@substrat-run/adapter-cloudflare 0.161.0 → 0.162.0

package/dist/host.js

@@ -1,7 +1,7 @@
 import { env as ambientEnv } from 'cloudflare:workers';
 import { isRewindRefusal, REWIND_REFUSED } from './rewind-refusal.js';
 import { isSystemDoorMoved, SYSTEM_DOOR_MOVED, SYSTEM_DOOR_REGATES } from './system-door.js';
-import { delegatedReadParams, operationSeriesCount, fromWireFailure, isSubstratError, exportReadInput, exportedBatch, importBatch, importResult, importState, importsOfManifestJson, connectionLandingsOfManifestJson, exportsOfManifestJson, assertNoBindingShapeBreak, importCursorMove, importCursorMoveAt, importCursorMoved, accessLogEntry, adminLogEntry, opsFailureEntry, opsFailureFingerprint, issueEntry, findingEntry, findingRuleEntry, sweepRunEntry, FRESHNESS_HEARTBEAT_MINUTES, sweepRunsPayload, modelUsageEntry, createTenantInput, identityLink, identityPool, createOrgInput, promotionAcknowledgement, bindAcknowledgement, bindHostnameInput, channelHistoryEntry, hostnameBinding, publishVersionInput, AUTO_ADMISSION_NOTE, registerVerticalInput, vertical as verticalSchema, verticalServingState, deploymentWireAuth, verticalChannel, verticalVersion, connection, capabilityExchange, mintedCapability, boundedBecomeMint, boundedBecomeRevoke, boundedUnbind, entityRef, becomeLinkState, principalBecomeCapabilityInput, capabilityGrant, principalId, connectionGrant, connectionGrantRecord, connectionSecret, systemGrant, systemSwitch, systemSwitchOutcome, systemScheduleEntry, systemSwitchRecord, entitlementGrant, entitlementGrantInput, capabilityFilter, instant, meterReading, scopeStorageSample, requestDay, requestRollupDay, meterDay, meterDayTake, verticalOwnerPeriod, subjectRef, createConnectionInput, connectLinkFilter, connectLinkKey, consumeConnectLinkInput, mintConnectLinkInput, projectedConnectionGrant, projectedConnectionKey, moduleManifest, org as orgSchema, orgMembership, resolvedIdentity, identityMembership, roleDefinition, scope as scopeSchema, tenant as tenantSchema, tenantRole, delegatedReadRecord, ownerTransferAudit, memberChangeAudit, peerBindingAudit, connectionBindingAudit, copyMarkAudit, orphanSweepAudit, subjectShredReceipt, connectorDispatchKind, callsOfManifestJson, outboundOfManifestJson, SCOPE_GATE_REASONS, substratError, redrainEventsInput, coverage, peerCoverage, peerGrantsEntry, peerSwitch, peerSwitchOutcome, verticalCaller, verticalResolution, peerInstanceResolution, peerBinding as peerBindingSchema, verticalSlug, entityObjectRef, ATTACHMENT_BLOB_BINDING, blobStoreBindingName, lifecycleDelivery, scopeLifecycle, } from '@substrat-run/contracts';
+import { delegatedReadParams, operationSeriesCount, fromWireFailure, isSubstratError, exportReadInput, exportedBatch, importBatch, importResult, importState, importsOfManifestJson, connectionLandingsOfManifestJson, exportsOfManifestJson, assertNoBindingShapeBreak, importCursorMove, importCursorMoveAt, importCursorMoved, accessLogEntry, adminLogEntry, opsFailureEntry, opsFailureFingerprint, issueEntry, findingEntry, findingRuleEntry, sweepRunEntry, FRESHNESS_HEARTBEAT_MINUTES, sweepRunsPayload, modelUsageEntry, createTenantInput, identityLink, identityPool, createOrgInput, promotionAcknowledgement, bindAcknowledgement, bindHostnameInput, channelHistoryEntry, hostnameBinding, publishVersionInput, AUTO_ADMISSION_NOTE, registerVerticalInput, vertical as verticalSchema, verticalServingState, deploymentWireAuth, verticalChannel, verticalVersion, connection, capabilityExchange, mintedCapability, boundedBecomeMint, boundedBecomeRevoke, boundedUnbind, entityRef, becomeLinkState, principalBecomeCapabilityInput, capabilityGrant, principalId, connectionGrant, connectionGrantRecord, connectionSecret, systemGrant, systemSwitch, systemSwitchOutcome, systemScheduleEntry, systemSwitchRecord, entitlementGrant, entitlementGrantInput, capabilityFilter, instant, meterReading, scopeStorageSample, requestDay, requestRollupDay, meterDay, meterDayTake, verticalOwnerPeriod, subjectRef, createConnectionInput, connectLinkFilter, connectLinkKey, consumeConnectLinkInput, mintConnectLinkInput, projectedConnectionGrant, projectedConnectionKey, moduleManifest, org