@substrat-run/adapter-cloudflare 0.136.0 → 0.138.0

package/dist/host.js

@@ -1,12 +1,14 @@
 import { env as ambientEnv } from 'cloudflare:workers';
 import { isRewindRefusal, REWIND_REFUSED } from './rewind-refusal.js';
-import { delegatedReadParams, fromWireFailure, exportReadInput, exportedBatch, importBatch, importResult, importState, importsOfManifestJson, exportsOfManifestJson, importCursorMove, importCursorMoveAt, importCursorMoved, accessLogEntry, adminLogEntry, opsFailureEntry, opsFailureFingerprint, issueEntry, sweepRunEntry, FRESHNESS_HEARTBEAT_MINUTES, sweepRunsPayload, modelUsageEntry, attachmentRecord, createTenantInput, identityLink, identityPool, createOrgInput, promotionAcknowledgement, bindAcknowledgement, bindHostnameInput, channelHistoryEntry, hostnameBinding, publishVersionInput, AUTO_ADMISSION_NOTE, registerVerticalInput, vertical as verticalSchema, verticalServingState, verticalChannel, verticalVersion, connection, capabilityExchange, capabilityGrant, principalId, connectionGrant, connectionGrantRecord, connectionSecret, systemGrant, systemSwitch, systemSwitchOutcome, systemScheduleEntry, systemSwitchRecord, entitlementGrant, entitlementGrantInput, capabilityFilter, instant, meterReading, subjectRef, createConnectionInput, projectedConnectionGrant, projectedConnectionKey, moduleManifest, org as orgSchema, orgMembership, resolvedIdentity, identityMembership, roleDefinition, scope as scopeSchema, tenant as tenantSchema, tenantRole, delegatedReadRecord, ownerTransferAudit, copyMarkAudit, subjectShredReceipt, connectorDispatchKind, callsOfManifestJson, outboundOfManifestJson, substratError, redrainEventsInput, coverage, peerCoverage, peerGrantsEntry, peerSwitch, peerSwitchOutcome, verticalCaller, verticalResolution, verticalSlug, entityObjectRef, ATTACHMENT_BLOB_BINDING, blobStoreBindingName, lifecycleDelivery, scopeLifecycle, } from '@substrat-run/contracts';
+import { isSystemDoorMoved, SYSTEM_DOOR_MOVED, SYSTEM_DOOR_REGATES } from './system-door.js';
+import { delegatedReadParams, operationSeriesCount, fromWireFailure, exportReadInput, exportedBatch, importBatch, importResult, importState, importsOfManifestJson, exportsOfManifestJson, importCursorMove, importCursorMoveAt, importCursorMoved, accessLogEntry, adminLogEntry, opsFailureEntry, opsFailureFingerprint, issueEntry, sweepRunEntry, FRESHNESS_HEARTBEAT_MINUTES, sweepRunsPayload, modelUsageEntry, attachmentRecord, createTenantInput, identityLink, identityPool, createOrgInput, promotionAcknowledgement, bindAcknowledgement, bindHostnameInput, channelHistoryEntry, hostnameBinding, publishVersionInput, AUTO_ADMISSION_NOTE, registerVerticalInput, vertical as verticalSchema, verticalServingState, verticalChannel, verticalVersion, connection, capabilityExchange, mintedCapability, capabilityGrant, principalId, connectionGrant, connectionGrantRecord, connectionSecret, systemGrant, systemSwitch, systemSwitchOutcome, systemScheduleEntry, systemSwitchRecord, entitlementGrant, entitlementGrantInput, capabilityFilter, instant, meterReading, subjectRef, createConnectionInput, projectedConnectionGrant, projectedConnectionKey, moduleManifest, org as orgSchema, orgMembership, resolvedIdentity, identityMembership, roleDefinition, scope as scopeSchema, tenant as tenantSchema, tenantRole, delegatedReadRecord, ownerTransferAudit, copyMarkAudit, subjectShredReceipt, connectorDispatchKind, callsOfManifestJson, outboundOfManifestJson, SCOPE_GATE_REASONS, substratError, redrainEventsInput, coverage, peerCoverage, peerGrantsEntry, peerSwitch, peerSwitchOutcome, verticalCaller, verticalResolution, verticalSlug, entityObjectRef, ATTACHMENT_BLOB_BINDING, blobStoreBindingName, lifecycleDelivery, scopeLifecycle, } from '@substrat-run/contracts';
 import { normalizeHostname, toRouteTarget } from './route-resolver.js';
-import { attachmentBlobKey, attachmentSha256, entitlementDenial, requiredEntitlementFor, foldMeterReading, parseValidationRecords, resolveScopeRecord, ulid, KEPT_COPY_REFUSAL, capabilityTokenHash, checkBecomeInput, plausibleSessionToken, foldModelUsage, backoffAt, resolveRetryPolicy, isSecretBoxConfigured, unconfiguredSecretBox, createSubjectKeys, generateSealingKeyPair, openSealed, ImpersonationRefused, assertSessionUsable, impersonationRowValues, mapImpersonationRow, newImpersonationSession, jobRunOf, runDueJobRuns, startJobRun, attachmentTextJob, assertAttachmentExtractors, assertJobRegistrable, isAttachmentTextRun, searchLimit, searchMatchExpression, globalFetch, assertRedrainWindow, platformRequestOf, undrainedEventsOf, inUnitMovesToAudit, staleCarryRevertRow, staleCarryReverts, withRecorded, systemSwitchedOffMessage, tenantSystemSwitchedOffMessage, CrossVerticalRegistry, importCursorSourceOf, exportBreaksOf, exportBreakRefusal, bindExportBreaksOf, bindExportBreakRefusal, collectPeers, peerSeats, connectorCallRecord, noopConnectorCallRecorder, recordConnectorCall, settleConnectionUse, splitManifestMigrations, unknownRoleError, assertRowLimit, assertRowOffset, INERT_SCOPE_REASON, lifecycleReceipt, lifecycleRefusal, isPrimaryScope, isPrimaryScopeRow, asyncInvocationId, asyncLinePass, } from '@substrat-run/kernel';
+import { attachmentBlobKey, attachmentSha256, entitlementDenial, requiredEntitlementFor, foldMeterReading, parseValidationRecords, resolveScopeRecord, ulid, KEPT_COPY_REFUSAL, capabilityTokenHash, checkBecomeInput, plausibleSessionToken, foldModelUsage, backoffAt, resolveRetryPolicy, executorOutcomeOf, isDeliveryRefusal, refusalJournalText, isSecretBoxConfigured, unconfiguredSecretBox, createSubjectKeys, generateSealingKeyPair, openSealed, ImpersonationRefused, assertSessionUsable, impersonationRowValues, mapImpersonationRow, newImpersonationSession, jobRunOf, assertLeaseMs, runDueJobRuns, SYSTEM_DOOR_WAIT, startJobRun, attachmentTextJob, assertAttachmentExtractors, assertJobRegistrable, isAttachmentTextRun, searchLimit, searchMatchExpression, globalFetch, assertRedrainWindow, platformRequestOf, undrainedEventsOf, inUnitMovesToAudit, staleCarryRevertRow, staleCarryReverts, recordedOffFromWire, peerSubjectRef, SWITCH_KINDS, reassertActionOf, reassertEntry, reassertOffRow, reassertOnRow, switchActionOf, switchAuditSubject, switchNotFoundMessage, recordWriteSuperseded, switchSubjectOf, switchSupersededMessage, withRecorded, systemSwitchedOffMessage, tenantSystemSwitchedOffMessage, CrossVerticalRegistry, importCursorSourceOf, exportBreaksOf, exportBreakRefusal, bindExportBreaksOf, bindExportBreakRefusal, collectPeers, peerSeats, connectorCallRecord, noopConnectorCallRecorder, recordConnectorCall, settleConnectionUse, splitManifestMigrations, unknownRoleError, assertRowLimit, assertRowOffset, emptyImportResult, INERT_SCOPE_REASON, lifecycleReceipt, lifecycleRefusal, isPrimaryScope, isPrimaryScopeRow, asyncInvocationId, asyncLinePass, } from '@substrat-run/kernel';
 import { attributedHost } from '@substrat-run/kernel';
-import { isOrangeToOrange, isUpgradeRequest, LIVE_MODE_HEADER, LIVE_PRINCIPAL_HEADER, LIVE_SCOPE_HEADER, LIVE_SUBSCRIBE_PATH, LIVE_TENANT_HEADER, } from './live-reads.js';
+import { isOrangeToOrange, isUpgradeRequest, LIVE_MODE_HEADER, LIVE_PRINCIPAL_HEADER, LIVE_SCOPE_HEADER, LIVE_SUBSCRIBE_PATH, LIVE_TENANT_HEADER, LIVE_WITHIN_HEADER, encodeLiveWithin, liveWithinOf, } from './live-reads.js';
 import { tenantStoreDatabaseName } from './d1.js';
 import { blobStoreBucketName, r2TenantBlobStore } from './r2.js';
+import { unwrapReply } from './do-reply.js';
 /** DO row → contract shape. Never reads the secrets table — that is the split. */
 const toConnection = (r) => connection.parse({
     id: r.id,
@@ -25,18 +27,34 @@ const toConnection = (r) => connection.parse({
     createdAt: r.created_at,
     revokedAt: r.revoked_at,
 });
-/** Rethrow a capability attachment verb's failure, rebuilt with its code; else its value. */
-function unwrapCapabilityReply(reply) {
-    if (reply.failure)
-        throw fromWireFailure(reply.failure);
-    return reply.value;
-}
 /**
  * How far ahead of the clock a held lifecycle epoch may be and still be learned past (#1713). An
  * epoch is the time a directory restore minted it, so a legitimate one is behind its minter's
  * clock; the skew allows for clocks that disagree, and bounds what a forged answer can move.
  */
 export const LIFECYCLE_EPOCH_SKEW_MS = 24 * 60 * 60 * 1000;
+/**
+ * #2016: how many served scopes one heal pass asks for their tenant record, beyond the drift and the
+ * holds. Rotated least-recently-asked first, so a deployment that cannot answer yet (a build from
+ * before the record) costs at most this many deliveries a pass and starves nothing.
+ */
+export const TENANT_UNRECORDED_PER_PASS = 50;
+/**
+ * K-3's refusal of a (tenant, scope) pair the host does not hold — the same answer for a scope that
+ * does not exist and for one of another tenant (#1718), in one wording.
+ */
+const unknownScopeForTenant = (tenantId, scopeId) => substratError('not_found', `unknown scope for tenant: (${tenantId}, ${scopeId})`);
+/**
+ * #2016: the line a CP-less host writes each time it admits a pair to a scope with no tenant record
+ * and no role rows — nothing to hold the pair against. Ids only.
+ */
+export const tenantUnrecordedLine = (tenantId, scopeId) => ({
+    substrat: 'tenant-unrecorded',
+    level: 'warn',
+    tenantId,
+    scopeId,
+    message: 'admitted to a scope whose tenant is not recorded; a reconcile or lifecycle delivery records it',
+});
 /**
  * Refuse to mark a scope a copy unless the request classifies it non-primary (#2005). The
  * classification is the platform directory's; the vertical applies the same `isPrimaryScope` to
@@ -51,9 +69,10 @@ function assertCopyLineage(lineage) {
  * A control-plane stand-in for a CP-less vertical (scope-local-permissions.md Phase 3).
  * The hot path a served scope actually touches becomes trust-the-upstream:
  *   - `scopeAccessRefusal` / `setMigrationState` → no-op: the router gates the scope's
- *     lifecycle + tenancy from the shared directory, and the vertical trusts the asserted
- *     node rather than re-reading a directory it does not have. Its own half of the
- *     lifecycle gate reads the scope's storage instead (`assertLive`, #1713).
+ *     lifecycle + tenancy from the shared directory, and the vertical does not re-read a
+ *     directory it does not have. Its own half of both gates reads the scope's storage
+ *     instead (`validateScopeAccess`): the tenant the scope was provisioned for (#2016) and the lifecycle
+ *     the platform delivered (#1713).
  *   - `tenantHoldsEntitlement` → true: the SKU was enforced on the shared control plane
  *     at provision (before `provisionInstance`), so a scope that EXISTS here was granted
  *     it upstream — a single-vertical deployment holds its own entitlements by construction.
@@ -68,22 +87,31 @@ function nullControlPlane() {
         recordAdmin: noop,
         recordAccess: noop,
         tenantHoldsEntitlement: async () => true,
-        // #1674: the schedule switch's record is a DIRECTORY store, and a CP-less host has no
+        // #1674, #2029: the switches' record is a DIRECTORY store, and a CP-less host has no
         // directory — the shared control plane that delegates here keeps it. Same posture as
         // `recordAdmin`: nothing to write, nothing recorded to read back.
-        recordSystemSwitchedOff: noop,
-        recordSystemSwitchedOn: async () => null,
-        restoreSystemSwitchRecord: noop,
+        recordSwitchedOff: async () => null,
+        recordSwitchedOn: async () => null,
+        restoreSwitchRecord: noop,
         listSystemSwitches: async () => [],
-        systemSwitchRecordsOf: async () => [],
-        switchedOffModulesOf: async () => [],
+        switchRecordsOf: async () => [],
+        switchRecordStatesOf: async () => [],
+        switchesOwedOf: async () => [],
+        clearSwitchOwed: noop,
+        // #1823: no tenant tuples here either — the platform reads them and sends `tenantHeld`.
+        tenantHeldOf: async () => [],
+    };
+    const unavailable = (method) => new Error(`control plane unavailable: '${method}' — this host is scope-local / CP-less ` +
+        `(docs/architecture/scope-local-permissions.md, Phase 3)`);
+    // A directory write through `reply` (#113) is named for the write it carries, not for `reply`.
+    passthrough.reply = async (method) => {
+        throw unavailable(String(method));
     };
     return new Proxy({}, {
         get: (_t, prop) => typeof prop === 'string' && prop in passthrough
             ? passthrough[prop]
             : async () => {
-                throw new Error(`control plane unavailable: '${String(prop)}' — this host is scope-local / CP-less ` +
-                    `(docs/architecture/scope-local-permissions.md, Phase 3)`);
+                throw unavailable(String(prop));
             },
     });
 }
@@ -124,6 +152,35 @@ export const SWITCH_HOLD_EXTRA_WAITS = 3;
  * clock, against the releasing host's clock: minutes, not seconds.
  */
 export const SWITCH_HOLD_PENDING_MAX_MS = 5 * 60_000;
+/**
+ * A move the deployment serving the scope applied, or may have, without attesting what the
+ * platform needs from it (#2045 Codex r3): the switch fence (`fenced`), or for a tenant-held
+ * module's OFF the evaluator that denies a tenant-level grant (`deniesTenantGrants`, #1823).
+ *
+ * The preflight (`switchTarget`'s `attestFence`) tells a deployment built before the fence apart
+ * before anything is recorded or moved. On such a deployment only an ON is refused: the race the
+ * fence closes is an older OFF landing after a newer ON, and with every ON refused there is no
+ * newer ON to land after, so an OFF goes through unfenced (#2045 follow-up). A kill switch that
+ * cannot be pulled until every vertical is re-pushed is the outage the fence must never cause.
+ * An unfenced OFF keeps its write-ahead owed mark, so the first re-assert after the vertical is
+ * redeployed moves the scope again under the record's fence.
+ *
+ * This error fires when a deployment that attested the fence answers a move without it — a
+ * rollback to an old build between the preflight and the move — or when an ON reaches a
+ * deployment without the fence. It is NOT compensated with an opposite move: an unfenced
+ * compensation can undo a newer call's switch (Codex r3, finding 2). The call's record and its
+ * write-ahead owed mark stay, and the call is refused.
+ */
+class UnattestedSwitch extends Error {
+}
+/** A fenced move answered without `fenced`: the deployment predates the fence. */
+const unfencedMessage = (scopeId) => `the deployment serving scope ${scopeId} predates the switch fence (#2045): it cannot refuse an older ` +
+    `switch call's OFF landing after this ON, so no switch is turned on there. Switching off still works. ` +
+    `Redeploy the vertical, then retry.`;
+/** A tenant-held module's OFF answered without `deniesTenantGrants` (#1823). */
+const undeniedMessage = (scopeId, moduleId) => `the deployment serving scope ${scopeId} predates the kill switch's tenant-grant denial (#1823): ` +
+    `module '${moduleId}' holds a tenant-level grant that its OFF would leave authorizing there. ` +
+    `Redeploy the vertical, then retry.`;
 /**
  * The attachment bucket a host resolves when it was handed no resolver (#1995): the
  * platform's per-tenant binding, read off this script's own env, named by the one shared
@@ -132,6 +189,49 @@ export const SWITCH_HOLD_PENDING_MAX_MS = 5 * 60_000;
 function ambientAttachmentBucket(tenantId) {
     return ambientEnv[blobStoreBindingName(ATTACHMENT_BLOB_BINDING, tenantId)] ?? null;
 }
+/**
+ * #2029: scope instances whose door has read the rewind hold and found NO claim on the scope at
+ * all, so their doors skip the hold read for the rest of the instance's life. Isolate-wide, because
+ * a host lives for one request: without it, every peer call would read the deployment's one hold
+ * object — an extra hop, on a single object, on the hot path of every scope never rewound.
+ *
+ * Safe because claims are only ever added for storage a LATER instance serves. A rewind writes its
+ * claim before it arms, and arming restarts the scope, so its rewound storage is always served by a
+ * new instance with a new id, which reads the hold afresh (`SWITCH_HOLD_SETTLE_MS` puts every row of
+ * the claim before that instance existed). A join (`switchHoldJoin`) goes into a rewind's claim too,
+ * so into that same later instance. An instance that read no claim therefore never gains one; claims
+ * only leave it, by a switch move. Only a GOOD read is remembered: a read that failed open is not.
+ * Bounded: past `CLEAR_SCOPE_INSTANCES_MAX` it is emptied, which costs a re-read, nothing else.
+ */
+const CLEAR_SCOPE_INSTANCES = new Set();
+const CLEAR_SCOPE_INSTANCES_MAX = 10_000;
+const rememberClearInstance = (key) => {
+    if (CLEAR_SCOPE_INSTANCES.size >= CLEAR_SCOPE_INSTANCES_MAX)
+        CLEAR_SCOPE_INSTANCES.clear();
+    CLEAR_SCOPE_INSTANCES.add(key);
+};
+/**
+ * #2045: a carry's fences, by tuple subject (`RecordedOffCarry.fences`): for each recorded-off
+ * subject, the operation id of the call the record holds.
+ */
+const switchFencesCarried = (kinds) => {
+    const out = {};
+    for (const [kind, { keys, fences }] of kinds) {
+        for (const key of keys) {
+            const fence = fences.get(key);
+            if (fence !== undefined)
+                out[switchSubjectOf(kind, key)] = fence;
+        }
+    }
+    return out;
+};
+/** #2029: how a door's refusals and a re-assert's name each kind of subject. */
+const DOOR_WORDS = {
+    system: { what: (key) => `module '${key}'`, door: 'system door', switchName: 'schedule', switched: 'schedules' },
+    peer: { what: (key) => `peer vertical '${key}'`, door: 'peer door', switchName: 'peer', switched: 'peers' },
+};
+/** #2029: the rewind hold's key for one subject — a module's id, bare as #1819 stored it, or `vertical:<slug>`. */
+const holdKeyOf = (kind, key) => (kind === 'system' ? key : peerSubjectRef(key));
 export class CloudflareScopeHost {
     admin;
     scopeNs;
@@ -349,6 +449,22 @@ export class CloudflareScopeHost {
             },
         };
     }
+    /**
+     * #1184: the scope reads an executor's handler may make. Plain RPCs to the ScopeDO: the
+     * handler runs here on the coordinator, after the DO's own task has returned.
