@substrat-run/contract-tests 0.133.0 → 0.135.0

package/dist/scope-host-suite.js

@@ -1,7 +1,7 @@
 import { describe, it, expect, beforeAll, afterAll } from 'vitest';
 import { connectorCalls, connectorTestFetch, resetConnectorCalls } from './connector-fixture.js';
-import { connectionId, dataSubjectId, domainEvent, errorCodeOf, eventId, instant, moduleManifest, orgId, AUTO_ADMISSION_NOTE, permissionKey, platformActorId, platformRequestId, principalId, scopeId, tenantId, SCOPE_QUERY_ROW_MAX, KERNEL_AUTHORED_EVENT_TYPES, } from '@substrat-run/contracts';
-import { isSearchIndexTable, REDACTED_DELIVERY_NOTE, REDACTED_INTENT_MARKER, runPlatformSweep, ulid, } from '@substrat-run/kernel';
+import { connectionId, dataSubjectId, domainEvent, errorCodeOf, eventId, instant, moduleManifest, orgId, AUTO_ADMISSION_NOTE, permissionKey, platformActorId, platformRequestId, principalId, scopeId, tenantId, SCOPE_QUERY_ROW_MAX, KERNEL_AUTHORED_EVENT_TYPES, SWEEP_RUNS_KIND, SCOPE_TABLE_PAGE_MAX, } from '@substrat-run/contracts';
+import { isSearchIndexTable, platformIntentFailureMessage, REDACTED_DELIVERY_NOTE, REDACTED_FAILURE_NOTE, REDACTED_INTENT_MARKER, runPlatformSweep, startPlatformSweeper, ulid, } from '@substrat-run/kernel';
 import { billedMod, contractTestBareOps, contractTestInitialModules, gateModManifest, lateMod, testModManifest, victimModManifest, } from './modules.js';
 /**
  * Assert a refusal by the CODE it declared, not by the sentence it happens to carry
@@ -1606,6 +1606,47 @@ export function scopeHostContractSuite(adapterName, makeFixture, opts = {}) {
             // `test/move` leads to two states where it is legal, so the attempt is not one of them.
             expect(flow.refused).toEqual([{ from: 'done', attempted: null, operation: 'test/move', count: 2, actors: { principal: 2 } }]);
         });
+        it('reads a refused transition back as a row — record, states, actor, call — like a denial (#1745)', async () => {
+            // A record of its own and a call id of its own, so the case above does not leak in.
+            const stub = await host.getScope(alice, t1, s1);
+            const call = ulid();
+            await expect(stub.invoke('test/refuse', { entityId: 'r2', from: 'done' }, { invocationId: call })).rejects.toThrow(/invalid transition/);
+            const rows = await host.admin.listRefusals(staff, t1, s1, { entityType: 'test-lifecycle', entityId: 'r2' });
+            expect(rows).toHaveLength(1);
+            expect(rows[0]).toMatchObject({
+                kind: 'transition',
+                reason: 'invalid_transition',
+                actor: alice,
+                actorKind: 'principal',
+                tenantId: t1,
+                scopeId: s1,
+                entityType: 'test-lifecycle',
+                entityId: 'r2',
+                fromState: 'done',
+                attemptedState: null,
+                operation: 'test/move',
+                invokedOperation: 'test/refuse',
+                impersonation: null,
+                invocationId: call,
+                drainedAt: null,
+            });
+            expect(rows[0].decodeError).toBeUndefined();
+            // The row survived the operation's rollback — and the operation itself left nothing
+            // behind in the outbox for that call.
+            expect((await host.admin.invocationEvents(staff, t1, s1, { invocationId: call })).events).toEqual([]);
+            // Narrowed like the denial log: by call, by actor, by window; newest first, bounded.
+            expect(await host.admin.listRefusals(staff, t1, s1, { invocationId: call })).toHaveLength(1);
+            expect(await host.admin.listRefusals(staff, t1, s1, { invocationId: ulid() })).toEqual([]);
+            const all = await host.admin.listRefusals(staff, t1, s1, { actor: alice });
+            expect(all.length).toBeGreaterThanOrEqual(3); // r1 twice (the case above) + r2
+            expect(all[0].entityId).toBe('r2');
+            expect(await host.admin.listRefusals(staff, t1, s1, { until: all[all.length - 1].at })).toEqual([]);
+            expect(await host.admin.listRefusals(staff, t1, s1, { limit: 1 })).toHaveLength(1);
+            // K-24: the read is recorded; K-3: a mismatched pair is refused, never another tenant's log.
+            const logged = await host.admin.accessLog(staff, { tenantId: t1, method: 'listRefusals' });
+            expect(logged.length).toBeGreaterThan(0);
+            await expect(host.admin.listRefusals(staff, t2, s1)).rejects.toThrow();
+        });
         // -- scope data introspection: the §5.4 admin-query RPC --------------------
         //
         // A read-only window into a scope's OWN database (the console/dashboard Data
@@ -1641,6 +1682,21 @@ export function scopeHostContractSuite(adapterName, makeFixture, opts = {}) {
             it('rejects an unknown table', async () => {
                 await expect(host.admin.readScopeTable(staff, t1, s1, { table: 'no_such_table', limit: 50, offset: 0 })).rejects.toThrow(/unknown table/);
             });
+            it('refuses a page bound SQLite would misread, and still clamps to the ceiling (#1632)', async () => {
+                // The clamp passed NaN straight through to LIMIT / OFFSET. Refused instead, with the
+                // option's name; a large but valid limit is still clamped rather than refused.
