@substrat-run/adapter-cloudflare 0.135.0 → 0.137.0

package/dist/host.js

@@ -1,7 +1,9 @@
+import { env as ambientEnv } from 'cloudflare:workers';
 import { isRewindRefusal, REWIND_REFUSED } from './rewind-refusal.js';
-import { delegatedReadParams, fromWireFailure, exportReadInput, exportedBatch, importBatch, importResult, importState, importsOfManifestJson, exportsOfManifestJson, importCursorMove, importCursorMoveAt, importCursorMoved, accessLogEntry, adminLogEntry, opsFailureEntry, opsFailureFingerprint, issueEntry, sweepRunEntry, FRESHNESS_HEARTBEAT_MINUTES, sweepRunsPayload, modelUsageEntry, attachmentRecord, createTenantInput, identityLink, identityPool, createOrgInput, promotionAcknowledgement, bindAcknowledgement, bindHostnameInput, channelHistoryEntry, hostnameBinding, publishVersionInput, AUTO_ADMISSION_NOTE, registerVerticalInput, vertical as verticalSchema, verticalServingState, verticalChannel, verticalVersion, connection, capabilityExchange, capabilityGrant, principalId, connectionGrant, connectionGrantRecord, connectionSecret, systemGrant, systemSwitch, systemSwitchOutcome, systemScheduleEntry, systemSwitchRecord, entitlementGrant, entitlementGrantInput, capabilityFilter, instant, meterReading, subjectRef, createConnectionInput, projectedConnectionGrant, projectedConnectionKey, moduleManifest, org as orgSchema, orgMembership, resolvedIdentity, identityMembership, roleDefinition, scope as scopeSchema, tenant as tenantSchema, tenantRole, delegatedReadRecord, ownerTransferAudit, subjectShredReceipt, connectorDispatchKind, callsOfManifestJson, outboundOfManifestJson, substratError, redrainEventsInput, coverage, peerCoverage, peerGrantsEntry, peerSwitch, peerSwitchOutcome, verticalCaller, verticalResolution, verticalSlug, entityObjectRef, } from '@substrat-run/contracts';
+import { isSystemDoorMoved, SYSTEM_DOOR_MOVED, SYSTEM_DOOR_REGATES } from './system-door.js';
+import { delegatedReadParams, fromWireFailure, exportReadInput, exportedBatch, importBatch, importResult, importState, importsOfManifestJson, exportsOfManifestJson, importCursorMove, importCursorMoveAt, importCursorMoved, accessLogEntry, adminLogEntry, opsFailureEntry, opsFailureFingerprint, issueEntry, sweepRunEntry, FRESHNESS_HEARTBEAT_MINUTES, sweepRunsPayload, modelUsageEntry, attachmentRecord, createTenantInput, identityLink, identityPool, createOrgInput, promotionAcknowledgement, bindAcknowledgement, bindHostnameInput, channelHistoryEntry, hostnameBinding, publishVersionInput, AUTO_ADMISSION_NOTE, registerVerticalInput, vertical as verticalSchema, verticalServingState, verticalChannel, verticalVersion, connection, capabilityExchange, mintedCapability, capabilityGrant, principalId, connectionGrant, connectionGrantRecord, connectionSecret, systemGrant, systemSwitch, systemSwitchOutcome, systemScheduleEntry, systemSwitchRecord, entitlementGrant, entitlementGrantInput, capabilityFilter, instant, meterReading, subjectRef, createConnectionInput, projectedConnectionGrant, projectedConnectionKey, moduleManifest, org as orgSchema, orgMembership, resolvedIdentity, identityMembership, roleDefinition, scope as scopeSchema, tenant as tenantSchema, tenantRole, delegatedReadRecord, ownerTransferAudit, copyMarkAudit, subjectShredReceipt, connectorDispatchKind, callsOfManifestJson, outboundOfManifestJson, substratError, redrainEventsInput, coverage, peerCoverage, peerGrantsEntry, peerSwitch, peerSwitchOutcome, verticalCaller, verticalResolution, verticalSlug, entityObjectRef, ATTACHMENT_BLOB_BINDING, blobStoreBindingName, lifecycleDelivery, scopeLifecycle, } from '@substrat-run/contracts';
 import { normalizeHostname, toRouteTarget } from './route-resolver.js';
-import { attachmentBlobKey, attachmentSha256, entitlementDenial, requiredEntitlementFor, foldMeterReading, parseValidationRecords, resolveScopeRecord, ulid, capabilityTokenHash, checkBecomeInput, plausibleSessionToken, foldModelUsage, backoffAt, resolveRetryPolicy, isSecretBoxConfigured, unconfiguredSecretBox, createSubjectKeys, generateSealingKeyPair, openSealed, ImpersonationRefused, assertSessionUsable, impersonationRowValues, mapImpersonationRow, newImpersonationSession, jobRunOf, runDueJobRuns, startJobRun, attachmentTextJob, assertAttachmentExtractors, assertJobRegistrable, isAttachmentTextRun, searchLimit, searchMatchExpression, globalFetch, assertRedrainWindow, platformRequestOf, undrainedEventsOf, inUnitMovesToAudit, staleCarryRevertRow, staleCarryReverts, withRecorded, systemSwitchedOffMessage, tenantSystemSwitchedOffMessage, CrossVerticalRegistry, importCursorSourceOf, exportBreaksOf, exportBreakRefusal, bindExportBreaksOf, bindExportBreakRefusal, collectPeers, peerSeats, connectorCallRecord, noopConnectorCallRecorder, recordConnectorCall, settleConnectionUse, splitManifestMigrations, unknownRoleError, assertRowLimit, assertRowOffset, } from '@substrat-run/kernel';
+import { attachmentBlobKey, attachmentSha256, entitlementDenial, requiredEntitlementFor, foldMeterReading, parseValidationRecords, resolveScopeRecord, ulid, KEPT_COPY_REFUSAL, capabilityTokenHash, checkBecomeInput, plausibleSessionToken, foldModelUsage, backoffAt, resolveRetryPolicy, isSecretBoxConfigured, unconfiguredSecretBox, createSubjectKeys, generateSealingKeyPair, openSealed, ImpersonationRefused, assertSessionUsable, impersonationRowValues, mapImpersonationRow, newImpersonationSession, jobRunOf, runDueJobRuns, SYSTEM_DOOR_WAIT, startJobRun, attachmentTextJob, assertAttachmentExtractors, assertJobRegistrable, isAttachmentTextRun, searchLimit, searchMatchExpression, globalFetch, assertRedrainWindow, platformRequestOf, undrainedEventsOf, inUnitMovesToAudit, staleCarryRevertRow, staleCarryReverts, withRecorded, systemSwitchedOffMessage, tenantSystemSwitchedOffMessage, CrossVerticalRegistry, importCursorSourceOf, exportBreaksOf, exportBreakRefusal, bindExportBreaksOf, bindExportBreakRefusal, collectPeers, peerSeats, connectorCallRecord, noopConnectorCallRecorder, recordConnectorCall, settleConnectionUse, splitManifestMigrations, unknownRoleError, assertRowLimit, assertRowOffset, INERT_SCOPE_REASON, lifecycleReceipt, lifecycleRefusal, isPrimaryScope, isPrimaryScopeRow, asyncInvocationId, asyncLinePass, } from '@substrat-run/kernel';
 import { attributedHost } from '@substrat-run/kernel';
 import { isOrangeToOrange, isUpgradeRequest, LIVE_MODE_HEADER, LIVE_PRINCIPAL_HEADER, LIVE_SCOPE_HEADER, LIVE_SUBSCRIBE_PATH, LIVE_TENANT_HEADER, } from './live-reads.js';
 import { tenantStoreDatabaseName } from './d1.js';
@@ -30,12 +32,52 @@ function unwrapCapabilityReply(reply) {
         throw fromWireFailure(reply.failure);
     return reply.value;
 }
+/**
+ * How far ahead of the clock a held lifecycle epoch may be and still be learned past (#1713). An
+ * epoch is the time a directory restore minted it, so a legitimate one is behind its minter's
+ * clock; the skew allows for clocks that disagree, and bounds what a forged answer can move.
+ */
+export const LIFECYCLE_EPOCH_SKEW_MS = 24 * 60 * 60 * 1000;
+/**
+ * #2016: how many served scopes one heal pass asks for their tenant record, beyond the drift and the
+ * holds. Rotated least-recently-asked first, so a deployment that cannot answer yet (a build from
+ * before the record) costs at most this many deliveries a pass and starves nothing.
+ */
+export const TENANT_UNRECORDED_PER_PASS = 50;
+/**
+ * K-3's refusal of a (tenant, scope) pair the host does not hold — the same answer for a scope that
+ * does not exist and for one of another tenant (#1718), in one wording.
+ */
+const unknownScopeForTenant = (tenantId, scopeId) => substratError('not_found', `unknown scope for tenant: (${tenantId}, ${scopeId})`);
+/**
+ * #2016: the line a CP-less host writes each time it admits a pair to a scope with no tenant record
+ * and no role rows — nothing to hold the pair against. Ids only.
+ */
+export const tenantUnrecordedLine = (tenantId, scopeId) => ({
+    substrat: 'tenant-unrecorded',
+    level: 'warn',
+    tenantId,
+    scopeId,
+    message: 'admitted to a scope whose tenant is not recorded; a reconcile or lifecycle delivery records it',
+});
+/**
+ * Refuse to mark a scope a copy unless the request classifies it non-primary (#2005). The
+ * classification is the platform directory's; the vertical applies the same `isPrimaryScope` to
+ * it, so a primary can be marked only by a request that misstates its lineage, never by default.
+ */
+function assertCopyLineage(lineage) {
+    if (isPrimaryScope(lineage)) {
+        throw substratError('conflict', 'mark-copy refused: the directory classifies this scope as primary, not as a copy');
+    }
+}
 /**
  * A control-plane stand-in for a CP-less vertical (scope-local-permissions.md Phase 3).
  * The hot path a served scope actually touches becomes trust-the-upstream:
- *   - `scopeAccessRefusal` / `setMigrationState` → no-op: the router already gated the
- *     scope's lifecycle + tenancy from the shared directory, so the vertical trusts the
- *     asserted node rather than re-reading a directory it does not have.
+ *   - `scopeAccessRefusal` / `setMigrationState` → no-op: the router gates the scope's
+ *     lifecycle + tenancy from the shared directory, and the vertical does not re-read a
+ *     directory it does not have. Its own half of both gates reads the scope's storage
+ *     instead (`validateScopeAccess`): the tenant the scope was provisioned for (#2016) and the lifecycle
+ *     the platform delivered (#1713).
  *   - `tenantHoldsEntitlement` → true: the SKU was enforced on the shared control plane
  *     at provision (before `provisionInstance`), so a scope that EXISTS here was granted
  *     it upstream — a single-vertical deployment holds its own entitlements by construction.
@@ -53,12 +95,14 @@ function nullControlPlane() {
         // #1674: the schedule switch's record is a DIRECTORY store, and a CP-less host has no
         // directory — the shared control plane that delegates here keeps it. Same posture as
         // `recordAdmin`: nothing to write, nothing recorded to read back.
-        recordSystemSwitchedOff: noop,
+        recordSystemSwitchedOff: async () => null,
         recordSystemSwitchedOn: async () => null,
         restoreSystemSwitchRecord: noop,
         listSystemSwitches: async () => [],
         systemSwitchRecordsOf: async () => [],
         switchedOffModulesOf: async () => [],
+        // #1823: no tenant tuples here either — the platform reads them and sends `tenantHeld`.
+        tenantHeldSystemModules: async () => [],
     };
     return new Proxy({}, {
         get: (_t, prop) => typeof prop === 'string' && prop in passthrough
@@ -106,6 +150,28 @@ export const SWITCH_HOLD_EXTRA_WAITS = 3;
  * clock, against the releasing host's clock: minutes, not seconds.
  */
 export const SWITCH_HOLD_PENDING_MAX_MS = 5 * 60_000;
+/**
+ * An OFF of a tenant-held module whose far end did not attest `deniesTenantGrants` (#1823): it
+ * switched, but its evaluator still authorizes the module's tenant-level grant on the scope.
+ * Carries the far end's outcome, so the operator's OFF knows whether there is a move to put back.