+     */
+    executorScope(tenantId, scopeId) {
+        const stub = this.scopeStub(scopeId);
+        return {
+            history: async (entity, page) => stub.entityHistory({ entityType: entity.entityType, entityId: entity.entityId, limit: page?.limit, cursor: page?.cursor }),
+            covers: async (principal, roleKey, level) => {
+                const bound = await stub.canAssignFor(tenantId, scopeId, principalId.parse(principal), roleKey, level === 'tenant');
+                if (!bound)
+                    throw unknownRoleError(roleKey);
+                return coverage.parse(bound);
+            },
+        };
+    }
     /**
      * Drain this scope's outbox into the registered executors (K-22 §4.2).
      *
@@ -372,7 +488,9 @@ export class CloudflareScopeHost {
      * own `invocationId` field reads null — an ambient read there would record "no
      * call" for every attempt an operation's own tail made.
      */
-    invocationId) {
+    invocationId, 
+    /** #1184: what each attempt did, for the emitting call's `onExecutorOutcomes`. */
+    outcomes) {
         const report = {
             attempted: 0,
             delivered: 0,
@@ -386,27 +504,22 @@ export class CloudflareScopeHost {
         // attempt runs — the DO only journals it.
         const lines = asyncLinePass();
         try {
-            await this.drainExecutorsPass(tenantId, scopeId, invocationId, report, lines);
+            await this.drainExecutorsPass(tenantId, scopeId, invocationId, report, lines, outcomes);
         }
         finally {
             lines.end();
         }
         return report;
     }
-    async drainExecutorsPass(tenantId, scopeId, invocationId, report, lines) {
+    async drainExecutorsPass(tenantId, scopeId, invocationId, report, lines, outcomes) {
         const stub = this.scopeStub(scopeId);
+        const scope = this.executorScope(tenantId, scopeId);
         // #2005: a non-primary scope (a fork, a snapshot, a preview of either kind) causes no
         // outbound effects, so its deliveries are journaled terminal with the reason and no
-        // handler runs. Asked of the directory where there is one. A CP-less host has none, so it
-        // asks the scope's own storage whether it is classified a copy (`_substrat_copy_origin`'s
-        // `is_copy`, #2009, set on the directory's word) — a preview and a snapshot reach a hosted
-        // vertical as restores the platform marks.
-        // Asked on the first due event, once per pass: most passes have none, and the directory
-        // is one global object.
+        // handler runs (`isInertScope`). Asked on the first due event, once per pass: most passes
+        // have none, and the directory is one global object.
         let inert;
-        const isInert = () => (inert ??= this.cpLess
-            ? stub.isCopy()
-            : this.cp.getScopeRecord(tenantId, scopeId).then((row) => !isPrimaryScopeRow(row)));
+        const isInert = () => (inert ??= this.isInertScope(tenantId, scopeId));
         // #1713: a CP-less scope its lifecycle holds attempts nothing and journals nothing, so every
         // due delivery stays due for the first pass after it is live again. Asked on the first due
         // event, like `isInert`. Every caller passed `assertLive` already, so this is for the scope
@@ -437,6 +550,9 @@ export class CloudflareScopeHost {
                 attempt,
                 startedAt: Date.now(),
             });
+            const outcomeOf = (event, outcome, error) => {
+                outcomes?.push(executorOutcomeOf(id, event, outcome, error));
+            };
             for (const bad of undecodable) {
                 report.attempted += 1;
                 const attempt = await stub.recordExecutorAttempt(bad.eventId, deliveryId, bad.error, null, invocationId);
@@ -450,6 +566,7 @@ export class CloudflareScopeHost {
                     // No next attempt, like an undecodable row: a scope does not become primary.
                     const attempt = await stub.recordExecutorAttempt(event.id, deliveryId, INERT_SCOPE_REASON, null, invocationId);
                     report.inert = (report.inert ?? 0) + 1;
+                    outcomeOf(event, 'inert', INERT_SCOPE_REASON);
                     // Its own outcome, never `delivered`: no handler ran (#2005).
                     lines.write({ ...unitOf(event.id, attempt), startedAt, outcome: 'inert' });
                     continue;
@@ -467,6 +584,7 @@ export class CloudflareScopeHost {
                         // the at-least-once residue, as it already must in-process.
                         await stub.routeExecutorEventToPlatform(event.id, deliveryId, connectorDispatchKind(executor.provider), JSON.stringify({ executorId: id, event }), JSON.stringify({ system: 'connector-dispatch' }), invocationId);
                         report.routedToPlatform += 1;
+                        outcomeOf(event, 'routed');
                         // Handed on, not run here: the platform's drain owns its attempts from now on.
                         lines.write({ ...unitOf(event.id, 1), startedAt, outcome: 'routed' });
                     }
@@ -474,13 +592,26 @@ export class CloudflareScopeHost {
                         await executor.handler(await this.connectorContext(tenantId, scopeId, executor.timeoutMs, event.id), event);
                         const attempt = await stub.recordExecutorAttempt(event.id, deliveryId, null, null, invocationId);
                         report.delivered += 1;
+                        outcomeOf(event, 'delivered');
                         lines.write({ ...unitOf(event.id, attempt), startedAt, outcome: 'delivered' });
                     }
                     else {
-                        await executor.handler(this.admin, event);
-                        const attempt = await stub.recordExecutorAttempt(event.id, deliveryId, null, null, invocationId);
-                        report.delivered += 1;
-                        lines.write({ ...unitOf(event.id, attempt), startedAt, outcome: 'delivered' });
+                        const result = await executor.handler(this.admin, event, scope);
+                        // #1184: a refusal is the handler's own terminal decision — journaled with its
+                        // reason, no next attempt, listed by `executorDeadLetters` beside an exhausted one.
+                        const refused = isDeliveryRefusal(result) ? result : null;
+                        const text = refused && refusalJournalText(refused);
+                        const attempt = await stub.recordExecutorAttempt(event.id, deliveryId, text, null, invocationId);
+                        if (refused) {
+                            report.deadLettered += 1;
+                            outcomeOf(event, 'refused', refused.reason);
+                            lines.write({ ...unitOf(event.id, attempt), startedAt, outcome: 'dead-lettered', error: text });
+                        }
+                        else {
+                            report.delivered += 1;
+                            outcomeOf(event, 'delivered');
+                            lines.write({ ...unitOf(event.id, attempt), startedAt, outcome: 'delivered' });
+                        }
                     }
                 }
                 catch (err) {
@@ -495,6 +626,7 @@ export class CloudflareScopeHost {
                         report.deadLettered += 1;
                     else
                         report.retrying += 1;
+                    outcomeOf(event, exhausted ? 'dead-lettered' : 'retrying', err);
                     lines.write({
                         ...unitOf(event.id, attempts),
                         startedAt,
@@ -518,13 +650,14 @@ export class CloudflareScopeHost {
         // emitting operation's own tail made.
         return this.drainExecutors(tenantId, scopeId, null);
     }
-    registerJob(moduleId, name, handler, retry) {
+    registerJob(moduleId, name, handler, retry, options) {
         // #1575: the kernel's own jobs are dispatched before this registry is read.
         assertJobRegistrable(moduleId, name);
+        assertLeaseMs(options?.leaseMs);
         const key = `${moduleId}/${name}`;
         if (this.jobs.has(key))
             throw new Error(`job '${key}' is already registered`);
-        this.jobs.set(key, { handler, retry });
+        this.jobs.set(key, { handler, retry, leaseMs: options?.leaseMs });
     }
     /**
      * D-14's DURABLE driver: the run store is RPC to the scope DO, and nothing else.
@@ -542,13 +675,15 @@ export class CloudflareScopeHost {
         const stub = this.scopeStub(scopeId);
         return {
             startOrJoin: (key, row) => stub.jobRunStartOrJoin(key.moduleId, key.job, key.instance, row),
-            get: (id) => stub.jobRunById(id),
-            due: (now, limit, afterId) => stub.jobRunsDue(now, limit, afterId),
+            dueKeys: (now, max) => stub.jobRunsDueKeys(now, max),
+            claim: (id, owner, leaseMs) => stub.jobRunClaim(id, owner, leaseMs),
+            begin: (id, owner, marginMs) => stub.jobRunBegin(id, owner, marginMs),
+            miss: (id, owner, note) => stub.jobRunMiss(id, owner, note),
             list: (filter) => stub.jobRunList(filter),
-            patch: (id, patch) => stub.jobRunPatch(id, patch),
-            commitPass: (id, patch) => stub.jobCommitPass(id, patch),
-            step: (runId, name) => stub.jobStepRow(runId, name),
-            recordStep: (runId, name, result, attempts, lastError, at) => stub.jobStepRecord(runId, name, result, attempts, lastError, at),
+            patch: (id, patch, owner) => stub.jobRunPatch(id, patch, owner),
+            commitPass: (id, patch, owner) => stub.jobCommitPass(id, patch, owner),
+            beginStep: (runId, name, owner, leaseMs) => stub.jobStepBegin(runId, name, owner, leaseMs),
+            recordStep: (runId, name, result, attempts, lastError, at, owner, leaseMs) => stub.jobStepRecord(runId, name, result, attempts, lastError, at, owner, leaseMs),
         };
     }
     /**
@@ -585,7 +720,10 @@ export class CloudflareScopeHost {
             store: this.jobStore(scopeId),
             handlerFor: (run) => isAttachmentTextRun(run) ? attachmentText : this.jobs.get(`${run.module_id}/${run.job}`),
             now: () => new Date().toISOString(),
-            openScope: (run) => this.getSystemScope(run.module_id, tenantId, scopeId),
+            // #1834: the door is opened FOR this pass, so its "not now" is tied to this pass alone.
+            openScope: async (run, pass) => this.buildStub(tenantId, scopeId, undefined, undefined, await this.openSystemDoor(run.module_id, tenantId, scopeId, undefined, pass)),
+            // #1834: only this host's own door refusals defer a pass, recognised by identity.
+            deferral: (err, pass) => this.takeDoorWait(err, pass),
             maxPasses: options?.maxPasses,
             limit: options?.limit,
         });
@@ -665,9 +803,9 @@ export class CloudflareScopeHost {
         const rec = await this.cp.getScopeRecord(tenantId, scopeId);
         // K-3: a scope under another tenant is indistinguishable from one that does not exist.
         if (!rec)
-            throw substratError('not_found', `unknown scope for tenant: (${tenantId}, ${scopeId})`);
+            throw unknownScopeForTenant(tenantId, scopeId);
         if (rec.status !== 'active' && rec.status !== 'provisioning') {
-            throw new Error(`scope not migratable (status: ${rec.status}): ${scopeId}`);
+            throw substratError('conflict', `scope not migratable (status: ${rec.status}): ${scopeId}`);
         }
         const stub = this.scopeStub(scopeId);
         try {
@@ -709,11 +847,11 @@ export class CloudflareScopeHost {
         return this.scopeStub(scopeId).introspectTables();
     }
     async introspectScopeTable(scopeId, input) {
-        return this.scopeStub(scopeId).introspectTable(input.table, input.limit, input.offset);
+        return unwrapReply(await this.scopeStub(scopeId).introspectTableReply(input.table, input.limit, input.offset));
     }
     /** The SQL console's CP-less path (#219) — same trust line as the pair above. */
     async introspectScopeQuery(scopeId, input) {
-        return this.scopeStub(scopeId).introspectQuery(input.sql);
+        return unwrapReply(await this.scopeStub(scopeId).introspectQueryReply(input.sql));
     }
     /**
      * The K-35 denial log's CP-less path (#867) — same trust line as the reads above.
@@ -737,6 +875,31 @@ export class CloudflareScopeHost {
     async listCapabilitiesLocal(scopeId, filter) {
         return this.scopeStub(scopeId).listCapabilities(filter);
     }
+    /**
+     * The platform's `become` mint on the CP-less path (#1686) — `HostAdmin.mintCapability`'s
+     * ScopeDO half, for the deployment that serves the scope. Its one caller is an owner claim
+     * link, minted on the platform's instruction behind the vertical's platform-gated
+     * `/internal/owner-claim`; the control plane made the K-3 check and keeps the admin log before
+     * it called. Not a module verb: a module mints through `ctx.capabilities`, which mints `act`
+     * capabilities only. Same lifecycle gate as the exchange, so a held scope mints nothing.
+     */
+    async mintCapabilityLocal(tenantId, scopeId, input, actor) {
+        // Checked on this side too, as `HostAdmin.mintCapability` does: a typed refusal thrown
+        // across the RPC arrives as a bare message.
+        checkBecomeInput(input, new Date().toISOString());
+        await this.assertLive(tenantId, scopeId);
+        await this.migrateAndRecord(scopeId);
+        return mintedCapability.parse(await this.scopeStub(scopeId).mintBecomeCapability(input, actor));
+    }
+    /**
+     * The platform's revoke on the CP-less path (#1686) — how a re-minted claim link retires the
+     * previous one. True when the scope held the capability (revoked now, or already); false when
+     * it holds no such capability. No lifecycle gate: a revoke only narrows, so a held scope still
+     * takes one. Idempotent.
+     */
+    async revokeCapabilityLocal(scopeId, capabilityId, actor) {
+        return (await this.scopeStub(scopeId).revokeCapabilityAsPlatform(capabilityId, actor)) !== null;
+    }
     /**
      * Copy one scope's data into a fresh scope DO, entirely within THIS deployment —
      * the data half of an orchestrated snapshot (preview-and-snapshots.md §9). Like the
@@ -745,12 +908,24 @@ export class CloudflareScopeHost {
      * activation, version bind) stays on the control plane's side. Because source and
      * destination sit in the same SCOPE namespace, no scope bytes ever leave the
      * deployment — the §9 property the trust line rests on.
+     *
+     * #2016: `tenantId`, the tenant the platform snapshots for (absent from an older platform). The
+     * source must not be foreign to it — a copy never reads another tenant's scope — and the fork
+     * records it as its own receipt, not the source's.
      */
-    async snapshotScopeLocal(sourceScopeId, destScopeId) {
+    async snapshotScopeLocal(sourceScopeId, destScopeId, tenantId) {
+        if (tenantId !== undefined && (await this.scopeStub(sourceScopeId).admission(tenantId)).verdict === 'foreign') {
+            throw unknownScopeForTenant(tenantId, sourceScopeId);
+        }
         const tables = await this.scopeStub(sourceScopeId).exportDump();
         // #2009: a snapshot is a fork by construction (the control plane's row names `forkedFrom`, so
         // the directory never calls it primary), and a load classifies nothing by itself: marked here.
-        await this.scopeStub(destScopeId).importDump(tables, destScopeId, { sourceScopeId, exact: true, markCopy: true });
+        await this.scopeStub(destScopeId).importDump(tables, destScopeId, {
+            sourceScopeId,
+            exact: true,
+            markCopy: true,
+            provisionedFor: tenantId,
+        });
         return { tables: tables.length };
     }
     /**
@@ -767,28 +942,34 @@ export class CloudflareScopeHost {
      *  #1722: `loadStamp`, the stamp a carry leaves on the copy it lands, for a fenced wipe later,
      *  and `expect`, the marker the carry read here: the load is refused if the store moved since.
      *  #2005: `markCopy` — the directory's classification of the scope, sent when it is not
-     *  primary; the restore then marks it a copy. Refused if it classifies a primary. */
+     *  primary; the restore then marks it a copy. Refused if it classifies a primary.
+     *  #2016: `tenantId`, the tenant the platform restores for: recorded as the scope's receipt in
+     *  the load's own transaction, and a store provisioned for another tenant refuses the load. */
     opts) {
         if (opts?.markCopy)
             assertCopyLineage(opts.markCopy);
+        const carry = opts ? recordedOffFromWire(opts) : undefined;
         const load = {
-            switchOff: opts?.switchedOff ? { moduleIds: opts.switchedOff, at: new Date().toISOString() } : undefined,
+            switchOff: carry ? { at: new Date().toISOString(), ...carry } : undefined,
             sourceScopeId: opts?.sourceScopeId,
             exact: opts?.exact,
             loadStamp: opts?.loadStamp,
             markCopy: opts?.markCopy !== undefined,
+            provisionedFor: opts?.tenantId,
         };
-        // Both refusals come back as values (a throw over the RPC carries only its message) and are
+        // The refusals come back as values (a throw over the RPC carries only its message) and are
         // thrown here, in the vertical's own isolate, so its route answers 409 or 412, not a fault.
         const out = await this.scopeStub(scopeId).importDumpChecked(tables, scopeId, {
             ...load,
             ...(opts?.expect ? { expect: opts.expect } : {}),
         });
         if (out.refused === false) {
-            return { tables: tables.length, ...(opts?.switchedOff ? { switchedOff: out.switchedOff } : {}) };
+            return { tables: tables.length, ...(carry ? { switchedOff: out.switchedOff } : {}) };
         }
         if (out.refused === 'kept')
             throw substratError('conflict', KEPT_COPY_REFUSAL);
+        if (out.refused === 'tenant')
+            throw substratError('conflict', out.message);
         // A retry of a load that already committed (its answer was lost on the way back) is
         // refused by the marker that load itself moved. The store holding THIS request's stamp
         // says so: no other load writes it. Answered as applied, without `switchedOff`, so the
@@ -855,9 +1036,16 @@ export class CloudflareScopeHost {
      * the vertical's `/internal/lifecycle`. Kept unless the scope already holds a newer one, so a
      * push that arrives late cannot undo a later transition. `applied` is what the platform's heal
      * sweep records as delivered; `changed` says the gate's answer moved.
+     *
+     * #2016: `tenantId`, the tenant the directory delivered it for (absent from an older platform).
+     * A scope provisioned for another tenant refuses the delivery (`conflict`) and stores nothing;
+     * a scope provisioned before the tenant receipt existed records it here, its role rows agreeing.
      */
-    async setLifecycleLocal(scopeId, next) {
-        return lifecycleDelivery.parse(await this.scopeStub(scopeId).setLifecycle(scopeLifecycle.parse(next)));
+    async setLifecycleLocal(scopeId, next, tenantId) {
+        const out = await this.scopeStub(scopeId).setLifecycle(scopeLifecycle.parse(next), tenantId);
+        if ('refused' in out)
+            throw substratError('conflict', out.message);
+        return lifecycleDelivery.parse(out);
     }
     /**
      * Mark one scope in THIS deployment a copy (#2005), behind the vertical's `/internal/mark-copy`:
@@ -899,7 +1087,7 @@ export class CloudflareScopeHost {
      * safe; scope-level tuples (the restored grants) are never touched.
