@substrat-run/adapter-cloudflare 0.137.0 → 0.138.0

package/dist/scope-do.js

@@ -2,12 +2,13 @@ import { REWIND_REFUSED } from './rewind-refusal.js';
 import { SYSTEM_DOOR_MOVED } from './system-door.js';
 import { DurableObject } from 'cloudflare:workers';
 import { ATTACHMENT_ADDED, ATTACHMENT_REMOVED, attachmentRecord, domainEvent, domainEventInput, eventId, instant, objectRef, entityObjectRef, assertModuleEmittableType, assertKernelAuthoredType, toWireFailure, grantRefFromProof, principalId, scopeId as scopeIdOf, tenantId as tenantIdOf, platformRequestInput, platformRequestId, MAX_PENDING_PLATFORM_REQUESTS, MAX_PENDING_SWEEP_RUNS, SWEEP_RUNS_KIND, SCOPE_TABLE_PAGE_MAX, SCOPE_QUERY_ROW_MAX, listLimitOf, requestFingerprint, substratError, errorCodeOf, assertReplayableDump, REDRAIN_BATCH, } from '@substrat-run/contracts';
-import { ulid, DO_SQL_LIMITS, unknownRoleError, createUlid, assertAllowed, ConnectionSealingKeyUnavailableError, noSealingKeyMessage, sealTo, assertReadOnlyQuery, entitlementDenial, platformRequestHistoryQuery, platformRequestOf, PLATFORM_REQUEST_COLUMNS, PLATFORM_REQUEST_REDACTION_SQL, platformRequestRedactionParams, platformRequestRedactionQuery, intentPayloadCarriesSubject, redactSubjectJobRuns, redactSubjectScopeText, assertRowLimit, assertRowOffset, JOB_RUN_PATCH_SQL, JOB_STEP_RECORD_SQL, DELIVERY_ERROR_REDACTION_SQL, REDACTED_DELIVERY_NOTE, seatScopeTuple, effectiveRoleGrantQuery, switchRecordedOff, switchSystemSchedules, peerGrantsStatus, systemGrantsStatus, systemScheduleState, systemSwitchedOff, denialListQuery, refusalListQuery, mapRefusalRow, denialSummaryQuery, denialTotalsQuery, DENIAL_WINDOW_QUERY, mapDenialRow, mapDenialSummaryBuckets, PermissionDenied, assertImpersonationWrites, assertModuleEnqueueableKind, impersonationStampOf, createAtomic, NotSearchable, isSearchIndexTable, searchIndexDdl, searchIndexPlans, NotListable, listIndexPlans, moduleMigrations, listQuery, cursorOf, searchLimit, searchMatchExpression, searchQuery, ATTACHMENT_TEXT_DDL, attachmentRecordOfRow, enqueueAttachmentText, reconcileAttachmentText, recordAttachmentText, searchAttachments, IDEMPOTENCY_DDL, REFUSALS_TABLE_DDL, REFUSALS_INDEX, refusalInsert, refusalOf, markGuardRefusal, REFUSALS_REBUILD, refusalsAdmitGuards, assertIdempotencyKey, assertPermissionKey, idempotencyLookupQuery, idempotencyPruneStatement, idempotencyRecordStatement, idempotencyOptedOutMessage, replayFor, entityVersionQuery, entityVersionOf, assertIfMatch, OUTBOX_ENTITY_INDEX, SCHEDULE_STATE_DDL, SCHEDULE_STATE_REBUILD, scheduleStateHasKind, VERTICAL_EVENTS_DDL, EXPORT_HOPS_SQL, IMPORT_CURSORS_SQL, IMPORT_CURSOR_OF_SQL, OUTBOX_MARK_SQL, exportedSinceQuery, emittedSinceQuery, emittedReportOf, EMITTED_REPORT_CAP, IMPORT_CURSOR_ADVANCE_SQL, IMPORT_RECORD_SQL, moveImportCursor, CrossVerticalRegistry, exportReadPlan, exportReadQuery, planExportBatch, withheldNote, JOB_RUN_DDL, JOB_RUN_DUE_AT, jobRunListLimit, SYSTEM_DOOR_WAIT, } from '@substrat-run/kernel';
-import { isUpgradeRequest, readSubscription, LIVE_FANOUT_LIMIT, LIVE_MODE_HEADER, LIVE_PRINCIPAL_HEADER, LIVE_SCOPE_HEADER, LIVE_SUBSCRIBE_PATH, LIVE_TENANT_HEADER, } from './live-reads.js';
+import { ulid, DO_SQL_LIMITS, unknownRoleError, createUlid, assertAllowed, ConnectionSealingKeyUnavailableError, noSealingKeyMessage, sealTo, assertReadOnlyQuery, entitlementDenial, platformRequestHistoryQuery, platformRequestOf, PLATFORM_REQUEST_COLUMNS, PLATFORM_REQUEST_REDACTION_SQL, platformRequestRedactionParams, platformRequestRedactionQuery, intentPayloadCarriesSubject, redactSubjectJobRuns, redactSubjectScopeText, assertRowLimit, assertRowOffset, JOB_RUN_PATCH_SQL, JOB_RUN_CLAIM_SQL, JOB_RUN_RENEW_SQL, JOB_RUN_BEGIN_SQL, JOB_RUN_MISS_SQL, JOB_RUN_MISS_SETTLE_SQL, admissionMissOutcome, JOB_LEASE_EXPIRED_NOTE, JOB_STEP_RECORD_SQL, DELIVERY_ERROR_REDACTION_SQL, REDACTED_DELIVERY_NOTE, seatScopeTuple, effectiveRoleGrantQuery, switchRecordedOff, switchSystemSchedules, peerGrantsStatus, systemGrantsStatus, systemScheduleState, systemSwitchedOff, denialListQuery, refusalListQuery, mapRefusalRow, denialSummaryQuery, denialTotalsQuery, DENIAL_WINDOW_QUERY, mapDenialRow, mapDenialSummaryBuckets, PermissionDenied, assertImpersonationWrites, assertModuleEnqueueableKind, impersonationStampOf, createAtomic, NotSearchable, isSearchIndexTable, searchIndexDdl, searchIndexPlans, NotListable, listIndexPlans, moduleMigrations, listQuery, cursorOf, searchLimit, searchMatchExpression, searchQuery, ATTACHMENT_TEXT_DDL, attachmentRecordOfRow, enqueueAttachmentText, reconcileAttachmentText, recordAttachmentText, searchAttachments, IDEMPOTENCY_DDL, REFUSALS_TABLE_DDL, REFUSALS_INDEX, refusalInsert, refusalOf, markGuardRefusal, REFUSALS_REBUILD, refusalsAdmitGuards, assertIdempotencyKey, assertPermissionKey, idempotencyLookupQuery, idempotencyPruneStatement, idempotencyRecordStatement, idempotencyOptedOutMessage, replayFor, entityVersionQuery, entityVersionOf, assertIfMatch, OUTBOX_ENTITY_INDEX, SCHEDULE_STATE_DDL, SCHEDULE_STATE_REBUILD, scheduleStateHasKind, VERTICAL_EVENTS_DDL, EXPORT_HOPS_SQL, emptyImportResult, IMPORT_CURSORS_SQL, IMPORT_CURSOR_OF_SQL, OUTBOX_MARK_SQL, exportedSinceQuery, emittedSinceQuery, emittedReportOf, EMITTED_REPORT_CAP, IMPORT_CURSOR_ADVANCE_SQL, IMPORT_RECORD_SQL, moveImportCursor, CrossVerticalRegistry, exportReadPlan, exportReadQuery, planExportBatch, withheldNote, JOB_RUN_DDL, JOB_RUN_DUE_AT, jobRunListLimit, SYSTEM_DOOR_WAIT, ancestorsWithin, } from '@substrat-run/kernel';
+import { isUpgradeRequest, readSubscription, LIVE_FANOUT_LIMIT, LIVE_MODE_HEADER, LIVE_PRINCIPAL_HEADER, LIVE_SCOPE_HEADER, LIVE_SUBSCRIBE_PATH, LIVE_TENANT_HEADER, LIVE_WITHIN_HEADER, decodeLiveWithin, } from './live-reads.js';
+import { replyOf } from './do-reply.js';
 import { OperationQueue } from './serialization.js';
 import { doScopedSql, doBuiltColumnsOf, doRedactionSql, doSpineSql } from './sql.js';
-import { actorOf, admitPeer, collectPeers, switchPeer, assertNoSecret, CAPABILITY_DDL, COPY_ORIGIN_DDL, CAPABILITY_EXCHANGE_OPERATION, capabilityAttachmentWriteRefused, createCapabilityVerbs, createEntityEdgeVerbs, exchangeCapability, guardSecrets, mintBecomeCapability, redactSecrets, redactSecretText, moduleLog, asyncInvocationId, asyncLinePass, resolveCapabilitySession, revokeCapabilityAsPlatform, readCapabilityPage, domainEventOf, facetEvents, readDeadLetters, readLifecycleFlow, readHistory, readInvocation, readUndrainedOutbox, walkEventCause, walkEventEffects, } from '@substrat-run/kernel';
-import { createDoTupleChecker, createLocalControlPlaneReader } from './checker.js';
+import { actorOf, admitPeer, collectPeers, switchPeer, peerSubjectRef, subjectGrantState, assertNoSecret, CAPABILITY_DDL, COPY_ORIGIN_DDL, SWITCH_FENCES_DDL, CAPABILITY_EXCHANGE_OPERATION, capabilityAttachmentWriteRefused, createCapabilityVerbs, createEntityEdgeVerbs, exchangeCapability, guardSecrets, mintBecomeCapability, redactSecrets, redactSecretText, moduleLog, asyncInvocationId, asyncLinePass, resolveCapabilitySession, revokeCapabilityAsPlatform, readCapabilityPage, domainEventOf, facetEvents, readDeadLetters, readLifecycleFlow, readOperationSeries, readHistory, readInvocation, readUndrainedOutbox, walkEventCause, walkEventEffects, } from '@substrat-run/kernel';
+import { createDoTupleChecker, createLocalControlPlaneReader, scopeTupleReader } from './checker.js';
 import { CARRIED_AWAY_KEY, COPY_MARK_CLEARED_KEY, KEPT_COPY_REFUSAL, KEPT_DIVERGENT_KEY, LOAD_STAMP_KEY, STORE_LOCAL_META_KEYS, WRITE_REVISION_KEY, carriedAwayDump, isCopyMarkInsert, isWriteStatement, assertNoSpineReference, assertSpineTablesBuilt, capabilitiesForLoad, clearCopyMarker, dumpRowsInsert, isSpineTable, markCopyOrigin, repointScopeGrants, settleCopiedWork, emittedHere, IS_COPY_SQL, isCopyLoad, isLifecycleWrite, readLifecycle, settleLifecycleAfterLoad, writeLifecycle, spineColumnAdditions } from '@substrat-run/kernel';
 /**
  * The key marking a scope DO whose storage was destroyed (`destroyStorage`).
@@ -190,6 +191,7 @@ const KERNEL_DDL = `
     taken_at TEXT NOT NULL,
     pending TEXT NOT NULL
   );
+  ${SWITCH_FENCES_DDL}
   CREATE TABLE IF NOT EXISTS _substrat_tuples (
     subject TEXT NOT NULL,
     relation TEXT NOT NULL,
@@ -1067,7 +1069,16 @@ export function defineScopeDO(modules, bareOps) {
          * On the queue, so no operation is mid-transaction while the outbox is read. An event
          * must not reach another vertical before the transaction that wrote it has committed.
