@substrat-run/contract-tests 0.161.0 → 0.163.0

package/dist/directory-audit-suite.d.ts

@@ -6,6 +6,8 @@ import { type ScopeHost } from '@substrat-run/kernel';
 export interface DirectoryAuditFixture {
     host: ScopeHost;
     directorySql(sql: string): Promise<void>;
+    /** #2526: one read of the directory, for state no HostAdmin read answers (a tenant tuple). */
+    directoryRows(sql: string): Promise<unknown[]>;
     /**
      * #2528: arm one statement to run against the directory, committed on its own, immediately
      * before the host's next audited directory write begins its unit — the write another caller

package/dist/directory-audit-suite.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"directory-audit-suite.d.ts","sourceRoot":"","sources":["../src/directory-audit-suite.ts"],"names":[],"mappings":"AAEA,OAAO,EAAQ,KAAK,SAAS,EAAE,MAAM,sBAAsB,CAAC;AAG5D;;;GAGG;AACH,MAAM,WAAW,qBAAqB;IACpC,IAAI,EAAE,SAAS,CAAC;IAChB,YAAY,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACzC;;;;OAIG;IACH,UAAU,CAAC,GAAG,EAAE,MAAM,GAAG,IAAI,CAAC;IAC9B,OAAO,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;CAC1B;AAgRD;;;;GAIG;AACH,wBAAgB,mCAAmC,CAAC,WAAW,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,OAAO,CAAC,qBAAqB,CAAC,GAAG,IAAI,CAkUhI"}
+{"version":3,"file":"directory-audit-suite.d.ts","sourceRoot":"","sources":["../src/directory-audit-suite.ts"],"names":[],"mappings":"AAKA,OAAO,EAAQ,KAAK,SAAS,EAAE,MAAM,sBAAsB,CAAC;AAG5D;;;GAGG;AACH,MAAM,WAAW,qBAAqB;IACpC,IAAI,EAAE,SAAS,CAAC;IAChB,YAAY,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACzC,8FAA8F;IAC9F,aAAa,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,EAAE,CAAC,CAAC;IAC/C;;;;OAIG;IACH,UAAU,CAAC,GAAG,EAAE,MAAM,GAAG,IAAI,CAAC;IAC9B,OAAO,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;CAC1B;AAwhBD;;;;GAIG;AACH,wBAAgB,mCAAmC,CAAC,WAAW,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,OAAO,CAAC,qBAAqB,CAAC,GAAG,IAAI,CAkhBhI"}

package/dist/directory-audit-suite.js

@@ -1,5 +1,5 @@
 import { describe, it, expect } from 'vitest';
-import { errorCodeOf, platformActorId, scopeId, tenantId } from '@substrat-run/contracts';
+import { connectionId, errorCodeOf, moduleId, orgId, permissionKey, platformActorId, principalId, scopeId, tenantId, } from '@substrat-run/contracts';
 import { ulid } from '@substrat-run/kernel';
 import { heldMigrations } from './held-migrations.js';
 /** A trigger refusing one admin action's row, or one kind of write to a directory table. */
@@ -30,6 +30,43 @@ const publish = async (host, staff, slug) => {
 const verticalOf = async (host, staff, slug) => (await host.admin.listVerticals(staff)).find((v) => v.slug === slug);
 /** #2501: how many of the slug's ownership periods are open (at most one). */
 const openPeriodsOf = async (host, staff, slug) => (await host.admin.listVerticalOwners(staff, slug)).filter((p) => p.until === null).length;
+const AUDIT_READ = permissionKey.parse('audit:read');
+/** #2526: how many live tenant tuples hold `relation` for `subject`. */
+const tenantTuples = async (f, t, subject, relation) => (await f.directoryRows(`SELECT 1 FROM _substrat_tenant_tuples WHERE tenant_id = '${t}' AND subject = '${subject}'
+     AND relation = '${relation}' AND revoked_at IS NULL`)).length;
+const newOrg = async (host, staff, t) => {
+    const id = orgId.parse(ulid());
+    await host.admin.createOrg(staff, { id, tenantId: t, slug: slugOf(), name: 'Audit org' });
+    return id;
+};
+/** #2526: a live connection in tenant `t`, for vertical `vertical`. */
+const newConnection = async (host, staff, t, vertical = 'audit-vertical') => {
+    const id = connectionId.parse(ulid());
+    const provider = `audit-${id.toLowerCase()}`;
+    await host.admin.createConnection(staff, { id, tenantId: t, vertical, provider, label: 'Audit connection', secret: { accessToken: 'tok' } });
+    return { id, provider };
+};
+/** #2526: a provisioned scope in tenant `t`, with a lowercase hostname of its own to bind. */
+const newScope = async (host, staff, t) => {
+    const s = scopeId.parse(ulid());
+    await host.provisionScope(staff, { tenantId: t, scopeId: s, vertical: await newVertical(host, staff) });
+    return s;
+};
+const hostnameOf = () => `audit-${ulid().toLowerCase()}.example.com`;
+/**
+ * #2526: a hostname bound to scope `s` of tenant `t`, `pending` as a bind leaves it. Bound by an
+ * actor of its own, so its row is never one a case counts as the call's.