      */
     async projectRolesLocal(tenantId, scopeId, roles) {
-        await this.scopeStub(scopeId).applyProjection(tenantId, roles.map((r) => ({ role_key: r.key, permissions: JSON.stringify(r.permissions), source: r.source })), []);
+        unwrapReply(await this.scopeStub(scopeId).applyProjectionReply(tenantId, roles.map((r) => ({ role_key: r.key, permissions: JSON.stringify(r.permissions), source: r.source })), []));
     }
     /**
      * Wipe one scope DO's storage in THIS deployment — the reap half of an orchestrated
@@ -951,6 +1139,10 @@ export class CloudflareScopeHost {
     async lifecycleFlowLocal(scopeId, input) {
         return this.scopeStub(scopeId).lifecycleFlow(input);
     }
+    /** Business volumes per bucket (#1750) on this host's own scope — the vertical-host read. */
+    async operationSeriesLocal(scopeId, input) {
+        return this.scopeStub(scopeId).operationSeries(input);
+    }
     /** One event's causal chain (#1237) on this host's own scope — the vertical-host read. */
     async eventCauseLocal(scopeId, input) {
         return this.scopeStub(scopeId).eventCause(input);
@@ -1103,7 +1295,7 @@ export class CloudflareScopeHost {
         const record = resolveScopeRecord(input);
         // Fail-closed tenant gate throws out of the awaited cp call BEFORE migrate
         // or audit, so a rejected provision creates nothing and writes no audit row.
-        const created = await this.cp.provisionScope(input.tenantId, input.scopeId, record, new Date().toISOString());
+        const created = await this.directory('provisionScope', input.tenantId, input.scopeId, record, new Date().toISOString());
         // Instantiate the scope DO and trigger its lazy migration.
         await this.migrateAndRecord(input.scopeId);
         // Scope-local permissions: a freshly-provisioned scope evaluates from its own
@@ -1144,10 +1336,9 @@ export class CloudflareScopeHost {
         // #1742: in the SAME unit as the seat, so no sweep can land between them; the re-assert
         // after it then finds them off, and audits what the unit moved.
         const ownStore = this.cpLess || record.vertical === null;
-        const recordedOff = ownStore ? await this.cp.switchedOffModulesOf(input.tenantId, input.scopeId) : [];
-        const switchedOff = await this.scopeStub(input.scopeId).seatTuples(seats, recordedOff.length
-            ? { scopeId: input.scopeId, moduleIds: recordedOff, at: new Date().toISOString() }
-            : undefined);
+        const seatAt = new Date().toISOString();
+        const carry = ownStore ? await this.recordedOffCarry(input.tenantId, input.scopeId, seatAt) : undefined;
+        const switchedOff = await this.scopeStub(input.scopeId).seatTuples(seats, carry ? { scopeId: input.scopeId, at: seatAt, ...carry } : undefined);
         if (ownStore) {
             await this.admin.reassertSystemSwitches(actor, { tenantId: input.tenantId, scopeId: input.scopeId }, { appliedInUnit: switchedOff });
         }
@@ -1169,10 +1360,10 @@ export class CloudflareScopeHost {
         // inside the DO's ledger write, which is the serialization point that actually holds.
         const tenant = await this.cp.getTenant(input.tenantId);
         if (!tenant) {
-            throw new Error(`cannot provision tenant store under unknown tenant: ${input.tenantId}`);
+            throw substratError('not_found', `cannot provision tenant store under unknown tenant: ${input.tenantId}`);
         }
         if (tenant.status !== 'active') {
-            throw new Error(`cannot provision tenant store under non-active tenant (status: ${tenant.status}): ${input.tenantId}`);
+            throw substratError('conflict', `cannot provision tenant store under non-active tenant (status: ${tenant.status}): ${input.tenantId}`);
         }
         // Idempotent on (tenant, vertical, binding): a retried provision re-resolves the SAME
         // store rather than minting a second database (the K-31 ready-gate retries the whole
@@ -1187,7 +1378,7 @@ export class CloudflareScopeHost {
         // the source of truth, carrying the D1 database_id Cloudflare assigned as the ref.
         const name = await tenantStoreDatabaseName(input.tenantId, input.vertical, input.binding);
         const ref = await d1.create(name);
-        const stored = await this.cp.putTenantStore({
+        const stored = await this.directory('putTenantStore', {
             tenantId: input.tenantId,
             vertical: input.vertical,
             binding: input.binding,
@@ -1238,17 +1429,17 @@ export class CloudflareScopeHost {
         const r2 = this.requireBlobStores(`provisionBlobStore(tenant=${input.tenantId} vertical=${input.vertical} binding=${input.binding})`);
         const tenant = await this.cp.getTenant(input.tenantId);
         if (!tenant) {
-            throw new Error(`cannot provision blob store under unknown tenant: ${input.tenantId}`);
+            throw substratError('not_found', `cannot provision blob store under unknown tenant: ${input.tenantId}`);
         }
         if (tenant.status !== 'active') {
-            throw new Error(`cannot provision blob store under non-active tenant (status: ${tenant.status}): ${input.tenantId}`);
+            throw substratError('conflict', `cannot provision blob store under non-active tenant (status: ${tenant.status}): ${input.tenantId}`);
         }
         const existing = await this.cp.getBlobStore(input.tenantId, input.vertical, input.binding);
         if (existing)
             return { binding: input.binding, kind: 'blob', ref: existing.ref };
         const name = await blobStoreBucketName(input.tenantId, input.vertical, input.binding);
         const ref = await r2.create(name);
-        const stored = await this.cp.putBlobStore({
+        const stored = await this.directory('putBlobStore', {
             tenantId: input.tenantId,
             vertical: input.vertical,
             binding: input.binding,
@@ -1292,15 +1483,15 @@ export class CloudflareScopeHost {
         return this.buildAttachmentSurface({ principal }, tenantId, scopeId, store);
     }
     async getSystemAttachments(moduleId, tenantId, scopeId) {
-        // Reuse the system invoke door's module, tenant and lifecycle gate. The DO
-        // authorizes each open against the attachment target's read permission as
+        // Reuse the system invoke door's module, tenant and lifecycle gate, and its rewind gate
+        // (#1834). The DO authorizes each open against the attachment target's read permission as
         // system:<moduleId>; the worker reads bytes only after that gate succeeds.
-        await this.getSystemScope(moduleId, tenantId, scopeId);
+        const door = await this.openSystemDoor(moduleId, tenantId, scopeId);
         const store = await this.resolveAttachmentStore(tenantId);
         const stub = this.scopeStub(scopeId);
         return {
             open: async (attachmentId) => {
-                const record = await stub.systemAttachmentAuthorize(attachmentId, moduleId, tenantId, scopeId);
+                const record = await door.through((instance) => stub.systemAttachmentAuthorize(attachmentId, moduleId, tenantId, scopeId, instance));
                 return record ? this.openAttachmentBytes(store, scopeId, record) : null;
             },
         };
@@ -1387,22 +1578,22 @@ export class CloudflareScopeHost {
             // the DO only to be refused and recorded — never to the blob store.
             const hash = subject.capabilitySession;
             return {
-                upload: async (input) => unwrapCapabilityReply(await stub.capabilityAttachmentRefuseWrite(hash, tenantId, scopeId, 'attachments.upload', {
+                upload: async (input) => unwrapReply(await stub.capabilityAttachmentRefuseWrite(hash, tenantId, scopeId, 'attachments.upload', {
                     entityType: input.entity.entityType,
                 })),
-                list: async (entity) => unwrapCapabilityReply(await stub.capabilityAttachmentList(entity, hash, tenantId, scopeId)),
+                list: async (entity) => unwrapReply(await stub.capabilityAttachmentList(entity, hash, tenantId, scopeId)),
                 open: async (attachmentId) => {
-                    const record = unwrapCapabilityReply(await stub.capabilityAttachmentOpen(attachmentId, hash, tenantId, scopeId));
+                    const record = unwrapReply(await stub.capabilityAttachmentOpen(attachmentId, hash, tenantId, scopeId));
                     return record ? this.openAttachmentBytes(store, scopeId, record) : null;
                 },
-                remove: async (attachmentId) => unwrapCapabilityReply(await stub.capabilityAttachmentRefuseWrite(hash, tenantId, scopeId, 'attachments.remove', {
+                remove: async (attachmentId) => unwrapReply(await stub.capabilityAttachmentRefuseWrite(hash, tenantId, scopeId, 'attachments.remove', {
                     attachmentId,
                 })),
                 search: async (term, options) => {
                     // Judged here too, so a short term reaches the caller as `SearchTermTooShort`
                     // rather than as a message that crossed the RPC boundary. The DO judges again.
                     searchMatchExpression(term, 'prefix');
-                    return unwrapCapabilityReply(await stub.capabilityAttachmentSearch(term, searchLimit(options?.limit), hash, tenantId, scopeId));
+                    return unwrapReply(await stub.capabilityAttachmentSearch(term, searchLimit(options?.limit), hash, tenantId, scopeId));
                 },
             };
         }
@@ -1457,7 +1648,7 @@ export class CloudflareScopeHost {
                     throw new Error('attachments.search is not available on a delivery-scoped surface');
                 }
                 searchMatchExpression(term, 'prefix');
-                return unwrapCapabilityReply(await stub.attachmentSearch(term, searchLimit(options?.limit), asPrincipalId, tenantId, scopeId, connectionId));
+                return unwrapReply(await stub.attachmentSearch(term, searchLimit(options?.limit), asPrincipalId, tenantId, scopeId, connectionId));
             },
         };
     }
@@ -1505,16 +1696,51 @@ export class CloudflareScopeHost {
         // this is the scope's real store, as for the provision's seat above; a hosted scope is
         // restored in its deployment, which the platform carries the same list to.
         const ownStore = this.cpLess || existing.vertical === null;
-        const recordedOff = ownStore ? await this.cp.switchedOffModulesOf(tenantId, scopeId) : [];
+        const replayAt = new Date().toISOString();
+        const carry = ownStore ? await this.recordedOffCarry(tenantId, scopeId, replayAt) : undefined;
         const switchedOff = await this.scopeStub(scopeId).importDump(dump.tables, scopeId, {
-            switchOff: recordedOff.length ? { moduleIds: recordedOff, at: new Date().toISOString() } : undefined,
+            switchOff: carry ? { at: replayAt, ...carry } : undefined,
             sourceScopeId: opts?.sourceScopeId ?? dump.scopeId,
         });
         await this.recordAdmin(actor, 'restoreScope', { tenantId, scopeId }, null, { sourceScopeId: dump.scopeId, tables: dump.tables.length, capturedAt: dump.capturedAt });
-        if (recordedOff.length) {
+        if (carry) {
             await this.admin.reassertSystemSwitches(actor, { tenantId, scopeId }, { appliedInUnit: switchedOff });
         }
     }
+    /**
+     * #1742, #2029: what this host's own unit carries of the directory's record — the modules and
+     * the peers recorded OFF on the scope, each with the ones held there only by a tenant-level
+     * grant (#1823, #2030). Undefined when nothing is recorded off, so such a unit is unchanged.
+     */
+    async recordedOffCarry(tenantId, scopeId, at) {
+        const [modules, peers] = await Promise.all([
+            this.recordedOff('system', tenantId, scopeId, at),
+            this.recordedOff('peer', tenantId, scopeId, at),
+        ]);
+        if (!modules.keys.length && !peers.keys.length)
+            return undefined;
+        return {
+            moduleIds: modules.keys,
+            tenantHeld: modules.tenantHeld,
+            verticals: peers.keys,
+            tenantHeldVerticals: peers.tenantHeld,
+            fences: switchFencesCarried([
+                ['system', modules],
+                ['peer', peers],
+            ]),
+        };
+    }
+    /** The subjects of one kind the directory records OFF on the scope, and of those the tenant-held ones. */
+    async recordedOff(kind, tenantId, scopeId, at) {
+        // #2045: the OFF rows and their fences in one read, so every key carried has its own row's fence.
+        const fences = new Map((await this.cp.switchRecordStatesOf(kind, tenantId, scopeId))
+            .filter(([, row]) => row.position === 'off')
+            .map(([key, row]) => [key, row.fence]));
+        const keys = [...fences.keys()];
+        if (!keys.length)
+            return { keys, tenantHeld: [], fences };
+        return { keys, tenantHeld: await this.cp.tenantHeldOf(kind, tenantId, keys, at), fences };
+    }
     async snapshotScope(actor, tenantId, scopeId, opts) {
         const source = await this.admin.getScopeRecord(actor, tenantId, scopeId);
         if (!source)
@@ -1545,7 +1771,7 @@ export class CloudflareScopeHost {
         if (!rec)
             throw substratError('not_found', `unknown scope ${scopeId} in tenant ${tenantId}`);
         if (!rec.forkedFrom && rec.kind !== 'preview') {
-            throw new Error(`scope ${scopeId} is not a fork or preview — only previews may be deleted; ` +
+            throw substratError('forbidden', `scope ${scopeId} is not a fork or preview — only previews may be deleted; ` +
                 `archive a primary scope instead`);
         }
         // Storage BEFORE the directory row: a crash between the two leaves a visible row
@@ -1685,12 +1911,134 @@ export class CloudflareScopeHost {
      * against `system:<moduleId>` grants inside the stub.
      */
     async getSystemScope(moduleId, tenantId, scopeId) {
+        return this.buildStub(tenantId, scopeId, undefined, undefined, await this.openSystemDoor(moduleId, tenantId, scopeId));
+    }
+    /**
+     * #1834: the system door — the ONE place every entry acting as `system:<moduleId>` passes
+     * through: a schedule's fire, a job run's `pass.scope()`, a module's attachment open. The
+     * module must be registered here and the scope live, as before. Then the door GATES: the
+     * scope's own state read for the module, and after it the rewind hold (#1819), in the order
+     * `SWITCH_HOLD_SETTLE_MS` relies on. A module the hold keeps off is refused here, as a
+     * schedule pass skips it.
+     *
+     * A gate read is about the instance that answered it, and a door can be held for as long as
+     * a job pass runs. So every call through the door is PINNED to that instance: the DO refuses
+     * one that lands on another (`SYSTEM_DOOR_MOVED`), since a PITR restore always restarts the
+     * object, and the door gates again and retries. A restart within one call's round trip is
+     * rare, so past `SYSTEM_DOOR_REGATES` it fails closed (`unavailable`). No clock is involved:
+     * the gate and the call meet the same storage, or the call does not run.
+     */
+    async openSystemDoor(moduleId, tenantId, scopeId, gated, 
+    /** #1834: the job pass this door is opened for; its "not now" refusals are tied to it. */
+    pass) {
         if (!this.moduleIds.has(moduleId)) {
-            throw new Error(`module not registered on this host: ${moduleId}`);
+            throw substratError('not_found', `module not registered on this host: ${moduleId}`);
         }
         await this.assertLive(tenantId, scopeId);
         await this.migrateAndRecord(scopeId);
-        return this.buildStub(tenantId, scopeId, undefined, undefined, moduleId);
+        return this.openDoor('system', moduleId, scopeId, gated, pass);
+    }
+    /**
+     * #1834: one door, for either kind of switched subject (#2029). The gate is read here unless the
+     * caller read it (`runDueSchedules` reports a hold it could not read on its pass report); a held
+     * subject is refused, and a call landing on another instance than the gate's re-gates, at most
+     * `SYSTEM_DOOR_REGATES` times, then fails closed.
+     *
+     * The peer door (`kind: 'peer'`) is the system door's for a peer vertical. A PITR rewind to before
+     * a peer was switched off brings its grants back live and its OFF marker gone, so the rewind holds
+     * it outside the scope (`rewindHolding`, as for a module), and every peer entry — an invoke, a
+     * delivery, a coverage read, an export read for it as consumer — opens this door after
+     * `peerScopeGate`.
+     */
+    async openDoor(kind, key, scopeId, gated, pass) {
+        const words = DOOR_WORDS[kind];
+        const what = words.what(key);
+        // A gate this door reads itself reports a hold it could not read; one handed in was the
+        // caller's to report.
+        const regate = async () => {
+            const fresh = await this.doorGate(kind, scopeId, key);
+            if (fresh.error)
+                console.error(`substrat: door of ${what} on ${scopeId}: ${fresh.error}`);
+            return fresh;
+        };
+        let gate = gated ?? (await regate());
+        return {
+            kind,
+            key,
+            through: async (call) => {
+                for (let regates = 0;; regates += 1) {
+                    if (gate.held) {
+                        // The hold ends when the switch is applied again: a job run waits it out without
+                        // spending its retries, because the driver defers on THIS refusal (`doorWait`).
+                        const held = substratError('forbidden', `${what} is held off on this scope: it was rewound to before its ` +
+                            `${words.switchName} switch was turned off, and it stays off until ` +
+                            'the switch is applied again', { reason: SYSTEM_DOOR_WAIT });
+                        this.heldRefusals.add(held);
+                        throw this.doorWait(pass, held);
+                    }
+                    const answer = await call(gate.instance);
+                    if (!isSystemDoorMoved(answer))
+                        return answer;
+                    if (regates >= SYSTEM_DOOR_REGATES) {
+                        throw this.doorWait(pass, substratError('unavailable', `the scope kept restarting under the ${words.door} of ${what} ` +
+                            `(${regates + 1} attempts); nothing ran. Retry later`, { reason: SYSTEM_DOOR_WAIT }));
+                    }
+                    gate = await regate();
+                }
+            },
+        };
+    }
+    /**
+     * #1834: the refusals this host's system door threw that mean "not now" (a hold, a scope that
+     * kept restarting), each tied by identity to the job pass whose door threw it. The job driver
+     * defers a pass only on one of these, never on an error's shape, which any step or operation
+     * could copy. A mark is ORIGIN and FRESHNESS together: it is consumed when the driver takes it,
+     * and only the pass it names can take it, so a handler that keeps a refusal and throws it again
+     * on a later pass is an ordinary failure there. Held weakly: an error nobody holds goes.
+     */
+    doorWaits = new WeakMap();
+    /**
+     * #2029: the hold refusals this host's doors threw, by identity — so a peer delivery pauses its
+     * edge, and a coverage read answers "holds nothing", on exactly those and on no error that only
+     * looks like one. Held weakly, as `doorWaits` is.
+     */
+    heldRefusals = new WeakSet();
+    /** #2029: is `err` a hold refusal this host's door threw? */
+    isHeldRefusal(err) {
+        return typeof err === 'object' && err !== null && this.heldRefusals.has(err);
+    }
+    /** #1834: mark this door's own refusal as "not now" for the pass it was opened for, and hand it back. */
+    doorWait(pass, err) {
+        if (pass)
+            this.doorWaits.set(err, pass);
+        return err;
+    }
+    /** #1834: is `err` a "not now" this host's door threw on `pass`? Consumes the mark when it is. */
+    takeDoorWait(err, pass) {
+        if (typeof err !== 'object' || err === null || this.doorWaits.get(err) !== pass)
+            return false;
+        this.doorWaits.delete(err);
+        return true;
+    }
+    /**
+     * #1834: a door's gate — the scope's state read for the subject, the instance that answered it,
+     * and then the rewind hold (#1819), for any subject the scope does not already have off. The
+     * hold is read AFTER the state, which is the order `switchHeld` needs.
+     *
+     * `ungranted` reads the hold too (#2029): a subject held on the scope only by a TENANT-level
+     * grant (#1823, #2030) comes back from a rewind with no scope grant and no marker, and the
+     * tenant grant still authorizes it there. A rewind captured it off, so the hold must keep it so.
