@substrat-run/adapter-cloudflare 0.136.0 → 0.137.0

package/dist/scope-do.d.ts

@@ -32,6 +32,8 @@ export interface ScopeDoEnv {
      */
     SUBSTRAT_VERSION_ID?: string;
 }
+/** #2016: how a tenant reads against a scope's record (`ScopeDO.tenantVerdict`). */
+export type TenantVerdict = 'recorded' | 'inferred' | 'foreign' | 'unknown';
 /**
  * What a capability attachment verb (#1686) answers: its value, or its failure as DATA —
  * `invoke`'s envelope discipline, since a throw across the RPC keeps only its message.

package/dist/scope-do.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"scope-do.d.ts","sourceRoot":"","sources":["../src/scope-do.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAC;AACnD,OAAO,EAcL,KAAK,WAAW,EAyCjB,MAAM,yBAAyB,CAAC;AACjC,OAAO,EAuCL,KAAK,SAAS,EAsBd,KAAK,kBAAkB,EAEvB,KAAK,gBAAgB,EA+EtB,MAAM,sBAAsB,CAAC;AAgG9B;;;;;;;;;;;;;GAaG;AAEH,MAAM,WAAW,UAAU;IACzB;;;;;OAKG;IACH,aAAa,CAAC,EAAE,sBAAsB,CAAC;IACvC;;;;;;OAMG;IACH,mBAAmB,CAAC,EAAE,MAAM,CAAC;CAC9B;AAokBD;;;GAGG;AACH,MAAM,MAAM,yBAAyB,CAAC,CAAC,IAAI;IAAE,KAAK,EAAE,CAAC,CAAC;IAAC,OAAO,CAAC,EAAE,SAAS,CAAA;CAAE,GAAG;IAAE,OAAO,EAAE,WAAW,CAAA;CAAE,CAAC;AAgDxG;;;;GAIG;AACH,wBAAgB,aAAa,CAAC,GAAG,EAAE,UAAU,GAAG,SAAS,CAOxD;AAED,wBAAgB,kBAAkB,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,EAAE,CAwDxD;AAED,wBAAgB,aAAa,CAC3B,OAAO,EAAE,kBAAkB,EAAE,EAC7B,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,gBAAgB,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC,GACxD,KAAK,GAAG,EAAE,kBAAkB,EAAE,GAAG,EAAE,UAAU,KAAK,aAAa,CAwoLjE"}
+{"version":3,"file":"scope-do.d.ts","sourceRoot":"","sources":["../src/scope-do.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAC;AACnD,OAAO,EAcL,KAAK,WAAW,EAyCjB,MAAM,yBAAyB,CAAC;AACjC,OAAO,EAuCL,KAAK,SAAS,EAsBd,KAAK,kBAAkB,EAEvB,KAAK,gBAAgB,EAsFtB,MAAM,sBAAsB,CAAC;AAgG9B;;;;;;;;;;;;;GAaG;AAEH,MAAM,WAAW,UAAU;IACzB;;;;;OAKG;IACH,aAAa,CAAC,EAAE,sBAAsB,CAAC;IACvC;;;;;;OAMG;IACH,mBAAmB,CAAC,EAAE,MAAM,CAAC;CAC9B;AAwED,oFAAoF;AACpF,MAAM,MAAM,aAAa,GAAG,UAAU,GAAG,UAAU,GAAG,SAAS,GAAG,SAAS,CAAC;AAqhB5E;;;GAGG;AACH,MAAM,MAAM,yBAAyB,CAAC,CAAC,IAAI;IAAE,KAAK,EAAE,CAAC,CAAC;IAAC,OAAO,CAAC,EAAE,SAAS,CAAA;CAAE,GAAG;IAAE,OAAO,EAAE,WAAW,CAAA;CAAE,CAAC;AAgDxG;;;;GAIG;AACH,wBAAgB,aAAa,CAAC,GAAG,EAAE,UAAU,GAAG,SAAS,CAOxD;AAED,wBAAgB,kBAAkB,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,EAAE,CAwDxD;AAkBD,wBAAgB,aAAa,CAC3B,OAAO,EAAE,kBAAkB,EAAE,EAC7B,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,gBAAgB,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC,GACxD,KAAK,GAAG,EAAE,kBAAkB,EAAE,GAAG,EAAE,UAAU,KAAK,aAAa,CAs2LjE"}

package/dist/scope-do.js

@@ -1,7 +1,8 @@
 import { REWIND_REFUSED } from './rewind-refusal.js';
+import { SYSTEM_DOOR_MOVED } from './system-door.js';
 import { DurableObject } from 'cloudflare:workers';
 import { ATTACHMENT_ADDED, ATTACHMENT_REMOVED, attachmentRecord, domainEvent, domainEventInput, eventId, instant, objectRef, entityObjectRef, assertModuleEmittableType, assertKernelAuthoredType, toWireFailure, grantRefFromProof, principalId, scopeId as scopeIdOf, tenantId as tenantIdOf, platformRequestInput, platformRequestId, MAX_PENDING_PLATFORM_REQUESTS, MAX_PENDING_SWEEP_RUNS, SWEEP_RUNS_KIND, SCOPE_TABLE_PAGE_MAX, SCOPE_QUERY_ROW_MAX, listLimitOf, requestFingerprint, substratError, errorCodeOf, assertReplayableDump, REDRAIN_BATCH, } from '@substrat-run/contracts';
-import { ulid, DO_SQL_LIMITS, unknownRoleError, createUlid, assertAllowed, ConnectionSealingKeyUnavailableError, noSealingKeyMessage, sealTo, assertReadOnlyQuery, entitlementDenial, platformRequestHistoryQuery, platformRequestOf, PLATFORM_REQUEST_COLUMNS, PLATFORM_REQUEST_REDACTION_SQL, platformRequestRedactionParams, platformRequestRedactionQuery, intentPayloadCarriesSubject, redactSubjectJobRuns, redactSubjectScopeText, assertRowLimit, assertRowOffset, JOB_RUN_PATCH_SQL, JOB_STEP_RECORD_SQL, DELIVERY_ERROR_REDACTION_SQL, REDACTED_DELIVERY_NOTE, seatScopeTuple, effectiveRoleGrantQuery, switchRecordedOff, switchSystemSchedules, peerGrantsStatus, systemGrantsStatus, systemScheduleState, systemSwitchedOff, denialListQuery, refusalListQuery, mapRefusalRow, denialSummaryQuery, denialTotalsQuery, DENIAL_WINDOW_QUERY, mapDenialRow, mapDenialSummaryBuckets, PermissionDenied, assertImpersonationWrites, assertModuleEnqueueableKind, impersonationStampOf, createAtomic, NotSearchable, isSearchIndexTable, searchIndexDdl, searchIndexPlans, NotListable, listIndexPlans, moduleMigrations, listQuery, cursorOf, searchLimit, searchMatchExpression, searchQuery, ATTACHMENT_TEXT_DDL, attachmentRecordOfRow, enqueueAttachmentText, reconcileAttachmentText, recordAttachmentText, searchAttachments, IDEMPOTENCY_DDL, REFUSALS_DDL, refusalInsert, refusedTransitionOf, assertIdempotencyKey, assertPermissionKey, idempotencyLookupQuery, idempotencyPruneStatement, idempotencyRecordStatement, idempotencyOptedOutMessage, replayFor, entityVersionQuery, entityVersionOf, assertIfMatch, OUTBOX_ENTITY_INDEX, SCHEDULE_STATE_DDL, SCHEDULE_STATE_REBUILD, scheduleStateHasKind, VERTICAL_EVENTS_DDL, EXPORT_HOPS_SQL, IMPORT_CURSORS_SQL, IMPORT_CURSOR_OF_SQL, OUTBOX_MARK_SQL, exportedSinceQuery, emittedSinceQuery, emittedReportOf, EMITTED_REPORT_CAP, IMPORT_CURSOR_ADVANCE_SQL, IMPORT_RECORD_SQL, moveImportCursor, CrossVerticalRegistry, exportReadPlan, exportReadQuery, planExportBatch, withheldNote, JOB_RUN_DDL, jobRunListLimit, } from '@substrat-run/kernel';
+import { ulid, DO_SQL_LIMITS, unknownRoleError, createUlid, assertAllowed, ConnectionSealingKeyUnavailableError, noSealingKeyMessage, sealTo, assertReadOnlyQuery, entitlementDenial, platformRequestHistoryQuery, platformRequestOf, PLATFORM_REQUEST_COLUMNS, PLATFORM_REQUEST_REDACTION_SQL, platformRequestRedactionParams, platformRequestRedactionQuery, intentPayloadCarriesSubject, redactSubjectJobRuns, redactSubjectScopeText, assertRowLimit, assertRowOffset, JOB_RUN_PATCH_SQL, JOB_STEP_RECORD_SQL, DELIVERY_ERROR_REDACTION_SQL, REDACTED_DELIVERY_NOTE, seatScopeTuple, effectiveRoleGrantQuery, switchRecordedOff, switchSystemSchedules, peerGrantsStatus, systemGrantsStatus, systemScheduleState, systemSwitchedOff, denialListQuery, refusalListQuery, mapRefusalRow, denialSummaryQuery, denialTotalsQuery, DENIAL_WINDOW_QUERY, mapDenialRow, mapDenialSummaryBuckets, PermissionDenied, assertImpersonationWrites, assertModuleEnqueueableKind, impersonationStampOf, createAtomic, NotSearchable, isSearchIndexTable, searchIndexDdl, searchIndexPlans, NotListable, listIndexPlans, moduleMigrations, listQuery, cursorOf, searchLimit, searchMatchExpression, searchQuery, ATTACHMENT_TEXT_DDL, attachmentRecordOfRow, enqueueAttachmentText, reconcileAttachmentText, recordAttachmentText, searchAttachments, IDEMPOTENCY_DDL, REFUSALS_TABLE_DDL, REFUSALS_INDEX, refusalInsert, refusalOf, markGuardRefusal, REFUSALS_REBUILD, refusalsAdmitGuards, assertIdempotencyKey, assertPermissionKey, idempotencyLookupQuery, idempotencyPruneStatement, idempotencyRecordStatement, idempotencyOptedOutMessage, replayFor, entityVersionQuery, entityVersionOf, assertIfMatch, OUTBOX_ENTITY_INDEX, SCHEDULE_STATE_DDL, SCHEDULE_STATE_REBUILD, scheduleStateHasKind, VERTICAL_EVENTS_DDL, EXPORT_HOPS_SQL, IMPORT_CURSORS_SQL, IMPORT_CURSOR_OF_SQL, OUTBOX_MARK_SQL, exportedSinceQuery, emittedSinceQuery, emittedReportOf, EMITTED_REPORT_CAP, IMPORT_CURSOR_ADVANCE_SQL, IMPORT_RECORD_SQL, moveImportCursor, CrossVerticalRegistry, exportReadPlan, exportReadQuery, planExportBatch, withheldNote, JOB_RUN_DDL, JOB_RUN_DUE_AT, jobRunListLimit, SYSTEM_DOOR_WAIT, } from '@substrat-run/kernel';
 import { isUpgradeRequest, readSubscription, LIVE_FANOUT_LIMIT, LIVE_MODE_HEADER, LIVE_PRINCIPAL_HEADER, LIVE_SCOPE_HEADER, LIVE_SUBSCRIBE_PATH, LIVE_TENANT_HEADER, } from './live-reads.js';
 import { OperationQueue } from './serialization.js';
 import { doScopedSql, doBuiltColumnsOf, doRedactionSql, doSpineSql } from './sql.js';
@@ -15,6 +16,21 @@ import { CARRIED_AWAY_KEY, COPY_MARK_CLEARED_KEY, KEPT_COPY_REFUSAL, KEPT_DIVERG
  * without asking the directory.
