@substrat-run/adapter-cloudflare 0.164.0 → 0.166.0

package/dist/host.js

@@ -3,7 +3,7 @@ import { isRewindRefusal, REWIND_REFUSED } from './rewind-refusal.js';
 import { isSystemDoorMoved, SYSTEM_DOOR_MOVED, SYSTEM_DOOR_REGATES } from './system-door.js';
 import { delegatedReadParams, operationSeriesCount, fromWireFailure, isSubstratError, exportReadInput, exportedBatch, importBatch, importResult, importState, importsOfManifestJson, connectionLandingsOfManifestJson, connectorsOfManifestJson, exportsOfManifestJson, assertNoBindingShapeBreak, importCursorMove, importCursorMoveAt, importCursorMoved, accessLogEntry, adminLogEntry, opsFailureEntry, opsFailureFingerprint, issueEntry, findingEntry, findingRuleEntry, sweepRunEntry, FRESHNESS_HEARTBEAT_MINUTES, sweepRunsPayload, modelUsageEntry, createTenantInput, identityLink, identityPool, createOrgInput, promotionAcknowledgement, bindAcknowledgement, bindHostnameInput, channelHistoryEntry, hostnameBinding, publishVersionInput, AUTO_ADMISSION_NOTE, registerVerticalInput, vertical as verticalSchema, verticalServingState, deploymentWireAuth, verticalChannel, verticalVersion, connection, capabilityExchange, mintedCapability, boundedBecomeMint, boundedBecomeRevoke, boundedUnbind, entityRef, becomeLinkState, principalBecomeCapabilityInput, capabilityGrant, principalId, connectionGrant, connectionGrantRecord, connectionSecret, systemGrant, systemSwitch, systemSwitchOutcome, systemScheduleEntry, systemSwitchRecord, entitlementGrant, entitlementGrantInput, capabilityFilter, instant, meterReading, scopeStorageSample, requestDay, requestRollupDay, meterDay, meterDayTake, verticalOwnerPeriod, subjectRef, createConnectionInput, connectLinkFilter, connectLinkKey, consumeConnectLinkInput, mintConnectLinkInput, projectedConnectionGrant, projectedConnectionKey, moduleManifest, org as orgSchema, orgMembership, resolvedIdentity, identityMembership, roleDefinition, scope as scopeSchema, tenant as tenantSchema, tenantRole, delegatedReadRecord, ownerTransferAudit, memberChangeAudit, peerBindingAudit, connectionBindingAudit, copyMarkAudit, orphanSweepAudit, subjectShredReceipt, connectorDispatchKind, callsOfManifestJson, outboundOfManifestJson, SCOPE_GATE_REASONS, substratError, errorCodeOf, redrainEventsInput, coverage, peerCoverage, peerGrantsEntry, peerSwitch, peerSwitchOutcome, verticalCaller, verticalResolution, peerInstanceResolution, peerBinding as peerBindingSchema, verticalSlug, entityObjectRef, ATTACHMENT_BLOB_BINDING, blobStoreBindingName, lifecycleDelivery, scopeLifecycle, } from '@substrat-run/contracts';
 import { normalizeHostname, toRouteTarget } from './route-resolver.js';
-import { attachmentBlobKey, normalizeUploadMediaType, redeemOrReplayUploadLink, attachmentSha256, bytesStream, isSizedByteStream, openAttachmentByteStream, putAttachmentBytes, entitlementDenial, requiredEntitlementFor, foldMeterReading, parseValidationRecords, readableScopes, resolveScopeRecord, ulid, withheldOpsFailure, KEPT_COPY_REFUSAL, capabilityTokenHash, checkBecomeInput, assertBecomeLinkStateIds, plausibleSessionToken, foldModelUsage, backoffAt, resolveRetryPolicy, executorOutcomeOf, isDeliveryRefusal, refusalJournalText, isSecretBoxConfigured, unconfiguredSecretBox, createSubjectKeys, generateSealingKeyPair, openSealed, ImpersonationRefused, assertSessionUsable, impersonationRowValues, mapImpersonationRow, newImpersonationSession, jobRunOf, assertLeaseMs, runDueJobRuns, SYSTEM_DOOR_WAIT, startJobRun, attachmentTextJob, assertAttachmentExtractors, resolveAttachmentTextBounds, assertJobRegistrable, ATTACHMENT_TEXT_BACKFILL_JOB, ATTACHMENT_TEXT_JOB, kernelJobFor, attachmentTextBackfillJob, searchLimit, searchMatchExpression, globalFetch, fetchLikeOf, deadlineFetch, assertRedrainWindow, platformRequestOf, undrainedEventsOf, inUnitMovesToAudit, staleCarryRevertRow, staleCarryReverts, recordedOffFromWire, peerSubjectRef, SWITCH_KINDS, reassertActionOf, reassertEntry, reassertOffRow, reassertOnRow, switchActionOf, switchAuditSubject, recordAuditOutcome, auditedCapabilityRevoke, auditWarningOf, switchNotFoundMessage, recordWriteSuperseded, switchSubjectOf, switchSupersededMessage, withRecorded, systemSwitchedOffMessage, tenantSystemSwitchedOffMessage, CrossVerticalRegistry, importCursorSourceOf, exportBreaksOf, exportBreakRefusal, assertPromoteReviewCurrent, promoteRaceRefusal, servingRaceRefusal, migratesFrom, servedFromRow, rebindRaceRefusal, bindExportBreaksOf, bindExportBreakRefusal, scopeMoveOf, runningVersionOf, strandJudgmentsOf, boundShapesOfColumn, installReconciled, collectPeers, peerCallerAt, peerSeats, connectorCallRecord, noopConnectorCallRecorder, recordConnectorCall, settleConnectionUse, splitManifestMigrations, publishedMigrationDigest, migrationChangeRefusal, unknownRoleError, assertRowLimit, assertRowOffset, emptyImportResult, INERT_SCOPE_REASON, lifecycleReceipt, lifecycleRefusal, scopeNotHeldRefusal, isPrimaryScope, isPrimaryScopeRow, asyncInvocationId, asyncLinePass, assertNoCallerPurge, purgeReportOf, purgeStillDue, assertBoundOperations, registerTrashTargets, assertModuleDeclared, noteDeclaredKeys, noteReservedKeys, reservedGrantRefusal, reservedRoleRefusal, reservedRoleSetRefusal, reservedShapeRefusal, SEAT_HOLDING_SCOPE_STATUSES, dumpRoleRefusal, dumpRoleState, memberAddedAudit, shapeTopUpBatch, verticalOwnerNow, } from '@substrat-run/kernel';
