@substrat-run/adapter-sqlite 0.163.0 → 0.165.0

package/dist/index.js

@@ -2,8 +2,8 @@ import { createHash } from 'node:crypto';
 import { closeSync, existsSync, fstatSync, mkdirSync, openSync, readdirSync, readFileSync, readSync, realpathSync, rmSync, writeFileSync, writeSync } from 'node:fs';
 import { dirname, join } from 'node:path';
 import Database from 'better-sqlite3';
-import { accessLogEntry, adminLogEntry, delegatedReadParams, operationSeriesCount, opsFailureEntry, opsFailureFingerprint, issueEntry, FRESHNESS_HEARTBEAT_MINUTES, sweepRunEntry, modelUsageEntry, ATTACHMENT_ADDED, ATTACHMENT_REMOVED, createTenantInput, domainEvent, domainEventInput, exportReadInput, importBatch, importCursorMove, exportsOfManifestJson, assertNoBindingShapeBreak, importsOfManifestJson, connectionLandingsOfManifestJson, entitlementGrant, entitlementGrantInput, eventId, meterReading, platformRequestInput, platformRequestId, identityLink, identityPool, instant, isSubstratError, connection, capabilityGrant, connectionGrant, connectionGrantRecord, connectionSecret, systemGrant, systemSwitch, systemSwitchRecord, peerSwitch, verticalCaller, verticalSlug as verticalSlugOf, subjectRef, requestFingerprint, createConnectionInput, connectLinkFilter, connectLinkKey, consumeConnectLinkInput, mintConnectLinkInput, projectedConnectionGrant, projectedConnectionKey, moduleManifest, createOrgInput, promotionAcknowledgement, bindAcknowledgement, bindHostnameInput, channelHistoryEntry, hostnameBinding, publishVersionInput, AUTO_ADMISSION_NOTE, routeTarget, ROUTE_SCOPE_HOSTNAMES_MAX, registerVerticalInput, vertical as verticalSchema, verticalChannel, verticalVersion, objectRef, entityObjectRef, assertModuleEmittableType, assertKernelAuthoredType, grantRefFromProof, org as orgSchema, orgMembership, principalId, resolvedIdentity, identityMembership, roleDefinition, scope as scopeSchema, tenant as tenantSchema, tenantRole, principalBecomeCapabilityInput, subjectShredReceipt, SCOPE_TABLE_PAGE_DEFAULT, SCOPE_TABLE_PAGE_MAX, SCOPE_QUERY_ROW_MAX, verticalServingState, deploymentWireAuth, callsOfManifestJson, outboundOfManifestJson, listLimitOf, pageOf, countedPageOf, SCOPE_GATE_REASONS, substratError, assertReplayableDump, delegatedReadRecord, ownerTransferAudit, memberChangeAudit, peerBindingAudit, connectionBindingAudit, copyMarkAudit, orphanSweepAudit, redrainEventsInput, REDRAIN_BATCH, errorCodeOf, } from '@substrat-run/contracts';
-import { actorOf, asPrincipal, assertAllowed, assertNoSecret, assertPermissionKey, CAPABILITY_DDL, UPLOAD_LINK_DDL, createAttachmentVerbs, inspectUploadLink, redeemUploadLinkInTransaction, redeemOrReplayUploadLink, COPY_ORIGIN_DDL, ENTITY_STATE_MOVES_DDL, CAPABILITY_EXCHANGE_OPERATION, CAPABILITY_BECOME_MINT_OPERATION, becomeMintCheck, mintBecomeCapabilityAsPrincipal, revokeBecomeCapabilityAsPrincipal, readBecomeLinkStates, ENTITY_UNBIND_OPERATION, allowedFor, unbindEntityHolderBounded, capabilityAttachmentWriteRefused, capabilityTokenHash, createCapabilityVerbs, createEntityEdgeVerbs, createEntityStateVerbs, createTrashedReads, CONTINUATION_POSITION_CAP, visibleContinuation, searchStateWhere, uncheckedView, addStatePlans, addUpdatedStampPlans, watchUpdatedStamps, entityStateMigrations, assertNoCallerPurge, assertPlatformRequestRoom, isUnreachableParent, heldPurgePass, purgeDueOf, purgeHeldBy, lifecycleRefusal, scopeNotHeldRefusal, purgeOnlyKeysOf, purgeReportOf, purgeStillDue, refuseTrashedTarget, assertBoundOperations, checkHeldOperationsOf, countChecks, noteUncheckedCompletion, registerTrashTargets, runPurgePass, withheldKeysFor, statefulTablesOf, afterMigration, afterRuntimeDdl, derivesAnything, repairDerivedObjects, StateColumnLost, exchangeCapability as exchangeCapabilitySecret, guardSecrets, mintBecomeCapability, plausibleSessionToken, readCapabilityPage, redactSecrets, redactSecretText, moduleLog, consoleLogSink, asyncInvocationId, asyncLinePass, consoleInvocationLineSink, resolveCapabilitySession, revokeCapabilityAsPlatform, assertReadOnlyQuery, attachmentBlobKey, attachmentSha256, isSizedByteStream, knownLengthStream, openAttachmentByteStream, putAttachmentBytes, entitlementDenial, requiredEntitlementFor, foldMeterReading, guardSpine, guardSqlLimits, DO_SQL_LIMITS, tooManyResultColumns, tooManyTableColumns, parseValidationRecords, readableScopes, resolveScopeRecord, ulid, ISSUE_RETENTION_DAYS, telemetryRetentionStatements, FINDINGS_DDL, ATTACHMENT_BYTES_SQL, SCOPE_STORAGE_DDL, forgetScopeStorage, listScopeAttachmentStorageRows, retireScopeStorage, listScopeStorageAttemptRows, listScopeStorageRows, listScopeStoreStorageRows, pruneScopeStorageRows, recordScopeStorageRows, REQUEST_ROLLUP_DDL, listRequestDayRows, listRequestRollupDayRows, pruneRequestDayRows, recordRequestDayRows, METER_DAYS_DDL, VERTICAL_OWNERS_BACKFILL, VERTICAL_OWNERS_DDL, closeVerticalOwnerRow, listVerticalOwnerRows, openVerticalOwnerRow, verticalOwnerNow, listMeterDayRows, listMeterDayTakeRows, pruneMeterDayRows, recordMeterDayRows, CONNECT_LINKS_DDL, consumeConnectLinkRow, insertConnectLink, listConnectLinks as listConnectLinkRows, readConnectLink, restoreConnectLinkRow, revokeConnectLinkRow, createFindingRule, findingOfOpsFailure, findingOfSweepRun, pruneFindings, listFindingRules, listFindings, observeFinding, revokeFindingRule, setFindingStatus, assertRowLimit, assertRowOffset, OPS_FAILURE_RETENTION_DAYS, SWEEP_RUN_RETENTION_DAYS, SWEEP_RUNS_INTENT_INDEX, sweepRunsIntentHasKind, MODEL_USAGE_RETENTION_DAYS, foldModelUsage, backoffAt, platformRequestHistoryQuery, platformRequestOf, PLATFORM_REQUEST_COLUMNS, PLATFORM_REQUEST_REDACTION_SQL, platformRequestRedactionParams, platformRequestRedactionQuery, intentPayloadCarriesSubject, redactSubjectJobRuns, eraseSubjectFromModules, moduleRowsErased, moduleErasurePlan, redactSubjectScopeText, redactSubjectDirectoryText, ISSUE_EXEMPLAR_OWNER_BACKFILL_SQL, issueExemplarOwner, JOB_RUN_PATCH_SQL, JOB_RUN_CLAIM_SQL, JOB_RUN_RENEW_SQL, JOB_RUN_BEGIN_SQL, JOB_RUN_MISS_SQL, JOB_RUN_MISS_SETTLE_SQL, admissionMissOutcome, JOB_STEP_RECORD_SQL, JOB_LEASE_EXPIRED_NOTE, assertLeaseMs, DELIVERY_ERROR_REDACTION_SQL, REDACTED_DELIVERY_NOTE, seatScopeTuple, applyScopeRoleChange, changeScopeRole, revokeScopeRoles, scopeRoleHolders, assertModuleDeclared, noteDeclaredKeys, noteReservedKeys, dumpRoleRefusal, reservedGrantRefusal, reservedRoleDefinitionRefusal, reservedRoleRefusal, reservedShapeRefusal, SCOPE_SEATED_ROLES_SQL, SEAT_HOLDING_SCOPE_STATUSES, TENANT_SEATED_ROLES_SQL, admitPeer, boundToPeerDeclarations, peerCallerAt, collectPeers, peerSeats, resolveVerticalInstanceFrom, resolvePeerInstanceFrom, peerVerticalSpellings, samePeerVertical, peerGrantsStatus, systemGrantsStatus, systemScheduleState, systemSwitchedOff, systemSwitchedOffMessage, tenantSystemSwitchedOffMessage, PEER_SWITCHES_DDL, PEER_BINDINGS_DDL, SWITCH_OWED_DDL, SWITCH_FENCES_DDL, TABLE_OWNERS_DDL, assertMigrationLeavesLedgerAlone, recordOwnershipSteps, runMigrationStatements, executableSqlStatements, blankSqlComments, recordWriteSuperseded, switchFencesOf, switchSupersededMessage, SWITCH_KINDS, SYSTEM_SWITCHES_DDL, forgetSwitchesOf, listSystemSwitchRecords, moveSwitch, reassertActionOf, reassertEntry, reassertOffRow, recordSwitchedOff, recordSwitchedOn, restoreSwitchRecord, scopesSwitchedOffFor, switchActionOf, switchAuditSubject, recordAuditOutcome, auditedCapabilityRevoke, auditWarningOf, switchNotFoundMessage, switchRecordsOf, switchedOffOf, switchesBackfillSqlOf, switchesTableExists, tenantHeldOf, tenantHoldsGrant, inUnitMovesToAudit, staleCarryRevertRow, staleCarryReverts, withRecorded, VERSION_MIGRATIONS_DDL, VERTICAL_SCOPE_STORES_DDL, forgetVerticalScopeStores, DEPLOYMENT_WIRE_AUTH_DDL, assertWireAuthFilter, deploymentWireAuthOf, forgetVerticalWireAuth, wireAuthAccessTarget, writeDeploymentWireAuth, indexVersionScopeStores, driverDeclarationsOf, verticalScopeStoresOf, STORE_DRIVER_RELEASES_DDL, legacyStoreDriverConflict, legacyStoreDriverRenames, beginStoreDriverRolloutIn, finishStoreDriverRolloutIn, holdStoreDriverIn, advanceStoreDriverRebuildIn, claimStoreDriverRebuildIn, storeDriverRebuildIn, recordStoreDriverReleaseIn, releaseStoreDriverHoldIn, storeDriverReleaseIn, storeDriverStateIn, storeDriverRolloutPendingIn, storeDriverRolloutWalkedIn, splitManifestMigrations, splitVersionMigrationsBatch, versionMigrationsOf, deriveVersionMigrationDigest, publishedMigrationDigest, migrationChangeRefusal, writeVersionMigrations, denialListQuery, refusalListQuery, mapRefusalRow, denialSummaryQuery, denialTotalsQuery, DENIAL_WINDOW_QUERY, mapDenialRow, mapDenialSummaryBuckets, IMPERSONATION_COLUMNS, IMPERSONATION_DDL, ImpersonationRefused, assertImpersonationWrites, assertModuleEnqueueableKind, assertSessionUsable, impersonationByIdQuery, impersonationListQuery, impersonationRowValues, impersonationStampOf, mapImpersonationRow, newImpersonationSession, resolveRetryPolicy, executorOutcomeOf, isDeliveryRefusal, refusalJournalText, membershipFencesBackfillSql, MEMBERSHIP_FENCES_DDL, membershipFencesTableExists, MEMBERSHIP_FENCE_SINCE_SQL, RAISE_MEMBERSHIP_FENCE_SQL, memberAddedAudit, orgChangeBound, tenantCoverage, isSecretBoxConfigured, unconfiguredSecretBox, createSubjectKeys, generateSealingKeyPair, noSealingKeyMessage, openSealed, sealTo, ConnectionSealingKeyUnavailableError, PermissionDenied, createAtomic, NotSearchable, NotListable, listIndexMigrations, listIndexPlans, listQuery, cursorOf, moduleMigrations, MIGRATION_DIGEST_FENCE_DDL, MIGRATION_DIGEST_MARK_LEGACY, assertJournalDumpCoherent, assertMigrationSql, migrationDivergence, migrationFailedError, migrationSetDivergence, migrationSteps, planMigrations, isSearchIndexTable, searchIndexMigrations, searchIndexPlans, searchLimit, searchMatchExpression, searchQuery, ATTACHMENT_TEXT_DDL, ATTACHMENT_CONDEMNED_DDL, ATTACHMENT_SWEEP_LICENCE_DDL, ATTACHMENT_SWEEP_LICENCE_TABLE, clearOrphanSweepLicence, condemnLicensedOrphanAttachments, consumeOrphanSweepLicence, licensedOrphanIds, recordOrphanSweepLicence, refuseUnlicensedOrphanSweep, fenceAttachmentSweep, refuseCondemnedAttachment, refuseCondemnedInDump, rowlessAttachmentIds, sweepOrphanAttachments, missingAttachmentStore, SETTLED_COPY_STATES, unsettledCopyRefusal, assertAttachmentExtractors, resolveAttachmentTextBounds, assertJobRegistrable, attachmentRecordOfRow, attachmentTextJob, enqueueAttachmentText, ATTACHMENT_TEXT_BACKFILL_JOB, ATTACHMENT_TEXT_JOB, kernelJobFor, queueAttachmentTextBackfill, startAttachmentTextBackfill, attachmentTextBackfillJob, reconcileAttachmentText, recordAttachmentText, searchAttachments, entityVersionQuery, entityVersionOf, assertIfMatch, OUTBOX_ENTITY_INDEX, SCHEDULE_STATE_DDL, SCHEDULE_STATE_REBUILD, scheduleStateHasKind, VERTICAL_EVENTS_DDL, EXPORT_HOPS_SQL, emptyImportResult, IMPORT_CURSORS_SQL, IMPORT_CURSOR_OF_SQL, OUTBOX_MARK_SQL, emittedSinceQuery, emittedReportOf, EMITTED_REPORT_CAP, exportedSinceQuery, IMPORT_CURSOR_ADVANCE_SQL, IMPORT_RECORD_SQL, moveImportCursor, importCursorSourceOf, exportBreaksOf, exportBreakRefusal, assertPromoteReviewCurrent, promoteRaceRefusal, servingRaceRefusal, autoAdmittedProdRefusal, listedPromoteRefusal, rebindRaceRefusal, SERVES_NOW_CONDITION, SERVES_NOW_PREDICATE, servesNowParams, bindExportBreaksOf, bindExportBreakRefusal, scopeMoveOf, runningVersionOf, isPrimaryScope, PROVISIONED_VERSIONS_SQL, installsReconciledOf, strandJudgmentsOf, provisionedVersionsParams, boundShapesColumn, boundShapesOfColumn, installReconciled, CrossVerticalRegistry, exportReadPlan, exportReadQuery, planExportBatch, withheldNote, WIRE_NONCE_DDL, WIRE_NONCE_FULL, claimWireNonceIn, isWireNonceTable, JOB_RUN_DDL, JOB_RUN_DUE_AT, jobRunListLimit, jobRunOf, runDueJobRuns, startJobRun, IDEMPOTENCY_DDL, REFUSALS_TABLE_DDL, REFUSALS_INDEX, refusalInsert, refusalOf, markGuardRefusal, REFUSALS_REBUILD, refusalsAdmitGuards, assertIdempotencyKey, idempotencyLookupQuery, idempotencyPruneStatement, idempotencyRecordStatement, idempotencyOptedOutMessage, replayFor, globalFetch, fetchLikeOf, deadlineFetch, createUlid, facetEvents, readHistory, walkEventCause, walkEventEffects, assertRedrainWindow, readInvocation, readDeadLetters, readLifecycleFlow, readOperationSeries, domainEventOf, readUndrainedOutbox, undrainedEventsOf, connectorCallRecord, noopConnectorCallRecorder, recordConnectorCall, settleConnectionUse, unknownRoleError, callReservedStoreOperation, callScopeStore, observeStoreCall, replayStoreErasures, scopeStoreLifecycleOf, scopeStoreRunnersOf, } from '@substrat-run/kernel';
