@substrat-run/adapter-cloudflare 0.137.0 → 0.139.0

package/dist/scope-do.js

@@ -2,12 +2,13 @@ import { REWIND_REFUSED } from './rewind-refusal.js';
 import { SYSTEM_DOOR_MOVED } from './system-door.js';
 import { DurableObject } from 'cloudflare:workers';
 import { ATTACHMENT_ADDED, ATTACHMENT_REMOVED, attachmentRecord, domainEvent, domainEventInput, eventId, instant, objectRef, entityObjectRef, assertModuleEmittableType, assertKernelAuthoredType, toWireFailure, grantRefFromProof, principalId, scopeId as scopeIdOf, tenantId as tenantIdOf, platformRequestInput, platformRequestId, MAX_PENDING_PLATFORM_REQUESTS, MAX_PENDING_SWEEP_RUNS, SWEEP_RUNS_KIND, SCOPE_TABLE_PAGE_MAX, SCOPE_QUERY_ROW_MAX, listLimitOf, requestFingerprint, substratError, errorCodeOf, assertReplayableDump, REDRAIN_BATCH, } from '@substrat-run/contracts';
-import { ulid, DO_SQL_LIMITS, unknownRoleError, createUlid, assertAllowed, ConnectionSealingKeyUnavailableError, noSealingKeyMessage, sealTo, assertReadOnlyQuery, entitlementDenial, platformRequestHistoryQuery, platformRequestOf, PLATFORM_REQUEST_COLUMNS, PLATFORM_REQUEST_REDACTION_SQL, platformRequestRedactionParams, platformRequestRedactionQuery, intentPayloadCarriesSubject, redactSubjectJobRuns, redactSubjectScopeText, assertRowLimit, assertRowOffset, JOB_RUN_PATCH_SQL, JOB_STEP_RECORD_SQL, DELIVERY_ERROR_REDACTION_SQL, REDACTED_DELIVERY_NOTE, seatScopeTuple, effectiveRoleGrantQuery, switchRecordedOff, switchSystemSchedules, peerGrantsStatus, systemGrantsStatus, systemScheduleState, systemSwitchedOff, denialListQuery, refusalListQuery, mapRefusalRow, denialSummaryQuery, denialTotalsQuery, DENIAL_WINDOW_QUERY, mapDenialRow, mapDenialSummaryBuckets, PermissionDenied, assertImpersonationWrites, assertModuleEnqueueableKind, impersonationStampOf, createAtomic, NotSearchable, isSearchIndexTable, searchIndexDdl, searchIndexPlans, NotListable, listIndexPlans, moduleMigrations, listQuery, cursorOf, searchLimit, searchMatchExpression, searchQuery, ATTACHMENT_TEXT_DDL, attachmentRecordOfRow, enqueueAttachmentText, reconcileAttachmentText, recordAttachmentText, searchAttachments, IDEMPOTENCY_DDL, REFUSALS_TABLE_DDL, REFUSALS_INDEX, refusalInsert, refusalOf, markGuardRefusal, REFUSALS_REBUILD, refusalsAdmitGuards, assertIdempotencyKey, assertPermissionKey, idempotencyLookupQuery, idempotencyPruneStatement, idempotencyRecordStatement, idempotencyOptedOutMessage, replayFor, entityVersionQuery, entityVersionOf, assertIfMatch, OUTBOX_ENTITY_INDEX, SCHEDULE_STATE_DDL, SCHEDULE_STATE_REBUILD, scheduleStateHasKind, VERTICAL_EVENTS_DDL, EXPORT_HOPS_SQL, IMPORT_CURSORS_SQL, IMPORT_CURSOR_OF_SQL, OUTBOX_MARK_SQL, exportedSinceQuery, emittedSinceQuery, emittedReportOf, EMITTED_REPORT_CAP, IMPORT_CURSOR_ADVANCE_SQL, IMPORT_RECORD_SQL, moveImportCursor, CrossVerticalRegistry, exportReadPlan, exportReadQuery, planExportBatch, withheldNote, JOB_RUN_DDL, JOB_RUN_DUE_AT, jobRunListLimit, SYSTEM_DOOR_WAIT, } from '@substrat-run/kernel';
-import { isUpgradeRequest, readSubscription, LIVE_FANOUT_LIMIT, LIVE_MODE_HEADER, LIVE_PRINCIPAL_HEADER, LIVE_SCOPE_HEADER, LIVE_SUBSCRIBE_PATH, LIVE_TENANT_HEADER, } from './live-reads.js';
+import { ulid, DO_SQL_LIMITS, unknownRoleError, createUlid, assertAllowed, ConnectionSealingKeyUnavailableError, noSealingKeyMessage, sealTo, assertReadOnlyQuery, entitlementDenial, platformRequestHistoryQuery, platformRequestOf, PLATFORM_REQUEST_COLUMNS, PLATFORM_REQUEST_REDACTION_SQL, platformRequestRedactionParams, platformRequestRedactionQuery, intentPayloadCarriesSubject, redactSubjectJobRuns, redactSubjectScopeText, assertRowLimit, assertRowOffset, JOB_RUN_PATCH_SQL, JOB_RUN_CLAIM_SQL, JOB_RUN_RENEW_SQL, JOB_RUN_BEGIN_SQL, JOB_RUN_MISS_SQL, JOB_RUN_MISS_SETTLE_SQL, admissionMissOutcome, JOB_LEASE_EXPIRED_NOTE, JOB_STEP_RECORD_SQL, DELIVERY_ERROR_REDACTION_SQL, REDACTED_DELIVERY_NOTE, seatScopeTuple, applyScopeRoleChange, changeScopeRole, revokeScopeRoles, scopeRoleHolders, effectiveRoleGrantQuery, switchRecordedOff, switchSystemSchedules, peerGrantsStatus, systemGrantsStatus, systemScheduleState, systemSwitchedOff, denialListQuery, refusalListQuery, mapRefusalRow, denialSummaryQuery, denialTotalsQuery, DENIAL_WINDOW_QUERY, mapDenialRow, mapDenialSummaryBuckets, PermissionDenied, assertImpersonationWrites, assertModuleEnqueueableKind, impersonationStampOf, createAtomic, NotSearchable, isSearchIndexTable, searchIndexDdl, searchIndexPlans, NotListable, listIndexDdl, listIndexPlans, moduleMigrations, listQuery, cursorOf, searchLimit, searchMatchExpression, searchQuery, ATTACHMENT_TEXT_DDL, attachmentRecordOfRow, enqueueAttachmentText, reconcileAttachmentText, queueAttachmentTextBackfill, startAttachmentTextBackfill, recordAttachmentText, searchAttachments, IDEMPOTENCY_DDL, REFUSALS_TABLE_DDL, REFUSALS_INDEX, refusalInsert, refusalOf, markGuardRefusal, REFUSALS_REBUILD, refusalsAdmitGuards, assertIdempotencyKey, assertPermissionKey, idempotencyLookupQuery, idempotencyPruneStatement, idempotencyRecordStatement, idempotencyOptedOutMessage, replayFor, entityVersionQuery, entityVersionOf, assertIfMatch, OUTBOX_ENTITY_INDEX, SCHEDULE_STATE_DDL, SCHEDULE_STATE_REBUILD, scheduleStateHasKind, VERTICAL_EVENTS_DDL, EXPORT_HOPS_SQL, emptyImportResult, IMPORT_CURSORS_SQL, IMPORT_CURSOR_OF_SQL, OUTBOX_MARK_SQL, exportedSinceQuery, emittedSinceQuery, emittedReportOf, EMITTED_REPORT_CAP, IMPORT_CURSOR_ADVANCE_SQL, IMPORT_RECORD_SQL, moveImportCursor, CrossVerticalRegistry, exportReadPlan, exportReadQuery, planExportBatch, withheldNote, JOB_RUN_DDL, JOB_RUN_DUE_AT, jobRunListLimit, SYSTEM_DOOR_WAIT, ancestorsWithin, } from '@substrat-run/kernel';
+import { isUpgradeRequest, readSubscription, LIVE_FANOUT_LIMIT, LIVE_MODE_HEADER, LIVE_PRINCIPAL_HEADER, LIVE_SCOPE_HEADER, LIVE_SUBSCRIBE_PATH, LIVE_TENANT_HEADER, LIVE_WITHIN_HEADER, decodeLiveWithin, } from './live-reads.js';
+import { replyOf } from './do-reply.js';
 import { OperationQueue } from './serialization.js';
 import { doScopedSql, doBuiltColumnsOf, doRedactionSql, doSpineSql } from './sql.js';
-import { actorOf, admitPeer, collectPeers, switchPeer, assertNoSecret, CAPABILITY_DDL, COPY_ORIGIN_DDL, CAPABILITY_EXCHANGE_OPERATION, capabilityAttachmentWriteRefused, createCapabilityVerbs, createEntityEdgeVerbs, exchangeCapability, guardSecrets, mintBecomeCapability, redactSecrets, redactSecretText, moduleLog, asyncInvocationId, asyncLinePass, resolveCapabilitySession, revokeCapabilityAsPlatform, readCapabilityPage, domainEventOf, facetEvents, readDeadLetters, readLifecycleFlow, readHistory, readInvocation, readUndrainedOutbox, walkEventCause, walkEventEffects, } from '@substrat-run/kernel';
-import { createDoTupleChecker, createLocalControlPlaneReader } from './checker.js';
+import { actorOf, admitPeer, collectPeers, switchPeer, peerSubjectRef, subjectGrantState, assertNoSecret, CAPABILITY_DDL, COPY_ORIGIN_DDL, ENTITY_STATE_MOVES_DDL, SWITCH_FENCES_DDL, CAPABILITY_EXCHANGE_OPERATION, capabilityAttachmentWriteRefused, createCapabilityVerbs, createEntityEdgeVerbs, createEntityStateVerbs, createTrashedReads, searchStateWhere, uncheckedView, addStatePlans, entityStateTriggerDdl, statefulTablesOf, assertEntityStateIntact, stateListIndexNames, exchangeCapability, guardSecrets, mintBecomeCapability, redactSecrets, redactSecretText, moduleLog, asyncInvocationId, asyncLinePass, resolveCapabilitySession, revokeCapabilityAsPlatform, readCapabilityPage, domainEventOf, facetEvents, readDeadLetters, readLifecycleFlow, readOperationSeries, readHistory, readInvocation, readUndrainedOutbox, walkEventCause, walkEventEffects, } from '@substrat-run/kernel';
