@substrat-run/adapter-cloudflare 0.159.0 → 0.161.0

package/dist/host.js

@@ -1,16 +1,16 @@
 import { env as ambientEnv } from 'cloudflare:workers';
 import { isRewindRefusal, REWIND_REFUSED } from './rewind-refusal.js';
 import { isSystemDoorMoved, SYSTEM_DOOR_MOVED, SYSTEM_DOOR_REGATES } from './system-door.js';
-import { delegatedReadParams, operationSeriesCount, fromWireFailure, isSubstratError, exportReadInput, exportedBatch, importBatch, importResult, importState, importsOfManifestJson, connectionLandingsOfManifestJson, exportsOfManifestJson, assertNoBindingShapeBreak, importCursorMove, importCursorMoveAt, importCursorMoved, accessLogEntry, adminLogEntry, opsFailureEntry, opsFailureFingerprint, issueEntry, findingEntry, findingRuleEntry, sweepRunEntry, FRESHNESS_HEARTBEAT_MINUTES, sweepRunsPayload, modelUsageEntry, attachmentRecord, createTenantInput, identityLink, identityPool, createOrgInput, promotionAcknowledgement, bindAcknowledgement, bindHostnameInput, channelHistoryEntry, hostnameBinding, publishVersionInput, AUTO_ADMISSION_NOTE, registerVerticalInput, vertical as verticalSchema, verticalServingState, verticalChannel, verticalVersion, connection, capabilityExchange, mintedCapability, boundedBecomeMint, boundedBecomeRevoke, boundedUnbind, entityRef, becomeLinkState, principalBecomeCapabilityInput, capabilityGrant, principalId, connectionGrant, connectionGrantRecord, connectionSecret, systemGrant, systemSwitch, systemSwitchOutcome, systemScheduleEntry, systemSwitchRecord, entitlementGrant, entitlementGrantInput, capabilityFilter, instant, meterReading, scopeStorageSample, subjectRef, createConnectionInput, connectLinkFilter, connectLinkKey, consumeConnectLinkInput, mintConnectLinkInput, projectedConnectionGrant, projectedConnectionKey, moduleManifest, org as orgSchema, orgMembership, resolvedIdentity, identityMembership, roleDefinition, scope as scopeSchema, tenant as tenantSchema, tenantRole, delegatedReadRecord, ownerTransferAudit, memberChangeAudit, peerBindingAudit, connectionBindingAudit, copyMarkAudit, orphanSweepAudit, subjectShredReceipt, connectorDispatchKind, callsOfManifestJson, outboundOfManifestJson, SCOPE_GATE_REASONS, substratError, redrainEventsInput, coverage, peerCoverage, peerGrantsEntry, peerSwitch, peerSwitchOutcome, verticalCaller, verticalResolution, peerInstanceResolution, peerBinding as peerBindingSchema, verticalSlug, entityObjectRef, ATTACHMENT_BLOB_BINDING, blobStoreBindingName, lifecycleDelivery, scopeLifecycle, } from '@substrat-run/contracts';
+import { delegatedReadParams, operationSeriesCount, fromWireFailure, isSubstratError, exportReadInput, exportedBatch, importBatch, importResult, importState, importsOfManifestJson, connectionLandingsOfManifestJson, exportsOfManifestJson, assertNoBindingShapeBreak, importCursorMove, importCursorMoveAt, importCursorMoved, accessLogEntry, adminLogEntry, opsFailureEntry, opsFailureFingerprint, issueEntry, findingEntry, findingRuleEntry, sweepRunEntry, FRESHNESS_HEARTBEAT_MINUTES, sweepRunsPayload, modelUsageEntry, createTenantInput, identityLink, identityPool, createOrgInput, promotionAcknowledgement, bindAcknowledgement, bindHostnameInput, channelHistoryEntry, hostnameBinding, publishVersionInput, AUTO_ADMISSION_NOTE, registerVerticalInput, vertical as verticalSchema, verticalServingState, deploymentWireAuth, verticalChannel, verticalVersion, connection, capabilityExchange, mintedCapability, boundedBecomeMint, boundedBecomeRevoke, boundedUnbind, entityRef, becomeLinkState, principalBecomeCapabilityInput, capabilityGrant, principalId, connectionGrant, connectionGrantRecord, connectionSecret, systemGrant, systemSwitch, systemSwitchOutcome, systemScheduleEntry, systemSwitchRecord, entitlementGrant, entitlementGrantInput, capabilityFilter, instant, meterReading, scopeStorageSample, requestDay, requestRollupDay, meterDay, meterDayTake, verticalOwnerPeriod, subjectRef, createConnectionInput, connectLinkFilter, connectLinkKey, consumeConnectLinkInput, mintConnectLinkInput, projectedConnectionGrant, projectedConnectionKey, moduleManifest, org as orgSchema, orgMembership, resolvedIdentity, identityMembership, roleDefinition, scope as scopeSchema, tenant as tenantSchema, tenantRole, delegatedReadRecord, ownerTransferAudit, memberChangeAudit, peerBindingAudit, connectionBindingAudit, copyMarkAudit, orphanSweepAudit, subjectShredReceipt, connectorDispatchKind, callsOfManifestJson, outboundOfManifestJson, SCOPE_GATE_REASONS, substratError, redrainEventsInput, coverage, peerCoverage, peerGrantsEntry, peerSwitch, peerSwitchOutcome, verticalCaller, verticalResolution, peerInstanceResolution, peerBinding as peerBindingSchema, verticalSlug, entityObjectRef, ATTACHMENT_BLOB_BINDING, blobStoreBindingName, lifecycleDelivery, scopeLifecycle, } from '@substrat-run/contracts';
 import { normalizeHostname, toRouteTarget } from './route-resolver.js';
-import { attachmentBlobKey, normalizeUploadMediaType, redeemOrReplayUploadLink, attachmentSha256, entitlementDenial, requiredEntitlementFor, foldMeterReading, parseValidationRecords, resolveScopeRecord, ulid, KEPT_COPY_REFUSAL, capabilityTokenHash, checkBecomeInput, assertBecomeLinkStateIds, plausibleSessionToken, foldModelUsage, backoffAt, resolveRetryPolicy, executorOutcomeOf, isDeliveryRefusal, refusalJournalText, isSecretBoxConfigured, unconfiguredSecretBox, createSubjectKeys, generateSealingKeyPair, openSealed, ImpersonationRefused, assertSessionUsable, impersonationRowValues, mapImpersonationRow, newImpersonationSession, jobRunOf, assertLeaseMs, runDueJobRuns, SYSTEM_DOOR_WAIT, startJobRun, attachmentTextJob, assertAttachmentExtractors, resolveAttachmentTextBounds, assertJobRegistrable, ATTACHMENT_TEXT_BACKFILL_JOB, ATTACHMENT_TEXT_JOB, kernelJobFor, attachmentTextBackfillJob, searchLimit, searchMatchExpression, globalFetch, assertRedrainWindow, platformRequestOf, undrainedEventsOf, inUnitMovesToAudit, staleCarryRevertRow, staleCarryReverts, recordedOffFromWire, peerSubjectRef, SWITCH_KINDS, reassertActionOf, reassertEntry, reassertOffRow, reassertOnRow, switchActionOf, switchAuditSubject, recordAuditOutcome, auditedCapabilityRevoke, auditWarningOf, switchNotFoundMessage, recordWriteSuperseded, switchSubjectOf, switchSupersededMessage, withRecorded, systemSwitchedOffMessage, tenantSystemSwitchedOffMessage, CrossVerticalRegistry, importCursorSourceOf, exportBreaksOf, exportBreakRefusal, assertPromoteReviewCurrent, promoteRaceRefusal, rebindRaceRefusal, bindExportBreaksOf, bindExportBreakRefusal, scopeMoveOf, runningVersionOf, strandJudgmentsOf, boundShapesOfColumn, installReconciled, collectPeers, peerCallerAt, peerSeats, connectorCallRecord, noopConnectorCallRecorder, recordConnectorCall, settleConnectionUse, splitManifestMigrations, publishedMigrationDigest, migrationChangeRefusal, unknownRoleError, assertRowLimit, assertRowOffset, emptyImportResult, INERT_SCOPE_REASON, lifecycleReceipt, lifecycleRefusal, isPrimaryScope, isPrimaryScopeRow, asyncInvocationId, asyncLinePass, assertNoCallerPurge, purgeReportOf, purgeStillDue, assertBoundOperations, registerTrashTargets, assertModuleDeclared, noteReservedKeys, reservedGrantRefusal, reservedRoleRefusal, reservedShapeRefusal, memberAddedAudit, shapeTopUpBatch, } from '@substrat-run/kernel';
+import { attachmentBlobKey, normalizeUploadMediaType, redeemOrReplayUploadLink, attachmentSha256, bytesStream, isSizedByteStream, openAttachmentByteStream, putAttachmentBytes, entitlementDenial, requiredEntitlementFor, foldMeterReading, parseValidationRecords, readableScopes, resolveScopeRecord, ulid, withheldOpsFailure, KEPT_COPY_REFUSAL, capabilityTokenHash, checkBecomeInput, assertBecomeLinkStateIds, plausibleSessionToken, foldModelUsage, backoffAt, resolveRetryPolicy, executorOutcomeOf, isDeliveryRefusal, refusalJournalText, isSecretBoxConfigured, unconfiguredSecretBox, createSubjectKeys, generateSealingKeyPair, openSealed, ImpersonationRefused, assertSessionUsable, impersonationRowValues, mapImpersonationRow, newImpersonationSession, jobRunOf, assertLeaseMs, runDueJobRuns, SYSTEM_DOOR_WAIT, startJobRun, attachmentTextJob, assertAttachmentExtractors, resolveAttachmentTextBounds, assertJobRegistrable, ATTACHMENT_TEXT_BACKFILL_JOB, ATTACHMENT_TEXT_JOB, kernelJobFor, attachmentTextBackfillJob, searchLimit, searchMatchExpression, globalFetch, fetchLikeOf, deadlineFetch, assertRedrainWindow, platformRequestOf, undrainedEventsOf, inUnitMovesToAudit, staleCarryRevertRow, staleCarryReverts, recordedOffFromWire, peerSubjectRef, SWITCH_KINDS, reassertActionOf, reassertEntry, reassertOffRow, reassertOnRow, switchActionOf, switchAuditSubject, recordAuditOutcome, auditedCapabilityRevoke, auditWarningOf, switchNotFoundMessage, recordWriteSuperseded, switchSubjectOf, switchSupersededMessage, withRecorded, systemSwitchedOffMessage, tenantSystemSwitchedOffMessage, CrossVerticalRegistry, importCursorSourceOf, exportBreaksOf, exportBreakRefusal, assertPromoteReviewCurrent, promoteRaceRefusal, servingRaceRefusal, rebindRaceRefusal, bindExportBreaksOf, bindExportBreakRefusal, scopeMoveOf, runningVersionOf, strandJudgmentsOf, boundShapesOfColumn, installReconciled, collectPeers, peerCallerAt, peerSeats, connectorCallRecord, noopConnectorCallRecorder, recordConnectorCall, settleConnectionUse, splitManifestMigrations, publishedMigrationDigest, migrationChangeRefusal, unknownRoleError, assertRowLimit, assertRowOffset, emptyImportResult, INERT_SCOPE_REASON, lifecycleReceipt, lifecycleRefusal, scopeNotHeldRefusal, isPrimaryScope, isPrimaryScopeRow, asyncInvocationId, asyncLinePass, assertNoCallerPurge, purgeReportOf, purgeStillDue, assertBoundOperations, registerTrashTargets, assertModuleDeclared, noteDeclaredKeys, noteReservedKeys, reservedGrantRefusal, reservedRoleRefusal, reservedRoleSetRefusal, reservedShapeRefusal, SEAT_HOLDING_SCOPE_STATUSES, dumpRoleRefusal, dumpRoleState, memberAddedAudit, shapeTopUpBatch, verticalOwnerNow, } from '@substrat-run/kernel';