+import { accessLogEntry, adminLogEntry, delegatedReadParams, operationSeriesCount, opsFailureEntry, opsFailureFingerprint, issueEntry, FRESHNESS_HEARTBEAT_MINUTES, sweepRunEntry, modelUsageEntry, ATTACHMENT_ADDED, ATTACHMENT_REMOVED, createTenantInput, domainEvent, domainEventInput, exportReadInput, importBatch, importCursorMove, exportsOfManifestJson, assertNoBindingShapeBreak, importsOfManifestJson, connectionLandingsOfManifestJson, connectorsOfManifestJson, entitlementGrant, entitlementGrantInput, eventId, meterReading, platformRequestInput, platformRequestId, identityLink, identityPool, instant, isSubstratError, connection, capabilityGrant, connectionGrant, connectionGrantRecord, connectionSecret, systemGrant, systemSwitch, systemSwitchRecord, peerSwitch, verticalCaller, verticalSlug as verticalSlugOf, subjectRef, requestFingerprint, createConnectionInput, connectLinkFilter, connectLinkKey, consumeConnectLinkInput, mintConnectLinkInput, projectedConnectionGrant, projectedConnectionKey, moduleManifest, createOrgInput, promotionAcknowledgement, bindAcknowledgement, bindHostnameInput, channelHistoryEntry, hostnameBinding, publishVersionInput, AUTO_ADMISSION_NOTE, routeTarget, ROUTE_SCOPE_HOSTNAMES_MAX, registerVerticalInput, vertical as verticalSchema, verticalChannel, verticalVersion, objectRef, entityObjectRef, assertModuleEmittableType, assertKernelAuthoredType, grantRefFromProof, org as orgSchema, orgMembership, principalId, resolvedIdentity, identityMembership, roleDefinition, scope as scopeSchema, tenant as tenantSchema, tenantRole, principalBecomeCapabilityInput, subjectShredReceipt, SCOPE_TABLE_PAGE_DEFAULT, SCOPE_TABLE_PAGE_MAX, SCOPE_QUERY_ROW_MAX, verticalServingState, deploymentWireAuth, callsOfManifestJson, outboundOfManifestJson, listLimitOf, pageOf, countedPageOf, SCOPE_GATE_REASONS, substratError, assertReplayableDump, delegatedReadRecord, ownerTransferAudit, memberChangeAudit, peerBindingAudit, connectionBindingAudit, copyMarkAudit, orphanSweepAudit, redrainEventsInput, REDRAIN_BATCH, errorCodeOf, } from '@substrat-run/contracts';
+import { actorOf, asPrincipal, assertAllowed, assertNoSecret, assertPermissionKey, CAPABILITY_DDL, UPLOAD_LINK_DDL, createAttachmentVerbs, inspectUploadLink, redeemUploadLinkInTransaction, redeemOrReplayUploadLink, COPY_ORIGIN_DDL, ENTITY_STATE_MOVES_DDL, CAPABILITY_EXCHANGE_OPERATION, CAPABILITY_BECOME_MINT_OPERATION, becomeMintCheck, mintBecomeCapabilityAsPrincipal, revokeBecomeCapabilityAsPrincipal, readBecomeLinkStates, ENTITY_UNBIND_OPERATION, allowedFor, unbindEntityHolderBounded, capabilityAttachmentWriteRefused, capabilityTokenHash, createCapabilityVerbs, createEntityEdgeVerbs, createEntityStateVerbs, createTrashedReads, CONTINUATION_POSITION_CAP, visibleContinuation, searchStateWhere, uncheckedView, addStatePlans, addUpdatedStampPlans, watchUpdatedStamps, entityStateMigrations, assertNoCallerPurge, assertPlatformRequestRoom, isUnreachableParent, heldPurgePass, purgeDueOf, purgeHeldBy, lifecycleRefusal, scopeNotHeldRefusal, purgeOnlyKeysOf, purgeReportOf, purgeStillDue, refuseTrashedTarget, assertBoundOperations, checkHeldOperationsOf, countChecks, noteUncheckedCompletion, registerTrashTargets, runPurgePass, withheldKeysFor, statefulTablesOf, afterMigration, afterRuntimeDdl, derivesAnything, repairDerivedObjects, StateColumnLost, exchangeCapability as exchangeCapabilitySecret, guardSecrets, mintBecomeCapability, plausibleSessionToken, readCapabilityPage, redactSecrets, redactSecretText, moduleLog, consoleLogSink, asyncInvocationId, asyncLinePass, consoleInvocationLineSink, resolveCapabilitySession, revokeCapabilityAsPlatform, assertReadOnlyQuery, attachmentBlobKey, attachmentSha256, isSizedByteStream, knownLengthStream, openAttachmentByteStream, putAttachmentBytes, entitlementDenial, requiredEntitlementFor, foldMeterReading, guardSpine, guardSqlLimits, DO_SQL_LIMITS, tooManyResultColumns, tooManyTableColumns, parseValidationRecords, readableScopes, resolveScopeRecord, ulid, ISSUE_RETENTION_DAYS, telemetryRetentionStatements, FINDINGS_DDL, ATTACHMENT_BYTES_SQL, SCOPE_STORAGE_DDL, forgetScopeStorage, listScopeAttachmentStorageRows, retireScopeStorage, listScopeStorageAttemptRows, listScopeStorageRows, listScopeStoreStorageRows, pruneScopeStorageRows, recordScopeStorageRows, REQUEST_ROLLUP_DDL, listRequestDayRows, listRequestRollupDayRows, pruneRequestDayRows, recordRequestDayRows, METER_DAYS_DDL, VERTICAL_OWNERS_BACKFILL, VERTICAL_OWNERS_DDL, closeVerticalOwnerRow, listVerticalOwnerRows, openVerticalOwnerRow, verticalOwnerNow, listMeterDayRows, listMeterDayTakeRows, pruneMeterDayRows, recordMeterDayRows, CONNECT_LINKS_DDL, consumeConnectLinkRow, insertConnectLink, listConnectLinks as listConnectLinkRows, readConnectLink, restoreConnectLinkRow, revokeConnectLinkRow, createFindingRule, findingOfOpsFailure, findingOfSweepRun, pruneFindings, listFindingRules, listFindings, observeFinding, revokeFindingRule, setFindingStatus, assertRowLimit, assertRowOffset, OPS_FAILURE_RETENTION_DAYS, SWEEP_RUN_RETENTION_DAYS, SWEEP_RUNS_INTENT_INDEX, sweepRunsIntentHasKind, MODEL_USAGE_RETENTION_DAYS, foldModelUsage, backoffAt, platformRequestHistoryQuery, platformRequestOf, PLATFORM_REQUEST_COLUMNS, PLATFORM_REQUEST_REDACTION_SQL, platformRequestRedactionParams, platformRequestRedactionQuery, intentPayloadCarriesSubject, redactSubjectJobRuns, eraseSubjectFromModules, moduleRowsErased, moduleErasurePlan, redactSubjectScopeText, redactSubjectDirectoryText, ISSUE_EXEMPLAR_OWNER_BACKFILL_SQL, issueExemplarOwner, JOB_RUN_PATCH_SQL, JOB_RUN_CLAIM_SQL, JOB_RUN_RENEW_SQL, JOB_RUN_BEGIN_SQL, JOB_RUN_MISS_SQL, JOB_RUN_MISS_SETTLE_SQL, admissionMissOutcome, JOB_STEP_RECORD_SQL, JOB_LEASE_EXPIRED_NOTE, assertLeaseMs, DELIVERY_ERROR_REDACTION_SQL, REDACTED_DELIVERY_NOTE, seatScopeTuple, applyScopeRoleChange, changeScopeRole, revokeScopeRoles, scopeRoleHolders, assertModuleDeclared, noteDeclaredKeys, noteReservedKeys, dumpRoleRefusal, reservedGrantRefusal, reservedRoleDefinitionRefusal, reservedRoleRefusal, reservedShapeRefusal, SCOPE_SEATED_ROLES_SQL, SEAT_HOLDING_SCOPE_STATUSES, TENANT_SEATED_ROLES_SQL, admitPeer, boundToPeerDeclarations, peerCallerAt, collectPeers, peerSeats, resolveVerticalInstanceFrom, resolvePeerInstanceFrom, peerVerticalSpellings, samePeerVertical, peerGrantsStatus, systemGrantsStatus, systemScheduleState, systemSwitchedOff, systemSwitchedOffMessage, tenantSystemSwitchedOffMessage, PEER_SWITCHES_DDL, PEER_BINDINGS_DDL, SWITCH_OWED_DDL, SWITCH_FENCES_DDL, TABLE_OWNERS_DDL, assertMigrationLeavesLedgerAlone, recordOwnershipSteps, runMigrationStatements, executableSqlStatements, blankSqlComments, recordWriteSuperseded, switchFencesOf, switchSupersededMessage, SWITCH_KINDS, SYSTEM_SWITCHES_DDL, forgetSwitchesOf, listSystemSwitchRecords, moveSwitch, reassertActionOf, reassertEntry, reassertOffRow, recordSwitchedOff, recordSwitchedOn, restoreSwitchRecord, scopesSwitchedOffFor, switchActionOf, switchAuditSubject, recordAuditOutcome, auditedCapabilityRevoke, auditWarningOf, switchNotFoundMessage, switchRecordsOf, switchedOffOf, switchesBackfillSqlOf, switchesTableExists, tenantHeldOf, tenantHoldsGrant, inUnitMovesToAudit, staleCarryRevertRow, staleCarryReverts, withRecorded, VERSION_MIGRATIONS_DDL, VERTICAL_SCOPE_STORES_DDL, forgetVerticalScopeStores, DEPLOYMENT_WIRE_AUTH_DDL, assertWireAuthFilter, deploymentWireAuthOf, forgetVerticalWireAuth, wireAuthAccessTarget, writeDeploymentWireAuth, indexVersionScopeStores, driverDeclarationsOf, verticalScopeStoresOf, STORE_DRIVER_RELEASES_DDL, legacyStoreDriverConflict, legacyStoreDriverRenames, beginStoreDriverRolloutIn, finishStoreDriverRolloutIn, holdStoreDriverIn, advanceStoreDriverRebuildIn, claimStoreDriverRebuildIn, storeDriverRebuildIn, recordStoreDriverReleaseIn, releaseStoreDriverHoldIn, storeDriverReleaseIn, storeDriverStateIn, storeDriverRolloutPendingIn, storeDriverRolloutWalkedIn, splitManifestMigrations, splitVersionMigrationsBatch, versionMigrationsOf, deriveVersionMigrationDigest, publishedMigrationDigest, migrationChangeRefusal, writeVersionMigrations, denialListQuery, refusalListQuery, mapRefusalRow, denialSummaryQuery, denialTotalsQuery, DENIAL_WINDOW_QUERY, mapDenialRow, mapDenialSummaryBuckets, IMPERSONATION_COLUMNS, IMPERSONATION_DDL, ImpersonationRefused, assertImpersonationWrites, assertModuleEnqueueableKind, assertSessionUsable, impersonationByIdQuery, impersonationListQuery, impersonationRowValues, impersonationStampOf, mapImpersonationRow, newImpersonationSession, resolveRetryPolicy, executorOutcomeOf, isDeliveryRefusal, refusalJournalText, membershipFencesBackfillSql, MEMBERSHIP_FENCES_DDL, membershipFencesTableExists, MEMBERSHIP_FENCE_SINCE_SQL, RAISE_MEMBERSHIP_FENCE_SQL, memberAddedAudit, orgChangeBound, tenantCoverage, isSecretBoxConfigured, unconfiguredSecretBox, createSubjectKeys, generateSealingKeyPair, noSealingKeyMessage, openSealed, sealTo, ConnectionSealingKeyUnavailableError, PermissionDenied, createAtomic, NotSearchable, NotListable, listIndexMigrations, listIndexPlans, listQuery, cursorOf, moduleMigrations, MIGRATION_DIGEST_FENCE_DDL, MIGRATION_DIGEST_MARK_LEGACY, assertJournalDumpCoherent, assertMigrationSql, migrationDivergence, migrationFailedError, migrationSetDivergence, migrationSteps, planMigrations, isSearchIndexTable, searchIndexMigrations, searchIndexPlans, searchLimit, searchMatchExpression, searchQuery, ATTACHMENT_TEXT_DDL, ATTACHMENT_CONDEMNED_DDL, ATTACHMENT_SWEEP_LICENCE_DDL, ATTACHMENT_SWEEP_LICENCE_TABLE, clearOrphanSweepLicence, condemnLicensedOrphanAttachments, consumeOrphanSweepLicence, licensedOrphanIds, recordOrphanSweepLicence, refuseUnlicensedOrphanSweep, fenceAttachmentSweep, refuseCondemnedAttachment, refuseCondemnedInDump, rowlessAttachmentIds, sweepOrphanAttachments, missingAttachmentStore, SETTLED_COPY_STATES, unsettledCopyRefusal, assertAttachmentExtractors, resolveAttachmentTextBounds, assertJobRegistrable, attachmentRecordOfRow, attachmentTextJob, enqueueAttachmentText, ATTACHMENT_TEXT_BACKFILL_JOB, ATTACHMENT_TEXT_JOB, kernelJobFor, queueAttachmentTextBackfill, startAttachmentTextBackfill, attachmentTextBackfillJob, reconcileAttachmentText, recordAttachmentText, searchAttachments, entityVersionQuery, entityVersionOf, assertIfMatch, OUTBOX_ENTITY_INDEX, SCHEDULE_STATE_DDL, SCHEDULE_STATE_REBUILD, scheduleStateHasKind, VERTICAL_EVENTS_DDL, EXPORT_HOPS_SQL, emptyImportResult, IMPORT_CURSORS_SQL, IMPORT_CURSOR_OF_SQL, OUTBOX_MARK_SQL, emittedSinceQuery, emittedReportOf, EMITTED_REPORT_CAP, exportedSinceQuery, IMPORT_CURSOR_ADVANCE_SQL, IMPORT_RECORD_SQL, moveImportCursor, importCursorSourceOf, exportBreaksOf, exportBreakRefusal, assertPromoteReviewCurrent, promoteRaceRefusal, servingRaceRefusal, autoAdmittedProdRefusal, listedPromoteRefusal, rebindRaceRefusal, SERVES_NOW_CONDITION, SERVES_NOW_PREDICATE, servesNowParams, migratesFrom, servedFromRow, servesAsFrom, bindExportBreaksOf, bindExportBreakRefusal, scopeMoveOf, runningVersionOf, isPrimaryScope, PROVISIONED_VERSIONS_SQL, installsReconciledOf, strandJudgmentsOf, provisionedVersionsParams, boundShapesColumn, boundShapesOfColumn, installReconciled, CrossVerticalRegistry, exportReadPlan, exportReadQuery, planExportBatch, withheldNote, WIRE_NONCE_DDL, WIRE_NONCE_FULL, claimWireNonceIn, isWireNonceTable, JOB_RUN_DDL, JOB_RUN_DUE_AT, jobRunListLimit, jobRunOf, runDueJobRuns, startJobRun, IDEMPOTENCY_DDL, REFUSALS_TABLE_DDL, REFUSALS_INDEX, refusalInsert, refusalOf, markGuardRefusal, REFUSALS_REBUILD, refusalsAdmitGuards, assertIdempotencyKey, idempotencyLookupQuery, idempotencyPruneStatement, idempotencyRecordStatement, idempotencyOptedOutMessage, replayFor, globalFetch, fetchLikeOf, deadlineFetch, createUlid, facetEvents, readHistory, walkEventCause, walkEventEffects, assertRedrainWindow, readInvocation, readDeadLetters, readLifecycleFlow, readOperationSeries, domainEventOf, readUndrainedOutbox, undrainedEventsOf, connectorCallRecord, noopConnectorCallRecorder, recordConnectorCall, settleConnectionUse, unknownRoleError, callReservedStoreOperation, callScopeStore, observeStoreCall, replayStoreErasures, scopeStoreLifecycleOf, scopeStoreRunnersOf, } from '@substrat-run/kernel';
 import { attributedView, delegatedRevokeSql, writeExplicitTupleIn, grantEntityShapeIn, shapeTopUpBatch, topUpEntityGrantShapes, settlePlatformRequestIn, } from '@substrat-run/kernel';
 import { ADMIN_LOG_INDEXES_SQL, SETTLE_INTENT_SQL, SETTLE_OUTCOME_SQL, settleOutcomeParamsOf, readAuditedOperations, unknownOutcomeOf, } from '@substrat-run/kernel';
 import { INERT_SCOPE_REASON, isPrimaryScopeRow, normalizeUploadMediaType } from '@substrat-run/kernel';
@@ -2234,11 +2234,10 @@ export class SqliteScopeHost {
         // Physically mint the database now, so a successful mint means the file exists (matching
         // "the platform mints the store"); the vertical then runs its OWN migrations against it.
