@substrat-run/adapter-cloudflare 0.137.0 → 0.138.0

package/dist/host.js

@@ -1,13 +1,14 @@
 import { env as ambientEnv } from 'cloudflare:workers';
 import { isRewindRefusal, REWIND_REFUSED } from './rewind-refusal.js';
 import { isSystemDoorMoved, SYSTEM_DOOR_MOVED, SYSTEM_DOOR_REGATES } from './system-door.js';
-import { delegatedReadParams, fromWireFailure, exportReadInput, exportedBatch, importBatch, importResult, importState, importsOfManifestJson, exportsOfManifestJson, importCursorMove, importCursorMoveAt, importCursorMoved, accessLogEntry, adminLogEntry, opsFailureEntry, opsFailureFingerprint, issueEntry, sweepRunEntry, FRESHNESS_HEARTBEAT_MINUTES, sweepRunsPayload, modelUsageEntry, attachmentRecord, createTenantInput, identityLink, identityPool, createOrgInput, promotionAcknowledgement, bindAcknowledgement, bindHostnameInput, channelHistoryEntry, hostnameBinding, publishVersionInput, AUTO_ADMISSION_NOTE, registerVerticalInput, vertical as verticalSchema, verticalServingState, verticalChannel, verticalVersion, connection, capabilityExchange, mintedCapability, capabilityGrant, principalId, connectionGrant, connectionGrantRecord, connectionSecret, systemGrant, systemSwitch, systemSwitchOutcome, systemScheduleEntry, systemSwitchRecord, entitlementGrant, entitlementGrantInput, capabilityFilter, instant, meterReading, subjectRef, createConnectionInput, projectedConnectionGrant, projectedConnectionKey, moduleManifest, org as orgSchema, orgMembership, resolvedIdentity, identityMembership, roleDefinition, scope as scopeSchema, tenant as tenantSchema, tenantRole, delegatedReadRecord, ownerTransferAudit, copyMarkAudit, subjectShredReceipt, connectorDispatchKind, callsOfManifestJson, outboundOfManifestJson, substratError, redrainEventsInput, coverage, peerCoverage, peerGrantsEntry, peerSwitch, peerSwitchOutcome, verticalCaller, verticalResolution, verticalSlug, entityObjectRef, ATTACHMENT_BLOB_BINDING, blobStoreBindingName, lifecycleDelivery, scopeLifecycle, } from '@substrat-run/contracts';
+import { delegatedReadParams, operationSeriesCount, fromWireFailure, exportReadInput, exportedBatch, importBatch, importResult, importState, importsOfManifestJson, exportsOfManifestJson, importCursorMove, importCursorMoveAt, importCursorMoved, accessLogEntry, adminLogEntry, opsFailureEntry, opsFailureFingerprint, issueEntry, sweepRunEntry, FRESHNESS_HEARTBEAT_MINUTES, sweepRunsPayload, modelUsageEntry, attachmentRecord, createTenantInput, identityLink, identityPool, createOrgInput, promotionAcknowledgement, bindAcknowledgement, bindHostnameInput, channelHistoryEntry, hostnameBinding, publishVersionInput, AUTO_ADMISSION_NOTE, registerVerticalInput, vertical as verticalSchema, verticalServingState, verticalChannel, verticalVersion, connection, capabilityExchange, mintedCapability, capabilityGrant, principalId, connectionGrant, connectionGrantRecord, connectionSecret, systemGrant, systemSwitch, systemSwitchOutcome, systemScheduleEntry, systemSwitchRecord, entitlementGrant, entitlementGrantInput, capabilityFilter, instant, meterReading, subjectRef, createConnectionInput, projectedConnectionGrant, projectedConnectionKey, moduleManifest, org as orgSchema, orgMembership, resolvedIdentity, identityMembership, roleDefinition, scope as scopeSchema, tenant as tenantSchema, tenantRole, delegatedReadRecord, ownerTransferAudit, copyMarkAudit, subjectShredReceipt, connectorDispatchKind, callsOfManifestJson, outboundOfManifestJson, SCOPE_GATE_REASONS, substratError, redrainEventsInput, coverage, peerCoverage, peerGrantsEntry, peerSwitch, peerSwitchOutcome, verticalCaller, verticalResolution, verticalSlug, entityObjectRef, ATTACHMENT_BLOB_BINDING, blobStoreBindingName, lifecycleDelivery, scopeLifecycle, } from '@substrat-run/contracts';
 import { normalizeHostname, toRouteTarget } from './route-resolver.js';
-import { attachmentBlobKey, attachmentSha256, entitlementDenial, requiredEntitlementFor, foldMeterReading, parseValidationRecords, resolveScopeRecord, ulid, KEPT_COPY_REFUSAL, capabilityTokenHash, checkBecomeInput, plausibleSessionToken, foldModelUsage, backoffAt, resolveRetryPolicy, isSecretBoxConfigured, unconfiguredSecretBox, createSubjectKeys, generateSealingKeyPair, openSealed, ImpersonationRefused, assertSessionUsable, impersonationRowValues, mapImpersonationRow, newImpersonationSession, jobRunOf, runDueJobRuns, SYSTEM_DOOR_WAIT, startJobRun, attachmentTextJob, assertAttachmentExtractors, assertJobRegistrable, isAttachmentTextRun, searchLimit, searchMatchExpression, globalFetch, assertRedrainWindow, platformRequestOf, undrainedEventsOf, inUnitMovesToAudit, staleCarryRevertRow, staleCarryReverts, withRecorded, systemSwitchedOffMessage, tenantSystemSwitchedOffMessage, CrossVerticalRegistry, importCursorSourceOf, exportBreaksOf, exportBreakRefusal, bindExportBreaksOf, bindExportBreakRefusal, collectPeers, peerSeats, connectorCallRecord, noopConnectorCallRecorder, recordConnectorCall, settleConnectionUse, splitManifestMigrations, unknownRoleError, assertRowLimit, assertRowOffset, INERT_SCOPE_REASON, lifecycleReceipt, lifecycleRefusal, isPrimaryScope, isPrimaryScopeRow, asyncInvocationId, asyncLinePass, } from '@substrat-run/kernel';
+import { attachmentBlobKey, attachmentSha256, entitlementDenial, requiredEntitlementFor, foldMeterReading, parseValidationRecords, resolveScopeRecord, ulid, KEPT_COPY_REFUSAL, capabilityTokenHash, checkBecomeInput, plausibleSessionToken, foldModelUsage, backoffAt, resolveRetryPolicy, executorOutcomeOf, isDeliveryRefusal, refusalJournalText, isSecretBoxConfigured, unconfiguredSecretBox, createSubjectKeys, generateSealingKeyPair, openSealed, ImpersonationRefused, assertSessionUsable, impersonationRowValues, mapImpersonationRow, newImpersonationSession, jobRunOf, assertLeaseMs, runDueJobRuns, SYSTEM_DOOR_WAIT, startJobRun, attachmentTextJob, assertAttachmentExtractors, assertJobRegistrable, isAttachmentTextRun, searchLimit, searchMatchExpression, globalFetch, assertRedrainWindow, platformRequestOf, undrainedEventsOf, inUnitMovesToAudit, staleCarryRevertRow, staleCarryReverts, recordedOffFromWire, peerSubjectRef, SWITCH_KINDS, reassertActionOf, reassertEntry, reassertOffRow, reassertOnRow, switchActionOf, switchAuditSubject, switchNotFoundMessage, recordWriteSuperseded, switchSubjectOf, switchSupersededMessage, withRecorded, systemSwitchedOffMessage, tenantSystemSwitchedOffMessage, CrossVerticalRegistry, importCursorSourceOf, exportBreaksOf, exportBreakRefusal, bindExportBreaksOf, bindExportBreakRefusal, collectPeers, peerSeats, connectorCallRecord, noopConnectorCallRecorder, recordConnectorCall, settleConnectionUse, splitManifestMigrations, unknownRoleError, assertRowLimit, assertRowOffset, emptyImportResult, INERT_SCOPE_REASON, lifecycleReceipt, lifecycleRefusal, isPrimaryScope, isPrimaryScopeRow, asyncInvocationId, asyncLinePass, } from '@substrat-run/kernel';
 import { attributedHost } from '@substrat-run/kernel';
-import { isOrangeToOrange, isUpgradeRequest, LIVE_MODE_HEADER, LIVE_PRINCIPAL_HEADER, LIVE_SCOPE_HEADER, LIVE_SUBSCRIBE_PATH, LIVE_TENANT_HEADER, } from './live-reads.js';
+import { isOrangeToOrange, isUpgradeRequest, LIVE_MODE_HEADER, LIVE_PRINCIPAL_HEADER, LIVE_SCOPE_HEADER, LIVE_SUBSCRIBE_PATH, LIVE_TENANT_HEADER, LIVE_WITHIN_HEADER, encodeLiveWithin, liveWithinOf, } from './live-reads.js';
 import { tenantStoreDatabaseName } from './d1.js';
 import { blobStoreBucketName, r2TenantBlobStore } from './r2.js';
+import { unwrapReply } from './do-reply.js';
 /** DO row → contract shape. Never reads the secrets table — that is the split. */
 const toConnection = (r) => connection.parse({
     id: r.id,
@@ -26,12 +27,6 @@ const toConnection = (r) => connection.parse({
     createdAt: r.created_at,
     revokedAt: r.revoked_at,
 });
-/** Rethrow a capability attachment verb's failure, rebuilt with its code; else its value. */
-function unwrapCapabilityReply(reply) {
-    if (reply.failure)
-        throw fromWireFailure(reply.failure);
-    return reply.value;
-}
 /**
  * How far ahead of the clock a held lifecycle epoch may be and still be learned past (#1713). An
  * epoch is the time a directory restore minted it, so a legitimate one is behind its minter's
@@ -92,24 +87,31 @@ function nullControlPlane() {
         recordAdmin: noop,
         recordAccess: noop,
         tenantHoldsEntitlement: async () => true,
-        // #1674: the schedule switch's record is a DIRECTORY store, and a CP-less host has no
+        // #1674, #2029: the switches' record is a DIRECTORY store, and a CP-less host has no
         // directory — the shared control plane that delegates here keeps it. Same posture as
         // `recordAdmin`: nothing to write, nothing recorded to read back.
-        recordSystemSwitchedOff: async () => null,
-        recordSystemSwitchedOn: async () => null,
-        restoreSystemSwitchRecord: noop,
+        recordSwitchedOff: async () => null,
+        recordSwitchedOn: async () => null,
+        restoreSwitchRecord: noop,
         listSystemSwitches: async () => [],
-        systemSwitchRecordsOf: async () => [],
-        switchedOffModulesOf: async () => [],
+        switchRecordsOf: async () => [],
+        switchRecordStatesOf: async () => [],
+        switchesOwedOf: async () => [],
+        clearSwitchOwed: noop,
         // #1823: no tenant tuples here either — the platform reads them and sends `tenantHeld`.
-        tenantHeldSystemModules: async () => [],
+        tenantHeldOf: async () => [],
+    };
+    const unavailable = (method) => new Error(`control plane unavailable: '${method}' — this host is scope-local / CP-less ` +
+        `(docs/architecture/scope-local-permissions.md, Phase 3)`);
+    // A directory write through `reply` (#113) is named for the write it carries, not for `reply`.
+    passthrough.reply = async (method) => {
+        throw unavailable(String(method));
     };
     return new Proxy({}, {
         get: (_t, prop) => typeof prop === 'string' && prop in passthrough
             ? passthrough[prop]
             : async () => {
-                throw new Error(`control plane unavailable: '${String(prop)}' — this host is scope-local / CP-less ` +
-                    `(docs/architecture/scope-local-permissions.md, Phase 3)`);
+                throw unavailable(String(prop));
             },
     });
 }
@@ -151,19 +153,34 @@ export const SWITCH_HOLD_EXTRA_WAITS = 3;
  */
 export const SWITCH_HOLD_PENDING_MAX_MS = 5 * 60_000;
 /**
- * An OFF of a tenant-held module whose far end did not attest `deniesTenantGrants` (#1823): it
- * switched, but its evaluator still authorizes the module's tenant-level grant on the scope.
- * Carries the far end's outcome, so the operator's OFF knows whether there is a move to put back.
+ * A move the deployment serving the scope applied, or may have, without attesting what the
+ * platform needs from it (#2045 Codex r3): the switch fence (`fenced`), or for a tenant-held
+ * module's OFF the evaluator that denies a tenant-level grant (`deniesTenantGrants`, #1823).
+ *
+ * The preflight (`switchTarget`'s `attestFence`) tells a deployment built before the fence apart
+ * before anything is recorded or moved. On such a deployment only an ON is refused: the race the
+ * fence closes is an older OFF landing after a newer ON, and with every ON refused there is no
+ * newer ON to land after, so an OFF goes through unfenced (#2045 follow-up). A kill switch that
+ * cannot be pulled until every vertical is re-pushed is the outage the fence must never cause.
+ * An unfenced OFF keeps its write-ahead owed mark, so the first re-assert after the vertical is
+ * redeployed moves the scope again under the record's fence.
+ *
+ * This error fires when a deployment that attested the fence answers a move without it — a
+ * rollback to an old build between the preflight and the move — or when an ON reaches a
+ * deployment without the fence. It is NOT compensated with an opposite move: an unfenced
+ * compensation can undo a newer call's switch (Codex r3, finding 2). The call's record and its
+ * write-ahead owed mark stay, and the call is refused.
  */
-class UnattestedSwitchOff extends Error {
-    outcome;
-    constructor(scopeId, moduleId, outcome) {
-        super(`the deployment serving scope ${scopeId} predates the kill switch's tenant-grant denial (#1823): ` +
-            `module '${moduleId}' holds a tenant-level grant that its OFF would leave authorizing there. ` +
-            `Redeploy the vertical, then retry.`);
-        this.outcome = outcome;
-    }
+class UnattestedSwitch extends Error {
 }
+/** A fenced move answered without `fenced`: the deployment predates the fence. */
+const unfencedMessage = (scopeId) => `the deployment serving scope ${scopeId} predates the switch fence (#2045): it cannot refuse an older ` +
+    `switch call's OFF landing after this ON, so no switch is turned on there. Switching off still works. ` +
+    `Redeploy the vertical, then retry.`;
+/** A tenant-held module's OFF answered without `deniesTenantGrants` (#1823). */
+const undeniedMessage = (scopeId, moduleId) => `the deployment serving scope ${scopeId} predates the kill switch's tenant-grant denial (#1823): ` +
+    `module '${moduleId}' holds a tenant-level grant that its OFF would leave authorizing there. ` +
+    `Redeploy the vertical, then retry.`;
 /**
  * The attachment bucket a host resolves when it was handed no resolver (#1995): the
  * platform's per-tenant binding, read off this script's own env, named by the one shared
@@ -172,6 +189,49 @@ class UnattestedSwitchOff extends Error {
 function ambientAttachmentBucket(tenantId) {
     return ambientEnv[blobStoreBindingName(ATTACHMENT_BLOB_BINDING, tenantId)] ?? null;
 }
+/**
+ * #2029: scope instances whose door has read the rewind hold and found NO claim on the scope at
+ * all, so their doors skip the hold read for the rest of the instance's life. Isolate-wide, because
+ * a host lives for one request: without it, every peer call would read the deployment's one hold
+ * object — an extra hop, on a single object, on the hot path of every scope never rewound.
+ *
+ * Safe because claims are only ever added for storage a LATER instance serves. A rewind writes its
+ * claim before it arms, and arming restarts the scope, so its rewound storage is always served by a
+ * new instance with a new id, which reads the hold afresh (`SWITCH_HOLD_SETTLE_MS` puts every row of
+ * the claim before that instance existed). A join (`switchHoldJoin`) goes into a rewind's claim too,
+ * so into that same later instance. An instance that read no claim therefore never gains one; claims
+ * only leave it, by a switch move. Only a GOOD read is remembered: a read that failed open is not.
+ * Bounded: past `CLEAR_SCOPE_INSTANCES_MAX` it is emptied, which costs a re-read, nothing else.
+ */
+const CLEAR_SCOPE_INSTANCES = new Set();
+const CLEAR_SCOPE_INSTANCES_MAX = 10_000;
+const rememberClearInstance = (key) => {
+    if (CLEAR_SCOPE_INSTANCES.size >= CLEAR_SCOPE_INSTANCES_MAX)
+        CLEAR_SCOPE_INSTANCES.clear();
+    CLEAR_SCOPE_INSTANCES.add(key);
+};
+/**
+ * #2045: a carry's fences, by tuple subject (`RecordedOffCarry.fences`): for each recorded-off
+ * subject, the operation id of the call the record holds.