 import { fenceAttachmentSweep, missingAttachmentStore, sweepOrphanAttachments, unsettledCopyRefusal } from '@substrat-run/kernel';
-import { COPY_RESTORE_FENCE_LAPSED, scopeScriptCopyOf } from '@substrat-run/kernel';
+import { assertWireAuthFilter, wireAuthAccessTarget, COPY_RESTORE_FENCE_LAPSED, scopeScriptCopyOf } from '@substrat-run/kernel';
 import { attributedView, isModuleErasureCounts, moduleErasurePlan, moduleRowsErased, callReservedStoreOperation, callScopeStore, observeStoreCall, replayStoreErasures, scopeStoreLifecycleOf, scopeStoreRunnersOf } from '@substrat-run/kernel';
 import { PLATFORM_BINDING_PREFIX, scopeStoreBindingName, scopeStoreObjectName, STORE_CALL_URL, StoreError } from '@substrat-run/contracts';
 import { isOrangeToOrange, isUpgradeRequest, LIVE_PRINCIPAL_HEADER, LIVE_SCOPE_HEADER, LIVE_SUBSCRIBE_PATH, LIVE_TENANT_HEADER, LIVE_WITHIN_HEADER, LIVE_EXPIRES_HEADER, liveInstant, encodeLiveWithin, liveRefusalStatus, liveWithinOf, } from './live-reads.js';
 import { tenantStoreDatabaseName } from './d1.js';
-import { blobStoreBucketName, r2TenantBlobStore } from './r2.js';
+import { blobStoreBucketName, r2TenantBlobStore, workerdSha256 } from './r2.js';
 import { unwrapReply } from './do-reply.js';
 /** DO row → contract shape. Never reads the secrets table — that is the split. */
 const toConnection = (r) => connection.parse({
@@ -207,6 +207,28 @@ async function compensatingRefusal(store, key, call) {
         await store.delete(key).catch(() => { });
     return reply;
 }
+/**
+ * Ask the scope's write gate before a streamed body is read (#2516). A scope DO from before the
+ * verb exists cannot answer it, and a missing answer is never a pass: the call fails closed with a
+ * retryable `unavailable` that says to redeploy, rather than skipping the gate and reading the body.
+ */
+export async function askAttachmentWriteGate(stub, entity, principal, tenantId, scopeId, connectionId) {
+    let reply;
+    try {
+        reply = await stub.attachmentCheckWriteReply(entity, principal, tenantId, scopeId, connectionId);
+    }
+    catch (err) {
+        // By shape, not wording: the scope answers every refusal as data (`replyOf`), so what is
+        // THROWN here is a failure of the call itself, and a verb the receiver does not have is a
+        // `TypeError` however workerd phrases it. A dropped connection is a plain `Error`, rethrown.
+        if (err instanceof TypeError || err?.name === 'TypeError') {
+            throw substratError('unavailable', `the deployment serving scope ${scopeId} predates the upload write check (#2516): a streamed upload ` +
+                `is refused rather than read unchecked. Redeploy the vertical, then retry. Nothing was stored.`);
+        }
+        throw err;
+    }
+    unwrapReply(reply);
+}
 /** A tenant-held module's OFF answered without `deniesTenantGrants` (#1823). */
 const undeniedMessage = (scopeId, moduleId) => `the deployment serving scope ${scopeId} predates the kill switch's tenant-grant denial (#1823): ` +
     `module '${moduleId}' holds a tenant-level grant that its OFF would leave authorizing there. ` +
@@ -327,6 +349,12 @@ const DOOR_WORDS = {
 };
 /** #2029: the rewind hold's key for one subject — a module's id, bare as #1819 stored it, or `vertical:<slug>`. */
 const holdKeyOf = (kind, key) => (kind === 'system' ? key : peerSubjectRef(key));
+/** #2541, #2544: a vertical-side read's answer, or the refusal when the scope's own object said it holds nothing (`null`). */
+function heldOrRefused(scopeId, answer) {
+    if (answer === null)
+        throw substratError('conflict', scopeNotHeldRefusal(scopeId));
+    return answer;
+}
 export class CloudflareScopeHost {
     admin;
     scopeNs;
@@ -346,6 +374,8 @@ export class CloudflareScopeHost {
     moduleIds = new Set();
     /** #2430: what a registered module declares `holder: 'system'` — `assignRole`'s refusal reads it. */
     reservedKeys = new Set();
+    /** #2447: every key a registered or listed module declares, marked or not — a role definition reads it. */
+    declaredKeys = new Set();
     /** #2430: the declared permission surface `registerModule` holds each module to, when given. */
     permissions;
     /**
@@ -370,6 +400,7 @@ export class CloudflareScopeHost {
     /** Executor id → {eventType, handler} (K-22 §4.2). Coordinator-side, not in the DO. */
     secretBox;
     fetchImpl;
+    streamIdleMs;
     connectorCalls;
     /** The live D1 client for per-tenant stores (#301); undefined ⇒ refuse loudly. */
     tenantStores;
@@ -445,8 +476,10 @@ export class CloudflareScopeHost {
         this.servicePrincipals = options.servicePrincipals;
         this.permissions = options.permissions;
         // #2430: what the declared surface reserves holds here too, whatever is registered under its ids.
-        for (const m of options.permissions?.modules ?? [])
+        for (const m of options.permissions?.modules ?? []) {
             noteReservedKeys(this.reservedKeys, m.manifest);
+            noteDeclaredKeys(this.declaredKeys, m.manifest);
+        }
         this.secretBox = options.secretBox ?? unconfiguredSecretBox;
         this.tenantStores = options.tenantStores;
         this.blobStores = options.blobStores;
@@ -455,7 +488,9 @@ export class CloudflareScopeHost {
         assertAttachmentExtractors(options.attachmentExtractors ?? []);
         this.attachmentExtractors = options.attachmentExtractors ?? [];
         this.attachmentTextBounds = resolveAttachmentTextBounds(options.attachmentTextBounds);
-        this.fetchImpl = options.fetch ?? globalFetch;
+        // #2498: whatever fetch is injected, a sized stream body reaches it converted (`fetchLikeOf`).
+        this.fetchImpl = fetchLikeOf(options.fetch ?? globalFetch);
+        this.streamIdleMs = options.streamIdleTimeoutMs;
         this.connectorCalls = options.connectorCalls ?? noopConnectorCallRecorder;
         this.scopeLocalPermissions = options.scopeLocalPermissions ?? false;
         this.scopeNs = options.scope;
@@ -511,7 +546,8 @@ export class CloudflareScopeHost {
         const scope = await this.cp.getScopeRecord(tenantId, scopeId);
         const vertical = scope?.vertical ?? null;
         const admin = this.admin;
-        const fetchImpl = this.fetchImpl;
+        // #2518: the call under `timeoutMs`, a streamed body under the idle window instead.
+        const fetchImpl = deadlineFetch(this.fetchImpl, timeoutMs, { idleMs: this.streamIdleMs });
         return {
             admin,
             tenantId,
@@ -542,7 +578,8 @@ export class CloudflareScopeHost {
                     grants: async () => (await this.connectionGrantsInScope(tenantId, scopeId))
                         .filter((g) => g.connectionId === open.id)
                         .map((g) => g.permission),
-                    openAttachment: (attachmentId) => this.getConnectorAttachments(open.id, scopeId, { eventId }).then((a) => a.open(attachmentId)),
+                    openAttachment: async (attachmentId) => (await this.getConnectorAttachments(open.id, scopeId, { eventId })).open(attachmentId),
+                    openAttachmentStream: async (attachmentId) => (await this.getConnectorAttachments(open.id, scopeId, { eventId })).openStream(attachmentId),
                     // #687: open a cell the scope sealed TO this connection. The keyId-indexed
                     // map goes in, never out — a connector receives the plaintext of one cell,
                     // not a private key it could mislay. Retired keys are in the map too, so a
@@ -552,10 +589,7 @@ export class CloudflareScopeHost {
                         // #1691: timed where the call is made, so the data point carries a duration.
                         const started = Date.now();
                         try {
-                            const res = await fetchImpl(input, {
-                                ...init,
-                                signal: AbortSignal.timeout(timeoutMs),
-                            });
+                            const res = await fetchImpl(input, init);
                             await admin.recordConnectionUse(open.id, settleConnectionUse(provider, Date.now() - started, { response: res }));
                             return res;
                         }
@@ -972,14 +1006,29 @@ export class CloudflareScopeHost {
      * gate (the caller is the control plane, which did the K-3 check + audit on its side).
      */
     async introspectScopeTables(scopeId) {
-        return this.scopeStub(scopeId).introspectTables();
+        return heldOrRefused(scopeId, await this.scopeStub(scopeId).introspectTablesIfHeld());
     }
+    /**
+     * The Data view's table page (#2563): refused `conflict` with the shared sentence for a scope the
+     * deployment does not hold, as the reads above are, never answered as an empty store. The carry
+     * and its cleanup read a wiped copy's tombstone, which is not held by design: they use
+     * `readTombstoneTable`.
+     */
     async introspectScopeTable(scopeId, input) {
+        const reply = heldOrRefused(scopeId, await this.scopeStub(scopeId).introspectTableIfHeld(input.table, input.limit, input.offset));
+        return unwrapReply(reply);
+    }
+    /**
+     * A table of a store this deployment may no longer HOLD, for the carry and its cleanup, which ask
+     * a wiped copy whether it carries the `carried_away` tombstone (#2563). Not guarded: a wiped copy
+     * answers nothing else. Not for a screen or a console; those use `introspectScopeTable`.
