@substrat-run/adapter-cloudflare 0.163.0 → 0.165.0

package/dist/host.js

@@ -1,9 +1,9 @@
 import { env as ambientEnv } from 'cloudflare:workers';
 import { isRewindRefusal, REWIND_REFUSED } from './rewind-refusal.js';
 import { isSystemDoorMoved, SYSTEM_DOOR_MOVED, SYSTEM_DOOR_REGATES } from './system-door.js';
-import { delegatedReadParams, operationSeriesCount, fromWireFailure, isSubstratError, exportReadInput, exportedBatch, importBatch, importResult, importState, importsOfManifestJson, connectionLandingsOfManifestJson, exportsOfManifestJson, assertNoBindingShapeBreak, importCursorMove, importCursorMoveAt, importCursorMoved, accessLogEntry, adminLogEntry, opsFailureEntry, opsFailureFingerprint, issueEntry, findingEntry, findingRuleEntry, sweepRunEntry, FRESHNESS_HEARTBEAT_MINUTES, sweepRunsPayload, modelUsageEntry, createTenantInput, identityLink, identityPool, createOrgInput, promotionAcknowledgement, bindAcknowledgement, bindHostnameInput, channelHistoryEntry, hostnameBinding, publishVersionInput, AUTO_ADMISSION_NOTE, registerVerticalInput, vertical as verticalSchema, verticalServingState, deploymentWireAuth, verticalChannel, verticalVersion, connection, capabilityExchange, mintedCapability, boundedBecomeMint, boundedBecomeRevoke, boundedUnbind, entityRef, becomeLinkState, principalBecomeCapabilityInput, capabilityGrant, principalId, connectionGrant, connectionGrantRecord, connectionSecret, systemGrant, systemSwitch, systemSwitchOutcome, systemScheduleEntry, systemSwitchRecord, entitlementGrant, entitlementGrantInput, capabilityFilter, instant, meterReading, scopeStorageSample, requestDay, requestRollupDay, meterDay, meterDayTake, verticalOwnerPeriod, subjectRef, createConnectionInput, connectLinkFilter, connectLinkKey, consumeConnectLinkInput, mintConnectLinkInput, projectedConnectionGrant, projectedConnectionKey, moduleManifest, org as orgSchema, orgMembership, resolvedIdentity, identityMembership, roleDefinition, scope as scopeSchema, tenant as tenantSchema, tenantRole, delegatedReadRecord, ownerTransferAudit, memberChangeAudit, peerBindingAudit, connectionBindingAudit, copyMarkAudit, orphanSweepAudit, subjectShredReceipt, connectorDispatchKind, callsOfManifestJson, outboundOfManifestJson, SCOPE_GATE_REASONS, substratError, errorCodeOf, redrainEventsInput, coverage, peerCoverage, peerGrantsEntry, peerSwitch, peerSwitchOutcome, verticalCaller, verticalResolution, peerInstanceResolution, peerBinding as peerBindingSchema, verticalSlug, entityObjectRef, ATTACHMENT_BLOB_BINDING, blobStoreBindingName, lifecycleDelivery, scopeLifecycle, } from '@substrat-run/contracts';
+import { delegatedReadParams, operationSeriesCount, fromWireFailure, isSubstratError, exportReadInput, exportedBatch, importBatch, importResult, importState, importsOfManifestJson, connectionLandingsOfManifestJson, connectorsOfManifestJson, exportsOfManifestJson, assertNoBindingShapeBreak, importCursorMove, importCursorMoveAt, importCursorMoved, accessLogEntry, adminLogEntry, opsFailureEntry, opsFailureFingerprint, issueEntry, findingEntry, findingRuleEntry, sweepRunEntry, FRESHNESS_HEARTBEAT_MINUTES, sweepRunsPayload, modelUsageEntry, createTenantInput, identityLink, identityPool, createOrgInput, promotionAcknowledgement, bindAcknowledgement, bindHostnameInput, channelHistoryEntry, hostnameBinding, publishVersionInput, AUTO_ADMISSION_NOTE, registerVerticalInput, vertical as verticalSchema, verticalServingState, deploymentWireAuth, verticalChannel, verticalVersion, connection, capabilityExchange, mintedCapability, boundedBecomeMint, boundedBecomeRevoke, boundedUnbind, entityRef, becomeLinkState, principalBecomeCapabilityInput, capabilityGrant, principalId, connectionGrant, connectionGrantRecord, connectionSecret, systemGrant, systemSwitch, systemSwitchOutcome, systemScheduleEntry, systemSwitchRecord, entitlementGrant, entitlementGrantInput, capabilityFilter, instant, meterReading, scopeStorageSample, requestDay, requestRollupDay, meterDay, meterDayTake, verticalOwnerPeriod, subjectRef, createConnectionInput, connectLinkFilter, connectLinkKey, consumeConnectLinkInput, mintConnectLinkInput, projectedConnectionGrant, projectedConnectionKey, moduleManifest, org