@substrat-run/adapter-sqlite 0.116.0 → 0.117.0

package/dist/index.js

@@ -1,10 +1,25 @@
 import { existsSync, mkdirSync, readdirSync, readFileSync, rmSync, writeFileSync } from 'node:fs';
 import { dirname, join } from 'node:path';
 import Database from 'better-sqlite3';
-import { accessLogEntry, adminLogEntry, opsFailureEntry, opsFailureFingerprint, issueEntry, FRESHNESS_HEARTBEAT_MINUTES, sweepRunEntry, modelUsageEntry, ATTACHMENT_ADDED, ATTACHMENT_REMOVED, attachmentRecord, createTenantInput, domainEvent, domainEventInput, entitlementGrant, entitlementGrantInput, eventId, meterReading, platformRequestInput, platformRequestId, platformRequest, MAX_PENDING_PLATFORM_REQUESTS, identityLink, identityPool, instant, connection, capabilityGrant, connectionGrant, connectionGrantRecord, connectionSecret, systemGrant, subjectRef, requestFingerprint, createConnectionInput, projectedConnectionGrant, projectedConnectionKey, moduleManifest, createOrgInput, promotionAcknowledgement, bindHostnameInput, channelHistoryEntry, hostnameBinding, publishVersionInput, AUTO_ADMISSION_NOTE, routeTarget, registerVerticalInput, vertical as verticalSchema, verticalChannel, verticalVersion, objectRef, grantRefFromProof, org as orgSchema, orgMembership, principalId, resolvedIdentity, identityMembership, roleDefinition, scope as scopeSchema, tenant as tenantSchema, tenantRole, subjectShredReceipt, SCOPE_TABLE_PAGE_DEFAULT, SCOPE_TABLE_PAGE_MAX, SCOPE_QUERY_ROW_MAX, verticalServingState, outboundOfManifestJson, listLimitOf, substratError, assertReplayableDump, delegatedReadRecord, redrainEventsInput, REDRAIN_BATCH, } from '@substrat-run/contracts';
-import { asPrincipal, assertAllowed, assertReadOnlyQuery, attachmentBlobKey, entitlementDenial, foldMeterReading, guardSpine, parseValidationRecords, resolveScopeRecord, ulid, ISSUE_RETENTION_DAYS, OPS_FAILURE_RETENTION_DAYS, SWEEP_RUN_RETENTION_DAYS, MODEL_USAGE_RETENTION_DAYS, foldModelUsage, backoffAt, platformRequestHistoryQuery, PLATFORM_REQUEST_COLUMNS, denialListQuery, denialSummaryQuery, denialTotalsQuery, DENIAL_WINDOW_QUERY, mapDenialRow, mapDenialSummaryBuckets, IMPERSONATION_COLUMNS, IMPERSONATION_DDL, ImpersonationRefused, assertImpersonationWrites, assertModuleEnqueueableKind, assertSessionUsable, impersonationByIdQuery, impersonationListQuery, impersonationRowValues, impersonationStampOf, mapImpersonationRow, newImpersonationSession, resolveRetryPolicy, isSecretBoxConfigured, unconfiguredSecretBox, createSubjectKeys, generateSealingKeyPair, noSealingKeyMessage, openSealed, sealTo, ConnectionSealingKeyUnavailableError, PermissionDenied, createAtomic, NotSearchable, NotListable, listIndexMigrations, listIndexPlans, listQuery, cursorOf, isSearchIndexTable, searchIndexDdl, searchIndexMigrations, searchIndexPlans, searchLimit, searchMatchExpression, searchQuery, entityVersionQuery, entityVersionOf, assertIfMatch, OUTBOX_ENTITY_INDEX, SCHEDULE_STATE_DDL, SCHEDULE_STATE_REBUILD, scheduleStateHasKind, JOB_RUN_DDL, jobRunListLimit, jobRunOf, runDueJobRuns, startJobRun, IDEMPOTENCY_DDL, assertIdempotencyKey, idempotencyLookupQuery, idempotencyPruneStatement, idempotencyRecordStatement, idempotencyOptedOutMessage, replayFor, globalFetch, createUlid, facetEvents, readHistory, walkEventCause, walkEventEffects, assertRedrainWindow, readInvocation, readDeadLetters, } from '@substrat-run/kernel';
+import { accessLogEntry, adminLogEntry, opsFailureEntry, opsFailureFingerprint, issueEntry, FRESHNESS_HEARTBEAT_MINUTES, sweepRunEntry, modelUsageEntry, ATTACHMENT_ADDED, ATTACHMENT_REMOVED, attachmentRecord, createTenantInput, domainEvent, domainEventInput, entitlementGrant, entitlementGrantInput, eventId, meterReading, platformRequestInput, platformRequestId, MAX_PENDING_PLATFORM_REQUESTS, identityLink, identityPool, instant, connection, capabilityGrant, connectionGrant, connectionGrantRecord, connectionSecret, systemGrant, systemSwitch, subjectRef, requestFingerprint, createConnectionInput, projectedConnectionGrant, projectedConnectionKey, moduleManifest, createOrgInput, promotionAcknowledgement, bindHostnameInput, channelHistoryEntry, hostnameBinding, publishVersionInput, AUTO_ADMISSION_NOTE, routeTarget, registerVerticalInput, vertical as verticalSchema, verticalChannel, verticalVersion, objectRef, grantRefFromProof, org as orgSchema, orgMembership, principalId, resolvedIdentity, identityMembership, roleDefinition, scope as scopeSchema, tenant as tenantSchema, tenantRole, subjectShredReceipt, SCOPE_TABLE_PAGE_DEFAULT, SCOPE_TABLE_PAGE_MAX, SCOPE_QUERY_ROW_MAX, verticalServingState, outboundOfManifestJson, listLimitOf, substratError, assertReplayableDump, delegatedReadRecord, redrainEventsInput, REDRAIN_BATCH, } from '@substrat-run/contracts';
