@substrat-run/adapter-cloudflare 0.160.0 → 0.162.0

package/dist/host.js

@@ -1,9 +1,9 @@
 import { env as ambientEnv } from 'cloudflare:workers';
 import { isRewindRefusal, REWIND_REFUSED } from './rewind-refusal.js';
 import { isSystemDoorMoved, SYSTEM_DOOR_MOVED, SYSTEM_DOOR_REGATES } from './system-door.js';
-import { delegatedReadParams, operationSeriesCount, fromWireFailure, isSubstratError, exportReadInput, exportedBatch, importBatch, importResult, importState, importsOfManifestJson, connectionLandingsOfManifestJson, exportsOfManifestJson, assertNoBindingShapeBreak, importCursorMove, importCursorMoveAt, importCursorMoved, accessLogEntry, adminLogEntry, opsFailureEntry, opsFailureFingerprint, issueEntry, findingEntry, findingRuleEntry, sweepRunEntry, FRESHNESS_HEARTBEAT_MINUTES, sweepRunsPayload, modelUsageEntry, createTenantInput, identityLink, identityPool, createOrgInput, promotionAcknowledgement, bindAcknowledgement, bindHostnameInput, channelHistoryEntry, hostnameBinding, publishVersionInput, AUTO_ADMISSION_NOTE, registerVerticalInput, vertical as verticalSchema, verticalServingState, deploymentWireAuth, verticalChannel, verticalVersion, connection, capabilityExchange, mintedCapability, boundedBecomeMint, boundedBecomeRevoke, boundedUnbind, entityRef, becomeLinkState, principalBecomeCapabilityInput, capabilityGrant, principalId, connectionGrant, connectionGrantRecord, connectionSecret, systemGrant, systemSwitch, systemSwitchOutcome, systemScheduleEntry, systemSwitchRecord, entitlementGrant, entitlementGrantInput, capabilityFilter, instant, meterReading, scopeStorageSample, requestDay, requestRollupDay, meterDay, meterDayTake, verticalOwnerPeriod, subjectRef, createConnectionInput, connectLinkFilter, connectLinkKey, consumeConnectLinkInput, mintConnectLinkInput, projectedConnectionGrant, projectedConnectionKey, moduleManifest, org as orgSchema, orgMembership, resolvedIdentity, identityMembership, roleDefinition, scope as scopeSchema, tenant as tenantSchema, tenantRole, delegatedReadRecord, ownerTransferAudit, memberChangeAudit, peerBindingAudit, connectionBindingAudit, copyMarkAudit, orphanSweepAudit, subjectShredReceipt, connectorDispatchKind, callsOfManifestJson, outboundOfManifestJson, SCOPE_GATE_REASONS, substratError, redrainEventsInput, coverage, peerCoverage, peerGrantsEntry, peerSwitch, peerSwitchOutcome, verticalCaller, verticalResolution, peerInstanceResolution, peerBinding as peerBindingSchema, verticalSlug, entityObjectRef, ATTACHMENT_BLOB_BINDING, blobStoreBindingName, lifecycleDelivery, scopeLifecycle, } from '@substrat-run/contracts';
+import { delegatedReadParams, operationSeriesCount, fromWireFailure, isSubstratError, exportReadInput, exportedBatch, importBatch, importResult, importState, importsOfManifestJson, connectionLandingsOfManifestJson, exportsOfManifestJson, assertNoBindingShapeBreak, importCursorMove, importCursorMoveAt, importCursorMoved, accessLogEntry, adminLogEntry, opsFailureEntry, opsFailureFingerprint, issueEntry, findingEntry, findingRuleEntry, sweepRunEntry, FRESHNESS_HEARTBEAT_MINUTES, sweepRunsPayload, modelUsageEntry, createTenantInput, identityLink, identityPool, createOrgInput, promotionAcknowledgement, bindAcknowledgement, bindHostnameInput, channelHistoryEntry, hostnameBinding, publishVersionInput, AUTO_ADMISSION_NOTE, registerVerticalInput, vertical as verticalSchema, verticalServingState, deploymentWireAuth, verticalChannel, verticalVersion, connection, capabilityExchange, mintedCapability, boundedBecomeMint, boundedBecomeRevoke, boundedUnbind, entityRef, becomeLinkState, principalBecomeCapabilityInput, capabilityGrant, principalId, connectionGrant, connectionGrantRecord, connectionSecret, systemGrant, systemSwitch, systemSwitchOutcome, systemScheduleEntry, systemSwitchRecord, entitlementGrant, entitlementGrantInput, capabilityFilter, instant, meterReading, scopeStorageSample, requestDay, requestRollupDay, meterDay, meterDayTake, verticalOwnerPeriod, subjectRef, createConnectionInput, connectLinkFilter, connectLinkKey, consumeConnectLinkInput, mintConnectLinkInput, projectedConnectionGrant, projectedConnectionKey, moduleManifest, org as orgSchema, orgMembership, resolvedIdentity, identityMembership, roleDefinition, scope as scopeSchema, tenant as tenantSchema, tenantRole, delegatedReadRecord, ownerTransferAudit, memberChangeAudit, peerBindingAudit, connectionBindingAudit, copyMarkAudit, orphanSweepAudit, subjectShredReceipt, connectorDispatchKind, callsOfManifestJson, outboundOfManifestJson, SCOPE_GATE_REASONS, substratError, errorCodeOf, redrainEventsInput, coverage, peerCoverage, peerGrantsEntry, peerSwitch, peerSwitchOutcome, verticalCaller, verticalResolution, peerInstanceResolution, peerBinding as peerBindingSchema, verticalSlug, entityObjectRef, ATTACHMENT_BLOB_BINDING, blobStoreBindingName, lifecycleDelivery, scopeLifecycle, } from '@substrat-run/contracts';
 import { normalizeHostname, toRouteTarget } from './route-resolver.js';
-import { attachmentBlobKey, normalizeUploadMediaType, redeemOrReplayUploadLink, attachmentSha256, isSizedByteStream, putAttachmentBytes, entitlementDenial, requiredEntitlementFor, foldMeterReading, parseValidationRecords, readableScopes, resolveScopeRecord, ulid, withheldOpsFailure, KEPT_COPY_REFUSAL, capabilityTokenHash, checkBecomeInput, assertBecomeLinkStateIds, plausibleSessionToken, foldModelUsage, backoffAt, resolveRetryPolicy, executorOutcomeOf, isDeliveryRefusal, refusalJournalText, isSecretBoxConfigured, unconfiguredSecretBox, createSubjectKeys, generateSealingKeyPair, openSealed, ImpersonationRefused, assertSessionUsable, impersonationRowValues, mapImpersonationRow, newImpersonationSession, jobRunOf, assertLeaseMs, runDueJobRuns, SYSTEM_DOOR_WAIT, startJobRun, attachmentTextJob, assertAttachmentExtractors, resolveAttachmentTextBounds, assertJobRegistrable, ATTACHMENT_TEXT_BACKFILL_JOB, ATTACHMENT_TEXT_JOB, kernelJobFor, attachmentTextBackfillJob, searchLimit, searchMatchExpression, globalFetch, fetchLikeOf, deadlineFetch, assertRedrainWindow, platformRequestOf, undrainedEventsOf, inUnitMovesToAudit, staleCarryRevertRow, staleCarryReverts, recordedOffFromWire, peerSubjectRef, SWITCH_KINDS, reassertActionOf, reassertEntry, reassertOffRow, reassertOnRow, switchActionOf, switchAuditSubject, recordAuditOutcome, auditedCapabilityRevoke, auditWarningOf, switchNotFoundMessage, recordWriteSuperseded, switchSubjectOf, switchSupersededMessage, withRecorded, systemSwitchedOffMessage, tenantSystemSwitchedOffMessage, CrossVerticalRegistry, importCursorSourceOf, exportBreaksOf, exportBreakRefusal, assertPromoteReviewCurrent, promoteRaceRefusal, rebindRaceRefusal, bindExportBreaksOf, bindExportBreakRefusal, scopeMoveOf, runningVersionOf, strandJudgmentsOf, boundShapesOfColumn, installReconciled, collectPeers, peerCallerAt, peerSeats, connectorCallRecord, noopConnectorCallRecorder, recordConnectorCall, settleConnectionUse, splitManifestMigrations, publishedMigrationDigest, migrationChangeRefusal, unknownRoleError, assertRowLimit, assertRowOffset, emptyImportResult, INERT_SCOPE_REASON, lifecycleReceipt, lifecycleRefusal, scopeNotHeldRefusal, isPrimaryScope, isPrimaryScopeRow, asyncInvocationId, asyncLinePass, assertNoCallerPurge, purgeReportOf, purgeStillDue, assertBoundOperations, registerTrashTargets, assertModuleDeclared, noteDeclaredKeys, noteReservedKeys, reservedGrantRefusal, reservedRoleRefusal, reservedRoleSetRefusal, reservedShapeRefusal, SEAT_HOLDING_SCOPE_STATUSES, dumpRoleState, memberAddedAudit, shapeTopUpBatch, verticalOwnerNow, } from '@substrat-run/kernel';