+ */
+class UnattestedSwitchOff extends Error {
+    outcome;
+    constructor(scopeId, moduleId, outcome) {
+        super(`the deployment serving scope ${scopeId} predates the kill switch's tenant-grant denial (#1823): ` +
+            `module '${moduleId}' holds a tenant-level grant that its OFF would leave authorizing there. ` +
+            `Redeploy the vertical, then retry.`);
+        this.outcome = outcome;
+    }
+}
+/**
+ * The attachment bucket a host resolves when it was handed no resolver (#1995): the
+ * platform's per-tenant binding, read off this script's own env, named by the one shared
+ * encoding (`blobStoreBindingName`) for the tenant the caller passed in.
+ */
+function ambientAttachmentBucket(tenantId) {
+    return ambientEnv[blobStoreBindingName(ATTACHMENT_BLOB_BINDING, tenantId)] ?? null;
+}
 export class CloudflareScopeHost {
     admin;
     scopeNs;
@@ -145,7 +211,7 @@ export class CloudflareScopeHost {
     tenantStores;
     /** The live R2 client for per-tenant blob stores (#473); undefined ⇒ refuse loudly. */
     blobStores;
-    /** Worker-side attachment-bucket resolver (#473); undefined ⇒ attachments() refuses. */
+    /** Worker-side attachment-bucket resolver (#473); the ambient per-tenant binding unless overridden (#1995). */
     attachmentBuckets;
     /** The parsers attachment text is extracted with (K-43); the host's own, never imported here. */
     attachmentExtractors;
@@ -180,6 +246,8 @@ export class CloudflareScopeHost {
     eventDrainDelegation;
     /** #1666: the schedule kill switch's reach into the deployment serving a scope. */
     systemSwitchDelegation;
+    /** #1713: the lifecycle's reach into the deployment serving a scope. */
+    lifecycleDelegation;
     /** #1706: the peer kill switch's reach into the deployment serving a scope. */
     peerSwitchDelegation;
     /** #1705 PR 3: the replay lever's reach into the deployment serving a consumer scope. */
@@ -211,7 +279,7 @@ export class CloudflareScopeHost {
         this.secretBox = options.secretBox ?? unconfiguredSecretBox;
         this.tenantStores = options.tenantStores;
         this.blobStores = options.blobStores;
-        this.attachmentBuckets = options.attachmentBuckets;
+        this.attachmentBuckets = options.attachmentBuckets ?? ambientAttachmentBucket;
         assertAttachmentExtractors(options.attachmentExtractors ?? []);
         this.attachmentExtractors = options.attachmentExtractors ?? [];
         this.fetchImpl = options.fetch ?? globalFetch;
@@ -225,6 +293,7 @@ export class CloudflareScopeHost {
         this.connectorDelegation = options.connectorDelegation;
         this.eventDrainDelegation = options.eventDrainDelegation;
         this.systemSwitchDelegation = options.systemSwitchDelegation;
+        this.lifecycleDelegation = options.lifecycleDelegation;
         this.peerSwitchDelegation = options.peerSwitchDelegation;
         this.importCursorDelegation = options.importCursorDelegation;
         this.admin = this.buildAdmin();
@@ -353,21 +422,78 @@ export class CloudflareScopeHost {
         };
         if (this.executors.size === 0)
             return report;
+        // #1901: one line per attempt, capped per pass. Written on the coordinator, where the
+        // attempt runs — the DO only journals it.
+        const lines = asyncLinePass();
+        try {
+            await this.drainExecutorsPass(tenantId, scopeId, invocationId, report, lines);
+        }
+        finally {
+            lines.end();
+        }
+        return report;
+    }
+    async drainExecutorsPass(tenantId, scopeId, invocationId, report, lines) {
         const stub = this.scopeStub(scopeId);
-        for (const [id, executor] of this.executors) {
+        // #2005: a non-primary scope (a fork, a snapshot, a preview of either kind) causes no
+        // outbound effects, so its deliveries are journaled terminal with the reason and no
+        // handler runs. Asked of the directory where there is one. A CP-less host has none, so it
+        // asks the scope's own storage whether it is classified a copy (`_substrat_copy_origin`'s
+        // `is_copy`, #2009, set on the directory's word) — a preview and a snapshot reach a hosted
+        // vertical as restores the platform marks.
+        // Asked on the first due event, once per pass: most passes have none, and the directory
+        // is one global object.
+        let inert;
+        const isInert = () => (inert ??= this.cpLess
+            ? stub.isCopy()
+            : this.cp.getScopeRecord(tenantId, scopeId).then((row) => !isPrimaryScopeRow(row)));
+        // #1713: a CP-less scope its lifecycle holds attempts nothing and journals nothing, so every
+        // due delivery stays due for the first pass after it is live again. Asked on the first due
+        // event, like `isInert`. Every caller passed `assertLive` already, so this is for the scope
+        // suspended between that gate and the drain: a request in flight, whose write commits while
+        // its effect waits. A host with a directory answers false without a read.
+        let held;
+        const isHeld = () => (held ??= this.lifecycleHeld(scopeId));
+        drain: for (const [id, executor] of this.executors) {
             const deliveryId = `executor:${id}`;
             const { events, undecodable } = await stub.pendingExecutorDeliveries(deliveryId, executor.eventType);
             // #1636: an event the DO could not decode is dead-lettered for this executor at once,
             // and its handler never sees it. Terminal on the FIRST failure, unlike a handler's:
             // the decode is pure, so a retry cannot succeed. The rows behind it are delivered
             // below — the decode used to throw the whole list, on every pass.
+            if ((undecodable.length > 0 || events.length > 0) && (await isHeld())) {
+                report.lifecycleHeld = true;
+                break drain;
+            }
+            // #1901: an attempt's line. The attempt number is the one the journal is about to record.
+            const unitOf = (eventId, attempt) => ({
+                kind: 'consumer',
+                tenantId,
+                scopeId,
+                invocationId: asyncInvocationId(invocationId),
+                operation: deliveryId,
+                eventType: executor.eventType,
+                eventId,
+                attempt,
+                startedAt: Date.now(),
+            });
             for (const bad of undecodable) {
                 report.attempted += 1;
-                await stub.recordExecutorAttempt(bad.eventId, deliveryId, bad.error, null, invocationId);
+                const attempt = await stub.recordExecutorAttempt(bad.eventId, deliveryId, bad.error, null, invocationId);
                 report.deadLettered += 1;
+                lines.write({ ...unitOf(bad.eventId, attempt), outcome: 'dead-lettered' });
             }
             for (const event of events) {
                 report.attempted += 1;
+                const startedAt = Date.now();
+                if (await isInert()) {
+                    // No next attempt, like an undecodable row: a scope does not become primary.
+                    const attempt = await stub.recordExecutorAttempt(event.id, deliveryId, INERT_SCOPE_REASON, null, invocationId);
+                    report.inert = (report.inert ?? 0) + 1;
+                    // Its own outcome, never `delivered`: no handler ran (#2005).
+                    lines.write({ ...unitOf(event.id, attempt), startedAt, outcome: 'inert' });
+                    continue;
+                }
                 this.causedBy = event.id;
                 try {
                     if (executor.kind === 'connector' && this.cpLess) {
@@ -381,16 +507,20 @@ export class CloudflareScopeHost {
                         // the at-least-once residue, as it already must in-process.
                         await stub.routeExecutorEventToPlatform(event.id, deliveryId, connectorDispatchKind(executor.provider), JSON.stringify({ executorId: id, event }), JSON.stringify({ system: 'connector-dispatch' }), invocationId);
                         report.routedToPlatform += 1;
+                        // Handed on, not run here: the platform's drain owns its attempts from now on.
+                        lines.write({ ...unitOf(event.id, 1), startedAt, outcome: 'routed' });
                     }
                     else if (executor.kind === 'connector') {
                         await executor.handler(await this.connectorContext(tenantId, scopeId, executor.timeoutMs, event.id), event);
-                        await stub.recordExecutorAttempt(event.id, deliveryId, null, null, invocationId);
+                        const attempt = await stub.recordExecutorAttempt(event.id, deliveryId, null, null, invocationId);
                         report.delivered += 1;
+                        lines.write({ ...unitOf(event.id, attempt), startedAt, outcome: 'delivered' });
                     }
                     else {
                         await executor.handler(this.admin, event);
-                        await stub.recordExecutorAttempt(event.id, deliveryId, null, null, invocationId);
+                        const attempt = await stub.recordExecutorAttempt(event.id, deliveryId, null, null, invocationId);
                         report.delivered += 1;
+                        lines.write({ ...unitOf(event.id, attempt), startedAt, outcome: 'delivered' });
                     }
                 }
                 catch (err) {
@@ -405,18 +535,23 @@ export class CloudflareScopeHost {
                         report.deadLettered += 1;
                     else
                         report.retrying += 1;
+                    lines.write({
+                        ...unitOf(event.id, attempts),
+                        startedAt,
+                        outcome: exhausted ? 'dead-lettered' : 'retrying',
+                        error: err,
+                    });
                 }
                 finally {
                     this.causedBy = null;
                 }
             }
         }
-        return report;
     }
     async drainDue(tenantId, scopeId) {
         // Same lifecycle gate `getScope` applies (K-3): a suspended or archived scope
         // does not get its effects driven either.
-        await this.validateScopeAccess(tenantId, scopeId);
+        await this.assertLive(tenantId, scopeId);
         await this.migrateAndRecord(scopeId);
         // #1525: null, and honestly so — a sweep is not a call. An attempt this pass makes
         // records no invocation, which is what distinguishes it from the first attempt the
@@ -448,7 +583,7 @@ export class CloudflareScopeHost {
         return {
             startOrJoin: (key, row) => stub.jobRunStartOrJoin(key.moduleId, key.job, key.instance, row),
             get: (id) => stub.jobRunById(id),
-            due: (now, limit, afterId) => stub.jobRunsDue(now, limit, afterId),
+            dueKeys: (now, max) => stub.jobRunsDueKeys(now, max),
             list: (filter) => stub.jobRunList(filter),
             patch: (id, patch) => stub.jobRunPatch(id, patch),
             commitPass: (id, patch) => stub.jobCommitPass(id, patch),
@@ -474,14 +609,14 @@ export class CloudflareScopeHost {
         this.attachmentExtractors);
     }
     async startJobRun(tenantId, scopeId, input) {
-        await this.validateScopeAccess(tenantId, scopeId);
+        await this.assertLive(tenantId, scopeId);
         await this.migrateAndRecord(scopeId);
         return jobRunOf(await startJobRun(this.jobStore(scopeId), input, ulid, () => new Date().toISOString()));
     }
     async runDueJobs(tenantId, scopeId, options) {
         // Same lifecycle gate as `drainDue`: a suspended scope's runs wait rather than
         // advance, and an archived one's never move again.
-        await this.validateScopeAccess(tenantId, scopeId);
+        await this.assertLive(tenantId, scopeId);
         await this.migrateAndRecord(scopeId);
         // #1575: the kernel's extraction job is this host's own, bound to this scope — no
         // deployment registers it, and none can shadow it.
@@ -490,7 +625,10 @@ export class CloudflareScopeHost {
             store: this.jobStore(scopeId),
             handlerFor: (run) => isAttachmentTextRun(run) ? attachmentText : this.jobs.get(`${run.module_id}/${run.job}`),
             now: () => new Date().toISOString(),
-            openScope: (run) => this.getSystemScope(run.module_id, tenantId, scopeId),
+            // #1834: the door is opened FOR this pass, so its "not now" is tied to this pass alone.
+            openScope: async (run, pass) => this.buildStub(tenantId, scopeId, undefined, undefined, await this.openSystemDoor(run.module_id, tenantId, scopeId, undefined, pass)),
+            // #1834: only this host's own door refusals defer a pass, recognised by identity.
+            deferral: (err, pass) => this.takeDoorWait(err, pass),
             maxPasses: options?.maxPasses,
             limit: options?.limit,
         });
@@ -506,7 +644,7 @@ export class CloudflareScopeHost {
         // same context build as the in-process path, so the handler cannot tell which host
         // ran it. On a CP-less host `connectorContext` throws from the null control plane:
         // fail closed, exactly the hole routing exists to avoid.
