@substrat-run/adapter-cloudflare 0.134.0 → 0.136.0

package/dist/scope-do.js

@@ -1,13 +1,13 @@
 import { REWIND_REFUSED } from './rewind-refusal.js';
 import { DurableObject } from 'cloudflare:workers';
-import { ATTACHMENT_ADDED, ATTACHMENT_REMOVED, attachmentRecord, domainEvent, domainEventInput, eventId, instant, objectRef, entityObjectRef, assertModuleEmittableType, assertKernelAuthoredType, toWireFailure, grantRefFromProof, principalId, scopeId as scopeIdOf, tenantId as tenantIdOf, platformRequestInput, platformRequestId, MAX_PENDING_PLATFORM_REQUESTS, MAX_PENDING_SWEEP_RUNS, SWEEP_RUNS_KIND, SCOPE_TABLE_PAGE_MAX, SCOPE_QUERY_ROW_MAX, listLimitOf, requestFingerprint, substratError, assertReplayableDump, REDRAIN_BATCH, } from '@substrat-run/contracts';
-import { ulid, DO_SQL_LIMITS, unknownRoleError, createUlid, assertAllowed, ConnectionSealingKeyUnavailableError, noSealingKeyMessage, sealTo, assertReadOnlyQuery, entitlementDenial, platformRequestHistoryQuery, platformRequestOf, PLATFORM_REQUEST_COLUMNS, PLATFORM_REQUEST_REDACTION_SQL, platformRequestRedactionParams, platformRequestRedactionQuery, intentPayloadCarriesSubject, redactSubjectJobRuns, redactSubjectScopeText, assertRowLimit, assertRowOffset, JOB_RUN_PATCH_SQL, JOB_STEP_RECORD_SQL, DELIVERY_ERROR_REDACTION_SQL, REDACTED_DELIVERY_NOTE, seatScopeTuple, effectiveRoleGrantQuery, switchRecordedOff, switchSystemSchedules, peerGrantsStatus, systemGrantsStatus, systemScheduleState, systemSwitchedOff, denialListQuery, denialSummaryQuery, denialTotalsQuery, DENIAL_WINDOW_QUERY, mapDenialRow, mapDenialSummaryBuckets, PermissionDenied, assertImpersonationWrites, assertModuleEnqueueableKind, impersonationStampOf, createAtomic, NotSearchable, isSearchIndexTable, searchIndexDdl, searchIndexPlans, NotListable, listIndexPlans, moduleMigrations, listQuery, cursorOf, searchLimit, searchMatchExpression, searchQuery, ATTACHMENT_TEXT_DDL, attachmentRecordOfRow, enqueueAttachmentText, reconcileAttachmentText, recordAttachmentText, searchAttachments, IDEMPOTENCY_DDL, REFUSALS_DDL, refusalInsert, refusedTransitionOf, assertIdempotencyKey, assertPermissionKey, idempotencyLookupQuery, idempotencyPruneStatement, idempotencyRecordStatement, idempotencyOptedOutMessage, replayFor, entityVersionQuery, entityVersionOf, assertIfMatch, OUTBOX_ENTITY_INDEX, SCHEDULE_STATE_DDL, SCHEDULE_STATE_REBUILD, scheduleStateHasKind, VERTICAL_EVENTS_DDL, EXPORT_HOPS_SQL, IMPORT_CURSORS_SQL, IMPORT_CURSOR_OF_SQL, OUTBOX_MARK_SQL, exportedSinceQuery, emittedSinceQuery, emittedReportOf, EMITTED_REPORT_CAP, IMPORT_CURSOR_ADVANCE_SQL, IMPORT_RECORD_SQL, moveImportCursor, CrossVerticalRegistry, exportReadPlan, exportReadQuery, planExportBatch, withheldNote, JOB_RUN_DDL, jobRunListLimit, } from '@substrat-run/kernel';
+import { ATTACHMENT_ADDED, ATTACHMENT_REMOVED, attachmentRecord, domainEvent, domainEventInput, eventId, instant, objectRef, entityObjectRef, assertModuleEmittableType, assertKernelAuthoredType, toWireFailure, grantRefFromProof, principalId, scopeId as scopeIdOf, tenantId as tenantIdOf, platformRequestInput, platformRequestId, MAX_PENDING_PLATFORM_REQUESTS, MAX_PENDING_SWEEP_RUNS, SWEEP_RUNS_KIND, SCOPE_TABLE_PAGE_MAX, SCOPE_QUERY_ROW_MAX, listLimitOf, requestFingerprint, substratError, errorCodeOf, assertReplayableDump, REDRAIN_BATCH, } from '@substrat-run/contracts';
+import { ulid, DO_SQL_LIMITS, unknownRoleError, createUlid, assertAllowed, ConnectionSealingKeyUnavailableError, noSealingKeyMessage, sealTo, assertReadOnlyQuery, entitlementDenial, platformRequestHistoryQuery, platformRequestOf, PLATFORM_REQUEST_COLUMNS, PLATFORM_REQUEST_REDACTION_SQL, platformRequestRedactionParams, platformRequestRedactionQuery, intentPayloadCarriesSubject, redactSubjectJobRuns, redactSubjectScopeText, assertRowLimit, assertRowOffset, JOB_RUN_PATCH_SQL, JOB_STEP_RECORD_SQL, DELIVERY_ERROR_REDACTION_SQL, REDACTED_DELIVERY_NOTE, seatScopeTuple, effectiveRoleGrantQuery, switchRecordedOff, switchSystemSchedules, peerGrantsStatus, systemGrantsStatus, systemScheduleState, systemSwitchedOff, denialListQuery, refusalListQuery, mapRefusalRow, denialSummaryQuery, denialTotalsQuery, DENIAL_WINDOW_QUERY, mapDenialRow, mapDenialSummaryBuckets, PermissionDenied, assertImpersonationWrites, assertModuleEnqueueableKind, impersonationStampOf, createAtomic, NotSearchable, isSearchIndexTable, searchIndexDdl, searchIndexPlans, NotListable, listIndexPlans, moduleMigrations, listQuery, cursorOf, searchLimit, searchMatchExpression, searchQuery, ATTACHMENT_TEXT_DDL, attachmentRecordOfRow, enqueueAttachmentText, reconcileAttachmentText, recordAttachmentText, searchAttachments, IDEMPOTENCY_DDL, REFUSALS_DDL, refusalInsert, refusedTransitionOf, assertIdempotencyKey, assertPermissionKey, idempotencyLookupQuery, idempotencyPruneStatement, idempotencyRecordStatement, idempotencyOptedOutMessage, replayFor, entityVersionQuery, entityVersionOf, assertIfMatch, OUTBOX_ENTITY_INDEX, SCHEDULE_STATE_DDL, SCHEDULE_STATE_REBUILD, scheduleStateHasKind, VERTICAL_EVENTS_DDL, EXPORT_HOPS_SQL, IMPORT_CURSORS_SQL, IMPORT_CURSOR_OF_SQL, OUTBOX_MARK_SQL, exportedSinceQuery, emittedSinceQuery, emittedReportOf, EMITTED_REPORT_CAP, IMPORT_CURSOR_ADVANCE_SQL, IMPORT_RECORD_SQL, moveImportCursor, CrossVerticalRegistry, exportReadPlan, exportReadQuery, planExportBatch, withheldNote, JOB_RUN_DDL, jobRunListLimit, } from '@substrat-run/kernel';
 import { isUpgradeRequest, readSubscription, LIVE_FANOUT_LIMIT, LIVE_MODE_HEADER, LIVE_PRINCIPAL_HEADER, LIVE_SCOPE_HEADER, LIVE_SUBSCRIBE_PATH, LIVE_TENANT_HEADER, } from './live-reads.js';
 import { OperationQueue } from './serialization.js';
 import { doScopedSql, doBuiltColumnsOf, doRedactionSql, doSpineSql } from './sql.js';
-import { actorOf, admitPeer, collectPeers, switchPeer, assertNoSecret, CAPABILITY_DDL, CAPABILITY_EXCHANGE_OPERATION, capabilityAttachmentWriteRefused, createCapabilityVerbs, createEntityEdgeVerbs, exchangeCapability, guardSecrets, mintBecomeCapability, redactSecrets, redactSecretText, moduleLog, resolveCapabilitySession, revokeCapabilityAsPlatform, domainEventOf, facetEvents, readDeadLetters, readLifecycleFlow, readHistory, readInvocation, readUndrainedOutbox, walkEventCause, walkEventEffects, } from '@substrat-run/kernel';
+import { actorOf, admitPeer, collectPeers, switchPeer, assertNoSecret, CAPABILITY_DDL, COPY_ORIGIN_DDL, CAPABILITY_EXCHANGE_OPERATION, capabilityAttachmentWriteRefused, createCapabilityVerbs, createEntityEdgeVerbs, exchangeCapability, guardSecrets, mintBecomeCapability, redactSecrets, redactSecretText, moduleLog, asyncInvocationId, asyncLinePass, resolveCapabilitySession, revokeCapabilityAsPlatform, readCapabilityPage, domainEventOf, facetEvents, readDeadLetters, readLifecycleFlow, readHistory, readInvocation, readUndrainedOutbox, walkEventCause, walkEventEffects, } from '@substrat-run/kernel';
 import { createDoTupleChecker, createLocalControlPlaneReader } from './checker.js';
-import { assertNoSpineReference, assertSpineTablesBuilt, dumpRowsInsert, isSpineTable, repointScopeGrants, spineColumnAdditions } from '@substrat-run/kernel';
+import { CARRIED_AWAY_KEY, COPY_MARK_CLEARED_KEY, KEPT_COPY_REFUSAL, KEPT_DIVERGENT_KEY, LOAD_STAMP_KEY, STORE_LOCAL_META_KEYS, WRITE_REVISION_KEY, carriedAwayDump, isCopyMarkInsert, isWriteStatement, assertNoSpineReference, assertSpineTablesBuilt, capabilitiesForLoad, clearCopyMarker, dumpRowsInsert, isSpineTable, markCopyOrigin, repointScopeGrants, settleCopiedWork, emittedHere, IS_COPY_SQL, isCopyLoad, isLifecycleWrite, readLifecycle, settleLifecycleAfterLoad, writeLifecycle, spineColumnAdditions } from '@substrat-run/kernel';
 /**
  * The key marking a scope DO whose storage was destroyed (`destroyStorage`).
