@substrat-run/adapter-cloudflare 0.163.0 → 0.165.0

package/dist/control-plane-do.js

@@ -3,7 +3,7 @@ import { membershipFencesBackfillSql, MEMBERSHIP_FENCES_DDL, MEMBERSHIP_FENCES_T
 import { replyOf } from './do-reply.js';
 import { switchSqlOver } from './scope-do.js';
 import { blankSqlComments, boundShapesColumn, executableSqlStatements, installsReconciledOf, PROVISIONED_VERSIONS_SQL, provisionedVersionsParams, } from '@substrat-run/kernel';
-import { COPY_BACKFILL_SCOPE_SQL, COPY_BACKFILL_SQL, COPY_BACKFILL_SUPERSEDE_SQL, COPY_CLAIM_SQL, COPY_EXPIRED_SQL, COPY_MOVE_RENEW_SQL, copyMoveRenewParams, PENDING_COPY_KEEP_ALIVE_SQL, pendingCopyKeepAliveParams, copyBackfillParams, copyBackfillRefusal, SUBJECT_ERASURE_CLAIM_SQL, subjectErasureClaimParams, COPY_MOVE_CONFIRM_SQL, COPY_MOVE_LIVE_PREDICATE, SCOPE_COPY_LEASE_MS, SERVES_NOW_CONDITION, SERVES_NOW_PREDICATE, servesNowParams, SCOPE_SCRIPT_COPY_COLUMNS, copyMoveConfirmParams, copyMoveLiveParams, } from '@substrat-run/kernel';
+import { COPY_BACKFILL_SCOPE_SQL, COPY_BACKFILL_SQL, COPY_BACKFILL_SUPERSEDE_SQL, COPY_CLAIM_SQL, COPY_EXPIRED_SQL, COPY_MOVE_RENEW_SQL, copyMoveRenewParams, PENDING_COPY_KEEP_ALIVE_SQL, pendingCopyKeepAliveParams, copyBackfillParams, copyBackfillRefusal, SUBJECT_ERASURE_CLAIM_SQL, subjectErasureClaimParams, COPY_MOVE_CONFIRM_SQL, COPY_MOVE_LIVE_PREDICATE, SCOPE_COPY_LEASE_MS, SERVES_NOW_CONDITION, SERVES_NOW_PREDICATE, servesNowParams, servesAsFrom, SCOPE_SCRIPT_COPY_COLUMNS, copyMoveConfirmParams, copyMoveLiveParams, } from '@substrat-run/kernel';
 import { autoAdmittedProdRefusal, listedPromoteRefusal, opsFailureReferenceWhere } from '@substrat-run/kernel';
 import { doBuiltColumnsOf, doRedactionSql } from './sql.js';
 import { assertReplayableDump, AUTO_ADMISSION_NOTE, instant, opsFailureFingerprint, ROUTE_SCOPE_HOSTNAMES_MAX, SCOPE_GATE_REASONS, substratError } from '@substrat-run/contracts';
@@ -842,6 +842,25 @@ export const REPLIED_METHODS = [
     'deleteHostname',
     'grantEntitlement',
     'revokeEntitlement',
+    // #2479: these names are new even where the bare method above already exists. A DO from
+    // before the audit unit must refuse the name, not drop a trailing audit argument and commit.
+    'putTenantStoreAndAudit',
+    'putBlobStoreAndAudit',
+    'recordStoreDriverReleaseAndAudit',
+    'beginStoreDriverRolloutAndAudit',
+    'finishStoreDriverRolloutAndAudit',
+    'importDumpAndAudit',
+    'registerIdentityPoolAndAudit',
+    'insertConnectionAndAudit',
+    'updateConnectionSecretAndAudit',
+    'revokeConnectionAndAudit',
+    'linkIdentityAndAudit',
+    'unlinkIdentityAndAudit',
+    'markAccessLogDrainedAndAudit',
+    'pruneAccessLogAndAudit',
+    'writeImpersonationAndAudit',
+    'endImpersonationAndAudit',
+    'setIssueStatusAndAudit',
 ];
 export class ControlPlaneDO extends DurableObject {
     sql;
@@ -1287,7 +1306,7 @@ export class ControlPlaneDO extends DurableObject {
      * are filled in afterwards, inside the same transaction. A refusal anywhere in it leaves the
      * directory as it was.
