@substrat-run/adapter-sqlite 0.114.0 → 0.116.0

package/dist/index.js

@@ -1,8 +1,8 @@
 import { existsSync, mkdirSync, readdirSync, readFileSync, rmSync, writeFileSync } from 'node:fs';
 import { dirname, join } from 'node:path';
 import Database from 'better-sqlite3';
-import { accessLogEntry, adminLogEntry, opsFailureEntry, opsFailureFingerprint, issueEntry, FRESHNESS_HEARTBEAT_MINUTES, sweepRunEntry, modelUsageEntry, ATTACHMENT_ADDED, ATTACHMENT_REMOVED, attachmentRecord, createTenantInput, domainEvent, domainEventInput, entitlementGrant, entitlementGrantInput, eventId, meterReading, platformRequestInput, platformRequestId, platformRequest, MAX_PENDING_PLATFORM_REQUESTS, identityLink, identityPool, instant, connection, capabilityGrant, connectionGrant, connectionGrantRecord, connectionSecret, systemGrant, subjectRef, requestFingerprint, createConnectionInput, projectedConnectionGrant, projectedConnectionKey, moduleManifest, createOrgInput, promotionAcknowledgement, bindHostnameInput, channelHistoryEntry, hostnameBinding, publishVersionInput, AUTO_ADMISSION_NOTE, routeTarget, registerVerticalInput, vertical as verticalSchema, verticalChannel, verticalVersion, objectRef, grantRefFromProof, org as orgSchema, orgMembership, principalId, resolvedIdentity, roleDefinition, scope as scopeSchema, tenant as tenantSchema, tenantRole, subjectShredReceipt, SCOPE_TABLE_PAGE_DEFAULT, SCOPE_TABLE_PAGE_MAX, SCOPE_QUERY_ROW_MAX, verticalServingState, outboundOfManifestJson, listLimitOf, substratError, assertReplayableDump, delegatedReadRecord, redrainEventsInput, REDRAIN_BATCH, } from '@substrat-run/contracts';
-import { asPrincipal, assertAllowed, assertReadOnlyQuery, attachmentBlobKey, entitlementDenial, foldMeterReading, guardSpine, parseValidationRecords, resolveScopeRecord, ulid, ISSUE_RETENTION_DAYS, OPS_FAILURE_RETENTION_DAYS, SWEEP_RUN_RETENTION_DAYS, MODEL_USAGE_RETENTION_DAYS, foldModelUsage, backoffAt, platformRequestHistoryQuery, PLATFORM_REQUEST_COLUMNS, denialListQuery, denialSummaryQuery, denialTotalsQuery, DENIAL_WINDOW_QUERY, mapDenialRow, mapDenialSummaryBuckets, IMPERSONATION_COLUMNS, IMPERSONATION_DDL, ImpersonationRefused, assertImpersonationWrites, assertModuleEnqueueableKind, assertSessionUsable, impersonationByIdQuery, impersonationListQuery, impersonationRowValues, impersonationStampOf, mapImpersonationRow, newImpersonationSession, resolveRetryPolicy, isSecretBoxConfigured, unconfiguredSecretBox, createSubjectKeys, generateSealingKeyPair, noSealingKeyMessage, openSealed, sealTo, ConnectionSealingKeyUnavailableError, PermissionDenied, createAtomic, NotSearchable, NotListable, listIndexMigrations, listIndexPlans, listQuery, cursorOf, isSearchIndexTable, searchIndexDdl, searchIndexMigrations, searchIndexPlans, searchLimit, searchMatchExpression, searchQuery, entityVersionQuery, entityVersionOf, assertIfMatch, OUTBOX_ENTITY_INDEX, IDEMPOTENCY_DDL, assertIdempotencyKey, idempotencyLookupQuery, idempotencyPruneStatement, idempotencyRecordStatement, idempotencyOptedOutMessage, replayFor, globalFetch, createUlid, facetEvents, readHistory, walkEventCause, walkEventEffects, assertRedrainWindow, readInvocation, readDeadLetters, } from '@substrat-run/kernel';
+import { accessLogEntry, adminLogEntry, opsFailureEntry, opsFailureFingerprint, issueEntry, FRESHNESS_HEARTBEAT_MINUTES, sweepRunEntry, modelUsageEntry, ATTACHMENT_ADDED, ATTACHMENT_REMOVED, attachmentRecord, createTenantInput, domainEvent, domainEventInput, entitlementGrant, entitlementGrantInput, eventId, meterReading, platformRequestInput, platformRequestId, platformRequest, MAX_PENDING_PLATFORM_REQUESTS, identityLink, identityPool, instant, connection, capabilityGrant, connectionGrant, connectionGrantRecord, connectionSecret, systemGrant, subjectRef, requestFingerprint, createConnectionInput, projectedConnectionGrant, projectedConnectionKey, moduleManifest, createOrgInput, promotionAcknowledgement, bindHostnameInput, channelHistoryEntry, hostnameBinding, publishVersionInput, AUTO_ADMISSION_NOTE, routeTarget, registerVerticalInput, vertical as verticalSchema, verticalChannel, verticalVersion, objectRef, grantRefFromProof, org as orgSchema, orgMembership, principalId, resolvedIdentity, identityMembership, roleDefinition, scope as scopeSchema, tenant as tenantSchema, tenantRole, subjectShredReceipt, SCOPE_TABLE_PAGE_DEFAULT, SCOPE_TABLE_PAGE_MAX, SCOPE_QUERY_ROW_MAX, verticalServingState, outboundOfManifestJson, listLimitOf, substratError, assertReplayableDump, delegatedReadRecord, redrainEventsInput, REDRAIN_BATCH, } from '@substrat-run/contracts';
+import { asPrincipal, assertAllowed, assertReadOnlyQuery, attachmentBlobKey, entitlementDenial, foldMeterReading, guardSpine, parseValidationRecords, resolveScopeRecord, ulid, ISSUE_RETENTION_DAYS, OPS_FAILURE_RETENTION_DAYS, SWEEP_RUN_RETENTION_DAYS, MODEL_USAGE_RETENTION_DAYS, foldModelUsage, backoffAt, platformRequestHistoryQuery, PLATFORM_REQUEST_COLUMNS, denialListQuery, denialSummaryQuery, denialTotalsQuery, DENIAL_WINDOW_QUERY, mapDenialRow, mapDenialSummaryBuckets, IMPERSONATION_COLUMNS, IMPERSONATION_DDL, ImpersonationRefused, assertImpersonationWrites, assertModuleEnqueueableKind, assertSessionUsable, impersonationByIdQuery, impersonationListQuery, impersonationRowValues, impersonationStampOf, mapImpersonationRow, newImpersonationSession, resolveRetryPolicy, isSecretBoxConfigured, unconfiguredSecretBox, createSubjectKeys, generateSealingKeyPair, noSealingKeyMessage, openSealed, sealTo, ConnectionSealingKeyUnavailableError, PermissionDenied, createAtomic, NotSearchable, NotListable, listIndexMigrations, listIndexPlans, listQuery, cursorOf, isSearchIndexTable, searchIndexDdl, searchIndexMigrations, searchIndexPlans, searchLimit, searchMatchExpression, searchQuery, entityVersionQuery, entityVersionOf, assertIfMatch, OUTBOX_ENTITY_INDEX, SCHEDULE_STATE_DDL, SCHEDULE_STATE_REBUILD, scheduleStateHasKind, JOB_RUN_DDL, jobRunListLimit, jobRunOf, runDueJobRuns, startJobRun, IDEMPOTENCY_DDL, assertIdempotencyKey, idempotencyLookupQuery, idempotencyPruneStatement, idempotencyRecordStatement, idempotencyOptedOutMessage, replayFor, globalFetch, createUlid, facetEvents, readHistory, walkEventCause, walkEventEffects, assertRedrainWindow, readInvocation, readDeadLetters, } from '@substrat-run/kernel';
 import { ScopeActor } from './actor.js';
 import { createTupleChecker } from './checker.js';
 /**
@@ -119,10 +119,35 @@ const KERNEL_DDL = `
     operation TEXT,
     -- K-42: WHICH of the two actors was refused is exactly what this log is for.
