@substrat-run/adapter-sqlite 0.164.0 → 0.166.0

package/dist/index.js

@@ -3,8 +3,9 @@ import { closeSync, existsSync, fstatSync, mkdirSync, openSync, readdirSync, rea
 import { dirname, join } from 'node:path';
 import Database from 'better-sqlite3';
 import { accessLogEntry, adminLogEntry, delegatedReadParams, operationSeriesCount, opsFailureEntry, opsFailureFingerprint, issueEntry, FRESHNESS_HEARTBEAT_MINUTES, sweepRunEntry, modelUsageEntry, ATTACHMENT_ADDED, ATTACHMENT_REMOVED, createTenantInput, domainEvent, domainEventInput, exportReadInput, importBatch, importCursorMove, exportsOfManifestJson, assertNoBindingShapeBreak, importsOfManifestJson, connectionLandingsOfManifestJson, connectorsOfManifestJson, entitlementGrant, entitlementGrantInput, eventId, meterReading, platformRequestInput, platformRequestId, identityLink, identityPool, instant, isSubstratError, connection, capabilityGrant, connectionGrant, connectionGrantRecord, connectionSecret, systemGrant, systemSwitch, systemSwitchRecord, peerSwitch, verticalCaller, verticalSlug as verticalSlugOf, subjectRef, requestFingerprint, createConnectionInput, connectLinkFilter, connectLinkKey, consumeConnectLinkInput, mintConnectLinkInput, projectedConnectionGrant, projectedConnectionKey, moduleManifest, createOrgInput, promotionAcknowledgement, bindAcknowledgement, bindHostnameInput, channelHistoryEntry, hostnameBinding, publishVersionInput, AUTO_ADMISSION_NOTE, routeTarget, ROUTE_SCOPE_HOSTNAMES_MAX, registerVerticalInput, vertical as verticalSchema, verticalChannel, verticalVersion, objectRef, entityObjectRef, assertModuleEmittableType, assertKernelAuthoredType, grantRefFromProof, org as orgSchema, orgMembership, principalId, resolvedIdentity, identityMembership, roleDefinition, scope as scopeSchema, tenant as tenantSchema, tenantRole, principalBecomeCapabilityInput, subjectShredReceipt, SCOPE_TABLE_PAGE_DEFAULT, SCOPE_TABLE_PAGE_MAX, SCOPE_QUERY_ROW_MAX, verticalServingState, deploymentWireAuth, callsOfManifestJson, outboundOfManifestJson, listLimitOf, pageOf, countedPageOf, SCOPE_GATE_REASONS, substratError, assertReplayableDump, delegatedReadRecord, ownerTransferAudit, memberChangeAudit, peerBindingAudit, connectionBindingAudit, copyMarkAudit, orphanSweepAudit, redrainEventsInput, REDRAIN_BATCH, errorCodeOf, } from '@substrat-run/contracts';
-import { actorOf, asPrincipal, assertAllowed, assertNoSecret, assertPermissionKey, CAPABILITY_DDL, UPLOAD_LINK_DDL, createAttachmentVerbs, inspectUploadLink, redeemUploadLinkInTransaction, redeemOrReplayUploadLink, COPY_ORIGIN_DDL, ENTITY_STATE_MOVES_DDL, CAPABILITY_EXCHANGE_OPERATION, CAPABILITY_BECOME_MINT_OPERATION, becomeMintCheck, mintBecomeCapabilityAsPrincipal, revokeBecomeCapabilityAsPrincipal, readBecomeLinkStates, ENTITY_UNBIND_OPERATION, allowedFor, unbindEntityHolderBounded, capabilityAttachmentWriteRefused, capabilityTokenHash, createCapabilityVerbs, createEntityEdgeVerbs, createEntityStateVerbs, createTrashedReads, CONTINUATION_POSITION_CAP, visibleContinuation, searchStateWhere, uncheckedView, addStatePlans, addUpdatedStampPlans, watchUpdatedStamps, entityStateMigrations, assertNoCallerPurge, assertPlatformRequestRoom, isUnreachableParent, heldPurgePass, purgeDueOf, purgeHeldBy, lifecycleRefusal, scopeNotHeldRefusal, purgeOnlyKeysOf, purgeReportOf, purgeStillDue, refuseTrashedTarget, assertBoundOperations, checkHeldOperationsOf, countChecks, noteUncheckedCompletion, registerTrashTargets, runPurgePass, withheldKeysFor, statefulTablesOf, afterMigration, afterRuntimeDdl, derivesAnything, repairDerivedObjects, StateColumnLost, exchangeCapability as exchangeCapabilitySecret, guardSecrets, mintBecomeCapability, plausibleSessionToken, readCapabilityPage, redactSecrets, redactSecretText, moduleLog, consoleLogSink, asyncInvocationId, asyncLinePass, consoleInvocationLineSink, resolveCapabilitySession, revokeCapabilityAsPlatform, assertReadOnlyQuery, attachmentBlobKey, attachmentSha256, isSizedByteStream, knownLengthStream, openAttachmentByteStream, putAttachmentBytes, entitlementDenial, requiredEntitlementFor, foldMeterReading, guardSpine, guardSqlLimits, DO_SQL_LIMITS, tooManyResultColumns, tooManyTableColumns, parseValidationRecords, readableScopes, resolveScopeRecord, ulid, ISSUE_RETENTION_DAYS, telemetryRetentionStatements, FINDINGS_DDL, ATTACHMENT_BYTES_SQL, SCOPE_STORAGE_DDL, forgetScopeStorage, listScopeAttachmentStorageRows, retireScopeStorage, listScopeStorageAttemptRows, listScopeStorageRows, listScopeStoreStorageRows, pruneScopeStorageRows, recordScopeStorageRows, REQUEST_ROLLUP_DDL, listRequestDayRows, listRequestRollupDayRows, pruneRequestDayRows, recordRequestDayRows, METER_DAYS_DDL, VERTICAL_OWNERS_BACKFILL, VERTICAL_OWNERS_DDL, closeVerticalOwnerRow, listVerticalOwnerRows, openVerticalOwnerRow, verticalOwnerNow, listMeterDayRows, listMeterDayTakeRows, pruneMeterDayRows, recordMeterDayRows, CONNECT_LINKS_DDL, consumeConnectLinkRow, insertConnectLink, listConnectLinks as listConnectLinkRows, readConnectLink, restoreConnectLinkRow, revokeConnectLinkRow, createFindingRule, findingOfOpsFailure, findingOfSweepRun, pruneFindings, listFindingRules, listFindings, observeFinding, revokeFindingRule, setFindingStatus, assertRowLimit, assertRowOffset, OPS_FAILURE_RETENTION_DAYS, SWEEP_RUN_RETENTION_DAYS, SWEEP_RUNS_INTENT_INDEX, sweepRunsIntentHasKind, MODEL_USAGE_RETENTION_DAYS, foldModelUsage, backoffAt, platformRequestHistoryQuery, platformRequestOf, PLATFORM_REQUEST_COLUMNS, PLATFORM_REQUEST_REDACTION_SQL, platformRequestRedactionParams, platformRequestRedactionQuery, intentPayloadCarriesSubject, redactSubjectJobRuns, eraseSubjectFromModules, moduleRowsErased, moduleErasurePlan, redactSubjectScopeText, redactSubjectDirectoryText, ISSUE_EXEMPLAR_OWNER_BACKFILL_SQL, issueExemplarOwner, JOB_RUN_PATCH_SQL, JOB_RUN_CLAIM_SQL, JOB_RUN_RENEW_SQL, JOB_RUN_BEGIN_SQL, JOB_RUN_MISS_SQL, JOB_RUN_MISS_SETTLE_SQL, admissionMissOutcome, JOB_STEP_RECORD_SQL, JOB_LEASE_EXPIRED_NOTE, assertLeaseMs, DELIVERY_ERROR_REDACTION_SQL, REDACTED_DELIVERY_NOTE, seatScopeTuple, applyScopeRoleChange, changeScopeRole, revokeScopeRoles, scopeRoleHolders, assertModuleDeclared, noteDeclaredKeys, noteReservedKeys, dumpRoleRefusal, reservedGrantRefusal, reservedRoleDefinitionRefusal, reservedRoleRefusal, reservedShapeRefusal, SCOPE_SEATED_ROLES_SQL, SEAT_HOLDING_SCOPE_STATUSES, TENANT_SEATED_ROLES_SQL, admitPeer, boundToPeerDeclarations, peerCallerAt, collectPeers, peerSeats, resolveVerticalInstanceFrom, resolvePeerInstanceFrom, peerVerticalSpellings, samePeerVertical, peerGrantsStatus, systemGrantsStatus, systemScheduleState, systemSwitchedOff, systemSwitchedOffMessage, tenantSystemSwitchedOffMessage, PEER_SWITCHES_DDL, PEER_BINDINGS_DDL, SWITCH_OWED_DDL, SWITCH_FENCES_DDL, TABLE_OWNERS_DDL, assertMigrationLeavesLedgerAlone, recordOwnershipSteps, runMigrationStatements, executableSqlStatements, blankSqlComments, recordWriteSuperseded, switchFencesOf, switchSupersededMessage, SWITCH_KINDS, SYSTEM_SWITCHES_DDL, forgetSwitchesOf, listSystemSwitchRecords, moveSwitch, reassertActionOf, reassertEntry, reassertOffRow, recordSwitchedOff, recordSwitchedOn, restoreSwitchRecord, scopesSwitchedOffFor, switchActionOf, switchAuditSubject, recordAuditOutcome, auditedCapabilityRevoke, auditWarningOf, switchNotFoundMessage, switchRecordsOf, switchedOffOf, switchesBackfillSqlOf, switchesTableExists, tenantHeldOf, tenantHoldsGrant, inUnitMovesToAudit, staleCarryRevertRow, staleCarryReverts, withRecorded, VERSION_MIGRATIONS_DDL, VERTICAL_SCOPE_STORES_DDL, forgetVerticalScopeStores, DEPLOYMENT_WIRE_AUTH_DDL, assertWireAuthFilter, deploymentWireAuthOf, forgetVerticalWireAuth, wireAuthAccessTarget, writeDeploymentWireAuth, indexVersionScopeStores, driverDeclarationsOf, verticalScopeStoresOf, STORE_DRIVER_RELEASES_DDL, legacyStoreDriverConflict, legacyStoreDriverRenames, beginStoreDriverRolloutIn, finishStoreDriverRolloutIn, holdStoreDriverIn, advanceStoreDriverRebuildIn, claimStoreDriverRebuildIn, storeDriverRebuildIn, recordStoreDriverReleaseIn, releaseStoreDriverHoldIn, storeDriverReleaseIn, storeDriverStateIn, storeDriverRolloutPendingIn, storeDriverRolloutWalkedIn, splitManifestMigrations, splitVersionMigrationsBatch, versionMigrationsOf, deriveVersionMigrationDigest, publishedMigrationDigest, migrationChangeRefusal, writeVersionMigrations, denialListQuery, refusalListQuery, mapRefusalRow, denialSummaryQuery, denialTotalsQuery, DENIAL_WINDOW_QUERY, mapDenialRow, mapDenialSummaryBuckets, IMPERSONATION_COLUMNS, IMPERSONATION_DDL, ImpersonationRefused, assertImpersonationWrites, assertModuleEnqueueableKind, assertSessionUsable, impersonationByIdQuery, impersonationListQuery, impersonationRowValues, impersonationStampOf, mapImpersonationRow, newImpersonationSession, resolveRetryPolicy, executorOutcomeOf, isDeliveryRefusal, refusalJournalText, membershipFencesBackfillSql, MEMBERSHIP_FENCES_DDL, membershipFencesTableExists, MEMBERSHIP_FENCE_SINCE_SQL, RAISE_MEMBERSHIP_FENCE_SQL, memberAddedAudit, orgChangeBound, tenantCoverage, isSecretBoxConfigured, unconfiguredSecretBox, createSubjectKeys, generateSealingKeyPair, noSealingKeyMessage, openSealed, sealTo, ConnectionSealingKeyUnavailableError, PermissionDenied, createAtomic, NotSearchable, NotListable, listIndexMigrations, listIndexPlans, listQuery, cursorOf, moduleMigrations, MIGRATION_DIGEST_FENCE_DDL, MIGRATION_DIGEST_MARK_LEGACY, assertJournalDumpCoherent, assertMigrationSql, migrationDivergence, migrationFailedError, migrationSetDivergence, migrationSteps, planMigrations, isSearchIndexTable, searchIndexMigrations, searchIndexPlans, searchLimit, searchMatchExpression, searchQuery, ATTACHMENT_TEXT_DDL, ATTACHMENT_CONDEMNED_DDL, ATTACHMENT_SWEEP_LICENCE_DDL, ATTACHMENT_SWEEP_LICENCE_TABLE, clearOrphanSweepLicence, condemnLicensedOrphanAttachments, consumeOrphanSweepLicence, licensedOrphanIds, recordOrphanSweepLicence, refuseUnlicensedOrphanSweep, fenceAttachmentSweep, refuseCondemnedAttachment, refuseCondemnedInDump, rowlessAttachmentIds, sweepOrphanAttachments, missingAttachmentStore, SETTLED_COPY_STATES, unsettledCopyRefusal, assertAttachmentExtractors, resolveAttachmentTextBounds, assertJobRegistrable, attachmentRecordOfRow, attachmentTextJob, enqueueAttachmentText, ATTACHMENT_TEXT_BACKFILL_JOB, ATTACHMENT_TEXT_JOB, kernelJobFor, queueAttachmentTextBackfill, startAttachmentTextBackfill, attachmentTextBackfillJob, reconcileAttachmentText, recordAttachmentText, searchAttachments, entityVersionQuery, entityVersionOf, assertIfMatch, OUTBOX_ENTITY_INDEX, SCHEDULE_STATE_DDL, SCHEDULE_STATE_REBUILD, scheduleStateHasKind, VERTICAL_EVENTS_DDL, EXPORT_HOPS_SQL, emptyImportResult, IMPORT_CURSORS_SQL, IMPORT_CURSOR_OF_SQL, OUTBOX_MARK_SQL, emittedSinceQuery, emittedReportOf, EMITTED_REPORT_CAP, exportedSinceQuery, IMPORT_CURSOR_ADVANCE_SQL, IMPORT_RECORD_SQL, moveImportCursor, importCursorSourceOf, exportBreaksOf, exportBreakRefusal, assertPromoteReviewCurrent, promoteRaceRefusal, servingRaceRefusal, autoAdmittedProdRefusal, listedPromoteRefusal, rebindRaceRefusal, SERVES_NOW_CONDITION, SERVES_NOW_PREDICATE, servesNowParams, migratesFrom, servedFromRow, servesAsFrom, bindExportBreaksOf, bindExportBreakRefusal, scopeMoveOf, runningVersionOf, isPrimaryScope, PROVISIONED_VERSIONS_SQL, installsReconciledOf, strandJudgmentsOf, provisionedVersionsParams, boundShapesColumn, boundShapesOfColumn, installReconciled, CrossVerticalRegistry, exportReadPlan, exportReadQuery, planExportBatch, withheldNote, WIRE_NONCE_DDL, WIRE_NONCE_FULL, claimWireNonceIn, isWireNonceTable, JOB_RUN_DDL, JOB_RUN_DUE_AT, jobRunListLimit, jobRunOf, runDueJobRuns, startJobRun, IDEMPOTENCY_DDL, REFUSALS_TABLE_DDL, REFUSALS_INDEX, refusalInsert, refusalOf, markGuardRefusal, REFUSALS_REBUILD, refusalsAdmitGuards, assertIdempotencyKey, idempotencyLookupQuery, idempotencyPruneStatement, idempotencyRecordStatement, idempotencyOptedOutMessage, replayFor, globalFetch, fetchLikeOf, deadlineFetch, createUlid, facetEvents, readHistory, walkEventCause, walkEventEffects, assertRedrainWindow, readInvocation, readDeadLetters, readLifecycleFlow, readOperationSeries, domainEventOf, readUndrainedOutbox, undrainedEventsOf, connectorCallRecord, noopConnectorCallRecorder, recordConnectorCall, settleConnectionUse, unknownRoleError, callReservedStoreOperation, callScopeStore, observeStoreCall, replayStoreErasures, scopeStoreLifecycleOf, scopeStoreRunnersOf, } from '@substrat-run/kernel';
+import { actorOf, asPrincipal, assertAllowed, assertNoSecret, assertPermissionKey, CAPABILITY_DDL, UPLOAD_LINK_DDL, createAttachmentVerbs, inspectUploadLink, redeemUploadLinkInTransaction, redeemOrReplayUploadLink, COPY_ORIGIN_DDL, ENTITY_STATE_MOVES_DDL, CAPABILITY_EXCHANGE_OPERATION, CAPABILITY_BECOME_MINT_OPERATION, becomeMintCheck, mintBecomeCapabilityAsPrincipal, revokeBecomeCapabilityAsPrincipal, readBecomeLinkStates, ENTITY_UNBIND_OPERATION, allowedFor, unbindEntityHolderBounded, capabilityAttachmentWriteRefused, capabilityTokenHash, createCapabilityVerbs, createEntityEdgeVerbs, createEntityStateVerbs, createTrashedReads, CONTINUATION_POSITION_CAP, visibleContinuation, searchStateWhere, uncheckedView, addStatePlans, addUpdatedStampPlans, watchUpdatedStamps, entityStateMigrations, assertNoCallerPurge, assertPlatformRequestRoom, isUnreachableParent, heldPurgePass, purgeDueOf, purgeHeldBy, lifecycleRefusal, scopeNotHeldRefusal, purgeOnlyKeysOf, purgeReportOf, purgeStillDue, refuseTrashedTarget, assertBoundOperations, checkHeldOperationsOf, countChecks, noteUncheckedCompletion, registerTrashTargets, runPurgePass, withheldKeysFor, statefulTablesOf, afterMigration, afterRuntimeDdl, derivesAnything, repairDerivedObjects, StateColumnLost, exchangeCapability as exchangeCapabilitySecret, guardSecrets, mintBecomeCapability, plausibleSessionToken, readCapabilityPage, redactSecrets, redactSecretText, moduleLog, consoleLogSink, asyncInvocationId, asyncLinePass, consoleInvocationLineSink, resolveCapabilitySession, revokeCapabilityAsPlatform, assertReadOnlyQuery, attachmentBlobKey, attachmentSha256, isSizedByteStream, knownLengthStream, openAttachmentByteStream, putAttachmentBytes, entitlementDenial, requiredEntitlementFor, foldMeterReading, guardSpine, guardSqlLimits, DO_SQL_LIMITS, tooManyResultColumns, tooManyTableColumns, parseValidationRecords, readableScopes, resolveScopeRecord, ulid, ISSUE_RETENTION_DAYS, telemetryRetentionStatements, FINDINGS_DDL, ATTACHMENT_BYTES_SQL, SCOPE_STORAGE_DDL, forgetScopeStorage, listScopeAttachmentStorageRows, retireScopeStorage, listScopeStorageAttemptRows, listScopeStorageRows, listScopeStoreStorageRows, pruneScopeStorageRows, recordScopeStorageRows, readBoundedTenantStorageGauge, REQUEST_ROLLUP_DDL, listRequestDayRows, listRequestRollupDayRows, pruneRequestDayRows, recordRequestDayRows, readTenantRequestMeterRows, readRequestMeterDayRows, METER_DAYS_DDL, VERTICAL_OWNERS_BACKFILL, VERTICAL_OWNERS_DDL, closeVerticalOwnerRow, listVerticalOwnerRows, openVerticalOwnerRow, verticalOwnerNow, listMeterDayRows, listMeterDayTakeRows, pruneMeterDayRows, recordMeterDayRows, CONNECT_LINKS_DDL, consumeConnectLinkRow, insertConnectLink, listConnectLinks as