@substrat-run/adapter-cloudflare 0.114.0 → 0.117.0

package/dist/scope-do.js

@@ -1,9 +1,10 @@
 import { DurableObject } from 'cloudflare:workers';
-import { ATTACHMENT_ADDED, ATTACHMENT_REMOVED, attachmentRecord, domainEvent, domainEventInput, eventId, instant, objectRef, toWireFailure, grantRefFromProof, principalId, platformRequestInput, platformRequestId, MAX_PENDING_PLATFORM_REQUESTS, MAX_PENDING_SWEEP_RUNS, SWEEP_RUNS_KIND, platformRequest, SCOPE_TABLE_PAGE_MAX, SCOPE_QUERY_ROW_MAX, listLimitOf, requestFingerprint, substratError, assertReplayableDump, REDRAIN_BATCH, } from '@substrat-run/contracts';
-import { ulid, createUlid, assertAllowed, ConnectionSealingKeyUnavailableError, noSealingKeyMessage, sealTo, assertReadOnlyQuery, entitlementDenial, platformRequestHistoryQuery, PLATFORM_REQUEST_COLUMNS, denialListQuery, denialSummaryQuery, denialTotalsQuery, DENIAL_WINDOW_QUERY, mapDenialRow, mapDenialSummaryBuckets, PermissionDenied, assertImpersonationWrites, assertModuleEnqueueableKind, impersonationStampOf, createAtomic, NotSearchable, isSearchIndexTable, searchIndexDdl, searchIndexMigrations, searchIndexPlans, NotListable, listIndexMigrations, listIndexPlans, listQuery, cursorOf, searchLimit, searchMatchExpression, searchQuery, IDEMPOTENCY_DDL, assertIdempotencyKey, idempotencyLookupQuery, idempotencyPruneStatement, idempotencyRecordStatement, idempotencyOptedOutMessage, replayFor, entityVersionQuery, entityVersionOf, assertIfMatch, OUTBOX_ENTITY_INDEX, } from '@substrat-run/kernel';
+import { ATTACHMENT_ADDED, ATTACHMENT_REMOVED, attachmentRecord, domainEvent, domainEventInput, eventId, instant, objectRef, toWireFailure, grantRefFromProof, principalId, scopeId as scopeIdOf, tenantId as tenantIdOf, platformRequestInput, platformRequestId, MAX_PENDING_PLATFORM_REQUESTS, MAX_PENDING_SWEEP_RUNS, SWEEP_RUNS_KIND, SCOPE_TABLE_PAGE_MAX, SCOPE_QUERY_ROW_MAX, listLimitOf, requestFingerprint, substratError, assertReplayableDump, REDRAIN_BATCH, } from '@substrat-run/contracts';
+import { ulid, createUlid, assertAllowed, ConnectionSealingKeyUnavailableError, noSealingKeyMessage, sealTo, assertReadOnlyQuery, entitlementDenial, platformRequestHistoryQuery, platformRequestOf, PLATFORM_REQUEST_COLUMNS, PLATFORM_REQUEST_REDACTION_SQL, platformRequestRedactionParams, platformRequestRedactionQuery, intentPayloadCarriesSubject, seatScopeTuple, effectiveRoleGrantQuery, switchSystemSchedules, systemScheduleState, systemSwitchedOff, denialListQuery, denialSummaryQuery, denialTotalsQuery, DENIAL_WINDOW_QUERY, mapDenialRow, mapDenialSummaryBuckets, PermissionDenied, assertImpersonationWrites, assertModuleEnqueueableKind, impersonationStampOf, createAtomic, NotSearchable, isSearchIndexTable, searchIndexDdl, searchIndexMigrations, searchIndexPlans, NotListable, listIndexMigrations, listIndexPlans, listQuery, cursorOf, searchLimit, searchMatchExpression, searchQuery, IDEMPOTENCY_DDL, assertIdempotencyKey, assertPermissionKey, idempotencyLookupQuery, idempotencyPruneStatement, idempotencyRecordStatement, idempotencyOptedOutMessage, replayFor, entityVersionQuery, entityVersionOf, assertIfMatch, OUTBOX_ENTITY_INDEX, SCHEDULE_STATE_DDL, SCHEDULE_STATE_REBUILD, scheduleStateHasKind, JOB_RUN_DDL, jobRunListLimit, } from '@substrat-run/kernel';
+import { isUpgradeRequest, readSubscription, LIVE_FANOUT_LIMIT, LIVE_MODE_HEADER, LIVE_PRINCIPAL_HEADER, LIVE_SCOPE_HEADER, LIVE_SUBSCRIBE_PATH, LIVE_TENANT_HEADER, } from './live-reads.js';
 import { OperationQueue } from './serialization.js';
-import { doScopedSql } from './sql.js';
-import { facetEvents, readDeadLetters, readHistory, readInvocation, walkEventCause, walkEventEffects } from '@substrat-run/kernel';
+import { doScopedSql, doSpineSql } from './sql.js';
+import { actorOf, assertNoSecret, CAPABILITY_DDL, CAPABILITY_EXCHANGE_OPERATION, createCapabilityVerbs, exchangeCapability, guardSecrets, mintBecomeCapability, redactSecrets, resolveCapabilitySession, revokeCapabilityAsPlatform, domainEventOf, facetEvents, readDeadLetters, readHistory, readInvocation, readUndrainedOutbox, walkEventCause, walkEventEffects, } from '@substrat-run/kernel';
 import { createDoTupleChecker, createLocalControlPlaneReader } from './checker.js';
 /**
  * The key marking a scope DO whose storage was destroyed (`destroyStorage`).
@@ -127,31 +128,28 @@ const KERNEL_DDL = `
     operation TEXT,
     -- K-42: WHICH of the two actors was refused is exactly what this log is for.
     impersonation TEXT,
+    -- #1525: the INVOCATION this refusal happened during, the same id #1237 stamps on
+    -- every event of a call. A denial joins to nothing but actor and time otherwise --
+    -- the operation column names what was attempted, never WHICH attempt -- so "what
+    -- else did this request do" cannot reach a refusal, which is the one thing an
+    -- incident asks about first. NULL = the transport carried no id (a seed, a test,
+    -- an internal call, an attachment RPC), or the row predates the column.
+    invocation_id TEXT,
     at TEXT NOT NULL,
     drained_at TEXT
   );
-  -- #383: the platform sweep's per-scope gating state. Despite the name, this table
-  -- holds TWO kinds of row since #1232, told apart by the shape of schedule_op:
-  --   * a schedule operation, spelled module/verb -- last_run_at / last_status are
-  --     when that operation last RAN here and how it ended;
-  --   * a freshness key, spelled freshness:<eventType> -- last_run_at / last_status
-  --     are when the evaluator last RECORDED a verdict for that event type and what
-  --     the verdict was. Nothing ran; the row gates what the sweep records.
-  -- Only HALF the no-collision claim is enforced, which is worth knowing before
-  -- trusting it: a freshness key is always "freshness:" followed by a value the
-  -- contracts eventType schema accepted (lowercase ns.verb, no colon and no slash),
-  -- so no freshness key can ever look like an operation. The other direction is
-  -- CONVENTION only -- scheduleSpec.operation is z.string().min(1), so a module
-  -- that declared a schedule operation literally named "freshness:orders.placed"
-  -- would share a row with the evaluator and nothing today would reject it.
-  -- #1288 tracks giving the table a column (or a name) that says this outright,
-  -- which is also what would let the collision be refused rather than avoided.
-  -- Spine (kernel-written), never a module migration.
-  CREATE TABLE IF NOT EXISTS _substrat_schedule_state (
-    schedule_op TEXT PRIMARY KEY,
-    last_run_at TEXT,
-    last_status TEXT
-  );
+  -- #383 / #1232 / #1288: the platform sweep's per-scope gating state, holding two
+  -- families of row that the kind COLUMN -- not the spelling of a key -- tells
+  -- apart. Spine (kernel-written), never a module migration. Shared with the pure
+  -- adapter from @substrat-run/kernel, so the shape a rebuild produces and the shape
+  -- a fresh store gets cannot part company; the column comments are in there.
+  ${SCHEDULE_STATE_DDL}
+  -- #1577: the resumable-run driver's record and the step ledger of the pass it
+  -- currently has in flight. Spine (kernel-written), never a module migration.
+  -- Shared with the pure adapter from @substrat-run/kernel so the shape production
+  -- builds and the shape a self-host builds cannot part company; the column
+  -- comments, and the reason coalescing is NOT a unique index, are in there.
+  ${JOB_RUN_DDL}
   CREATE TABLE IF NOT EXISTS _substrat_migrations (
     module_id TEXT NOT NULL,
     version TEXT NOT NULL,
@@ -191,6 +189,17 @@ const KERNEL_DDL = `
     --   next_attempt_at IS NULL      -> terminal: error IS NULL delivered, else dead
     attempts INTEGER NOT NULL DEFAULT 0,
     next_attempt_at TEXT,
+    -- #1525: the invocation THIS ATTEMPT ran in, the same id #1237 stamps on every
+    -- event of a call. Not the emitting event's -- that one is already on the outbox
+    -- and a delivery joins to it through event_id. What that join cannot say is
+    -- which call attempted the DELIVERY, and for an executor the two differ by
+    -- design: attempt one runs in the emitting call's post-commit tail, every retry
+    -- afterwards in a drain that is a different call or none. Moves with the row on
+    -- an upsert, like delivered_at, error and attempts -- it describes the
+    -- latest attempt, not the first. NULL = that attempt carried no call (a
+    -- scheduled drain, an alarm, a seed, an attachment RPC), or the row predates
+    -- the column.
+    invocation_id TEXT,
     PRIMARY KEY (event_id, consumer_module)
   );
   -- Scope-local permissions (docs/architecture/scope-local-permissions.md): the
@@ -301,6 +310,10 @@ const KERNEL_DDL = `
   ${OUTBOX_ENTITY_INDEX}
   -- #116: the request-dedupe table, kernel-owned so no vertical migrates for it.
   ${IDEMPOTENCY_DDL}
+  -- #1672: capabilities — authority carried by a secret (a link share), and the sessions
+  -- an exchange trades that secret for. Shared with the pure adapter from
+  -- @substrat-run/kernel so the two cannot part company; the column comments are there.
+  ${CAPABILITY_DDL}
 `;
 /**
  * Workers RPC carries a plain `Error`'s MESSAGE faithfully and nothing else. A custom
@@ -359,27 +372,6 @@ function attachSubject(principal, connectionId) {
 function isSystemTable(name) {
     return name.startsWith('_substrat') || name.startsWith('sqlite_');
 }
-/**
- * A stored row → the `PlatformRequest` contract shape (JSON columns parsed). The coordinator
- * maps the RPC's raw rows the same way in `host.ts`; this copy exists because `ctx.platformRequests`
- * (#618) answers INSIDE the DO, where the row never crosses an RPC boundary at all.
- */
-function rowToPlatformRequest(r) {
-    return platformRequest.parse({
-        id: r.id,
-        kind: r.kind,
-        payload: JSON.parse(r.payload),
-        requestedBy: JSON.parse(r.requested_by),
-        impersonation: r.impersonation == null ? null : JSON.parse(r.impersonation),
-        status: r.status,
-        attempts: r.attempts,
-        lastError: r.last_error,
-        failure: r.last_failure == null ? null : JSON.parse(r.last_failure),
-        result: r.result === null ? null : JSON.parse(r.result),
-        requestedAt: r.requested_at,
-        settledAt: r.settled_at,
-    });
-}
 /** SQLite cell → a JSON-safe value: bigints stringify, blobs (ArrayBuffer) read as null. */
 function cellToJson(v) {
     if (v == null)
@@ -505,6 +497,12 @@ export function defineScopeDO(modules, bareOps) {
         listPlans = new Map();
         /** entityType → the declared attachment gate (#473): read key + write key (default: read). */
         attachmentTargets = new Map();
+        /**
+         * entityType → the declared live-read gate (#938): the key a subscriber must hold
+         * ON THAT ENTITY before a change to it is announced. Absent = announced to nobody;
+         * `fanOutLive` treats a miss as silence, never as "unguarded".
+         */
+        liveTargets = new Map();
         checker;
         systemPrincipal = principalId.parse(ulid());
         /**
@@ -622,6 +620,20 @@ export function defineScopeDO(modules, bareOps) {
                 }
                 this.attachmentTargets.set(target.entityType, gate);
             }
+            // Live-read targets (#938): entityType → the read key a subscriber must pass ON
+            // THAT ENTITY before a change to it is announced. Validated exactly like the
+            // attachment gate above, and for a sharper reason: two modules disagreeing about
+            // which key guards an entity type would make "who may watch this" depend on
+            // registration order, and the losing declaration would be the one that was meant
+            // to be stricter. An entity type nobody declares is announced to nobody.
