@substrat-run/adapter-sqlite 0.161.0 → 0.163.0

package/dist/index.js

@@ -3,7 +3,7 @@ import { closeSync, existsSync, fstatSync, mkdirSync, openSync, readdirSync, rea
 import { dirname, join } from 'node:path';
 import Database from 'better-sqlite3';
 import { accessLogEntry, adminLogEntry, delegatedReadParams, operationSeriesCount, opsFailureEntry, opsFailureFingerprint, issueEntry, FRESHNESS_HEARTBEAT_MINUTES, sweepRunEntry, modelUsageEntry, ATTACHMENT_ADDED, ATTACHMENT_REMOVED, createTenantInput, domainEvent, domainEventInput, exportReadInput, importBatch, importCursorMove, exportsOfManifestJson, assertNoBindingShapeBreak, importsOfManifestJson, connectionLandingsOfManifestJson, entitlementGrant, entitlementGrantInput, eventId, meterReading, platformRequestInput, platformRequestId, identityLink, identityPool, instant, isSubstratError, connection, capabilityGrant, connectionGrant, connectionGrantRecord, connectionSecret, systemGrant, systemSwitch, systemSwitchRecord, peerSwitch, verticalCaller, verticalSlug as verticalSlugOf, subjectRef, requestFingerprint, createConnectionInput, connectLinkFilter, connectLinkKey, consumeConnectLinkInput, mintConnectLinkInput, projectedConnectionGrant, projectedConnectionKey, moduleManifest, createOrgInput, promotionAcknowledgement, bindAcknowledgement, bindHostnameInput, channelHistoryEntry, hostnameBinding, publishVersionInput, AUTO_ADMISSION_NOTE, routeTarget, ROUTE_SCOPE_HOSTNAMES_MAX, registerVerticalInput, vertical as verticalSchema, verticalChannel, verticalVersion, objectRef, entityObjectRef, assertModuleEmittableType, assertKernelAuthoredType, grantRefFromProof, org as orgSchema, orgMembership, principalId, resolvedIdentity, identityMembership, roleDefinition, scope as scopeSchema, tenant as tenantSchema, tenantRole, principalBecomeCapabilityInput, subjectShredReceipt, SCOPE_TABLE_PAGE_DEFAULT, SCOPE_TABLE_PAGE_MAX, SCOPE_QUERY_ROW_MAX, verticalServingState, deploymentWireAuth, callsOfManifestJson, outboundOfManifestJson, listLimitOf, pageOf, countedPageOf, SCOPE_GATE_REASONS, substratError, assertReplayableDump, delegatedReadRecord, ownerTransferAudit, memberChangeAudit, peerBindingAudit, connectionBindingAudit, copyMarkAudit, orphanSweepAudit, redrainEventsInput, REDRAIN_BATCH, errorCodeOf, } from '@substrat-run/contracts';
-import { actorOf, asPrincipal, assertAllowed, assertNoSecret, assertPermissionKey, CAPABILITY_DDL, UPLOAD_LINK_DDL, createAttachmentVerbs, inspectUploadLink, redeemUploadLinkInTransaction, redeemOrReplayUploadLink, COPY_ORIGIN_DDL, ENTITY_STATE_MOVES_DDL, CAPABILITY_EXCHANGE_OPERATION, CAPABILITY_BECOME_MINT_OPERATION, becomeMintCheck, mintBecomeCapabilityAsPrincipal, revokeBecomeCapabilityAsPrincipal, readBecomeLinkStates, ENTITY_UNBIND_OPERATION, allowedFor, unbindEntityHolderBounded, capabilityAttachmentWriteRefused, capabilityTokenHash, createCapabilityVerbs, createEntityEdgeVerbs, createEntityStateVerbs, createTrashedReads, CONTINUATION_POSITION_CAP, visibleContinuation, searchStateWhere, uncheckedView, addStatePlans, addUpdatedStampPlans, watchUpdatedStamps, entityStateMigrations, assertNoCallerPurge, assertPlatformRequestRoom, isUnreachableParent, heldPurgePass, purgeDueOf, purgeHeldBy, lifecycleRefusal, scopeNotHeldRefusal, purgeOnlyKeysOf, purgeReportOf, purgeStillDue, refuseTrashedTarget, assertBoundOperations, checkHeldOperationsOf, countChecks, noteUncheckedCompletion, registerTrashTargets, runPurgePass, withheldKeysFor, statefulTablesOf, afterMigration, afterRuntimeDdl, derivesAnything, repairDerivedObjects, StateColumnLost, exchangeCapability as exchangeCapabilitySecret, guardSecrets, mintBecomeCapability, plausibleSessionToken, readCapabilityPage, redactSecrets, redactSecretText, moduleLog, consoleLogSink, asyncInvocationId, asyncLinePass, consoleInvocationLineSink, resolveCapabilitySession, revokeCapabilityAsPlatform, assertReadOnlyQuery, attachmentBlobKey, attachmentSha256, isSizedByteStream, knownLengthStream, openAttachmentByteStream, putAttachmentBytes, entitlementDenial, requiredEntitlementFor, foldMeterReading, guardSpine, guardSqlLimits, DO_SQL_LIMITS, tooManyResultColumns, tooManyTableColumns, parseValidationRecords, readableScopes, resolveScopeRecord, ulid, ISSUE_RETENTION_DAYS, telemetryRetentionStatements, FINDINGS_DDL, ATTACHMENT_BYTES_SQL, SCOPE_STORAGE_DDL, forgetScopeStorage, listScopeAttachmentStorageRows, retireScopeStorage, listScopeStorageAttemptRows, listScopeStorageRows, listScopeStoreStorageRows, pruneScopeStorageRows, recordScopeStorageRows, REQUEST_ROLLUP_DDL, listRequestDayRows, listRequestRollupDayRows, pruneRequestDayRows, recordRequestDayRows, METER_DAYS_DDL, VERTICAL_OWNERS_BACKFILL, VERTICAL_OWNERS_DDL, closeVerticalOwnerRow, listVerticalOwnerRows, openVerticalOwnerRow, verticalOwnerNow, listMeterDayRows, listMeterDayTakeRows, pruneMeterDayRows, recordMeterDayRows, CONNECT_LINKS_DDL, consumeConnectLinkRow, insertConnectLink, listConnectLinks as listConnectLinkRows, readConnectLink, restoreConnectLinkRow, revokeConnectLinkRow, createFindingRule, findingOfOpsFailure, findingOfSweepRun, pruneFindings, listFindingRules, listFindings, observeFinding, revokeFindingRule, setFindingStatus, assertRowLimit, assertRowOffset, OPS_FAILURE_RETENTION_DAYS, SWEEP_RUN_RETENTION_DAYS, SWEEP_RUNS_INTENT_INDEX, sweepRunsIntentHasKind, MODEL_USAGE_RETENTION_DAYS, foldModelUsage, backoffAt, platformRequestHistoryQuery, platformRequestOf, PLATFORM_REQUEST_COLUMNS, PLATFORM_REQUEST_REDACTION_SQL, platformRequestRedactionParams, platformRequestRedactionQuery, intentPayloadCarriesSubject, redactSubjectJobRuns, eraseSubjectFromModules, moduleRowsErased, moduleErasurePlan, redactSubjectScopeText, redactSubjectDirectoryText, ISSUE_EXEMPLAR_OWNER_BACKFILL_SQL, issueExemplarOwner, JOB_RUN_PATCH_SQL, JOB_RUN_CLAIM_SQL, JOB_RUN_RENEW_SQL, JOB_RUN_BEGIN_SQL, JOB_RUN_MISS_SQL, JOB_RUN_MISS_SETTLE_SQL, admissionMissOutcome, JOB_STEP_RECORD_SQL, JOB_LEASE_EXPIRED_NOTE, assertLeaseMs, DELIVERY_ERROR_REDACTION_SQL, REDACTED_DELIVERY_NOTE, seatScopeTuple, applyScopeRoleChange, changeScopeRole, revokeScopeRoles, scopeRoleHolders, assertModuleDeclared, noteDeclaredKeys, noteReservedKeys, dumpRoleRefusal, reservedGrantRefusal, reservedRoleDefinitionRefusal, reservedRoleRefusal, reservedShapeRefusal, SCOPE_SEATED_ROLES_SQL, SEAT_HOLDING_SCOPE_STATUSES, TENANT_SEATED_ROLES_SQL, admitPeer, boundToPeerDeclarations, peerCallerAt, collectPeers, peerSeats, resolveVerticalInstanceFrom, resolvePeerInstanceFrom, peerVerticalSpellings, samePeerVertical, peerGrantsStatus, systemGrantsStatus, systemScheduleState, systemSwitchedOff, systemSwitchedOffMessage, tenantSystemSwitchedOffMessage, PEER_SWITCHES_DDL, PEER_BINDINGS_DDL, SWITCH_OWED_DDL, SWITCH_FENCES_DDL, TABLE_OWNERS_DDL, assertMigrationLeavesLedgerAlone, recordOwnershipSteps, runMigrationStatements, executableSqlStatements, blankSqlComments, recordWriteSuperseded, switchFencesOf, switchSupersededMessage, SWITCH_KINDS, SYSTEM_SWITCHES_DDL, forgetSwitchesOf, listSystemSwitchRecords, moveSwitch, reassertActionOf, reassertEntry, reassertOffRow, recordSwitchedOff, recordSwitchedOn, restoreSwitchRecord, scopesSwitchedOffFor, switchActionOf, switchAuditSubject, recordAuditOutcome, auditedCapabilityRevoke, auditWarningOf, switchNotFoundMessage, switchRecordsOf, switchedOffOf, switchesBackfillSqlOf, switchesTableExists, tenantHeldOf, tenantHoldsGrant, inUnitMovesToAudit, staleCarryRevertRow, staleCarryReverts, withRecorded, VERSION_MIGRATIONS_DDL, VERTICAL_SCOPE_STORES_DDL, forgetVerticalScopeStores, DEPLOYMENT_WIRE_AUTH_DDL, assertWireAuthFilter, deploymentWireAuthOf, forgetVerticalWireAuth, wireAuthAccessTarget, writeDeploymentWireAuth, indexVersionScopeStores, driverDeclarationsOf, verticalScopeStoresOf, STORE_DRIVER_RELEASES_DDL, legacyStoreDriverConflict, legacyStoreDriverRenames, beginStoreDriverRolloutIn, finishStoreDriverRolloutIn, holdStoreDriverIn, advanceStoreDriverRebuildIn, claimStoreDriverRebuildIn, storeDriverRebuildIn, recordStoreDriverReleaseIn, releaseStoreDriverHoldIn, storeDriverReleaseIn, storeDriverStateIn, storeDriverRolloutPendingIn, storeDriverRolloutWalkedIn, splitManifestMigrations, splitVersionMigrationsBatch, versionMigrationsOf, deriveVersionMigrationDigest, publishedMigrationDigest, migrationChangeRefusal, writeVersionMigrations, denialListQuery, refusalListQuery, mapRefusalRow, denialSummaryQuery, denialTotalsQuery, DENIAL_WINDOW_QUERY, mapDenialRow, mapDenialSummaryBuckets, IMPERSONATION_COLUMNS, IMPERSONATION_DDL, ImpersonationRefused, assertImpersonationWrites, assertModuleEnqueueableKind, assertSessionUsable, impersonationByIdQuery, impersonationListQuery, impersonationRowValues, impersonationStampOf, mapImpersonationRow, newImpersonationSession, resolveRetryPolicy, executorOutcomeOf, isDeliveryRefusal, refusalJournalText, membershipFencesBackfillSql, MEMBERSHIP_FENCES_DDL, membershipFencesTableExists, MEMBERSHIP_FENCE_SINCE_SQL, RAISE_MEMBERSHIP_FENCE_SQL, memberAddedAudit, orgChangeBound, tenantCoverage, isSecretBoxConfigured, unconfiguredSecretBox, createSubjectKeys, generateSealingKeyPair, noSealingKeyMessage, openSealed, sealTo, ConnectionSealingKeyUnavailableError, PermissionDenied, createAtomic, NotSearchable, NotListable, listIndexMigrations, listIndexPlans, listQuery, cursorOf, moduleMigrations, MIGRATION_DIGEST_FENCE_DDL, MIGRATION_DIGEST_MARK_LEGACY, assertJournalDumpCoherent, assertMigrationSql, migrationDivergence, migrationFailedError, migrationSetDivergence, migrationSteps, planMigrations, isSearchIndexTable, searchIndexMigrations, searchIndexPlans, searchLimit, searchMatchExpression, searchQuery, ATTACHMENT_TEXT_DDL, ATTACHMENT_CONDEMNED_DDL, ATTACHMENT_SWEEP_LICENCE_DDL, ATTACHMENT_SWEEP_LICENCE_TABLE, clearOrphanSweepLicence, condemnLicensedOrphanAttachments, consumeOrphanSweepLicence, licensedOrphanIds, recordOrphanSweepLicence, refuseUnlicensedOrphanSweep, fenceAttachmentSweep, refuseCondemnedAttachment, refuseCondemnedInDump, rowlessAttachmentIds, sweepOrphanAttachments, missingAttachmentStore, SETTLED_COPY_STATES, unsettledCopyRefusal, assertAttachmentExtractors, resolveAttachmentTextBounds, assertJobRegistrable, attachmentRecordOfRow, attachmentTextJob, enqueueAttachmentText, ATTACHMENT_TEXT_BACKFILL_JOB, ATTACHMENT_TEXT_JOB, kernelJobFor, queueAttachmentTextBackfill, startAttachmentTextBackfill, attachmentTextBackfillJob, reconcileAttachmentText, recordAttachmentText, searchAttachments, entityVersionQuery, entityVersionOf, assertIfMatch, OUTBOX_ENTITY_INDEX, SCHEDULE_STATE_DDL, SCHEDULE_STATE_REBUILD, scheduleStateHasKind, VERTICAL_EVENTS_DDL, EXPORT_HOPS_SQL, emptyImportResult, IMPORT_CURSORS_SQL, IMPORT_CURSOR_OF_SQL, OUTBOX_MARK_SQL, emittedSinceQuery, emittedReportOf, EMITTED_REPORT_CAP, exportedSinceQuery, IMPORT_CURSOR_ADVANCE_SQL, IMPORT_RECORD_SQL, moveImportCursor, importCursorSourceOf, exportBreaksOf, exportBreakRefusal, assertPromoteReviewCurrent, promoteRaceRefusal, servingRaceRefusal, rebindRaceRefusal, SERVES_NOW_CONDITION, SERVES_NOW_PREDICATE, servesNowParams, bindExportBreaksOf, bindExportBreakRefusal, scopeMoveOf, runningVersionOf, isPrimaryScope, PROVISIONED_VERSIONS_SQL, installsReconciledOf, strandJudgmentsOf, provisionedVersionsParams, boundShapesColumn, boundShapesOfColumn, installReconciled, CrossVerticalRegistry, exportReadPlan, exportReadQuery, planExportBatch, withheldNote, JOB_RUN_DDL, JOB_RUN_DUE_AT, jobRunListLimit, jobRunOf, runDueJobRuns, startJobRun, IDEMPOTENCY_DDL, REFUSALS_TABLE_DDL, REFUSALS_INDEX, refusalInsert, refusalOf, markGuardRefusal, REFUSALS_REBUILD, refusalsAdmitGuards, assertIdempotencyKey, idempotencyLookupQuery, idempotencyPruneStatement, idempotencyRecordStatement, idempotencyOptedOutMessage, replayFor, globalFetch, fetchLikeOf, deadlineFetch, createUlid, facetEvents, readHistory, walkEventCause, walkEventEffects, assertRedrainWindow, readInvocation, readDeadLetters, readLifecycleFlow, readOperationSeries, domainEventOf, readUndrainedOutbox, undrainedEventsOf, connectorCallRecord, noopConnectorCallRecorder, recordConnectorCall, settleConnectionUse, unknownRoleError, callReservedStoreOperation, callScopeStore, observeStoreCall, replayStoreErasures, scopeStoreLifecycleOf, scopeStoreRunnersOf, } from '@substrat-run/kernel';
+import { actorOf, asPrincipal, assertAllowed, assertNoSecret, assertPermissionKey, CAPABILITY_DDL, UPLOAD_LINK_DDL, createAttachmentVerbs, inspectUploadLink, redeemUploadLinkInTransaction, redeemOrReplayUploadLink, COPY_ORIGIN_DDL, ENTITY_STATE_MOVES_DDL, CAPABILITY_EXCHANGE_OPERATION, CAPABILITY_BECOME_MINT_OPERATION, becomeMintCheck, mintBecomeCapabilityAsPrincipal, revokeBecomeCapabilityAsPrincipal, readBecomeLinkStates, ENTITY_UNBIND_OPERATION, allowedFor, unbindEntityHolderBounded, capabilityAttachmentWriteRefused, capabilityTokenHash, createCapabilityVerbs, createEntityEdgeVerbs, createEntityStateVerbs, createTrashedReads, CONTINUATION_POSITION_CAP, visibleContinuation, searchStateWhere, uncheckedView, addStatePlans, addUpdatedStampPlans, watchUpdatedStamps, entityStateMigrations, assertNoCallerPurge, assertPlatformRequestRoom, isUnreachableParent, heldPurgePass, purgeDueOf, purgeHeldBy, lifecycleRefusal, scopeNotHeldRefusal, purgeOnlyKeysOf, purgeReportOf, purgeStillDue, refuseTrashedTarget, assertBoundOperations, checkHeldOperationsOf, countChecks, noteUncheckedCompletion, registerTrashTargets, runPurgePass, withheldKeysFor, statefulTablesOf, afterMigration, afterRuntimeDdl, derivesAnything, repairDerivedObjects, StateColumnLost, exchangeCapability as