@substrat-run/adapter-cloudflare 0.116.0 → 0.117.0

package/dist/scope-do.js

@@ -1,10 +1,10 @@
 import { DurableObject } from 'cloudflare:workers';
-import { ATTACHMENT_ADDED, ATTACHMENT_REMOVED, attachmentRecord, domainEvent, domainEventInput, eventId, instant, objectRef, toWireFailure, grantRefFromProof, principalId, scopeId as scopeIdOf, tenantId as tenantIdOf, platformRequestInput, platformRequestId, MAX_PENDING_PLATFORM_REQUESTS, MAX_PENDING_SWEEP_RUNS, SWEEP_RUNS_KIND, platformRequest, SCOPE_TABLE_PAGE_MAX, SCOPE_QUERY_ROW_MAX, listLimitOf, requestFingerprint, substratError, assertReplayableDump, REDRAIN_BATCH, } from '@substrat-run/contracts';
-import { ulid, createUlid, assertAllowed, ConnectionSealingKeyUnavailableError, noSealingKeyMessage, sealTo, assertReadOnlyQuery, entitlementDenial, platformRequestHistoryQuery, PLATFORM_REQUEST_COLUMNS, denialListQuery, denialSummaryQuery, denialTotalsQuery, DENIAL_WINDOW_QUERY, mapDenialRow, mapDenialSummaryBuckets, PermissionDenied, assertImpersonationWrites, assertModuleEnqueueableKind, impersonationStampOf, createAtomic, NotSearchable, isSearchIndexTable, searchIndexDdl, searchIndexMigrations, searchIndexPlans, NotListable, listIndexMigrations, listIndexPlans, listQuery, cursorOf, searchLimit, searchMatchExpression, searchQuery, IDEMPOTENCY_DDL, assertIdempotencyKey, idempotencyLookupQuery, idempotencyPruneStatement, idempotencyRecordStatement, idempotencyOptedOutMessage, replayFor, entityVersionQuery, entityVersionOf, assertIfMatch, OUTBOX_ENTITY_INDEX, SCHEDULE_STATE_DDL, SCHEDULE_STATE_REBUILD, scheduleStateHasKind, JOB_RUN_DDL, jobRunListLimit, } from '@substrat-run/kernel';
+import { ATTACHMENT_ADDED, ATTACHMENT_REMOVED, attachmentRecord, domainEvent, domainEventInput, eventId, instant, objectRef, toWireFailure, grantRefFromProof, principalId, scopeId as scopeIdOf, tenantId as tenantIdOf, platformRequestInput, platformRequestId, MAX_PENDING_PLATFORM_REQUESTS, MAX_PENDING_SWEEP_RUNS, SWEEP_RUNS_KIND, SCOPE_TABLE_PAGE_MAX, SCOPE_QUERY_ROW_MAX, listLimitOf, requestFingerprint, substratError, assertReplayableDump, REDRAIN_BATCH, } from '@substrat-run/contracts';
+import { ulid, createUlid, assertAllowed, ConnectionSealingKeyUnavailableError, noSealingKeyMessage, sealTo, assertReadOnlyQuery, entitlementDenial, platformRequestHistoryQuery, platformRequestOf, PLATFORM_REQUEST_COLUMNS, PLATFORM_REQUEST_REDACTION_SQL, platformRequestRedactionParams, platformRequestRedactionQuery, intentPayloadCarriesSubject, seatScopeTuple, effectiveRoleGrantQuery, switchSystemSchedules, systemScheduleState, systemSwitchedOff, denialListQuery, denialSummaryQuery, denialTotalsQuery, DENIAL_WINDOW_QUERY, mapDenialRow, mapDenialSummaryBuckets, PermissionDenied, assertImpersonationWrites, assertModuleEnqueueableKind, impersonationStampOf, createAtomic, NotSearchable, isSearchIndexTable, searchIndexDdl, searchIndexMigrations, searchIndexPlans, NotListable, listIndexMigrations, listIndexPlans, listQuery, cursorOf, searchLimit, searchMatchExpression, searchQuery, IDEMPOTENCY_DDL, assertIdempotencyKey, assertPermissionKey, idempotencyLookupQuery, idempotencyPruneStatement, idempotencyRecordStatement, idempotencyOptedOutMessage, replayFor, entityVersionQuery, entityVersionOf, assertIfMatch, OUTBOX_ENTITY_INDEX, SCHEDULE_STATE_DDL, SCHEDULE_STATE_REBUILD, scheduleStateHasKind, JOB_RUN_DDL, jobRunListLimit, } from '@substrat-run/kernel';
 import { isUpgradeRequest, readSubscription, LIVE_FANOUT_LIMIT, LIVE_MODE_HEADER, LIVE_PRINCIPAL_HEADER, LIVE_SCOPE_HEADER, LIVE_SUBSCRIBE_PATH, LIVE_TENANT_HEADER, } from './live-reads.js';
 import { OperationQueue } from './serialization.js';
-import { doScopedSql } from './sql.js';
-import { facetEvents, readDeadLetters, readHistory, readInvocation, walkEventCause, walkEventEffects } from '@substrat-run/kernel';
+import { doScopedSql, doSpineSql } from './sql.js';
+import { actorOf, assertNoSecret, CAPABILITY_DDL, CAPABILITY_EXCHANGE_OPERATION, createCapabilityVerbs, exchangeCapability, guardSecrets, mintBecomeCapability, redactSecrets, resolveCapabilitySession, revokeCapabilityAsPlatform, domainEventOf, facetEvents, readDeadLetters, readHistory, readInvocation, readUndrainedOutbox, walkEventCause, walkEventEffects, } from '@substrat-run/kernel';
 import { createDoTupleChecker, createLocalControlPlaneReader } from './checker.js';
 /**
  * The key marking a scope DO whose storage was destroyed (`destroyStorage`).
@@ -310,6 +310,10 @@ const KERNEL_DDL = `
   ${OUTBOX_ENTITY_INDEX}
   -- #116: the request-dedupe table, kernel-owned so no vertical migrates for it.
   ${IDEMPOTENCY_DDL}
+  -- #1672: capabilities — authority carried by a secret (a link share), and the sessions
+  -- an exchange trades that secret for. Shared with the pure adapter from
+  -- @substrat-run/kernel so the two cannot part company; the column comments are there.
+  ${CAPABILITY_DDL}
 `;
 /**
  * Workers RPC carries a plain `Error`'s MESSAGE faithfully and nothing else. A custom
@@ -368,27 +372,6 @@ function attachSubject(principal, connectionId) {
 function isSystemTable(name) {
     return name.startsWith('_substrat') || name.startsWith('sqlite_');
 }
-/**
- * A stored row → the `PlatformRequest` contract shape (JSON columns parsed). The coordinator
- * maps the RPC's raw rows the same way in `host.ts`; this copy exists because `ctx.platformRequests`
- * (#618) answers INSIDE the DO, where the row never crosses an RPC boundary at all.
