@substrat-run/adapter-cloudflare 0.160.0 → 0.161.0

package/dist/host.js

@@ -3,7 +3,7 @@ import { isRewindRefusal, REWIND_REFUSED } from './rewind-refusal.js';
 import { isSystemDoorMoved, SYSTEM_DOOR_MOVED, SYSTEM_DOOR_REGATES } from './system-door.js';
 import { delegatedReadParams, operationSeriesCount, fromWireFailure, isSubstratError, exportReadInput, exportedBatch, importBatch, importResult, importState, importsOfManifestJson, connectionLandingsOfManifestJson, exportsOfManifestJson, assertNoBindingShapeBreak, importCursorMove, importCursorMoveAt, importCursorMoved, accessLogEntry, adminLogEntry, opsFailureEntry, opsFailureFingerprint, issueEntry, findingEntry, findingRuleEntry, sweepRunEntry, FRESHNESS_HEARTBEAT_MINUTES, sweepRunsPayload, modelUsageEntry, createTenantInput, identityLink, identityPool, createOrgInput, promotionAcknowledgement, bindAcknowledgement, bindHostnameInput, channelHistoryEntry, hostnameBinding, publishVersionInput, AUTO_ADMISSION_NOTE, registerVerticalInput, vertical as verticalSchema, verticalServingState, deploymentWireAuth, verticalChannel, verticalVersion, connection, capabilityExchange, mintedCapability, boundedBecomeMint, boundedBecomeRevoke, boundedUnbind, entityRef, becomeLinkState, principalBecomeCapabilityInput, capabilityGrant, principalId, connectionGrant, connectionGrantRecord, connectionSecret, systemGrant, systemSwitch, systemSwitchOutcome, systemScheduleEntry, systemSwitchRecord, entitlementGrant, entitlementGrantInput, capabilityFilter, instant, meterReading, scopeStorageSample, requestDay, requestRollupDay, meterDay, meterDayTake, verticalOwnerPeriod, subjectRef, createConnectionInput, connectLinkFilter, connectLinkKey, consumeConnectLinkInput, mintConnectLinkInput, projectedConnectionGrant, projectedConnectionKey, moduleManifest, org as orgSchema, orgMembership, resolvedIdentity, identityMembership, roleDefinition, scope as scopeSchema, tenant as tenantSchema, tenantRole, delegatedReadRecord, ownerTransferAudit, memberChangeAudit, peerBindingAudit, connectionBindingAudit, copyMarkAudit, orphanSweepAudit, subjectShredReceipt, connectorDispatchKind, callsOfManifestJson, outboundOfManifestJson, SCOPE_GATE_REASONS, substratError, redrainEventsInput, coverage, peerCoverage, peerGrantsEntry, peerSwitch, peerSwitchOutcome, verticalCaller, verticalResolution, peerInstanceResolution, peerBinding as peerBindingSchema, verticalSlug, entityObjectRef, ATTACHMENT_BLOB_BINDING, blobStoreBindingName, lifecycleDelivery, scopeLifecycle, } from '@substrat-run/contracts';
 import { normalizeHostname, toRouteTarget } from './route-resolver.js';
-import { attachmentBlobKey, normalizeUploadMediaType, redeemOrReplayUploadLink, attachmentSha256, isSizedByteStream, putAttachmentBytes, entitlementDenial, requiredEntitlementFor, foldMeterReading, parseValidationRecords, readableScopes, resolveScopeRecord, ulid, withheldOpsFailure, KEPT_COPY_REFUSAL, capabilityTokenHash, checkBecomeInput, assertBecomeLinkStateIds, plausibleSessionToken, foldModelUsage, backoffAt, resolveRetryPolicy, executorOutcomeOf, isDeliveryRefusal, refusalJournalText, isSecretBoxConfigured, unconfiguredSecretBox, createSubjectKeys, generateSealingKeyPair, openSealed, ImpersonationRefused, assertSessionUsable, impersonationRowValues, mapImpersonationRow, newImpersonationSession, jobRunOf, assertLeaseMs, runDueJobRuns, SYSTEM_DOOR_WAIT, startJobRun, attachmentTextJob, assertAttachmentExtractors, resolveAttachmentTextBounds, assertJobRegistrable, ATTACHMENT_TEXT_BACKFILL_JOB, ATTACHMENT_TEXT_JOB, kernelJobFor, attachmentTextBackfillJob, searchLimit, searchMatchExpression, globalFetch, fetchLikeOf, deadlineFetch, assertRedrainWindow, platformRequestOf, undrainedEventsOf, inUnitMovesToAudit, staleCarryRevertRow, staleCarryReverts, recordedOffFromWire, peerSubjectRef, SWITCH_KINDS, reassertActionOf, reassertEntry, reassertOffRow, reassertOnRow, switchActionOf, switchAuditSubject, recordAuditOutcome, auditedCapabilityRevoke, auditWarningOf, switchNotFoundMessage, recordWriteSuperseded, switchSubjectOf, switchSupersededMessage, withRecorded, systemSwitchedOffMessage, tenantSystemSwitchedOffMessage, CrossVerticalRegistry, importCursorSourceOf, exportBreaksOf, exportBreakRefusal, assertPromoteReviewCurrent, promoteRaceRefusal, rebindRaceRefusal, bindExportBreaksOf, bindExportBreakRefusal, scopeMoveOf, runningVersionOf, strandJudgmentsOf, boundShapesOfColumn, installReconciled, collectPeers, peerCallerAt, peerSeats, connectorCallRecord, noopConnectorCallRecorder, recordConnectorCall, settleConnectionUse, splitManifestMigrations, publishedMigrationDigest, migrationChangeRefusal, unknownRoleError, assertRowLimit, assertRowOffset, emptyImportResult, INERT_SCOPE_REASON, lifecycleReceipt, lifecycleRefusal, scopeNotHeldRefusal, isPrimaryScope, isPrimaryScopeRow, asyncInvocationId, asyncLinePass, assertNoCallerPurge, purgeReportOf, purgeStillDue, assertBoundOperations, registerTrashTargets, assertModuleDeclared, noteDeclaredKeys, noteReservedKeys, reservedGrantRefusal, reservedRoleRefusal, reservedRoleSetRefusal, reservedShapeRefusal, SEAT_HOLDING_SCOPE_STATUSES, dumpRoleState, memberAddedAudit, shapeTopUpBatch, verticalOwnerNow, } from '@substrat-run/kernel';