as orgSchema, orgMembership, resolvedIdentity, identityMembership, roleDefinition, scope as scopeSchema, tenant as tenantSchema, tenantRole, delegatedReadRecord, ownerTransferAudit, memberChangeAudit, peerBindingAudit, connectionBindingAudit, copyMarkAudit, orphanSweepAudit, subjectShredReceipt, connectorDispatchKind, callsOfManifestJson, outboundOfManifestJson, SCOPE_GATE_REASONS, substratError, errorCodeOf, redrainEventsInput, coverage, peerCoverage, peerGrantsEntry, peerSwitch, peerSwitchOutcome, verticalCaller, verticalResolution, peerInstanceResolution, peerBinding as peerBindingSchema, verticalSlug, entityObjectRef, ATTACHMENT_BLOB_BINDING, blobStoreBindingName, lifecycleDelivery, scopeLifecycle, } from '@substrat-run/contracts';
 import { normalizeHostname, toRouteTarget } from './route-resolver.js';
 import { attachmentBlobKey, normalizeUploadMediaType, redeemOrReplayUploadLink, attachmentSha256, bytesStream, isSizedByteStream, openAttachmentByteStream, putAttachmentBytes, entitlementDenial, requiredEntitlementFor, foldMeterReading, parseValidationRecords, readableScopes, resolveScopeRecord, ulid, withheldOpsFailure, KEPT_COPY_REFUSAL, capabilityTokenHash, checkBecomeInput, assertBecomeLinkStateIds, plausibleSessionToken, foldModelUsage, backoffAt, resolveRetryPolicy, executorOutcomeOf, isDeliveryRefusal, refusalJournalText, isSecretBoxConfigured, unconfiguredSecretBox, createSubjectKeys, generateSealingKeyPair, openSealed, ImpersonationRefused, assertSessionUsable, impersonationRowValues, mapImpersonationRow, newImpersonationSession, jobRunOf, assertLeaseMs, runDueJobRuns, SYSTEM_DOOR_WAIT, startJobRun, attachmentTextJob, assertAttachmentExtractors, resolveAttachmentTextBounds, assertJobRegistrable, ATTACHMENT_TEXT_BACKFILL_JOB, ATTACHMENT_TEXT_JOB, kernelJobFor, attachmentTextBackfillJob, searchLimit, searchMatchExpression, globalFetch, fetchLikeOf, deadlineFetch, assertRedrainWindow, platformRequestOf, undrainedEventsOf, inUnitMovesToAudit, staleCarryRevertRow, staleCarryReverts, recordedOffFromWire, peerSubjectRef, SWITCH_KINDS, reassertActionOf, reassertEntry, reassertOffRow, reassertOnRow, switchActionOf, switchAuditSubject, recordAuditOutcome, auditedCapabilityRevoke, auditWarningOf, switchNotFoundMessage, recordWriteSuperseded, switchSubjectOf, switchSupersededMessage, withRecorded, systemSwitchedOffMessage, tenantSystemSwitchedOffMessage, CrossVerticalRegistry, importCursorSourceOf, exportBreaksOf, exportBreakRefusal, assertPromoteReviewCurrent, promoteRaceRefusal, servingRaceRefusal, rebindRaceRefusal, bindExportBreaksOf, bindExportBreakRefusal, scopeMoveOf, runningVersionOf, strandJudgmentsOf, boundShapesOfColumn, installReconciled, collectPeers, peerCallerAt, peerSeats, connectorCallRecord, noopConnectorCallRecorder, recordConnectorCall, settleConnectionUse, splitManifestMigrations, publishedMigrationDigest, migrationChangeRefusal, unknownRoleError, assertRowLimit, assertRowOffset, emptyImportResult, INERT_SCOPE_REASON, lifecycleReceipt, lifecycleRefusal, scopeNotHeldRefusal, isPrimaryScope, isPrimaryScopeRow, asyncInvocationId, asyncLinePass, assertNoCallerPurge, purgeReportOf, purgeStillDue, assertBoundOperations, registerTrashTargets, assertModuleDeclared, noteDeclaredKeys, noteReservedKeys, reservedGrantRefusal, reservedRoleRefusal, reservedRoleSetRefusal, reservedShapeRefusal, SEAT_HOLDING_SCOPE_STATUSES, dumpRoleRefusal, dumpRoleState, memberAddedAudit, shapeTopUpBatch, verticalOwnerNow, } from '@substrat-run/kernel';
 import { fenceAttachmentSweep, missingAttachmentStore, sweepOrphanAttachments, unsettledCopyRefusal } from '@substrat-run/kernel';
@@ -75,6 +75,10 @@ const connectionGrantsSkippedLine = (tenantId, scopeId, skipped) => ({
  * classification is the platform directory's; the vertical applies the same `isPrimaryScope` to
  * it, so a primary can be marked only by a request that misstates its lineage, never by default.
