@wildo-ai/saas-backend-lib 1.1.2 → 1.1.4

package/dist/esm/base-classes/services/services/services-registry-handler.backend.service.js

@@ -13,7 +13,7 @@ var __param = (this && this.__param) || function (paramIndex, decorator) {
 import 'reflect-metadata';
 import { randomUUID } from 'node:crypto';
 import { injectable, inject, optional } from 'inversify';
-import { CoreResourceOperation, CoreResourceType, readBulkOperationSelectorIds, stripBulkOperationSelector, composeDefaultOperationResponse, PersistenceAdapter, selectByPersistenceAdapter, ResourcesConfig_OperationPathUtils, ErrorType, ErrorCustomMessageReference, ResourceOperationVariantType, ResourceOperationRiskLevel, ResourceOperationsUtils, DataMode, OPERATION_VARIANT_KEY, ChildLifecycleMode, ChildLifecycleStrategy, buildImpersonalizeScrubPatch, SubjectErasureDisposition, classifySubjectErasureDisposition, isBlockingSubjectErasureDisposition, SubjectExportPurpose, SubjectExportEdgeDisposition, SubjectExportFieldScope, SubjectExportFieldDecisionBasis, compileSubjectExportFieldDecisions, enumerateSubjectExportRelationshipTraversals, isIncludedSubjectExportEdgeDisposition, ResourceSystemAccessMode, ResourceOperation_ServiceRuntimeMode, ExecutionContext_ExecutionType, CoreConsumableTokenTypes, isWildoBackendError, Resources_SharedUtils, ResourceRelationshipBulkAction, ResourceRelationshipBulkActionRequestSchema, ResourceRelationshipBulkClearOperationRequestSchema, ResourceRelationshipBulkCreateOperationRequestSchema, ResourceRelationshipBulkLinkOperationRequestSchema, ResourceRelationshipBulkReplaceOperationRequestSchema, ResourceRelationshipBulkSetOperationRequestSchema, ResourceRelationshipBulkUnlinkOperationRequestSchema, ResourceGeneratedOperationKind, ResourceDataSubjectKind, } from '@wildo-ai/saas-models';
+import { CoreResourceOperation, PlatformAccessGrantScope, CoreResourceType, readBulkOperationSelectorIds, stripBulkOperationSelector, composeDefaultOperationResponse, PersistenceAdapter, selectByPersistenceAdapter, ResourcesConfig_OperationPathUtils, ErrorType, ErrorCustomMessageReference, ResourceOperationVariantType, ResourceOperationRiskLevel, ResourceOperationsUtils, DataMode, OPERATION_VARIANT_KEY, ChildLifecycleMode, ChildLifecycleStrategy, buildImpersonalizeScrubPatch, SubjectErasureDisposition, classifySubjectErasureDisposition, isBlockingSubjectErasureDisposition, SubjectExportPurpose, SubjectExportEdgeDisposition, SubjectExportFieldScope, SubjectExportFieldDecisionBasis, compileSubjectExportFieldDecisions, enumerateSubjectExportRelationshipTraversals, isIncludedSubjectExportEdgeDisposition, ResourceSystemAccessMode, ResourceOperation_ServiceRuntimeMode, ExecutionContext_ExecutionType, CoreConsumableTokenTypes, isWildoBackendError, Resources_SharedUtils, ResourceRelationshipBulkAction, ResourceRelationshipBulkActionRequestSchema, ResourceRelationshipBulkClearOperationRequestSchema, ResourceRelationshipBulkCreateOperationRequestSchema, ResourceRelationshipBulkLinkOperationRequestSchema, ResourceRelationshipBulkReplaceOperationRequestSchema, ResourceRelationshipBulkSetOperationRequestSchema, ResourceRelationshipBulkUnlinkOperationRequestSchema, ResourceGeneratedOperationKind, ResourceDataSubjectKind, resolveAuthConfig, } from '@wildo-ai/saas-models';
 import { getZodObjectShape, isAuditEvidenceField, isZodObject, unwrapSchema } from '@wildo-ai/zod-decorators';
 import { isWriteIntegrityExemptExecution } from '../../../base-classes/services/repositories/resource-write-integrity.backend.js';
 import { collectCandidateReadOnlyFields, filterChangedReadOnlyFields, stringifyPersistedValueForCompare } from '../../../base-classes/services/services/read-only-field-change.backend.utils.js';
@@ -21,13 +21,16 @@ import { AuditLogsBackendService } from '../../../compliance/audit-trails/servic
 import { resolveResourceOperationAuditDecision, resolveResourceOperationFieldEffect, } from '../../../base-classes/services/services/resource-operation-audit-emission.backend.utils.js';
 import { resolveServerInjectedFieldAllowList } from '../../../base-classes/services/services/resource-operation-server-injected-fields.backend.utils.js';
 import { buildRetentionMarkerStampPatch } from '../../../compliance/privacy/retention-hide-predicate.backend.js';
+import { CHILD_LIFECYCLE_TEARDOWN_BATCH_REF } from '../../../base-classes/services/batches/engine-custom-batch-manifests.js';
 import { SAAS_SERVICE_TYPES } from '../../../inject/models/service-types.js';
+import { AuditObservationKind, emitAuditObservation, } from '../../../monitoring/observability/audit-observation-emission.backend.js';
 import { RepositoriesRegistryHandlerBackendService } from '../../../base-classes/services/repositories/repositories-registry-handler.backend.service.js';
 import { ResourceOperationHelperBackendService } from '../../../base-classes/services/resource-operations-helper.backend.service.js';
 import { extractFunctionContextNeeds, ResourcesConfigOperationsDtosBuilderUtils, } from '@wildo-ai/saas-models';
 import { LoggerService } from '../../../monitoring/logger/services/logger.service.js';
 import { ErrorBuilderBackendService } from '../../../errors/services/error-builder.backend.service.js';
 import { describeCaughtError, projectCaughtErrorLogFields } from '../../../errors/utils/error-log-level-classification.backend.utils.js';
+import { resolveActiveMemberOrgIds } from '../../../security/authentications/services/resolve-active-member-orgs.backend.utils.js';
 import { z } from 'zod';
 import { PlatformMutualizedHandlerBackendService } from '../../../requests/service/platform-mutualized-handler.backend.service.js';
 import { ResourcesRegistryBackendService } from '../../../resources/services/resources-registry.backend.service.js';
@@ -62,6 +65,8 @@ import { PdfGenerationOrchestratorBackendService, PdfGenerationRenderPhase } fro
 import { getConfiguredPrimaryLanguage } from '../../../config/services/app-configuration.backend.utils.js';
 import { FileGenerationSource } from '@wildo-ai/zod-decorators';
 import { isUnconfinedScopeRootDirectoryRead } from '../../../security/authorizations/scope-root-collection-confinement.backend.js';
+import { collectCrossTenantReadCrossings } from '../../../security/authorizations/cross-tenant-read-observation.backend.js';
+import { getUsageMeteringService } from '../../../billing/services/custom-impl/billing-custom-implementations.backend.js';
 /**
  * Build a fresh input graph for one database-driver transaction attempt.
