@substrat-run/adapter-sqlite 0.114.0 → 0.117.0

package/dist/index.js

@@ -1,10 +1,25 @@
 import { existsSync, mkdirSync, readdirSync, readFileSync, rmSync, writeFileSync } from 'node:fs';
 import { dirname, join } from 'node:path';
 import Database from 'better-sqlite3';
-import { accessLogEntry, adminLogEntry, opsFailureEntry, opsFailureFingerprint, issueEntry, FRESHNESS_HEARTBEAT_MINUTES, sweepRunEntry, modelUsageEntry, ATTACHMENT_ADDED, ATTACHMENT_REMOVED, attachmentRecord, createTenantInput, domainEvent, domainEventInput, entitlementGrant, entitlementGrantInput, eventId, meterReading, platformRequestInput, platformRequestId, platformRequest, MAX_PENDING_PLATFORM_REQUESTS, identityLink, identityPool, instant, connection, capabilityGrant, connectionGrant, connectionGrantRecord, connectionSecret, systemGrant, subjectRef, requestFingerprint, createConnectionInput, projectedConnectionGrant, projectedConnectionKey, moduleManifest, createOrgInput, promotionAcknowledgement, bindHostnameInput, channelHistoryEntry, hostnameBinding, publishVersionInput, AUTO_ADMISSION_NOTE, routeTarget, registerVerticalInput, vertical as verticalSchema, verticalChannel, verticalVersion, objectRef, grantRefFromProof, org as orgSchema, orgMembership, principalId, resolvedIdentity, roleDefinition, scope as scopeSchema, tenant as tenantSchema, tenantRole, subjectShredReceipt, SCOPE_TABLE_PAGE_DEFAULT, SCOPE_TABLE_PAGE_MAX, SCOPE_QUERY_ROW_MAX, verticalServingState, outboundOfManifestJson, listLimitOf, substratError, assertReplayableDump, delegatedReadRecord, redrainEventsInput, REDRAIN_BATCH, } from '@substrat-run/contracts';
-import { asPrincipal, assertAllowed, assertReadOnlyQuery, attachmentBlobKey, entitlementDenial, foldMeterReading, guardSpine, parseValidationRecords, resolveScopeRecord, ulid, ISSUE_RETENTION_DAYS, OPS_FAILURE_RETENTION_DAYS, SWEEP_RUN_RETENTION_DAYS, MODEL_USAGE_RETENTION_DAYS, foldModelUsage, backoffAt, platformRequestHistoryQuery, PLATFORM_REQUEST_COLUMNS, denialListQuery, denialSummaryQuery, denialTotalsQuery, DENIAL_WINDOW_QUERY, mapDenialRow, mapDenialSummaryBuckets, IMPERSONATION_COLUMNS, IMPERSONATION_DDL, ImpersonationRefused, assertImpersonationWrites, assertModuleEnqueueableKind, assertSessionUsable, impersonationByIdQuery, impersonationListQuery, impersonationRowValues, impersonationStampOf, mapImpersonationRow, newImpersonationSession, resolveRetryPolicy, isSecretBoxConfigured, unconfiguredSecretBox, createSubjectKeys, generateSealingKeyPair, noSealingKeyMessage, openSealed, sealTo, ConnectionSealingKeyUnavailableError, PermissionDenied, createAtomic, NotSearchable, NotListable, listIndexMigrations, listIndexPlans, listQuery, cursorOf, isSearchIndexTable, searchIndexDdl, searchIndexMigrations, searchIndexPlans, searchLimit, searchMatchExpression, searchQuery, entityVersionQuery, entityVersionOf, assertIfMatch, OUTBOX_ENTITY_INDEX, IDEMPOTENCY_DDL, assertIdempotencyKey, idempotencyLookupQuery, idempotencyPruneStatement, idempotencyRecordStatement, idempotencyOptedOutMessage, replayFor, globalFetch, createUlid, facetEvents, readHistory, walkEventCause, walkEventEffects, assertRedrainWindow, readInvocation, readDeadLetters, } from '@substrat-run/kernel';
+import { accessLogEntry, adminLogEntry, opsFailureEntry, opsFailureFingerprint, issueEntry, FRESHNESS_HEARTBEAT_MINUTES, sweepRunEntry, modelUsageEntry, ATTACHMENT_ADDED, ATTACHMENT_REMOVED, attachmentRecord, createTenantInput, domainEvent, domainEventInput, entitlementGrant, entitlementGrantInput, eventId, meterReading, platformRequestInput, platformRequestId, MAX_PENDING_PLATFORM_REQUESTS, identityLink, identityPool, instant, connection, capabilityGrant, connectionGrant, connectionGrantRecord, connectionSecret, systemGrant, systemSwitch, subjectRef, requestFingerprint, createConnectionInput, projectedConnectionGrant, projectedConnectionKey, moduleManifest, createOrgInput, promotionAcknowledgement, bindHostnameInput, channelHistoryEntry, hostnameBinding, publishVersionInput, AUTO_ADMISSION_NOTE, routeTarget, registerVerticalInput, vertical as verticalSchema, verticalChannel, verticalVersion, objectRef, grantRefFromProof, org as orgSchema, orgMembership, principalId, resolvedIdentity, identityMembership, roleDefinition, scope as scopeSchema, tenant as tenantSchema, tenantRole, subjectShredReceipt, SCOPE_TABLE_PAGE_DEFAULT, SCOPE_TABLE_PAGE_MAX, SCOPE_QUERY_ROW_MAX, verticalServingState, outboundOfManifestJson, listLimitOf, substratError, assertReplayableDump, delegatedReadRecord, redrainEventsInput, REDRAIN_BATCH, } from '@substrat-run/contracts';
+import { actorOf, asPrincipal, assertAllowed, assertNoSecret, assertPermissionKey, CAPABILITY_DDL, CAPABILITY_EXCHANGE_OPERATION, capabilityTokenHash, createCapabilityVerbs, exchangeCapability as exchangeCapabilitySecret, guardSecrets, mintBecomeCapability, plausibleSessionToken, redactSecrets, resolveCapabilitySession, revokeCapabilityAsPlatform, assertReadOnlyQuery, attachmentBlobKey, entitlementDenial, foldMeterReading, guardSpine, parseValidationRecords, resolveScopeRecord, ulid, ISSUE_RETENTION_DAYS, OPS_FAILURE_RETENTION_DAYS, SWEEP_RUN_RETENTION_DAYS, SWEEP_RUNS_INTENT_INDEX, sweepRunsIntentHasKind, MODEL_USAGE_RETENTION_DAYS, foldModelUsage, backoffAt, platformRequestHistoryQuery, platformRequestOf, PLATFORM_REQUEST_COLUMNS, PLATFORM_REQUEST_REDACTION_SQL, platformRequestRedactionParams, platformRequestRedactionQuery, intentPayloadCarriesSubject, seatScopeTuple, switchSystemSchedules, systemScheduleState, systemSwitchedOff, systemSwitchedOffMessage, denialListQuery, denialSummaryQuery, denialTotalsQuery, DENIAL_WINDOW_QUERY, mapDenialRow, mapDenialSummaryBuckets, IMPERSONATION_COLUMNS, IMPERSONATION_DDL, ImpersonationRefused, assertImpersonationWrites, assertModuleEnqueueableKind, assertSessionUsable, impersonationByIdQuery, impersonationListQuery, impersonationRowValues, impersonationStampOf, mapImpersonationRow, newImpersonationSession, resolveRetryPolicy, isSecretBoxConfigured, unconfiguredSecretBox, createSubjectKeys, generateSealingKeyPair, noSealingKeyMessage, openSealed, sealTo, ConnectionSealingKeyUnavailableError, PermissionDenied, createAtomic, NotSearchable, NotListable, listIndexMigrations, listIndexPlans, listQuery, cursorOf, isSearchIndexTable, searchIndexDdl, searchIndexMigrations, searchIndexPlans, searchLimit, searchMatchExpression, searchQuery, entityVersionQuery, entityVersionOf, assertIfMatch, OUTBOX_ENTITY_INDEX, SCHEDULE_STATE_DDL, SCHEDULE_STATE_REBUILD, scheduleStateHasKind, JOB_RUN_DDL, jobRunListLimit, jobRunOf, runDueJobRuns, startJobRun, IDEMPOTENCY_DDL, assertIdempotencyKey, idempotencyLookupQuery, idempotencyPruneStatement, idempotencyRecordStatement, idempotencyOptedOutMessage, replayFor, globalFetch, createUlid, facetEvents, readHistory, walkEventCause, walkEventEffects, assertRedrainWindow, readInvocation, readDeadLetters, domainEventOf, readUndrainedOutbox, undrainedEventsOf, } from '@substrat-run/kernel';
 import { ScopeActor } from './actor.js';
 import { createTupleChecker } from './checker.js';
+/** The kernel's schedule-switch SQL (#1666), over one scope's database handle. */
+const switchSqlOf = (db) => ({
+    all: (sql, ...params) => db.prepare(sql).all(...params),
+    run: (sql, ...params) => {
+        db.prepare(sql).run(...params);
+    },
+});
+/**
+ * How many scopes may hold a read connection at once (#1624). Every open scope keeps its
+ * write connection for the life of the host, so an uncapped reader per scope would double
+ * the file handles a node deployment holds — and the lake drain alone reads every scope.
+ * Past the cap the least recently read scope's reader is closed, and reopened on its next
+ * read, which costs well under a millisecond.
+ */
+const READER_CAP = 32;
 /**
  * The scope spine, as this adapter builds it — one of two hand-written copies (#969).
  *
@@ -119,10 +134,39 @@ const KERNEL_DDL = `
     operation TEXT,
     -- K-42: WHICH of the two actors was refused is exactly what this log is for.
     impersonation TEXT,
+    -- #1525: the INVOCATION this refusal happened during, the same id #1237 stamps on
+    -- every event of a call. A denial joins to nothing but actor and time otherwise —
+    -- the operation column names what was attempted, never WHICH attempt — so "what
+    -- else did this request do" cannot reach a refusal, which is the one thing an
+    -- incident asks about first. NULL = the transport carried no id (a seed, a test,
+    -- an internal call, an attachment RPC), or the row predates the column.
+    invocation_id TEXT,
     at TEXT NOT NULL,
     drained_at TEXT
   );
   ${IDEMPOTENCY_DDL}
+  -- #1672: capabilities — authority carried by a secret (a link share), and the sessions
+  -- an exchange trades that secret for. Spine (kernel-written), shared with the DO adapter
+  -- from @substrat-run/kernel so the two cannot part company; the column comments are there.
+  ${CAPABILITY_DDL}
+  -- #383 / #1232 / #1288: the platform sweep's per-scope gating state, holding two
+  -- families of row that the kind COLUMN — not the spelling of a key — tells apart.
+  -- Spine (kernel-written), never a module migration. Shared with the DO adapter from
+  -- @substrat-run/kernel, so the shape a rebuild produces and the shape a fresh store
+  -- gets cannot part company; the column comments are in there.
+  --
+  -- HERE since #1288, rather than lazily in runDueSchedules/checkFreshness as it was:
+  -- a table only one adapter's KERNEL_DDL declares is a one-sided NOTE to
+  -- lint:spine-ddl, never a failure, so the copies this issue had to keep in step were
+  -- the copies the gate could not see. Every scope db passes through runtime(), which
+  -- runs this, so the lazy creates were load-bearing for nothing.
+  ${SCHEDULE_STATE_DDL}
+  -- #1577: the resumable-run driver's record and the step ledger of the pass it
+  -- currently has in flight. Spine (kernel-written), never a module migration.
+  -- Shared with the DO adapter from @substrat-run/kernel so the shape a self-host
+  -- builds and the shape production builds cannot part company; the column
+  -- comments, and the reason coalescing is NOT a unique index, are in there.
+  ${JOB_RUN_DDL}
   CREATE TABLE IF NOT EXISTS _substrat_migrations (
     module_id TEXT NOT NULL,
     version TEXT NOT NULL,
@@ -155,6 +199,17 @@ const KERNEL_DDL = `
     --   next_attempt_at IS NULL      -> terminal: error IS NULL delivered, else dead
     attempts INTEGER NOT NULL DEFAULT 0,
     next_attempt_at TEXT,
+    -- #1525: the invocation THIS ATTEMPT ran in, the same id #1237 stamps on every
+    -- event of a call. Not the emitting event's — that one is already on the outbox
+    -- and a delivery joins to it through event_id. What that join cannot say is
+    -- which call attempted the DELIVERY, and for an executor the two differ by
+    -- design: attempt one runs in the emitting call's post-commit tail, every retry
+    -- afterwards in a drain that is a different call or none. Moves with the row on
+    -- an upsert, like delivered_at, error and attempts — it describes the
+    -- latest attempt, not the first. NULL = that attempt carried no call (a
+    -- scheduled drain, an alarm, a seed, an attachment RPC), or the row predates
+    -- the column.
+    invocation_id TEXT,
     PRIMARY KEY (event_id, consumer_module)
   );
   -- Attachment metadata facts (#473): one row per object in the per-tenant blob store,
@@ -294,23 +349,12 @@ function modelUsageEntryOf(r) {
         elapsedMs: r.elapsed_ms,
     });
 }
-/** Map a stored platform-request row to the `PlatformRequest` contract shape (JSON columns parsed). */
-function rowToPlatformRequest(r) {
-    return platformRequest.parse({
-        id: r.id,
-        kind: r.kind,
-        payload: JSON.parse(r.payload),
-        requestedBy: JSON.parse(r.requested_by),
-        impersonation: r.impersonation == null ? null : JSON.parse(r.impersonation),
-        status: r.status,
-        attempts: r.attempts,
-        lastError: r.last_error,
-        failure: r.last_failure == null ? null : JSON.parse(r.last_failure),
-        result: r.result === null ? null : JSON.parse(r.result),
-        requestedAt: r.requested_at,
-        settledAt: r.settled_at,
-    });
-}
+/**
+ * The policy an undecodable event's executor delivery is journaled under (#1636): one
+ * attempt, so the first failure is the dead letter. A decode is pure — retrying it cannot
+ * succeed — and the Cloudflare coordinator records the same row with no next attempt.
+ */
+const UNDECODABLE_RETRY = { maxAttempts: 1, baseDelayMs: 0, maxDelayMs: 0 };
 /**
  * The dispatch capability (#726 remedy B): a connector delivery may read the attachments
  * of the entity the DELIVERED EVENT names, and nothing else.
@@ -350,11 +394,39 @@ const admitByDelivery = (rt, eventId, row) => {
 };
 export class SqliteScopeHost {
     admin;
+    /**
+     * Live reads are not available on this host (#938) — `never`, not `undefined`.
+     *
+     * This is the `clock?: never` seam (`CloudflareScopeHostOptions`) pointing the other
+     * way. There, the hosted adapter refuses an option it could only honour for half of
+     * the host's judgements; here, the pure adapter refuses a surface it cannot honour at
+     * all. A live read needs something that outlives a request and can be woken when an
+     * event lands. On Cloudflare that is the scope's own Durable Object, which the runtime
+     * keeps addressable between requests. This host is a function call inside somebody
+     * else's process: nothing here survives the return, so the only honest answer is that
+     * there is no subscription to hand out.
+     *
+     * `never` rather than an omission, and rather than a `subscribe` that throws, because
+     * those two fail in the places this one does not: an omission makes
+     * `host.liveReads?.subscribe(…)` compile and silently do nothing, and a thrower moves
+     * the discovery to runtime, in production, on the one path nobody drove in a test.
+     * The field is declared so that reaching for it is refused by the compiler at the call
+     * site — the same argument the clock seam makes in its own comment.
+     *
+     * What this costs, stated rather than hidden: nothing in the fan-out is held to a
+     * CONTRACT suite, because a contract suite asserts the two adapters agree and on this
+     * they deliberately do not. The tests live on `adapter-cloudflare` instead, beside the
+     * only host that can run them. The day a pure host grows a long-lived transport, this
+     * comment and those tests' home are the whole change.
+     */
+    liveReads;
     dir;
     checker;
     directory;
     scopes = new Map();
     scopesById = new Map();
+    /** The runtimes holding an open `reader` (#1624), least recently read first — `READER_CAP`'s LRU. */
+    readers = new Map();
     /** Per-tenant relational stores (#301), opened lazily and cached by `ref` (the bare
      *  `.sqlite` filename). The pure-adapter analogue of a per-tenant D1 — one file per
      *  (tenant, vertical, binding), physically separate from the scope DBs. */
@@ -399,6 +471,13 @@ export class SqliteScopeHost {
     roles = new Map(); // 'tenantId/roleKey'
     /** Executor id → {eventType, handler} (K-22 §4.2). Host code, not module code. */
     executors = new Map();
+    /**
+     * `<moduleId>/<job>` → the pass body and its default step policy (#1577). Host
+     * code like `executors`, and keyed the way a run row is: the coalescing key's
+     * first two thirds, so a run picked off the table finds its handler by the
+     * columns it already carries.