-        await this.validateScopeAccess(tenantId, scopeId);
+        await this.assertLive(tenantId, scopeId);
         this.causedBy = event.id;
         try {
             await handler(await this.connectorContext(tenantId, scopeId, options?.timeoutMs ?? 30_000, event.id), event);
@@ -570,7 +708,7 @@ export class CloudflareScopeHost {
         const rec = await this.cp.getScopeRecord(tenantId, scopeId);
         // K-3: a scope under another tenant is indistinguishable from one that does not exist.
         if (!rec)
-            throw substratError('not_found', `unknown scope for tenant: (${tenantId}, ${scopeId})`);
+            throw unknownScopeForTenant(tenantId, scopeId);
         if (rec.status !== 'active' && rec.status !== 'provisioning') {
             throw new Error(`scope not migratable (status: ${rec.status}): ${scopeId}`);
         }
@@ -642,6 +780,31 @@ export class CloudflareScopeHost {
     async listCapabilitiesLocal(scopeId, filter) {
         return this.scopeStub(scopeId).listCapabilities(filter);
     }
+    /**
+     * The platform's `become` mint on the CP-less path (#1686) — `HostAdmin.mintCapability`'s
+     * ScopeDO half, for the deployment that serves the scope. Its one caller is an owner claim
+     * link, minted on the platform's instruction behind the vertical's platform-gated
+     * `/internal/owner-claim`; the control plane made the K-3 check and keeps the admin log before
+     * it called. Not a module verb: a module mints through `ctx.capabilities`, which mints `act`
+     * capabilities only. Same lifecycle gate as the exchange, so a held scope mints nothing.
+     */
+    async mintCapabilityLocal(tenantId, scopeId, input, actor) {
+        // Checked on this side too, as `HostAdmin.mintCapability` does: a typed refusal thrown
+        // across the RPC arrives as a bare message.
+        checkBecomeInput(input, new Date().toISOString());
+        await this.assertLive(tenantId, scopeId);
+        await this.migrateAndRecord(scopeId);
+        return mintedCapability.parse(await this.scopeStub(scopeId).mintBecomeCapability(input, actor));
+    }
+    /**
+     * The platform's revoke on the CP-less path (#1686) — how a re-minted claim link retires the
+     * previous one. True when the scope held the capability (revoked now, or already); false when
+     * it holds no such capability. No lifecycle gate: a revoke only narrows, so a held scope still
+     * takes one. Idempotent.
+     */
+    async revokeCapabilityLocal(scopeId, capabilityId, actor) {
+        return (await this.scopeStub(scopeId).revokeCapabilityAsPlatform(capabilityId, actor)) !== null;
+    }
     /**
      * Copy one scope's data into a fresh scope DO, entirely within THIS deployment —
      * the data half of an orchestrated snapshot (preview-and-snapshots.md §9). Like the
@@ -650,10 +813,24 @@ export class CloudflareScopeHost {
      * activation, version bind) stays on the control plane's side. Because source and
      * destination sit in the same SCOPE namespace, no scope bytes ever leave the
      * deployment — the §9 property the trust line rests on.
+     *
+     * #2016: `tenantId`, the tenant the platform snapshots for (absent from an older platform). The
+     * source must not be foreign to it — a copy never reads another tenant's scope — and the fork
+     * records it as its own receipt, not the source's.
      */
-    async snapshotScopeLocal(sourceScopeId, destScopeId) {
+    async snapshotScopeLocal(sourceScopeId, destScopeId, tenantId) {
+        if (tenantId !== undefined && (await this.scopeStub(sourceScopeId).admission(tenantId)).verdict === 'foreign') {
+            throw unknownScopeForTenant(tenantId, sourceScopeId);
+        }
         const tables = await this.scopeStub(sourceScopeId).exportDump();
-        await this.scopeStub(destScopeId).importDump(tables, destScopeId, { sourceScopeId, exact: true });
+        // #2009: a snapshot is a fork by construction (the control plane's row names `forkedFrom`, so
+        // the directory never calls it primary), and a load classifies nothing by itself: marked here.
+        await this.scopeStub(destScopeId).importDump(tables, destScopeId, {
+            sourceScopeId,
+            exact: true,
+            markCopy: true,
+            provisionedFor: tenantId,
+        });
         return { tables: tables.length };
     }
     /**
@@ -666,14 +843,145 @@ export class CloudflareScopeHost {
     /** #1742: the directory's recorded-off modules, switched off on THIS scope in the replay's
      *  own event — a dump from before a switch was pulled brings its grants back live. #1869:
      *  `sourceScopeId`, the scope the dump was captured from, narrows the grant re-point to it;
-     *  `exact` says the platform exported the dump itself, so the re-point never falls back. */
+     *  `exact` says the platform exported the dump itself, so the re-point never falls back.
+     *  #1722: `loadStamp`, the stamp a carry leaves on the copy it lands, for a fenced wipe later,
+     *  and `expect`, the marker the carry read here: the load is refused if the store moved since.
+     *  #2005: `markCopy` — the directory's classification of the scope, sent when it is not
+     *  primary; the restore then marks it a copy. Refused if it classifies a primary.
+     *  #2016: `tenantId`, the tenant the platform restores for: recorded as the scope's receipt in
+     *  the load's own transaction, and a store provisioned for another tenant refuses the load. */
     opts) {
-        const switchedOff = await this.scopeStub(scopeId).importDump(tables, scopeId, {
-            switchOff: opts?.switchedOff ? { moduleIds: opts.switchedOff, at: new Date().toISOString() } : undefined,
+        if (opts?.markCopy)
+            assertCopyLineage(opts.markCopy);
+        const load = {
+            switchOff: opts?.switchedOff
+                ? { moduleIds: opts.switchedOff, at: new Date().toISOString(), tenantHeld: opts.tenantHeld }
+                : undefined,
             sourceScopeId: opts?.sourceScopeId,
             exact: opts?.exact,
+            loadStamp: opts?.loadStamp,
+            markCopy: opts?.markCopy !== undefined,
+            provisionedFor: opts?.tenantId,
+        };
+        // The refusals come back as values (a throw over the RPC carries only its message) and are
+        // thrown here, in the vertical's own isolate, so its route answers 409 or 412, not a fault.
+        const out = await this.scopeStub(scopeId).importDumpChecked(tables, scopeId, {
+            ...load,
+            ...(opts?.expect ? { expect: opts.expect } : {}),
         });
-        return { tables: tables.length, ...(opts?.switchedOff ? { switchedOff } : {}) };
+        if (out.refused === false) {
+            return { tables: tables.length, ...(opts?.switchedOff ? { switchedOff: out.switchedOff } : {}) };
+        }
+        if (out.refused === 'kept')
+            throw substratError('conflict', KEPT_COPY_REFUSAL);
+        if (out.refused === 'tenant')
+            throw substratError('conflict', out.message);
+        // A retry of a load that already committed (its answer was lost on the way back) is
+        // refused by the marker that load itself moved. The store holding THIS request's stamp
+        // says so: no other load writes it. Answered as applied, without `switchedOff`, so the
+        // caller's re-assert after the bind covers the OFF positions.
+        const now = await this.scopeStub(scopeId).loadMarker();
+        if (!opts?.loadStamp || now.loadStamp !== opts.loadStamp) {
+            throw substratError('precondition_failed', 'scope store changed since the carry read it; nothing was loaded (#1722)');
+        }
+        return { tables: tables.length };
+    }
+    /** The kept-copy marker of this scope's store in THIS deployment (#1722), or null. */
+    async keptCopyLocal(scopeId) {
+        return this.scopeStub(scopeId).keptCopy();
+    }
+    /**
+     * Discard the kept copy of a scope in THIS deployment (#1722), behind the vertical's
+     * `/internal/kept-copy/discard`: the staff resolution, only at the write revision the operator
+     * acted on. Answers whether it was discarded, or why not.
+     */
+    async discardKeptCopyLocal(scopeId, revision, carriedAway, 
+    /** #2005: the directory's classification, sent when the scope is not primary. */
+    markCopy, 
+    /** #1722 (Codex #2008 r13): the load stamp read with `revision`; a replaced store is refused. */
+    loadStamp) {
+        if (markCopy)
+            assertCopyLineage(markCopy);
+        return this.scopeStub(scopeId).discardKeptCopy(scopeId, revision, carriedAway, markCopy !== undefined, ...(loadStamp !== undefined ? [loadStamp] : []));
+    }
+    /**
+     * What a carry's restore into this scope's store expects to find unchanged (#1722), behind
+     * the vertical's `/internal/load-marker`. Read before the carry checks the binding again; the
+     * restore then carries it as `expect`, and is refused if the store was loaded or written since.
+     */
+    async loadMarkerLocal(scopeId) {
+        return this.scopeStub(scopeId).loadMarker();
+    }
+    /**
+     * Wipe the copy a carry left in THIS deployment (#1722), behind the vertical's
+     * `/internal/wipe-carried`: only if nothing was loaded into the scope's DO since the stamp
+     * the carry read (`expectLoadStamp`, null for a store no load has stamped). Non-terminal,
+     * so a later bind back to this version can restore into it. False when refused.
+     */
+    async wipeCarriedLocal(scopeId, expectLoadStamp, carriedAway, opts = {}) {
+        if (opts.markCopy)
+            assertCopyLineage(opts.markCopy);
+        return this.scopeStub(scopeId).wipeCarried(scopeId, expectLoadStamp, carriedAway, {
+            ...(opts.expectRevision !== undefined ? { expectRevision: opts.expectRevision } : {}),
+            ...(opts.protectIfChanged !== undefined ? { protectIfChanged: opts.protectIfChanged } : {}),
+            markCopy: opts.markCopy !== undefined,
+        });
+    }
+    /** Release a kept copy that is the live store after all (#1722), at the revision read. */
+    async releaseKeptCopyLocal(scopeId, revision, 
+    /** #2005: the directory's classification, sent when the scope is not primary. */
+    markCopy, 
+    /** #1722 (Codex #2008 r13): the load stamp read with `revision`; a replaced store is refused. */
+    loadStamp) {
+        if (markCopy)
+            assertCopyLineage(markCopy);
+        return this.scopeStub(scopeId).releaseKeptCopy(revision, markCopy !== undefined, ...(loadStamp !== undefined ? [loadStamp] : []));
+    }
+    /**
+     * Store the lifecycle the platform delivered for one scope in THIS deployment (#1713), behind
+     * the vertical's `/internal/lifecycle`. Kept unless the scope already holds a newer one, so a
+     * push that arrives late cannot undo a later transition. `applied` is what the platform's heal
+     * sweep records as delivered; `changed` says the gate's answer moved.
+     *
+     * #2016: `tenantId`, the tenant the directory delivered it for (absent from an older platform).
+     * A scope provisioned for another tenant refuses the delivery (`conflict`) and stores nothing;
+     * a scope provisioned before the tenant receipt existed records it here, its role rows agreeing.
+     */
+    async setLifecycleLocal(scopeId, next, tenantId) {
+        const out = await this.scopeStub(scopeId).setLifecycle(scopeLifecycle.parse(next), tenantId);
+        if ('refused' in out)
+            throw substratError('conflict', out.message);
+        return lifecycleDelivery.parse(out);
+    }
+    /**
+     * Mark one scope in THIS deployment a copy (#2005), behind the vertical's `/internal/mark-copy`:
+     * the repair of a copy that predates the marker, which a CP-less coordinator reads for primacy.
+     * The control plane decides which scopes (its directory says they are not primary) and audits.
+     */
+    async markCopyLocal(scopeId, lineage) {
+        assertCopyLineage(lineage);
+        return { marked: await this.scopeStub(scopeId).markCopy() };
+    }
+    /**
+     * Clear a mistaken copy classification from one scope in THIS deployment (#2005), behind the
+     * vertical's `/internal/clear-copy-mark`: staff's correction for a scope the directory says IS
+     * primary. Refused for a scope classified a copy. A load's copied-events mark is never touched
+     * (#2009), so a primary restored from another scope's backup runs its own effects again and
+     * still never runs the work it copied.
+     */
+    async clearCopyMarkLocal(scopeId, lineage, 
+    /** #1722 (Codex #2008 r12–r13): the store as the caller means it, its load stamp and write
+     *  revision, compared in the clear's own transaction; refused (412) if either moved. The
+     *  platform's reconcile of a carry's destination sends it; staff send none. */
+    expect) {
+        if (!isPrimaryScope(lineage)) {
+            throw substratError('conflict', 'clear-copy-mark refused: the directory classifies this scope as a copy (a preview or a fork)');
+        }
+        const outcome = await this.scopeStub(scopeId).clearCopyMark(...(expect ? [expect] : []));
+        if (outcome === 'changed') {
+            throw substratError('precondition_failed', `clear-copy-mark refused: scope ${scopeId}'s store changed since its revision was read`);
+        }
+        return { cleared: outcome === 'cleared' };
     }
     /**
      * Re-apply the vertical's OWN role definitions to one scope, CP-lessly — the
@@ -710,6 +1018,13 @@ export class CloudflareScopeHost {
     async exportScopeLocal(scopeId) {
         return this.scopeStub(scopeId).exportDump();
     }
+    /**
+     * `exportScopeLocal` with the store's load stamp, read in the same DO call (#1722): what a
+     * carry's fenced wipe of the copy it leaves here expects. Behind the vertical's `/internal/export`.