exchangeCapabilitySecret, guardSecrets, mintBecomeCapability, plausibleSessionToken, readCapabilityPage, redactSecrets, redactSecretText, moduleLog, consoleLogSink, asyncInvocationId, asyncLinePass, consoleInvocationLineSink, resolveCapabilitySession, revokeCapabilityAsPlatform, assertReadOnlyQuery, attachmentBlobKey, attachmentSha256, isSizedByteStream, knownLengthStream, openAttachmentByteStream, putAttachmentBytes, entitlementDenial, requiredEntitlementFor, foldMeterReading, guardSpine, guardSqlLimits, DO_SQL_LIMITS, tooManyResultColumns, tooManyTableColumns, parseValidationRecords, readableScopes, resolveScopeRecord, ulid, ISSUE_RETENTION_DAYS, telemetryRetentionStatements, FINDINGS_DDL, ATTACHMENT_BYTES_SQL, SCOPE_STORAGE_DDL, forgetScopeStorage, listScopeAttachmentStorageRows, retireScopeStorage, listScopeStorageAttemptRows, listScopeStorageRows, listScopeStoreStorageRows, pruneScopeStorageRows, recordScopeStorageRows, REQUEST_ROLLUP_DDL, listRequestDayRows, listRequestRollupDayRows, pruneRequestDayRows, recordRequestDayRows, METER_DAYS_DDL, VERTICAL_OWNERS_BACKFILL, VERTICAL_OWNERS_DDL, closeVerticalOwnerRow, listVerticalOwnerRows, openVerticalOwnerRow, verticalOwnerNow, listMeterDayRows, listMeterDayTakeRows, pruneMeterDayRows, recordMeterDayRows, CONNECT_LINKS_DDL, consumeConnectLinkRow, insertConnectLink, listConnectLinks as listConnectLinkRows, readConnectLink, restoreConnectLinkRow, revokeConnectLinkRow, createFindingRule, findingOfOpsFailure, findingOfSweepRun, pruneFindings, listFindingRules, listFindings, observeFinding, revokeFindingRule, setFindingStatus, assertRowLimit, assertRowOffset, OPS_FAILURE_RETENTION_DAYS, SWEEP_RUN_RETENTION_DAYS, SWEEP_RUNS_INTENT_INDEX, sweepRunsIntentHasKind, MODEL_USAGE_RETENTION_DAYS, foldModelUsage, backoffAt, platformRequestHistoryQuery, platformRequestOf, PLATFORM_REQUEST_COLUMNS, PLATFORM_REQUEST_REDACTION_SQL, platformRequestRedactionParams, platformRequestRedactionQuery, intentPayloadCarriesSubject, redactSubjectJobRuns, eraseSubjectFromModules, moduleRowsErased, moduleErasurePlan, redactSubjectScopeText, redactSubjectDirectoryText, ISSUE_EXEMPLAR_OWNER_BACKFILL_SQL, issueExemplarOwner, JOB_RUN_PATCH_SQL, JOB_RUN_CLAIM_SQL, JOB_RUN_RENEW_SQL, JOB_RUN_BEGIN_SQL, JOB_RUN_MISS_SQL, JOB_RUN_MISS_SETTLE_SQL, admissionMissOutcome, JOB_STEP_RECORD_SQL, JOB_LEASE_EXPIRED_NOTE, assertLeaseMs, DELIVERY_ERROR_REDACTION_SQL, REDACTED_DELIVERY_NOTE, seatScopeTuple, applyScopeRoleChange, changeScopeRole, revokeScopeRoles, scopeRoleHolders, assertModuleDeclared, noteDeclaredKeys, noteReservedKeys, dumpRoleRefusal, reservedGrantRefusal, reservedRoleDefinitionRefusal, reservedRoleRefusal, reservedShapeRefusal, SCOPE_SEATED_ROLES_SQL, SEAT_HOLDING_SCOPE_STATUSES, TENANT_SEATED_ROLES_SQL, admitPeer, boundToPeerDeclarations, peerCallerAt, collectPeers, peerSeats, resolveVerticalInstanceFrom, resolvePeerInstanceFrom, peerVerticalSpellings, samePeerVertical, peerGrantsStatus, systemGrantsStatus, systemScheduleState, systemSwitchedOff, systemSwitchedOffMessage, tenantSystemSwitchedOffMessage, PEER_SWITCHES_DDL, PEER_BINDINGS_DDL, SWITCH_OWED_DDL, SWITCH_FENCES_DDL, TABLE_OWNERS_DDL, assertMigrationLeavesLedgerAlone, recordOwnershipSteps, runMigrationStatements, executableSqlStatements, blankSqlComments, recordWriteSuperseded, switchFencesOf, switchSupersededMessage, SWITCH_KINDS, SYSTEM_SWITCHES_DDL, forgetSwitchesOf, listSystemSwitchRecords, moveSwitch, reassertActionOf, reassertEntry, reassertOffRow, recordSwitchedOff, recordSwitchedOn, restoreSwitchRecord, scopesSwitchedOffFor, switchActionOf, switchAuditSubject, recordAuditOutcome, auditedCapabilityRevoke, auditWarningOf, switchNotFoundMessage, switchRecordsOf, switchedOffOf, switchesBackfillSqlOf, switchesTableExists, tenantHeldOf, tenantHoldsGrant, inUnitMovesToAudit, staleCarryRevertRow, staleCarryReverts, withRecorded, VERSION_MIGRATIONS_DDL, VERTICAL_SCOPE_STORES_DDL, forgetVerticalScopeStores, DEPLOYMENT_WIRE_AUTH_DDL, assertWireAuthFilter, deploymentWireAuthOf, forgetVerticalWireAuth, wireAuthAccessTarget, writeDeploymentWireAuth, indexVersionScopeStores, driverDeclarationsOf, verticalScopeStoresOf, STORE_DRIVER_RELEASES_DDL, legacyStoreDriverConflict, legacyStoreDriverRenames, beginStoreDriverRolloutIn, finishStoreDriverRolloutIn, holdStoreDriverIn, advanceStoreDriverRebuildIn, claimStoreDriverRebuildIn, storeDriverRebuildIn, recordStoreDriverReleaseIn, releaseStoreDriverHoldIn, storeDriverReleaseIn, storeDriverStateIn, storeDriverRolloutPendingIn, storeDriverRolloutWalkedIn, splitManifestMigrations, splitVersionMigrationsBatch, versionMigrationsOf, deriveVersionMigrationDigest, publishedMigrationDigest, migrationChangeRefusal, writeVersionMigrations, denialListQuery, refusalListQuery, mapRefusalRow, denialSummaryQuery, denialTotalsQuery, DENIAL_WINDOW_QUERY, mapDenialRow, mapDenialSummaryBuckets, IMPERSONATION_COLUMNS, IMPERSONATION_DDL, ImpersonationRefused, assertImpersonationWrites, assertModuleEnqueueableKind, assertSessionUsable, impersonationByIdQuery, impersonationListQuery, impersonationRowValues, impersonationStampOf, mapImpersonationRow, newImpersonationSession, resolveRetryPolicy, executorOutcomeOf, isDeliveryRefusal, refusalJournalText, membershipFencesBackfillSql, MEMBERSHIP_FENCES_DDL, membershipFencesTableExists, MEMBERSHIP_FENCE_SINCE_SQL, RAISE_MEMBERSHIP_FENCE_SQL, memberAddedAudit, orgChangeBound, tenantCoverage, isSecretBoxConfigured, unconfiguredSecretBox, createSubjectKeys, generateSealingKeyPair, noSealingKeyMessage, openSealed, sealTo, ConnectionSealingKeyUnavailableError, PermissionDenied, createAtomic, NotSearchable, NotListable, listIndexMigrations, listIndexPlans, listQuery, cursorOf, moduleMigrations, MIGRATION_DIGEST_FENCE_DDL, MIGRATION_DIGEST_MARK_LEGACY, assertJournalDumpCoherent, assertMigrationSql, migrationDivergence, migrationFailedError, migrationSetDivergence, migrationSteps, planMigrations, isSearchIndexTable, searchIndexMigrations, searchIndexPlans, searchLimit, searchMatchExpression, searchQuery, ATTACHMENT_TEXT_DDL, ATTACHMENT_CONDEMNED_DDL, ATTACHMENT_SWEEP_LICENCE_DDL, ATTACHMENT_SWEEP_LICENCE_TABLE, clearOrphanSweepLicence, condemnLicensedOrphanAttachments, consumeOrphanSweepLicence, licensedOrphanIds, recordOrphanSweepLicence, refuseUnlicensedOrphanSweep, fenceAttachmentSweep, refuseCondemnedAttachment, refuseCondemnedInDump, rowlessAttachmentIds, sweepOrphanAttachments, missingAttachmentStore, SETTLED_COPY_STATES, unsettledCopyRefusal, assertAttachmentExtractors, resolveAttachmentTextBounds, assertJobRegistrable, attachmentRecordOfRow, attachmentTextJob, enqueueAttachmentText, ATTACHMENT_TEXT_BACKFILL_JOB, ATTACHMENT_TEXT_JOB, kernelJobFor, queueAttachmentTextBackfill, startAttachmentTextBackfill, attachmentTextBackfillJob, reconcileAttachmentText, recordAttachmentText, searchAttachments, entityVersionQuery, entityVersionOf, assertIfMatch, OUTBOX_ENTITY_INDEX, SCHEDULE_STATE_DDL, SCHEDULE_STATE_REBUILD, scheduleStateHasKind, VERTICAL_EVENTS_DDL, EXPORT_HOPS_SQL, emptyImportResult, IMPORT_CURSORS_SQL, IMPORT_CURSOR_OF_SQL, OUTBOX_MARK_SQL, emittedSinceQuery, emittedReportOf, EMITTED_REPORT_CAP, exportedSinceQuery, IMPORT_CURSOR_ADVANCE_SQL, IMPORT_RECORD_SQL, moveImportCursor, importCursorSourceOf, exportBreaksOf, exportBreakRefusal, assertPromoteReviewCurrent, promoteRaceRefusal, servingRaceRefusal, autoAdmittedProdRefusal, listedPromoteRefusal, rebindRaceRefusal, SERVES_NOW_CONDITION, SERVES_NOW_PREDICATE, servesNowParams, bindExportBreaksOf, bindExportBreakRefusal, scopeMoveOf, runningVersionOf, isPrimaryScope, PROVISIONED_VERSIONS_SQL, installsReconciledOf, strandJudgmentsOf, provisionedVersionsParams, boundShapesColumn, boundShapesOfColumn, installReconciled, CrossVerticalRegistry, exportReadPlan, exportReadQuery, planExportBatch, withheldNote, WIRE_NONCE_DDL, WIRE_NONCE_FULL, claimWireNonceIn, isWireNonceTable, JOB_RUN_DDL, JOB_RUN_DUE_AT, jobRunListLimit, jobRunOf, runDueJobRuns, startJobRun, IDEMPOTENCY_DDL, REFUSALS_TABLE_DDL, REFUSALS_INDEX, refusalInsert, refusalOf, markGuardRefusal, REFUSALS_REBUILD, refusalsAdmitGuards, assertIdempotencyKey, idempotencyLookupQuery, idempotencyPruneStatement, idempotencyRecordStatement, idempotencyOptedOutMessage, replayFor, globalFetch, fetchLikeOf, deadlineFetch, createUlid, facetEvents, readHistory, walkEventCause, walkEventEffects, assertRedrainWindow, readInvocation, readDeadLetters, readLifecycleFlow, readOperationSeries, domainEventOf, readUndrainedOutbox, undrainedEventsOf, connectorCallRecord, noopConnectorCallRecorder, recordConnectorCall, settleConnectionUse, unknownRoleError, callReservedStoreOperation, callScopeStore, observeStoreCall, replayStoreErasures, scopeStoreLifecycleOf, scopeStoreRunnersOf, } from '@substrat-run/kernel';
 import { attributedView, delegatedRevokeSql, writeExplicitTupleIn, grantEntityShapeIn, shapeTopUpBatch, topUpEntityGrantShapes, settlePlatformRequestIn, } from '@substrat-run/kernel';
 import { ADMIN_LOG_INDEXES_SQL, SETTLE_INTENT_SQL, SETTLE_OUTCOME_SQL, settleOutcomeParamsOf, readAuditedOperations, unknownOutcomeOf, } from '@substrat-run/kernel';
 import { INERT_SCOPE_REASON, isPrimaryScopeRow, normalizeUploadMediaType } from '@substrat-run/kernel';
@@ -343,6 +343,10 @@ const KERNEL_DDL = `
   -- only) and its watermark per producer, plus the producer-side (type, id) outbox index the
   -- export read seeks on. Shared with the DO adapter from @substrat-run/kernel.
   ${VERTICAL_EVENTS_DDL}
+  -- RFC wire-signing §4: the nonces of signed calls this scope accepted, and their count.
+  -- Store-local, never dumped. Shared with the DO adapter from @substrat-run/kernel, where the
+  -- column comments are (its time is integer seconds, the envelope's own unit).
+  ${WIRE_NONCE_DDL}
   CREATE TABLE IF NOT EXISTS _substrat_migrations (
     module_id TEXT NOT NULL,
     version TEXT NOT NULL,
@@ -2889,7 +2893,9 @@ export class SqliteScopeHost {
             // A dump written before indexes were excluded may still carry them; skip those
             // too rather than failing a restore over data that is about to be recomputed.
             // Matched without case, as SQLite resolves a table name (#1883 review).
-            const replayable = dumped.filter((t) => !isSearchIndexTable(t.name.toLowerCase()));
+            // The wire nonce store is this store's own (RFC wire-signing §4): a dump that carries it is not
+            // replayed, so a load starts it empty, as it starts a vertical's search index.
+            const replayable = dumped.filter((t) => !isSearchIndexTable(t.name.toLowerCase()) && !isWireNonceTable(t.name));
             // A Durable Object's dump carries spine tables this adapter keeps in its directory, or does
             // not keep at all; they are skipped by name, and any other unknown spine table is refused.
             const loadable = replayable.filter((t) => !DO_SCOPE_ONLY_SPINE_TABLES.has(t.name.toLowerCase()));
@@ -4225,6 +4231,20 @@ export class SqliteScopeHost {
     async redrainCountLocal(scopeId, drainedBefore) {
         return redrainCountOf(this.heldReadDb(scopeId), drainedBefore);
     }
+    /**
+     * RFC wire-signing §4: spend a signed call's nonce in this scope's own store, the hosted
+     * object's `claimWireNonce` here: `true` once, `false` for a nonce already spent or a claim after
+     * `until`, and a throw when the store is at its cap (after its purge committed). Judged against
+     * this host's clock. No provisioned check, as on the hosted object: the call that provisions a
+     * scope spends its nonce there too.
+     */
+    async claimWireNonceLocal(tenantId, scopeId, nonce, until) {
+        const rt = this.runtime(tenantId, scopeId);
+        const answer = await rt.actor.enqueue(() => rt.db.transaction(() => claimWireNonceIn(switchSqlOf(rt.db), nonce, until, Math.floor(Date.parse(this.clock()) / 1000)))());
+        if (answer === 'full')
+            throw substratError('unavailable', WIRE_NONCE_FULL);
+        return answer;
+    }
     /**
      * The read connection of a scope this host holds, for a read that names only the scope id (#2541),
      * with the directory read ONCE. Refused `conflict` before anything is opened: no row, a reaped one
@@ -6519,6 +6539,19 @@ export class SqliteScopeHost {
         const onNode = (node, body) => node.scopeId
             ? this.runtime(node.tenantId, node.scopeId).actor.turn(body)
             : Promise.resolve().then(body);
+        /**
+         * `onNode`, with the write's admin row (#2526). At the tenant node the write is a directory
+         * row, so it and its row are one directory transaction. At a scope node it is in the scope's
+         * own store, which no directory transaction reaches, so the row follows it (#1292's window).
+         */
+        const auditedOnNode = async (node, write, audit) => {
+            if (!node.scopeId) {
+                this.directoryWriteAndAudit(() => { write(); return true; }, audit);
+                return;
+            }
+            await onNode(node, write);
+            audit();
+        };
         /**
          * One kill switch moved on one scope — the ONE body `revokeFromSystem` / `restoreToSystem`
          * (#1666, a module's `system:` authority) and `revokeFromPeer` / `restoreToPeer` (#1706, a
@@ -6775,14 +6808,25 @@ export class SqliteScopeHost {
                 // #2447: judged before the write, against this host's keys and the tenant's other roles, so a
                 // role assigned through a door cannot be widened afterwards. A refusal writes nothing, so a
                 // seat of the role as it was stored keeps working.
-                this.refuseReservedDefinition(tenantId, parsed);
-                const before = this.roles.get(`${tenantId}/${parsed.key}`) ?? null;
-                this.directory
-                    .prepare(`INSERT OR REPLACE INTO _substrat_roles (tenant_id, role_key, permissions, source, holder)
-             VALUES (?, ?, ?, ?, ?)`)
-                    .run(tenantId, parsed.key, JSON.stringify(parsed.permissions), String(parsed.source), parsed.holder ?? 'person');
+                // #2526: the judgement, the row's `before`, the write and the row are one directory unit.
+                let before = null;
+                this.directoryWriteAndAudit(() => {
+                    this.refuseReservedDefinition(tenantId, parsed);
+                    // The row as stored, read as `loadRoles` reads one.
+                    const stored = this.directory
+                        .prepare('SELECT permissions, source, holder FROM _substrat_roles WHERE tenant_id = ? AND role_key = ?')