+ */
+const bound = async (host, t, s, canonical = false) => {
+    const hostname = hostnameOf();
+    await host.admin.bindHostname(platformActorId.parse(ulid()), { hostname, tenantId: t, scopeId: s, surface: 'app', region: null, canonical });
+    return hostname;
+};
+/** #2526: a scope's hostnames as `[hostname, canonical]`, in name order. */
+const scopeHostnames = async (host, staff, s) => (await host.admin.listHostnames(staff, { scopeId: s })).map((h) => [h.hostname, h.canonical]).sort();
+const hostnameStatus = async (host, staff, s, hostname) => (await host.admin.listHostnames(staff, { scopeId: s })).find((h) => h.hostname === hostname)?.status ?? null;
+const RECORDS = [{ type: 'txt', name: '_cf-custom-hostname', value: 'dcv-token', status: null }];
+const entitlementsOf = async (host, staff, t) => (await host.admin.listEntitlements(staff, t)).map((e) => [e.entitlementKey, e.plan]);
 /** One vertical flag flipped by staff: the case is the same shape for each. */
 const flagCase = (action, field) => ({
     action,
@@ -243,6 +280,218 @@ const CASES = [
             };
         },
     },
+    // #2526: the role, grant and org writes at a tenant node.
+    {
+        action: 'defineRole',
+        write: { table: '_substrat_roles', verb: 'INSERT' },
+        arrange: async (host, staff) => {
+            const t = await newTenant(host, staff);
+            return {
+                call: () => host.admin.defineRole(staff, t, { key: 'auditor', permissions: [AUDIT_READ], source: 'vertical' }),
+                state: async () => (await host.admin.listRoles(staff, { tenantId: t })).find((r) => r.key === 'auditor')?.permissions ?? null,
+                changed: [AUDIT_READ],
+                row: { before: null, after: expect.objectContaining({ key: 'auditor', permissions: [AUDIT_READ], source: 'vertical' }) },
+            };
+        },
+    },
+    {
+        action: 'assignRole',
+        write: { table: '_substrat_tenant_tuples', verb: 'INSERT' },
+        arrange: async (host, staff, fixture) => {
+            const t = await newTenant(host, staff);
+            await host.admin.defineRole(staff, t, { key: 'auditor', permissions: [AUDIT_READ], source: 'vertical' });
+            const assignment = { principalId: principalId.parse(ulid()), roleKey: 'auditor', node: { tenantId: t, scopeId: null } };
+            return {
+                call: () => host.admin.assignRole(staff, assignment),
+                state: () => tenantTuples(fixture, t, `principal:${assignment.principalId}`, 'role:auditor'),
+                changed: 1,
+                row: { before: null, after: assignment },
+            };
+        },
+    },
+    {
+        action: 'grant',
+        write: { table: '_substrat_tenant_tuples', verb: 'INSERT' },
+        arrange: async (host, staff, fixture) => {
+            const t = await newTenant(host, staff);
+            const who = principalId.parse(ulid());
+            return {
+                call: () => host.admin.grant(staff, { principalId: who, permission: AUDIT_READ, node: { tenantId: t, scopeId: null }, grantedBy: who }),
+                state: () => tenantTuples(fixture, t, `principal:${who}`, `granted:${AUDIT_READ}`),
+                changed: 1,
+                row: { before: null, after: expect.objectContaining({ principalId: who, permission: AUDIT_READ }) },
+            };
+        },
+    },
+    {
+        action: 'grantToOrg',
+        write: { table: '_substrat_tenant_tuples', verb: 'INSERT' },
+        arrange: async (host, staff, fixture) => {
+            const t = await newTenant(host, staff);
+            const org = await newOrg(host, staff, t);
