@substrat-run/adapter-cloudflare 0.179.0 → 0.183.0

package/dist/host.js

@@ -1,7 +1,7 @@
 import { env as ambientEnv } from 'cloudflare:workers';
 import { isRewindRefusal, REWIND_REFUSED } from './rewind-refusal.js';
 import { isSystemDoorMoved, SYSTEM_DOOR_MOVED, SYSTEM_DOOR_REGATES } from './system-door.js';
-import { delegatedReadParams, operationSeriesCount, fromWireFailure, isSubstratError, exportReadInput, exportedBatch, importBatch, importResult, importState, importsOfManifestJson, connectionLandingsOfManifestJson, connectorsOfManifestJson, exportsOfManifestJson, assertNoBindingShapeBreak, importCursorMove, importCursorMoveAt, importCursorMoved, accessLogEntry, adminLogEntry, opsFailureEntry, opsFailureFingerprint, issueEntry, findingEntry, findingRuleEntry, sweepRunEntry, FRESHNESS_HEARTBEAT_MINUTES, sweepRunsPayload, modelUsageEntry, createTenantInput, identityLink, identityPool, createOrgInput, promotionAcknowledgement, bindAcknowledgement, bindHostnameInput, channelHistoryEntry, hostnameBinding, publishVersionInput, AUTO_ADMISSION_NOTE, registerVerticalInput, vertical as verticalSchema, verticalServingState, deploymentWireAuth, verticalChannel, verticalVersion, connection, capabilityExchange, mintedCapability, boundedBecomeMint, boundedBecomeRevoke, boundedUnbind, entityRef, becomeLinkState, principalBecomeCapabilityInput, capabilityGrant, principalId, connectionGrant, connectionRevoke, connectionGrantRecord, connectionSecret, systemGrant, systemSwitch, systemSwitchOutcome, systemScheduleEntry, systemSwitchRecord, entitlementGrant, entitlementGrantInput, capabilityFilter, instant, meterReading, scopeStorageSample, requestDay, requestRollupDay, meterDay, meterDayTake, verticalOwnerPeriod, subjectRef, createConnectionInput, connectLinkFilter, connectLinkKey, consumeConnectLinkInput, mintConnectLinkInput, projectedConnectionGrant, projectedConnectionKey, moduleManifest, org as orgSchema, orgMembership, resolvedIdentity, identityMembership, roleDefinition, scope as scopeSchema, tenant as tenantSchema, tenantRole, delegatedReadRecord, ownerTransferAudit, memberChangeAudit, peerBindingAudit, connectionBindingAudit, copyMarkAudit, orphanSweepAudit, subjectShredReceipt, connectorDispatchKind, callsOfManifestJson, outboundOfManifestJson, SCOPE_GATE_REASONS, substratError, MODULE_OBJECTS_NOT_CARRIED, errorCodeOf, redrainEventsInput, coverage, peerCoverage, peerGrantsEntry, peerSwitch, peerSwitchOutcome, verticalCaller, verticalResolution, peerInstanceResolution, peerBinding as peerBindingSchema, verticalSlug, entityObjectRef, ATTACHMENT_BLOB_BINDING, blobStoreBindingName, lifecycleDelivery, scopeLifecycle, storeDriverDumpPageBytes, } from '@substrat-run/contracts';
+import { delegatedReadParams, operationSeriesCount, fromWireFailure, isSubstratError, exportReadInput, exportedBatch, importBatch, importResult, importState, importsOfManifestJson, connectionLandingsOfManifestJson, connectorsOfManifestJson, exportsOfManifestJson, assertNoBindingShapeBreak, importCursorMove, importCursorMoveAt, importCursorMoved, accessLogEntry, adminLogEntry, opsFailureEntry, opsFailureFingerprint, issueEntry, findingEntry, findingRuleEntry, sweepRunEntry, FRESHNESS_HEARTBEAT_MINUTES, sweepRunsPayload, modelUsageEntry, createTenantInput, identityLink, identityPool, createOrgInput, promotionAcknowledgement, bindAcknowledgement, bindHostnameInput, channelHistoryEntry, hostnameBinding, publishVersionInput, AUTO_ADMISSION_NOTE, registerVerticalInput, vertical as verticalSchema, verticalServingState, deploymentWireAuth, verticalChannel, verticalVersion, connection, capabilityExchange, mintedCapability, boundedBecomeMint, boundedBindLinkMint, boundedBecomeRevoke, boundedUnbind, entityRef, becomeLinkState, principalBecomeCapabilityInput, principalBindLinkInput, capabilityGrant, principalId, connectionGrant, connectionRevoke, connectionGrantRecord, connectionSecret, systemGrant, systemSwitch, systemSwitchOutcome, systemScheduleEntry, systemSwitchRecord, entitlementGrant, entitlementGrantInput, capabilityFilter, instant, meterReading, scopeStorageSample, requestDay, requestRollupDay, meterDay, meterDayTake, verticalOwnerPeriod, subjectRef, createConnectionInput, connectLinkFilter, connectLinkKey, consumeConnectLinkInput, mintConnectLinkInput, projectedConnectionGrant, projectedConnectionKey, moduleManifest, org