+import { createDoTupleChecker, createLocalControlPlaneReader, scopeTupleReader } from './checker.js';
 import { CARRIED_AWAY_KEY, COPY_MARK_CLEARED_KEY, KEPT_COPY_REFUSAL, KEPT_DIVERGENT_KEY, LOAD_STAMP_KEY, STORE_LOCAL_META_KEYS, WRITE_REVISION_KEY, carriedAwayDump, isCopyMarkInsert, isWriteStatement, assertNoSpineReference, assertSpineTablesBuilt, capabilitiesForLoad, clearCopyMarker, dumpRowsInsert, isSpineTable, markCopyOrigin, repointScopeGrants, settleCopiedWork, emittedHere, IS_COPY_SQL, isCopyLoad, isLifecycleWrite, readLifecycle, settleLifecycleAfterLoad, writeLifecycle, spineColumnAdditions } from '@substrat-run/kernel';
 /**
  * The key marking a scope DO whose storage was destroyed (`destroyStorage`).
@@ -190,6 +191,7 @@ const KERNEL_DDL = `
     taken_at TEXT NOT NULL,
     pending TEXT NOT NULL
   );
+  ${SWITCH_FENCES_DDL}
   CREATE TABLE IF NOT EXISTS _substrat_tuples (
     subject TEXT NOT NULL,
     relation TEXT NOT NULL,
@@ -347,6 +349,9 @@ const KERNEL_DDL = `
   -- #1686: where a copied scope's data came from, and the event id its own events start above.
   -- Shared with the other adapter from @substrat-run/kernel; the column comments are there.
   ${COPY_ORIGIN_DDL}
+  -- #119: the kernel's authorization for one archive/trash move, read by the derived update
+  -- trigger. Shared with the other adapter from @substrat-run/kernel; the comments are there.
+  ${ENTITY_STATE_MOVES_DDL}
 `;
 /**
  * Workers RPC carries a plain `Error`'s MESSAGE faithfully and nothing else. A custom
@@ -706,6 +711,8 @@ export function defineScopeDO(modules, bareOps) {
         searchPlans = new Map();
         /** #811: the paged lists modules declare, by entity type. Same one-owner rule. */
         listPlans = new Map();
+        /** #119: entity type → its archive/trash plan, from every registered module. */
+        statePlans = new Map();
         /** entityType → the declared attachment gate (#473): read key + write key (default: read). */
         attachmentTargets = new Map();
         /**
@@ -817,8 +824,10 @@ export function defineScopeDO(modules, bareOps) {
                 }
                 this.searchPlans.set(plan.entityType, plan);
             }
+            // #119: the archive/trash plans, refusing a second owner of one entity type.
+            addStatePlans(this.statePlans, manifest.id, manifest.entityStates, manifest.permissions);
             // #811: the list indexes `lists` declares, same placement and same reason.
-            for (const plan of listIndexPlans(manifest.id, manifest.lists)) {
+            for (const plan of listIndexPlans(manifest.id, manifest.lists, manifest.entityStates)) {
                 const existing = this.listPlans.get(plan.entityType);
                 if (existing) {
                     throw new Error(`list: '${plan.entityType}' declares a paged list in both '${existing.moduleId}' and ` +
@@ -1067,7 +1076,16 @@ export function defineScopeDO(modules, bareOps) {
          * On the queue, so no operation is mid-transaction while the outbox is read. An event
          * must not reach another vertical before the transaction that wrote it has committed.
          */
-        async exportedEventsRead(input, tenantId, scopeId) {
+        async exportedEventsRead(input, tenantId, scopeId, 
+        /**
+         * #2029: the consumer is a peer, so the read is gated by its door. `instance` pins it to the
+         * gate's read, as every door call is; `held` says the rewind hold keeps the consumer off, and
+         * then it holds nothing here: every key is missing, the answer a switched-off consumer gets.
+         */
+        door) {
+            const held = door !== undefined && 'held' in door;
+            if (!held && this.peerDoorMoved(input.consumer, door?.instance))
+                return SYSTEM_DOOR_MOVED;
             await this.ensureMigrations();
             const plan = exportReadPlan(this.crossVertical.exports(), input.wants);
             const quiet = {
@@ -1080,9 +1098,11 @@ export function defineScopeDO(modules, bareOps) {
             };
             if (plan.types.length === 0)
                 return quiet;
-            const missing = (await this.peerCovers(tenantId, scopeId, input.consumer, plan.keys))
-                .filter((c) => !c.held)
-                .map((c) => c.permission);
+            const missing = held
+                ? plan.keys
+                : (await this.peerCoverage(tenantId, scopeId, input.consumer, plan.keys))
+                    .filter((c) => !c.held)
+                    .map((c) => c.permission);
             if (missing.length > 0)
                 return { ...quiet, paused: { missing } };
             return await this.queue.enqueue(() => {
@@ -1221,20 +1241,16 @@ export function defineScopeDO(modules, bareOps) {
          * The coordinator parses the batch before it gets here and runs the executors after.
          * Executors live on the coordinator here, as they do after an invoke.
          */
-        async importApply(batch, tenantId, scopeId) {
-            await this.ensureMigrations();
+        async importApply(batch, tenantId, scopeId, 
+        /** #2029: the instance the peer door's gate read for the producer; on another, nothing applies. */
+        doorInstance) {
             const source = batch.source;
+            if (this.peerDoorMoved(source.vertical, doorInstance))
+                return SYSTEM_DOOR_MOVED;
+            await this.ensureMigrations();
             return await this.queue.enqueue(async () => {
                 const liveSince = this.liveHighWaterMark();
-                const result = {
-                    delivered: 0,
-                    deadLettered: 0,
-                    duplicates: 0,
-                    withheld: 0,
-                    cursor: batch.after,
-                    stale: false,
-                    paused: null,
-                };
+                const result = emptyImportResult(batch);
                 // #1706's door, for a delivery (`operation: null`), inside the queued body: the producer
                 // is a declared peer with its switch on, or nothing runs and the edge pauses.
                 let peerSubject;
@@ -1297,13 +1313,12 @@ export function defineScopeDO(modules, bareOps) {
                         const { hops: _hops, ...fact } = e;
                         const event = structuredClone({ ...fact, source });
                         const unit = unitOf(imp.moduleId, e.id, e.type);
-                        this.causedBy = e.id;
-                        this.unitInvocationId = unit.invocationId;
                         try {
                             await this.revision.transaction(async () => {
                                 // As the producer's principal: real checks against the grants this vertical's
                                 // `peers` gave it; its emits carry `{ vertical, scope }` and what they passed.
