@substrat-run/contract-tests 0.160.0 → 0.161.0

package/dist/introspection-reads-suite.js

@@ -0,0 +1,114 @@
+import { afterAll, beforeAll, describe, expect, it } from 'vitest';
+import { errorCodeOf, eventId, platformActorId, scopeId as scopeIdSchema, tenantId, } from '@substrat-run/contracts';
+import { scopeNotHeldRefusal, ulid } from '@substrat-run/kernel';
+import { TEST_LIFECYCLE } from './modules.js';
+/** A host's introspection reads, bound, for a fixture to hand the suite. */
+export const introspectionReadsOf = (host) => ({
+    facetEventsLocal: (s, i) => host.facetEventsLocal(s, i),
+    eventEffectsLocal: (s, i) => host.eventEffectsLocal(s, i),
+    invocationEventsLocal: (s, i) => host.invocationEventsLocal(s, i),
+    deadLettersLocal: (s, i) => host.deadLettersLocal(s, i),
+    lifecycleFlowLocal: (s, i) => host.lifecycleFlowLocal(s, i),
+    operationSeriesLocal: (s, i) => host.operationSeriesLocal(s, i),
+    eventCauseLocal: (s, i) => host.eventCauseLocal(s, i),
+    entityHistoryLocal: (s, i) => host.entityHistoryLocal(s, i),
+    appliedMigrationsLocal: (s) => host.appliedMigrationsLocal(s),
+    migrationBookmarksLocal: (s) => host.migrationBookmarksLocal(s),
+    introspectScopeTables: (s) => host.introspectScopeTables(s),
+    introspectScopeTable: (s, i) => host.introspectScopeTable(s, i),
+    introspectScopeQuery: (s, i) => host.introspectScopeQuery(s, i),
+    undrainedEventsLocal: (s, n) => host.undrainedEventsLocal(s, n),
+    redrainCountLocal: (s, b) => host.redrainCountLocal(s, b),
+});
+/** One valid call of each read, for a suite that asks every one of them the same question. */
+export function introspectionReadCalls(r) {
+    const window = () => {
+        const since = Math.floor(Date.now() / 1000) * 1000;
+        return { since: new Date(since - 60_000).toISOString(), until: new Date(since + 60_000).toISOString() };
+    };
+    return {
+        facetEventsLocal: (s) => r.facetEventsLocal(s, { groupBy: { kind: 'type' } }),
+        eventEffectsLocal: (s) => r.eventEffectsLocal(s, { eventId: eventId.parse(ulid()) }),
+        invocationEventsLocal: (s) => r.invocationEventsLocal(s, { invocationId: ulid() }),
+        deadLettersLocal: (s) => r.deadLettersLocal(s, {}),
+        lifecycleFlowLocal: (s) => r.lifecycleFlowLocal(s, { entityType: 'test-lifecycle', lifecycle: TEST_LIFECYCLE, ...window() }),
+        operationSeriesLocal: (s) => r.operationSeriesLocal(s, {
+            moves: [{ entityType: 'test-lifecycle', operation: 'test/move' }],
+            bucketMinutes: 1,
+            ...window(),
+        }),
+        eventCauseLocal: (s) => r.eventCauseLocal(s, { eventId: eventId.parse(ulid()) }),
+        entityHistoryLocal: (s) => r.entityHistoryLocal(s, { entityType: 'test-thing', entityId: 'x1' }),
+        appliedMigrationsLocal: (s) => r.appliedMigrationsLocal(s),
+        migrationBookmarksLocal: (s) => r.migrationBookmarksLocal(s),
+        introspectScopeTables: (s) => r.introspectScopeTables(s),
+        introspectScopeTable: (s) => r.introspectScopeTable(s, { table: '_substrat_outbox', limit: 10, offset: 0 }),
+        introspectScopeQuery: (s) => r.introspectScopeQuery(s, { sql: 'SELECT 1 AS one' }),
+        undrainedEventsLocal: (s) => r.undrainedEventsLocal(s, 10),
+        redrainCountLocal: (s) => r.redrainCountLocal(s, new Date().toISOString()),
+    };
+}
+/**
+ * The introspection reads that name only a scope id hold the scope before they read it (#2544), as
+ * the size reads do (#2541): a scope this deployment does not hold (reaped, or never provisioned
+ * here) is refused `conflict` with one sentence, never answered as an empty store, and a refusal
+ * creates no store. A held scope still reads. One case per read, on both adapters.
+ */
+export function introspectionReadsContractSuite(adapterName, makeFixture) {
+    describe(`introspection reads refuse a scope the deployment does not hold (#2544): ${adapterName}`, () => {
+        let fixture;
+        const staff = platformActorId.parse(ulid());
+        const t = tenantId.parse(ulid());
+        beforeAll(async () => {
+            fixture = await makeFixture();
+            await fixture.host.admin.createTenant(staff, { id: t, slug: `introspect-${t.slice(-8).toLowerCase()}`, name: 'Introspection' });
+        });
+        afterAll(async () => fixture?.cleanup());
+        const newScope = async () => {
+            const s = scopeIdSchema.parse(ulid());
+            await fixture.host.provisionScope(staff, { tenantId: t, scopeId: s, vertical: 'introspect' });
+            await fixture.host.admin.activateScope(staff, t, s);
+            return s;
+        };
+        const reap = async (s) => {
+            await fixture.host.admin.archiveScope(staff, t, s);
+            await fixture.host.admin.reapScope(staff, t, s, { force: true });
+        };
+        const refusal = (p) => p.then(() => undefined, (e) => ({ code: errorCodeOf(e), message: e.message }));
+        const refusedAs = (s) => ({ code: 'conflict', message: scopeNotHeldRefusal(s) });
+        // The calls are built before the fixture is (they name the cases), so each one reaches it late.
+        const lazy = new Proxy({}, {
+            get: (_target, name) => (...args) => fixture[name](...args),
+        });
+        const reads = introspectionReadCalls(lazy);
+        describe.each(Object.entries(reads))('%s', (_name, read) => {
+            it('reads a held scope, and answers something', async () => {
+                const s = await newScope();
+                expect(await read(s)).not.toBeNull();
+                expect(await read(s)).toBeDefined();
+            });
+            it('refuses a reaped scope, in the shared words, and leaves nothing stored for it', async () => {
+                const s = await newScope();
+                await reap(s);
+                expect(await refusal(read(s))).toEqual(refusedAs(s));
+                // Asked again, it is still refused: the first refusal did not make the scope held.