as orgSchema, orgMembership, resolvedIdentity, identityMembership, roleDefinition, scope as scopeSchema, tenant as tenantSchema, tenantRole, delegatedReadRecord, ownerTransferAudit, memberChangeAudit, peerBindingAudit, connectionBindingAudit, copyMarkAudit, orphanSweepAudit, subjectShredReceipt, connectorDispatchKind, callsOfManifestJson, outboundOfManifestJson, SCOPE_GATE_REASONS, substratError, MODULE_OBJECTS_NOT_CARRIED, errorCodeOf, redrainEventsInput, coverage, peerCoverage, peerGrantsEntry, peerSwitch, peerSwitchOutcome, verticalCaller, verticalResolution, peerInstanceResolution, peerBinding as peerBindingSchema, verticalSlug, entityObjectRef, ATTACHMENT_BLOB_BINDING, blobStoreBindingName, lifecycleDelivery, scopeLifecycle, storeDriverDumpPageBytes, } from '@substrat-run/contracts';
 import { normalizeHostname, toRouteTarget } from './route-resolver.js';
 import { attachmentBlobKey, normalizeUploadMediaType, redeemOrReplayUploadLink, attachmentSha256, bytesStream, isSizedByteStream, openAttachmentByteStream, putAttachmentBytes, entitlementDenial, requiredEntitlementFor, foldMeterReading, parseValidationRecords, readableScopes, resolveScopeRecord, ulid, withheldOpsFailure, KEPT_COPY_REFUSAL, capabilityTokenHash, checkBecomeInput, assertBecomeLinkStateIds, plausibleSessionToken, foldModelUsage, backoffAt, resolveRetryPolicy, executorOutcomeOf, isDeliveryRefusal, refusalJournalText, isSecretBoxConfigured, unconfiguredSecretBox, createSubjectKeys, generateSealingKeyPair, openSealed, ImpersonationRefused, assertSessionUsable, impersonationRowValues, mapImpersonationRow, newImpersonationSession, jobRunOf, assertLeaseMs, runDueJobRuns, SYSTEM_DOOR_WAIT, startJobRun, attachmentTextJob, assertAttachmentExtractors, resolveAttachmentTextBounds, assertJobRegistrable, ATTACHMENT_TEXT_BACKFILL_JOB, ATTACHMENT_TEXT_JOB, kernelJobFor, attachmentTextBackfillJob, searchLimit, searchMatchExpression, globalFetch, fetchLikeOf, deadlineFetch, assertRedrainWindow, platformRequestOf, undrainedEventsOf, outboxSubscribersOf, pruneInputOf, inUnitMovesToAudit, staleCarryRevertRow, staleCarryReverts, recordedOffFromWire, peerSubjectRef, SWITCH_KINDS, reassertActionOf, reassertEntry, reassertOffRow, reassertOnRow, switchActionOf, switchAuditSubject, recordAuditOutcome, auditedCapabilityRevoke, auditedScopePermissionWrite, auditWarningOf, switchNotFoundMessage, recordWriteSuperseded, switchSubjectOf, switchSupersededMessage, withRecorded, systemSwitchedOffMessage, tenantSystemSwitchedOffMessage, CrossVerticalRegistry, importCursorSourceOf, exportBreaksOf, exportBreakRefusal, assertPromoteReviewCurrent, promoteRaceRefusal, servingRaceRefusal, migratesFrom, servedFromRow, rebindRaceRefusal, bindExportBreaksOf, bindExportBreakRefusal, scopeMoveOf, runningVersionOf, strandJudgmentsOf, boundShapesOfColumn, installReconciled, collectPeers, peerCallerAt, peerSeats, connectorCallRecord, noopConnectorCallRecorder, recordConnectorCall, settleConnectionUse, splitManifestMigrations, publishedMigrationDigest, migrationChangeRefusal, unknownRoleError, assertRowLimit, assertRowOffset, emptyImportResult, INERT_SCOPE_REASON, lifecycleReceipt, lifecycleRefusal, scopeNotHeldRefusal, isPrimaryScope, isPrimaryScopeRow, asyncInvocationId, asyncLinePass, assertNoCallerPurge, purgeReportOf, purgeStillDue, assertBoundOperations, registerTrashTargets, assertModuleDeclared, noteDeclaredKeys, noteReservedKeys, reservedGrantRefusal, reservedRoleRefusal, reservedRoleSetRefusal, reservedShapeRefusal, SEAT_HOLDING_SCOPE_STATUSES, dumpRoleRefusal, dumpRoleState, memberAddedAudit, shapeTopUpBatch, verticalOwnerNow, } from '@substrat-run/kernel';
 import { fenceAttachmentSweep, missingAttachmentStore, sweepOrphanAttachments, unsettledCopyRefusal } from '@substrat-run/kernel';
@@ -50,15 +50,18 @@ export const TENANT_UNRECORDED_PER_PASS = 50;
  */
 const unknownScopeForTenant = (tenantId, scopeId) => substratError('not_found', `unknown scope for tenant: (${tenantId}, ${scopeId})`);
 /**
- * #2016: the line a CP-less host writes each time it admits a pair to a scope with no tenant record
- * and no role rows — nothing to hold the pair against. Ids only.