as orgSchema, orgMembership, resolvedIdentity, identityMembership, roleDefinition, scope as scopeSchema, tenant as tenantSchema, tenantRole, delegatedReadRecord, ownerTransferAudit, memberChangeAudit, peerBindingAudit, connectionBindingAudit, copyMarkAudit, orphanSweepAudit, subjectShredReceipt, connectorDispatchKind, callsOfManifestJson, outboundOfManifestJson, SCOPE_GATE_REASONS, substratError, errorCodeOf, redrainEventsInput, coverage, peerCoverage, peerGrantsEntry, peerSwitch, peerSwitchOutcome, verticalCaller, verticalResolution, peerInstanceResolution, peerBinding as peerBindingSchema, verticalSlug, entityObjectRef, ATTACHMENT_BLOB_BINDING, blobStoreBindingName, lifecycleDelivery, scopeLifecycle, } from '@substrat-run/contracts';
 import { normalizeHostname, toRouteTarget } from './route-resolver.js';
-import { attachmentBlobKey, normalizeUploadMediaType, redeemOrReplayUploadLink, attachmentSha256, bytesStream, isSizedByteStream, openAttachmentByteStream, putAttachmentBytes, entitlementDenial, requiredEntitlementFor, foldMeterReading, parseValidationRecords, readableScopes, resolveScopeRecord, ulid, withheldOpsFailure, KEPT_COPY_REFUSAL, capabilityTokenHash, checkBecomeInput, assertBecomeLinkStateIds, plausibleSessionToken, foldModelUsage, backoffAt, resolveRetryPolicy, executorOutcomeOf, isDeliveryRefusal, refusalJournalText, isSecretBoxConfigured, unconfiguredSecretBox, createSubjectKeys, generateSealingKeyPair, openSealed, ImpersonationRefused, assertSessionUsable, impersonationRowValues, mapImpersonationRow, newImpersonationSession, jobRunOf, assertLeaseMs, runDueJobRuns, SYSTEM_DOOR_WAIT, startJobRun, attachmentTextJob, assertAttachmentExtractors, resolveAttachmentTextBounds, assertJobRegistrable, ATTACHMENT_TEXT_BACKFILL_JOB, ATTACHMENT_TEXT_JOB, kernelJobFor, attachmentTextBackfillJob, searchLimit, searchMatchExpression, globalFetch, fetchLikeOf, deadlineFetch, assertRedrainWindow, platformRequestOf, undrainedEventsOf, inUnitMovesToAudit, staleCarryRevertRow, staleCarryReverts, recordedOffFromWire, peerSubjectRef, SWITCH_KINDS, reassertActionOf, reassertEntry, reassertOffRow, reassertOnRow, switchActionOf, switchAuditSubject, recordAuditOutcome, auditedCapabilityRevoke, auditWarningOf, switchNotFoundMessage, recordWriteSuperseded, switchSubjectOf, switchSupersededMessage, withRecorded, systemSwitchedOffMessage, tenantSystemSwitchedOffMessage, CrossVerticalRegistry, importCursorSourceOf, exportBreaksOf, exportBreakRefusal, assertPromoteReviewCurrent, promoteRaceRefusal, servingRaceRefusal, rebindRaceRefusal, bindExportBreaksOf, bindExportBreakRefusal, scopeMoveOf, runningVersionOf, strandJudgmentsOf, boundShapesOfColumn, installReconciled, collectPeers, peerCallerAt, peerSeats, connectorCallRecord, noopConnectorCallRecorder, recordConnectorCall, settleConnectionUse, splitManifestMigrations, publishedMigrationDigest, migrationChangeRefusal, unknownRoleError, assertRowLimit, assertRowOffset, emptyImportResult, INERT_SCOPE_REASON, lifecycleReceipt, lifecycleRefusal, scopeNotHeldRefusal, isPrimaryScope, isPrimaryScopeRow, asyncInvocationId, asyncLinePass, assertNoCallerPurge, purgeReportOf, purgeStillDue, assertBoundOperations, registerTrashTargets, assertModuleDeclared, noteDeclaredKeys, noteReservedKeys, reservedGrantRefusal, reservedRoleRefusal, reservedRoleSetRefusal, reservedShapeRefusal, SEAT_HOLDING_SCOPE_STATUSES, dumpRoleRefusal, dumpRoleState, memberAddedAudit, shapeTopUpBatch, verticalOwnerNow, } from '@substrat-run/kernel';