          */
-        async exportedEventsRead(input, tenantId, scopeId) {
+        async exportedEventsRead(input, tenantId, scopeId, 
+        /**
+         * #2029: the consumer is a peer, so the read is gated by its door. `instance` pins it to the
+         * gate's read, as every door call is; `held` says the rewind hold keeps the consumer off, and
+         * then it holds nothing here: every key is missing, the answer a switched-off consumer gets.
+         */
+        door) {
+            const held = door !== undefined && 'held' in door;
+            if (!held && this.peerDoorMoved(input.consumer, door?.instance))
+                return SYSTEM_DOOR_MOVED;
             await this.ensureMigrations();
             const plan = exportReadPlan(this.crossVertical.exports(), input.wants);
             const quiet = {
@@ -1080,9 +1091,11 @@ export function defineScopeDO(modules, bareOps) {
             };
             if (plan.types.length === 0)
                 return quiet;
-            const missing = (await this.peerCovers(tenantId, scopeId, input.consumer, plan.keys))
-                .filter((c) => !c.held)
-                .map((c) => c.permission);
+            const missing = held
+                ? plan.keys
+                : (await this.peerCoverage(tenantId, scopeId, input.consumer, plan.keys))
+                    .filter((c) => !c.held)
+                    .map((c) => c.permission);
             if (missing.length > 0)
                 return { ...quiet, paused: { missing } };
             return await this.queue.enqueue(() => {
@@ -1221,20 +1234,16 @@ export function defineScopeDO(modules, bareOps) {
          * The coordinator parses the batch before it gets here and runs the executors after.
          * Executors live on the coordinator here, as they do after an invoke.
          */
-        async importApply(batch, tenantId, scopeId) {
-            await this.ensureMigrations();
+        async importApply(batch, tenantId, scopeId, 
+        /** #2029: the instance the peer door's gate read for the producer; on another, nothing applies. */
+        doorInstance) {
             const source = batch.source;
+            if (this.peerDoorMoved(source.vertical, doorInstance))
+                return SYSTEM_DOOR_MOVED;
+            await this.ensureMigrations();
             return await this.queue.enqueue(async () => {
                 const liveSince = this.liveHighWaterMark();
-                const result = {
-                    delivered: 0,
-                    deadLettered: 0,
-                    duplicates: 0,
-                    withheld: 0,
-                    cursor: batch.after,
-                    stale: false,
-                    paused: null,
-                };
+                const result = emptyImportResult(batch);
                 // #1706's door, for a delivery (`operation: null`), inside the queued body: the producer
                 // is a declared peer with its switch on, or nothing runs and the edge pauses.
                 let peerSubject;
@@ -1460,6 +1469,10 @@ export function defineScopeDO(modules, bareOps) {
         lifecycleFlow(input) {
             return readLifecycleFlow({ sql: doScopedSql(this.sql) }, input);
         }
+        /** #1750: business volumes per bucket, counted over this scope's outbox. */
+        operationSeries(input) {
+            return readOperationSeries({ sql: doScopedSql(this.sql) }, input);
+        }
         migrationBookmarks(limit = 20) {
             return this.sql
                 .exec(`SELECT bookmark, taken_at, pending FROM _substrat_migration_bookmarks
@@ -1845,6 +1858,8 @@ export function defineScopeDO(modules, bareOps) {
                     // operation off its allowlist are refused `forbidden`; none is a K-35 denial.
                     let peerSubject;
                     if (verticalCaller !== undefined) {
+                        // #2029: pinned to the instance the peer door's gate read against the rewind hold.
+                        this.assertPeerDoor(verticalCaller.vertical, systemDoorInstance);
                         peerSubject = admitPeer(this.switchSql(), this.peers, verticalCaller, operation);
                         idempotencySubjectRef = peerSubject;
                     }
@@ -2119,6 +2134,14 @@ export function defineScopeDO(modules, bareOps) {
                     status: 500,
                 });
             }
+            // A narrowing the coordinator sent but this end cannot read is refused, never
+            // dropped: dropping it would open the whole scope's feed — to a vouched
+            // subscriber, one the principal's check was never going to filter (#1853).
+            const withinHeader = request.headers.get(LIVE_WITHIN_HEADER);
+            const within = withinHeader === null ? undefined : decodeLiveWithin(withinHeader);
+            if (withinHeader !== null && !within) {
+                return new Response('live reads: unreadable within narrowing', { status: 500 });
+            }
             // A subscriber arriving before the scope's migrations have run would be told
             // about events against a schema it cannot read back through. Same gate every
             // other entry point takes, for the same reason.
@@ -2143,6 +2166,7 @@ export function defineScopeDO(modules, bareOps) {
                 tenantId: tenantIdOf.parse(tenantId),
                 scopeId: scopeIdOf.parse(scopeId),
                 since: new Date().toISOString(),
+                ...(within ? { within } : {}),
             });
             return new Response(null, { status: 101, webSocket: client });
         }
@@ -2266,6 +2290,11 @@ export function defineScopeDO(modules, bareOps) {
          * to nobody. Knowing that a row exists and changed at 14:02 is information about
          * that row, so the empty payload is not what makes this safe; this is.
          *
+         * *Narrowed, when the subscription asked to be* (#1853). A socket opened `within` an
+         * entity hears only rows that reach it through live parent edges — each row's
+         * ancestors are walked once per pass, however many sockets ask. A vouched root
+         * replaces the check above, and its frames are `LiveNudge`s.
+         *
          * *Never able to fail the operation.* The write has committed and the caller has
          * its answer. A socket that has gone away mid-fan-out, or a check that cannot be
          * evaluated, costs a subscriber its live update — which it survives, because the
@@ -2285,6 +2314,25 @@ export function defineScopeDO(modules, bareOps) {
             const announceable = rows.filter((r) => this.liveTargets.has(r.entity_type));
             if (announceable.length === 0)
                 return;
+            /**
+             * Is a row's entity beneath a `within` root (#1853)? Each row's ancestors are walked
+             * once per pass, on first need, so a check per socket is a set lookup — every widget
+             * visitor's root is a different session, and a walk per (row, socket) would read the
+             * same parent edges once per visitor. Post-commit state: a `ctx.relink` in the same
+             * operation has already moved the edge the walk follows.