+ * #2035: the line a CP-less host writes when a door refuses a scope whose tenant is not recorded —
+ * no receipt and no role rows. The caller gets the foreign pair's refusal unchanged, so this line is
+ * the only place an operator tells a scope that has not converged from a wrong-tenant request.
+ * Server-side only, and ids and the door's name only.
  */
-export const tenantUnrecordedLine = (tenantId, scopeId) => ({
-    substrat: 'tenant-unrecorded',
+const tenantUnrecordedRefusedLine = (tenantId, scopeId, door) => ({
+    substrat: 'tenant-unrecorded-refused',
     level: 'warn',
     tenantId,
     scopeId,
-    message: 'admitted to a scope whose tenant is not recorded; a reconcile or lifecycle delivery records it',
+    door,
+    message: 'refused a scope whose tenant is not recorded; a reconcile, provision or load naming its tenant records it',
 });
 /**
  * #2430: the line a host writes when a provision or reconcile skips delivered connection grants that
@@ -828,7 +831,7 @@ export class CloudflareScopeHost {
     async drainDue(tenantId, scopeId) {
         // Same lifecycle gate `getScope` applies (K-3): a suspended or archived scope
         // does not get its effects driven either.
-        await this.assertLive(tenantId, scopeId);
+        await this.assertLive(tenantId, scopeId, 'drainDue');
         await this.migrateAndRecord(scopeId);
         // #1525: null, and honestly so — a sweep is not a call. An attempt this pass makes
         // records no invocation, which is what distinguishes it from the first attempt the
@@ -889,14 +892,14 @@ export class CloudflareScopeHost {
         this.attachmentExtractors, this.attachmentTextBounds);
     }
     async startJobRun(tenantId, scopeId, input) {
-        await this.assertLive(tenantId, scopeId);
+        await this.assertLive(tenantId, scopeId, 'startJobRun');
         await this.migrateAndRecord(scopeId);
         return jobRunOf(await startJobRun(this.jobStore(scopeId), input, ulid, () => new Date().toISOString()));
     }
     async runDueJobs(tenantId, scopeId, options) {
         // Same lifecycle gate as `drainDue`: a suspended scope's runs wait rather than
         // advance, and an archived one's never move again.
-        await this.assertLive(tenantId, scopeId);
+        await this.assertLive(tenantId, scopeId, 'runDueJobs');
         await this.migrateAndRecord(scopeId);
         // #1575: the kernel's extraction jobs are this host's own, bound to this scope — no
         // deployment registers them, and none can shadow them. The backfill starts here, on
@@ -920,7 +923,7 @@ export class CloudflareScopeHost {
         });
     }
     async jobRuns(tenantId, scopeId, filter) {
-        await this.validateScopeAccess(tenantId, scopeId);
+        await this.validateScopeAccess(tenantId, scopeId, 'jobRuns');
         await this.migrateAndRecord(scopeId);
         return (await this.jobStore(scopeId).list(filter ?? {})).map(jobRunOf);
     }
@@ -930,13 +933,13 @@ export class CloudflareScopeHost {
         // same context build as the in-process path, so the handler cannot tell which host
         // ran it. On a CP-less host `connectorContext` throws from the null control plane:
         // fail closed, exactly the hole routing exists to avoid.
-        await this.assertLive(tenantId, scopeId);
+        await this.assertLive(tenantId, scopeId, 'dispatchConnector');
         // Built on a view bound to the event, so its admin rows carry it and nothing else the
         // host serves does (#2055).