+            for (const target of manifest.liveTargets ?? []) {
+                const existing = this.liveTargets.get(target.entityType);
+                if (existing && existing !== target.readPermission) {
+                    throw new Error(`conflicting liveTargets for '${target.entityType}': ` +
+                        `(${existing}) vs (${target.readPermission})`);
+                }
+                this.liveTargets.set(target.entityType, target.readPermission);
+            }
             for (const name of manifest.withdraws ?? []) {
                 this.withdrawn.set(name, manifest.id);
                 this.operations.delete(name);
@@ -680,9 +692,11 @@ export function defineScopeDO(modules, bareOps) {
          * and skips the write when nothing changed.
          *
          * `ensureMigrations` memoises its promise, so every later call on a warm DO
-         * resolves to the SAME `true` without applying anything. Reporting on each of
-         * those would bill a control-plane RPC per stub mint to store a number that
-         * has not moved — hence the once-per-instance latch.
+         * resolves to the SAME `true` without applying anything — until something
+         * clears the memo (`retryMigrations`, `importDump`), which is a fresh pass and
+         * may apply. Reporting on each of the cached ones would bill a control-plane
+         * RPC per stub mint to store a number that has not moved — hence the
+         * once-per-instance latch.
          */
         async migrate() {
             const applied = await this.ensureMigrations();
@@ -738,6 +752,14 @@ export function defineScopeDO(modules, bareOps) {
         migrationFailure() {
             return this.lastFailure ? { ...this.lastFailure, applied: this.applied.size } : null;
         }
+        /**
+         * This scope's database size in bytes (#1524): `SqlStorage.databaseSize`, which Cloudflare
+         * bills on. Its one caller is an on-demand storage reading, never a sweep, because reaching
+         * it wakes this DO.
+         */
+        databaseSize() {
+            return this.sql.databaseSize;
+        }
         /**
          * The PITR bookmarks this scope recorded before migration passes (#286),
          * newest first — what a backout UI offers as rewind points. Rows taken after
@@ -762,26 +784,26 @@ export function defineScopeDO(modules, bareOps) {
             }));
         }
         /**
-         * The events not yet shipped to Tier 2 (#1334), oldest first. `ORDER BY id`
-         * is chronological (ULID) and stable, so a drain resumes where it stopped.
+         * The events not yet shipped to Tier 2 (#1334), oldest first — and what the read
+         * stepped over (#1636). `ORDER BY id` is chronological (ULID) and stable, so a drain
+         * resumes where it stopped.
+         *
+         * The kernel's read, shared with the pure adapter: a row that will not decode is
+         * neither returned nor stamped, and the rows behind it still come back. An object
+         * rather than an array because it crosses the RPC — a property on an array would not.
+         */
+        undrainedEventsRead(limit) {
+            return readUndrainedOutbox((offset, count) => this.sql
+                .exec(`SELECT * FROM _substrat_outbox WHERE drained_at IS NULL ORDER BY id LIMIT ? OFFSET ?`, count, offset)
+                .toArray(), limit);
+        }
+        /**
+         * The same read as a bare array, for a coordinator deployed before
+         * `undrainedEventsRead` (#1636) — kept so that pairing still drains, and still steps
+         * over a bad row rather than stalling on it. It just cannot say that it did.
          */
         undrainedEvents(limit) {
-            const rows = this.sql
-                .exec(`SELECT * FROM _substrat_outbox WHERE drained_at IS NULL ORDER BY id LIMIT ?`, limit)
-                .toArray();
-            return rows.map((r) => ({
-                ...this.parseOutboxRow(r),
-                operation: r.operation ?? null,
-                version: r.version ?? null,
-                // #1237 — lifted like the two above, and for the same reason: the column
-                // exists on the outbox but not on the envelope `parseOutboxRow` returns,
-                // whose `domainEvent.parse` strips anything it does not declare.
-                causedBy: r.caused_by ?? null,
-                // …and the invocation, for the same reason again: a lake that kept cause and
-                // dropped the call could say what set an event off and never which request did
-                // it, which is the grouping a trace is built on.
-                invocationId: r.invocation_id ?? null,
-            }));
+            return this.undrainedEventsRead(limit).events;
         }
         /**
          * Stamp `drained_at` on shipped events (#1334). Idempotent — a re-mark is a no-op,
@@ -843,6 +865,24 @@ export function defineScopeDO(modules, bareOps) {
                 return ids.length;
             });
         }
+        /**
+         * How many rows `redrainEvents` WOULD reopen for the same instant (#1545), reopening
+         * none of them. A separate verb rather than a flag on the one above, deliberately: the
+         * two answers are indistinguishable once they are numbers, so the caller that asks for
+         * a count must not be able to reach the reopen by losing an argument on the way.
+         *
+         * UNBOUNDED where the reopen is batched. The batch exists because an UPDATE over the
+         * whole window rewrites every row and its index entries inside ONE Durable Object
+         * request, against a fixed budget. An aggregate materialises no rows, so that budget is
+         * not the binding constraint — and a partial count would be worse than useless: the
+         * number is the whole point, and "5000, or possibly more" answers nothing.
+         */
+        async redrainCount(drainedBefore) {
+            return this.sql
+                .exec(`SELECT COUNT(*) AS c FROM _substrat_outbox
+              WHERE drained_at IS NOT NULL AND drained_at < ?`, drainedBefore)
+                .toArray()[0].c;
+        }
         /**
          * Facet this scope's own outbox (#1239) — `facetEvents`, which is the
          * sanctioned read: an erased payload yields the same NULL a missing field
@@ -960,13 +1000,30 @@ export function defineScopeDO(modules, bareOps) {
                 return rows.sort((a, b) => a.subject.localeCompare(b.subject) || a.relation.localeCompare(b.relation));
             });
         }
-        /** Admin scope-tuple write (role assignment / grant scoped to this scope). */
+        /**
+         * Admin scope-tuple write (role assignment / grant scoped to this scope) — the
+         * EXPLICIT grant. `INSERT OR REPLACE`, so it clears a tombstone: a re-grant grants.
+         * Provisioning does not come through here; it seats with `seatTuple` (#1659).
+         */
         async writeTuple(subject, relation, object, expiresAt) {
             await this.queue.enqueue(() => {
                 this.sql.exec(`INSERT OR REPLACE INTO _substrat_tuples (subject, relation, object, expires_at)
            VALUES (?, ?, ?, ?)`, subject, relation, object, expiresAt);
             });
         }
+        /**
+         * Provisioning's scope-tuple write (#1659): create the row if it is missing, follow the
+         * platform's expiry if it is live, and leave it alone if it was revoked — so a re-run
+         * provision cannot undo an operator's revoke — and seat nothing at all for a module
+         * whose schedule kill switch is off (#1666). `seatScopeTuple` is the statement, shared
+         * with `applyProjection`'s `scopeTuples` and with the pure adapter.
+         */
+        async seatTuple(subject, relation, object, expiresAt) {
+            await this.queue.enqueue(() => {
+                const seat = seatScopeTuple(subject, relation, object, expiresAt);
+                this.sql.exec(seat.sql, ...seat.params);
+            });
+        }
         /**
          * The dispatch capability's admission (#726 remedy B): this delivery may read the
          * attachments of the entity its own spine row names, and no others.
@@ -1056,19 +1113,28 @@ export function defineScopeDO(modules, bareOps) {
          * this scope; the DO uses it for the two-actor stamp and for the read-only
          * bound, and nothing here can be reached without it having been minted.
          */
-        impersonation) {
+        impersonation, 
+        /**
+         * #1672: the HASH of a capability session token — the coordinator hashed the token
+         * and the plaintext never crosses. Resolved to its capability INSIDE the queued body,
+         * on every call, so a revoke between two calls refuses the second. `principal` is
+         * then a random placeholder that holds nothing, and the reply carries
+         * `capability.honoured`: an old DO that ignored this argument would run the call as
+         * that placeholder, and the coordinator refuses a success without the acknowledgement.
+         */
+        capabilitySession) {
             if (!failureEnvelope) {
                 // Legacy path, byte-for-byte what it was: rewrapped so a non-plain error (a
                 // ZodError, whose `message` is a getter) still arrives with its message.
                 try {
-                    return await this.invokeOrThrow(operation, input, principal, tenantId, scopeId, connectionId, requiredEntitlement, systemModuleId, invokeOptions, impersonation);
+                    return await this.invokeOrThrow(operation, input, principal, tenantId, scopeId, connectionId, requiredEntitlement, systemModuleId, invokeOptions, impersonation, capabilitySession);
                 }
                 catch (err) {
                     throw toRpcError(err);
                 }
             }
             try {
-                return await this.invokeOrThrow(operation, input, principal, tenantId, scopeId, connectionId, requiredEntitlement, systemModuleId, invokeOptions, impersonation);
+                return await this.invokeOrThrow(operation, input, principal, tenantId, scopeId, connectionId, requiredEntitlement, systemModuleId, invokeOptions, impersonation, capabilitySession);
             }
             catch (err) {
                 // The ONE place the error keeps its structure: flattened here, rebuilt by the
@@ -1080,7 +1146,9 @@ export function defineScopeDO(modules, bareOps) {
         /** The operation path itself. Throws; `invoke` decides how that reaches the caller. */
         async invokeOrThrow(operation, input, principal, tenantId, scopeId, connectionId, requiredEntitlement, systemModuleId, invokeOptions, 
         /** K-42: the session, resolved coordinator-side. See `invoke` above. */
-        impersonation) {
+        impersonation, 
+        /** #1672: a capability session's hash. See `invoke` above. */
+        capabilitySession) {
             await this.ensureMigrations();
             const handler = this.operations.get(operation);
             // `not_found`, not a bare throw (#113): every vertical hand-matched this message
@@ -1139,7 +1207,7 @@ export function defineScopeDO(modules, bareOps) {
             // The subject a key is scoped to — the same three-way read `recordDenial`
             // makes below, hoisted because both need it. A key belongs to whoever sent
             // it: two principals choosing `1` must not reach each other's response.
-            const idempotencySubjectRef = systemModuleId
+            let idempotencySubjectRef = systemModuleId
                 ? { kind: 'system', id: systemModuleId }
                 : connectionId
                     ? { kind: 'connection', id: connectionId }
@@ -1163,6 +1231,34 @@ export function defineScopeDO(modules, bareOps) {
                 // one call. Same placement as the SQLite adapter's actor task, for this reason.
                 this.invocationId = invokeOptions?.invocationId ?? null;
                 try {
+                    // #1672: the capability session, resolved on EVERY call and here — inside the queued
+                    // body, the one region where this call holds the DO to itself — so nothing can
+                    // revoke between this read and the transaction. Refuses a stale session, a revoked
+                    // or expired capability and an operation off its allowlist before anything opens;
+                    // none of those is a K-35 denial (no key was checked).
+                    let capabilityId;
+                    if (capabilitySession !== undefined) {
+                        capabilityId = resolveCapabilitySession(doSpineSql(this.sql), capabilitySession, instant.parse(new Date().toISOString()), operation);
+                        idempotencySubjectRef = { kind: 'capability', id: capabilityId };
+                    }
+                    // #1672: the secrets this call mints — withheld from its idempotency recording, and
+                    // what the tripwire on its writes looks for.
+                    const minted = [];
+                    /**
+                     * #938: the outbox's high-water mark BEFORE this call wrote anything, so the
+                     * post-commit fan-out can name exactly the events this call (and the consumers
+                     * it set off) added. Read here — inside the queued body, before the
+                     * transaction — because that is the region where this call holds the DO to
+                     * itself, the same reason `invocationId` is set here.
+                     *
+                     * A socket that connects between here and the fan-out is served whatever this
+                     * call committed, and one that connects while `null` was decided hears nothing
+                     * about it. Both are harmless and neither is worth a lock: a frame is an
+                     * invalidation, so hearing about a change from just before you subscribed costs
+                     * one redundant re-read, and missing one costs a wait for the client's poll —
+                     * which is the floor this whole surface sits on.
+                     */
+                    const liveSince = this.liveHighWaterMark();
                     let result;
                     let committedVersion = null;
                     // #116: set when this invocation was answered from a recording rather
@@ -1190,7 +1286,7 @@ export function defineScopeDO(modules, bareOps) {
                     // emitted events back as one — verified across `await` in workerd.
                     try {
                         await this.ctx.storage.transaction(async () => {
-                            const ctx = this.operationContext(principal, tenantId, scopeId, undefined, connectionId, systemModuleId, signals, impersonation, operation);
+                            const ctx = this.operationContext(principal, tenantId, scopeId, undefined, connectionId, systemModuleId, signals, impersonation, operation, capabilityId, minted);
                             // #116: a retry is answered from the recording, and nothing else runs
                             // — not the guards, not the handler, not the permission check inside
                             // it. Keyed by SUBJECT, so a caller only ever reaches its own
@@ -1231,7 +1327,9 @@ export function defineScopeDO(modules, bareOps) {
                             // it describes. The prune rides along, on the only path that adds a row.