+import { actorOf, asPrincipal, assertAllowed, assertNoSecret, assertPermissionKey, CAPABILITY_DDL, CAPABILITY_EXCHANGE_OPERATION, capabilityTokenHash, createCapabilityVerbs, exchangeCapability as exchangeCapabilitySecret, guardSecrets, mintBecomeCapability, plausibleSessionToken, redactSecrets, resolveCapabilitySession, revokeCapabilityAsPlatform, assertReadOnlyQuery, attachmentBlobKey, entitlementDenial, foldMeterReading, guardSpine, parseValidationRecords, resolveScopeRecord, ulid, ISSUE_RETENTION_DAYS, OPS_FAILURE_RETENTION_DAYS, SWEEP_RUN_RETENTION_DAYS, SWEEP_RUNS_INTENT_INDEX, sweepRunsIntentHasKind, MODEL_USAGE_RETENTION_DAYS, foldModelUsage, backoffAt, platformRequestHistoryQuery, platformRequestOf, PLATFORM_REQUEST_COLUMNS, PLATFORM_REQUEST_REDACTION_SQL, platformRequestRedactionParams, platformRequestRedactionQuery, intentPayloadCarriesSubject, seatScopeTuple, switchSystemSchedules, systemScheduleState, systemSwitchedOff, systemSwitchedOffMessage, denialListQuery, denialSummaryQuery, denialTotalsQuery, DENIAL_WINDOW_QUERY, mapDenialRow, mapDenialSummaryBuckets, IMPERSONATION_COLUMNS, IMPERSONATION_DDL, ImpersonationRefused, assertImpersonationWrites, assertModuleEnqueueableKind, assertSessionUsable, impersonationByIdQuery, impersonationListQuery, impersonationRowValues, impersonationStampOf, mapImpersonationRow, newImpersonationSession, resolveRetryPolicy, isSecretBoxConfigured, unconfiguredSecretBox, createSubjectKeys, generateSealingKeyPair, noSealingKeyMessage, openSealed, sealTo, ConnectionSealingKeyUnavailableError, PermissionDenied, createAtomic, NotSearchable, NotListable, listIndexMigrations, listIndexPlans, listQuery, cursorOf, isSearchIndexTable, searchIndexDdl, searchIndexMigrations, searchIndexPlans, searchLimit, searchMatchExpression, searchQuery, entityVersionQuery, entityVersionOf, assertIfMatch, OUTBOX_ENTITY_INDEX, SCHEDULE_STATE_DDL, SCHEDULE_STATE_REBUILD, scheduleStateHasKind, JOB_RUN_DDL, jobRunListLimit, jobRunOf, runDueJobRuns, startJobRun, IDEMPOTENCY_DDL, assertIdempotencyKey, idempotencyLookupQuery, idempotencyPruneStatement, idempotencyRecordStatement, idempotencyOptedOutMessage, replayFor, globalFetch, createUlid, facetEvents, readHistory, walkEventCause, walkEventEffects, assertRedrainWindow, readInvocation, readDeadLetters, domainEventOf, readUndrainedOutbox, undrainedEventsOf, } from '@substrat-run/kernel';
 import { ScopeActor } from './actor.js';
 import { createTupleChecker } from './checker.js';
+/** The kernel's schedule-switch SQL (#1666), over one scope's database handle. */
+const switchSqlOf = (db) => ({
+    all: (sql, ...params) => db.prepare(sql).all(...params),
+    run: (sql, ...params) => {
+        db.prepare(sql).run(...params);
+    },
+});
+/**
+ * How many scopes may hold a read connection at once (#1624). Every open scope keeps its
+ * write connection for the life of the host, so an uncapped reader per scope would double
+ * the file handles a node deployment holds — and the lake drain alone reads every scope.
+ * Past the cap the least recently read scope's reader is closed, and reopened on its next
+ * read, which costs well under a millisecond.
+ */
+const READER_CAP = 32;
 /**
  * The scope spine, as this adapter builds it — one of two hand-written copies (#969).
  *
@@ -130,6 +145,10 @@ const KERNEL_DDL = `
     drained_at TEXT
   );
   ${IDEMPOTENCY_DDL}
+  -- #1672: capabilities — authority carried by a secret (a link share), and the sessions
+  -- an exchange trades that secret for. Spine (kernel-written), shared with the DO adapter
+  -- from @substrat-run/kernel so the two cannot part company; the column comments are there.
+  ${CAPABILITY_DDL}
   -- #383 / #1232 / #1288: the platform sweep's per-scope gating state, holding two
   -- families of row that the kind COLUMN — not the spelling of a key — tells apart.
   -- Spine (kernel-written), never a module migration. Shared with the DO adapter from
@@ -330,23 +349,12 @@ function modelUsageEntryOf(r) {
         elapsedMs: r.elapsed_ms,
     });
 }
-/** Map a stored platform-request row to the `PlatformRequest` contract shape (JSON columns parsed). */
-function rowToPlatformRequest(r) {
-    return platformRequest.parse({
-        id: r.id,
-        kind: r.kind,
-        payload: JSON.parse(r.payload),
-        requestedBy: JSON.parse(r.requested_by),
-        impersonation: r.impersonation == null ? null : JSON.parse(r.impersonation),
-        status: r.status,
-        attempts: r.attempts,
-        lastError: r.last_error,
-        failure: r.last_failure == null ? null : JSON.parse(r.last_failure),
-        result: r.result === null ? null : JSON.parse(r.result),
-        requestedAt: r.requested_at,
-        settledAt: r.settled_at,
-    });
-}
+/**
+ * The policy an undecodable event's executor delivery is journaled under (#1636): one
+ * attempt, so the first failure is the dead letter. A decode is pure — retrying it cannot
+ * succeed — and the Cloudflare coordinator records the same row with no next attempt.
+ */
+const UNDECODABLE_RETRY = { maxAttempts: 1, baseDelayMs: 0, maxDelayMs: 0 };
 /**
  * The dispatch capability (#726 remedy B): a connector delivery may read the attachments
  * of the entity the DELIVERED EVENT names, and nothing else.