+ */
+const switchFencesCarried = (kinds) => {
+    const out = {};
+    for (const [kind, { keys, fences }] of kinds) {
+        for (const key of keys) {
+            const fence = fences.get(key);
+            if (fence !== undefined)
+                out[switchSubjectOf(kind, key)] = fence;
+        }
+    }
+    return out;
+};
+/** #2029: how a door's refusals and a re-assert's name each kind of subject. */
+const DOOR_WORDS = {
+    system: { what: (key) => `module '${key}'`, door: 'system door', switchName: 'schedule', switched: 'schedules' },
+    peer: { what: (key) => `peer vertical '${key}'`, door: 'peer door', switchName: 'peer', switched: 'peers' },
+};
+/** #2029: the rewind hold's key for one subject — a module's id, bare as #1819 stored it, or `vertical:<slug>`. */
+const holdKeyOf = (kind, key) => (kind === 'system' ? key : peerSubjectRef(key));
 export class CloudflareScopeHost {
     admin;
     scopeNs;
@@ -389,6 +449,22 @@ export class CloudflareScopeHost {
             },
         };
     }
+    /**
+     * #1184: the scope reads an executor's handler may make. Plain RPCs to the ScopeDO: the
+     * handler runs here on the coordinator, after the DO's own task has returned.
+     */
+    executorScope(tenantId, scopeId) {
+        const stub = this.scopeStub(scopeId);
+        return {
+            history: async (entity, page) => stub.entityHistory({ entityType: entity.entityType, entityId: entity.entityId, limit: page?.limit, cursor: page?.cursor }),
+            covers: async (principal, roleKey, level) => {
+                const bound = await stub.canAssignFor(tenantId, scopeId, principalId.parse(principal), roleKey, level === 'tenant');
+                if (!bound)
+                    throw unknownRoleError(roleKey);
+                return coverage.parse(bound);
+            },
+        };
+    }
     /**
      * Drain this scope's outbox into the registered executors (K-22 §4.2).
      *
@@ -412,7 +488,9 @@ export class CloudflareScopeHost {
      * own `invocationId` field reads null — an ambient read there would record "no
      * call" for every attempt an operation's own tail made.
      */
-    invocationId) {
+    invocationId, 
+    /** #1184: what each attempt did, for the emitting call's `onExecutorOutcomes`. */
+    outcomes) {
         const report = {
             attempted: 0,
             delivered: 0,
@@ -426,27 +504,22 @@ export class CloudflareScopeHost {
         // attempt runs — the DO only journals it.
         const lines = asyncLinePass();
         try {
-            await this.drainExecutorsPass(tenantId, scopeId, invocationId, report, lines);
+            await this.drainExecutorsPass(tenantId, scopeId, invocationId, report, lines, outcomes);
         }
         finally {
             lines.end();
         }
         return report;
     }
-    async drainExecutorsPass(tenantId, scopeId, invocationId, report, lines) {
+    async drainExecutorsPass(tenantId, scopeId, invocationId, report, lines, outcomes) {
         const stub = this.scopeStub(scopeId);
+        const scope = this.executorScope(tenantId, scopeId);
         // #2005: a non-primary scope (a fork, a snapshot, a preview of either kind) causes no
         // outbound effects, so its deliveries are journaled terminal with the reason and no
-        // handler runs. Asked of the directory where there is one. A CP-less host has none, so it
-        // asks the scope's own storage whether it is classified a copy (`_substrat_copy_origin`'s
-        // `is_copy`, #2009, set on the directory's word) — a preview and a snapshot reach a hosted
-        // vertical as restores the platform marks.
-        // Asked on the first due event, once per pass: most passes have none, and the directory
-        // is one global object.
+        // handler runs (`isInertScope`). Asked on the first due event, once per pass: most passes
+        // have none, and the directory is one global object.
         let inert;
-        const isInert = () => (inert ??= this.cpLess
-            ? stub.isCopy()
-            : this.cp.getScopeRecord(tenantId, scopeId).then((row) => !isPrimaryScopeRow(row)));
+        const isInert = () => (inert ??= this.isInertScope(tenantId, scopeId));
         // #1713: a CP-less scope its lifecycle holds attempts nothing and journals nothing, so every
         // due delivery stays due for the first pass after it is live again. Asked on the first due
         // event, like `isInert`. Every caller passed `assertLive` already, so this is for the scope
@@ -477,6 +550,9 @@ export class CloudflareScopeHost {
                 attempt,
                 startedAt: Date.now(),
             });
+            const outcomeOf = (event, outcome, error) => {
+                outcomes?.push(executorOutcomeOf(id, event, outcome, error));
+            };
             for (const bad of undecodable) {
                 report.attempted += 1;
                 const attempt = await stub.recordExecutorAttempt(bad.eventId, deliveryId, bad.error, null, invocationId);
@@ -490,6 +566,7 @@ export class CloudflareScopeHost {
                     // No next attempt, like an undecodable row: a scope does not become primary.
                     const attempt = await stub.recordExecutorAttempt(event.id, deliveryId, INERT_SCOPE_REASON, null, invocationId);
                     report.inert = (report.inert ?? 0) + 1;
+                    outcomeOf(event, 'inert', INERT_SCOPE_REASON);
                     // Its own outcome, never `delivered`: no handler ran (#2005).
                     lines.write({ ...unitOf(event.id, attempt), startedAt, outcome: 'inert' });
                     continue;
@@ -507,6 +584,7 @@ export class CloudflareScopeHost {
                         // the at-least-once residue, as it already must in-process.
                         await stub.routeExecutorEventToPlatform(event.id, deliveryId, connectorDispatchKind(executor.provider), JSON.stringify({ executorId: id, event }), JSON.stringify({ system: 'connector-dispatch' }), invocationId);
                         report.routedToPlatform += 1;
+                        outcomeOf(event, 'routed');
                         // Handed on, not run here: the platform's drain owns its attempts from now on.
                         lines.write({ ...unitOf(event.id, 1), startedAt, outcome: 'routed' });
                     }
@@ -514,13 +592,26 @@ export class CloudflareScopeHost {
                         await executor.handler(await this.connectorContext(tenantId, scopeId, executor.timeoutMs, event.id), event);
                         const attempt = await stub.recordExecutorAttempt(event.id, deliveryId, null, null, invocationId);
                         report.delivered += 1;
+                        outcomeOf(event, 'delivered');
                         lines.write({ ...unitOf(event.id, attempt), startedAt, outcome: 'delivered' });
                     }
                     else {
-                        await executor.handler(this.admin, event);
-                        const attempt = await stub.recordExecutorAttempt(event.id, deliveryId, null, null, invocationId);
-                        report.delivered += 1;
-                        lines.write({ ...unitOf(event.id, attempt), startedAt, outcome: 'delivered' });
+                        const result = await executor.handler(this.admin, event, scope);
+                        // #1184: a refusal is the handler's own terminal decision — journaled with its
+                        // reason, no next attempt, listed by `executorDeadLetters` beside an exhausted one.
+                        const refused = isDeliveryRefusal(result) ? result : null;
+                        const text = refused && refusalJournalText(refused);
+                        const attempt = await stub.recordExecutorAttempt(event.id, deliveryId, text, null, invocationId);
+                        if (refused) {
+                            report.deadLettered += 1;
+                            outcomeOf(event, 'refused', refused.reason);
+                            lines.write({ ...unitOf(event.id, attempt), startedAt, outcome: 'dead-lettered', error: text });
+                        }
+                        else {
+                            report.delivered += 1;
+                            outcomeOf(event, 'delivered');
+                            lines.write({ ...unitOf(event.id, attempt), startedAt, outcome: 'delivered' });
+                        }
                     }
                 }
                 catch (err) {
@@ -535,6 +626,7 @@ export class CloudflareScopeHost {
                         report.deadLettered += 1;
                     else
                         report.retrying += 1;
+                    outcomeOf(event, exhausted ? 'dead-lettered' : 'retrying', err);
                     lines.write({
                         ...unitOf(event.id, attempts),
                         startedAt,
@@ -558,13 +650,14 @@ export class CloudflareScopeHost {
         // emitting operation's own tail made.
         return this.drainExecutors(tenantId, scopeId, null);
     }
-    registerJob(moduleId, name, handler, retry) {
+    registerJob(moduleId, name, handler, retry, options) {
         // #1575: the kernel's own jobs are dispatched before this registry is read.
         assertJobRegistrable(moduleId, name);
+        assertLeaseMs(options?.leaseMs);
         const key = `${moduleId}/${name}`;
         if (this.jobs.has(key))
             throw new Error(`job '${key}' is already registered`);
-        this.jobs.set(key, { handler, retry });
+        this.jobs.set(key, { handler, retry, leaseMs: options?.leaseMs });
     }
     /**
      * D-14's DURABLE driver: the run store is RPC to the scope DO, and nothing else.
@@ -582,13 +675,15 @@ export class CloudflareScopeHost {
         const stub = this.scopeStub(scopeId);
         return {
             startOrJoin: (key, row) => stub.jobRunStartOrJoin(key.moduleId, key.job, key.instance, row),
-            get: (id) => stub.jobRunById(id),
             dueKeys: (now, max) => stub.jobRunsDueKeys(now, max),
+            claim: (id, owner, leaseMs) => stub.jobRunClaim(id, owner, leaseMs),
+            begin: (id, owner, marginMs) => stub.jobRunBegin(id, owner, marginMs),
+            miss: (id, owner, note) => stub.jobRunMiss(id, owner, note),
             list: (filter) => stub.jobRunList(filter),
-            patch: (id, patch) => stub.jobRunPatch(id, patch),
-            commitPass: (id, patch) => stub.jobCommitPass(id, patch),
-            step: (runId, name) => stub.jobStepRow(runId, name),
-            recordStep: (runId, name, result, attempts, lastError, at) => stub.jobStepRecord(runId, name, result, attempts, lastError, at),
+            patch: (id, patch, owner) => stub.jobRunPatch(id, patch, owner),
+            commitPass: (id, patch, owner) => stub.jobCommitPass(id, patch, owner),
+            beginStep: (runId, name, owner, leaseMs) => stub.jobStepBegin(runId, name, owner, leaseMs),
+            recordStep: (runId, name, result, attempts, lastError, at, owner, leaseMs) => stub.jobStepRecord(runId, name, result, attempts, lastError, at, owner, leaseMs),
         };
     }
     /**
@@ -710,7 +805,7 @@ export class CloudflareScopeHost {
         if (!rec)
             throw unknownScopeForTenant(tenantId, scopeId);
         if (rec.status !== 'active' && rec.status !== 'provisioning') {
-            throw new Error(`scope not migratable (status: ${rec.status}): ${scopeId}`);
+            throw substratError('conflict', `scope not migratable (status: ${rec.status}): ${scopeId}`);
         }
         const stub = this.scopeStub(scopeId);
         try {
@@ -752,11 +847,11 @@ export class CloudflareScopeHost {
         return this.scopeStub(scopeId).introspectTables();
     }
     async introspectScopeTable(scopeId, input) {
-        return this.scopeStub(scopeId).introspectTable(input.table, input.limit, input.offset);
+        return unwrapReply(await this.scopeStub(scopeId).introspectTableReply(input.table, input.limit, input.offset));
     }
     /** The SQL console's CP-less path (#219) — same trust line as the pair above. */
     async introspectScopeQuery(scopeId, input) {
-        return this.scopeStub(scopeId).introspectQuery(input.sql);
+        return unwrapReply(await this.scopeStub(scopeId).introspectQueryReply(input.sql));
     }
     /**
      * The K-35 denial log's CP-less path (#867) — same trust line as the reads above.
@@ -853,10 +948,9 @@ export class CloudflareScopeHost {
     opts) {
         if (opts?.markCopy)
             assertCopyLineage(opts.markCopy);
+        const carry = opts ? recordedOffFromWire(opts) : undefined;
         const load = {
-            switchOff: opts?.switchedOff
-                ? { moduleIds: opts.switchedOff, at: new Date().toISOString(), tenantHeld: opts.tenantHeld }
-                : undefined,
+            switchOff: carry ? { at: new Date().toISOString(), ...carry } : undefined,
             sourceScopeId: opts?.sourceScopeId,
             exact: opts?.exact,
             loadStamp: opts?.loadStamp,
@@ -870,7 +964,7 @@ export class CloudflareScopeHost {
             ...(opts?.expect ? { expect: opts.expect } : {}),
         });
         if (out.refused === false) {
-            return { tables: tables.length, ...(opts?.switchedOff ? { switchedOff: out.switchedOff } : {}) };
+            return { tables: tables.length, ...(carry ? { switchedOff: out.switchedOff } : {}) };
         }
         if (out.refused === 'kept')
             throw substratError('conflict', KEPT_COPY_REFUSAL);
@@ -993,7 +1087,7 @@ export class CloudflareScopeHost {
      * safe; scope-level tuples (the restored grants) are never touched.
      */
     async projectRolesLocal(tenantId, scopeId, roles) {
-        await this.scopeStub(scopeId).applyProjection(tenantId, roles.map((r) => ({ role_key: r.key, permissions: JSON.stringify(r.permissions), source: r.source })), []);
+        unwrapReply(await this.scopeStub(scopeId).applyProjectionReply(tenantId, roles.map((r) => ({ role_key: r.key, permissions: JSON.stringify(r.permissions), source: r.source })), []));
     }
     /**
      * Wipe one scope DO's storage in THIS deployment — the reap half of an orchestrated
@@ -1045,6 +1139,10 @@ export class CloudflareScopeHost {
     async lifecycleFlowLocal(scopeId, input) {
         return this.scopeStub(scopeId).lifecycleFlow(input);
     }
+    /** Business volumes per bucket (#1750) on this host's own scope — the vertical-host read. */
+    async operationSeriesLocal(scopeId, input) {
+        return this.scopeStub(scopeId).operationSeries(input);
+    }
     /** One event's causal chain (#1237) on this host's own scope — the vertical-host read. */
     async eventCauseLocal(scopeId, input) {
         return this.scopeStub(scopeId).eventCause(input);
@@ -1197,7 +1295,7 @@ export class CloudflareScopeHost {
         const record = resolveScopeRecord(input);
         // Fail-closed tenant gate throws out of the awaited cp call BEFORE migrate
         // or audit, so a rejected provision creates nothing and writes no audit row.
-        const created = await this.cp.provisionScope(input.tenantId, input.scopeId, record, new Date().toISOString());
+        const created = await this.directory('provisionScope', input.tenantId, input.scopeId, record, new Date().toISOString());
         // Instantiate the scope DO and trigger its lazy migration.
         await this.migrateAndRecord(input.scopeId);
         // Scope-local permissions: a freshly-provisioned scope evaluates from its own
@@ -1238,17 +1336,9 @@ export class CloudflareScopeHost {
         // #1742: in the SAME unit as the seat, so no sweep can land between them; the re-assert
         // after it then finds them off, and audits what the unit moved.
         const ownStore = this.cpLess || record.vertical === null;
-        const recordedOff = ownStore ? await this.cp.switchedOffModulesOf(input.tenantId, input.scopeId) : [];
         const seatAt = new Date().toISOString();
-        const switchedOff = await this.scopeStub(input.scopeId).seatTuples(seats, recordedOff.length
-            ? {
-                scopeId: input.scopeId,
-                moduleIds: recordedOff,
-                at: seatAt,
-                // #1823: a recorded-off module held only by a tenant grant goes back off too.