+     */
+    async readTombstoneTable(scopeId, input) {
         return unwrapReply(await this.scopeStub(scopeId).introspectTableReply(input.table, input.limit, input.offset));
     }
-    /** The SQL console's CP-less path (#219) — same trust line as the pair above. */
+    /** The SQL console's CP-less path (#219): guarded as the table page is (#2563). */
     async introspectScopeQuery(scopeId, input) {
-        return unwrapReply(await this.scopeStub(scopeId).introspectQueryReply(input.sql));
+        return unwrapReply(heldOrRefused(scopeId, await this.scopeStub(scopeId).introspectQueryIfHeld(input.sql)));
     }
     /**
      * The K-35 denial log's CP-less path (#867) — same trust line as the reads above.
@@ -1262,6 +1311,8 @@ export class CloudflareScopeHost {
      * safe; scope-level tuples (the restored grants) are never touched.
      */
     async projectRolesLocal(tenantId, scopeId, roles) {
+        // #2447: the role set is defined here, so it is judged here, before anything is projected.
+        await this.refuseReservedRoleSet(roles, tenantId, scopeId);
         unwrapReply(await this.scopeStub(scopeId).applyProjectionReply(tenantId, roles.map((r) => ({ role_key: r.key, permissions: JSON.stringify(r.permissions), source: r.source, holder: r.holder === 'system' ? 'system' : 'person' })), []));
     }
     /**
@@ -1298,43 +1349,50 @@ export class CloudflareScopeHost {
     }
     /** Facet this host's own scope's outbox (#1239) — the vertical-host read. */
     async facetEventsLocal(scopeId, input) {
-        return this.scopeStub(scopeId).facetEvents(input);
+        return heldOrRefused(scopeId, await this.scopeStub(scopeId).facetEventsIfHeld(input));
     }
     /** What one event set off (#1237) on this host's own scope — the vertical-host read. */
     async eventEffectsLocal(scopeId, input) {
-        return this.scopeStub(scopeId).eventEffects(input);
+        return heldOrRefused(scopeId, await this.scopeStub(scopeId).eventEffectsIfHeld(input));
     }
     /** Everything one call emitted (#1237) on this host's own scope — the vertical-host read. */
     async invocationEventsLocal(scopeId, input) {
-        return this.scopeStub(scopeId).invocationEvents(input);
+        return heldOrRefused(scopeId, await this.scopeStub(scopeId).invocationEventsIfHeld(input));
     }
     /** Every delivery that gave up (#1525) on this host's own scope — the vertical-host read. */
     async deadLettersLocal(scopeId, input) {
-        return this.scopeStub(scopeId).deadLetters(input);
+        return heldOrRefused(scopeId, await this.scopeStub(scopeId).deadLettersIfHeld(input));
     }
     /** One entity's lifecycle replayed (#1744) on this host's own scope — the vertical-host read. */
     async lifecycleFlowLocal(scopeId, input) {
-        return this.scopeStub(scopeId).lifecycleFlow(input);
+        return heldOrRefused(scopeId, await this.scopeStub(scopeId).lifecycleFlowIfHeld(input));
     }
     /** Business volumes per bucket (#1750) on this host's own scope — the vertical-host read. */
     async operationSeriesLocal(scopeId, input) {
-        return this.scopeStub(scopeId).operationSeries(input);
+        return heldOrRefused(scopeId, await this.scopeStub(scopeId).operationSeriesIfHeld(input));
     }
     /** One event's causal chain (#1237) on this host's own scope — the vertical-host read. */
     async eventCauseLocal(scopeId, input) {
-        return this.scopeStub(scopeId).eventCause(input);
+        return heldOrRefused(scopeId, await this.scopeStub(scopeId).eventCauseIfHeld(input));
     }
     /** One record's event history (#1235) on this host's own scope — the vertical-host read. */
     async entityHistoryLocal(scopeId, input) {
-        return this.scopeStub(scopeId).entityHistory(input);
+        return heldOrRefused(scopeId, await this.scopeStub(scopeId).entityHistoryIfHeld(input));
     }
     /** When this host's own scope applied each migration (#1236) — the vertical-host read. */
     async appliedMigrationsLocal(scopeId) {
-        return this.scopeStub(scopeId).appliedMigrations();
+        return heldOrRefused(scopeId, await this.scopeStub(scopeId).appliedMigrationsIfHeld());
     }
-    /** This host's own scope's database size in bytes (#1524), the vertical-host read. */
+    /**
+     * This host's own scope's database size in bytes (#1524), the vertical-host read. A scope this
+     * deployment does not hold is refused (#2541), not read as 0.
+     */
     async databaseSizeLocal(scopeId) {
-        return this.scopeStub(scopeId).databaseSize();
+        return heldOrRefused(scopeId, await this.scopeStub(scopeId).databaseSizeIfHeld());
+    }
+    /** This host's own scope's attachment bytes (#2501), the vertical-host read; refused as the size is. */
+    async attachmentSizeLocal(scopeId) {
+        return heldOrRefused(scopeId, await this.scopeStub(scopeId).attachmentBytesIfHeld());
     }
     /**
      * Each scope store's size in this deployment (#2207). The control plane already
@@ -1376,7 +1434,8 @@ export class CloudflareScopeHost {
      * so a caller cannot ask this side for more than the other would.
      */
     async undrainedEventsLocal(scopeId, limit) {
-        return undrainedEventsOf(await this.scopeStub(scopeId).undrainedEventsRead(Math.min(Math.max(limit, 1), 1000)));
+        const bounded = Math.min(Math.max(limit, 1), 1000);
+        return undrainedEventsOf(heldOrRefused(scopeId, await this.scopeStub(scopeId).undrainedEventsReadIfHeld(bounded)));
     }
     /**
      * Stamp `drained_at` on this host's own scope (#1334) — the delegation's other half.
@@ -1402,7 +1461,7 @@ export class CloudflareScopeHost {
      * platform's `redrainEvents` is the door, and a count egresses nothing to record.
      */
     async redrainCountLocal(scopeId, drainedBefore) {
-        return this.scopeStub(scopeId).redrainCount(drainedBefore);
+        return heldOrRefused(scopeId, await this.scopeStub(scopeId).redrainCountIfHeld(drainedBefore));
     }
     /**
      * The PITR bookmarks one scope recorded before its migration passes (#286) — the
@@ -1410,7 +1469,7 @@ export class CloudflareScopeHost {
      * `/internal/bookmarks`; the control plane is the gate and the auditor.
      */
     async migrationBookmarksLocal(scopeId) {
-        return this.scopeStub(scopeId).migrationBookmarks();
+        return heldOrRefused(scopeId, await this.scopeStub(scopeId).migrationBookmarksIfHeld());
     }
     /**
      * Rewind one scope to a pre-migration bookmark (#286's backout) — schema AND data,
@@ -1583,6 +1642,7 @@ export class CloudflareScopeHost {
         this.crossVertical.register(manifest, registration.imports);
         this.moduleIds.add(manifest.id);
         noteReservedKeys(this.reservedKeys, manifest);
+        noteDeclaredKeys(this.declaredKeys, manifest);
         if (manifest.schedules && manifest.schedules.length > 0) {
             this.moduleSchedules.set(manifest.id, manifest.schedules);
         }
@@ -1844,22 +1904,11 @@ export class CloudflareScopeHost {
             const filename = view.filename ?? input.filename;
             // Recorded as it is judged: the essence, never a parameter or a stray space.
             const contentType = normalizeUploadMediaType(input.contentType);
-            const record = attachmentRecord.parse({
-                id,
-                entity: view.entity,
-                filename,
-                contentType,
-                size: input.body.byteLength,
-                sha256: await attachmentSha256(input.body),
-                visibility: view.visibility,
-                createdBy: mintedBy,
-                createdAt: new Date().toISOString(),
-            });
             // Bytes first, row second, exactly as an upload: a refusal (size, type, a lost key, a link
             // someone else spent first) compensates the object away, and the link is unspent with it.
             // A lost reply keeps the bytes (`compensatingRefusal`), and a retry carrying the same
             // `Idempotency-Key` is answered as a replay (#2315).
-            await store.put(key, input.body, { contentType });
+            const record = await putAttachmentBytes(store, key, { id, entity: view.entity, filename, contentType, visibility: view.visibility, createdBy: mintedBy, createdAt: new Date().toISOString() }, input.body, workerdSha256);
             return unwrapReply(await compensatingRefusal(store, key, () => stub.attachmentRedeemUploadLinkReply(record, secret, tenantId, scopeId, input.idempotencyKey)));
         });
     }
@@ -1908,19 +1957,28 @@ export class CloudflareScopeHost {
                 throw new Error(`connector attachment ${verb} is not delegated (#574) — upload and open are the ` +
                     `verbs that cross the /internal seam to the serving deployment`);
             };
+            const openArgs = (attachmentId) => ({
+                connectionId,
+                tenantId: tenant,
+                scopeId,
+                vertical,
+                attachmentId,
+                // #726 remedy B: the delivery, resolved at the far end against the
+                // deployment's own outbox. Absent outside a dispatch, where the ordinary
+                // permission check still applies.
+                eventId: forEvent?.eventId,
+            });
             return {
                 upload: (upload) => delegation.uploadAttachment({ connectionId, tenantId: tenant, scopeId, vertical, upload }),
-                open: (attachmentId) => delegation.openAttachment({
-                    connectionId,
-                    tenantId: tenant,
-                    scopeId,
-                    vertical,
-                    attachmentId,
-                    // #726 remedy B: the delivery, resolved at the far end against the
-                    // deployment's own outbox. Absent outside a dispatch, where the ordinary
-                    // permission check still applies.
-                    eventId: forEvent?.eventId,
-                }),
+                open: (attachmentId) => delegation.openAttachment(openArgs(attachmentId)),
+                // #2514: streamed over the seam when the embedder can. One that cannot reads the bytes whole,
+                // as `open` does, and hands them on as a stream, so the verb still works and holds what it did.
+                openStream: async (attachmentId) => {
+                    if (delegation.openAttachmentStream)
+                        return delegation.openAttachmentStream(openArgs(attachmentId));
+                    const opened = await delegation.openAttachment(openArgs(attachmentId));
+                    return opened && { record: opened.record, body: bytesStream(opened.body), contentType: opened.contentType };
+                },
                 list: notDelegated('list'),
                 remove: notDelegated('remove'),
                 // #1575: undelegated for `list`'s reason — a connector picks a document by id.