  *
@@ -224,12 +229,14 @@ let ServicesRegistryHandlerBackendService = class ServicesRegistryHandlerBackend
     lifecycleEvaluator;
     postgreSQLDatabaseService;
     samlMetadataService;
+    workerClientFactory;
     systemAccessService;
     subjectSessionRevocation;
     auditLogsService;
     ragSourceFieldDetection;
     ragChunkStore;
     ragIngestion;
+    auditObservationLossMetrics;
     services;
     serviceOperationsMap;
     isInitialized = false;
@@ -261,7 +268,7 @@ let ServicesRegistryHandlerBackendService = class ServicesRegistryHandlerBackend
      * `prefixCoreOperations` of custom operation impls.
      */
     preOperationHooks = new Map();
-    constructor(repositoriesRegistry, logger, errorBuilder, resourcesRegistry, repositoryHelper, customImplRegistry, resourcePersistenceUnitOfWork, externalApiHandler, platformMutualizedHandler, serverlessServicesHandler, notificationDispatcher, populationService, virtualFieldsService, mongoDBService, fileOperationHandler, fileFieldDetection, executionContextCreator, queueService, featureGate, consumableTokenService, appConfigService, pdfGenerationOrchestrator, guidanceTriggerEvaluator, milestoneEvaluator, lifecycleEvaluator, postgreSQLDatabaseService, samlMetadataService, systemAccessService, subjectSessionRevocation, auditLogsService, ragSourceFieldDetection, ragChunkStore, ragIngestion) {
+    constructor(repositoriesRegistry, logger, errorBuilder, resourcesRegistry, repositoryHelper, customImplRegistry, resourcePersistenceUnitOfWork, externalApiHandler, platformMutualizedHandler, serverlessServicesHandler, notificationDispatcher, populationService, virtualFieldsService, mongoDBService, fileOperationHandler, fileFieldDetection, executionContextCreator, queueService, featureGate, consumableTokenService, appConfigService, pdfGenerationOrchestrator, guidanceTriggerEvaluator, milestoneEvaluator, lifecycleEvaluator, postgreSQLDatabaseService, samlMetadataService, workerClientFactory, systemAccessService, subjectSessionRevocation, auditLogsService, ragSourceFieldDetection, ragChunkStore, ragIngestion, auditObservationLossMetrics) {
         this.repositoriesRegistry = repositoriesRegistry;
         this.logger = logger;
         this.errorBuilder = errorBuilder;
@@ -289,12 +296,14 @@ let ServicesRegistryHandlerBackendService = class ServicesRegistryHandlerBackend
         this.lifecycleEvaluator = lifecycleEvaluator;
         this.postgreSQLDatabaseService = postgreSQLDatabaseService;
         this.samlMetadataService = samlMetadataService;
+        this.workerClientFactory = workerClientFactory;
         this.systemAccessService = systemAccessService;
         this.subjectSessionRevocation = subjectSessionRevocation;
         this.auditLogsService = auditLogsService;
         this.ragSourceFieldDetection = ragSourceFieldDetection;
         this.ragChunkStore = ragChunkStore;
         this.ragIngestion = ragIngestion;
+        this.auditObservationLossMetrics = auditObservationLossMetrics;
         this.logger = logger;
         this.errorBuilder = errorBuilder;
         this.services = new Map();
@@ -316,6 +325,20 @@ let ServicesRegistryHandlerBackendService = class ServicesRegistryHandlerBackend
     getSystemAccessService() {
         return this.systemAccessService;
     }
+    /**
+     * Exposes backend→worker dispatch to custom-impl utils — the sanctioned way for application code
+     * to move work off the request path (#426).
+     *
+     * A GETTER rather than a `ServiceResourceBackendService` constructor parameter, for exactly the
+     * reason `getSystemAccessService` is one: that constructor is invoked POSITIONALLY from
+     * `createService` and from focused tests, so a new parameter shifts existing arguments silently.
+     *
+     * Returns `undefined` only in a minimal container that does not bind the factory; a custom impl
+     * that needs one then refuses with its own named message instead of failing at DI time.
+     */
+    getWorkerClientFactory() {
+        return this.workerClientFactory;
+    }
     /**
      * Exposes the session-revocation port to the per-resource services, whose scrub chokepoint ends an
      * erased person's sessions. A port rather than a direct dependency because `AuthTokenIssuer` already
@@ -384,6 +407,22 @@ let ServicesRegistryHandlerBackendService = class ServicesRegistryHandlerBackend
     getAuditLogsService() {
         return this.auditLogsService;
     }
+    /**
+     * The recorder that counts a DROPPED audit observation, for the two seams on
+     * `ServiceResourceBackendService` that emit fire-and-forget.
+     *
+     * A getter for exactly the reason {@link getAuditLogsService} is one: that class's constructor is
+     * invoked POSITIONALLY from `createService` and from focused tests, so a new parameter shifts
+     * existing arguments silently. The two seams therefore reach BOTH halves of their contract — the
+     * sink and the loss counter — through this handler, which is the object they already hold.
+     *
+     * Returns `undefined` in a minimal container, which degrades a lost observation to the log channel
+     * rather than to nothing. It is never a reason to refuse: an observability gap must not be able to
+     * fail the read it observes.
+     */
+    getAuditObservationLossMetricsRecorder() {
+        return this.auditObservationLossMetrics;
+    }
     // ================================
     // Initialization Methods
     // ================================
@@ -801,6 +840,59 @@ let ServicesRegistryHandlerBackendService = class ServicesRegistryHandlerBackend
             isInitialized: this.isInitialized
         };
     }
+    /**
+     * The step-up policy for this principal, with the organisation overrides its tenants declare.
+     *
+     * Returns the RAW user-type policy unchanged — with no I/O — whenever no organisation type in the
+     * application overrides step-up, which is the overwhelmingly common case and was the ONLY case
+     * before #527. An application that authors the override pays one membership list plus one read per
+     * membership, and only on an operation where step-up is already in play.
+     *
+     * Fails OPEN to the raw policy, deliberately and unlike most guards here: this resolution is a
+     * TIGHTENING of an already-enforced gate, so a failed resolve must leave the application-wide
+     * requirement standing rather than removing it. Refusing instead would turn one unreadable
+     * membership row into a 403 on every operation the user attempts.
+     */
+    async resolveEffectiveStepUpConfig(executionContext, activeUserType, authPolicy) {
+        const rawStepUp = authPolicy?.stepUpAuth;
+        if (!activeUserType)
+            return rawStepUp;
+        const userId = executionContext.initiatorIds?.userId;
+        if (!userId)
+            return rawStepUp;
+        try {
+            const activeOrgIds = await resolveActiveMemberOrgIds(this.systemAccessService, userId);
+            if (activeOrgIds.length === 0)
+                return rawStepUp;
+            const config = this.appConfigService.config;
+            const organizationTypes = config.organizationTypes ?? {};
+            const orgOverrides = [];
+            for (const organizationId of activeOrgIds) {
+                const organization = await this.systemAccessService.readAsSystem(CoreResourceType.ORGANIZATIONS, organizationId, { suppressSystemAudit: true });
+                const overrides = organization?.type ? organizationTypes[organization.type]?.authOverrides : undefined;
+                if (overrides)
+                    orgOverrides.push(overrides);
+            }
+            if (orgOverrides.length === 0 || !authPolicy || !config.auth)
+                return rawStepUp;
+            // The canonical multi-org merge — the same `resolveAuthConfig` the login path uses, so a tenant
+            // sees ONE most-restrictive answer across every organisation they belong to rather than a
+            // per-organisation one this gate would have to choose between.
