@substrat-run/adapter-sqlite 0.159.0 → 0.160.0

package/dist/index.js

@@ -1,11 +1,13 @@
-import { existsSync, mkdirSync, readdirSync, readFileSync, realpathSync, rmSync, writeFileSync } from 'node:fs';
+import { createHash } from 'node:crypto';
+import { closeSync, existsSync, mkdirSync, openSync, readdirSync, readFileSync, realpathSync, rmSync, writeFileSync, writeSync } from 'node:fs';
 import { dirname, join } from 'node:path';
 import Database from 'better-sqlite3';
-import { accessLogEntry, adminLogEntry, delegatedReadParams, operationSeriesCount, opsFailureEntry, opsFailureFingerprint, issueEntry, FRESHNESS_HEARTBEAT_MINUTES, sweepRunEntry, modelUsageEntry, ATTACHMENT_ADDED, ATTACHMENT_REMOVED, attachmentRecord, createTenantInput, domainEvent, domainEventInput, exportReadInput, importBatch, importCursorMove, exportsOfManifestJson, assertNoBindingShapeBreak, importsOfManifestJson, connectionLandingsOfManifestJson, entitlementGrant, entitlementGrantInput, eventId, meterReading, platformRequestInput, platformRequestId, MAX_PENDING_PLATFORM_REQUESTS, identityLink, identityPool, instant, isSubstratError, connection, capabilityGrant, connectionGrant, connectionGrantRecord, connectionSecret, systemGrant, systemSwitch, systemSwitchRecord, peerSwitch, verticalCaller, verticalSlug as verticalSlugOf, subjectRef, requestFingerprint, createConnectionInput, connectLinkFilter, connectLinkKey, consumeConnectLinkInput, mintConnectLinkInput, projectedConnectionGrant, projectedConnectionKey, moduleManifest, createOrgInput, promotionAcknowledgement, bindAcknowledgement, bindHostnameInput, channelHistoryEntry, hostnameBinding, publishVersionInput, AUTO_ADMISSION_NOTE, routeTarget, ROUTE_SCOPE_HOSTNAMES_MAX, registerVerticalInput, vertical as verticalSchema, verticalChannel, verticalVersion, objectRef, entityObjectRef, assertModuleEmittableType, assertKernelAuthoredType, grantRefFromProof, org as orgSchema, orgMembership, principalId, resolvedIdentity, identityMembership, roleDefinition, scope as scopeSchema, tenant as tenantSchema, tenantRole, principalBecomeCapabilityInput, subjectShredReceipt, SCOPE_TABLE_PAGE_DEFAULT, SCOPE_TABLE_PAGE_MAX, SCOPE_QUERY_ROW_MAX, verticalServingState, callsOfManifestJson, outboundOfManifestJson, listLimitOf, pageOf, countedPageOf, SCOPE_GATE_REASONS, substratError, assertReplayableDump, delegatedReadRecord, ownerTransferAudit, memberChangeAudit, peerBindingAudit, connectionBindingAudit, copyMarkAudit, orphanSweepAudit, redrainEventsInput, REDRAIN_BATCH, errorCodeOf, } from '@substrat-run/contracts';
-import { actorOf, asPrincipal, assertAllowed, assertNoSecret, assertPermissionKey, CAPABILITY_DDL, UPLOAD_LINK_DDL, createAttachmentVerbs, inspectUploadLink, redeemUploadLinkInTransaction, redeemOrReplayUploadLink, COPY_ORIGIN_DDL, ENTITY_STATE_MOVES_DDL, CAPABILITY_EXCHANGE_OPERATION, CAPABILITY_BECOME_MINT_OPERATION, becomeMintCheck, mintBecomeCapabilityAsPrincipal, revokeBecomeCapabilityAsPrincipal, readBecomeLinkStates, ENTITY_UNBIND_OPERATION, allowedFor, unbindEntityHolderBounded, capabilityAttachmentWriteRefused, capabilityTokenHash, createCapabilityVerbs, createEntityEdgeVerbs, createEntityStateVerbs, createTrashedReads, CONTINUATION_POSITION_CAP, visibleContinuation, searchStateWhere, uncheckedView, addStatePlans, addUpdatedStampPlans, watchUpdatedStamps, entityStateMigrations, assertNoCallerPurge, isUnreachableParent, heldPurgePass, purgeDueOf, purgeHeldBy, lifecycleRefusal, purgeOnlyKeysOf, purgeReportOf, purgeStillDue, refuseTrashedTarget, assertBoundOperations, checkHeldOperationsOf, countChecks, noteUncheckedCompletion, registerTrashTargets, runPurgePass, withheldKeysFor, statefulTablesOf, afterMigration, afterRuntimeDdl, derivesAnything, repairDerivedObjects, StateColumnLost, exchangeCapability as exchangeCapabilitySecret, guardSecrets, mintBecomeCapability, plausibleSessionToken, readCapabilityPage, redactSecrets, redactSecretText, moduleLog, consoleLogSink, asyncInvocationId, asyncLinePass, consoleInvocationLineSink, resolveCapabilitySession, revokeCapabilityAsPlatform, assertReadOnlyQuery, attachmentBlobKey, attachmentSha256, entitlementDenial, requiredEntitlementFor, foldMeterReading, guardSpine, guardSqlLimits, DO_SQL_LIMITS, tooManyResultColumns, tooManyTableColumns, parseValidationRecords, resolveScopeRecord, ulid, ISSUE_RETENTION_DAYS, telemetryRetentionStatements, FINDINGS_DDL, SCOPE_STORAGE_DDL, forgetScopeStorage, listScopeStorageAttemptRows, listScopeStorageRows, listScopeStoreStorageRows, pruneScopeStorageRows, recordScopeStorageRows, CONNECT_LINKS_DDL, consumeConnectLinkRow, insertConnectLink, listConnectLinks as listConnectLinkRows, readConnectLink, restoreConnectLinkRow, revokeConnectLinkRow, createFindingRule, findingOfOpsFailure, findingOfSweepRun, pruneFindings, listFindingRules, listFindings, observeFinding, revokeFindingRule, setFindingStatus, assertRowLimit, assertRowOffset, OPS_FAILURE_RETENTION_DAYS, SWEEP_RUN_RETENTION_DAYS, SWEEP_RUNS_INTENT_INDEX, sweepRunsIntentHasKind, MODEL_USAGE_RETENTION_DAYS, foldModelUsage, backoffAt, platformRequestHistoryQuery, platformRequestOf, PLATFORM_REQUEST_COLUMNS, PLATFORM_REQUEST_REDACTION_SQL, platformRequestRedactionParams, platformRequestRedactionQuery, intentPayloadCarriesSubject, redactSubjectJobRuns, eraseSubjectFromModules, moduleRowsErased, moduleErasurePlan, redactSubjectScopeText, redactSubjectDirectoryText, ISSUE_EXEMPLAR_OWNER_BACKFILL_SQL, issueExemplarOwner, JOB_RUN_PATCH_SQL, JOB_RUN_CLAIM_SQL, JOB_RUN_RENEW_SQL, JOB_RUN_BEGIN_SQL, JOB_RUN_MISS_SQL, JOB_RUN_MISS_SETTLE_SQL, admissionMissOutcome, JOB_STEP_RECORD_SQL, JOB_LEASE_EXPIRED_NOTE, assertLeaseMs, DELIVERY_ERROR_REDACTION_SQL, REDACTED_DELIVERY_NOTE, seatScopeTuple, applyScopeRoleChange, changeScopeRole, revokeScopeRoles, scopeRoleHolders, assertModuleDeclared, noteReservedKeys, reservedGrantRefusal, reservedRoleRefusal, reservedShapeRefusal, admitPeer, boundToPeerDeclarations, peerCallerAt, collectPeers, peerSeats, resolveVerticalInstanceFrom, resolvePeerInstanceFrom, peerVerticalSpellings, samePeerVertical, peerGrantsStatus, systemGrantsStatus, systemScheduleState, systemSwitchedOff, systemSwitchedOffMessage, tenantSystemSwitchedOffMessage, PEER_SWITCHES_DDL, PEER_BINDINGS_DDL, SWITCH_OWED_DDL, SWITCH_FENCES_DDL, TABLE_OWNERS_DDL, assertMigrationLeavesLedgerAlone, recordOwnershipSteps, runMigrationStatements, executableSqlStatements, blankSqlComments, recordWriteSuperseded, switchFencesOf, switchSupersededMessage, SWITCH_KINDS, SYSTEM_SWITCHES_DDL, forgetSwitchesOf, listSystemSwitchRecords, moveSwitch, reassertActionOf, reassertEntry, reassertOffRow, recordSwitchedOff, recordSwitchedOn, restoreSwitchRecord, scopesSwitchedOffFor, switchActionOf, switchAuditSubject, recordAuditOutcome, auditedCapabilityRevoke, auditWarningOf, switchNotFoundMessage, switchRecordsOf, switchedOffOf, switchesBackfillSqlOf, switchesTableExists, tenantHeldOf, tenantHoldsGrant, inUnitMovesToAudit, staleCarryRevertRow, staleCarryReverts, withRecorded, VERSION_MIGRATIONS_DDL, VERTICAL_SCOPE_STORES_DDL, forgetVerticalScopeStores, indexVersionScopeStores, driverDeclarationsOf, verticalScopeStoresOf, STORE_DRIVER_RELEASES_DDL, legacyStoreDriverConflict, legacyStoreDriverRenames, beginStoreDriverRolloutIn, finishStoreDriverRolloutIn, holdStoreDriverIn, advanceStoreDriverRebuildIn, claimStoreDriverRebuildIn, storeDriverRebuildIn, recordStoreDriverReleaseIn, releaseStoreDriverHoldIn, storeDriverReleaseIn, storeDriverStateIn, storeDriverRolloutPendingIn, storeDriverRolloutWalkedIn, splitManifestMigrations, splitVersionMigrationsBatch, versionMigrationsOf, deriveVersionMigrationDigest, publishedMigrationDigest, migrationChangeRefusal, writeVersionMigrations, denialListQuery, refusalListQuery, mapRefusalRow, denialSummaryQuery, denialTotalsQuery, DENIAL_WINDOW_QUERY, mapDenialRow, mapDenialSummaryBuckets, IMPERSONATION_COLUMNS, IMPERSONATION_DDL, ImpersonationRefused, assertImpersonationWrites, assertModuleEnqueueableKind, assertSessionUsable, impersonationByIdQuery, impersonationListQuery, impersonationRowValues, impersonationStampOf, mapImpersonationRow, newImpersonationSession, resolveRetryPolicy, executorOutcomeOf, isDeliveryRefusal, refusalJournalText, membershipFencesBackfillSql, MEMBERSHIP_FENCES_DDL, membershipFencesTableExists, MEMBERSHIP_FENCE_SINCE_SQL, RAISE_MEMBERSHIP_FENCE_SQL, memberAddedAudit, orgChangeBound, tenantCoverage, isSecretBoxConfigured, unconfiguredSecretBox, createSubjectKeys, generateSealingKeyPair, noSealingKeyMessage, openSealed, sealTo, ConnectionSealingKeyUnavailableError, PermissionDenied, createAtomic, NotSearchable, NotListable, listIndexMigrations, listIndexPlans, listQuery, cursorOf, moduleMigrations, MIGRATION_DIGEST_FENCE_DDL, MIGRATION_DIGEST_MARK_LEGACY, assertJournalDumpCoherent, assertMigrationSql, migrationDivergence, migrationFailedError, migrationSetDivergence, migrationSteps, planMigrations, isSearchIndexTable, searchIndexMigrations, searchIndexPlans, searchLimit, searchMatchExpression, searchQuery, ATTACHMENT_TEXT_DDL, ATTACHMENT_CONDEMNED_DDL, ATTACHMENT_SWEEP_LICENCE_DDL, ATTACHMENT_SWEEP_LICENCE_TABLE, clearOrphanSweepLicence, condemnLicensedOrphanAttachments, consumeOrphanSweepLicence, licensedOrphanIds, recordOrphanSweepLicence, refuseUnlicensedOrphanSweep, fenceAttachmentSweep, refuseCondemnedAttachment, refuseCondemnedInDump, rowlessAttachmentIds, sweepOrphanAttachments, missingAttachmentStore, SETTLED_COPY_STATES, unsettledCopyRefusal, assertAttachmentExtractors, resolveAttachmentTextBounds, assertJobRegistrable, attachmentRecordOfRow, attachmentTextJob, enqueueAttachmentText, ATTACHMENT_TEXT_BACKFILL_JOB, ATTACHMENT_TEXT_JOB, kernelJobFor, queueAttachmentTextBackfill, startAttachmentTextBackfill, attachmentTextBackfillJob, reconcileAttachmentText, recordAttachmentText, searchAttachments, entityVersionQuery, entityVersionOf, assertIfMatch, OUTBOX_ENTITY_INDEX, SCHEDULE_STATE_DDL, SCHEDULE_STATE_REBUILD, scheduleStateHasKind, VERTICAL_EVENTS_DDL, EXPORT_HOPS_SQL, emptyImportResult, IMPORT_CURSORS_SQL, IMPORT_CURSOR_OF_SQL, OUTBOX_MARK_SQL, emittedSinceQuery, emittedReportOf, EMITTED_REPORT_CAP, exportedSinceQuery, IMPORT_CURSOR_ADVANCE_SQL, IMPORT_RECORD_SQL, moveImportCursor, importCursorSourceOf, exportBreaksOf, exportBreakRefusal, assertPromoteReviewCurrent, promoteRaceRefusal, rebindRaceRefusal, SERVES_NOW_CONDITION, SERVES_NOW_PREDICATE, servesNowParams, bindExportBreaksOf, bindExportBreakRefusal, scopeMoveOf, runningVersionOf, isPrimaryScope, PROVISIONED_VERSIONS_SQL, installsReconciledOf, strandJudgmentsOf, provisionedVersionsParams, boundShapesColumn, boundShapesOfColumn, installReconciled, CrossVerticalRegistry, exportReadPlan, exportReadQuery, planExportBatch, withheldNote, JOB_RUN_DDL, JOB_RUN_DUE_AT, jobRunListLimit, jobRunOf, runDueJobRuns, startJobRun, IDEMPOTENCY_DDL, REFUSALS_TABLE_DDL, REFUSALS_INDEX, refusalInsert, refusalOf, markGuardRefusal, REFUSALS_REBUILD, refusalsAdmitGuards, assertIdempotencyKey, idempotencyLookupQuery, idempotencyPruneStatement, idempotencyRecordStatement, idempotencyOptedOutMessage, replayFor, globalFetch, createUlid, facetEvents, readHistory, walkEventCause, walkEventEffects, assertRedrainWindow, readInvocation, readDeadLetters, readLifecycleFlow, readOperationSeries, domainEventOf, readUndrainedOutbox, undrainedEventsOf, connectorCallRecord, noopConnectorCallRecorder, recordConnectorCall, settleConnectionUse, unknownRoleError, callReservedStoreOperation, callScopeStore, observeStoreCall, replayStoreErasures, scopeStoreLifecycleOf, scopeStoreRunnersOf, } from '@substrat-run/kernel';
+import { accessLogEntry, adminLogEntry, delegatedReadParams, operationSeriesCount, opsFailureEntry, opsFailureFingerprint, issueEntry, FRESHNESS_HEARTBEAT_MINUTES, sweepRunEntry, modelUsageEntry, ATTACHMENT_ADDED, ATTACHMENT_REMOVED, createTenantInput, domainEvent, domainEventInput, exportReadInput, importBatch, importCursorMove, exportsOfManifestJson, assertNoBindingShapeBreak, importsOfManifestJson, connectionLandingsOfManifestJson, entitlementGrant, entitlementGrantInput, eventId, meterReading, platformRequestInput, platformRequestId, identityLink, identityPool, instant, isSubstratError, connection, capabilityGrant, connectionGrant, connectionGrantRecord, connectionSecret, systemGrant, systemSwitch, systemSwitchRecord, peerSwitch, verticalCaller, verticalSlug as verticalSlugOf, subjectRef, requestFingerprint, createConnectionInput, connectLinkFilter, connectLinkKey, consumeConnectLinkInput, mintConnectLinkInput, projectedConnectionGrant, projectedConnectionKey, moduleManifest, createOrgInput, promotionAcknowledgement, bindAcknowledgement, bindHostnameInput, channelHistoryEntry, hostnameBinding, publishVersionInput, AUTO_ADMISSION_NOTE, routeTarget, ROUTE_SCOPE_HOSTNAMES_MAX, registerVerticalInput, vertical as verticalSchema, verticalChannel, verticalVersion, objectRef, entityObjectRef, assertModuleEmittableType, assertKernelAuthoredType, grantRefFromProof, org as orgSchema, orgMembership, principalId, resolvedIdentity, identityMembership, roleDefinition, scope as scopeSchema, tenant as tenantSchema, tenantRole, principalBecomeCapabilityInput, subjectShredReceipt, SCOPE_TABLE_PAGE_DEFAULT, SCOPE_TABLE_PAGE_MAX, SCOPE_QUERY_ROW_MAX, verticalServingState, deploymentWireAuth, callsOfManifestJson, outboundOfManifestJson, listLimitOf, pageOf, countedPageOf, SCOPE_GATE_REASONS, substratError, assertReplayableDump, delegatedReadRecord, ownerTransferAudit, memberChangeAudit, peerBindingAudit, connectionBindingAudit, copyMarkAudit, orphanSweepAudit, redrainEventsInput, REDRAIN_BATCH, errorCodeOf, } from '@substrat-run/contracts';
+import { actorOf, asPrincipal, assertAllowed, assertNoSecret, assertPermissionKey, CAPABILITY_DDL, UPLOAD_LINK_DDL, createAttachmentVerbs, inspectUploadLink, redeemUploadLinkInTransaction, redeemOrReplayUploadLink, COPY_ORIGIN_DDL, ENTITY_STATE_MOVES_DDL, CAPABILITY_EXCHANGE_OPERATION, CAPABILITY_BECOME_MINT_OPERATION, becomeMintCheck, mintBecomeCapabilityAsPrincipal, revokeBecomeCapabilityAsPrincipal, readBecomeLinkStates, ENTITY_UNBIND_OPERATION, allowedFor, unbindEntityHolderBounded, capabilityAttachmentWriteRefused, capabilityTokenHash, createCapabilityVerbs, createEntityEdgeVerbs, createEntityStateVerbs, createTrashedReads, CONTINUATION_POSITION_CAP, visibleContinuation, searchStateWhere, uncheckedView, addStatePlans, addUpdatedStampPlans, watchUpdatedStamps, entityStateMigrations, assertNoCallerPurge, assertPlatformRequestRoom, isUnreachableParent, heldPurgePass, purgeDueOf, purgeHeldBy, lifecycleRefusal, scopeNotHeldRefusal, purgeOnlyKeysOf, purgeReportOf, purgeStillDue, refuseTrashedTarget, assertBoundOperations, checkHeldOperationsOf, countChecks, noteUncheckedCompletion, registerTrashTargets, runPurgePass, withheldKeysFor, statefulTablesOf, afterMigration, afterRuntimeDdl, derivesAnything, repairDerivedObjects, StateColumnLost, exchangeCapability as exchangeCapabilitySecret, guardSecrets, mintBecomeCapability, plausibleSessionToken, readCapabilityPage, redactSecrets, redactSecretText, moduleLog, consoleLogSink, asyncInvocationId, asyncLinePass, consoleInvocationLineSink, resolveCapabilitySession, revokeCapabilityAsPlatform, assertReadOnlyQuery, attachmentBlobKey, attachmentSha256, isSizedByteStream, knownLengthStream, putAttachmentBytes, entitlementDenial, requiredEntitlementFor, foldMeterReading, guardSpine, guardSqlLimits, DO_SQL_LIMITS, tooManyResultColumns, tooManyTableColumns, parseValidationRecords, readableScopes, resolveScopeRecord, ulid, ISSUE_RETENTION_DAYS, telemetryRetentionStatements, FINDINGS_DDL, ATTACHMENT_BYTES_SQL, SCOPE_STORAGE_DDL, forgetScopeStorage, listScopeAttachmentStorageRows, retireScopeStorage, listScopeStorageAttemptRows, listScopeStorageRows, listScopeStoreStorageRows, pruneScopeStorageRows, recordScopeStorageRows, REQUEST_ROLLUP_DDL, listRequestDayRows, listRequestRollupDayRows, pruneRequestDayRows, recordRequestDayRows, METER_DAYS_DDL, VERTICAL_OWNERS_BACKFILL, VERTICAL_OWNERS_DDL, closeVerticalOwnerRow, listVerticalOwnerRows, openVerticalOwnerRow, verticalOwnerNow, listMeterDayRows, listMeterDayTakeRows, pruneMeterDayRows, recordMeterDayRows, CONNECT_LINKS_DDL, consumeConnectLinkRow, insertConnectLink, listConnectLinks as listConnectLinkRows, readConnectLink, restoreConnectLinkRow, revokeConnectLinkRow, createFindingRule, findingOfOpsFailure, findingOfSweepRun, pruneFindings, listFindingRules, listFindings, observeFinding, revokeFindingRule, setFindingStatus, assertRowLimit, assertRowOffset, OPS_FAILURE_RETENTION_DAYS, SWEEP_RUN_RETENTION_DAYS, SWEEP_RUNS_INTENT_INDEX, sweepRunsIntentHasKind, MODEL_USAGE_RETENTION_DAYS, foldModelUsage, backoffAt, platformRequestHistoryQuery, platformRequestOf, PLATFORM_REQUEST_COLUMNS, PLATFORM_REQUEST_REDACTION_SQL, platformRequestRedactionParams, platformRequestRedactionQuery, intentPayloadCarriesSubject, redactSubjectJobRuns, eraseSubjectFromModules, moduleRowsErased, moduleErasurePlan, redactSubjectScopeText, redactSubjectDirectoryText, ISSUE_EXEMPLAR_OWNER_BACKFILL_SQL, issueExemplarOwner, JOB_RUN_PATCH_SQL, JOB_RUN_CLAIM_SQL, JOB_RUN_RENEW_SQL, JOB_RUN_BEGIN_SQL, JOB_RUN_MISS_SQL, JOB_RUN_MISS_SETTLE_SQL, admissionMissOutcome, JOB_STEP_RECORD_SQL, JOB_LEASE_EXPIRED_NOTE, assertLeaseMs, DELIVERY_ERROR_REDACTION_SQL, REDACTED_DELIVERY_NOTE, seatScopeTuple, applyScopeRoleChange, changeScopeRole, revokeScopeRoles, scopeRoleHolders, assertModuleDeclared, noteDeclaredKeys, noteReservedKeys, reservedGrantRefusal, reservedRoleDefinitionRefusal, reservedRoleRefusal, reservedShapeRefusal, SCOPE_SEATED_ROLES_SQL, SEAT_HOLDING_SCOPE_STATUSES, TENANT_SEATED_ROLES_SQL, admitPeer, boundToPeerDeclarations, peerCallerAt, collectPeers, peerSeats, resolveVerticalInstanceFrom, resolvePeerInstanceFrom, peerVerticalSpellings, samePeerVertical, peerGrantsStatus, systemGrantsStatus, systemScheduleState, systemSwitchedOff, systemSwitchedOffMessage, tenantSystemSwitchedOffMessage, PEER_SWITCHES_DDL, PEER_BINDINGS_DDL, SWITCH_OWED_DDL, SWITCH_FENCES_DDL, TABLE_OWNERS_DDL, assertMigrationLeavesLedgerAlone, recordOwnershipSteps, runMigrationStatements, executableSqlStatements, blankSqlComments, recordWriteSuperseded, switchFencesOf, switchSupersededMessage, SWITCH_KINDS, SYSTEM_SWITCHES_DDL, forgetSwitchesOf, listSystemSwitchRecords, moveSwitch, reassertActionOf, reassertEntry, reassertOffRow, recordSwitchedOff, recordSwitchedOn, restoreSwitchRecord, scopesSwitchedOffFor, switchActionOf, switchAuditSubject, recordAuditOutcome, auditedCapabilityRevoke, auditWarningOf, switchNotFoundMessage, switchRecordsOf, switchedOffOf, switchesBackfillSqlOf, switchesTableExists, tenantHeldOf, tenantHoldsGrant, inUnitMovesToAudit, staleCarryRevertRow, staleCarryReverts, withRecorded, VERSION_MIGRATIONS_DDL, VERTICAL_SCOPE_STORES_DDL, forgetVerticalScopeStores, DEPLOYMENT_WIRE_AUTH_DDL, assertWireAuthFilter, deploymentWireAuthOf, forgetVerticalWireAuth, wireAuthAccessTarget, writeDeploymentWireAuth, indexVersionScopeStores, driverDeclarationsOf, verticalScopeStoresOf, STORE_DRIVER_RELEASES_DDL, legacyStoreDriverConflict, legacyStoreDriverRenames, beginStoreDriverRolloutIn, finishStoreDriverRolloutIn, holdStoreDriverIn, advanceStoreDriverRebuildIn, claimStoreDriverRebuildIn, storeDriverRebuildIn, recordStoreDriverReleaseIn, releaseStoreDriverHoldIn, storeDriverReleaseIn, storeDriverStateIn, storeDriverRolloutPendingIn, storeDriverRolloutWalkedIn, splitManifestMigrations, splitVersionMigrationsBatch, versionMigrationsOf, deriveVersionMigrationDigest, publishedMigrationDigest, migrationChangeRefusal, writeVersionMigrations, denialListQuery, refusalListQuery, mapRefusalRow, denialSummaryQuery, denialTotalsQuery, DENIAL_WINDOW_QUERY, mapDenialRow, mapDenialSummaryBuckets, IMPERSONATION_COLUMNS, IMPERSONATION_DDL, ImpersonationRefused, assertImpersonationWrites, assertModuleEnqueueableKind, assertSessionUsable, impersonationByIdQuery, impersonationListQuery, impersonationRowValues, impersonationStampOf, mapImpersonationRow, newImpersonationSession, resolveRetryPolicy, executorOutcomeOf, isDeliveryRefusal, refusalJournalText, membershipFencesBackfillSql, MEMBERSHIP_FENCES_DDL, membershipFencesTableExists, MEMBERSHIP_FENCE_SINCE_SQL, RAISE_MEMBERSHIP_FENCE_SQL, memberAddedAudit, orgChangeBound, tenantCoverage, isSecretBoxConfigured, unconfiguredSecretBox, createSubjectKeys, generateSealingKeyPair, noSealingKeyMessage, openSealed, sealTo, ConnectionSealingKeyUnavailableError, PermissionDenied, createAtomic, NotSearchable, NotListable, listIndexMigrations, listIndexPlans, listQuery, cursorOf, moduleMigrations, MIGRATION_DIGEST_FENCE_DDL, MIGRATION_DIGEST_MARK_LEGACY, assertJournalDumpCoherent, assertMigrationSql, migrationDivergence, migrationFailedError, migrationSetDivergence, migrationSteps, planMigrations, isSearchIndexTable, searchIndexMigrations, searchIndexPlans, searchLimit, searchMatchExpression, searchQuery, ATTACHMENT_TEXT_DDL, ATTACHMENT_CONDEMNED_DDL, ATTACHMENT_SWEEP_LICENCE_DDL, ATTACHMENT_SWEEP_LICENCE_TABLE, clearOrphanSweepLicence, condemnLicensedOrphanAttachments, consumeOrphanSweepLicence, licensedOrphanIds, recordOrphanSweepLicence, refuseUnlicensedOrphanSweep, fenceAttachmentSweep, refuseCondemnedAttachment, refuseCondemnedInDump, rowlessAttachmentIds, sweepOrphanAttachments, missingAttachmentStore, SETTLED_COPY_STATES, unsettledCopyRefusal, assertAttachmentExtractors, resolveAttachmentTextBounds, assertJobRegistrable, attachmentRecordOfRow, attachmentTextJob, enqueueAttachmentText, ATTACHMENT_TEXT_BACKFILL_JOB, ATTACHMENT_TEXT_JOB, kernelJobFor, queueAttachmentTextBackfill, startAttachmentTextBackfill, attachmentTextBackfillJob, reconcileAttachmentText, recordAttachmentText, searchAttachments, entityVersionQuery, entityVersionOf, assertIfMatch, OUTBOX_ENTITY_INDEX, SCHEDULE_STATE_DDL, SCHEDULE_STATE_REBUILD, scheduleStateHasKind, VERTICAL_EVENTS_DDL, EXPORT_HOPS_SQL, emptyImportResult, IMPORT_CURSORS_SQL, IMPORT_CURSOR_OF_SQL, OUTBOX_MARK_SQL, emittedSinceQuery, emittedReportOf, EMITTED_REPORT_CAP, exportedSinceQuery, IMPORT_CURSOR_ADVANCE_SQL, IMPORT_RECORD_SQL, moveImportCursor, importCursorSourceOf, exportBreaksOf, exportBreakRefusal, assertPromoteReviewCurrent, promoteRaceRefusal, rebindRaceRefusal, SERVES_NOW_CONDITION, SERVES_NOW_PREDICATE, servesNowParams, bindExportBreaksOf, bindExportBreakRefusal, scopeMoveOf, runningVersionOf, isPrimaryScope, PROVISIONED_VERSIONS_SQL, installsReconciledOf, strandJudgmentsOf, provisionedVersionsParams, boundShapesColumn, boundShapesOfColumn, installReconciled, CrossVerticalRegistry, exportReadPlan, exportReadQuery, planExportBatch, withheldNote, JOB_RUN_DDL, JOB_RUN_DUE_AT, jobRunListLimit, jobRunOf, runDueJobRuns, startJobRun, IDEMPOTENCY_DDL, REFUSALS_TABLE_DDL, REFUSALS_INDEX, refusalInsert, refusalOf, markGuardRefusal, REFUSALS_REBUILD, refusalsAdmitGuards, assertIdempotencyKey, idempotencyLookupQuery, idempotencyPruneStatement, idempotencyRecordStatement, idempotencyOptedOutMessage, replayFor, globalFetch, fetchLikeOf, deadlineFetch, createUlid, facetEvents, readHistory, walkEventCause, walkEventEffects, assertRedrainWindow, readInvocation, readDeadLetters, readLifecycleFlow, readOperationSeries, domainEventOf, readUndrainedOutbox, undrainedEventsOf, connectorCallRecord, noopConnectorCallRecorder, recordConnectorCall, settleConnectionUse, unknownRoleError, callReservedStoreOperation, callScopeStore, observeStoreCall, replayStoreErasures, scopeStoreLifecycleOf, scopeStoreRunnersOf, } from '@substrat-run/kernel';
 import { attributedView, delegatedRevokeSql, writeExplicitTupleIn, grantEntityShapeIn, shapeTopUpBatch, topUpEntityGrantShapes, settlePlatformRequestIn, } from '@substrat-run/kernel';
 import { ADMIN_LOG_INDEXES_SQL, SETTLE_INTENT_SQL, SETTLE_OUTCOME_SQL, settleOutcomeParamsOf, readAuditedOperations, unknownOutcomeOf, } from '@substrat-run/kernel';
 import { INERT_SCOPE_REASON, isPrimaryScopeRow, normalizeUploadMediaType } from '@substrat-run/kernel';
+import { opsFailureReferenceWhere } from '@substrat-run/kernel';
 import { COPY_BACKFILL_SCOPE_SQL, COPY_BACKFILL_SQL, COPY_BACKFILL_SUPERSEDE_SQL, COPY_CLAIM_SQL, COPY_EXPIRED_SQL, COPY_MOVE_RENEW_SQL, copyMoveRenewParams, PENDING_COPY_KEEP_ALIVE_SQL, pendingCopyKeepAliveParams, copyBackfillParams, copyBackfillRefusal, SUBJECT_ERASURE_CLAIM_SQL, subjectErasureClaimParams, COPY_MOVE_CONFIRM_SQL, COPY_MOVE_LIVE_PREDICATE, SCOPE_COPY_LEASE_MS, SCOPE_SCRIPT_COPY_COLUMNS, copyMoveConfirmParams, copyMoveLiveParams, scopeScriptCopyOf, } from '@substrat-run/kernel';
 import { GRANT_CHILDREN_INDEX_DDL, SHAPE_MARKER_INDEX_DDL, grantedEntitiesForContext } from '@substrat-run/kernel';
 import { LEGACY_SCOPE_ROWS_BACKFILL, assertSpineTablesBuilt, capabilitiesForLoad, dumpRowsInsert, isSpineTable, loadDirectoryDump, repointScopeGrants, settleCopiedWork, emittedHere, spineColumnAdditions } from '@substrat-run/kernel';
@@ -28,6 +30,45 @@ export function isStorageFault(err) {
  * this map — cannot write one. Registered as each context is built.
  */
 const kernelEmitters = new WeakMap();
+/**
+ * Node's running SHA-256 (#2498), for a streamed upload — the kernel's `putAttachmentBytes` takes
+ * it. `node:crypto` because Web Crypto has no running digest, and hashing the written file
+ * afterwards would read it whole into memory, which is what streaming is for.
+ */
+function nodeSha256() {
+    const hash = createHash('sha256');
+    return {
+        update: (chunk) => {
+            hash.update(chunk);
+        },
+        hex: async () => hash.digest('hex'),
+    };
+}
+/**
+ * Write a sized stream to `path` one chunk at a time (#2498), so the file is never held whole,
+ * held to its declared length as the store contract says: a stream that carries more or fewer
+ * bytes leaves no file.
+ */
+async function writeStreamToFile(path, body) {
+    const reader = knownLengthStream(body).getReader();
+    const fd = openSync(path, 'w');
+    try {
+        for (;;) {
+            const { done, value } = await reader.read();
+            if (done)
+                break;
+            if (value)
+                writeSync(fd, value);
+        }
+    }
+    catch (err) {
+        rmSync(path, { force: true });
+        throw err;
+    }
+    finally {
+        closeSync(fd);
+    }
+}
 function kernelEmit(ctx, event) {
     const write = kernelEmitters.get(ctx);
     if (!write)
@@ -508,6 +549,10 @@ const admitByDelivery = (rt, eventId, row) => {
  * it refuses another process.