+import { attachmentBlobKey, normalizeUploadMediaType, redeemOrReplayUploadLink, attachmentSha256, bytesStream, isSizedByteStream, openAttachmentByteStream, putAttachmentBytes, entitlementDenial, requiredEntitlementFor, foldMeterReading, parseValidationRecords, readableScopes, resolveScopeRecord, ulid, withheldOpsFailure, KEPT_COPY_REFUSAL, capabilityTokenHash, checkBecomeInput, assertBecomeLinkStateIds, plausibleSessionToken, foldModelUsage, backoffAt, resolveRetryPolicy, executorOutcomeOf, isDeliveryRefusal, refusalJournalText, isSecretBoxConfigured, unconfiguredSecretBox, createSubjectKeys, generateSealingKeyPair, openSealed, ImpersonationRefused, assertSessionUsable, impersonationRowValues, mapImpersonationRow, newImpersonationSession, jobRunOf, assertLeaseMs, runDueJobRuns, SYSTEM_DOOR_WAIT, startJobRun, attachmentTextJob, assertAttachmentExtractors, resolveAttachmentTextBounds, assertJobRegistrable, ATTACHMENT_TEXT_BACKFILL_JOB, ATTACHMENT_TEXT_JOB, kernelJobFor, attachmentTextBackfillJob, searchLimit, searchMatchExpression, globalFetch, fetchLikeOf, deadlineFetch, assertRedrainWindow, platformRequestOf, undrainedEventsOf, inUnitMovesToAudit, staleCarryRevertRow, staleCarryReverts, recordedOffFromWire, peerSubjectRef, SWITCH_KINDS, reassertActionOf, reassertEntry, reassertOffRow, reassertOnRow, switchActionOf, switchAuditSubject, recordAuditOutcome, auditedCapabilityRevoke, auditWarningOf, switchNotFoundMessage, recordWriteSuperseded, switchSubjectOf, switchSupersededMessage, withRecorded, systemSwitchedOffMessage, tenantSystemSwitchedOffMessage, CrossVerticalRegistry, importCursorSourceOf, exportBreaksOf, exportBreakRefusal, assertPromoteReviewCurrent, promoteRaceRefusal, servingRaceRefusal, migratesFrom, servedFromRow, rebindRaceRefusal, bindExportBreaksOf, bindExportBreakRefusal, scopeMoveOf, runningVersionOf, strandJudgmentsOf, boundShapesOfColumn, installReconciled, collectPeers, peerCallerAt, peerSeats, connectorCallRecord, noopConnectorCallRecorder, recordConnectorCall, settleConnectionUse, splitManifestMigrations, publishedMigrationDigest, migrationChangeRefusal, unknownRoleError, assertRowLimit, assertRowOffset, emptyImportResult, INERT_SCOPE_REASON, lifecycleReceipt, lifecycleRefusal, scopeNotHeldRefusal, isPrimaryScope, isPrimaryScopeRow, asyncInvocationId, asyncLinePass, assertNoCallerPurge, purgeReportOf, purgeStillDue, assertBoundOperations, registerTrashTargets, assertModuleDeclared, noteDeclaredKeys, noteReservedKeys, reservedGrantRefusal, reservedRoleRefusal, reservedRoleSetRefusal, reservedShapeRefusal, SEAT_HOLDING_SCOPE_STATUSES, dumpRoleRefusal, dumpRoleState, memberAddedAudit, shapeTopUpBatch, verticalOwnerNow, } from '@substrat-run/kernel';
 import { fenceAttachmentSweep, missingAttachmentStore, sweepOrphanAttachments, unsettledCopyRefusal } from '@substrat-run/kernel';
 import { assertWireAuthFilter, wireAuthAccessTarget, COPY_RESTORE_FENCE_LAPSED, scopeScriptCopyOf } from '@substrat-run/kernel';
 import { attributedView, isModuleErasureCounts, moduleErasurePlan, moduleRowsErased, callReservedStoreOperation, callScopeStore, observeStoreCall, replayStoreErasures, scopeStoreLifecycleOf, scopeStoreRunnersOf } from '@substrat-run/kernel';
@@ -165,9 +165,11 @@ export const SWITCH_HOLD_SNAPSHOT_MS = 2_000;
  * one older than `SWITCH_HOLD_SNAPSHOT_MS`. A state read that met rewound storage therefore
  * finished at least this long after the hold was written, so a snapshot taken before the hold
  * is past its age by then and is re-read. Each side measures a duration on its own clock;
- * nothing compares two clocks.
+ * nothing compares two clocks. Derived from the snapshot age, never set on its own, so no host
+ * can be given a settle that does not outlast its snapshot (`switchHoldSnapshotMs`).
  */
-export const SWITCH_HOLD_SETTLE_MS = SWITCH_HOLD_SNAPSHOT_MS + 1_000;
+export const switchHoldSettleMs = (snapshotMs) => (snapshotMs * 3) / 2;
+export const SWITCH_HOLD_SETTLE_MS = switchHoldSettleMs(SWITCH_HOLD_SNAPSHOT_MS);
 /**
  * #1839: how many times a rewind waits again, after its settle, for a row a late OFF added to its
  * claim to be `SWITCH_HOLD_SETTLE_MS` old. The settle argument above holds per ROW, so a row
@@ -479,6 +481,9 @@ export class CloudflareScopeHost {
      * join this one read rather than each sending their own.
      */
     holdRefresh = null;
+    /** #1819: `SWITCH_HOLD_SNAPSHOT_MS` and `SWITCH_HOLD_SETTLE_MS`, unless `switchHoldSnapshotMs` is given. */
+    holdSnapshotMs;
+    holdSettleMs;
     /**
      * MUST be constructed per request. Never cache an instance across requests.