+            return {
+                call: () => host.admin.grantToOrg(staff, org, AUDIT_READ, { tenantId: t, scopeId: null }),
+                state: () => tenantTuples(fixture, t, `org:${org}`, `granted:${AUDIT_READ}`),
+                changed: 1,
+                row: { before: null, after: { orgId: org, permission: AUDIT_READ, node: { tenantId: t, scopeId: null } } },
+            };
+        },
+    },
+    {
+        action: 'grantToSystem',
+        write: { table: '_substrat_tenant_tuples', verb: 'INSERT' },
+        arrange: async (host, staff, fixture) => {
+            const t = await newTenant(host, staff);
+            const mod = moduleId.parse('audit-module');
+            const node = { tenantId: t, scopeId: null };
+            return {
+                call: () => host.admin.grantToSystem(staff, { moduleId: mod, permission: AUDIT_READ, node, grantedBy: staff }),
+                state: () => tenantTuples(fixture, t, `system:${mod}`, `granted:${AUDIT_READ}`),
+                changed: 1,
+                row: { before: null, after: { moduleId: mod, permission: AUDIT_READ, node } },
+            };
+        },
+    },
+    {
+        action: 'grantToConnection',
+        write: { table: '_substrat_connection_grants', verb: 'INSERT' },
+        arrange: async (host, staff, fixture) => {
+            const t = await newTenant(host, staff);
+            const conn = await newConnection(host, staff, t);
+            const node = { tenantId: t, scopeId: null };
+            return {
+                call: () => host.admin.grantToConnection(staff, { connectionId: conn.id, permission: AUDIT_READ, node, grantedBy: staff }),
+                // The record and, at the tenant node, the tuple go back together.
+                state: async () => [
+                    (await host.admin.listConnectionGrants(staff, t)).filter((g) => g.connectionId === conn.id).length,
+                    await tenantTuples(fixture, t, `connection:${conn.id}`, `granted:${AUDIT_READ}`),
+                ],
+                changed: [1, 1],
+                row: { before: null, after: { connectionId: conn.id, provider: conn.provider, permission: AUDIT_READ, node } },
+            };
+        },
+    },
+    {
+        action: 'createOrg',
+        write: { table: 'orgs', verb: 'INSERT' },
+        arrange: async (host, staff) => {
+            const t = await newTenant(host, staff);
+            const id = orgId.parse(ulid());
+            const slug = slugOf();
+            return {
+                call: () => host.admin.createOrg(staff, { id, tenantId: t, slug, name: 'Created org' }),
+                state: async () => (await host.admin.getOrg(staff, t, id))?.slug ?? null,
+                changed: slug,
+                row: { before: null, after: expect.objectContaining({ id, tenantId: t, slug, name: 'Created org' }) },
+            };
+        },
+    },
+    {
+        action: 'addMember',
+        write: { table: '_substrat_tenant_tuples', verb: 'INSERT' },
+        arrange: async (host, staff) => {
+            const t = await newTenant(host, staff);
+            const org = await newOrg(host, staff, t);
+            const who = principalId.parse(ulid());
+            return {
+                call: () => host.admin.addMember(staff, t, who, org),
+                state: async () => (await host.admin.listMembers(staff, t, org)).map((m) => m.principal),
+                changed: [who],
+                row: { before: null, after: expect.objectContaining({ principal: who, orgId: org }) },
+            };
+        },
+    },
+    // #2526: the hostname and entitlement writes.
