@substrat-run/adapter-cloudflare 0.136.0 → 0.138.0

package/dist/scope-do.js

@@ -1,12 +1,14 @@
 import { REWIND_REFUSED } from './rewind-refusal.js';
+import { SYSTEM_DOOR_MOVED } from './system-door.js';
 import { DurableObject } from 'cloudflare:workers';
 import { ATTACHMENT_ADDED, ATTACHMENT_REMOVED, attachmentRecord, domainEvent, domainEventInput, eventId, instant, objectRef, entityObjectRef, assertModuleEmittableType, assertKernelAuthoredType, toWireFailure, grantRefFromProof, principalId, scopeId as scopeIdOf, tenantId as tenantIdOf, platformRequestInput, platformRequestId, MAX_PENDING_PLATFORM_REQUESTS, MAX_PENDING_SWEEP_RUNS, SWEEP_RUNS_KIND, SCOPE_TABLE_PAGE_MAX, SCOPE_QUERY_ROW_MAX, listLimitOf, requestFingerprint, substratError, errorCodeOf, assertReplayableDump, REDRAIN_BATCH, } from '@substrat-run/contracts';
-import { ulid, DO_SQL_LIMITS, unknownRoleError, createUlid, assertAllowed, ConnectionSealingKeyUnavailableError, noSealingKeyMessage, sealTo, assertReadOnlyQuery, entitlementDenial, platformRequestHistoryQuery, platformRequestOf, PLATFORM_REQUEST_COLUMNS, PLATFORM_REQUEST_REDACTION_SQL, platformRequestRedactionParams, platformRequestRedactionQuery, intentPayloadCarriesSubject, redactSubjectJobRuns, redactSubjectScopeText, assertRowLimit, assertRowOffset, JOB_RUN_PATCH_SQL, JOB_STEP_RECORD_SQL, DELIVERY_ERROR_REDACTION_SQL, REDACTED_DELIVERY_NOTE, seatScopeTuple, effectiveRoleGrantQuery, switchRecordedOff, switchSystemSchedules, peerGrantsStatus, systemGrantsStatus, systemScheduleState, systemSwitchedOff, denialListQuery, refusalListQuery, mapRefusalRow, denialSummaryQuery, denialTotalsQuery, DENIAL_WINDOW_QUERY, mapDenialRow, mapDenialSummaryBuckets, PermissionDenied, assertImpersonationWrites, assertModuleEnqueueableKind, impersonationStampOf, createAtomic, NotSearchable, isSearchIndexTable, searchIndexDdl, searchIndexPlans, NotListable, listIndexPlans, moduleMigrations, listQuery, cursorOf, searchLimit, searchMatchExpression, searchQuery, ATTACHMENT_TEXT_DDL, attachmentRecordOfRow, enqueueAttachmentText, reconcileAttachmentText, recordAttachmentText, searchAttachments, IDEMPOTENCY_DDL, REFUSALS_DDL, refusalInsert, refusedTransitionOf, assertIdempotencyKey, assertPermissionKey, idempotencyLookupQuery, idempotencyPruneStatement, idempotencyRecordStatement, idempotencyOptedOutMessage, replayFor, entityVersionQuery, entityVersionOf, assertIfMatch, OUTBOX_ENTITY_INDEX, SCHEDULE_STATE_DDL, SCHEDULE_STATE_REBUILD, scheduleStateHasKind, VERTICAL_EVENTS_DDL, EXPORT_HOPS_SQL, IMPORT_CURSORS_SQL, IMPORT_CURSOR_OF_SQL, OUTBOX_MARK_SQL, exportedSinceQuery, emittedSinceQuery, emittedReportOf, EMITTED_REPORT_CAP, IMPORT_CURSOR_ADVANCE_SQL, IMPORT_RECORD_SQL, moveImportCursor, CrossVerticalRegistry, exportReadPlan, exportReadQuery, planExportBatch, withheldNote, JOB_RUN_DDL, jobRunListLimit, } from '@substrat-run/kernel';
-import { isUpgradeRequest, readSubscription, LIVE_FANOUT_LIMIT, LIVE_MODE_HEADER, LIVE_PRINCIPAL_HEADER, LIVE_SCOPE_HEADER, LIVE_SUBSCRIBE_PATH, LIVE_TENANT_HEADER, } from './live-reads.js';
+import { ulid, DO_SQL_LIMITS, unknownRoleError, createUlid, assertAllowed, ConnectionSealingKeyUnavailableError, noSealingKeyMessage, sealTo, assertReadOnlyQuery, entitlementDenial, platformRequestHistoryQuery, platformRequestOf, PLATFORM_REQUEST_COLUMNS, PLATFORM_REQUEST_REDACTION_SQL, platformRequestRedactionParams, platformRequestRedactionQuery, intentPayloadCarriesSubject, redactSubjectJobRuns, redactSubjectScopeText, assertRowLimit, assertRowOffset, JOB_RUN_PATCH_SQL, JOB_RUN_CLAIM_SQL, JOB_RUN_RENEW_SQL, JOB_RUN_BEGIN_SQL, JOB_RUN_MISS_SQL, JOB_RUN_MISS_SETTLE_SQL, admissionMissOutcome, JOB_LEASE_EXPIRED_NOTE, JOB_STEP_RECORD_SQL, DELIVERY_ERROR_REDACTION_SQL, REDACTED_DELIVERY_NOTE, seatScopeTuple, effectiveRoleGrantQuery, switchRecordedOff, switchSystemSchedules, peerGrantsStatus, systemGrantsStatus, systemScheduleState, systemSwitchedOff, denialListQuery, refusalListQuery, mapRefusalRow, denialSummaryQuery, denialTotalsQuery, DENIAL_WINDOW_QUERY, mapDenialRow, mapDenialSummaryBuckets, PermissionDenied, assertImpersonationWrites, assertModuleEnqueueableKind, impersonationStampOf, createAtomic, NotSearchable, isSearchIndexTable, searchIndexDdl, searchIndexPlans, NotListable, listIndexPlans, moduleMigrations, listQuery, cursorOf, searchLimit, searchMatchExpression, searchQuery, ATTACHMENT_TEXT_DDL, attachmentRecordOfRow, enqueueAttachmentText, reconcileAttachmentText, recordAttachmentText, searchAttachments, IDEMPOTENCY_DDL, REFUSALS_TABLE_DDL, REFUSALS_INDEX, refusalInsert, refusalOf, markGuardRefusal, REFUSALS_REBUILD, refusalsAdmitGuards, assertIdempotencyKey, assertPermissionKey, idempotencyLookupQuery, idempotencyPruneStatement, idempotencyRecordStatement, idempotencyOptedOutMessage, replayFor, entityVersionQuery, entityVersionOf, assertIfMatch, OUTBOX_ENTITY_INDEX, SCHEDULE_STATE_DDL, SCHEDULE_STATE_REBUILD, scheduleStateHasKind, VERTICAL_EVENTS_DDL, EXPORT_HOPS_SQL, emptyImportResult, IMPORT_CURSORS_SQL, IMPORT_CURSOR_OF_SQL, OUTBOX_MARK_SQL, exportedSinceQuery, emittedSinceQuery, emittedReportOf, EMITTED_REPORT_CAP, IMPORT_CURSOR_ADVANCE_SQL, IMPORT_RECORD_SQL, moveImportCursor, CrossVerticalRegistry, exportReadPlan, exportReadQuery, planExportBatch, withheldNote, JOB_RUN_DDL, JOB_RUN_DUE_AT, jobRunListLimit, SYSTEM_DOOR_WAIT, ancestorsWithin, } from '@substrat-run/kernel';
+import { isUpgradeRequest, readSubscription, LIVE_FANOUT_LIMIT, LIVE_MODE_HEADER, LIVE_PRINCIPAL_HEADER, LIVE_SCOPE_HEADER, LIVE_SUBSCRIBE_PATH, LIVE_TENANT_HEADER, LIVE_WITHIN_HEADER, decodeLiveWithin, } from './live-reads.js';
+import { replyOf } from './do-reply.js';
 import { OperationQueue } from './serialization.js';
 import { doScopedSql, doBuiltColumnsOf, doRedactionSql, doSpineSql } from './sql.js';
-import { actorOf, admitPeer, collectPeers, switchPeer, assertNoSecret, CAPABILITY_DDL, COPY_ORIGIN_DDL, CAPABILITY_EXCHANGE_OPERATION, capabilityAttachmentWriteRefused, createCapabilityVerbs, createEntityEdgeVerbs, exchangeCapability, guardSecrets, mintBecomeCapability, redactSecrets, redactSecretText, moduleLog, asyncInvocationId, asyncLinePass, resolveCapabilitySession, revokeCapabilityAsPlatform, readCapabilityPage, domainEventOf, facetEvents, readDeadLetters, readLifecycleFlow, readHistory, readInvocation, readUndrainedOutbox, walkEventCause, walkEventEffects, } from '@substrat-run/kernel';
-import { createDoTupleChecker, createLocalControlPlaneReader } from './checker.js';
+import { actorOf, admitPeer, collectPeers, switchPeer, peerSubjectRef, subjectGrantState, assertNoSecret, CAPABILITY_DDL, COPY_ORIGIN_DDL, SWITCH_FENCES_DDL, CAPABILITY_EXCHANGE_OPERATION, capabilityAttachmentWriteRefused, createCapabilityVerbs, createEntityEdgeVerbs, exchangeCapability, guardSecrets, mintBecomeCapability, redactSecrets, redactSecretText, moduleLog, asyncInvocationId, asyncLinePass, resolveCapabilitySession, revokeCapabilityAsPlatform, readCapabilityPage, domainEventOf, facetEvents, readDeadLetters, readLifecycleFlow, readOperationSeries, readHistory, readInvocation, readUndrainedOutbox, walkEventCause, walkEventEffects, } from '@substrat-run/kernel';
+import { createDoTupleChecker, createLocalControlPlaneReader, scopeTupleReader } from './checker.js';
 import { CARRIED_AWAY_KEY, COPY_MARK_CLEARED_KEY, KEPT_COPY_REFUSAL, KEPT_DIVERGENT_KEY, LOAD_STAMP_KEY, STORE_LOCAL_META_KEYS, WRITE_REVISION_KEY, carriedAwayDump, isCopyMarkInsert, isWriteStatement, assertNoSpineReference, assertSpineTablesBuilt, capabilitiesForLoad, clearCopyMarker, dumpRowsInsert, isSpineTable, markCopyOrigin, repointScopeGrants, settleCopiedWork, emittedHere, IS_COPY_SQL, isCopyLoad, isLifecycleWrite, readLifecycle, settleLifecycleAfterLoad, writeLifecycle, spineColumnAdditions } from '@substrat-run/kernel';
 /**
  * The key marking a scope DO whose storage was destroyed (`destroyStorage`).