-                tenantHeld: await this.cp.tenantHeldSystemModules(input.tenantId, recordedOff, seatAt),
-            }
-            : undefined);
+        const carry = ownStore ? await this.recordedOffCarry(input.tenantId, input.scopeId, seatAt) : undefined;
+        const switchedOff = await this.scopeStub(input.scopeId).seatTuples(seats, carry ? { scopeId: input.scopeId, at: seatAt, ...carry } : undefined);
         if (ownStore) {
             await this.admin.reassertSystemSwitches(actor, { tenantId: input.tenantId, scopeId: input.scopeId }, { appliedInUnit: switchedOff });
         }
@@ -1270,10 +1360,10 @@ export class CloudflareScopeHost {
         // inside the DO's ledger write, which is the serialization point that actually holds.
         const tenant = await this.cp.getTenant(input.tenantId);
         if (!tenant) {
-            throw new Error(`cannot provision tenant store under unknown tenant: ${input.tenantId}`);
+            throw substratError('not_found', `cannot provision tenant store under unknown tenant: ${input.tenantId}`);
         }
         if (tenant.status !== 'active') {
-            throw new Error(`cannot provision tenant store under non-active tenant (status: ${tenant.status}): ${input.tenantId}`);
+            throw substratError('conflict', `cannot provision tenant store under non-active tenant (status: ${tenant.status}): ${input.tenantId}`);
         }
         // Idempotent on (tenant, vertical, binding): a retried provision re-resolves the SAME
         // store rather than minting a second database (the K-31 ready-gate retries the whole
@@ -1288,7 +1378,7 @@ export class CloudflareScopeHost {
         // the source of truth, carrying the D1 database_id Cloudflare assigned as the ref.
         const name = await tenantStoreDatabaseName(input.tenantId, input.vertical, input.binding);
         const ref = await d1.create(name);
-        const stored = await this.cp.putTenantStore({
+        const stored = await this.directory('putTenantStore', {
             tenantId: input.tenantId,
             vertical: input.vertical,
             binding: input.binding,
@@ -1339,17 +1429,17 @@ export class CloudflareScopeHost {
         const r2 = this.requireBlobStores(`provisionBlobStore(tenant=${input.tenantId} vertical=${input.vertical} binding=${input.binding})`);
         const tenant = await this.cp.getTenant(input.tenantId);
         if (!tenant) {
-            throw new Error(`cannot provision blob store under unknown tenant: ${input.tenantId}`);
+            throw substratError('not_found', `cannot provision blob store under unknown tenant: ${input.tenantId}`);
         }
         if (tenant.status !== 'active') {
-            throw new Error(`cannot provision blob store under non-active tenant (status: ${tenant.status}): ${input.tenantId}`);
+            throw substratError('conflict', `cannot provision blob store under non-active tenant (status: ${tenant.status}): ${input.tenantId}`);
         }
         const existing = await this.cp.getBlobStore(input.tenantId, input.vertical, input.binding);
         if (existing)
             return { binding: input.binding, kind: 'blob', ref: existing.ref };
         const name = await blobStoreBucketName(input.tenantId, input.vertical, input.binding);
         const ref = await r2.create(name);
-        const stored = await this.cp.putBlobStore({
+        const stored = await this.directory('putBlobStore', {
             tenantId: input.tenantId,
             vertical: input.vertical,
             binding: input.binding,
@@ -1488,22 +1578,22 @@ export class CloudflareScopeHost {
             // the DO only to be refused and recorded — never to the blob store.
             const hash = subject.capabilitySession;
             return {
-                upload: async (input) => unwrapCapabilityReply(await stub.capabilityAttachmentRefuseWrite(hash, tenantId, scopeId, 'attachments.upload', {
+                upload: async (input) => unwrapReply(await stub.capabilityAttachmentRefuseWrite(hash, tenantId, scopeId, 'attachments.upload', {
                     entityType: input.entity.entityType,
                 })),
-                list: async (entity) => unwrapCapabilityReply(await stub.capabilityAttachmentList(entity, hash, tenantId, scopeId)),
+                list: async (entity) => unwrapReply(await stub.capabilityAttachmentList(entity, hash, tenantId, scopeId)),
                 open: async (attachmentId) => {
-                    const record = unwrapCapabilityReply(await stub.capabilityAttachmentOpen(attachmentId, hash, tenantId, scopeId));
+                    const record = unwrapReply(await stub.capabilityAttachmentOpen(attachmentId, hash, tenantId, scopeId));
                     return record ? this.openAttachmentBytes(store, scopeId, record) : null;
                 },
-                remove: async (attachmentId) => unwrapCapabilityReply(await stub.capabilityAttachmentRefuseWrite(hash, tenantId, scopeId, 'attachments.remove', {
+                remove: async (attachmentId) => unwrapReply(await stub.capabilityAttachmentRefuseWrite(hash, tenantId, scopeId, 'attachments.remove', {
                     attachmentId,
                 })),
                 search: async (term, options) => {
                     // Judged here too, so a short term reaches the caller as `SearchTermTooShort`
                     // rather than as a message that crossed the RPC boundary. The DO judges again.
                     searchMatchExpression(term, 'prefix');
-                    return unwrapCapabilityReply(await stub.capabilityAttachmentSearch(term, searchLimit(options?.limit), hash, tenantId, scopeId));
+                    return unwrapReply(await stub.capabilityAttachmentSearch(term, searchLimit(options?.limit), hash, tenantId, scopeId));
                 },
             };
         }
@@ -1558,7 +1648,7 @@ export class CloudflareScopeHost {
                     throw new Error('attachments.search is not available on a delivery-scoped surface');
                 }
                 searchMatchExpression(term, 'prefix');
-                return unwrapCapabilityReply(await stub.attachmentSearch(term, searchLimit(options?.limit), asPrincipalId, tenantId, scopeId, connectionId));
+                return unwrapReply(await stub.attachmentSearch(term, searchLimit(options?.limit), asPrincipalId, tenantId, scopeId, connectionId));
             },
         };
     }
@@ -1606,24 +1696,51 @@ export class CloudflareScopeHost {
         // this is the scope's real store, as for the provision's seat above; a hosted scope is
         // restored in its deployment, which the platform carries the same list to.
         const ownStore = this.cpLess || existing.vertical === null;
-        const recordedOff = ownStore ? await this.cp.switchedOffModulesOf(tenantId, scopeId) : [];
         const replayAt = new Date().toISOString();
+        const carry = ownStore ? await this.recordedOffCarry(tenantId, scopeId, replayAt) : undefined;
         const switchedOff = await this.scopeStub(scopeId).importDump(dump.tables, scopeId, {
-            switchOff: recordedOff.length
-                ? {
-                    moduleIds: recordedOff,
-                    at: replayAt,
-                    // #1823: a recorded-off module held only by a tenant grant goes back off too.
-                    tenantHeld: await this.cp.tenantHeldSystemModules(tenantId, recordedOff, replayAt),
-                }
-                : undefined,
+            switchOff: carry ? { at: replayAt, ...carry } : undefined,
             sourceScopeId: opts?.sourceScopeId ?? dump.scopeId,
         });
         await this.recordAdmin(actor, 'restoreScope', { tenantId, scopeId }, null, { sourceScopeId: dump.scopeId, tables: dump.tables.length, capturedAt: dump.capturedAt });
-        if (recordedOff.length) {
+        if (carry) {
             await this.admin.reassertSystemSwitches(actor, { tenantId, scopeId }, { appliedInUnit: switchedOff });
         }
     }
+    /**
+     * #1742, #2029: what this host's own unit carries of the directory's record — the modules and
+     * the peers recorded OFF on the scope, each with the ones held there only by a tenant-level
+     * grant (#1823, #2030). Undefined when nothing is recorded off, so such a unit is unchanged.
+     */
+    async recordedOffCarry(tenantId, scopeId, at) {
+        const [modules, peers] = await Promise.all([
+            this.recordedOff('system', tenantId, scopeId, at),
+            this.recordedOff('peer', tenantId, scopeId, at),
+        ]);
+        if (!modules.keys.length && !peers.keys.length)
+            return undefined;
+        return {
+            moduleIds: modules.keys,
+            tenantHeld: modules.tenantHeld,
+            verticals: peers.keys,
+            tenantHeldVerticals: peers.tenantHeld,
+            fences: switchFencesCarried([
+                ['system', modules],
+                ['peer', peers],
+            ]),
+        };
+    }
+    /** The subjects of one kind the directory records OFF on the scope, and of those the tenant-held ones. */
+    async recordedOff(kind, tenantId, scopeId, at) {
+        // #2045: the OFF rows and their fences in one read, so every key carried has its own row's fence.
+        const fences = new Map((await this.cp.switchRecordStatesOf(kind, tenantId, scopeId))
+            .filter(([, row]) => row.position === 'off')
+            .map(([key, row]) => [key, row.fence]));
+        const keys = [...fences.keys()];
+        if (!keys.length)
+            return { keys, tenantHeld: [], fences };
+        return { keys, tenantHeld: await this.cp.tenantHeldOf(kind, tenantId, keys, at), fences };
+    }
     async snapshotScope(actor, tenantId, scopeId, opts) {
         const source = await this.admin.getScopeRecord(actor, tenantId, scopeId);
         if (!source)
@@ -1654,7 +1771,7 @@ export class CloudflareScopeHost {
         if (!rec)
             throw substratError('not_found', `unknown scope ${scopeId} in tenant ${tenantId}`);
         if (!rec.forkedFrom && rec.kind !== 'preview') {
-            throw new Error(`scope ${scopeId} is not a fork or preview — only previews may be deleted; ` +
+            throw substratError('forbidden', `scope ${scopeId} is not a fork or preview — only previews may be deleted; ` +
                 `archive a primary scope instead`);
         }
         // Storage BEFORE the directory row: a crash between the two leaves a visible row
@@ -1815,34 +1932,55 @@ export class CloudflareScopeHost {
     /** #1834: the job pass this door is opened for; its "not now" refusals are tied to it. */
     pass) {
         if (!this.moduleIds.has(moduleId)) {
-            throw new Error(`module not registered on this host: ${moduleId}`);
+            throw substratError('not_found', `module not registered on this host: ${moduleId}`);
         }
         await this.assertLive(tenantId, scopeId);
         await this.migrateAndRecord(scopeId);
+        return this.openDoor('system', moduleId, scopeId, gated, pass);
+    }
+    /**
+     * #1834: one door, for either kind of switched subject (#2029). The gate is read here unless the
+     * caller read it (`runDueSchedules` reports a hold it could not read on its pass report); a held
+     * subject is refused, and a call landing on another instance than the gate's re-gates, at most
+     * `SYSTEM_DOOR_REGATES` times, then fails closed.
+     *
+     * The peer door (`kind: 'peer'`) is the system door's for a peer vertical. A PITR rewind to before
+     * a peer was switched off brings its grants back live and its OFF marker gone, so the rewind holds
+     * it outside the scope (`rewindHolding`, as for a module), and every peer entry — an invoke, a
+     * delivery, a coverage read, an export read for it as consumer — opens this door after
+     * `peerScopeGate`.
+     */
+    async openDoor(kind, key, scopeId, gated, pass) {
+        const words = DOOR_WORDS[kind];
+        const what = words.what(key);
         // A gate this door reads itself reports a hold it could not read; one handed in was the
-        // caller's to report (`runDueSchedules` puts it on its pass report).
+        // caller's to report.
         const regate = async () => {
-            const fresh = await this.systemDoorGate(scopeId, moduleId);
+            const fresh = await this.doorGate(kind, scopeId, key);
             if (fresh.error)
-                console.error(`substrat: system door ${moduleId} on ${scopeId}: ${fresh.error}`);
+                console.error(`substrat: door of ${what} on ${scopeId}: ${fresh.error}`);
             return fresh;
         };
         let gate = gated ?? (await regate());
         return {
-            moduleId,
+            kind,
+            key,
             through: async (call) => {
                 for (let regates = 0;; regates += 1) {
                     if (gate.held) {
                         // The hold ends when the switch is applied again: a job run waits it out without
                         // spending its retries, because the driver defers on THIS refusal (`doorWait`).
-                        throw this.doorWait(pass, substratError('forbidden', `module '${moduleId}' is held off on this scope: it was rewound to before its schedule ` +
-                            'switch was turned off, and it stays off until the switch is applied again', { reason: SYSTEM_DOOR_WAIT }));
+                        const held = substratError('forbidden', `${what} is held off on this scope: it was rewound to before its ` +
+                            `${words.switchName} switch was turned off, and it stays off until ` +
+                            'the switch is applied again', { reason: SYSTEM_DOOR_WAIT });
+                        this.heldRefusals.add(held);
+                        throw this.doorWait(pass, held);
                     }
                     const answer = await call(gate.instance);
                     if (!isSystemDoorMoved(answer))
                         return answer;
                     if (regates >= SYSTEM_DOOR_REGATES) {
-                        throw this.doorWait(pass, substratError('unavailable', `the scope kept restarting under the system door of module '${moduleId}' ` +
+                        throw this.doorWait(pass, substratError('unavailable', `the scope kept restarting under the ${words.door} of ${what} ` +
                             `(${regates + 1} attempts); nothing ran. Retry later`, { reason: SYSTEM_DOOR_WAIT }));
                     }
                     gate = await regate();
@@ -1859,6 +1997,16 @@ export class CloudflareScopeHost {
      * on a later pass is an ordinary failure there. Held weakly: an error nobody holds goes.
      */
     doorWaits = new WeakMap();
+    /**
+     * #2029: the hold refusals this host's doors threw, by identity — so a peer delivery pauses its
+     * edge, and a coverage read answers "holds nothing", on exactly those and on no error that only
+     * looks like one. Held weakly, as `doorWaits` is.
+     */
+    heldRefusals = new WeakSet();
+    /** #2029: is `err` a hold refusal this host's door threw? */
+    isHeldRefusal(err) {
+        return typeof err === 'object' && err !== null && this.heldRefusals.has(err);
+    }
     /** #1834: mark this door's own refusal as "not now" for the pass it was opened for, and hand it back. */
     doorWait(pass, err) {
         if (pass)
@@ -1873,13 +2021,23 @@ export class CloudflareScopeHost {
         return true;
     }
     /**
-     * #1834: the system door's gate — the scope's state read for the module, the instance that
-     * answered it, and then (only for a module the scope has on) the rewind hold (#1819). The
+     * #1834: a door's gate — the scope's state read for the subject, the instance that answered it,
+     * and then the rewind hold (#1819), for any subject the scope does not already have off. The
      * hold is read AFTER the state, which is the order `switchHeld` needs.
+     *
+     * `ungranted` reads the hold too (#2029): a subject held on the scope only by a TENANT-level
+     * grant (#1823, #2030) comes back from a rewind with no scope grant and no marker, and the
+     * tenant grant still authorizes it there. A rewind captured it off, so the hold must keep it so.
      */
-    async systemDoorGate(scopeId, moduleId) {
-        const { state, instance } = await this.scopeStub(scopeId).systemDoorState(moduleId);
-        const hold = state === 'on' ? await this.switchHeld(scopeId, moduleId) : { held: false };
+    async doorGate(kind, scopeId, key) {
+        const stub = this.scopeStub(scopeId);
+        const { state, instance } = await (kind === 'system' ? stub.systemDoorState(key) : stub.peerDoorState(key));
+        const cleared = `${scopeId} ${instance}`;
+        if (state === 'off' || CLEAR_SCOPE_INSTANCES.has(cleared))
+            return { state, instance, held: false };
+        const hold = await this.switchHeld(scopeId, holdKeyOf(kind, key));
+        if (hold.scopeClear)
+            rememberClearInstance(cleared);
         return { state, instance, held: hold.held, ...(hold.error ? { error: hold.error } : {}) };
     }
     /**
@@ -1893,8 +2051,25 @@ export class CloudflareScopeHost {
         // The peer door's own gate (#1706): K-3's pair check, the refusal for a scope served
         // elsewhere, the lifecycle check and the migration. A delivery is a write into the
         // consumer's scope, so it takes the gate an invoke through that door takes.
-        await this.peerScopeGate(tenantId, scopeId, 'deliverToPeer');
-        const result = importResult.parse(await this.scopeStub(scopeId).importApply(batch, tenantId, scopeId));
+        const record = await this.peerScopeGate(tenantId, scopeId, 'deliverToPeer');
+        // #2004: a copy consumes no other vertical's events, at the door as in the sweep
+        // (`scope-copy.ts`). A pause: nothing runs and the watermark stays.
+        if (await this.isInertScope(tenantId, scopeId, record)) {
+            return { ...emptyImportResult(batch), paused: { reason: INERT_SCOPE_REASON } };
+        }
+        // #2029: the producer is a peer, so the delivery goes through its door: a producer the rewind
+        // hold keeps off pauses the edge, exactly as a switched-off one does inside the DO.
+        const door = await this.openDoor('peer', batch.source.vertical, scopeId);
+        let applied;
+        try {
+            applied = await door.through((instance) => this.scopeStub(scopeId).importApply(batch, tenantId, scopeId, instance));
+        }
+        catch (err) {
+            if (!this.isHeldRefusal(err))
+                throw err;
+            return { ...emptyImportResult(batch), paused: { reason: err.message } };
+        }
+        const result = importResult.parse(applied);
         if (result.delivered > 0) {
             try {
                 await this.drainExecutors(tenantId, scopeId, null);
@@ -1938,7 +2113,9 @@ export class CloudflareScopeHost {
     async getVerticalScope(caller, tenantId, scopeId, options) {
         const parsed = verticalCaller.parse(caller);
         await this.peerScopeGate(tenantId, scopeId, 'getVerticalScope');
-        return this.buildStub(tenantId, scopeId, undefined, undefined, undefined, options, undefined, undefined, parsed);
+        // #2029: gated against the rewind hold and pinned, as the system door is.