         await handler(await this.causedByView(event.id).connectorContext(tenantId, scopeId, options?.timeoutMs ?? 30_000, event.id), event);
     }
     async executorDeadLetters(tenantId, scopeId) {
-        await this.validateScopeAccess(tenantId, scopeId);
+        await this.validateScopeAccess(tenantId, scopeId, 'executorDeadLetters');
         await this.migrateAndRecord(scopeId);
         return this.scopeStub(scopeId).executorDeadLetters();
     }
@@ -949,18 +952,18 @@ export class CloudflareScopeHost {
         return this.scopeStub(scopeId).enqueueSweepRuns(JSON.stringify(sweepRunsPayload.parse(payload)), JSON.stringify({ system: 'scope-sweeper' }));
     }
     async listPlatformRequests(tenantId, scopeId) {
-        await this.validateScopeAccess(tenantId, scopeId);
+        await this.validateScopeAccess(tenantId, scopeId, 'listPlatformRequests');
         await this.migrateAndRecord(scopeId);
         // Tolerant (#1588, #1637): an undecodable row comes back naming why, never throws for the list.
         return (await this.scopeStub(scopeId).pendingPlatformRequests()).map(platformRequestOf);
     }
     async listPlatformRequestHistory(tenantId, scopeId, filter) {
-        await this.validateScopeAccess(tenantId, scopeId);
+        await this.validateScopeAccess(tenantId, scopeId, 'listPlatformRequestHistory');
         await this.migrateAndRecord(scopeId);
         return (await this.scopeStub(scopeId).platformRequestHistory(filter)).map(platformRequestOf);
     }
     async settlePlatformRequest(tenantId, scopeId, id, outcome) {
-        await this.validateScopeAccess(tenantId, scopeId);
+        await this.validateScopeAccess(tenantId, scopeId, 'settlePlatformRequest');
         await this.migrateAndRecord(scopeId);
         // #2102: an outcome event travels by the verb that writes it; every other settle keeps the
         // positional one, so it still reaches a DO class that predates the event.
@@ -1095,7 +1098,7 @@ export class CloudflareScopeHost {
         // Checked on this side too, as `HostAdmin.mintCapability` does: a typed refusal thrown
         // across the RPC arrives as a bare message.
         checkBecomeInput(input, new Date().toISOString());
-        await this.assertLive(tenantId, scopeId);
+        await this.assertLive(tenantId, scopeId, 'mintCapabilityLocal');
         await this.migrateAndRecord(scopeId);
         return mintedCapability.parse(await this.scopeStub(scopeId).mintBecomeCapability(input, actor));
     }
@@ -1674,7 +1677,7 @@ export class CloudflareScopeHost {
                 after = { scriptRef: last.scriptRef, moveId: last.moveId };
             }
             // The tenant's status too, as every door into a scope asks.
-            await this.assertLive(tenantId, scopeId);
+            await this.assertLive(tenantId, scopeId, 'sweepOrphanAttachments');
             vouched = true;
         }
         else if (request.copiesSettled !== true) {
@@ -1993,18 +1996,18 @@ export class CloudflareScopeHost {
         // gates and metadata facts live in the ScopeDO (per-scope serialization, spine event
         // in the same transaction); bytes go straight to the per-tenant R2 bucket through the
         // binding the vertical's worker resolved — never through the DO.
-        await this.assertLive(tenantId, scopeId);
+        await this.assertLive(tenantId, scopeId, 'attachments');
         await this.migrateAndRecord(scopeId);
         const store = await this.resolveAttachmentStore(tenantId);
         return this.buildAttachmentSurface({ principal }, tenantId, scopeId, store);
     }
     async inspectUploadLink(tenantId, scopeId, secret, target, idempotencyKey) {
-        await this.assertLive(tenantId, scopeId);
+        await this.assertLive(tenantId, scopeId, 'inspectUploadLink');
         await this.migrateAndRecord(scopeId);
         return unwrapReply(await this.scopeStub(scopeId).uploadLinkInspectReply(secret, tenantId, scopeId, target, idempotencyKey)).view;
     }
     async redeemUploadLink(tenantId, scopeId, secret, input) {
-        await this.assertLive(tenantId, scopeId);
+        await this.assertLive(tenantId, scopeId, 'redeemUploadLink');
         await this.migrateAndRecord(scopeId);
         const stub = this.scopeStub(scopeId);
         // The target first (the kernel judges it before the state), so a wrong path never reads as
@@ -2057,7 +2060,7 @@ export class CloudflareScopeHost {
             throw new Error(`connection ${connectionId} is for vertical '${conn.vertical}' and scope ${scopeId} ` +
                 `runs '${scope.vertical ?? 'none'}'`);
         }
-        await this.validateScopeAccess(conn.tenant_id, scopeId);
+        await this.validateScopeAccess(conn.tenant_id, scopeId, 'getConnectorAttachments');
         // #574: same delegation as getConnectorScope. `upload` is the verb the reconcile
         // path needs (landing the sealed PDF) and `open` the one the outbound path needs
         // (sending the vertical's own document, #711). `list` and `remove` still fail
@@ -2458,7 +2461,7 @@ export class CloudflareScopeHost {
     async getScope(principal, tenantId, scopeId, options) {
         // Lifecycle gates (control-plane.md §4.1/§4.2), the K-3 fail-closed path,
         // evaluated durably in the ControlPlaneDO. A throw propagates here.