@@ -15,6 +17,21 @@ import { CARRIED_AWAY_KEY, COPY_MARK_CLEARED_KEY, KEPT_COPY_REFUSAL, KEPT_DIVERG
  * without asking the directory.
  */
 const REAPED_MARKER = '_substrat_reaped';
+/**
+ * The `_substrat_meta` key of the tenant a scope was provisioned for (#1738): written by the first
+ * projection, never re-pointed, and what every door's pair check holds a request to (#2016).
+ */
+const PROVISIONED_FOR_KEY = 'provisioned_for';
+/** #2016: the refusal of a write that would re-point a scope's tenant, in one wording. */
+const tenantReceiptRefusal = (held, asked) => `refused: this scope was provisioned for tenant ${held}, not ${asked}`;
+/** #2016: the spine tables whose rows say a scope holds state (`ScopeDO.holdsData`). */
+const HOLDS_DATA_TABLES = ['_substrat_migrations', '_substrat_tuples', '_substrat_outbox', '_substrat_schedule_state'];
+/** #2016: why `tenantId` is foreign to a scope (`held`, the receipt `tenantVerdict` read), in one wording. */
+const foreignTenant = (held, tenantId) => held !== null
+    ? tenantReceiptRefusal(held, tenantId)
+    : `refused: this scope holds role rows for another tenant and none for ${tenantId}`;
+/** #2016: the load refusals `tenantReceiptRefusal` raised, told apart by identity, not by text. */
+const tenantRefusals = new WeakSet();
 /**
  * The scope spine, as this adapter builds it — one of two hand-written copies (#969).
  *
@@ -174,6 +191,7 @@ const KERNEL_DDL = `
     taken_at TEXT NOT NULL,
     pending TEXT NOT NULL
   );
+  ${SWITCH_FENCES_DDL}
   CREATE TABLE IF NOT EXISTS _substrat_tuples (
     subject TEXT NOT NULL,
     relation TEXT NOT NULL,
@@ -322,7 +340,8 @@ const KERNEL_DDL = `
   -- #116: the request-dedupe table, kernel-owned so no vertical migrates for it.
   ${IDEMPOTENCY_DDL}
   -- #1745: refused transitions, recorded after the rollback like a denial. Kernel-owned.
-  ${REFUSALS_DDL}
+  ${REFUSALS_TABLE_DDL}
+  ${REFUSALS_INDEX}
   -- #1672: capabilities — authority carried by a secret (a link share), and the sessions
   -- an exchange trades that secret for. Shared with the pure adapter from
   -- @substrat-run/kernel so the two cannot part company; the column comments are there.
@@ -644,6 +663,15 @@ export function splitSqlStatements(sql) {
         out.push(cur.trim());
     return out;
 }
+/**
+ * #1834: the pin missed. Thrown only by `assertSystemDoor`, and module-private, so no operation can
+ * throw one: the two RPCs a door call reaches turn it into the `SystemDoorMoved` ANSWER, by class
+ * identity, and an operation's own error, whatever its text, stays a failure.
+ */
+class SystemDoorMovedError extends Error {
+}
+/** #1834: the brand only `assertSystemDoor` sets, so nothing else can make a `SystemDoorPass`. */
+const SYSTEM_DOOR_PASSED = Symbol('system door passed');
 export function defineScopeDO(modules, bareOps) {
     return class ScopeDO extends DurableObject {
         sql;
@@ -1041,7 +1069,16 @@ export function defineScopeDO(modules, bareOps) {
          * On the queue, so no operation is mid-transaction while the outbox is read. An event
          * must not reach another vertical before the transaction that wrote it has committed.
          */
-        async exportedEventsRead(input, tenantId, scopeId) {
+        async exportedEventsRead(input, tenantId, scopeId, 
+        /**
+         * #2029: the consumer is a peer, so the read is gated by its door. `instance` pins it to the
+         * gate's read, as every door call is; `held` says the rewind hold keeps the consumer off, and
+         * then it holds nothing here: every key is missing, the answer a switched-off consumer gets.
+         */
+        door) {
+            const held = door !== undefined && 'held' in door;
+            if (!held && this.peerDoorMoved(input.consumer, door?.instance))
+                return SYSTEM_DOOR_MOVED;
             await this.ensureMigrations();
             const plan = exportReadPlan(this.crossVertical.exports(), input.wants);
             const quiet = {
@@ -1054,9 +1091,11 @@ export function defineScopeDO(modules, bareOps) {
             };
             if (plan.types.length === 0)
                 return quiet;
-            const missing = (await this.peerCovers(tenantId, scopeId, input.consumer, plan.keys))
-                .filter((c) => !c.held)
-                .map((c) => c.permission);
+            const missing = held
+                ? plan.keys
+                : (await this.peerCoverage(tenantId, scopeId, input.consumer, plan.keys))
+                    .filter((c) => !c.held)
+                    .map((c) => c.permission);
             if (missing.length > 0)
                 return { ...quiet, paused: { missing } };
             return await this.queue.enqueue(() => {
@@ -1106,25 +1145,76 @@ export function defineScopeDO(modules, bareOps) {
          * pair check), and a stray role row can no longer make a scope serve a tenant it was never
          * provisioned for.
          *
-         * A scope with NO receipt was provisioned before it existed, or has just been restored (a
-         * dump's receipt is dropped on import: it describes the scope the dump came from). Only
-         * then is the old inference used: `provisionScopeLocal` projected role definitions under
-         * the tenant, so a `_substrat_roles` row for it says the same thing. The next projection
-         * (reconcile, or the restore's repair) writes the receipt, after which the inference is
-         * never consulted again.
+         * A scope with NO receipt was provisioned before it existed (a load never brings the dump's:
+         * it describes the scope the dump came from, and the store keeps its own, #2016). Only then
+         * is the old inference used: `provisionScopeLocal` projected role definitions under the
+         * tenant, so a `_substrat_roles` row for it says the same thing. The next projection
+         * (reconcile, or the restore's repair) or lifecycle delivery writes the receipt, after which
+         * the inference is never consulted again.
          *
          * Read without migrating, so asking about a foreign scope leaves its DO as empty as it found it.
          */
         async servesTenant(tenantId) {
-            const has = (table) => this.sql.exec(`SELECT 1 FROM sqlite_master WHERE type = 'table' AND name = ?`, table).toArray().length > 0;
-            if (has('_substrat_meta')) {
-                const receipt = this.sql.exec(`SELECT value FROM _substrat_meta WHERE key = 'provisioned_for'`).toArray()[0];
-                if (receipt)
-                    return receipt.value === tenantId;
+            const { verdict } = this.tenantVerdict(tenantId);
+            return verdict === 'recorded' || verdict === 'inferred';
+        }
+        /**
+         * #2016: what one door into this scope needs from its storage on a CP-less host, in ONE call —
+         * how `tenantId` reads against the scope (`tenantVerdict`), and the lifecycle the platform
+         * delivered (#1713). The coordinator refuses a foreign pair before any guard, handler or store
+         * lookup runs, and reports an `unknown` one it lets through. Read without migrating, like
+         * `servesTenant`.
+         */
+        admission(tenantId) {
+            return { verdict: this.tenantVerdict(tenantId).verdict, lifecycle: readLifecycle(this.switchSql()) };
+        }
+        /**
+         * #1738 / #2016: this scope's tenant against `tenantId` — the one reading behind the served-here
+         * gate, every door's pair check and the lifecycle delivery's back-fill.
+         *
+         *  - `recorded`: the `provisioned_for` receipt names `tenantId`.
+         *  - `foreign`: the receipt names another tenant, or — on a scope provisioned before receipts
+         *    existed — the scope holds role rows and none of them is `tenantId`'s.
+         *  - `inferred`: no receipt, and a role row for `tenantId` (what `provisionScopeLocal` projected
+         *    before the receipt existed).
+         *  - `unknown`: no receipt and no role rows — never provisioned here, or loaded from a world
+         *    that keeps its roles elsewhere and not yet repaired. Nothing to hold the pair against.
+         *
+         * `held` is the receipt read, so a refusal can name it. Read without migrating, so asking about
+         * a foreign scope leaves its DO as empty as it found it.