+     */
+    jobs = new Map();
     /**
      * The event currently being effected by an executor, stamped onto any admin rows
      * it writes. Ambient rather than threaded through every HostAdmin signature: it is
@@ -979,7 +1058,9 @@ export class SqliteScopeHost {
         at TEXT NOT NULL
       );
       CREATE INDEX IF NOT EXISTS _substrat_sweep_runs_unit ON _substrat_sweep_runs (kind, unit, id);
-      CREATE UNIQUE INDEX IF NOT EXISTS _substrat_sweep_runs_intent ON _substrat_sweep_runs (request_id, unit);
+      -- (request_id, kind, unit) since #1572; a directory holding the older
+      -- (request_id, unit) is rebuilt by ensureSweepRunsIntentKind, not by this line.
+      ${SWEEP_RUNS_INTENT_INDEX}
       CREATE INDEX IF NOT EXISTS _substrat_sweep_runs_tenant ON _substrat_sweep_runs (tenant_id, id);
       CREATE INDEX IF NOT EXISTS _substrat_sweep_runs_at ON _substrat_sweep_runs (at);
       -- Model usage (#1054, meter 3): one line per model call a vertical made through
@@ -1367,21 +1448,29 @@ export class SqliteScopeHost {
         await this.applyPendingMigrations(rt);
         // Project each registered module's SCHEDULE grants (#383): a system principal
         // holds exactly the permissions its schedules declared, on this scope. This is
-        // what makes `ctx.check` resolve for scheduled work — the gate stays the check,
-        // and revoking the tuple (console) is how scheduling is turned off per scope.
-        // Idempotent (INSERT OR REPLACE), so a re-provision re-asserts the same grants.
-        for (const mod of this.modules.values()) {
-            const perms = new Set();
-            for (const s of mod.schedules)
-                for (const p of s.permissions)
-                    perms.add(p);
-            for (const perm of perms) {
-                rt.db
-                    .prepare(`INSERT OR REPLACE INTO _substrat_tuples (subject, relation, object, expires_at)
-             VALUES (?, ?, ?, NULL)`)
-                    .run(`system:${mod.id}`, `granted:${perm}`, `scope:${input.scopeId}`);
+        // what makes `ctx.check` resolve for scheduled work — the gate stays the check.
+        // Idempotent, so a re-provision re-asserts the same grants — SEATED (#1659), with the
+        // statement the Cloudflare adapter seats with: a missing grant is recreated, a revoked
+        // one stays revoked. Turning a scope's schedules off is `revokeFromSystem` (#1666), and
+        // its OFF marker is not a grant, so no re-provision can seat it away; `restoreToSystem`
+        // is the only way back (`grantToSystem` clears a tuple's tombstone, not the switch).
+        //
+        // One turn on the scope actor for the whole loop (#1678): a seat issued while an
+        // invoke held its transaction open joined it, and a rollback un-seated the grant
+        // after provisioning had returned. The switch check lives inside the seat statement.
+        await rt.actor.turn(() => {
+            for (const mod of this.modules.values()) {
+                const perms = new Set();
+                for (const s of mod.schedules)
+                    for (const p of s.permissions)
+                        perms.add(p);
+                for (const perm of perms) {
+                    // A module switched off (#1666) gets nothing seated — see `seatScopeTuple`.
+                    const seat = seatScopeTuple(`system:${mod.id}`, `granted:${perm}`, `scope:${input.scopeId}`, null);
+                    rt.db.prepare(seat.sql).run(...seat.params);
+                }
             }
-        }
+        });
         // Audit a real provision only; an idempotent re-provision changed nothing.
         if (!existing) {
             this.recordAdmin(actor, 'provisionScope', { tenantId: input.tenantId, scopeId: input.scopeId, vertical: record.vertical }, null, record);
@@ -1627,12 +1716,16 @@ export class SqliteScopeHost {
             }
             catch (err) {
                 rt.db.exec('ROLLBACK');
+                // #1525: null. This task is the attachment RPC's own — no invoke set an id on
+                // the runtime, and the actor guarantees no other task is mid-flight holding one.
                 if (err instanceof PermissionDenied)
-                    this.recordDenial(rt, subject, operation, err);
+                    this.recordDenial(rt, subject, operation, err, null);
                 throw err;
             }
-            await this.dispatch(rt);
-            await this.dispatchExecutors(rt);
+            // #1525: null, for the reason the denial two lines up records null — this task
+            // is the attachment RPC's own and no invoke set an id on the runtime.
+            await this.dispatch(rt, null);
+            await this.dispatchExecutors(rt, null);
             return result;
         });
         /**
@@ -1653,8 +1746,12 @@ export class SqliteScopeHost {
                 return await fn(this.operationContext(rt, subject, undefined, undefined, undefined, operation));
             }
             catch (err) {
+                // #1525: the ENCLOSING call's id, deliberately. This runner takes no turn of its
+                // own — it is the connector's dispatch-time read, already inside that call's
+                // actor task — so its refusal belongs to that call, for the reason a consumer's
+                // emit does (#1237): dispatch runs in the same post-commit tail and IS the call.
                 if (err instanceof PermissionDenied)
-                    this.recordDenial(rt, subject, operation, err);
+                    this.recordDenial(rt, subject, operation, err, rt.invocationId);
                 throw err;
             }
         };
@@ -1780,12 +1877,12 @@ export class SqliteScopeHost {
             forkedFrom: input.forkedFrom ?? dump.scopeId,
             forkedAt: input.forkedAt ?? dump.capturedAt,
         });
-        this.loadDump(input.tenantId, input.scopeId, dump.tables);
+        await this.loadDump(input.tenantId, input.scopeId, dump.tables);
         await this.admin.activateScope(actor, input.tenantId, input.scopeId);
         this.recordAdmin(actor, 'importScope', { tenantId: input.tenantId, scopeId: input.scopeId }, null, { sourceScopeId: dump.scopeId, tables: dump.tables.length, capturedAt: dump.capturedAt });
     }
     /** Drop-then-replay a dump into a scope's db, refreshing the migration frontier. */
-    loadDump(tenantId, scopeId, tables) {
+    async loadDump(tenantId, scopeId, tables) {
         const rt = this.runtime(tenantId, scopeId);
         const db = rt.db;
         const load = db.transaction((dumped) => {
@@ -1869,20 +1966,25 @@ export class SqliteScopeHost {
             db.prepare(`UPDATE OR REPLACE _substrat_tuples SET object = ?
           WHERE object LIKE 'scope:%' AND object <> ?`).run(`scope:${scopeId}`, `scope:${scopeId}`);
         });
-        load(tables);
-        // The frontier came in with the dump — refresh the cached applied-migration set so
-        // a later bind/migrate builds on the loaded state, not the previous one.
-        rt.appliedMigrations.clear();
-        for (const r of db.prepare('SELECT module_id, version FROM _substrat_migrations').all()) {
-            rt.appliedMigrations.add(`${r.module_id}@${r.version}`);
-        }
+        // On the scope actor (#1678): issued while an invoke held its transaction open, the
+        // load was a SAVEPOINT inside it, and that invoke's rollback undid the restore after
+        // this verb had audited it.
+        await rt.actor.turn(() => {
+            load(tables);
+            // The frontier came in with the dump — refresh the cached applied-migration set so
+            // a later bind/migrate builds on the loaded state, not the previous one.
+            rt.appliedMigrations.clear();
+            for (const r of db.prepare('SELECT module_id, version FROM _substrat_migrations').all()) {
+                rt.appliedMigrations.add(`${r.module_id}@${r.version}`);
+            }
+        });
     }
     async restoreScope(actor, tenantId, scopeId, dump) {
         // Restore never creates a scope (that is importScope) — an unknown target fails closed.
         const existing = await this.admin.getScopeRecord(actor, tenantId, scopeId);
         if (!existing)
             throw new Error(`unknown scope ${scopeId} in tenant ${tenantId}`);
-        this.loadDump(tenantId, scopeId, dump.tables);
+        await this.loadDump(tenantId, scopeId, dump.tables);
         this.recordAdmin(actor, 'restoreScope', { tenantId, scopeId }, null, { sourceScopeId: dump.scopeId, tables: dump.tables.length, capturedAt: dump.capturedAt });
     }
     async snapshotScope(actor, tenantId, scopeId, opts) {
@@ -1919,13 +2021,9 @@ export class SqliteScopeHost {
                 `archive a primary scope instead`);
         }
         // Close and evict the runtime handle before touching the file.
-        const key = `${tenantId}/${scopeId}`;
-        const rt = this.scopes.get(key);
-        if (rt) {
-            rt.db.close();
-            this.scopes.delete(key);
-            this.scopesById.delete(scopeId);
-        }
+        const rt = this.scopes.get(`${tenantId}/${scopeId}`);
+        if (rt)
+            this.closeRuntime(rt);
         // Order is the retry story: hostnames first (a reaped preview URL must stop
         // resolving), then the STORAGE, then the directory row — so a crash mid-way leaves
         // a visible row over empty storage (re-running deleteSnapshot converges), never
@@ -2103,6 +2201,82 @@ export class SqliteScopeHost {
         await this.applyPendingMigrations(rt);
         return this.buildStub(tenantId, scopeId, rt, { kind: 'system', id: moduleId });
     }
+    /**
+     * The lifecycle gate the capability doors share (#1672): the scope must exist in this
+     * tenant, the tenant must be active, the scope must be active — K-3's fail-closed pair
+     * check, worded as the principal door words it, so a scope in another tenant reads the
+     * same as one that does not exist. Migrations are applied as on every door.
+     */
+    async openActiveScope(tenantId, scopeId) {
+        const scope = this.directory
+            .prepare('SELECT tenant_id, status FROM scopes WHERE scope_id = ?')
+            .get(scopeId);
+        if (!scope || scope.tenant_id !== tenantId) {
+            throw new Error(`unknown scope for tenant: (${tenantId}, ${scopeId})`);
+        }
+        const tenant = this.directory
+            .prepare('SELECT status FROM tenants WHERE tenant_id = ?')
+            .get(tenantId);
+        if (!tenant || tenant.status !== 'active') {
+            throw new Error(`tenant not active (status: ${tenant?.status ?? 'missing'}): ${tenantId}`);
+        }
+        if (scope.status !== 'active') {
+            throw new Error(`scope not active (status: ${scope.status}): ${scopeId}`);
+        }
+        const rt = this.runtime(tenantId, scopeId);
+        await this.applyPendingMigrations(rt);
+        return rt;
+    }
+    /**
+     * The exchange (#1672) — a secret traded for a session, or for the principal a `become`
+     * capability yields. One serialized scope task and one transaction, so the use it takes
+     * and the `capability.exercised` event recording it commit together or not at all; the
+     * event's consumers then dispatch as an invoke's would.
+     */
+    async exchangeCapability(tenantId, scopeId, secret, options) {
+        const rt = await this.openActiveScope(tenantId, scopeId);
+        return rt.actor.enqueue(async () => {
+            // ONE instant for the whole exchange: the row's `last_used_at`, the session's times and
+            // the event's `occurredAt` are one fact, and two clock reads could disagree about it.
+            const now = this.clock();
+            rt.db.exec('BEGIN IMMEDIATE');
+            let outcome;
+            try {
+                outcome = await exchangeCapabilitySecret({
+                    sql: spineSql(rt.db),
+                    now,
+                    // Stamped `{ capability }` by the ordinary emit path, under the exchange's own
+                    // pseudo-operation name — the actor is the capability, as on every event it
+                    // goes on to cause.
+                    emit: (capability, event) => this.operationContext(rt, { kind: 'capability', id: capability }, undefined, undefined, undefined, CAPABILITY_EXCHANGE_OPERATION, [], now).emit(event),
+                }, secret, options?.mode);
+                rt.db.exec('COMMIT');
+            }
+            catch (err) {
+                rt.db.exec('ROLLBACK');
+                throw err;
+            }
+            if (outcome) {
+                await this.dispatch(rt, null);
+                await this.dispatchExecutors(rt, null);
+            }
+            return outcome;
+        });
+    }
+    /**
+     * The capability door (#1672) — mirror of the connection and system doors. The token is
+     * shape-checked and hashed HERE, and only its hash travels on: `buildStub` re-resolves it
+     * to its capability on every invoke, so a revoke or an expiry refuses the very next call
+     * on a stub minted before it.
+     */
+    async getCapabilityScope(sessionToken, tenantId, scopeId, options) {
+        if (!plausibleSessionToken(sessionToken)) {
+            throw substratError('unauthenticated', 'not a capability session token');
+        }
+        const rt = await this.openActiveScope(tenantId, scopeId);
+        const hash = await capabilityTokenHash(sessionToken);
+        return this.buildStub(tenantId, scopeId, rt, { kind: 'capability-session', hash }, options);
+    }
     registeredSchedules() {
         const out = [];
         for (const mod of this.modules.values()) {
@@ -2148,22 +2322,11 @@ export class SqliteScopeHost {
             return report;
         const rt = this.runtime(tenantId, scopeId);
         await this.applyPendingMigrations(rt);
-        // Same lazy create as runDueSchedules — a freshness-only module must not hit
-        // `no such table` on a scope no schedule ever swept. Despite the table's name it
-        // holds two kinds of row (#1232): schedule operations keyed `module/verb`, and
-        // the rows written just below, keyed `freshness:<eventType>`. For those,
-        // `last_run_at`/`last_status` are the last RECORDED at and verdict — nothing ran.
-        // Only half the no-collision claim is enforced: an event type has passed
-        // contracts' `eventType` regex (lowercase `ns.verb`, no colon), so a freshness
-        // key can never look like an operation — but `scheduleSpec.operation` is
-        // `z.string().min(1)`, so a schedule literally named `freshness:orders.placed`
-        // would share this row and nothing would refuse it. #1288 tracks the `kind`
-        // column that would make the distinction real instead of conventional.
-        rt.db.exec(`CREATE TABLE IF NOT EXISTS _substrat_schedule_state (
-         schedule_op TEXT PRIMARY KEY,
-         last_run_at TEXT,
-         last_status TEXT
-       )`);
+        // The gating-state table is KERNEL_DDL's since #1288 — `runtime()` above ran it,
+        // so a freshness-only module on a scope no schedule ever swept finds the table
+        // there rather than creating it here. The rows written below are the evaluator's,
+        // `kind = 'freshness'`, keyed `freshness:<eventType>`: for those `last_run_at` /
+        // `last_status` are the last RECORDED at and verdict — nothing ran.
         // Collapse duplicate event types to the tightest window, ACROSS modules.
         const windows = new Map();
         for (const m of this.modules.values()) {
@@ -2175,41 +2338,51 @@ export class SqliteScopeHost {
         }
         if (windows.size === 0)
             return report;
-        const types = [...windows.keys()];
-        const observed = new Map();
-        for (const row of rt.db
-            .prepare(`SELECT type, MAX(occurred_at) AS at FROM _substrat_outbox
-          WHERE type IN (${types.map(() => '?').join(', ')}) GROUP BY type`)
-            .all(...types)) {
-            if (row.at !== null)
-                observed.set(row.type, row.at);
-        }
-        const nowIso = this.clock();
-        const now = Date.parse(nowIso);
-        for (const [eventType, withinHours] of windows) {
-            const observedAt = observed.get(eventType) ?? null;
-            const outcome = observedAt === null
-                ? 'skipped' // never observed — the never-run analogue, not a failure
-                : now - Date.parse(observedAt) <= withinHours * 3_600_000
-                    ? 'ok'
-                    : 'failed';
-            const stateKey = `freshness:${eventType}`;
-            const state = rt.db
-                .prepare('SELECT last_run_at, last_status FROM _substrat_schedule_state WHERE schedule_op = ?')
-                .get(stateKey);
-            const changed = state?.last_status !== outcome;
-            const heartbeatDue = !state?.last_run_at ||
-                now - Date.parse(state.last_run_at) > FRESHNESS_HEARTBEAT_MINUTES * 60_000;
-            if (!changed && !heartbeatDue)
-                continue;
-            rt.db
-                .prepare(`INSERT INTO _substrat_schedule_state (schedule_op, last_run_at, last_status)
-             VALUES (?, ?, ?)
-           ON CONFLICT(schedule_op) DO UPDATE SET last_run_at = excluded.last_run_at,
-                                                  last_status = excluded.last_status`)
-                .run(stateKey, nowIso, outcome);
-            report.checks.push({ eventType, outcome, observedAt, withinHours });
-        }
+        // The WHOLE evaluation is one turn on the scope actor (#1678 review): the outbox probe,
+        // the previous verdict and the write that records the new one. Read outside the turn, the
+        // probe saw a suspended operation's UNCOMMITTED event on this shared connection, then
+        // waited here and persisted an `ok` for an event its rollback was about to remove.
+        await rt.actor.turn(() => {
+            const types = [...windows.keys()];
+            const observed = new Map();
+            for (const row of rt.db
+                .prepare(`SELECT type, MAX(occurred_at) AS at FROM _substrat_outbox
+            WHERE type IN (${types.map(() => '?').join(', ')}) GROUP BY type`)
+                .all(...types)) {
+                if (row.at !== null)
+                    observed.set(row.type, row.at);
+            }
+            const nowIso = this.clock();
+            const now = Date.parse(nowIso);
+            for (const [eventType, withinHours] of windows) {
+                const observedAt = observed.get(eventType) ?? null;
+                const outcome = observedAt === null
+                    ? 'skipped' // never observed — the never-run analogue, not a failure
+                    : now - Date.parse(observedAt) <= withinHours * 3_600_000
+                        ? 'ok'
+                        : 'failed';
+                const stateKey = `freshness:${eventType}`;
+                // #1288: the evaluator's own row, named by kind. Before the column, a module
+                // declaring a schedule called `freshness:<this type>` shared it — and the
+                // verdict read back here was whichever of the two wrote last.