+import { attachmentBlobKey, normalizeUploadMediaType, redeemOrReplayUploadLink, attachmentSha256, bytesStream, isSizedByteStream, openAttachmentByteStream, putAttachmentBytes, entitlementDenial, requiredEntitlementFor, foldMeterReading, parseValidationRecords, readableScopes, resolveScopeRecord, ulid, withheldOpsFailure, KEPT_COPY_REFUSAL, capabilityTokenHash, checkBecomeInput, assertBecomeLinkStateIds, plausibleSessionToken, foldModelUsage, backoffAt, resolveRetryPolicy, executorOutcomeOf, isDeliveryRefusal, refusalJournalText, isSecretBoxConfigured, unconfiguredSecretBox, createSubjectKeys, generateSealingKeyPair, openSealed, ImpersonationRefused, assertSessionUsable, impersonationRowValues, mapImpersonationRow, newImpersonationSession, jobRunOf, assertLeaseMs, runDueJobRuns, SYSTEM_DOOR_WAIT, startJobRun, attachmentTextJob, assertAttachmentExtractors, resolveAttachmentTextBounds, assertJobRegistrable, ATTACHMENT_TEXT_BACKFILL_JOB, ATTACHMENT_TEXT_JOB, kernelJobFor, attachmentTextBackfillJob, searchLimit, searchMatchExpression, globalFetch, fetchLikeOf, deadlineFetch, assertRedrainWindow, platformRequestOf, undrainedEventsOf, inUnitMovesToAudit, staleCarryRevertRow, staleCarryReverts, recordedOffFromWire, peerSubjectRef, SWITCH_KINDS, reassertActionOf, reassertEntry, reassertOffRow, reassertOnRow, switchActionOf, switchAuditSubject, recordAuditOutcome, auditedCapabilityRevoke, auditWarningOf, switchNotFoundMessage, recordWriteSuperseded, switchSubjectOf, switchSupersededMessage, withRecorded, systemSwitchedOffMessage, tenantSystemSwitchedOffMessage, CrossVerticalRegistry, importCursorSourceOf, exportBreaksOf, exportBreakRefusal, assertPromoteReviewCurrent, promoteRaceRefusal, servingRaceRefusal, rebindRaceRefusal, bindExportBreaksOf, bindExportBreakRefusal, scopeMoveOf, runningVersionOf, strandJudgmentsOf, boundShapesOfColumn, installReconciled, collectPeers, peerCallerAt, peerSeats, connectorCallRecord, noopConnectorCallRecorder, recordConnectorCall, settleConnectionUse, splitManifestMigrations, publishedMigrationDigest, migrationChangeRefusal, unknownRoleError, assertRowLimit, assertRowOffset, emptyImportResult, INERT_SCOPE_REASON, lifecycleReceipt, lifecycleRefusal, scopeNotHeldRefusal, isPrimaryScope, isPrimaryScopeRow, asyncInvocationId, asyncLinePass, assertNoCallerPurge, purgeReportOf, purgeStillDue, assertBoundOperations, registerTrashTargets, assertModuleDeclared, noteDeclaredKeys, noteReservedKeys, reservedGrantRefusal, reservedRoleRefusal, reservedRoleSetRefusal, reservedShapeRefusal, SEAT_HOLDING_SCOPE_STATUSES, dumpRoleRefusal, dumpRoleState, memberAddedAudit, shapeTopUpBatch, verticalOwnerNow, } from '@substrat-run/kernel';
 import { fenceAttachmentSweep, missingAttachmentStore, sweepOrphanAttachments, unsettledCopyRefusal } from '@substrat-run/kernel';
 import { assertWireAuthFilter, wireAuthAccessTarget, COPY_RESTORE_FENCE_LAPSED, scopeScriptCopyOf } from '@substrat-run/kernel';
 import { attributedView, isModuleErasureCounts, moduleErasurePlan, moduleRowsErased, callReservedStoreOperation, callScopeStore, observeStoreCall, replayStoreErasures, scopeStoreLifecycleOf, scopeStoreRunnersOf } from '@substrat-run/kernel';
@@ -349,11 +349,11 @@ const DOOR_WORDS = {
 };
 /** #2029: the rewind hold's key for one subject — a module's id, bare as #1819 stored it, or `vertical:<slug>`. */
 const holdKeyOf = (kind, key) => (kind === 'system' ? key : peerSubjectRef(key));
-/** #2541: a vertical-side size read's answer, or the refusal when the scope's own object said it holds nothing (`null`). */
-function heldOrRefused(scopeId, size) {
-    if (size === null)
+/** #2541, #2544: a vertical-side read's answer, or the refusal when the scope's own object said it holds nothing (`null`). */
+function heldOrRefused(scopeId, answer) {
+    if (answer === null)
         throw substratError('conflict', scopeNotHeldRefusal(scopeId));
-    return size;
+    return answer;
 }
 export class CloudflareScopeHost {
     admin;
@@ -578,7 +578,8 @@ export class CloudflareScopeHost {
                     grants: async () => (await this.connectionGrantsInScope(tenantId, scopeId))
                         .filter((g) => g.connectionId === open.id)
                         .map((g) => g.permission),
-                    openAttachment: (attachmentId) => this.getConnectorAttachments(open.id, scopeId, { eventId }).then((a) => a.open(attachmentId)),
+                    openAttachment: async (attachmentId) => (await this.getConnectorAttachments(open.id, scopeId, { eventId })).open(attachmentId),
+                    openAttachmentStream: async (attachmentId) => (await this.getConnectorAttachments(open.id, scopeId, { eventId })).openStream(attachmentId),
                     // #687: open a cell the scope sealed TO this connection. The keyId-indexed
                     // map goes in, never out — a connector receives the plaintext of one cell,
                     // not a private key it could mislay. Retired keys are in the map too, so a
@@ -1005,14 +1006,29 @@ export class CloudflareScopeHost {
      * gate (the caller is the control plane, which did the K-3 check + audit on its side).