+         */
+        tenantVerdict(tenantId) {
+            const held = this.provisionedFor();
+            if (held !== null)
+                return { verdict: held === tenantId ? 'recorded' : 'foreign', held };
+            if (!this.hasTable('_substrat_roles'))
+                return { verdict: 'unknown', held };
+            if (this.sql.exec('SELECT 1 FROM _substrat_roles WHERE tenant_id = ? LIMIT 1', tenantId).toArray().length > 0) {
+                return { verdict: 'inferred', held };
             }
-            if (!has('_substrat_roles'))
-                return false;
-            return this.sql.exec('SELECT 1 FROM _substrat_roles WHERE tenant_id = ? LIMIT 1', tenantId).toArray().length > 0;
+            const anyRole = this.sql.exec('SELECT 1 FROM _substrat_roles LIMIT 1').toArray().length > 0;
+            return { verdict: anyRole ? 'foreign' : 'unknown', held };
+        }
+        /**
+         * #2016: whether a scope with no receipt and no role rows holds state — rather than being a DO
+         * nothing ever provisioned or loaded here. Only such a scope takes its tenant from a lifecycle
+         * delivery: recording one in an empty DO would make `servesTenant` answer for a scope this
+         * deployment does not hold.
+         *
+         * Every provision since #1738 writes the receipt itself (that IS the durable provision marker),
+         * so this only ever judges a scope from before it, or a load from an older platform. A module
+         * with no SQL migrations still leaves spine state, so any of it counts, not migrations alone:
+         * applied migrations, scope tuples (its grants, `system:` ones included), events, schedule state.
+         */
+        holdsData() {
+            return HOLDS_DATA_TABLES.some((table) => this.hasTable(table) && this.sql.exec(`SELECT 1 FROM ${table} LIMIT 1`).toArray().length > 0);
+        }
+        /** #1738: the tenant this scope's `provisioned_for` receipt names, or null; read without migrating. */
+        provisionedFor() {
+            return this.hasTable('_substrat_meta') ? this.metaValue(PROVISIONED_FOR_KEY) : null;
+        }
+        hasTable(name) {
+            return this.sql.exec(`SELECT 1 FROM sqlite_master WHERE type = 'table' AND name = ?`, name).toArray().length > 0;
         }
         /** #1705 PR 2: the outbox's insertion mark (`OUTBOX_MARK_SQL`). */
         outboxMark() {
@@ -1144,20 +1234,16 @@ export function defineScopeDO(modules, bareOps) {
          * The coordinator parses the batch before it gets here and runs the executors after.
          * Executors live on the coordinator here, as they do after an invoke.
          */
-        async importApply(batch, tenantId, scopeId) {
-            await this.ensureMigrations();
+        async importApply(batch, tenantId, scopeId, 
+        /** #2029: the instance the peer door's gate read for the producer; on another, nothing applies. */
+        doorInstance) {
             const source = batch.source;
+            if (this.peerDoorMoved(source.vertical, doorInstance))
+                return SYSTEM_DOOR_MOVED;
+            await this.ensureMigrations();
             return await this.queue.enqueue(async () => {
                 const liveSince = this.liveHighWaterMark();
-                const result = {
-                    delivered: 0,
-                    deadLettered: 0,
-                    duplicates: 0,
-                    withheld: 0,
-                    cursor: batch.after,
-                    stale: false,
-                    paused: null,
-                };
+                const result = emptyImportResult(batch);
                 // #1706's door, for a delivery (`operation: null`), inside the queued body: the producer
                 // is a declared peer with its switch on, or nothing runs and the edge pauses.
                 let peerSubject;
@@ -1383,6 +1469,10 @@ export function defineScopeDO(modules, bareOps) {
         lifecycleFlow(input) {
             return readLifecycleFlow({ sql: doScopedSql(this.sql) }, input);
         }
+        /** #1750: business volumes per bucket, counted over this scope's outbox. */
+        operationSeries(input) {
+            return readOperationSeries({ sql: doScopedSql(this.sql) }, input);
+        }
         migrationBookmarks(limit = 20) {
             return this.sql
                 .exec(`SELECT bookmark, taken_at, pending FROM _substrat_migration_bookmarks
@@ -1625,21 +1715,33 @@ export function defineScopeDO(modules, bareOps) {
          * `vertical.honoured`: an old DO that ignored this argument would run the call as that
          * placeholder, and the coordinator refuses a success without the acknowledgement.
          */
-        verticalCaller) {
+        verticalCaller, 
+        /**
+         * #1834: set on a system-door call — the instance whose state read the door's gate
+         * consulted the rewind hold against. On any other instance nothing runs and the answer is
+         * `systemDoorMoved` instead, because a PITR restore always restarts this object, so another
+         * instance may be rewound storage the gate never saw. The reply carries `systemDoor.honoured`.
+         */
+        systemDoorInstance) {
             if (!failureEnvelope) {
                 // Legacy path, byte-for-byte what it was: rewrapped so a non-plain error (a
                 // ZodError, whose `message` is a getter) still arrives with its message.
                 try {
-                    return await this.invokeOrThrow(operation, input, principal, tenantId, scopeId, connectionId, requiredEntitlement, systemModuleId, invokeOptions, impersonation, capabilitySession, verticalCaller);
+                    return await this.invokeOrThrow(operation, input, principal, tenantId, scopeId, connectionId, requiredEntitlement, systemModuleId, invokeOptions, impersonation, capabilitySession, verticalCaller, systemDoorInstance);
                 }
                 catch (err) {
+                    if (err instanceof SystemDoorMovedError)
+                        return { result: undefined, platformRequests: 0, ...SYSTEM_DOOR_MOVED };
                     throw toRpcError(err);
                 }
             }
             try {
-                return await this.invokeOrThrow(operation, input, principal, tenantId, scopeId, connectionId, requiredEntitlement, systemModuleId, invokeOptions, impersonation, capabilitySession, verticalCaller);
+                return await this.invokeOrThrow(operation, input, principal, tenantId, scopeId, connectionId, requiredEntitlement, systemModuleId, invokeOptions, impersonation, capabilitySession, verticalCaller, systemDoorInstance);
             }
             catch (err) {
+                // #1834: the pin missed — an answer, never a failure an operation could have produced.
+                if (err instanceof SystemDoorMovedError)
+                    return { result: undefined, platformRequests: 0, ...SYSTEM_DOOR_MOVED };
                 // The ONE place the error keeps its structure: flattened here, rebuilt by the
                 // coordinator. `toRpcError` is not applied — that exists to make a throw
                 // survivable, and this is not a throw.
@@ -1653,7 +1755,9 @@ export function defineScopeDO(modules, bareOps) {
         /** #1672: a capability session's hash. See `invoke` above. */
         capabilitySession, 
         /** #1706: the calling vertical, as the platform named it. See `invoke` above. */
-        verticalCaller) {
+        verticalCaller, 
+        /** #1834: the instance the system door's gate read. See `invoke` above. */
+        systemDoorInstance) {
             await this.ensureMigrations();
             const handler = this.operations.get(operation);
             // `not_found`, not a bare throw (#113): every vertical hand-matched this message
@@ -1736,6 +1840,9 @@ export function defineScopeDO(modules, bareOps) {
                 // one call. Same placement as the SQLite adapter's actor task, for this reason.
                 this.invocationId = invokeOptions?.invocationId ?? null;
                 try {
+                    // #1834: before anything opens. This instance is the storage the call meets, for the
+                    // whole call: a restore restarts the object, so it cannot move under a running body.
+                    const systemDoor = this.assertSystemDoor(systemModuleId, systemDoorInstance);
                     // #1672: the capability session, resolved on EVERY call and here — inside the queued
                     // body, the one region where this call holds the DO to itself — so nothing can
                     // revoke between this read and the transaction. Refuses a stale session, a revoked
@@ -1751,6 +1858,8 @@ export function defineScopeDO(modules, bareOps) {
                     // operation off its allowlist are refused `forbidden`; none is a K-35 denial.
                     let peerSubject;
                     if (verticalCaller !== undefined) {
+                        // #2029: pinned to the instance the peer door's gate read against the rewind hold.
+                        this.assertPeerDoor(verticalCaller.vertical, systemDoorInstance);
                         peerSubject = admitPeer(this.switchSql(), this.peers, verticalCaller, operation);
                         idempotencySubjectRef = peerSubject;
                     }
@@ -1810,7 +1919,7 @@ export function defineScopeDO(modules, bareOps) {
                     // emitted events back as one — verified across `await` in workerd.
                     try {
                         await this.revision.transaction(async () => {
-                            const ctx = this.operationContext(principal, tenantId, scopeId, undefined, connectionId, systemModuleId, signals, impersonation, operation, capabilityId, minted, undefined, peerSubject);
+                            const ctx = this.operationContext(principal, tenantId, scopeId, undefined, connectionId, systemDoor, signals, impersonation, operation, capabilityId, minted, undefined, peerSubject);
                             // #116: a retry is answered from the recording, and nothing else runs
                             // — not the guards, not the handler, not the permission check inside
                             // it. Keyed by SUBJECT, so a caller only ever reaches its own
@@ -1878,6 +1987,7 @@ export function defineScopeDO(modules, bareOps) {
                                 impersonation: { honoured: true },
                                 ...(capabilitySession !== undefined ? { capability: { honoured: true } } : {}),
                                 ...(verticalCaller !== undefined ? { vertical: { honoured: true } } : {}),
+                                ...(systemDoorInstance !== undefined ? { systemDoor: { honoured: true } } : {}),
                                 ...(idempotencyKey !== undefined
                                     ? { idempotency: { keyHonoured: true, replayed } }
                                     : {}),
@@ -1942,6 +2052,8 @@ export function defineScopeDO(modules, bareOps) {
                         ...(capabilitySession !== undefined ? { capability: { honoured: true } } : {}),
                         // #1706: the same, for the peer door.