+import { attachmentBlobKey, normalizeUploadMediaType, redeemOrReplayUploadLink, attachmentSha256, bytesStream, isSizedByteStream, openAttachmentByteStream, putAttachmentBytes, entitlementDenial, requiredEntitlementFor, foldMeterReading, parseValidationRecords, readableScopes, resolveScopeRecord, ulid, withheldOpsFailure, KEPT_COPY_REFUSAL, capabilityTokenHash, checkBecomeInput, assertBecomeLinkStateIds, plausibleSessionToken, foldModelUsage, backoffAt, resolveRetryPolicy, executorOutcomeOf, isDeliveryRefusal, refusalJournalText, isSecretBoxConfigured, unconfiguredSecretBox, createSubjectKeys, generateSealingKeyPair, openSealed, ImpersonationRefused, assertSessionUsable, impersonationRowValues, mapImpersonationRow, newImpersonationSession, jobRunOf, assertLeaseMs, runDueJobRuns, SYSTEM_DOOR_WAIT, startJobRun, attachmentTextJob, assertAttachmentExtractors, resolveAttachmentTextBounds, assertJobRegistrable, ATTACHMENT_TEXT_BACKFILL_JOB, ATTACHMENT_TEXT_JOB, kernelJobFor, attachmentTextBackfillJob, searchLimit, searchMatchExpression, globalFetch, fetchLikeOf, deadlineFetch, assertRedrainWindow, platformRequestOf, undrainedEventsOf, inUnitMovesToAudit, staleCarryRevertRow, staleCarryReverts, recordedOffFromWire, peerSubjectRef, SWITCH_KINDS, reassertActionOf, reassertEntry, reassertOffRow, reassertOnRow, switchActionOf, switchAuditSubject, recordAuditOutcome, auditedCapabilityRevoke, auditedScopePermissionWrite, auditWarningOf, switchNotFoundMessage, recordWriteSuperseded, switchSubjectOf, switchSupersededMessage, withRecorded, systemSwitchedOffMessage, tenantSystemSwitchedOffMessage, CrossVerticalRegistry, importCursorSourceOf, exportBreaksOf, exportBreakRefusal, assertPromoteReviewCurrent, promoteRaceRefusal, servingRaceRefusal, migratesFrom, servedFromRow, rebindRaceRefusal, bindExportBreaksOf, bindExportBreakRefusal, scopeMoveOf, runningVersionOf, strandJudgmentsOf, boundShapesOfColumn, installReconciled, collectPeers, peerCallerAt, peerSeats, connectorCallRecord, noopConnectorCallRecorder, recordConnectorCall, settleConnectionUse, splitManifestMigrations, publishedMigrationDigest, migrationChangeRefusal, unknownRoleError, assertRowLimit, assertRowOffset, emptyImportResult, INERT_SCOPE_REASON, lifecycleReceipt, lifecycleRefusal, scopeNotHeldRefusal, isPrimaryScope, isPrimaryScopeRow, asyncInvocationId, asyncLinePass, assertNoCallerPurge, purgeReportOf, purgeStillDue, assertBoundOperations, registerTrashTargets, assertModuleDeclared, noteDeclaredKeys, noteReservedKeys, reservedGrantRefusal, reservedRoleRefusal, reservedRoleSetRefusal, reservedShapeRefusal, SEAT_HOLDING_SCOPE_STATUSES, dumpRoleRefusal, dumpRoleState, memberAddedAudit, shapeTopUpBatch, verticalOwnerNow, } from '@substrat-run/kernel';
 import { fenceAttachmentSweep, missingAttachmentStore, sweepOrphanAttachments, unsettledCopyRefusal } from '@substrat-run/kernel';
 import { assertWireAuthFilter, wireAuthAccessTarget, COPY_RESTORE_FENCE_LAPSED, scopeScriptCopyOf } from '@substrat-run/kernel';
 import { attributedView, isModuleErasureCounts, moduleErasurePlan, moduleRowsErased, callReservedStoreOperation, callScopeStore, observeStoreCall, replayStoreErasures, scopeStoreLifecycleOf, scopeStoreRunnersOf } from '@substrat-run/kernel';
@@ -1864,14 +1864,14 @@ export class CloudflareScopeHost {
         // the source of truth, carrying the D1 database_id Cloudflare assigned as the ref.
         const name = await tenantStoreDatabaseName(input.tenantId, input.vertical, input.binding);
         const ref = await d1.create(name);
-        const stored = await this.directory('putTenantStore', {
+        const stored = await this.directory('putTenantStoreAndAudit', {
             tenantId: input.tenantId,
             vertical: input.vertical,
             binding: input.binding,
             kind: 'relational',
             ref,
             createdAt: new Date().toISOString(),
-        });
+        }, this.adminEntry(actor, 'provisionTenantStore', { tenantId: input.tenantId, vertical: input.vertical }, null, { binding: input.binding, kind: 'relational', ref }));
         if (stored.ref !== ref) {
             // A concurrent provision won the ledger write. One database is canonical — the
             // ledger's — so drop ours rather than orphan it (best-effort: a leaked delete
@@ -1879,7 +1879,6 @@ export class CloudflareScopeHost {
             await d1.remove(ref).catch(() => undefined);
             return { binding: input.binding, kind: 'relational', ref: stored.ref };
         }
-        await this.recordAdmin(actor, 'provisionTenantStore', { tenantId: input.tenantId, vertical: input.vertical }, null, { binding: input.binding, kind: 'relational', ref });
         return { binding: input.binding, kind: 'relational', ref };
     }
     openTenantStore(handle) {
@@ -1925,19 +1924,18 @@ export class CloudflareScopeHost {
             return { binding: input.binding, kind: 'blob', ref: existing.ref };
         const name = await blobStoreBucketName(input.tenantId, input.vertical, input.binding);
         const ref = await r2.create(name);
-        const stored = await this.directory('putBlobStore', {
+        const stored = await this.directory('putBlobStoreAndAudit', {
             tenantId: input.tenantId,
             vertical: input.vertical,
             binding: input.binding,
             kind: 'blob',
             ref,
             createdAt: new Date().toISOString(),
-        });
+        }, this.adminEntry(actor, 'provisionBlobStore', { tenantId: input.tenantId, vertical: input.vertical }, null, { binding: input.binding, kind: 'blob', ref }));
         if (stored.ref !== ref) {
             await r2.remove(ref).catch(() => undefined);
             return { binding: input.binding, kind: 'blob', ref: stored.ref };
         }
-        await this.recordAdmin(actor, 'provisionBlobStore', { tenantId: input.tenantId, vertical: input.vertical }, null, { binding: input.binding, kind: 'blob', ref });
         return { binding: input.binding, kind: 'blob', ref };
     }
     /**
@@ -3246,11 +3244,14 @@ export class CloudflareScopeHost {
      * configured; the mint has no such reach and no caller needing one, since an owner claim link
      * is minted by the deployment itself behind `/internal/owner-claim`.