                             if (idempotencyKey !== undefined && fingerprint !== undefined) {
                                 const at = new Date().toISOString();
-                                const record = idempotencyRecordStatement(idempotencySubjectRef, idempotencyKey, operation, fingerprint, result, committedVersion, at);
+                                const record = idempotencyRecordStatement(idempotencySubjectRef, idempotencyKey, operation, fingerprint, 
+                                // #1672: a replay of a mint returns the placeholder, never the secret.
+                                redactSecrets(result, minted), committedVersion, at);
                                 this.sql.exec(record.sql, ...record.params);
                                 const prune = idempotencyPruneStatement(at);
                                 this.sql.exec(prune.sql, ...prune.params);
@@ -1254,6 +1352,7 @@ export function defineScopeDO(modules, bareOps) {
                                 result,
                                 platformRequests: 0,
                                 impersonation: { honoured: true },
+                                ...(capabilitySession !== undefined ? { capability: { honoured: true } } : {}),
                                 ...(idempotencyKey !== undefined
                                     ? { idempotency: { keyHonoured: true, replayed } }
                                     : {}),
@@ -1270,11 +1369,12 @@ export function defineScopeDO(modules, bareOps) {
                         // K-35: the transaction has rolled back; record a refused check now, as its own
                         // write (outside that transaction), so the denial survives the rollback.
                         if (err instanceof PermissionDenied) {
-                            this.recordDenial(systemModuleId
-                                ? { kind: 'system', id: systemModuleId }
-                                : connectionId
-                                    ? { kind: 'connection', id: connectionId }
-                                    : { kind: 'principal', id: principal }, tenantId, operation, err, impersonation);
+                            this.recordDenial(
+                            // The subject the call acted as — the capability's, once resolved above.
+                            idempotencySubjectRef, tenantId, operation, err, 
+                            // Inside the queued body, which is the one region where this call holds
+                            // the DO to itself — so the field is this call's own (#1237).
+                            this.invocationId, impersonation);
                         }
                         // The ORIGINAL error, deliberately: `invoke` flattens it for the envelope
                         // (which keeps its code and extensions) or rewraps it for the legacy throw
@@ -1285,12 +1385,20 @@ export function defineScopeDO(modules, bareOps) {
                     // Skipped on a replay: nothing was written, so there is nothing this
                     // invocation added to drain. Anything the ORIGINAL left undrained is the
                     // outbox's own retry backstop, which is what that backstop is for.
+                    // Drain to consumers, then announce what landed (#938). Skipped whole on a
+                    // replay: nothing was written, so there is nothing this invocation added to
+                    // drain or to announce. Anything the ORIGINAL left undrained is the outbox's
+                    // own retry backstop, which is what that backstop is for.
+                    // #1525: still inside the queued body that set it, so these deliveries are this
+                    // call's own work — the same tail its consumers' emits are stamped in.
                     if (!replayed)
-                        await this.dispatch(tenantId, scopeId);
+                        await this.settleCommitted(tenantId, scopeId, liveSince, this.invocationId);
                     return {
                         result,
                         platformRequests: signals.platformRequests,
                         ...(impersonation ? { impersonation: { honoured: true } } : {}),
+                        // #1672: the acknowledgement the coordinator's skew check reads — see `invoke`.
+                        ...(capabilitySession !== undefined ? { capability: { honoured: true } } : {}),
                         // The acknowledgement the coordinator's skew check reads (#116), on the
                         // same reasoning as `ifMatchChecked` below and with a sharper failure: a
                         // DO too old to know about keys would EXECUTE THE OPERATION AGAIN and
@@ -1319,6 +1427,288 @@ export function defineScopeDO(modules, bareOps) {
                 }
             });
         }
+        // -- live reads (#938): the subscription half of the change feed ------------
+        // The ONLY part of this DO addressed as a fetch target rather than over RPC, and
+        // only because a WebSocket cannot cross RPC — a socket is not serializable, so the
+        // one way to hand one back is a `Response` carrying a `webSocket`. Everything the
+        // coordinator asserts on the way in is named in `live-reads.ts`, shared with
+        // `host.ts` so the two ends cannot drift.
+        /**
+         * Accept a subscription to this scope's changes.
+         *
+         * The coordinator has already decided that this connection can carry a push at all
+         * (the O2O check) and WHO is asking. What is decided here is nothing about
+         * authority: a subscription is not an authorization, and accepting one grants the
+         * subscriber no read it did not already have. Every frame is checked on its way
+         * out, individually, against the tuple state at that moment — so a grant revoked
+         * while the socket is open stops the frames it used to allow, which a
+         * subscription-time check would not.
+         *
+         * **This adds no authority to a holder of the stub, and the question is worth
+         * answering rather than leaving to be asked.** Being a public method, anything with
+         * the `SCOPE` binding can call it and assert whatever principal it likes in the
+         * headers. That is already true of `invoke`, which takes the principal as an
+         * argument and acts on it: a stub is the key to the scope, which is precisely why
+         * the router is not given one. The trust boundary is who holds the binding, not
+         * what this method checks — and what it does NOT do is let a stub-holder read
+         * anything the asserted principal could not, because the filter downstream re-checks
+         * that principal against every frame.
+         */
+        async fetch(request) {
+            const url = new URL(request.url);
+            if (url.pathname !== LIVE_SUBSCRIBE_PATH) {
+                // The DO has exactly one fetch surface. Anything else reaching here is a
+                // coordinator bug, and a 404 says so without guessing at an intent.
+                return new Response('this scope has no such surface', { status: 404 });
+            }
+            if (!isUpgradeRequest(request)) {
+                return new Response('live reads are a WebSocket surface', {
+                    status: 426,
+                    headers: { [LIVE_MODE_HEADER]: 'not-an-upgrade' },
+                });
+            }
+            const principal = request.headers.get(LIVE_PRINCIPAL_HEADER);
+            const tenantId = request.headers.get(LIVE_TENANT_HEADER);
+            const scopeId = request.headers.get(LIVE_SCOPE_HEADER);
+            if (!principal || !tenantId || !scopeId) {
+                // Fail closed and loudly. An unnamed subscriber is one whose permissions
+                // cannot be evaluated, and the only safe thing to do with a channel we cannot
+                // filter is to refuse to open it. 500, not 400: the caller is the coordinator
+                // in this same package, so a missing assertion is OUR bug, not the client's.
+                return new Response('live reads require an asserted principal, tenant and scope', {
+                    status: 500,
+                });
+            }
+            // A subscriber arriving before the scope's migrations have run would be told
+            // about events against a schema it cannot read back through. Same gate every
+            // other entry point takes, for the same reason.
+            await this.ensureMigrations();
+            const pair = new WebSocketPair();
+            const [client, server] = Object.values(pair);
+            // HIBERNATABLE, not `server.accept()`. A scope with a watcher open would
+            // otherwise be pinned in memory for as long as somebody has a tab open, which is
+            // the cost model inverted: a support desk being WATCHED is the normal state.
+            // Hibernation also fixes the worse half — an in-memory roster does not survive
+            // eviction, so the socket would stay open and silently stop receiving, which is
+            // indistinguishable from a quiet scope.
+            this.ctx.acceptWebSocket(server);
+            // `.parse`, not a cast: these three arrived as header strings, and the branded
+            // ids are what every check downstream is keyed on. A malformed one would
+            // otherwise be carried all the way to a `ctx.check` that quietly matches nothing —
+            // which reads as "this subscriber may see nothing" and is indistinguishable from
+            // a correct denial. Refused here instead, where it is still one subscriber's
+            // problem. Throwing is right: the coordinator built this request.
+            server.serializeAttachment({
+                principal: principalId.parse(principal),
+                tenantId: tenantIdOf.parse(tenantId),
+                scopeId: scopeIdOf.parse(scopeId),
+                since: new Date().toISOString(),
+            });
+            return new Response(null, { status: 101, webSocket: client });
+        }
+        /**
+         * A subscriber said something.
+         *
+         * The channel is one-way by design — the server announces, the client re-reads
+         * through the ordinary operation — so there is no client message that can cause a
+         * read, a write, or a change of subscription. `ping`/`pong` is the whole protocol,
+         * and it exists so an idle connection can be kept alive by either end.
+         *
+         * Deliberately NOT a place to let a client narrow or widen what it receives: a
+         * filter the client chooses is a filter the client can choose wrongly, and the
+         * only filter that matters here is the one it does not control.
+         */
+        webSocketMessage(ws, message) {
+            if (message === 'ping')
+                ws.send('pong');
+        }
+        /**
+         * The client hung up. Close our end so the runtime stops holding the subscription.
+         *
+         * The runtime passes `reason` and `wasClean` too; neither is read, so neither is
+         * named — there is nothing to do differently for an unclean close, because the
+         * socket is going away either way and the client's poll is what covers the gap.
+         */
+        webSocketClose(ws, code) {
+            // 1006 is reserved: it is what the runtime REPORTS for an abnormal closure and
+            // is not a code anything may SEND, so echoing it back throws — on precisely the
+            // path where the connection is already in trouble.
+            try {
+                ws.close(code === 1006 ? 1000 : code, 'scope closing the subscription');
+            }
+            catch {
+                // Already gone. Nothing to do, and nothing worth reporting.
+            }
+        }
+        /**
+         * A socket failed. Logged and not rethrown: there is no caller to fail, and the
+         * runtime delivers `webSocketClose` after this, which is what does the cleanup.
+         */
+        webSocketError(_ws, error) {
+            console.error('substrat: live-read socket error', error);
+        }
+        /**
+         * The outbox's high-water mark before a committing path runs (#938), or `null`
+         * when nobody is listening.
+         *
+         * `null` and `''` are different answers: `null` means no subscriber, so nothing is
+         * read at all and a scope pays nothing for a feature it is not using; `''` is the
+         * honest empty-outbox answer, and every ULID sorts above it.
+         *
+         * Read BEFORE the transaction by every caller, which is what makes the pair below
+         * able to name exactly the events that path added.
+         */
+        liveHighWaterMark() {
+            if (this.ctx.getWebSockets().length === 0)
+                return null;
+            return (this.sql.exec('SELECT MAX(id) AS id FROM _substrat_outbox').toArray()[0]?.id ?? '');
+        }
+        /**
+         * What every committing path does after its transaction closes: drain the outbox
+         * to consumers, then announce what landed to whoever may see it.
+         *
+         * **One step, because there is one rule.** The fan-out was wired into `invoke`
+         * alone at first, and `attachmentAdd`/`attachmentRemove` commit and emit too —
+         * `attachment.added` and `attachment.removed`, about a real entity. A watcher of
+         * that entity would have missed them: no error, no gap it could see, just a screen
+         * that did not update for one kind of change. That is the exact failure the
+         * hibernation design exists to prevent, arriving through a different door, so the
+         * answer is a step both doors take rather than a second call both must remember.
+         *
+         * Order is load-bearing: drain FIRST, announce after. A consumer's own emits are
+         * changes too, and they land in the outbox above `liveSince` — so announcing first
+         * would tell a subscriber about the cause and not the effect, and it would re-read
+         * too early.
+         */
+        async settleCommitted(tenantId, scopeId, liveSince, 
+        /**
+         * #1525: the call whose commit this is settling, or null — PASSED rather than
+         * read off `this.invocationId` inside `dispatch`, so each of the three doors
+         * says what it actually knows: `invoke` its own id, the two attachment verbs
+         * null. Same discipline `recordDenial` adopted, and for the same reason.
+         */
+        invocationId) {
+            await this.dispatch(tenantId, scopeId, invocationId);
+            if (liveSince === null)
+                return;
+            try {
+                await this.fanOutLive(liveSince, tenantId, scopeId);
+            }
+            catch (err) {
+                // The write has COMMITTED and the caller is owed its answer. A failure to
+                // announce is a failure of a hint, and the client's poll is the floor
+                // underneath it — so this is logged and never rethrown. Rethrowing would turn
+                // a delivered write into a 500 the caller would reasonably retry.
+                console.error('substrat: live-read fan-out failed after commit', err);
+            }
+        }
+        /**
+         * Announce what just committed, to whoever may see it (#938).
+         *
+         * **Three properties, and each is load-bearing.**
+         *
+         * *Post-commit.* Called after the operation's transaction has closed and after the
+         * consumer drain, so nothing is announced that a rollback could take back and
+         * nothing a consumer emitted is missed. A subscriber told about a row that then
+         * vanished would re-read, find nothing, and have no way to tell that from a
+         * deletion.
+         *
+         * *Filtered per subscriber, per event, after the check.* The declared
+         * `liveTargets` key is checked ON THE EVENT'S OWN ENTITY, through `ctx.check` —
+         * the same evaluator, the same entity-narrowed grants, the same parent walk as the
+         * read the client is about to make. An entity type no module declared is announced
+         * to nobody. Knowing that a row exists and changed at 14:02 is information about
+         * that row, so the empty payload is not what makes this safe; this is.
+         *
+         * *Never able to fail the operation.* The write has committed and the caller has
+         * its answer. A socket that has gone away mid-fan-out, or a check that cannot be
+         * evaluated, costs a subscriber its live update — which it survives, because the
+         * client's contract is that a push is a hint and the poll is the floor.
