@substrat-run/adapter-cloudflare 0.180.0 → 0.183.0

package/dist/host.js

@@ -50,15 +50,18 @@ export const TENANT_UNRECORDED_PER_PASS = 50;
  */
 const unknownScopeForTenant = (tenantId, scopeId) => substratError('not_found', `unknown scope for tenant: (${tenantId}, ${scopeId})`);
 /**
- * #2016: the line a CP-less host writes each time it admits a pair to a scope with no tenant record
- * and no role rows — nothing to hold the pair against. Ids only.
+ * #2035: the line a CP-less host writes when a door refuses a scope whose tenant is not recorded —
+ * no receipt and no role rows. The caller gets the foreign pair's refusal unchanged, so this line is
+ * the only place an operator tells a scope that has not converged from a wrong-tenant request.
+ * Server-side only, and ids and the door's name only.
  */
-export const tenantUnrecordedLine = (tenantId, scopeId) => ({
-    substrat: 'tenant-unrecorded',
+const tenantUnrecordedRefusedLine = (tenantId, scopeId, door) => ({
+    substrat: 'tenant-unrecorded-refused',
     level: 'warn',
     tenantId,
     scopeId,
-    message: 'admitted to a scope whose tenant is not recorded; a reconcile or lifecycle delivery records it',
+    door,
+    message: 'refused a scope whose tenant is not recorded; a reconcile, provision or load naming its tenant records it',
 });
 /**
  * #2430: the line a host writes when a provision or reconcile skips delivered connection grants that
@@ -828,7 +831,7 @@ export class CloudflareScopeHost {
     async drainDue(tenantId, scopeId) {
         // Same lifecycle gate `getScope` applies (K-3): a suspended or archived scope
         // does not get its effects driven either.
-        await this.assertLive(tenantId, scopeId);
+        await this.assertLive(tenantId, scopeId, 'drainDue');
         await this.migrateAndRecord(scopeId);
         // #1525: null, and honestly so — a sweep is not a call. An attempt this pass makes
         // records no invocation, which is what distinguishes it from the first attempt the
@@ -889,14 +892,14 @@ export class CloudflareScopeHost {
         this.attachmentExtractors, this.attachmentTextBounds);
     }
     async startJobRun(tenantId, scopeId, input) {
-        await this.assertLive(tenantId, scopeId);
+        await this.assertLive(tenantId, scopeId, 'startJobRun');
         await this.migrateAndRecord(scopeId);
         return jobRunOf(await startJobRun(this.jobStore(scopeId), input, ulid, () => new Date().toISOString()));
     }
     async runDueJobs(tenantId, scopeId, options) {
         // Same lifecycle gate as `drainDue`: a suspended scope's runs wait rather than
         // advance, and an archived one's never move again.
-        await this.assertLive(tenantId, scopeId);
+        await this.assertLive(tenantId, scopeId, 'runDueJobs');
         await this.migrateAndRecord(scopeId);
         // #1575: the kernel's extraction jobs are this host's own, bound to this scope — no
         // deployment registers them, and none can shadow them. The backfill starts here, on
@@ -920,7 +923,7 @@ export class CloudflareScopeHost {
         });
     }
     async jobRuns(tenantId, scopeId, filter) {
-        await this.validateScopeAccess(tenantId, scopeId);
+        await this.validateScopeAccess(tenantId, scopeId, 'jobRuns');
         await this.migrateAndRecord(scopeId);
         return (await this.jobStore(scopeId).list(filter ?? {})).map(jobRunOf);
     }
@@ -930,13 +933,13 @@ export class CloudflareScopeHost {
         // same context build as the in-process path, so the handler cannot tell which host
         // ran it. On a CP-less host `connectorContext` throws from the null control plane:
         // fail closed, exactly the hole routing exists to avoid.