+     */
+    async doorGate(kind, scopeId, key) {
+        const stub = this.scopeStub(scopeId);
+        const { state, instance } = await (kind === 'system' ? stub.systemDoorState(key) : stub.peerDoorState(key));
+        const cleared = `${scopeId} ${instance}`;
+        if (state === 'off' || CLEAR_SCOPE_INSTANCES.has(cleared))
+            return { state, instance, held: false };
+        const hold = await this.switchHeld(scopeId, holdKeyOf(kind, key));
+        if (hold.scopeClear)
+            rememberClearInstance(cleared);
+        return { state, instance, held: hold.held, ...(hold.error ? { error: hold.error } : {}) };
     }
     /**
      * #1705: the consumer half. The same lifecycle gate as every door (K-3), then the ScopeDO
@@ -1703,8 +2051,25 @@ export class CloudflareScopeHost {
         // The peer door's own gate (#1706): K-3's pair check, the refusal for a scope served
         // elsewhere, the lifecycle check and the migration. A delivery is a write into the
         // consumer's scope, so it takes the gate an invoke through that door takes.
-        await this.peerScopeGate(tenantId, scopeId, 'deliverToPeer');
-        const result = importResult.parse(await this.scopeStub(scopeId).importApply(batch, tenantId, scopeId));
+        const record = await this.peerScopeGate(tenantId, scopeId, 'deliverToPeer');
+        // #2004: a copy consumes no other vertical's events, at the door as in the sweep
+        // (`scope-copy.ts`). A pause: nothing runs and the watermark stays.
+        if (await this.isInertScope(tenantId, scopeId, record)) {
+            return { ...emptyImportResult(batch), paused: { reason: INERT_SCOPE_REASON } };
+        }
+        // #2029: the producer is a peer, so the delivery goes through its door: a producer the rewind
+        // hold keeps off pauses the edge, exactly as a switched-off one does inside the DO.
+        const door = await this.openDoor('peer', batch.source.vertical, scopeId);
+        let applied;
+        try {
+            applied = await door.through((instance) => this.scopeStub(scopeId).importApply(batch, tenantId, scopeId, instance));
+        }
+        catch (err) {
+            if (!this.isHeldRefusal(err))
+                throw err;
+            return { ...emptyImportResult(batch), paused: { reason: err.message } };
+        }
+        const result = importResult.parse(applied);
         if (result.delivered > 0) {
             try {
                 await this.drainExecutors(tenantId, scopeId, null);
@@ -1748,7 +2113,9 @@ export class CloudflareScopeHost {
     async getVerticalScope(caller, tenantId, scopeId, options) {
         const parsed = verticalCaller.parse(caller);
         await this.peerScopeGate(tenantId, scopeId, 'getVerticalScope');
-        return this.buildStub(tenantId, scopeId, undefined, undefined, undefined, options, undefined, undefined, parsed);
+        // #2029: gated against the rewind hold and pinned, as the system door is.
+        const door = await this.openDoor('peer', parsed.vertical, scopeId);
+        return this.buildStub(tenantId, scopeId, undefined, undefined, door, options, undefined, undefined, parsed);
     }
     /**
      * Does peer `vertical` hold each key at this scope's node now (#1706) — the ScopeDO's own
@@ -1756,9 +2123,19 @@ export class CloudflareScopeHost {
      */
     async peerCovers(tenantId, scopeId, vertical, permissions) {
         await this.peerScopeGate(tenantId, scopeId, 'peerCovers');
-        return peerCoverage
-            .array()
-            .parse(await this.scopeStub(scopeId).peerCovers(tenantId, scopeId, verticalSlug.parse(vertical), [...permissions]));
+        const slug = verticalSlug.parse(vertical);
+        // #2029: a peer the rewind hold keeps off holds nothing here, as a switched-off one doesn't.
+        const door = await this.openDoor('peer', slug, scopeId);
+        try {
+            return peerCoverage
+                .array()
+                .parse(await door.through((instance) => this.scopeStub(scopeId).peerCovers(tenantId, scopeId, slug, [...permissions], instance)));
+        }
+        catch (err) {
+            if (this.isHeldRefusal(err))
+                return permissions.map((permission) => ({ permission, held: false }));
+            throw err;
+        }
     }
     /**
      * `ctx.canAssign`'s bound for a principal the host names (#1931) — the ScopeDO's own role read
@@ -1772,7 +2149,7 @@ export class CloudflareScopeHost {
         // provisioning receipt is K-3 here (#1738), read before anything migrates the DO, and the
         // refusal reads as the pure host's does: an unknown scope, not an unknown role.
         if (this.cpLess && !(await this.scopeStub(scopeId).servesTenant(tenantId))) {
-            throw substratError('not_found', `unknown scope for tenant: (${tenantId}, ${scopeId})`);
+            throw unknownScopeForTenant(tenantId, scopeId);
         }
         await this.peerScopeGate(tenantId, scopeId, 'canAssign');
         const bound = await this.scopeStub(scopeId).canAssignFor(tenantId, scopeId, principalId.parse(principal), roleKey);
@@ -1782,7 +2159,7 @@ export class CloudflareScopeHost {
     }
     async assignScopeRoleBounded(tenantId, scopeId, caller, assignee, roleKey) {
         if (this.cpLess && !(await this.scopeStub(scopeId).servesTenant(tenantId))) {
-            throw substratError('not_found', `unknown scope for tenant: (${tenantId}, ${scopeId})`);
+            throw unknownScopeForTenant(tenantId, scopeId);
         }
         await this.peerScopeGate(tenantId, scopeId, 'assignScopeRoleBounded');
         const bound = await this.scopeStub(scopeId).assignScopeRoleBoundedFor(tenantId, scopeId, principalId.parse(caller), principalId.parse(assignee), roleKey);
@@ -1804,15 +2181,33 @@ export class CloudflareScopeHost {
         // door's own tenant-confinement test proved. A RECORD crosses intact, so the coordinator
         // reads the record and types the refusal itself. `validateScopeAccess` still runs below
         // and still owns the lifecycle half (a suspended tenant or scope).
+        let record;
         if (!this.cpLess) {
-            const record = await this.cp.getScopeRecord(tenantId, scopeId);
+            record = await this.cp.getScopeRecord(tenantId, scopeId);
             if (!record) {
-                throw substratError('not_found', `unknown scope for tenant: (${tenantId}, ${scopeId})`);
+                throw unknownScopeForTenant(tenantId, scopeId);
             }
             this.assertServedHere(record, scopeId, verb);
         }
         await this.assertLive(tenantId, scopeId);
         await this.migrateAndRecord(scopeId);
+        return record;
+    }
+    /**
+     * Whether this scope is held inert (#2005): a fork, a snapshot or a preview, which causes no
+     * outbound effects and consumes no other vertical's events (#2004). The one primacy question
+     * every such door asks. Where there is a directory its record answers (`record`, the one
+     * `peerScopeGate` returns, when the caller has already read it). A CP-less host has none, so it asks the scope's own storage
+     * whether it is classified a copy (`_substrat_copy_origin`'s `is_copy`, #2009, set on the
+     * directory's word): a preview and a snapshot reach a hosted vertical as restores the
+     * platform marks.
+     */
+    isInertScope(tenantId, scopeId, record) {
+        if (this.cpLess)
+            return this.scopeStub(scopeId).isCopy();
+        if (record)
+            return Promise.resolve(!isPrimaryScopeRow(record));
+        return this.cp.getScopeRecord(tenantId, scopeId).then((row) => !isPrimaryScopeRow(row));
     }
     /**
      * The capability's attachment door (#1686) — `getCapabilityScope`'s gate, then the
@@ -1875,7 +2270,7 @@ export class CloudflareScopeHost {
     async capabilityScopeStub(tenantId, scopeId, verb) {
         const rec = await this.cp.getScopeRecord(tenantId, scopeId);
         if (!rec)
-            throw substratError('not_found', `unknown scope for tenant: (${tenantId}, ${scopeId})`);
+            throw unknownScopeForTenant(tenantId, scopeId);
         if (this.servesScopesElsewhereNow && rec.vertical !== null) {
             throw substratError('unavailable', `${verb} cannot reach scope ${scopeId}: it is served by the '${rec.vertical}' ` +
                 'deployment, and platform capability verbs are not delegated there yet');
@@ -1921,7 +2316,9 @@ export class CloudflareScopeHost {
             if (!rec || rec.status !== 'active')
                 return report;
         }
-        else if (await this.lifecycleHeld(scopeId)) {
+        else if (lifecycleRefusal(await this.validateScopeAccess(tenantId, scopeId)) !== null) {
+            // #2016: the pair is held to the scope's own record first, so a sweep roster entry whose
+            // tenant disagrees with the scope is refused before the probe reads or writes anything.
             // #1713: a held scope emits nothing, so judging it stale would only raise a false alarm.
             return report;
         }
@@ -1963,13 +2360,15 @@ export class CloudflareScopeHost {
             return report;
         // Only run on a live scope of this tenant; a scope archived between the sweep's
         // enumeration and here simply has nothing due. A CP-less host has no directory
-        // to ask (#461), so it reads the lifecycle the platform delivered to the scope (#1713).
+        // to ask (#461), so it reads the lifecycle the platform delivered to the scope (#1713), in
+        // the same call that holds the pair to the scope's own record (#2016): a roster entry whose
+        // tenant disagrees is refused before a grant, a cadence row or a run is read or written.
         if (!this.cpLess) {
             const rec = await this.cp.getScopeRecord(tenantId, scopeId);
             if (!rec || rec.status !== 'active')
                 return report;
         }
-        else if (await this.lifecycleHeld(scopeId)) {
+        else if (lifecycleRefusal(await this.validateScopeAccess(tenantId, scopeId)) !== null) {
             // #1713: the lifecycle the platform delivered holds the scope. Every schedule is
             // `skipped` and no cadence row moves, as under the kill switch, so a schedule that
             // came due meanwhile fires once on the first pass after the scope is live again.
@@ -1986,15 +2385,15 @@ export class CloudflareScopeHost {
         // never held the module's grant (a foreign vertical's) is a quiet no-op, exactly as
         // before. A scope switched OFF reports every schedule `skipped`, never `failed`, and
         // does not touch its cadence rows — so a restore fires a due schedule on the next pass.
-        const state = await stub.systemScheduleState(moduleId);
-        if (state === 'ungranted')
+        // #1819: a scope rewound to before its switch was pulled answers `on`, and the rewind held
+        // the module outside the scope. Both are read by the system door's own gate (#1834), which
+        // every fire below then goes through, pinned to the instance this read came from.
+        const gate = await this.doorGate('system', scopeId, moduleId);
+        if (gate.state === 'ungranted')
             return report;
-        // #1819: a scope rewound to before its switch was pulled answers `on`. The rewind held the
-        // module outside the scope; read AFTER the state, which is the order `switchHeld` needs.
-        const hold = state === 'on' ? await this.switchHeld(scopeId, moduleId) : { held: false };
-        if (hold.error)
-            report.errors.push({ operation: 'switch-hold', error: hold.error });
-        if (state === 'off' || hold.held) {
+        if (gate.error)
+            report.errors.push({ operation: 'switch-hold', error: gate.error });
+        if (gate.state === 'off' || gate.held) {
             for (const schedule of schedules) {
                 report.skipped += 1;
                 report.runs.push({ operation: schedule.operation, outcome: 'skipped' });
@@ -2004,6 +2403,7 @@ export class CloudflareScopeHost {
         }
         const now = Date.now();
         const lines = asyncLinePass();
+        let door;
         for (const schedule of schedules) {
             const last = await stub.scheduleLastRun(schedule.operation);
             const lastRun = last ? Date.parse(last) : null;
@@ -2023,7 +2423,10 @@ export class CloudflareScopeHost {
             let emitted;
             let failure;
             try {
-                const scope = await this.getSystemScope(moduleId, tenantId, scopeId);
+                // The gate above already answered for this pass; a fire that meets a restarted scope
+                // is gated again by the door (#1834).
+                door ??= await this.openSystemDoor(moduleId, tenantId, scopeId, gate);
+                const scope = this.buildStub(tenantId, scopeId, undefined, undefined, door);
                 await scope.invoke(schedule.operation, schedule.input, { invocationId, onEmitted: (r) => (emitted = r) });
                 report.fired += 1;
             }
@@ -2058,7 +2461,13 @@ export class CloudflareScopeHost {
         return report;
     }
     /** The stub body, shared by the principal, connection, system and impersonation doors. */
-    buildStub(tenantId, scopeId, principal, connectionId, systemModuleId, options, 
+    buildStub(tenantId, scopeId, principal, connectionId, 
+    /**
+     * #1834: the door this stub acts through. The ONLY way to make a stub acting as
+     * `system:<moduleId>`: the module is the door's, and every invoke is gated and pinned by it.
+     * #2029: a peer stub's door too (`openDoor('peer', …)`), gating and pinning each invoke the same way.
+     */
+    door, options, 
     /**
      * K-42: the session this stub acts under. Re-read from the directory on
      * EVERY invoke rather than captured here — a stub is a capability and
@@ -2079,6 +2488,7 @@ export class CloudflareScopeHost {
      */
     verticalCaller) {
         const stub = this.scopeStub(scopeId);
+        const systemModuleId = door?.kind === 'system' ? door.key : undefined;
         const cp = this.cp;
         const operationEntitlement = this.operationEntitlement;
         // The DO needs SOME principal-shaped value for `ctx.principal`; for a
@@ -2133,7 +2543,15 @@ export class CloudflareScopeHost {
                 }
                 // K-42: resolved per invoke, so expiry and `endImpersonation` both bite.
                 const session = sessionId === undefined ? undefined : await this.resolveImpersonation(sessionId, tenantId, scopeId);
-                const envelope = await stub.invoke(operation, input, asPrincipalId, tenantId, scopeId, connectionId, requiredKey, systemModuleId, true, invokeOptions, session, capabilitySession, verticalCaller);
+                const send = (systemDoorInstance) => stub.invoke(operation, input, asPrincipalId, tenantId, scopeId, connectionId, requiredKey, systemModuleId, true, invokeOptions, session, capabilitySession, verticalCaller, systemDoorInstance);
+                // #1834: through the door (a module's, or #2029 a peer's), pinned to the instance its gate
+                // read. A missed pin comes back as an answer, which `through` re-gates on.
+                const envelope = door
+                    ? await door.through(async (instance) => {
+                        const sent = await send(instance);
+                        return sent.systemDoorMoved === true ? SYSTEM_DOOR_MOVED : sent;
+                    })
+                    : await send();
                 // The operation failed and the DO handed the error back as DATA — so it still
                 // has its code and extensions, which a throw across this boundary would have
                 // stripped down to a message (#113 §3). Rethrown here, where the caller expects
@@ -2182,6 +2600,12 @@ export class CloudflareScopeHost {
                     throw substratError('unavailable', `${operation} ran on a scope host that did not understand peer callers. ` +
                         'Retry once the scope has been migrated');
                 }
+                // #1834, the same shape: a DO too old to know the door's pin ran the call without
+                // checking it met the storage the door's gate read.
+                if (door !== undefined && envelope.systemDoor?.honoured !== true) {
+                    throw substratError('unavailable', `${operation} ran on a scope host that did not understand the system door's pin. ` +
+                        'Retry once the scope has been migrated');
+                }
                 if (session !== undefined && envelope.impersonation?.honoured !== true) {
                     throw substratError('unavailable', `${operation} ran on a scope host that did not understand impersonation — the ` +
                         'operation may have run unrecorded and unbounded. Retry once the scope has ' +
@@ -2192,11 +2616,13 @@ export class CloudflareScopeHost {
                 // this scope's outbox — and draining anyway would run executors and
                 // connectors as a side effect of a session that may not have side effects.
                 // Whatever the outbox already held is the drain sweep's own backstop.
+                // #1184: what this call's executors did inline, for `onExecutorOutcomes`.
+                const executorOutcomes = invokeOptions?.onExecutorOutcomes ? [] : undefined;
                 const drained = session?.mode === 'read-only'
                     ? { attempted: 0, delivered: 0, retrying: 0, deadLettered: 0, routedToPlatform: 0 }
                     // #1525: this drain is part of the call that emitted the events — the
                     // coordinator's half of the post-commit tail the DO ran the consumers in.
-                    : await this.drainExecutors(tenantId, scopeId, invokeOptions?.invocationId ?? null);
+                    : await this.drainExecutors(tenantId, scopeId, invokeOptions?.invocationId ?? null, executorOutcomes);
                 // #458: the operation committed having enqueued platform intents — tell the
                 // caller's harness so it can flag the response for the router kick (#381).
                 // Routed connector deliveries (#574 phase 3) count too: the inline drain just
@@ -2213,6 +2639,9 @@ export class CloudflareScopeHost {
                     invokeOptions?.onIdempotentReplay?.();
                 if (envelope.emitted)
                     invokeOptions?.onEmitted?.(envelope.emitted);
+                if (executorOutcomes && session?.mode !== 'read-only' && !envelope.idempotency?.replayed) {
+                    invokeOptions?.onExecutorOutcomes?.(executorOutcomes);
+                }
                 return envelope.result;
             },
         };
@@ -2305,7 +2734,7 @@ export class CloudflareScopeHost {
          */
         const requireOrg = async (tenant, id) => {
             if (!(await this.cp.readOrg(tenant, id))) {
-                throw new Error(`unknown org ${id} in tenant ${tenant}`);
+                throw substratError('not_found', `unknown org ${id} in tenant ${tenant}`);
             }
         };
         const mapScope = (r) => scopeSchema.parse({
@@ -2392,202 +2821,224 @@ export class CloudflareScopeHost {
             }
         };
         /**
-         * #1666: move one module's schedule switch on one scope — see `HostAdmin.revokeFromSystem`.
+         * Where one scope's kill switch of one kind lands — the ONE rule the operator's switch and
+         * the #1674 re-assert share, so a re-assert moves exactly the switch an operator's OFF would
+         * have. `kind` is a module's schedule switch (#1666) or a peer's (#1706, #2029); `key` is the
+         * module id or the peer's slug.
          *
          * Where the write lands is the whole point of the delegation branch. The shared control
-         * plane's own `SCOPE` namespace is the module-less placeholder, so a hosted scope's
-         * switch has to be moved in the deployment serving it; writing it here would report a
-         * switch pulled while every schedule kept firing. The audit row is written HERE either
-         * way — the deployment's host is CP-less, and its `recordAdmin` is a no-op.
-         */
-        /**
-         * #1706: move one PEER's kill switch on one scope — see `HostAdmin.revokeFromPeer`. The
-         * schedule switch's audit discipline (intent first, outcome after, every attempt) and,
-         * since part 3, its delegation: a scope served by a vertical's own deployment is switched
-         * THERE, over `PeerSwitchDelegation`. Without one configured the scope is still refused
-         * `unavailable` (`peerScopeGate`) rather than switched in the placeholder namespace.
+         * plane's own `SCOPE` namespace is the module-less placeholder, so a hosted scope's switch
+         * has to be moved in the deployment serving it, over that kind's delegation; writing it here
+         * would report a switch pulled while every schedule kept firing, or every peer call kept
+         * being admitted. A scope bound to no vertical (#1666 review) has no deployment to delegate
+         * to: its store is the DO here, so the switch moves (or answers `held: false`) here too.
+         * Delegating it would throw "no deployment serving scope" instead.
