@substrat-run/adapter-cloudflare 0.135.0 → 0.137.0

package/dist/scope-do.js

@@ -1,13 +1,14 @@
 import { REWIND_REFUSED } from './rewind-refusal.js';
+import { SYSTEM_DOOR_MOVED } from './system-door.js';
 import { DurableObject } from 'cloudflare:workers';
-import { ATTACHMENT_ADDED, ATTACHMENT_REMOVED, attachmentRecord, domainEvent, domainEventInput, eventId, instant, objectRef, entityObjectRef, assertModuleEmittableType, assertKernelAuthoredType, toWireFailure, grantRefFromProof, principalId, scopeId as scopeIdOf, tenantId as tenantIdOf, platformRequestInput, platformRequestId, MAX_PENDING_PLATFORM_REQUESTS, MAX_PENDING_SWEEP_RUNS, SWEEP_RUNS_KIND, SCOPE_TABLE_PAGE_MAX, SCOPE_QUERY_ROW_MAX, listLimitOf, requestFingerprint, substratError, assertReplayableDump, REDRAIN_BATCH, } from '@substrat-run/contracts';
-import { ulid, DO_SQL_LIMITS, unknownRoleError, createUlid, assertAllowed, ConnectionSealingKeyUnavailableError, noSealingKeyMessage, sealTo, assertReadOnlyQuery, entitlementDenial, platformRequestHistoryQuery, platformRequestOf, PLATFORM_REQUEST_COLUMNS, PLATFORM_REQUEST_REDACTION_SQL, platformRequestRedactionParams, platformRequestRedactionQuery, intentPayloadCarriesSubject, redactSubjectJobRuns, redactSubjectScopeText, assertRowLimit, assertRowOffset, JOB_RUN_PATCH_SQL, JOB_STEP_RECORD_SQL, DELIVERY_ERROR_REDACTION_SQL, REDACTED_DELIVERY_NOTE, seatScopeTuple, effectiveRoleGrantQuery, switchRecordedOff, switchSystemSchedules, peerGrantsStatus, systemGrantsStatus, systemScheduleState, systemSwitchedOff, denialListQuery, refusalListQuery, mapRefusalRow, denialSummaryQuery, denialTotalsQuery, DENIAL_WINDOW_QUERY, mapDenialRow, mapDenialSummaryBuckets, PermissionDenied, assertImpersonationWrites, assertModuleEnqueueableKind, impersonationStampOf, createAtomic, NotSearchable, isSearchIndexTable, searchIndexDdl, searchIndexPlans, NotListable, listIndexPlans, moduleMigrations, listQuery, cursorOf, searchLimit, searchMatchExpression, searchQuery, ATTACHMENT_TEXT_DDL, attachmentRecordOfRow, enqueueAttachmentText, reconcileAttachmentText, recordAttachmentText, searchAttachments, IDEMPOTENCY_DDL, REFUSALS_DDL, refusalInsert, refusedTransitionOf, assertIdempotencyKey, assertPermissionKey, idempotencyLookupQuery, idempotencyPruneStatement, idempotencyRecordStatement, idempotencyOptedOutMessage, replayFor, entityVersionQuery, entityVersionOf, assertIfMatch, OUTBOX_ENTITY_INDEX, SCHEDULE_STATE_DDL, SCHEDULE_STATE_REBUILD, scheduleStateHasKind, VERTICAL_EVENTS_DDL, EXPORT_HOPS_SQL, IMPORT_CURSORS_SQL, IMPORT_CURSOR_OF_SQL, OUTBOX_MARK_SQL, exportedSinceQuery, emittedSinceQuery, emittedReportOf, EMITTED_REPORT_CAP, IMPORT_CURSOR_ADVANCE_SQL, IMPORT_RECORD_SQL, moveImportCursor, CrossVerticalRegistry, exportReadPlan, exportReadQuery, planExportBatch, withheldNote, JOB_RUN_DDL, jobRunListLimit, } from '@substrat-run/kernel';
+import { ATTACHMENT_ADDED, ATTACHMENT_REMOVED, attachmentRecord, domainEvent, domainEventInput, eventId, instant, objectRef, entityObjectRef, assertModuleEmittableType, assertKernelAuthoredType, toWireFailure, grantRefFromProof, principalId, scopeId as scopeIdOf, tenantId as tenantIdOf, platformRequestInput, platformRequestId, MAX_PENDING_PLATFORM_REQUESTS, MAX_PENDING_SWEEP_RUNS, SWEEP_RUNS_KIND, SCOPE_TABLE_PAGE_MAX, SCOPE_QUERY_ROW_MAX, listLimitOf, requestFingerprint, substratError, errorCodeOf, assertReplayableDump, REDRAIN_BATCH, } from '@substrat-run/contracts';
+import { ulid, DO_SQL_LIMITS, unknownRoleError, createUlid, assertAllowed, ConnectionSealingKeyUnavailableError, noSealingKeyMessage, sealTo, assertReadOnlyQuery, entitlementDenial, platformRequestHistoryQuery, platformRequestOf, PLATFORM_REQUEST_COLUMNS, PLATFORM_REQUEST_REDACTION_SQL, platformRequestRedactionParams, platformRequestRedactionQuery, intentPayloadCarriesSubject, redactSubjectJobRuns, redactSubjectScopeText, assertRowLimit, assertRowOffset, JOB_RUN_PATCH_SQL, JOB_STEP_RECORD_SQL, DELIVERY_ERROR_REDACTION_SQL, REDACTED_DELIVERY_NOTE, seatScopeTuple, effectiveRoleGrantQuery, switchRecordedOff, switchSystemSchedules, peerGrantsStatus, systemGrantsStatus, systemScheduleState, systemSwitchedOff, denialListQuery, refusalListQuery, mapRefusalRow, denialSummaryQuery, denialTotalsQuery, DENIAL_WINDOW_QUERY, mapDenialRow, mapDenialSummaryBuckets, PermissionDenied, assertImpersonationWrites, assertModuleEnqueueableKind, impersonationStampOf, createAtomic, NotSearchable, isSearchIndexTable, searchIndexDdl, searchIndexPlans, NotListable, listIndexPlans, moduleMigrations, listQuery, cursorOf, searchLimit, searchMatchExpression, searchQuery, ATTACHMENT_TEXT_DDL, attachmentRecordOfRow, enqueueAttachmentText, reconcileAttachmentText, recordAttachmentText, searchAttachments, IDEMPOTENCY_DDL, REFUSALS_TABLE_DDL, REFUSALS_INDEX, refusalInsert, refusalOf, markGuardRefusal, REFUSALS_REBUILD, refusalsAdmitGuards, assertIdempotencyKey, assertPermissionKey, idempotencyLookupQuery, idempotencyPruneStatement, idempotencyRecordStatement, idempotencyOptedOutMessage, replayFor, entityVersionQuery, entityVersionOf, assertIfMatch, OUTBOX_ENTITY_INDEX, SCHEDULE_STATE_DDL, SCHEDULE_STATE_REBUILD, scheduleStateHasKind, VERTICAL_EVENTS_DDL, EXPORT_HOPS_SQL, IMPORT_CURSORS_SQL, IMPORT_CURSOR_OF_SQL, OUTBOX_MARK_SQL, exportedSinceQuery, emittedSinceQuery, emittedReportOf, EMITTED_REPORT_CAP, IMPORT_CURSOR_ADVANCE_SQL, IMPORT_RECORD_SQL, moveImportCursor, CrossVerticalRegistry, exportReadPlan, exportReadQuery, planExportBatch, withheldNote, JOB_RUN_DDL, JOB_RUN_DUE_AT, jobRunListLimit, SYSTEM_DOOR_WAIT, } from '@substrat-run/kernel';
 import { isUpgradeRequest, readSubscription, LIVE_FANOUT_LIMIT, LIVE_MODE_HEADER, LIVE_PRINCIPAL_HEADER, LIVE_SCOPE_HEADER, LIVE_SUBSCRIBE_PATH, LIVE_TENANT_HEADER, } from './live-reads.js';
 import { OperationQueue } from './serialization.js';
 import { doScopedSql, doBuiltColumnsOf, doRedactionSql, doSpineSql } from './sql.js';
-import { actorOf, admitPeer, collectPeers, switchPeer, assertNoSecret, CAPABILITY_DDL, CAPABILITY_EXCHANGE_OPERATION, capabilityAttachmentWriteRefused, createCapabilityVerbs, createEntityEdgeVerbs, exchangeCapability, guardSecrets, mintBecomeCapability, redactSecrets, redactSecretText, moduleLog, resolveCapabilitySession, revokeCapabilityAsPlatform, readCapabilityPage, domainEventOf, facetEvents, readDeadLetters, readLifecycleFlow, readHistory, readInvocation, readUndrainedOutbox, walkEventCause, walkEventEffects, } from '@substrat-run/kernel';
+import { actorOf, admitPeer, collectPeers, switchPeer, assertNoSecret, CAPABILITY_DDL, COPY_ORIGIN_DDL, CAPABILITY_EXCHANGE_OPERATION, capabilityAttachmentWriteRefused, createCapabilityVerbs, createEntityEdgeVerbs, exchangeCapability, guardSecrets, mintBecomeCapability, redactSecrets, redactSecretText, moduleLog, asyncInvocationId, asyncLinePass, resolveCapabilitySession, revokeCapabilityAsPlatform, readCapabilityPage, domainEventOf, facetEvents, readDeadLetters, readLifecycleFlow, readHistory, readInvocation, readUndrainedOutbox, walkEventCause, walkEventEffects, } from '@substrat-run/kernel';
 import { createDoTupleChecker, createLocalControlPlaneReader } from './checker.js';
-import { assertNoSpineReference, assertSpineTablesBuilt, dumpRowsInsert, isSpineTable, repointScopeGrants, spineColumnAdditions } from '@substrat-run/kernel';
+import { CARRIED_AWAY_KEY, COPY_MARK_CLEARED_KEY, KEPT_COPY_REFUSAL, KEPT_DIVERGENT_KEY, LOAD_STAMP_KEY, STORE_LOCAL_META_KEYS, WRITE_REVISION_KEY, carriedAwayDump, isCopyMarkInsert, isWriteStatement, assertNoSpineReference, assertSpineTablesBuilt, capabilitiesForLoad, clearCopyMarker, dumpRowsInsert, isSpineTable, markCopyOrigin, repointScopeGrants, settleCopiedWork, emittedHere, IS_COPY_SQL, isCopyLoad, isLifecycleWrite, readLifecycle, settleLifecycleAfterLoad, writeLifecycle, spineColumnAdditions } from '@substrat-run/kernel';
 /**
  * The key marking a scope DO whose storage was destroyed (`destroyStorage`).
  * Written after `deleteAll()` so it survives the wipe, and never cleared: `reaped`
@@ -15,6 +16,21 @@ import { assertNoSpineReference, assertSpineTablesBuilt, dumpRowsInsert, isSpine
  * without asking the directory.
  */
 const REAPED_MARKER = '_substrat_reaped';
+/**
+ * The `_substrat_meta` key of the tenant a scope was provisioned for (#1738): written by the first
+ * projection, never re-pointed, and what every door's pair check holds a request to (#2016).
+ */
+const PROVISIONED_FOR_KEY = 'provisioned_for';
+/** #2016: the refusal of a write that would re-point a scope's tenant, in one wording. */
+const tenantReceiptRefusal = (held, asked) => `refused: this scope was provisioned for tenant ${held}, not ${asked}`;
+/** #2016: the spine tables whose rows say a scope holds state (`ScopeDO.holdsData`). */
+const HOLDS_DATA_TABLES = ['_substrat_migrations', '_substrat_tuples', '_substrat_outbox', '_substrat_schedule_state'];
+/** #2016: why `tenantId` is foreign to a scope (`held`, the receipt `tenantVerdict` read), in one wording. */
+const foreignTenant = (held, tenantId) => held !== null
+    ? tenantReceiptRefusal(held, tenantId)
+    : `refused: this scope holds role rows for another tenant and none for ${tenantId}`;
+/** #2016: the load refusals `tenantReceiptRefusal` raised, told apart by identity, not by text. */
+const tenantRefusals = new WeakSet();
 /**
  * The scope spine, as this adapter builds it — one of two hand-written copies (#969).
  *
@@ -322,11 +338,15 @@ const KERNEL_DDL = `
   -- #116: the request-dedupe table, kernel-owned so no vertical migrates for it.
   ${IDEMPOTENCY_DDL}
   -- #1745: refused transitions, recorded after the rollback like a denial. Kernel-owned.
