@substrat-run/adapter-cloudflare 0.139.0 → 0.141.0

package/dist/scope-do.js

@@ -1,15 +1,23 @@
 import { REWIND_REFUSED } from './rewind-refusal.js';
 import { SYSTEM_DOOR_MOVED } from './system-door.js';
 import { DurableObject } from 'cloudflare:workers';
-import { ATTACHMENT_ADDED, ATTACHMENT_REMOVED, attachmentRecord, domainEvent, domainEventInput, eventId, instant, objectRef, entityObjectRef, assertModuleEmittableType, assertKernelAuthoredType, toWireFailure, grantRefFromProof, principalId, scopeId as scopeIdOf, tenantId as tenantIdOf, platformRequestInput, platformRequestId, MAX_PENDING_PLATFORM_REQUESTS, MAX_PENDING_SWEEP_RUNS, SWEEP_RUNS_KIND, SCOPE_TABLE_PAGE_MAX, SCOPE_QUERY_ROW_MAX, listLimitOf, requestFingerprint, substratError, errorCodeOf, assertReplayableDump, REDRAIN_BATCH, } from '@substrat-run/contracts';
-import { ulid, DO_SQL_LIMITS, unknownRoleError, createUlid, assertAllowed, ConnectionSealingKeyUnavailableError, noSealingKeyMessage, sealTo, assertReadOnlyQuery, entitlementDenial, platformRequestHistoryQuery, platformRequestOf, PLATFORM_REQUEST_COLUMNS, PLATFORM_REQUEST_REDACTION_SQL, platformRequestRedactionParams, platformRequestRedactionQuery, intentPayloadCarriesSubject, redactSubjectJobRuns, redactSubjectScopeText, assertRowLimit, assertRowOffset, JOB_RUN_PATCH_SQL, JOB_RUN_CLAIM_SQL, JOB_RUN_RENEW_SQL, JOB_RUN_BEGIN_SQL, JOB_RUN_MISS_SQL, JOB_RUN_MISS_SETTLE_SQL, admissionMissOutcome, JOB_LEASE_EXPIRED_NOTE, JOB_STEP_RECORD_SQL, DELIVERY_ERROR_REDACTION_SQL, REDACTED_DELIVERY_NOTE, seatScopeTuple, applyScopeRoleChange, changeScopeRole, revokeScopeRoles, scopeRoleHolders, effectiveRoleGrantQuery, switchRecordedOff, switchSystemSchedules, peerGrantsStatus, systemGrantsStatus, systemScheduleState, systemSwitchedOff, denialListQuery, refusalListQuery, mapRefusalRow, denialSummaryQuery, denialTotalsQuery, DENIAL_WINDOW_QUERY, mapDenialRow, mapDenialSummaryBuckets, PermissionDenied, assertImpersonationWrites, assertModuleEnqueueableKind, impersonationStampOf, createAtomic, NotSearchable, isSearchIndexTable, searchIndexDdl, searchIndexPlans, NotListable, listIndexDdl, listIndexPlans, moduleMigrations, listQuery, cursorOf, searchLimit, searchMatchExpression, searchQuery, ATTACHMENT_TEXT_DDL, attachmentRecordOfRow, enqueueAttachmentText, reconcileAttachmentText, queueAttachmentTextBackfill, startAttachmentTextBackfill, recordAttachmentText, searchAttachments, IDEMPOTENCY_DDL, REFUSALS_TABLE_DDL, REFUSALS_INDEX, refusalInsert, refusalOf, markGuardRefusal, REFUSALS_REBUILD, refusalsAdmitGuards, assertIdempotencyKey, assertPermissionKey, idempotencyLookupQuery, idempotencyPruneStatement, idempotencyRecordStatement, idempotencyOptedOutMessage, replayFor, entityVersionQuery, entityVersionOf, assertIfMatch, OUTBOX_ENTITY_INDEX, SCHEDULE_STATE_DDL, SCHEDULE_STATE_REBUILD, scheduleStateHasKind, VERTICAL_EVENTS_DDL, EXPORT_HOPS_SQL, emptyImportResult, IMPORT_CURSORS_SQL, IMPORT_CURSOR_OF_SQL, OUTBOX_MARK_SQL, exportedSinceQuery, emittedSinceQuery, emittedReportOf, EMITTED_REPORT_CAP, IMPORT_CURSOR_ADVANCE_SQL, IMPORT_RECORD_SQL, moveImportCursor, CrossVerticalRegistry, exportReadPlan, exportReadQuery, planExportBatch, withheldNote, JOB_RUN_DDL, JOB_RUN_DUE_AT, jobRunListLimit, SYSTEM_DOOR_WAIT, ancestorsWithin, } from '@substrat-run/kernel';
-import { isUpgradeRequest, readSubscription, LIVE_FANOUT_LIMIT, LIVE_MODE_HEADER, LIVE_PRINCIPAL_HEADER, LIVE_SCOPE_HEADER, LIVE_SUBSCRIBE_PATH, LIVE_TENANT_HEADER, LIVE_WITHIN_HEADER, decodeLiveWithin, } from './live-reads.js';
+import { ATTACHMENT_ADDED, ATTACHMENT_REMOVED, attachmentRecord, domainEvent, domainEventInput, eventId, instant, objectRef, entityObjectRef, assertModuleEmittableType, assertKernelAuthoredType, toWireFailure, grantRefFromProof, principalId, scopeId as scopeIdOf, tenantId as tenantIdOf, platformRequestInput, platformRequestId, MAX_PENDING_PLATFORM_REQUESTS, MAX_PENDING_SWEEP_RUNS, SWEEP_RUNS_KIND, SCOPE_TABLE_PAGE_MAX, SCOPE_QUERY_ROW_MAX, listLimitOf, pageOf, countedPageOf, requestFingerprint, substratError, errorCodeOf, assertReplayableDump, REDRAIN_BATCH, } from '@substrat-run/contracts';
+import { ulid, LIVE_CLOSE, LIVE_SOCKETS_PER_PRINCIPAL, DO_SQL_LIMITS, unknownRoleError, createUlid, assertAllowed, ConnectionSealingKeyUnavailableError, noSealingKeyMessage, sealTo, assertReadOnlyQuery, entitlementDenial, platformRequestHistoryQuery, platformRequestOf, PLATFORM_REQUEST_COLUMNS, PLATFORM_REQUEST_REDACTION_SQL, platformRequestRedactionParams, platformRequestRedactionQuery, intentPayloadCarriesSubject, redactSubjectJobRuns, eraseSubjectFromModules, moduleErasurePlan, redactSubjectScopeText, assertRowLimit, assertRowOffset, JOB_RUN_PATCH_SQL, JOB_RUN_CLAIM_SQL, JOB_RUN_RENEW_SQL, JOB_RUN_BEGIN_SQL, JOB_RUN_MISS_SQL, JOB_RUN_MISS_SETTLE_SQL, admissionMissOutcome, JOB_LEASE_EXPIRED_NOTE, JOB_STEP_RECORD_SQL, DELIVERY_ERROR_REDACTION_SQL, REDACTED_DELIVERY_NOTE, seatScopeTuple, delegatedRevokeSql, writeExplicitTupleIn, grantEntityShapeIn, topUpEntityGrantShapes, applyScopeRoleChange, changeScopeRole, revokeScopeRoles, scopeRoleHolders, effectiveRoleGrantQuery, switchRecordedOff, switchSystemSchedules, peerGrantsStatus, systemGrantsStatus, systemScheduleState, systemSwitchedOff, denialListQuery, refusalListQuery, mapRefusalRow, denialSummaryQuery, denialTotalsQuery, DENIAL_WINDOW_QUERY, mapDenialRow, mapDenialSummaryBuckets, PermissionDenied, assertImpersonationWrites, assertModuleEnqueueableKind, impersonationStampOf, createAtomic, NotSearchable, isSearchIndexTable, searchIndexPlans, NotListable, listIndexPlans, moduleMigrations, MIGRATION_DIGEST_FENCE_DDL, MIGRATION_DIGEST_MARK_LEGACY, assertJournalDumpCoherent, assertMigrationSql, migrationDivergence, migrationFailedError, migrationSteps, planMigrations, listQuery, cursorOf, searchLimit, searchMatchExpression, searchQuery, ATTACHMENT_TEXT_DDL, attachmentRecordOfRow, enqueueAttachmentText, reconcileAttachmentText, queueAttachmentTextBackfill, startAttachmentTextBackfill, recordAttachmentText, searchAttachments, IDEMPOTENCY_DDL, REFUSALS_TABLE_DDL, REFUSALS_INDEX, refusalInsert, refusalOf, markGuardRefusal, REFUSALS_REBUILD, refusalsAdmitGuards, assertIdempotencyKey, assertPermissionKey, idempotencyLookupQuery, idempotencyPruneStatement, idempotencyRecordStatement, idempotencyOptedOutMessage, replayFor, entityVersionQuery, entityVersionOf, assertIfMatch, OUTBOX_ENTITY_INDEX, SCHEDULE_STATE_DDL, SCHEDULE_STATE_REBUILD, scheduleStateHasKind, VERTICAL_EVENTS_DDL, EXPORT_HOPS_SQL, emptyImportResult, IMPORT_CURSORS_SQL, IMPORT_CURSOR_OF_SQL, OUTBOX_MARK_SQL, exportedSinceQuery, emittedSinceQuery, emittedReportOf, EMITTED_REPORT_CAP, IMPORT_CURSOR_ADVANCE_SQL, IMPORT_RECORD_SQL, moveImportCursor, CrossVerticalRegistry, exportReadPlan, exportReadQuery, planExportBatch, withheldNote, JOB_RUN_DDL, JOB_RUN_DUE_AT, jobRunListLimit, SYSTEM_DOOR_WAIT, ancestorsWithin, } from '@substrat-run/kernel';
+import { isUpgradeRequest, readSubscription, LIVE_DECIDE_ATTEMPTS, LIVE_FANOUT_LIMIT, LIVE_MODE_HEADER, LIVE_PRINCIPAL_HEADER, LIVE_SCOPE_HEADER, LIVE_SUBSCRIBE_PATH, LIVE_TENANT_HEADER, LIVE_WITHIN_HEADER, LIVE_EXPIRES_HEADER, decodeLiveWithin, liveInstant, } from './live-reads.js';
 import { replyOf } from './do-reply.js';
 import { OperationQueue } from './serialization.js';
-import { doScopedSql, doBuiltColumnsOf, doRedactionSql, doSpineSql } from './sql.js';
-import { actorOf, admitPeer, collectPeers, switchPeer, peerSubjectRef, subjectGrantState, assertNoSecret, CAPABILITY_DDL, COPY_ORIGIN_DDL, ENTITY_STATE_MOVES_DDL, SWITCH_FENCES_DDL, CAPABILITY_EXCHANGE_OPERATION, capabilityAttachmentWriteRefused, createCapabilityVerbs, createEntityEdgeVerbs, createEntityStateVerbs, createTrashedReads, searchStateWhere, uncheckedView, addStatePlans, entityStateTriggerDdl, statefulTablesOf, assertEntityStateIntact, stateListIndexNames, exchangeCapability, guardSecrets, mintBecomeCapability, redactSecrets, redactSecretText, moduleLog, asyncInvocationId, asyncLinePass, resolveCapabilitySession, revokeCapabilityAsPlatform, readCapabilityPage, domainEventOf, facetEvents, readDeadLetters, readLifecycleFlow, readOperationSeries, readHistory, readInvocation, readUndrainedOutbox, walkEventCause, walkEventEffects, } from '@substrat-run/kernel';
+import { assertNoWorkerdStorage, doScopedSql, doBuiltColumnsOf, doRedactionSql, doSpineSql } from './sql.js';
+import { actorOf, admitPeer, collectPeers, switchPeer, peerSubjectRef, subjectGrantState, assertNoSecret, CAPABILITY_DDL, COPY_ORIGIN_DDL, ENTITY_STATE_MOVES_DDL, SWITCH_FENCES_DDL, TABLE_OWNERS_DDL, assertMigrationLeavesLedgerAlone, recordOwnershipSteps, runMigrationStatements, splitSqlStatements, executableSqlStatements, blankSqlComments, CAPABILITY_EXCHANGE_OPERATION, capabilityAttachmentWriteRefused, createCapabilityVerbs, createEntityEdgeVerbs, createEntityStateVerbs, createTrashedReads, CONTINUATION_POSITION_CAP, visibleContinuation, searchStateWhere, uncheckedView, addStatePlans, assertNoCallerPurge, isUnreachableParent, PURGE_BATCH, heldPurgePass, lifecycleRefusal, purgeHeldBy, purgeDueOf, purgeOnlyKeysOf, runPurgePass, refuseTrashedTarget, registerTrashTargets, withheldKeysFor, statefulTablesOf, afterMigration, afterRuntimeDdl, derivesAnything, repairDerivedObjects, StateColumnLost, exchangeCapability, guardSecrets, mintBecomeCapability, redactSecrets, redactSecretText, moduleLog, asyncInvocationId, asyncLinePass, resolveCapabilitySession, revokeCapabilityAsPlatform, readCapabilityPage, domainEventOf, facetEvents, readDeadLetters, readLifecycleFlow, readOperationSeries, readHistory, readInvocation, readUndrainedOutbox, walkEventCause, walkEventEffects, } from '@substrat-run/kernel';