+     */
+    async exportScopeStampedLocal(scopeId) {
+        return this.scopeStub(scopeId).exportDumpStamped();
+    }
     /** Facet this host's own scope's outbox (#1239) — the vertical-host read. */
     async facetEventsLocal(scopeId, input) {
         return this.scopeStub(scopeId).facetEvents(input);
@@ -924,8 +1239,15 @@ export class CloudflareScopeHost {
         // after it then finds them off, and audits what the unit moved.
         const ownStore = this.cpLess || record.vertical === null;
         const recordedOff = ownStore ? await this.cp.switchedOffModulesOf(input.tenantId, input.scopeId) : [];
+        const seatAt = new Date().toISOString();
         const switchedOff = await this.scopeStub(input.scopeId).seatTuples(seats, recordedOff.length
-            ? { scopeId: input.scopeId, moduleIds: recordedOff, at: new Date().toISOString() }
+            ? {
+                scopeId: input.scopeId,
+                moduleIds: recordedOff,
+                at: seatAt,
+                // #1823: a recorded-off module held only by a tenant grant goes back off too.
+                tenantHeld: await this.cp.tenantHeldSystemModules(input.tenantId, recordedOff, seatAt),
+            }
             : undefined);
         if (ownStore) {
             await this.admin.reassertSystemSwitches(actor, { tenantId: input.tenantId, scopeId: input.scopeId }, { appliedInUnit: switchedOff });
@@ -1065,21 +1387,21 @@ export class CloudflareScopeHost {
         // gates and metadata facts live in the ScopeDO (per-scope serialization, spine event
         // in the same transaction); bytes go straight to the per-tenant R2 bucket through the
         // binding the vertical's worker resolved — never through the DO.
-        await this.validateScopeAccess(tenantId, scopeId);
+        await this.assertLive(tenantId, scopeId);
         await this.migrateAndRecord(scopeId);
         const store = await this.resolveAttachmentStore(tenantId);
         return this.buildAttachmentSurface({ principal }, tenantId, scopeId, store);
     }
     async getSystemAttachments(moduleId, tenantId, scopeId) {
-        // Reuse the system invoke door's module, tenant and lifecycle gate. The DO
-        // authorizes each open against the attachment target's read permission as
+        // Reuse the system invoke door's module, tenant and lifecycle gate, and its rewind gate
+        // (#1834). The DO authorizes each open against the attachment target's read permission as
         // system:<moduleId>; the worker reads bytes only after that gate succeeds.
-        await this.getSystemScope(moduleId, tenantId, scopeId);
+        const door = await this.openSystemDoor(moduleId, tenantId, scopeId);
         const store = await this.resolveAttachmentStore(tenantId);
         const stub = this.scopeStub(scopeId);
         return {
             open: async (attachmentId) => {
-                const record = await stub.systemAttachmentAuthorize(attachmentId, moduleId, tenantId, scopeId);
+                const record = await door.through((instance) => stub.systemAttachmentAuthorize(attachmentId, moduleId, tenantId, scopeId, instance));
                 return record ? this.openAttachmentBytes(store, scopeId, record) : null;
             },
         };
@@ -1138,17 +1460,14 @@ export class CloudflareScopeHost {
         const store = await this.resolveAttachmentStore(conn.tenant_id);
         return this.buildAttachmentSurface({ connectionId }, conn.tenant_id, scopeId, store, forEvent);
     }
-    /** Resolve the per-tenant R2 blob store, or fail closed exactly as `attachments` did. */
+    /** Resolve the per-tenant R2 blob store, or fail closed. */
     async resolveAttachmentStore(tenantId) {
-        if (!this.attachmentBuckets) {
-            throw new Error(`attachments are not configured on this host (#473): pass ` +
-                `CloudflareScopeHostOptions.attachmentBuckets — (tenantId) => ` +
-                `env[blobStoreBindingName('<BINDING>', tenantId)] for the vertical's declared blob store`);
-        }
         const bucket = await this.attachmentBuckets(tenantId);
         if (!bucket) {
-            throw new Error(`no attachment bucket resolved for tenant ${tenantId} (#473) — is the per-tenant blob ` +
-                `store provisioned and its r2_bucket binding attached to the serving script?`);
+            throw new Error(`no attachment bucket resolved for tenant ${tenantId} (#473, #1995) — this script has no ` +
+                `${blobStoreBindingName(ATTACHMENT_BLOB_BINDING, tenantId)} binding. A vertical whose modules declare ` +
+                `attachmentTargets gets one per installed tenant once it is pushed with a CLI that declares the ` +
+                `store (re-push); off the platform, pass CloudflareScopeHostOptions.attachmentBuckets.`);
         }
         return r2TenantBlobStore(bucket);
     }
@@ -1288,8 +1607,16 @@ export class CloudflareScopeHost {
         // restored in its deployment, which the platform carries the same list to.
         const ownStore = this.cpLess || existing.vertical === null;
         const recordedOff = ownStore ? await this.cp.switchedOffModulesOf(tenantId, scopeId) : [];
+        const replayAt = new Date().toISOString();
         const switchedOff = await this.scopeStub(scopeId).importDump(dump.tables, scopeId, {
-            switchOff: recordedOff.length ? { moduleIds: recordedOff, at: new Date().toISOString() } : undefined,
+            switchOff: recordedOff.length
+                ? {
+                    moduleIds: recordedOff,
+                    at: replayAt,
+                    // #1823: a recorded-off module held only by a tenant grant goes back off too.
+                    tenantHeld: await this.cp.tenantHeldSystemModules(tenantId, recordedOff, replayAt),
+                }
+                : undefined,
             sourceScopeId: opts?.sourceScopeId ?? dump.scopeId,
         });
         await this.recordAdmin(actor, 'restoreScope', { tenantId, scopeId }, null, { sourceScopeId: dump.scopeId, tables: dump.tables.length, capturedAt: dump.capturedAt });
@@ -1381,7 +1708,7 @@ export class CloudflareScopeHost {
     async getScope(principal, tenantId, scopeId, options) {
         // Lifecycle gates (control-plane.md §4.1/§4.2), the K-3 fail-closed path,
         // evaluated durably in the ControlPlaneDO. A throw propagates here.
-        await this.validateScopeAccess(tenantId, scopeId);
+        await this.assertLive(tenantId, scopeId);
         await this.migrateAndRecord(scopeId);
         return this.buildStub(tenantId, scopeId, principal, undefined, undefined, options);
     }
@@ -1456,7 +1783,7 @@ export class CloudflareScopeHost {
         const record = await this.resolveImpersonation(session, tenantId, scopeId);
         // The same lifecycle gate the principal door applies: a suspended tenant
         // refuses a support session exactly as it refuses a user.
-        await this.validateScopeAccess(tenantId, scopeId);
+        await this.assertLive(tenantId, scopeId);
         await this.migrateAndRecord(scopeId);
         return this.buildStub(tenantId, scopeId, record.principal, undefined, undefined, options, record.id);
     }
@@ -1467,12 +1794,93 @@ export class CloudflareScopeHost {
      * against `system:<moduleId>` grants inside the stub.
      */
     async getSystemScope(moduleId, tenantId, scopeId) {
+        return this.buildStub(tenantId, scopeId, undefined, undefined, await this.openSystemDoor(moduleId, tenantId, scopeId));
+    }
+    /**
+     * #1834: the system door — the ONE place every entry acting as `system:<moduleId>` passes
+     * through: a schedule's fire, a job run's `pass.scope()`, a module's attachment open. The
+     * module must be registered here and the scope live, as before. Then the door GATES: the
+     * scope's own state read for the module, and after it the rewind hold (#1819), in the order
+     * `SWITCH_HOLD_SETTLE_MS` relies on. A module the hold keeps off is refused here, as a
+     * schedule pass skips it.
+     *
+     * A gate read is about the instance that answered it, and a door can be held for as long as
+     * a job pass runs. So every call through the door is PINNED to that instance: the DO refuses
+     * one that lands on another (`SYSTEM_DOOR_MOVED`), since a PITR restore always restarts the
+     * object, and the door gates again and retries. A restart within one call's round trip is
+     * rare, so past `SYSTEM_DOOR_REGATES` it fails closed (`unavailable`). No clock is involved:
+     * the gate and the call meet the same storage, or the call does not run.
+     */
+    async openSystemDoor(moduleId, tenantId, scopeId, gated, 
+    /** #1834: the job pass this door is opened for; its "not now" refusals are tied to it. */
+    pass) {
         if (!this.moduleIds.has(moduleId)) {
             throw new Error(`module not registered on this host: ${moduleId}`);
         }
-        await this.validateScopeAccess(tenantId, scopeId);
+        await this.assertLive(tenantId, scopeId);
         await this.migrateAndRecord(scopeId);
-        return this.buildStub(tenantId, scopeId, undefined, undefined, moduleId);
+        // A gate this door reads itself reports a hold it could not read; one handed in was the
+        // caller's to report (`runDueSchedules` puts it on its pass report).
+        const regate = async () => {
+            const fresh = await this.systemDoorGate(scopeId, moduleId);
+            if (fresh.error)
+                console.error(`substrat: system door ${moduleId} on ${scopeId}: ${fresh.error}`);
+            return fresh;
+        };
+        let gate = gated ?? (await regate());
+        return {
+            moduleId,
+            through: async (call) => {
+                for (let regates = 0;; regates += 1) {
+                    if (gate.held) {
+                        // The hold ends when the switch is applied again: a job run waits it out without
+                        // spending its retries, because the driver defers on THIS refusal (`doorWait`).
+                        throw this.doorWait(pass, substratError('forbidden', `module '${moduleId}' is held off on this scope: it was rewound to before its schedule ` +
+                            'switch was turned off, and it stays off until the switch is applied again', { reason: SYSTEM_DOOR_WAIT }));
+                    }
+                    const answer = await call(gate.instance);
+                    if (!isSystemDoorMoved(answer))
+                        return answer;
+                    if (regates >= SYSTEM_DOOR_REGATES) {
+                        throw this.doorWait(pass, substratError('unavailable', `the scope kept restarting under the system door of module '${moduleId}' ` +
+                            `(${regates + 1} attempts); nothing ran. Retry later`, { reason: SYSTEM_DOOR_WAIT }));
+                    }
+                    gate = await regate();
+                }
+            },
+        };
+    }
+    /**
+     * #1834: the refusals this host's system door threw that mean "not now" (a hold, a scope that
+     * kept restarting), each tied by identity to the job pass whose door threw it. The job driver
+     * defers a pass only on one of these, never on an error's shape, which any step or operation
+     * could copy. A mark is ORIGIN and FRESHNESS together: it is consumed when the driver takes it,
+     * and only the pass it names can take it, so a handler that keeps a refusal and throws it again
+     * on a later pass is an ordinary failure there. Held weakly: an error nobody holds goes.
+     */
+    doorWaits = new WeakMap();
+    /** #1834: mark this door's own refusal as "not now" for the pass it was opened for, and hand it back. */
+    doorWait(pass, err) {
+        if (pass)
+            this.doorWaits.set(err, pass);
+        return err;
+    }
+    /** #1834: is `err` a "not now" this host's door threw on `pass`? Consumes the mark when it is. */
+    takeDoorWait(err, pass) {
+        if (typeof err !== 'object' || err === null || this.doorWaits.get(err) !== pass)
+            return false;
+        this.doorWaits.delete(err);
+        return true;
+    }
+    /**
+     * #1834: the system door's gate — the scope's state read for the module, the instance that
+     * answered it, and then (only for a module the scope has on) the rewind hold (#1819). The
+     * hold is read AFTER the state, which is the order `switchHeld` needs.
+     */
+    async systemDoorGate(scopeId, moduleId) {
+        const { state, instance } = await this.scopeStub(scopeId).systemDoorState(moduleId);
+        const hold = state === 'on' ? await this.switchHeld(scopeId, moduleId) : { held: false };
+        return { state, instance, held: hold.held, ...(hold.error ? { error: hold.error } : {}) };
     }
     /**
      * #1705: the consumer half. The same lifecycle gate as every door (K-3), then the ScopeDO
@@ -1503,7 +1911,7 @@ export class CloudflareScopeHost {
      * capability row lives. The answer is re-parsed on this side of the RPC.