  */
 const REAPED_MARKER = '_substrat_reaped';
+/**
+ * The `_substrat_meta` key of the tenant a scope was provisioned for (#1738): written by the first
+ * projection, never re-pointed, and what every door's pair check holds a request to (#2016).
+ */
+const PROVISIONED_FOR_KEY = 'provisioned_for';
+/** #2016: the refusal of a write that would re-point a scope's tenant, in one wording. */
+const tenantReceiptRefusal = (held, asked) => `refused: this scope was provisioned for tenant ${held}, not ${asked}`;
+/** #2016: the spine tables whose rows say a scope holds state (`ScopeDO.holdsData`). */
+const HOLDS_DATA_TABLES = ['_substrat_migrations', '_substrat_tuples', '_substrat_outbox', '_substrat_schedule_state'];
+/** #2016: why `tenantId` is foreign to a scope (`held`, the receipt `tenantVerdict` read), in one wording. */
+const foreignTenant = (held, tenantId) => held !== null
+    ? tenantReceiptRefusal(held, tenantId)
+    : `refused: this scope holds role rows for another tenant and none for ${tenantId}`;
+/** #2016: the load refusals `tenantReceiptRefusal` raised, told apart by identity, not by text. */
+const tenantRefusals = new WeakSet();
 /**
  * The scope spine, as this adapter builds it — one of two hand-written copies (#969).
  *
@@ -322,7 +338,8 @@ const KERNEL_DDL = `
   -- #116: the request-dedupe table, kernel-owned so no vertical migrates for it.
   ${IDEMPOTENCY_DDL}
   -- #1745: refused transitions, recorded after the rollback like a denial. Kernel-owned.
-  ${REFUSALS_DDL}
+  ${REFUSALS_TABLE_DDL}
+  ${REFUSALS_INDEX}
   -- #1672: capabilities — authority carried by a secret (a link share), and the sessions
   -- an exchange trades that secret for. Shared with the pure adapter from
   -- @substrat-run/kernel so the two cannot part company; the column comments are there.
@@ -644,6 +661,15 @@ export function splitSqlStatements(sql) {
         out.push(cur.trim());
     return out;
 }
+/**
+ * #1834: the pin missed. Thrown only by `assertSystemDoor`, and module-private, so no operation can
+ * throw one: the two RPCs a door call reaches turn it into the `SystemDoorMoved` ANSWER, by class
+ * identity, and an operation's own error, whatever its text, stays a failure.
+ */
+class SystemDoorMovedError extends Error {
+}
+/** #1834: the brand only `assertSystemDoor` sets, so nothing else can make a `SystemDoorPass`. */
+const SYSTEM_DOOR_PASSED = Symbol('system door passed');
 export function defineScopeDO(modules, bareOps) {
     return class ScopeDO extends DurableObject {
         sql;
@@ -1106,25 +1132,76 @@ export function defineScopeDO(modules, bareOps) {
          * pair check), and a stray role row can no longer make a scope serve a tenant it was never
          * provisioned for.
          *
-         * A scope with NO receipt was provisioned before it existed, or has just been restored (a
-         * dump's receipt is dropped on import: it describes the scope the dump came from). Only
-         * then is the old inference used: `provisionScopeLocal` projected role definitions under
-         * the tenant, so a `_substrat_roles` row for it says the same thing. The next projection
-         * (reconcile, or the restore's repair) writes the receipt, after which the inference is
-         * never consulted again.
+         * A scope with NO receipt was provisioned before it existed (a load never brings the dump's:
+         * it describes the scope the dump came from, and the store keeps its own, #2016). Only then
+         * is the old inference used: `provisionScopeLocal` projected role definitions under the
+         * tenant, so a `_substrat_roles` row for it says the same thing. The next projection
+         * (reconcile, or the restore's repair) or lifecycle delivery writes the receipt, after which
+         * the inference is never consulted again.
          *
          * Read without migrating, so asking about a foreign scope leaves its DO as empty as it found it.
          */
         async servesTenant(tenantId) {
-            const has = (table) => this.sql.exec(`SELECT 1 FROM sqlite_master WHERE type = 'table' AND name = ?`, table).toArray().length > 0;
-            if (has('_substrat_meta')) {
-                const receipt = this.sql.exec(`SELECT value FROM _substrat_meta WHERE key = 'provisioned_for'`).toArray()[0];
-                if (receipt)
-                    return receipt.value === tenantId;
+            const { verdict } = this.tenantVerdict(tenantId);
+            return verdict === 'recorded' || verdict === 'inferred';
+        }
+        /**
+         * #2016: what one door into this scope needs from its storage on a CP-less host, in ONE call —
+         * how `tenantId` reads against the scope (`tenantVerdict`), and the lifecycle the platform
+         * delivered (#1713). The coordinator refuses a foreign pair before any guard, handler or store
+         * lookup runs, and reports an `unknown` one it lets through. Read without migrating, like
+         * `servesTenant`.