+                expect(await refusal(read(s))).toEqual(refusedAs(s));
+                expect(await fixture.storeHoldsNothing(t, s)).toBe(true);
+            });
+            it('refuses an id nothing provisioned here, and leaves nothing stored for it', async () => {
+                const s = scopeIdSchema.parse(ulid());
+                expect(await refusal(read(s))).toEqual(refusedAs(s));
+                expect(await fixture.storeHoldsNothing(t, s)).toBe(true);
+            });
+        });
+        it('a scope listed as active and reaped before it is read is refused, while the held one beside it reads', async () => {
+            const [gone, kept] = [await newScope(), await newScope()];
+            const due = (await fixture.host.admin.listScopes(staff, { tenantId: t, status: 'active' })).map((x) => x.id);
+            expect(due).toEqual(expect.arrayContaining([gone, kept]));
+            await reap(gone);
+            expect(await refusal(fixture.undrainedEventsLocal(gone, 10))).toEqual(refusedAs(gone));
+            expect(await refusal(fixture.undrainedEventsLocal(kept, 10))).toBeUndefined();
+        });
+    });
+}
+//# sourceMappingURL=introspection-reads-suite.js.map

package/dist/introspection-reads-suite.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"introspection-reads-suite.js","sourceRoot":"","sources":["../src/introspection-reads-suite.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,QAAQ,CAAC;AACnE,OAAO,EACL,WAAW,EACX,OAAO,EACP,eAAe,EACf,OAAO,IAAI,aAAa,EACxB,QAAQ,GAaT,MAAM,yBAAyB,CAAC;AACjC,OAAO,EAAE,mBAAmB,EAAE,IAAI,EAAE,MAAM,sBAAsB,CAAC;AAEjE,OAAO,EAAE,cAAc,EAAE,MAAM,cAAc,CAAC;AAqB9C,4EAA4E;AAC5E,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAAC,IAAwB,EAAsB,EAAE,CAAC,CAAC;IACrF,gBAAgB,EAAE,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC,EAAE,CAAC,CAAC;IACvD,iBAAiB,EAAE,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC,EAAE,CAAC,CAAC;IACzD,qBAAqB,EAAE,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,qBAAqB,CAAC,CAAC,EAAE,CAAC,CAAC;IACjE,gBAAgB,EAAE,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC,EAAE,CAAC,CAAC;IACvD,kBAAkB,EAAE,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,kBAAkB,CAAC,CAAC,EAAE,CAAC,CAAC;IAC3D,oBAAoB,EAAE,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,oBAAoB,CAAC,CAAC,EAAE,CAAC,CAAC;IAC/D,eAAe,EAAE,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC,EAAE,CAAC,CAAC;IACrD,kBAAkB,EAAE,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,kBAAkB,CAAC,CAAC,EAAE,CAAC,CAAC;IAC3D,sBAAsB,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,sBAAsB,CAAC,CAAC,CAAC;IAC7D,uBAAuB,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,uBAAuB,CAAC,CAAC,CAAC;IAC/D,qBAAqB,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,qBAAqB,CAAC,CAAC,CAAC;IAC3D,oBAAoB,EAAE,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,oBAAoB,CAAC,CAAC,EAAE,CAAC,CAAC;IAC/D,oBAAoB,EAAE,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,oBAAoB,CAAC,CAAC,EAAE,CAAC,CAAC;IAC/D,oBAAoB,EAAE,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,oBAAoB,CAAC,CAAC,EAAE,CAAC,CAAC;IAC/D,iBAAiB,EAAE,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC,EAAE,CAAC,CAAC;CAC1D,CAAC,CAAC;AAEH,8FAA8F;AAC9F,MAAM,UAAU,sBAAsB,CAAC,CAAqB;IAC1D,MAAM,MAAM,GAAG,GAAG,EAAE;QAClB,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,GAAG,IAAI,CAAC;QACnD,OAAO,EAAE,KAAK,EAAE,IAAI,IAAI,CAAC,KAAK,GAAG,MAAM,CAAC,CAAC,WAAW,EAAE,EAAE,KAAK,EAAE,IAAI,IAAI,CAAC,KAAK,GAAG,MAAM,CAAC,CAAC,WAAW,EAAE,EAAE,CAAC;IAC1G,CAAC,CAAC;IACF,OAAO;QACL,gBAAgB,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,gBAAgB,CAAC,CAAC,EAAE,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,CAAC;QAC7E,iBAAiB,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,iBAAiB,CAAC,CAAC,EAAE,EAAE,OAAO,EAAE,OAAO,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,EAAE,CAAC;QACpF,qBAAqB,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,qBAAqB,CAAC,CAAC,EAAE,EAAE,YAAY,EAAE,IAAI,EAAE,EAAE,CAAC;QAClF,gBAAgB,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,gBAAgB,CAAC,CAAC,EAAE,EAAE,CAAC;QAClD,kBAAkB,EAAE,CAAC,CAAC,EAAE,EAAE,CACxB,CAAC,CAAC,kBAAkB,CAAC,CAAC,EAAE,EAAE,UAAU,EAAE,gBAAgB,EAAE,SAAS,EAAE,cAAc,EAAE,GAAG,MAAM,EAAE,EAAE,CAAC;QACnG,oBAAoB,EAAE,CAAC,CAAC,EAAE,EAAE,CAC1B,CAAC,CAAC,oBAAoB,CAAC,CAAC,EAAE;YACxB,KAAK,EAAE,CAAC,EAAE,UAAU,EAAE,gBAAgB,EAAE,SAAS,EAAE,WAAW,EAAE,CAAC;YACjE,aAAa,EAAE,CAAC;YAChB,GAAG,MAAM,EAAE;SACZ,CAAC;QACJ,eAAe,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC,EAAE,EAAE,OAAO,EAAE,OAAO,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,EAAE,CAAC;QAChF,kBAAkB,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,kBAAkB,CAAC,CAAC,EAAE,EAAE,UAAU,EAAE,YAAY,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;QAChG,sBAAsB,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,sBAAsB,CAAC,CAAC,CAAC;QAC1D,uBAAuB,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,uBAAuB,CAAC,CAAC,CAAC;QAC5D,qBAAqB,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,qBAAqB,CAAC,CAAC,CAAC;QACxD,oBAAoB,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,oBAAoB,CAAC,CAAC,EAAE,EAAE,KAAK,EAAE,kBAAkB,EAAE,KAAK,EAAE,EAAE,EAAE,MAAM,EAAE,CAAC,EAAE,CAAC;QAC3G,oBAAoB,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,oBAAoB,CAAC,CAAC,EAAE,EAAE,GAAG,EAAE,iBAAiB,EAAE,CAAC;QAClF,oBAAoB,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,oBAAoB,CAAC,CAAC,EAAE,EAAE,CAAC;QAC1D,iBAAiB,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,iBAAiB,CAAC,CAAC,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;KAC3E,CAAC;AACJ,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,+BAA+B,CAC7C,WAAmB,EACnB,WAMC;IAED,QAAQ,CAAC,4EAA4E,WAAW,EAAE,EAAE,GAAG,EAAE;QACvG,IAAI,OAAgD,CAAC;QACrD,MAAM,KAAK,GAAG,eAAe,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC;QAC5C,MAAM,CAAC,GAAG,QAAQ,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC;QAEjC,SAAS,CAAC,KAAK,IAAI,EAAE;YACnB,OAAO,GAAG,MAAM,WAAW,EAAE,CAAC;YAC9B,MAAM,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,KAAK,EAAE,EAAE,EAAE,EAAE,CAAC,EAAE,IAAI,EAAE,cAAc,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,EAAE,EAAE,IAAI,EAAE,eAAe,EAAE,CAAC,CAAC;QAClI,CAAC,CAAC,CAAC;QACH,QAAQ,CAAC,KAAK,IAAI,EAAE,CAAC,OAAO,EAAE,OAAO,EAAE,CAAC,CAAC;QAEzC,MAAM,QAAQ,GAAG,KAAK,IAAsB,EAAE;YAC5C,MAAM,CAAC,GAAG,aAAa,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC;YACtC,MAAM,OAAO,CAAC,IAAI,CAAC,cAAc,CAAC,KAAK,EAAE,EAAE,QAAQ,EAAE,CAAC,EAAE,OAAO,EAAE,CAAC,EAAE,QAAQ,EAAE,YAAY,EAAE,CAAC,CAAC;YAC9F,MAAM,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,aAAa,CAAC,KAAK,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC;YACpD,OAAO,CAAC,CAAC;QACX,CAAC,CAAC;QACF,MAAM,IAAI,GAAG,KAAK,EAAE,CAAU,EAAiB,EAAE;YAC/C,MAAM,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,KAAK,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC;YACnD,MAAM,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,KAAK,EAAE,CAAC,EAAE,CAAC,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;QACnE,CAAC,CAAC;QACF,MAAM,OAAO,GAAG,CAAC,CAAmB,EAAE,EAAE,CACtC,CAAC,CAAC,IAAI,CACJ,GAAG,EAAE,CAAC,SAAS,EACf,CAAC,CAAU,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,WAAW,CAAC,CAAC,CAAC,EAAE,OAAO,EAAG,CAAW,CAAC,OAAO,EAAE,CAAC,CAC1E,CAAC;QACJ,MAAM,SAAS,GAAG,CAAC,CAAU,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,UAAU,EAAE,OAAO,EAAE,mBAAmB,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;QAE1F,gGAAgG;QAChG,MAAM,IAAI,GAAG,IAAI,KAAK,CAAC,EAAwB,EAAE;YAC/C,GAAG,EAAE,CAAC,OAAO,EAAE,IAAY,EAAE,EAAE,CAAC,CAAC,GAAG,IAAe,EAAE,EAAE,CACpD,OAAmE,CAAC,IAAI,CAAE,CAAC,GAAG,IAAI,CAAC;SACvF,CAAC,CAAC;QACH,MAAM,KAAK,GAAG,sBAAsB,CAAC,IAAI,CAAC,CAAC;QAE3C,QAAQ,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,KAAK,EAAE,IAAI,EAAE,EAAE;YACzD,EAAE,CAAC,2CAA2C,EAAE,KAAK,IAAI,EAAE;gBACzD,MAAM,CAAC,GAAG,MAAM,QAAQ,EAAE,CAAC;gBAC3B,MAAM,CAAC,MAAM,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE,CAAC;gBACrC,MAAM,CAAC,MAAM,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC;YACtC,CAAC,CAAC,CAAC;YAEH,EAAE,CAAC,+EAA+E,EAAE,KAAK,IAAI,EAAE;gBAC7F,MAAM,CAAC,GAAG,MAAM,QAAQ,EAAE,CAAC;gBAC3B,MAAM,IAAI,CAAC,CAAC,CAAC,CAAC;gBACd,MAAM,CAAC,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC;gBACrD,mFAAmF;gBACnF,MAAM,CAAC,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC;gBACrD,MAAM,CAAC,MAAM,OAAO,CAAC,iBAAiB,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YAC3D,CAAC,CAAC,CAAC;YAEH,EAAE,CAAC,0EAA0E,EAAE,KAAK,IAAI,EAAE;gBACxF,MAAM,CAAC,GAAG,aAAa,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC;gBACtC,MAAM,CAAC,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC;gBACrD,MAAM,CAAC,MAAM,OAAO,CAAC,iBAAiB,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YAC3D,CAAC,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,sGAAsG,EAAE,KAAK,IAAI,EAAE;YACpH,MAAM,CAAC,IAAI,EAAE,IAAI,CAAC,GAAG,CAAC,MAAM,QAAQ,EAAE,EAAE,MAAM,QAAQ,EAAE,CAAC,CAAC;YAC1D,MAAM,GAAG,GAAG,CAAC,MAAM,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,KAAK,EAAE,EAAE,QAAQ,EAAE,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;YAC7G,MAAM,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,eAAe,CAAC,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC;YAC1D,MAAM,IAAI,CAAC,IAAI,CAAC,CAAC;YACjB,MAAM,CAAC,MAAM,OAAO,CAAC,OAAO,CAAC,oBAAoB,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC;YACvF,MAAM,CAAC,MAAM,OAAO,CAAC,OAAO,CAAC,oBAAoB,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,aAAa,EAAE,CAAC;QAChF,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;AACL,CAAC"}

package/dist/restore-role-suite.d.ts

@@ -0,0 +1,17 @@
+import { type ScopeId, type TenantId } from '@substrat-run/contracts';
+import { type RoleState } from '@substrat-run/kernel';
+import type { ScopeHostFixture } from './scope-host-suite.js';
+/**
+ * #2555: a staff restore or import on a host the control plane runs (`restoreScope`, `importScope`)
+ * judges the tenant's roles as the directory stores them NOW against the dump's seats and role rows
+ * (`dumpRoleRefusal`), before anything is replaced. A dump holding a seat in a role the directory
+ * has since made system-held is refused, with nothing loaded and no scope created; the twin without
+ * the seat is admitted. A change the rule admits leaves the dump's seats as they were: nothing is
+ * revoked. The refusal is one fixed sentence naming the role key only.
+ */
+export declare function restoreRoleContractSuite(adapterName: string, makeFixture: () => Promise<ScopeHostFixture & {
+    roleState(tenantId: TenantId, scopeId: ScopeId): Promise<RoleState>;
+    /** Whether this host's dump stores the tenant's role rows (a scope that reads its roles locally). */
+    dumpCarriesRoles: boolean;
+}>): void;
+//# sourceMappingURL=restore-role-suite.d.ts.map

package/dist/restore-role-suite.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"restore-role-suite.d.ts","sourceRoot":"","sources":["../src/restore-role-suite.ts"],"names":[],"mappings":"AACA,OAAO,EAAuE,KAAK,OAAO,EAAE,KAAK,QAAQ,EAAE,MAAM,yBAAyB,CAAC;AAC3I,OAAO,EAAQ,KAAK,SAAS,EAAE,MAAM,sBAAsB,CAAC;AAC5D,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,uBAAuB,CAAC;AAE9D;;;;;;;GAOG;AACH,wBAAgB,wBAAwB,CACtC,WAAW,EAAE,MAAM,EACnB,WAAW,EAAE,MAAM,OAAO,CACxB,gBAAgB,GAAG;IACjB,SAAS,CAAC,QAAQ,EAAE,QAAQ,EAAE,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,SAAS,CAAC,CAAC;IACpE,qGAAqG;IACrG,gBAAgB,EAAE,OAAO,CAAC;CAC3B,CACF,GACA,IAAI,CAuGN"}

package/dist/restore-role-suite.js

@@ -0,0 +1,107 @@
+import { afterAll, beforeAll, describe, expect, it } from 'vitest';
+import { platformActorId, principalId, scopeId, tenantId } from '@substrat-run/contracts';
+import { ulid } from '@substrat-run/kernel';
+/**
+ * #2555: a staff restore or import on a host the control plane runs (`restoreScope`, `importScope`)
+ * judges the tenant's roles as the directory stores them NOW against the dump's seats and role rows
+ * (`dumpRoleRefusal`), before anything is replaced. A dump holding a seat in a role the directory
+ * has since made system-held is refused, with nothing loaded and no scope created; the twin without
+ * the seat is admitted. A change the rule admits leaves the dump's seats as they were: nothing is
+ * revoked. The refusal is one fixed sentence naming the role key only.
+ */
+export function restoreRoleContractSuite(adapterName, makeFixture) {
+    describe(`a restore judges the directory's roles against the dump's seats (#2555): ${adapterName}`, () => {
+        let fixture;
+        const staff = platformActorId.parse(ulid());
+        const t = tenantId.parse(ulid());
+        const alice = principalId.parse(ulid());
+        const USE = 'rrs:use';
+        const RUN = 'rrs:run';
+        const undefinedInDump = (key) => `restore refused: the dump seats role '${key}' but carries no definition of it, so its seats cannot be told from a person's, ` +
+            `and the tenant now defines the role for a system principal (K-55); nothing was loaded`;
+        /** The refusal of a seat in a role since made system-held: which sentence depends on whether the dump stores the role. */
+        const refusalFor = (key) => fixture.dumpCarriesRoles
+            ? `restore refused: role '${key}', which the dump seats or defines, cannot be applied as the tenant defines it now (K-55); nothing was loaded`
+            : undefinedInDump(key);
+        const scope = async () => {
+            const id = scopeId.parse(ulid());
+            await fixture.host.provisionScope(staff, { tenantId: t, scopeId: id, vertical: 'restore-roles' });
+            await fixture.host.admin.activateScope(staff, t, id);
+            return id;
+        };
+        const seat = (roleKey, at) => ({ principalId: alice, roleKey, node: { tenantId: t, scopeId: at } });
+        const refusalOf = (p) => p.then(() => undefined, (e) => e);
+        beforeAll(async () => {
+            fixture = await makeFixture();
+            await fixture.host.admin.createTenant(staff, { id: t, slug: `restore-roles-${t.slice(-8).toLowerCase()}`, name: 'Restore roles' });
+        });
+        afterAll(async () => fixture?.cleanup());
+        it('a dump seated in a role since made system-held is refused: nothing loaded, no scope created', async () => {
+            const s = await scope();
+            await fixture.host.admin.defineRole(staff, t, { key: 'member', permissions: [USE], source: 'vertical' });
+            await fixture.host.admin.assignRole(staff, seat('member', s));
+            const dump = await fixture.host.admin.exportScope(staff, t, s);
+            // The seat is taken back, so the directory may now make the role system-held.
+            await fixture.host.admin.unassignRole(staff, seat('member', s));
+            await fixture.host.admin.defineRole(staff, t, { key: 'member', permissions: [RUN], source: 'vertical', holder: 'system' });
+            const restored = await refusalOf(fixture.host.restoreScope(staff, t, s, dump));
+            expect(restored?.message).toBe(refusalFor('member'));
+            // The scope is as it was: the seat the dump holds did not come back.