@@ -417,6 +425,8 @@ export class SqliteScopeHost {
     directory;
     scopes = new Map();
     scopesById = new Map();
+    /** The runtimes holding an open `reader` (#1624), least recently read first — `READER_CAP`'s LRU. */
+    readers = new Map();
     /** Per-tenant relational stores (#301), opened lazily and cached by `ref` (the bare
      *  `.sqlite` filename). The pure-adapter analogue of a per-tenant D1 — one file per
      *  (tenant, vertical, binding), physically separate from the scope DBs. */
@@ -1048,7 +1058,9 @@ export class SqliteScopeHost {
         at TEXT NOT NULL
       );
       CREATE INDEX IF NOT EXISTS _substrat_sweep_runs_unit ON _substrat_sweep_runs (kind, unit, id);
-      CREATE UNIQUE INDEX IF NOT EXISTS _substrat_sweep_runs_intent ON _substrat_sweep_runs (request_id, unit);
+      -- (request_id, kind, unit) since #1572; a directory holding the older
+      -- (request_id, unit) is rebuilt by ensureSweepRunsIntentKind, not by this line.
+      ${SWEEP_RUNS_INTENT_INDEX}
       CREATE INDEX IF NOT EXISTS _substrat_sweep_runs_tenant ON _substrat_sweep_runs (tenant_id, id);
       CREATE INDEX IF NOT EXISTS _substrat_sweep_runs_at ON _substrat_sweep_runs (at);
       -- Model usage (#1054, meter 3): one line per model call a vertical made through
@@ -1436,21 +1448,29 @@ export class SqliteScopeHost {
         await this.applyPendingMigrations(rt);
         // Project each registered module's SCHEDULE grants (#383): a system principal
         // holds exactly the permissions its schedules declared, on this scope. This is
-        // what makes `ctx.check` resolve for scheduled work — the gate stays the check,
-        // and revoking the tuple (console) is how scheduling is turned off per scope.
-        // Idempotent (INSERT OR REPLACE), so a re-provision re-asserts the same grants.
-        for (const mod of this.modules.values()) {
-            const perms = new Set();
-            for (const s of mod.schedules)
-                for (const p of s.permissions)
-                    perms.add(p);
-            for (const perm of perms) {
-                rt.db
-                    .prepare(`INSERT OR REPLACE INTO _substrat_tuples (subject, relation, object, expires_at)
-             VALUES (?, ?, ?, NULL)`)
-                    .run(`system:${mod.id}`, `granted:${perm}`, `scope:${input.scopeId}`);
+        // what makes `ctx.check` resolve for scheduled work — the gate stays the check.
+        // Idempotent, so a re-provision re-asserts the same grants — SEATED (#1659), with the
+        // statement the Cloudflare adapter seats with: a missing grant is recreated, a revoked
+        // one stays revoked. Turning a scope's schedules off is `revokeFromSystem` (#1666), and
+        // its OFF marker is not a grant, so no re-provision can seat it away; `restoreToSystem`
+        // is the only way back (`grantToSystem` clears a tuple's tombstone, not the switch).
+        //
+        // One turn on the scope actor for the whole loop (#1678): a seat issued while an
+        // invoke held its transaction open joined it, and a rollback un-seated the grant
+        // after provisioning had returned. The switch check lives inside the seat statement.
+        await rt.actor.turn(() => {
+            for (const mod of this.modules.values()) {
+                const perms = new Set();
+                for (const s of mod.schedules)
+                    for (const p of s.permissions)
+                        perms.add(p);
+                for (const perm of perms) {
+                    // A module switched off (#1666) gets nothing seated — see `seatScopeTuple`.
+                    const seat = seatScopeTuple(`system:${mod.id}`, `granted:${perm}`, `scope:${input.scopeId}`, null);
+                    rt.db.prepare(seat.sql).run(...seat.params);
+                }
             }
-        }
+        });
         // Audit a real provision only; an idempotent re-provision changed nothing.
         if (!existing) {
             this.recordAdmin(actor, 'provisionScope', { tenantId: input.tenantId, scopeId: input.scopeId, vertical: record.vertical }, null, record);
@@ -1857,12 +1877,12 @@ export class SqliteScopeHost {
             forkedFrom: input.forkedFrom ?? dump.scopeId,
             forkedAt: input.forkedAt ?? dump.capturedAt,
         });
-        this.loadDump(input.tenantId, input.scopeId, dump.tables);
+        await this.loadDump(input.tenantId, input.scopeId, dump.tables);
         await this.admin.activateScope(actor, input.tenantId, input.scopeId);
         this.recordAdmin(actor, 'importScope', { tenantId: input.tenantId, scopeId: input.scopeId }, null, { sourceScopeId: dump.scopeId, tables: dump.tables.length, capturedAt: dump.capturedAt });
     }
     /** Drop-then-replay a dump into a scope's db, refreshing the migration frontier. */
-    loadDump(tenantId, scopeId, tables) {
+    async loadDump(tenantId, scopeId, tables) {
         const rt = this.runtime(tenantId, scopeId);
         const db = rt.db;
         const load = db.transaction((dumped) => {
@@ -1946,20 +1966,25 @@ export class SqliteScopeHost {
             db.prepare(`UPDATE OR REPLACE _substrat_tuples SET object = ?
           WHERE object LIKE 'scope:%' AND object <> ?`).run(`scope:${scopeId}`, `scope:${scopeId}`);
         });
-        load(tables);
-        // The frontier came in with the dump — refresh the cached applied-migration set so
-        // a later bind/migrate builds on the loaded state, not the previous one.
-        rt.appliedMigrations.clear();
-        for (const r of db.prepare('SELECT module_id, version FROM _substrat_migrations').all()) {
-            rt.appliedMigrations.add(`${r.module_id}@${r.version}`);
-        }
+        // On the scope actor (#1678): issued while an invoke held its transaction open, the
+        // load was a SAVEPOINT inside it, and that invoke's rollback undid the restore after
+        // this verb had audited it.
+        await rt.actor.turn(() => {
+            load(tables);
+            // The frontier came in with the dump — refresh the cached applied-migration set so
+            // a later bind/migrate builds on the loaded state, not the previous one.