                         ...(verticalCaller !== undefined ? { vertical: { honoured: true } } : {}),
+                        // #1834: the same, for the system door's instance pin.
+                        ...(systemDoorInstance !== undefined ? { systemDoor: { honoured: true } } : {}),
                         // The acknowledgement the coordinator's skew check reads (#116), on the
                         // same reasoning as `ifMatchChecked` below and with a sharper failure: a
                         // DO too old to know about keys would EXECUTE THE OPERATION AGAIN and
@@ -2022,6 +2134,14 @@ export function defineScopeDO(modules, bareOps) {
                     status: 500,
                 });
             }
+            // A narrowing the coordinator sent but this end cannot read is refused, never
+            // dropped: dropping it would open the whole scope's feed — to a vouched
+            // subscriber, one the principal's check was never going to filter (#1853).
+            const withinHeader = request.headers.get(LIVE_WITHIN_HEADER);
+            const within = withinHeader === null ? undefined : decodeLiveWithin(withinHeader);
+            if (withinHeader !== null && !within) {
+                return new Response('live reads: unreadable within narrowing', { status: 500 });
+            }
             // A subscriber arriving before the scope's migrations have run would be told
             // about events against a schema it cannot read back through. Same gate every
             // other entry point takes, for the same reason.
@@ -2046,6 +2166,7 @@ export function defineScopeDO(modules, bareOps) {
                 tenantId: tenantIdOf.parse(tenantId),
                 scopeId: scopeIdOf.parse(scopeId),
                 since: new Date().toISOString(),
+                ...(within ? { within } : {}),
             });
             return new Response(null, { status: 101, webSocket: client });
         }
@@ -2169,6 +2290,11 @@ export function defineScopeDO(modules, bareOps) {
          * to nobody. Knowing that a row exists and changed at 14:02 is information about
          * that row, so the empty payload is not what makes this safe; this is.
          *
+         * *Narrowed, when the subscription asked to be* (#1853). A socket opened `within` an
+         * entity hears only rows that reach it through live parent edges — each row's
+         * ancestors are walked once per pass, however many sockets ask. A vouched root
+         * replaces the check above, and its frames are `LiveNudge`s.
+         *
          * *Never able to fail the operation.* The write has committed and the caller has
          * its answer. A socket that has gone away mid-fan-out, or a check that cannot be
          * evaluated, costs a subscriber its live update — which it survives, because the
@@ -2188,6 +2314,25 @@ export function defineScopeDO(modules, bareOps) {
             const announceable = rows.filter((r) => this.liveTargets.has(r.entity_type));
             if (announceable.length === 0)
                 return;
+            /**
+             * Is a row's entity beneath a `within` root (#1853)? Each row's ancestors are walked
+             * once per pass, on first need, so a check per socket is a set lookup — every widget
+             * visitor's root is a different session, and a walk per (row, socket) would read the
+             * same parent edges once per visitor. Post-commit state: a `ctx.relink` in the same
+             * operation has already moved the edge the walk follows.
+             */
+            const parents = scopeTupleReader(this.sql);
+            const now = new Date().toISOString();
+            const ancestors = new Map();
+            const reaches = async (row, root) => {
+                let up = ancestors.get(row.id);
+                if (!up) {
+                    // A walk that cannot answer is a frame not sent — the same fail-closed rule as the check.
+                    up = ancestorsWithin(parents, { entityType: row.entity_type, entityId: row.entity_id }, now).catch(() => new Set());
+                    ancestors.set(row.id, up);
+                }
+                return (await up).has(`${root.entityType}:${root.entityId}`);
+            };
             for (const ws of sockets) {
                 let subscription = null;
                 try {
@@ -2206,8 +2351,10 @@ export function defineScopeDO(modules, bareOps) {
                 // assumption about how the subscription was created.
                 if (subscription.tenantId !== tenantId || subscription.scopeId !== scopeId)
                     continue;
+                const { within } = subscription;
                 // One context per subscriber, not per event: `ctx.check` is the expensive part
-                // and the context is only the subject it is evaluated for.
+                // and the context is only the subject it is evaluated for. Built on first use, so
+                // a vouched subscriber — whose frames the walk alone decides — never builds one.
                 //
                 // A frame this subscriber does not pass is NOT recorded as a denial (K-35),
                 // and that is deliberate: `recordDenial` is called on a refused REQUEST, where
@@ -2218,35 +2365,50 @@ export function defineScopeDO(modules, bareOps) {
                 //
                 // The operation name is carried anyway, for the events a fan-out cannot emit
                 // but a future reader of this context might.
-                const ctx = this.operationContext(subscription.principal, tenantId, scopeId, undefined, undefined, undefined, undefined, undefined, 'live.subscribe');
+                let ctx;
+                const { principal } = subscription;
+                const context = () => (ctx ??= this.operationContext(principal, tenantId, scopeId, undefined, undefined, undefined, undefined, undefined, 'live.subscribe'));
                 for (const row of announceable) {
-                    // Non-null: `announceable` is exactly the rows whose type is in the map.
-                    const permission = this.liveTargets.get(row.entity_type);
-                    let allowed = false;
-                    try {
-                        const decision = await ctx.check(permission, {
+                    // Narrowing first: it is memoised across sockets, and a row outside the root
+                    // is out whatever the principal holds.
+                    if (within && !(await reaches(row, within)))
+                        continue;
+                    let frame;
+                    if (within?.vouched !== undefined) {
+                        // The vertical vouched for the root, so the walk above was the whole filter
+                        // — and the subscriber holds no read on this row, so it is told only that
+                        // something beneath its root changed. Never which row, never how.
+                        frame = { kind: 'nudge', id: row.id, at: row.occurred_at };
+                    }
+                    else {
+                        // Non-null: `announceable` is exactly the rows whose type is in the map.
+                        const permission = this.liveTargets.get(row.entity_type);
+                        let allowed = false;
+                        try {
+                            const decision = await context().check(permission, {
+                                entityType: row.entity_type,
+                                entityId: row.entity_id,
+                            });
+                            allowed = decision.allowed;
+                        }
+                        catch {
+                            // A check that cannot answer is a check that refuses. The alternative —
+                            // treating an evaluator failure as an allow — turns an outage in the
+                            // permission path into a disclosure, which is the one failure mode this
+                            // surface must not have.
+                            allowed = false;
+                        }
+                        if (!allowed)
+                            continue;
+                        frame = {
+                            kind: 'change',
+                            id: row.id,
+                            type: row.type,
                             entityType: row.entity_type,
                             entityId: row.entity_id,
-                        });
-                        allowed = decision.allowed;
-                    }
-                    catch {
-                        // A check that cannot answer is a check that refuses. The alternative —
-                        // treating an evaluator failure as an allow — turns an outage in the
-                        // permission path into a disclosure, which is the one failure mode this
-                        // surface must not have.
-                        allowed = false;
+                            at: row.occurred_at,
+                        };
                     }
-                    if (!allowed)
-                        continue;
-                    const frame = {
-                        kind: 'change',
-                        id: row.id,
-                        type: row.type,
-                        entityType: row.entity_type,
-                        entityId: row.entity_id,
-                        at: row.occurred_at,
-                    };
                     try {
                         ws.send(JSON.stringify(frame));
                     }
@@ -2383,8 +2545,19 @@ export function defineScopeDO(modules, bareOps) {
             return record;
         }
         /** Authorize a job's read as its registered module, never as a person. */
-        async systemAttachmentAuthorize(attachmentId, moduleId, tenantId, scopeId) {
+        async systemAttachmentAuthorize(attachmentId, moduleId, tenantId, scopeId, 
+        /** #1834: the instance the system door's gate read; see `invoke`. */
+        systemDoorInstance) {
             await this.ensureMigrations();
+            let systemDoor;
+            try {
+                systemDoor = this.assertSystemDoor(moduleId, systemDoorInstance);
+            }
+            catch (err) {
+                if (err instanceof SystemDoorMovedError)
+                    return SYSTEM_DOOR_MOVED;
+                throw toRpcError(err);
+            }
             if (!this.modules.has(moduleId)) {
                 throw toRpcError(substratError('not_found', `module not registered in this scope: ${moduleId}`));
             }
@@ -2393,7 +2566,7 @@ export function defineScopeDO(modules, bareOps) {
                 return null;
             const gate = this.attachmentGate(record.entity.entityType);
             try {
-                const ctx = this.operationContext(this.systemPrincipal, tenantId, scopeId, undefined, undefined, moduleId, undefined, undefined, 'attachments.open');
+                const ctx = this.operationContext(this.systemPrincipal, tenantId, scopeId, undefined, undefined, systemDoor, undefined, undefined, 'attachments.open');
                 assertAllowed(await ctx.check(gate.read, record.entity));
             }
             catch (err) {
@@ -2457,13 +2630,10 @@ export function defineScopeDO(modules, bareOps) {
          */
         async attachmentSearch(term, limit, principal, tenantId, scopeId, connectionId) {
             await this.ensureMigrations();
-            try {
+            return replyOf(() => {
                 const ctx = this.operationContext(principal, tenantId, scopeId, undefined, connectionId, undefined, undefined, undefined, 'attachments.search');
-                return { value: await this.searchAttachmentsAs(ctx, term, limit) };
-            }
-            catch (err) {
-                return { failure: toWireFailure(err) };
-            }
+                return this.searchAttachmentsAs(ctx, term, limit);
+            });
         }
         /**
          * #1575: the extraction job's read of one record. No gate, deliberately — extraction
@@ -2585,6 +2755,70 @@ export function defineScopeDO(modules, bareOps) {
         async systemScheduleState(moduleId) {
             return systemScheduleState(this.switchSql(), moduleId, new Date().toISOString());
         }
+        /**
+         * #1834: the system door's state read — `systemScheduleState`, and the instance that
+         * answered it. The door consults the rewind hold after this read and pins every call it
+         * then makes to this instance (`assertSystemDoor`).
