@substrat-run/adapter-cloudflare 0.134.0 → 0.136.0

package/dist/host.js

@@ -1,7 +1,8 @@
+import { env as ambientEnv } from 'cloudflare:workers';
 import { isRewindRefusal, REWIND_REFUSED } from './rewind-refusal.js';
-import { delegatedReadParams, fromWireFailure, exportReadInput, exportedBatch, importBatch, importResult, importState, importsOfManifestJson, exportsOfManifestJson, importCursorMove, importCursorMoveAt, importCursorMoved, accessLogEntry, adminLogEntry, opsFailureEntry, opsFailureFingerprint, issueEntry, sweepRunEntry, FRESHNESS_HEARTBEAT_MINUTES, sweepRunsPayload, modelUsageEntry, attachmentRecord, createTenantInput, identityLink, identityPool, createOrgInput, promotionAcknowledgement, bindAcknowledgement, bindHostnameInput, channelHistoryEntry, hostnameBinding, publishVersionInput, AUTO_ADMISSION_NOTE, registerVerticalInput, vertical as verticalSchema, verticalServingState, verticalChannel, verticalVersion, connection, capabilityExchange, capabilityGrant, principalId, connectionGrant, connectionGrantRecord, connectionSecret, systemGrant, systemSwitch, systemSwitchOutcome, systemScheduleEntry, systemSwitchRecord, entitlementGrant, entitlementGrantInput, instant, meterReading, subjectRef, createConnectionInput, projectedConnectionGrant, projectedConnectionKey, moduleManifest, org as orgSchema, orgMembership, resolvedIdentity, identityMembership, roleDefinition, scope as scopeSchema, tenant as tenantSchema, tenantRole, delegatedReadRecord, ownerTransferAudit, subjectShredReceipt, connectorDispatchKind, callsOfManifestJson, outboundOfManifestJson, substratError, redrainEventsInput, coverage, peerCoverage, peerGrantsEntry, peerSwitch, peerSwitchOutcome, verticalCaller, verticalResolution, verticalSlug, entityObjectRef, } from '@substrat-run/contracts';
+import { delegatedReadParams, fromWireFailure, exportReadInput, exportedBatch, importBatch, importResult, importState, importsOfManifestJson, exportsOfManifestJson, importCursorMove, importCursorMoveAt, importCursorMoved, accessLogEntry, adminLogEntry, opsFailureEntry, opsFailureFingerprint, issueEntry, sweepRunEntry, FRESHNESS_HEARTBEAT_MINUTES, sweepRunsPayload, modelUsageEntry, attachmentRecord, createTenantInput, identityLink, identityPool, createOrgInput, promotionAcknowledgement, bindAcknowledgement, bindHostnameInput, channelHistoryEntry, hostnameBinding, publishVersionInput, AUTO_ADMISSION_NOTE, registerVerticalInput, vertical as verticalSchema, verticalServingState, verticalChannel, verticalVersion, connection, capabilityExchange, capabilityGrant, principalId, connectionGrant, connectionGrantRecord, connectionSecret, systemGrant, systemSwitch, systemSwitchOutcome, systemScheduleEntry, systemSwitchRecord, entitlementGrant, entitlementGrantInput, capabilityFilter, instant, meterReading, subjectRef, createConnectionInput, projectedConnectionGrant, projectedConnectionKey, moduleManifest, org as orgSchema, orgMembership, resolvedIdentity, identityMembership, roleDefinition, scope as scopeSchema, tenant as tenantSchema, tenantRole, delegatedReadRecord, ownerTransferAudit, copyMarkAudit, subjectShredReceipt, connectorDispatchKind, callsOfManifestJson, outboundOfManifestJson, substratError, redrainEventsInput, coverage, peerCoverage, peerGrantsEntry, peerSwitch, peerSwitchOutcome, verticalCaller, verticalResolution, verticalSlug, entityObjectRef, ATTACHMENT_BLOB_BINDING, blobStoreBindingName, lifecycleDelivery, scopeLifecycle, } from '@substrat-run/contracts';
 import { normalizeHostname, toRouteTarget } from './route-resolver.js';
-import { attachmentBlobKey, attachmentSha256, entitlementDenial, foldMeterReading, parseValidationRecords, resolveScopeRecord, ulid, capabilityTokenHash, checkBecomeInput, plausibleSessionToken, foldModelUsage, backoffAt, resolveRetryPolicy, isSecretBoxConfigured, unconfiguredSecretBox, createSubjectKeys, generateSealingKeyPair, openSealed, ImpersonationRefused, assertSessionUsable, impersonationRowValues, mapImpersonationRow, newImpersonationSession, jobRunOf, runDueJobRuns, startJobRun, attachmentTextJob, assertAttachmentExtractors, assertJobRegistrable, isAttachmentTextRun, searchLimit, searchMatchExpression, globalFetch, assertRedrainWindow, platformRequestOf, undrainedEventsOf, inUnitMovesToAudit, staleCarryRevertRow, staleCarryReverts, withRecorded, systemSwitchedOffMessage, tenantSystemSwitchedOffMessage, CrossVerticalRegistry, importCursorSourceOf, exportBreaksOf, exportBreakRefusal, bindExportBreaksOf, bindExportBreakRefusal, collectPeers, peerSeats, connectorCallRecord, noopConnectorCallRecorder, recordConnectorCall, settleConnectionUse, splitManifestMigrations, unknownRoleError, assertRowLimit, assertRowOffset, } from '@substrat-run/kernel';
+import { attachmentBlobKey, attachmentSha256, entitlementDenial, requiredEntitlementFor, foldMeterReading, parseValidationRecords, resolveScopeRecord, ulid, KEPT_COPY_REFUSAL, capabilityTokenHash, checkBecomeInput, plausibleSessionToken, foldModelUsage, backoffAt, resolveRetryPolicy, isSecretBoxConfigured, unconfiguredSecretBox, createSubjectKeys, generateSealingKeyPair, openSealed, ImpersonationRefused, assertSessionUsable, impersonationRowValues, mapImpersonationRow, newImpersonationSession, jobRunOf, runDueJobRuns, startJobRun, attachmentTextJob, assertAttachmentExtractors, assertJobRegistrable, isAttachmentTextRun, searchLimit, searchMatchExpression, globalFetch, assertRedrainWindow, platformRequestOf, undrainedEventsOf, inUnitMovesToAudit, staleCarryRevertRow, staleCarryReverts, withRecorded, systemSwitchedOffMessage, tenantSystemSwitchedOffMessage, CrossVerticalRegistry, importCursorSourceOf, exportBreaksOf, exportBreakRefusal, bindExportBreaksOf, bindExportBreakRefusal, collectPeers, peerSeats, connectorCallRecord, noopConnectorCallRecorder, recordConnectorCall, settleConnectionUse, splitManifestMigrations, unknownRoleError, assertRowLimit, assertRowOffset, INERT_SCOPE_REASON, lifecycleReceipt, lifecycleRefusal, isPrimaryScope, isPrimaryScopeRow, asyncInvocationId, asyncLinePass, } from '@substrat-run/kernel';
 import { attributedHost } from '@substrat-run/kernel';
 import { isOrangeToOrange, isUpgradeRequest, LIVE_MODE_HEADER, LIVE_PRINCIPAL_HEADER, LIVE_SCOPE_HEADER, LIVE_SUBSCRIBE_PATH, LIVE_TENANT_HEADER, } from './live-reads.js';
 import { tenantStoreDatabaseName } from './d1.js';
@@ -30,12 +31,29 @@ function unwrapCapabilityReply(reply) {
         throw fromWireFailure(reply.failure);
     return reply.value;
 }
+/**
+ * How far ahead of the clock a held lifecycle epoch may be and still be learned past (#1713). An
+ * epoch is the time a directory restore minted it, so a legitimate one is behind its minter's
+ * clock; the skew allows for clocks that disagree, and bounds what a forged answer can move.