      */
-    async capabilityScopeStub(rec, scopeId, verb) {
+    assertCapabilityScopeReach(rec, scopeId, verb) {
         if (this.servesScopesElsewhereNow && rec.vertical !== null) {
             throw substratError('unavailable', `${verb} cannot reach scope ${scopeId}: it is served by the '${rec.vertical}' ` +
                 'deployment, and this host has no reach into it');
         }
+    }
+    async capabilityScopeStub(rec, scopeId, verb) {
+        this.assertCapabilityScopeReach(rec, scopeId, verb);
         await this.migrateAndRecord(scopeId);
         return this.scopeStub(scopeId);
     }
@@ -3878,13 +3879,18 @@ export class CloudflareScopeHost {
             // #1713: after the directory moved and the move was audited, never before or instead.
             await this.deliverLifecycles(actor, { scopeId });
         };
-        const writeGrant = async (subject, permission, node, entity, expiresAt) => {
+        const writeGrant = async (subject, permission, node, entity, expiresAt, audited = false) => {
+            const writeTuple = async (scopeId, object) => {
+                if (audited)
+                    unwrapReply(await this.scopeStub(scopeId).writeTupleAndAuditIntent(subject, `granted:${permission}`, object, expiresAt ?? null));
+                else
+                    await this.writeScopeTuple(scopeId, subject, `granted:${permission}`, object, expiresAt ?? null);
+            };
             if (entity) {
-                await this.writeScopeTuple(node.scopeId, subject, `granted:${permission}`, entityObjectRef(entity, 'HostAdmin'), // #1856: grant and grantToOrg both land here
-                expiresAt ?? null);
+                await writeTuple(node.scopeId, entityObjectRef(entity, 'HostAdmin')); // #1856
             }
             else if (node.scopeId) {
-                await this.writeScopeTuple(node.scopeId, subject, `granted:${permission}`, `scope:${node.scopeId}`, expiresAt ?? null);
+                await writeTuple(node.scopeId, `scope:${node.scopeId}`);
             }
             else {
                 // #2526: a tenant-level grant is a directory tuple, written by the ControlPlaneDO in the
@@ -4461,15 +4467,33 @@ export class CloudflareScopeHost {
                     await this.fanOut(tenantId);
                     return;
                 }
-                const refusal = await this.scopeStub(scopeId).reservedRoleRefusalFor(tenantId, assignment.roleKey, 'platform');
+                if (await this.scopePermissionUsesLegacyPlaceholder(tenantId, scopeId)) {
+                    const refusal = await this.scopeStub(scopeId).reservedRoleRefusalFor(tenantId, assignment.roleKey, 'platform');
+                    if (refusal)
+                        throw substratError('forbidden', refusal);
+                    await this.writeScopeTuple(scopeId, `principal:${assignment.principalId}`, `role:${assignment.roleKey}`, `scope:${scopeId}`, null);
+                    await this.recordAdmin(actor, 'assignRole', { tenantId, scopeId }, null, assignment);
+                    return;
+                }
+                const refusal = await auditedScopePermissionWrite({
+                    action: 'assignRole', request: { ...assignment },
+                    record: (after) => this.recordAdmin(actor, 'assignRole', { tenantId, scopeId }, null, after),
+                    write: async () => {
+                        const refusal = await this.scopeStub(scopeId).reservedRoleRefusalFor(tenantId, assignment.roleKey, 'platform');
+                        if (refusal)
+                            return refusal;
+                        unwrapReply(await this.scopeStub(scopeId).writeTupleAndAuditIntent(`principal:${assignment.principalId}`, `role:${assignment.roleKey}`, `scope:${scopeId}`, null));
+                        return null;
+                    },
+                    outcome: (refusal) => ({ phase: refusal ? 'refused' : 'applied', details: { changed: !refusal } }),
+                    logError: (message, fields) => console.error(message, fields),
+                });
                 if (refusal)
                     throw substratError('forbidden', refusal);
-                await this.writeScopeTuple(scopeId, `principal:${assignment.principalId}`, `role:${assignment.roleKey}`, `scope:${scopeId}`, null);
-                await this.recordAdmin(actor, 'assignRole', { tenantId, scopeId }, null, assignment);
             },
             unassignRole: async (actor, assignment) => {
                 // Tombstone (K-21) — the checker skips revoked rows. A no-op returns false so
-                // a repeat unassign stays silent (no second audit row, no needless fan-out).
+                // a repeat unassign is a refused no-op at a scope node, with no needless fan-out.
                 const relation = `role:${assignment.roleKey}`;
                 const { tenantId, scopeId } = assignment.node;
                 if (!scopeId) {
@@ -4481,17 +4505,27 @@ export class CloudflareScopeHost {
                         await this.fanOut(tenantId);
                     return;
                 }
-                const changed = await this.scopeStub(scopeId).revokeTuple(`principal:${assignment.principalId}`, relation, `scope:${scopeId}`, new Date().toISOString());
-                if (!changed)
+                if (await this.scopePermissionUsesLegacyPlaceholder(tenantId, scopeId)) {
+                    const changed = await this.scopeStub(scopeId).revokeTuple(`principal:${assignment.principalId}`, relation, `scope:${scopeId}`, new Date().toISOString());
+                    if (changed)
+                        await this.recordAdmin(actor, 'unassignRole', { tenantId, scopeId }, assignment, null);
                     return;
-                await this.recordAdmin(actor, 'unassignRole', { tenantId, scopeId }, assignment, null);
+                }
+                await auditedScopePermissionWrite({
+                    action: 'unassignRole', request: { ...assignment },
+                    record: (after) => this.recordAdmin(actor, 'unassignRole', { tenantId, scopeId }, assignment, after),
+                    write: () => this.scopeStub(scopeId).revokeTupleAndAuditIntent(`principal:${assignment.principalId}`, relation, `scope:${scopeId}`, new Date().toISOString()),
+                    outcome: (changed) => ({ phase: changed ? 'applied' : 'refused', details: { changed } }),
+                    logError: (message, fields) => console.error(message, fields),
+                });
             },
             grant: async (actor, raw) => {
                 // Parsed like its `grantToConnection`/`grantToSystem` siblings, not taken on
                 // trust: the parse is where an `expiresAt` carrying a UTC offset is normalised
                 // to Z text (#963), and liveness here is a lexicographic `expires_at > ?`.
