@substrat-run/adapter-cloudflare 0.114.0 → 0.117.0

package/dist/host.js

@@ -1,6 +1,7 @@
-import { fromWireFailure, accessLogEntry, adminLogEntry, opsFailureEntry, opsFailureFingerprint, issueEntry, sweepRunEntry, FRESHNESS_HEARTBEAT_MINUTES, sweepRunsPayload, modelUsageEntry, attachmentRecord, createTenantInput, identityLink, identityPool, createOrgInput, promotionAcknowledgement, bindHostnameInput, channelHistoryEntry, hostnameBinding, publishVersionInput, AUTO_ADMISSION_NOTE, registerVerticalInput, vertical as verticalSchema, verticalServingState, verticalChannel, verticalVersion, connection, capabilityGrant, connectionGrant, connectionGrantRecord, connectionSecret, systemGrant, entitlementGrant, entitlementGrantInput, instant, meterReading, subjectRef, createConnectionInput, projectedConnectionGrant, projectedConnectionKey, moduleManifest, org as orgSchema, orgMembership, resolvedIdentity, roleDefinition, scope as scopeSchema, tenant as tenantSchema, tenantRole, delegatedReadRecord, subjectShredReceipt, platformRequest, connectorDispatchKind, outboundOfManifestJson, substratError, redrainEventsInput, } from '@substrat-run/contracts';
+import { fromWireFailure, accessLogEntry, adminLogEntry, opsFailureEntry, opsFailureFingerprint, issueEntry, sweepRunEntry, FRESHNESS_HEARTBEAT_MINUTES, sweepRunsPayload, modelUsageEntry, attachmentRecord, createTenantInput, identityLink, identityPool, createOrgInput, promotionAcknowledgement, bindHostnameInput, channelHistoryEntry, hostnameBinding, publishVersionInput, AUTO_ADMISSION_NOTE, registerVerticalInput, vertical as verticalSchema, verticalServingState, verticalChannel, verticalVersion, connection, capabilityExchange, capabilityGrant, principalId, connectionGrant, connectionGrantRecord, connectionSecret, systemGrant, systemSwitch, systemSwitchOutcome, entitlementGrant, entitlementGrantInput, instant, meterReading, subjectRef, createConnectionInput, projectedConnectionGrant, projectedConnectionKey, moduleManifest, org as orgSchema, orgMembership, resolvedIdentity, identityMembership, roleDefinition, scope as scopeSchema, tenant as tenantSchema, tenantRole, delegatedReadRecord, subjectShredReceipt, connectorDispatchKind, outboundOfManifestJson, substratError, redrainEventsInput, } from '@substrat-run/contracts';
 import { normalizeHostname, toRouteTarget } from './route-resolver.js';
-import { attachmentBlobKey, entitlementDenial, foldMeterReading, parseValidationRecords, resolveScopeRecord, ulid, foldModelUsage, backoffAt, resolveRetryPolicy, isSecretBoxConfigured, unconfiguredSecretBox, createSubjectKeys, generateSealingKeyPair, openSealed, ImpersonationRefused, assertSessionUsable, impersonationRowValues, mapImpersonationRow, newImpersonationSession, globalFetch, assertRedrainWindow, } from '@substrat-run/kernel';
+import { attachmentBlobKey, entitlementDenial, foldMeterReading, parseValidationRecords, resolveScopeRecord, ulid, capabilityTokenHash, checkBecomeInput, plausibleSessionToken, foldModelUsage, backoffAt, resolveRetryPolicy, isSecretBoxConfigured, unconfiguredSecretBox, createSubjectKeys, generateSealingKeyPair, openSealed, ImpersonationRefused, assertSessionUsable, impersonationRowValues, mapImpersonationRow, newImpersonationSession, jobRunOf, runDueJobRuns, startJobRun, globalFetch, assertRedrainWindow, platformRequestOf, undrainedEventsOf, systemSwitchedOffMessage, } from '@substrat-run/kernel';
+import { isOrangeToOrange, isUpgradeRequest, LIVE_MODE_HEADER, LIVE_PRINCIPAL_HEADER, LIVE_SCOPE_HEADER, LIVE_SUBSCRIBE_PATH, LIVE_TENANT_HEADER, } from './live-reads.js';
 import { tenantStoreDatabaseName } from './d1.js';
 import { blobStoreBucketName, r2TenantBlobStore } from './r2.js';
 /** DO row → contract shape. Never reads the secrets table — that is the split. */
@@ -21,23 +22,6 @@ const toConnection = (r) => connection.parse({
     createdAt: r.created_at,
     revokedAt: r.revoked_at,
 });
-/** Map a stored platform-request row to the `PlatformRequest` contract shape (JSON columns parsed). */
-function rowToPlatformRequest(r) {
-    return platformRequest.parse({
-        id: r.id,
-        kind: r.kind,
-        payload: JSON.parse(r.payload),
-        requestedBy: JSON.parse(r.requested_by),
-        impersonation: r.impersonation == null ? null : JSON.parse(r.impersonation),
-        status: r.status,
-        attempts: r.attempts,
-        lastError: r.last_error,
-        failure: r.last_failure == null ? null : JSON.parse(r.last_failure),
-        result: r.result === null ? null : JSON.parse(r.result),
-        requestedAt: r.requested_at,
-        settledAt: r.settled_at,
-    });
-}
 /**
  * A control-plane stand-in for a CP-less vertical (scope-local-permissions.md Phase 3).
  * The hot path a served scope actually touches becomes trust-the-upstream:
@@ -99,6 +83,14 @@ export class CloudflareScopeHost {
     /** Worker-side attachment-bucket resolver (#473); undefined ⇒ attachments() refuses. */
     attachmentBuckets;
     executors = new Map();
+    /**
+     * `<moduleId>/<job>` → the pass body and its default step policy (#1577). Host
+     * code like `executors`, and keyed the way a run row is: the coalescing key's
+     * first two thirds, so a run read off the DO finds its handler by the columns it
+     * already carries. The HANDLER stays on the coordinator — it holds credentials
+     * and calls the internet, which is why the DO never sees it.
+     */
+    jobs = new Map();
     /**
      * The event currently being effected, stamped onto admin rows the executor writes.
      * Ambient rather than threaded through every HostAdmin signature: set and cleared
@@ -112,6 +104,8 @@ export class CloudflareScopeHost {
     connectorDelegation;
     /** #1334: the Tier-2 drain's reach into the deployment serving a scope. */
     eventDrainDelegation;
+    /** #1666: the schedule kill switch's reach into the deployment serving a scope. */
+    systemSwitchDelegation;
     /**
      * MUST be constructed per request. Never cache an instance across requests.
      *
@@ -137,6 +131,7 @@ export class CloudflareScopeHost {
             : nullControlPlane();
         this.connectorDelegation = options.connectorDelegation;
         this.eventDrainDelegation = options.eventDrainDelegation;
+        this.systemSwitchDelegation = options.systemSwitchDelegation;
         this.admin = this.buildAdmin();
     }
     // -- registration mechanics (validation only) -----------------------------
@@ -245,7 +240,16 @@ export class CloudflareScopeHost {
      * delivery cannot wedge the ones behind it. At-least-once still requires
      * idempotent handlers.
      */
-    async drainExecutors(tenantId, scopeId) {
+    async drainExecutors(tenantId, scopeId, 
+    /**
+     * #1525: the call this drain pass is running in, or null.
+     *
+     * The coordinator is the ONLY side that knows. Executors run here, not in the DO,
+     * so by the time the journal RPC arrives the DO's queued body has returned and its
+     * own `invocationId` field reads null — an ambient read there would record "no
+     * call" for every attempt an operation's own tail made.