      */
     async introspectScopeTables(scopeId) {
-        return this.scopeStub(scopeId).introspectTables();
+        return heldOrRefused(scopeId, await this.scopeStub(scopeId).introspectTablesIfHeld());
     }
+    /**
+     * The Data view's table page (#2563): refused `conflict` with the shared sentence for a scope the
+     * deployment does not hold, as the reads above are, never answered as an empty store. The carry
+     * and its cleanup read a wiped copy's tombstone, which is not held by design: they use
+     * `readTombstoneTable`.
+     */
     async introspectScopeTable(scopeId, input) {
+        const reply = heldOrRefused(scopeId, await this.scopeStub(scopeId).introspectTableIfHeld(input.table, input.limit, input.offset));
+        return unwrapReply(reply);
+    }
+    /**
+     * A table of a store this deployment may no longer HOLD, for the carry and its cleanup, which ask
+     * a wiped copy whether it carries the `carried_away` tombstone (#2563). Not guarded: a wiped copy
+     * answers nothing else. Not for a screen or a console; those use `introspectScopeTable`.
+     */
+    async readTombstoneTable(scopeId, input) {
         return unwrapReply(await this.scopeStub(scopeId).introspectTableReply(input.table, input.limit, input.offset));
     }
-    /** The SQL console's CP-less path (#219) — same trust line as the pair above. */
+    /** The SQL console's CP-less path (#219): guarded as the table page is (#2563). */
     async introspectScopeQuery(scopeId, input) {
-        return unwrapReply(await this.scopeStub(scopeId).introspectQueryReply(input.sql));
+        return unwrapReply(heldOrRefused(scopeId, await this.scopeStub(scopeId).introspectQueryIfHeld(input.sql)));
     }
     /**
      * The K-35 denial log's CP-less path (#867) — same trust line as the reads above.
@@ -1333,39 +1349,39 @@ export class CloudflareScopeHost {
     }
     /** Facet this host's own scope's outbox (#1239) — the vertical-host read. */
     async facetEventsLocal(scopeId, input) {
-        return this.scopeStub(scopeId).facetEvents(input);
+        return heldOrRefused(scopeId, await this.scopeStub(scopeId).facetEventsIfHeld(input));
     }
     /** What one event set off (#1237) on this host's own scope — the vertical-host read. */
     async eventEffectsLocal(scopeId, input) {
-        return this.scopeStub(scopeId).eventEffects(input);
+        return heldOrRefused(scopeId, await this.scopeStub(scopeId).eventEffectsIfHeld(input));
     }
     /** Everything one call emitted (#1237) on this host's own scope — the vertical-host read. */
     async invocationEventsLocal(scopeId, input) {
-        return this.scopeStub(scopeId).invocationEvents(input);
+        return heldOrRefused(scopeId, await this.scopeStub(scopeId).invocationEventsIfHeld(input));
     }
     /** Every delivery that gave up (#1525) on this host's own scope — the vertical-host read. */
     async deadLettersLocal(scopeId, input) {
-        return this.scopeStub(scopeId).deadLetters(input);
+        return heldOrRefused(scopeId, await this.scopeStub(scopeId).deadLettersIfHeld(input));
     }
     /** One entity's lifecycle replayed (#1744) on this host's own scope — the vertical-host read. */
     async lifecycleFlowLocal(scopeId, input) {
-        return this.scopeStub(scopeId).lifecycleFlow(input);
+        return heldOrRefused(scopeId, await this.scopeStub(scopeId).lifecycleFlowIfHeld(input));
     }
     /** Business volumes per bucket (#1750) on this host's own scope — the vertical-host read. */
     async operationSeriesLocal(scopeId, input) {
-        return this.scopeStub(scopeId).operationSeries(input);
+        return heldOrRefused(scopeId, await this.scopeStub(scopeId).operationSeriesIfHeld(input));
     }
     /** One event's causal chain (#1237) on this host's own scope — the vertical-host read. */
     async eventCauseLocal(scopeId, input) {
-        return this.scopeStub(scopeId).eventCause(input);
+        return heldOrRefused(scopeId, await this.scopeStub(scopeId).eventCauseIfHeld(input));
     }
     /** One record's event history (#1235) on this host's own scope — the vertical-host read. */
     async entityHistoryLocal(scopeId, input) {
-        return this.scopeStub(scopeId).entityHistory(input);
+        return heldOrRefused(scopeId, await this.scopeStub(scopeId).entityHistoryIfHeld(input));
     }
     /** When this host's own scope applied each migration (#1236) — the vertical-host read. */
     async appliedMigrationsLocal(scopeId) {
-        return this.scopeStub(scopeId).appliedMigrations();
+        return heldOrRefused(scopeId, await this.scopeStub(scopeId).appliedMigrationsIfHeld());
     }
     /**
      * This host's own scope's database size in bytes (#1524), the vertical-host read. A scope this
@@ -1418,7 +1434,8 @@ export class CloudflareScopeHost {
      * so a caller cannot ask this side for more than the other would.
