTopUpBatch, } from '@substrat-run/kernel';
+import { attachmentBlobKey, normalizeUploadMediaType, redeemOrReplayUploadLink, attachmentSha256, isSizedByteStream, putAttachmentBytes, entitlementDenial, requiredEntitlementFor, foldMeterReading, parseValidationRecords, readableScopes, resolveScopeRecord, ulid, withheldOpsFailure, KEPT_COPY_REFUSAL, capabilityTokenHash, checkBecomeInput, assertBecomeLinkStateIds, plausibleSessionToken, foldModelUsage, backoffAt, resolveRetryPolicy, executorOutcomeOf, isDeliveryRefusal, refusalJournalText, isSecretBoxConfigured, unconfiguredSecretBox, createSubjectKeys, generateSealingKeyPair, openSealed, ImpersonationRefused, assertSessionUsable, impersonationRowValues, mapImpersonationRow, newImpersonationSession, jobRunOf, assertLeaseMs, runDueJobRuns, SYSTEM_DOOR_WAIT, startJobRun, attachmentTextJob, assertAttachmentExtractors, resolveAttachmentTextBounds, assertJobRegistrable, ATTACHMENT_TEXT_BACKFILL_JOB, ATTACHMENT_TEXT_JOB, kernelJobFor, attachmentTextBackfillJob, searchLimit, searchMatchExpression, globalFetch, fetchLikeOf, deadlineFetch, assertRedrainWindow, platformRequestOf, undrainedEventsOf, inUnitMovesToAudit, staleCarryRevertRow, staleCarryReverts, recordedOffFromWire, peerSubjectRef, SWITCH_KINDS, reassertActionOf, reassertEntry, reassertOffRow, reassertOnRow, switchActionOf, switchAuditSubject, recordAuditOutcome, auditedCapabilityRevoke, auditWarningOf, switchNotFoundMessage, recordWriteSuperseded, switchSubjectOf, switchSupersededMessage, withRecorded, systemSwitchedOffMessage, tenantSystemSwitchedOffMessage, CrossVerticalRegistry, importCursorSourceOf, exportBreaksOf, exportBreakRefusal, assertPromoteReviewCurrent, promoteRaceRefusal, rebindRaceRefusal, bindExportBreaksOf, bindExportBreakRefusal, scopeMoveOf, runningVersionOf, strandJudgmentsOf, boundShapesOfColumn, installReconciled, collectPeers, peerCallerAt, peerSeats, connectorCallRecord, noopConnectorCallRecorder, recordConnectorCall, settleConnectionUse, splitManifestMigrations, publishedMigrationDigest, migrationChangeRefusal, unknownRoleError, assertRowLimit, assertRowOffset, emptyImportResult, INERT_SCOPE_REASON, lifecycleReceipt, lifecycleRefusal, scopeNotHeldRefusal, isPrimaryScope, isPrimaryScopeRow, asyncInvocationId, asyncLinePass, assertNoCallerPurge, purgeReportOf, purgeStillDue, assertBoundOperations, registerTrashTargets, assertModuleDeclared, noteDeclaredKeys, noteReservedKeys, reservedGrantRefusal, reservedRoleRefusal, reservedRoleSetRefusal, reservedShapeRefusal, SEAT_HOLDING_SCOPE_STATUSES, dumpRoleState, memberAddedAudit, shapeTopUpBatch, verticalOwnerNow, } from '@substrat-run/kernel';
 import { fenceAttachmentSweep, missingAttachmentStore, sweepOrphanAttachments, unsettledCopyRefusal } from '@substrat-run/kernel';
-import { COPY_RESTORE_FENCE_LAPSED, scopeScriptCopyOf } from '@substrat-run/kernel';
+import { assertWireAuthFilter, wireAuthAccessTarget, COPY_RESTORE_FENCE_LAPSED, scopeScriptCopyOf } from '@substrat-run/kernel';
 import { attributedView, isModuleErasureCounts, moduleErasurePlan, moduleRowsErased, callReservedStoreOperation, callScopeStore, observeStoreCall, replayStoreErasures, scopeStoreLifecycleOf, scopeStoreRunnersOf } from '@substrat-run/kernel';
 import { PLATFORM_BINDING_PREFIX, scopeStoreBindingName, scopeStoreObjectName, STORE_CALL_URL, StoreError } from '@substrat-run/contracts';
 import { isOrangeToOrange, isUpgradeRequest, LIVE_PRINCIPAL_HEADER, LIVE_SCOPE_HEADER, LIVE_SUBSCRIBE_PATH, LIVE_TENANT_HEADER, LIVE_WITHIN_HEADER, LIVE_EXPIRES_HEADER, liveInstant, encodeLiveWithin, liveRefusalStatus, liveWithinOf, } from './live-reads.js';
 import { tenantStoreDatabaseName } from './d1.js';
-import { blobStoreBucketName, r2TenantBlobStore } from './r2.js';
+import { blobStoreBucketName, r2TenantBlobStore, workerdSha256 } from './r2.js';
 import { unwrapReply } from './do-reply.js';
 /** DO row → contract shape. Never reads the secrets table — that is the split. */
 const toConnection = (r) => connection.parse({
@@ -207,6 +207,28 @@ async function compensatingRefusal(store, key, call) {
         await store.delete(key).catch(() => { });
     return reply;
 }
+/**
+ * Ask the scope's write gate before a streamed body is read (#2516). A scope DO from before the
+ * verb exists cannot answer it, and a missing answer is never a pass: the call fails closed with a
+ * retryable `unavailable` that says to redeploy, rather than skipping the gate and reading the body.
+ */
+export async function askAttachmentWriteGate(stub, entity, principal, tenantId, scopeId, connectionId) {
+    let reply;
+    try {
+        reply = await stub.attachmentCheckWriteReply(entity, principal, tenantId, scopeId, connectionId);
+    }
+    catch (err) {
+        // By shape, not wording: the scope answers every refusal as data (`replyOf`), so what is
+        // THROWN here is a failure of the call itself, and a verb the receiver does not have is a
+        // `TypeError` however workerd phrases it. A dropped connection is a plain `Error`, rethrown.