+ */
+export const LIFECYCLE_EPOCH_SKEW_MS = 24 * 60 * 60 * 1000;
+/**
+ * Refuse to mark a scope a copy unless the request classifies it non-primary (#2005). The
+ * classification is the platform directory's; the vertical applies the same `isPrimaryScope` to
+ * it, so a primary can be marked only by a request that misstates its lineage, never by default.
+ */
+function assertCopyLineage(lineage) {
+    if (isPrimaryScope(lineage)) {
+        throw substratError('conflict', 'mark-copy refused: the directory classifies this scope as primary, not as a copy');
+    }
+}
 /**
  * A control-plane stand-in for a CP-less vertical (scope-local-permissions.md Phase 3).
  * The hot path a served scope actually touches becomes trust-the-upstream:
- *   - `scopeAccessRefusal` / `setMigrationState` → no-op: the router already gated the
- *     scope's lifecycle + tenancy from the shared directory, so the vertical trusts the
- *     asserted node rather than re-reading a directory it does not have.
+ *   - `scopeAccessRefusal` / `setMigrationState` → no-op: the router gates the scope's
+ *     lifecycle + tenancy from the shared directory, and the vertical trusts the asserted
+ *     node rather than re-reading a directory it does not have. Its own half of the
+ *     lifecycle gate reads the scope's storage instead (`assertLive`, #1713).
  *   - `tenantHoldsEntitlement` → true: the SKU was enforced on the shared control plane
  *     at provision (before `provisionInstance`), so a scope that EXISTS here was granted
  *     it upstream — a single-vertical deployment holds its own entitlements by construction.
@@ -106,6 +124,14 @@ export const SWITCH_HOLD_EXTRA_WAITS = 3;
  * clock, against the releasing host's clock: minutes, not seconds.
  */
 export const SWITCH_HOLD_PENDING_MAX_MS = 5 * 60_000;
+/**
+ * The attachment bucket a host resolves when it was handed no resolver (#1995): the
+ * platform's per-tenant binding, read off this script's own env, named by the one shared
+ * encoding (`blobStoreBindingName`) for the tenant the caller passed in.
+ */
+function ambientAttachmentBucket(tenantId) {
+    return ambientEnv[blobStoreBindingName(ATTACHMENT_BLOB_BINDING, tenantId)] ?? null;
+}
 export class CloudflareScopeHost {
     admin;
     scopeNs;
@@ -145,7 +171,7 @@ export class CloudflareScopeHost {
     tenantStores;
     /** The live R2 client for per-tenant blob stores (#473); undefined ⇒ refuse loudly. */
     blobStores;
-    /** Worker-side attachment-bucket resolver (#473); undefined ⇒ attachments() refuses. */
+    /** Worker-side attachment-bucket resolver (#473); the ambient per-tenant binding unless overridden (#1995). */
     attachmentBuckets;
     /** The parsers attachment text is extracted with (K-43); the host's own, never imported here. */
     attachmentExtractors;
@@ -171,6 +197,8 @@ export class CloudflareScopeHost {
      */
     onBehalfOf = null;
     withdrawn = new Map(); // operation → module
+    /** Operation → who binds it (module, SKU flag, its declared schedules) — the §4.3 gate's
+     *  input, resolved per invoke by the kernel's `requiredEntitlementFor` (#1654). */
     operationEntitlement = new Map();
     /** #574: remote connector write-back for scopes served by another deployment. */
     connectorDelegation;
@@ -178,6 +206,8 @@ export class CloudflareScopeHost {
     eventDrainDelegation;
     /** #1666: the schedule kill switch's reach into the deployment serving a scope. */
     systemSwitchDelegation;
+    /** #1713: the lifecycle's reach into the deployment serving a scope. */
+    lifecycleDelegation;
     /** #1706: the peer kill switch's reach into the deployment serving a scope. */
     peerSwitchDelegation;
     /** #1705 PR 3: the replay lever's reach into the deployment serving a consumer scope. */
@@ -209,7 +239,7 @@ export class CloudflareScopeHost {
         this.secretBox = options.secretBox ?? unconfiguredSecretBox;
         this.tenantStores = options.tenantStores;
         this.blobStores = options.blobStores;
-        this.attachmentBuckets = options.attachmentBuckets;
+        this.attachmentBuckets = options.attachmentBuckets ?? ambientAttachmentBucket;
         assertAttachmentExtractors(options.attachmentExtractors ?? []);
         this.attachmentExtractors = options.attachmentExtractors ?? [];
         this.fetchImpl = options.fetch ?? globalFetch;
@@ -223,6 +253,7 @@ export class CloudflareScopeHost {
         this.connectorDelegation = options.connectorDelegation;
         this.eventDrainDelegation = options.eventDrainDelegation;
         this.systemSwitchDelegation = options.systemSwitchDelegation;
+        this.lifecycleDelegation = options.lifecycleDelegation;
         this.peerSwitchDelegation = options.peerSwitchDelegation;
         this.importCursorDelegation = options.importCursorDelegation;
         this.admin = this.buildAdmin();
@@ -351,21 +382,78 @@ export class CloudflareScopeHost {
         };
         if (this.executors.size === 0)
             return report;
+        // #1901: one line per attempt, capped per pass. Written on the coordinator, where the
+        // attempt runs — the DO only journals it.
+        const lines = asyncLinePass();
+        try {
+            await this.drainExecutorsPass(tenantId, scopeId, invocationId, report, lines);
+        }
+        finally {
+            lines.end();
+        }
+        return report;
+    }
+    async drainExecutorsPass(tenantId, scopeId, invocationId, report, lines) {
         const stub = this.scopeStub(scopeId);
-        for (const [id, executor] of this.executors) {
+        // #2005: a non-primary scope (a fork, a snapshot, a preview of either kind) causes no
+        // outbound effects, so its deliveries are journaled terminal with the reason and no
+        // handler runs. Asked of the directory where there is one. A CP-less host has none, so it
+        // asks the scope's own storage whether it is classified a copy (`_substrat_copy_origin`'s
+        // `is_copy`, #2009, set on the directory's word) — a preview and a snapshot reach a hosted
+        // vertical as restores the platform marks.
+        // Asked on the first due event, once per pass: most passes have none, and the directory
+        // is one global object.
+        let inert;
+        const isInert = () => (inert ??= this.cpLess
+            ? stub.isCopy()
+            : this.cp.getScopeRecord(tenantId, scopeId).then((row) => !isPrimaryScopeRow(row)));
+        // #1713: a CP-less scope its lifecycle holds attempts nothing and journals nothing, so every
+        // due delivery stays due for the first pass after it is live again. Asked on the first due
+        // event, like `isInert`. Every caller passed `assertLive` already, so this is for the scope
+        // suspended between that gate and the drain: a request in flight, whose write commits while
+        // its effect waits. A host with a directory answers false without a read.
+        let held;
+        const isHeld = () => (held ??= this.lifecycleHeld(scopeId));
+        drain: for (const [id, executor] of this.executors) {
             const deliveryId = `executor:${id}`;
             const { events, undecodable } = await stub.pendingExecutorDeliveries(deliveryId, executor.eventType);
             // #1636: an event the DO could not decode is dead-lettered for this executor at once,
             // and its handler never sees it. Terminal on the FIRST failure, unlike a handler's:
             // the decode is pure, so a retry cannot succeed. The rows behind it are delivered
             // below — the decode used to throw the whole list, on every pass.
+            if ((undecodable.length > 0 || events.length > 0) && (await isHeld())) {
+                report.lifecycleHeld = true;
+                break drain;
+            }
+            // #1901: an attempt's line. The attempt number is the one the journal is about to record.