      */
     async undrainedEventsLocal(scopeId, limit) {
-        return undrainedEventsOf(await this.scopeStub(scopeId).undrainedEventsRead(Math.min(Math.max(limit, 1), 1000)));
+        const bounded = Math.min(Math.max(limit, 1), 1000);
+        return undrainedEventsOf(heldOrRefused(scopeId, await this.scopeStub(scopeId).undrainedEventsReadIfHeld(bounded)));
     }
     /**
      * Stamp `drained_at` on this host's own scope (#1334) — the delegation's other half.
@@ -1444,7 +1461,7 @@ export class CloudflareScopeHost {
      * platform's `redrainEvents` is the door, and a count egresses nothing to record.
      */
     async redrainCountLocal(scopeId, drainedBefore) {
-        return this.scopeStub(scopeId).redrainCount(drainedBefore);
+        return heldOrRefused(scopeId, await this.scopeStub(scopeId).redrainCountIfHeld(drainedBefore));
     }
     /**
      * The PITR bookmarks one scope recorded before its migration passes (#286) — the
@@ -1452,7 +1469,7 @@ export class CloudflareScopeHost {
      * `/internal/bookmarks`; the control plane is the gate and the auditor.
      */
     async migrationBookmarksLocal(scopeId) {
-        return this.scopeStub(scopeId).migrationBookmarks();
+        return heldOrRefused(scopeId, await this.scopeStub(scopeId).migrationBookmarksIfHeld());
     }
     /**
      * Rewind one scope to a pre-migration bookmark (#286's backout) — schema AND data,
@@ -1940,19 +1957,28 @@ export class CloudflareScopeHost {
                 throw new Error(`connector attachment ${verb} is not delegated (#574) — upload and open are the ` +
                     `verbs that cross the /internal seam to the serving deployment`);
             };
+            const openArgs = (attachmentId) => ({
+                connectionId,
+                tenantId: tenant,
+                scopeId,
+                vertical,
+                attachmentId,
+                // #726 remedy B: the delivery, resolved at the far end against the
+                // deployment's own outbox. Absent outside a dispatch, where the ordinary
+                // permission check still applies.
+                eventId: forEvent?.eventId,
+            });
             return {
                 upload: (upload) => delegation.uploadAttachment({ connectionId, tenantId: tenant, scopeId, vertical, upload }),
-                open: (attachmentId) => delegation.openAttachment({
-                    connectionId,
-                    tenantId: tenant,
-                    scopeId,
-                    vertical,
-                    attachmentId,
-                    // #726 remedy B: the delivery, resolved at the far end against the
-                    // deployment's own outbox. Absent outside a dispatch, where the ordinary
-                    // permission check still applies.
-                    eventId: forEvent?.eventId,
-                }),
+                open: (attachmentId) => delegation.openAttachment(openArgs(attachmentId)),
+                // #2514: streamed over the seam when the embedder can. One that cannot reads the bytes whole,
+                // as `open` does, and hands them on as a stream, so the verb still works and holds what it did.
+                openStream: async (attachmentId) => {
+                    if (delegation.openAttachmentStream)
+                        return delegation.openAttachmentStream(openArgs(attachmentId));
+                    const opened = await delegation.openAttachment(openArgs(attachmentId));
+                    return opened && { record: opened.record, body: bytesStream(opened.body), contentType: opened.contentType };
+                },
                 list: notDelegated('list'),
                 remove: notDelegated('remove'),
                 // #1575: undelegated for `list`'s reason — a connector picks a document by id.
@@ -1999,6 +2025,10 @@ export class CloudflareScopeHost {
                     const record = unwrapReply(await stub.capabilityAttachmentOpen(attachmentId, hash, tenantId, scopeId));
                     return record ? this.openAttachmentBytes(store, scopeId, record) : null;
                 },
+                openStream: async (attachmentId) => {
+                    const record = unwrapReply(await stub.capabilityAttachmentOpen(attachmentId, hash, tenantId, scopeId));
+                    return record ? openAttachmentByteStream(store, attachmentBlobKey(scopeId, record.id), record, workerdSha256) : null;
+                },
                 remove: async (attachmentId) => unwrapReply(await stub.capabilityAttachmentRefuseWrite(hash, tenantId, scopeId, 'attachments.remove', {
                     attachmentId,
                 })),
@@ -2018,6 +2048,8 @@ export class CloudflareScopeHost {
         const asPrincipalId = ('principal' in subject
             ? subject.principal
             : subject.connectionId);
+        // The read gate, asked in the DO before the blob store is touched: a refused read never reaches it.
