@substrat-run/adapter-cloudflare 0.153.0 → 0.154.0

package/dist/scope-do.d.ts

@@ -1,5 +1,5 @@
 import { DurableObject } from 'cloudflare:workers';
-import { type SwitchSql, type ModuleRegistration, type OperationHandler } from '@substrat-run/kernel';
+import { type DeclaredPermissions, type SwitchSql, type ModuleRegistration, type OperationHandler } from '@substrat-run/kernel';
 import { type DoReply } from './do-reply.js';
 import { splitSqlStatements } from '@substrat-run/kernel';
 /**
@@ -81,5 +81,13 @@ export type CapabilityAttachmentReply<T> = DoReply<T>;
 export declare function switchSqlOver(sql: SqlStorage): SwitchSql;
 /** The splitter both adapters run migrations through — the kernel's, re-exported for this package's callers. */
 export { splitSqlStatements };
-export declare function defineScopeDO(modules: ModuleRegistration[], bareOps: Record<string, OperationHandler<never, unknown>>): new (ctx: DurableObjectState, env: ScopeDoEnv) => DurableObject<ScopeDoEnv>;
+export declare function defineScopeDO(modules: ModuleRegistration[], bareOps: Record<string, OperationHandler<never, unknown>>, 
+/**
+ * #2430: `permissions` is the vertical's `definePermissions(...)` value, the one `substrat push`
+ * and `lint:permissions` read. Given, a module in `modules` that its list leaves out is refused
+ * when the class is defined, as `registerModule` refuses one on either host.
+ */
+options?: {
+    permissions?: DeclaredPermissions;
+}): new (ctx: DurableObjectState, env: ScopeDoEnv) => DurableObject<ScopeDoEnv>;
 //# sourceMappingURL=scope-do.d.ts.map

package/dist/scope-do.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"scope-do.d.ts","sourceRoot":"","sources":["../src/scope-do.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAC;AA8DnD,OAAO,EA2DL,KAAK,SAAS,EAsBd,KAAK,kBAAkB,EAEvB,KAAK,gBAAgB,EAkHtB,MAAM,sBAAsB,CAAC;AAoD9B,OAAO,EAAW,KAAK,OAAO,EAAE,MAAM,eAAe,CAAC;AAGtD,OAAO,EAwBL,kBAAkB,EAgFnB,MAAM,sBAAsB,CAAC;AA0B9B;;;;;;;;;;;;;GAaG;AAEH,MAAM,WAAW,UAAU;IACzB;;;;;OAKG;IACH,aAAa,CAAC,EAAE,sBAAsB,CAAC;IACvC;;;;;;OAMG;IACH,mBAAmB,CAAC,EAAE,MAAM,CAAC;IAC7B;;;;;OAKG;IACH,0BAA0B,CAAC,EAAE,MAAM,CAAC;CACrC;AAoFD,oFAAoF;AACpF,MAAM,MAAM,aAAa,GAAG,UAAU,GAAG,UAAU,GAAG,SAAS,GAAG,SAAS,CAAC;AAwkB5E;;;GAGG;AACH,MAAM,MAAM,yBAAyB,CAAC,CAAC,IAAI,OAAO,CAAC,CAAC,CAAC,CAAC;AAmBtD;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AAEH;;;;GAIG;AACH,wBAAgB,aAAa,CAAC,GAAG,EAAE,UAAU,GAAG,SAAS,CAOxD;AAED,gHAAgH;AAChH,OAAO,EAAE,kBAAkB,EAAE,CAAC;AA2B9B,wBAAgB,aAAa,CAC3B,OAAO,EAAE,kBAAkB,EAAE,EAC7B,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,gBAAgB,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC,GACxD,KAAK,GAAG,EAAE,kBAAkB,EAAE,GAAG,EAAE,UAAU,KAAK,aAAa,CAAC,UAAU,CAAC,CA00O7E"}
+{"version":3,"file":"scope-do.d.ts","sourceRoot":"","sources":["../src/scope-do.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAC;AAgEnD,OAAO,EAwDL,KAAK,mBAAmB,EASxB,KAAK,SAAS,EAsBd,KAAK,kBAAkB,EAEvB,KAAK,gBAAgB,EAkHtB,MAAM,sBAAsB,CAAC;AAoD9B,OAAO,EAAW,KAAK,OAAO,EAAE,MAAM,eAAe,CAAC;AAGtD,OAAO,EAwBL,kBAAkB,EAgFnB,MAAM,sBAAsB,CAAC;AA2B9B;;;;;;;;;;;;;GAaG;AAEH,MAAM,WAAW,UAAU;IACzB;;;;;OAKG;IACH,aAAa,CAAC,EAAE,sBAAsB,CAAC;IACvC;;;;;;OAMG;IACH,mBAAmB,CAAC,EAAE,MAAM,CAAC;IAC7B;;;;;OAKG;IACH,0BAA0B,CAAC,EAAE,MAAM,CAAC;CACrC;AAoFD,oFAAoF;AACpF,MAAM,MAAM,aAAa,GAAG,UAAU,GAAG,UAAU,GAAG,SAAS,GAAG,SAAS,CAAC;AAmrB5E;;;GAGG;AACH,MAAM,MAAM,yBAAyB,CAAC,CAAC,IAAI,OAAO,CAAC,CAAC,CAAC,CAAC;AAmBtD;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AAEH;;;;GAIG;AACH,wBAAgB,aAAa,CAAC,GAAG,EAAE,UAAU,GAAG,SAAS,CAOxD;AAED,gHAAgH;AAChH,OAAO,EAAE,kBAAkB,EAAE,CAAC;AA2B9B,wBAAgB,aAAa,CAC3B,OAAO,EAAE,kBAAkB,EAAE,EAC7B,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,gBAAgB,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;AACzD;;;;GAIG;AACH,OAAO,GAAE;IAAE,WAAW,CAAC,EAAE,mBAAmB,CAAA;CAAO,GAClD,KAAK,GAAG,EAAE,kBAAkB,EAAE,GAAG,EAAE,UAAU,KAAK,aAAa,CAAC,UAAU,CAAC,CAqoP7E"}

package/dist/scope-do.js

@@ -1,8 +1,8 @@
 import { REWIND_REFUSED } from './rewind-refusal.js';
 import { SYSTEM_DOOR_MOVED } from './system-door.js';
 import { DurableObject } from 'cloudflare:workers';
-import { ATTACHMENT_ADDED, ATTACHMENT_REMOVED, attachmentRecord, domainEvent, domainEventInput, eventId, instant, objectRef, entityObjectRef, assertModuleEmittableType, assertKernelAuthoredType, toWireFailure, grantRefFromProof, principalId, principalBecomeCapabilityInput, scopeId as scopeIdOf, tenantId as tenantIdOf, platformRequestInput, platformRequestId, MAX_PENDING_PLATFORM_REQUESTS, MAX_PENDING_SWEEP_RUNS, SWEEP_RUNS_KIND, SCOPE_TABLE_PAGE_MAX, SCOPE_QUERY_ROW_MAX, listLimitOf, pageOf, countedPageOf, requestFingerprint, substratError, errorCodeOf, assertReplayableDump, REDRAIN_BATCH, } from '@substrat-run/contracts';