+        if (err instanceof TypeError || err?.name === 'TypeError') {
+            throw substratError('unavailable', `the deployment serving scope ${scopeId} predates the upload write check (#2516): a streamed upload ` +
+                `is refused rather than read unchecked. Redeploy the vertical, then retry. Nothing was stored.`);
+        }
+        throw err;
+    }
+    unwrapReply(reply);
+}
 /** A tenant-held module's OFF answered without `deniesTenantGrants` (#1823). */
 const undeniedMessage = (scopeId, moduleId) => `the deployment serving scope ${scopeId} predates the kill switch's tenant-grant denial (#1823): ` +
     `module '${moduleId}' holds a tenant-level grant that its OFF would leave authorizing there. ` +
@@ -327,6 +349,12 @@ const DOOR_WORDS = {
 };
 /** #2029: the rewind hold's key for one subject — a module's id, bare as #1819 stored it, or `vertical:<slug>`. */
 const holdKeyOf = (kind, key) => (kind === 'system' ? key : peerSubjectRef(key));
+/** #2541: a vertical-side size read's answer, or the refusal when the scope's own object said it holds nothing (`null`). */
+function heldOrRefused(scopeId, size) {
+    if (size === null)
+        throw substratError('conflict', scopeNotHeldRefusal(scopeId));
+    return size;
+}
 export class CloudflareScopeHost {
     admin;
     scopeNs;
@@ -346,6 +374,8 @@ export class CloudflareScopeHost {
     moduleIds = new Set();
     /** #2430: what a registered module declares `holder: 'system'` — `assignRole`'s refusal reads it. */
     reservedKeys = new Set();
+    /** #2447: every key a registered or listed module declares, marked or not — a role definition reads it. */
+    declaredKeys = new Set();
     /** #2430: the declared permission surface `registerModule` holds each module to, when given. */
     permissions;
     /**
@@ -370,6 +400,7 @@ export class CloudflareScopeHost {
     /** Executor id → {eventType, handler} (K-22 §4.2). Coordinator-side, not in the DO. */
     secretBox;
     fetchImpl;
+    streamIdleMs;
     connectorCalls;
     /** The live D1 client for per-tenant stores (#301); undefined ⇒ refuse loudly. */
     tenantStores;
@@ -445,8 +476,10 @@ export class CloudflareScopeHost {
         this.servicePrincipals = options.servicePrincipals;
         this.permissions = options.permissions;
         // #2430: what the declared surface reserves holds here too, whatever is registered under its ids.
-        for (const m of options.permissions?.modules ?? [])
+        for (const m of options.permissions?.modules ?? []) {
             noteReservedKeys(this.reservedKeys, m.manifest);
+            noteDeclaredKeys(this.declaredKeys, m.manifest);
+        }
         this.secretBox = options.secretBox ?? unconfiguredSecretBox;
         this.tenantStores = options.tenantStores;
         this.blobStores = options.blobStores;
@@ -455,7 +488,9 @@ export class CloudflareScopeHost {
         assertAttachmentExtractors(options.attachmentExtractors ?? []);
         this.attachmentExtractors = options.attachmentExtractors ?? [];
         this.attachmentTextBounds = resolveAttachmentTextBounds(options.attachmentTextBounds);
-        this.fetchImpl = options.fetch ?? globalFetch;
+        // #2498: whatever fetch is injected, a sized stream body reaches it converted (`fetchLikeOf`).
+        this.fetchImpl = fetchLikeOf(options.fetch ?? globalFetch);
+        this.streamIdleMs = options.streamIdleTimeoutMs;
         this.connectorCalls = options.connectorCalls ?? noopConnectorCallRecorder;
         this.scopeLocalPermissions = options.scopeLocalPermissions ?? false;
         this.scopeNs = options.scope;
@@ -511,7 +546,8 @@ export class CloudflareScopeHost {
         const scope = await this.cp.getScopeRecord(tenantId, scopeId);
         const vertical = scope?.vertical ?? null;
         const admin = this.admin;
-        const fetchImpl = this.fetchImpl;
+        // #2518: the call under `timeoutMs`, a streamed body under the idle window instead.
+        const fetchImpl = deadlineFetch(this.fetchImpl, timeoutMs, { idleMs: this.streamIdleMs });
         return {
             admin,
             tenantId,
@@ -552,10 +588,7 @@ export class CloudflareScopeHost {
                         // #1691: timed where the call is made, so the data point carries a duration.
                         const started = Date.now();
                         try {
-                            const res = await fetchImpl(input, {
-                                ...init,
-                                signal: AbortSignal.timeout(timeoutMs),
-                            });
+                            const res = await fetchImpl(input, init);
                             await admin.recordConnectionUse(open.id, settleConnectionUse(provider, Date.now() - started, { response: res }));
                             return res;
                         }
@@ -1262,6 +1295,8 @@ export class CloudflareScopeHost {
      * safe; scope-level tuples (the restored grants) are never touched.
      */
     async projectRolesLocal(tenantId, scopeId, roles) {
+        // #2447: the role set is defined here, so it is judged here, before anything is projected.
+        await this.refuseReservedRoleSet(roles, tenantId, scopeId);
         unwrapReply(await this.scopeStub(scopeId).applyProjectionReply(tenantId, roles.map((r) => ({ role_key: r.key, permissions: JSON.stringify(r.permissions), source: r.source, holder: r.holder === 'system' ? 'system' : 'person' })), []));
     }
     /**
@@ -1332,9 +1367,16 @@ export class CloudflareScopeHost {
     async appliedMigrationsLocal(scopeId) {
         return this.scopeStub(scopeId).appliedMigrations();
     }
-    /** This host's own scope's database size in bytes (#1524), the vertical-host read. */
+    /**
+     * This host's own scope's database size in bytes (#1524), the vertical-host read. A scope this
+     * deployment does not hold is refused (#2541), not read as 0.
+     */
     async databaseSizeLocal(scopeId) {
-        return this.scopeStub(scopeId).databaseSize();
+        return heldOrRefused(scopeId, await this.scopeStub(scopeId).databaseSizeIfHeld());
+    }
+    /** This host's own scope's attachment bytes (#2501), the vertical-host read; refused as the size is. */
+    async attachmentSizeLocal(scopeId) {
+        return heldOrRefused(scopeId, await this.scopeStub(scopeId).attachmentBytesIfHeld());
     }
     /**
      * Each scope store's size in this deployment (#2207). The control plane already
@@ -1583,6 +1625,7 @@ export class CloudflareScopeHost {
         this.crossVertical.register(manifest, registration.imports);
         this.moduleIds.add(manifest.id);
         noteReservedKeys(this.reservedKeys, manifest);
+        noteDeclaredKeys(this.declaredKeys, manifest);
         if (manifest.schedules && manifest.schedules.length > 0) {
             this.moduleSchedules.set(manifest.id, manifest.schedules);
         }
@@ -1844,22 +1887,11 @@ export class CloudflareScopeHost {
             const filename = view.filename ?? input.filename;
             // Recorded as it is judged: the essence, never a parameter or a stray space.
             const contentType = normalizeUploadMediaType(input.contentType);
-            const record = attachmentRecord.parse({
-                id,
-                entity: view.entity,
-                filename,
-                contentType,
-                size: input.body.byteLength,
-                sha256: await attachmentSha256(input.body),
-                visibility: view.visibility,
-                createdBy: mintedBy,
-                createdAt: new Date().toISOString(),
-            });
             // Bytes first, row second, exactly as an upload: a refusal (size, type, a lost key, a link
             // someone else spent first) compensates the object away, and the link is unspent with it.
             // A lost reply keeps the bytes (`compensatingRefusal`), and a retry carrying the same
             // `Idempotency-Key` is answered as a replay (#2315).