+     */
+    invocationId) {
         const report = {
             attempted: 0,
             delivered: 0,
@@ -258,7 +262,16 @@ export class CloudflareScopeHost {
         const stub = this.scopeStub(scopeId);
         for (const [id, executor] of this.executors) {
             const deliveryId = `executor:${id}`;
-            const events = await stub.pendingExecutorEvents(deliveryId, executor.eventType);
+            const { events, undecodable } = await stub.pendingExecutorDeliveries(deliveryId, executor.eventType);
+            // #1636: an event the DO could not decode is dead-lettered for this executor at once,
+            // and its handler never sees it. Terminal on the FIRST failure, unlike a handler's:
+            // the decode is pure, so a retry cannot succeed. The rows behind it are delivered
+            // below — the decode used to throw the whole list, on every pass.
+            for (const bad of undecodable) {
+                report.attempted += 1;
+                await stub.recordExecutorAttempt(bad.eventId, deliveryId, bad.error, null, invocationId);
+                report.deadLettered += 1;
+            }
             for (const event of events) {
                 report.attempted += 1;
                 this.causedBy = event.id;
@@ -272,17 +285,17 @@ export class CloudflareScopeHost {
                         // the authority this host lacks. The intent row carries the retry
                         // state from here on; the handler's own idempotency ledger absorbs
                         // the at-least-once residue, as it already must in-process.
-                        await stub.routeExecutorEventToPlatform(event.id, deliveryId, connectorDispatchKind(executor.provider), JSON.stringify({ executorId: id, event }), JSON.stringify({ system: 'connector-dispatch' }));
+                        await stub.routeExecutorEventToPlatform(event.id, deliveryId, connectorDispatchKind(executor.provider), JSON.stringify({ executorId: id, event }), JSON.stringify({ system: 'connector-dispatch' }), invocationId);
                         report.routedToPlatform += 1;
                     }
                     else if (executor.kind === 'connector') {
                         await executor.handler(await this.connectorContext(tenantId, scopeId, executor.timeoutMs, event.id), event);
-                        await stub.recordExecutorAttempt(event.id, deliveryId, null, null);
+                        await stub.recordExecutorAttempt(event.id, deliveryId, null, null, invocationId);
                         report.delivered += 1;
                     }
                     else {
                         await executor.handler(this.admin, event);
-                        await stub.recordExecutorAttempt(event.id, deliveryId, null, null);
+                        await stub.recordExecutorAttempt(event.id, deliveryId, null, null, invocationId);
                         report.delivered += 1;
                     }
                 }
@@ -293,7 +306,7 @@ export class CloudflareScopeHost {
                     const prior = await stub.executorAttempts(event.id, deliveryId);
                     const attempts = prior + 1;
                     const exhausted = attempts >= executor.retry.maxAttempts;
-                    await stub.recordExecutorAttempt(event.id, deliveryId, message, exhausted ? null : backoffAt(attempts, executor.retry, new Date()));
+                    await stub.recordExecutorAttempt(event.id, deliveryId, message, exhausted ? null : backoffAt(attempts, executor.retry, new Date()), invocationId);
                     if (exhausted)
                         report.deadLettered += 1;
                     else
@@ -311,7 +324,65 @@ export class CloudflareScopeHost {
         // does not get its effects driven either.
         await this.cp.validateScopeAccess(tenantId, scopeId);
         await this.migrateAndRecord(scopeId);
-        return this.drainExecutors(tenantId, scopeId);
+        // #1525: null, and honestly so — a sweep is not a call. An attempt this pass makes
+        // records no invocation, which is what distinguishes it from the first attempt the
+        // emitting operation's own tail made.
+        return this.drainExecutors(tenantId, scopeId, null);
+    }
+    registerJob(moduleId, name, handler, retry) {
+        const key = `${moduleId}/${name}`;
+        if (this.jobs.has(key))
+            throw new Error(`job '${key}' is already registered`);
+        this.jobs.set(key, { handler, retry });
+    }
+    /**
+     * D-14's DURABLE driver: the run store is RPC to the scope DO, and nothing else.
+     *
+     * The pass engine stays on the coordinator — it is the same kernel code the pure
+     * adapter runs, so the two drivers cannot disagree about when a step is skipped or
+     * when a run fails. What crosses into the DO is a row read and a row write, which
+     * is also the only part that has to be durable.
+     *
+     * Every step costs a round trip, deliberately. Batching a pass's steps into one
+     * write at the end would be cheaper and would lose exactly the work an eviction
+     * mid-pass is supposed to keep — and a DO is evicted and revived constantly.
+     */
+    jobStore(scopeId) {
+        const stub = this.scopeStub(scopeId);
+        return {
+            startOrJoin: (key, row) => stub.jobRunStartOrJoin(key.moduleId, key.job, key.instance, row),
+            get: (id) => stub.jobRunById(id),
+            due: (now, limit, afterId) => stub.jobRunsDue(now, limit, afterId),
+            list: (filter) => stub.jobRunList(filter),
+            patch: (id, patch) => stub.jobRunPatch(id, patch),
+            commitPass: (id, patch) => stub.jobCommitPass(id, patch),
+            step: (runId, name) => stub.jobStepRow(runId, name),
+            recordStep: (runId, name, result, attempts, lastError, at) => stub.jobStepRecord(runId, name, result, attempts, lastError, at),
+        };
+    }
+    async startJobRun(tenantId, scopeId, input) {
+        await this.cp.validateScopeAccess(tenantId, scopeId);
+        await this.migrateAndRecord(scopeId);
+        return jobRunOf(await startJobRun(this.jobStore(scopeId), input, ulid, () => new Date().toISOString()));
+    }
+    async runDueJobs(tenantId, scopeId, options) {
+        // Same lifecycle gate as `drainDue`: a suspended scope's runs wait rather than
+        // advance, and an archived one's never move again.
+        await this.cp.validateScopeAccess(tenantId, scopeId);
+        await this.migrateAndRecord(scopeId);
+        return runDueJobRuns({
+            store: this.jobStore(scopeId),
+            handlerFor: (run) => this.jobs.get(`${run.module_id}/${run.job}`),
+            now: () => new Date().toISOString(),
+            openScope: (run) => this.getSystemScope(run.module_id, tenantId, scopeId),
+            maxPasses: options?.maxPasses,
+            limit: options?.limit,
+        });
+    }
+    async jobRuns(tenantId, scopeId, filter) {
+        await this.cp.validateScopeAccess(tenantId, scopeId);
+        await this.migrateAndRecord(scopeId);
+        return (await this.jobStore(scopeId).list(filter ?? {})).map(jobRunOf);
     }
     async dispatchConnector(tenantId, scopeId, handler, event, options) {
         // The platform half of a routed delivery (#574 phase 3). The same lifecycle gate as
@@ -344,12 +415,13 @@ export class CloudflareScopeHost {
     async listPlatformRequests(tenantId, scopeId) {
         await this.cp.validateScopeAccess(tenantId, scopeId);
         await this.migrateAndRecord(scopeId);
-        return (await this.scopeStub(scopeId).pendingPlatformRequests()).map(rowToPlatformRequest);
+        // Tolerant (#1588): one undecodable row comes back naming why, never throws for the list.
+        return (await this.scopeStub(scopeId).pendingPlatformRequests()).map(platformRequestOf);
     }
     async listPlatformRequestHistory(tenantId, scopeId, filter) {
         await this.cp.validateScopeAccess(tenantId, scopeId);
         await this.migrateAndRecord(scopeId);
-        return (await this.scopeStub(scopeId).platformRequestHistory(filter)).map(rowToPlatformRequest);
+        return (await this.scopeStub(scopeId).platformRequestHistory(filter)).map(platformRequestOf);
     }
     async settlePlatformRequest(tenantId, scopeId, id, outcome) {
         await this.cp.validateScopeAccess(tenantId, scopeId);
@@ -528,13 +600,17 @@ export class CloudflareScopeHost {
     async appliedMigrationsLocal(scopeId) {
         return this.scopeStub(scopeId).appliedMigrations();
     }
+    /** This host's own scope's database size in bytes (#1524), the vertical-host read. */
+    async databaseSizeLocal(scopeId) {
+        return this.scopeStub(scopeId).databaseSize();
+    }
     /**
      * The oldest not-yet-drained events of this host's own scope (#1334) — the far end of
      * the control plane's `EventDrainDelegation`. Bounded the same way the audited verb is,
      * so a caller cannot ask this side for more than the other would.