          */
-        const switchPeerAt = async (actor, raw, to) => {
-            const input = peerSwitch.parse(raw);
-            const { tenantId, scopeId } = input.node;
+        const switchTarget = async (kind, tenantId, scopeId) => {
             let vertical = null;
             if (!this.cpLess) {
                 const rec = await this.cp.getScopeRecord(tenantId, scopeId);
                 if (!rec)
-                    throw substratError('not_found', `unknown scope for tenant: (${tenantId}, ${scopeId})`);
+                    throw unknownScopeForTenant(tenantId, scopeId);
                 vertical = rec.vertical;
             }
-            const action = to === 'off' ? 'revokeFromPeer' : 'restoreToPeer';
-            // Where the write lands is the whole point of this branch (#1706 part 3, mirroring
-            // #1666). A scope bound to a vertical is served by that vertical's own deployment, and
-            // its `vertical:<slug>` grants live there; switching it in the shared control plane's
-            // placeholder namespace would tombstone nothing and report a peer cut off while every
-            // call it makes kept being admitted. A scope bound to NO vertical has its store here,
-            // so it switches here — delegating it would throw "no deployment serving scope".
-            // With no delegation configured the old refusal stands, loudly, rather than a write
-            // into the wrong namespace.
-            const delegation = this.cpLess || vertical !== null ? this.peerSwitchDelegation : undefined;
-            if (delegation) {
-                // The gate's lifecycle half still runs (a suspended tenant or scope cannot be
-                // switched); its `scopeStub` half is what the delegation replaces.
-                await this.validateScopeAccess(tenantId, scopeId);
-            }
-            else {
-                await this.peerScopeGate(tenantId, scopeId, action);
-            }
-            const operationId = ulid();
-            const target = { tenantId, scopeId, vertical };
-            const base = { operationId, vertical: input.vertical, calls: to };
-            await this.recordAdmin(actor, action, target, null, { ...base, phase: 'intent', reason: input.reason });
-            let outcome;
-            try {
-                outcome = delegation
-                    ? await delegation.switch({ tenantId, scopeId, vertical: input.vertical, to })
-                    : await this.scopeStub(scopeId).switchPeer(input.vertical, scopeId, to, new Date().toISOString());
-            }
-            catch (err) {
-                await this.recordAdmin(actor, action, target, null, {
-                    ...base,
-                    phase: 'failed',
-                    error: err instanceof Error ? err.message : String(err),
-                }).catch(() => undefined);
-                throw err;
-            }
-            await this.recordAdmin(actor, action, target, null, {
-                ...base,
-                phase: outcome.held ? 'applied' : 'refused',
-                changed: outcome.changed,
-                permissions: outcome.permissions,
-            });
-            if (!outcome.held) {
-                throw substratError('not_found', `scope ${scopeId} holds no grant for peer '${input.vertical}' — nothing to switch ${to} ` +
-                    `(check the slug: it is the calling vertical's registry id, as the target's \`peers\` names it)`);
-            }
-            return {
-                operationId,
-                vertical: input.vertical,
-                calls: to,
-                changed: outcome.changed,
-                permissions: outcome.permissions,
+            const hosted = this.cpLess || vertical !== null;
+            const systemDelegation = kind === 'system' && hosted ? this.systemSwitchDelegation : undefined;
+            const peerDelegation = kind === 'peer' && hosted ? this.peerSwitchDelegation : undefined;
+            const delegated = systemDelegation !== undefined || peerDelegation !== undefined;
+            // #1819: a scope whose store is here was rewound here, so `switchInScope` releases its
+            // hold here too. A delegated move releases in the deployment serving the scope.
+            // #1823 (#2030 for a peer): a subject whose only authority on the scope is a TENANT-level
+            // grant has nothing in the scope's storage for the switch to find, so the directory says
+            // whether it is held. A caller moving several reads them in one call and passes each in.
+            // An OFF of a tenant-held MODULE is refused, after the far end answers, unless that answer
+            // attests the evaluator that denies a tenant-level grant (`deniesTenantGrants`). A
+            // deployment built before #1823 drops `tenantHeld`, still answers `held: true` (the module's
+            // scope-level grants were there to switch), and keeps authorizing the tenant-level grant —
+            // so its `held` alone would have the platform record a scope off that is not. A peer needs
+            // no attestation: its door refuses on the marker in every build that has the peer switch at
+            // all (`admitPeer` and `switchPeer` arrived together, #1714). Every OFF the platform drives
+            // moves through here: an operator's (`switchSubjectAt`) and a re-assert's, which every carry
+            // ends with.
+            //
+            // #2045 (Codex r3): whether a delegated deployment honours the switch fence is settled
+            // BEFORE anything moves (`attestFence`, once per target), never after the fact by putting a
+            // move back. Without the fence an ON is refused and an OFF goes through unfenced (see
+            // `UnattestedSwitch`). A move a fenced deployment answers without the attestation still
+            // throws, as defence in depth against a rollback between the preflight and the move.
+            const delegation = systemDelegation ?? peerDelegation;
+            let attested;
+            const attestFence = () => (attested ??= delegation ? delegation.fenceSupported({ tenantId, scopeId }) : Promise.resolve(true));
+            const move = async (key, to, at, tenantHeld, 
+            /** #2045: the switch call's fence — its operation id, or for a re-assert the record's. */
+            fence) => {
+                const fenced = await attestFence();
+                if (!fenced && to === 'on')
+                    throw new UnattestedSwitch(unfencedMessage(scopeId));
+                const held = tenantHeld ?? (await this.cp.tenantHeldOf(kind, tenantId, [key], at)).length > 0;
+                const outcome = await (systemDelegation
+                    ? systemDelegation.switch({ tenantId, scopeId, moduleId: key, to, tenantHeld: held, fence })
+                    : peerDelegation
+                        ? peerDelegation.switch({ tenantId, scopeId, vertical: key, to, tenantHeld: held, fence })
+                        : this.switchInScope(kind, scopeId, key, to, at, held, fence));
+                // An unfenced OFF answers without `fenced`, and that is what the callers read it by.
+                if (fenced && outcome.fenced !== true)
+                    throw new UnattestedSwitch(unfencedMessage(scopeId));
+                if (outcome.superseded)
+                    return outcome;
+                if (kind === 'system' && to === 'off' && held && outcome.held && outcome.deniesTenantGrants !== true) {
+                    throw new UnattestedSwitch(undeniedMessage(scopeId, key));
+                }
+                return outcome;
             };
+            return { vertical, delegated, move, attestFence };
         };
         /**
-         * Where one scope's schedule switch lands — the ONE rule `switchSystem` and the #1674
-         * re-assert share, so a re-assert moves exactly the switch an operator's OFF would have.
-         * A scope bound to no vertical (#1666 review) has no deployment to delegate to: its store
-         * is the DO here, so the switch moves (or answers `held: false`) here too. Delegating it
-         * would throw "no deployment serving scope" instead. A scope WITH a vertical still
-         * delegates, and still fails loudly when none serves it.
+         * One kill switch moved on one scope — the ONE body `revokeFromSystem` / `restoreToSystem`
+         * (#1666) and `revokeFromPeer` / `restoreToPeer` (#1706) share, so the two levers cannot
+         * disagree about the record, the audit, the readback or the undo (#2029). The audit row is
+         * written HERE either way — a deployment's host is CP-less, and its `recordAdmin` is a no-op.
          */
-        const systemSwitchTarget = async (tenantId, scopeId) => {
-            let vertical = null;
-            if (!this.cpLess) {
-                const rec = await this.cp.getScopeRecord(tenantId, scopeId);
-                if (!rec)
-                    throw substratError('not_found', `unknown scope for tenant: (${tenantId}, ${scopeId})`);
-                vertical = rec.vertical;
+        const switchSubjectAt = async (actor, kind, node, key, reason, to) => {
+            const { tenantId, scopeId } = node;
+            const { vertical, delegated, move, attestFence } = await switchTarget(kind, tenantId, scopeId);
+            const action = switchActionOf(kind, to);
+            if (kind === 'peer') {
+                // The peer door's gate (#1706): with a delegation, its lifecycle half (a suspended tenant
+                // or scope cannot be switched), the `scopeStub` half being what the delegation replaces.
+                // Without one, a hosted scope is refused `unavailable` rather than switched in the
+                // placeholder namespace, where it would tombstone nothing a peer call reads.
+                if (delegated)
+                    await this.validateScopeAccess(tenantId, scopeId);
+                else
+                    await this.peerScopeGate(tenantId, scopeId, action);
             }
-            const delegation = this.cpLess || vertical !== null ? this.systemSwitchDelegation : undefined;
-            // #1819: a scope whose store is here was rewound here, so `switchInScope` releases its
-            // hold here too. A delegated move releases in the deployment serving the scope.
-            const move = (moduleId, to, at) => delegation
-                ? delegation.switch({ tenantId, scopeId, moduleId, to })
-                : this.switchInScope(scopeId, moduleId, to, at);
-            return { vertical, move };
-        };
-        const switchSystem = async (actor, raw, to) => {
-            const input = systemSwitch.parse(raw);
-            const { tenantId, scopeId } = input.node;
-            const { vertical, move } = await systemSwitchTarget(tenantId, scopeId);
             // AUDIT FIRST (#1666 review): the intent row lands before anything moves, and the
             // outcome row after — every attempt, a repeat included. The scope's store and the
             // admin log are separate, so no order makes the pair atomic; this one fails toward
             // "an intent with no recorded outcome" and never toward "a switch that moved with no
             // audit row". A retry after a crash re-audits even though it answers `changed: false`.
             const operationId = ulid();
-            const action = to === 'off' ? 'revokeFromSystem' : 'restoreToSystem';
             const target = { tenantId, scopeId, vertical };
-            const base = { operationId, moduleId: input.moduleId, schedules: to };
-            await this.recordAdmin(actor, action, target, null, { ...base, phase: 'intent', reason: input.reason });
-            // The directory's record (#1674): ON before the scope moves, OFF after it held — see
-            // `recordSystemSwitchedOn` for why that order is the safe one.
-            const at = new Date().toISOString();
-            const record = { tenantId, scopeId, moduleId: input.moduleId, actor, reason: input.reason, operationId, at };
+            const base = { operationId, ...switchAuditSubject(kind, key, to) };
+            await this.recordAdmin(actor, action, target, null, { ...base, phase: 'intent', reason });
             const errorOf = (err) => (err instanceof Error ? err.message : String(err));
-            let prior = null;
-            if (to === 'on') {
-                try {
-                    prior = await this.cp.recordSystemSwitchedOn(record);
-                }
-                catch (err) {
-                    // Nothing has moved: fail the call here, audited, rather than switch a scope on
-                    // whose record still says off (the next reconcile would switch it back off).
-                    await this.recordAdmin(actor, action, target, null, { ...base, phase: 'failed', error: errorOf(err) }).catch(() => undefined);
-                    throw err;
+            // #2045 (Codex r3): the deployment's fence is attested BEFORE anything is recorded or moved. An
+            // ON on a deployment built before it is refused here, with nothing written anywhere but the
+            // audit. An OFF goes on: the kill switch must work on every deployment (see `UnattestedSwitch`).
+            try {
+                if (!(await attestFence()) && to === 'on') {
+                    throw substratError('precondition_failed', `${unfencedMessage(scopeId)} Nothing was switched.`);
                 }
             }
-            /**
-             * A record write AFTER the scope moved (review #5): retried once, and a failure of both
-             * is answered rather than swallowed — it lands on the outcome row as `recordError`, and
-             * the call does not report plain success. A lost OFF record is exactly what a wipe then
-             * turns into a module running again.
-             */
-            const recordWrite = async (write) => {
+            catch (err) {
+                await this.recordAdmin(actor, action, target, null, { ...base, phase: 'refused', error: errorOf(err) }).catch(() => undefined);
+                throw err;
+            }
+            // The directory's record (#1674; #2029 for a peer), written BEFORE the scope moves, both
+            // ways — see `recordSwitchedOn` and (#1823) `recordSwitchedOff` for why that order is the
+            // safe one. #2045 (Codex r3): the same write marks the subject owed and clears the scope's
+            // reconcile receipt, so from here on the scope converges to this record whatever happens to
+            // the move. The mark goes only when the scope confirms the move under this call's fence.
+            const at = new Date().toISOString();
+            const record = { kind, tenantId, scopeId, key, actor, reason, operationId, at };
+            let prior;
+            try {
+                prior = to === 'on' ? await this.cp.recordSwitchedOn(record) : await this.cp.recordSwitchedOff(record);
+            }
+            catch (err) {
+                // Nothing has moved: fail the call here, audited. An ON must not switch a scope on
+                // whose record still says off (the next reconcile would switch it back off), and an
+                // OFF must not leave a scope off that the record does not know of (#1823).
+                await this.recordAdmin(actor, action, target, null, { ...base, phase: 'failed', error: errorOf(err) }).catch(() => undefined);
+                throw err;
+            }
+            // #2045: a newer call on this subject has recorded its position already: this one writes
+            // nothing, here or in the scope, and says so.
+            if (recordWriteSuperseded(prior, record)) {
+                await this.recordAdmin(actor, action, target, null, { ...base, phase: 'refused', superseded: true });
+                throw substratError('conflict', switchSupersededMessage(kind, scopeId, key, to));
+            }
+            let outcome;
+            try {
                 try {
-                    await write();
-                    return null;
+                    outcome = await move(key, to, at, undefined, operationId);
                 }
-                catch {
-                    try {
-                        await write();
-                        return null;
-                    }
-                    catch (err) {
-                        return errorOf(err);
-                    }
+                catch (first) {
+                    if (first instanceof UnattestedSwitch)
+                        throw first;
+                    // #2045 (Codex r2): one retry under this call's own fence — idempotent, and refused by
+                    // the scope if a newer call has moved it meanwhile.
+                    outcome = await move(key, to, new Date().toISOString(), undefined, operationId);
                 }
-            };
-            let outcome;
-            try {
-                outcome = await move(input.moduleId, to, at);
             }
             catch (err) {
-                const recordError = prior ? await recordWrite(() => this.cp.restoreSystemSwitchRecord(record, prior)) : null;
-                // Best effort: the original error is what the caller must see, and the intent row
-                // already says an attempt was made.
+                // The move threw twice, or was answered by a deployment that could not attest it. Either
+                // way it may have landed, and an older call's move may still be in flight behind it, so no
+                // readback can settle the scope and nothing is put back: the record is this call's position
+                // under the newest fence, and its write-ahead mark makes the next re-assert move the scope
+                // to it, under that fence, whichever way it lies now.
                 await this.recordAdmin(actor, action, target, null, {
                     ...base,
-                    phase: 'failed',
+                    phase: err instanceof UnattestedSwitch ? 'refused' : 'failed',
                     error: errorOf(err),
-                    ...(recordError ? { recordError } : {}),
+                    recordKept: true,
+                    reassertOwed: true,
                 }).catch(() => undefined);
+                if (err instanceof UnattestedSwitch)
+                    throw substratError('precondition_failed', err.message);
                 throw err;
             }
-            // OFF is recorded once the scope held it. A refused ON moved nothing, so its record
-            // write is undone: left `on`, the next reconcile of a wiped scope would leave the
-            // module running.
-            const recordError = to === 'off' && outcome.held
-                ? await recordWrite(() => this.cp.recordSystemSwitchedOff(record))
-                : to === 'on' && !outcome.held && prior
-                    ? await recordWrite(() => this.cp.restoreSystemSwitchRecord(record, prior))
-                    : null;
+            // #2045: the scope has applied a newer call on this subject, so this move wrote nothing. The
+            // record is that newer call's too (its write overwrote this one's, mark included), so nothing
+            // is undone and no mark is this call's to clear.
+            if (outcome.superseded) {
+                await this.recordAdmin(actor, action, target, null, { ...base, phase: 'refused', superseded: true });
+                throw substratError('conflict', switchSupersededMessage(kind, scopeId, key, to));
+            }
+            // A call that held nothing moved nothing, so its record write is undone: left `off`, it
+            // would switch the subject off the day it is installed; left `on`, the next reconcile of
+            // a wiped scope would leave it running. Retried once; a failure of both lands on the
+            // outcome row as `recordError`, and the call says so.
+            //
+            // The scope confirmed this call's move (or that there was nothing to move), so its mark goes.
+            // Held nothing, it goes WITH the undo, in one directory transaction: the row put back carries
+            // the prior call's older id, and no later re-assert confirms under a fence older than this
+            // call's mark. An undo that fails twice leaves the record AND the mark this call's, and the
+            // next re-assert confirms both under it. Held, a failed clear is not the call's: the mark only
+            // costs the next re-assert one idempotent move under this same record.
+            //
+            // An unfenced OFF that held something (a deployment built before the fence) confirmed nothing
+            // under its fence, so its mark stays for the first re-assert after the vertical is redeployed.
+            const unfenced = outcome.held && outcome.fenced !== true;
+            let recordError = null;
+            let owedError = null;
+            if (!outcome.held) {
+                const undo = () => this.cp.restoreSwitchRecord(record, prior, true);
+                recordError = await undo().then(() => null, () => undo().then(() => null, errorOf));
+            }
+            else if (!unfenced) {
+                owedError = await this.cp.clearSwitchOwed(kind, tenantId, scopeId, key, operationId).then(() => null, errorOf);
+            }
             await this.recordAdmin(actor, action, target, null, {
                 ...base,
                 phase: outcome.held ? 'applied' : 'refused',
                 changed: outcome.changed,
                 permissions: outcome.permissions,
+                ...(unfenced ? { unfenced: true, reassertOwed: true } : {}),
                 ...(recordError ? { recordError } : {}),
+                ...(owedError ? { owedError } : {}),
             });
             if (!outcome.held) {
-                throw substratError('not_found', `scope ${scopeId} holds no system grant for module '${input.moduleId}' — nothing to switch ${to} ` +
-                    `(check the module id: it is the module's manifest id, e.g. '@substrat-run/engine-absence')` +
+                throw substratError('not_found', switchNotFoundMessage(kind, scopeId, key, to) +
                     (recordError ? `; and its directory record could not be put back (${recordError})` : ''));
             }
-            if (recordError) {
-                throw substratError('unavailable', `module '${input.moduleId}' is switched ${to} on scope ${scopeId}, but the directory's record of it ` +
-                    `could not be written (${recordError}) — repeat the call to record it; a wipe of this scope would ` +
-                    `otherwise lose the switch`);
-            }
+            return { operationId, outcome };
+        };
+        /** #1666: move one module's schedule switch on one scope — see `HostAdmin.revokeFromSystem`. */
+        const switchSystem = async (actor, raw, to) => {
+            const input = systemSwitch.parse(raw);
+            const { operationId, outcome } = await switchSubjectAt(actor, 'system', input.node, input.moduleId, input.reason, to);
             return {
                 operationId,
                 moduleId: input.moduleId,
@@ -2596,6 +3047,18 @@ export class CloudflareScopeHost {
                 permissions: outcome.permissions,
             };
         };
+        /** #1706: move one PEER's kill switch on one scope — see `HostAdmin.revokeFromPeer`. */
+        const switchPeerAt = async (actor, raw, to) => {
+            const input = peerSwitch.parse(raw);
+            const { operationId, outcome } = await switchSubjectAt(actor, 'peer', input.node, input.vertical, input.reason, to);
+            return {
+                operationId,
+                vertical: input.vertical,
+                calls: to,
+                changed: outcome.changed,
+                permissions: outcome.permissions,
+            };
+        };
         /**
          * The status read's admin-log join (#1674): the `intent` row of the `revokeFromSystem`
          * still in force for each OFF module — actor, reason, when. Paired to its `applied` row
@@ -2651,7 +3114,7 @@ export class CloudflareScopeHost {
             if (!this.cpLess) {
                 const rec = await this.cp.getScopeRecord(tenantId, scopeId);
                 if (!rec)
-                    throw substratError('not_found', `unknown scope for tenant: (${tenantId}, ${scopeId})`);
+                    throw unknownScopeForTenant(tenantId, scopeId);
                 vertical = rec.vertical;
             }
             // A hosted scope (a vertical bound, on a non-cpLess host) has no local storage worth
@@ -2668,7 +3131,7 @@ export class CloudflareScopeHost {
                 delegation
                     ? delegation.status({ tenantId, scopeId })
                     : this.scopeStub(scopeId).systemGrantsStatus().then((rows) => systemScheduleEntry.array().parse(rows)),
-                this.cp.systemSwitchRecordsOf(tenantId, scopeId),
+                this.cp.switchRecordsOf('system', tenantId, scopeId),
             ]);
             const offModules = new Set(states.filter((s) => s.schedules === 'off').map((s) => s.moduleId));
             const explanations = offModules.size > 0
@@ -2687,70 +3150,137 @@ export class CloudflareScopeHost {
         };
         /**
          * #1674: put the directory's OFF positions back into one scope — see
-         * `HostAdmin.reassertSystemSwitches`. It moves the switch through `systemSwitchTarget`,
-         * so it lands wherever an operator's OFF would have — for a hosted scope, over the
-         * `/internal/system-switch` route every deployment since #1666 answers.