-        await this.assertLive(tenantId, scopeId);
+        await this.assertLive(tenantId, scopeId, 'dispatchConnector');
         // Built on a view bound to the event, so its admin rows carry it and nothing else the
         // host serves does (#2055).
         await handler(await this.causedByView(event.id).connectorContext(tenantId, scopeId, options?.timeoutMs ?? 30_000, event.id), event);
     }
     async executorDeadLetters(tenantId, scopeId) {
-        await this.validateScopeAccess(tenantId, scopeId);
+        await this.validateScopeAccess(tenantId, scopeId, 'executorDeadLetters');
         await this.migrateAndRecord(scopeId);
         return this.scopeStub(scopeId).executorDeadLetters();
     }
@@ -949,18 +952,18 @@ export class CloudflareScopeHost {
         return this.scopeStub(scopeId).enqueueSweepRuns(JSON.stringify(sweepRunsPayload.parse(payload)), JSON.stringify({ system: 'scope-sweeper' }));
     }
     async listPlatformRequests(tenantId, scopeId) {
-        await this.validateScopeAccess(tenantId, scopeId);
+        await this.validateScopeAccess(tenantId, scopeId, 'listPlatformRequests');
         await this.migrateAndRecord(scopeId);
         // Tolerant (#1588, #1637): an undecodable row comes back naming why, never throws for the list.
         return (await this.scopeStub(scopeId).pendingPlatformRequests()).map(platformRequestOf);
     }
     async listPlatformRequestHistory(tenantId, scopeId, filter) {
-        await this.validateScopeAccess(tenantId, scopeId);
+        await this.validateScopeAccess(tenantId, scopeId, 'listPlatformRequestHistory');
         await this.migrateAndRecord(scopeId);
         return (await this.scopeStub(scopeId).platformRequestHistory(filter)).map(platformRequestOf);
     }
     async settlePlatformRequest(tenantId, scopeId, id, outcome) {
-        await this.validateScopeAccess(tenantId, scopeId);
+        await this.validateScopeAccess(tenantId, scopeId, 'settlePlatformRequest');
         await this.migrateAndRecord(scopeId);
         // #2102: an outcome event travels by the verb that writes it; every other settle keeps the
         // positional one, so it still reaches a DO class that predates the event.
@@ -1095,7 +1098,7 @@ export class CloudflareScopeHost {
         // Checked on this side too, as `HostAdmin.mintCapability` does: a typed refusal thrown
         // across the RPC arrives as a bare message.
         checkBecomeInput(input, new Date().toISOString());
-        await this.assertLive(tenantId, scopeId);
+        await this.assertLive(tenantId, scopeId, 'mintCapabilityLocal');
         await this.migrateAndRecord(scopeId);
         return mintedCapability.parse(await this.scopeStub(scopeId).mintBecomeCapability(input, actor));
     }
@@ -1674,7 +1677,7 @@ export class CloudflareScopeHost {
                 after = { scriptRef: last.scriptRef, moveId: last.moveId };
             }
             // The tenant's status too, as every door into a scope asks.
-            await this.assertLive(tenantId, scopeId);
+            await this.assertLive(tenantId, scopeId, 'sweepOrphanAttachments');
             vouched = true;
         }
         else if (request.copiesSettled !== true) {
@@ -1993,18 +1996,18 @@ export class CloudflareScopeHost {
         // gates and metadata facts live in the ScopeDO (per-scope serialization, spine event
         // in the same transaction); bytes go straight to the per-tenant R2 bucket through the
         // binding the vertical's worker resolved — never through the DO.