+import { attachmentBlobKey, normalizeUploadMediaType, redeemOrReplayUploadLink, attachmentSha256, bytesStream, isSizedByteStream, openAttachmentByteStream, putAttachmentBytes, entitlementDenial, requiredEntitlementFor, foldMeterReading, parseValidationRecords, readableScopes, resolveScopeRecord, ulid, withheldOpsFailure, KEPT_COPY_REFUSAL, capabilityTokenHash, checkBecomeInput, assertBecomeLinkStateIds, plausibleSessionToken, foldModelUsage, backoffAt, resolveRetryPolicy, executorOutcomeOf, isDeliveryRefusal, refusalJournalText, isSecretBoxConfigured, unconfiguredSecretBox, createSubjectKeys, generateSealingKeyPair, openSealed, ImpersonationRefused, assertSessionUsable, impersonationRowValues, mapImpersonationRow, newImpersonationSession, jobRunOf, assertLeaseMs, runDueJobRuns, SYSTEM_DOOR_WAIT, startJobRun, attachmentTextJob, assertAttachmentExtractors, resolveAttachmentTextBounds, assertJobRegistrable, ATTACHMENT_TEXT_BACKFILL_JOB, ATTACHMENT_TEXT_JOB, kernelJobFor, attachmentTextBackfillJob, searchLimit, searchMatchExpression, globalFetch, fetchLikeOf, deadlineFetch, assertRedrainWindow, platformRequestOf, undrainedEventsOf, inUnitMovesToAudit, staleCarryRevertRow, staleCarryReverts, recordedOffFromWire, peerSubjectRef, SWITCH_KINDS, reassertActionOf, reassertEntry, reassertOffRow, reassertOnRow, switchActionOf, switchAuditSubject, recordAuditOutcome, auditedCapabilityRevoke, auditWarningOf, switchNotFoundMessage, recordWriteSuperseded, switchSubjectOf, switchSupersededMessage, withRecorded, systemSwitchedOffMessage, tenantSystemSwitchedOffMessage, CrossVerticalRegistry, importCursorSourceOf, exportBreaksOf, exportBreakRefusal, assertPromoteReviewCurrent, promoteRaceRefusal, servingRaceRefusal, rebindRaceRefusal, bindExportBreaksOf, bindExportBreakRefusal, scopeMoveOf, runningVersionOf, strandJudgmentsOf, boundShapesOfColumn, installReconciled, collectPeers, peerCallerAt, peerSeats, connectorCallRecord, noopConnectorCallRecorder, recordConnectorCall, settleConnectionUse, splitManifestMigrations, publishedMigrationDigest, migrationChangeRefusal, unknownRoleError, assertRowLimit, assertRowOffset, emptyImportResult, INERT_SCOPE_REASON, lifecycleReceipt, lifecycleRefusal, scopeNotHeldRefusal, isPrimaryScope, isPrimaryScopeRow, asyncInvocationId, asyncLinePass, assertNoCallerPurge, purgeReportOf, purgeStillDue, assertBoundOperations, registerTrashTargets, assertModuleDeclared, noteDeclaredKeys, noteReservedKeys, reservedGrantRefusal, reservedRoleRefusal, reservedRoleSetRefusal, reservedShapeRefusal, SEAT_HOLDING_SCOPE_STATUSES, dumpRoleRefusal, dumpRoleState, memberAddedAudit, shapeTopUpBatch, verticalOwnerNow, } from '@substrat-run/kernel';
 import { fenceAttachmentSweep, missingAttachmentStore, sweepOrphanAttachments, unsettledCopyRefusal } from '@substrat-run/kernel';
 import { assertWireAuthFilter, wireAuthAccessTarget, COPY_RESTORE_FENCE_LAPSED, scopeScriptCopyOf } from '@substrat-run/kernel';
 import { attributedView, isModuleErasureCounts, moduleErasurePlan, moduleRowsErased, callReservedStoreOperation, callScopeStore, observeStoreCall, replayStoreErasures, scopeStoreLifecycleOf, scopeStoreRunnersOf } from '@substrat-run/kernel';
@@ -75,6 +75,10 @@ const connectionGrantsSkippedLine = (tenantId, scopeId, skipped) => ({
  * classification is the platform directory's; the vertical applies the same `isPrimaryScope` to
  * it, so a primary can be marked only by a request that misstates its lineage, never by default.
  */
+/** A vertical's role definitions as a CP-less projection writes them (`applyProjection`'s rows). */
+function projectedRoleRows(roles) {
+    return roles.map((r) => ({ role_key: r.key, permissions: JSON.stringify(r.permissions), source: r.source, holder: r.holder === 'system' ? 'system' : 'person' }));
+}
 function assertCopyLineage(lineage) {
     if (isPrimaryScope(lineage)) {
         throw substratError('conflict', 'mark-copy refused: the directory classifies this scope as primary, not as a copy');
@@ -349,11 +353,11 @@ const DOOR_WORDS = {
 };
 /** #2029: the rewind hold's key for one subject — a module's id, bare as #1819 stored it, or `vertical:<slug>`. */
 const holdKeyOf = (kind, key) => (kind === 'system' ? key : peerSubjectRef(key));
-/** #2541: a vertical-side size read's answer, or the refusal when the scope's own object said it holds nothing (`null`). */
-function heldOrRefused(scopeId, size) {
-    if (size === null)
+/** #2541, #2544: a vertical-side read's answer, or the refusal when the scope's own object said it holds nothing (`null`). */
+function heldOrRefused(scopeId, answer) {
+    if (answer === null)
         throw substratError('conflict', scopeNotHeldRefusal(scopeId));
-    return size;
+    return answer;
 }
 export class CloudflareScopeHost {
     admin;
@@ -578,7 +582,8 @@ export class CloudflareScopeHost {
                     grants: async () => (await this.connectionGrantsInScope(tenantId, scopeId))
                         .filter((g) => g.connectionId === open.id)
                         .map((g) => g.permission),
-                    openAttachment: (attachmentId) => this.getConnectorAttachments(open.id, scopeId, { eventId }).then((a) => a.open(attachmentId)),
+                    openAttachment: async (attachmentId) => (await this.getConnectorAttachments(open.id, scopeId, { eventId })).open(attachmentId),
+                    openAttachmentStream: async (attachmentId) => (await this.getConnectorAttachments(open.id, scopeId, { eventId })).openStream(attachmentId),
                     // #687: open a cell the scope sealed TO this connection. The keyId-indexed
                     // map goes in, never out — a connector receives the plaintext of one cell,
                     // not a private key it could mislay. Retired keys are in the map too, so a
@@ -1005,14 +1010,29 @@ export class CloudflareScopeHost {
      * gate (the caller is the control plane, which did the K-3 check + audit on its side).
      */
     async introspectScopeTables(scopeId) {
-        return this.scopeStub(scopeId).introspectTables();
+        return heldOrRefused(scopeId, await this.scopeStub(scopeId).introspectTablesIfHeld());
     }
+    /**
+     * The Data view's table page (#2563): refused `conflict` with the shared sentence for a scope the
+     * deployment does not hold, as the reads above are, never answered as an empty store. The carry
+     * and its cleanup read a wiped copy's tombstone, which is not held by design: they use
+     * `readTombstoneTable`.
+     */
     async introspectScopeTable(scopeId, input) {
+        const reply = heldOrRefused(scopeId, await this.scopeStub(scopeId).introspectTableIfHeld(input.table, input.limit, input.offset));
+        return unwrapReply(reply);
+    }
+    /**
+     * A table of a store this deployment may no longer HOLD, for the carry and its cleanup, which ask
+     * a wiped copy whether it carries the `carried_away` tombstone (#2563). Not guarded: a wiped copy
+     * answers nothing else. Not for a screen or a console; those use `introspectScopeTable`.
+     */
+    async readTombstoneTable(scopeId, input) {
         return unwrapReply(await this.scopeStub(scopeId).introspectTableReply(input.table, input.limit, input.offset));
     }
-    /** The SQL console's CP-less path (#219) — same trust line as the pair above. */
+    /** The SQL console's CP-less path (#219): guarded as the table page is (#2563). */
     async introspectScopeQuery(scopeId, input) {
-        return unwrapReply(await this.scopeStub(scopeId).introspectQueryReply(input.sql));
+        return unwrapReply(heldOrRefused(scopeId, await this.scopeStub(scopeId).introspectQueryIfHeld(input.sql)));
     }
     /**
      * The K-35 denial log's CP-less path (#867) — same trust line as the reads above.