+            expect((await fixture.roleState(t, s)).seated).toEqual([]);
+            const fresh = scopeId.parse(ulid());
+            const imported = await refusalOf(fixture.host.importScope(staff, { tenantId: t, scopeId: fresh, vertical: 'restore-roles' }, dump));
+            expect(imported?.message).toBe(refusalFor('member'));
+            expect((await fixture.host.admin.getScopeRecord(staff, t, fresh)) ?? null).toBeNull();
+        });
+        it('the refusal names the role key only: no principal, no tenant', async () => {
+            const s = await scope();
+            await fixture.host.admin.defineRole(staff, t, { key: 'named', permissions: [USE], source: 'vertical' });
+            await fixture.host.admin.assignRole(staff, seat('named', s));
+            const dump = await fixture.host.admin.exportScope(staff, t, s);
+            await fixture.host.admin.unassignRole(staff, seat('named', s));
+            await fixture.host.admin.defineRole(staff, t, { key: 'named', permissions: [RUN], source: 'vertical', holder: 'system' });
+            const message = (await refusalOf(fixture.host.restoreScope(staff, t, s, dump)))?.message ?? '';
+            expect(message).toBe(refusalFor('named'));
+            for (const id of [alice, t, s])
+                expect(message).not.toContain(id);
+        });
+        it('twin: the same change with no seat in the dump is admitted, by restore and by import', async () => {
+            const s = await scope();
+            await fixture.host.admin.defineRole(staff, t, { key: 'idle', permissions: [USE], source: 'vertical' });
+            const dump = await fixture.host.admin.exportScope(staff, t, s);
+            await fixture.host.admin.defineRole(staff, t, { key: 'idle', permissions: [RUN], source: 'vertical', holder: 'system' });
+            await fixture.host.restoreScope(staff, t, s, dump);
+            const fresh = scopeId.parse(ulid());
+            await fixture.host.importScope(staff, { tenantId: t, scopeId: fresh, vertical: 'restore-roles' }, dump);
+            expect((await fixture.host.admin.getScopeRecord(staff, t, fresh))?.status).toBe('active');
+        });
+        it('a person’s role the directory changed since is admitted, and the dump’s seat in it is kept', async () => {
+            const s = await scope();
+            await fixture.host.admin.defineRole(staff, t, { key: 'editor', permissions: [USE], source: 'vertical' });
+            await fixture.host.admin.assignRole(staff, seat('editor', s));
+            const dump = await fixture.host.admin.exportScope(staff, t, s);
+            await fixture.host.admin.unassignRole(staff, seat('editor', s));
+            await fixture.host.admin.defineRole(staff, t, { key: 'editor', permissions: [USE, 'rrs:edit'], source: 'vertical' });
+            await fixture.host.restoreScope(staff, t, s, dump);
+            expect((await fixture.roleState(t, s)).seated).toEqual(['editor']);
+        });
+        // Where the dump carries no role rows, this is a scope that cannot be restored from its own export (K-55).
+        it('a seat in a role stored system-held when the dump was taken: admitted where the dump stores the role, else judged a person’s', async () => {
+            const s = await scope();
+            await fixture.host.admin.defineRole(staff, t, { key: 'runner', permissions: [RUN], source: 'vertical', holder: 'system' });
+            // The platform's door seats a system-held role made only of keys this host does not reserve.
+            await fixture.host.admin.assignRole(staff, seat('runner', s));
+            const dump = await fixture.host.admin.exportScope(staff, t, s);
+            const restored = await refusalOf(fixture.host.restoreScope(staff, t, s, dump));
+            if (fixture.dumpCarriesRoles) {
+                expect(restored).toBeUndefined();
+            }
+            else {
+                // A dump with no role rows says nothing about the definition its seat was made under.
+                expect(restored?.message).toBe(undefinedInDump('runner'));
+            }
+            expect((await fixture.roleState(t, s)).seated).toEqual(['runner']);
+        });
+    });
+}
+//# sourceMappingURL=restore-role-suite.js.map

package/dist/restore-role-suite.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"restore-role-suite.js","sourceRoot":"","sources":["../src/restore-role-suite.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,QAAQ,CAAC;AACnE,OAAO,EAAE,eAAe,EAAE,WAAW,EAAE,OAAO,EAAE,QAAQ,EAAmD,MAAM,yBAAyB,CAAC;AAC3I,OAAO,EAAE,IAAI,EAAkB,MAAM,sBAAsB,CAAC;AAG5D;;;;;;;GAOG;AACH,MAAM,UAAU,wBAAwB,CACtC,WAAmB,EACnB,WAMC;IAED,QAAQ,CAAC,4EAA4E,WAAW,EAAE,EAAE,GAAG,EAAE;QACvG,IAAI,OAAgD,CAAC;QACrD,MAAM,KAAK,GAAG,eAAe,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC;QAC5C,MAAM,CAAC,GAAG,QAAQ,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC;QACjC,MAAM,KAAK,GAAG,WAAW,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC;QACxC,MAAM,GAAG,GAAG,SAA0B,CAAC;QACvC,MAAM,GAAG,GAAG,SAA0B,CAAC;QACvC,MAAM,eAAe,GAAG,CAAC,GAAW,EAAE,EAAE,CACtC,yCAAyC,GAAG,kFAAkF;YAC9H,uFAAuF,CAAC;QAC1F,0HAA0H;QAC1H,MAAM,UAAU,GAAG,CAAC,GAAW,EAAE,EAAE,CACjC,OAAO,CAAC,gBAAgB;YACtB,CAAC,CAAC,0BAA0B,GAAG,+GAA+G;YAC9I,CAAC,CAAC,eAAe,CAAC,GAAG,CAAC,CAAC;QAE3B,MAAM,KAAK,GAAG,KAAK,IAAI,EAAE;YACvB,MAAM,EAAE,GAAG,OAAO,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC;YACjC,MAAM,OAAO,CAAC,IAAI,CAAC,cAAc,CAAC,KAAK,EAAE,EAAE,QAAQ,EAAE,CAAC,EAAE,OAAO,EAAE,EAAE,EAAE,QAAQ,EAAE,eAAe,EAAE,CAAC,CAAC;YAClG,MAAM,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,aAAa,CAAC,KAAK,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;YACrD,OAAO,EAAE,CAAC;QACZ,CAAC,CAAC;QACF,MAAM,IAAI,GAAG,CAAC,OAAe,EAAE,EAAW,EAAE,EAAE,CAAC,CAAC,EAAE,WAAW,EAAE,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE,QAAQ,EAAE,CAAC,EAAE,OAAO,EAAE,EAAE,EAAE,EAAE,CAAC,CAAC;QACrH,MAAM,SAAS,GAAG,CAAC,CAAmB,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,SAAS,EAAE,CAAC,CAAU,EAAE,EAAE,CAAC,CAA8B,CAAC,CAAC;QAEnH,SAAS,CAAC,KAAK,IAAI,EAAE;YACnB,OAAO,GAAG,MAAM,WAAW,EAAE,CAAC;YAC9B,MAAM,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,KAAK,EAAE,EAAE,EAAE,EAAE,CAAC,EAAE,IAAI,EAAE,iBAAiB,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,EAAE,EAAE,IAAI,EAAE,eAAe,EAAE,CAAC,CAAC;QACrI,CAAC,CAAC,CAAC;QACH,QAAQ,CAAC,KAAK,IAAI,EAAE,CAAC,OAAO,EAAE,OAAO,EAAE,CAAC,CAAC;QAEzC,EAAE,CAAC,6FAA6F,EAAE,KAAK,IAAI,EAAE;YAC3G,MAAM,CAAC,GAAG,MAAM,KAAK,EAAE,CAAC;YACxB,MAAM,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,KAAK,EAAE,CAAC,EAAE,EAAE,GAAG,EAAE,QAAQ,EAAE,WAAW,EAAE,CAAC,GAAG,CAAC,EAAE,MAAM,EAAE,UAAU,EAAE,CAAC,CAAC;YACzG,MAAM,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,KAAK,EAAE,IAAI,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,CAAC;YAC9D,MAAM,IAAI,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC,KAAK,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC;YAC/D,8EAA8E;YAC9E,MAAM,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,KAAK,EAAE,IAAI,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,CAAC;YAChE,MAAM,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,KAAK,EAAE,CAAC,EAAE,EAAE,GAAG,EAAE,QAAQ,EAAE,WAAW,EAAE,CAAC,GAAG,CAAC,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC,CAAC;YAE3H,MAAM,QAAQ,GAAG,MAAM,SAAS,CAAC,OAAO,CAAC,IAAI,CAAC,YAAY,CAAC,KAAK,EAAE,CAAC,EAAE,CAAC,EAAE,IAAI,CAAC,CAAC,CAAC;YAC/E,MAAM,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,CAAC;YACrD,qEAAqE;YACrE,MAAM,CAAC,CAAC,MAAM,OAAO,CAAC,SAAS,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;YAE3D,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC;YACpC,MAAM,QAAQ,GAAG,MAAM,SAAS,CAAC,OAAO,CAAC,IAAI,CAAC,WAAW,CAAC,KAAK,EAAE,EAAE,QAAQ,EAAE,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,eAAe,EAAE,EAAE,IAAI,CAAC,CAAC,CAAC;YACpI,MAAM,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,CAAC;YACrD,MAAM,CAAC,CAAC,MAAM,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,cAAc,CAAC,KAAK,EAAE,CAAC,EAAE,KAAK,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,QAAQ,EAAE,CAAC;QACxF,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,8DAA8D,EAAE,KAAK,IAAI,EAAE;YAC5E,MAAM,CAAC,GAAG,MAAM,KAAK,EAAE,CAAC;YACxB,MAAM,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,KAAK,EAAE,CAAC,EAAE,EAAE,GAAG,EAAE,OAAO,EAAE,WAAW,EAAE,CAAC,GAAG,CAAC,EAAE,MAAM,EAAE,UAAU,EAAE,CAAC,CAAC;YACxG,MAAM,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,KAAK,EAAE,IAAI,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,CAAC;YAC7D,MAAM,IAAI,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC,KAAK,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC;YAC/D,MAAM,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,KAAK,EAAE,IAAI,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,CAAC;YAC/D,MAAM,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,KAAK,EAAE,CAAC,EAAE,EAAE,GAAG,EAAE,OAAO,EAAE,WAAW,EAAE,CAAC,GAAG,CAAC,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC,CAAC;YAC1H,MAAM,OAAO,GAAG,CAAC,MAAM,SAAS,CAAC,OAAO,CAAC,IAAI,CAAC,YAAY,CAAC,KAAK,EAAE,CAAC,EAAE,CAAC,EAAE,IAAI,CAAC,CAAC,CAAC,EAAE,OAAO,IAAI,EAAE,CAAC;YAC/F,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC,CAAC;YAC1C,KAAK,MAAM,EAAE,IAAI,CAAC,KAAK,EAAE,CAAC,EAAE,CAAC,CAAC;gBAAE,MAAM,CAAC,OAAO,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC;QACpE,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,sFAAsF,EAAE,KAAK,IAAI,EAAE;YACpG,MAAM,CAAC,GAAG,MAAM,KAAK,EAAE,CAAC;YACxB,MAAM,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,KAAK,EAAE,CAAC,EAAE,EAAE,GAAG,EAAE,MAAM,EAAE,WAAW,EAAE,CAAC,GAAG,CAAC,EAAE,MAAM,EAAE,UAAU,EAAE,CAAC,CAAC;YACvG,MAAM,IAAI,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC,KAAK,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC;YAC/D,MAAM,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,KAAK,EAAE,CAAC,EAAE,EAAE,GAAG,EAAE,MAAM,EAAE,WAAW,EAAE,CAAC,GAAG,CAAC,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC,CAAC;YACzH,MAAM,OAAO,CAAC,IAAI,CAAC,YAAY,CAAC,KAAK,EAAE,CAAC,EAAE,CAAC,EAAE,IAAI,CAAC,CAAC;YACnD,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC;YACpC,MAAM,OAAO,CAAC,IAAI,CAAC,WAAW,CAAC,KAAK,EAAE,EAAE,QAAQ,EAAE,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,eAAe,EAAE,EAAE,IAAI,CAAC,CAAC;YACxG,MAAM,CAAC,CAAC,MAAM,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,cAAc,CAAC,KAAK,EAAE,CAAC,EAAE,KAAK,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QAC5F,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,4FAA4F,EAAE,KAAK,IAAI,EAAE;YAC1G,MAAM,CAAC,GAAG,MAAM,KAAK,EAAE,CAAC;YACxB,MAAM,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,KAAK,EAAE,CAAC,EAAE,EAAE,GAAG,EAAE,QAAQ,EAAE,WAAW,EAAE,CAAC,GAAG,CAAC,EAAE,MAAM,EAAE,UAAU,EAAE,CAAC,CAAC;YACzG,MAAM,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,KAAK,EAAE,IAAI,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,CAAC;YAC9D,MAAM,IAAI,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC,KAAK,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC;YAC/D,MAAM,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,KAAK,EAAE,IAAI,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,CAAC;YAChE,MAAM,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,KAAK,EAAE,CAAC,EAAE,EAAE,GAAG,EAAE,QAAQ,EAAE,WAAW,EAAE,CAAC,GAAG,EAAE,UAA2B,CAAC,EAAE,MAAM,EAAE,UAAU,EAAE,CAAC,CAAC;YACtI,MAAM,OAAO,CAAC,IAAI,CAAC,YAAY,CAAC,KAAK,EAAE,CAAC,EAAE,CAAC,EAAE,IAAI,CAAC,CAAC;YACnD,MAAM,CAAC,CAAC,MAAM,OAAO,CAAC,SAAS,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC;QACrE,CAAC,CAAC,CAAC;QAEH,2GAA2G;QAC3G,EAAE,CAAC,8HAA8H,EAAE,KAAK,IAAI,EAAE;YAC5I,MAAM,CAAC,GAAG,MAAM,KAAK,EAAE,CAAC;YACxB,MAAM,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,KAAK,EAAE,CAAC,EAAE,EAAE,GAAG,EAAE,QAAQ,EAAE,WAAW,EAAE,CAAC,GAAG,CAAC,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC,CAAC;YAC3H,6FAA6F;YAC7F,MAAM,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,KAAK,EAAE,IAAI,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,CAAC;YAC9D,MAAM,IAAI,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC,KAAK,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC;YAC/D,MAAM,QAAQ,GAAG,MAAM,SAAS,CAAC,OAAO,CAAC,IAAI,CAAC,YAAY,CAAC,KAAK,EAAE,CAAC,EAAE,CAAC,EAAE,IAAI,CAAC,CAAC,CAAC;YAC/E,IAAI,OAAO,CAAC,gBAAgB,EAAE,CAAC;gBAC7B,MAAM,CAAC,QAAQ,CAAC,CAAC,aAAa,EAAE,CAAC;YACnC,CAAC;iBAAM,CAAC;gBACN,sFAAsF;gBACtF,MAAM,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC,eAAe,CAAC,QAAQ,CAAC,CAAC,CAAC;YAC5D,CAAC;YACD,MAAM,CAAC,CAAC,MAAM,OAAO,CAAC,SAAS,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC;QACrE,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;AACL,CAAC"}

package/dist/scope-host-suite.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"scope-host-suite.d.ts","sourceRoot":"","sources":["../src/scope-host-suite.ts"],"names":[],"mappings":"AAEA,OAAO,EAuBL,KAAK,SAAS,EAuBf,MAAM,yBAAyB,CAAC;AACjC,OAAO,EAoBL,KAAK,SAAS,EACf,MAAM,sBAAsB,CAAC;AAe9B,MAAM,WAAW,gBAAgB;IAC/B,IAAI,EAAE,SAAS,CAAC;IAChB;;;;;OAKG;IACH,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,OAAO,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;CAC1B;AAED,oGAAoG;AACpG,wBAAgB,+BAA+B,CAC7C,WAAW,EAAE,MAAM,EACnB,WAAW,EAAE,MAAM,OAAO,CAAC,gBAAgB,GAAG;IAC5C,iBAAiB,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC;CAChF,CAAC,GACD,IAAI,CA+GN;AAuCD;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,eAAO,MAAM,aAAa,MACrB,OAAO,CAAC,OAAO,CAAC,QACb,SAAS,YACL,MAAM,KACf,OAAO,CAAC,IAAI,CAOd,CAAC;AAEF,iFAAiF;AACjF,MAAM,WAAW,qBAAqB;IACpC;;;;;;OAMG;IACH,2BAA2B,CAAC,EAAE,OAAO,CAAC;CACvC;AAED;;;;;GAKG;AACH,wBAAgB,sBAAsB,CACpC,WAAW,EAAE,MAAM,EACnB,WAAW,EAAE,MAAM,OAAO,CAAC,gBAAgB,CAAC,EAC5C,IAAI,GAAE,qBAA0B,GAC/B,IAAI,CAyjYN"}
+{"version":3,"file":"scope-host-suite.d.ts","sourceRoot":"","sources":["../src/scope-host-suite.ts"],"names":[],"mappings":"AAEA,OAAO,EAuBL,KAAK,SAAS,EAuBf,MAAM,yBAAyB,CAAC;AACjC,OAAO,EAqBL,KAAK,SAAS,EACf,MAAM,sBAAsB,CAAC;AAe9B,MAAM,WAAW,gBAAgB;IAC/B,IAAI,EAAE,SAAS,CAAC;IAChB;;;;;OAKG;IACH,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,OAAO,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;CAC1B;AAED,oGAAoG;AACpG,wBAAgB,+BAA+B,CAC7C,WAAW,EAAE,MAAM,EACnB,WAAW,EAAE,MAAM,OAAO,CAAC,gBAAgB,GAAG;IAC5C,iBAAiB,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC;CAChF,CAAC,GACD,IAAI,CA+GN;AAuCD;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,eAAO,MAAM,aAAa,MACrB,OAAO,CAAC,OAAO,CAAC,QACb,SAAS,YACL,MAAM,KACf,OAAO,CAAC,IAAI,CAOd,CAAC;AAEF,iFAAiF;AACjF,MAAM,WAAW,qBAAqB;IACpC;;;;;;OAMG;IACH,2BAA2B,CAAC,EAAE,OAAO,CAAC;CACvC;AAED;;;;;GAKG;AACH,wBAAgB,sBAAsB,CACpC,WAAW,EAAE,MAAM,EACnB,WAAW,EAAE,MAAM,OAAO,CAAC,gBAAgB,CAAC,EAC5C,IAAI,GAAE,qBAA0B,GAC/B,IAAI,CAsuYN"}