-            await store.put(key, input.body, { contentType });
+            const record = await putAttachmentBytes(store, key, { id, entity: view.entity, filename, contentType, visibility: view.visibility, createdBy: mintedBy, createdAt: new Date().toISOString() }, input.body, workerdSha256);
             return unwrapReply(await compensatingRefusal(store, key, () => stub.attachmentRedeemUploadLinkReply(record, secret, tenantId, scopeId, input.idempotencyKey)));
         });
     }
@@ -1990,20 +2022,24 @@ export class CloudflareScopeHost {
             upload: async (input) => {
                 const id = ulid();
                 const key = attachmentBlobKey(scopeId, id);
-                const record = attachmentRecord.parse({
+                const fields = {
                     id,
                     entity: input.entity,
                     filename: input.filename,
                     contentType: input.contentType,
-                    size: input.body.byteLength,
-                    sha256: await attachmentSha256(input.body),
                     visibility: input.visibility,
                     createdBy,
                     createdAt: new Date().toISOString(),
-                });
+                };
+                // A streamed body is the case where bytes are the cost, so the write gate is asked before
+                // the first one is read (#2516). The row's own check below stays: this one is only early.
+                if (isSizedByteStream(input.body)) {
+                    await askAttachmentWriteGate(stub, input.entity, asPrincipalId, tenantId, scopeId, connectionId);
+                }
                 // Bytes first, row second — a crash between the two leaves an orphaned object (#2314);
                 // a refused gate compensates, and only an answered refusal does (`compensatingRefusal`).
-                await store.put(key, input.body, { contentType: input.contentType });
+                // A streamed body is hashed and counted as R2 reads it (#2498).
+                const record = await putAttachmentBytes(store, key, fields, input.body, workerdSha256);
                 return unwrapReply(await compensatingRefusal(store, key, () => stub.attachmentAddReply(record, asPrincipalId, tenantId, scopeId, connectionId)));
             },
             list: async (entity) => unwrapReply(await stub.attachmentListReply(entity, asPrincipalId, tenantId, scopeId, connectionId)),
@@ -2140,6 +2176,7 @@ export class CloudflareScopeHost {
             scopeId: snapshotId,
             kind: opts?.kind ?? 'archive',
             vertical: source.vertical,
+            verticalSource: 'copy',
             jurisdiction: source.jurisdiction,
             expiresAt: opts?.expiresAt,
             // forkedFrom/forkedAt are stamped from the dump by importScope.
@@ -3126,7 +3163,9 @@ export class CloudflareScopeHost {
         }
         return report;
     }
-    async runDueSchedules(moduleId, tenantId, scopeId) {
+    async runDueSchedules(moduleId, tenantId, scopeId, 
+    /** #2517: what the sweep tick's earlier calls did to this scope (`ScopeHost.runDueSchedules`). */
+    tick) {
         const report = { fired: 0, skipped: 0, failed: 0, errors: [], runs: [] };
         const schedules = this.moduleSchedules.get(moduleId);
         if (!schedules || schedules.length === 0)
@@ -3181,6 +3220,10 @@ export class CloudflareScopeHost {
         // scope at once. `ScheduleRunReport.platformRequests` says what that does and does not count.
         let platformRequests = 0;
         const counted = { onPlatformRequests: (n) => (platformRequests += n) };
+        // #2517: the part of that the purge runs enqueued, which is what defers a later purge head the
+        // cap refuses (`runPurgePass`): this call's, on top of what the tick's earlier calls report.
+        const earlierPurgeRequests = tick?.earlierPurgeRequests ?? 0;
+        let purgeRequests = 0;
         for (const schedule of schedules) {
             const last = await stub.scheduleLastRun(schedule.operation);
             const lastRun = last ? Date.parse(last) : null;
@@ -3215,12 +3258,24 @@ export class CloudflareScopeHost {
                     // call and transaction — and the SCOPE decides which are due and runs them, so purge
                     // authority is never an argument any stub can pass (`runPurgeSweep`).
                     // #2192: under the run's own id, so the purges and their deliveries join this run's line.
-                    // #2431: the purges' own requests run inside the scope, which reports no count for them;
-                    // the deliveries their events route to the platform are counted below, as an invoke's are.
-                    const pass = await door.through((instance) => stub.runPurgeSweep(schedule.operation, tenantId, scopeId, instance, invocationId));
+                    // #2431, #2440: the scope reports the requests its purges enqueued (`pass.platformRequests`),
+                    // and the deliveries their events route to the platform are counted below, as an invoke's are.
+                    // #2517: with what the purge runs before this one in the tick enqueued, so a head the cap
+                    // refuses because they filled the queue is deferred to the next tick rather than failed.
+                    const pass = await door.through((instance) => stub.runPurgeSweep(schedule.operation, tenantId, scopeId, instance, invocationId, earlierPurgeRequests + purgeRequests));
+                    if (pass.deferred) {
+                        // Ran nothing: no line, no cadence row, `skipped` like any run that did not happen.
+                        report.skipped += 1;
+                        report.deferred = (report.deferred ?? 0) + 1;
+                        report.runs.push({ operation: schedule.operation, outcome: 'skipped' });
+                        continue;
+                    }
+                    platformRequests += pass.platformRequests ?? 0;
+                    purgeRequests += pass.platformRequests ?? 0;
                     // The purges' events, delivered the way each invoke's own tail delivers them.
                     const delivered = await this.drainExecutors(tenantId, scopeId, invocationId);
                     platformRequests += delivered.routedToPlatform ?? 0;
+                    purgeRequests += delivered.routedToPlatform ?? 0;
                     stillDue = purgeStillDue(pass);
                     const outcome = purgeReportOf(schedule.operation, schedule.purge.entityType, pass);
                     report.errors.push(...outcome.errors);
@@ -3274,6 +3329,8 @@ export class CloudflareScopeHost {
         lines.end();
         if (platformRequests > 0)
             report.platformRequests = platformRequests;
+        if (purgeRequests > 0)
+            report.purgeRequests = purgeRequests;
         return report;
     }
     /** The stub body, shared by the principal, connection, system and impersonation doors. */
@@ -3594,6 +3651,19 @@ export class CloudflareScopeHost {
             archivedFromStatus: (r.archived_from_status ?? null),
             createdAt: r.created_at,
         });
+        // The directory rows `listScopes` and `listScopesReadable` map, filtered and paged alike.
+        const scopeRows = (filter) => this.cp.listScopes({
+            tenantId: filter?.tenantId,
+            status: filter?.status
+                ? Array.isArray(filter.status)
+                    ? filter.status
+                    : [filter.status]
+                : undefined,
+            vertical: filter?.vertical,
+            limit: filter?.limit,
+            cursor: filter?.cursor,
+            order: filter?.order,
+        });
         // The (version, scope) pair a bind and its impact read both start from, and the refusals
         // that come before any export-break question, in the order the bind makes them (#1756).
         const bindTarget = async (tenantId, scopeId, versionId) => {
@@ -4166,7 +4236,19 @@ export class CloudflareScopeHost {
             canStoreSecrets: isSecretBoxConfigured(this.secretBox),
             defineRole: async (actor, tenantId, role) => {
                 const parsed = roleDefinition.parse(role);
-                const before = await this.cp.defineRole(tenantId, parsed);
+                // #2447: judged in the ControlPlaneDO's unit, against this host's keys and the tenant's other
+                // roles, so a role assigned through a door cannot be widened afterwards. A refusal writes
+                // nothing, so a seat of the role as it was stored keeps working.