-                                await imp.handler(this.importContext(tenantId, scopeId, peerSubject), event);
+                                // What it emits was emitted BECAUSE of the producer's event (#1237).
+                                await imp.handler(this.importContext(tenantId, scopeId, peerSubject, { causedBy: e.id, invocationId: unit.invocationId }), event);
                                 this.sql.exec(`INSERT INTO _substrat_deliveries (event_id, consumer_module, delivered_at, invocation_id)
                    VALUES (?, ?, ?, NULL)`, e.id, imp.moduleId, new Date().toISOString());
                             });
@@ -1316,10 +1331,6 @@ export function defineScopeDO(modules, bareOps) {
                             result.deadLettered += 1;
                             lines.write({ ...unit, outcome: 'dead-lettered', error: err });
                         }
-                        finally {
-                            this.causedBy = null;
-                            this.unitInvocationId = null;
-                        }
                     }
                     if (!ran)
                         result.duplicates += 1;
@@ -1336,8 +1347,12 @@ export function defineScopeDO(modules, bareOps) {
          * passes it (#1706). `principal` is a placeholder that the subject never reads, and there is
          * no operation, so the emitted rows' `operation` is NULL, as it is for any consumer.
          */
-        importContext(tenantId, scopeId, peerSubject) {
-            return this.operationContext(principalId.parse(ulid()), tenantId, scopeId, undefined, undefined, undefined, undefined, undefined, undefined, undefined, [], undefined, peerSubject);
+        /** A module consumer's context: the system override, and the delivery it runs for (#2055). */
+        consumerContext(tenantId, scopeId, moduleId, delivery) {
+            return this.operationContext(this.systemPrincipal, tenantId, scopeId, { system: moduleId }, undefined, undefined, undefined, undefined, undefined, undefined, [], undefined, undefined, delivery);
+        }
+        importContext(tenantId, scopeId, peerSubject, delivery) {
+            return this.operationContext(principalId.parse(ulid()), tenantId, scopeId, undefined, undefined, undefined, undefined, undefined, undefined, undefined, [], undefined, peerSubject, delivery);
         }
         async markEventsDrained(eventIds, at) {
             if (eventIds.length === 0)
@@ -1460,6 +1475,10 @@ export function defineScopeDO(modules, bareOps) {
         lifecycleFlow(input) {
             return readLifecycleFlow({ sql: doScopedSql(this.sql) }, input);
         }
+        /** #1750: business volumes per bucket, counted over this scope's outbox. */
+        operationSeries(input) {
+            return readOperationSeries({ sql: doScopedSql(this.sql) }, input);
+        }
         migrationBookmarks(limit = 20) {
             return this.sql
                 .exec(`SELECT bookmark, taken_at, pending FROM _substrat_migration_bookmarks
@@ -1845,6 +1864,8 @@ export function defineScopeDO(modules, bareOps) {
                     // operation off its allowlist are refused `forbidden`; none is a K-35 denial.
                     let peerSubject;
                     if (verticalCaller !== undefined) {
+                        // #2029: pinned to the instance the peer door's gate read against the rewind hold.
+                        this.assertPeerDoor(verticalCaller.vertical, systemDoorInstance);
                         peerSubject = admitPeer(this.switchSql(), this.peers, verticalCaller, operation);
                         idempotencySubjectRef = peerSubject;
                     }
@@ -2119,6 +2140,14 @@ export function defineScopeDO(modules, bareOps) {
                     status: 500,
                 });
             }
+            // A narrowing the coordinator sent but this end cannot read is refused, never
+            // dropped: dropping it would open the whole scope's feed — to a vouched
+            // subscriber, one the principal's check was never going to filter (#1853).
+            const withinHeader = request.headers.get(LIVE_WITHIN_HEADER);
+            const within = withinHeader === null ? undefined : decodeLiveWithin(withinHeader);
+            if (withinHeader !== null && !within) {
+                return new Response('live reads: unreadable within narrowing', { status: 500 });
+            }
             // A subscriber arriving before the scope's migrations have run would be told
             // about events against a schema it cannot read back through. Same gate every
             // other entry point takes, for the same reason.
@@ -2143,6 +2172,7 @@ export function defineScopeDO(modules, bareOps) {
                 tenantId: tenantIdOf.parse(tenantId),
                 scopeId: scopeIdOf.parse(scopeId),
                 since: new Date().toISOString(),
+                ...(within ? { within } : {}),
             });
             return new Response(null, { status: 101, webSocket: client });
         }
@@ -2266,6 +2296,11 @@ export function defineScopeDO(modules, bareOps) {
          * to nobody. Knowing that a row exists and changed at 14:02 is information about
          * that row, so the empty payload is not what makes this safe; this is.
          *
+         * *Narrowed, when the subscription asked to be* (#1853). A socket opened `within` an
+         * entity hears only rows that reach it through live parent edges — each row's
+         * ancestors are walked once per pass, however many sockets ask. A vouched root
+         * replaces the check above, and its frames are `LiveNudge`s.
+         *
          * *Never able to fail the operation.* The write has committed and the caller has
          * its answer. A socket that has gone away mid-fan-out, or a check that cannot be
          * evaluated, costs a subscriber its live update — which it survives, because the
@@ -2285,6 +2320,25 @@ export function defineScopeDO(modules, bareOps) {
             const announceable = rows.filter((r) => this.liveTargets.has(r.entity_type));
             if (announceable.length === 0)
                 return;
+            /**
+             * Is a row's entity beneath a `within` root (#1853)? Each row's ancestors are walked
+             * once per pass, on first need, so a check per socket is a set lookup — every widget
+             * visitor's root is a different session, and a walk per (row, socket) would read the
+             * same parent edges once per visitor. Post-commit state: a `ctx.relink` in the same
+             * operation has already moved the edge the walk follows.
+             */
+            const parents = scopeTupleReader(this.sql);
+            const now = new Date().toISOString();
+            const ancestors = new Map();
+            const reaches = async (row, root) => {
+                let up = ancestors.get(row.id);
+                if (!up) {
+                    // A walk that cannot answer is a frame not sent — the same fail-closed rule as the check.
+                    up = ancestorsWithin(parents, { entityType: row.entity_type, entityId: row.entity_id }, now).catch(() => new Set());
+                    ancestors.set(row.id, up);
+                }
+                return (await up).has(`${root.entityType}:${root.entityId}`);
+            };
             for (const ws of sockets) {
                 let subscription = null;
                 try {
@@ -2303,8 +2357,10 @@ export function defineScopeDO(modules, bareOps) {
                 // assumption about how the subscription was created.
                 if (subscription.tenantId !== tenantId || subscription.scopeId !== scopeId)
                     continue;
+                const { within } = subscription;
                 // One context per subscriber, not per event: `ctx.check` is the expensive part
-                // and the context is only the subject it is evaluated for.
+                // and the context is only the subject it is evaluated for. Built on first use, so
+                // a vouched subscriber — whose frames the walk alone decides — never builds one.
                 //
                 // A frame this subscriber does not pass is NOT recorded as a denial (K-35),
                 // and that is deliberate: `recordDenial` is called on a refused REQUEST, where
@@ -2315,35 +2371,50 @@ export function defineScopeDO(modules, bareOps) {
                 //
                 // The operation name is carried anyway, for the events a fan-out cannot emit
                 // but a future reader of this context might.
-                const ctx = this.operationContext(subscription.principal, tenantId, scopeId, undefined, undefined, undefined, undefined, undefined, 'live.subscribe');
+                let ctx;
+                const { principal } = subscription;
+                const context = () => (ctx ??= this.operationContext(principal, tenantId, scopeId, undefined, undefined, undefined, undefined, undefined, 'live.subscribe'));
                 for (const row of announceable) {
-                    // Non-null: `announceable` is exactly the rows whose type is in the map.