+                const state = rt.db
+                    .prepare(`SELECT last_run_at, last_status FROM _substrat_schedule_state
+              WHERE kind = 'freshness' AND schedule_op = ?`)
+                    .get(stateKey);
+                const changed = state?.last_status !== outcome;
+                const heartbeatDue = !state?.last_run_at ||
+                    now - Date.parse(state.last_run_at) > FRESHNESS_HEARTBEAT_MINUTES * 60_000;
+                if (!changed && !heartbeatDue)
+                    continue;
+                rt.db
+                    .prepare(`INSERT INTO _substrat_schedule_state (kind, schedule_op, last_run_at, last_status)
+               VALUES ('freshness', ?, ?, ?)
+             ON CONFLICT(kind, schedule_op) DO UPDATE SET last_run_at = excluded.last_run_at,
+                                                          last_status = excluded.last_status`)
+                    .run(stateKey, nowIso, outcome);
+                report.checks.push({ eventType, outcome, observedAt, withinHours });
+            }
+        });
         return report;
     }
     async runDueSchedules(moduleId, tenantId, scopeId) {
@@ -2228,35 +2401,58 @@ export class SqliteScopeHost {
             return report;
         const rt = this.runtime(tenantId, scopeId);
         await this.applyPendingMigrations(rt);
-        // The grant IS the switch (#383): a scope runs a module's schedules only while it
-        // holds a live `system:<moduleId>` grant. This is what makes a foreign-vertical
-        // scope (one this module was never provisioned on) a quiet no-op, and what makes
-        // "disable scheduling for this tenant" a plain grant revoke — no error, no run.
+        // The grant IS the switch (#383), and the kill switch is its lever (#1666): the
+        // kernel's `systemScheduleState`, the one predicate both adapters run. A scope that
+        // never held the module's grant (a foreign vertical's) is a quiet no-op, exactly as
+        // before. A scope switched OFF reports every schedule `skipped`, never `failed`, and
+        // does not touch its cadence rows — so a restore fires a due schedule on the next pass.
         const nowIso = this.clock();
-        const hasGrant = rt.db
-            .prepare(`SELECT 1 FROM _substrat_tuples
-          WHERE subject = ? AND revoked_at IS NULL AND (expires_at IS NULL OR expires_at > ?)
-          LIMIT 1`)
-            .get(`system:${moduleId}`, nowIso);
-        if (!hasGrant)
+        // The whole gate — the switch state and every cadence row — is ONE turn, on the write
+        // connection (#1624). Outside a turn it saw a suspended operation's uncommitted grant,
+        // revoke or cadence row, and fired (or skipped) on a state its rollback was about to
+        // undo. Not the read connection either: these reads decide a write (a fire, then its
+        // cadence row), and a snapshot read ahead of the write's turn is the split #1678 closed.
+        // One turn rather than one per read, because the first turn already waits out any
+        // stranger; nothing but this loop writes a `kind = 'schedule'` row, so reading them all
+        // up front answers what reading each just before its fire did.
+        //
+        // #1288: each schedule's own row. `kind` is what makes that true even when the operation
+        // is spelled `freshness:<eventType>` — without it, the cadence gate read the evaluator's
+        // last recorded verdict as a run of this operation.
+        const gate = await rt.actor.turn(() => {
+            const switched = systemScheduleState(switchSqlOf(rt.db), moduleId, nowIso);
+            const lastRuns = new Map();
+            if (switched !== 'on')
+                return { state: switched, lastRuns };
+            const read = rt.db.prepare(`SELECT last_run_at FROM _substrat_schedule_state
+          WHERE kind = 'schedule' AND schedule_op = ?`);
+            for (const schedule of mod.schedules) {
+                const row = read.get(schedule.operation);
+                lastRuns.set(schedule.operation, row?.last_run_at ?? null);
+            }
+            return { state: switched, lastRuns };
+        });
+        const state = gate.state;
+        if (state === 'ungranted')
+            return report;
+        if (state === 'off') {
+            for (const schedule of mod.schedules) {
+                report.skipped += 1;
+                report.runs.push({ operation: schedule.operation, outcome: 'skipped' });
+            }
+            report.switchedOff = true;
             return report;
-        // The spine state table is created lazily on first sweep of a scope — it is
-        // kernel-owned (`_substrat_*`), never in a module migration. It holds this
-        // loop's rows, keyed by the schedule operation (`module/verb`, where
-        // `last_run_at`/`last_status` are when it RAN and how it ended), and — since
-        // #1232 — the freshness evaluator's, keyed `freshness:<eventType>`. See
-        // checkFreshness for what the columns mean there; #1288 tracks the widening.
-        rt.db.exec(`CREATE TABLE IF NOT EXISTS _substrat_schedule_state (
-         schedule_op TEXT PRIMARY KEY,
-         last_run_at TEXT,
-         last_status TEXT
-       )`);
+        }
+        // The spine state table is KERNEL_DDL's (#1288) — kernel-owned (`_substrat_*`),
+        // never a module migration, and created by `runtime()` above rather than lazily
+        // here. This loop's rows are `kind = 'schedule'`, keyed by the operation
+        // (`module/verb`, where `last_run_at`/`last_status` are when it RAN and how it
+        // ended); the freshness evaluator's are `kind = 'freshness'` — see checkFreshness
+        // for what the same two columns mean there.
         const now = Date.parse(nowIso);
         for (const schedule of mod.schedules) {
-            const row = rt.db
-                .prepare('SELECT last_run_at FROM _substrat_schedule_state WHERE schedule_op = ?')
-                .get(schedule.operation);
-            const lastRun = row?.last_run_at ? Date.parse(row.last_run_at) : null;
+            const lastRunAt = gate.lastRuns.get(schedule.operation) ?? null;
+            const lastRun = lastRunAt ? Date.parse(lastRunAt) : null;
             const dueAt = lastRun === null ? -Infinity : lastRun + schedule.cadence.everyMinutes * 60_000;
             if (now < dueAt) {
                 report.skipped += 1;
@@ -2279,18 +2475,27 @@ export class SqliteScopeHost {
                     error: err instanceof Error ? err.message : String(err),
                 });
             }
-            rt.db
-                .prepare(`INSERT INTO _substrat_schedule_state (schedule_op, last_run_at, last_status)
-             VALUES (?, ?, ?)
-           ON CONFLICT(schedule_op) DO UPDATE SET last_run_at = excluded.last_run_at,
-                                                  last_status = excluded.last_status`)
-                .run(schedule.operation, new Date(now).toISOString(), status);
+            // On the scope actor (#1678): the cadence row joined whatever transaction an invoke
+            // held open, so its rollback forgot the run and the next pass fired it AGAIN.
+            await rt.actor.turn(() => rt.db
+                .prepare(`INSERT INTO _substrat_schedule_state (kind, schedule_op, last_run_at, last_status)
+               VALUES ('schedule', ?, ?, ?)
+             ON CONFLICT(kind, schedule_op) DO UPDATE SET last_run_at = excluded.last_run_at,
+                                                          last_status = excluded.last_status`)
+                .run(schedule.operation, new Date(now).toISOString(), status));
             report.runs.push({ operation: schedule.operation, outcome: status === 'ok' ? 'ok' : 'failed' });
         }
         return report;
     }
-    /** The stub body, shared by the principal, connection, system and impersonation doors. */
-    buildStub(tenantId, scopeId, rt, subject, options, 
+    /** The stub body, shared by the principal, connection, system, impersonation and capability doors. */
+    buildStub(tenantId, scopeId, rt, 
+    /**
+     * Who the stub acts as — or, for the capability door (#1672), the SESSION it holds,
+     * which every invoke re-resolves to its capability inside the scope's actor task. A
+     * capability resolved once at mint time would outlive its own revocation for exactly
+     * the one caller holding the stub.
+     */
+    authority, options, 
     /**
      * K-42: the session this stub acts under. `subject` is already the
      * IMPERSONATED principal — that is what makes the permission model answer
@@ -2372,9 +2577,22 @@ export class SqliteScopeHost {
                     // which is the leak `causedBy` had to be moved off the host to avoid.
                     rt.invocationId = invokeOptions?.invocationId ?? null;
                     try {
+                        // #1672: the capability door's session, re-resolved on EVERY invoke and inside the
+                        // actor task — so nothing can revoke between this read and the transaction below.
+                        // Refuses a stale session, a revoked or expired capability and an operation off its
+                        // allowlist before anything opens; none of those is a K-35 denial (no key checked).
+                        const subject = authority.kind === 'capability-session'
+                            ? {
+                                kind: 'capability',
+                                id: resolveCapabilitySession(spineSql(rt.db), authority.hash, this.clock(), operation),
+                            }
+                            : authority;
+                        // #1672: the secrets this invocation mints — withheld from its idempotency recording,
+                        // and what the tripwire on its writes looks for.
+                        const minted = [];
                         // Fresh per operation: the context carries the K-34 authorization accumulator,
                         // which must not leak across operations (invokes are serialized per scope).
-                        const ctx = this.operationContext(rt, subject, undefined, signals, session, operation);
+                        const ctx = this.operationContext(rt, subject, undefined, signals, session, operation, minted);
                         const clonedInput = structuredClone(input);
                         // #893: parse, don't trust — at the scope door, from the operation's own
                         // declaration. BEFORE `BEGIN`, so a malformed call never opens a
@@ -2460,7 +2678,9 @@ export class SqliteScopeHost {
                             // that adds a row.
                             if (idempotencyKey !== undefined && fingerprint !== undefined) {
                                 const at = this.clock();
-                                const record = idempotencyRecordStatement(subject, idempotencyKey, operation, fingerprint, result, committedVersion ?? null, at);
+                                const record = idempotencyRecordStatement(subject, idempotencyKey, operation, fingerprint, 
+                                // #1672: a replay of a mint returns the placeholder, never the secret.
+                                redactSecrets(result, minted), committedVersion ?? null, at);
                                 rt.db.prepare(record.sql).run(...record.params);
                                 const prune = idempotencyPruneStatement(at);
                                 rt.db.prepare(prune.sql).run(...prune.params);
@@ -2481,7 +2701,8 @@ export class SqliteScopeHost {
                             // K-35: a refused check rolled the operation back. Record it now — a fresh
                             // statement in autocommit, AFTER the rollback, so the denial survives it.
                             if (err instanceof PermissionDenied)
-                                this.recordDenial(rt, subject, operation, err, session);
+                                // Inside the actor task that set it, so the field is this call's own (#1237).
+                                this.recordDenial(rt, subject, operation, err, rt.invocationId, session);
                             throw err;
                         }
                         // Post-commit, still inside the actor task: drain outbox → consumers,
@@ -2492,8 +2713,10 @@ export class SqliteScopeHost {
                         // drain — and draining anyway would run consumers as a side effect of a
                         // session that may not have side effects.
                         if (session?.mode !== 'read-only') {
-                            await this.dispatch(rt);
-                            await this.dispatchExecutors(rt);
+                            // #1525: still inside the actor task that set it, so these deliveries are
+                            // this call's own work — the same tail its consumers' emits are stamped in.
+                            await this.dispatch(rt, rt.invocationId);
+                            await this.dispatchExecutors(rt, rt.invocationId);
                         }
                         return structuredClone(result);
                     }
@@ -2563,10 +2786,8 @@ export class SqliteScopeHost {
         }
     }
     async close() {
-        for (const { db } of this.scopes.values())
-            db.close();
-        this.scopes.clear();
-        this.scopesById.clear();
+        for (const rt of [...this.scopes.values()])
+            this.closeRuntime(rt);
         this.directory.close();
     }
     // -------------------------------------------------------------------------
@@ -2594,7 +2815,15 @@ export class SqliteScopeHost {
      * At-least-once still requires idempotent handlers. Retry is the backstop, not a
      * substitute.
      */
-    async dispatchExecutors(rt) {
+    async dispatchExecutors(rt, 
+    /**
+     * #1525: the call this drain pass is running in, or null — PASSED, not read off
+     * `rt.invocationId`, for the reason `recordDenial` states. The Cloudflare twin
+     * has no ambient field to read here at all: its executors run on the coordinator
+     * and journal over RPC, so the id has to travel as an argument on that side, and
+     * a recorded fact whose correctness argument differs per adapter drifts.
+     */
+    invocationId) {
         const report = {
             attempted: 0,
             delivered: 0,
@@ -2616,8 +2845,22 @@ export class SqliteScopeHost {
            ORDER BY o.id`)
                 .all(deliveryId, executor.eventType, now);
             for (const row of rows) {
-                const event = this.parseOutboxRow(row);
                 report.attempted += 1;
+                let event;
+                try {
+                    event = domainEventOf(row);
+                }
+                catch (err) {
+                    // #1636: an event that does not decode is dead-lettered for this executor at
+                    // once, and the handler never sees it. The decode sat above this loop's `try`,
+                    // so one bad row threw the executor's whole pending list on every pass. Terminal
+                    // on the FIRST failure, unlike a handler's: the decode is pure, of text already
+                    // in hand, so a retry cannot succeed — and only the decode is caught here, so a
+                    // handler's transient failure keeps its backoff below.
+                    this.recordExecutorDelivery(rt, row.id, deliveryId, String(err), UNDECODABLE_RETRY, invocationId);
+                    report.deadLettered += 1;
+                    continue;
+                }
                 this.causedBy = event.id;
                 try {
                     if (executor.kind === 'connector') {
@@ -2628,11 +2871,11 @@ export class SqliteScopeHost {
                     else {
                         await executor.handler(this.admin, event);
                     }
-                    this.recordExecutorDelivery(rt, row.id, deliveryId, null, executor.retry);
+                    this.recordExecutorDelivery(rt, row.id, deliveryId, null, executor.retry, invocationId);
                     report.delivered += 1;
                 }
                 catch (err) {
-                    const dead = this.recordExecutorDelivery(rt, row.id, deliveryId, err instanceof Error ? (err.stack ?? err.message) : String(err), executor.retry);
+                    const dead = this.recordExecutorDelivery(rt, row.id, deliveryId, err instanceof Error ? (err.stack ?? err.message) : String(err), executor.retry, invocationId);
                     if (dead)
                         report.deadLettered += 1;
                     else
@@ -2653,7 +2896,9 @@ export class SqliteScopeHost {
      * silently marking success. Claiming first would make delivery at-most-once and
      * lose an effect on any crash in between.
      */
-    recordExecutorDelivery(rt, eventId, deliveryId, error, retry) {
+    recordExecutorDelivery(rt, eventId, deliveryId, error, retry, 
+    /** #1525: the call THIS attempt ran in, or null. Last, mirroring the DO's RPC. */
+    invocationId) {
         const prior = rt.db
             .prepare('SELECT attempts FROM _substrat_deliveries WHERE event_id = ? AND consumer_module = ?')
             .get(eventId, deliveryId)?.attempts ?? 0;
@@ -2663,20 +2908,160 @@ export class SqliteScopeHost {
         const nextAttemptAt = error === null || exhausted ? null : backoffAt(attempts, retry, new Date());
         rt.db
             .prepare(`INSERT INTO _substrat_deliveries
-           (event_id, consumer_module, delivered_at, error, attempts, next_attempt_at)
-         VALUES (?, ?, ?, ?, ?, ?)
+           (event_id, consumer_module, delivered_at, error, attempts, next_attempt_at,
+            invocation_id)
+         VALUES (?, ?, ?, ?, ?, ?, ?)
          ON CONFLICT (event_id, consumer_module) DO UPDATE SET
            delivered_at = excluded.delivered_at,
            error = excluded.error,
            attempts = excluded.attempts,
-           next_attempt_at = excluded.next_attempt_at`)
-            .run(eventId, deliveryId, new Date().toISOString(), error, attempts, nextAttemptAt);
+           next_attempt_at = excluded.next_attempt_at,
+           -- #1525: overwritten, like the four above. The row describes the LATEST
+           -- attempt, so a retry drained by a different call (or by none) must not
+           -- keep claiming the call that made the first one.
+           invocation_id = excluded.invocation_id`)
+            .run(eventId, deliveryId, new Date().toISOString(), error, attempts, nextAttemptAt, 
+        // #1525: the call this attempt ran in, as the caller named it.
+        invocationId);
         return error !== null && exhausted;
     }
     async drainDue(tenantId, scopeId) {
         const rt = this.runtime(tenantId, scopeId);
         await this.applyPendingMigrations(rt);
-        return rt.actor.enqueue(() => this.dispatchExecutors(rt));
+        // #1525: null, and honestly so — a sweep is not a call. An attempt this pass makes
+        // records no invocation, which is what distinguishes it from the first attempt the
+        // emitting operation's own tail made.
+        return rt.actor.enqueue(() => this.dispatchExecutors(rt, null));
+    }
+    registerJob(moduleId, name, handler, retry) {
+        const key = `${moduleId}/${name}`;
+        if (this.jobs.has(key))
+            throw new Error(`job '${key}' is already registered`);
+        this.jobs.set(key, { handler, retry });
+    }
+    /**
+     * D-14's in-process driver: the run store is direct SQL on the scope db.