+        const door = await this.openDoor('peer', parsed.vertical, scopeId);
+        return this.buildStub(tenantId, scopeId, undefined, undefined, door, options, undefined, undefined, parsed);
     }
     /**
      * Does peer `vertical` hold each key at this scope's node now (#1706) — the ScopeDO's own
@@ -1946,9 +2123,19 @@ export class CloudflareScopeHost {
      */
     async peerCovers(tenantId, scopeId, vertical, permissions) {
         await this.peerScopeGate(tenantId, scopeId, 'peerCovers');
-        return peerCoverage
-            .array()
-            .parse(await this.scopeStub(scopeId).peerCovers(tenantId, scopeId, verticalSlug.parse(vertical), [...permissions]));
+        const slug = verticalSlug.parse(vertical);
+        // #2029: a peer the rewind hold keeps off holds nothing here, as a switched-off one doesn't.
+        const door = await this.openDoor('peer', slug, scopeId);
+        try {
+            return peerCoverage
+                .array()
+                .parse(await door.through((instance) => this.scopeStub(scopeId).peerCovers(tenantId, scopeId, slug, [...permissions], instance)));
+        }
+        catch (err) {
+            if (this.isHeldRefusal(err))
+                return permissions.map((permission) => ({ permission, held: false }));
+            throw err;
+        }
     }
     /**
      * `ctx.canAssign`'s bound for a principal the host names (#1931) — the ScopeDO's own role read
@@ -1994,8 +2181,9 @@ export class CloudflareScopeHost {
         // door's own tenant-confinement test proved. A RECORD crosses intact, so the coordinator
         // reads the record and types the refusal itself. `validateScopeAccess` still runs below
         // and still owns the lifecycle half (a suspended tenant or scope).
+        let record;
         if (!this.cpLess) {
-            const record = await this.cp.getScopeRecord(tenantId, scopeId);
+            record = await this.cp.getScopeRecord(tenantId, scopeId);
             if (!record) {
                 throw unknownScopeForTenant(tenantId, scopeId);
             }
@@ -2003,6 +2191,23 @@ export class CloudflareScopeHost {
         }
         await this.assertLive(tenantId, scopeId);
         await this.migrateAndRecord(scopeId);
+        return record;
+    }
+    /**
+     * Whether this scope is held inert (#2005): a fork, a snapshot or a preview, which causes no
+     * outbound effects and consumes no other vertical's events (#2004). The one primacy question
+     * every such door asks. Where there is a directory its record answers (`record`, the one
+     * `peerScopeGate` returns, when the caller has already read it). A CP-less host has none, so it asks the scope's own storage
+     * whether it is classified a copy (`_substrat_copy_origin`'s `is_copy`, #2009, set on the
+     * directory's word): a preview and a snapshot reach a hosted vertical as restores the
+     * platform marks.
+     */
+    isInertScope(tenantId, scopeId, record) {
+        if (this.cpLess)
+            return this.scopeStub(scopeId).isCopy();
+        if (record)
+            return Promise.resolve(!isPrimaryScopeRow(record));
+        return this.cp.getScopeRecord(tenantId, scopeId).then((row) => !isPrimaryScopeRow(row));
     }
     /**
      * The capability's attachment door (#1686) — `getCapabilityScope`'s gate, then the
@@ -2183,7 +2388,7 @@ export class CloudflareScopeHost {
         // #1819: a scope rewound to before its switch was pulled answers `on`, and the rewind held
         // the module outside the scope. Both are read by the system door's own gate (#1834), which
         // every fire below then goes through, pinned to the instance this read came from.
-        const gate = await this.systemDoorGate(scopeId, moduleId);
+        const gate = await this.doorGate('system', scopeId, moduleId);
         if (gate.state === 'ungranted')
             return report;
         if (gate.error)
@@ -2258,10 +2463,11 @@ export class CloudflareScopeHost {
     /** The stub body, shared by the principal, connection, system and impersonation doors. */
     buildStub(tenantId, scopeId, principal, connectionId, 
     /**
-     * #1834: the system door this stub acts through. The ONLY way to make a stub acting as
+     * #1834: the door this stub acts through. The ONLY way to make a stub acting as
      * `system:<moduleId>`: the module is the door's, and every invoke is gated and pinned by it.
+     * #2029: a peer stub's door too (`openDoor('peer', …)`), gating and pinning each invoke the same way.
      */
-    systemDoor, options, 
+    door, options, 
     /**
      * K-42: the session this stub acts under. Re-read from the directory on
      * EVERY invoke rather than captured here — a stub is a capability and
@@ -2282,7 +2488,7 @@ export class CloudflareScopeHost {
      */
     verticalCaller) {
         const stub = this.scopeStub(scopeId);
-        const systemModuleId = systemDoor?.moduleId;
+        const systemModuleId = door?.kind === 'system' ? door.key : undefined;
         const cp = this.cp;
         const operationEntitlement = this.operationEntitlement;
         // The DO needs SOME principal-shaped value for `ctx.principal`; for a
@@ -2338,10 +2544,10 @@ export class CloudflareScopeHost {
                 // K-42: resolved per invoke, so expiry and `endImpersonation` both bite.
                 const session = sessionId === undefined ? undefined : await this.resolveImpersonation(sessionId, tenantId, scopeId);
                 const send = (systemDoorInstance) => stub.invoke(operation, input, asPrincipalId, tenantId, scopeId, connectionId, requiredKey, systemModuleId, true, invokeOptions, session, capabilitySession, verticalCaller, systemDoorInstance);
-                // #1834: through the system door, pinned to the instance its gate read. The DO's
-                // refusal comes back as a failure envelope, so it is rethrown for the door to re-gate.
-                const envelope = systemDoor
-                    ? await systemDoor.through(async (instance) => {
+                // #1834: through the door (a module's, or #2029 a peer's), pinned to the instance its gate
+                // read. A missed pin comes back as an answer, which `through` re-gates on.
+                const envelope = door
+                    ? await door.through(async (instance) => {
                         const sent = await send(instance);
                         return sent.systemDoorMoved === true ? SYSTEM_DOOR_MOVED : sent;
                     })
@@ -2394,9 +2600,9 @@ export class CloudflareScopeHost {
                     throw substratError('unavailable', `${operation} ran on a scope host that did not understand peer callers. ` +
                         'Retry once the scope has been migrated');
                 }
-                // #1834, the same shape: a DO too old to know the system door's pin ran the call
-                // without checking it met the storage the door's gate read.
-                if (systemDoor !== undefined && envelope.systemDoor?.honoured !== true) {
+                // #1834, the same shape: a DO too old to know the door's pin ran the call without
+                // checking it met the storage the door's gate read.
+                if (door !== undefined && envelope.systemDoor?.honoured !== true) {
                     throw substratError('unavailable', `${operation} ran on a scope host that did not understand the system door's pin. ` +
                         'Retry once the scope has been migrated');
                 }
@@ -2410,11 +2616,13 @@ export class CloudflareScopeHost {
                 // this scope's outbox — and draining anyway would run executors and
                 // connectors as a side effect of a session that may not have side effects.
                 // Whatever the outbox already held is the drain sweep's own backstop.
+                // #1184: what this call's executors did inline, for `onExecutorOutcomes`.
+                const executorOutcomes = invokeOptions?.onExecutorOutcomes ? [] : undefined;
                 const drained = session?.mode === 'read-only'
                     ? { attempted: 0, delivered: 0, retrying: 0, deadLettered: 0, routedToPlatform: 0 }
                     // #1525: this drain is part of the call that emitted the events — the
                     // coordinator's half of the post-commit tail the DO ran the consumers in.
-                    : await this.drainExecutors(tenantId, scopeId, invokeOptions?.invocationId ?? null);
+                    : await this.drainExecutors(tenantId, scopeId, invokeOptions?.invocationId ?? null, executorOutcomes);
                 // #458: the operation committed having enqueued platform intents — tell the
                 // caller's harness so it can flag the response for the router kick (#381).
                 // Routed connector deliveries (#574 phase 3) count too: the inline drain just
@@ -2431,6 +2639,9 @@ export class CloudflareScopeHost {
                     invokeOptions?.onIdempotentReplay?.();
                 if (envelope.emitted)
                     invokeOptions?.onEmitted?.(envelope.emitted);
+                if (executorOutcomes && session?.mode !== 'read-only' && !envelope.idempotency?.replayed) {
+                    invokeOptions?.onExecutorOutcomes?.(executorOutcomes);
+                }
                 return envelope.result;
             },
         };
@@ -2523,7 +2734,7 @@ export class CloudflareScopeHost {
          */
         const requireOrg = async (tenant, id) => {
             if (!(await this.cp.readOrg(tenant, id))) {
-                throw new Error(`unknown org ${id} in tenant ${tenant}`);
+                throw substratError('not_found', `unknown org ${id} in tenant ${tenant}`);
             }
         };
         const mapScope = (r) => scopeSchema.parse({
@@ -2610,24 +2821,20 @@ export class CloudflareScopeHost {
             }
         };
         /**
-         * #1666: move one module's schedule switch on one scope — see `HostAdmin.revokeFromSystem`.
+         * Where one scope's kill switch of one kind lands — the ONE rule the operator's switch and
+         * the #1674 re-assert share, so a re-assert moves exactly the switch an operator's OFF would
+         * have. `kind` is a module's schedule switch (#1666) or a peer's (#1706, #2029); `key` is the
+         * module id or the peer's slug.
          *
          * Where the write lands is the whole point of the delegation branch. The shared control
-         * plane's own `SCOPE` namespace is the module-less placeholder, so a hosted scope's
-         * switch has to be moved in the deployment serving it; writing it here would report a
-         * switch pulled while every schedule kept firing. The audit row is written HERE either
-         * way — the deployment's host is CP-less, and its `recordAdmin` is a no-op.
+         * plane's own `SCOPE` namespace is the module-less placeholder, so a hosted scope's switch
+         * has to be moved in the deployment serving it, over that kind's delegation; writing it here
+         * would report a switch pulled while every schedule kept firing, or every peer call kept
+         * being admitted. A scope bound to no vertical (#1666 review) has no deployment to delegate
+         * to: its store is the DO here, so the switch moves (or answers `held: false`) here too.
+         * Delegating it would throw "no deployment serving scope" instead.
          */
-        /**
-         * #1706: move one PEER's kill switch on one scope — see `HostAdmin.revokeFromPeer`. The
-         * schedule switch's audit discipline (intent first, outcome after, every attempt) and,
-         * since part 3, its delegation: a scope served by a vertical's own deployment is switched
-         * THERE, over `PeerSwitchDelegation`. Without one configured the scope is still refused
-         * `unavailable` (`peerScopeGate`) rather than switched in the placeholder namespace.
-         */
-        const switchPeerAt = async (actor, raw, to) => {
-            const input = peerSwitch.parse(raw);
-            const { tenantId, scopeId } = input.node;
+        const switchTarget = async (kind, tenantId, scopeId) => {
             let vertical = null;
             if (!this.cpLess) {
                 const rec = await this.cp.getScopeRecord(tenantId, scopeId);
@@ -2635,136 +2842,109 @@ export class CloudflareScopeHost {
                     throw unknownScopeForTenant(tenantId, scopeId);
                 vertical = rec.vertical;
             }
-            const action = to === 'off' ? 'revokeFromPeer' : 'restoreToPeer';
-            // Where the write lands is the whole point of this branch (#1706 part 3, mirroring
-            // #1666). A scope bound to a vertical is served by that vertical's own deployment, and
-            // its `vertical:<slug>` grants live there; switching it in the shared control plane's
-            // placeholder namespace would tombstone nothing and report a peer cut off while every
-            // call it makes kept being admitted. A scope bound to NO vertical has its store here,
-            // so it switches here — delegating it would throw "no deployment serving scope".
-            // With no delegation configured the old refusal stands, loudly, rather than a write
-            // into the wrong namespace.
-            const delegation = this.cpLess || vertical !== null ? this.peerSwitchDelegation : undefined;
-            if (delegation) {
-                // The gate's lifecycle half still runs (a suspended tenant or scope cannot be
-                // switched); its `scopeStub` half is what the delegation replaces.
-                await this.validateScopeAccess(tenantId, scopeId);
-            }
-            else {
-                await this.peerScopeGate(tenantId, scopeId, action);
-            }
-            const operationId = ulid();
-            const target = { tenantId, scopeId, vertical };
-            const base = { operationId, vertical: input.vertical, calls: to };
-            await this.recordAdmin(actor, action, target, null, { ...base, phase: 'intent', reason: input.reason });
-            let outcome;
-            try {
-                outcome = delegation
-                    ? await delegation.switch({ tenantId, scopeId, vertical: input.vertical, to })
-                    : await this.scopeStub(scopeId).switchPeer(input.vertical, scopeId, to, new Date().toISOString());
-            }
-            catch (err) {
-                await this.recordAdmin(actor, action, target, null, {
-                    ...base,
-                    phase: 'failed',
-                    error: err instanceof Error ? err.message : String(err),
-                }).catch(() => undefined);
-                throw err;
-            }
-            await this.recordAdmin(actor, action, target, null, {
-                ...base,
-                phase: outcome.held ? 'applied' : 'refused',
-                changed: outcome.changed,
-                permissions: outcome.permissions,
-            });
-            if (!outcome.held) {
-                throw substratError('not_found', `scope ${scopeId} holds no grant for peer '${input.vertical}' — nothing to switch ${to} ` +
-                    `(check the slug: it is the calling vertical's registry id, as the target's \`peers\` names it)`);
-            }
-            return {
-                operationId,
-                vertical: input.vertical,
-                calls: to,
-                changed: outcome.changed,
-                permissions: outcome.permissions,
-            };
-        };
-        /**
-         * Where one scope's schedule switch lands — the ONE rule `switchSystem` and the #1674
-         * re-assert share, so a re-assert moves exactly the switch an operator's OFF would have.
-         * A scope bound to no vertical (#1666 review) has no deployment to delegate to: its store
-         * is the DO here, so the switch moves (or answers `held: false`) here too. Delegating it
-         * would throw "no deployment serving scope" instead. A scope WITH a vertical still
-         * delegates, and still fails loudly when none serves it.
-         */
-        const systemSwitchTarget = async (tenantId, scopeId) => {
-            let vertical = null;
-            if (!this.cpLess) {
-                const rec = await this.cp.getScopeRecord(tenantId, scopeId);
-                if (!rec)
-                    throw unknownScopeForTenant(tenantId, scopeId);
-                vertical = rec.vertical;
-            }
-            const delegation = this.cpLess || vertical !== null ? this.systemSwitchDelegation : undefined;
+            const hosted = this.cpLess || vertical !== null;
+            const systemDelegation = kind === 'system' && hosted ? this.systemSwitchDelegation : undefined;
+            const peerDelegation = kind === 'peer' && hosted ? this.peerSwitchDelegation : undefined;
+            const delegated = systemDelegation !== undefined || peerDelegation !== undefined;
             // #1819: a scope whose store is here was rewound here, so `switchInScope` releases its
             // hold here too. A delegated move releases in the deployment serving the scope.
-            // #1823: a module whose only authority on the scope is a TENANT-level grant has nothing in
-            // the scope's storage for the switch to find, so the directory says whether it is held.
-            // A caller moving several modules reads them in one call and passes each answer in.
-            // An OFF of a tenant-held module is refused, after the far end answers, unless that answer
+            // #1823 (#2030 for a peer): a subject whose only authority on the scope is a TENANT-level
+            // grant has nothing in the scope's storage for the switch to find, so the directory says
+            // whether it is held. A caller moving several reads them in one call and passes each in.
+            // An OFF of a tenant-held MODULE is refused, after the far end answers, unless that answer
             // attests the evaluator that denies a tenant-level grant (`deniesTenantGrants`). A
             // deployment built before #1823 drops `tenantHeld`, still answers `held: true` (the module's
             // scope-level grants were there to switch), and keeps authorizing the tenant-level grant —
-            // so its `held` alone would have the platform record a scope off that is not. Every OFF the
-            // platform drives moves through here: an operator's (`switchSystem`, which then puts the
-            // switch back) and a re-assert's, which every carry ends with.