@@ -1967,6 +2025,10 @@ export class CloudflareScopeHost {
                     const record = unwrapReply(await stub.capabilityAttachmentOpen(attachmentId, hash, tenantId, scopeId));
                     return record ? this.openAttachmentBytes(store, scopeId, record) : null;
                 },
+                openStream: async (attachmentId) => {
+                    const record = unwrapReply(await stub.capabilityAttachmentOpen(attachmentId, hash, tenantId, scopeId));
+                    return record ? openAttachmentByteStream(store, attachmentBlobKey(scopeId, record.id), record, workerdSha256) : null;
+                },
                 remove: async (attachmentId) => unwrapReply(await stub.capabilityAttachmentRefuseWrite(hash, tenantId, scopeId, 'attachments.remove', {
                     attachmentId,
                 })),
@@ -1986,31 +2048,42 @@ export class CloudflareScopeHost {
         const asPrincipalId = ('principal' in subject
             ? subject.principal
             : subject.connectionId);
+        // The read gate, asked in the DO before the blob store is touched: a refused read never reaches it.
+        const authorizeRead = async (attachmentId) => unwrapReply(await stub.attachmentAuthorizeReply(attachmentId, 'read', asPrincipalId, tenantId, scopeId, connectionId, forEvent?.eventId));
         return {
             upload: async (input) => {
                 const id = ulid();
                 const key = attachmentBlobKey(scopeId, id);
-                const record = attachmentRecord.parse({
+                const fields = {
                     id,
                     entity: input.entity,
                     filename: input.filename,
                     contentType: input.contentType,
-                    size: input.body.byteLength,
-                    sha256: await attachmentSha256(input.body),
                     visibility: input.visibility,
                     createdBy,
                     createdAt: new Date().toISOString(),
-                });
+                };
+                // A streamed body is the case where bytes are the cost, so the write gate is asked before
+                // the first one is read (#2516). The row's own check below stays: this one is only early.
+                if (isSizedByteStream(input.body)) {
+                    await askAttachmentWriteGate(stub, input.entity, asPrincipalId, tenantId, scopeId, connectionId);
+                }
                 // Bytes first, row second — a crash between the two leaves an orphaned object (#2314);
                 // a refused gate compensates, and only an answered refusal does (`compensatingRefusal`).
-                await store.put(key, input.body, { contentType: input.contentType });
+                // A streamed body is hashed and counted as R2 reads it (#2498).
+                const record = await putAttachmentBytes(store, key, fields, input.body, workerdSha256);
                 return unwrapReply(await compensatingRefusal(store, key, () => stub.attachmentAddReply(record, asPrincipalId, tenantId, scopeId, connectionId)));
             },
             list: async (entity) => unwrapReply(await stub.attachmentListReply(entity, asPrincipalId, tenantId, scopeId, connectionId)),
             open: async (attachmentId) => {
-                const record = unwrapReply(await stub.attachmentAuthorizeReply(attachmentId, 'read', asPrincipalId, tenantId, scopeId, connectionId, forEvent?.eventId));
+                const record = await authorizeRead(attachmentId);
                 return record ? this.openAttachmentBytes(store, scopeId, record) : null;
             },
+            // #2514: the same gate, then the bytes as R2 reads them, checked against the record as they pass.
+            openStream: async (attachmentId) => {
+                const record = await authorizeRead(attachmentId);
+                return record ? openAttachmentByteStream(store, attachmentBlobKey(scopeId, record.id), record, workerdSha256) : null;
+            },
             remove: async (attachmentId) => {
                 const removed = unwrapReply(await stub.attachmentRemoveReply(attachmentId, asPrincipalId, tenantId, scopeId, connectionId));
                 if (removed)
@@ -2044,7 +2117,17 @@ export class CloudflareScopeHost {
         return { record, body: obj.body, contentType: obj.contentType ?? record.contentType };
     }
     async importScope(actor, input, dump) {
+        await this.importScopeFrom(actor, input, dump, true);
+    }
+    /**
+     * `importScope`, with its role judgement (#2555) when `judge`, made before the scope is created so a
+     * refused import leaves nothing behind. A snapshot passes false: it is the platform's copy of a live
+     * scope of this host, made at once, so its seats are the ones that scope holds now (K-55).
+     */
+    async importScopeFrom(actor, input, dump, judge) {
         this.refuseUnusableScopeStores(dump.stores, input.vertical ?? null);
+        if (judge)
+            await this.refuseDumpRoles(input.tenantId, null, dump);
         // Create the destination scope (directory row + DO + lazy migrate); the DO then
         // replaces its provisioned schema with the dump wholesale (drop-then-replay), so
         // the end state is the dump, at the source's frontier. Provenance is stamped from
@@ -2069,6 +2152,8 @@ export class CloudflareScopeHost {
         if (!existing)
             throw substratError('not_found', `unknown scope ${scopeId} in tenant ${tenantId}`);
         this.refuseUnusableScopeStores(dump.stores, existing.vertical);
+        // #2555: judged before the fence, so a refused restore moves nothing.
+        await this.refuseDumpRoles(tenantId, scopeId, dump);
         // #2314: the load replaces the scope's rows, so the orphan sweep is fenced first.
         await this.fenceOrphanSweep(scopeId, tenantId);
         // #1742: a dump from before a switch was pulled brings the module's grants back live, so
@@ -2135,15 +2220,16 @@ export class CloudflareScopeHost {
             throw substratError('not_found', `unknown scope ${scopeId} in tenant ${tenantId}`);
         const dump = await this.admin.exportScope(actor, tenantId, scopeId);
         const snapshotId = ulid();
-        await this.importScope(actor, {
+        await this.importScopeFrom(actor, {
             tenantId,
             scopeId: snapshotId,
             kind: opts?.kind ?? 'archive',
             vertical: source.vertical,
+            verticalSource: 'copy',
             jurisdiction: source.jurisdiction,
             expiresAt: opts?.expiresAt,
             // forkedFrom/forkedAt are stamped from the dump by importScope.
-        }, dump);
+        }, dump, false);
         // Bind the snapshot to the source's current version so it is a runnable copy at the
         // same frontier (a fresh bind, so it never re-triggers the snapshot path).
         if (source.verticalVersionId) {
@@ -3126,7 +3212,9 @@ export class CloudflareScopeHost {
         }
         return report;
     }
-    async runDueSchedules(moduleId, tenantId, scopeId) {
+    async runDueSchedules(moduleId, tenantId, scopeId, 
+    /** #2517: what the sweep tick's earlier calls did to this scope (`ScopeHost.runDueSchedules`). */
+    tick) {
         const report = { fired: 0, skipped: 0, failed: 0, errors: [], runs: [] };
         const schedules = this.moduleSchedules.get(moduleId);
         if (!schedules || schedules.length === 0)
@@ -3181,6 +3269,10 @@ export class CloudflareScopeHost {
         // scope at once. `ScheduleRunReport.platformRequests` says what that does and does not count.
         let platformRequests = 0;
         const counted = { onPlatformRequests: (n) => (platformRequests += n) };
+        // #2517: the part of that the purge runs enqueued, which is what defers a later purge head the
+        // cap refuses (`runPurgePass`): this call's, on top of what the tick's earlier calls report.
+        const earlierPurgeRequests = tick?.earlierPurgeRequests ?? 0;
+        let purgeRequests = 0;
         for (const schedule of schedules) {
             const last = await stub.scheduleLastRun(schedule.operation);
             const lastRun = last ? Date.parse(last) : null;
@@ -3215,12 +3307,24 @@ export class CloudflareScopeHost {
                     // call and transaction — and the SCOPE decides which are due and runs them, so purge
                     // authority is never an argument any stub can pass (`runPurgeSweep`).
                     // #2192: under the run's own id, so the purges and their deliveries join this run's line.
-                    // #2431: the purges' own requests run inside the scope, which reports no count for them;
-                    // the deliveries their events route to the platform are counted below, as an invoke's are.
-                    const pass = await door.through((instance) => stub.runPurgeSweep(schedule.operation, tenantId, scopeId, instance, invocationId));
+                    // #2431, #2440: the scope reports the requests its purges enqueued (`pass.platformRequests`),
+                    // and the deliveries their events route to the platform are counted below, as an invoke's are.
+                    // #2517: with what the purge runs before this one in the tick enqueued, so a head the cap
+                    // refuses because they filled the queue is deferred to the next tick rather than failed.
+                    const pass = await door.through((instance) => stub.runPurgeSweep(schedule.operation, tenantId, scopeId, instance, invocationId, earlierPurgeRequests + purgeRequests));
+                    if (pass.deferred) {
+                        // Ran nothing: no line, no cadence row, `skipped` like any run that did not happen.
+                        report.skipped += 1;
+                        report.deferred = (report.deferred ?? 0) + 1;
+                        report.runs.push({ operation: schedule.operation, outcome: 'skipped' });
+                        continue;
+                    }
+                    platformRequests += pass.platformRequests ?? 0;
+                    purgeRequests += pass.platformRequests ?? 0;
                     // The purges' events, delivered the way each invoke's own tail delivers them.
                     const delivered = await this.drainExecutors(tenantId, scopeId, invocationId);
                     platformRequests += delivered.routedToPlatform ?? 0;
+                    purgeRequests += delivered.routedToPlatform ?? 0;
                     stillDue = purgeStillDue(pass);
                     const outcome = purgeReportOf(schedule.operation, schedule.purge.entityType, pass);
                     report.errors.push(...outcome.errors);
@@ -3274,6 +3378,8 @@ export class CloudflareScopeHost {
         lines.end();
         if (platformRequests > 0)
             report.platformRequests = platformRequests;
+        if (purgeRequests > 0)
+            report.purgeRequests = purgeRequests;
         return report;
     }
     /** The stub body, shared by the principal, connection, system and impersonation doors. */
@@ -3594,6 +3700,19 @@ export class CloudflareScopeHost {
             archivedFromStatus: (r.archived_from_status ?? null),
             createdAt: r.created_at,
         });
+        // The directory rows `listScopes` and `listScopesReadable` map, filtered and paged alike.
+        const scopeRows = (filter) => this.cp.listScopes({
+            tenantId: filter?.tenantId,
+            status: filter?.status
+                ? Array.isArray(filter.status)
+                    ? filter.status
+                    : [filter.status]
+                : undefined,
+            vertical: filter?.vertical,
+            limit: filter?.limit,
+            cursor: filter?.cursor,
+            order: filter?.order,
+        });
         // The (version, scope) pair a bind and its impact read both start from, and the refusals
         // that come before any export-break question, in the order the bind makes them (#1756).
         const bindTarget = async (tenantId, scopeId, versionId) => {
@@ -4166,7 +4285,19 @@ export class CloudflareScopeHost {
             canStoreSecrets: isSecretBoxConfigured(this.secretBox),
             defineRole: async (actor, tenantId, role) => {
                 const parsed = roleDefinition.parse(role);
-                const before = await this.cp.defineRole(tenantId, parsed);
+                // #2447: judged in the ControlPlaneDO's unit, against this host's keys and the tenant's other
+                // roles, so a role assigned through a door cannot be widened afterwards. A refusal writes
+                // nothing, so a seat of the role as it was stored keeps working.