      *
@@ -509,6 +514,12 @@ export class CloudflareScopeHost {
         // #2498: whatever fetch is injected, a sized stream body reaches it converted (`fetchLikeOf`).
         this.fetchImpl = fetchLikeOf(options.fetch ?? globalFetch);
         this.streamIdleMs = options.streamIdleTimeoutMs;
+        this.holdSnapshotMs = options.switchHoldSnapshotMs ?? SWITCH_HOLD_SNAPSHOT_MS;
+        // NaN or Infinity never expires a snapshot; zero or less settles for nothing.
+        if (!Number.isFinite(this.holdSnapshotMs) || this.holdSnapshotMs <= 0) {
+            throw new RangeError(`switchHoldSnapshotMs must be a positive, finite number of milliseconds, got ${this.holdSnapshotMs}`);
+        }
+        this.holdSettleMs = switchHoldSettleMs(this.holdSnapshotMs);
         this.connectorCalls = options.connectorCalls ?? noopConnectorCallRecorder;
         this.scopeLocalPermissions = options.scopeLocalPermissions ?? false;
         this.scopeNs = options.scope;
@@ -1853,14 +1864,14 @@ export class CloudflareScopeHost {
         // the source of truth, carrying the D1 database_id Cloudflare assigned as the ref.
         const name = await tenantStoreDatabaseName(input.tenantId, input.vertical, input.binding);
         const ref = await d1.create(name);
-        const stored = await this.directory('putTenantStore', {
+        const stored = await this.directory('putTenantStoreAndAudit', {
             tenantId: input.tenantId,
             vertical: input.vertical,
             binding: input.binding,
             kind: 'relational',
             ref,
             createdAt: new Date().toISOString(),
-        });
+        }, this.adminEntry(actor, 'provisionTenantStore', { tenantId: input.tenantId, vertical: input.vertical }, null, { binding: input.binding, kind: 'relational', ref }));
         if (stored.ref !== ref) {
             // A concurrent provision won the ledger write. One database is canonical — the
             // ledger's — so drop ours rather than orphan it (best-effort: a leaked delete
@@ -1868,7 +1879,6 @@ export class CloudflareScopeHost {
             await d1.remove(ref).catch(() => undefined);
             return { binding: input.binding, kind: 'relational', ref: stored.ref };
         }
-        await this.recordAdmin(actor, 'provisionTenantStore', { tenantId: input.tenantId, vertical: input.vertical }, null, { binding: input.binding, kind: 'relational', ref });
         return { binding: input.binding, kind: 'relational', ref };
     }
     openTenantStore(handle) {
@@ -1914,19 +1924,18 @@ export class CloudflareScopeHost {
             return { binding: input.binding, kind: 'blob', ref: existing.ref };
         const name = await blobStoreBucketName(input.tenantId, input.vertical, input.binding);
         const ref = await r2.create(name);
-        const stored = await this.directory('putBlobStore', {
+        const stored = await this.directory('putBlobStoreAndAudit', {
             tenantId: input.tenantId,
             vertical: input.vertical,
             binding: input.binding,
             kind: 'blob',
             ref,
             createdAt: new Date().toISOString(),
-        });
+        }, this.adminEntry(actor, 'provisionBlobStore', { tenantId: input.tenantId, vertical: input.vertical }, null, { binding: input.binding, kind: 'blob', ref }));
         if (stored.ref !== ref) {
             await r2.remove(ref).catch(() => undefined);
             return { binding: input.binding, kind: 'blob', ref: stored.ref };
         }
-        await this.recordAdmin(actor, 'provisionBlobStore', { tenantId: input.tenantId, vertical: input.vertical }, null, { binding: input.binding, kind: 'blob', ref });
         return { binding: input.binding, kind: 'blob', ref };
     }
     /**
@@ -4792,6 +4801,9 @@ export class CloudflareScopeHost {
                     installSpec.provides = parsed.provides;
                 if (parsed.requires)
                     installSpec.requires = parsed.requires;
+                // The declared vertical-defined connectors (vertical-connectors.md §7.2), the dashboard's door.
+                if (parsed.connectors)
+                    installSpec.connectors = parsed.connectors;
                 // Declared provisioner intent (#455) — the request half of the tenant-provisioner
                 // capability; the grant is its own column, never part of this refreshable bag.
                 if (parsed.provisions)
@@ -4989,6 +5001,7 @@ export class CloudflareScopeHost {
                     ack,
                     channel,
                     baseId: outgoing?.id ?? null,
+                    permissionsChange: outgoing !== undefined && outgoing.permission_digest !== incoming.permission_digest,
                     migrationsChange: outgoing !== undefined && outgoing.migration_digest !== incoming.migration_digest,
                     read: async () => ({ base: outgoing ? await reviewed(outgoing) : null, incoming: await reviewed(incoming) }),
                 });
@@ -5207,11 +5220,14 @@ export class CloudflareScopeHost {
                     migrationTag: r.serving_migration_tag,
                 });
             },
-            setVerticalServing: async (actor, verticalSlug, state) => {
+            setVerticalServing: async (actor, verticalSlug, state, expected) => {
                 const parsed = verticalServingState.parse(state);
                 const r = await this.cp.readVertical(verticalSlug);
                 if (!r)
                     throw substratError('not_found', `unknown vertical '${verticalSlug}'`);
+                // #2577: the caller's upload diffed its DO-class migration from `expected`'s class set and tag.