+         */
+        async fanOutLive(sinceEventId, tenantId, scopeId) {
+            const sockets = this.ctx.getWebSockets();
+            if (sockets.length === 0)
+                return;
+            const rows = this.sql
+                .exec(`SELECT id, type, entity_type, entity_id, occurred_at FROM _substrat_outbox
+            WHERE id > ? ORDER BY id LIMIT ?`, sinceEventId, LIVE_FANOUT_LIMIT)
+                .toArray();
+            // Drop the undeclared entity types BEFORE any per-subscriber work. Not an
+            // optimisation: it is the fail-closed rule stated once, in the one place that
+            // decides, rather than relied upon inside the loop below.
+            const announceable = rows.filter((r) => this.liveTargets.has(r.entity_type));
+            if (announceable.length === 0)
+                return;
+            for (const ws of sockets) {
+                let subscription = null;
+                try {
+                    subscription = readSubscription(ws.deserializeAttachment());
+                }
+                catch {
+                    subscription = null;
+                }
+                // A socket we cannot name is a socket we cannot filter for. Skipped, never
+                // sent to — see `readSubscription` for why every unusable shape fails closed.
+                if (!subscription)
+                    continue;
+                // A socket that outlived a scope rebind, or was somehow accepted for another
+                // node, must not be fed this scope's events. Cheap, and it makes the identity
+                // the frames are filtered against an explicit precondition rather than an
+                // assumption about how the subscription was created.
+                if (subscription.tenantId !== tenantId || subscription.scopeId !== scopeId)
+                    continue;
+                // One context per subscriber, not per event: `ctx.check` is the expensive part
+                // and the context is only the subject it is evaluated for.
+                //
+                // A frame this subscriber does not pass is NOT recorded as a denial (K-35),
+                // and that is deliberate: `recordDenial` is called on a refused REQUEST, where
+                // somebody asked for something and was told no. Nobody asked for these. Logging
+                // one row per unentitled subscriber per event would bury the denials that mean
+                // something — a broken screen, or somebody walking the surface — under the
+                // ordinary, correct working of a filter.
+                //
+                // The operation name is carried anyway, for the events a fan-out cannot emit
+                // but a future reader of this context might.
+                const ctx = this.operationContext(subscription.principal, tenantId, scopeId, undefined, undefined, undefined, undefined, undefined, 'live.subscribe');
+                for (const row of announceable) {
+                    // Non-null: `announceable` is exactly the rows whose type is in the map.
+                    const permission = this.liveTargets.get(row.entity_type);
+                    let allowed = false;
+                    try {
+                        const decision = await ctx.check(permission, {
+                            entityType: row.entity_type,
+                            entityId: row.entity_id,
+                        });
+                        allowed = decision.allowed;
+                    }
+                    catch {
+                        // A check that cannot answer is a check that refuses. The alternative —
+                        // treating an evaluator failure as an allow — turns an outage in the
+                        // permission path into a disclosure, which is the one failure mode this
+                        // surface must not have.
+                        allowed = false;
+                    }
+                    if (!allowed)
+                        continue;
+                    const frame = {
+                        kind: 'change',
+                        id: row.id,
+                        type: row.type,
+                        entityType: row.entity_type,
+                        entityId: row.entity_id,
+                        at: row.occurred_at,
+                    };
+                    try {
+                        ws.send(JSON.stringify(frame));
+                    }
+                    catch {
+                        // The socket went away between `getWebSockets()` and here. Stop writing to
+                        // this one and move on; the runtime will deliver `webSocketClose`.
+                        break;
+                    }
+                }
+            }
+        }
         // -- attachments (#473): the metadata half of the attachment surface --------
         // The coordinator (worker) holds the bytes and the per-tenant R2 binding; this
         // DO holds the permission gate and the metadata fact, under the same per-scope
@@ -1359,6 +1749,10 @@ export function defineScopeDO(modules, bareOps) {
             const parsed = attachmentRecord.parse(record);
             const gate = this.attachmentGate(parsed.entity.entityType);
             return this.queue.enqueue(async () => {
+                // #938: this path commits and emits too, so it takes the same mark-then-settle
+                // pair `invoke` takes. Inside the queued body and before the transaction, for
+                // the reason it is read there: that is where this call holds the DO to itself.
+                const liveSince = this.liveHighWaterMark();
                 try {
                     await this.ctx.storage.transaction(async () => {
                         const ctx = this.operationContext(principal, tenantId, scopeId, undefined, connectionId, undefined, undefined, undefined, 'attachments.upload');
@@ -1378,11 +1772,13 @@ export function defineScopeDO(modules, bareOps) {
                 }
                 catch (err) {
                     if (err instanceof PermissionDenied) {
-                        this.recordDenial(attachSubject(principal, connectionId), tenantId, 'attachments.upload', err);
+                        this.recordDenial(attachSubject(principal, connectionId), tenantId, 'attachments.upload', err, null);
                     }
                     throw toRpcError(err);
                 }
-                await this.dispatch(tenantId, scopeId);
+                // #1525: null. An attachment RPC carries no invocation, exactly as its denial
+                // records none — so the deliveries it drains name no call rather than a wrong one.
+                await this.settleCommitted(tenantId, scopeId, liveSince, null);
                 return parsed;
             });
         }
@@ -1396,7 +1792,7 @@ export function defineScopeDO(modules, bareOps) {
             }
             catch (err) {
                 if (err instanceof PermissionDenied) {
-                    this.recordDenial(attachSubject(principal, connectionId), tenantId, 'attachments.list', err);
+                    this.recordDenial(attachSubject(principal, connectionId), tenantId, 'attachments.list', err, null);
                 }
                 throw toRpcError(err);
             }
@@ -1427,7 +1823,7 @@ export function defineScopeDO(modules, bareOps) {
                 }
                 catch (err) {
                     if (err instanceof PermissionDenied) {
-                        this.recordDenial(attachSubject(principal, connectionId), tenantId, 'attachments.open', err);
+                        this.recordDenial(attachSubject(principal, connectionId), tenantId, 'attachments.open', err, null);
                     }
                     throw toRpcError(err);
                 }
@@ -1440,7 +1836,7 @@ export function defineScopeDO(modules, bareOps) {
             }
             catch (err) {
                 if (err instanceof PermissionDenied) {
-                    this.recordDenial(attachSubject(principal, connectionId), tenantId, 'attachments.open', err);
+                    this.recordDenial(attachSubject(principal, connectionId), tenantId, 'attachments.open', err, null);
                 }
                 throw toRpcError(err);
             }
@@ -1454,6 +1850,8 @@ export function defineScopeDO(modules, bareOps) {
                 if (!record)
                     return null;
                 const gate = this.attachmentGate(record.entity.entityType);
+                // #938: same mark-then-settle pair as the upload path above.
+                const liveSince = this.liveHighWaterMark();
                 try {
                     await this.ctx.storage.transaction(async () => {
                         const ctx = this.operationContext(principal, tenantId, scopeId, undefined, connectionId, undefined, undefined, undefined, 'attachments.remove');
@@ -1470,32 +1868,128 @@ export function defineScopeDO(modules, bareOps) {
                 }
                 catch (err) {
                     if (err instanceof PermissionDenied) {
-                        this.recordDenial(attachSubject(principal, connectionId), tenantId, 'attachments.remove', err);
+                        this.recordDenial(attachSubject(principal, connectionId), tenantId, 'attachments.remove', err, null);
                     }
                     throw toRpcError(err);
                 }
-                await this.dispatch(tenantId, scopeId);
+                // #1525: null. An attachment RPC carries no invocation, exactly as its denial
+                // records none — so the deliveries it drains name no call rather than a wrong one.
+                await this.settleCommitted(tenantId, scopeId, liveSince, null);
                 return record;
             });
         }
+        /** The kernel's schedule-switch SQL (#1666), over this DO's storage. */
+        switchSql() {
+            return {
+                all: (sql, ...params) => this.sql.exec(sql, ...params).toArray(),
+                run: (sql, ...params) => {
+                    this.sql.exec(sql, ...params);
+                },
+            };
+        }
+        /**
+         * Where a module's schedules stand on this scope (#383, #1666) — the kernel's
+         * `systemScheduleState`, the predicate the pure adapter runs too: `on` with a live
+         * `system:<moduleId>` grant, `off` while the kill switch's marker is live, whatever
+         * else is, and `ungranted` on a scope that never ran the module (a foreign vertical's,
+         * which the sweep skips quietly).
+         */
+        async systemScheduleState(moduleId) {
+            return systemScheduleState(this.switchSql(), moduleId, new Date().toISOString());
+        }
         /**
-         * Whether this scope holds a live `system:<moduleId>` grant (#383) — the switch
-         * that decides if a module's schedules run here at all. Absent on a foreign
-         * vertical's scope, or after a per-tenant revoke, so the sweep skips it quietly.
+         * The pre-#1666 read, kept for ONE reason: a coordinator a deploy behind this DO still
+         * calls it. It answers the new question, not the old one — the old predicate counted any
+         * live `system:` tuple, and the kill switch's OFF marker is one, so an old coordinator
+         * asking the old question would run a switched-off scope's schedules.
          */
         async hasSystemGrant(moduleId) {
-            const now = new Date().toISOString();
-            const row = this.sql
-                .exec(`SELECT 1 FROM _substrat_tuples
-            WHERE subject = ? AND revoked_at IS NULL AND (expires_at IS NULL OR expires_at > ?)
-            LIMIT 1`, `system:${moduleId}`, now)
-                .toArray()[0];
-            return row !== undefined;
+            return (await this.systemScheduleState(moduleId)) === 'on';
+        }
+        /**
+         * `grantToSystem`'s scope-level write (#1666): the explicit grant — `INSERT OR REPLACE`,
+         * as `writeTuple` — EXCEPT while the module's schedule kill switch is off, when it writes
+         * nothing and answers `false`. The check and the write are one queued unit, so no switch
+         * can move between them. Restore is the lever; a grant is not.
+         */
+        async writeSystemGrant(moduleId, relation, object, expiresAt) {
+            return this.queue.enqueue(() => {
+                if (systemSwitchedOff(this.switchSql(), moduleId))
+                    return false;
+                this.sql.exec(`INSERT OR REPLACE INTO _substrat_tuples (subject, relation, object, expires_at)
+           VALUES (?, ?, ?, ?)`, `system:${moduleId}`, relation, object, expiresAt);
+                return true;
+            });
         }
-        /** The last time a schedule's operation ran on this scope (#383), or null. */
+        /**
+         * Move a module's schedule switch on this scope (#1666) — the kernel's
+         * `switchSystemSchedules`, serialized on the queue with every other tuple write and run
+         * as one `transactionSync`, so its reads and writes are one unit.
+         */
+        async switchSystemSchedules(moduleId, scopeId, to, at) {
+            return this.queue.enqueue(() => this.ctx.storage.transactionSync(() => switchSystemSchedules(this.switchSql(), { moduleId, scopeId, to, at })));
+        }
+        /**
+         * The exchange (#1672) — a capability's secret traded for a session, or for the
+         * principal a `become` capability yields. Runs the kernel's `exchangeCapability`, the
+         * function the pure adapter runs, in this DO: one queued body and one storage
+         * transaction, so the use it takes and the `capability.exercised` event recording it
+         * commit together or not at all; the event's consumers then settle as an invoke's do.
+         *
+         * The secret itself reaches this DO — it must, to be hashed and looked up — and goes
+         * no further: nothing here stores or returns it.
+         */
+        async exchangeCapability(secret, tenantId, scopeId, mode) {
+            await this.ensureMigrations();
+            return await this.queue.enqueue(async () => {
+                const liveSince = this.liveHighWaterMark();
+                // ONE instant for the whole exchange: the row's `last_used_at`, the session's times
+                // and the event's `occurredAt` are one fact, and two clock reads could disagree.
+                const now = instant.parse(new Date().toISOString());
+                let outcome = null;
+                await this.ctx.storage.transaction(async () => {
+                    outcome = await exchangeCapability({
+                        sql: doSpineSql(this.sql),
+                        now,
+                        // Stamped `{ capability }` by the ordinary emit path, under the exchange's own
+                        // pseudo-operation name — the actor is the capability, as on every event it
+                        // goes on to cause.
+                        emit: (capability, event) => this.operationContext(principalId.parse(ulid()), tenantId, scopeId, undefined, undefined, undefined, undefined, undefined, CAPABILITY_EXCHANGE_OPERATION, capability, [], now).emit(event),
+                    }, secret, mode);
+                });
+                if (outcome)
+                    await this.settleCommitted(tenantId, scopeId, liveSince, null);
+                return outcome;
+            });
+        }
+        /**
+         * The platform's mint (#1672, `HostAdmin.mintCapability`) — a `become` capability,
+         * serialized on the queue with every other spine write. One INSERT, so it needs no
+         * transaction of its own; the hash is computed before it.