+                const context = await this.definitionContext(tenantId, parsed);
+                if (context.unreadable)
+                    throw substratError('forbidden', `role '${parsed.key}' cannot be judged: ${context.unreadable}`);
+                // `defineRoleOrRefusal`, not the legacy `defineRole` an older coordinator reads. A ControlPlaneDO from
+                // before #2447, met in a deploy's restart window, has no such method, so the call fails loudly rather
+                // than being misread.
+                const defined = await this.cp.defineRoleOrRefusal(tenantId, parsed, context.reservation, context.seatedInScopes);
+                if ('refused' in defined)
+                    throw substratError('forbidden', defined.refused);
+                const before = defined.before;
                 await this.recordAdmin(actor, 'defineRole', { tenantId }, before, parsed);
                 await this.fanOut(tenantId); // role definitions are projected into the tenant's scopes
             },
@@ -4607,8 +4738,7 @@ export class CloudflareScopeHost {
                     }
                     throw substratError('conflict', `vertical '${parsed.slug}' is already registered as ${existing.source}`);
                 }
-                await this.cp.insertVertical(parsed.slug, parsed.name, parsed.source, parsed.ownerTenant, envSpecJson, installSpecJson, parsed.listed ? 1 : 0, new Date().toISOString());
-                await this.recordAdmin(actor, 'registerVertical', { tenantId: null }, null, parsed);
+                await this.cp.insertVertical(parsed.slug, parsed.name, parsed.source, parsed.ownerTenant, envSpecJson, installSpecJson, parsed.listed ? 1 : 0, verticalOwnerNow(), this.adminEntry(actor, 'registerVertical', { tenantId: null }, null, parsed));
             },
             listVerticals: async (actor, page) => {
                 const rows = await this.cp.listVerticals(page);
@@ -4624,7 +4754,9 @@ export class CloudflareScopeHost {
                 // Lands PENDING — a push is not a deploy — except for a PRIVATE vertical
                 // (tenant-owned, not listed), whose blast radius is its own tenant: there the
                 // sandbox contract is the gate and the version self-admits, noted so the
-                // publish seam can tell a staff vouch from this shortcut.
+                // publish seam can tell a staff vouch from this shortcut. The DO judges it again on the
+                // vertical as the insert's unit reads it, and that is what the row and the version carry
+                // (#2528); this read answers an older DO, which takes what it is sent.
                 const selfAdmits = owning.owner_tenant !== null && !owning.listed;
                 // The manifest is retained for the serving upload (#286), not audited — a whole
                 // manifest per publish would drown the admin log in bundle metadata.
@@ -4645,14 +4777,13 @@ export class CloudflareScopeHost {
                     admission: selfAdmits ? 'admitted' : 'pending',
                     admissionNote: selfAdmits ? AUTO_ADMISSION_NOTE : null,
                     createdAt: new Date().toISOString(),
-                });
-                await this.recordAdmin(actor, 'publishVersion', { tenantId: null }, null, {
+                }, this.adminEntry(actor, 'publishVersion', { tenantId: null }, null, {
                     ...audited,
                     // The digest the registry holds, which differs from the pushed one only for an unheld version.
                     migrationDigest,
                     ...(origin ? { origin } : {}),
                     admission: selfAdmits ? 'admitted' : 'pending',
-                });
+                }));
             },
             verticalScopeStores: async (actor, verticalSlug) => {
                 const stores = await this.directory('verticalScopeStores', verticalSlug);
@@ -4671,90 +4802,43 @@ export class CloudflareScopeHost {
                 await this.recordAccess(actor, 'getVersion', {}, { versionId, verticalSlug }, hit ? 1 : 0);
                 return hit ? mapVersion(hit) : undefined;
             },
+            // #2528: each vertical write below is one DO call that reads the row's `before`, and runs its
+            // guard, in the unit that writes; it refuses an unknown vertical with not_found.
             setVerticalListed: async (actor, slug, listed) => {
-                const existing = await this.cp.readVertical(slug);
-                if (!existing)
-                    throw substratError('not_found', `unknown vertical '${slug}'`);
-                // Listing is the moment other tenants start trusting this code, so the
-                // version they would install must carry a real staff vouch — an auto-admitted
-                // prod version has never been read by anyone but its author.
-                if (listed) {
-                    const prod = await this.cp.readChannel(slug, 'prod');
-                    const prodVersion = prod ? await this.cp.readVersion(prod.version_id) : undefined;
-                    if (prodVersion?.admission_note === AUTO_ADMISSION_NOTE) {
-                        throw substratError('conflict', `vertical '${slug}' prod version ${prodVersion.id} is auto-admitted (private self-serve) — ` +
-                            `a staff admit must vouch for it before listing`);
-                    }
-                }
-                await this.cp.updateVerticalListed(slug, listed ? 1 : 0); // also resolves any pending request
-                await this.recordAdmin(actor, 'setVerticalListed', { tenantId: null }, { listed: !!existing.listed }, { listed });
+                // Listing is the moment other tenants start trusting this code, so the version they
+                // would install must carry a real staff vouch — an auto-admitted prod version has never
+                // been read by anyone but its author. The DO refuses one; it also resolves any pending
+                // publish request.
+                await this.directory('updateVerticalListed', slug, listed ? 1 : 0, this.adminEntry(actor, 'setVerticalListed', { tenantId: null }, null, { listed }));
             },
             requestPublish: async (actor, slug) => {
-                const existing = await this.cp.readVertical(slug);
-                if (!existing)
-                    throw substratError('not_found', `unknown vertical '${slug}'`);
-                await this.cp.updateVerticalPublishRequest(slug, new Date().toISOString());
-                await this.recordAdmin(actor, 'requestPublish', { tenantId: null }, null, { slug });
+                await this.directory('updateVerticalPublishRequest', slug, new Date().toISOString(), this.adminEntry(actor, 'requestPublish', { tenantId: null }, null, { slug }));
             },
             setVerticalInstallsBlocked: async (actor, slug, blocked) => {
-                const existing = await this.cp.readVertical(slug);
-                if (!existing)
-                    throw substratError('not_found', `unknown vertical '${slug}'`);
-                await this.cp.updateVerticalInstallsBlocked(slug, blocked ? 1 : 0);
-                await this.recordAdmin(actor, 'setVerticalInstallsBlocked', { tenantId: null }, { installsBlocked: !!existing.installs_blocked }, { installsBlocked: blocked });
+                await this.directory('updateVerticalInstallsBlocked', slug, blocked ? 1 : 0, this.adminEntry(actor, 'setVerticalInstallsBlocked', { tenantId: null }, null, { installsBlocked: blocked }));
             },
             setVerticalTenantProvisioner: async (actor, slug, granted) => {
-                const existing = await this.cp.readVertical(slug);
-                if (!existing)
-                    throw substratError('not_found', `unknown vertical '${slug}'`);
-                await this.cp.updateVerticalTenantProvisioner(slug, granted ? 1 : 0);
-                await this.recordAdmin(actor, 'setVerticalTenantProvisioner', { tenantId: null }, { tenantProvisioner: !!existing.tenant_provisioner }, { tenantProvisioner: granted });
+                await this.directory('updateVerticalTenantProvisioner', slug, granted ? 1 : 0, this.adminEntry(actor, 'setVerticalTenantProvisioner', { tenantId: null }, null, { tenantProvisioner: granted }));
             },
             setVerticalEmailSender: async (actor, slug, granted) => {
-                const existing = await this.cp.readVertical(slug);
-                if (!existing)
-                    throw substratError('not_found', `unknown vertical '${slug}'`);
-                await this.cp.updateVerticalEmailSender(slug, granted ? 1 : 0);
-                await this.recordAdmin(actor, 'setVerticalEmailSender', { tenantId: null }, { emailSender: !!existing.email_sender }, { emailSender: granted });
+                await this.directory('updateVerticalEmailSender', slug, granted ? 1 : 0, this.adminEntry(actor, 'setVerticalEmailSender', { tenantId: null }, null, { emailSender: granted }));
             },
             deleteVertical: async (actor, slug) => {
-                const existing = await this.cp.readVertical(slug);
-                if (!existing)
-                    throw substratError('not_found', `unknown vertical '${slug}'`);
-                // Refuse while any restorable scope is bound: a deleted registry row would strand
-                // those scopes' version pins and routing. An `archived` scope (a deleted app) still
-                // blocks — unarchive can bring it back — but the refusal names reap/restore, not
-                // "delete", because the app itself is already gone. `reaped` is terminal history and
-                // never blocks. Deployed dispatch scripts are NOT reaped here — they become orphans
-                // for the cleanup script (#248).
-                const bound = await this.cp.countScopesForVertical(slug);
-                if (bound.live > 0) {
-                    throw substratError('conflict', `vertical '${slug}' still backs ${bound.live} scope(s) — delete or rebind them first`);
-                }
-                if (bound.archived > 0) {
-                    throw substratError('conflict', `vertical '${slug}' still backs ${bound.archived} archived scope(s) — reap or restore them first`);
-                }
-                await this.cp.deleteVertical(slug);
-                await this.recordAdmin(actor, 'deleteVertical', { tenantId: null }, { slug, source: existing.source, ownerTenant: existing.owner_tenant }, null);
+                // Refused while any restorable scope is bound (the DO counts them in the delete's unit).
+                // `reaped` is terminal history and never blocks. Deployed dispatch scripts are NOT reaped
+                // here — they become orphans for the cleanup script (#248). #2501: the period's `until`
+                // is read here, on the clock its `since` was.
+                await this.directory('deleteVertical', slug, this.adminEntry(actor, 'deleteVertical', { tenantId: null }, null, null), verticalOwnerNow());
+            },
+            listVerticalOwners: async (actor, slug) => {
+                const periods = (await this.cp.listVerticalOwners(slug)).map((p) => verticalOwnerPeriod.parse(p));
+                await this.recordAccess(actor, 'listVerticalOwners', { tenantId: null }, { slug }, periods.length);
+                return periods;
             },
             admitVersion: async (actor, versionId) => {
-                const v = await this.cp.readVersion(versionId);
-                if (!v)
-                    throw substratError('not_found', `unknown version ${versionId}`);
-                if (v.admission === 'admitted') {
-                    // Idempotent — except an AUTO-admitted version, which this upgrades to a
-                    // manual vouch by clearing the note (what the publish seam requires).