+import { COPY_RESTORE_FENCE_LAPSED, copyRestoreFenceLapsed } from '@substrat-run/kernel';
 import { createDoTupleChecker, createLocalControlPlaneReader, scopeTupleReader } from './checker.js';
-import { CARRIED_AWAY_KEY, COPY_MARK_CLEARED_KEY, KEPT_COPY_REFUSAL, KEPT_DIVERGENT_KEY, LOAD_STAMP_KEY, STORE_LOCAL_META_KEYS, WRITE_REVISION_KEY, carriedAwayDump, isCopyMarkInsert, isWriteStatement, assertNoSpineReference, assertSpineTablesBuilt, capabilitiesForLoad, clearCopyMarker, dumpRowsInsert, isSpineTable, markCopyOrigin, repointScopeGrants, settleCopiedWork, emittedHere, IS_COPY_SQL, isCopyLoad, isLifecycleWrite, readLifecycle, settleLifecycleAfterLoad, writeLifecycle, spineColumnAdditions } from '@substrat-run/kernel';
+import { settlePlatformRequestIn } from '@substrat-run/kernel';
+import { CARRIED_AWAY_KEY, COPY_MARK_CLEARED_KEY, KEPT_COPY_REFUSAL, KEPT_DIVERGENT_KEY, LOAD_STAMP_KEY, STORE_LOCAL_META_KEYS, WRITE_REVISION_KEY, carriedAwayDump, isCopyMarkInsert, isWriteStatement, assertSpineTablesBuilt, capabilitiesForLoad, clearCopyMarker, dumpRowsInsert, isSpineTable, markCopyOrigin, repointScopeGrants, settleCopiedWork, emittedHere, IS_COPY_SQL, isCopyLoad, isLifecycleWrite, readLifecycle, settleLifecycleAfterLoad, writeLifecycle, spineColumnAdditions } from '@substrat-run/kernel';
+import { GRANT_CHILDREN_INDEX_DDL, grantedEntitiesForContext } from '@substrat-run/kernel';
+/** A scope's migration journal: `module@version` → the SQL digest it recorded (#2066). */
+function readAppliedMigrations(sql) {
+    const rows = sql.exec('SELECT module_id, version, sql_digest FROM _substrat_migrations').toArray();
+    return new Map(rows.map((r) => [`${r.module_id}@${r.version}`, r.sql_digest]));
+}
 /**
  * The key marking a scope DO whose storage was destroyed (`destroyStorage`).
  * Written after `deleteAll()` so it survives the wipe, and never cleared: `reaped`
@@ -32,6 +40,9 @@ const foreignTenant = (held, tenantId) => held !== null
     : `refused: this scope holds role rows for another tenant and none for ${tenantId}`;
 /** #2016: the load refusals `tenantReceiptRefusal` raised, told apart by identity, not by text. */
 const tenantRefusals = new WeakSet();
+/** #1722: a load refused because its copy move's lease ran out (`CopyRestoreFence`), told apart
+ *  from a store that moved, since the host must not read it as an applied retry. */
+const fenceRefusals = new WeakSet();
 /**
  * The scope spine, as this adapter builds it — one of two hand-written copies (#969).
  *
@@ -179,8 +190,13 @@ const KERNEL_DDL = `
     applied_at TEXT NOT NULL,
     duration_ms INTEGER,
     rows_changed INTEGER,
+    -- #2066: SHA-256 of the SQL that ran (kernel migrationDigest). NULL on a row written
+    -- before the column: unrecorded, accepted, never backfilled.
+    sql_digest TEXT,
     PRIMARY KEY (module_id, version)
   );
+  -- #2066: no new journal row without its digest (the kernel's comment says why).
+  ${MIGRATION_DIGEST_FENCE_DDL}
   -- #286: the PITR bookmark taken immediately BEFORE a migration pass runs on a
   -- scope that already holds data -- the precise rewind point a backout restores
   -- to. Rows live in the same storage they describe, so a rewind erases the rows
@@ -192,6 +208,7 @@ const KERNEL_DDL = `
     pending TEXT NOT NULL
   );
   ${SWITCH_FENCES_DDL}
+  ${TABLE_OWNERS_DDL}
   CREATE TABLE IF NOT EXISTS _substrat_tuples (
     subject TEXT NOT NULL,
     relation TEXT NOT NULL,
@@ -202,6 +219,7 @@ const KERNEL_DDL = `
     revoked_at TEXT,
     PRIMARY KEY (subject, relation, object)
   );
+  ${GRANT_CHILDREN_INDEX_DDL};
   CREATE TABLE IF NOT EXISTS _substrat_deliveries (
     event_id TEXT NOT NULL,
     consumer_module TEXT NOT NULL,
@@ -420,6 +438,17 @@ class WriteRevision {
     keeping = false;
     /** A statement's text is almost always a constant, so its answer is remembered (bounded). */
     writes = new Map();
+    /**
+     * Every write statement run through this handle since the object woke, in memory (#938, Codex
+     * #2077 r4) — counted per STATEMENT, bookkeeping and suspended ones included, where the durable
+     * revision above is bumped once per run. A live fan-out pass decides who may hear a frame across
+     * awaits; it reads this immediately before deciding and again immediately before sending, with
+     * no await between that second read and the send, and decides again when it moved. Per statement
+     * because a decision taken between a transaction's first write (its bump) and a later one (the
+     * revoke itself) must not read as current. Over-counting (a rolled-back write, a write no check
+     * reads) only costs a pass a re-check.
+     */
+    written = 0;
     sql;
     constructor(raw, storage, suspended, 
     /** Why this store takes no write at all right now, or null (a `carried_away` copy, #1722). */
@@ -429,7 +458,10 @@ class WriteRevision {
         this.suspended = suspended;
         this.refusal = refusal;
         const exec = (query, ...bindings) => {
-            if (this.keeping && this.isWrite(query)) {
+            const write = this.isWrite(query);
+            if (write)
+                this.written++;
+            if (this.keeping && write) {
                 // Bookkeeping takes the copy-marker insert and the lifecycle delivery (#1713) and nothing
                 // else: any other write here would be one the revision never saw, which is the hole this
                 // class exists to close.
@@ -438,7 +470,7 @@ class WriteRevision {
                 }
                 return raw.exec(query, ...bindings);
             }
-            if (!this.suspended() && this.isWrite(query)) {
+            if (write && !this.suspended()) {
                 const refused = this.refusal();
                 if (refused)
                     throw substratError('conflict', refused);
@@ -504,6 +536,10 @@ class WriteRevision {
             this.covered = false;
         });
     }
+    /** How many write statements this handle has run (see `written`). */
+    get statementsWritten() {
+        return this.written;
+    }
     isWrite(query) {
         let known = this.writes.get(query);
         if (known === undefined) {
@@ -590,8 +626,6 @@ function cellToJson(v) {
  * trigger: it passed on better-sqlite3 (whose `exec` takes the whole blob) and
  * failed every scope on the DO host.
  */
-const IS_CREATE_TRIGGER = /^\s*CREATE\s+(TEMP\s+|TEMPORARY\s+)?TRIGGER\b/i;
-const ENDS_WITH_END = /\bEND\s*$/i;
 /**
  * The kernel's two-method SQL handle (`SwitchSql`) over a Durable Object's storage — what the
  * shared switch rules (#1666) and the directory's switch record (#1674) run through. One
@@ -605,67 +639,8 @@ export function switchSqlOver(sql) {
         },
     };
 }
-export function splitSqlStatements(sql) {
-    const out = [];
-    let cur = '';
-    const n = sql.length;
-    let i = 0;
-    while (i < n) {
-        const c = sql[i];
-        const c2 = sql[i + 1];
-        if (c === '-' && c2 === '-') {
-            while (i < n && sql[i] !== '\n')
-                i += 1; // line comment → end of line
-            continue;
-        }
-        if (c === '/' && c2 === '*') {
-            i += 2;
-            while (i < n && !(sql[i] === '*' && sql[i + 1] === '/'))
-                i += 1;
-            i += 2; // block comment → past the closing */
-            continue;
-        }
-        if (c === "'") {
-            cur += c;
-            i += 1;
-            while (i < n) {
-                cur += sql[i];
-                if (sql[i] === "'") {
-                    if (sql[i + 1] === "'") {
-                        cur += sql[i + 1]; // '' is an escaped quote, still inside the string
-                        i += 2;
-                        continue;
-                    }
-                    i += 1;
-                    break;
-                }
-                i += 1;
-            }
-            continue;
-        }
-        if (c === ';') {
-            // Inside a trigger body, a `;` ends an inner statement, not the CREATE.
-            // `END` is matched as a bare word at the end of what has accumulated —
-            // a string literal ending in END reads as `…END'`, so the quote keeps it
-            // from matching, and the string scanner above has already copied it whole.
-            if (IS_CREATE_TRIGGER.test(cur) && !ENDS_WITH_END.test(cur)) {
-                cur += c;
-                i += 1;
-                continue;
-            }
-            if (cur.trim())
-                out.push(cur.trim());
-            cur = '';
-            i += 1;
-            continue;
-        }
-        cur += c;
-        i += 1;
-    }
-    if (cur.trim())
-        out.push(cur.trim());
-    return out;
-}
+/** The splitter both adapters run migrations through — the kernel's, re-exported for this package's callers. */
+export { splitSqlStatements };
 /**
  * #1834: the pin missed. Thrown only by `assertSystemDoor`, and module-private, so no operation can
  * throw one: the two RPCs a door call reaches turn it into the `SystemDoorMoved` ANSWER, by class
@@ -675,9 +650,51 @@ class SystemDoorMovedError extends Error {
 }
 /** #1834: the brand only `assertSystemDoor` sets, so nothing else can make a `SystemDoorPass`. */
 const SYSTEM_DOOR_PASSED = Symbol('system door passed');
+/** Close a live socket whose session has ended (#938). */
+function closeSessionEnded(ws) {
+    try {
+        ws.close(LIVE_CLOSE.revoked, 'the session that opened this subscription has ended');
+    }
+    catch {
+        // Already gone.