  */
+/** A vertical's role definitions as a CP-less projection writes them (`applyProjection`'s rows). */
+function projectedRoleRows(roles) {
+    return roles.map((r) => ({ role_key: r.key, permissions: JSON.stringify(r.permissions), source: r.source, holder: r.holder === 'system' ? 'system' : 'person' }));
+}
 function assertCopyLineage(lineage) {
     if (isPrimaryScope(lineage)) {
         throw substratError('conflict', 'mark-copy refused: the directory classifies this scope as primary, not as a copy');
@@ -1124,7 +1128,7 @@ export class CloudflareScopeHost {
      *  #2016: `tenantId`, the tenant the platform restores for: recorded as the scope's receipt in
      *  the load's own transaction, and a store provisioned for another tenant refuses the load. */
     opts) {
-        const out = await this.loadLocal(scopeId, opts, (load) => this.scopeStub(scopeId).importDumpChecked(tables, scopeId, load));
+        const out = await this.loadLocal(scopeId, opts, (load, repair) => repair ? this.scopeStub(scopeId).importDumpJudged(tables, scopeId, load, repair) : this.scopeStub(scopeId).importDumpChecked(tables, scopeId, load));
         return { ...out, tables: tables.length };
     }
     /**
@@ -1146,7 +1150,9 @@ export class CloudflareScopeHost {
     }
     /** `restoreScopeLocal` from the dump staged under `stageId` (#2450), with the same fences and answers. */
     async restoreStagedScopeLocal(scopeId, stageId, opts) {
-        return this.loadLocal(scopeId, opts, (load) => this.scopeStub(scopeId).commitStagedDumpChecked(stageId, scopeId, load));
+        return this.loadLocal(scopeId, opts, (load, repair) => repair
+            ? this.scopeStub(scopeId).commitStagedDumpJudged(stageId, scopeId, load, repair)
+            : this.scopeStub(scopeId).commitStagedDumpChecked(stageId, scopeId, load));
     }
     /** Drop the dump staged under `stageId` (#2450), if it is still there. */
     async discardStagedScopeLocal(scopeId, stageId) {
@@ -1156,6 +1162,11 @@ export class CloudflareScopeHost {
     async loadLocal(scopeId, opts, run) {
         if (opts?.markCopy)
             assertCopyLineage(opts.markCopy);
+        if (opts?.roles && !opts.tenantId) {
+            throw substratError('validation_failed', 'restore refused: a role repair needs the tenant it is projected for; nothing was loaded');
+        }
+        // #2531: the repair the load judges and projects in its own transaction.
+        const repair = opts?.roles && opts.tenantId ? { tenantId: opts.tenantId, roles: projectedRoleRows(opts.roles), judge: this.roleJudge() } : undefined;
         // #2314: a load replaces the scope's rows, so the orphan sweep is fenced first, as for a rewind.
         await this.fenceOrphanSweep(scopeId, opts?.tenantId);
         const carry = opts ? recordedOffFromWire(opts) : undefined;
@@ -1173,14 +1184,22 @@ export class CloudflareScopeHost {
             ...load,
             ...(opts?.expect ? { expect: opts.expect } : {}),
             ...(opts?.fence ? { fence: opts.fence } : {}),
-        });
+        }, repair);
         if (out.refused === false) {
-            return { tables: out.tables ?? 0, ...(carry ? { switchedOff: out.switchedOff } : {}) };
+            return {
+                tables: out.tables ?? 0,
+                ...(carry ? { switchedOff: out.switchedOff } : {}),
+                // Only a load that ran the judged method can say the repair landed in it.