-        await this.assertLive(tenantId, scopeId);
+        await this.assertLive(tenantId, scopeId, 'attachments');
         await this.migrateAndRecord(scopeId);
         const store = await this.resolveAttachmentStore(tenantId);
         return this.buildAttachmentSurface({ principal }, tenantId, scopeId, store);
     }
     async inspectUploadLink(tenantId, scopeId, secret, target, idempotencyKey) {
-        await this.assertLive(tenantId, scopeId);
+        await this.assertLive(tenantId, scopeId, 'inspectUploadLink');
         await this.migrateAndRecord(scopeId);
         return unwrapReply(await this.scopeStub(scopeId).uploadLinkInspectReply(secret, tenantId, scopeId, target, idempotencyKey)).view;
     }
     async redeemUploadLink(tenantId, scopeId, secret, input) {
-        await this.assertLive(tenantId, scopeId);
+        await this.assertLive(tenantId, scopeId, 'redeemUploadLink');
         await this.migrateAndRecord(scopeId);
         const stub = this.scopeStub(scopeId);
         // The target first (the kernel judges it before the state), so a wrong path never reads as
@@ -2057,7 +2060,7 @@ export class CloudflareScopeHost {
             throw new Error(`connection ${connectionId} is for vertical '${conn.vertical}' and scope ${scopeId} ` +
                 `runs '${scope.vertical ?? 'none'}'`);
         }
-        await this.validateScopeAccess(conn.tenant_id, scopeId);
+        await this.validateScopeAccess(conn.tenant_id, scopeId, 'getConnectorAttachments');
         // #574: same delegation as getConnectorScope. `upload` is the verb the reconcile
         // path needs (landing the sealed PDF) and `open` the one the outbound path needs
         // (sending the vertical's own document, #711). `list` and `remove` still fail
@@ -2458,7 +2461,7 @@ export class CloudflareScopeHost {
     async getScope(principal, tenantId, scopeId, options) {
         // Lifecycle gates (control-plane.md §4.1/§4.2), the K-3 fail-closed path,
         // evaluated durably in the ControlPlaneDO. A throw propagates here.
-        await this.assertLive(tenantId, scopeId);
+        await this.assertLive(tenantId, scopeId, 'getScope');
         await this.migrateAndRecord(scopeId);
         return this.buildStub(tenantId, scopeId, principal, undefined, undefined, options);
     }
@@ -2495,7 +2498,7 @@ export class CloudflareScopeHost {
             throw substratError('not_found', `no scope store is bound for '${binding}'`);
         }
         const vertical = await this.scopeStoreVerticalOf(tenantId, scopeId);
-        await this.assertLive(tenantId, scopeId);
+        await this.assertLive(tenantId, scopeId, 'getScopeStore');
         if (runner) {
             await this.scopeStoreLifecycle.start();
             return {
@@ -2587,7 +2590,7 @@ export class CloudflareScopeHost {
             await this.scopeRecordForRead(tenantId, scopeId);
         const vertical = await this.scopeStoreVerticalOf(tenantId, scopeId);
         if (this.cpLess)
-            await this.assertLive(tenantId, scopeId);
+            await this.assertLive(tenantId, scopeId, 'readScopeStoreSizes');
         const sizes = [];
         for (const binding of bindings) {
             const { bytes } = await this.invokeReservedStore({ tenantId, vertical, scopeId, binding }, 'substrat.size');
@@ -2792,7 +2795,7 @@ export class CloudflareScopeHost {
             throw new Error(`connection ${connectionId} is for vertical '${conn.vertical}' and scope ${scopeId} ` +
                 `runs '${scope.vertical ?? 'none'}'`);
         }
-        await this.validateScopeAccess(conn.tenant_id, scopeId);
+        await this.validateScopeAccess(conn.tenant_id, scopeId, 'getConnectorScope');
         // #574: a scope served by ANOTHER deployment (the shared control plane running the
         // connector pass for a dispatch vertical) — the write-back rides the delegation
         // seam; migration is the serving deployment's business, exactly like provision.
@@ -2839,7 +2842,7 @@ export class CloudflareScopeHost {
         const record = await this.resolveImpersonation(session, tenantId, scopeId);
         // The same lifecycle gate the principal door applies: a suspended tenant
         // refuses a support session exactly as it refuses a user.