+            const unitOf = (eventId, attempt) => ({
+                kind: 'consumer',
+                tenantId,
+                scopeId,
+                invocationId: asyncInvocationId(invocationId),
+                operation: deliveryId,
+                eventType: executor.eventType,
+                eventId,
+                attempt,
+                startedAt: Date.now(),
+            });
             for (const bad of undecodable) {
                 report.attempted += 1;
-                await stub.recordExecutorAttempt(bad.eventId, deliveryId, bad.error, null, invocationId);
+                const attempt = await stub.recordExecutorAttempt(bad.eventId, deliveryId, bad.error, null, invocationId);
                 report.deadLettered += 1;
+                lines.write({ ...unitOf(bad.eventId, attempt), outcome: 'dead-lettered' });
             }
             for (const event of events) {
                 report.attempted += 1;
+                const startedAt = Date.now();
+                if (await isInert()) {
+                    // No next attempt, like an undecodable row: a scope does not become primary.
+                    const attempt = await stub.recordExecutorAttempt(event.id, deliveryId, INERT_SCOPE_REASON, null, invocationId);
+                    report.inert = (report.inert ?? 0) + 1;
+                    // Its own outcome, never `delivered`: no handler ran (#2005).
+                    lines.write({ ...unitOf(event.id, attempt), startedAt, outcome: 'inert' });
+                    continue;
+                }
                 this.causedBy = event.id;
                 try {
                     if (executor.kind === 'connector' && this.cpLess) {
@@ -379,16 +467,20 @@ export class CloudflareScopeHost {
                         // the at-least-once residue, as it already must in-process.
                         await stub.routeExecutorEventToPlatform(event.id, deliveryId, connectorDispatchKind(executor.provider), JSON.stringify({ executorId: id, event }), JSON.stringify({ system: 'connector-dispatch' }), invocationId);
                         report.routedToPlatform += 1;
+                        // Handed on, not run here: the platform's drain owns its attempts from now on.
+                        lines.write({ ...unitOf(event.id, 1), startedAt, outcome: 'routed' });
                     }
                     else if (executor.kind === 'connector') {
                         await executor.handler(await this.connectorContext(tenantId, scopeId, executor.timeoutMs, event.id), event);
-                        await stub.recordExecutorAttempt(event.id, deliveryId, null, null, invocationId);
+                        const attempt = await stub.recordExecutorAttempt(event.id, deliveryId, null, null, invocationId);
                         report.delivered += 1;
+                        lines.write({ ...unitOf(event.id, attempt), startedAt, outcome: 'delivered' });
                     }
                     else {
                         await executor.handler(this.admin, event);
-                        await stub.recordExecutorAttempt(event.id, deliveryId, null, null, invocationId);
+                        const attempt = await stub.recordExecutorAttempt(event.id, deliveryId, null, null, invocationId);
                         report.delivered += 1;
+                        lines.write({ ...unitOf(event.id, attempt), startedAt, outcome: 'delivered' });
                     }
                 }
                 catch (err) {
@@ -403,18 +495,23 @@ export class CloudflareScopeHost {
                         report.deadLettered += 1;
                     else
                         report.retrying += 1;
+                    lines.write({
+                        ...unitOf(event.id, attempts),
+                        startedAt,
+                        outcome: exhausted ? 'dead-lettered' : 'retrying',
+                        error: err,
+                    });
                 }
                 finally {
                     this.causedBy = null;
                 }
             }
         }
-        return report;
     }
     async drainDue(tenantId, scopeId) {
         // Same lifecycle gate `getScope` applies (K-3): a suspended or archived scope
         // does not get its effects driven either.
-        await this.validateScopeAccess(tenantId, scopeId);
+        await this.assertLive(tenantId, scopeId);
         await this.migrateAndRecord(scopeId);
         // #1525: null, and honestly so — a sweep is not a call. An attempt this pass makes
         // records no invocation, which is what distinguishes it from the first attempt the
@@ -472,14 +569,14 @@ export class CloudflareScopeHost {
         this.attachmentExtractors);
     }
     async startJobRun(tenantId, scopeId, input) {
-        await this.validateScopeAccess(tenantId, scopeId);
+        await this.assertLive(tenantId, scopeId);
         await this.migrateAndRecord(scopeId);
         return jobRunOf(await startJobRun(this.jobStore(scopeId), input, ulid, () => new Date().toISOString()));
     }
     async runDueJobs(tenantId, scopeId, options) {
         // Same lifecycle gate as `drainDue`: a suspended scope's runs wait rather than
         // advance, and an archived one's never move again.
-        await this.validateScopeAccess(tenantId, scopeId);
+        await this.assertLive(tenantId, scopeId);
         await this.migrateAndRecord(scopeId);
         // #1575: the kernel's extraction job is this host's own, bound to this scope — no
         // deployment registers it, and none can shadow it.
@@ -504,7 +601,7 @@ export class CloudflareScopeHost {
         // same context build as the in-process path, so the handler cannot tell which host
         // ran it. On a CP-less host `connectorContext` throws from the null control plane:
         // fail closed, exactly the hole routing exists to avoid.
-        await this.validateScopeAccess(tenantId, scopeId);
+        await this.assertLive(tenantId, scopeId);
         this.causedBy = event.id;
         try {
             await handler(await this.connectorContext(tenantId, scopeId, options?.timeoutMs ?? 30_000, event.id), event);
@@ -631,6 +728,15 @@ export class CloudflareScopeHost {
     async summarizeDenialsLocal(scopeId, filter) {
         return this.scopeStub(scopeId).summarizeDenials(filter);
     }
+    /**
+     * The operator's capability read's CP-less path (#1686) — the denial log's trust line: the
+     * directory rows live in the scope's own DO, in the vertical's deployment, reachable only
+     * through its platform-gated `/internal/capabilities`; the K-3 check and the K-24 entry are
+     * the control plane's, made before it calls. Records only — the DO's query selects no hash.
+     */
+    async listCapabilitiesLocal(scopeId, filter) {
+        return this.scopeStub(scopeId).listCapabilities(filter);
+    }
     /**
      * Copy one scope's data into a fresh scope DO, entirely within THIS deployment —
      * the data half of an orchestrated snapshot (preview-and-snapshots.md §9). Like the
@@ -642,7 +748,9 @@ export class CloudflareScopeHost {
      */
     async snapshotScopeLocal(sourceScopeId, destScopeId) {
         const tables = await this.scopeStub(sourceScopeId).exportDump();
-        await this.scopeStub(destScopeId).importDump(tables, destScopeId, { sourceScopeId, exact: true });
+        // #2009: a snapshot is a fork by construction (the control plane's row names `forkedFrom`, so
+        // the directory never calls it primary), and a load classifies nothing by itself: marked here.
+        await this.scopeStub(destScopeId).importDump(tables, destScopeId, { sourceScopeId, exact: true, markCopy: true });
         return { tables: tables.length };
     }
     /**
@@ -655,14 +763,131 @@ export class CloudflareScopeHost {
     /** #1742: the directory's recorded-off modules, switched off on THIS scope in the replay's
      *  own event — a dump from before a switch was pulled brings its grants back live. #1869:
      *  `sourceScopeId`, the scope the dump was captured from, narrows the grant re-point to it;
-     *  `exact` says the platform exported the dump itself, so the re-point never falls back. */
+     *  `exact` says the platform exported the dump itself, so the re-point never falls back.
+     *  #1722: `loadStamp`, the stamp a carry leaves on the copy it lands, for a fenced wipe later,
+     *  and `expect`, the marker the carry read here: the load is refused if the store moved since.
