@substrat-run/adapter-cloudflare 0.138.0 → 0.139.0

package/dist/scope-do.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"scope-do.d.ts","sourceRoot":"","sources":["../src/scope-do.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAC;AAyDnD,OAAO,EA8CL,KAAK,SAAS,EAsBd,KAAK,kBAAkB,EAEvB,KAAK,gBAAgB,EA0FtB,MAAM,sBAAsB,CAAC;AAwC9B,OAAO,EAAW,KAAK,OAAO,EAAE,MAAM,eAAe,CAAC;AAkEtD;;;;;;;;;;;;;GAaG;AAEH,MAAM,WAAW,UAAU;IACzB;;;;;OAKG;IACH,aAAa,CAAC,EAAE,sBAAsB,CAAC;IACvC;;;;;;OAMG;IACH,mBAAmB,CAAC,EAAE,MAAM,CAAC;CAC9B;AAwED,oFAAoF;AACpF,MAAM,MAAM,aAAa,GAAG,UAAU,GAAG,UAAU,GAAG,SAAS,GAAG,SAAS,CAAC;AAshB5E;;;GAGG;AACH,MAAM,MAAM,yBAAyB,CAAC,CAAC,IAAI,OAAO,CAAC,CAAC,CAAC,CAAC;AAgDtD;;;;GAIG;AACH,wBAAgB,aAAa,CAAC,GAAG,EAAE,UAAU,GAAG,SAAS,CAOxD;AAED,wBAAgB,kBAAkB,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,EAAE,CAwDxD;AAkBD,wBAAgB,aAAa,CAC3B,OAAO,EAAE,kBAAkB,EAAE,EAC7B,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,gBAAgB,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC,GACxD,KAAK,GAAG,EAAE,kBAAkB,EAAE,GAAG,EAAE,UAAU,KAAK,aAAa,CAumMjE"}
+{"version":3,"file":"scope-do.d.ts","sourceRoot":"","sources":["../src/scope-do.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAC;AAyDnD,OAAO,EAoDL,KAAK,SAAS,EAsBd,KAAK,kBAAkB,EAEvB,KAAK,gBAAgB,EA8FtB,MAAM,sBAAsB,CAAC;AAwC9B,OAAO,EAAW,KAAK,OAAO,EAAE,MAAM,eAAe,CAAC;AA8EtD;;;;;;;;;;;;;GAaG;AAEH,MAAM,WAAW,UAAU;IACzB;;;;;OAKG;IACH,aAAa,CAAC,EAAE,sBAAsB,CAAC;IACvC;;;;;;OAMG;IACH,mBAAmB,CAAC,EAAE,MAAM,CAAC;CAC9B;AAwED,oFAAoF;AACpF,MAAM,MAAM,aAAa,GAAG,UAAU,GAAG,UAAU,GAAG,SAAS,GAAG,SAAS,CAAC;AAyhB5E;;;GAGG;AACH,MAAM,MAAM,yBAAyB,CAAC,CAAC,IAAI,OAAO,CAAC,CAAC,CAAC,CAAC;AAgDtD;;;;GAIG;AACH,wBAAgB,aAAa,CAAC,GAAG,EAAE,UAAU,GAAG,SAAS,CAOxD;AAED,wBAAgB,kBAAkB,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,EAAE,CAwDxD;AAkBD,wBAAgB,aAAa,CAC3B,OAAO,EAAE,kBAAkB,EAAE,EAC7B,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,gBAAgB,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC,GACxD,KAAK,GAAG,EAAE,kBAAkB,EAAE,GAAG,EAAE,UAAU,KAAK,aAAa,CAotMjE"}

package/dist/scope-do.js

@@ -2,12 +2,12 @@ import { REWIND_REFUSED } from './rewind-refusal.js';
 import { SYSTEM_DOOR_MOVED } from './system-door.js';
 import { DurableObject } from 'cloudflare:workers';
 import { ATTACHMENT_ADDED, ATTACHMENT_REMOVED, attachmentRecord, domainEvent, domainEventInput, eventId, instant, objectRef, entityObjectRef, assertModuleEmittableType, assertKernelAuthoredType, toWireFailure, grantRefFromProof, principalId, scopeId as scopeIdOf, tenantId as tenantIdOf, platformRequestInput, platformRequestId, MAX_PENDING_PLATFORM_REQUESTS, MAX_PENDING_SWEEP_RUNS, SWEEP_RUNS_KIND, SCOPE_TABLE_PAGE_MAX, SCOPE_QUERY_ROW_MAX, listLimitOf, requestFingerprint, substratError, errorCodeOf, assertReplayableDump, REDRAIN_BATCH, } from '@substrat-run/contracts';