      */
     async exchangeCapability(tenantId, scopeId, secret, options) {
-        await this.validateScopeAccess(tenantId, scopeId);
+        await this.assertLive(tenantId, scopeId);
         await this.migrateAndRecord(scopeId);
         const outcome = await this.scopeStub(scopeId).exchangeCapability(secret, tenantId, scopeId, options?.mode);
         return capabilityExchange.nullable().parse(outcome);
@@ -1517,7 +1925,7 @@ export class CloudflareScopeHost {
         if (!plausibleSessionToken(sessionToken)) {
             throw substratError('unauthenticated', 'not a capability session token');
         }
-        await this.validateScopeAccess(tenantId, scopeId);
+        await this.assertLive(tenantId, scopeId);
         await this.migrateAndRecord(scopeId);
         const hash = await capabilityTokenHash(sessionToken);
         return this.buildStub(tenantId, scopeId, undefined, undefined, undefined, options, undefined, hash);
@@ -1554,7 +1962,7 @@ export class CloudflareScopeHost {
         // provisioning receipt is K-3 here (#1738), read before anything migrates the DO, and the
         // refusal reads as the pure host's does: an unknown scope, not an unknown role.
         if (this.cpLess && !(await this.scopeStub(scopeId).servesTenant(tenantId))) {
-            throw substratError('not_found', `unknown scope for tenant: (${tenantId}, ${scopeId})`);
+            throw unknownScopeForTenant(tenantId, scopeId);
         }
         await this.peerScopeGate(tenantId, scopeId, 'canAssign');
         const bound = await this.scopeStub(scopeId).canAssignFor(tenantId, scopeId, principalId.parse(principal), roleKey);
@@ -1564,7 +1972,7 @@ export class CloudflareScopeHost {
     }
     async assignScopeRoleBounded(tenantId, scopeId, caller, assignee, roleKey) {
         if (this.cpLess && !(await this.scopeStub(scopeId).servesTenant(tenantId))) {
-            throw substratError('not_found', `unknown scope for tenant: (${tenantId}, ${scopeId})`);
+            throw unknownScopeForTenant(tenantId, scopeId);
         }
         await this.peerScopeGate(tenantId, scopeId, 'assignScopeRoleBounded');
         const bound = await this.scopeStub(scopeId).assignScopeRoleBoundedFor(tenantId, scopeId, principalId.parse(caller), principalId.parse(assignee), roleKey);
@@ -1589,11 +1997,11 @@ export class CloudflareScopeHost {
         if (!this.cpLess) {
             const record = await this.cp.getScopeRecord(tenantId, scopeId);
             if (!record) {
-                throw substratError('not_found', `unknown scope for tenant: (${tenantId}, ${scopeId})`);
+                throw unknownScopeForTenant(tenantId, scopeId);
             }
             this.assertServedHere(record, scopeId, verb);
         }
-        await this.validateScopeAccess(tenantId, scopeId);
+        await this.assertLive(tenantId, scopeId);
         await this.migrateAndRecord(scopeId);
     }
     /**
@@ -1606,7 +2014,7 @@ export class CloudflareScopeHost {
         if (!plausibleSessionToken(sessionToken)) {
             throw substratError('unauthenticated', 'not a capability session token');
         }
-        await this.validateScopeAccess(tenantId, scopeId);
+        await this.assertLive(tenantId, scopeId);
         await this.migrateAndRecord(scopeId);
         const store = await this.resolveAttachmentStore(tenantId);
         const capabilitySession = await capabilityTokenHash(sessionToken);
@@ -1657,7 +2065,7 @@ export class CloudflareScopeHost {
     async capabilityScopeStub(tenantId, scopeId, verb) {
         const rec = await this.cp.getScopeRecord(tenantId, scopeId);
         if (!rec)
-            throw substratError('not_found', `unknown scope for tenant: (${tenantId}, ${scopeId})`);
+            throw unknownScopeForTenant(tenantId, scopeId);
         if (this.servesScopesElsewhereNow && rec.vertical !== null) {
             throw substratError('unavailable', `${verb} cannot reach scope ${scopeId}: it is served by the '${rec.vertical}' ` +
                 'deployment, and platform capability verbs are not delegated there yet');
@@ -1703,6 +2111,12 @@ export class CloudflareScopeHost {
             if (!rec || rec.status !== 'active')
                 return report;
         }
+        else if (lifecycleRefusal(await this.validateScopeAccess(tenantId, scopeId)) !== null) {
+            // #2016: the pair is held to the scope's own record first, so a sweep roster entry whose
+            // tenant disagrees with the scope is refused before the probe reads or writes anything.
+            // #1713: a held scope emits nothing, so judging it stale would only raise a false alarm.
+            return report;
+        }
         const stub = this.scopeStub(scopeId);
         const windows = new Map();
         for (const specs of this.moduleFreshness.values()) {
@@ -1741,29 +2155,40 @@ export class CloudflareScopeHost {
             return report;
         // Only run on a live scope of this tenant; a scope archived between the sweep's
         // enumeration and here simply has nothing due. A CP-less host has no directory
-        // to ask (#461) — it already trusts the router-asserted (tenant, scope) for the
-        // whole request path, and lifecycle for its scopes lives wherever provisioning
-        // does, so the grant check below is the only gate it can and does enforce.
+        // to ask (#461), so it reads the lifecycle the platform delivered to the scope (#1713), in
+        // the same call that holds the pair to the scope's own record (#2016): a roster entry whose
+        // tenant disagrees is refused before a grant, a cadence row or a run is read or written.
         if (!this.cpLess) {
             const rec = await this.cp.getScopeRecord(tenantId, scopeId);
             if (!rec || rec.status !== 'active')
                 return report;
         }
+        else if (lifecycleRefusal(await this.validateScopeAccess(tenantId, scopeId)) !== null) {
+            // #1713: the lifecycle the platform delivered holds the scope. Every schedule is
+            // `skipped` and no cadence row moves, as under the kill switch, so a schedule that
+            // came due meanwhile fires once on the first pass after the scope is live again.
+            for (const schedule of schedules) {
+                report.skipped += 1;
+                report.runs.push({ operation: schedule.operation, outcome: 'skipped' });
+            }
+            report.lifecycleHeld = true;
+            return report;
+        }
         const stub = this.scopeStub(scopeId);
         // The grant IS the switch (#383), and the kill switch is its lever (#1666): the
         // kernel's `systemScheduleState`, the one predicate both adapters run. A scope that
         // never held the module's grant (a foreign vertical's) is a quiet no-op, exactly as
         // before. A scope switched OFF reports every schedule `skipped`, never `failed`, and
         // does not touch its cadence rows — so a restore fires a due schedule on the next pass.
-        const state = await stub.systemScheduleState(moduleId);
-        if (state === 'ungranted')
+        // #1819: a scope rewound to before its switch was pulled answers `on`, and the rewind held
+        // the module outside the scope. Both are read by the system door's own gate (#1834), which
+        // every fire below then goes through, pinned to the instance this read came from.
+        const gate = await this.systemDoorGate(scopeId, moduleId);
+        if (gate.state === 'ungranted')
             return report;
-        // #1819: a scope rewound to before its switch was pulled answers `on`. The rewind held the
-        // module outside the scope; read AFTER the state, which is the order `switchHeld` needs.
-        const hold = state === 'on' ? await this.switchHeld(scopeId, moduleId) : { held: false };
-        if (hold.error)
-            report.errors.push({ operation: 'switch-hold', error: hold.error });
-        if (state === 'off' || hold.held) {
+        if (gate.error)
+            report.errors.push({ operation: 'switch-hold', error: gate.error });
+        if (gate.state === 'off' || gate.held) {
             for (const schedule of schedules) {
                 report.skipped += 1;
                 report.runs.push({ operation: schedule.operation, outcome: 'skipped' });
@@ -1772,6 +2197,8 @@ export class CloudflareScopeHost {
             return report;
         }
         const now = Date.now();
+        const lines = asyncLinePass();
+        let door;
         for (const schedule of schedules) {
             const last = await stub.scheduleLastRun(schedule.operation);
             const lastRun = last ? Date.parse(last) : null;
@@ -1786,28 +2213,55 @@ export class CloudflareScopeHost {
             // produces either way carries it, and so does the row below.
             const invocationId = ulid();
             let status = 'ok';
+            // #1901: the run's line, under the call's own id — the one its `ctx.log` lines carry.
+            const startedAt = Date.now();
+            let emitted;
+            let failure;
             try {
-                const scope = await this.getSystemScope(moduleId, tenantId, scopeId);
-                await scope.invoke(schedule.operation, schedule.input, { invocationId });
+                // The gate above already answered for this pass; a fire that meets a restarted scope
+                // is gated again by the door (#1834).
+                door ??= await this.openSystemDoor(moduleId, tenantId, scopeId, gate);
+                const scope = this.buildStub(tenantId, scopeId, undefined, undefined, door);
+                await scope.invoke(schedule.operation, schedule.input, { invocationId, onEmitted: (r) => (emitted = r) });
                 report.fired += 1;
             }
             catch (err) {
                 status = 'failed';
+                failure = { error: err };
                 report.failed += 1;
                 report.errors.push({
                     operation: schedule.operation,
                     error: err instanceof Error ? err.message : String(err),
                 });
             }
+            lines.write({
+                kind: 'schedule',
+                tenantId,
+                scopeId,
+                invocationId,
+                operation: schedule.operation,
+                startedAt,
+                outcome: status,
+                ...failure,
+                dueAt: lastRun === null ? null : new Date(dueAt).toISOString(),
+                latenessMs: lastRun === null ? null : now - dueAt,
+                ...(emitted ? { emitted } : {}),
+            });
             // #1288: 'schedule', whatever this operation happens to be called — including
             // `freshness:<something>`, which is exactly the row the evaluator no longer eats.
             await stub.recordScheduleRun(schedule.operation, new Date(now).toISOString(), status, 'schedule', invocationId);
             report.runs.push({ operation: schedule.operation, outcome: status === 'ok' ? 'ok' : 'failed' });
         }
+        lines.end();
         return report;
     }
     /** The stub body, shared by the principal, connection, system and impersonation doors. */
-    buildStub(tenantId, scopeId, principal, connectionId, systemModuleId, options, 
+    buildStub(tenantId, scopeId, principal, connectionId, 
+    /**
+     * #1834: the system door this stub acts through. The ONLY way to make a stub acting as
+     * `system:<moduleId>`: the module is the door's, and every invoke is gated and pinned by it.
+     */
+    systemDoor, options, 
     /**
      * K-42: the session this stub acts under. Re-read from the directory on
      * EVERY invoke rather than captured here — a stub is a capability and
@@ -1828,6 +2282,7 @@ export class CloudflareScopeHost {
      */
     verticalCaller) {
         const stub = this.scopeStub(scopeId);
+        const systemModuleId = systemDoor?.moduleId;
         const cp = this.cp;
         const operationEntitlement = this.operationEntitlement;
         // The DO needs SOME principal-shaped value for `ctx.principal`; for a
@@ -1882,7 +2337,15 @@ export class CloudflareScopeHost {
                 }
                 // K-42: resolved per invoke, so expiry and `endImpersonation` both bite.
                 const session = sessionId === undefined ? undefined : await this.resolveImpersonation(sessionId, tenantId, scopeId);
-                const envelope = await stub.invoke(operation, input, asPrincipalId, tenantId, scopeId, connectionId, requiredKey, systemModuleId, true, invokeOptions, session, capabilitySession, verticalCaller);
+                const send = (systemDoorInstance) => stub.invoke(operation, input, asPrincipalId, tenantId, scopeId, connectionId, requiredKey, systemModuleId, true, invokeOptions, session, capabilitySession, verticalCaller, systemDoorInstance);
+                // #1834: through the system door, pinned to the instance its gate read. The DO's
+                // refusal comes back as a failure envelope, so it is rethrown for the door to re-gate.
+                const envelope = systemDoor
+                    ? await systemDoor.through(async (instance) => {
+                        const sent = await send(instance);
+                        return sent.systemDoorMoved === true ? SYSTEM_DOOR_MOVED : sent;
+                    })
+                    : await send();
                 // The operation failed and the DO handed the error back as DATA — so it still
                 // has its code and extensions, which a throw across this boundary would have
                 // stripped down to a message (#113 §3). Rethrown here, where the caller expects
@@ -1931,6 +2394,12 @@ export class CloudflareScopeHost {
                     throw substratError('unavailable', `${operation} ran on a scope host that did not understand peer callers. ` +
                         'Retry once the scope has been migrated');
                 }
+                // #1834, the same shape: a DO too old to know the system door's pin ran the call
+                // without checking it met the storage the door's gate read.