+                if (expected !== undefined && !migratesFrom(r, expected))
+                    throw servingRaceRefusal(verticalSlug);
                 // #2178: every install on the serving script runs the new version from this moment.
                 if (r.serving_version_id) {
                     const incoming = await this.cp.readVersion(parsed.versionId);
@@ -5219,14 +5235,15 @@ export class CloudflareScopeHost {
                         await this.assertNoStrandFrom([r.serving_version_id], incoming.id, incoming, r.serving_ref ? await this.cp.provisionedVersionsOf(verticalSlug, { ref: r.serving_ref, versionId: r.serving_version_id }, null) : []);
                     }
                 }
-                // #2528: a compare-and-set on the serving ref and version the gate above judged, across
-                // awaits another serve can run in. The DO fills the row's `before` from the state it moves.
+                // #2528/#2577: a compare-and-set on the serving state the gate above judged, its class set
+                // and tag included, across awaits another serve can run in. The DO fills the row's `before`
+                // from the state it moves.
                 const moved = await this.directory('setVerticalServing', verticalSlug, {
                     ref: parsed.ref,
                     versionId: parsed.versionId,
                     doClassesJson: JSON.stringify(parsed.doClasses),
                     migrationTag: parsed.migrationTag,
-                }, this.adminEntry(actor, 'setVerticalServing', { tenantId: null }, null, { vertical: verticalSlug, ref: parsed.ref, versionId: parsed.versionId }), { ref: r.serving_ref ?? null, versionId: r.serving_version_id ?? null });
+                }, this.adminEntry(actor, 'setVerticalServing', { tenantId: null }, null, { vertical: verticalSlug, ref: parsed.ref, versionId: parsed.versionId }), servedFromRow(r));
                 if (!moved)
                     throw servingRaceRefusal(verticalSlug);
             },
@@ -5491,9 +5508,7 @@ export class CloudflareScopeHost {
             // -- store-driver releases, rollouts and holds (D-63, #2300) -------------------
             recordStoreDriverRelease: async (actor, input) => {
                 const at = new Date().toISOString();
-                const { record, created } = await this.directory('recordStoreDriverRelease', { ...input, actor, at });
-                if (created)
-                    await this.recordAdmin(actor, 'uploadStoreDriverRelease', { tenantId: null }, null, record);
+                const { record } = await this.directory('recordStoreDriverReleaseAndAudit', { ...input, actor, at }, this.adminEntry(actor, 'uploadStoreDriverRelease', { tenantId: null }, null, null));
                 return record;
             },
             getStoreDriverRelease: async (actor, driver, sha256) => {
@@ -5526,13 +5541,11 @@ export class CloudflareScopeHost {
                 await this.cp.releaseStoreDriverHold(input);
             },
             beginStoreDriverRollout: async (actor, input) => {
-                const row = await this.directory('beginStoreDriverRollout', { ...input, actor, at: new Date().toISOString() });
-                await this.recordAdmin(actor, input.action === 'rollback' ? 'rollBackStoreDriver' : 'rollOutStoreDriver', { tenantId: null }, null, row);
+                const row = await this.directory('beginStoreDriverRolloutAndAudit', { ...input, actor, at: new Date().toISOString() }, this.adminEntry(actor, input.action === 'rollback' ? 'rollBackStoreDriver' : 'rollOutStoreDriver', { tenantId: null }, null, null));
                 return row;
             },
             finishStoreDriverRollout: async (actor, input) => {
-                const row = await this.directory('finishStoreDriverRollout', { ...input, at: new Date().toISOString() });
-                await this.recordAdmin(actor, row.action === 'rollback' ? 'rollBackStoreDriver' : 'rollOutStoreDriver', { tenantId: null }, null, row);
+                const row = await this.directory('finishStoreDriverRolloutAndAudit', { ...input, at: new Date().toISOString() }, this.adminEntry(actor, 'rollOutStoreDriver', { tenantId: null }, null, null));
                 return row;
             },
             storeDriverRebuild: async (actor, driver) => {
@@ -5831,8 +5844,7 @@ export class CloudflareScopeHost {
                 // admin log too, so an entry written first would be overwritten by the very act
                 // it records, leaving the platform's most consequential write invisible.
                 const before = (await this.cp.listTenants({ limit: 1000 })).length;
-                await this.cp.importDump(dump.tables);
-                await this.recordAdmin(actor, 'restoreDirectory', { tenantId: null }, { tenants: before }, { capturedAt: dump.capturedAt, tables: dump.tables.length });
+                await this.directory('importDumpAndAudit', dump.tables, this.adminEntry(actor, 'restoreDirectory', { tenantId: null }, { tenants: before }, { capturedAt: dump.capturedAt, tables: dump.tables.length }));
             },
             activateScope: async (actor, tenantId, scopeId) => {
                 // Idempotent on `active`, unaudited because nothing changed. Provisioning is
@@ -6060,11 +6072,10 @@ export class CloudflareScopeHost {
                 // anyway leaves the admin log recording an access that could not happen.