listConnectLinkRows, readConnectLink, restoreConnectLinkRow, revokeConnectLinkRow, createFindingRule, findingOfOpsFailure, findingOfSweepRun, pruneFindings, listFindingRules, listFindings, observeFinding, revokeFindingRule, setFindingStatus, assertRowLimit, assertRowOffset, OPS_FAILURE_RETENTION_DAYS, SWEEP_RUN_RETENTION_DAYS, SWEEP_RUNS_INTENT_INDEX, sweepRunsIntentHasKind, MODEL_USAGE_RETENTION_DAYS, foldModelUsage, backoffAt, platformRequestHistoryQuery, platformRequestOf, PLATFORM_REQUEST_COLUMNS, PLATFORM_REQUEST_REDACTION_SQL, platformRequestRedactionParams, platformRequestRedactionQuery, intentPayloadCarriesSubject, redactSubjectJobRuns, eraseSubjectFromModules, moduleRowsErased, moduleErasurePlan, redactSubjectScopeText, redactSubjectDirectoryText, ISSUE_EXEMPLAR_OWNER_BACKFILL_SQL, issueExemplarOwner, JOB_RUN_PATCH_SQL, JOB_RUN_CLAIM_SQL, JOB_RUN_RENEW_SQL, JOB_RUN_BEGIN_SQL, JOB_RUN_MISS_SQL, JOB_RUN_MISS_SETTLE_SQL, admissionMissOutcome, JOB_STEP_RECORD_SQL, JOB_LEASE_EXPIRED_NOTE, assertLeaseMs, DELIVERY_ERROR_REDACTION_SQL, REDACTED_DELIVERY_NOTE, seatScopeTuple, applyScopeRoleChange, changeScopeRole, revokeScopeRoles, scopeRoleHolders, assertModuleDeclared, noteDeclaredKeys, noteReservedKeys, dumpRoleRefusal, reservedGrantRefusal, reservedRoleDefinitionRefusal, reservedRoleRefusal, reservedShapeRefusal, SCOPE_SEATED_ROLES_SQL, SEAT_HOLDING_SCOPE_STATUSES, TENANT_SEATED_ROLES_SQL, admitPeer, boundToPeerDeclarations, peerCallerAt, collectPeers, peerSeats, resolveVerticalInstanceFrom, resolvePeerInstanceFrom, peerVerticalSpellings, samePeerVertical, peerGrantsStatus, systemGrantsStatus, systemScheduleState, systemSwitchedOff, systemSwitchedOffMessage, tenantSystemSwitchedOffMessage, PEER_SWITCHES_DDL, PEER_BINDINGS_DDL, SWITCH_OWED_DDL, SWITCH_FENCES_DDL, TABLE_OWNERS_DDL, assertMigrationLeavesLedgerAlone, recordOwnershipSteps, runMigrationStatements, executableSqlStatements, blankSqlComments, recordWriteSuperseded, switchFencesOf, switchSupersededMessage, SWITCH_KINDS, SYSTEM_SWITCHES_DDL, forgetSwitchesOf, listSystemSwitchRecords, moveSwitch, reassertActionOf, reassertEntry, reassertOffRow, recordSwitchedOff, recordSwitchedOn, restoreSwitchRecord, scopesSwitchedOffFor, switchActionOf, switchAuditSubject, recordAuditOutcome, auditedCapabilityRevoke, auditedScopePermissionWrite, auditWarningOf, switchNotFoundMessage, switchRecordsOf, switchedOffOf, switchesBackfillSqlOf, switchesTableExists, tenantHeldOf, tenantHoldsGrant, inUnitMovesToAudit, staleCarryRevertRow, staleCarryReverts, withRecorded, VERSION_MIGRATIONS_DDL, VERTICAL_SCOPE_STORES_DDL, forgetVerticalScopeStores, DEPLOYMENT_WIRE_AUTH_DDL, assertWireAuthFilter, deploymentWireAuthOf, forgetVerticalWireAuth, wireAuthAccessTarget, writeDeploymentWireAuth, indexVersionScopeStores, driverDeclarationsOf, verticalScopeStoresOf, STORE_DRIVER_RELEASES_DDL, approveStoreDriverReleaseIn, legacyStoreDriverConflict, legacyStoreDriverRenames, beginStoreDriverRolloutIn, finishStoreDriverRolloutIn, holdStoreDriverIn, advanceStoreDriverRebuildIn, claimStoreDriverRebuildIn, storeDriverRebuildIn, recordStoreDriverReleaseIn, recordStoreDriverRevokeWalkIn, releaseStoreDriverHoldIn, revokeStoreDriverReleaseIn, liveStoreDriverApprovalIn, storeDriverApprovalsIn, storeDriverRevokeWalkIn, storeDriverReleaseIn, storeDriverStateIn, storeDriverRolloutPendingIn, storeDriverRolloutWalkedIn, splitManifestMigrations, splitVersionMigrationsBatch, versionMigrationsOf, deriveVersionMigrationDigest, publishedMigrationDigest, migrationChangeRefusal, writeVersionMigrations, denialListQuery, refusalListQuery, mapRefusalRow, denialSummaryQuery, denialTotalsQuery, DENIAL_WINDOW_QUERY, mapDenialRow, mapDenialSummaryBuckets, IMPERSONATION_COLUMNS, IMPERSONATION_DDL, ImpersonationRefused, assertImpersonationWrites, assertModuleEnqueueableKind, assertSessionUsable, impersonationByIdQuery, impersonationListQuery, impersonationRowValues, impersonationStampOf, mapImpersonationRow, newImpersonationSession, resolveRetryPolicy, executorOutcomeOf, isDeliveryRefusal, refusalJournalText, membershipFencesBackfillSql, MEMBERSHIP_FENCES_DDL, membershipFencesTableExists, MEMBERSHIP_FENCE_SINCE_SQL, RAISE_MEMBERSHIP_FENCE_SQL, memberAddedAudit, orgChangeBound, tenantCoverage, isSecretBoxConfigured, unconfiguredSecretBox, createSubjectKeys, generateSealingKeyPair, noSealingKeyMessage, openSealed, sealTo, ConnectionSealingKeyUnavailableError, PermissionDenied, createAtomic, NotSearchable, NotListable, listIndexMigrations, listIndexPlans, listQuery, cursorOf, moduleMigrations, MIGRATION_DIGEST_FENCE_DDL, MIGRATION_DIGEST_MARK_LEGACY, assertJournalDumpCoherent, assertMigrationSql, migrationDivergence, migrationFailedError, migrationSetDivergence, migrationSteps, planMigrations, isSearchIndexTable, searchIndexMigrations, searchIndexPlans, searchLimit, searchMatchExpression, searchQuery, ATTACHMENT_TEXT_DDL, ATTACHMENT_CONDEMNED_DDL, ATTACHMENT_SWEEP_LICENCE_DDL, ATTACHMENT_SWEEP_LICENCE_TABLE, clearOrphanSweepLicence, condemnLicensedOrphanAttachments, consumeOrphanSweepLicence, licensedOrphanIds, recordOrphanSweepLicence, refuseUnlicensedOrphanSweep, fenceAttachmentSweep, refuseCondemnedAttachment, refuseCondemnedInDump, rowlessAttachmentIds, sweepOrphanAttachments, missingAttachmentStore, SETTLED_COPY_STATES, unsettledCopyRefusal, assertAttachmentExtractors, resolveAttachmentTextBounds, assertJobRegistrable, attachmentRecordOfRow, attachmentTextJob, enqueueAttachmentText, ATTACHMENT_TEXT_BACKFILL_JOB, ATTACHMENT_TEXT_JOB, kernelJobFor, queueAttachmentTextBackfill, startAttachmentTextBackfill, attachmentTextBackfillJob, reconcileAttachmentText, recordAttachmentText, searchAttachments, entityVersionQuery, entityVersionOf, assertIfMatch, OUTBOX_ENTITY_INDEX, SCHEDULE_STATE_DDL, SCHEDULE_STATE_REBUILD, scheduleStateHasKind, VERTICAL_EVENTS_DDL, EXPORT_HOPS_SQL, emptyImportResult, IMPORT_CURSORS_SQL, IMPORT_CURSOR_OF_SQL, OUTBOX_MARK_SQL, emittedSinceQuery, emittedReportOf, EMITTED_REPORT_CAP, exportedSinceQuery, IMPORT_CURSOR_ADVANCE_SQL, IMPORT_RECORD_SQL, moveImportCursor, importCursorSourceOf, exportBreaksOf, exportBreakRefusal, assertPromoteReviewCurrent, promoteRaceRefusal, servingRaceRefusal, autoAdmittedProdRefusal, listedPromoteRefusal, rebindRaceRefusal, SERVES_NOW_CONDITION, SERVES_NOW_PREDICATE, servesNowParams, migratesFrom, servedFromRow, servesAsFrom, bindExportBreaksOf, bindExportBreakRefusal, scopeMoveOf, runningVersionOf, isPrimaryScope, PROVISIONED_VERSIONS_SQL, installsReconciledOf, strandJudgmentsOf, provisionedVersionsParams, boundShapesColumn, boundShapesOfColumn, installReconciled, CrossVerticalRegistry, exportReadPlan, exportReadQuery, planExportBatch, withheldNote, WIRE_NONCE_DDL, WIRE_NONCE_FULL, claimWireNonceIn, isWireNonceTable, JOB_RUN_DDL, JOB_RUN_DUE_AT, jobRunListLimit, jobRunOf, runDueJobRuns, startJobRun, IDEMPOTENCY_DDL, REFUSALS_TABLE_DDL, REFUSALS_INDEX, refusalInsert, refusalOf, markGuardRefusal, REFUSALS_REBUILD, refusalsAdmitGuards, assertIdempotencyKey, idempotencyLookupQuery, idempotencyPruneStatement, idempotencyRecordStatement, idempotencyOptedOutMessage, replayFor, globalFetch, fetchLikeOf, deadlineFetch, createUlid, facetEvents, readHistory, walkEventCause, walkEventEffects, assertRedrainWindow, readInvocation, readDeadLetters, readLifecycleFlow, readOperationSeries, domainEventOf, readUndrainedOutbox, undrainedEventsOf, connectorCallRecord, noopConnectorCallRecorder, recordConnectorCall, settleConnectionUse, unknownRoleError, callReservedStoreOperation, callScopeStore, observeStoreCall, replayStoreErasures, scopeStoreLifecycleOf, scopeStoreRunnersOf, } from '@substrat-run/kernel';
 import { attributedView, delegatedRevokeSql, writeExplicitTupleIn, grantEntityShapeIn, shapeTopUpBatch, topUpEntityGrantShapes, settlePlatformRequestIn, } from '@substrat-run/kernel';
+import { canonicalInstant } from '@substrat-run/kernel';
 import { ADMIN_LOG_INDEXES_SQL, SETTLE_INTENT_SQL, SETTLE_OUTCOME_SQL, settleOutcomeParamsOf, readAuditedOperations, unknownOutcomeOf, } from '@substrat-run/kernel';
 import { INERT_SCOPE_REASON, isPrimaryScopeRow, normalizeUploadMediaType } from '@substrat-run/kernel';
 import { opsFailureReferenceWhere } from '@substrat-run/kernel';
@@ -1630,6 +1631,7 @@ export class SqliteScopeHost {
         elapsed_ms INTEGER NOT NULL
       );
       CREATE INDEX IF NOT EXISTS _substrat_model_usage_tenant ON _substrat_model_usage (tenant_id, at);
+      CREATE INDEX IF NOT EXISTS _substrat_model_usage_tenant_page ON _substrat_model_usage (tenant_id, at, id);
       CREATE INDEX IF NOT EXISTS _substrat_model_usage_at ON _substrat_model_usage (at);
       -- #1524: the stored storage gauge — one row per (scope, UTC day), kernel-owned DDL.