-        await this.assertLive(tenantId, scopeId);
+        await this.assertLive(tenantId, scopeId, 'getScope');
         await this.migrateAndRecord(scopeId);
         return this.buildStub(tenantId, scopeId, principal, undefined, undefined, options);
     }
@@ -2495,7 +2498,7 @@ export class CloudflareScopeHost {
             throw substratError('not_found', `no scope store is bound for '${binding}'`);
         }
         const vertical = await this.scopeStoreVerticalOf(tenantId, scopeId);
-        await this.assertLive(tenantId, scopeId);
+        await this.assertLive(tenantId, scopeId, 'getScopeStore');
         if (runner) {
             await this.scopeStoreLifecycle.start();
             return {
@@ -2587,7 +2590,7 @@ export class CloudflareScopeHost {
             await this.scopeRecordForRead(tenantId, scopeId);
         const vertical = await this.scopeStoreVerticalOf(tenantId, scopeId);
         if (this.cpLess)
-            await this.assertLive(tenantId, scopeId);
+            await this.assertLive(tenantId, scopeId, 'readScopeStoreSizes');
         const sizes = [];
         for (const binding of bindings) {
             const { bytes } = await this.invokeReservedStore({ tenantId, vertical, scopeId, binding }, 'substrat.size');
@@ -2792,7 +2795,7 @@ export class CloudflareScopeHost {
             throw new Error(`connection ${connectionId} is for vertical '${conn.vertical}' and scope ${scopeId} ` +
                 `runs '${scope.vertical ?? 'none'}'`);
         }
-        await this.validateScopeAccess(conn.tenant_id, scopeId);
+        await this.validateScopeAccess(conn.tenant_id, scopeId, 'getConnectorScope');
         // #574: a scope served by ANOTHER deployment (the shared control plane running the
         // connector pass for a dispatch vertical) — the write-back rides the delegation
         // seam; migration is the serving deployment's business, exactly like provision.
@@ -2839,7 +2842,7 @@ export class CloudflareScopeHost {
         const record = await this.resolveImpersonation(session, tenantId, scopeId);
         // The same lifecycle gate the principal door applies: a suspended tenant
         // refuses a support session exactly as it refuses a user.
-        await this.assertLive(tenantId, scopeId);
+        await this.assertLive(tenantId, scopeId, 'getImpersonatedScope');
         await this.migrateAndRecord(scopeId);
         return this.buildStub(tenantId, scopeId, record.principal, undefined, undefined, options, record.id);
     }
@@ -2873,7 +2876,7 @@ export class CloudflareScopeHost {
         if (!this.moduleIds.has(moduleId)) {
             throw substratError('not_found', `module not registered on this host: ${moduleId}`);
         }
-        await this.assertLive(tenantId, scopeId);
+        await this.assertLive(tenantId, scopeId, 'openSystemDoor');
         await this.migrateAndRecord(scopeId);
         return this.openDoor('system', moduleId, scopeId, gated, pass);
     }
@@ -3025,9 +3028,9 @@ export class CloudflareScopeHost {
      * capability row lives. The answer is re-parsed on this side of the RPC.
      */
     async exchangeCapability(tenantId, scopeId, secret, options) {
-        await this.assertLive(tenantId, scopeId);
+        await this.assertLive(tenantId, scopeId, 'exchangeCapability');
         await this.migrateAndRecord(scopeId);
-        const outcome = await this.scopeStub(scopeId).exchangeCapability(secret, tenantId, scopeId, options?.mode);
+        const outcome = await this.scopeStub(scopeId).exchangeCapability(secret, tenantId, scopeId, options?.mode, options?.mode === 'bind' ? principalId.parse(options.presenter) : undefined);
         return capabilityExchange.nullable().parse(outcome);
     }
     /**
@@ -3039,7 +3042,7 @@ export class CloudflareScopeHost {
         if (!plausibleSessionToken(sessionToken)) {
             throw substratError('unauthenticated', 'not a capability session token');
         }
-        await this.assertLive(tenantId, scopeId);
+        await this.assertLive(tenantId, scopeId, 'getCapabilityScope');
         await this.migrateAndRecord(scopeId);
         const hash = await capabilityTokenHash(sessionToken);
         return this.buildStub(tenantId, scopeId, undefined, undefined, undefined, options, undefined, hash);
@@ -3145,6 +3148,15 @@ export class CloudflareScopeHost {
         await this.scopeRoleGate(tenantId, scopeId, 'mintBecomeCapabilityBounded');
         return boundedBecomeMint.parse(await this.scopeStub(scopeId).mintBecomeCapabilityBoundedFor(tenantId, scopeId, principalId.parse(caller), principalBecomeCapabilityInput.parse(input)));
     }
+    /**
+     * A principal's `bind` link mint (#2817) — binding an existing member to a record, minted by
+     * someone holding the binding's key on it. The bound (`bindLinkMintCheck`) and the write are one
+     * ScopeDO task; a refusal writes nothing. Same gate as the scope-role verbs.