+                const context = await this.definitionContext(tenantId, parsed);
+                if (context.unreadable)
+                    throw substratError('forbidden', `role '${parsed.key}' cannot be judged: ${context.unreadable}`);
+                // `defineRoleOrRefusal`, not the legacy `defineRole` an older coordinator reads. A ControlPlaneDO from
+                // before #2447, met in a deploy's restart window, has no such method, so the call fails loudly rather
+                // than being misread.
+                const defined = await this.cp.defineRoleOrRefusal(tenantId, parsed, context.reservation, context.seatedInScopes);
+                if ('refused' in defined)
+                    throw substratError('forbidden', defined.refused);
+                const before = defined.before;
                 await this.recordAdmin(actor, 'defineRole', { tenantId }, before, parsed);
                 await this.fanOut(tenantId); // role definitions are projected into the tenant's scopes
             },
@@ -4607,8 +4689,7 @@ export class CloudflareScopeHost {
                     }
                     throw substratError('conflict', `vertical '${parsed.slug}' is already registered as ${existing.source}`);
                 }
-                await this.cp.insertVertical(parsed.slug, parsed.name, parsed.source, parsed.ownerTenant, envSpecJson, installSpecJson, parsed.listed ? 1 : 0, new Date().toISOString());
-                await this.recordAdmin(actor, 'registerVertical', { tenantId: null }, null, parsed);
+                await this.cp.insertVertical(parsed.slug, parsed.name, parsed.source, parsed.ownerTenant, envSpecJson, installSpecJson, parsed.listed ? 1 : 0, verticalOwnerNow(), this.adminEntry(actor, 'registerVertical', { tenantId: null }, null, parsed));
             },
             listVerticals: async (actor, page) => {
                 const rows = await this.cp.listVerticals(page);
@@ -4645,14 +4726,13 @@ export class CloudflareScopeHost {
                     admission: selfAdmits ? 'admitted' : 'pending',
                     admissionNote: selfAdmits ? AUTO_ADMISSION_NOTE : null,
                     createdAt: new Date().toISOString(),
-                });
-                await this.recordAdmin(actor, 'publishVersion', { tenantId: null }, null, {
+                }, this.adminEntry(actor, 'publishVersion', { tenantId: null }, null, {
                     ...audited,
                     // The digest the registry holds, which differs from the pushed one only for an unheld version.
                     migrationDigest,
                     ...(origin ? { origin } : {}),
                     admission: selfAdmits ? 'admitted' : 'pending',
-                });
+                }));
             },
             verticalScopeStores: async (actor, verticalSlug) => {
                 const stores = await this.directory('verticalScopeStores', verticalSlug);
@@ -4686,36 +4766,32 @@ export class CloudflareScopeHost {
                             `a staff admit must vouch for it before listing`);
                     }
                 }
-                await this.cp.updateVerticalListed(slug, listed ? 1 : 0); // also resolves any pending request
-                await this.recordAdmin(actor, 'setVerticalListed', { tenantId: null }, { listed: !!existing.listed }, { listed });
+                await this.cp.updateVerticalListed(slug, listed ? 1 : 0, // also resolves any pending request
+                this.adminEntry(actor, 'setVerticalListed', { tenantId: null }, { listed: !!existing.listed }, { listed }));
             },
             requestPublish: async (actor, slug) => {
                 const existing = await this.cp.readVertical(slug);
                 if (!existing)
                     throw substratError('not_found', `unknown vertical '${slug}'`);
-                await this.cp.updateVerticalPublishRequest(slug, new Date().toISOString());
-                await this.recordAdmin(actor, 'requestPublish', { tenantId: null }, null, { slug });
+                await this.cp.updateVerticalPublishRequest(slug, new Date().toISOString(), this.adminEntry(actor, 'requestPublish', { tenantId: null }, null, { slug }));
             },
             setVerticalInstallsBlocked: async (actor, slug, blocked) => {
                 const existing = await this.cp.readVertical(slug);
                 if (!existing)
                     throw substratError('not_found', `unknown vertical '${slug}'`);
-                await this.cp.updateVerticalInstallsBlocked(slug, blocked ? 1 : 0);
-                await this.recordAdmin(actor, 'setVerticalInstallsBlocked', { tenantId: null }, { installsBlocked: !!existing.installs_blocked }, { installsBlocked: blocked });
+                await this.cp.updateVerticalInstallsBlocked(slug, blocked ? 1 : 0, this.adminEntry(actor, 'setVerticalInstallsBlocked', { tenantId: null }, { installsBlocked: !!existing.installs_blocked }, { installsBlocked: blocked }));
             },
             setVerticalTenantProvisioner: async (actor, slug, granted) => {
                 const existing = await this.cp.readVertical(slug);
                 if (!existing)
                     throw substratError('not_found', `unknown vertical '${slug}'`);
-                await this.cp.updateVerticalTenantProvisioner(slug, granted ? 1 : 0);
-                await this.recordAdmin(actor, 'setVerticalTenantProvisioner', { tenantId: null }, { tenantProvisioner: !!existing.tenant_provisioner }, { tenantProvisioner: granted });
+                await this.cp.updateVerticalTenantProvisioner(slug, granted ? 1 : 0, this.adminEntry(actor, 'setVerticalTenantProvisioner', { tenantId: null }, { tenantProvisioner: !!existing.tenant_provisioner }, { tenantProvisioner: granted }));
             },
             setVerticalEmailSender: async (actor, slug, granted) => {
                 const existing = await this.cp.readVertical(slug);
                 if (!existing)
                     throw substratError('not_found', `unknown vertical '${slug}'`);
-                await this.cp.updateVerticalEmailSender(slug, granted ? 1 : 0);
-                await this.recordAdmin(actor, 'setVerticalEmailSender', { tenantId: null }, { emailSender: !!existing.email_sender }, { emailSender: granted });
+                await this.cp.updateVerticalEmailSender(slug, granted ? 1 : 0, this.adminEntry(actor, 'setVerticalEmailSender', { tenantId: null }, { emailSender: !!existing.email_sender }, { emailSender: granted }));
             },
             deleteVertical: async (actor, slug) => {
                 const existing = await this.cp.readVertical(slug);
@@ -4734,8 +4810,13 @@ export class CloudflareScopeHost {
                 if (bound.archived > 0) {
                     throw substratError('conflict', `vertical '${slug}' still backs ${bound.archived} archived scope(s) — reap or restore them first`);
                 }
-                await this.cp.deleteVertical(slug);
-                await this.recordAdmin(actor, 'deleteVertical', { tenantId: null }, { slug, source: existing.source, ownerTenant: existing.owner_tenant }, null);
+                // #2501: the period's `until` is read here, on the clock its `since` was.