+    {
+        action: 'bindHostname',
+        write: { table: 'hostnames', verb: 'INSERT' },
+        arrange: async (host, staff) => {
+            const t = await newTenant(host, staff);
+            const s = await newScope(host, staff, t);
+            // The surface's canonical already: the new canonical demotes it in the same unit, so a
+            // refused bind leaves it canonical, whichever write is refused.
+            const first = await bound(host, t, s, true);
+            const hostname = hostnameOf();
+            return {
+                call: () => host.admin.bindHostname(staff, { hostname, tenantId: t, scopeId: s, surface: 'app', region: null, canonical: true }),
+                state: () => scopeHostnames(host, staff, s),
+                changed: [[first, false], [hostname, true]].sort(),
+                row: { before: null, after: expect.objectContaining({ hostname, tenantId: t, scopeId: s, surface: 'app', canonical: true }) },
+            };
+        },
+    },
+    {
+        action: 'setHostnameStatus',
+        write: { table: 'hostnames', verb: 'UPDATE' },
+        arrange: async (host, staff) => {
+            const t = await newTenant(host, staff);
+            const s = await newScope(host, staff, t);
+            const hostname = await bound(host, t, s);
+            return {
+                call: () => host.admin.setHostnameStatus(staff, hostname, 'active'),
+                state: () => hostnameStatus(host, staff, s, hostname),
+                changed: 'active',
+                row: { before: { status: 'pending' }, after: { status: 'active', note: null } },
+            };
+        },
+    },
+    {
+        action: 'setHostnameIssuance',
+        write: { table: 'hostnames', verb: 'UPDATE' },
+        arrange: async (host, staff) => {
+            const t = await newTenant(host, staff);
+            const s = await newScope(host, staff, t);
+            const hostname = await bound(host, t, s);
+            return {
+                call: () => host.admin.setHostnameIssuance(staff, hostname, { status: 'verifying', customHostnameId: 'cf-audit', validationRecords: RECORDS }),
+                state: () => hostnameStatus(host, staff, s, hostname),
+                changed: 'verifying',
+                row: { before: { status: 'pending' }, after: { status: 'verifying', note: null } },
+            };
+        },
+    },
+    {
+        action: 'unbindHostname',
+        write: { table: 'hostnames', verb: 'DELETE' },
+        arrange: async (host, staff) => {
+            const t = await newTenant(host, staff);
+            const s = await newScope(host, staff, t);
+            const hostname = await bound(host, t, s);
+            return {
+                call: () => host.admin.unbindHostname(staff, hostname),
+                state: () => scopeHostnames(host, staff, s),
+                changed: [],
+                row: { before: { hostname, status: 'pending' }, after: null },
+            };
+        },
+    },
+    {
+        action: 'grantEntitlement',
+        write: { table: '_substrat_entitlements', verb: 'INSERT' },
+        arrange: async (host, staff) => {
+            const t = await newTenant(host, staff);
+            return {
+                call: () => host.admin.grantEntitlement(staff, t, 'audit-entitlement', { plan: 'pro' }),
+                state: () => entitlementsOf(host, staff, t),
+                changed: [['audit-entitlement', 'pro']],
+                row: { before: null, after: { entitlementKey: 'audit-entitlement', expiresAt: null, quota: null, plan: 'pro' } },
+            };
+        },
+    },
+    {
+        action: 'revokeEntitlement',
+        write: { table: '_substrat_entitlements', verb: 'DELETE' },
+        arrange: async (host, staff) => {
+            const t = await newTenant(host, staff);
+            await host.admin.grantEntitlement(staff, t, 'audit-entitlement', { plan: 'pro' });
+            return {
+                call: () => host.admin.revokeEntitlement(staff, t, 'audit-entitlement'),
+                state: () => entitlementsOf(host, staff, t),
+                changed: [],
+                row: { before: { entitlementKey: 'audit-entitlement', expiresAt: null, quota: null, plan: 'pro' }, after: null },
+            };
+        },
+    },
 ];
 /**
  * #2479: every tenant and vertical directory write commits with its admin row. A fault in the
@@ -261,9 +510,11 @@ export function directoryAdminAuditTransactionSuite(adapterName, makeFixture) {
                 : refusal(`test_refuse_write_${tag}`, `${c.write.verb} ON ${c.write.table}`);
             let lifted = true;
             try {
-                const { call, state, changed, row } = await c.arrange(host, staff);
+                const { call, state, changed, row } = await c.arrange(host, staff, fixture);
                 const since = new Date().toISOString();
-                const rows = () => host.admin.auditLog(staff, { action: [c.action], since });
+                // The call's own rows: an arrangement that made the same action as another actor, in the
+                // same millisecond as `since`, is not one of them.
