@substrat-run/adapter-cloudflare 0.113.0 → 0.116.0

package/dist/scope-do.js

@@ -1,9 +1,10 @@
 import { DurableObject } from 'cloudflare:workers';
-import { ATTACHMENT_ADDED, ATTACHMENT_REMOVED, attachmentRecord, domainEvent, domainEventInput, eventId, instant, objectRef, toWireFailure, grantRefFromProof, principalId, platformRequestInput, platformRequestId, MAX_PENDING_PLATFORM_REQUESTS, MAX_PENDING_SWEEP_RUNS, SWEEP_RUNS_KIND, platformRequest, SCOPE_TABLE_PAGE_MAX, SCOPE_QUERY_ROW_MAX, listLimitOf, requestFingerprint, substratError, assertReplayableDump, REDRAIN_BATCH, } from '@substrat-run/contracts';
-import { ulid, createUlid, assertAllowed, ConnectionSealingKeyUnavailableError, noSealingKeyMessage, sealTo, assertReadOnlyQuery, entitlementDenial, platformRequestHistoryQuery, PLATFORM_REQUEST_COLUMNS, denialListQuery, denialSummaryQuery, denialTotalsQuery, DENIAL_WINDOW_QUERY, mapDenialRow, mapDenialSummaryBuckets, PermissionDenied, assertImpersonationWrites, assertModuleEnqueueableKind, impersonationStampOf, createAtomic, NotSearchable, isSearchIndexTable, searchIndexDdl, searchIndexMigrations, searchIndexPlans, NotListable, listIndexMigrations, listIndexPlans, listQuery, cursorOf, searchLimit, searchMatchExpression, searchQuery, IDEMPOTENCY_DDL, assertIdempotencyKey, idempotencyLookupQuery, idempotencyPruneStatement, idempotencyRecordStatement, idempotencyOptedOutMessage, replayFor, entityVersionQuery, entityVersionOf, assertIfMatch, OUTBOX_ENTITY_INDEX, } from '@substrat-run/kernel';
+import { ATTACHMENT_ADDED, ATTACHMENT_REMOVED, attachmentRecord, domainEvent, domainEventInput, eventId, instant, objectRef, toWireFailure, grantRefFromProof, principalId, scopeId as scopeIdOf, tenantId as tenantIdOf, platformRequestInput, platformRequestId, MAX_PENDING_PLATFORM_REQUESTS, MAX_PENDING_SWEEP_RUNS, SWEEP_RUNS_KIND, platformRequest, SCOPE_TABLE_PAGE_MAX, SCOPE_QUERY_ROW_MAX, listLimitOf, requestFingerprint, substratError, assertReplayableDump, REDRAIN_BATCH, } from '@substrat-run/contracts';
+import { ulid, createUlid, assertAllowed, ConnectionSealingKeyUnavailableError, noSealingKeyMessage, sealTo, assertReadOnlyQuery, entitlementDenial, platformRequestHistoryQuery, PLATFORM_REQUEST_COLUMNS, denialListQuery, denialSummaryQuery, denialTotalsQuery, DENIAL_WINDOW_QUERY, mapDenialRow, mapDenialSummaryBuckets, PermissionDenied, assertImpersonationWrites, assertModuleEnqueueableKind, impersonationStampOf, createAtomic, NotSearchable, isSearchIndexTable, searchIndexDdl, searchIndexMigrations, searchIndexPlans, NotListable, listIndexMigrations, listIndexPlans, listQuery, cursorOf, searchLimit, searchMatchExpression, searchQuery, IDEMPOTENCY_DDL, assertIdempotencyKey, idempotencyLookupQuery, idempotencyPruneStatement, idempotencyRecordStatement, idempotencyOptedOutMessage, replayFor, entityVersionQuery, entityVersionOf, assertIfMatch, OUTBOX_ENTITY_INDEX, SCHEDULE_STATE_DDL, SCHEDULE_STATE_REBUILD, scheduleStateHasKind, JOB_RUN_DDL, jobRunListLimit, } from '@substrat-run/kernel';
+import { isUpgradeRequest, readSubscription, LIVE_FANOUT_LIMIT, LIVE_MODE_HEADER, LIVE_PRINCIPAL_HEADER, LIVE_SCOPE_HEADER, LIVE_SUBSCRIBE_PATH, LIVE_TENANT_HEADER, } from './live-reads.js';
 import { OperationQueue } from './serialization.js';
 import { doScopedSql } from './sql.js';
-import { facetEvents, readHistory, readInvocation, walkEventCause, walkEventEffects } from '@substrat-run/kernel';
+import { facetEvents, readDeadLetters, readHistory, readInvocation, walkEventCause, walkEventEffects } from '@substrat-run/kernel';
 import { createDoTupleChecker, createLocalControlPlaneReader } from './checker.js';
 /**
  * The key marking a scope DO whose storage was destroyed (`destroyStorage`).
@@ -127,31 +128,28 @@ const KERNEL_DDL = `
     operation TEXT,
     -- K-42: WHICH of the two actors was refused is exactly what this log is for.
     impersonation TEXT,
+    -- #1525: the INVOCATION this refusal happened during, the same id #1237 stamps on
+    -- every event of a call. A denial joins to nothing but actor and time otherwise --
+    -- the operation column names what was attempted, never WHICH attempt -- so "what
+    -- else did this request do" cannot reach a refusal, which is the one thing an
+    -- incident asks about first. NULL = the transport carried no id (a seed, a test,
+    -- an internal call, an attachment RPC), or the row predates the column.
+    invocation_id TEXT,
     at TEXT NOT NULL,
     drained_at TEXT
   );
-  -- #383: the platform sweep's per-scope gating state. Despite the name, this table
-  -- holds TWO kinds of row since #1232, told apart by the shape of schedule_op:
-  --   * a schedule operation, spelled module/verb -- last_run_at / last_status are
-  --     when that operation last RAN here and how it ended;
-  --   * a freshness key, spelled freshness:<eventType> -- last_run_at / last_status
-  --     are when the evaluator last RECORDED a verdict for that event type and what
-  --     the verdict was. Nothing ran; the row gates what the sweep records.
-  -- Only HALF the no-collision claim is enforced, which is worth knowing before
-  -- trusting it: a freshness key is always "freshness:" followed by a value the
-  -- contracts eventType schema accepted (lowercase ns.verb, no colon and no slash),
-  -- so no freshness key can ever look like an operation. The other direction is
-  -- CONVENTION only -- scheduleSpec.operation is z.string().min(1), so a module
-  -- that declared a schedule operation literally named "freshness:orders.placed"
-  -- would share a row with the evaluator and nothing today would reject it.
-  -- #1288 tracks giving the table a column (or a name) that says this outright,
-  -- which is also what would let the collision be refused rather than avoided.
-  -- Spine (kernel-written), never a module migration.
-  CREATE TABLE IF NOT EXISTS _substrat_schedule_state (
-    schedule_op TEXT PRIMARY KEY,
-    last_run_at TEXT,
-    last_status TEXT
-  );
+  -- #383 / #1232 / #1288: the platform sweep's per-scope gating state, holding two
+  -- families of row that the kind COLUMN -- not the spelling of a key -- tells
+  -- apart. Spine (kernel-written), never a module migration. Shared with the pure
+  -- adapter from @substrat-run/kernel, so the shape a rebuild produces and the shape
+  -- a fresh store gets cannot part company; the column comments are in there.