+    }
+}
 export function defineScopeDO(modules, bareOps) {
     return class ScopeDO extends DurableObject {
         sql;
+        continuationOrder = 0;
+        /** DO storage KV is private to the adapter; neither module SQL nor dumps can read it. */
+        continuationStore(writable) {
+            const positionKey = (id, expiresAt) => `continuation:position:${String(expiresAt).padStart(13, '0')}:${id}`;
+            return {
+                keys: async () => (await this.ctx.storage.get('continuation:keys')) ?? null,
+                setKeys: async (keys) => { await this.ctx.storage.put('continuation:keys', keys); },
+                position: async (id, expiresAt) => {
+                    if (writable)
+                        await this.pruneContinuationPositions();
+                    return (await this.ctx.storage.get(positionKey(id, expiresAt))) ?? null;
+                },
+                setPosition: async (id, position) => {
+                    // Several budget stops can land in one millisecond. Keep insertion
+                    // order explicit so the cap always evicts the first locator minted.
+                    this.continuationOrder = Math.max(Date.now() * 1_000, this.continuationOrder + 1);
+                    await this.ctx.storage.put(positionKey(id, position.expiresAt), {
+                        ...position, order: this.continuationOrder,
+                    });
+                    await this.pruneContinuationPositions();
+                },
+            };
+        }
+        async pruneContinuationPositions() {
+            const positions = await this.ctx.storage.list({ prefix: 'continuation:position:' });
+            const live = [...positions].filter(([, record]) => record.expiresAt > Date.now())
+                .sort((a, b) => (a[1].order ?? 0) - (b[1].order ?? 0));
+            const evict = new Set(live.slice(0, Math.max(0, live.length - CONTINUATION_POSITION_CAP)).map(([name]) => name));
+            for (const [name, record] of positions) {
+                if (record.expiresAt <= Date.now() || evict.has(name))
+                    await this.ctx.storage.delete(name);
+            }
+        }
         queue = new OperationQueue();
         operations = new Map();
         /**
@@ -688,6 +705,12 @@ export function defineScopeDO(modules, bareOps) {
         operationInput = new Map();
         /** #129: name → the entity whose version an `If-Match` is compared against. */
         operationConcurrency = new Map();
+        /** #119: name → the entity it addresses by id — the host's trash refusal reads it. */
+        operationTarget = new Map();
+        /** #119: module id → the keys its system principal holds only for its purge schedules. */
+        purgeOnlyKeys = new Map();
+        /** #119: a purge schedule's operation → the module that declared it and the entity it purges. */
+        purgeSchedules = new Map();
         /** #116: the operations that declared `idempotency: false` — refusals, not participants. */
         operationIdempotencyOptOut = new Set();
         modules = new Map();
@@ -713,6 +736,8 @@ export function defineScopeDO(modules, bareOps) {
         listPlans = new Map();
         /** #119: entity type → its archive/trash plan, from every registered module. */
         statePlans = new Map();
+        /** #2068: each registered module's erasure, in registration order — what `redactSubject` runs. */
+        erasurePlans = [];
         /** entityType → the declared attachment gate (#473): read key + write key (default: read). */
         attachmentTargets = new Map();
         /**
@@ -736,7 +761,8 @@ export function defineScopeDO(modules, bareOps) {
          * underneath rows it already stored.
          */
         mintEventId = createUlid();
-        applied = new Set();
+        /** `module@version` → the SQL digest its journal row recorded, null for a row from before #2066. */
+        applied = new Map();
         migrationPromise;
         /** Latch: the applied count is reported to the directory once per DO instance. */
         schemaVersionReported = false;
@@ -779,7 +805,7 @@ export function defineScopeDO(modules, bareOps) {
             // transaction on `ctx.storage` itself (`carried-copy.test.ts` in the kernel holds that).
             this.revision = new WriteRevision(ctx.storage.sql, ctx.storage, () => this.revisionSuspended, () => (this.carriedAwayCopy ? CARRIED_AWAY_WRITE_REFUSAL : null));
             this.sql = this.revision.sql;
-            for (const stmt of splitSqlStatements(KERNEL_DDL)) {
+            for (const stmt of executableSqlStatements(KERNEL_DDL)) {
                 this.sql.exec(stmt);
             }
             this.applySpineColumnAdditions();
@@ -790,11 +816,7 @@ export function defineScopeDO(modules, bareOps) {
             for (const [name, handler] of Object.entries(bareOps))
                 this.defineOperation(name, handler);
             // Which migrations have already run (a warm DO wakes with rows here).
-            for (const row of this.sql
-                .exec('SELECT module_id, version FROM _substrat_migrations')
-                .toArray()) {
-                this.applied.add(`${row.module_id}@${row.version}`);
-            }
+            this.applied = readAppliedMigrations(this.sql);
             // #1335: and where this DO's event ids have to resume from. A revived DO would
             // otherwise start its floor at the wall clock, and a clock that has stepped back
             // — an NTP correction is small but real — mints underneath rows already stored,
@@ -810,6 +832,15 @@ export function defineScopeDO(modules, bareOps) {
         // -- module registration (port of SqliteScopeHost.registerModule) ---------
         registerModule(registration) {
             const manifest = registration.manifest;
+            // #119: refused before anything is recorded, as in the pure adapter.
+            const trashTargets = registerTrashTargets(manifest.id, new Set(Object.keys(registration.operations ?? {})), registration.operationInputs, manifest.entityStates, manifest.schedules);
+            this.purgeOnlyKeys.set(manifest.id, purgeOnlyKeysOf(manifest.schedules ?? []));
+            for (const schedule of manifest.schedules ?? []) {
+                if (schedule.purge)
+                    this.purgeSchedules.set(schedule.operation, { moduleId: manifest.id, entityType: schedule.purge.entityType });
+            }
+            // #2068: refused before anything is recorded, as on the pure host.
+            const erasure = moduleErasurePlan(registration);
             if (manifest.peers?.length)
                 this.peerSources.push({ peers: manifest.peers });
             // #827: the FTS indexes `searchables` declares, appended after the module's
@@ -841,11 +872,14 @@ export function defineScopeDO(modules, bareOps) {
                 id: manifest.id,
                 // The order the kernel writes once (#1677): authored, then search, then list indexes.
                 migrations: moduleMigrations(registration),
+                steps: migrationSteps(registration),
                 consumers: Object.entries(registration.consumers ?? {}).map(([eventType, handler]) => ({
                     eventType,
                     handler,
                 })),
             });
+            if (erasure)
+                this.erasurePlans.push(erasure);
             for (const [name, handler] of Object.entries(registration.predicates ?? {})) {
                 this.predicates.set(name, { module: manifest.id, handler });
             }
@@ -932,6 +966,9 @@ export function defineScopeDO(modules, bareOps) {
                 if (declaredOptOuts.includes(name) && this.operations.has(name)) {
                     this.operationIdempotencyOptOut.add(name);
                 }
+                const target = trashTargets.get(name);
+                if (target && this.operations.has(name))
+                    this.operationTarget.set(name, target);
             }
         }
         defineOperation(name, handler) {
@@ -1571,10 +1608,10 @@ export function defineScopeDO(modules, bareOps) {
          * Provisioning does not come through here; it seats with `seatTuple` (#1659).
          */
         async writeTuple(subject, relation, object, expiresAt) {
-            await this.queue.enqueue(() => {
-                this.sql.exec(`INSERT OR REPLACE INTO _substrat_tuples (subject, relation, object, expires_at)
-           VALUES (?, ?, ?, ?)`, subject, relation, object, expiresAt);
-            });
+            return replyOf(() => this.queue.enqueue(() => {
+                writeExplicitTupleIn(this.switchSql(), subject, relation, object, { kind: 'replace', expiresAt });
+                return null;
+            }));
         }
         /**
          * Provisioning's scope-tuple write (#1659): create the row if it is missing, follow the
@@ -1604,6 +1641,26 @@ export function defineScopeDO(modules, bareOps) {
                 return switchOff ? switchRecordedOff(this.switchSql(), switchOff) : [];
             }));
         }
+        /** A declared entity-grant shape's grant to one person on one entity (#2071), as ONE unit. */
+        async grantEntityShape(principal, entity, permissions) {
+            await this.queue.enqueue(() => this.revision.transactionSync(() => grantEntityShapeIn(this.switchSql(), principal, entity, permissions)));
+        }
+        /**
+         * One bounded pass of a declared shape's reconcile (#2071), with its events, in ONE
+         * transaction: how many it topped up, how many it took retired keys from (#2082), and
+         * whether the scope is done.
+         */
+        async topUpEntityGrantShapes(tenantId, scopeId, shapes, limit) {
+            return this.queue.enqueue(() => this.revision.transactionSync(() => topUpEntityGrantShapes(this.switchSql(), {
+                tenantId,
+                scopeId,
+                shapes,
+                now: new Date().toISOString(),
+                limit,
+                mintEventId: (ms) => this.mintEventId(ms),
+                version: this.env.SUBSTRAT_VERSION_ID ?? null,
+            })));
+        }
         /**
          * The dispatch capability's admission (#726 remedy B): this delivery may read the
          * attachments of the entity its own spine row names, and no others.
@@ -1733,7 +1790,7 @@ export function defineScopeDO(modules, bareOps) {
                 // Legacy path, byte-for-byte what it was: rewrapped so a non-plain error (a
                 // ZodError, whose `message` is a getter) still arrives with its message.
                 try {
-                    return await this.invokeOrThrow(operation, input, principal, tenantId, scopeId, connectionId, requiredEntitlement, systemModuleId, invokeOptions, impersonation, capabilitySession, verticalCaller, systemDoorInstance);
+                    return await this.#invokeOrThrow(operation, input, principal, tenantId, scopeId, connectionId, requiredEntitlement, systemModuleId, invokeOptions, impersonation, capabilitySession, verticalCaller, systemDoorInstance);
                 }
                 catch (err) {
                     if (err instanceof SystemDoorMovedError)
@@ -1742,7 +1799,7 @@ export function defineScopeDO(modules, bareOps) {
                 }
             }
             try {
-                return await this.invokeOrThrow(operation, input, principal, tenantId, scopeId, connectionId, requiredEntitlement, systemModuleId, invokeOptions, impersonation, capabilitySession, verticalCaller, systemDoorInstance);
+                return await this.#invokeOrThrow(operation, input, principal, tenantId, scopeId, connectionId, requiredEntitlement, systemModuleId, invokeOptions, impersonation, capabilitySession, verticalCaller, systemDoorInstance);
             }
             catch (err) {
                 // #1834: the pin missed — an answer, never a failure an operation could have produced.
@@ -1754,8 +1811,14 @@ export function defineScopeDO(modules, bareOps) {
                 return { result: undefined, platformRequests: 0, failure: toWireFailure(err) };
             }
         }
-        /** The operation path itself. Throws; `invoke` decides how that reaches the caller. */
-        async invokeOrThrow(operation, input, principal, tenantId, scopeId, connectionId, requiredEntitlement, systemModuleId, invokeOptions, 
+        /**
+         * The operation path itself. Throws; `invoke` decides how that reaches the caller.
+         *
+         * `#`-private, not merely `private`: workerd's RPC exposes every method on the prototype,
+         * and this one takes `purge` (#119), which only `runPurgeSweep` may set. A `#` method is not
+         * on the prototype, so no stub can reach it.