+                await this.cp.deleteVertical(slug, this.adminEntry(actor, 'deleteVertical', { tenantId: null }, { slug, source: existing.source, ownerTenant: existing.owner_tenant }, null), verticalOwnerNow());
+            },
+            listVerticalOwners: async (actor, slug) => {
+                const periods = (await this.cp.listVerticalOwners(slug)).map((p) => verticalOwnerPeriod.parse(p));
+                await this.recordAccess(actor, 'listVerticalOwners', { tenantId: null }, { slug }, periods.length);
+                return periods;
             },
             admitVersion: async (actor, versionId) => {
                 const v = await this.cp.readVersion(versionId);
@@ -4746,15 +4827,13 @@ export class CloudflareScopeHost {
                     // manual vouch by clearing the note (what the publish seam requires).
                     if (v.admission_note !== AUTO_ADMISSION_NOTE)
                         return;
-                    await this.cp.setAdmission(versionId, 'admitted', null);
-                    await this.recordAdmin(actor, 'admitVersion', { tenantId: null }, { admission: v.admission, note: v.admission_note }, { admission: 'admitted', note: null });
+                    await this.cp.setAdmission(versionId, 'admitted', null, this.adminEntry(actor, 'admitVersion', { tenantId: null }, { admission: v.admission, note: v.admission_note }, { admission: 'admitted', note: null }));
                     return;
                 }
                 if (v.admission === 'rejected') {
                     throw substratError('conflict', `version ${versionId} was rejected — publish a new one`);
                 }
-                await this.cp.setAdmission(versionId, 'admitted', null);
-                await this.recordAdmin(actor, 'admitVersion', { tenantId: null }, { admission: v.admission }, { admission: 'admitted' });
+                await this.cp.setAdmission(versionId, 'admitted', null, this.adminEntry(actor, 'admitVersion', { tenantId: null }, { admission: v.admission }, { admission: 'admitted' }));
             },
             promotionImpact: async (actor, verticalSlug, channel, versionId) => {
                 const incoming = await this.cp.readVersion(versionId);
@@ -4778,8 +4857,7 @@ export class CloudflareScopeHost {
                 }
                 if (v.admission === 'rejected')
                     return;
-                await this.cp.setAdmission(versionId, 'rejected', note);
-                await this.recordAdmin(actor, 'rejectVersion', { tenantId: null }, { admission: v.admission }, { admission: 'rejected', note });
+                await this.cp.setAdmission(versionId, 'rejected', note, this.adminEntry(actor, 'rejectVersion', { tenantId: null }, { admission: v.admission }, { admission: 'rejected', note }));
             },
             promoteVersion: async (actor, verticalSlug, channel, versionId, acknowledge) => {
                 const incoming = await this.cp.readVersion(versionId);
@@ -4853,7 +4931,8 @@ export class CloudflareScopeHost {
                 // in. The control plane moves the pointer, and writes the timeline row (what makes rollback a
                 // choice among recorded moments, and `at` the PITR anchor a data rollback would rewind to),
                 // only if the pointer still names `outgoing`; the promote that lost the race is refused as
-                // stale and writes nothing.
+                // stale and writes nothing. Its admin row commits with the move, ahead of the rebinds below,
+                // which record their own — and the acknowledgement is recorded, not just enforced.
                 const moved = await this.cp.moveChannel(outgoing?.id ?? null, {
                     id: ulid(),
                     vertical_slug: verticalSlug,
@@ -4862,7 +4941,7 @@ export class CloudflareScopeHost {
                     from_version_id: outgoing?.id ?? null,
                     actor,
                     at: promotedAt,
-                });
+                }, this.adminEntry(actor, 'promoteVersion', { tenantId: null, vertical: verticalSlug }, outgoing ? { versionId: outgoing.id, version: outgoing.version } : null, { channel, versionId, version: incoming.version, acknowledged: ack }));
                 if (!moved)
                     throw promoteRaceRefusal(channel);
                 // For a PRIVATE vertical, prod IS what the owner's apps run: re-point the
@@ -4892,7 +4971,6 @@ export class CloudflareScopeHost {
                     }
                     await this.cp.bindScopeVersion(s.scope_id, versionId, verticalSlug, undefined, undefined, undefined, undefined, undefined, this.adminEntry(actor, 'bindScopeVersion', { tenantId: s.tenant_id, scopeId: s.scope_id }, prev ? { versionId: prev.id, version: prev.version } : null, { versionId, vertical: verticalSlug, version: incoming.version, via: 'promoteVersion' }));
                 }
-                await this.recordAdmin(actor, 'promoteVersion', { tenantId: null, vertical: verticalSlug }, outgoing ? { versionId: outgoing.id, version: outgoing.version } : null, { channel, versionId, version: incoming.version, acknowledged: ack });
             },
             listChannels: async (actor, verticalSlug, page) => {
                 // `prod` is the only live channel (#509 retired dev/staging). Filter before the parse
@@ -5061,10 +5139,9 @@ export class CloudflareScopeHost {
                     versionId: parsed.versionId,
                     doClassesJson: JSON.stringify(parsed.doClasses),
                     migrationTag: parsed.migrationTag,
-                });
-                await this.recordAdmin(actor, 'setVerticalServing', { tenantId: null }, r.serving_ref
+                }, this.adminEntry(actor, 'setVerticalServing', { tenantId: null }, r.serving_ref
                     ? { ref: r.serving_ref, versionId: r.serving_version_id }
-                    : null, { vertical: verticalSlug, ref: parsed.ref, versionId: parsed.versionId });
+                    : null, { vertical: verticalSlug, ref: parsed.ref, versionId: parsed.versionId }));
             },
             versionManifest: async (actor, verticalSlug, versionId) => {
                 const v = await this.cp.readVersion(versionId);
@@ -5082,6 +5159,18 @@ export class CloudflareScopeHost {
                 await this.recordAccess(actor, 'versionMigrations', {}, { verticalSlug, versionId }, v.migrations?.length ?? 0);
                 return v.migrations;
             },
+            recordWireAuth: async (actor, input) => {
+                const row = deploymentWireAuth.parse(input);
+                await this.cp.recordWireAuth(row, this.adminEntry(actor, 'recordWireAuth', { tenantId: null, vertical: row.verticalSlug }, null, { vertical: row.verticalSlug, deploymentRef: row.deploymentRef, versionId: row.versionId, record: row.record }));
+            },
+            listWireAuth: async (actor, input) => {
+                // Judged here, before the call into the directory's object, so a refusal keeps its code; the
+                // judged copy is what crosses the RPC and reaches the log (its own fields, the reach first).