+            return resolveAuthConfig({
+                userTypeAuth: authPolicy,
+                orgOverrides,
+                orgAuthMethodPolicy: config.auth.orgAuthMethodPolicy,
+                expandableOrgMethods: config.auth.expandableOrgMethods,
+            }).stepUpAuth;
+        }
+        catch (error) {
+            this.logDebug('Step-up org-override resolution failed; falling back to the raw user-type policy', {
+                activeUserType,
+                ...projectCaughtErrorLogFields(error),
+            });
+            return rawStepUp;
+        }
+    }
 };
 ServicesRegistryHandlerBackendService = __decorate([
     injectable(),
@@ -836,18 +928,22 @@ ServicesRegistryHandlerBackendService = __decorate([
     __param(25, optional()),
     __param(26, inject(SAAS_SERVICE_TYPES.SAMLMetadataService)),
     __param(26, optional()),
-    __param(27, inject(SAAS_SERVICE_TYPES.SystemAccessService)),
+    __param(27, inject(SAAS_SERVICE_TYPES.WorkerRemoteClientFactoryService)),
     __param(27, optional()),
-    __param(28, inject(SAAS_SERVICE_TYPES.SubjectSessionRevocationService)),
+    __param(28, inject(SAAS_SERVICE_TYPES.SystemAccessService)),
     __param(28, optional()),
-    __param(29, inject(SAAS_SERVICE_TYPES.AuditLogsService)),
+    __param(29, inject(SAAS_SERVICE_TYPES.SubjectSessionRevocationService)),
     __param(29, optional()),
-    __param(30, inject(SAAS_SERVICE_TYPES.RagSourceFieldDetectionService)),
+    __param(30, inject(SAAS_SERVICE_TYPES.AuditLogsService)),
     __param(30, optional()),
-    __param(31, inject(SAAS_SERVICE_TYPES.RagChunkStoreService)),
+    __param(31, inject(SAAS_SERVICE_TYPES.RagSourceFieldDetectionService)),
     __param(31, optional()),
-    __param(32, inject(SAAS_SERVICE_TYPES.RagIngestionService)),
+    __param(32, inject(SAAS_SERVICE_TYPES.RagChunkStoreService)),
     __param(32, optional()),
+    __param(33, inject(SAAS_SERVICE_TYPES.RagIngestionService)),
+    __param(33, optional()),
+    __param(34, inject(SAAS_SERVICE_TYPES.MetricsService)),
+    __param(34, optional()),
     __metadata("design:paramtypes", [RepositoriesRegistryHandlerBackendService,
         LoggerService,
         ErrorBuilderBackendService,
@@ -871,7 +967,7 @@ ServicesRegistryHandlerBackendService = __decorate([
         GuidanceTriggerEvaluatorBackendService,
         MilestoneEvaluatorBackendService,
         LifecycleEvaluatorBackendService,
-        PostgreSQLDatabaseBackendService, Function, Function, Function, AuditLogsBackendService, Function, Function, Function])
+        PostgreSQLDatabaseBackendService, Function, Function, Function, Function, AuditLogsBackendService, Function, Function, Function, Object])
 ], ServicesRegistryHandlerBackendService);
 export { ServicesRegistryHandlerBackendService };
 //============================================================================================================================
@@ -2020,6 +2116,32 @@ export class ServiceResourceBackendService {
      * Failing either trigger throws STEP_UP_REQUIRED (HTTP 403); the frontend HTTP client catches that
      * status, obtains a token through its registered step-up handler, and replays the request.
      */
+    /**
+     * Whether ANY organisation type in this application authors a `stepUpAuth` override.
+     *
+     * A pure fold over static configuration, memoized for the process because application
+     * configuration does not change under a running backend. It is the switch that keeps
+     * `enforceStepUpAuth` free for every application that has not adopted the override (#527): when
+     * this is false, the organisation-merged step-up policy EQUALS the raw user-type policy by
+     * construction, so there is nothing to resolve and nothing to read.
+     */
+    organizationTypesOverrideStepUpAuthCache = undefined;
+    anyOrganizationTypeOverridesStepUpAuth() {
+        /*
+         * `undefined` rather than `null` for "not yet computed", and the difference is not stylistic:
+         * this class is instantiated with `Object.create(prototype)` in its own pin harnesses, which
+         * does NOT run field initializers. A `=== null` guard therefore never matched there, the fold
+         * silently returned `undefined`, and every test took the fast path while appearing to exercise
+         * the switch. Caught by probing the branch rather than by any assertion — the fold was inert in
+         * exactly the harness a future override pin would have been written in.
+         */
+        if (this.organizationTypesOverrideStepUpAuthCache === undefined) {
+            const organizationTypes = this.appConfigService.config?.organizationTypes ?? {};
+            this.organizationTypesOverrideStepUpAuthCache = Object.values(organizationTypes)
+                .some((definition) => definition?.authOverrides?.stepUpAuth !== undefined);
+        }
+        return this.organizationTypesOverrideStepUpAuthCache;
+    }
     async enforceStepUpAuth(coreOperation, executionContext, options, operation) {
         if (executionContext.executionType !== ExecutionContext_ExecutionType.USER_REQUEST)
             return;
@@ -2034,7 +2156,40 @@ export class ServiceResourceBackendService {
         const authPolicy = activeUserType
             ? this.appConfigService.getUserTypeAuthPolicy(activeUserType)
             : undefined;
-        const stepUpConfig = authPolicy?.stepUpAuth;
+        /*
+         * The ORGANISATION-MERGED step-up policy, resolved only when an organisation could actually
+         * change the answer (#527).
+         *
+         * Until 2026-09-09 an organisation type could tighten `mfaPolicy` and `passwordPolicy` but not
+         * re-authentication freshness — the override did not exist — so reading the raw user-type policy
+         * here was correct. Now that it does, reading the raw policy would drop a tenant's tightened
+         * window, which is the defect the other three overrides exist to prevent.
+         *
+         * ## Why this is not a per-request read
+         *
+         * This gate runs on EVERY user-request operation, and the exact resolver
+         * (`resolveEffectiveAuthPolicy`) lists the user's memberships and then reads one organisation
+         * PER membership. That is unaffordable here, and the cheap alternative is unavailable: the
+         * execution context carries an `organizationId` but no organisation TYPE, so even the pure
+         * org-type resolver would need a read to find its own input.