+         */
+        admission(tenantId) {
+            return { verdict: this.tenantVerdict(tenantId).verdict, lifecycle: readLifecycle(this.switchSql()) };
+        }
+        /**
+         * #1738 / #2016: this scope's tenant against `tenantId` — the one reading behind the served-here
+         * gate, every door's pair check and the lifecycle delivery's back-fill.
+         *
+         *  - `recorded`: the `provisioned_for` receipt names `tenantId`.
+         *  - `foreign`: the receipt names another tenant, or — on a scope provisioned before receipts
+         *    existed — the scope holds role rows and none of them is `tenantId`'s.
+         *  - `inferred`: no receipt, and a role row for `tenantId` (what `provisionScopeLocal` projected
+         *    before the receipt existed).
+         *  - `unknown`: no receipt and no role rows — never provisioned here, or loaded from a world
+         *    that keeps its roles elsewhere and not yet repaired. Nothing to hold the pair against.
+         *
+         * `held` is the receipt read, so a refusal can name it. Read without migrating, so asking about
+         * a foreign scope leaves its DO as empty as it found it.
+         */
+        tenantVerdict(tenantId) {
+            const held = this.provisionedFor();
+            if (held !== null)
+                return { verdict: held === tenantId ? 'recorded' : 'foreign', held };
+            if (!this.hasTable('_substrat_roles'))
+                return { verdict: 'unknown', held };
+            if (this.sql.exec('SELECT 1 FROM _substrat_roles WHERE tenant_id = ? LIMIT 1', tenantId).toArray().length > 0) {
+                return { verdict: 'inferred', held };
             }
-            if (!has('_substrat_roles'))
-                return false;
-            return this.sql.exec('SELECT 1 FROM _substrat_roles WHERE tenant_id = ? LIMIT 1', tenantId).toArray().length > 0;
+            const anyRole = this.sql.exec('SELECT 1 FROM _substrat_roles LIMIT 1').toArray().length > 0;
+            return { verdict: anyRole ? 'foreign' : 'unknown', held };
+        }
+        /**
+         * #2016: whether a scope with no receipt and no role rows holds state — rather than being a DO
+         * nothing ever provisioned or loaded here. Only such a scope takes its tenant from a lifecycle
+         * delivery: recording one in an empty DO would make `servesTenant` answer for a scope this
+         * deployment does not hold.
+         *
+         * Every provision since #1738 writes the receipt itself (that IS the durable provision marker),
+         * so this only ever judges a scope from before it, or a load from an older platform. A module
+         * with no SQL migrations still leaves spine state, so any of it counts, not migrations alone:
+         * applied migrations, scope tuples (its grants, `system:` ones included), events, schedule state.
+         */
+        holdsData() {
+            return HOLDS_DATA_TABLES.some((table) => this.hasTable(table) && this.sql.exec(`SELECT 1 FROM ${table} LIMIT 1`).toArray().length > 0);
+        }
+        /** #1738: the tenant this scope's `provisioned_for` receipt names, or null; read without migrating. */
+        provisionedFor() {
+            return this.hasTable('_substrat_meta') ? this.metaValue(PROVISIONED_FOR_KEY) : null;
+        }
+        hasTable(name) {
+            return this.sql.exec(`SELECT 1 FROM sqlite_master WHERE type = 'table' AND name = ?`, name).toArray().length > 0;
         }
         /** #1705 PR 2: the outbox's insertion mark (`OUTBOX_MARK_SQL`). */
         outboxMark() {
@@ -1625,21 +1702,33 @@ export function defineScopeDO(modules, bareOps) {
          * `vertical.honoured`: an old DO that ignored this argument would run the call as that
          * placeholder, and the coordinator refuses a success without the acknowledgement.
          */
-        verticalCaller) {
+        verticalCaller, 
+        /**
+         * #1834: set on a system-door call — the instance whose state read the door's gate
+         * consulted the rewind hold against. On any other instance nothing runs and the answer is
+         * `systemDoorMoved` instead, because a PITR restore always restarts this object, so another
+         * instance may be rewound storage the gate never saw. The reply carries `systemDoor.honoured`.
+         */
+        systemDoorInstance) {
             if (!failureEnvelope) {
                 // Legacy path, byte-for-byte what it was: rewrapped so a non-plain error (a
                 // ZodError, whose `message` is a getter) still arrives with its message.
                 try {
-                    return await this.invokeOrThrow(operation, input, principal, tenantId, scopeId, connectionId, requiredEntitlement, systemModuleId, invokeOptions, impersonation, capabilitySession, verticalCaller);
+                    return await this.invokeOrThrow(operation, input, principal, tenantId, scopeId, connectionId, requiredEntitlement, systemModuleId, invokeOptions, impersonation, capabilitySession, verticalCaller, systemDoorInstance);
                 }
                 catch (err) {
+                    if (err instanceof SystemDoorMovedError)
+                        return { result: undefined, platformRequests: 0, ...SYSTEM_DOOR_MOVED };
                     throw toRpcError(err);
                 }
             }
             try {
-                return await this.invokeOrThrow(operation, input, principal, tenantId, scopeId, connectionId, requiredEntitlement, systemModuleId, invokeOptions, impersonation, capabilitySession, verticalCaller);
+                return await this.invokeOrThrow(operation, input, principal, tenantId, scopeId, connectionId, requiredEntitlement, systemModuleId, invokeOptions, impersonation, capabilitySession, verticalCaller, systemDoorInstance);
             }
             catch (err) {
+                // #1834: the pin missed — an answer, never a failure an operation could have produced.