+         */
+        async #invokeOrThrow(operation, input, principal, tenantId, scopeId, connectionId, requiredEntitlement, systemModuleId, invokeOptions, 
         /** K-42: the session, resolved coordinator-side. See `invoke` above. */
         impersonation, 
         /** #1672: a capability session's hash. See `invoke` above. */
@@ -1763,7 +1826,9 @@ export function defineScopeDO(modules, bareOps) {
         /** #1706: the calling vertical, as the platform named it. See `invoke` above. */
         verticalCaller, 
         /** #1834: the instance the system door's gate read. See `invoke` above. */
-        systemDoorInstance) {
+        systemDoorInstance, 
+        /** #119: set only by `runPurgeSweep` on its own invokes — never an RPC argument. */
+        purge) {
             await this.ensureMigrations();
             const handler = this.operations.get(operation);
             // `not_found`, not a bare throw (#113): every vertical hand-matched this message
@@ -1798,6 +1863,8 @@ export function defineScopeDO(modules, bareOps) {
             // declaration. Outside the queue and outside the transaction: a malformed
             // call takes no turn and opens nothing. Guards read the parsed input too,
             // so a K-17 pre-condition sees what the handler will.
+            // #119: purge authority is never an option a caller supplies.
+            assertNoCallerPurge(invokeOptions);
             const declaredInput = this.operationInput.get(operation);
             const parsed = declaredInput ? declaredInput.parse(input) : input;
             // #129. Refused rather than ignored, for the reason the coordinator refuses an
@@ -1924,8 +1991,16 @@ export function defineScopeDO(modules, bareOps) {
                     // commit together, or a throw (from either) rolls domain writes AND
                     // emitted events back as one — verified across `await` in workerd.
                     try {
+                        // #119: a module's purge-only keys are withheld from its system principal on every
+                        // call but the purge sweep's own invoke of the purge operation.
+                        const target = this.operationTarget.get(operation);
+                        // #119: purge authority is the system door's, and only `runPurgeSweep` sets `purge`.
+                        const purging = purge === true && systemDoor !== undefined;
+                        const withheld = systemDoor
+                            ? withheldKeysFor(this.purgeOnlyKeys.get(systemDoor.moduleId), target, purging)
+                            : undefined;
                         await this.revision.transaction(async () => {
-                            const ctx = this.operationContext(principal, tenantId, scopeId, undefined, connectionId, systemDoor, signals, impersonation, operation, capabilityId, minted, undefined, peerSubject);
+                            const ctx = this.operationContext(principal, tenantId, scopeId, undefined, connectionId, systemDoor, signals, impersonation, operation, capabilityId, minted, undefined, peerSubject, undefined, withheld);
                             // #116: a retry is answered from the recording, and nothing else runs
                             // — not the guards, not the handler, not the permission check inside
                             // it. Keyed by SUBJECT, so a caller only ever reaches its own
@@ -1952,6 +2027,9 @@ export function defineScopeDO(modules, bareOps) {
                             const seen = guardedRef && invokeOptions?.ifMatch !== undefined
                                 ? this.versionAt(guardedRef)
                                 : undefined;
+                            // #119: the host's trash refusal, before the guards and the handler — the pure
+                            // adapter's, through the same kernel function.
+                            await refuseTrashedTarget({ sql: doSpineSql(this.sql), plans: this.statePlans, check: ctx.check }, operation, target, parsed, purging ? { now: new Date().toISOString(), gate: this.purgeGateFacts(systemDoor.moduleId, tenantId) } : undefined);
                             await this.runGuards(operation, ctx, parsed);
                             result = await handler(ctx, parsed);
                             if (guardedRef && invokeOptions?.ifMatch !== undefined) {
@@ -2148,12 +2226,57 @@ export function defineScopeDO(modules, bareOps) {
             if (withinHeader !== null && !within) {
                 return new Response('live reads: unreadable within narrowing', { status: 500 });
             }
+            // The same for an expiry: dropping it would keep the socket open past its session.
+            const expiresHeader = request.headers.get(LIVE_EXPIRES_HEADER);
+            const expiresAt = expiresHeader === null ? undefined : liveInstant(expiresHeader);
+            if (expiresHeader !== null && !expiresAt) {
+                return new Response('live reads: unreadable expiry', { status: 500 });
+            }
             // A subscriber arriving before the scope's migrations have run would be told
             // about events against a schema it cannot read back through. Same gate every
             // other entry point takes, for the same reason.
             await this.ensureMigrations();
+            // `.parse`, not a cast: these three arrived as header strings, and the branded
+            // ids are what every check downstream is keyed on. A malformed one would
+            // otherwise be carried all the way to a `ctx.check` that quietly matches nothing —
+            // which reads as "this subscriber may see nothing" and is indistinguishable from
+            // a correct denial. Refused here instead, where it is still one subscriber's
+            // problem. Throwing is right: the coordinator built this request.
+            const subscriber = {
+                principal: principalId.parse(principal),
+                tenantId: tenantIdOf.parse(tenantId),
+                scopeId: scopeIdOf.parse(scopeId),
+            };
+            // A checked root (#938) is gated here as well as on every pass: a subscriber who may
+            // not watch it gets no socket at all, so its client meets a refusal rather than a
+            // feed that would close on the first thing it had to say. A session already over is
+            // refused the same way.
+            const expired = expiresAt !== undefined && expiresAt <= new Date().toISOString();
+            if (expired ||
+                (within?.checked !== undefined && !(await this.mayWatchRoot(() => this.liveContext(subscriber), within)))) {
+                return new Response('live reads: the subscriber may not watch this root', {
+                    status: 403,
+                    headers: { [LIVE_MODE_HEADER]: 'forbidden' },
+                });
+            }
             const pair = new WebSocketPair();
             const [client, server] = Object.values(pair);
+            /**
+             * At most `LIVE_SOCKETS_PER_PRINCIPAL` sockets per principal on this scope (#938):
+             * each is work on every post-commit pass. The extra one is accepted and closed at
+             * once with `4429`, rather than refused with a status, because a browser never sees
+             * a failed handshake's status — only a close code, which the client reads as "poll
+             * and stop asking". Not hibernated, so it never joins the roster the fan-out walks.
+             *
+             * Counted over the sockets still live: one whose session has ended is closed here
+             * first, so sockets that expired on an idle scope never hold a fresh session out.
+             */
+            const held = this.reapExpiredLive().filter((s) => s.principal === subscriber.principal).length;
+            if (held >= LIVE_SOCKETS_PER_PRINCIPAL) {
+                server.accept();
+                server.close(LIVE_CLOSE.tooMany, 'too many live subscriptions for this principal; poll instead');
+                return new Response(null, { status: 101, webSocket: client });
+            }
             // HIBERNATABLE, not `server.accept()`. A scope with a watcher open would
             // otherwise be pinned in memory for as long as somebody has a tab open, which is
             // the cost model inverted: a support desk being WATCHED is the normal state.
@@ -2161,21 +2284,94 @@ export function defineScopeDO(modules, bareOps) {
             // eviction, so the socket would stay open and silently stop receiving, which is
             // indistinguishable from a quiet scope.
             this.ctx.acceptWebSocket(server);
-            // `.parse`, not a cast: these three arrived as header strings, and the branded
-            // ids are what every check downstream is keyed on. A malformed one would
-            // otherwise be carried all the way to a `ctx.check` that quietly matches nothing —
-            // which reads as "this subscriber may see nothing" and is indistinguishable from
-            // a correct denial. Refused here instead, where it is still one subscriber's
-            // problem. Throwing is right: the coordinator built this request.
             server.serializeAttachment({
-                principal: principalId.parse(principal),
-                tenantId: tenantIdOf.parse(tenantId),
-                scopeId: scopeIdOf.parse(scopeId),
+                ...subscriber,
                 since: new Date().toISOString(),
                 ...(within ? { within } : {}),
+                ...(expiresAt ? { expiresAt } : {}),
             });
+            if (expiresAt)
+                await this.armLiveExpiry();
             return new Response(null, { status: 101, webSocket: client });
         }
+        /**
+         * Close every live socket whose session has ended (`1008`), and return the
+         * subscriptions still open (#938). Reads only the sockets' own attachments, never the
+         * database, so it is as cheap on a scope nobody writes to as on a busy one.
+         */
+        reapExpiredLive(now = new Date().toISOString()) {
+            const live = [];
+            for (const ws of this.ctx.getWebSockets()) {
+                let s = null;
+                try {
+                    s = readSubscription(ws.deserializeAttachment());
+                }
+                catch {
+                    s = null;
+                }
+                if (!s)
+                    continue;
+                if (s.expiresAt !== undefined && s.expiresAt <= now) {
+                    closeSessionEnded(ws);
+                    continue;
+                }
+                live.push(s);
+            }
+            return live;
+        }
+        /**
+         * Arm the scope's alarm for the earliest session end among its live sockets (#938), so
+         * an expired socket is closed on a scope nobody writes to — the fan-out closes them
+         * too, but only on a pass, and an idle scope has none.
+         *
+         * Only ever moved EARLIER: an alarm already set before that instant is kept, and the
+         * handler re-arms for whatever is next. Re-arming on a close is not needed: an alarm
+         * that finds the socket already gone simply arms for the next one, or for nothing.
+         *
+         * The live reaper is this DO's only alarm use. A second one must share `alarm()` and
+         * this "earliest wins" rule, not call `setAlarm` on its own. The alarm makes workerd
+         * keep a `_cf_METADATA` table in the scope's SQLite; every table walk here skips
+         * `_cf_*` for that reason (`exportDump`, `importDump`, `introspectTables`).
+         */
+        async armLiveExpiry() {
+            let earliest;
+            for (const s of this.reapExpiredLive()) {
+                if (s.expiresAt !== undefined && (earliest === undefined || s.expiresAt < earliest))
+                    earliest = s.expiresAt;
+            }
+            if (earliest === undefined)
+                return;
+            const at = Date.parse(earliest);
+            const current = await this.ctx.storage.getAlarm();
+            if (current === null || current > at)
+                await this.ctx.storage.setAlarm(at);
+        }
+        /** The live reaper's alarm (#938): close what has expired, then arm for what is next. */
+        async alarm() {
+            await this.armLiveExpiry();
+        }
+        /** The context a live subscriber's checks run in: its own principal, under `live.subscribe`. */
+        liveContext(subscriber) {
+            return this.operationContext(subscriber.principal, subscriber.tenantId, subscriber.scopeId, undefined, undefined, undefined, undefined, undefined, 'live.subscribe');
+        }
+        /**
+         * May this subscriber watch its `checkedWithin` root (#938)? Its own `ctx.check` of the
+         * stated key on the root, the same walk a read of the root would make. A check that
+         * throws is a refusal: an outage in the permission path must not become a feed.
+         */
+        async mayWatchRoot(context, within) {
+            try {
+                // Built inside the try: a context that cannot be built is a refusal too.
+                const decision = await context().check(within.checked, {
+                    entityType: within.entityType,
+                    entityId: within.entityId,
+                });
+                return decision.allowed;
+            }
+            catch {
+                return false;
+            }
+        }
         /**
          * A subscriber said something.
          *
@@ -2195,6 +2391,9 @@ export function defineScopeDO(modules, bareOps) {
          */
         webSocketMessage(ws, message) {
             this.webSocketMessagesHandled++;
+            // Ungated, and safe to be: the reply is the constant `'pong'` and carries no event, no
+            // entity and no time, so it tells the socket nothing it did not already know. Every
+            // frame that is about the scope's data goes out through `fanOutLive`'s gates instead.
             if (message === 'ping')
                 ws.send('pong');
         }
@@ -2328,12 +2527,33 @@ export function defineScopeDO(modules, bareOps) {
              * operation has already moved the edge the walk follows.
              */
             const parents = scopeTupleReader(this.sql);
-            const now = new Date().toISOString();
+            /**
+             * A checked root's gate, asked once per (principal, key, root) per pass (#938): a
+             * principal holding that root in several tabs is one check, fanned out to each socket.