-import { ulid, DO_SQL_LIMITS, unknownRoleError, createUlid, assertAllowed, ConnectionSealingKeyUnavailableError, noSealingKeyMessage, sealTo, assertReadOnlyQuery, entitlementDenial, platformRequestHistoryQuery, platformRequestOf, PLATFORM_REQUEST_COLUMNS, PLATFORM_REQUEST_REDACTION_SQL, platformRequestRedactionParams, platformRequestRedactionQuery, intentPayloadCarriesSubject, redactSubjectJobRuns, eraseSubjectFromModules, moduleErasurePlan, redactSubjectScopeText, assertRowLimit, assertRowOffset, JOB_RUN_PATCH_SQL, JOB_RUN_CLAIM_SQL, JOB_RUN_RENEW_SQL, JOB_RUN_BEGIN_SQL, JOB_RUN_MISS_SQL, JOB_RUN_MISS_SETTLE_SQL, admissionMissOutcome, JOB_LEASE_EXPIRED_NOTE, JOB_STEP_RECORD_SQL, DELIVERY_ERROR_REDACTION_SQL, REDACTED_DELIVERY_NOTE, seatScopeTuple, delegatedRevokeSql, writeExplicitTupleIn, grantEntityShapeIn, topUpEntityGrantShapes, applyScopeRoleChange, changeScopeRole, revokeScopeRoles, scopeRoleHolders, effectiveRoleGrantQuery, switchRecordedOff, switchSystemSchedules, peerGrantsStatus, systemGrantsStatus, systemScheduleState, systemSwitchedOff, denialListQuery, refusalListQuery, mapRefusalRow, denialSummaryQuery, denialTotalsQuery, DENIAL_WINDOW_QUERY, mapDenialRow, mapDenialSummaryBuckets, PermissionDenied, assertImpersonationWrites, assertModuleEnqueueableKind, impersonationStampOf, createAtomic, NotSearchable, isSearchIndexTable, searchIndexPlans, NotListable, listIndexPlans, moduleMigrations, MIGRATION_DIGEST_FENCE_DDL, MIGRATION_DIGEST_MARK_LEGACY, assertJournalDumpCoherent, assertMigrationSql, migrationDivergence, migrationFailedError, migrationSetDivergence, migrationSteps, planMigrations, listQuery, cursorOf, searchLimit, searchMatchExpression, searchQuery, ATTACHMENT_TEXT_DDL, ATTACHMENT_CONDEMNED_DDL, ATTACHMENT_SWEEP_LICENCE_DDL, ATTACHMENT_SWEEP_LICENCE_TABLE, clearOrphanSweepLicence, condemnLicensedOrphanAttachments, consumeOrphanSweepLicence, licensedOrphanIds, recordOrphanSweepLicence, refuseUnlicensedOrphanSweep, refuseCondemnedAttachment, refuseCondemnedInDump, rowlessAttachmentIds, attachmentRecordOfRow, enqueueAttachmentText, reconcileAttachmentText, queueAttachmentTextBackfill, startAttachmentTextBackfill, recordAttachmentText, searchAttachments, IDEMPOTENCY_DDL, REFUSALS_TABLE_DDL, REFUSALS_INDEX, refusalInsert, refusalOf, markGuardRefusal, REFUSALS_REBUILD, refusalsAdmitGuards, assertIdempotencyKey, assertPermissionKey, idempotencyLookupQuery, idempotencyPruneStatement, idempotencyRecordStatement, idempotencyOptedOutMessage, replayFor, entityVersionQuery, entityVersionOf, assertIfMatch, OUTBOX_ENTITY_INDEX, SCHEDULE_STATE_DDL, SCHEDULE_STATE_REBUILD, scheduleStateHasKind, VERTICAL_EVENTS_DDL, EXPORT_HOPS_SQL, emptyImportResult, IMPORT_CURSORS_SQL, IMPORT_CURSOR_OF_SQL, OUTBOX_MARK_SQL, exportedSinceQuery, emittedSinceQuery, emittedReportOf, EMITTED_REPORT_CAP, IMPORT_CURSOR_ADVANCE_SQL, IMPORT_RECORD_SQL, moveImportCursor, CrossVerticalRegistry, exportReadPlan, exportReadQuery, planExportBatch, withheldNote, JOB_RUN_DDL, JOB_RUN_DUE_AT, jobRunListLimit, SYSTEM_DOOR_WAIT, ancestorsWithin, } from '@substrat-run/kernel';
+import { ATTACHMENT_ADDED, ATTACHMENT_REMOVED, attachmentRecord, domainEvent, domainEventInput, eventId, instant, objectRef, entityObjectRef, assertModuleEmittableType, assertKernelAuthoredType, toWireFailure, grantRefFromProof, principalId, principalBecomeCapabilityInput, scopeId as scopeIdOf, tenantId as tenantIdOf, platformRequestInput, platformRequestId, MAX_PENDING_PLATFORM_REQUESTS, MAX_PENDING_SWEEP_RUNS, SWEEP_RUNS_KIND, SCOPE_DUMP_PAGE_MAX_BYTES, SCOPE_TABLE_PAGE_MAX, SCOPE_QUERY_ROW_MAX, listLimitOf, pageOf, countedPageOf, requestFingerprint, substratError, errorCodeOf, assertReplayableDump, REDRAIN_BATCH, } from '@substrat-run/contracts';
+import { ulid, DO_SQL_LIMITS, unknownRoleError, createUlid, assertAllowed, ConnectionSealingKeyUnavailableError, noSealingKeyMessage, sealTo, assertReadOnlyQuery, entitlementDenial, platformRequestHistoryQuery, platformRequestOf, PLATFORM_REQUEST_COLUMNS, PLATFORM_REQUEST_REDACTION_SQL, platformRequestRedactionParams, platformRequestRedactionQuery, intentPayloadCarriesSubject, redactSubjectJobRuns, eraseSubjectFromModules, moduleErasurePlan, redactSubjectScopeText, assertRowLimit, assertRowOffset, JOB_RUN_PATCH_SQL, JOB_RUN_CLAIM_SQL, JOB_RUN_RENEW_SQL, JOB_RUN_BEGIN_SQL, JOB_RUN_MISS_SQL, JOB_RUN_MISS_SETTLE_SQL, admissionMissOutcome, JOB_LEASE_EXPIRED_NOTE, JOB_STEP_RECORD_SQL, DELIVERY_ERROR_REDACTION_SQL, REDACTED_DELIVERY_NOTE, seatScopeTuple, delegatedRevokeSql, writeExplicitTupleIn, grantEntityShapeIn, topUpEntityGrantShapes, applyScopeRoleChange, changeScopeRole, revokeScopeRoles, scopeRoleHolders, assertModuleDeclared, noteReservedKeys, reservedGrantRefusal, reservedRoleRefusal, reservedShapeRefusal, effectiveRoleGrantQuery, switchRecordedOff, switchSystemSchedules, peerGrantsStatus, systemGrantsStatus, systemScheduleState, systemSwitchedOff, denialListQuery, refusalListQuery, mapRefusalRow, denialSummaryQuery, denialTotalsQuery