         this.tenantStoreDb(ref);
-        this.directory
+        this.directoryWriteAndAudit(() => this.directory
             .prepare(`INSERT INTO tenant_stores (tenant_id, vertical, binding, kind, ref, created_at)
          VALUES (?, ?, ?, 'relational', ?, ?)`)
-            .run(input.tenantId, input.vertical, input.binding, ref, new Date().toISOString());
-        this.recordAdmin(actor, 'provisionTenantStore', { tenantId: input.tenantId, vertical: input.vertical }, null, { binding: input.binding, kind: 'relational', ref });
+            .run(input.tenantId, input.vertical, input.binding, ref, new Date().toISOString()).changes > 0, () => this.recordAdmin(actor, 'provisionTenantStore', { tenantId: input.tenantId, vertical: input.vertical }, null, { binding: input.binding, kind: 'relational', ref }));
         return { binding: input.binding, kind: 'relational', ref };
     }
     openTenantStore(handle) {
@@ -2295,11 +2294,10 @@ export class SqliteScopeHost {
         const safeVertical = input.vertical.replace(/[^A-Za-z0-9_-]+/g, '-');
         const ref = `blob__${input.tenantId}__${safeVertical}__${input.binding}__${ulid()}`;
         mkdirSync(join(this.dir, ref), { recursive: true });
-        this.directory
+        this.directoryWriteAndAudit(() => this.directory
             .prepare(`INSERT INTO blob_stores (tenant_id, vertical, binding, kind, ref, created_at)
          VALUES (?, ?, ?, 'blob', ?, ?)`)
-            .run(input.tenantId, input.vertical, input.binding, ref, new Date().toISOString());
-        this.recordAdmin(actor, 'provisionBlobStore', { tenantId: input.tenantId, vertical: input.vertical }, null, { binding: input.binding, kind: 'blob', ref });
+            .run(input.tenantId, input.vertical, input.binding, ref, new Date().toISOString()).changes > 0, () => this.recordAdmin(actor, 'provisionBlobStore', { tenantId: input.tenantId, vertical: input.vertical }, null, { binding: input.binding, kind: 'blob', ref }));
         return { binding: input.binding, kind: 'blob', ref };
     }
     /** A `TenantBlobStore` over the per-tenant directory a `ref` names (#473). Keys are
@@ -3749,6 +3747,13 @@ export class SqliteScopeHost {
             throw substratError('not_found', `unknown version ${versionId} for vertical '${slug}'`);
         return connectionLandingsOfManifestJson(manifest);
     }
+    /** What one version of `slug` declares about vertical-defined connectors (vertical-connectors.md §6.4); `not_found` for a version it does not know. */
+    async versionConnectors(slug, versionId) {
+        const manifest = this.manifestJsonOf(versionId, slug);
+        if (manifest === undefined)
+            throw substratError('not_found', `unknown version ${versionId} for vertical '${slug}'`);
+        return connectorsOfManifestJson(manifest);
+    }
     /** #1705 PR 3: the promote gate's question, over two stored versions (`exportBreaksOf`). */
     exportBreaksBetween(actor, producer, outgoingId, incomingId) {
         return exportBreaksOf({
@@ -7425,6 +7430,9 @@ export class SqliteScopeHost {
                     installSpec.provides = parsed.provides;
                 if (parsed.requires)
                     installSpec.requires = parsed.requires;
+                // The declared vertical-defined connectors (vertical-connectors.md §7.2), the dashboard's door.
+                if (parsed.connectors)
+                    installSpec.connectors = parsed.connectors;
                 if (parsed.provisions)
                     installSpec.provisions = parsed.provisions;
                 if (parsed.sendsEmail)
@@ -7732,6 +7740,7 @@ export class SqliteScopeHost {
                     ack,
                     channel,
                     baseId: outgoing?.id ?? null,
+                    permissionsChange: outgoing !== undefined && outgoing.permissionDigest !== incoming.permissionDigest,
                     migrationsChange: outgoing !== undefined && outgoing.migrationDigest !== incoming.migrationDigest,
                     read: async () => ({ base: outgoing ? reviewed(outgoing) : null, incoming: reviewed(incoming) }),
                 });
@@ -8084,33 +8093,39 @@ export class SqliteScopeHost {
                     migrationTag: r.serving_migration_tag,
                 });
             },
-            setVerticalServing: async (actor, verticalSlug, state) => {
+            setVerticalServing: async (actor, verticalSlug, state, expected) => {
                 const parsed = verticalServingState.parse(state);
                 const r = this.directory
                     .prepare('SELECT * FROM verticals WHERE slug = ?')
                     .get(verticalSlug);
                 if (!r)
                     throw substratError('not_found', `unknown vertical '${verticalSlug}'`);
+                // #2577: the caller's upload diffed its DO-class migration from `expected`'s class set and tag.
+                if (expected !== undefined && !migratesFrom(r, expected))
+                    throw servingRaceRefusal(verticalSlug);
                 // #2178: every install on the serving script runs the new version from this moment.
                 this.assertNoStrandFrom([r.serving_version_id], parsed.versionId, r.serving_ref ? this.provisionedVersionsOf(verticalSlug, r.serving_version_id ? { ref: r.serving_ref, versionId: r.serving_version_id } : null, null) : []);
-                // #2528: a compare-and-set on the serving ref and version the gate judged
-                // (`SERVES_NOW_CONDITION`), and the row's `before` read in the transaction that moves it,
-                // as the Cloudflare host does.
+                // #2528/#2577: a compare-and-set on the serving state the gate judged, its ref, version,
+                // class set and tag (a serve and a re-serve can bring the ref and version back over a grown
+                // class set), and the row's `before` read in the transaction that moves it, as the
+                // Cloudflare host does.
                 let before = null;
                 let raced = false;
                 this.directoryWriteAndAudit(() => {
                     const now = this.directory
-                        .prepare('SELECT serving_ref, serving_version_id FROM verticals WHERE slug = ?')
+                        .prepare('SELECT * FROM verticals WHERE slug = ?')
                         .get(verticalSlug);
                     if (!now)
                         throw substratError('not_found', `unknown vertical '${verticalSlug}'`);
                     before = now.serving_ref ? { ref: now.serving_ref, versionId: now.serving_version_id } : null;
-                    const moved = this.directory
+                    raced = !servesAsFrom(now, servedFromRow(r));
+                    if (raced)
+                        return false;
+                    this.directory
                         .prepare(`UPDATE verticals SET serving_ref = ?, serving_version_id = ?,
-                      serving_do_classes = ?, serving_migration_tag = ? WHERE ${SERVES_NOW_CONDITION}`)
-                        .run(parsed.ref, parsed.versionId, JSON.stringify(parsed.doClasses), parsed.migrationTag, verticalSlug, r.serving_ref ?? null, r.serving_version_id ?? null).changes > 0;
-                    raced = !moved;
-                    return moved;
+                      serving_do_classes = ?, serving_migration_tag = ? WHERE slug = ?`)
+                        .run(parsed.ref, parsed.versionId, JSON.stringify(parsed.doClasses), parsed.migrationTag, verticalSlug);
+                    return true;
                 }, () => this.recordAdmin(actor, 'setVerticalServing', { tenantId: null }, before, { vertical: verticalSlug, ref: parsed.ref, versionId: parsed.versionId }));
                 if (raced)
                     throw servingRaceRefusal(verticalSlug);
@@ -8726,10 +8741,12 @@ export class SqliteScopeHost {
             // this host's clock, so a test can let a lease lapse without waiting.