-        await this.assertLive(tenantId, scopeId);
+        await this.assertLive(tenantId, scopeId, 'getImpersonatedScope');
         await this.migrateAndRecord(scopeId);
         return this.buildStub(tenantId, scopeId, record.principal, undefined, undefined, options, record.id);
     }
@@ -2873,7 +2876,7 @@ export class CloudflareScopeHost {
         if (!this.moduleIds.has(moduleId)) {
             throw substratError('not_found', `module not registered on this host: ${moduleId}`);
         }
-        await this.assertLive(tenantId, scopeId);
+        await this.assertLive(tenantId, scopeId, 'openSystemDoor');
         await this.migrateAndRecord(scopeId);
         return this.openDoor('system', moduleId, scopeId, gated, pass);
     }
@@ -3025,7 +3028,7 @@ export class CloudflareScopeHost {
      * capability row lives. The answer is re-parsed on this side of the RPC.
      */
     async exchangeCapability(tenantId, scopeId, secret, options) {
-        await this.assertLive(tenantId, scopeId);
+        await this.assertLive(tenantId, scopeId, 'exchangeCapability');
         await this.migrateAndRecord(scopeId);
         const outcome = await this.scopeStub(scopeId).exchangeCapability(secret, tenantId, scopeId, options?.mode, options?.mode === 'bind' ? principalId.parse(options.presenter) : undefined);
         return capabilityExchange.nullable().parse(outcome);
@@ -3039,7 +3042,7 @@ export class CloudflareScopeHost {
         if (!plausibleSessionToken(sessionToken)) {
             throw substratError('unauthenticated', 'not a capability session token');
         }
-        await this.assertLive(tenantId, scopeId);
+        await this.assertLive(tenantId, scopeId, 'getCapabilityScope');
         await this.migrateAndRecord(scopeId);
         const hash = await capabilityTokenHash(sessionToken);
         return this.buildStub(tenantId, scopeId, undefined, undefined, undefined, options, undefined, hash);
@@ -3214,7 +3217,7 @@ export class CloudflareScopeHost {
             }
             this.assertServedHere(record, scopeId, verb);
         }
-        await this.assertLive(tenantId, scopeId);
+        await this.assertLive(tenantId, scopeId, 'peerScopeGate');
         await this.migrateAndRecord(scopeId);
         return record;
     }
@@ -3244,7 +3247,7 @@ export class CloudflareScopeHost {
         if (!plausibleSessionToken(sessionToken)) {
             throw substratError('unauthenticated', 'not a capability session token');
         }
-        await this.assertLive(tenantId, scopeId);
+        await this.assertLive(tenantId, scopeId, 'getCapabilityAttachments');
         await this.migrateAndRecord(scopeId);
         const store = await this.resolveAttachmentStore(tenantId);
         const capabilitySession = await capabilityTokenHash(sessionToken);
@@ -3351,7 +3354,7 @@ export class CloudflareScopeHost {
             if (await this.cp.scopeAccessRefusal(tenantId, scopeId))
                 return report;
         }
-        else if (lifecycleRefusal(await this.validateScopeAccess(tenantId, scopeId)) !== null) {
+        else if (lifecycleRefusal(await this.validateScopeAccess(tenantId, scopeId, 'checkFreshness')) !== null) {
             // #2016: the pair is held to the scope's own record first, so a sweep roster entry whose
             // tenant disagrees with the scope is refused before the probe reads or writes anything.
             // #1713: a held scope emits nothing, so judging it stale would only raise a false alarm.
@@ -3404,7 +3407,7 @@ export class CloudflareScopeHost {
             if (await this.cp.scopeAccessRefusal(tenantId, scopeId))
                 return report;
         }
-        else if (lifecycleRefusal(await this.validateScopeAccess(tenantId, scopeId)) !== null) {
+        else if (lifecycleRefusal(await this.validateScopeAccess(tenantId, scopeId, 'runDueSchedules')) !== null) {
             // #1713: the lifecycle the platform delivered holds the scope. Every schedule is
             // `skipped` and no cadence row moves, as under the kill switch, so a schedule that
             // came due meanwhile fires once on the first pass after the scope is live again.