+                        .get(tenantId, parsed.key);
+                    before = stored
+                        ? { key: parsed.key, permissions: JSON.parse(stored.permissions), source: stored.source, holder: stored.holder ?? undefined }
+                        : null;
+                    this.directory
+                        .prepare(`INSERT OR REPLACE INTO _substrat_roles (tenant_id, role_key, permissions, source, holder)
+               VALUES (?, ?, ?, ?, ?)`)
+                        .run(tenantId, parsed.key, JSON.stringify(parsed.permissions), String(parsed.source), parsed.holder ?? 'person');
+                    return true;
+                }, () => this.recordAdmin(actor, 'defineRole', { tenantId }, before, parsed));
+                // The cache follows the commit, so a rolled-back definition is never served.
                 this.roles.set(`${tenantId}/${parsed.key}`, { ...parsed, holder: parsed.holder ?? 'person' });
-                this.recordAdmin(actor, 'defineRole', { tenantId }, before, parsed);
             },
             listRoles: async (actor, filter) => {
                 const where = [];
@@ -6827,17 +6871,18 @@ export class SqliteScopeHost {
                 }));
             },
             assignRole: async (actor, assignment) => {
-                // #2430: the platform's door — a role mixing reserved and other keys is refused (K-55).
-                this.refuseReservedRole(assignment.node.tenantId, assignment.roleKey, 'platform');
                 const subject = `principal:${assignment.principalId}`;
-                if (assignment.node.scopeId) {
-                    const scopeNode = assignment.node.scopeId;
-                    await onNode(assignment.node, () => writeScopeTuple(assignment.node, subject, `role:${assignment.roleKey}`, `scope:${scopeNode}`));
-                }
-                else {
-                    writeTenantTuple(assignment.node.tenantId, subject, `role:${assignment.roleKey}`, `tenant:${assignment.node.tenantId}`);
-                }
-                this.recordAdmin(actor, 'assignRole', { tenantId: assignment.node.tenantId, scopeId: assignment.node.scopeId }, null, assignment);
+                const { tenantId, scopeId } = assignment.node;
+                // #2430: the platform's door — a role mixing reserved and other keys is refused (K-55).
+                // Before the write opens a scope's file; synchronous with a tenant node's unit, so no
+                // definition lands between the two.
+                this.refuseReservedRole(tenantId, assignment.roleKey, 'platform');
+                await auditedOnNode(assignment.node, () => {
+                    if (scopeId)
+                        writeScopeTuple(assignment.node, subject, `role:${assignment.roleKey}`, `scope:${scopeId}`);
+                    else
+                        writeTenantTuple(tenantId, subject, `role:${assignment.roleKey}`, `tenant:${tenantId}`);
+                }, () => this.recordAdmin(actor, 'assignRole', { tenantId, scopeId }, null, assignment));
             },
             unassignRole: async (actor, assignment) => {
                 // Tombstone (K-21), never DELETE — the checker skips revoked_at rows, so the
@@ -6866,8 +6911,7 @@ export class SqliteScopeHost {
                 // to Z text (#963), and liveness here is a lexicographic `expires_at > ?`.
                 const grant = capabilityGrant.parse(raw);
                 this.refuseReservedGrant([grant.permission]); // #2430
-                await onNode(grant.node, () => writeGrant(`principal:${grant.principalId}`, grant.permission, grant.node, grant.entity, grant.expiresAt));
-                this.recordAdmin(actor, 'grant', { tenantId: grant.node.tenantId, scopeId: grant.node.scopeId }, null, grant);
+                await auditedOnNode(grant.node, () => writeGrant(`principal:${grant.principalId}`, grant.permission, grant.node, grant.entity, grant.expiresAt), () => this.recordAdmin(actor, 'grant', { tenantId: grant.node.tenantId, scopeId: grant.node.scopeId }, null, grant));
             },
             grantEntityShape: async (actor, grant) => {
                 const { tenantId, scopeId } = grant.node;
@@ -6948,29 +6992,35 @@ export class SqliteScopeHost {
                 // row, so a refused grant is gathered by no later provision. A grant recorded before stays.
                 this.refuseReservedGrant([grant.permission]);
                 // Once BEFORE the turn, so a refused grant never opens (and so creates) the scope's
-                // file; then again inside it, with the tuple and the directory row, in ONE body on
-                // the scope actor (#1678) — so the tuple cannot roll back with a stranger's
-                // transaction and leave the directory row (#592) claiming a grant the scope lacks.
+                // file; then again inside it, in ONE body on the scope actor (#1678), so the tuple
+                // cannot roll back with a stranger's transaction.
                 check();
-                const conn = await onNode(grant.node, () => {
-                    const row = check();
-                    writeGrant(subjectRef({ kind: 'connection', id: grant.connectionId }), grant.permission, grant.node, undefined, grant.expiresAt);
-                    // #592: the directory-side record, alongside the tuple. The tuple is checked
-                    // where it lives; this row is what provision/reconcile gather FROM, so the
-                    // grant reaches scopes provisioned after it without a human replaying it.
-                    this.directory
-                        .prepare(`INSERT OR REPLACE INTO _substrat_connection_grants
-                 (connection_id, tenant_id, vertical, permission, scope_id, expires_at,
-                  granted_by, granted_at, revoked_at)
-               VALUES (?, ?, ?, ?, ?, ?, ?, ?, NULL)`)
-                        .run(grant.connectionId, grant.node.tenantId, row.vertical, grant.permission, grant.node.scopeId ?? null, grant.expiresAt ?? null, grant.grantedBy, new Date().toISOString());
-                    return row;
-                });
-                this.recordAdmin(actor, 'grantToConnection', { tenantId: grant.node.tenantId, scopeId: grant.node.scopeId, vertical: conn.vertical }, null, {
-                    connectionId: grant.connectionId,
-                    provider: conn.provider,
-                    permission: grant.permission,
-                    node: grant.node,
+                const tuple = () => writeGrant(subjectRef({ kind: 'connection', id: grant.connectionId }), grant.permission, grant.node, undefined, grant.expiresAt);
+                await onNode(grant.node, () => {
+                    // #2526: the check, the directory record (#592) and the admin row are one directory unit,
+                    // with the tuple too at the tenant node, where it is a directory row. A scope tuple lives
+                    // in the scope's own store and is written after the unit: if it fails, the call throws and
+                    // the record and its row stand without it. The Cloudflare host's reconcile re-seats a
+                    // tuple from the record; this host does not (#2586), so a re-grant is what delivers it.
+                    this.directory.transaction(() => {
+                        const conn = check();
+                        if (!grant.node.scopeId)
+                            tuple();
+                        this.directory
+                            .prepare(`INSERT OR REPLACE INTO _substrat_connection_grants
+                   (connection_id, tenant_id, vertical, permission, scope_id, expires_at,
+                    granted_by, granted_at, revoked_at)
+                 VALUES (?, ?, ?, ?, ?, ?, ?, ?, NULL)`)
+                            .run(grant.connectionId, grant.node.tenantId, conn.vertical, grant.permission, grant.node.scopeId ?? null, grant.expiresAt ?? null, grant.grantedBy, new Date().toISOString());
+                        this.recordAdmin(actor, 'grantToConnection', { tenantId: grant.node.tenantId, scopeId: grant.node.scopeId, vertical: conn.vertical }, null, {
+                            connectionId: grant.connectionId,
+                            provider: conn.provider,
+                            permission: grant.permission,
+                            node: grant.node,
+                        });
+                    })();
+                    if (grant.node.scopeId)
+                        tuple();
                 });
             },
             grantToSystem: async (actor, raw) => {
@@ -6983,6 +7033,7 @@ export class SqliteScopeHost {
                 const grant = systemGrant.parse(raw);
                 const write = () => writeGrant(subjectRef({ kind: 'system', id: grant.moduleId }), grant.permission, grant.node, undefined, grant.expiresAt);
                 const scope = grant.node.scopeId;
+                const audit = () => this.recordAdmin(actor, 'grantToSystem', { tenantId: grant.node.tenantId, scopeId: grant.node.scopeId }, null, { moduleId: grant.moduleId, permission: grant.permission, node: grant.node });
                 if (scope) {
                     // #1666: refused while the module is switched off on this scope. The check and the
                     // write share one synchronous body inside one turn on the scope actor, so no switch
@@ -6997,19 +7048,21 @@ export class SqliteScopeHost {
                         }
                         write();
                     });
+                    audit();
                 }
                 else {
                     // Tenant-level: a directory write, which no scope's transaction can hold. #1743:
                     // refused while the record holds the module off on any scope (`scopesSwitchedOffFor`);
-                    // the record and the tenant tuple share the directory, so this is one transaction.
-                    this.directory.transaction(() => {
+                    // the record, the tenant tuple and (#2526) the row share the directory, so this is one
+                    // transaction.