+                const read = (limit, offset) => host.admin.readScopeTable(staff, t1, s1, { table: 'marker', limit, offset });
+                const refused = (pattern) => (err) => errorCodeOf(err) === 'validation_failed' && pattern.test(err.message);
+                for (const bad of [Number.NaN, Number.POSITIVE_INFINITY, -1, 0, 1.5]) {
+                    await expect(read(bad, 0)).rejects.toSatisfy(refused(/limit must be a positive integer/));
+                }
+                for (const bad of [Number.NaN, Number.POSITIVE_INFINITY, -1, 1.5]) {
+                    await expect(read(1, bad)).rejects.toSatisfy(refused(/offset must be a non-negative integer/));
+                }
+                const clamped = await read(SCOPE_TABLE_PAGE_MAX + 1_000, 0);
+                expect(clamped.limit).toBe(SCOPE_TABLE_PAGE_MAX);
+                expect((await read(1, 0)).offset).toBe(0);
+            });
             // #1524: the size behind the on-demand storage reading. The growth assertion is what
             // separates a real size from a constant. A host that answered a fixed number, or
             // the size of some other database, passes "positive integer" and fails this.
@@ -2204,6 +2260,401 @@ export function scopeHostContractSuite(adapterName, makeFixture, opts = {}) {
                     const twice = (await journal(kind)).find((r) => r.id === id);
                     expect(twice).toEqual(once);
                 });
+                // -- the free-text copies (#1632) ---------------------------------------
+                //
+                // The directory keeps failure text about a scope: an ops failure's message, its
+                // issue's newest exemplar, a sweep record's error. The drain's failure row quotes the
+                // intent it gave up on, so a row about a tombstoned intent is a copy of redacted text;
+                // anything else is reached only when it names the subject's id.
+                describe('the directory\'s failure text, and a queued sweep record (#1632)', () => {
+                    const op = (name) => `intent.erasure-${name}-${ulid()}`;
+                    const fail = (operation, message, tenant = t1, scope = s1) => host.admin.recordOpsFailure({
+                        actor: staff,
+                        operation,
+                        stage: 'terminal',
+                        tenantId: tenant,
+                        scopeId: scope,
+                        message,
+                    });
+                    const failureOf = async (operation) => (await host.admin.listOpsFailures(staff, { operation }))[0];
+                    const issueOf = async (operation) => (await host.admin.listIssues(staff, { operation }))[0];
+                    const sweepOf = async (unit) => (await host.admin.listSweepRuns(staff, { unit }))[0];
+                    const snapshot = async (ops, units) => {
+                        const out = {};
+                        for (const [k, o] of Object.entries(ops)) {
+                            out[`failure:${k}`] = await failureOf(o);
+                            out[`issue:${k}`] = await issueOf(o);
+                        }
+                        for (const [k, u] of Object.entries(units))
+                            out[`sweep:${k}`] = await sweepOf(u);
+                        return out;
+                    };
+                    it('redacts the subject\'s failure text, and leaves every other row as it was', async () => {
+                        const kind = `connector:erasure-${ulid()}`;
+                        const erased = dataSubjectId.parse(ulid());
+                        const spared = dataSubjectId.parse(ulid());
+                        const linked = await routeIntent(kind, erased, 'Anna Ek');
+                        const unlinked = await routeIntent(kind, spared, 'Bo Lund');
+                        const ops = {
+                            linked: op('linked'),
+                            byId: op('by-id'),
+                            platform: op('platform'),
+                            spared: op('spared'),
+                            otherTenant: op('other-tenant'),
+                            unlinked: op('unlinked'),
+                            nameOnly: op('name-only'),
+                        };
+                        await fail(ops.linked, platformIntentFailureMessage(linked, 'failed: HTTP 409: Anna Ek needs a personal number'));
+                        await fail(ops.byId, `schedule threw on contact ${erased} (Anna Ek)`);
+                        await fail(ops.platform, `digest named contact ${erased}`, null, null);
+                        await fail(ops.spared, `schedule threw on contact ${spared} (Bo Lund)`);
+                        await fail(ops.otherTenant, `schedule threw on contact ${erased}`, t2, null);
+                        await fail(ops.unlinked, platformIntentFailureMessage(unlinked, 'failed: HTTP 409: Bo Lund needs a personal number'));
+                        await fail(ops.nameOnly, 'schedule threw: Anna Ek has no postal address');
+                        const units = {
+                            byId: `${s1}:erasure/by-id-${ulid()}`,
+                            spared: `${s1}:erasure/spared-${ulid()}`,
+                            otherTenant: `${s1}:erasure/other-tenant-${ulid()}`,
+                        };
+                        const sweep = (unit, error, tenant = t1) => host.admin.recordSweepRun({
+                            kind: 'schedule',
+                            unit,
+                            outcome: 'failed',
+                            tenantId: tenant,
+                            scopeId: tenant === t1 ? s1 : null,
+                            operation: 'erasure/run',
+                            error,
+                        });
+                        await sweep(units.byId, `contact ${erased} (Anna Ek) bounced`);
+                        await sweep(units.spared, `contact ${spared} (Bo Lund) bounced`);
+                        await sweep(units.otherTenant, `contact ${erased} bounced`, t2);
+                        const before = await snapshot(ops, units);
+                        await host.admin.shredSubject(staff, t1, s1, erased);
+                        const after = await snapshot(ops, units);
+                        // Text about the subject: the drain's row about a tombstoned intent, and every row
+                        // in this tenant (or the platform's own) that names the subject's id.