package/dist/scope-host-suite.js

@@ -1,7 +1,7 @@
 import { describe, it, expect, beforeAll, afterAll } from 'vitest';
 import { connectorCalls, connectorTestFetch, resetConnectorCalls } from './connector-fixture.js';
 import { connectionId, dataSubjectId, domainEvent, errorCodeOf, moduleId, SCOPE_GATE_REASONS, eventId, instant, moduleManifest, orgId, AUTO_ADMISSION_NOTE, permissionKey, platformActorId, platformRequestId, principalId, scopeId, tenantId, SCOPE_QUERY_ROW_MAX, LIST_PAGE_MAX, KERNEL_AUTHORED_EVENT_TYPES, EMAIL_SENT, PLATFORM_REQUEST_ENTITY_TYPE, SEND_EMAIL_KIND, isUndecodablePlatformRequest, platformRequestEntry, SWEEP_RUNS_KIND, SCOPE_TABLE_PAGE_MAX, unheldMigrationDigest, withUpstreamReference, } from '@substrat-run/contracts';
-import { INERT_SCOPE_REASON, BACKFILL_MOVE_ID, SCOPE_COPY_LEASE_MS, isSearchIndexTable, platformIntentFailureMessage, withheldOpsFailure, REDACTED_DELIVERY_NOTE, REDACTED_FAILURE_NOTE, REDACTED_INTENT_MARKER, runPlatformSweep, startPlatformSweeper, promoteReviewDigest, promoteReviewRefusalOf, rebindReviewRefusalOf, createUlid, ulid, WIRE_AUTH_FILTER_TEXT_MAX, } from '@substrat-run/kernel';
+import { INERT_SCOPE_REASON, BACKFILL_MOVE_ID, SCOPE_COPY_LEASE_MS, isSearchIndexTable, platformIntentFailureMessage, withheldOpsFailure, withheldStaffFailure, REDACTED_DELIVERY_NOTE, REDACTED_FAILURE_NOTE, REDACTED_INTENT_MARKER, runPlatformSweep, startPlatformSweeper, promoteReviewDigest, promoteReviewRefusalOf, rebindReviewRefusalOf, createUlid, ulid, WIRE_AUTH_FILTER_TEXT_MAX, } from '@substrat-run/kernel';
 import { billedMod, contractTestBareOps, contractTestInitialModules, gateModManifest, lateMod, TEST_LIFECYCLE, testModManifest, victimModManifest, } from './modules.js';
 import { testOperations } from './test-operations.js';
 import { derivedDigestOf, heldMigrations } from './held-migrations.js';
@@ -2368,6 +2368,21 @@ export function scopeHostContractSuite(adapterName, makeFixture, opts = {}) {
                 // The spine: present and flagged system, so the UI can group it apart.
                 expect(byName.get('_substrat_outbox')?.system).toBe(true);
             });
+            it('counts what is in force apart from what a table keeps as tombstones (#2531)', async () => {
+                const key = `introspect-${ulid().toLowerCase()}`;
+                await host.admin.defineRole(staff, t1, { key, permissions: [permissionKey.parse('thing:read')], source: 'vertical' });
+                const seat = { principalId: principalId.parse(ulid()), roleKey: key, node: { tenantId: t1, scopeId: s1 } };
+                const tuples = async () => (await host.admin.listScopeTables(staff, t1, s1)).find((t) => t.name === '_substrat_tuples');
+                const before = await tuples();
+                expect(before.liveRowCount).toBeDefined();
+                await host.admin.assignRole(staff, seat);
+                expect(await tuples()).toMatchObject({ rowCount: before.rowCount + 1, liveRowCount: before.liveRowCount + 1 });
+                // A revoke tombstones the seat: the row is kept, and it is no longer in force.
+                await host.admin.unassignRole(staff, seat);
+                expect(await tuples()).toMatchObject({ rowCount: before.rowCount + 1, liveRowCount: before.liveRowCount });
+                // A table that keeps no tombstones answers no live count.
+                expect((await host.admin.listScopeTables(staff, t1, s1)).find((t) => t.name === '_substrat_outbox')).not.toHaveProperty('liveRowCount');
+            });
             it('reads a bounded page of a table', async () => {
                 const stub = await host.getScope(alice, t1, s1);
                 await stub.invoke('test/write-marker', { v: 'page-row' });
@@ -3126,6 +3141,29 @@ export function scopeHostContractSuite(adapterName, makeFixture, opts = {}) {
                         expect(await rowsOf(ops.elsewhere)).toEqual(before.elsewhere);
                         await host.settlePlatformRequest(t1, s1, unlinked, { status: 'done' });
                     });
+                    it("#2556: staff's row alone, for a withheld pass that left a tombstoned intent pending, is redacted too", async () => {
+                        const kind = `connector:erasure-${ulid()}`;
+                        const erased = dataSubjectId.parse(ulid());
+                        const spared = dataSubjectId.parse(ulid());
+                        const linked = await routeIntent(kind, erased, 'Anna Ek');
+                        const unlinked = await routeIntent(kind, spared, 'Bo Lund');
+                        // As the drain files it (`withheldStaffFailure`): no tenant, the drained scope, marker first.
+                        const transient = (operation, id, error) => host.admin.recordOpsFailure({
+                            actor: staff,
+                            ...withheldStaffFailure({ operation, stage: 'transient', scopeId: s1 }, `${error}; reference = up${ulid().toLowerCase()}`, ulid(), platformIntentFailureMessage(id, 'pending (the call did not complete at its deployment): ')),
+                        });
+                        const ops = { linked: op('transient-linked'), unlinked: op('transient-unlinked') };
+                        await transient(ops.linked, linked, 'HTTP 500: Anna Ek is not on file');
+                        await transient(ops.unlinked, unlinked, 'HTTP 500: Bo Lund is not on file');
+                        const rowsOf = async (operation) => (await host.admin.listOpsFailures(staff, { operation })).map((r) => [r.tenantId, r.message]);
+                        const before = await rowsOf(ops.unlinked);
+                        expect((await rowsOf(ops.linked))[0][1]).toMatch(/^\[upstream reference = up[0-9a-z]+\] platform intent .* pending \(the call did not complete at its deployment\): HTTP 500: /);
+                        await host.admin.shredSubject(staff, t1, s1, erased);
+                        expect(await rowsOf(ops.linked)).toEqual([[null, REDACTED_FAILURE_NOTE]]);
+                        expect((await issueOf(ops.linked)).lastMessage).toBe(REDACTED_FAILURE_NOTE);
+                        expect(await rowsOf(ops.unlinked)).toEqual(before);
+                        await host.settlePlatformRequest(t1, s1, unlinked, { status: 'done' });
+                    });
                     /** Whose an exemplar is, as the directory stores it — not on the issue read shape. */
                     const exemplarOwnerOf = async (operation) => {
                         const dump = await host.admin.exportDirectory(staff);
@@ -7440,7 +7478,8 @@ export function scopeHostContractSuite(adapterName, makeFixture, opts = {}) {
             await host.admin.setVerticalListed(staff, slug, true);
             await host.admin.promoteVersion(staff, slug, 'prod', first);
             expect((await host.admin.getScopeRecord(staff, t2, install))?.verticalVersionId).toBe(next);
-        });
+            // Seven scopes, a snapshot and three promotions: about 3 s alone, past the 5 s default under CI load (#2576).