+         *
+         * So the cost is made PROPORTIONAL TO USE instead. `anyOrganizationTypeOverridesStepUpAuth` is a
+         * pure fold over static application configuration: when no organisation type in the application
+         * authors a `stepUpAuth` override — the case for every application that has not adopted this —
+         * the merged policy is the raw policy BY CONSTRUCTION, and this gate keeps exactly the zero-I/O
+         * behaviour it had before. Only an application that actually authors the override pays, and only
+         * on the operations where step-up is already in play.
+         */
+        const rawStepUpConfig = authPolicy?.stepUpAuth;
+        /*
+         * The fast path is LOCAL and dependency-free, which is the whole point: an application whose
+         * organisation types author no `stepUpAuth` override cannot have a merged policy that differs
+         * from the raw one, so it never reaches the registry and never performs a read. Every
+         * application behaves exactly as it did before #527 until it adopts the override.
+         */
+        const stepUpConfig = this.anyOrganizationTypeOverridesStepUpAuth()
+            ? await this.servicesRegistry.resolveEffectiveStepUpConfig(executionContext, activeUserType, authPolicy)
+            : rawStepUpConfig;
         // Neither trigger fires → nothing to enforce.
         if (!operationRequiresStepUp && !stepUpConfig?.enabled)
             return;
@@ -2459,7 +2614,32 @@ export class ServiceResourceBackendService {
             || coreOperation === CoreResourceOperation.DELETE
             || coreOperation === CoreResourceOperation.DELETE_MANY;
         const skipCorePersistenceForTargetlessReplace = willReplaceCore && coreMutationRequiresTarget && !target;
-        coreState = skipCorePersistenceForTargetlessReplace
+        /*
+         * A CREATE-borrowing REPLACE op must not run the core create either, and for a STRONGER reason
+         * than the targetless case above.
+         *
+         * An op borrows `CoreResourceOperation.CREATE` to obtain the collection-POST route shape — a
+         * request that carries a body but addresses no instance — while its replace impl does the real
+         * work and the core result is discarded. Running the core create anyway has two outcomes, both
+         * wrong, and CREATE is the one verb where neither is a tolerated near-no-op:
+         *
+         *   - the op's own narrow request contract does not satisfy the resource's persistence schema,
+         *     so the core create fails on missing required fields and the caller gets an opaque
+         *     `repository_resource_operation_failed` — the replace handler never runs. This is
+         *     `auditLogs | exportAuditLogs`, which had never once succeeded (#319): its request is an
+         *     export FILTER, and an audit row's required fields are nothing a filter would carry.
+         *   - or the contract happens to satisfy it, and the core create INSERTS A SPURIOUS ROW that is
+         *     then thrown away. A phantom write is worse than the failure, because nothing reports it.
+         *
+         * Measured before changing: of the six operations that borrow CREATE, exactly one also declares
+         * REPLACE — so this changes the behaviour of one operation that was unreachable, and forecloses
+         * the phantom write for any future one. The sibling guard above deliberately lists only the
+         * target-requiring mutations; CREATE needs its own condition because it requires no target and
+         * would never satisfy `!target`.
+         */
+        const skipCorePersistenceForCreateBorrowingReplace = willReplaceCore
+            && coreOperation === CoreResourceOperation.CREATE;
+        coreState = skipCorePersistenceForTargetlessReplace || skipCorePersistenceForCreateBorrowingReplace
             ? undefined
             : await this.executeCorePersistenceOperation({
                 operation,
@@ -2611,6 +2791,20 @@ export class ServiceResourceBackendService {
             ? currentState.resource
             : currentState;
         await this.dispatchNotifications(executionContext, inputData, notificationCurrentState, transactionallyPreparedTokenGenerationResult, preOperationState);
+        /*
+         * METERED USAGE seam (#415). Sits in this chokepoint for the same reason the RAG ingestion hook
+         * below does: it is the one post-commit point every service-tier write door reaches, so an
+         * operation that consumes a metered product is billed whether it arrived through create, update,
+         * a custom operation, a system write or a nested mutation.
+         *
+         * FIRE-AND-FORGET, like the evaluators above it. The write has already committed, so failing the
+         * caller's operation because a usage row could not be written would trade a billing gap for an
+         * outage — and the metering service already refuses in silence with a warning naming the product.
+         *
+         * `getUsageMeteringService()` returns null when billing is not configured, so an application
+         * without billing pays one null check per write and the whole path is inert.
+         */
+        this.recordDeclaredMeteredUsage(executionContext, notificationCurrentState);
         // RAG INGESTION seam — the service-tier CHANGED-FIELD hook (plan §3.c / H1). Sits in THIS
         // chokepoint because it is the one post-commit point every service-tier write door reaches
         // (create/createMany/update/updateMany, system writes, custom operations, nested mutations, on
@@ -2742,9 +2936,26 @@ export class ServiceResourceBackendService {
             // A bulk write names a COUNT rather than an id; a singular write names the row. Reading the
             // id off the post-state (falling back to the pre-image) covers DELETE, whose post-state may
             // not echo the row.
+            //
+            // The fallback is on the ABSENCE OF AN ID, not on the absence of a post-state — and that
+            // distinction is the whole of it. A custom operation may declare a `customResponseDto`, and
+            // its POSTFIX then hands back the RESPONSE rather than the row: a truthy object with no `_id`
+            // at all. `?? preOperationState` never fires for one, so the emitted row named no subject.
+            //
+            // Measured 2026-09-10 against a live application: of 282 `RESOURCE_OPERATION_PERFORMED` rows,
+            // 276 carried `eventData.resourceId` and the SIX that did not were exactly the operations
+            // that reshape their response — all five `organizationSsoConfig` domain-ownership calls, plus
+            // one `organizations` lifecycle verb. Those are privileged, cross-tenant-reaching
+            // configuration changes, and their trail could not say WHICH row moved, so any SIEM rule or
+            // query keyed on `resourceId` silently skipped them (issue #542's own audit claim).
+            //
+            // Still UNDEFINED for a bulk write, deliberately: the fallback is reached only on the
+            // singular path, so a bulk operation cannot start naming one row out of the many it touched.
             const isBulk = Array.isArray(postOperationState);
-            const singularState = (isBulk ? undefined : postOperationState) ?? preOperationState;
-            const resourceId = this.extractPersistedResourceId((singularState ?? {}));
+            const resourceId = isBulk
+                ? undefined
+                : this.extractPersistedResourceId((postOperationState ?? {}))
+                    ?? this.extractPersistedResourceId((preOperationState ?? {}));
             await auditLogsService.logResourceOperationPerformed({
                 riskLevel: operation.riskLevel ?? ResourceOperationRiskLevel.LOW,
                 actorUserId: executionContext.initiatorIds?.userId,
@@ -3180,6 +3391,7 @@ export class ServiceResourceBackendService {
             serverlessServicesHandler: this.serverlessServicesHandler,
             executionContextCreator: this.executionContextCreator,
             systemAccessService: this.servicesRegistry.getSystemAccessService?.(),
+            workerClientFactory: this.servicesRegistry.getWorkerClientFactory?.(),
             samlMetadataService: this.servicesRegistry.getSamlMetadataService?.(),
             objectContext: {
                 parents: computationContext.objectContext?.parents || {},
@@ -3543,10 +3755,10 @@ export class ServiceResourceBackendService {
         // 2. The validation doesn't check if the user has permission to link the specific
         //    file - only that the file exists and is in UPLOADED status.