                 const grant = capabilityGrant.parse(raw);
-                await this.refuseReservedGrant([grant.permission], grant.node.scopeId); // #2430
+                const legacy = !!grant.node.scopeId && await this.scopePermissionUsesLegacyPlaceholder(grant.node.tenantId, grant.node.scopeId);
+                await this.refuseReservedGrant([grant.permission], legacy ? grant.node.scopeId : null); // #2430
                 const subject = `principal:${grant.principalId}`;
                 const target = { tenantId: grant.node.tenantId, scopeId: grant.node.scopeId };
                 if (!grant.node.scopeId && !grant.entity) {
@@ -4502,12 +4536,49 @@ export class CloudflareScopeHost {
                     return;
                 }
                 // Scope-level and entity grants write scope tuples (already local): no fan-out.
-                await writeGrant(subject, grant.permission, grant.node, grant.entity, grant.expiresAt);
-                await this.recordAdmin(actor, 'grant', target, null, grant);
+                if (legacy) {
+                    await writeGrant(subject, grant.permission, grant.node, grant.entity, grant.expiresAt);
+                    await this.recordAdmin(actor, 'grant', target, null, grant);
+                    return;
+                }
+                const refusal = await auditedScopePermissionWrite({
+                    action: 'grant', request: { ...grant },
+                    record: (after) => this.recordAdmin(actor, 'grant', target, null, after),
+                    write: async () => {
+                        const refusal = await this.scopeStub(grant.node.scopeId).reservedGrantRefusalFor([grant.permission]);
+                        if (refusal)
+                            return refusal;
+                        await writeGrant(subject, grant.permission, grant.node, grant.entity, grant.expiresAt, true);
+                        return null;
+                    },
+                    outcome: (refusal) => ({ phase: refusal ? 'refused' : 'applied', details: { changed: !refusal } }),
+                    logError: (message, fields) => console.error(message, fields),
+                });
+                if (refusal)
+                    throw substratError('forbidden', refusal);
             },
             grantEntityShape: async (actor, grant) => {
-                await this.grantEntityShapeLocal(grant.node.scopeId, grant.principalId, grant.entity, grant.permissions);
-                await this.recordAdmin(actor, 'grantEntityShape', grant.node, null, grant);
+                if (await this.scopePermissionUsesLegacyPlaceholder(grant.node.tenantId, grant.node.scopeId)) {
+                    await this.grantEntityShapeLocal(grant.node.scopeId, grant.principalId, grant.entity, grant.permissions);
+                    await this.recordAdmin(actor, 'grantEntityShape', grant.node, null, grant);
+                    return;
+                }
+                await this.refuseReservedGrant(grant.permissions, null);
+                const refusal = await auditedScopePermissionWrite({
+                    action: 'grantEntityShape', request: { ...grant },
+                    record: (after) => this.recordAdmin(actor, 'grantEntityShape', grant.node, null, after),
+                    write: async () => {
+                        const refusal = await this.scopeStub(grant.node.scopeId).reservedGrantRefusalFor([...grant.permissions]);
+                        if (refusal)
+                            return refusal;
+                        await this.scopeStub(grant.node.scopeId).grantEntityShapeAndAuditIntent(grant.principalId, grant.entity, grant.permissions);
+                        return null;
+                    },
+                    outcome: (refusal) => ({ phase: refusal ? 'refused' : 'applied', details: { changed: !refusal } }),
+                    logError: (message, fields) => console.error(message, fields),
+                });
+                if (refusal)
+                    throw substratError('forbidden', refusal);
             },
             reconcileEntityGrantShapes: async (actor, node, shapes, opts) => {
                 // #2184: the bound types are the reconcile route's answer to the platform, not part of this
@@ -4599,13 +4670,25 @@ export class CloudflareScopeHost {
                 const target = { tenantId: grant.node.tenantId, scopeId: grant.node.scopeId };
                 const after = { moduleId: grant.moduleId, permission: grant.permission, node: grant.node };
                 if (grant.node.scopeId) {
+                    if (await this.scopePermissionUsesLegacyPlaceholder(grant.node.tenantId, grant.node.scopeId)) {
+                        const written = await this.scopeStub(grant.node.scopeId).writeSystemGrant(grant.moduleId, `granted:${grant.permission}`, `scope:${grant.node.scopeId}`, grant.expiresAt ?? null);
+                        if (!written)
+                            throw substratError('conflict', systemSwitchedOffMessage(grant.moduleId, grant.node.scopeId));
+                        await this.recordAdmin(actor, 'grantToSystem', target, null, after);
+                        return;
+                    }
                     // #1666: refused while the module is switched off on this scope — checked and
                     // written in one DO unit. Restore is the lever; a grant is not.