+     */
+    async mintBindLinkBounded(tenantId, scopeId, caller, input) {
+        await this.scopeRoleGate(tenantId, scopeId, 'mintBindLinkBounded');
+        return boundedBindLinkMint.parse(await this.scopeStub(scopeId).mintBindLinkBoundedFor(tenantId, scopeId, principalId.parse(caller), principalBindLinkInput.parse(input)));
+    }
     /**
      * Revoke a `become` capability a principal minted (#1686) — what withdrawing a member invite
      * does to its link. `revoked` is false when it was already revoked or is not such a capability
@@ -3205,7 +3217,7 @@ export class CloudflareScopeHost {
             }
             this.assertServedHere(record, scopeId, verb);
         }
-        await this.assertLive(tenantId, scopeId);
+        await this.assertLive(tenantId, scopeId, 'peerScopeGate');
         await this.migrateAndRecord(scopeId);
         return record;
     }
@@ -3235,7 +3247,7 @@ export class CloudflareScopeHost {
         if (!plausibleSessionToken(sessionToken)) {
             throw substratError('unauthenticated', 'not a capability session token');
         }
-        await this.assertLive(tenantId, scopeId);
+        await this.assertLive(tenantId, scopeId, 'getCapabilityAttachments');
         await this.migrateAndRecord(scopeId);
         const store = await this.resolveAttachmentStore(tenantId);
         const capabilitySession = await capabilityTokenHash(sessionToken);
@@ -3342,7 +3354,7 @@ export class CloudflareScopeHost {
             if (await this.cp.scopeAccessRefusal(tenantId, scopeId))
                 return report;
         }
-        else if (lifecycleRefusal(await this.validateScopeAccess(tenantId, scopeId)) !== null) {
+        else if (lifecycleRefusal(await this.validateScopeAccess(tenantId, scopeId, 'checkFreshness')) !== null) {
             // #2016: the pair is held to the scope's own record first, so a sweep roster entry whose
             // tenant disagrees with the scope is refused before the probe reads or writes anything.
             // #1713: a held scope emits nothing, so judging it stale would only raise a false alarm.
@@ -3395,7 +3407,7 @@ export class CloudflareScopeHost {
             if (await this.cp.scopeAccessRefusal(tenantId, scopeId))
                 return report;
         }
-        else if (lifecycleRefusal(await this.validateScopeAccess(tenantId, scopeId)) !== null) {
+        else if (lifecycleRefusal(await this.validateScopeAccess(tenantId, scopeId, 'runDueSchedules')) !== null) {
             // #1713: the lifecycle the platform delivered holds the scope. Every schedule is
             // `skipped` and no cadence row moves, as under the kill switch, so a schedule that
             // came due meanwhile fires once on the first pass after the scope is live again.
@@ -3466,7 +3478,7 @@ export class CloudflareScopeHost {
                 // read again before every later fire: the scope does not hold a directory lifecycle,
                 // so a suspension after an earlier fire would otherwise not stop this one (#1713).
                 if (door)
-                    await this.assertLive(tenantId, scopeId);
+                    await this.assertLive(tenantId, scopeId, 'runDueSchedules');
                 door ??= await this.openSystemDoor(moduleId, tenantId, scopeId, gate);
                 const scope = this.buildStub(tenantId, scopeId, undefined, undefined, door, counted);
                 if (schedule.purge) {
@@ -4031,7 +4043,7 @@ export class CloudflareScopeHost {
                 // Without one, a hosted scope is refused `unavailable` rather than switched in the
                 // placeholder namespace, where it would tombstone nothing a peer call reads.
                 if (delegated)
-                    await this.validateScopeAccess(tenantId, scopeId);
+                    await this.validateScopeAccess(tenantId, scopeId, 'switchSubject');
                 else
                     await this.peerScopeGate(tenantId, scopeId, action);
             }
@@ -4821,7 +4833,7 @@ export class CloudflareScopeHost {
                 // a bare message, and the caller would lose `validation_failed`. One function, so the
                 // two sides cannot disagree about what a valid mint is.
                 checkBecomeInput(input, new Date().toISOString());
-                await this.validateScopeAccess(tenantId, scopeId);
+                await this.validateScopeAccess(tenantId, scopeId, 'mintCapability');
                 const rec = await this.capabilityScopeRecord(tenantId, scopeId);
                 // A hosted refusal precedes intent; the local migrate happens inside the audited write.
                 this.assertCapabilityScopeReach(rec, scopeId, 'mintCapability');
@@ -7053,7 +7065,9 @@ export class CloudflareScopeHost {
      * without the lifecycle half pays the one DO call the pair check needs. Null with a directory,
      * whose refusal already covered the lifecycle.