  * Written after `deleteAll()` so it survives the wipe, and never cleared: `reaped`
@@ -327,6 +327,9 @@ const KERNEL_DDL = `
   -- an exchange trades that secret for. Shared with the pure adapter from
   -- @substrat-run/kernel so the two cannot part company; the column comments are there.
   ${CAPABILITY_DDL}
+  -- #1686: where a copied scope's data came from, and the event id its own events start above.
+  -- Shared with the other adapter from @substrat-run/kernel; the column comments are there.
+  ${COPY_ORIGIN_DDL}
 `;
 /**
  * Workers RPC carries a plain `Error`'s MESSAGE faithfully and nothing else. A custom
@@ -362,6 +365,137 @@ function kernelEmit(ctx, event) {
         throw new Error('kernelEmit: not an operation context this host built');
     write(event);
 }
+/**
+ * The scope DO's write revision (#1722): the one SQL handle this object writes through, and the
+ * one way it opens a transaction, so a writer or a transaction added later cannot slip past it.
+ * A carry's conditional restore compares the revision, so every change to the store has to move
+ * it: an UPDATE in place (a drain receipt, a redrain) as surely as an emitted event (Codex #2008
+ * r2). `suspended` is the wake's idempotent DDL, a load's drop-and-replay and a migration's own
+ * statements, which advance it themselves.
+ *
+ * **Atomic with the write (Codex #2008 r4).** The bump runs synchronously, right BEFORE the first
+ * write that needs it, on the same connection: inside a `transactionSync` or `transaction` it
+ * commits or rolls back with that transaction's writes, and outside one it joins the same
+ * coalesced batch. A bump that fails throws before the write runs, so no write lands under the old
+ * revision. Nothing is deferred to a later commit.
+ *
+ * **Once per run, not per statement** (a bump per statement cost 28.7–32.4% on a write-heavy
+ * operation, `write-revision-cost.test.ts`). After a bump, later writes skip it while they are
+ * covered by it: until the run ends (a microtask clears the flag at its first await or its end)
+ * and until a transaction boundary. Entering a transaction clears it, so each committing
+ * transaction holds a bump of its own; leaving one clears it too, so after a rollback (which took
+ * the bump with it) or a commit the next write bumps again. Clearing more often only over-counts,
+ * and over-counting only refuses a restore that could have landed.
+ */
+class WriteRevision {
+    raw;
+    storage;
+    suspended;
+    refusal;
+    /** Whether the current run, in the current transaction scope, already holds a bump. */
+    covered = false;
+    /** Inside `bookkeeping`: the one path whose writes advance no revision. */
+    keeping = false;
+    /** A statement's text is almost always a constant, so its answer is remembered (bounded). */
+    writes = new Map();
+    sql;
+    constructor(raw, storage, suspended, 
+    /** Why this store takes no write at all right now, or null (a `carried_away` copy, #1722). */
+    refusal) {
+        this.raw = raw;
+        this.storage = storage;
+        this.suspended = suspended;
+        this.refusal = refusal;
+        const exec = (query, ...bindings) => {
+            if (this.keeping && this.isWrite(query)) {
+                // Bookkeeping takes the copy-marker insert and the lifecycle delivery (#1713) and nothing
+                // else: any other write here would be one the revision never saw, which is the hole this
+                // class exists to close.
+                if (!isCopyMarkInsert(query) && !isLifecycleWrite(query)) {
+                    throw substratError('internal', `the bookkeeping path takes only the copy-marker insert and the lifecycle delivery (#1722, #1713), not: ${query.slice(0, 80)}`);
+                }
+                return raw.exec(query, ...bindings);
+            }
+            if (!this.suspended() && this.isWrite(query)) {
+                const refused = this.refusal();
+                if (refused)
+                    throw substratError('conflict', refused);
+                if (!this.covered)
+                    this.bump();
+            }
+            return raw.exec(query, ...bindings);
+        };
+        this.sql = new Proxy(raw, {
+            get(target, prop) {
+                if (prop === 'exec')
+                    return exec;
+                const value = Reflect.get(target, prop, target);
+                return typeof value === 'function' ? value.bind(target) : value;
+            },
+        });
+    }
+    /**
+     * Store bookkeeping that is not the scope's data: marking the store a copy (#2005, Codex #2008
+     * r10). That only ever restricts what the store may run and changes no data, so it advances no
+     * write revision: a backfill that marks a carry's source between its export and its wipe must
+     * not read as a write the carry did not copy (that would keep the copy for nothing). Enforced,
+     * not trusted: any write in here but the marker insert (`isCopyMarkInsert`) or the lifecycle
+     * delivery (`isLifecycleWrite`, #1713) throws. Clearing a
+     * marker is NOT bookkeeping (r11): it loosens the store, so it is a write a carry fences on.
+     */
+    bookkeeping(run) {
+        const was = this.keeping;
+        this.keeping = true;
+        try {
+            return run();
+        }
+        finally {
+            this.keeping = was;
+        }
+    }
+    /** `storage.transactionSync`, at a transaction boundary. */
+    transactionSync(run) {
+        this.covered = false;
+        try {
+            return this.storage.transactionSync(run);
+        }
+        finally {
+            this.covered = false;
+        }
+    }
+    /** `storage.transaction`, at a transaction boundary. */
+    async transaction(run) {
+        this.covered = false;
+        try {
+            return await this.storage.transaction(run);
+        }
+        finally {
+            this.covered = false;
+        }
+    }
+    bump() {
+        // No catch: a bump that cannot be written fails the write it was for.
+        this.raw.exec(`INSERT INTO _substrat_meta (key, value) VALUES (?, '1')
+       ON CONFLICT (key) DO UPDATE SET value = CAST(CAST(value AS INTEGER) + 1 AS TEXT)`, WRITE_REVISION_KEY);
+        this.covered = true;
+        queueMicrotask(() => {
+            this.covered = false;
+        });
+    }
+    isWrite(query) {
+        let known = this.writes.get(query);
+        if (known === undefined) {
+            known = isWriteStatement(query);
+            if (this.writes.size >= 512)
+                this.writes.clear();
+            this.writes.set(query, known);
+        }
+        return known;
+    }
+}
+/** What a write into a wiped copy answers (#1722): the scope's data lives in another script now. */
+const CARRIED_AWAY_WRITE_REFUSAL = 'this copy of the scope was carried to another script and wiped (#1722); it takes no writes — ' +
+    'a request that reaches it was routed before the move';
 function toRpcError(err) {
     if (err instanceof Error) {
         return err.constructor === Error ? err : new Error(err.message);
@@ -584,6 +718,21 @@ export function defineScopeDO(modules, bareOps) {
          * `runInDurableObject` — rather than assuming the runtime's documented behaviour.
          */
         webSocketMessagesHandled = 0;
+        /**
+         * #1722: while true, a write does not advance the write revision. True through the wake's
+         * own idempotent DDL (which every wake re-runs, and which changes nothing) and through a
+         * load's drop-and-replay, which sets the revision itself once the store is rebuilt.
+         */
+        revisionSuspended = true;
+        /**
+         * #1722 (Codex #2008 r7): whether this store is a copy a carry wiped (it holds the
+         * `carried_away` tombstone). Such a store takes no write: a stale request still routed here
+         * after the wipe would land a write that belongs to no live copy. A load, a rollback's
+         * restore, ends it. Read on every wake and after every load.
+         */
+        carriedAwayCopy = false;
+        /** #1722: the write revision, and the one way this object opens a transaction. */
+        revision;
         constructor(ctx, env) {
             super(ctx, env);
             // #1860: the client's 45s keep-alive (demos/ticket0/app/src/feed.ts) answered at
@@ -591,11 +740,18 @@ export function defineScopeDO(modules, bareOps) {
             // subscriber's ping still reaches `webSocketMessage` and pins the DO in memory —
             // exactly the hibernation cost `acceptWebSocket` (below) exists to avoid.
             ctx.setWebSocketAutoResponse(new WebSocketRequestResponsePair('ping', 'pong'));
-            this.sql = ctx.storage.sql;
+            // #1722: the ONE handle this object writes through and the one way it opens a transaction,
+            // so every write advances the write revision a carry's restore is fenced on, inside the
+            // transaction that commits it. Nothing else here may take the raw handle or open a
+            // transaction on `ctx.storage` itself (`carried-copy.test.ts` in the kernel holds that).