-                    if (v.admission_note !== AUTO_ADMISSION_NOTE)
-                        return;
-                    await this.cp.setAdmission(versionId, 'admitted', null);
-                    await this.recordAdmin(actor, 'admitVersion', { tenantId: null }, { admission: v.admission, note: v.admission_note }, { admission: 'admitted', note: null });
-                    return;
-                }
-                if (v.admission === 'rejected') {
-                    throw substratError('conflict', `version ${versionId} was rejected — publish a new one`);
-                }
-                await this.cp.setAdmission(versionId, 'admitted', null);
-                await this.recordAdmin(actor, 'admitVersion', { tenantId: null }, { admission: v.admission }, { admission: 'admitted' });
+                // Judged in the DO's unit (#2528): idempotent on an admitted version, except an AUTO-admitted
+                // one, which it upgrades to a manual vouch; a rejected one is refused. The DO fills the row.
+                await this.directory('admitVersion', versionId, this.adminEntry(actor, 'admitVersion', { tenantId: null }, null, null));
             },
             promotionImpact: async (actor, verticalSlug, channel, versionId) => {
                 const incoming = await this.cp.readVersion(versionId);
@@ -4770,16 +4854,8 @@ export class CloudflareScopeHost {
                 return breaks;
             },
             rejectVersion: async (actor, versionId, note) => {
-                const v = await this.cp.readVersion(versionId);
-                if (!v)
-                    throw substratError('not_found', `unknown version ${versionId}`);
-                if (v.admission === 'admitted') {
-                    throw substratError('conflict', `version ${versionId} is already admitted — it may be bound`);
-                }
-                if (v.admission === 'rejected')
-                    return;
-                await this.cp.setAdmission(versionId, 'rejected', note);
-                await this.recordAdmin(actor, 'rejectVersion', { tenantId: null }, { admission: v.admission }, { admission: 'rejected', note });
+                // Judged in the DO's unit (#2528): an admitted version is refused, a rejected one is a no-op.
+                await this.directory('rejectVersion', versionId, note, this.adminEntry(actor, 'rejectVersion', { tenantId: null }, null, { admission: 'rejected', note }));
             },
             promoteVersion: async (actor, verticalSlug, channel, versionId, acknowledge) => {
                 const incoming = await this.cp.readVersion(versionId);
@@ -4853,7 +4929,8 @@ export class CloudflareScopeHost {
                 // in. The control plane moves the pointer, and writes the timeline row (what makes rollback a
                 // choice among recorded moments, and `at` the PITR anchor a data rollback would rewind to),
                 // only if the pointer still names `outgoing`; the promote that lost the race is refused as
-                // stale and writes nothing.
+                // stale and writes nothing. Its admin row commits with the move, ahead of the rebinds below,
+                // which record their own — and the acknowledgement is recorded, not just enforced.
                 const moved = await this.cp.moveChannel(outgoing?.id ?? null, {
                     id: ulid(),
                     vertical_slug: verticalSlug,
@@ -4862,7 +4939,7 @@ export class CloudflareScopeHost {
                     from_version_id: outgoing?.id ?? null,
                     actor,
                     at: promotedAt,
-                });
+                }, this.adminEntry(actor, 'promoteVersion', { tenantId: null, vertical: verticalSlug }, outgoing ? { versionId: outgoing.id, version: outgoing.version } : null, { channel, versionId, version: incoming.version, acknowledged: ack }));
                 if (!moved)
                     throw promoteRaceRefusal(channel);
                 // For a PRIVATE vertical, prod IS what the owner's apps run: re-point the
@@ -4892,7 +4969,6 @@ export class CloudflareScopeHost {
                     }
                     await this.cp.bindScopeVersion(s.scope_id, versionId, verticalSlug, undefined, undefined, undefined, undefined, undefined, this.adminEntry(actor, 'bindScopeVersion', { tenantId: s.tenant_id, scopeId: s.scope_id }, prev ? { versionId: prev.id, version: prev.version } : null, { versionId, vertical: verticalSlug, version: incoming.version, via: 'promoteVersion' }));
                 }
-                await this.recordAdmin(actor, 'promoteVersion', { tenantId: null, vertical: verticalSlug }, outgoing ? { versionId: outgoing.id, version: outgoing.version } : null, { channel, versionId, version: incoming.version, acknowledged: ack });
             },
             listChannels: async (actor, verticalSlug, page) => {
                 // `prod` is the only live channel (#509 retired dev/staging). Filter before the parse
@@ -5056,15 +5132,16 @@ export class CloudflareScopeHost {
                         await this.assertNoStrandFrom([r.serving_version_id], incoming.id, incoming, r.serving_ref ? await this.cp.provisionedVersionsOf(verticalSlug, { ref: r.serving_ref, versionId: r.serving_version_id }, null) : []);
                     }
                 }
-                await this.cp.setVerticalServing(verticalSlug, {
+                // #2528: a compare-and-set on the serving ref and version the gate above judged, across
+                // awaits another serve can run in. The DO fills the row's `before` from the state it moves.
+                const moved = await this.directory('setVerticalServing', verticalSlug, {
                     ref: parsed.ref,
                     versionId: parsed.versionId,
                     doClassesJson: JSON.stringify(parsed.doClasses),
                     migrationTag: parsed.migrationTag,
-                });
-                await this.recordAdmin(actor, 'setVerticalServing', { tenantId: null }, r.serving_ref
-                    ? { ref: r.serving_ref, versionId: r.serving_version_id }
-                    : null, { vertical: verticalSlug, ref: parsed.ref, versionId: parsed.versionId });
+                }, this.adminEntry(actor, 'setVerticalServing', { tenantId: null }, null, { vertical: verticalSlug, ref: parsed.ref, versionId: parsed.versionId }), { ref: r.serving_ref ?? null, versionId: r.serving_version_id ?? null });
+                if (!moved)
+                    throw servingRaceRefusal(verticalSlug);
             },
             versionManifest: async (actor, verticalSlug, versionId) => {
                 const v = await this.cp.readVersion(versionId);
@@ -5082,6 +5159,21 @@ export class CloudflareScopeHost {
                 await this.recordAccess(actor, 'versionMigrations', {}, { verticalSlug, versionId }, v.migrations?.length ?? 0);
                 return v.migrations;
             },
+            recordWireAuth: async (actor, input) => {
+                const row = deploymentWireAuth.parse(input);
+                const written = await this.cp.recordWireAuth(row, this.adminEntry(actor, 'recordWireAuth', { tenantId: null, vertical: row.verticalSlug }, null, { vertical: row.verticalSlug, deploymentRef: row.deploymentRef, versionId: row.versionId, record: row.record }));
+                // Thrown here, not in the directory's object, so the code survives the RPC.
+                if (!written)
+                    throw substratError('not_found', `no capability record for '${row.deploymentRef}': vertical '${row.verticalSlug}' is not registered`);
+            },
+            listWireAuth: async (actor, input) => {
+                // Judged here, before the call into the directory's object, so a refusal keeps its code; the
+                // judged copy is what crosses the RPC and reaches the log (its own fields, the reach first).
+                const filter = assertWireAuthFilter(input);
+                const rows = await this.cp.listWireAuth(filter);
+                await this.recordAccess(actor, 'listWireAuth', wireAuthAccessTarget(filter), filter, rows.length);
+                return rows;
+            },
             setScopeServingRef: async (actor, tenantId, scopeId, servingRef, opts) => {
                 const scope = await this.cp.getScopeRecord(tenantId, scopeId);
                 if (!scope)
@@ -5144,6 +5236,13 @@ export class CloudflareScopeHost {
                 await this.recordAccess(actor, 'scopeStoreSizes', { tenantId, scopeId }, null, sizes.length);
                 return sizes;
             },
+            scopeAttachmentBytes: async (actor, tenantId, scopeId) => {
+                // Reaped is refused, not read: addressing the deleted DO would recreate it.
+                await this.scopeRecordForRead(tenantId, scopeId);
+                const bytes = await this.scopeStub(scopeId).attachmentBytes();
+                await this.recordAccess(actor, 'scopeAttachmentBytes', { tenantId, scopeId }, null, 1);
+                return bytes;
+            },
             rewindScope: async (actor, tenantId, scopeId, bookmark, opts) => {
                 const scope = await this.cp.getScopeRecord(tenantId, scopeId);
                 if (!scope)
@@ -5228,31 +5327,26 @@ export class CloudflareScopeHost {
             },
             createTenant: async (actor, input) => {
                 const parsed = createTenantInput.parse(input);
-                const created = await this.directory('createTenant', parsed.id, parsed.slug, parsed.name, new Date().toISOString(), parsed.provisionedByTenant ?? null);
-                // Idempotent: re-creating an existing tenant is a no-op, not audited.
-                if (!created)
-                    return;
-                await this.recordAdmin(actor, 'createTenant', { tenantId: parsed.id }, null, created);
+                // Idempotent: re-creating an existing tenant is a no-op, not audited. The DO writes the
+                // row with the tenant it created as its `after`.
+                await this.directory('createTenant', parsed.id, parsed.slug, parsed.name, new Date().toISOString(), parsed.provisionedByTenant ?? null, this.adminEntry(actor, 'createTenant', { tenantId: parsed.id }, null, null));
             },
             setTenantStatus: async (actor, tenantId, status) => {
-                const before = await this.directory('setTenantStatus', tenantId, status);
-                await this.recordAdmin(actor, 'setTenantStatus', { tenantId }, { status: before }, { status });
+                // The DO fills the row's `before` with the status it read in the write's unit.
+                await this.directory('setTenantStatus', tenantId, status, this.adminEntry(actor, 'setTenantStatus', { tenantId }, null, { status }));
                 // #1713: every hosted scope under the tenant holds or resumes its work by this.
                 await this.deliverLifecycles(actor, { tenantId });
             },
             setTenantName: async (actor, tenantId, name) => {
-                const before = await this.directory('setTenantName', tenantId, name);
-                if (before === name)
-                    return; // no-op is not audited — nothing changed
-                await this.recordAdmin(actor, 'setTenantName', { tenantId }, { name: before }, { name });
+                // A rename to the current name writes nothing and is not audited; the DO fills `before`.
+                await this.directory('setTenantName', tenantId, name, this.adminEntry(actor, 'setTenantName', { tenantId }, null, { name }));
             },
             reapTenant: async (actor, tenantId) => {
                 // Directory-side terminal reap (§4.8). The caller reaped every scope's storage
                 // first (archive-if-needed → reapScope in the vertical deployment); the DO clears
                 // the tenant's PII/config rows and flips the row to a `reaped` tombstone, keeping
                 // the row + admin log. Only a `deleting` tenant may be reaped (checked in the DO).