+  ${SCHEDULE_STATE_DDL}
+  -- #1577: the resumable-run driver's record and the step ledger of the pass it
+  -- currently has in flight. Spine (kernel-written), never a module migration.
+  -- Shared with the pure adapter from @substrat-run/kernel so the shape production
+  -- builds and the shape a self-host builds cannot part company; the column
+  -- comments, and the reason coalescing is NOT a unique index, are in there.
+  ${JOB_RUN_DDL}
   CREATE TABLE IF NOT EXISTS _substrat_migrations (
     module_id TEXT NOT NULL,
     version TEXT NOT NULL,
@@ -191,6 +189,17 @@ const KERNEL_DDL = `
     --   next_attempt_at IS NULL      -> terminal: error IS NULL delivered, else dead
     attempts INTEGER NOT NULL DEFAULT 0,
     next_attempt_at TEXT,
+    -- #1525: the invocation THIS ATTEMPT ran in, the same id #1237 stamps on every
+    -- event of a call. Not the emitting event's -- that one is already on the outbox
+    -- and a delivery joins to it through event_id. What that join cannot say is
+    -- which call attempted the DELIVERY, and for an executor the two differ by
+    -- design: attempt one runs in the emitting call's post-commit tail, every retry
+    -- afterwards in a drain that is a different call or none. Moves with the row on
+    -- an upsert, like delivered_at, error and attempts -- it describes the
+    -- latest attempt, not the first. NULL = that attempt carried no call (a
+    -- scheduled drain, an alarm, a seed, an attachment RPC), or the row predates
+    -- the column.
+    invocation_id TEXT,
     PRIMARY KEY (event_id, consumer_module)
   );
   -- Scope-local permissions (docs/architecture/scope-local-permissions.md): the
@@ -505,6 +514,12 @@ export function defineScopeDO(modules, bareOps) {
         listPlans = new Map();
         /** entityType → the declared attachment gate (#473): read key + write key (default: read). */
         attachmentTargets = new Map();
+        /**
+         * entityType → the declared live-read gate (#938): the key a subscriber must hold
+         * ON THAT ENTITY before a change to it is announced. Absent = announced to nobody;
+         * `fanOutLive` treats a miss as silence, never as "unguarded".
+         */
+        liveTargets = new Map();
         checker;
         systemPrincipal = principalId.parse(ulid());
         /**
@@ -622,6 +637,20 @@ export function defineScopeDO(modules, bareOps) {
                 }
                 this.attachmentTargets.set(target.entityType, gate);
             }
+            // Live-read targets (#938): entityType → the read key a subscriber must pass ON
+            // THAT ENTITY before a change to it is announced. Validated exactly like the
+            // attachment gate above, and for a sharper reason: two modules disagreeing about
+            // which key guards an entity type would make "who may watch this" depend on
+            // registration order, and the losing declaration would be the one that was meant
+            // to be stricter. An entity type nobody declares is announced to nobody.
+            for (const target of manifest.liveTargets ?? []) {
+                const existing = this.liveTargets.get(target.entityType);
+                if (existing && existing !== target.readPermission) {
+                    throw new Error(`conflicting liveTargets for '${target.entityType}': ` +
+                        `(${existing}) vs (${target.readPermission})`);
+                }
+                this.liveTargets.set(target.entityType, target.readPermission);
+            }
             for (const name of manifest.withdraws ?? []) {
                 this.withdrawn.set(name, manifest.id);
                 this.operations.delete(name);
@@ -843,6 +872,24 @@ export function defineScopeDO(modules, bareOps) {
                 return ids.length;
             });
         }
+        /**
+         * How many rows `redrainEvents` WOULD reopen for the same instant (#1545), reopening
+         * none of them. A separate verb rather than a flag on the one above, deliberately: the
+         * two answers are indistinguishable once they are numbers, so the caller that asks for
+         * a count must not be able to reach the reopen by losing an argument on the way.
+         *
+         * UNBOUNDED where the reopen is batched. The batch exists because an UPDATE over the
+         * whole window rewrites every row and its index entries inside ONE Durable Object
+         * request, against a fixed budget. An aggregate materialises no rows, so that budget is
+         * not the binding constraint — and a partial count would be worse than useless: the
+         * number is the whole point, and "5000, or possibly more" answers nothing.
+         */
+        async redrainCount(drainedBefore) {
+            return this.sql
+                .exec(`SELECT COUNT(*) AS c FROM _substrat_outbox
+              WHERE drained_at IS NOT NULL AND drained_at < ?`, drainedBefore)
+                .toArray()[0].c;
+        }
         /**
          * Facet this scope's own outbox (#1239) — `facetEvents`, which is the
          * sanctioned read: an erased payload yields the same NULL a missing field
@@ -879,6 +926,10 @@ export function defineScopeDO(modules, bareOps) {
         invocationEvents(input) {
             return readInvocation({ sql: doScopedSql(this.sql) }, input.invocationId, input.limit);
         }
+        /** #1525: every delivery in this scope that gave up, inside the DO where both tables live. */
+        deadLetters(input) {
+            return readDeadLetters({ sql: doScopedSql(this.sql) }, { limit: input.limit, cursor: input.cursor });
+        }
         migrationBookmarks(limit = 20) {
             return this.sql
                 .exec(`SELECT bookmark, taken_at, pending FROM _substrat_migration_bookmarks
@@ -1159,6 +1210,21 @@ export function defineScopeDO(modules, bareOps) {
                 // one call. Same placement as the SQLite adapter's actor task, for this reason.
                 this.invocationId = invokeOptions?.invocationId ?? null;
                 try {
+                    /**
+                     * #938: the outbox's high-water mark BEFORE this call wrote anything, so the
+                     * post-commit fan-out can name exactly the events this call (and the consumers
+                     * it set off) added. Read here — inside the queued body, before the
+                     * transaction — because that is the region where this call holds the DO to
+                     * itself, the same reason `invocationId` is set here.
+                     *
+                     * A socket that connects between here and the fan-out is served whatever this
+                     * call committed, and one that connects while `null` was decided hears nothing
+                     * about it. Both are harmless and neither is worth a lock: a frame is an
+                     * invalidation, so hearing about a change from just before you subscribed costs
+                     * one redundant re-read, and missing one costs a wait for the client's poll —
+                     * which is the floor this whole surface sits on.
+                     */
+                    const liveSince = this.liveHighWaterMark();
                     let result;
                     let committedVersion = null;
                     // #116: set when this invocation was answered from a recording rather
@@ -1270,7 +1336,10 @@ export function defineScopeDO(modules, bareOps) {
                                 ? { kind: 'system', id: systemModuleId }
                                 : connectionId
                                     ? { kind: 'connection', id: connectionId }
-                                    : { kind: 'principal', id: principal }, tenantId, operation, err, impersonation);
+                                    : { kind: 'principal', id: principal }, tenantId, operation, err, 
+                            // Inside the queued body, which is the one region where this call holds
+                            // the DO to itself — so the field is this call's own (#1237).
+                            this.invocationId, impersonation);
                         }
                         // The ORIGINAL error, deliberately: `invoke` flattens it for the envelope
                         // (which keeps its code and extensions) or rewraps it for the legacy throw
@@ -1281,8 +1350,14 @@ export function defineScopeDO(modules, bareOps) {
                     // Skipped on a replay: nothing was written, so there is nothing this
                     // invocation added to drain. Anything the ORIGINAL left undrained is the
                     // outbox's own retry backstop, which is what that backstop is for.