-                    const permission = this.liveTargets.get(row.entity_type);
-                    let allowed = false;
-                    try {
-                        const decision = await ctx.check(permission, {
+                    // Narrowing first: it is memoised across sockets, and a row outside the root
+                    // is out whatever the principal holds.
+                    if (within && !(await reaches(row, within)))
+                        continue;
+                    let frame;
+                    if (within?.vouched !== undefined) {
+                        // The vertical vouched for the root, so the walk above was the whole filter
+                        // — and the subscriber holds no read on this row, so it is told only that
+                        // something beneath its root changed. Never which row, never how.
+                        frame = { kind: 'nudge', id: row.id, at: row.occurred_at };
+                    }
+                    else {
+                        // Non-null: `announceable` is exactly the rows whose type is in the map.
+                        const permission = this.liveTargets.get(row.entity_type);
+                        let allowed = false;
+                        try {
+                            const decision = await context().check(permission, {
+                                entityType: row.entity_type,
+                                entityId: row.entity_id,
+                            });
+                            allowed = decision.allowed;
+                        }
+                        catch {
+                            // A check that cannot answer is a check that refuses. The alternative —
+                            // treating an evaluator failure as an allow — turns an outage in the
+                            // permission path into a disclosure, which is the one failure mode this
+                            // surface must not have.
+                            allowed = false;
+                        }
+                        if (!allowed)
+                            continue;
+                        frame = {
+                            kind: 'change',
+                            id: row.id,
+                            type: row.type,
                             entityType: row.entity_type,
                             entityId: row.entity_id,
-                        });
-                        allowed = decision.allowed;
+                            at: row.occurred_at,
+                        };
                     }
-                    catch {
-                        // A check that cannot answer is a check that refuses. The alternative —
-                        // treating an evaluator failure as an allow — turns an outage in the
-                        // permission path into a disclosure, which is the one failure mode this
-                        // surface must not have.
-                        allowed = false;
-                    }
-                    if (!allowed)
-                        continue;
-                    const frame = {
-                        kind: 'change',
-                        id: row.id,
-                        type: row.type,
-                        entityType: row.entity_type,
-                        entityId: row.entity_id,
-                        at: row.occurred_at,
-                    };
                     try {
                         ws.send(JSON.stringify(frame));
                     }
@@ -2565,13 +2636,10 @@ export function defineScopeDO(modules, bareOps) {
          */
         async attachmentSearch(term, limit, principal, tenantId, scopeId, connectionId) {
             await this.ensureMigrations();
-            try {
+            return replyOf(() => {
                 const ctx = this.operationContext(principal, tenantId, scopeId, undefined, connectionId, undefined, undefined, undefined, 'attachments.search');
-                return { value: await this.searchAttachmentsAs(ctx, term, limit) };
-            }
-            catch (err) {
-                return { failure: toWireFailure(err) };
-            }
+                return this.searchAttachmentsAs(ctx, term, limit);
+            });
         }
         /**
          * #1575: the extraction job's read of one record. No gate, deliberately — extraction
@@ -2591,6 +2659,20 @@ export function defineScopeDO(modules, bareOps) {
             await this.ensureMigrations();
             return this.queue.enqueue(async () => this.revision.transactionSync(() => recordAttachmentText(doSpineSql(this.sql), attachmentId, outcome, new Date().toISOString())));
         }
+        /**
+         * #1575: start the scope's one-shot backfill, unless it is marked or holds no
+         * attachments (`startAttachmentTextBackfill` reads before it writes, so a marked scope
+         * writes nothing — and moves no write revision — on every drive).
+         */
+        async attachmentTextBackfillStart() {
+            await this.ensureMigrations();
+            await this.queue.enqueue(async () => this.revision.transactionSync(() => startAttachmentTextBackfill(doSpineSql(this.sql), ulid(), new Date().toISOString())));
+        }
+        /** #1575: one backfill batch, in one transaction (`queueAttachmentTextBackfill`). */
+        async attachmentTextBackfillBatch(after) {
+            await this.ensureMigrations();
+            return this.queue.enqueue(async () => this.revision.transactionSync(() => queueAttachmentTextBackfill(doSpineSql(this.sql), after, ulid, new Date().toISOString())));
+        }
         // -- attachments through a capability (#1686) -------------------------------
         // The coordinator hashed the session token; only the hash arrives. Each verb resolves it
         // INSIDE the queue, as `invoke` does, so nothing can revoke between the resolution and
@@ -2714,19 +2796,48 @@ export function defineScopeDO(modules, bareOps) {
         assertSystemDoor(moduleId, expected) {
             if (moduleId === undefined)
                 return undefined;
+            this.assertDoorPin(`module '${moduleId}'`, 'system door', expected);
+            return { moduleId, [SYSTEM_DOOR_PASSED]: true };
+        }
+        /** #2029: the peer door's pin, for a call acting as `vertical:<slug>` — `assertDoorPin`. */
+        assertPeerDoor(vertical, expected) {
+            this.assertDoorPin(`vertical '${vertical}'`, 'peer door', expected);
+        }
+        /**
+         * #2029: the peer door's pin for an RPC that answers a missed pin as `SystemDoorMoved` rather
+         * than through `invoke`'s envelope: true when it missed. A call with no pin still throws.
+         */
+        peerDoorMoved(vertical, expected) {
+            try {
+                this.assertPeerDoor(vertical, expected);
+                return false;
+            }
+            catch (err) {
+                if (err instanceof SystemDoorMovedError)
+                    return true;
+                throw err;
+            }
+        }
+        /**
+         * #1834's pin, for any door (#2029: the peer door's too). A call acting as a switched subject
+         * must carry the instance the host's door gate read, and is refused on any other instance —
+         * the moved one as the module-private `SystemDoorMovedError`, so the door re-gates.
+         */
+        assertDoorPin(what, door, expected) {
             // Strict, and deliberately so: no pin means no door gated this call, so it is refused rather
             // than run unchecked. The one innocent caller is a worker a deploy behind, still running host
             // code from before the pin, during a rolling deploy. Its refusal is transient: the host and this
             // object ship in the same bundle, so the window lasts as long as the rollout. Nothing ran, and
             // the reason says "not now" (`SYSTEM_DOOR_WAIT`) to whoever reads it: a schedule fires on the
-            // next pass, and a job run retries on its next drive.
+            // next pass, a job run retries on its next drive, and a peer caller retries.
             if (expected === undefined) {
-                throw substratError('forbidden', `a call acting as module '${moduleId}' reached this scope without passing the system door`, { reason: SYSTEM_DOOR_WAIT });
+                throw substratError('forbidden', `a call acting as ${what} reached this scope without passing the ${door}`, {
+                    reason: SYSTEM_DOOR_WAIT,
+                });
             }
             if (expected !== this.instanceId) {
-                throw new SystemDoorMovedError("the scope restarted after the system door's gate read it; gate it again");
+                throw new SystemDoorMovedError(`the scope restarted after the ${door}'s gate read it; gate it again`);
             }
-            return { moduleId, [SYSTEM_DOOR_PASSED]: true };
         }
         /**
          * The pre-#1666 read, kept for ONE reason: a coordinator a deploy behind this DO still
@@ -2757,8 +2868,10 @@ export function defineScopeDO(modules, bareOps) {
          * `switchSystemSchedules`, serialized on the queue with every other tuple write and run
          * as one `transactionSync`, so its reads and writes are one unit.
          */
-        async switchSystemSchedules(moduleId, scopeId, to, at, tenantHeld = false) {
-            const outcome = await this.queue.enqueue(() => this.revision.transactionSync(() => switchSystemSchedules(this.switchSql(), { moduleId, scopeId, to, at, tenantHeld })));
+        async switchSystemSchedules(moduleId, scopeId, to, at, tenantHeld = false, 
+        /** #2045: the switch call's fence — the scope refuses a move older than the one it applied. */
+        fence) {
+            const outcome = await this.queue.enqueue(() => this.revision.transactionSync(() => switchSystemSchedules(this.switchSql(), { moduleId, scopeId, to, at, tenantHeld, fence })));
             // #1819: the instance that applied it, which the rewind hold's release rule reads.
             return { ...outcome, instance: this.instanceId };
         }
@@ -2779,8 +2892,25 @@ export function defineScopeDO(modules, bareOps) {
          * Move one PEER's kill switch on this scope (#1706) — the kernel's `switchPeer`, which is
          * the schedule switch's statement with a `vertical:` subject. Queued, one transaction.
          */
-        async switchPeer(vertical, scopeId, to, at) {
-            return this.queue.enqueue(() => this.revision.transactionSync(() => switchPeer(this.switchSql(), { vertical, scopeId, to, at })));
+        async switchPeer(vertical, scopeId, to, at, 
+        /** #2030: the directory holds a live tenant-level `vertical:` grant for the peer. */
+        tenantHeld = false, 
+        /** #2045: the switch call's fence — the scope refuses a move older than the one it applied. */
+        fence) {
+            const outcome = await this.queue.enqueue(() => this.revision.transactionSync(() => switchPeer(this.switchSql(), { vertical, scopeId, to, at, tenantHeld, fence })));
+            // #2029: the instance that applied it, which the rewind hold's release rule reads.
+            return { ...outcome, instance: this.instanceId };
+        }
+        /**
+         * #2029: the peer door's state read — where one peer stands here (`subjectGrantState` over its
+         * subject, the predicate `admitPeer` refuses on), and the instance that answered it. The door
+         * consults the rewind hold after this read and pins every call it then makes to this instance.
+         */
+        async peerDoorState(vertical) {
+            return {
+                state: subjectGrantState(this.switchSql(), peerSubjectRef(vertical), new Date().toISOString()),
+                instance: this.instanceId,
+            };
         }
         /**
          * Does peer `vertical` hold each key at this scope's node now (#1706) — the checker's own
@@ -2788,7 +2918,15 @@ export function defineScopeDO(modules, bareOps) {
          * is the target scope only to satisfy the type: `covers` records nothing, and the tuple ref
          * it walks is the slug alone.
          */
-        async peerCovers(tenantId, scopeId, vertical, permissions) {
+        async peerCovers(tenantId, scopeId, vertical, permissions, 
+        /** #2029: the instance the peer door's gate read; on another, nothing is read. */
+        doorInstance) {
+            if (this.peerDoorMoved(vertical, doorInstance))
+                return SYSTEM_DOOR_MOVED;
+            return this.peerCoverage(tenantId, scopeId, vertical, permissions);
+        }
+        /** `peerCovers`' read, for this object's own callers, which gated the peer themselves. */
+        async peerCoverage(tenantId, scopeId, vertical, permissions) {
             await this.ensureMigrations();
             return this.queue.enqueue(async () => {
                 const coverage = await this.checker.covers({ kind: 'vertical', id: vertical, scope: scopeId }, permissions, { tenantId, scopeId });
@@ -2801,9 +2939,11 @@ export function defineScopeDO(modules, bareOps) {
          * so no invoke's open transaction is read half-done. `null` when the tenant defines no such
          * role: a typed error thrown here would reach the host flattened, so the host types it.
          */
-        async canAssignFor(tenantId, scopeId, principal, roleKey) {
+        async canAssignFor(tenantId, scopeId, principal, roleKey, 
+        /** #1184: bound at the TENANT node instead — a membership executor assigning tenant-wide. */
+        atTenant = false) {
             await this.ensureMigrations();
-            return this.queue.enqueue(() => this.assignmentBound({ kind: 'principal', id: principal }, tenantId, scopeId, roleKey));
+            return this.queue.enqueue(() => this.assignmentBound({ kind: 'principal', id: principal }, tenantId, atTenant ? null : scopeId, roleKey));
         }
         /** Check and grant in one serialized scope task; a refusal never writes a tuple. */
         async assignScopeRoleBoundedFor(tenantId, scopeId, caller, assignee, roleKey) {
@@ -2811,12 +2951,33 @@ export function defineScopeDO(modules, bareOps) {
             return this.queue.enqueue(async () => {
                 const bound = await this.assignmentBound({ kind: 'principal', id: caller }, tenantId, scopeId, roleKey);
                 if (bound?.covered) {
-                    this.sql.exec(`INSERT OR REPLACE INTO _substrat_tuples (subject, relation, object, expires_at)
-             VALUES (?, ?, ?, NULL)`, `principal:${assignee}`, `role:${roleKey}`, `scope:${scopeId}`);
+                    applyScopeRoleChange(this.switchSql(), scopeId, assignee, { revoke: [], grant: roleKey }, new Date().toISOString());
                 }
                 return bound;
             });
         }
+        /** The scope's live scope-level role assignments, or one principal's (#1150). */
+        async scopeRoleHoldersFor(scopeId, principal) {
+            await this.ensureMigrations();
+            return this.queue.enqueue(() => scopeRoleHolders(this.switchSql(), scopeId, new Date().toISOString(), principal));
+        }
+        /**
+         * The kernel's `changeScopeRole` in one serialized scope task (#1150). Its two refusals come
+         * back as values: an error thrown here crosses the RPC flattened, so the coordinator types them.
+         */
+        async changeScopeRoleBoundedFor(tenantId, scopeId, caller, principal, from, to) {
+            await this.ensureMigrations();
+            return this.queue.enqueue(() => changeScopeRole(this.switchSql(), scopeId, principal, from, to, new Date().toISOString(), this.roleBound(caller, tenantId, scopeId), (run) => this.revision.transactionSync(run)));
+        }
+        /** The kernel's `revokeScopeRoles` in one serialized scope task (#1150). */
+        async revokeScopeRolesBoundedFor(tenantId, scopeId, caller, principal) {
+            await this.ensureMigrations();
+            return this.queue.enqueue(() => revokeScopeRoles(this.switchSql(), scopeId, principal, new Date().toISOString(), this.roleBound(caller, tenantId, scopeId), (run) => this.revision.transactionSync(run)));
+        }
+        /** The caller's bound per role at the scope; `null` for a role the tenant does not define. */
+        roleBound(caller, tenantId, scopeId) {
+            return (roleKey) => this.assignmentBound({ kind: 'principal', id: caller }, tenantId, scopeId, roleKey);
+        }
         /**
          * §5.1's assignment bound, resolved against the SAME role table the checker
          * expands — the tenant's projected role, not a vertical's compile-time `ROLES`
@@ -2844,7 +3005,9 @@ export function defineScopeDO(modules, bareOps) {
         // the host can tell storage the rewind will discard from storage it restored. On ONE object
         // per deployment, the one named `SWITCH_HOLDS_NAME` and never a scope's own: the claims
         // themselves, because a rewind replaces the rewound scope's whole storage. The claims table
-        // is created on first use, so no scope ever carries it.
+        // is created on first use, so no scope ever carries it. #2029: `module_id` holds a hold KEY —
+        // a module id, bare as #1819 stored it, or a peer's `vertical:<slug>`, which no module id can
+        // spell (a module id has no `:`).
         /** This instance, and nothing before or after it: a restart is a new id. */
         instanceId = crypto.randomUUID();
         /** Whether this instance armed a rewind: then its writes are discarded at the restart. */
@@ -3204,9 +3367,16 @@ export function defineScopeDO(modules, bareOps) {
             });
             return row;
         }
-        /** One run by id, whatever its status. */
-        async jobRunById(id) {
-            return (this.sql.exec('SELECT * FROM _substrat_job_runs WHERE id = ?', id).toArray()[0] ?? null);
+        /**
+         * #2034 (#2042 review r1): the FENCE for a coordinator from before leases. Its only caller is
+         * that coordinator's drive, which re-reads a run here and then runs the pass WITHOUT claiming
+         * it, so a row handed back could run beside a claimed pass. It answers "no such run" to it,
+         * always: the old drive skips, and only a coordinator that claims ever drives. Nothing else
+         * reads a run through this method (the operator read is `jobRunList`). The coordinator ships in
+         * the same script as this class, so an old one exists only for a deploy's overlap.
+         */
+        async jobRunById(_id) {
+            return null;
         }
         /** Insert a fresh run. The coordinator has already refused a non-queue-safe payload. */
         async jobRunInsert(row) {
@@ -3216,30 +3386,19 @@ export function defineScopeDO(modules, bareOps) {
          VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`, row.id, row.module_id, row.job, row.instance, row.payload, row.status, row.cursor, row.counters, row.attempts, row.last_error, row.started_at, row.updated_at, row.next_attempt_at, row.ended_at, row.subject_id ?? null);
         }
         /**
-         * `running` runs whose backoff has elapsed, oldest first, after `afterId`.