+         */
+        async systemDoorState(moduleId) {
+            return { state: await this.systemScheduleState(moduleId), instance: this.instanceId };
+        }
+        /**
+         * #1834: the system door's check on this side, and the ONLY maker of the `SystemDoorPass`
+         * the operation context needs to act as `system:<moduleId>`. A call acting as a module must
+         * carry the instance the host's door gate read (refused without one: no door gated it), and
+         * is refused on any other instance. A PITR restore always restarts this object, so a call
+         * landing on a new instance may meet rewound storage whose module the gate never checked
+         * against the rewind hold. Both are refused before anything opens; the moved one is the
+         * module-private `SystemDoorMovedError`, which the RPC answers as `SystemDoorMoved`, so the door
+         * gates again and retries. No module, no pass.
+         */
+        assertSystemDoor(moduleId, expected) {
+            if (moduleId === undefined)
+                return undefined;
+            this.assertDoorPin(`module '${moduleId}'`, 'system door', expected);
+            return { moduleId, [SYSTEM_DOOR_PASSED]: true };
+        }
+        /** #2029: the peer door's pin, for a call acting as `vertical:<slug>` — `assertDoorPin`. */
+        assertPeerDoor(vertical, expected) {
+            this.assertDoorPin(`vertical '${vertical}'`, 'peer door', expected);
+        }
+        /**
+         * #2029: the peer door's pin for an RPC that answers a missed pin as `SystemDoorMoved` rather
+         * than through `invoke`'s envelope: true when it missed. A call with no pin still throws.
+         */
+        peerDoorMoved(vertical, expected) {
+            try {
+                this.assertPeerDoor(vertical, expected);
+                return false;
+            }
+            catch (err) {
+                if (err instanceof SystemDoorMovedError)
+                    return true;
+                throw err;
+            }
+        }
+        /**
+         * #1834's pin, for any door (#2029: the peer door's too). A call acting as a switched subject
+         * must carry the instance the host's door gate read, and is refused on any other instance —
+         * the moved one as the module-private `SystemDoorMovedError`, so the door re-gates.
+         */
+        assertDoorPin(what, door, expected) {
+            // Strict, and deliberately so: no pin means no door gated this call, so it is refused rather
+            // than run unchecked. The one innocent caller is a worker a deploy behind, still running host
+            // code from before the pin, during a rolling deploy. Its refusal is transient: the host and this
+            // object ship in the same bundle, so the window lasts as long as the rollout. Nothing ran, and
+            // the reason says "not now" (`SYSTEM_DOOR_WAIT`) to whoever reads it: a schedule fires on the
+            // next pass, a job run retries on its next drive, and a peer caller retries.
+            if (expected === undefined) {
+                throw substratError('forbidden', `a call acting as ${what} reached this scope without passing the ${door}`, {
+                    reason: SYSTEM_DOOR_WAIT,
+                });
+            }
+            if (expected !== this.instanceId) {
+                throw new SystemDoorMovedError(`the scope restarted after the ${door}'s gate read it; gate it again`);
+            }
+        }
         /**
          * The pre-#1666 read, kept for ONE reason: a coordinator a deploy behind this DO still
          * calls it. It answers the new question, not the old one — the old predicate counted any
@@ -2614,8 +2848,10 @@ export function defineScopeDO(modules, bareOps) {
          * `switchSystemSchedules`, serialized on the queue with every other tuple write and run
          * as one `transactionSync`, so its reads and writes are one unit.
          */
-        async switchSystemSchedules(moduleId, scopeId, to, at) {
-            const outcome = await this.queue.enqueue(() => this.revision.transactionSync(() => switchSystemSchedules(this.switchSql(), { moduleId, scopeId, to, at })));
+        async switchSystemSchedules(moduleId, scopeId, to, at, tenantHeld = false, 
+        /** #2045: the switch call's fence — the scope refuses a move older than the one it applied. */
+        fence) {
+            const outcome = await this.queue.enqueue(() => this.revision.transactionSync(() => switchSystemSchedules(this.switchSql(), { moduleId, scopeId, to, at, tenantHeld, fence })));
             // #1819: the instance that applied it, which the rewind hold's release rule reads.
             return { ...outcome, instance: this.instanceId };
         }
@@ -2636,8 +2872,25 @@ export function defineScopeDO(modules, bareOps) {
          * Move one PEER's kill switch on this scope (#1706) — the kernel's `switchPeer`, which is
          * the schedule switch's statement with a `vertical:` subject. Queued, one transaction.
          */
-        async switchPeer(vertical, scopeId, to, at) {
-            return this.queue.enqueue(() => this.revision.transactionSync(() => switchPeer(this.switchSql(), { vertical, scopeId, to, at })));
+        async switchPeer(vertical, scopeId, to, at, 
+        /** #2030: the directory holds a live tenant-level `vertical:` grant for the peer. */
+        tenantHeld = false, 
+        /** #2045: the switch call's fence — the scope refuses a move older than the one it applied. */
+        fence) {
+            const outcome = await this.queue.enqueue(() => this.revision.transactionSync(() => switchPeer(this.switchSql(), { vertical, scopeId, to, at, tenantHeld, fence })));
+            // #2029: the instance that applied it, which the rewind hold's release rule reads.
+            return { ...outcome, instance: this.instanceId };
+        }
+        /**
+         * #2029: the peer door's state read — where one peer stands here (`subjectGrantState` over its
+         * subject, the predicate `admitPeer` refuses on), and the instance that answered it. The door
+         * consults the rewind hold after this read and pins every call it then makes to this instance.
+         */
+        async peerDoorState(vertical) {
+            return {
+                state: subjectGrantState(this.switchSql(), peerSubjectRef(vertical), new Date().toISOString()),
+                instance: this.instanceId,
+            };
         }
         /**
          * Does peer `vertical` hold each key at this scope's node now (#1706) — the checker's own
@@ -2645,7 +2898,15 @@ export function defineScopeDO(modules, bareOps) {
          * is the target scope only to satisfy the type: `covers` records nothing, and the tuple ref
          * it walks is the slug alone.
          */
-        async peerCovers(tenantId, scopeId, vertical, permissions) {
+        async peerCovers(tenantId, scopeId, vertical, permissions, 
+        /** #2029: the instance the peer door's gate read; on another, nothing is read. */
+        doorInstance) {
+            if (this.peerDoorMoved(vertical, doorInstance))
+                return SYSTEM_DOOR_MOVED;
+            return this.peerCoverage(tenantId, scopeId, vertical, permissions);
+        }
+        /** `peerCovers`' read, for this object's own callers, which gated the peer themselves. */
+        async peerCoverage(tenantId, scopeId, vertical, permissions) {
             await this.ensureMigrations();
             return this.queue.enqueue(async () => {
                 const coverage = await this.checker.covers({ kind: 'vertical', id: vertical, scope: scopeId }, permissions, { tenantId, scopeId });
@@ -2658,9 +2919,11 @@ export function defineScopeDO(modules, bareOps) {
          * so no invoke's open transaction is read half-done. `null` when the tenant defines no such
          * role: a typed error thrown here would reach the host flattened, so the host types it.
          */
-        async canAssignFor(tenantId, scopeId, principal, roleKey) {
+        async canAssignFor(tenantId, scopeId, principal, roleKey, 
+        /** #1184: bound at the TENANT node instead — a membership executor assigning tenant-wide. */
+        atTenant = false) {
             await this.ensureMigrations();
-            return this.queue.enqueue(() => this.assignmentBound({ kind: 'principal', id: principal }, tenantId, scopeId, roleKey));
+            return this.queue.enqueue(() => this.assignmentBound({ kind: 'principal', id: principal }, tenantId, atTenant ? null : scopeId, roleKey));
         }
         /** Check and grant in one serialized scope task; a refusal never writes a tuple. */
         async assignScopeRoleBoundedFor(tenantId, scopeId, caller, assignee, roleKey) {
@@ -2701,7 +2964,9 @@ export function defineScopeDO(modules, bareOps) {
         // the host can tell storage the rewind will discard from storage it restored. On ONE object
         // per deployment, the one named `SWITCH_HOLDS_NAME` and never a scope's own: the claims
         // themselves, because a rewind replaces the rewound scope's whole storage. The claims table
-        // is created on first use, so no scope ever carries it.
+        // is created on first use, so no scope ever carries it. #2029: `module_id` holds a hold KEY —
+        // a module id, bare as #1819 stored it, or a peer's `vertical:<slug>`, which no module id can
+        // spell (a module id has no `:`).