+     *
+     * **The PASS stays outside the actor; every STORE OPERATION takes a turn on it.**
+     * That split is the whole of the concurrency design here, and the first cut got
+     * the second half wrong — it ran these statements on `rt.db` with no turn at all,
+     * under a comment claiming they "interleave exactly as any other write does".
+     * They do not. `invoke` opens a raw `BEGIN IMMEDIATE` on this same connection and
+     * HOLDS IT ACROSS AWAITS (its guards, its handler), so a job-store statement
+     * issued while some unrelated request was mid-operation landed INSIDE that
+     * request's transaction — and rolled back with it. A step whose effect had
+     * already happened would lose its ledger row and run a second time, for no reason
+     * connected to the job at all.
+     *
+     * A turn each is the fix, and it keeps the property the original comment wanted:
+     * a pass may take an hour, and holding the scope's lock for it would stop every
+     * request on that scope, so the pass itself is never enqueued. Only the short
+     * writes are. Nothing nests — a store operation never invokes, and the `invoke`s
+     * a pass makes through `pass.scope()` take their own separate turns — so there is
+     * no path by which this can deadlock against itself.
+     */
+    jobStore(rt) {
+        const db = rt.db;
+        const row = (v) => v ?? null;
+        const findLive = db.prepare(`SELECT * FROM _substrat_job_runs
+        WHERE module_id = ? AND job = ? AND instance = ? AND status = 'running'
+        ORDER BY id DESC LIMIT 1`);
+        const insertRun = db.prepare(`INSERT INTO _substrat_job_runs
+         (id, module_id, job, instance, payload, status, cursor, counters, attempts,
+          last_error, started_at, updated_at, next_attempt_at, ended_at)
+       VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`);
+        const patchRun = db.prepare(`UPDATE _substrat_job_runs
+          SET status = ?, cursor = ?, counters = ?, attempts = ?, last_error = ?,
+              updated_at = ?, next_attempt_at = ?, ended_at = ?
+        WHERE id = ?`);
+        const patchArgs = (id, p) => [p.status, p.cursor, p.counters, p.attempts, p.lastError, p.updatedAt, p.nextAttemptAt, p.endedAt, id];
+        // `db.transaction` on better-sqlite3 runs its body SYNCHRONOUSLY inside a real
+        // SQLite transaction, so nothing — not another turn of the event loop, not
+        // another caller of this host — can interleave between the read and the write.
+        // That is what makes the two operations below atomic rather than merely ordered.
+        const startOrJoinTx = db.transaction((key, r) => {
+            const live = row(findLive.get(key.moduleId, key.job, key.instance));
+            if (live)
+                return live;
+            insertRun.run(r.id, r.module_id, r.job, r.instance, r.payload, r.status, r.cursor, r.counters, r.attempts, r.last_error, r.started_at, r.updated_at, r.next_attempt_at, r.ended_at);
+            return r;
+        });
+        const commitPassTx = db.transaction((id, p) => {
+            patchRun.run(...patchArgs(id, p));
+            db.prepare('DELETE FROM _substrat_job_steps WHERE run_id = ?').run(id);
+        });
+        // Every store operation takes its own short turn on the scope actor, so no
+        // statement here can land inside an `invoke`'s open transaction. `turn` is the
+        // one place that happens; adding a method without it reintroduces the bug.
+        const turn = (fn) => rt.actor.enqueue(fn);
+        return {
+            startOrJoin: (key, r) => turn(() => startOrJoinTx(key, r)),
+            get: (id) => turn(() => row(db.prepare('SELECT * FROM _substrat_job_runs WHERE id = ?').get(id))),
+            due: (now, limit, afterId) => turn(() => db
+                .prepare(`SELECT * FROM _substrat_job_runs
+              WHERE status = 'running' AND (next_attempt_at IS NULL OR next_attempt_at <= ?)
+                AND (? IS NULL OR id > ?)
+              ORDER BY id LIMIT ?`)
+                .all(now, afterId ?? null, afterId ?? null, limit)),
+            list: (filter) => turn(() => {
+                const where = [];
+                const params = [];
+                for (const [column, value] of [
+                    ['module_id', filter.moduleId],
+                    ['job', filter.job],
+                    ['instance', filter.instance],
+                    ['status', filter.status],
+                ]) {
+                    if (value !== undefined) {
+                        where.push(`${column} = ?`);
+                        params.push(value);
+                    }
+                }
+                params.push(jobRunListLimit(filter.limit));
+                return db
+                    .prepare(`SELECT * FROM _substrat_job_runs
+             ${where.length ? `WHERE ${where.join(' AND ')}` : ''}
+             ORDER BY id DESC LIMIT ?`)
+                    .all(...params);
+            }),
+            patch: (id, p) => turn(() => {
+                patchRun.run(...patchArgs(id, p));
+            }),
+            commitPass: (id, p) => turn(() => commitPassTx(id, p)),
+            step: (runId, name) => turn(() => db
+                .prepare('SELECT step, result, attempts, last_error FROM _substrat_job_steps WHERE run_id = ? AND step = ?')
+                .get(runId, name) ?? null),
+            recordStep: (runId, name, result, attempts, lastError, at) => turn(() => {
+                db.prepare(`INSERT INTO _substrat_job_steps (run_id, step, result, attempts, last_error, recorded_at)
+             VALUES (?, ?, ?, ?, ?, ?)
+           ON CONFLICT (run_id, step) DO UPDATE SET result = excluded.result,
+                                                    attempts = excluded.attempts,
+                                                    last_error = excluded.last_error,
+                                                    recorded_at = excluded.recorded_at`).run(runId, name, result, attempts, lastError, at);
+            }),
+        };
+    }
+    async startJobRun(tenantId, scopeId, input) {
+        const rt = this.runtime(tenantId, scopeId);
+        await this.applyPendingMigrations(rt);
+        return jobRunOf(await startJobRun(this.jobStore(rt), input, ulid, this.clock));
+    }
+    async runDueJobs(tenantId, scopeId, options) {
+        const rt = this.runtime(tenantId, scopeId);
+        await this.applyPendingMigrations(rt);
+        return runDueJobRuns({
+            store: this.jobStore(rt),
+            handlerFor: (run) => this.jobs.get(`${run.module_id}/${run.job}`),
+            now: this.clock,
+            openScope: (run) => this.getSystemScope(run.module_id, tenantId, scopeId),
+            maxPasses: options?.maxPasses,
+            limit: options?.limit,
+        });
+    }
+    async jobRuns(tenantId, scopeId, filter) {
+        const rt = this.runtime(tenantId, scopeId);
+        await this.applyPendingMigrations(rt);
+        return (await this.jobStore(rt).list(filter ?? {})).map(jobRunOf);
     }
     async dispatchConnector(tenantId, scopeId, handler, event, options) {
         // The platform half of a routed `connector:<provider>` intent (#574 phase 3): run
@@ -2714,7 +3099,7 @@ export class SqliteScopeHost {
         // "not granted" where the checker answers allow — a read-back that disagrees with
         // enforcement is worse than none, since it is the read an operator would trust.
         const rows = [
-            ...rt.db
+            ...this.readDb(rt)
                 .prepare(`SELECT subject, relation, expires_at FROM _substrat_tuples
            WHERE subject LIKE 'connection:%' AND relation LIKE 'granted:%'
              AND revoked_at IS NULL AND (expires_at IS NULL OR expires_at > ?)`)
@@ -2794,7 +3179,7 @@ export class SqliteScopeHost {
     async executorDeadLetters(tenantId, scopeId) {
         const rt = this.runtime(tenantId, scopeId);
         await this.applyPendingMigrations(rt);
-        const rows = rt.db
+        const rows = this.readDb(rt)
             .prepare(`SELECT d.event_id, d.consumer_module, d.attempts, d.error, d.delivered_at, o.type
          FROM _substrat_deliveries d
          JOIN _substrat_outbox o ON o.id = d.event_id
@@ -2815,31 +3200,46 @@ export class SqliteScopeHost {
     async listPlatformRequests(tenantId, scopeId) {
         const rt = this.runtime(tenantId, scopeId);
         await this.applyPendingMigrations(rt);
-        const rows = rt.db
+        const rows = this.readDb(rt)
             .prepare(`SELECT ${PLATFORM_REQUEST_COLUMNS}
            FROM _substrat_platform_requests WHERE status = 'pending' ORDER BY id`)
             .all();
-        return rows.map(rowToPlatformRequest);
+        // Tolerant (#1588): one undecodable row comes back naming why, never throws for the list.
+        return rows.map(platformRequestOf);
     }
     async listPlatformRequestHistory(tenantId, scopeId, filter) {
         const rt = this.runtime(tenantId, scopeId);
         await this.applyPendingMigrations(rt);
         const q = platformRequestHistoryQuery(filter);
-        return rt.db.prepare(q.sql).all(...q.params).map(rowToPlatformRequest);
+        return this.readDb(rt).prepare(q.sql).all(...q.params).map(platformRequestOf);
     }
     async settlePlatformRequest(tenantId, scopeId, id, outcome) {
         const rt = this.runtime(tenantId, scopeId);
         await this.applyPendingMigrations(rt);
         await rt.actor.enqueue(() => {
+            // Compare-and-set on `pending` (#1600 review). The drain reads pending rows, runs a
+            // handler, then settles — and between the read and the settle a subject erasure can
+            // redact the row. Settling by `id` alone let that stale pass overwrite the redaction
+            // and write a provider's reply, which can quote the person, back into `last_error`.
+            // Nothing legitimate is refused by this: `listPlatformRequests` returns only pending
+            // rows, so every settle in the tree targets one that was pending when it was read.
+            // A settle that finds the row already terminal does nothing, deliberately silently —
+            // throwing would make the drain's blanket catch retry a row that is correctly over.
             rt.db
                 .prepare(`UPDATE _substrat_platform_requests
              SET status = ?, result = COALESCE(?, result), last_error = ?, last_failure = ?,
                  attempts = attempts + 1, settled_at = ?
-           WHERE id = ?`)
+           WHERE id = ? AND status = 'pending'`)
                 .run(outcome.status, outcome.result === undefined ? null : JSON.stringify(outcome.result), outcome.lastError ?? null, outcome.failure == null ? null : JSON.stringify(outcome.failure), outcome.status === 'pending' ? null : new Date().toISOString(), id);
         });
     }
-    async dispatch(rt) {
+    async dispatch(rt, 
+    /**
+     * #1525: the call this drain is running in, or null — PASSED, for the reason
+     * `dispatchExecutors` states. Every round of the loop belongs to it: a consumer's
+     * own emit is delivered in the same tail, so the whole cascade is one call's work.
+     */
+    invocationId) {
         for (let round = 0; round < 50; round++) {
             let deliveredAny = false;
             for (const mod of this.modules.values()) {
@@ -2854,7 +3254,24 @@ export class SqliteScopeHost {
                ORDER BY o.id`)
                         .all(consumer.eventType, mod.id);
                     for (const row of rows) {
-                        const event = this.parseOutboxRow(row);
+                        let event;
+                        try {
+                            event = domainEventOf(row);
+                        }
+                        catch (err) {
+                            // #1636: dead-letter an event that does not decode, exactly as a failed
+                            // handler is — the decode sat ABOVE the `try` below, so one bad row halted
+                            // every event of this type behind it, on every pass. The consumer is never
+                            // handed it: an event built from stand-ins is not one it may act on. Only
+                            // the decode is caught; the journal write is not, so a failure to record
+                            // this still surfaces as it would for a handler's dead letter.
+                            rt.db
+                                .prepare(`INSERT INTO _substrat_deliveries
+                     (event_id, consumer_module, delivered_at, error, invocation_id)
+                   VALUES (?, ?, ?, ?, ?)`)
+                                .run(row.id, mod.id, new Date().toISOString(), String(err), invocationId);
+                            continue;
+                        }
                         const ctx = this.operationContext(rt, asPrincipal(this.systemPrincipal), {
                             system: mod.id,
                         });
@@ -2867,9 +3284,10 @@ export class SqliteScopeHost {
                         try {
                             await consumer.handler(ctx, event);
                             rt.db
-                                .prepare(`INSERT INTO _substrat_deliveries (event_id, consumer_module, delivered_at)
-                   VALUES (?, ?, ?)`)
-                                .run(event.id, mod.id, new Date().toISOString());
+                                .prepare(`INSERT INTO _substrat_deliveries
+                     (event_id, consumer_module, delivered_at, invocation_id)
+                   VALUES (?, ?, ?, ?)`)
+                                .run(event.id, mod.id, new Date().toISOString(), invocationId);
                             rt.db.exec('COMMIT');
                             deliveredAny = true;
                         }
@@ -2878,9 +3296,10 @@ export class SqliteScopeHost {
                             // Dead-letter (v0): journal the failure so one poison event
                             // can't wedge the loop. Real redelivery/backoff is a later cut.
                             rt.db
-                                .prepare(`INSERT INTO _substrat_deliveries (event_id, consumer_module, delivered_at, error)
-                   VALUES (?, ?, ?, ?)`)
-                                .run(event.id, mod.id, new Date().toISOString(), String(err));
+                                .prepare(`INSERT INTO _substrat_deliveries
+                     (event_id, consumer_module, delivered_at, error, invocation_id)
+                   VALUES (?, ?, ?, ?, ?)`)
+                                .run(event.id, mod.id, new Date().toISOString(), String(err), invocationId);
                         }
                         finally {
                             // Cleared on BOTH paths. Left set, the id would leak onto every later
@@ -2902,6 +3321,19 @@ export class SqliteScopeHost {
      * point, since the denial is exactly the write the rolled-back operation could not make.
      */
     recordDenial(rt, subject, operation, err, 
+    /**
+     * #1525: the invocation this refusal belongs to, or null — PASSED, not read off
+     * `rt.invocationId` here.
+     *
+     * Every denial path on THIS adapter runs inside the scope's actor task, so reading
+     * `rt.invocationId` would in fact be right at each one. It is passed anyway, to keep
+     * one discipline across both adapters: the Cloudflare side has two denial paths that
+     * run outside its queue, where the ambient read rests on an argument about workerd's
+     * input gate rather than on anything local. A recorded fact whose correctness
+     * argument differs per adapter is the kind that drifts, so on both sides the caller
+     * says what it knows.
+     */
+    invocationId, 
     /** K-42: the session the refused call ran under, when it ran under one. */
     impersonation) {
         // Only an ENFORCED denial (assertAllowed, which attaches the checked permission +
@@ -2909,39 +3341,15 @@ export class SqliteScopeHost {
         // policy, carries no permission key, and is left to the module.
         if (!err.permission || !err.node)
             return;
-        const actor = subject.kind === 'system'
-            ? { system: subject.id }
-            : subject.kind === 'connection'
-                ? { connection: subject.id }
-                : subject.id;
+        const actor = actorOf(subject);
         rt.db
             .prepare(`INSERT INTO _substrat_denials
-           (id, actor, permission, tenant_id, scope_id, operation, impersonation, at)
-         VALUES (?, ?, ?, ?, ?, ?, ?, ?)`)
-            .run(ulid(), JSON.stringify(actor), err.permission, err.node.tenantId, err.node.scopeId ?? null, operation, impersonation ? JSON.stringify(impersonationStampOf(impersonation)) : null, new Date().toISOString());
-    }
-    parseOutboxRow(row) {
-        return domainEvent.parse({
-            id: row.id,
-            type: row.type,
-            schemaVersion: row.schema_version,
-            occurredAt: row.occurred_at,
-            tenantId: row.tenant_id,
-            scopeId: row.scope_id,
-            actor: JSON.parse(row.actor),
-            entity: { entityType: row.entity_type, entityId: row.entity_id },
-            piiClass: row.pii_class,
-            ...(row.subject_id ? { subjectId: row.subject_id } : {}),
-            ...(row.authorization ? { authorization: JSON.parse(row.authorization) } : {}),
-            // K-42: the stamp survives the read, so a consumer's event and an executor's
-            // are the same fact the stored row is. Absent rather than null when nobody
-            // was impersonating, because `DomainEvent.impersonation` is optional — the
-            // shape module code never sees is also the shape it cannot branch on.
-            ...(row.impersonation ? { impersonation: JSON.parse(row.impersonation) } : {}),
-            // #1231: absent rather than null, the same shape rule as the stamp above.
-            ...(row.operation ? { operation: row.operation } : {}),
-            payload: row.payload === null ? undefined : JSON.parse(row.payload),
-        });
+           (id, actor, permission, tenant_id, scope_id, operation, impersonation,
+            invocation_id, at)
+         VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?)`)
+            .run(ulid(), JSON.stringify(actor), err.permission, err.node.tenantId, err.node.scopeId ?? null, operation, impersonation ? JSON.stringify(impersonationStampOf(impersonation)) : null, 
+        // #1525: the call this refusal belongs to, as the caller named it.