+                const rows = async () => (await host.admin.auditLog(staff, { action: [c.action], since })).filter((r) => r.actor === staff);
                 const before = await state();
                 expect(before).not.toEqual(changed);
                 await fixture.directorySql(trigger.create);
@@ -360,7 +611,9 @@ export function directoryAdminAuditTransactionSuite(adapterName, makeFixture) {
                 }
                 throw new Error('expected the call to be refused');
             };
-            const rowsSince = async (host, staff, action, since) => (await host.admin.auditLog(staff, { action: [action], since })).map((r) => ({ before: r.before, after: r.after }));
+            const rowsSince = async (host, staff, action, since) => (await host.admin.auditLog(staff, { action: [action], since }))
+                .filter((r) => r.actor === staff)
+                .map((r) => ({ before: r.before, after: r.after }));
             /** A private vertical (tenant-owned, not listed), whose versions self-admit. */
             const privateVertical = async (host, staff) => {
                 const owner = await newTenant(host, staff);
@@ -494,6 +747,53 @@ export function directoryAdminAuditTransactionSuite(adapterName, makeFixture) {
                         .toEqual(['admitted']);
                 });
             });
+            // #2565: a promote reads the listing in the unit that moves prod, as listing reads prod.
+            it('promoteVersion refuses an auto-admitted version as prod of a vertical listed since it was read', async () => {
+                await withFixture(async (fixture, host, staff) => {
+                    const { slug, release } = await privateVertical(host, staff);
+                    const auto = await release();
+                    const since = new Date().toISOString();
+                    fixture.interleave(`UPDATE verticals SET listed = 1 WHERE slug = '${slug}'`);
+                    const refused = await refusalOf(host.admin.promoteVersion(staff, slug, 'prod', auto));
+                    expect(errorCodeOf(refused)).toBe('conflict');
+                    expect(refused.message).toContain(`prod version ${auto} is auto-admitted`);
+                    expect(await host.admin.listChannels(staff, slug)).toEqual([]);
+                    expect(await rowsSince(host, staff, 'promoteVersion', since)).toEqual([]);
+                });
+            });
+            it('and, unlistedOnly, refuses any version of a vertical listed since it was read', async () => {
+                await withFixture(async (fixture, host, staff) => {
+                    const { slug, release } = await privateVertical(host, staff);
+                    const vouched = await release();
+                    await host.admin.admitVersion(staff, vouched);
+                    const since = new Date().toISOString();
+                    fixture.interleave(`UPDATE verticals SET listed = 1 WHERE slug = '${slug}'`);
+                    const refused = await refusalOf(host.admin.promoteVersion(staff, slug, 'prod', vouched, undefined, { unlistedOnly: true }));
+                    expect(errorCodeOf(refused)).toBe('forbidden');
+                    expect(await host.admin.listChannels(staff, slug)).toEqual([]);
+                    expect(await rowsSince(host, staff, 'promoteVersion', since)).toEqual([]);
+                });
+            });
+            it('re-promoting the auto-admitted version a listed vertical names as prod is refused only if its serve would change what runs', async () => {
+                await withFixture(async (fixture, host, staff) => {
+                    const { slug, release } = await privateVertical(host, staff);
+                    const auto = await release();
+                    const vouched = await release();
+                    await host.admin.promoteVersion(staff, slug, 'prod', auto);
+                    // Listed before listing refused an auto-admitted prod: the state is kept, not judged again.
+                    await fixture.directorySql(`UPDATE verticals SET listed = 1 WHERE slug = '${slug}'`);
+                    await host.admin.promoteVersion(staff, slug, 'prod', auto);
+                    expect((await host.admin.listChannels(staff, slug)).find((c) => c.channel === 'prod')?.versionId).toBe(auto);
+                    // Serving the same version (the usual hosted state): the retry changes nothing either.