+            this.revision = new WriteRevision(ctx.storage.sql, ctx.storage, () => this.revisionSuspended, () => (this.carriedAwayCopy ? CARRIED_AWAY_WRITE_REFUSAL : null));
+            this.sql = this.revision.sql;
             for (const stmt of splitSqlStatements(KERNEL_DDL)) {
                 this.sql.exec(stmt);
             }
             this.applySpineColumnAdditions();
+            this.revisionSuspended = false;
+            this.carriedAwayCopy = this.metaValue(CARRIED_AWAY_KEY) !== null;
             for (const registration of modules)
                 this.registerModule(registration);
             for (const [name, handler] of Object.entries(bareOps))
@@ -860,7 +1016,7 @@ export function defineScopeDO(modules, bareOps) {
          */
         undrainedEventsRead(limit) {
             return readUndrainedOutbox((offset, count) => this.sql
-                .exec(`SELECT * FROM _substrat_outbox WHERE drained_at IS NULL ORDER BY id LIMIT ? OFFSET ?`, count, offset)
+                .exec(`SELECT * FROM _substrat_outbox WHERE drained_at IS NULL AND ${emittedHere()} ORDER BY id LIMIT ? OFFSET ?`, count, offset)
                 .toArray(), limit);
         }
         /**
@@ -1024,10 +1180,27 @@ export function defineScopeDO(modules, bareOps) {
                (event_id, consumer_module, delivered_at, error, invocation_id)
              VALUES (?, ?, ?, ?, NULL)`, id, moduleId, when, error);
                 };
+                // #1901: one line per (event, importing module), as for the scope's own consumers.
+                // The handler runs as the producer's peer, so that is who the line says it ran as.
+                const lines = asyncLinePass();
+                const unitOf = (moduleId, eventId, eventType) => ({
+                    kind: 'consumer',
+                    tenantId,
+                    scopeId,
+                    invocationId: asyncInvocationId(null),
+                    operation: moduleId,
+                    eventType,
+                    eventId,
+                    attempt: 1,
+                    startedAt: Date.now(),
+                    principalKind: peerSubject.kind,
+                    versionId: this.env.SUBSTRAT_VERSION_ID ?? null,
+                });
                 for (const w of batch.withheld) {
                     this.sql.exec(IMPORT_RECORD_SQL, w.id, source.scopeId, source.vertical, w.type, w.schemaVersion, w.occurredAt, w.entity.entityType, w.entity.entityId, 0, w.reason, at);
                     for (const moduleId of this.crossVertical.modulesImporting(source.vertical, w.type)) {
                         deadLetter(w.id, moduleId, at, withheldNote(w.reason, source.vertical));
+                        lines.write({ ...unitOf(moduleId, w.id, w.type), outcome: 'dead-lettered' });
                     }
                     result.withheld += 1;
                 }
@@ -1040,14 +1213,17 @@ export function defineScopeDO(modules, bareOps) {
                         ran = true;
                         if (imp.schemaVersion !== e.schemaVersion) {
                             deadLetter(e.id, imp.moduleId, at, withheldNote('version', source.vertical));
+                            lines.write({ ...unitOf(imp.moduleId, e.id, e.type), outcome: 'dead-lettered' });
                             result.deadLettered += 1;
                             continue;
                         }
                         const { hops: _hops, ...fact } = e;
                         const event = structuredClone({ ...fact, source });
+                        const unit = unitOf(imp.moduleId, e.id, e.type);
                         this.causedBy = e.id;
+                        this.unitInvocationId = unit.invocationId;
                         try {
-                            await this.ctx.storage.transaction(async () => {
+                            await this.revision.transaction(async () => {
                                 // As the producer's principal: real checks against the grants this vertical's
                                 // `peers` gave it; its emits carry `{ vertical, scope }` and what they passed.
                                 await imp.handler(this.importContext(tenantId, scopeId, peerSubject), event);
@@ -1055,14 +1231,17 @@ export function defineScopeDO(modules, bareOps) {
                    VALUES (?, ?, ?, NULL)`, e.id, imp.moduleId, new Date().toISOString());
                             });
                             result.delivered += 1;
+                            lines.write({ ...unit, outcome: 'delivered' });
                         }
                         catch (err) {
                             // Dead-letter (v0), outside the rolled-back transaction.
                             deadLetter(e.id, imp.moduleId, new Date().toISOString(), String(err));
                             result.deadLettered += 1;
+                            lines.write({ ...unit, outcome: 'dead-lettered', error: err });
                         }
                         finally {
                             this.causedBy = null;
+                            this.unitInvocationId = null;
                         }
                     }
                     if (!ran)
@@ -1070,6 +1249,7 @@ export function defineScopeDO(modules, bareOps) {
                 }
                 this.sql.exec(IMPORT_CURSOR_ADVANCE_SQL, source.scopeId, source.vertical, batch.next, at);
                 result.cursor = batch.next;
+                lines.end();
                 await this.settleCommitted(tenantId, scopeId, liveSince, null);
                 return result;
             });
@@ -1320,7 +1500,7 @@ export function defineScopeDO(modules, bareOps) {
          * and the re-assert in which a sweep could run the grants just seated.
          */
         async seatTuples(tuples, switchOff) {
-            return this.queue.enqueue(() => this.ctx.storage.transactionSync(() => {
+            return this.queue.enqueue(() => this.revision.transactionSync(() => {
                 for (const t of tuples) {
                     const seat = seatScopeTuple(t.subject, t.relation, t.object, t.expires_at);
                     this.sql.exec(seat.sql, ...seat.params);
@@ -1386,6 +1566,9 @@ export function defineScopeDO(modules, bareOps) {
          * where the control plane is unreachable by the sandbox contract and the projected
          * entitlements are the source of truth. A console-managed scope is gated on the
          * coordinator against the shared CP, so this is left undefined / a no-op there.
+         * Also undefined for a module's own declared schedule through the system door
+         * (#1654): the coordinator resolves the key with the kernel's `requiredEntitlementFor`,
+         * which exempts exactly that invoke, so the DO enforces whatever it is handed.
          */
         requiredEntitlement, 
         /**
@@ -1626,7 +1809,7 @@ export function defineScopeDO(modules, bareOps) {
                     // commit together, or a throw (from either) rolls domain writes AND
                     // emitted events back as one — verified across `await` in workerd.
                     try {
-                        await this.ctx.storage.transaction(async () => {
+                        await this.revision.transaction(async () => {
                             const ctx = this.operationContext(principal, tenantId, scopeId, undefined, connectionId, systemModuleId, signals, impersonation, operation, capabilityId, minted, undefined, peerSubject);
                             // #116: a retry is answered from the recording, and nothing else runs
                             // — not the guards, not the handler, not the permission check inside
@@ -2108,7 +2291,7 @@ export function defineScopeDO(modules, bareOps) {
                 // the reason it is read there: that is where this call holds the DO to itself.
                 const liveSince = this.liveHighWaterMark();
                 try {
-                    await this.ctx.storage.transaction(async () => {
+                    await this.revision.transaction(async () => {
                         const ctx = this.operationContext(principal, tenantId, scopeId, undefined, connectionId, undefined, undefined, undefined, 'attachments.upload');
                         assertAllowed(await ctx.check(gate.write, parsed.entity));
                         this.sql.exec(`INSERT INTO _substrat_attachments
@@ -2232,7 +2415,7 @@ export function defineScopeDO(modules, bareOps) {
                 // #938: same mark-then-settle pair as the upload path above.
                 const liveSince = this.liveHighWaterMark();
                 try {
-                    await this.ctx.storage.transaction(async () => {
+                    await this.revision.transaction(async () => {
                         const ctx = this.operationContext(principal, tenantId, scopeId, undefined, connectionId, undefined, undefined, undefined, 'attachments.remove');
                         assertAllowed(await ctx.check(gate.write, record.entity));
                         this.sql.exec('DELETE FROM _substrat_attachments WHERE id = ?', attachmentId);
@@ -2298,7 +2481,7 @@ export function defineScopeDO(modules, bareOps) {
          */
         async attachmentTextRecord(attachmentId, outcome) {
             await this.ensureMigrations();
-            return this.queue.enqueue(async () => this.ctx.storage.transactionSync(() => recordAttachmentText(doSpineSql(this.sql), attachmentId, outcome, new Date().toISOString())));
+            return this.queue.enqueue(async () => this.revision.transactionSync(() => recordAttachmentText(doSpineSql(this.sql), attachmentId, outcome, new Date().toISOString())));
         }
         // -- attachments through a capability (#1686) -------------------------------
         // The coordinator hashed the session token; only the hash arrives. Each verb resolves it
@@ -2432,7 +2615,7 @@ export function defineScopeDO(modules, bareOps) {
          * as one `transactionSync`, so its reads and writes are one unit.