+                ...(repair && out.rolesProjected === true ? { rolesProjected: true } : {}),
+            };
         }
         if (out.refused === 'kept')
             throw substratError('conflict', KEPT_COPY_REFUSAL);
         if (out.refused === 'tenant')
             throw substratError('conflict', out.message);
+        // #2531: the repair's role set, refused on the seats the load wrote; the whole load rolled back.
+        if (out.refused === 'roles')
+            throw substratError('conflict', `the vertical's roles cannot be defined here: ${out.message}`);
         if (out.refused === 'lapsed')
             throw substratError('precondition_failed', COPY_RESTORE_FENCE_LAPSED);
         // A retry of a load that already committed (its answer was lost on the way back) is
@@ -1311,9 +1330,33 @@ export class CloudflareScopeHost {
      * safe; scope-level tuples (the restored grants) are never touched.
      */
     async projectRolesLocal(tenantId, scopeId, roles) {
-        // #2447: the role set is defined here, so it is judged here, before anything is projected.
+        // #2447: the role set is defined here, so it is judged here, before anything is projected, and
+        // (#2531) again inside the projection's unit, on the seats the scope holds as it writes.
         await this.refuseReservedRoleSet(roles, tenantId, scopeId);
-        unwrapReply(await this.scopeStub(scopeId).applyProjectionReply(tenantId, roles.map((r) => ({ role_key: r.key, permissions: JSON.stringify(r.permissions), source: r.source, holder: r.holder === 'system' ? 'system' : 'person' })), []));
+        await this.projectJudged(tenantId, scopeId, projectedRoleRows(roles), []);
+    }
+    /**
+     * #2531: what this host's own modules reserve and declare, for a unit that judges a role set in the
+     * scope (`RoleJudge`); the scope class's are joined there.
+     */
+    roleJudge() {
+        return { reserved: [...this.reservedKeys], declared: [...this.declaredKeys] };
+    }
+    /**
+     * #2531: `applyProjectionReply` with the role set judged in its unit (`applyJudgedProjectionReply`).
+     * A refusal there answers with the staff-facing prefix `refuseReservedRoleSet` gives a pre-check's.
+     * A ScopeDO from before the judged method refuses the call itself, with nothing written.
+     */
+    async projectJudged(tenantId, scopeId, ...rest) {
+        try {
+            return unwrapReply(await this.scopeStub(scopeId).applyJudgedProjectionReply(this.roleJudge(), tenantId, ...rest));
+        }
+        catch (e) {
+            if (errorCodeOf(e) === 'forbidden') {
+                throw substratError('forbidden', `tenant ${tenantId}, scope ${scopeId}: the vertical's roles cannot be defined here: ${e.message}`);
+            }
+            throw e;
+        }
     }
     /**
      * Wipe one scope DO's storage in THIS deployment — the reap half of an orchestrated
@@ -3762,7 +3805,9 @@ export class CloudflareScopeHost {
                 await this.writeScopeTuple(node.scopeId, subject, `granted:${permission}`, `scope:${node.scopeId}`, expiresAt ?? null);
             }
             else {
-                await this.cp.writeTenantTuple(node.tenantId, subject, `granted:${permission}`, `tenant:${node.tenantId}`, expiresAt ?? null);
+                // #2526: a tenant-level grant is a directory tuple, written by the ControlPlaneDO in the
+                // unit that writes its admin row — never through here.
+                throw new Error('writeGrant: a tenant-level grant is written with its row in the ControlPlaneDO');
             }
         };
         /**
@@ -4294,11 +4339,11 @@ export class CloudflareScopeHost {
                 // `defineRoleOrRefusal`, not the legacy `defineRole` an older coordinator reads. A ControlPlaneDO from
                 // before #2447, met in a deploy's restart window, has no such method, so the call fails loudly rather
                 // than being misread.
-                const defined = await this.cp.defineRoleOrRefusal(tenantId, parsed, context.reservation, context.seatedInScopes);
+                // #2526: through `reply`, with the row, which the DO writes in the definition's unit, its
+                // `before` the role it read there. A DO from before #2526 does not list the method, and refuses.