-                    const written = await this.scopeStub(grant.node.scopeId).writeSystemGrant(grant.moduleId, `granted:${grant.permission}`, `scope:${grant.node.scopeId}`, grant.expiresAt ?? null);
+                    const written = await auditedScopePermissionWrite({
+                        action: 'grantToSystem', request: { ...after, expiresAt: grant.expiresAt ?? null, grantedBy: grant.grantedBy },
+                        record: (row) => this.recordAdmin(actor, 'grantToSystem', target, null, row),
+                        write: () => this.scopeStub(grant.node.scopeId).writeSystemGrantAndAuditIntent(grant.moduleId, `granted:${grant.permission}`, `scope:${grant.node.scopeId}`, grant.expiresAt ?? null),
+                        outcome: (written) => ({ phase: written ? 'applied' : 'refused', details: { changed: written } }),
+                        logError: (message, fields) => console.error(message, fields),
+                    });
                     if (!written) {
                         throw substratError('conflict', systemSwitchedOffMessage(grant.moduleId, grant.node.scopeId));
                     }
-                    await this.recordAdmin(actor, 'grantToSystem', target, null, after);
                     return;
                 }
                 // #1743: refused while the record holds the module off on any scope — checked and
@@ -4649,10 +4732,8 @@ export class CloudflareScopeHost {
                 return { switchedOffPeers, tenantHeldPeers, fences };
             },
             reassertSystemSwitches: reassertSystemSwitchesOf,
-            // #1672 — the platform's two capability verbs. Audited AFTER the write, on both, and
-            // the failure each leaves is the safe one: a mint whose audit row did not land never
-            // returned its secret, so nobody can ever exchange it; a revoke whose row did not land
-            // has still revoked. Neither the secret nor its hash is ever in before/after.
+            // #1672 — the platform's two capability verbs. An intent precedes the scope write and
+            // the outcome follows it. Neither the secret nor its hash is ever in before/after.
             mintCapability: async (actor, tenantId, scopeId, input) => {
                 // Checked HERE as well as in the DO: a typed refusal thrown across the RPC arrives as
                 // a bare message, and the caller would lose `validation_failed`. One function, so the
@@ -4660,17 +4741,22 @@ export class CloudflareScopeHost {
                 checkBecomeInput(input, new Date().toISOString());
                 await this.validateScopeAccess(tenantId, scopeId);
                 const rec = await this.capabilityScopeRecord(tenantId, scopeId);
-                const stub = await this.capabilityScopeStub(rec, scopeId, 'mintCapability');
-                const minted = await stub.mintBecomeCapability(input, actor);
-                await this.recordAdmin(actor, 'mintCapability', { tenantId, scopeId, vertical: rec.vertical }, null, {
-                    capabilityId: minted.id,
-                    mode: 'become',
-                    principal: input.principal,
-                    expiresAt: input.expiresAt,
-                    maxUses: input.maxUses,
-                    label: input.label ?? null,
+                // A hosted refusal precedes intent; the local migrate happens inside the audited write.
+                this.assertCapabilityScopeReach(rec, scopeId, 'mintCapability');
+                return auditedScopePermissionWrite({
+                    action: 'mintCapability', request: {
+                        mode: 'become',
+                        principal: input.principal,
+                        expiresAt: input.expiresAt,
+                        maxUses: input.maxUses,
+                        label: input.label ?? null,
+                    },
+                    record: (after) => this.recordAdmin(actor, 'mintCapability', { tenantId, scopeId, vertical: rec.vertical }, null, after),
+                    write: async () => (await this.capabilityScopeStub(rec, scopeId, 'mintCapability')).mintBecomeCapabilityAndAuditIntent(input, actor),
+                    outcome: (minted) => ({ phase: 'applied', details: { capabilityId: minted.id } }),
+                    onUnrecordedOutcome: (minted, error) => ({ ...minted, auditWarning: auditWarningOf('the capability mint', error) }),
+                    logError: (message, fields) => console.error(message, fields),
                 });
-                return minted;
             },
             revokeCapability: async (actor, tenantId, scopeId, capabilityId) => {
                 // #1686: a hosted scope's directory is in the deployment serving it, reached through the
@@ -4702,7 +4788,8 @@ export class CloudflareScopeHost {
                 // The org must exist in the node's tenant. A grant to a phantom org looks
                 // applied, resolves for nobody, and still shows up in the permission diff.
                 await requireOrg(node.tenantId, orgId);
-                await this.refuseReservedGrant([permission], node.scopeId); // #2430: an org's members are people
+                const legacy = !!node.scopeId && await this.scopePermissionUsesLegacyPlaceholder(node.tenantId, node.scopeId);
+                await this.refuseReservedGrant([permission], legacy ? node.scopeId : null); // #2430: an org's members are people
                 const target = { tenantId: node.tenantId, scopeId: node.scopeId };
                 const after = { orgId, permission, node, entity };
                 if (!node.scopeId && !entity) {
@@ -4711,8 +4798,26 @@ export class CloudflareScopeHost {
                     await this.fanOut(node.tenantId);
                     return;
                 }
-                await writeGrant(`org:${orgId}`, permission, node, entity);
-                await this.recordAdmin(actor, 'grantToOrg', target, null, after);
+                if (legacy) {
+                    await writeGrant(`org:${orgId}`, permission, node, entity);
+                    await this.recordAdmin(actor, 'grantToOrg', target, null, after);
+                    return;
+                }
+                const refusal = await auditedScopePermissionWrite({
+                    action: 'grantToOrg', request: after,
+                    record: (row) => this.recordAdmin(actor, 'grantToOrg', target, null, row),
+                    write: async () => {
+                        const refusal = await this.scopeStub(node.scopeId).reservedGrantRefusalFor([permission]);
+                        if (refusal)
+                            return refusal;
+                        await writeGrant(`org:${orgId}`, permission, node, entity, undefined, true);
+                        return null;
+                    },
+                    outcome: (refusal) => ({ phase: refusal ? 'refused' : 'applied', details: { changed: !refusal } }),
+                    logError: (message, fields) => console.error(message, fields),
+                });
+                if (refusal)
+                    throw substratError('forbidden', refusal);
             },
             // -- vertical + version registry (#31) ---------------------------------
             // -- the hostname map (K-26) -------------------------------------------
@@ -5510,9 +5615,7 @@ export class CloudflareScopeHost {
             // -- store-driver releases, rollouts and holds (D-63, #2300) -------------------
             recordStoreDriverRelease: async (actor, input) => {
                 const at = new Date().toISOString();
-                const { record, created } = await this.directory('recordStoreDriverRelease', { ...input, actor, at });
-                if (created)
-                    await this.recordAdmin(actor, 'uploadStoreDriverRelease', { tenantId: null }, null, record);
+                const { record } = await this.directory('recordStoreDriverReleaseAndAudit', { ...input, actor, at }, this.adminEntry(actor, 'uploadStoreDriverRelease', { tenantId: null }, null, null));