+        invocationId, new Date().toISOString());
     }
     // -------------------------------------------------------------------------
     // Admin surface (enforcement input, §9.2.5)
@@ -3369,6 +3777,9 @@ export class SqliteScopeHost {
              (tenant_id, subject, relation, object, expires_at)
            VALUES (?, ?, ?, ?, ?)`)
             .run(tenantId, subject, relation, object, expiresAt ?? null);
+        // The EXPLICIT grant: `INSERT OR REPLACE` clears a tombstone, because a re-grant must
+        // grant. Provisioning seats with `seatScopeTuple` instead, which never un-revokes
+        // (#1659) — keep the two apart.
         const writeScopeTuple = (node, subject, relation, object, expiresAt) => {
             if (!node.scopeId)
                 throw new Error('scope tuple requires node.scopeId');
@@ -3389,6 +3800,82 @@ export class SqliteScopeHost {
                 writeTenantTuple(node.tenantId, subject, `granted:${permission}`, `tenant:${node.tenantId}`, expiresAt);
             }
         };
+        /**
+         * A node's write, on the scope actor when the node is a scope (#1678). `invoke` holds a
+         * raw `BEGIN IMMEDIATE` on the scope's connection across awaits, so a bare statement
+         * issued mid-invoke joined that transaction and rolled back with it — after the verb
+         * had answered success and audited. `body` holds the check AND the write, synchronously,
+         * so nothing moves between them. Tenant-level: a directory write, which no scope's
+         * transaction can hold, so it runs as it always did.
+         */
+        const onNode = (node, body) => node.scopeId
+            ? this.runtime(node.tenantId, node.scopeId).actor.turn(body)
+            : Promise.resolve().then(body);
+        /** #1666: move one module's schedule switch on one scope — see `HostAdmin.revokeFromSystem`. */
+        const switchSystem = async (actor, raw, to) => {
+            const input = systemSwitch.parse(raw);
+            const { tenantId, scopeId } = input.node;
+            const scope = this.directory
+                .prepare('SELECT tenant_id FROM scopes WHERE scope_id = ?')
+                .get(scopeId);
+            if (!scope || scope.tenant_id !== tenantId) {
+                throw substratError('not_found', `unknown scope for tenant: (${tenantId}, ${scopeId})`);
+            }
+            // AUDIT FIRST (#1666 review), exactly as the Cloudflare adapter: the intent row before
+            // anything moves, the outcome row after, on every attempt. The directory and the
+            // scope's file are separate databases, so a crash between them leaves an intent with
+            // no recorded outcome — never a moved switch with no audit row.
+            const operationId = ulid();
+            const action = to === 'off' ? 'revokeFromSystem' : 'restoreToSystem';
+            const target = { tenantId, scopeId };
+            const base = { operationId, moduleId: input.moduleId, schedules: to };
+            this.recordAdmin(actor, action, target, null, { ...base, phase: 'intent', reason: input.reason });
+            let outcome;
+            try {
+                // A turn on the scope actor (#1666 review), exactly as the job store (#1577): `invoke`
+                // holds a raw `BEGIN IMMEDIATE` on this same connection across awaits, so a bare
+                // `db.transaction` issued mid-invoke became a SAVEPOINT inside it and rolled back
+                // with it — after this verb had already audited `applied`. `turn` is re-entrant, so a
+                // caller already inside one of this scope's tasks joins it rather than deadlocking.
+                const rt = this.runtime(tenantId, scopeId);
+                outcome = await rt.actor.turn(() => rt.db.transaction(() => switchSystemSchedules(switchSqlOf(rt.db), {
+                    moduleId: input.moduleId,
+                    scopeId,
+                    to,
+                    at: new Date().toISOString(),
+                }))());
+            }
+            catch (err) {
+                try {
+                    this.recordAdmin(actor, action, target, null, {
+                        ...base,
+                        phase: 'failed',
+                        error: err instanceof Error ? err.message : String(err),
+                    });
+                }
+                catch {
+                    // Best effort: the original error is what the caller must see.
+                }
+                throw err;
+            }
+            this.recordAdmin(actor, action, target, null, {
+                ...base,
+                phase: outcome.held ? 'applied' : 'refused',
+                changed: outcome.changed,
+                permissions: outcome.permissions,
+            });
+            if (!outcome.held) {
+                throw substratError('not_found', `scope ${scopeId} holds no system grant for module '${input.moduleId}' — nothing to switch ${to} ` +
+                    `(check the module id: it is the module's manifest id, e.g. '@substrat-run/engine-absence')`);
+            }
+            return {
+                operationId,
+                moduleId: input.moduleId,
+                schedules: to,
+                changed: outcome.changed,
+                permissions: outcome.permissions,
+            };
+        };
         return {
             // #603: fixed at construction — a host built without a box can never store a
             // credential, and saying so is what lets a transport answer 503 instead of 500.
@@ -3447,7 +3934,8 @@ export class SqliteScopeHost {
             assignRole: async (actor, assignment) => {
                 const subject = `principal:${assignment.principalId}`;
                 if (assignment.node.scopeId) {
-                    writeScopeTuple(assignment.node, subject, `role:${assignment.roleKey}`, `scope:${assignment.node.scopeId}`);
+                    const scopeNode = assignment.node.scopeId;
+                    await onNode(assignment.node, () => writeScopeTuple(assignment.node, subject, `role:${assignment.roleKey}`, `scope:${scopeNode}`));
                 }
                 else {
                     writeTenantTuple(assignment.node.tenantId, subject, `role:${assignment.roleKey}`, `tenant:${assignment.node.tenantId}`);
@@ -3463,11 +3951,14 @@ export class SqliteScopeHost {
                 const now = new Date().toISOString();
                 let changes;
                 if (assignment.node.scopeId) {
-                    const rt = this.runtime(assignment.node.tenantId, assignment.node.scopeId);
-                    changes = rt.db
+                    // On the scope actor (#1678): a revoke that joined a stranger's transaction and
+                    // rolled back with it left the role LIVE after the caller was told it was gone.
+                    const scopeNode = assignment.node.scopeId;
+                    const rt = this.runtime(assignment.node.tenantId, scopeNode);
+                    changes = await rt.actor.turn(() => rt.db
                         .prepare(`UPDATE _substrat_tuples SET revoked_at = ?
-               WHERE subject = ? AND relation = ? AND object = ? AND revoked_at IS NULL`)
-                        .run(now, subject, relation, `scope:${assignment.node.scopeId}`).changes;
+                   WHERE subject = ? AND relation = ? AND object = ? AND revoked_at IS NULL`)
+                        .run(now, subject, relation, `scope:${scopeNode}`).changes);
                 }
                 else {
                     changes = this.directory
@@ -3484,44 +3975,56 @@ export class SqliteScopeHost {
                 // trust: the parse is where an `expiresAt` carrying a UTC offset is normalised
                 // to Z text (#963), and liveness here is a lexicographic `expires_at > ?`.
                 const grant = capabilityGrant.parse(raw);
-                writeGrant(`principal:${grant.principalId}`, grant.permission, grant.node, grant.entity, grant.expiresAt);
+                await onNode(grant.node, () => writeGrant(`principal:${grant.principalId}`, grant.permission, grant.node, grant.entity, grant.expiresAt));
                 this.recordAdmin(actor, 'grant', { tenantId: grant.node.tenantId, scopeId: grant.node.scopeId }, null, grant);
             },
             grantToConnection: async (actor, raw) => {
                 const grant = connectionGrant.parse(raw);
-                const conn = this.connectionRow(grant.connectionId);
-                if (conn.revoked_at) {
-                    throw new Error(`connection ${grant.connectionId} is revoked — grant nothing to it`);
-                }
-                // The grant may not reach outside what the connection already is. A
-                // connection is keyed (tenant, vertical, provider); letting it hold a
-                // permission in another tenant would make the key decorative.
-                if (conn.tenant_id !== grant.node.tenantId) {
-                    throw new Error(`connection ${grant.connectionId} belongs to tenant ${conn.tenant_id} and cannot ` +
-                        `be granted anything in ${grant.node.tenantId}`);
-                }
-                if (grant.node.scopeId) {
-                    const scope = this.directory
-                        .prepare('SELECT tenant_id, vertical FROM scopes WHERE scope_id = ?')
-                        .get(grant.node.scopeId);
-                    if (!scope || scope.tenant_id !== grant.node.tenantId) {
-                        throw new Error(`unknown scope ${grant.node.scopeId} in tenant ${grant.node.tenantId}`);
+                const check = () => {
+                    const conn = this.connectionRow(grant.connectionId);
+                    if (conn.revoked_at) {
+                        throw new Error(`connection ${grant.connectionId} is revoked — grant nothing to it`);
                     }
-                    if (scope.vertical !== conn.vertical) {
-                        throw new Error(`connection ${grant.connectionId} is for vertical '${conn.vertical}' and scope ` +
-                            `${grant.node.scopeId} runs '${scope.vertical ?? 'none'}'`);
+                    // The grant may not reach outside what the connection already is. A
+                    // connection is keyed (tenant, vertical, provider); letting it hold a
+                    // permission in another tenant would make the key decorative.
+                    if (conn.tenant_id !== grant.node.tenantId) {
+                        throw new Error(`connection ${grant.connectionId} belongs to tenant ${conn.tenant_id} and cannot ` +
+                            `be granted anything in ${grant.node.tenantId}`);
                     }
-                }
-                writeGrant(subjectRef({ kind: 'connection', id: grant.connectionId }), grant.permission, grant.node, undefined, grant.expiresAt);
-                // #592: the directory-side record, alongside the tuple. The tuple is checked
-                // where it lives; this row is what provision/reconcile gather FROM, so the
-                // grant reaches scopes provisioned after it without a human replaying it.
-                this.directory
-                    .prepare(`INSERT OR REPLACE INTO _substrat_connection_grants
-               (connection_id, tenant_id, vertical, permission, scope_id, expires_at,
-                granted_by, granted_at, revoked_at)
-             VALUES (?, ?, ?, ?, ?, ?, ?, ?, NULL)`)
-                    .run(grant.connectionId, grant.node.tenantId, conn.vertical, grant.permission, grant.node.scopeId ?? null, grant.expiresAt ?? null, grant.grantedBy, new Date().toISOString());
+                    if (grant.node.scopeId) {
+                        const scope = this.directory
+                            .prepare('SELECT tenant_id, vertical FROM scopes WHERE scope_id = ?')
+                            .get(grant.node.scopeId);
+                        if (!scope || scope.tenant_id !== grant.node.tenantId) {
+                            throw new Error(`unknown scope ${grant.node.scopeId} in tenant ${grant.node.tenantId}`);
+                        }
+                        if (scope.vertical !== conn.vertical) {
+                            throw new Error(`connection ${grant.connectionId} is for vertical '${conn.vertical}' and scope ` +
+                                `${grant.node.scopeId} runs '${scope.vertical ?? 'none'}'`);
+                        }
+                    }
+                    return conn;
+                };
+                // Once BEFORE the turn, so a refused grant never opens (and so creates) the scope's
+                // file; then again inside it, with the tuple and the directory row, in ONE body on
+                // the scope actor (#1678) — so the tuple cannot roll back with a stranger's
+                // transaction and leave the directory row (#592) claiming a grant the scope lacks.
+                check();
+                const conn = await onNode(grant.node, () => {
+                    const row = check();
+                    writeGrant(subjectRef({ kind: 'connection', id: grant.connectionId }), grant.permission, grant.node, undefined, grant.expiresAt);
+                    // #592: the directory-side record, alongside the tuple. The tuple is checked
+                    // where it lives; this row is what provision/reconcile gather FROM, so the
+                    // grant reaches scopes provisioned after it without a human replaying it.
+                    this.directory
+                        .prepare(`INSERT OR REPLACE INTO _substrat_connection_grants
+                 (connection_id, tenant_id, vertical, permission, scope_id, expires_at,
+                  granted_by, granted_at, revoked_at)
+               VALUES (?, ?, ?, ?, ?, ?, ?, ?, NULL)`)
+                        .run(grant.connectionId, grant.node.tenantId, row.vertical, grant.permission, grant.node.scopeId ?? null, grant.expiresAt ?? null, grant.grantedBy, new Date().toISOString());
+                    return row;
+                });
                 this.recordAdmin(actor, 'grantToConnection', { tenantId: grant.node.tenantId, scopeId: grant.node.scopeId, vertical: conn.vertical }, null, {
                     connectionId: grant.connectionId,
                     provider: conn.provider,
@@ -3537,15 +4040,79 @@ export class SqliteScopeHost {
                 // principal is bound to the module, and a scope only ever runs the modules
                 // its own host registered.
                 const grant = systemGrant.parse(raw);
-                writeGrant(subjectRef({ kind: 'system', id: grant.moduleId }), grant.permission, grant.node, undefined, grant.expiresAt);
+                const write = () => writeGrant(subjectRef({ kind: 'system', id: grant.moduleId }), grant.permission, grant.node, undefined, grant.expiresAt);
+                const scope = grant.node.scopeId;
+                if (scope) {
+                    // #1666: refused while the module is switched off on this scope. The check and the
+                    // write share one synchronous body inside one turn on the scope actor, so no switch
+                    // can move between them — and (#1666 review) neither can land inside an unrelated
+                    // `invoke`'s open transaction and roll back with it after this verb returned. The
+                    // turn is re-entrant: from inside one of this scope's tasks it joins that task.
+                    // Restore is the lever; a grant is not.
+                    const rt = this.runtime(grant.node.tenantId, scope);
+                    await rt.actor.turn(() => {
+                        if (systemSwitchedOff(switchSqlOf(rt.db), grant.moduleId)) {
+                            throw substratError('conflict', systemSwitchedOffMessage(grant.moduleId, scope));
+                        }
+                        write();
+                    });
+                }
+                else {
+                    // Tenant-level: a directory write, which no scope's transaction can hold.
+                    write();
+                }
                 this.recordAdmin(actor, 'grantToSystem', { tenantId: grant.node.tenantId, scopeId: grant.node.scopeId }, null, { moduleId: grant.moduleId, permission: grant.permission, node: grant.node });
             },
+            // #1666: the schedule kill switch and its lever back — `system-switch.ts` is the
+            // whole rule, shared with the Cloudflare adapter; this is the directory check, the
+            // transaction and the audit row around it.
+            revokeFromSystem: async (actor, raw) => switchSystem(actor, raw, 'off'),
+            restoreToSystem: async (actor, raw) => switchSystem(actor, raw, 'on'),
+            // #1672 — the platform's two capability verbs, both a turn on the scope actor
+            // (#1678: every scope-level admin write takes one, so none lands mid-invoke inside a
+            // stranger's transaction) and both in the admin log without the secret or its hash.
+            mintCapability: async (actor, tenantId, scopeId, input) => {
+                const rt = await this.openActiveScope(tenantId, scopeId);
+                const minted = await rt.actor.turn(() => mintBecomeCapability(spineSql(rt.db), input, actor, this.clock()));
+                this.recordAdmin(actor, 'mintCapability', { tenantId, scopeId }, null, {
+                    capabilityId: minted.id,
+                    mode: 'become',
+                    principal: input.principal,
+                    expiresAt: input.expiresAt,
+                    maxUses: input.maxUses,
+                    label: input.label ?? null,
+                });
+                return minted;
+            },
+            revokeCapability: async (actor, tenantId, scopeId, capabilityId) => {
+                const scope = this.directory
+                    .prepare('SELECT tenant_id FROM scopes WHERE scope_id = ?')
+                    .get(scopeId);
+                if (!scope || scope.tenant_id !== tenantId) {
+                    throw substratError('not_found', `unknown scope for tenant: (${tenantId}, ${scopeId})`);
+                }
+                const rt = this.runtime(tenantId, scopeId);
+                await this.applyPendingMigrations(rt);
+                const before = await rt.actor.turn(() => rt.db.transaction(() => revokeCapabilityAsPlatform(spineSql(rt.db), capabilityId, actor, this.clock()))());
+                if (!before) {
+                    throw substratError('not_found', `no capability ${capabilityId} in scope ${scopeId}`);
+                }
+                this.recordAdmin(actor, 'revokeCapability', { tenantId, scopeId }, before, {
+                    capabilityId,
+                    revoked: true,
+                });
+            },
             grantToOrg: async (actor, orgId, permission, node, entity) => {
                 // The org must exist in the node's tenant. A grant to a phantom org is
                 // worse than an error: it looks applied, resolves for nobody, and shows up
                 // in the permission diff as though access were conferred.
+                // Checked once before the turn, so a refusal opens no scope file; then again with
+                // the write in one body, on the scope actor when the node is a scope (#1678).
                 requireOrg(node.tenantId, orgId);
-                writeGrant(`org:${orgId}`, permission, node, entity);
+                await onNode(node, () => {
+                    requireOrg(node.tenantId, orgId);
+                    writeGrant(`org:${orgId}`, permission, node, entity);
+                });
                 this.recordAdmin(actor, 'grantToOrg', { tenantId: node.tenantId, scopeId: node.scopeId }, null, { orgId, permission, node, entity });
             },
             // -- vertical + version registry (#31) ---------------------------------
@@ -3787,7 +4354,7 @@ export class SqliteScopeHost {
                 const parsed = publishVersionInput.parse(input);
                 const owning = readVertical(parsed.verticalSlug);
                 if (!owning) {
-                    throw new Error(`unknown vertical '${parsed.verticalSlug}'`);
+                    throw substratError('not_found', `unknown vertical '${parsed.verticalSlug}'`);
                 }
                 // Lands PENDING — a push is not a deploy — except for a PRIVATE vertical
                 // (tenant-owned, not listed), whose blast radius is its own tenant: there the
@@ -3830,7 +4397,7 @@ export class SqliteScopeHost {
             setVerticalListed: async (actor, slug, listed) => {
                 const existing = readVertical(slug);
                 if (!existing)
-                    throw new Error(`unknown vertical '${slug}'`);
+                    throw substratError('not_found', `unknown vertical '${slug}'`);
                 // Listing is the moment other tenants start trusting this code, so the
                 // version they would install must carry a real staff vouch — an auto-admitted
                 // prod version has never been read by anyone but its author.