+                    // Drain to consumers, then announce what landed (#938). Skipped whole on a
+                    // replay: nothing was written, so there is nothing this invocation added to
+                    // drain or to announce. Anything the ORIGINAL left undrained is the outbox's
+                    // own retry backstop, which is what that backstop is for.
+                    // #1525: still inside the queued body that set it, so these deliveries are this
+                    // call's own work — the same tail its consumers' emits are stamped in.
                     if (!replayed)
-                        await this.dispatch(tenantId, scopeId);
+                        await this.settleCommitted(tenantId, scopeId, liveSince, this.invocationId);
                     return {
                         result,
                         platformRequests: signals.platformRequests,
@@ -1315,6 +1390,288 @@ export function defineScopeDO(modules, bareOps) {
                 }
             });
         }
+        // -- live reads (#938): the subscription half of the change feed ------------
+        // The ONLY part of this DO addressed as a fetch target rather than over RPC, and
+        // only because a WebSocket cannot cross RPC — a socket is not serializable, so the
+        // one way to hand one back is a `Response` carrying a `webSocket`. Everything the
+        // coordinator asserts on the way in is named in `live-reads.ts`, shared with
+        // `host.ts` so the two ends cannot drift.
+        /**
+         * Accept a subscription to this scope's changes.
+         *
+         * The coordinator has already decided that this connection can carry a push at all
+         * (the O2O check) and WHO is asking. What is decided here is nothing about
+         * authority: a subscription is not an authorization, and accepting one grants the
+         * subscriber no read it did not already have. Every frame is checked on its way
+         * out, individually, against the tuple state at that moment — so a grant revoked
+         * while the socket is open stops the frames it used to allow, which a
+         * subscription-time check would not.
+         *
+         * **This adds no authority to a holder of the stub, and the question is worth
+         * answering rather than leaving to be asked.** Being a public method, anything with
+         * the `SCOPE` binding can call it and assert whatever principal it likes in the
+         * headers. That is already true of `invoke`, which takes the principal as an
+         * argument and acts on it: a stub is the key to the scope, which is precisely why
+         * the router is not given one. The trust boundary is who holds the binding, not
+         * what this method checks — and what it does NOT do is let a stub-holder read
+         * anything the asserted principal could not, because the filter downstream re-checks
+         * that principal against every frame.
+         */
+        async fetch(request) {
+            const url = new URL(request.url);
+            if (url.pathname !== LIVE_SUBSCRIBE_PATH) {
+                // The DO has exactly one fetch surface. Anything else reaching here is a
+                // coordinator bug, and a 404 says so without guessing at an intent.
+                return new Response('this scope has no such surface', { status: 404 });
+            }
+            if (!isUpgradeRequest(request)) {
+                return new Response('live reads are a WebSocket surface', {
+                    status: 426,
+                    headers: { [LIVE_MODE_HEADER]: 'not-an-upgrade' },
+                });
+            }
+            const principal = request.headers.get(LIVE_PRINCIPAL_HEADER);
+            const tenantId = request.headers.get(LIVE_TENANT_HEADER);
+            const scopeId = request.headers.get(LIVE_SCOPE_HEADER);
+            if (!principal || !tenantId || !scopeId) {
+                // Fail closed and loudly. An unnamed subscriber is one whose permissions
+                // cannot be evaluated, and the only safe thing to do with a channel we cannot
+                // filter is to refuse to open it. 500, not 400: the caller is the coordinator
+                // in this same package, so a missing assertion is OUR bug, not the client's.
+                return new Response('live reads require an asserted principal, tenant and scope', {
+                    status: 500,
+                });
+            }
+            // A subscriber arriving before the scope's migrations have run would be told
+            // about events against a schema it cannot read back through. Same gate every
+            // other entry point takes, for the same reason.
+            await this.ensureMigrations();
+            const pair = new WebSocketPair();
+            const [client, server] = Object.values(pair);
+            // HIBERNATABLE, not `server.accept()`. A scope with a watcher open would
+            // otherwise be pinned in memory for as long as somebody has a tab open, which is
+            // the cost model inverted: a support desk being WATCHED is the normal state.
+            // Hibernation also fixes the worse half — an in-memory roster does not survive
+            // eviction, so the socket would stay open and silently stop receiving, which is
+            // indistinguishable from a quiet scope.
+            this.ctx.acceptWebSocket(server);
+            // `.parse`, not a cast: these three arrived as header strings, and the branded
+            // ids are what every check downstream is keyed on. A malformed one would
+            // otherwise be carried all the way to a `ctx.check` that quietly matches nothing —
+            // which reads as "this subscriber may see nothing" and is indistinguishable from
+            // a correct denial. Refused here instead, where it is still one subscriber's
+            // problem. Throwing is right: the coordinator built this request.
+            server.serializeAttachment({
+                principal: principalId.parse(principal),
+                tenantId: tenantIdOf.parse(tenantId),
+                scopeId: scopeIdOf.parse(scopeId),
+                since: new Date().toISOString(),
+            });
+            return new Response(null, { status: 101, webSocket: client });
+        }
+        /**
+         * A subscriber said something.
+         *
+         * The channel is one-way by design — the server announces, the client re-reads
+         * through the ordinary operation — so there is no client message that can cause a
+         * read, a write, or a change of subscription. `ping`/`pong` is the whole protocol,
+         * and it exists so an idle connection can be kept alive by either end.
+         *
+         * Deliberately NOT a place to let a client narrow or widen what it receives: a
+         * filter the client chooses is a filter the client can choose wrongly, and the
+         * only filter that matters here is the one it does not control.
+         */
+        webSocketMessage(ws, message) {
+            if (message === 'ping')
+                ws.send('pong');
+        }
+        /**
+         * The client hung up. Close our end so the runtime stops holding the subscription.
+         *
+         * The runtime passes `reason` and `wasClean` too; neither is read, so neither is
+         * named — there is nothing to do differently for an unclean close, because the
+         * socket is going away either way and the client's poll is what covers the gap.
+         */
+        webSocketClose(ws, code) {
+            // 1006 is reserved: it is what the runtime REPORTS for an abnormal closure and
+            // is not a code anything may SEND, so echoing it back throws — on precisely the
+            // path where the connection is already in trouble.
+            try {
+                ws.close(code === 1006 ? 1000 : code, 'scope closing the subscription');
+            }
+            catch {
+                // Already gone. Nothing to do, and nothing worth reporting.
+            }
+        }
+        /**
+         * A socket failed. Logged and not rethrown: there is no caller to fail, and the
+         * runtime delivers `webSocketClose` after this, which is what does the cleanup.
+         */
+        webSocketError(_ws, error) {
+            console.error('substrat: live-read socket error', error);
+        }
+        /**
+         * The outbox's high-water mark before a committing path runs (#938), or `null`
+         * when nobody is listening.
+         *
+         * `null` and `''` are different answers: `null` means no subscriber, so nothing is
+         * read at all and a scope pays nothing for a feature it is not using; `''` is the
+         * honest empty-outbox answer, and every ULID sorts above it.
+         *
+         * Read BEFORE the transaction by every caller, which is what makes the pair below
+         * able to name exactly the events that path added.