+                    await fixture.directorySql(`UPDATE verticals SET serving_ref = 'serving-a', serving_version_id = '${auto}' WHERE slug = '${slug}'`);
+                    await host.admin.promoteVersion(staff, slug, 'prod', auto);
+                    // A failed serve left another version serving: the retry would put `auto` on every install.
+                    await fixture.directorySql(`UPDATE verticals SET serving_ref = 'serving-a', serving_version_id = '${vouched}' WHERE slug = '${slug}'`);
+                    const refused = await refusalOf(host.admin.promoteVersion(staff, slug, 'prod', auto));
+                    expect(errorCodeOf(refused)).toBe('conflict');
+                    expect(refused.message).toContain(`prod version ${auto} is auto-admitted`);
+                });
+            });
             it('setVerticalServing refuses a serve whose serving version moved, and a retry after reading it again lands', async () => {
                 await withFixture(async (fixture, host, staff) => {
                     const slug = await newVertical(host, staff);
@@ -533,6 +833,49 @@ export function directoryAdminAuditTransactionSuite(adapterName, makeFixture) {
                         .map((r) => r.after.ref)).toEqual(['serving-a']);
                 });
             });
+            // #2526: the org and the connection a grant names are judged in the unit that writes it.
+            it.each(['grantToOrg', 'addMember'])('%s refuses an org deleted since it was read, and writes nothing', async (action) => {
+                await withFixture(async (fixture, host, staff) => {
+                    const t = await newTenant(host, staff);
+                    const org = await newOrg(host, staff, t);
+                    const who = principalId.parse(ulid());
+                    const since = new Date().toISOString();
+                    fixture.interleave(`DELETE FROM orgs WHERE org_id = '${org}'`);
+                    const refused = await refusalOf(action === 'grantToOrg'
+                        ? host.admin.grantToOrg(staff, org, AUDIT_READ, { tenantId: t, scopeId: null })
+                        : host.admin.addMember(staff, t, who, org));
+                    expect(errorCodeOf(refused)).toBe('not_found');
+                    expect(refused.message).toBe(`unknown org ${org} in tenant ${t}`);
+                    expect(await fixture.directoryRows(`SELECT 1 FROM _substrat_tenant_tuples WHERE tenant_id = '${t}'`)).toEqual([]);
+                    expect(await rowsSince(host, staff, action, since)).toEqual([]);
+                });
+            });
+            it('grantToConnection refuses a connection revoked since it was read, and writes nothing', async () => {
+                await withFixture(async (fixture, host, staff) => {
+                    const t = await newTenant(host, staff);
+                    const conn = await newConnection(host, staff, t);
+                    const since = new Date().toISOString();
+                    fixture.interleave(`UPDATE _substrat_connections SET revoked_at = '${since}' WHERE id = '${conn.id}'`);
+                    const refused = await refusalOf(host.admin.grantToConnection(staff, { connectionId: conn.id, permission: AUDIT_READ, node: { tenantId: t, scopeId: null }, grantedBy: staff }));
+                    expect(refused.message).toContain(`connection ${conn.id} is revoked — grant nothing to it`);
+                    expect(await fixture.directoryRows(`SELECT 1 FROM _substrat_connection_grants WHERE connection_id = '${conn.id}'`)).toEqual([]);
+                    expect(await tenantTuples(fixture, t, `connection:${conn.id}`, `granted:${AUDIT_READ}`)).toBe(0);
+                    expect(await rowsSince(host, staff, 'grantToConnection', since)).toEqual([]);
+                });
+            });
+            it('defineRole records the role its own unit read as its before', async () => {
+                await withFixture(async (fixture, host, staff) => {
+                    const t = await newTenant(host, staff);
+                    await host.admin.defineRole(staff, t, { key: 'auditor', permissions: [AUDIT_READ], source: 'vertical' });
+                    fixture.interleave(`UPDATE _substrat_roles SET permissions = '["audit:write"]' WHERE tenant_id = '${t}' AND role_key = 'auditor'`);
+                    await host.admin.defineRole(staff, t, { key: 'auditor', permissions: [AUDIT_READ], source: 'vertical' });
+                    // The first definition's row has no `before`; the second's is the role as the interleave left it.