      */
-    async validateScopeAccess(tenantId, scopeId) {
+    async validateScopeAccess(tenantId, scopeId, 
+    /** The host method the call came through, named in `tenantUnrecordedRefusedLine` only. */
+    door) {
         const refusal = await this.cp.scopeAccessRefusal(tenantId, scopeId);
         if (refusal) {
             throw refusal.code
@@ -7063,14 +7077,15 @@ export class CloudflareScopeHost {
         if (!this.cpLess)
             return null;
         const { verdict, lifecycle } = await this.scopeStub(scopeId).admission(tenantId);
-        if (verdict === 'foreign')
-            throw unknownScopeForTenant(tenantId, scopeId);
-        // A scope with no tenant record and no role rows has nothing to hold the pair against, so it is
-        // let through — a compatibility state, not a steady one: the next reconcile (every push runs
-        // one against the scopes behind it, #1172) or lifecycle delivery records the directory's tenant.
-        // Logged on every admission, so an operator sees a scope that has not converged.
+        // #2035: a scope with no tenant record and no role rows has nothing to hold the pair against, so
+        // it is refused like a foreign one. The platform's paths record the tenant without passing this
+        // door — a provision or reconcile (every push runs one, #1172), a restore or snapshot, a
+        // lifecycle delivery to a scope holding data — so a scope converges rather than staying shut.
+        // The caller meets the foreign pair's refusal, word for word; only the log tells them apart.
         if (verdict === 'unknown')
-            console.warn(JSON.stringify(tenantUnrecordedLine(tenantId, scopeId)));
+            console.warn(JSON.stringify(tenantUnrecordedRefusedLine(tenantId, scopeId, door)));
+        if (verdict === 'foreign' || verdict === 'unknown')
+            throw unknownScopeForTenant(tenantId, scopeId);
         return lifecycle;
     }
     /**
@@ -7088,8 +7103,8 @@ export class CloudflareScopeHost {
      * The admin and diagnostic reads (dead letters, job runs, platform requests, delivered
      * grants) keep `validateScopeAccess` alone: an operator still reads a suspended scope.
      */
-    async assertLive(tenantId, scopeId) {
-        const refusal = lifecycleRefusal(await this.validateScopeAccess(tenantId, scopeId), { tenantId, scopeId });
+    async assertLive(tenantId, scopeId, door) {
+        const refusal = lifecycleRefusal(await this.validateScopeAccess(tenantId, scopeId, door), { tenantId, scopeId });
         if (refusal)
             throw substratError('conflict', refusal, { reason: SCOPE_GATE_REASONS.notActive });
     }
@@ -7355,7 +7370,7 @@ export class CloudflareScopeHost {
      * directory's view stays on `HostAdmin.listConnectionGrants`.
      */
     async connectionGrantsInScope(tenantId, scopeId) {
-        await this.validateScopeAccess(tenantId, scopeId);
+        await this.validateScopeAccess(tenantId, scopeId, 'connectionGrantsInScope');
         if (this.connectorDelegation) {
             if (!this.connectorDelegation.grants)
                 throw new Error('connector grant inspection is not configured for the serving deployment');
@@ -7368,10 +7383,11 @@ export class CloudflareScopeHost {
         // CP-less shape); a scope with a live control plane has its tenant-level grants in
         // the directory instead, where the checker reads them from (`cp.tenantTuples`). Read
         // only the DO and a tenant-wide grant would be reported absent on exactly the
-        // deployments that have a control plane — the fleet — while being enforced.
+        // deployments that have a control plane — the fleet — while being enforced. A CP-less
+        // host has no directory to ask, and its DO already holds the projection (#2892).
         const rows = [
             ...(await this.scopeStub(scopeId).listConnectionGrants(now)),
-            ...(await this.cp.dumpTenantTuples(tenantId))
+            ...(this.cpLess ? [] : await this.cp.dumpTenantTuples(tenantId))
                 .filter((r) => r.subject.startsWith('connection:') &&
                 r.relation.startsWith('granted:') &&
                 r.revoked_at === null &&
@@ -7849,7 +7865,7 @@ export class CloudflareScopeHost {
              * count to the directory — so a scope whose first contact after a deploy is a
              * subscription does not go dark in the migration fleet view.
              */
-            await this.assertLive(tenantId, scopeId);
+            await this.assertLive(tenantId, scopeId, 'subscribe');
             await this.migrateAndRecord(scopeId);
             // Asserted, not carried through from the client: the principal is the
             // vertical's own resolution of its session, and the tenant and scope are the
@@ -8394,17 +8410,25 @@ export class CloudflareScopeHost {
      * and a switched-off subject gets nothing. It can therefore only add what the running code
      * declares, and never takes anything away but a recorded OFF.