+                        for (const k of ['linked', 'byId', 'platform']) {
+                            expect(after[`failure:${k}`]).toEqual({ ...before[`failure:${k}`], message: REDACTED_FAILURE_NOTE });
+                            // The platform's own exemplar is attributed as the platform's, and goes on a
+                            // direct id match exactly as its ops-failure row does.
+                            expect(after[`issue:${k}`]).toEqual({ ...before[`issue:${k}`], lastMessage: REDACTED_FAILURE_NOTE });
+                        }
+                        expect(after['sweep:byId']).toEqual({ ...before['sweep:byId'], error: REDACTED_FAILURE_NOTE });
+                        // The twins: another subject's text, another tenant's row, a drain row about an
+                        // intent the erasure did not touch — and the documented residual, a sentence that
+                        // names the person with neither their id nor an intent link (§13.1).
+                        for (const k of ['spared', 'otherTenant', 'unlinked', 'nameOnly']) {
+                            expect(after[`failure:${k}`]).toEqual(before[`failure:${k}`]);
+                            expect(after[`issue:${k}`]).toEqual(before[`issue:${k}`]);
+                        }
+                        expect(after['sweep:spared']).toEqual(before['sweep:spared']);
+                        expect(after['sweep:otherTenant']).toEqual(before['sweep:otherTenant']);
+                        // Idempotent: the note names neither the subject nor an intent.
+                        await host.admin.shredSubject(staff, t1, s1, erased);
+                        expect(await snapshot(ops, units)).toEqual(after);
+                        await host.settlePlatformRequest(t1, s1, unlinked, { status: 'done' });
+                    });
+                    it('reaches a drain failure recorded after an earlier erasure tombstoned its intent', async () => {
+                        // An erasure that crashed between its scope half and its directory half, re-run:
+                        // the intent is already a tombstone, so the link has to come from every tombstone
+                        // in the journal and not only the ones this pass wrote.
+                        const kind = `connector:erasure-${ulid()}`;
+                        const erased = dataSubjectId.parse(ulid());
+                        const id = await routeIntent(kind, erased, 'Anna Ek');
+                        await host.admin.shredSubject(staff, t1, s1, erased);
+                        const operation = op('late');
+                        await fail(operation, platformIntentFailureMessage(id, 'gave up after 5 drain attempts — last error: Anna Ek'));
+                        await host.admin.shredSubject(staff, t1, s1, erased);
+                        expect((await failureOf(operation)).message).toBe(REDACTED_FAILURE_NOTE);
+                        expect((await issueOf(operation)).lastMessage).toBe(REDACTED_FAILURE_NOTE);
+                    });
+                    /** Whose an exemplar is, as the directory stores it — not on the issue read shape. */
+                    const exemplarOwnerOf = async (operation) => {
+                        const dump = await host.admin.exportDirectory(staff);
+                        const t = dump.tables.find((x) => x.name === '_substrat_issues');
+                        const row = t.rows.find((r) => r[t.columns.indexOf('operation')] === operation);
+                        return { kind: row[t.columns.indexOf('last_owner_kind')], tenant: row[t.columns.indexOf('last_tenant_id')] };
+                    };
+                    it('rewrites an issue exemplar only when its writer attributed it to the erasing tenant', async () => {
+                        // An issue has no tenant of its own and outlives its ops-failure rows (180 days vs
+                        // 90), so the writer records whose failure each exemplar copied, and erasure reads
+                        // that rather than the rows. Expiry is simulated by restoring a directory copy with
+                        // the source rows taken out — what the 90-day prune leaves behind.
+                        const erased = dataSubjectId.parse(ulid());
+                        const ops = {
+                            otherExpired: op('other-expired'),
+                            ownExpired: op('own-expired'),
+                            legacy: op('legacy'),
+                            legacyPlatform: op('legacy-platform'),
+                        };
+                        await fail(ops.otherExpired, `schedule threw on contact ${erased}`, t2, null);
+                        await fail(ops.ownExpired, `schedule threw on contact ${erased} (Anna Ek)`);
+                        await fail(ops.legacy, `schedule threw on contact ${erased} (Anna Ek)`);
+                        await fail(ops.legacyPlatform, `digest named contact ${erased}`, null, null);
+                        const copy = await host.admin.exportDirectory(staff);
+                        const expired = new Set(Object.values(ops));
+                        await host.admin.restoreDirectory(staff, {
+                            ...copy,
+                            tables: copy.tables.map((t) => {
+                                if (t.name === '_substrat_ops_failures') {
+                                    const col = t.columns.indexOf('operation');
+                                    return { ...t, rows: t.rows.filter((r) => !expired.has(r[col])) };
+                                }
+                                if (t.name === '_substrat_issues') {
+                                    // Issues from before attribution that nothing could backfill: owner unknown.