      */
     async undrainedEventsLocal(scopeId, limit) {
-        return this.scopeStub(scopeId).undrainedEvents(Math.min(Math.max(limit, 1), 1000));
+        return undrainedEventsOf(await this.scopeStub(scopeId).undrainedEventsRead(Math.min(Math.max(limit, 1), 1000)));
     }
     /**
      * Stamp `drained_at` on this host's own scope (#1334) — the delegation's other half.
@@ -552,6 +628,16 @@ export class CloudflareScopeHost {
     async redrainEventsLocal(scopeId, drainedBefore) {
         return this.scopeStub(scopeId).redrainEvents(drainedBefore);
     }
+    /**
+     * How many rows that reopen would touch, in this host's own scope (#1545) — the
+     * read-only half a dry run asks for. A separate method rather than a flag on the one
+     * above: the two return the same shape, so a lost argument would turn a count into a
+     * reopen silently, and a name cannot be lost that way. No audit, like the reopen: the
+     * platform's `redrainEvents` is the door, and a count egresses nothing to record.
+     */
+    async redrainCountLocal(scopeId, drainedBefore) {
+        return this.scopeStub(scopeId).redrainCount(drainedBefore);
+    }
     /**
      * The PITR bookmarks one scope recorded before its migration passes (#286) — the
      * rewind points a backout UI offers. Behind the vertical's platform-gated
@@ -651,14 +737,18 @@ export class CloudflareScopeHost {
         // holds exactly the permissions its schedules declared, on this scope, so
         // `ctx.check` resolves for scheduled work (the gate stays the check). Written to
         // the scope's own tuples, where the checker reads them — the same place the owner
-        // grant and connection grants land. Idempotent, so a re-provision re-asserts them.
+        // grant and connection grants land. Idempotent, so a re-provision re-asserts them —
+        // SEATED (#1659): a missing grant is recreated, a revoked one stays revoked. The
+        // per-scope schedule kill switch is `revokeFromSystem` (#1666), and its OFF marker is
+        // not a grant, so no reconcile can seat it away; `restoreToSystem` is the only way back.
+        // (`grantToSystem` still clears a tuple's tombstone, but it does not move the switch.)
         for (const [moduleId, schedules] of this.moduleSchedules) {
             const perms = new Set();
             for (const s of schedules)
                 for (const p of s.permissions)
                     perms.add(p);
             for (const perm of perms) {
-                await this.scopeStub(input.scopeId).writeTuple(`system:${moduleId}`, `granted:${perm}`, `scope:${input.scopeId}`, null);
+                await this.scopeStub(input.scopeId).seatTuple(`system:${moduleId}`, `granted:${perm}`, `scope:${input.scopeId}`, null);
             }
         }
         // Audit a real provision only; an idempotent re-provision changed nothing.
@@ -1137,6 +1227,59 @@ export class CloudflareScopeHost {
         await this.migrateAndRecord(scopeId);
         return this.buildStub(tenantId, scopeId, undefined, undefined, moduleId);
     }
+    /**
+     * The exchange (#1672) — the same fail-closed (tenant, scope) and lifecycle gate as
+     * `getScope`, then the kernel's `exchangeCapability` inside the ScopeDO, where the
+     * capability row lives. The answer is re-parsed on this side of the RPC.
+     */
+    async exchangeCapability(tenantId, scopeId, secret, options) {
+        await this.cp.validateScopeAccess(tenantId, scopeId);
+        await this.migrateAndRecord(scopeId);
+        const outcome = await this.scopeStub(scopeId).exchangeCapability(secret, tenantId, scopeId, options?.mode);
+        return capabilityExchange.nullable().parse(outcome);
+    }
+    /**
+     * The capability door (#1672) — mirror of the connection, system and impersonation doors.
+     * The token is shape-checked and hashed HERE; only its hash reaches the ScopeDO, which
+     * re-resolves it to its capability on every invoke and acknowledges that it did.
+     */
+    async getCapabilityScope(sessionToken, tenantId, scopeId, options) {
+        if (!plausibleSessionToken(sessionToken)) {
+            throw substratError('unauthenticated', 'not a capability session token');
+        }
+        await this.cp.validateScopeAccess(tenantId, scopeId);
+        await this.migrateAndRecord(scopeId);
+        const hash = await capabilityTokenHash(sessionToken);
+        return this.buildStub(tenantId, scopeId, undefined, undefined, undefined, options, undefined, hash);
+    }
+    /**
+     * Is this the SHARED control plane's host — the one whose own `SCOPE` namespace holds no
+     * hosted scope's storage, and which routes scope writes to the serving deployment? The
+     * delegations are set on that host and no other (their own docs say so), so any one of
+     * them being present is the signal.
+     */
+    get servesScopesElsewhere() {
+        return Boolean(this.connectorDelegation || this.systemSwitchDelegation || this.eventDrainDelegation);
+    }
+    /**
+     * Where a platform capability verb (#1672) may write: this host's own ScopeDO — refused,
+     * loudly, on the shared control plane for a scope bound to a vertical, whose storage lives
+     * in that vertical's deployment. Writing through `this.scopeStub` there would mint into
+     * an empty DO of the wrong namespace, a capability nobody could ever exchange. Delegating
+     * these verbs to the serving deployment (as the schedule switch is) is a follow-up; the
+     * claim-link migration is the first caller that needs it.
+     */
+    async capabilityScopeStub(tenantId, scopeId, verb) {
+        const rec = await this.cp.getScopeRecord(tenantId, scopeId);
+        if (!rec)
+            throw substratError('not_found', `unknown scope for tenant: (${tenantId}, ${scopeId})`);
+        if (this.servesScopesElsewhere && rec.vertical !== null) {
+            throw substratError('unavailable', `${verb} cannot reach scope ${scopeId}: it is served by the '${rec.vertical}' ` +
+                'deployment, and platform capability verbs are not delegated there yet');
+        }
+        await this.migrateAndRecord(scopeId);
+        return { stub: this.scopeStub(scopeId), vertical: rec.vertical };
+    }
     registeredSchedules() {
         const out = [];
         for (const [moduleId, schedules] of this.moduleSchedules) {
@@ -1196,7 +1339,8 @@ export class CloudflareScopeHost {
             const heartbeatDue = p.stateAt === null || now - Date.parse(p.stateAt) > FRESHNESS_HEARTBEAT_MINUTES * 60_000;
             if (!changed && !heartbeatDue)
                 continue;
-            await stub.recordScheduleRun(`freshness:${eventType}`, nowIso, outcome);
+            // #1288: 'freshness', said rather than inferred from the key's prefix.
+            await stub.recordScheduleRun(`freshness:${eventType}`, nowIso, outcome, 'freshness');
             report.checks.push({ eventType, outcome, observedAt: p.observedAt, withinHours });
         }
         return report;
@@ -1217,11 +1361,22 @@ export class CloudflareScopeHost {
                 return report;
         }
         const stub = this.scopeStub(scopeId);
-        // The grant IS the switch (#383): run only where the scope holds a live
-        // `system:<moduleId>` grant. Skips a foreign-vertical scope and a per-tenant
-        // revoke quietly — no run, no error.
-        if (!(await stub.hasSystemGrant(moduleId)))
+        // The grant IS the switch (#383), and the kill switch is its lever (#1666): the
+        // kernel's `systemScheduleState`, the one predicate both adapters run. A scope that
+        // never held the module's grant (a foreign vertical's) is a quiet no-op, exactly as
+        // before. A scope switched OFF reports every schedule `skipped`, never `failed`, and
+        // does not touch its cadence rows — so a restore fires a due schedule on the next pass.
+        const state = await stub.systemScheduleState(moduleId);
+        if (state === 'ungranted')
             return report;
+        if (state === 'off') {
+            for (const schedule of schedules) {
+                report.skipped += 1;
+                report.runs.push({ operation: schedule.operation, outcome: 'skipped' });
+            }
+            report.switchedOff = true;
+            return report;
+        }
         const now = Date.now();
         for (const schedule of schedules) {
             const last = await stub.scheduleLastRun(schedule.operation);
@@ -1246,7 +1401,9 @@ export class CloudflareScopeHost {
                     error: err instanceof Error ? err.message : String(err),
                 });
             }
-            await stub.recordScheduleRun(schedule.operation, new Date(now).toISOString(), status);
+            // #1288: 'schedule', whatever this operation happens to be called — including
+            // `freshness:<something>`, which is exactly the row the evaluator no longer eats.