      *
-     * Only a scope already provisioned for `tenantId` is seated (`servesTenant`, K-3): this never
-     * provisions a scope, and never writes into another tenant's.
+     * Only a scope that serves `tenantId` is seated (K-3): this never provisions a scope, and never
+     * writes into another tenant's. Like a full reconcile, it records the platform's tenant on a scope
+     * that holds no receipt yet (`seatsTenant`, #2035), so a push converges an ownerless vertical's
+     * scopes too — every door refuses a scope whose tenant nothing recorded. The receipt lands in the
+     * seat's own unit, after the recorded-off positions: until then every door still refuses the
+     * scope, and a seat that fails records nothing.
      */
     async seatScopeLocal(input) {
         const stub = this.scopeStub(input.scopeId);
-        if (!(await stub.servesTenant(input.tenantId)))
+        if (!(await stub.seatsTenant(input.tenantId)))
             throw unknownScopeForTenant(input.tenantId, input.scopeId);
         const carry = recordedOffFromWire(input);
         const connections = await this.seatableConnectionGrants(input.tenantId, input.scopeId, input.connectionGrants); // #2430
         await this.migrateAndRecord(input.scopeId);
-        const switchedOff = await stub.seatTuples(this.declaredSeatsLocal(input.scopeId, connections.seat), carry ? { scopeId: input.scopeId, at: new Date().toISOString(), ...carry } : undefined);
+        const seated = await stub.seatTuplesFor(input.tenantId, this.declaredSeatsLocal(input.scopeId, connections.seat), carry ? { scopeId: input.scopeId, at: new Date().toISOString(), ...carry } : undefined);
+        // Reaped or recorded for another tenant since the check: K-3's refusal, naming no other tenant.
+        if ('refused' in seated)
+            throw unknownScopeForTenant(input.tenantId, input.scopeId);
+        const { switchedOff } = seated;
         return {
             ...(carry ? { switchedOff } : {}),
             ...(connections.skipped.length ? { skippedConnectionGrants: connections.skipped } : {}),
@@ -8592,7 +8616,7 @@ export class CloudflareScopeHost {
     // scope (#1713): a held scope's invoke and bytes doors refuse, as every other door does.
     /** Invoke ONE operation in this deployment as a CONNECTION (#574). */
     async connectorInvokeLocal(connectionId, tenantId, scopeId, operation, input) {
-        await this.assertLive(tenantId, scopeId); // #1713: a held scope runs no connector work either
+        await this.assertLive(tenantId, scopeId, 'connectorInvokeLocal'); // #1713: a held scope runs no connector work either
         await this.migrateAndRecord(scopeId);
         return this.buildStub(tenantId, scopeId, undefined, connectionId).invoke(operation, input);
     }
@@ -8600,7 +8624,7 @@ export class CloudflareScopeHost {
     async connectorAttachmentUploadLocal(connectionId, tenantId, scopeId, upload) {
         // The lifecycle gate every attachments door takes (#1713), ahead of the bucket: a held
         // scope's provider bytes wait for the delivery's retry rather than land (#1995).
-        await this.assertLive(tenantId, scopeId);
+        await this.assertLive(tenantId, scopeId, 'connectorAttachmentUploadLocal');
         await this.migrateAndRecord(scopeId);
         const store = await this.resolveAttachmentStore(tenantId);
         return this.buildAttachmentSurface({ connectionId }, tenantId, scopeId, store).upload(upload);
@@ -8625,7 +8649,7 @@ export class CloudflareScopeHost {
     /** The attachment surface the platform's reads as a connection go through, behind their gates. */
     async connectorReadSurface(connectionId, tenantId, scopeId, eventId) {
         // Same gate as the upload leg: a held scope's bytes are not read out of its bucket.
-        await this.assertLive(tenantId, scopeId);
+        await this.assertLive(tenantId, scopeId, 'connectorReadSurface');
         await this.migrateAndRecord(scopeId);
         const store = await this.resolveAttachmentStore(tenantId);
         return this.buildAttachmentSurface({ connectionId }, tenantId, scopeId, store, 
@@ -8799,7 +8823,7 @@ export class CloudflareScopeHost {
         const delegation = rec.vertical !== null ? this.importCursorDelegation : undefined;
         if (!delegation)
             this.assertServedHere(rec, scopeId, 'moveImportCursor');
-        await this.validateScopeAccess(tenantId, scopeId);
+        await this.validateScopeAccess(tenantId, scopeId, 'moveImportCursorAt');
         // #2114: the replay's id is also its audit `operationId`, so the scheduled settle pairs and
         // closes the lever's rows exactly as it does the kill switches'.
         const replayId = ulid();