         //
-        // 3. For PostgreSQL resources, file metadata lookup still uses MongoDB,
-        //    which could have latency implications.
-        //
-        // See: .cursor/plans for file/storage context
+        // 3. File metadata is no longer pinned to MongoDB: FILES declares no
+        //    `persistenceAdapter` and follows the application's default, so on a
+        //    PostgreSQL application this lookup is a PostgreSQL read on the same
+        //    adapter as the parent row. Do not reason from a cross-adapter lookup here.
         // ============================================================================
         const generatedPdfMaterializations = [];
         let enrichedData;
@@ -3882,6 +4094,7 @@ export class ServiceResourceBackendService {
         // 3. Apply business context enrichment
         const enrichedResult = await this.enrichBusinessContext(CoreResourceOperation.READ, processedResult, executionContext);
         this.logDebug('Read business operation completed', { dataMode });
+        this.recordCrossTenantReadAccess(operation, executionContext, CoreResourceOperation.READ, enrichedResult);
         return enrichedResult;
     }
     async update(operation, executionContext, id_or_ids_or_filter, data, options) {
@@ -4052,7 +4265,7 @@ export class ServiceResourceBackendService {
                 },
             });
         }
-        this.assertGeneratedFileMaterializationCommitsWithRow(resourceType, executionContext, 'Generated PDF regenerate is not yet supported for PostgreSQL-backed resources because FILES metadata is Mongo-backed and cannot be swapped atomically with the parent row.', { fieldName });
+        this.assertGeneratedFileMaterializationCommitsWithRow(resourceType, executionContext, 'Generated PDF regenerate requires the replacement file metadata to be swapped in the same transaction as the parent row, and this resource does not resolve to the same persistence adapter as the FILES resource, so that boundary cannot commit atomically. FILES follows the application default adapter; see resourceAdapterMap for the adapters involved.', { fieldName });
         const generated = await this.pdfGenerationOrchestrator.generateForField({
             resourceType,
             parentRecord: currentObject,
@@ -4542,6 +4755,7 @@ export class ServiceResourceBackendService {
             const enrichedData = await Promise.all(processedData.map((item) => this.enrichBusinessContext(CoreResourceOperation.LIST, item, executionContext)));
             this.logDebug('List business operation completed (paginated)', { count: enrichedData.length, pagination: result.pagination, dataMode });
             this.recordPlatformDirectoryAccess(operation, executionContext, CoreResourceOperation.LIST, enrichedData.length);
+            this.recordCrossTenantReadAccess(operation, executionContext, CoreResourceOperation.LIST, enrichedData);
             return { data: enrichedData, pagination: result.pagination };
         }
         else {
@@ -4551,6 +4765,7 @@ export class ServiceResourceBackendService {
             const enrichedData = await Promise.all(processedData.map((item) => this.enrichBusinessContext(CoreResourceOperation.LIST, item, executionContext)));
             this.logDebug('List business operation completed (raw)', { count: enrichedData.length, dataMode });
             this.recordPlatformDirectoryAccess(operation, executionContext, CoreResourceOperation.LIST, enrichedData.length);
+            this.recordCrossTenantReadAccess(operation, executionContext, CoreResourceOperation.LIST, enrichedData);
             return enrichedData;
         }
     }
@@ -4575,6 +4790,19 @@ export class ServiceResourceBackendService {
      * down, and a fail-closed variant would hand anyone a way to disable an administrative surface by
      * breaking the sink. Feature-detected against the service so a partial DI binding (unit suites,
      * minimal containers) cannot turn an observation into a crash.
+     *
+     * ## The drop is COUNTED
+     *
+     * Emission goes through {@link emitAuditObservation}, so an observation that never reaches the
+     * pipeline lands on `audit_observation_dropped_total` rather than nowhere. The feature detection
+     * therefore decides an ARGUMENT: handing the seam `undefined` is how this site reports
+     * `SERVICE_UNAVAILABLE`, and an early return there would restore the silence — which is the whole
+     * defect, because an empty directory-access trail reads as "nobody enumerated anything".
+     *
+     * Both suppressions above stay ABOVE that emission and are deliberately NOT counted: an unknown
+     * resource configuration and a read the confinement authority DID confine are cases where nothing
+     * was owed. Counting them would fire the loss signal on correct behaviour, and a signal that fires
+     * on correct behaviour is one operators learn to ignore.
      */
     recordPlatformDirectoryAccess(operation, executionContext, executedCoreOperation, returnedCount) {
         try {
@@ -4591,19 +4819,155 @@ export class ServiceResourceBackendService {
             }))
                 return;
             const auditLogsService = this.servicesRegistry?.getAuditLogsService?.();
-            if (typeof auditLogsService?.logPlatformDirectoryAccess !== 'function')
+            const emitter = typeof auditLogsService?.logPlatformDirectoryAccess === 'function'
+                ? auditLogsService
+                : undefined;
+            emitAuditObservation({
+                observation: AuditObservationKind.PLATFORM_DIRECTORY_ACCESS,
+                emit: emitter
+                    ? () => emitter.logPlatformDirectoryAccess({
+                        resourceType: String(operation.resourceIdentifier),
+                        operationIdentifier: String(operation.operationIdentifier),
+                        variantType: operation.variantType,
+                        variantKey: operation.variantKey,
+                        returnedCount,
+                        initiatorRoles: (executionContext.initiatorRoles ?? []).flatMap((roleInfo) => roleInfo.roles ?? []),
+                        executionType: executionContext.executionType,
+                        actorUserId: executionContext.initiatorIds?.userId,
+                        applicationId: executionContext.initiatorIds?.applicationId,
+                        // The elevation the authorizer admitted this read under, stamped on the context by
+                        // `enforceApplicationWideReadAdmission`. Until 2026-09-09 this event named NO elevation
+                        // because none was required — the directory read was gated on a role alone while the far
+                        // narrower per-row crossing required a grant. Reading it off the context rather than
+                        // re-resolving it is what keeps the evidence and the admission describing the SAME grant.
+                        authorizingGrantId: executionContext
+                            .authorizingApplicationAccessGrantId,
+                        authorizingGrantScope: executionContext
+                            .authorizingApplicationAccessGrantId
+                            ? PlatformAccessGrantScope.APPLICATION_WIDE
+                            : undefined,
+                    }, executionContext)
+                    : undefined,
+                metricsResolver: () => this.servicesRegistry?.getAuditObservationLossMetricsRecorder?.(),
+                logger: this.logger,
+                // The SIZE is what the lost row was for — an operator who opened the directory and one who
+                // exported it produce the same record without it, so it belongs in the loss line too.