                 await this.assertScope(input.tenantId, input.scopeId);
                 const session = newImpersonationSession(ulid(), actor, input, new Date().toISOString());
-                await this.cp.writeImpersonation(impersonationRowValues(session));
+                await this.directory('writeImpersonationAndAudit', impersonationRowValues(session), this.adminEntry(actor, 'beginImpersonation', { tenantId: session.tenantId, scopeId: session.scopeId }, null, session));
                 // BEFORE the session is usable, so the log entry precedes every row it
                 // will ever touch. The reason rides in `after`: it is what a review reads
                 // first, and a log saying a session opened but not why is half a record.
-                await this.recordAdmin(actor, 'beginImpersonation', { tenantId: session.tenantId, scopeId: session.scopeId }, null, session);
                 return session;
             },
             endImpersonation: async (actor, id) => {
@@ -6076,9 +6087,9 @@ export class CloudflareScopeHost {
                 // already stopped it.
                 if (before.endedAt !== null)
                     return before;
-                await this.cp.endImpersonation(String(id), new Date().toISOString());
+                const endedAt = new Date().toISOString();
+                await this.directory('endImpersonationAndAudit', String(id), endedAt, this.adminEntry(actor, 'endImpersonation', { tenantId: before.tenantId, scopeId: before.scopeId }, before, { ...before, endedAt }));
                 const after = mapImpersonationRow((await this.cp.readImpersonation(String(id))));
-                await this.recordAdmin(actor, 'endImpersonation', { tenantId: after.tenantId, scopeId: after.scopeId }, before, after);
                 return after;
             },
             listImpersonations: async (actor, filter) => {
@@ -6158,12 +6169,11 @@ export class CloudflareScopeHost {
             },
             registerIdentityPool: async (actor, input) => {
                 const parsed = identityPool.parse(input);
-                const created = await this.directory('registerIdentityPool', parsed.provider, parsed.topology, parsed.tenantId, new Date().toISOString());
+                const created = await this.directory('registerIdentityPoolAndAudit', parsed.provider, parsed.topology, parsed.tenantId, new Date().toISOString(), this.adminEntry(actor, 'registerIdentityPool', { tenantId: parsed.tenantId }, null, parsed));
                 if (!created)
                     return; // identical registration is idempotent, unaudited
                 // Null tenant for a central pool: it belongs to no single tenant, which is
                 // what made the admin log's tenantId nullable.
-                await this.recordAdmin(actor, 'registerIdentityPool', { tenantId: parsed.tenantId }, null, parsed);
             },
             getIdentityPool: async (actor, provider) => {
                 const r = await this.cp.readPool(provider);
@@ -6220,7 +6230,7 @@ export class CloudflareScopeHost {
                 // never seen a plaintext credential.
                 const sealed = await this.secretBox.seal(JSON.stringify(input.secret));
                 const now = new Date().toISOString();
-                await this.cp.insertConnection({
+                await this.directory('insertConnectionAndAudit', {
                     id: input.id,
                     tenantId: input.tenantId,
                     vertical: input.vertical,
@@ -6235,17 +6245,16 @@ export class CloudflareScopeHost {
                     createdAt: now,
                     keyId: sealed.keyId,
                     ciphertext: sealed.ciphertext,
-                });
-                // METADATA ONLY — the admin log is append-only, so a credential written
-                // here could never be removed.
-                await this.recordAdmin(actor, 'createConnection', { tenantId: input.tenantId, vertical: input.vertical }, null, {
+                }, this.adminEntry(actor, 'createConnection', { tenantId: input.tenantId, vertical: input.vertical }, null, {
                     id: input.id,
                     provider: input.provider,
                     label: input.label,
                     scopes: input.scopes,
                     externalAccountRef: input.externalAccountRef ?? null,
                     createdBy: input.createdBy ?? actor,
-                });
+                }));
+                // METADATA ONLY — the admin log is append-only, so a credential written
+                // here could never be removed.
             },
             connectionSealingKey: async (id) => this.ensureSealingKey(id),
             connectionSealingKeys: async (tenantId, vertical) => {
@@ -6288,26 +6297,22 @@ export class CloudflareScopeHost {
                     throw new Error(`connection not found: ${id}`);
                 const sealed = await this.secretBox.seal(JSON.stringify(connectionSecret.parse(secret)));
                 const now = new Date().toISOString();
-                await this.cp.updateConnectionSecret(id, sealed.keyId, sealed.ciphertext, expiresAt === undefined ? row.expires_at : expiresAt, now);
-                await this.recordAdmin(actor, 'updateConnectionSecret', { tenantId: row.tenant_id, vertical: row.vertical }, null, {
+                await this.directory('updateConnectionSecretAndAudit', id, sealed.keyId, sealed.ciphertext, expiresAt === undefined ? row.expires_at : expiresAt, now, this.adminEntry(actor, 'updateConnectionSecret', { tenantId: row.tenant_id, vertical: row.vertical }, null, {
                     id,
                     provider: row.provider,
                     rotatedAt: now,
                     expiresAt: expiresAt === undefined ? row.expires_at : expiresAt,
-                    // §3.5.1's attribution, rotate-side: the authorizing tenant principal,
-                    // never laundered into the actor column.