+            rt.appliedMigrations.clear();
+            for (const r of db.prepare('SELECT module_id, version FROM _substrat_migrations').all()) {
+                rt.appliedMigrations.add(`${r.module_id}@${r.version}`);
+            }
+        });
     }
     async restoreScope(actor, tenantId, scopeId, dump) {
         // Restore never creates a scope (that is importScope) — an unknown target fails closed.
         const existing = await this.admin.getScopeRecord(actor, tenantId, scopeId);
         if (!existing)
             throw new Error(`unknown scope ${scopeId} in tenant ${tenantId}`);
-        this.loadDump(tenantId, scopeId, dump.tables);
+        await this.loadDump(tenantId, scopeId, dump.tables);
         this.recordAdmin(actor, 'restoreScope', { tenantId, scopeId }, null, { sourceScopeId: dump.scopeId, tables: dump.tables.length, capturedAt: dump.capturedAt });
     }
     async snapshotScope(actor, tenantId, scopeId, opts) {
@@ -1996,13 +2021,9 @@ export class SqliteScopeHost {
                 `archive a primary scope instead`);
         }
         // Close and evict the runtime handle before touching the file.
-        const key = `${tenantId}/${scopeId}`;
-        const rt = this.scopes.get(key);
-        if (rt) {
-            rt.db.close();
-            this.scopes.delete(key);
-            this.scopesById.delete(scopeId);
-        }
+        const rt = this.scopes.get(`${tenantId}/${scopeId}`);
+        if (rt)
+            this.closeRuntime(rt);
         // Order is the retry story: hostnames first (a reaped preview URL must stop
         // resolving), then the STORAGE, then the directory row — so a crash mid-way leaves
         // a visible row over empty storage (re-running deleteSnapshot converges), never
@@ -2180,6 +2201,82 @@ export class SqliteScopeHost {
         await this.applyPendingMigrations(rt);
         return this.buildStub(tenantId, scopeId, rt, { kind: 'system', id: moduleId });
     }
+    /**
+     * The lifecycle gate the capability doors share (#1672): the scope must exist in this
+     * tenant, the tenant must be active, the scope must be active — K-3's fail-closed pair
+     * check, worded as the principal door words it, so a scope in another tenant reads the
+     * same as one that does not exist. Migrations are applied as on every door.
+     */
+    async openActiveScope(tenantId, scopeId) {
+        const scope = this.directory
+            .prepare('SELECT tenant_id, status FROM scopes WHERE scope_id = ?')
+            .get(scopeId);
+        if (!scope || scope.tenant_id !== tenantId) {
+            throw new Error(`unknown scope for tenant: (${tenantId}, ${scopeId})`);
+        }
+        const tenant = this.directory
+            .prepare('SELECT status FROM tenants WHERE tenant_id = ?')
+            .get(tenantId);
+        if (!tenant || tenant.status !== 'active') {
+            throw new Error(`tenant not active (status: ${tenant?.status ?? 'missing'}): ${tenantId}`);
+        }
+        if (scope.status !== 'active') {
+            throw new Error(`scope not active (status: ${scope.status}): ${scopeId}`);
+        }
+        const rt = this.runtime(tenantId, scopeId);
+        await this.applyPendingMigrations(rt);
+        return rt;
+    }
+    /**
+     * The exchange (#1672) — a secret traded for a session, or for the principal a `become`
+     * capability yields. One serialized scope task and one transaction, so the use it takes
+     * and the `capability.exercised` event recording it commit together or not at all; the
+     * event's consumers then dispatch as an invoke's would.
+     */
+    async exchangeCapability(tenantId, scopeId, secret, options) {
+        const rt = await this.openActiveScope(tenantId, scopeId);
+        return rt.actor.enqueue(async () => {
+            // ONE instant for the whole exchange: the row's `last_used_at`, the session's times and
+            // the event's `occurredAt` are one fact, and two clock reads could disagree about it.
+            const now = this.clock();
+            rt.db.exec('BEGIN IMMEDIATE');
+            let outcome;
+            try {
+                outcome = await exchangeCapabilitySecret({
+                    sql: spineSql(rt.db),
+                    now,
+                    // Stamped `{ capability }` by the ordinary emit path, under the exchange's own
+                    // pseudo-operation name — the actor is the capability, as on every event it
+                    // goes on to cause.
+                    emit: (capability, event) => this.operationContext(rt, { kind: 'capability', id: capability }, undefined, undefined, undefined, CAPABILITY_EXCHANGE_OPERATION, [], now).emit(event),
+                }, secret, options?.mode);
+                rt.db.exec('COMMIT');
+            }
+            catch (err) {
+                rt.db.exec('ROLLBACK');
+                throw err;
+            }
+            if (outcome) {
+                await this.dispatch(rt, null);
+                await this.dispatchExecutors(rt, null);
+            }
+            return outcome;
+        });
+    }
+    /**
+     * The capability door (#1672) — mirror of the connection and system doors. The token is
+     * shape-checked and hashed HERE, and only its hash travels on: `buildStub` re-resolves it
+     * to its capability on every invoke, so a revoke or an expiry refuses the very next call
+     * on a stub minted before it.
+     */
+    async getCapabilityScope(sessionToken, tenantId, scopeId, options) {
+        if (!plausibleSessionToken(sessionToken)) {
+            throw substratError('unauthenticated', 'not a capability session token');
+        }
+        const rt = await this.openActiveScope(tenantId, scopeId);
+        const hash = await capabilityTokenHash(sessionToken);
+        return this.buildStub(tenantId, scopeId, rt, { kind: 'capability-session', hash }, options);
+    }
     registeredSchedules() {
         const out = [];
         for (const mod of this.modules.values()) {
@@ -2241,45 +2338,51 @@ export class SqliteScopeHost {
         }
         if (windows.size === 0)
             return report;
-        const types = [...windows.keys()];
-        const observed = new Map();
-        for (const row of rt.db
-            .prepare(`SELECT type, MAX(occurred_at) AS at FROM _substrat_outbox
-          WHERE type IN (${types.map(() => '?').join(', ')}) GROUP BY type`)
-            .all(...types)) {
-            if (row.at !== null)
-                observed.set(row.type, row.at);
-        }
-        const nowIso = this.clock();
-        const now = Date.parse(nowIso);
-        for (const [eventType, withinHours] of windows) {
-            const observedAt = observed.get(eventType) ?? null;
-            const outcome = observedAt === null
-                ? 'skipped' // never observed — the never-run analogue, not a failure
-                : now - Date.parse(observedAt) <= withinHours * 3_600_000
-                    ? 'ok'
-                    : 'failed';
-            const stateKey = `freshness:${eventType}`;
-            // #1288: the evaluator's own row, named by kind. Before the column, a module
-            // declaring a schedule called `freshness:<this type>` shared it — and the
-            // verdict read back here was whichever of the two wrote last.