         /** This instance, and nothing before or after it: a restart is a new id. */
         instanceId = crypto.randomUUID();
         /** Whether this instance armed a rewind: then its writes are discarded at the restart. */
@@ -3061,9 +3326,16 @@ export function defineScopeDO(modules, bareOps) {
             });
             return row;
         }
-        /** One run by id, whatever its status. */
-        async jobRunById(id) {
-            return (this.sql.exec('SELECT * FROM _substrat_job_runs WHERE id = ?', id).toArray()[0] ?? null);
+        /**
+         * #2034 (#2042 review r1): the FENCE for a coordinator from before leases. Its only caller is
+         * that coordinator's drive, which re-reads a run here and then runs the pass WITHOUT claiming
+         * it, so a row handed back could run beside a claimed pass. It answers "no such run" to it,
+         * always: the old drive skips, and only a coordinator that claims ever drives. Nothing else
+         * reads a run through this method (the operator read is `jobRunList`). The coordinator ships in
+         * the same script as this class, so an old one exists only for a deploy's overlap.
+         */
+        async jobRunById(_id) {
+            return null;
         }
         /** Insert a fresh run. The coordinator has already refused a non-queue-safe payload. */
         async jobRunInsert(row) {
@@ -3073,24 +3345,25 @@ export function defineScopeDO(modules, bareOps) {
          VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`, row.id, row.module_id, row.job, row.instance, row.payload, row.status, row.cursor, row.counters, row.attempts, row.last_error, row.started_at, row.updated_at, row.next_attempt_at, row.ended_at, row.subject_id ?? null);
         }
         /**
-         * `running` runs whose backoff has elapsed, oldest first, after `afterId`.
-         *
-         * The cursor is what lets the coordinator page past runs it cannot drive: it
-         * skips any whose job this deployment does not register, and without a cursor
-         * those rows head every batch forever (`runDueJobRuns`). `afterId` is LAST, as
-         * every argument added to an RPC on this interface must be.
+         * Was: `running` runs whose backoff has elapsed, oldest first, after `afterId` — the due read of
+         * a coordinator from before #1834, which drove every row it returned. Now always empty (below).
          */
-        async jobRunsDue(now, limit, afterId) {
+        async jobRunsDue(_now, _limit, _afterId) {
+            // #2034 (#2042 review r1): fenced, as `jobRunById` is. Its only caller is a coordinator from
+            // before #1834, which runs every row this returns without claiming it.
+            return [];
+        }
+        /**
+         * #1834: the drive's ONE snapshot of due runs — keys only, in the order they became due
+         * (`JOB_RUN_DUE_AT`, then id). Spelled exactly as the pure adapter spells it. A coordinator
+         * from before #2034 reads this too, but drives nothing from it: its re-read (`jobRunById`)
+         * is fenced.
+         */
+        async jobRunsDueKeys(now, max) {
             return this.sql
-                .exec(
-            // `afterId` bound TWICE rather than as `?2`: mixing anonymous and numbered
-            // parameters makes the anonymous ones resume from the highest index used,
-            // which is a footgun for the next person to add a clause. Spelled exactly
-            // as the pure adapter spells it.
-            `SELECT * FROM _substrat_job_runs
+                .exec(`SELECT id, module_id, job FROM _substrat_job_runs
             WHERE status = 'running' AND (next_attempt_at IS NULL OR next_attempt_at <= ?)
-              AND (? IS NULL OR id > ?)
-            ORDER BY id LIMIT ?`, now, afterId ?? null, afterId ?? null, limit)
+            ORDER BY ${JOB_RUN_DUE_AT}, id LIMIT ?`, now, max)
                 .toArray();
         }
         /** The operator read, newest first. */
@@ -3123,20 +3396,99 @@ export function defineScopeDO(modules, bareOps) {
          * partial update that wrote three of the four would leave a run carrying the
          * last failure's error beside the new cursor, which reads as broken forever.
          */
-        async jobRunPatch(id, patch) {
-            // A compare-and-set on `running` (#1632) — see `JOB_RUN_PATCH_SQL`.
-            this.sql.exec(JOB_RUN_PATCH_SQL, patch.status, patch.cursor, patch.counters, patch.attempts, patch.lastError, patch.updatedAt, patch.nextAttemptAt, patch.endedAt, id);
+        async jobRunPatch(id, patch, owner) {
+            // A compare-and-set on `running` (#1632) and on the pass's lease (#2034) — see
+            // `JOB_RUN_PATCH_SQL`. `owner` is LAST and optional: a coordinator from before leases
+            // sends none, and patches the unleased rows it drives.
+            return this.sql.exec(JOB_RUN_PATCH_SQL, ...this.jobPatchArgs(id, patch, owner)).rowsWritten > 0;
+        }
+        jobPatchArgs(id, patch, owner) {
+            return [
+                patch.status, patch.cursor, patch.counters, patch.attempts, patch.lastError,
+                patch.updatedAt, patch.nextAttemptAt, patch.endedAt, id, owner ?? null,
+            ];
         }
-        /** One step's ledger row — a non-null `result` is what means completed. */
+        /**
+         * #2034: the claim — `JOB_RUN_CLAIM_SQL`, and whether it took over a lease, read in ONE
+         * `transactionSync`: the single round trip is what makes it indivisible, as in
+         * `jobRunStartOrJoin`. Null = the run is no longer running and due.
+         */
+        async jobRunClaim(id, owner, leaseMs) {
+            return this.revision.transactionSync(() => {
+                // #2042 r2, r4: a takeover is charged only when the lease it takes had BEGUN its pass.
+                const before = this.sql.exec('SELECT lease_began_at FROM _substrat_job_runs WHERE id = ?', id).toArray()[0];
+                // #2042 r4: the due test and the expiry are THIS object's clock, never the coordinator's.
+                const now = Date.now();
+                const at = new Date(now).toISOString();
+                const claimed = this.sql
+                    .exec(JOB_RUN_CLAIM_SQL, owner, new Date(now + leaseMs).toISOString(), at, JOB_LEASE_EXPIRED_NOTE, id, at)
+                    .toArray()[0];
+                return claimed ? { run: claimed, takeover: (before?.lease_began_at ?? null) !== null } : null;
+            });
+        }
+        /**
+         * #2042 r3, r4: an admission miss — `JOB_RUN_MISS_SQL` (the relative count) and
+         * `JOB_RUN_MISS_SETTLE_SQL` (the backoff or failure that count calls for) in ONE transaction,
+         * by this object's clock. Null = the claim no longer held the run, or had begun.
+         */
+        async jobRunMiss(id, owner, note) {
+            return this.revision.transactionSync(() => {
+                const at = new Date(Date.now()).toISOString();
+                const counted = this.sql.exec(JOB_RUN_MISS_SQL, at, id, owner).toArray()[0];
+                if (!counted)
+                    return null;
+                const o = admissionMissOutcome(counted.admission_misses, at, note);
+                this.sql.exec(JOB_RUN_MISS_SETTLE_SQL, o.status, o.nextAttemptAt, o.endedAt, o.lastError, id, counted.admission_misses);
+                return { misses: counted.admission_misses, failed: o.status === 'failed' };
+            });
+        }
+        /**
+         * #2034 (#2042 r4): BEGIN a claimed pass — `JOB_RUN_BEGIN_SQL`, the commitment point: one
+         * compare-and-set judged by this object's clock as it runs, never by a time the coordinator
+         * computed. The coordinator invokes the handler if and only if this wrote.
+         */
+        async jobRunBegin(id, owner, marginMs) {
+            const now = Date.now();
+            return (this.sql.exec(JOB_RUN_BEGIN_SQL, new Date(now).toISOString(), id, owner, new Date(now + marginMs).toISOString())
+                .rowsWritten > 0);
+        }
+        /**
+         * #2034: a step boundary — renew the pass's lease, then read the step's ledger row, in one
+         * round trip. A pass that lost its lease reads nothing and stops.
+         */
+        async jobStepBegin(runId, step, owner, leaseMs) {
+            // #2042 r4: renewed to this object's now plus the lease.
+            const until = new Date(Date.now() + leaseMs).toISOString();
+            if (this.sql.exec(JOB_RUN_RENEW_SQL, until, runId, owner).rowsWritten === 0)
+                return { held: false, row: null };
+            return { held: true, row: this.stepRow(runId, step) };
+        }
+        /**
+         * One step's ledger row — a non-null `result` is what means completed. Not called by a
+         * coordinator since #2034 (`jobStepBegin` reads it while renewing); kept for one a deploy behind.
+         */
         async jobStepRow(runId, step) {
+            return this.stepRow(runId, step);
+        }
+        stepRow(runId, step) {
             return (this.sql
                 .exec('SELECT step, result, attempts, last_error FROM _substrat_job_steps WHERE run_id = ? AND step = ?', runId, step)
                 .toArray()[0] ?? null);
         }
         /** Record one step attempt. `result` non-null = it completed and must not re-run. */
-        async jobStepRecord(runId, step, result, attempts, lastError, at) {
-            // Only while the run is still `running` (#1632) — see `JOB_STEP_RECORD_SQL`.
-            this.sql.exec(JOB_STEP_RECORD_SQL, runId, step, result, attempts, lastError, at, runId);
+        async jobStepRecord(runId, step, result, attempts, lastError, at, owner, leaseMs) {
+            // Only while the run is still `running` (#1632) and the pass holds its lease (#2034),
+            // renewing the lease — to this object's now plus `leaseMs` (#2042 r4) — in the same
+            // transaction; see `JOB_STEP_RECORD_SQL`. A coordinator from before leases sends neither,
+            // holds no lease, and renews nothing.