-         *
-         * The cursor is what lets the coordinator page past runs it cannot drive: it
-         * skips any whose job this deployment does not register, and without a cursor
-         * those rows head every batch forever (`runDueJobRuns`). `afterId` is LAST, as
-         * every argument added to an RPC on this interface must be.
+         * Was: `running` runs whose backoff has elapsed, oldest first, after `afterId` — the due read of
+         * a coordinator from before #1834, which drove every row it returned. Now always empty (below).
          */
-        async jobRunsDue(now, limit, afterId) {
-            return this.sql
-                .exec(
-            // `afterId` bound TWICE rather than as `?2`: mixing anonymous and numbered
-            // parameters makes the anonymous ones resume from the highest index used,
-            // which is a footgun for the next person to add a clause. Spelled exactly
-            // as the pure adapter spells it.
-            `SELECT * FROM _substrat_job_runs
-            WHERE status = 'running' AND (next_attempt_at IS NULL OR next_attempt_at <= ?)
-              AND (? IS NULL OR id > ?)
-            ORDER BY id LIMIT ?`, now, afterId ?? null, afterId ?? null, limit)
-                .toArray();
+        async jobRunsDue(_now, _limit, _afterId) {
+            // #2034 (#2042 review r1): fenced, as `jobRunById` is. Its only caller is a coordinator from
+            // before #1834, which runs every row this returns without claiming it.
+            return [];
         }
         /**
          * #1834: the drive's ONE snapshot of due runs — keys only, in the order they became due
-         * (`JOB_RUN_DUE_AT`, then id). Spelled exactly as the pure adapter spells it. `jobRunsDue`
-         * above stays for a coordinator a deploy behind, which still pages by id.
+         * (`JOB_RUN_DUE_AT`, then id). Spelled exactly as the pure adapter spells it. A coordinator
+         * from before #2034 reads this too, but drives nothing from it: its re-read (`jobRunById`)
+         * is fenced.
          */
         async jobRunsDueKeys(now, max) {
             return this.sql
@@ -3278,20 +3437,99 @@ export function defineScopeDO(modules, bareOps) {
          * partial update that wrote three of the four would leave a run carrying the
          * last failure's error beside the new cursor, which reads as broken forever.
          */
-        async jobRunPatch(id, patch) {
-            // A compare-and-set on `running` (#1632) — see `JOB_RUN_PATCH_SQL`.
-            this.sql.exec(JOB_RUN_PATCH_SQL, patch.status, patch.cursor, patch.counters, patch.attempts, patch.lastError, patch.updatedAt, patch.nextAttemptAt, patch.endedAt, id);
+        async jobRunPatch(id, patch, owner) {
+            // A compare-and-set on `running` (#1632) and on the pass's lease (#2034) — see
+            // `JOB_RUN_PATCH_SQL`. `owner` is LAST and optional: a coordinator from before leases
+            // sends none, and patches the unleased rows it drives.
+            return this.sql.exec(JOB_RUN_PATCH_SQL, ...this.jobPatchArgs(id, patch, owner)).rowsWritten > 0;
+        }
+        jobPatchArgs(id, patch, owner) {
+            return [
+                patch.status, patch.cursor, patch.counters, patch.attempts, patch.lastError,
+                patch.updatedAt, patch.nextAttemptAt, patch.endedAt, id, owner ?? null,
+            ];
+        }
+        /**
+         * #2034: the claim — `JOB_RUN_CLAIM_SQL`, and whether it took over a lease, read in ONE
+         * `transactionSync`: the single round trip is what makes it indivisible, as in
+         * `jobRunStartOrJoin`. Null = the run is no longer running and due.
+         */
+        async jobRunClaim(id, owner, leaseMs) {
+            return this.revision.transactionSync(() => {
+                // #2042 r2, r4: a takeover is charged only when the lease it takes had BEGUN its pass.
+                const before = this.sql.exec('SELECT lease_began_at FROM _substrat_job_runs WHERE id = ?', id).toArray()[0];
+                // #2042 r4: the due test and the expiry are THIS object's clock, never the coordinator's.
+                const now = Date.now();
+                const at = new Date(now).toISOString();
+                const claimed = this.sql
+                    .exec(JOB_RUN_CLAIM_SQL, owner, new Date(now + leaseMs).toISOString(), at, JOB_LEASE_EXPIRED_NOTE, id, at)
+                    .toArray()[0];
+                return claimed ? { run: claimed, takeover: (before?.lease_began_at ?? null) !== null } : null;
+            });
+        }
+        /**
+         * #2042 r3, r4: an admission miss — `JOB_RUN_MISS_SQL` (the relative count) and
+         * `JOB_RUN_MISS_SETTLE_SQL` (the backoff or failure that count calls for) in ONE transaction,
+         * by this object's clock. Null = the claim no longer held the run, or had begun.
+         */
+        async jobRunMiss(id, owner, note) {
+            return this.revision.transactionSync(() => {
+                const at = new Date(Date.now()).toISOString();
+                const counted = this.sql.exec(JOB_RUN_MISS_SQL, at, id, owner).toArray()[0];
+                if (!counted)
+                    return null;
+                const o = admissionMissOutcome(counted.admission_misses, at, note);
+                this.sql.exec(JOB_RUN_MISS_SETTLE_SQL, o.status, o.nextAttemptAt, o.endedAt, o.lastError, id, counted.admission_misses);
+                return { misses: counted.admission_misses, failed: o.status === 'failed' };
+            });
+        }
+        /**
+         * #2034 (#2042 r4): BEGIN a claimed pass — `JOB_RUN_BEGIN_SQL`, the commitment point: one
+         * compare-and-set judged by this object's clock as it runs, never by a time the coordinator
+         * computed. The coordinator invokes the handler if and only if this wrote.
+         */
+        async jobRunBegin(id, owner, marginMs) {
+            const now = Date.now();
+            return (this.sql.exec(JOB_RUN_BEGIN_SQL, new Date(now).toISOString(), id, owner, new Date(now + marginMs).toISOString())
+                .rowsWritten > 0);
         }
-        /** One step's ledger row — a non-null `result` is what means completed. */
+        /**
+         * #2034: a step boundary — renew the pass's lease, then read the step's ledger row, in one
+         * round trip. A pass that lost its lease reads nothing and stops.
+         */
+        async jobStepBegin(runId, step, owner, leaseMs) {
+            // #2042 r4: renewed to this object's now plus the lease.
+            const until = new Date(Date.now() + leaseMs).toISOString();
+            if (this.sql.exec(JOB_RUN_RENEW_SQL, until, runId, owner).rowsWritten === 0)
+                return { held: false, row: null };
+            return { held: true, row: this.stepRow(runId, step) };
+        }
+        /**
+         * One step's ledger row — a non-null `result` is what means completed. Not called by a
+         * coordinator since #2034 (`jobStepBegin` reads it while renewing); kept for one a deploy behind.
+         */
         async jobStepRow(runId, step) {
+            return this.stepRow(runId, step);
+        }
+        stepRow(runId, step) {
             return (this.sql
                 .exec('SELECT step, result, attempts, last_error FROM _substrat_job_steps WHERE run_id = ? AND step = ?', runId, step)
                 .toArray()[0] ?? null);
         }
         /** Record one step attempt. `result` non-null = it completed and must not re-run. */
-        async jobStepRecord(runId, step, result, attempts, lastError, at) {
-            // Only while the run is still `running` (#1632) — see `JOB_STEP_RECORD_SQL`.
-            this.sql.exec(JOB_STEP_RECORD_SQL, runId, step, result, attempts, lastError, at, runId);
+        async jobStepRecord(runId, step, result, attempts, lastError, at, owner, leaseMs) {
+            // Only while the run is still `running` (#1632) and the pass holds its lease (#2034),
+            // renewing the lease — to this object's now plus `leaseMs` (#2042 r4) — in the same
+            // transaction; see `JOB_STEP_RECORD_SQL`. A coordinator from before leases sends neither,
+            // holds no lease, and renews nothing.