-import { ulid, DO_SQL_LIMITS, unknownRoleError, createUlid, assertAllowed, ConnectionSealingKeyUnavailableError, noSealingKeyMessage, sealTo, assertReadOnlyQuery, entitlementDenial, platformRequestHistoryQuery, platformRequestOf, PLATFORM_REQUEST_COLUMNS, PLATFORM_REQUEST_REDACTION_SQL, platformRequestRedactionParams, platformRequestRedactionQuery, intentPayloadCarriesSubject, redactSubjectJobRuns, redactSubjectScopeText, assertRowLimit, assertRowOffset, JOB_RUN_PATCH_SQL, JOB_RUN_CLAIM_SQL, JOB_RUN_RENEW_SQL, JOB_RUN_BEGIN_SQL, JOB_RUN_MISS_SQL, JOB_RUN_MISS_SETTLE_SQL, admissionMissOutcome, JOB_LEASE_EXPIRED_NOTE, JOB_STEP_RECORD_SQL, DELIVERY_ERROR_REDACTION_SQL, REDACTED_DELIVERY_NOTE, seatScopeTuple, effectiveRoleGrantQuery, switchRecordedOff, switchSystemSchedules, peerGrantsStatus, systemGrantsStatus, systemScheduleState, systemSwitchedOff, denialListQuery, refusalListQuery, mapRefusalRow, denialSummaryQuery, denialTotalsQuery, DENIAL_WINDOW_QUERY, mapDenialRow, mapDenialSummaryBuckets, PermissionDenied, assertImpersonationWrites, assertModuleEnqueueableKind, impersonationStampOf, createAtomic, NotSearchable, isSearchIndexTable, searchIndexDdl, searchIndexPlans, NotListable, listIndexPlans, moduleMigrations, listQuery, cursorOf, searchLimit, searchMatchExpression, searchQuery, ATTACHMENT_TEXT_DDL, attachmentRecordOfRow, enqueueAttachmentText, reconcileAttachmentText, recordAttachmentText, searchAttachments, IDEMPOTENCY_DDL, REFUSALS_TABLE_DDL, REFUSALS_INDEX, refusalInsert, refusalOf, markGuardRefusal, REFUSALS_REBUILD, refusalsAdmitGuards, assertIdempotencyKey, assertPermissionKey, idempotencyLookupQuery, idempotencyPruneStatement, idempotencyRecordStatement, idempotencyOptedOutMessage, replayFor, entityVersionQuery, entityVersionOf, assertIfMatch, OUTBOX_ENTITY_INDEX, SCHEDULE_STATE_DDL, SCHEDULE_STATE_REBUILD, scheduleStateHasKind, VERTICAL_EVENTS_DDL, EXPORT_HOPS_SQL, emptyImportResult, IMPORT_CURSORS_SQL, IMPORT_CURSOR_OF_SQL, OUTBOX_MARK_SQL, exportedSinceQuery, emittedSinceQuery, emittedReportOf, EMITTED_REPORT_CAP, IMPORT_CURSOR_ADVANCE_SQL, IMPORT_RECORD_SQL, moveImportCursor, CrossVerticalRegistry, exportReadPlan, exportReadQuery, planExportBatch, withheldNote, JOB_RUN_DDL, JOB_RUN_DUE_AT, jobRunListLimit, SYSTEM_DOOR_WAIT, ancestorsWithin, } from '@substrat-run/kernel';
+import { ulid, DO_SQL_LIMITS, unknownRoleError, createUlid, assertAllowed, ConnectionSealingKeyUnavailableError, noSealingKeyMessage, sealTo, assertReadOnlyQuery, entitlementDenial, platformRequestHistoryQuery, platformRequestOf, PLATFORM_REQUEST_COLUMNS, PLATFORM_REQUEST_REDACTION_SQL, platformRequestRedactionParams, platformRequestRedactionQuery, intentPayloadCarriesSubject, redactSubjectJobRuns, redactSubjectScopeText, assertRowLimit, assertRowOffset, JOB_RUN_PATCH_SQL, JOB_RUN_CLAIM_SQL, JOB_RUN_RENEW_SQL, JOB_RUN_BEGIN_SQL, JOB_RUN_MISS_SQL, JOB_RUN_MISS_SETTLE_SQL, admissionMissOutcome, JOB_LEASE_EXPIRED_NOTE, JOB_STEP_RECORD_SQL, DELIVERY_ERROR_REDACTION_SQL, REDACTED_DELIVERY_NOTE, seatScopeTuple, applyScopeRoleChange, changeScopeRole, revokeScopeRoles, scopeRoleHolders, effectiveRoleGrantQuery, switchRecordedOff, switchSystemSchedules, peerGrantsStatus, systemGrantsStatus, systemScheduleState, systemSwitchedOff, denialListQuery, refusalListQuery, mapRefusalRow, denialSummaryQuery, denialTotalsQuery, DENIAL_WINDOW_QUERY, mapDenialRow, mapDenialSummaryBuckets, PermissionDenied, assertImpersonationWrites, assertModuleEnqueueableKind, impersonationStampOf, createAtomic, NotSearchable, isSearchIndexTable, searchIndexDdl, searchIndexPlans, NotListable, listIndexDdl, listIndexPlans, moduleMigrations, listQuery, cursorOf, searchLimit, searchMatchExpression, searchQuery, ATTACHMENT_TEXT_DDL, attachmentRecordOfRow, enqueueAttachmentText, reconcileAttachmentText, queueAttachmentTextBackfill, startAttachmentTextBackfill, recordAttachmentText, searchAttachments, IDEMPOTENCY_DDL, REFUSALS_TABLE_DDL, REFUSALS_INDEX, refusalInsert, refusalOf, markGuardRefusal, REFUSALS_REBUILD, refusalsAdmitGuards, assertIdempotencyKey, assertPermissionKey, idempotencyLookupQuery, idempotencyPruneStatement, idempotencyRecordStatement, idempotencyOptedOutMessage, replayFor, entityVersionQuery, entityVersionOf, assertIfMatch, OUTBOX_ENTITY_INDEX, SCHEDULE_STATE_DDL, SCHEDULE_STATE_REBUILD, scheduleStateHasKind, VERTICAL_EVENTS_DDL, EXPORT_HOPS_SQL, emptyImportResult, IMPORT_CURSORS_SQL, IMPORT_CURSOR_OF_SQL, OUTBOX_MARK_SQL, exportedSinceQuery, emittedSinceQuery, emittedReportOf, EMITTED_REPORT_CAP, IMPORT_CURSOR_ADVANCE_SQL, IMPORT_RECORD_SQL, moveImportCursor, CrossVerticalRegistry, exportReadPlan, exportReadQuery, planExportBatch, withheldNote, JOB_RUN_DDL, JOB_RUN_DUE_AT, jobRunListLimit, SYSTEM_DOOR_WAIT, ancestorsWithin, } from '@substrat-run/kernel';
 import { isUpgradeRequest, readSubscription, LIVE_FANOUT_LIMIT, LIVE_MODE_HEADER, LIVE_PRINCIPAL_HEADER, LIVE_SCOPE_HEADER, LIVE_SUBSCRIBE_PATH, LIVE_TENANT_HEADER, LIVE_WITHIN_HEADER, decodeLiveWithin, } from './live-reads.js';
 import { replyOf } from './do-reply.js';
 import { OperationQueue } from './serialization.js';
 import { doScopedSql, doBuiltColumnsOf, doRedactionSql, doSpineSql } from './sql.js';
-import { actorOf, admitPeer, collectPeers, switchPeer, peerSubjectRef, subjectGrantState, assertNoSecret, CAPABILITY_DDL, COPY_ORIGIN_DDL, SWITCH_FENCES_DDL, CAPABILITY_EXCHANGE_OPERATION, capabilityAttachmentWriteRefused, createCapabilityVerbs, createEntityEdgeVerbs, exchangeCapability, guardSecrets, mintBecomeCapability, redactSecrets, redactSecretText, moduleLog, asyncInvocationId, asyncLinePass, resolveCapabilitySession, revokeCapabilityAsPlatform, readCapabilityPage, domainEventOf, facetEvents, readDeadLetters, readLifecycleFlow, readOperationSeries, readHistory, readInvocation, readUndrainedOutbox, walkEventCause, walkEventEffects, } from '@substrat-run/kernel';
+import { actorOf, admitPeer, collectPeers, switchPeer, peerSubjectRef, subjectGrantState, assertNoSecret, CAPABILITY_DDL, COPY_ORIGIN_DDL, ENTITY_STATE_MOVES_DDL, SWITCH_FENCES_DDL, CAPABILITY_EXCHANGE_OPERATION, capabilityAttachmentWriteRefused, createCapabilityVerbs, createEntityEdgeVerbs, createEntityStateVerbs, createTrashedReads, searchStateWhere, uncheckedView, addStatePlans, entityStateTriggerDdl, statefulTablesOf, assertEntityStateIntact, stateListIndexNames, exchangeCapability, guardSecrets, mintBecomeCapability, redactSecrets, redactSecretText, moduleLog, asyncInvocationId, asyncLinePass, resolveCapabilitySession, revokeCapabilityAsPlatform, readCapabilityPage, domainEventOf, facetEvents, readDeadLetters, readLifecycleFlow, readOperationSeries, readHistory, readInvocation, readUndrainedOutbox, walkEventCause, walkEventEffects, } from '@substrat-run/kernel';
 import { createDoTupleChecker, createLocalControlPlaneReader, scopeTupleReader } from './checker.js';