+                const defined = await this.directory('defineRoleOrRefusal', tenantId, parsed, context.reservation, context.seatedInScopes, this.adminEntry(actor, 'defineRole', { tenantId }, null, parsed));
                 if ('refused' in defined)
                     throw substratError('forbidden', defined.refused);
-                const before = defined.before;
-                await this.recordAdmin(actor, 'defineRole', { tenantId }, before, parsed);
                 await this.fanOut(tenantId); // role definitions are projected into the tenant's scopes
             },
             listRoles: async (actor, filter) => {
@@ -4323,29 +4368,22 @@ export class CloudflareScopeHost {
             assignRole: async (actor, assignment) => {
                 // #2430: the platform's door — a role mixing reserved and other keys is refused (K-55).
                 // At a scope node, read where the checker reads the role, against the scope class's own
-                // reservations (it answers null when it has none). At the tenant node, against this host's.
-                {
-                    const { tenantId, scopeId } = assignment.node;
-                    const refusal = scopeId
-                        ? await this.scopeStub(scopeId).reservedRoleRefusalFor(tenantId, assignment.roleKey, 'platform')
-                        : this.reservedKeys.size > 0
-                            ? await this.cp.getRole(tenantId, assignment.roleKey).then((role) => role && reservedRoleRefusal(role, this.reservedKeys, 'platform'))
-                            : null;
-                    if (refusal)
-                        throw substratError('forbidden', refusal);
-                }
-                const subject = `principal:${assignment.principalId}`;
-                if (assignment.node.scopeId) {
-                    await this.writeScopeTuple(assignment.node.scopeId, subject, `role:${assignment.roleKey}`, `scope:${assignment.node.scopeId}`, null);
-                }
-                else {
-                    await this.cp.writeTenantTuple(assignment.node.tenantId, subject, `role:${assignment.roleKey}`, `tenant:${assignment.node.tenantId}`, null);
+                // reservations (it answers null when it has none). At the tenant node, against this host's,
+                // in the ControlPlaneDO's unit that writes the tuple and its row (#2526).
+                const { tenantId, scopeId } = assignment.node;
+                if (!scopeId) {
+                    const assigned = await this.directory('assignTenantRole', tenantId, assignment.principalId, assignment.roleKey, [...this.reservedKeys], this.adminEntry(actor, 'assignRole', { tenantId, scopeId }, null, assignment));
+                    if (assigned.refused)
+                        throw substratError('forbidden', assigned.refused);
+                    // A tenant-level assignment changes the projected set and must fan out.
+                    await this.fanOut(tenantId);
+                    return;
                 }
-                await this.recordAdmin(actor, 'assignRole', { tenantId: assignment.node.tenantId, scopeId: assignment.node.scopeId }, null, assignment);
-                // A scope-level assignment writes a scope tuple (already local); only a
-                // tenant-level one changes the projected set and must fan out.
-                if (!assignment.node.scopeId)
-                    await this.fanOut(assignment.node.tenantId);
+                const refusal = await this.scopeStub(scopeId).reservedRoleRefusalFor(tenantId, assignment.roleKey, 'platform');
+                if (refusal)
+                    throw substratError('forbidden', refusal);
+                await this.writeScopeTuple(scopeId, `principal:${assignment.principalId}`, `role:${assignment.roleKey}`, `scope:${scopeId}`, null);
+                await this.recordAdmin(actor, 'assignRole', { tenantId, scopeId }, null, assignment);
             },
             unassignRole: async (actor, assignment) => {
                 // Tombstone (K-21) — the checker skips revoked rows. A no-op returns false so
@@ -4372,12 +4410,18 @@ export class CloudflareScopeHost {
                 // to Z text (#963), and liveness here is a lexicographic `expires_at > ?`.
                 const grant = capabilityGrant.parse(raw);
                 await this.refuseReservedGrant([grant.permission], grant.node.scopeId); // #2430
-                await writeGrant(`principal:${grant.principalId}`, grant.permission, grant.node, grant.entity, grant.expiresAt);
-                await this.recordAdmin(actor, 'grant', { tenantId: grant.node.tenantId, scopeId: grant.node.scopeId }, null, grant);
-                // Tenant-level grant → changes the projected set. Scope-level + entity
-                // grants write scope tuples (already local), so they need no fan-out.
-                if (!grant.node.scopeId)
+                const subject = `principal:${grant.principalId}`;
+                const target = { tenantId: grant.node.tenantId, scopeId: grant.node.scopeId };
+                if (!grant.node.scopeId && !grant.entity) {
+                    // #2526: a directory tuple, written with its row in one ControlPlaneDO unit. Tenant-level
+                    // → it changes the projected set, so it fans out.