                     ...(opts?.rotatedBy ? { rotatedBy: opts.rotatedBy } : {}),
-                });
+                }));
             },
             revokeConnection: async (actor, id) => {
                 const row = await this.cp.readConnection(id);
                 if (!row)
                     throw new Error(`connection not found: ${id}`);
                 const now = new Date().toISOString();
-                const changed = await this.cp.revokeConnection(id, now);
+                const changed = await this.directory('revokeConnectionAndAudit', id, now, this.adminEntry(actor, 'revokeConnection', { tenantId: row.tenant_id, vertical: row.vertical }, { status: row.status }, { id, provider: row.provider, status: 'revoked', revokedAt: now }));
                 if (!changed)
                     return; // idempotent, and a no-op is not audited
-                await this.recordAdmin(actor, 'revokeConnection', { tenantId: row.tenant_id, vertical: row.vertical }, { status: row.status }, { id, provider: row.provider, status: 'revoked', revokedAt: now });
             },
             // -- a vertical's mailed connect links (connections.md §3.5.4) --------------
             // Parsed here, run in the ControlPlaneDO as the kernel's statements (shared with
@@ -6405,11 +6410,10 @@ export class CloudflareScopeHost {
                 if (pool.topology === 'tenant-bound' && pool.tenant_id !== parsed.tenantId) {
                     throw substratError('conflict', `identity pool '${parsed.provider}' is bound to tenant ${pool.tenant_id} and cannot link into ${parsed.tenantId}`);
                 }
-                const changed = await this.directory('linkIdentity', parsed.provider, parsed.externalId, parsed.principal, parsed.tenantId, parsed.scopeId ?? null, new Date().toISOString());
+                const changed = await this.directory('linkIdentityAndAudit', parsed.provider, parsed.externalId, parsed.principal, parsed.tenantId, parsed.scopeId ?? null, new Date().toISOString(), this.adminEntry(actor, 'linkIdentity', { tenantId: parsed.tenantId, scopeId: parsed.scopeId }, null, { provider: parsed.provider, externalId: parsed.externalId, principal: parsed.principal }));
                 // Idempotent: an identity already bound is a no-op, not audited.
                 if (!changed)
                     return;
-                await this.recordAdmin(actor, 'linkIdentity', { tenantId: parsed.tenantId, scopeId: parsed.scopeId }, null, { provider: parsed.provider, externalId: parsed.externalId, principal: parsed.principal });
                 // #406: an identity link is a tenant-level write, so it fans out into the tenant's
                 // projected scopes exactly as entitlements do (#304) — a no-op unless scope-local
                 // projection is on; the reconcile sweep repairs any drop.
@@ -6418,10 +6422,9 @@ export class CloudflareScopeHost {
             unlinkIdentity: async (actor, tenantId, principal) => {
                 // DELETE by principal (audit is the log), so the caller who removed a member
                 // can sever their login without knowing the external subject. Idempotent.
-                const changed = await this.cp.unlinkIdentity(tenantId, principal);
+                const changed = await this.directory('unlinkIdentityAndAudit', tenantId, principal, this.adminEntry(actor, 'unlinkIdentity', { tenantId, scopeId: null }, { principal }, null));
                 if (!changed)
                     return;
-                await this.recordAdmin(actor, 'unlinkIdentity', { tenantId, scopeId: null }, { principal }, null);
                 // The unlink must reach the projected scopes so the severed login stops resolving
                 // there — this is what makes revocation durable at request time (#406); a dropped
                 // fan-out is repaired by the reconcile sweep.
@@ -6513,24 +6516,11 @@ export class CloudflareScopeHost {
                 }));
             },
             markAccessLogDrained: async (actor, upToId, drainedAt) => {
-                const drained = await this.cp.markAccessLogDrained(upToId, drainedAt);
-                if (drained > 0) {
-                    // The payload is the APPLIED state, so it belongs in `after` (contracts'
-                    // adminLogEntry: before = prior state, after = the applied payload).
-                    await this.recordAdmin(actor, 'drainAccessLog', { tenantId: null }, null, { drained, upToId, drainedAt });
-                }
-                return drained;
+                return this.directory('markAccessLogDrainedAndAudit', upToId, drainedAt, this.adminEntry(actor, 'drainAccessLog', { tenantId: null }, null, null));
             },
             pruneAccessLog: async (actor, limit) => {
                 // Checked here as well as in the directory, so the refusal keeps its code across the hop.