                 return record;
             },
             getStoreDriverRelease: async (actor, driver, sha256) => {
@@ -5520,6 +5623,24 @@ export class CloudflareScopeHost {
                 await this.recordAccess(actor, 'getStoreDriverRelease', { tenantId: null }, { driver, sha256 }, record ? 1 : 0);
                 return record;
             },
+            storeDriverApprovals: async (actor, driver) => {
+                const records = await this.cp.storeDriverApprovals(driver);
+                await this.recordAccess(actor, 'storeDriverApprovals', { tenantId: null }, { driver }, records.length);
+                return records;
+            },
+            liveStoreDriverApproval: async (actor, driver, sha256) => {
+                const record = await this.cp.liveStoreDriverApproval(driver, sha256);
+                await this.recordAccess(actor, 'liveStoreDriverApproval', { tenantId: null }, { driver, sha256 }, record ? 1 : 0);
+                return record;
+            },
+            approveStoreDriverRelease: async (actor, input) => this.directory('approveStoreDriverReleaseAndAudit', { ...input, actor, at: new Date().toISOString() }, this.adminEntry(actor, 'approveStoreDriverRelease', { tenantId: null }, null, null)),
+            storeDriverRevokeWalk: async (actor, approvalId) => {
+                const record = await this.cp.storeDriverRevokeWalk(approvalId);
+                await this.recordAccess(actor, 'storeDriverRevokeWalk', { tenantId: null }, { approvalId }, record ? 1 : 0);
+                return record;
+            },
+            recordStoreDriverRevokeWalk: async (actor, input) => this.directory('recordStoreDriverRevokeWalk', { ...input, actor }),
+            revokeStoreDriverRelease: async (actor, input) => this.directory('revokeStoreDriverReleaseAndAudit', { ...input, actor, at: new Date().toISOString() }, this.adminEntry(actor, 'revokeStoreDriverRelease', { tenantId: null }, null, null)),
             storeDriverState: async (actor, driver) => {
                 const state = await this.cp.storeDriverState(driver);
                 await this.recordAccess(actor, 'storeDriverState', { tenantId: null }, { driver }, state.rollouts.length);
@@ -5545,13 +5666,11 @@ export class CloudflareScopeHost {
                 await this.cp.releaseStoreDriverHold(input);
             },
             beginStoreDriverRollout: async (actor, input) => {
-                const row = await this.directory('beginStoreDriverRollout', { ...input, actor, at: new Date().toISOString() });
-                await this.recordAdmin(actor, input.action === 'rollback' ? 'rollBackStoreDriver' : 'rollOutStoreDriver', { tenantId: null }, null, row);
+                const row = await this.directory('beginStoreDriverRolloutAndAudit', { ...input, actor, at: new Date().toISOString() }, this.adminEntry(actor, input.action === 'rollback' ? 'rollBackStoreDriver' : 'rollOutStoreDriver', { tenantId: null }, null, null));
                 return row;
             },
             finishStoreDriverRollout: async (actor, input) => {
-                const row = await this.directory('finishStoreDriverRollout', { ...input, at: new Date().toISOString() });
-                await this.recordAdmin(actor, row.action === 'rollback' ? 'rollBackStoreDriver' : 'rollOutStoreDriver', { tenantId: null }, null, row);
+                const row = await this.directory('finishStoreDriverRolloutAndAudit', { ...input, at: new Date().toISOString() }, this.adminEntry(actor, 'rollOutStoreDriver', { tenantId: null }, null, null));
                 return row;
             },
             storeDriverRebuild: async (actor, driver) => {
@@ -5850,8 +5969,7 @@ export class CloudflareScopeHost {
                 // admin log too, so an entry written first would be overwritten by the very act
                 // it records, leaving the platform's most consequential write invisible.
                 const before = (await this.cp.listTenants({ limit: 1000 })).length;
-                await this.cp.importDump(dump.tables);
-                await this.recordAdmin(actor, 'restoreDirectory', { tenantId: null }, { tenants: before }, { capturedAt: dump.capturedAt, tables: dump.tables.length });
+                await this.directory('importDumpAndAudit', dump.tables, this.adminEntry(actor, 'restoreDirectory', { tenantId: null }, { tenants: before }, { capturedAt: dump.capturedAt, tables: dump.tables.length }));
             },
             activateScope: async (actor, tenantId, scopeId) => {
                 // Idempotent on `active`, unaudited because nothing changed. Provisioning is
@@ -6079,11 +6197,10 @@ export class CloudflareScopeHost {
                 // anyway leaves the admin log recording an access that could not happen.
                 await this.assertScope(input.tenantId, input.scopeId);
                 const session = newImpersonationSession(ulid(), actor, input, new Date().toISOString());
-                await this.cp.writeImpersonation(impersonationRowValues(session));
+                await this.directory('writeImpersonationAndAudit', impersonationRowValues(session), this.adminEntry(actor, 'beginImpersonation', { tenantId: session.tenantId, scopeId: session.scopeId }, null, session));
                 // BEFORE the session is usable, so the log entry precedes every row it
                 // will ever touch. The reason rides in `after`: it is what a review reads
                 // first, and a log saying a session opened but not why is half a record.
-                await this.recordAdmin(actor, 'beginImpersonation', { tenantId: session.tenantId, scopeId: session.scopeId }, null, session);
                 return session;
             },
             endImpersonation: async (actor, id) => {
@@ -6095,9 +6212,9 @@ export class CloudflareScopeHost {
                 // already stopped it.
                 if (before.endedAt !== null)
                     return before;
-                await this.cp.endImpersonation(String(id), new Date().toISOString());
+                const endedAt = new Date().toISOString();
+                await this.directory('endImpersonationAndAudit', String(id), endedAt, this.adminEntry(actor, 'endImpersonation', { tenantId: before.tenantId, scopeId: before.scopeId }, before, { ...before, endedAt }));
                 const after = mapImpersonationRow((await this.cp.readImpersonation(String(id))));
-                await this.recordAdmin(actor, 'endImpersonation', { tenantId: after.tenantId, scopeId: after.scopeId }, before, after);
                 return after;
             },
             listImpersonations: async (actor, filter) => {
@@ -6175,14 +6292,18 @@ export class CloudflareScopeHost {
                 await this.recordAccess(actor, 'readMeters', { tenantId: only ?? null }, filter ?? null, reading.perTenant.length);
                 return meterReading.parse(reading);
             },
+            readTenantStorageGauge: async (actor, tenantId, limit) => {
+                const result = await this.cp.readTenantStorageGauge(tenantId, limit);
+                await this.recordAccess(actor, 'readTenantStorageGauge', { tenantId }, { limit }, result.gauge.sampled);
+                return result;
+            },
             registerIdentityPool: async (actor, input) => {
                 const parsed = identityPool.parse(input);
-                const created = await this.directory('registerIdentityPool', parsed.provider, parsed.topology, parsed.tenantId, new Date().toISOString());
+                const created = await this.directory('registerIdentityPoolAndAudit', parsed.provider, parsed.topology, parsed.tenantId, new Date().toISOString(), this.adminEntry(actor, 'registerIdentityPool', { tenantId: parsed.tenantId }, null, parsed));
                 if (!created)
                     return; // identical registration is idempotent, unaudited
                 // Null tenant for a central pool: it belongs to no single tenant, which is
                 // what made the admin log's tenantId nullable.