+                if (err instanceof SystemDoorMovedError)
+                    return { result: undefined, platformRequests: 0, ...SYSTEM_DOOR_MOVED };
                 // The ONE place the error keeps its structure: flattened here, rebuilt by the
                 // coordinator. `toRpcError` is not applied — that exists to make a throw
                 // survivable, and this is not a throw.
@@ -1653,7 +1742,9 @@ export function defineScopeDO(modules, bareOps) {
         /** #1672: a capability session's hash. See `invoke` above. */
         capabilitySession, 
         /** #1706: the calling vertical, as the platform named it. See `invoke` above. */
-        verticalCaller) {
+        verticalCaller, 
+        /** #1834: the instance the system door's gate read. See `invoke` above. */
+        systemDoorInstance) {
             await this.ensureMigrations();
             const handler = this.operations.get(operation);
             // `not_found`, not a bare throw (#113): every vertical hand-matched this message
@@ -1736,6 +1827,9 @@ export function defineScopeDO(modules, bareOps) {
                 // one call. Same placement as the SQLite adapter's actor task, for this reason.
                 this.invocationId = invokeOptions?.invocationId ?? null;
                 try {
+                    // #1834: before anything opens. This instance is the storage the call meets, for the
+                    // whole call: a restore restarts the object, so it cannot move under a running body.
+                    const systemDoor = this.assertSystemDoor(systemModuleId, systemDoorInstance);
                     // #1672: the capability session, resolved on EVERY call and here — inside the queued
                     // body, the one region where this call holds the DO to itself — so nothing can
                     // revoke between this read and the transaction. Refuses a stale session, a revoked
@@ -1810,7 +1904,7 @@ export function defineScopeDO(modules, bareOps) {
                     // emitted events back as one — verified across `await` in workerd.
                     try {
                         await this.revision.transaction(async () => {
-                            const ctx = this.operationContext(principal, tenantId, scopeId, undefined, connectionId, systemModuleId, signals, impersonation, operation, capabilityId, minted, undefined, peerSubject);
+                            const ctx = this.operationContext(principal, tenantId, scopeId, undefined, connectionId, systemDoor, signals, impersonation, operation, capabilityId, minted, undefined, peerSubject);
                             // #116: a retry is answered from the recording, and nothing else runs
                             // — not the guards, not the handler, not the permission check inside
                             // it. Keyed by SUBJECT, so a caller only ever reaches its own
@@ -1878,6 +1972,7 @@ export function defineScopeDO(modules, bareOps) {
                                 impersonation: { honoured: true },
                                 ...(capabilitySession !== undefined ? { capability: { honoured: true } } : {}),
                                 ...(verticalCaller !== undefined ? { vertical: { honoured: true } } : {}),
+                                ...(systemDoorInstance !== undefined ? { systemDoor: { honoured: true } } : {}),
                                 ...(idempotencyKey !== undefined
                                     ? { idempotency: { keyHonoured: true, replayed } }
                                     : {}),
@@ -1942,6 +2037,8 @@ export function defineScopeDO(modules, bareOps) {
                         ...(capabilitySession !== undefined ? { capability: { honoured: true } } : {}),
                         // #1706: the same, for the peer door.
                         ...(verticalCaller !== undefined ? { vertical: { honoured: true } } : {}),
+                        // #1834: the same, for the system door's instance pin.
+                        ...(systemDoorInstance !== undefined ? { systemDoor: { honoured: true } } : {}),
                         // The acknowledgement the coordinator's skew check reads (#116), on the
                         // same reasoning as `ifMatchChecked` below and with a sharper failure: a
                         // DO too old to know about keys would EXECUTE THE OPERATION AGAIN and
@@ -2383,8 +2480,19 @@ export function defineScopeDO(modules, bareOps) {
             return record;
         }
         /** Authorize a job's read as its registered module, never as a person. */
-        async systemAttachmentAuthorize(attachmentId, moduleId, tenantId, scopeId) {
+        async systemAttachmentAuthorize(attachmentId, moduleId, tenantId, scopeId, 
+        /** #1834: the instance the system door's gate read; see `invoke`. */
+        systemDoorInstance) {
             await this.ensureMigrations();
+            let systemDoor;
+            try {
+                systemDoor = this.assertSystemDoor(moduleId, systemDoorInstance);
+            }
+            catch (err) {
+                if (err instanceof SystemDoorMovedError)
+                    return SYSTEM_DOOR_MOVED;
+                throw toRpcError(err);
+            }
             if (!this.modules.has(moduleId)) {
                 throw toRpcError(substratError('not_found', `module not registered in this scope: ${moduleId}`));
             }
@@ -2393,7 +2501,7 @@ export function defineScopeDO(modules, bareOps) {
                 return null;
             const gate = this.attachmentGate(record.entity.entityType);
             try {
-                const ctx = this.operationContext(this.systemPrincipal, tenantId, scopeId, undefined, undefined, moduleId, undefined, undefined, 'attachments.open');
+                const ctx = this.operationContext(this.systemPrincipal, tenantId, scopeId, undefined, undefined, systemDoor, undefined, undefined, 'attachments.open');
                 assertAllowed(await ctx.check(gate.read, record.entity));
             }
             catch (err) {
@@ -2585,6 +2693,41 @@ export function defineScopeDO(modules, bareOps) {
         async systemScheduleState(moduleId) {
             return systemScheduleState(this.switchSql(), moduleId, new Date().toISOString());
         }
+        /**
+         * #1834: the system door's state read — `systemScheduleState`, and the instance that
+         * answered it. The door consults the rewind hold after this read and pins every call it
+         * then makes to this instance (`assertSystemDoor`).