-            const state = rt.db
-                .prepare(`SELECT last_run_at, last_status FROM _substrat_schedule_state
-            WHERE kind = 'freshness' AND schedule_op = ?`)
-                .get(stateKey);
-            const changed = state?.last_status !== outcome;
-            const heartbeatDue = !state?.last_run_at ||
-                now - Date.parse(state.last_run_at) > FRESHNESS_HEARTBEAT_MINUTES * 60_000;
-            if (!changed && !heartbeatDue)
-                continue;
-            rt.db
-                .prepare(`INSERT INTO _substrat_schedule_state (kind, schedule_op, last_run_at, last_status)
-             VALUES ('freshness', ?, ?, ?)
-           ON CONFLICT(kind, schedule_op) DO UPDATE SET last_run_at = excluded.last_run_at,
-                                                        last_status = excluded.last_status`)
-                .run(stateKey, nowIso, outcome);
-            report.checks.push({ eventType, outcome, observedAt, withinHours });
-        }
+        // The WHOLE evaluation is one turn on the scope actor (#1678 review): the outbox probe,
+        // the previous verdict and the write that records the new one. Read outside the turn, the
+        // probe saw a suspended operation's UNCOMMITTED event on this shared connection, then
+        // waited here and persisted an `ok` for an event its rollback was about to remove.
+        await rt.actor.turn(() => {
+            const types = [...windows.keys()];
+            const observed = new Map();
+            for (const row of rt.db
+                .prepare(`SELECT type, MAX(occurred_at) AS at FROM _substrat_outbox
+            WHERE type IN (${types.map(() => '?').join(', ')}) GROUP BY type`)
+                .all(...types)) {
+                if (row.at !== null)
+                    observed.set(row.type, row.at);
+            }
+            const nowIso = this.clock();
+            const now = Date.parse(nowIso);
+            for (const [eventType, withinHours] of windows) {
+                const observedAt = observed.get(eventType) ?? null;
+                const outcome = observedAt === null
+                    ? 'skipped' // never observed — the never-run analogue, not a failure
+                    : now - Date.parse(observedAt) <= withinHours * 3_600_000
+                        ? 'ok'
+                        : 'failed';
+                const stateKey = `freshness:${eventType}`;
+                // #1288: the evaluator's own row, named by kind. Before the column, a module
+                // declaring a schedule called `freshness:<this type>` shared it — and the
+                // verdict read back here was whichever of the two wrote last.
+                const state = rt.db
+                    .prepare(`SELECT last_run_at, last_status FROM _substrat_schedule_state
+              WHERE kind = 'freshness' AND schedule_op = ?`)
+                    .get(stateKey);
+                const changed = state?.last_status !== outcome;
+                const heartbeatDue = !state?.last_run_at ||
+                    now - Date.parse(state.last_run_at) > FRESHNESS_HEARTBEAT_MINUTES * 60_000;
+                if (!changed && !heartbeatDue)
+                    continue;
+                rt.db
+                    .prepare(`INSERT INTO _substrat_schedule_state (kind, schedule_op, last_run_at, last_status)
+               VALUES ('freshness', ?, ?, ?)
+             ON CONFLICT(kind, schedule_op) DO UPDATE SET last_run_at = excluded.last_run_at,
+                                                          last_status = excluded.last_status`)
+                    .run(stateKey, nowIso, outcome);
+                report.checks.push({ eventType, outcome, observedAt, withinHours });
+            }
+        });
         return report;
     }
     async runDueSchedules(moduleId, tenantId, scopeId) {
@@ -2298,18 +2401,48 @@ export class SqliteScopeHost {
             return report;
         const rt = this.runtime(tenantId, scopeId);
         await this.applyPendingMigrations(rt);
-        // The grant IS the switch (#383): a scope runs a module's schedules only while it
-        // holds a live `system:<moduleId>` grant. This is what makes a foreign-vertical
-        // scope (one this module was never provisioned on) a quiet no-op, and what makes
-        // "disable scheduling for this tenant" a plain grant revoke — no error, no run.
+        // The grant IS the switch (#383), and the kill switch is its lever (#1666): the
+        // kernel's `systemScheduleState`, the one predicate both adapters run. A scope that
+        // never held the module's grant (a foreign vertical's) is a quiet no-op, exactly as
+        // before. A scope switched OFF reports every schedule `skipped`, never `failed`, and
+        // does not touch its cadence rows — so a restore fires a due schedule on the next pass.
         const nowIso = this.clock();
-        const hasGrant = rt.db
-            .prepare(`SELECT 1 FROM _substrat_tuples
-          WHERE subject = ? AND revoked_at IS NULL AND (expires_at IS NULL OR expires_at > ?)
-          LIMIT 1`)
-            .get(`system:${moduleId}`, nowIso);
-        if (!hasGrant)
+        // The whole gate — the switch state and every cadence row — is ONE turn, on the write
+        // connection (#1624). Outside a turn it saw a suspended operation's uncommitted grant,
+        // revoke or cadence row, and fired (or skipped) on a state its rollback was about to
+        // undo. Not the read connection either: these reads decide a write (a fire, then its
+        // cadence row), and a snapshot read ahead of the write's turn is the split #1678 closed.
+        // One turn rather than one per read, because the first turn already waits out any
+        // stranger; nothing but this loop writes a `kind = 'schedule'` row, so reading them all
+        // up front answers what reading each just before its fire did.
+        //
+        // #1288: each schedule's own row. `kind` is what makes that true even when the operation
+        // is spelled `freshness:<eventType>` — without it, the cadence gate read the evaluator's
+        // last recorded verdict as a run of this operation.