+                    const befores = (await host.admin.auditLog(staff, { tenantId: t, action: ['defineRole'] }))
+                        .map((r) => r.before?.permissions ?? null);
+                    expect(befores).toHaveLength(2);
+                    expect(befores).toEqual(expect.arrayContaining([null, ['audit:write']]));
+                });
+            });
             it('setTenantStatus records the status its own unit read', async () => {
                 await withFixture(async (fixture, host, staff) => {
                     const t = await newTenant(host, staff);
@@ -554,6 +897,104 @@ export function directoryAdminAuditTransactionSuite(adapterName, makeFixture) {
                         .toEqual([[{ name: 'Middle' }, { name: 'After' }]]);
                 });
             });
+            // #2526: the hostname and entitlement writes judge their guard, their no-op and their row's
+            // `before` in the unit that writes. A no-op writes nothing and records nothing; each is
+            // paired with the change beside it that does record.
+            /** A hostname row as another caller would write it, for an interleave. */
+            const hostnameInsert = (hostname, t, s) => `INSERT INTO hostnames (hostname, tenant_id, scope_id, vertical_slug, surface, region, status, status_note, canonical,
+           created_at, custom_hostname_id, validation_records)
+         VALUES ('${hostname}', '${t}', '${s}', NULL, 'app', NULL, 'pending', NULL, 0, '2026-10-25T00:00:00.000Z', NULL, NULL)`;
+            it('bindHostname refuses a name another live scope bound since it was read, demoting nothing', async () => {
+                await withFixture(async (fixture, host, staff) => {
+                    const t = await newTenant(host, staff);
+                    const [mine, theirs] = [await newScope(host, staff, t), await newScope(host, staff, t)];
+                    const canonical = await bound(host, t, mine, true);
+                    const hostname = hostnameOf();
+                    const since = new Date().toISOString();
+                    fixture.interleave(hostnameInsert(hostname, t, theirs));
+                    const refused = await refusalOf(host.admin.bindHostname(staff, { hostname, tenantId: t, scopeId: mine, surface: 'app', region: null, canonical: true }));
+                    expect(errorCodeOf(refused)).toBe('conflict');
+                    expect(refused.message).toBe(`hostname '${hostname}' is already bound to another scope`);
+                    expect(await scopeHostnames(host, staff, mine)).toEqual([[canonical, true]]);
+                    expect(await scopeHostnames(host, staff, theirs)).toEqual([[hostname, false]]);
+                    expect(await rowsSince(host, staff, 'bindHostname', since)).toEqual([]);
+                });
+            });
+            it('and reclaims a name whose holder was archived since it was read', async () => {
+                await withFixture(async (fixture, host, staff) => {
+                    const t = await newTenant(host, staff);
+                    const [mine, theirs] = [await newScope(host, staff, t), await newScope(host, staff, t)];
+                    const hostname = await bound(host, t, theirs);
+                    const since = new Date().toISOString();
+                    fixture.interleave(`UPDATE scopes SET status = 'archived' WHERE scope_id = '${theirs}'`);
+                    await host.admin.bindHostname(staff, { hostname, tenantId: t, scopeId: mine, surface: 'app', region: null, canonical: false });
+                    expect(await scopeHostnames(host, staff, mine)).toEqual([[hostname, false]]);
+                    expect((await rowsSince(host, staff, 'bindHostname', since)).map((r) => r.after.scopeId)).toEqual([mine]);
+                });
+            });
+            it('setHostnameStatus records nothing for a status set since it was read, and the status its unit read otherwise', async () => {
+                await withFixture(async (fixture, host, staff) => {
+                    const t = await newTenant(host, staff);
+                    const s = await newScope(host, staff, t);
+                    const hostname = await bound(host, t, s);
+                    const since = new Date().toISOString();
+                    fixture.interleave(`UPDATE hostnames SET status = 'active' WHERE hostname = '${hostname}'`);
+                    await host.admin.setHostnameStatus(staff, hostname, 'active');