+     *  #2005: `markCopy` — the directory's classification of the scope, sent when it is not
+     *  primary; the restore then marks it a copy. Refused if it classifies a primary. */
     opts) {
-        const switchedOff = await this.scopeStub(scopeId).importDump(tables, scopeId, {
+        if (opts?.markCopy)
+            assertCopyLineage(opts.markCopy);
+        const load = {
             switchOff: opts?.switchedOff ? { moduleIds: opts.switchedOff, at: new Date().toISOString() } : undefined,
             sourceScopeId: opts?.sourceScopeId,
             exact: opts?.exact,
+            loadStamp: opts?.loadStamp,
+            markCopy: opts?.markCopy !== undefined,
+        };
+        // Both refusals come back as values (a throw over the RPC carries only its message) and are
+        // thrown here, in the vertical's own isolate, so its route answers 409 or 412, not a fault.
+        const out = await this.scopeStub(scopeId).importDumpChecked(tables, scopeId, {
+            ...load,
+            ...(opts?.expect ? { expect: opts.expect } : {}),
         });
-        return { tables: tables.length, ...(opts?.switchedOff ? { switchedOff } : {}) };
+        if (out.refused === false) {
+            return { tables: tables.length, ...(opts?.switchedOff ? { switchedOff: out.switchedOff } : {}) };
+        }
+        if (out.refused === 'kept')
+            throw substratError('conflict', KEPT_COPY_REFUSAL);
+        // A retry of a load that already committed (its answer was lost on the way back) is
+        // refused by the marker that load itself moved. The store holding THIS request's stamp
+        // says so: no other load writes it. Answered as applied, without `switchedOff`, so the
+        // caller's re-assert after the bind covers the OFF positions.
+        const now = await this.scopeStub(scopeId).loadMarker();
+        if (!opts?.loadStamp || now.loadStamp !== opts.loadStamp) {
+            throw substratError('precondition_failed', 'scope store changed since the carry read it; nothing was loaded (#1722)');
+        }
+        return { tables: tables.length };
+    }
+    /** The kept-copy marker of this scope's store in THIS deployment (#1722), or null. */
+    async keptCopyLocal(scopeId) {
+        return this.scopeStub(scopeId).keptCopy();
+    }
+    /**
+     * Discard the kept copy of a scope in THIS deployment (#1722), behind the vertical's
+     * `/internal/kept-copy/discard`: the staff resolution, only at the write revision the operator
+     * acted on. Answers whether it was discarded, or why not.
+     */
+    async discardKeptCopyLocal(scopeId, revision, carriedAway, 
+    /** #2005: the directory's classification, sent when the scope is not primary. */
+    markCopy, 
+    /** #1722 (Codex #2008 r13): the load stamp read with `revision`; a replaced store is refused. */
+    loadStamp) {
+        if (markCopy)
+            assertCopyLineage(markCopy);
+        return this.scopeStub(scopeId).discardKeptCopy(scopeId, revision, carriedAway, markCopy !== undefined, ...(loadStamp !== undefined ? [loadStamp] : []));
+    }
+    /**
+     * What a carry's restore into this scope's store expects to find unchanged (#1722), behind
+     * the vertical's `/internal/load-marker`. Read before the carry checks the binding again; the
+     * restore then carries it as `expect`, and is refused if the store was loaded or written since.
+     */
+    async loadMarkerLocal(scopeId) {
+        return this.scopeStub(scopeId).loadMarker();
+    }
+    /**
+     * Wipe the copy a carry left in THIS deployment (#1722), behind the vertical's
+     * `/internal/wipe-carried`: only if nothing was loaded into the scope's DO since the stamp
+     * the carry read (`expectLoadStamp`, null for a store no load has stamped). Non-terminal,
+     * so a later bind back to this version can restore into it. False when refused.
+     */
+    async wipeCarriedLocal(scopeId, expectLoadStamp, carriedAway, opts = {}) {
+        if (opts.markCopy)
+            assertCopyLineage(opts.markCopy);
+        return this.scopeStub(scopeId).wipeCarried(scopeId, expectLoadStamp, carriedAway, {
+            ...(opts.expectRevision !== undefined ? { expectRevision: opts.expectRevision } : {}),
+            ...(opts.protectIfChanged !== undefined ? { protectIfChanged: opts.protectIfChanged } : {}),
+            markCopy: opts.markCopy !== undefined,
+        });
+    }
+    /** Release a kept copy that is the live store after all (#1722), at the revision read. */
+    async releaseKeptCopyLocal(scopeId, revision, 
+    /** #2005: the directory's classification, sent when the scope is not primary. */
+    markCopy, 
+    /** #1722 (Codex #2008 r13): the load stamp read with `revision`; a replaced store is refused. */
+    loadStamp) {
+        if (markCopy)
+            assertCopyLineage(markCopy);
+        return this.scopeStub(scopeId).releaseKeptCopy(revision, markCopy !== undefined, ...(loadStamp !== undefined ? [loadStamp] : []));
+    }
+    /**
+     * Store the lifecycle the platform delivered for one scope in THIS deployment (#1713), behind
+     * the vertical's `/internal/lifecycle`. Kept unless the scope already holds a newer one, so a
+     * push that arrives late cannot undo a later transition. `applied` is what the platform's heal
+     * sweep records as delivered; `changed` says the gate's answer moved.
+     */
+    async setLifecycleLocal(scopeId, next) {
+        return lifecycleDelivery.parse(await this.scopeStub(scopeId).setLifecycle(scopeLifecycle.parse(next)));
+    }
+    /**
+     * Mark one scope in THIS deployment a copy (#2005), behind the vertical's `/internal/mark-copy`:
+     * the repair of a copy that predates the marker, which a CP-less coordinator reads for primacy.
+     * The control plane decides which scopes (its directory says they are not primary) and audits.
+     */
+    async markCopyLocal(scopeId, lineage) {
+        assertCopyLineage(lineage);
+        return { marked: await this.scopeStub(scopeId).markCopy() };
+    }
+    /**
+     * Clear a mistaken copy classification from one scope in THIS deployment (#2005), behind the
+     * vertical's `/internal/clear-copy-mark`: staff's correction for a scope the directory says IS
+     * primary. Refused for a scope classified a copy. A load's copied-events mark is never touched
+     * (#2009), so a primary restored from another scope's backup runs its own effects again and
+     * still never runs the work it copied.
+     */
+    async clearCopyMarkLocal(scopeId, lineage, 
+    /** #1722 (Codex #2008 r12–r13): the store as the caller means it, its load stamp and write
+     *  revision, compared in the clear's own transaction; refused (412) if either moved. The
+     *  platform's reconcile of a carry's destination sends it; staff send none. */
+    expect) {
+        if (!isPrimaryScope(lineage)) {
+            throw substratError('conflict', 'clear-copy-mark refused: the directory classifies this scope as a copy (a preview or a fork)');
+        }
+        const outcome = await this.scopeStub(scopeId).clearCopyMark(...(expect ? [expect] : []));
+        if (outcome === 'changed') {
+            throw substratError('precondition_failed', `clear-copy-mark refused: scope ${scopeId}'s store changed since its revision was read`);
+        }
+        return { cleared: outcome === 'cleared' };
     }
     /**
      * Re-apply the vertical's OWN role definitions to one scope, CP-lessly — the
@@ -699,6 +924,13 @@ export class CloudflareScopeHost {
     async exportScopeLocal(scopeId) {
         return this.scopeStub(scopeId).exportDump();
     }
+    /**
+     * `exportScopeLocal` with the store's load stamp, read in the same DO call (#1722): what a
+     * carry's fenced wipe of the copy it leaves here expects. Behind the vertical's `/internal/export`.