      */
-    async importDump(tables) {
+    async importDump(tables, audit) {
         // Same untrusted dump, same two holes as the scope path (#1143): names reaching SQL as
         // identifiers, and a `ddl` that is never executed here but is still held to one CREATE
         // TABLE. Pure input validation, so it runs before the first DROP: a refused dump touches
@@ -1326,6 +1345,10 @@ export class ControlPlaneDO extends DurableObject {
             // A dump never carries one (`exportDump`); a hand-made dump that does is outranked too.
             // Every deployment then takes this history's deliveries, whatever its counters say.
             this.sql.exec("INSERT OR REPLACE INTO lifecycle_revisions (subject, revision) VALUES ('directory:epoch', ?)", Math.max(epochBefore + 1, this.lifecycleEpoch() + 1, Date.now()));
+            // Append the restore's own row after the dump rows have landed in the rebuilt
+            // admin table, inside this same import transaction.
+            if (audit)
+                this.recordAdmin(audit);
         });
         // A restore is a new #1764 backfill episode. It replaced the data the old failure count and
         // backoff were about, so neither may delay or silence it: the count is cleared and the next
@@ -1494,21 +1517,26 @@ export class ControlPlaneDO extends DurableObject {
      * callers converge on one canonical row and the loser can tear its orphan mint down.
      * Fails closed on an unknown/non-active tenant, exactly as provisionScope does.
      */
-    putTenantStore(row) {
-        const tenantRow = this.sql
-            .exec('SELECT status FROM tenants WHERE tenant_id = ?', row.tenantId)
-            .toArray()[0];
-        if (!tenantRow) {
-            throw substratError('not_found', `cannot provision tenant store under unknown tenant: ${row.tenantId}`);
-        }
-        if (tenantRow.status !== 'active') {
-            throw substratError('conflict', `cannot provision tenant store under non-active tenant (status: ${tenantRow.status}): ${row.tenantId}`);
-        }
-        this.sql.exec(`INSERT OR IGNORE INTO tenant_stores (tenant_id, vertical, binding, kind, ref, created_at)
-       VALUES (?, ?, ?, ?, ?, ?)`, row.tenantId, row.vertical, row.binding, row.kind, row.ref, row.createdAt);
-        const stored = this.getTenantStore(row.tenantId, row.vertical, row.binding);
-        if (!stored)
-            throw new Error(`tenant store write did not land for tenant ${row.tenantId}`);
+    putTenantStore(row, audit) {
+        let stored;
+        this.writeAndAudit(() => {
+            const tenantRow = this.sql
+                .exec('SELECT status FROM tenants WHERE tenant_id = ?', row.tenantId)
+                .toArray()[0];
+            if (!tenantRow) {
+                throw substratError('not_found', `cannot provision tenant store under unknown tenant: ${row.tenantId}`);
+            }
+            if (tenantRow.status !== 'active') {
+                throw substratError('conflict', `cannot provision tenant store under non-active tenant (status: ${tenantRow.status}): ${row.tenantId}`);
+            }
+            const inserted = this.sql.exec(`INSERT OR IGNORE INTO tenant_stores (tenant_id, vertical, binding, kind, ref, created_at)
+       VALUES (?, ?, ?, ?, ?, ?)`, row.tenantId, row.vertical, row.binding, row.kind, row.ref, row.createdAt).rowsWritten > 0;
+            const found = this.getTenantStore(row.tenantId, row.vertical, row.binding);
+            if (!found)
+                throw new Error(`tenant store write did not land for tenant ${row.tenantId}`);
+            stored = found;
+            return inserted;
+        }, audit);
         return stored;
     }
     listTenantStores(filter) {
@@ -1538,21 +1566,26 @@ export class ControlPlaneDO extends DurableObject {
     }
     /** Record a minted blob store — FIRST WRITER WINS, same race protocol as
      *  putTenantStore: INSERT OR IGNORE then read back; the loser tears its orphan down. */
-    putBlobStore(row) {
-        const tenantRow = this.sql
-            .exec('SELECT status FROM tenants WHERE tenant_id = ?', row.tenantId)
-            .toArray()[0];
-        if (!tenantRow) {
-            throw substratError('not_found', `cannot provision blob store under unknown tenant: ${row.tenantId}`);
-        }
-        if (tenantRow.status !== 'active') {
-            throw substratError('conflict', `cannot provision blob store under non-active tenant (status: ${tenantRow.status}): ${row.tenantId}`);
-        }