             recordStoreDriverRelease: async (actor, input) => {
                 const at = this.clock();
-                const { record, created } = this.directory.transaction(() => recordStoreDriverReleaseIn(switchSqlOf(this.directory), { ...input, actor, at }))();
-                if (created)
-                    this.recordAdmin(actor, 'uploadStoreDriverRelease', { tenantId: null }, null, record, at);
-                return record;
+                let result;
+                this.directoryWriteAndAudit(() => {
+                    result = recordStoreDriverReleaseIn(switchSqlOf(this.directory), { ...input, actor, at });
+                    return result.created;
+                }, () => this.recordAdmin(actor, 'uploadStoreDriverRelease', { tenantId: null }, null, result.record, at));
+                return result.record;
             },
             getStoreDriverRelease: async (actor, driver, sha256) => {
                 const record = storeDriverReleaseIn(switchSqlOf(this.directory), driver, sha256);
@@ -8762,14 +8779,20 @@ export class SqliteScopeHost {
             },
             beginStoreDriverRollout: async (actor, input) => {
                 const at = this.clock();
-                const row = this.directory.transaction(() => beginStoreDriverRolloutIn(switchSqlOf(this.directory), { ...input, actor, at, nowMs: Date.parse(at) }))();
-                this.recordAdmin(actor, input.action === 'rollback' ? 'rollBackStoreDriver' : 'rollOutStoreDriver', { tenantId: null }, null, row, at);
+                let row;
+                this.directoryWriteAndAudit(() => {
+                    row = beginStoreDriverRolloutIn(switchSqlOf(this.directory), { ...input, actor, at, nowMs: Date.parse(at) });
+                    return true;
+                }, () => this.recordAdmin(actor, input.action === 'rollback' ? 'rollBackStoreDriver' : 'rollOutStoreDriver', { tenantId: null }, null, row, at));
                 return row;
             },
             finishStoreDriverRollout: async (actor, input) => {
                 const at = this.clock();
-                const row = this.directory.transaction(() => finishStoreDriverRolloutIn(switchSqlOf(this.directory), { ...input, at, nowMs: Date.parse(at) }))();
-                this.recordAdmin(actor, row.action === 'rollback' ? 'rollBackStoreDriver' : 'rollOutStoreDriver', { tenantId: null }, null, row, at);
+                let row;
+                this.directoryWriteAndAudit(() => {
+                    row = finishStoreDriverRolloutIn(switchSqlOf(this.directory), { ...input, at, nowMs: Date.parse(at) });
+                    return true;
+                }, () => this.recordAdmin(actor, row.action === 'rollback' ? 'rollBackStoreDriver' : 'rollOutStoreDriver', { tenantId: null }, null, row, at));
                 return row;
             },
             storeDriverRebuild: async (actor, driver) => {
@@ -8970,6 +8993,9 @@ export class SqliteScopeHost {
                                 insert.run(...row);
                         },
                     });
+                    // The dump's rows have landed in the rebuilt tables. Append this restore's
+                    // own row before commit, so a failed insert rolls the imported state back.
+                    this.recordAdmin(actor, 'restoreDirectory', { tenantId: null }, { tenants: before }, { capturedAt: dump.capturedAt, tables: dump.tables.length });
                 })();
                 // #1764's split, over any version the dump stored before it.
                 this.splitVersionMigrations();
@@ -8977,7 +9003,6 @@ export class SqliteScopeHost {
                 // table would leave every permission check reading the PRE-restore roles until
                 // the process restarted — the exact silent-divergence a recovery must not have.
                 this.loadRoles();
-                this.recordAdmin(actor, 'restoreDirectory', { tenantId: null }, { tenants: before }, { capturedAt: dump.capturedAt, tables: dump.tables.length });
             },
             activateScope: async (actor, tenantId, scopeId) => {
                 // Idempotent on `active`, unaudited because nothing changed. Provisioning is
@@ -9210,15 +9235,15 @@ export class SqliteScopeHost {
                 // records an access that could never have happened.
                 this.assertScope(input.tenantId, input.scopeId);
                 const session = newImpersonationSession(ulid(), actor, input, this.clock());
-                this.directory
+                this.directoryWriteAndAudit(() => this.directory
                     .prepare(`INSERT INTO _substrat_impersonations
                (${IMPERSONATION_COLUMNS}) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`)
-                    .run(...impersonationRowValues(session));
+                    .run(...impersonationRowValues(session)).changes > 0, 
                 // BEFORE the session is returned, so the log entry precedes every row it
                 // will ever touch. The reason rides in `after` — it is the field a review
                 // reads first, and a log saying a session opened but not why is half a
                 // record.
-                this.recordAdmin(actor, 'beginImpersonation', { tenantId: session.tenantId, scopeId: session.scopeId }, null, session);
+                () => this.recordAdmin(actor, 'beginImpersonation', { tenantId: session.tenantId, scopeId: session.scopeId }, null, session));
                 return session;
             },
             endImpersonation: async (actor, id) => {
@@ -9227,11 +9252,14 @@ export class SqliteScopeHost {
                 // already stopped it, and it must not move the moment it stopped.
                 if (before.endedAt !== null)
                     return before;
-                this.directory
-                    .prepare('UPDATE _substrat_impersonations SET ended_at = ? WHERE id = ?')
-                    .run(this.clock(), id);
-                const after = this.readImpersonation(id);
-                this.recordAdmin(actor, 'endImpersonation', { tenantId: after.tenantId, scopeId: after.scopeId }, before, after);
+                let after;
+                this.directoryWriteAndAudit(() => {
+                    const changed = this.directory
+                        .prepare('UPDATE _substrat_impersonations SET ended_at = ? WHERE id = ?')
+                        .run(this.clock(), id).changes > 0;
+                    after = this.readImpersonation(id);
+                    return changed;
+                }, () => this.recordAdmin(actor, 'endImpersonation', { tenantId: after.tenantId, scopeId: after.scopeId }, before, after));
                 return after;
             },
             listImpersonations: async (actor, filter) => {
@@ -9404,24 +9432,23 @@ export class SqliteScopeHost {
             },
             registerIdentityPool: async (actor, input) => {
                 const parsed = identityPool.parse(input);
-                const existing = readPool(parsed.provider);
-                if (existing) {
-                    // Idempotent on an identical registration. A CONFLICTING one throws:
-                    // flipping a live pool's topology silently reinterprets every row it owns
-                    // — the same externalId across tenants would change from one human to two.
-                    if (existing.topology === parsed.topology && existing.tenantId === parsed.tenantId) {
-                        return;
+                this.directoryWriteAndAudit(() => {
+                    const existing = readPool(parsed.provider);
+                    if (existing) {
+                        // Idempotent on an identical registration. A conflicting one is refused.
+                        if (existing.topology === parsed.topology && existing.tenantId === parsed.tenantId) {
+                            return false;
+                        }
+                        throw substratError('conflict', `identity pool '${parsed.provider}' is already registered as ${existing.topology}` +
+                            `${existing.tenantId ? ` for tenant ${existing.tenantId}` : ''}`);
                     }
-                    throw substratError('conflict', `identity pool '${parsed.provider}' is already registered as ${existing.topology}` +
-                        `${existing.tenantId ? ` for tenant ${existing.tenantId}` : ''}`);
-                }
-                this.directory
-                    .prepare('INSERT INTO _substrat_identity_pools (provider, topology, tenant_id, created_at) VALUES (?, ?, ?, ?)')
-                    .run(parsed.provider, parsed.topology, parsed.tenantId, new Date().toISOString());
-                this.recordAdmin(actor, 'registerIdentityPool', 
+                    return this.directory
+                        .prepare('INSERT INTO _substrat_identity_pools (provider, topology, tenant_id, created_at) VALUES (?, ?, ?, ?)')
+                        .run(parsed.provider, parsed.topology, parsed.tenantId, new Date().toISOString()).changes > 0;
+                }, () => this.recordAdmin(actor, 'registerIdentityPool', 
                 // Null for a central pool: it belongs to no single tenant, which is what
                 // made the admin log's tenantId nullable.
-                { tenantId: parsed.tenantId }, null, parsed);
+                { tenantId: parsed.tenantId }, null, parsed));
             },
             getIdentityPool: async (actor, provider) => {
                 const pool = readPool(provider);
@@ -9500,42 +9527,46 @@ export class SqliteScopeHost {
                 const input = createConnectionInput.parse(raw);
                 const sealed = await this.secretBox.seal(JSON.stringify(input.secret));
                 const now = new Date().toISOString();
-                try {
-                    this.directory
-                        .prepare(`INSERT INTO _substrat_connections
+                this.directoryWriteAndAudit(() => {
+                    try {
+                        this.directory
+                            .prepare(`INSERT INTO _substrat_connections
                  (id, tenant_id, vertical, provider, label, status, external_account_ref,
                   scopes, expires_at, last_ok_at, last_error, last_error_at,
                   created_by, created_at, revoked_at)
                VALUES (?, ?, ?, ?, ?, 'active', ?, ?, ?, NULL, NULL, NULL, ?, ?, NULL)`)
-                        .run(input.id, input.tenantId, input.vertical, input.provider, input.label, input.externalAccountRef ?? null, JSON.stringify(input.scopes), input.expiresAt ?? null, 
-                    // The authorizing principal when supplied (a self-serve connect), else the
-                    // effecting platform actor. See connections.md §3.5.1 / createConnectionInput.