+     */
+    async exportScopeStampedLocal(scopeId) {
+        return this.scopeStub(scopeId).exportDumpStamped();
+    }
     /** Facet this host's own scope's outbox (#1239) — the vertical-host read. */
     async facetEventsLocal(scopeId, input) {
         return this.scopeStub(scopeId).facetEvents(input);
@@ -845,9 +1077,14 @@ export class CloudflareScopeHost {
             throw new Error(`${manifest.id} declares operationInputs for unbound operation(s): ` +
                 `${unboundInputs.sort().join(', ')} — a schema on nothing reads as a parse that is not there`);
         }
+        const binding = {
+            moduleId: manifest.id,
+            entitlementKey: manifest.entitlementKey,
+            scheduledOperations: new Set((manifest.schedules ?? []).map((sch) => sch.operation)),
+        };
         for (const name of Object.keys(registration.operations ?? {})) {
             this.bindOperation(name);
-            this.operationEntitlement.set(name, manifest.entitlementKey);
+            this.operationEntitlement.set(name, binding);
         }
     }
     defineOperation(name, _handler) {
@@ -1049,7 +1286,7 @@ export class CloudflareScopeHost {
         // gates and metadata facts live in the ScopeDO (per-scope serialization, spine event
         // in the same transaction); bytes go straight to the per-tenant R2 bucket through the
         // binding the vertical's worker resolved — never through the DO.
-        await this.validateScopeAccess(tenantId, scopeId);
+        await this.assertLive(tenantId, scopeId);
         await this.migrateAndRecord(scopeId);
         const store = await this.resolveAttachmentStore(tenantId);
         return this.buildAttachmentSurface({ principal }, tenantId, scopeId, store);
@@ -1122,17 +1359,14 @@ export class CloudflareScopeHost {
         const store = await this.resolveAttachmentStore(conn.tenant_id);
         return this.buildAttachmentSurface({ connectionId }, conn.tenant_id, scopeId, store, forEvent);
     }
-    /** Resolve the per-tenant R2 blob store, or fail closed exactly as `attachments` did. */
+    /** Resolve the per-tenant R2 blob store, or fail closed. */
     async resolveAttachmentStore(tenantId) {
-        if (!this.attachmentBuckets) {
-            throw new Error(`attachments are not configured on this host (#473): pass ` +
-                `CloudflareScopeHostOptions.attachmentBuckets — (tenantId) => ` +
-                `env[blobStoreBindingName('<BINDING>', tenantId)] for the vertical's declared blob store`);
-        }
         const bucket = await this.attachmentBuckets(tenantId);
         if (!bucket) {
-            throw new Error(`no attachment bucket resolved for tenant ${tenantId} (#473) — is the per-tenant blob ` +
-                `store provisioned and its r2_bucket binding attached to the serving script?`);
+            throw new Error(`no attachment bucket resolved for tenant ${tenantId} (#473, #1995) — this script has no ` +
+                `${blobStoreBindingName(ATTACHMENT_BLOB_BINDING, tenantId)} binding. A vertical whose modules declare ` +
+                `attachmentTargets gets one per installed tenant once it is pushed with a CLI that declares the ` +
+                `store (re-push); off the platform, pass CloudflareScopeHostOptions.attachmentBuckets.`);
         }
         return r2TenantBlobStore(bucket);
     }
@@ -1365,7 +1599,7 @@ export class CloudflareScopeHost {
     async getScope(principal, tenantId, scopeId, options) {
         // Lifecycle gates (control-plane.md §4.1/§4.2), the K-3 fail-closed path,
         // evaluated durably in the ControlPlaneDO. A throw propagates here.
-        await this.validateScopeAccess(tenantId, scopeId);
+        await this.assertLive(tenantId, scopeId);
         await this.migrateAndRecord(scopeId);
         return this.buildStub(tenantId, scopeId, principal, undefined, undefined, options);
     }
@@ -1440,7 +1674,7 @@ export class CloudflareScopeHost {
         const record = await this.resolveImpersonation(session, tenantId, scopeId);
         // The same lifecycle gate the principal door applies: a suspended tenant
         // refuses a support session exactly as it refuses a user.
-        await this.validateScopeAccess(tenantId, scopeId);
+        await this.assertLive(tenantId, scopeId);
         await this.migrateAndRecord(scopeId);
         return this.buildStub(tenantId, scopeId, record.principal, undefined, undefined, options, record.id);
     }
@@ -1454,7 +1688,7 @@ export class CloudflareScopeHost {
         if (!this.moduleIds.has(moduleId)) {
             throw new Error(`module not registered on this host: ${moduleId}`);
         }
-        await this.validateScopeAccess(tenantId, scopeId);
+        await this.assertLive(tenantId, scopeId);
         await this.migrateAndRecord(scopeId);
         return this.buildStub(tenantId, scopeId, undefined, undefined, moduleId);
     }
@@ -1487,7 +1721,7 @@ export class CloudflareScopeHost {
      * capability row lives. The answer is re-parsed on this side of the RPC.
      */
     async exchangeCapability(tenantId, scopeId, secret, options) {
-        await this.validateScopeAccess(tenantId, scopeId);
+        await this.assertLive(tenantId, scopeId);
         await this.migrateAndRecord(scopeId);
         const outcome = await this.scopeStub(scopeId).exchangeCapability(secret, tenantId, scopeId, options?.mode);
         return capabilityExchange.nullable().parse(outcome);
@@ -1501,7 +1735,7 @@ export class CloudflareScopeHost {
         if (!plausibleSessionToken(sessionToken)) {
             throw substratError('unauthenticated', 'not a capability session token');
         }
-        await this.validateScopeAccess(tenantId, scopeId);
+        await this.assertLive(tenantId, scopeId);
         await this.migrateAndRecord(scopeId);
         const hash = await capabilityTokenHash(sessionToken);
         return this.buildStub(tenantId, scopeId, undefined, undefined, undefined, options, undefined, hash);
@@ -1577,7 +1811,7 @@ export class CloudflareScopeHost {
             }
             this.assertServedHere(record, scopeId, verb);
         }
-        await this.validateScopeAccess(tenantId, scopeId);
+        await this.assertLive(tenantId, scopeId);
         await this.migrateAndRecord(scopeId);
     }
     /**
@@ -1590,7 +1824,7 @@ export class CloudflareScopeHost {
         if (!plausibleSessionToken(sessionToken)) {
             throw substratError('unauthenticated', 'not a capability session token');
         }
-        await this.validateScopeAccess(tenantId, scopeId);
+        await this.assertLive(tenantId, scopeId);
         await this.migrateAndRecord(scopeId);
         const store = await this.resolveAttachmentStore(tenantId);
         const capabilitySession = await capabilityTokenHash(sessionToken);
@@ -1687,6 +1921,10 @@ export class CloudflareScopeHost {
             if (!rec || rec.status !== 'active')
                 return report;
         }
+        else if (await this.lifecycleHeld(scopeId)) {
+            // #1713: a held scope emits nothing, so judging it stale would only raise a false alarm.
+            return report;
+        }
         const stub = this.scopeStub(scopeId);
         const windows = new Map();
         for (const specs of this.moduleFreshness.values()) {
@@ -1725,14 +1963,23 @@ export class CloudflareScopeHost {
             return report;
         // Only run on a live scope of this tenant; a scope archived between the sweep's
         // enumeration and here simply has nothing due. A CP-less host has no directory
-        // to ask (#461) — it already trusts the router-asserted (tenant, scope) for the
-        // whole request path, and lifecycle for its scopes lives wherever provisioning
-        // does, so the grant check below is the only gate it can and does enforce.
+        // to ask (#461), so it reads the lifecycle the platform delivered to the scope (#1713).
         if (!this.cpLess) {
             const rec = await this.cp.getScopeRecord(tenantId, scopeId);
             if (!rec || rec.status !== 'active')
                 return report;
         }
+        else if (await this.lifecycleHeld(scopeId)) {
+            // #1713: the lifecycle the platform delivered holds the scope. Every schedule is
+            // `skipped` and no cadence row moves, as under the kill switch, so a schedule that
+            // came due meanwhile fires once on the first pass after the scope is live again.