-            const move = async (moduleId, to, at, tenantHeld) => {
-                const held = tenantHeld ?? (await this.cp.tenantHeldSystemModules(tenantId, [moduleId], at)).length > 0;
-                const outcome = await (delegation
-                    ? delegation.switch({ tenantId, scopeId, moduleId, to, tenantHeld: held })
-                    : this.switchInScope(scopeId, moduleId, to, at, held));
-                if (to === 'off' && held && outcome.held && outcome.deniesTenantGrants !== true) {
-                    throw new UnattestedSwitchOff(scopeId, moduleId, outcome);
+            // so its `held` alone would have the platform record a scope off that is not. A peer needs
+            // no attestation: its door refuses on the marker in every build that has the peer switch at
+            // all (`admitPeer` and `switchPeer` arrived together, #1714). Every OFF the platform drives
+            // moves through here: an operator's (`switchSubjectAt`) and a re-assert's, which every carry
+            // ends with.
+            //
+            // #2045 (Codex r3): whether a delegated deployment honours the switch fence is settled
+            // BEFORE anything moves (`attestFence`, once per target), never after the fact by putting a
+            // move back. Without the fence an ON is refused and an OFF goes through unfenced (see
+            // `UnattestedSwitch`). A move a fenced deployment answers without the attestation still
+            // throws, as defence in depth against a rollback between the preflight and the move.
+            const delegation = systemDelegation ?? peerDelegation;
+            let attested;
+            const attestFence = () => (attested ??= delegation ? delegation.fenceSupported({ tenantId, scopeId }) : Promise.resolve(true));
+            const move = async (key, to, at, tenantHeld, 
+            /** #2045: the switch call's fence — its operation id, or for a re-assert the record's. */
+            fence) => {
+                const fenced = await attestFence();
+                if (!fenced && to === 'on')
+                    throw new UnattestedSwitch(unfencedMessage(scopeId));
+                const held = tenantHeld ?? (await this.cp.tenantHeldOf(kind, tenantId, [key], at)).length > 0;
+                const outcome = await (systemDelegation
+                    ? systemDelegation.switch({ tenantId, scopeId, moduleId: key, to, tenantHeld: held, fence })
+                    : peerDelegation
+                        ? peerDelegation.switch({ tenantId, scopeId, vertical: key, to, tenantHeld: held, fence })
+                        : this.switchInScope(kind, scopeId, key, to, at, held, fence));
+                // An unfenced OFF answers without `fenced`, and that is what the callers read it by.
+                if (fenced && outcome.fenced !== true)
+                    throw new UnattestedSwitch(unfencedMessage(scopeId));
+                if (outcome.superseded)
+                    return outcome;
+                if (kind === 'system' && to === 'off' && held && outcome.held && outcome.deniesTenantGrants !== true) {
+                    throw new UnattestedSwitch(undeniedMessage(scopeId, key));
                 }
                 return outcome;
             };
-            /**
-             * Is the module switched off on the scope right now? Read from wherever `move` writes — the
-             * deployment's status read or this scope's own — for a move that threw (#1823): the switch
-             * may already have moved before the throw (`switchInScope` moves it, then works the rewind
-             * hold), and then the directory's record must stay.
-             */
-            const isOff = async (moduleId) => {
-                const rows = delegation
-                    ? await delegation.status({ tenantId, scopeId })
-                    : systemScheduleEntry.array().parse(await this.scopeStub(scopeId).systemGrantsStatus());
-                return rows.some((r) => r.moduleId === moduleId && r.schedules === 'off');
-            };
-            return { vertical, move, isOff };
+            return { vertical, delegated, move, attestFence };
         };
-        const switchSystem = async (actor, raw, to) => {
-            const input = systemSwitch.parse(raw);
-            const { tenantId, scopeId } = input.node;
-            const { vertical, move, isOff } = await systemSwitchTarget(tenantId, scopeId);
+        /**
+         * One kill switch moved on one scope — the ONE body `revokeFromSystem` / `restoreToSystem`
+         * (#1666) and `revokeFromPeer` / `restoreToPeer` (#1706) share, so the two levers cannot
+         * disagree about the record, the audit, the readback or the undo (#2029). The audit row is
+         * written HERE either way — a deployment's host is CP-less, and its `recordAdmin` is a no-op.
+         */
+        const switchSubjectAt = async (actor, kind, node, key, reason, to) => {
+            const { tenantId, scopeId } = node;
+            const { vertical, delegated, move, attestFence } = await switchTarget(kind, tenantId, scopeId);
+            const action = switchActionOf(kind, to);
+            if (kind === 'peer') {
+                // The peer door's gate (#1706): with a delegation, its lifecycle half (a suspended tenant
+                // or scope cannot be switched), the `scopeStub` half being what the delegation replaces.
+                // Without one, a hosted scope is refused `unavailable` rather than switched in the
+                // placeholder namespace, where it would tombstone nothing a peer call reads.
+                if (delegated)
+                    await this.validateScopeAccess(tenantId, scopeId);
+                else
+                    await this.peerScopeGate(tenantId, scopeId, action);
+            }
             // AUDIT FIRST (#1666 review): the intent row lands before anything moves, and the
             // outcome row after — every attempt, a repeat included. The scope's store and the
             // admin log are separate, so no order makes the pair atomic; this one fails toward
             // "an intent with no recorded outcome" and never toward "a switch that moved with no
             // audit row". A retry after a crash re-audits even though it answers `changed: false`.
             const operationId = ulid();
-            const action = to === 'off' ? 'revokeFromSystem' : 'restoreToSystem';
             const target = { tenantId, scopeId, vertical };
-            const base = { operationId, moduleId: input.moduleId, schedules: to };
-            await this.recordAdmin(actor, action, target, null, { ...base, phase: 'intent', reason: input.reason });
-            // The directory's record (#1674), written BEFORE the scope moves, both ways, and undone
-            // if the move throws or holds nothing — see `recordSystemSwitchedOn` and (#1823)
-            // `recordSystemSwitchedOff` for why that order is the safe one.
-            const at = new Date().toISOString();
-            const record = { tenantId, scopeId, moduleId: input.moduleId, actor, reason: input.reason, operationId, at };
+            const base = { operationId, ...switchAuditSubject(kind, key, to) };
+            await this.recordAdmin(actor, action, target, null, { ...base, phase: 'intent', reason });
             const errorOf = (err) => (err instanceof Error ? err.message : String(err));
+            // #2045 (Codex r3): the deployment's fence is attested BEFORE anything is recorded or moved. An
+            // ON on a deployment built before it is refused here, with nothing written anywhere but the
+            // audit. An OFF goes on: the kill switch must work on every deployment (see `UnattestedSwitch`).
+            try {
+                if (!(await attestFence()) && to === 'on') {
+                    throw substratError('precondition_failed', `${unfencedMessage(scopeId)} Nothing was switched.`);
+                }
+            }
+            catch (err) {
+                await this.recordAdmin(actor, action, target, null, { ...base, phase: 'refused', error: errorOf(err) }).catch(() => undefined);
+                throw err;
+            }
+            // The directory's record (#1674; #2029 for a peer), written BEFORE the scope moves, both
+            // ways — see `recordSwitchedOn` and (#1823) `recordSwitchedOff` for why that order is the
+            // safe one. #2045 (Codex r3): the same write marks the subject owed and clears the scope's
+            // reconcile receipt, so from here on the scope converges to this record whatever happens to
+            // the move. The mark goes only when the scope confirms the move under this call's fence.
+            const at = new Date().toISOString();
+            const record = { kind, tenantId, scopeId, key, actor, reason, operationId, at };
             let prior;
             try {
-                prior = to === 'on' ? await this.cp.recordSystemSwitchedOn(record) : await this.cp.recordSystemSwitchedOff(record);
+                prior = to === 'on' ? await this.cp.recordSwitchedOn(record) : await this.cp.recordSwitchedOff(record);
             }
             catch (err) {
                 // Nothing has moved: fail the call here, audited. An ON must not switch a scope on
@@ -2773,92 +2953,92 @@ export class CloudflareScopeHost {
                 await this.recordAdmin(actor, action, target, null, { ...base, phase: 'failed', error: errorOf(err) }).catch(() => undefined);
                 throw err;
             }
-            /**
-             * The record's undo, after the scope's move threw or held nothing: retried once, and a
-             * failure of both is answered rather than swallowed — it lands on the outcome row as
-             * `recordError`, and the call says so.
-             */
-            const undoRecord = async () => {
-                const undo = () => this.cp.restoreSystemSwitchRecord(record, prior);
+            // #2045: a newer call on this subject has recorded its position already: this one writes
+            // nothing, here or in the scope, and says so.
+            if (recordWriteSuperseded(prior, record)) {
+                await this.recordAdmin(actor, action, target, null, { ...base, phase: 'refused', superseded: true });
+                throw substratError('conflict', switchSupersededMessage(kind, scopeId, key, to));
+            }
+            let outcome;
+            try {
                 try {
-                    await undo();
-                    return null;
+                    outcome = await move(key, to, at, undefined, operationId);
                 }
-                catch {
-                    try {
-                        await undo();
-                        return null;
-                    }
-                    catch (err) {
-                        return errorOf(err);
-                    }
+                catch (first) {
+                    if (first instanceof UnattestedSwitch)
+                        throw first;
+                    // #2045 (Codex r2): one retry under this call's own fence — idempotent, and refused by
+                    // the scope if a newer call has moved it meanwhile.
+                    outcome = await move(key, to, new Date().toISOString(), undefined, operationId);
                 }
-            };
-            let outcome;
-            try {
-                outcome = await move(input.moduleId, to, at);
             }
             catch (err) {
-                if (err instanceof UnattestedSwitchOff) {
-                    // The far end switched, and cannot hold it against the tenant-level grant. Refused:
-                    // ON gives back exactly what this OFF took (nothing, when it changed nothing), and
-                    // then the record goes back too — neither the scope nor the directory says off. An ON
-                    // that fails here leaves the scope off, and the readback rule below keeps its record.
-                    const putBack = err.outcome.changed
-                        ? await move(input.moduleId, 'on', new Date().toISOString(), true).then(() => true, () => false)
-                        : true;
-                    if (putBack) {
-                        const recordError = await undoRecord();
-                        await this.recordAdmin(actor, action, target, null, {
-                            ...base,
-                            phase: 'refused',
-                            error: err.message,
-                            ...(recordError ? { recordError } : {}),
-                        }).catch(() => undefined);
-                        throw substratError('precondition_failed', `${err.message} Nothing was switched` +
-                            (recordError ? `, but its directory record could not be put back (${recordError}).` : '.'));
-                    }
-                }
-                // A throw does not say the scope did not move: the move crosses the scope's DO and then
-                // the rewind hold, and a throw from the second leaves the scope's switch moved. So the
-                // record is undone only when the scope reads back in the OTHER position — an OFF that
-                // reads not off, an ON that still reads off — and kept when it reads back as asked.
-                // Undoing an ON that landed would put the record back to `off` beside a scope that is
-                // on, and the next re-assert would switch the operator's ON back off. A read that fails
-                // too counts as off, both ways, so what is left fails toward off: an OFF keeps its
-                // record (never a scope switched off with no record — a wipe or restore would have
-                // nothing to re-assert, and #1743's refusal nothing to read), and an ON is undone back
-                // to `off`, which the next re-assert completes if the scope did move.
-                const off = await isOff(input.moduleId).catch(() => true);
-                const recordKept = off === (to === 'off');
-                const recordError = recordKept ? null : await undoRecord();
-                // Best effort: the original error is what the caller must see, and the intent row
-                // already says an attempt was made.
+                // The move threw twice, or was answered by a deployment that could not attest it. Either
+                // way it may have landed, and an older call's move may still be in flight behind it, so no
+                // readback can settle the scope and nothing is put back: the record is this call's position
+                // under the newest fence, and its write-ahead mark makes the next re-assert move the scope
+                // to it, under that fence, whichever way it lies now.
                 await this.recordAdmin(actor, action, target, null, {
                     ...base,
-                    phase: 'failed',
+                    phase: err instanceof UnattestedSwitch ? 'refused' : 'failed',
                     error: errorOf(err),
-                    ...(recordKept ? { recordKept: true } : {}),
-                    ...(recordError ? { recordError } : {}),
+                    recordKept: true,
+                    reassertOwed: true,
                 }).catch(() => undefined);
+                if (err instanceof UnattestedSwitch)
+                    throw substratError('precondition_failed', err.message);
                 throw err;
             }
+            // #2045: the scope has applied a newer call on this subject, so this move wrote nothing. The
+            // record is that newer call's too (its write overwrote this one's, mark included), so nothing
+            // is undone and no mark is this call's to clear.
+            if (outcome.superseded) {
+                await this.recordAdmin(actor, action, target, null, { ...base, phase: 'refused', superseded: true });
+                throw substratError('conflict', switchSupersededMessage(kind, scopeId, key, to));
+            }
             // A call that held nothing moved nothing, so its record write is undone: left `off`, it
-            // would switch the module off the day it is installed; left `on`, the next reconcile of
-            // a wiped scope would leave the module running.
-            const recordError = outcome.held ? null : await undoRecord();
+            // would switch the subject off the day it is installed; left `on`, the next reconcile of
+            // a wiped scope would leave it running. Retried once; a failure of both lands on the
+            // outcome row as `recordError`, and the call says so.
+            //
+            // The scope confirmed this call's move (or that there was nothing to move), so its mark goes.
+            // Held nothing, it goes WITH the undo, in one directory transaction: the row put back carries
+            // the prior call's older id, and no later re-assert confirms under a fence older than this
+            // call's mark. An undo that fails twice leaves the record AND the mark this call's, and the
+            // next re-assert confirms both under it. Held, a failed clear is not the call's: the mark only
+            // costs the next re-assert one idempotent move under this same record.
+            //
+            // An unfenced OFF that held something (a deployment built before the fence) confirmed nothing
+            // under its fence, so its mark stays for the first re-assert after the vertical is redeployed.
+            const unfenced = outcome.held && outcome.fenced !== true;
+            let recordError = null;
+            let owedError = null;
+            if (!outcome.held) {
+                const undo = () => this.cp.restoreSwitchRecord(record, prior, true);
+                recordError = await undo().then(() => null, () => undo().then(() => null, errorOf));
+            }
+            else if (!unfenced) {
+                owedError = await this.cp.clearSwitchOwed(kind, tenantId, scopeId, key, operationId).then(() => null, errorOf);
+            }
             await this.recordAdmin(actor, action, target, null, {
                 ...base,
                 phase: outcome.held ? 'applied' : 'refused',
                 changed: outcome.changed,
                 permissions: outcome.permissions,
+                ...(unfenced ? { unfenced: true, reassertOwed: true } : {}),
                 ...(recordError ? { recordError } : {}),
+                ...(owedError ? { owedError } : {}),
             });
             if (!outcome.held) {
-                throw substratError('not_found', `scope ${scopeId} holds no system grant for module '${input.moduleId}' — nothing to switch ${to} ` +
-                    `(check the module id: it is the module's manifest id, e.g. '@substrat-run/engine-absence')` +
+                throw substratError('not_found', switchNotFoundMessage(kind, scopeId, key, to) +
                     (recordError ? `; and its directory record could not be put back (${recordError})` : ''));
             }
+            return { operationId, outcome };
+        };
+        /** #1666: move one module's schedule switch on one scope — see `HostAdmin.revokeFromSystem`. */
+        const switchSystem = async (actor, raw, to) => {
+            const input = systemSwitch.parse(raw);
+            const { operationId, outcome } = await switchSubjectAt(actor, 'system', input.node, input.moduleId, input.reason, to);
             return {
                 operationId,
                 moduleId: input.moduleId,
@@ -2867,6 +3047,18 @@ export class CloudflareScopeHost {
                 permissions: outcome.permissions,
             };
         };
+        /** #1706: move one PEER's kill switch on one scope — see `HostAdmin.revokeFromPeer`. */
+        const switchPeerAt = async (actor, raw, to) => {
+            const input = peerSwitch.parse(raw);
+            const { operationId, outcome } = await switchSubjectAt(actor, 'peer', input.node, input.vertical, input.reason, to);
+            return {
+                operationId,
+                vertical: input.vertical,
+                calls: to,
+                changed: outcome.changed,
+                permissions: outcome.permissions,
+            };
+        };
         /**
          * The status read's admin-log join (#1674): the `intent` row of the `revokeFromSystem`
          * still in force for each OFF module — actor, reason, when. Paired to its `applied` row
@@ -2939,7 +3131,7 @@ export class CloudflareScopeHost {
                 delegation
                     ? delegation.status({ tenantId, scopeId })
                     : this.scopeStub(scopeId).systemGrantsStatus().then((rows) => systemScheduleEntry.array().parse(rows)),
-                this.cp.systemSwitchRecordsOf(tenantId, scopeId),
+                this.cp.switchRecordsOf('system', tenantId, scopeId),
             ]);
             const offModules = new Set(states.filter((s) => s.schedules === 'off').map((s) => s.moduleId));
             const explanations = offModules.size > 0
@@ -2958,71 +3150,137 @@ export class CloudflareScopeHost {
         };
         /**
          * #1674: put the directory's OFF positions back into one scope — see
-         * `HostAdmin.reassertSystemSwitches`. It moves the switch through `systemSwitchTarget`,
-         * so it lands wherever an operator's OFF would have — for a hosted scope, over the
-         * `/internal/system-switch` route every deployment since #1666 answers.