+        const gate = await rt.actor.turn(() => {
+            const switched = systemScheduleState(switchSqlOf(rt.db), moduleId, nowIso);
+            const lastRuns = new Map();
+            if (switched !== 'on')
+                return { state: switched, lastRuns };
+            const read = rt.db.prepare(`SELECT last_run_at FROM _substrat_schedule_state
+          WHERE kind = 'schedule' AND schedule_op = ?`);
+            for (const schedule of mod.schedules) {
+                const row = read.get(schedule.operation);
+                lastRuns.set(schedule.operation, row?.last_run_at ?? null);
+            }
+            return { state: switched, lastRuns };
+        });
+        const state = gate.state;
+        if (state === 'ungranted')
             return report;
+        if (state === 'off') {
+            for (const schedule of mod.schedules) {
+                report.skipped += 1;
+                report.runs.push({ operation: schedule.operation, outcome: 'skipped' });
+            }
+            report.switchedOff = true;
+            return report;
+        }
         // The spine state table is KERNEL_DDL's (#1288) — kernel-owned (`_substrat_*`),
         // never a module migration, and created by `runtime()` above rather than lazily
         // here. This loop's rows are `kind = 'schedule'`, keyed by the operation
@@ -2318,14 +2451,8 @@ export class SqliteScopeHost {
         // for what the same two columns mean there.
         const now = Date.parse(nowIso);
         for (const schedule of mod.schedules) {
-            // #1288: this schedule's own row. `kind` is what makes that true even when the
-            // operation is spelled `freshness:<eventType>` — without it, the cadence gate
-            // below read the evaluator's last recorded verdict as a run of this operation.
-            const row = rt.db
-                .prepare(`SELECT last_run_at FROM _substrat_schedule_state
-            WHERE kind = 'schedule' AND schedule_op = ?`)
-                .get(schedule.operation);
-            const lastRun = row?.last_run_at ? Date.parse(row.last_run_at) : null;
+            const lastRunAt = gate.lastRuns.get(schedule.operation) ?? null;
+            const lastRun = lastRunAt ? Date.parse(lastRunAt) : null;
             const dueAt = lastRun === null ? -Infinity : lastRun + schedule.cadence.everyMinutes * 60_000;
             if (now < dueAt) {
                 report.skipped += 1;
@@ -2348,18 +2475,27 @@ export class SqliteScopeHost {
                     error: err instanceof Error ? err.message : String(err),
                 });
             }
-            rt.db
+            // On the scope actor (#1678): the cadence row joined whatever transaction an invoke
+            // held open, so its rollback forgot the run and the next pass fired it AGAIN.
+            await rt.actor.turn(() => rt.db
                 .prepare(`INSERT INTO _substrat_schedule_state (kind, schedule_op, last_run_at, last_status)
-             VALUES ('schedule', ?, ?, ?)
-           ON CONFLICT(kind, schedule_op) DO UPDATE SET last_run_at = excluded.last_run_at,
-                                                        last_status = excluded.last_status`)
-                .run(schedule.operation, new Date(now).toISOString(), status);
+               VALUES ('schedule', ?, ?, ?)
+             ON CONFLICT(kind, schedule_op) DO UPDATE SET last_run_at = excluded.last_run_at,
+                                                          last_status = excluded.last_status`)
+                .run(schedule.operation, new Date(now).toISOString(), status));
             report.runs.push({ operation: schedule.operation, outcome: status === 'ok' ? 'ok' : 'failed' });
         }
         return report;
     }
-    /** The stub body, shared by the principal, connection, system and impersonation doors. */
-    buildStub(tenantId, scopeId, rt, subject, options, 
+    /** The stub body, shared by the principal, connection, system, impersonation and capability doors. */
+    buildStub(tenantId, scopeId, rt, 
+    /**
+     * Who the stub acts as — or, for the capability door (#1672), the SESSION it holds,
+     * which every invoke re-resolves to its capability inside the scope's actor task. A
+     * capability resolved once at mint time would outlive its own revocation for exactly
+     * the one caller holding the stub.
+     */
+    authority, options, 
     /**
      * K-42: the session this stub acts under. `subject` is already the
      * IMPERSONATED principal — that is what makes the permission model answer
@@ -2441,9 +2577,22 @@ export class SqliteScopeHost {
                     // which is the leak `causedBy` had to be moved off the host to avoid.
                     rt.invocationId = invokeOptions?.invocationId ?? null;
                     try {
+                        // #1672: the capability door's session, re-resolved on EVERY invoke and inside the
+                        // actor task — so nothing can revoke between this read and the transaction below.
+                        // Refuses a stale session, a revoked or expired capability and an operation off its
+                        // allowlist before anything opens; none of those is a K-35 denial (no key checked).
+                        const subject = authority.kind === 'capability-session'
+                            ? {
+                                kind: 'capability',
+                                id: resolveCapabilitySession(spineSql(rt.db), authority.hash, this.clock(), operation),
+                            }
+                            : authority;
+                        // #1672: the secrets this invocation mints — withheld from its idempotency recording,
+                        // and what the tripwire on its writes looks for.
+                        const minted = [];
                         // Fresh per operation: the context carries the K-34 authorization accumulator,
                         // which must not leak across operations (invokes are serialized per scope).
-                        const ctx = this.operationContext(rt, subject, undefined, signals, session, operation);
+                        const ctx = this.operationContext(rt, subject, undefined, signals, session, operation, minted);
                         const clonedInput = structuredClone(input);
                         // #893: parse, don't trust — at the scope door, from the operation's own
                         // declaration. BEFORE `BEGIN`, so a malformed call never opens a
@@ -2529,7 +2678,9 @@ export class SqliteScopeHost {
                             // that adds a row.
                             if (idempotencyKey !== undefined && fingerprint !== undefined) {
                                 const at = this.clock();
-                                const record = idempotencyRecordStatement(subject, idempotencyKey, operation, fingerprint, result, committedVersion ?? null, at);
+                                const record = idempotencyRecordStatement(subject, idempotencyKey, operation, fingerprint, 
+                                // #1672: a replay of a mint returns the placeholder, never the secret.