+                                    const op = t.columns.indexOf('operation');
+                                    const owner = [t.columns.indexOf('last_tenant_id'), t.columns.indexOf('last_owner_kind')];
+                                    const legacy = new Set([ops.legacy, ops.legacyPlatform]);
+                                    return {
+                                        ...t,
+                                        rows: t.rows.map((r) => (legacy.has(r[op]) ? r.map((c, i) => (owner.includes(i) ? null : c)) : r)),
+                                    };
+                                }
+                                return t;
+                            }),
+                        });
+                        expect(await host.admin.listOpsFailures(staff, { operation: ops.ownExpired })).toEqual([]);
+                        const before = {
+                            otherExpired: await issueOf(ops.otherExpired),
+                            ownExpired: await issueOf(ops.ownExpired),
+                            legacy: await issueOf(ops.legacy),
+                            legacyPlatform: await issueOf(ops.legacyPlatform),
+                        };
+                        await host.admin.shredSubject(staff, t1, s1, erased);
+                        // Another tenant's exemplar, its rows expired: byte-equal.
+                        expect(await issueOf(ops.otherExpired)).toEqual(before.otherExpired);
+                        // This tenant's, its rows expired: the attribution is enough.
+                        expect(await issueOf(ops.ownExpired)).toEqual({ ...before.ownExpired, lastMessage: REDACTED_FAILURE_NOTE });
+                        // Owner unknown: skipped — the legacy residual (§13.1 limit 9), never a guess, whether
+                        // the text was a tenant's or the platform's.
+                        expect(await issueOf(ops.legacy)).toEqual(before.legacy);
+                        expect(await issueOf(ops.legacyPlatform)).toEqual(before.legacyPlatform);
+                    });
+                    it('attributes each exemplar to the failure it copied, and a newer one takes it over', async () => {
+                        const erased = dataSubjectId.parse(ulid());
+                        const shared = op('shared');
+                        const text = `schedule threw on contact ${erased}`;
+                        await fail(shared, text);
+                        expect(await exemplarOwnerOf(shared)).toEqual({ kind: 'tenant', tenant: t1 });
+                        // The same group, a newer exemplar from another tenant: the attribution moves with it.
+                        await fail(shared, text, t2, null);
+                        expect(await exemplarOwnerOf(shared)).toEqual({ kind: 'tenant', tenant: t2 });
+                        const exemplar = await issueOf(shared);
+                        await host.admin.shredSubject(staff, t1, s1, erased);
+                        // This tenant's own row goes; the exemplar is now another tenant's and stays.
+                        const rows = await host.admin.listOpsFailures(staff, { operation: shared });
+                        expect(rows.find((r) => r.tenantId === t1).message).toBe(REDACTED_FAILURE_NOTE);
+                        expect(rows.find((r) => r.tenantId === t2).message).toBe(text);
+                        expect(await issueOf(shared)).toEqual(exemplar);
+                        // And the platform's own failure leaves the platform's exemplar — never "unknown".
+                        await fail(shared, 'the platform failed', null, null);
+                        expect(await exemplarOwnerOf(shared)).toEqual({ kind: 'platform', tenant: null });
+                    });
+                    it('ages telemetry out on the scheduled pass, not only when something new is written', async () => {
+                        // Issues, ops failures and sweep runs prune on write, which bounds them only while
+                        // something is written. Erasure skips an issue of unknown owner on the promise that
+                        // it ages out within its retention, so a quiet directory must shed it on time too.
+                        // Aged by restoring a directory copy with the rows' timestamps moved past retention.
