@substrat-run/adapter-sqlite 0.162.0 → 0.164.0

package/dist/index.js

@@ -2,8 +2,8 @@ import { createHash } from 'node:crypto';
 import { closeSync, existsSync, fstatSync, mkdirSync, openSync, readdirSync, readFileSync, readSync, realpathSync, rmSync, writeFileSync, writeSync } from 'node:fs';
 import { dirname, join } from 'node:path';
 import Database from 'better-sqlite3';
-import { accessLogEntry, adminLogEntry, delegatedReadParams, operationSeriesCount, opsFailureEntry, opsFailureFingerprint, issueEntry, FRESHNESS_HEARTBEAT_MINUTES, sweepRunEntry, modelUsageEntry, ATTACHMENT_ADDED, ATTACHMENT_REMOVED, createTenantInput, domainEvent, domainEventInput, exportReadInput, importBatch, importCursorMove, exportsOfManifestJson, assertNoBindingShapeBreak, importsOfManifestJson, connectionLandingsOfManifestJson, entitlementGrant, entitlementGrantInput, eventId, meterReading, platformRequestInput, platformRequestId, identityLink, identityPool, instant, isSubstratError, connection, capabilityGrant, connectionGrant, connectionGrantRecord, connectionSecret, systemGrant, systemSwitch, systemSwitchRecord, peerSwitch, verticalCaller, verticalSlug as verticalSlugOf, subjectRef, requestFingerprint, createConnectionInput, connectLinkFilter, connectLinkKey, consumeConnectLinkInput, mintConnectLinkInput, projectedConnectionGrant, projectedConnectionKey, moduleManifest, createOrgInput, promotionAcknowledgement, bindAcknowledgement, bindHostnameInput, channelHistoryEntry, hostnameBinding, publishVersionInput, AUTO_ADMISSION_NOTE, routeTarget, ROUTE_SCOPE_HOSTNAMES_MAX, registerVerticalInput, vertical as verticalSchema, verticalChannel, verticalVersion, objectRef, entityObjectRef, assertModuleEmittableType, assertKernelAuthoredType, grantRefFromProof, org as orgSchema, orgMembership, principalId, resolvedIdentity, identityMembership, roleDefinition, scope as scopeSchema, tenant as tenantSchema, tenantRole, principalBecomeCapabilityInput, subjectShredReceipt, SCOPE_TABLE_PAGE_DEFAULT, SCOPE_TABLE_PAGE_MAX, SCOPE_QUERY_ROW_MAX, verticalServingState, deploymentWireAuth, callsOfManifestJson, outboundOfManifestJson, listLimitOf, pageOf, countedPageOf, SCOPE_GATE_REASONS, substratError, assertReplayableDump, delegatedReadRecord, ownerTransferAudit, memberChangeAudit, peerBindingAudit, connectionBindingAudit, copyMarkAudit, orphanSweepAudit, redrainEventsInput, REDRAIN_BATCH, errorCodeOf, } from '@substrat-run/contracts';
-import { actorOf, asPrincipal, assertAllowed, assertNoSecret, assertPermissionKey, CAPABILITY_DDL, UPLOAD_LINK_DDL, createAttachmentVerbs, inspectUploadLink, redeemUploadLinkInTransaction, redeemOrReplayUploadLink, COPY_ORIGIN_DDL, ENTITY_STATE_MOVES_DDL, CAPABILITY_EXCHANGE_OPERATION, CAPABILITY_BECOME_MINT_OPERATION, becomeMintCheck, mintBecomeCapabilityAsPrincipal, revokeBecomeCapabilityAsPrincipal, readBecomeLinkStates, ENTITY_UNBIND_OPERATION, allowedFor, unbindEntityHolderBounded, capabilityAttachmentWriteRefused, capabilityTokenHash, createCapabilityVerbs, createEntityEdgeVerbs, createEntityStateVerbs, createTrashedReads, CONTINUATION_POSITION_CAP, visibleContinuation, searchStateWhere, uncheckedView, addStatePlans, addUpdatedStampPlans, watchUpdatedStamps, entityStateMigrations, assertNoCallerPurge, assertPlatformRequestRoom, isUnreachableParent, heldPurgePass, purgeDueOf, purgeHeldBy, lifecycleRefusal, scopeNotHeldRefusal, purgeOnlyKeysOf, purgeReportOf, purgeStillDue, refuseTrashedTarget, assertBoundOperations, checkHeldOperationsOf, countChecks, noteUncheckedCompletion, registerTrashTargets, runPurgePass, withheldKeysFor, statefulTablesOf, afterMigration, afterRuntimeDdl, derivesAnything, repairDerivedObjects, StateColumnLost, exchangeCapability as exchangeCapabilitySecret, guardSecrets, mintBecomeCapability, plausibleSessionToken, readCapabilityPage, redactSecrets, redactSecretText, moduleLog, consoleLogSink, asyncInvocationId, asyncLinePass, consoleInvocationLineSink, resolveCapabilitySession, revokeCapabilityAsPlatform, assertReadOnlyQuery, attachmentBlobKey, attachmentSha256, isSizedByteStream, knownLengthStream, openAttachmentByteStream, putAttachmentBytes, entitlementDenial, requiredEntitlementFor, foldMeterReading, guardSpine, guardSqlLimits, DO_SQL_LIMITS, tooManyResultColumns, tooManyTableColumns, parseValidationRecords, readableScopes, resolveScopeRecord, ulid, ISSUE_RETENTION_DAYS, telemetryRetentionStatements, FINDINGS_DDL, ATTACHMENT_BYTES_SQL, SCOPE_STORAGE_DDL, forgetScopeStorage, listScopeAttachmentStorageRows, retireScopeStorage, listScopeStorageAttemptRows, listScopeStorageRows, listScopeStoreStorageRows, pruneScopeStorageRows, recordScopeStorageRows, REQUEST_ROLLUP_DDL, listRequestDayRows, listRequestRollupDayRows, pruneRequestDayRows, recordRequestDayRows, METER_DAYS_DDL, VERTICAL_OWNERS_BACKFILL, VERTICAL_OWNERS_DDL, closeVerticalOwnerRow, listVerticalOwnerRows, openVerticalOwnerRow, verticalOwnerNow, listMeterDayRows, listMeterDayTakeRows, pruneMeterDayRows, recordMeterDayRows, CONNECT_LINKS_DDL, consumeConnectLinkRow, insertConnectLink, listConnectLinks as listConnectLinkRows, readConnectLink, restoreConnectLinkRow, revokeConnectLinkRow, createFindingRule, findingOfOpsFailure, findingOfSweepRun, pruneFindings, listFindingRules, listFindings, observeFinding, revokeFindingRule, setFindingStatus, assertRowLimit, assertRowOffset, OPS_FAILURE_RETENTION_DAYS, SWEEP_RUN_RETENTION_DAYS, SWEEP_RUNS_INTENT_INDEX, sweepRunsIntentHasKind, MODEL_USAGE_RETENTION_DAYS, foldModelUsage, backoffAt, platformRequestHistoryQuery, platformRequestOf, PLATFORM_REQUEST_COLUMNS, PLATFORM_REQUEST_REDACTION_SQL, platformRequestRedactionParams, platformRequestRedactionQuery, intentPayloadCarriesSubject, redactSubjectJobRuns, eraseSubjectFromModules, moduleRowsErased, moduleErasurePlan, redactSubjectScopeText, redactSubjectDirectoryText, ISSUE_EXEMPLAR_OWNER_BACKFILL_SQL, issueExemplarOwner, JOB_RUN_PATCH_SQL, JOB_RUN_CLAIM_SQL, JOB_RUN_RENEW_SQL, JOB_RUN_BEGIN_SQL, JOB_RUN_MISS_SQL, JOB_RUN_MISS_SETTLE_SQL, admissionMissOutcome, JOB_STEP_RECORD_SQL, JOB_LEASE_EXPIRED_NOTE, assertLeaseMs, DELIVERY_ERROR_REDACTION_SQL, REDACTED_DELIVERY_NOTE, seatScopeTuple, applyScopeRoleChange, changeScopeRole, revokeScopeRoles, scopeRoleHolders, assertModuleDeclared, noteDeclaredKeys, noteReservedKeys, dumpRoleRefusal, reservedGrantRefusal, reservedRoleDefinitionRefusal, reservedRoleRefusal, reservedShapeRefusal, SCOPE_SEATED_ROLES_SQL, SEAT_HOLDING_SCOPE_STATUSES, TENANT_SEATED_ROLES_SQL, admitPeer, boundToPeerDeclarations, peerCallerAt, collectPeers, peerSeats, resolveVerticalInstanceFrom, resolvePeerInstanceFrom, peerVerticalSpellings, samePeerVertical, peerGrantsStatus, systemGrantsStatus, systemScheduleState, systemSwitchedOff, systemSwitchedOffMessage, tenantSystemSwitchedOffMessage, PEER_SWITCHES_DDL, PEER_BINDINGS_DDL, SWITCH_OWED_DDL, SWITCH_FENCES_DDL, TABLE_OWNERS_DDL, assertMigrationLeavesLedgerAlone, recordOwnershipSteps, runMigrationStatements, executableSqlStatements, blankSqlComments, recordWriteSuperseded, switchFencesOf, switchSupersededMessage, SWITCH_KINDS, SYSTEM_SWITCHES_DDL, forgetSwitchesOf, listSystemSwitchRecords, moveSwitch, reassertActionOf, reassertEntry, reassertOffRow, recordSwitchedOff, recordSwitchedOn, restoreSwitchRecord, scopesSwitchedOffFor, switchActionOf, switchAuditSubject, recordAuditOutcome, auditedCapabilityRevoke, auditWarningOf, switchNotFoundMessage, switchRecordsOf, switchedOffOf, switchesBackfillSqlOf, switchesTableExists, tenantHeldOf, tenantHoldsGrant, inUnitMovesToAudit, staleCarryRevertRow, staleCarryReverts, withRecorded, VERSION_MIGRATIONS_DDL, VERTICAL_SCOPE_STORES_DDL, forgetVerticalScopeStores, DEPLOYMENT_WIRE_AUTH_DDL, assertWireAuthFilter, deploymentWireAuthOf, forgetVerticalWireAuth, wireAuthAccessTarget, writeDeploymentWireAuth, indexVersionScopeStores, driverDeclarationsOf, verticalScopeStoresOf, STORE_DRIVER_RELEASES_DDL, legacyStoreDriverConflict, legacyStoreDriverRenames, beginStoreDriverRolloutIn, finishStoreDriverRolloutIn, holdStoreDriverIn, advanceStoreDriverRebuildIn, claimStoreDriverRebuildIn, storeDriverRebuildIn, recordStoreDriverReleaseIn, releaseStoreDriverHoldIn, storeDriverReleaseIn, storeDriverStateIn, storeDriverRolloutPendingIn, storeDriverRolloutWalkedIn, splitManifestMigrations, splitVersionMigrationsBatch, versionMigrationsOf, deriveVersionMigrationDigest, publishedMigrationDigest, migrationChangeRefusal, writeVersionMigrations, denialListQuery, refusalListQuery, mapRefusalRow, denialSummaryQuery, denialTotalsQuery, DENIAL_WINDOW_QUERY, mapDenialRow, mapDenialSummaryBuckets, IMPERSONATION_COLUMNS, IMPERSONATION_DDL, ImpersonationRefused, assertImpersonationWrites, assertModuleEnqueueableKind, assertSessionUsable, impersonationByIdQuery, impersonationListQuery, impersonationRowValues, impersonationStampOf, mapImpersonationRow, newImpersonationSession, resolveRetryPolicy, executorOutcomeOf, isDeliveryRefusal, refusalJournalText, membershipFencesBackfillSql, MEMBERSHIP_FENCES_DDL, membershipFencesTableExists, MEMBERSHIP_FENCE_SINCE_SQL, RAISE_MEMBERSHIP_FENCE_SQL, memberAddedAudit, orgChangeBound, tenantCoverage, isSecretBoxConfigured, unconfiguredSecretBox, createSubjectKeys, generateSealingKeyPair, noSealingKeyMessage, openSealed, sealTo, ConnectionSealingKeyUnavailableError, PermissionDenied, createAtomic, NotSearchable, NotListable, listIndexMigrations, listIndexPlans, listQuery, cursorOf, moduleMigrations, MIGRATION_DIGEST_FENCE_DDL, MIGRATION_DIGEST_MARK_LEGACY, assertJournalDumpCoherent, assertMigrationSql, migrationDivergence, migrationFailedError, migrationSetDivergence, migrationSteps, planMigrations, isSearchIndexTable, searchIndexMigrations, searchIndexPlans, searchLimit, searchMatchExpression, searchQuery, ATTACHMENT_TEXT_DDL, ATTACHMENT_CONDEMNED_DDL, ATTACHMENT_SWEEP_LICENCE_DDL, ATTACHMENT_SWEEP_LICENCE_TABLE, clearOrphanSweepLicence, condemnLicensedOrphanAttachments, consumeOrphanSweepLicence, licensedOrphanIds, recordOrphanSweepLicence, refuseUnlicensedOrphanSweep, fenceAttachmentSweep, refuseCondemnedAttachment, refuseCondemnedInDump, rowlessAttachmentIds, sweepOrphanAttachments, missingAttachmentStore, SETTLED_COPY_STATES, unsettledCopyRefusal, assertAttachmentExtractors, resolveAttachmentTextBounds, assertJobRegistrable, attachmentRecordOfRow, attachmentTextJob, enqueueAttachmentText, ATTACHMENT_TEXT_BACKFILL_JOB, ATTACHMENT_TEXT_JOB, kernelJobFor, queueAttachmentTextBackfill, startAttachmentTextBackfill, attachmentTextBackfillJob, reconcileAttachmentText, recordAttachmentText, searchAttachments, entityVersionQuery, entityVersionOf, assertIfMatch, OUTBOX_ENTITY_INDEX, SCHEDULE_STATE_DDL, SCHEDULE_STATE_REBUILD, scheduleStateHasKind, VERTICAL_EVENTS_DDL, EXPORT_HOPS_SQL, emptyImportResult, IMPORT_CURSORS_SQL, IMPORT_CURSOR_OF_SQL, OUTBOX_MARK_SQL, emittedSinceQuery, emittedReportOf, EMITTED_REPORT_CAP, exportedSinceQuery, IMPORT_CURSOR_ADVANCE_SQL, IMPORT_RECORD_SQL, moveImportCursor, importCursorSourceOf, exportBreaksOf, exportBreakRefusal, assertPromoteReviewCurrent, promoteRaceRefusal, servingRaceRefusal, rebindRaceRefusal, SERVES_NOW_CONDITION, SERVES_NOW_PREDICATE, servesNowParams, bindExportBreaksOf, bindExportBreakRefusal, scopeMoveOf, runningVersionOf, isPrimaryScope, PROVISIONED_VERSIONS_SQL, installsReconciledOf, strandJudgmentsOf, provisionedVersionsParams, boundShapesColumn, boundShapesOfColumn, installReconciled, CrossVerticalRegistry, exportReadPlan, exportReadQuery, planExportBatch, withheldNote, JOB_RUN_DDL, JOB_RUN_DUE_AT, jobRunListLimit, jobRunOf, runDueJobRuns, startJobRun, IDEMPOTENCY_DDL, REFUSALS_TABLE_DDL, REFUSALS_INDEX, refusalInsert, refusalOf, markGuardRefusal, REFUSALS_REBUILD, refusalsAdmitGuards, assertIdempotencyKey, idempotencyLookupQuery, idempotencyPruneStatement, idempotencyRecordStatement, idempotencyOptedOutMessage, replayFor, globalFetch, fetchLikeOf, deadlineFetch, createUlid, facetEvents, readHistory, walkEventCause, walkEventEffects, assertRedrainWindow, readInvocation, readDeadLetters, readLifecycleFlow, readOperationSeries, domainEventOf, readUndrainedOutbox, undrainedEventsOf, connectorCallRecord, noopConnectorCallRecorder, recordConnectorCall, settleConnectionUse, unknownRoleError, callReservedStoreOperation, callScopeStore, observeStoreCall, replayStoreErasures, scopeStoreLifecycleOf, scopeStoreRunnersOf, } from '@substrat-run/kernel';