+         */
+        liveHighWaterMark() {
+            if (this.ctx.getWebSockets().length === 0)
+                return null;
+            return (this.sql.exec('SELECT MAX(id) AS id FROM _substrat_outbox').toArray()[0]?.id ?? '');
+        }
+        /**
+         * What every committing path does after its transaction closes: drain the outbox
+         * to consumers, then announce what landed to whoever may see it.
+         *
+         * **One step, because there is one rule.** The fan-out was wired into `invoke`
+         * alone at first, and `attachmentAdd`/`attachmentRemove` commit and emit too —
+         * `attachment.added` and `attachment.removed`, about a real entity. A watcher of
+         * that entity would have missed them: no error, no gap it could see, just a screen
+         * that did not update for one kind of change. That is the exact failure the
+         * hibernation design exists to prevent, arriving through a different door, so the
+         * answer is a step both doors take rather than a second call both must remember.
+         *
+         * Order is load-bearing: drain FIRST, announce after. A consumer's own emits are
+         * changes too, and they land in the outbox above `liveSince` — so announcing first
+         * would tell a subscriber about the cause and not the effect, and it would re-read
+         * too early.
+         */
+        async settleCommitted(tenantId, scopeId, liveSince, 
+        /**
+         * #1525: the call whose commit this is settling, or null — PASSED rather than
+         * read off `this.invocationId` inside `dispatch`, so each of the three doors
+         * says what it actually knows: `invoke` its own id, the two attachment verbs
+         * null. Same discipline `recordDenial` adopted, and for the same reason.
+         */
+        invocationId) {
+            await this.dispatch(tenantId, scopeId, invocationId);
+            if (liveSince === null)
+                return;
+            try {
+                await this.fanOutLive(liveSince, tenantId, scopeId);
+            }
+            catch (err) {
+                // The write has COMMITTED and the caller is owed its answer. A failure to
+                // announce is a failure of a hint, and the client's poll is the floor
+                // underneath it — so this is logged and never rethrown. Rethrowing would turn
+                // a delivered write into a 500 the caller would reasonably retry.
+                console.error('substrat: live-read fan-out failed after commit', err);
+            }
+        }
+        /**
+         * Announce what just committed, to whoever may see it (#938).
+         *
+         * **Three properties, and each is load-bearing.**
+         *
+         * *Post-commit.* Called after the operation's transaction has closed and after the
+         * consumer drain, so nothing is announced that a rollback could take back and
+         * nothing a consumer emitted is missed. A subscriber told about a row that then
+         * vanished would re-read, find nothing, and have no way to tell that from a
+         * deletion.
+         *
+         * *Filtered per subscriber, per event, after the check.* The declared
+         * `liveTargets` key is checked ON THE EVENT'S OWN ENTITY, through `ctx.check` —
+         * the same evaluator, the same entity-narrowed grants, the same parent walk as the
+         * read the client is about to make. An entity type no module declared is announced
+         * to nobody. Knowing that a row exists and changed at 14:02 is information about
+         * that row, so the empty payload is not what makes this safe; this is.
+         *
+         * *Never able to fail the operation.* The write has committed and the caller has
+         * its answer. A socket that has gone away mid-fan-out, or a check that cannot be
+         * evaluated, costs a subscriber its live update — which it survives, because the
+         * client's contract is that a push is a hint and the poll is the floor.
+         */
+        async fanOutLive(sinceEventId, tenantId, scopeId) {
+            const sockets = this.ctx.getWebSockets();
+            if (sockets.length === 0)
+                return;
+            const rows = this.sql
+                .exec(`SELECT id, type, entity_type, entity_id, occurred_at FROM _substrat_outbox
+            WHERE id > ? ORDER BY id LIMIT ?`, sinceEventId, LIVE_FANOUT_LIMIT)
+                .toArray();
+            // Drop the undeclared entity types BEFORE any per-subscriber work. Not an
+            // optimisation: it is the fail-closed rule stated once, in the one place that
+            // decides, rather than relied upon inside the loop below.
+            const announceable = rows.filter((r) => this.liveTargets.has(r.entity_type));
+            if (announceable.length === 0)
+                return;
+            for (const ws of sockets) {
+                let subscription = null;
+                try {
+                    subscription = readSubscription(ws.deserializeAttachment());
+                }
+                catch {
+                    subscription = null;
+                }
+                // A socket we cannot name is a socket we cannot filter for. Skipped, never
+                // sent to — see `readSubscription` for why every unusable shape fails closed.
+                if (!subscription)
+                    continue;
+                // A socket that outlived a scope rebind, or was somehow accepted for another
+                // node, must not be fed this scope's events. Cheap, and it makes the identity
+                // the frames are filtered against an explicit precondition rather than an
+                // assumption about how the subscription was created.
+                if (subscription.tenantId !== tenantId || subscription.scopeId !== scopeId)
+                    continue;
+                // One context per subscriber, not per event: `ctx.check` is the expensive part
+                // and the context is only the subject it is evaluated for.
+                //
+                // A frame this subscriber does not pass is NOT recorded as a denial (K-35),
+                // and that is deliberate: `recordDenial` is called on a refused REQUEST, where
+                // somebody asked for something and was told no. Nobody asked for these. Logging
+                // one row per unentitled subscriber per event would bury the denials that mean
+                // something — a broken screen, or somebody walking the surface — under the
+                // ordinary, correct working of a filter.
+                //
+                // The operation name is carried anyway, for the events a fan-out cannot emit
+                // but a future reader of this context might.
+                const ctx = this.operationContext(subscription.principal, tenantId, scopeId, undefined, undefined, undefined, undefined, undefined, 'live.subscribe');
+                for (const row of announceable) {
+                    // Non-null: `announceable` is exactly the rows whose type is in the map.
+                    const permission = this.liveTargets.get(row.entity_type);
+                    let allowed = false;
+                    try {
+                        const decision = await ctx.check(permission, {
+                            entityType: row.entity_type,
+                            entityId: row.entity_id,
+                        });
+                        allowed = decision.allowed;
+                    }
+                    catch {
+                        // A check that cannot answer is a check that refuses. The alternative —
+                        // treating an evaluator failure as an allow — turns an outage in the
+                        // permission path into a disclosure, which is the one failure mode this
+                        // surface must not have.
+                        allowed = false;
+                    }
+                    if (!allowed)
+                        continue;
+                    const frame = {
+                        kind: 'change',
+                        id: row.id,
+                        type: row.type,
+                        entityType: row.entity_type,
+                        entityId: row.entity_id,
+                        at: row.occurred_at,
+                    };
+                    try {
+                        ws.send(JSON.stringify(frame));
+                    }
+                    catch {
+                        // The socket went away between `getWebSockets()` and here. Stop writing to
+                        // this one and move on; the runtime will deliver `webSocketClose`.
+                        break;
+                    }
+                }
+            }
+        }
         // -- attachments (#473): the metadata half of the attachment surface --------
         // The coordinator (worker) holds the bytes and the per-tenant R2 binding; this
         // DO holds the permission gate and the metadata fact, under the same per-scope
@@ -1355,6 +1712,10 @@ export function defineScopeDO(modules, bareOps) {
             const parsed = attachmentRecord.parse(record);
             const gate = this.attachmentGate(parsed.entity.entityType);
             return this.queue.enqueue(async () => {
+                // #938: this path commits and emits too, so it takes the same mark-then-settle
+                // pair `invoke` takes. Inside the queued body and before the transaction, for
+                // the reason it is read there: that is where this call holds the DO to itself.