+                        const expired = { op: op('expired'), unit: `${s1}:erasure/expired-${ulid()}` };
+                        const fresh = { op: op('fresh'), unit: `${s1}:erasure/fresh-${ulid()}` };
+                        for (const x of [expired, fresh]) {
+                            await fail(x.op, 'a failure');
+                            await host.admin.recordSweepRun({ kind: 'schedule', unit: x.unit, outcome: 'failed', tenantId: t1, scopeId: s1, operation: 'erasure/run', error: 'x' });
+                        }
+                        const LONG_AGO = '2020-01-01T00:00:00.000Z';
+                        const copy = await host.admin.exportDirectory(staff);
+                        const age = (t, match, matchCol, cols) => {
+                            const m = t.columns.indexOf(matchCol);
+                            const at = cols.map((c) => t.columns.indexOf(c));
+                            return { ...t, rows: t.rows.map((r) => (r[m] === match ? r.map((c, i) => (at.includes(i) ? LONG_AGO : c)) : r)) };
+                        };
+                        await host.admin.restoreDirectory(staff, {
+                            ...copy,
+                            tables: copy.tables.map((t) => t.name === '_substrat_ops_failures' ? age(t, expired.op, 'operation', ['at'])
+                                : t.name === '_substrat_issues' ? age(t, expired.op, 'operation', ['first_seen', 'last_seen'])
+                                    : t.name === '_substrat_sweep_runs' ? age(t, expired.unit, 'unit', ['at'])
+                                        : t),
+                        });
+                        expect(await host.admin.listIssues(staff, { operation: expired.op })).toHaveLength(1);
+                        const report = await runPlatformSweep(host, {
+                            actor: staff,
+                            fetch: connectorTestFetch,
+                            sweepers: {},
+                            drainRetries: false,
+                        });
+                        expect(report.errors.filter((e) => e.kind === 'telemetry')).toEqual([]);
+                        expect(report.telemetry?.opsFailures).toBeGreaterThanOrEqual(1);
+                        expect(report.telemetry?.issues).toBeGreaterThanOrEqual(1);
+                        expect(report.telemetry?.sweepRuns).toBeGreaterThanOrEqual(1);
+                        expect(await host.admin.listOpsFailures(staff, { operation: expired.op })).toEqual([]);
+                        expect(await host.admin.listIssues(staff, { operation: expired.op })).toEqual([]);
+                        expect(await host.admin.listSweepRuns(staff, { unit: expired.unit })).toEqual([]);
+                        // The positive twin: rows inside their retention stay.
+                        expect(await host.admin.listOpsFailures(staff, { operation: fresh.op })).toHaveLength(1);
+                        expect(await host.admin.listIssues(staff, { operation: fresh.op })).toHaveLength(1);
+                        expect(await host.admin.listSweepRuns(staff, { unit: fresh.unit })).toHaveLength(1);
+                    });
+                    it('drains a telemetry backlog larger than the batch over passes, oldest first', async () => {
+                        // After a long pause or a restore the backlog can be months of rows, and one
+                        // unbounded DELETE over it fails on the Durable Object every tick. Each pass
+                        // deletes at most `limit` rows per table, so the backlog converges instead.
+                        await host.admin.pruneTelemetry(staff, 100_000); // whatever earlier tests left
+                        const backlog = Array.from({ length: 5 }, (_, i) => ({ op: op(`backlog-${i}`), unit: `${s1}:erasure/backlog-${i}-${ulid()}` }));
+                        const fresh = { op: op('kept'), unit: `${s1}:erasure/kept-${ulid()}` };
+                        for (const x of [...backlog, fresh]) {
+                            await fail(x.op, 'a failure');
+                            await host.admin.recordSweepRun({ kind: 'schedule', unit: x.unit, outcome: 'failed', tenantId: t1, scopeId: s1, operation: 'erasure/run', error: 'x' });
+                        }
+                        const ops = new Set(backlog.map((b) => b.op));
+                        const units = new Set(backlog.map((b) => b.unit));
+                        const LONG_AGO = '2020-01-01T00:00:00.000Z';
+                        const copy = await host.admin.exportDirectory(staff);
+                        const age = (t, match, matchCol, cols) => {
+                            const m = t.columns.indexOf(matchCol);
+                            const at = cols.map((c) => t.columns.indexOf(c));
+                            return { ...t, rows: t.rows.map((r) => (match.has(r[m]) ? r.map((c, i) => (at.includes(i) ? LONG_AGO : c)) : r)) };
+                        };
+                        await host.admin.restoreDirectory(staff, {
+                            ...copy,
+                            tables: copy.tables.map((t) => t.name === '_substrat_ops_failures' ? age(t, ops, 'operation', ['at'])
+                                : t.name === '_substrat_issues' ? age(t, ops, 'operation', ['first_seen', 'last_seen'])
+                                    : t.name === '_substrat_sweep_runs' ? age(t, units, 'unit', ['at'])
+                                        : t),
+                        });
+                        expect(await host.admin.pruneTelemetry(staff, 3)).toEqual({ opsFailures: 3, issues: 3, sweepRuns: 3 });
+                        expect(await host.admin.pruneTelemetry(staff, 3)).toEqual({ opsFailures: 2, issues: 2, sweepRuns: 2 });
+                        expect(await host.admin.pruneTelemetry(staff, 3)).toEqual({ opsFailures: 0, issues: 0, sweepRuns: 0 });
+                        for (const b of backlog) {
+                            expect(await host.admin.listOpsFailures(staff, { operation: b.op })).toEqual([]);
+                            expect(await host.admin.listIssues(staff, { operation: b.op })).toEqual([]);
+                            expect(await host.admin.listSweepRuns(staff, { unit: b.unit })).toEqual([]);
+                        }
+                        // Rows inside their retention are never part of a batch.
+                        expect(await host.admin.listOpsFailures(staff, { operation: fresh.op })).toHaveLength(1);
+                        expect(await host.admin.listIssues(staff, { operation: fresh.op })).toHaveLength(1);
+                        expect(await host.admin.listSweepRuns(staff, { unit: fresh.unit })).toHaveLength(1);
+                    });
+                    it('refuses a row bound that is not a positive integer, wherever one reaches a LIMIT', async () => {
+                        // SQLite reads a negative LIMIT as no limit at all, so `-1` turned the bounded
+                        // telemetry prune into an unbounded one; a fraction or a non-finite value fails
+                        // inside SQLite on every later call. Each is refused with the option's name, and
+                        // nothing is deleted on the way.