+import { accessLogEntry, adminLogEntry, delegatedReadParams, operationSeriesCount, opsFailureEntry, opsFailureFingerprint, issueEntry, FRESHNESS_HEARTBEAT_MINUTES, sweepRunEntry, modelUsageEntry, ATTACHMENT_ADDED, ATTACHMENT_REMOVED, createTenantInput, domainEvent, domainEventInput, exportReadInput, importBatch, importCursorMove, exportsOfManifestJson, assertNoBindingShapeBreak, importsOfManifestJson, connectionLandingsOfManifestJson, connectorsOfManifestJson, entitlementGrant, entitlementGrantInput, eventId, meterReading, platformRequestInput, platformRequestId, identityLink, identityPool, instant, isSubstratError, connection, capabilityGrant, connectionGrant, connectionGrantRecord, connectionSecret, systemGrant, systemSwitch, systemSwitchRecord, peerSwitch, verticalCaller, verticalSlug as verticalSlugOf, subjectRef, requestFingerprint, createConnectionInput, connectLinkFilter, connectLinkKey, consumeConnectLinkInput, mintConnectLinkInput, projectedConnectionGrant, projectedConnectionKey, moduleManifest, createOrgInput, promotionAcknowledgement, bindAcknowledgement, bindHostnameInput, channelHistoryEntry, hostnameBinding, publishVersionInput, AUTO_ADMISSION_NOTE, routeTarget, ROUTE_SCOPE_HOSTNAMES_MAX, registerVerticalInput, vertical as verticalSchema, verticalChannel, verticalVersion, objectRef, entityObjectRef, assertModuleEmittableType, assertKernelAuthoredType, grantRefFromProof, org as orgSchema, orgMembership, principalId, resolvedIdentity, identityMembership, roleDefinition, scope as scopeSchema, tenant as tenantSchema, tenantRole, principalBecomeCapabilityInput, subjectShredReceipt, SCOPE_TABLE_PAGE_DEFAULT, SCOPE_TABLE_PAGE_MAX, SCOPE_QUERY_ROW_MAX, verticalServingState, deploymentWireAuth, callsOfManifestJson, outboundOfManifestJson, listLimitOf, pageOf, countedPageOf, SCOPE_GATE_REASONS, substratError, assertReplayableDump, delegatedReadRecord, ownerTransferAudit, memberChangeAudit, peerBindingAudit, connectionBindingAudit, copyMarkAudit, orphanSweepAudit, redrainEventsInput, REDRAIN_BATCH, errorCodeOf, } from '@substrat-run/contracts';
+import { actorOf, asPrincipal, assertAllowed, assertNoSecret, assertPermissionKey, CAPABILITY_DDL, UPLOAD_LINK_DDL, createAttachmentVerbs, inspectUploadLink, redeemUploadLinkInTransaction, redeemOrReplayUploadLink, COPY_ORIGIN_DDL, ENTITY_STATE_MOVES_DDL, CAPABILITY_EXCHANGE_OPERATION, CAPABILITY_BECOME_MINT_OPERATION, becomeMintCheck, mintBecomeCapabilityAsPrincipal, revokeBecomeCapabilityAsPrincipal, readBecomeLinkStates, ENTITY_UNBIND_OPERATION, allowedFor, unbindEntityHolderBounded, capabilityAttachmentWriteRefused, capabilityTokenHash, createCapabilityVerbs, createEntityEdgeVerbs, createEntityStateVerbs, createTrashedReads, CONTINUATION_POSITION_CAP, visibleContinuation, searchStateWhere, uncheckedView, addStatePlans, addUpdatedStampPlans, watchUpdatedStamps, entityStateMigrations, assertNoCallerPurge, assertPlatformRequestRoom, isUnreachableParent, heldPurgePass, purgeDueOf, purgeHeldBy, lifecycleRefusal, scopeNotHeldRefusal, purgeOnlyKeysOf, purgeReportOf, purgeStillDue, refuseTrashedTarget, assertBoundOperations, checkHeldOperationsOf, countChecks, noteUncheckedCompletion, registerTrashTargets, runPurgePass, withheldKeysFor, statefulTablesOf, afterMigration, afterRuntimeDdl, derivesAnything, repairDerivedObjects, StateColumnLost, exchangeCapability as exchangeCapabilitySecret, guardSecrets, mintBecomeCapability, plausibleSessionToken, readCapabilityPage, redactSecrets, redactSecretText, moduleLog, consoleLogSink, asyncInvocationId, asyncLinePass, consoleInvocationLineSink, resolveCapabilitySession, revokeCapabilityAsPlatform, assertReadOnlyQuery, attachmentBlobKey, attachmentSha256, isSizedByteStream, knownLengthStream, openAttachmentByteStream, putAttachmentBytes, entitlementDenial, requiredEntitlementFor, foldMeterReading, guardSpine, guardSqlLimits, DO_SQL_LIMITS, tooManyResultColumns, tooManyTableColumns, parseValidationRecords, readableScopes, resolveScopeRecord, ulid, ISSUE_RETENTION_DAYS, telemetryRetentionStatements, FINDINGS_DDL, ATTACHMENT_BYTES_SQL, SCOPE_STORAGE_DDL, forgetScopeStorage, listScopeAttachmentStorageRows, retireScopeStorage, listScopeStorageAttemptRows, listScopeStorageRows, listScopeStoreStorageRows, pruneScopeStorageRows, recordScopeStorageRows, REQUEST_ROLLUP_DDL, listRequestDayRows, listRequestRollupDayRows, pruneRequestDayRows, recordRequestDayRows, METER_DAYS_DDL, VERTICAL_OWNERS_BACKFILL, VERTICAL_OWNERS_DDL, closeVerticalOwnerRow, listVerticalOwnerRows, openVerticalOwnerRow, verticalOwnerNow, listMeterDayRows, listMeterDayTakeRows, pruneMeterDayRows, recordMeterDayRows, CONNECT_LINKS_DDL, consumeConnectLinkRow, insertConnectLink, listConnectLinks as listConnectLinkRows, readConnectLink, restoreConnectLinkRow, revokeConnectLinkRow, createFindingRule, findingOfOpsFailure, findingOfSweepRun, pruneFindings, listFindingRules, listFindings, observeFinding, revokeFindingRule, setFindingStatus, assertRowLimit, assertRowOffset, OPS_FAILURE_RETENTION_DAYS, SWEEP_RUN_RETENTION_DAYS, SWEEP_RUNS_INTENT_INDEX, sweepRunsIntentHasKind, MODEL_USAGE_RETENTION_DAYS, foldModelUsage, backoffAt, platformRequestHistoryQuery, platformRequestOf, PLATFORM_REQUEST_COLUMNS, PLATFORM_REQUEST_REDACTION_SQL, platformRequestRedactionParams, platformRequestRedactionQuery, intentPayloadCarriesSubject, redactSubjectJobRuns, eraseSubjectFromModules, moduleRowsErased, moduleErasurePlan, redactSubjectScopeText, redactSubjectDirectoryText, ISSUE_EXEMPLAR_OWNER_BACKFILL_SQL, issueExemplarOwner, JOB_RUN_PATCH_SQL, JOB_RUN_CLAIM_SQL, JOB_RUN_RENEW_SQL, JOB_RUN_BEGIN_SQL, JOB_RUN_MISS_SQL, JOB_RUN_MISS_SETTLE_SQL, admissionMissOutcome, JOB_STEP_RECORD_SQL, JOB_LEASE_EXPIRED_NOTE, assertLeaseMs, DELIVERY_ERROR_REDACTION_SQL, REDACTED_DELIVERY_NOTE, seatScopeTuple, applyScopeRoleChange, changeScopeRole, revokeScopeRoles, scopeRoleHolders, assertModuleDeclared, noteDeclaredKeys, noteReservedKeys, dumpRoleRefusal, reservedGrantRefusal, reservedRoleDefinitionRefusal, reservedRoleRefusal, reservedShapeRefusal, SCOPE_SEATED_ROLES_SQL, SEAT_HOLDING_SCOPE_STATUSES, TENANT_SEATED_ROLES_SQL, admitPeer, boundToPeerDeclarations, peerCallerAt, collectPeers, peerSeats, resolveVerticalInstanceFrom, resolvePeerInstanceFrom, peerVerticalSpellings, samePeerVertical, peerGrantsStatus, systemGrantsStatus, systemScheduleState, systemSwitchedOff, systemSwitchedOffMessage, tenantSystemSwitchedOffMessage, PEER_SWITCHES_DDL, PEER_BINDINGS_DDL, SWITCH_OWED_DDL, SWITCH_FENCES_DDL, TABLE_OWNERS_DDL, assertMigrationLeavesLedgerAlone, recordOwnershipSteps, runMigrationStatements, executableSqlStatements, blankSqlComments, recordWriteSuperseded, switchFencesOf, switchSupersededMessage, SWITCH_KINDS, SYSTEM_SWITCHES_DDL, forgetSwitchesOf, listSystemSwitchRecords, moveSwitch, reassertActionOf, reassertEntry, reassertOffRow, recordSwitchedOff, recordSwitchedOn, restoreSwitchRecord, scopesSwitchedOffFor, switchActionOf, switchAuditSubject, recordAuditOutcome, auditedCapabilityRevoke, auditWarningOf, switchNotFoundMessage, switchRecordsOf, switchedOffOf, switchesBackfillSqlOf, switchesTableExists, tenantHeldOf, tenantHoldsGrant, inUnitMovesToAudit, staleCarryRevertRow, staleCarryReverts, withRecorded, VERSION_MIGRATIONS_DDL, VERTICAL_SCOPE_STORES_DDL, forgetVerticalScopeStores, DEPLOYMENT_WIRE_AUTH_DDL, assertWireAuthFilter, deploymentWireAuthOf, forgetVerticalWireAuth, wireAuthAccessTarget, writeDeploymentWireAuth, indexVersionScopeStores, driverDeclarationsOf, verticalScopeStoresOf, STORE_DRIVER_RELEASES_DDL, legacyStoreDriverConflict, legacyStoreDriverRenames, beginStoreDriverRolloutIn, finishStoreDriverRolloutIn, holdStoreDriverIn, advanceStoreDriverRebuildIn, claimStoreDriverRebuildIn, storeDriverRebuildIn, recordStoreDriverReleaseIn, releaseStoreDriverHoldIn, storeDriverReleaseIn, storeDriverStateIn, storeDriverRolloutPendingIn, storeDriverRolloutWalkedIn, splitManifestMigrations, splitVersionMigrationsBatch, versionMigrationsOf, deriveVersionMigrationDigest, publishedMigrationDigest, migrationChangeRefusal, writeVersionMigrations, denialListQuery, refusalListQuery, mapRefusalRow, denialSummaryQuery, denialTotalsQuery, DENIAL_WINDOW_QUERY, mapDenialRow, mapDenialSummaryBuckets, IMPERSONATION_COLUMNS, IMPERSONATION_DDL, ImpersonationRefused, assertImpersonationWrites, assertModuleEnqueueableKind, assertSessionUsable, impersonationByIdQuery, impersonationListQuery, impersonationRowValues, impersonationStampOf, mapImpersonationRow, newImpersonationSession, resolveRetryPolicy, executorOutcomeOf, isDeliveryRefusal, refusalJournalText, membershipFencesBackfillSql, MEMBERSHIP_FENCES_DDL, membershipFencesTableExists, MEMBERSHIP_FENCE_SINCE_SQL, RAISE_MEMBERSHIP_FENCE_SQL, memberAddedAudit, orgChangeBound, tenantCoverage, isSecretBoxConfigured, unconfiguredSecretBox, createSubjectKeys, generateSealingKeyPair, noSealingKeyMessage, openSealed, sealTo, ConnectionSealingKeyUnavailableError, PermissionDenied, createAtomic, NotSearchable, NotListable, listIndexMigrations, listIndexPlans, listQuery, cursorOf, moduleMigrations, MIGRATION_DIGEST_FENCE_DDL, MIGRATION_DIGEST_MARK_LEGACY, assertJournalDumpCoherent, assertMigrationSql, migrationDivergence, migrationFailedError, migrationSetDivergence, migrationSteps, planMigrations, isSearchIndexTable, searchIndexMigrations, searchIndexPlans, searchLimit, searchMatchExpression, searchQuery, ATTACHMENT_TEXT_DDL, ATTACHMENT_CONDEMNED_DDL, ATTACHMENT_SWEEP_LICENCE_DDL, ATTACHMENT_SWEEP_LICENCE_TABLE, clearOrphanSweepLicence, condemnLicensedOrphanAttachments, consumeOrphanSweepLicence, licensedOrphanIds, recordOrphanSweepLicence, refuseUnlicensedOrphanSweep, fenceAttachmentSweep, refuseCondemnedAttachment, refuseCondemnedInDump, rowlessAttachmentIds, sweepOrphanAttachments, missingAttachmentStore, SETTLED_COPY_STATES, unsettledCopyRefusal, assertAttachmentExtractors, resolveAttachmentTextBounds, assertJobRegistrable, attachmentRecordOfRow, attachmentTextJob, enqueueAttachmentText, ATTACHMENT_TEXT_BACKFILL_JOB, ATTACHMENT_TEXT_JOB, kernelJobFor, queueAttachmentTextBackfill, startAttachmentTextBackfill, attachmentTextBackfillJob, reconcileAttachmentText, recordAttachmentText, searchAttachments, entityVersionQuery, entityVersionOf, assertIfMatch, OUTBOX_ENTITY_INDEX, SCHEDULE_STATE_DDL, SCHEDULE_STATE_REBUILD, scheduleStateHasKind, VERTICAL_EVENTS_DDL, EXPORT_HOPS_SQL, emptyImportResult, IMPORT_CURSORS_SQL, IMPORT_CURSOR_OF_SQL, OUTBOX_MARK_SQL, emittedSinceQuery, emittedReportOf, EMITTED_REPORT_CAP, exportedSinceQuery, IMPORT_CURSOR_ADVANCE_SQL, IMPORT_RECORD_SQL, moveImportCursor, importCursorSourceOf, exportBreaksOf, exportBreakRefusal, assertPromoteReviewCurrent, promoteRaceRefusal, servingRaceRefusal, autoAdmittedProdRefusal, listedPromoteRefusal, rebindRaceRefusal, SERVES_NOW_CONDITION, SERVES_NOW_PREDICATE, servesNowParams, migratesFrom, servedFromRow, servesAsFrom, bindExportBreaksOf, bindExportBreakRefusal, scopeMoveOf, runningVersionOf, isPrimaryScope, PROVISIONED_VERSIONS_SQL, installsReconciledOf, strandJudgmentsOf, provisionedVersionsParams, boundShapesColumn, boundShapesOfColumn, installReconciled, CrossVerticalRegistry, exportReadPlan, exportReadQuery, planExportBatch, withheldNote, WIRE_NONCE_DDL, WIRE_NONCE_FULL, claimWireNonceIn, isWireNonceTable, JOB_RUN_DDL, JOB_RUN_DUE_AT, jobRunListLimit, jobRunOf, runDueJobRuns, startJobRun, IDEMPOTENCY_DDL, REFUSALS_TABLE_DDL, REFUSALS_INDEX, refusalInsert, refusalOf, markGuardRefusal, REFUSALS_REBUILD, refusalsAdmitGuards, assertIdempotencyKey, idempotencyLookupQuery, idempotencyPruneStatement, idempotencyRecordStatement, idempotencyOptedOutMessage, replayFor, globalFetch, fetchLikeOf, deadlineFetch, createUlid, facetEvents, readHistory, walkEventCause, walkEventEffects, assertRedrainWindow, readInvocation, readDeadLetters, readLifecycleFlow, readOperationSeries, domainEventOf, readUndrainedOutbox, undrainedEventsOf, connectorCallRecord, noopConnectorCallRecorder, recordConnectorCall, settleConnectionUse, unknownRoleError, callReservedStoreOperation, callScopeStore, observeStoreCall, replayStoreErasures, scopeStoreLifecycleOf, scopeStoreRunnersOf, } from '@substrat-run/kernel';
 import { attributedView, delegatedRevokeSql, writeExplicitTupleIn, grantEntityShapeIn, shapeTopUpBatch, topUpEntityGrantShapes, settlePlatformRequestIn, } from '@substrat-run/kernel';
 import { ADMIN_LOG_INDEXES_SQL, SETTLE_INTENT_SQL, SETTLE_OUTCOME_SQL, settleOutcomeParamsOf, readAuditedOperations, unknownOutcomeOf, } from '@substrat-run/kernel';
 import { INERT_SCOPE_REASON, isPrimaryScopeRow, normalizeUploadMediaType } from '@substrat-run/kernel';
@@ -343,6 +343,10 @@ const KERNEL_DDL = `
   -- only) and its watermark per producer, plus the producer-side (type, id) outbox index the
   -- export read seeks on. Shared with the DO adapter from @substrat-run/kernel.