+        const authorizeRead = async (attachmentId) => unwrapReply(await stub.attachmentAuthorizeReply(attachmentId, 'read', asPrincipalId, tenantId, scopeId, connectionId, forEvent?.eventId));
         return {
             upload: async (input) => {
                 const id = ulid();
@@ -2044,9 +2076,14 @@ export class CloudflareScopeHost {
             },
             list: async (entity) => unwrapReply(await stub.attachmentListReply(entity, asPrincipalId, tenantId, scopeId, connectionId)),
             open: async (attachmentId) => {
-                const record = unwrapReply(await stub.attachmentAuthorizeReply(attachmentId, 'read', asPrincipalId, tenantId, scopeId, connectionId, forEvent?.eventId));
+                const record = await authorizeRead(attachmentId);
                 return record ? this.openAttachmentBytes(store, scopeId, record) : null;
             },
+            // #2514: the same gate, then the bytes as R2 reads them, checked against the record as they pass.
+            openStream: async (attachmentId) => {
+                const record = await authorizeRead(attachmentId);
+                return record ? openAttachmentByteStream(store, attachmentBlobKey(scopeId, record.id), record, workerdSha256) : null;
+            },
             remove: async (attachmentId) => {
                 const removed = unwrapReply(await stub.attachmentRemoveReply(attachmentId, asPrincipalId, tenantId, scopeId, connectionId));
                 if (removed)
@@ -2080,7 +2117,17 @@ export class CloudflareScopeHost {
         return { record, body: obj.body, contentType: obj.contentType ?? record.contentType };
     }
     async importScope(actor, input, dump) {
+        await this.importScopeFrom(actor, input, dump, true);
+    }
+    /**
+     * `importScope`, with its role judgement (#2555) when `judge`, made before the scope is created so a
+     * refused import leaves nothing behind. A snapshot passes false: it is the platform's copy of a live
+     * scope of this host, made at once, so its seats are the ones that scope holds now (K-55).
+     */
+    async importScopeFrom(actor, input, dump, judge) {
         this.refuseUnusableScopeStores(dump.stores, input.vertical ?? null);
+        if (judge)
+            await this.refuseDumpRoles(input.tenantId, null, dump);
         // Create the destination scope (directory row + DO + lazy migrate); the DO then
         // replaces its provisioned schema with the dump wholesale (drop-then-replay), so
         // the end state is the dump, at the source's frontier. Provenance is stamped from
@@ -2105,6 +2152,8 @@ export class CloudflareScopeHost {
         if (!existing)
             throw substratError('not_found', `unknown scope ${scopeId} in tenant ${tenantId}`);
         this.refuseUnusableScopeStores(dump.stores, existing.vertical);
+        // #2555: judged before the fence, so a refused restore moves nothing.
+        await this.refuseDumpRoles(tenantId, scopeId, dump);
         // #2314: the load replaces the scope's rows, so the orphan sweep is fenced first.
         await this.fenceOrphanSweep(scopeId, tenantId);
         // #1742: a dump from before a switch was pulled brings the module's grants back live, so
@@ -2171,7 +2220,7 @@ export class CloudflareScopeHost {
             throw substratError('not_found', `unknown scope ${scopeId} in tenant ${tenantId}`);
         const dump = await this.admin.exportScope(actor, tenantId, scopeId);
         const snapshotId = ulid();
-        await this.importScope(actor, {
+        await this.importScopeFrom(actor, {
             tenantId,
             scopeId: snapshotId,
             kind: opts?.kind ?? 'archive',
@@ -2180,7 +2229,7 @@ export class CloudflareScopeHost {
             jurisdiction: source.jurisdiction,
             expiresAt: opts?.expiresAt,
             // forkedFrom/forkedAt are stamped from the dump by importScope.
-        }, dump);
+        }, dump, false);
         // Bind the snapshot to the source's current version so it is a runnable copy at the
         // same frontier (a fresh bind, so it never re-triggers the snapshot path).
         if (source.verticalVersionId) {
@@ -4705,7 +4754,9 @@ export class CloudflareScopeHost {
                 // Lands PENDING — a push is not a deploy — except for a PRIVATE vertical
                 // (tenant-owned, not listed), whose blast radius is its own tenant: there the
                 // sandbox contract is the gate and the version self-admits, noted so the
-                // publish seam can tell a staff vouch from this shortcut.
+                // publish seam can tell a staff vouch from this shortcut. The DO judges it again on the
+                // vertical as the insert's unit reads it, and that is what the row and the version carry
+                // (#2528); this read answers an older DO, which takes what it is sent.
                 const selfAdmits = owning.owner_tenant !== null && !owning.listed;
                 // The manifest is retained for the serving upload (#286), not audited — a whole
                 // manifest per publish would drown the admin log in bundle metadata.
@@ -4751,67 +4802,33 @@ export class CloudflareScopeHost {
                 await this.recordAccess(actor, 'getVersion', {}, { versionId, verticalSlug }, hit ? 1 : 0);
                 return hit ? mapVersion(hit) : undefined;
             },
+            // #2528: each vertical write below is one DO call that reads the row's `before`, and runs its
+            // guard, in the unit that writes; it refuses an unknown vertical with not_found.
             setVerticalListed: async (actor, slug, listed) => {
-                const existing = await this.cp.readVertical(slug);
-                if (!existing)
-                    throw substratError('not_found', `unknown vertical '${slug}'`);
-                // Listing is the moment other tenants start trusting this code, so the
-                // version they would install must carry a real staff vouch — an auto-admitted
-                // prod version has never been read by anyone but its author.