- */
-function rowToPlatformRequest(r) {
-    return platformRequest.parse({
-        id: r.id,
-        kind: r.kind,
-        payload: JSON.parse(r.payload),
-        requestedBy: JSON.parse(r.requested_by),
-        impersonation: r.impersonation == null ? null : JSON.parse(r.impersonation),
-        status: r.status,
-        attempts: r.attempts,
-        lastError: r.last_error,
-        failure: r.last_failure == null ? null : JSON.parse(r.last_failure),
-        result: r.result === null ? null : JSON.parse(r.result),
-        requestedAt: r.requested_at,
-        settledAt: r.settled_at,
-    });
-}
 /** SQLite cell → a JSON-safe value: bigints stringify, blobs (ArrayBuffer) read as null. */
 function cellToJson(v) {
     if (v == null)
@@ -709,9 +692,11 @@ export function defineScopeDO(modules, bareOps) {
          * and skips the write when nothing changed.
          *
          * `ensureMigrations` memoises its promise, so every later call on a warm DO
-         * resolves to the SAME `true` without applying anything. Reporting on each of
-         * those would bill a control-plane RPC per stub mint to store a number that
-         * has not moved — hence the once-per-instance latch.
+         * resolves to the SAME `true` without applying anything — until something
+         * clears the memo (`retryMigrations`, `importDump`), which is a fresh pass and
+         * may apply. Reporting on each of the cached ones would bill a control-plane
+         * RPC per stub mint to store a number that has not moved — hence the
+         * once-per-instance latch.
          */
         async migrate() {
             const applied = await this.ensureMigrations();
@@ -767,6 +752,14 @@ export function defineScopeDO(modules, bareOps) {
         migrationFailure() {
             return this.lastFailure ? { ...this.lastFailure, applied: this.applied.size } : null;
         }
+        /**
+         * This scope's database size in bytes (#1524): `SqlStorage.databaseSize`, which Cloudflare
+         * bills on. Its one caller is an on-demand storage reading, never a sweep, because reaching
+         * it wakes this DO.
+         */
+        databaseSize() {
+            return this.sql.databaseSize;
+        }
         /**
          * The PITR bookmarks this scope recorded before migration passes (#286),
          * newest first — what a backout UI offers as rewind points. Rows taken after
@@ -791,26 +784,26 @@ export function defineScopeDO(modules, bareOps) {
             }));
         }
         /**
-         * The events not yet shipped to Tier 2 (#1334), oldest first. `ORDER BY id`
-         * is chronological (ULID) and stable, so a drain resumes where it stopped.
+         * The events not yet shipped to Tier 2 (#1334), oldest first — and what the read
+         * stepped over (#1636). `ORDER BY id` is chronological (ULID) and stable, so a drain
+         * resumes where it stopped.
+         *
+         * The kernel's read, shared with the pure adapter: a row that will not decode is
+         * neither returned nor stamped, and the rows behind it still come back. An object
+         * rather than an array because it crosses the RPC — a property on an array would not.
+         */
+        undrainedEventsRead(limit) {
+            return readUndrainedOutbox((offset, count) => this.sql
+                .exec(`SELECT * FROM _substrat_outbox WHERE drained_at IS NULL ORDER BY id LIMIT ? OFFSET ?`, count, offset)
+                .toArray(), limit);
+        }
+        /**
+         * The same read as a bare array, for a coordinator deployed before
+         * `undrainedEventsRead` (#1636) — kept so that pairing still drains, and still steps
+         * over a bad row rather than stalling on it. It just cannot say that it did.
          */
         undrainedEvents(limit) {
-            const rows = this.sql
-                .exec(`SELECT * FROM _substrat_outbox WHERE drained_at IS NULL ORDER BY id LIMIT ?`, limit)
-                .toArray();
-            return rows.map((r) => ({
-                ...this.parseOutboxRow(r),
-                operation: r.operation ?? null,
-                version: r.version ?? null,
-                // #1237 — lifted like the two above, and for the same reason: the column
-                // exists on the outbox but not on the envelope `parseOutboxRow` returns,
-                // whose `domainEvent.parse` strips anything it does not declare.
-                causedBy: r.caused_by ?? null,
-                // …and the invocation, for the same reason again: a lake that kept cause and
-                // dropped the call could say what set an event off and never which request did
-                // it, which is the grouping a trace is built on.
-                invocationId: r.invocation_id ?? null,
-            }));
+            return this.undrainedEventsRead(limit).events;
         }
         /**
          * Stamp `drained_at` on shipped events (#1334). Idempotent — a re-mark is a no-op,
@@ -1007,13 +1000,30 @@ export function defineScopeDO(modules, bareOps) {
                 return rows.sort((a, b) => a.subject.localeCompare(b.subject) || a.relation.localeCompare(b.relation));
             });
         }
-        /** Admin scope-tuple write (role assignment / grant scoped to this scope). */
+        /**
+         * Admin scope-tuple write (role assignment / grant scoped to this scope) — the
+         * EXPLICIT grant. `INSERT OR REPLACE`, so it clears a tombstone: a re-grant grants.
+         * Provisioning does not come through here; it seats with `seatTuple` (#1659).
+         */
         async writeTuple(subject, relation, object, expiresAt) {
             await this.queue.enqueue(() => {
                 this.sql.exec(`INSERT OR REPLACE INTO _substrat_tuples (subject, relation, object, expires_at)
            VALUES (?, ?, ?, ?)`, subject, relation, object, expiresAt);
             });
         }
+        /**
+         * Provisioning's scope-tuple write (#1659): create the row if it is missing, follow the
+         * platform's expiry if it is live, and leave it alone if it was revoked — so a re-run
+         * provision cannot undo an operator's revoke — and seat nothing at all for a module
+         * whose schedule kill switch is off (#1666). `seatScopeTuple` is the statement, shared
+         * with `applyProjection`'s `scopeTuples` and with the pure adapter.
+         */
+        async seatTuple(subject, relation, object, expiresAt) {
+            await this.queue.enqueue(() => {
+                const seat = seatScopeTuple(subject, relation, object, expiresAt);
+                this.sql.exec(seat.sql, ...seat.params);
+            });
+        }
         /**
          * The dispatch capability's admission (#726 remedy B): this delivery may read the
          * attachments of the entity its own spine row names, and no others.
@@ -1103,19 +1113,28 @@ export function defineScopeDO(modules, bareOps) {
          * this scope; the DO uses it for the two-actor stamp and for the read-only
          * bound, and nothing here can be reached without it having been minted.