, DENIAL_WINDOW_QUERY, mapDenialRow, mapDenialSummaryBuckets, PermissionDenied, assertImpersonationWrites, assertModuleEnqueueableKind, impersonationStampOf, createAtomic, NotSearchable, isSearchIndexTable, searchIndexPlans, NotListable, listIndexPlans, moduleMigrations, MIGRATION_DIGEST_FENCE_DDL, MIGRATION_DIGEST_MARK_LEGACY, assertJournalDumpCoherent, assertMigrationSql, migrationDivergence, migrationFailedError, migrationSetDivergence, migrationSteps, planMigrations, listQuery, cursorOf, searchLimit, searchMatchExpression, searchQuery, ATTACHMENT_TEXT_DDL, ATTACHMENT_CONDEMNED_DDL, ATTACHMENT_SWEEP_LICENCE_DDL, ATTACHMENT_SWEEP_LICENCE_TABLE, clearOrphanSweepLicence, condemnLicensedOrphanAttachments, consumeOrphanSweepLicence, licensedOrphanIds, recordOrphanSweepLicence, refuseUnlicensedOrphanSweep, refuseCondemnedAttachment, refuseCondemnedInDump, rowlessAttachmentIds, attachmentRecordOfRow, enqueueAttachmentText, reconcileAttachmentText, queueAttachmentTextBackfill, startAttachmentTextBackfill, recordAttachmentText, searchAttachments, IDEMPOTENCY_DDL, REFUSALS_TABLE_DDL, REFUSALS_INDEX, refusalInsert, refusalOf, markGuardRefusal, REFUSALS_REBUILD, refusalsAdmitGuards, assertIdempotencyKey, assertPermissionKey, idempotencyLookupQuery, idempotencyPruneStatement, idempotencyRecordStatement, idempotencyOptedOutMessage, replayFor, entityVersionQuery, entityVersionOf, assertIfMatch, OUTBOX_ENTITY_INDEX, SCHEDULE_STATE_DDL, SCHEDULE_STATE_REBUILD, scheduleStateHasKind, VERTICAL_EVENTS_DDL, EXPORT_HOPS_SQL, emptyImportResult, IMPORT_CURSORS_SQL, IMPORT_CURSOR_OF_SQL, OUTBOX_MARK_SQL, exportedSinceQuery, emittedSinceQuery, emittedReportOf, EMITTED_REPORT_CAP, IMPORT_CURSOR_ADVANCE_SQL, IMPORT_RECORD_SQL, moveImportCursor, CrossVerticalRegistry, exportReadPlan, exportReadQuery, planExportBatch, withheldNote, JOB_RUN_DDL, JOB_RUN_DUE_AT, jobRunListLimit, SYSTEM_DOOR_WAIT, ancestorsWithin, } from '@substrat-run/kernel';
 import { isUpgradeRequest, readSubscription, LIVE_DECIDE_ATTEMPTS, LIVE_FANOUT_LIMIT, LIVE_PRINCIPAL_HEADER, LIVE_SCOPE_HEADER, LIVE_SUBSCRIBE_PATH, LIVE_TENANT_HEADER, LIVE_WITHIN_HEADER, LIVE_EXPIRES_HEADER, LIVE_CLOSE, LIVE_SOCKETS_PER_PRINCIPAL, decodeLiveWithin, liveInstant, liveRefusal, liveRefusalStatus, } from './live-reads.js';
 import { replyOf } from './do-reply.js';
 import { OperationQueue } from './serialization.js';
@@ -11,7 +11,8 @@ import { actorOf, admitPeer, boundToPeerDeclarations, collectPeers, switchPeer,
 import { COPY_RESTORE_FENCE_LAPSED, copyRestoreFenceLapsed, orphanSweepVersionRefusal } from '@substrat-run/kernel';
 import { createDoTupleChecker, createLocalControlPlaneReader, scopeTupleReader } from './checker.js';
 import { settlePlatformRequestIn } from '@substrat-run/kernel';
-import { CARRIED_AWAY_KEY, COPY_MARK_CLEARED_KEY, KEPT_COPY_REFUSAL, KEPT_DIVERGENT_KEY, LOAD_STAMP_KEY, STORE_LOCAL_META_KEYS, WRITE_REVISION_KEY, carriedAwayDump, isCopyMarkInsert, isWriteStatement, assertSpineTablesBuilt, capabilitiesForLoad, clearCopyMarker, dumpRowsInsert, isSpineTable, markCopyOrigin, repointScopeGrants, settleCopiedWork, emittedHere, IS_COPY_SQL, isCopyLoad, isLifecycleWrite, readLifecycle, settleLifecycleAfterLoad, writeLifecycle, spineColumnAdditions } from '@substrat-run/kernel';
+import { loadDropsRowsOf } from '@substrat-run/kernel';
+import { CARRIED_AWAY_KEY, COPY_MARK_CLEARED_KEY, KEPT_COPY_REFUSAL, KEPT_DIVERGENT_KEY, LOAD_STAMP_KEY, STORE_LOCAL_META_KEYS, WRITE_REVISION_KEY, carriedAwayDump, isCopyMarkInsert, isWriteStatement, assertSpineTablesBuilt, clearCopyMarker, dumpRowsInsert, isSpineTable, markCopyOrigin, repointScopeGrants, settleCopiedWork, emittedHere, IS_COPY_SQL, isCopyLoad, isLifecycleWrite, readLifecycle, settleLifecycleAfterLoad, writeLifecycle, spineColumnAdditions } from '@substrat-run/kernel';
 import { GRANT_CHILDREN_INDEX_DDL, SHAPE_MARKER_INDEX_DDL, grantedEntitiesForContext } from '@substrat-run/kernel';
 /** A scope's migration journal: `module@version` → the SQL digest it recorded (#2066). */
 function readAppliedMigrations(sql) {
@@ -415,6 +416,68 @@ function kernelEmit(ctx, event) {
         throw new Error('kernelEmit: not an operation context this host built');
     write(event);
 }
+/** #2450: a commit or a page naming a stage this store no longer holds. */
+const STAGE_GONE = 'the staged load is not here any more (another carry replaced it, or it was already loaded); nothing was loaded';
+/**
+ * A staged load's own tables (#2450): `_substrat_stage` (which load, and the next page it takes),
+ * `_substrat_stage_tables` (each staged table's name, DDL and columns) and one
+ * `_substrat_stage_rows_<n>` per staged table. They hold a carry's pages until the load commits
+ * from them, so they are this store's, never its data: no dump carries them, and a load's drops
+ * leave them to the commit that reads them.