   ${VERTICAL_EVENTS_DDL}
+  -- RFC wire-signing §4: the nonces of signed calls this scope accepted, and their count.
+  -- Store-local, never dumped. Shared with the DO adapter from @substrat-run/kernel, where the
+  -- column comments are (its time is integer seconds, the envelope's own unit).
+  ${WIRE_NONCE_DDL}
   CREATE TABLE IF NOT EXISTS _substrat_migrations (
     module_id TEXT NOT NULL,
     version TEXT NOT NULL,
@@ -2889,7 +2893,9 @@ export class SqliteScopeHost {
             // A dump written before indexes were excluded may still carry them; skip those
             // too rather than failing a restore over data that is about to be recomputed.
             // Matched without case, as SQLite resolves a table name (#1883 review).
-            const replayable = dumped.filter((t) => !isSearchIndexTable(t.name.toLowerCase()));
+            // The wire nonce store is this store's own (RFC wire-signing §4): a dump that carries it is not
+            // replayed, so a load starts it empty, as it starts a vertical's search index.
+            const replayable = dumped.filter((t) => !isSearchIndexTable(t.name.toLowerCase()) && !isWireNonceTable(t.name));
             // A Durable Object's dump carries spine tables this adapter keeps in its directory, or does
             // not keep at all; they are skipped by name, and any other unknown spine table is refused.
             const loadable = replayable.filter((t) => !DO_SCOPE_ONLY_SPINE_TABLES.has(t.name.toLowerCase()));
@@ -3743,6 +3749,13 @@ export class SqliteScopeHost {
             throw substratError('not_found', `unknown version ${versionId} for vertical '${slug}'`);
         return connectionLandingsOfManifestJson(manifest);
     }
+    /** What one version of `slug` declares about vertical-defined connectors (vertical-connectors.md §6.4); `not_found` for a version it does not know. */
+    async versionConnectors(slug, versionId) {
+        const manifest = this.manifestJsonOf(versionId, slug);
+        if (manifest === undefined)
+            throw substratError('not_found', `unknown version ${versionId} for vertical '${slug}'`);
+        return connectorsOfManifestJson(manifest);
+    }
     /** #1705 PR 3: the promote gate's question, over two stored versions (`exportBreaksOf`). */
     exportBreaksBetween(actor, producer, outgoingId, incomingId) {
         return exportBreaksOf({
@@ -4225,6 +4238,20 @@ export class SqliteScopeHost {
     async redrainCountLocal(scopeId, drainedBefore) {
         return redrainCountOf(this.heldReadDb(scopeId), drainedBefore);
     }
+    /**
+     * RFC wire-signing §4: spend a signed call's nonce in this scope's own store, the hosted
+     * object's `claimWireNonce` here: `true` once, `false` for a nonce already spent or a claim after
+     * `until`, and a throw when the store is at its cap (after its purge committed). Judged against
+     * this host's clock. No provisioned check, as on the hosted object: the call that provisions a
+     * scope spends its nonce there too.
+     */
+    async claimWireNonceLocal(tenantId, scopeId, nonce, until) {
+        const rt = this.runtime(tenantId, scopeId);
+        const answer = await rt.actor.enqueue(() => rt.db.transaction(() => claimWireNonceIn(switchSqlOf(rt.db), nonce, until, Math.floor(Date.parse(this.clock()) / 1000)))());
+        if (answer === 'full')
+            throw substratError('unavailable', WIRE_NONCE_FULL);
+        return answer;
+    }
     /**
      * The read connection of a scope this host holds, for a read that names only the scope id (#2541),
      * with the directory read ONCE. Refused `conflict` before anything is opened: no row, a reaped one
@@ -7142,98 +7169,116 @@ export class SqliteScopeHost {
             // -- the hostname map (K-26) -------------------------------------------
             bindHostname: async (actor, input) => {
                 const parsed = bindHostnameInput.parse(input);
-                const scope = this.directory
-                    .prepare('SELECT tenant_id, vertical FROM scopes WHERE scope_id = ?')
-                    .get(parsed.scopeId);
-                if (!scope || scope.tenant_id !== parsed.tenantId) {
-                    throw substratError('not_found', `unknown scope ${parsed.scopeId} in tenant ${parsed.tenantId}`);
-                }
-                const existing = this.directory
-                    .prepare(`SELECT h.scope_id AS scope_id, s.status AS scope_status
-               FROM hostnames h LEFT JOIN scopes s ON s.scope_id = h.scope_id
-              WHERE h.hostname = ?`)
-                    .get(parsed.hostname);
-                const holderReleased = existing?.scope_status === 'archived' || existing?.scope_status === 'reaped';
-                if (existing && existing.scope_id !== parsed.scopeId && !holderReleased) {
-                    // A hostname is globally unique and routes to exactly one place. Silently
-                    // rebinding it would move another tenant's traffic. Exception: the holder is
-                    // ARCHIVED or REAPED (a deleted app, storage since wiped) — it released the
-                    // name, so the rebind reclaims it.
-                    throw substratError('conflict', `hostname '${parsed.hostname}' is already bound to another scope`);
-                }
-                // Exactly one canonical per (scope, surface): "which one do certs and
-                // redirects use" has to have one answer, so a new canonical demotes the old.
-                if (parsed.canonical) {
+                // #2526: the scope, the holder it judges, the demotion, the bind and the row are one
+                // directory unit, so a name bound elsewhere meanwhile is refused rather than moved.
+                let vertical = null;
+                this.directoryWriteAndAudit(() => {
+                    const scope = this.directory
+                        .prepare('SELECT tenant_id, vertical FROM scopes WHERE scope_id = ?')
+                        .get(parsed.scopeId);
+                    if (!scope || scope.tenant_id !== parsed.tenantId) {
+                        throw substratError('not_found', `unknown scope ${parsed.scopeId} in tenant ${parsed.tenantId}`);
+                    }
+                    vertical = scope.vertical;
+                    const existing = this.directory
+                        .prepare(`SELECT h.scope_id AS scope_id, s.status AS scope_status
+                 FROM hostnames h LEFT JOIN scopes s ON s.scope_id = h.scope_id
+                WHERE h.hostname = ?`)
+                        .get(parsed.hostname);
+                    const holderReleased = existing?.scope_status === 'archived' || existing?.scope_status === 'reaped';
+                    if (existing && existing.scope_id !== parsed.scopeId && !holderReleased) {
+                        // A hostname is globally unique and routes to exactly one place. Silently
+                        // rebinding it would move another tenant's traffic. Exception: the holder is
+                        // ARCHIVED or REAPED (a deleted app, storage since wiped) — it released the
+                        // name, so the rebind reclaims it.