     impersonation TEXT,
+    -- #1525: the INVOCATION this refusal happened during, the same id #1237 stamps on
+    -- every event of a call. A denial joins to nothing but actor and time otherwise —
+    -- the operation column names what was attempted, never WHICH attempt — so "what
+    -- else did this request do" cannot reach a refusal, which is the one thing an
+    -- incident asks about first. NULL = the transport carried no id (a seed, a test,
+    -- an internal call, an attachment RPC), or the row predates the column.
+    invocation_id TEXT,
     at TEXT NOT NULL,
     drained_at TEXT
   );
   ${IDEMPOTENCY_DDL}
+  -- #383 / #1232 / #1288: the platform sweep's per-scope gating state, holding two
+  -- families of row that the kind COLUMN — not the spelling of a key — tells apart.
+  -- Spine (kernel-written), never a module migration. Shared with the DO adapter from
+  -- @substrat-run/kernel, so the shape a rebuild produces and the shape a fresh store
+  -- gets cannot part company; the column comments are in there.
+  --
+  -- HERE since #1288, rather than lazily in runDueSchedules/checkFreshness as it was:
+  -- a table only one adapter's KERNEL_DDL declares is a one-sided NOTE to
+  -- lint:spine-ddl, never a failure, so the copies this issue had to keep in step were
+  -- the copies the gate could not see. Every scope db passes through runtime(), which
+  -- runs this, so the lazy creates were load-bearing for nothing.
+  ${SCHEDULE_STATE_DDL}
+  -- #1577: the resumable-run driver's record and the step ledger of the pass it
+  -- currently has in flight. Spine (kernel-written), never a module migration.
+  -- Shared with the DO adapter from @substrat-run/kernel so the shape a self-host
+  -- builds and the shape production builds cannot part company; the column
+  -- comments, and the reason coalescing is NOT a unique index, are in there.
+  ${JOB_RUN_DDL}
   CREATE TABLE IF NOT EXISTS _substrat_migrations (
     module_id TEXT NOT NULL,
     version TEXT NOT NULL,
@@ -155,6 +180,17 @@ const KERNEL_DDL = `
     --   next_attempt_at IS NULL      -> terminal: error IS NULL delivered, else dead
     attempts INTEGER NOT NULL DEFAULT 0,
     next_attempt_at TEXT,
+    -- #1525: the invocation THIS ATTEMPT ran in, the same id #1237 stamps on every
+    -- event of a call. Not the emitting event's — that one is already on the outbox
+    -- and a delivery joins to it through event_id. What that join cannot say is
+    -- which call attempted the DELIVERY, and for an executor the two differ by
+    -- design: attempt one runs in the emitting call's post-commit tail, every retry
+    -- afterwards in a drain that is a different call or none. Moves with the row on
+    -- an upsert, like delivered_at, error and attempts — it describes the
+    -- latest attempt, not the first. NULL = that attempt carried no call (a
+    -- scheduled drain, an alarm, a seed, an attachment RPC), or the row predates
+    -- the column.
+    invocation_id TEXT,
     PRIMARY KEY (event_id, consumer_module)
   );
   -- Attachment metadata facts (#473): one row per object in the per-tenant blob store,
@@ -350,6 +386,32 @@ const admitByDelivery = (rt, eventId, row) => {
 };
 export class SqliteScopeHost {
     admin;
+    /**
+     * Live reads are not available on this host (#938) — `never`, not `undefined`.
+     *
+     * This is the `clock?: never` seam (`CloudflareScopeHostOptions`) pointing the other
+     * way. There, the hosted adapter refuses an option it could only honour for half of
+     * the host's judgements; here, the pure adapter refuses a surface it cannot honour at
+     * all. A live read needs something that outlives a request and can be woken when an
+     * event lands. On Cloudflare that is the scope's own Durable Object, which the runtime
+     * keeps addressable between requests. This host is a function call inside somebody
+     * else's process: nothing here survives the return, so the only honest answer is that
+     * there is no subscription to hand out.
+     *
+     * `never` rather than an omission, and rather than a `subscribe` that throws, because
+     * those two fail in the places this one does not: an omission makes
+     * `host.liveReads?.subscribe(…)` compile and silently do nothing, and a thrower moves
+     * the discovery to runtime, in production, on the one path nobody drove in a test.
+     * The field is declared so that reaching for it is refused by the compiler at the call
+     * site — the same argument the clock seam makes in its own comment.
+     *
+     * What this costs, stated rather than hidden: nothing in the fan-out is held to a
+     * CONTRACT suite, because a contract suite asserts the two adapters agree and on this
+     * they deliberately do not. The tests live on `adapter-cloudflare` instead, beside the
+     * only host that can run them. The day a pure host grows a long-lived transport, this
+     * comment and those tests' home are the whole change.
+     */
+    liveReads;
     dir;
     checker;
     directory;
@@ -399,6 +461,13 @@ export class SqliteScopeHost {
     roles = new Map(); // 'tenantId/roleKey'
     /** Executor id → {eventType, handler} (K-22 §4.2). Host code, not module code. */
     executors = new Map();
+    /**
+     * `<moduleId>/<job>` → the pass body and its default step policy (#1577). Host
+     * code like `executors`, and keyed the way a run row is: the coalescing key's
+     * first two thirds, so a run picked off the table finds its handler by the
+     * columns it already carries.
+     */
+    jobs = new Map();
     /**
      * The event currently being effected by an executor, stamped onto any admin rows
      * it writes. Ambient rather than threaded through every HostAdmin signature: it is
@@ -1627,12 +1696,16 @@ export class SqliteScopeHost {
             }
             catch (err) {
                 rt.db.exec('ROLLBACK');
+                // #1525: null. This task is the attachment RPC's own — no invoke set an id on
+                // the runtime, and the actor guarantees no other task is mid-flight holding one.
                 if (err instanceof PermissionDenied)
-                    this.recordDenial(rt, subject, operation, err);
+                    this.recordDenial(rt, subject, operation, err, null);
                 throw err;
             }
-            await this.dispatch(rt);
-            await this.dispatchExecutors(rt);
+            // #1525: null, for the reason the denial two lines up records null — this task
+            // is the attachment RPC's own and no invoke set an id on the runtime.