+                if (systemDoor !== undefined && envelope.systemDoor?.honoured !== true) {
+                    throw substratError('unavailable', `${operation} ran on a scope host that did not understand the system door's pin. ` +
+                        'Retry once the scope has been migrated');
+                }
                 if (session !== undefined && envelope.impersonation?.honoured !== true) {
                     throw substratError('unavailable', `${operation} ran on a scope host that did not understand impersonation — the ` +
                         'operation may have run unrecorded and unbounded. Retry once the scope has ' +
@@ -2125,6 +2594,8 @@ export class CloudflareScopeHost {
             // returns it with the previous status, so the trail cannot disagree with
             // the directory about which deployment the action touched.
             await this.recordAdmin(actor, action, { tenantId, scopeId, vertical: before.vertical }, { status: before.status }, { status: to, ...afterExtra });
+            // #1713: after the directory moved and the move was audited, never before or instead.
+            await this.deliverLifecycles(actor, { scopeId });
         };
         const writeGrant = async (subject, permission, node, entity, expiresAt) => {
             if (entity) {
@@ -2161,7 +2632,7 @@ export class CloudflareScopeHost {
             if (!this.cpLess) {
                 const rec = await this.cp.getScopeRecord(tenantId, scopeId);
                 if (!rec)
-                    throw substratError('not_found', `unknown scope for tenant: (${tenantId}, ${scopeId})`);
+                    throw unknownScopeForTenant(tenantId, scopeId);
                 vertical = rec.vertical;
             }
             const action = to === 'off' ? 'revokeFromPeer' : 'restoreToPeer';
@@ -2231,21 +2702,50 @@ export class CloudflareScopeHost {
             if (!this.cpLess) {
                 const rec = await this.cp.getScopeRecord(tenantId, scopeId);
                 if (!rec)
-                    throw substratError('not_found', `unknown scope for tenant: (${tenantId}, ${scopeId})`);
+                    throw unknownScopeForTenant(tenantId, scopeId);
                 vertical = rec.vertical;
             }
             const delegation = this.cpLess || vertical !== null ? this.systemSwitchDelegation : undefined;
             // #1819: a scope whose store is here was rewound here, so `switchInScope` releases its
             // hold here too. A delegated move releases in the deployment serving the scope.
-            const move = (moduleId, to, at) => delegation
-                ? delegation.switch({ tenantId, scopeId, moduleId, to })
-                : this.switchInScope(scopeId, moduleId, to, at);
-            return { vertical, move };
+            // #1823: a module whose only authority on the scope is a TENANT-level grant has nothing in
+            // the scope's storage for the switch to find, so the directory says whether it is held.
+            // A caller moving several modules reads them in one call and passes each answer in.
+            // An OFF of a tenant-held module is refused, after the far end answers, unless that answer
+            // attests the evaluator that denies a tenant-level grant (`deniesTenantGrants`). A
+            // deployment built before #1823 drops `tenantHeld`, still answers `held: true` (the module's
+            // scope-level grants were there to switch), and keeps authorizing the tenant-level grant —
+            // so its `held` alone would have the platform record a scope off that is not. Every OFF the
+            // platform drives moves through here: an operator's (`switchSystem`, which then puts the
+            // switch back) and a re-assert's, which every carry ends with.
+            const move = async (moduleId, to, at, tenantHeld) => {
+                const held = tenantHeld ?? (await this.cp.tenantHeldSystemModules(tenantId, [moduleId], at)).length > 0;
+                const outcome = await (delegation
+                    ? delegation.switch({ tenantId, scopeId, moduleId, to, tenantHeld: held })
+                    : this.switchInScope(scopeId, moduleId, to, at, held));
+                if (to === 'off' && held && outcome.held && outcome.deniesTenantGrants !== true) {
+                    throw new UnattestedSwitchOff(scopeId, moduleId, outcome);
+                }
+                return outcome;
+            };
+            /**
+             * Is the module switched off on the scope right now? Read from wherever `move` writes — the
+             * deployment's status read or this scope's own — for a move that threw (#1823): the switch
+             * may already have moved before the throw (`switchInScope` moves it, then works the rewind
+             * hold), and then the directory's record must stay.
+             */
+            const isOff = async (moduleId) => {
+                const rows = delegation
+                    ? await delegation.status({ tenantId, scopeId })
+                    : systemScheduleEntry.array().parse(await this.scopeStub(scopeId).systemGrantsStatus());
+                return rows.some((r) => r.moduleId === moduleId && r.schedules === 'off');
+            };
+            return { vertical, move, isOff };
         };
         const switchSystem = async (actor, raw, to) => {
             const input = systemSwitch.parse(raw);
             const { tenantId, scopeId } = input.node;
-            const { vertical, move } = await systemSwitchTarget(tenantId, scopeId);
+            const { vertical, move, isOff } = await systemSwitchTarget(tenantId, scopeId);
             // AUDIT FIRST (#1666 review): the intent row lands before anything moves, and the
             // outcome row after — every attempt, a repeat included. The scope's store and the
             // admin log are separate, so no order makes the pair atomic; this one fails toward
@@ -2256,37 +2756,37 @@ export class CloudflareScopeHost {
             const target = { tenantId, scopeId, vertical };
             const base = { operationId, moduleId: input.moduleId, schedules: to };
             await this.recordAdmin(actor, action, target, null, { ...base, phase: 'intent', reason: input.reason });
-            // The directory's record (#1674): ON before the scope moves, OFF after it held — see
-            // `recordSystemSwitchedOn` for why that order is the safe one.
+            // The directory's record (#1674), written BEFORE the scope moves, both ways, and undone
+            // if the move throws or holds nothing — see `recordSystemSwitchedOn` and (#1823)
+            // `recordSystemSwitchedOff` for why that order is the safe one.
             const at = new Date().toISOString();
             const record = { tenantId, scopeId, moduleId: input.moduleId, actor, reason: input.reason, operationId, at };
             const errorOf = (err) => (err instanceof Error ? err.message : String(err));
-            let prior = null;
-            if (to === 'on') {
-                try {
-                    prior = await this.cp.recordSystemSwitchedOn(record);
-                }
-                catch (err) {
-                    // Nothing has moved: fail the call here, audited, rather than switch a scope on
-                    // whose record still says off (the next reconcile would switch it back off).
-                    await this.recordAdmin(actor, action, target, null, { ...base, phase: 'failed', error: errorOf(err) }).catch(() => undefined);
-                    throw err;
-                }
+            let prior;
+            try {
+                prior = to === 'on' ? await this.cp.recordSystemSwitchedOn(record) : await this.cp.recordSystemSwitchedOff(record);
+            }
+            catch (err) {
+                // Nothing has moved: fail the call here, audited. An ON must not switch a scope on
+                // whose record still says off (the next reconcile would switch it back off), and an
+                // OFF must not leave a scope off that the record does not know of (#1823).
+                await this.recordAdmin(actor, action, target, null, { ...base, phase: 'failed', error: errorOf(err) }).catch(() => undefined);
+                throw err;
             }
             /**
-             * A record write AFTER the scope moved (review #5): retried once, and a failure of both
-             * is answered rather than swallowed — it lands on the outcome row as `recordError`, and
-             * the call does not report plain success. A lost OFF record is exactly what a wipe then
-             * turns into a module running again.
+             * The record's undo, after the scope's move threw or held nothing: retried once, and a
+             * failure of both is answered rather than swallowed — it lands on the outcome row as
+             * `recordError`, and the call says so.
              */
-            const recordWrite = async (write) => {
+            const undoRecord = async () => {
+                const undo = () => this.cp.restoreSystemSwitchRecord(record, prior);
                 try {
-                    await write();
+                    await undo();
                     return null;
                 }
                 catch {
                     try {
-                        await write();
+                        await undo();
                         return null;
                     }
                     catch (err) {
@@ -2299,25 +2799,54 @@ export class CloudflareScopeHost {
                 outcome = await move(input.moduleId, to, at);
             }
             catch (err) {
-                const recordError = prior ? await recordWrite(() => this.cp.restoreSystemSwitchRecord(record, prior)) : null;
+                if (err instanceof UnattestedSwitchOff) {
+                    // The far end switched, and cannot hold it against the tenant-level grant. Refused:
+                    // ON gives back exactly what this OFF took (nothing, when it changed nothing), and
+                    // then the record goes back too — neither the scope nor the directory says off. An ON
+                    // that fails here leaves the scope off, and the readback rule below keeps its record.
+                    const putBack = err.outcome.changed
+                        ? await move(input.moduleId, 'on', new Date().toISOString(), true).then(() => true, () => false)
+                        : true;
+                    if (putBack) {
+                        const recordError = await undoRecord();
+                        await this.recordAdmin(actor, action, target, null, {
+                            ...base,
+                            phase: 'refused',
+                            error: err.message,
+                            ...(recordError ? { recordError } : {}),
+                        }).catch(() => undefined);
+                        throw substratError('precondition_failed', `${err.message} Nothing was switched` +
+                            (recordError ? `, but its directory record could not be put back (${recordError}).` : '.'));
+                    }
+                }
+                // A throw does not say the scope did not move: the move crosses the scope's DO and then
+                // the rewind hold, and a throw from the second leaves the scope's switch moved. So the
+                // record is undone only when the scope reads back in the OTHER position — an OFF that
+                // reads not off, an ON that still reads off — and kept when it reads back as asked.
+                // Undoing an ON that landed would put the record back to `off` beside a scope that is
+                // on, and the next re-assert would switch the operator's ON back off. A read that fails
+                // too counts as off, both ways, so what is left fails toward off: an OFF keeps its
+                // record (never a scope switched off with no record — a wipe or restore would have
+                // nothing to re-assert, and #1743's refusal nothing to read), and an ON is undone back
+                // to `off`, which the next re-assert completes if the scope did move.
+                const off = await isOff(input.moduleId).catch(() => true);
+                const recordKept = off === (to === 'off');
+                const recordError = recordKept ? null : await undoRecord();
                 // Best effort: the original error is what the caller must see, and the intent row
                 // already says an attempt was made.
                 await this.recordAdmin(actor, action, target, null, {
                     ...base,
                     phase: 'failed',
                     error: errorOf(err),
+                    ...(recordKept ? { recordKept: true } : {}),
                     ...(recordError ? { recordError } : {}),
                 }).catch(() => undefined);
                 throw err;
             }
-            // OFF is recorded once the scope held it. A refused ON moved nothing, so its record
-            // write is undone: left `on`, the next reconcile of a wiped scope would leave the
-            // module running.
-            const recordError = to === 'off' && outcome.held
-                ? await recordWrite(() => this.cp.recordSystemSwitchedOff(record))
-                : to === 'on' && !outcome.held && prior
-                    ? await recordWrite(() => this.cp.restoreSystemSwitchRecord(record, prior))
-                    : null;
+            // A call that held nothing moved nothing, so its record write is undone: left `off`, it
+            // would switch the module off the day it is installed; left `on`, the next reconcile of
+            // a wiped scope would leave the module running.