+         */
+        async systemDoorState(moduleId) {
+            return { state: await this.systemScheduleState(moduleId), instance: this.instanceId };
+        }
+        /**
+         * #1834: the system door's check on this side, and the ONLY maker of the `SystemDoorPass`
+         * the operation context needs to act as `system:<moduleId>`. A call acting as a module must
+         * carry the instance the host's door gate read (refused without one: no door gated it), and
+         * is refused on any other instance. A PITR restore always restarts this object, so a call
+         * landing on a new instance may meet rewound storage whose module the gate never checked
+         * against the rewind hold. Both are refused before anything opens; the moved one is the
+         * module-private `SystemDoorMovedError`, which the RPC answers as `SystemDoorMoved`, so the door
+         * gates again and retries. No module, no pass.
+         */
+        assertSystemDoor(moduleId, expected) {
+            if (moduleId === undefined)
+                return undefined;
+            // Strict, and deliberately so: no pin means no door gated this call, so it is refused rather
+            // than run unchecked. The one innocent caller is a worker a deploy behind, still running host
+            // code from before the pin, during a rolling deploy. Its refusal is transient: the host and this
+            // object ship in the same bundle, so the window lasts as long as the rollout. Nothing ran, and
+            // the reason says "not now" (`SYSTEM_DOOR_WAIT`) to whoever reads it: a schedule fires on the
+            // next pass, and a job run retries on its next drive.
+            if (expected === undefined) {
+                throw substratError('forbidden', `a call acting as module '${moduleId}' reached this scope without passing the system door`, { reason: SYSTEM_DOOR_WAIT });
+            }
+            if (expected !== this.instanceId) {
+                throw new SystemDoorMovedError("the scope restarted after the system door's gate read it; gate it again");
+            }
+            return { moduleId, [SYSTEM_DOOR_PASSED]: true };
+        }
         /**
          * The pre-#1666 read, kept for ONE reason: a coordinator a deploy behind this DO still
          * calls it. It answers the new question, not the old one — the old predicate counted any
@@ -2614,8 +2757,8 @@ export function defineScopeDO(modules, bareOps) {
          * `switchSystemSchedules`, serialized on the queue with every other tuple write and run
          * as one `transactionSync`, so its reads and writes are one unit.
          */
-        async switchSystemSchedules(moduleId, scopeId, to, at) {
-            const outcome = await this.queue.enqueue(() => this.revision.transactionSync(() => switchSystemSchedules(this.switchSql(), { moduleId, scopeId, to, at })));
+        async switchSystemSchedules(moduleId, scopeId, to, at, tenantHeld = false) {
+            const outcome = await this.queue.enqueue(() => this.revision.transactionSync(() => switchSystemSchedules(this.switchSql(), { moduleId, scopeId, to, at, tenantHeld })));
             // #1819: the instance that applied it, which the rewind hold's release rule reads.
             return { ...outcome, instance: this.instanceId };
         }
@@ -3093,6 +3236,18 @@ export function defineScopeDO(modules, bareOps) {
             ORDER BY id LIMIT ?`, now, afterId ?? null, afterId ?? null, limit)
                 .toArray();
         }
+        /**
+         * #1834: the drive's ONE snapshot of due runs — keys only, in the order they became due
+         * (`JOB_RUN_DUE_AT`, then id). Spelled exactly as the pure adapter spells it. `jobRunsDue`
+         * above stays for a coordinator a deploy behind, which still pages by id.
+         */
+        async jobRunsDueKeys(now, max) {
+            return this.sql
+                .exec(`SELECT id, module_id, job FROM _substrat_job_runs
+            WHERE status = 'running' AND (next_attempt_at IS NULL OR next_attempt_at <= ?)
+            ORDER BY ${JOB_RUN_DUE_AT}, id LIMIT ?`, now, max)
+                .toArray();
+        }
         /** The operator read, newest first. */
         async jobRunList(filter) {
             const where = [];
@@ -3174,7 +3329,15 @@ export function defineScopeDO(modules, bareOps) {
                     throw new Error(`unknown guard predicate: '${guard.predicate}' — declared by ${guard.declaredBy} ` +
                         `before '${operation}'; no registered module contributes it (operation blocked)`);
                 }
-                await predicate.handler(ctx, guard.config, input);
+                try {
+                    await predicate.handler(ctx, guard.config, input);
+                }
+                catch (err) {
+                    // #1745: a guard refusing is recorded after the rollback, as a transition is —
+                    // marked here, where which guard threw is still known. Always rethrown.
+                    markGuardRefusal(err, guard.predicate, operation);
+                    throw err;
+                }
             }
         }
         // -- migrations (port of applyPendingMigrations) --------------------------
@@ -3324,10 +3487,28 @@ export function defineScopeDO(modules, bareOps) {
          * older than the one held. Bookkeeping, like the copy marker: it changes what runs here, not
          * the scope's data, so it does not advance the write revision a carry fences on.
          */
-        setLifecycle(next) {
+        setLifecycle(next, 
+        /** #2016: the tenant the directory delivered this lifecycle for. A scope it is foreign to
+         *  (`tenantVerdict`) refuses the delivery untouched; one provisioned before the receipt
+         *  existed, whose role rows name this tenant, records it — the back-fill. */
+        tenantId) {
+            const { verdict, held } = tenantId === undefined ? { verdict: null, held: null } : this.tenantVerdict(tenantId);
+            if (verdict === 'foreign') {
+                return { refused: 'tenant', message: `lifecycle delivery ${foreignTenant(held, tenantId)}` };
+            }
+            // The back-fill: a scope provisioned before the receipt (its role rows agree), or one whose
+            // tenant nothing recorded although it holds data (a load from a world that keeps its roles
+            // elsewhere). The directory's word records it; a DO never provisioned here records nothing.