+                const liveSince = this.liveHighWaterMark();
                 try {
                     await this.ctx.storage.transaction(async () => {
                         const ctx = this.operationContext(principal, tenantId, scopeId, undefined, connectionId, undefined, undefined, undefined, 'attachments.upload');
@@ -1374,11 +1735,13 @@ export function defineScopeDO(modules, bareOps) {
                 }
                 catch (err) {
                     if (err instanceof PermissionDenied) {
-                        this.recordDenial(attachSubject(principal, connectionId), tenantId, 'attachments.upload', err);
+                        this.recordDenial(attachSubject(principal, connectionId), tenantId, 'attachments.upload', err, null);
                     }
                     throw toRpcError(err);
                 }
-                await this.dispatch(tenantId, scopeId);
+                // #1525: null. An attachment RPC carries no invocation, exactly as its denial
+                // records none — so the deliveries it drains name no call rather than a wrong one.
+                await this.settleCommitted(tenantId, scopeId, liveSince, null);
                 return parsed;
             });
         }
@@ -1392,7 +1755,7 @@ export function defineScopeDO(modules, bareOps) {
             }
             catch (err) {
                 if (err instanceof PermissionDenied) {
-                    this.recordDenial(attachSubject(principal, connectionId), tenantId, 'attachments.list', err);
+                    this.recordDenial(attachSubject(principal, connectionId), tenantId, 'attachments.list', err, null);
                 }
                 throw toRpcError(err);
             }
@@ -1423,7 +1786,7 @@ export function defineScopeDO(modules, bareOps) {
                 }
                 catch (err) {
                     if (err instanceof PermissionDenied) {
-                        this.recordDenial(attachSubject(principal, connectionId), tenantId, 'attachments.open', err);
+                        this.recordDenial(attachSubject(principal, connectionId), tenantId, 'attachments.open', err, null);
                     }
                     throw toRpcError(err);
                 }
@@ -1436,7 +1799,7 @@ export function defineScopeDO(modules, bareOps) {
             }
             catch (err) {
                 if (err instanceof PermissionDenied) {
-                    this.recordDenial(attachSubject(principal, connectionId), tenantId, 'attachments.open', err);
+                    this.recordDenial(attachSubject(principal, connectionId), tenantId, 'attachments.open', err, null);
                 }
                 throw toRpcError(err);
             }
@@ -1450,6 +1813,8 @@ export function defineScopeDO(modules, bareOps) {
                 if (!record)
                     return null;
                 const gate = this.attachmentGate(record.entity.entityType);
+                // #938: same mark-then-settle pair as the upload path above.
+                const liveSince = this.liveHighWaterMark();
                 try {
                     await this.ctx.storage.transaction(async () => {
                         const ctx = this.operationContext(principal, tenantId, scopeId, undefined, connectionId, undefined, undefined, undefined, 'attachments.remove');
@@ -1466,11 +1831,13 @@ export function defineScopeDO(modules, bareOps) {
                 }
                 catch (err) {
                     if (err instanceof PermissionDenied) {
-                        this.recordDenial(attachSubject(principal, connectionId), tenantId, 'attachments.remove', err);
+                        this.recordDenial(attachSubject(principal, connectionId), tenantId, 'attachments.remove', err, null);
                     }
                     throw toRpcError(err);
                 }
-                await this.dispatch(tenantId, scopeId);
+                // #1525: null. An attachment RPC carries no invocation, exactly as its denial
+                // records none — so the deliveries it drains name no call rather than a wrong one.
+                await this.settleCommitted(tenantId, scopeId, liveSince, null);
                 return record;
             });
         }
@@ -1488,10 +1855,17 @@ export function defineScopeDO(modules, bareOps) {
                 .toArray()[0];
             return row !== undefined;
         }
-        /** The last time a schedule's operation ran on this scope (#383), or null. */
+        /**
+         * The last time a schedule's operation ran on this scope (#383), or null.
+         *
+         * `kind = 'schedule'` is not decoration (#1288): an operation may legally be
+         * named `freshness:<something>`, and before the column this read answered with
+         * the EVALUATOR's last recorded time for that event type — a cadence gate
+         * driven by a verdict nothing ran.
+         */
         async scheduleLastRun(operation) {
             const row = this.sql
-                .exec(`SELECT last_run_at FROM _substrat_schedule_state WHERE schedule_op = ?`, operation)
+                .exec(`SELECT last_run_at FROM _substrat_schedule_state WHERE kind = 'schedule' AND schedule_op = ?`, operation)
                 .toArray()[0];
             return row?.last_run_at ?? null;
         }
@@ -1499,8 +1873,9 @@ export function defineScopeDO(modules, bareOps) {
          * #1232: everything the freshness evaluator needs about this scope, one round
          * trip regardless of how many types are declared — the newest matching event
          * per type, plus each type's recorded evaluator state (last recorded at +
-         * outcome, kept in `_substrat_schedule_state` under a `freshness:` prefix that
-         * cannot collide with operation names).
+         * outcome, kept in `_substrat_schedule_state` under `kind = 'freshness'`, which
+         * since #1288 is what separates these rows from the schedule rows beside them —
+         * the `freshness:` prefix on the key is retained but no longer load-bearing).
          */
         async freshnessProbe(types) {
             const out = {};
@@ -1517,7 +1892,8 @@ export function defineScopeDO(modules, bareOps) {
             }
             const keys = types.map((t) => `freshness:${t}`);
             for (const row of this.sql
-                .exec(`SELECT schedule_op, last_run_at, last_status FROM _substrat_schedule_state WHERE schedule_op IN (${marks})`, ...keys)
+                .exec(`SELECT schedule_op, last_run_at, last_status FROM _substrat_schedule_state
+            WHERE kind = 'freshness' AND schedule_op IN (${marks})`, ...keys)
                 .toArray()) {
                 const t = row.schedule_op.slice('freshness:'.length);
                 if (out[t]) {
@@ -1529,16 +1905,173 @@ export function defineScopeDO(modules, bareOps) {
         }
         /**
          * Write one `_substrat_schedule_state` row (#383). Spine, kernel-written.
-         * `unit` is the row's key in either of the two shapes the table holds: a schedule
+         *
+         * `kind` is PASSED, never derived from the shape of `unit` (#1288) — deriving it
+         * is precisely the convention this column replaced, and it is wrong for the one
+         * input that matters: a schedule operation named `freshness:orders.placed` is a
+         * schedule row, whatever its key looks like. `unit` is that row's key: a schedule
          * operation (`module/verb`, and then `at`/`status` are when it ran and how it
          * ended) or a freshness key (`freshness:<eventType>`, and then they are when the
          * verdict was recorded and what it was — nothing ran). See the bootstrap DDL.
+         *
+         * `kind` is LAST because this is a positional RPC — see the interface's own note
+         * in `host.ts`. An old DO drops a trailing argument; a leading one it binds, and
+         * every value after it lands one column to the left, silently.
+         */
+        async recordScheduleRun(unit, at, status, kind) {
+            this.sql.exec(`INSERT INTO _substrat_schedule_state (kind, schedule_op, last_run_at, last_status)
+           VALUES (?, ?, ?, ?)