+             */
+            const parents = scopeTupleReader(this.sql);
+            const now = new Date().toISOString();
+            const ancestors = new Map();
+            const reaches = async (row, root) => {
+                let up = ancestors.get(row.id);
+                if (!up) {
+                    // A walk that cannot answer is a frame not sent — the same fail-closed rule as the check.
+                    up = ancestorsWithin(parents, { entityType: row.entity_type, entityId: row.entity_id }, now).catch(() => new Set());
+                    ancestors.set(row.id, up);
+                }
+                return (await up).has(`${root.entityType}:${root.entityId}`);
+            };
             for (const ws of sockets) {
                 let subscription = null;
                 try {
@@ -2303,8 +2351,10 @@ export function defineScopeDO(modules, bareOps) {
                 // assumption about how the subscription was created.
                 if (subscription.tenantId !== tenantId || subscription.scopeId !== scopeId)
                     continue;
+                const { within } = subscription;
                 // One context per subscriber, not per event: `ctx.check` is the expensive part
-                // and the context is only the subject it is evaluated for.
+                // and the context is only the subject it is evaluated for. Built on first use, so
+                // a vouched subscriber — whose frames the walk alone decides — never builds one.
                 //
                 // A frame this subscriber does not pass is NOT recorded as a denial (K-35),
                 // and that is deliberate: `recordDenial` is called on a refused REQUEST, where
@@ -2315,35 +2365,50 @@ export function defineScopeDO(modules, bareOps) {
                 //
                 // The operation name is carried anyway, for the events a fan-out cannot emit
                 // but a future reader of this context might.
-                const ctx = this.operationContext(subscription.principal, tenantId, scopeId, undefined, undefined, undefined, undefined, undefined, 'live.subscribe');
+                let ctx;
+                const { principal } = subscription;
+                const context = () => (ctx ??= this.operationContext(principal, tenantId, scopeId, undefined, undefined, undefined, undefined, undefined, 'live.subscribe'));
                 for (const row of announceable) {
-                    // Non-null: `announceable` is exactly the rows whose type is in the map.
-                    const permission = this.liveTargets.get(row.entity_type);
-                    let allowed = false;
-                    try {
-                        const decision = await ctx.check(permission, {
+                    // Narrowing first: it is memoised across sockets, and a row outside the root
+                    // is out whatever the principal holds.
+                    if (within && !(await reaches(row, within)))
+                        continue;
+                    let frame;
+                    if (within?.vouched !== undefined) {
+                        // The vertical vouched for the root, so the walk above was the whole filter
+                        // — and the subscriber holds no read on this row, so it is told only that
+                        // something beneath its root changed. Never which row, never how.
+                        frame = { kind: 'nudge', id: row.id, at: row.occurred_at };
+                    }
+                    else {
+                        // Non-null: `announceable` is exactly the rows whose type is in the map.
+                        const permission = this.liveTargets.get(row.entity_type);
+                        let allowed = false;
+                        try {
+                            const decision = await context().check(permission, {
+                                entityType: row.entity_type,
+                                entityId: row.entity_id,
+                            });
+                            allowed = decision.allowed;
+                        }
+                        catch {
+                            // A check that cannot answer is a check that refuses. The alternative —
+                            // treating an evaluator failure as an allow — turns an outage in the
+                            // permission path into a disclosure, which is the one failure mode this
+                            // surface must not have.
+                            allowed = false;
+                        }
+                        if (!allowed)
+                            continue;
+                        frame = {
+                            kind: 'change',
+                            id: row.id,
+                            type: row.type,
                             entityType: row.entity_type,
                             entityId: row.entity_id,
-                        });
-                        allowed = decision.allowed;
-                    }
-                    catch {
-                        // A check that cannot answer is a check that refuses. The alternative —
-                        // treating an evaluator failure as an allow — turns an outage in the
-                        // permission path into a disclosure, which is the one failure mode this
-                        // surface must not have.
-                        allowed = false;
+                            at: row.occurred_at,
+                        };
                     }
-                    if (!allowed)
-                        continue;
-                    const frame = {
-                        kind: 'change',
-                        id: row.id,
-                        type: row.type,
-                        entityType: row.entity_type,
-                        entityId: row.entity_id,
-                        at: row.occurred_at,
-                    };
                     try {
                         ws.send(JSON.stringify(frame));
                     }
@@ -2565,13 +2630,10 @@ export function defineScopeDO(modules, bareOps) {
          */
         async attachmentSearch(term, limit, principal, tenantId, scopeId, connectionId) {
             await this.ensureMigrations();
-            try {
+            return replyOf(() => {
                 const ctx = this.operationContext(principal, tenantId, scopeId, undefined, connectionId, undefined, undefined, undefined, 'attachments.search');
-                return { value: await this.searchAttachmentsAs(ctx, term, limit) };
-            }
-            catch (err) {
-                return { failure: toWireFailure(err) };
-            }
+                return this.searchAttachmentsAs(ctx, term, limit);
+            });
         }
         /**
          * #1575: the extraction job's read of one record. No gate, deliberately — extraction
@@ -2714,19 +2776,48 @@ export function defineScopeDO(modules, bareOps) {
         assertSystemDoor(moduleId, expected) {
             if (moduleId === undefined)
                 return undefined;
+            this.assertDoorPin(`module '${moduleId}'`, 'system door', expected);
+            return { moduleId, [SYSTEM_DOOR_PASSED]: true };
+        }
+        /** #2029: the peer door's pin, for a call acting as `vertical:<slug>` — `assertDoorPin`. */
+        assertPeerDoor(vertical, expected) {
+            this.assertDoorPin(`vertical '${vertical}'`, 'peer door', expected);
+        }
+        /**
+         * #2029: the peer door's pin for an RPC that answers a missed pin as `SystemDoorMoved` rather
+         * than through `invoke`'s envelope: true when it missed. A call with no pin still throws.