+                        throw substratError('conflict', `hostname '${parsed.hostname}' is already bound to another scope`);
+                    }
+                    // Exactly one canonical per (scope, surface): "which one do certs and
+                    // redirects use" has to have one answer, so a new canonical demotes the old.
+                    if (parsed.canonical) {
+                        this.directory
+                            .prepare('UPDATE hostnames SET canonical = 0 WHERE scope_id = ? AND surface = ?')
+                            .run(parsed.scopeId, parsed.surface);
+                    }
                     this.directory
-                        .prepare('UPDATE hostnames SET canonical = 0 WHERE scope_id = ? AND surface = ?')
-                        .run(parsed.scopeId, parsed.surface);
-                }
-                this.directory
-                    .prepare(
-                // INSERT OR REPLACE resets issuance columns — a (re)bind starts a fresh
-                // lifecycle, so any prior CF hostname id / DNS records must not linger.
-                `INSERT OR REPLACE INTO hostnames
-               (hostname, tenant_id, scope_id, vertical_slug, surface, region,
-                status, status_note, canonical, created_at, custom_hostname_id, validation_records)
-             VALUES (?, ?, ?, ?, ?, ?, 'pending', NULL, ?, ?, NULL, NULL)`)
-                    .run(parsed.hostname, parsed.tenantId, parsed.scopeId, scope.vertical, parsed.surface, parsed.region, parsed.canonical ? 1 : 0, new Date().toISOString());
-                this.recordAdmin(actor, 'bindHostname', { tenantId: parsed.tenantId, scopeId: parsed.scopeId, vertical: scope.vertical }, null, parsed);
+                        .prepare(
+                    // INSERT OR REPLACE resets issuance columns — a (re)bind starts a fresh
+                    // lifecycle, so any prior CF hostname id / DNS records must not linger.
+                    `INSERT OR REPLACE INTO hostnames
+                 (hostname, tenant_id, scope_id, vertical_slug, surface, region,
+                  status, status_note, canonical, created_at, custom_hostname_id, validation_records)
+               VALUES (?, ?, ?, ?, ?, ?, 'pending', NULL, ?, ?, NULL, NULL)`)
+                        .run(parsed.hostname, parsed.tenantId, parsed.scopeId, scope.vertical, parsed.surface, parsed.region, parsed.canonical ? 1 : 0, new Date().toISOString());
+                    return true;
+                }, () => this.recordAdmin(actor, 'bindHostname', { tenantId: parsed.tenantId, scopeId: parsed.scopeId, vertical }, null, parsed));
             },
             setHostnameStatus: async (actor, raw, status, note) => {
                 const hostname = raw.toLowerCase(); // DNS is case-insensitive; the map is normalized
-                const row = this.directory
-                    .prepare('SELECT tenant_id, scope_id, status FROM hostnames WHERE hostname = ?')
-                    .get(hostname);
-                if (!row)
-                    throw substratError('not_found', `unknown hostname '${hostname}'`);
-                if (row.status === status)
-                    return; // idempotent, and a no-op is not audited
-                this.directory
-                    .prepare('UPDATE hostnames SET status = ?, status_note = ? WHERE hostname = ?')
-                    .run(status, note ?? null, hostname);
-                this.recordAdmin(actor, 'setHostnameStatus', { tenantId: row.tenant_id, scopeId: row.scope_id }, { status: row.status }, { status, note: note ?? null });
+                // #2526: the row's read (its `before`, and the no-op judgement), the write and the
+                // admin row are one directory unit.
+                let row;
+                this.directoryWriteAndAudit(() => {
+                    row = this.directory
+                        .prepare('SELECT tenant_id, scope_id, status FROM hostnames WHERE hostname = ?')
+                        .get(hostname);
+                    if (!row)
+                        throw substratError('not_found', `unknown hostname '${hostname}'`);
+                    if (row.status === status)
+                        return false; // idempotent, and a no-op is not audited
+                    this.directory
+                        .prepare('UPDATE hostnames SET status = ?, status_note = ? WHERE hostname = ?')
+                        .run(status, note ?? null, hostname);
+                    return true;
+                }, () => this.recordAdmin(actor, 'setHostnameStatus', { tenantId: row.tenant_id, scopeId: row.scope_id }, { status: row.status }, { status, note: note ?? null }));
             },
             setHostnameIssuance: async (actor, raw, fields) => {
                 const hostname = raw.toLowerCase(); // DNS is case-insensitive; the map is normalized
-                const row = this.directory
-                    .prepare('SELECT tenant_id, scope_id, status, custom_hostname_id, validation_records FROM hostnames WHERE hostname = ?')
-                    .get(hostname);
-                if (!row)
-                    throw substratError('not_found', `unknown hostname '${hostname}'`);
                 const recordsJson = fields.validationRecords.length
                     ? JSON.stringify(fields.validationRecords)
                     : null;
-                const idUnchanged = fields.customHostnameId === undefined || fields.customHostnameId === row.custom_hostname_id;
-                // A poll that changes nothing is not an event — skip it, so the reconcile sweep
-                // does not append a no-op admin-log row every interval.
-                if (row.status === fields.status &&
-                    (row.validation_records ?? null) === recordsJson &&
-                    idUnchanged) {
-                    return;
-                }
-                if (fields.customHostnameId !== undefined) {
-                    this.directory
-                        .prepare('UPDATE hostnames SET status = ?, status_note = ?, custom_hostname_id = ?, validation_records = ? WHERE hostname = ?')
-                        .run(fields.status, fields.note ?? null, fields.customHostnameId, recordsJson, hostname);
-                }
-                else {
-                    this.directory
-                        .prepare('UPDATE hostnames SET status = ?, status_note = ?, validation_records = ? WHERE hostname = ?')
-                        .run(fields.status, fields.note ?? null, recordsJson, hostname);
-                }
-                this.recordAdmin(actor, 'setHostnameIssuance', { tenantId: row.tenant_id, scopeId: row.scope_id }, { status: row.status }, { status: fields.status, note: fields.note ?? null });
+                // #2526: the row's read (its `before`, and the no-op judgement), the write and the
+                // admin row are one directory unit.
+                let row;
+                this.directoryWriteAndAudit(() => {
+                    row = this.directory
+                        .prepare('SELECT tenant_id, scope_id, status, custom_hostname_id, validation_records FROM hostnames WHERE hostname = ?')
+                        .get(hostname);
+                    if (!row)
+                        throw substratError('not_found', `unknown hostname '${hostname}'`);
+                    const idUnchanged = fields.customHostnameId === undefined || fields.customHostnameId === row.custom_hostname_id;
+                    // A poll that changes nothing is not an event — skip it, so the reconcile sweep
+                    // does not append a no-op admin-log row every interval.
+                    if (row.status === fields.status &&
+                        (row.validation_records ?? null) === recordsJson &&
+                        idUnchanged) {
+                        return false;
+                    }
+                    if (fields.customHostnameId !== undefined) {
+                        this.directory
+                            .prepare('UPDATE hostnames SET status = ?, status_note = ?, custom_hostname_id = ?, validation_records = ? WHERE hostname = ?')
+                            .run(fields.status, fields.note ?? null, fields.customHostnameId, recordsJson, hostname);
+                    }
+                    else {
+                        this.directory
+                            .prepare('UPDATE hostnames SET status = ?, status_note = ?, validation_records = ? WHERE hostname = ?')