+            return this.revision.transactionSync(() => {
+                const until = leaseMs === undefined ? null : new Date(Date.now() + leaseMs).toISOString();
+                if (until !== null && this.sql.exec(JOB_RUN_RENEW_SQL, until, runId, owner ?? null).rowsWritten === 0) {
+                    return false;
+                }
+                this.sql.exec(JOB_STEP_RECORD_SQL, runId, step, result, attempts, lastError, at, runId, owner ?? null);
+                return true;
+            });
         }
         /**
          * A COMMITTED pass: the run's new state and the dropping of its step ledger, in
@@ -3304,13 +3542,17 @@ export function defineScopeDO(modules, bareOps) {
          * results, not to the cursor) then skips work it never did. The kernel's
          * `runJobPass` carries the full argument.
          */
-        async jobCommitPass(id, patch) {
+        async jobCommitPass(id, patch, owner) {
             // `transactionSync` with both statements inline — NOT `await
             // this.jobRunPatch(...)` then the delete. The await is an output-gate
             // boundary, which is precisely the gap this method exists to close.
-            this.revision.transactionSync(() => {
-                this.sql.exec(JOB_RUN_PATCH_SQL, patch.status, patch.cursor, patch.counters, patch.attempts, patch.lastError, patch.updatedAt, patch.nextAttemptAt, patch.endedAt, id);
+            return this.revision.transactionSync(() => {
+                // #2034: the ledger goes only with a patch that applied — a stale holder's commit must
+                // not empty the ledger of the pass that took the run over.
+                if (this.sql.exec(JOB_RUN_PATCH_SQL, ...this.jobPatchArgs(id, patch, owner)).rowsWritten === 0)
+                    return false;
                 this.sql.exec('DELETE FROM _substrat_job_steps WHERE run_id = ?', id);
+                return true;
             });
         }
         // -- guards (K-17) --------------------------------------------------------
@@ -3763,13 +4005,26 @@ export function defineScopeDO(modules, bareOps) {
                 system: isSystemTable(name),
             }));
         }
-        /** A bounded page of one table. Unknown table names throw — never queried blind. */
+        /** A bounded page of one table. Unknown table names throw — never queried blind. Kept for a
+         *  coordinator from before #113; the current one calls `introspectTableReply`. */
         introspectTable(table, limit, offset) {
+            try {
+                return this.tablePage(table, limit, offset);
+            }
+            catch (e) {
+                throw toRpcError(e);
+            }
+        }
+        /** `introspectTable`, its refusal answered as DATA so its code survives the hop (#113). */
+        introspectTableReply(table, limit, offset) {
+            return replyOf(() => this.tablePage(table, limit, offset));
+        }
+        tablePage(table, limit, offset) {
             const known = new Set(this.sql
                 .exec(`SELECT name FROM sqlite_master WHERE type = 'table'`)
                 .toArray().map((r) => r.name));
             if (!known.has(table))
-                throw new Error(`unknown table '${table}'`);
+                throw substratError('not_found', `unknown table '${table}'`);
             // The ceiling clamps; a bound SQLite would misread (NaN, non-finite, fractional,
             // negative) is refused instead of reaching LIMIT / OFFSET (#1632).
             const l = Math.min(assertRowLimit('limit', limit), SCOPE_TABLE_PAGE_MAX);
@@ -3788,8 +4043,21 @@ export function defineScopeDO(modules, bareOps) {
          * (no sqlite3_stmt_readonly analogue), a transaction that ALWAYS rolls back — a
          * statement the gate misclassified still cannot persist a write. Rows are capped
          * at SCOPE_QUERY_ROW_MAX with `truncated` set, never an error.
+         * Kept for a coordinator from before #113; the current one calls `introspectQueryReply`.
          */
         async introspectQuery(sql) {
+            try {
+                return await this.readOnlyQuery(sql);
+            }
+            catch (e) {
+                throw toRpcError(e);
+            }
+        }
+        /** `introspectQuery`, its refusal answered as DATA so its code survives the hop (#113). */
+        introspectQueryReply(sql) {
+            return replyOf(() => this.readOnlyQuery(sql));
+        }
+        async readOnlyQuery(sql) {
             const stmt = assertReadOnlyQuery(sql);
             let result;
             const rollback = new Error('read-only console rollback');
@@ -3813,7 +4081,7 @@ export function defineScopeDO(modules, bareOps) {
             }
             catch (e) {
                 if (e !== rollback)
-                    throw toRpcError(e);
+                    throw e;
             }
             return result;
         }
@@ -3934,6 +4202,12 @@ export function defineScopeDO(modules, bareOps) {
                 'ALTER TABLE _substrat_tuples ADD COLUMN revoked_at TEXT',
                 // #1632: legacy runs retain an unknown subject; no content-based backfill.
                 'ALTER TABLE _substrat_job_runs ADD COLUMN subject_id TEXT',
+                // #2034: the lease. NULL = nobody holds the run, which is right for every row already there.
+                'ALTER TABLE _substrat_job_runs ADD COLUMN lease_owner TEXT',
+                // #2042 r2, r4: whether the holder BEGAN its pass. NULL for any lease already there: free to take over.
+                'ALTER TABLE _substrat_job_runs ADD COLUMN lease_began_at TEXT',
+                // #2042 r3: consecutive admission misses. NULL = none, right for every run already there.
+                'ALTER TABLE _substrat_job_runs ADD COLUMN admission_misses INTEGER',
                 // Executor retry state (#100). The defaults read as "terminal", which is
                 // right for every row already there: each is a completed delivery or a
                 // consumer dead-letter.
@@ -4231,6 +4505,23 @@ export function defineScopeDO(modules, bareOps) {
                 for (const stmt of splitSqlStatements(searchIndexDdl(plan)))
                     this.sql.exec(stmt);
             }
+            // #119: the never-born-archived trigger went with the dropped table. Put back AFTER the
+            // rows, which may legitimately arrive archived or trashed.
+            for (const plan of this.statePlans.values()) {
+                if (!present.has(plan.table))
+                    continue;
+                for (const stmt of splitSqlStatements(entityStateTriggerDdl(plan)))
+                    this.sql.exec(stmt);
+            }
+            // #811 / #119: the derived list indexes went with the dropped table too, and a load never
+            // put them back — an archivable entity's partial indexes are part of what the kernel
+            // checks after DDL.
+            for (const plan of this.listPlans.values()) {
+                if (!present.has(plan.table))
+                    continue;
+                for (const stmt of splitSqlStatements(listIndexDdl(plan)))
+                    this.sql.exec(stmt);
+            }
             // #1335 / #1686: the outbox arrived with the dump, so this DO's event ids resume above it,
             // as on a wake. A copy's own events then sort above every copied one, which is what
             // `emittedHere()` relies on. A dump whose top id is no ULID leaves the floor where it was.
@@ -4559,36 +4850,17 @@ export function defineScopeDO(modules, bareOps) {
             return redacted;
         }
         // -- event dispatch (port of dispatch) ------------------------------------
-        /**
-         * #1237: the event currently being delivered, or null.
-         *
-         * The host carries a field of the same name for the admin log, and it is
-         * unreachable from here — it lives in the worker that holds the stub, while every
-         * emit runs inside this Durable Object. So the DO keeps its own, and the two are
-         * deliberately separate rather than one passed across the hop.
-         *
-         * One instance IS one scope, so this field is per-scope by construction. The
-         * SQLite twin has to say so explicitly (`ScopeRuntime.causedBy`): that host holds
-         * every scope in the process, so the same field on the host would be read by
-         * another scope's emit the moment a consumer awaits.
-         */
-        causedBy = null;
         /**
          * #1237: the invocation currently running in this DO, or null.
          *
-         * DO-local, like `causedBy` and for a simpler reason: a Durable Object IS one
-         * scope, so there is no other scope's call to confuse it with. It still has to be
-         * cleared, because the DO outlives the request and a value left set would stamp a
-         * later alarm-driven drain with a call it had nothing to do with.
+         * DO-local: a Durable Object IS one scope, so there is no other scope's call to
+         * confuse it with, and `invoke` sets and clears it inside its queued body, which no
+         * other emitting body interleaves with. It still has to be cleared, because the DO
+         * outlives the request and a value left set would stamp a later alarm-driven drain
+         * with a call it had nothing to do with. A consumer's own cause is not kept here: it is
+         * passed into the consumer's context (`ConsumerDelivery`, #2055).