+            for (const schedule of schedules) {
+                report.skipped += 1;
+                report.runs.push({ operation: schedule.operation, outcome: 'skipped' });
+            }
+            report.lifecycleHeld = true;
+            return report;
+        }
         const stub = this.scopeStub(scopeId);
         // The grant IS the switch (#383), and the kill switch is its lever (#1666): the
         // kernel's `systemScheduleState`, the one predicate both adapters run. A scope that
@@ -1756,6 +2003,7 @@ export class CloudflareScopeHost {
             return report;
         }
         const now = Date.now();
+        const lines = asyncLinePass();
         for (const schedule of schedules) {
             const last = await stub.scheduleLastRun(schedule.operation);
             const lastRun = last ? Date.parse(last) : null;
@@ -1770,24 +2018,43 @@ export class CloudflareScopeHost {
             // produces either way carries it, and so does the row below.
             const invocationId = ulid();
             let status = 'ok';
+            // #1901: the run's line, under the call's own id — the one its `ctx.log` lines carry.
+            const startedAt = Date.now();
+            let emitted;
+            let failure;
             try {
                 const scope = await this.getSystemScope(moduleId, tenantId, scopeId);
-                await scope.invoke(schedule.operation, schedule.input, { invocationId });
+                await scope.invoke(schedule.operation, schedule.input, { invocationId, onEmitted: (r) => (emitted = r) });
                 report.fired += 1;
             }
             catch (err) {
                 status = 'failed';
+                failure = { error: err };
                 report.failed += 1;
                 report.errors.push({
                     operation: schedule.operation,
                     error: err instanceof Error ? err.message : String(err),
                 });
             }
+            lines.write({
+                kind: 'schedule',
+                tenantId,
+                scopeId,
+                invocationId,
+                operation: schedule.operation,
+                startedAt,
+                outcome: status,
+                ...failure,
+                dueAt: lastRun === null ? null : new Date(dueAt).toISOString(),
+                latenessMs: lastRun === null ? null : now - dueAt,
+                ...(emitted ? { emitted } : {}),
+            });
             // #1288: 'schedule', whatever this operation happens to be called — including
             // `freshness:<something>`, which is exactly the row the evaluator no longer eats.
             await stub.recordScheduleRun(schedule.operation, new Date(now).toISOString(), status, 'schedule', invocationId);
             report.runs.push({ operation: schedule.operation, outcome: status === 'ok' ? 'ok' : 'failed' });
         }
+        lines.end();
         return report;
     }
     /** The stub body, shared by the principal, connection, system and impersonation doors. */
@@ -1848,7 +2115,13 @@ export class CloudflareScopeHost {
                 // (`cp.tenantHoldsEntitlement`); for a hosted/CP-less scope that call is a trusting
                 // no-op, so the SAME `requiredKey` is passed to the DO, which fails closed against
                 // its PROJECTED entitlements (#304). One or the other enforces, never neither.
-                const requiredKey = operationEntitlement.get(operation);
+                //
+                // EXCEPTION (#1654): a module's own declared schedule, through this system door,
+                // demands no SKU — its `system:<moduleId>` grant is the switch, as it already is for
+                // permissions (#383). `requiredEntitlementFor` holds the whole rule and why; it
+                // answers `undefined` there, so neither the coordinator nor the DO asks. Every other
+                // door passes no `systemModuleId` and is gated exactly as before.
+                const requiredKey = requiredEntitlementFor(operation, operationEntitlement.get(operation), systemModuleId);
                 if (requiredKey && !(await cp.tenantHoldsEntitlement(tenantId, requiredKey))) {
                     // Required AND held (#691) — a second CP read, but only on the denial path.
                     const now = new Date().toISOString();
@@ -2103,6 +2376,8 @@ export class CloudflareScopeHost {
             // returns it with the previous status, so the trail cannot disagree with
             // the directory about which deployment the action touched.
             await this.recordAdmin(actor, action, { tenantId, scopeId, vertical: before.vertical }, { status: before.status }, { status: to, ...afterExtra });
+            // #1713: after the directory moved and the move was audited, never before or instead.
+            await this.deliverLifecycles(actor, { scopeId });
         };
         const writeGrant = async (subject, permission, node, entity, expiresAt) => {
             if (entity) {
@@ -3032,7 +3307,7 @@ export class CloudflareScopeHost {
                 if (!v)
                     throw substratError('not_found', `unknown version ${versionId}`);
                 if (v.admission === 'admitted') {
-                    throw new Error(`version ${versionId} is already admitted — it may be bound`);
+                    throw substratError('conflict', `version ${versionId} is already admitted — it may be bound`);
                 }
                 if (v.admission === 'rejected')
                     return;
@@ -3044,7 +3319,7 @@ export class CloudflareScopeHost {
                 if (!incoming)
                     throw substratError('not_found', `unknown version ${versionId}`);
                 if (incoming.vertical_slug !== verticalSlug) {
-                    throw new Error(`version ${versionId} belongs to '${incoming.vertical_slug}'`);
+                    throw substratError('conflict', `version ${versionId} belongs to '${incoming.vertical_slug}'`);
                 }
                 if (incoming.admission !== 'admitted') {
                     throw substratError('conflict', `version ${versionId} is ${incoming.admission}, not admitted — it cannot be promoted`);
@@ -3104,7 +3379,7 @@ export class CloudflareScopeHost {
                 if (channel === 'prod' && !incoming.deployment_ref) {
                     const owning = await this.cp.readVertical(verticalSlug);
                     if (owning && owning.owner_tenant !== null && !owning.listed) {
-                        const bound = (await this.cp.listScopes({ tenantId: owning.owner_tenant, vertical: verticalSlug, status: ['active'] })).filter((s) => !s.forked_from && s.kind !== 'preview');
+                        const bound = (await this.cp.listScopes({ tenantId: owning.owner_tenant, vertical: verticalSlug, status: ['active'] })).filter(isPrimaryScopeRow);
                         for (const s of bound) {
                             if (s.vertical_version_id === versionId)
                                 continue;
@@ -3262,6 +3537,12 @@ export class CloudflareScopeHost {
                 await this.cp.setScopeServingRef(scopeId, servingRef);
                 await this.recordAdmin(actor, 'setScopeServingRef', { tenantId, scopeId }, { servingRef: scope.serving_ref ?? null }, { servingRef, ...(ack.exportBreak ? { acknowledged: ack } : {}) });
             },
+            recordKeptCopyResolution: async (actor, tenantId, scopeId, r) => {
+                const scope = await this.cp.getScopeRecord(tenantId, scopeId);
+                if (!scope)
+                    throw substratError('not_found', `unknown scope ${scopeId} in tenant ${tenantId}`);
+                await this.recordAdmin(actor, 'resolveKeptCopy', { tenantId, scopeId }, { script: r.script, keptAt: r.keptAt, revision: r.revisionBefore }, { action: r.action, liveScript: r.liveScript, revision: r.revisionAfter });
+            },
             setScopeExpiresAt: async (actor, tenantId, scopeId, expiresAt) => {
                 const scope = await this.cp.getScopeRecord(tenantId, scopeId);
                 if (!scope)
@@ -3366,6 +3647,8 @@ export class CloudflareScopeHost {
             setTenantStatus: async (actor, tenantId, status) => {
                 const before = await this.cp.setTenantStatus(tenantId, status);
                 await this.recordAdmin(actor, 'setTenantStatus', { tenantId }, { status: before }, { status });
+                // #1713: every hosted scope under the tenant holds or resumes its work by this.
