@substrat-run/kernel 0.162.0 → 0.164.0

package/dist/scope-host.d.ts

@@ -11,11 +11,15 @@ import type { StoreDriverHoldMode, StoreDriverRebuildFailure, StoreDriverRebuild
 import type { SubjectRedactionCounts } from './subject-redaction.js';
 import type { OnBehalfOf, ExportReadInput, ExportedBatch, ImportBatch, ImportedEvent, ImportResult, ImportState, ImportCursorMove, ImportCursorMoved, AdminAction, BecomeCapabilityInput, CapabilityExchange, CapabilityFilter, CapabilityId, CapabilityPage, MintedCapability, ListPage, ConnectLink, ConnectLinkConsume, ConnectLinkFilter, ConnectLinkKey, ConsumeConnectLinkInput, MintConnectLinkInput, Connection, ConnectionFilter, ConnectionId, ConnectionGrant, ConnectionGrantRecord, ConnectionSecret, CreateConnectionInput, OpenConnection, ProjectedConnectionGrant, ProjectedConnectionKey, AccessLogEntry, DelegatedReadRecord, OwnerTransferAudit, MemberChangeAudit, PeerBindingAudit, ConnectionBindingAudit, CopyMarkAudit, OrphanSweepAudit, BindHostnameInput, AdminLogEntry, OpsFailureEntry, PlatformRequestDrainTotalsEntry, SweepRunEntry, SweepRunKind, SweepRunOutcome, ModelUsageEntry, ModelUsageSummary, CapabilityGrant, CreateTenantInput, Decision, Instant, DomainEvent, DomainEventInput, PlatformRequestInput, PlatformRequestId, PlatformRequestEntry, PlatformRequestFilter, PlatformRequestStatus, PlatformRequestFailure, PlatformOutcomeEvent, EntitlementGrant, EntitlementGrantInput, EntitlementView, MeterReading, MeterDay, MeterDayTake, VerticalOwnerPeriod, ScopeStorageSample, RequestDay, RequestRollupDay, EntityRef, IdentityLink, IdentityPool, Jurisdiction, ModuleId, ModuleManifest, ScheduleSpec, SystemGrant, PeerGrantsStatusEntry, SystemGrantsStatusEntry, SystemSwitchRecord, SystemSwitch, SystemSwitchResult, PeerCoverage, PeerSwitch, PeerSwitchResult, VerticalCaller, VerticalResolution, PeerBinding, PeerInstanceResolution, CreateOrgInput, Node, Org, OrgId, OrgMembership, PermissionKey, PlatformActorId, ChannelName, ExportBreak, ChannelHistoryEntry, DnsRecord, HostnameBinding, HostnameStatus, PromotionAcknowledgement, BindAcknowledgement, PublishVersionInput, RegisterVerticalInput, VerticalServingState, DeploymentWireAuth, RouteTarget, DirectoryDump, IdentityMembership, PrincipalId, ResolvedIdentity, RoleAssignment, RoleDefinition, QueryScopeInput, ReadScopeTableInput, Scope, ScopeDump, ScopeDumpInput, SubjectShredReceipt, ScopeQueryResult, ScopeId, ScopeStatus, ScopeTable, DenialFilter, DenialSummary, RefusalFilter, RefusalRecord, PermissionDenial, Coverage, BeginImpersonationInput, ImpersonationFilter, ImpersonationSession, ImpersonationSessionId, ScopeTablePage, StorageShape, Tenant, TenantId, TenantRole, TenantStoreHandle, AttachmentRecord, UploadLinkView, BlobStoreHandle, Visibility, Vertical, VerticalChannel, VerticalVersion, TenantStatus, Page, CountedPage, FreshnessSpec, EntityHistoryInput, EventFacetInput, EventCauseInput, EventEffectsInput, EffectsTree, InvocationEventsInput, InvocationEvents, DeadLettersInput, DeadLetter, LifecycleFlowInput, LifecycleFlowResult, OperationSeriesInput, OperationSeriesResult, CauseChain, EventFacetResult, HistoryEntry, ErrorCode, PlatformRequestFailureOrigin, IssueEntry, IssueStatus, IssueStatusInput, FindingEntry, FindingFilter, FindingRuleEntry, FindingRuleInput, FindingStatusInput, DeclaredMigration, CheckSubject, EntityGrantShape } from '@substrat-run/contracts';
 import type { ConnectionUseOutcome } from './connector-calls.js';
-import { type ByteBody, type ByteStream, type IncrementalSha256, type SizedByteStream } from './byte-stream.js';
+import type { ByteBody } from './byte-stream.js';
+import type { BlobStoreProvisionInput, BlobStoreRecord, OpenedAttachment, OpenedAttachmentStream } from './attachment-bytes.js';
+import type { ConnectorOptions, ExecutorDeadLetter, ExecutorRetryPolicy, ScopedConnectorConnection } from './connector-transport.js';
+import type { TelemetryPruneReport } from './retention.js';
+import type { LiveReadSurface } from './live-read.js';
 import type { CapabilityVerbs } from './capability.js';
 import type { AttachmentVerbs } from './upload-link.js';
 import type { AuditedOperationRef, AuditedOperationRow } from './audit-outcome.js';
-import { type AttachmentRecordFields, type EntityStateName } from '@substrat-run/contracts';
+import { type EntityStateName } from '@substrat-run/contracts';
 import type { ModelUsageFilter, ModelUsageInput, ModelUsageWindow } from './model-usage.js';
 import type { FindingPruneReport } from './findings.js';
 import type { ScopeStorageAttempt, ScopeStorageFilter, ScopeStorageReadingInput } from './storage-gauge.js';
@@ -1056,21 +1060,6 @@ export interface ExecutorOutcome {
 }
 /** One delivery's `ExecutorOutcome` — the one builder both adapters report through. */
 export declare function executorOutcomeOf(executorId: string, event: DomainEvent, outcome: ExecutorOutcome['outcome'], error?: unknown): ExecutorOutcome;
-/**
- * How hard the host tries before it gives up on one delivery (#100).
- *
- * Defaults suit a directory write. A connector making an outbound HTTP call
- * wants a longer tail — that is the whole reason this is per-executor rather
- * than a host-wide constant.
- */
-export interface ExecutorRetryPolicy {
-    /** Total attempts including the first. Reaching it dead-letters. Default 5. */
-    maxAttempts?: number;
-    /** First backoff step; doubles per attempt. Default 1000ms. `0` retries at once. */
-    baseDelayMs?: number;
-    /** Ceiling on the doubling. Default 300_000ms (5 min). */
-    maxDelayMs?: number;
-}
 /**
  * What one drain pass did. `retrying` and `deadLettered` are the numbers a
  * health surface reports; a caller that ignores them learns nothing, which is
@@ -1225,51 +1214,6 @@ export interface ScheduleTick {
     /** Platform requests the purge runs of the tick's earlier calls on this scope enqueued (their `purgeRequests`). */
     earlierPurgeRequests?: number;
 }
-/**
- * The web-standard fetch surface, structurally typed.