-        this.sql.exec(`INSERT OR IGNORE INTO blob_stores (tenant_id, vertical, binding, kind, ref, created_at)
-       VALUES (?, ?, ?, ?, ?, ?)`, row.tenantId, row.vertical, row.binding, row.kind, row.ref, row.createdAt);
-        const stored = this.getBlobStore(row.tenantId, row.vertical, row.binding);
-        if (!stored)
-            throw new Error(`blob store write did not land for tenant ${row.tenantId}`);
+    putBlobStore(row, audit) {
+        let stored;
+        this.writeAndAudit(() => {
+            const tenantRow = this.sql
+                .exec('SELECT status FROM tenants WHERE tenant_id = ?', row.tenantId)
+                .toArray()[0];
+            if (!tenantRow) {
+                throw substratError('not_found', `cannot provision blob store under unknown tenant: ${row.tenantId}`);
+            }
+            if (tenantRow.status !== 'active') {
+                throw substratError('conflict', `cannot provision blob store under non-active tenant (status: ${tenantRow.status}): ${row.tenantId}`);
+            }
+            const inserted = this.sql.exec(`INSERT OR IGNORE INTO blob_stores (tenant_id, vertical, binding, kind, ref, created_at)
+       VALUES (?, ?, ?, ?, ?, ?)`, row.tenantId, row.vertical, row.binding, row.kind, row.ref, row.createdAt).rowsWritten > 0;
+            const found = this.getBlobStore(row.tenantId, row.vertical, row.binding);
+            if (!found)
+                throw new Error(`blob store write did not land for tenant ${row.tenantId}`);
+            stored = found;
+            return inserted;
+        }, audit);
         return stored;
     }
     listBlobStores(filter) {
@@ -1575,8 +1608,13 @@ export class ControlPlaneDO extends DurableObject {
     // -- store-driver releases, rollouts and holds (D-63, #2300) ---------------------
     // Kernel code over the directory (store-driver-releases.ts), shared with the SQLite host. Each
     // call is one transaction, and the object runs one at a time, so a hold is taken atomically.
-    recordStoreDriverRelease(input) {
-        return this.ctx.storage.transactionSync(() => recordStoreDriverReleaseIn(this.kernelSql, input));
+    recordStoreDriverRelease(input, audit) {
+        let result;
+        this.writeAndAudit(() => {
+            result = recordStoreDriverReleaseIn(this.kernelSql, input);
+            return result.created;
+        }, audit ? () => ({ ...audit, after: result.record }) : undefined);
+        return result;
     }
     getStoreDriverRelease(driver, sha256) {
         return storeDriverReleaseIn(this.kernelSql, driver, sha256);
@@ -1599,11 +1637,21 @@ export class ControlPlaneDO extends DurableObject {
     releaseStoreDriverHold(input) {
         releaseStoreDriverHoldIn(this.kernelSql, input);
     }
-    beginStoreDriverRollout(input) {
-        return this.ctx.storage.transactionSync(() => beginStoreDriverRolloutIn(this.kernelSql, { ...input, nowMs: Date.now() }));
+    beginStoreDriverRollout(input, audit) {
+        let row;
+        this.writeAndAudit(() => {
+            row = beginStoreDriverRolloutIn(this.kernelSql, { ...input, nowMs: Date.now() });
+            return true;
+        }, audit ? () => ({ ...audit, after: row }) : undefined);
+        return row;
     }
-    finishStoreDriverRollout(input) {
-        return this.ctx.storage.transactionSync(() => finishStoreDriverRolloutIn(this.kernelSql, { ...input, nowMs: Date.now() }));
+    finishStoreDriverRollout(input, audit) {
+        let row;
+        this.writeAndAudit(() => {
+            row = finishStoreDriverRolloutIn(this.kernelSql, { ...input, nowMs: Date.now() });
+            return true;
+        }, audit ? () => ({ ...audit, action: row.action === 'rollback' ? 'rollBackStoreDriver' : 'rollOutStoreDriver', after: row }) : undefined);
+        return row;
     }
     storeDriverRebuild(driver) {
         return storeDriverRebuildIn(this.kernelSql, driver);
@@ -2552,11 +2600,13 @@ export class ControlPlaneDO extends DurableObject {
     }
     /**
      * Record what the serving script now runs — written only after a successful in-place upload, so
-     * a failed serve leaves the trailing state visible. #2528: `expected` is the serving ref and
-     * version the caller's #2178 gate judged the move from (nulls: nothing served); the write lands
-     * only if the row still names both (`SERVES_NOW_CONDITION`), and `audit`'s `before` is the
-     * serving state this unit read. False when either moved. Optional and trailing, so a caller from
-     * before it still writes unconditionally.