+                const filter = assertWireAuthFilter(input);
+                const rows = await this.cp.listWireAuth(filter);
+                await this.recordAccess(actor, 'listWireAuth', wireAuthAccessTarget(filter), filter, rows.length);
+                return rows;
+            },
             setScopeServingRef: async (actor, tenantId, scopeId, servingRef, opts) => {
                 const scope = await this.cp.getScopeRecord(tenantId, scopeId);
                 if (!scope)
@@ -5144,6 +5233,13 @@ export class CloudflareScopeHost {
                 await this.recordAccess(actor, 'scopeStoreSizes', { tenantId, scopeId }, null, sizes.length);
                 return sizes;
             },
+            scopeAttachmentBytes: async (actor, tenantId, scopeId) => {
+                // Reaped is refused, not read: addressing the deleted DO would recreate it.
+                await this.scopeRecordForRead(tenantId, scopeId);
+                const bytes = await this.scopeStub(scopeId).attachmentBytes();
+                await this.recordAccess(actor, 'scopeAttachmentBytes', { tenantId, scopeId }, null, 1);
+                return bytes;
+            },
             rewindScope: async (actor, tenantId, scopeId, bookmark, opts) => {
                 const scope = await this.cp.getScopeRecord(tenantId, scopeId);
                 if (!scope)
@@ -5228,31 +5324,26 @@ export class CloudflareScopeHost {
             },
             createTenant: async (actor, input) => {
                 const parsed = createTenantInput.parse(input);
-                const created = await this.directory('createTenant', parsed.id, parsed.slug, parsed.name, new Date().toISOString(), parsed.provisionedByTenant ?? null);
-                // Idempotent: re-creating an existing tenant is a no-op, not audited.
-                if (!created)
-                    return;
-                await this.recordAdmin(actor, 'createTenant', { tenantId: parsed.id }, null, created);
+                // Idempotent: re-creating an existing tenant is a no-op, not audited. The DO writes the
+                // row with the tenant it created as its `after`.
+                await this.directory('createTenant', parsed.id, parsed.slug, parsed.name, new Date().toISOString(), parsed.provisionedByTenant ?? null, this.adminEntry(actor, 'createTenant', { tenantId: parsed.id }, null, null));
             },
             setTenantStatus: async (actor, tenantId, status) => {
-                const before = await this.directory('setTenantStatus', tenantId, status);
-                await this.recordAdmin(actor, 'setTenantStatus', { tenantId }, { status: before }, { status });
+                // The DO fills the row's `before` with the status it read in the write's unit.
+                await this.directory('setTenantStatus', tenantId, status, this.adminEntry(actor, 'setTenantStatus', { tenantId }, null, { status }));
                 // #1713: every hosted scope under the tenant holds or resumes its work by this.
                 await this.deliverLifecycles(actor, { tenantId });
             },
             setTenantName: async (actor, tenantId, name) => {
-                const before = await this.directory('setTenantName', tenantId, name);
-                if (before === name)
-                    return; // no-op is not audited — nothing changed
-                await this.recordAdmin(actor, 'setTenantName', { tenantId }, { name: before }, { name });
+                // A rename to the current name writes nothing and is not audited; the DO fills `before`.
+                await this.directory('setTenantName', tenantId, name, this.adminEntry(actor, 'setTenantName', { tenantId }, null, { name }));
             },
             reapTenant: async (actor, tenantId) => {
                 // Directory-side terminal reap (§4.8). The caller reaped every scope's storage
                 // first (archive-if-needed → reapScope in the vertical deployment); the DO clears
                 // the tenant's PII/config rows and flips the row to a `reaped` tombstone, keeping
                 // the row + admin log. Only a `deleting` tenant may be reaped (checked in the DO).
-                const before = await this.directory('reapTenant', tenantId);
-                await this.recordAdmin(actor, 'reapTenant', { tenantId }, { status: before }, { status: 'reaped' });
+                await this.directory('reapTenant', tenantId, this.adminEntry(actor, 'reapTenant', { tenantId }, null, { status: 'reaped' }));
             },
             listTenants: async (actor, page) => {
                 const tenants = (await this.cp.listTenants(page)).map((t) => tenantSchema.parse(t));
@@ -5266,21 +5357,15 @@ export class CloudflareScopeHost {
                 return t ? tenantSchema.parse(t) : undefined;
             },
             listScopes: async (actor, filter) => {
-                const rows = await this.cp.listScopes({
-                    tenantId: filter?.tenantId,
-                    status: filter?.status
-                        ? Array.isArray(filter.status)
-                            ? filter.status
-                            : [filter.status]
-                        : undefined,
-                    vertical: filter?.vertical,
-                    limit: filter?.limit,
-                    cursor: filter?.cursor,
-                    order: filter?.order,
-                });
+                const rows = await scopeRows(filter);
                 await this.recordAccess(actor, 'listScopes', { tenantId: filter?.tenantId ?? null }, filter, rows.length);
                 return rows.map(mapScope);
             },
+            listScopesReadable: async (actor, filter) => {
+                const rows = await scopeRows(filter);
+                await this.recordAccess(actor, 'listScopesReadable', { tenantId: filter?.tenantId ?? null }, filter, rows.length);
+                return readableScopes(rows, mapScope);
+            },
             getScopeRecord: async (actor, tenantId, scopeId) => {
                 const row = await this.cp.getScopeRecord(tenantId, scopeId);
                 await this.recordAccess(actor, 'getScopeRecord', { tenantId, scopeId }, null, row ? 1 : 0);
@@ -5984,6 +6069,7 @@ export class CloudflareScopeHost {
                     storage: rows.storage,
                     storageAttempts: rows.storageAttempts,
                     storeStorage: rows.storeStorage,
+                    attachmentStorage: rows.attachmentStorage,
                 });
                 // Tenants covered, not totals: "read one tenant's meter" and "metered the whole
                 // fleet" are different acts, and K-24 exists to tell them apart.
@@ -6388,7 +6474,10 @@ export class CloudflareScopeHost {
                 return rows.map((r) => adminLogEntry.parse(r));
             },
             recordOpsFailure: async (entry) => {
+                // #2540: a pair's staff row is minted first, so the tenant's row lists above it.