+ */
+const STAGE_GLOB = '_substrat_stage*';
+const STAGE_TABLES_DDL = [
+    `CREATE TABLE _substrat_stage (stage_id TEXT NOT NULL, next_seq INTEGER NOT NULL)`,
+    `CREATE TABLE _substrat_stage_tables (ord INTEGER PRIMARY KEY, name TEXT NOT NULL UNIQUE, ddl TEXT NOT NULL, columns TEXT NOT NULL)`,
+];
+const stageRowsTable = (ord) => `_substrat_stage_rows_${ord}`;
+/** How many staged rows a commit reads at a time. */
+const STAGE_READ_BATCH = 500;
+/** How many rows a dump page reads from a table at a time; each batch is read to its end. */
+const DUMP_READ_BATCH = 500;
+/** The names under which SQLite answers a table's rowid, unless a column takes one. */
+const ROWID_NAMES = new Set(['rowid', '_rowid_', 'oid']);
+/**
+ * The rows of `name` a dump carries, as a WHERE clause and its bindings. #1722: the load stamp and
+ * the write revision describe THIS store, so they never leave in a dump (`exportDumpStamped` hands
+ * the stamp over beside one); every load writes its own. #2350: the orphan sweep's licence is this
+ * store's own, so its rows never leave either.
+ */
+function dumpRowFilter(name) {
+    if (name === '_substrat_meta') {
+        return { where: `key NOT IN (${STORE_LOCAL_META_KEYS.map(() => '?').join(', ')})`, bindings: [...STORE_LOCAL_META_KEYS] };
+    }
+    if (name === ATTACHMENT_SWEEP_LICENCE_TABLE)
+        return { where: '0', bindings: [] };
+    return { where: '1', bindings: [] };
+}
+/** An estimate of a row's size on the wire, for sizing a dump page (#2450). Over, never under. */
+function rowBytes(row) {
+    let n = 0;
+    for (const cell of row) {
+        if (typeof cell === 'string')
+            n += cell.length * 3 + 2;
+        else if (cell instanceof ArrayBuffer || ArrayBuffer.isView(cell))
+            n += cell.byteLength * 4 + 2;
+        else
+            n += 24;
+    }
+    return n;
+}
+const encodeDumpCursor = (at) => JSON.stringify([at.table, at.after]);
+function decodeDumpCursor(cursor) {
+    let parsed;
+    try {
+        parsed = JSON.parse(cursor);
+    }
+    catch {
+        parsed = null;
+    }
+    if (!Array.isArray(parsed) || parsed.length !== 2 || typeof parsed[0] !== 'string' || !Number.isSafeInteger(parsed[1])) {
+        throw substratError('validation_failed', 'not a dump page cursor');
+    }
+    return { table: parsed[0], after: parsed[1] };
+}
 /**
  * The scope DO's write revision (#1722): the one SQL handle this object writes through, and the
  * one way it opens a transaction, so a writer or a transaction added later cannot slip past it.
@@ -678,7 +741,21 @@ function closeSessionEnded(ws) {
         // Already gone.
     }
 }
-export function defineScopeDO(modules, bareOps) {
+export function defineScopeDO(modules, bareOps, 
+/**
+ * #2430: `permissions` is the vertical's `definePermissions(...)` value, the one `substrat push`
+ * and `lint:permissions` read. Given, a module in `modules` that its list leaves out is refused
+ * when the class is defined, as `registerModule` refuses one on either host.
+ */
+options = {}) {
+    // At definition, not at construction: a worker whose module list drifted fails at its first
+    // import, rather than at the first scope it wakes.
+    for (const registration of modules)
+        assertModuleDeclared(options.permissions, registration.manifest.id);
+    // What the declared surface reserves holds in every instance too, whatever registers under its ids.
+    const declaredReserved = new Set();
+    for (const m of options.permissions?.modules ?? [])
+        noteReservedKeys(declaredReserved, m.manifest);
     return class ScopeDO extends DurableObject {
         sql;
         continuationOrder = 0;
@@ -735,6 +812,11 @@ export function defineScopeDO(modules, bareOps) {
         /** #2387: the operations held to a `ctx.check` — the pure adapter's set, from the same kernel read. */
         operationCheckHeld = new Set();
         modules = new Map();
+        /**
+         * #2430: what a registered module, or a module the class's declared `permissions` lists, declares
+         * `holder: 'system'` — the role and grant doors' refusals read it.
+         */
+        reservedKeys = new Set(declaredReserved);
         /** #1705: what this deployment exports to other verticals and imports from them. */
         crossVertical = new CrossVerticalRegistry();
         /**
@@ -913,6 +995,7 @@ export function defineScopeDO(modules, bareOps) {
                     handler,
                 })),
             });
+            noteReservedKeys(this.reservedKeys, manifest);
             if (erasure)
                 this.erasurePlans.push(erasure);
             for (const [name, handler] of Object.entries(registration.predicates ?? {})) {
@@ -3533,10 +3616,17 @@ export function defineScopeDO(modules, bareOps) {
             await this.ensureMigrations();
             return this.queue.enqueue(() => this.assignmentBound({ kind: 'principal', id: principal }, tenantId, atTenant ? null : scopeId, roleKey));
         }
-        /** Check and grant in one serialized scope task; a refusal never writes a tuple. */
+        /**
+         * Check and grant in one serialized scope task; a refusal never writes a tuple. `refused` (#2430)
+         * is a role carrying a key reserved to a system principal, answered as data so its text survives
+         * the hop and the coordinator types it.