+            await stub.recordScheduleRun(schedule.operation, new Date(now).toISOString(), status, 'schedule');
             report.runs.push({ operation: schedule.operation, outcome: status === 'ok' ? 'ok' : 'failed' });
         }
         return report;
@@ -1260,16 +1417,25 @@ export class CloudflareScopeHost {
      * time box that never runs out for the one caller holding it, and
      * `endImpersonation` would stop nothing.
      */
-    sessionId) {
+    sessionId, 
+    /**
+     * #1672: the HASH of a capability session token — the capability door hashed it and
+     * the plaintext goes no further. The ScopeDO resolves it on every invoke, inside its
+     * queue, and acknowledges it; see the refusal below for why the acknowledgement matters.
+     */
+    capabilitySession) {
         const stub = this.scopeStub(scopeId);
         const cp = this.cp;
         const operationEntitlement = this.operationEntitlement;
         // The DO needs SOME principal-shaped value for `ctx.principal`; for a
         // connection it is the connection id, for a schedule the module id, and the
-        // honest attribution rides on the event actor instead.
+        // honest attribution rides on the event actor instead. For a capability it is a
+        // FRESH id nobody holds anything under (#1672): the DO replaces it with the resolved
+        // capability, and a DO too old to know that would act as nobody rather than as someone.
         const asPrincipalId = (principal ??
             connectionId ??
-            systemModuleId);
+            systemModuleId ??
+            (capabilitySession !== undefined ? principalId.parse(ulid()) : undefined));
         return {
             tenantId,
             scopeId,
@@ -1291,7 +1457,7 @@ export class CloudflareScopeHost {
                 }
                 // K-42: resolved per invoke, so expiry and `endImpersonation` both bite.
                 const session = sessionId === undefined ? undefined : await this.resolveImpersonation(sessionId, tenantId, scopeId);
-                const envelope = await stub.invoke(operation, input, asPrincipalId, tenantId, scopeId, connectionId, requiredKey, systemModuleId, true, invokeOptions, session);
+                const envelope = await stub.invoke(operation, input, asPrincipalId, tenantId, scopeId, connectionId, requiredKey, systemModuleId, true, invokeOptions, session, capabilitySession);
                 // The operation failed and the DO handed the error back as DATA — so it still
                 // has its code and extensions, which a throw across this boundary would have
                 // stripped down to a message (#113 §3). Rethrown here, where the caller expects
@@ -1325,6 +1491,14 @@ export class CloudflareScopeHost {
                 // principal with nothing stamped and no read-only bound. The write has
                 // committed; what this refuses is the SUCCESS, because a support session
                 // believed to be recorded and bounded is worse than no support session.
+                // #1672, the same shape: a DO too old to know about capability sessions ignored the
+                // hash and ran the call as the fresh placeholder principal, who holds nothing — so
+                // the likely outcome is a refusal, but a SUCCESS here would have been decided
+                // without the capability's grant, its allowlist or its liveness, and is refused.
+                if (capabilitySession !== undefined && envelope.capability?.honoured !== true) {
+                    throw substratError('unavailable', `${operation} ran on a scope host that did not understand capability sessions. ` +
+                        'Retry once the scope has been migrated');
+                }
                 if (session !== undefined && envelope.impersonation?.honoured !== true) {
                     throw substratError('unavailable', `${operation} ran on a scope host that did not understand impersonation — the ` +
                         'operation may have run unrecorded and unbounded. Retry once the scope has ' +
@@ -1337,7 +1511,9 @@ export class CloudflareScopeHost {
                 // Whatever the outbox already held is the drain sweep's own backstop.
                 const drained = session?.mode === 'read-only'
                     ? { attempted: 0, delivered: 0, retrying: 0, deadLettered: 0, routedToPlatform: 0 }
-                    : await this.drainExecutors(tenantId, scopeId);
+                    // #1525: this drain is part of the call that emitted the events — the
+                    // coordinator's half of the post-commit tail the DO ran the consumers in.
+                    : await this.drainExecutors(tenantId, scopeId, invokeOptions?.invocationId ?? null);
                 // #458: the operation committed having enqueued platform intents — tell the
                 // caller's harness so it can flag the response for the router kick (#381).
                 // Routed connector deliveries (#574 phase 3) count too: the inline drain just
@@ -1479,6 +1655,74 @@ export class CloudflareScopeHost {
                 await this.cp.writeTenantTuple(node.tenantId, subject, `granted:${permission}`, `tenant:${node.tenantId}`, expiresAt ?? null);
             }
         };
+        /**
+         * #1666: move one module's schedule switch on one scope — see `HostAdmin.revokeFromSystem`.
+         *
+         * Where the write lands is the whole point of the delegation branch. The shared control
+         * plane's own `SCOPE` namespace is the module-less placeholder, so a hosted scope's
+         * switch has to be moved in the deployment serving it; writing it here would report a
+         * switch pulled while every schedule kept firing. The audit row is written HERE either
+         * way — the deployment's host is CP-less, and its `recordAdmin` is a no-op.
+         */
+        const switchSystem = async (actor, raw, to) => {
+            const input = systemSwitch.parse(raw);
+            const { tenantId, scopeId } = input.node;
+            let vertical = null;
+            if (!this.cpLess) {
+                const rec = await this.cp.getScopeRecord(tenantId, scopeId);
+                if (!rec)
+                    throw substratError('not_found', `unknown scope for tenant: (${tenantId}, ${scopeId})`);
+                vertical = rec.vertical;
+            }
+            // AUDIT FIRST (#1666 review): the intent row lands before anything moves, and the
+            // outcome row after — every attempt, a repeat included. The scope's store and the
+            // admin log are separate, so no order makes the pair atomic; this one fails toward
+            // "an intent with no recorded outcome" and never toward "a switch that moved with no
+            // audit row". A retry after a crash re-audits even though it answers `changed: false`.
+            const operationId = ulid();
+            const action = to === 'off' ? 'revokeFromSystem' : 'restoreToSystem';
+            const target = { tenantId, scopeId, vertical };
+            const base = { operationId, moduleId: input.moduleId, schedules: to };
+            await this.recordAdmin(actor, action, target, null, { ...base, phase: 'intent', reason: input.reason });
+            // A scope bound to no vertical (#1666 review) has no deployment to delegate to: its
+            // store is the DO here, so the switch moves (or answers `held: false`) here too.
+            // Delegating it would throw "no deployment serving scope" instead. A scope WITH a
+            // vertical still delegates, and still fails loudly when none serves it.
+            const delegation = this.cpLess || vertical !== null ? this.systemSwitchDelegation : undefined;
+            let outcome;
+            try {
+                outcome = delegation
+                    ? await delegation.switch({ tenantId, scopeId, moduleId: input.moduleId, to })
+                    : await this.scopeStub(scopeId).switchSystemSchedules(input.moduleId, scopeId, to, new Date().toISOString());
+            }
+            catch (err) {
+                // Best effort: the original error is what the caller must see, and the intent row
+                // already says an attempt was made.
+                await this.recordAdmin(actor, action, target, null, {
+                    ...base,
+                    phase: 'failed',
+                    error: err instanceof Error ? err.message : String(err),
+                }).catch(() => undefined);
+                throw err;
+            }
+            await this.recordAdmin(actor, action, target, null, {
+                ...base,
+                phase: outcome.held ? 'applied' : 'refused',
+                changed: outcome.changed,
+                permissions: outcome.permissions,
+            });
+            if (!outcome.held) {
+                throw substratError('not_found', `scope ${scopeId} holds no system grant for module '${input.moduleId}' — nothing to switch ${to} ` +
+                    `(check the module id: it is the module's manifest id, e.g. '@substrat-run/engine-absence')`);
+            }
+            return {
+                operationId,
+                moduleId: input.moduleId,
+                schedules: to,
+                changed: outcome.changed,
+                permissions: outcome.permissions,
+            };
+        };
         return {
             // #603: fixed at construction — a worker deployed without SECRET_BOX_KEY can never
             // store a credential, and saying so is what lets a transport answer 503 instead of 500.