+                                redactSecrets(result, minted), committedVersion ?? null, at);
                                 rt.db.prepare(record.sql).run(...record.params);
                                 const prune = idempotencyPruneStatement(at);
                                 rt.db.prepare(prune.sql).run(...prune.params);
@@ -2635,10 +2786,8 @@ export class SqliteScopeHost {
         }
     }
     async close() {
-        for (const { db } of this.scopes.values())
-            db.close();
-        this.scopes.clear();
-        this.scopesById.clear();
+        for (const rt of [...this.scopes.values()])
+            this.closeRuntime(rt);
         this.directory.close();
     }
     // -------------------------------------------------------------------------
@@ -2696,8 +2845,22 @@ export class SqliteScopeHost {
            ORDER BY o.id`)
                 .all(deliveryId, executor.eventType, now);
             for (const row of rows) {
-                const event = this.parseOutboxRow(row);
                 report.attempted += 1;
+                let event;
+                try {
+                    event = domainEventOf(row);
+                }
+                catch (err) {
+                    // #1636: an event that does not decode is dead-lettered for this executor at
+                    // once, and the handler never sees it. The decode sat above this loop's `try`,
+                    // so one bad row threw the executor's whole pending list on every pass. Terminal
+                    // on the FIRST failure, unlike a handler's: the decode is pure, of text already
+                    // in hand, so a retry cannot succeed — and only the decode is caught here, so a
+                    // handler's transient failure keeps its backoff below.
+                    this.recordExecutorDelivery(rt, row.id, deliveryId, String(err), UNDECODABLE_RETRY, invocationId);
+                    report.deadLettered += 1;
+                    continue;
+                }
                 this.causedBy = event.id;
                 try {
                     if (executor.kind === 'connector') {
@@ -2936,7 +3099,7 @@ export class SqliteScopeHost {
         // "not granted" where the checker answers allow — a read-back that disagrees with
         // enforcement is worse than none, since it is the read an operator would trust.
         const rows = [
-            ...rt.db
+            ...this.readDb(rt)
                 .prepare(`SELECT subject, relation, expires_at FROM _substrat_tuples
            WHERE subject LIKE 'connection:%' AND relation LIKE 'granted:%'
              AND revoked_at IS NULL AND (expires_at IS NULL OR expires_at > ?)`)
@@ -3016,7 +3179,7 @@ export class SqliteScopeHost {
     async executorDeadLetters(tenantId, scopeId) {
         const rt = this.runtime(tenantId, scopeId);
         await this.applyPendingMigrations(rt);
-        const rows = rt.db
+        const rows = this.readDb(rt)
             .prepare(`SELECT d.event_id, d.consumer_module, d.attempts, d.error, d.delivered_at, o.type
          FROM _substrat_deliveries d
          JOIN _substrat_outbox o ON o.id = d.event_id
@@ -3037,27 +3200,36 @@ export class SqliteScopeHost {
     async listPlatformRequests(tenantId, scopeId) {
         const rt = this.runtime(tenantId, scopeId);
         await this.applyPendingMigrations(rt);
-        const rows = rt.db
+        const rows = this.readDb(rt)
             .prepare(`SELECT ${PLATFORM_REQUEST_COLUMNS}
            FROM _substrat_platform_requests WHERE status = 'pending' ORDER BY id`)
             .all();
-        return rows.map(rowToPlatformRequest);
+        // Tolerant (#1588): one undecodable row comes back naming why, never throws for the list.
+        return rows.map(platformRequestOf);
     }
     async listPlatformRequestHistory(tenantId, scopeId, filter) {
         const rt = this.runtime(tenantId, scopeId);
         await this.applyPendingMigrations(rt);
         const q = platformRequestHistoryQuery(filter);
-        return rt.db.prepare(q.sql).all(...q.params).map(rowToPlatformRequest);
+        return this.readDb(rt).prepare(q.sql).all(...q.params).map(platformRequestOf);
     }
     async settlePlatformRequest(tenantId, scopeId, id, outcome) {
         const rt = this.runtime(tenantId, scopeId);
         await this.applyPendingMigrations(rt);
         await rt.actor.enqueue(() => {
+            // Compare-and-set on `pending` (#1600 review). The drain reads pending rows, runs a
+            // handler, then settles — and between the read and the settle a subject erasure can
+            // redact the row. Settling by `id` alone let that stale pass overwrite the redaction
+            // and write a provider's reply, which can quote the person, back into `last_error`.
+            // Nothing legitimate is refused by this: `listPlatformRequests` returns only pending
+            // rows, so every settle in the tree targets one that was pending when it was read.
+            // A settle that finds the row already terminal does nothing, deliberately silently —
+            // throwing would make the drain's blanket catch retry a row that is correctly over.
             rt.db
                 .prepare(`UPDATE _substrat_platform_requests
              SET status = ?, result = COALESCE(?, result), last_error = ?, last_failure = ?,
                  attempts = attempts + 1, settled_at = ?
-           WHERE id = ?`)
+           WHERE id = ? AND status = 'pending'`)
                 .run(outcome.status, outcome.result === undefined ? null : JSON.stringify(outcome.result), outcome.lastError ?? null, outcome.failure == null ? null : JSON.stringify(outcome.failure), outcome.status === 'pending' ? null : new Date().toISOString(), id);
         });
     }
@@ -3082,7 +3254,24 @@ export class SqliteScopeHost {
                ORDER BY o.id`)
                         .all(consumer.eventType, mod.id);
                     for (const row of rows) {
-                        const event = this.parseOutboxRow(row);
+                        let event;
+                        try {
+                            event = domainEventOf(row);
+                        }
+                        catch (err) {
+                            // #1636: dead-letter an event that does not decode, exactly as a failed
+                            // handler is — the decode sat ABOVE the `try` below, so one bad row halted
+                            // every event of this type behind it, on every pass. The consumer is never
+                            // handed it: an event built from stand-ins is not one it may act on. Only
+                            // the decode is caught; the journal write is not, so a failure to record
+                            // this still surfaces as it would for a handler's dead letter.