          */
         async switchSystemSchedules(moduleId, scopeId, to, at) {
-            const outcome = await this.queue.enqueue(() => this.ctx.storage.transactionSync(() => switchSystemSchedules(this.switchSql(), { moduleId, scopeId, to, at })));
+            const outcome = await this.queue.enqueue(() => this.revision.transactionSync(() => switchSystemSchedules(this.switchSql(), { moduleId, scopeId, to, at })));
             // #1819: the instance that applied it, which the rewind hold's release rule reads.
             return { ...outcome, instance: this.instanceId };
         }
@@ -2447,14 +2630,14 @@ export function defineScopeDO(modules, bareOps) {
             // The consumer's own running imports decide whether the edge exists: read here, in the
             // deployment whose handlers would run, never from the platform's request.
             const imports = this.crossVertical.consumes();
-            return this.queue.enqueue(() => this.ctx.storage.transactionSync(() => moveImportCursor(this.switchSql(), { ...input, imports })));
+            return this.queue.enqueue(() => this.revision.transactionSync(() => moveImportCursor(this.switchSql(), { ...input, imports })));
         }
         /**
          * Move one PEER's kill switch on this scope (#1706) — the kernel's `switchPeer`, which is
          * the schedule switch's statement with a `vertical:` subject. Queued, one transaction.
          */
         async switchPeer(vertical, scopeId, to, at) {
-            return this.queue.enqueue(() => this.ctx.storage.transactionSync(() => switchPeer(this.switchSql(), { vertical, scopeId, to, at })));
+            return this.queue.enqueue(() => this.revision.transactionSync(() => switchPeer(this.switchSql(), { vertical, scopeId, to, at })));
         }
         /**
          * Does peer `vertical` hold each key at this scope's node now (#1706) — the checker's own
@@ -2578,7 +2761,7 @@ export function defineScopeDO(modules, bareOps) {
          */
         switchHoldOn(scopeId, moduleId, claimIds) {
             this.switchHoldsTable();
-            this.ctx.storage.transactionSync(() => {
+            this.revision.transactionSync(() => {
                 const seq = this.sql
                     .exec(`INSERT INTO _substrat_switch_hold_seq (id, seq) VALUES (1, 1)
                ON CONFLICT (id) DO UPDATE SET seq = seq + 1 RETURNING seq`)
@@ -2603,7 +2786,7 @@ export function defineScopeDO(modules, bareOps) {
         switchHoldClaim(scopeId, moduleIds, claimId, token) {
             this.switchHoldsTable();
             const at = new Date().toISOString();
-            this.ctx.storage.transactionSync(() => {
+            this.revision.transactionSync(() => {
                 for (const moduleId of moduleIds) {
                     this.sql.exec(`INSERT OR IGNORE INTO _substrat_switch_holds (scope_id, module_id, claim_id, state, doomed, held_at)
              SELECT ?, ?, ?, 'pending', NULL, ?
@@ -2623,7 +2806,7 @@ export function defineScopeDO(modules, bareOps) {
         switchHoldJoin(scopeId, moduleId, claimIds) {
             this.switchHoldsTable();
             const at = new Date().toISOString();
-            this.ctx.storage.transactionSync(() => {
+            this.revision.transactionSync(() => {
                 for (const claimId of claimIds) {
                     this.sql.exec(`INSERT OR IGNORE INTO _substrat_switch_holds (scope_id, module_id, claim_id, state, doomed, held_at)
              SELECT scope_id, ?, claim_id, state, doomed, ? FROM _substrat_switch_holds
@@ -2681,7 +2864,7 @@ export function defineScopeDO(modules, bareOps) {
         /** Release these claims on one module, or every claim on the scope when `claimIds` is null. */
         switchHoldRelease(scopeId, moduleId, claimIds) {
             this.switchHoldsTable();
-            this.ctx.storage.transactionSync(() => {
+            this.revision.transactionSync(() => {
                 if (moduleId === null || claimIds === null) {
                     this.sql.exec('DELETE FROM _substrat_switch_holds WHERE scope_id = ?', scopeId);
                     this.sql.exec('DELETE FROM _substrat_switch_hold_ons WHERE scope_id = ?', scopeId);
@@ -2718,7 +2901,7 @@ export function defineScopeDO(modules, bareOps) {
                 // and the event's `occurredAt` are one fact, and two clock reads could disagree.
                 const now = instant.parse(new Date().toISOString());
                 let outcome = null;
-                await this.ctx.storage.transaction(async () => {
+                await this.revision.transaction(async () => {
                     outcome = await exchangeCapability({
                         sql: doSpineSql(this.sql),
                         now,
@@ -2748,7 +2931,16 @@ export function defineScopeDO(modules, bareOps) {
          */
         async revokeCapabilityAsPlatform(id, actor) {
             await this.ensureMigrations();
-            return await this.queue.enqueue(() => this.ctx.storage.transactionSync(() => revokeCapabilityAsPlatform(doSpineSql(this.sql), id, actor, instant.parse(new Date().toISOString()))) ?? null);
+            return await this.queue.enqueue(() => this.revision.transactionSync(() => revokeCapabilityAsPlatform(doSpineSql(this.sql), id, actor, instant.parse(new Date().toISOString()))) ?? null);
+        }
+        /**
+         * The operator's read of this scope's capabilities (#1686). The kernel's one read
+         * (`readCapabilityPage`): no `token_hash` selected, decoded to a record with no field to hold one.
+         * Authorization and the K-3 cross-check happen on the coordinator first.
+         */
+        async listCapabilities(filter) {
+            await this.ensureMigrations();
+            return readCapabilityPage(doSpineSql(this.sql), filter);
         }
         /**
          * The last time a schedule's operation ran on this scope (#383), or null.
@@ -2861,7 +3053,7 @@ export function defineScopeDO(modules, bareOps) {
             // `jobRunInsert`: an `await` between them is an output-gate boundary, and the
             // point of doing this in one RPC is that there is no boundary to be evicted
             // at. Same reason `SCHEDULE_STATE_REBUILD` insists on it.
-            this.ctx.storage.transactionSync(() => {
+            this.revision.transactionSync(() => {
                 this.sql.exec(`INSERT INTO _substrat_job_runs
              (id, module_id, job, instance, payload, status, cursor, counters, attempts,
               last_error, started_at, updated_at, next_attempt_at, ended_at, subject_id)
@@ -2961,7 +3153,7 @@ export function defineScopeDO(modules, bareOps) {
             // `transactionSync` with both statements inline — NOT `await
             // this.jobRunPatch(...)` then the delete. The await is an output-gate
             // boundary, which is precisely the gap this method exists to close.
-            this.ctx.storage.transactionSync(() => {
+            this.revision.transactionSync(() => {
                 this.sql.exec(JOB_RUN_PATCH_SQL, patch.status, patch.cursor, patch.counters, patch.attempts, patch.lastError, patch.updatedAt, patch.nextAttemptAt, patch.endedAt, id);
                 this.sql.exec('DELETE FROM _substrat_job_steps WHERE run_id = ?', id);
             });
@@ -3030,7 +3222,7 @@ export function defineScopeDO(modules, bareOps) {
                     if (this.applied.has(key))
                         continue;
                     try {
-                        await this.ctx.storage.transaction(async () => {
+                        await this.revision.transaction(async () => {
                             const already = this.sql
                                 .exec('SELECT 1 FROM _substrat_migrations WHERE module_id = ? AND version = ?', moduleId, migration.version)
                                 .toArray()[0];
@@ -3040,8 +3232,16 @@ export function defineScopeDO(modules, bareOps) {
                                 // #1898: a migration runs on this DO's own handle, not `ctx.sql`, so the
                                 // spine guard's REFERENCES rule is applied here.
                                 assertNoSpineReference(migration.sql, `migration ${key}`);
-                                for (const stmt of splitSqlStatements(migration.sql)) {
-                                    this.sql.exec(stmt);
+                                // #1722: not counted per statement, so `total_changes()` measures the migration
+                                // alone. The journal row below is a write, and advances the revision once.
+                                this.revisionSuspended = true;
+                                try {
+                                    for (const stmt of splitSqlStatements(migration.sql)) {
+                                        this.sql.exec(stmt);
+                                    }
+                                }
+                                finally {
+                                    this.revisionSuspended = false;
                                 }
                                 const after = this.sql.exec('SELECT total_changes() AS n').toArray()[0].n;
                                 this.sql.exec('INSERT INTO _substrat_migrations (module_id, version, applied_at, duration_ms, rows_changed) VALUES (?, ?, ?, ?, ?)', moduleId, migration.version, new Date().toISOString(), Math.max(0, Math.round(performance.now() - started)), after - before);
@@ -3089,7 +3289,7 @@ export function defineScopeDO(modules, bareOps) {
                 .exec(`SELECT o.* FROM _substrat_outbox o
            LEFT JOIN _substrat_deliveries d
              ON d.event_id = o.id AND d.consumer_module = ?
-           WHERE o.type = ?
+           WHERE o.type = ? AND ${emittedHere('o.')}
              AND (d.event_id IS NULL
                   OR (d.next_attempt_at IS NOT NULL AND d.next_attempt_at <= ?))
            ORDER BY o.id`, deliveryId, eventType, new Date().toISOString())
@@ -3106,6 +3306,69 @@ export function defineScopeDO(modules, bareOps) {
             }
             return { events, undecodable };
         }
+        /**
+         * Whether this scope is a copy (#2005) — the classification on its `_substrat_copy_origin` row
+         * (#2009), which only the directory's word sets, not a load's events mark. A CP-less
+         * coordinator has no directory to read a scope's kind from, so this is how it holds a copy's
+         * executor deliveries inert; a coordinator with a directory asks that instead.