+         * `HostAdmin.reassertSystemSwitches`. Every kind (#2029): the recorded-off modules, then the
+         * recorded-off peers. Each moves through `switchTarget`, so it lands wherever an operator's
+         * OFF would have — for a hosted scope, over that kind's `/internal/*` switch route.
          */
         const reassertSystemSwitchesOf = async (actor, node, opts) => {
+            const results = [];
+            for (const kind of SWITCH_KINDS)
+                results.push(...(await reassertKind(actor, kind, node, opts)));
+            return results;
+        };
+        /** One kind's half of `reassertSystemSwitchesOf`. */
+        const reassertKind = async (actor, kind, node, opts) => {
             const { tenantId, scopeId } = node;
-            const { vertical, move } = await systemSwitchTarget(tenantId, scopeId);
-            const recorded = new Map(await this.cp.systemSwitchRecordsOf(tenantId, scopeId));
+            const { vertical, delegated, move, attestFence } = await switchTarget(kind, tenantId, scopeId);
+            const action = reassertActionOf(kind);
+            const target = { tenantId, scopeId, vertical };
+            const recorded = new Map(await this.cp.switchRecordsOf(kind, tenantId, scopeId));
+            // #2045: every switch call's write-ahead mark, with the newest call that wrote it.
+            const owed = new Map(await this.cp.switchesOwedOf(kind, tenantId, scopeId));
             // #1742 review: moves the deployment made from a stale list (restored ON after the list
             // was read), to undo before the OFF pass below.
-            const reverts = staleCarryReverts(recorded, opts?.appliedInUnit);
+            const reverts = staleCarryReverts(kind, recorded, opts?.appliedInUnit);
             // A hosted scope with no delegation configured (Copilot review): this host's own
             // namespace is the module-less placeholder, where the switch would answer `held: false`
             // quietly — a re-assert reported done, and a receipt written, while the deployment
-            // serving the scope keeps its schedules running. Refused loudly instead, as the status
-            // read is, and only when a re-assert is owed: nothing recorded, nothing to refuse.
-            const owed = reverts.length > 0 || [...recorded.values()].includes('off');
-            if (owed && !this.cpLess && vertical !== null && !this.systemSwitchDelegation) {
+            // serving the scope keeps its schedules running or its peer admitted. Refused loudly
+            // instead, as the status read is, and only when a re-assert is owed: nothing recorded,
+            // nothing to refuse.
+            const reassertOwed = reverts.length > 0 || owed.size > 0 || [...recorded.values()].includes('off');
+            if (reassertOwed && !this.cpLess && vertical !== null && !delegated) {
                 throw substratError('unavailable', `no delegation configured for hosted scope ${scopeId} (vertical '${vertical}') — cannot re-assert ` +
-                    `its switched-off schedules in the deployment serving it`);
+                    `its switched-off ${DOOR_WORDS[kind].switched} in the deployment serving it`);
             }
+            // #2045 (Codex r3): a subject's mark goes only once the scope has confirmed a move under the
+            // record's fence — a fenced answer that was not superseded. A throw anywhere below leaves
+            // every mark not yet confirmed for the next pass.
+            // An unfenced OFF (a deployment built before the fence) confirms nothing, so its mark stays.
+            const confirm = async (key, fence, outcome) => {
+                if (owed.has(key) && !outcome.superseded && outcome.fenced === true) {
+                    await this.cp.clearSwitchOwed(kind, tenantId, scopeId, key, fence);
+                }
+            };
+            // #2045 follow-up: on a deployment built before the fence no ON is sent (see
+            // `UnattestedSwitch`). Every OFF below still moves, and the pass refuses at its end, so a
+            // sweep records no receipt for a scope whose owed ON was not sent. Asked only when an ON is due.
+            const onWithheld = [];
+            const withholdOn = async (key) => {
+                if (await attestFence())
+                    return false;
+                onWithheld.push(key);
+                return true;
+            };
             const at = new Date().toISOString();
             const reverted = new Set();
-            for (const moduleId of reverts) {
+            for (const key of reverts) {
                 // Re-read immediately before the move: a staff OFF that completed since the read above
-                // (record `off`) must not get a transient ON a due schedule could run in.
-                const current = new Map(await this.cp.systemSwitchRecordsOf(tenantId, scopeId));
-                if (current.get(moduleId) !== 'on')
+                // (record `off`) must not get a transient ON a due schedule, or a peer call, could use.
+                // #2045: under the fence of the ON the record holds, which is the operator's own call — read
+                // with the position, so it is that ON's fence and no other call's.
+                const current = new Map(await this.cp.switchRecordStatesOf(kind, tenantId, scopeId)).get(key);
+                if (current?.position !== 'on')
                     continue;
-                const outcome = await move(moduleId, 'on', at);
-                reverted.add(moduleId);
+                const fence = current.fence;
+                if (await withholdOn(key))
+                    continue;
+                const outcome = await move(key, 'on', at, undefined, fence);
+                reverted.add(key);
                 if (outcome.changed) {
-                    await this.recordAdmin(actor, 'reassertSystemSwitch', { tenantId, scopeId, vertical }, null, {
-                        operationId: ulid(),
-                        ...staleCarryRevertRow(moduleId, outcome),
-                    });
+                    await this.recordAdmin(actor, action, target, null, { operationId: ulid(), ...staleCarryRevertRow(kind, key, outcome) });
                 }
+                await confirm(key, fence, outcome);
             }
             // Read AFTER the reverts: an OFF that landed meanwhile is switched off below.
-            const modules = await this.cp.switchedOffModulesOf(tenantId, scopeId);
+            const { keys, tenantHeld, fences } = await this.recordedOff(kind, tenantId, scopeId, at);
             // #1742: what the deployment already switched off inside its own unit, audited here —
-            // the move below answers `changed: false` for it and would write no row.
-            // A move the revert above undid is not credited as an in-unit OFF.
-            const applied = opts?.appliedInUnit?.filter((a) => !reverted.has(a.moduleId));
-            for (const row of inUnitMovesToAudit(modules, applied)) {
-                await this.recordAdmin(actor, 'reassertSystemSwitch', { tenantId, scopeId, vertical }, null, {
-                    operationId: ulid(),
-                    ...row,
-                });
+            // the move below answers `changed: false` for it and would write no row. A move the
+            // revert above undid is not credited as an in-unit OFF.
+            for (const row of inUnitMovesToAudit(kind, keys, opts?.appliedInUnit, reverted)) {
+                await this.recordAdmin(actor, action, target, null, { operationId: ulid(), ...row });
             }
+            // #2045: every move here carries the fence of the call the record holds, so a scope a newer call
+            // has moved since refuses it. A deployment from before the fence takes the OFF unfenced.
             const results = [];
-            for (const moduleId of modules) {
-                const outcome = await move(moduleId, 'off', at);
+            const held = new Set(tenantHeld);
+            for (const key of keys) {
+                const fence = fences.get(key); // `recordedOff` read each key with its own row's fence
+                const outcome = await move(key, 'off', at, held.has(key), fence);
                 if (outcome.changed) {
-                    await this.recordAdmin(actor, 'reassertSystemSwitch', { tenantId, scopeId, vertical }, null, {
+                    await this.recordAdmin(actor, action, target, null, {
                         operationId: ulid(),
-                        moduleId,
-                        schedules: 'off',
-                        phase: 'applied',
-                        changed: true,
-                        permissions: outcome.permissions,
+                        ...reassertOffRow(kind, key, outcome.permissions),
+                        ...(outcome.fenced === true ? {} : { unfenced: true }),
                     });
                 }
-                results.push({ moduleId, held: outcome.held, changed: outcome.changed });
+                results.push(reassertEntry(kind, key, outcome));
+                await confirm(key, fence, outcome);
+            }
+            // A subject marked owed converges to its record in either direction: OFF above, and here a
+            // record of ON — sent whatever the scope reads now, because a scope that reads ON may still
+            // be behind the record's fence, with an older call's OFF in flight that only the fence can
+            // refuse (Codex r3, finding 1). Idempotent: an ON already in place changes nothing and moves
+            // the fence. Every other record of ON keeps #1674's rule and turns nothing on.
+            const settled = new Set([...keys, ...reverted]);
+            const pending = [...owed.keys()].filter((key) => !settled.has(key));
+            if (pending.length) {
+                // Position and fence in one read: an ON is sent only under the fence of the ON it read.
+                const now = new Map(await this.cp.switchRecordStatesOf(kind, tenantId, scopeId));
+                for (const key of pending) {
+                    const row = now.get(key);
+                    if (row?.position !== 'on') {
+                        // No record (a call that held nothing, whose undo removed its row), or one that turned
+                        // OFF since the read above, which the next pass moves: nothing to send on this one. A
+                        // missing row's mark goes under its own id, so a newer call's mark stays.
+                        if (row === undefined)
+                            await this.cp.clearSwitchOwed(kind, tenantId, scopeId, key, owed.get(key));
+                        continue;
+                    }
+                    const fence = row.fence;
+                    if (await withholdOn(key))
+                        continue;
+                    const outcome = await move(key, 'on', at, undefined, fence);
+                    if (outcome.changed) {
+                        await this.recordAdmin(actor, action, target, null, { operationId: ulid(), ...reassertOnRow(kind, key, outcome.permissions) });
+                        results.push(reassertEntry(kind, key, outcome));
+                    }
+                    await confirm(key, fence, outcome);
+                }
+            }
+            if (onWithheld.length) {
+                throw substratError('precondition_failed', `${unfencedMessage(scopeId)} Its recorded OFF positions were applied; the owed ON of ` +
+                    `${onWithheld.map((k) => `'${k}'`).join(', ')} was not sent.`);
             }
             return results;
         };
@@ -2769,7 +3299,7 @@ export class CloudflareScopeHost {
             if (!this.cpLess) {
                 const rec = await this.cp.getScopeRecord(tenantId, scopeId);
                 if (!rec)
-                    throw substratError('not_found', `unknown scope for tenant: (${tenantId}, ${scopeId})`);
+                    throw unknownScopeForTenant(tenantId, scopeId);
                 vertical = rec.vertical;
             }
             if (!this.cpLess && vertical !== null && !this.peerSwitchDelegation) {
@@ -2837,18 +3367,21 @@ export class CloudflareScopeHost {
             unassignRole: async (actor, assignment) => {
                 // Tombstone (K-21) — the checker skips revoked rows. A no-op returns false so
                 // a repeat unassign stays silent (no second audit row, no needless fan-out).
-                const subject = `principal:${assignment.principalId}`;
                 const relation = `role:${assignment.roleKey}`;
-                const now = new Date().toISOString();
-                const changed = assignment.node.scopeId
-                    ? await this.scopeStub(assignment.node.scopeId).revokeTuple(subject, relation, `scope:${assignment.node.scopeId}`, now)
-                    : await this.cp.revokeTenantTuple(assignment.node.tenantId, subject, relation, `tenant:${assignment.node.tenantId}`, now);
+                const { tenantId, scopeId } = assignment.node;
+                if (!scopeId) {
+                    // One ControlPlaneDO method (#1184): the revoke, the removal fence (raised even when
+                    // nothing was held) and the audit row, so no add can land between any two of them.
+                    const changed = await this.cp.revokeAndFence(tenantId, assignment.principalId, relation, `tenant:${tenantId}`, this.adminEntry(actor, 'unassignRole', { tenantId, scopeId: null }, assignment, null));
+                    // A tenant-level revoke changes the projected set — the tombstone must reach scopes.
+                    if (changed)
+                        await this.fanOut(tenantId);
+                    return;
+                }
+                const changed = await this.scopeStub(scopeId).revokeTuple(`principal:${assignment.principalId}`, relation, `scope:${scopeId}`, new Date().toISOString());
                 if (!changed)
                     return;
-                await this.recordAdmin(actor, 'unassignRole', { tenantId: assignment.node.tenantId, scopeId: assignment.node.scopeId }, assignment, null);
-                // A tenant-level revoke changes the projected set — the tombstone must reach scopes.
-                if (!assignment.node.scopeId)
-                    await this.fanOut(assignment.node.tenantId);
+                await this.recordAdmin(actor, 'unassignRole', { tenantId, scopeId }, assignment, null);
             },
             grant: async (actor, raw) => {
                 // Parsed like its `grantToConnection`/`grantToSystem` siblings, not taken on
@@ -2968,6 +3501,19 @@ export class CloudflareScopeHost {
                 await this.recordAccess(actor, 'listSystemSwitches', { tenantId: filter?.tenantId ?? null }, filter ?? null, rows.length);
                 return rows.map((r) => systemSwitchRecord.parse(r));
             },
+            tenantHeldSystemModules: async (actor, tenantId, moduleIds) => {
+                const held = moduleIds.length
+                    ? await this.cp.tenantHeldOf('system', tenantId, moduleIds, new Date().toISOString())
+                    : [];
+                await this.recordAccess(actor, 'tenantHeldSystemModules', { tenantId }, { moduleIds: [...moduleIds] }, held.length);
+                return held;
+            },
+            peerSwitchCarry: async (actor, node) => {
+                const { keys: switchedOffPeers, tenantHeld: tenantHeldPeers, fences: all, } = await this.recordedOff('peer', node.tenantId, node.scopeId, new Date().toISOString());
+                const fences = Object.fromEntries(switchedOffPeers.map((v) => [v, all.get(v)]));
+                await this.recordAccess(actor, 'peerSwitchCarry', node, null, switchedOffPeers.length);
+                return { switchedOffPeers, tenantHeldPeers, fences };
+            },
             reassertSystemSwitches: reassertSystemSwitchesOf,
             // #1672 — the platform's two capability verbs. Audited AFTER the write, on both, and
             // the failure each leaves is the safe one: a mint whose audit row did not land never
@@ -3033,7 +3579,7 @@ export class CloudflareScopeHost {
                     // another tenant's traffic. Exception: the holder is ARCHIVED or REAPED (a
                     // deleted app, storage since wiped) — it has released the name, so the rebind
                     // reclaims it.
-                    throw new Error(`hostname '${parsed.hostname}' is already bound to another scope`);
+                    throw substratError('conflict', `hostname '${parsed.hostname}' is already bound to another scope`);
                 }
                 // Exactly one canonical per (scope, surface).
                 if (parsed.canonical)
@@ -3054,7 +3600,7 @@ export class CloudflareScopeHost {
                 const hostname = raw.toLowerCase(); // DNS is case-insensitive; the map is normalized
                 const row = await this.cp.readHostname(hostname);
                 if (!row)
-                    throw new Error(`unknown hostname '${hostname}'`);
+                    throw substratError('not_found', `unknown hostname '${hostname}'`);
                 if (row.status === status)
                     return; // idempotent, unaudited
                 await this.cp.setHostnameStatus(hostname, status, note ?? null);
@@ -3064,7 +3610,7 @@ export class CloudflareScopeHost {
                 const hostname = raw.toLowerCase(); // DNS is case-insensitive; the map is normalized
                 const row = await this.cp.readHostname(hostname);
                 if (!row)
-                    throw new Error(`unknown hostname '${hostname}'`);
+                    throw substratError('not_found', `unknown hostname '${hostname}'`);
                 // A poll that finds nothing changed (same status, same records, id already set)
                 // is not an event — skip the write and the audit entry, so the reconcile sweep
                 // does not flood the admin log with no-op rows every interval.
@@ -3150,7 +3696,7 @@ export class CloudflareScopeHost {
                     if (existing.owner_tenant !== parsed.ownerTenant) {
                         throw substratError('conflict', `vertical '${parsed.slug}' is owned by ${existing.owner_tenant ?? 'the platform'}, not ${parsed.ownerTenant ?? 'the platform'}`);
                     }
-                    throw new Error(`vertical '${parsed.slug}' is already registered as ${existing.source}`);
+                    throw substratError('conflict', `vertical '${parsed.slug}' is already registered as ${existing.source}`);
                 }
                 await this.cp.insertVertical(parsed.slug, parsed.name, parsed.source, parsed.ownerTenant, envSpecJson, installSpecJson, parsed.listed ? 1 : 0, new Date().toISOString());
                 await this.recordAdmin(actor, 'registerVertical', { tenantId: null }, null, parsed);
@@ -3331,11 +3877,11 @@ export class CloudflareScopeHost {
                 // nothing to diff against — the gate is about change, not existence.
                 if (outgoing) {
                     if (outgoing.permission_digest !== incoming.permission_digest && !ack.permissionChange) {
-                        throw new Error(`promotion changes the permission surface (${outgoing.permission_digest} → ` +
+                        throw substratError('conflict', `promotion changes the permission surface (${outgoing.permission_digest} → ` +
                             `${incoming.permission_digest}) — acknowledge it explicitly to promote`);
                     }
                     if (outgoing.migration_digest !== incoming.migration_digest && !ack.migrationChange) {
-                        throw new Error(`promotion changes migrations (${outgoing.migration_digest} → ` +
+                        throw substratError('conflict', `promotion changes migrations (${outgoing.migration_digest} → ` +
                             `${incoming.migration_digest}) — acknowledge it explicitly to promote`);
                     }
                     // #1705 PR 3: an export an installed consumer imports, dropped or re-versioned.
@@ -3595,7 +4141,7 @@ export class CloudflareScopeHost {
             },
             createOrg: async (actor, input) => {
                 const parsed = createOrgInput.parse(input);
-                const created = await this.cp.createOrg(parsed.id, parsed.tenantId, parsed.slug, parsed.name, new Date().toISOString());
+                const created = await this.directory('createOrg', parsed.id, parsed.tenantId, parsed.slug, parsed.name, new Date().toISOString());
                 if (!created)
                     return; // idempotent, and a no-op is not audited
                 await this.recordAdmin(actor, 'createOrg', { tenantId: parsed.tenantId }, null, parsed);
@@ -3616,15 +4162,27 @@ export class CloudflareScopeHost {
                 await this.recordAdmin(actor, 'addMember', { tenantId }, null, { principal, orgId });
                 await this.fanOut(tenantId); // membership is a tenant-level tuple
             },
+            applyMembership: async (actor, change) => {
+                // The row is minted here, where attribution and `causedBy` live, and written by the
+                // ControlPlaneDO in the same synchronous method as the fence, the bound and the tuple
+                // (#1184): one DO unit, so nothing lands between the check and the write.