          */
         invocationId = null;
-        /**
-         * #1901: the id a unit of async work with no call around it logs under — a consumer a
-         * seed or an import delivered — set for its handler's duration and cleared after. Read
-         * by `ctx.log` only, never the spine: an event a consumer emits outside a call still
-         * records no invocation (#1525), while its log lines join the consumer's own line.
-         */
-        unitInvocationId = null;
         async dispatch(tenantId, scopeId, 
         /**
          * #1525: the call this drain is running in, or null. Every round of the loop
@@ -4651,16 +4923,15 @@ export function defineScopeDO(modules, bareOps) {
                                 lines.write({ ...unit, outcome: 'dead-lettered' });
                                 continue;
                             }
-                            // #1237: anything this consumer emits was emitted BECAUSE of this event
-                            // — the step a backwards walk used to stop dead at, since a consumer
-                            // emit records no operation either.
-                            this.causedBy = event.id;
-                            // #1901: the handler's `ctx.log` lines join this delivery's line.
-                            this.unitInvocationId = unit.invocationId;
                             try {
                                 await this.revision.transaction(async () => {
-                                    const ctx = this.operationContext(this.systemPrincipal, tenantId, scopeId, {
-                                        system: mod.id,
+                                    // #1237: anything this consumer emits was emitted BECAUSE of this event —
+                                    // the step a backwards walk used to stop dead at, since a consumer emit
+                                    // records no operation either. #1901: its `ctx.log` lines join this
+                                    // delivery's line.
+                                    const ctx = this.consumerContext(tenantId, scopeId, mod.id, {
+                                        causedBy: event.id,
+                                        invocationId: unit.invocationId,
                                     });
                                     await consumer.handler(ctx, event);
                                     this.sql.exec(`INSERT INTO _substrat_deliveries
@@ -4678,14 +4949,6 @@ export function defineScopeDO(modules, bareOps) {
                    VALUES (?, ?, ?, ?, ?)`, event.id, mod.id, new Date().toISOString(), String(err), invocationId);
                                 lines.write({ ...unit, outcome: 'dead-lettered', error: err });
                             }
-                            finally {
-                                this.unitInvocationId = null;
-                                // Cleared on BOTH paths. Left set, the id leaks onto every later emit
-                                // this DO makes — an operation's own event stamped as caused by
-                                // whatever was delivered last, which is worse than recording nothing
-                                // because it reads as a fact.
-                                this.causedBy = null;
-                            }
                         }
                     }
                 }
@@ -4800,11 +5063,14 @@ export function defineScopeDO(modules, bareOps) {
          * the queued body. Mutually exclusive with the other non-person callers; `principal` is
          * then a placeholder that the subject below never reads.
          */
-        peerSubject) {
+        peerSubject, 
+        /** #2055: the delivery a consumer's or an import's context runs for; absent otherwise. */
+        delivery) {
             const checker = this.checker;
             const relations = this.relations;
             const searchPlans = this.searchPlans;
             const listPlans = this.listPlans;
+            const statePlans = this.statePlans;
             const sql = this.sql;
             const mintEventId = this.mintEventId;
             /**
@@ -4927,10 +5193,10 @@ export function defineScopeDO(modules, bareOps) {
                 // about the deploy, so it never rides `DomainEvent` for module code to
                 // branch on; it exists for the observability joins the column serves.
                 this.env.SUBSTRAT_VERSION_ID ?? null, 
-                // #1237: whatever delivery is in flight, if any — read off the DO the same
-                // way the version is read off its env. A fact about the surrounding
-                // dispatch, never envelope data module code could set or branch on.
-                this.causedBy, 
+                // #1237: the delivery this context was built for, if any — passed in, never read
+                // off the DO (#2055). A fact about the surrounding dispatch, never envelope data
+                // module code could set or branch on.
+                delivery?.causedBy ?? null, 
                 // #1237: a fact about the surrounding CALL, like the version above.
                 this.invocationId, full.payload === undefined ? null : JSON.stringify(full.payload));
             };
@@ -4940,7 +5206,11 @@ export function defineScopeDO(modules, bareOps) {
                 // #1672: a capability's own id stands in so the type holds — it is not a person, and
                 // the event actor says what it is instead. Every other door passes its own value.
                 principal: capabilityId ? capabilityId : principal,
-                sql: guardSecrets(doScopedSql(sql), minted),
+                sql: guardSecrets(doScopedSql(sql, statefulTablesOf(statePlans), 
+                // #119: after runtime DDL, the stateful tables must still carry what the kernel derived.
+                statePlans.size
+                    ? () => assertEntityStateIntact(doSpineSql(sql), statePlans, stateListIndexNames(listPlans.values()))
+                    : undefined), minted),
                 now: () => at,
                 // #1746/#1747: the host stamps who and where; module code supplies only the template
                 // and its fields. A consumer runs under the system override, so it logs as `system`.
@@ -4949,7 +5219,7 @@ export function defineScopeDO(modules, bareOps) {
                     tenantId,
                     scopeId,
                     operation: operation ?? null,
-                    invocationId: () => this.invocationId ?? this.unitInvocationId,
+                    invocationId: () => this.invocationId ?? delivery?.invocationId ?? null,
                     principalKind: systemActor ? 'system' : subject.kind,
                     // The string-safe redaction: `redactSecrets` parses its serialization back, and a
                     // log's text is not JSON.
@@ -5007,7 +5277,9 @@ export function defineScopeDO(modules, bareOps) {
                     const plan = searchPlans.get(entityType);
                     if (!plan)
                         throw new NotSearchable(entityType);
-                    const q = searchQuery(plan, searchMatchExpression(term, plan.tokenizer), searchLimit(options?.limit));
+                    const q = searchQuery(plan, searchMatchExpression(term, plan.tokenizer), searchLimit(options?.limit), 
+                    // #119: active rows unless the archive is asked for.
+                    searchStateWhere(statePlans, entityType, options?.view));
                     return sql.exec(q.sql, ...q.params).toArray().map((row) => ({ entityType, id: row.id, rank: row.rank }));
                 },
                 /**
@@ -5027,10 +5299,12 @@ export function defineScopeDO(modules, bareOps) {
                         order: params.order,
                         cursor: params.cursor,
                         filters: params.filters,
+                        // #119: the bin is the checked reader's, never this one's.
+                        view: uncheckedView('ctx.page', entityType, params.view),
                     });
                     const rows = sql.exec(q.sql, ...q.params).toArray();
                     const last = rows.length >= limit ? rows[rows.length - 1] : undefined;
-                    const nextCursor = last === undefined ? null : cursorOf(last, q.sortColumn, plan.idColumn, q.order);
+                    const nextCursor = last === undefined ? null : cursorOf(last, q.sortColumn, plan.idColumn, q.order, q.view);
                     const page = { entries: rows, nextCursor };
                     if (!params.total)
                         return page;
@@ -5096,6 +5370,22 @@ export function defineScopeDO(modules, bareOps) {
                     emit: (event) => writeEvent(event, 'kernel'),
                     assertWrites: (verb) => assertImpersonationWrites(impersonation, verb),
                 }),
+                // #119: archive and trash — the pure adapter's wiring, over the raw spine seam.
+                ...createEntityStateVerbs({
+                    sql: doSpineSql(sql),
+                    plans: statePlans,
+                    now: at,
+                    check: runCheck,
+                    emit: (event) => writeEvent(event, 'kernel'),
+                    assertWrites: (verb) => assertImpersonationWrites(impersonation, verb),
+                }),
+                ...createTrashedReads({
+                    query: (q, params) => sql.exec(q, ...params).toArray(),
+                    listPlans,
+                    searchPlans,
+                    statePlans,
+                    check: runCheck,
+                }),
                 entitlement: async (key) => {
                     const held = await entitlementReader().listEntitlements(tenantId);
                     return held.find((e) => e.key === key) ?? null;
@@ -5209,6 +5499,10 @@ export function defineScopeDO(modules, bareOps) {
                 this.sql.exec(`INSERT OR REPLACE INTO _substrat_meta (key, value) VALUES ('permission_source', ?)`, source);
             });
         }
+        /** `applyProjection`, its refusal answered as DATA so its code survives the hop (#113). */
+        applyProjectionReply(...args) {
+            return replyOf(() => this.applyProjection(...args));
+        }
         /**
          * Replace this scope's projected view of a tenant's roles + tenant-level tuples
          * with a fresh snapshot, and make it authoritative (source = 'local'). A full