+         * `HostAdmin.reassertSystemSwitches`. Every kind (#2029): the recorded-off modules, then the
+         * recorded-off peers. Each moves through `switchTarget`, so it lands wherever an operator's
+         * OFF would have — for a hosted scope, over that kind's `/internal/*` switch route.
          */
         const reassertSystemSwitchesOf = async (actor, node, opts) => {
+            const results = [];
+            for (const kind of SWITCH_KINDS)
+                results.push(...(await reassertKind(actor, kind, node, opts)));
+            return results;
+        };
+        /** One kind's half of `reassertSystemSwitchesOf`. */
+        const reassertKind = async (actor, kind, node, opts) => {
             const { tenantId, scopeId } = node;
-            const { vertical, move } = await systemSwitchTarget(tenantId, scopeId);
-            const recorded = new Map(await this.cp.systemSwitchRecordsOf(tenantId, scopeId));
+            const { vertical, delegated, move, attestFence } = await switchTarget(kind, tenantId, scopeId);
+            const action = reassertActionOf(kind);
+            const target = { tenantId, scopeId, vertical };
+            const recorded = new Map(await this.cp.switchRecordsOf(kind, tenantId, scopeId));
+            // #2045: every switch call's write-ahead mark, with the newest call that wrote it.
+            const owed = new Map(await this.cp.switchesOwedOf(kind, tenantId, scopeId));
             // #1742 review: moves the deployment made from a stale list (restored ON after the list
             // was read), to undo before the OFF pass below.
-            const reverts = staleCarryReverts(recorded, opts?.appliedInUnit);
+            const reverts = staleCarryReverts(kind, recorded, opts?.appliedInUnit);
             // A hosted scope with no delegation configured (Copilot review): this host's own
             // namespace is the module-less placeholder, where the switch would answer `held: false`
             // quietly — a re-assert reported done, and a receipt written, while the deployment
-            // serving the scope keeps its schedules running. Refused loudly instead, as the status
-            // read is, and only when a re-assert is owed: nothing recorded, nothing to refuse.
-            const owed = reverts.length > 0 || [...recorded.values()].includes('off');
-            if (owed && !this.cpLess && vertical !== null && !this.systemSwitchDelegation) {
+            // serving the scope keeps its schedules running or its peer admitted. Refused loudly
+            // instead, as the status read is, and only when a re-assert is owed: nothing recorded,
+            // nothing to refuse.
+            const reassertOwed = reverts.length > 0 || owed.size > 0 || [...recorded.values()].includes('off');
+            if (reassertOwed && !this.cpLess && vertical !== null && !delegated) {
                 throw substratError('unavailable', `no delegation configured for hosted scope ${scopeId} (vertical '${vertical}') — cannot re-assert ` +
-                    `its switched-off schedules in the deployment serving it`);
+                    `its switched-off ${DOOR_WORDS[kind].switched} in the deployment serving it`);
             }
+            // #2045 (Codex r3): a subject's mark goes only once the scope has confirmed a move under the
+            // record's fence — a fenced answer that was not superseded. A throw anywhere below leaves
+            // every mark not yet confirmed for the next pass.
+            // An unfenced OFF (a deployment built before the fence) confirms nothing, so its mark stays.
+            const confirm = async (key, fence, outcome) => {
+                if (owed.has(key) && !outcome.superseded && outcome.fenced === true) {
+                    await this.cp.clearSwitchOwed(kind, tenantId, scopeId, key, fence);
+                }
+            };
+            // #2045 follow-up: on a deployment built before the fence no ON is sent (see
+            // `UnattestedSwitch`). Every OFF below still moves, and the pass refuses at its end, so a
+            // sweep records no receipt for a scope whose owed ON was not sent. Asked only when an ON is due.
+            const onWithheld = [];
+            const withholdOn = async (key) => {
+                if (await attestFence())
+                    return false;
+                onWithheld.push(key);
+                return true;
+            };
             const at = new Date().toISOString();
             const reverted = new Set();
-            for (const moduleId of reverts) {
+            for (const key of reverts) {
                 // Re-read immediately before the move: a staff OFF that completed since the read above
-                // (record `off`) must not get a transient ON a due schedule could run in.
-                const current = new Map(await this.cp.systemSwitchRecordsOf(tenantId, scopeId));
-                if (current.get(moduleId) !== 'on')
+                // (record `off`) must not get a transient ON a due schedule, or a peer call, could use.
+                // #2045: under the fence of the ON the record holds, which is the operator's own call — read
+                // with the position, so it is that ON's fence and no other call's.
+                const current = new Map(await this.cp.switchRecordStatesOf(kind, tenantId, scopeId)).get(key);
+                if (current?.position !== 'on')
                     continue;
-                const outcome = await move(moduleId, 'on', at);
-                reverted.add(moduleId);
+                const fence = current.fence;
+                if (await withholdOn(key))
+                    continue;
+                const outcome = await move(key, 'on', at, undefined, fence);
+                reverted.add(key);
                 if (outcome.changed) {
-                    await this.recordAdmin(actor, 'reassertSystemSwitch', { tenantId, scopeId, vertical }, null, {
-                        operationId: ulid(),
-                        ...staleCarryRevertRow(moduleId, outcome),
-                    });
+                    await this.recordAdmin(actor, action, target, null, { operationId: ulid(), ...staleCarryRevertRow(kind, key, outcome) });
                 }
+                await confirm(key, fence, outcome);
             }
             // Read AFTER the reverts: an OFF that landed meanwhile is switched off below.
-            const modules = await this.cp.switchedOffModulesOf(tenantId, scopeId);
+            const { keys, tenantHeld, fences } = await this.recordedOff(kind, tenantId, scopeId, at);
             // #1742: what the deployment already switched off inside its own unit, audited here —
-            // the move below answers `changed: false` for it and would write no row.
-            // A move the revert above undid is not credited as an in-unit OFF.
-            const applied = opts?.appliedInUnit?.filter((a) => !reverted.has(a.moduleId));
-            for (const row of inUnitMovesToAudit(modules, applied)) {
-                await this.recordAdmin(actor, 'reassertSystemSwitch', { tenantId, scopeId, vertical }, null, {
-                    operationId: ulid(),
-                    ...row,
-                });
+            // the move below answers `changed: false` for it and would write no row. A move the
+            // revert above undid is not credited as an in-unit OFF.
+            for (const row of inUnitMovesToAudit(kind, keys, opts?.appliedInUnit, reverted)) {
+                await this.recordAdmin(actor, action, target, null, { operationId: ulid(), ...row });
             }
+            // #2045: every move here carries the fence of the call the record holds, so a scope a newer call
+            // has moved since refuses it. A deployment from before the fence takes the OFF unfenced.
             const results = [];
-            const tenantHeld = new Set(modules.length ? await this.cp.tenantHeldSystemModules(tenantId, modules, at) : []);
-            for (const moduleId of modules) {
-                const outcome = await move(moduleId, 'off', at, tenantHeld.has(moduleId));
+            const held = new Set(tenantHeld);
+            for (const key of keys) {
+                const fence = fences.get(key); // `recordedOff` read each key with its own row's fence
+                const outcome = await move(key, 'off', at, held.has(key), fence);
                 if (outcome.changed) {
-                    await this.recordAdmin(actor, 'reassertSystemSwitch', { tenantId, scopeId, vertical }, null, {
+                    await this.recordAdmin(actor, action, target, null, {
                         operationId: ulid(),
-                        moduleId,
-                        schedules: 'off',
-                        phase: 'applied',
-                        changed: true,
-                        permissions: outcome.permissions,
+                        ...reassertOffRow(kind, key, outcome.permissions),
+                        ...(outcome.fenced === true ? {} : { unfenced: true }),
                     });
                 }
-                results.push({ moduleId, held: outcome.held, changed: outcome.changed });
+                results.push(reassertEntry(kind, key, outcome));
+                await confirm(key, fence, outcome);
+            }
+            // A subject marked owed converges to its record in either direction: OFF above, and here a
+            // record of ON — sent whatever the scope reads now, because a scope that reads ON may still
+            // be behind the record's fence, with an older call's OFF in flight that only the fence can
+            // refuse (Codex r3, finding 1). Idempotent: an ON already in place changes nothing and moves
+            // the fence. Every other record of ON keeps #1674's rule and turns nothing on.
+            const settled = new Set([...keys, ...reverted]);
+            const pending = [...owed.keys()].filter((key) => !settled.has(key));
+            if (pending.length) {
+                // Position and fence in one read: an ON is sent only under the fence of the ON it read.
+                const now = new Map(await this.cp.switchRecordStatesOf(kind, tenantId, scopeId));
+                for (const key of pending) {
+                    const row = now.get(key);
+                    if (row?.position !== 'on') {
+                        // No record (a call that held nothing, whose undo removed its row), or one that turned
+                        // OFF since the read above, which the next pass moves: nothing to send on this one. A
+                        // missing row's mark goes under its own id, so a newer call's mark stays.
+                        if (row === undefined)
+                            await this.cp.clearSwitchOwed(kind, tenantId, scopeId, key, owed.get(key));
+                        continue;
+                    }
+                    const fence = row.fence;
+                    if (await withholdOn(key))
+                        continue;
+                    const outcome = await move(key, 'on', at, undefined, fence);
+                    if (outcome.changed) {
+                        await this.recordAdmin(actor, action, target, null, { operationId: ulid(), ...reassertOnRow(kind, key, outcome.permissions) });
+                        results.push(reassertEntry(kind, key, outcome));
+                    }
+                    await confirm(key, fence, outcome);
+                }
+            }
+            if (onWithheld.length) {
+                throw substratError('precondition_failed', `${unfencedMessage(scopeId)} Its recorded OFF positions were applied; the owed ON of ` +
+                    `${onWithheld.map((k) => `'${k}'`).join(', ')} was not sent.`);
             }
             return results;
         };
@@ -3109,18 +3367,21 @@ export class CloudflareScopeHost {
             unassignRole: async (actor, assignment) => {
                 // Tombstone (K-21) — the checker skips revoked rows. A no-op returns false so
                 // a repeat unassign stays silent (no second audit row, no needless fan-out).
-                const subject = `principal:${assignment.principalId}`;
                 const relation = `role:${assignment.roleKey}`;
-                const now = new Date().toISOString();
-                const changed = assignment.node.scopeId
-                    ? await this.scopeStub(assignment.node.scopeId).revokeTuple(subject, relation, `scope:${assignment.node.scopeId}`, now)
-                    : await this.cp.revokeTenantTuple(assignment.node.tenantId, subject, relation, `tenant:${assignment.node.tenantId}`, now);
+                const { tenantId, scopeId } = assignment.node;
+                if (!scopeId) {
+                    // One ControlPlaneDO method (#1184): the revoke, the removal fence (raised even when
+                    // nothing was held) and the audit row, so no add can land between any two of them.
+                    const changed = await this.cp.revokeAndFence(tenantId, assignment.principalId, relation, `tenant:${tenantId}`, this.adminEntry(actor, 'unassignRole', { tenantId, scopeId: null }, assignment, null));
+                    // A tenant-level revoke changes the projected set — the tombstone must reach scopes.
+                    if (changed)
+                        await this.fanOut(tenantId);
+                    return;
+                }
+                const changed = await this.scopeStub(scopeId).revokeTuple(`principal:${assignment.principalId}`, relation, `scope:${scopeId}`, new Date().toISOString());
                 if (!changed)
                     return;
-                await this.recordAdmin(actor, 'unassignRole', { tenantId: assignment.node.tenantId, scopeId: assignment.node.scopeId }, assignment, null);
-                // A tenant-level revoke changes the projected set — the tombstone must reach scopes.
-                if (!assignment.node.scopeId)
-                    await this.fanOut(assignment.node.tenantId);
+                await this.recordAdmin(actor, 'unassignRole', { tenantId, scopeId }, assignment, null);
             },
             grant: async (actor, raw) => {
                 // Parsed like its `grantToConnection`/`grantToSystem` siblings, not taken on
@@ -3242,11 +3503,17 @@ export class CloudflareScopeHost {
             },
             tenantHeldSystemModules: async (actor, tenantId, moduleIds) => {
                 const held = moduleIds.length
-                    ? await this.cp.tenantHeldSystemModules(tenantId, moduleIds, new Date().toISOString())
+                    ? await this.cp.tenantHeldOf('system', tenantId, moduleIds, new Date().toISOString())
                     : [];
                 await this.recordAccess(actor, 'tenantHeldSystemModules', { tenantId }, { moduleIds: [...moduleIds] }, held.length);
                 return held;
             },
+            peerSwitchCarry: async (actor, node) => {
+                const { keys: switchedOffPeers, tenantHeld: tenantHeldPeers, fences: all, } = await this.recordedOff('peer', node.tenantId, node.scopeId, new Date().toISOString());
+                const fences = Object.fromEntries(switchedOffPeers.map((v) => [v, all.get(v)]));
+                await this.recordAccess(actor, 'peerSwitchCarry', node, null, switchedOffPeers.length);
+                return { switchedOffPeers, tenantHeldPeers, fences };
+            },
             reassertSystemSwitches: reassertSystemSwitchesOf,
             // #1672 — the platform's two capability verbs. Audited AFTER the write, on both, and
             // the failure each leaves is the safe one: a mint whose audit row did not land never
@@ -3312,7 +3579,7 @@ export class CloudflareScopeHost {
                     // another tenant's traffic. Exception: the holder is ARCHIVED or REAPED (a
                     // deleted app, storage since wiped) — it has released the name, so the rebind
                     // reclaims it.
-                    throw new Error(`hostname '${parsed.hostname}' is already bound to another scope`);
+                    throw substratError('conflict', `hostname '${parsed.hostname}' is already bound to another scope`);
                 }
                 // Exactly one canonical per (scope, surface).
                 if (parsed.canonical)
@@ -3333,7 +3600,7 @@ export class CloudflareScopeHost {
                 const hostname = raw.toLowerCase(); // DNS is case-insensitive; the map is normalized
                 const row = await this.cp.readHostname(hostname);
                 if (!row)
-                    throw new Error(`unknown hostname '${hostname}'`);
+                    throw substratError('not_found', `unknown hostname '${hostname}'`);
                 if (row.status === status)
                     return; // idempotent, unaudited
                 await this.cp.setHostnameStatus(hostname, status, note ?? null);
@@ -3343,7 +3610,7 @@ export class CloudflareScopeHost {
                 const hostname = raw.toLowerCase(); // DNS is case-insensitive; the map is normalized
                 const row = await this.cp.readHostname(hostname);
                 if (!row)
-                    throw new Error(`unknown hostname '${hostname}'`);
+                    throw substratError('not_found', `unknown hostname '${hostname}'`);
                 // A poll that finds nothing changed (same status, same records, id already set)
                 // is not an event — skip the write and the audit entry, so the reconcile sweep
                 // does not flood the admin log with no-op rows every interval.
@@ -3429,7 +3696,7 @@ export class CloudflareScopeHost {
                     if (existing.owner_tenant !== parsed.ownerTenant) {
                         throw substratError('conflict', `vertical '${parsed.slug}' is owned by ${existing.owner_tenant ?? 'the platform'}, not ${parsed.ownerTenant ?? 'the platform'}`);
                     }
-                    throw new Error(`vertical '${parsed.slug}' is already registered as ${existing.source}`);
+                    throw substratError('conflict', `vertical '${parsed.slug}' is already registered as ${existing.source}`);
                 }
                 await this.cp.insertVertical(parsed.slug, parsed.name, parsed.source, parsed.ownerTenant, envSpecJson, installSpecJson, parsed.listed ? 1 : 0, new Date().toISOString());
                 await this.recordAdmin(actor, 'registerVertical', { tenantId: null }, null, parsed);
@@ -3610,11 +3877,11 @@ export class CloudflareScopeHost {
                 // nothing to diff against — the gate is about change, not existence.
                 if (outgoing) {
                     if (outgoing.permission_digest !== incoming.permission_digest && !ack.permissionChange) {
-                        throw new Error(`promotion changes the permission surface (${outgoing.permission_digest} → ` +
+                        throw substratError('conflict', `promotion changes the permission surface (${outgoing.permission_digest} → ` +
                             `${incoming.permission_digest}) — acknowledge it explicitly to promote`);
                     }
                     if (outgoing.migration_digest !== incoming.migration_digest && !ack.migrationChange) {
-                        throw new Error(`promotion changes migrations (${outgoing.migration_digest} → ` +
+                        throw substratError('conflict', `promotion changes migrations (${outgoing.migration_digest} → ` +
                             `${incoming.migration_digest}) — acknowledge it explicitly to promote`);
                     }
                     // #1705 PR 3: an export an installed consumer imports, dropped or re-versioned.