 import { CARRIED_AWAY_KEY, COPY_MARK_CLEARED_KEY, KEPT_COPY_REFUSAL, KEPT_DIVERGENT_KEY, LOAD_STAMP_KEY, STORE_LOCAL_META_KEYS, WRITE_REVISION_KEY, carriedAwayDump, isCopyMarkInsert, isWriteStatement, assertNoSpineReference, assertSpineTablesBuilt, capabilitiesForLoad, clearCopyMarker, dumpRowsInsert, isSpineTable, markCopyOrigin, repointScopeGrants, settleCopiedWork, emittedHere, IS_COPY_SQL, isCopyLoad, isLifecycleWrite, readLifecycle, settleLifecycleAfterLoad, writeLifecycle, spineColumnAdditions } from '@substrat-run/kernel';
 /**
@@ -349,6 +349,9 @@ const KERNEL_DDL = `
   -- #1686: where a copied scope's data came from, and the event id its own events start above.
   -- Shared with the other adapter from @substrat-run/kernel; the column comments are there.
   ${COPY_ORIGIN_DDL}
+  -- #119: the kernel's authorization for one archive/trash move, read by the derived update
+  -- trigger. Shared with the other adapter from @substrat-run/kernel; the comments are there.
+  ${ENTITY_STATE_MOVES_DDL}
 `;
 /**
  * Workers RPC carries a plain `Error`'s MESSAGE faithfully and nothing else. A custom
@@ -708,6 +711,8 @@ export function defineScopeDO(modules, bareOps) {
         searchPlans = new Map();
         /** #811: the paged lists modules declare, by entity type. Same one-owner rule. */
         listPlans = new Map();
+        /** #119: entity type → its archive/trash plan, from every registered module. */
+        statePlans = new Map();
         /** entityType → the declared attachment gate (#473): read key + write key (default: read). */
         attachmentTargets = new Map();
         /**
@@ -819,8 +824,10 @@ export function defineScopeDO(modules, bareOps) {
                 }
                 this.searchPlans.set(plan.entityType, plan);
             }
+            // #119: the archive/trash plans, refusing a second owner of one entity type.
+            addStatePlans(this.statePlans, manifest.id, manifest.entityStates, manifest.permissions);
             // #811: the list indexes `lists` declares, same placement and same reason.
-            for (const plan of listIndexPlans(manifest.id, manifest.lists)) {
+            for (const plan of listIndexPlans(manifest.id, manifest.lists, manifest.entityStates)) {
                 const existing = this.listPlans.get(plan.entityType);
                 if (existing) {
                     throw new Error(`list: '${plan.entityType}' declares a paged list in both '${existing.moduleId}' and ` +
@@ -1306,13 +1313,12 @@ export function defineScopeDO(modules, bareOps) {
                         const { hops: _hops, ...fact } = e;
                         const event = structuredClone({ ...fact, source });
                         const unit = unitOf(imp.moduleId, e.id, e.type);
-                        this.causedBy = e.id;
-                        this.unitInvocationId = unit.invocationId;
                         try {
                             await this.revision.transaction(async () => {
                                 // As the producer's principal: real checks against the grants this vertical's
                                 // `peers` gave it; its emits carry `{ vertical, scope }` and what they passed.