@@ -3853,14 +4420,14 @@ export class SqliteScopeHost {
             requestPublish: async (actor, slug) => {
                 const existing = readVertical(slug);
                 if (!existing)
-                    throw new Error(`unknown vertical '${slug}'`);
+                    throw substratError('not_found', `unknown vertical '${slug}'`);
                 this.directory.prepare('UPDATE verticals SET publish_requested_at = ? WHERE slug = ?').run(new Date().toISOString(), slug);
                 this.recordAdmin(actor, 'requestPublish', { tenantId: null }, null, { slug });
             },
             setVerticalInstallsBlocked: async (actor, slug, blocked) => {
                 const existing = readVertical(slug);
                 if (!existing)
-                    throw new Error(`unknown vertical '${slug}'`);
+                    throw substratError('not_found', `unknown vertical '${slug}'`);
                 this.directory
                     .prepare('UPDATE verticals SET installs_blocked = ? WHERE slug = ?')
                     .run(blocked ? 1 : 0, slug);
@@ -3869,7 +4436,7 @@ export class SqliteScopeHost {
             setVerticalTenantProvisioner: async (actor, slug, granted) => {
                 const existing = readVertical(slug);
                 if (!existing)
-                    throw new Error(`unknown vertical '${slug}'`);
+                    throw substratError('not_found', `unknown vertical '${slug}'`);
                 this.directory
                     .prepare('UPDATE verticals SET tenant_provisioner = ? WHERE slug = ?')
                     .run(granted ? 1 : 0, slug);
@@ -3878,7 +4445,7 @@ export class SqliteScopeHost {
             setVerticalEmailSender: async (actor, slug, granted) => {
                 const existing = readVertical(slug);
                 if (!existing)
-                    throw new Error(`unknown vertical '${slug}'`);
+                    throw substratError('not_found', `unknown vertical '${slug}'`);
                 this.directory
                     .prepare('UPDATE verticals SET email_sender = ? WHERE slug = ?')
                     .run(granted ? 1 : 0, slug);
@@ -3887,7 +4454,7 @@ export class SqliteScopeHost {
             deleteVertical: async (actor, slug) => {
                 const existing = readVertical(slug);
                 if (!existing)
-                    throw new Error(`unknown vertical '${slug}'`);
+                    throw substratError('not_found', `unknown vertical '${slug}'`);
                 // Refuse while any restorable scope is bound: a deleted registry row would strand
                 // those scopes' version pins and routing. An `archived` scope (a deleted app) still
                 // blocks — unarchive can bring it back — but the refusal names reap/restore, not
@@ -3900,10 +4467,10 @@ export class SqliteScopeHost {
                     'FROM scopes WHERE vertical = ?')
                     .get(slug);
                 if (bound.live > 0) {
-                    throw new Error(`vertical '${slug}' still backs ${bound.live} scope(s) — delete or rebind them first`);
+                    throw substratError('conflict', `vertical '${slug}' still backs ${bound.live} scope(s) — delete or rebind them first`);
                 }
                 if (bound.archived > 0) {
-                    throw new Error(`vertical '${slug}' still backs ${bound.archived} archived scope(s) — reap or restore them first`);
+                    throw substratError('conflict', `vertical '${slug}' still backs ${bound.archived} archived scope(s) — reap or restore them first`);
                 }
                 // Deployed dispatch scripts are NOT reaped here — they become orphans for the
                 // cleanup script (#248), never destroyed alongside a registry row.
@@ -3916,7 +4483,7 @@ export class SqliteScopeHost {
             admitVersion: async (actor, versionId) => {
                 const v = readVersion(versionId);
                 if (!v)
-                    throw new Error(`unknown version ${versionId}`);
+                    throw substratError('not_found', `unknown version ${versionId}`);
                 if (v.admission === 'admitted') {
                     // Idempotent — except an AUTO-admitted version, which this upgrades to a
                     // manual vouch by clearing the note (what the publish seam requires).
@@ -3932,7 +4499,7 @@ export class SqliteScopeHost {
                     return;
                 }
                 if (v.admission === 'rejected') {
-                    throw new Error(`version ${versionId} was rejected — publish a new one`);
+                    throw substratError('conflict', `version ${versionId} was rejected — publish a new one`);
                 }
                 this.directory
                     .prepare("UPDATE vertical_versions SET admission = 'admitted' WHERE id = ?")
@@ -3944,7 +4511,7 @@ export class SqliteScopeHost {
             rejectVersion: async (actor, versionId, note) => {
                 const v = readVersion(versionId);
                 if (!v)
-                    throw new Error(`unknown version ${versionId}`);
+                    throw substratError('not_found', `unknown version ${versionId}`);
                 if (v.admission === 'admitted') {
                     throw new Error(`version ${versionId} is already admitted — it may be bound`);
                 }
@@ -3961,7 +4528,7 @@ export class SqliteScopeHost {
             promoteVersion: async (actor, verticalSlug, channel, versionId, acknowledge) => {
                 const incoming = readVersion(versionId);
                 if (!incoming)
-                    throw new Error(`unknown version ${versionId}`);
+                    throw substratError('not_found', `unknown version ${versionId}`);
                 if (incoming.verticalSlug !== verticalSlug) {
                     throw new Error(`version ${versionId} belongs to '${incoming.verticalSlug}'`);
                 }
@@ -4091,7 +4658,7 @@ export class SqliteScopeHost {
             bindScopeVersion: async (actor, tenantId, scopeId, versionId, opts) => {
                 const v = readVersion(versionId);
                 if (!v)
-                    throw new Error(`unknown version ${versionId}`);
+                    throw substratError('not_found', `unknown version ${versionId}`);
                 const scope = this.directory
                     .prepare('SELECT tenant_id, kind, vertical_version_id FROM scopes WHERE scope_id = ?')
                     .get(scopeId);
@@ -4147,7 +4714,7 @@ export class SqliteScopeHost {
                     .prepare('SELECT * FROM verticals WHERE slug = ?')
                     .get(verticalSlug);
                 if (!r)
-                    throw new Error(`unknown vertical '${verticalSlug}'`);
+                    throw substratError('not_found', `unknown vertical '${verticalSlug}'`);
                 this.recordAccess(actor, 'verticalServing', {}, { verticalSlug }, r.serving_ref ? 1 : 0);
                 if (!r.serving_ref || !r.serving_version_id || !r.serving_migration_tag)
                     return null;
@@ -4164,7 +4731,7 @@ export class SqliteScopeHost {
                     .prepare('SELECT * FROM verticals WHERE slug = ?')
                     .get(verticalSlug);
                 if (!r)
-                    throw new Error(`unknown vertical '${verticalSlug}'`);
+                    throw substratError('not_found', `unknown vertical '${verticalSlug}'`);
                 this.directory
                     .prepare(`UPDATE verticals SET serving_ref = ?, serving_version_id = ?,
                     serving_do_classes = ?, serving_migration_tag = ? WHERE slug = ?`)
@@ -4176,7 +4743,7 @@ export class SqliteScopeHost {
                     .prepare('SELECT * FROM vertical_versions WHERE id = ?')
                     .get(versionId);
                 if (!v || v.vertical_slug !== verticalSlug) {
-                    throw new Error(`unknown version ${versionId} for vertical '${verticalSlug}'`);
+                    throw substratError('not_found', `unknown version ${versionId} for vertical '${verticalSlug}'`);
                 }
                 this.recordAccess(actor, 'versionManifest', {}, { verticalSlug, versionId }, v.manifest_json ? 1 : 0);
                 return v.manifest_json;
@@ -4206,24 +4773,18 @@ export class SqliteScopeHost {
                 this.recordAdmin(actor, 'setScopeExpiresAt', { tenantId, scopeId }, { expiresAt: scope.expires_at }, { expiresAt });
             },
             readUndrainedEvents: async (actor, tenantId, scopeId, limit) => {
-                const db = this.scopeDbFor(tenantId, scopeId);
-                const rows = db
-                    .prepare(`SELECT * FROM _substrat_outbox WHERE drained_at IS NULL ORDER BY id LIMIT ?`)
-                    .all(Math.min(Math.max(limit ?? 200, 1), 1000));
-                this.recordAccess(actor, 'readUndrainedEvents', { tenantId, scopeId }, { limit }, rows.length);
-                return rows.map((r) => ({
-                    ...this.parseOutboxRow(r),
-                    operation: r.operation ?? null,
-                    version: r.version ?? null,
-                    // #1237 — lifted like the two above, and for the same reason: the column
-                    // exists on the outbox but not on the envelope `parseOutboxRow` returns,
-                    // whose `domainEvent.parse` strips anything it does not declare.
-                    causedBy: r.caused_by ?? null,
-                    // Same lift, same reason. `drainedEvent` requires this field, and the `as never`
-                    // below is what let it be missed: without it a SQLite-backed lake loses the
-                    // call grouping permanently, while a Cloudflare-backed one keeps it.
-                    invocationId: r.invocation_id ?? null,
-                }));
+                // The COMMITTED outbox (#1624). On the shared connection this read saw an in-flight
+                // operation's uncommitted event, the drain shipped it, and the rollback left the lake
+                // — which is append-only — holding an event the scope never had. The mark that
+                // follows needs no such care: it stamps only rows that exist and are undrained.
+                const db = this.scopeReadDbFor(tenantId, scopeId);
+                const page = db.prepare(`SELECT * FROM _substrat_outbox WHERE drained_at IS NULL ORDER BY id LIMIT ? OFFSET ?`);
+                // The kernel's read, shared with the DO: the envelope and the columns lifted beside
+                // it (#1242, #1237) are decoded once, and a row that will not decode is stepped over
+                // rather than stalling the scope on it (#1636).
+                const read = readUndrainedOutbox((offset, count) => page.all(count, offset), Math.min(Math.max(limit ?? 200, 1), 1000));
+                this.recordAccess(actor, 'readUndrainedEvents', { tenantId, scopeId }, { limit }, read.events.length);
+                return undrainedEventsOf(read);
             },
             markEventsDrained: async (actor, tenantId, scopeId, eventIds) => {
                 // BEFORE the empty-batch shortcut, not after. "Nothing to mark" and "you may
@@ -4244,12 +4805,16 @@ export class SqliteScopeHost {
                 // cannot absorb: the next read resumes from the middle of a batch already
                 // in the lake, and the object it writes overlaps the one already there —
                 // the duplication the first-id object key exists to prevent.
-                const drained = db.transaction(() => {
+                //
+                // On the scope actor (#1678): issued mid-invoke, this transaction was a SAVEPOINT
+                // inside the invoke's, and its rollback un-marked a batch already in the lake — so
+                // the next pass shipped it again, the same duplicate by another road.
+                const drained = await this.runtime(tenantId, scopeId).actor.turn(() => db.transaction(() => {
                     let n = 0;
                     for (const id of eventIds)
                         n += stmt.run(at, id).changes;
                     return n;
-                })();
+                })());
                 // K-24's rule, one tier down (#1334): declaring domain payloads shipped is an
                 // EGRESS, and the admin log is where "these events left the platform, at this
                 // time, on this actor's say-so" is recorded. `drainAccessLog` audits the same
@@ -4265,12 +4830,35 @@ export class SqliteScopeHost {
                 // Directory check first, on mark's reasoning: "nothing to reopen" and "you may not
                 // address this scope" are different answers.
                 this.assertScopeReachable(tenantId, scopeId);
-                const { drainedBefore } = redrainEventsInput.parse(input);
+                const { drainedBefore, countOnly } = redrainEventsInput.parse(input);
                 // The window rule, enforced HERE and not only at the control-plane door: this verb
                 // is public `HostAdmin`, so the fleet script reaches it without passing that route.
-                // The injected clock, so a test pins the boundary rather than racing it.
+                // The injected clock, so a test pins the boundary rather than racing it. A count is
+                // held to it too — the two answers come from one verb and one door.
                 assertRedrainWindow(drainedBefore, this.clock());
                 const db = this.scopeDbFor(tenantId, scopeId);
+                // A COUNT reopens nothing, writes nothing, and records nothing (#1545). The two
+                // receipts below are there because a reopen is a second egress of a tenant's
+                // payloads; a count egresses none, and an admin row claiming a redrain on a scope
+                // that was only counted is a false statement in the one log that is evidence.
+                //
+                // UNBOUNDED, unlike the reopen under it: the batch exists because an UPDATE over
+                // the whole window must fit one Durable-Object request on the other adapter, and an
+                // aggregate materialises no rows. A capped count would answer "5000, or more",
+                // which is not an answer.
+                //
+                // It IS a read, and K-24 takes all reads rather than a chosen subset, so it leaves
+                // an access row — the count itself as the result count, which is the fact an
+                // auditor asking "who counted this tenant's outbox, and how much was there" wants.
+                if (countOnly) {
+                    // The committed count (#1624): a stranger's uncommitted drain mark is not a fact yet.
+                    const redrainable = this.scopeReadDbFor(tenantId, scopeId)
+                        .prepare(`SELECT COUNT(*) AS c FROM _substrat_outbox
+                  WHERE drained_at IS NOT NULL AND drained_at < ?`)
+                        .get(drainedBefore).c;
+                    this.recordAccess(actor, 'redrainEvents', { tenantId, scopeId }, { drainedBefore, countOnly: true }, redrainable);
+                    return redrainable;
+                }
                 // Audit FIRST, matching the Cloudflare adapter and `rewindScope` (K-33): the row is
                 // a separate statement outside the update's transaction, so a failure between them
                 // would leave a reopen with no receipt — and the retry cannot repair it, because the
@@ -4288,14 +4876,17 @@ export class SqliteScopeHost {
                 // is never pruned, so the unbounded form scales with the scope's whole history.
                 // SQLite is built here without UPDATE...LIMIT, so the batch is a subselect over the
                 // primary key — oldest first, so a partial run leaves a prefix rather than holes.
-                const redrained = db
+                //
+                // On the scope actor (#1678), so a stranger's rollback cannot undo a reopen this
+                // verb has already counted and receipted.
+                const redrained = await this.runtime(tenantId, scopeId).actor.turn(() => db
                     .prepare(`UPDATE _substrat_outbox SET drained_at = NULL
-              WHERE id IN (
-                SELECT id FROM _substrat_outbox
-                 WHERE drained_at IS NOT NULL AND drained_at < ?
-                 ORDER BY id LIMIT ?
-              )`)
-                    .run(drainedBefore, REDRAIN_BATCH).changes;
+                  WHERE id IN (
+                    SELECT id FROM _substrat_outbox
+                     WHERE drained_at IS NOT NULL AND drained_at < ?
+                     ORDER BY id LIMIT ?
+                  )`)
+                    .run(drainedBefore, REDRAIN_BATCH).changes);
                 // The outcome beside the intent above — only when something changed, so a re-run
                 // over an already reopened window leaves no row claiming it did something.
                 if (redrained > 0) {
@@ -4306,7 +4897,7 @@ export class SqliteScopeHost {
             facetEvents: async (actor, tenantId, scopeId, input) => {
                 // `facetEvents` is the sanctioned read: an erased payload yields the same
                 // NULL a missing field does, and only the helper counts them apart.
-                const db = this.scopeDbFor(tenantId, scopeId);
+                const db = this.scopeReadDbFor(tenantId, scopeId);
                 const result = facetEvents({ sql: scopedSql(db) }, input);
                 this.recordAccess(actor, 'facetEvents', { tenantId, scopeId }, input, result.buckets.length);
                 return result;
@@ -4316,7 +4907,7 @@ export class SqliteScopeHost {
                 // only one that decodes the envelope's nullable facts (an erased payload, an
                 // unrecorded authorization chain, nobody impersonating) as facts rather than
                 // as missing data.
-                const db = this.scopeDbFor(tenantId, scopeId);
+                const db = this.scopeReadDbFor(tenantId, scopeId);
                 const page = readHistory({ sql: scopedSql(db) }, { entityType: input.entityType, entityId: input.entityId }, { limit: input.limit, cursor: input.cursor });
                 this.recordAccess(actor, 'entityHistory', { tenantId, scopeId }, { entityType: input.entityType, entityId: input.entityId }, page.entries.length);
                 return page;
@@ -4325,7 +4916,7 @@ export class SqliteScopeHost {
                 // #1237: the sanctioned walk. The helper owns the one distinction the whole
                 // view rests on — a null cause with an operation is the beginning of the
                 // chain, a null cause without one is the trail running out.