+     * a failed serve leaves the trailing state visible. #2528: `expected` is the serving state the
+     * caller's #2178 gate judged the move from (nulls: nothing served); the write lands only if the
+     * row still holds it (`servesAsFrom`), and `audit`'s `before` is the serving state this unit read.
+     * False when it moved. #2577 added the class set and tag to `expected`, since a serve and a
+     * re-serve can bring the ref and version back over a grown class set. Each is optional, so a
+     * coordinator from before still sends the ref and version alone and gets the CAS it always had;
+     * `expected` is trailing, so one from before #2528 still writes unconditionally.
      */
     setVerticalServing(slug, s, audit, expected) {
         let before = null;
@@ -2566,11 +2616,12 @@ export class ControlPlaneDO extends DurableObject {
             if (!r)
                 throw substratError('not_found', `unknown vertical '${slug}'`);
             before = r.serving_ref ? { ref: r.serving_ref, versionId: r.serving_version_id } : null;
-            const moved = this.sql.exec(`UPDATE verticals SET serving_ref = ?, serving_version_id = ?,
-                serving_do_classes = ?, serving_migration_tag = ?
-          WHERE ${expected === undefined ? 'slug = ?' : SERVES_NOW_CONDITION}`, s.ref, s.versionId, s.doClassesJson, s.migrationTag, ...(expected === undefined ? [slug] : [slug, expected.ref, expected.versionId])).rowsWritten > 0;
-            raced = !moved;
-            return moved;
+            raced = expected !== undefined && !servesAsFrom(r, expected);
+            if (raced)
+                return false;
+            this.sql.exec(`UPDATE verticals SET serving_ref = ?, serving_version_id = ?,
+                serving_do_classes = ?, serving_migration_tag = ? WHERE slug = ?`, s.ref, s.versionId, s.doClassesJson, s.migrationTag, slug);
+            return true;
         }, audit && (() => ({ ...audit, before })));
         return !raced;
     }
@@ -2727,6 +2778,62 @@ export class ControlPlaneDO extends DurableObject {
             return changed;
         });
     }
+    /**
+     * The coordinator calls these new RPC names for directory-only audited writes. The old names
+     * remain callable by an older coordinator, which records its own row afterwards. An older DO
+     * knows none of these names and refuses before the state write instead of dropping the row.
+     */
+    putTenantStoreAndAudit(...args) {
+        return this.putTenantStore(...args);
+    }
+    putBlobStoreAndAudit(...args) {
+        return this.putBlobStore(...args);
+    }
+    recordStoreDriverReleaseAndAudit(...args) {
+        return this.recordStoreDriverRelease(...args);
+    }
+    beginStoreDriverRolloutAndAudit(...args) {
+        return this.beginStoreDriverRollout(...args);
+    }
+    finishStoreDriverRolloutAndAudit(...args) {
+        return this.finishStoreDriverRollout(...args);
+    }
+    importDumpAndAudit(...args) {
+        return this.importDump(...args);
+    }
+    registerIdentityPoolAndAudit(...args) {
+        return this.registerIdentityPool(...args);
+    }
+    insertConnectionAndAudit(...args) {
+        return this.insertConnection(...args);
+    }
+    updateConnectionSecretAndAudit(...args) {
+        return this.updateConnectionSecret(...args);
+    }
+    revokeConnectionAndAudit(...args) {
+        return this.revokeConnection(...args);
+    }
+    linkIdentityAndAudit(...args) {
+        return this.linkIdentity(...args);
+    }
+    unlinkIdentityAndAudit(...args) {
+        return this.unlinkIdentity(...args);
+    }
+    markAccessLogDrainedAndAudit(...args) {
+        return this.markAccessLogDrained(...args);
+    }
+    pruneAccessLogAndAudit(...args) {
+        return this.pruneAccessLog(...args);
+    }
+    writeImpersonationAndAudit(...args) {
+        return this.writeImpersonation(...args);
+    }
+    endImpersonationAndAudit(...args) {
+        return this.endImpersonation(...args);
+    }
+    setIssueStatusAndAudit(...args) {
+        return this.setIssueStatus(...args);
+    }
     scopeErasureEpoch(tenantId, scopeId) {
         // NULL on every row from before the column (#1722): the same 0 every CAS compares against.