@@ -1108,7 +1128,7 @@ export class CloudflareScopeHost {
      *  #2016: `tenantId`, the tenant the platform restores for: recorded as the scope's receipt in
      *  the load's own transaction, and a store provisioned for another tenant refuses the load. */
     opts) {
-        const out = await this.loadLocal(scopeId, opts, (load) => this.scopeStub(scopeId).importDumpChecked(tables, scopeId, load));
+        const out = await this.loadLocal(scopeId, opts, (load, repair) => repair ? this.scopeStub(scopeId).importDumpJudged(tables, scopeId, load, repair) : this.scopeStub(scopeId).importDumpChecked(tables, scopeId, load));
         return { ...out, tables: tables.length };
     }
     /**
@@ -1130,7 +1150,9 @@ export class CloudflareScopeHost {
     }
     /** `restoreScopeLocal` from the dump staged under `stageId` (#2450), with the same fences and answers. */
     async restoreStagedScopeLocal(scopeId, stageId, opts) {
-        return this.loadLocal(scopeId, opts, (load) => this.scopeStub(scopeId).commitStagedDumpChecked(stageId, scopeId, load));
+        return this.loadLocal(scopeId, opts, (load, repair) => repair
+            ? this.scopeStub(scopeId).commitStagedDumpJudged(stageId, scopeId, load, repair)
+            : this.scopeStub(scopeId).commitStagedDumpChecked(stageId, scopeId, load));
     }
     /** Drop the dump staged under `stageId` (#2450), if it is still there. */
     async discardStagedScopeLocal(scopeId, stageId) {
@@ -1140,6 +1162,11 @@ export class CloudflareScopeHost {
     async loadLocal(scopeId, opts, run) {
         if (opts?.markCopy)
             assertCopyLineage(opts.markCopy);
+        if (opts?.roles && !opts.tenantId) {
+            throw substratError('validation_failed', 'restore refused: a role repair needs the tenant it is projected for; nothing was loaded');
+        }
+        // #2531: the repair the load judges and projects in its own transaction.
+        const repair = opts?.roles && opts.tenantId ? { tenantId: opts.tenantId, roles: projectedRoleRows(opts.roles), judge: this.roleJudge() } : undefined;
         // #2314: a load replaces the scope's rows, so the orphan sweep is fenced first, as for a rewind.
         await this.fenceOrphanSweep(scopeId, opts?.tenantId);
         const carry = opts ? recordedOffFromWire(opts) : undefined;
@@ -1157,14 +1184,22 @@ export class CloudflareScopeHost {
             ...load,
             ...(opts?.expect ? { expect: opts.expect } : {}),
             ...(opts?.fence ? { fence: opts.fence } : {}),
-        });
+        }, repair);
         if (out.refused === false) {
-            return { tables: out.tables ?? 0, ...(carry ? { switchedOff: out.switchedOff } : {}) };
+            return {
+                tables: out.tables ?? 0,
+                ...(carry ? { switchedOff: out.switchedOff } : {}),
+                // Only a load that ran the judged method can say the repair landed in it.
+                ...(repair && out.rolesProjected === true ? { rolesProjected: true } : {}),
+            };
         }
         if (out.refused === 'kept')
             throw substratError('conflict', KEPT_COPY_REFUSAL);
         if (out.refused === 'tenant')
             throw substratError('conflict', out.message);
+        // #2531: the repair's role set, refused on the seats the load wrote; the whole load rolled back.
+        if (out.refused === 'roles')
+            throw substratError('conflict', `the vertical's roles cannot be defined here: ${out.message}`);
         if (out.refused === 'lapsed')
             throw substratError('precondition_failed', COPY_RESTORE_FENCE_LAPSED);
         // A retry of a load that already committed (its answer was lost on the way back) is
@@ -1295,9 +1330,33 @@ export class CloudflareScopeHost {
      * safe; scope-level tuples (the restored grants) are never touched.
      */
     async projectRolesLocal(tenantId, scopeId, roles) {
-        // #2447: the role set is defined here, so it is judged here, before anything is projected.
+        // #2447: the role set is defined here, so it is judged here, before anything is projected, and
+        // (#2531) again inside the projection's unit, on the seats the scope holds as it writes.
         await this.refuseReservedRoleSet(roles, tenantId, scopeId);
-        unwrapReply(await this.scopeStub(scopeId).applyProjectionReply(tenantId, roles.map((r) => ({ role_key: r.key, permissions: JSON.stringify(r.permissions), source: r.source, holder: r.holder === 'system' ? 'system' : 'person' })), []));
+        await this.projectJudged(tenantId, scopeId, projectedRoleRows(roles), []);
+    }
+    /**
+     * #2531: what this host's own modules reserve and declare, for a unit that judges a role set in the
+     * scope (`RoleJudge`); the scope class's are joined there.
+     */
+    roleJudge() {
+        return { reserved: [...this.reservedKeys], declared: [...this.declaredKeys] };
+    }
+    /**
+     * #2531: `applyProjectionReply` with the role set judged in its unit (`applyJudgedProjectionReply`).
+     * A refusal there answers with the staff-facing prefix `refuseReservedRoleSet` gives a pre-check's.
+     * A ScopeDO from before the judged method refuses the call itself, with nothing written.
+     */
+    async projectJudged(tenantId, scopeId, ...rest) {
+        try {
+            return unwrapReply(await this.scopeStub(scopeId).applyJudgedProjectionReply(this.roleJudge(), tenantId, ...rest));
+        }
+        catch (e) {
+            if (errorCodeOf(e) === 'forbidden') {
+                throw substratError('forbidden', `tenant ${tenantId}, scope ${scopeId}: the vertical's roles cannot be defined here: ${e.message}`);
+            }
+            throw e;
+        }
     }
     /**
      * Wipe one scope DO's storage in THIS deployment — the reap half of an orchestrated
@@ -1333,39 +1392,39 @@ export class CloudflareScopeHost {
     }
     /** Facet this host's own scope's outbox (#1239) — the vertical-host read. */
     async facetEventsLocal(scopeId, input) {
-        return this.scopeStub(scopeId).facetEvents(input);
+        return heldOrRefused(scopeId, await this.scopeStub(scopeId).facetEventsIfHeld(input));
     }
     /** What one event set off (#1237) on this host's own scope — the vertical-host read. */
     async eventEffectsLocal(scopeId, input) {
-        return this.scopeStub(scopeId).eventEffects(input);
+        return heldOrRefused(scopeId, await this.scopeStub(scopeId).eventEffectsIfHeld(input));
     }
     /** Everything one call emitted (#1237) on this host's own scope — the vertical-host read. */
     async invocationEventsLocal(scopeId, input) {
-        return this.scopeStub(scopeId).invocationEvents(input);
+        return heldOrRefused(scopeId, await this.scopeStub(scopeId).invocationEventsIfHeld(input));
     }
     /** Every delivery that gave up (#1525) on this host's own scope — the vertical-host read. */
     async deadLettersLocal(scopeId, input) {
-        return this.scopeStub(scopeId).deadLetters(input);
+        return heldOrRefused(scopeId, await this.scopeStub(scopeId).deadLettersIfHeld(input));
     }
     /** One entity's lifecycle replayed (#1744) on this host's own scope — the vertical-host read. */
     async lifecycleFlowLocal(scopeId, input) {
-        return this.scopeStub(scopeId).lifecycleFlow(input);
+        return heldOrRefused(scopeId, await this.scopeStub(scopeId).lifecycleFlowIfHeld(input));
     }
     /** Business volumes per bucket (#1750) on this host's own scope — the vertical-host read. */
     async operationSeriesLocal(scopeId, input) {
-        return this.scopeStub(scopeId).operationSeries(input);
+        return heldOrRefused(scopeId, await this.scopeStub(scopeId).operationSeriesIfHeld(input));
     }
     /** One event's causal chain (#1237) on this host's own scope — the vertical-host read. */
     async eventCauseLocal(scopeId, input) {
-        return this.scopeStub(scopeId).eventCause(input);
+        return heldOrRefused(scopeId, await this.scopeStub(scopeId).eventCauseIfHeld(input));
     }
     /** One record's event history (#1235) on this host's own scope — the vertical-host read. */
     async entityHistoryLocal(scopeId, input) {
-        return this.scopeStub(scopeId).entityHistory(input);
+        return heldOrRefused(scopeId, await this.scopeStub(scopeId).entityHistoryIfHeld(input));
     }
     /** When this host's own scope applied each migration (#1236) — the vertical-host read. */
     async appliedMigrationsLocal(scopeId) {
-        return this.scopeStub(scopeId).appliedMigrations();
+        return heldOrRefused(scopeId, await this.scopeStub(scopeId).appliedMigrationsIfHeld());
     }
     /**
      * This host's own scope's database size in bytes (#1524), the vertical-host read. A scope this
@@ -1418,7 +1477,8 @@ export class CloudflareScopeHost {
      * so a caller cannot ask this side for more than the other would.
      */
     async undrainedEventsLocal(scopeId, limit) {
-        return undrainedEventsOf(await this.scopeStub(scopeId).undrainedEventsRead(Math.min(Math.max(limit, 1), 1000)));
+        const bounded = Math.min(Math.max(limit, 1), 1000);
+        return undrainedEventsOf(heldOrRefused(scopeId, await this.scopeStub(scopeId).undrainedEventsReadIfHeld(bounded)));
     }
     /**
      * Stamp `drained_at` on this host's own scope (#1334) — the delegation's other half.