+                await this.deliverLifecycles(actor, { tenantId });
             },
             setTenantName: async (actor, tenantId, name) => {
                 const before = await this.cp.setTenantName(tenantId, name);
@@ -3660,6 +3943,26 @@ export class CloudflareScopeHost {
                 await this.recordAccess(actor, 'listDenials', { tenantId, scopeId }, filter ?? null, rows.length);
                 return rows;
             },
+            // #1686: the operator's capability read. K-3 on the directory before the DO, like the
+            // denial log. On the shared control plane a scope a vertical's own deployment serves
+            // holds its storage THERE, and this namespace holds a placeholder: the control-plane
+            // API asks the vertical (`listCapabilitiesLocal`), so this branch is the co-located one.
+            listCapabilities: async (actor, tenantId, scopeId, filter) => {
+                // Parsed here too: a typed refusal thrown inside the DO arrives as a bare message.
+                const parsed = capabilityFilter.parse(filter ?? {});
+                const rec = await this.scopeRecordForRead(tenantId, scopeId);
+                this.assertServedHere(rec, scopeId, 'listCapabilities');
+                const page = await this.scopeStub(scopeId).listCapabilities(parsed);
+                await this.recordAccess(actor, 'listCapabilities', { tenantId, scopeId }, filter ?? null, page.entries.length);
+                return page;
+            },
+            listRefusals: async (actor, tenantId, scopeId, filter) => {
+                // #1745: the denial log's discipline — K-3 on the directory before the DO is reached.
+                await this.scopeRecordForRead(tenantId, scopeId);
+                const rows = await this.scopeStub(scopeId).listRefusals(filter);
+                await this.recordAccess(actor, 'listRefusals', { tenantId, scopeId }, filter ?? null, rows.length);
+                return rows;
+            },
             summarizeDenials: async (actor, tenantId, scopeId, filter) => {
                 await this.scopeRecordForRead(tenantId, scopeId);
                 const summary = await this.scopeStub(scopeId).summarizeDenials(filter);
@@ -4218,6 +4521,11 @@ export class CloudflareScopeHost {
                 const { tenantId, scopeId, ...after } = ownerTransferAudit.parse(entry);
                 await this.recordAdmin(actor, 'transferOwner', { tenantId, scopeId }, null, after);
             },
+            /** #2005: one change to a scope's copy marker, written around the vertical's own change. */
+            recordCopyMark: async (actor, entry) => {
+                const { tenantId, scopeId, action, ...after } = copyMarkAudit.parse(entry);
+                await this.recordAdmin(actor, action === 'mark' ? 'markScopeCopy' : 'clearScopeCopyMark', { tenantId, scopeId }, null, after);
+            },
             accessLog: async (actor, filter) => {
                 const rows = await this.cp.accessLog({
                     actor: filter?.actor,
@@ -4439,6 +4747,184 @@ export class CloudflareScopeHost {
             return;
         throw refusal.code ? substratError(refusal.code, refusal.message) : new Error(refusal.message);
     }
+    /**
+     * THE lifecycle gate (#1713) at every door that runs a scope's work: a request's stubs and
+     * attachments, a capability or impersonation session, a peer call or delivery, a subscription,
+     * and the entry points no request asked for — the retry driver, the job runner, a schedule's
+     * system stub, a routed connector delivery.
+     *
+     * `validateScopeAccess` first, which is the directory's gate where there is a directory. A
+     * CP-less host has none, so it then reads the lifecycle the platform delivered to the scope's
+     * own storage (`/internal/lifecycle`), judged by the kernel's `lifecycleRefusal` in the
+     * directory's own words. The router refuses a suspended scope's requests first (#1730); this
+     * is the deployment's own half, and the only one a timer or a retry ever meets.
+     *
+     * The admin and diagnostic reads (dead letters, job runs, platform requests, delivered
+     * grants) keep `validateScopeAccess` alone: an operator still reads a suspended scope.
+     */
+    async assertLive(tenantId, scopeId) {
+        await this.validateScopeAccess(tenantId, scopeId);
+        const refusal = await this.cpLessRefusal(scopeId, { tenantId, scopeId });
+        if (refusal)
+            throw new Error(refusal);
+    }
+    /** The delivered lifecycle's refusal on a CP-less host (#1713); always null with a directory. */
+    async cpLessRefusal(scopeId, ids) {
+        if (!this.cpLess)
+            return null;
+        return lifecycleRefusal(await this.scopeStub(scopeId).lifecycle(), ids);
+    }
+    /**
+     * Deliver the directory's lifecycle to the deployments serving the matching scopes (#1713):
+     * one scope after its transition, a tenant's scopes after the tenant's, or the heal sweep's
+     * drift. Each delivery carries the directory's revisions, read in the same query as the
+     * statuses, so a late one cannot undo a later transition: the deployment keeps only a delivery
+     * strictly newer than the one it holds.
+     *
+     * Never throws. A transition is the operator's lever in an incident, and the router refuses
+     * the scope's requests as soon as the directory moves (#1730), so a deployment that cannot be
+     * reached must not refuse the lever. Each failure is an ops-failure row, no receipt is written,
+     * and the heal sweep delivers again.
+     */
+    async deliverLifecycles(actor, filter) {
+        const report = { attempted: 0, delivered: 0, failed: 0 };
+        const delegation = this.lifecycleDelegation;
+        if (!delegation || this.cpLess)
+            return report;
+        let targets;
+        try {
+            targets = await this.cp.lifecycleTargets(filter);
+        }
+        catch (err) {
+            console.error('substrat: could not read the scopes to deliver a lifecycle to (#1713)', err);
+            return report;
+        }
+        for (const first of targets) {
+            const tenantId = first.tenant_id;
+            const scopeId = first.scope_id;
+            let t = first;
+            let lifecycle = this.lifecycleOfTarget(t);
+            if (!lifecycle) {
+                // A status this code does not know (a newer directory): delivering a guess could lift a hold.
+                report.failed += 1;
+                console.error(`substrat: scope ${scopeId} has a lifecycle this code cannot read (#1713)`);
+                continue;
+            }
+            // A live scope whose deployment already acknowledged exactly this has nothing to receive,
+            // and neither does one with no receipt in a directory never restored: a deployment holding
+            // no lifecycle runs live. That keeps an activation, and every transition before a
+            // deployment carries the route, from posting a delivery that changes nothing. After a
+            // restore (epoch > 0) no receipt says nothing about what the deployment holds, so it is
+            // delivered. A HOLD is always delivered.
+            if (lifecycleRefusal(lifecycle) === null && (t.delivered === null ? t.epoch === 0 : t.delivered === lifecycleReceipt(lifecycle))) {
+                continue;
+            }
+            report.attempted += 1;
+            try {
+                let answer = await delegation.deliver({ tenantId, scopeId, lifecycle });
+                // SINGLE AUTHORITY (the invariant this rests on): an environment has exactly one directory,
+                // the singleton `CONTROL_PLANE.idFromName('control-plane')`. A "fresh directory" restore is
+                // that same object restored after its storage was lost, never a second live writer, and
+                // the raise below always re-reads the CURRENT store and delivers what it says. Two control
+                // planes healing one dispatch namespace at once is a split brain that corrupts far more
+                // than lifecycle, and is out of scope here; fencing it in lifecycle alone would guarantee
+                // nothing.
+                //
+                // The scope refused us as OLDER while holding a revision this directory's history did not
+                // write: an epoch ahead of ours, or ours with other counters. Only another history of the
+                // directory delivers those — the one a fresh-directory restore replaced, whose epoch a
+                // clock running behind (or a restore in the same millisecond) cannot outrank. A scope only
+                // ever holds epochs a directory minted, so this directory learns past it: its epoch is
+                // raised above the one held (monotonic, one statement), and the scope is delivered again.