- *
- * Declared rather than imported: the kernel depends on no platform typings, and
- * `RequestInit`/`Response` come from DOM lib in Node and from workers-types in
- * Workers. Structural typing means both satisfy this without either being
- * required — the same reason `crypto` and `TextEncoder` are declared locally.
- */
-export interface FetchLike {
-    (input: string, init?: ConnectorRequestInit): Promise<ConnectorResponse>;
-}
-/**
- * The runtime's own `fetch`, as a `FetchLike` — the ONE place the structural cast
- * lives. A host that takes a `fetch` defaults to this; a caller that hands one to a
- * connector passes this. Nobody else spells `globalThis.fetch` (`lint:bound-fetch`).
- *
- * The cast is needed at all because a real `fetch` is NOT assignable to `FetchLike`
- * under strict TypeScript: `ConnectorRequestInit.body` is a `Uint8Array` the DOM lib's
- * `BodyInit` no longer accepts unparameterized, and `signal` is `unknown`. Structurally
- * the runtime satisfies it — every field is one `fetch` reads — and this is where that
- * claim is made, once. Code typed against the DOM `fetch` itself (a `Response` in hand)
- * does not want this; `globalThis.fetch.bind(globalThis)` is that type with no cast.
- *
- * An arrow, deliberately, rather than the global handed on as a value: workerd
- * refuses the bare global invoked with any other receiver — `TypeError: Illegal
- * invocation` — and a callee is free to call what it was given as `input.fetch(…)`.
- * Node's fetch accepts any `this`, and so does the wrapper the workers vitest pool
- * installs, so no suite in this repo sees the difference; the Fortnox consent
- * callback shipped green and failed every hosted round that way (#1291). Closing
- * over the global here means the receiver is never in play, anywhere downstream.
- *
- * A `SizedByteStream` body (#2498) is converted by `fetchLikeOf`, which this is built from.
- */
-export declare const globalFetch: FetchLike;
-/**
- * A runtime `fetch` (the global, a service binding's, a test's stand-in) as a `FetchLike`
- * (#2498): the one place a `SizedByteStream` body becomes a request the runtime can send, as
- * `knownLengthInit` builds it. The runtime takes no such value: handed one as it is, a `fetch`
- * sends its string form, `"[object Object]"`, and answers as if nothing were wrong. So
- * `globalFetch` is built from this, and both hosts pass the `fetch` they are given through it,
- * as `runPlatformSweep` does, so a sized body reaches no runtime `fetch` unconverted whichever
- * one was injected. Wrapping a `FetchLike` that is already one is harmless: a converted body is
- * no longer a `SizedByteStream`.
- */
-export declare function fetchLikeOf(runtimeFetch: (input: string, init?: never) => Promise<ConnectorResponse>): FetchLike;
 /**
  * The host's clock (#812) — what `ctx.now()` reads.
  *
@@ -1300,210 +1244,6 @@ export declare function fetchLikeOf(runtimeFetch: (input: string, init?: never)
 export interface Clock {
     (): Instant;
 }
-export interface ConnectorRequestInit {
-    method?: string;
-    headers?: Record<string, string>;
-    /**
-     * `Uint8Array` as well as `string` because a real provider upload is binary:
-     * Scrive's `setfile` is `multipart/form-data`, whose body is a byte sequence a
-     * string cannot carry without corrupting the file. Web `fetch` accepts both, so
-     * this only widens the declared surface — the adapter passes it straight
-     * through.
-     *
-     * A {@link SizedByteStream} as well (#2498), for a body too large to hold in memory. The
-     * length is part of the value because a provider wants a `Content-Length`, and a stream
-     * carries none. The runtime cannot take one as it is, so it is converted by `fetchLikeOf`:
-     * `globalFetch` is built from it, and both hosts and `runPlatformSweep` pass the `fetch` they
-     * are given through it. A runtime `fetch` handed straight to a connector is made a
-     * `FetchLike` with `fetchLikeOf` too, never by a cast.
-     */
-    body?: string | Uint8Array | SizedByteStream;
-    signal?: unknown;
-}
-export interface ConnectorResponse {
-    readonly ok: boolean;
-    readonly status: number;
-    text(): Promise<string>;
-    json(): Promise<unknown>;
-    /**
-     * The raw bytes — for provider responses that are a file, not JSON. Scrive's
-     * sealed signed PDF (`documents/{id}/files/main`) comes back as `application/pdf`,
-     * which `text()` would corrupt. Web `Response` already has this, so declaring it
-     * only widens the structural surface the adapter passes straight through.
-     */
-    arrayBuffer(): Promise<ArrayBuffer>;
-    /**
-     * The body as a stream (#2498), for a provider file too large to hold: read it chunk by chunk,
-     * or hand it on to `upload` as a `SizedByteStream`. `null` for a response with no body, as on
-     * a web `Response`, which every adapter's `fetch` returns.
-     *
-     * The stream carries the body as `fetch` delivers it: DECODED. A response sent with a
-     * `Content-Encoding` (gzip, br) is decompressed on the way, while its `Content-Length` still
-     * counts the compressed bytes, so that header is the stream's length only when the response
-     * has no `Content-Encoding`. Otherwise take the length from the provider's own record of the
-     * file (its item metadata); a stream sized by the wrong number is refused, not landed.
-     *
-     * The stream is bounded by IDLENESS, not by total transfer time (#2518). A connection's `fetch`
-     * holds the connector's `timeoutMs` (default 30 s) over the call up to the headers and over a
-     * buffered read, and still holds it while `body` is only looked at or never read. From the first
-     * read of the stream the deadline hands over: it errors (`TimeoutError`) when the provider sends
-     * no byte for `STREAM_IDLE_TIMEOUT_MS` (an empty chunk is not a byte), or when
-     * `STREAM_MAX_DURATION_MS` has passed in all. A transfer that keeps flowing completes within
-     * that. A stalled or endless one errors, the connection is released, and an upload reading it
-     * lands no object and no row.
-     *
-     * OPTIONAL for the reason `headers` is: a hand-built stand-in is an object literal, and most
-     * connectors never read a stream. A caller that needs one falls back to `arrayBuffer()` when it
-     * is absent. Read a body once, by one of these.
-     */
-    readonly body?: ByteStream | null;
-    /**
-     * The response headers, when the runtime behind this seam has them.