+                context: {
+                    observedResourceType: String(operation.resourceIdentifier),
+                    observedOperationIdentifier: String(operation.operationIdentifier),
+                    observedReturnedCount: returnedCount,
+                    observedActorUserId: executionContext.initiatorIds?.userId,
+                },
+            });
+        }
+        catch {
+            /* observation only */
+        }
+    }
+    /**
+     * Record a READ that crossed the tenant boundary — one row per TENANT reached.
+     *
+     * assurance-control: WILDO.ACCESS.CROSS_TENANT_ADMINISTRATION — an operator read of another
+     * tenant's rows leaves evidence in that tenant's own trail.
+     *
+     * ## Why here, and not in the authorizer
+     *
+     * `authorizeOrganizations` emits the same event, but it only runs for ORGANIZATIONS-scoped
+     * resources and it decides on ONE fetched row. An APPLICATION-scoped door returns a SET whose rows
+     * belong to many tenants, and the authorizer never sees it. This seam has the operation, the
+     * execution context and the rows, and is adapter-neutral — the same three reasons
+     * {@link recordPlatformDirectoryAccess} sits here.
+     *
+     * ## Fire-and-forget, deliberately
+     *
+     * No `await`, and the rejection is swallowed — the same contract as its two siblings. An operator's
+     * read must not fail because the audit sink is down, and a fail-closed variant would hand anyone a
+     * way to disable an administrative surface by breaking the sink.
+     *
+     * The service is also feature-DETECTED, matching its two siblings. Stated honestly: the outer
+     * `catch` below would contain an absent-method `TypeError` anyway, so this check is defence in
+     * depth rather than the only thing standing between a partial DI binding (unit suites, minimal
+     * containers, a host binding an older audit service) and a thrown observer. What it buys is that
+     * such a binding is a NO-OP rather than an exception path — a swallowed `TypeError` looks exactly
+     * like a swallowed real defect. An observer must never be able to fail the request it observes.
+     *
+     * ## The drop is COUNTED, on the SAME member as the authorizer's half
+     *
+     * Emission goes through {@link emitAuditObservation} under
+     * `AuditObservationKind.CROSS_TENANT_ADMINISTRATIVE_ACCESS` — the member the per-instance gate
+     * already uses, deliberately. A member names the EVIDENCE rather than the emitter, so *how much
+     * cross-tenant evidence did we lose?* stays one number instead of a sum somebody has to remember
+     * to widen. WHICH door dropped it is in the loss line's context.
+     *
+     * One observation per CROSSING, so a lost set of ten tenants counts ten — the loss signal is then
+     * proportional to the evidence actually lost rather than to the number of reads. `crossings.length
+     * === 0` stays ABOVE it: no crossing is nothing owed, not a loss.
+     */
+    recordCrossTenantReadAccess(operation, executionContext, executedCoreOperation, rows) {
+        try {
+            const resourceConfiguration = this.resourcesRegistry?.getResourceConfiguration?.(operation.resourceIdentifier);
+            if (!resourceConfiguration)
                 return;
-            void auditLogsService.logPlatformDirectoryAccess({
-                resourceType: String(operation.resourceIdentifier),
-                operationIdentifier: String(operation.operationIdentifier),
-                variantType: operation.variantType,
-                variantKey: operation.variantKey,
-                returnedCount,
-                initiatorRoles: (executionContext.initiatorRoles ?? []).flatMap((roleInfo) => roleInfo.roles ?? []),
-                executionType: executionContext.executionType,
-                actorUserId: executionContext.initiatorIds?.userId,
-                applicationId: executionContext.initiatorIds?.applicationId,
-            }, executionContext).catch(() => { });
+            const crossings = collectCrossTenantReadCrossings({
+                executionContext: executionContext,
+                // The EXECUTED variant, for both halves of the decision — see the authority's JSDoc. Reading
+                // enrolment from here and `admissionDeclared` from anywhere else is how the trail would come
+                // to describe a read the observation never actually admitted.
+                operation: operation,
+                resourceConfiguration: resourceConfiguration,
+                executedCoreOperation,
+                rows,
+            });
+            if (crossings.length === 0)
+                return;
+            const auditLogsService = this.servicesRegistry?.getAuditLogsService?.();
+            const emitter = typeof auditLogsService?.logCrossTenantAdministrativeAccess === 'function'
+                ? auditLogsService
+                : undefined;
+            const initiatorRoles = (executionContext.initiatorRoles ?? []).flatMap((roleInfo) => roleInfo.roles ?? []);
+            for (const crossing of crossings) {
+                emitAuditObservation({
+                    observation: AuditObservationKind.CROSS_TENANT_ADMINISTRATIVE_ACCESS,
+                    emit: emitter
+                        ? () => emitter.logCrossTenantAdministrativeAccess({
+                            operatorUserId: executionContext.initiatorIds?.userId,
+                            targetOrganizationId: crossing.targetOrganizationId,
+                            resourceType: String(operation.resourceIdentifier),
+                            operationIdentifier: String(operation.operationIdentifier),
+                            variantType: operation.variantType,
+                            variantKey: operation.variantKey,
+                            targetResourceIds: crossing.targetResourceIds.length > 0 ? crossing.targetResourceIds : undefined,
+                            // TWO elevations can authorise a crossing and they live in two collections, so the id
+                            // alone is not resolvable — hence the paired scope. The TENANT grant wins when both are
+                            // present: it is the narrower, customer-approvable authority, and naming the wider one
+                            // beside it would overstate what the read was admitted under.
+                            authorizingGrantId: executionContext.authorizingPlatformAccessGrantId
+                                ?? executionContext.authorizingApplicationAccessGrantId,
+                            authorizingGrantScope: executionContext.authorizingPlatformAccessGrantId
+                                ? PlatformAccessGrantScope.TENANT
+                                : (executionContext.authorizingApplicationAccessGrantId
+                                    ? PlatformAccessGrantScope.APPLICATION_WIDE
+                                    : undefined),
+                            // Always true by construction — only a DECLARED crossing is observed, so the trail never
+                            // describes a completed read with the token that means "attempted and refused". Read from
+                            // the operation rather than hard-coded, so the two can never drift apart.
+                            admissionDeclared: operation.admitsCrossTenantPlatformAdministration === true,
+                            initiatorRoles,
+                            executionType: executionContext.executionType,
+                        })
+                        : undefined,
+                    metricsResolver: () => this.servicesRegistry?.getAuditObservationLossMetricsRecorder?.(),
+                    logger: this.logger,
+                    // The operator and the TENANT reached are the two identities the audit row would have
+                    // carried, and the pair a reviewer needs to reconstruct one lost crossing.
+                    context: {
+                        observedResourceType: String(operation.resourceIdentifier),
+                        observedOperationIdentifier: String(operation.operationIdentifier),
+                        observedTargetOrganizationId: crossing.targetOrganizationId,
+                        observedOperatorUserId: executionContext.initiatorIds?.userId,
+                    },
+                });
+            }
         }
         catch {
             /* observation only */
@@ -4628,6 +4992,34 @@ export class ServiceResourceBackendService {
         // 4. Return result with enriched data (transformation happens in doOperation)
         const processedResult = { ...result, data: enrichedData };
         this.logDebug('Search business operation completed', { count: enrichedData.length });
+        // SEARCH is a directory enumeration exactly as LIST is, and it was the site this invariant
+        // MISSED. `SCOPE_ROOT_CONFINED_OPERATIONS` names SEARCH, the event schema's own
+        // `operationIdentifier` JSDoc names `search` as a collection verb it carries, and
+        // `isUnconfinedScopeRootDirectoryRead` answers `true` for it — only this seam never asked.