+         */
         async assignScopeRoleBoundedFor(tenantId, scopeId, caller, assignee, roleKey) {
             await this.ensureMigrations();
             return this.queue.enqueue(async () => {
+                const refused = await this.reservedRoleRefusalFor(tenantId, roleKey, 'person');
+                if (refused)
+                    return { refused };
                 const bound = await this.assignmentBound({ kind: 'principal', id: caller }, tenantId, scopeId, roleKey);
                 if (bound?.covered) {
                     applyScopeRoleChange(this.switchSql(), scopeId, assignee, { revoke: [], grant: roleKey }, new Date().toISOString());
@@ -3555,7 +3645,70 @@ export function defineScopeDO(modules, bareOps) {
          */
         async changeScopeRoleBoundedFor(tenantId, scopeId, caller, principal, from, to) {
             await this.ensureMigrations();
-            return this.queue.enqueue(() => changeScopeRole(this.switchSql(), scopeId, principal, from, to, new Date().toISOString(), this.roleBound(caller, tenantId, scopeId), (run) => this.revision.transactionSync(run)));
+            return this.queue.enqueue(async () => {
+                // #2430: the role moved TO is conferred by a person; the one moved from is only taken back.
+                const refused = await this.reservedRoleRefusalFor(tenantId, to, 'person');
+                if (refused)
+                    return { refused };
+                return changeScopeRole(this.switchSql(), scopeId, principal, from, to, new Date().toISOString(), this.roleBound(caller, tenantId, scopeId), (run) => this.revision.transactionSync(run));
+            });
+        }
+        /**
+         * #2430: why `roleKey` may not be conferred through `door` here, or null — the tenant's role as
+         * the checker expands it (`controlPlaneReader`), against the keys this class's modules reserve.
+         * A role the tenant does not define is left to the door's own answer for it.
+         */
+        async reservedRoleRefusalFor(tenantId, roleKey, door) {
+            if (this.reservedKeys.size === 0)
+                return null;
+            const role = await this.controlPlaneReader().getRole(tenantId, roleKey);
+            return role ? reservedRoleRefusal(role, this.reservedKeys, door) : null;
+        }
+        /**
+         * #2430: `reservedRoleRefusalFor` for a caller that names no tenant — `assignScopeRole` — read
+         * against the tenant this scope's provisioning receipt names.
+         *
+         * A scope from before receipts (#1738) names its tenants only through the role rows it was
+         * projected (`tenantVerdict`'s inference), and each of those tenants is judged through the
+         * same reader the checker expands the role with (`controlPlaneReader`): the scope's own rows
+         * once it reads locally, the control plane's definition otherwise. So a stale or partial
+         * projection is never what decides for a checker that does not read it. A scope with no role
+         * row names no tenant: reading locally it expands nothing, so nothing is refused, but a checker
+         * reading the control plane would expand whichever tenant's role a later call names, which this
+         * door cannot know, so it refuses.
+         */
+        async reservedRoleRefusalHere(roleKey, door) {
+            if (this.reservedKeys.size === 0)
+                return null;
+            const tenantId = this.provisionedFor();
+            if (tenantId)
+                return this.reservedRoleRefusalFor(tenantId, roleKey, door);
+            const tenants = this.hasTable('_substrat_roles')
+                ? this.sql.exec('SELECT DISTINCT tenant_id FROM _substrat_roles').toArray().map((r) => r.tenant_id)
+                : [];
+            for (const projected of tenants) {
+                const refusal = await this.reservedRoleRefusalFor(projected, roleKey, door);
+                if (refusal)
+                    return refusal;
+            }
+            if (tenants.length === 0 && this.permissionSourceIsRemote()) {
+                return (`role '${roleKey}' cannot be judged here: this scope has no provisioning receipt and no projected role, and its ` +
+                    "checks read roles from the control plane, so which tenant's definition a check expands is unknown and a key " +
+                    'reserved to a system principal cannot be ruled out. Provision the scope first.');
+            }
+            return null;
+        }
+        /** #2430: why a raw grant of `permissions` is refused against this class's reservations, or null. */
+        async reservedGrantRefusalFor(permissions) {
+            return reservedGrantRefusal(permissions, this.reservedKeys);
+        }
+        /** #2430: why a reconcile of declared `shapes` is refused against this class's reservations, or null. */
+        async reservedShapeRefusalFor(shapes) {
+            return reservedShapeRefusal(shapes, this.reservedKeys);
+        }
+        /** #2430: which of `permissions` this class's modules reserve to a system principal. */
+        async reservedAmong(permissions) {
+            return permissions.filter((p) => this.reservedKeys.has(p));
         }
         /** The kernel's `revokeScopeRoles` in one serialized scope task (#1150). */
         async revokeScopeRolesBoundedFor(tenantId, scopeId, caller, principal) {
@@ -4943,31 +5096,99 @@ export function defineScopeDO(modules, bareOps) {
          * with the scope's identity after the K-3 check (host.ts admin.exportScope).
          */
         exportDump() {
-            // The derived search index (#827) is excluded: its shadow tables cannot be
-            // replayed — this host answers "object name reserved for internal use" — and
-            // it is recomputable, so `importDump` rebuilds it from the loaded rows. A dump
-            // carries the rows, never the index over them.
-            const defs = this.sql
-                .exec(`SELECT name, sql FROM sqlite_master
-              WHERE type = 'table' AND name NOT GLOB 'sqlite_*' AND name NOT GLOB '_cf_*' AND sql IS NOT NULL
-              ORDER BY name`)
-                .toArray().filter(({ name }) => !isSearchIndexTable(name));
-            return defs.map(({ name, sql }) => {
+            return this.dumpTableDefs().map(({ name, sql }) => {
                 // Raw positional rows, cells as-is (blobs kept as bytes, not nulled like a UI
                 // read) so the dump reloads faithfully. The name is from the live schema.
-                // #1722: the load stamp and the write revision describe THIS store, so they never leave
-                // in a dump (`exportDumpStamped` hands the stamp over beside one); every load writes its own.
-                const cursor = name === '_substrat_meta'
-                    ? this.sql.exec(`SELECT * FROM "${name}" WHERE key NOT IN (${STORE_LOCAL_META_KEYS.map(() => '?').join(', ')})`, ...STORE_LOCAL_META_KEYS)
-                    : // #2350: the orphan sweep's licence is this store's own, so its rows never leave in a dump.