       ${SCOPE_STORAGE_DDL}
@@ -2234,11 +2236,10 @@ export class SqliteScopeHost {
         // Physically mint the database now, so a successful mint means the file exists (matching
         // "the platform mints the store"); the vertical then runs its OWN migrations against it.
         this.tenantStoreDb(ref);
-        this.directory
+        this.directoryWriteAndAudit(() => this.directory
             .prepare(`INSERT INTO tenant_stores (tenant_id, vertical, binding, kind, ref, created_at)
          VALUES (?, ?, ?, 'relational', ?, ?)`)
-            .run(input.tenantId, input.vertical, input.binding, ref, new Date().toISOString());
-        this.recordAdmin(actor, 'provisionTenantStore', { tenantId: input.tenantId, vertical: input.vertical }, null, { binding: input.binding, kind: 'relational', ref });
+            .run(input.tenantId, input.vertical, input.binding, ref, new Date().toISOString()).changes > 0, () => this.recordAdmin(actor, 'provisionTenantStore', { tenantId: input.tenantId, vertical: input.vertical }, null, { binding: input.binding, kind: 'relational', ref }));
         return { binding: input.binding, kind: 'relational', ref };
     }
     openTenantStore(handle) {
@@ -2295,11 +2296,10 @@ export class SqliteScopeHost {
         const safeVertical = input.vertical.replace(/[^A-Za-z0-9_-]+/g, '-');
         const ref = `blob__${input.tenantId}__${safeVertical}__${input.binding}__${ulid()}`;
         mkdirSync(join(this.dir, ref), { recursive: true });
-        this.directory
+        this.directoryWriteAndAudit(() => this.directory
             .prepare(`INSERT INTO blob_stores (tenant_id, vertical, binding, kind, ref, created_at)
          VALUES (?, ?, ?, 'blob', ?, ?)`)
-            .run(input.tenantId, input.vertical, input.binding, ref, new Date().toISOString());
-        this.recordAdmin(actor, 'provisionBlobStore', { tenantId: input.tenantId, vertical: input.vertical }, null, { binding: input.binding, kind: 'blob', ref });
+            .run(input.tenantId, input.vertical, input.binding, ref, new Date().toISOString()).changes > 0, () => this.recordAdmin(actor, 'provisionBlobStore', { tenantId: input.tenantId, vertical: input.vertical }, null, { binding: input.binding, kind: 'blob', ref }));
         return { binding: input.binding, kind: 'blob', ref };
     }
     /** A `TenantBlobStore` over the per-tenant directory a `ref` names (#473). Keys are
@@ -6549,15 +6549,19 @@ export class SqliteScopeHost {
         /**
          * `onNode`, with the write's admin row (#2526). At the tenant node the write is a directory
          * row, so it and its row are one directory transaction. At a scope node it is in the scope's
-         * own store, which no directory transaction reaches, so the row follows it (#1292's window).
+         * own store, which no directory transaction reaches, so intent precedes the scope write.
          */
-        const auditedOnNode = async (node, write, audit) => {
+        const auditedOnNode = async (node, write, audit, scopeAudit) => {
             if (!node.scopeId) {
                 this.directoryWriteAndAudit(() => { write(); return true; }, audit);
                 return;
             }
-            await onNode(node, write);
-            audit();
+            await auditedScopePermissionWrite({
+                ...scopeAudit,
+                record: (after) => this.recordAdmin(scopeAudit.actor, scopeAudit.action, node, null, after),
+                write: () => onNode(node, write),
+                logError: (message, fields) => console.error(message, fields),
+            });
         };
         /**
          * One kill switch moved on one scope — the ONE body `revokeFromSystem` / `restoreToSystem`
@@ -6889,12 +6893,12 @@ export class SqliteScopeHost {
                         writeScopeTuple(assignment.node, subject, `role:${assignment.roleKey}`, `scope:${scopeId}`);
                     else
                         writeTenantTuple(tenantId, subject, `role:${assignment.roleKey}`, `tenant:${tenantId}`);
-                }, () => this.recordAdmin(actor, 'assignRole', { tenantId, scopeId }, null, assignment));
+                }, () => this.recordAdmin(actor, 'assignRole', { tenantId, scopeId }, null, assignment), { actor, action: 'assignRole', request: { ...assignment } });
             },
             unassignRole: async (actor, assignment) => {
                 // Tombstone (K-21), never DELETE — the checker skips revoked_at rows, so the
                 // assignment stops resolving while staying visible to audit. Guarded on
-                // `revoked_at IS NULL` so a repeat unassign is a silent no-op.
+                // `revoked_at IS NULL` so a repeat unassign records a refused no-op.
                 const scopeNode = assignment.node.scopeId;
                 if (!scopeNode) {
                     // One directory transaction (#1184): the revoke, the removal fence and the audit row.
@@ -6903,14 +6907,14 @@ export class SqliteScopeHost {
                 }
                 // On the scope actor (#1678): a revoke that joined a stranger's transaction and
                 // rolled back with it left the role LIVE after the caller was told it was gone.
-                const rt = this.runtime(assignment.node.tenantId, scopeNode);
-                const changes = await rt.actor.turn(() => rt.db
-                    .prepare(`UPDATE _substrat_tuples SET revoked_at = ?
-                 WHERE subject = ? AND relation = ? AND object = ? AND revoked_at IS NULL`)
-                    .run(new Date().toISOString(), `principal:${assignment.principalId}`, `role:${assignment.roleKey}`, `scope:${scopeNode}`).changes);
-                if (changes === 0)
-                    return; // never assigned, or already revoked — idempotent, unaudited
-                this.recordAdmin(actor, 'unassignRole', { tenantId: assignment.node.tenantId, scopeId: scopeNode }, assignment, null);
+                await auditedScopePermissionWrite({
+                    action: 'unassignRole', request: { ...assignment },
+                    record: (after) => this.recordAdmin(actor, 'unassignRole', { tenantId: assignment.node.tenantId, scopeId: scopeNode }, assignment, after),
+                    write: () => onNode(assignment.node, () => this.runtime(assignment.node.tenantId, scopeNode).db.prepare(`UPDATE _substrat_tuples SET revoked_at = ?
+               WHERE subject = ? AND relation = ? AND object = ? AND revoked_at IS NULL`).run(new Date().toISOString(), `principal:${assignment.principalId}`, `role:${assignment.roleKey}`, `scope:${scopeNode}`).changes),
+                    outcome: (changes) => ({ phase: changes === 0 ? 'refused' : 'applied', details: { changed: changes !== 0 } }),
+                    logError: (message, fields) => console.error(message, fields),
+                });
             },
             grant: async (actor, raw) => {
                 // Parsed like its `grantToConnection`/`grantToSystem` siblings, not taken on
@@ -6918,16 +6922,22 @@ export class SqliteScopeHost {
                 // to Z text (#963), and liveness here is a lexicographic `expires_at > ?`.
                 const grant = capabilityGrant.parse(raw);
                 this.refuseReservedGrant([grant.permission]); // #2430
-                await auditedOnNode(grant.node, () => writeGrant(`principal:${grant.principalId}`, grant.permission, grant.node, grant.entity, grant.expiresAt), () => this.recordAdmin(actor, 'grant', { tenantId: grant.node.tenantId, scopeId: grant.node.scopeId }, null, grant));
+                await auditedOnNode(grant.node, () => writeGrant(`principal:${grant.principalId}`, grant.permission, grant.node, grant.entity, grant.expiresAt), () => this.recordAdmin(actor, 'grant', { tenantId: grant.node.tenantId, scopeId: grant.node.scopeId }, null, grant), { actor, action: 'grant', request: { ...grant } });
             },
             grantEntityShape: async (actor, grant) => {
                 const { tenantId, scopeId } = grant.node;
                 this.assertScope(tenantId, scopeId);
                 this.refuseReservedGrant(grant.permissions); // #2430
-                const rt = this.runtime(tenantId, scopeId);
                 // One unit on the scope actor (#1678): the marker and its keys land together or not at all.