@@ -3874,7 +4141,7 @@ export class CloudflareScopeHost {
             },
             createOrg: async (actor, input) => {
                 const parsed = createOrgInput.parse(input);
-                const created = await this.cp.createOrg(parsed.id, parsed.tenantId, parsed.slug, parsed.name, new Date().toISOString());
+                const created = await this.directory('createOrg', parsed.id, parsed.tenantId, parsed.slug, parsed.name, new Date().toISOString());
                 if (!created)
                     return; // idempotent, and a no-op is not audited
                 await this.recordAdmin(actor, 'createOrg', { tenantId: parsed.tenantId }, null, parsed);
@@ -3895,15 +4162,27 @@ export class CloudflareScopeHost {
                 await this.recordAdmin(actor, 'addMember', { tenantId }, null, { principal, orgId });
                 await this.fanOut(tenantId); // membership is a tenant-level tuple
             },
+            applyMembership: async (actor, change) => {
+                // The row is minted here, where attribution and `causedBy` live, and written by the
+                // ControlPlaneDO in the same synchronous method as the fence, the bound and the tuple
+                // (#1184): one DO unit, so nothing lands between the check and the write.
+                const { tenantId, principal, roleKey, op } = change;
+                const assignment = { principalId: principal, roleKey, node: { tenantId, scopeId: null } };
+                const result = await this.cp.applyMembership(change, op === 'add'
+                    ? this.adminEntry(actor, 'assignRole', { tenantId, scopeId: null }, null, assignment)
+                    : this.adminEntry(actor, 'unassignRole', { tenantId, scopeId: null }, assignment, null));
+                // The tenant-level tuple, or its tombstone, reaches the projections.
+                if (result.applied && (op === 'add' || result.changed))
+                    await this.fanOut(tenantId);
+                return result;
+            },
             removeMember: async (actor, tenantId, principal, orgId) => {
                 await requireOrg(tenantId, orgId);
-                // Tombstone (K-21), never DELETE. The DO reports whether anything changed
-                // so a repeat revoke stays a silent no-op rather than a second audit row.
-                const changed = await this.cp.revokeMember(tenantId, `principal:${principal}`, `org:${orgId}`, new Date().toISOString());
-                if (!changed)
-                    return;
-                await this.recordAdmin(actor, 'removeMember', { tenantId }, { principal, orgId }, null);
-                await this.fanOut(tenantId); // the tombstone must reach the projections
+                // Tombstone (K-21), never DELETE, with the removal fence in the same DO method
+                // (#1184). A repeat revoke stays a silent no-op rather than a second audit row.
+                const changed = await this.cp.revokeAndFence(tenantId, principal, 'member', `org:${orgId}`, this.adminEntry(actor, 'removeMember', { tenantId }, { principal, orgId }, null));
+                if (changed)
+                    await this.fanOut(tenantId); // the tombstone must reach the projections
             },
             listMembers: async (actor, tenantId, orgId, options) => {
                 await requireOrg(tenantId, orgId);
@@ -3917,20 +4196,20 @@ export class CloudflareScopeHost {
             },
             createTenant: async (actor, input) => {
                 const parsed = createTenantInput.parse(input);
-                const created = await this.cp.createTenant(parsed.id, parsed.slug, parsed.name, new Date().toISOString(), parsed.provisionedByTenant ?? null);
+                const created = await this.directory('createTenant', parsed.id, parsed.slug, parsed.name, new Date().toISOString(), parsed.provisionedByTenant ?? null);
                 // Idempotent: re-creating an existing tenant is a no-op, not audited.
                 if (!created)
                     return;
                 await this.recordAdmin(actor, 'createTenant', { tenantId: parsed.id }, null, created);
             },
             setTenantStatus: async (actor, tenantId, status) => {
-                const before = await this.cp.setTenantStatus(tenantId, status);
+                const before = await this.directory('setTenantStatus', tenantId, status);
                 await this.recordAdmin(actor, 'setTenantStatus', { tenantId }, { status: before }, { status });
                 // #1713: every hosted scope under the tenant holds or resumes its work by this.
                 await this.deliverLifecycles(actor, { tenantId });
             },
             setTenantName: async (actor, tenantId, name) => {
-                const before = await this.cp.setTenantName(tenantId, name);
+                const before = await this.directory('setTenantName', tenantId, name);
                 if (before === name)
                     return; // no-op is not audited — nothing changed
                 await this.recordAdmin(actor, 'setTenantName', { tenantId }, { name: before }, { name });
@@ -3940,7 +4219,7 @@ export class CloudflareScopeHost {
                 // first (archive-if-needed → reapScope in the vertical deployment); the DO clears
                 // the tenant's PII/config rows and flips the row to a `reaped` tombstone, keeping
                 // the row + admin log. Only a `deleting` tenant may be reaped (checked in the DO).
-                const before = await this.cp.reapTenant(tenantId);
+                const before = await this.directory('reapTenant', tenantId);
                 await this.recordAdmin(actor, 'reapTenant', { tenantId }, { status: before }, { status: 'reaped' });
             },
             listTenants: async (actor, page) => {
@@ -4024,7 +4303,7 @@ export class CloudflareScopeHost {
                 // Not `peerScopeGate`: a read must not migrate, and the phase makes this call once
                 // per edge per pass, where an extra round trip is a fleet-wide cost.
                 this.assertServedHere(await this.scopeRecordForRead(tenantId, scopeId), scopeId, 'readExportedEvents');
-                const batch = exportedBatch.parse(await this.scopeStub(scopeId).exportedEventsRead(input, tenantId, scopeId));
+                const batch = await this.readExportsThroughDoor(input, tenantId, scopeId);
                 await this.recordAccess(actor, 'readExportedEvents', { tenantId, scopeId }, { consumer: input.consumer, after: input.after, limit: input.limit }, batch.events.length);
                 return batch;
             },
@@ -4204,12 +4483,18 @@ export class CloudflareScopeHost {
                 await this.recordAccess(actor, 'lifecycleFlow', { tenantId, scopeId }, delegatedReadParams.lifecycleFlow(input), flow.observation.events);
                 return flow;
             },
+            operationSeries: async (actor, tenantId, scopeId, input) => {
+                await this.scopeRecordForRead(tenantId, scopeId);
+                const series = await this.scopeStub(scopeId).operationSeries(input);
+                await this.recordAccess(actor, 'operationSeries', { tenantId, scopeId }, delegatedReadParams.operationSeries(input), operationSeriesCount(series));
+                return series;
+            },
             readScopeTable: async (actor, tenantId, scopeId, input) => {
                 await this.scopeRecordForRead(tenantId, scopeId);
                 // Checked here as well as in the ScopeDO, so the refusal keeps its code across the hop.
                 assertRowLimit('limit', input.limit);
                 assertRowOffset('offset', input.offset);
-                const page = await this.scopeStub(scopeId).introspectTable(input.table, input.limit, input.offset);
+                const page = unwrapReply(await this.scopeStub(scopeId).introspectTableReply(input.table, input.limit, input.offset));
                 await this.recordAccess(actor, 'readScopeTable', { tenantId, scopeId }, { table: input.table, limit: page.limit, offset: page.offset }, page.rows.length);
                 return page;
             },
@@ -4250,7 +4535,7 @@ export class CloudflareScopeHost {
             },
             queryScope: async (actor, tenantId, scopeId, input) => {
                 await this.scopeRecordForRead(tenantId, scopeId);
-                const result = await this.scopeStub(scopeId).introspectQuery(input.sql);
+                const result = unwrapReply(await this.scopeStub(scopeId).introspectQueryReply(input.sql));
                 // The statement is the logged argument: the access log is the evidence trail,
                 // and for a console read the SQL is the whole story.
                 await this.recordAccess(actor, 'queryScope', { tenantId, scopeId }, { sql: input.sql }, result.rows.length);
@@ -4343,7 +4628,7 @@ export class CloudflareScopeHost {
                 if (!rec)
                     throw substratError('not_found', `unknown scope ${scopeId} in tenant ${tenantId}`);
                 if (rec.status !== 'archived') {
-                    throw new Error(`scope ${scopeId} is ${rec.status}, not archived — only an archived scope may be reaped`);
+                    throw substratError('conflict', `scope ${scopeId} is ${rec.status}, not archived — only an archived scope may be reaped`);
                 }
                 // A serving scope always holds ≥1 bound hostname; a truly-dead one has been
                 // unbound. The dashboard delete path unbinds AT archive, but a bare console
@@ -4355,7 +4640,7 @@ export class CloudflareScopeHost {
                 // being released anyway; the interactive per-scope reap never sets it.
                 const bound = opts?.force ? [] : await this.cp.listHostnames({ scopeId, limit: 1 });
                 if (bound.length > 0) {
-                    throw new Error(`scope ${scopeId} still resolves hostname '${bound[0].hostname}' — ` +
+                    throw substratError('conflict', `scope ${scopeId} still resolves hostname '${bound[0].hostname}' — ` +
                         `unbind it before reaping (reap wipes storage and cannot be undone)`);
                 }
                 await this.scopeStub(scopeId).destroyStorage();
@@ -4553,7 +4838,7 @@ export class CloudflareScopeHost {
             },
             registerIdentityPool: async (actor, input) => {
                 const parsed = identityPool.parse(input);
-                const created = await this.cp.registerIdentityPool(parsed.provider, parsed.topology, parsed.tenantId, new Date().toISOString());
+                const created = await this.directory('registerIdentityPool', parsed.provider, parsed.topology, parsed.tenantId, new Date().toISOString());
                 if (!created)
                     return; // identical registration is idempotent, unaudited
                 // Null tenant for a central pool: it belongs to no single tenant, which is
@@ -4570,9 +4855,9 @@ export class CloudflareScopeHost {
             listIdentityTenants: async (actor, provider, externalId) => {
                 const r = await this.cp.readPool(provider);
                 if (!r)
-                    throw new Error(`identity pool '${provider}' is not registered`);
+                    throw substratError('not_found', `identity pool '${provider}' is not registered`);
                 if (r.topology !== 'central') {
-                    throw new Error(`identity pool '${provider}' is tenant-bound — enumerating tenants is only ` +
+                    throw substratError('forbidden', `identity pool '${provider}' is tenant-bound — enumerating tenants is only ` +
                         `meaningful on a central pool, where the same externalId is the same person`);
                 }
                 const tenants = (await this.cp.identityTenants(provider, externalId));
@@ -4589,9 +4874,9 @@ export class CloudflareScopeHost {
                     at: new Date().toISOString(),
                 });
                 if (topology === null)
-                    throw new Error(`identity pool '${provider}' is not registered`);
+                    throw substratError('not_found', `identity pool '${provider}' is not registered`);
                 if (topology !== 'central') {
-                    throw new Error(`identity pool '${provider}' is tenant-bound — enumerating tenants is only ` +
+                    throw substratError('forbidden', `identity pool '${provider}' is tenant-bound — enumerating tenants is only ` +
                         `meaningful on a central pool, where the same externalId is the same person`);
                 }
                 return memberships.map((m) => identityMembership.parse(m));
@@ -4744,14 +5029,14 @@ export class CloudflareScopeHost {
                 const parsed = identityLink.parse(input);
                 const pool = await this.cp.readPool(parsed.provider);
                 if (!pool) {
-                    throw new Error(`identity pool '${parsed.provider}' is not registered — a pool must declare ` +
+                    throw substratError('conflict', `identity pool '${parsed.provider}' is not registered — a pool must declare ` +
                         `its topology before it may link (central vs tenant-bound decides whether ` +
                         `the same externalId in two tenants is one person or two)`);
                 }
                 if (pool.topology === 'tenant-bound' && pool.tenant_id !== parsed.tenantId) {
-                    throw new Error(`identity pool '${parsed.provider}' is bound to tenant ${pool.tenant_id} and cannot link into ${parsed.tenantId}`);
+                    throw substratError('conflict', `identity pool '${parsed.provider}' is bound to tenant ${pool.tenant_id} and cannot link into ${parsed.tenantId}`);
                 }
-                const changed = await this.cp.linkIdentity(parsed.provider, parsed.externalId, parsed.principal, parsed.tenantId, parsed.scopeId ?? null, new Date().toISOString());
+                const changed = await this.directory('linkIdentity', parsed.provider, parsed.externalId, parsed.principal, parsed.tenantId, parsed.scopeId ?? null, new Date().toISOString());
                 // Idempotent: an identity already bound is a no-op, not audited.
                 if (!changed)
                     return;
@@ -5013,6 +5298,10 @@ export class CloudflareScopeHost {
         };
     }
     // -- helpers --------------------------------------------------------------
+    /** A directory write whose refusal must keep its code across the DO hop (#113). */
+    async directory(method, ...args) {
+        return unwrapReply(await this.cp.reply(method, args));
+    }
     /**
      * The getScope gate (control-plane.md §4.1/§4.2) — the pair check, then the tenant's and
      * the scope's lifecycle — thrown on THIS side of the RPC (#1718). The ControlPlaneDO
@@ -5032,8 +5321,11 @@ export class CloudflareScopeHost {
      */
     async validateScopeAccess(tenantId, scopeId) {
         const refusal = await this.cp.scopeAccessRefusal(tenantId, scopeId);
-        if (refusal)
-            throw refusal.code ? substratError(refusal.code, refusal.message) : new Error(refusal.message);
+        if (refusal) {
+            throw refusal.code
+                ? substratError(refusal.code, refusal.message, refusal.reason ? { reason: refusal.reason } : undefined)
+                : new Error(refusal.message);
+        }
         if (!this.cpLess)
             return null;
         const { verdict, lifecycle } = await this.scopeStub(scopeId).admission(tenantId);
@@ -5065,7 +5357,7 @@ export class CloudflareScopeHost {
     async assertLive(tenantId, scopeId) {
         const refusal = lifecycleRefusal(await this.validateScopeAccess(tenantId, scopeId), { tenantId, scopeId });
         if (refusal)
-            throw new Error(refusal);
+            throw substratError('conflict', refusal, { reason: SCOPE_GATE_REASONS.notActive });
     }
     /**
      * Deliver the directory's lifecycle to the deployments serving the matching scopes (#1713):
@@ -5262,7 +5554,7 @@ export class CloudflareScopeHost {
         if (!row)
             throw unknownScopeForTenant(tenantId, scopeId);
         if (row.status === 'reaped') {
-            throw new Error(`scope ${scopeId} is reaped — its storage is gone and cannot be read`);
+            throw substratError('conflict', `scope ${scopeId} is reaped — its storage is gone and cannot be read`);
         }
         return row;
     }
@@ -5295,7 +5587,14 @@ export class CloudflareScopeHost {
         });
     }
     async recordAdmin(actor, action, target, before, after) {
-        await this.cp.recordAdmin({
+        await this.cp.recordAdmin(this.adminEntry(actor, action, target, before, after));
+    }
+    /**
+     * One admin-log row, minted here where attribution and `causedBy` live — for `recordAdmin`,
+     * and for a ControlPlaneDO method that writes its row in the same unit as its effect (#1184).
+     */
+    adminEntry(actor, action, target, before, after) {
+        return {
             id: ulid(),
             actor,
             action,
@@ -5307,7 +5606,7 @@ export class CloudflareScopeHost {
             before: before ?? null,
             after: after ?? null,
             at: new Date().toISOString(),
-        });
+        };
     }
     /**
      * The scope's own answer to "what may this connection do here" (#726 gap 1).
@@ -5432,6 +5731,11 @@ export class CloudflareScopeHost {
     // rewind CLAIMS them on `SWITCH_HOLDS_NAME`, which the rewind cannot reach. A module is held
     // while any claim on it exists, and `runDueSchedules` skips a held module.
     //
+    // #2029: the same for a PEER switched off (`vertical:<slug>`): the rewind claims the scope's
+    // off peers beside its off modules, each under its hold key (`holdKeyOf`), and the peer door
+    // refuses a held peer as the system door refuses a held module. Everything below holds for
+    // both kinds; "module" reads as "subject".