+                    this.directoryWriteAndAudit(() => {
                         const off = scopesSwitchedOffFor(switchSqlOf(this.directory), grant.node.tenantId, grant.moduleId);
                         if (off.length > 0)
                             throw substratError('conflict', tenantSystemSwitchedOffMessage(grant.moduleId, off));
                         write();
-                    })();
+                        return true;
+                    }, audit);
                 }
-                this.recordAdmin(actor, 'grantToSystem', { tenantId: grant.node.tenantId, scopeId: grant.node.scopeId }, null, { moduleId: grant.moduleId, permission: grant.permission, node: grant.node });
             },
             // #1666: the schedule kill switch and its lever back — `system-switch.ts` is the
             // whole rule, shared with the Cloudflare adapter; this is the directory check, the
@@ -7100,108 +7153,125 @@ export class SqliteScopeHost {
                 // the write in one body, on the scope actor when the node is a scope (#1678).
                 requireOrg(node.tenantId, orgId);
                 this.refuseReservedGrant([permission]); // #2430: an org's members are people
-                await onNode(node, () => {
+                await auditedOnNode(node, () => {
                     requireOrg(node.tenantId, orgId);
                     writeGrant(`org:${orgId}`, permission, node, entity);
-                });
-                this.recordAdmin(actor, 'grantToOrg', { tenantId: node.tenantId, scopeId: node.scopeId }, null, { orgId, permission, node, entity });
+                }, () => this.recordAdmin(actor, 'grantToOrg', { tenantId: node.tenantId, scopeId: node.scopeId }, null, { orgId, permission, node, entity }));
             },
             // -- vertical + version registry (#31) ---------------------------------
             // -- the hostname map (K-26) -------------------------------------------
             bindHostname: async (actor, input) => {
                 const parsed = bindHostnameInput.parse(input);
-                const scope = this.directory
-                    .prepare('SELECT tenant_id, vertical FROM scopes WHERE scope_id = ?')
-                    .get(parsed.scopeId);
-                if (!scope || scope.tenant_id !== parsed.tenantId) {
-                    throw substratError('not_found', `unknown scope ${parsed.scopeId} in tenant ${parsed.tenantId}`);
-                }
-                const existing = this.directory
-                    .prepare(`SELECT h.scope_id AS scope_id, s.status AS scope_status
-               FROM hostnames h LEFT JOIN scopes s ON s.scope_id = h.scope_id
-              WHERE h.hostname = ?`)
-                    .get(parsed.hostname);
-                const holderReleased = existing?.scope_status === 'archived' || existing?.scope_status === 'reaped';
-                if (existing && existing.scope_id !== parsed.scopeId && !holderReleased) {
-                    // A hostname is globally unique and routes to exactly one place. Silently
-                    // rebinding it would move another tenant's traffic. Exception: the holder is
-                    // ARCHIVED or REAPED (a deleted app, storage since wiped) — it released the
-                    // name, so the rebind reclaims it.
-                    throw substratError('conflict', `hostname '${parsed.hostname}' is already bound to another scope`);
-                }
-                // Exactly one canonical per (scope, surface): "which one do certs and
-                // redirects use" has to have one answer, so a new canonical demotes the old.
-                if (parsed.canonical) {
+                // #2526: the scope, the holder it judges, the demotion, the bind and the row are one
+                // directory unit, so a name bound elsewhere meanwhile is refused rather than moved.
+                let vertical = null;
+                this.directoryWriteAndAudit(() => {
+                    const scope = this.directory
+                        .prepare('SELECT tenant_id, vertical FROM scopes WHERE scope_id = ?')
+                        .get(parsed.scopeId);
+                    if (!scope || scope.tenant_id !== parsed.tenantId) {
+                        throw substratError('not_found', `unknown scope ${parsed.scopeId} in tenant ${parsed.tenantId}`);
+                    }
+                    vertical = scope.vertical;
+                    const existing = this.directory
+                        .prepare(`SELECT h.scope_id AS scope_id, s.status AS scope_status
+                 FROM hostnames h LEFT JOIN scopes s ON s.scope_id = h.scope_id
+                WHERE h.hostname = ?`)
+                        .get(parsed.hostname);
+                    const holderReleased = existing?.scope_status === 'archived' || existing?.scope_status === 'reaped';
+                    if (existing && existing.scope_id !== parsed.scopeId && !holderReleased) {
+                        // A hostname is globally unique and routes to exactly one place. Silently
+                        // rebinding it would move another tenant's traffic. Exception: the holder is
+                        // ARCHIVED or REAPED (a deleted app, storage since wiped) — it released the
+                        // name, so the rebind reclaims it.
+                        throw substratError('conflict', `hostname '${parsed.hostname}' is already bound to another scope`);
+                    }
+                    // Exactly one canonical per (scope, surface): "which one do certs and
+                    // redirects use" has to have one answer, so a new canonical demotes the old.
+                    if (parsed.canonical) {
+                        this.directory
+                            .prepare('UPDATE hostnames SET canonical = 0 WHERE scope_id = ? AND surface = ?')
+                            .run(parsed.scopeId, parsed.surface);
+                    }
                     this.directory
-                        .prepare('UPDATE hostnames SET canonical = 0 WHERE scope_id = ? AND surface = ?')
-                        .run(parsed.scopeId, parsed.surface);
-                }
-                this.directory
-                    .prepare(
-                // INSERT OR REPLACE resets issuance columns — a (re)bind starts a fresh
-                // lifecycle, so any prior CF hostname id / DNS records must not linger.
-                `INSERT OR REPLACE INTO hostnames
-               (hostname, tenant_id, scope_id, vertical_slug, surface, region,
-                status, status_note, canonical, created_at, custom_hostname_id, validation_records)
-             VALUES (?, ?, ?, ?, ?, ?, 'pending', NULL, ?, ?, NULL, NULL)`)
-                    .run(parsed.hostname, parsed.tenantId, parsed.scopeId, scope.vertical, parsed.surface, parsed.region, parsed.canonical ? 1 : 0, new Date().toISOString());
-                this.recordAdmin(actor, 'bindHostname', { tenantId: parsed.tenantId, scopeId: parsed.scopeId, vertical: scope.vertical }, null, parsed);
+                        .prepare(
+                    // INSERT OR REPLACE resets issuance columns — a (re)bind starts a fresh
+                    // lifecycle, so any prior CF hostname id / DNS records must not linger.
+                    `INSERT OR REPLACE INTO hostnames
+                 (hostname, tenant_id, scope_id, vertical_slug, surface, region,
+                  status, status_note, canonical, created_at, custom_hostname_id, validation_records)
+               VALUES (?, ?, ?, ?, ?, ?, 'pending', NULL, ?, ?, NULL, NULL)`)
+                        .run(parsed.hostname, parsed.tenantId, parsed.scopeId, scope.vertical, parsed.surface, parsed.region, parsed.canonical ? 1 : 0, new Date().toISOString());
+                    return true;
+                }, () => this.recordAdmin(actor, 'bindHostname', { tenantId: parsed.tenantId, scopeId: parsed.scopeId, vertical }, null, parsed));
             },
             setHostnameStatus: async (actor, raw, status, note) => {
                 const hostname = raw.toLowerCase(); // DNS is case-insensitive; the map is normalized
-                const row = this.directory
-                    .prepare('SELECT tenant_id, scope_id, status FROM hostnames WHERE hostname = ?')
-                    .get(hostname);
-                if (!row)
-                    throw substratError('not_found', `unknown hostname '${hostname}'`);
-                if (row.status === status)
-                    return; // idempotent, and a no-op is not audited
-                this.directory
-                    .prepare('UPDATE hostnames SET status = ?, status_note = ? WHERE hostname = ?')
-                    .run(status, note ?? null, hostname);
-                this.recordAdmin(actor, 'setHostnameStatus', { tenantId: row.tenant_id, scopeId: row.scope_id }, { status: row.status }, { status, note: note ?? null });
+                // #2526: the row's read (its `before`, and the no-op judgement), the write and the
+                // admin row are one directory unit.
+                let row;
+                this.directoryWriteAndAudit(() => {
+                    row = this.directory
+                        .prepare('SELECT tenant_id, scope_id, status FROM hostnames WHERE hostname = ?')
+                        .get(hostname);
+                    if (!row)
+                        throw substratError('not_found', `unknown hostname '${hostname}'`);
+                    if (row.status === status)
+                        return false; // idempotent, and a no-op is not audited
+                    this.directory
+                        .prepare('UPDATE hostnames SET status = ?, status_note = ? WHERE hostname = ?')
+                        .run(status, note ?? null, hostname);
+                    return true;
+                }, () => this.recordAdmin(actor, 'setHostnameStatus', { tenantId: row.tenant_id, scopeId: row.scope_id }, { status: row.status }, { status, note: note ?? null }));
             },
             setHostnameIssuance: async (actor, raw, fields) => {
                 const hostname = raw.toLowerCase(); // DNS is case-insensitive; the map is normalized
-                const row = this.directory
-                    .prepare('SELECT tenant_id, scope_id, status, custom_hostname_id, validation_records FROM hostnames WHERE hostname = ?')