+         */
+        peerDoorMoved(vertical, expected) {
+            try {
+                this.assertPeerDoor(vertical, expected);
+                return false;
+            }
+            catch (err) {
+                if (err instanceof SystemDoorMovedError)
+                    return true;
+                throw err;
+            }
+        }
+        /**
+         * #1834's pin, for any door (#2029: the peer door's too). A call acting as a switched subject
+         * must carry the instance the host's door gate read, and is refused on any other instance —
+         * the moved one as the module-private `SystemDoorMovedError`, so the door re-gates.
+         */
+        assertDoorPin(what, door, expected) {
             // Strict, and deliberately so: no pin means no door gated this call, so it is refused rather
             // than run unchecked. The one innocent caller is a worker a deploy behind, still running host
             // code from before the pin, during a rolling deploy. Its refusal is transient: the host and this
             // object ship in the same bundle, so the window lasts as long as the rollout. Nothing ran, and
             // the reason says "not now" (`SYSTEM_DOOR_WAIT`) to whoever reads it: a schedule fires on the
-            // next pass, and a job run retries on its next drive.
+            // next pass, a job run retries on its next drive, and a peer caller retries.
             if (expected === undefined) {
-                throw substratError('forbidden', `a call acting as module '${moduleId}' reached this scope without passing the system door`, { reason: SYSTEM_DOOR_WAIT });
+                throw substratError('forbidden', `a call acting as ${what} reached this scope without passing the ${door}`, {
+                    reason: SYSTEM_DOOR_WAIT,
+                });
             }
             if (expected !== this.instanceId) {
-                throw new SystemDoorMovedError("the scope restarted after the system door's gate read it; gate it again");
+                throw new SystemDoorMovedError(`the scope restarted after the ${door}'s gate read it; gate it again`);
             }
-            return { moduleId, [SYSTEM_DOOR_PASSED]: true };
         }
         /**
          * The pre-#1666 read, kept for ONE reason: a coordinator a deploy behind this DO still
@@ -2757,8 +2848,10 @@ export function defineScopeDO(modules, bareOps) {
          * `switchSystemSchedules`, serialized on the queue with every other tuple write and run
          * as one `transactionSync`, so its reads and writes are one unit.
          */
-        async switchSystemSchedules(moduleId, scopeId, to, at, tenantHeld = false) {
-            const outcome = await this.queue.enqueue(() => this.revision.transactionSync(() => switchSystemSchedules(this.switchSql(), { moduleId, scopeId, to, at, tenantHeld })));
+        async switchSystemSchedules(moduleId, scopeId, to, at, tenantHeld = false, 
+        /** #2045: the switch call's fence — the scope refuses a move older than the one it applied. */
+        fence) {
+            const outcome = await this.queue.enqueue(() => this.revision.transactionSync(() => switchSystemSchedules(this.switchSql(), { moduleId, scopeId, to, at, tenantHeld, fence })));
             // #1819: the instance that applied it, which the rewind hold's release rule reads.
             return { ...outcome, instance: this.instanceId };
         }
@@ -2779,8 +2872,25 @@ export function defineScopeDO(modules, bareOps) {
          * Move one PEER's kill switch on this scope (#1706) — the kernel's `switchPeer`, which is
          * the schedule switch's statement with a `vertical:` subject. Queued, one transaction.
          */
-        async switchPeer(vertical, scopeId, to, at) {
-            return this.queue.enqueue(() => this.revision.transactionSync(() => switchPeer(this.switchSql(), { vertical, scopeId, to, at })));
+        async switchPeer(vertical, scopeId, to, at, 
+        /** #2030: the directory holds a live tenant-level `vertical:` grant for the peer. */
+        tenantHeld = false, 
+        /** #2045: the switch call's fence — the scope refuses a move older than the one it applied. */
+        fence) {
+            const outcome = await this.queue.enqueue(() => this.revision.transactionSync(() => switchPeer(this.switchSql(), { vertical, scopeId, to, at, tenantHeld, fence })));
+            // #2029: the instance that applied it, which the rewind hold's release rule reads.
+            return { ...outcome, instance: this.instanceId };
+        }
+        /**
+         * #2029: the peer door's state read — where one peer stands here (`subjectGrantState` over its
+         * subject, the predicate `admitPeer` refuses on), and the instance that answered it. The door
+         * consults the rewind hold after this read and pins every call it then makes to this instance.
+         */
+        async peerDoorState(vertical) {
+            return {
+                state: subjectGrantState(this.switchSql(), peerSubjectRef(vertical), new Date().toISOString()),
+                instance: this.instanceId,
+            };
         }
         /**
          * Does peer `vertical` hold each key at this scope's node now (#1706) — the checker's own
@@ -2788,7 +2898,15 @@ export function defineScopeDO(modules, bareOps) {
          * is the target scope only to satisfy the type: `covers` records nothing, and the tuple ref
          * it walks is the slug alone.
          */
-        async peerCovers(tenantId, scopeId, vertical, permissions) {
+        async peerCovers(tenantId, scopeId, vertical, permissions, 
+        /** #2029: the instance the peer door's gate read; on another, nothing is read. */
+        doorInstance) {
+            if (this.peerDoorMoved(vertical, doorInstance))
+                return SYSTEM_DOOR_MOVED;
+            return this.peerCoverage(tenantId, scopeId, vertical, permissions);
+        }
+        /** `peerCovers`' read, for this object's own callers, which gated the peer themselves. */
+        async peerCoverage(tenantId, scopeId, vertical, permissions) {
             await this.ensureMigrations();
             return this.queue.enqueue(async () => {
                 const coverage = await this.checker.covers({ kind: 'vertical', id: vertical, scope: scopeId }, permissions, { tenantId, scopeId });
@@ -2801,9 +2919,11 @@ export function defineScopeDO(modules, bareOps) {
          * so no invoke's open transaction is read half-done. `null` when the tenant defines no such
          * role: a typed error thrown here would reach the host flattened, so the host types it.