  */
 const PROCESS_HOST_DIRS = new Map();
+/** A scope database's size in bytes: allocated pages, free ones included, which is what the file costs on disk (#1524). */
+const databaseBytesOf = (db) => db.pragma('page_count', { simple: true }) * db.pragma('page_size', { simple: true });
+/** What a scope database's attachment rows sum to (#2501). */
+const attachmentBytesOf = (db) => db.prepare(ATTACHMENT_BYTES_SQL).get().bytes;
 /**
  * #119: claim a host directory for this process, for one live `SqliteScopeHost`. The first host in
  * the process takes an exclusive lock on `_host.lock` (a SQLite file: `locking_mode = EXCLUSIVE`
@@ -631,6 +676,8 @@ export class SqliteScopeHost {
     modules = new Map();
     /** #2430: what a registered module declares `holder: 'system'` — the role doors' refusal reads it. */
     reservedKeys = new Set();
+    /** #2447: every key a registered or listed module declares, marked or not — a role definition reads it. */
+    declaredKeys = new Set();
     /** #2430: the declared permission surface `registerModule` holds each module to, when given. */
     permissions;
     /** #1705: what this deployment exports to other verticals and imports from them. */
@@ -722,6 +769,7 @@ export class SqliteScopeHost {
     wrapBlobStore;
     attachmentTextBounds;
     fetchImpl;
+    streamIdleMs;
     connectorCalls;
     clock;
     versionId;
@@ -741,15 +789,19 @@ export class SqliteScopeHost {
         this.attachmentExtractors = options.attachmentExtractors ?? [];
         this.wrapBlobStore = options.wrapBlobStore ?? ((store) => store);
         this.attachmentTextBounds = resolveAttachmentTextBounds(options.attachmentTextBounds);
-        this.fetchImpl = options.fetch ?? globalFetch;
+        // #2498: whatever fetch is injected, a sized stream body reaches it converted (`fetchLikeOf`).
+        this.fetchImpl = fetchLikeOf(options.fetch ?? globalFetch);
+        this.streamIdleMs = options.streamIdleTimeoutMs;
         this.connectorCalls = options.connectorCalls ?? noopConnectorCallRecorder;
         this.clock = options.clock ?? (() => instant.parse(new Date().toISOString()));
         this.versionId = options.versionId ?? null;
         this.migrationsDigest = options.migrationsDigest;
         this.permissions = options.permissions;
         // #2430: what the declared surface reserves holds here too, whatever is registered under its ids.
-        for (const m of options.permissions?.modules ?? [])
+        for (const m of options.permissions?.modules ?? []) {
             noteReservedKeys(this.reservedKeys, m.manifest);
+            noteDeclaredKeys(this.declaredKeys, m.manifest);
+        }
         this.scopeStoreVertical = options.scopeStores?.vertical;
         this.scopeStoreRunners = scopeStoreRunnersOf(options.scopeStores);
         this.scopeStoreLifecycle = scopeStoreLifecycleOf(this.scopeStoreRunners);
@@ -1047,6 +1099,7 @@ export class SqliteScopeHost {
       );
       ${VERSION_MIGRATIONS_DDL}
       ${VERTICAL_SCOPE_STORES_DDL}
+      ${DEPLOYMENT_WIRE_AUTH_DDL}
       -- Channels (#31 step 2): a named pointer per vertical. Promotion moves it,
       -- and promotion is where the migration and permission diffs fire — the
       -- moment a change reaches anyone, rather than the moment it was typed.
@@ -1437,6 +1490,12 @@ export class SqliteScopeHost {
       CREATE INDEX IF NOT EXISTS _substrat_model_usage_at ON _substrat_model_usage (at);
       -- #1524: the stored storage gauge — one row per (scope, UTC day), kernel-owned DDL.
       ${SCOPE_STORAGE_DDL}
+      -- #2501: the daily request rollup — one row per (UTC day, tenant, vertical, scope), kernel-owned DDL.
+      ${REQUEST_ROLLUP_DDL}
+      -- #2501: the daily meter snapshot — one row per (UTC day, tenant), kernel-owned DDL.
+      ${METER_DAYS_DDL}
+      -- #2501: who owned each vertical slug, period by period — kernel-owned DDL.
+      ${VERTICAL_OWNERS_DDL}
       CREATE INDEX IF NOT EXISTS scopes_tenant ON scopes (tenant_id, scope_id);
     `);
         this.ensureDirectoryColumns();
@@ -1558,7 +1617,8 @@ export class SqliteScopeHost {
             .prepare('SELECT vertical FROM scopes WHERE scope_id = ?')
             .get(rt.scopeId)?.vertical ?? null;
         const admin = this.admin;
-        const fetchImpl = this.fetchImpl;
+        // #2518: the call under `timeoutMs`, a streamed body under the idle window instead.
+        const fetchImpl = deadlineFetch(this.fetchImpl, timeoutMs, { idleMs: this.streamIdleMs });
         return {
             admin,
             tenantId: rt.tenantId,
@@ -1611,10 +1671,7 @@ export class SqliteScopeHost {
                         // records beside the health line carries a duration.
                         const started = Date.now();
                         try {
-                            const res = await fetchImpl(input, {
-                                ...init,
-                                signal: AbortSignal.timeout(timeoutMs),
-                            });
+                            const res = await fetchImpl(input, init);
                             // A 5xx is the provider failing; a 4xx is usually us. Both are
                             // worth recording, because "the connection stopped working" is the
                             // question a health view answers.
@@ -1744,6 +1801,7 @@ export class SqliteScopeHost {
             purgeOnlyKeys: purgeOnlyKeysOf(manifest.schedules ?? []),
         });
         noteReservedKeys(this.reservedKeys, manifest);
+        noteDeclaredKeys(this.declaredKeys, manifest);
         if (erasure)
             this.erasurePlans.push(erasure);
         for (const rel of manifest.entityRelations ?? []) {
@@ -2130,7 +2188,10 @@ export class SqliteScopeHost {
             put: async (key, body, opts) => {
                 const p = resolveKey(key);
                 mkdirSync(dirname(p), { recursive: true });
-                writeFileSync(p, body);
+                if (isSizedByteStream(body))
+                    await writeStreamToFile(p, body);
+                else
+                    writeFileSync(p, body);
                 writeFileSync(`${p}.meta`, JSON.stringify({ contentType: opts?.contentType ?? null }));
             },
             get: async (key) => {
@@ -2416,24 +2477,33 @@ export class SqliteScopeHost {
                     });
                 }
                 const gate = targetGate(input.entity.entityType);
+                // A streamed body is the case where bytes are the cost, so the write gate is asked before
+                // the first one is read (#2516). The row's own check below stays: this one is only early.
+                if (isSizedByteStream(input.body)) {
+                    // A read that writes nothing: one actor turn, no transaction and no drain (the denial is
+                    // still recorded). Already inside the turn on a reentrant surface, which must not queue again.
+                    const askGate = () => reentrant('attachments.upload', async (ctx) => {
+                        assertAllowed(await ctx.check(gate.write, input.entity));
+                    });
+                    await (opts.reentrant ? askGate() : rt.actor.enqueue(askGate));
+                }
                 const creator = authority;
                 const id = ulid();
                 const key = attachmentBlobKey(rt.scopeId, id);
-                const record = attachmentRecord.parse({
+                const fields = {
                     id,
                     entity: input.entity,
                     filename: input.filename,
                     contentType: input.contentType,
-                    size: input.body.byteLength,
-                    sha256: await attachmentSha256(input.body),
                     visibility: input.visibility,
                     createdBy: creator.id,
                     createdAt: new Date().toISOString(),
-                });
+                };
                 // Bytes first, row second: a crash between the two leaves an orphaned object that no
                 // row points at (#2314). A refused check compensates the object away below; a drain
                 // fault after the commit is not a refusal (`serialized` keeps it from becoming one).
-                await store.put(key, input.body, { contentType: input.contentType });
+                // A streamed body is hashed and counted as it is written (#2498).
+                const record = await putAttachmentBytes(store, key, fields, input.body, nodeSha256);
                 try {
                     return await guarded('attachments.upload', async (ctx) => {
                         assertAllowed(await ctx.check(gate.write, input.entity));
@@ -2760,6 +2830,7 @@ export class SqliteScopeHost {
             scopeId: snapshotId,
             kind: opts?.kind ?? 'archive',
             vertical: source.vertical,
+            verticalSource: 'copy',
             jurisdiction: source.jurisdiction,
             expiresAt: opts?.expiresAt,
             // forkedFrom/forkedAt are stamped from the dump by importScope.
@@ -3785,6 +3856,92 @@ export class SqliteScopeHost {
         if (refusal)
             throw substratError('forbidden', refusal);
     }
+    /**
+     * #2447: refuse defining `role` for `tenantId` (`reservedRoleDefinitionRefusal`): against the keys
+     * the modules registered or listed here reserve and declare, and the tenant's other roles.
+     */
+    refuseReservedDefinition(tenantId, role) {
+        const prefix = `${tenantId}/`;
+        const tenantRoles = [...this.roles].filter(([k]) => k.startsWith(prefix)).map(([, r]) => r);
+        const stored = this.roles.get(`${tenantId}/${role.key}`);
+        // The seats are read only for the one case they decide: a system-held definition of a key with no
+        // system-held definition stored (none at all included: a seat can outlive its role's row).
+        const seated = stored?.holder !== 'system' && role.holder === 'system' && this.roleSeated(tenantId, role.key);
+        const refusal = reservedRoleDefinitionRefusal(role, { reserved: this.reservedKeys, declared: this.declaredKeys }, tenantRoles, seated);
+        if (refusal)
+            throw substratError('forbidden', refusal);
+    }
+    /**
+     * #2447: does anyone but a system principal hold a live seat in `roleKey` in this tenant — a
+     * tenant-level assignment, or a scope-level one in any of its scopes not reaped
+     * (`SEAT_HOLDING_SCOPE_STATUSES`: an archived scope's seats come back on unarchive, one archived
+     * straight from provisioning included)? A scope with no store on disk holds none and is not opened.
+     */
+    roleSeated(tenantId, roleKey) {
+        const now = this.clock();
+        const holds = (rows) => rows.some((r) => r.role_key === roleKey);
+        if (holds(this.directory.prepare(TENANT_SEATED_ROLES_SQL).all(tenantId, now)))
+            return true;
+        const scopes = this.directory
+            .prepare(`SELECT scope_id FROM scopes WHERE tenant_id = ? AND status IN (${SEAT_HOLDING_SCOPE_STATUSES.map(() => '?').join(', ')})`)
+            .all(tenantId, ...SEAT_HOLDING_SCOPE_STATUSES);
+        return scopes.some((s) => {
+            // Read without creating storage: a scope whose store is neither open nor on disk never held a
+            // seat (a scope archived straight from provisioning may be one), and opening it would create it.