-                const before = await this.directory('reapTenant', tenantId);
-                await this.recordAdmin(actor, 'reapTenant', { tenantId }, { status: before }, { status: 'reaped' });
+                await this.directory('reapTenant', tenantId, this.adminEntry(actor, 'reapTenant', { tenantId }, null, { status: 'reaped' }));
             },
             listTenants: async (actor, page) => {
                 const tenants = (await this.cp.listTenants(page)).map((t) => tenantSchema.parse(t));
@@ -5266,21 +5360,15 @@ export class CloudflareScopeHost {
                 return t ? tenantSchema.parse(t) : undefined;
             },
             listScopes: async (actor, filter) => {
-                const rows = await this.cp.listScopes({
-                    tenantId: filter?.tenantId,
-                    status: filter?.status
-                        ? Array.isArray(filter.status)
-                            ? filter.status
-                            : [filter.status]
-                        : undefined,
-                    vertical: filter?.vertical,
-                    limit: filter?.limit,
-                    cursor: filter?.cursor,
-                    order: filter?.order,
-                });
+                const rows = await scopeRows(filter);
                 await this.recordAccess(actor, 'listScopes', { tenantId: filter?.tenantId ?? null }, filter, rows.length);
                 return rows.map(mapScope);
             },
+            listScopesReadable: async (actor, filter) => {
+                const rows = await scopeRows(filter);
+                await this.recordAccess(actor, 'listScopesReadable', { tenantId: filter?.tenantId ?? null }, filter, rows.length);
+                return readableScopes(rows, mapScope);
+            },
             getScopeRecord: async (actor, tenantId, scopeId) => {
                 const row = await this.cp.getScopeRecord(tenantId, scopeId);
                 await this.recordAccess(actor, 'getScopeRecord', { tenantId, scopeId }, null, row ? 1 : 0);
@@ -5373,6 +5461,9 @@ export class CloudflareScopeHost {
             recordStoreDriverRebuildRun: async (actor, entry) => {
                 await this.recordAdmin(actor, 'rebuildStoreDriver', { tenantId: null }, null, entry);
             },
+            recordWireWalk: async (actor, entry) => {
+                await this.recordAdmin(actor, 'walkWireAuth', { tenantId: null }, null, entry);
+            },
             listScopeTables: async (actor, tenantId, scopeId) => {
                 // K-3 cross-check on the shared directory BEFORE reaching the scope DO: a pair
                 // that does not resolve is unreachable, never another tenant's database.
@@ -5984,6 +6075,7 @@ export class CloudflareScopeHost {
                     storage: rows.storage,
                     storageAttempts: rows.storageAttempts,
                     storeStorage: rows.storeStorage,
+                    attachmentStorage: rows.attachmentStorage,
                 });
                 // Tenants covered, not totals: "read one tenant's meter" and "metered the whole
                 // fleet" are different acts, and K-24 exists to tell them apart.
@@ -6388,7 +6480,10 @@ export class CloudflareScopeHost {
                 return rows.map((r) => adminLogEntry.parse(r));
             },
             recordOpsFailure: async (entry) => {
+                // #2540: a pair's staff row is minted first, so the tenant's row lists above it.
+                const detail = entry.tenantId && typeof entry.detail === 'string' ? { detail: entry.detail.slice(0, 2000), detail_id: ulid() } : {};
                 await this.cp.recordOpsFailure({
+                    ...detail,
                     id: ulid(),
                     actor: entry.actor,
                     operation: entry.operation,
@@ -6418,6 +6513,7 @@ export class CloudflareScopeHost {
                     code: filter?.code,
                     fingerprint: filter?.fingerprint,
                     reference: filter?.reference,
+                    referenceInText: filter?.referenceInText,
                     since: filter?.since,
                     until: filter?.until,
                     limit: filter?.limit,
@@ -6534,6 +6630,30 @@ export class CloudflareScopeHost {
                 return rows;
             },
             pruneScopeStorage: async (_actor, limit) => this.cp.pruneScopeStorage(assertRowLimit('limit', limit)),
+            recordRequestDay: async (_actor, input) => this.cp.recordRequestDay(input),
+            listRequestDays: async (actor, filter) => {
+                const rows = (await this.cp.listRequestDays(filter)).map((r) => requestDay.parse(r));
+                await this.recordAccess(actor, 'listRequestDays', { tenantId: filter?.tenantId ?? null, scopeId: filter?.scopeId ?? null }, filter ?? null, rows.length);
+                return rows;
+            },
+            listRequestRollupDays: async (actor, filter) => {
+                const rows = (await this.cp.listRequestRollupDays(filter)).map((r) => requestRollupDay.parse(r));
+                await this.recordAccess(actor, 'listRequestRollupDays', { tenantId: null }, filter ?? null, rows.length);
+                return rows;
+            },
+            pruneRequestDays: async (_actor, limit, retentionMonths) => this.cp.pruneRequestDays(assertRowLimit('limit', limit), retentionMonths),
+            recordMeterDay: async (_actor, input) => this.cp.recordMeterDay(input),
+            listMeterDays: async (actor, filter) => {
+                const rows = (await this.cp.listMeterDays(filter)).map((r) => meterDay.parse(r));
+                await this.recordAccess(actor, 'listMeterDays', { tenantId: filter?.tenantId ?? null }, filter ?? null, rows.length);
+                return rows;
+            },
+            listMeterDayTakes: async (actor, filter) => {
+                const rows = (await this.cp.listMeterDayTakes(filter)).map((r) => meterDayTake.parse(r));
+                await this.recordAccess(actor, 'listMeterDayTakes', { tenantId: null }, filter ?? null, rows.length);
+                return rows;
+            },
+            pruneMeterDays: async (_actor, limit, retentionMonths) => this.cp.pruneMeterDays(assertRowLimit('limit', limit), retentionMonths),
             recordModelUsage: async (input) => {
                 const l = input.line;
                 return this.cp.recordModelUsage({
@@ -6756,15 +6876,11 @@ export class CloudflareScopeHost {
             catch (err) {
                 report.failed += 1;
                 try {
-                    await this.admin.recordOpsFailure({
-                        actor,
-                        operation: 'scope.lifecycle',
-                        stage: 'deliver',
-                        tenantId,
-                        scopeId,
-                        message: `the lifecycle (scope ${t.scope_status}, tenant ${t.tenant_status}) did not reach the ` +
-                            `deployment serving this scope; the heal sweep will deliver it again: ${err instanceof Error ? err.message : String(err)}`,
-                    });
+                    // #2554: the throw is the deployment's or its runtime's text, and the deployment serving
+                    // a scope is the vertical's code, often another tenant's. The tenant's row says only what
+                    // happened; the text is staff's row, under the same reference.
+                    const missed = `the lifecycle (scope ${t.scope_status}, tenant ${t.tenant_status}) did not reach the deployment serving this scope; the heal sweep will deliver it again`;
+                    await this.admin.recordOpsFailure(withheldOpsFailure({ actor, operation: 'scope.lifecycle', stage: 'deliver', tenantId, scopeId }, `${missed}: ${err instanceof Error ? err.message : String(err)}`, (reference) => `${missed} (reference ${reference})`));
                 }
                 catch (recordErr) {
                     console.error('substrat: could not record a lifecycle delivery failure (#1713)', recordErr);
@@ -7564,6 +7680,14 @@ export class CloudflareScopeHost {
         // #2430: refused before anything is written, rather than at the top-up after the projection.
         if (input.entityGrants)
             await this.refuseReservedShapes(input.entityGrants, input.scopeId);
+        // #2447: the role set this provision defines, and the owner's seat in it — a person's seat, so
+        // the person's door — are judged before anything is written. A refusal fails the provision and
+        // writes nothing, so a seat a reconcile would have re-asserted is left exactly as it is.
+        const reserved = await this.refuseReservedRoleSet(input.roles, input.tenantId, input.scopeId);
+        const ownerRole = input.roles.find((r) => r.key === input.ownerRoleKey);
+        const ownerRefusal = ownerRole ? reservedRoleRefusal(ownerRole, reserved, 'person') : null;
+        if (ownerRefusal)
+            throw substratError('forbidden', `the owner's seat: ${ownerRefusal}`);
         const connections = await this.seatableConnectionGrants(input.tenantId, input.scopeId, input.connectionGrants);
         const services = await this.servicePrincipals?.(input.tenantId, input.scopeId);
         const stub = this.scopeStub(input.scopeId);
@@ -7639,6 +7763,136 @@ export class CloudflareScopeHost {
             ...(connections.skipped.length ? { skippedConnectionGrants: connections.skipped } : {}),
         };
     }
+    /**
+     * #2447: what a tenant's role definition is judged with, beyond the stored roles the ControlPlaneDO
+     * reads in its own unit:
+     * - the reservations of this host's modules, joined with the scope class's. Every scope on this
+     *   binding is one class, so one of the tenant's scopes answers for all, and the fan-out after
+     *   the write projects into exactly those scopes. A tenant with no scope yet is judged by this
+     *   host's modules alone (a stated residual: its first scope's projection is not judged again);
+     * - for a `holder: 'system'` definition of a key with no system-held definition stored (none at
+     *   all included: a seat can outlive its role's row), whether anyone but a system principal holds a
+     *   live scope-level seat in it in one of those scopes (the ControlPlaneDO reads the tenant-level
+     *   seats). No scope is asked for seats otherwise.
+     *
+     * Every scope that is not reaped is read, a scope archived straight from `provisioning` included:
+     * the platform's door seats into a provisioning scope, and unarchive brings the seat back. A DO
+     * cannot be asked anything without waking it, and waking one that never ran would create storage it
+     * never had (#1524), so such a scope is read only when its directory row records a migration
+     * (`schema_version` past `'0'`). That is not a mark of instantiation: it counts the module
+     * migrations applied, and is written only when a pass applied one, so a scope of a class with no
+     * module migrations reads `'0'` though it holds a seat. One that records none is not read, and the
+     * definition fails closed where that scope could decide it: `unreadable` names it, and the caller
+     * refuses a definition its seats, or its class's reservations when no other scope gives them, would
+     * decide. So while such a scope is the tenant's only one, every definition is refused until it is
+     * unarchived or reaped. No product path reaches this today: the dashboard is the one Cloudflare
+     * caller of `defineRole`, and its class has migrations.
+     *
+     * A stated residual: this half is read before the ControlPlaneDO's unit, not in it, so a scope-level
+     * seat made in between is not seen. The tenant-level seats and the stored roles are read in the unit.