-                    .get(hostname);
-                if (!row)
-                    throw substratError('not_found', `unknown hostname '${hostname}'`);
                 const recordsJson = fields.validationRecords.length
                     ? JSON.stringify(fields.validationRecords)
                     : null;
-                const idUnchanged = fields.customHostnameId === undefined || fields.customHostnameId === row.custom_hostname_id;
-                // A poll that changes nothing is not an event — skip it, so the reconcile sweep
-                // does not append a no-op admin-log row every interval.
-                if (row.status === fields.status &&
-                    (row.validation_records ?? null) === recordsJson &&
-                    idUnchanged) {
-                    return;
-                }
-                if (fields.customHostnameId !== undefined) {
-                    this.directory
-                        .prepare('UPDATE hostnames SET status = ?, status_note = ?, custom_hostname_id = ?, validation_records = ? WHERE hostname = ?')
-                        .run(fields.status, fields.note ?? null, fields.customHostnameId, recordsJson, hostname);
-                }
-                else {
-                    this.directory
-                        .prepare('UPDATE hostnames SET status = ?, status_note = ?, validation_records = ? WHERE hostname = ?')
-                        .run(fields.status, fields.note ?? null, recordsJson, hostname);
-                }
-                this.recordAdmin(actor, 'setHostnameIssuance', { tenantId: row.tenant_id, scopeId: row.scope_id }, { status: row.status }, { status: fields.status, note: fields.note ?? null });
+                // #2526: the row's read (its `before`, and the no-op judgement), the write and the
+                // admin row are one directory unit.
+                let row;
+                this.directoryWriteAndAudit(() => {
+                    row = this.directory
+                        .prepare('SELECT tenant_id, scope_id, status, custom_hostname_id, validation_records FROM hostnames WHERE hostname = ?')
+                        .get(hostname);
+                    if (!row)
+                        throw substratError('not_found', `unknown hostname '${hostname}'`);
+                    const idUnchanged = fields.customHostnameId === undefined || fields.customHostnameId === row.custom_hostname_id;
+                    // A poll that changes nothing is not an event — skip it, so the reconcile sweep
+                    // does not append a no-op admin-log row every interval.
+                    if (row.status === fields.status &&
+                        (row.validation_records ?? null) === recordsJson &&
+                        idUnchanged) {
+                        return false;
+                    }
+                    if (fields.customHostnameId !== undefined) {
+                        this.directory
+                            .prepare('UPDATE hostnames SET status = ?, status_note = ?, custom_hostname_id = ?, validation_records = ? WHERE hostname = ?')
+                            .run(fields.status, fields.note ?? null, fields.customHostnameId, recordsJson, hostname);
+                    }
+                    else {
+                        this.directory
+                            .prepare('UPDATE hostnames SET status = ?, status_note = ?, validation_records = ? WHERE hostname = ?')
+                            .run(fields.status, fields.note ?? null, recordsJson, hostname);
+                    }
+                    return true;
+                }, () => this.recordAdmin(actor, 'setHostnameIssuance', { tenantId: row.tenant_id, scopeId: row.scope_id }, { status: row.status }, { status: fields.status, note: fields.note ?? null }));
             },
             unbindHostname: async (actor, raw, owner) => {
                 const hostname = raw.toLowerCase(); // DNS is case-insensitive; the map is normalized
                 // One statement: the row it removes is the row it audits, and an owner is judged by the
                 // delete itself, so a name rebound to another scope in between is left alone (#2285).
-                const row = this.directory
-                    .prepare(`DELETE FROM hostnames WHERE hostname = ?${owner ? ' AND tenant_id = ? AND scope_id = ?' : ''}
-            RETURNING tenant_id, scope_id, status`)
-                    .get(hostname, ...(owner ? [owner.tenantId, owner.scopeId] : []));
-                if (!row)
-                    return; // idempotent, and a no-op is not audited
-                this.recordAdmin(actor, 'unbindHostname', { tenantId: row.tenant_id, scopeId: row.scope_id }, { hostname, status: row.status }, null);
+                // #2526: the delete and its admin row are one directory unit.
+                let row;
+                this.directoryWriteAndAudit(() => {
+                    row = this.directory
+                        .prepare(`DELETE FROM hostnames WHERE hostname = ?${owner ? ' AND tenant_id = ? AND scope_id = ?' : ''}
+              RETURNING tenant_id, scope_id, status`)
+                        .get(hostname, ...(owner ? [owner.tenantId, owner.scopeId] : []));
+                    return row !== undefined; // idempotent, and a no-op is not audited
+                }, () => this.recordAdmin(actor, 'unbindHostname', { tenantId: row.tenant_id, scopeId: row.scope_id }, { hostname, status: row.status }, null));
             },
             listHostnames: async (actor, filter) => {
                 const where = [];
@@ -7505,8 +7575,7 @@ export class SqliteScopeHost {
                   WHERE c.vertical_slug = ? AND c.channel = 'prod'`)
                             .get(slug);
                         if (prod?.admission_note === AUTO_ADMISSION_NOTE) {
-                            throw substratError('conflict', `vertical '${slug}' prod version ${prod.id} is auto-admitted (private self-serve) — ` +
-                                `a staff admit must vouch for it before listing`);
+                            throw autoAdmittedProdRefusal(slug, prod.id);
                         }
                     }
                     return { listed: existing.listed };
@@ -7618,7 +7687,7 @@ export class SqliteScopeHost {
                 this.recordAccess(actor, 'promotionImpact', { tenantId: null }, { verticalSlug, channel, versionId }, breaks.length);
                 return breaks;
             },
-            promoteVersion: async (actor, verticalSlug, channel, versionId, acknowledge) => {
+            promoteVersion: async (actor, verticalSlug, channel, versionId, acknowledge, options) => {
                 const incoming = await readVersion(versionId);
                 if (!incoming)
                     throw substratError('not_found', `unknown version ${versionId}`);
@@ -7696,6 +7765,17 @@ export class SqliteScopeHost {
                         .get(verticalSlug, channel);
                     if ((now?.version_id ?? null) !== (outgoing?.id ?? null))
                         return false;
+                    // #2565: the listing's rule and the builder's door, read where the listing could land.
+                    const listed = readVertical(verticalSlug)?.listed;
+                    if (listed && options?.unlistedOnly)
+                        throw listedPromoteRefusal();
+                    // A re-promote of what prod already names, and what serves (if anything does), moves
+                    // nothing, so it is not judged again. One whose serve would change what runs is.
+                    const serving = this.servingPointerOfVertical(verticalSlug)?.versionId ?? versionId;
+                    if (listed && channel === 'prod' && (outgoing?.id !== versionId || serving !== versionId) &&
+                        versionAdmission(versionId).admission_note === AUTO_ADMISSION_NOTE) {
+                        throw autoAdmittedProdRefusal(verticalSlug, versionId);
+                    }
                     this.directory
                         .prepare(`INSERT INTO vertical_channels (vertical_slug, channel, version_id, updated_at)
                VALUES (?, ?, ?, ?)
@@ -8389,21 +8469,24 @@ export class SqliteScopeHost {
             },
             createOrg: async (actor, input) => {
                 const parsed = createOrgInput.parse(input);
-                if (readOrg(parsed.tenantId, parsed.id))
-                    return; // idempotent, unaudited
-                // Checked explicitly rather than left to the UNIQUE index: OR IGNORE would
-                // swallow a collision from a DIFFERENT id and report success, silently not
-                // creating the org the caller asked for. Fail closed instead (as createTenant).
-                const slugOwner = this.directory
-                    .prepare('SELECT org_id FROM orgs WHERE tenant_id = ? AND slug = ?')
-                    .get(parsed.tenantId, parsed.slug);
-                if (slugOwner) {
-                    throw substratError('conflict', `org slug '${parsed.slug}' already taken by ${slugOwner.org_id} (slugs are unique per tenant)`);
-                }
-                this.directory
-                    .prepare('INSERT INTO orgs (org_id, tenant_id, slug, name, created_at) VALUES (?, ?, ?, ?, ?)')
-                    .run(parsed.id, parsed.tenantId, parsed.slug, parsed.name, new Date().toISOString());
-                this.recordAdmin(actor, 'createOrg', { tenantId: parsed.tenantId }, null, parsed);
+                // #2526: the checks, the insert and the row are one directory unit.
+                this.directoryWriteAndAudit(() => {
+                    if (readOrg(parsed.tenantId, parsed.id))
+                        return false; // idempotent, unaudited
+                    // Checked explicitly rather than left to the UNIQUE index: OR IGNORE would
+                    // swallow a collision from a DIFFERENT id and report success, silently not
+                    // creating the org the caller asked for. Fail closed instead (as createTenant).
+                    const slugOwner = this.directory
+                        .prepare('SELECT org_id FROM orgs WHERE tenant_id = ? AND slug = ?')
+                        .get(parsed.tenantId, parsed.slug);
+                    if (slugOwner) {
+                        throw substratError('conflict', `org slug '${parsed.slug}' already taken by ${slugOwner.org_id} (slugs are unique per tenant)`);
+                    }
+                    this.directory
+                        .prepare('INSERT INTO orgs (org_id, tenant_id, slug, name, created_at) VALUES (?, ?, ?, ?, ?)')