-                        name === ATTACHMENT_SWEEP_LICENCE_TABLE
-                            ? this.sql.exec(`SELECT * FROM "${name}" WHERE 0`)
-                            : this.sql.exec(`SELECT * FROM "${name}"`);
+                const { where, bindings } = dumpRowFilter(name);
+                const cursor = this.sql.exec(`SELECT * FROM "${name}" WHERE ${where}`, ...bindings);
                 const columns = cursor.columnNames;
                 const rows = Array.from(cursor.raw(), (row) => row);
                 return { name, ddl: sql, columns, rows };
             });
         }
+        /**
+         * The tables a dump carries, by name. The derived search index (#827) is excluded: its shadow
+         * tables cannot be replayed — this host answers "object name reserved for internal use" — and
+         * it is recomputable, so `importDump` rebuilds it from the loaded rows. A dump carries the rows,
+         * never the index over them. A staged load's own tables (#2450) are this store's, not its data.
+         */
+        dumpTableDefs() {
+            return this.sql
+                .exec(`SELECT name, sql FROM sqlite_master
+              WHERE type = 'table' AND name NOT GLOB 'sqlite_*' AND name NOT GLOB '_cf_*'
+                AND name NOT GLOB '${STAGE_GLOB}' AND sql IS NOT NULL
+              ORDER BY name`)
+                .toArray().filter(({ name }) => !isSearchIndexTable(name));
+        }
+        /**
+         * One page of `exportDumpStamped` (#2450): the tables in the same order, each table's rows in
+         * rowid order, until about `maxBytes` of cells are read (a single larger row rides alone). Every
+         * table is in some page, empty or not. Each page is read in one turn, so it is consistent on its
+         * own; the pages are one consistent read only while `revision` stays the same, which the reader
+         * compares. With `stamp`, the first page (`cursor` null) mints the load stamp, as
+         * `exportDumpStamped` does; without it the export writes nothing, as `exportDump`.
+         */
+        exportDumpPage(cursor, opts = {}) {
+            // Answered as data, so a refusal's code survives the hop (#113).
+            return replyOf(() => this.dumpPage(cursor, opts));
+        }
+        dumpPage(cursor, { stamp = false, maxBytes = SCOPE_DUMP_PAGE_MAX_BYTES }) {
+            let loadStamp = this.loadStamp();
+            if (stamp && cursor === null && !loadStamp && !this.carriedAwayCopy) {
+                loadStamp = ulid();
+                this.sql.exec(`INSERT INTO _substrat_meta (key, value) VALUES (?, ?)`, LOAD_STAMP_KEY, loadStamp);
+            }
+            const at = cursor === null ? null : decodeDumpCursor(cursor);
+            const tables = [];
+            let bytes = 0;
+            let next = null;
+            for (const { name, sql } of this.dumpTableDefs()) {
+                // Tables are read in name order: those before the cursor's are done. A cursor naming a
+                // table that is gone resumes at the next name.
+                if (at && name < at.table)
+                    continue;
+                const after = at && name === at.table ? at.after : null;
+                const { where, bindings } = dumpRowFilter(name);
+                // Read to its end (it holds no row), as every cursor here is: see the batches below.
+                const probe = this.sql.exec(`SELECT * FROM "${name}" WHERE 0`);
+                probe.toArray();
+                const columns = probe.columnNames;
+                // A table without a rowid, or with a column that takes the name, is read by offset.
+                const byRowid = !/\bWITHOUT\s+ROWID\b/i.test(sql) && !columns.some((c) => ROWID_NAMES.has(c.toLowerCase()));
+                // In batches, each read to its end: a cursor left part-read keeps its table locked, and
+                // the next statement that drops or alters it fails with SQLITE_LOCKED.
+                const batch = (from) => Array.from(!byRowid
+                    ? this.sql.exec(`SELECT * FROM "${name}" WHERE ${where} LIMIT ? OFFSET ?`, ...bindings, DUMP_READ_BATCH, from ?? 0).raw()
+                    : from === null
+                        ? this.sql.exec(`SELECT rowid, * FROM "${name}" WHERE ${where} ORDER BY rowid LIMIT ?`, ...bindings, DUMP_READ_BATCH).raw()
+                        : this.sql
+                            .exec(`SELECT rowid, * FROM "${name}" WHERE (${where}) AND rowid > ? ORDER BY rowid LIMIT ?`, ...bindings, from, DUMP_READ_BATCH)
+                            .raw(), (raw) => raw);
+                const rows = [];
+                let last = after;
+                let full = false;
+                for (;;) {
+                    const read = batch(last);
+                    for (const cells of read) {
+                        rows.push(byRowid ? cells.slice(1) : cells);
+                        last = byRowid ? Number(cells[0]) : (last ?? 0) + 1;
+                        bytes += rowBytes(rows[rows.length - 1]);
+                        if (bytes >= maxBytes) {
+                            full = true;
+                            break;
+                        }
+                    }
+                    if (full || read.length < DUMP_READ_BATCH)
+                        break;
+                }
+                tables.push({ name, ddl: sql, columns, rows });
+                if (full) {
+                    next = encodeDumpCursor({ table: name, after: last ?? 0 });
+                    break;
+                }
+            }
+            return { tables, next, loadStamp, revision: this.metaValue(WRITE_REVISION_KEY) };
+        }
         /**
          * `exportDump`, with the store's load stamp read in the same call (#1722): the stamp a
          * carry's fenced wipe of this copy later expects. A store no load has stamped gets one now,
@@ -5159,7 +5380,16 @@ export function defineScopeDO(modules, bareOps) {
                     this.sql.exec(stmt);
             });
         }
-        async importDump(tables, destScopeId, { switchOff, sourceScopeId, exact, loadStamp, expect, resolveKept, markCopy, provisionedFor, fence, } = {}) {
+        async importDump(tables, destScopeId, opts = {}) {
+            return this.loadTables(tables.map((t) => ({ name: t.name, ddl: t.ddl, columns: t.columns, rows: () => t.rows })), destScopeId, opts);
+        }
+        /**
+         * The load `importDump` runs, over tables whose rows are read lazily (#2450): from the dump's
+         * arrays, or from a staged load's tables (`commitStagedDump`), so a load never needs every row
+         * in memory at once. `stageId` names the staged load the rows come from: checked inside the
+         * load's transaction, and its tables dropped in it once the rows are in.
+         */
+        async loadTables(tables, destScopeId, { switchOff, sourceScopeId, exact, loadStamp, expect, resolveKept, markCopy, provisionedFor, fence, } = {}, stageId) {
             // The WHOLE drop-then-replay runs under deferred foreign keys, in one transaction.
             //
             // Two distinct FK hazards, and both need the deferral — the second is why it cannot
@@ -5182,7 +5412,9 @@ export function defineScopeDO(modules, bareOps) {
             // rather than failing a restore over data about to be recomputed.
             // Matched without case, as SQLite resolves a table name (#1883 review).
             // #1686: a copy into another scope id loads no capability rows; a same-scope restore keeps them.