+                    await this.directory('writeTenantTuple', grant.node.tenantId, subject, `granted:${grant.permission}`, `tenant:${grant.node.tenantId}`, grant.expiresAt ?? null, this.adminEntry(actor, 'grant', target, null, grant));
                     await this.fanOut(grant.node.tenantId);
+                    return;
+                }
+                // Scope-level and entity grants write scope tuples (already local): no fan-out.
+                await writeGrant(subject, grant.permission, grant.node, grant.entity, grant.expiresAt);
+                await this.recordAdmin(actor, 'grant', target, null, grant);
             },
             grantEntityShape: async (actor, grant) => {
                 await this.grantEntityShapeLocal(grant.node.scopeId, grant.principalId, grant.entity, grant.permissions);
@@ -4427,27 +4471,37 @@ export class CloudflareScopeHost {
                 // fails below is still gathered by the next provision/reconcile — the
                 // repair channel — instead of vanishing. The tuple stays the only thing
                 // the permission checker reads; this row is what the platform gathers
-                // from so scopes provisioned AFTER the grant receive it too.
-                await this.cp.recordConnectionGrant({
+                // from so scopes provisioned AFTER the grant receive it too. #2526: the
+                // record, the checks above made again, the admin row and — at the tenant
+                // node — the tuple are one ControlPlaneDO unit.
+                const { vertical } = await this.directory('grantConnectionInDirectory', {
                     connectionId: grant.connectionId,
                     tenantId: grant.node.tenantId,
-                    vertical: conn.vertical,
                     permission: grant.permission,
                     scopeId: grant.node.scopeId ?? null,
                     expiresAt: grant.expiresAt ?? null,
                     grantedBy: grant.grantedBy,
                     grantedAt: new Date().toISOString(),
-                });
+                }, this.adminEntry(actor, 'grantToConnection', { tenantId: grant.node.tenantId, scopeId: grant.node.scopeId, vertical: conn.vertical }, null, {
+                    connectionId: grant.connectionId,
+                    provider: conn.provider,
+                    permission: grant.permission,
+                    node: grant.node,
+                }));
+                if (!grant.node.scopeId) {
+                    // A tenant tuple changes the projected set, as its siblings' do: it fans out.
+                    await this.fanOut(grant.node.tenantId);
+                    return;
+                }
                 // #574: a scope-level grant is a SCOPE tuple, and the scope's DO lives in the
                 // deployment serving it — for the shared control plane that is the vertical's
-                // dispatch script, so the tuple write rides the delegation seam. Tenant-level
-                // grants stay directory-side either way.
-                if (this.connectorDelegation && grant.node.scopeId) {
+                // dispatch script, so the tuple write rides the delegation seam.
+                if (this.connectorDelegation) {
                     await this.connectorDelegation.grant({
                         connectionId: grant.connectionId,
                         tenantId: grant.node.tenantId,
                         scopeId: grant.node.scopeId,
-                        vertical: conn.vertical,
+                        vertical,
                         permission: grant.permission,
                         expiresAt: grant.expiresAt,
                     });
@@ -4455,17 +4509,13 @@ export class CloudflareScopeHost {
                 else {
                     await writeGrant(subjectRef({ kind: 'connection', id: grant.connectionId }), grant.permission, grant.node, undefined, grant.expiresAt);
                 }
-                await this.recordAdmin(actor, 'grantToConnection', { tenantId: grant.node.tenantId, scopeId: grant.node.scopeId, vertical: conn.vertical }, null, {
-                    connectionId: grant.connectionId,
-                    provider: conn.provider,
-                    permission: grant.permission,
-                    node: grant.node,
-                });
             },
             grantToSystem: async (actor, raw) => {
                 // The scheduler's grant (#383) — mirror of grantToConnection. Narrow: one
                 // module, one permission; tombstones on revoke; shows in the permission diff.
                 const grant = systemGrant.parse(raw);
+                const target = { tenantId: grant.node.tenantId, scopeId: grant.node.scopeId };
+                const after = { moduleId: grant.moduleId, permission: grant.permission, node: grant.node };
                 if (grant.node.scopeId) {
                     // #1666: refused while the module is switched off on this scope — checked and
                     // written in one DO unit. Restore is the lever; a grant is not.