+                        .run(parsed.id, parsed.tenantId, parsed.slug, parsed.name, new Date().toISOString());
+                    return true;
+                }, () => this.recordAdmin(actor, 'createOrg', { tenantId: parsed.tenantId }, null, parsed));
             },
             listOrgs: async (actor, tenantId) => {
                 const rows = this.directory
@@ -8418,12 +8501,15 @@ export class SqliteScopeHost {
                 return o;
             },
             addMember: async (actor, tenantId, principal, orgId, opts) => {
-                requireOrg(tenantId, orgId);
                 // INSERT OR REPLACE, so re-adding a revoked member clears the tombstone —
                 // they are a member again. The add/revoke history is not lost: it lives in
                 // the append-only admin log, which is where "what happened" belongs. The
                 // tuple carries "what is true now" plus enough to explain a live proof.
-                joinOrg(actor, tenantId, principal, orgId, opts?.expiresAt ?? null);
+                // #2526: the org's check, the tuple and the row are one directory unit.
+                this.directory.transaction(() => {
+                    requireOrg(tenantId, orgId);
+                    joinOrg(actor, tenantId, principal, orgId, opts?.expiresAt ?? null);
+                })();
             },
             applyMembership: async (actor, change) => {
                 // ONE directory transaction, synchronous throughout (#1184): the fence (an add's), the
@@ -8534,6 +8620,8 @@ export class SqliteScopeHost {
                     before = readTenant(tenantId);
                     if (!before)
                         throw substratError('not_found', `unknown tenant: ${tenantId}`);
+                    if (before.status === 'reaped')
+                        throw substratError('conflict', `tenant ${tenantId} is reaped and cannot change status`);
                     return (status === 'deleting'
                         ? this.directory
                             .prepare('UPDATE tenants SET status = ?, deleting_at = ? WHERE tenant_id = ?')
@@ -8789,11 +8877,14 @@ export class SqliteScopeHost {
                 // reason: its shadow tables cannot be replayed (the DO host rejects the name
                 // outright), and it is recomputable — `loadDump` rebuilds it from the content
                 // tables it just loaded. A dump carries the rows, never the index over them.
+                //
+                // The wire nonce store is dropped as well (RFC wire-signing §4): it describes calls this
+                // store accepted, not the scope's data, so a load builds it empty.
                 const defs = db
                     .prepare(`SELECT name, sql FROM sqlite_master
                 WHERE type = 'table' AND name NOT GLOB 'sqlite_*' AND sql IS NOT NULL
                 ORDER BY name`)
-                    .all().filter(({ name }) => !isSearchIndexTable(name));
+                    .all().filter(({ name }) => !isSearchIndexTable(name) && !isWireNonceTable(name));
                 const tables = defs.map(({ name, sql }) => {
                     // `.raw(true)` gives positional rows; cells stay as-is (blobs are Buffers, not
                     // nulled as in a UI read) so the dump is byte-faithful. The name is from the live
@@ -9207,52 +9298,59 @@ export class SqliteScopeHost {
             },
             grantEntitlement: async (actor, tenantId, entitlementKey, plan) => {
                 const input = entitlementGrantInput.parse(plan ?? {});
-                const existing = this.directory
-                    .prepare('SELECT expires_at, quota, plan FROM _substrat_entitlements WHERE tenant_id = ? AND entitlement_key = ?')
-                    .get(tenantId, entitlementKey);
-                // PATCH semantics (entitlementGrantInput): omitted preserves, null clears —
-                // a bare re-grant on an idempotent provisioning path must not erase a
-                // trial's expiry and quietly turn it perpetual.
-                const next = {
-                    expiresAt: input.expiresAt !== undefined ? input.expiresAt : (existing?.expires_at ?? null),
-                    quota: input.quota !== undefined ? input.quota : (existing?.quota ?? null),
-                    plan: input.plan !== undefined ? input.plan : (existing?.plan ?? null),
-                };
-                // Idempotent: a grant that changes nothing is not audited.
-                if (existing &&
-                    existing.expires_at === next.expiresAt &&
-                    existing.quota === next.quota &&
-                    existing.plan === next.plan) {
-                    return;
-                }
-                const now = new Date().toISOString();
-                // granted_at/granted_by restamp on every effective change: a renewal is a
-                // new grant act, and the full history is the admin log below.
-                this.directory
-                    .prepare(`INSERT INTO _substrat_entitlements
-               (tenant_id, entitlement_key, expires_at, quota, plan, granted_at, granted_by)
-             VALUES (?, ?, ?, ?, ?, ?, ?)
-             ON CONFLICT (tenant_id, entitlement_key) DO UPDATE SET
-               expires_at = excluded.expires_at,
-               quota = excluded.quota,
-               plan = excluded.plan,
-               granted_at = excluded.granted_at,
-               granted_by = excluded.granted_by`)
-                    .run(tenantId, entitlementKey, next.expiresAt, next.quota, next.plan, now, actor);
-                this.recordAdmin(actor, 'grantEntitlement', { tenantId }, existing
+                // #2526: the held grant (its `before`, and the no-op judgement), the write and the admin
+                // row are one directory unit.
+                let existing;
+                let next = { expiresAt: null, quota: null, plan: null };
+                this.directoryWriteAndAudit(() => {
+                    existing = this.directory
+                        .prepare('SELECT expires_at, quota, plan FROM _substrat_entitlements WHERE tenant_id = ? AND entitlement_key = ?')
+                        .get(tenantId, entitlementKey);
+                    // PATCH semantics (entitlementGrantInput): omitted preserves, null clears —
+                    // a bare re-grant on an idempotent provisioning path must not erase a
+                    // trial's expiry and quietly turn it perpetual.
+                    next = {
+                        expiresAt: input.expiresAt !== undefined ? input.expiresAt : (existing?.expires_at ?? null),
+                        quota: input.quota !== undefined ? input.quota : (existing?.quota ?? null),
+                        plan: input.plan !== undefined ? input.plan : (existing?.plan ?? null),
+                    };
+                    // Idempotent: a grant that changes nothing is not audited.
+                    if (existing &&
+                        existing.expires_at === next.expiresAt &&
+                        existing.quota === next.quota &&
+                        existing.plan === next.plan) {
+                        return false;
+                    }
+                    const now = new Date().toISOString();
+                    // granted_at/granted_by restamp on every effective change: a renewal is a
+                    // new grant act, and the full history is the admin log.
+                    this.directory
+                        .prepare(`INSERT INTO _substrat_entitlements
+                 (tenant_id, entitlement_key, expires_at, quota, plan, granted_at, granted_by)
+               VALUES (?, ?, ?, ?, ?, ?, ?)
+               ON CONFLICT (tenant_id, entitlement_key) DO UPDATE SET
+                 expires_at = excluded.expires_at,
+                 quota = excluded.quota,
+                 plan = excluded.plan,
+                 granted_at = excluded.granted_at,
+                 granted_by = excluded.granted_by`)
+                        .run(tenantId, entitlementKey, next.expiresAt, next.quota, next.plan, now, actor);
+                    return true;
+                }, () => this.recordAdmin(actor, 'grantEntitlement', { tenantId }, existing
                     ? { entitlementKey, expiresAt: existing.expires_at, quota: existing.quota, plan: existing.plan }
-                    : null, { entitlementKey, ...next });
+                    : null, { entitlementKey, ...next }));
             },
             revokeEntitlement: async (actor, tenantId, entitlementKey) => {
-                const existing = this.directory
-                    .prepare('SELECT expires_at, quota, plan FROM _substrat_entitlements WHERE tenant_id = ? AND entitlement_key = ?')
-                    .get(tenantId, entitlementKey);
-                if (!existing)
-                    return; // nothing held, nothing changed
-                this.directory
-                    .prepare('DELETE FROM _substrat_entitlements WHERE tenant_id = ? AND entitlement_key = ?')
-                    .run(tenantId, entitlementKey);
-                this.recordAdmin(actor, 'revokeEntitlement', { tenantId }, { entitlementKey, expiresAt: existing.expires_at, quota: existing.quota, plan: existing.plan }, null);
+                // #2526: one statement removes the grant and answers what it held, which is the admin
+                // row's `before`; the row commits with it.
+                let removed;
+                this.directoryWriteAndAudit(() => {
+                    removed = this.directory
+                        .prepare(`DELETE FROM _substrat_entitlements WHERE tenant_id = ? AND entitlement_key = ?
+              RETURNING expires_at, quota, plan`)
+                        .get(tenantId, entitlementKey);
+                    return removed !== undefined; // nothing held, nothing changed
+                }, () => this.recordAdmin(actor, 'revokeEntitlement', { tenantId }, { entitlementKey, expiresAt: removed.expires_at, quota: removed.quota, plan: removed.plan }, null));
             },
             listEntitlements: async (actor, tenantId) => {
                 const grants = this.directory