+             */
+            const rootChecks = new Map();
             const ancestors = new Map();
-            const reaches = async (row, root) => {
+            const openEpoch = (now) => ({
+                writes: this.revision.statementsWritten,
+                until: this.authorityLapsesAfter(now),
+                remote: this.permissionSourceIsRemote(),
+            });
+            const holds = (e, now) => e.writes === this.revision.statementsWritten && (e.until === null || now < e.until);
+            let epoch = openEpoch(new Date().toISOString());
+            /** The epoch current at `now`, opening a new one (and forgetting every memo) if not. */
+            const epochAt = (now) => {
+                if (!holds(epoch, now)) {
+                    epoch = openEpoch(now);
+                    rootChecks.clear();
+                    ancestors.clear();
+                }
+                return epoch;
+            };
+            const reaches = async (row, root, now) => {
                 let up = ancestors.get(row.id);
                 if (!up) {
                     // A walk that cannot answer is a frame not sent — the same fail-closed rule as the check.
+                    // Walked at the decision's own instant; remembered only while its epoch holds.
                     up = ancestorsWithin(parents, { entityType: row.entity_type, entityId: row.entity_id }, now).catch(() => new Set());
                     ancestors.set(row.id, up);
                 }
@@ -2357,6 +2577,18 @@ export function defineScopeDO(modules, bareOps) {
                 // assumption about how the subscription was created.
                 if (subscription.tenantId !== tenantId || subscription.scopeId !== scopeId)
                     continue;
+                // The session that opened it has ended (#938): closed before anything is sent,
+                // whatever the subscriber's grants still say. Checked on every pass, so it holds for
+                // every kind of subscription, not only the ones with a gate to ask — and asked
+                // again, against a fresh clock, immediately before every send below, because the
+                // walk and the checks between here and there await, and a session can end during
+                // them.
+                const { expiresAt } = subscription;
+                const sessionEnded = () => expiresAt !== undefined && expiresAt <= new Date().toISOString();
+                if (sessionEnded()) {
+                    closeSessionEnded(ws);
+                    continue;
+                }
                 const { within } = subscription;
                 // One context per subscriber, not per event: `ctx.check` is the expensive part
                 // and the context is only the subject it is evaluated for. Built on first use, so
@@ -2372,57 +2604,115 @@ export function defineScopeDO(modules, bareOps) {
                 // The operation name is carried anyway, for the events a fan-out cannot emit
                 // but a future reader of this context might.
                 let ctx;
-                const { principal } = subscription;
-                const context = () => (ctx ??= this.operationContext(principal, tenantId, scopeId, undefined, undefined, undefined, undefined, undefined, 'live.subscribe'));
-                for (const row of announceable) {
+                const subscriber = subscription;
+                const context = () => (ctx ??= this.liveContext(subscriber));
+                /**
+                 * A checked root's gate (#938), asked at most once per (principal, key, root) per
+                 * pass (`rootChecks`) and only once a row beneath the root is about to be announced,
+                 * so an idle subscription costs no check. A refusal, or a check that throws, closes the socket before anything is
+                 * sent: the grant is gone, the principal is, or the root moved out of the grant's
+                 * reach. Closed rather than skipped, so the subscription does not sit there asking
+                 * on every pass, and the client's reconnect meets the handshake's 403. Held with the
+                 * write count it was decided under, and asked again once that has moved.
+                 */
+                let rootVerdict;
+                /** What this subscriber is owed for one row, decided at `now` under epoch `e`. */
+                const decide = async (row, e, now) => {
+                    // A remote authority's verdict is never reused: see `Epoch`.
+                    if (rootVerdict?.epoch !== e || e.remote)
+                        rootVerdict = undefined;
                     // Narrowing first: it is memoised across sockets, and a row outside the root
                     // is out whatever the principal holds.
-                    if (within && !(await reaches(row, within)))
-                        continue;
-                    let frame;
-                    if (within?.vouched !== undefined) {
-                        // The vertical vouched for the root, so the walk above was the whole filter
-                        // — and the subscriber holds no read on this row, so it is told only that
+                    if (within && !(await reaches(row, within, now)))
+                        return 'skip';
+                    if (within?.checked !== undefined) {
+                        if (rootVerdict === undefined) {
+                            let check;
+                            if (e.remote) {
+                                check = this.mayWatchRoot(context, within);
+                            }
+                            else {
+                                const key = `${subscriber.principal}\n${within.checked}\n${within.entityType}:${within.entityId}`;
+                                check = rootChecks.get(key);
+                                if (!check)
+                                    rootChecks.set(key, (check = this.mayWatchRoot(context, within)));
+                            }
+                            rootVerdict = { epoch: e, allowed: await check };
+                        }
+                        if (!rootVerdict.allowed)
+                            return 'revoked';
+                    }
+                    if (within?.vouched !== undefined || within?.checked !== undefined) {
+                        // The root was vouched for or checked, so the walk above was the row filter —
+                        // and the subscriber holds no read on this row, so it is told only that
                         // something beneath its root changed. Never which row, never how.
-                        frame = { kind: 'nudge', id: row.id, at: row.occurred_at };
+                        return { kind: 'nudge', id: row.id, at: row.occurred_at };
                     }
-                    else {
-                        // Non-null: `announceable` is exactly the rows whose type is in the map.
-                        const permission = this.liveTargets.get(row.entity_type);
-                        let allowed = false;
-                        try {
-                            const decision = await context().check(permission, {
-                                entityType: row.entity_type,
-                                entityId: row.entity_id,
-                            });
-                            allowed = decision.allowed;
-                        }
-                        catch {
-                            // A check that cannot answer is a check that refuses. The alternative —
-                            // treating an evaluator failure as an allow — turns an outage in the
-                            // permission path into a disclosure, which is the one failure mode this
-                            // surface must not have.
-                            allowed = false;
-                        }
-                        if (!allowed)
-                            continue;
-                        frame = {
-                            kind: 'change',
-                            id: row.id,
-                            type: row.type,
+                    // Non-null: `announceable` is exactly the rows whose type is in the map.
+                    const permission = this.liveTargets.get(row.entity_type);
+                    try {
+                        const decision = await context().check(permission, {
                             entityType: row.entity_type,
                             entityId: row.entity_id,
-                            at: row.occurred_at,
-                        };
-                    }
-                    try {
-                        ws.send(JSON.stringify(frame));
+                        });
+                        if (!decision.allowed)
+                            return 'skip';
                     }
                     catch {
-                        // The socket went away between `getWebSockets()` and here. Stop writing to
-                        // this one and move on; the runtime will deliver `webSocketClose`.
-                        break;
+                        // A check that cannot answer is a check that refuses. The alternative —
+                        // treating an evaluator failure as an allow — turns an outage in the
+                        // permission path into a disclosure, which is the one failure mode this
+                        // surface must not have.
+                        return 'skip';
+                    }
+                    return {
+                        kind: 'change',
+                        id: row.id,
+                        type: row.type,
+                        entityType: row.entity_type,
+                        entityId: row.entity_id,
+                        at: row.occurred_at,
+                    };
+                };
+                rows: for (const row of announceable) {
+                    for (let attempt = 0; attempt < LIVE_DECIDE_ATTEMPTS; attempt++) {
+                        const decidedAt = new Date().toISOString();
+                        const e = epochAt(decidedAt);
+                        const verdict = await decide(row, e, decidedAt);
+                        // Every gate as close to the send as it can be, with no await between these
+                        // reads and the send below — so nothing can land after them and before it.
+                        // The store wrote, or something the decision relied on lapsed, while it was being
+                        // taken (Codex #2077 r4, r5): decide again, from nothing remembered.
+                        if (!holds(e, new Date().toISOString()))
+                            continue;
+                        if (verdict === 'skip')
+                            continue rows;
+                        if (verdict === 'revoked') {
+                            try {
+                                ws.close(LIVE_CLOSE.revoked, 'the subscriber may no longer watch this root');
+                            }
+                            catch {
+                                // Already gone.
+                            }
+                            break rows;
+                        }
+                        // The clock is read again here too, after every await above.
+                        if (sessionEnded()) {
+                            closeSessionEnded(ws);
+                            break rows;
+                        }
+                        try {
+                            ws.send(JSON.stringify(verdict));
+                        }
+                        catch {
+                            // The socket went away between `getWebSockets()` and here. Stop writing to
+                            // this one and move on; the runtime will deliver `webSocketClose`.
+                            break rows;
+                        }
+                        continue rows;
                     }
+                    // Still moving after every attempt: this row is not announced, and the client's
+                    // poll — the floor under every push — picks it up.
                 }
             }
         }
@@ -2696,7 +2986,7 @@ export function defineScopeDO(modules, bareOps) {
             return this.queue.enqueue(async () => {
                 let capability;
                 try {
-                    capability = resolveCapabilitySession(doSpineSql(this.sql), sessionHash, instant.parse(new Date().toISOString()), operation);
+                    capability = resolveCapabilitySession(doSpineSql(this.sql), sessionHash, instant.parse(new Date().toISOString()), operation, true);
                 }
                 catch (err) {
                     return { failure: toWireFailure(err) };
@@ -2858,8 +3148,7 @@ export function defineScopeDO(modules, bareOps) {
             return this.queue.enqueue(() => {
                 if (systemSwitchedOff(this.switchSql(), moduleId))
                     return false;
-                this.sql.exec(`INSERT OR REPLACE INTO _substrat_tuples (subject, relation, object, expires_at)
-           VALUES (?, ?, ?, ?)`, `system:${moduleId}`, relation, object, expiresAt);
+                writeExplicitTupleIn(this.switchSql(), `system:${moduleId}`, relation, object, { kind: 'replace', expiresAt });
                 return true;
             });
         }
@@ -3248,6 +3537,70 @@ export function defineScopeDO(modules, bareOps) {
             await this.ensureMigrations();
             return readCapabilityPage(doSpineSql(this.sql), filter);
         }
+        /**
+         * One pass of a purge horizon's schedule on this scope (#119): the oldest entities due for
+         * purge, each deleted by the module's own `trashed: 'purges'` operation, one call and one
+         * transaction per entity, as `system:<moduleId>`.
+         *
+         * The caller names only WHICH schedule. Everything that decides what is purged is this
+         * object's: the module and the entity come from the registered schedule, the cutoff from this
+         * object's clock and the entity's declared horizon, the ids from its own bin — and each purge
+         * re-checks the cutoff inside its transaction (`refuseTrashedTarget`). Purge authority lives
+         * here and nowhere else: `invoke` takes no purge argument, so a stub holding this namespace
+         * cannot hand the system principal its purge-only key, and calling this early, often or from
+         * outside the sweep can only purge what is genuinely due.
+         *
+         * Pinned like every system-door call (#1834): a missed pin answers `SystemDoorMoved` before
+         * anything is read, and the coordinator's door gates again.
+         */
+        async runPurgeSweep(operation, tenantId, 
+        /**
+         * The node the purges' checks and events are stamped with. This object records no scope id of
+         * its own, so it cannot hold this one to anything — and it routes nothing: the sweep runs on
+         * the scope that received the call, whatever this says. A wrong one fails closed, since the
+         * module's grant is seated on this scope's node and not on the one named.
+         */
+        scopeId, systemDoorInstance) {
+            await this.ensureMigrations();
+            const schedule = this.purgeSchedules.get(operation);
+            if (!schedule)
+                throw toRpcError(substratError('not_found', `no purge schedule runs ${operation} on this scope`));
+            try {
+                this.assertSystemDoor(schedule.moduleId, systemDoorInstance);
+            }
+            catch (err) {
+                if (err instanceof SystemDoorMovedError)
+                    return SYSTEM_DOOR_MOVED;
+                throw toRpcError(err);
+            }
+            await this.pruneContinuationPositions();
+            // #119: the gate the coordinator applies before any schedule fires, applied here from what
+            // this scope records of it (`purgeGateFacts`). A foreign tenant throws.