-                    input.createdBy ?? actor, now);
-                }
-                catch (err) {
-                    if (/UNIQUE constraint failed/i.test(err.message)) {
-                        const account = input.externalAccountRef
-                            ? ` under account '${input.externalAccountRef}'`
-                            : '';
-                        throw new Error(`tenant ${input.tenantId} already has a live '${input.provider}' connection ` +
-                            `for vertical '${input.vertical}'${account} — revoke it before connecting another`);
+                            .run(input.id, input.tenantId, input.vertical, input.provider, input.label, input.externalAccountRef ?? null, JSON.stringify(input.scopes), input.expiresAt ?? null, 
+                        // The authorizing principal when supplied (a self-serve connect), else the
+                        // effecting platform actor. See connections.md §3.5.1 / createConnectionInput.
+                        input.createdBy ?? actor, now);
                     }
-                    throw err;
-                }
-                this.directory
-                    .prepare(`INSERT INTO _substrat_connection_secrets (connection_id, key_id, ciphertext, updated_at)
+                    catch (err) {
+                        if (/UNIQUE constraint failed/i.test(err.message)) {
+                            const account = input.externalAccountRef
+                                ? ` under account '${input.externalAccountRef}'`
+                                : '';
+                            throw new Error(`tenant ${input.tenantId} already has a live '${input.provider}' connection ` +
+                                `for vertical '${input.vertical}'${account} — revoke it before connecting another`);
+                        }
+                        throw err;
+                    }
+                    this.directory
+                        .prepare(`INSERT INTO _substrat_connection_secrets (connection_id, key_id, ciphertext, updated_at)
              VALUES (?, ?, ?, ?)`)
-                    .run(input.id, sealed.keyId, sealed.ciphertext, now);
-                // METADATA ONLY. `_substrat_admin_log` is append-only, so a credential
-                // written here could never be removed — the redaction is the point, and
-                // it is structural rather than a rule someone has to remember.
-                this.recordAdmin(actor, 'createConnection', { tenantId: input.tenantId, vertical: input.vertical }, null, {
-                    id: input.id,
-                    provider: input.provider,
-                    label: input.label,
-                    scopes: input.scopes,
-                    externalAccountRef: input.externalAccountRef ?? null,
-                    createdBy: input.createdBy ?? actor,
+                        .run(input.id, sealed.keyId, sealed.ciphertext, now);
+                    return true;
+                }, () => {
+                    // METADATA ONLY. `_substrat_admin_log` is append-only, so a credential
+                    // written here could never be removed — the redaction is the point, and
+                    // it is structural rather than a rule someone has to remember.
+                    this.recordAdmin(actor, 'createConnection', { tenantId: input.tenantId, vertical: input.vertical }, null, {
+                        id: input.id,
+                        provider: input.provider,
+                        label: input.label,
+                        scopes: input.scopes,
+                        externalAccountRef: input.externalAccountRef ?? null,
+                        createdBy: input.createdBy ?? actor,
+                    });
                 });
             },
             connectionSealingKey: (id) => this.ensureSealingKey(id),
@@ -9600,25 +9631,29 @@ export class SqliteScopeHost {
                 const row = this.connectionRow(id);
                 const sealed = await this.secretBox.seal(JSON.stringify(connectionSecret.parse(secret)));
                 const now = new Date().toISOString();
-                this.directory
-                    .prepare(`UPDATE _substrat_connection_secrets
+                this.directoryWriteAndAudit(() => {
+                    this.directory
+                        .prepare(`UPDATE _substrat_connection_secrets
              SET key_id = ?, ciphertext = ?, updated_at = ? WHERE connection_id = ?`)
-                    .run(sealed.keyId, sealed.ciphertext, now, id);
-                // A refresh revives a connection that had lapsed or errored.
-                this.directory
-                    .prepare(`UPDATE _substrat_connections
+                        .run(sealed.keyId, sealed.ciphertext, now, id);
+                    // A refresh revives a connection that had lapsed or errored.
+                    this.directory
+                        .prepare(`UPDATE _substrat_connections
              SET status = 'active', expires_at = ?, last_error = NULL, last_error_at = NULL
              WHERE id = ?`)
-                    .run(expiresAt === undefined ? row.expires_at : expiresAt, id);
-                // The event, never the token. "Rotated at T" is the auditable fact — plus WHO
-                // authorized it when the rotation was a tenant admin's act (§3.5.1's attribution,
-                // rotate-side): the principal, never laundered into the actor column.
-                this.recordAdmin(actor, 'updateConnectionSecret', { tenantId: row.tenant_id, vertical: row.vertical }, null, {
-                    id,
-                    provider: row.provider,
-                    rotatedAt: now,
-                    expiresAt: expiresAt === undefined ? row.expires_at : expiresAt,
-                    ...(opts?.rotatedBy ? { rotatedBy: opts.rotatedBy } : {}),
+                        .run(expiresAt === undefined ? row.expires_at : expiresAt, id);
+                    return true;
+                }, () => {
+                    // The event, never the token. "Rotated at T" is the auditable fact — plus WHO
+                    // authorized it when the rotation was a tenant admin's act (§3.5.1's attribution,
+                    // rotate-side): the principal, never laundered into the actor column.
+                    this.recordAdmin(actor, 'updateConnectionSecret', { tenantId: row.tenant_id, vertical: row.vertical }, null, {
+                        id,
+                        provider: row.provider,
+                        rotatedAt: now,
+                        expiresAt: expiresAt === undefined ? row.expires_at : expiresAt,
+                        ...(opts?.rotatedBy ? { rotatedBy: opts.rotatedBy } : {}),
+                    });
                 });
             },
             revokeConnection: async (actor, id) => {
@@ -9626,27 +9661,29 @@ export class SqliteScopeHost {
                 if (row.revoked_at)
                     return; // idempotent, and a no-op is not audited
                 const now = new Date().toISOString();
-                this.directory
-                    .prepare(`UPDATE _substrat_connections SET status = 'revoked', revoked_at = ? WHERE id = ?`)
-                    .run(now, id);
-                // The sealed blob goes NOW. A tombstoned connection is evidence that a
-                // grant existed (K-21); keeping the usable credential would make it a
-                // liability instead. The row says what happened; the secret does not.
-                this.directory
-                    .prepare('DELETE FROM _substrat_connection_secrets WHERE connection_id = ?')
-                    .run(id);
-                // Connector state dies with the connection: it is that connection's
-                // private bookkeeping and means nothing once it can no longer act.
-                this.directory
-                    .prepare('DELETE FROM _substrat_connector_state WHERE connection_id = ?')
-                    .run(id);
-                // #592: its grants tombstone (K-21 — evidence, not roster). Absent from the
-                // next gather, so no later provision/reconcile delivers them again.
-                this.directory
-                    .prepare(`UPDATE _substrat_connection_grants SET revoked_at = ?
+                this.directoryWriteAndAudit(() => {
+                    this.directory
+                        .prepare(`UPDATE _substrat_connections SET status = 'revoked', revoked_at = ? WHERE id = ?`)
+                        .run(now, id);
+                    // The sealed blob goes NOW. A tombstoned connection is evidence that a
+                    // grant existed (K-21); keeping the usable credential would make it a
+                    // liability instead. The row says what happened; the secret does not.
+                    this.directory
+                        .prepare('DELETE FROM _substrat_connection_secrets WHERE connection_id = ?')
+                        .run(id);
+                    // Connector state dies with the connection: it is that connection's
+                    // private bookkeeping and means nothing once it can no longer act.
+                    this.directory
+                        .prepare('DELETE FROM _substrat_connector_state WHERE connection_id = ?')
+                        .run(id);
+                    // #592: its grants tombstone (K-21 — evidence, not roster). Absent from the
+                    // next gather, so no later provision/reconcile delivers them again.
+                    this.directory
+                        .prepare(`UPDATE _substrat_connection_grants SET revoked_at = ?
              WHERE connection_id = ? AND revoked_at IS NULL`)
-                    .run(now, id);
-                this.recordAdmin(actor, 'revokeConnection', { tenantId: row.tenant_id, vertical: row.vertical }, { status: row.status }, { id, provider: row.provider, status: 'revoked', revokedAt: now });
+                        .run(now, id);
+                    return true;
+                }, () => this.recordAdmin(actor, 'revokeConnection', { tenantId: row.tenant_id, vertical: row.vertical }, { status: row.status }, { id, provider: row.provider, status: 'revoked', revokedAt: now }));
             },
             // -- a vertical's mailed connect links (connections.md §3.5.4) --------------
             // The statements are the kernel's (`connect-links.ts`), shared with the hosted
@@ -9786,32 +9823,30 @@ export class SqliteScopeHost {
                 // Read before write. `INSERT OR IGNORE` alone cannot tell "already bound to the
                 // same principal" (idempotent) from "already bound to someone else" (a
                 // collision), and silently ignoring the second resolves one person as another.