@@ -1444,7 +1504,7 @@ export class CloudflareScopeHost {
      * platform's `redrainEvents` is the door, and a count egresses nothing to record.
      */
     async redrainCountLocal(scopeId, drainedBefore) {
-        return this.scopeStub(scopeId).redrainCount(drainedBefore);
+        return heldOrRefused(scopeId, await this.scopeStub(scopeId).redrainCountIfHeld(drainedBefore));
     }
     /**
      * The PITR bookmarks one scope recorded before its migration passes (#286) — the
@@ -1452,7 +1512,7 @@ export class CloudflareScopeHost {
      * `/internal/bookmarks`; the control plane is the gate and the auditor.
      */
     async migrationBookmarksLocal(scopeId) {
-        return this.scopeStub(scopeId).migrationBookmarks();
+        return heldOrRefused(scopeId, await this.scopeStub(scopeId).migrationBookmarksIfHeld());
     }
     /**
      * Rewind one scope to a pre-migration bookmark (#286's backout) — schema AND data,
@@ -1940,19 +2000,28 @@ export class CloudflareScopeHost {
                 throw new Error(`connector attachment ${verb} is not delegated (#574) — upload and open are the ` +
                     `verbs that cross the /internal seam to the serving deployment`);
             };
+            const openArgs = (attachmentId) => ({
+                connectionId,
+                tenantId: tenant,
+                scopeId,
+                vertical,
+                attachmentId,
+                // #726 remedy B: the delivery, resolved at the far end against the
+                // deployment's own outbox. Absent outside a dispatch, where the ordinary
+                // permission check still applies.
+                eventId: forEvent?.eventId,
+            });
             return {
                 upload: (upload) => delegation.uploadAttachment({ connectionId, tenantId: tenant, scopeId, vertical, upload }),
-                open: (attachmentId) => delegation.openAttachment({
-                    connectionId,
-                    tenantId: tenant,
-                    scopeId,
-                    vertical,
-                    attachmentId,
-                    // #726 remedy B: the delivery, resolved at the far end against the
-                    // deployment's own outbox. Absent outside a dispatch, where the ordinary
-                    // permission check still applies.
-                    eventId: forEvent?.eventId,
-                }),
+                open: (attachmentId) => delegation.openAttachment(openArgs(attachmentId)),
+                // #2514: streamed over the seam when the embedder can. One that cannot reads the bytes whole,
+                // as `open` does, and hands them on as a stream, so the verb still works and holds what it did.
+                openStream: async (attachmentId) => {
+                    if (delegation.openAttachmentStream)
+                        return delegation.openAttachmentStream(openArgs(attachmentId));
+                    const opened = await delegation.openAttachment(openArgs(attachmentId));
+                    return opened && { record: opened.record, body: bytesStream(opened.body), contentType: opened.contentType };
+                },
                 list: notDelegated('list'),
                 remove: notDelegated('remove'),
                 // #1575: undelegated for `list`'s reason — a connector picks a document by id.
@@ -1999,6 +2068,10 @@ export class CloudflareScopeHost {
                     const record = unwrapReply(await stub.capabilityAttachmentOpen(attachmentId, hash, tenantId, scopeId));
                     return record ? this.openAttachmentBytes(store, scopeId, record) : null;
                 },
+                openStream: async (attachmentId) => {
+                    const record = unwrapReply(await stub.capabilityAttachmentOpen(attachmentId, hash, tenantId, scopeId));
+                    return record ? openAttachmentByteStream(store, attachmentBlobKey(scopeId, record.id), record, workerdSha256) : null;
+                },
                 remove: async (attachmentId) => unwrapReply(await stub.capabilityAttachmentRefuseWrite(hash, tenantId, scopeId, 'attachments.remove', {
                     attachmentId,
                 })),
@@ -2018,6 +2091,8 @@ export class CloudflareScopeHost {
         const asPrincipalId = ('principal' in subject
             ? subject.principal
             : subject.connectionId);
+        // The read gate, asked in the DO before the blob store is touched: a refused read never reaches it.
+        const authorizeRead = async (attachmentId) => unwrapReply(await stub.attachmentAuthorizeReply(attachmentId, 'read', asPrincipalId, tenantId, scopeId, connectionId, forEvent?.eventId));
         return {
             upload: async (input) => {
                 const id = ulid();
@@ -2044,9 +2119,14 @@ export class CloudflareScopeHost {
             },
             list: async (entity) => unwrapReply(await stub.attachmentListReply(entity, asPrincipalId, tenantId, scopeId, connectionId)),
             open: async (attachmentId) => {
-                const record = unwrapReply(await stub.attachmentAuthorizeReply(attachmentId, 'read', asPrincipalId, tenantId, scopeId, connectionId, forEvent?.eventId));
+                const record = await authorizeRead(attachmentId);
                 return record ? this.openAttachmentBytes(store, scopeId, record) : null;
             },
+            // #2514: the same gate, then the bytes as R2 reads them, checked against the record as they pass.
+            openStream: async (attachmentId) => {
+                const record = await authorizeRead(attachmentId);
+                return record ? openAttachmentByteStream(store, attachmentBlobKey(scopeId, record.id), record, workerdSha256) : null;
+            },
             remove: async (attachmentId) => {
                 const removed = unwrapReply(await stub.attachmentRemoveReply(attachmentId, asPrincipalId, tenantId, scopeId, connectionId));
                 if (removed)
@@ -2080,7 +2160,17 @@ export class CloudflareScopeHost {
         return { record, body: obj.body, contentType: obj.contentType ?? record.contentType };
     }
     async importScope(actor, input, dump) {
+        await this.importScopeFrom(actor, input, dump, true);
+    }
+    /**
+     * `importScope`, with its role judgement (#2555) when `judge`, made before the scope is created so a
+     * refused import leaves nothing behind. A snapshot passes false: it is the platform's copy of a live
+     * scope of this host, made at once, so its seats are the ones that scope holds now (K-55).
+     */
+    async importScopeFrom(actor, input, dump, judge) {
         this.refuseUnusableScopeStores(dump.stores, input.vertical ?? null);
+        if (judge)
+            await this.refuseDumpRoles(input.tenantId, null, dump);
         // Create the destination scope (directory row + DO + lazy migrate); the DO then
         // replaces its provisioned schema with the dump wholesale (drop-then-replay), so
         // the end state is the dump, at the source's frontier. Provenance is stamped from
@@ -2105,6 +2195,8 @@ export class CloudflareScopeHost {
         if (!existing)
             throw substratError('not_found', `unknown scope ${scopeId} in tenant ${tenantId}`);
         this.refuseUnusableScopeStores(dump.stores, existing.vertical);
+        // #2555: judged before the fence, so a refused restore moves nothing.
+        await this.refuseDumpRoles(tenantId, scopeId, dump);
         // #2314: the load replaces the scope's rows, so the orphan sweep is fenced first.
         await this.fenceOrphanSweep(scopeId, tenantId);
         // #1742: a dump from before a switch was pulled brings the module's grants back live, so
@@ -2171,7 +2263,7 @@ export class CloudflareScopeHost {
             throw substratError('not_found', `unknown scope ${scopeId} in tenant ${tenantId}`);
         const dump = await this.admin.exportScope(actor, tenantId, scopeId);
         const snapshotId = ulid();
-        await this.importScope(actor, {
+        await this.importScopeFrom(actor, {
             tenantId,
             scopeId: snapshotId,
             kind: opts?.kind ?? 'archive',
@@ -2180,7 +2272,7 @@ export class CloudflareScopeHost {
             jurisdiction: source.jurisdiction,
             expiresAt: opts?.expiresAt,
             // forkedFrom/forkedAt are stamped from the dump by importScope.
-        }, dump);
+        }, dump, false);
         // Bind the snapshot to the source's current version so it is a runnable copy at the
         // same frontier (a fresh bind, so it never re-triggers the snapshot path).
         if (source.verticalVersionId) {
@@ -3713,7 +3805,9 @@ export class CloudflareScopeHost {
                 await this.writeScopeTuple(node.scopeId, subject, `granted:${permission}`, `scope:${node.scopeId}`, expiresAt ?? null);
             }
             else {
-                await this.cp.writeTenantTuple(node.tenantId, subject, `granted:${permission}`, `tenant:${node.tenantId}`, expiresAt ?? null);
+                // #2526: a tenant-level grant is a directory tuple, written by the ControlPlaneDO in the
+                // unit that writes its admin row — never through here.
+                throw new Error('writeGrant: a tenant-level grant is written with its row in the ControlPlaneDO');
             }
         };
         /**
@@ -4245,11 +4339,11 @@ export class CloudflareScopeHost {
                 // `defineRoleOrRefusal`, not the legacy `defineRole` an older coordinator reads. A ControlPlaneDO from
                 // before #2447, met in a deploy's restart window, has no such method, so the call fails loudly rather
                 // than being misread.