+         */
+        isCopy() {
+            return this.sql.exec(IS_COPY_SQL).toArray().length > 0;
+        }
+        /** The lifecycle the platform last delivered to this scope (#1713), or null for none. */
+        lifecycle() {
+            return readLifecycle(this.switchSql());
+        }
+        /**
+         * Store a lifecycle the platform delivered (#1713, `writeLifecycle`): kept only when it is not
+         * older than the one held. Bookkeeping, like the copy marker: it changes what runs here, not
+         * the scope's data, so it does not advance the write revision a carry fences on.
+         */
+        setLifecycle(next) {
+            let out;
+            this.revision.transactionSync(() => {
+                out = this.revision.bookkeeping(() => writeLifecycle(this.switchSql(), next));
+            });
+            return out;
+        }
+        /** Mark this scope a copy (#2005, `markCopyOrigin`): the repair of a copy that predates the
+         *  marker. Answers whether this call stamped it; a store that already reads as a copy is left
+         *  as it is, and a load's events mark is never moved (#2009). */
+        markCopy() {
+            let marked = false;
+            this.revision.transactionSync(() => {
+                marked = this.revision.bookkeeping(() => markCopyOrigin(this.switchSql(), new Date().toISOString()));
+            });
+            return marked;
+        }
+        /**
+         * Clear a mistaken copy classification (#2005, `clearCopyMarker`); a load's events mark stays,
+         * so copied work still never runs here (#2009). A
+         * clear is a write like any other (Codex #2008 r11), never bookkeeping: it lets the store run
+         * work a copy holds inert, so it advances the write revision, and a carry that exported
+         * before it cannot wipe the repaired store. That carry's wipe keeps it instead.
+         */
+        clearCopyMark(
+        /** The store the caller means (Codex #2008 r12–r13): the platform's reconcile of the store a
+         *  carry landed names that carry's load stamp and the revision it read, so a store another
+         *  load has replaced since (a governed restore, whose classification is its own) is refused,
+         *  compared here, in the clear's own transaction. Absent for staff's correction. */
+        expect) {
+            return this.revision.transactionSync(() => {
+                const from = this.metaValue(WRITE_REVISION_KEY);
+                if (expect && (this.metaValue(LOAD_STAMP_KEY) !== expect.loadStamp || from !== expect.revision)) {
+                    return 'changed';
+                }
+                const outcome = clearCopyMarker(this.switchSql());
+                // The clear's own revisions, so a carry's refused wipe can tell that this clear, and
+                // nothing else, is what changed here since its export (`COPY_MARK_CLEARED_KEY`).
+                if (outcome === 'cleared') {
+                    this.sql.exec(`INSERT INTO _substrat_meta (key, value) VALUES (?, ?)
+             ON CONFLICT (key) DO UPDATE SET value = excluded.value`, COPY_MARK_CLEARED_KEY, JSON.stringify({ from, to: this.metaValue(WRITE_REVISION_KEY) }));
+                }
+                return outcome;
+            });
+        }
         /**
          * The same read as a bare list of events, for a coordinator deployed before
          * `pendingExecutorDeliveries` (#1636). An undecodable row is left out rather than
@@ -3350,7 +3613,7 @@ export function defineScopeDO(modules, bareOps) {
             let result;
             const rollback = new Error('read-only console rollback');
             try {
-                await this.ctx.storage.transaction(async () => {
+                await this.revision.transaction(async () => {
                     const cursor = this.sql.exec(stmt);
                     const columns = cursor.columnNames;
                     const rows = [];
@@ -3382,6 +3645,14 @@ export function defineScopeDO(modules, bareOps) {
             const q = denialListQuery(filter);
             return this.sql.exec(q.sql, ...q.params).toArray().map(mapDenialRow);
         }
+        /**
+         * #1745: the refusal log — every lifecycle move refused and failed with, recorded after
+         * the rollback. Authorization and the K-3 cross-check happen on the coordinator first.
+         */
+        listRefusals(filter) {
+            const q = refusalListQuery(filter);
+            return this.sql.exec(q.sql, ...q.params).toArray().map(mapRefusalRow);
+        }
         /**
          * The same log bucketed per (actor, permission) — or per operation when the filter
          * says `groupBy: 'operation'` (#1456) — with the window's own facts.
@@ -3422,12 +3693,32 @@ export function defineScopeDO(modules, bareOps) {
             return defs.map(({ name, sql }) => {
                 // Raw positional rows, cells as-is (blobs kept as bytes, not nulled like a UI
                 // read) so the dump reloads faithfully. The name is from the live schema.
-                const cursor = this.sql.exec(`SELECT * FROM "${name}"`);
+                // #1722: the load stamp and the write revision describe THIS store, so they never leave
+                // in a dump (`exportDumpStamped` hands the stamp over beside one); every load writes its own.
+                const cursor = name === '_substrat_meta'
+                    ? this.sql.exec(`SELECT * FROM "${name}" WHERE key NOT IN (${STORE_LOCAL_META_KEYS.map(() => '?').join(', ')})`, ...STORE_LOCAL_META_KEYS)
+                    : this.sql.exec(`SELECT * FROM "${name}"`);
                 const columns = cursor.columnNames;
                 const rows = Array.from(cursor.raw(), (row) => row);
                 return { name, ddl: sql, columns, rows };
             });
         }
+        /**
+         * `exportDump`, with the store's load stamp read in the same call (#1722): the stamp a
+         * carry's fenced wipe of this copy later expects. A store no load has stamped gets one now,
+         * so the stamp handed out is present exactly while nothing has been loaded here since. One
+         * synchronous method, so no load can land between the dump and the stamp.
+         */
+        exportDumpStamped() {
+            let stamp = this.loadStamp();
+            // A wiped copy takes no write, a stamp included; the carry refuses its tombstone anyway.
+            if (!stamp && !this.carriedAwayCopy) {
+                stamp = ulid();
+                this.sql.exec(`INSERT INTO _substrat_meta (key, value) VALUES (?, ?)`, LOAD_STAMP_KEY, stamp);
+            }
+            // Read after the stamp's own write, so it is the revision the store holds as it is dumped.
+            return { tables: this.exportDump(), loadStamp: stamp, revision: this.metaValue(WRITE_REVISION_KEY) };
+        }
         /**
          * Load a dump into this (freshly-provisioned) scope — the write half of the fork
          * (host.ts importScope). Drop-then-replay: the provisioning schema is wiped and rebuilt,
@@ -3509,6 +3800,9 @@ export function defineScopeDO(modules, bareOps) {
                 // every legacy row — a past run's id cannot be recovered afterwards, exactly
                 // as the other #1525 columns above argued.
                 'ALTER TABLE _substrat_schedule_state ADD COLUMN invocation_id TEXT',
+                // #2009: the copy classification on a scope DO built before it (NULL reads as a copy;
+                // see `COPY_ORIGIN_DDL`).
+                'ALTER TABLE _substrat_copy_origin ADD COLUMN is_copy INTEGER',
             ]) {
                 try {
                     this.sql.exec(alter);
@@ -3554,12 +3848,12 @@ export function defineScopeDO(modules, bareOps) {
             // runtime forbids a manual BEGIN through `sql.exec`, and this body is wholly
             // synchronous, which is the one case the sync API is for (it commits at the
             // first await, and there is none). It also has to be sync because the caller is.
-            this.ctx.storage.transactionSync(() => {
+            this.revision.transactionSync(() => {
                 for (const stmt of splitSqlStatements(SCHEDULE_STATE_REBUILD))
                     this.sql.exec(stmt);
             });
         }
-        async importDump(tables, destScopeId, { switchOff, sourceScopeId, exact, } = {}) {
+        async importDump(tables, destScopeId, { switchOff, sourceScopeId, exact, loadStamp, expect, resolveKept, markCopy, } = {}) {
             // The WHOLE drop-then-replay runs under deferred foreign keys, in one transaction.
             //
             // Two distinct FK hazards, and both need the deferral — the second is why it cannot
@@ -3581,7 +3875,8 @@ export function defineScopeDO(modules, bareOps) {
             // A dump written before indexes were excluded may still carry them; skipped
             // rather than failing a restore over data about to be recomputed.
             // Matched without case, as SQLite resolves a table name (#1883 review).
-            const replayable = tables.filter((t) => !isSearchIndexTable(t.name.toLowerCase()));
+            // #1686: a copy into another scope id loads no capability rows; a same-scope restore keeps them.
+            const replayable = capabilitiesForLoad(tables.filter((t) => !isSearchIndexTable(t.name.toLowerCase())), destScopeId, sourceScopeId);
             // The dump is untrusted input (#1143). `SqlStorage.exec` runs every statement
             // in the string it is given, so a `ddl` with anything appended to its CREATE
             // TABLE executed that too — with entirely plain identifiers, which is why no
@@ -3593,74 +3888,123 @@ export function defineScopeDO(modules, bareOps) {
             if (exact && !sourceScopeId) {
                 throw substratError('validation_failed', 'restore refused: `exact` needs the scope the dump came from');
             }
-            const switched = await this.ctx.storage.transaction(async () => {
-                this.sql.exec('PRAGMA defer_foreign_keys = ON');
-                // Real tables only; `sqlite_*` internals are auto-managed and un-droppable.
-                const existing = this.sql
-                    .exec(`SELECT name FROM sqlite_master WHERE type = 'table' AND name NOT GLOB 'sqlite_*'`)
-                    .toArray();
-                // Search index tables are left alone here and rebuilt below (#827): dropping a
-                // shadow table directly is an error, and `sqlite_master` order would reach one
-                // before its virtual table.