+            return this.revision.transactionSync(() => {
+                const until = leaseMs === undefined ? null : new Date(Date.now() + leaseMs).toISOString();
+                if (until !== null && this.sql.exec(JOB_RUN_RENEW_SQL, until, runId, owner ?? null).rowsWritten === 0) {
+                    return false;
+                }
+                this.sql.exec(JOB_STEP_RECORD_SQL, runId, step, result, attempts, lastError, at, runId, owner ?? null);
+                return true;
+            });
         }
         /**
          * A COMMITTED pass: the run's new state and the dropping of its step ledger, in
@@ -3149,13 +3501,17 @@ export function defineScopeDO(modules, bareOps) {
          * results, not to the cursor) then skips work it never did. The kernel's
          * `runJobPass` carries the full argument.
          */
-        async jobCommitPass(id, patch) {
+        async jobCommitPass(id, patch, owner) {
             // `transactionSync` with both statements inline — NOT `await
             // this.jobRunPatch(...)` then the delete. The await is an output-gate
             // boundary, which is precisely the gap this method exists to close.
-            this.revision.transactionSync(() => {
-                this.sql.exec(JOB_RUN_PATCH_SQL, patch.status, patch.cursor, patch.counters, patch.attempts, patch.lastError, patch.updatedAt, patch.nextAttemptAt, patch.endedAt, id);
+            return this.revision.transactionSync(() => {
+                // #2034: the ledger goes only with a patch that applied — a stale holder's commit must
+                // not empty the ledger of the pass that took the run over.
+                if (this.sql.exec(JOB_RUN_PATCH_SQL, ...this.jobPatchArgs(id, patch, owner)).rowsWritten === 0)
+                    return false;
                 this.sql.exec('DELETE FROM _substrat_job_steps WHERE run_id = ?', id);
+                return true;
             });
         }
         // -- guards (K-17) --------------------------------------------------------
@@ -3174,7 +3530,15 @@ export function defineScopeDO(modules, bareOps) {
                     throw new Error(`unknown guard predicate: '${guard.predicate}' — declared by ${guard.declaredBy} ` +
                         `before '${operation}'; no registered module contributes it (operation blocked)`);
                 }
-                await predicate.handler(ctx, guard.config, input);
+                try {
+                    await predicate.handler(ctx, guard.config, input);
+                }
+                catch (err) {
+                    // #1745: a guard refusing is recorded after the rollback, as a transition is —
+                    // marked here, where which guard threw is still known. Always rethrown.
+                    markGuardRefusal(err, guard.predicate, operation);
+                    throw err;
+                }
             }
         }
         // -- migrations (port of applyPendingMigrations) --------------------------
@@ -3324,10 +3688,28 @@ export function defineScopeDO(modules, bareOps) {
          * older than the one held. Bookkeeping, like the copy marker: it changes what runs here, not
          * the scope's data, so it does not advance the write revision a carry fences on.
          */
-        setLifecycle(next) {
+        setLifecycle(next, 
+        /** #2016: the tenant the directory delivered this lifecycle for. A scope it is foreign to
+         *  (`tenantVerdict`) refuses the delivery untouched; one provisioned before the receipt
+         *  existed, whose role rows name this tenant, records it — the back-fill. */
+        tenantId) {
+            const { verdict, held } = tenantId === undefined ? { verdict: null, held: null } : this.tenantVerdict(tenantId);
+            if (verdict === 'foreign') {
+                return { refused: 'tenant', message: `lifecycle delivery ${foreignTenant(held, tenantId)}` };
+            }
+            // The back-fill: a scope provisioned before the receipt (its role rows agree), or one whose
+            // tenant nothing recorded although it holds data (a load from a world that keeps its roles
+            // elsewhere). The directory's word records it; a DO never provisioned here records nothing.
+            const backfill = verdict === 'inferred' || (verdict === 'unknown' && this.holdsData());
             let out;
             this.revision.transactionSync(() => {
-                out = this.revision.bookkeeping(() => writeLifecycle(this.switchSql(), next));
+                // A write the carry fences on, not bookkeeping: it happens once per legacy scope, and
+                // over-counting only refuses a restore that could have landed. A carried-away copy takes
+                // no write at all, so it is left to the next projection.
+                if (backfill && !this.carriedAwayCopy) {
+                    this.sql.exec(`INSERT INTO _substrat_meta (key, value) VALUES (?, ?)`, PROVISIONED_FOR_KEY, tenantId);
+                }
+                out = { ...this.revision.bookkeeping(() => writeLifecycle(this.switchSql(), next)), tenantRecorded: this.provisionedFor() !== null };
             });
             return out;
         }
@@ -3582,13 +3964,26 @@ export function defineScopeDO(modules, bareOps) {
                 system: isSystemTable(name),
             }));
         }
-        /** A bounded page of one table. Unknown table names throw — never queried blind. */
+        /** A bounded page of one table. Unknown table names throw — never queried blind. Kept for a
+         *  coordinator from before #113; the current one calls `introspectTableReply`. */
         introspectTable(table, limit, offset) {
+            try {
+                return this.tablePage(table, limit, offset);
+            }
+            catch (e) {
+                throw toRpcError(e);
+            }
+        }
+        /** `introspectTable`, its refusal answered as DATA so its code survives the hop (#113). */
+        introspectTableReply(table, limit, offset) {
+            return replyOf(() => this.tablePage(table, limit, offset));
+        }
+        tablePage(table, limit, offset) {
             const known = new Set(this.sql
                 .exec(`SELECT name FROM sqlite_master WHERE type = 'table'`)
                 .toArray().map((r) => r.name));
             if (!known.has(table))
-                throw new Error(`unknown table '${table}'`);
+                throw substratError('not_found', `unknown table '${table}'`);
             // The ceiling clamps; a bound SQLite would misread (NaN, non-finite, fractional,
             // negative) is refused instead of reaching LIMIT / OFFSET (#1632).
             const l = Math.min(assertRowLimit('limit', limit), SCOPE_TABLE_PAGE_MAX);
@@ -3607,8 +4002,21 @@ export function defineScopeDO(modules, bareOps) {
          * (no sqlite3_stmt_readonly analogue), a transaction that ALWAYS rolls back — a
          * statement the gate misclassified still cannot persist a write. Rows are capped
          * at SCOPE_QUERY_ROW_MAX with `truncated` set, never an error.
+         * Kept for a coordinator from before #113; the current one calls `introspectQueryReply`.
          */
         async introspectQuery(sql) {
+            try {
+                return await this.readOnlyQuery(sql);
+            }
+            catch (e) {
+                throw toRpcError(e);
+            }
+        }
+        /** `introspectQuery`, its refusal answered as DATA so its code survives the hop (#113). */
+        introspectQueryReply(sql) {
+            return replyOf(() => this.readOnlyQuery(sql));
+        }
+        async readOnlyQuery(sql) {
             const stmt = assertReadOnlyQuery(sql);
             let result;
             const rollback = new Error('read-only console rollback');
@@ -3632,7 +4040,7 @@ export function defineScopeDO(modules, bareOps) {
             }
             catch (e) {
                 if (e !== rollback)
-                    throw toRpcError(e);
+                    throw e;
             }
             return result;
         }
@@ -3753,6 +4161,12 @@ export function defineScopeDO(modules, bareOps) {
                 'ALTER TABLE _substrat_tuples ADD COLUMN revoked_at TEXT',
                 // #1632: legacy runs retain an unknown subject; no content-based backfill.
                 'ALTER TABLE _substrat_job_runs ADD COLUMN subject_id TEXT',
+                // #2034: the lease. NULL = nobody holds the run, which is right for every row already there.
+                'ALTER TABLE _substrat_job_runs ADD COLUMN lease_owner TEXT',
+                // #2042 r2, r4: whether the holder BEGAN its pass. NULL for any lease already there: free to take over.
+                'ALTER TABLE _substrat_job_runs ADD COLUMN lease_began_at TEXT',
+                // #2042 r3: consecutive admission misses. NULL = none, right for every run already there.
+                'ALTER TABLE _substrat_job_runs ADD COLUMN admission_misses INTEGER',
                 // Executor retry state (#100). The defaults read as "terminal", which is
                 // right for every row already there: each is a completed delivery or a
                 // consumer dead-letter.
@@ -3826,6 +4240,14 @@ export function defineScopeDO(modules, bareOps) {
             // both adapters by the query-plan test rather than by that gate.
             this.sql.exec('CREATE INDEX IF NOT EXISTS _substrat_outbox_invocation ON _substrat_outbox (invocation_id, id)');
             this.ensureScheduleStateKind();
+            this.ensureRefusalsAdmitGuards();
+        }
+        /**
+         * #1745: `_substrat_refusals`, rebuilt to admit a guard row (a nullable `from_state`, plus
+         * `guard` and `reason`) on a scope DO whose table predates it.
+         */
+        ensureRefusalsAdmitGuards() {
+            this.rebuildIfStale('_substrat_refusals', refusalsAdmitGuards, REFUSALS_REBUILD);
         }
         /**
          * #1288: `_substrat_schedule_state`, rebuilt with `kind` in its key on a scope DO
@@ -3837,23 +4259,31 @@ export function defineScopeDO(modules, bareOps) {
          * the stored DDL is the one probe both adapters can make.