+        }, 30_000);
         it('publish refuses an auto-admitted prod version until a staff admit vouches for it', async () => {
             // Listing is the moment OTHER tenants start trusting this code, so the version
             // they would install needs a recorded human decision — the auto-admission note
@@ -9709,8 +9748,22 @@ export function scopeHostContractSuite(adapterName, makeFixture, opts = {}) {
             const at = (time) => `2026-10-24T${time}.000Z`;
             /** The whole fleet, one full page: every read names its reach and its limit. */
             const fleet = { reach: { fleet: true }, limit: LIST_PAGE_MAX };
-            /** Record `rec` for the script `<vertical>-<script>`. */
-            const put = (vertical, script, versionId, rec, time) => host.admin.recordWireAuth(staff, { deploymentRef: `${vertical}-${script}`, verticalSlug: vertical, versionId, record: rec, recordedAt: at(time) });
+            /** The verticals this block registered: a record is written only beside its vertical's registration. */
+            const registered = new Set();
+            const register = async (slug, ownerTenant) => {
+                await host.admin.registerVertical(staff, { slug, name: slug, source: 'cli', ...(ownerTenant ? { ownerTenant } : {}) });
+                registered.add(slug);
+            };
+            const forget = async (slug) => {
+                await host.admin.deleteVertical(staff, slug);
+                registered.delete(slug);
+            };
+            /** Record `rec` for the script `<vertical>-<script>`, registering the vertical (platform-owned) first when no test did. */
+            const put = async (vertical, script, versionId, rec, time) => {
+                if (!registered.has(vertical))
+                    await register(vertical);
+                await host.admin.recordWireAuth(staff, { deploymentRef: `${vertical}-${script}`, verticalSlug: vertical, versionId, record: rec, recordedAt: at(time) });
+            };
             it('keeps one record per deployment, the last upload’s, and lists one vertical’s by deployment', async () => {
                 const [a, b] = [slugOf('wire-a'), slugOf('wire-b')];
                 await put(a, 'serving', 'v1', record({ audience: `${a}-serving` }), '10:00:00');
@@ -9825,26 +9878,25 @@ export function scopeHostContractSuite(adapterName, makeFixture, opts = {}) {
                 const [owner, other] = [tenantId.parse(ulid()), tenantId.parse(ulid())];
                 await host.admin.createTenant(staff, { id: owner, slug: `wire-own-${owner.slice(-6).toLowerCase()}`, name: 'Wire Owner' });
                 await host.admin.createTenant(staff, { id: other, slug: `wire-oth-${other.slice(-6).toLowerCase()}`, name: 'Wire Other' });
-                const [mine, theirs, platform, unregistered] = [slugOf('wire-mine'), slugOf('wire-theirs'), slugOf('wire-plat'), slugOf('wire-unreg')];
-                await host.admin.registerVertical(staff, { slug: mine, name: 'Mine', source: 'cli', ownerTenant: owner });
-                await host.admin.registerVertical(staff, { slug: theirs, name: 'Theirs', source: 'cli', ownerTenant: other });
-                await host.admin.registerVertical(staff, { slug: platform, name: 'Platform', source: 'cli' });
-                for (const [i, slug] of [mine, theirs, platform, unregistered].entries()) {
+                const [mine, theirs, platform] = [slugOf('wire-mine'), slugOf('wire-theirs'), slugOf('wire-plat')];
+                await register(mine, owner);
+                await register(theirs, other);
+                await register(platform);
+                for (const [i, slug] of [mine, theirs, platform].entries()) {
                     await put(slug, 'serving', null, record(), `16:00:0${i}`);
                     await put(slug, 'archive', 'v1', record(), `16:00:1${i}`);
                 }
                 const refs = async (reach, verticalSlug) => (await host.admin.listWireAuth(staff, { reach, limit: LIST_PAGE_MAX, ...(verticalSlug ? { verticalSlug } : {}) }))
                     .map((r) => r.deploymentRef)
-                    .filter((ref) => [mine, theirs, platform, unregistered].some((slug) => ref.startsWith(`${slug}-`)));
+                    .filter((ref) => [mine, theirs, platform].some((slug) => ref.startsWith(`${slug}-`)));
                 expect(await refs({ tenantId: owner })).toEqual([`${mine}-archive`, `${mine}-serving`]);
                 expect(await refs({ tenantId: other })).toEqual([`${theirs}-archive`, `${theirs}-serving`]);
                 // Naming another tenant's vertical inside one tenant's reach reaches nothing, not that vertical.
                 expect(await refs({ tenantId: owner }, theirs)).toEqual([]);
                 expect(await refs({ tenantId: owner }, mine)).toEqual([`${mine}-archive`, `${mine}-serving`]);
-                // A tenant that owns nothing reaches nothing; a vertical no tenant owns, or the registry does not
-                // know, is reached by the fleet alone.
+                // A tenant that owns nothing reaches nothing; a vertical no tenant owns is reached by the fleet alone.
                 expect(await refs({ tenantId: tenantId.parse(ulid()) })).toEqual([]);
-                for (const slug of [mine, theirs, platform, unregistered]) {
+                for (const slug of [mine, theirs, platform]) {
                     expect(await refs({ fleet: true }, slug)).toEqual([`${slug}-archive`, `${slug}-serving`]);
                 }
                 // A page inside the reach pages over the tenant's records only.
@@ -9891,7 +9943,7 @@ export function scopeHostContractSuite(adapterName, makeFixture, opts = {}) {
                 const owner = tenantId.parse(ulid());
                 await host.admin.createTenant(staff, { id: owner, slug: `wire-log-${owner.slice(-6).toLowerCase()}`, name: 'Wire Log' });
                 const mine = slugOf('wire-logged');
-                await host.admin.registerVertical(staff, { slug: mine, name: 'Logged', source: 'cli', ownerTenant: owner });
+                await register(mine, owner);
                 await put(mine, 'serving', null, record(), '17:00:00');
                 // The reach given last, as a caller may spell it: the log still names it first.
                 await host.admin.listWireAuth(staff, { limit: 5, verticalSlug: mine, reach: { tenantId: owner } });
@@ -9919,30 +9971,119 @@ export function scopeHostContractSuite(adapterName, makeFixture, opts = {}) {
                 await host.admin.createTenant(staff, { id: second, slug: `wire-snd-${second.slice(-6).toLowerCase()}`, name: 'Wire Second' });
                 const slug = slugOf('wire-owned');
                 const refsOf = async (owner) => (await host.admin.listWireAuth(staff, { reach: { tenantId: owner }, limit: LIST_PAGE_MAX, verticalSlug: slug })).map((r) => r.deploymentRef);
-                // A record written while no tenant owned the slug is read by whoever owns it when the read runs.
+                // The owner reads what was recorded while it held the slug.
+                await register(slug, first);
                 await put(slug, 'archive', 'v0', record(), '18:00:00');
-                expect(await refsOf(first)).toEqual([]);
-                await host.admin.registerVertical(staff, { slug, name: 'Owned', source: 'cli', ownerTenant: first });
                 expect(await refsOf(first)).toEqual([`${slug}-archive`]);
                 await put(slug, 'serving', 'v1', record(), '18:00:01');
                 expect(await refsOf(first)).toEqual([`${slug}-archive`, `${slug}-serving`]);
                 // An owner changes by deleting the vertical, which takes its records, and registering it again:
                 // the tenant that held it reads nothing after, the new owner reads only what was recorded since.
-                await host.admin.deleteVertical(staff, slug);
-                await host.admin.registerVertical(staff, { slug, name: 'Owned', source: 'cli', ownerTenant: second });
+                await forget(slug);
+                await register(slug, second);
                 expect(await refsOf(first)).toEqual([]);
                 expect(await refsOf(second)).toEqual([]);
                 await put(slug, 'serving', 'v2', record(), '18:00:02');
                 expect(await refsOf(first)).toEqual([]);
                 expect(await refsOf(second)).toEqual([`${slug}-serving`]);
             });
+            it('writes no record, and no admin row, for a vertical the registry does not hold', async () => {
+                const never = slugOf('wire-unreg');
+                const gone = slugOf('wire-gone');
+                await put(gone, 'serving', 'v1', record(), '20:00:00');
+                await forget(gone);
+                for (const slug of [never, gone]) {
+                    await expectRefusal(host.admin.recordWireAuth(staff, { deploymentRef: `${slug}-serving`, verticalSlug: slug, versionId: 'v2', record: record(), recordedAt: at('20:00:01') }), 'not_found');
+                    expect(await host.admin.listWireAuth(staff, { ...fleet, verticalSlug: slug })).toEqual([]);
+                }
+                const rows = (await host.admin.auditLog(staff, { action: 'recordWireAuth' })).filter((r) => r.vertical === never || r.vertical === gone);
+                // Only the one write made while `gone` was registered.