+            const held = purgeHeldBy(this.purgeGateFacts(schedule.moduleId, tenantId));
+            if (held !== null)
+                return heldPurgePass(held);
+            const due = purgeDueOf(doSpineSql(this.sql), this.statePlans, this.operationTarget, operation, schedule.entityType, new Date().toISOString(), PURGE_BATCH);
+            return runPurgePass(operation, due, async (entityId) => {
+                await this.#invokeOrThrow(operation, { [due.idFrom]: entityId }, schedule.moduleId, tenantId, scopeId, undefined, undefined, schedule.moduleId, { invocationId: ulid() }, undefined, undefined, undefined, systemDoorInstance, true);
+            }, (write) => write(doSpineSql(this.sql)));
+        }
+        /**
+         * #119: the purge gate's facts (`PurgeGateFacts`), from this scope's own storage: the module's
+         * switch, the lifecycle the platform delivered (#1713), the copy classification (#2009) and the
+         * tenant receipt (`tenantVerdict` — `unknown` passes, as at every door). A directory-backed
+         * deployment records no receipt and delivers neither a lifecycle nor a copy classification here,
+         * so on one those read clear: this object enforces the kill switch, and the coordinator's gate
+         * is the authority for tenant, lifecycle, copy and the rewind hold.
+         */
+        purgeGateFacts(moduleId, tenantId) {
+            const now = new Date().toISOString();
+            return {
+                switched: systemScheduleState(this.switchSql(), moduleId, now),
+                lifecycle: lifecycleRefusal(readLifecycle(this.switchSql())),
+                copy: this.isCopy(),
+                foreignTenant: this.tenantVerdict(tenantId).verdict === 'foreign',
+            };
+        }
         /**
          * The last time a schedule's operation ran on this scope (#383), or null.
          *
@@ -3588,18 +3941,55 @@ export function defineScopeDO(modules, bareOps) {
                 this.migrationPromise = this.applyPendingMigrations();
             return this.migrationPromise;
         }
+        /** Every registered module's derivation plans — what `repairDerivedObjects` and its checks read. */
+        derivedPlans() {
+            return { state: this.statePlans, lists: this.listPlans, search: this.searchPlans };
+        }
+        /** A multi-statement script on this DO's own handle, one statement per exec. */
+        runScript(ddl) {
+            for (const stmt of executableSqlStatements(ddl))
+                this.sql.exec(stmt);
+        }
+        /**
+         * #2090: the repair a pass with nothing pending runs, in a transaction of its own. A lost
+         * state column fails the scope closed like a failed migration, named by the journaled
+         * migration that added the column — the pure host's `repairDerived`.
+         */
+        async repairDerived() {
+            try {
+                await this.revision.transaction(async () => {
+                    this.revisionSuspended = true;
+                    try {
+                        repairDerivedObjects(doSpineSql(this.sql), (ddl) => this.runScript(ddl), this.derivedPlans(), {
+                            after: 'an applied migration',
+                        });
+                    }
+                    finally {
+                        this.revisionSuspended = false;
+                    }
+                });
+            }
+            catch (err) {
+                const version = err instanceof StateColumnLost ? err.migration : 'kernel@derived-objects';
+                this.lastFailure = { version, error: err.message };
+                throw migrationFailedError(version, err.message);
+            }
+        }
         /** Resolves true if this call applied at least one migration. */
         async applyPendingMigrations() {
-            const pending = [];
-            for (const mod of this.modules.values()) {
-                for (const migration of mod.migrations) {
-                    if (!this.applied.has(`${mod.id}@${migration.version}`)) {
-                        pending.push({ moduleId: mod.id, migration });
-                    }
-                }
+            const { pending, diverged } = await planMigrations(this.modules.values(), this.applied);
+            if (diverged) {
+                // Recorded as a failed migration is, so the coordinator projects it the same way.
+                this.lastFailure = diverged;
+                throw migrationFailedError(diverged.version, diverged.error);
             }
-            if (pending.length === 0)
+            if (pending.length === 0) {
+                // #2090: once per pass — so once per wake, and on every `retryMigrations` — check and
+                // repair what the kernel derived onto the tables. Their migrations are journaled and will
+                // never run again, so this is what reaches a scope stripped before the pass checked.
+                await this.queue.enqueue(async () => this.repairDerived());
                 return false;
+            }
             this.migrationRuns += 1;
             await this.queue.enqueue(async () => {
                 // #286: bookmark the instant before an UPGRADE migrates live data — the
@@ -3622,34 +4012,53 @@ export function defineScopeDO(modules, bareOps) {
                         // (#278) remains the fallback rewind point.
                     }
                 }
-                for (const { moduleId, migration } of pending) {
+                for (const [i, { moduleId, migration, digest, authored }] of pending.entries()) {
                     const key = `${moduleId}@${migration.version}`;
                     if (this.applied.has(key))
                         continue;
+                    let recorded = digest;
                     try {
                         await this.revision.transaction(async () => {
                             const already = this.sql
-                                .exec('SELECT 1 FROM _substrat_migrations WHERE module_id = ? AND version = ?', moduleId, migration.version)
+                                .exec('SELECT sql_digest FROM _substrat_migrations WHERE module_id = ? AND version = ?', moduleId, migration.version)
                                 .toArray()[0];
-                            if (!already) {
+                            if (already) {
+                                // Applied since this pass read the journal: held to the same digest rule.
+                                const error = migrationDivergence(already.sql_digest, digest, authored);
+                                if (error)
+                                    throw new Error(error);
+                                recorded = already.sql_digest;
+                            }
+                            else {
                                 const started = performance.now();
                                 const before = this.sql.exec('SELECT total_changes() AS n').toArray()[0].n;
-                                // #1898: a migration runs on this DO's own handle, not `ctx.sql`, so the
-                                // spine guard's REFERENCES rule is applied here.
-                                assertNoSpineReference(migration.sql, `migration ${key}`);
+                                // #1898, #2066: a migration runs on this DO's own handle, not `ctx.sql`, so the
+                                // spine rules a migration is held to are applied here.
+                                assertMigrationSql(migration.sql, { key, digest, authored });
+                                // #2068: the ownership ledger is the kernel's — no migration may name it, not even to
+                                // read it (the spine rules above allow reads).
+                                assertMigrationLeavesLedgerAlone(migration.sql, `migration ${key}`);
                                 // #1722: not counted per statement, so `total_changes()` measures the migration
                                 // alone. The journal row below is a write, and advances the revision once.
+                                // #2068: run one statement at a time, keeping the table set either side of each.
+                                let steps;
                                 this.revisionSuspended = true;
                                 try {
-                                    for (const stmt of splitSqlStatements(migration.sql)) {
+                                    steps = runMigrationStatements(doSpineSql(this.sql), migration.sql, (stmt) => {
                                         this.sql.exec(stmt);
-                                    }
+                                    });
+                                    // #2090: the state columns this migration must have left, and after the last of
+                                    // the pass, the triggers and indexes a create-copy-rename rebuild dropped.
+                                    const last = i === pending.length - 1;
+                                    afterMigration(doSpineSql(this.sql), (ddl) => this.runScript(ddl), this.derivedPlans(), key, last);
                                 }
                                 finally {
                                     this.revisionSuspended = false;
                                 }
                                 const after = this.sql.exec('SELECT total_changes() AS n').toArray()[0].n;
-                                this.sql.exec('INSERT INTO _substrat_migrations (module_id, version, applied_at, duration_ms, rows_changed) VALUES (?, ?, ?, ?, ?)', moduleId, migration.version, new Date().toISOString(), Math.max(0, Math.round(performance.now() - started)), after - before);
+                                // After the count: `rows_changed` is the migration's own, never the kernel's bookkeeping.
+                                recordOwnershipSteps(doSpineSql(this.sql), moduleId, steps, new Date().toISOString());
+                                this.sql.exec('INSERT INTO _substrat_migrations (module_id, version, applied_at, duration_ms, rows_changed, sql_digest) VALUES (?, ?, ?, ?, ?, ?)', moduleId, migration.version, new Date().toISOString(), Math.max(0, Math.round(performance.now() - started)), after - before, digest);
                             }
                         });
                     }
@@ -3663,9 +4072,9 @@ export function defineScopeDO(modules, bareOps) {
                         // It is not an unhandled rejection: every caller awaits the memoised promise, and
                         // the coordinator records the failure it receives (#1898 review).
                         this.lastFailure = { version: key, error: err.message };
-                        throw new Error(`migration failed for ${key} — scope fails closed: ${err.message}`);
+                        throw migrationFailedError(key, err.message);
                     }
-                    this.applied.add(key);
+                    this.applied.set(key, recorded);
                 }
             });
             return true;
@@ -3904,6 +4313,30 @@ export function defineScopeDO(modules, bareOps) {
                attempts = attempts + 1, settled_at = ?
          WHERE id = ? AND status = 'pending'`, status, result, lastError, lastFailure, status === 'pending' ? null : new Date().toISOString(), id);
         }
+        /**
+         * A settle that writes an outcome event (#2102): the kernel's one settle — the same
+         * compare-and-set as the verb above — and the event in its transaction, written only when
+         * this settle moved the row out of `pending`. Then the event reaches this scope's consumers,
+         * as any committed write's does.
+         *
+         * A verb of its own rather than an argument on the one above, so a settle carrying no event
+         * keeps reaching a DO class older than this change; only the new kind's settle needs it.
+         */
+        async settlePlatformRequestWithEvent(tenantId, scopeId, id, outcome) {
+            await this.ensureMigrations();
+            return this.queue.enqueue(async () => {
+                const liveSince = this.liveHighWaterMark();
+                this.revision.transactionSync(() => settlePlatformRequestIn(this.switchSql(), id, outcome, {
+                    tenantId,
+                    scopeId,
+                    now: new Date().toISOString(),
+                    mintEventId: (ms) => this.mintEventId(ms),
+                    version: this.env.SUBSTRAT_VERSION_ID ?? null,
+                }));
+                // #1525: null — a settle is the platform's call, not one a vertical's caller made.
+                await this.settleCommitted(tenantId, scopeId, liveSince, null);
+            });
+        }
         /**
          * Turn one connector delivery into a `connector:<provider>` platform intent (#574
          * phase 3) — the CP-less host's substitute for running the handler it cannot run.
@@ -3997,7 +4430,7 @@ export function defineScopeDO(modules, bareOps) {
         /** Every table in this scope's DB, with row counts; spine/internal tables flagged. */
         introspectTables() {
             const names = this.sql
-                .exec(`SELECT name FROM sqlite_master WHERE type = 'table' ORDER BY name`)
+                .exec(`SELECT name FROM sqlite_master WHERE type = 'table' AND name NOT GLOB '_cf_*' ORDER BY name`)
                 .toArray().map((r) => r.name);
             return names.map((name) => ({
                 name,
@@ -4021,7 +4454,7 @@ export function defineScopeDO(modules, bareOps) {
         }
         tablePage(table, limit, offset) {
             const known = new Set(this.sql
-                .exec(`SELECT name FROM sqlite_master WHERE type = 'table'`)
+                .exec(`SELECT name FROM sqlite_master WHERE type = 'table' AND name NOT GLOB '_cf_*'`)
                 .toArray().map((r) => r.name));
             if (!known.has(table))
                 throw substratError('not_found', `unknown table '${table}'`);
@@ -4059,6 +4492,7 @@ export function defineScopeDO(modules, bareOps) {
         }
         async readOnlyQuery(sql) {
             const stmt = assertReadOnlyQuery(sql);
+            assertNoWorkerdStorage(stmt);
             let result;
             const rollback = new Error('read-only console rollback');
             try {
@@ -4136,7 +4570,7 @@ export function defineScopeDO(modules, bareOps) {
             // carries the rows, never the index over them.
             const defs = this.sql
                 .exec(`SELECT name, sql FROM sqlite_master
-              WHERE type = 'table' AND name NOT GLOB 'sqlite_*' AND sql IS NOT NULL
+              WHERE type = 'table' AND name NOT GLOB 'sqlite_*' AND name NOT GLOB '_cf_*' AND sql IS NOT NULL
               ORDER BY name`)
                 .toArray().filter(({ name }) => !isSearchIndexTable(name));
             return defs.map(({ name, sql }) => {
@@ -4199,7 +4633,11 @@ export function defineScopeDO(modules, bareOps) {
                 // #1763: rows written before these fields keep NULL, meaning unrecorded.