+            const id = s.scope_id;
+            if (!this.scopes.has(`${tenantId}/${id}`) && !existsSync(join(this.dir, `${tenantId}__${id}.sqlite`)))
+                return false;
+            return holds(this.runtime(tenantId, id).db.prepare(SCOPE_SEATED_ROLES_SQL).all(now));
+        });
+    }
+    /**
+     * #2446: the roles this host stores for `tenantId` and the role keys anyone but a system principal
+     * holds a live seat in at `scopeId` (`SCOPE_SEATED_ROLES_SQL`): the Cloudflare host's
+     * `roleStateLocal`, the state a CP-less reconcile judges a role set against and a promote judges the
+     * incoming version's set with. It is deliberately narrower than this host's own `defineRole`
+     * judgement (`roleSeated`), which also counts tenant-level seats and every other scope's: a
+     * reconcile defines a scope's role set and reads that scope's seats only, and this answers what it
+     * reads (`roleStateContractSuite` pins the two adapters to the same answer, a tenant-level seat
+     * and another scope's seat excluded). Read-only: a scope with no store on disk holds no seat and is
+     * not opened, so the read creates nothing.
+     */
+    async roleStateLocal(tenantId, scopeId) {
+        const prefix = `${tenantId}/`;
+        const roles = [...this.roles]
+            .filter(([k]) => k.startsWith(prefix))
+            .map(([, r]) => ({ key: r.key, permissions: [...r.permissions], ...(r.holder ? { holder: r.holder } : {}) }));
+        const stored = this.scopes.has(`${tenantId}/${scopeId}`) || existsSync(join(this.dir, `${tenantId}__${scopeId}.sqlite`));
+        const seated = stored
+            ? [...new Set(this.runtime(tenantId, scopeId).db.prepare(SCOPE_SEATED_ROLES_SQL).all(this.clock()).map((r) => r.role_key))]
+            : [];
+        return { roles, seated };
+    }
+    /**
+     * The scope database's size in bytes, asked by scope id alone (#2541): the Cloudflare host's
+     * `databaseSizeLocal`, which a vertical's `/internal/database-size` calls. Counts as
+     * `scopeDatabaseSize` does. A scope this host does not hold is refused before any store is opened.
+     */
+    async databaseSizeLocal(scopeId) {
+        return databaseBytesOf(this.heldReadDb(scopeId));
+    }
+    /** What the scope's attachment rows sum to (#2501), asked by scope id alone: refused as the size is (#2541). */
+    async attachmentSizeLocal(scopeId) {
+        return attachmentBytesOf(this.heldReadDb(scopeId));
+    }
+    /**
+     * The read connection of a scope this host holds, for a read that names only the scope id (#2541),
+     * with the directory read ONCE. Refused `conflict` before anything is opened: no row, a reaped one
+     * (a tombstone whose store is gone), or a scope with no store open or on disk (archived straight
+     * from provisioning, as the Cloudflare host's object holding nothing is), since `runtime()` would
+     * create the store those leave absent.
+     */
+    heldReadDb(scopeId) {
+        const row = this.directory.prepare('SELECT tenant_id, status FROM scopes WHERE scope_id = ?').get(scopeId);
+        const stored = row !== undefined && (this.scopes.has(`${row.tenant_id}/${scopeId}`) || existsSync(join(this.dir, `${row.tenant_id}__${scopeId}.sqlite`)));
+        if (!row || row.status === 'reaped' || !stored)
+            throw substratError('conflict', scopeNotHeldRefusal(scopeId));
+        return this.readDb(this.runtime(row.tenant_id, scopeId));
+    }
     /** #2430: refuse a raw grant of a key a module registered here reserves (`reservedGrantRefusal`). */
     refuseReservedGrant(permissions) {
         const refusal = reservedGrantRefusal(permissions, this.reservedKeys);
@@ -3921,7 +4078,9 @@ export class SqliteScopeHost {
         });
         return report;
     }
-    async runDueSchedules(moduleId, tenantId, scopeId) {
+    async runDueSchedules(moduleId, tenantId, scopeId, 
+    /** #2517: what the sweep tick's earlier calls did to this scope (`ScopeHost.runDueSchedules`). */
+    tick) {
         const report = { fired: 0, skipped: 0, failed: 0, errors: [], runs: [] };
         const mod = this.modules.get(moduleId);
         if (!mod || mod.schedules.length === 0)
@@ -3989,6 +4148,16 @@ export class SqliteScopeHost {
         // scope at once. `ScheduleRunReport.platformRequests` says what that does and does not count.
         let platformRequests = 0;
         const counted = { onPlatformRequests: (n) => (platformRequests += n) };
+        // #2517: the part of that the purge runs enqueued, which is what defers a later purge head the
+        // cap refuses (`runPurgePass`): this call's, on top of what the tick's earlier calls report.
+        const earlierPurgeRequests = tick?.earlierPurgeRequests ?? 0;
+        let purgeRequests = 0;
+        const purgeCounted = {
+            onPlatformRequests: (n) => {
+                platformRequests += n;
+                purgeRequests += n;
+            },
+        };
         for (const schedule of mod.schedules) {
             const lastRunAt = gate.lastRuns.get(schedule.operation) ?? null;
             const lastRun = lastRunAt ? Date.parse(lastRunAt) : null;
@@ -4016,7 +4185,16 @@ export class SqliteScopeHost {
                     // #119: a purge horizon's schedule runs its operation once per due entity, never once.
                     // #2192: under the run's own id, so the purges and their deliveries join this run's line.
                     // #2431: each purge is an invoke, and reports what it enqueued through `counted` like any other.
-                    const pass = await this.runPurgeSweep(moduleId, tenantId, scopeId, schedule.operation, invocationId, counted);
+                    // #2517: what the purge runs before this one in the tick enqueued, so a head the cap refuses
+                    // because they filled the queue is deferred to the next tick rather than failed.
+                    const pass = await this.runPurgeSweep(moduleId, tenantId, scopeId, schedule.operation, invocationId, purgeCounted, earlierPurgeRequests + purgeRequests);
+                    if (pass.deferred) {
+                        // Ran nothing: no line, no cadence row, `skipped` like any run that did not happen.
+                        report.skipped += 1;
+                        report.deferred = (report.deferred ?? 0) + 1;
+                        report.runs.push({ operation: schedule.operation, outcome: 'skipped' });
+                        continue;
+                    }
                     stillDue = purgeStillDue(pass);
                     const outcome = purgeReportOf(schedule.operation, schedule.purge.entityType, pass);
                     report.errors.push(...outcome.errors);
@@ -4079,6 +4257,8 @@ export class SqliteScopeHost {
         lines.end();
         if (platformRequests > 0)
             report.platformRequests = platformRequests;
+        if (purgeRequests > 0)
+            report.purgeRequests = purgeRequests;
         return report;
     }
     /**
@@ -4093,7 +4273,9 @@ export class SqliteScopeHost {
     /** #2192: the schedule run this pass belongs to; every purge in it runs under that id. */
     runInvocationId, 
     /** #2431: how each purge reports the platform requests it enqueued. */
-    counted) {
+    counted, 
+    /** #2517: platform requests the purge runs earlier in this tick enqueued. */
+    earlierPurgeRequests = 0) {
         const entityType = this.modules
             .get(moduleId)
             ?.schedules.find((s) => s.operation === operation && s.purge)?.purge?.entityType;
@@ -4121,7 +4303,7 @@ export class SqliteScopeHost {
         const stub = await this.openSystemScope(moduleId, tenantId, scopeId, true, counted);
         return runPurgePass(operation, due, async (entityId) => {
             await stub.invoke(operation, { [due.idFrom]: entityId }, { invocationId: runInvocationId });
-        }, (write) => rt.actor.turn(() => write(spineSql(rt.db))));
+        }, (write) => rt.actor.turn(() => write(spineSql(rt.db))), earlierPurgeRequests);
     }
     /**
      * #119: the purge gate's facts (`PurgeGateFacts`) — the module's switch from the scope's own
@@ -5600,15 +5782,20 @@ export class SqliteScopeHost {
         // #1748: the evidence, its issue and its finding in ONE transaction — a detector that
         // throws takes the evidence with it, so the caller's retry observes it rather than finding
         // the row already there and the observation lost.
+        // #2540: a tenant's row with a `detail` is a pair — the tenant's row says what was answered, and
+        // a row with no tenant, which only staff read, carries the failure's own text. Counted once.
+        const detail = entry.tenantId && typeof entry.detail === 'string' ? entry.detail : null;
         this.directory.transaction(() => {
-            this.directory
-                .prepare(`INSERT INTO _substrat_ops_failures
-             (id, actor, operation, stage, tenant_id, scope_id, vertical, version, status, message, reference, origin, code, fingerprint, at)
-           VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`)
-                .run(ulid(), entry.actor, entry.operation, entry.stage ?? null, entry.tenantId ?? null, entry.scopeId ?? null, entry.vertical ?? null, entry.version ?? null, entry.status ?? null, 
+            const insert = this.directory.prepare(`INSERT INTO _substrat_ops_failures
+           (id, actor, operation, stage, tenant_id, scope_id, vertical, version, status, message, reference, origin, code, fingerprint, at)
+         VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`);
+            const row = (tenantId, message) => insert.run(ulid(), entry.actor, entry.operation, entry.stage ?? null, tenantId, entry.scopeId ?? null, entry.vertical ?? null, entry.version ?? null, entry.status ?? null, 
             // Bounded here, not trusted from the catch site: one runaway upstream
             // body must not become a runaway directory row (#559).
-            entry.message.slice(0, 2000), entry.reference ?? null, entry.origin ?? null, entry.code ?? null, fingerprint, at);
+            message.slice(0, 2000), entry.reference ?? null, entry.origin ?? null, entry.code ?? null, fingerprint, at);
+            if (detail !== null)
+                row(null, detail);
+            row(entry.tenantId ?? null, entry.message);
             // Prune-on-write (#559): retention lives here, not in a cron — every insert
             // pays for its own housekeeping, so the table stays bounded even where no
             // scheduled pass runs (this adapter has none).
@@ -5632,7 +5819,11 @@ export class SqliteScopeHost {
              last_version = COALESCE(excluded.last_version, last_version),
              origin = COALESCE(excluded.origin, origin),
              status = CASE WHEN status = 'resolved' THEN 'regressed' ELSE status END`)
-                .run(fingerprint, entry.operation, entry.stage ?? null, entry.origin ?? null, entry.code ?? null, at, at, entry.message.slice(0, 2000), entry.tenantId ?? null, issueExemplarOwner(entry.tenantId ?? null), entry.vertical ?? null, entry.version ?? null);
+                .run(fingerprint, entry.operation, entry.stage ?? null, entry.origin ?? null, entry.code ?? null, at, at, 
+            // The issues are staff's (#2540): a pair's exemplar is its own text, not the tenant's
+            // sentence, and it is owned as the row it is copied from is, the platform's — so erasure
+            // reaches it on an id match, as it reaches that row.
+            (detail ?? entry.message).slice(0, 2000), detail !== null ? null : (entry.tenantId ?? null), issueExemplarOwner(detail !== null ? null : (entry.tenantId ?? null)), entry.vertical ?? null, entry.version ?? null);
             const issueHorizon = new Date(Date.now() - ISSUE_RETENTION_DAYS * 86_400_000).toISOString();
             this.directory.prepare('DELETE FROM _substrat_issues WHERE last_seen < ?').run(issueHorizon);
             // #1748: the tenant's Recurring finding, over the tenant's own occurrences only.
@@ -5833,6 +6024,32 @@ export class SqliteScopeHost {
             archivedFromStatus: (r.archived_from_status ?? null),
             createdAt: r.created_at,
         });
+        // The directory rows `listScopes` and `listScopesReadable` map, filtered and paged alike.