+                            .run(fields.status, fields.note ?? null, recordsJson, hostname);
+                    }
+                    return true;
+                }, () => this.recordAdmin(actor, 'setHostnameIssuance', { tenantId: row.tenant_id, scopeId: row.scope_id }, { status: row.status }, { status: fields.status, note: fields.note ?? null }));
             },
             unbindHostname: async (actor, raw, owner) => {
                 const hostname = raw.toLowerCase(); // DNS is case-insensitive; the map is normalized
                 // One statement: the row it removes is the row it audits, and an owner is judged by the
                 // delete itself, so a name rebound to another scope in between is left alone (#2285).
-                const row = this.directory
-                    .prepare(`DELETE FROM hostnames WHERE hostname = ?${owner ? ' AND tenant_id = ? AND scope_id = ?' : ''}
-            RETURNING tenant_id, scope_id, status`)
-                    .get(hostname, ...(owner ? [owner.tenantId, owner.scopeId] : []));
-                if (!row)
-                    return; // idempotent, and a no-op is not audited
-                this.recordAdmin(actor, 'unbindHostname', { tenantId: row.tenant_id, scopeId: row.scope_id }, { hostname, status: row.status }, null);
+                // #2526: the delete and its admin row are one directory unit.
+                let row;
+                this.directoryWriteAndAudit(() => {
+                    row = this.directory
+                        .prepare(`DELETE FROM hostnames WHERE hostname = ?${owner ? ' AND tenant_id = ? AND scope_id = ?' : ''}
+              RETURNING tenant_id, scope_id, status`)
+                        .get(hostname, ...(owner ? [owner.tenantId, owner.scopeId] : []));
+                    return row !== undefined; // idempotent, and a no-op is not audited
+                }, () => this.recordAdmin(actor, 'unbindHostname', { tenantId: row.tenant_id, scopeId: row.scope_id }, { hostname, status: row.status }, null));
             },
             listHostnames: async (actor, filter) => {
                 const where = [];
@@ -7387,6 +7432,9 @@ export class SqliteScopeHost {
                     installSpec.provides = parsed.provides;
                 if (parsed.requires)
                     installSpec.requires = parsed.requires;
+                // The declared vertical-defined connectors (vertical-connectors.md §7.2), the dashboard's door.
+                if (parsed.connectors)
+                    installSpec.connectors = parsed.connectors;
                 if (parsed.provisions)
                     installSpec.provisions = parsed.provisions;
                 if (parsed.sendsEmail)
@@ -7537,8 +7585,7 @@ export class SqliteScopeHost {
                   WHERE c.vertical_slug = ? AND c.channel = 'prod'`)
                             .get(slug);
                         if (prod?.admission_note === AUTO_ADMISSION_NOTE) {
-                            throw substratError('conflict', `vertical '${slug}' prod version ${prod.id} is auto-admitted (private self-serve) — ` +
-                                `a staff admit must vouch for it before listing`);
+                            throw autoAdmittedProdRefusal(slug, prod.id);
                         }
                     }
                     return { listed: existing.listed };
@@ -7650,7 +7697,7 @@ export class SqliteScopeHost {
                 this.recordAccess(actor, 'promotionImpact', { tenantId: null }, { verticalSlug, channel, versionId }, breaks.length);
                 return breaks;
             },
-            promoteVersion: async (actor, verticalSlug, channel, versionId, acknowledge) => {
+            promoteVersion: async (actor, verticalSlug, channel, versionId, acknowledge, options) => {
                 const incoming = await readVersion(versionId);
                 if (!incoming)
                     throw substratError('not_found', `unknown version ${versionId}`);
@@ -7695,6 +7742,7 @@ export class SqliteScopeHost {
                     ack,
                     channel,
                     baseId: outgoing?.id ?? null,
+                    permissionsChange: outgoing !== undefined && outgoing.permissionDigest !== incoming.permissionDigest,
                     migrationsChange: outgoing !== undefined && outgoing.migrationDigest !== incoming.migrationDigest,
                     read: async () => ({ base: outgoing ? reviewed(outgoing) : null, incoming: reviewed(incoming) }),
                 });
@@ -7728,6 +7776,17 @@ export class SqliteScopeHost {
                         .get(verticalSlug, channel);
                     if ((now?.version_id ?? null) !== (outgoing?.id ?? null))
                         return false;
+                    // #2565: the listing's rule and the builder's door, read where the listing could land.
+                    const listed = readVertical(verticalSlug)?.listed;
+                    if (listed && options?.unlistedOnly)
+                        throw listedPromoteRefusal();
+                    // A re-promote of what prod already names, and what serves (if anything does), moves
+                    // nothing, so it is not judged again. One whose serve would change what runs is.
+                    const serving = this.servingPointerOfVertical(verticalSlug)?.versionId ?? versionId;
+                    if (listed && channel === 'prod' && (outgoing?.id !== versionId || serving !== versionId) &&
+                        versionAdmission(versionId).admission_note === AUTO_ADMISSION_NOTE) {
+                        throw autoAdmittedProdRefusal(verticalSlug, versionId);
+                    }
                     this.directory
                         .prepare(`INSERT INTO vertical_channels (vertical_slug, channel, version_id, updated_at)
                VALUES (?, ?, ?, ?)
@@ -8036,33 +8095,39 @@ export class SqliteScopeHost {
                     migrationTag: r.serving_migration_tag,
                 });
             },
-            setVerticalServing: async (actor, verticalSlug, state) => {
+            setVerticalServing: async (actor, verticalSlug, state, expected) => {
                 const parsed = verticalServingState.parse(state);
                 const r = this.directory
                     .prepare('SELECT * FROM verticals WHERE slug = ?')
                     .get(verticalSlug);
                 if (!r)
                     throw substratError('not_found', `unknown vertical '${verticalSlug}'`);
+                // #2577: the caller's upload diffed its DO-class migration from `expected`'s class set and tag.
+                if (expected !== undefined && !migratesFrom(r, expected))
+                    throw servingRaceRefusal(verticalSlug);
                 // #2178: every install on the serving script runs the new version from this moment.
                 this.assertNoStrandFrom([r.serving_version_id], parsed.versionId, r.serving_ref ? this.provisionedVersionsOf(verticalSlug, r.serving_version_id ? { ref: r.serving_ref, versionId: r.serving_version_id } : null, null) : []);
-                // #2528: a compare-and-set on the serving ref and version the gate judged
-                // (`SERVES_NOW_CONDITION`), and the row's `before` read in the transaction that moves it,
-                // as the Cloudflare host does.
+                // #2528/#2577: a compare-and-set on the serving state the gate judged, its ref, version,
+                // class set and tag (a serve and a re-serve can bring the ref and version back over a grown
+                // class set), and the row's `before` read in the transaction that moves it, as the
+                // Cloudflare host does.
                 let before = null;
                 let raced = false;
                 this.directoryWriteAndAudit(() => {
                     const now = this.directory
-                        .prepare('SELECT serving_ref, serving_version_id FROM verticals WHERE slug = ?')
+                        .prepare('SELECT * FROM verticals WHERE slug = ?')
                         .get(verticalSlug);
                     if (!now)
                         throw substratError('not_found', `unknown vertical '${verticalSlug}'`);
                     before = now.serving_ref ? { ref: now.serving_ref, versionId: now.serving_version_id } : null;
-                    const moved = this.directory
+                    raced = !servesAsFrom(now, servedFromRow(r));
+                    if (raced)
+                        return false;
+                    this.directory
                         .prepare(`UPDATE verticals SET serving_ref = ?, serving_version_id = ?,
-                      serving_do_classes = ?, serving_migration_tag = ? WHERE ${SERVES_NOW_CONDITION}`)
-                        .run(parsed.ref, parsed.versionId, JSON.stringify(parsed.doClasses), parsed.migrationTag, verticalSlug, r.serving_ref ?? null, r.serving_version_id ?? null).changes > 0;
-                    raced = !moved;
-                    return moved;
+                      serving_do_classes = ?, serving_migration_tag = ? WHERE slug = ?`)
+                        .run(parsed.ref, parsed.versionId, JSON.stringify(parsed.doClasses), parsed.migrationTag, verticalSlug);
+                    return true;
                 }, () => this.recordAdmin(actor, 'setVerticalServing', { tenantId: null }, before, { vertical: verticalSlug, ref: parsed.ref, versionId: parsed.versionId }));
                 if (raced)
                     throw servingRaceRefusal(verticalSlug);
@@ -8572,6 +8637,8 @@ export class SqliteScopeHost {
                     before = readTenant(tenantId);
                     if (!before)
                         throw substratError('not_found', `unknown tenant: ${tenantId}`);
+                    if (before.status === 'reaped')
+                        throw substratError('conflict', `tenant ${tenantId} is reaped and cannot change status`);
                     return (status === 'deleting'
                         ? this.directory
                             .prepare('UPDATE tenants SET status = ?, deleting_at = ? WHERE tenant_id = ?')