-                for (const { name } of existing) {
-                    if (isSearchIndexTable(name.toLowerCase()))
-                        continue;
-                    this.sql.exec(`DROP TABLE IF EXISTS "${name}"`);
+            const switched = await this.revision.transaction(async () => {
+                const before = this.loadMarker();
+                // #1713: the lifecycle the platform delivered here, read before the drops take it.
+                const lifecycleBefore = readLifecycle(this.switchSql());
+                // #1722 (Codex #2008 r7): a kept copy holds writes nothing else has. No load replaces it
+                // except its own resolution, and that only at the revision the operator acted on.
+                const kept = this.metaValue(KEPT_DIVERGENT_KEY);
+                if (resolveKept) {
+                    if (!kept)
+                        throw substratError('precondition_failed', 'no kept copy here to resolve; nothing was loaded');
+                    if (before.revision !== resolveKept.revision ||
+                        (resolveKept.loadStamp !== undefined && before.loadStamp !== resolveKept.loadStamp)) {
+                        throw substratError('precondition_failed', 'the kept copy changed since it was read; nothing was loaded');
+                    }
                 }
-                // A vertical's tables take the dump's own DDL. The spine never does (#1883): a dump
-                // that declared a column the checker compares on as COLLATE NOCASE would otherwise
-                // decide how this DO's permission checks match. Every `_substrat_*` table is built
-                // from KERNEL_DDL instead, and the dump contributes only rows, by column name
-                // (`spineRowsInsert`), a missing column taking the kernel's default.
-                for (const t of replayable)
-                    if (!isSpineTable(t.name))
-                        this.sql.exec(t.ddl);
-                // KERNEL_DDL also builds what the dump did not carry (#321). A dump captured from a
-                // WORLD that stores some `_substrat_*` tables ELSEWHERE carries only a subset — an
-                // `@substrat-run/adapter-sqlite` scope file keeps `_substrat_roles` /
-                // `_substrat_tenant_tuples` in its DIRECTORY database, so its per-scope dump omits
-                // them, and without them the very next permission check would raise a bare `no such
-                // table: _substrat_roles`. Roles land empty here and are re-projected by the
-                // restore's repair leg (host.projectRolesLocal) — the spine's job is only to exist so
-                // the checker can read it. The column pass follows, for the one outbox index KERNEL_DDL
-                // leaves to it.
-                for (const stmt of splitSqlStatements(KERNEL_DDL))
-                    this.sql.exec(stmt);
-                this.applySpineColumnAdditions();
-                const columnsOf = (name) => doBuiltColumnsOf(this.sql, name);
-                assertSpineTablesBuilt(replayable.map((t) => t.name), columnsOf);
-                // A spine column this kernel does not know (a dump from a newer one) is kept, as a plain
-                // untyped column the checker never reads.
-                for (const t of replayable) {
-                    if (isSpineTable(t.name))
-                        for (const alter of spineColumnAdditions(t, columnsOf(t.name)))
-                            this.sql.exec(alter);
+                else if (kept) {
+                    throw substratError('conflict', KEPT_COPY_REFUSAL);
                 }
-                for (const t of replayable) {
-                    const insert = dumpRowsInsert(t, columnsOf);
-                    for (const row of t.rows)
-                        this.sql.exec(insert, ...row);
+                if (expect) {
+                    if (before.loadStamp !== expect.loadStamp || (expect.revision !== undefined && before.revision !== expect.revision)) {
+                        throw substratError('precondition_failed', 'scope store changed since it was read; nothing was loaded');
+                    }
                 }
-                // #1738: a dump's `provisioned_for` names the scope (and tenant) it was captured from,
-                // not this one. Dropped, so a restore never carries a receipt over; the repair
-                // projection that follows writes this scope's own.
-                this.sql.exec(`DELETE FROM _substrat_meta WHERE key = 'provisioned_for'`);
-                // #1575: attachment text is not in a dump, so the load left it as it was. Drop the
-                // text of attachments the dump did not bring back, and queue extraction for those
-                // it brought back without text — the bytes decide what that run finds.
-                reconcileAttachmentText(doSpineSql(this.sql), ulid, new Date().toISOString());
-                // Re-point the restored grants at THIS scope (after the spine exists, so a dump
-                // that carried no tuples table still finds one here).
-                if (destScopeId) {
-                    this.rewriteScopeTuples(destScopeId, sourceScopeId && { scopeId: sourceScopeId, exact }, new Date().toISOString());
+                // #1722: the drops take `_substrat_meta` with them; the revision is written back below.
+                this.revisionSuspended = true;
+                try {
+                    this.sql.exec('PRAGMA defer_foreign_keys = ON');
+                    // Real tables only; `sqlite_*` internals are auto-managed and un-droppable.
+                    const existing = this.sql
+                        .exec(`SELECT name FROM sqlite_master WHERE type = 'table' AND name NOT GLOB 'sqlite_*'`)
+                        .toArray();
+                    // Search index tables are left alone here and rebuilt below (#827): dropping a
+                    // shadow table directly is an error, and `sqlite_master` order would reach one
+                    // before its virtual table.
+                    for (const { name } of existing) {
+                        if (isSearchIndexTable(name.toLowerCase()))
+                            continue;
+                        this.sql.exec(`DROP TABLE IF EXISTS "${name}"`);
+                    }
+                    // A vertical's tables take the dump's own DDL. The spine never does (#1883): a dump
+                    // that declared a column the checker compares on as COLLATE NOCASE would otherwise
+                    // decide how this DO's permission checks match. Every `_substrat_*` table is built
+                    // from KERNEL_DDL instead, and the dump contributes only rows, by column name
+                    // (`spineRowsInsert`), a missing column taking the kernel's default.
+                    for (const t of replayable)
+                        if (!isSpineTable(t.name))
+                            this.sql.exec(t.ddl);
+                    // KERNEL_DDL also builds what the dump did not carry (#321). A dump captured from a
+                    // WORLD that stores some `_substrat_*` tables ELSEWHERE carries only a subset — an
+                    // `@substrat-run/adapter-sqlite` scope file keeps `_substrat_roles` /
+                    // `_substrat_tenant_tuples` in its DIRECTORY database, so its per-scope dump omits
+                    // them, and without them the very next permission check would raise a bare `no such
+                    // table: _substrat_roles`. Roles land empty here and are re-projected by the
+                    // restore's repair leg (host.projectRolesLocal) — the spine's job is only to exist so
+                    // the checker can read it. The column pass follows, for the one outbox index KERNEL_DDL
+                    // leaves to it.
+                    for (const stmt of splitSqlStatements(KERNEL_DDL))
+                        this.sql.exec(stmt);
+                    this.applySpineColumnAdditions();
+                    const columnsOf = (name) => doBuiltColumnsOf(this.sql, name);
+                    assertSpineTablesBuilt(replayable.map((t) => t.name), columnsOf);
+                    // A spine column this kernel does not know (a dump from a newer one) is kept, as a plain
+                    // untyped column the checker never reads.
+                    for (const t of replayable) {
+                        if (isSpineTable(t.name))
+                            for (const alter of spineColumnAdditions(t, columnsOf(t.name)))
+                                this.sql.exec(alter);
+                    }
+                    for (const t of replayable) {
+                        const insert = dumpRowsInsert(t, columnsOf);
+                        for (const row of t.rows)
+                            this.sql.exec(insert, ...row);
+                    }
+                    // #1738: a dump's `provisioned_for` names the scope (and tenant) it was captured from,
+                    // not this one. Dropped, so a restore never carries a receipt over; the repair
+                    // projection that follows writes this scope's own.
+                    this.sql.exec(`DELETE FROM _substrat_meta WHERE key = 'provisioned_for'`);
+                    // #1722: whatever stamp an export read here no longer describes this store, so every load
+                    // replaces it: with the carry's own, or with none. And the write revision moves on from
+                    // where it stood before the drops, so it never goes back.
+                    if (loadStamp) {
+                        this.sql.exec(`INSERT OR REPLACE INTO _substrat_meta (key, value) VALUES (?, ?)`, LOAD_STAMP_KEY, loadStamp);
+                    }
+                    else {
+                        this.sql.exec(`DELETE FROM _substrat_meta WHERE key = ?`, LOAD_STAMP_KEY);
+                    }
+                    this.sql.exec(`INSERT OR REPLACE INTO _substrat_meta (key, value) VALUES (?, ?)`, WRITE_REVISION_KEY, String(Number(before.revision ?? 0) + 1));
+                    // #1575: attachment text is not in a dump, so the load left it as it was. Drop the
+                    // text of attachments the dump did not bring back, and queue extraction for those
+                    // it brought back without text — the bytes decide what that run finds.
+                    const now = new Date().toISOString();
+                    // #1686: nothing the source queued runs in a copy; a return leaves it all queued. BEFORE
+                    // the extraction queue below, which is this scope's own work, not the source's.
+                    settleCopiedWork(this.switchSql(), destScopeId, sourceScopeId, now);
+                    if (markCopy)
+                        markCopyOrigin(this.switchSql(), now);
+                    // #1713: a return keeps the newer of this store's lifecycle and the dump's, so a backup
+                    // from before a suspension does not lift it; a copy keeps only its own.