          */
-        impersonation) {
+        impersonation, 
+        /**
+         * #1672: the HASH of a capability session token — the coordinator hashed the token
+         * and the plaintext never crosses. Resolved to its capability INSIDE the queued body,
+         * on every call, so a revoke between two calls refuses the second. `principal` is
+         * then a random placeholder that holds nothing, and the reply carries
+         * `capability.honoured`: an old DO that ignored this argument would run the call as
+         * that placeholder, and the coordinator refuses a success without the acknowledgement.
+         */
+        capabilitySession) {
             if (!failureEnvelope) {
                 // Legacy path, byte-for-byte what it was: rewrapped so a non-plain error (a
                 // ZodError, whose `message` is a getter) still arrives with its message.
                 try {
-                    return await this.invokeOrThrow(operation, input, principal, tenantId, scopeId, connectionId, requiredEntitlement, systemModuleId, invokeOptions, impersonation);
+                    return await this.invokeOrThrow(operation, input, principal, tenantId, scopeId, connectionId, requiredEntitlement, systemModuleId, invokeOptions, impersonation, capabilitySession);
                 }
                 catch (err) {
                     throw toRpcError(err);
                 }
             }
             try {
-                return await this.invokeOrThrow(operation, input, principal, tenantId, scopeId, connectionId, requiredEntitlement, systemModuleId, invokeOptions, impersonation);
+                return await this.invokeOrThrow(operation, input, principal, tenantId, scopeId, connectionId, requiredEntitlement, systemModuleId, invokeOptions, impersonation, capabilitySession);
             }
             catch (err) {
                 // The ONE place the error keeps its structure: flattened here, rebuilt by the
@@ -1127,7 +1146,9 @@ export function defineScopeDO(modules, bareOps) {
         /** The operation path itself. Throws; `invoke` decides how that reaches the caller. */
         async invokeOrThrow(operation, input, principal, tenantId, scopeId, connectionId, requiredEntitlement, systemModuleId, invokeOptions, 
         /** K-42: the session, resolved coordinator-side. See `invoke` above. */
-        impersonation) {
+        impersonation, 
+        /** #1672: a capability session's hash. See `invoke` above. */
+        capabilitySession) {
             await this.ensureMigrations();
             const handler = this.operations.get(operation);
             // `not_found`, not a bare throw (#113): every vertical hand-matched this message
@@ -1186,7 +1207,7 @@ export function defineScopeDO(modules, bareOps) {
             // The subject a key is scoped to — the same three-way read `recordDenial`
             // makes below, hoisted because both need it. A key belongs to whoever sent
             // it: two principals choosing `1` must not reach each other's response.
-            const idempotencySubjectRef = systemModuleId
+            let idempotencySubjectRef = systemModuleId
                 ? { kind: 'system', id: systemModuleId }
                 : connectionId
                     ? { kind: 'connection', id: connectionId }
@@ -1210,6 +1231,19 @@ export function defineScopeDO(modules, bareOps) {
                 // one call. Same placement as the SQLite adapter's actor task, for this reason.
                 this.invocationId = invokeOptions?.invocationId ?? null;
                 try {
+                    // #1672: the capability session, resolved on EVERY call and here — inside the queued
+                    // body, the one region where this call holds the DO to itself — so nothing can
+                    // revoke between this read and the transaction. Refuses a stale session, a revoked
+                    // or expired capability and an operation off its allowlist before anything opens;
+                    // none of those is a K-35 denial (no key was checked).
+                    let capabilityId;
+                    if (capabilitySession !== undefined) {
+                        capabilityId = resolveCapabilitySession(doSpineSql(this.sql), capabilitySession, instant.parse(new Date().toISOString()), operation);
+                        idempotencySubjectRef = { kind: 'capability', id: capabilityId };
+                    }
+                    // #1672: the secrets this call mints — withheld from its idempotency recording, and
+                    // what the tripwire on its writes looks for.
+                    const minted = [];
                     /**
                      * #938: the outbox's high-water mark BEFORE this call wrote anything, so the
                      * post-commit fan-out can name exactly the events this call (and the consumers
@@ -1252,7 +1286,7 @@ export function defineScopeDO(modules, bareOps) {
                     // emitted events back as one — verified across `await` in workerd.
                     try {
                         await this.ctx.storage.transaction(async () => {
-                            const ctx = this.operationContext(principal, tenantId, scopeId, undefined, connectionId, systemModuleId, signals, impersonation, operation);
+                            const ctx = this.operationContext(principal, tenantId, scopeId, undefined, connectionId, systemModuleId, signals, impersonation, operation, capabilityId, minted);
                             // #116: a retry is answered from the recording, and nothing else runs
                             // — not the guards, not the handler, not the permission check inside
                             // it. Keyed by SUBJECT, so a caller only ever reaches its own
@@ -1293,7 +1327,9 @@ export function defineScopeDO(modules, bareOps) {
                             // it describes. The prune rides along, on the only path that adds a row.
                             if (idempotencyKey !== undefined && fingerprint !== undefined) {
                                 const at = new Date().toISOString();
-                                const record = idempotencyRecordStatement(idempotencySubjectRef, idempotencyKey, operation, fingerprint, result, committedVersion, at);
+                                const record = idempotencyRecordStatement(idempotencySubjectRef, idempotencyKey, operation, fingerprint, 
+                                // #1672: a replay of a mint returns the placeholder, never the secret.
+                                redactSecrets(result, minted), committedVersion, at);
                                 this.sql.exec(record.sql, ...record.params);
                                 const prune = idempotencyPruneStatement(at);
                                 this.sql.exec(prune.sql, ...prune.params);
@@ -1316,6 +1352,7 @@ export function defineScopeDO(modules, bareOps) {
                                 result,
                                 platformRequests: 0,
                                 impersonation: { honoured: true },
+                                ...(capabilitySession !== undefined ? { capability: { honoured: true } } : {}),
                                 ...(idempotencyKey !== undefined
                                     ? { idempotency: { keyHonoured: true, replayed } }
                                     : {}),
@@ -1332,11 +1369,9 @@ export function defineScopeDO(modules, bareOps) {
                         // K-35: the transaction has rolled back; record a refused check now, as its own
                         // write (outside that transaction), so the denial survives the rollback.
                         if (err instanceof PermissionDenied) {
-                            this.recordDenial(systemModuleId
-                                ? { kind: 'system', id: systemModuleId }
-                                : connectionId
-                                    ? { kind: 'connection', id: connectionId }
-                                    : { kind: 'principal', id: principal }, tenantId, operation, err, 
+                            this.recordDenial(
+                            // The subject the call acted as — the capability's, once resolved above.
+                            idempotencySubjectRef, tenantId, operation, err, 
                             // Inside the queued body, which is the one region where this call holds
                             // the DO to itself — so the field is this call's own (#1237).