-  ${REFUSALS_DDL}
+  ${REFUSALS_TABLE_DDL}
+  ${REFUSALS_INDEX}
   -- #1672: capabilities — authority carried by a secret (a link share), and the sessions
   -- an exchange trades that secret for. Shared with the pure adapter from
   -- @substrat-run/kernel so the two cannot part company; the column comments are there.
   ${CAPABILITY_DDL}
+  -- #1686: where a copied scope's data came from, and the event id its own events start above.
+  -- Shared with the other adapter from @substrat-run/kernel; the column comments are there.
+  ${COPY_ORIGIN_DDL}
 `;
 /**
  * Workers RPC carries a plain `Error`'s MESSAGE faithfully and nothing else. A custom
@@ -362,6 +382,137 @@ function kernelEmit(ctx, event) {
         throw new Error('kernelEmit: not an operation context this host built');
     write(event);
 }
+/**
+ * The scope DO's write revision (#1722): the one SQL handle this object writes through, and the
+ * one way it opens a transaction, so a writer or a transaction added later cannot slip past it.
+ * A carry's conditional restore compares the revision, so every change to the store has to move
+ * it: an UPDATE in place (a drain receipt, a redrain) as surely as an emitted event (Codex #2008
+ * r2). `suspended` is the wake's idempotent DDL, a load's drop-and-replay and a migration's own
+ * statements, which advance it themselves.
+ *
+ * **Atomic with the write (Codex #2008 r4).** The bump runs synchronously, right BEFORE the first
+ * write that needs it, on the same connection: inside a `transactionSync` or `transaction` it
+ * commits or rolls back with that transaction's writes, and outside one it joins the same
+ * coalesced batch. A bump that fails throws before the write runs, so no write lands under the old
+ * revision. Nothing is deferred to a later commit.
+ *
+ * **Once per run, not per statement** (a bump per statement cost 28.7–32.4% on a write-heavy
+ * operation, `write-revision-cost.test.ts`). After a bump, later writes skip it while they are
+ * covered by it: until the run ends (a microtask clears the flag at its first await or its end)
+ * and until a transaction boundary. Entering a transaction clears it, so each committing
+ * transaction holds a bump of its own; leaving one clears it too, so after a rollback (which took
+ * the bump with it) or a commit the next write bumps again. Clearing more often only over-counts,
+ * and over-counting only refuses a restore that could have landed.
+ */
+class WriteRevision {
+    raw;
+    storage;
+    suspended;
+    refusal;
+    /** Whether the current run, in the current transaction scope, already holds a bump. */
+    covered = false;
+    /** Inside `bookkeeping`: the one path whose writes advance no revision. */
+    keeping = false;
+    /** A statement's text is almost always a constant, so its answer is remembered (bounded). */
+    writes = new Map();
+    sql;
+    constructor(raw, storage, suspended, 
+    /** Why this store takes no write at all right now, or null (a `carried_away` copy, #1722). */
+    refusal) {
+        this.raw = raw;
+        this.storage = storage;
+        this.suspended = suspended;
+        this.refusal = refusal;
+        const exec = (query, ...bindings) => {
+            if (this.keeping && this.isWrite(query)) {
+                // Bookkeeping takes the copy-marker insert and the lifecycle delivery (#1713) and nothing
+                // else: any other write here would be one the revision never saw, which is the hole this
+                // class exists to close.
+                if (!isCopyMarkInsert(query) && !isLifecycleWrite(query)) {
+                    throw substratError('internal', `the bookkeeping path takes only the copy-marker insert and the lifecycle delivery (#1722, #1713), not: ${query.slice(0, 80)}`);
+                }
+                return raw.exec(query, ...bindings);
+            }
+            if (!this.suspended() && this.isWrite(query)) {
+                const refused = this.refusal();
+                if (refused)
+                    throw substratError('conflict', refused);
+                if (!this.covered)
+                    this.bump();
+            }
+            return raw.exec(query, ...bindings);
+        };
+        this.sql = new Proxy(raw, {
+            get(target, prop) {
+                if (prop === 'exec')
+                    return exec;
+                const value = Reflect.get(target, prop, target);
+                return typeof value === 'function' ? value.bind(target) : value;
+            },
+        });
+    }
+    /**
+     * Store bookkeeping that is not the scope's data: marking the store a copy (#2005, Codex #2008
+     * r10). That only ever restricts what the store may run and changes no data, so it advances no
+     * write revision: a backfill that marks a carry's source between its export and its wipe must
+     * not read as a write the carry did not copy (that would keep the copy for nothing). Enforced,
+     * not trusted: any write in here but the marker insert (`isCopyMarkInsert`) or the lifecycle
+     * delivery (`isLifecycleWrite`, #1713) throws. Clearing a
+     * marker is NOT bookkeeping (r11): it loosens the store, so it is a write a carry fences on.
+     */
+    bookkeeping(run) {
+        const was = this.keeping;
+        this.keeping = true;
+        try {
+            return run();
+        }
+        finally {
+            this.keeping = was;
+        }
+    }
+    /** `storage.transactionSync`, at a transaction boundary. */
+    transactionSync(run) {
+        this.covered = false;
+        try {
+            return this.storage.transactionSync(run);
+        }
+        finally {
+            this.covered = false;
+        }
+    }
+    /** `storage.transaction`, at a transaction boundary. */
+    async transaction(run) {
+        this.covered = false;
+        try {
+            return await this.storage.transaction(run);
+        }
+        finally {
+            this.covered = false;
+        }
+    }
+    bump() {
+        // No catch: a bump that cannot be written fails the write it was for.
+        this.raw.exec(`INSERT INTO _substrat_meta (key, value) VALUES (?, '1')
+       ON CONFLICT (key) DO UPDATE SET value = CAST(CAST(value AS INTEGER) + 1 AS TEXT)`, WRITE_REVISION_KEY);
+        this.covered = true;
+        queueMicrotask(() => {
+            this.covered = false;
+        });
+    }
+    isWrite(query) {
+        let known = this.writes.get(query);
+        if (known === undefined) {
+            known = isWriteStatement(query);
+            if (this.writes.size >= 512)
+                this.writes.clear();
+            this.writes.set(query, known);
+        }
+        return known;
+    }
+}
+/** What a write into a wiped copy answers (#1722): the scope's data lives in another script now. */
+const CARRIED_AWAY_WRITE_REFUSAL = 'this copy of the scope was carried to another script and wiped (#1722); it takes no writes — ' +
+    'a request that reaches it was routed before the move';
 function toRpcError(err) {
     if (err instanceof Error) {
         return err.constructor === Error ? err : new Error(err.message);
@@ -510,6 +661,15 @@ export function splitSqlStatements(sql) {
         out.push(cur.trim());
     return out;
 }
+/**
+ * #1834: the pin missed. Thrown only by `assertSystemDoor`, and module-private, so no operation can
+ * throw one: the two RPCs a door call reaches turn it into the `SystemDoorMoved` ANSWER, by class
+ * identity, and an operation's own error, whatever its text, stays a failure.
+ */
+class SystemDoorMovedError extends Error {
+}
+/** #1834: the brand only `assertSystemDoor` sets, so nothing else can make a `SystemDoorPass`. */
+const SYSTEM_DOOR_PASSED = Symbol('system door passed');
 export function defineScopeDO(modules, bareOps) {
     return class ScopeDO extends DurableObject {
         sql;
@@ -584,6 +744,21 @@ export function defineScopeDO(modules, bareOps) {
          * `runInDurableObject` — rather than assuming the runtime's documented behaviour.
          */
         webSocketMessagesHandled = 0;
+        /**
+         * #1722: while true, a write does not advance the write revision. True through the wake's
+         * own idempotent DDL (which every wake re-runs, and which changes nothing) and through a
+         * load's drop-and-replay, which sets the revision itself once the store is rebuilt.
+         */
+        revisionSuspended = true;
+        /**
+         * #1722 (Codex #2008 r7): whether this store is a copy a carry wiped (it holds the
+         * `carried_away` tombstone). Such a store takes no write: a stale request still routed here
+         * after the wipe would land a write that belongs to no live copy. A load, a rollback's
+         * restore, ends it. Read on every wake and after every load.
+         */
+        carriedAwayCopy = false;
+        /** #1722: the write revision, and the one way this object opens a transaction. */
+        revision;
         constructor(ctx, env) {
             super(ctx, env);
             // #1860: the client's 45s keep-alive (demos/ticket0/app/src/feed.ts) answered at
@@ -591,11 +766,18 @@ export function defineScopeDO(modules, bareOps) {
             // subscriber's ping still reaches `webSocketMessage` and pins the DO in memory —
             // exactly the hibernation cost `acceptWebSocket` (below) exists to avoid.
             ctx.setWebSocketAutoResponse(new WebSocketRequestResponsePair('ping', 'pong'));
-            this.sql = ctx.storage.sql;
+            // #1722: the ONE handle this object writes through and the one way it opens a transaction,
+            // so every write advances the write revision a carry's restore is fenced on, inside the
+            // transaction that commits it. Nothing else here may take the raw handle or open a
+            // transaction on `ctx.storage` itself (`carried-copy.test.ts` in the kernel holds that).
+            this.revision = new WriteRevision(ctx.storage.sql, ctx.storage, () => this.revisionSuspended, () => (this.carriedAwayCopy ? CARRIED_AWAY_WRITE_REFUSAL : null));
+            this.sql = this.revision.sql;
             for (const stmt of splitSqlStatements(KERNEL_DDL)) {
                 this.sql.exec(stmt);
             }
             this.applySpineColumnAdditions();
+            this.revisionSuspended = false;
+            this.carriedAwayCopy = this.metaValue(CARRIED_AWAY_KEY) !== null;
             for (const registration of modules)
                 this.registerModule(registration);
             for (const [name, handler] of Object.entries(bareOps))
@@ -860,7 +1042,7 @@ export function defineScopeDO(modules, bareOps) {
          */
         undrainedEventsRead(limit) {
             return readUndrainedOutbox((offset, count) => this.sql
-                .exec(`SELECT * FROM _substrat_outbox WHERE drained_at IS NULL ORDER BY id LIMIT ? OFFSET ?`, count, offset)
+                .exec(`SELECT * FROM _substrat_outbox WHERE drained_at IS NULL AND ${emittedHere()} ORDER BY id LIMIT ? OFFSET ?`, count, offset)
                 .toArray(), limit);
         }
         /**
@@ -950,25 +1132,76 @@ export function defineScopeDO(modules, bareOps) {
          * pair check), and a stray role row can no longer make a scope serve a tenant it was never
          * provisioned for.
          *
-         * A scope with NO receipt was provisioned before it existed, or has just been restored (a
-         * dump's receipt is dropped on import: it describes the scope the dump came from). Only
-         * then is the old inference used: `provisionScopeLocal` projected role definitions under
-         * the tenant, so a `_substrat_roles` row for it says the same thing. The next projection
-         * (reconcile, or the restore's repair) writes the receipt, after which the inference is
-         * never consulted again.
+         * A scope with NO receipt was provisioned before it existed (a load never brings the dump's:
+         * it describes the scope the dump came from, and the store keeps its own, #2016). Only then
+         * is the old inference used: `provisionScopeLocal` projected role definitions under the
+         * tenant, so a `_substrat_roles` row for it says the same thing. The next projection
+         * (reconcile, or the restore's repair) or lifecycle delivery writes the receipt, after which
+         * the inference is never consulted again.
          *
          * Read without migrating, so asking about a foreign scope leaves its DO as empty as it found it.
          */
         async servesTenant(tenantId) {
-            const has = (table) => this.sql.exec(`SELECT 1 FROM sqlite_master WHERE type = 'table' AND name = ?`, table).toArray().length > 0;
-            if (has('_substrat_meta')) {
-                const receipt = this.sql.exec(`SELECT value FROM _substrat_meta WHERE key = 'provisioned_for'`).toArray()[0];
-                if (receipt)
-                    return receipt.value === tenantId;
+            const { verdict } = this.tenantVerdict(tenantId);
+            return verdict === 'recorded' || verdict === 'inferred';
+        }
+        /**
+         * #2016: what one door into this scope needs from its storage on a CP-less host, in ONE call —
+         * how `tenantId` reads against the scope (`tenantVerdict`), and the lifecycle the platform
+         * delivered (#1713). The coordinator refuses a foreign pair before any guard, handler or store
+         * lookup runs, and reports an `unknown` one it lets through. Read without migrating, like
+         * `servesTenant`.