+                        const expired = { op: op('bound'), unit: `${s1}:erasure/bound-${ulid()}` };
+                        await fail(expired.op, 'a failure');
+                        await host.admin.recordSweepRun({ kind: 'schedule', unit: expired.unit, outcome: 'failed', tenantId: t1, scopeId: s1, operation: 'erasure/run', error: 'x' });
+                        const LONG_AGO = '2020-01-01T00:00:00.000Z';
+                        const copy = await host.admin.exportDirectory(staff);
+                        const age = (t, match, matchCol, cols) => {
+                            const m = t.columns.indexOf(matchCol);
+                            const at = cols.map((c) => t.columns.indexOf(c));
+                            return { ...t, rows: t.rows.map((r) => (r[m] === match ? r.map((c, i) => (at.includes(i) ? LONG_AGO : c)) : r)) };
+                        };
+                        await host.admin.restoreDirectory(staff, {
+                            ...copy,
+                            tables: copy.tables.map((t) => t.name === '_substrat_ops_failures' ? age(t, expired.op, 'operation', ['at'])
+                                : t.name === '_substrat_issues' ? age(t, expired.op, 'operation', ['first_seen', 'last_seen'])
+                                    : t.name === '_substrat_sweep_runs' ? age(t, expired.unit, 'unit', ['at'])
+                                        : t),
+                        });
+                        const sweep = { actor: staff, fetch: connectorTestFetch, sweepers: {}, drainRetries: false };
+                        const refused = (name) => (err) => errorCodeOf(err) === 'validation_failed' && new RegExp(`${name} must be a positive integer`).test(err.message);
+                        for (const bad of [-1, 0, 1.5, Number.NaN, Number.POSITIVE_INFINITY]) {
+                            await expect(host.admin.pruneTelemetry(staff, bad)).rejects.toSatisfy(refused('limit'));
+                            await expect(host.admin.pruneAccessLog(staff, bad)).rejects.toSatisfy(refused('limit'));
+                            await expect(runPlatformSweep(host, { ...sweep, telemetryBatch: bad })).rejects.toSatisfy(refused('telemetryBatch'));
+                            await expect(runPlatformSweep(host, { ...sweep, accessLogBatch: bad })).rejects.toSatisfy(refused('accessLogBatch'));
+                            expect(() => startPlatformSweeper(host, { ...sweep, telemetryBatch: bad, intervalMs: 60_000 })).toThrow(/telemetryBatch must be a positive integer/);
+                            await expect(host.runDueJobs(t1, s1, { limit: bad })).rejects.toThrow(/limit must be a positive integer/);
+                            await expect(host.admin.readUndrainedEvents(staff, t1, s1, bad)).rejects.toThrow(/limit must be a positive integer/);
+                            await expect(host.admin.auditLog(staff, { limit: bad })).rejects.toThrow(/limit must be a positive integer/);
+                        }
+                        // Nothing went on the way: the expired rows are all still there.
+                        expect(await host.admin.listOpsFailures(staff, { operation: expired.op })).toHaveLength(1);
+                        expect(await host.admin.listIssues(staff, { operation: expired.op })).toHaveLength(1);
+                        expect(await host.admin.listSweepRuns(staff, { unit: expired.unit })).toHaveLength(1);
+                        // The positive twin: a valid bound drains them.
+                        while (Object.values(await host.admin.pruneTelemetry(staff, 1)).some((n) => n > 0))
+                            ;
+                        expect(await host.admin.listOpsFailures(staff, { operation: expired.op })).toEqual([]);
+                        expect(await host.admin.listIssues(staff, { operation: expired.op })).toEqual([]);
+                        expect(await host.admin.listSweepRuns(staff, { unit: expired.unit })).toEqual([]);
+                    });
+                    it('rewrites a queued sweep-runs entry\'s error, and keeps the rest of the intent', async () => {
+                        // A CP-less pass queues its schedule outcomes as one `sweep-runs` intent, and the
+                        // drain lands each entry's `error` in `_substrat_sweep_runs`. The intent is kept like
+                        // every other, so the same text is held twice. `sweep-runs` is platform-authored —
+                        // module code cannot enqueue it — so the rows are planted through a restore.
+                        const erased = dataSubjectId.parse(ulid());
+                        const spared = dataSubjectId.parse(ulid());
+                        // Guarantees the journal has a row to copy the envelope columns from.