@@ -1617,11 +1861,59 @@ export class CloudflareScopeHost {
                 // The scheduler's grant (#383) — mirror of grantToConnection. Narrow: one
                 // module, one permission; tombstones on revoke; shows in the permission diff.
                 const grant = systemGrant.parse(raw);
-                await writeGrant(subjectRef({ kind: 'system', id: grant.moduleId }), grant.permission, grant.node, undefined, grant.expiresAt);
+                if (grant.node.scopeId) {
+                    // #1666: refused while the module is switched off on this scope — checked and
+                    // written in one DO unit. Restore is the lever; a grant is not.
+                    const written = await this.scopeStub(grant.node.scopeId).writeSystemGrant(grant.moduleId, `granted:${grant.permission}`, `scope:${grant.node.scopeId}`, grant.expiresAt ?? null);
+                    if (!written) {
+                        throw substratError('conflict', systemSwitchedOffMessage(grant.moduleId, grant.node.scopeId));
+                    }
+                }
+                else {
+                    await writeGrant(subjectRef({ kind: 'system', id: grant.moduleId }), grant.permission, grant.node, undefined, grant.expiresAt);
+                }
                 await this.recordAdmin(actor, 'grantToSystem', { tenantId: grant.node.tenantId, scopeId: grant.node.scopeId }, null, { moduleId: grant.moduleId, permission: grant.permission, node: grant.node });
                 if (!grant.node.scopeId)
                     await this.fanOut(grant.node.tenantId);
             },
+            // #1666: the schedule kill switch and its lever back — `system-switch.ts` is the
+            // whole rule, shared with the pure adapter; this is the directory check, the reach
+            // into the scope's storage, and the audit row around it.
+            revokeFromSystem: async (actor, raw) => switchSystem(actor, raw, 'off'),
+            restoreToSystem: async (actor, raw) => switchSystem(actor, raw, 'on'),
+            // #1672 — the platform's two capability verbs. Audited AFTER the write, on both, and
+            // the failure each leaves is the safe one: a mint whose audit row did not land never
+            // returned its secret, so nobody can ever exchange it; a revoke whose row did not land
+            // has still revoked. Neither the secret nor its hash is ever in before/after.
+            mintCapability: async (actor, tenantId, scopeId, input) => {
+                // Checked HERE as well as in the DO: a typed refusal thrown across the RPC arrives as
+                // a bare message, and the caller would lose `validation_failed`. One function, so the
+                // two sides cannot disagree about what a valid mint is.
+                checkBecomeInput(input, new Date().toISOString());
+                await this.cp.validateScopeAccess(tenantId, scopeId);
+                const { stub, vertical } = await this.capabilityScopeStub(tenantId, scopeId, 'mintCapability');
+                const minted = await stub.mintBecomeCapability(input, actor);
+                await this.recordAdmin(actor, 'mintCapability', { tenantId, scopeId, vertical }, null, {
+                    capabilityId: minted.id,
+                    mode: 'become',
+                    principal: input.principal,
+                    expiresAt: input.expiresAt,
+                    maxUses: input.maxUses,
+                    label: input.label ?? null,
+                });
+                return minted;
+            },
+            revokeCapability: async (actor, tenantId, scopeId, capabilityId) => {
+                const { stub, vertical } = await this.capabilityScopeStub(tenantId, scopeId, 'revokeCapability');
+                const before = await stub.revokeCapabilityAsPlatform(capabilityId, actor);
+                if (!before) {
+                    throw substratError('not_found', `no capability ${capabilityId} in scope ${scopeId}`);
+                }
+                await this.recordAdmin(actor, 'revokeCapability', { tenantId, scopeId, vertical }, before, {
+                    capabilityId,
+                    revoked: true,
+                });
+            },
             grantToOrg: async (actor, orgId, permission, node, entity) => {
                 // The org must exist in the node's tenant. A grant to a phantom org looks
                 // applied, resolves for nobody, and still shows up in the permission diff.
@@ -1781,7 +2073,7 @@ export class CloudflareScopeHost {
                 const parsed = publishVersionInput.parse(input);
                 const owning = await this.cp.readVertical(parsed.verticalSlug);
                 if (!owning) {
-                    throw new Error(`unknown vertical '${parsed.verticalSlug}'`);
+                    throw substratError('not_found', `unknown vertical '${parsed.verticalSlug}'`);
                 }
                 // Lands PENDING — a push is not a deploy — except for a PRIVATE vertical
                 // (tenant-owned, not listed), whose blast radius is its own tenant: there the
@@ -1820,7 +2112,7 @@ export class CloudflareScopeHost {
             setVerticalListed: async (actor, slug, listed) => {
                 const existing = await this.cp.readVertical(slug);
                 if (!existing)
-                    throw new Error(`unknown vertical '${slug}'`);
+                    throw substratError('not_found', `unknown vertical '${slug}'`);
                 // Listing is the moment other tenants start trusting this code, so the
                 // version they would install must carry a real staff vouch — an auto-admitted
                 // prod version has never been read by anyone but its author.
@@ -1838,35 +2130,35 @@ export class CloudflareScopeHost {
             requestPublish: async (actor, slug) => {
                 const existing = await this.cp.readVertical(slug);
                 if (!existing)
-                    throw new Error(`unknown vertical '${slug}'`);
+                    throw substratError('not_found', `unknown vertical '${slug}'`);
                 await this.cp.updateVerticalPublishRequest(slug, new Date().toISOString());
                 await this.recordAdmin(actor, 'requestPublish', { tenantId: null }, null, { slug });
             },
             setVerticalInstallsBlocked: async (actor, slug, blocked) => {
                 const existing = await this.cp.readVertical(slug);
                 if (!existing)
-                    throw new Error(`unknown vertical '${slug}'`);
+                    throw substratError('not_found', `unknown vertical '${slug}'`);
                 await this.cp.updateVerticalInstallsBlocked(slug, blocked ? 1 : 0);
                 await this.recordAdmin(actor, 'setVerticalInstallsBlocked', { tenantId: null }, { installsBlocked: !!existing.installs_blocked }, { installsBlocked: blocked });
             },
             setVerticalTenantProvisioner: async (actor, slug, granted) => {
                 const existing = await this.cp.readVertical(slug);
                 if (!existing)
-                    throw new Error(`unknown vertical '${slug}'`);
+                    throw substratError('not_found', `unknown vertical '${slug}'`);
                 await this.cp.updateVerticalTenantProvisioner(slug, granted ? 1 : 0);
                 await this.recordAdmin(actor, 'setVerticalTenantProvisioner', { tenantId: null }, { tenantProvisioner: !!existing.tenant_provisioner }, { tenantProvisioner: granted });
             },
             setVerticalEmailSender: async (actor, slug, granted) => {
                 const existing = await this.cp.readVertical(slug);
                 if (!existing)
-                    throw new Error(`unknown vertical '${slug}'`);
+                    throw substratError('not_found', `unknown vertical '${slug}'`);
                 await this.cp.updateVerticalEmailSender(slug, granted ? 1 : 0);
                 await this.recordAdmin(actor, 'setVerticalEmailSender', { tenantId: null }, { emailSender: !!existing.email_sender }, { emailSender: granted });
             },
             deleteVertical: async (actor, slug) => {
                 const existing = await this.cp.readVertical(slug);
                 if (!existing)
-                    throw new Error(`unknown vertical '${slug}'`);
+                    throw substratError('not_found', `unknown vertical '${slug}'`);
                 // Refuse while any restorable scope is bound: a deleted registry row would strand
                 // those scopes' version pins and routing. An `archived` scope (a deleted app) still
                 // blocks — unarchive can bring it back — but the refusal names reap/restore, not
@@ -1875,10 +2167,10 @@ export class CloudflareScopeHost {
                 // for the cleanup script (#248).