+     */
+    async definitionContext(tenantId, role) {
+        const listed = await this.cp.listScopes({ tenantId, status: [...SEAT_HOLDING_SCOPE_STATUSES] });
+        const neverStored = (s) => (s.status === 'archived' || s.status === 'archiving') && s.archived_from_status === 'provisioning' && (s.schema_version ?? '0') === '0';
+        const scopes = listed.filter((s) => !neverStored(s));
+        const unreadableScope = listed.find(neverStored);
+        const unreadable = unreadableScope
+            ? `scope ${unreadableScope.scope_id} was archived straight from provisioning and records no migration, so its seats and its ` +
+                `class's reservations cannot be read without creating storage it may never have had. Unarchive it (or reap it) first`
+            : null;
+        const reservation = { reserved: [...this.reservedKeys], declared: [...this.declaredKeys] };
+        if (scopes.length > 0) {
+            const here = await this.scopeStub(scopes[0].scope_id).reservationHere();
+            reservation.reserved = [...new Set([...reservation.reserved, ...here.reserved])];
+            reservation.declared = [...new Set([...reservation.declared, ...here.declared])];
+        }
+        let seatedInScopes = false;
+        let seatsDecide = false;
+        if (role.holder === 'system') {
+            const stored = await this.cp.getRole(tenantId, role.key);
+            if (stored?.holder !== 'system') {
+                seatsDecide = true;
+                for (const s of scopes) {
+                    if ((await this.scopeStub(s.scope_id).roleStateHere(tenantId)).seated.includes(role.key)) {
+                        seatedInScopes = true;
+                        break;
+                    }
+                }
+            }
+        }
+        // Fail closed only where the unread scope could decide: its seats (a system-held definition the
+        // seats judge), or the class's reservations when no other scope gave them.
+        const decides = unreadable !== null && ((seatsDecide && !seatedInScopes) || scopes.length === 0);
+        return { reservation, seatedInScopes, unreadable: decides ? unreadable : null };
+    }
+    /**
+     * #2447: why `roles` may not be defined on `scopeId`, judged as a set against this host's
+     * reservations joined with the scope class's, or null. A restore asks it before it imports a dump,
+     * which replaces whatever the scope stores now, so what the set is judged against is the DUMP's
+     * roles and seats for `dump.tenantId` (`dumpRoleState`), when the caller has the dump in hand. A
+     * staged restore has not (its pages are already in the scope), so it is judged as a set alone
+     * here, and `projectRolesLocal` judges again after the import, against what the dump brought.
+     */
+    async roleSetRefusalLocal(scopeId, roles, dump) {
+        const here = await this.scopeStub(scopeId).reservationHere();
+        return reservedRoleSetRefusal(roles, { reserved: new Set([...this.reservedKeys, ...here.reserved]), declared: new Set([...this.declaredKeys, ...here.declared]) }, dump ? dumpRoleState(dump.tables, dump.tenantId, new Date().toISOString()) : undefined);
+    }
+    /**
+     * #2555: refuse loading `dump` into a scope of `tenantId` (`dumpRoleRefusal`): the tenant's roles as
+     * the directory stores them now, against the dump's role rows and seats, with this host's
+     * reservations joined with the scope class's. The class is read at `scopeId` when the scope exists
+     * (a restore), else at a live scope of the tenant (an import, whose scope is not created yet: asking
+     * its object would create storage for a scope a refusal leaves unmade).
+     *
+     * Two stated residuals. The directory is read here and the dump is loaded in the scope's own call,
+     * so a role defined between the two is not judged against the dump's seats. And an import for a
+     * tenant with no live scope reads no class, so it is judged with this host's reservations alone: the
+     * seat rule holds without them, and a key only the class reserves is not counted.
+     */
+    async refuseDumpRoles(tenantId, scopeId, dump) {
+        const classScope = scopeId ?? (await this.cp.listScopes({ tenantId, status: ['active', 'suspended'], limit: 1 }))[0]?.scope_id;
+        const [rows, here] = await Promise.all([
+            this.cp.listRoles({ tenantId }),
+            classScope ? this.scopeStub(classScope).reservationHere() : { reserved: [], declared: [] },
+        ]);
+        const roles = rows.map((r) => ({ key: r.role_key, permissions: JSON.parse(r.permissions), ...(r.holder ? { holder: r.holder } : {}) }));
+        const refusal = dumpRoleRefusal(roles, { reserved: new Set([...this.reservedKeys, ...here.reserved]), declared: new Set([...this.declaredKeys, ...here.declared]) }, dump, new Date().toISOString());
+        if (refusal)
+            throw substratError('forbidden', refusal);
+    }
+    /**
+     * #2446: the roles `scopeId` stores for `tenantId` and the role keys anyone but a system principal
+     * holds a live seat in there: what `refuseReservedRoleSet` judges a reconcile's role set against
+     * (`roleStateHere`), read for a promote to judge the incoming version's set with
+     * (`releaseRoleSetRefusal`) before it moves the scope. Read-only, and names no principal.
+     */
+    async roleStateLocal(tenantId, scopeId) {
+        return this.scopeStub(scopeId).roleStateHere(tenantId);
+    }
+    /**
+     * #2447: refuse a role set a CP-less provision or restore defines on `scopeId` for `tenantId`
+     * (`reservedRoleSetRefusal`), against this host's reservations joined with the scope class's,
+     * and the roles the scope stores for the tenant now with their seats there. Answers the reserved
+     * keys it judged with, for the seats the same call makes.
+     *
+     * A stated residual: the scope state is read in one RPC (`roleStateHere`) and written in another
+     * (`applyProjectionReply`), so a seat made between the two is not seen. The window is one call
+     * wide, and a reconcile runs again every pass.
+     */
+    async refuseReservedRoleSet(roles, tenantId, scopeId) {
+        const stub = this.scopeStub(scopeId);
+        const [here, state] = await Promise.all([stub.reservationHere(), stub.roleStateHere(tenantId)]);
+        const reserved = new Set([...this.reservedKeys, ...here.reserved]);
+        const refusal = reservedRoleSetRefusal(roles, { reserved, declared: new Set([...this.declaredKeys, ...here.declared]) }, 
+        // #2531: with the tombstones the scope keeps, so a system-held role a release dropped is judged
+        // as the stored definition it was. A ScopeDO from before them answers none.
+        { roles: state.roles, seated: new Set(state.seated), ...(state.dropped ? { dropped: state.dropped } : {}) });
+        // Named by tenant and scope as well as role: a release push admitted can be refused here at every
+        // scope where the role is seated, and staff find each one by this line (K-55).
+        if (refusal)
+            throw substratError('forbidden', `tenant ${tenantId}, scope ${scopeId}: the vertical's roles cannot be defined here: ${refusal}`);
+        return reserved;
+    }
     /**
      * #2430: the delivered connection grants a provision or reconcile may seat, and those it skips. A
      * connection acts for the external provider holding its token, so a grant naming a key reserved
@@ -7734,15 +7988,26 @@ export class CloudflareScopeHost {
      * storage. Idempotent (writeTuple is INSERT OR REPLACE). `roleKey` must be one the scope
      * already projected (via `provisionScopeLocal`), or the local checker expands it to nothing.
      */
-    async assignScopeRole(scopeId, principal, roleKey) {
-        // #2430: a platform door, as `HostAdmin.assignRole` is — a role mixing reserved and other keys
-        // is refused, against the scope class's own reservations and the role as the checker reads it
-        // for the tenant the scope's receipt names (`reservedRoleRefusalHere` says what happens without one).
-        const refusal = await this.scopeStub(scopeId).reservedRoleRefusalHere(roleKey, 'platform');
+    async assignScopeRole(scopeId, principal, roleKey, 
+    /** #2447: `person` when the caller knows it seats a person (the owner hand-over); the platform's door otherwise. */
+    door = 'platform') {
+        // #2430: a platform door by default, as `HostAdmin.assignRole` is — a role mixing reserved and
+        // other keys is refused, against the scope class's own reservations and the role as the checker
+        // reads it for the tenant the scope's receipt names (`reservedRoleRefusalHere` says what happens
+        // without one). The person's door also refuses any reserved key and a system-held role (#2447).
+        const refusal = await this.scopeStub(scopeId).reservedRoleRefusalHere(roleKey, door);
         if (refusal)
             throw substratError('forbidden', refusal);
         unwrapReply(await this.scopeStub(scopeId).writeTuple(`principal:${principal}`, `role:${roleKey}`, `scope:${scopeId}`, null));
     }
+    /**
+     * #2447: why `roleKey` may not be seated at scope level through `door`, or null — the question
+     * `assignScopeRole` asks before it writes, for a caller (the owner hand-over) that must ask it
+     * before anything else moves.
+     */
+    async scopeRoleRefusal(scopeId, roleKey, door) {
+        return this.scopeStub(scopeId).reservedRoleRefusalHere(roleKey, door);
+    }
     /**
      * Take a scope-level role back — the counterpart `assignScopeRole` went without (#1161).
      * A tombstone, exactly as `HostAdmin.unassignRole` writes for a scope-level assignment:
@@ -7904,6 +8169,17 @@ export class CloudflareScopeHost {
      * so a caller falls back rather than failing a dispatch over a missing file.
      */
     async connectorAttachmentOpenLocal(connectionId, tenantId, scopeId, attachmentId, eventId) {
+        return (await this.connectorReadSurface(connectionId, tenantId, scopeId, eventId)).open(attachmentId);
+    }
+    /**
+     * `connectorAttachmentOpenLocal`, with the bytes as a stream read from R2 as the platform reads
+     * the response (#2514). The same gates, in the same order, before the bucket is touched.
+     */
+    async connectorAttachmentOpenStreamLocal(connectionId, tenantId, scopeId, attachmentId, eventId) {
+        return (await this.connectorReadSurface(connectionId, tenantId, scopeId, eventId)).openStream(attachmentId);
+    }
+    /** The attachment surface the platform's reads as a connection go through, behind their gates. */
+    async connectorReadSurface(connectionId, tenantId, scopeId, eventId) {
         // Same gate as the upload leg: a held scope's bytes are not read out of its bucket.
         await this.assertLive(tenantId, scopeId);
         await this.migrateAndRecord(scopeId);
@@ -7911,7 +8187,7 @@ export class CloudflareScopeHost {
         return this.buildAttachmentSurface({ connectionId }, tenantId, scopeId, store, 
         // #726 remedy B: the platform named a delivery; this deployment decides what that
         // delivery reaches, from its own spine row. Absent ⇒ the ordinary grant check.
-        eventId === undefined ? undefined : { eventId }).open(attachmentId);
+        eventId === undefined ? undefined : { eventId });
     }
     /**
      * The delivery half of `grantToConnection` for a scope served HERE (#574): write