+                        const template = await routeIntent(`connector:erasure-${ulid()}`, spared, 'Bo Lund');
+                        const backup = await host.admin.exportScope(staff, t1, s1);
+                        const table = backup.tables.find((t) => t.name === '_substrat_platform_requests');
+                        const idCol = table.columns.indexOf('id');
+                        const base = table.rows.find((r) => r[idCol] === template);
+                        const at = '2026-09-20T00:00:00.000Z';
+                        const entry = (operation, error) => ({
+                            kind: 'schedule',
+                            operation,
+                            outcome: error === null ? 'ok' : 'failed',
+                            at,
+                            error,
+                            elapsedMs: 12,
+                        });
+                        const payloads = {
+                            mine: {
+                                version: null,
+                                entries: [
+                                    entry('crm/sync', `contact ${erased} (Anna Ek) bounced`),
+                                    entry('crm/tidy', 'nothing to tidy'),
+                                    entry('crm/ok', null),
+                                ],
+                            },
+                            theirs: { version: 'v-1', entries: [entry('crm/sync', `contact ${spared} (Bo Lund) bounced`)] },
+                        };
+                        const ids = { mine: ulid(), theirs: ulid() };
+                        const plant = (id, payload) => table.columns.map((c, i) => c === 'id' ? id
+                            : c === 'kind' ? SWEEP_RUNS_KIND
+                                : c === 'payload' ? JSON.stringify(payload)
+                                    : c === 'status' ? 'pending'
+                                        : c === 'attempts' ? 0
+                                            : c === 'settled_at' || c === 'last_error' || c === 'last_failure' || c === 'result' ? null
+                                                : base[i]);
+                        const s = scopeId.parse(ulid());
+                        await host.provisionScope(staff, { tenantId: t1, scopeId: s, jurisdiction: 'eu', vertical: 'connector-vertical' });
+                        await host.admin.activateScope(staff, t1, s);
+                        await host.restoreScope(staff, t1, s, {
+                            ...backup,
+                            scopeId: s,
+                            tables: backup.tables.map((t) => t === table ? { ...t, rows: [...t.rows, plant(ids.mine, payloads.mine), plant(ids.theirs, payloads.theirs)] } : t),
+                        });
+                        await host.settlePlatformRequest(t1, s1, template, { status: 'done' });
+                        const queued = async () => {
+                            const rows = await host.listPlatformRequestHistory(t1, s, { kind: SWEEP_RUNS_KIND });
+                            return { mine: rows.find((r) => r.id === ids.mine), theirs: rows.find((r) => r.id === ids.theirs) };
+                        };
+                        const before = await queued();
+                        await host.admin.shredSubject(staff, t1, s, erased);
+                        const after = await queued();
+                        // Only the error that named the subject; the shape, the other entries, the
+                        // version and the row's own columns are as they were — still pending, so the
+                        // drain lands the note instead of the text.
+                        expect(after.mine).toEqual({
+                            ...before.mine,
+                            payload: {
+                                ...payloads.mine,
+                                entries: [
+                                    { ...payloads.mine.entries[0], error: REDACTED_FAILURE_NOTE },
+                                    payloads.mine.entries[1],
+                                    payloads.mine.entries[2],
+                                ],
+                            },
+                        });
+                        expect(after.theirs).toEqual(before.theirs);
+                        await host.admin.shredSubject(staff, t1, s, erased);
+                        expect(await queued()).toEqual(after);
+                    });
+                });
             });
             it('records the erasure in BOTH logs — mutation and evidence-destruction', async () => {
                 const subject = dataSubjectId.parse(ulid());
@@ -4024,7 +4475,7 @@ export function scopeHostContractSuite(adapterName, makeFixture, opts = {}) {
             // The refusal the registry exists for. Without it "a push lands pending" is
             // a convention, and D-30's lockstep-upgrade argument is that conventions are
             // what we cannot afford here.
-            await expect(host.admin.bindScopeVersion(staff, t1, s1, versionId)).rejects.toThrow(/pending, not admitted/);
+            await expectRefusal(host.admin.bindScopeVersion(staff, t1, s1, versionId), 'conflict');
             await host.admin.admitVersion(staff, versionId);
             await host.admin.bindScopeVersion(staff, t1, s1, versionId);
             const scope = await host.admin.getScopeRecord(staff, t1, s1);
@@ -4085,7 +4536,7 @@ export function scopeHostContractSuite(adapterName, makeFixture, opts = {}) {
             await host.admin.bindScopeVersion(staff, t1, preview, pending);
             expect((await host.admin.getScopeRecord(staff, t1, preview))?.verticalVersionId).toBe(pending);
             // …while a normal (serving) scope keeps the refusal the registry exists for.
-            await expect(host.admin.bindScopeVersion(staff, t1, s1, pending)).rejects.toThrow(/pending, not admitted/);
+            await expectRefusal(host.admin.bindScopeVersion(staff, t1, s1, pending), 'conflict');
         });
         it('routes a PREVIEW to its bound version, not the vertical serving script (#527)', async () => {
             // The bug: a preview forks into — and binds — a specific (usually not-yet-serving)
@@ -4238,19 +4689,20 @@ export function scopeHostContractSuite(adapterName, makeFixture, opts = {}) {
                 ownerTenant: t2,
             });
             // A slug's owner is fixed at first push: a different owner (or claiming a
-            // platform vertical) is refused, naming both owners.
-            await expect(host.admin.registerVertical(staff, {
+            // platform vertical) is refused, naming both owners. The message is asserted beside
+            // the code only for WHICH owner it names; the code is the contract.