                             this.invocationId, impersonation);
@@ -1362,6 +1397,8 @@ export function defineScopeDO(modules, bareOps) {
                         result,
                         platformRequests: signals.platformRequests,
                         ...(impersonation ? { impersonation: { honoured: true } } : {}),
+                        // #1672: the acknowledgement the coordinator's skew check reads — see `invoke`.
+                        ...(capabilitySession !== undefined ? { capability: { honoured: true } } : {}),
                         // The acknowledgement the coordinator's skew check reads (#116), on the
                         // same reasoning as `ifMatchChecked` below and with a sharper failure: a
                         // DO too old to know about keys would EXECUTE THE OPERATION AGAIN and
@@ -1841,19 +1878,106 @@ export function defineScopeDO(modules, bareOps) {
                 return record;
             });
         }
+        /** The kernel's schedule-switch SQL (#1666), over this DO's storage. */
+        switchSql() {
+            return {
+                all: (sql, ...params) => this.sql.exec(sql, ...params).toArray(),
+                run: (sql, ...params) => {
+                    this.sql.exec(sql, ...params);
+                },
+            };
+        }
         /**
-         * Whether this scope holds a live `system:<moduleId>` grant (#383) — the switch
-         * that decides if a module's schedules run here at all. Absent on a foreign
-         * vertical's scope, or after a per-tenant revoke, so the sweep skips it quietly.
+         * Where a module's schedules stand on this scope (#383, #1666) — the kernel's
+         * `systemScheduleState`, the predicate the pure adapter runs too: `on` with a live
+         * `system:<moduleId>` grant, `off` while the kill switch's marker is live, whatever
+         * else is, and `ungranted` on a scope that never ran the module (a foreign vertical's,
+         * which the sweep skips quietly).
+         */
+        async systemScheduleState(moduleId) {
+            return systemScheduleState(this.switchSql(), moduleId, new Date().toISOString());
+        }
+        /**
+         * The pre-#1666 read, kept for ONE reason: a coordinator a deploy behind this DO still
+         * calls it. It answers the new question, not the old one — the old predicate counted any
+         * live `system:` tuple, and the kill switch's OFF marker is one, so an old coordinator
+         * asking the old question would run a switched-off scope's schedules.
          */
         async hasSystemGrant(moduleId) {
-            const now = new Date().toISOString();
-            const row = this.sql
-                .exec(`SELECT 1 FROM _substrat_tuples
-            WHERE subject = ? AND revoked_at IS NULL AND (expires_at IS NULL OR expires_at > ?)
-            LIMIT 1`, `system:${moduleId}`, now)
-                .toArray()[0];
-            return row !== undefined;
+            return (await this.systemScheduleState(moduleId)) === 'on';
+        }
+        /**
+         * `grantToSystem`'s scope-level write (#1666): the explicit grant — `INSERT OR REPLACE`,
+         * as `writeTuple` — EXCEPT while the module's schedule kill switch is off, when it writes
+         * nothing and answers `false`. The check and the write are one queued unit, so no switch
+         * can move between them. Restore is the lever; a grant is not.
+         */
+        async writeSystemGrant(moduleId, relation, object, expiresAt) {
+            return this.queue.enqueue(() => {
+                if (systemSwitchedOff(this.switchSql(), moduleId))
+                    return false;
+                this.sql.exec(`INSERT OR REPLACE INTO _substrat_tuples (subject, relation, object, expires_at)
+           VALUES (?, ?, ?, ?)`, `system:${moduleId}`, relation, object, expiresAt);
+                return true;
+            });
+        }
+        /**
+         * Move a module's schedule switch on this scope (#1666) — the kernel's
+         * `switchSystemSchedules`, serialized on the queue with every other tuple write and run
+         * as one `transactionSync`, so its reads and writes are one unit.
+         */
+        async switchSystemSchedules(moduleId, scopeId, to, at) {
+            return this.queue.enqueue(() => this.ctx.storage.transactionSync(() => switchSystemSchedules(this.switchSql(), { moduleId, scopeId, to, at })));
+        }
+        /**
+         * The exchange (#1672) — a capability's secret traded for a session, or for the
+         * principal a `become` capability yields. Runs the kernel's `exchangeCapability`, the
+         * function the pure adapter runs, in this DO: one queued body and one storage
+         * transaction, so the use it takes and the `capability.exercised` event recording it
+         * commit together or not at all; the event's consumers then settle as an invoke's do.
+         *
+         * The secret itself reaches this DO — it must, to be hashed and looked up — and goes
+         * no further: nothing here stores or returns it.
+         */
+        async exchangeCapability(secret, tenantId, scopeId, mode) {
+            await this.ensureMigrations();
+            return await this.queue.enqueue(async () => {
+                const liveSince = this.liveHighWaterMark();
+                // ONE instant for the whole exchange: the row's `last_used_at`, the session's times
+                // and the event's `occurredAt` are one fact, and two clock reads could disagree.
+                const now = instant.parse(new Date().toISOString());
+                let outcome = null;
+                await this.ctx.storage.transaction(async () => {
+                    outcome = await exchangeCapability({
+                        sql: doSpineSql(this.sql),
+                        now,
+                        // Stamped `{ capability }` by the ordinary emit path, under the exchange's own
+                        // pseudo-operation name — the actor is the capability, as on every event it
+                        // goes on to cause.
+                        emit: (capability, event) => this.operationContext(principalId.parse(ulid()), tenantId, scopeId, undefined, undefined, undefined, undefined, undefined, CAPABILITY_EXCHANGE_OPERATION, capability, [], now).emit(event),
+                    }, secret, mode);
+                });
+                if (outcome)
+                    await this.settleCommitted(tenantId, scopeId, liveSince, null);
+                return outcome;
+            });
+        }
+        /**
+         * The platform's mint (#1672, `HostAdmin.mintCapability`) — a `become` capability,
+         * serialized on the queue with every other spine write. One INSERT, so it needs no
+         * transaction of its own; the hash is computed before it.
+         */
+        async mintBecomeCapability(input, actor) {
+            await this.ensureMigrations();
+            return await this.queue.enqueue(() => mintBecomeCapability(doSpineSql(this.sql), input, actor, instant.parse(new Date().toISOString())));
+        }
+        /**
+         * The platform's revoke (#1672, `HostAdmin.revokeCapability`) — of any capability in
+         * this scope. Returns the record as it stood before, for the admin log, or `null`.
+         */
+        async revokeCapabilityAsPlatform(id, actor) {
+            await this.ensureMigrations();
+            return await this.queue.enqueue(() => this.ctx.storage.transactionSync(() => revokeCapabilityAsPlatform(doSpineSql(this.sql), id, actor, instant.parse(new Date().toISOString()))) ?? null);
         }
         /**
          * The last time a schedule's operation ran on this scope (#383), or null.