+                const held = answer.lifecycle.revision;
+                const foreign = !answer.applied &&
+                    held !== undefined &&
+                    (held.epoch > lifecycle.revision.epoch ||
+                        (held.epoch === lifecycle.revision.epoch && lifecycleReceipt(answer.lifecycle) !== lifecycleReceipt(lifecycle)));
+                // Bounded, because the deployment answering is the vertical's own code: only a directory
+                // that has been restored can meet another history (epoch > 0), and a legitimate epoch is
+                // a mint time, so one further ahead than the skew is forged or broken. Either way nothing
+                // is raised; the refusal is an ops failure for an operator to look at.
+                if (foreign && (lifecycle.revision.epoch === 0 || held.epoch > Date.now() + LIFECYCLE_EPOCH_SKEW_MS)) {
+                    report.failed += 1;
+                    await this.admin
+                        .recordOpsFailure({
+                        actor,
+                        operation: 'scope.lifecycle',
+                        stage: 'foreign-epoch',
+                        tenantId,
+                        scopeId,
+                        message: `the deployment refused this directory's lifecycle while holding epoch ${held.epoch} ` +
+                            `(this directory is at ${lifecycle.revision.epoch}); not raised past it — ` +
+                            (lifecycle.revision.epoch === 0
+                                ? 'this directory has never been restored, so no other history should have written it'
+                                : 'it is further ahead of the clock than any directory mints'),
+                    })
+                        .catch((e) => console.error('substrat: could not record a foreign lifecycle epoch (#1713)', e));
+                    continue;
+                }
+                if (foreign) {
+                    await this.cp.raiseLifecycleEpoch(held.epoch + 1);
+                    const [again] = await this.cp.lifecycleTargets({ scopeId });
+                    const next = again ? this.lifecycleOfTarget(again) : null;
+                    if (again && next) {
+                        t = again;
+                        lifecycle = next;
+                        answer = await delegation.deliver({ tenantId, scopeId, lifecycle });
+                    }
+                }
+                // The receipt is what the scope HOLDS: a newer delivery it kept instead is the truth.
+                await this.cp.recordLifecycleReceipt(scopeId, lifecycleReceipt(answer.lifecycle), new Date().toISOString());
+                report.delivered += 1;
+            }
+            catch (err) {
+                report.failed += 1;
+                try {
+                    await this.admin.recordOpsFailure({
+                        actor,
+                        operation: 'scope.lifecycle',
+                        stage: 'deliver',
+                        tenantId,
+                        scopeId,
+                        message: `the lifecycle (scope ${t.scope_status}, tenant ${t.tenant_status}) did not reach the ` +
+                            `deployment serving this scope; the heal sweep will deliver it again: ${err instanceof Error ? err.message : String(err)}`,
+                    });
+                }
+                catch (recordErr) {
+                    console.error('substrat: could not record a lifecycle delivery failure (#1713)', recordErr);
+                }
+            }
+        }
+        return report;
+    }
+    /** One directory row as the lifecycle a delivery carries (#1713), or null for a status this code does not know. */
+    lifecycleOfTarget(t) {
+        const parsed = scopeLifecycle.safeParse({
+            scope: t.scope_status,
+            tenant: t.tenant_status,
+            at: new Date().toISOString(),
+            revision: { epoch: t.epoch, scope: t.scope_rev, tenant: t.tenant_rev },
+        });
+        return parsed.success ? parsed.data : null;
+    }
+    /**
+     * The heal sweep (#1713): deliver the lifecycle to every hosted scope whose deployment's
+     * acknowledged state differs from the directory, and again to every scope held now — which is
+     * what puts a hold back on a store a carry or a restore landed without it. Bounded per pass
+     * (`limit`), drifted scopes first. Run from the shared control plane's cron.
+     */
+    async healLifecycles(actor, opts) {
+        return this.deliverLifecycles(actor, { drift: true, limit: opts?.limit ?? 200 });
+    }
+    /**
+     * Whether a CP-less host holds this scope's work (#1713): `assertLive`'s predicate, answered
+     * rather than thrown, for the entry points that defer instead of refusing — a sweep pass, a
+     * schedule run, an executor drain. Always false on a host with a directory, whose entry
+     * points ask the directory themselves.
+     */
+    async lifecycleHeld(scopeId) {
+        return (await this.cpLessRefusal(scopeId)) !== null;
+    }
     /**
      * K-3's cross-check on its own: the (tenant, scope) pair must exist and agree before a
      * subject-key operation touches anything. Without it a caller could reach another
@@ -4955,16 +5441,16 @@ export class CloudflareScopeHost {
              * suspended or archiving scope could still be addressed and handed a 101 — a
              * scope that refuses every ordinary read while quietly holding an open socket.
              *
-             * Costs a CP-less vertical nothing: `validateScopeAccess` is a **no-op** on the
-             * null control plane (the router already gated lifecycle and tenancy from the
-             * shared directory), so this is the hosted-vertical shape unchanged.
+             * On a CP-less vertical, `validateScopeAccess` is a no-op on the null control
+             * plane, and `assertLive` reads the lifecycle the platform delivered to the
+             * scope's own storage instead (#1713).
              *
              * `migrateAndRecord`, not the DO's own `ensureMigrations`: the DO migrates
              * itself when the socket opens either way, but only this reports the applied
              * count to the directory — so a scope whose first contact after a deploy is a
              * subscription does not go dark in the migration fleet view.
              */
-            await this.validateScopeAccess(tenantId, scopeId);
+            await this.assertLive(tenantId, scopeId);
             await this.migrateAndRecord(scopeId);
             // Asserted, not carried through from the client: the principal is the
             // vertical's own resolution of its session, and the tenant and scope are the
@@ -5327,14 +5813,19 @@ export class CloudflareScopeHost {
     // side before the call; what runs HERE is the half only this deployment can
     // enforce: the scope's own permission check against its delivered
     // `connection:<id>` tuple, in the scope's own DO. Fail closed — no grant, no
-    // effect — exactly as for any other caller.
+    // effect — exactly as for any other caller. And the lifecycle delivered to the
+    // scope (#1713): a held scope's invoke and bytes doors refuse, as every other door does.
     /** Invoke ONE operation in this deployment as a CONNECTION (#574). */
     async connectorInvokeLocal(connectionId, tenantId, scopeId, operation, input) {
+        await this.assertLive(tenantId, scopeId); // #1713: a held scope runs no connector work either
         await this.migrateAndRecord(scopeId);
         return this.buildStub(tenantId, scopeId, undefined, connectionId).invoke(operation, input);
     }
     /** Land provider bytes in this deployment as a CONNECTION — the bytes leg (#574). */
     async connectorAttachmentUploadLocal(connectionId, tenantId, scopeId, upload) {
+        // The lifecycle gate every attachments door takes (#1713), ahead of the bucket: a held
+        // scope's provider bytes wait for the delivery's retry rather than land (#1995).
+        await this.assertLive(tenantId, scopeId);
         await this.migrateAndRecord(scopeId);
         const store = await this.resolveAttachmentStore(tenantId);
         return this.buildAttachmentSurface({ connectionId }, tenantId, scopeId, store).upload(upload);
@@ -5347,6 +5838,8 @@ export class CloudflareScopeHost {
      * so a caller falls back rather than failing a dispatch over a missing file.
      */
     async connectorAttachmentOpenLocal(connectionId, tenantId, scopeId, attachmentId, eventId) {
+        // Same gate as the upload leg: a held scope's bytes are not read out of its bucket.
+        await this.assertLive(tenantId, scopeId);
         await this.migrateAndRecord(scopeId);
         const store = await this.resolveAttachmentStore(tenantId);
         return this.buildAttachmentSurface({ connectionId }, tenantId, scopeId, store,