+        const scopeRows = (filter) => {
+            const where = [];
+            const params = [];
+            if (filter?.tenantId) {
+                where.push('tenant_id = ?');
+                params.push(filter.tenantId);
+            }
+            if (filter?.status) {
+                const statuses = Array.isArray(filter.status) ? filter.status : [filter.status];
+                // An empty array means "no status is acceptable" — match nothing, rather
+                // than degenerating into an unfiltered read of the whole fleet.
+                if (statuses.length === 0)
+                    return [];
+                // One JSON array, the shape the DO twin needs for its 100-parameter limit (#1776).
+                where.push('status IN (SELECT value FROM json_each(?))');
+                params.push(JSON.stringify(statuses));
+            }
+            if (filter?.vertical) {
+                where.push('vertical = ?');
+                params.push(filter.vertical);
+            }
+            const tail = keysetTail(where, params, 'scope_id', filter);
+            const sql = 'SELECT * FROM scopes' + (where.length ? ` WHERE ${where.join(' AND ')}` : '') + tail;
+            return this.directory.prepare(sql).all(...params);
+        };
         // The (version, scope) pair a bind and its impact read both start from, and the refusals
         // that come before any export-break question, in the order the bind makes them (#1756).
         const bindTarget = async (tenantId, scopeId, versionId) => {
@@ -5900,8 +6117,8 @@ export class SqliteScopeHost {
                 }
                 if (to === 'reaped') {
                     forgetSwitchesOf(switchSqlOf(this.directory), scopeId);
-                    // #1524: its storage is gone, so its samples describe nothing.
-                    forgetScopeStorage(redactionSqlOf(this.directory), scopeId);
+                    // #2515: its storage is gone, and its measured days are kept for the invoice (retention ends them).
+                    retireScopeStorage(redactionSqlOf(this.directory), scopeId);
                 }
                 // The audit target carries the scope's vertical (control-plane.md §4.4:
                 // "vertical stays null until §4.2 lifecycle actions that name one"). It is
@@ -6236,6 +6453,10 @@ export class SqliteScopeHost {
             canStoreSecrets: isSecretBoxConfigured(this.secretBox),
             defineRole: async (actor, tenantId, role) => {
                 const parsed = roleDefinition.parse(role);
+                // #2447: judged before the write, against this host's keys and the tenant's other roles, so a
+                // role assigned through a door cannot be widened afterwards. A refusal writes nothing, so a
+                // seat of the role as it was stored keeps working.
+                this.refuseReservedDefinition(tenantId, parsed);
                 const before = this.roles.get(`${tenantId}/${parsed.key}`) ?? null;
                 this.directory
                     .prepare(`INSERT OR REPLACE INTO _substrat_roles (tenant_id, role_key, permissions, source, holder)
@@ -6856,10 +7077,17 @@ export class SqliteScopeHost {
                     }
                     throw substratError('conflict', `vertical '${parsed.slug}' is already registered as ${existing.source}`);
                 }
-                this.directory
-                    .prepare('INSERT INTO verticals (slug, name, source, owner_tenant, env_spec, install_spec, listed, created_at) VALUES (?, ?, ?, ?, ?, ?, ?, ?)')
-                    .run(parsed.slug, parsed.name, parsed.source, parsed.ownerTenant, envSpecJson, installSpecJson, parsed.listed ? 1 : 0, new Date().toISOString());
-                this.recordAdmin(actor, 'registerVertical', { tenantId: null }, null, parsed);
+                const createdAt = verticalOwnerNow();
+                // #2501: the slug's ownership period opens with its row, in the same transaction.
+                this.directoryWriteAndAudit(() => {
+                    const changed = this.directory
+                        .prepare('INSERT INTO verticals (slug, name, source, owner_tenant, env_spec, install_spec, listed, created_at) VALUES (?, ?, ?, ?, ?, ?, ?, ?)')
+                        .run(parsed.slug, parsed.name, parsed.source, parsed.ownerTenant, envSpecJson, installSpecJson, parsed.listed ? 1 : 0, createdAt)
+                        .changes > 0;
+                    if (changed)
+                        openVerticalOwnerRow(redactionSqlOf(this.directory), parsed.slug, parsed.ownerTenant, createdAt);
+                    return changed;
+                }, () => this.recordAdmin(actor, 'registerVertical', { tenantId: null }, null, parsed));
             },
             listVerticals: async (actor, page) => {
                 const where = [];
@@ -6891,7 +7119,7 @@ export class SqliteScopeHost {
                 const migrationDigest = await publishedMigrationDigest({
                     id: audited.id, migrationDigest: audited.migrationDigest, manifestJson: manifestJson ?? null, migrations: split.migrations,
                 });
-                this.directory.transaction(() => {
+                this.directoryWriteAndAudit(() => {
                     this.directory
                         .prepare(`INSERT INTO vertical_versions
                  (id, vertical_slug, version, manifest_digest, permission_digest,
@@ -6902,14 +7130,14 @@ export class SqliteScopeHost {
                     writeVersionMigrations(switchSqlOf(this.directory), audited.id, split.migrations);
                     // #2286: the version's scope-store bindings, refusing one moved to another driver, in the insert's transaction.
                     indexVersionScopeStores(switchSqlOf(this.directory), audited.verticalSlug, audited.id, split.manifestJson);
-                })();
-                this.recordAdmin(actor, 'publishVersion', { tenantId: null }, null, {
+                    return true;
+                }, () => this.recordAdmin(actor, 'publishVersion', { tenantId: null }, null, {
                     ...audited,
                     // The digest the registry holds, which differs from the pushed one only for an unheld version.
                     migrationDigest,
                     ...(origin ? { origin } : {}),
                     admission: selfAdmits ? 'admitted' : 'pending',
-                });
+                }));
             },
             verticalScopeStores: async (actor, verticalSlug) => {
                 // One transaction: versions not indexed yet are indexed by the read (#2286).
@@ -6958,44 +7186,41 @@ export class SqliteScopeHost {
                     }
                 }
                 // Resolve any pending publish request either way, and set the flag.
-                this.directory
+                this.directoryWriteAndAudit(() => this.directory
                     .prepare('UPDATE verticals SET listed = ?, publish_requested_at = NULL WHERE slug = ?')
-                    .run(listed ? 1 : 0, slug);
-                this.recordAdmin(actor, 'setVerticalListed', { tenantId: null }, { listed: existing.listed }, { listed });
+                    .run(listed ? 1 : 0, slug).changes > 0, () => this.recordAdmin(actor, 'setVerticalListed', { tenantId: null }, { listed: existing.listed }, { listed }));
             },
             requestPublish: async (actor, slug) => {
                 const existing = readVertical(slug);
                 if (!existing)
                     throw substratError('not_found', `unknown vertical '${slug}'`);
-                this.directory.prepare('UPDATE verticals SET publish_requested_at = ? WHERE slug = ?').run(new Date().toISOString(), slug);
-                this.recordAdmin(actor, 'requestPublish', { tenantId: null }, null, { slug });
+                this.directoryWriteAndAudit(() => this.directory
+                    .prepare('UPDATE verticals SET publish_requested_at = ? WHERE slug = ?')
+                    .run(new Date().toISOString(), slug).changes > 0, () => this.recordAdmin(actor, 'requestPublish', { tenantId: null }, null, { slug }));
             },
             setVerticalInstallsBlocked: async (actor, slug, blocked) => {
                 const existing = readVertical(slug);
                 if (!existing)
                     throw substratError('not_found', `unknown vertical '${slug}'`);
-                this.directory
+                this.directoryWriteAndAudit(() => this.directory
                     .prepare('UPDATE verticals SET installs_blocked = ? WHERE slug = ?')
-                    .run(blocked ? 1 : 0, slug);
-                this.recordAdmin(actor, 'setVerticalInstallsBlocked', { tenantId: null }, { installsBlocked: existing.installsBlocked }, { installsBlocked: blocked });
+                    .run(blocked ? 1 : 0, slug).changes > 0, () => this.recordAdmin(actor, 'setVerticalInstallsBlocked', { tenantId: null }, { installsBlocked: existing.installsBlocked }, { installsBlocked: blocked }));
             },
             setVerticalTenantProvisioner: async (actor, slug, granted) => {
                 const existing = readVertical(slug);
                 if (!existing)
                     throw substratError('not_found', `unknown vertical '${slug}'`);
-                this.directory
+                this.directoryWriteAndAudit(() => this.directory
                     .prepare('UPDATE verticals SET tenant_provisioner = ? WHERE slug = ?')
-                    .run(granted ? 1 : 0, slug);
-                this.recordAdmin(actor, 'setVerticalTenantProvisioner', { tenantId: null }, { tenantProvisioner: existing.tenantProvisioner }, { tenantProvisioner: granted });
+                    .run(granted ? 1 : 0, slug).changes > 0, () => this.recordAdmin(actor, 'setVerticalTenantProvisioner', { tenantId: null }, { tenantProvisioner: existing.tenantProvisioner }, { tenantProvisioner: granted }));
             },
             setVerticalEmailSender: async (actor, slug, granted) => {
                 const existing = readVertical(slug);
                 if (!existing)
                     throw substratError('not_found', `unknown vertical '${slug}'`);
-                this.directory
+                this.directoryWriteAndAudit(() => this.directory
                     .prepare('UPDATE verticals SET email_sender = ? WHERE slug = ?')
-                    .run(granted ? 1 : 0, slug);
-                this.recordAdmin(actor, 'setVerticalEmailSender', { tenantId: null }, { emailSender: existing.emailSender }, { emailSender: granted });
+                    .run(granted ? 1 : 0, slug).changes > 0, () => this.recordAdmin(actor, 'setVerticalEmailSender', { tenantId: null }, { emailSender: existing.emailSender }, { emailSender: granted }));
             },
             deleteVertical: async (actor, slug) => {
                 const existing = readVertical(slug);
@@ -7020,16 +7245,27 @@ export class SqliteScopeHost {
                 }
                 // Deployed dispatch scripts are NOT reaped here — they become orphans for the
                 // cleanup script (#248), never destroyed alongside a registry row.
-                this.directory.prepare('DELETE FROM vertical_channels WHERE vertical_slug = ?').run(slug);
-                this.directory.prepare('DELETE FROM vertical_channel_history WHERE vertical_slug = ?').run(slug);
-                this.directory
-                    .prepare(`DELETE FROM vertical_version_migrations
-              WHERE version_id IN (SELECT id FROM vertical_versions WHERE vertical_slug = ?)`)
-                    .run(slug);
-                forgetVerticalScopeStores(switchSqlOf(this.directory), slug);
-                this.directory.prepare('DELETE FROM vertical_versions WHERE vertical_slug = ?').run(slug);
-                this.directory.prepare('DELETE FROM verticals WHERE slug = ?').run(slug);
-                this.recordAdmin(actor, 'deleteVertical', { tenantId: null }, { slug, source: existing.source, ownerTenant: existing.ownerTenant }, null);
+                // #2501: one transaction, so the row and its ownership period close together.