-                const defined = await this.cp.defineRoleOrRefusal(tenantId, parsed, context.reservation, context.seatedInScopes);
+                // #2526: through `reply`, with the row, which the DO writes in the definition's unit, its
+                // `before` the role it read there. A DO from before #2526 does not list the method, and refuses.
+                const defined = await this.directory('defineRoleOrRefusal', tenantId, parsed, context.reservation, context.seatedInScopes, this.adminEntry(actor, 'defineRole', { tenantId }, null, parsed));
                 if ('refused' in defined)
                     throw substratError('forbidden', defined.refused);
-                const before = defined.before;
-                await this.recordAdmin(actor, 'defineRole', { tenantId }, before, parsed);
                 await this.fanOut(tenantId); // role definitions are projected into the tenant's scopes
             },
             listRoles: async (actor, filter) => {
@@ -4274,29 +4368,22 @@ export class CloudflareScopeHost {
             assignRole: async (actor, assignment) => {
                 // #2430: the platform's door — a role mixing reserved and other keys is refused (K-55).
                 // At a scope node, read where the checker reads the role, against the scope class's own
-                // reservations (it answers null when it has none). At the tenant node, against this host's.
-                {
-                    const { tenantId, scopeId } = assignment.node;
-                    const refusal = scopeId
-                        ? await this.scopeStub(scopeId).reservedRoleRefusalFor(tenantId, assignment.roleKey, 'platform')
-                        : this.reservedKeys.size > 0
-                            ? await this.cp.getRole(tenantId, assignment.roleKey).then((role) => role && reservedRoleRefusal(role, this.reservedKeys, 'platform'))
-                            : null;
-                    if (refusal)
-                        throw substratError('forbidden', refusal);
-                }
-                const subject = `principal:${assignment.principalId}`;
-                if (assignment.node.scopeId) {
-                    await this.writeScopeTuple(assignment.node.scopeId, subject, `role:${assignment.roleKey}`, `scope:${assignment.node.scopeId}`, null);
-                }
-                else {
-                    await this.cp.writeTenantTuple(assignment.node.tenantId, subject, `role:${assignment.roleKey}`, `tenant:${assignment.node.tenantId}`, null);
+                // reservations (it answers null when it has none). At the tenant node, against this host's,
+                // in the ControlPlaneDO's unit that writes the tuple and its row (#2526).
+                const { tenantId, scopeId } = assignment.node;
+                if (!scopeId) {
+                    const assigned = await this.directory('assignTenantRole', tenantId, assignment.principalId, assignment.roleKey, [...this.reservedKeys], this.adminEntry(actor, 'assignRole', { tenantId, scopeId }, null, assignment));
+                    if (assigned.refused)
+                        throw substratError('forbidden', assigned.refused);
+                    // A tenant-level assignment changes the projected set and must fan out.
+                    await this.fanOut(tenantId);
+                    return;
                 }
-                await this.recordAdmin(actor, 'assignRole', { tenantId: assignment.node.tenantId, scopeId: assignment.node.scopeId }, null, assignment);
-                // A scope-level assignment writes a scope tuple (already local); only a
-                // tenant-level one changes the projected set and must fan out.
-                if (!assignment.node.scopeId)
-                    await this.fanOut(assignment.node.tenantId);
+                const refusal = await this.scopeStub(scopeId).reservedRoleRefusalFor(tenantId, assignment.roleKey, 'platform');
+                if (refusal)
+                    throw substratError('forbidden', refusal);
+                await this.writeScopeTuple(scopeId, `principal:${assignment.principalId}`, `role:${assignment.roleKey}`, `scope:${scopeId}`, null);
+                await this.recordAdmin(actor, 'assignRole', { tenantId, scopeId }, null, assignment);
             },
             unassignRole: async (actor, assignment) => {
                 // Tombstone (K-21) — the checker skips revoked rows. A no-op returns false so
@@ -4323,12 +4410,18 @@ export class CloudflareScopeHost {
                 // to Z text (#963), and liveness here is a lexicographic `expires_at > ?`.
                 const grant = capabilityGrant.parse(raw);
                 await this.refuseReservedGrant([grant.permission], grant.node.scopeId); // #2430
-                await writeGrant(`principal:${grant.principalId}`, grant.permission, grant.node, grant.entity, grant.expiresAt);
-                await this.recordAdmin(actor, 'grant', { tenantId: grant.node.tenantId, scopeId: grant.node.scopeId }, null, grant);
-                // Tenant-level grant → changes the projected set. Scope-level + entity
-                // grants write scope tuples (already local), so they need no fan-out.
-                if (!grant.node.scopeId)
+                const subject = `principal:${grant.principalId}`;
+                const target = { tenantId: grant.node.tenantId, scopeId: grant.node.scopeId };
+                if (!grant.node.scopeId && !grant.entity) {
+                    // #2526: a directory tuple, written with its row in one ControlPlaneDO unit. Tenant-level
+                    // → it changes the projected set, so it fans out.
+                    await this.directory('writeTenantTuple', grant.node.tenantId, subject, `granted:${grant.permission}`, `tenant:${grant.node.tenantId}`, grant.expiresAt ?? null, this.adminEntry(actor, 'grant', target, null, grant));
                     await this.fanOut(grant.node.tenantId);
+                    return;
+                }
+                // Scope-level and entity grants write scope tuples (already local): no fan-out.
+                await writeGrant(subject, grant.permission, grant.node, grant.entity, grant.expiresAt);
+                await this.recordAdmin(actor, 'grant', target, null, grant);
             },
             grantEntityShape: async (actor, grant) => {
                 await this.grantEntityShapeLocal(grant.node.scopeId, grant.principalId, grant.entity, grant.permissions);
@@ -4378,27 +4471,37 @@ export class CloudflareScopeHost {
                 // fails below is still gathered by the next provision/reconcile — the
                 // repair channel — instead of vanishing. The tuple stays the only thing
                 // the permission checker reads; this row is what the platform gathers
-                // from so scopes provisioned AFTER the grant receive it too.
-                await this.cp.recordConnectionGrant({
+                // from so scopes provisioned AFTER the grant receive it too. #2526: the
+                // record, the checks above made again, the admin row and — at the tenant
+                // node — the tuple are one ControlPlaneDO unit.
+                const { vertical } = await this.directory('grantConnectionInDirectory', {
                     connectionId: grant.connectionId,
                     tenantId: grant.node.tenantId,
-                    vertical: conn.vertical,
                     permission: grant.permission,
                     scopeId: grant.node.scopeId ?? null,
                     expiresAt: grant.expiresAt ?? null,
                     grantedBy: grant.grantedBy,
                     grantedAt: new Date().toISOString(),
-                });
+                }, this.adminEntry(actor, 'grantToConnection', { tenantId: grant.node.tenantId, scopeId: grant.node.scopeId, vertical: conn.vertical }, null, {
+                    connectionId: grant.connectionId,
+                    provider: conn.provider,
+                    permission: grant.permission,
+                    node: grant.node,
+                }));
+                if (!grant.node.scopeId) {
+                    // A tenant tuple changes the projected set, as its siblings' do: it fans out.
+                    await this.fanOut(grant.node.tenantId);
+                    return;
+                }
                 // #574: a scope-level grant is a SCOPE tuple, and the scope's DO lives in the
                 // deployment serving it — for the shared control plane that is the vertical's
-                // dispatch script, so the tuple write rides the delegation seam. Tenant-level
-                // grants stay directory-side either way.
-                if (this.connectorDelegation && grant.node.scopeId) {
+                // dispatch script, so the tuple write rides the delegation seam.
+                if (this.connectorDelegation) {
                     await this.connectorDelegation.grant({
                         connectionId: grant.connectionId,
                         tenantId: grant.node.tenantId,
                         scopeId: grant.node.scopeId,
-                        vertical: conn.vertical,
+                        vertical,
                         permission: grant.permission,
                         expiresAt: grant.expiresAt,
                     });
@@ -4406,17 +4509,13 @@ export class CloudflareScopeHost {
                 else {
                     await writeGrant(subjectRef({ kind: 'connection', id: grant.connectionId }), grant.permission, grant.node, undefined, grant.expiresAt);
                 }
-                await this.recordAdmin(actor, 'grantToConnection', { tenantId: grant.node.tenantId, scopeId: grant.node.scopeId, vertical: conn.vertical }, null, {
-                    connectionId: grant.connectionId,
-                    provider: conn.provider,
-                    permission: grant.permission,
-                    node: grant.node,
-                });
             },
             grantToSystem: async (actor, raw) => {
                 // The scheduler's grant (#383) — mirror of grantToConnection. Narrow: one
                 // module, one permission; tombstones on revoke; shows in the permission diff.
                 const grant = systemGrant.parse(raw);
+                const target = { tenantId: grant.node.tenantId, scopeId: grant.node.scopeId };
+                const after = { moduleId: grant.moduleId, permission: grant.permission, node: grant.node };
                 if (grant.node.scopeId) {
                     // #1666: refused while the module is switched off on this scope — checked and
                     // written in one DO unit. Restore is the lever; a grant is not.