         const row = this.sql.exec('SELECT COALESCE(erasure_epoch, 0) AS erasure_epoch FROM scopes WHERE tenant_id = ? AND scope_id = ?', tenantId, scopeId)
@@ -3309,16 +3416,18 @@ export class ControlPlaneDO extends DurableObject {
             .toArray()[0];
     }
     /** Returns false when an identical registration already exists; throws on a conflicting one. */
-    registerIdentityPool(provider, topology, tenantId, createdAt) {
-        const existing = this.readPool(provider);
-        if (existing) {
-            if (existing.topology === topology && existing.tenant_id === tenantId)
-                return false;
-            throw substratError('conflict', `identity pool '${provider}' is already registered as ${existing.topology}` +
-                `${existing.tenant_id ? ` for tenant ${existing.tenant_id}` : ''}`);
-        }
-        this.sql.exec('INSERT INTO _substrat_identity_pools (provider, topology, tenant_id, created_at) VALUES (?, ?, ?, ?)', provider, topology, tenantId, createdAt);
-        return true;
+    registerIdentityPool(provider, topology, tenantId, createdAt, audit) {
+        return this.writeAndAudit(() => {
+            const existing = this.readPool(provider);
+            if (existing) {
+                if (existing.topology === topology && existing.tenant_id === tenantId)
+                    return false;
+                throw substratError('conflict', `identity pool '${provider}' is already registered as ${existing.topology}` +
+                    `${existing.tenant_id ? ` for tenant ${existing.tenant_id}` : ''}`);
+            }
+            this.sql.exec('INSERT INTO _substrat_identity_pools (provider, topology, tenant_id, created_at) VALUES (?, ?, ?, ?)', provider, topology, tenantId, createdAt);
+            return true;
+        }, audit);
     }
     identityTenants(provider, externalId) {
         return this.sql
@@ -3386,27 +3495,30 @@ export class ControlPlaneDO extends DurableObject {
     // The DO owns the rows; the coordinator owns the SecretBox, so ciphertext
     // arrives already sealed and leaves still sealed. This DO has never seen a
     // plaintext credential and cannot.
-    insertConnection(row) {
-        // Live-uniqueness is per ACCOUNT (COALESCEd like the index): a provider
-        // without account refs stays a singleton; a multi-namespace provider may
-        // hold one live connection per external account.
-        const live = this.sql
-            .exec(`SELECT id FROM _substrat_connections
+    insertConnection(row, audit) {
+        this.writeAndAudit(() => {
+            // Live-uniqueness is per ACCOUNT (COALESCEd like the index): a provider
+            // without account refs stays a singleton; a multi-namespace provider may
+            // hold one live connection per external account.
+            const live = this.sql
+                .exec(`SELECT id FROM _substrat_connections
          WHERE tenant_id = ? AND vertical = ? AND provider = ?
            AND COALESCE(external_account_ref, '') = COALESCE(?, '') AND revoked_at IS NULL`, row.tenantId, row.vertical, row.provider, row.externalAccountRef)
-            .toArray()[0];
-        if (live) {
-            const account = row.externalAccountRef ? ` under account '${row.externalAccountRef}'` : '';
-            throw new Error(`tenant ${row.tenantId} already has a live '${row.provider}' connection ` +
-                `for vertical '${row.vertical}'${account} — revoke it before connecting another`);
-        }
-        this.sql.exec(`INSERT INTO _substrat_connections
+                .toArray()[0];
+            if (live) {
+                const account = row.externalAccountRef ? ` under account '${row.externalAccountRef}'` : '';
+                throw new Error(`tenant ${row.tenantId} already has a live '${row.provider}' connection ` +
+                    `for vertical '${row.vertical}'${account} — revoke it before connecting another`);
+            }
+            this.sql.exec(`INSERT INTO _substrat_connections
          (id, tenant_id, vertical, provider, label, status, external_account_ref,
           scopes, expires_at, last_ok_at, last_error, last_error_at,
           created_by, created_at, revoked_at)
        VALUES (?, ?, ?, ?, ?, 'active', ?, ?, ?, NULL, NULL, NULL, ?, ?, NULL)`, row.id, row.tenantId, row.vertical, row.provider, row.label, row.externalAccountRef, row.scopes, row.expiresAt, row.createdBy, row.createdAt);
-        this.sql.exec(`INSERT INTO _substrat_connection_secrets (connection_id, key_id, ciphertext, updated_at)
+            this.sql.exec(`INSERT INTO _substrat_connection_secrets (connection_id, key_id, ciphertext, updated_at)
        VALUES (?, ?, ?, ?)`, row.id, row.keyId, row.ciphertext, row.createdAt);
+            return true;
+        }, audit);
     }
     /** This connection's key rows — every one, current and retired (#687). */
     readConnectionKeys(connectionId) {
@@ -3475,12 +3587,15 @@ export class ControlPlaneDO extends DurableObject {
         }
         return rows[0];
     }
-    updateConnectionSecret(id, keyId, ciphertext, expiresAt, at) {
-        this.sql.exec(`UPDATE _substrat_connection_secrets
+    updateConnectionSecret(id, keyId, ciphertext, expiresAt, at, audit) {
+        this.writeAndAudit(() => {
+            this.sql.exec(`UPDATE _substrat_connection_secrets
        SET key_id = ?, ciphertext = ?, updated_at = ? WHERE connection_id = ?`, keyId, ciphertext, at, id);
-        this.sql.exec(`UPDATE _substrat_connections
+            this.sql.exec(`UPDATE _substrat_connections
        SET status = 'active', expires_at = ?, last_error = NULL, last_error_at = NULL
        WHERE id = ?`, expiresAt, id);
+            return true;
+        }, audit);
     }
     /**
      * Tombstone the connection and DELETE the sealed blob.