+            const backfill = verdict === 'inferred' || (verdict === 'unknown' && this.holdsData());
             let out;
             this.revision.transactionSync(() => {
-                out = this.revision.bookkeeping(() => writeLifecycle(this.switchSql(), next));
+                // A write the carry fences on, not bookkeeping: it happens once per legacy scope, and
+                // over-counting only refuses a restore that could have landed. A carried-away copy takes
+                // no write at all, so it is left to the next projection.
+                if (backfill && !this.carriedAwayCopy) {
+                    this.sql.exec(`INSERT INTO _substrat_meta (key, value) VALUES (?, ?)`, PROVISIONED_FOR_KEY, tenantId);
+                }
+                out = { ...this.revision.bookkeeping(() => writeLifecycle(this.switchSql(), next)), tenantRecorded: this.provisionedFor() !== null };
             });
             return out;
         }
@@ -3826,6 +4007,14 @@ export function defineScopeDO(modules, bareOps) {
             // both adapters by the query-plan test rather than by that gate.
             this.sql.exec('CREATE INDEX IF NOT EXISTS _substrat_outbox_invocation ON _substrat_outbox (invocation_id, id)');
             this.ensureScheduleStateKind();
+            this.ensureRefusalsAdmitGuards();
+        }
+        /**
+         * #1745: `_substrat_refusals`, rebuilt to admit a guard row (a nullable `from_state`, plus
+         * `guard` and `reason`) on a scope DO whose table predates it.
+         */
+        ensureRefusalsAdmitGuards() {
+            this.rebuildIfStale('_substrat_refusals', refusalsAdmitGuards, REFUSALS_REBUILD);
         }
         /**
          * #1288: `_substrat_schedule_state`, rebuilt with `kind` in its key on a scope DO
@@ -3837,23 +4026,31 @@ export function defineScopeDO(modules, bareOps) {
          * the stored DDL is the one probe both adapters can make.
          */
         ensureScheduleStateKind() {
+            this.rebuildIfStale('_substrat_schedule_state', scheduleStateHasKind, SCHEDULE_STATE_REBUILD);
+        }
+        /**
+         * Run a kernel create-copy-drop-rename `script` over `table` when the stored DDL fails
+         * `isCurrent` — the one shape `ensureScheduleStateKind` and `ensureRefusalsAdmitGuards`
+         * share, so the pure adapter's twin rebuilds byte-identically.
+         */
+        rebuildIfStale(table, isCurrent, script) {
             const row = this.sql
-                .exec(`SELECT sql FROM sqlite_master WHERE type = 'table' AND name = ?`, '_substrat_schedule_state')
+                .exec(`SELECT sql FROM sqlite_master WHERE type = 'table' AND name = ?`, table)
                 .toArray()[0];
-            if (!row || scheduleStateHasKind(row.sql))
+            if (!row || isCurrent(row.sql))
                 return;
-            // In a transaction, for the reason the kernel constant spells out: create-copy-
+            // In a transaction, for the reason the kernel constants spell out: create-copy-
             // drop-rename has two intermediate states and both are unrecoverable on the next
             // wake. `transactionSync`, not the async one every operation uses — the DO
             // runtime forbids a manual BEGIN through `sql.exec`, and this body is wholly
             // synchronous, which is the one case the sync API is for (it commits at the
             // first await, and there is none). It also has to be sync because the caller is.
             this.revision.transactionSync(() => {
-                for (const stmt of splitSqlStatements(SCHEDULE_STATE_REBUILD))
+                for (const stmt of splitSqlStatements(script))
                     this.sql.exec(stmt);
             });
         }
-        async importDump(tables, destScopeId, { switchOff, sourceScopeId, exact, loadStamp, expect, resolveKept, markCopy, } = {}) {
+        async importDump(tables, destScopeId, { switchOff, sourceScopeId, exact, loadStamp, expect, resolveKept, markCopy, provisionedFor, } = {}) {
             // The WHOLE drop-then-replay runs under deferred foreign keys, in one transaction.
             //
             // Two distinct FK hazards, and both need the deferral — the second is why it cannot
@@ -3892,6 +4089,15 @@ export function defineScopeDO(modules, bareOps) {
                 const before = this.loadMarker();
                 // #1713: the lifecycle the platform delivered here, read before the drops take it.
                 const lifecycleBefore = readLifecycle(this.switchSql());
+                // #2016: this store's own tenant receipt, read before the drops take it. A load never
+                // changes which tenant the scope belongs to: the platform's word for it (`provisionedFor`)
+                // must agree with the receipt held, and is refused before the first drop if it does not.
+                const receiptBefore = this.provisionedFor();
+                if (provisionedFor !== undefined && receiptBefore !== null && receiptBefore !== provisionedFor) {
+                    const refused = substratError('conflict', tenantReceiptRefusal(receiptBefore, provisionedFor));
+                    tenantRefusals.add(refused);
+                    throw refused;
+                }
                 // #1722 (Codex #2008 r7): a kept copy holds writes nothing else has. No load replaces it
                 // except its own resolution, and that only at the revision the operator acted on.
                 const kept = this.metaValue(KEPT_DIVERGENT_KEY);
@@ -3962,9 +4168,15 @@ export function defineScopeDO(modules, bareOps) {
                             this.sql.exec(insert, ...row);
                     }
                     // #1738: a dump's `provisioned_for` names the scope (and tenant) it was captured from,
-                    // not this one. Dropped, so a restore never carries a receipt over; the repair
-                    // projection that follows writes this scope's own.