-     *
-     * OPTIONAL, and the optionality is the whole design. Every adapter's `fetch`
-     * returns a real web `Response`, which always carries headers — so a connector
-     * reading one gets a value in production, always. What is not guaranteed is a
-     * hand-built stand-in: a mock or an in-memory provider is a plain object
-     * literal, and requiring `headers` would break every one of them for a field
-     * most connectors never read.
-     *
-     * So a caller must handle absence, and the callers that need it do. It exists
-     * because some provider instructions live ONLY in a header and a connector that
-     * cannot read them has to invent a substitute: Planima answers a rate limit with
-     * `Retry-After`, and a client that cannot see it backs off on a schedule of its
-     * own guessing — either too soon (spending another request to be told the same
-     * thing) or too late. Declaring it here is what keeps that read inside the
-     * sanctioned seam instead of a structural cast in a connector.
-     */
-    readonly headers?: {
-        get(name: string): string | null;
-    };
-}
-/**
- * A connection with its credential opened, plus egress bound to it.
- *
- * `fetch` is bound to the connection rather than sitting on the context because
- * health has to land on the right row by construction. An ambient
- * `ctx.fetch` would need the runtime to guess which connection a call belonged
- * to, and it would guess wrong the first time a connector talked to two.
- */
-export interface ConnectorConnection extends OpenConnection {
-    /**
-     * Sanctioned egress: a timeout, and success/failure recorded against THIS
-     * connection.
-     *
-     * The connector is handed its `fetch` rather than importing one — the same
-     * move `ctx.sql` makes for module code, and for the same reason. Egress
-     * policy, timeouts and health become properties of the seam instead of
-     * conventions a connector author has to remember. Module code still cannot
-     * reach any of this: boundary-lint R3 bans `fetch` outright, and a connector
-     * is host code.
-     */
-    fetch(input: string, init?: ConnectorRequestInit): Promise<ConnectorResponse>;
-}
-/**
- * A connection opened INSIDE a dispatch (#711) — `ctx.connection(provider)`.
- *
- * Strictly more than a `ConnectorConnection`, and the difference is a scope. A
- * dispatch happens *for* one scope, which is ambient in the context, so a
- * connection opened there can reach that scope's attachments. A connection
- * reopened top-level — a probe of a candidate credential, a poll driver
- * rebuilding egress from the directory — has no such scope, and the type says so
- * rather than handing out a method that would have to throw.
- */
-export interface ScopedConnectorConnection extends ConnectorConnection {
-    /**
-     * Read ONE attachment's bytes from the scope this delivery is for (#711) — the
-     * outbound mirror of `getConnectorAttachments`, which is the return path's door.
-     *
-     * A signing connector sends a document. Until this existed it could only send a
-     * document it RENDERED ITSELF, because `create` had no way to be handed the
-     * vertical's own file: the bytes were in the attachment store, and the store was
-     * unreachable from inside a dispatch. So a Swedish counterparty was asked to sign
-     * a page of identifiers with BankID rather than the contract.
-     *
-     * **On the connection, for the same reason `fetch` is.** The read is authorized as
-     * a connection, and the only connection it can correctly be authorized as is the
-     * one the handler opened — this object. An ambient "the provider this connector is
-     * registered under" would be a second name for the same thing, and two names for
-     * one fact is how they come to disagree: `registerScriveConnector({ id: 'scrive-eu' })`
-     * opens its credential as `'scrive'` and would have read as `'scrive-eu'`, so the
-     * egress half kept working while the document half failed on every contract.
-     * Handing the door to whoever holds the credential makes that unrepresentable.
-     *
-     * **Why not `getConnectorAttachments` from in here.** On the pure adapter a
-     * connector runs INSIDE the scope's actor task, and every verb of that surface
-     * re-enqueues on the same actor — the nested task waits on the task holding it,
-     * and the invoke never returns. (Pinned in `connector-reads.test.ts`.) The adapter
-     * builds this read to suit where it is running: reentrant when the caller already
-     * holds the actor, ordinary and serialized when it does not.
-     *
-     * **Reads only, and only by id.** No `list`, deliberately. A connector that
-     * SEARCHES for the document to send has to have a rule for picking among several
-     * — and the return path lands the sealed signed copy on the same entity, so a
-     * wrong rule mails the counterparty their own signed contract to sign again.
-     * Naming the id makes that unrepresentable: the caller says which bytes, the
-     * event carries it, and nothing has to be disambiguated. Writes stay top-level
-     * (`getConnectorAttachments().upload`), where a spine event and its consumers
-     * have a transaction to live in.
-     *
-     * Gated by the target's `readPermission` checked against this connection's
-     * `connection:<id>` grants. `null` for an id the scope does not know — a caller
-     * falls back rather than failing a dispatch over a missing file.
-     */
-    openAttachment(attachmentId: string): Promise<OpenedAttachment | null>;
-    /**
-     * `openAttachment`, with the bytes as a stream that is never held whole (#2514), for a connector
-     * that sends a file on to a provider. Gated the same way, before any byte is read. The sha256 is
-     * checked as the bytes flow, and a mismatch errors the stream before its last chunk is handed on
-     * (see {@link OpenedAttachmentStream}). The bytes delivered before a stream error are a prefix of
-     * an unverified file, never a shorter file: a connector that sends what it read discards them and
-     * undoes anything it wrote from them (an upload session cancelled, a request aborted before it
-     * completes), as the hosted read's refusal says (`STREAMED_ATTACHMENT_UNVERIFIED` in
-     * `@substrat-run/control-plane-api`). A stream it decides not to read is
-     * cancelled (`body.stream.getReader().cancel()`), which releases the stored object at once.
-     */
-    openAttachmentStream(attachmentId: string): Promise<OpenedAttachmentStream | null>;
-    /**
-     * What this connection may do in the scope this delivery is for (#726 gap 1) —
-     * `connectionGrantsInScope`, narrowed to this connection.
-     *
-     * Here so a connector can check its own preconditions at the top of a dispatch and
-     * fail saying which grant is missing, instead of discovering it three calls later as
-     * a refusal the drain then captions as the provider's (#841). A connector that needs
-     * a standing grant for its RETURN path — where there is no delivered event to carry
-     * authority — can say so on the way out, which is the only moment it is cheap to fix.
-     *
-     * Deliberately the permission keys and nothing else: a connector asks whether it may
-     * act, never who granted it or when. Both are the operator's question, and both are
-     * on the drawer that already renders them.
-     */
-    grants(): Promise<PermissionKey[]>;
-    /**
-     * Open a cell the scope sealed TO this connection (#687) — the egress half of
-     * `ctx.sealToConnection`.
-     *
-     * **Here rather than on `ConnectorConnection`, and the probe path is why.** A
-     * connection rebuilt top-level may have no directory row at all — the credential
-     * probe builds one from a candidate secret and a zero id — so it holds no
-     * keypair and could only ever throw. A sealed cell arrives on a delivered event,
-     * which is to say inside a dispatch, which is exactly the shape that has one.