-                                await imp.handler(this.importContext(tenantId, scopeId, peerSubject), event);
+                                // What it emits was emitted BECAUSE of the producer's event (#1237).
+                                await imp.handler(this.importContext(tenantId, scopeId, peerSubject, { causedBy: e.id, invocationId: unit.invocationId }), event);
                                 this.sql.exec(`INSERT INTO _substrat_deliveries (event_id, consumer_module, delivered_at, invocation_id)
                    VALUES (?, ?, ?, NULL)`, e.id, imp.moduleId, new Date().toISOString());
                             });
@@ -1325,10 +1331,6 @@ export function defineScopeDO(modules, bareOps) {
                             result.deadLettered += 1;
                             lines.write({ ...unit, outcome: 'dead-lettered', error: err });
                         }
-                        finally {
-                            this.causedBy = null;
-                            this.unitInvocationId = null;
-                        }
                     }
                     if (!ran)
                         result.duplicates += 1;
@@ -1345,8 +1347,12 @@ export function defineScopeDO(modules, bareOps) {
          * passes it (#1706). `principal` is a placeholder that the subject never reads, and there is
          * no operation, so the emitted rows' `operation` is NULL, as it is for any consumer.
          */
-        importContext(tenantId, scopeId, peerSubject) {
-            return this.operationContext(principalId.parse(ulid()), tenantId, scopeId, undefined, undefined, undefined, undefined, undefined, undefined, undefined, [], undefined, peerSubject);
+        /** A module consumer's context: the system override, and the delivery it runs for (#2055). */
+        consumerContext(tenantId, scopeId, moduleId, delivery) {
+            return this.operationContext(this.systemPrincipal, tenantId, scopeId, { system: moduleId }, undefined, undefined, undefined, undefined, undefined, undefined, [], undefined, undefined, delivery);
+        }
+        importContext(tenantId, scopeId, peerSubject, delivery) {
+            return this.operationContext(principalId.parse(ulid()), tenantId, scopeId, undefined, undefined, undefined, undefined, undefined, undefined, undefined, [], undefined, peerSubject, delivery);
         }
         async markEventsDrained(eventIds, at) {
             if (eventIds.length === 0)
@@ -2653,6 +2659,20 @@ export function defineScopeDO(modules, bareOps) {
             await this.ensureMigrations();
             return this.queue.enqueue(async () => this.revision.transactionSync(() => recordAttachmentText(doSpineSql(this.sql), attachmentId, outcome, new Date().toISOString())));
         }
+        /**
+         * #1575: start the scope's one-shot backfill, unless it is marked or holds no
+         * attachments (`startAttachmentTextBackfill` reads before it writes, so a marked scope
+         * writes nothing — and moves no write revision — on every drive).
+         */
+        async attachmentTextBackfillStart() {
+            await this.ensureMigrations();
+            await this.queue.enqueue(async () => this.revision.transactionSync(() => startAttachmentTextBackfill(doSpineSql(this.sql), ulid(), new Date().toISOString())));
+        }
+        /** #1575: one backfill batch, in one transaction (`queueAttachmentTextBackfill`). */
+        async attachmentTextBackfillBatch(after) {
+            await this.ensureMigrations();
+            return this.queue.enqueue(async () => this.revision.transactionSync(() => queueAttachmentTextBackfill(doSpineSql(this.sql), after, ulid, new Date().toISOString())));
+        }
         // -- attachments through a capability (#1686) -------------------------------
         // The coordinator hashed the session token; only the hash arrives. Each verb resolves it
         // INSIDE the queue, as `invoke` does, so nothing can revoke between the resolution and
@@ -2931,12 +2951,33 @@ export function defineScopeDO(modules, bareOps) {
             return this.queue.enqueue(async () => {
                 const bound = await this.assignmentBound({ kind: 'principal', id: caller }, tenantId, scopeId, roleKey);
                 if (bound?.covered) {
-                    this.sql.exec(`INSERT OR REPLACE INTO _substrat_tuples (subject, relation, object, expires_at)
-             VALUES (?, ?, ?, NULL)`, `principal:${assignee}`, `role:${roleKey}`, `scope:${scopeId}`);
+                    applyScopeRoleChange(this.switchSql(), scopeId, assignee, { revoke: [], grant: roleKey }, new Date().toISOString());
                 }
                 return bound;
             });
         }
+        /** The scope's live scope-level role assignments, or one principal's (#1150). */
+        async scopeRoleHoldersFor(scopeId, principal) {
+            await this.ensureMigrations();
+            return this.queue.enqueue(() => scopeRoleHolders(this.switchSql(), scopeId, new Date().toISOString(), principal));
+        }
+        /**
+         * The kernel's `changeScopeRole` in one serialized scope task (#1150). Its two refusals come
+         * back as values: an error thrown here crosses the RPC flattened, so the coordinator types them.