+         */
+        async mintBecomeCapability(input, actor) {
+            await this.ensureMigrations();
+            return await this.queue.enqueue(() => mintBecomeCapability(doSpineSql(this.sql), input, actor, instant.parse(new Date().toISOString())));
+        }
+        /**
+         * The platform's revoke (#1672, `HostAdmin.revokeCapability`) — of any capability in
+         * this scope. Returns the record as it stood before, for the admin log, or `null`.
+         */
+        async revokeCapabilityAsPlatform(id, actor) {
+            await this.ensureMigrations();
+            return await this.queue.enqueue(() => this.ctx.storage.transactionSync(() => revokeCapabilityAsPlatform(doSpineSql(this.sql), id, actor, instant.parse(new Date().toISOString()))) ?? null);
+        }
+        /**
+         * The last time a schedule's operation ran on this scope (#383), or null.
+         *
+         * `kind = 'schedule'` is not decoration (#1288): an operation may legally be
+         * named `freshness:<something>`, and before the column this read answered with
+         * the EVALUATOR's last recorded time for that event type — a cadence gate
+         * driven by a verdict nothing ran.
+         */
         async scheduleLastRun(operation) {
             const row = this.sql
-                .exec(`SELECT last_run_at FROM _substrat_schedule_state WHERE schedule_op = ?`, operation)
+                .exec(`SELECT last_run_at FROM _substrat_schedule_state WHERE kind = 'schedule' AND schedule_op = ?`, operation)
                 .toArray()[0];
             return row?.last_run_at ?? null;
         }
@@ -1503,8 +1997,9 @@ export function defineScopeDO(modules, bareOps) {
          * #1232: everything the freshness evaluator needs about this scope, one round
          * trip regardless of how many types are declared — the newest matching event
          * per type, plus each type's recorded evaluator state (last recorded at +
-         * outcome, kept in `_substrat_schedule_state` under a `freshness:` prefix that
-         * cannot collide with operation names).
+         * outcome, kept in `_substrat_schedule_state` under `kind = 'freshness'`, which
+         * since #1288 is what separates these rows from the schedule rows beside them —
+         * the `freshness:` prefix on the key is retained but no longer load-bearing).
          */
         async freshnessProbe(types) {
             const out = {};
@@ -1521,7 +2016,8 @@ export function defineScopeDO(modules, bareOps) {
             }
             const keys = types.map((t) => `freshness:${t}`);
             for (const row of this.sql
-                .exec(`SELECT schedule_op, last_run_at, last_status FROM _substrat_schedule_state WHERE schedule_op IN (${marks})`, ...keys)
+                .exec(`SELECT schedule_op, last_run_at, last_status FROM _substrat_schedule_state
+            WHERE kind = 'freshness' AND schedule_op IN (${marks})`, ...keys)
                 .toArray()) {
                 const t = row.schedule_op.slice('freshness:'.length);
                 if (out[t]) {
@@ -1533,16 +2029,173 @@ export function defineScopeDO(modules, bareOps) {
         }
         /**
          * Write one `_substrat_schedule_state` row (#383). Spine, kernel-written.
-         * `unit` is the row's key in either of the two shapes the table holds: a schedule
+         *
+         * `kind` is PASSED, never derived from the shape of `unit` (#1288) — deriving it
+         * is precisely the convention this column replaced, and it is wrong for the one
+         * input that matters: a schedule operation named `freshness:orders.placed` is a
+         * schedule row, whatever its key looks like. `unit` is that row's key: a schedule
          * operation (`module/verb`, and then `at`/`status` are when it ran and how it
          * ended) or a freshness key (`freshness:<eventType>`, and then they are when the
          * verdict was recorded and what it was — nothing ran). See the bootstrap DDL.
+         *
+         * `kind` is LAST because this is a positional RPC — see the interface's own note
+         * in `host.ts`. An old DO drops a trailing argument; a leading one it binds, and
+         * every value after it lands one column to the left, silently.
          */
-        async recordScheduleRun(unit, at, status) {
-            this.sql.exec(`INSERT INTO _substrat_schedule_state (schedule_op, last_run_at, last_status)
-           VALUES (?, ?, ?)
-         ON CONFLICT(schedule_op) DO UPDATE SET last_run_at = excluded.last_run_at,
-                                                last_status = excluded.last_status`, unit, at, status);
+        async recordScheduleRun(unit, at, status, kind) {
+            this.sql.exec(`INSERT INTO _substrat_schedule_state (kind, schedule_op, last_run_at, last_status)
+           VALUES (?, ?, ?, ?)
+         ON CONFLICT(kind, schedule_op) DO UPDATE SET last_run_at = excluded.last_run_at,
+                                                      last_status = excluded.last_status`, kind, unit, at, status);
+        }
+        // -- the resumable-run driver's store (#1577) -----------------------------
+        //
+        // D-14's DURABLE driver, and the only half of it that lives in the DO: the run
+        // record and the step ledger. Every decision — what coalescing means, when a
+        // step is skipped, when a run fails — is in the kernel's `JobRunStore` callers,
+        // which the coordinator drives; these are reads and writes and nothing else, so
+        // the two drivers cannot disagree about any of it.
+        //
+        // Each step commits on its OWN round trip rather than the pass batching them at
+        // the end. That is what a mid-pass eviction keeps, and a DO is evicted and
+        // revived constantly — batching would lose exactly the work resume exists for.
+        /**
+         * Coalescing, as ONE round trip: the live (`running`) run for this key, or this
+         * row inserted and returned.
+         *
+         * **The single RPC is the atomicity**, and that is the whole reason it is shaped
+         * this way rather than as a `jobRunLive` the coordinator follows with a
+         * `jobRunInsert`. A Durable Object serializes its RPCs, so the lookup and the
+         * insert cannot be interleaved by another caller; split across two calls they
+         * can, and two concurrent starts then both find nothing and both insert. The
+         * schema carries no unique constraint to catch that, deliberately — a crashed
+         * run must stay restartable — so the indivisibility has to come from here.
+         */
+        async jobRunStartOrJoin(moduleId, job, instance, row) {
+            const live = this.sql
+                .exec(`SELECT * FROM _substrat_job_runs
+              WHERE module_id = ? AND job = ? AND instance = ? AND status = 'running'
+              ORDER BY id DESC LIMIT 1`, moduleId, job, instance)
+                .toArray()[0] ?? null;
+            if (live)
+                return live;
+            // `transactionSync`, and the two writes inlined rather than reached through
+            // `jobRunInsert`: an `await` between them is an output-gate boundary, and the
+            // point of doing this in one RPC is that there is no boundary to be evicted
+            // at. Same reason `SCHEDULE_STATE_REBUILD` insists on it.
+            this.ctx.storage.transactionSync(() => {
+                this.sql.exec(`INSERT INTO _substrat_job_runs
+             (id, module_id, job, instance, payload, status, cursor, counters, attempts,
+              last_error, started_at, updated_at, next_attempt_at, ended_at)
+           VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`, row.id, row.module_id, row.job, row.instance, row.payload, row.status, row.cursor, row.counters, row.attempts, row.last_error, row.started_at, row.updated_at, row.next_attempt_at, row.ended_at);
+            });
+            return row;
+        }
+        /** One run by id, whatever its status. */
+        async jobRunById(id) {
+            return (this.sql.exec('SELECT * FROM _substrat_job_runs WHERE id = ?', id).toArray()[0] ?? null);
+        }
+        /** Insert a fresh run. The coordinator has already refused a non-queue-safe payload. */
+        async jobRunInsert(row) {
+            this.sql.exec(`INSERT INTO _substrat_job_runs
+           (id, module_id, job, instance, payload, status, cursor, counters, attempts,
+            last_error, started_at, updated_at, next_attempt_at, ended_at)
+         VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`, row.id, row.module_id, row.job, row.instance, row.payload, row.status, row.cursor, row.counters, row.attempts, row.last_error, row.started_at, row.updated_at, row.next_attempt_at, row.ended_at);
+        }
+        /**
+         * `running` runs whose backoff has elapsed, oldest first, after `afterId`.
+         *
+         * The cursor is what lets the coordinator page past runs it cannot drive: it
+         * skips any whose job this deployment does not register, and without a cursor
+         * those rows head every batch forever (`runDueJobRuns`). `afterId` is LAST, as
+         * every argument added to an RPC on this interface must be.
+         */
+        async jobRunsDue(now, limit, afterId) {
+            return this.sql
+                .exec(
+            // `afterId` bound TWICE rather than as `?2`: mixing anonymous and numbered
+            // parameters makes the anonymous ones resume from the highest index used,
+            // which is a footgun for the next person to add a clause. Spelled exactly
+            // as the pure adapter spells it.
+            `SELECT * FROM _substrat_job_runs
+            WHERE status = 'running' AND (next_attempt_at IS NULL OR next_attempt_at <= ?)
+              AND (? IS NULL OR id > ?)
+            ORDER BY id LIMIT ?`, now, afterId ?? null, afterId ?? null, limit)
+                .toArray();
+        }
+        /** The operator read, newest first. */
+        async jobRunList(filter) {
+            const where = [];
+            const params = [];
+            for (const [column, value] of [
+                ['module_id', filter.moduleId],
+                ['job', filter.job],
+                ['instance', filter.instance],
+                ['status', filter.status],
+            ]) {
+                if (value !== undefined) {
+                    where.push(`${column} = ?`);
+                    params.push(value);
+                }
+            }
+            params.push(jobRunListLimit(filter.limit));
+            return this.sql
+                .exec(`SELECT * FROM _substrat_job_runs
+           ${where.length ? `WHERE ${where.join(' AND ')}` : ''}
+           ORDER BY id DESC LIMIT ?`, ...params)
+                .toArray();
+        }
+        /**
+         * Write a pass outcome onto the run row — every column at once.
+         *
+         * Whole rather than partial, and that is the shape not an accident: a commit
+         * writes cursor AND counters AND a cleared error AND a cleared backoff, and a
+         * partial update that wrote three of the four would leave a run carrying the
+         * last failure's error beside the new cursor, which reads as broken forever.
+         */
+        async jobRunPatch(id, patch) {
+            this.sql.exec(`UPDATE _substrat_job_runs
+            SET status = ?, cursor = ?, counters = ?, attempts = ?, last_error = ?,
+                updated_at = ?, next_attempt_at = ?, ended_at = ?
+          WHERE id = ?`, patch.status, patch.cursor, patch.counters, patch.attempts, patch.lastError, patch.updatedAt, patch.nextAttemptAt, patch.endedAt, id);
+        }
+        /** One step's ledger row — a non-null `result` is what means completed. */
+        async jobStepRow(runId, step) {
+            return (this.sql
+                .exec('SELECT step, result, attempts, last_error FROM _substrat_job_steps WHERE run_id = ? AND step = ?', runId, step)
+                .toArray()[0] ?? null);
+        }
+        /** Record one step attempt. `result` non-null = it completed and must not re-run. */
+        async jobStepRecord(runId, step, result, attempts, lastError, at) {
+            this.sql.exec(`INSERT INTO _substrat_job_steps (run_id, step, result, attempts, last_error, recorded_at)
+           VALUES (?, ?, ?, ?, ?, ?)
+         ON CONFLICT (run_id, step) DO UPDATE SET result = excluded.result,
+                                                  attempts = excluded.attempts,
+                                                  last_error = excluded.last_error,
+                                                  recorded_at = excluded.recorded_at`, runId, step, result, attempts, lastError, at);
+        }
+        /**
+         * A COMMITTED pass: the run's new state and the dropping of its step ledger, in
+         * ONE RPC so they cannot come apart.
+         *
+         * Same reasoning as `jobRunStartOrJoin` — the single round trip is the
+         * atomicity. As two calls, a stop in between leaves the advanced cursor beside
+         * the finished pass's memo rows, and a handler that reuses a step name across
+         * passes (legal: the determinism rule binds names to the payload and prior
+         * results, not to the cursor) then skips work it never did. The kernel's
+         * `runJobPass` carries the full argument.
+         */
+        async jobCommitPass(id, patch) {
+            // `transactionSync` with both statements inline — NOT `await
+            // this.jobRunPatch(...)` then the delete. The await is an output-gate
+            // boundary, which is precisely the gap this method exists to close.
+            this.ctx.storage.transactionSync(() => {
+                this.sql.exec(`UPDATE _substrat_job_runs
+              SET status = ?, cursor = ?, counters = ?, attempts = ?, last_error = ?,
+                  updated_at = ?, next_attempt_at = ?, ended_at = ?
+            WHERE id = ?`, patch.status, patch.cursor, patch.counters, patch.attempts, patch.lastError, patch.updatedAt, patch.nextAttemptAt, patch.endedAt, id);
+                this.sql.exec('DELETE FROM _substrat_job_steps WHERE run_id = ?', id);
+            });
         }
         // -- guards (K-17) --------------------------------------------------------
         /** This scope's spine, read under whatever transaction the caller already opened. */
@@ -1644,8 +2297,15 @@ export function defineScopeDO(modules, bareOps) {
          *
          * "Not yet consumed" means never attempted, or retrying and now due (#100).