+                const detail = entry.tenantId && typeof entry.detail === 'string' ? { detail: entry.detail.slice(0, 2000), detail_id: ulid() } : {};
                 await this.cp.recordOpsFailure({
+                    ...detail,
                     id: ulid(),
                     actor: entry.actor,
                     operation: entry.operation,
@@ -6418,6 +6507,7 @@ export class CloudflareScopeHost {
                     code: filter?.code,
                     fingerprint: filter?.fingerprint,
                     reference: filter?.reference,
+                    referenceInText: filter?.referenceInText,
                     since: filter?.since,
                     until: filter?.until,
                     limit: filter?.limit,
@@ -6534,6 +6624,30 @@ export class CloudflareScopeHost {
                 return rows;
             },
             pruneScopeStorage: async (_actor, limit) => this.cp.pruneScopeStorage(assertRowLimit('limit', limit)),
+            recordRequestDay: async (_actor, input) => this.cp.recordRequestDay(input),
+            listRequestDays: async (actor, filter) => {
+                const rows = (await this.cp.listRequestDays(filter)).map((r) => requestDay.parse(r));
+                await this.recordAccess(actor, 'listRequestDays', { tenantId: filter?.tenantId ?? null, scopeId: filter?.scopeId ?? null }, filter ?? null, rows.length);
+                return rows;
+            },
+            listRequestRollupDays: async (actor, filter) => {
+                const rows = (await this.cp.listRequestRollupDays(filter)).map((r) => requestRollupDay.parse(r));
+                await this.recordAccess(actor, 'listRequestRollupDays', { tenantId: null }, filter ?? null, rows.length);
+                return rows;
+            },
+            pruneRequestDays: async (_actor, limit, retentionMonths) => this.cp.pruneRequestDays(assertRowLimit('limit', limit), retentionMonths),
+            recordMeterDay: async (_actor, input) => this.cp.recordMeterDay(input),
+            listMeterDays: async (actor, filter) => {
+                const rows = (await this.cp.listMeterDays(filter)).map((r) => meterDay.parse(r));
+                await this.recordAccess(actor, 'listMeterDays', { tenantId: filter?.tenantId ?? null }, filter ?? null, rows.length);
+                return rows;
+            },
+            listMeterDayTakes: async (actor, filter) => {
+                const rows = (await this.cp.listMeterDayTakes(filter)).map((r) => meterDayTake.parse(r));
+                await this.recordAccess(actor, 'listMeterDayTakes', { tenantId: null }, filter ?? null, rows.length);
+                return rows;
+            },
+            pruneMeterDays: async (_actor, limit, retentionMonths) => this.cp.pruneMeterDays(assertRowLimit('limit', limit), retentionMonths),
             recordModelUsage: async (input) => {
                 const l = input.line;
                 return this.cp.recordModelUsage({
@@ -6756,15 +6870,11 @@ export class CloudflareScopeHost {
             catch (err) {
                 report.failed += 1;
                 try {
-                    await this.admin.recordOpsFailure({
-                        actor,
-                        operation: 'scope.lifecycle',
-                        stage: 'deliver',
-                        tenantId,
-                        scopeId,
-                        message: `the lifecycle (scope ${t.scope_status}, tenant ${t.tenant_status}) did not reach the ` +
-                            `deployment serving this scope; the heal sweep will deliver it again: ${err instanceof Error ? err.message : String(err)}`,
-                    });
+                    // #2554: the throw is the deployment's or its runtime's text, and the deployment serving
+                    // a scope is the vertical's code, often another tenant's. The tenant's row says only what
+                    // happened; the text is staff's row, under the same reference.
+                    const missed = `the lifecycle (scope ${t.scope_status}, tenant ${t.tenant_status}) did not reach the deployment serving this scope; the heal sweep will deliver it again`;
+                    await this.admin.recordOpsFailure(withheldOpsFailure({ actor, operation: 'scope.lifecycle', stage: 'deliver', tenantId, scopeId }, `${missed}: ${err instanceof Error ? err.message : String(err)}`, (reference) => `${missed} (reference ${reference})`));
                 }
                 catch (recordErr) {
                     console.error('substrat: could not record a lifecycle delivery failure (#1713)', recordErr);
@@ -7564,6 +7674,14 @@ export class CloudflareScopeHost {
         // #2430: refused before anything is written, rather than at the top-up after the projection.
         if (input.entityGrants)
             await this.refuseReservedShapes(input.entityGrants, input.scopeId);
+        // #2447: the role set this provision defines, and the owner's seat in it — a person's seat, so
+        // the person's door — are judged before anything is written. A refusal fails the provision and
+        // writes nothing, so a seat a reconcile would have re-asserted is left exactly as it is.
+        const reserved = await this.refuseReservedRoleSet(input.roles, input.tenantId, input.scopeId);
+        const ownerRole = input.roles.find((r) => r.key === input.ownerRoleKey);
+        const ownerRefusal = ownerRole ? reservedRoleRefusal(ownerRole, reserved, 'person') : null;
+        if (ownerRefusal)
+            throw substratError('forbidden', `the owner's seat: ${ownerRefusal}`);
         const connections = await this.seatableConnectionGrants(input.tenantId, input.scopeId, input.connectionGrants);
         const services = await this.servicePrincipals?.(input.tenantId, input.scopeId);
         const stub = this.scopeStub(input.scopeId);
@@ -7639,6 +7757,110 @@ export class CloudflareScopeHost {
             ...(connections.skipped.length ? { skippedConnectionGrants: connections.skipped } : {}),
         };
     }
+    /**
+     * #2447: what a tenant's role definition is judged with, beyond the stored roles the ControlPlaneDO
+     * reads in its own unit:
+     * - the reservations of this host's modules, joined with the scope class's. Every scope on this
+     *   binding is one class, so one of the tenant's scopes answers for all, and the fan-out after
+     *   the write projects into exactly those scopes. A tenant with no scope yet is judged by this
+     *   host's modules alone (a stated residual: its first scope's projection is not judged again);
+     * - for a `holder: 'system'` definition of a key with no system-held definition stored (none at
+     *   all included: a seat can outlive its role's row), whether anyone but a system principal holds a
+     *   live scope-level seat in it in one of those scopes (the ControlPlaneDO reads the tenant-level
+     *   seats). No scope is asked for seats otherwise.
+     *
+     * Every scope that is not reaped is read, a scope archived straight from `provisioning` included:
+     * the platform's door seats into a provisioning scope, and unarchive brings the seat back. A DO
+     * cannot be asked anything without waking it, and waking one that never ran would create storage it
+     * never had (#1524), so such a scope is read only when its directory row records a migration
+     * (`schema_version` past `'0'`). That is not a mark of instantiation: it counts the module
+     * migrations applied, and is written only when a pass applied one, so a scope of a class with no
+     * module migrations reads `'0'` though it holds a seat. One that records none is not read, and the
+     * definition fails closed where that scope could decide it: `unreadable` names it, and the caller
+     * refuses a definition its seats, or its class's reservations when no other scope gives them, would
+     * decide. So while such a scope is the tenant's only one, every definition is refused until it is
+     * unarchived or reaped. No product path reaches this today: the dashboard is the one Cloudflare
+     * caller of `defineRole`, and its class has migrations.
+     *
+     * A stated residual: this half is read before the ControlPlaneDO's unit, not in it, so a scope-level
+     * seat made in between is not seen. The tenant-level seats and the stored roles are read in the unit.