+         */
+        async changeScopeRoleBoundedFor(tenantId, scopeId, caller, principal, from, to) {
+            await this.ensureMigrations();
+            return this.queue.enqueue(() => changeScopeRole(this.switchSql(), scopeId, principal, from, to, new Date().toISOString(), this.roleBound(caller, tenantId, scopeId), (run) => this.revision.transactionSync(run)));
+        }
+        /** The kernel's `revokeScopeRoles` in one serialized scope task (#1150). */
+        async revokeScopeRolesBoundedFor(tenantId, scopeId, caller, principal) {
+            await this.ensureMigrations();
+            return this.queue.enqueue(() => revokeScopeRoles(this.switchSql(), scopeId, principal, new Date().toISOString(), this.roleBound(caller, tenantId, scopeId), (run) => this.revision.transactionSync(run)));
+        }
+        /** The caller's bound per role at the scope; `null` for a role the tenant does not define. */
+        roleBound(caller, tenantId, scopeId) {
+            return (roleKey) => this.assignmentBound({ kind: 'principal', id: caller }, tenantId, scopeId, roleKey);
+        }
         /**
          * §5.1's assignment bound, resolved against the SAME role table the checker
          * expands — the tenant's projected role, not a vertical's compile-time `ROLES`
@@ -4464,6 +4505,23 @@ export function defineScopeDO(modules, bareOps) {
                 for (const stmt of splitSqlStatements(searchIndexDdl(plan)))
                     this.sql.exec(stmt);
             }
+            // #119: the never-born-archived trigger went with the dropped table. Put back AFTER the
+            // rows, which may legitimately arrive archived or trashed.
+            for (const plan of this.statePlans.values()) {
+                if (!present.has(plan.table))
+                    continue;
+                for (const stmt of splitSqlStatements(entityStateTriggerDdl(plan)))
+                    this.sql.exec(stmt);
+            }
+            // #811 / #119: the derived list indexes went with the dropped table too, and a load never
+            // put them back — an archivable entity's partial indexes are part of what the kernel
+            // checks after DDL.
+            for (const plan of this.listPlans.values()) {
+                if (!present.has(plan.table))
+                    continue;
+                for (const stmt of splitSqlStatements(listIndexDdl(plan)))
+                    this.sql.exec(stmt);
+            }
             // #1335 / #1686: the outbox arrived with the dump, so this DO's event ids resume above it,
             // as on a wake. A copy's own events then sort above every copied one, which is what
             // `emittedHere()` relies on. A dump whose top id is no ULID leaves the floor where it was.
@@ -4792,36 +4850,17 @@ export function defineScopeDO(modules, bareOps) {
             return redacted;
         }
         // -- event dispatch (port of dispatch) ------------------------------------
-        /**
-         * #1237: the event currently being delivered, or null.
-         *
-         * The host carries a field of the same name for the admin log, and it is
-         * unreachable from here — it lives in the worker that holds the stub, while every
-         * emit runs inside this Durable Object. So the DO keeps its own, and the two are
-         * deliberately separate rather than one passed across the hop.
-         *
-         * One instance IS one scope, so this field is per-scope by construction. The
-         * SQLite twin has to say so explicitly (`ScopeRuntime.causedBy`): that host holds
-         * every scope in the process, so the same field on the host would be read by
-         * another scope's emit the moment a consumer awaits.
-         */
-        causedBy = null;
         /**
          * #1237: the invocation currently running in this DO, or null.