+                this.directoryWriteAndAudit(() => {
+                    this.directory.prepare('DELETE FROM vertical_channels WHERE vertical_slug = ?').run(slug);
+                    this.directory.prepare('DELETE FROM vertical_channel_history WHERE vertical_slug = ?').run(slug);
+                    this.directory
+                        .prepare(`DELETE FROM vertical_version_migrations
+                WHERE version_id IN (SELECT id FROM vertical_versions WHERE vertical_slug = ?)`)
+                        .run(slug);
+                    forgetVerticalScopeStores(switchSqlOf(this.directory), slug);
+                    forgetVerticalWireAuth(switchSqlOf(this.directory), slug);
+                    this.directory.prepare('DELETE FROM vertical_versions WHERE vertical_slug = ?').run(slug);
+                    const changed = this.directory.prepare('DELETE FROM verticals WHERE slug = ?').run(slug).changes > 0;
+                    if (changed)
+                        closeVerticalOwnerRow(redactionSqlOf(this.directory), slug, verticalOwnerNow());
+                    return changed;
+                }, () => this.recordAdmin(actor, 'deleteVertical', { tenantId: null }, { slug, source: existing.source, ownerTenant: existing.ownerTenant }, null));
+            },
+            listVerticalOwners: async (actor, slug) => {
+                const periods = listVerticalOwnerRows(redactionSqlOf(this.directory), slug);
+                this.recordAccess(actor, 'listVerticalOwners', { tenantId: null }, { slug }, periods.length);
+                return periods;
             },
             admitVersion: async (actor, versionId) => {
                 const v = await readVersion(versionId);
@@ -7040,24 +7276,22 @@ export class SqliteScopeHost {
                     // manual vouch by clearing the note (what the publish seam requires).
                     if (v.admissionNote !== AUTO_ADMISSION_NOTE)
                         return;
-                    this.directory
+                    this.directoryWriteAndAudit(() => this.directory
                         .prepare('UPDATE vertical_versions SET admission_note = NULL WHERE id = ?')
-                        .run(versionId);
-                    this.recordAdmin(actor, 'admitVersion', { tenantId: null }, { admission: v.admission, note: v.admissionNote }, {
+                        .run(versionId).changes > 0, () => this.recordAdmin(actor, 'admitVersion', { tenantId: null }, { admission: v.admission, note: v.admissionNote }, {
                         admission: 'admitted',
                         note: null,
-                    });
+                    }));
                     return;
                 }
                 if (v.admission === 'rejected') {
                     throw substratError('conflict', `version ${versionId} was rejected — publish a new one`);
                 }
-                this.directory
+                this.directoryWriteAndAudit(() => this.directory
                     .prepare("UPDATE vertical_versions SET admission = 'admitted' WHERE id = ?")
-                    .run(versionId);
-                this.recordAdmin(actor, 'admitVersion', { tenantId: null }, { admission: v.admission }, {
+                    .run(versionId).changes > 0, () => this.recordAdmin(actor, 'admitVersion', { tenantId: null }, { admission: v.admission }, {
                     admission: 'admitted',
-                });
+                }));
             },
             rejectVersion: async (actor, versionId, note) => {
                 const v = await readVersion(versionId);
@@ -7068,13 +7302,12 @@ export class SqliteScopeHost {
                 }
                 if (v.admission === 'rejected')
                     return; // idempotent
-                this.directory
+                this.directoryWriteAndAudit(() => this.directory
                     .prepare("UPDATE vertical_versions SET admission = 'rejected', admission_note = ? WHERE id = ?")
-                    .run(note, versionId);
-                this.recordAdmin(actor, 'rejectVersion', { tenantId: null }, { admission: v.admission }, {
+                    .run(note, versionId).changes > 0, () => this.recordAdmin(actor, 'rejectVersion', { tenantId: null }, { admission: v.admission }, {
                     admission: 'rejected',
                     note,
-                });
+                }));
             },
             promotionImpact: async (actor, verticalSlug, channel, versionId) => {
                 const incoming = await readVersion(versionId);
@@ -7158,8 +7391,9 @@ export class SqliteScopeHost {
                 // #2333: a compare-and-set. Every gate above — the review binding, the digest checkpoints,
                 // the export breaks — was judged against `outgoing`, across awaits another promote can run
                 // in. So the pointer moves only if it still names `outgoing`, read and written in one
-                // transaction; the promote that lost the race is refused as stale and writes nothing.
-                const moved = this.directory.transaction(() => {
+                // transaction; the promote that lost the race is refused as stale and writes nothing. Its admin
+                // row commits with the move, ahead of the rebinds below, which record their own.
+                const moved = this.directoryWriteAndAudit(() => {
                     const now = this.directory
                         .prepare('SELECT version_id FROM vertical_channels WHERE vertical_slug = ? AND channel = ?')
                         .get(verticalSlug, channel);
@@ -7178,7 +7412,10 @@ export class SqliteScopeHost {
                VALUES (?, ?, ?, ?, ?, ?, ?)`)
                         .run(ulid(), verticalSlug, channel, versionId, outgoing?.id ?? null, actor, promotedAt);
                     return true;
-                })();
+                }, 
+                // The acknowledgement is recorded, not just enforced: that is what turns
+                // "someone reviewed the permission change" into evidence.
+                () => this.recordAdmin(actor, 'promoteVersion', { tenantId: null, vertical: verticalSlug }, outgoing ? { versionId: outgoing.id, version: outgoing.version } : null, { channel, versionId, version: incoming.version, acknowledged: ack }));
                 if (!moved)
                     throw promoteRaceRefusal(channel);
                 // For a PRIVATE vertical, prod IS what the owner's apps run: re-point the
@@ -7208,9 +7445,6 @@ export class SqliteScopeHost {
                         .prepare('UPDATE scopes SET vertical_version_id = ?, vertical = ? WHERE scope_id = ?')
                         .run(versionId, verticalSlug, s.scope_id).changes > 0, () => this.recordAdmin(actor, 'bindScopeVersion', { tenantId: s.tenant_id, scopeId: s.scope_id }, prev ? { versionId: prev.id, version: prev.version } : null, { versionId, vertical: verticalSlug, version: incoming.version, via: 'promoteVersion' }));
                 }
-                // The acknowledgement is recorded, not just enforced: that is what turns
-                // "someone reviewed the permission change" into evidence.
-                this.recordAdmin(actor, 'promoteVersion', { tenantId: null, vertical: verticalSlug }, outgoing ? { versionId: outgoing.id, version: outgoing.version } : null, { channel, versionId, version: incoming.version, acknowledged: ack });
             },
             listChannels: async (actor, verticalSlug, page) => {
                 // `prod` is the only live channel (#509 retired dev/staging). Filtering here keeps a
@@ -7482,11 +7716,10 @@ export class SqliteScopeHost {
                     throw substratError('not_found', `unknown vertical '${verticalSlug}'`);
                 // #2178: every install on the serving script runs the new version from this moment.
                 this.assertNoStrandFrom([r.serving_version_id], parsed.versionId, r.serving_ref ? this.provisionedVersionsOf(verticalSlug, r.serving_version_id ? { ref: r.serving_ref, versionId: r.serving_version_id } : null, null) : []);
-                this.directory
+                this.directoryWriteAndAudit(() => this.directory
                     .prepare(`UPDATE verticals SET serving_ref = ?, serving_version_id = ?,
                     serving_do_classes = ?, serving_migration_tag = ? WHERE slug = ?`)
-                    .run(parsed.ref, parsed.versionId, JSON.stringify(parsed.doClasses), parsed.migrationTag, verticalSlug);
-                this.recordAdmin(actor, 'setVerticalServing', { tenantId: null }, r.serving_ref ? { ref: r.serving_ref, versionId: r.serving_version_id } : null, { vertical: verticalSlug, ref: parsed.ref, versionId: parsed.versionId });
+                    .run(parsed.ref, parsed.versionId, JSON.stringify(parsed.doClasses), parsed.migrationTag, verticalSlug).changes > 0, () => this.recordAdmin(actor, 'setVerticalServing', { tenantId: null }, r.serving_ref ? { ref: r.serving_ref, versionId: r.serving_version_id } : null, { vertical: verticalSlug, ref: parsed.ref, versionId: parsed.versionId }));
             },
             versionManifest: async (actor, verticalSlug, versionId) => {
                 const v = this.directory
@@ -7506,6 +7739,20 @@ export class SqliteScopeHost {
                 this.recordAccess(actor, 'versionMigrations', {}, { verticalSlug, versionId }, v.migrations?.length ?? 0);
                 return v.migrations;
             },
+            recordWireAuth: async (actor, input) => {
+                const row = deploymentWireAuth.parse(input);
+                this.directoryWriteAndAudit(() => {
+                    writeDeploymentWireAuth(switchSqlOf(this.directory), row);
+                    return true;
+                }, () => this.recordAdmin(actor, 'recordWireAuth', { tenantId: null, vertical: row.verticalSlug }, null, { vertical: row.verticalSlug, deploymentRef: row.deploymentRef, versionId: row.versionId, record: row.record }));
+            },
+            listWireAuth: async (actor, input) => {
+                // The judged copy, not the caller's object: only its own fields, the reach first, reach the log.
+                const filter = assertWireAuthFilter(input);
+                const rows = deploymentWireAuthOf(switchSqlOf(this.directory), filter);
+                this.recordAccess(actor, 'listWireAuth', wireAuthAccessTarget(filter), filter, rows.length);
+                return rows;
+            },
             setScopeServingRef: async (actor, tenantId, scopeId, servingRef, opts) => {
                 const scope = this.directory.prepare('SELECT * FROM scopes WHERE scope_id = ?').get(scopeId);
                 if (!scope || scope.tenant_id !== tenantId) {
@@ -7796,11 +8043,12 @@ export class SqliteScopeHost {
                 this.recordAccess(actor, 'operationSeries', { tenantId, scopeId }, delegatedReadParams.operationSeries(input), operationSeriesCount(series));
                 return series;
             },
+            // Every row, newest first (#2553); `rowid DESC` orders migrations stamped in one millisecond.
             scopeAppliedMigrations: async (actor, tenantId, scopeId) => {
                 const db = this.scopeReadDbFor(tenantId, scopeId);
                 const rows = db
                     .prepare(`SELECT module_id, version, applied_at, duration_ms, rows_changed FROM _substrat_migrations
-              ORDER BY applied_at DESC, module_id, version LIMIT 100`)
+              ORDER BY applied_at DESC, rowid DESC`)
                     .all();
                 this.recordAccess(actor, 'scopeAppliedMigrations', { tenantId, scopeId }, null, rows.length);
                 return rows.map((r) => ({
@@ -7826,10 +8074,7 @@ export class SqliteScopeHost {
             scopeDatabaseSize: async (actor, tenantId, scopeId) => {
                 // #1524: the SQLite twin of a DO's `databaseSize`. It counts allocated pages,
                 // free ones included, which is what the file costs on disk, not the live row bytes.