-                await rt.actor.turn(() => rt.db.transaction(() => grantEntityShapeIn(switchSqlOf(rt.db), grant.principalId, grant.entity, grant.permissions))());
-                this.recordAdmin(actor, 'grantEntityShape', { tenantId, scopeId }, null, grant);
+                await auditedScopePermissionWrite({
+                    action: 'grantEntityShape', request: { ...grant },
+                    record: (after) => this.recordAdmin(actor, 'grantEntityShape', { tenantId, scopeId }, null, after),
+                    write: () => {
+                        const rt = this.runtime(tenantId, scopeId);
+                        return rt.actor.turn(() => rt.db.transaction(() => grantEntityShapeIn(switchSqlOf(rt.db), grant.principalId, grant.entity, grant.permissions))());
+                    },
+                    logError: (message, fields) => console.error(message, fields),
+                });
             },
             reconcileEntityGrantShapes: async (actor, node, shapes, opts) => {
                 const limit = shapeTopUpBatch(opts?.batch);
@@ -7048,14 +7058,21 @@ export class SqliteScopeHost {
                     // `invoke`'s open transaction and roll back with it after this verb returned. The
                     // turn is re-entrant: from inside one of this scope's tasks it joins that task.
                     // Restore is the lever; a grant is not.
-                    const rt = this.runtime(grant.node.tenantId, scope);
-                    await rt.actor.turn(() => {
-                        if (systemSwitchedOff(switchSqlOf(rt.db), grant.moduleId)) {
-                            throw substratError('conflict', systemSwitchedOffMessage(grant.moduleId, scope));
-                        }
-                        write();
+                    await auditedScopePermissionWrite({
+                        action: 'grantToSystem', request: { moduleId: grant.moduleId, permission: grant.permission, node: grant.node,
+                            expiresAt: grant.expiresAt ?? null, grantedBy: grant.grantedBy },
+                        record: (after) => this.recordAdmin(actor, 'grantToSystem', { tenantId: grant.node.tenantId, scopeId: scope }, null, after),
+                        write: () => {
+                            const rt = this.runtime(grant.node.tenantId, scope);
+                            return rt.actor.turn(() => {
+                                if (systemSwitchedOff(switchSqlOf(rt.db), grant.moduleId)) {
+                                    throw substratError('conflict', systemSwitchedOffMessage(grant.moduleId, scope));
+                                }
+                                write();
+                            });
+                        },
+                        logError: (message, fields) => console.error(message, fields),
                     });
-                    audit();
                 }
                 else {
                     // Tenant-level: a directory write, which no scope's transaction can hold. #1743:
@@ -7113,17 +7130,23 @@ export class SqliteScopeHost {
             // (#1678: every scope-level admin write takes one, so none lands mid-invoke inside a
             // stranger's transaction) and both in the admin log without the secret or its hash.
             mintCapability: async (actor, tenantId, scopeId, input) => {
-                const rt = await this.openActiveScope(tenantId, scopeId);
-                const minted = await rt.actor.turn(() => mintBecomeCapability(spineSql(rt.db), input, actor, this.clock()));
-                this.recordAdmin(actor, 'mintCapability', { tenantId, scopeId }, null, {
-                    capabilityId: minted.id,
-                    mode: 'become',
-                    principal: input.principal,
-                    expiresAt: input.expiresAt,
-                    maxUses: input.maxUses,
-                    label: input.label ?? null,
+                return auditedScopePermissionWrite({
+                    action: 'mintCapability', request: {
+                        mode: 'become',
+                        principal: input.principal,
+                        expiresAt: input.expiresAt,
+                        maxUses: input.maxUses,
+                        label: input.label ?? null,
+                    },
+                    record: (after) => this.recordAdmin(actor, 'mintCapability', { tenantId, scopeId }, null, after),
+                    write: async () => {
+                        const rt = await this.openActiveScope(tenantId, scopeId);
+                        return rt.actor.turn(() => mintBecomeCapability(spineSql(rt.db), input, actor, this.clock()));
+                    },
+                    outcome: (minted) => ({ phase: 'applied', details: { capabilityId: minted.id } }),
+                    onUnrecordedOutcome: (minted, error) => ({ ...minted, auditWarning: auditWarningOf('the capability mint', error) }),
+                    logError: (message, fields) => console.error(message, fields),
                 });
-                return minted;
             },
             revokeCapability: async (actor, tenantId, scopeId, capabilityId) => {
                 const scope = this.directory
@@ -7163,7 +7186,7 @@ export class SqliteScopeHost {
                 await auditedOnNode(node, () => {
                     requireOrg(node.tenantId, orgId);
                     writeGrant(`org:${orgId}`, permission, node, entity);
-                }, () => this.recordAdmin(actor, 'grantToOrg', { tenantId: node.tenantId, scopeId: node.scopeId }, null, { orgId, permission, node, entity }));
+                }, () => this.recordAdmin(actor, 'grantToOrg', { tenantId: node.tenantId, scopeId: node.scopeId }, null, { orgId, permission, node, entity }), { actor, action: 'grantToOrg', request: { orgId, permission, node, entity } });
             },
             // -- vertical + version registry (#31) ---------------------------------
             // -- the hostname map (K-26) -------------------------------------------
@@ -8743,16 +8766,54 @@ export class SqliteScopeHost {
             // this host's clock, so a test can let a lease lapse without waiting.
             recordStoreDriverRelease: async (actor, input) => {
                 const at = this.clock();
-                const { record, created } = this.directory.transaction(() => recordStoreDriverReleaseIn(switchSqlOf(this.directory), { ...input, actor, at }))();
-                if (created)
-                    this.recordAdmin(actor, 'uploadStoreDriverRelease', { tenantId: null }, null, record, at);
-                return record;
+                let result;
+                this.directoryWriteAndAudit(() => {
+                    result = recordStoreDriverReleaseIn(switchSqlOf(this.directory), { ...input, actor, at });
+                    return result.created;
+                }, () => this.recordAdmin(actor, 'uploadStoreDriverRelease', { tenantId: null }, null, result.record, at));
+                return result.record;
             },
             getStoreDriverRelease: async (actor, driver, sha256) => {
                 const record = storeDriverReleaseIn(switchSqlOf(this.directory), driver, sha256);
                 this.recordAccess(actor, 'getStoreDriverRelease', { tenantId: null }, { driver, sha256 }, record ? 1 : 0);
                 return record;
             },
+            storeDriverApprovals: async (actor, driver) => {
+                const records = storeDriverApprovalsIn(switchSqlOf(this.directory), driver);
+                this.recordAccess(actor, 'storeDriverApprovals', { tenantId: null }, { driver }, records.length);
+                return records;
+            },
+            liveStoreDriverApproval: async (actor, driver, sha256) => {
+                const record = liveStoreDriverApprovalIn(switchSqlOf(this.directory), driver, sha256);
+                this.recordAccess(actor, 'liveStoreDriverApproval', { tenantId: null }, { driver, sha256 }, record ? 1 : 0);
+                return record;
+            },
+            approveStoreDriverRelease: async (actor, input) => {
+                const at = this.clock();
+                let record;
+                this.directoryWriteAndAudit(() => {
+                    record = approveStoreDriverReleaseIn(switchSqlOf(this.directory), { ...input, approvalId: ulid(), actor, at });
+                    return true;
+                }, () => this.recordAdmin(actor, 'approveStoreDriverRelease', { tenantId: null }, null, record, at));
+                return record;
+            },
+            storeDriverRevokeWalk: async (actor, approvalId) => {
+                const record = storeDriverRevokeWalkIn(switchSqlOf(this.directory), approvalId);
+                this.recordAccess(actor, 'storeDriverRevokeWalk', { tenantId: null }, { approvalId }, record ? 1 : 0);
+                return record;
+            },
+            recordStoreDriverRevokeWalk: async (actor, input) => this.directory.transaction(() => recordStoreDriverRevokeWalkIn(switchSqlOf(this.directory), { ...input, actor, nowMs: Date.parse(this.clock()) }))(),
+            revokeStoreDriverRelease: async (actor, input) => {
+                const at = this.clock();
+                let before = null;
+                let record;
+                this.directoryWriteAndAudit(() => {
+                    before = liveStoreDriverApprovalIn(switchSqlOf(this.directory), input.driver, input.sha256) ?? null;
+                    record = revokeStoreDriverReleaseIn(switchSqlOf(this.directory), { ...input, actor, at, nowMs: Date.parse(at) });
+                    return true;
+                }, () => this.recordAdmin(actor, 'revokeStoreDriverRelease', { tenantId: null }, before, record, at));
+                return record;
+            },
             storeDriverState: async (actor, driver) => {
                 const state = storeDriverStateIn(switchSqlOf(this.directory), driver, Date.parse(this.clock()));
                 this.recordAccess(actor, 'storeDriverState', { tenantId: null }, { driver }, state.rollouts.length);
@@ -8779,14 +8840,20 @@ export class SqliteScopeHost {
             },
             beginStoreDriverRollout: async (actor, input) => {
                 const at = this.clock();
-                const row = this.directory.transaction(() => beginStoreDriverRolloutIn(switchSqlOf(this.directory), { ...input, actor, at, nowMs: Date.parse(at) }))();
-                this.recordAdmin(actor, input.action === 'rollback' ? 'rollBackStoreDriver' : 'rollOutStoreDriver', { tenantId: null }, null, row, at);
+                let row;
+                this.directoryWriteAndAudit(() => {
+                    row = beginStoreDriverRolloutIn(switchSqlOf(this.directory), { ...input, actor, at, nowMs: Date.parse(at) });
+                    return true;
+                }, () => this.recordAdmin(actor, input.action === 'rollback' ? 'rollBackStoreDriver' : 'rollOutStoreDriver', { tenantId: null }, null, row, at));
                 return row;
             },
             finishStoreDriverRollout: async (actor, input) => {
                 const at = this.clock();
-                const row = this.directory.transaction(() => finishStoreDriverRolloutIn(switchSqlOf(this.directory), { ...input, at, nowMs: Date.parse(at) }))();
-                this.recordAdmin(actor, row.action === 'rollback' ? 'rollBackStoreDriver' : 'rollOutStoreDriver', { tenantId: null }, null, row, at);
+                let row;
+                this.directoryWriteAndAudit(() => {
+                    row = finishStoreDriverRolloutIn(switchSqlOf(this.directory), { ...input, at, nowMs: Date.parse(at) });
+                    return true;
+                }, () => this.recordAdmin(actor, row.action === 'rollback' ? 'rollBackStoreDriver' : 'rollOutStoreDriver', { tenantId: null }, null, row, at));
                 return row;
             },
             storeDriverRebuild: async (actor, driver) => {
@@ -8987,6 +9054,9 @@ export class SqliteScopeHost {
                                 insert.run(...row);
                         },
                     });
+                    // The dump's rows have landed in the rebuilt tables. Append this restore's
+                    // own row before commit, so a failed insert rolls the imported state back.