+                const { tenantId, principal, roleKey, op } = change;
+                const assignment = { principalId: principal, roleKey, node: { tenantId, scopeId: null } };
+                const result = await this.cp.applyMembership(change, op === 'add'
+                    ? this.adminEntry(actor, 'assignRole', { tenantId, scopeId: null }, null, assignment)
+                    : this.adminEntry(actor, 'unassignRole', { tenantId, scopeId: null }, assignment, null));
+                // The tenant-level tuple, or its tombstone, reaches the projections.
+                if (result.applied && (op === 'add' || result.changed))
+                    await this.fanOut(tenantId);
+                return result;
+            },
             removeMember: async (actor, tenantId, principal, orgId) => {
                 await requireOrg(tenantId, orgId);
-                // Tombstone (K-21), never DELETE. The DO reports whether anything changed
-                // so a repeat revoke stays a silent no-op rather than a second audit row.
-                const changed = await this.cp.revokeMember(tenantId, `principal:${principal}`, `org:${orgId}`, new Date().toISOString());
-                if (!changed)
-                    return;
-                await this.recordAdmin(actor, 'removeMember', { tenantId }, { principal, orgId }, null);
-                await this.fanOut(tenantId); // the tombstone must reach the projections
+                // Tombstone (K-21), never DELETE, with the removal fence in the same DO method
+                // (#1184). A repeat revoke stays a silent no-op rather than a second audit row.
+                const changed = await this.cp.revokeAndFence(tenantId, principal, 'member', `org:${orgId}`, this.adminEntry(actor, 'removeMember', { tenantId }, { principal, orgId }, null));
+                if (changed)
+                    await this.fanOut(tenantId); // the tombstone must reach the projections
             },
             listMembers: async (actor, tenantId, orgId, options) => {
                 await requireOrg(tenantId, orgId);
@@ -3638,20 +4196,20 @@ export class CloudflareScopeHost {
             },
             createTenant: async (actor, input) => {
                 const parsed = createTenantInput.parse(input);
-                const created = await this.cp.createTenant(parsed.id, parsed.slug, parsed.name, new Date().toISOString(), parsed.provisionedByTenant ?? null);
+                const created = await this.directory('createTenant', parsed.id, parsed.slug, parsed.name, new Date().toISOString(), parsed.provisionedByTenant ?? null);
                 // Idempotent: re-creating an existing tenant is a no-op, not audited.
                 if (!created)
                     return;
                 await this.recordAdmin(actor, 'createTenant', { tenantId: parsed.id }, null, created);
             },
             setTenantStatus: async (actor, tenantId, status) => {
-                const before = await this.cp.setTenantStatus(tenantId, status);
+                const before = await this.directory('setTenantStatus', tenantId, status);
                 await this.recordAdmin(actor, 'setTenantStatus', { tenantId }, { status: before }, { status });
                 // #1713: every hosted scope under the tenant holds or resumes its work by this.
                 await this.deliverLifecycles(actor, { tenantId });
             },
             setTenantName: async (actor, tenantId, name) => {
-                const before = await this.cp.setTenantName(tenantId, name);
+                const before = await this.directory('setTenantName', tenantId, name);
                 if (before === name)
                     return; // no-op is not audited — nothing changed
                 await this.recordAdmin(actor, 'setTenantName', { tenantId }, { name: before }, { name });
@@ -3661,7 +4219,7 @@ export class CloudflareScopeHost {
                 // first (archive-if-needed → reapScope in the vertical deployment); the DO clears
                 // the tenant's PII/config rows and flips the row to a `reaped` tombstone, keeping
                 // the row + admin log. Only a `deleting` tenant may be reaped (checked in the DO).
-                const before = await this.cp.reapTenant(tenantId);
+                const before = await this.directory('reapTenant', tenantId);
                 await this.recordAdmin(actor, 'reapTenant', { tenantId }, { status: before }, { status: 'reaped' });
             },
             listTenants: async (actor, page) => {
@@ -3745,7 +4303,7 @@ export class CloudflareScopeHost {
                 // Not `peerScopeGate`: a read must not migrate, and the phase makes this call once
                 // per edge per pass, where an extra round trip is a fleet-wide cost.
                 this.assertServedHere(await this.scopeRecordForRead(tenantId, scopeId), scopeId, 'readExportedEvents');
-                const batch = exportedBatch.parse(await this.scopeStub(scopeId).exportedEventsRead(input, tenantId, scopeId));
+                const batch = await this.readExportsThroughDoor(input, tenantId, scopeId);
                 await this.recordAccess(actor, 'readExportedEvents', { tenantId, scopeId }, { consumer: input.consumer, after: input.after, limit: input.limit }, batch.events.length);
                 return batch;
             },
@@ -3925,12 +4483,18 @@ export class CloudflareScopeHost {
                 await this.recordAccess(actor, 'lifecycleFlow', { tenantId, scopeId }, delegatedReadParams.lifecycleFlow(input), flow.observation.events);
                 return flow;
             },
+            operationSeries: async (actor, tenantId, scopeId, input) => {
+                await this.scopeRecordForRead(tenantId, scopeId);
+                const series = await this.scopeStub(scopeId).operationSeries(input);
+                await this.recordAccess(actor, 'operationSeries', { tenantId, scopeId }, delegatedReadParams.operationSeries(input), operationSeriesCount(series));
+                return series;
+            },
             readScopeTable: async (actor, tenantId, scopeId, input) => {
                 await this.scopeRecordForRead(tenantId, scopeId);
                 // Checked here as well as in the ScopeDO, so the refusal keeps its code across the hop.
                 assertRowLimit('limit', input.limit);
                 assertRowOffset('offset', input.offset);
-                const page = await this.scopeStub(scopeId).introspectTable(input.table, input.limit, input.offset);
+                const page = unwrapReply(await this.scopeStub(scopeId).introspectTableReply(input.table, input.limit, input.offset));
                 await this.recordAccess(actor, 'readScopeTable', { tenantId, scopeId }, { table: input.table, limit: page.limit, offset: page.offset }, page.rows.length);
                 return page;
             },
@@ -3971,7 +4535,7 @@ export class CloudflareScopeHost {
             },
             queryScope: async (actor, tenantId, scopeId, input) => {
                 await this.scopeRecordForRead(tenantId, scopeId);
-                const result = await this.scopeStub(scopeId).introspectQuery(input.sql);
+                const result = unwrapReply(await this.scopeStub(scopeId).introspectQueryReply(input.sql));
                 // The statement is the logged argument: the access log is the evidence trail,
                 // and for a console read the SQL is the whole story.
                 await this.recordAccess(actor, 'queryScope', { tenantId, scopeId }, { sql: input.sql }, result.rows.length);
@@ -4064,7 +4628,7 @@ export class CloudflareScopeHost {
                 if (!rec)
                     throw substratError('not_found', `unknown scope ${scopeId} in tenant ${tenantId}`);
                 if (rec.status !== 'archived') {
-                    throw new Error(`scope ${scopeId} is ${rec.status}, not archived — only an archived scope may be reaped`);
+                    throw substratError('conflict', `scope ${scopeId} is ${rec.status}, not archived — only an archived scope may be reaped`);
                 }
                 // A serving scope always holds ≥1 bound hostname; a truly-dead one has been
                 // unbound. The dashboard delete path unbinds AT archive, but a bare console
@@ -4076,7 +4640,7 @@ export class CloudflareScopeHost {
                 // being released anyway; the interactive per-scope reap never sets it.
                 const bound = opts?.force ? [] : await this.cp.listHostnames({ scopeId, limit: 1 });
                 if (bound.length > 0) {
-                    throw new Error(`scope ${scopeId} still resolves hostname '${bound[0].hostname}' — ` +
+                    throw substratError('conflict', `scope ${scopeId} still resolves hostname '${bound[0].hostname}' — ` +
                         `unbind it before reaping (reap wipes storage and cannot be undone)`);
                 }
                 await this.scopeStub(scopeId).destroyStorage();
@@ -4274,7 +4838,7 @@ export class CloudflareScopeHost {
             },
             registerIdentityPool: async (actor, input) => {
                 const parsed = identityPool.parse(input);
-                const created = await this.cp.registerIdentityPool(parsed.provider, parsed.topology, parsed.tenantId, new Date().toISOString());
+                const created = await this.directory('registerIdentityPool', parsed.provider, parsed.topology, parsed.tenantId, new Date().toISOString());
                 if (!created)
                     return; // identical registration is idempotent, unaudited
                 // Null tenant for a central pool: it belongs to no single tenant, which is
@@ -4291,9 +4855,9 @@ export class CloudflareScopeHost {
             listIdentityTenants: async (actor, provider, externalId) => {
                 const r = await this.cp.readPool(provider);
                 if (!r)
-                    throw new Error(`identity pool '${provider}' is not registered`);
+                    throw substratError('not_found', `identity pool '${provider}' is not registered`);
                 if (r.topology !== 'central') {
-                    throw new Error(`identity pool '${provider}' is tenant-bound — enumerating tenants is only ` +
+                    throw substratError('forbidden', `identity pool '${provider}' is tenant-bound — enumerating tenants is only ` +
                         `meaningful on a central pool, where the same externalId is the same person`);
                 }
                 const tenants = (await this.cp.identityTenants(provider, externalId));
@@ -4310,9 +4874,9 @@ export class CloudflareScopeHost {
                     at: new Date().toISOString(),
                 });
                 if (topology === null)
-                    throw new Error(`identity pool '${provider}' is not registered`);
+                    throw substratError('not_found', `identity pool '${provider}' is not registered`);
                 if (topology !== 'central') {
-                    throw new Error(`identity pool '${provider}' is tenant-bound — enumerating tenants is only ` +
+                    throw substratError('forbidden', `identity pool '${provider}' is tenant-bound — enumerating tenants is only ` +
                         `meaningful on a central pool, where the same externalId is the same person`);
                 }
                 return memberships.map((m) => identityMembership.parse(m));
@@ -4465,14 +5029,14 @@ export class CloudflareScopeHost {
                 const parsed = identityLink.parse(input);
                 const pool = await this.cp.readPool(parsed.provider);
                 if (!pool) {
-                    throw new Error(`identity pool '${parsed.provider}' is not registered — a pool must declare ` +
+                    throw substratError('conflict', `identity pool '${parsed.provider}' is not registered — a pool must declare ` +
                         `its topology before it may link (central vs tenant-bound decides whether ` +
                         `the same externalId in two tenants is one person or two)`);
                 }
                 if (pool.topology === 'tenant-bound' && pool.tenant_id !== parsed.tenantId) {
-                    throw new Error(`identity pool '${parsed.provider}' is bound to tenant ${pool.tenant_id} and cannot link into ${parsed.tenantId}`);
+                    throw substratError('conflict', `identity pool '${parsed.provider}' is bound to tenant ${pool.tenant_id} and cannot link into ${parsed.tenantId}`);
                 }
-                const changed = await this.cp.linkIdentity(parsed.provider, parsed.externalId, parsed.principal, parsed.tenantId, parsed.scopeId ?? null, new Date().toISOString());
+                const changed = await this.directory('linkIdentity', parsed.provider, parsed.externalId, parsed.principal, parsed.tenantId, parsed.scopeId ?? null, new Date().toISOString());
                 // Idempotent: an identity already bound is a no-op, not audited.
                 if (!changed)
                     return;
@@ -4734,18 +5298,46 @@ export class CloudflareScopeHost {
         };
     }
     // -- helpers --------------------------------------------------------------
+    /** A directory write whose refusal must keep its code across the DO hop (#113). */
+    async directory(method, ...args) {
+        return unwrapReply(await this.cp.reply(method, args));
+    }
     /**
      * The getScope gate (control-plane.md §4.1/§4.2) — the pair check, then the tenant's and
      * the scope's lifecycle — thrown on THIS side of the RPC (#1718). The ControlPlaneDO
      * answers its refusal as data, because an error thrown there arrives here flattened, with
-     * no code; a record crosses intact. A CP-less host's null control plane answers nothing,
-     * so the gate passes: the router already made it from the shared directory.
+     * no code; a record crosses intact.
+     *
+     * A CP-less host's null control plane answers nothing: the router made the pair check from
+     * the shared directory. The scope's own storage then makes it again (#2016), against the
+     * tenant it was provisioned for (`ScopeDO.admission`), so a vertical that passes a scope id
+     * under the wrong tenant meets K-3's refusal at the door instead of relying on the permission
+     * gate's grant data to deny it.
+     *
+     * Answers with the lifecycle the CP-less scope holds (#1713), read in the same DO call as the
+     * pair check, so an `assertLive` door still costs one round-trip; a door that reads the scope
+     * without the lifecycle half pays the one DO call the pair check needs. Null with a directory,
+     * whose refusal already covered the lifecycle.
      */
     async validateScopeAccess(tenantId, scopeId) {
         const refusal = await this.cp.scopeAccessRefusal(tenantId, scopeId);
-        if (!refusal)
-            return;
-        throw refusal.code ? substratError(refusal.code, refusal.message) : new Error(refusal.message);
+        if (refusal) {
+            throw refusal.code
+                ? substratError(refusal.code, refusal.message, refusal.reason ? { reason: refusal.reason } : undefined)
+                : new Error(refusal.message);
+        }
+        if (!this.cpLess)
+            return null;
+        const { verdict, lifecycle } = await this.scopeStub(scopeId).admission(tenantId);
+        if (verdict === 'foreign')
+            throw unknownScopeForTenant(tenantId, scopeId);
+        // A scope with no tenant record and no role rows has nothing to hold the pair against, so it is
+        // let through — a compatibility state, not a steady one: the next reconcile (every push runs
+        // one against the scopes behind it, #1172) or lifecycle delivery records the directory's tenant.
+        // Logged on every admission, so an operator sees a scope that has not converged.
+        if (verdict === 'unknown')
+            console.warn(JSON.stringify(tenantUnrecordedLine(tenantId, scopeId)));
+        return lifecycle;
     }
     /**
      * THE lifecycle gate (#1713) at every door that runs a scope's work: a request's stubs and
@@ -4763,16 +5355,9 @@ export class CloudflareScopeHost {
      * grants) keep `validateScopeAccess` alone: an operator still reads a suspended scope.
      */
     async assertLive(tenantId, scopeId) {
-        await this.validateScopeAccess(tenantId, scopeId);
-        const refusal = await this.cpLessRefusal(scopeId, { tenantId, scopeId });
+        const refusal = lifecycleRefusal(await this.validateScopeAccess(tenantId, scopeId), { tenantId, scopeId });
         if (refusal)
-            throw new Error(refusal);
-    }
-    /** The delivered lifecycle's refusal on a CP-less host (#1713); always null with a directory. */
-    async cpLessRefusal(scopeId, ids) {
-        if (!this.cpLess)
-            return null;
-        return lifecycleRefusal(await this.scopeStub(scopeId).lifecycle(), ids);
+            throw substratError('conflict', refusal, { reason: SCOPE_GATE_REASONS.notActive });
     }
     /**
      * Deliver the directory's lifecycle to the deployments serving the matching scopes (#1713):
@@ -4792,8 +5377,25 @@ export class CloudflareScopeHost {
         if (!delegation || this.cpLess)
             return report;
         let targets;
+        // #2016: the heal also asks the served scopes whose deployment has not answered that it holds a
+        // record of the scope's tenant, a copy as much as a primary (no push reconciles a copy), until
+        // each answers that it does. A bounded slice per pass, after the drift and the holds.
+        const askTenant = new Set();
         try {
             targets = await this.cp.lifecycleTargets(filter);
+            if (filter.drift) {
+                const unrecorded = await this.cp.lifecycleTargets({ unrecorded: true, limit: TENANT_UNRECORDED_PER_PASS });
+                // Noted before asking, so an ask that fails (or a deployment that never answers) rotates
+                // behind the scopes not asked yet, and the next pass reaches them.
+                if (unrecorded.length > 0)
+                    await this.cp.recordTenantAsks(unrecorded.map((u) => u.scope_id), new Date().toISOString());
+                const seen = new Set(targets.map((t) => t.scope_id));
+                for (const u of unrecorded) {
+                    askTenant.add(u.scope_id);
+                    if (!seen.has(u.scope_id))
+                        targets.push(u);
+                }
+            }
         }
         catch (err) {
             console.error('substrat: could not read the scopes to deliver a lifecycle to (#1713)', err);
@@ -4815,8 +5417,10 @@ export class CloudflareScopeHost {
             // no lifecycle runs live. That keeps an activation, and every transition before a
             // deployment carries the route, from posting a delivery that changes nothing. After a
             // restore (epoch > 0) no receipt says nothing about what the deployment holds, so it is
-            // delivered. A HOLD is always delivered.
-            if (lifecycleRefusal(lifecycle) === null && (t.delivered === null ? t.epoch === 0 : t.delivered === lifecycleReceipt(lifecycle))) {
+            // delivered. A HOLD is always delivered, and so is a scope the heal asks for its tenant record.
+            if (!askTenant.has(scopeId) &&
+                lifecycleRefusal(lifecycle) === null &&
+                (t.delivered === null ? t.epoch === 0 : t.delivered === lifecycleReceipt(lifecycle))) {
                 continue;
             }
             report.attempted += 1;
@@ -4874,7 +5478,7 @@ export class CloudflareScopeHost {
                     }
                 }
                 // The receipt is what the scope HOLDS: a newer delivery it kept instead is the truth.
-                await this.cp.recordLifecycleReceipt(scopeId, lifecycleReceipt(answer.lifecycle), new Date().toISOString());
+                await this.cp.recordLifecycleReceipt(scopeId, lifecycleReceipt(answer.lifecycle), new Date().toISOString(), answer.tenantRecorded === true);
                 report.delivered += 1;
             }
             catch (err) {
@@ -4923,7 +5527,7 @@ export class CloudflareScopeHost {
      * points ask the directory themselves.
      */
     async lifecycleHeld(scopeId) {
-        return (await this.cpLessRefusal(scopeId)) !== null;
+        return this.cpLess && lifecycleRefusal(await this.scopeStub(scopeId).lifecycle()) !== null;
     }
     /**
      * K-3's cross-check on its own: the (tenant, scope) pair must exist and agree before a
@@ -4933,7 +5537,7 @@ export class CloudflareScopeHost {
     async assertScope(tenantId, scopeId) {
         const rec = await this.cp.getScopeRecord(tenantId, scopeId);
         if (!rec)
-            throw substratError('not_found', `unknown scope for tenant: (${tenantId}, ${scopeId})`);
+            throw unknownScopeForTenant(tenantId, scopeId);
     }
     /**
      * The same K-3 cross-check, for a read that then opens the scope's STORAGE — every
@@ -4948,9 +5552,9 @@ export class CloudflareScopeHost {
     async scopeRecordForRead(tenantId, scopeId) {
         const row = await this.cp.getScopeRecord(tenantId, scopeId);
         if (!row)
-            throw substratError('not_found', `unknown scope for tenant: (${tenantId}, ${scopeId})`);
+            throw unknownScopeForTenant(tenantId, scopeId);
         if (row.status === 'reaped') {
-            throw new Error(`scope ${scopeId} is reaped — its storage is gone and cannot be read`);
+            throw substratError('conflict', `scope ${scopeId} is reaped — its storage is gone and cannot be read`);
         }
         return row;
     }
@@ -4983,7 +5587,14 @@ export class CloudflareScopeHost {
         });
     }
     async recordAdmin(actor, action, target, before, after) {
-        await this.cp.recordAdmin({
+        await this.cp.recordAdmin(this.adminEntry(actor, action, target, before, after));
+    }
+    /**
+     * One admin-log row, minted here where attribution and `causedBy` live — for `recordAdmin`,
+     * and for a ControlPlaneDO method that writes its row in the same unit as its effect (#1184).