@@ -4473,18 +4523,17 @@ export class CloudflareScopeHost {
                     if (!written) {
                         throw substratError('conflict', systemSwitchedOffMessage(grant.moduleId, grant.node.scopeId));
                     }
+                    await this.recordAdmin(actor, 'grantToSystem', target, null, after);
+                    return;
                 }
-                else {
-                    // #1743: refused while the record holds the module off on any scope — checked and
-                    // written in one control-plane call, where the record and the tenant tuple both live.
-                    const off = await this.cp.writeTenantSystemGrant(grant.node.tenantId, grant.moduleId, `granted:${grant.permission}`, grant.expiresAt ?? null);
-                    if (off.length > 0) {
-                        throw substratError('conflict', tenantSystemSwitchedOffMessage(grant.moduleId, off));
-                    }
+                // #1743: refused while the record holds the module off on any scope — checked and
+                // written in one control-plane call, where the record and the tenant tuple both live,
+                // and (#2526) the admin row with them.
+                const off = await this.directory('writeTenantSystemGrant', grant.node.tenantId, grant.moduleId, `granted:${grant.permission}`, grant.expiresAt ?? null, this.adminEntry(actor, 'grantToSystem', target, null, after));
+                if (off.length > 0) {
+                    throw substratError('conflict', tenantSystemSwitchedOffMessage(grant.moduleId, off));
                 }
-                await this.recordAdmin(actor, 'grantToSystem', { tenantId: grant.node.tenantId, scopeId: grant.node.scopeId }, null, { moduleId: grant.moduleId, permission: grant.permission, node: grant.node });
-                if (!grant.node.scopeId)
-                    await this.fanOut(grant.node.tenantId);
+                await this.fanOut(grant.node.tenantId);
             },
             // #1666: the schedule kill switch and its lever back — `system-switch.ts` is the
             // whole rule, shared with the pure adapter; this is the directory check, the reach
@@ -4572,10 +4621,16 @@ export class CloudflareScopeHost {
                 // applied, resolves for nobody, and still shows up in the permission diff.
                 await requireOrg(node.tenantId, orgId);
                 await this.refuseReservedGrant([permission], node.scopeId); // #2430: an org's members are people
-                await writeGrant(`org:${orgId}`, permission, node, entity);
-                await this.recordAdmin(actor, 'grantToOrg', { tenantId: node.tenantId, scopeId: node.scopeId }, null, { orgId, permission, node, entity });
-                if (!node.scopeId)
+                const target = { tenantId: node.tenantId, scopeId: node.scopeId };
+                const after = { orgId, permission, node, entity };
+                if (!node.scopeId && !entity) {
+                    // #2526: the org checked again, the tuple and its row, in one ControlPlaneDO unit.
+                    await this.directory('writeOrgTenantTuple', node.tenantId, orgId, `org:${orgId}`, `granted:${permission}`, `tenant:${node.tenantId}`, null, this.adminEntry(actor, 'grantToOrg', target, null, after));
                     await this.fanOut(node.tenantId);
+                    return;
+                }
+                await writeGrant(`org:${orgId}`, permission, node, entity);
+                await this.recordAdmin(actor, 'grantToOrg', target, null, after);
             },
             // -- vertical + version registry (#31) ---------------------------------
             // -- the hostname map (K-26) -------------------------------------------
@@ -5265,10 +5320,8 @@ export class CloudflareScopeHost {
             },
             createOrg: async (actor, input) => {
                 const parsed = createOrgInput.parse(input);
-                const created = await this.directory('createOrg', parsed.id, parsed.tenantId, parsed.slug, parsed.name, new Date().toISOString());
-                if (!created)
-                    return; // idempotent, and a no-op is not audited
-                await this.recordAdmin(actor, 'createOrg', { tenantId: parsed.tenantId }, null, parsed);
+                // #2526: the org and its row in one unit; an org that exists already writes neither.
+                await this.directory('insertOrg', parsed.id, parsed.tenantId, parsed.slug, parsed.name, new Date().toISOString(), this.adminEntry(actor, 'createOrg', { tenantId: parsed.tenantId }, null, parsed));
             },
             listOrgs: async (actor, tenantId) => {
                 const orgs = (await this.cp.listOrgs(tenantId)).map(mapOrg);
@@ -5281,10 +5334,9 @@ export class CloudflareScopeHost {
                 return r ? mapOrg(r) : undefined;
             },
             addMember: async (actor, tenantId, principal, orgId, opts) => {
-                await requireOrg(tenantId, orgId);
                 const expiresAt = opts?.expiresAt ?? null;
-                await this.cp.writeTenantTuple(tenantId, `principal:${principal}`, 'member', `org:${orgId}`, expiresAt);
-                await this.recordAdmin(actor, 'addMember', { tenantId }, null, memberAddedAudit(principal, orgId, expiresAt));
+                // #2526: the org's check, the tuple and its row, in one ControlPlaneDO unit.