-     *
-     * **On the connection, for the same reason `fetch` and `openAttachment` are.**
-     * The private half belongs to one connection, and the only connection it can
-     * correctly be is the one this handler opened. An ambient `ctx.unseal` would
-     * have to guess, and it would guess wrong the first time a tenant held two
-     * credentials for one provider.
-     *
-     * Key material never crosses this seam: the adapter holds the keyId-indexed map
-     * and picks by the cell's own `keyId`, so a connector cannot mislay a private
-     * key it never had. Throws `SealedKeyUnavailableError` when the named key is not
-     * held — which after a rotation-as-erasure (D-5) is the correct and permanent
-     * answer, not a mystery. A scope restored from backup can resurrect a pending
-     * request whose key is gone, and that delivery should dead-letter saying so.
-     */
-    unseal(sealed: SealedSecret): Promise<string>;
-}
 /**
  * What a connector sees. Strictly more than an executor: an executor effects
  * something in the DIRECTORY, a connector effects something in the OUTSIDE
@@ -1527,50 +1267,6 @@ export interface ConnectorContext {
     connection(provider: string): Promise<ScopedConnectorConnection>;
 }
 export type ConnectorHandler = (ctx: ConnectorContext, event: DomainEvent) => void | Promise<void>;
-/** Tuning for one connector's egress. */
-export interface ConnectorOptions extends ExecutorRetryPolicy {
-    /**
-     * Per-request timeout. Default 30s. It bounds the call up to the response headers and a
-     * buffered read of the body. A streamed body (`ConnectorResponse.body`) is bounded by an idle
-     * window instead (#2518, `STREAM_IDLE_TIMEOUT_MS`) and an absolute cap (`STREAM_MAX_DURATION_MS`):
-     * it may take longer than this, as long as bytes keep arriving.
-     */
-    timeoutMs?: number;
-    /**
-     * The provider slug this connector operates (#574 phase 3) — the routing key a
-     * CP-less host uses when it cannot run the handler itself: the delivery becomes a
-     * `connector:<provider>` platform intent, and the platform's drain dispatches it to
-     * the handler registered for that same slug. Defaults to the registration id, which
-     * for the shipped connectors is already the provider name ('scrive'). Irrelevant on
-     * a host that reaches the connection directory (self-host, the control plane): there
-     * the handler runs in-process and this key is never consulted.
-     */
-    provider?: string;
-}
-/** A delivery that exhausted its attempts. The evidence, not a silent drop. */
-export interface ExecutorDeadLetter {
-    eventId: string;
-    executorId: string;
-    eventType: string;
-    attempts: number;
-    error: string;
-    lastAttemptAt: string;
-}
-/**
- * Retry defaults (#100). Tuned for the directory write the first executor does;
- * a connector making an outbound call should raise `maxAttempts` explicitly,
- * which is why the policy is per-executor rather than a host constant.
- */
-export declare function resolveRetryPolicy(retry?: ExecutorRetryPolicy): Required<ExecutorRetryPolicy>;
-/**
- * When attempt `attempts` should next be tried: exponential, capped, jittered.
- *
- * Jitter is ±20% and is skipped entirely at zero delay, so a test setting
- * `baseDelayMs: 0` gets deterministic immediate retries rather than a race. It
- * matters at real delays because every scope in a fleet retries a downed
- * provider on the same schedule otherwise.
- */
-export declare function backoffAt(attempts: number, retry: Required<ExecutorRetryPolicy>, from: Date): string;
 /**
  * A named, manifest-wired pre-condition on an operation (K-17; engine-protocol
  * §6, open question 11). One module CONTRIBUTES a predicate under a name; a
@@ -2352,7 +2048,10 @@ export interface HostAdmin {
      * "someone reviewed it" becomes evidence rather than a claim.
      *
      * Only admitted versions may be promoted, for the same reason they are the only
-     * ones bindable.
+     * ones bindable. **#2565: prod of a listed vertical takes no auto-admitted version**
+     * (`AUTO_ADMISSION_NOTE`), the rule `setVerticalListed` holds prod to, and `unlistedOnly` refuses
+     * (`forbidden`) a vertical that is listed. Both are read in the unit that moves the channel, so a
+     * listing that lands while the promote is judged is seen.
      *
      * **#1705 PR 3: refuses a promotion that breaks an installed consumer** unless it is
      * acknowledged (`exportBreak`). A break is an exported (type, schemaVersion) the outgoing
@@ -2360,7 +2059,9 @@ export interface HostAdmin {
      * (`exportBreaksOf`). The refusal counts what breaks and names no tenant, since this layer does
      * not know who is asking. `promotionImpact` is the listing, for a caller that may see it.
      */
-    promoteVersion(actor: PlatformActorId, verticalSlug: string, channel: ChannelName, versionId: string, acknowledge?: PromotionAcknowledgement): Promise<void>;
+    promoteVersion(actor: PlatformActorId, verticalSlug: string, channel: ChannelName, versionId: string, acknowledge?: PromotionAcknowledgement, options?: {
+        unlistedOnly?: boolean;
+    }): Promise<void>;
     /**
      * Which installed consumers promoting `versionId` to `channel` would break (#1705 PR 3): the
      * `exportBreaksOf` answer the promote gate refuses on, as a read. Empty for a first promote,
@@ -2475,8 +2176,17 @@ export interface HostAdmin {
      * and the DO-class/migration-tag base the NEXT upload diffs against. Written only
      * AFTER the upload succeeded — a failed serve leaves `servingVersionId` trailing
      * the prod channel, which is the visible, retryable state. Audited.
+     *
+     * A compare-and-set (#2528): the write lands only if the row still holds the serving state this
+     * method read, its ref, version, class set and migration tag, judged in the unit that writes.
+     * `expected` (#2577) is the state the caller computed its upload from (`verticalServing`'s answer
+     * before the upload, null for nothing served); a row whose class set or tag differs from it is
+     * refused before the gate, so the record never names a migration base diffed from one that is
+     * gone. Its ref and version are not compared: a serve recorded meanwhile that moved only those
+     * left the upload's migration right, and the record lands over it as it did before. Either
+     * refusal is `precondition_failed` (`servingRaceRefusal`) and writes nothing.