+            await this.dispatch(rt, null);
+            await this.dispatchExecutors(rt, null);
             return result;
         });
         /**
@@ -1653,8 +1726,12 @@ export class SqliteScopeHost {
                 return await fn(this.operationContext(rt, subject, undefined, undefined, undefined, operation));
             }
             catch (err) {
+                // #1525: the ENCLOSING call's id, deliberately. This runner takes no turn of its
+                // own — it is the connector's dispatch-time read, already inside that call's
+                // actor task — so its refusal belongs to that call, for the reason a consumer's
+                // emit does (#1237): dispatch runs in the same post-commit tail and IS the call.
                 if (err instanceof PermissionDenied)
-                    this.recordDenial(rt, subject, operation, err);
+                    this.recordDenial(rt, subject, operation, err, rt.invocationId);
                 throw err;
             }
         };
@@ -2148,22 +2225,11 @@ export class SqliteScopeHost {
             return report;
         const rt = this.runtime(tenantId, scopeId);
         await this.applyPendingMigrations(rt);
-        // Same lazy create as runDueSchedules — a freshness-only module must not hit
-        // `no such table` on a scope no schedule ever swept. Despite the table's name it
-        // holds two kinds of row (#1232): schedule operations keyed `module/verb`, and
-        // the rows written just below, keyed `freshness:<eventType>`. For those,
-        // `last_run_at`/`last_status` are the last RECORDED at and verdict — nothing ran.
-        // Only half the no-collision claim is enforced: an event type has passed
-        // contracts' `eventType` regex (lowercase `ns.verb`, no colon), so a freshness
-        // key can never look like an operation — but `scheduleSpec.operation` is
-        // `z.string().min(1)`, so a schedule literally named `freshness:orders.placed`
-        // would share this row and nothing would refuse it. #1288 tracks the `kind`
-        // column that would make the distinction real instead of conventional.
-        rt.db.exec(`CREATE TABLE IF NOT EXISTS _substrat_schedule_state (
-         schedule_op TEXT PRIMARY KEY,
-         last_run_at TEXT,
-         last_status TEXT
-       )`);
+        // The gating-state table is KERNEL_DDL's since #1288 — `runtime()` above ran it,
+        // so a freshness-only module on a scope no schedule ever swept finds the table
+        // there rather than creating it here. The rows written below are the evaluator's,
+        // `kind = 'freshness'`, keyed `freshness:<eventType>`: for those `last_run_at` /
+        // `last_status` are the last RECORDED at and verdict — nothing ran.
         // Collapse duplicate event types to the tightest window, ACROSS modules.
         const windows = new Map();
         for (const m of this.modules.values()) {
@@ -2194,8 +2260,12 @@ export class SqliteScopeHost {
                     ? 'ok'
                     : 'failed';
             const stateKey = `freshness:${eventType}`;
+            // #1288: the evaluator's own row, named by kind. Before the column, a module
+            // declaring a schedule called `freshness:<this type>` shared it — and the
+            // verdict read back here was whichever of the two wrote last.
             const state = rt.db
-                .prepare('SELECT last_run_at, last_status FROM _substrat_schedule_state WHERE schedule_op = ?')
+                .prepare(`SELECT last_run_at, last_status FROM _substrat_schedule_state
+            WHERE kind = 'freshness' AND schedule_op = ?`)
                 .get(stateKey);
             const changed = state?.last_status !== outcome;
             const heartbeatDue = !state?.last_run_at ||
@@ -2203,10 +2273,10 @@ export class SqliteScopeHost {
             if (!changed && !heartbeatDue)
                 continue;
             rt.db
-                .prepare(`INSERT INTO _substrat_schedule_state (schedule_op, last_run_at, last_status)
-             VALUES (?, ?, ?)
-           ON CONFLICT(schedule_op) DO UPDATE SET last_run_at = excluded.last_run_at,
-                                                  last_status = excluded.last_status`)
+                .prepare(`INSERT INTO _substrat_schedule_state (kind, schedule_op, last_run_at, last_status)
+             VALUES ('freshness', ?, ?, ?)
+           ON CONFLICT(kind, schedule_op) DO UPDATE SET last_run_at = excluded.last_run_at,
+                                                        last_status = excluded.last_status`)
                 .run(stateKey, nowIso, outcome);
             report.checks.push({ eventType, outcome, observedAt, withinHours });
         }
@@ -2240,21 +2310,20 @@ export class SqliteScopeHost {
             .get(`system:${moduleId}`, nowIso);
         if (!hasGrant)
             return report;
-        // The spine state table is created lazily on first sweep of a scope — it is
-        // kernel-owned (`_substrat_*`), never in a module migration. It holds this
-        // loop's rows, keyed by the schedule operation (`module/verb`, where
-        // `last_run_at`/`last_status` are when it RAN and how it ended), and — since
-        // #1232 — the freshness evaluator's, keyed `freshness:<eventType>`. See
-        // checkFreshness for what the columns mean there; #1288 tracks the widening.
-        rt.db.exec(`CREATE TABLE IF NOT EXISTS _substrat_schedule_state (
-         schedule_op TEXT PRIMARY KEY,
-         last_run_at TEXT,
-         last_status TEXT
-       )`);
+        // The spine state table is KERNEL_DDL's (#1288) — kernel-owned (`_substrat_*`),
+        // never a module migration, and created by `runtime()` above rather than lazily
+        // here. This loop's rows are `kind = 'schedule'`, keyed by the operation
+        // (`module/verb`, where `last_run_at`/`last_status` are when it RAN and how it
+        // ended); the freshness evaluator's are `kind = 'freshness'` — see checkFreshness
+        // for what the same two columns mean there.
         const now = Date.parse(nowIso);
         for (const schedule of mod.schedules) {
+            // #1288: this schedule's own row. `kind` is what makes that true even when the
+            // operation is spelled `freshness:<eventType>` — without it, the cadence gate
+            // below read the evaluator's last recorded verdict as a run of this operation.
             const row = rt.db
-                .prepare('SELECT last_run_at FROM _substrat_schedule_state WHERE schedule_op = ?')
+                .prepare(`SELECT last_run_at FROM _substrat_schedule_state
+            WHERE kind = 'schedule' AND schedule_op = ?`)
                 .get(schedule.operation);
             const lastRun = row?.last_run_at ? Date.parse(row.last_run_at) : null;
             const dueAt = lastRun === null ? -Infinity : lastRun + schedule.cadence.everyMinutes * 60_000;
@@ -2280,10 +2349,10 @@ export class SqliteScopeHost {
                 });
             }
             rt.db
-                .prepare(`INSERT INTO _substrat_schedule_state (schedule_op, last_run_at, last_status)
-             VALUES (?, ?, ?)