-                const existing = this.directory
-                    .prepare(`SELECT principal_id FROM _substrat_identities
+                this.directoryWriteAndAudit(() => {
+                    const existing = this.directory
+                        .prepare(`SELECT principal_id FROM _substrat_identities
              WHERE tenant_id = ? AND provider = ? AND external_id = ?`)
-                    .get(parsed.tenantId, parsed.provider, parsed.externalId);
-                if (existing) {
-                    if (existing.principal_id === parsed.principal)
-                        return; // idempotent, unaudited
-                    throw substratError('conflict', `identity ${parsed.provider}:${parsed.externalId} in tenant ${parsed.tenantId} ` +
-                        `is already bound to ${existing.principal_id}`);
-                }
-                this.directory
-                    .prepare(`INSERT INTO _substrat_identities
+                        .get(parsed.tenantId, parsed.provider, parsed.externalId);
+                    if (existing) {
+                        if (existing.principal_id === parsed.principal)
+                            return false; // idempotent, unaudited
+                        throw substratError('conflict', `identity ${parsed.provider}:${parsed.externalId} in tenant ${parsed.tenantId} ` +
+                            `is already bound to ${existing.principal_id}`);
+                    }
+                    return this.directory
+                        .prepare(`INSERT INTO _substrat_identities
                (provider, external_id, principal_id, tenant_id, scope_id, created_at)
              VALUES (?, ?, ?, ?, ?, ?)`)
-                    .run(parsed.provider, parsed.externalId, parsed.principal, parsed.tenantId, parsed.scopeId ?? null, new Date().toISOString());
-                this.recordAdmin(actor, 'linkIdentity', { tenantId: parsed.tenantId, scopeId: parsed.scopeId }, null, { provider: parsed.provider, externalId: parsed.externalId, principal: parsed.principal });
+                        .run(parsed.provider, parsed.externalId, parsed.principal, parsed.tenantId, parsed.scopeId ?? null, new Date().toISOString()).changes > 0;
+                }, () => this.recordAdmin(actor, 'linkIdentity', { tenantId: parsed.tenantId, scopeId: parsed.scopeId }, null, { provider: parsed.provider, externalId: parsed.externalId, principal: parsed.principal }));
             },
             unlinkIdentity: async (actor, tenantId, principal) => {
                 // DELETE, not a tombstone — the identity map is current state (audit is the log),
                 // and re-inviting must be able to re-link a fresh principal for the same person.
-                const info = this.directory
+                this.directoryWriteAndAudit(() => this.directory
                     .prepare(`DELETE FROM _substrat_identities WHERE tenant_id = ? AND principal_id = ?`)
-                    .run(tenantId, principal);
-                if (info.changes === 0)
-                    return; // no link — idempotent, unaudited
-                this.recordAdmin(actor, 'unlinkIdentity', { tenantId, scopeId: null }, { principal }, null);
+                    .run(tenantId, principal).changes > 0, () => this.recordAdmin(actor, 'unlinkIdentity', { tenantId, scopeId: null }, { principal }, null));
             },
             resolveIdentity: async (tenantId, provider, externalId) => {
                 const row = this.directory
@@ -9907,32 +9942,40 @@ export class SqliteScopeHost {
                 // `drained_at IS NULL` makes the stamp idempotent: a retried pass that ships
                 // the same batch twice re-stamps nothing and reports 0, so the admin log does
                 // not grow a row claiming an egress that already happened.
-                const info = this.directory
-                    .prepare(`UPDATE _substrat_access_log SET drained_at = ?
+                let drained = 0;
+                this.directoryWriteAndAudit(() => {
+                    const info = this.directory
+                        .prepare(`UPDATE _substrat_access_log SET drained_at = ?
              WHERE id <= ? AND drained_at IS NULL`)
-                    .run(drainedAt, upToId);
-                if (info.changes > 0) {
+                        .run(drainedAt, upToId);
+                    drained = info.changes;
+                    return drained > 0;
+                }, () => {
                     // The payload is the APPLIED state, so it belongs in `after` (contracts'
                     // adminLogEntry: before = prior state, after = the applied payload).
-                    this.recordAdmin(actor, 'drainAccessLog', { tenantId: null }, null, { drained: info.changes, upToId, drainedAt });
-                }
-                return info.changes;
+                    this.recordAdmin(actor, 'drainAccessLog', { tenantId: null }, null, { drained, upToId, drainedAt });
+                });
+                return drained;
             },
             pruneAccessLog: async (actor, limit) => {
                 assertRowLimit('limit', limit);
                 // ONLY drained rows. Age alone is not a licence to delete evidence.
-                const info = this.directory
-                    .prepare(`DELETE FROM _substrat_access_log WHERE id IN (
+                let pruned = 0;
+                this.directoryWriteAndAudit(() => {
+                    const info = this.directory
+                        .prepare(`DELETE FROM _substrat_access_log WHERE id IN (
                SELECT id FROM _substrat_access_log WHERE drained_at IS NOT NULL ORDER BY id LIMIT ?
              )`)
-                    .run(limit);
-                if (info.changes > 0) {
+                        .run(limit);
+                    pruned = info.changes;
+                    return pruned > 0;
+                }, () => {
                     // The payload is the APPLIED state, so it belongs in `after` (contracts'
                     // adminLogEntry: before = prior state, after = the applied payload) — the
                     // same shape as drainAccessLog's row above (#557).
-                    this.recordAdmin(actor, 'pruneAccessLog', { tenantId: null }, null, { pruned: info.changes });
-                }
-                return info.changes;
+                    this.recordAdmin(actor, 'pruneAccessLog', { tenantId: null }, null, { pruned });
+                });
+                return pruned;
             },
             auditLog: async (actor, filter) => {
                 const where = [];
@@ -10219,21 +10262,27 @@ export class SqliteScopeHost {
                 return rows.map((r) => issueEntry.parse(issueOf(r)));
             },
             setIssueStatus: async (actor, fingerprint, status) => {
-                const existing = this.directory
-                    .prepare('SELECT * FROM _substrat_issues WHERE fingerprint = ?')
-                    .get(fingerprint);
-                if (!existing)
-                    return undefined;
-                const resolvedAt = status === 'resolved' ? new Date().toISOString() : null;
-                // "Resolved under X": freeze the newest version at the verdict, so a later
-                // regression can name the pair. A reopen or ignore clears it with the timestamp.
-                const resolvedVersion = status === 'resolved' ? existing.last_version : null;
-                this.directory
-                    .prepare('UPDATE _substrat_issues SET status = ?, resolved_at = ?, resolved_version = ? WHERE fingerprint = ?')
-                    .run(status, resolvedAt, resolvedVersion, fingerprint);
-                const after = issueEntry.parse(issueOf({ ...existing, status, resolved_at: resolvedAt, resolved_version: resolvedVersion }));
-                // A lifecycle flip is a staff mutation — audited with the diff (K-33).
-                this.recordAdmin(actor, 'setIssueStatus', { tenantId: null, vertical: after.lastVertical }, { fingerprint, status: existing.status }, { fingerprint, status: after.status });
+                let existing;
+                let after;
+                this.directoryWriteAndAudit(() => {
+                    existing = this.directory
+                        .prepare('SELECT * FROM _substrat_issues WHERE fingerprint = ?')
+                        .get(fingerprint);
+                    if (!existing)
+                        return false;
+                    const resolvedAt = status === 'resolved' ? new Date().toISOString() : null;
+                    // "Resolved under X": freeze the newest version at the verdict, so a later
+                    // regression can name the pair. A reopen or ignore clears it with the timestamp.
+                    const resolvedVersion = status === 'resolved' ? existing.last_version : null;
+                    this.directory
+                        .prepare('UPDATE _substrat_issues SET status = ?, resolved_at = ?, resolved_version = ? WHERE fingerprint = ?')
+                        .run(status, resolvedAt, resolvedVersion, fingerprint);
+                    after = issueEntry.parse(issueOf({ ...existing, status, resolved_at: resolvedAt, resolved_version: resolvedVersion }));
+                    return true;
+                }, () => {
+                    // A lifecycle flip is a staff mutation — audited with the diff (K-33).
+                    this.recordAdmin(actor, 'setIssueStatus', { tenantId: null, vertical: after.lastVertical }, { fingerprint, status: existing.status }, { fingerprint, status: after.status });
+                });
                 return after;
             },
             listFindings: async (actor, filter) => {