@@ -2173,8 +2297,15 @@ export function defineScopeDO(modules, bareOps) {
          *
          * "Not yet consumed" means never attempted, or retrying and now due (#100).
          * Terminal rows — delivered or dead-lettered — are excluded by the join.
-         */
-        pendingExecutorEvents(deliveryId, eventType) {
+         *
+         * Decoded per row (#1636). A row that will not decode comes back in `undecodable`,
+         * never as an event: the coordinator journals it as a dead letter, and its handler is
+         * never handed an event built from stand-ins. The whole list used to be one
+         * `rows.map(decode)`, so one bad row threw the executor's pending list on every pass.
+         * The journal write stays on the coordinator, beside every other attempt it records —
+         * this stays a read.
+         */
+        pendingExecutorDeliveries(deliveryId, eventType) {
             const rows = this.sql
                 .exec(`SELECT o.* FROM _substrat_outbox o
            LEFT JOIN _substrat_deliveries d
@@ -2184,7 +2315,26 @@ export function defineScopeDO(modules, bareOps) {
                   OR (d.next_attempt_at IS NOT NULL AND d.next_attempt_at <= ?))
            ORDER BY o.id`, deliveryId, eventType, new Date().toISOString())
                 .toArray();
-            return rows.map((r) => this.parseOutboxRow(r));
+            const events = [];
+            const undecodable = [];
+            for (const r of rows) {
+                try {
+                    events.push(domainEventOf(r));
+                }
+                catch (err) {
+                    undecodable.push({ eventId: r.id, error: String(err) });
+                }
+            }
+            return { events, undecodable };
+        }
+        /**
+         * The same read as a bare list of events, for a coordinator deployed before
+         * `pendingExecutorDeliveries` (#1636). An undecodable row is left out rather than
+         * thrown, so that pairing still delivers the rows behind it; the next coordinator
+         * dead-letters it.
+         */
+        pendingExecutorEvents(deliveryId, eventType) {
+            return this.pendingExecutorDeliveries(deliveryId, eventType).events;
         }
         /**
          * Journal one executor attempt (#100). `error` null means delivered;
@@ -2273,12 +2423,21 @@ export function defineScopeDO(modules, bareOps) {
          * `result` is COALESCE'd so a value written on an earlier pass (e.g. a minted sibling scope id,
          * for two-phase idempotency) survives a null on retry. `attempts` bumps each settle; `settled_at`
          * is set only on a terminal outcome.
+         *
+         * **Compare-and-set on `pending` (#1600 review).** The drain reads pending rows, runs a
+         * handler, then settles — and between the read and the settle a subject erasure can redact
+         * the row. Settling by `id` alone let that stale pass overwrite the redaction and write a
+         * provider's reply, which can quote the person, back into `last_error`. Nothing legitimate
+         * is refused: `pendingPlatformRequests` returns only pending rows, so every settle targets
+         * one that was pending when it was read. A settle that finds the row already terminal does
+         * nothing, deliberately silently — throwing would make the drain's blanket catch retry a
+         * row that is correctly over.
          */
         settlePlatformRequest(id, status, result, lastError, lastFailure = null) {
             this.sql.exec(`UPDATE _substrat_platform_requests
            SET status = ?, result = COALESCE(?, result), last_error = ?, last_failure = ?,
                attempts = attempts + 1, settled_at = ?
-         WHERE id = ?`, status, result, lastError, lastFailure, status === 'pending' ? null : new Date().toISOString(), id);
+         WHERE id = ? AND status = 'pending'`, status, result, lastError, lastFailure, status === 'pending' ? null : new Date().toISOString(), id);
         }
         /**
          * Turn one connector delivery into a `connector:<provider>` platform intent (#574
@@ -2496,6 +2655,9 @@ export function defineScopeDO(modules, bareOps) {
          * `destScopeId` is the scope being written INTO. A dump carries scope-level tuples
          * naming the scope it was captured from, so restoring one anywhere else needs them
          * re-pointed — see `rewriteScopeTuples`.
+         *
+         * What the dump did NOT carry is rebuilt by the next migration pass, which is why
+         * this ends by forgetting the memoised one (#1589) — see the tail of the method.
          */
         /**
          * The additive spine-column migrations. KERNEL_DDL is all IF NOT EXISTS, so a
@@ -2699,6 +2861,29 @@ export function defineScopeDO(modules, bareOps) {
                 .toArray()) {
                 this.applied.add(`${row.module_id}@${row.version}`);
             }
+            // …and forget that this INSTANCE ever ran a migration pass (#1589). Refreshing
+            // the set above is not enough on its own: `ensureMigrations` memoises its
+            // promise, so a warm DO answers "already migrated" from the cache and never
+            // reads the set again. A restore replays only what the dump carries, so a dump
+            // that omits a module's tables — a world that keeps part of the spine
+            // elsewhere, a targeted repair supplying only the tables being fixed — leaves
+            // them dropped and never rebuilt, and the next operation touching one fails
+            // with a bare `no such table` until an eviction or `retryMigrations` resets the
+            // latch. The pure host has no such memo (it re-reads `appliedMigrations` on
+            // every pass), so this is the line that makes the two adapters agree; without
+            // it the divergence is invisible to dev, CI and self-host, which is the #969
+            // class exactly. Same two fields `retryMigrations` clears, for the same reason:
+            // the next pass has to be a fresh one. Already-journaled versions are skipped
+            // by the `applied` set and the in-transaction re-check, so a dump that DID
+            // carry its tables re-applies nothing.
+            //
+            // `schemaVersionReported` is deliberately left set, as `retryMigrations` leaves
+            // it. `migrate()` reports only when a pass APPLIED something, and a pass that
+            // applies after this reset ends with every code-defined migration journaled —
+            // the same `applied.size` the first pass already reported. A dump whose frontier
+            // is complete applies nothing, so there is nothing to report either way.
+            this.migrationPromise = undefined;
+            this.lastFailure = null;
         }
         /**
          * Re-point scope-level tuples at the scope they now live in.
@@ -2760,12 +2945,23 @@ export function defineScopeDO(modules, bareOps) {
          * and transaction facts remain". A timeline still shows that something happened, to
          * what, and when; it no longer shows who, or what was said about them.
          *
+         * **Two tables, one verb (#1600).** The outbox is not the only place the spine holds
+         * an event's payload: this host is the CP-less one, so every connector delivery it
+         * cannot run becomes a `connector:<provider>` intent carrying the whole event, and
+         * nothing ever deletes those rows. Redacting one table and not the other left the
+         * name in the live database and in every copy taken from it afterwards. One RPC
+         * rather than two for `routeExecutorEventToPlatform`'s reason — a crash cannot land
+         * half an erasure — and both halves are idempotent anyway, so a retry converges.