+     */
+    adminEntry(actor, action, target, before, after) {
+        return {
             id: ulid(),
             actor,
             action,
@@ -4995,7 +5606,7 @@ export class CloudflareScopeHost {
             before: before ?? null,
             after: after ?? null,
             at: new Date().toISOString(),
-        });
+        };
     }
     /**
      * The scope's own answer to "what may this connection do here" (#726 gap 1).
@@ -5120,6 +5731,11 @@ export class CloudflareScopeHost {
     // rewind CLAIMS them on `SWITCH_HOLDS_NAME`, which the rewind cannot reach. A module is held
     // while any claim on it exists, and `runDueSchedules` skips a held module.
     //
+    // #2029: the same for a PEER switched off (`vertical:<slug>`): the rewind claims the scope's
+    // off peers beside its off modules, each under its hold key (`holdKeyOf`), and the peer door
+    // refuses a held peer as the system door refuses a held module. Everything below holds for
+    // both kinds; "module" reads as "subject".
+    //
     // A claim is released only by a switch move KNOWN to survive its rewind (`switchInScope`): a
     // move on the restored storage, after the rewind armed. A move during the settle, or one the
     // doomed instance applied, lands in storage the restart discards, so it releases nothing. A
@@ -5138,7 +5754,7 @@ export class CloudflareScopeHost {
      * reopens only the gap this closes, for a rewind that lands during the outage, and the next
      * reconcile still switches that module off. The error is answered, for the pass to report.
      */
-    async switchHeld(scopeId, moduleId) {
+    async switchHeld(scopeId, holdKey) {
         const at = Date.now();
         let error;
         if (!this.holdSnapshot || at - this.holdSnapshot.at > SWITCH_HOLD_SNAPSHOT_MS) {
@@ -5161,8 +5777,11 @@ export class CloudflareScopeHost {
                 }
             }
         }
-        const held = this.holdSnapshot?.held.has(`${scopeId} ${moduleId}`) ?? false;
-        return { held, ...(error ? { error } : {}) };
+        const snapshot = this.holdSnapshot;
+        const held = snapshot?.held.has(`${scopeId} ${holdKey}`) ?? false;
+        // #2029: a good read naming no row for this scope at all, for `doorGate`'s instance cache.
+        const scopeClear = !error && snapshot?.good === true && !snapshot.scopes.has(scopeId);
+        return { held, ...(error ? { error } : {}), ...(scopeClear ? { scopeClear: true } : {}) };
     }
     /** One read of the whole hold into the snapshot, stamped with when it went out. Never throws. */
     async refreshHolds(at) {
@@ -5170,7 +5789,12 @@ export class CloudflareScopeHost {
             const rows = await this.switchHoldsStub().switchHoldsAll();
             // A slow read that lands after a newer one never replaces it.
             if (!this.holdSnapshot || at >= this.holdSnapshot.at) {
-                this.holdSnapshot = { at, held: new Set(rows.map((r) => `${r.scopeId} ${r.moduleId}`)) };
+                this.holdSnapshot = {
+                    at,
+                    held: new Set(rows.map((r) => `${r.scopeId} ${r.moduleId}`)),
+                    scopes: new Set(rows.map((r) => r.scopeId)),
+                    good: true,
+                };
             }
             return {};
         }
@@ -5181,8 +5805,10 @@ export class CloudflareScopeHost {
             // than hammered per scope. For that long, other scopes reuse this possibly pre-hold set
             // silently, and only the consult that sent this read reports the error: the declared
             // fail-open, attributed once.
-            if (!this.holdSnapshot || at >= this.holdSnapshot.at)
-                this.holdSnapshot = { at, held: known ?? new Set() };
+            if (!this.holdSnapshot || at >= this.holdSnapshot.at) {
+                const scopes = new Set([...(known ?? [])].map((k) => k.slice(0, k.indexOf(' '))));
+                this.holdSnapshot = { at, held: known ?? new Set(), scopes, good: false };
+            }
             return {
                 error: known
                     ? `switch hold unreadable (${why}); the ${known.size} hold(s) from this pass's last good read ` +
@@ -5229,7 +5855,11 @@ export class CloudflareScopeHost {
      * its claims before the OFF's join lands. The joined row then holds the module the operator just
      * turned ON, until the next surviving move of that switch releases it (another ON does).
      */
-    async switchInScope(scopeId, moduleId, to, at) {
+    async switchInScope(kind, scopeId, key, to, at, tenantHeld = false, 
+    /** #2045: the switch call's fence; see `SWITCH_FENCES_DDL`. */
+    fence) {
+        // #2029: a peer's claims live beside the modules', under its own hold key.
+        const holdKey = holdKeyOf(kind, key);
         let scopeClaims;
         let readError;
         try {
@@ -5238,23 +5868,30 @@ export class CloudflareScopeHost {
         catch (err) {
             readError = err;
         }
-        const { instance, ...outcome } = await this.scopeStub(scopeId).switchSystemSchedules(moduleId, scopeId, to, at);
+        const stub = this.scopeStub(scopeId);
+        const { instance, ...outcome } = await (kind === 'system'
+            ? stub.switchSystemSchedules(key, scopeId, to, at, tenantHeld, fence)
+            : stub.switchPeer(key, scopeId, to, at, tenantHeld, fence));
         if (!scopeClaims)
             throw readError;
+        // #2045: a move the fence refused wrote nothing, so it is known to survive nothing and to
+        // release nothing; the newer call that superseded it did whatever the hold needed.
+        if (outcome.superseded)
+            return outcome;
         const now = Date.now();
         const pendingLive = (c) => c.state === 'pending' && now - Date.parse(c.heldAt) <= SWITCH_HOLD_PENDING_MAX_MS;
-        const before = scopeClaims.filter((c) => c.moduleId === moduleId);
+        const before = scopeClaims.filter((c) => c.moduleId === holdKey);
         if (to === 'on') {
             // Every ON, claims or not: its tombstone is what keeps a rewind's stale read from claiming
             // the module after this (#1839).
             this.holdSnapshot = null;
-            await this.switchHoldsStub().switchHoldOn(scopeId, moduleId, before.map((c) => c.claimId));
+            await this.switchHoldsStub().switchHoldOn(scopeId, holdKey, before.map((c) => c.claimId));
         }
         else if (outcome.held && before.length > 0) {
             const survived = before.filter((c) => !pendingLive(c) && c.doomed !== instance);
             if (survived.length > 0) {
                 this.holdSnapshot = null;
-                await this.switchHoldsStub().switchHoldRelease(scopeId, moduleId, survived.map((c) => c.claimId));
+                await this.switchHoldsStub().switchHoldRelease(scopeId, holdKey, survived.map((c) => c.claimId));
             }
         }
         if (to === 'off' && outcome.changed) {
@@ -5265,7 +5902,7 @@ export class CloudflareScopeHost {
             const joins = new Set([...scopeClaims, ...after].filter((c) => pendingLive(c) || c.doomed === instance).map((c) => c.claimId));
             if (joins.size > 0) {
                 this.holdSnapshot = null;
-                await this.switchHoldsStub().switchHoldJoin(scopeId, moduleId, [...joins]);
+                await this.switchHoldsStub().switchHoldJoin(scopeId, holdKey, [...joins]);
             }
         }
         return outcome;
@@ -5329,11 +5966,16 @@ export class CloudflareScopeHost {
         await holds.switchHoldArm(scopeId, claimId, result.instance ?? null).catch(() => undefined);
         return { rewindingTo: result.rewindingTo };
     }
-    /** The modules this scope's own storage has switched off, as a rewind reads them before it arms. */
+    /**
+     * The subjects this scope's own storage has switched off, as a rewind reads them before it arms:
+     * its modules, and (#2029) its peers, each by its hold key (`holdKeyOf`).
+     */
     async offInStorage(scopeId) {
-        return (await this.systemGrantsStatusLocal(scopeId))
-            .filter((e) => e.schedules === 'off')
-            .map((e) => e.moduleId);
+        const [modules, peers] = await Promise.all([this.systemGrantsStatusLocal(scopeId), this.peerGrantsStatusLocal(scopeId)]);
+        return [
+            ...modules.filter((e) => e.schedules === 'off').map((e) => holdKeyOf('system', e.moduleId)),
+            ...peers.filter((e) => e.calls === 'off').map((e) => holdKeyOf('peer', e.vertical)),
+        ];
     }
     /**
      * #1839: wait until every row of this rewind's claim is `SWITCH_HOLD_SETTLE_MS` old. The settle
@@ -5402,7 +6044,11 @@ export class CloudflareScopeHost {
      * arrive as a different class of answer just because the caller asked for a socket.
      */
     liveReads = {
-        subscribe: async ({ tenantId, scopeId, principal, request }) => {
+        subscribe: async ({ tenantId, scopeId, principal, request, within }) => {
+            // Decided before anything else, and thrown: a `within` that is neither a plain
+            // EntityRef nor a value `vouchedWithin` built is a caller bug, and the two ways of
+            // guessing at it both open a feed wider than was asked for (#1853).
+            const narrowed = liveWithinOf(within);
             if (!isUpgradeRequest(request)) {
                 return new Response('live reads are a WebSocket surface', {
                     status: 426,
@@ -5460,6 +6106,10 @@ export class CloudflareScopeHost {
             headers.set(LIVE_PRINCIPAL_HEADER, principal);
             headers.set(LIVE_TENANT_HEADER, tenantId);
             headers.set(LIVE_SCOPE_HEADER, scopeId);
+            if (narrowed)
+                headers.set(LIVE_WITHIN_HEADER, encodeLiveWithin(narrowed));
+            else
+                headers.delete(LIVE_WITHIN_HEADER);
             const forwarded = new Request(new URL(LIVE_SUBSCRIBE_PATH, 'https://scope.substrat.internal'), 
             // `new Request(url, { …, headers })` rather than `new Request(request, …)`:
             // the DO is addressed by its own path, not the client's, and the upgrade
@@ -5538,10 +6188,10 @@ export class CloudflareScopeHost {
         // good. Read first, so a pair the directory does not hold writes nothing.
         const scope = await this.cp.getScopeRecord(tenantId, scopeId);
         if (!scope)
-            throw substratError('not_found', `unknown scope for tenant: (${tenantId}, ${scopeId})`);
+            throw unknownScopeForTenant(tenantId, scopeId);
         const { roles, tuples, entitlements, identities } = await this.tenantProjection(tenantId);
         const connectionKeys = await this.connectionKeyRows(tenantId, scope.vertical);
-        await this.scopeStub(scopeId).applyProjection(tenantId, roles, tuples, entitlements, undefined, identities, connectionKeys);
+        unwrapReply(await this.scopeStub(scopeId).applyProjectionReply(tenantId, roles, tuples, entitlements, undefined, identities, connectionKeys));
     }
     /**
      * Fan the tenant's current state out into ALL its scopes — called after any
@@ -5590,7 +6240,7 @@ export class CloudflareScopeHost {
             if (!keysByVertical.has(vertical)) {
                 keysByVertical.set(vertical, this.connectionKeyRows(tenantId, s.vertical));
             }
-            await this.scopeStub(s.scope_id).applyProjection(tenantId, roles, tuples, entitlements, undefined, identities, await keysByVertical.get(vertical));
+            unwrapReply(await this.scopeStub(s.scope_id).applyProjectionReply(tenantId, roles, tuples, entitlements, undefined, identities, await keysByVertical.get(vertical)));
         }));
         const failed = settled.flatMap((r, i) => (r.status === 'rejected' ? [{ scope: scopes[i].scope_id, reason: r.reason }] : []));
         if (failed.length === 0)
@@ -5620,10 +6270,11 @@ export class CloudflareScopeHost {
      * from its own storage. No tenant-level tuples, no control plane.
      */
     async provisionScopeLocal(input) {
+        const carry = recordedOffFromWire(input);
         const services = await this.servicePrincipals?.(input.tenantId, input.scopeId);
         const stub = this.scopeStub(input.scopeId);
         await this.migrateAndRecord(input.scopeId); // create the module tables (setMigrationState no-ops on a null CP)
-        const switchedOff = await stub.applyProjection(input.tenantId, input.roles.map((r) => ({ role_key: r.key, permissions: JSON.stringify(r.permissions), source: r.source })), [], // no tenant-level tuples — a CP-less vertical grants at scope level only
+        const switchedOff = unwrapReply(await stub.applyProjectionReply(input.tenantId, input.roles.map((r) => ({ role_key: r.key, permissions: JSON.stringify(r.permissions), source: r.source })), [], // no tenant-level tuples — a CP-less vertical grants at scope level only
         // Only PROJECT (and thereby switch on strict enforcement) when the platform actually
         // supplies entitlements. Omitting them leaves the scope un-projected and trusting-
         // upstream, so a vertical whose provision path predates #304 is never denied — it
@@ -5713,12 +6364,10 @@ export class CloudflareScopeHost {
                 public_key: k.publicKey,
             }))
             : undefined, 
-        // #1742: the recorded-off modules, switched off after the seat in the same unit, on the
-        // scope this call provisions — the one the seat's tuples name.
-        input.switchedOff
-            ? { scopeId: input.scopeId, moduleIds: input.switchedOff, at: new Date().toISOString() }
-            : undefined, services?.map((id) => `principal:${id}`));
-        return input.switchedOff ? { switchedOff } : {};
+        // #1742: the recorded-off modules and (#2029) peers, switched off after the seat in the
+        // same unit, on the scope this call provisions — the one the seat's tuples name.
+        carry ? { scopeId: input.scopeId, at: new Date().toISOString(), ...carry } : undefined, services?.map((id) => `principal:${id}`)));
+        return carry ? { switchedOff } : {};
     }
     /**
      * Resolve an external identity from a scope's PROJECTED links (#406) — the CP-less
@@ -5857,6 +6506,8 @@ export class CloudflareScopeHost {
     async connectorGrantLocal(connectionId, scopeId, permission, expiresAt) {
         await this.writeScopeTuple(scopeId, subjectRef({ kind: 'connection', id: connectionId }), `granted:${permission}`, `scope:${scopeId}`, expiresAt ?? null);
     }
+    /** #2045 (Codex r3): every switch mover here honours the fence — what `/internal/switch-fence` reports. */
+    switchFenced = true;
     /**
      * The far end of the schedule kill switch for a scope served HERE (#1666):
      * `/internal/system-switch` lands on this, from the shared control plane's
@@ -5865,11 +6516,11 @@ export class CloudflareScopeHost {
      * admin log and writes the row once this returns. `held: false` is an answer, not a
      * throw — see `systemSwitchOutcome`.
      */
-    async systemSwitchLocal(scopeId, moduleId, to) {
+    async systemSwitchLocal(scopeId, moduleId, to, opts) {
         // Parsed on the way out: this is the wire answer the platform reads, and the DO's
         // plain strings become the published shape here rather than on trust.
         // #1819: `switchInScope` releases a rewind's hold on the module once the switch lands.
-        return systemSwitchOutcome.parse(await this.switchInScope(scopeId, moduleId, to, new Date().toISOString()));
+        return systemSwitchOutcome.parse(await this.switchInScope('system', scopeId, moduleId, to, new Date().toISOString(), opts?.tenantHeld ?? false, opts?.fence));
     }
     /**
      * The far end of the status read for a scope served HERE (#1674): `/internal/system-grants`
@@ -5904,9 +6555,12 @@ export class CloudflareScopeHost {
      * Move one peer's kill switch on a scope served HERE (#1706) — the far end of
      * `revokeFromPeer` / `restoreToPeer` for a hosted scope. Nothing is audited here; the
      * platform writes the admin rows around this call, as for the schedule switch.
+     * #2029: through `switchInScope`, so the move releases a rewind's hold on the peer once it
+     * lands, as a module's does. #2030: `tenantHeld`, the platform's word that the peer holds a
+     * live tenant-level grant, which this deployment has no directory to read.
      */
-    async peerSwitchLocal(scopeId, vertical, to) {
-        return peerSwitchOutcome.parse(await this.scopeStub(scopeId).switchPeer(verticalSlug.parse(vertical), scopeId, to, new Date().toISOString()));
+    async peerSwitchLocal(scopeId, vertical, to, opts) {
+        return peerSwitchOutcome.parse(await this.switchInScope('peer', scopeId, verticalSlug.parse(vertical), to, new Date().toISOString(), opts?.tenantHeld ?? false, opts?.fence));
     }
     // -- the cross-vertical far ends (#1705 PR 2) --------------------------------
     // The shared control plane runs the cross-vertical phase for every hosted edge and reaches the
@@ -5920,7 +6574,25 @@ export class CloudflareScopeHost {
     async exportedEventsLocal(tenantId, scopeId, raw) {
         const input = exportReadInput.parse(raw);
         await this.assertServesLocally(tenantId, scopeId, 'readExportedEvents');
-        return exportedBatch.parse(await this.scopeStub(scopeId).exportedEventsRead(input, tenantId, scopeId));
+        return this.readExportsThroughDoor(input, tenantId, scopeId);
+    }
+    /**
+     * #2029: a producer's export read, through the CONSUMER's peer door: the consumer's grants on
+     * this scope decide what leaves it, so a consumer the rewind hold keeps off must hold nothing
+     * here, exactly as a switched-off one does. Gated and pinned like every door call; held, the
+     * producer answers every key missing, so the edge pauses rather than reading past the hold.
+     */
+    async readExportsThroughDoor(input, tenantId, scopeId) {
+        const stub = this.scopeStub(scopeId);
+        const door = await this.openDoor('peer', input.consumer, scopeId);
+        try {
+            return exportedBatch.parse(await door.through((instance) => stub.exportedEventsRead(input, tenantId, scopeId, { instance })));
+        }
+        catch (err) {
+            if (!this.isHeldRefusal(err))
+                throw err;
+            return exportedBatch.parse(await stub.exportedEventsRead(input, tenantId, scopeId, { held: true }));
+        }
     }
     /**
      * The consumer's imports and watermarks (#1705), for a scope served HERE. The served-here
@@ -5970,7 +6642,7 @@ export class CloudflareScopeHost {
         }
         const rec = await this.cp.getScopeRecord(tenantId, scopeId);
         if (!rec)
-            throw substratError('not_found', `unknown scope for tenant: (${tenantId}, ${scopeId})`);
+            throw unknownScopeForTenant(tenantId, scopeId);
         const source = await importCursorSourceOf((t, v) => this.admin.resolveVerticalInstance(t, v), { tenantId, scopeId, vertical: rec.vertical }, move.from);
         // Where the write lands is the peer switch's rule: a scope bound to a vertical is served by
         // that vertical's deployment, and its watermark lives there. Without a delegation that