                 const bound = await this.cp.countScopesForVertical(slug);
                 if (bound.live > 0) {
-                    throw new Error(`vertical '${slug}' still backs ${bound.live} scope(s) — delete or rebind them first`);
+                    throw substratError('conflict', `vertical '${slug}' still backs ${bound.live} scope(s) — delete or rebind them first`);
                 }
                 if (bound.archived > 0) {
-                    throw new Error(`vertical '${slug}' still backs ${bound.archived} archived scope(s) — reap or restore them first`);
+                    throw substratError('conflict', `vertical '${slug}' still backs ${bound.archived} archived scope(s) — reap or restore them first`);
                 }
                 await this.cp.deleteVertical(slug);
                 await this.recordAdmin(actor, 'deleteVertical', { tenantId: null }, { slug, source: existing.source, ownerTenant: existing.owner_tenant }, null);
@@ -1886,7 +2178,7 @@ export class CloudflareScopeHost {
             admitVersion: async (actor, versionId) => {
                 const v = await this.cp.readVersion(versionId);
                 if (!v)
-                    throw new Error(`unknown version ${versionId}`);
+                    throw substratError('not_found', `unknown version ${versionId}`);
                 if (v.admission === 'admitted') {
                     // Idempotent — except an AUTO-admitted version, which this upgrades to a
                     // manual vouch by clearing the note (what the publish seam requires).
@@ -1897,7 +2189,7 @@ export class CloudflareScopeHost {
                     return;
                 }
                 if (v.admission === 'rejected') {
-                    throw new Error(`version ${versionId} was rejected — publish a new one`);
+                    throw substratError('conflict', `version ${versionId} was rejected — publish a new one`);
                 }
                 await this.cp.setAdmission(versionId, 'admitted', null);
                 await this.recordAdmin(actor, 'admitVersion', { tenantId: null }, { admission: v.admission }, { admission: 'admitted' });
@@ -1905,7 +2197,7 @@ export class CloudflareScopeHost {
             rejectVersion: async (actor, versionId, note) => {
                 const v = await this.cp.readVersion(versionId);
                 if (!v)
-                    throw new Error(`unknown version ${versionId}`);
+                    throw substratError('not_found', `unknown version ${versionId}`);
                 if (v.admission === 'admitted') {
                     throw new Error(`version ${versionId} is already admitted — it may be bound`);
                 }
@@ -1917,7 +2209,7 @@ export class CloudflareScopeHost {
             promoteVersion: async (actor, verticalSlug, channel, versionId, acknowledge) => {
                 const incoming = await this.cp.readVersion(versionId);
                 if (!incoming)
-                    throw new Error(`unknown version ${versionId}`);
+                    throw substratError('not_found', `unknown version ${versionId}`);
                 if (incoming.vertical_slug !== verticalSlug) {
                     throw new Error(`version ${versionId} belongs to '${incoming.vertical_slug}'`);
                 }
@@ -2022,7 +2314,7 @@ export class CloudflareScopeHost {
             bindScopeVersion: async (actor, tenantId, scopeId, versionId, opts) => {
                 const v = await this.cp.readVersion(versionId);
                 if (!v)
-                    throw new Error(`unknown version ${versionId}`);
+                    throw substratError('not_found', `unknown version ${versionId}`);
                 const scope = await this.cp.getScopeRecord(tenantId, scopeId);
                 if (!scope)
                     throw new Error(`unknown scope ${scopeId} in tenant ${tenantId}`);
@@ -2068,7 +2360,7 @@ export class CloudflareScopeHost {
             verticalServing: async (actor, verticalSlug) => {
                 const r = await this.cp.readVertical(verticalSlug);
                 if (!r)
-                    throw new Error(`unknown vertical '${verticalSlug}'`);
+                    throw substratError('not_found', `unknown vertical '${verticalSlug}'`);
                 await this.recordAccess(actor, 'verticalServing', {}, { verticalSlug }, r.serving_ref ? 1 : 0);
                 if (!r.serving_ref || !r.serving_version_id || !r.serving_migration_tag)
                     return null;
@@ -2083,7 +2375,7 @@ export class CloudflareScopeHost {
                 const parsed = verticalServingState.parse(state);
                 const r = await this.cp.readVertical(verticalSlug);
                 if (!r)
-                    throw new Error(`unknown vertical '${verticalSlug}'`);
+                    throw substratError('not_found', `unknown vertical '${verticalSlug}'`);
                 await this.cp.setVerticalServing(verticalSlug, {
                     ref: parsed.ref,
                     versionId: parsed.versionId,
@@ -2097,7 +2389,7 @@ export class CloudflareScopeHost {
             versionManifest: async (actor, verticalSlug, versionId) => {
                 const v = await this.cp.readVersion(versionId);
                 if (!v || v.vertical_slug !== verticalSlug) {
-                    throw new Error(`unknown version ${versionId} for vertical '${verticalSlug}'`);
+                    throw substratError('not_found', `unknown version ${versionId} for vertical '${verticalSlug}'`);
                 }
                 await this.recordAccess(actor, 'versionManifest', {}, { verticalSlug, versionId }, v.manifest_json ? 1 : 0);
                 return v.manifest_json;
@@ -2132,6 +2424,13 @@ export class CloudflareScopeHost {
                 await this.recordAccess(actor, 'scopeMigrationBookmarks', { tenantId, scopeId }, null, bookmarks.length);
                 return bookmarks;
             },
+            scopeDatabaseSize: async (actor, tenantId, scopeId) => {
+                // Reaped is refused, not read: addressing the deleted DO would recreate it.
+                await this.scopeRecordForRead(tenantId, scopeId);
+                const bytes = await this.scopeStub(scopeId).databaseSize();
+                await this.recordAccess(actor, 'scopeDatabaseSize', { tenantId, scopeId }, null, 1);
+                return bytes;
+            },
             rewindScope: async (actor, tenantId, scopeId, bookmark, opts) => {
                 const scope = await this.cp.getScopeRecord(tenantId, scopeId);
                 if (!scope)
@@ -2305,7 +2604,7 @@ export class CloudflareScopeHost {
                         vertical: record.vertical,
                         limit: bounded,
                     })
-                    : await this.scopeStub(scopeId).undrainedEvents(bounded);
+                    : undrainedEventsOf(await this.scopeStub(scopeId).undrainedEventsRead(bounded));
                 await this.recordAccess(actor, 'readUndrainedEvents', { tenantId, scopeId }, { limit }, events.length);
                 return events;
             },
@@ -2342,11 +2641,39 @@ export class CloudflareScopeHost {
                 // The same refusal the stamp carries: a reaped scope's storage is gone, and
                 // addressing its DO would construct an empty one and report nothing reopened.
                 const record = await this.scopeRecordForRead(tenantId, scopeId);
-                const { drainedBefore } = redrainEventsInput.parse(input);
+                const { drainedBefore, countOnly } = redrainEventsInput.parse(input);
                 // The window rule at the HostAdmin boundary, not only at the control-plane door:
                 // this verb is public, so an in-process caller reaches it without that route. Host
                 // code, so the real clock is the right one to read (the DO host injects none).
+                // Applied to a count too: a future instant is as meaningless to count as it is
+                // dangerous to reopen, and one answer from this verb should not be reachable
+                // through a door the other is refused at.
                 assertRedrainWindow(drainedBefore, new Date().toISOString());
+                // A COUNT reopens nothing, so it writes no receipt (#1545). Both rows below exist
+                // for a second egress of a tenant's payloads: the intent because a reopen that
+                // crashed before its outcome row would otherwise leave no trace, the outcome
+                // because something moved. A count moves nothing and egresses nothing, and an
+                // admin row saying a redrain was intended on a scope where none was is a false
+                // statement about a tenant's data — the opposite of what the log is for.