@@ -3475,7 +3478,7 @@ export class CloudflareScopeHost {
                 // read again before every later fire: the scope does not hold a directory lifecycle,
                 // so a suspension after an earlier fire would otherwise not stop this one (#1713).
                 if (door)
-                    await this.assertLive(tenantId, scopeId);
+                    await this.assertLive(tenantId, scopeId, 'runDueSchedules');
                 door ??= await this.openSystemDoor(moduleId, tenantId, scopeId, gate);
                 const scope = this.buildStub(tenantId, scopeId, undefined, undefined, door, counted);
                 if (schedule.purge) {
@@ -4040,7 +4043,7 @@ export class CloudflareScopeHost {
                 // Without one, a hosted scope is refused `unavailable` rather than switched in the
                 // placeholder namespace, where it would tombstone nothing a peer call reads.
                 if (delegated)
-                    await this.validateScopeAccess(tenantId, scopeId);
+                    await this.validateScopeAccess(tenantId, scopeId, 'switchSubject');
                 else
                     await this.peerScopeGate(tenantId, scopeId, action);
             }
@@ -4830,7 +4833,7 @@ export class CloudflareScopeHost {
                 // a bare message, and the caller would lose `validation_failed`. One function, so the
                 // two sides cannot disagree about what a valid mint is.
                 checkBecomeInput(input, new Date().toISOString());
-                await this.validateScopeAccess(tenantId, scopeId);
+                await this.validateScopeAccess(tenantId, scopeId, 'mintCapability');
                 const rec = await this.capabilityScopeRecord(tenantId, scopeId);
                 // A hosted refusal precedes intent; the local migrate happens inside the audited write.
                 this.assertCapabilityScopeReach(rec, scopeId, 'mintCapability');
@@ -7062,7 +7065,9 @@ export class CloudflareScopeHost {
      * without the lifecycle half pays the one DO call the pair check needs. Null with a directory,
      * whose refusal already covered the lifecycle.
      */
-    async validateScopeAccess(tenantId, scopeId) {
+    async validateScopeAccess(tenantId, scopeId, 
+    /** The host method the call came through, named in `tenantUnrecordedRefusedLine` only. */
+    door) {
         const refusal = await this.cp.scopeAccessRefusal(tenantId, scopeId);
         if (refusal) {
             throw refusal.code
@@ -7072,14 +7077,15 @@ export class CloudflareScopeHost {
         if (!this.cpLess)
             return null;
         const { verdict, lifecycle } = await this.scopeStub(scopeId).admission(tenantId);
-        if (verdict === 'foreign')
-            throw unknownScopeForTenant(tenantId, scopeId);
-        // A scope with no tenant record and no role rows has nothing to hold the pair against, so it is
-        // let through — a compatibility state, not a steady one: the next reconcile (every push runs
-        // one against the scopes behind it, #1172) or lifecycle delivery records the directory's tenant.
-        // Logged on every admission, so an operator sees a scope that has not converged.
+        // #2035: a scope with no tenant record and no role rows has nothing to hold the pair against, so
+        // it is refused like a foreign one. The platform's paths record the tenant without passing this
+        // door — a provision or reconcile (every push runs one, #1172), a restore or snapshot, a
+        // lifecycle delivery to a scope holding data — so a scope converges rather than staying shut.