+            const recordError = outcome.held ? null : await undoRecord();
             await this.recordAdmin(actor, action, target, null, {
                 ...base,
                 phase: outcome.held ? 'applied' : 'refused',
@@ -2330,11 +2859,6 @@ export class CloudflareScopeHost {
                     `(check the module id: it is the module's manifest id, e.g. '@substrat-run/engine-absence')` +
                     (recordError ? `; and its directory record could not be put back (${recordError})` : ''));
             }
-            if (recordError) {
-                throw substratError('unavailable', `module '${input.moduleId}' is switched ${to} on scope ${scopeId}, but the directory's record of it ` +
-                    `could not be written (${recordError}) — repeat the call to record it; a wipe of this scope would ` +
-                    `otherwise lose the switch`);
-            }
             return {
                 operationId,
                 moduleId: input.moduleId,
@@ -2398,7 +2922,7 @@ export class CloudflareScopeHost {
             if (!this.cpLess) {
                 const rec = await this.cp.getScopeRecord(tenantId, scopeId);
                 if (!rec)
-                    throw substratError('not_found', `unknown scope for tenant: (${tenantId}, ${scopeId})`);
+                    throw unknownScopeForTenant(tenantId, scopeId);
                 vertical = rec.vertical;
             }
             // A hosted scope (a vertical bound, on a non-cpLess host) has no local storage worth
@@ -2485,8 +3009,9 @@ export class CloudflareScopeHost {
                 });
             }
             const results = [];
+            const tenantHeld = new Set(modules.length ? await this.cp.tenantHeldSystemModules(tenantId, modules, at) : []);
             for (const moduleId of modules) {
-                const outcome = await move(moduleId, 'off', at);
+                const outcome = await move(moduleId, 'off', at, tenantHeld.has(moduleId));
                 if (outcome.changed) {
                     await this.recordAdmin(actor, 'reassertSystemSwitch', { tenantId, scopeId, vertical }, null, {
                         operationId: ulid(),
@@ -2516,7 +3041,7 @@ export class CloudflareScopeHost {
             if (!this.cpLess) {
                 const rec = await this.cp.getScopeRecord(tenantId, scopeId);
                 if (!rec)
-                    throw substratError('not_found', `unknown scope for tenant: (${tenantId}, ${scopeId})`);
+                    throw unknownScopeForTenant(tenantId, scopeId);
                 vertical = rec.vertical;
             }
             if (!this.cpLess && vertical !== null && !this.peerSwitchDelegation) {
@@ -2715,6 +3240,13 @@ export class CloudflareScopeHost {
                 await this.recordAccess(actor, 'listSystemSwitches', { tenantId: filter?.tenantId ?? null }, filter ?? null, rows.length);
                 return rows.map((r) => systemSwitchRecord.parse(r));
             },
+            tenantHeldSystemModules: async (actor, tenantId, moduleIds) => {
+                const held = moduleIds.length
+                    ? await this.cp.tenantHeldSystemModules(tenantId, moduleIds, new Date().toISOString())
+                    : [];
+                await this.recordAccess(actor, 'tenantHeldSystemModules', { tenantId }, { moduleIds: [...moduleIds] }, held.length);
+                return held;
+            },
             reassertSystemSwitches: reassertSystemSwitchesOf,
             // #1672 — the platform's two capability verbs. Audited AFTER the write, on both, and
             // the failure each leaves is the safe one: a mint whose audit row did not land never
@@ -3126,7 +3658,7 @@ export class CloudflareScopeHost {
                 if (channel === 'prod' && !incoming.deployment_ref) {
                     const owning = await this.cp.readVertical(verticalSlug);
                     if (owning && owning.owner_tenant !== null && !owning.listed) {
-                        const bound = (await this.cp.listScopes({ tenantId: owning.owner_tenant, vertical: verticalSlug, status: ['active'] })).filter((s) => !s.forked_from && s.kind !== 'preview');
+                        const bound = (await this.cp.listScopes({ tenantId: owning.owner_tenant, vertical: verticalSlug, status: ['active'] })).filter(isPrimaryScopeRow);
                         for (const s of bound) {
                             if (s.vertical_version_id === versionId)
                                 continue;
@@ -3284,6 +3816,12 @@ export class CloudflareScopeHost {
                 await this.cp.setScopeServingRef(scopeId, servingRef);
                 await this.recordAdmin(actor, 'setScopeServingRef', { tenantId, scopeId }, { servingRef: scope.serving_ref ?? null }, { servingRef, ...(ack.exportBreak ? { acknowledged: ack } : {}) });
             },
+            recordKeptCopyResolution: async (actor, tenantId, scopeId, r) => {
+                const scope = await this.cp.getScopeRecord(tenantId, scopeId);
+                if (!scope)
+                    throw substratError('not_found', `unknown scope ${scopeId} in tenant ${tenantId}`);
+                await this.recordAdmin(actor, 'resolveKeptCopy', { tenantId, scopeId }, { script: r.script, keptAt: r.keptAt, revision: r.revisionBefore }, { action: r.action, liveScript: r.liveScript, revision: r.revisionAfter });
+            },
             setScopeExpiresAt: async (actor, tenantId, scopeId, expiresAt) => {
                 const scope = await this.cp.getScopeRecord(tenantId, scopeId);
                 if (!scope)
@@ -3388,6 +3926,8 @@ export class CloudflareScopeHost {
             setTenantStatus: async (actor, tenantId, status) => {
                 const before = await this.cp.setTenantStatus(tenantId, status);
                 await this.recordAdmin(actor, 'setTenantStatus', { tenantId }, { status: before }, { status });
+                // #1713: every hosted scope under the tenant holds or resumes its work by this.
+                await this.deliverLifecycles(actor, { tenantId });
             },
             setTenantName: async (actor, tenantId, name) => {
                 const before = await this.cp.setTenantName(tenantId, name);
@@ -4260,6 +4800,11 @@ export class CloudflareScopeHost {
                 const { tenantId, scopeId, ...after } = ownerTransferAudit.parse(entry);
                 await this.recordAdmin(actor, 'transferOwner', { tenantId, scopeId }, null, after);
             },
+            /** #2005: one change to a scope's copy marker, written around the vertical's own change. */
+            recordCopyMark: async (actor, entry) => {
+                const { tenantId, scopeId, action, ...after } = copyMarkAudit.parse(entry);
+                await this.recordAdmin(actor, action === 'mark' ? 'markScopeCopy' : 'clearScopeCopyMark', { tenantId, scopeId }, null, after);
+            },
             accessLog: async (actor, filter) => {
                 const rows = await this.cp.accessLog({
                     actor: filter?.actor,
@@ -4472,14 +5017,225 @@ export class CloudflareScopeHost {
      * The getScope gate (control-plane.md §4.1/§4.2) — the pair check, then the tenant's and
      * the scope's lifecycle — thrown on THIS side of the RPC (#1718). The ControlPlaneDO
      * answers its refusal as data, because an error thrown there arrives here flattened, with
-     * no code; a record crosses intact. A CP-less host's null control plane answers nothing,
-     * so the gate passes: the router already made it from the shared directory.
+     * no code; a record crosses intact.
+     *
+     * A CP-less host's null control plane answers nothing: the router made the pair check from
+     * the shared directory. The scope's own storage then makes it again (#2016), against the
+     * tenant it was provisioned for (`ScopeDO.admission`), so a vertical that passes a scope id
+     * under the wrong tenant meets K-3's refusal at the door instead of relying on the permission
+     * gate's grant data to deny it.
+     *
+     * Answers with the lifecycle the CP-less scope holds (#1713), read in the same DO call as the
+     * pair check, so an `assertLive` door still costs one round-trip; a door that reads the scope
+     * without the lifecycle half pays the one DO call the pair check needs. Null with a directory,
+     * whose refusal already covered the lifecycle.
      */
     async validateScopeAccess(tenantId, scopeId) {
         const refusal = await this.cp.scopeAccessRefusal(tenantId, scopeId);
-        if (!refusal)
-            return;
-        throw refusal.code ? substratError(refusal.code, refusal.message) : new Error(refusal.message);
+        if (refusal)
+            throw refusal.code ? substratError(refusal.code, refusal.message) : new Error(refusal.message);
+        if (!this.cpLess)
+            return null;
+        const { verdict, lifecycle } = await this.scopeStub(scopeId).admission(tenantId);
+        if (verdict === 'foreign')
+            throw unknownScopeForTenant(tenantId, scopeId);
+        // A scope with no tenant record and no role rows has nothing to hold the pair against, so it is
+        // let through — a compatibility state, not a steady one: the next reconcile (every push runs
+        // one against the scopes behind it, #1172) or lifecycle delivery records the directory's tenant.
+        // Logged on every admission, so an operator sees a scope that has not converged.
+        if (verdict === 'unknown')
+            console.warn(JSON.stringify(tenantUnrecordedLine(tenantId, scopeId)));
+        return lifecycle;
+    }
+    /**
+     * THE lifecycle gate (#1713) at every door that runs a scope's work: a request's stubs and
+     * attachments, a capability or impersonation session, a peer call or delivery, a subscription,
+     * and the entry points no request asked for — the retry driver, the job runner, a schedule's
+     * system stub, a routed connector delivery.
+     *
+     * `validateScopeAccess` first, which is the directory's gate where there is a directory. A
+     * CP-less host has none, so it then reads the lifecycle the platform delivered to the scope's
+     * own storage (`/internal/lifecycle`), judged by the kernel's `lifecycleRefusal` in the
+     * directory's own words. The router refuses a suspended scope's requests first (#1730); this
+     * is the deployment's own half, and the only one a timer or a retry ever meets.
+     *
+     * The admin and diagnostic reads (dead letters, job runs, platform requests, delivered
+     * grants) keep `validateScopeAccess` alone: an operator still reads a suspended scope.
+     */
+    async assertLive(tenantId, scopeId) {
+        const refusal = lifecycleRefusal(await this.validateScopeAccess(tenantId, scopeId), { tenantId, scopeId });
+        if (refusal)
+            throw new Error(refusal);
+    }
+    /**
+     * Deliver the directory's lifecycle to the deployments serving the matching scopes (#1713):
+     * one scope after its transition, a tenant's scopes after the tenant's, or the heal sweep's
+     * drift. Each delivery carries the directory's revisions, read in the same query as the
+     * statuses, so a late one cannot undo a later transition: the deployment keeps only a delivery
+     * strictly newer than the one it holds.
+     *
+     * Never throws. A transition is the operator's lever in an incident, and the router refuses
+     * the scope's requests as soon as the directory moves (#1730), so a deployment that cannot be
+     * reached must not refuse the lever. Each failure is an ops-failure row, no receipt is written,
+     * and the heal sweep delivers again.
+     */
+    async deliverLifecycles(actor, filter) {
+        const report = { attempted: 0, delivered: 0, failed: 0 };
+        const delegation = this.lifecycleDelegation;
+        if (!delegation || this.cpLess)
+            return report;
+        let targets;
+        // #2016: the heal also asks the served scopes whose deployment has not answered that it holds a
+        // record of the scope's tenant, a copy as much as a primary (no push reconciles a copy), until
+        // each answers that it does. A bounded slice per pass, after the drift and the holds.
+        const askTenant = new Set();
+        try {
+            targets = await this.cp.lifecycleTargets(filter);
+            if (filter.drift) {
+                const unrecorded = await this.cp.lifecycleTargets({ unrecorded: true, limit: TENANT_UNRECORDED_PER_PASS });
+                // Noted before asking, so an ask that fails (or a deployment that never answers) rotates
+                // behind the scopes not asked yet, and the next pass reaches them.
+                if (unrecorded.length > 0)
+                    await this.cp.recordTenantAsks(unrecorded.map((u) => u.scope_id), new Date().toISOString());
+                const seen = new Set(targets.map((t) => t.scope_id));
+                for (const u of unrecorded) {
+                    askTenant.add(u.scope_id);
+                    if (!seen.has(u.scope_id))
+                        targets.push(u);
+                }
+            }
+        }
+        catch (err) {
+            console.error('substrat: could not read the scopes to deliver a lifecycle to (#1713)', err);
+            return report;
+        }
+        for (const first of targets) {
+            const tenantId = first.tenant_id;
+            const scopeId = first.scope_id;
+            let t = first;
+            let lifecycle = this.lifecycleOfTarget(t);
+            if (!lifecycle) {
+                // A status this code does not know (a newer directory): delivering a guess could lift a hold.
+                report.failed += 1;
+                console.error(`substrat: scope ${scopeId} has a lifecycle this code cannot read (#1713)`);
+                continue;
+            }
+            // A live scope whose deployment already acknowledged exactly this has nothing to receive,
+            // and neither does one with no receipt in a directory never restored: a deployment holding
+            // no lifecycle runs live. That keeps an activation, and every transition before a
+            // deployment carries the route, from posting a delivery that changes nothing. After a
+            // restore (epoch > 0) no receipt says nothing about what the deployment holds, so it is
+            // delivered. A HOLD is always delivered, and so is a scope the heal asks for its tenant record.
+            if (!askTenant.has(scopeId) &&
+                lifecycleRefusal(lifecycle) === null &&
+                (t.delivered === null ? t.epoch === 0 : t.delivered === lifecycleReceipt(lifecycle))) {
+                continue;
+            }
+            report.attempted += 1;
+            try {
+                let answer = await delegation.deliver({ tenantId, scopeId, lifecycle });
+                // SINGLE AUTHORITY (the invariant this rests on): an environment has exactly one directory,
+                // the singleton `CONTROL_PLANE.idFromName('control-plane')`. A "fresh directory" restore is
+                // that same object restored after its storage was lost, never a second live writer, and
+                // the raise below always re-reads the CURRENT store and delivers what it says. Two control
+                // planes healing one dispatch namespace at once is a split brain that corrupts far more
+                // than lifecycle, and is out of scope here; fencing it in lifecycle alone would guarantee
+                // nothing.
+                //
+                // The scope refused us as OLDER while holding a revision this directory's history did not
+                // write: an epoch ahead of ours, or ours with other counters. Only another history of the
+                // directory delivers those — the one a fresh-directory restore replaced, whose epoch a
+                // clock running behind (or a restore in the same millisecond) cannot outrank. A scope only
+                // ever holds epochs a directory minted, so this directory learns past it: its epoch is
+                // raised above the one held (monotonic, one statement), and the scope is delivered again.