                 'ALTER TABLE _substrat_migrations ADD COLUMN duration_ms INTEGER',
                 'ALTER TABLE _substrat_migrations ADD COLUMN rows_changed INTEGER',
+                // #2066: the rows already there get the legacy mark below, never a digest.
+                'ALTER TABLE _substrat_migrations ADD COLUMN sql_digest TEXT',
                 'ALTER TABLE _substrat_tuples ADD COLUMN revoked_at TEXT',
+                // #2126: NULL keeps every existing capability's attachment behavior unchanged.
+                'ALTER TABLE _substrat_capabilities ADD COLUMN attachments TEXT',
                 // #1632: legacy runs retain an unknown subject; no content-based backfill.
                 'ALTER TABLE _substrat_job_runs ADD COLUMN subject_id TEXT',
                 // #2034: the lease. NULL = nobody holds the run, which is right for every row already there.
@@ -4255,6 +4693,9 @@ export function defineScopeDO(modules, bareOps) {
                 // every legacy row — a past run's id cannot be recovered afterwards, exactly
                 // as the other #1525 columns above argued.
                 'ALTER TABLE _substrat_schedule_state ADD COLUMN invocation_id TEXT',
+                // #2096: a purge horizon's lap in progress, on a scope DO built before the column. NULL is
+                // the start of a lap — the honest reading of every row already there.
+                'ALTER TABLE _substrat_schedule_state ADD COLUMN purge_cursor TEXT',
                 // #2009: the copy classification on a scope DO built before it (NULL reads as a copy;
                 // see `COPY_ORIGIN_DDL`).
                 'ALTER TABLE _substrat_copy_origin ADD COLUMN is_copy INTEGER',
@@ -4280,6 +4721,9 @@ export function defineScopeDO(modules, bareOps) {
             // boot. `lint:spine-ddl` compares KERNEL_DDL's indexes only, so this one is held to
             // both adapters by the query-plan test rather than by that gate.
             this.sql.exec('CREATE INDEX IF NOT EXISTS _substrat_outbox_invocation ON _substrat_outbox (invocation_id, id)');
+            this.sql.exec(GRANT_CHILDREN_INDEX_DDL);
+            // #2066: what they ran was never measured. KERNEL_DDL's fence keeps any other NULL out.
+            this.sql.exec(MIGRATION_DIGEST_MARK_LEGACY);
             this.ensureScheduleStateKind();
             this.ensureRefusalsAdmitGuards();
         }
@@ -4320,11 +4764,11 @@ export function defineScopeDO(modules, bareOps) {
             // synchronous, which is the one case the sync API is for (it commits at the
             // first await, and there is none). It also has to be sync because the caller is.
             this.revision.transactionSync(() => {
-                for (const stmt of splitSqlStatements(script))
+                for (const stmt of executableSqlStatements(script))
                     this.sql.exec(stmt);
             });
         }
-        async importDump(tables, destScopeId, { switchOff, sourceScopeId, exact, loadStamp, expect, resolveKept, markCopy, provisionedFor, } = {}) {
+        async importDump(tables, destScopeId, { switchOff, sourceScopeId, exact, loadStamp, expect, resolveKept, markCopy, provisionedFor, fence, } = {}) {
             // The WHOLE drop-then-replay runs under deferred foreign keys, in one transaction.
             //
             // Two distinct FK hazards, and both need the deferral — the second is why it cannot
@@ -4360,6 +4804,13 @@ export function defineScopeDO(modules, bareOps) {
                 throw substratError('validation_failed', 'restore refused: `exact` needs the scope the dump came from');
             }
             const switched = await this.revision.transaction(async () => {
+                // #1722: first, before any read: a store a reap has since emptied must refuse the late load
+                // too, and the check is against this store's clock, inside the load's own transaction.
+                if (fence && copyRestoreFenceLapsed(fence, Date.now())) {
+                    const lapsed = substratError('precondition_failed', COPY_RESTORE_FENCE_LAPSED);
+                    fenceRefusals.add(lapsed);
+                    throw lapsed;
+                }
                 const before = this.loadMarker();
                 // #1713: the lifecycle the platform delivered here, read before the drops take it.
                 const lifecycleBefore = readLifecycle(this.switchSql());
@@ -4397,7 +4848,9 @@ export function defineScopeDO(modules, bareOps) {
                     this.sql.exec('PRAGMA defer_foreign_keys = ON');
                     // Real tables only; `sqlite_*` internals are auto-managed and un-droppable.
                     const existing = this.sql
-                        .exec(`SELECT name FROM sqlite_master WHERE type = 'table' AND name NOT GLOB 'sqlite_*'`)
+                        // Nor workerd's own `_cf_*` (the live reaper's alarm keeps `_cf_METADATA`), which
+                        // it refuses to drop.
+                        .exec(`SELECT name FROM sqlite_master WHERE type = 'table' AND name NOT GLOB 'sqlite_*' AND name NOT GLOB '_cf_*'`)
                         .toArray();
                     // Search index tables are left alone here and rebuilt below (#827): dropping a
                     // shadow table directly is an error, and `sqlite_master` order would reach one
@@ -4412,9 +4865,12 @@ export function defineScopeDO(modules, bareOps) {
                     // decide how this DO's permission checks match. Every `_substrat_*` table is built
                     // from KERNEL_DDL instead, and the dump contributes only rows, by column name
                     // (`spineRowsInsert`), a missing column taking the kernel's default.
+                    // Comment-blanked (#2068): a dump records `sqlite_master.sql` verbatim, comments included,
+                    // and replaying it raw would store them again — and a later DROP COLUMN of the last
+                    // column fails on workerd. The validated statement is otherwise executed exactly as is.
                     for (const t of replayable)
                         if (!isSpineTable(t.name))
-                            this.sql.exec(t.ddl);
+                            this.sql.exec(blankSqlComments(t.ddl));
                     // KERNEL_DDL also builds what the dump did not carry (#321). A dump captured from a
                     // WORLD that stores some `_substrat_*` tables ELSEWHERE carries only a subset — an
                     // `@substrat-run/adapter-sqlite` scope file keeps `_substrat_roles` /
@@ -4424,11 +4880,12 @@ export function defineScopeDO(modules, bareOps) {
                     // restore's repair leg (host.projectRolesLocal) — the spine's job is only to exist so
                     // the checker can read it. The column pass follows, for the one outbox index KERNEL_DDL
                     // leaves to it.
-                    for (const stmt of splitSqlStatements(KERNEL_DDL))
+                    for (const stmt of executableSqlStatements(KERNEL_DDL))
                         this.sql.exec(stmt);
                     this.applySpineColumnAdditions();
                     const columnsOf = (name) => doBuiltColumnsOf(this.sql, name);
                     assertSpineTablesBuilt(replayable.map((t) => t.name), columnsOf);
+                    assertJournalDumpCoherent(replayable);
                     // A spine column this kernel does not know (a dump from a newer one) is kept, as a plain
                     // untyped column the checker never reads.
                     for (const t of replayable) {
@@ -4479,6 +4936,17 @@ export function defineScopeDO(modules, bareOps) {
                     if (destScopeId) {
                         this.rewriteScopeTuples(destScopeId, sourceScopeId && { scopeId: sourceScopeId, exact }, new Date().toISOString());
                     }
+                    // #827 / #119 / #811: the search triggers, the archive/trash guard triggers, the purge
+                    // sweep's index and the derived list indexes went with the dropped tables, and the search index points at rows
+                    // that are gone. Repaired, and the search index rebuilt, AFTER the rows — which may
+                    // legitimately arrive archived or trashed — as the dump's own journal says they were
+                    // derived (#2090). Inside the replay's transaction: a dump whose journal owes a table a
+                    // state column it does not carry rolls the whole load back. A plan whose table this dump
+                    // did not carry is skipped: a restore must not invent one.
+                    repairDerivedObjects(doSpineSql(this.sql), (ddl) => this.runScript(ddl), this.derivedPlans(), {
+                        after: 'the restored dump',
+                        absentTable: 'skip',
+                    });
                     // #1742: the recorded-off modules go back off INSIDE the replay's transaction, with
                     // the spine and the re-point. A switch that throws rolls the whole restore back, so
                     // the dump's grants never commit live without the switch that should cover them.
@@ -4491,37 +4959,6 @@ export function defineScopeDO(modules, bareOps) {
                 }
             });
             this.carriedAwayCopy = this.metaValue(CARRIED_AWAY_KEY) !== null;
-            // Rebuild the derived search indexes over the rows just loaded (#827). Drop-then-
-            // create, so it also repairs an index a dump left stale, and the triggers it
-            // recreates are what keep the restored scope in step from here. Skipped for a plan
-            // whose content table this dump did not carry — a restore must not invent a table
-            // for an index to point at.
-            const present = new Set(this.sql
-                .exec(`SELECT name FROM sqlite_master WHERE type = 'table'`)
-                .toArray().map((r) => r.name));
-            for (const plan of this.searchPlans.values()) {
-                if (!present.has(plan.table))
-                    continue;
-                for (const stmt of splitSqlStatements(searchIndexDdl(plan)))
-                    this.sql.exec(stmt);
-            }
-            // #119: the never-born-archived trigger went with the dropped table. Put back AFTER the
-            // rows, which may legitimately arrive archived or trashed.
-            for (const plan of this.statePlans.values()) {
-                if (!present.has(plan.table))
-                    continue;
-                for (const stmt of splitSqlStatements(entityStateTriggerDdl(plan)))
-                    this.sql.exec(stmt);
-            }
-            // #811 / #119: the derived list indexes went with the dropped table too, and a load never
-            // put them back — an archivable entity's partial indexes are part of what the kernel
-            // checks after DDL.
-            for (const plan of this.listPlans.values()) {
-                if (!present.has(plan.table))
-                    continue;
-                for (const stmt of splitSqlStatements(listIndexDdl(plan)))
-                    this.sql.exec(stmt);
-            }
             // #1335 / #1686: the outbox arrived with the dump, so this DO's event ids resume above it,
             // as on a wake. A copy's own events then sort above every copied one, which is what
             // `emittedHere()` relies on. A dump whose top id is no ULID leaves the floor where it was.
@@ -4536,12 +4973,7 @@ export function defineScopeDO(modules, bareOps) {
             }
             // The frontier arrived with the dump — refresh the in-memory applied set so a
             // later migrate() builds on the imported state, not the provisioning state.
-            this.applied.clear();
-            for (const row of this.sql
-                .exec('SELECT module_id, version FROM _substrat_migrations')
-                .toArray()) {
-                this.applied.add(`${row.module_id}@${row.version}`);
-            }
+            this.applied = readAppliedMigrations(this.sql);
             // …and forget that this INSTANCE ever ran a migration pass (#1589). Refreshing
             // the set above is not enough on its own: `ensureMigrations` memoises its
             // promise, so a warm DO answers "already migrated" from the cache and never
@@ -4565,6 +4997,12 @@ export function defineScopeDO(modules, bareOps) {
             // is complete applies nothing, so there is nothing to report either way.
             this.migrationPromise = undefined;
             this.lastFailure = null;
+            // The KV key never travels in a SQL dump. A load into this same DO would
+            // otherwise retain its old epoch, so explicitly invalidate all old tokens.