+         */
+        admission(tenantId) {
+            return { verdict: this.tenantVerdict(tenantId).verdict, lifecycle: readLifecycle(this.switchSql()) };
+        }
+        /**
+         * #1738 / #2016: this scope's tenant against `tenantId` — the one reading behind the served-here
+         * gate, every door's pair check and the lifecycle delivery's back-fill.
+         *
+         *  - `recorded`: the `provisioned_for` receipt names `tenantId`.
+         *  - `foreign`: the receipt names another tenant, or — on a scope provisioned before receipts
+         *    existed — the scope holds role rows and none of them is `tenantId`'s.
+         *  - `inferred`: no receipt, and a role row for `tenantId` (what `provisionScopeLocal` projected
+         *    before the receipt existed).
+         *  - `unknown`: no receipt and no role rows — never provisioned here, or loaded from a world
+         *    that keeps its roles elsewhere and not yet repaired. Nothing to hold the pair against.
+         *
+         * `held` is the receipt read, so a refusal can name it. Read without migrating, so asking about
+         * a foreign scope leaves its DO as empty as it found it.
+         */
+        tenantVerdict(tenantId) {
+            const held = this.provisionedFor();
+            if (held !== null)
+                return { verdict: held === tenantId ? 'recorded' : 'foreign', held };
+            if (!this.hasTable('_substrat_roles'))
+                return { verdict: 'unknown', held };
+            if (this.sql.exec('SELECT 1 FROM _substrat_roles WHERE tenant_id = ? LIMIT 1', tenantId).toArray().length > 0) {
+                return { verdict: 'inferred', held };
             }
-            if (!has('_substrat_roles'))
-                return false;
-            return this.sql.exec('SELECT 1 FROM _substrat_roles WHERE tenant_id = ? LIMIT 1', tenantId).toArray().length > 0;
+            const anyRole = this.sql.exec('SELECT 1 FROM _substrat_roles LIMIT 1').toArray().length > 0;
+            return { verdict: anyRole ? 'foreign' : 'unknown', held };
+        }
+        /**
+         * #2016: whether a scope with no receipt and no role rows holds state — rather than being a DO
+         * nothing ever provisioned or loaded here. Only such a scope takes its tenant from a lifecycle
+         * delivery: recording one in an empty DO would make `servesTenant` answer for a scope this
+         * deployment does not hold.
+         *
+         * Every provision since #1738 writes the receipt itself (that IS the durable provision marker),
+         * so this only ever judges a scope from before it, or a load from an older platform. A module
+         * with no SQL migrations still leaves spine state, so any of it counts, not migrations alone:
+         * applied migrations, scope tuples (its grants, `system:` ones included), events, schedule state.
+         */
+        holdsData() {
+            return HOLDS_DATA_TABLES.some((table) => this.hasTable(table) && this.sql.exec(`SELECT 1 FROM ${table} LIMIT 1`).toArray().length > 0);
+        }
+        /** #1738: the tenant this scope's `provisioned_for` receipt names, or null; read without migrating. */
+        provisionedFor() {
+            return this.hasTable('_substrat_meta') ? this.metaValue(PROVISIONED_FOR_KEY) : null;
+        }
+        hasTable(name) {
+            return this.sql.exec(`SELECT 1 FROM sqlite_master WHERE type = 'table' AND name = ?`, name).toArray().length > 0;
         }
         /** #1705 PR 2: the outbox's insertion mark (`OUTBOX_MARK_SQL`). */
         outboxMark() {
@@ -1024,10 +1257,27 @@ export function defineScopeDO(modules, bareOps) {
                (event_id, consumer_module, delivered_at, error, invocation_id)
              VALUES (?, ?, ?, ?, NULL)`, id, moduleId, when, error);
                 };
+                // #1901: one line per (event, importing module), as for the scope's own consumers.
+                // The handler runs as the producer's peer, so that is who the line says it ran as.
+                const lines = asyncLinePass();
+                const unitOf = (moduleId, eventId, eventType) => ({
+                    kind: 'consumer',
+                    tenantId,
+                    scopeId,
+                    invocationId: asyncInvocationId(null),
+                    operation: moduleId,
+                    eventType,
+                    eventId,
+                    attempt: 1,
+                    startedAt: Date.now(),
+                    principalKind: peerSubject.kind,
+                    versionId: this.env.SUBSTRAT_VERSION_ID ?? null,
+                });
                 for (const w of batch.withheld) {
                     this.sql.exec(IMPORT_RECORD_SQL, w.id, source.scopeId, source.vertical, w.type, w.schemaVersion, w.occurredAt, w.entity.entityType, w.entity.entityId, 0, w.reason, at);
                     for (const moduleId of this.crossVertical.modulesImporting(source.vertical, w.type)) {
                         deadLetter(w.id, moduleId, at, withheldNote(w.reason, source.vertical));
+                        lines.write({ ...unitOf(moduleId, w.id, w.type), outcome: 'dead-lettered' });
                     }
                     result.withheld += 1;
                 }
@@ -1040,14 +1290,17 @@ export function defineScopeDO(modules, bareOps) {
                         ran = true;
                         if (imp.schemaVersion !== e.schemaVersion) {
                             deadLetter(e.id, imp.moduleId, at, withheldNote('version', source.vertical));
+                            lines.write({ ...unitOf(imp.moduleId, e.id, e.type), outcome: 'dead-lettered' });
                             result.deadLettered += 1;
                             continue;
                         }
                         const { hops: _hops, ...fact } = e;
                         const event = structuredClone({ ...fact, source });
+                        const unit = unitOf(imp.moduleId, e.id, e.type);
                         this.causedBy = e.id;
+                        this.unitInvocationId = unit.invocationId;
                         try {
-                            await this.ctx.storage.transaction(async () => {
+                            await this.revision.transaction(async () => {
                                 // As the producer's principal: real checks against the grants this vertical's
                                 // `peers` gave it; its emits carry `{ vertical, scope }` and what they passed.
                                 await imp.handler(this.importContext(tenantId, scopeId, peerSubject), event);
@@ -1055,14 +1308,17 @@ export function defineScopeDO(modules, bareOps) {
                    VALUES (?, ?, ?, NULL)`, e.id, imp.moduleId, new Date().toISOString());
                             });
                             result.delivered += 1;
+                            lines.write({ ...unit, outcome: 'delivered' });
                         }
                         catch (err) {
                             // Dead-letter (v0), outside the rolled-back transaction.
                             deadLetter(e.id, imp.moduleId, new Date().toISOString(), String(err));
                             result.deadLettered += 1;
+                            lines.write({ ...unit, outcome: 'dead-lettered', error: err });
                         }
                         finally {
                             this.causedBy = null;
+                            this.unitInvocationId = null;
                         }
                     }
                     if (!ran)
@@ -1070,6 +1326,7 @@ export function defineScopeDO(modules, bareOps) {
                 }
                 this.sql.exec(IMPORT_CURSOR_ADVANCE_SQL, source.scopeId, source.vertical, batch.next, at);
                 result.cursor = batch.next;
+                lines.end();
                 await this.settleCommitted(tenantId, scopeId, liveSince, null);
                 return result;
             });
@@ -1320,7 +1577,7 @@ export function defineScopeDO(modules, bareOps) {
          * and the re-assert in which a sweep could run the grants just seated.
          */
         async seatTuples(tuples, switchOff) {
-            return this.queue.enqueue(() => this.ctx.storage.transactionSync(() => {
+            return this.queue.enqueue(() => this.revision.transactionSync(() => {
                 for (const t of tuples) {
                     const seat = seatScopeTuple(t.subject, t.relation, t.object, t.expires_at);
                     this.sql.exec(seat.sql, ...seat.params);
@@ -1445,21 +1702,33 @@ export function defineScopeDO(modules, bareOps) {
          * `vertical.honoured`: an old DO that ignored this argument would run the call as that
          * placeholder, and the coordinator refuses a success without the acknowledgement.
          */
-        verticalCaller) {
+        verticalCaller, 
+        /**
+         * #1834: set on a system-door call — the instance whose state read the door's gate
+         * consulted the rewind hold against. On any other instance nothing runs and the answer is
+         * `systemDoorMoved` instead, because a PITR restore always restarts this object, so another
+         * instance may be rewound storage the gate never saw. The reply carries `systemDoor.honoured`.
+         */
+        systemDoorInstance) {
             if (!failureEnvelope) {
                 // Legacy path, byte-for-byte what it was: rewrapped so a non-plain error (a
                 // ZodError, whose `message` is a getter) still arrives with its message.
                 try {
-                    return await this.invokeOrThrow(operation, input, principal, tenantId, scopeId, connectionId, requiredEntitlement, systemModuleId, invokeOptions, impersonation, capabilitySession, verticalCaller);
+                    return await this.invokeOrThrow(operation, input, principal, tenantId, scopeId, connectionId, requiredEntitlement, systemModuleId, invokeOptions, impersonation, capabilitySession, verticalCaller, systemDoorInstance);
                 }
                 catch (err) {
+                    if (err instanceof SystemDoorMovedError)
+                        return { result: undefined, platformRequests: 0, ...SYSTEM_DOOR_MOVED };
                     throw toRpcError(err);
                 }
             }
             try {
-                return await this.invokeOrThrow(operation, input, principal, tenantId, scopeId, connectionId, requiredEntitlement, systemModuleId, invokeOptions, impersonation, capabilitySession, verticalCaller);
+                return await this.invokeOrThrow(operation, input, principal, tenantId, scopeId, connectionId, requiredEntitlement, systemModuleId, invokeOptions, impersonation, capabilitySession, verticalCaller, systemDoorInstance);
             }
             catch (err) {
+                // #1834: the pin missed — an answer, never a failure an operation could have produced.
+                if (err instanceof SystemDoorMovedError)
+                    return { result: undefined, platformRequests: 0, ...SYSTEM_DOOR_MOVED };
                 // The ONE place the error keeps its structure: flattened here, rebuilt by the
                 // coordinator. `toRpcError` is not applied — that exists to make a throw
                 // survivable, and this is not a throw.
@@ -1473,7 +1742,9 @@ export function defineScopeDO(modules, bareOps) {
         /** #1672: a capability session's hash. See `invoke` above. */
         capabilitySession, 
         /** #1706: the calling vertical, as the platform named it. See `invoke` above. */
-        verticalCaller) {
+        verticalCaller, 
+        /** #1834: the instance the system door's gate read. See `invoke` above. */
+        systemDoorInstance) {
             await this.ensureMigrations();
             const handler = this.operations.get(operation);
             // `not_found`, not a bare throw (#113): every vertical hand-matched this message
@@ -1556,6 +1827,9 @@ export function defineScopeDO(modules, bareOps) {
                 // one call. Same placement as the SQLite adapter's actor task, for this reason.
                 this.invocationId = invokeOptions?.invocationId ?? null;
                 try {
+                    // #1834: before anything opens. This instance is the storage the call meets, for the
+                    // whole call: a restore restarts the object, so it cannot move under a running body.
+                    const systemDoor = this.assertSystemDoor(systemModuleId, systemDoorInstance);
                     // #1672: the capability session, resolved on EVERY call and here — inside the queued
                     // body, the one region where this call holds the DO to itself — so nothing can
                     // revoke between this read and the transaction. Refuses a stale session, a revoked
@@ -1629,8 +1903,8 @@ export function defineScopeDO(modules, bareOps) {
                     // commit together, or a throw (from either) rolls domain writes AND
                     // emitted events back as one — verified across `await` in workerd.
                     try {
-                        await this.ctx.storage.transaction(async () => {
-                            const ctx = this.operationContext(principal, tenantId, scopeId, undefined, connectionId, systemModuleId, signals, impersonation, operation, capabilityId, minted, undefined, peerSubject);
+                        await this.revision.transaction(async () => {
+                            const ctx = this.operationContext(principal, tenantId, scopeId, undefined, connectionId, systemDoor, signals, impersonation, operation, capabilityId, minted, undefined, peerSubject);
                             // #116: a retry is answered from the recording, and nothing else runs
                             // — not the guards, not the handler, not the permission check inside
                             // it. Keyed by SUBJECT, so a caller only ever reaches its own
@@ -1698,6 +1972,7 @@ export function defineScopeDO(modules, bareOps) {
                                 impersonation: { honoured: true },
                                 ...(capabilitySession !== undefined ? { capability: { honoured: true } } : {}),
                                 ...(verticalCaller !== undefined ? { vertical: { honoured: true } } : {}),
+                                ...(systemDoorInstance !== undefined ? { systemDoor: { honoured: true } } : {}),
                                 ...(idempotencyKey !== undefined
                                     ? { idempotency: { keyHonoured: true, replayed } }
                                     : {}),
@@ -1762,6 +2037,8 @@ export function defineScopeDO(modules, bareOps) {
                         ...(capabilitySession !== undefined ? { capability: { honoured: true } } : {}),
                         // #1706: the same, for the peer door.
                         ...(verticalCaller !== undefined ? { vertical: { honoured: true } } : {}),
+                        // #1834: the same, for the system door's instance pin.
+                        ...(systemDoorInstance !== undefined ? { systemDoor: { honoured: true } } : {}),
                         // The acknowledgement the coordinator's skew check reads (#116), on the
                         // same reasoning as `ifMatchChecked` below and with a sharper failure: a
                         // DO too old to know about keys would EXECUTE THE OPERATION AGAIN and
@@ -2111,7 +2388,7 @@ export function defineScopeDO(modules, bareOps) {
                 // the reason it is read there: that is where this call holds the DO to itself.
                 const liveSince = this.liveHighWaterMark();
                 try {
-                    await this.ctx.storage.transaction(async () => {
+                    await this.revision.transaction(async () => {
                         const ctx = this.operationContext(principal, tenantId, scopeId, undefined, connectionId, undefined, undefined, undefined, 'attachments.upload');
                         assertAllowed(await ctx.check(gate.write, parsed.entity));
                         this.sql.exec(`INSERT INTO _substrat_attachments
@@ -2203,8 +2480,19 @@ export function defineScopeDO(modules, bareOps) {
             return record;
         }
         /** Authorize a job's read as its registered module, never as a person. */
-        async systemAttachmentAuthorize(attachmentId, moduleId, tenantId, scopeId) {
+        async systemAttachmentAuthorize(attachmentId, moduleId, tenantId, scopeId, 
+        /** #1834: the instance the system door's gate read; see `invoke`. */
+        systemDoorInstance) {
             await this.ensureMigrations();
+            let systemDoor;
+            try {
+                systemDoor = this.assertSystemDoor(moduleId, systemDoorInstance);
+            }
+            catch (err) {
+                if (err instanceof SystemDoorMovedError)
+                    return SYSTEM_DOOR_MOVED;
+                throw toRpcError(err);
+            }
             if (!this.modules.has(moduleId)) {
                 throw toRpcError(substratError('not_found', `module not registered in this scope: ${moduleId}`));
             }
@@ -2213,7 +2501,7 @@ export function defineScopeDO(modules, bareOps) {
                 return null;
             const gate = this.attachmentGate(record.entity.entityType);
             try {
-                const ctx = this.operationContext(this.systemPrincipal, tenantId, scopeId, undefined, undefined, moduleId, undefined, undefined, 'attachments.open');
+                const ctx = this.operationContext(this.systemPrincipal, tenantId, scopeId, undefined, undefined, systemDoor, undefined, undefined, 'attachments.open');
                 assertAllowed(await ctx.check(gate.read, record.entity));
             }
             catch (err) {
@@ -2235,7 +2523,7 @@ export function defineScopeDO(modules, bareOps) {
                 // #938: same mark-then-settle pair as the upload path above.
                 const liveSince = this.liveHighWaterMark();
                 try {
-                    await this.ctx.storage.transaction(async () => {
+                    await this.revision.transaction(async () => {
                         const ctx = this.operationContext(principal, tenantId, scopeId, undefined, connectionId, undefined, undefined, undefined, 'attachments.remove');
                         assertAllowed(await ctx.check(gate.write, record.entity));
                         this.sql.exec('DELETE FROM _substrat_attachments WHERE id = ?', attachmentId);
@@ -2301,7 +2589,7 @@ export function defineScopeDO(modules, bareOps) {
          */
         async attachmentTextRecord(attachmentId, outcome) {
             await this.ensureMigrations();
-            return this.queue.enqueue(async () => this.ctx.storage.transactionSync(() => recordAttachmentText(doSpineSql(this.sql), attachmentId, outcome, new Date().toISOString())));
+            return this.queue.enqueue(async () => this.revision.transactionSync(() => recordAttachmentText(doSpineSql(this.sql), attachmentId, outcome, new Date().toISOString())));
         }
         // -- attachments through a capability (#1686) -------------------------------
         // The coordinator hashed the session token; only the hash arrives. Each verb resolves it
@@ -2405,6 +2693,41 @@ export function defineScopeDO(modules, bareOps) {
         async systemScheduleState(moduleId) {
             return systemScheduleState(this.switchSql(), moduleId, new Date().toISOString());
         }
+        /**
+         * #1834: the system door's state read — `systemScheduleState`, and the instance that
+         * answered it. The door consults the rewind hold after this read and pins every call it
+         * then makes to this instance (`assertSystemDoor`).
+         */
+        async systemDoorState(moduleId) {
+            return { state: await this.systemScheduleState(moduleId), instance: this.instanceId };
+        }
+        /**
+         * #1834: the system door's check on this side, and the ONLY maker of the `SystemDoorPass`
+         * the operation context needs to act as `system:<moduleId>`. A call acting as a module must
+         * carry the instance the host's door gate read (refused without one: no door gated it), and
+         * is refused on any other instance. A PITR restore always restarts this object, so a call
+         * landing on a new instance may meet rewound storage whose module the gate never checked
+         * against the rewind hold. Both are refused before anything opens; the moved one is the
+         * module-private `SystemDoorMovedError`, which the RPC answers as `SystemDoorMoved`, so the door
+         * gates again and retries. No module, no pass.
+         */
+        assertSystemDoor(moduleId, expected) {
+            if (moduleId === undefined)
+                return undefined;
+            // Strict, and deliberately so: no pin means no door gated this call, so it is refused rather
+            // than run unchecked. The one innocent caller is a worker a deploy behind, still running host
+            // code from before the pin, during a rolling deploy. Its refusal is transient: the host and this
+            // object ship in the same bundle, so the window lasts as long as the rollout. Nothing ran, and
+            // the reason says "not now" (`SYSTEM_DOOR_WAIT`) to whoever reads it: a schedule fires on the
+            // next pass, and a job run retries on its next drive.
+            if (expected === undefined) {
+                throw substratError('forbidden', `a call acting as module '${moduleId}' reached this scope without passing the system door`, { reason: SYSTEM_DOOR_WAIT });
+            }
+            if (expected !== this.instanceId) {
+                throw new SystemDoorMovedError("the scope restarted after the system door's gate read it; gate it again");
+            }
+            return { moduleId, [SYSTEM_DOOR_PASSED]: true };
+        }
         /**
          * The pre-#1666 read, kept for ONE reason: a coordinator a deploy behind this DO still
          * calls it. It answers the new question, not the old one — the old predicate counted any
@@ -2434,8 +2757,8 @@ export function defineScopeDO(modules, bareOps) {
          * `switchSystemSchedules`, serialized on the queue with every other tuple write and run
          * as one `transactionSync`, so its reads and writes are one unit.
          */
-        async switchSystemSchedules(moduleId, scopeId, to, at) {
-            const outcome = await this.queue.enqueue(() => this.ctx.storage.transactionSync(() => switchSystemSchedules(this.switchSql(), { moduleId, scopeId, to, at })));
+        async switchSystemSchedules(moduleId, scopeId, to, at, tenantHeld = false) {
+            const outcome = await this.queue.enqueue(() => this.revision.transactionSync(() => switchSystemSchedules(this.switchSql(), { moduleId, scopeId, to, at, tenantHeld })));
             // #1819: the instance that applied it, which the rewind hold's release rule reads.
             return { ...outcome, instance: this.instanceId };
         }
@@ -2450,14 +2773,14 @@ export function defineScopeDO(modules, bareOps) {
             // The consumer's own running imports decide whether the edge exists: read here, in the
             // deployment whose handlers would run, never from the platform's request.
             const imports = this.crossVertical.consumes();
-            return this.queue.enqueue(() => this.ctx.storage.transactionSync(() => moveImportCursor(this.switchSql(), { ...input, imports })));
+            return this.queue.enqueue(() => this.revision.transactionSync(() => moveImportCursor(this.switchSql(), { ...input, imports })));
         }
         /**
          * Move one PEER's kill switch on this scope (#1706) — the kernel's `switchPeer`, which is
          * the schedule switch's statement with a `vertical:` subject. Queued, one transaction.
          */
         async switchPeer(vertical, scopeId, to, at) {
-            return this.queue.enqueue(() => this.ctx.storage.transactionSync(() => switchPeer(this.switchSql(), { vertical, scopeId, to, at })));
+            return this.queue.enqueue(() => this.revision.transactionSync(() => switchPeer(this.switchSql(), { vertical, scopeId, to, at })));
         }
         /**
          * Does peer `vertical` hold each key at this scope's node now (#1706) — the checker's own
@@ -2581,7 +2904,7 @@ export function defineScopeDO(modules, bareOps) {
          */
         switchHoldOn(scopeId, moduleId, claimIds) {
             this.switchHoldsTable();
-            this.ctx.storage.transactionSync(() => {
+            this.revision.transactionSync(() => {
                 const seq = this.sql
                     .exec(`INSERT INTO _substrat_switch_hold_seq (id, seq) VALUES (1, 1)
                ON CONFLICT (id) DO UPDATE SET seq = seq + 1 RETURNING seq`)
@@ -2606,7 +2929,7 @@ export function defineScopeDO(modules, bareOps) {
         switchHoldClaim(scopeId, moduleIds, claimId, token) {
             this.switchHoldsTable();
             const at = new Date().toISOString();
-            this.ctx.storage.transactionSync(() => {
+            this.revision.transactionSync(() => {
                 for (const moduleId of moduleIds) {
                     this.sql.exec(`INSERT OR IGNORE INTO _substrat_switch_holds (scope_id, module_id, claim_id, state, doomed, held_at)
              SELECT ?, ?, ?, 'pending', NULL, ?
@@ -2626,7 +2949,7 @@ export function defineScopeDO(modules, bareOps) {
         switchHoldJoin(scopeId, moduleId, claimIds) {
             this.switchHoldsTable();
             const at = new Date().toISOString();
-            this.ctx.storage.transactionSync(() => {
+            this.revision.transactionSync(() => {
                 for (const claimId of claimIds) {
                     this.sql.exec(`INSERT OR IGNORE INTO _substrat_switch_holds (scope_id, module_id, claim_id, state, doomed, held_at)
              SELECT scope_id, ?, claim_id, state, doomed, ? FROM _substrat_switch_holds
@@ -2684,7 +3007,7 @@ export function defineScopeDO(modules, bareOps) {
         /** Release these claims on one module, or every claim on the scope when `claimIds` is null. */
         switchHoldRelease(scopeId, moduleId, claimIds) {
             this.switchHoldsTable();
-            this.ctx.storage.transactionSync(() => {
+            this.revision.transactionSync(() => {
                 if (moduleId === null || claimIds === null) {
                     this.sql.exec('DELETE FROM _substrat_switch_holds WHERE scope_id = ?', scopeId);
                     this.sql.exec('DELETE FROM _substrat_switch_hold_ons WHERE scope_id = ?', scopeId);
@@ -2721,7 +3044,7 @@ export function defineScopeDO(modules, bareOps) {
                 // and the event's `occurredAt` are one fact, and two clock reads could disagree.
                 const now = instant.parse(new Date().toISOString());
                 let outcome = null;
-                await this.ctx.storage.transaction(async () => {
+                await this.revision.transaction(async () => {
                     outcome = await exchangeCapability({
                         sql: doSpineSql(this.sql),
                         now,
@@ -2751,7 +3074,7 @@ export function defineScopeDO(modules, bareOps) {
          */
         async revokeCapabilityAsPlatform(id, actor) {
             await this.ensureMigrations();
-            return await this.queue.enqueue(() => this.ctx.storage.transactionSync(() => revokeCapabilityAsPlatform(doSpineSql(this.sql), id, actor, instant.parse(new Date().toISOString()))) ?? null);
+            return await this.queue.enqueue(() => this.revision.transactionSync(() => revokeCapabilityAsPlatform(doSpineSql(this.sql), id, actor, instant.parse(new Date().toISOString()))) ?? null);
         }
         /**
          * The operator's read of this scope's capabilities (#1686). The kernel's one read
@@ -2873,7 +3196,7 @@ export function defineScopeDO(modules, bareOps) {
             // `jobRunInsert`: an `await` between them is an output-gate boundary, and the
             // point of doing this in one RPC is that there is no boundary to be evicted
             // at. Same reason `SCHEDULE_STATE_REBUILD` insists on it.
-            this.ctx.storage.transactionSync(() => {
+            this.revision.transactionSync(() => {
                 this.sql.exec(`INSERT INTO _substrat_job_runs
              (id, module_id, job, instance, payload, status, cursor, counters, attempts,
               last_error, started_at, updated_at, next_attempt_at, ended_at, subject_id)
@@ -2913,6 +3236,18 @@ export function defineScopeDO(modules, bareOps) {
             ORDER BY id LIMIT ?`, now, afterId ?? null, afterId ?? null, limit)
                 .toArray();
         }
+        /**
+         * #1834: the drive's ONE snapshot of due runs — keys only, in the order they became due
+         * (`JOB_RUN_DUE_AT`, then id). Spelled exactly as the pure adapter spells it. `jobRunsDue`
+         * above stays for a coordinator a deploy behind, which still pages by id.
+         */
+        async jobRunsDueKeys(now, max) {
+            return this.sql
+                .exec(`SELECT id, module_id, job FROM _substrat_job_runs
+            WHERE status = 'running' AND (next_attempt_at IS NULL OR next_attempt_at <= ?)
+            ORDER BY ${JOB_RUN_DUE_AT}, id LIMIT ?`, now, max)
+                .toArray();
+        }
         /** The operator read, newest first. */
         async jobRunList(filter) {
             const where = [];
@@ -2973,7 +3308,7 @@ export function defineScopeDO(modules, bareOps) {
             // `transactionSync` with both statements inline — NOT `await
             // this.jobRunPatch(...)` then the delete. The await is an output-gate
             // boundary, which is precisely the gap this method exists to close.
-            this.ctx.storage.transactionSync(() => {
+            this.revision.transactionSync(() => {
                 this.sql.exec(JOB_RUN_PATCH_SQL, patch.status, patch.cursor, patch.counters, patch.attempts, patch.lastError, patch.updatedAt, patch.nextAttemptAt, patch.endedAt, id);
                 this.sql.exec('DELETE FROM _substrat_job_steps WHERE run_id = ?', id);
             });
@@ -2994,7 +3329,15 @@ export function defineScopeDO(modules, bareOps) {
                     throw new Error(`unknown guard predicate: '${guard.predicate}' — declared by ${guard.declaredBy} ` +
                         `before '${operation}'; no registered module contributes it (operation blocked)`);
                 }
-                await predicate.handler(ctx, guard.config, input);
+                try {
+                    await predicate.handler(ctx, guard.config, input);
+                }
+                catch (err) {
+                    // #1745: a guard refusing is recorded after the rollback, as a transition is —
+                    // marked here, where which guard threw is still known. Always rethrown.
+                    markGuardRefusal(err, guard.predicate, operation);
+                    throw err;
+                }
             }
         }
         // -- migrations (port of applyPendingMigrations) --------------------------
@@ -3042,7 +3385,7 @@ export function defineScopeDO(modules, bareOps) {
                     if (this.applied.has(key))
                         continue;
                     try {
-                        await this.ctx.storage.transaction(async () => {
+                        await this.revision.transaction(async () => {
                             const already = this.sql
                                 .exec('SELECT 1 FROM _substrat_migrations WHERE module_id = ? AND version = ?', moduleId, migration.version)
                                 .toArray()[0];
@@ -3052,8 +3395,16 @@ export function defineScopeDO(modules, bareOps) {
                                 // #1898: a migration runs on this DO's own handle, not `ctx.sql`, so the
                                 // spine guard's REFERENCES rule is applied here.
                                 assertNoSpineReference(migration.sql, `migration ${key}`);
-                                for (const stmt of splitSqlStatements(migration.sql)) {
-                                    this.sql.exec(stmt);
+                                // #1722: not counted per statement, so `total_changes()` measures the migration
+                                // alone. The journal row below is a write, and advances the revision once.
+                                this.revisionSuspended = true;
+                                try {
+                                    for (const stmt of splitSqlStatements(migration.sql)) {
+                                        this.sql.exec(stmt);
+                                    }
+                                }
+                                finally {
+                                    this.revisionSuspended = false;
                                 }
                                 const after = this.sql.exec('SELECT total_changes() AS n').toArray()[0].n;
                                 this.sql.exec('INSERT INTO _substrat_migrations (module_id, version, applied_at, duration_ms, rows_changed) VALUES (?, ?, ?, ?, ?)', moduleId, migration.version, new Date().toISOString(), Math.max(0, Math.round(performance.now() - started)), after - before);
@@ -3101,7 +3452,7 @@ export function defineScopeDO(modules, bareOps) {
                 .exec(`SELECT o.* FROM _substrat_outbox o
            LEFT JOIN _substrat_deliveries d
              ON d.event_id = o.id AND d.consumer_module = ?
-           WHERE o.type = ?
+           WHERE o.type = ? AND ${emittedHere('o.')}
              AND (d.event_id IS NULL
                   OR (d.next_attempt_at IS NOT NULL AND d.next_attempt_at <= ?))
            ORDER BY o.id`, deliveryId, eventType, new Date().toISOString())
@@ -3118,6 +3469,87 @@ export function defineScopeDO(modules, bareOps) {
             }
             return { events, undecodable };
         }
+        /**
+         * Whether this scope is a copy (#2005) — the classification on its `_substrat_copy_origin` row
+         * (#2009), which only the directory's word sets, not a load's events mark. A CP-less
+         * coordinator has no directory to read a scope's kind from, so this is how it holds a copy's
+         * executor deliveries inert; a coordinator with a directory asks that instead.
+         */
+        isCopy() {
+            return this.sql.exec(IS_COPY_SQL).toArray().length > 0;
+        }
+        /** The lifecycle the platform last delivered to this scope (#1713), or null for none. */
+        lifecycle() {
+            return readLifecycle(this.switchSql());
+        }
+        /**
+         * Store a lifecycle the platform delivered (#1713, `writeLifecycle`): kept only when it is not
+         * older than the one held. Bookkeeping, like the copy marker: it changes what runs here, not
+         * the scope's data, so it does not advance the write revision a carry fences on.
+         */
+        setLifecycle(next, 
+        /** #2016: the tenant the directory delivered this lifecycle for. A scope it is foreign to
+         *  (`tenantVerdict`) refuses the delivery untouched; one provisioned before the receipt
+         *  existed, whose role rows name this tenant, records it — the back-fill. */
+        tenantId) {
+            const { verdict, held } = tenantId === undefined ? { verdict: null, held: null } : this.tenantVerdict(tenantId);
+            if (verdict === 'foreign') {
+                return { refused: 'tenant', message: `lifecycle delivery ${foreignTenant(held, tenantId)}` };
+            }
+            // The back-fill: a scope provisioned before the receipt (its role rows agree), or one whose
+            // tenant nothing recorded although it holds data (a load from a world that keeps its roles
+            // elsewhere). The directory's word records it; a DO never provisioned here records nothing.
+            const backfill = verdict === 'inferred' || (verdict === 'unknown' && this.holdsData());
+            let out;
+            this.revision.transactionSync(() => {
+                // A write the carry fences on, not bookkeeping: it happens once per legacy scope, and
+                // over-counting only refuses a restore that could have landed. A carried-away copy takes
+                // no write at all, so it is left to the next projection.
+                if (backfill && !this.carriedAwayCopy) {
+                    this.sql.exec(`INSERT INTO _substrat_meta (key, value) VALUES (?, ?)`, PROVISIONED_FOR_KEY, tenantId);
+                }
+                out = { ...this.revision.bookkeeping(() => writeLifecycle(this.switchSql(), next)), tenantRecorded: this.provisionedFor() !== null };
+            });
+            return out;
+        }
+        /** Mark this scope a copy (#2005, `markCopyOrigin`): the repair of a copy that predates the
+         *  marker. Answers whether this call stamped it; a store that already reads as a copy is left
+         *  as it is, and a load's events mark is never moved (#2009). */
+        markCopy() {
+            let marked = false;
+            this.revision.transactionSync(() => {
+                marked = this.revision.bookkeeping(() => markCopyOrigin(this.switchSql(), new Date().toISOString()));
+            });
+            return marked;
+        }
+        /**
+         * Clear a mistaken copy classification (#2005, `clearCopyMarker`); a load's events mark stays,
+         * so copied work still never runs here (#2009). A
+         * clear is a write like any other (Codex #2008 r11), never bookkeeping: it lets the store run
+         * work a copy holds inert, so it advances the write revision, and a carry that exported
+         * before it cannot wipe the repaired store. That carry's wipe keeps it instead.
+         */
+        clearCopyMark(
+        /** The store the caller means (Codex #2008 r12–r13): the platform's reconcile of the store a
+         *  carry landed names that carry's load stamp and the revision it read, so a store another
+         *  load has replaced since (a governed restore, whose classification is its own) is refused,
+         *  compared here, in the clear's own transaction. Absent for staff's correction. */
+        expect) {
+            return this.revision.transactionSync(() => {
+                const from = this.metaValue(WRITE_REVISION_KEY);
+                if (expect && (this.metaValue(LOAD_STAMP_KEY) !== expect.loadStamp || from !== expect.revision)) {
+                    return 'changed';
+                }
+                const outcome = clearCopyMarker(this.switchSql());
+                // The clear's own revisions, so a carry's refused wipe can tell that this clear, and
+                // nothing else, is what changed here since its export (`COPY_MARK_CLEARED_KEY`).
+                if (outcome === 'cleared') {
+                    this.sql.exec(`INSERT INTO _substrat_meta (key, value) VALUES (?, ?)
+             ON CONFLICT (key) DO UPDATE SET value = excluded.value`, COPY_MARK_CLEARED_KEY, JSON.stringify({ from, to: this.metaValue(WRITE_REVISION_KEY) }));
+                }
+                return outcome;
+            });
+        }
         /**
          * The same read as a bare list of events, for a coordinator deployed before
          * `pendingExecutorDeliveries` (#1636). An undecodable row is left out rather than
@@ -3362,7 +3794,7 @@ export function defineScopeDO(modules, bareOps) {
             let result;
             const rollback = new Error('read-only console rollback');
             try {
-                await this.ctx.storage.transaction(async () => {
+                await this.revision.transaction(async () => {
                     const cursor = this.sql.exec(stmt);
                     const columns = cursor.columnNames;
                     const rows = [];
@@ -3442,12 +3874,32 @@ export function defineScopeDO(modules, bareOps) {
             return defs.map(({ name, sql }) => {
                 // Raw positional rows, cells as-is (blobs kept as bytes, not nulled like a UI
                 // read) so the dump reloads faithfully. The name is from the live schema.
-                const cursor = this.sql.exec(`SELECT * FROM "${name}"`);
+                // #1722: the load stamp and the write revision describe THIS store, so they never leave
+                // in a dump (`exportDumpStamped` hands the stamp over beside one); every load writes its own.
+                const cursor = name === '_substrat_meta'
+                    ? this.sql.exec(`SELECT * FROM "${name}" WHERE key NOT IN (${STORE_LOCAL_META_KEYS.map(() => '?').join(', ')})`, ...STORE_LOCAL_META_KEYS)
+                    : this.sql.exec(`SELECT * FROM "${name}"`);
                 const columns = cursor.columnNames;
                 const rows = Array.from(cursor.raw(), (row) => row);
                 return { name, ddl: sql, columns, rows };
             });
         }
+        /**
+         * `exportDump`, with the store's load stamp read in the same call (#1722): the stamp a
+         * carry's fenced wipe of this copy later expects. A store no load has stamped gets one now,
+         * so the stamp handed out is present exactly while nothing has been loaded here since. One
+         * synchronous method, so no load can land between the dump and the stamp.
+         */
+        exportDumpStamped() {
+            let stamp = this.loadStamp();
+            // A wiped copy takes no write, a stamp included; the carry refuses its tombstone anyway.
+            if (!stamp && !this.carriedAwayCopy) {
+                stamp = ulid();
+                this.sql.exec(`INSERT INTO _substrat_meta (key, value) VALUES (?, ?)`, LOAD_STAMP_KEY, stamp);
+            }
+            // Read after the stamp's own write, so it is the revision the store holds as it is dumped.
+            return { tables: this.exportDump(), loadStamp: stamp, revision: this.metaValue(WRITE_REVISION_KEY) };
+        }
         /**
          * Load a dump into this (freshly-provisioned) scope — the write half of the fork
          * (host.ts importScope). Drop-then-replay: the provisioning schema is wiped and rebuilt,
@@ -3529,6 +3981,9 @@ export function defineScopeDO(modules, bareOps) {
                 // every legacy row — a past run's id cannot be recovered afterwards, exactly
                 // as the other #1525 columns above argued.
                 'ALTER TABLE _substrat_schedule_state ADD COLUMN invocation_id TEXT',
+                // #2009: the copy classification on a scope DO built before it (NULL reads as a copy;
+                // see `COPY_ORIGIN_DDL`).
+                'ALTER TABLE _substrat_copy_origin ADD COLUMN is_copy INTEGER',
             ]) {
                 try {
                     this.sql.exec(alter);
@@ -3552,6 +4007,14 @@ export function defineScopeDO(modules, bareOps) {
             // both adapters by the query-plan test rather than by that gate.
             this.sql.exec('CREATE INDEX IF NOT EXISTS _substrat_outbox_invocation ON _substrat_outbox (invocation_id, id)');
             this.ensureScheduleStateKind();
+            this.ensureRefusalsAdmitGuards();
+        }
+        /**
+         * #1745: `_substrat_refusals`, rebuilt to admit a guard row (a nullable `from_state`, plus
+         * `guard` and `reason`) on a scope DO whose table predates it.
+         */
+        ensureRefusalsAdmitGuards() {
+            this.rebuildIfStale('_substrat_refusals', refusalsAdmitGuards, REFUSALS_REBUILD);
         }
         /**
          * #1288: `_substrat_schedule_state`, rebuilt with `kind` in its key on a scope DO
@@ -3563,23 +4026,31 @@ export function defineScopeDO(modules, bareOps) {
          * the stored DDL is the one probe both adapters can make.
          */
         ensureScheduleStateKind() {
+            this.rebuildIfStale('_substrat_schedule_state', scheduleStateHasKind, SCHEDULE_STATE_REBUILD);
+        }
+        /**
+         * Run a kernel create-copy-drop-rename `script` over `table` when the stored DDL fails
+         * `isCurrent` — the one shape `ensureScheduleStateKind` and `ensureRefusalsAdmitGuards`
+         * share, so the pure adapter's twin rebuilds byte-identically.
+         */
+        rebuildIfStale(table, isCurrent, script) {
             const row = this.sql
-                .exec(`SELECT sql FROM sqlite_master WHERE type = 'table' AND name = ?`, '_substrat_schedule_state')
+                .exec(`SELECT sql FROM sqlite_master WHERE type = 'table' AND name = ?`, table)
                 .toArray()[0];
-            if (!row || scheduleStateHasKind(row.sql))
+            if (!row || isCurrent(row.sql))
                 return;
-            // In a transaction, for the reason the kernel constant spells out: create-copy-
+            // In a transaction, for the reason the kernel constants spell out: create-copy-
             // drop-rename has two intermediate states and both are unrecoverable on the next
             // wake. `transactionSync`, not the async one every operation uses — the DO
             // runtime forbids a manual BEGIN through `sql.exec`, and this body is wholly
             // synchronous, which is the one case the sync API is for (it commits at the
             // first await, and there is none). It also has to be sync because the caller is.
-            this.ctx.storage.transactionSync(() => {
-                for (const stmt of splitSqlStatements(SCHEDULE_STATE_REBUILD))
+            this.revision.transactionSync(() => {
+                for (const stmt of splitSqlStatements(script))
                     this.sql.exec(stmt);
             });
         }
-        async importDump(tables, destScopeId, { switchOff, sourceScopeId, exact, } = {}) {
+        async importDump(tables, destScopeId, { switchOff, sourceScopeId, exact, loadStamp, expect, resolveKept, markCopy, provisionedFor, } = {}) {
             // The WHOLE drop-then-replay runs under deferred foreign keys, in one transaction.
             //
             // Two distinct FK hazards, and both need the deferral — the second is why it cannot
@@ -3601,7 +4072,8 @@ export function defineScopeDO(modules, bareOps) {
             // A dump written before indexes were excluded may still carry them; skipped
             // rather than failing a restore over data about to be recomputed.
             // Matched without case, as SQLite resolves a table name (#1883 review).
-            const replayable = tables.filter((t) => !isSearchIndexTable(t.name.toLowerCase()));
+            // #1686: a copy into another scope id loads no capability rows; a same-scope restore keeps them.
+            const replayable = capabilitiesForLoad(tables.filter((t) => !isSearchIndexTable(t.name.toLowerCase())), destScopeId, sourceScopeId);
             // The dump is untrusted input (#1143). `SqlStorage.exec` runs every statement
             // in the string it is given, so a `ddl` with anything appended to its CREATE
             // TABLE executed that too — with entirely plain identifiers, which is why no
@@ -3613,74 +4085,138 @@ export function defineScopeDO(modules, bareOps) {
             if (exact && !sourceScopeId) {
                 throw substratError('validation_failed', 'restore refused: `exact` needs the scope the dump came from');
             }
-            const switched = await this.ctx.storage.transaction(async () => {
-                this.sql.exec('PRAGMA defer_foreign_keys = ON');
-                // Real tables only; `sqlite_*` internals are auto-managed and un-droppable.
-                const existing = this.sql
-                    .exec(`SELECT name FROM sqlite_master WHERE type = 'table' AND name NOT GLOB 'sqlite_*'`)
-                    .toArray();
-                // Search index tables are left alone here and rebuilt below (#827): dropping a
-                // shadow table directly is an error, and `sqlite_master` order would reach one
-                // before its virtual table.
-                for (const { name } of existing) {
-                    if (isSearchIndexTable(name.toLowerCase()))
-                        continue;
-                    this.sql.exec(`DROP TABLE IF EXISTS "${name}"`);
+            const switched = await this.revision.transaction(async () => {
+                const before = this.loadMarker();
+                // #1713: the lifecycle the platform delivered here, read before the drops take it.
+                const lifecycleBefore = readLifecycle(this.switchSql());
+                // #2016: this store's own tenant receipt, read before the drops take it. A load never
+                // changes which tenant the scope belongs to: the platform's word for it (`provisionedFor`)
+                // must agree with the receipt held, and is refused before the first drop if it does not.
+                const receiptBefore = this.provisionedFor();
+                if (provisionedFor !== undefined && receiptBefore !== null && receiptBefore !== provisionedFor) {
+                    const refused = substratError('conflict', tenantReceiptRefusal(receiptBefore, provisionedFor));
+                    tenantRefusals.add(refused);
+                    throw refused;
                 }
-                // A vertical's tables take the dump's own DDL. The spine never does (#1883): a dump
-                // that declared a column the checker compares on as COLLATE NOCASE would otherwise
-                // decide how this DO's permission checks match. Every `_substrat_*` table is built
-                // from KERNEL_DDL instead, and the dump contributes only rows, by column name
-                // (`spineRowsInsert`), a missing column taking the kernel's default.
-                for (const t of replayable)
-                    if (!isSpineTable(t.name))
-                        this.sql.exec(t.ddl);
-                // KERNEL_DDL also builds what the dump did not carry (#321). A dump captured from a
-                // WORLD that stores some `_substrat_*` tables ELSEWHERE carries only a subset — an
-                // `@substrat-run/adapter-sqlite` scope file keeps `_substrat_roles` /
-                // `_substrat_tenant_tuples` in its DIRECTORY database, so its per-scope dump omits
-                // them, and without them the very next permission check would raise a bare `no such
-                // table: _substrat_roles`. Roles land empty here and are re-projected by the
-                // restore's repair leg (host.projectRolesLocal) — the spine's job is only to exist so
-                // the checker can read it. The column pass follows, for the one outbox index KERNEL_DDL
-                // leaves to it.
-                for (const stmt of splitSqlStatements(KERNEL_DDL))
-                    this.sql.exec(stmt);
-                this.applySpineColumnAdditions();
-                const columnsOf = (name) => doBuiltColumnsOf(this.sql, name);
-                assertSpineTablesBuilt(replayable.map((t) => t.name), columnsOf);
-                // A spine column this kernel does not know (a dump from a newer one) is kept, as a plain
-                // untyped column the checker never reads.
-                for (const t of replayable) {
-                    if (isSpineTable(t.name))
-                        for (const alter of spineColumnAdditions(t, columnsOf(t.name)))
-                            this.sql.exec(alter);
+                // #1722 (Codex #2008 r7): a kept copy holds writes nothing else has. No load replaces it
+                // except its own resolution, and that only at the revision the operator acted on.
+                const kept = this.metaValue(KEPT_DIVERGENT_KEY);
+                if (resolveKept) {
+                    if (!kept)
+                        throw substratError('precondition_failed', 'no kept copy here to resolve; nothing was loaded');
+                    if (before.revision !== resolveKept.revision ||
+                        (resolveKept.loadStamp !== undefined && before.loadStamp !== resolveKept.loadStamp)) {
+                        throw substratError('precondition_failed', 'the kept copy changed since it was read; nothing was loaded');
+                    }
                 }
-                for (const t of replayable) {
-                    const insert = dumpRowsInsert(t, columnsOf);
-                    for (const row of t.rows)
-                        this.sql.exec(insert, ...row);
+                else if (kept) {
+                    throw substratError('conflict', KEPT_COPY_REFUSAL);
                 }
-                // #1738: a dump's `provisioned_for` names the scope (and tenant) it was captured from,
-                // not this one. Dropped, so a restore never carries a receipt over; the repair
-                // projection that follows writes this scope's own.
-                this.sql.exec(`DELETE FROM _substrat_meta WHERE key = 'provisioned_for'`);
-                // #1575: attachment text is not in a dump, so the load left it as it was. Drop the
-                // text of attachments the dump did not bring back, and queue extraction for those
-                // it brought back without text — the bytes decide what that run finds.
-                reconcileAttachmentText(doSpineSql(this.sql), ulid, new Date().toISOString());
-                // Re-point the restored grants at THIS scope (after the spine exists, so a dump
-                // that carried no tuples table still finds one here).
-                if (destScopeId) {
-                    this.rewriteScopeTuples(destScopeId, sourceScopeId && { scopeId: sourceScopeId, exact }, new Date().toISOString());
+                if (expect) {
+                    if (before.loadStamp !== expect.loadStamp || (expect.revision !== undefined && before.revision !== expect.revision)) {
+                        throw substratError('precondition_failed', 'scope store changed since it was read; nothing was loaded');
+                    }
+                }
+                // #1722: the drops take `_substrat_meta` with them; the revision is written back below.
+                this.revisionSuspended = true;
+                try {
+                    this.sql.exec('PRAGMA defer_foreign_keys = ON');
+                    // Real tables only; `sqlite_*` internals are auto-managed and un-droppable.
+                    const existing = this.sql
+                        .exec(`SELECT name FROM sqlite_master WHERE type = 'table' AND name NOT GLOB 'sqlite_*'`)
+                        .toArray();
+                    // Search index tables are left alone here and rebuilt below (#827): dropping a
+                    // shadow table directly is an error, and `sqlite_master` order would reach one
+                    // before its virtual table.
+                    for (const { name } of existing) {
+                        if (isSearchIndexTable(name.toLowerCase()))
+                            continue;
+                        this.sql.exec(`DROP TABLE IF EXISTS "${name}"`);
+                    }
+                    // A vertical's tables take the dump's own DDL. The spine never does (#1883): a dump
+                    // that declared a column the checker compares on as COLLATE NOCASE would otherwise
+                    // decide how this DO's permission checks match. Every `_substrat_*` table is built
+                    // from KERNEL_DDL instead, and the dump contributes only rows, by column name
+                    // (`spineRowsInsert`), a missing column taking the kernel's default.
+                    for (const t of replayable)
+                        if (!isSpineTable(t.name))
+                            this.sql.exec(t.ddl);
+                    // KERNEL_DDL also builds what the dump did not carry (#321). A dump captured from a
+                    // WORLD that stores some `_substrat_*` tables ELSEWHERE carries only a subset — an
+                    // `@substrat-run/adapter-sqlite` scope file keeps `_substrat_roles` /
+                    // `_substrat_tenant_tuples` in its DIRECTORY database, so its per-scope dump omits
+                    // them, and without them the very next permission check would raise a bare `no such
+                    // table: _substrat_roles`. Roles land empty here and are re-projected by the
+                    // restore's repair leg (host.projectRolesLocal) — the spine's job is only to exist so
+                    // the checker can read it. The column pass follows, for the one outbox index KERNEL_DDL
+                    // leaves to it.
+                    for (const stmt of splitSqlStatements(KERNEL_DDL))
+                        this.sql.exec(stmt);
+                    this.applySpineColumnAdditions();
+                    const columnsOf = (name) => doBuiltColumnsOf(this.sql, name);
+                    assertSpineTablesBuilt(replayable.map((t) => t.name), columnsOf);
+                    // A spine column this kernel does not know (a dump from a newer one) is kept, as a plain
+                    // untyped column the checker never reads.
+                    for (const t of replayable) {
+                        if (isSpineTable(t.name))
+                            for (const alter of spineColumnAdditions(t, columnsOf(t.name)))
+                                this.sql.exec(alter);
+                    }
+                    for (const t of replayable) {
+                        const insert = dumpRowsInsert(t, columnsOf);
+                        for (const row of t.rows)
+                            this.sql.exec(insert, ...row);
+                    }
+                    // #1738: a dump's `provisioned_for` names the scope (and tenant) it was captured from,
+                    // not this one, so it is never carried over. #2016: what stays is THIS store's own —
+                    // the platform's word when the load carries it (a copy into a fresh scope records its
+                    // own tenant here), else the receipt held before the drops. A store that held none
+                    // keeps none, and the repair projection that follows writes it.
+                    this.sql.exec(`DELETE FROM _substrat_meta WHERE key = ?`, PROVISIONED_FOR_KEY);
+                    const receipt = provisionedFor ?? receiptBefore;
+                    if (receipt !== null) {
+                        this.sql.exec(`INSERT INTO _substrat_meta (key, value) VALUES (?, ?)`, PROVISIONED_FOR_KEY, receipt);
+                    }
+                    // #1722: whatever stamp an export read here no longer describes this store, so every load
+                    // replaces it: with the carry's own, or with none. And the write revision moves on from
+                    // where it stood before the drops, so it never goes back.
+                    if (loadStamp) {
+                        this.sql.exec(`INSERT OR REPLACE INTO _substrat_meta (key, value) VALUES (?, ?)`, LOAD_STAMP_KEY, loadStamp);
+                    }
+                    else {
+                        this.sql.exec(`DELETE FROM _substrat_meta WHERE key = ?`, LOAD_STAMP_KEY);
+                    }
+                    this.sql.exec(`INSERT OR REPLACE INTO _substrat_meta (key, value) VALUES (?, ?)`, WRITE_REVISION_KEY, String(Number(before.revision ?? 0) + 1));
+                    // #1575: attachment text is not in a dump, so the load left it as it was. Drop the
+                    // text of attachments the dump did not bring back, and queue extraction for those
+                    // it brought back without text — the bytes decide what that run finds.
+                    const now = new Date().toISOString();
+                    // #1686: nothing the source queued runs in a copy; a return leaves it all queued. BEFORE
+                    // the extraction queue below, which is this scope's own work, not the source's.
+                    settleCopiedWork(this.switchSql(), destScopeId, sourceScopeId, now);
+                    if (markCopy)
+                        markCopyOrigin(this.switchSql(), now);
+                    // #1713: a return keeps the newer of this store's lifecycle and the dump's, so a backup
+                    // from before a suspension does not lift it; a copy keeps only its own.
+                    settleLifecycleAfterLoad(this.switchSql(), lifecycleBefore, markCopy === true || isCopyLoad(destScopeId, sourceScopeId));
+                    reconcileAttachmentText(doSpineSql(this.sql), ulid, now);
+                    // Re-point the restored grants at THIS scope (after the spine exists, so a dump
+                    // that carried no tuples table still finds one here).
+                    if (destScopeId) {
+                        this.rewriteScopeTuples(destScopeId, sourceScopeId && { scopeId: sourceScopeId, exact }, new Date().toISOString());
+                    }
+                    // #1742: the recorded-off modules go back off INSIDE the replay's transaction, with
+                    // the spine and the re-point. A switch that throws rolls the whole restore back, so
+                    // the dump's grants never commit live without the switch that should cover them.
+                    return destScopeId && switchOff
+                        ? switchRecordedOff(this.switchSql(), { scopeId: destScopeId, ...switchOff })
+                        : [];
+                }
+                finally {
+                    this.revisionSuspended = false;
                 }
-                // #1742: the recorded-off modules go back off INSIDE the replay's transaction, with
-                // the spine and the re-point. A switch that throws rolls the whole restore back, so
-                // the dump's grants never commit live without the switch that should cover them.
-                return destScopeId && switchOff
-                    ? switchRecordedOff(this.switchSql(), { scopeId: destScopeId, ...switchOff })
-                    : [];
             });
+            this.carriedAwayCopy = this.metaValue(CARRIED_AWAY_KEY) !== null;
             // Rebuild the derived search indexes over the rows just loaded (#827). Drop-then-
             // create, so it also repairs an index a dump left stale, and the triggers it
             // recreates are what keep the restored scope in step from here. Skipped for a plan
@@ -3695,6 +4231,18 @@ export function defineScopeDO(modules, bareOps) {
                 for (const stmt of splitSqlStatements(searchIndexDdl(plan)))
                     this.sql.exec(stmt);
             }
+            // #1335 / #1686: the outbox arrived with the dump, so this DO's event ids resume above it,
+            // as on a wake. A copy's own events then sort above every copied one, which is what
+            // `emittedHere()` relies on. A dump whose top id is no ULID leaves the floor where it was.
+            const top = this.sql.exec('SELECT MAX(id) AS id FROM _substrat_outbox').toArray()[0]?.id;
+            if (top) {
+                try {
+                    this.mintEventId.seedFrom(top);
+                }
+                catch {
+                    // Not a ULID: nothing this mint could have written, so there is no floor to keep.
+                }
+            }
             // The frontier arrived with the dump — refresh the in-memory applied set so a
             // later migrate() builds on the imported state, not the provisioning state.
             this.applied.clear();
@@ -3728,6 +4276,166 @@ export function defineScopeDO(modules, bareOps) {
             this.lastFailure = null;
             return switched;
         }
+        /**
+         * `importDump` with its two refusals answered as values (#1722): across this RPC a throw
+         * carries only its message, and the host has to tell "the store moved since it was read"
+         * (`changed`, 412) and "this store is a kept copy" (`kept`, 409) from a failure.
+         */
+        async importDumpChecked(tables, destScopeId, opts) {
+            try {
+                return { refused: false, switchedOff: await this.importDump(tables, destScopeId, opts) };
+            }
+            catch (e) {
+                const code = errorCodeOf(e);
+                if (code === 'precondition_failed')
+                    return { refused: 'changed' };
+                if (e instanceof Error && tenantRefusals.has(e))
+                    return { refused: 'tenant', message: e.message };
+                if (code === 'conflict')
+                    return { refused: 'kept' };
+                throw toRpcError(e);
+            }
+        }
+        /** The kept-copy marker (#1722), or null when this store is not one. */
+        keptCopy() {
+            const raw = this.metaValue(KEPT_DIVERGENT_KEY);
+            return raw ? JSON.parse(raw) : null;
+        }
+        /**
+         * Release a kept copy that is the scope's live store after all (#1722, Codex #2008 r8): a carry
+         * that protected its source when the route read elsewhere, while a rollback was about to bind
+         * it. Clears the marker only, fenced on the write revision read; the data stays as it is.
+         */
+        releaseKeptCopy(revision, 
+        /** The directory says this scope is not primary (#2005): the released store is marked a copy. */
+        markCopy, 
+        /** The load stamp read with `revision` (Codex #2008 r13): a store a load replaced is refused.
+         *  A kept copy refuses every load but its own resolution, so this holds by construction too. */
+        loadStamp) {
+            return this.revision.transactionSync(() => {
+                if (!this.metaValue(KEPT_DIVERGENT_KEY))
+                    return { refused: 'not-kept' };
+                if (this.metaValue(WRITE_REVISION_KEY) !== revision)
+                    return { refused: 'changed' };
+                if (loadStamp !== undefined && this.metaValue(LOAD_STAMP_KEY) !== loadStamp)
+                    return { refused: 'changed' };
+                this.sql.exec(`DELETE FROM _substrat_meta WHERE key = ?`, KEPT_DIVERGENT_KEY);
+                if (markCopy)
+                    this.revision.bookkeeping(() => markCopyOrigin(this.switchSql(), new Date().toISOString()));
+                return { released: true };
+            });
+        }
+        /**
+         * Discard a kept copy (#1722): the staff resolution that wipes it to the tombstone, only if it
+         * is still one at the write revision the operator acted on. The marker goes with the wipe.
+         */
+        async discardKeptCopy(scopeId, revision, carriedAway, 
+        /** The directory says this scope is not primary (#2005): as `wipeCarried`. */
+        markCopy, 
+        /** The load stamp read with `revision` (Codex #2008 r13), as `releaseKeptCopy`. */
+        loadStamp) {
+            if (!this.metaValue(KEPT_DIVERGENT_KEY))
+                return { refused: 'not-kept' };
+            try {
+                await this.importDump(carriedAwayDump(carriedAway), scopeId, {
+                    sourceScopeId: scopeId,
+                    resolveKept: { revision, ...(loadStamp !== undefined ? { loadStamp } : {}) },
+                    markCopy: markCopy === true || this.isCopy(), // #2005: as `wipeCarried`
+                });
+                return { discarded: true };
+            }
+            catch (e) {
+                if (errorCodeOf(e) === 'precondition_failed')
+                    return { refused: 'changed' };
+                throw toRpcError(e);
+            }
+        }
+        /** What a carry's restore into this store expects to find unchanged (#1722): see `LoadMarker`. */
+        loadMarker() {
+            return { loadStamp: this.metaValue(LOAD_STAMP_KEY), revision: this.metaValue(WRITE_REVISION_KEY) };
+        }
+        /** This store's load stamp (#1722), or null when no load has written one. */
+        loadStamp() {
+            return this.metaValue(LOAD_STAMP_KEY);
+        }
+        metaValue(key) {
+            const row = this.sql.exec(`SELECT value FROM _substrat_meta WHERE key = ?`, key).toArray()[0];
+            return row?.value ?? null;
+        }
+        /**
+         * Wipe the copy a carry left in this script (#1722), only if nothing was loaded here since
+         * the carry exported it. A rollback that restored into this DO in the meantime replaced or
+         * cleared the stamp, and its restore stays. Non-terminal, unlike `destroyStorage`: the store is a load of
+         * the `carriedAway` tombstone, so a later restore into it works as on any scope. False when
+         * refused.
+         */
+        async wipeCarried(scopeId, expectLoadStamp, carriedAway, { expectRevision, protectIfChanged, markCopy, } = {}) {
+            // A store marked now stays one: the copy-origin row goes on the tombstone (the wipe), or
+            // on the copy kept (a refusal), and never counts as a data write (`bookkeeping`).
+            const copy = markCopy === true || this.isCopy();
+            try {
+                await this.importDump(carriedAwayDump(carriedAway), scopeId, {
+                    sourceScopeId: scopeId,
+                    expect: { loadStamp: expectLoadStamp, ...(expectRevision !== undefined ? { revision: expectRevision } : {}) },
+                    // #2005: a copy wiped is still a copy. The drop-and-replay takes the copy-origin row
+                    // with everything else, so it is written again, or the tombstone would read as primary.
+                    markCopy: copy,
+                });
+                return true;
+            }
+            catch (e) {
+                const code = errorCodeOf(e);
+                // Only on the directory's word: the store's own marker, read before the refused load, may
+                // have been cleared by staff since (Codex #2008 r12), and marking it again would undo that.
+                if (markCopy === true) {
+                    this.revision.transactionSync(() => this.revision.bookkeeping(() => markCopyOrigin(this.switchSql(), carriedAway.at)));
+                }
+                if (code === 'conflict') {
+                    // Already a kept copy, and the scope has been carried away from it again (Codex #2008
+                    // r9). That is recorded on the marker, which is a write: it advances the revision, so a
+                    // release (staff or a carry's auto-release) that read the revision before this, when the
+                    // scope still routed here, fails its compare-and-set rather than clearing the marker of
+                    // a copy the scope has just left.
+                    this.revision.transactionSync(() => {
+                        const raw = this.metaValue(KEPT_DIVERGENT_KEY);
+                        if (!raw)
+                            return;
+                        const kept = { ...JSON.parse(raw), leftAgain: { to: carriedAway.to, at: carriedAway.at } };
+                        this.sql.exec(`UPDATE _substrat_meta SET value = ? WHERE key = ?`, JSON.stringify(kept), KEPT_DIVERGENT_KEY);
+                    });
+                    return false;
+                }
+                if (code !== 'precondition_failed')
+                    throw toRpcError(e);
+                // Refused. When nothing was LOADED here since the export (the stamp is the one read) but
+                // the store was WRITTEN (the revision moved), the copy holds a write the carry never
+                // copied: protect it in the store itself, decided again inside its own transaction.
+                this.revision.transactionSync(() => {
+                    const now = this.loadMarker();
+                    const writtenSince = expectRevision !== undefined && now.loadStamp === expectLoadStamp && now.revision !== expectRevision;
+                    const changedSince = now.loadStamp !== expectLoadStamp || (expectRevision !== undefined && now.revision !== expectRevision);
+                    // A wiped copy holds nothing to protect (and takes no write, the marker included).
+                    if (this.carriedAwayCopy || this.metaValue(KEPT_DIVERGENT_KEY))
+                        return;
+                    if (!writtenSince && !(protectIfChanged && changedSince))
+                        return;
+                    const kept = { carriedTo: carriedAway.to, keptAt: carriedAway.at, revision: now.revision };
+                    this.sql.exec(`INSERT INTO _substrat_meta (key, value) VALUES (?, ?)`, KEPT_DIVERGENT_KEY, JSON.stringify(kept));
+                    // Codex #2008 r12: changed ONLY by a staff clear of the copy marker — the clear's own
+                    // revisions span exactly the export's and the store's now — so the data is what the carry
+                    // copied, and only the fresher classification is not. Recorded on the marker with the
+                    // revision this keep committed at (the same run: no second bump), which the platform's
+                    // discard is fenced on once it has brought the clear to where the scope runs.
+                    const cleared = this.metaValue(COPY_MARK_CLEARED_KEY);
+                    const span = cleared ? JSON.parse(cleared) : null;
+                    if (writtenSince && span && span.from === expectRevision && span.to === now.revision) {
+                        const settled = { ...kept, clearedOnly: { revision: this.metaValue(WRITE_REVISION_KEY) } };
+                        this.sql.exec(`UPDATE _substrat_meta SET value = ? WHERE key = ?`, JSON.stringify(settled), KEPT_DIVERGENT_KEY);
+                    }
+                });
+                return false;
+            }
+        }
         /**
          * Re-point scope-level tuples at the scope they now live in.
          *
@@ -3874,6 +4582,13 @@ export function defineScopeDO(modules, bareOps) {
          * later alarm-driven drain with a call it had nothing to do with.
          */
         invocationId = null;
+        /**
+         * #1901: the id a unit of async work with no call around it logs under — a consumer a
+         * seed or an import delivered — set for its handler's duration and cleared after. Read
+         * by `ctx.log` only, never the spine: an event a consumer emits outside a call still
+         * records no invocation (#1525), while its log lines join the consumer's own line.
+         */
+        unitInvocationId = null;
         async dispatch(tenantId, scopeId, 
         /**
          * #1525: the call this drain is running in, or null. Every round of the loop
@@ -3881,13 +4596,23 @@ export function defineScopeDO(modules, bareOps) {
          * whole cascade is one call's work.
          */
         invocationId) {
+            // #1901: one line per delivery, capped per drain.
+            const lines = asyncLinePass();
+            try {
+                await this.dispatchRounds(tenantId, scopeId, invocationId, lines);
+            }
+            finally {
+                lines.end();
+            }
+        }
+        async dispatchRounds(tenantId, scopeId, invocationId, lines) {
             for (let round = 0; round < 50; round++) {
                 let deliveredAny = false;
                 for (const mod of this.modules.values()) {
                     for (const consumer of mod.consumers) {
                         const rows = this.sql
                             .exec(`SELECT * FROM _substrat_outbox o
-                 WHERE o.type = ?
+                 WHERE o.type = ? AND ${emittedHere('o.')}
                    AND NOT EXISTS (
                      SELECT 1 FROM _substrat_deliveries d
                      WHERE d.event_id = o.id AND d.consumer_module = ?
@@ -3895,6 +4620,20 @@ export function defineScopeDO(modules, bareOps) {
                  ORDER BY o.id`, consumer.eventType, mod.id)
                             .toArray();
                         for (const row of rows) {
+                            // #1901: this delivery's line — the call's id when it runs in one, else its own.
+                            const unit = {
+                                kind: 'consumer',
+                                tenantId,
+                                scopeId,
+                                invocationId: asyncInvocationId(invocationId),
+                                operation: mod.id,
+                                eventType: consumer.eventType,
+                                eventId: row.id,
+                                // A module consumer is tried once: a throw dead-letters it (v0).
+                                attempt: 1,
+                                startedAt: Date.now(),
+                                versionId: this.env.SUBSTRAT_VERSION_ID ?? null,
+                            };
                             let event;
                             try {
                                 event = domainEventOf(row);
@@ -3908,14 +4647,18 @@ export function defineScopeDO(modules, bareOps) {
                                 this.sql.exec(`INSERT INTO _substrat_deliveries
                      (event_id, consumer_module, delivered_at, error, invocation_id)
                    VALUES (?, ?, ?, ?, ?)`, row.id, mod.id, new Date().toISOString(), String(err), invocationId);
+                                // Never reached the handler, so nothing threw in it: a warning, not an error.
+                                lines.write({ ...unit, outcome: 'dead-lettered' });
                                 continue;
                             }
                             // #1237: anything this consumer emits was emitted BECAUSE of this event
                             // — the step a backwards walk used to stop dead at, since a consumer
                             // emit records no operation either.
                             this.causedBy = event.id;
+                            // #1901: the handler's `ctx.log` lines join this delivery's line.
+                            this.unitInvocationId = unit.invocationId;
                             try {
-                                await this.ctx.storage.transaction(async () => {
+                                await this.revision.transaction(async () => {
                                     const ctx = this.operationContext(this.systemPrincipal, tenantId, scopeId, {
                                         system: mod.id,
                                     });
@@ -3925,6 +4668,7 @@ export function defineScopeDO(modules, bareOps) {
                      VALUES (?, ?, ?, ?)`, event.id, mod.id, new Date().toISOString(), invocationId);
                                 });
                                 deliveredAny = true;
+                                lines.write({ ...unit, outcome: 'delivered' });
                             }
                             catch (err) {
                                 // Dead-letter (v0): journal the failure so one poison event
@@ -3932,8 +4676,10 @@ export function defineScopeDO(modules, bareOps) {
                                 this.sql.exec(`INSERT INTO _substrat_deliveries
                      (event_id, consumer_module, delivered_at, error, invocation_id)
                    VALUES (?, ?, ?, ?, ?)`, event.id, mod.id, new Date().toISOString(), String(err), invocationId);
+                                lines.write({ ...unit, outcome: 'dead-lettered', error: err });
                             }
                             finally {
+                                this.unitInvocationId = null;
                                 // Cleared on BOTH paths. Left set, the id leaks onto every later emit
                                 // this DO makes — an operation's own event stamped as caused by
                                 // whatever was delivered last, which is worse than recording nothing
@@ -3953,9 +4699,9 @@ export function defineScopeDO(modules, bareOps) {
          * survives — the whole point, since the denial is the write the operation could not make.
          */
         /** K-42: the session a refused call ran under travels with the denial row. */
-        /** #1745: a refused transition the operation failed with, written after its rollback. */
+        /** #1745: a refused transition or refusing guard the operation failed with, written after its rollback. */
         recordRefusal(subject, tenantId, scopeId, operation, err, invocationId, impersonation) {
-            const refused = refusedTransitionOf(err);
+            const refused = refusalOf(err);
             if (!refused)
                 return;
             const q = refusalInsert({
@@ -4006,7 +4752,12 @@ export function defineScopeDO(modules, bareOps) {
             invocationId, new Date().toISOString());
         }
         // -- operation context (port of operationContext) -------------------------
-        operationContext(principal, tenantId, scopeId, systemActor, connectionId, systemModuleId, 
+        operationContext(principal, tenantId, scopeId, systemActor, connectionId, 
+        /**
+         * #1834: the system subject, only as the door check hands it out (`assertSystemDoor`) — so
+         * no path can act as `system:<moduleId>` without passing that check.
+         */
+        systemDoor, 
         /** #458: per-invoke tally of `ctx.requestPlatform` calls; absent for consumer dispatch. */
         signals, 
         /**
@@ -4071,8 +4822,8 @@ export function defineScopeDO(modules, bareOps) {
                 ? peerSubject
                 : capabilityId
                     ? { kind: 'capability', id: capabilityId }
-                    : systemModuleId
-                        ? { kind: 'system', id: systemModuleId }
+                    : systemDoor
+                        ? { kind: 'system', id: systemDoor.moduleId }
                         : connectionId
                             ? { kind: 'connection', id: connectionId }
                             : { kind: 'principal', id: principal };
@@ -4101,7 +4852,7 @@ export function defineScopeDO(modules, bareOps) {
              * owns that stack itself. It is exactly this asymmetry that makes `RunSub`
              * closure-shaped rather than an enter/rollback/release triple.
              */
-            const runSub = (_depth, fn) => this.ctx.storage.transaction(fn);
+            const runSub = (_depth, fn) => this.revision.transaction(fn);
             // Lifted so `grant` reuses the SAME check the operation itself passes —
             // a delegation check that could differ from the operation's would be a
             // second opinion about what the caller holds.
@@ -4198,7 +4949,7 @@ export function defineScopeDO(modules, bareOps) {
                     tenantId,
                     scopeId,
                     operation: operation ?? null,
-                    invocationId: () => this.invocationId,
+                    invocationId: () => this.invocationId ?? this.unitInvocationId,
                     principalKind: systemActor ? 'system' : subject.kind,
                     // The string-safe redaction: `redactSecrets` parses its serialization back, and a
                     // log's text is not JSON.
@@ -4279,7 +5030,7 @@ export function defineScopeDO(modules, bareOps) {
                     });
                     const rows = sql.exec(q.sql, ...q.params).toArray();
                     const last = rows.length >= limit ? rows[rows.length - 1] : undefined;
-                    const nextCursor = last === undefined ? null : cursorOf(last, q.sortColumn, plan.idColumn);
+                    const nextCursor = last === undefined ? null : cursorOf(last, q.sortColumn, plan.idColumn, q.order);
                     const page = { entries: rows, nextCursor };
                     if (!params.total)
                         return page;
@@ -4512,18 +5263,23 @@ export function defineScopeDO(modules, bareOps) {
             // The whole body is synchronous storage work, so it is ONE transaction (#1738): the queue
             // serializes but does not roll back, and a role insert that throws part-way must not leave
             // the receipt (or a half-replaced role set) behind for `servesTenant` to trust.
-            return this.queue.enqueue(() => this.ctx.storage.transactionSync(() => {
+            return this.queue.enqueue(() => this.revision.transactionSync(() => {
                 // #1738: the receipt `servesTenant` reads. First writer wins: absent or equal is written,
                 // a receipt for ANOTHER tenant refuses the whole projection (K-3), before a single row
                 // moves, so a misdirected projection can never re-point a scope or leave its roles behind.
-                // A restore does not trip this: `importDump` drops the dump's receipt, so the repair
-                // projection that follows finds none and writes the destination's own.
-                const held = this.sql.exec(`SELECT value FROM _substrat_meta WHERE key = 'provisioned_for'`).toArray()[0];
-                if (held && held.value !== tenantId) {
-                    throw substratError('conflict', `applyProjection refused: this scope was provisioned for tenant ${held.value}, and a projection for tenant ${tenantId} would re-point it`);
+                // A restore does not trip this: `importDump` keeps the destination's own receipt and
+                // never the dump's (#2016), so the repair projection that follows finds its own tenant.
+                // #2016: a scope with no receipt yet takes its first one only where its role rows agree
+                // (`tenantVerdict`, the same reading the lifecycle back-fill uses), so a projection for
+                // another tenant cannot pin a legacy scope to it.
+                const { verdict, held } = this.tenantVerdict(tenantId);
+                if (verdict === 'foreign') {
+                    throw substratError('conflict', held !== null
+                        ? `applyProjection refused: this scope was provisioned for tenant ${held}, and a projection for tenant ${tenantId} would re-point it`
+                        : `applyProjection ${foreignTenant(held, tenantId)}`);
                 }
                 // Written before any guard below can return early, so every projection leaves it.
-                this.sql.exec(`INSERT OR REPLACE INTO _substrat_meta (key, value) VALUES ('provisioned_for', ?)`, tenantId);
+                this.sql.exec(`INSERT OR REPLACE INTO _substrat_meta (key, value) VALUES (?, ?)`, PROVISIONED_FOR_KEY, tenantId);
                 this.sql.exec(`DELETE FROM _substrat_roles WHERE tenant_id = ?`, tenantId);
                 for (const r of roles) {
                     this.sql.exec(`INSERT OR REPLACE INTO _substrat_roles (tenant_id, role_key, permissions, source, revoked_at)