-           ON CONFLICT(schedule_op) DO UPDATE SET last_run_at = excluded.last_run_at,
-                                                  last_status = excluded.last_status`)
+                .prepare(`INSERT INTO _substrat_schedule_state (kind, schedule_op, last_run_at, last_status)
+             VALUES ('schedule', ?, ?, ?)
+           ON CONFLICT(kind, schedule_op) DO UPDATE SET last_run_at = excluded.last_run_at,
+                                                        last_status = excluded.last_status`)
                 .run(schedule.operation, new Date(now).toISOString(), status);
             report.runs.push({ operation: schedule.operation, outcome: status === 'ok' ? 'ok' : 'failed' });
         }
@@ -2481,7 +2550,8 @@ export class SqliteScopeHost {
                             // K-35: a refused check rolled the operation back. Record it now — a fresh
                             // statement in autocommit, AFTER the rollback, so the denial survives it.
                             if (err instanceof PermissionDenied)
-                                this.recordDenial(rt, subject, operation, err, session);
+                                // Inside the actor task that set it, so the field is this call's own (#1237).
+                                this.recordDenial(rt, subject, operation, err, rt.invocationId, session);
                             throw err;
                         }
                         // Post-commit, still inside the actor task: drain outbox → consumers,
@@ -2492,8 +2562,10 @@ export class SqliteScopeHost {
                         // drain — and draining anyway would run consumers as a side effect of a
                         // session that may not have side effects.
                         if (session?.mode !== 'read-only') {
-                            await this.dispatch(rt);
-                            await this.dispatchExecutors(rt);
+                            // #1525: still inside the actor task that set it, so these deliveries are
+                            // this call's own work — the same tail its consumers' emits are stamped in.
+                            await this.dispatch(rt, rt.invocationId);
+                            await this.dispatchExecutors(rt, rt.invocationId);
                         }
                         return structuredClone(result);
                     }
@@ -2594,7 +2666,15 @@ export class SqliteScopeHost {
      * At-least-once still requires idempotent handlers. Retry is the backstop, not a
      * substitute.
      */
-    async dispatchExecutors(rt) {
+    async dispatchExecutors(rt, 
+    /**
+     * #1525: the call this drain pass is running in, or null — PASSED, not read off
+     * `rt.invocationId`, for the reason `recordDenial` states. The Cloudflare twin
+     * has no ambient field to read here at all: its executors run on the coordinator
+     * and journal over RPC, so the id has to travel as an argument on that side, and
+     * a recorded fact whose correctness argument differs per adapter drifts.
+     */
+    invocationId) {
         const report = {
             attempted: 0,
             delivered: 0,
@@ -2628,11 +2708,11 @@ export class SqliteScopeHost {
                     else {
                         await executor.handler(this.admin, event);
                     }
-                    this.recordExecutorDelivery(rt, row.id, deliveryId, null, executor.retry);
+                    this.recordExecutorDelivery(rt, row.id, deliveryId, null, executor.retry, invocationId);
                     report.delivered += 1;
                 }
                 catch (err) {
-                    const dead = this.recordExecutorDelivery(rt, row.id, deliveryId, err instanceof Error ? (err.stack ?? err.message) : String(err), executor.retry);
+                    const dead = this.recordExecutorDelivery(rt, row.id, deliveryId, err instanceof Error ? (err.stack ?? err.message) : String(err), executor.retry, invocationId);
                     if (dead)
                         report.deadLettered += 1;
                     else
@@ -2653,7 +2733,9 @@ export class SqliteScopeHost {
      * silently marking success. Claiming first would make delivery at-most-once and
      * lose an effect on any crash in between.
      */
-    recordExecutorDelivery(rt, eventId, deliveryId, error, retry) {
+    recordExecutorDelivery(rt, eventId, deliveryId, error, retry, 
+    /** #1525: the call THIS attempt ran in, or null. Last, mirroring the DO's RPC. */
+    invocationId) {
         const prior = rt.db
             .prepare('SELECT attempts FROM _substrat_deliveries WHERE event_id = ? AND consumer_module = ?')
             .get(eventId, deliveryId)?.attempts ?? 0;
@@ -2663,20 +2745,160 @@ export class SqliteScopeHost {
         const nextAttemptAt = error === null || exhausted ? null : backoffAt(attempts, retry, new Date());
         rt.db
             .prepare(`INSERT INTO _substrat_deliveries
-           (event_id, consumer_module, delivered_at, error, attempts, next_attempt_at)
-         VALUES (?, ?, ?, ?, ?, ?)
+           (event_id, consumer_module, delivered_at, error, attempts, next_attempt_at,
+            invocation_id)
+         VALUES (?, ?, ?, ?, ?, ?, ?)
          ON CONFLICT (event_id, consumer_module) DO UPDATE SET
            delivered_at = excluded.delivered_at,
            error = excluded.error,
            attempts = excluded.attempts,
-           next_attempt_at = excluded.next_attempt_at`)
-            .run(eventId, deliveryId, new Date().toISOString(), error, attempts, nextAttemptAt);
+           next_attempt_at = excluded.next_attempt_at,
+           -- #1525: overwritten, like the four above. The row describes the LATEST
+           -- attempt, so a retry drained by a different call (or by none) must not
+           -- keep claiming the call that made the first one.
+           invocation_id = excluded.invocation_id`)
+            .run(eventId, deliveryId, new Date().toISOString(), error, attempts, nextAttemptAt, 
+        // #1525: the call this attempt ran in, as the caller named it.
+        invocationId);
         return error !== null && exhausted;
     }
     async drainDue(tenantId, scopeId) {
         const rt = this.runtime(tenantId, scopeId);
         await this.applyPendingMigrations(rt);
-        return rt.actor.enqueue(() => this.dispatchExecutors(rt));
+        // #1525: null, and honestly so — a sweep is not a call. An attempt this pass makes
+        // records no invocation, which is what distinguishes it from the first attempt the
+        // emitting operation's own tail made.
+        return rt.actor.enqueue(() => this.dispatchExecutors(rt, null));
+    }
+    registerJob(moduleId, name, handler, retry) {
+        const key = `${moduleId}/${name}`;
+        if (this.jobs.has(key))
+            throw new Error(`job '${key}' is already registered`);
+        this.jobs.set(key, { handler, retry });
+    }
+    /**
+     * D-14's in-process driver: the run store is direct SQL on the scope db.
+     *
+     * **The PASS stays outside the actor; every STORE OPERATION takes a turn on it.**
+     * That split is the whole of the concurrency design here, and the first cut got
+     * the second half wrong — it ran these statements on `rt.db` with no turn at all,
+     * under a comment claiming they "interleave exactly as any other write does".
+     * They do not. `invoke` opens a raw `BEGIN IMMEDIATE` on this same connection and
+     * HOLDS IT ACROSS AWAITS (its guards, its handler), so a job-store statement
+     * issued while some unrelated request was mid-operation landed INSIDE that
+     * request's transaction — and rolled back with it. A step whose effect had
+     * already happened would lose its ledger row and run a second time, for no reason
+     * connected to the job at all.