+        //
+        // The cost was not theoretical and lands on the widest read in the system. `users search admin`
+        // is THE operator directory surface (it is the one that declares `searchableFields`,
+        // `filterFields`, `sortFields` and a 200-row page, and it is what an admin UI's user list is
+        // built on), while `users list admin` is the unparameterised sibling. So the verb an operator
+        // actually reaches for left nothing behind, and an empty directory-access trail reads as
+        // "nobody enumerated anything" — the precise failure the event exists to prevent. The collection
+        // EXPORT door inherits the fix for free: it pages through this same seam.
+        //
+        // It survived because the e2e lane DRIVES this exact call (`platform-directory-access.e2e.ts`
+        // D-1g) to prove a pagination ceiling, and asserts the audit row only for LIST — an exercised
+        // site with no assertion on it. `.claude/rules/invariant-call-site-enumeration.md`.
+        //
+        // `operation`, not `resolvedOperation`, matching the LIST seam and the sibling recorder one line
+        // below. Two conventions for "which operation object" in one file is how a trail and a gate come
+        // to disagree about which variant ran.
+        //
+        // COUNT is still deliberately NOT recorded, and that is unchanged: `returnedCount` means rows the
+        // caller RECEIVED, and a COUNT returns none while disclosing a size. Recording 0 would be false
+        // and recording the total would redefine the field. Should a count ever be treated as a
+        // disclosure it needs an event carrying a number, which is the same conclusion the cross-tenant
+        // read observation reached for its own COUNT exclusion.
+        this.recordPlatformDirectoryAccess(operation, executionContext, CoreResourceOperation.SEARCH, enrichedData.length);
+        this.recordCrossTenantReadAccess(operation, executionContext, CoreResourceOperation.SEARCH, enrichedData);
         return processedResult;
     }
     async count(operation, executionContext, filter, options) {
@@ -4723,7 +5115,7 @@ export class ServiceResourceBackendService {
         this.logDebug('transformOutput - before validation', {
             dataKeys: data && typeof data === 'object' && !Array.isArray(data) ? Object.keys(data) : 'not plain object',
             hasUserSelfProfile: data && typeof data === 'object' ? 'userSelfProfile' in data : false,
-            hasUserSelfPreference: data && typeof data === 'object' ? 'userSelfPreference' in data : false,
+            hasUserSelfPreferences: data && typeof data === 'object' ? 'userSelfPreferences' in data : false,
             hasOrgMembers: data && typeof data === 'object' ? 'organizationMembers' in data : false
         });
         try {
@@ -4792,7 +5184,7 @@ export class ServiceResourceBackendService {
             this.logDebug('transformOutput - after validation', {
                 dataKeys: transformedData && typeof transformedData === 'object' && !Array.isArray(transformedData) ? Object.keys(transformedData) : 'not plain object',
                 hasUserSelfProfile: transformedData && typeof transformedData === 'object' ? 'userSelfProfile' in transformedData : false,
-                hasUserSelfPreference: transformedData && typeof transformedData === 'object' ? 'userSelfPreference' in transformedData : false,
+                hasUserSelfPreferences: transformedData && typeof transformedData === 'object' ? 'userSelfPreferences' in transformedData : false,
                 hasOrgMembers: transformedData && typeof transformedData === 'object' ? 'organizationMembers' in transformedData : false
             });
             this.logDebug('Output transformation successful');
@@ -5908,7 +6300,7 @@ export class ServiceResourceBackendService {
         if (this.getGeneratedPdfFileFields(resourceType).length === 0) {
             return;
         }
-        this.assertGeneratedFileMaterializationCommitsWithRow(resourceType, executionContext, 'Generated PDF creation is not yet supported for PostgreSQL-backed resources because FILES metadata is Mongo-backed and cannot be committed atomically with the parent row.');
+        this.assertGeneratedFileMaterializationCommitsWithRow(resourceType, executionContext, 'Generated PDF creation requires the file metadata to be committed in the same transaction as the parent row, and this resource does not resolve to the same persistence adapter as the FILES resource, so that boundary cannot commit atomically. FILES follows the application default adapter; see resourceAdapterMap for the adapters involved.');
     }
     async materializeGeneratedPdfFieldsForCreate(data, resourceType, executionContext, options) {
         const generatedPdfFields = this.getGeneratedPdfFileFields(resourceType);
@@ -8311,20 +8703,118 @@ export class ServiceResourceBackendService {
             return rows;
         return rows.map((row) => this.omitPathsFromValue(row, excludedPaths));
     }
+    /**
+     * Defer one relationship edge's teardown onto the custom-batch queue — the runtime behind
+     * `ChildLifecycleMode.LAZY` (#427).
+     *
+     * ## What is deferred is the WHOLE teardown, not a delete
+     *
+     * The job carries the two resource types and the parent ids; it carries no rows, no relationship
+     * object and no child ids. `runDeferredChildLifecycleTeardown` re-derives the edge from the
+     * PARENT'S CURRENT CONFIGURATION at consumption time and calls `deleteChildrenImmediate` — the
+     * same method IMMEDIATE mode calls. That is deliberate and it is what makes the mode honest:
+     *
+     *   - **rag-removal-gate: INHERITED.** The chunk removal is the last step of that method
+     *     (`runRagChunkRemovalForDeletedRows`), so a deferred teardown cannot skip it without the
+     *     immediate one skipping it too. The obligation this method's previous comment handed to
+     *     "whoever implements it" is discharged by not having a second implementation at all.
+     *   - grandchild recursion, file orchestration and the repository delete come along for the same
+     *     reason.
+     *   - discovery happens LATER, against the rows that exist then — which is the point of LAZY. A
+     *     job carrying a child-id list would have frozen the answer at enqueue time.
+     *
+     * ## Enqueue failure is FATAL to the parent delete, on purpose
+     *
+     * If the job cannot be published, this throws and the parent's delete fails. The alternative —
+     * log and continue — leaves orphaned children with no record that anything is owed, which is
+     * exactly the silent data problem the fail-closed refusal here used to prevent. LAZY moves WHEN
+     * the teardown happens; it does not make it optional.
+     */
     async queueChildDeletion(relationship, parentIds, executionContext) {
-        // rag-removal-gate: N/A — LAZY cascade deletion is UNIMPLEMENTED (this method only throws).
-        // Whoever implements it inherits the chunk-removal obligation: the deferred teardown must call
-        // runRagChunkRemovalForDeletedRows for the child rows it eventually deletes, exactly as
-        // deleteChildrenImmediate does — a queued delete that skips it strands the children's chunks
-        // until the backstop sweep.