+         *
          * This is the one sanctioned write that mutates the outbox. It is kernel code, not
          * module code, and an erasure request is precisely the case the append-only rule has
          * to yield to — the alternative is telling a data subject that the spine's convenience
          * outranks their Article 17 right.
          */
         async redactSubject(subjectId) {
+            // One instant for the whole erasure — the intent tombstones must not disagree with
+            // each other about when a person was erased.
+            const at = new Date().toISOString();
             const doomed = this.sql
                 .exec(`SELECT id FROM _substrat_outbox
               WHERE subject_id = ? AND pii_class != 'none' AND payload IS NOT NULL`, subjectId)
@@ -2773,7 +2969,30 @@ export function defineScopeDO(modules, bareOps) {
             for (const id of doomed) {
                 this.sql.exec('UPDATE _substrat_outbox SET payload = NULL WHERE id = ?', id);
             }
-            return doomed.length;
+            return { events: doomed.length, intents: this.redactSubjectIntents(subjectId, at) };
+        }
+        /**
+         * The intent-journal half of `redactSubject` (#1600) — the SQLite adapter's twin.
+         *
+         * Row-by-row rather than one `UPDATE … WHERE`, because the decision is structural and
+         * SQL cannot make it: an intent payload is opaque JSON with no `pii_class` column to
+         * test, so the SQL narrows to rows that could possibly match and the kernel predicate
+         * decides. Query, predicate and statement all come from the kernel, so this adapter
+         * and the pure one cannot drift about what a redacted intent is.
+         */
+        redactSubjectIntents(subjectId, at) {
+            const q = platformRequestRedactionQuery(subjectId);
+            const candidates = this.sql
+                .exec(q.sql, ...q.params)
+                .toArray();
+            let redacted = 0;
+            for (const row of candidates) {
+                if (!intentPayloadCarriesSubject(row.payload, subjectId))
+                    continue;
+                this.sql.exec(PLATFORM_REQUEST_REDACTION_SQL, ...platformRequestRedactionParams(row.id, subjectId, at));
+                redacted += 1;
+            }
+            return redacted;
         }
         // -- event dispatch (port of dispatch) ------------------------------------
         /**
@@ -2820,7 +3039,21 @@ export function defineScopeDO(modules, bareOps) {
                  ORDER BY o.id`, consumer.eventType, mod.id)
                             .toArray();
                         for (const row of rows) {
-                            const event = this.parseOutboxRow(row);
+                            let event;
+                            try {
+                                event = domainEventOf(row);
+                            }
+                            catch (err) {
+                                // #1636: dead-letter an event that does not decode, exactly as a failed
+                                // handler is — the decode sat ABOVE the `try` below, so one bad row halted
+                                // every event of this type behind it, on every pass. The consumer is never
+                                // handed it: an event built from stand-ins is not one it may act on. Only
+                                // the decode is caught; the journal write is not.
+                                this.sql.exec(`INSERT INTO _substrat_deliveries
+                     (event_id, consumer_module, delivered_at, error, invocation_id)
+                   VALUES (?, ?, ?, ?, ?)`, row.id, mod.id, new Date().toISOString(), String(err), invocationId);
+                                continue;
+                            }
                             // #1237: anything this consumer emits was emitted BECAUSE of this event
                             // — the step a backwards walk used to stop dead at, since a consumer
                             // emit records no operation either.
@@ -2891,11 +3124,7 @@ export function defineScopeDO(modules, bareOps) {
             // no permission key and is left to the module.
             if (!err.permission || !err.node)
                 return;
-            const actor = subject.kind === 'system'
-                ? { system: subject.id }
-                : subject.kind === 'connection'
-                    ? { connection: subject.id }
-                    : subject.id;
+            const actor = actorOf(subject);
             this.sql.exec(`INSERT INTO _substrat_denials
            (id, actor, permission, tenant_id, scope_id, operation, impersonation,
             invocation_id, at)
@@ -2903,29 +3132,6 @@ export function defineScopeDO(modules, bareOps) {
             // #1525: the call this refusal belongs to, as the caller named it.
             invocationId, new Date().toISOString());
         }
-        parseOutboxRow(row) {
-            return domainEvent.parse({
-                id: row.id,
-                type: row.type,
-                schemaVersion: row.schema_version,
-                occurredAt: row.occurred_at,
-                tenantId: row.tenant_id,
-                scopeId: row.scope_id,
-                actor: JSON.parse(row.actor),
-                entity: { entityType: row.entity_type, entityId: row.entity_id },
-                piiClass: row.pii_class,
-                ...(row.subject_id ? { subjectId: row.subject_id } : {}),
-                ...(row.authorization ? { authorization: JSON.parse(row.authorization) } : {}),
-                // K-42: the stamp survives the read, so a consumer's event and an executor's
-                // are the same fact the stored row is. Absent rather than null when nobody
-                // was impersonating, because `DomainEvent.impersonation` is optional — the
-                // shape module code never sees is also the shape it cannot branch on.
-                ...(row.impersonation ? { impersonation: JSON.parse(row.impersonation) } : {}),
-                // #1231: absent rather than null, the same shape rule as the stamp above.
-                ...(row.operation ? { operation: row.operation } : {}),
-                payload: row.payload === null ? undefined : JSON.parse(row.payload),
-            });
-        }
         // -- operation context (port of operationContext) -------------------------
         operationContext(principal, tenantId, scopeId, systemActor, connectionId, systemModuleId, 
         /** #458: per-invoke tally of `ctx.requestPlatform` calls; absent for consumer dispatch. */
@@ -2943,7 +3149,28 @@ export function defineScopeDO(modules, bareOps) {
          * onto every event it emits. Absent for consumer dispatch: a consumer runs on
          * behalf of no operation, and the emitted row's NULL says so.
          */
-        operation) {
+        operation, 
+        /**
+         * #1672: set when the caller holds a CAPABILITY session — already resolved from its
+         * hash inside the queued body, before the transaction. Mutually exclusive with
+         * `connectionId` and `systemModuleId`; `principal` is then a placeholder that the
+         * subject below never reads.
+         */
+        capabilityId, 
+        /**
+         * #1672: the secrets `ctx.capabilities.mint` hands out during this invocation. The
+         * caller owns the array (it withholds them from the idempotency recording); this
+         * context appends to it and holds `ctx.sql`, `ctx.emit` and `ctx.requestPlatform` to
+         * it — the tripwire that catches a module persisting one by accident (not a boundary
+         * against one that means to; see `assertNoSecret`).