+                const held = answer.lifecycle.revision;
+                const foreign = !answer.applied &&
+                    held !== undefined &&
+                    (held.epoch > lifecycle.revision.epoch ||
+                        (held.epoch === lifecycle.revision.epoch && lifecycleReceipt(answer.lifecycle) !== lifecycleReceipt(lifecycle)));
+                // Bounded, because the deployment answering is the vertical's own code: only a directory
+                // that has been restored can meet another history (epoch > 0), and a legitimate epoch is
+                // a mint time, so one further ahead than the skew is forged or broken. Either way nothing
+                // is raised; the refusal is an ops failure for an operator to look at.
+                if (foreign && (lifecycle.revision.epoch === 0 || held.epoch > Date.now() + LIFECYCLE_EPOCH_SKEW_MS)) {
+                    report.failed += 1;
+                    await this.admin
+                        .recordOpsFailure({
+                        actor,
+                        operation: 'scope.lifecycle',
+                        stage: 'foreign-epoch',
+                        tenantId,
+                        scopeId,
+                        message: `the deployment refused this directory's lifecycle while holding epoch ${held.epoch} ` +
+                            `(this directory is at ${lifecycle.revision.epoch}); not raised past it — ` +
+                            (lifecycle.revision.epoch === 0
+                                ? 'this directory has never been restored, so no other history should have written it'
+                                : 'it is further ahead of the clock than any directory mints'),
+                    })
+                        .catch((e) => console.error('substrat: could not record a foreign lifecycle epoch (#1713)', e));
+                    continue;
+                }
+                if (foreign) {
+                    await this.cp.raiseLifecycleEpoch(held.epoch + 1);
+                    const [again] = await this.cp.lifecycleTargets({ scopeId });
+                    const next = again ? this.lifecycleOfTarget(again) : null;
+                    if (again && next) {
+                        t = again;
+                        lifecycle = next;
+                        answer = await delegation.deliver({ tenantId, scopeId, lifecycle });
+                    }
+                }
+                // The receipt is what the scope HOLDS: a newer delivery it kept instead is the truth.
+                await this.cp.recordLifecycleReceipt(scopeId, lifecycleReceipt(answer.lifecycle), new Date().toISOString(), answer.tenantRecorded === true);
+                report.delivered += 1;
+            }
+            catch (err) {
+                report.failed += 1;
+                try {
+                    await this.admin.recordOpsFailure({
+                        actor,
+                        operation: 'scope.lifecycle',
+                        stage: 'deliver',
+                        tenantId,
+                        scopeId,
+                        message: `the lifecycle (scope ${t.scope_status}, tenant ${t.tenant_status}) did not reach the ` +
+                            `deployment serving this scope; the heal sweep will deliver it again: ${err instanceof Error ? err.message : String(err)}`,
+                    });
+                }
+                catch (recordErr) {
+                    console.error('substrat: could not record a lifecycle delivery failure (#1713)', recordErr);
+                }
+            }
+        }
+        return report;
+    }
+    /** One directory row as the lifecycle a delivery carries (#1713), or null for a status this code does not know. */
+    lifecycleOfTarget(t) {
+        const parsed = scopeLifecycle.safeParse({
+            scope: t.scope_status,
+            tenant: t.tenant_status,
+            at: new Date().toISOString(),
+            revision: { epoch: t.epoch, scope: t.scope_rev, tenant: t.tenant_rev },
+        });
+        return parsed.success ? parsed.data : null;
+    }
+    /**
+     * The heal sweep (#1713): deliver the lifecycle to every hosted scope whose deployment's
+     * acknowledged state differs from the directory, and again to every scope held now — which is
+     * what puts a hold back on a store a carry or a restore landed without it. Bounded per pass
+     * (`limit`), drifted scopes first. Run from the shared control plane's cron.
+     */
+    async healLifecycles(actor, opts) {
+        return this.deliverLifecycles(actor, { drift: true, limit: opts?.limit ?? 200 });
+    }
+    /**
+     * Whether a CP-less host holds this scope's work (#1713): `assertLive`'s predicate, answered
+     * rather than thrown, for the entry points that defer instead of refusing — a sweep pass, a
+     * schedule run, an executor drain. Always false on a host with a directory, whose entry
+     * points ask the directory themselves.
+     */
+    async lifecycleHeld(scopeId) {
+        return this.cpLess && lifecycleRefusal(await this.scopeStub(scopeId).lifecycle()) !== null;
     }
     /**
      * K-3's cross-check on its own: the (tenant, scope) pair must exist and agree before a
@@ -4489,7 +5245,7 @@ export class CloudflareScopeHost {
     async assertScope(tenantId, scopeId) {
         const rec = await this.cp.getScopeRecord(tenantId, scopeId);
         if (!rec)
-            throw substratError('not_found', `unknown scope for tenant: (${tenantId}, ${scopeId})`);
+            throw unknownScopeForTenant(tenantId, scopeId);
     }
     /**
      * The same K-3 cross-check, for a read that then opens the scope's STORAGE — every
@@ -4504,7 +5260,7 @@ export class CloudflareScopeHost {
     async scopeRecordForRead(tenantId, scopeId) {
         const row = await this.cp.getScopeRecord(tenantId, scopeId);
         if (!row)
-            throw substratError('not_found', `unknown scope for tenant: (${tenantId}, ${scopeId})`);
+            throw unknownScopeForTenant(tenantId, scopeId);
         if (row.status === 'reaped') {
             throw new Error(`scope ${scopeId} is reaped — its storage is gone and cannot be read`);
         }
@@ -4785,7 +5541,7 @@ export class CloudflareScopeHost {
      * its claims before the OFF's join lands. The joined row then holds the module the operator just
      * turned ON, until the next surviving move of that switch releases it (another ON does).
      */
-    async switchInScope(scopeId, moduleId, to, at) {
+    async switchInScope(scopeId, moduleId, to, at, tenantHeld = false) {
         let scopeClaims;
         let readError;
         try {
@@ -4794,7 +5550,7 @@ export class CloudflareScopeHost {
         catch (err) {
             readError = err;
         }
-        const { instance, ...outcome } = await this.scopeStub(scopeId).switchSystemSchedules(moduleId, scopeId, to, at);
+        const { instance, ...outcome } = await this.scopeStub(scopeId).switchSystemSchedules(moduleId, scopeId, to, at, tenantHeld);
         if (!scopeClaims)
             throw readError;
         const now = Date.now();
@@ -4997,16 +5753,16 @@ export class CloudflareScopeHost {
              * suspended or archiving scope could still be addressed and handed a 101 — a
              * scope that refuses every ordinary read while quietly holding an open socket.
              *
-             * Costs a CP-less vertical nothing: `validateScopeAccess` is a **no-op** on the
-             * null control plane (the router already gated lifecycle and tenancy from the
-             * shared directory), so this is the hosted-vertical shape unchanged.
+             * On a CP-less vertical, `validateScopeAccess` is a no-op on the null control
+             * plane, and `assertLive` reads the lifecycle the platform delivered to the
+             * scope's own storage instead (#1713).
              *
              * `migrateAndRecord`, not the DO's own `ensureMigrations`: the DO migrates
              * itself when the socket opens either way, but only this reports the applied
              * count to the directory — so a scope whose first contact after a deploy is a
              * subscription does not go dark in the migration fleet view.
              */
-            await this.validateScopeAccess(tenantId, scopeId);
+            await this.assertLive(tenantId, scopeId);
             await this.migrateAndRecord(scopeId);
             // Asserted, not carried through from the client: the principal is the
             // vertical's own resolution of its session, and the tenant and scope are the
@@ -5094,7 +5850,7 @@ export class CloudflareScopeHost {
         // good. Read first, so a pair the directory does not hold writes nothing.
         const scope = await this.cp.getScopeRecord(tenantId, scopeId);
         if (!scope)
-            throw substratError('not_found', `unknown scope for tenant: (${tenantId}, ${scopeId})`);
+            throw unknownScopeForTenant(tenantId, scopeId);
         const { roles, tuples, entitlements, identities } = await this.tenantProjection(tenantId);
         const connectionKeys = await this.connectionKeyRows(tenantId, scope.vertical);
         await this.scopeStub(scopeId).applyProjection(tenantId, roles, tuples, entitlements, undefined, identities, connectionKeys);
@@ -5272,7 +6028,7 @@ export class CloudflareScopeHost {
         // #1742: the recorded-off modules, switched off after the seat in the same unit, on the
         // scope this call provisions — the one the seat's tuples name.
         input.switchedOff
-            ? { scopeId: input.scopeId, moduleIds: input.switchedOff, at: new Date().toISOString() }
+            ? { scopeId: input.scopeId, moduleIds: input.switchedOff, at: new Date().toISOString(), tenantHeld: input.tenantHeld }
             : undefined, services?.map((id) => `principal:${id}`));
         return input.switchedOff ? { switchedOff } : {};
     }
@@ -5369,14 +6125,19 @@ export class CloudflareScopeHost {
     // side before the call; what runs HERE is the half only this deployment can
     // enforce: the scope's own permission check against its delivered
     // `connection:<id>` tuple, in the scope's own DO. Fail closed — no grant, no
-    // effect — exactly as for any other caller.
+    // effect — exactly as for any other caller. And the lifecycle delivered to the
+    // scope (#1713): a held scope's invoke and bytes doors refuse, as every other door does.
     /** Invoke ONE operation in this deployment as a CONNECTION (#574). */
     async connectorInvokeLocal(connectionId, tenantId, scopeId, operation, input) {
+        await this.assertLive(tenantId, scopeId); // #1713: a held scope runs no connector work either
         await this.migrateAndRecord(scopeId);
         return this.buildStub(tenantId, scopeId, undefined, connectionId).invoke(operation, input);
     }
     /** Land provider bytes in this deployment as a CONNECTION — the bytes leg (#574). */
     async connectorAttachmentUploadLocal(connectionId, tenantId, scopeId, upload) {
+        // The lifecycle gate every attachments door takes (#1713), ahead of the bucket: a held
+        // scope's provider bytes wait for the delivery's retry rather than land (#1995).
+        await this.assertLive(tenantId, scopeId);
         await this.migrateAndRecord(scopeId);
         const store = await this.resolveAttachmentStore(tenantId);
         return this.buildAttachmentSurface({ connectionId }, tenantId, scopeId, store).upload(upload);
@@ -5389,6 +6150,8 @@ export class CloudflareScopeHost {
      * so a caller falls back rather than failing a dispatch over a missing file.
      */
     async connectorAttachmentOpenLocal(connectionId, tenantId, scopeId, attachmentId, eventId) {
+        // Same gate as the upload leg: a held scope's bytes are not read out of its bucket.
+        await this.assertLive(tenantId, scopeId);
         await this.migrateAndRecord(scopeId);
         const store = await this.resolveAttachmentStore(tenantId);
         return this.buildAttachmentSurface({ connectionId }, tenantId, scopeId, store, 
@@ -5414,11 +6177,11 @@ export class CloudflareScopeHost {
      * admin log and writes the row once this returns. `held: false` is an answer, not a
      * throw — see `systemSwitchOutcome`.
      */
-    async systemSwitchLocal(scopeId, moduleId, to) {
+    async systemSwitchLocal(scopeId, moduleId, to, opts) {
         // Parsed on the way out: this is the wire answer the platform reads, and the DO's
         // plain strings become the published shape here rather than on trust.
         // #1819: `switchInScope` releases a rewind's hold on the module once the switch lands.
-        return systemSwitchOutcome.parse(await this.switchInScope(scopeId, moduleId, to, new Date().toISOString()));
+        return systemSwitchOutcome.parse(await this.switchInScope(scopeId, moduleId, to, new Date().toISOString(), opts?.tenantHeld ?? false));
     }
     /**
      * The far end of the status read for a scope served HERE (#1674): `/internal/system-grants`
@@ -5519,7 +6282,7 @@ export class CloudflareScopeHost {
         }
         const rec = await this.cp.getScopeRecord(tenantId, scopeId);
         if (!rec)
-            throw substratError('not_found', `unknown scope for tenant: (${tenantId}, ${scopeId})`);
+            throw unknownScopeForTenant(tenantId, scopeId);
         const source = await importCursorSourceOf((t, v) => this.admin.resolveVerticalInstance(t, v), { tenantId, scopeId, vertical: rec.vertical }, move.from);
         // Where the write lands is the peer switch's rule: a scope bound to a vertical is served by
         // that vertical's deployment, and its watermark lives there. Without a delegation that