+                //
+                // It IS a read, though, and K-24 admits no curated subset: every `HostAdmin` read
+                // records actor, method, target and result count in the access log, so "who counted
+                // every tenant's outbox" has an answer. The count itself is the result count — the
+                // read returns one row, and the number in it is the fact worth having. The row lands
+                // on THIS host whichever branch answered, like the drain's read.
+                if (countOnly) {
+                    const redrainable = this.eventDrainDelegation && record.vertical
+                        ? await this.eventDrainDelegation.redrain({
+                            tenantId,
+                            scopeId,
+                            vertical: record.vertical,
+                            drainedBefore,
+                            countOnly: true,
+                        })
+                        : await this.scopeStub(scopeId).redrainCount(drainedBefore);
+                    await this.recordAccess(actor, 'redrainEvents', { tenantId, scopeId }, { drainedBefore, countOnly: true }, redrainable);
+                    return redrainable;
+                }
                 // Audit FIRST, on `rewindScope`'s rule (K-33), because this has the same shape: the
                 // mutation commits in a DO and the row is a separate write afterwards, so a failure
                 // between them left a reopen that had happened with no receipt — and the retry could
@@ -2575,12 +2902,29 @@ export class CloudflareScopeHost {
                 // half-done state harms the person: dying after the redaction leaves ciphertext in
                 // a backup that no key opens; destroying the key first would leave their PII in the
                 // live database while the audit log already claims they were erased.
-                const eventsRedacted = await this.scopeStub(scopeId).redactSubject(subjectId);
+                // Both spine copies (#1600): the outbox row AND any platform intent this event was
+                // routed into. One RPC, so a crash cannot land half of it.
+                const redacted = await this.scopeStub(scopeId).redactSubject(subjectId);
+                // An OLD ScopeDO answers with a bare number — it redacted the outbox and never
+                // looked at the intent journal. Refused here, BEFORE the key is destroyed, and
+                // that order is the whole point: the key is the irreversible half, so proceeding
+                // would leave the subject's platform-retained copies permanently unreadable, their
+                // name still sitting in `_substrat_platform_requests`, and no admin-log row at all
+                // (the log is written after this). Refusing leaves an erasure that can simply be
+                // re-run once the scope is redeployed. Loud rather than partial, the way this
+                // interface's reverse skew is left loud on `recordScheduleRun`.
+                if (typeof redacted === 'number') {
+                    throw substratError('unavailable', `scope ${scopeId} runs a ScopeDO from before #1600, whose redaction does not reach ` +
+                        `_substrat_platform_requests — erasing now would destroy the subject key while ` +
+                        `leaving their payloads in the intent journal. Redeploy the vertical and re-run.`);
+                }
+                const { events: eventsRedacted, intents: intentsRedacted } = redacted;
                 const at = new Date().toISOString();
                 const { existed } = await this.subjectKeysFor(tenantId, scopeId).destroy(subjectId, at);
                 const receipt = subjectShredReceipt.parse({
                     subjectId,
                     eventsRedacted,
+                    intentsRedacted,
                     keyDestroyed: existed,
                     tombstoned: true,
                 });
@@ -2588,7 +2932,9 @@ export class CloudflareScopeHost {
                 // because it destroys evidence. An erasure is the one action where "who asked for
                 // this to disappear" is itself part of the record.
                 await this.recordAdmin(actor, 'shredSubject', { tenantId, scopeId }, null, receipt);
-                await this.recordAccess(actor, 'shredSubject', { tenantId, scopeId }, { subjectId }, eventsRedacted);
+                // BOTH counts: the access log's number is "how much evidence this destroyed", and
+                // an intent payload is a whole event's worth of it.
+                await this.recordAccess(actor, 'shredSubject', { tenantId, scopeId }, { subjectId }, eventsRedacted + intentsRedacted);
                 return receipt;
             },
             // -- impersonation (K-42, #868) ----------------------------------------
@@ -2727,6 +3073,23 @@ export class CloudflareScopeHost {
                 await this.recordAccess(actor, 'listIdentityTenants', {}, { provider }, tenants.length);
                 return tenants;
             },
+            listIdentityMemberships: async (actor, provider, externalId) => {
+                // ONE round trip: the pool check, the join and the K-24 row all happen inside
+                // the directory's own call. The id and timestamp are minted here, as
+                // `recordAccess` mints them, so the log row is shaped exactly like its siblings.
+                const { topology, memberships } = await this.cp.identityMemberships(provider, externalId, {
+                    id: ulid(),
+                    actor,
+                    at: new Date().toISOString(),
+                });
+                if (topology === null)
+                    throw new Error(`identity pool '${provider}' is not registered`);
+                if (topology !== 'central') {
+                    throw new Error(`identity pool '${provider}' is tenant-bound — enumerating tenants is only ` +
+                        `meaningful on a central pool, where the same externalId is the same person`);
+                }
+                return memberships.map((m) => identityMembership.parse(m));
+            },
             listIdentityLinks: async (actor, tenantId) => {
                 const rows = await this.cp.dumpTenantIdentities(tenantId);
                 const links = rows.map((r) => identityLink.parse({
@@ -3309,6 +3672,104 @@ export class CloudflareScopeHost {
         // via newUniqueId (K-7) and stores the mapping in the directory — deferred.
         return this.scopeNs.get(this.scopeNs.idFromName(scopeId));
     }
+    // -- live reads (#938): the door ------------------------------------------
+    // The coordinator's half of the live-read path. It decides two things and no more:
+    // whether this CONNECTION can carry a push at all, and who is asking. What a
+    // subscriber may then be told is decided in the scope DO, per event, per frame.
+    /**
+     * Subscribe a principal to this scope's changes — `ScopeHost.liveReads`.
+     *
+     * Present on this host and declared `never` on `SqliteScopeHost`: a live read needs
+     * something that outlives a request and can be woken when an event lands, and on
+     * Cloudflare that is the scope's own Durable Object. The seam's full reasoning is on
+     * the contract (`ScopeHost.liveReads`), beside the `clock?: never` precedent it
+     * mirrors.
+     *
+     * **Two kinds of refusal, and they are deliberately different shapes.** A request
+     * that cannot carry a socket is answered with a `Response` (426, 501) — that is a
+     * fact about the connection, addressed to the client. A scope that must not be
+     * reached at all THROWS, exactly as `getScope` and the attachment door do, because
+     * it is the same refusal an ordinary read of that scope would get and it should not
+     * arrive as a different class of answer just because the caller asked for a socket.
+     */
+    liveReads = {
+        subscribe: async ({ tenantId, scopeId, principal, request }) => {
+            if (!isUpgradeRequest(request)) {
+                return new Response('live reads are a WebSocket surface', {
+                    status: 426,
+                    headers: { [LIVE_MODE_HEADER]: 'not-an-upgrade' },
+                });
+            }
+            /**
+             * The orange-to-orange refusal (#938).
+             *
+             * Cloudflare does not carry WebSockets across an O2O hop — the customer's own
+             * proxied zone in front of ours — so an upgrade offered here would fail
+             * somewhere the vertical cannot see, and the client would be left holding a
+             * socket that never delivers. Refused at the door instead, with a reason the
+             * client can read, so the fallback to polling is a thing it KNOWS it is doing
+             * rather than a silence it has to infer.
+             *
+             * Per request, never per hostname: whether a tenant is O2O is decided by the
+             * tenant's own DNS, which is theirs to change without telling us. Anything
+             * cached would be a fact with an invisible expiry date; this header is correct
+             * on the request after they change it.
+             *
+             * 501, not 426: 426 means "upgrade and try again", and trying again is exactly
+             * what will not work. This connection cannot carry the thing that was asked for.
+             */
+            if (isOrangeToOrange(request)) {
+                return new Response('live reads are not available over this connection — the request arrived ' +
+                    'through a proxied customer zone, which does not carry WebSockets. Poll instead.', { status: 501, headers: { [LIVE_MODE_HEADER]: 'poll' } });
+            }
+            /**
+             * The same fail-closed lifecycle gate + lazy migration every other door takes
+             * (`getScope`, `attachments`; control-plane.md §4.1/§4.2, K-3).