+                    settleLifecycleAfterLoad(this.switchSql(), lifecycleBefore, markCopy === true || isCopyLoad(destScopeId, sourceScopeId));
+                    reconcileAttachmentText(doSpineSql(this.sql), ulid, now);
+                    // Re-point the restored grants at THIS scope (after the spine exists, so a dump
+                    // that carried no tuples table still finds one here).
+                    if (destScopeId) {
+                        this.rewriteScopeTuples(destScopeId, sourceScopeId && { scopeId: sourceScopeId, exact }, new Date().toISOString());
+                    }
+                    // #1742: the recorded-off modules go back off INSIDE the replay's transaction, with
+                    // the spine and the re-point. A switch that throws rolls the whole restore back, so
+                    // the dump's grants never commit live without the switch that should cover them.
+                    return destScopeId && switchOff
+                        ? switchRecordedOff(this.switchSql(), { scopeId: destScopeId, ...switchOff })
+                        : [];
+                }
+                finally {
+                    this.revisionSuspended = false;
                 }
-                // #1742: the recorded-off modules go back off INSIDE the replay's transaction, with
-                // the spine and the re-point. A switch that throws rolls the whole restore back, so
-                // the dump's grants never commit live without the switch that should cover them.
-                return destScopeId && switchOff
-                    ? switchRecordedOff(this.switchSql(), { scopeId: destScopeId, ...switchOff })
-                    : [];
             });
+            this.carriedAwayCopy = this.metaValue(CARRIED_AWAY_KEY) !== null;
             // Rebuild the derived search indexes over the rows just loaded (#827). Drop-then-
             // create, so it also repairs an index a dump left stale, and the triggers it
             // recreates are what keep the restored scope in step from here. Skipped for a plan
@@ -3675,6 +4019,18 @@ export function defineScopeDO(modules, bareOps) {
                 for (const stmt of splitSqlStatements(searchIndexDdl(plan)))
                     this.sql.exec(stmt);
             }
+            // #1335 / #1686: the outbox arrived with the dump, so this DO's event ids resume above it,
+            // as on a wake. A copy's own events then sort above every copied one, which is what
+            // `emittedHere()` relies on. A dump whose top id is no ULID leaves the floor where it was.
+            const top = this.sql.exec('SELECT MAX(id) AS id FROM _substrat_outbox').toArray()[0]?.id;
+            if (top) {
+                try {
+                    this.mintEventId.seedFrom(top);
+                }
+                catch {
+                    // Not a ULID: nothing this mint could have written, so there is no floor to keep.
+                }
+            }
             // The frontier arrived with the dump — refresh the in-memory applied set so a
             // later migrate() builds on the imported state, not the provisioning state.
             this.applied.clear();
@@ -3708,6 +4064,164 @@ export function defineScopeDO(modules, bareOps) {
             this.lastFailure = null;
             return switched;
         }
+        /**
+         * `importDump` with its two refusals answered as values (#1722): across this RPC a throw
+         * carries only its message, and the host has to tell "the store moved since it was read"
+         * (`changed`, 412) and "this store is a kept copy" (`kept`, 409) from a failure.
+         */
+        async importDumpChecked(tables, destScopeId, opts) {
+            try {
+                return { refused: false, switchedOff: await this.importDump(tables, destScopeId, opts) };
+            }
+            catch (e) {
+                const code = errorCodeOf(e);
+                if (code === 'precondition_failed')
+                    return { refused: 'changed' };
+                if (code === 'conflict')
+                    return { refused: 'kept' };
+                throw toRpcError(e);
+            }
+        }
+        /** The kept-copy marker (#1722), or null when this store is not one. */
+        keptCopy() {
+            const raw = this.metaValue(KEPT_DIVERGENT_KEY);
+            return raw ? JSON.parse(raw) : null;
+        }
+        /**
+         * Release a kept copy that is the scope's live store after all (#1722, Codex #2008 r8): a carry
+         * that protected its source when the route read elsewhere, while a rollback was about to bind
+         * it. Clears the marker only, fenced on the write revision read; the data stays as it is.
+         */
+        releaseKeptCopy(revision, 
+        /** The directory says this scope is not primary (#2005): the released store is marked a copy. */
+        markCopy, 
+        /** The load stamp read with `revision` (Codex #2008 r13): a store a load replaced is refused.
+         *  A kept copy refuses every load but its own resolution, so this holds by construction too. */
+        loadStamp) {
+            return this.revision.transactionSync(() => {
+                if (!this.metaValue(KEPT_DIVERGENT_KEY))
+                    return { refused: 'not-kept' };
+                if (this.metaValue(WRITE_REVISION_KEY) !== revision)
+                    return { refused: 'changed' };
+                if (loadStamp !== undefined && this.metaValue(LOAD_STAMP_KEY) !== loadStamp)
+                    return { refused: 'changed' };
+                this.sql.exec(`DELETE FROM _substrat_meta WHERE key = ?`, KEPT_DIVERGENT_KEY);
+                if (markCopy)
+                    this.revision.bookkeeping(() => markCopyOrigin(this.switchSql(), new Date().toISOString()));
+                return { released: true };
+            });
+        }
+        /**
+         * Discard a kept copy (#1722): the staff resolution that wipes it to the tombstone, only if it
+         * is still one at the write revision the operator acted on. The marker goes with the wipe.
+         */
+        async discardKeptCopy(scopeId, revision, carriedAway, 
+        /** The directory says this scope is not primary (#2005): as `wipeCarried`. */
+        markCopy, 
+        /** The load stamp read with `revision` (Codex #2008 r13), as `releaseKeptCopy`. */
+        loadStamp) {
+            if (!this.metaValue(KEPT_DIVERGENT_KEY))
+                return { refused: 'not-kept' };
+            try {
+                await this.importDump(carriedAwayDump(carriedAway), scopeId, {
+                    sourceScopeId: scopeId,
+                    resolveKept: { revision, ...(loadStamp !== undefined ? { loadStamp } : {}) },
+                    markCopy: markCopy === true || this.isCopy(), // #2005: as `wipeCarried`
+                });
+                return { discarded: true };
+            }
+            catch (e) {
+                if (errorCodeOf(e) === 'precondition_failed')
+                    return { refused: 'changed' };
+                throw toRpcError(e);
+            }
+        }
+        /** What a carry's restore into this store expects to find unchanged (#1722): see `LoadMarker`. */
+        loadMarker() {
+            return { loadStamp: this.metaValue(LOAD_STAMP_KEY), revision: this.metaValue(WRITE_REVISION_KEY) };
+        }
+        /** This store's load stamp (#1722), or null when no load has written one. */
+        loadStamp() {
+            return this.metaValue(LOAD_STAMP_KEY);
+        }
+        metaValue(key) {
+            const row = this.sql.exec(`SELECT value FROM _substrat_meta WHERE key = ?`, key).toArray()[0];
+            return row?.value ?? null;
+        }
+        /**
+         * Wipe the copy a carry left in this script (#1722), only if nothing was loaded here since
+         * the carry exported it. A rollback that restored into this DO in the meantime replaced or
+         * cleared the stamp, and its restore stays. Non-terminal, unlike `destroyStorage`: the store is a load of
+         * the `carriedAway` tombstone, so a later restore into it works as on any scope. False when
+         * refused.
+         */
+        async wipeCarried(scopeId, expectLoadStamp, carriedAway, { expectRevision, protectIfChanged, markCopy, } = {}) {
+            // A store marked now stays one: the copy-origin row goes on the tombstone (the wipe), or
+            // on the copy kept (a refusal), and never counts as a data write (`bookkeeping`).
+            const copy = markCopy === true || this.isCopy();
+            try {
+                await this.importDump(carriedAwayDump(carriedAway), scopeId, {
+                    sourceScopeId: scopeId,
+                    expect: { loadStamp: expectLoadStamp, ...(expectRevision !== undefined ? { revision: expectRevision } : {}) },
+                    // #2005: a copy wiped is still a copy. The drop-and-replay takes the copy-origin row
+                    // with everything else, so it is written again, or the tombstone would read as primary.
+                    markCopy: copy,
+                });
+                return true;
+            }
+            catch (e) {
+                const code = errorCodeOf(e);
+                // Only on the directory's word: the store's own marker, read before the refused load, may
+                // have been cleared by staff since (Codex #2008 r12), and marking it again would undo that.
+                if (markCopy === true) {
+                    this.revision.transactionSync(() => this.revision.bookkeeping(() => markCopyOrigin(this.switchSql(), carriedAway.at)));
+                }
+                if (code === 'conflict') {
+                    // Already a kept copy, and the scope has been carried away from it again (Codex #2008
+                    // r9). That is recorded on the marker, which is a write: it advances the revision, so a
+                    // release (staff or a carry's auto-release) that read the revision before this, when the
+                    // scope still routed here, fails its compare-and-set rather than clearing the marker of
+                    // a copy the scope has just left.
+                    this.revision.transactionSync(() => {
+                        const raw = this.metaValue(KEPT_DIVERGENT_KEY);
+                        if (!raw)
+                            return;
+                        const kept = { ...JSON.parse(raw), leftAgain: { to: carriedAway.to, at: carriedAway.at } };
+                        this.sql.exec(`UPDATE _substrat_meta SET value = ? WHERE key = ?`, JSON.stringify(kept), KEPT_DIVERGENT_KEY);
+                    });
+                    return false;
+                }
+                if (code !== 'precondition_failed')
+                    throw toRpcError(e);
+                // Refused. When nothing was LOADED here since the export (the stamp is the one read) but
+                // the store was WRITTEN (the revision moved), the copy holds a write the carry never
+                // copied: protect it in the store itself, decided again inside its own transaction.
+                this.revision.transactionSync(() => {
+                    const now = this.loadMarker();
+                    const writtenSince = expectRevision !== undefined && now.loadStamp === expectLoadStamp && now.revision !== expectRevision;
+                    const changedSince = now.loadStamp !== expectLoadStamp || (expectRevision !== undefined && now.revision !== expectRevision);
+                    // A wiped copy holds nothing to protect (and takes no write, the marker included).
+                    if (this.carriedAwayCopy || this.metaValue(KEPT_DIVERGENT_KEY))
+                        return;
+                    if (!writtenSince && !(protectIfChanged && changedSince))
+                        return;
+                    const kept = { carriedTo: carriedAway.to, keptAt: carriedAway.at, revision: now.revision };
+                    this.sql.exec(`INSERT INTO _substrat_meta (key, value) VALUES (?, ?)`, KEPT_DIVERGENT_KEY, JSON.stringify(kept));
+                    // Codex #2008 r12: changed ONLY by a staff clear of the copy marker — the clear's own
+                    // revisions span exactly the export's and the store's now — so the data is what the carry
+                    // copied, and only the fresher classification is not. Recorded on the marker with the
+                    // revision this keep committed at (the same run: no second bump), which the platform's
+                    // discard is fenced on once it has brought the clear to where the scope runs.
+                    const cleared = this.metaValue(COPY_MARK_CLEARED_KEY);
+                    const span = cleared ? JSON.parse(cleared) : null;
+                    if (writtenSince && span && span.from === expectRevision && span.to === now.revision) {
+                        const settled = { ...kept, clearedOnly: { revision: this.metaValue(WRITE_REVISION_KEY) } };
+                        this.sql.exec(`UPDATE _substrat_meta SET value = ? WHERE key = ?`, JSON.stringify(settled), KEPT_DIVERGENT_KEY);
+                    }
+                });
+                return false;
+            }
+        }
         /**
          * Re-point scope-level tuples at the scope they now live in.
          *
@@ -3854,6 +4368,13 @@ export function defineScopeDO(modules, bareOps) {
          * later alarm-driven drain with a call it had nothing to do with.
          */
         invocationId = null;
+        /**
+         * #1901: the id a unit of async work with no call around it logs under — a consumer a
+         * seed or an import delivered — set for its handler's duration and cleared after. Read
+         * by `ctx.log` only, never the spine: an event a consumer emits outside a call still
+         * records no invocation (#1525), while its log lines join the consumer's own line.
+         */
+        unitInvocationId = null;
         async dispatch(tenantId, scopeId, 
         /**
          * #1525: the call this drain is running in, or null. Every round of the loop
@@ -3861,13 +4382,23 @@ export function defineScopeDO(modules, bareOps) {
          * whole cascade is one call's work.
          */
         invocationId) {
+            // #1901: one line per delivery, capped per drain.
+            const lines = asyncLinePass();
+            try {
+                await this.dispatchRounds(tenantId, scopeId, invocationId, lines);
+            }
+            finally {
+                lines.end();
+            }
+        }
+        async dispatchRounds(tenantId, scopeId, invocationId, lines) {
             for (let round = 0; round < 50; round++) {
                 let deliveredAny = false;
                 for (const mod of this.modules.values()) {
                     for (const consumer of mod.consumers) {
                         const rows = this.sql
                             .exec(`SELECT * FROM _substrat_outbox o
-                 WHERE o.type = ?
+                 WHERE o.type = ? AND ${emittedHere('o.')}
                    AND NOT EXISTS (
                      SELECT 1 FROM _substrat_deliveries d
                      WHERE d.event_id = o.id AND d.consumer_module = ?
@@ -3875,6 +4406,20 @@ export function defineScopeDO(modules, bareOps) {
                  ORDER BY o.id`, consumer.eventType, mod.id)
                             .toArray();
                         for (const row of rows) {
+                            // #1901: this delivery's line — the call's id when it runs in one, else its own.
+                            const unit = {
+                                kind: 'consumer',
+                                tenantId,
+                                scopeId,
+                                invocationId: asyncInvocationId(invocationId),
+                                operation: mod.id,
+                                eventType: consumer.eventType,
+                                eventId: row.id,
+                                // A module consumer is tried once: a throw dead-letters it (v0).
+                                attempt: 1,
+                                startedAt: Date.now(),
+                                versionId: this.env.SUBSTRAT_VERSION_ID ?? null,
+                            };
                             let event;
                             try {
                                 event = domainEventOf(row);
@@ -3888,14 +4433,18 @@ export function defineScopeDO(modules, bareOps) {
                                 this.sql.exec(`INSERT INTO _substrat_deliveries
                      (event_id, consumer_module, delivered_at, error, invocation_id)
                    VALUES (?, ?, ?, ?, ?)`, row.id, mod.id, new Date().toISOString(), String(err), invocationId);
+                                // Never reached the handler, so nothing threw in it: a warning, not an error.
+                                lines.write({ ...unit, outcome: 'dead-lettered' });
                                 continue;
                             }
                             // #1237: anything this consumer emits was emitted BECAUSE of this event
                             // — the step a backwards walk used to stop dead at, since a consumer
                             // emit records no operation either.
                             this.causedBy = event.id;
+                            // #1901: the handler's `ctx.log` lines join this delivery's line.
+                            this.unitInvocationId = unit.invocationId;
                             try {
-                                await this.ctx.storage.transaction(async () => {
+                                await this.revision.transaction(async () => {
                                     const ctx = this.operationContext(this.systemPrincipal, tenantId, scopeId, {
                                         system: mod.id,
                                     });
@@ -3905,6 +4454,7 @@ export function defineScopeDO(modules, bareOps) {
                      VALUES (?, ?, ?, ?)`, event.id, mod.id, new Date().toISOString(), invocationId);
                                 });
                                 deliveredAny = true;
+                                lines.write({ ...unit, outcome: 'delivered' });
                             }
                             catch (err) {
                                 // Dead-letter (v0): journal the failure so one poison event
@@ -3912,8 +4462,10 @@ export function defineScopeDO(modules, bareOps) {
                                 this.sql.exec(`INSERT INTO _substrat_deliveries
                      (event_id, consumer_module, delivered_at, error, invocation_id)
                    VALUES (?, ?, ?, ?, ?)`, event.id, mod.id, new Date().toISOString(), String(err), invocationId);
+                                lines.write({ ...unit, outcome: 'dead-lettered', error: err });
                             }
                             finally {
+                                this.unitInvocationId = null;
                                 // Cleared on BOTH paths. Left set, the id leaks onto every later emit
                                 // this DO makes — an operation's own event stamped as caused by
                                 // whatever was delivered last, which is worse than recording nothing
@@ -4081,7 +4633,7 @@ export function defineScopeDO(modules, bareOps) {
              * owns that stack itself. It is exactly this asymmetry that makes `RunSub`
              * closure-shaped rather than an enter/rollback/release triple.
              */
-            const runSub = (_depth, fn) => this.ctx.storage.transaction(fn);
+            const runSub = (_depth, fn) => this.revision.transaction(fn);
             // Lifted so `grant` reuses the SAME check the operation itself passes —
             // a delegation check that could differ from the operation's would be a
             // second opinion about what the caller holds.
@@ -4178,7 +4730,7 @@ export function defineScopeDO(modules, bareOps) {
                     tenantId,
                     scopeId,
                     operation: operation ?? null,
-                    invocationId: () => this.invocationId,
+                    invocationId: () => this.invocationId ?? this.unitInvocationId,
                     principalKind: systemActor ? 'system' : subject.kind,
                     // The string-safe redaction: `redactSecrets` parses its serialization back, and a
                     // log's text is not JSON.
@@ -4259,7 +4811,7 @@ export function defineScopeDO(modules, bareOps) {
                     });
                     const rows = sql.exec(q.sql, ...q.params).toArray();
                     const last = rows.length >= limit ? rows[rows.length - 1] : undefined;
-                    const nextCursor = last === undefined ? null : cursorOf(last, q.sortColumn, plan.idColumn);
+                    const nextCursor = last === undefined ? null : cursorOf(last, q.sortColumn, plan.idColumn, q.order);
                     const page = { entries: rows, nextCursor };
                     if (!params.total)
                         return page;
@@ -4492,7 +5044,7 @@ export function defineScopeDO(modules, bareOps) {
             // The whole body is synchronous storage work, so it is ONE transaction (#1738): the queue
             // serializes but does not roll back, and a role insert that throws part-way must not leave
             // the receipt (or a half-replaced role set) behind for `servesTenant` to trust.
-            return this.queue.enqueue(() => this.ctx.storage.transactionSync(() => {
+            return this.queue.enqueue(() => this.revision.transactionSync(() => {
                 // #1738: the receipt `servesTenant` reads. First writer wins: absent or equal is written,
                 // a receipt for ANOTHER tenant refuses the whole projection (K-3), before a single row
                 // moves, so a misdirected projection can never re-point a scope or leave its roles behind.