@@ -4424,18 +4523,17 @@ export class CloudflareScopeHost {
                     if (!written) {
                         throw substratError('conflict', systemSwitchedOffMessage(grant.moduleId, grant.node.scopeId));
                     }
+                    await this.recordAdmin(actor, 'grantToSystem', target, null, after);
+                    return;
                 }
-                else {
-                    // #1743: refused while the record holds the module off on any scope — checked and
-                    // written in one control-plane call, where the record and the tenant tuple both live.
-                    const off = await this.cp.writeTenantSystemGrant(grant.node.tenantId, grant.moduleId, `granted:${grant.permission}`, grant.expiresAt ?? null);
-                    if (off.length > 0) {
-                        throw substratError('conflict', tenantSystemSwitchedOffMessage(grant.moduleId, off));
-                    }
+                // #1743: refused while the record holds the module off on any scope — checked and
+                // written in one control-plane call, where the record and the tenant tuple both live,
+                // and (#2526) the admin row with them.
+                const off = await this.directory('writeTenantSystemGrant', grant.node.tenantId, grant.moduleId, `granted:${grant.permission}`, grant.expiresAt ?? null, this.adminEntry(actor, 'grantToSystem', target, null, after));
+                if (off.length > 0) {
+                    throw substratError('conflict', tenantSystemSwitchedOffMessage(grant.moduleId, off));
                 }
-                await this.recordAdmin(actor, 'grantToSystem', { tenantId: grant.node.tenantId, scopeId: grant.node.scopeId }, null, { moduleId: grant.moduleId, permission: grant.permission, node: grant.node });
-                if (!grant.node.scopeId)
-                    await this.fanOut(grant.node.tenantId);
+                await this.fanOut(grant.node.tenantId);
             },
             // #1666: the schedule kill switch and its lever back — `system-switch.ts` is the
             // whole rule, shared with the pure adapter; this is the directory check, the reach
@@ -4523,10 +4621,16 @@ export class CloudflareScopeHost {
                 // applied, resolves for nobody, and still shows up in the permission diff.
                 await requireOrg(node.tenantId, orgId);
                 await this.refuseReservedGrant([permission], node.scopeId); // #2430: an org's members are people
-                await writeGrant(`org:${orgId}`, permission, node, entity);
-                await this.recordAdmin(actor, 'grantToOrg', { tenantId: node.tenantId, scopeId: node.scopeId }, null, { orgId, permission, node, entity });
-                if (!node.scopeId)
+                const target = { tenantId: node.tenantId, scopeId: node.scopeId };
+                const after = { orgId, permission, node, entity };
+                if (!node.scopeId && !entity) {
+                    // #2526: the org checked again, the tuple and its row, in one ControlPlaneDO unit.
+                    await this.directory('writeOrgTenantTuple', node.tenantId, orgId, `org:${orgId}`, `granted:${permission}`, `tenant:${node.tenantId}`, null, this.adminEntry(actor, 'grantToOrg', target, null, after));
                     await this.fanOut(node.tenantId);
+                    return;
+                }
+                await writeGrant(`org:${orgId}`, permission, node, entity);
+                await this.recordAdmin(actor, 'grantToOrg', target, null, after);
             },
             // -- vertical + version registry (#31) ---------------------------------
             // -- the hostname map (K-26) -------------------------------------------
@@ -4705,7 +4809,9 @@ export class CloudflareScopeHost {
                 // Lands PENDING — a push is not a deploy — except for a PRIVATE vertical
                 // (tenant-owned, not listed), whose blast radius is its own tenant: there the
                 // sandbox contract is the gate and the version self-admits, noted so the
-                // publish seam can tell a staff vouch from this shortcut.
+                // publish seam can tell a staff vouch from this shortcut. The DO judges it again on the
+                // vertical as the insert's unit reads it, and that is what the row and the version carry
+                // (#2528); this read answers an older DO, which takes what it is sent.
                 const selfAdmits = owning.owner_tenant !== null && !owning.listed;
                 // The manifest is retained for the serving upload (#286), not audited — a whole
                 // manifest per publish would drown the admin log in bundle metadata.
@@ -4751,67 +4857,33 @@ export class CloudflareScopeHost {
                 await this.recordAccess(actor, 'getVersion', {}, { versionId, verticalSlug }, hit ? 1 : 0);
                 return hit ? mapVersion(hit) : undefined;
             },
+            // #2528: each vertical write below is one DO call that reads the row's `before`, and runs its
+            // guard, in the unit that writes; it refuses an unknown vertical with not_found.
             setVerticalListed: async (actor, slug, listed) => {
-                const existing = await this.cp.readVertical(slug);
-                if (!existing)
-                    throw substratError('not_found', `unknown vertical '${slug}'`);
-                // Listing is the moment other tenants start trusting this code, so the
-                // version they would install must carry a real staff vouch — an auto-admitted
-                // prod version has never been read by anyone but its author.
-                if (listed) {
-                    const prod = await this.cp.readChannel(slug, 'prod');
-                    const prodVersion = prod ? await this.cp.readVersion(prod.version_id) : undefined;
-                    if (prodVersion?.admission_note === AUTO_ADMISSION_NOTE) {
-                        throw substratError('conflict', `vertical '${slug}' prod version ${prodVersion.id} is auto-admitted (private self-serve) — ` +
-                            `a staff admit must vouch for it before listing`);
-                    }
-                }
-                await this.cp.updateVerticalListed(slug, listed ? 1 : 0, // also resolves any pending request
-                this.adminEntry(actor, 'setVerticalListed', { tenantId: null }, { listed: !!existing.listed }, { listed }));
+                // Listing is the moment other tenants start trusting this code, so the version they
+                // would install must carry a real staff vouch — an auto-admitted prod version has never
+                // been read by anyone but its author. The DO refuses one; it also resolves any pending
+                // publish request.
+                await this.directory('updateVerticalListed', slug, listed ? 1 : 0, this.adminEntry(actor, 'setVerticalListed', { tenantId: null }, null, { listed }));
             },
             requestPublish: async (actor, slug) => {
-                const existing = await this.cp.readVertical(slug);
-                if (!existing)
-                    throw substratError('not_found', `unknown vertical '${slug}'`);
-                await this.cp.updateVerticalPublishRequest(slug, new Date().toISOString(), this.adminEntry(actor, 'requestPublish', { tenantId: null }, null, { slug }));
+                await this.directory('updateVerticalPublishRequest', slug, new Date().toISOString(), this.adminEntry(actor, 'requestPublish', { tenantId: null }, null, { slug }));
             },
             setVerticalInstallsBlocked: async (actor, slug, blocked) => {
-                const existing = await this.cp.readVertical(slug);
-                if (!existing)
-                    throw substratError('not_found', `unknown vertical '${slug}'`);
-                await this.cp.updateVerticalInstallsBlocked(slug, blocked ? 1 : 0, this.adminEntry(actor, 'setVerticalInstallsBlocked', { tenantId: null }, { installsBlocked: !!existing.installs_blocked }, { installsBlocked: blocked }));
+                await this.directory('updateVerticalInstallsBlocked', slug, blocked ? 1 : 0, this.adminEntry(actor, 'setVerticalInstallsBlocked', { tenantId: null }, null, { installsBlocked: blocked }));
             },
             setVerticalTenantProvisioner: async (actor, slug, granted) => {
-                const existing = await this.cp.readVertical(slug);
-                if (!existing)
-                    throw substratError('not_found', `unknown vertical '${slug}'`);
-                await this.cp.updateVerticalTenantProvisioner(slug, granted ? 1 : 0, this.adminEntry(actor, 'setVerticalTenantProvisioner', { tenantId: null }, { tenantProvisioner: !!existing.tenant_provisioner }, { tenantProvisioner: granted }));
+                await this.directory('updateVerticalTenantProvisioner', slug, granted ? 1 : 0, this.adminEntry(actor, 'setVerticalTenantProvisioner', { tenantId: null }, null, { tenantProvisioner: granted }));
             },
             setVerticalEmailSender: async (actor, slug, granted) => {
-                const existing = await this.cp.readVertical(slug);
-                if (!existing)
-                    throw substratError('not_found', `unknown vertical '${slug}'`);
-                await this.cp.updateVerticalEmailSender(slug, granted ? 1 : 0, this.adminEntry(actor, 'setVerticalEmailSender', { tenantId: null }, { emailSender: !!existing.email_sender }, { emailSender: granted }));
+                await this.directory('updateVerticalEmailSender', slug, granted ? 1 : 0, this.adminEntry(actor, 'setVerticalEmailSender', { tenantId: null }, null, { emailSender: granted }));
             },
             deleteVertical: async (actor, slug) => {
-                const existing = await this.cp.readVertical(slug);
-                if (!existing)
-                    throw substratError('not_found', `unknown vertical '${slug}'`);
-                // Refuse while any restorable scope is bound: a deleted registry row would strand
-                // those scopes' version pins and routing. An `archived` scope (a deleted app) still
-                // blocks — unarchive can bring it back — but the refusal names reap/restore, not
-                // "delete", because the app itself is already gone. `reaped` is terminal history and
-                // never blocks. Deployed dispatch scripts are NOT reaped here — they become orphans
-                // for the cleanup script (#248).