+     *
+     * A turn each is the fix, and it keeps the property the original comment wanted:
+     * a pass may take an hour, and holding the scope's lock for it would stop every
+     * request on that scope, so the pass itself is never enqueued. Only the short
+     * writes are. Nothing nests — a store operation never invokes, and the `invoke`s
+     * a pass makes through `pass.scope()` take their own separate turns — so there is
+     * no path by which this can deadlock against itself.
+     */
+    jobStore(rt) {
+        const db = rt.db;
+        const row = (v) => v ?? null;
+        const findLive = db.prepare(`SELECT * FROM _substrat_job_runs
+        WHERE module_id = ? AND job = ? AND instance = ? AND status = 'running'
+        ORDER BY id DESC LIMIT 1`);
+        const insertRun = db.prepare(`INSERT INTO _substrat_job_runs
+         (id, module_id, job, instance, payload, status, cursor, counters, attempts,
+          last_error, started_at, updated_at, next_attempt_at, ended_at)
+       VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`);
+        const patchRun = db.prepare(`UPDATE _substrat_job_runs
+          SET status = ?, cursor = ?, counters = ?, attempts = ?, last_error = ?,
+              updated_at = ?, next_attempt_at = ?, ended_at = ?
+        WHERE id = ?`);
+        const patchArgs = (id, p) => [p.status, p.cursor, p.counters, p.attempts, p.lastError, p.updatedAt, p.nextAttemptAt, p.endedAt, id];
+        // `db.transaction` on better-sqlite3 runs its body SYNCHRONOUSLY inside a real
+        // SQLite transaction, so nothing — not another turn of the event loop, not
+        // another caller of this host — can interleave between the read and the write.
+        // That is what makes the two operations below atomic rather than merely ordered.
+        const startOrJoinTx = db.transaction((key, r) => {
+            const live = row(findLive.get(key.moduleId, key.job, key.instance));
+            if (live)
+                return live;
+            insertRun.run(r.id, r.module_id, r.job, r.instance, r.payload, r.status, r.cursor, r.counters, r.attempts, r.last_error, r.started_at, r.updated_at, r.next_attempt_at, r.ended_at);
+            return r;
+        });
+        const commitPassTx = db.transaction((id, p) => {
+            patchRun.run(...patchArgs(id, p));
+            db.prepare('DELETE FROM _substrat_job_steps WHERE run_id = ?').run(id);
+        });
+        // Every store operation takes its own short turn on the scope actor, so no
+        // statement here can land inside an `invoke`'s open transaction. `turn` is the
+        // one place that happens; adding a method without it reintroduces the bug.
+        const turn = (fn) => rt.actor.enqueue(fn);
+        return {
+            startOrJoin: (key, r) => turn(() => startOrJoinTx(key, r)),
+            get: (id) => turn(() => row(db.prepare('SELECT * FROM _substrat_job_runs WHERE id = ?').get(id))),
+            due: (now, limit, afterId) => turn(() => db
+                .prepare(`SELECT * FROM _substrat_job_runs
+              WHERE status = 'running' AND (next_attempt_at IS NULL OR next_attempt_at <= ?)
+                AND (? IS NULL OR id > ?)
+              ORDER BY id LIMIT ?`)
+                .all(now, afterId ?? null, afterId ?? null, limit)),
+            list: (filter) => turn(() => {
+                const where = [];
+                const params = [];
+                for (const [column, value] of [
+                    ['module_id', filter.moduleId],
+                    ['job', filter.job],
+                    ['instance', filter.instance],
+                    ['status', filter.status],
+                ]) {
+                    if (value !== undefined) {
+                        where.push(`${column} = ?`);
+                        params.push(value);
+                    }
+                }
+                params.push(jobRunListLimit(filter.limit));
+                return db
+                    .prepare(`SELECT * FROM _substrat_job_runs
+             ${where.length ? `WHERE ${where.join(' AND ')}` : ''}
+             ORDER BY id DESC LIMIT ?`)
+                    .all(...params);
+            }),
+            patch: (id, p) => turn(() => {
+                patchRun.run(...patchArgs(id, p));
+            }),
+            commitPass: (id, p) => turn(() => commitPassTx(id, p)),
+            step: (runId, name) => turn(() => db
+                .prepare('SELECT step, result, attempts, last_error FROM _substrat_job_steps WHERE run_id = ? AND step = ?')
+                .get(runId, name) ?? null),
+            recordStep: (runId, name, result, attempts, lastError, at) => turn(() => {
+                db.prepare(`INSERT INTO _substrat_job_steps (run_id, step, result, attempts, last_error, recorded_at)
+             VALUES (?, ?, ?, ?, ?, ?)
+           ON CONFLICT (run_id, step) DO UPDATE SET result = excluded.result,
+                                                    attempts = excluded.attempts,
+                                                    last_error = excluded.last_error,
+                                                    recorded_at = excluded.recorded_at`).run(runId, name, result, attempts, lastError, at);
+            }),
+        };
+    }
+    async startJobRun(tenantId, scopeId, input) {
+        const rt = this.runtime(tenantId, scopeId);
+        await this.applyPendingMigrations(rt);
+        return jobRunOf(await startJobRun(this.jobStore(rt), input, ulid, this.clock));
+    }
+    async runDueJobs(tenantId, scopeId, options) {
+        const rt = this.runtime(tenantId, scopeId);
+        await this.applyPendingMigrations(rt);
+        return runDueJobRuns({
+            store: this.jobStore(rt),
+            handlerFor: (run) => this.jobs.get(`${run.module_id}/${run.job}`),
+            now: this.clock,
+            openScope: (run) => this.getSystemScope(run.module_id, tenantId, scopeId),
+            maxPasses: options?.maxPasses,
+            limit: options?.limit,
+        });
+    }
+    async jobRuns(tenantId, scopeId, filter) {
+        const rt = this.runtime(tenantId, scopeId);
+        await this.applyPendingMigrations(rt);
+        return (await this.jobStore(rt).list(filter ?? {})).map(jobRunOf);
     }
     async dispatchConnector(tenantId, scopeId, handler, event, options) {
         // The platform half of a routed `connector:<provider>` intent (#574 phase 3): run
@@ -2839,7 +3061,13 @@ export class SqliteScopeHost {
                 .run(outcome.status, outcome.result === undefined ? null : JSON.stringify(outcome.result), outcome.lastError ?? null, outcome.failure == null ? null : JSON.stringify(outcome.failure), outcome.status === 'pending' ? null : new Date().toISOString(), id);
         });
     }
-    async dispatch(rt) {
+    async dispatch(rt, 
+    /**
+     * #1525: the call this drain is running in, or null — PASSED, for the reason
+     * `dispatchExecutors` states. Every round of the loop belongs to it: a consumer's
+     * own emit is delivered in the same tail, so the whole cascade is one call's work.