@@ -3489,21 +3604,23 @@ export class ControlPlaneDO extends DurableObject {
      * only be a liability. Returns false when already revoked, so the caller can
      * skip an audit row for a no-op.
      */
-    revokeConnection(id, at) {
-        const row = this.readConnection(id);
-        if (!row)
-            throw new Error(`connection not found: ${id}`);
-        if (row.revoked_at)
-            return false;
-        this.sql.exec(`UPDATE _substrat_connections SET status = 'revoked', revoked_at = ? WHERE id = ?`, at, id);
-        this.sql.exec('DELETE FROM _substrat_connection_secrets WHERE connection_id = ?', id);
-        // Connector state dies with the connection — its private bookkeeping.
-        this.sql.exec('DELETE FROM _substrat_connector_state WHERE connection_id = ?', id);
-        // #592: its grants tombstone (K-21 — evidence, not roster). Absent from the
-        // next gather, so no later provision/reconcile delivers them again.
-        this.sql.exec(`UPDATE _substrat_connection_grants SET revoked_at = ?
+    revokeConnection(id, at, audit) {
+        return this.writeAndAudit(() => {
+            const row = this.readConnection(id);
+            if (!row)
+                throw new Error(`connection not found: ${id}`);
+            if (row.revoked_at)
+                return false;
+            this.sql.exec(`UPDATE _substrat_connections SET status = 'revoked', revoked_at = ? WHERE id = ?`, at, id);
+            this.sql.exec('DELETE FROM _substrat_connection_secrets WHERE connection_id = ?', id);
+            // Connector state dies with the connection — its private bookkeeping.
+            this.sql.exec('DELETE FROM _substrat_connector_state WHERE connection_id = ?', id);
+            // #592: its grants tombstone (K-21 — evidence, not roster). Absent from the
+            // next gather, so no later provision/reconcile delivers them again.
+            this.sql.exec(`UPDATE _substrat_connection_grants SET revoked_at = ?