+         ON CONFLICT(kind, schedule_op) DO UPDATE SET last_run_at = excluded.last_run_at,
+                                                      last_status = excluded.last_status`, kind, unit, at, status);
+        }
+        // -- the resumable-run driver's store (#1577) -----------------------------
+        //
+        // D-14's DURABLE driver, and the only half of it that lives in the DO: the run
+        // record and the step ledger. Every decision — what coalescing means, when a
+        // step is skipped, when a run fails — is in the kernel's `JobRunStore` callers,
+        // which the coordinator drives; these are reads and writes and nothing else, so
+        // the two drivers cannot disagree about any of it.
+        //
+        // Each step commits on its OWN round trip rather than the pass batching them at
+        // the end. That is what a mid-pass eviction keeps, and a DO is evicted and
+        // revived constantly — batching would lose exactly the work resume exists for.
+        /**
+         * Coalescing, as ONE round trip: the live (`running`) run for this key, or this
+         * row inserted and returned.
+         *
+         * **The single RPC is the atomicity**, and that is the whole reason it is shaped
+         * this way rather than as a `jobRunLive` the coordinator follows with a
+         * `jobRunInsert`. A Durable Object serializes its RPCs, so the lookup and the
+         * insert cannot be interleaved by another caller; split across two calls they
+         * can, and two concurrent starts then both find nothing and both insert. The
+         * schema carries no unique constraint to catch that, deliberately — a crashed
+         * run must stay restartable — so the indivisibility has to come from here.
+         */
+        async jobRunStartOrJoin(moduleId, job, instance, row) {
+            const live = this.sql
+                .exec(`SELECT * FROM _substrat_job_runs
+              WHERE module_id = ? AND job = ? AND instance = ? AND status = 'running'
+              ORDER BY id DESC LIMIT 1`, moduleId, job, instance)
+                .toArray()[0] ?? null;
+            if (live)
+                return live;
+            // `transactionSync`, and the two writes inlined rather than reached through
+            // `jobRunInsert`: an `await` between them is an output-gate boundary, and the
+            // point of doing this in one RPC is that there is no boundary to be evicted
+            // at. Same reason `SCHEDULE_STATE_REBUILD` insists on it.
+            this.ctx.storage.transactionSync(() => {
+                this.sql.exec(`INSERT INTO _substrat_job_runs
+             (id, module_id, job, instance, payload, status, cursor, counters, attempts,
+              last_error, started_at, updated_at, next_attempt_at, ended_at)
+           VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`, row.id, row.module_id, row.job, row.instance, row.payload, row.status, row.cursor, row.counters, row.attempts, row.last_error, row.started_at, row.updated_at, row.next_attempt_at, row.ended_at);
+            });
+            return row;
+        }
+        /** One run by id, whatever its status. */
+        async jobRunById(id) {
+            return (this.sql.exec('SELECT * FROM _substrat_job_runs WHERE id = ?', id).toArray()[0] ?? null);
+        }
+        /** Insert a fresh run. The coordinator has already refused a non-queue-safe payload. */
+        async jobRunInsert(row) {
+            this.sql.exec(`INSERT INTO _substrat_job_runs
+           (id, module_id, job, instance, payload, status, cursor, counters, attempts,
+            last_error, started_at, updated_at, next_attempt_at, ended_at)
+         VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`, row.id, row.module_id, row.job, row.instance, row.payload, row.status, row.cursor, row.counters, row.attempts, row.last_error, row.started_at, row.updated_at, row.next_attempt_at, row.ended_at);
+        }
+        /**
+         * `running` runs whose backoff has elapsed, oldest first, after `afterId`.
+         *
+         * The cursor is what lets the coordinator page past runs it cannot drive: it
+         * skips any whose job this deployment does not register, and without a cursor
+         * those rows head every batch forever (`runDueJobRuns`). `afterId` is LAST, as
+         * every argument added to an RPC on this interface must be.
          */
-        async recordScheduleRun(unit, at, status) {
-            this.sql.exec(`INSERT INTO _substrat_schedule_state (schedule_op, last_run_at, last_status)
-           VALUES (?, ?, ?)
-         ON CONFLICT(schedule_op) DO UPDATE SET last_run_at = excluded.last_run_at,
-                                                last_status = excluded.last_status`, unit, at, status);
+        async jobRunsDue(now, limit, afterId) {
+            return this.sql
+                .exec(
+            // `afterId` bound TWICE rather than as `?2`: mixing anonymous and numbered
+            // parameters makes the anonymous ones resume from the highest index used,
+            // which is a footgun for the next person to add a clause. Spelled exactly
+            // as the pure adapter spells it.
+            `SELECT * FROM _substrat_job_runs
+            WHERE status = 'running' AND (next_attempt_at IS NULL OR next_attempt_at <= ?)
+              AND (? IS NULL OR id > ?)
+            ORDER BY id LIMIT ?`, now, afterId ?? null, afterId ?? null, limit)
+                .toArray();
+        }
+        /** The operator read, newest first. */
+        async jobRunList(filter) {
+            const where = [];
+            const params = [];
+            for (const [column, value] of [
+                ['module_id', filter.moduleId],
+                ['job', filter.job],
+                ['instance', filter.instance],
+                ['status', filter.status],
+            ]) {
+                if (value !== undefined) {
+                    where.push(`${column} = ?`);
+                    params.push(value);
+                }
+            }
+            params.push(jobRunListLimit(filter.limit));
+            return this.sql
+                .exec(`SELECT * FROM _substrat_job_runs
+           ${where.length ? `WHERE ${where.join(' AND ')}` : ''}
+           ORDER BY id DESC LIMIT ?`, ...params)
+                .toArray();
+        }
+        /**
+         * Write a pass outcome onto the run row — every column at once.
+         *
+         * Whole rather than partial, and that is the shape not an accident: a commit
+         * writes cursor AND counters AND a cleared error AND a cleared backoff, and a
+         * partial update that wrote three of the four would leave a run carrying the
+         * last failure's error beside the new cursor, which reads as broken forever.
+         */
+        async jobRunPatch(id, patch) {
+            this.sql.exec(`UPDATE _substrat_job_runs
+            SET status = ?, cursor = ?, counters = ?, attempts = ?, last_error = ?,
+                updated_at = ?, next_attempt_at = ?, ended_at = ?
+          WHERE id = ?`, patch.status, patch.cursor, patch.counters, patch.attempts, patch.lastError, patch.updatedAt, patch.nextAttemptAt, patch.endedAt, id);
+        }
+        /** One step's ledger row — a non-null `result` is what means completed. */
+        async jobStepRow(runId, step) {
+            return (this.sql
+                .exec('SELECT step, result, attempts, last_error FROM _substrat_job_steps WHERE run_id = ? AND step = ?', runId, step)
+                .toArray()[0] ?? null);
+        }
+        /** Record one step attempt. `result` non-null = it completed and must not re-run. */
+        async jobStepRecord(runId, step, result, attempts, lastError, at) {
+            this.sql.exec(`INSERT INTO _substrat_job_steps (run_id, step, result, attempts, last_error, recorded_at)
+           VALUES (?, ?, ?, ?, ?, ?)
+         ON CONFLICT (run_id, step) DO UPDATE SET result = excluded.result,
+                                                  attempts = excluded.attempts,
+                                                  last_error = excluded.last_error,
+                                                  recorded_at = excluded.recorded_at`, runId, step, result, attempts, lastError, at);
+        }
+        /**
+         * A COMMITTED pass: the run's new state and the dropping of its step ledger, in
+         * ONE RPC so they cannot come apart.