      */
-    setVerticalServing(actor: PlatformActorId, verticalSlug: string, state: VerticalServingState): Promise<void>;
+    setVerticalServing(actor: PlatformActorId, verticalSlug: string, state: VerticalServingState, expected?: VerticalServingState | null): Promise<void>;
     /**
      * The pushed DeployManifest (JSON) of one version — what a serve rebuilds upload
      * metadata from. Null for a version pushed before manifests were retained; such a
@@ -4209,106 +3919,6 @@ export interface TenantStoreRecord {
     ref: string;
     createdAt: string;
 }
-/** What `provisionBlobStore` needs to mint (or idempotently re-resolve) a per-tenant
- *  blob store (#473). Keyed by (tenant, vertical, binding), exactly like tenant stores. */
-export interface BlobStoreProvisionInput {
-    tenantId: TenantId;
-    /** The vertical the store belongs to — its `blobStoreNeed` binding is scoped to it. */
-    vertical: string;
-    /** The declared `blobStoreNeed.binding` this store satisfies (SCREAMING_SNAKE). */
-    binding: string;
-}
-/**
- * A live per-tenant blob store (#473) — the byte side of the attachment surface. The
- * contract is async and byte-shaped (Uint8Array + web-standard types only) because the
- * store is only reachable asynchronously on Cloudflare (an `R2Bucket` binding); the pure
- * adapter backs it with a per-tenant directory and resolves immediately.
- *
- * Keys are PLATFORM-DERIVED (`attachmentBlobKey`), never caller-supplied strings — the
- * per-scope prefix inside a per-tenant store is constructed in kernel/adapter code, which
- * is what turns "scope/<id>/ is a convention" into "cross-scope keys are unwritable".
- */
-export interface TenantBlobStore {
-    /**
-     * Write `body` under `key`. A `SizedByteStream` (#2498) is written as it is read, never
-     * collected first, and refused if it carries other than its declared length. The put
-     * resolves only once the whole stream has been read.
-     */
-    put(key: string, body: ByteBody, opts?: {
-        contentType?: string;
-    }): Promise<void>;
-    get(key: string): Promise<{
-        body: Uint8Array;
-        contentType?: string;
-    } | null>;
-    /**
-     * The object under `key` as a stream (#2514), with the size the store holds for it, read as the
-     * consumer reads it and never collected first. Optional, so a store written before it still
-     * satisfies this interface: an open over such a store reads the object with `get` and hands it on
-     * as a stream, which works but holds the object whole.
-     */
-    getStream?(key: string): Promise<{
-        stream: ByteStream;
-        size: number;
-        contentType?: string;
-    } | null>;
-    delete(key: string): Promise<void>;
-    /** Keys under `prefix` — the GC/ops walk. */
-    list(prefix: string): Promise<string[]>;
-}
-/**
- * One row of the blob-store ledger (#473) — same idempotency/deploy/reap roles as
- * {@link TenantStoreRecord}: a retried provision re-resolves the same `ref`, the deploy
- * path derives which `r2_bucket` bindings must ride every serving-script upload, and a
- * tenant reap knows what to tear down.
- */
-export interface BlobStoreRecord {
-    tenantId: TenantId;
-    vertical: string;
-    binding: string;
-    kind: 'blob';
-    ref: string;
-    createdAt: string;
-}
-/**
- * The blob key an attachment's bytes live under inside the per-tenant store (#473).
- * Scope-prefixed by construction: every key this platform ever writes for a scope sits
- * under `scope/<scopeId>/`, and the attachment id (a fresh ULID per upload) makes keys
- * write-once — the two properties the attachment integrity story rests on. Exported so
- * both adapters (and an ops GC walk) derive the same key; module and route code never do.
- */
-export declare function attachmentBlobKey(scopeId: string, attachmentId: string): string;
-/**
- * An attachment's integrity witness: the lowercase hex SHA-256 of its bytes (Web Crypto).
- * One definition for the hash an upload records and every read that holds bytes to it —
- * both adapters' `open`, and the extraction job (#1575).
- */
-export declare function attachmentSha256(body: Uint8Array): Promise<string>;
-/**
- * Write an upload's bytes to the blob store and answer the record they make (#2498) — the "bytes
- * first" half of every attachment write, one path for both adapters. The record's fields are
- * judged before a byte moves, so a record the surface would refuse lands no object. A buffer is
- * then hashed and written, as before. A stream is hashed and counted while the store reads it, so
- * it is never held whole; `sha256` is the adapter's running digest, since the kernel has none of
- * its own. The caller writes the row.
- *
- * A streamed write that fails, or whose store answers without reading the stream to its end, has
- * its object deleted and is refused: no record may witness bytes nobody saw.
- */
-export declare function putAttachmentBytes(store: TenantBlobStore, key: string, fields: AttachmentRecordFields, body: ByteBody, sha256: () => IncrementalSha256): Promise<AttachmentRecord>;
-/**
- * The bytes of an attachment the scope has already AUTHORIZED, as a stream held to its record (#2514):
- * the "bytes" half of every streamed open, one path for both adapters, as {@link putAttachmentBytes}
- * is for the write. The caller checks the read permission first and calls this only once it passed,
- * so a refused read never reaches the store.
- *
- * The length is the record's `size`, which the upload took from the bytes themselves. The store's own
- * size for the object is held to it before the first byte, so an object that is not the recorded one
- * is refused up front. The sha256 is checked as the bytes flow ({@link verifiedStream}): a mismatch
- * errors the stream before its last chunk is handed on. A store without `getStream` is read whole with
- * `get` and handed on the same way.
- */
-export declare function openAttachmentByteStream(store: TenantBlobStore, key: string, record: AttachmentRecord, sha256: () => IncrementalSha256): Promise<OpenedAttachmentStream>;
 /**
  * Who binds an operation, as the §4.3 entitlement gate needs to know it: the owning
  * module, the SKU flag its manifest declares, and the operations that module declares
@@ -4440,24 +4050,6 @@ export type RedeemedUploadLink = AttachmentRecord & {
     /** Present only on a replay (#2315): the file was stored by the request that spent the link, and nothing was written now. */
     replayed?: true;
 };
-/** An opened attachment: the metadata fact plus the bytes it witnesses. */
-export interface OpenedAttachment {
-    record: AttachmentRecord;
-    body: Uint8Array;
-    contentType: string;
-}
-/**
- * An opened attachment whose bytes are a stream (#2514): the metadata fact, and its bytes at the
- * record's `size`, read as the consumer reads them. The sha256 is checked as they pass, so a
- * mismatch errors the stream before its last chunk instead of refusing up front: a consumer that
- * has received all `size` bytes has received bytes that matched the record. One-shot: read it once,
- * or cancel it, which releases the stored object; a stream that is neither holds it until collected.