+                    this.recordAdmin(actor, 'restoreDirectory', { tenantId: null }, { tenants: before }, { capturedAt: dump.capturedAt, tables: dump.tables.length });
                 })();
                 // #1764's split, over any version the dump stored before it.
                 this.splitVersionMigrations();
@@ -8994,7 +9064,6 @@ export class SqliteScopeHost {
                 // table would leave every permission check reading the PRE-restore roles until
                 // the process restarted — the exact silent-divergence a recovery must not have.
                 this.loadRoles();
-                this.recordAdmin(actor, 'restoreDirectory', { tenantId: null }, { tenants: before }, { capturedAt: dump.capturedAt, tables: dump.tables.length });
             },
             activateScope: async (actor, tenantId, scopeId) => {
                 // Idempotent on `active`, unaudited because nothing changed. Provisioning is
@@ -9227,15 +9296,15 @@ export class SqliteScopeHost {
                 // records an access that could never have happened.
                 this.assertScope(input.tenantId, input.scopeId);
                 const session = newImpersonationSession(ulid(), actor, input, this.clock());
-                this.directory
+                this.directoryWriteAndAudit(() => this.directory
                     .prepare(`INSERT INTO _substrat_impersonations
                (${IMPERSONATION_COLUMNS}) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`)
-                    .run(...impersonationRowValues(session));
+                    .run(...impersonationRowValues(session)).changes > 0, 
                 // BEFORE the session is returned, so the log entry precedes every row it
                 // will ever touch. The reason rides in `after` — it is the field a review
                 // reads first, and a log saying a session opened but not why is half a
                 // record.
-                this.recordAdmin(actor, 'beginImpersonation', { tenantId: session.tenantId, scopeId: session.scopeId }, null, session);
+                () => this.recordAdmin(actor, 'beginImpersonation', { tenantId: session.tenantId, scopeId: session.scopeId }, null, session));
                 return session;
             },
             endImpersonation: async (actor, id) => {
@@ -9244,11 +9313,14 @@ export class SqliteScopeHost {
                 // already stopped it, and it must not move the moment it stopped.
                 if (before.endedAt !== null)
                     return before;
-                this.directory
-                    .prepare('UPDATE _substrat_impersonations SET ended_at = ? WHERE id = ?')
-                    .run(this.clock(), id);
-                const after = this.readImpersonation(id);
-                this.recordAdmin(actor, 'endImpersonation', { tenantId: after.tenantId, scopeId: after.scopeId }, before, after);
+                let after;
+                this.directoryWriteAndAudit(() => {
+                    const changed = this.directory
+                        .prepare('UPDATE _substrat_impersonations SET ended_at = ? WHERE id = ?')
+                        .run(this.clock(), id).changes > 0;
+                    after = this.readImpersonation(id);
+                    return changed;
+                }, () => this.recordAdmin(actor, 'endImpersonation', { tenantId: after.tenantId, scopeId: after.scopeId }, before, after));
                 return after;
             },
             listImpersonations: async (actor, filter) => {
@@ -9419,26 +9491,30 @@ export class SqliteScopeHost {
                 this.recordAccess(actor, 'readMeters', { tenantId: only ?? null }, filter ?? null, reading.perTenant.length);
                 return meterReading.parse(reading);
             },
+            readTenantStorageGauge: async (actor, tenantId, limit) => {
+                const result = readBoundedTenantStorageGauge(redactionSqlOf(this.directory), tenantId, limit);
+                this.recordAccess(actor, 'readTenantStorageGauge', { tenantId }, { limit }, result.gauge.sampled);
+                return result;
+            },
             registerIdentityPool: async (actor, input) => {
                 const parsed = identityPool.parse(input);
-                const existing = readPool(parsed.provider);
-                if (existing) {
-                    // Idempotent on an identical registration. A CONFLICTING one throws:
-                    // flipping a live pool's topology silently reinterprets every row it owns
-                    // — the same externalId across tenants would change from one human to two.
-                    if (existing.topology === parsed.topology && existing.tenantId === parsed.tenantId) {
-                        return;
+                this.directoryWriteAndAudit(() => {
+                    const existing = readPool(parsed.provider);
+                    if (existing) {
+                        // Idempotent on an identical registration. A conflicting one is refused.
+                        if (existing.topology === parsed.topology && existing.tenantId === parsed.tenantId) {
+                            return false;
+                        }
+                        throw substratError('conflict', `identity pool '${parsed.provider}' is already registered as ${existing.topology}` +
+                            `${existing.tenantId ? ` for tenant ${existing.tenantId}` : ''}`);
                     }
-                    throw substratError('conflict', `identity pool '${parsed.provider}' is already registered as ${existing.topology}` +
-                        `${existing.tenantId ? ` for tenant ${existing.tenantId}` : ''}`);
-                }
-                this.directory
-                    .prepare('INSERT INTO _substrat_identity_pools (provider, topology, tenant_id, created_at) VALUES (?, ?, ?, ?)')
-                    .run(parsed.provider, parsed.topology, parsed.tenantId, new Date().toISOString());
-                this.recordAdmin(actor, 'registerIdentityPool', 
+                    return this.directory
+                        .prepare('INSERT INTO _substrat_identity_pools (provider, topology, tenant_id, created_at) VALUES (?, ?, ?, ?)')
+                        .run(parsed.provider, parsed.topology, parsed.tenantId, new Date().toISOString()).changes > 0;
+                }, () => this.recordAdmin(actor, 'registerIdentityPool', 
                 // Null for a central pool: it belongs to no single tenant, which is what
                 // made the admin log's tenantId nullable.
-                { tenantId: parsed.tenantId }, null, parsed);
+                { tenantId: parsed.tenantId }, null, parsed));
             },
             getIdentityPool: async (actor, provider) => {
                 const pool = readPool(provider);
@@ -9517,42 +9593,46 @@ export class SqliteScopeHost {
                 const input = createConnectionInput.parse(raw);
                 const sealed = await this.secretBox.seal(JSON.stringify(input.secret));
                 const now = new Date().toISOString();
-                try {
-                    this.directory
-                        .prepare(`INSERT INTO _substrat_connections
+                this.directoryWriteAndAudit(() => {
+                    try {
+                        this.directory
+                            .prepare(`INSERT INTO _substrat_connections
                  (id, tenant_id, vertical, provider, label, status, external_account_ref,
                   scopes, expires_at, last_ok_at, last_error, last_error_at,
                   created_by, created_at, revoked_at)
                VALUES (?, ?, ?, ?, ?, 'active', ?, ?, ?, NULL, NULL, NULL, ?, ?, NULL)`)
-                        .run(input.id, input.tenantId, input.vertical, input.provider, input.label, input.externalAccountRef ?? null, JSON.stringify(input.scopes), input.expiresAt ?? null, 
-                    // The authorizing principal when supplied (a self-serve connect), else the
-                    // effecting platform actor. See connections.md §3.5.1 / createConnectionInput.
-                    input.createdBy ?? actor, now);
-                }
-                catch (err) {
-                    if (/UNIQUE constraint failed/i.test(err.message)) {
-                        const account = input.externalAccountRef
-                            ? ` under account '${input.externalAccountRef}'`
-                            : '';
-                        throw new Error(`tenant ${input.tenantId} already has a live '${input.provider}' connection ` +
-                            `for vertical '${input.vertical}'${account} — revoke it before connecting another`);
+                            .run(input.id, input.tenantId, input.vertical, input.provider, input.label, input.externalAccountRef ?? null, JSON.stringify(input.scopes), input.expiresAt ?? null, 
+                        // The authorizing principal when supplied (a self-serve connect), else the
+                        // effecting platform actor. See connections.md §3.5.1 / createConnectionInput.