-                    this.sql.exec(`DELETE FROM _substrat_meta WHERE key = 'provisioned_for'`);
+                    // not this one, so it is never carried over. #2016: what stays is THIS store's own —
+                    // the platform's word when the load carries it (a copy into a fresh scope records its
+                    // own tenant here), else the receipt held before the drops. A store that held none
+                    // keeps none, and the repair projection that follows writes it.
+                    this.sql.exec(`DELETE FROM _substrat_meta WHERE key = ?`, PROVISIONED_FOR_KEY);
+                    const receipt = provisionedFor ?? receiptBefore;
+                    if (receipt !== null) {
+                        this.sql.exec(`INSERT INTO _substrat_meta (key, value) VALUES (?, ?)`, PROVISIONED_FOR_KEY, receipt);
+                    }
                     // #1722: whatever stamp an export read here no longer describes this store, so every load
                     // replaces it: with the carry's own, or with none. And the write revision moves on from
                     // where it stood before the drops, so it never goes back.
@@ -4077,6 +4289,8 @@ export function defineScopeDO(modules, bareOps) {
                 const code = errorCodeOf(e);
                 if (code === 'precondition_failed')
                     return { refused: 'changed' };
+                if (e instanceof Error && tenantRefusals.has(e))
+                    return { refused: 'tenant', message: e.message };
                 if (code === 'conflict')
                     return { refused: 'kept' };
                 throw toRpcError(e);
@@ -4485,9 +4699,9 @@ export function defineScopeDO(modules, bareOps) {
          * survives — the whole point, since the denial is the write the operation could not make.
          */
         /** K-42: the session a refused call ran under travels with the denial row. */
-        /** #1745: a refused transition the operation failed with, written after its rollback. */
+        /** #1745: a refused transition or refusing guard the operation failed with, written after its rollback. */
         recordRefusal(subject, tenantId, scopeId, operation, err, invocationId, impersonation) {
-            const refused = refusedTransitionOf(err);
+            const refused = refusalOf(err);
             if (!refused)
                 return;
             const q = refusalInsert({
@@ -4538,7 +4752,12 @@ export function defineScopeDO(modules, bareOps) {
             invocationId, new Date().toISOString());
         }
         // -- operation context (port of operationContext) -------------------------
-        operationContext(principal, tenantId, scopeId, systemActor, connectionId, systemModuleId, 
+        operationContext(principal, tenantId, scopeId, systemActor, connectionId, 
+        /**
+         * #1834: the system subject, only as the door check hands it out (`assertSystemDoor`) — so
+         * no path can act as `system:<moduleId>` without passing that check.
+         */
+        systemDoor, 
         /** #458: per-invoke tally of `ctx.requestPlatform` calls; absent for consumer dispatch. */
         signals, 
         /**
@@ -4603,8 +4822,8 @@ export function defineScopeDO(modules, bareOps) {
                 ? peerSubject
                 : capabilityId
                     ? { kind: 'capability', id: capabilityId }
-                    : systemModuleId
-                        ? { kind: 'system', id: systemModuleId }
+                    : systemDoor
+                        ? { kind: 'system', id: systemDoor.moduleId }
                         : connectionId
                             ? { kind: 'connection', id: connectionId }
                             : { kind: 'principal', id: principal };
@@ -5048,14 +5267,19 @@ export function defineScopeDO(modules, bareOps) {
                 // #1738: the receipt `servesTenant` reads. First writer wins: absent or equal is written,
                 // a receipt for ANOTHER tenant refuses the whole projection (K-3), before a single row
                 // moves, so a misdirected projection can never re-point a scope or leave its roles behind.
-                // A restore does not trip this: `importDump` drops the dump's receipt, so the repair
-                // projection that follows finds none and writes the destination's own.
-                const held = this.sql.exec(`SELECT value FROM _substrat_meta WHERE key = 'provisioned_for'`).toArray()[0];
-                if (held && held.value !== tenantId) {
-                    throw substratError('conflict', `applyProjection refused: this scope was provisioned for tenant ${held.value}, and a projection for tenant ${tenantId} would re-point it`);
+                // A restore does not trip this: `importDump` keeps the destination's own receipt and
+                // never the dump's (#2016), so the repair projection that follows finds its own tenant.
+                // #2016: a scope with no receipt yet takes its first one only where its role rows agree
+                // (`tenantVerdict`, the same reading the lifecycle back-fill uses), so a projection for
+                // another tenant cannot pin a legacy scope to it.
+                const { verdict, held } = this.tenantVerdict(tenantId);
+                if (verdict === 'foreign') {
+                    throw substratError('conflict', held !== null
+                        ? `applyProjection refused: this scope was provisioned for tenant ${held}, and a projection for tenant ${tenantId} would re-point it`
+                        : `applyProjection ${foreignTenant(held, tenantId)}`);
                 }
                 // Written before any guard below can return early, so every projection leaves it.
-                this.sql.exec(`INSERT OR REPLACE INTO _substrat_meta (key, value) VALUES ('provisioned_for', ?)`, tenantId);
+                this.sql.exec(`INSERT OR REPLACE INTO _substrat_meta (key, value) VALUES (?, ?)`, PROVISIONED_FOR_KEY, tenantId);
                 this.sql.exec(`DELETE FROM _substrat_roles WHERE tenant_id = ?`, tenantId);
                 for (const r of roles) {
                     this.sql.exec(`INSERT OR REPLACE INTO _substrat_roles (tenant_id, role_key, permissions, source, revoked_at)