+            await expectRefusal(host.admin.registerVertical(staff, {
                 slug: 'helpdesk',
                 name: 'Helpdesk',
                 source: 'cli',
                 ownerTenant: t1,
-            })).rejects.toThrow(/owned by/);
-            await expect(host.admin.registerVertical(staff, {
+            }), 'conflict', /owned by/);
+            await expectRefusal(host.admin.registerVertical(staff, {
                 slug: 'callout',
                 name: 'Callout',
                 source: 'builtin',
                 ownerTenant: t2,
-            })).rejects.toThrow(/owned by the platform/);
+            }), 'conflict', /owned by the platform/);
         });
         it('carries registry-driven install metadata (marketplace-publish.md §3) and refreshes it', async () => {
             // ownerGrants/entitlements/provides/requires ride the registry (one install_spec JSON
@@ -4560,12 +5012,31 @@ export function scopeHostContractSuite(adapterName, makeFixture, opts = {}) {
                 deploymentRef: null,
             });
             await host.admin.rejectVersion(staff, versionId, 'permission diff widened a role');
-            await expect(host.admin.bindScopeVersion(staff, t1, s1, versionId)).rejects.toThrow(/rejected, not admitted/);
+            await expectRefusal(host.admin.bindScopeVersion(staff, t1, s1, versionId), 'conflict');
             // Terminal: a rejected version is not resurrected, a new one is published.
             await expectRefusal(host.admin.admitVersion(staff, versionId), 'conflict');
             const rejected = (await host.admin.listVersions(staff, 'callout')).find((v) => v.id === versionId);
             expect(rejected?.admissionNote).toContain('widened a role');
         });
+        it('refuses to reject a version that is already admitted, and leaves it admitted', async () => {
+            // `conflict` (#113 phase 6): the version may already be bound, so admission is one-way
+            // from here. Rejecting an admitted version is the one refusal `rejectVersion` makes.
+            const versionId = ulid();
+            await host.admin.publishVersion(staff, {
+                id: versionId,
+                verticalSlug: 'callout',
+                version: '1.1.0-vouched',
+                manifestDigest: 'm3',
+                permissionDigest: 'p3',
+                migrationDigest: 'g3',
+                deploymentRef: null,
+            });
+            await host.admin.admitVersion(staff, versionId);
+            await expectRefusal(host.admin.rejectVersion(staff, versionId, 'changed my mind'), 'conflict');
+            const after = (await host.admin.listVersions(staff, 'callout')).find((v) => v.id === versionId);
+            expect(after?.admission).toBe('admitted');
+            expect(after?.admissionNote).toBeNull();
+        });
         it('carries the digests promotion compares', async () => {
             // "Has the permission surface changed between what is in prod and what I am
             // promoting?" is a string comparison here. Today it is a person remembering
@@ -4656,7 +5127,18 @@ export function scopeHostContractSuite(adapterName, makeFixture, opts = {}) {
                 migrationDigest: 'g',
                 deploymentRef: null,
             });
-            await expect(host.admin.promoteVersion(staff, 'callout', 'prod', pending)).rejects.toThrow(/pending, not admitted/);
+            await expectRefusal(host.admin.promoteVersion(staff, 'callout', 'prod', pending), 'conflict');
+        });
+        it('refuses to promote a version through a vertical that does not own it', async () => {
+            // `conflict` (#113 phase 6). The version is real and admitted — it is the pairing that
+            // is wrong — so this is neither `not_found` (the version exists) nor a state to wait out.
+            const v = await publish('2.9.0', { perm: 'pZ', mig: 'gZ' });
+            await host.admin.registerVertical(staff, { slug: 'elsewhere', name: 'Elsewhere', source: 'builtin' });
+            await expectRefusal(host.admin.promoteVersion(staff, 'elsewhere', 'prod', v), 'conflict');
+            // Positive twin: through its own vertical the same version promotes (the earlier tests
+            // moved prod, so the digest checkpoints are acknowledged — they are not under test here).
+            await host.admin.promoteVersion(staff, 'callout', 'prod', v, { permissionChange: true, migrationChange: true });
+            expect((await host.admin.listChannels(staff, 'callout')).find((c) => c.channel === 'prod')?.versionId).toBe(v);
         });
         // -- private verticals: self-serve prod (builder-plane.md §4-revised) ----
         // A private vertical's blast radius is its own tenant — dev/staging already
@@ -4798,7 +5280,7 @@ export function scopeHostContractSuite(adapterName, makeFixture, opts = {}) {
             // Listing is the moment OTHER tenants start trusting this code, so the version
             // they would install needs a recorded human decision — the auto-admission note
             // is exactly what marks its absence.
-            await expect(host.admin.setVerticalListed(staff, 'tenant-a/crm', true)).rejects.toThrow(/auto-admitted.*staff admit/);
+            await expectRefusal(host.admin.setVerticalListed(staff, 'tenant-a/crm', true), 'conflict');
             // A staff admit of the already-admitted version upgrades it to a manual vouch
             // (clears the note, audited) — then listing passes.
             const prodNow = (await host.admin.listChannels(staff, 'tenant-a/crm')).find((c) => c.channel === 'prod')