+                        input.createdBy ?? actor, now);
                     }
-                    throw err;
-                }
-                this.directory
-                    .prepare(`INSERT INTO _substrat_connection_secrets (connection_id, key_id, ciphertext, updated_at)
+                    catch (err) {
+                        if (/UNIQUE constraint failed/i.test(err.message)) {
+                            const account = input.externalAccountRef
+                                ? ` under account '${input.externalAccountRef}'`
+                                : '';
+                            throw new Error(`tenant ${input.tenantId} already has a live '${input.provider}' connection ` +
+                                `for vertical '${input.vertical}'${account} — revoke it before connecting another`);
+                        }
+                        throw err;
+                    }
+                    this.directory
+                        .prepare(`INSERT INTO _substrat_connection_secrets (connection_id, key_id, ciphertext, updated_at)
              VALUES (?, ?, ?, ?)`)
-                    .run(input.id, sealed.keyId, sealed.ciphertext, now);
-                // METADATA ONLY. `_substrat_admin_log` is append-only, so a credential
-                // written here could never be removed — the redaction is the point, and
-                // it is structural rather than a rule someone has to remember.
-                this.recordAdmin(actor, 'createConnection', { tenantId: input.tenantId, vertical: input.vertical }, null, {
-                    id: input.id,
-                    provider: input.provider,
-                    label: input.label,
-                    scopes: input.scopes,
-                    externalAccountRef: input.externalAccountRef ?? null,
-                    createdBy: input.createdBy ?? actor,
+                        .run(input.id, sealed.keyId, sealed.ciphertext, now);
+                    return true;
+                }, () => {
+                    // METADATA ONLY. `_substrat_admin_log` is append-only, so a credential
+                    // written here could never be removed — the redaction is the point, and
+                    // it is structural rather than a rule someone has to remember.
+                    this.recordAdmin(actor, 'createConnection', { tenantId: input.tenantId, vertical: input.vertical }, null, {
+                        id: input.id,
+                        provider: input.provider,
+                        label: input.label,
+                        scopes: input.scopes,
+                        externalAccountRef: input.externalAccountRef ?? null,
+                        createdBy: input.createdBy ?? actor,
+                    });
                 });
             },
             connectionSealingKey: (id) => this.ensureSealingKey(id),
@@ -9617,25 +9697,29 @@ export class SqliteScopeHost {
                 const row = this.connectionRow(id);
                 const sealed = await this.secretBox.seal(JSON.stringify(connectionSecret.parse(secret)));
                 const now = new Date().toISOString();
-                this.directory
-                    .prepare(`UPDATE _substrat_connection_secrets
+                this.directoryWriteAndAudit(() => {
+                    this.directory
+                        .prepare(`UPDATE _substrat_connection_secrets
              SET key_id = ?, ciphertext = ?, updated_at = ? WHERE connection_id = ?`)
-                    .run(sealed.keyId, sealed.ciphertext, now, id);
-                // A refresh revives a connection that had lapsed or errored.
-                this.directory
-                    .prepare(`UPDATE _substrat_connections
+                        .run(sealed.keyId, sealed.ciphertext, now, id);
+                    // A refresh revives a connection that had lapsed or errored.
+                    this.directory
+                        .prepare(`UPDATE _substrat_connections
              SET status = 'active', expires_at = ?, last_error = NULL, last_error_at = NULL
              WHERE id = ?`)
-                    .run(expiresAt === undefined ? row.expires_at : expiresAt, id);
-                // The event, never the token. "Rotated at T" is the auditable fact — plus WHO
-                // authorized it when the rotation was a tenant admin's act (§3.5.1's attribution,
-                // rotate-side): the principal, never laundered into the actor column.
-                this.recordAdmin(actor, 'updateConnectionSecret', { tenantId: row.tenant_id, vertical: row.vertical }, null, {
-                    id,
-                    provider: row.provider,
-                    rotatedAt: now,
-                    expiresAt: expiresAt === undefined ? row.expires_at : expiresAt,
-                    ...(opts?.rotatedBy ? { rotatedBy: opts.rotatedBy } : {}),
+                        .run(expiresAt === undefined ? row.expires_at : expiresAt, id);
+                    return true;
+                }, () => {
+                    // The event, never the token. "Rotated at T" is the auditable fact — plus WHO
+                    // authorized it when the rotation was a tenant admin's act (§3.5.1's attribution,
+                    // rotate-side): the principal, never laundered into the actor column.
+                    this.recordAdmin(actor, 'updateConnectionSecret', { tenantId: row.tenant_id, vertical: row.vertical }, null, {
+                        id,
+                        provider: row.provider,
+                        rotatedAt: now,
+                        expiresAt: expiresAt === undefined ? row.expires_at : expiresAt,
+                        ...(opts?.rotatedBy ? { rotatedBy: opts.rotatedBy } : {}),
+                    });
                 });
             },
             revokeConnection: async (actor, id) => {
@@ -9643,27 +9727,29 @@ export class SqliteScopeHost {
                 if (row.revoked_at)
                     return; // idempotent, and a no-op is not audited
                 const now = new Date().toISOString();
-                this.directory
-                    .prepare(`UPDATE _substrat_connections SET status = 'revoked', revoked_at = ? WHERE id = ?`)
-                    .run(now, id);
-                // The sealed blob goes NOW. A tombstoned connection is evidence that a
-                // grant existed (K-21); keeping the usable credential would make it a
-                // liability instead. The row says what happened; the secret does not.
-                this.directory
-                    .prepare('DELETE FROM _substrat_connection_secrets WHERE connection_id = ?')
-                    .run(id);
-                // Connector state dies with the connection: it is that connection's
-                // private bookkeeping and means nothing once it can no longer act.
-                this.directory
-                    .prepare('DELETE FROM _substrat_connector_state WHERE connection_id = ?')
-                    .run(id);
-                // #592: its grants tombstone (K-21 — evidence, not roster). Absent from the
-                // next gather, so no later provision/reconcile delivers them again.
-                this.directory
-                    .prepare(`UPDATE _substrat_connection_grants SET revoked_at = ?
+                this.directoryWriteAndAudit(() => {
+                    this.directory
+                        .prepare(`UPDATE _substrat_connections SET status = 'revoked', revoked_at = ? WHERE id = ?`)
+                        .run(now, id);
+                    // The sealed blob goes NOW. A tombstoned connection is evidence that a
+                    // grant existed (K-21); keeping the usable credential would make it a
+                    // liability instead. The row says what happened; the secret does not.
+                    this.directory
+                        .prepare('DELETE FROM _substrat_connection_secrets WHERE connection_id = ?')
+                        .run(id);
+                    // Connector state dies with the connection: it is that connection's
+                    // private bookkeeping and means nothing once it can no longer act.
+                    this.directory
+                        .prepare('DELETE FROM _substrat_connector_state WHERE connection_id = ?')
+                        .run(id);
+                    // #592: its grants tombstone (K-21 — evidence, not roster). Absent from the
+                    // next gather, so no later provision/reconcile delivers them again.
+                    this.directory
+                        .prepare(`UPDATE _substrat_connection_grants SET revoked_at = ?
              WHERE connection_id = ? AND revoked_at IS NULL`)
-                    .run(now, id);
-                this.recordAdmin(actor, 'revokeConnection', { tenantId: row.tenant_id, vertical: row.vertical }, { status: row.status }, { id, provider: row.provider, status: 'revoked', revokedAt: now });
+                        .run(now, id);
+                    return true;
+                }, () => this.recordAdmin(actor, 'revokeConnection', { tenantId: row.tenant_id, vertical: row.vertical }, { status: row.status }, { id, provider: row.provider, status: 'revoked', revokedAt: now }));
             },
             // -- a vertical's mailed connect links (connections.md §3.5.4) --------------
             // The statements are the kernel's (`connect-links.ts`), shared with the hosted
@@ -9803,32 +9889,30 @@ export class SqliteScopeHost {
                 // Read before write. `INSERT OR IGNORE` alone cannot tell "already bound to the
                 // same principal" (idempotent) from "already bound to someone else" (a
                 // collision), and silently ignoring the second resolves one person as another.
-                const existing = this.directory
-                    .prepare(`SELECT principal_id FROM _substrat_identities
+                this.directoryWriteAndAudit(() => {
+                    const existing = this.directory
+                        .prepare(`SELECT principal_id FROM _substrat_identities
              WHERE tenant_id = ? AND provider = ? AND external_id = ?`)
-                    .get(parsed.tenantId, parsed.provider, parsed.externalId);
-                if (existing) {
-                    if (existing.principal_id === parsed.principal)
-                        return; // idempotent, unaudited
-                    throw substratError('conflict', `identity ${parsed.provider}:${parsed.externalId} in tenant ${parsed.tenantId} ` +
-                        `is already bound to ${existing.principal_id}`);
-                }
-                this.directory
-                    .prepare(`INSERT INTO _substrat_identities
+                        .get(parsed.tenantId, parsed.provider, parsed.externalId);
+                    if (existing) {
+                        if (existing.principal_id === parsed.principal)
+                            return false; // idempotent, unaudited
+                        throw substratError('conflict', `identity ${parsed.provider}:${parsed.externalId} in tenant ${parsed.tenantId} ` +
+                            `is already bound to ${existing.principal_id}`);
+                    }
+                    return this.directory
+                        .prepare(`INSERT INTO _substrat_identities
                (provider, external_id, principal_id, tenant_id, scope_id, created_at)
              VALUES (?, ?, ?, ?, ?, ?)`)
-                    .run(parsed.provider, parsed.externalId, parsed.principal, parsed.tenantId, parsed.scopeId ?? null, new Date().toISOString());
-                this.recordAdmin(actor, 'linkIdentity', { tenantId: parsed.tenantId, scopeId: parsed.scopeId }, null, { provider: parsed.provider, externalId: parsed.externalId, principal: parsed.principal });
+                        .run(parsed.provider, parsed.externalId, parsed.principal, parsed.tenantId, parsed.scopeId ?? null, new Date().toISOString()).changes > 0;
+                }, () => this.recordAdmin(actor, 'linkIdentity', { tenantId: parsed.tenantId, scopeId: parsed.scopeId }, null, { provider: parsed.provider, externalId: parsed.externalId, principal: parsed.principal }));
             },
             unlinkIdentity: async (actor, tenantId, principal) => {
                 // DELETE, not a tombstone — the identity map is current state (audit is the log),
                 // and re-inviting must be able to re-link a fresh principal for the same person.