-                if (listed) {
-                    const prod = await this.cp.readChannel(slug, 'prod');
-                    const prodVersion = prod ? await this.cp.readVersion(prod.version_id) : undefined;
-                    if (prodVersion?.admission_note === AUTO_ADMISSION_NOTE) {
-                        throw substratError('conflict', `vertical '${slug}' prod version ${prodVersion.id} is auto-admitted (private self-serve) — ` +
-                            `a staff admit must vouch for it before listing`);
-                    }
-                }
-                await this.cp.updateVerticalListed(slug, listed ? 1 : 0, // also resolves any pending request
-                this.adminEntry(actor, 'setVerticalListed', { tenantId: null }, { listed: !!existing.listed }, { listed }));
+                // Listing is the moment other tenants start trusting this code, so the version they
+                // would install must carry a real staff vouch — an auto-admitted prod version has never
+                // been read by anyone but its author. The DO refuses one; it also resolves any pending
+                // publish request.
+                await this.directory('updateVerticalListed', slug, listed ? 1 : 0, this.adminEntry(actor, 'setVerticalListed', { tenantId: null }, null, { listed }));
             },
             requestPublish: async (actor, slug) => {
-                const existing = await this.cp.readVertical(slug);
-                if (!existing)
-                    throw substratError('not_found', `unknown vertical '${slug}'`);
-                await this.cp.updateVerticalPublishRequest(slug, new Date().toISOString(), this.adminEntry(actor, 'requestPublish', { tenantId: null }, null, { slug }));
+                await this.directory('updateVerticalPublishRequest', slug, new Date().toISOString(), this.adminEntry(actor, 'requestPublish', { tenantId: null }, null, { slug }));
             },
             setVerticalInstallsBlocked: async (actor, slug, blocked) => {
-                const existing = await this.cp.readVertical(slug);
-                if (!existing)
-                    throw substratError('not_found', `unknown vertical '${slug}'`);
-                await this.cp.updateVerticalInstallsBlocked(slug, blocked ? 1 : 0, this.adminEntry(actor, 'setVerticalInstallsBlocked', { tenantId: null }, { installsBlocked: !!existing.installs_blocked }, { installsBlocked: blocked }));
+                await this.directory('updateVerticalInstallsBlocked', slug, blocked ? 1 : 0, this.adminEntry(actor, 'setVerticalInstallsBlocked', { tenantId: null }, null, { installsBlocked: blocked }));
             },
             setVerticalTenantProvisioner: async (actor, slug, granted) => {
-                const existing = await this.cp.readVertical(slug);
-                if (!existing)
-                    throw substratError('not_found', `unknown vertical '${slug}'`);
-                await this.cp.updateVerticalTenantProvisioner(slug, granted ? 1 : 0, this.adminEntry(actor, 'setVerticalTenantProvisioner', { tenantId: null }, { tenantProvisioner: !!existing.tenant_provisioner }, { tenantProvisioner: granted }));
+                await this.directory('updateVerticalTenantProvisioner', slug, granted ? 1 : 0, this.adminEntry(actor, 'setVerticalTenantProvisioner', { tenantId: null }, null, { tenantProvisioner: granted }));
             },
             setVerticalEmailSender: async (actor, slug, granted) => {
-                const existing = await this.cp.readVertical(slug);
-                if (!existing)
-                    throw substratError('not_found', `unknown vertical '${slug}'`);
-                await this.cp.updateVerticalEmailSender(slug, granted ? 1 : 0, this.adminEntry(actor, 'setVerticalEmailSender', { tenantId: null }, { emailSender: !!existing.email_sender }, { emailSender: granted }));
+                await this.directory('updateVerticalEmailSender', slug, granted ? 1 : 0, this.adminEntry(actor, 'setVerticalEmailSender', { tenantId: null }, null, { emailSender: granted }));
             },
             deleteVertical: async (actor, slug) => {
-                const existing = await this.cp.readVertical(slug);
-                if (!existing)
-                    throw substratError('not_found', `unknown vertical '${slug}'`);
-                // Refuse while any restorable scope is bound: a deleted registry row would strand
-                // those scopes' version pins and routing. An `archived` scope (a deleted app) still
-                // blocks — unarchive can bring it back — but the refusal names reap/restore, not
-                // "delete", because the app itself is already gone. `reaped` is terminal history and
-                // never blocks. Deployed dispatch scripts are NOT reaped here — they become orphans
-                // for the cleanup script (#248).
-                const bound = await this.cp.countScopesForVertical(slug);
-                if (bound.live > 0) {
-                    throw substratError('conflict', `vertical '${slug}' still backs ${bound.live} scope(s) — delete or rebind them first`);
-                }
-                if (bound.archived > 0) {
-                    throw substratError('conflict', `vertical '${slug}' still backs ${bound.archived} archived scope(s) — reap or restore them first`);
-                }
-                // #2501: the period's `until` is read here, on the clock its `since` was.
-                await this.cp.deleteVertical(slug, this.adminEntry(actor, 'deleteVertical', { tenantId: null }, { slug, source: existing.source, ownerTenant: existing.owner_tenant }, null), verticalOwnerNow());
+                // Refused while any restorable scope is bound (the DO counts them in the delete's unit).
+                // `reaped` is terminal history and never blocks. Deployed dispatch scripts are NOT reaped
+                // here — they become orphans for the cleanup script (#248). #2501: the period's `until`
+                // is read here, on the clock its `since` was.