          * Terminal rows — delivered or dead-lettered — are excluded by the join.
+         *
+         * Decoded per row (#1636). A row that will not decode comes back in `undecodable`,
+         * never as an event: the coordinator journals it as a dead letter, and its handler is
+         * never handed an event built from stand-ins. The whole list used to be one
+         * `rows.map(decode)`, so one bad row threw the executor's pending list on every pass.
+         * The journal write stays on the coordinator, beside every other attempt it records —
+         * this stays a read.
          */
-        pendingExecutorEvents(deliveryId, eventType) {
+        pendingExecutorDeliveries(deliveryId, eventType) {
             const rows = this.sql
                 .exec(`SELECT o.* FROM _substrat_outbox o
            LEFT JOIN _substrat_deliveries d
@@ -1655,7 +2315,26 @@ export function defineScopeDO(modules, bareOps) {
                   OR (d.next_attempt_at IS NOT NULL AND d.next_attempt_at <= ?))
            ORDER BY o.id`, deliveryId, eventType, new Date().toISOString())
                 .toArray();
-            return rows.map((r) => this.parseOutboxRow(r));
+            const events = [];
+            const undecodable = [];
+            for (const r of rows) {
+                try {
+                    events.push(domainEventOf(r));
+                }
+                catch (err) {
+                    undecodable.push({ eventId: r.id, error: String(err) });
+                }
+            }
+            return { events, undecodable };
+        }
+        /**
+         * The same read as a bare list of events, for a coordinator deployed before
+         * `pendingExecutorDeliveries` (#1636). An undecodable row is left out rather than
+         * thrown, so that pairing still delivers the rows behind it; the next coordinator
+         * dead-letters it.
+         */
+        pendingExecutorEvents(deliveryId, eventType) {
+            return this.pendingExecutorDeliveries(deliveryId, eventType).events;
         }
         /**
          * Journal one executor attempt (#100). `error` null means delivered;
@@ -1665,20 +2344,44 @@ export function defineScopeDO(modules, bareOps) {
          * Written AFTER the effect, so a crash mid-effect retries rather than silently
          * marking success. The coordinator computes the backoff because it owns the
          * per-executor policy; the DO owns the state.
+         *
+         * `invocationId` is LAST because this is a positional RPC — the same rule
+         * `recordScheduleRun` states. An old DO drops a trailing argument; a leading one
+         * it binds, and every value after it lands one column to the left, silently.
          */
-        recordExecutorAttempt(eventId, deliveryId, error, nextAttemptAt) {
+        recordExecutorAttempt(eventId, deliveryId, error, nextAttemptAt, 
+        /**
+         * #1525: the call THIS attempt ran in, or null. Passed rather than read off
+         * `this.invocationId`, and here there is no choice about it: executors run on
+         * the COORDINATOR, so by the time this RPC arrives the queued body that held
+         * the id has long returned and the field reads null. The coordinator is the
+         * only side that knows, which is why the SQLite twin passes it too — a recorded
+         * fact whose correctness argument differs per adapter is the kind that drifts.
+         *
+         * Defaulted, for the other half of the skew: a coordinator too old to pass it
+         * calls this with four arguments, and `undefined` is not a value SQLite binds.
+         * Null is the honest answer there anyway — that coordinator recorded no call.
+         */
+        invocationId = null) {
             const prior = this.sql
                 .exec('SELECT attempts FROM _substrat_deliveries WHERE event_id = ? AND consumer_module = ?', eventId, deliveryId)
                 .toArray()[0];
             const attempts = (prior?.attempts ?? 0) + 1;
             this.sql.exec(`INSERT INTO _substrat_deliveries
-           (event_id, consumer_module, delivered_at, error, attempts, next_attempt_at)
-         VALUES (?, ?, ?, ?, ?, ?)
+           (event_id, consumer_module, delivered_at, error, attempts, next_attempt_at,
+            invocation_id)
+         VALUES (?, ?, ?, ?, ?, ?, ?)
          ON CONFLICT (event_id, consumer_module) DO UPDATE SET
            delivered_at = excluded.delivered_at,
            error = excluded.error,
            attempts = excluded.attempts,
-           next_attempt_at = excluded.next_attempt_at`, eventId, deliveryId, new Date().toISOString(), error, attempts, nextAttemptAt);
+           next_attempt_at = excluded.next_attempt_at,
+           -- #1525: overwritten, like the four above. The row describes the LATEST
+           -- attempt, so a retry drained by a different call (or by none) must not
+           -- keep claiming the call that made the first one.
+           invocation_id = excluded.invocation_id`, eventId, deliveryId, new Date().toISOString(), error, attempts, nextAttemptAt, 
+            // #1525: the call this attempt ran in, as the coordinator named it.
+            invocationId);
             return attempts;
         }
         /** How many attempts this delivery has already had — the backoff input. */
@@ -1720,12 +2423,21 @@ export function defineScopeDO(modules, bareOps) {
          * `result` is COALESCE'd so a value written on an earlier pass (e.g. a minted sibling scope id,
          * for two-phase idempotency) survives a null on retry. `attempts` bumps each settle; `settled_at`
          * is set only on a terminal outcome.
+         *
+         * **Compare-and-set on `pending` (#1600 review).** The drain reads pending rows, runs a
+         * handler, then settles — and between the read and the settle a subject erasure can redact
+         * the row. Settling by `id` alone let that stale pass overwrite the redaction and write a
+         * provider's reply, which can quote the person, back into `last_error`. Nothing legitimate
+         * is refused: `pendingPlatformRequests` returns only pending rows, so every settle targets
+         * one that was pending when it was read. A settle that finds the row already terminal does
+         * nothing, deliberately silently — throwing would make the drain's blanket catch retry a
+         * row that is correctly over.
          */
         settlePlatformRequest(id, status, result, lastError, lastFailure = null) {
             this.sql.exec(`UPDATE _substrat_platform_requests
            SET status = ?, result = COALESCE(?, result), last_error = ?, last_failure = ?,
                attempts = attempts + 1, settled_at = ?
-         WHERE id = ?`, status, result, lastError, lastFailure, status === 'pending' ? null : new Date().toISOString(), id);
+         WHERE id = ? AND status = 'pending'`, status, result, lastError, lastFailure, status === 'pending' ? null : new Date().toISOString(), id);
         }
         /**
          * Turn one connector delivery into a `connector:<provider>` platform intent (#574
@@ -1736,8 +2448,18 @@ export function defineScopeDO(modules, bareOps) {
          * the event on the next drain). Backpressure throws BEFORE any write — the caller
          * records a failed attempt and the delivery retries on its own backoff, exactly as
          * a throwing handler would.
+         *
+         * `invocationId` is LAST, and defaulted, for the RPC-skew reason `recordExecutorAttempt`
+         * states at length.
          */
-        routeExecutorEventToPlatform(eventId, deliveryId, kind, payload, requestedBy) {
+        routeExecutorEventToPlatform(eventId, deliveryId, kind, payload, requestedBy, 
+        /**
+         * #1525: the call this routing ran in, or null. On the hosted path this is the
+         * dominant executor journal — every vertical is CP-less, so a connector delivery
+         * becomes an intent here rather than running in `recordExecutorAttempt`'s caller —
+         * so leaving it null would make the column read "no call" for the common case.
+         */
+        invocationId = null) {
             const pending = Number(this.sql
                 .exec(`SELECT COUNT(*) AS c FROM _substrat_platform_requests WHERE status = 'pending'`)
                 .toArray()[0].c);
@@ -1757,7 +2479,7 @@ export function defineScopeDO(modules, bareOps) {
             this.sql.exec(`INSERT INTO _substrat_platform_requests
            (id, kind, payload, requested_by, impersonation, status, attempts, requested_at)
          VALUES (?, ?, ?, ?, ?, 'pending', 0, ?)`, id, kind, payload, requestedBy, source?.impersonation ?? null, instant.parse(new Date().toISOString()));
-            this.recordExecutorAttempt(eventId, deliveryId, null, null);
+            this.recordExecutorAttempt(eventId, deliveryId, null, null, invocationId);
             return id;
         }
         /**
@@ -1933,6 +2655,9 @@ export function defineScopeDO(modules, bareOps) {
          * `destScopeId` is the scope being written INTO. A dump carries scope-level tuples
          * naming the scope it was captured from, so restoring one anywhere else needs them
          * re-pointed — see `rewriteScopeTuples`.
+         *
+         * What the dump did NOT carry is rebuilt by the next migration pass, which is why
+         * this ends by forgetting the memoised one (#1589) — see the tail of the method.
          */
         /**
          * The additive spine-column migrations. KERNEL_DDL is all IF NOT EXISTS, so a
@@ -1951,6 +2676,11 @@ export function defineScopeDO(modules, bareOps) {
                 // consumer dead-letter.
                 'ALTER TABLE _substrat_deliveries ADD COLUMN attempts INTEGER NOT NULL DEFAULT 0',
                 'ALTER TABLE _substrat_deliveries ADD COLUMN next_attempt_at TEXT',
+                // #1525: the invocation an attempt ran in, on a scope DO created before the
+                // column. Nullable, and the null is honestly "no call was carried" — which
+                // attempt produced a delivery already journalled cannot be decided afterwards,
+                // exactly as #1237's outbox column argued.
+                'ALTER TABLE _substrat_deliveries ADD COLUMN invocation_id TEXT',
                 // K-34: the authorization column on a scope DO created before it existed. Nullable,
                 // so legacy outbox rows read as "unrecorded". (_substrat_denials is a new table,
                 // covered by KERNEL_DDL's IF NOT EXISTS with no ALTER.)
@@ -1966,6 +2696,10 @@ export function defineScopeDO(modules, bareOps) {
                 'ALTER TABLE _substrat_outbox ADD COLUMN impersonation TEXT',
                 'ALTER TABLE _substrat_platform_requests ADD COLUMN impersonation TEXT',
                 'ALTER TABLE _substrat_denials ADD COLUMN impersonation TEXT',
+                // #1525: the invocation a refusal happened during, on a scope DO created before
+                // the column. Nullable, and the null is honestly "no id was carried" — a past
+                // denial's call cannot be decided afterwards, as #1237's outbox column argued.
+                'ALTER TABLE _substrat_denials ADD COLUMN invocation_id TEXT',
                 // #1231: the emitting operation, on a scope DO created before the column.
                 // Nullable so every legacy row reads as unrecorded rather than named.
                 'ALTER TABLE _substrat_outbox ADD COLUMN operation TEXT',
@@ -2001,6 +2735,33 @@ export function defineScopeDO(modules, bareOps) {
             // boot. `lint:spine-ddl` compares KERNEL_DDL's indexes only, so this one is held to
             // both adapters by the query-plan test rather than by that gate.
             this.sql.exec('CREATE INDEX IF NOT EXISTS _substrat_outbox_invocation ON _substrat_outbox (invocation_id, id)');
+            this.ensureScheduleStateKind();
+        }
+        /**
+         * #1288: `_substrat_schedule_state`, rebuilt with `kind` in its key on a scope DO
+         * whose table predates the column. Not in the ALTER list above, because `kind`
+         * joins the PRIMARY KEY and no ALTER can widen a key — the statements are the
+         * kernel's, so the pure adapter rebuilds byte-identically.
+         *
+         * Detected from `sqlite_master.sql`: DO SQLite restricts `PRAGMA`, and reading
+         * the stored DDL is the one probe both adapters can make.
+         */
+        ensureScheduleStateKind() {
+            const row = this.sql
+                .exec(`SELECT sql FROM sqlite_master WHERE type = 'table' AND name = ?`, '_substrat_schedule_state')
+                .toArray()[0];
+            if (!row || scheduleStateHasKind(row.sql))
+                return;
+            // In a transaction, for the reason the kernel constant spells out: create-copy-
+            // drop-rename has two intermediate states and both are unrecoverable on the next
+            // wake. `transactionSync`, not the async one every operation uses — the DO
+            // runtime forbids a manual BEGIN through `sql.exec`, and this body is wholly
+            // synchronous, which is the one case the sync API is for (it commits at the
+            // first await, and there is none). It also has to be sync because the caller is.
+            this.ctx.storage.transactionSync(() => {
+                for (const stmt of splitSqlStatements(SCHEDULE_STATE_REBUILD))
+                    this.sql.exec(stmt);
+            });
         }
         async importDump(tables, destScopeId) {
             // The WHOLE drop-then-replay runs under deferred foreign keys, in one transaction.