+     */
+    invocationId) {
         for (let round = 0; round < 50; round++) {
             let deliveredAny = false;
             for (const mod of this.modules.values()) {
@@ -2867,9 +3095,10 @@ export class SqliteScopeHost {
                         try {
                             await consumer.handler(ctx, event);
                             rt.db
-                                .prepare(`INSERT INTO _substrat_deliveries (event_id, consumer_module, delivered_at)
-                   VALUES (?, ?, ?)`)
-                                .run(event.id, mod.id, new Date().toISOString());
+                                .prepare(`INSERT INTO _substrat_deliveries
+                     (event_id, consumer_module, delivered_at, invocation_id)
+                   VALUES (?, ?, ?, ?)`)
+                                .run(event.id, mod.id, new Date().toISOString(), invocationId);
                             rt.db.exec('COMMIT');
                             deliveredAny = true;
                         }
@@ -2878,9 +3107,10 @@ export class SqliteScopeHost {
                             // Dead-letter (v0): journal the failure so one poison event
                             // can't wedge the loop. Real redelivery/backoff is a later cut.
                             rt.db
-                                .prepare(`INSERT INTO _substrat_deliveries (event_id, consumer_module, delivered_at, error)
-                   VALUES (?, ?, ?, ?)`)
-                                .run(event.id, mod.id, new Date().toISOString(), String(err));
+                                .prepare(`INSERT INTO _substrat_deliveries
+                     (event_id, consumer_module, delivered_at, error, invocation_id)
+                   VALUES (?, ?, ?, ?, ?)`)
+                                .run(event.id, mod.id, new Date().toISOString(), String(err), invocationId);
                         }
                         finally {
                             // Cleared on BOTH paths. Left set, the id would leak onto every later
@@ -2902,6 +3132,19 @@ export class SqliteScopeHost {
      * point, since the denial is exactly the write the rolled-back operation could not make.
      */
     recordDenial(rt, subject, operation, err, 
+    /**
+     * #1525: the invocation this refusal belongs to, or null — PASSED, not read off
+     * `rt.invocationId` here.
+     *
+     * Every denial path on THIS adapter runs inside the scope's actor task, so reading
+     * `rt.invocationId` would in fact be right at each one. It is passed anyway, to keep
+     * one discipline across both adapters: the Cloudflare side has two denial paths that
+     * run outside its queue, where the ambient read rests on an argument about workerd's
+     * input gate rather than on anything local. A recorded fact whose correctness
+     * argument differs per adapter is the kind that drifts, so on both sides the caller
+     * says what it knows.
+     */
+    invocationId, 
     /** K-42: the session the refused call ran under, when it ran under one. */
     impersonation) {
         // Only an ENFORCED denial (assertAllowed, which attaches the checked permission +
@@ -2916,9 +3159,12 @@ export class SqliteScopeHost {
                 : subject.id;
         rt.db
             .prepare(`INSERT INTO _substrat_denials
-           (id, actor, permission, tenant_id, scope_id, operation, impersonation, at)
-         VALUES (?, ?, ?, ?, ?, ?, ?, ?)`)
-            .run(ulid(), JSON.stringify(actor), err.permission, err.node.tenantId, err.node.scopeId ?? null, operation, impersonation ? JSON.stringify(impersonationStampOf(impersonation)) : null, new Date().toISOString());
+           (id, actor, permission, tenant_id, scope_id, operation, impersonation,
+            invocation_id, at)
+         VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?)`)
+            .run(ulid(), JSON.stringify(actor), err.permission, err.node.tenantId, err.node.scopeId ?? null, operation, impersonation ? JSON.stringify(impersonationStampOf(impersonation)) : null, 
+        // #1525: the call this refusal belongs to, as the caller named it.
+        invocationId, new Date().toISOString());
     }
     parseOutboxRow(row) {
         return domainEvent.parse({
@@ -3787,7 +4033,7 @@ export class SqliteScopeHost {
                 const parsed = publishVersionInput.parse(input);
                 const owning = readVertical(parsed.verticalSlug);
                 if (!owning) {
-                    throw new Error(`unknown vertical '${parsed.verticalSlug}'`);
+                    throw substratError('not_found', `unknown vertical '${parsed.verticalSlug}'`);
                 }
                 // Lands PENDING — a push is not a deploy — except for a PRIVATE vertical
                 // (tenant-owned, not listed), whose blast radius is its own tenant: there the
@@ -3830,7 +4076,7 @@ export class SqliteScopeHost {
             setVerticalListed: async (actor, slug, listed) => {
                 const existing = readVertical(slug);
                 if (!existing)
-                    throw new Error(`unknown vertical '${slug}'`);
+                    throw substratError('not_found', `unknown vertical '${slug}'`);
                 // Listing is the moment other tenants start trusting this code, so the
                 // version they would install must carry a real staff vouch — an auto-admitted
                 // prod version has never been read by anyone but its author.
@@ -3853,14 +4099,14 @@ export class SqliteScopeHost {
             requestPublish: async (actor, slug) => {
                 const existing = readVertical(slug);
                 if (!existing)
-                    throw new Error(`unknown vertical '${slug}'`);
+                    throw substratError('not_found', `unknown vertical '${slug}'`);
                 this.directory.prepare('UPDATE verticals SET publish_requested_at = ? WHERE slug = ?').run(new Date().toISOString(), slug);
                 this.recordAdmin(actor, 'requestPublish', { tenantId: null }, null, { slug });
             },
             setVerticalInstallsBlocked: async (actor, slug, blocked) => {
                 const existing = readVertical(slug);
                 if (!existing)
-                    throw new Error(`unknown vertical '${slug}'`);
+                    throw substratError('not_found', `unknown vertical '${slug}'`);
                 this.directory
                     .prepare('UPDATE verticals SET installs_blocked = ? WHERE slug = ?')
                     .run(blocked ? 1 : 0, slug);
@@ -3869,7 +4115,7 @@ export class SqliteScopeHost {
             setVerticalTenantProvisioner: async (actor, slug, granted) => {
                 const existing = readVertical(slug);
                 if (!existing)
-                    throw new Error(`unknown vertical '${slug}'`);
+                    throw substratError('not_found', `unknown vertical '${slug}'`);
                 this.directory
                     .prepare('UPDATE verticals SET tenant_provisioner = ? WHERE slug = ?')
                     .run(granted ? 1 : 0, slug);
@@ -3878,7 +4124,7 @@ export class SqliteScopeHost {
             setVerticalEmailSender: async (actor, slug, granted) => {
                 const existing = readVertical(slug);
                 if (!existing)
-                    throw new Error(`unknown vertical '${slug}'`);
+                    throw substratError('not_found', `unknown vertical '${slug}'`);
                 this.directory
                     .prepare('UPDATE verticals SET email_sender = ? WHERE slug = ?')