-                const bound = await this.cp.countScopesForVertical(slug);
-                if (bound.live > 0) {
-                    throw substratError('conflict', `vertical '${slug}' still backs ${bound.live} scope(s) — delete or rebind them first`);
-                }
-                if (bound.archived > 0) {
-                    throw substratError('conflict', `vertical '${slug}' still backs ${bound.archived} archived scope(s) — reap or restore them first`);
-                }
-                // #2501: the period's `until` is read here, on the clock its `since` was.
-                await this.cp.deleteVertical(slug, this.adminEntry(actor, 'deleteVertical', { tenantId: null }, { slug, source: existing.source, ownerTenant: existing.owner_tenant }, null), verticalOwnerNow());
+                // Refused while any restorable scope is bound (the DO counts them in the delete's unit).
+                // `reaped` is terminal history and never blocks. Deployed dispatch scripts are NOT reaped
+                // here — they become orphans for the cleanup script (#248). #2501: the period's `until`
+                // is read here, on the clock its `since` was.
+                await this.directory('deleteVertical', slug, this.adminEntry(actor, 'deleteVertical', { tenantId: null }, null, null), verticalOwnerNow());
             },
             listVerticalOwners: async (actor, slug) => {
                 const periods = (await this.cp.listVerticalOwners(slug)).map((p) => verticalOwnerPeriod.parse(p));
@@ -4819,21 +4891,9 @@ export class CloudflareScopeHost {
                 return periods;
             },
             admitVersion: async (actor, versionId) => {
-                const v = await this.cp.readVersion(versionId);
-                if (!v)
-                    throw substratError('not_found', `unknown version ${versionId}`);
-                if (v.admission === 'admitted') {
-                    // Idempotent — except an AUTO-admitted version, which this upgrades to a
-                    // manual vouch by clearing the note (what the publish seam requires).
-                    if (v.admission_note !== AUTO_ADMISSION_NOTE)
-                        return;
-                    await this.cp.setAdmission(versionId, 'admitted', null, this.adminEntry(actor, 'admitVersion', { tenantId: null }, { admission: v.admission, note: v.admission_note }, { admission: 'admitted', note: null }));
-                    return;
-                }
-                if (v.admission === 'rejected') {
-                    throw substratError('conflict', `version ${versionId} was rejected — publish a new one`);
-                }
-                await this.cp.setAdmission(versionId, 'admitted', null, this.adminEntry(actor, 'admitVersion', { tenantId: null }, { admission: v.admission }, { admission: 'admitted' }));
+                // Judged in the DO's unit (#2528): idempotent on an admitted version, except an AUTO-admitted
+                // one, which it upgrades to a manual vouch; a rejected one is refused. The DO fills the row.
+                await this.directory('admitVersion', versionId, this.adminEntry(actor, 'admitVersion', { tenantId: null }, null, null));
             },
             promotionImpact: async (actor, verticalSlug, channel, versionId) => {
                 const incoming = await this.cp.readVersion(versionId);
@@ -4849,15 +4909,8 @@ export class CloudflareScopeHost {
                 return breaks;
             },
             rejectVersion: async (actor, versionId, note) => {
-                const v = await this.cp.readVersion(versionId);
-                if (!v)
-                    throw substratError('not_found', `unknown version ${versionId}`);
-                if (v.admission === 'admitted') {
-                    throw substratError('conflict', `version ${versionId} is already admitted — it may be bound`);
-                }
-                if (v.admission === 'rejected')
-                    return;
-                await this.cp.setAdmission(versionId, 'rejected', note, this.adminEntry(actor, 'rejectVersion', { tenantId: null }, { admission: v.admission }, { admission: 'rejected', note }));
+                // Judged in the DO's unit (#2528): an admitted version is refused, a rejected one is a no-op.
+                await this.directory('rejectVersion', versionId, note, this.adminEntry(actor, 'rejectVersion', { tenantId: null }, null, { admission: 'rejected', note }));
             },
             promoteVersion: async (actor, verticalSlug, channel, versionId, acknowledge) => {
                 const incoming = await this.cp.readVersion(versionId);
@@ -5134,14 +5187,16 @@ export class CloudflareScopeHost {
                         await this.assertNoStrandFrom([r.serving_version_id], incoming.id, incoming, r.serving_ref ? await this.cp.provisionedVersionsOf(verticalSlug, { ref: r.serving_ref, versionId: r.serving_version_id }, null) : []);
                     }
                 }
-                await this.cp.setVerticalServing(verticalSlug, {
+                // #2528: a compare-and-set on the serving ref and version the gate above judged, across
+                // awaits another serve can run in. The DO fills the row's `before` from the state it moves.
+                const moved = await this.directory('setVerticalServing', verticalSlug, {
                     ref: parsed.ref,
                     versionId: parsed.versionId,
                     doClassesJson: JSON.stringify(parsed.doClasses),
                     migrationTag: parsed.migrationTag,
-                }, this.adminEntry(actor, 'setVerticalServing', { tenantId: null }, r.serving_ref
-                    ? { ref: r.serving_ref, versionId: r.serving_version_id }
-                    : null, { vertical: verticalSlug, ref: parsed.ref, versionId: parsed.versionId }));
+                }, this.adminEntry(actor, 'setVerticalServing', { tenantId: null }, null, { vertical: verticalSlug, ref: parsed.ref, versionId: parsed.versionId }), { ref: r.serving_ref ?? null, versionId: r.serving_version_id ?? null });
+                if (!moved)
+                    throw servingRaceRefusal(verticalSlug);
             },
             versionManifest: async (actor, verticalSlug, versionId) => {
                 const v = await this.cp.readVersion(versionId);
@@ -5161,7 +5216,10 @@ export class CloudflareScopeHost {
             },
             recordWireAuth: async (actor, input) => {
                 const row = deploymentWireAuth.parse(input);
-                await this.cp.recordWireAuth(row, this.adminEntry(actor, 'recordWireAuth', { tenantId: null, vertical: row.verticalSlug }, null, { vertical: row.verticalSlug, deploymentRef: row.deploymentRef, versionId: row.versionId, record: row.record }));
+                const written = await this.cp.recordWireAuth(row, this.adminEntry(actor, 'recordWireAuth', { tenantId: null, vertical: row.verticalSlug }, null, { vertical: row.verticalSlug, deploymentRef: row.deploymentRef, versionId: row.versionId, record: row.record }));
+                // Thrown here, not in the directory's object, so the code survives the RPC.
+                if (!written)
+                    throw substratError('not_found', `no capability record for '${row.deploymentRef}': vertical '${row.verticalSlug}' is not registered`);
             },
             listWireAuth: async (actor, input) => {
                 // Judged here, before the call into the directory's object, so a refusal keeps its code; the
@@ -5262,10 +5320,8 @@ export class CloudflareScopeHost {
             },
             createOrg: async (actor, input) => {
                 const parsed = createOrgInput.parse(input);
-                const created = await this.directory('createOrg', parsed.id, parsed.tenantId, parsed.slug, parsed.name, new Date().toISOString());
-                if (!created)
-                    return; // idempotent, and a no-op is not audited
-                await this.recordAdmin(actor, 'createOrg', { tenantId: parsed.tenantId }, null, parsed);
+                // #2526: the org and its row in one unit; an org that exists already writes neither.
+                await this.directory('insertOrg', parsed.id, parsed.tenantId, parsed.slug, parsed.name, new Date().toISOString(), this.adminEntry(actor, 'createOrg', { tenantId: parsed.tenantId }, null, parsed));
             },
             listOrgs: async (actor, tenantId) => {
                 const orgs = (await this.cp.listOrgs(tenantId)).map(mapOrg);
@@ -5278,10 +5334,9 @@ export class CloudflareScopeHost {
                 return r ? mapOrg(r) : undefined;
             },
             addMember: async (actor, tenantId, principal, orgId, opts) => {
-                await requireOrg(tenantId, orgId);
                 const expiresAt = opts?.expiresAt ?? null;
-                await this.cp.writeTenantTuple(tenantId, `principal:${principal}`, 'member', `org:${orgId}`, expiresAt);
-                await this.recordAdmin(actor, 'addMember', { tenantId }, null, memberAddedAudit(principal, orgId, expiresAt));
+                // #2526: the org's check, the tuple and its row, in one ControlPlaneDO unit.
+                await this.directory('writeOrgTenantTuple', tenantId, orgId, `principal:${principal}`, 'member', `org:${orgId}`, expiresAt, this.adminEntry(actor, 'addMember', { tenantId }, null, memberAddedAudit(principal, orgId, expiresAt)));
                 await this.fanOut(tenantId); // membership is a tenant-level tuple
             },
             applyMembership: async (actor, change) => {
@@ -5458,6 +5513,9 @@ export class CloudflareScopeHost {
             recordStoreDriverRebuildRun: async (actor, entry) => {
                 await this.recordAdmin(actor, 'rebuildStoreDriver', { tenantId: null }, null, entry);
             },
+            recordWireWalk: async (actor, entry) => {
+                await this.recordAdmin(actor, 'walkWireAuth', { tenantId: null }, null, entry);
+            },
             listScopeTables: async (actor, tenantId, scopeId) => {
                 // K-3 cross-check on the shared directory BEFORE reaching the scope DO: a pair
                 // that does not resolve is unreachable, never another tenant's database.