-                await this.recordAdmin(actor, 'registerIdentityPool', { tenantId: parsed.tenantId }, null, parsed);
             },
             getIdentityPool: async (actor, provider) => {
                 const r = await this.cp.readPool(provider);
@@ -6239,7 +6360,7 @@ export class CloudflareScopeHost {
                 // never seen a plaintext credential.
                 const sealed = await this.secretBox.seal(JSON.stringify(input.secret));
                 const now = new Date().toISOString();
-                await this.cp.insertConnection({
+                await this.directory('insertConnectionAndAudit', {
                     id: input.id,
                     tenantId: input.tenantId,
                     vertical: input.vertical,
@@ -6254,17 +6375,16 @@ export class CloudflareScopeHost {
                     createdAt: now,
                     keyId: sealed.keyId,
                     ciphertext: sealed.ciphertext,
-                });
-                // METADATA ONLY — the admin log is append-only, so a credential written
-                // here could never be removed.
-                await this.recordAdmin(actor, 'createConnection', { tenantId: input.tenantId, vertical: input.vertical }, null, {
+                }, this.adminEntry(actor, 'createConnection', { tenantId: input.tenantId, vertical: input.vertical }, null, {
                     id: input.id,
                     provider: input.provider,
                     label: input.label,
                     scopes: input.scopes,
                     externalAccountRef: input.externalAccountRef ?? null,
                     createdBy: input.createdBy ?? actor,
-                });
+                }));
+                // METADATA ONLY — the admin log is append-only, so a credential written
+                // here could never be removed.
             },
             connectionSealingKey: async (id) => this.ensureSealingKey(id),
             connectionSealingKeys: async (tenantId, vertical) => {
@@ -6307,26 +6427,22 @@ export class CloudflareScopeHost {
                     throw new Error(`connection not found: ${id}`);
                 const sealed = await this.secretBox.seal(JSON.stringify(connectionSecret.parse(secret)));
                 const now = new Date().toISOString();
-                await this.cp.updateConnectionSecret(id, sealed.keyId, sealed.ciphertext, expiresAt === undefined ? row.expires_at : expiresAt, now);
-                await this.recordAdmin(actor, 'updateConnectionSecret', { tenantId: row.tenant_id, vertical: row.vertical }, null, {
+                await this.directory('updateConnectionSecretAndAudit', id, sealed.keyId, sealed.ciphertext, expiresAt === undefined ? row.expires_at : expiresAt, now, this.adminEntry(actor, 'updateConnectionSecret', { tenantId: row.tenant_id, vertical: row.vertical }, null, {
                     id,
                     provider: row.provider,
                     rotatedAt: now,
                     expiresAt: expiresAt === undefined ? row.expires_at : expiresAt,
-                    // §3.5.1's attribution, rotate-side: the authorizing tenant principal,
-                    // never laundered into the actor column.
                     ...(opts?.rotatedBy ? { rotatedBy: opts.rotatedBy } : {}),
-                });
+                }));
             },
             revokeConnection: async (actor, id) => {
                 const row = await this.cp.readConnection(id);
                 if (!row)
                     throw new Error(`connection not found: ${id}`);
                 const now = new Date().toISOString();
-                const changed = await this.cp.revokeConnection(id, now);
+                const changed = await this.directory('revokeConnectionAndAudit', id, now, this.adminEntry(actor, 'revokeConnection', { tenantId: row.tenant_id, vertical: row.vertical }, { status: row.status }, { id, provider: row.provider, status: 'revoked', revokedAt: now }));
                 if (!changed)
                     return; // idempotent, and a no-op is not audited
-                await this.recordAdmin(actor, 'revokeConnection', { tenantId: row.tenant_id, vertical: row.vertical }, { status: row.status }, { id, provider: row.provider, status: 'revoked', revokedAt: now });
             },
             // -- a vertical's mailed connect links (connections.md §3.5.4) --------------
             // Parsed here, run in the ControlPlaneDO as the kernel's statements (shared with
@@ -6424,11 +6540,10 @@ export class CloudflareScopeHost {
                 if (pool.topology === 'tenant-bound' && pool.tenant_id !== parsed.tenantId) {
                     throw substratError('conflict', `identity pool '${parsed.provider}' is bound to tenant ${pool.tenant_id} and cannot link into ${parsed.tenantId}`);
                 }
-                const changed = await this.directory('linkIdentity', parsed.provider, parsed.externalId, parsed.principal, parsed.tenantId, parsed.scopeId ?? null, new Date().toISOString());
+                const changed = await this.directory('linkIdentityAndAudit', parsed.provider, parsed.externalId, parsed.principal, parsed.tenantId, parsed.scopeId ?? null, new Date().toISOString(), this.adminEntry(actor, 'linkIdentity', { tenantId: parsed.tenantId, scopeId: parsed.scopeId }, null, { provider: parsed.provider, externalId: parsed.externalId, principal: parsed.principal }));
                 // Idempotent: an identity already bound is a no-op, not audited.
                 if (!changed)
                     return;
-                await this.recordAdmin(actor, 'linkIdentity', { tenantId: parsed.tenantId, scopeId: parsed.scopeId }, null, { provider: parsed.provider, externalId: parsed.externalId, principal: parsed.principal });
                 // #406: an identity link is a tenant-level write, so it fans out into the tenant's
                 // projected scopes exactly as entitlements do (#304) — a no-op unless scope-local
                 // projection is on; the reconcile sweep repairs any drop.
@@ -6437,10 +6552,9 @@ export class CloudflareScopeHost {
             unlinkIdentity: async (actor, tenantId, principal) => {
                 // DELETE by principal (audit is the log), so the caller who removed a member
                 // can sever their login without knowing the external subject. Idempotent.