-                const db = this.scopeDbFor(tenantId, scopeId);
+                const db = this.scopeReadDbFor(tenantId, scopeId);
                 const result = walkEventCause({ sql: scopedSql(db) }, input.eventId, input.maxDepth);
                 this.recordAccess(actor, 'eventCause', { tenantId, scopeId }, { eventId: input.eventId }, result.chain.length);
                 return result;
@@ -4333,27 +4924,27 @@ export class SqliteScopeHost {
             eventEffects: async (actor, tenantId, scopeId, input) => {
                 // #1237 forward: the helper owns the two delivery traps — `delivered_at`
                 // meaning two different things, and an empty list being ambiguous.
-                const db = this.scopeDbFor(tenantId, scopeId);
+                const db = this.scopeReadDbFor(tenantId, scopeId);
                 const tree = walkEventEffects({ sql: scopedSql(db) }, input.eventId, input.maxNodes);
                 this.recordAccess(actor, 'eventEffects', { tenantId, scopeId }, { eventId: input.eventId }, tree.count);
                 return tree;
             },
             invocationEvents: async (actor, tenantId, scopeId, input) => {
                 // #1237: one call's events, siblings included — what neither walk reaches.
-                const db = this.scopeDbFor(tenantId, scopeId);
+                const db = this.scopeReadDbFor(tenantId, scopeId);
                 const read = readInvocation({ sql: scopedSql(db) }, input.invocationId, input.limit);
                 this.recordAccess(actor, 'invocationEvents', { tenantId, scopeId }, { invocationId: input.invocationId }, read.events.length);
                 return read;
             },
             deadLetters: async (actor, tenantId, scopeId, input) => {
                 // #1525: every delivery that gave up, scope-wide — what the walks reach only by event.
-                const db = this.scopeDbFor(tenantId, scopeId);
+                const db = this.scopeReadDbFor(tenantId, scopeId);
                 const page = readDeadLetters({ sql: scopedSql(db) }, { limit: input.limit, cursor: input.cursor });
                 this.recordAccess(actor, 'deadLetters', { tenantId, scopeId }, null, page.entries.length);
                 return page;
             },
             scopeAppliedMigrations: async (actor, tenantId, scopeId) => {
-                const db = this.scopeDbFor(tenantId, scopeId);
+                const db = this.scopeReadDbFor(tenantId, scopeId);
                 const rows = db
                     .prepare(`SELECT module_id, version, applied_at FROM _substrat_migrations
               ORDER BY applied_at DESC, module_id, version LIMIT 100`)
@@ -4377,6 +4968,16 @@ export class SqliteScopeHost {
                 this.recordAccess(actor, 'scopeMigrationBookmarks', { tenantId, scopeId }, null, 0);
                 return [];
             },
+            scopeDatabaseSize: async (actor, tenantId, scopeId) => {
+                // #1524: the SQLite twin of a DO's `databaseSize`. It counts allocated pages,
+                // free ones included, which is what the file costs on disk, not the live row bytes.
+                const db = this.scopeReadDbFor(tenantId, scopeId);
+                const pages = db.pragma('page_count', { simple: true });
+                const pageSize = db.pragma('page_size', { simple: true });
+                const bytes = pages * pageSize;
+                this.recordAccess(actor, 'scopeDatabaseSize', { tenantId, scopeId }, null, 1);
+                return bytes;
+            },
             rewindScope: async () => {
                 throw new Error('point-in-time rewind is not available on this host (PITR is a Durable-Object-plane mechanism) — use the backup restore path');
             },
@@ -4609,7 +5210,7 @@ export class SqliteScopeHost {
             listScopeTables: async (actor, tenantId, scopeId) => {
                 // K-3: the (tenantId, scopeId) pair is cross-checked before we open anything;
                 // a scope under a different tenant is unreachable, never another tenant's DB.
-                const db = this.scopeDbFor(tenantId, scopeId);
+                const db = this.scopeReadDbFor(tenantId, scopeId);
                 const names = db
                     .prepare(`SELECT name FROM sqlite_master WHERE type = 'table' ORDER BY name`)
                     .all().map((r) => r.name);
@@ -4622,7 +5223,7 @@ export class SqliteScopeHost {
                 return tables;
             },
             readScopeTable: async (actor, tenantId, scopeId, input) => {
-                const db = this.scopeDbFor(tenantId, scopeId);
+                const db = this.scopeReadDbFor(tenantId, scopeId);
                 // Validate the table against the LIVE schema — an unknown name throws, it is
                 // never interpolated blind. That validated name is the only thing that reaches
                 // the query, so the quoted identifier below carries no user input.
@@ -4639,7 +5240,7 @@ export class SqliteScopeHost {
                 return { table: input.table, columns, rows, rowCount, limit, offset };
             },
             queryScope: async (actor, tenantId, scopeId, input) => {
-                const db = this.scopeDbFor(tenantId, scopeId);
+                const db = this.scopeReadDbFor(tenantId, scopeId);
                 // Layer 1, shared: the kernel's textual gate (single statement, read verbs
                 // only) — the checked statement is the one that runs.
                 const sql = assertReadOnlyQuery(input.sql);
@@ -4674,14 +5275,14 @@ export class SqliteScopeHost {
             // read records to the K-24 access log. What differs is that these two answer a
             // question about the permission model rather than about the data.
             listDenials: async (actor, tenantId, scopeId, filter) => {
-                const db = this.scopeDbFor(tenantId, scopeId);
+                const db = this.scopeReadDbFor(tenantId, scopeId);
                 const q = denialListQuery(filter);
                 const rows = db.prepare(q.sql).all(...q.params).map(mapDenialRow);
                 this.recordAccess(actor, 'listDenials', { tenantId, scopeId }, filter ?? null, rows.length);
                 return rows;
             },
             summarizeDenials: async (actor, tenantId, scopeId, filter) => {
-                const db = this.scopeDbFor(tenantId, scopeId);
+                const db = this.scopeReadDbFor(tenantId, scopeId);
                 const b = denialSummaryQuery(filter);
                 // Grouped as the filter asked (#1456), and the answer says which way.
                 const grouped = mapDenialSummaryBuckets(b.groupBy, db.prepare(b.sql).all(...b.params));
@@ -4701,7 +5302,7 @@ export class SqliteScopeHost {
             },
             exportScope: async (actor, tenantId, scopeId) => {
                 // K-3: cross-check the pair before opening anything (same as the introspection reads).
-                const db = this.scopeDbFor(tenantId, scopeId);
+                const db = this.scopeReadDbFor(tenantId, scopeId);
                 // Every real table, keeping the `_substrat_*` spine but dropping SQLite's own
                 // `sqlite_*` internals — those are auto-managed and `CREATE TABLE sqlite_*` is
                 // rejected on reload. `sql` is the CREATE statement, replayed to rebuild the schema.
@@ -4842,13 +5443,11 @@ export class SqliteScopeHost {
                     throw new Error(`scope ${scopeId} still resolves hostname '${bound.hostname}' — ` +
                         `unbind it before reaping (reap wipes storage and cannot be undone)`);
                 }
-                const key = `${tenantId}/${scopeId}`;
-                const rt = this.scopes.get(key);
-                if (rt) {
-                    rt.db.close();
-                    this.scopes.delete(key);
-                    this.scopesById.delete(scopeId);
-                }
+                // The reader goes with the writer (#1624): an open handle on a removed file keeps
+                // reading the unlinked bytes, which is the reaped data answering as if it were live.
+                const rt = this.scopes.get(`${tenantId}/${scopeId}`);
+                if (rt)
+                    this.closeRuntime(rt);
                 rmSync(join(this.dir, `${tenantId}__${scopeId}.sqlite`), { force: true });
                 // The recoverable copy the caller stored first (#493), named in the audit entry so
                 // the trail answers "was there a backup" without correlating two timestamps.
@@ -4887,15 +5486,31 @@ export class SqliteScopeHost {
                 // and transaction facts remain". A consumer's timeline still shows that something
                 // happened, to what, and when; it no longer shows who or what was said.
                 const db = this.scopeDbFor(tenantId, scopeId);
-                const redacted = db
-                    .prepare(`UPDATE _substrat_outbox SET payload = NULL
-              WHERE subject_id = ? AND pii_class != 'none' AND payload IS NOT NULL`)
-                    .run(subjectId);
+                // One instant for the whole erasure, read before the first write: the intent
+                // tombstones below and the key's own tombstone should not disagree about when a
+                // person was erased.
                 const at = new Date().toISOString();
+                // Both scope-side redactions in ONE turn on the scope actor (#1678): issued while an
+                // invoke held its transaction open, they joined it, and its rollback put the
+                // person's PII back after this verb had destroyed the key and receipted the erasure.
+                const { redacted, intentsRedacted } = await this.runtime(tenantId, scopeId).actor.turn(() => ({
+                    redacted: db
+                        .prepare(`UPDATE _substrat_outbox SET payload = NULL
+                WHERE subject_id = ? AND pii_class != 'none' AND payload IS NOT NULL`)
+                        .run(subjectId),
+                    // The spine's OTHER copy of an event (#1600). A CP-less host routes a connector
+                    // delivery it cannot run into `_substrat_platform_requests` with the whole event
+                    // embedded, and nothing ever deletes those rows — so the same line has to be held
+                    // here, or the redaction above only moves the name one table across. Same
+                    // idempotence as the outbox half: a re-run finds the tombstones and changes
+                    // nothing.
+                    intentsRedacted: this.redactSubjectIntents(db, subjectId, at),
+                }));
                 const { existed } = await this.subjectKeysFor(tenantId, scopeId).destroy(subjectId, at);
                 const receipt = subjectShredReceipt.parse({
                     subjectId,
                     eventsRedacted: redacted.changes,
+                    intentsRedacted,
                     keyDestroyed: existed,
                     tombstoned: true,
                 });
@@ -4903,7 +5518,9 @@ export class SqliteScopeHost {
                 // mutation, the access log because it destroys evidence. An erasure is the one
                 // action where "who asked for this to disappear" is itself the record.
                 this.recordAdmin(actor, 'shredSubject', { tenantId, scopeId }, null, receipt);
-                this.recordAccess(actor, 'shredSubject', { tenantId, scopeId }, { subjectId }, redacted.changes);
+                // BOTH counts: the access log's number is "how much evidence this destroyed", and
+                // an intent payload is a whole event's worth of it.
+                this.recordAccess(actor, 'shredSubject', { tenantId, scopeId }, { subjectId }, redacted.changes + intentsRedacted);
                 return receipt;
             },
             // -- impersonation (K-42, #868) ----------------------------------------
@@ -5121,6 +5738,40 @@ export class SqliteScopeHost {
                 this.recordAccess(actor, 'listIdentityTenants', {}, { provider }, tenants.length);
                 return tenants;
             },
+            listIdentityMemberships: async (actor, provider, externalId) => {
+                const pool = readPool(provider);
+                if (!pool)
+                    throw new Error(`identity pool '${provider}' is not registered`);
+                if (pool.topology !== 'central') {
+                    throw new Error(`identity pool '${provider}' is tenant-bound — enumerating tenants is only ` +
+                        `meaningful on a central pool, where the same externalId is the same person`);
+                }
+                const rows = this.directory
+                    .prepare(`SELECT i.tenant_id, i.principal_id, s.scope_id, s.vertical, s.status AS scope_status
+               FROM _substrat_identities i
+               LEFT JOIN scopes s ON s.scope_id = i.scope_id AND s.tenant_id = i.tenant_id
+              WHERE i.provider = ? AND i.external_id = ?
+              ORDER BY i.tenant_id`)
+                    .all(provider, externalId);
+                const memberships = rows.flatMap((r) => {
+                    // A link whose tenant row is gone names nothing a caller could land in.
+                    const tenant = readTenant(r.tenant_id);
+                    if (!tenant)
+                        return [];
+                    return [
+                        identityMembership.parse({
+                            tenant,
+                            principal: r.principal_id,
+                            scope: r.scope_id === null
+                                ? null
+                                : { id: r.scope_id, vertical: r.vertical, status: r.scope_status ?? 'active' },
+                        }),
+                    ];
+                });
+                // One row for the whole answer — the read this replaces logged one per tenant.
+                this.recordAccess(actor, 'listIdentityMemberships', {}, { provider }, memberships.length);
+                return memberships;
+            },
             listIdentityLinks: async (actor, tid) => {
                 // The projection read (#406): what the platform gathers to deliver a tenant's
                 // links with provisioning/reconcile — the same trust line entitlements ride
@@ -5826,6 +6477,44 @@ export class SqliteScopeHost {
         if (!existing)
             db.exec(`ALTER TABLE ${table} ADD COLUMN ${ddl}`);
     }
+    /**
+     * #1288: `_substrat_schedule_state`, rebuilt with `kind` in its key on a scope db
+     * whose table predates the column. The statements are the kernel's, so the DO
+     * adapter rebuilds byte-identically, and the detection is the `sqlite_master.sql`
+     * read `ensureIdentityKey` already uses — PRAGMA would do here, but not there.
+     */
+    ensureScheduleStateKind(db) {
+        const row = db
+            .prepare("SELECT sql FROM sqlite_master WHERE type = 'table' AND name = ?")
+            .get('_substrat_schedule_state');
+        if (!row || scheduleStateHasKind(row.sql))
+            return;
+        // In a transaction, for the reason the kernel constant spells out: create-copy-
+        // drop-rename has two intermediate states and BOTH are unrecoverable on the next
+        // wake — one dies on the leftover scratch table, one silently orphans the rows
+        // behind an empty table `CREATE TABLE IF NOT EXISTS` put back. `db.transaction`
+        // nests as a SAVEPOINT, which is what makes this safe on the `loadDump` path too,
+        // where the whole replay is already inside one.
+        db.transaction(() => db.exec(SCHEDULE_STATE_REBUILD))();
+    }
+    /**
+     * #1573: run a create-copy-drop-rename against the directory as ONE transaction.
+     * `exec` of four statements is four autocommits, and the state between DROP and
+     * RENAME is the one to fear: the next open runs the bootstrap first, whose `CREATE
+     * TABLE IF NOT EXISTS` puts an EMPTY table of the new shape back, detection then
+     * reads that shape and concludes the migration is done — and every copied row stays
+     * orphaned in the `_new` table, with nothing ever erroring. Atomic, neither
+     * intermediate state is reachable, so there is no recovery path to write (or to
+     * leave untested).
+     *
+     * `db.transaction` nests as a SAVEPOINT, as `ensureScheduleStateKind` (#1571) relies
+     * on. Each script leads with `DROP TABLE IF EXISTS <table>_new` to absorb a scratch
+     * table arriving from BELOW the transaction (a torn copy of the file, a backup that
+     * captured one mid-rebuild) — belt, not the fix.
+     */
+    rebuildAtomically(script) {
+        this.directory.transaction(() => this.directory.exec(script))();
+    }
     /**
      * Rebuild `_substrat_identities` when it still carries the pre-K-22 global key.
      * A PRIMARY KEY cannot be ALTERed, so this is create-copy-drop-rename.
@@ -5846,7 +6535,9 @@ export class SqliteScopeHost {
             .get('_substrat_identities');
         if (!row || row.sql.includes('PRIMARY KEY (tenant_id, provider, external_id)'))
             return;
-        this.directory.exec(`
+        // #1573: one transaction — see `rebuildAtomically`.
+        this.rebuildAtomically(`
+      DROP TABLE IF EXISTS _substrat_identities_new;
       CREATE TABLE _substrat_identities_new (
         provider     TEXT NOT NULL,
         external_id  TEXT NOT NULL,
@@ -5877,7 +6568,9 @@ export class SqliteScopeHost {
             .get('_substrat_admin_log');
         if (!row || !/tenant_id TEXT NOT NULL/.test(row.sql))
             return;
-        this.directory.exec(`
+        // #1573: one transaction — see `rebuildAtomically`.
+        this.rebuildAtomically(`
+      DROP TABLE IF EXISTS _substrat_admin_log_new;
       CREATE TABLE _substrat_admin_log_new (
         id TEXT PRIMARY KEY,
         actor TEXT NOT NULL,
@@ -5896,6 +6589,30 @@ export class SqliteScopeHost {
       ALTER TABLE _substrat_admin_log_new RENAME TO _substrat_admin_log;
     `);
     }
+    /**
+     * #1572: `_substrat_sweep_runs_intent` with `kind` in it, on a directory whose index
+     * predates that. `CREATE UNIQUE INDEX IF NOT EXISTS` matches on the name alone, so the
+     * bootstrap cannot do this: on an existing directory it sees the old index and skips,
+     * and the schedule/freshness collision the new key refuses stays live for good.
+     *
+     * Detected from `sqlite_master.sql`, like the table rebuilds above, and replaced as
+     * DROP-then-CREATE in one transaction (`rebuildAtomically`). Less rides on that than on
+     * a table rebuild — the index holds no rows, and one dropped but not re-created comes
+     * back on the next open, because the bootstrap creates it by name — but there is then
+     * no committed directory with no dedupe key at all. The CREATE cannot meet a row it
+     * refuses: every set of rows unique on (request_id, unit) is unique on the wider key.
+     */
+    ensureSweepRunsIntentKind() {
+        const row = this.directory
+            .prepare("SELECT sql FROM sqlite_master WHERE type = 'index' AND name = ?")