- */
-export interface OpenedAttachmentStream {
-    record: AttachmentRecord;
-    body: SizedByteStream;
-    contentType: string;
-}
 /**
  * The attachment surface a host mints per (principal, scope) — `attachmentTargets`
  * finally consumed (#473). Every method is gated INSIDE the platform by the declared
@@ -4564,111 +4156,6 @@ export interface AccessLogFilter extends ListPage {
      */
     drained?: boolean;
 }
-/**
- * How long a recorded operational failure is kept (#559). Telemetry, not evidence:
- * unlike the never-swept admin log, the ops-failures table self-prunes on write in
- * every adapter, so it can never grow without bound and needs no cron wiring or
- * operator decision. 90 days comfortably outlives any incident follow-up (a
- * Cloudflare ticket round-trip) while keeping directory storage flat.
- */
-export declare const OPS_FAILURE_RETENTION_DAYS = 90;
-/**
- * How long a sweep-run row is kept (#1232). Much shorter than ops failures: this
- * is high-frequency telemetry (a pass every few minutes times every connection
- * and schedule), and its job is the recent-runs strip plus an incident window —
- * 14 days covers both. Pruned on write in every adapter, like ops failures and
- * for the same reason: the table stays bounded even where no scheduled pass runs.
- */
-export declare const SWEEP_RUN_RETENTION_DAYS = 14;
-/**
- * The drained batch's dedupe key on the directory's `_substrat_sweep_runs` (#1232), as
- * both adapters build it: `recordSweepRun` is an `INSERT OR IGNORE` against this index,
- * which is what makes a replayed drain write nothing twice.
- *
- * `kind` is in it since #1572, and that is the fix rather than a tidy-up. Every entry of
- * one drained batch shares its `request_id`, and `unit` is built from two namespaces that
- * nothing keeps apart — `<scopeId>:<operation>` for a schedule, `<scopeId>:<eventType>`
- * for a freshness verdict — while `scheduleSpec.operation` is `z.string().min(1)`. A
- * schedule named exactly like an event type its scope expects freshness on collided on
- * `(request_id, unit)`, and the ignore-on-conflict write discarded the second row with no
- * error anywhere. Both rows are signals by their absence (a stopped evaluator, a missed
- * run), so losing one read as the very thing it was meant to rule out. It is #1288's
- * collision, in the record table beside the state table.
- *
- * Shared rather than spelled in each adapter because a directory that predates it
- * re-creates it (`ensureSweepRunsIntentKind`, in both), and `lint:spine-ddl` sees only
- * the created copy. One definition keeps the re-created shape and the created shape the
- * same shape; the gate then holds each adapter's DDL to including it.
- */
-export declare const SWEEP_RUNS_INTENT_INDEX = "CREATE UNIQUE INDEX IF NOT EXISTS _substrat_sweep_runs_intent ON _substrat_sweep_runs (request_id, kind, unit);";
-/**
- * Whether a directory's `_substrat_sweep_runs_intent` already has `kind` among its
- * columns, read off the index's `sql` in `sqlite_master` — which DO SQLite serves and
- * `PRAGMA` does not, so both adapters detect by one strategy. `false` means the index
- * must be DROPPED and created again: `CREATE … IF NOT EXISTS` matches on the name alone,
- * so on every existing directory the old `(request_id, unit)` index would otherwise
- * stand for good, while a fresh one — and any test that starts from one — gets the new.
- */
-export declare function sweepRunsIntentHasKind(indexSql: string): boolean;
-/**
- * How long an issue row outlives its last occurrence (#1233). Deliberately longer
- * than the 90-day evidence beneath it: an issue is the compressed memory of a
- * failure class, and "we saw this five months ago" is exactly what a regression
- * needs to be recognizable. Pruned on write like everything else here, and on the
- * scheduled pass (`pruneTelemetry`, #1632), so a quiet directory sheds it on time too.
- */
-export declare const ISSUE_RETENTION_DAYS = 180;
-/** What one `pruneTelemetry` call deleted, per table. */
-export interface TelemetryPruneReport {
-    opsFailures: number;
-    issues: number;
-    sweepRuns: number;
-}
-/**
- * A caller-supplied row bound, checked before it reaches a SQL `LIMIT` (#1632). SQLite reads a
- * negative `LIMIT` as no limit at all, so `-1` turns a bounded batch into an unbounded one; a
- * fractional or non-finite value is refused by SQLite itself, as a failure every later call
- * repeats. Neither is a value anyone means, so it is a configuration error, refused here with the
- * option's name, and never silently normalized into something the caller did not ask for.
- * Returns the value, so a call site can bind it in place.
- */
-export declare function assertRowLimit(name: string, value: number): number;
-/**
- * A caller-supplied row offset, checked before it reaches a SQL `OFFSET` — `assertRowLimit`'s
- * sibling. Zero is a valid offset; a negative, fractional or non-finite one is refused rather
- * than passed to SQLite, which fails the statement on it.
- */
-export declare function assertRowOffset(name: string, value: number): number;
-/** How many rows of EACH telemetry table one `pruneTelemetry` call deletes, by default. */
-export declare const TELEMETRY_PRUNE_BATCH = 500;
-/**
- * The three telemetry retentions as statements, for `pruneTelemetry` on both adapters (#1632).
- *
- * Each table already prunes on write, and that bound holds only while something is written:
- * a quiet directory keeps a row past its retention for as long as nothing new arrives in
- * that table. An issue is the case that matters. Erasure skips an issue whose exemplar owner
- * is unknown, on the promise that it ages out within `ISSUE_RETENTION_DAYS`, and on a
- * directory with no new failures nothing ever deleted it. The scheduled pass runs these
- * statements, which makes the stated retention a bound in time rather than in traffic.
- *
- * **Bounded per call, oldest first.** After a long pause or a restore the backlog can be a
- * year of sweep runs, and one unbounded DELETE over it is a pass that fails on the Durable
- * Object every tick. Each statement deletes at most `limit` rows, chosen through the table's
- * own retention index (`… WHERE rowid IN (SELECT rowid … ORDER BY <ts> LIMIT ?)`), so the
- * backlog drains over passes. `RETURNING` makes the count what was actually deleted on both
- * adapters, rather than a rows-written figure that would also count index writes.
- */
-export declare function telemetryRetentionStatements(nowMs: number, limit: number): {
-    table: keyof TelemetryPruneReport;
-    sql: string;
-    params: [string, number];
-}[];
-/**
- * One bounded retention DELETE: at most `LIMIT ?` rows whose `column` is before `?`, oldest
- * first through the column's own index, `RETURNING 1` so the count is what was deleted. Takes
- * `(horizon, limit)`. The statement `telemetryRetentionStatements` and `pruneFindings` share.
- */
-export declare function boundedRetentionDelete(table: string, column: string): string;
 /** Filter for `listIssues` (#1233). Bounded by `limit` only — see the verb's doc. */
 export interface IssueFilter {
     status?: IssueStatus;
@@ -5737,261 +5224,6 @@ export interface ScopeHost {
     defineOperation<I, O>(name: string, handler: OperationHandler<I, O>): void;
     close(): Promise<void>;
 }
-/**
- * The live-read surface (#938): one `Upgrade` in, one long-lived subscription out.