@@ -2100,6 +2861,29 @@ export function defineScopeDO(modules, bareOps) {
                 .toArray()) {
                 this.applied.add(`${row.module_id}@${row.version}`);
             }
+            // …and forget that this INSTANCE ever ran a migration pass (#1589). Refreshing
+            // the set above is not enough on its own: `ensureMigrations` memoises its
+            // promise, so a warm DO answers "already migrated" from the cache and never
+            // reads the set again. A restore replays only what the dump carries, so a dump
+            // that omits a module's tables — a world that keeps part of the spine
+            // elsewhere, a targeted repair supplying only the tables being fixed — leaves
+            // them dropped and never rebuilt, and the next operation touching one fails
+            // with a bare `no such table` until an eviction or `retryMigrations` resets the
+            // latch. The pure host has no such memo (it re-reads `appliedMigrations` on
+            // every pass), so this is the line that makes the two adapters agree; without
+            // it the divergence is invisible to dev, CI and self-host, which is the #969
+            // class exactly. Same two fields `retryMigrations` clears, for the same reason:
+            // the next pass has to be a fresh one. Already-journaled versions are skipped
+            // by the `applied` set and the in-transaction re-check, so a dump that DID
+            // carry its tables re-applies nothing.
+            //
+            // `schemaVersionReported` is deliberately left set, as `retryMigrations` leaves
+            // it. `migrate()` reports only when a pass APPLIED something, and a pass that
+            // applies after this reset ends with every code-defined migration journaled —
+            // the same `applied.size` the first pass already reported. A dump whose frontier
+            // is complete applies nothing, so there is nothing to report either way.
+            this.migrationPromise = undefined;
+            this.lastFailure = null;
         }
         /**
          * Re-point scope-level tuples at the scope they now live in.
@@ -2161,12 +2945,23 @@ export function defineScopeDO(modules, bareOps) {
          * and transaction facts remain". A timeline still shows that something happened, to
          * what, and when; it no longer shows who, or what was said about them.
          *
+         * **Two tables, one verb (#1600).** The outbox is not the only place the spine holds
+         * an event's payload: this host is the CP-less one, so every connector delivery it
+         * cannot run becomes a `connector:<provider>` intent carrying the whole event, and
+         * nothing ever deletes those rows. Redacting one table and not the other left the
+         * name in the live database and in every copy taken from it afterwards. One RPC
+         * rather than two for `routeExecutorEventToPlatform`'s reason — a crash cannot land
+         * half an erasure — and both halves are idempotent anyway, so a retry converges.
+         *
          * This is the one sanctioned write that mutates the outbox. It is kernel code, not
          * module code, and an erasure request is precisely the case the append-only rule has
          * to yield to — the alternative is telling a data subject that the spine's convenience
          * outranks their Article 17 right.
          */
         async redactSubject(subjectId) {
+            // One instant for the whole erasure — the intent tombstones must not disagree with
+            // each other about when a person was erased.
+            const at = new Date().toISOString();
             const doomed = this.sql
                 .exec(`SELECT id FROM _substrat_outbox
               WHERE subject_id = ? AND pii_class != 'none' AND payload IS NOT NULL`, subjectId)
@@ -2174,7 +2969,30 @@ export function defineScopeDO(modules, bareOps) {
             for (const id of doomed) {
                 this.sql.exec('UPDATE _substrat_outbox SET payload = NULL WHERE id = ?', id);
             }
-            return doomed.length;
+            return { events: doomed.length, intents: this.redactSubjectIntents(subjectId, at) };
+        }
+        /**
+         * The intent-journal half of `redactSubject` (#1600) — the SQLite adapter's twin.
+         *
+         * Row-by-row rather than one `UPDATE … WHERE`, because the decision is structural and
+         * SQL cannot make it: an intent payload is opaque JSON with no `pii_class` column to
+         * test, so the SQL narrows to rows that could possibly match and the kernel predicate
+         * decides. Query, predicate and statement all come from the kernel, so this adapter
+         * and the pure one cannot drift about what a redacted intent is.
+         */
+        redactSubjectIntents(subjectId, at) {
+            const q = platformRequestRedactionQuery(subjectId);
+            const candidates = this.sql
+                .exec(q.sql, ...q.params)
+                .toArray();
+            let redacted = 0;
+            for (const row of candidates) {
+                if (!intentPayloadCarriesSubject(row.payload, subjectId))
+                    continue;
+                this.sql.exec(PLATFORM_REQUEST_REDACTION_SQL, ...platformRequestRedactionParams(row.id, subjectId, at));
+                redacted += 1;
+            }
+            return redacted;
         }
         // -- event dispatch (port of dispatch) ------------------------------------
         /**
@@ -2200,7 +3018,13 @@ export function defineScopeDO(modules, bareOps) {
          * later alarm-driven drain with a call it had nothing to do with.
          */
         invocationId = null;
-        async dispatch(tenantId, scopeId) {
+        async dispatch(tenantId, scopeId, 
+        /**
+         * #1525: the call this drain is running in, or null. Every round of the loop
+         * belongs to it: a consumer's own emit is delivered in the same tail, so the
+         * whole cascade is one call's work.
+         */
+        invocationId) {
             for (let round = 0; round < 50; round++) {
                 let deliveredAny = false;
                 for (const mod of this.modules.values()) {
@@ -2215,7 +3039,21 @@ export function defineScopeDO(modules, bareOps) {
                  ORDER BY o.id`, consumer.eventType, mod.id)
                             .toArray();
                         for (const row of rows) {
-                            const event = this.parseOutboxRow(row);
+                            let event;
+                            try {
+                                event = domainEventOf(row);
+                            }
+                            catch (err) {
+                                // #1636: dead-letter an event that does not decode, exactly as a failed
+                                // handler is — the decode sat ABOVE the `try` below, so one bad row halted
+                                // every event of this type behind it, on every pass. The consumer is never
+                                // handed it: an event built from stand-ins is not one it may act on. Only
+                                // the decode is caught; the journal write is not.
+                                this.sql.exec(`INSERT INTO _substrat_deliveries
+                     (event_id, consumer_module, delivered_at, error, invocation_id)
+                   VALUES (?, ?, ?, ?, ?)`, row.id, mod.id, new Date().toISOString(), String(err), invocationId);
+                                continue;
+                            }
                             // #1237: anything this consumer emits was emitted BECAUSE of this event
                             // — the step a backwards walk used to stop dead at, since a consumer
                             // emit records no operation either.
@@ -2226,16 +3064,18 @@ export function defineScopeDO(modules, bareOps) {
                                         system: mod.id,
                                     });
                                     await consumer.handler(ctx, event);
-                                    this.sql.exec(`INSERT INTO _substrat_deliveries (event_id, consumer_module, delivered_at)
-                     VALUES (?, ?, ?)`, event.id, mod.id, new Date().toISOString());
+                                    this.sql.exec(`INSERT INTO _substrat_deliveries
+                       (event_id, consumer_module, delivered_at, invocation_id)
+                     VALUES (?, ?, ?, ?)`, event.id, mod.id, new Date().toISOString(), invocationId);
                                 });
                                 deliveredAny = true;
                             }
                             catch (err) {
                                 // Dead-letter (v0): journal the failure so one poison event
                                 // can't wedge the loop. Written outside the rolled-back txn.
-                                this.sql.exec(`INSERT INTO _substrat_deliveries (event_id, consumer_module, delivered_at, error)
-                   VALUES (?, ?, ?, ?)`, event.id, mod.id, new Date().toISOString(), String(err));
+                                this.sql.exec(`INSERT INTO _substrat_deliveries
+                     (event_id, consumer_module, delivered_at, error, invocation_id)
+                   VALUES (?, ?, ?, ?, ?)`, event.id, mod.id, new Date().toISOString(), String(err), invocationId);
                             }
                             finally {
                                 // Cleared on BOTH paths. Left set, the id leaks onto every later emit
@@ -2257,43 +3097,40 @@ export function defineScopeDO(modules, bareOps) {
          * survives — the whole point, since the denial is the write the operation could not make.
          */
         /** K-42: the session a refused call ran under travels with the denial row. */
-        recordDenial(subject, tenantId, operation, err, impersonation) {
+        recordDenial(subject, tenantId, operation, err, 
+        /**
+         * #1525: the invocation this refusal belongs to, or null — PASSED, never read off
+         * `this.invocationId` here.
+         *
+         * Reading the ambient field is only self-evidently right where one call holds the
+         * DO to itself, and two denial paths do not: `attachmentList` and
+         * `attachmentAuthorize` run OUTSIDE `this.queue`, and both await before they
+         * record (`ensureMigrations`, `ctx.check`). Whether the input gate can actually
+         * reopen far enough for one of them to observe an in-flight call's id is NOT
+         * settled here — a probe that raced twelve attachment refusals against invokes
+         * holding an id (including one awaiting the control plane) recorded null every
+         * time, so the gate evidently holds more than the shape of the code promises.
+         *
+         * Passed anyway, because the argument for the ambient read is an argument about
+         * workerd's gate semantics, and the argument for a parameter is local: the invoke
+         * path passes its own id, every attachment path passes null, and each says what it
+         * actually knows. That is the property worth having on a recorded fact, and it
+         * costs one argument. No test accompanies it — the condition could not be
+         * reproduced, and a test that passes either way would be worse than none.
+         */
+        invocationId, impersonation) {
             // Only an ENFORCED denial (assertAllowed, which attaches the checked permission +
             // node) is recorded. A module's own hand-thrown `new PermissionDenied('…')` carries
             // no permission key and is left to the module.
             if (!err.permission || !err.node)
                 return;
-            const actor = subject.kind === 'system'
-                ? { system: subject.id }
-                : subject.kind === 'connection'
-                    ? { connection: subject.id }
-                    : subject.id;
+            const actor = actorOf(subject);
             this.sql.exec(`INSERT INTO _substrat_denials
-           (id, actor, permission, tenant_id, scope_id, operation, impersonation, at)
-         VALUES (?, ?, ?, ?, ?, ?, ?, ?)`, ulid(), JSON.stringify(actor), err.permission, err.node.tenantId, err.node.scopeId ?? null, operation, impersonation ? JSON.stringify(impersonationStampOf(impersonation)) : null, new Date().toISOString());
-        }
-        parseOutboxRow(row) {
-            return domainEvent.parse({
-                id: row.id,
-                type: row.type,
-                schemaVersion: row.schema_version,
-                occurredAt: row.occurred_at,
-                tenantId: row.tenant_id,
-                scopeId: row.scope_id,
-                actor: JSON.parse(row.actor),
-                entity: { entityType: row.entity_type, entityId: row.entity_id },
-                piiClass: row.pii_class,
-                ...(row.subject_id ? { subjectId: row.subject_id } : {}),
-                ...(row.authorization ? { authorization: JSON.parse(row.authorization) } : {}),
-                // K-42: the stamp survives the read, so a consumer's event and an executor's
-                // are the same fact the stored row is. Absent rather than null when nobody
-                // was impersonating, because `DomainEvent.impersonation` is optional — the
-                // shape module code never sees is also the shape it cannot branch on.
-                ...(row.impersonation ? { impersonation: JSON.parse(row.impersonation) } : {}),
-                // #1231: absent rather than null, the same shape rule as the stamp above.
-                ...(row.operation ? { operation: row.operation } : {}),
-                payload: row.payload === null ? undefined : JSON.parse(row.payload),
-            });
+           (id, actor, permission, tenant_id, scope_id, operation, impersonation,
+            invocation_id, at)
+         VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?)`, ulid(), JSON.stringify(actor), err.permission, err.node.tenantId, err.node.scopeId ?? null, operation, impersonation ? JSON.stringify(impersonationStampOf(impersonation)) : null, 
+            // #1525: the call this refusal belongs to, as the caller named it.
+            invocationId, new Date().toISOString());
         }
         // -- operation context (port of operationContext) -------------------------
         operationContext(principal, tenantId, scopeId, systemActor, connectionId, systemModuleId, 
@@ -2312,7 +3149,28 @@ export function defineScopeDO(modules, bareOps) {
          * onto every event it emits. Absent for consumer dispatch: a consumer runs on
          * behalf of no operation, and the emitted row's NULL says so.
          */
-        operation) {
+        operation, 
+        /**
+         * #1672: set when the caller holds a CAPABILITY session — already resolved from its
+         * hash inside the queued body, before the transaction. Mutually exclusive with
+         * `connectionId` and `systemModuleId`; `principal` is then a placeholder that the
+         * subject below never reads.
+         */
+        capabilityId, 
+        /**
+         * #1672: the secrets `ctx.capabilities.mint` hands out during this invocation. The
+         * caller owns the array (it withholds them from the idempotency recording); this
+         * context appends to it and holds `ctx.sql`, `ctx.emit` and `ctx.requestPlatform` to
+         * it — the tripwire that catches a module persisting one by accident (not a boundary
+         * against one that means to; see `assertNoSecret`).
+         */
+        minted = [], 
+        /**
+         * #1672: the instant to stamp, when the caller already read one. The exchange passes
+         * the instant its row write used, so the `capability.exercised` event's `occurredAt`
+         * and the row's `last_used_at` are the same value — a second read could disagree.
+         */
+        instantOverride) {
             const checker = this.checker;
             const relations = this.relations;
             const searchPlans = this.searchPlans;
@@ -2326,20 +3184,18 @@ export function defineScopeDO(modules, bareOps) {
              * on, and it holds identically here: `ctx.now()`, every `occurredAt` and
              * every `requested_at` in one operation are the same value.