          *
-         * DO-local, like `causedBy` and for a simpler reason: a Durable Object IS one
-         * scope, so there is no other scope's call to confuse it with. It still has to be
-         * cleared, because the DO outlives the request and a value left set would stamp a
-         * later alarm-driven drain with a call it had nothing to do with.
+         * DO-local: a Durable Object IS one scope, so there is no other scope's call to
+         * confuse it with, and `invoke` sets and clears it inside its queued body, which no
+         * other emitting body interleaves with. It still has to be cleared, because the DO
+         * outlives the request and a value left set would stamp a later alarm-driven drain
+         * with a call it had nothing to do with. A consumer's own cause is not kept here: it is
+         * passed into the consumer's context (`ConsumerDelivery`, #2055).
          */
         invocationId = null;
-        /**
-         * #1901: the id a unit of async work with no call around it logs under — a consumer a
-         * seed or an import delivered — set for its handler's duration and cleared after. Read
-         * by `ctx.log` only, never the spine: an event a consumer emits outside a call still
-         * records no invocation (#1525), while its log lines join the consumer's own line.
-         */
-        unitInvocationId = null;
         async dispatch(tenantId, scopeId, 
         /**
          * #1525: the call this drain is running in, or null. Every round of the loop
@@ -4884,16 +4923,15 @@ export function defineScopeDO(modules, bareOps) {
                                 lines.write({ ...unit, outcome: 'dead-lettered' });
                                 continue;
                             }
-                            // #1237: anything this consumer emits was emitted BECAUSE of this event
-                            // — the step a backwards walk used to stop dead at, since a consumer
-                            // emit records no operation either.
-                            this.causedBy = event.id;
-                            // #1901: the handler's `ctx.log` lines join this delivery's line.
-                            this.unitInvocationId = unit.invocationId;
                             try {
                                 await this.revision.transaction(async () => {
-                                    const ctx = this.operationContext(this.systemPrincipal, tenantId, scopeId, {
-                                        system: mod.id,
+                                    // #1237: anything this consumer emits was emitted BECAUSE of this event —
+                                    // the step a backwards walk used to stop dead at, since a consumer emit
+                                    // records no operation either. #1901: its `ctx.log` lines join this
+                                    // delivery's line.
+                                    const ctx = this.consumerContext(tenantId, scopeId, mod.id, {
+                                        causedBy: event.id,
+                                        invocationId: unit.invocationId,
                                     });
                                     await consumer.handler(ctx, event);
                                     this.sql.exec(`INSERT INTO _substrat_deliveries
@@ -4911,14 +4949,6 @@ export function defineScopeDO(modules, bareOps) {
                    VALUES (?, ?, ?, ?, ?)`, event.id, mod.id, new Date().toISOString(), String(err), invocationId);
                                 lines.write({ ...unit, outcome: 'dead-lettered', error: err });
                             }
-                            finally {
-                                this.unitInvocationId = null;
-                                // Cleared on BOTH paths. Left set, the id leaks onto every later emit
-                                // this DO makes — an operation's own event stamped as caused by
-                                // whatever was delivered last, which is worse than recording nothing
-                                // because it reads as a fact.
-                                this.causedBy = null;
-                            }
                         }
                     }
                 }
@@ -5033,11 +5063,14 @@ export function defineScopeDO(modules, bareOps) {
          * the queued body. Mutually exclusive with the other non-person callers; `principal` is
          * then a placeholder that the subject below never reads.
          */
-        peerSubject) {
+        peerSubject, 
+        /** #2055: the delivery a consumer's or an import's context runs for; absent otherwise. */
+        delivery) {
             const checker = this.checker;
             const relations = this.relations;
             const searchPlans = this.searchPlans;
             const listPlans = this.listPlans;
+            const statePlans = this.statePlans;
             const sql = this.sql;
             const mintEventId = this.mintEventId;
             /**
@@ -5160,10 +5193,10 @@ export function defineScopeDO(modules, bareOps) {
                 // about the deploy, so it never rides `DomainEvent` for module code to
                 // branch on; it exists for the observability joins the column serves.
                 this.env.SUBSTRAT_VERSION_ID ?? null, 
-                // #1237: whatever delivery is in flight, if any — read off the DO the same
-                // way the version is read off its env. A fact about the surrounding
-                // dispatch, never envelope data module code could set or branch on.