                     .run(granted ? 1 : 0, slug);
@@ -3887,7 +4133,7 @@ export class SqliteScopeHost {
             deleteVertical: async (actor, slug) => {
                 const existing = readVertical(slug);
                 if (!existing)
-                    throw new Error(`unknown vertical '${slug}'`);
+                    throw substratError('not_found', `unknown vertical '${slug}'`);
                 // Refuse while any restorable scope is bound: a deleted registry row would strand
                 // those scopes' version pins and routing. An `archived` scope (a deleted app) still
                 // blocks — unarchive can bring it back — but the refusal names reap/restore, not
@@ -3900,10 +4146,10 @@ export class SqliteScopeHost {
                     'FROM scopes WHERE vertical = ?')
                     .get(slug);
                 if (bound.live > 0) {
-                    throw new Error(`vertical '${slug}' still backs ${bound.live} scope(s) — delete or rebind them first`);
+                    throw substratError('conflict', `vertical '${slug}' still backs ${bound.live} scope(s) — delete or rebind them first`);
                 }
                 if (bound.archived > 0) {
-                    throw new Error(`vertical '${slug}' still backs ${bound.archived} archived scope(s) — reap or restore them first`);
+                    throw substratError('conflict', `vertical '${slug}' still backs ${bound.archived} archived scope(s) — reap or restore them first`);
                 }
                 // Deployed dispatch scripts are NOT reaped here — they become orphans for the
                 // cleanup script (#248), never destroyed alongside a registry row.
@@ -3916,7 +4162,7 @@ export class SqliteScopeHost {
             admitVersion: async (actor, versionId) => {
                 const v = readVersion(versionId);
                 if (!v)
-                    throw new Error(`unknown version ${versionId}`);
+                    throw substratError('not_found', `unknown version ${versionId}`);
                 if (v.admission === 'admitted') {
                     // Idempotent — except an AUTO-admitted version, which this upgrades to a
                     // manual vouch by clearing the note (what the publish seam requires).
@@ -3932,7 +4178,7 @@ export class SqliteScopeHost {
                     return;
                 }
                 if (v.admission === 'rejected') {
-                    throw new Error(`version ${versionId} was rejected — publish a new one`);
+                    throw substratError('conflict', `version ${versionId} was rejected — publish a new one`);
                 }
                 this.directory
                     .prepare("UPDATE vertical_versions SET admission = 'admitted' WHERE id = ?")
@@ -3944,7 +4190,7 @@ export class SqliteScopeHost {
             rejectVersion: async (actor, versionId, note) => {
                 const v = readVersion(versionId);
                 if (!v)
-                    throw new Error(`unknown version ${versionId}`);
+                    throw substratError('not_found', `unknown version ${versionId}`);
                 if (v.admission === 'admitted') {
                     throw new Error(`version ${versionId} is already admitted — it may be bound`);
                 }
@@ -3961,7 +4207,7 @@ export class SqliteScopeHost {
             promoteVersion: async (actor, verticalSlug, channel, versionId, acknowledge) => {
                 const incoming = readVersion(versionId);
                 if (!incoming)
-                    throw new Error(`unknown version ${versionId}`);
+                    throw substratError('not_found', `unknown version ${versionId}`);
                 if (incoming.verticalSlug !== verticalSlug) {
                     throw new Error(`version ${versionId} belongs to '${incoming.verticalSlug}'`);
                 }
@@ -4091,7 +4337,7 @@ export class SqliteScopeHost {
             bindScopeVersion: async (actor, tenantId, scopeId, versionId, opts) => {
                 const v = readVersion(versionId);
                 if (!v)
-                    throw new Error(`unknown version ${versionId}`);
+                    throw substratError('not_found', `unknown version ${versionId}`);
                 const scope = this.directory
                     .prepare('SELECT tenant_id, kind, vertical_version_id FROM scopes WHERE scope_id = ?')
                     .get(scopeId);
@@ -4147,7 +4393,7 @@ export class SqliteScopeHost {
                     .prepare('SELECT * FROM verticals WHERE slug = ?')
                     .get(verticalSlug);
                 if (!r)
-                    throw new Error(`unknown vertical '${verticalSlug}'`);
+                    throw substratError('not_found', `unknown vertical '${verticalSlug}'`);
                 this.recordAccess(actor, 'verticalServing', {}, { verticalSlug }, r.serving_ref ? 1 : 0);
                 if (!r.serving_ref || !r.serving_version_id || !r.serving_migration_tag)
                     return null;
@@ -4164,7 +4410,7 @@ export class SqliteScopeHost {
                     .prepare('SELECT * FROM verticals WHERE slug = ?')
                     .get(verticalSlug);
                 if (!r)
-                    throw new Error(`unknown vertical '${verticalSlug}'`);
+                    throw substratError('not_found', `unknown vertical '${verticalSlug}'`);
                 this.directory
                     .prepare(`UPDATE verticals SET serving_ref = ?, serving_version_id = ?,
                     serving_do_classes = ?, serving_migration_tag = ? WHERE slug = ?`)
@@ -4176,7 +4422,7 @@ export class SqliteScopeHost {
                     .prepare('SELECT * FROM vertical_versions WHERE id = ?')
                     .get(versionId);
                 if (!v || v.vertical_slug !== verticalSlug) {
-                    throw new Error(`unknown version ${versionId} for vertical '${verticalSlug}'`);
+                    throw substratError('not_found', `unknown version ${versionId} for vertical '${verticalSlug}'`);
                 }
                 this.recordAccess(actor, 'versionManifest', {}, { verticalSlug, versionId }, v.manifest_json ? 1 : 0);
                 return v.manifest_json;
@@ -4265,12 +4511,34 @@ export class SqliteScopeHost {
                 // Directory check first, on mark's reasoning: "nothing to reopen" and "you may not
                 // address this scope" are different answers.
                 this.assertScopeReachable(tenantId, scopeId);
-                const { drainedBefore } = redrainEventsInput.parse(input);
+                const { drainedBefore, countOnly } = redrainEventsInput.parse(input);
                 // The window rule, enforced HERE and not only at the control-plane door: this verb
                 // is public `HostAdmin`, so the fleet script reaches it without passing that route.
-                // The injected clock, so a test pins the boundary rather than racing it.
+                // The injected clock, so a test pins the boundary rather than racing it. A count is
+                // held to it too — the two answers come from one verb and one door.
                 assertRedrainWindow(drainedBefore, this.clock());
                 const db = this.scopeDbFor(tenantId, scopeId);
+                // A COUNT reopens nothing, writes nothing, and records nothing (#1545). The two
+                // receipts below are there because a reopen is a second egress of a tenant's
+                // payloads; a count egresses none, and an admin row claiming a redrain on a scope
+                // that was only counted is a false statement in the one log that is evidence.
+                //
+                // UNBOUNDED, unlike the reopen under it: the batch exists because an UPDATE over
+                // the whole window must fit one Durable-Object request on the other adapter, and an
+                // aggregate materialises no rows. A capped count would answer "5000, or more",
+                // which is not an answer.
+                //
+                // It IS a read, and K-24 takes all reads rather than a chosen subset, so it leaves
+                // an access row — the count itself as the result count, which is the fact an
+                // auditor asking "who counted this tenant's outbox, and how much was there" wants.