          */
-        async canAssignFor(tenantId, scopeId, principal, roleKey) {
+        async canAssignFor(tenantId, scopeId, principal, roleKey, 
+        /** #1184: bound at the TENANT node instead — a membership executor assigning tenant-wide. */
+        atTenant = false) {
             await this.ensureMigrations();
-            return this.queue.enqueue(() => this.assignmentBound({ kind: 'principal', id: principal }, tenantId, scopeId, roleKey));
+            return this.queue.enqueue(() => this.assignmentBound({ kind: 'principal', id: principal }, tenantId, atTenant ? null : scopeId, roleKey));
         }
         /** Check and grant in one serialized scope task; a refusal never writes a tuple. */
         async assignScopeRoleBoundedFor(tenantId, scopeId, caller, assignee, roleKey) {
@@ -2844,7 +2964,9 @@ export function defineScopeDO(modules, bareOps) {
         // the host can tell storage the rewind will discard from storage it restored. On ONE object
         // per deployment, the one named `SWITCH_HOLDS_NAME` and never a scope's own: the claims
         // themselves, because a rewind replaces the rewound scope's whole storage. The claims table
-        // is created on first use, so no scope ever carries it.
+        // is created on first use, so no scope ever carries it. #2029: `module_id` holds a hold KEY —
+        // a module id, bare as #1819 stored it, or a peer's `vertical:<slug>`, which no module id can
+        // spell (a module id has no `:`).
         /** This instance, and nothing before or after it: a restart is a new id. */
         instanceId = crypto.randomUUID();
         /** Whether this instance armed a rewind: then its writes are discarded at the restart. */
@@ -3204,9 +3326,16 @@ export function defineScopeDO(modules, bareOps) {
             });
             return row;
         }
-        /** One run by id, whatever its status. */
-        async jobRunById(id) {
-            return (this.sql.exec('SELECT * FROM _substrat_job_runs WHERE id = ?', id).toArray()[0] ?? null);
+        /**
+         * #2034 (#2042 review r1): the FENCE for a coordinator from before leases. Its only caller is
+         * that coordinator's drive, which re-reads a run here and then runs the pass WITHOUT claiming
+         * it, so a row handed back could run beside a claimed pass. It answers "no such run" to it,
+         * always: the old drive skips, and only a coordinator that claims ever drives. Nothing else
+         * reads a run through this method (the operator read is `jobRunList`). The coordinator ships in
+         * the same script as this class, so an old one exists only for a deploy's overlap.
+         */
+        async jobRunById(_id) {
+            return null;
         }
         /** Insert a fresh run. The coordinator has already refused a non-queue-safe payload. */
         async jobRunInsert(row) {
@@ -3216,30 +3345,19 @@ export function defineScopeDO(modules, bareOps) {
          VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`, row.id, row.module_id, row.job, row.instance, row.payload, row.status, row.cursor, row.counters, row.attempts, row.last_error, row.started_at, row.updated_at, row.next_attempt_at, row.ended_at, row.subject_id ?? null);
         }
         /**
-         * `running` runs whose backoff has elapsed, oldest first, after `afterId`.
-         *
-         * The cursor is what lets the coordinator page past runs it cannot drive: it
-         * skips any whose job this deployment does not register, and without a cursor
-         * those rows head every batch forever (`runDueJobRuns`). `afterId` is LAST, as
-         * every argument added to an RPC on this interface must be.
+         * Was: `running` runs whose backoff has elapsed, oldest first, after `afterId` — the due read of
+         * a coordinator from before #1834, which drove every row it returned. Now always empty (below).
          */
-        async jobRunsDue(now, limit, afterId) {
-            return this.sql
-                .exec(
-            // `afterId` bound TWICE rather than as `?2`: mixing anonymous and numbered
-            // parameters makes the anonymous ones resume from the highest index used,
-            // which is a footgun for the next person to add a clause. Spelled exactly
-            // as the pure adapter spells it.
-            `SELECT * FROM _substrat_job_runs
-            WHERE status = 'running' AND (next_attempt_at IS NULL OR next_attempt_at <= ?)
-              AND (? IS NULL OR id > ?)
-            ORDER BY id LIMIT ?`, now, afterId ?? null, afterId ?? null, limit)
-                .toArray();
+        async jobRunsDue(_now, _limit, _afterId) {
+            // #2034 (#2042 review r1): fenced, as `jobRunById` is. Its only caller is a coordinator from
+            // before #1834, which runs every row this returns without claiming it.
+            return [];
         }
         /**
          * #1834: the drive's ONE snapshot of due runs — keys only, in the order they became due
-         * (`JOB_RUN_DUE_AT`, then id). Spelled exactly as the pure adapter spells it. `jobRunsDue`
-         * above stays for a coordinator a deploy behind, which still pages by id.
+         * (`JOB_RUN_DUE_AT`, then id). Spelled exactly as the pure adapter spells it. A coordinator
+         * from before #2034 reads this too, but drives nothing from it: its re-read (`jobRunById`)
+         * is fenced.
          */
         async jobRunsDueKeys(now, max) {
             return this.sql
@@ -3278,20 +3396,99 @@ export function defineScopeDO(modules, bareOps) {
          * partial update that wrote three of the four would leave a run carrying the
          * last failure's error beside the new cursor, which reads as broken forever.
          */
-        async jobRunPatch(id, patch) {
-            // A compare-and-set on `running` (#1632) — see `JOB_RUN_PATCH_SQL`.