+                    expect(await rowsSince(host, staff, 'setHostnameStatus', since)).toEqual([]);
+                    fixture.interleave(`UPDATE hostnames SET status = 'failed' WHERE hostname = '${hostname}'`);
+                    await host.admin.setHostnameStatus(staff, hostname, 'active');
+                    expect(await hostnameStatus(host, staff, s, hostname)).toBe('active');
+                    expect(await rowsSince(host, staff, 'setHostnameStatus', since))
+                        .toEqual([{ before: { status: 'failed' }, after: { status: 'active', note: null } }]);
+                });
+            });
+            it('setHostnameIssuance records nothing for a poll that finds what another write already stored, and one row for a poll that changes it', async () => {
+                await withFixture(async (fixture, host, staff) => {
+                    const t = await newTenant(host, staff);
+                    const s = await newScope(host, staff, t);
+                    const hostname = await bound(host, t, s);
+                    const poll = { status: 'verifying', customHostnameId: 'cf-audit', validationRecords: RECORDS };
+                    const since = new Date().toISOString();
+                    fixture.interleave(`UPDATE hostnames SET status = 'verifying', custom_hostname_id = 'cf-audit',
+            validation_records = '${JSON.stringify(RECORDS)}' WHERE hostname = '${hostname}'`);
+                    await host.admin.setHostnameIssuance(staff, hostname, poll);
+                    expect(await rowsSince(host, staff, 'setHostnameIssuance', since)).toEqual([]);
+                    // Its twin: a poll that resolves it records one row, `before` the status the unit read.
+                    await host.admin.setHostnameIssuance(staff, hostname, { status: 'active', validationRecords: [] });
+                    expect(await hostnameStatus(host, staff, s, hostname)).toBe('active');
+                    expect(await rowsSince(host, staff, 'setHostnameIssuance', since))
+                        .toEqual([{ before: { status: 'verifying' }, after: { status: 'active', note: null } }]);
+                });
+            });
+            it('grantEntitlement records nothing for a grant another write already made, and the grant its unit read as before otherwise', async () => {
+                await withFixture(async (fixture, host, staff) => {
+                    const t = await newTenant(host, staff);
+                    const held = (plan) => `INSERT OR REPLACE INTO _substrat_entitlements
+            (tenant_id, entitlement_key, expires_at, quota, plan, granted_at, granted_by)
+            VALUES ('${t}', 'audit-entitlement', NULL, NULL, '${plan}', '2026-10-25T00:00:00.000Z', 'interleaved')`;
+                    const since = new Date().toISOString();
+                    fixture.interleave(held('pro'));
+                    await host.admin.grantEntitlement(staff, t, 'audit-entitlement', { plan: 'pro' });
+                    expect(await rowsSince(host, staff, 'grantEntitlement', since)).toEqual([]);
+                    fixture.interleave(held('trial'));
+                    await host.admin.grantEntitlement(staff, t, 'audit-entitlement', { plan: 'pro' });
+                    expect(await entitlementsOf(host, staff, t)).toEqual([['audit-entitlement', 'pro']]);
+                    expect(await rowsSince(host, staff, 'grantEntitlement', since)).toEqual([{
+                            before: { entitlementKey: 'audit-entitlement', expiresAt: null, quota: null, plan: 'trial' },
+                            after: { entitlementKey: 'audit-entitlement', expiresAt: null, quota: null, plan: 'pro' },
+                        }]);
+                });
+            });
+            it('revokeEntitlement records nothing for a grant revoked since it was read', async () => {
+                await withFixture(async (fixture, host, staff) => {
+                    const t = await newTenant(host, staff);
+                    await host.admin.grantEntitlement(staff, t, 'audit-entitlement', { plan: 'pro' });
+                    const since = new Date().toISOString();
+                    fixture.interleave(`DELETE FROM _substrat_entitlements WHERE tenant_id = '${t}' AND entitlement_key = 'audit-entitlement'`);
+                    await host.admin.revokeEntitlement(staff, t, 'audit-entitlement');
+                    expect(await rowsSince(host, staff, 'revokeEntitlement', since)).toEqual([]);
+                });
+            });
         });
     });
 }