+     */
+    async definitionContext(tenantId, role) {
+        const listed = await this.cp.listScopes({ tenantId, status: [...SEAT_HOLDING_SCOPE_STATUSES] });
+        const neverStored = (s) => (s.status === 'archived' || s.status === 'archiving') && s.archived_from_status === 'provisioning' && (s.schema_version ?? '0') === '0';
+        const scopes = listed.filter((s) => !neverStored(s));
+        const unreadableScope = listed.find(neverStored);
+        const unreadable = unreadableScope
+            ? `scope ${unreadableScope.scope_id} was archived straight from provisioning and records no migration, so its seats and its ` +
+                `class's reservations cannot be read without creating storage it may never have had. Unarchive it (or reap it) first`
+            : null;
+        const reservation = { reserved: [...this.reservedKeys], declared: [...this.declaredKeys] };
+        if (scopes.length > 0) {
+            const here = await this.scopeStub(scopes[0].scope_id).reservationHere();
+            reservation.reserved = [...new Set([...reservation.reserved, ...here.reserved])];
+            reservation.declared = [...new Set([...reservation.declared, ...here.declared])];
+        }
+        let seatedInScopes = false;
+        let seatsDecide = false;
+        if (role.holder === 'system') {
+            const stored = await this.cp.getRole(tenantId, role.key);
+            if (stored?.holder !== 'system') {
+                seatsDecide = true;
+                for (const s of scopes) {
+                    if ((await this.scopeStub(s.scope_id).roleStateHere(tenantId)).seated.includes(role.key)) {
+                        seatedInScopes = true;
+                        break;
+                    }
+                }
+            }
+        }
+        // Fail closed only where the unread scope could decide: its seats (a system-held definition the
+        // seats judge), or the class's reservations when no other scope gave them.
+        const decides = unreadable !== null && ((seatsDecide && !seatedInScopes) || scopes.length === 0);
+        return { reservation, seatedInScopes, unreadable: decides ? unreadable : null };
+    }
+    /**
+     * #2447: why `roles` may not be defined on `scopeId`, judged as a set against this host's
+     * reservations joined with the scope class's, or null. A restore asks it before it imports a dump,
+     * which replaces whatever the scope stores now, so what the set is judged against is the DUMP's
+     * roles and seats for `dump.tenantId` (`dumpRoleState`), when the caller has the dump in hand. A
+     * staged restore has not (its pages are already in the scope), so it is judged as a set alone
+     * here, and `projectRolesLocal` judges again after the import, against what the dump brought.
+     */
+    async roleSetRefusalLocal(scopeId, roles, dump) {
+        const here = await this.scopeStub(scopeId).reservationHere();
+        return reservedRoleSetRefusal(roles, { reserved: new Set([...this.reservedKeys, ...here.reserved]), declared: new Set([...this.declaredKeys, ...here.declared]) }, dump ? dumpRoleState(dump.tables, dump.tenantId, new Date().toISOString()) : undefined);
+    }
+    /**
+     * #2446: the roles `scopeId` stores for `tenantId` and the role keys anyone but a system principal
+     * holds a live seat in there: what `refuseReservedRoleSet` judges a reconcile's role set against
+     * (`roleStateHere`), read for a promote to judge the incoming version's set with
+     * (`releaseRoleSetRefusal`) before it moves the scope. Read-only, and names no principal.
+     */
+    async roleStateLocal(tenantId, scopeId) {
+        return this.scopeStub(scopeId).roleStateHere(tenantId);
+    }
+    /**
+     * #2447: refuse a role set a CP-less provision or restore defines on `scopeId` for `tenantId`
+     * (`reservedRoleSetRefusal`), against this host's reservations joined with the scope class's,
+     * and the roles the scope stores for the tenant now with their seats there. Answers the reserved
+     * keys it judged with, for the seats the same call makes.
+     *
+     * A stated residual: the scope state is read in one RPC (`roleStateHere`) and written in another
+     * (`applyProjectionReply`), so a seat made between the two is not seen. The window is one call
+     * wide, and a reconcile runs again every pass.
+     */
+    async refuseReservedRoleSet(roles, tenantId, scopeId) {
+        const stub = this.scopeStub(scopeId);
+        const [here, state] = await Promise.all([stub.reservationHere(), stub.roleStateHere(tenantId)]);
+        const reserved = new Set([...this.reservedKeys, ...here.reserved]);
+        const refusal = reservedRoleSetRefusal(roles, { reserved, declared: new Set([...this.declaredKeys, ...here.declared]) }, { roles: state.roles, seated: new Set(state.seated) });
+        // Named by tenant and scope as well as role: a release push admitted can be refused here at every
+        // scope where the role is seated, and staff find each one by this line (K-55).
+        if (refusal)
+            throw substratError('forbidden', `tenant ${tenantId}, scope ${scopeId}: the vertical's roles cannot be defined here: ${refusal}`);
+        return reserved;
+    }
     /**
      * #2430: the delivered connection grants a provision or reconcile may seat, and those it skips. A
      * connection acts for the external provider holding its token, so a grant naming a key reserved
@@ -7734,15 +7956,26 @@ export class CloudflareScopeHost {
      * storage. Idempotent (writeTuple is INSERT OR REPLACE). `roleKey` must be one the scope
      * already projected (via `provisionScopeLocal`), or the local checker expands it to nothing.
      */
-    async assignScopeRole(scopeId, principal, roleKey) {
-        // #2430: a platform door, as `HostAdmin.assignRole` is — a role mixing reserved and other keys
-        // is refused, against the scope class's own reservations and the role as the checker reads it
-        // for the tenant the scope's receipt names (`reservedRoleRefusalHere` says what happens without one).
-        const refusal = await this.scopeStub(scopeId).reservedRoleRefusalHere(roleKey, 'platform');
+    async assignScopeRole(scopeId, principal, roleKey, 
+    /** #2447: `person` when the caller knows it seats a person (the owner hand-over); the platform's door otherwise. */
+    door = 'platform') {
+        // #2430: a platform door by default, as `HostAdmin.assignRole` is — a role mixing reserved and
+        // other keys is refused, against the scope class's own reservations and the role as the checker
+        // reads it for the tenant the scope's receipt names (`reservedRoleRefusalHere` says what happens
+        // without one). The person's door also refuses any reserved key and a system-held role (#2447).
+        const refusal = await this.scopeStub(scopeId).reservedRoleRefusalHere(roleKey, door);
         if (refusal)
             throw substratError('forbidden', refusal);
         unwrapReply(await this.scopeStub(scopeId).writeTuple(`principal:${principal}`, `role:${roleKey}`, `scope:${scopeId}`, null));
     }
+    /**
+     * #2447: why `roleKey` may not be seated at scope level through `door`, or null — the question
+     * `assignScopeRole` asks before it writes, for a caller (the owner hand-over) that must ask it
+     * before anything else moves.
+     */
+    async scopeRoleRefusal(scopeId, roleKey, door) {
+        return this.scopeStub(scopeId).reservedRoleRefusalHere(roleKey, door);
+    }
     /**
      * Take a scope-level role back — the counterpart `assignScopeRole` went without (#1161).
      * A tombstone, exactly as `HostAdmin.unassignRole` writes for a scope-level assignment: