@substrat-run/adapter-cloudflare 0.136.0 → 0.137.0

package/dist/host.js

@@ -1,8 +1,9 @@
 import { env as ambientEnv } from 'cloudflare:workers';
 import { isRewindRefusal, REWIND_REFUSED } from './rewind-refusal.js';
-import { delegatedReadParams, fromWireFailure, exportReadInput, exportedBatch, importBatch, importResult, importState, importsOfManifestJson, exportsOfManifestJson, importCursorMove, importCursorMoveAt, importCursorMoved, accessLogEntry, adminLogEntry, opsFailureEntry, opsFailureFingerprint, issueEntry, sweepRunEntry, FRESHNESS_HEARTBEAT_MINUTES, sweepRunsPayload, modelUsageEntry, attachmentRecord, createTenantInput, identityLink, identityPool, createOrgInput, promotionAcknowledgement, bindAcknowledgement, bindHostnameInput, channelHistoryEntry, hostnameBinding, publishVersionInput, AUTO_ADMISSION_NOTE, registerVerticalInput, vertical as verticalSchema, verticalServingState, verticalChannel, verticalVersion, connection, capabilityExchange, capabilityGrant, principalId, connectionGrant, connectionGrantRecord, connectionSecret, systemGrant, systemSwitch, systemSwitchOutcome, systemScheduleEntry, systemSwitchRecord, entitlementGrant, entitlementGrantInput, capabilityFilter, instant, meterReading, subjectRef, createConnectionInput, projectedConnectionGrant, projectedConnectionKey, moduleManifest, org as orgSchema, orgMembership, resolvedIdentity, identityMembership, roleDefinition, scope as scopeSchema, tenant as tenantSchema, tenantRole, delegatedReadRecord, ownerTransferAudit, copyMarkAudit, subjectShredReceipt, connectorDispatchKind, callsOfManifestJson, outboundOfManifestJson, substratError, redrainEventsInput, coverage, peerCoverage, peerGrantsEntry, peerSwitch, peerSwitchOutcome, verticalCaller, verticalResolution, verticalSlug, entityObjectRef, ATTACHMENT_BLOB_BINDING, blobStoreBindingName, lifecycleDelivery, scopeLifecycle, } from '@substrat-run/contracts';
+import { isSystemDoorMoved, SYSTEM_DOOR_MOVED, SYSTEM_DOOR_REGATES } from './system-door.js';
+import { delegatedReadParams, fromWireFailure, exportReadInput, exportedBatch, importBatch, importResult, importState, importsOfManifestJson, exportsOfManifestJson, importCursorMove, importCursorMoveAt, importCursorMoved, accessLogEntry, adminLogEntry, opsFailureEntry, opsFailureFingerprint, issueEntry, sweepRunEntry, FRESHNESS_HEARTBEAT_MINUTES, sweepRunsPayload, modelUsageEntry, attachmentRecord, createTenantInput, identityLink, identityPool, createOrgInput, promotionAcknowledgement, bindAcknowledgement, bindHostnameInput, channelHistoryEntry, hostnameBinding, publishVersionInput, AUTO_ADMISSION_NOTE, registerVerticalInput, vertical as verticalSchema, verticalServingState, verticalChannel, verticalVersion, connection, capabilityExchange, mintedCapability, capabilityGrant, principalId, connectionGrant, connectionGrantRecord, connectionSecret, systemGrant, systemSwitch, systemSwitchOutcome, systemScheduleEntry, systemSwitchRecord, entitlementGrant, entitlementGrantInput, capabilityFilter, instant, meterReading, subjectRef, createConnectionInput, projectedConnectionGrant, projectedConnectionKey, moduleManifest, org as orgSchema, orgMembership, resolvedIdentity, identityMembership, roleDefinition, scope as scopeSchema, tenant as tenantSchema, tenantRole, delegatedReadRecord, ownerTransferAudit, copyMarkAudit, subjectShredReceipt, connectorDispatchKind, callsOfManifestJson, outboundOfManifestJson, substratError, redrainEventsInput, coverage, peerCoverage, peerGrantsEntry, peerSwitch, peerSwitchOutcome, verticalCaller, verticalResolution, verticalSlug, entityObjectRef, ATTACHMENT_BLOB_BINDING, blobStoreBindingName, lifecycleDelivery, scopeLifecycle, } from '@substrat-run/contracts';
 import { normalizeHostname, toRouteTarget } from './route-resolver.js';
-import { attachmentBlobKey, attachmentSha256, entitlementDenial, requiredEntitlementFor, foldMeterReading, parseValidationRecords, resolveScopeRecord, ulid, KEPT_COPY_REFUSAL, capabilityTokenHash, checkBecomeInput, plausibleSessionToken, foldModelUsage, backoffAt, resolveRetryPolicy, isSecretBoxConfigured, unconfiguredSecretBox, createSubjectKeys, generateSealingKeyPair, openSealed, ImpersonationRefused, assertSessionUsable, impersonationRowValues, mapImpersonationRow, newImpersonationSession, jobRunOf, runDueJobRuns, startJobRun, attachmentTextJob, assertAttachmentExtractors, assertJobRegistrable, isAttachmentTextRun, searchLimit, searchMatchExpression, globalFetch, assertRedrainWindow, platformRequestOf, undrainedEventsOf, inUnitMovesToAudit, staleCarryRevertRow, staleCarryReverts, withRecorded, systemSwitchedOffMessage, tenantSystemSwitchedOffMessage, CrossVerticalRegistry, importCursorSourceOf, exportBreaksOf, exportBreakRefusal, bindExportBreaksOf, bindExportBreakRefusal, collectPeers, peerSeats, connectorCallRecord, noopConnectorCallRecorder, recordConnectorCall, settleConnectionUse, splitManifestMigrations, unknownRoleError, assertRowLimit, assertRowOffset, INERT_SCOPE_REASON, lifecycleReceipt, lifecycleRefusal, isPrimaryScope, isPrimaryScopeRow, asyncInvocationId, asyncLinePass, } from '@substrat-run/kernel';
+import { attachmentBlobKey, attachmentSha256, entitlementDenial, requiredEntitlementFor, foldMeterReading, parseValidationRecords, resolveScopeRecord, ulid, KEPT_COPY_REFUSAL, capabilityTokenHash, checkBecomeInput, plausibleSessionToken, foldModelUsage, backoffAt, resolveRetryPolicy, isSecretBoxConfigured, unconfiguredSecretBox, createSubjectKeys, generateSealingKeyPair, openSealed, ImpersonationRefused, assertSessionUsable, impersonationRowValues, mapImpersonationRow, newImpersonationSession, jobRunOf, runDueJobRuns, SYSTEM_DOOR_WAIT, startJobRun, attachmentTextJob, assertAttachmentExtractors, assertJobRegistrable, isAttachmentTextRun, searchLimit, searchMatchExpression, globalFetch, assertRedrainWindow, platformRequestOf, undrainedEventsOf, inUnitMovesToAudit, staleCarryRevertRow, staleCarryReverts, withRecorded, systemSwitchedOffMessage, tenantSystemSwitchedOffMessage, CrossVerticalRegistry, importCursorSourceOf, exportBreaksOf, exportBreakRefusal, bindExportBreaksOf, bindExportBreakRefusal, collectPeers, peerSeats, connectorCallRecord, noopConnectorCallRecorder, recordConnectorCall, settleConnectionUse, splitManifestMigrations, unknownRoleError, assertRowLimit, assertRowOffset, INERT_SCOPE_REASON, lifecycleReceipt, lifecycleRefusal, isPrimaryScope, isPrimaryScopeRow, asyncInvocationId, asyncLinePass, } from '@substrat-run/kernel';
 import { attributedHost } from '@substrat-run/kernel';
 import { isOrangeToOrange, isUpgradeRequest, LIVE_MODE_HEADER, LIVE_PRINCIPAL_HEADER, LIVE_SCOPE_HEADER, LIVE_SUBSCRIBE_PATH, LIVE_TENANT_HEADER, } from './live-reads.js';
 import { tenantStoreDatabaseName } from './d1.js';
@@ -37,6 +38,28 @@ function unwrapCapabilityReply(reply) {
  * clock; the skew allows for clocks that disagree, and bounds what a forged answer can move.
  */
 export const LIFECYCLE_EPOCH_SKEW_MS = 24 * 60 * 60 * 1000;
+/**
+ * #2016: how many served scopes one heal pass asks for their tenant record, beyond the drift and the
+ * holds. Rotated least-recently-asked first, so a deployment that cannot answer yet (a build from
+ * before the record) costs at most this many deliveries a pass and starves nothing.
+ */
+export const TENANT_UNRECORDED_PER_PASS = 50;
+/**
+ * K-3's refusal of a (tenant, scope) pair the host does not hold — the same answer for a scope that
+ * does not exist and for one of another tenant (#1718), in one wording.
+ */
+const unknownScopeForTenant = (tenantId, scopeId) => substratError('not_found', `unknown scope for tenant: (${tenantId}, ${scopeId})`);
+/**
+ * #2016: the line a CP-less host writes each time it admits a pair to a scope with no tenant record
+ * and no role rows — nothing to hold the pair against. Ids only.
+ */
+export const tenantUnrecordedLine = (tenantId, scopeId) => ({
+    substrat: 'tenant-unrecorded',
+    level: 'warn',
+    tenantId,
+    scopeId,
+    message: 'admitted to a scope whose tenant is not recorded; a reconcile or lifecycle delivery records it',
+});
 /**
  * Refuse to mark a scope a copy unless the request classifies it non-primary (#2005). The
  * classification is the platform directory's; the vertical applies the same `isPrimaryScope` to
@@ -51,9 +74,10 @@ function assertCopyLineage(lineage) {
  * A control-plane stand-in for a CP-less vertical (scope-local-permissions.md Phase 3).
  * The hot path a served scope actually touches becomes trust-the-upstream:
  *   - `scopeAccessRefusal` / `setMigrationState` → no-op: the router gates the scope's
- *     lifecycle + tenancy from the shared directory, and the vertical trusts the asserted
- *     node rather than re-reading a directory it does not have. Its own half of the
- *     lifecycle gate reads the scope's storage instead (`assertLive`, #1713).
+ *     lifecycle + tenancy from the shared directory, and the vertical does not re-read a
+ *     directory it does not have. Its own half of both gates reads the scope's storage
+ *     instead (`validateScopeAccess`): the tenant the scope was provisioned for (#2016) and the lifecycle
+ *     the platform delivered (#1713).
  *   - `tenantHoldsEntitlement` → true: the SKU was enforced on the shared control plane
  *     at provision (before `provisionInstance`), so a scope that EXISTS here was granted
  *     it upstream — a single-vertical deployment holds its own entitlements by construction.
@@ -71,12 +95,14 @@ function nullControlPlane() {
         // #1674: the schedule switch's record is a DIRECTORY store, and a CP-less host has no
         // directory — the shared control plane that delegates here keeps it. Same posture as
         // `recordAdmin`: nothing to write, nothing recorded to read back.
-        recordSystemSwitchedOff: noop,
+        recordSystemSwitchedOff: async () => null,
         recordSystemSwitchedOn: async () => null,
         restoreSystemSwitchRecord: noop,
         listSystemSwitches: async () => [],
         systemSwitchRecordsOf: async () => [],
         switchedOffModulesOf: async () => [],
+        // #1823: no tenant tuples here either — the platform reads them and sends `tenantHeld`.
+        tenantHeldSystemModules: async () => [],
     };
     return new Proxy({}, {
         get: (_t, prop) => typeof prop === 'string' && prop in passthrough
@@ -124,6 +150,20 @@ export const SWITCH_HOLD_EXTRA_WAITS = 3;
  * clock, against the releasing host's clock: minutes, not seconds.
  */
 export const SWITCH_HOLD_PENDING_MAX_MS = 5 * 60_000;
+/**
+ * An OFF of a tenant-held module whose far end did not attest `deniesTenantGrants` (#1823): it
+ * switched, but its evaluator still authorizes the module's tenant-level grant on the scope.
+ * Carries the far end's outcome, so the operator's OFF knows whether there is a move to put back.
+ */
+class UnattestedSwitchOff extends Error {
+    outcome;
+    constructor(scopeId, moduleId, outcome) {
+        super(`the deployment serving scope ${scopeId} predates the kill switch's tenant-grant denial (#1823): ` +
+            `module '${moduleId}' holds a tenant-level grant that its OFF would leave authorizing there. ` +
+            `Redeploy the vertical, then retry.`);
+        this.outcome = outcome;
+    }
+}
 /**
  * The attachment bucket a host resolves when it was handed no resolver (#1995): the
  * platform's per-tenant binding, read off this script's own env, named by the one shared
@@ -543,7 +583,7 @@ export class CloudflareScopeHost {
         return {
             startOrJoin: (key, row) => stub.jobRunStartOrJoin(key.moduleId, key.job, key.instance, row),
             get: (id) => stub.jobRunById(id),
-            due: (now, limit, afterId) => stub.jobRunsDue(now, limit, afterId),
+            dueKeys: (now, max) => stub.jobRunsDueKeys(now, max),
             list: (filter) => stub.jobRunList(filter),
             patch: (id, patch) => stub.jobRunPatch(id, patch),
             commitPass: (id, patch) => stub.jobCommitPass(id, patch),
@@ -585,7 +625,10 @@ export class CloudflareScopeHost {
             store: this.jobStore(scopeId),
             handlerFor: (run) => isAttachmentTextRun(run) ? attachmentText : this.jobs.get(`${run.module_id}/${run.job}`),
             now: () => new Date().toISOString(),
-            openScope: (run) => this.getSystemScope(run.module_id, tenantId, scopeId),
+            // #1834: the door is opened FOR this pass, so its "not now" is tied to this pass alone.
+            openScope: async (run, pass) => this.buildStub(tenantId, scopeId, undefined, undefined, await this.openSystemDoor(run.module_id, tenantId, scopeId, undefined, pass)),
+            // #1834: only this host's own door refusals defer a pass, recognised by identity.
+            deferral: (err, pass) => this.takeDoorWait(err, pass),
             maxPasses: options?.maxPasses,
             limit: options?.limit,
         });
@@ -665,7 +708,7 @@ export class CloudflareScopeHost {
         const rec = await this.cp.getScopeRecord(tenantId, scopeId);
         // K-3: a scope under another tenant is indistinguishable from one that does not exist.
         if (!rec)
-            throw substratError('not_found', `unknown scope for tenant: (${tenantId}, ${scopeId})`);
+            throw unknownScopeForTenant(tenantId, scopeId);
         if (rec.status !== 'active' && rec.status !== 'provisioning') {
             throw new Error(`scope not migratable (status: ${rec.status}): ${scopeId}`);
         }
@@ -737,6 +780,31 @@ export class CloudflareScopeHost {
     async listCapabilitiesLocal(scopeId, filter) {
         return this.scopeStub(scopeId).listCapabilities(filter);
     }
+    /**
+     * The platform's `become` mint on the CP-less path (#1686) — `HostAdmin.mintCapability`'s
+     * ScopeDO half, for the deployment that serves the scope. Its one caller is an owner claim
+     * link, minted on the platform's instruction behind the vertical's platform-gated
+     * `/internal/owner-claim`; the control plane made the K-3 check and keeps the admin log before
+     * it called. Not a module verb: a module mints through `ctx.capabilities`, which mints `act`
+     * capabilities only. Same lifecycle gate as the exchange, so a held scope mints nothing.
+     */
+    async mintCapabilityLocal(tenantId, scopeId, input, actor) {
+        // Checked on this side too, as `HostAdmin.mintCapability` does: a typed refusal thrown
+        // across the RPC arrives as a bare message.
+        checkBecomeInput(input, new Date().toISOString());
+        await this.assertLive(tenantId, scopeId);
+        await this.migrateAndRecord(scopeId);
+        return mintedCapability.parse(await this.scopeStub(scopeId).mintBecomeCapability(input, actor));
+    }
+    /**
+     * The platform's revoke on the CP-less path (#1686) — how a re-minted claim link retires the
+     * previous one. True when the scope held the capability (revoked now, or already); false when
+     * it holds no such capability. No lifecycle gate: a revoke only narrows, so a held scope still
+     * takes one. Idempotent.
+     */
+    async revokeCapabilityLocal(scopeId, capabilityId, actor) {
+        return (await this.scopeStub(scopeId).revokeCapabilityAsPlatform(capabilityId, actor)) !== null;
+    }
     /**
      * Copy one scope's data into a fresh scope DO, entirely within THIS deployment —
      * the data half of an orchestrated snapshot (preview-and-snapshots.md §9). Like the
@@ -745,12 +813,24 @@ export class CloudflareScopeHost {
      * activation, version bind) stays on the control plane's side. Because source and
      * destination sit in the same SCOPE namespace, no scope bytes ever leave the
      * deployment — the §9 property the trust line rests on.
+     *
+     * #2016: `tenantId`, the tenant the platform snapshots for (absent from an older platform). The
+     * source must not be foreign to it — a copy never reads another tenant's scope — and the fork
+     * records it as its own receipt, not the source's.
      */
-    async snapshotScopeLocal(sourceScopeId, destScopeId) {
+    async snapshotScopeLocal(sourceScopeId, destScopeId, tenantId) {
+        if (tenantId !== undefined && (await this.scopeStub(sourceScopeId).admission(tenantId)).verdict === 'foreign') {
+            throw unknownScopeForTenant(tenantId, sourceScopeId);
+        }
         const tables = await this.scopeStub(sourceScopeId).exportDump();
         // #2009: a snapshot is a fork by construction (the control plane's row names `forkedFrom`, so
         // the directory never calls it primary), and a load classifies nothing by itself: marked here.
-        await this.scopeStub(destScopeId).importDump(tables, destScopeId, { sourceScopeId, exact: true, markCopy: true });
+        await this.scopeStub(destScopeId).importDump(tables, destScopeId, {
+            sourceScopeId,
+            exact: true,
+            markCopy: true,
+            provisionedFor: tenantId,
+        });
         return { tables: tables.length };
     }
     /**
@@ -767,18 +847,23 @@ export class CloudflareScopeHost {
      *  #1722: `loadStamp`, the stamp a carry leaves on the copy it lands, for a fenced wipe later,
      *  and `expect`, the marker the carry read here: the load is refused if the store moved since.
      *  #2005: `markCopy` — the directory's classification of the scope, sent when it is not
-     *  primary; the restore then marks it a copy. Refused if it classifies a primary. */
+     *  primary; the restore then marks it a copy. Refused if it classifies a primary.
+     *  #2016: `tenantId`, the tenant the platform restores for: recorded as the scope's receipt in
+     *  the load's own transaction, and a store provisioned for another tenant refuses the load. */
     opts) {
         if (opts?.markCopy)
             assertCopyLineage(opts.markCopy);
         const load = {
-            switchOff: opts?.switchedOff ? { moduleIds: opts.switchedOff, at: new Date().toISOString() } : undefined,
+            switchOff: opts?.switchedOff
+                ? { moduleIds: opts.switchedOff, at: new Date().toISOString(), tenantHeld: opts.tenantHeld }
+                : undefined,
             sourceScopeId: opts?.sourceScopeId,
             exact: opts?.exact,
             loadStamp: opts?.loadStamp,
             markCopy: opts?.markCopy !== undefined,
+            provisionedFor: opts?.tenantId,
         };
-        // Both refusals come back as values (a throw over the RPC carries only its message) and are
+        // The refusals come back as values (a throw over the RPC carries only its message) and are
         // thrown here, in the vertical's own isolate, so its route answers 409 or 412, not a fault.
         const out = await this.scopeStub(scopeId).importDumpChecked(tables, scopeId, {
             ...load,
@@ -789,6 +874,8 @@ export class CloudflareScopeHost {
         }
         if (out.refused === 'kept')
             throw substratError('conflict', KEPT_COPY_REFUSAL);
+        if (out.refused === 'tenant')
+            throw substratError('conflict', out.message);
         // A retry of a load that already committed (its answer was lost on the way back) is
         // refused by the marker that load itself moved. The store holding THIS request's stamp
         // says so: no other load writes it. Answered as applied, without `switchedOff`, so the
@@ -855,9 +942,16 @@ export class CloudflareScopeHost {
      * the vertical's `/internal/lifecycle`. Kept unless the scope already holds a newer one, so a
      * push that arrives late cannot undo a later transition. `applied` is what the platform's heal
      * sweep records as delivered; `changed` says the gate's answer moved.
+     *
+     * #2016: `tenantId`, the tenant the directory delivered it for (absent from an older platform).
+     * A scope provisioned for another tenant refuses the delivery (`conflict`) and stores nothing;
+     * a scope provisioned before the tenant receipt existed records it here, its role rows agreeing.
      */
-    async setLifecycleLocal(scopeId, next) {
-        return lifecycleDelivery.parse(await this.scopeStub(scopeId).setLifecycle(scopeLifecycle.parse(next)));
+    async setLifecycleLocal(scopeId, next, tenantId) {
+        const out = await this.scopeStub(scopeId).setLifecycle(scopeLifecycle.parse(next), tenantId);
+        if ('refused' in out)
+            throw substratError('conflict', out.message);
+        return lifecycleDelivery.parse(out);
     }
     /**
      * Mark one scope in THIS deployment a copy (#2005), behind the vertical's `/internal/mark-copy`:
@@ -1145,8 +1239,15 @@ export class CloudflareScopeHost {
         // after it then finds them off, and audits what the unit moved.
         const ownStore = this.cpLess || record.vertical === null;
         const recordedOff = ownStore ? await this.cp.switchedOffModulesOf(input.tenantId, input.scopeId) : [];
+        const seatAt = new Date().toISOString();
         const switchedOff = await this.scopeStub(input.scopeId).seatTuples(seats, recordedOff.length
-            ? { scopeId: input.scopeId, moduleIds: recordedOff, at: new Date().toISOString() }
+            ? {
+                scopeId: input.scopeId,
+                moduleIds: recordedOff,
+                at: seatAt,
+                // #1823: a recorded-off module held only by a tenant grant goes back off too.
+                tenantHeld: await this.cp.tenantHeldSystemModules(input.tenantId, recordedOff, seatAt),
+            }
             : undefined);
         if (ownStore) {
             await this.admin.reassertSystemSwitches(actor, { tenantId: input.tenantId, scopeId: input.scopeId }, { appliedInUnit: switchedOff });
@@ -1292,15 +1393,15 @@ export class CloudflareScopeHost {
         return this.buildAttachmentSurface({ principal }, tenantId, scopeId, store);
     }
     async getSystemAttachments(moduleId, tenantId, scopeId) {
-        // Reuse the system invoke door's module, tenant and lifecycle gate. The DO
-        // authorizes each open against the attachment target's read permission as
+        // Reuse the system invoke door's module, tenant and lifecycle gate, and its rewind gate
+        // (#1834). The DO authorizes each open against the attachment target's read permission as
         // system:<moduleId>; the worker reads bytes only after that gate succeeds.
-        await this.getSystemScope(moduleId, tenantId, scopeId);
+        const door = await this.openSystemDoor(moduleId, tenantId, scopeId);
         const store = await this.resolveAttachmentStore(tenantId);
         const stub = this.scopeStub(scopeId);
         return {
             open: async (attachmentId) => {
-                const record = await stub.systemAttachmentAuthorize(attachmentId, moduleId, tenantId, scopeId);
+                const record = await door.through((instance) => stub.systemAttachmentAuthorize(attachmentId, moduleId, tenantId, scopeId, instance));
                 return record ? this.openAttachmentBytes(store, scopeId, record) : null;
             },
         };
@@ -1506,8 +1607,16 @@ export class CloudflareScopeHost {
         // restored in its deployment, which the platform carries the same list to.
         const ownStore = this.cpLess || existing.vertical === null;
         const recordedOff = ownStore ? await this.cp.switchedOffModulesOf(tenantId, scopeId) : [];
+        const replayAt = new Date().toISOString();
         const switchedOff = await this.scopeStub(scopeId).importDump(dump.tables, scopeId, {
-            switchOff: recordedOff.length ? { moduleIds: recordedOff, at: new Date().toISOString() } : undefined,
+            switchOff: recordedOff.length
+                ? {
+                    moduleIds: recordedOff,
+                    at: replayAt,
+                    // #1823: a recorded-off module held only by a tenant grant goes back off too.
+                    tenantHeld: await this.cp.tenantHeldSystemModules(tenantId, recordedOff, replayAt),
+                }
+                : undefined,
             sourceScopeId: opts?.sourceScopeId ?? dump.scopeId,
         });
         await this.recordAdmin(actor, 'restoreScope', { tenantId, scopeId }, null, { sourceScopeId: dump.scopeId, tables: dump.tables.length, capturedAt: dump.capturedAt });
@@ -1685,12 +1794,93 @@ export class CloudflareScopeHost {
      * against `system:<moduleId>` grants inside the stub.
      */
     async getSystemScope(moduleId, tenantId, scopeId) {
+        return this.buildStub(tenantId, scopeId, undefined, undefined, await this.openSystemDoor(moduleId, tenantId, scopeId));
+    }
+    /**
+     * #1834: the system door — the ONE place every entry acting as `system:<moduleId>` passes
+     * through: a schedule's fire, a job run's `pass.scope()`, a module's attachment open. The
+     * module must be registered here and the scope live, as before. Then the door GATES: the
+     * scope's own state read for the module, and after it the rewind hold (#1819), in the order
+     * `SWITCH_HOLD_SETTLE_MS` relies on. A module the hold keeps off is refused here, as a
+     * schedule pass skips it.
+     *
+     * A gate read is about the instance that answered it, and a door can be held for as long as
+     * a job pass runs. So every call through the door is PINNED to that instance: the DO refuses
+     * one that lands on another (`SYSTEM_DOOR_MOVED`), since a PITR restore always restarts the
+     * object, and the door gates again and retries. A restart within one call's round trip is
+     * rare, so past `SYSTEM_DOOR_REGATES` it fails closed (`unavailable`). No clock is involved:
+     * the gate and the call meet the same storage, or the call does not run.
+     */
+    async openSystemDoor(moduleId, tenantId, scopeId, gated, 
+    /** #1834: the job pass this door is opened for; its "not now" refusals are tied to it. */
+    pass) {
         if (!this.moduleIds.has(moduleId)) {
             throw new Error(`module not registered on this host: ${moduleId}`);
         }
         await this.assertLive(tenantId, scopeId);
         await this.migrateAndRecord(scopeId);
-        return this.buildStub(tenantId, scopeId, undefined, undefined, moduleId);
+        // A gate this door reads itself reports a hold it could not read; one handed in was the
+        // caller's to report (`runDueSchedules` puts it on its pass report).
+        const regate = async () => {
+            const fresh = await this.systemDoorGate(scopeId, moduleId);
+            if (fresh.error)
+                console.error(`substrat: system door ${moduleId} on ${scopeId}: ${fresh.error}`);
+            return fresh;
+        };
+        let gate = gated ?? (await regate());
+        return {
+            moduleId,
+            through: async (call) => {
+                for (let regates = 0;; regates += 1) {
+                    if (gate.held) {
+                        // The hold ends when the switch is applied again: a job run waits it out without
+                        // spending its retries, because the driver defers on THIS refusal (`doorWait`).
+                        throw this.doorWait(pass, substratError('forbidden', `module '${moduleId}' is held off on this scope: it was rewound to before its schedule ` +
+                            'switch was turned off, and it stays off until the switch is applied again', { reason: SYSTEM_DOOR_WAIT }));
+                    }
+                    const answer = await call(gate.instance);
+                    if (!isSystemDoorMoved(answer))
+                        return answer;
+                    if (regates >= SYSTEM_DOOR_REGATES) {
+                        throw this.doorWait(pass, substratError('unavailable', `the scope kept restarting under the system door of module '${moduleId}' ` +
+                            `(${regates + 1} attempts); nothing ran. Retry later`, { reason: SYSTEM_DOOR_WAIT }));
+                    }
+                    gate = await regate();
+                }
+            },
+        };
+    }
+    /**
+     * #1834: the refusals this host's system door threw that mean "not now" (a hold, a scope that
+     * kept restarting), each tied by identity to the job pass whose door threw it. The job driver
+     * defers a pass only on one of these, never on an error's shape, which any step or operation
+     * could copy. A mark is ORIGIN and FRESHNESS together: it is consumed when the driver takes it,
+     * and only the pass it names can take it, so a handler that keeps a refusal and throws it again
+     * on a later pass is an ordinary failure there. Held weakly: an error nobody holds goes.
+     */
+    doorWaits = new WeakMap();
+    /** #1834: mark this door's own refusal as "not now" for the pass it was opened for, and hand it back. */
+    doorWait(pass, err) {
+        if (pass)
+            this.doorWaits.set(err, pass);
+        return err;
+    }
+    /** #1834: is `err` a "not now" this host's door threw on `pass`? Consumes the mark when it is. */
+    takeDoorWait(err, pass) {
+        if (typeof err !== 'object' || err === null || this.doorWaits.get(err) !== pass)
+            return false;
+        this.doorWaits.delete(err);
+        return true;
+    }
+    /**
+     * #1834: the system door's gate — the scope's state read for the module, the instance that
+     * answered it, and then (only for a module the scope has on) the rewind hold (#1819). The
+     * hold is read AFTER the state, which is the order `switchHeld` needs.
+     */
+    async systemDoorGate(scopeId, moduleId) {
+        const { state, instance } = await this.scopeStub(scopeId).systemDoorState(moduleId);
+        const hold = state === 'on' ? await this.switchHeld(scopeId, moduleId) : { held: false };
+        return { state, instance, held: hold.held, ...(hold.error ? { error: hold.error } : {}) };
     }
     /**
      * #1705: the consumer half. The same lifecycle gate as every door (K-3), then the ScopeDO
@@ -1772,7 +1962,7 @@ export class CloudflareScopeHost {
         // provisioning receipt is K-3 here (#1738), read before anything migrates the DO, and the
         // refusal reads as the pure host's does: an unknown scope, not an unknown role.
         if (this.cpLess && !(await this.scopeStub(scopeId).servesTenant(tenantId))) {
-            throw substratError('not_found', `unknown scope for tenant: (${tenantId}, ${scopeId})`);
+            throw unknownScopeForTenant(tenantId, scopeId);
         }
         await this.peerScopeGate(tenantId, scopeId, 'canAssign');
         const bound = await this.scopeStub(scopeId).canAssignFor(tenantId, scopeId, principalId.parse(principal), roleKey);
@@ -1782,7 +1972,7 @@ export class CloudflareScopeHost {
     }
     async assignScopeRoleBounded(tenantId, scopeId, caller, assignee, roleKey) {
         if (this.cpLess && !(await this.scopeStub(scopeId).servesTenant(tenantId))) {
-            throw substratError('not_found', `unknown scope for tenant: (${tenantId}, ${scopeId})`);
+            throw unknownScopeForTenant(tenantId, scopeId);
         }
         await this.peerScopeGate(tenantId, scopeId, 'assignScopeRoleBounded');
         const bound = await this.scopeStub(scopeId).assignScopeRoleBoundedFor(tenantId, scopeId, principalId.parse(caller), principalId.parse(assignee), roleKey);
@@ -1807,7 +1997,7 @@ export class CloudflareScopeHost {
         if (!this.cpLess) {
             const record = await this.cp.getScopeRecord(tenantId, scopeId);
             if (!record) {
-                throw substratError('not_found', `unknown scope for tenant: (${tenantId}, ${scopeId})`);
+                throw unknownScopeForTenant(tenantId, scopeId);
             }
             this.assertServedHere(record, scopeId, verb);
         }
@@ -1875,7 +2065,7 @@ export class CloudflareScopeHost {
     async capabilityScopeStub(tenantId, scopeId, verb) {
         const rec = await this.cp.getScopeRecord(tenantId, scopeId);
         if (!rec)
-            throw substratError('not_found', `unknown scope for tenant: (${tenantId}, ${scopeId})`);
+            throw unknownScopeForTenant(tenantId, scopeId);
         if (this.servesScopesElsewhereNow && rec.vertical !== null) {
             throw substratError('unavailable', `${verb} cannot reach scope ${scopeId}: it is served by the '${rec.vertical}' ` +
                 'deployment, and platform capability verbs are not delegated there yet');
@@ -1921,7 +2111,9 @@ export class CloudflareScopeHost {
             if (!rec || rec.status !== 'active')
                 return report;
         }
-        else if (await this.lifecycleHeld(scopeId)) {
+        else if (lifecycleRefusal(await this.validateScopeAccess(tenantId, scopeId)) !== null) {
+            // #2016: the pair is held to the scope's own record first, so a sweep roster entry whose
+            // tenant disagrees with the scope is refused before the probe reads or writes anything.
             // #1713: a held scope emits nothing, so judging it stale would only raise a false alarm.
             return report;
         }
@@ -1963,13 +2155,15 @@ export class CloudflareScopeHost {
             return report;
         // Only run on a live scope of this tenant; a scope archived between the sweep's
         // enumeration and here simply has nothing due. A CP-less host has no directory
-        // to ask (#461), so it reads the lifecycle the platform delivered to the scope (#1713).
+        // to ask (#461), so it reads the lifecycle the platform delivered to the scope (#1713), in
+        // the same call that holds the pair to the scope's own record (#2016): a roster entry whose
+        // tenant disagrees is refused before a grant, a cadence row or a run is read or written.
         if (!this.cpLess) {
             const rec = await this.cp.getScopeRecord(tenantId, scopeId);
             if (!rec || rec.status !== 'active')
                 return report;
         }
-        else if (await this.lifecycleHeld(scopeId)) {
+        else if (lifecycleRefusal(await this.validateScopeAccess(tenantId, scopeId)) !== null) {
             // #1713: the lifecycle the platform delivered holds the scope. Every schedule is
             // `skipped` and no cadence row moves, as under the kill switch, so a schedule that
             // came due meanwhile fires once on the first pass after the scope is live again.
@@ -1986,15 +2180,15 @@ export class CloudflareScopeHost {
         // never held the module's grant (a foreign vertical's) is a quiet no-op, exactly as
         // before. A scope switched OFF reports every schedule `skipped`, never `failed`, and
         // does not touch its cadence rows — so a restore fires a due schedule on the next pass.
-        const state = await stub.systemScheduleState(moduleId);
-        if (state === 'ungranted')
+        // #1819: a scope rewound to before its switch was pulled answers `on`, and the rewind held
+        // the module outside the scope. Both are read by the system door's own gate (#1834), which
+        // every fire below then goes through, pinned to the instance this read came from.
+        const gate = await this.systemDoorGate(scopeId, moduleId);
+        if (gate.state === 'ungranted')
             return report;
-        // #1819: a scope rewound to before its switch was pulled answers `on`. The rewind held the
-        // module outside the scope; read AFTER the state, which is the order `switchHeld` needs.
-        const hold = state === 'on' ? await this.switchHeld(scopeId, moduleId) : { held: false };
-        if (hold.error)
-            report.errors.push({ operation: 'switch-hold', error: hold.error });
-        if (state === 'off' || hold.held) {
+        if (gate.error)
+            report.errors.push({ operation: 'switch-hold', error: gate.error });
+        if (gate.state === 'off' || gate.held) {
             for (const schedule of schedules) {
                 report.skipped += 1;
                 report.runs.push({ operation: schedule.operation, outcome: 'skipped' });
@@ -2004,6 +2198,7 @@ export class CloudflareScopeHost {
         }
         const now = Date.now();
         const lines = asyncLinePass();
+        let door;
         for (const schedule of schedules) {
             const last = await stub.scheduleLastRun(schedule.operation);
             const lastRun = last ? Date.parse(last) : null;
@@ -2023,7 +2218,10 @@ export class CloudflareScopeHost {
             let emitted;
             let failure;
             try {
-                const scope = await this.getSystemScope(moduleId, tenantId, scopeId);
+                // The gate above already answered for this pass; a fire that meets a restarted scope
+                // is gated again by the door (#1834).
+                door ??= await this.openSystemDoor(moduleId, tenantId, scopeId, gate);
+                const scope = this.buildStub(tenantId, scopeId, undefined, undefined, door);
                 await scope.invoke(schedule.operation, schedule.input, { invocationId, onEmitted: (r) => (emitted = r) });
                 report.fired += 1;
             }
@@ -2058,7 +2256,12 @@ export class CloudflareScopeHost {
         return report;
     }
     /** The stub body, shared by the principal, connection, system and impersonation doors. */
-    buildStub(tenantId, scopeId, principal, connectionId, systemModuleId, options, 
+    buildStub(tenantId, scopeId, principal, connectionId, 
+    /**
+     * #1834: the system door this stub acts through. The ONLY way to make a stub acting as
+     * `system:<moduleId>`: the module is the door's, and every invoke is gated and pinned by it.
+     */
+    systemDoor, options, 
     /**
      * K-42: the session this stub acts under. Re-read from the directory on
      * EVERY invoke rather than captured here — a stub is a capability and
@@ -2079,6 +2282,7 @@ export class CloudflareScopeHost {
      */
     verticalCaller) {
         const stub = this.scopeStub(scopeId);
+        const systemModuleId = systemDoor?.moduleId;
         const cp = this.cp;
         const operationEntitlement = this.operationEntitlement;
         // The DO needs SOME principal-shaped value for `ctx.principal`; for a
@@ -2133,7 +2337,15 @@ export class CloudflareScopeHost {
                 }
                 // K-42: resolved per invoke, so expiry and `endImpersonation` both bite.
                 const session = sessionId === undefined ? undefined : await this.resolveImpersonation(sessionId, tenantId, scopeId);
-                const envelope = await stub.invoke(operation, input, asPrincipalId, tenantId, scopeId, connectionId, requiredKey, systemModuleId, true, invokeOptions, session, capabilitySession, verticalCaller);
+                const send = (systemDoorInstance) => stub.invoke(operation, input, asPrincipalId, tenantId, scopeId, connectionId, requiredKey, systemModuleId, true, invokeOptions, session, capabilitySession, verticalCaller, systemDoorInstance);
+                // #1834: through the system door, pinned to the instance its gate read. The DO's
+                // refusal comes back as a failure envelope, so it is rethrown for the door to re-gate.
+                const envelope = systemDoor
+                    ? await systemDoor.through(async (instance) => {
+                        const sent = await send(instance);
+                        return sent.systemDoorMoved === true ? SYSTEM_DOOR_MOVED : sent;
+                    })
+                    : await send();
                 // The operation failed and the DO handed the error back as DATA — so it still
                 // has its code and extensions, which a throw across this boundary would have
                 // stripped down to a message (#113 §3). Rethrown here, where the caller expects
@@ -2182,6 +2394,12 @@ export class CloudflareScopeHost {
                     throw substratError('unavailable', `${operation} ran on a scope host that did not understand peer callers. ` +
                         'Retry once the scope has been migrated');
                 }
+                // #1834, the same shape: a DO too old to know the system door's pin ran the call
+                // without checking it met the storage the door's gate read.
+                if (systemDoor !== undefined && envelope.systemDoor?.honoured !== true) {
+                    throw substratError('unavailable', `${operation} ran on a scope host that did not understand the system door's pin. ` +
+                        'Retry once the scope has been migrated');
+                }
                 if (session !== undefined && envelope.impersonation?.honoured !== true) {
                     throw substratError('unavailable', `${operation} ran on a scope host that did not understand impersonation — the ` +
                         'operation may have run unrecorded and unbounded. Retry once the scope has ' +
@@ -2414,7 +2632,7 @@ export class CloudflareScopeHost {
             if (!this.cpLess) {
                 const rec = await this.cp.getScopeRecord(tenantId, scopeId);
                 if (!rec)
-                    throw substratError('not_found', `unknown scope for tenant: (${tenantId}, ${scopeId})`);
+                    throw unknownScopeForTenant(tenantId, scopeId);
                 vertical = rec.vertical;
             }
             const action = to === 'off' ? 'revokeFromPeer' : 'restoreToPeer';
@@ -2484,21 +2702,50 @@ export class CloudflareScopeHost {
             if (!this.cpLess) {
                 const rec = await this.cp.getScopeRecord(tenantId, scopeId);
                 if (!rec)
-                    throw substratError('not_found', `unknown scope for tenant: (${tenantId}, ${scopeId})`);
+                    throw unknownScopeForTenant(tenantId, scopeId);
                 vertical = rec.vertical;
             }
             const delegation = this.cpLess || vertical !== null ? this.systemSwitchDelegation : undefined;
             // #1819: a scope whose store is here was rewound here, so `switchInScope` releases its
             // hold here too. A delegated move releases in the deployment serving the scope.
-            const move = (moduleId, to, at) => delegation
-                ? delegation.switch({ tenantId, scopeId, moduleId, to })
-                : this.switchInScope(scopeId, moduleId, to, at);
-            return { vertical, move };
+            // #1823: a module whose only authority on the scope is a TENANT-level grant has nothing in
+            // the scope's storage for the switch to find, so the directory says whether it is held.
+            // A caller moving several modules reads them in one call and passes each answer in.
+            // An OFF of a tenant-held module is refused, after the far end answers, unless that answer
+            // attests the evaluator that denies a tenant-level grant (`deniesTenantGrants`). A
+            // deployment built before #1823 drops `tenantHeld`, still answers `held: true` (the module's
+            // scope-level grants were there to switch), and keeps authorizing the tenant-level grant —
+            // so its `held` alone would have the platform record a scope off that is not. Every OFF the
+            // platform drives moves through here: an operator's (`switchSystem`, which then puts the
+            // switch back) and a re-assert's, which every carry ends with.
+            const move = async (moduleId, to, at, tenantHeld) => {
+                const held = tenantHeld ?? (await this.cp.tenantHeldSystemModules(tenantId, [moduleId], at)).length > 0;
+                const outcome = await (delegation
+                    ? delegation.switch({ tenantId, scopeId, moduleId, to, tenantHeld: held })
+                    : this.switchInScope(scopeId, moduleId, to, at, held));
+                if (to === 'off' && held && outcome.held && outcome.deniesTenantGrants !== true) {
+                    throw new UnattestedSwitchOff(scopeId, moduleId, outcome);
+                }
+                return outcome;
+            };
+            /**
+             * Is the module switched off on the scope right now? Read from wherever `move` writes — the
+             * deployment's status read or this scope's own — for a move that threw (#1823): the switch
+             * may already have moved before the throw (`switchInScope` moves it, then works the rewind
+             * hold), and then the directory's record must stay.
+             */
+            const isOff = async (moduleId) => {
+                const rows = delegation
+                    ? await delegation.status({ tenantId, scopeId })
+                    : systemScheduleEntry.array().parse(await this.scopeStub(scopeId).systemGrantsStatus());
+                return rows.some((r) => r.moduleId === moduleId && r.schedules === 'off');
+            };
+            return { vertical, move, isOff };
         };
         const switchSystem = async (actor, raw, to) => {
             const input = systemSwitch.parse(raw);
             const { tenantId, scopeId } = input.node;
-            const { vertical, move } = await systemSwitchTarget(tenantId, scopeId);
+            const { vertical, move, isOff } = await systemSwitchTarget(tenantId, scopeId);
             // AUDIT FIRST (#1666 review): the intent row lands before anything moves, and the
             // outcome row after — every attempt, a repeat included. The scope's store and the
             // admin log are separate, so no order makes the pair atomic; this one fails toward
@@ -2509,37 +2756,37 @@ export class CloudflareScopeHost {
             const target = { tenantId, scopeId, vertical };
             const base = { operationId, moduleId: input.moduleId, schedules: to };
             await this.recordAdmin(actor, action, target, null, { ...base, phase: 'intent', reason: input.reason });
-            // The directory's record (#1674): ON before the scope moves, OFF after it held — see
-            // `recordSystemSwitchedOn` for why that order is the safe one.
+            // The directory's record (#1674), written BEFORE the scope moves, both ways, and undone
+            // if the move throws or holds nothing — see `recordSystemSwitchedOn` and (#1823)
+            // `recordSystemSwitchedOff` for why that order is the safe one.
             const at = new Date().toISOString();
             const record = { tenantId, scopeId, moduleId: input.moduleId, actor, reason: input.reason, operationId, at };
             const errorOf = (err) => (err instanceof Error ? err.message : String(err));
-            let prior = null;
-            if (to === 'on') {
-                try {
-                    prior = await this.cp.recordSystemSwitchedOn(record);
-                }
-                catch (err) {
-                    // Nothing has moved: fail the call here, audited, rather than switch a scope on
-                    // whose record still says off (the next reconcile would switch it back off).
-                    await this.recordAdmin(actor, action, target, null, { ...base, phase: 'failed', error: errorOf(err) }).catch(() => undefined);
-                    throw err;
-                }
+            let prior;
+            try {
+                prior = to === 'on' ? await this.cp.recordSystemSwitchedOn(record) : await this.cp.recordSystemSwitchedOff(record);
+            }
+            catch (err) {
+                // Nothing has moved: fail the call here, audited. An ON must not switch a scope on
+                // whose record still says off (the next reconcile would switch it back off), and an
+                // OFF must not leave a scope off that the record does not know of (#1823).
+                await this.recordAdmin(actor, action, target, null, { ...base, phase: 'failed', error: errorOf(err) }).catch(() => undefined);
+                throw err;
             }
             /**
-             * A record write AFTER the scope moved (review #5): retried once, and a failure of both
-             * is answered rather than swallowed — it lands on the outcome row as `recordError`, and
-             * the call does not report plain success. A lost OFF record is exactly what a wipe then
-             * turns into a module running again.
+             * The record's undo, after the scope's move threw or held nothing: retried once, and a
+             * failure of both is answered rather than swallowed — it lands on the outcome row as
+             * `recordError`, and the call says so.
              */
-            const recordWrite = async (write) => {
+            const undoRecord = async () => {
+                const undo = () => this.cp.restoreSystemSwitchRecord(record, prior);
                 try {
-                    await write();
+                    await undo();
                     return null;
                 }
                 catch {
                     try {
-                        await write();
+                        await undo();
                         return null;
                     }
                     catch (err) {
@@ -2552,25 +2799,54 @@ export class CloudflareScopeHost {
                 outcome = await move(input.moduleId, to, at);
             }
             catch (err) {
-                const recordError = prior ? await recordWrite(() => this.cp.restoreSystemSwitchRecord(record, prior)) : null;
+                if (err instanceof UnattestedSwitchOff) {
+                    // The far end switched, and cannot hold it against the tenant-level grant. Refused:
+                    // ON gives back exactly what this OFF took (nothing, when it changed nothing), and
+                    // then the record goes back too — neither the scope nor the directory says off. An ON
+                    // that fails here leaves the scope off, and the readback rule below keeps its record.
+                    const putBack = err.outcome.changed
+                        ? await move(input.moduleId, 'on', new Date().toISOString(), true).then(() => true, () => false)
+                        : true;
+                    if (putBack) {
+                        const recordError = await undoRecord();
+                        await this.recordAdmin(actor, action, target, null, {
+                            ...base,
+                            phase: 'refused',
+                            error: err.message,
+                            ...(recordError ? { recordError } : {}),
+                        }).catch(() => undefined);
+                        throw substratError('precondition_failed', `${err.message} Nothing was switched` +
+                            (recordError ? `, but its directory record could not be put back (${recordError}).` : '.'));
+                    }
+                }
+                // A throw does not say the scope did not move: the move crosses the scope's DO and then
+                // the rewind hold, and a throw from the second leaves the scope's switch moved. So the
+                // record is undone only when the scope reads back in the OTHER position — an OFF that
+                // reads not off, an ON that still reads off — and kept when it reads back as asked.
+                // Undoing an ON that landed would put the record back to `off` beside a scope that is
+                // on, and the next re-assert would switch the operator's ON back off. A read that fails
+                // too counts as off, both ways, so what is left fails toward off: an OFF keeps its
+                // record (never a scope switched off with no record — a wipe or restore would have
+                // nothing to re-assert, and #1743's refusal nothing to read), and an ON is undone back
+                // to `off`, which the next re-assert completes if the scope did move.
+                const off = await isOff(input.moduleId).catch(() => true);
+                const recordKept = off === (to === 'off');
+                const recordError = recordKept ? null : await undoRecord();
                 // Best effort: the original error is what the caller must see, and the intent row
                 // already says an attempt was made.
                 await this.recordAdmin(actor, action, target, null, {
                     ...base,
                     phase: 'failed',
                     error: errorOf(err),
+                    ...(recordKept ? { recordKept: true } : {}),
                     ...(recordError ? { recordError } : {}),
                 }).catch(() => undefined);
                 throw err;
             }
-            // OFF is recorded once the scope held it. A refused ON moved nothing, so its record
-            // write is undone: left `on`, the next reconcile of a wiped scope would leave the
-            // module running.
-            const recordError = to === 'off' && outcome.held
-                ? await recordWrite(() => this.cp.recordSystemSwitchedOff(record))
-                : to === 'on' && !outcome.held && prior
-                    ? await recordWrite(() => this.cp.restoreSystemSwitchRecord(record, prior))
-                    : null;
+            // A call that held nothing moved nothing, so its record write is undone: left `off`, it
+            // would switch the module off the day it is installed; left `on`, the next reconcile of
+            // a wiped scope would leave the module running.
+            const recordError = outcome.held ? null : await undoRecord();
             await this.recordAdmin(actor, action, target, null, {
                 ...base,
                 phase: outcome.held ? 'applied' : 'refused',
@@ -2583,11 +2859,6 @@ export class CloudflareScopeHost {
                     `(check the module id: it is the module's manifest id, e.g. '@substrat-run/engine-absence')` +
                     (recordError ? `; and its directory record could not be put back (${recordError})` : ''));
             }
-            if (recordError) {
-                throw substratError('unavailable', `module '${input.moduleId}' is switched ${to} on scope ${scopeId}, but the directory's record of it ` +
-                    `could not be written (${recordError}) — repeat the call to record it; a wipe of this scope would ` +
-                    `otherwise lose the switch`);
-            }
             return {
                 operationId,
                 moduleId: input.moduleId,
@@ -2651,7 +2922,7 @@ export class CloudflareScopeHost {
             if (!this.cpLess) {
                 const rec = await this.cp.getScopeRecord(tenantId, scopeId);
                 if (!rec)
-                    throw substratError('not_found', `unknown scope for tenant: (${tenantId}, ${scopeId})`);
+                    throw unknownScopeForTenant(tenantId, scopeId);
                 vertical = rec.vertical;
             }
             // A hosted scope (a vertical bound, on a non-cpLess host) has no local storage worth
@@ -2738,8 +3009,9 @@ export class CloudflareScopeHost {
                 });
             }
             const results = [];
+            const tenantHeld = new Set(modules.length ? await this.cp.tenantHeldSystemModules(tenantId, modules, at) : []);
             for (const moduleId of modules) {
-                const outcome = await move(moduleId, 'off', at);
+                const outcome = await move(moduleId, 'off', at, tenantHeld.has(moduleId));
                 if (outcome.changed) {
                     await this.recordAdmin(actor, 'reassertSystemSwitch', { tenantId, scopeId, vertical }, null, {
                         operationId: ulid(),
@@ -2769,7 +3041,7 @@ export class CloudflareScopeHost {
             if (!this.cpLess) {
                 const rec = await this.cp.getScopeRecord(tenantId, scopeId);
                 if (!rec)
-                    throw substratError('not_found', `unknown scope for tenant: (${tenantId}, ${scopeId})`);
+                    throw unknownScopeForTenant(tenantId, scopeId);
                 vertical = rec.vertical;
             }
             if (!this.cpLess && vertical !== null && !this.peerSwitchDelegation) {
@@ -2968,6 +3240,13 @@ export class CloudflareScopeHost {
                 await this.recordAccess(actor, 'listSystemSwitches', { tenantId: filter?.tenantId ?? null }, filter ?? null, rows.length);
                 return rows.map((r) => systemSwitchRecord.parse(r));
             },
+            tenantHeldSystemModules: async (actor, tenantId, moduleIds) => {
+                const held = moduleIds.length
+                    ? await this.cp.tenantHeldSystemModules(tenantId, moduleIds, new Date().toISOString())
+                    : [];
+                await this.recordAccess(actor, 'tenantHeldSystemModules', { tenantId }, { moduleIds: [...moduleIds] }, held.length);
+                return held;
+            },
             reassertSystemSwitches: reassertSystemSwitchesOf,
             // #1672 — the platform's two capability verbs. Audited AFTER the write, on both, and
             // the failure each leaves is the safe one: a mint whose audit row did not land never
@@ -4738,14 +5017,35 @@ export class CloudflareScopeHost {
      * The getScope gate (control-plane.md §4.1/§4.2) — the pair check, then the tenant's and
      * the scope's lifecycle — thrown on THIS side of the RPC (#1718). The ControlPlaneDO
      * answers its refusal as data, because an error thrown there arrives here flattened, with
-     * no code; a record crosses intact. A CP-less host's null control plane answers nothing,
-     * so the gate passes: the router already made it from the shared directory.
+     * no code; a record crosses intact.
+     *
+     * A CP-less host's null control plane answers nothing: the router made the pair check from
+     * the shared directory. The scope's own storage then makes it again (#2016), against the
+     * tenant it was provisioned for (`ScopeDO.admission`), so a vertical that passes a scope id
+     * under the wrong tenant meets K-3's refusal at the door instead of relying on the permission
+     * gate's grant data to deny it.
+     *
+     * Answers with the lifecycle the CP-less scope holds (#1713), read in the same DO call as the
+     * pair check, so an `assertLive` door still costs one round-trip; a door that reads the scope
+     * without the lifecycle half pays the one DO call the pair check needs. Null with a directory,
+     * whose refusal already covered the lifecycle.
      */
     async validateScopeAccess(tenantId, scopeId) {
         const refusal = await this.cp.scopeAccessRefusal(tenantId, scopeId);
-        if (!refusal)
-            return;
-        throw refusal.code ? substratError(refusal.code, refusal.message) : new Error(refusal.message);
+        if (refusal)
+            throw refusal.code ? substratError(refusal.code, refusal.message) : new Error(refusal.message);
+        if (!this.cpLess)
+            return null;
+        const { verdict, lifecycle } = await this.scopeStub(scopeId).admission(tenantId);
+        if (verdict === 'foreign')
+            throw unknownScopeForTenant(tenantId, scopeId);
+        // A scope with no tenant record and no role rows has nothing to hold the pair against, so it is
+        // let through — a compatibility state, not a steady one: the next reconcile (every push runs
+        // one against the scopes behind it, #1172) or lifecycle delivery records the directory's tenant.
+        // Logged on every admission, so an operator sees a scope that has not converged.
+        if (verdict === 'unknown')
+            console.warn(JSON.stringify(tenantUnrecordedLine(tenantId, scopeId)));
+        return lifecycle;
     }
     /**
      * THE lifecycle gate (#1713) at every door that runs a scope's work: a request's stubs and
@@ -4763,17 +5063,10 @@ export class CloudflareScopeHost {
      * grants) keep `validateScopeAccess` alone: an operator still reads a suspended scope.
      */
     async assertLive(tenantId, scopeId) {
-        await this.validateScopeAccess(tenantId, scopeId);
-        const refusal = await this.cpLessRefusal(scopeId, { tenantId, scopeId });
+        const refusal = lifecycleRefusal(await this.validateScopeAccess(tenantId, scopeId), { tenantId, scopeId });
         if (refusal)
             throw new Error(refusal);
     }
-    /** The delivered lifecycle's refusal on a CP-less host (#1713); always null with a directory. */
-    async cpLessRefusal(scopeId, ids) {
-        if (!this.cpLess)
-            return null;
-        return lifecycleRefusal(await this.scopeStub(scopeId).lifecycle(), ids);
-    }
     /**
      * Deliver the directory's lifecycle to the deployments serving the matching scopes (#1713):
      * one scope after its transition, a tenant's scopes after the tenant's, or the heal sweep's
@@ -4792,8 +5085,25 @@ export class CloudflareScopeHost {
         if (!delegation || this.cpLess)
             return report;
         let targets;
+        // #2016: the heal also asks the served scopes whose deployment has not answered that it holds a
+        // record of the scope's tenant, a copy as much as a primary (no push reconciles a copy), until
+        // each answers that it does. A bounded slice per pass, after the drift and the holds.
+        const askTenant = new Set();
         try {
             targets = await this.cp.lifecycleTargets(filter);
+            if (filter.drift) {
+                const unrecorded = await this.cp.lifecycleTargets({ unrecorded: true, limit: TENANT_UNRECORDED_PER_PASS });
+                // Noted before asking, so an ask that fails (or a deployment that never answers) rotates
+                // behind the scopes not asked yet, and the next pass reaches them.
+                if (unrecorded.length > 0)
+                    await this.cp.recordTenantAsks(unrecorded.map((u) => u.scope_id), new Date().toISOString());
+                const seen = new Set(targets.map((t) => t.scope_id));
+                for (const u of unrecorded) {
+                    askTenant.add(u.scope_id);
+                    if (!seen.has(u.scope_id))
+                        targets.push(u);
+                }
+            }
         }
         catch (err) {
             console.error('substrat: could not read the scopes to deliver a lifecycle to (#1713)', err);
@@ -4815,8 +5125,10 @@ export class CloudflareScopeHost {
             // no lifecycle runs live. That keeps an activation, and every transition before a
             // deployment carries the route, from posting a delivery that changes nothing. After a
             // restore (epoch > 0) no receipt says nothing about what the deployment holds, so it is
-            // delivered. A HOLD is always delivered.
-            if (lifecycleRefusal(lifecycle) === null && (t.delivered === null ? t.epoch === 0 : t.delivered === lifecycleReceipt(lifecycle))) {
+            // delivered. A HOLD is always delivered, and so is a scope the heal asks for its tenant record.
+            if (!askTenant.has(scopeId) &&
+                lifecycleRefusal(lifecycle) === null &&
+                (t.delivered === null ? t.epoch === 0 : t.delivered === lifecycleReceipt(lifecycle))) {
                 continue;
             }
             report.attempted += 1;
@@ -4874,7 +5186,7 @@ export class CloudflareScopeHost {
                     }
                 }
                 // The receipt is what the scope HOLDS: a newer delivery it kept instead is the truth.
-                await this.cp.recordLifecycleReceipt(scopeId, lifecycleReceipt(answer.lifecycle), new Date().toISOString());
+                await this.cp.recordLifecycleReceipt(scopeId, lifecycleReceipt(answer.lifecycle), new Date().toISOString(), answer.tenantRecorded === true);
                 report.delivered += 1;
             }
             catch (err) {
@@ -4923,7 +5235,7 @@ export class CloudflareScopeHost {
      * points ask the directory themselves.
      */
     async lifecycleHeld(scopeId) {
-        return (await this.cpLessRefusal(scopeId)) !== null;
+        return this.cpLess && lifecycleRefusal(await this.scopeStub(scopeId).lifecycle()) !== null;
     }
     /**
      * K-3's cross-check on its own: the (tenant, scope) pair must exist and agree before a
@@ -4933,7 +5245,7 @@ export class CloudflareScopeHost {
     async assertScope(tenantId, scopeId) {
         const rec = await this.cp.getScopeRecord(tenantId, scopeId);
         if (!rec)
-            throw substratError('not_found', `unknown scope for tenant: (${tenantId}, ${scopeId})`);
+            throw unknownScopeForTenant(tenantId, scopeId);
     }
     /**
      * The same K-3 cross-check, for a read that then opens the scope's STORAGE — every
@@ -4948,7 +5260,7 @@ export class CloudflareScopeHost {
     async scopeRecordForRead(tenantId, scopeId) {
         const row = await this.cp.getScopeRecord(tenantId, scopeId);
         if (!row)
-            throw substratError('not_found', `unknown scope for tenant: (${tenantId}, ${scopeId})`);
+            throw unknownScopeForTenant(tenantId, scopeId);
         if (row.status === 'reaped') {
             throw new Error(`scope ${scopeId} is reaped — its storage is gone and cannot be read`);
         }
@@ -5229,7 +5541,7 @@ export class CloudflareScopeHost {
      * its claims before the OFF's join lands. The joined row then holds the module the operator just
      * turned ON, until the next surviving move of that switch releases it (another ON does).
      */
-    async switchInScope(scopeId, moduleId, to, at) {
+    async switchInScope(scopeId, moduleId, to, at, tenantHeld = false) {
         let scopeClaims;
         let readError;
         try {
@@ -5238,7 +5550,7 @@ export class CloudflareScopeHost {
         catch (err) {
             readError = err;
         }
-        const { instance, ...outcome } = await this.scopeStub(scopeId).switchSystemSchedules(moduleId, scopeId, to, at);
+        const { instance, ...outcome } = await this.scopeStub(scopeId).switchSystemSchedules(moduleId, scopeId, to, at, tenantHeld);
         if (!scopeClaims)
             throw readError;
         const now = Date.now();
@@ -5538,7 +5850,7 @@ export class CloudflareScopeHost {
         // good. Read first, so a pair the directory does not hold writes nothing.
         const scope = await this.cp.getScopeRecord(tenantId, scopeId);
         if (!scope)
-            throw substratError('not_found', `unknown scope for tenant: (${tenantId}, ${scopeId})`);
+            throw unknownScopeForTenant(tenantId, scopeId);
         const { roles, tuples, entitlements, identities } = await this.tenantProjection(tenantId);
         const connectionKeys = await this.connectionKeyRows(tenantId, scope.vertical);
         await this.scopeStub(scopeId).applyProjection(tenantId, roles, tuples, entitlements, undefined, identities, connectionKeys);
@@ -5716,7 +6028,7 @@ export class CloudflareScopeHost {
         // #1742: the recorded-off modules, switched off after the seat in the same unit, on the
         // scope this call provisions — the one the seat's tuples name.
         input.switchedOff
-            ? { scopeId: input.scopeId, moduleIds: input.switchedOff, at: new Date().toISOString() }
+            ? { scopeId: input.scopeId, moduleIds: input.switchedOff, at: new Date().toISOString(), tenantHeld: input.tenantHeld }
             : undefined, services?.map((id) => `principal:${id}`));
         return input.switchedOff ? { switchedOff } : {};
     }
@@ -5865,11 +6177,11 @@ export class CloudflareScopeHost {
      * admin log and writes the row once this returns. `held: false` is an answer, not a
      * throw — see `systemSwitchOutcome`.
      */
-    async systemSwitchLocal(scopeId, moduleId, to) {
+    async systemSwitchLocal(scopeId, moduleId, to, opts) {
         // Parsed on the way out: this is the wire answer the platform reads, and the DO's
         // plain strings become the published shape here rather than on trust.
         // #1819: `switchInScope` releases a rewind's hold on the module once the switch lands.
-        return systemSwitchOutcome.parse(await this.switchInScope(scopeId, moduleId, to, new Date().toISOString()));
+        return systemSwitchOutcome.parse(await this.switchInScope(scopeId, moduleId, to, new Date().toISOString(), opts?.tenantHeld ?? false));
     }
     /**
      * The far end of the status read for a scope served HERE (#1674): `/internal/system-grants`
@@ -5970,7 +6282,7 @@ export class CloudflareScopeHost {
         }
         const rec = await this.cp.getScopeRecord(tenantId, scopeId);
         if (!rec)
-            throw substratError('not_found', `unknown scope for tenant: (${tenantId}, ${scopeId})`);
+            throw unknownScopeForTenant(tenantId, scopeId);
         const source = await importCursorSourceOf((t, v) => this.admin.resolveVerticalInstance(t, v), { tenantId, scopeId, vertical: rec.vertical }, move.from);
         // Where the write lands is the peer switch's rule: a scope bound to a vertical is served by
         // that vertical's deployment, and its watermark lives there. Without a delegation that