+             *
+             * A subscription is a new way INTO a scope, and the permission filter downstream
+             * answers a different question: it decides what a subscriber may see, not whether
+             * this scope should be reachable at all. Without this, an unknown, cross-tenant,
+             * suspended or archiving scope could still be addressed and handed a 101 — a
+             * scope that refuses every ordinary read while quietly holding an open socket.
+             *
+             * Costs a CP-less vertical nothing: `validateScopeAccess` is a **no-op** on the
+             * null control plane (the router already gated lifecycle and tenancy from the
+             * shared directory), so this is the hosted-vertical shape unchanged.
+             *
+             * `migrateAndRecord`, not the DO's own `ensureMigrations`: the DO migrates
+             * itself when the socket opens either way, but only this reports the applied
+             * count to the directory — so a scope whose first contact after a deploy is a
+             * subscription does not go dark in the migration fleet view.
+             */
+            await this.cp.validateScopeAccess(tenantId, scopeId);
+            await this.migrateAndRecord(scopeId);
+            // Asserted, not carried through from the client: the principal is the
+            // vertical's own resolution of its session, and the tenant and scope are the
+            // node the router resolved. Every inbound copy is replaced, for the reason the
+            // router strips `x-substrat-*` before setting its own.
+            const headers = new Headers(request.headers);
+            headers.set(LIVE_PRINCIPAL_HEADER, principal);
+            headers.set(LIVE_TENANT_HEADER, tenantId);
+            headers.set(LIVE_SCOPE_HEADER, scopeId);
+            const forwarded = new Request(new URL(LIVE_SUBSCRIBE_PATH, 'https://scope.substrat.internal'), 
+            // `new Request(url, { …, headers })` rather than `new Request(request, …)`:
+            // the DO is addressed by its own path, not the client's, and the upgrade
+            // headers that matter travel in `headers` above. Verified in workerd — a
+            // reconstructed request keeps `Upgrade`, `Connection` and the
+            // `Sec-WebSocket-*` pair, which is what makes the router's own
+            // strip-and-assert safe on this path too.
+            { method: 'GET', headers });
+            // Through `scopeStub`, deliberately, rather than a second `idFromName` here:
+            // that method's own comment says the id derivation is milestone-one and that
+            // production will mint per-jurisdiction ids from the directory. A copy of the
+            // derivation would keep compiling on the day it changes and address a DIFFERENT
+            // object — a subscriber watching an empty scope while its writes land elsewhere.
+            // `ScopeStubRpc` describes the RPC methods and not `fetch`, which every stub has;
+            // the cast widens the view of one object, it does not mint a second one.
+            const stub = this.scopeStub(scopeId);
+            return stub.fetch(forwarded);
+        },
+    };
     // -- scope-local projection (docs/architecture/scope-local-permissions.md, Phase 2) --
     // The write side of the local reader (Phase 1): after any tenant-level change,
     // the coordinator PROJECTS the tenant's current roles + tenant-level tuples into
@@ -3455,15 +3916,22 @@ export class CloudflareScopeHost {
         // used to leave the scope "roles projected, source=local, zero tuples" — enforcing nothing
         // but denials, with no builder-facing lever to fix it. Atomic now: grant and flip land
         // together, and the empty-tuple guard in `applyProjection` refuses the flip if they don't.
+        //
+        // #1659: every tuple here is SEATED — created if missing, left alone if revoked — so a
+        // reconcile no longer undoes an operator's revoke. The owner's seat alone carries
+        // `lockout_reseat`: it comes back over a revoke only when the scope would otherwise hold
+        // no effective role grant — none whose role the vertical still defines — which is the
+        // #332 lockout a reconcile exists to repair.
         [
             {
                 subject: `principal:${input.owner}`,
                 relation: `role:${input.ownerRoleKey}`,
                 object: `scope:${input.scopeId}`,
                 expires_at: null,
+                lockout_reseat: true,
             },
             // #461: each registered module's SCHEDULE grants (#383) ride the same unit —
-            // the CP-less mirror of `provisionScope`'s writeTuple loop. Without them the
+            // the CP-less mirror of `provisionScope`'s seatTuple loop. Without them the
             // grant-is-the-switch check makes every schedule a silent no-op (`fired: 0`,
             // no error — the #49 unfalsifiable zero).
             ...[...this.moduleSchedules].flatMap(([modId, schedules]) => {
@@ -3550,16 +4018,23 @@ export class CloudflareScopeHost {
      * seat is the one that knows what to announce, and it emits from its own operation.
      * Guarded like `assignScopeRole`: at the harness route, not at this seam.
      *
-     * Two things a caller has to know, because the tombstone is only as durable as the next
-     * `INSERT OR REPLACE` on the same row:
-     * - Anything that re-projects the scope's tuples clears it — `provisionScopeLocal` on a
-     *   reconcile re-seats the owner and the `system:` grants, and a vertical's `onProvision`
-     *   hook that re-issues `assignScopeRole` re-seats whatever it names. A revoke of a role
-     *   such a path grants is undone on the next reconcile, silently. Revoke the seats your
-     *   own flow granted, not the ones provisioning did.
-     * - Revoking the LAST live role tuple in a scope leaves nobody who passes a check, and
-     *   the local checker has no way back in (#332 guards the flip to local on the way in
-     *   only). Seat the successor before unseating the last holder.
+     * What survives a reconcile (#1659), because the tombstone is only as durable as the next
+     * write that is allowed to replace it:
+     * - Provisioning does not clear it. `provisionScopeLocal` SEATS its tuples (the owner's
+     *   role, the `system:` grants, the connection grants): it recreates a missing one and
+     *   leaves a revoked one revoked, so a reconcile — every listed promote runs one — keeps
+     *   your revoke.
+     * - With ONE exception: the owner-of-record's seat is re-seated over a revoke when the
+     *   scope would otherwise hold no effective role grant at all — a holder of a role the
+     *   vertical no longer defines passes no check, so it does not count. A scope nobody can
+     *   act in is the #332 lockout the reconcile exists to repair, so revoking the LAST holder
+     *   is undone at the next reconcile. Seat the successor (in a role the vertical defines)
+     *   before unseating the owner, and the revoke stands. The owner re-seated is the one `owner_of_record` names, which is first-write-
+     *   wins — if a successor is later revoked too, the ORIGINAL owner comes back. To lock a
+     *   compromised owner out, suspend the scope; a seat revoke is not that lever.
+     * - An explicit grant does clear it: `assignScopeRole` is `INSERT OR REPLACE`, and so is
+     *   a vertical's `onProvision` hook that re-issues it — which re-seats whatever it names
+     *   on every reconcile. Revoke the seats your own flow granted and does not re-grant.
      * On a CP-less host this records no admin-log row (there is no control plane to hold
      * one), so the row's `revoked_at` is the only evidence, and a re-assign replaces it.
      */
@@ -3623,6 +4098,19 @@ export class CloudflareScopeHost {
     async connectorGrantLocal(connectionId, scopeId, permission, expiresAt) {
         await this.writeScopeTuple(scopeId, subjectRef({ kind: 'connection', id: connectionId }), `granted:${permission}`, `scope:${scopeId}`, expiresAt ?? null);
     }
+    /**
+     * The far end of the schedule kill switch for a scope served HERE (#1666):
+     * `/internal/system-switch` lands on this, from the shared control plane's
+     * `revokeFromSystem` / `restoreToSystem`. It moves the switch in the scope's own DO and
+     * answers what it did; it audits nothing, because the control plane that asked holds the
+     * admin log and writes the row once this returns. `held: false` is an answer, not a
+     * throw — see `systemSwitchOutcome`.
+     */
+    async systemSwitchLocal(scopeId, moduleId, to) {
+        // Parsed on the way out: this is the wire answer the platform reads, and the DO's
+        // plain strings become the published shape here rather than on trust.
+        return systemSwitchOutcome.parse(await this.scopeStub(scopeId).switchSystemSchedules(moduleId, scopeId, to, new Date().toISOString()));
+    }
 }
 /** A ledger row -> the wire entry, the attribution re-nested (#1054). */
 function modelUsageEntryOf(r) {