-            this.sql.exec(JOB_RUN_PATCH_SQL, patch.status, patch.cursor, patch.counters, patch.attempts, patch.lastError, patch.updatedAt, patch.nextAttemptAt, patch.endedAt, id);
+        async jobRunPatch(id, patch, owner) {
+            // A compare-and-set on `running` (#1632) and on the pass's lease (#2034) — see
+            // `JOB_RUN_PATCH_SQL`. `owner` is LAST and optional: a coordinator from before leases
+            // sends none, and patches the unleased rows it drives.
+            return this.sql.exec(JOB_RUN_PATCH_SQL, ...this.jobPatchArgs(id, patch, owner)).rowsWritten > 0;
+        }
+        jobPatchArgs(id, patch, owner) {
+            return [
+                patch.status, patch.cursor, patch.counters, patch.attempts, patch.lastError,
+                patch.updatedAt, patch.nextAttemptAt, patch.endedAt, id, owner ?? null,
+            ];
+        }
+        /**
+         * #2034: the claim — `JOB_RUN_CLAIM_SQL`, and whether it took over a lease, read in ONE
+         * `transactionSync`: the single round trip is what makes it indivisible, as in
+         * `jobRunStartOrJoin`. Null = the run is no longer running and due.
+         */
+        async jobRunClaim(id, owner, leaseMs) {
+            return this.revision.transactionSync(() => {
+                // #2042 r2, r4: a takeover is charged only when the lease it takes had BEGUN its pass.
+                const before = this.sql.exec('SELECT lease_began_at FROM _substrat_job_runs WHERE id = ?', id).toArray()[0];
+                // #2042 r4: the due test and the expiry are THIS object's clock, never the coordinator's.
+                const now = Date.now();
+                const at = new Date(now).toISOString();
+                const claimed = this.sql
+                    .exec(JOB_RUN_CLAIM_SQL, owner, new Date(now + leaseMs).toISOString(), at, JOB_LEASE_EXPIRED_NOTE, id, at)
+                    .toArray()[0];
+                return claimed ? { run: claimed, takeover: (before?.lease_began_at ?? null) !== null } : null;
+            });
         }
-        /** One step's ledger row — a non-null `result` is what means completed. */
+        /**
+         * #2042 r3, r4: an admission miss — `JOB_RUN_MISS_SQL` (the relative count) and
+         * `JOB_RUN_MISS_SETTLE_SQL` (the backoff or failure that count calls for) in ONE transaction,
+         * by this object's clock. Null = the claim no longer held the run, or had begun.
+         */
+        async jobRunMiss(id, owner, note) {
+            return this.revision.transactionSync(() => {
+                const at = new Date(Date.now()).toISOString();
+                const counted = this.sql.exec(JOB_RUN_MISS_SQL, at, id, owner).toArray()[0];
+                if (!counted)
+                    return null;
+                const o = admissionMissOutcome(counted.admission_misses, at, note);
+                this.sql.exec(JOB_RUN_MISS_SETTLE_SQL, o.status, o.nextAttemptAt, o.endedAt, o.lastError, id, counted.admission_misses);
+                return { misses: counted.admission_misses, failed: o.status === 'failed' };
+            });
+        }
+        /**
+         * #2034 (#2042 r4): BEGIN a claimed pass — `JOB_RUN_BEGIN_SQL`, the commitment point: one
+         * compare-and-set judged by this object's clock as it runs, never by a time the coordinator
+         * computed. The coordinator invokes the handler if and only if this wrote.
+         */
+        async jobRunBegin(id, owner, marginMs) {
+            const now = Date.now();
+            return (this.sql.exec(JOB_RUN_BEGIN_SQL, new Date(now).toISOString(), id, owner, new Date(now + marginMs).toISOString())
+                .rowsWritten > 0);
+        }
+        /**
+         * #2034: a step boundary — renew the pass's lease, then read the step's ledger row, in one
+         * round trip. A pass that lost its lease reads nothing and stops.
+         */
+        async jobStepBegin(runId, step, owner, leaseMs) {
+            // #2042 r4: renewed to this object's now plus the lease.
+            const until = new Date(Date.now() + leaseMs).toISOString();
+            if (this.sql.exec(JOB_RUN_RENEW_SQL, until, runId, owner).rowsWritten === 0)
+                return { held: false, row: null };
+            return { held: true, row: this.stepRow(runId, step) };
+        }
+        /**
+         * One step's ledger row — a non-null `result` is what means completed. Not called by a
+         * coordinator since #2034 (`jobStepBegin` reads it while renewing); kept for one a deploy behind.
+         */
         async jobStepRow(runId, step) {
+            return this.stepRow(runId, step);
+        }
+        stepRow(runId, step) {
             return (this.sql
                 .exec('SELECT step, result, attempts, last_error FROM _substrat_job_steps WHERE run_id = ? AND step = ?', runId, step)
                 .toArray()[0] ?? null);
         }
         /** Record one step attempt. `result` non-null = it completed and must not re-run. */
-        async jobStepRecord(runId, step, result, attempts, lastError, at) {
-            // Only while the run is still `running` (#1632) — see `JOB_STEP_RECORD_SQL`.
-            this.sql.exec(JOB_STEP_RECORD_SQL, runId, step, result, attempts, lastError, at, runId);
+        async jobStepRecord(runId, step, result, attempts, lastError, at, owner, leaseMs) {
+            // Only while the run is still `running` (#1632) and the pass holds its lease (#2034),
+            // renewing the lease — to this object's now plus `leaseMs` (#2042 r4) — in the same
+            // transaction; see `JOB_STEP_RECORD_SQL`. A coordinator from before leases sends neither,
+            // holds no lease, and renews nothing.