+            await this.ctx.storage.delete('continuation:keys');
+            const oldPositions = await this.ctx.storage.list({ prefix: 'continuation:position:' });
+            for (const name of oldPositions.keys())
+                await this.ctx.storage.delete(name);
             return switched;
         }
         /**
@@ -4577,6 +5015,8 @@ export function defineScopeDO(modules, bareOps) {
                 return { refused: false, switchedOff: await this.importDump(tables, destScopeId, opts) };
             }
             catch (e) {
+                if (e instanceof Error && fenceRefusals.has(e))
+                    return { refused: 'lapsed' };
                 const code = errorCodeOf(e);
                 if (code === 'precondition_failed')
                     return { refused: 'changed' };
@@ -4801,9 +5241,41 @@ export function defineScopeDO(modules, bareOps) {
          * outranks their Article 17 right.
          */
         async redactSubject(subjectId) {
+            // #2068: the module half reaches the scope's own tables, so they have to exist.
+            await this.ensureMigrations();
             // One instant for the whole erasure — the intent tombstones must not disagree with
             // each other about when a person was erased.
             const at = new Date().toISOString();
+            // ONE transaction (#2068): a module's `onSubjectErased` hook that throws rolls the
+            // whole redaction back, the spine half with it, and the coordinator — which destroys
+            // the key only after this returns — never reaches the key.
+            //
+            // Its refusal is answered as DATA (`toWireFailure`, #113): workerd delivers a throw across
+            // this boundary as its message alone, and a hook's `forbidden` (it reached past its own
+            // tables) is a different answer from an `internal`. In this method's own reply rather than
+            // a `…Reply` sibling, so every coordinator — old ones too — keeps calling one verb: an old
+            // one reads a failure as a reply missing its counts and refuses before the key, which is
+            // the safe reading.
+            try {
+                return this.revision.transactionSync(() => this.redactSubjectInTransaction(subjectId, at));
+            }
+            catch (err) {
+                return { failure: toWireFailure(err) };
+            }
+        }
+        /** The body of `redactSubject`, inside its transaction. */
+        redactSubjectInTransaction(subjectId, at) {
+            // The module half first (#2068): the declared entities, then each hook, with the search
+            // indexes over them under FTS5 secure-delete. The spine half follows in the same transaction.
+            const vertical = eraseSubjectFromModules({
+                sql: doSpineSql(this.sql),
+                plans: this.erasurePlans,
+                searchPlans: this.searchPlans.values(),
+                statefulTables: statefulTablesOf(this.statePlans),
+                subjectId,
+                at,
+                migrationSqlOf: (moduleId, version) => this.modules.get(moduleId)?.migrations.find((m) => m.version === version)?.sql,
+            });
             const doomed = this.sql
                 .exec(`SELECT id FROM _substrat_outbox
               WHERE subject_id = ? AND pii_class != 'none' AND payload IS NOT NULL`, subjectId)
@@ -4824,6 +5296,7 @@ export function defineScopeDO(modules, bareOps) {
                 // The free-text copies (#1632), and the tombstoned intents the coordinator hands to
                 // the directory half. Last, so those ids include every intent tombstoned above.
                 ...redactSubjectScopeText(sql, subjectId, at),
+                vertical,
             };
         }
         /**
@@ -5065,7 +5538,9 @@ export function defineScopeDO(modules, bareOps) {
          */
         peerSubject, 
         /** #2055: the delivery a consumer's or an import's context runs for; absent otherwise. */
-        delivery) {
+        delivery, 
+        /** #119: keys this context's checks refuse whatever the subject holds (`purgeOnlyKeysOf`). */
+        withheld) {
             const checker = this.checker;
             const relations = this.relations;
             const searchPlans = this.searchPlans;
@@ -5126,6 +5601,9 @@ export function defineScopeDO(modules, bareOps) {
                 // #1642: parsed before the system actor's early return, which never reaches
                 // the checker — a cast key would otherwise become that path's proof relation.
                 const permission = assertPermissionKey(unparsed);
+                if (withheld?.has(permission)) {
+                    return { allowed: false, checked: permission, node: { tenantId, scopeId } };
+                }
                 if (systemActor) {
                     return {
                         allowed: true,
@@ -5206,10 +5684,12 @@ export function defineScopeDO(modules, bareOps) {
                 // #1672: a capability's own id stands in so the type holds — it is not a person, and
                 // the event actor says what it is instead. Every other door passes its own value.
                 principal: capabilityId ? capabilityId : principal,
+                pageContinuation: (list, query) => visibleContinuation(this.continuationStore(impersonation?.mode !== 'read-only' && !this.isCopy()), { scopeId, principal: `${subject.kind}:${subject.id}`, operation: operation ?? 'kernel', list, query }, Date.now, () => ctxRef.log.info('legacy filtered-list cursor accepted', { list }), impersonation?.mode !== 'read-only' && !this.isCopy()),
                 sql: guardSecrets(doScopedSql(sql, statefulTablesOf(statePlans), 
-                // #119: after runtime DDL, the stateful tables must still carry what the kernel derived.
-                statePlans.size
-                    ? () => assertEntityStateIntact(doSpineSql(sql), statePlans, stateListIndexNames(listPlans.values()))
+                // #119 / #2090: after runtime DDL, inside this operation's transaction, what the kernel
+                // derived onto any table is repaired — and a lost state column fails the operation.
+                derivesAnything(this.derivedPlans())
+                    ? () => afterRuntimeDdl(doSpineSql(sql), (ddl) => this.runScript(ddl), this.derivedPlans())
                     : undefined), minted),
                 now: () => at,
                 // #1746/#1747: the host stamps who and where; module code supplies only the template
@@ -5268,6 +5748,10 @@ export function defineScopeDO(modules, bareOps) {
                     return entityVersionOf(sql.exec(q.sql, ...q.params).toArray());
                 },
                 check: runCheck,
+                grantedEntities: async (unparsed, entityType, options) => {
+                    const permission = assertPermissionKey(unparsed);
+                    return grantedEntitiesForContext(checker, subject, permission, { tenantId, scopeId }, entityType, options, runCheck, withheld, Boolean(systemActor));
+                },
                 canAssign: runCanAssign,
                 // #827. Mirror of the pure adapter: the plan comes from registration, the
                 // rows from this DO's own SQLite, and the index is maintained by triggers
@@ -5303,15 +5787,14 @@ export function defineScopeDO(modules, bareOps) {
                         view: uncheckedView('ctx.page', entityType, params.view),
                     });
                     const rows = sql.exec(q.sql, ...q.params).toArray();
-                    const last = rows.length >= limit ? rows[rows.length - 1] : undefined;
-                    const nextCursor = last === undefined ? null : cursorOf(last, q.sortColumn, plan.idColumn, q.order, q.view);
-                    const page = { entries: rows, nextCursor };
+                    // `pageOf`'s rule, and each row's own cursor when asked (#2073).
+                    const mint = (row) => cursorOf(row, q.sortColumn, plan.idColumn, q.order, q.view);
                     if (!params.total)
-                        return page;
+                        return pageOf(rows, limit, mint, params.rowCursors);
                     const counted = sql
                         .exec(q.countSql, ...q.countParams)
                         .toArray();
-                    return { ...page, total: counted[0]?.n ?? 0 };
+                    return countedPageOf(rows, limit, mint, counted[0]?.n ?? 0, params.rowCursors);
                 },
                 /**
                  * Delegate a permission this caller holds onto one entity — see the
@@ -5329,7 +5812,8 @@ export function defineScopeDO(modules, bareOps) {
                         throw new PermissionDenied(`cannot grant '${permission}' on ${entity.entityType}:${entity.entityId} — ` +
                             'the caller does not hold it there (a grant delegates, it never elevates)');
                     }
-                    sql.exec(`INSERT OR IGNORE INTO _substrat_tuples (subject, relation, object) VALUES (?, ?, ?)`, `principal:${principal}`, `granted:${permission}`, `${entity.entityType}:${entity.entityId}`);
+                    // #2071: an explicit grant, so it clears a tombstone `revoke` left.
+                    writeExplicitTupleIn(this.switchSql(), `principal:${principal}`, `granted:${permission}`, `${entity.entityType}:${entity.entityId}`, { kind: 'delegated' });
                 },
                 /**
                  * Deliberately NOT the #1856 grammar check `grant` and `link` make: a revoke writes
@@ -5343,7 +5827,10 @@ export function defineScopeDO(modules, bareOps) {
                         throw new PermissionDenied(`cannot revoke '${permission}' on ${entity.entityType}:${entity.entityId} — ` +
                             'the caller does not hold it there');
                     }
-                    sql.exec(`DELETE FROM _substrat_tuples WHERE subject = ? AND relation = ? AND object = ?`, `principal:${principal}`, `granted:${permission}`, `${entity.entityType}:${entity.entityId}`);
+                    // K-21 (#2071): a tombstone, never a delete — a declared shape's top-up must be
+                    // able to tell a key taken back from one never held.
+                    const r = delegatedRevokeSql(principal, permission, `${entity.entityType}:${entity.entityId}`, at);
+                    sql.exec(r.sql, ...r.params);
                 },
                 atomic: createAtomic(runSub, { passed, signals }),
                 // #1672: mint / revoke / list, written once in the kernel — the pure adapter hands
@@ -5369,6 +5856,7 @@ export function defineScopeDO(modules, bareOps) {
                     now: at,
                     emit: (event) => writeEvent(event, 'kernel'),
                     assertWrites: (verb) => assertImpersonationWrites(impersonation, verb),
+                    isUnreachableParent: (entity) => isUnreachableParent(doSpineSql(sql), statePlans, entity),
                 }),
                 // #119: archive and trash — the pure adapter's wiring, over the raw spine seam.
                 ...createEntityStateVerbs({
@@ -5385,6 +5873,7 @@ export function defineScopeDO(modules, bareOps) {
                     searchPlans,
                     statePlans,
                     check: runCheck,
+                    continuation: (entityType, params) => ctxRef.pageContinuation(`trash:${entityType}`, { ...params, view: 'trashed' }),
                 }),
                 entitlement: async (key) => {
                     const held = await entitlementReader().listEntitlements(tenantId);
@@ -5427,6 +5916,29 @@ export function defineScopeDO(modules, bareOps) {
                 .toArray()[0];
             return row?.value === 'local' ? 'local' : 'control-plane';
         }
+        /**
+         * Whether a check here reads the directory over RPC (#938, Codex #2077 r5): the same
+         * choice `controlPlaneReader` makes per call, asked each time a live fan-out pass opens an epoch.
+         */
+        permissionSourceIsRemote() {
+            return this.permissionSource() !== 'local' && Boolean(this.env.CONTROL_PLANE);
+        }
+        /**
+         * The earliest `expires_at` after `now` in any local store a check or the parent walk
+         * reads (#938, Codex #2077 r5), or null when nothing here lapses. Until then, no grant,
+         * tenant tuple, parent edge or entitlement this scope holds can stop authorizing without
+         * a write. Revoked rows are not excluded: an earlier bound only costs a re-check.
+         */
+        authorityLapsesAfter(now) {
+            const row = this.sql
+                .exec(`SELECT MIN(e) AS until FROM (
+             SELECT MIN(expires_at) AS e FROM _substrat_tuples WHERE expires_at > ?
+             UNION ALL SELECT MIN(expires_at) FROM _substrat_tenant_tuples WHERE expires_at > ?
+             UNION ALL SELECT MIN(expires_at) FROM _substrat_entitlements WHERE expires_at > ?
+           )`, now, now, now)
+                .toArray()[0];
+            return row?.until ?? null;
+        }
         /**
          * The checker's tenant-tuple/role reader. Chosen **per call** (the source can
          * flip at runtime, and the checker holds this wrapper for the DO's lifetime):