-                this.causedBy, 
+                // #1237: the delivery this context was built for, if any — passed in, never read
+                // off the DO (#2055). A fact about the surrounding dispatch, never envelope data
+                // module code could set or branch on.
+                delivery?.causedBy ?? null, 
                 // #1237: a fact about the surrounding CALL, like the version above.
                 this.invocationId, full.payload === undefined ? null : JSON.stringify(full.payload));
             };
@@ -5173,7 +5206,11 @@ export function defineScopeDO(modules, bareOps) {
                 // #1672: a capability's own id stands in so the type holds — it is not a person, and
                 // the event actor says what it is instead. Every other door passes its own value.
                 principal: capabilityId ? capabilityId : principal,
-                sql: guardSecrets(doScopedSql(sql), minted),
+                sql: guardSecrets(doScopedSql(sql, statefulTablesOf(statePlans), 
+                // #119: after runtime DDL, the stateful tables must still carry what the kernel derived.
+                statePlans.size
+                    ? () => assertEntityStateIntact(doSpineSql(sql), statePlans, stateListIndexNames(listPlans.values()))
+                    : undefined), minted),
                 now: () => at,
                 // #1746/#1747: the host stamps who and where; module code supplies only the template
                 // and its fields. A consumer runs under the system override, so it logs as `system`.
@@ -5182,7 +5219,7 @@ export function defineScopeDO(modules, bareOps) {
                     tenantId,
                     scopeId,
                     operation: operation ?? null,
-                    invocationId: () => this.invocationId ?? this.unitInvocationId,
+                    invocationId: () => this.invocationId ?? delivery?.invocationId ?? null,
                     principalKind: systemActor ? 'system' : subject.kind,
                     // The string-safe redaction: `redactSecrets` parses its serialization back, and a
                     // log's text is not JSON.
@@ -5240,7 +5277,9 @@ export function defineScopeDO(modules, bareOps) {
                     const plan = searchPlans.get(entityType);
                     if (!plan)
                         throw new NotSearchable(entityType);
-                    const q = searchQuery(plan, searchMatchExpression(term, plan.tokenizer), searchLimit(options?.limit));
+                    const q = searchQuery(plan, searchMatchExpression(term, plan.tokenizer), searchLimit(options?.limit), 
+                    // #119: active rows unless the archive is asked for.
+                    searchStateWhere(statePlans, entityType, options?.view));
                     return sql.exec(q.sql, ...q.params).toArray().map((row) => ({ entityType, id: row.id, rank: row.rank }));
                 },
                 /**
@@ -5260,10 +5299,12 @@ export function defineScopeDO(modules, bareOps) {
                         order: params.order,
                         cursor: params.cursor,
                         filters: params.filters,
+                        // #119: the bin is the checked reader's, never this one's.
+                        view: uncheckedView('ctx.page', entityType, params.view),
                     });
                     const rows = sql.exec(q.sql, ...q.params).toArray();
                     const last = rows.length >= limit ? rows[rows.length - 1] : undefined;
-                    const nextCursor = last === undefined ? null : cursorOf(last, q.sortColumn, plan.idColumn, q.order);
+                    const nextCursor = last === undefined ? null : cursorOf(last, q.sortColumn, plan.idColumn, q.order, q.view);
                     const page = { entries: rows, nextCursor };
                     if (!params.total)
                         return page;
@@ -5329,6 +5370,22 @@ export function defineScopeDO(modules, bareOps) {
                     emit: (event) => writeEvent(event, 'kernel'),
                     assertWrites: (verb) => assertImpersonationWrites(impersonation, verb),
                 }),
+                // #119: archive and trash — the pure adapter's wiring, over the raw spine seam.
+                ...createEntityStateVerbs({
+                    sql: doSpineSql(sql),
+                    plans: statePlans,
+                    now: at,
+                    check: runCheck,
+                    emit: (event) => writeEvent(event, 'kernel'),
+                    assertWrites: (verb) => assertImpersonationWrites(impersonation, verb),
+                }),
+                ...createTrashedReads({
+                    query: (q, params) => sql.exec(q, ...params).toArray(),
+                    listPlans,
+                    searchPlans,
+                    statePlans,
+                    check: runCheck,
+                }),
                 entitlement: async (key) => {
                     const held = await entitlementReader().listEntitlements(tenantId);
                     return held.find((e) => e.key === key) ?? null;