+                expect(rows.map((r) => r.after.versionId)).toEqual(['v1']);
+                // Registered again, the slug's records start empty: nothing written while unregistered survives.
+                await register(gone);
+                expect(await host.admin.listWireAuth(staff, { ...fleet, verticalSlug: gone })).toEqual([]);
+            });
+            it('keeps a walk’s hold on a record, by binding name, and refuses a hold it cannot read', async () => {
+                const a = slugOf('wire-hold');
+                const hold = { reason: 'verify', bindings: ['SCOPE', 'SUBSTRAT_WIRE_STATE'], at: at('22:00:00') };
+                await put(a, 'archive', 'v1', { ...record(), walkHold: hold }, '22:00:00');
+                expect((await host.admin.listWireAuth(staff, { ...fleet, verticalSlug: a }))[0].record.walkHold).toEqual(hold);
+                // The next upload of the script writes a record without it.
+                await put(a, 'archive', 'v1', record(), '22:00:01');
+                expect((await host.admin.listWireAuth(staff, { ...fleet, verticalSlug: a }))[0].record.walkHold).toBeUndefined();
+                const good = { deploymentRef: `${a}-archive`, verticalSlug: a, versionId: 'v1', recordedAt: at('22:00:02') };
+                for (const walkHold of [
+                    { ...hold, reason: 'because' },
+                    { ...hold, at: 'yesterday' },
+                    { ...hold, bindings: [''] },
+                    { ...hold, bindings: Array.from({ length: 65 }, (_, i) => `B${i}`) },
+                    { ...hold, value: 'not a field' },
+                    // The count of names past the cap is a positive whole number when given.
+                    { ...hold, more: 0 },
+                    { ...hold, more: 1.5 },
+                ]) {
+                    await expectRefusal(host.admin.recordWireAuth(staff, { ...good, record: { ...record(), walkHold } }), 'validation_failed');
+                }
+                expect((await host.admin.listWireAuth(staff, { ...fleet, verticalSlug: a }))[0].record.walkHold).toBeUndefined();
+                // A hold of more names than it keeps: the first ones, and how many more.
+                const many = { ...hold, bindings: Array.from({ length: 64 }, (_, i) => `B${i}`), more: 6 };
+                await put(a, 'archive', 'v1', { ...record(), walkHold: many }, '22:00:02');
+                expect((await host.admin.listWireAuth(staff, { ...fleet, verticalSlug: a }))[0].record.walkHold).toEqual(many);
+                await put(a, 'archive', 'v1', record(), '22:00:02');
+                // `unverified`, the walk's record of a script it could not confirm: lists claimed by none, and
+                // only beside a hold. Without the hold, or beside lists, it is refused.
+                const unverified = withheld('unverified');
+                await expectRefusal(host.admin.recordWireAuth(staff, { ...good, record: unverified }), 'validation_failed');
+                await expectRefusal(host.admin.recordWireAuth(staff, { ...good, record: { ...record(), withheld: 'unverified', walkHold: hold } }), 'validation_failed');
+                await put(a, 'archive', 'v1', { ...unverified, walkHold: hold }, '22:00:03');
+                expect((await host.admin.listWireAuth(staff, { ...fleet, verticalSlug: a }))[0].record).toMatchObject({ withheld: 'unverified', state: 'legacy-only', routerKids: [], walkHold: hold });
+            });
+            it('audits a pass of the fleet walk as walkWireAuth, naming scripts and reasons, never a value', async () => {
+                const entry = {
+                    apply: true,
+                    confirm: false,
+                    from: null,
+                    next: 'acme/crm|01HZZZZZZZZZZZZZZZZZZZZZZZ',
+                    walked: 3,
+                    updated: ['acme-crm'],
+                    held: ['acme-crm-01hzzzzzzzzzzzzzzzzzzzzzzz'],
+                    released: [],
+                    skipped: [{ deploymentRef: 'acme-crm-01hyyyyyyyyyyyyyyyyyyyyyyy', reason: 'no-entry' }],
+                    failed: [{ deploymentRef: 'acme-crm-01hzzzzzzzzzzzzzzzzzzzzzzz', reason: 'verify' }],
+                };
+                await host.admin.recordWireWalk(staff, entry);
+                const rows = (await host.admin.auditLog(staff, { action: 'walkWireAuth' })).filter((r) => r.after.next === entry.next);
+                expect(rows).toHaveLength(1);
+                expect(rows[0].actor).toBe(staff);
+                expect(rows[0].after).toEqual(entry);
+            });
+            it('restores the owners and the records together, from one dump', async () => {
+                const [first, second] = [tenantId.parse(ulid()), tenantId.parse(ulid())];
+                await host.admin.createTenant(staff, { id: first, slug: `wire-rst-${first.slice(-6).toLowerCase()}`, name: 'Wire Restore' });
+                const slug = slugOf('wire-restore');
+                await register(slug, first);
+                await put(slug, 'serving', 'v1', record(), '21:00:00');
+                const backup = await host.admin.exportDirectory(staff);
+                // Diverge past the copy: the vertical deleted (its records with it) and taken by another tenant.
+                await host.admin.createTenant(staff, { id: second, slug: `wire-rs2-${second.slice(-6).toLowerCase()}`, name: 'Wire Restore 2' });
+                await forget(slug);
+                await register(slug, second);
+                await put(slug, 'archive', 'v2', record(), '21:00:01');
+                await host.admin.restoreDirectory(staff, backup);
+                registered.add(slug);
+                // The copy's owner reads the copy's records, and nothing of the divergence came back with it.
+                const reads = async (reach) => (await host.admin.listWireAuth(staff, { reach, limit: LIST_PAGE_MAX, verticalSlug: slug })).map((r) => [r.deploymentRef, r.versionId]);
+                expect(await reads({ tenantId: first })).toEqual([[`${slug}-serving`, 'v1']]);
+                expect(await reads({ tenantId: second })).toEqual([]);
+                expect(await reads({ fleet: true })).toEqual([[`${slug}-serving`, 'v1']]);
+            });
             it('forgets a vertical’s records with the vertical', async () => {
                 const a = slugOf('wire-del');
-                await host.admin.registerVertical(staff, { slug: a, name: 'Wire record', source: 'cli' });
+                await register(a);
                 await put(a, 'serving', null, record(), '13:00:00');
                 const kept = slugOf('wire-kept');
                 await put(kept, 'serving', null, record(), '13:00:01');
-                await host.admin.deleteVertical(staff, a);
+                await forget(a);
                 expect(await host.admin.listWireAuth(staff, { ...fleet, verticalSlug: a })).toEqual([]);
                 // Another vertical's record is not touched.
                 expect(await host.admin.listWireAuth(staff, { ...fleet, verticalSlug: kept })).toHaveLength(1);
@@ -10638,6 +10779,16 @@ export function scopeHostContractSuite(adapterName, makeFixture, opts = {}) {
                 name: 'Impostor Co',
             }), 'conflict', /already taken/);
         });
+        it('words the tenant slug refusal without the tenant that holds the slug (#2556)', async () => {
+            const holder = tenantId.parse(ulid());
+            const slug = `held-${holder.toLowerCase()}`;
+            await host.admin.createTenant(staff, { id: holder, slug, name: 'Holder Co' });
+            const taken = await host.admin
+                .createTenant(staff, { id: tenantId.parse(ulid()), slug, name: 'Impostor Co' })
+                .then(() => null, (e) => e);
+            expect(taken?.message).toBe(`tenant slug '${slug}' is already taken (slugs are unique)`);
+            expect(taken?.message).not.toContain(holder);
+        });
         it('enumerates the scopes under a tenant, and filters by status (§4.5)', async () => {
             const all = await host.admin.listScopes(staff, { tenantId: t5 });
             expect(all.length).toBeGreaterThanOrEqual(2);