-            const replayable = capabilitiesForLoad(tables.filter((t) => !isSearchIndexTable(t.name.toLowerCase())), destScopeId, sourceScopeId);
+            const replayable = tables
+                .filter((t) => !isSearchIndexTable(t.name.toLowerCase()))
+                .map((t) => (loadDropsRowsOf(t.name, destScopeId, sourceScopeId) ? { ...t, rows: () => [] } : t));
             // The dump is untrusted input (#1143). `SqlStorage.exec` runs every statement
             // in the string it is given, so a `ddl` with anything appended to its CREATE
             // TABLE executed that too — with entirely plain identifiers, which is why no
@@ -5202,6 +5434,11 @@ export function defineScopeDO(modules, bareOps) {
                     fenceRefusals.add(lapsed);
                     throw lapsed;
                 }
+                // #2450: the staged load is still the one this commit names: a later carry's first page
+                // replaces a stage, and a load that already committed dropped its own.
+                if (stageId !== undefined && this.stageHead()?.stageId !== stageId) {
+                    throw substratError('precondition_failed', STAGE_GONE);
+                }
                 const before = this.loadMarker();
                 // #1713: the lifecycle the platform delivered here, read before the drops take it.
                 const lifecycleBefore = readLifecycle(this.switchSql());
@@ -5210,7 +5447,13 @@ export function defineScopeDO(modules, bareOps) {
                 // must agree with the receipt held, and is refused before the first drop if it does not.
                 // #2314: a row for an id the orphan sweep condemned here is refused, as the insert refuses it.
                 // Judged on `replayable`, the very tables whose rows the replay below inserts.
-                refuseCondemnedInDump(doSpineSql(this.sql), replayable);
+                // Only the ids are read (#2450): a staged load holds no table whole, this one included.
+                refuseCondemnedInDump(doSpineSql(this.sql), replayable
+                    .filter((t) => t.name.toLowerCase() === '_substrat_attachments')
+                    .map((t) => {
+                    const at = t.columns.indexOf('id');
+                    return { name: t.name, columns: ['id'], rows: at < 0 ? [] : Array.from(t.rows(), (row) => [row[at]]) };
+                }));
                 const receiptBefore = this.provisionedFor();
                 if (provisionedFor !== undefined && receiptBefore !== null && receiptBefore !== provisionedFor) {
                     const refused = substratError('conflict', tenantReceiptRefusal(receiptBefore, provisionedFor));
@@ -5244,7 +5487,9 @@ export function defineScopeDO(modules, bareOps) {
                     const existing = this.sql
                         // Nor workerd's own `_cf_*` (the live reaper's alarm keeps `_cf_METADATA`), which
                         // it refuses to drop.
-                        .exec(`SELECT name FROM sqlite_master WHERE type = 'table' AND name NOT GLOB 'sqlite_*' AND name NOT GLOB '_cf_*'`)
+                        // Nor a staged load's own tables (#2450): this commit reads its rows from them below.
+                        .exec(`SELECT name FROM sqlite_master WHERE type = 'table' AND name NOT GLOB 'sqlite_*' AND name NOT GLOB '_cf_*'
+                 AND name NOT GLOB '${STAGE_GLOB}'`)
                         .toArray();
                     // Search index tables are left alone here and rebuilt below (#827): dropping a
                     // shadow table directly is an error, and `sqlite_master` order would reach one
@@ -5289,9 +5534,13 @@ export function defineScopeDO(modules, bareOps) {
                     }
                     for (const t of replayable) {
                         const insert = dumpRowsInsert(t, columnsOf);
-                        for (const row of t.rows)
+                        for (const row of t.rows())
                             this.sql.exec(insert, ...row);
                     }
+                    // #2450: the staged rows are in, so the stage goes, with the load: a load refused or
+                    // rolled back after this keeps it, for a retry of the same commit.
+                    if (stageId !== undefined)
+                        this.dropStage();
                     // #1738: a dump's `provisioned_for` names the scope (and tenant) it was captured from,
                     // not this one, so it is never carried over. #2016: what stays is THIS store's own —
                     // the platform's word when the load carries it (a copy into a fresh scope records its
@@ -5409,8 +5658,149 @@ export function defineScopeDO(modules, bareOps) {
          * (`changed`, 412) and "this store is a kept copy" (`kept`, 409) from a failure.
          */
         async importDumpChecked(tables, destScopeId, opts) {
+            return this.checkedLoad(() => this.importDump(tables, destScopeId, opts));
+        }
+        /**
+         * Stage one page of a dump for a later `commitStagedDump` (#2450). The rows go into this
+         * store's own staging tables, untyped, so every cell is kept as it arrived; nothing of the
+         * scope's data is touched, and the write revision does not move, so the marker a carry read
+         * here before staging still holds at the commit. Page `0` of a new stage replaces any
+         * other; the following pages must arrive in order. A page already staged (page `0` included)
+         * answers `staged: false` and changes nothing, so a retried page is harmless.
+         */
+        stageDumpPage(stageId, seq, tables) {
+            // Answered as data, so a refusal's code survives the hop (#113).
+            return replyOf(() => this.stagePage(stageId, seq, tables));
+        }
+        stagePage(stageId, seq, tables) {
+            if (!Number.isSafeInteger(seq) || seq < 0)
+                throw substratError('validation_failed', 'a stage page is numbered from 0');
+            // The identifiers reach SQL below as text, so they are held to the replay rules first.
+            assertReplayableDump(tables, { maxColumns: DO_SQL_LIMITS.columns });
+            this.revisionSuspended = true;
             try {
-                return { refused: false, switchedOff: await this.importDump(tables, destScopeId, opts) };
+                return this.revision.transactionSync(() => {
+                    // A page 0 that already opened this stage is a retry, answered below as one.
+                    if (seq === 0 && this.stageHead()?.stageId !== stageId) {
+                        this.dropStage();
+                        for (const ddl of STAGE_TABLES_DDL)
+                            this.sql.exec(ddl);
+                        this.sql.exec(`INSERT INTO _substrat_stage (stage_id, next_seq) VALUES (?, 0)`, stageId);
+                    }
+                    const head = this.stageHead();
+                    if (head?.stageId !== stageId)
+                        throw substratError('precondition_failed', STAGE_GONE);
+                    if (seq < head.nextSeq)
+                        return { staged: false };
+                    if (seq > head.nextSeq) {
+                        throw substratError('precondition_failed', `stage page ${seq} arrived before page ${head.nextSeq}`);
+                    }
+                    // #2314: a page carrying an attachment row this store condemned is refused here, at the
+                    // page, as the commit refuses it again before its first drop (`loadTables`).