+            .get('_substrat_sweep_runs_intent');
+        if (row && sweepRunsIntentHasKind(row.sql))
+            return;
+        this.rebuildAtomically(`
+      DROP INDEX IF EXISTS _substrat_sweep_runs_intent;
+      ${SWEEP_RUNS_INTENT_INDEX}
+    `);
+    }
     ensureDirectoryColumns() {
         this.ensureIdentityKey();
         this.ensureAdminLogTenantNullable();
@@ -5964,7 +6681,7 @@ export class SqliteScopeHost {
         this.ensureColumn(this.directory, '_substrat_sweep_runs', 'request_id', 'request_id TEXT');
         this.ensureColumn(this.directory, '_substrat_sweep_runs', 'event_type', 'event_type TEXT');
         this.ensureColumn(this.directory, '_substrat_sweep_runs', 'observed_at', 'observed_at TEXT');
-        this.directory.exec('CREATE UNIQUE INDEX IF NOT EXISTS _substrat_sweep_runs_intent ON _substrat_sweep_runs (request_id, unit)');
+        this.ensureSweepRunsIntentKind();
         const existing = new Set(this.directory.prepare('PRAGMA table_info(scopes)').all().map((c) => c.name));
         for (const [column, ddl] of [
             ['parent_scope_id', 'parent_scope_id TEXT'],
@@ -6041,7 +6758,23 @@ export class SqliteScopeHost {
      * onto every event it emits. Absent for consumer dispatch: a consumer runs on
      * behalf of no operation, and the emitted row's NULL says so.
      */
-    operation) {
+    operation, 
+    /**
+     * #1672: the secrets `ctx.capabilities.mint` hands out during this invocation. The
+     * stub owns the array (it withholds them from the idempotency recording); this
+     * context appends to it and holds `ctx.sql`, `ctx.emit` and `ctx.requestPlatform` to
+     * it — the tripwire that catches a module persisting one by accident (not a boundary
+     * against one that means to; see `assertNoSecret`).
+     */
+    minted = [], 
+    /**
+     * #1672: the instant to stamp, when the caller already read one. The exchange passes the
+     * instant its row write used, so the `capability.exercised` event's `occurredAt` and the
+     * row's `last_used_at` are the same value — a second clock read could disagree.
+     */
+    at = this.clock()) {
+        // For a connection, system or capability subject this carries THAT id so the type
+        // holds — it is not a person, and the event actor below says what it is instead.
         const principal = subject.id;
         const checker = this.checker;
         const relations = this.relations;
@@ -6066,7 +6799,6 @@ export class SqliteScopeHost {
          * `ctx.now()` deterministic only in the sense that each reading is separately
          * unpredictable.
          */
-        const at = this.clock();
         /**
          * The scope host's half of `ctx.atomic` (#770) — everything else is the
          * kernel's (`createAtomic`). SQLite gives us savepoints, which nest inside
@@ -6102,7 +6834,10 @@ export class SqliteScopeHost {
         // Lifted out of the object literal so `grant` can reuse it: a delegation
         // check has to be the SAME check the operation itself passes, or the two
         // could disagree about what the caller holds.
-        const runCheck = async (permission, entity) => {
+        const runCheck = async (unparsed, entity) => {
+            // #1642: parsed before the override actor's early return, which never reaches
+            // the checker — a cast key would otherwise become that path's proof relation.
+            const permission = assertPermissionKey(unparsed);
             if (overrideActor) {
                 return {
                     allowed: true,
@@ -6140,15 +6875,17 @@ export class SqliteScopeHost {
                 scopeId: rt.scopeId,
             });
         };
-        return {
+        const ctxRef = {
             tenantId: rt.tenantId,
             scopeId: rt.scopeId,
             principal,
-            sql: scopedSql(rt.db),
+            sql: guardSecrets(scopedSql(rt.db), minted),
             now: () => at,
             emit: (event) => {
                 assertImpersonationWrites(impersonation, 'ctx.emit');
                 const input = domainEventInput.parse(event);
+                // #1672: the COMPLETE parsed event — entity id, type and subject as well as payload.
+                assertNoSecret('ctx.emit', input, minted);
                 const full = domainEvent.parse({
                     ...input,
                     // #956: from the operation's instant, not the wall clock. `ORDER BY id`
@@ -6159,12 +6896,7 @@ export class SqliteScopeHost {
                     occurredAt: at,
                     tenantId: rt.tenantId,
                     scopeId: rt.scopeId,
-                    actor: overrideActor ??
-                        (subject.kind === 'system'
-                            ? { system: subject.id }
-                            : subject.kind === 'connection'
-                                ? { connection: subject.id }
-                                : principal),
+                    actor: overrideActor ?? actorOf(subject),
                     ...(passed.length ? { authorization: passed.map((p) => ({ ...p })) } : {}),
                     ...(stamp ? { impersonation: stamp } : {}),
                     // #1231: kernel-stamped like the two above — `domainEventInput.parse`
@@ -6194,6 +6926,8 @@ export class SqliteScopeHost {
             requestPlatform: (request) => {
                 assertImpersonationWrites(impersonation, 'ctx.requestPlatform');
                 const input = platformRequestInput.parse(request);
+                // #1672: the COMPLETE parsed request — its `kind` is persisted as surely as its payload.
+                assertNoSecret('ctx.requestPlatform', input, minted);
                 // #1474: a platform-authored kind (`sweep-runs`) is the platform's to enqueue, never
                 // module code's — its drain handler writes schedule verdicts the dashboard trusts.
                 assertModuleEnqueueableKind(input.kind);
@@ -6206,12 +6940,7 @@ export class SqliteScopeHost {
                     throw new Error(`too many pending platform requests (${pending}); retry once some have drained`);
                 }
                 const id = platformRequestId.parse(ulid());
-                const requestedBy = overrideActor ??
-                    (subject.kind === 'system'
-                        ? { system: subject.id }
-                        : subject.kind === 'connection'
-                            ? { connection: subject.id }
-                            : principal);
+                const requestedBy = overrideActor ?? actorOf(subject);
                 rt.db
                     .prepare(`INSERT INTO _substrat_platform_requests
                (id, kind, payload, requested_by, impersonation, status, attempts, requested_at)
@@ -6225,7 +6954,7 @@ export class SqliteScopeHost {
             // predicate is needed or possible: the runtime IS the scope.
             platformRequests: (filter) => {
                 const q = platformRequestHistoryQuery(filter);
-                return rt.db.prepare(q.sql).all(...q.params).map(rowToPlatformRequest);
+                return rt.db.prepare(q.sql).all(...q.params).map(platformRequestOf);
             },
             // #901. This scope's own spine, so no tenancy predicate is needed or
             // possible — the runtime IS the scope. The version is the last event's
@@ -6325,6 +7054,21 @@ export class SqliteScopeHost {
                     .run(`principal:${principal}`, `granted:${permission}`, `${entity.entityType}:${entity.entityId}`);
             },
             atomic: createAtomic(runSub, { passed, signals }),
+            // #1672: mint / revoke / list, written once in the kernel. The raw spine seam (this
+            // is the kernel's own write to `_substrat_capabilities`), the operation's OWN check —
+            // the predicate `grant` shares — and `ctx.emit` for the minted/revoked events. A
+            // consumer's override actor is passed as the system actor it is, so a consumer cannot
+            // mint: its checks allow unconditionally, which would make "the minter holds it" vacuous.
+            capabilities: createCapabilityVerbs({
+                sql: spineSql(rt.db),
+                subject: overrideActor ? { kind: 'system', id: overrideActor.system } : subject,
+                now: at,
+                check: runCheck,
+                emit: (event) => ctxRef.emit(event),
+                isOperation: (name) => this.operations.has(name),
+                assertWrites: (verb) => assertImpersonationWrites(impersonation, verb),
+                minted,
+            }),
             link: (child, parent) => {
                 assertImpersonationWrites(impersonation, 'ctx.link');
                 const allowed = relations.get(child.entityType);
@@ -6386,6 +7130,7 @@ export class SqliteScopeHost {
                 return sealTo({ keyId: key.keyId, publicKey: key.publicKey }, plaintext);
             },
         };
+        return ctxRef;
     }
     async applyPendingMigrations(rt) {
         const pending = [];
@@ -6494,10 +7239,98 @@ export class SqliteScopeHost {
             throw new Error(`scope ${scopeId} is reaped — its storage is gone and cannot be read`);
         }
     }
+    /**
+     * The intent-journal half of `shredSubject` (#1600) — the DO's `redactSubject` twin.
+     *
+     * Row-by-row rather than one `UPDATE … WHERE`: the decision is structural (does this
+     * payload embed an event the erasure redacts?) and SQL cannot make it, because an
+     * intent payload is opaque JSON with no `pii_class` column to test. The SQL narrows to
+     * the rows that could possibly match; the kernel predicate decides; the kernel's
+     * statement writes. All three are shared with the Durable-Object adapter so the two
+     * cannot drift about what a redacted intent is.
+     *
+     * Returns how many rows it redacted — zero on a re-run, the tombstones having already
+     * stopped matching.
+     */
+    redactSubjectIntents(db, subjectId, at) {
+        const q = platformRequestRedactionQuery(subjectId);
+        const candidates = db.prepare(q.sql).all(...q.params);
+        const write = db.prepare(PLATFORM_REQUEST_REDACTION_SQL);
+        let redacted = 0;
+        for (const row of candidates) {
+            if (!intentPayloadCarriesSubject(row.payload, subjectId))
+                continue;
+            write.run(...platformRequestRedactionParams(row.id, subjectId, at));
+            redacted += 1;
+        }
+        return redacted;
+    }
     scopeDbFor(tenantId, scopeId) {
         this.assertScopeReachable(tenantId, scopeId);
         return this.runtime(tenantId, scopeId).db;
     }
+    /**
+     * The connection a `HostAdmin` READ runs on (#1624) — `scopeDbFor`'s twin, with the
+     * same K-3 and reap gate in front of it.
+     *
+     * From OUTSIDE the scope's actor it is the scope's read-only connection. `invoke` holds
+     * a `BEGIN IMMEDIATE` open on the shared connection across its awaits, so a read there
+     * saw a stranger's uncommitted rows: a lake drain shipped an event that then rolled
+     * back — permanently, since the lake is append-only — and an export captured one into a
+     * backup. The file is WAL, so the reader sees exactly what was committed.
+     *
+     * From INSIDE one of the scope's actor tasks (an executor handed `HostAdmin`, reading
+     * its own scope) it is the shared connection, as before. The only transaction open
+     * there is the caller's own unit — the actor serializes everything else — so reading
+     * it is reading your own writes, which is the answer the caller is owed and the one it
+     * had. `ScopeActor.turn` makes the same call for the writers (#1678).
+     */
+    scopeReadDbFor(tenantId, scopeId) {
+        this.assertScopeReachable(tenantId, scopeId);
+        return this.readDb(this.runtime(tenantId, scopeId));
+    }
+    /**
+     * `scopeReadDbFor` without the directory gate, for the host-side reads that already
+     * resolved their runtime — the platform-intent drain's `listPlatformRequests` among them,
+     * where a stranger's uncommitted intent was a platform effect about to be carried out for
+     * an operation that then rolled back.
+     */
+    readDb(rt) {
+        if (rt.actor.holds())
+            return rt.db;
+        const key = `${rt.tenantId}/${rt.scopeId}`;
+        if (rt.reader) {
+            // Most recently used goes to the back of the insertion order, which is the cap's LRU.
+            this.readers.delete(key);
+            this.readers.set(key, rt);
+            return rt.reader;
+        }
+        // `runtime()` opened the writer first, in WAL, so the file and its `-shm` exist.
+        rt.reader = new Database(rt.file, { readonly: true, fileMustExist: true });
+        this.readers.set(key, rt);
+        // The cap: a lake drain sweeps every scope, and without it every open scope would end
+        // up holding two connections. The oldest reader is closed; the next read reopens it.
+        while (this.readers.size > READER_CAP) {
+            const [oldest, victim] = this.readers.entries().next().value;
+            this.readers.delete(oldest);
+            victim.reader?.close();
+            victim.reader = null;
+        }
+        return rt.reader;
+    }
+    /**
+     * Close a scope's connections and forget its runtime — the reader with the writer, so
+     * neither outlives the file a reap or a snapshot delete is about to remove.
+     */
+    closeRuntime(rt) {
+        const key = `${rt.tenantId}/${rt.scopeId}`;
+        rt.reader?.close();
+        rt.reader = null;
+        this.readers.delete(key);
+        rt.db.close();
+        this.scopes.delete(key);
+        this.scopesById.delete(rt.scopeId);
+    }
     /**
      * The additive spine-column migrations, shared by `runtime()` and the dump replay.
      * KERNEL_DDL is all IF NOT EXISTS, so a scope DB created before a column keeps the
@@ -6516,6 +7349,11 @@ export class SqliteScopeHost {
         // consumer dead-letter.
         this.ensureColumn(db, '_substrat_deliveries', 'attempts', 'attempts INTEGER NOT NULL DEFAULT 0');
         this.ensureColumn(db, '_substrat_deliveries', 'next_attempt_at', 'next_attempt_at TEXT');
+        // #1525: the invocation an attempt ran in, on a scope DB created before the column.
+        // Nullable, and the null is honestly "no call was carried" — which attempt produced
+        // a delivery already journalled cannot be decided afterwards, exactly as #1237's
+        // outbox column argued.
+        this.ensureColumn(db, '_substrat_deliveries', 'invocation_id', 'invocation_id TEXT');
         // K-34: the authorization column on a scope DB created before it existed. Nullable,
         // so legacy outbox rows read as "unrecorded" — the honest value. (_substrat_denials
         // is a whole new table, so KERNEL_DDL's IF NOT EXISTS covers it with no ALTER.)
@@ -6531,6 +7369,10 @@ export class SqliteScopeHost {
         this.ensureColumn(db, '_substrat_outbox', 'impersonation', 'impersonation TEXT');
         this.ensureColumn(db, '_substrat_platform_requests', 'impersonation', 'impersonation TEXT');
         this.ensureColumn(db, '_substrat_denials', 'impersonation', 'impersonation TEXT');
+        // #1525: the invocation a refusal happened during, on a scope DB created before the
+        // column. Nullable, and the null is honestly "no id was carried" — a past denial's
+        // call cannot be decided afterwards, exactly as #1237's outbox column argued.
+        this.ensureColumn(db, '_substrat_denials', 'invocation_id', 'invocation_id TEXT');
         // #1231: the emitting operation, on a scope DB created before the column. Nullable
         // so every legacy row reads as unrecorded rather than claiming a name nobody stamped.
         this.ensureColumn(db, '_substrat_outbox', 'operation', 'operation TEXT');
@@ -6544,6 +7386,9 @@ export class SqliteScopeHost {
         // #1237: existing scopes get it on next wake. Rows already written keep NULL, which
         // honestly means "no invocation id was carried" — nothing can decide one afterwards.
         this.ensureColumn(db, '_substrat_outbox', 'invocation_id', 'invocation_id TEXT');
+        // #1288: not an ensureColumn, because `kind` joins the schedule-state PRIMARY KEY
+        // and no ALTER can widen a key. Rebuilt instead, from the kernel's statements.
+        this.ensureScheduleStateKind(db);
         // #1237: `readInvocation`'s lookup — WHERE invocation_id = ? ORDER BY id — over an outbox
         // that is never pruned. No index leads with invocation_id, so without this one SQLite
         // walks the PRIMARY KEY from the oldest event until it reaches the call, and reading a
@@ -6563,7 +7408,10 @@ export class SqliteScopeHost {
         const existing = this.scopes.get(key);
         if (existing)
             return existing;
-        const db = new Database(join(this.dir, `${tenantId}__${scopeId}.sqlite`));
+        const file = join(this.dir, `${tenantId}__${scopeId}.sqlite`);
+        const db = new Database(file);
+        // WAL is also what the read connection rests on (#1624): a reader sees the last
+        // committed snapshot and never blocks, or is blocked by, the writer.
         db.pragma('journal_mode = WAL');
         db.exec(KERNEL_DDL);
         this.ensureSpineColumns(db);
@@ -6580,7 +7428,9 @@ export class SqliteScopeHost {
         const created = {
             tenantId,
             scopeId,
+            file,
             db,
+            reader: null,
             actor: new ScopeActor(),
             appliedMigrations,
             mintEventId,
@@ -6611,6 +7461,20 @@ function cellToJson(v) {
  * `_substrat_*`" a mechanism rather than a lint rule (#954) — the kernel's own
  * spine writes use `rt.db` directly and never pass through here.
  */
+/**
+ * The kernel's OWN spine access (#1672) — the same seam as `scopedSql` without `guardSpine`,
+ * because these are the kernel's writes to `_substrat_capabilities`, which module code may
+ * never make. Never handed to module code.
+ */
+function spineSql(db) {
+    return {
+        query: (sql, params = []) => db.prepare(sql).all(...params),
+        exec: (sql, params = []) => {
+            const info = db.prepare(sql).run(...params);
+            return { changes: info.changes };
+        },
+    };
+}
 function scopedSql(db) {
     return guardSpine({
         query: (sql, params = []) => db.prepare(sql).all(...params),