-        throw this.errorBuilder.buildError(ErrorType.INTERNAL, executionContext, {
-            customMessageReference: ErrorCustomMessageReference.SERVICE_RESOURCE_OPERATION_FAILED,
-            context: {
-                message: 'LAZY cascade mode requires queue system integration. Queue system implementation pending. See Phase 6.1-6.2 for implementation details.',
-                relationship: relationship.resourceType2,
-                parentIds,
-            },
+        const childResourceType = relationship.resourceType2;
+        const parentResourceType = this.resourceConfiguration.resourceIdentifier;
+        if (!this.queueService) {
+            throw this.errorBuilder.buildError(ErrorType.CONFIGURATION, executionContext, {
+                customMessageReference: ErrorCustomMessageReference.SERVICE_RESOURCE_OPERATION_FAILED,
+                context: {
+                    message: 'LAZY child lifecycle requires the queue service, which is not bound in this runtime. '
+                        + 'Declare the relationship with ChildLifecycleMode.IMMEDIATE, or run this operation in a '
+                        + 'host that has the queue.',
+                    parentResourceType,
+                    childResourceType,
+                },
+            });
+        }
+        const enqueued = await this.queueService.enqueueCustomBatch(CHILD_LIFECYCLE_TEARDOWN_BATCH_REF, {
+            parentResourceType,
+            childResourceType,
+            parentIds,
         });
+        this.logDebug('Child lifecycle teardown deferred to the queue', {
+            jobId: enqueued.jobId,
+            parentResourceType,
+            childResourceType,
+            parentIdsCount: parentIds.length,
+        });
+        // TRUE per the dispatcher's `@returns` contract: this edge was processed. The erasure receipt
+        // reads that as "the teardown ran", which for LAZY means "the teardown is owed and recorded",
+        // and the job is durable with a dead-letter queue behind it.
+        return true;
+    }
+    /**
+     * Run a deferred child-lifecycle teardown — the consumer half of {@link queueChildDeletion} (#427).
+     *
+     * Public because the custom-batch executor is the caller and it reaches this service through
+     * `ServicesRegistryHandlerBackendService.getService(parentResourceType)`. It is the ONLY public
+     * entry to the cascade, and it re-checks the configuration rather than trusting the job:
+     *
+     *   - the edge must still exist on the parent and still declare `onParentDelete.enabled`;
+     *   - it must still be `DELETE` + `LAZY`.
+     *
+     * A configuration that changed between enqueue and consumption therefore does NOT get the old
+     * behaviour replayed. Refusing is right rather than adapting: if the edge became IMMEDIATE the
+     * parent delete that would have run it is already gone, and if it became
+     * IMPERSONALIZE_AND_RETAIN then hard-deleting the children is precisely the data loss the retain
+     * strategy exists to prevent.
+     */
+    async runDeferredChildLifecycleTeardown(args) {
+        const { childResourceType, parentIds, executionContext } = args;
+        const parentResourceType = this.resourceConfiguration.resourceIdentifier;
+        const childRelationships = getChildDirectionRelationships(this.resourceConfiguration.resourceRelationships);
+        const relationship = childRelationships.find((candidate) => String(candidate.resourceType2) === String(childResourceType)
+            && this.getResolvedLifecycleOnParentDelete(candidate)?.enabled === true);
+        if (!relationship) {
+            throw this.errorBuilder.buildError(ErrorType.CONFIGURATION, executionContext, {
+                customMessageReference: ErrorCustomMessageReference.SERVICE_RESOURCE_OPERATION_FAILED,
+                context: {
+                    message: 'Deferred child teardown names an edge this parent no longer declares with an enabled '
+                        + 'onParentDelete lifecycle. Refusing rather than replaying the configuration the job was '
+                        + 'enqueued under.',
+                    parentResourceType,
+                    childResourceType,
+                },
+            });
+        }
+        const lifecycleConfig = this.getResolvedLifecycleOnParentDelete(relationship);
+        const strategy = lifecycleConfig.strategy || ChildLifecycleStrategy.DELETE;
+        const mode = lifecycleConfig.mode || ChildLifecycleMode.IMMEDIATE;
+        if (strategy !== ChildLifecycleStrategy.DELETE || mode !== ChildLifecycleMode.LAZY) {
+            throw this.errorBuilder.buildError(ErrorType.CONFIGURATION, executionContext, {
+                customMessageReference: ErrorCustomMessageReference.SERVICE_RESOURCE_OPERATION_FAILED,
+                context: {
+                    message: 'Deferred child teardown is no longer the configured behaviour for this edge. Refusing: '
+                        + 'hard-deleting children whose edge now declares IMPERSONALIZE_AND_RETAIN is the data '
+                        + 'loss that strategy exists to prevent.',
+                    parentResourceType,
+                    childResourceType,
+                    strategy,
+                    mode,
+                },
+            });
+        }
+        // The SAME method IMMEDIATE mode calls. Depth starts at 0 with the edge's own budget, so the
+        // grandchild recursion behaves exactly as it would have on the request path.
+        return await this.deleteChildrenImmediate(relationship, [...parentIds], executionContext, 0, lifecycleConfig.maxDepth || 1, new Set());
     }
     /**
      * Execute additional post-operation logic (non-cascading)
@@ -8417,5 +8907,41 @@ export class ServiceResourceBackendService {
             logDebug: this.logDebug,
         }, executionContext, inputData, currentResult, tokenGenerationResult, previousState);
     }
+    /**
+     * Record the metered usage an operation DECLARES, if any (#415).
+     *
+     * Reads `recordsUsage` off `executionContext.operation`, which by this point is the variant-resolved
+     * operation — the same guarantee `dispatchNotifications` relies on for its own authored config.
+     *
+     * The metering service is reached through a module-level getter rather than injection, because it
+     * injects THIS class and the container cannot resolve that cycle. See `setUsageMeteringService`.
+     */
+    recordDeclaredMeteredUsage(executionContext, operationResult) {
+        const declaration = executionContext.operation?.recordsUsage;
+        if (!declaration)
+            return;
+        const usageMetering = getUsageMeteringService();
+        if (!usageMetering) {
+            // Declared but unbillable: the operation says it consumes a metered product and the application
+            // has no billing provider. Loud, because it is an authoring error that costs revenue silently —
+            // every call of this operation consumes something nobody will ever be charged for.
+            this.logger.warn('Operation declares metered usage but billing is not configured; nothing recorded', {
+                productKey: declaration.productKey,
+                resourceIdentifier: executionContext.operation?.resourceIdentifier,
+                operationIdentifier: executionContext.operation?.operationIdentifier,
+            });
+            return;
+        }
+        setImmediate(() => {
+            void usageMetering
+                .recordDeclaredOperationUsage(declaration, executionContext, operationResult)
+                .catch((error) => {
+                this.logger.error('Failed to record declared metered usage', {
+                    ...projectCaughtErrorLogFields(error),
+                    productKey: declaration.productKey,
+                });
+            });
+        });
+    }
 }
 //# sourceMappingURL=services-registry-handler.backend.service.js.map