        WHERE connection_id = ? AND revoked_at IS NULL`, at, id);
-        return true;
+            return true;
+        }, audit);
     }
     // -- a vertical's mailed connect links (connections.md §3.5.4) ------------------
     // The kernel's statements (`connect-links.ts`), shared with the pure adapter. Each
@@ -3712,31 +3829,35 @@ export class ControlPlaneDO extends DurableObject {
             .filter((r) => !prefix || r.state_key.startsWith(prefix))
             .map((r) => ({ key: r.state_key, value: r.value }));
     }
-    linkIdentity(provider, externalId, principal, tenantId, scopeId, createdAt) {
-        const existing = this.sql
-            .exec(`SELECT principal_id FROM _substrat_identities
+    linkIdentity(provider, externalId, principal, tenantId, scopeId, createdAt, audit) {
+        return this.writeAndAudit(() => {
+            const existing = this.sql
+                .exec(`SELECT principal_id FROM _substrat_identities
          WHERE tenant_id = ? AND provider = ? AND external_id = ?`, tenantId, provider, externalId)
-            .toArray()[0];
-        if (existing) {
-            if (existing.principal_id === principal)
-                return false;
-            throw substratError('conflict', `identity ${provider}:${externalId} in tenant ${tenantId} is already bound to ${existing.principal_id}`);
-        }
-        this.sql.exec(`INSERT INTO _substrat_identities
+                .toArray()[0];
+            if (existing) {
+                if (existing.principal_id === principal)
+                    return false;
+                throw substratError('conflict', `identity ${provider}:${externalId} in tenant ${tenantId} is already bound to ${existing.principal_id}`);
+            }
+            this.sql.exec(`INSERT INTO _substrat_identities
          (provider, external_id, principal_id, tenant_id, scope_id, created_at)
        VALUES (?, ?, ?, ?, ?, ?)`, provider, externalId, principal, tenantId, scopeId, createdAt);
-        return true;
+            return true;
+        }, audit);
     }
     /** Remove a principal's identity link(s) in a tenant. Returns whether a row was
      *  deleted so a no-op stays silent (idempotent). */
-    unlinkIdentity(tenantId, principal) {
-        const before = this.sql
-            .exec(`SELECT 1 FROM _substrat_identities WHERE tenant_id = ? AND principal_id = ?`, tenantId, principal)
-            .toArray();
-        if (before.length === 0)
-            return false;
-        this.sql.exec(`DELETE FROM _substrat_identities WHERE tenant_id = ? AND principal_id = ?`, tenantId, principal);
-        return true;
+    unlinkIdentity(tenantId, principal, audit) {
+        return this.writeAndAudit(() => {
+            const before = this.sql
+                .exec(`SELECT 1 FROM _substrat_identities WHERE tenant_id = ? AND principal_id = ?`, tenantId, principal)
+                .toArray();
+            if (before.length === 0)
+                return false;
+            this.sql.exec(`DELETE FROM _substrat_identities WHERE tenant_id = ? AND principal_id = ?`, tenantId, principal);
+            return true;
+        }, audit);
     }
     resolveIdentity(tenantId, provider, externalId) {
         const row = this.sql
@@ -3799,25 +3920,35 @@ export class ControlPlaneDO extends DurableObject {
      * Stamp `drained_at` on undrained rows up to `upToId`. The `IS NULL` guard makes a
      * retried shipment idempotent — it re-stamps nothing and returns 0 (K-24).
      */
-    markAccessLogDrained(upToId, drainedAt) {
-        const doomed = this.sql
-            .exec('SELECT id FROM _substrat_access_log WHERE id <= ? AND drained_at IS NULL', upToId)
-            .toArray().map((r) => r.id);
-        for (const id of doomed) {
-            this.sql.exec('UPDATE _substrat_access_log SET drained_at = ? WHERE id = ?', drainedAt, id);
-        }
-        return doomed.length;
+    markAccessLogDrained(upToId, drainedAt, audit) {
+        let drained = 0;
+        this.writeAndAudit(() => {
+            const doomed = this.sql
+                .exec('SELECT id FROM _substrat_access_log WHERE id <= ? AND drained_at IS NULL', upToId)
+                .toArray().map((r) => r.id);
+            for (const id of doomed) {
+                this.sql.exec('UPDATE _substrat_access_log SET drained_at = ? WHERE id = ?', drainedAt, id);
+            }
+            drained = doomed.length;
+            return drained > 0;
+        }, audit ? () => ({ ...audit, after: { drained, upToId, drainedAt } }) : undefined);
+        return drained;
     }
     /** ONLY drained rows. Age alone is not a licence to delete evidence (K-24). */
-    pruneAccessLog(limit) {
-        assertRowLimit('limit', limit);
-        const doomed = this.sql
-            .exec('SELECT id FROM _substrat_access_log WHERE drained_at IS NOT NULL ORDER BY id LIMIT ?', limit)
-            .toArray().map((r) => r.id);
-        for (const id of doomed) {
-            this.sql.exec('DELETE FROM _substrat_access_log WHERE id = ?', id);
-        }
-        return doomed.length;
+    pruneAccessLog(limit, audit) {
+        let pruned = 0;
+        this.writeAndAudit(() => {
+            assertRowLimit('limit', limit);
+            const doomed = this.sql
+                .exec('SELECT id FROM _substrat_access_log WHERE drained_at IS NOT NULL ORDER BY id LIMIT ?', limit)
+                .toArray().map((r) => r.id);
+            for (const id of doomed) {
+                this.sql.exec('DELETE FROM _substrat_access_log WHERE id = ?', id);
+            }
+            pruned = doomed.length;
+            return pruned > 0;
+        }, audit ? () => ({ ...audit, after: { pruned } }) : undefined);
+        return pruned;
     }
     // -- per-subject keys (#37) -------------------------------------------------
     // The three row operations `createSubjectKeys` needs. The crypto is the kernel's; what
@@ -3870,9 +4001,9 @@ export class ControlPlaneDO extends DurableObject {
     // never reads these — the coordinator resolves the session and hands the DO the
     // two actors, which keeps the DO's invoke free of a directory round-trip.