- *
- * **What crosses it is an invalidation, never a payload.** A frame names the event
- * type and the `(entityType, entityId)` it was about, and the client re-reads that
- * entity through the ordinary operation it already calls. That is what keeps the
- * change feed from quietly becoming a second, ungoverned read API: every field a
- * subscriber ever sees came back through the declared read surface, with that read's
- * own permission check, its own field-level omissions and its own PII handling.
- *
- * **Every frame is filtered per subscriber, after the commit and after the check.**
- * The host offers each committed event to each subscriber and delivers it only if
- * that subscriber passes the entity type's declared `liveTargets.readPermission` ON
- * THAT ENTITY — the same walk `ctx.check(key, entityRef)` makes, through the same
- * evaluator, so an entity-narrowed grant decides a push exactly as it decides a read.
- * An entity type no module declared reaches nobody. Knowing that a row exists and
- * changed at 14:02 is information about that row, so "the body was empty" is not a
- * defence: the filter runs whether or not there is a payload to withhold.
- *
- * A subscription may be narrowed `within` one entity (#1853), which only removes frames.
- * Two built roots replace the per-row check with one about the ROOT, and their subscribers
- * are sent bare `LiveNudge` frames that name no entity: `checkedWithin`, whose principal must
- * pass a stated key on the root at the handshake and again on every pass that has something
- * to send (#938), and `vouchedWithin`, which the vertical asserts once and nothing re-checks
- * (#1853). Which to use is on `checkedWithin`.
- *
- * **Generic over the runtime's request and response, because the kernel names
- * neither.** This package has one dependency and no DOM or workers lib
- * (`docs/architecture/dependency-policy.md`), which is why `FetchLike` above describes
- * a `fetch` structurally rather than importing one. The same rule applies here, and it
- * is load-bearing in the other direction too: what a caller gets back must be the
- * runtime's OWN response object, because a Worker's handler has to return one. A
- * structural stand-in would describe it correctly and still not be returnable. So the
- * type travels through instead of being restated — `CloudflareScopeHost` binds it to
- * the real `Request`/`Response`, and code holding the bare contract gets `unknown` back
- * and narrows at its own mount point, where it knows which host it is on.
- */
-export interface LiveReadSurface<Req extends LiveUpgradeRequest = LiveUpgradeRequest, Res = unknown> {
-    /**
-     * Accept a WebSocket `Upgrade` and subscribe the principal to the scope's changes.
-     *
-     * The caller is the vertical, and it has already done the one thing this surface
-     * cannot do for itself: resolved WHO is asking. The principal is an authenticated
-     * fact the vertical's session carries, exactly as it is for an `invoke` — this
-     * surface trusts it the same way and no further, which is why every frame is still
-     * checked against it individually rather than a subscription being authorized once.
-     *
-     * Returns the 101 to hand back to the client, or a refusal to return as-is: a
-     * request that is not an upgrade gets 426, and one arriving over a hop that cannot
-     * carry a socket gets a refusal naming that, so the client can fall back to polling
-     * KNOWINGLY. Neither is thrown, because both are answers to a client rather than
-     * faults of the caller.
-     */
-    subscribe(input: {
-        tenantId: TenantId;
-        scopeId: ScopeId;
-        /** WHO is subscribing — resolved by the vertical from its own session, never by the client. */
-        principal: PrincipalId;
-        /** The upgrade request as it arrived, carried whole so the host reads its own headers. */
-        request: Req;
-        /**
-         * Narrow the feed to one entity and what hangs beneath it (#1853).
-         *
-         * A frame is then delivered only if its entity IS this one or reaches it upward
-         * through live declared `parent` edges (what `ctx.link` / `ctx.relink` write) — the
-         * walk `ctx.check` makes, rooted here instead of at a grant.
-         *
-         * - **An `EntityRef` narrows and nothing else.** The principal's own per-frame
-         *   `liveTargets` check still runs; `within` is ANDed with it, so it can only take
-         *   frames away. A screen watching one conversation passes it to stop hearing the
-         *   rest of the desk.
-         * - **A `vouchedWithin(…)` value replaces the principal's check.** For a subscriber
-         *   confined by something other than a grant — a widget visitor holding a session
-         *   token the vertical has just redeemed. The vertical asserts access to the root,
-         *   the same trust it already extends in naming `principal`, and the scope's walk is
-         *   the whole filter. Such a subscriber receives `LiveNudge` frames only, which name
-         *   no event type and no entity.
-         * - **A `checkedWithin(…)` value replaces the per-row check with one on the root**
-         *   (#938). The principal must pass the stated key on the root, at the handshake (a
-         *   `403` otherwise) and again on every pass that has a row beneath it to announce,
-         *   so a grant withdrawn, or a root moved out from under it, closes the socket
-         *   instead of nudging it. `LiveNudge` frames only, as for a vouched root.
-         *
-         * **Freshness (Codex #2077 r5).** A decision is reused within a pass only while the
-         * scope has had no write and nothing it holds has reached its `expires_at` since the
-         * decision. It is never reused while the scope reads its permissions from the directory.
-         * Both are checked against the clock immediately before each send. A change that lands
-         * while a check is still being evaluated can let that one frame through. Frames name
-         * nothing the subscriber could not read when checked, and the next frame, pass and poll
-         * see the change: a push is a hint at most one evaluation stale.
-         */
-        within?: EntityRef | VouchedWithin | CheckedWithin;
-        /**
-         * When the credential that proved `principal` stops being valid (ISO 8601), so the
-         * socket never outlives it (#938). Pass the session's or the bearer's expiry
-         * (`AuthSubject.expiresAt`). A handshake at or past it is refused, and the scope closes
-         * the socket (`1008`) on its first pass at or past it, before sending anything on that
-         * pass. Absent: the socket lives until either end closes it, as before.
-         */
-        expiresAt?: string;
-    }): Promise<Res>;
-}
-/** The brand only `vouchedWithin` can apply — a literal cannot type-check as one. */
-declare const vouchedBrand: unique symbol;
-/**
- * A `within` root the VERTICAL vouches the subscriber may watch, in place of the
- * principal's own grants (#1853). Built only by `vouchedWithin`.
- */
-export interface VouchedWithin {
-    readonly [vouchedBrand]: true;
-    readonly entity: EntityRef;
-    /** Why the vertical vouches — what it checked. Required, and kept on the subscription. */
-    readonly because: string;
-}
-/**
- * Vouch that the subscriber may watch `entity` and everything beneath it, though the
- * principal it subscribes as holds no read on it.