-                const changed = await this.cp.unlinkIdentity(tenantId, principal);
+                const changed = await this.directory('unlinkIdentityAndAudit', tenantId, principal, this.adminEntry(actor, 'unlinkIdentity', { tenantId, scopeId: null }, { principal }, null));
                 if (!changed)
                     return;
-                await this.recordAdmin(actor, 'unlinkIdentity', { tenantId, scopeId: null }, { principal }, null);
                 // The unlink must reach the projected scopes so the severed login stops resolving
                 // there — this is what makes revocation durable at request time (#406); a dropped
                 // fan-out is repaired by the reconcile sweep.
@@ -6532,24 +6646,11 @@ export class CloudflareScopeHost {
                 }));
             },
             markAccessLogDrained: async (actor, upToId, drainedAt) => {
-                const drained = await this.cp.markAccessLogDrained(upToId, drainedAt);
-                if (drained > 0) {
-                    // The payload is the APPLIED state, so it belongs in `after` (contracts'
-                    // adminLogEntry: before = prior state, after = the applied payload).
-                    await this.recordAdmin(actor, 'drainAccessLog', { tenantId: null }, null, { drained, upToId, drainedAt });
-                }
-                return drained;
+                return this.directory('markAccessLogDrainedAndAudit', upToId, drainedAt, this.adminEntry(actor, 'drainAccessLog', { tenantId: null }, null, null));
             },
             pruneAccessLog: async (actor, limit) => {
                 // Checked here as well as in the directory, so the refusal keeps its code across the hop.
-                const pruned = await this.cp.pruneAccessLog(assertRowLimit('limit', limit));
-                if (pruned > 0) {
-                    // The payload is the APPLIED state, so it belongs in `after` (contracts'
-                    // adminLogEntry: before = prior state, after = the applied payload) — the
-                    // same shape as drainAccessLog's row above (#557).
-                    await this.recordAdmin(actor, 'pruneAccessLog', { tenantId: null }, null, { pruned });
-                }
-                return pruned;
+                return this.directory('pruneAccessLogAndAudit', assertRowLimit('limit', limit), this.adminEntry(actor, 'pruneAccessLog', { tenantId: null }, null, null));
             },
             auditLog: async (actor, filter) => {
                 const rows = await this.cp.auditLog({
@@ -6675,13 +6776,11 @@ export class CloudflareScopeHost {
                 return rows.map((r) => issueEntry.parse(r));
             },
             setIssueStatus: async (actor, fingerprint, status) => {
-                const change = await this.cp.setIssueStatus(fingerprint, status, new Date().toISOString());
+                const change = await this.directory('setIssueStatusAndAudit', fingerprint, status, new Date().toISOString(), this.adminEntry(actor, 'setIssueStatus', { tenantId: null }, null, null));
                 if (!change)
                     return undefined;
-                const before = issueEntry.parse(change.before);
                 const after = issueEntry.parse(change.after);
-                // A lifecycle flip is a staff mutation — audited with the diff (K-33).
-                await this.recordAdmin(actor, 'setIssueStatus', { tenantId: null, vertical: after.lastVertical }, { fingerprint, status: before.status }, { fingerprint, status: after.status });
+                // A lifecycle flip is recorded in the same directory unit as the state write.
                 return after;
             },
             listFindings: async (actor, filter) => {
@@ -6734,6 +6833,16 @@ export class CloudflareScopeHost {
                 await this.recordAccess(actor, 'listRequestRollupDays', { tenantId: null }, filter ?? null, rows.length);
                 return rows;
             },
+            listTenantRequestMeter: async (actor, tenantId, since, until, limit) => {
+                const rows = await this.cp.listTenantRequestMeter(tenantId, since, until, limit);
+                await this.recordAccess(actor, 'listTenantRequestMeter', { tenantId }, { since, until, limit }, rows.length);
+                return rows;
+            },
+            listRequestMeterDays: async (actor, since, until) => {
+                const rows = await this.cp.listRequestMeterDays(since, until);
+                await this.recordAccess(actor, 'listRequestMeterDays', { tenantId: null }, { since, until }, rows.length);
+                return rows;
+            },
             pruneRequestDays: async (_actor, limit, retentionMonths) => this.cp.pruneRequestDays(assertRowLimit('limit', limit), retentionMonths),
             recordMeterDay: async (_actor, input) => this.cp.recordMeterDay(input),
             listMeterDays: async (actor, filter) => {
@@ -6775,6 +6884,11 @@ export class CloudflareScopeHost {
                 await this.recordAccess(actor, 'listModelUsage', { tenantId: filter?.tenantId ?? null, scopeId: filter?.scopeId ?? null }, filter, rows.length);
                 return rows.map(modelUsageEntryOf);
             },
+            listTenantModelUsageMeter: async (actor, filter) => {
+                const rows = await this.cp.listTenantModelUsageMeter(filter);
+                await this.recordAccess(actor, 'listTenantModelUsageMeter', { tenantId: filter.tenantId }, { since: filter.since, until: filter.until, limit: filter.limit }, rows.length);
+                return rows;
+            },
             summarizeModelUsage: async (actor, window, marginPercent) => {
                 const rows = await this.cp.listModelUsage({ ...window, order: 'asc' });
                 await this.recordAccess(actor, 'summarizeModelUsage', { tenantId: window.tenantId ?? null }, window, rows.length);
@@ -7216,6 +7330,13 @@ export class CloudflareScopeHost {
         // via newUniqueId (K-7) and stores the mapping in the directory — deferred.
         return this.scopeNs.get(this.scopeNs.idFromName(scopeId));
     }
+    /** The shared coordinator has only a placeholder ScopeDO for a scope served by another deployment.
+     * Until a permission delegation seam exists, preserve its existing write and single-row audit path. */
+    async scopePermissionUsesLegacyPlaceholder(tenantId, scopeId) {
+        if (!this.servesScopesElsewhereNow)
+            return false;
+        return (await this.cp.getScopeRecord(tenantId, scopeId))?.vertical != null;
+    }
     // -- the rewind hold (#1819) ------------------------------------------------
     // A PITR rewind to a bookmark from before a schedule kill switch was pulled brings the
     // module's `system:` grants back live, and nothing in the rewound storage says otherwise.