+         */
+        minted = [], 
+        /**
+         * #1672: the instant to stamp, when the caller already read one. The exchange passes
+         * the instant its row write used, so the `capability.exercised` event's `occurredAt`
+         * and the row's `last_used_at` are the same value — a second read could disagree.
+         */
+        instantOverride) {
             const checker = this.checker;
             const relations = this.relations;
             const searchPlans = this.searchPlans;
@@ -2957,20 +3184,18 @@ export function defineScopeDO(modules, bareOps) {
              * on, and it holds identically here: `ctx.now()`, every `occurredAt` and
              * every `requested_at` in one operation are the same value.
              */
-            const at = instant.parse(new Date().toISOString());
+            const at = instantOverride ?? instant.parse(new Date().toISOString());
             // The permission subject and the derived event actor for a NON-override caller
             // (#383/#97): a scheduled module, a connection, or a person. `systemActor` (the
             // override, used only by consumer dispatch) stays a separate bypass path below.
-            const subject = systemModuleId
-                ? { kind: 'system', id: systemModuleId }
-                : connectionId
-                    ? { kind: 'connection', id: connectionId }
-                    : { kind: 'principal', id: principal };
-            const derivedActor = subject.kind === 'system'
-                ? { system: subject.id }
-                : subject.kind === 'connection'
-                    ? { connection: subject.id }
-                    : principal;
+            const subject = capabilityId
+                ? { kind: 'capability', id: capabilityId }
+                : systemModuleId
+                    ? { kind: 'system', id: systemModuleId }
+                    : connectionId
+                        ? { kind: 'connection', id: connectionId }
+                        : { kind: 'principal', id: principal };
+            const derivedActor = actorOf(subject);
             // #304: entitlement reads pick the same local-vs-RPC reader the permission checker
             // uses (projected scope → local table; console-managed → CP over RPC), resolved per
             // call so a scope that flips to 'local' is picked up without rebuilding the context.
@@ -2999,7 +3224,10 @@ export function defineScopeDO(modules, bareOps) {
             // Lifted so `grant` reuses the SAME check the operation itself passes —
             // a delegation check that could differ from the operation's would be a
             // second opinion about what the caller holds.
-            const runCheck = async (permission, entity) => {
+            const runCheck = async (unparsed, entity) => {
+                // #1642: parsed before the system actor's early return, which never reaches
+                // the checker — a cast key would otherwise become that path's proof relation.
+                const permission = assertPermissionKey(unparsed);
                 if (systemActor) {
                     return {
                         allowed: true,
@@ -3034,15 +3262,19 @@ export function defineScopeDO(modules, bareOps) {
                 }
                 return checker.covers(subject, role.permissions, { tenantId, scopeId });
             };
-            return {
+            const ctxRef = {
                 tenantId,
                 scopeId,
-                principal,
-                sql: doScopedSql(sql),
+                // #1672: a capability's own id stands in so the type holds — it is not a person, and
+                // the event actor says what it is instead. Every other door passes its own value.
+                principal: capabilityId ? capabilityId : principal,
+                sql: guardSecrets(doScopedSql(sql), minted),
                 now: () => at,
                 emit: (event) => {
                     assertImpersonationWrites(impersonation, 'ctx.emit');
                     const parsed = domainEventInput.parse(event);
+                    // #1672: the COMPLETE parsed event — entity id, type and subject as well as payload.
+                    assertNoSecret('ctx.emit', parsed, minted);
                     const full = domainEvent.parse({
                         ...parsed,
                         // #956: from the operation's instant, not a second reading of the clock.
@@ -3079,6 +3311,8 @@ export function defineScopeDO(modules, bareOps) {
                 requestPlatform: (request) => {
                     assertImpersonationWrites(impersonation, 'ctx.requestPlatform');
                     const input = platformRequestInput.parse(request);
+                    // #1672: the COMPLETE parsed request — its `kind` is persisted as surely as its payload.
+                    assertNoSecret('ctx.requestPlatform', input, minted);
                     // #1474: a platform-authored kind (`sweep-runs`) never comes from module code —
                     // the sweeper enqueues it through `enqueueSweepRuns`, which does not pass here.
                     assertModuleEnqueueableKind(input.kind);
@@ -3103,7 +3337,9 @@ export function defineScopeDO(modules, bareOps) {
                 // predicate is needed or possible: the DO IS the scope.
                 platformRequests: (filter) => {
                     const q = platformRequestHistoryQuery(filter);
-                    return sql.exec(q.sql, ...q.params).toArray().map(rowToPlatformRequest);
+                    // The kernel's decoder, the one the coordinator maps the RPC's rows with (#1588):
+                    // tolerant, so one undecodable row cannot hide this scope's other intents from it.
+                    return sql.exec(q.sql, ...q.params).toArray().map(platformRequestOf);
                 },
                 // #901. Mirror of the pure adapter, and the reason the contract suite
                 // runs on both: the query is ordinary SQL, but it is only a seek rather
@@ -3182,6 +3418,22 @@ export function defineScopeDO(modules, bareOps) {
                     sql.exec(`DELETE FROM _substrat_tuples WHERE subject = ? AND relation = ? AND object = ?`, `principal:${principal}`, `granted:${permission}`, `${entity.entityType}:${entity.entityId}`);
                 },
                 atomic: createAtomic(runSub, { passed, signals }),
+                // #1672: mint / revoke / list, written once in the kernel — the pure adapter hands
+                // the same function the same four things. The raw spine seam (the kernel's own write
+                // to `_substrat_capabilities`), the operation's OWN check, and `ctx.emit`. A
+                // consumer's override actor is passed as the system actor it is, so a consumer
+                // cannot mint: its checks allow unconditionally, which would make "the minter holds
+                // it" vacuous.
+                capabilities: createCapabilityVerbs({
+                    sql: doSpineSql(sql),
+                    subject: systemActor ? { kind: 'system', id: systemActor.system } : subject,
+                    now: at,
+                    check: runCheck,
+                    emit: (event) => ctxRef.emit(event),
+                    isOperation: (name) => this.operations.has(name),
+                    assertWrites: (verb) => assertImpersonationWrites(impersonation, verb),
+                    minted,
+                }),
                 link: (child, parent) => {
                     assertImpersonationWrites(impersonation, 'ctx.link');
                     const allowed = relations.get(child.entityType);
@@ -3215,6 +3467,7 @@ export function defineScopeDO(modules, bareOps) {
                     return sealTo({ keyId: row.key_id, publicKey: row.public_key }, plaintext);
                 },
             };
+            return ctxRef;
         }
         /** True once this scope has had entitlements projected at least once (#304) — the switch
          *  from trust-upstream to strict fail-closed entitlement enforcement on the local path. */
@@ -3317,11 +3570,16 @@ export function defineScopeDO(modules, bareOps) {
          *  while passing a list — even `[]` — full-replaces them. This keeps pre-#304 callers
          *  from silently wiping a scope's entitlements. */
         entitlements, 
-        /** Scope-level tuples (e.g. the owner's role grant at provision) upserted into
+        /** Scope-level tuples (e.g. the owner's role grant at provision) seated into
          *  `_substrat_tuples` in this SAME transaction, additively (#332). Preserve-on-undefined:
          *  omitting it leaves existing scope tuples untouched, so a role-only re-projection keeps
          *  the owner grant. Passing them here (rather than a follow-up `writeTuple`) is what makes
-         *  provision atomic — the grant and the enforcement flip land together or not at all. */
+         *  provision atomic — the grant and the enforcement flip land together or not at all.