@@ -7684,9 +7742,11 @@ export class CloudflareScopeHost {
             throw substratError('forbidden', `the owner's seat: ${ownerRefusal}`);
         const connections = await this.seatableConnectionGrants(input.tenantId, input.scopeId, input.connectionGrants);
         const services = await this.servicePrincipals?.(input.tenantId, input.scopeId);
-        const stub = this.scopeStub(input.scopeId);
         await this.migrateAndRecord(input.scopeId); // create the module tables (setMigrationState no-ops on a null CP)
-        const switchedOff = unwrapReply(await stub.applyProjectionReply(input.tenantId, input.roles.map((r) => ({ role_key: r.key, permissions: JSON.stringify(r.permissions), source: r.source, holder: r.holder === 'system' ? 'system' : 'person' })), [], // no tenant-level tuples — a CP-less vertical grants at scope level only
+        // #2531: judged again in the projection's own unit, on the roles and seats the scope holds as it
+        // writes, so a seat made since the pre-check above is seen. The module migrations above have
+        // already run when that refuses; they are this host's own setup, and the projection writes nothing.
+        const switchedOff = await this.projectJudged(input.tenantId, input.scopeId, projectedRoleRows(input.roles), [], // no tenant-level tuples — a CP-less vertical grants at scope level only
         // Only PROJECT (and thereby switch on strict enforcement) when the platform actually
         // supplies entitlements. Omitting them leaves the scope un-projected and trusting-
         // upstream, so a vertical whose provision path predates #304 is never denied — it
@@ -7746,7 +7806,7 @@ export class CloudflareScopeHost {
             : undefined, 
         // #1742: the recorded-off modules and (#2029) peers, switched off after the seat in the
         // same unit, on the scope this call provisions — the one the seat's tuples name.
-        carry ? { scopeId: input.scopeId, at: new Date().toISOString(), ...carry } : undefined, services?.map((id) => `principal:${id}`)));
+        carry ? { scopeId: input.scopeId, at: new Date().toISOString(), ...carry } : undefined, services?.map((id) => `principal:${id}`));
         const shapes = input.entityGrants
             ? await this.topUpEntityGrantShapesLocal(input.tenantId, input.scopeId, input.entityGrants)
             : null;
@@ -7825,12 +7885,36 @@ export class CloudflareScopeHost {
      * which replaces whatever the scope stores now, so what the set is judged against is the DUMP's
      * roles and seats for `dump.tenantId` (`dumpRoleState`), when the caller has the dump in hand. A
      * staged restore has not (its pages are already in the scope), so it is judged as a set alone
-     * here, and `projectRolesLocal` judges again after the import, against what the dump brought.
+     * here. The load given the vertical's `roles` judges again in its own transaction, against what
+     * the dump brought (#2531), and `projectRolesLocal` does in its unit where the load did not.
      */
     async roleSetRefusalLocal(scopeId, roles, dump) {
         const here = await this.scopeStub(scopeId).reservationHere();
         return reservedRoleSetRefusal(roles, { reserved: new Set([...this.reservedKeys, ...here.reserved]), declared: new Set([...this.declaredKeys, ...here.declared]) }, dump ? dumpRoleState(dump.tables, dump.tenantId, new Date().toISOString()) : undefined);
     }
+    /**
+     * #2555: refuse loading `dump` into a scope of `tenantId` (`dumpRoleRefusal`): the tenant's roles as
+     * the directory stores them now, against the dump's role rows and seats, with this host's
+     * reservations joined with the scope class's. The class is read at `scopeId` when the scope exists
+     * (a restore), else at a live scope of the tenant (an import, whose scope is not created yet: asking
+     * its object would create storage for a scope a refusal leaves unmade).
+     *
+     * Two stated residuals. The directory is read here and the dump is loaded in the scope's own call,
+     * so a role defined between the two is not judged against the dump's seats. And an import for a
+     * tenant with no live scope reads no class, so it is judged with this host's reservations alone: the
+     * seat rule holds without them, and a key only the class reserves is not counted.
+     */
+    async refuseDumpRoles(tenantId, scopeId, dump) {
+        const classScope = scopeId ?? (await this.cp.listScopes({ tenantId, status: ['active', 'suspended'], limit: 1 }))[0]?.scope_id;
+        const [rows, here] = await Promise.all([
+            this.cp.listRoles({ tenantId }),
+            classScope ? this.scopeStub(classScope).reservationHere() : { reserved: [], declared: [] },
+        ]);
+        const roles = rows.map((r) => ({ key: r.role_key, permissions: JSON.parse(r.permissions), ...(r.holder ? { holder: r.holder } : {}) }));
+        const refusal = dumpRoleRefusal(roles, { reserved: new Set([...this.reservedKeys, ...here.reserved]), declared: new Set([...this.declaredKeys, ...here.declared]) }, dump, new Date().toISOString());
+        if (refusal)
+            throw substratError('forbidden', refusal);
+    }
     /**
      * #2446: the roles `scopeId` stores for `tenantId` and the role keys anyone but a system principal
      * holds a live seat in there: what `refuseReservedRoleSet` judges a reconcile's role set against
@@ -7846,15 +7930,18 @@ export class CloudflareScopeHost {
      * and the roles the scope stores for the tenant now with their seats there. Answers the reserved
      * keys it judged with, for the seats the same call makes.
      *
-     * A stated residual: the scope state is read in one RPC (`roleStateHere`) and written in another
-     * (`applyProjectionReply`), so a seat made between the two is not seen. The window is one call
-     * wide, and a reconcile runs again every pass.
+     * The scope state is read in one RPC (`roleStateHere`) and written in another, so this is the
+     * first check, for its detailed wording; the write judges the set again inside its own unit
+     * (`projectJudged`, #2531), where a seat made between the two is seen.
      */
     async refuseReservedRoleSet(roles, tenantId, scopeId) {
         const stub = this.scopeStub(scopeId);
         const [here, state] = await Promise.all([stub.reservationHere(), stub.roleStateHere(tenantId)]);
         const reserved = new Set([...this.reservedKeys, ...here.reserved]);
-        const refusal = reservedRoleSetRefusal(roles, { reserved, declared: new Set([...this.declaredKeys, ...here.declared]) }, { roles: state.roles, seated: new Set(state.seated) });
+        const refusal = reservedRoleSetRefusal(roles, { reserved, declared: new Set([...this.declaredKeys, ...here.declared]) }, 
+        // #2531: with the tombstones the scope keeps, so a system-held role a release dropped is judged
+        // as the stored definition it was. A ScopeDO from before them answers none.
+        { roles: state.roles, seated: new Set(state.seated), ...(state.dropped ? { dropped: state.dropped } : {}) });
         // Named by tenant and scope as well as role: a release push admitted can be refused here at every
         // scope where the role is seated, and staff find each one by this line (K-55).
         if (refusal)
@@ -8137,6 +8224,17 @@ export class CloudflareScopeHost {
      * so a caller falls back rather than failing a dispatch over a missing file.
      */
     async connectorAttachmentOpenLocal(connectionId, tenantId, scopeId, attachmentId, eventId) {
+        return (await this.connectorReadSurface(connectionId, tenantId, scopeId, eventId)).open(attachmentId);
+    }
+    /**
+     * `connectorAttachmentOpenLocal`, with the bytes as a stream read from R2 as the platform reads
+     * the response (#2514). The same gates, in the same order, before the bucket is touched.
+     */
+    async connectorAttachmentOpenStreamLocal(connectionId, tenantId, scopeId, attachmentId, eventId) {
+        return (await this.connectorReadSurface(connectionId, tenantId, scopeId, eventId)).openStream(attachmentId);
+    }
+    /** The attachment surface the platform's reads as a connection go through, behind their gates. */
+    async connectorReadSurface(connectionId, tenantId, scopeId, eventId) {
         // Same gate as the upload leg: a held scope's bytes are not read out of its bucket.
         await this.assertLive(tenantId, scopeId);
         await this.migrateAndRecord(scopeId);
@@ -8144,7 +8242,7 @@ export class CloudflareScopeHost {
         return this.buildAttachmentSurface({ connectionId }, tenantId, scopeId, store, 
         // #726 remedy B: the platform named a delivery; this deployment decides what that
         // delivery reaches, from its own spine row. Absent ⇒ the ordinary grant check.
-        eventId === undefined ? undefined : { eventId }).open(attachmentId);
+        eventId === undefined ? undefined : { eventId });
     }
     /**
      * The delivery half of `grantToConnection` for a scope served HERE (#574): write