+                await this.directory('deleteVertical', slug, this.adminEntry(actor, 'deleteVertical', { tenantId: null }, null, null), verticalOwnerNow());
             },
             listVerticalOwners: async (actor, slug) => {
                 const periods = (await this.cp.listVerticalOwners(slug)).map((p) => verticalOwnerPeriod.parse(p));
@@ -4819,21 +4836,9 @@ export class CloudflareScopeHost {
                 return periods;
             },
             admitVersion: async (actor, versionId) => {
-                const v = await this.cp.readVersion(versionId);
-                if (!v)
-                    throw substratError('not_found', `unknown version ${versionId}`);
-                if (v.admission === 'admitted') {
-                    // Idempotent — except an AUTO-admitted version, which this upgrades to a
-                    // manual vouch by clearing the note (what the publish seam requires).
-                    if (v.admission_note !== AUTO_ADMISSION_NOTE)
-                        return;
-                    await this.cp.setAdmission(versionId, 'admitted', null, this.adminEntry(actor, 'admitVersion', { tenantId: null }, { admission: v.admission, note: v.admission_note }, { admission: 'admitted', note: null }));
-                    return;
-                }
-                if (v.admission === 'rejected') {
-                    throw substratError('conflict', `version ${versionId} was rejected — publish a new one`);
-                }
-                await this.cp.setAdmission(versionId, 'admitted', null, this.adminEntry(actor, 'admitVersion', { tenantId: null }, { admission: v.admission }, { admission: 'admitted' }));
+                // Judged in the DO's unit (#2528): idempotent on an admitted version, except an AUTO-admitted
+                // one, which it upgrades to a manual vouch; a rejected one is refused. The DO fills the row.
+                await this.directory('admitVersion', versionId, this.adminEntry(actor, 'admitVersion', { tenantId: null }, null, null));
             },
             promotionImpact: async (actor, verticalSlug, channel, versionId) => {
                 const incoming = await this.cp.readVersion(versionId);
@@ -4849,15 +4854,8 @@ export class CloudflareScopeHost {
                 return breaks;
             },
             rejectVersion: async (actor, versionId, note) => {
-                const v = await this.cp.readVersion(versionId);
-                if (!v)
-                    throw substratError('not_found', `unknown version ${versionId}`);
-                if (v.admission === 'admitted') {
-                    throw substratError('conflict', `version ${versionId} is already admitted — it may be bound`);
-                }
-                if (v.admission === 'rejected')
-                    return;
-                await this.cp.setAdmission(versionId, 'rejected', note, this.adminEntry(actor, 'rejectVersion', { tenantId: null }, { admission: v.admission }, { admission: 'rejected', note }));
+                // Judged in the DO's unit (#2528): an admitted version is refused, a rejected one is a no-op.
+                await this.directory('rejectVersion', versionId, note, this.adminEntry(actor, 'rejectVersion', { tenantId: null }, null, { admission: 'rejected', note }));
             },
             promoteVersion: async (actor, verticalSlug, channel, versionId, acknowledge) => {
                 const incoming = await this.cp.readVersion(versionId);
@@ -5134,14 +5132,16 @@ export class CloudflareScopeHost {
                         await this.assertNoStrandFrom([r.serving_version_id], incoming.id, incoming, r.serving_ref ? await this.cp.provisionedVersionsOf(verticalSlug, { ref: r.serving_ref, versionId: r.serving_version_id }, null) : []);
                     }
                 }
-                await this.cp.setVerticalServing(verticalSlug, {
+                // #2528: a compare-and-set on the serving ref and version the gate above judged, across
+                // awaits another serve can run in. The DO fills the row's `before` from the state it moves.
+                const moved = await this.directory('setVerticalServing', verticalSlug, {
                     ref: parsed.ref,
                     versionId: parsed.versionId,
                     doClassesJson: JSON.stringify(parsed.doClasses),
                     migrationTag: parsed.migrationTag,
-                }, this.adminEntry(actor, 'setVerticalServing', { tenantId: null }, r.serving_ref
-                    ? { ref: r.serving_ref, versionId: r.serving_version_id }
-                    : null, { vertical: verticalSlug, ref: parsed.ref, versionId: parsed.versionId }));
+                }, this.adminEntry(actor, 'setVerticalServing', { tenantId: null }, null, { vertical: verticalSlug, ref: parsed.ref, versionId: parsed.versionId }), { ref: r.serving_ref ?? null, versionId: r.serving_version_id ?? null });
+                if (!moved)
+                    throw servingRaceRefusal(verticalSlug);
             },
             versionManifest: async (actor, verticalSlug, versionId) => {
                 const v = await this.cp.readVersion(versionId);
@@ -5161,7 +5161,10 @@ export class CloudflareScopeHost {
             },
             recordWireAuth: async (actor, input) => {
                 const row = deploymentWireAuth.parse(input);
-                await this.cp.recordWireAuth(row, this.adminEntry(actor, 'recordWireAuth', { tenantId: null, vertical: row.verticalSlug }, null, { vertical: row.verticalSlug, deploymentRef: row.deploymentRef, versionId: row.versionId, record: row.record }));
+                const written = await this.cp.recordWireAuth(row, this.adminEntry(actor, 'recordWireAuth', { tenantId: null, vertical: row.verticalSlug }, null, { vertical: row.verticalSlug, deploymentRef: row.deploymentRef, versionId: row.versionId, record: row.record }));
+                // Thrown here, not in the directory's object, so the code survives the RPC.
+                if (!written)
+                    throw substratError('not_found', `no capability record for '${row.deploymentRef}': vertical '${row.verticalSlug}' is not registered`);
             },
             listWireAuth: async (actor, input) => {
                 // Judged here, before the call into the directory's object, so a refusal keeps its code; the
@@ -5458,6 +5461,9 @@ export class CloudflareScopeHost {
             recordStoreDriverRebuildRun: async (actor, entry) => {
                 await this.recordAdmin(actor, 'rebuildStoreDriver', { tenantId: null }, null, entry);
             },
+            recordWireWalk: async (actor, entry) => {
+                await this.recordAdmin(actor, 'walkWireAuth', { tenantId: null }, null, entry);
+            },
             listScopeTables: async (actor, tenantId, scopeId) => {
                 // K-3 cross-check on the shared directory BEFORE reaching the scope DO: a pair
                 // that does not resolve is unreachable, never another tenant's database.