@@ -8827,11 +8894,14 @@ export class SqliteScopeHost {
                 // reason: its shadow tables cannot be replayed (the DO host rejects the name
                 // outright), and it is recomputable — `loadDump` rebuilds it from the content
                 // tables it just loaded. A dump carries the rows, never the index over them.
+                //
+                // The wire nonce store is dropped as well (RFC wire-signing §4): it describes calls this
+                // store accepted, not the scope's data, so a load builds it empty.
                 const defs = db
                     .prepare(`SELECT name, sql FROM sqlite_master
                 WHERE type = 'table' AND name NOT GLOB 'sqlite_*' AND sql IS NOT NULL
                 ORDER BY name`)
-                    .all().filter(({ name }) => !isSearchIndexTable(name));
+                    .all().filter(({ name }) => !isSearchIndexTable(name) && !isWireNonceTable(name));
                 const tables = defs.map(({ name, sql }) => {
                     // `.raw(true)` gives positional rows; cells stay as-is (blobs are Buffers, not
                     // nulled as in a UI read) so the dump is byte-faithful. The name is from the live
@@ -9245,52 +9315,59 @@ export class SqliteScopeHost {
             },
             grantEntitlement: async (actor, tenantId, entitlementKey, plan) => {
                 const input = entitlementGrantInput.parse(plan ?? {});
-                const existing = this.directory
-                    .prepare('SELECT expires_at, quota, plan FROM _substrat_entitlements WHERE tenant_id = ? AND entitlement_key = ?')
-                    .get(tenantId, entitlementKey);
-                // PATCH semantics (entitlementGrantInput): omitted preserves, null clears —
-                // a bare re-grant on an idempotent provisioning path must not erase a
-                // trial's expiry and quietly turn it perpetual.
-                const next = {
-                    expiresAt: input.expiresAt !== undefined ? input.expiresAt : (existing?.expires_at ?? null),
-                    quota: input.quota !== undefined ? input.quota : (existing?.quota ?? null),
-                    plan: input.plan !== undefined ? input.plan : (existing?.plan ?? null),
-                };
-                // Idempotent: a grant that changes nothing is not audited.
-                if (existing &&
-                    existing.expires_at === next.expiresAt &&
-                    existing.quota === next.quota &&
-                    existing.plan === next.plan) {
-                    return;
-                }
-                const now = new Date().toISOString();
-                // granted_at/granted_by restamp on every effective change: a renewal is a
-                // new grant act, and the full history is the admin log below.
-                this.directory
-                    .prepare(`INSERT INTO _substrat_entitlements
-               (tenant_id, entitlement_key, expires_at, quota, plan, granted_at, granted_by)
-             VALUES (?, ?, ?, ?, ?, ?, ?)
-             ON CONFLICT (tenant_id, entitlement_key) DO UPDATE SET
-               expires_at = excluded.expires_at,
-               quota = excluded.quota,
-               plan = excluded.plan,
-               granted_at = excluded.granted_at,
-               granted_by = excluded.granted_by`)
-                    .run(tenantId, entitlementKey, next.expiresAt, next.quota, next.plan, now, actor);
-                this.recordAdmin(actor, 'grantEntitlement', { tenantId }, existing
+                // #2526: the held grant (its `before`, and the no-op judgement), the write and the admin
+                // row are one directory unit.
+                let existing;
+                let next = { expiresAt: null, quota: null, plan: null };
+                this.directoryWriteAndAudit(() => {
+                    existing = this.directory
+                        .prepare('SELECT expires_at, quota, plan FROM _substrat_entitlements WHERE tenant_id = ? AND entitlement_key = ?')
+                        .get(tenantId, entitlementKey);
+                    // PATCH semantics (entitlementGrantInput): omitted preserves, null clears —
+                    // a bare re-grant on an idempotent provisioning path must not erase a
+                    // trial's expiry and quietly turn it perpetual.
+                    next = {
+                        expiresAt: input.expiresAt !== undefined ? input.expiresAt : (existing?.expires_at ?? null),
+                        quota: input.quota !== undefined ? input.quota : (existing?.quota ?? null),
+                        plan: input.plan !== undefined ? input.plan : (existing?.plan ?? null),
+                    };
+                    // Idempotent: a grant that changes nothing is not audited.
+                    if (existing &&
+                        existing.expires_at === next.expiresAt &&
+                        existing.quota === next.quota &&
+                        existing.plan === next.plan) {
+                        return false;
+                    }
+                    const now = new Date().toISOString();
+                    // granted_at/granted_by restamp on every effective change: a renewal is a
+                    // new grant act, and the full history is the admin log.
+                    this.directory
+                        .prepare(`INSERT INTO _substrat_entitlements
+                 (tenant_id, entitlement_key, expires_at, quota, plan, granted_at, granted_by)
+               VALUES (?, ?, ?, ?, ?, ?, ?)
+               ON CONFLICT (tenant_id, entitlement_key) DO UPDATE SET
+                 expires_at = excluded.expires_at,
+                 quota = excluded.quota,
+                 plan = excluded.plan,
+                 granted_at = excluded.granted_at,
+                 granted_by = excluded.granted_by`)
+                        .run(tenantId, entitlementKey, next.expiresAt, next.quota, next.plan, now, actor);
+                    return true;
+                }, () => this.recordAdmin(actor, 'grantEntitlement', { tenantId }, existing
                     ? { entitlementKey, expiresAt: existing.expires_at, quota: existing.quota, plan: existing.plan }
-                    : null, { entitlementKey, ...next });
+                    : null, { entitlementKey, ...next }));
             },
             revokeEntitlement: async (actor, tenantId, entitlementKey) => {
-                const existing = this.directory
-                    .prepare('SELECT expires_at, quota, plan FROM _substrat_entitlements WHERE tenant_id = ? AND entitlement_key = ?')
-                    .get(tenantId, entitlementKey);
-                if (!existing)
-                    return; // nothing held, nothing changed
-                this.directory
-                    .prepare('DELETE FROM _substrat_entitlements WHERE tenant_id = ? AND entitlement_key = ?')
-                    .run(tenantId, entitlementKey);
-                this.recordAdmin(actor, 'revokeEntitlement', { tenantId }, { entitlementKey, expiresAt: existing.expires_at, quota: existing.quota, plan: existing.plan }, null);
+                // #2526: one statement removes the grant and answers what it held, which is the admin
+                // row's `before`; the row commits with it.
+                let removed;
+                this.directoryWriteAndAudit(() => {
+                    removed = this.directory
+                        .prepare(`DELETE FROM _substrat_entitlements WHERE tenant_id = ? AND entitlement_key = ?
+              RETURNING expires_at, quota, plan`)
+                        .get(tenantId, entitlementKey);
+                    return removed !== undefined; // nothing held, nothing changed
+                }, () => this.recordAdmin(actor, 'revokeEntitlement', { tenantId }, { entitlementKey, expiresAt: removed.expires_at, quota: removed.quota, plan: removed.plan }, null));
             },
             listEntitlements: async (actor, tenantId) => {
                 const grants = this.directory