-                const pruned = await this.cp.pruneAccessLog(assertRowLimit('limit', limit));
-                if (pruned > 0) {
-                    // The payload is the APPLIED state, so it belongs in `after` (contracts'
-                    // adminLogEntry: before = prior state, after = the applied payload) — the
-                    // same shape as drainAccessLog's row above (#557).
-                    await this.recordAdmin(actor, 'pruneAccessLog', { tenantId: null }, null, { pruned });
-                }
-                return pruned;
+                return this.directory('pruneAccessLogAndAudit', assertRowLimit('limit', limit), this.adminEntry(actor, 'pruneAccessLog', { tenantId: null }, null, null));
             },
             auditLog: async (actor, filter) => {
                 const rows = await this.cp.auditLog({
@@ -6656,13 +6646,11 @@ export class CloudflareScopeHost {
                 return rows.map((r) => issueEntry.parse(r));
             },
             setIssueStatus: async (actor, fingerprint, status) => {
-                const change = await this.cp.setIssueStatus(fingerprint, status, new Date().toISOString());
+                const change = await this.directory('setIssueStatusAndAudit', fingerprint, status, new Date().toISOString(), this.adminEntry(actor, 'setIssueStatus', { tenantId: null }, null, null));
                 if (!change)
                     return undefined;
-                const before = issueEntry.parse(change.before);
                 const after = issueEntry.parse(change.after);
-                // A lifecycle flip is a staff mutation — audited with the diff (K-33).
-                await this.recordAdmin(actor, 'setIssueStatus', { tenantId: null, vertical: after.lastVertical }, { fingerprint, status: before.status }, { fingerprint, status: after.status });
+                // A lifecycle flip is recorded in the same directory unit as the state write.
                 return after;
             },
             listFindings: async (actor, filter) => {
@@ -7230,12 +7218,12 @@ export class CloudflareScopeHost {
     async switchHeld(scopeId, holdKey) {
         const at = Date.now();
         let error;
-        if (!this.holdSnapshot || at - this.holdSnapshot.at > SWITCH_HOLD_SNAPSHOT_MS) {
+        if (!this.holdSnapshot || at - this.holdSnapshot.at > this.holdSnapshotMs) {
             const inflight = this.holdRefresh;
             // Join a read that went out within the snapshot age of this consult: its result is then as
             // fresh as one this consult would take itself, which is what the settle argument needs.
             // Only the consult that sent the read reports its failure.
-            if (inflight && at - inflight.at <= SWITCH_HOLD_SNAPSHOT_MS) {
+            if (inflight && at - inflight.at <= this.holdSnapshotMs) {
                 await inflight.done;
             }
             else {
@@ -7477,7 +7465,7 @@ export class CloudflareScopeHost {
      * claimed by the re-read.
      */
     async settleClaim(holds, scopeId, claimId) {
-        await new Promise((resolve) => setTimeout(resolve, SWITCH_HOLD_SETTLE_MS));
+        await new Promise((resolve) => setTimeout(resolve, this.holdSettleMs));
         for (let waits = 0;; waits++) {
             const token = await holds.switchHoldToken();
             const off = await this.offInStorage(scopeId);
@@ -7486,14 +7474,14 @@ export class CloudflareScopeHost {
                 this.holdSnapshot = null;
             }
             const youngest = await holds.switchHoldYoungestMs(scopeId, claimId);
-            if (youngest === null || youngest >= SWITCH_HOLD_SETTLE_MS)
+            if (youngest === null || youngest >= this.holdSettleMs)
                 return;
             if (waits === SWITCH_HOLD_EXTRA_WAITS) {
                 throw new Error(`${REWIND_REFUSED}schedule switches kept being pulled off while this rewind waited for them to ` +
                     `settle (${waits} extra waits); nothing was rewound, and those switches stay off. Retry the rewind`);
             }
             // Never longer than one settle, even if the hold object's clock moved back under a restart.
-            await new Promise((resolve) => setTimeout(resolve, SWITCH_HOLD_SETTLE_MS - Math.max(0, youngest)));
+            await new Promise((resolve) => setTimeout(resolve, this.holdSettleMs - Math.max(0, youngest)));
         }
     }
     // -- live reads (#938): the door ------------------------------------------
@@ -8673,6 +8661,18 @@ export class CloudflareScopeHost {
         }
         return connectionLandingsOfManifestJson(v.manifest_json);
     }
+    /**
+     * What one pushed version declares about vertical-defined connectors (vertical-connectors.md
+     * §6.4), from its stored manifest: the connector proxy reads it for the running version on every
+     * call. Unaudited for the reason {@link versionImports} is.
+     */
+    async versionConnectors(verticalSlug, versionId) {
+        const v = await this.cp.readVersion(versionId);
+        if (!v || v.vertical_slug !== verticalSlug) {
+            throw substratError('not_found', `unknown version ${versionId} for vertical '${verticalSlug}'`);
+        }
+        return connectorsOfManifestJson(v.manifest_json);
+    }
 }
 /** A ledger row -> the wire entry, the attribution re-nested (#1054). */
 function modelUsageEntryOf(r) {