+         *
+         * Same reasoning as `jobRunStartOrJoin` — the single round trip is the
+         * atomicity. As two calls, a stop in between leaves the advanced cursor beside
+         * the finished pass's memo rows, and a handler that reuses a step name across
+         * passes (legal: the determinism rule binds names to the payload and prior
+         * results, not to the cursor) then skips work it never did. The kernel's
+         * `runJobPass` carries the full argument.
+         */
+        async jobCommitPass(id, patch) {
+            // `transactionSync` with both statements inline — NOT `await
+            // this.jobRunPatch(...)` then the delete. The await is an output-gate
+            // boundary, which is precisely the gap this method exists to close.
+            this.ctx.storage.transactionSync(() => {
+                this.sql.exec(`UPDATE _substrat_job_runs
+              SET status = ?, cursor = ?, counters = ?, attempts = ?, last_error = ?,
+                  updated_at = ?, next_attempt_at = ?, ended_at = ?
+            WHERE id = ?`, patch.status, patch.cursor, patch.counters, patch.attempts, patch.lastError, patch.updatedAt, patch.nextAttemptAt, patch.endedAt, id);
+                this.sql.exec('DELETE FROM _substrat_job_steps WHERE run_id = ?', id);
+            });
         }
         // -- guards (K-17) --------------------------------------------------------
         /** This scope's spine, read under whatever transaction the caller already opened. */
@@ -1661,20 +2194,44 @@ export function defineScopeDO(modules, bareOps) {
          * Written AFTER the effect, so a crash mid-effect retries rather than silently
          * marking success. The coordinator computes the backoff because it owns the
          * per-executor policy; the DO owns the state.
+         *
+         * `invocationId` is LAST because this is a positional RPC — the same rule
+         * `recordScheduleRun` states. An old DO drops a trailing argument; a leading one
+         * it binds, and every value after it lands one column to the left, silently.
+         */
+        recordExecutorAttempt(eventId, deliveryId, error, nextAttemptAt, 
+        /**
+         * #1525: the call THIS attempt ran in, or null. Passed rather than read off
+         * `this.invocationId`, and here there is no choice about it: executors run on
+         * the COORDINATOR, so by the time this RPC arrives the queued body that held
+         * the id has long returned and the field reads null. The coordinator is the
+         * only side that knows, which is why the SQLite twin passes it too — a recorded
+         * fact whose correctness argument differs per adapter is the kind that drifts.
+         *
+         * Defaulted, for the other half of the skew: a coordinator too old to pass it
+         * calls this with four arguments, and `undefined` is not a value SQLite binds.
+         * Null is the honest answer there anyway — that coordinator recorded no call.
          */
-        recordExecutorAttempt(eventId, deliveryId, error, nextAttemptAt) {
+        invocationId = null) {
             const prior = this.sql
                 .exec('SELECT attempts FROM _substrat_deliveries WHERE event_id = ? AND consumer_module = ?', eventId, deliveryId)
                 .toArray()[0];
             const attempts = (prior?.attempts ?? 0) + 1;
             this.sql.exec(`INSERT INTO _substrat_deliveries
-           (event_id, consumer_module, delivered_at, error, attempts, next_attempt_at)
-         VALUES (?, ?, ?, ?, ?, ?)
+           (event_id, consumer_module, delivered_at, error, attempts, next_attempt_at,
+            invocation_id)
+         VALUES (?, ?, ?, ?, ?, ?, ?)
          ON CONFLICT (event_id, consumer_module) DO UPDATE SET
            delivered_at = excluded.delivered_at,
            error = excluded.error,
            attempts = excluded.attempts,
-           next_attempt_at = excluded.next_attempt_at`, eventId, deliveryId, new Date().toISOString(), error, attempts, nextAttemptAt);
+           next_attempt_at = excluded.next_attempt_at,
+           -- #1525: overwritten, like the four above. The row describes the LATEST
+           -- attempt, so a retry drained by a different call (or by none) must not
+           -- keep claiming the call that made the first one.
+           invocation_id = excluded.invocation_id`, eventId, deliveryId, new Date().toISOString(), error, attempts, nextAttemptAt, 
+            // #1525: the call this attempt ran in, as the coordinator named it.
+            invocationId);
             return attempts;
         }
         /** How many attempts this delivery has already had — the backoff input. */
@@ -1732,8 +2289,18 @@ export function defineScopeDO(modules, bareOps) {
          * the event on the next drain). Backpressure throws BEFORE any write — the caller
          * records a failed attempt and the delivery retries on its own backoff, exactly as
          * a throwing handler would.
+         *
+         * `invocationId` is LAST, and defaulted, for the RPC-skew reason `recordExecutorAttempt`
+         * states at length.
+         */
+        routeExecutorEventToPlatform(eventId, deliveryId, kind, payload, requestedBy, 
+        /**
+         * #1525: the call this routing ran in, or null. On the hosted path this is the
+         * dominant executor journal — every vertical is CP-less, so a connector delivery
+         * becomes an intent here rather than running in `recordExecutorAttempt`'s caller —
+         * so leaving it null would make the column read "no call" for the common case.
          */
-        routeExecutorEventToPlatform(eventId, deliveryId, kind, payload, requestedBy) {
+        invocationId = null) {
             const pending = Number(this.sql
                 .exec(`SELECT COUNT(*) AS c FROM _substrat_platform_requests WHERE status = 'pending'`)
                 .toArray()[0].c);
@@ -1753,7 +2320,7 @@ export function defineScopeDO(modules, bareOps) {
             this.sql.exec(`INSERT INTO _substrat_platform_requests
            (id, kind, payload, requested_by, impersonation, status, attempts, requested_at)
          VALUES (?, ?, ?, ?, ?, 'pending', 0, ?)`, id, kind, payload, requestedBy, source?.impersonation ?? null, instant.parse(new Date().toISOString()));
-            this.recordExecutorAttempt(eventId, deliveryId, null, null);
+            this.recordExecutorAttempt(eventId, deliveryId, null, null, invocationId);
             return id;
         }
         /**
@@ -1947,6 +2514,11 @@ export function defineScopeDO(modules, bareOps) {
                 // consumer dead-letter.
                 'ALTER TABLE _substrat_deliveries ADD COLUMN attempts INTEGER NOT NULL DEFAULT 0',
                 'ALTER TABLE _substrat_deliveries ADD COLUMN next_attempt_at TEXT',
+                // #1525: the invocation an attempt ran in, on a scope DO created before the
+                // column. Nullable, and the null is honestly "no call was carried" — which
+                // attempt produced a delivery already journalled cannot be decided afterwards,
+                // exactly as #1237's outbox column argued.
+                'ALTER TABLE _substrat_deliveries ADD COLUMN invocation_id TEXT',
                 // K-34: the authorization column on a scope DO created before it existed. Nullable,
                 // so legacy outbox rows read as "unrecorded". (_substrat_denials is a new table,
                 // covered by KERNEL_DDL's IF NOT EXISTS with no ALTER.)
@@ -1962,6 +2534,10 @@ export function defineScopeDO(modules, bareOps) {
                 'ALTER TABLE _substrat_outbox ADD COLUMN impersonation TEXT',
                 'ALTER TABLE _substrat_platform_requests ADD COLUMN impersonation TEXT',
                 'ALTER TABLE _substrat_denials ADD COLUMN impersonation TEXT',
+                // #1525: the invocation a refusal happened during, on a scope DO created before
+                // the column. Nullable, and the null is honestly "no id was carried" — a past
+                // denial's call cannot be decided afterwards, as #1237's outbox column argued.