              */
-            const at = instant.parse(new Date().toISOString());
+            const at = instantOverride ?? instant.parse(new Date().toISOString());
             // The permission subject and the derived event actor for a NON-override caller
             // (#383/#97): a scheduled module, a connection, or a person. `systemActor` (the
             // override, used only by consumer dispatch) stays a separate bypass path below.
-            const subject = systemModuleId
-                ? { kind: 'system', id: systemModuleId }
-                : connectionId
-                    ? { kind: 'connection', id: connectionId }
-                    : { kind: 'principal', id: principal };
-            const derivedActor = subject.kind === 'system'
-                ? { system: subject.id }
-                : subject.kind === 'connection'
-                    ? { connection: subject.id }
-                    : principal;
+            const subject = capabilityId
+                ? { kind: 'capability', id: capabilityId }
+                : systemModuleId
+                    ? { kind: 'system', id: systemModuleId }
+                    : connectionId
+                        ? { kind: 'connection', id: connectionId }
+                        : { kind: 'principal', id: principal };
+            const derivedActor = actorOf(subject);
             // #304: entitlement reads pick the same local-vs-RPC reader the permission checker
             // uses (projected scope → local table; console-managed → CP over RPC), resolved per
             // call so a scope that flips to 'local' is picked up without rebuilding the context.
@@ -2368,7 +3224,10 @@ export function defineScopeDO(modules, bareOps) {
             // Lifted so `grant` reuses the SAME check the operation itself passes —
             // a delegation check that could differ from the operation's would be a
             // second opinion about what the caller holds.
-            const runCheck = async (permission, entity) => {
+            const runCheck = async (unparsed, entity) => {
+                // #1642: parsed before the system actor's early return, which never reaches
+                // the checker — a cast key would otherwise become that path's proof relation.
+                const permission = assertPermissionKey(unparsed);
                 if (systemActor) {
                     return {
                         allowed: true,
@@ -2403,15 +3262,19 @@ export function defineScopeDO(modules, bareOps) {
                 }
                 return checker.covers(subject, role.permissions, { tenantId, scopeId });
             };
-            return {
+            const ctxRef = {
                 tenantId,
                 scopeId,
-                principal,
-                sql: doScopedSql(sql),
+                // #1672: a capability's own id stands in so the type holds — it is not a person, and
+                // the event actor says what it is instead. Every other door passes its own value.
+                principal: capabilityId ? capabilityId : principal,
+                sql: guardSecrets(doScopedSql(sql), minted),
                 now: () => at,
                 emit: (event) => {
                     assertImpersonationWrites(impersonation, 'ctx.emit');
                     const parsed = domainEventInput.parse(event);
+                    // #1672: the COMPLETE parsed event — entity id, type and subject as well as payload.
+                    assertNoSecret('ctx.emit', parsed, minted);
                     const full = domainEvent.parse({
                         ...parsed,
                         // #956: from the operation's instant, not a second reading of the clock.
@@ -2448,6 +3311,8 @@ export function defineScopeDO(modules, bareOps) {
                 requestPlatform: (request) => {
                     assertImpersonationWrites(impersonation, 'ctx.requestPlatform');
                     const input = platformRequestInput.parse(request);
+                    // #1672: the COMPLETE parsed request — its `kind` is persisted as surely as its payload.
+                    assertNoSecret('ctx.requestPlatform', input, minted);
                     // #1474: a platform-authored kind (`sweep-runs`) never comes from module code —
                     // the sweeper enqueues it through `enqueueSweepRuns`, which does not pass here.
                     assertModuleEnqueueableKind(input.kind);
@@ -2472,7 +3337,9 @@ export function defineScopeDO(modules, bareOps) {
                 // predicate is needed or possible: the DO IS the scope.
                 platformRequests: (filter) => {
                     const q = platformRequestHistoryQuery(filter);
-                    return sql.exec(q.sql, ...q.params).toArray().map(rowToPlatformRequest);
+                    // The kernel's decoder, the one the coordinator maps the RPC's rows with (#1588):
+                    // tolerant, so one undecodable row cannot hide this scope's other intents from it.
+                    return sql.exec(q.sql, ...q.params).toArray().map(platformRequestOf);
                 },
                 // #901. Mirror of the pure adapter, and the reason the contract suite
                 // runs on both: the query is ordinary SQL, but it is only a seek rather
@@ -2551,6 +3418,22 @@ export function defineScopeDO(modules, bareOps) {
                     sql.exec(`DELETE FROM _substrat_tuples WHERE subject = ? AND relation = ? AND object = ?`, `principal:${principal}`, `granted:${permission}`, `${entity.entityType}:${entity.entityId}`);
                 },
                 atomic: createAtomic(runSub, { passed, signals }),
+                // #1672: mint / revoke / list, written once in the kernel — the pure adapter hands
+                // the same function the same four things. The raw spine seam (the kernel's own write
+                // to `_substrat_capabilities`), the operation's OWN check, and `ctx.emit`. A
+                // consumer's override actor is passed as the system actor it is, so a consumer
+                // cannot mint: its checks allow unconditionally, which would make "the minter holds
+                // it" vacuous.
+                capabilities: createCapabilityVerbs({
+                    sql: doSpineSql(sql),
+                    subject: systemActor ? { kind: 'system', id: systemActor.system } : subject,
+                    now: at,
+                    check: runCheck,
+                    emit: (event) => ctxRef.emit(event),
+                    isOperation: (name) => this.operations.has(name),
+                    assertWrites: (verb) => assertImpersonationWrites(impersonation, verb),
+                    minted,
+                }),
                 link: (child, parent) => {
                     assertImpersonationWrites(impersonation, 'ctx.link');
                     const allowed = relations.get(child.entityType);
@@ -2584,6 +3467,7 @@ export function defineScopeDO(modules, bareOps) {
                     return sealTo({ keyId: row.key_id, publicKey: row.public_key }, plaintext);
                 },
             };
+            return ctxRef;
         }
         /** True once this scope has had entitlements projected at least once (#304) — the switch
          *  from trust-upstream to strict fail-closed entitlement enforcement on the local path. */
@@ -2686,11 +3570,16 @@ export function defineScopeDO(modules, bareOps) {
          *  while passing a list — even `[]` — full-replaces them. This keeps pre-#304 callers
          *  from silently wiping a scope's entitlements. */
         entitlements, 
-        /** Scope-level tuples (e.g. the owner's role grant at provision) upserted into
+        /** Scope-level tuples (e.g. the owner's role grant at provision) seated into
          *  `_substrat_tuples` in this SAME transaction, additively (#332). Preserve-on-undefined:
          *  omitting it leaves existing scope tuples untouched, so a role-only re-projection keeps
          *  the owner grant. Passing them here (rather than a follow-up `writeTuple`) is what makes
-         *  provision atomic — the grant and the enforcement flip land together or not at all. */
+         *  provision atomic — the grant and the enforcement flip land together or not at all.
+         *
+         *  Seated, not replaced (#1659): a missing tuple is created, a revoked one stays revoked.
+         *  `lockout_reseat` marks the one exception — the owner-of-record's seat, which is
+         *  re-seated even over a revoke when the scope would otherwise hold no effective role
+         *  grant (`hasEffectiveRoleGrant`). */
         scopeTuples, 
         /** The tenant's identity links (#406) — projected alongside the rest so a CP-less
          *  vertical's auth adapter resolves logins locally. Same preserve-on-undefined
@@ -2765,18 +3654,39 @@ export function defineScopeDO(modules, bareOps) {
                 // — NOT a full replace — so existing scope tuples are preserved. This is what keeps a
                 // scope from ever being left "roles projected, permission_source=local, zero tuples" by
                 // a write that lands the projection but drops before a follow-up owner grant.
+                //
+                // #1659: SEATED, so a reconcile creates what is missing and leaves a revoke alone. It
+                // used to be `INSERT OR REPLACE … revoked_at = NULL`, which undid an operator's revoke
+                // of the owner seat or of a `system:` schedule grant on the next reconcile. And a
+                // module switched off (#1666) gets no `system:` grant seated, new or old.
                 for (const st of scopeTuples ?? []) {
-                    this.sql.exec(`INSERT OR REPLACE INTO _substrat_tuples (subject, relation, object, expires_at, revoked_at)
-             VALUES (?, ?, ?, ?, NULL)`, st.subject, st.relation, st.object, st.expires_at);
+                    const seat = seatScopeTuple(st.subject, st.relation, st.object, st.expires_at);
+                    this.sql.exec(seat.sql, ...seat.params);
+                }
+                // #1659's one exception: the owner-of-record's seat comes back over a revoke when
+                // NOTHING else would let anyone act here — roles projected, no effective role grant.
+                // That is the #332 lockout this path exists to repair, and it is decided by the same
+                // predicate as the flip guard below, so "locked out" means one thing in this unit.
+                // With any other effective holder, the revoke stands: a hand-over that seats a
+                // successor before unseating the owner is not undone by the next promote. A holder of
+                // a role the vertical no longer defines is NOT one — it passes no check, so it must
+                // not stand in for the holder this repair exists to restore.
+                if (roles.length > 0 && !this.hasEffectiveRoleGrant(tenantId)) {
+                    for (const st of scopeTuples ?? []) {
+                        if (!st.lockout_reseat)
+                            continue;
+                        this.sql.exec(`INSERT OR REPLACE INTO _substrat_tuples (subject, relation, object, expires_at, revoked_at)
+               VALUES (?, ?, ?, ?, NULL)`, st.subject, st.relation, st.object, st.expires_at);
+                    }
                 }
                 // #332: only switch on strict local enforcement when SOMEONE actually holds a role.
-                // A projection that leaves role definitions but no live principal→role grant would make
-                // every check fail closed — a scope serving nothing but denials, unfixable from inside.
-                // Leave `permission_source` as-is instead; a reconcile that restores the owner grant
-                // re-runs this and flips safely. (A CP-less vertical uses the local reader regardless of
-                // this flag, so the owner grant is written above in the same unit — this guard is the
-                // belt to that suspenders, and it protects the CP-backed flip outright.)
-                if (roles.length > 0 && !this.hasLiveRoleGrant(tenantId))
+                // A projection that leaves role definitions but no effective principal→role grant would
+                // make every check fail closed — a scope serving nothing but denials, unfixable from
+                // inside. Leave `permission_source` as-is instead; a reconcile that restores the owner
+                // grant re-runs this and flips safely. (A CP-less vertical uses the local reader
+                // regardless of this flag, so the owner grant is written above in the same unit — this
+                // guard is the belt to that suspenders, and it protects the CP-backed flip outright.)
+                if (roles.length > 0 && !this.hasEffectiveRoleGrant(tenantId))
                     return;
                 this.sql.exec(`INSERT OR REPLACE INTO _substrat_meta (key, value) VALUES ('permission_source', 'local')`);
             });
@@ -2797,23 +3707,17 @@ export function defineScopeDO(modules, bareOps) {
                 return undefined;
             return { principal: row.principal_id, scopeId: row.scope_id };
         }
-        /** True if any live (non-revoked, unexpired) principal→role grant exists for this tenant,
-         *  at scope OR tenant level — the precondition for switching on strict local enforcement so a
-         *  projection never enables fail-closed evaluation against an empty tuple table (#332). */
-        hasLiveRoleGrant(tenantId) {
-            const now = new Date().toISOString();
-            const scope = this.sql
-                .exec(`SELECT 1 FROM _substrat_tuples
-           WHERE relation LIKE 'role:%' AND revoked_at IS NULL AND (expires_at IS NULL OR expires_at > ?)
-           LIMIT 1`, now)
-                .toArray();
-            if (scope.length > 0)
-                return true;
-            return (this.sql
-                .exec(`SELECT 1 FROM _substrat_tenant_tuples
-             WHERE tenant_id = ? AND relation LIKE 'role:%' AND revoked_at IS NULL AND (expires_at IS NULL OR expires_at > ?)
-             LIMIT 1`, tenantId, now)
-                .toArray().length > 0);
+        /** True if some principal holds a role this scope can actually EXPAND — a live
+         *  (non-revoked, unexpired) `role:<key>` tuple, at scope OR tenant level, whose key names a
+         *  current, non-revoked role definition for this tenant. The one predicate behind both the
+         *  #332 flip guard and #1659's owner re-seat in `applyProjection`; the query is the
+         *  kernel's `effectiveRoleGrantQuery`, where it is tested against a real SQLite. A tuple
+         *  for a role the vertical no longer defines counts for nothing, exactly as in the local
+         *  checker, which expands a role only through its definition. */
+        hasEffectiveRoleGrant(tenantId) {
+            const q = effectiveRoleGrantQuery(tenantId, new Date().toISOString());
+            const row = this.sql.exec(q.sql, ...q.params).toArray()[0];
+            return row?.effective === 1;
         }
     };
 }