+            return this.revision.transactionSync(() => {
+                const until = leaseMs === undefined ? null : new Date(Date.now() + leaseMs).toISOString();
+                if (until !== null && this.sql.exec(JOB_RUN_RENEW_SQL, until, runId, owner ?? null).rowsWritten === 0) {
+                    return false;
+                }
+                this.sql.exec(JOB_STEP_RECORD_SQL, runId, step, result, attempts, lastError, at, runId, owner ?? null);
+                return true;
+            });
         }
         /**
          * A COMMITTED pass: the run's new state and the dropping of its step ledger, in
@@ -3304,13 +3501,17 @@ export function defineScopeDO(modules, bareOps) {
          * results, not to the cursor) then skips work it never did. The kernel's
          * `runJobPass` carries the full argument.
          */
-        async jobCommitPass(id, patch) {
+        async jobCommitPass(id, patch, owner) {
             // `transactionSync` with both statements inline — NOT `await
             // this.jobRunPatch(...)` then the delete. The await is an output-gate
             // boundary, which is precisely the gap this method exists to close.
-            this.revision.transactionSync(() => {
-                this.sql.exec(JOB_RUN_PATCH_SQL, patch.status, patch.cursor, patch.counters, patch.attempts, patch.lastError, patch.updatedAt, patch.nextAttemptAt, patch.endedAt, id);
+            return this.revision.transactionSync(() => {
+                // #2034: the ledger goes only with a patch that applied — a stale holder's commit must
+                // not empty the ledger of the pass that took the run over.
+                if (this.sql.exec(JOB_RUN_PATCH_SQL, ...this.jobPatchArgs(id, patch, owner)).rowsWritten === 0)
+                    return false;
                 this.sql.exec('DELETE FROM _substrat_job_steps WHERE run_id = ?', id);
+                return true;
             });
         }
         // -- guards (K-17) --------------------------------------------------------
@@ -3763,13 +3964,26 @@ export function defineScopeDO(modules, bareOps) {
                 system: isSystemTable(name),
             }));
         }
-        /** A bounded page of one table. Unknown table names throw — never queried blind. */
+        /** A bounded page of one table. Unknown table names throw — never queried blind. Kept for a
+         *  coordinator from before #113; the current one calls `introspectTableReply`. */
         introspectTable(table, limit, offset) {
+            try {
+                return this.tablePage(table, limit, offset);
+            }
+            catch (e) {
+                throw toRpcError(e);
+            }
+        }
+        /** `introspectTable`, its refusal answered as DATA so its code survives the hop (#113). */
+        introspectTableReply(table, limit, offset) {
+            return replyOf(() => this.tablePage(table, limit, offset));
+        }
+        tablePage(table, limit, offset) {
             const known = new Set(this.sql
                 .exec(`SELECT name FROM sqlite_master WHERE type = 'table'`)
                 .toArray().map((r) => r.name));
             if (!known.has(table))
-                throw new Error(`unknown table '${table}'`);
+                throw substratError('not_found', `unknown table '${table}'`);
             // The ceiling clamps; a bound SQLite would misread (NaN, non-finite, fractional,
             // negative) is refused instead of reaching LIMIT / OFFSET (#1632).
             const l = Math.min(assertRowLimit('limit', limit), SCOPE_TABLE_PAGE_MAX);
@@ -3788,8 +4002,21 @@ export function defineScopeDO(modules, bareOps) {
          * (no sqlite3_stmt_readonly analogue), a transaction that ALWAYS rolls back — a
          * statement the gate misclassified still cannot persist a write. Rows are capped
          * at SCOPE_QUERY_ROW_MAX with `truncated` set, never an error.
+         * Kept for a coordinator from before #113; the current one calls `introspectQueryReply`.
          */
         async introspectQuery(sql) {
+            try {
+                return await this.readOnlyQuery(sql);
+            }
+            catch (e) {
+                throw toRpcError(e);
+            }
+        }
+        /** `introspectQuery`, its refusal answered as DATA so its code survives the hop (#113). */
+        introspectQueryReply(sql) {
+            return replyOf(() => this.readOnlyQuery(sql));
+        }
+        async readOnlyQuery(sql) {
             const stmt = assertReadOnlyQuery(sql);
             let result;
             const rollback = new Error('read-only console rollback');
@@ -3813,7 +4040,7 @@ export function defineScopeDO(modules, bareOps) {
             }
             catch (e) {
                 if (e !== rollback)
-                    throw toRpcError(e);
+                    throw e;
             }
             return result;
         }
@@ -3934,6 +4161,12 @@ export function defineScopeDO(modules, bareOps) {
                 'ALTER TABLE _substrat_tuples ADD COLUMN revoked_at TEXT',
                 // #1632: legacy runs retain an unknown subject; no content-based backfill.
                 'ALTER TABLE _substrat_job_runs ADD COLUMN subject_id TEXT',
+                // #2034: the lease. NULL = nobody holds the run, which is right for every row already there.
+                'ALTER TABLE _substrat_job_runs ADD COLUMN lease_owner TEXT',
+                // #2042 r2, r4: whether the holder BEGAN its pass. NULL for any lease already there: free to take over.
+                'ALTER TABLE _substrat_job_runs ADD COLUMN lease_began_at TEXT',
+                // #2042 r3: consecutive admission misses. NULL = none, right for every run already there.
+                'ALTER TABLE _substrat_job_runs ADD COLUMN admission_misses INTEGER',
                 // Executor retry state (#100). The defaults read as "terminal", which is
                 // right for every row already there: each is a completed delivery or a
                 // consumer dead-letter.
@@ -5209,6 +5442,10 @@ export function defineScopeDO(modules, bareOps) {
                 this.sql.exec(`INSERT OR REPLACE INTO _substrat_meta (key, value) VALUES ('permission_source', ?)`, source);
             });
         }
+        /** `applyProjection`, its refusal answered as DATA so its code survives the hop (#113). */
+        applyProjectionReply(...args) {
+            return replyOf(() => this.applyProjection(...args));
+        }
         /**
          * Replace this scope's projected view of a tenant's roles + tenant-level tuples
          * with a fresh snapshot, and make it authoritative (source = 'local'). A full