-                const db = this.scopeReadDbFor(tenantId, scopeId);
-                const pages = db.pragma('page_count', { simple: true });
-                const pageSize = db.pragma('page_size', { simple: true });
-                const bytes = pages * pageSize;
+                const bytes = databaseBytesOf(this.scopeReadDbFor(tenantId, scopeId));
                 this.recordAccess(actor, 'scopeDatabaseSize', { tenantId, scopeId }, null, 1);
                 return bytes;
             },
@@ -7838,6 +8083,11 @@ export class SqliteScopeHost {
                 this.recordAccess(actor, 'scopeStoreSizes', { tenantId, scopeId }, null, sizes.length);
                 return sizes;
             },
+            scopeAttachmentBytes: async (actor, tenantId, scopeId) => {
+                const bytes = attachmentBytesOf(this.scopeReadDbFor(tenantId, scopeId));
+                this.recordAccess(actor, 'scopeAttachmentBytes', { tenantId, scopeId }, null, 1);
+                return bytes;
+            },
             rewindScope: async () => {
                 throw new Error('point-in-time rewind is not available on this host (PITR is a Durable-Object-plane mechanism) — use the backup restore path');
             },
@@ -7963,11 +8213,10 @@ export class SqliteScopeHost {
                 if (slugOwner) {
                     throw substratError('conflict', `tenant slug '${parsed.slug}' already taken by ${slugOwner.tenant_id} (slugs are unique)`);
                 }
-                this.directory
+                this.directoryWriteAndAudit(() => this.directory
                     .prepare(`INSERT INTO tenants (tenant_id, slug, name, status, created_at, provisioned_by_tenant)
              VALUES (?, ?, ?, 'active', ?, ?)`)
-                    .run(parsed.id, parsed.slug, parsed.name, new Date().toISOString(), parsed.provisionedByTenant ?? null);
-                this.recordAdmin(actor, 'createTenant', { tenantId: parsed.id }, null, readTenant(parsed.id));
+                    .run(parsed.id, parsed.slug, parsed.name, new Date().toISOString(), parsed.provisionedByTenant ?? null).changes > 0, () => this.recordAdmin(actor, 'createTenant', { tenantId: parsed.id }, null, readTenant(parsed.id)));
             },
             setTenantStatus: async (actor, tenantId, status) => {
                 const before = readTenant(tenantId);
@@ -7982,17 +8231,13 @@ export class SqliteScopeHost {
                 // Stamp/clear deleting_at so the grace-window sweep can age tenants (§4.8):
                 // entering `deleting` stamps, leaving it (an un-delete) clears — exactly the
                 // shape suspendScope/archiveScope use for archived_at.
-                if (status === 'deleting') {
-                    this.directory
+                this.directoryWriteAndAudit(() => (status === 'deleting'
+                    ? this.directory
                         .prepare('UPDATE tenants SET status = ?, deleting_at = ? WHERE tenant_id = ?')
-                        .run(status, new Date().toISOString(), tenantId);
-                }
-                else {
-                    this.directory
+                        .run(status, new Date().toISOString(), tenantId)
+                    : this.directory
                         .prepare('UPDATE tenants SET status = ?, deleting_at = NULL WHERE tenant_id = ?')
-                        .run(status, tenantId);
-                }
-                this.recordAdmin(actor, 'setTenantStatus', { tenantId }, { status: before.status }, { status });
+                        .run(status, tenantId)).changes > 0, () => this.recordAdmin(actor, 'setTenantStatus', { tenantId }, { status: before.status }, { status }));
             },
             setTenantName: async (actor, tenantId, name) => {
                 const before = readTenant(tenantId);
@@ -8000,8 +8245,7 @@ export class SqliteScopeHost {
                     throw substratError('not_found', `unknown tenant: ${tenantId}`);
                 if (before.name === name)
                     return; // no-op is not audited — nothing changed
-                this.directory.prepare('UPDATE tenants SET name = ? WHERE tenant_id = ?').run(name, tenantId);
-                this.recordAdmin(actor, 'setTenantName', { tenantId }, { name: before.name }, { name });
+                this.directoryWriteAndAudit(() => this.directory.prepare('UPDATE tenants SET name = ? WHERE tenant_id = ?').run(name, tenantId).changes > 0, () => this.recordAdmin(actor, 'setTenantName', { tenantId }, { name: before.name }, { name }));
             },
             listTenants: async (actor, page) => {
                 const where = [];
@@ -8019,32 +8263,15 @@ export class SqliteScopeHost {
                 return t;
             },
             listScopes: async (actor, filter) => {
-                const where = [];
-                const params = [];
-                if (filter?.tenantId) {
-                    where.push('tenant_id = ?');
-                    params.push(filter.tenantId);
-                }
-                if (filter?.status) {
-                    const statuses = Array.isArray(filter.status) ? filter.status : [filter.status];
-                    // An empty array means "no status is acceptable" — match nothing, rather
-                    // than degenerating into an unfiltered read of the whole fleet.
-                    if (statuses.length === 0)
-                        return [];
-                    // One JSON array, the shape the DO twin needs for its 100-parameter limit (#1776).
-                    where.push('status IN (SELECT value FROM json_each(?))');
-                    params.push(JSON.stringify(statuses));
-                }
-                if (filter?.vertical) {
-                    where.push('vertical = ?');
-                    params.push(filter.vertical);
-                }
-                const tail = keysetTail(where, params, 'scope_id', filter);
-                const sql = 'SELECT * FROM scopes' + (where.length ? ` WHERE ${where.join(' AND ')}` : '') + tail;
-                const scopes = this.directory.prepare(sql).all(...params).map(mapScope);
+                const scopes = scopeRows(filter).map(mapScope);
                 this.recordAccess(actor, 'listScopes', { tenantId: filter?.tenantId ?? null }, filter, scopes.length);
                 return scopes;
             },
+            listScopesReadable: async (actor, filter) => {
+                const rows = scopeRows(filter);
+                this.recordAccess(actor, 'listScopesReadable', { tenantId: filter?.tenantId ?? null }, filter, rows.length);
+                return readableScopes(rows, mapScope);
+            },
             listTenantStores: async (actor, filter) => {
                 const where = [];
                 const params = [];
@@ -8687,23 +8914,22 @@ export class SqliteScopeHost {
                     '_substrat_scope_storage', // #1524: storage samples of scopes whose storage is gone
                     '_substrat_scope_storage_attempts', // #1524: and the phase's last try at each
                     '_substrat_scope_store_storage', // #2212: scope-store samples, gone with the tenant
+                    '_substrat_scope_attachment_storage', // #2501: attachment samples, gone with the tenant
                 ];
-                const clear = this.directory.transaction(() => {
+                this.directoryWriteAndAudit(() => {
                     for (const table of tables) {
                         this.directory.prepare(`DELETE FROM ${table} WHERE tenant_id = ?`).run(tenantId);
                     }
-                    this.directory
+                    return this.directory
                         .prepare(`UPDATE tenants SET status = 'reaped', deleting_at = NULL WHERE tenant_id = ?`)
-                        .run(tenantId);
-                });
-                clear();
+                        .run(tenantId).changes > 0;
+                }, () => this.recordAdmin(actor, 'reapTenant', { tenantId }, { status: before.status }, { status: 'reaped' }));
                 // Evict the in-memory role cache for this tenant (the one directory table
                 // mirrored in memory) so a reaped role never resolves after the DELETE.
                 for (const cacheKey of [...this.roles.keys()]) {
                     if (cacheKey.startsWith(`${tenantId}/`))
                         this.roles.delete(cacheKey);
                 }
-                this.recordAdmin(actor, 'reapTenant', { tenantId }, { status: before.status }, { status: 'reaped' });
             },
             grantEntitlement: async (actor, tenantId, entitlementKey, plan) => {
                 const input = entitlementGrantInput.parse(plan ?? {});
@@ -8796,6 +9022,7 @@ export class SqliteScopeHost {
                     storage: listScopeStorageRows(redactionSqlOf(this.directory), { tenantId: only, latest: true }),
                     storageAttempts: listScopeStorageAttemptRows(redactionSqlOf(this.directory), only),
                     storeStorage: listScopeStoreStorageRows(redactionSqlOf(this.directory), only),
+                    attachmentStorage: listScopeAttachmentStorageRows(redactionSqlOf(this.directory), only),
                 });
                 // The count that matters for K-24 is how many TENANTS this reading covered —
                 // "read the meter for one tenant" and "metered the whole fleet" are different
@@ -9449,8 +9676,9 @@ export class SqliteScopeHost {
                     params.push(filter.fingerprint);
                 }
                 if (filter?.reference) {
-                    where.push('reference = ?');
-                    params.push(filter.reference);
+                    const byReference = opsFailureReferenceWhere(filter.reference, filter.referenceInText === true);
+                    where.push(byReference.sql);
+                    params.push(...byReference.params);
                 }
                 if (filter?.since) {
                     where.push('at >= ?');
@@ -9683,6 +9911,33 @@ export class SqliteScopeHost {
                 return rows;
             },
             pruneScopeStorage: async (_actor, limit) => pruneScopeStorageRows(redactionSqlOf(this.directory), Date.now(), limit),
+            recordRequestDay: async (_actor, input) => ({
+                recorded: this.directory.transaction(() => recordRequestDayRows(redactionSqlOf(this.directory), input))(),
+            }),
+            listRequestDays: async (actor, filter) => {
+                const rows = listRequestDayRows(redactionSqlOf(this.directory), filter);
+                this.recordAccess(actor, 'listRequestDays', { tenantId: filter?.tenantId ?? null, scopeId: filter?.scopeId ?? null }, filter ?? null, rows.length);
+                return rows;
+            },
+            listRequestRollupDays: async (actor, filter) => {
+                const rows = listRequestRollupDayRows(redactionSqlOf(this.directory), filter);
+                this.recordAccess(actor, 'listRequestRollupDays', { tenantId: null }, filter ?? null, rows.length);
+                return rows;
+            },
+            pruneRequestDays: async (_actor, limit, retentionMonths) => this.directory.transaction(() => pruneRequestDayRows(redactionSqlOf(this.directory), Date.now(), limit, retentionMonths))(),
+            // #2501: the snapshot reads and writes in one transaction, so its rows are one instant's reading.
+            recordMeterDay: async (_actor, input) => this.directory.transaction(() => recordMeterDayRows(redactionSqlOf(this.directory), input))(),
+            listMeterDays: async (actor, filter) => {
+                const rows = listMeterDayRows(redactionSqlOf(this.directory), filter);
+                this.recordAccess(actor, 'listMeterDays', { tenantId: filter?.tenantId ?? null }, filter ?? null, rows.length);
+                return rows;
+            },
+            listMeterDayTakes: async (actor, filter) => {
+                const rows = listMeterDayTakeRows(redactionSqlOf(this.directory), filter);
+                this.recordAccess(actor, 'listMeterDayTakes', { tenantId: null }, filter ?? null, rows.length);
+                return rows;
+            },
+            pruneMeterDays: async (_actor, limit, retentionMonths) => this.directory.transaction(() => pruneMeterDayRows(redactionSqlOf(this.directory), Date.now(), limit, retentionMonths))(),
             listModelUsage: async (actor, filter) => {
                 const rows = this.selectModelUsage(filter);
                 this.recordAccess(actor, 'listModelUsage', { tenantId: filter?.tenantId ?? null, scopeId: filter?.scopeId ?? null }, filter, rows.length);
@@ -10034,6 +10289,8 @@ export class SqliteScopeHost {
         }
         for (const stmt of LEGACY_SCOPE_ROWS_BACKFILL)
             this.directory.exec(stmt);
+        // #2501: an ownership period for every vertical registered before the history existed.
+        this.directory.exec(VERTICAL_OWNERS_BACKFILL);
         // Created after the backfill: a UNIQUE index over NULL slugs would permit the
         // duplicates it exists to forbid (SQLite treats NULLs as distinct).
         //
@@ -10364,9 +10621,7 @@ export class SqliteScopeHost {
                 const pending = rt.db
                     .prepare(`SELECT COUNT(*) AS c FROM _substrat_platform_requests WHERE status = 'pending'`)
                     .get().c;
-                if (pending >= MAX_PENDING_PLATFORM_REQUESTS) {
-                    throw new Error(`too many pending platform requests (${pending}); retry once some have drained`);
-                }
+                assertPlatformRequestRoom(pending);
                 const id = platformRequestId.parse(ulid());
                 const requestedBy = overrideActor ?? actorOf(subject);
                 rt.db