+        // The caller meets the foreign pair's refusal, word for word; only the log tells them apart.
         if (verdict === 'unknown')
-            console.warn(JSON.stringify(tenantUnrecordedLine(tenantId, scopeId)));
+            console.warn(JSON.stringify(tenantUnrecordedRefusedLine(tenantId, scopeId, door)));
+        if (verdict === 'foreign' || verdict === 'unknown')
+            throw unknownScopeForTenant(tenantId, scopeId);
         return lifecycle;
     }
     /**
@@ -7097,8 +7103,8 @@ export class CloudflareScopeHost {
      * The admin and diagnostic reads (dead letters, job runs, platform requests, delivered
      * grants) keep `validateScopeAccess` alone: an operator still reads a suspended scope.
      */
-    async assertLive(tenantId, scopeId) {
-        const refusal = lifecycleRefusal(await this.validateScopeAccess(tenantId, scopeId), { tenantId, scopeId });
+    async assertLive(tenantId, scopeId, door) {
+        const refusal = lifecycleRefusal(await this.validateScopeAccess(tenantId, scopeId, door), { tenantId, scopeId });
         if (refusal)
             throw substratError('conflict', refusal, { reason: SCOPE_GATE_REASONS.notActive });
     }
@@ -7364,7 +7370,7 @@ export class CloudflareScopeHost {
      * directory's view stays on `HostAdmin.listConnectionGrants`.
      */
     async connectionGrantsInScope(tenantId, scopeId) {
-        await this.validateScopeAccess(tenantId, scopeId);
+        await this.validateScopeAccess(tenantId, scopeId, 'connectionGrantsInScope');
         if (this.connectorDelegation) {
             if (!this.connectorDelegation.grants)
                 throw new Error('connector grant inspection is not configured for the serving deployment');
@@ -7377,10 +7383,11 @@ export class CloudflareScopeHost {
         // CP-less shape); a scope with a live control plane has its tenant-level grants in
         // the directory instead, where the checker reads them from (`cp.tenantTuples`). Read
         // only the DO and a tenant-wide grant would be reported absent on exactly the
-        // deployments that have a control plane — the fleet — while being enforced.
+        // deployments that have a control plane — the fleet — while being enforced. A CP-less
+        // host has no directory to ask, and its DO already holds the projection (#2892).
         const rows = [
             ...(await this.scopeStub(scopeId).listConnectionGrants(now)),
-            ...(await this.cp.dumpTenantTuples(tenantId))
+            ...(this.cpLess ? [] : await this.cp.dumpTenantTuples(tenantId))
                 .filter((r) => r.subject.startsWith('connection:') &&
                 r.relation.startsWith('granted:') &&
                 r.revoked_at === null &&
@@ -7858,7 +7865,7 @@ export class CloudflareScopeHost {
              * count to the directory — so a scope whose first contact after a deploy is a
              * subscription does not go dark in the migration fleet view.
              */
-            await this.assertLive(tenantId, scopeId);
+            await this.assertLive(tenantId, scopeId, 'subscribe');
             await this.migrateAndRecord(scopeId);
             // Asserted, not carried through from the client: the principal is the
             // vertical's own resolution of its session, and the tenant and scope are the
@@ -8403,17 +8410,25 @@ export class CloudflareScopeHost {
      * and a switched-off subject gets nothing. It can therefore only add what the running code
      * declares, and never takes anything away but a recorded OFF.
      *
-     * Only a scope already provisioned for `tenantId` is seated (`servesTenant`, K-3): this never
-     * provisions a scope, and never writes into another tenant's.
+     * Only a scope that serves `tenantId` is seated (K-3): this never provisions a scope, and never
+     * writes into another tenant's. Like a full reconcile, it records the platform's tenant on a scope
+     * that holds no receipt yet (`seatsTenant`, #2035), so a push converges an ownerless vertical's
+     * scopes too — every door refuses a scope whose tenant nothing recorded. The receipt lands in the
+     * seat's own unit, after the recorded-off positions: until then every door still refuses the
+     * scope, and a seat that fails records nothing.