-                const info = this.directory
+                this.directoryWriteAndAudit(() => this.directory
                     .prepare(`DELETE FROM _substrat_identities WHERE tenant_id = ? AND principal_id = ?`)
-                    .run(tenantId, principal);
-                if (info.changes === 0)
-                    return; // no link — idempotent, unaudited
-                this.recordAdmin(actor, 'unlinkIdentity', { tenantId, scopeId: null }, { principal }, null);
+                    .run(tenantId, principal).changes > 0, () => this.recordAdmin(actor, 'unlinkIdentity', { tenantId, scopeId: null }, { principal }, null));
             },
             resolveIdentity: async (tenantId, provider, externalId) => {
                 const row = this.directory
@@ -9924,32 +10008,40 @@ export class SqliteScopeHost {
                 // `drained_at IS NULL` makes the stamp idempotent: a retried pass that ships
                 // the same batch twice re-stamps nothing and reports 0, so the admin log does
                 // not grow a row claiming an egress that already happened.
-                const info = this.directory
-                    .prepare(`UPDATE _substrat_access_log SET drained_at = ?
+                let drained = 0;
+                this.directoryWriteAndAudit(() => {
+                    const info = this.directory
+                        .prepare(`UPDATE _substrat_access_log SET drained_at = ?
              WHERE id <= ? AND drained_at IS NULL`)
-                    .run(drainedAt, upToId);
-                if (info.changes > 0) {
+                        .run(drainedAt, upToId);
+                    drained = info.changes;
+                    return drained > 0;
+                }, () => {
                     // The payload is the APPLIED state, so it belongs in `after` (contracts'
                     // adminLogEntry: before = prior state, after = the applied payload).
-                    this.recordAdmin(actor, 'drainAccessLog', { tenantId: null }, null, { drained: info.changes, upToId, drainedAt });
-                }
-                return info.changes;
+                    this.recordAdmin(actor, 'drainAccessLog', { tenantId: null }, null, { drained, upToId, drainedAt });
+                });
+                return drained;
             },
             pruneAccessLog: async (actor, limit) => {
                 assertRowLimit('limit', limit);
                 // ONLY drained rows. Age alone is not a licence to delete evidence.
-                const info = this.directory
-                    .prepare(`DELETE FROM _substrat_access_log WHERE id IN (
+                let pruned = 0;
+                this.directoryWriteAndAudit(() => {
+                    const info = this.directory
+                        .prepare(`DELETE FROM _substrat_access_log WHERE id IN (
                SELECT id FROM _substrat_access_log WHERE drained_at IS NOT NULL ORDER BY id LIMIT ?
              )`)
-                    .run(limit);
-                if (info.changes > 0) {
+                        .run(limit);
+                    pruned = info.changes;
+                    return pruned > 0;
+                }, () => {
                     // The payload is the APPLIED state, so it belongs in `after` (contracts'
                     // adminLogEntry: before = prior state, after = the applied payload) — the
                     // same shape as drainAccessLog's row above (#557).
-                    this.recordAdmin(actor, 'pruneAccessLog', { tenantId: null }, null, { pruned: info.changes });
-                }
-                return info.changes;
+                    this.recordAdmin(actor, 'pruneAccessLog', { tenantId: null }, null, { pruned });
+                });
+                return pruned;
             },
             auditLog: async (actor, filter) => {
                 const where = [];
@@ -10236,21 +10328,27 @@ export class SqliteScopeHost {
                 return rows.map((r) => issueEntry.parse(issueOf(r)));
             },
             setIssueStatus: async (actor, fingerprint, status) => {
-                const existing = this.directory
-                    .prepare('SELECT * FROM _substrat_issues WHERE fingerprint = ?')
-                    .get(fingerprint);
-                if (!existing)
-                    return undefined;
-                const resolvedAt = status === 'resolved' ? new Date().toISOString() : null;
-                // "Resolved under X": freeze the newest version at the verdict, so a later
-                // regression can name the pair. A reopen or ignore clears it with the timestamp.
-                const resolvedVersion = status === 'resolved' ? existing.last_version : null;
-                this.directory
-                    .prepare('UPDATE _substrat_issues SET status = ?, resolved_at = ?, resolved_version = ? WHERE fingerprint = ?')
-                    .run(status, resolvedAt, resolvedVersion, fingerprint);
-                const after = issueEntry.parse(issueOf({ ...existing, status, resolved_at: resolvedAt, resolved_version: resolvedVersion }));
-                // A lifecycle flip is a staff mutation — audited with the diff (K-33).
-                this.recordAdmin(actor, 'setIssueStatus', { tenantId: null, vertical: after.lastVertical }, { fingerprint, status: existing.status }, { fingerprint, status: after.status });
+                let existing;
+                let after;
+                this.directoryWriteAndAudit(() => {
+                    existing = this.directory
+                        .prepare('SELECT * FROM _substrat_issues WHERE fingerprint = ?')
+                        .get(fingerprint);
+                    if (!existing)
+                        return false;
+                    const resolvedAt = status === 'resolved' ? new Date().toISOString() : null;
+                    // "Resolved under X": freeze the newest version at the verdict, so a later
+                    // regression can name the pair. A reopen or ignore clears it with the timestamp.
+                    const resolvedVersion = status === 'resolved' ? existing.last_version : null;
+                    this.directory
+                        .prepare('UPDATE _substrat_issues SET status = ?, resolved_at = ?, resolved_version = ? WHERE fingerprint = ?')
+                        .run(status, resolvedAt, resolvedVersion, fingerprint);
+                    after = issueEntry.parse(issueOf({ ...existing, status, resolved_at: resolvedAt, resolved_version: resolvedVersion }));
+                    return true;
+                }, () => {
+                    // A lifecycle flip is a staff mutation — audited with the diff (K-33).
+                    this.recordAdmin(actor, 'setIssueStatus', { tenantId: null, vertical: after.lastVertical }, { fingerprint, status: existing.status }, { fingerprint, status: after.status });
+                });
                 return after;
             },
             listFindings: async (actor, filter) => {
@@ -10313,6 +10411,16 @@ export class SqliteScopeHost {
                 this.recordAccess(actor, 'listRequestRollupDays', { tenantId: null }, filter ?? null, rows.length);
                 return rows;
             },
+            listTenantRequestMeter: async (actor, tenantId, since, until, limit) => {
+                const rows = readTenantRequestMeterRows(redactionSqlOf(this.directory), tenantId, since, until, limit);
+                this.recordAccess(actor, 'listTenantRequestMeter', { tenantId }, { since, until, limit }, rows.length);
+                return rows;
+            },
+            listRequestMeterDays: async (actor, since, until) => {
+                const rows = readRequestMeterDayRows(redactionSqlOf(this.directory), since, until);
+                this.recordAccess(actor, 'listRequestMeterDays', { tenantId: null }, { since, until }, rows.length);
+                return rows;
+            },
             pruneRequestDays: async (_actor, limit, retentionMonths) => this.directory.transaction(() => pruneRequestDayRows(redactionSqlOf(this.directory), Date.now(), limit, retentionMonths))(),
             // #2501: the snapshot reads and writes in one transaction, so its rows are one instant's reading.
             recordMeterDay: async (_actor, input) => this.directory.transaction(() => recordMeterDayRows(redactionSqlOf(this.directory), input))(),
@@ -10332,6 +10440,22 @@ export class SqliteScopeHost {
                 this.recordAccess(actor, 'listModelUsage', { tenantId: filter?.tenantId ?? null, scopeId: filter?.scopeId ?? null }, filter, rows.length);
                 return rows;
             },
+            listTenantModelUsageMeter: async (actor, filter) => {
+                const cursor = filter.cursor;
+                const since = canonicalInstant(filter.since);
+                const until = canonicalInstant(filter.until);
+                const rows = this.directory.prepare(`SELECT id, at, substr(vertical, 1, 64) AS vertical, substr(model, 1, 128) AS model,
+                  CASE WHEN length(vertical) > 64 OR length(model) > 128 THEN 1 ELSE 0 END AS label_truncated,
+                  reported, input_tokens, output_tokens
+             FROM _substrat_model_usage
+            WHERE tenant_id = ? AND at >= ? AND at < ?
+              ${cursor ? 'AND (at < ? OR (at = ? AND id < ?))' : ''}
+            ORDER BY at DESC, id DESC LIMIT ?`).all(filter.tenantId, since, until, ...(cursor ? [cursor.at, cursor.at, cursor.id] : []), Math.min(assertRowLimit('limit', filter.limit), 501));
+                this.recordAccess(actor, 'listTenantModelUsageMeter', { tenantId: filter.tenantId }, { since, until, limit: filter.limit }, rows.length);
+                return rows.map((row) => ({ id: row.id, at: row.at, vertical: row.vertical, model: row.model,
+                    labelTruncated: row.label_truncated !== 0, reported: row.reported !== 0,
+                    inputTokens: row.input_tokens, outputTokens: row.output_tokens }));
+            },
             summarizeModelUsage: async (actor, window, marginPercent) => {
                 const rows = this.selectModelUsage({ ...window, order: 'asc' });
                 this.recordAccess(actor, 'summarizeModelUsage', { tenantId: window.tenantId ?? null }, window, rows.length);