+                if (countOnly) {
+                    const redrainable = db
+                        .prepare(`SELECT COUNT(*) AS c FROM _substrat_outbox
+                  WHERE drained_at IS NOT NULL AND drained_at < ?`)
+                        .get(drainedBefore).c;
+                    this.recordAccess(actor, 'redrainEvents', { tenantId, scopeId }, { drainedBefore, countOnly: true }, redrainable);
+                    return redrainable;
+                }
                 // Audit FIRST, matching the Cloudflare adapter and `rewindScope` (K-33): the row is
                 // a separate statement outside the update's transaction, so a failure between them
                 // would leave a reopen with no receipt — and the retry cannot repair it, because the
@@ -5121,6 +5389,40 @@ export class SqliteScopeHost {
                 this.recordAccess(actor, 'listIdentityTenants', {}, { provider }, tenants.length);
                 return tenants;
             },
+            listIdentityMemberships: async (actor, provider, externalId) => {
+                const pool = readPool(provider);
+                if (!pool)
+                    throw new Error(`identity pool '${provider}' is not registered`);
+                if (pool.topology !== 'central') {
+                    throw new Error(`identity pool '${provider}' is tenant-bound — enumerating tenants is only ` +
+                        `meaningful on a central pool, where the same externalId is the same person`);
+                }
+                const rows = this.directory
+                    .prepare(`SELECT i.tenant_id, i.principal_id, s.scope_id, s.vertical, s.status AS scope_status
+               FROM _substrat_identities i
+               LEFT JOIN scopes s ON s.scope_id = i.scope_id AND s.tenant_id = i.tenant_id
+              WHERE i.provider = ? AND i.external_id = ?
+              ORDER BY i.tenant_id`)
+                    .all(provider, externalId);
+                const memberships = rows.flatMap((r) => {
+                    // A link whose tenant row is gone names nothing a caller could land in.
+                    const tenant = readTenant(r.tenant_id);
+                    if (!tenant)
+                        return [];
+                    return [
+                        identityMembership.parse({
+                            tenant,
+                            principal: r.principal_id,
+                            scope: r.scope_id === null
+                                ? null
+                                : { id: r.scope_id, vertical: r.vertical, status: r.scope_status ?? 'active' },
+                        }),
+                    ];
+                });
+                // One row for the whole answer — the read this replaces logged one per tenant.
+                this.recordAccess(actor, 'listIdentityMemberships', {}, { provider }, memberships.length);
+                return memberships;
+            },
             listIdentityLinks: async (actor, tid) => {
                 // The projection read (#406): what the platform gathers to deliver a tenant's
                 // links with provisioning/reconcile — the same trust line entitlements ride
@@ -5826,6 +6128,26 @@ export class SqliteScopeHost {
         if (!existing)
             db.exec(`ALTER TABLE ${table} ADD COLUMN ${ddl}`);
     }
+    /**
+     * #1288: `_substrat_schedule_state`, rebuilt with `kind` in its key on a scope db
+     * whose table predates the column. The statements are the kernel's, so the DO
+     * adapter rebuilds byte-identically, and the detection is the `sqlite_master.sql`
+     * read `ensureIdentityKey` already uses — PRAGMA would do here, but not there.
+     */
+    ensureScheduleStateKind(db) {
+        const row = db
+            .prepare("SELECT sql FROM sqlite_master WHERE type = 'table' AND name = ?")
+            .get('_substrat_schedule_state');
+        if (!row || scheduleStateHasKind(row.sql))
+            return;
+        // In a transaction, for the reason the kernel constant spells out: create-copy-
+        // drop-rename has two intermediate states and BOTH are unrecoverable on the next
+        // wake — one dies on the leftover scratch table, one silently orphans the rows
+        // behind an empty table `CREATE TABLE IF NOT EXISTS` put back. `db.transaction`
+        // nests as a SAVEPOINT, which is what makes this safe on the `loadDump` path too,
+        // where the whole replay is already inside one.
+        db.transaction(() => db.exec(SCHEDULE_STATE_REBUILD))();
+    }
     /**
      * Rebuild `_substrat_identities` when it still carries the pre-K-22 global key.
      * A PRIMARY KEY cannot be ALTERed, so this is create-copy-drop-rename.
@@ -6516,6 +6838,11 @@ export class SqliteScopeHost {
         // consumer dead-letter.
         this.ensureColumn(db, '_substrat_deliveries', 'attempts', 'attempts INTEGER NOT NULL DEFAULT 0');
         this.ensureColumn(db, '_substrat_deliveries', 'next_attempt_at', 'next_attempt_at TEXT');
+        // #1525: the invocation an attempt ran in, on a scope DB created before the column.
+        // Nullable, and the null is honestly "no call was carried" — which attempt produced
+        // a delivery already journalled cannot be decided afterwards, exactly as #1237's
+        // outbox column argued.
+        this.ensureColumn(db, '_substrat_deliveries', 'invocation_id', 'invocation_id TEXT');
         // K-34: the authorization column on a scope DB created before it existed. Nullable,
         // so legacy outbox rows read as "unrecorded" — the honest value. (_substrat_denials
         // is a whole new table, so KERNEL_DDL's IF NOT EXISTS covers it with no ALTER.)
@@ -6531,6 +6858,10 @@ export class SqliteScopeHost {
         this.ensureColumn(db, '_substrat_outbox', 'impersonation', 'impersonation TEXT');
         this.ensureColumn(db, '_substrat_platform_requests', 'impersonation', 'impersonation TEXT');
         this.ensureColumn(db, '_substrat_denials', 'impersonation', 'impersonation TEXT');
+        // #1525: the invocation a refusal happened during, on a scope DB created before the
+        // column. Nullable, and the null is honestly "no id was carried" — a past denial's
+        // call cannot be decided afterwards, exactly as #1237's outbox column argued.
+        this.ensureColumn(db, '_substrat_denials', 'invocation_id', 'invocation_id TEXT');
         // #1231: the emitting operation, on a scope DB created before the column. Nullable
         // so every legacy row reads as unrecorded rather than claiming a name nobody stamped.
         this.ensureColumn(db, '_substrat_outbox', 'operation', 'operation TEXT');
@@ -6544,6 +6875,9 @@ export class SqliteScopeHost {
         // #1237: existing scopes get it on next wake. Rows already written keep NULL, which
         // honestly means "no invocation id was carried" — nothing can decide one afterwards.
         this.ensureColumn(db, '_substrat_outbox', 'invocation_id', 'invocation_id TEXT');
+        // #1288: not an ensureColumn, because `kind` joins the schedule-state PRIMARY KEY
+        // and no ALTER can widen a key. Rebuilt instead, from the kernel's statements.
+        this.ensureScheduleStateKind(db);
         // #1237: `readInvocation`'s lookup — WHERE invocation_id = ? ORDER BY id — over an outbox
         // that is never pruned. No index leads with invocation_id, so without this one SQLite
         // walks the PRIMARY KEY from the oldest event until it reaches the call, and reading a