+         *
+         *  Seated, not replaced (#1659): a missing tuple is created, a revoked one stays revoked.
+         *  `lockout_reseat` marks the one exception — the owner-of-record's seat, which is
+         *  re-seated even over a revoke when the scope would otherwise hold no effective role
+         *  grant (`hasEffectiveRoleGrant`). */
         scopeTuples, 
         /** The tenant's identity links (#406) — projected alongside the rest so a CP-less
          *  vertical's auth adapter resolves logins locally. Same preserve-on-undefined
@@ -3396,18 +3654,39 @@ export function defineScopeDO(modules, bareOps) {
                 // — NOT a full replace — so existing scope tuples are preserved. This is what keeps a
                 // scope from ever being left "roles projected, permission_source=local, zero tuples" by
                 // a write that lands the projection but drops before a follow-up owner grant.
+                //
+                // #1659: SEATED, so a reconcile creates what is missing and leaves a revoke alone. It
+                // used to be `INSERT OR REPLACE … revoked_at = NULL`, which undid an operator's revoke
+                // of the owner seat or of a `system:` schedule grant on the next reconcile. And a
+                // module switched off (#1666) gets no `system:` grant seated, new or old.
                 for (const st of scopeTuples ?? []) {
-                    this.sql.exec(`INSERT OR REPLACE INTO _substrat_tuples (subject, relation, object, expires_at, revoked_at)
-             VALUES (?, ?, ?, ?, NULL)`, st.subject, st.relation, st.object, st.expires_at);
+                    const seat = seatScopeTuple(st.subject, st.relation, st.object, st.expires_at);
+                    this.sql.exec(seat.sql, ...seat.params);
+                }
+                // #1659's one exception: the owner-of-record's seat comes back over a revoke when
+                // NOTHING else would let anyone act here — roles projected, no effective role grant.
+                // That is the #332 lockout this path exists to repair, and it is decided by the same
+                // predicate as the flip guard below, so "locked out" means one thing in this unit.
+                // With any other effective holder, the revoke stands: a hand-over that seats a
+                // successor before unseating the owner is not undone by the next promote. A holder of
+                // a role the vertical no longer defines is NOT one — it passes no check, so it must
+                // not stand in for the holder this repair exists to restore.
+                if (roles.length > 0 && !this.hasEffectiveRoleGrant(tenantId)) {
+                    for (const st of scopeTuples ?? []) {
+                        if (!st.lockout_reseat)
+                            continue;
+                        this.sql.exec(`INSERT OR REPLACE INTO _substrat_tuples (subject, relation, object, expires_at, revoked_at)
+               VALUES (?, ?, ?, ?, NULL)`, st.subject, st.relation, st.object, st.expires_at);
+                    }
                 }
                 // #332: only switch on strict local enforcement when SOMEONE actually holds a role.
-                // A projection that leaves role definitions but no live principal→role grant would make
-                // every check fail closed — a scope serving nothing but denials, unfixable from inside.
-                // Leave `permission_source` as-is instead; a reconcile that restores the owner grant
-                // re-runs this and flips safely. (A CP-less vertical uses the local reader regardless of
-                // this flag, so the owner grant is written above in the same unit — this guard is the
-                // belt to that suspenders, and it protects the CP-backed flip outright.)
-                if (roles.length > 0 && !this.hasLiveRoleGrant(tenantId))
+                // A projection that leaves role definitions but no effective principal→role grant would
+                // make every check fail closed — a scope serving nothing but denials, unfixable from
+                // inside. Leave `permission_source` as-is instead; a reconcile that restores the owner
+                // grant re-runs this and flips safely. (A CP-less vertical uses the local reader
+                // regardless of this flag, so the owner grant is written above in the same unit — this
+                // guard is the belt to that suspenders, and it protects the CP-backed flip outright.)
+                if (roles.length > 0 && !this.hasEffectiveRoleGrant(tenantId))
                     return;
                 this.sql.exec(`INSERT OR REPLACE INTO _substrat_meta (key, value) VALUES ('permission_source', 'local')`);
             });
@@ -3428,23 +3707,17 @@ export function defineScopeDO(modules, bareOps) {
                 return undefined;
             return { principal: row.principal_id, scopeId: row.scope_id };
         }
-        /** True if any live (non-revoked, unexpired) principal→role grant exists for this tenant,
-         *  at scope OR tenant level — the precondition for switching on strict local enforcement so a
-         *  projection never enables fail-closed evaluation against an empty tuple table (#332). */
-        hasLiveRoleGrant(tenantId) {
-            const now = new Date().toISOString();
-            const scope = this.sql
-                .exec(`SELECT 1 FROM _substrat_tuples
-           WHERE relation LIKE 'role:%' AND revoked_at IS NULL AND (expires_at IS NULL OR expires_at > ?)
-           LIMIT 1`, now)
-                .toArray();
-            if (scope.length > 0)
-                return true;
-            return (this.sql
-                .exec(`SELECT 1 FROM _substrat_tenant_tuples
-             WHERE tenant_id = ? AND relation LIKE 'role:%' AND revoked_at IS NULL AND (expires_at IS NULL OR expires_at > ?)
-             LIMIT 1`, tenantId, now)
-                .toArray().length > 0);
+        /** True if some principal holds a role this scope can actually EXPAND — a live
+         *  (non-revoked, unexpired) `role:<key>` tuple, at scope OR tenant level, whose key names a
+         *  current, non-revoked role definition for this tenant. The one predicate behind both the
+         *  #332 flip guard and #1659's owner re-seat in `applyProjection`; the query is the
+         *  kernel's `effectiveRoleGrantQuery`, where it is tested against a real SQLite. A tuple
+         *  for a role the vertical no longer defines counts for nothing, exactly as in the local
+         *  checker, which expands a role only through its definition. */
+        hasEffectiveRoleGrant(tenantId) {
+            const q = effectiveRoleGrantQuery(tenantId, new Date().toISOString());
+            const row = this.sql.exec(q.sql, ...q.params).toArray()[0];
+            return row?.effective === 1;
         }
     };
 }