     /** Insert a session the coordinator minted. Returns nothing; the caller holds it. */
-    writeImpersonation(values) {
-        this.sql.exec(`INSERT INTO _substrat_impersonations (${IMPERSONATION_COLUMNS})
-       VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`, ...values);
+    writeImpersonation(values, audit) {
+        this.writeAndAudit(() => this.sql.exec(`INSERT INTO _substrat_impersonations (${IMPERSONATION_COLUMNS})
+       VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`, ...values).rowsWritten > 0, audit);
     }
     /** One session by id, or undefined. The door's lookup and every invoke's re-read. */
     readImpersonation(id) {
@@ -3880,8 +4011,8 @@ export class ControlPlaneDO extends DurableObject {
         return this.sql.exec(q.sql, ...q.params).toArray()[0];
     }
     /** Close a session. Idempotent — a row already ended keeps its first `ended_at`. */
-    endImpersonation(id, endedAt) {
-        this.sql.exec('UPDATE _substrat_impersonations SET ended_at = ? WHERE id = ? AND ended_at IS NULL', endedAt, id);
+    endImpersonation(id, endedAt, audit) {
+        this.writeAndAudit(() => this.sql.exec('UPDATE _substrat_impersonations SET ended_at = ? WHERE id = ? AND ended_at IS NULL', endedAt, id).rowsWritten > 0, audit);
     }
     listImpersonations(filter, now) {
         const q = impersonationListQuery(filter, now);
@@ -4412,22 +4543,27 @@ export class ControlPlaneDO extends DurableObject {
         return rows.map((r) => issueOf(r));
     }
     /** The lifecycle write (#1233). Returns before/after for the caller's audit, or undefined. */
-    setIssueStatus(fingerprint, status, at) {
-        const rows = this.sql
-            .exec('SELECT * FROM _substrat_issues WHERE fingerprint = ?', fingerprint)
-            .toArray();
-        const existing = rows[0];
-        if (!existing)
-            return undefined;
-        const resolvedAt = status === 'resolved' ? at : null;
-        // "Resolved under X": freeze the newest version at the verdict, so a later
-        // regression can name the pair. A reopen or ignore clears it with the timestamp.
-        const resolvedVersion = status === 'resolved' ? existing.last_version : null;
-        this.sql.exec('UPDATE _substrat_issues SET status = ?, resolved_at = ?, resolved_version = ? WHERE fingerprint = ?', status, resolvedAt, resolvedVersion, fingerprint);
-        return {
-            before: issueOf(existing),
-            after: issueOf({ ...existing, status, resolved_at: resolvedAt, resolved_version: resolvedVersion }),
-        };
+    setIssueStatus(fingerprint, status, at, audit) {
+        let existing;
+        let after;
+        this.writeAndAudit(() => {
+            const rows = this.sql
+                .exec('SELECT * FROM _substrat_issues WHERE fingerprint = ?', fingerprint)
+                .toArray();
+            existing = rows[0];
+            if (!existing)
+                return false;
+            const resolvedAt = status === 'resolved' ? at : null;
+            // "Resolved under X": freeze the newest version at the verdict, so a later
+            // regression can name the pair. A reopen or ignore clears it with the timestamp.
+            const resolvedVersion = status === 'resolved' ? existing.last_version : null;
+            this.sql.exec('UPDATE _substrat_issues SET status = ?, resolved_at = ?, resolved_version = ? WHERE fingerprint = ?', status, resolvedAt, resolvedVersion, fingerprint);
+            after = { ...existing, status, resolved_at: resolvedAt, resolved_version: resolvedVersion };
+            return true;
+        }, audit ? () => ({ ...audit, vertical: after.last_vertical,
+            before: { fingerprint, status: existing.status },
+            after: { fingerprint, status: after.status } }) : undefined);
+        return existing && after ? { before: issueOf(existing), after: issueOf(after) } : undefined;
     }
     /** #1054: idempotent on request_id — a replayed intent writes nothing. */
     recordModelUsage(row) {