@@ -7831,6 +7837,29 @@ export class CloudflareScopeHost {
         const here = await this.scopeStub(scopeId).reservationHere();
         return reservedRoleSetRefusal(roles, { reserved: new Set([...this.reservedKeys, ...here.reserved]), declared: new Set([...this.declaredKeys, ...here.declared]) }, dump ? dumpRoleState(dump.tables, dump.tenantId, new Date().toISOString()) : undefined);
     }
+    /**
+     * #2555: refuse loading `dump` into a scope of `tenantId` (`dumpRoleRefusal`): the tenant's roles as
+     * the directory stores them now, against the dump's role rows and seats, with this host's
+     * reservations joined with the scope class's. The class is read at `scopeId` when the scope exists
+     * (a restore), else at a live scope of the tenant (an import, whose scope is not created yet: asking
+     * its object would create storage for a scope a refusal leaves unmade).
+     *
+     * Two stated residuals. The directory is read here and the dump is loaded in the scope's own call,
+     * so a role defined between the two is not judged against the dump's seats. And an import for a
+     * tenant with no live scope reads no class, so it is judged with this host's reservations alone: the
+     * seat rule holds without them, and a key only the class reserves is not counted.
+     */
+    async refuseDumpRoles(tenantId, scopeId, dump) {
+        const classScope = scopeId ?? (await this.cp.listScopes({ tenantId, status: ['active', 'suspended'], limit: 1 }))[0]?.scope_id;
+        const [rows, here] = await Promise.all([
+            this.cp.listRoles({ tenantId }),
+            classScope ? this.scopeStub(classScope).reservationHere() : { reserved: [], declared: [] },
+        ]);
+        const roles = rows.map((r) => ({ key: r.role_key, permissions: JSON.parse(r.permissions), ...(r.holder ? { holder: r.holder } : {}) }));
+        const refusal = dumpRoleRefusal(roles, { reserved: new Set([...this.reservedKeys, ...here.reserved]), declared: new Set([...this.declaredKeys, ...here.declared]) }, dump, new Date().toISOString());
+        if (refusal)
+            throw substratError('forbidden', refusal);
+    }
     /**
      * #2446: the roles `scopeId` stores for `tenantId` and the role keys anyone but a system principal
      * holds a live seat in there: what `refuseReservedRoleSet` judges a reconcile's role set against
@@ -7854,7 +7883,10 @@ export class CloudflareScopeHost {
         const stub = this.scopeStub(scopeId);
         const [here, state] = await Promise.all([stub.reservationHere(), stub.roleStateHere(tenantId)]);
         const reserved = new Set([...this.reservedKeys, ...here.reserved]);
-        const refusal = reservedRoleSetRefusal(roles, { reserved, declared: new Set([...this.declaredKeys, ...here.declared]) }, { roles: state.roles, seated: new Set(state.seated) });
+        const refusal = reservedRoleSetRefusal(roles, { reserved, declared: new Set([...this.declaredKeys, ...here.declared]) }, 
+        // #2531: with the tombstones the scope keeps, so a system-held role a release dropped is judged
+        // as the stored definition it was. A ScopeDO from before them answers none.
+        { roles: state.roles, seated: new Set(state.seated), ...(state.dropped ? { dropped: state.dropped } : {}) });
         // Named by tenant and scope as well as role: a release push admitted can be refused here at every
         // scope where the role is seated, and staff find each one by this line (K-55).
         if (refusal)
@@ -8137,6 +8169,17 @@ export class CloudflareScopeHost {
      * so a caller falls back rather than failing a dispatch over a missing file.
      */
     async connectorAttachmentOpenLocal(connectionId, tenantId, scopeId, attachmentId, eventId) {
+        return (await this.connectorReadSurface(connectionId, tenantId, scopeId, eventId)).open(attachmentId);
+    }
+    /**
+     * `connectorAttachmentOpenLocal`, with the bytes as a stream read from R2 as the platform reads
+     * the response (#2514). The same gates, in the same order, before the bucket is touched.
+     */
+    async connectorAttachmentOpenStreamLocal(connectionId, tenantId, scopeId, attachmentId, eventId) {
+        return (await this.connectorReadSurface(connectionId, tenantId, scopeId, eventId)).openStream(attachmentId);
+    }
+    /** The attachment surface the platform's reads as a connection go through, behind their gates. */
+    async connectorReadSurface(connectionId, tenantId, scopeId, eventId) {
         // Same gate as the upload leg: a held scope's bytes are not read out of its bucket.
         await this.assertLive(tenantId, scopeId);
         await this.migrateAndRecord(scopeId);
@@ -8144,7 +8187,7 @@ export class CloudflareScopeHost {
         return this.buildAttachmentSurface({ connectionId }, tenantId, scopeId, store, 
         // #726 remedy B: the platform named a delivery; this deployment decides what that
         // delivery reaches, from its own spine row. Absent ⇒ the ordinary grant check.
-        eventId === undefined ? undefined : { eventId }).open(attachmentId);
+        eventId === undefined ? undefined : { eventId });
     }
     /**
      * The delivery half of `grantToConnection` for a scope served HERE (#574): write