+                'ALTER TABLE _substrat_denials ADD COLUMN invocation_id TEXT',
                 // #1231: the emitting operation, on a scope DO created before the column.
                 // Nullable so every legacy row reads as unrecorded rather than named.
                 'ALTER TABLE _substrat_outbox ADD COLUMN operation TEXT',
@@ -1997,6 +2573,33 @@ export function defineScopeDO(modules, bareOps) {
             // boot. `lint:spine-ddl` compares KERNEL_DDL's indexes only, so this one is held to
             // both adapters by the query-plan test rather than by that gate.
             this.sql.exec('CREATE INDEX IF NOT EXISTS _substrat_outbox_invocation ON _substrat_outbox (invocation_id, id)');
+            this.ensureScheduleStateKind();
+        }
+        /**
+         * #1288: `_substrat_schedule_state`, rebuilt with `kind` in its key on a scope DO
+         * whose table predates the column. Not in the ALTER list above, because `kind`
+         * joins the PRIMARY KEY and no ALTER can widen a key — the statements are the
+         * kernel's, so the pure adapter rebuilds byte-identically.
+         *
+         * Detected from `sqlite_master.sql`: DO SQLite restricts `PRAGMA`, and reading
+         * the stored DDL is the one probe both adapters can make.
+         */
+        ensureScheduleStateKind() {
+            const row = this.sql
+                .exec(`SELECT sql FROM sqlite_master WHERE type = 'table' AND name = ?`, '_substrat_schedule_state')
+                .toArray()[0];
+            if (!row || scheduleStateHasKind(row.sql))
+                return;
+            // In a transaction, for the reason the kernel constant spells out: create-copy-
+            // drop-rename has two intermediate states and both are unrecoverable on the next
+            // wake. `transactionSync`, not the async one every operation uses — the DO
+            // runtime forbids a manual BEGIN through `sql.exec`, and this body is wholly
+            // synchronous, which is the one case the sync API is for (it commits at the
+            // first await, and there is none). It also has to be sync because the caller is.
+            this.ctx.storage.transactionSync(() => {
+                for (const stmt of splitSqlStatements(SCHEDULE_STATE_REBUILD))
+                    this.sql.exec(stmt);
+            });
         }
         async importDump(tables, destScopeId) {
             // The WHOLE drop-then-replay runs under deferred foreign keys, in one transaction.
@@ -2196,7 +2799,13 @@ export function defineScopeDO(modules, bareOps) {
          * later alarm-driven drain with a call it had nothing to do with.
          */
         invocationId = null;
-        async dispatch(tenantId, scopeId) {
+        async dispatch(tenantId, scopeId, 
+        /**
+         * #1525: the call this drain is running in, or null. Every round of the loop
+         * belongs to it: a consumer's own emit is delivered in the same tail, so the
+         * whole cascade is one call's work.
+         */
+        invocationId) {
             for (let round = 0; round < 50; round++) {
                 let deliveredAny = false;
                 for (const mod of this.modules.values()) {
@@ -2222,16 +2831,18 @@ export function defineScopeDO(modules, bareOps) {
                                         system: mod.id,
                                     });
                                     await consumer.handler(ctx, event);
-                                    this.sql.exec(`INSERT INTO _substrat_deliveries (event_id, consumer_module, delivered_at)
-                     VALUES (?, ?, ?)`, event.id, mod.id, new Date().toISOString());
+                                    this.sql.exec(`INSERT INTO _substrat_deliveries
+                       (event_id, consumer_module, delivered_at, invocation_id)
+                     VALUES (?, ?, ?, ?)`, event.id, mod.id, new Date().toISOString(), invocationId);
                                 });
                                 deliveredAny = true;
                             }
                             catch (err) {
                                 // Dead-letter (v0): journal the failure so one poison event
                                 // can't wedge the loop. Written outside the rolled-back txn.
-                                this.sql.exec(`INSERT INTO _substrat_deliveries (event_id, consumer_module, delivered_at, error)
-                   VALUES (?, ?, ?, ?)`, event.id, mod.id, new Date().toISOString(), String(err));
+                                this.sql.exec(`INSERT INTO _substrat_deliveries
+                     (event_id, consumer_module, delivered_at, error, invocation_id)
+                   VALUES (?, ?, ?, ?, ?)`, event.id, mod.id, new Date().toISOString(), String(err), invocationId);
                             }
                             finally {
                                 // Cleared on BOTH paths. Left set, the id leaks onto every later emit
@@ -2253,7 +2864,28 @@ export function defineScopeDO(modules, bareOps) {
          * survives — the whole point, since the denial is the write the operation could not make.
          */
         /** K-42: the session a refused call ran under travels with the denial row. */
-        recordDenial(subject, tenantId, operation, err, impersonation) {
+        recordDenial(subject, tenantId, operation, err, 
+        /**
+         * #1525: the invocation this refusal belongs to, or null — PASSED, never read off
+         * `this.invocationId` here.
+         *
+         * Reading the ambient field is only self-evidently right where one call holds the
+         * DO to itself, and two denial paths do not: `attachmentList` and
+         * `attachmentAuthorize` run OUTSIDE `this.queue`, and both await before they
+         * record (`ensureMigrations`, `ctx.check`). Whether the input gate can actually
+         * reopen far enough for one of them to observe an in-flight call's id is NOT
+         * settled here — a probe that raced twelve attachment refusals against invokes
+         * holding an id (including one awaiting the control plane) recorded null every
+         * time, so the gate evidently holds more than the shape of the code promises.
+         *
+         * Passed anyway, because the argument for the ambient read is an argument about
+         * workerd's gate semantics, and the argument for a parameter is local: the invoke
+         * path passes its own id, every attachment path passes null, and each says what it
+         * actually knows. That is the property worth having on a recorded fact, and it
+         * costs one argument. No test accompanies it — the condition could not be
+         * reproduced, and a test that passes either way would be worse than none.
+         */
+        invocationId, impersonation) {
             // Only an ENFORCED denial (assertAllowed, which attaches the checked permission +
             // node) is recorded. A module's own hand-thrown `new PermissionDenied('…')` carries
             // no permission key and is left to the module.
@@ -2265,8 +2897,11 @@ export function defineScopeDO(modules, bareOps) {
                     ? { connection: subject.id }
                     : subject.id;
             this.sql.exec(`INSERT INTO _substrat_denials
-           (id, actor, permission, tenant_id, scope_id, operation, impersonation, at)
-         VALUES (?, ?, ?, ?, ?, ?, ?, ?)`, ulid(), JSON.stringify(actor), err.permission, err.node.tenantId, err.node.scopeId ?? null, operation, impersonation ? JSON.stringify(impersonationStampOf(impersonation)) : null, new Date().toISOString());
+           (id, actor, permission, tenant_id, scope_id, operation, impersonation,
+            invocation_id, at)
+         VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?)`, ulid(), JSON.stringify(actor), err.permission, err.node.tenantId, err.node.scopeId ?? null, operation, impersonation ? JSON.stringify(impersonationStampOf(impersonation)) : null, 
+            // #1525: the call this refusal belongs to, as the caller named it.
+            invocationId, new Date().toISOString());
         }
         parseOutboxRow(row) {
             return domainEvent.parse({