- *
- * The one way to reach the replacing mode, so every use is greppable and none is an
- * accident: an object literal is refused by the type checker, and anything not built
- * here is refused by the host at run time (`isVouchedWithin`). Call it only after the
- * vertical itself has proven access — for ticket0's widget, by redeeming the session
- * token for the session it names.
- *
- * What it costs the subscriber is detail: a vouched feed carries `LiveNudge` frames, so
- * the scope never tells it which entity changed or how. Root it at an entity whose
- * subtree holds only what the subscriber may see — the walk is the whole filter.
- */
-export declare function vouchedWithin(entity: EntityRef, opts: {
-    because: string;
-}): VouchedWithin;
-/** Was this value built by `vouchedWithin`? A host asks before it drops the principal's check. */
-export declare function isVouchedWithin(value: unknown): value is VouchedWithin;
-/** The brand only `checkedWithin` can apply. */
-declare const checkedBrand: unique symbol;
-/**
- * A `within` root the PRINCIPAL must be allowed `permission` on, re-checked for as long
- * as the socket is open (#938). Built only by `checkedWithin`.
- */
-export interface CheckedWithin {
-    readonly [checkedBrand]: true;
-    readonly entity: EntityRef;
-    readonly permission: PermissionKey;
-}
-/**
- * Watch `entity` and everything beneath it, for as long as the subscriber may
- * `permission` on `entity` itself.
- *
- * For a subscriber whose grant reaches the ROOT but not each row under it the way a
- * `liveTargets` key would: ticket0's portal customer holds `conversation:read-own` on
- * their contact, which reaches the conversation's public thread, while the per-row key
- * on a message is the staff read. Rooted at an entity whose subtree is exactly what that
- * key's read returns, the walk is the row filter and the key is the gate.
- *
- * The gate is asked at the handshake (`403` if it refuses) and again, once per socket,
- * on every post-commit pass that has a row beneath the root to announce. A refusal or a
- * check that throws closes the socket (`1008`) and sends nothing on that pass, so a
- * revoked grant, a principal who is gone, or a root relinked out of the grant's reach
- * ends the subscription instead of nudging it, and the client's reconnect meets the
- * handshake's `403`. A pass with nothing beneath the root asks nothing, so an idle
- * subscription costs no checks.
- *
- * **`checkedWithin` or `vouchedWithin`?** Use `checkedWithin` whenever the subscriber is
- * a principal with a grant that reaches the root: authority leaves with the grant. Use
- * `vouchedWithin` only when there is no such grant to ask, as for ticket0's widget
- * visitor, who holds a session token rather than a principal of their own. A vouched
- * socket is asserted once, so a token revoked mid-socket keeps receiving content-free
- * nudges until the socket closes. That is known and accepted for the widget: the nudge
- * names nothing, and every re-read it causes is checked again.
- *
- * Both send `LiveNudge` frames only: the subscriber may not read each row, so it is
- * never told which one changed. Only rows of a type some module declared in
- * `liveTargets` are announced, as for every other subscriber.
- */
-export declare function checkedWithin(entity: EntityRef, permission: string): CheckedWithin;
-/** Was this value built by `checkedWithin`? */
-export declare function isCheckedWithin(value: unknown): value is CheckedWithin;
-/**
- * Is this request asking to be upgraded to a WebSocket?
- *
- * Paired with `LIVE_MODE_HEADER` (`@substrat-run/contracts`) because a vertical's live
- * route asks it first, before anything else it decides: only a WebSocket handshake is a
- * live read, and a browser always sends `Origin` on one, so everything past this check
- * can trust that a missing `Origin` did not come from a browser page. A plain GET with a
- * cookie on it cannot.
- */
-export declare function isUpgradeRequest(request: LiveUpgradeRequest): boolean;
-/**
- * The only thing this surface needs of an incoming request: its headers.
- *
- * Narrow on purpose. A live-read door reads `Upgrade` to know what is being asked for
- * and `cf-connecting-o2o` to know whether this hop can carry it, and nothing else — it
- * does not route on the path, read the body, or care about the method. Describing
- * exactly that much is what lets a test drive the door with a two-line object instead
- * of constructing a runtime request.
- */
-export interface LiveUpgradeRequest {
-    readonly headers: {
-        get(name: string): string | null;
-    };
-}
-/**
- * One frame on a live read (#938) — the wire shape, so both ends name it once.
- *
- * Deliberately not the outbox envelope. An envelope carries the payload, the
- * authorization chain, the impersonation stamp and the PII class, and none of those
- * belong on a channel whose contract is "re-read it yourself". What a subscriber
- * needs in order to act is what is here: which entity changed, and what happened to it.
- */
-export interface LiveChange {
-    /** Always `'change'` today; a field rather than an assumption, so a second kind can be added. */
-    readonly kind: 'change';
-    /**
-     * The event id — a ULID, so frames sort and a repeat is recognisable.
-     *
-     * **Not a gap detector, and a client must not use it as one.** ULIDs are ordered but
-     * not contiguous, so "the next id is not the one after this" says nothing on its own.
-     * More to the point, gaps here are the NORMAL case and the deliberate one: the
-     * permission filter withholds every event this subscriber may not read, so the ids it
-     * receives are a sparse subset of what the scope emitted, by design. A client
-     * inferring missed updates from the spacing would be reading someone else's
-     * entitlements as its own packet loss.
-     *
-     * What it is good for: ordering frames that arrive out of order, and discarding one
-     * it has already acted on. Detecting a genuinely missed update would need an
-     * authorized contiguous cursor — a per-subscriber sequence, counted after the filter —
-     * which this protocol does not have and should not grow by accident.
-     */
-    readonly id: string;
-    /** The emitted event type, e.g. `'ticket0/message-posted'`. */
-    readonly type: string;
-    readonly entityType: string;
-    readonly entityId: string;
-    /** When the event was emitted (ISO 8601), i.e. the emitting operation's instant. */
-    readonly at: string;
-}
-/**
- * What a vouched or checked subscriber is told (#1853, #938): something beneath its root
- * changed, and nothing else.
- *
- * No event type and no entity, deliberately. Such a subscriber holds no read on the
- * entities its frames are about — the vertical vouched for the ROOT, or the principal was
- * checked on the root alone, and the scope cannot know which rows under it the vertical's
- * own read would show. Naming the type
- * or the id would tell it what it never asked to read. The client re-reads, as it does
- * on a `LiveChange`.
- */
-export interface LiveNudge {
-    readonly kind: 'nudge';
-    /** The event id, as on `LiveChange` — for ordering and de-duplication only. */
-    readonly id: string;
-    readonly at: string;
-}
-/** Any frame a live read sends. */
-export type LiveFrame = LiveChange | LiveNudge;
 /**
  * Refuse a cutoff in the future — at the HostAdmin boundary, not only at the HTTP door.
  *