+                await this.directory('writeOrgTenantTuple', tenantId, orgId, `principal:${principal}`, 'member', `org:${orgId}`, expiresAt, this.adminEntry(actor, 'addMember', { tenantId }, null, memberAddedAudit(principal, orgId, expiresAt)));
                 await this.fanOut(tenantId); // membership is a tenant-level tuple
             },
             applyMembership: async (actor, change) => {
@@ -7690,9 +7742,11 @@ export class CloudflareScopeHost {
             throw substratError('forbidden', `the owner's seat: ${ownerRefusal}`);
         const connections = await this.seatableConnectionGrants(input.tenantId, input.scopeId, input.connectionGrants);
         const services = await this.servicePrincipals?.(input.tenantId, input.scopeId);
-        const stub = this.scopeStub(input.scopeId);
         await this.migrateAndRecord(input.scopeId); // create the module tables (setMigrationState no-ops on a null CP)
-        const switchedOff = unwrapReply(await stub.applyProjectionReply(input.tenantId, input.roles.map((r) => ({ role_key: r.key, permissions: JSON.stringify(r.permissions), source: r.source, holder: r.holder === 'system' ? 'system' : 'person' })), [], // no tenant-level tuples — a CP-less vertical grants at scope level only
+        // #2531: judged again in the projection's own unit, on the roles and seats the scope holds as it
+        // writes, so a seat made since the pre-check above is seen. The module migrations above have
+        // already run when that refuses; they are this host's own setup, and the projection writes nothing.
+        const switchedOff = await this.projectJudged(input.tenantId, input.scopeId, projectedRoleRows(input.roles), [], // no tenant-level tuples — a CP-less vertical grants at scope level only
         // Only PROJECT (and thereby switch on strict enforcement) when the platform actually
         // supplies entitlements. Omitting them leaves the scope un-projected and trusting-
         // upstream, so a vertical whose provision path predates #304 is never denied — it
@@ -7752,7 +7806,7 @@ export class CloudflareScopeHost {
             : undefined, 
         // #1742: the recorded-off modules and (#2029) peers, switched off after the seat in the
         // same unit, on the scope this call provisions — the one the seat's tuples name.
-        carry ? { scopeId: input.scopeId, at: new Date().toISOString(), ...carry } : undefined, services?.map((id) => `principal:${id}`)));
+        carry ? { scopeId: input.scopeId, at: new Date().toISOString(), ...carry } : undefined, services?.map((id) => `principal:${id}`));
         const shapes = input.entityGrants
             ? await this.topUpEntityGrantShapesLocal(input.tenantId, input.scopeId, input.entityGrants)
             : null;
@@ -7831,7 +7885,8 @@ export class CloudflareScopeHost {
      * which replaces whatever the scope stores now, so what the set is judged against is the DUMP's
      * roles and seats for `dump.tenantId` (`dumpRoleState`), when the caller has the dump in hand. A
      * staged restore has not (its pages are already in the scope), so it is judged as a set alone
-     * here, and `projectRolesLocal` judges again after the import, against what the dump brought.
+     * here. The load given the vertical's `roles` judges again in its own transaction, against what
+     * the dump brought (#2531), and `projectRolesLocal` does in its unit where the load did not.
      */
     async roleSetRefusalLocal(scopeId, roles, dump) {
         const here = await this.scopeStub(scopeId).reservationHere();
@@ -7875,9 +7930,9 @@ export class CloudflareScopeHost {
      * and the roles the scope stores for the tenant now with their seats there. Answers the reserved
      * keys it judged with, for the seats the same call makes.
      *
-     * A stated residual: the scope state is read in one RPC (`roleStateHere`) and written in another
-     * (`applyProjectionReply`), so a seat made between the two is not seen. The window is one call
-     * wide, and a reconcile runs again every pass.
+     * The scope state is read in one RPC (`roleStateHere`) and written in another, so this is the
+     * first check, for its detailed wording; the write judges the set again inside its own unit
+     * (`projectJudged`, #2531), where a seat made between the two is seen.
      */
     async refuseReservedRoleSet(roles, tenantId, scopeId) {
         const stub = this.scopeStub(scopeId);