+    //
     // A claim is released only by a switch move KNOWN to survive its rewind (`switchInScope`): a
     // move on the restored storage, after the rewind armed. A move during the settle, or one the
     // doomed instance applied, lands in storage the restart discards, so it releases nothing. A
@@ -5450,7 +5754,7 @@ export class CloudflareScopeHost {
      * reopens only the gap this closes, for a rewind that lands during the outage, and the next
      * reconcile still switches that module off. The error is answered, for the pass to report.
      */
-    async switchHeld(scopeId, moduleId) {
+    async switchHeld(scopeId, holdKey) {
         const at = Date.now();
         let error;
         if (!this.holdSnapshot || at - this.holdSnapshot.at > SWITCH_HOLD_SNAPSHOT_MS) {
@@ -5473,8 +5777,11 @@ export class CloudflareScopeHost {
                 }
             }
         }
-        const held = this.holdSnapshot?.held.has(`${scopeId} ${moduleId}`) ?? false;
-        return { held, ...(error ? { error } : {}) };
+        const snapshot = this.holdSnapshot;
+        const held = snapshot?.held.has(`${scopeId} ${holdKey}`) ?? false;
+        // #2029: a good read naming no row for this scope at all, for `doorGate`'s instance cache.
+        const scopeClear = !error && snapshot?.good === true && !snapshot.scopes.has(scopeId);
+        return { held, ...(error ? { error } : {}), ...(scopeClear ? { scopeClear: true } : {}) };
     }
     /** One read of the whole hold into the snapshot, stamped with when it went out. Never throws. */
     async refreshHolds(at) {
@@ -5482,7 +5789,12 @@ export class CloudflareScopeHost {
             const rows = await this.switchHoldsStub().switchHoldsAll();
             // A slow read that lands after a newer one never replaces it.
             if (!this.holdSnapshot || at >= this.holdSnapshot.at) {
-                this.holdSnapshot = { at, held: new Set(rows.map((r) => `${r.scopeId} ${r.moduleId}`)) };
+                this.holdSnapshot = {
+                    at,
+                    held: new Set(rows.map((r) => `${r.scopeId} ${r.moduleId}`)),
+                    scopes: new Set(rows.map((r) => r.scopeId)),
+                    good: true,
+                };
             }
             return {};
         }
@@ -5493,8 +5805,10 @@ export class CloudflareScopeHost {
             // than hammered per scope. For that long, other scopes reuse this possibly pre-hold set
             // silently, and only the consult that sent this read reports the error: the declared
             // fail-open, attributed once.
-            if (!this.holdSnapshot || at >= this.holdSnapshot.at)
-                this.holdSnapshot = { at, held: known ?? new Set() };
+            if (!this.holdSnapshot || at >= this.holdSnapshot.at) {
+                const scopes = new Set([...(known ?? [])].map((k) => k.slice(0, k.indexOf(' '))));
+                this.holdSnapshot = { at, held: known ?? new Set(), scopes, good: false };
+            }
             return {
                 error: known
                     ? `switch hold unreadable (${why}); the ${known.size} hold(s) from this pass's last good read ` +
@@ -5541,7 +5855,11 @@ export class CloudflareScopeHost {
      * its claims before the OFF's join lands. The joined row then holds the module the operator just
      * turned ON, until the next surviving move of that switch releases it (another ON does).
      */
-    async switchInScope(scopeId, moduleId, to, at, tenantHeld = false) {
+    async switchInScope(kind, scopeId, key, to, at, tenantHeld = false, 
+    /** #2045: the switch call's fence; see `SWITCH_FENCES_DDL`. */
+    fence) {
+        // #2029: a peer's claims live beside the modules', under its own hold key.
+        const holdKey = holdKeyOf(kind, key);
         let scopeClaims;
         let readError;
         try {
@@ -5550,23 +5868,30 @@ export class CloudflareScopeHost {
         catch (err) {
             readError = err;
         }
-        const { instance, ...outcome } = await this.scopeStub(scopeId).switchSystemSchedules(moduleId, scopeId, to, at, tenantHeld);
+        const stub = this.scopeStub(scopeId);
+        const { instance, ...outcome } = await (kind === 'system'
+            ? stub.switchSystemSchedules(key, scopeId, to, at, tenantHeld, fence)
+            : stub.switchPeer(key, scopeId, to, at, tenantHeld, fence));
         if (!scopeClaims)
             throw readError;
+        // #2045: a move the fence refused wrote nothing, so it is known to survive nothing and to
+        // release nothing; the newer call that superseded it did whatever the hold needed.
+        if (outcome.superseded)
+            return outcome;
         const now = Date.now();
         const pendingLive = (c) => c.state === 'pending' && now - Date.parse(c.heldAt) <= SWITCH_HOLD_PENDING_MAX_MS;
-        const before = scopeClaims.filter((c) => c.moduleId === moduleId);
+        const before = scopeClaims.filter((c) => c.moduleId === holdKey);
         if (to === 'on') {
             // Every ON, claims or not: its tombstone is what keeps a rewind's stale read from claiming
             // the module after this (#1839).
             this.holdSnapshot = null;
-            await this.switchHoldsStub().switchHoldOn(scopeId, moduleId, before.map((c) => c.claimId));
+            await this.switchHoldsStub().switchHoldOn(scopeId, holdKey, before.map((c) => c.claimId));
         }
         else if (outcome.held && before.length > 0) {
             const survived = before.filter((c) => !pendingLive(c) && c.doomed !== instance);
             if (survived.length > 0) {
                 this.holdSnapshot = null;
-                await this.switchHoldsStub().switchHoldRelease(scopeId, moduleId, survived.map((c) => c.claimId));
+                await this.switchHoldsStub().switchHoldRelease(scopeId, holdKey, survived.map((c) => c.claimId));
             }
         }
         if (to === 'off' && outcome.changed) {
@@ -5577,7 +5902,7 @@ export class CloudflareScopeHost {
             const joins = new Set([...scopeClaims, ...after].filter((c) => pendingLive(c) || c.doomed === instance).map((c) => c.claimId));
             if (joins.size > 0) {
                 this.holdSnapshot = null;
-                await this.switchHoldsStub().switchHoldJoin(scopeId, moduleId, [...joins]);
+                await this.switchHoldsStub().switchHoldJoin(scopeId, holdKey, [...joins]);
             }
         }
         return outcome;
@@ -5641,11 +5966,16 @@ export class CloudflareScopeHost {
         await holds.switchHoldArm(scopeId, claimId, result.instance ?? null).catch(() => undefined);
         return { rewindingTo: result.rewindingTo };
     }
-    /** The modules this scope's own storage has switched off, as a rewind reads them before it arms. */
+    /**
+     * The subjects this scope's own storage has switched off, as a rewind reads them before it arms:
+     * its modules, and (#2029) its peers, each by its hold key (`holdKeyOf`).
+     */
     async offInStorage(scopeId) {
-        return (await this.systemGrantsStatusLocal(scopeId))
-            .filter((e) => e.schedules === 'off')
-            .map((e) => e.moduleId);
+        const [modules, peers] = await Promise.all([this.systemGrantsStatusLocal(scopeId), this.peerGrantsStatusLocal(scopeId)]);
+        return [
+            ...modules.filter((e) => e.schedules === 'off').map((e) => holdKeyOf('system', e.moduleId)),
+            ...peers.filter((e) => e.calls === 'off').map((e) => holdKeyOf('peer', e.vertical)),
+        ];
     }
     /**
      * #1839: wait until every row of this rewind's claim is `SWITCH_HOLD_SETTLE_MS` old. The settle
@@ -5714,7 +6044,11 @@ export class CloudflareScopeHost {
      * arrive as a different class of answer just because the caller asked for a socket.
      */
     liveReads = {
-        subscribe: async ({ tenantId, scopeId, principal, request }) => {
+        subscribe: async ({ tenantId, scopeId, principal, request, within }) => {
+            // Decided before anything else, and thrown: a `within` that is neither a plain
+            // EntityRef nor a value `vouchedWithin` built is a caller bug, and the two ways of
+            // guessing at it both open a feed wider than was asked for (#1853).
+            const narrowed = liveWithinOf(within);
             if (!isUpgradeRequest(request)) {
                 return new Response('live reads are a WebSocket surface', {
                     status: 426,
@@ -5772,6 +6106,10 @@ export class CloudflareScopeHost {
             headers.set(LIVE_PRINCIPAL_HEADER, principal);
             headers.set(LIVE_TENANT_HEADER, tenantId);
             headers.set(LIVE_SCOPE_HEADER, scopeId);
+            if (narrowed)
+                headers.set(LIVE_WITHIN_HEADER, encodeLiveWithin(narrowed));
+            else
+                headers.delete(LIVE_WITHIN_HEADER);
             const forwarded = new Request(new URL(LIVE_SUBSCRIBE_PATH, 'https://scope.substrat.internal'), 
             // `new Request(url, { …, headers })` rather than `new Request(request, …)`:
             // the DO is addressed by its own path, not the client's, and the upgrade
@@ -5853,7 +6191,7 @@ export class CloudflareScopeHost {
             throw unknownScopeForTenant(tenantId, scopeId);
         const { roles, tuples, entitlements, identities } = await this.tenantProjection(tenantId);
         const connectionKeys = await this.connectionKeyRows(tenantId, scope.vertical);
-        await this.scopeStub(scopeId).applyProjection(tenantId, roles, tuples, entitlements, undefined, identities, connectionKeys);
+        unwrapReply(await this.scopeStub(scopeId).applyProjectionReply(tenantId, roles, tuples, entitlements, undefined, identities, connectionKeys));
     }
     /**
      * Fan the tenant's current state out into ALL its scopes — called after any
@@ -5902,7 +6240,7 @@ export class CloudflareScopeHost {
             if (!keysByVertical.has(vertical)) {
                 keysByVertical.set(vertical, this.connectionKeyRows(tenantId, s.vertical));
             }
-            await this.scopeStub(s.scope_id).applyProjection(tenantId, roles, tuples, entitlements, undefined, identities, await keysByVertical.get(vertical));
+            unwrapReply(await this.scopeStub(s.scope_id).applyProjectionReply(tenantId, roles, tuples, entitlements, undefined, identities, await keysByVertical.get(vertical)));
         }));
         const failed = settled.flatMap((r, i) => (r.status === 'rejected' ? [{ scope: scopes[i].scope_id, reason: r.reason }] : []));
         if (failed.length === 0)
@@ -5932,10 +6270,11 @@ export class CloudflareScopeHost {
      * from its own storage. No tenant-level tuples, no control plane.
      */
     async provisionScopeLocal(input) {
+        const carry = recordedOffFromWire(input);
         const services = await this.servicePrincipals?.(input.tenantId, input.scopeId);
         const stub = this.scopeStub(input.scopeId);
         await this.migrateAndRecord(input.scopeId); // create the module tables (setMigrationState no-ops on a null CP)
-        const switchedOff = await stub.applyProjection(input.tenantId, input.roles.map((r) => ({ role_key: r.key, permissions: JSON.stringify(r.permissions), source: r.source })), [], // no tenant-level tuples — a CP-less vertical grants at scope level only
+        const switchedOff = unwrapReply(await stub.applyProjectionReply(input.tenantId, input.roles.map((r) => ({ role_key: r.key, permissions: JSON.stringify(r.permissions), source: r.source })), [], // no tenant-level tuples — a CP-less vertical grants at scope level only
         // Only PROJECT (and thereby switch on strict enforcement) when the platform actually
         // supplies entitlements. Omitting them leaves the scope un-projected and trusting-
         // upstream, so a vertical whose provision path predates #304 is never denied — it
@@ -6025,12 +6364,10 @@ export class CloudflareScopeHost {
                 public_key: k.publicKey,
             }))
             : undefined, 
-        // #1742: the recorded-off modules, switched off after the seat in the same unit, on the
-        // scope this call provisions — the one the seat's tuples name.
-        input.switchedOff
-            ? { scopeId: input.scopeId, moduleIds: input.switchedOff, at: new Date().toISOString(), tenantHeld: input.tenantHeld }
-            : undefined, services?.map((id) => `principal:${id}`));
-        return input.switchedOff ? { switchedOff } : {};
+        // #1742: the recorded-off modules and (#2029) peers, switched off after the seat in the
+        // same unit, on the scope this call provisions — the one the seat's tuples name.
+        carry ? { scopeId: input.scopeId, at: new Date().toISOString(), ...carry } : undefined, services?.map((id) => `principal:${id}`)));
+        return carry ? { switchedOff } : {};
     }
     /**
      * Resolve an external identity from a scope's PROJECTED links (#406) — the CP-less
@@ -6169,6 +6506,8 @@ export class CloudflareScopeHost {
     async connectorGrantLocal(connectionId, scopeId, permission, expiresAt) {
         await this.writeScopeTuple(scopeId, subjectRef({ kind: 'connection', id: connectionId }), `granted:${permission}`, `scope:${scopeId}`, expiresAt ?? null);
     }
+    /** #2045 (Codex r3): every switch mover here honours the fence — what `/internal/switch-fence` reports. */
+    switchFenced = true;
     /**
      * The far end of the schedule kill switch for a scope served HERE (#1666):
      * `/internal/system-switch` lands on this, from the shared control plane's
@@ -6181,7 +6520,7 @@ export class CloudflareScopeHost {
         // Parsed on the way out: this is the wire answer the platform reads, and the DO's
         // plain strings become the published shape here rather than on trust.
         // #1819: `switchInScope` releases a rewind's hold on the module once the switch lands.
-        return systemSwitchOutcome.parse(await this.switchInScope(scopeId, moduleId, to, new Date().toISOString(), opts?.tenantHeld ?? false));
+        return systemSwitchOutcome.parse(await this.switchInScope('system', scopeId, moduleId, to, new Date().toISOString(), opts?.tenantHeld ?? false, opts?.fence));
     }
     /**
      * The far end of the status read for a scope served HERE (#1674): `/internal/system-grants`
@@ -6216,9 +6555,12 @@ export class CloudflareScopeHost {
      * Move one peer's kill switch on a scope served HERE (#1706) — the far end of
      * `revokeFromPeer` / `restoreToPeer` for a hosted scope. Nothing is audited here; the
      * platform writes the admin rows around this call, as for the schedule switch.
+     * #2029: through `switchInScope`, so the move releases a rewind's hold on the peer once it
+     * lands, as a module's does. #2030: `tenantHeld`, the platform's word that the peer holds a
+     * live tenant-level grant, which this deployment has no directory to read.
      */
-    async peerSwitchLocal(scopeId, vertical, to) {
-        return peerSwitchOutcome.parse(await this.scopeStub(scopeId).switchPeer(verticalSlug.parse(vertical), scopeId, to, new Date().toISOString()));
+    async peerSwitchLocal(scopeId, vertical, to, opts) {
+        return peerSwitchOutcome.parse(await this.switchInScope('peer', scopeId, verticalSlug.parse(vertical), to, new Date().toISOString(), opts?.tenantHeld ?? false, opts?.fence));
     }
     // -- the cross-vertical far ends (#1705 PR 2) --------------------------------
     // The shared control plane runs the cross-vertical phase for every hosted edge and reaches the
@@ -6232,7 +6574,25 @@ export class CloudflareScopeHost {
     async exportedEventsLocal(tenantId, scopeId, raw) {
         const input = exportReadInput.parse(raw);
         await this.assertServesLocally(tenantId, scopeId, 'readExportedEvents');
-        return exportedBatch.parse(await this.scopeStub(scopeId).exportedEventsRead(input, tenantId, scopeId));
+        return this.readExportsThroughDoor(input, tenantId, scopeId);
+    }
+    /**
+     * #2029: a producer's export read, through the CONSUMER's peer door: the consumer's grants on
+     * this scope decide what leaves it, so a consumer the rewind hold keeps off must hold nothing
+     * here, exactly as a switched-off one does. Gated and pinned like every door call; held, the
+     * producer answers every key missing, so the edge pauses rather than reading past the hold.
+     */
+    async readExportsThroughDoor(input, tenantId, scopeId) {
+        const stub = this.scopeStub(scopeId);
+        const door = await this.openDoor('peer', input.consumer, scopeId);
+        try {
+            return exportedBatch.parse(await door.through((instance) => stub.exportedEventsRead(input, tenantId, scopeId, { instance })));
+        }
+        catch (err) {
+            if (!this.isHeldRefusal(err))
+                throw err;
+            return exportedBatch.parse(await stub.exportedEventsRead(input, tenantId, scopeId, { held: true }));
+        }
     }
     /**
      * The consumer's imports and watermarks (#1705), for a scope served HERE. The served-here