+                    refuseCondemnedInDump(doSpineSql(this.sql), tables);
+                    for (const t of tables) {
+                        const columns = JSON.stringify(t.columns);
+                        let held = this.sql
+                            .exec(`SELECT ord, ddl, columns FROM _substrat_stage_tables WHERE name = ?`, t.name)
+                            .toArray()[0];
+                        if (!held) {
+                            const ord = Number(this.sql.exec(`SELECT COUNT(*) AS n FROM _substrat_stage_tables`).toArray()[0].n);
+                            this.sql.exec(`INSERT INTO _substrat_stage_tables (ord, name, ddl, columns) VALUES (?, ?, ?, ?)`, ord, t.name, t.ddl, columns);
+                            // Untyped columns: no affinity, so a cell is stored exactly as it came.
+                            this.sql.exec(`CREATE TABLE "${stageRowsTable(ord)}" (${t.columns.map((_, i) => `c${i}`).join(', ')})`);
+                            held = { ord, ddl: t.ddl, columns };
+                        }
+                        else if (held.ddl !== t.ddl || held.columns !== columns) {
+                            throw substratError('precondition_failed', `table ${t.name} changed between dump pages; nothing more was staged`);
+                        }
+                        const insert = `INSERT INTO "${stageRowsTable(held.ord)}" VALUES (${t.columns.map(() => '?').join(', ')})`;
+                        for (const row of t.rows) {
+                            if (row.length !== t.columns.length) {
+                                throw substratError('validation_failed', `a row of ${t.name} has ${row.length} cells for ${t.columns.length} columns`);
+                            }
+                            this.sql.exec(insert, ...row);
+                        }
+                    }
+                    this.sql.exec(`UPDATE _substrat_stage SET next_seq = ?`, seq + 1);
+                    return { staged: true };
+                });
+            }
+            finally {
+                this.revisionSuspended = false;
+            }
+        }
+        /**
+         * Load the dump staged under `stageId` (#2450): `importDump`, its rows read from the stage a
+         * batch at a time rather than handed over whole, in the same one transaction with the same
+         * fences and refusals. The stage is dropped with the load; a refused load keeps it.
+         */
+        async commitStagedDumpChecked(stageId, destScopeId, opts) {
+            let count = 0;
+            const out = await this.checkedLoad(() => {
+                const head = this.stageHead();
+                if (head?.stageId !== stageId)
+                    throw substratError('precondition_failed', STAGE_GONE);
+                const staged = this.sql
+                    .exec(`SELECT ord, name, ddl, columns FROM _substrat_stage_tables ORDER BY name`)
+                    .toArray();
+                const tables = staged.map((t) => ({
+                    name: t.name,
+                    ddl: t.ddl,
+                    columns: JSON.parse(t.columns),
+                    rows: () => this.stagedRows(t.ord),
+                }));
+                count = tables.length;
+                return this.loadTables(tables, destScopeId, opts, stageId);
+            });
+            return out.refused === false ? { ...out, tables: count } : out;
+        }
+        /** Drop a staged load (#2450), if it is still `stageId`'s. A carry that gave up calls it. */
+        discardStagedDump(stageId) {
+            if (this.stageHead()?.stageId !== stageId)
+                return { discarded: false };
+            this.revisionSuspended = true;
+            try {
+                this.revision.transactionSync(() => this.dropStage());
+            }
+            finally {
+                this.revisionSuspended = false;
+            }
+            return { discarded: true };
+        }
+        /** One staged table's rows, in the order they were staged, a batch at a time. */
+        *stagedRows(ord) {
+            let after = 0;
+            for (;;) {
+                const batch = Array.from(this.sql
+                    .exec(`SELECT rowid, * FROM "${stageRowsTable(ord)}" WHERE rowid > ? ORDER BY rowid LIMIT ?`, after, STAGE_READ_BATCH)
+                    .raw(), (row) => row);
+                for (const row of batch)
+                    yield row.slice(1);
+                if (batch.length < STAGE_READ_BATCH)
+                    return;
+                after = Number(batch[batch.length - 1][0]);
+            }
+        }
+        /** The staged load this store holds (#2450), or null. */
+        stageHead() {
+            const present = this.sql.exec(`SELECT 1 FROM sqlite_master WHERE type = 'table' AND name = '_substrat_stage'`).toArray();
+            if (present.length === 0)
+                return null;
+            const row = this.sql.exec(`SELECT stage_id, next_seq FROM _substrat_stage`).toArray()[0];
+            return row ? { stageId: row.stage_id, nextSeq: Number(row.next_seq) } : null;
+        }
+        /** Drop every staging table (#2450). Inside the caller's transaction. */
+        dropStage() {
+            const names = this.sql
+                .exec(`SELECT name FROM sqlite_master WHERE type = 'table' AND name GLOB '${STAGE_GLOB}'`)
+                .toArray();
+            for (const { name } of names)
+                this.sql.exec(`DROP TABLE "${name}"`);
+        }
+        /** A load's refusals answered as values (#1722): across the RPC a throw carries only its message. */
+        async checkedLoad(run) {
+            try {
+                return { refused: false, switchedOff: await run() };
             }
             catch (e) {
                 if (e instanceof Error && fenceRefusals.has(e))
@@ -6031,6 +6421,10 @@ export function defineScopeDO(modules, bareOps) {
             // #2387: every check this context makes is counted, the kernel's own verbs' included.
             const runCheck = checks ? countChecks(decideUncounted, checks) : decideUncounted;
             const runCanAssign = async (roleKey) => {
+                // #2430: the answer a person's door would give — a role carrying a reserved key is refused.
+                const refused = await this.reservedRoleRefusalFor(tenantId, roleKey, 'person');
+                if (refused)
+                    throw substratError('forbidden', refused);
                 const bound = await this.assignmentBound(subject, tenantId, scopeId, roleKey);
                 if (!bound) {
                     throw unknownRoleError(roleKey);
@@ -6218,6 +6612,10 @@ export function defineScopeDO(modules, bareOps) {
                 grant: async (principal, permission, entity) => {
                     assertImpersonationWrites(impersonation, 'ctx.grant');
                     entityObjectRef(entity, 'ctx.grant'); // #1856: a tuple the walk can read back
+                    // #2430: whoever the caller is — a system actor passes guardrail 2 by construction.
+                    const reserved = reservedGrantRefusal([permission], this.reservedKeys);
+                    if (reserved)
+                        throw substratError('forbidden', reserved);
                     const held = await runCheck(permission, entity);
                     if (!held.allowed) {
                         throw new PermissionDenied(`cannot grant '${permission}' on ${entity.entityType}:${entity.entityId} — ` +