          */
         ensureScheduleStateKind() {
+            this.rebuildIfStale('_substrat_schedule_state', scheduleStateHasKind, SCHEDULE_STATE_REBUILD);
+        }
+        /**
+         * Run a kernel create-copy-drop-rename `script` over `table` when the stored DDL fails
+         * `isCurrent` — the one shape `ensureScheduleStateKind` and `ensureRefusalsAdmitGuards`
+         * share, so the pure adapter's twin rebuilds byte-identically.
+         */
+        rebuildIfStale(table, isCurrent, script) {
             const row = this.sql
-                .exec(`SELECT sql FROM sqlite_master WHERE type = 'table' AND name = ?`, '_substrat_schedule_state')
+                .exec(`SELECT sql FROM sqlite_master WHERE type = 'table' AND name = ?`, table)
                 .toArray()[0];
-            if (!row || scheduleStateHasKind(row.sql))
+            if (!row || isCurrent(row.sql))
                 return;
-            // In a transaction, for the reason the kernel constant spells out: create-copy-
+            // In a transaction, for the reason the kernel constants spell out: create-copy-
             // drop-rename has two intermediate states and both are unrecoverable on the next
             // wake. `transactionSync`, not the async one every operation uses — the DO
             // runtime forbids a manual BEGIN through `sql.exec`, and this body is wholly
             // synchronous, which is the one case the sync API is for (it commits at the
             // first await, and there is none). It also has to be sync because the caller is.
             this.revision.transactionSync(() => {
-                for (const stmt of splitSqlStatements(SCHEDULE_STATE_REBUILD))
+                for (const stmt of splitSqlStatements(script))
                     this.sql.exec(stmt);
             });
         }
-        async importDump(tables, destScopeId, { switchOff, sourceScopeId, exact, loadStamp, expect, resolveKept, markCopy, } = {}) {
+        async importDump(tables, destScopeId, { switchOff, sourceScopeId, exact, loadStamp, expect, resolveKept, markCopy, provisionedFor, } = {}) {
             // The WHOLE drop-then-replay runs under deferred foreign keys, in one transaction.
             //
             // Two distinct FK hazards, and both need the deferral — the second is why it cannot
@@ -3892,6 +4322,15 @@ export function defineScopeDO(modules, bareOps) {
                 const before = this.loadMarker();
                 // #1713: the lifecycle the platform delivered here, read before the drops take it.
                 const lifecycleBefore = readLifecycle(this.switchSql());
+                // #2016: this store's own tenant receipt, read before the drops take it. A load never
+                // changes which tenant the scope belongs to: the platform's word for it (`provisionedFor`)
+                // must agree with the receipt held, and is refused before the first drop if it does not.
+                const receiptBefore = this.provisionedFor();
+                if (provisionedFor !== undefined && receiptBefore !== null && receiptBefore !== provisionedFor) {
+                    const refused = substratError('conflict', tenantReceiptRefusal(receiptBefore, provisionedFor));
+                    tenantRefusals.add(refused);
+                    throw refused;
+                }
                 // #1722 (Codex #2008 r7): a kept copy holds writes nothing else has. No load replaces it
                 // except its own resolution, and that only at the revision the operator acted on.
                 const kept = this.metaValue(KEPT_DIVERGENT_KEY);
@@ -3962,9 +4401,15 @@ export function defineScopeDO(modules, bareOps) {
                             this.sql.exec(insert, ...row);
                     }
                     // #1738: a dump's `provisioned_for` names the scope (and tenant) it was captured from,
-                    // not this one. Dropped, so a restore never carries a receipt over; the repair
-                    // projection that follows writes this scope's own.
-                    this.sql.exec(`DELETE FROM _substrat_meta WHERE key = 'provisioned_for'`);
+                    // not this one, so it is never carried over. #2016: what stays is THIS store's own —
+                    // the platform's word when the load carries it (a copy into a fresh scope records its
+                    // own tenant here), else the receipt held before the drops. A store that held none
+                    // keeps none, and the repair projection that follows writes it.
+                    this.sql.exec(`DELETE FROM _substrat_meta WHERE key = ?`, PROVISIONED_FOR_KEY);
+                    const receipt = provisionedFor ?? receiptBefore;
+                    if (receipt !== null) {
+                        this.sql.exec(`INSERT INTO _substrat_meta (key, value) VALUES (?, ?)`, PROVISIONED_FOR_KEY, receipt);
+                    }
                     // #1722: whatever stamp an export read here no longer describes this store, so every load
                     // replaces it: with the carry's own, or with none. And the write revision moves on from
                     // where it stood before the drops, so it never goes back.
@@ -4077,6 +4522,8 @@ export function defineScopeDO(modules, bareOps) {
                 const code = errorCodeOf(e);
                 if (code === 'precondition_failed')
                     return { refused: 'changed' };
+                if (e instanceof Error && tenantRefusals.has(e))
+                    return { refused: 'tenant', message: e.message };
                 if (code === 'conflict')
                     return { refused: 'kept' };
                 throw toRpcError(e);
@@ -4485,9 +4932,9 @@ export function defineScopeDO(modules, bareOps) {
          * survives — the whole point, since the denial is the write the operation could not make.
          */
         /** K-42: the session a refused call ran under travels with the denial row. */
-        /** #1745: a refused transition the operation failed with, written after its rollback. */
+        /** #1745: a refused transition or refusing guard the operation failed with, written after its rollback. */
         recordRefusal(subject, tenantId, scopeId, operation, err, invocationId, impersonation) {
-            const refused = refusedTransitionOf(err);
+            const refused = refusalOf(err);
             if (!refused)
                 return;
             const q = refusalInsert({
@@ -4538,7 +4985,12 @@ export function defineScopeDO(modules, bareOps) {
             invocationId, new Date().toISOString());
         }
         // -- operation context (port of operationContext) -------------------------
-        operationContext(principal, tenantId, scopeId, systemActor, connectionId, systemModuleId, 
+        operationContext(principal, tenantId, scopeId, systemActor, connectionId, 
+        /**
+         * #1834: the system subject, only as the door check hands it out (`assertSystemDoor`) — so
+         * no path can act as `system:<moduleId>` without passing that check.
+         */
+        systemDoor, 
         /** #458: per-invoke tally of `ctx.requestPlatform` calls; absent for consumer dispatch. */
         signals, 
         /**
@@ -4603,8 +5055,8 @@ export function defineScopeDO(modules, bareOps) {
                 ? peerSubject
                 : capabilityId
                     ? { kind: 'capability', id: capabilityId }
-                    : systemModuleId
-                        ? { kind: 'system', id: systemModuleId }
+                    : systemDoor
+                        ? { kind: 'system', id: systemDoor.moduleId }
                         : connectionId
                             ? { kind: 'connection', id: connectionId }
                             : { kind: 'principal', id: principal };
@@ -4990,6 +5442,10 @@ export function defineScopeDO(modules, bareOps) {
                 this.sql.exec(`INSERT OR REPLACE INTO _substrat_meta (key, value) VALUES ('permission_source', ?)`, source);
             });
         }
+        /** `applyProjection`, its refusal answered as DATA so its code survives the hop (#113). */
+        applyProjectionReply(...args) {
+            return replyOf(() => this.applyProjection(...args));
+        }
         /**
          * Replace this scope's projected view of a tenant's roles + tenant-level tuples
          * with a fresh snapshot, and make it authoritative (source = 'local'). A full
@@ -5048,14 +5504,19 @@ export function defineScopeDO(modules, bareOps) {
                 // #1738: the receipt `servesTenant` reads. First writer wins: absent or equal is written,
                 // a receipt for ANOTHER tenant refuses the whole projection (K-3), before a single row
                 // moves, so a misdirected projection can never re-point a scope or leave its roles behind.
-                // A restore does not trip this: `importDump` drops the dump's receipt, so the repair
-                // projection that follows finds none and writes the destination's own.
-                const held = this.sql.exec(`SELECT value FROM _substrat_meta WHERE key = 'provisioned_for'`).toArray()[0];
-                if (held && held.value !== tenantId) {
-                    throw substratError('conflict', `applyProjection refused: this scope was provisioned for tenant ${held.value}, and a projection for tenant ${tenantId} would re-point it`);
+                // A restore does not trip this: `importDump` keeps the destination's own receipt and
+                // never the dump's (#2016), so the repair projection that follows finds its own tenant.
+                // #2016: a scope with no receipt yet takes its first one only where its role rows agree
+                // (`tenantVerdict`, the same reading the lifecycle back-fill uses), so a projection for
+                // another tenant cannot pin a legacy scope to it.
+                const { verdict, held } = this.tenantVerdict(tenantId);
+                if (verdict === 'foreign') {
+                    throw substratError('conflict', held !== null
+                        ? `applyProjection refused: this scope was provisioned for tenant ${held}, and a projection for tenant ${tenantId} would re-point it`
+                        : `applyProjection ${foreignTenant(held, tenantId)}`);
                 }
                 // Written before any guard below can return early, so every projection leaves it.
-                this.sql.exec(`INSERT OR REPLACE INTO _substrat_meta (key, value) VALUES ('provisioned_for', ?)`, tenantId);
+                this.sql.exec(`INSERT OR REPLACE INTO _substrat_meta (key, value) VALUES (?, ?)`, PROVISIONED_FOR_KEY, tenantId);
                 this.sql.exec(`DELETE FROM _substrat_roles WHERE tenant_id = ?`, tenantId);
                 for (const r of roles) {
                     this.sql.exec(`INSERT OR REPLACE INTO _substrat_roles (tenant_id, role_key, permissions, source, revoked_at)