      */
     async seatScopeLocal(input) {
         const stub = this.scopeStub(input.scopeId);
-        if (!(await stub.servesTenant(input.tenantId)))
+        if (!(await stub.seatsTenant(input.tenantId)))
             throw unknownScopeForTenant(input.tenantId, input.scopeId);
         const carry = recordedOffFromWire(input);
         const connections = await this.seatableConnectionGrants(input.tenantId, input.scopeId, input.connectionGrants); // #2430
         await this.migrateAndRecord(input.scopeId);
-        const switchedOff = await stub.seatTuples(this.declaredSeatsLocal(input.scopeId, connections.seat), carry ? { scopeId: input.scopeId, at: new Date().toISOString(), ...carry } : undefined);
+        const seated = await stub.seatTuplesFor(input.tenantId, this.declaredSeatsLocal(input.scopeId, connections.seat), carry ? { scopeId: input.scopeId, at: new Date().toISOString(), ...carry } : undefined);
+        // Reaped or recorded for another tenant since the check: K-3's refusal, naming no other tenant.
+        if ('refused' in seated)
+            throw unknownScopeForTenant(input.tenantId, input.scopeId);
+        const { switchedOff } = seated;
         return {
             ...(carry ? { switchedOff } : {}),
             ...(connections.skipped.length ? { skippedConnectionGrants: connections.skipped } : {}),
@@ -8601,7 +8616,7 @@ export class CloudflareScopeHost {
     // scope (#1713): a held scope's invoke and bytes doors refuse, as every other door does.
     /** Invoke ONE operation in this deployment as a CONNECTION (#574). */
     async connectorInvokeLocal(connectionId, tenantId, scopeId, operation, input) {
-        await this.assertLive(tenantId, scopeId); // #1713: a held scope runs no connector work either
+        await this.assertLive(tenantId, scopeId, 'connectorInvokeLocal'); // #1713: a held scope runs no connector work either
         await this.migrateAndRecord(scopeId);
         return this.buildStub(tenantId, scopeId, undefined, connectionId).invoke(operation, input);
     }
@@ -8609,7 +8624,7 @@ export class CloudflareScopeHost {
     async connectorAttachmentUploadLocal(connectionId, tenantId, scopeId, upload) {
         // The lifecycle gate every attachments door takes (#1713), ahead of the bucket: a held
         // scope's provider bytes wait for the delivery's retry rather than land (#1995).
-        await this.assertLive(tenantId, scopeId);
+        await this.assertLive(tenantId, scopeId, 'connectorAttachmentUploadLocal');
         await this.migrateAndRecord(scopeId);
         const store = await this.resolveAttachmentStore(tenantId);
         return this.buildAttachmentSurface({ connectionId }, tenantId, scopeId, store).upload(upload);
@@ -8634,7 +8649,7 @@ export class CloudflareScopeHost {
     /** The attachment surface the platform's reads as a connection go through, behind their gates. */
     async connectorReadSurface(connectionId, tenantId, scopeId, eventId) {
         // Same gate as the upload leg: a held scope's bytes are not read out of its bucket.
-        await this.assertLive(tenantId, scopeId);
+        await this.assertLive(tenantId, scopeId, 'connectorReadSurface');
         await this.migrateAndRecord(scopeId);
         const store = await this.resolveAttachmentStore(tenantId);
         return this.buildAttachmentSurface({ connectionId }, tenantId, scopeId, store, 
@@ -8808,7 +8823,7 @@ export class CloudflareScopeHost {
         const delegation = rec.vertical !== null ? this.importCursorDelegation : undefined;
         if (!delegation)
             this.assertServedHere(rec, scopeId, 'moveImportCursor');
-        await this.validateScopeAccess(tenantId, scopeId);
+        await this.validateScopeAccess(tenantId, scopeId, 'moveImportCursorAt');
         // #2114: the replay's id is also its audit `operationId`, so the scheduled settle pairs and
         // closes the lever's rows exactly as it does the kill switches'.
         const replayId = ulid();