+                            rt.db
+                                .prepare(`INSERT INTO _substrat_deliveries
+                     (event_id, consumer_module, delivered_at, error, invocation_id)
+                   VALUES (?, ?, ?, ?, ?)`)
+                                .run(row.id, mod.id, new Date().toISOString(), String(err), invocationId);
+                            continue;
+                        }
                         const ctx = this.operationContext(rt, asPrincipal(this.systemPrincipal), {
                             system: mod.id,
                         });
@@ -3152,11 +3341,7 @@ export class SqliteScopeHost {
         // policy, carries no permission key, and is left to the module.
         if (!err.permission || !err.node)
             return;
-        const actor = subject.kind === 'system'
-            ? { system: subject.id }
-            : subject.kind === 'connection'
-                ? { connection: subject.id }
-                : subject.id;
+        const actor = actorOf(subject);
         rt.db
             .prepare(`INSERT INTO _substrat_denials
            (id, actor, permission, tenant_id, scope_id, operation, impersonation,
@@ -3166,29 +3351,6 @@ export class SqliteScopeHost {
         // #1525: the call this refusal belongs to, as the caller named it.
         invocationId, new Date().toISOString());
     }
-    parseOutboxRow(row) {
-        return domainEvent.parse({
-            id: row.id,
-            type: row.type,
-            schemaVersion: row.schema_version,
-            occurredAt: row.occurred_at,
-            tenantId: row.tenant_id,
-            scopeId: row.scope_id,
-            actor: JSON.parse(row.actor),
-            entity: { entityType: row.entity_type, entityId: row.entity_id },
-            piiClass: row.pii_class,
-            ...(row.subject_id ? { subjectId: row.subject_id } : {}),
-            ...(row.authorization ? { authorization: JSON.parse(row.authorization) } : {}),
-            // K-42: the stamp survives the read, so a consumer's event and an executor's
-            // are the same fact the stored row is. Absent rather than null when nobody
-            // was impersonating, because `DomainEvent.impersonation` is optional — the
-            // shape module code never sees is also the shape it cannot branch on.
-            ...(row.impersonation ? { impersonation: JSON.parse(row.impersonation) } : {}),
-            // #1231: absent rather than null, the same shape rule as the stamp above.
-            ...(row.operation ? { operation: row.operation } : {}),
-            payload: row.payload === null ? undefined : JSON.parse(row.payload),
-        });
-    }
     // -------------------------------------------------------------------------
     // Admin surface (enforcement input, §9.2.5)
     // -------------------------------------------------------------------------
@@ -3615,6 +3777,9 @@ export class SqliteScopeHost {
              (tenant_id, subject, relation, object, expires_at)
            VALUES (?, ?, ?, ?, ?)`)
             .run(tenantId, subject, relation, object, expiresAt ?? null);
+        // The EXPLICIT grant: `INSERT OR REPLACE` clears a tombstone, because a re-grant must
+        // grant. Provisioning seats with `seatScopeTuple` instead, which never un-revokes
+        // (#1659) — keep the two apart.
         const writeScopeTuple = (node, subject, relation, object, expiresAt) => {
             if (!node.scopeId)
                 throw new Error('scope tuple requires node.scopeId');
@@ -3635,6 +3800,82 @@ export class SqliteScopeHost {
                 writeTenantTuple(node.tenantId, subject, `granted:${permission}`, `tenant:${node.tenantId}`, expiresAt);
             }
         };
+        /**
+         * A node's write, on the scope actor when the node is a scope (#1678). `invoke` holds a
+         * raw `BEGIN IMMEDIATE` on the scope's connection across awaits, so a bare statement
+         * issued mid-invoke joined that transaction and rolled back with it — after the verb
+         * had answered success and audited. `body` holds the check AND the write, synchronously,
+         * so nothing moves between them. Tenant-level: a directory write, which no scope's
+         * transaction can hold, so it runs as it always did.
+         */
+        const onNode = (node, body) => node.scopeId
+            ? this.runtime(node.tenantId, node.scopeId).actor.turn(body)
+            : Promise.resolve().then(body);
+        /** #1666: move one module's schedule switch on one scope — see `HostAdmin.revokeFromSystem`. */
+        const switchSystem = async (actor, raw, to) => {
+            const input = systemSwitch.parse(raw);
+            const { tenantId, scopeId } = input.node;
+            const scope = this.directory
+                .prepare('SELECT tenant_id FROM scopes WHERE scope_id = ?')
+                .get(scopeId);
+            if (!scope || scope.tenant_id !== tenantId) {
+                throw substratError('not_found', `unknown scope for tenant: (${tenantId}, ${scopeId})`);
+            }
+            // AUDIT FIRST (#1666 review), exactly as the Cloudflare adapter: the intent row before
+            // anything moves, the outcome row after, on every attempt. The directory and the
+            // scope's file are separate databases, so a crash between them leaves an intent with
+            // no recorded outcome — never a moved switch with no audit row.
+            const operationId = ulid();
+            const action = to === 'off' ? 'revokeFromSystem' : 'restoreToSystem';
+            const target = { tenantId, scopeId };
+            const base = { operationId, moduleId: input.moduleId, schedules: to };
+            this.recordAdmin(actor, action, target, null, { ...base, phase: 'intent', reason: input.reason });
+            let outcome;
+            try {
+                // A turn on the scope actor (#1666 review), exactly as the job store (#1577): `invoke`
+                // holds a raw `BEGIN IMMEDIATE` on this same connection across awaits, so a bare
+                // `db.transaction` issued mid-invoke became a SAVEPOINT inside it and rolled back
+                // with it — after this verb had already audited `applied`. `turn` is re-entrant, so a
+                // caller already inside one of this scope's tasks joins it rather than deadlocking.
+                const rt = this.runtime(tenantId, scopeId);
+                outcome = await rt.actor.turn(() => rt.db.transaction(() => switchSystemSchedules(switchSqlOf(rt.db), {
+                    moduleId: input.moduleId,
+                    scopeId,
+                    to,
+                    at: new Date().toISOString(),
+                }))());
+            }
+            catch (err) {
+                try {
+                    this.recordAdmin(actor, action, target, null, {
+                        ...base,
+                        phase: 'failed',
+                        error: err instanceof Error ? err.message : String(err),
+                    });
+                }
+                catch {
+                    // Best effort: the original error is what the caller must see.
+                }
+                throw err;
+            }
+            this.recordAdmin(actor, action, target, null, {
+                ...base,
+                phase: outcome.held ? 'applied' : 'refused',
+                changed: outcome.changed,
+                permissions: outcome.permissions,
+            });
+            if (!outcome.held) {
+                throw substratError('not_found', `scope ${scopeId} holds no system grant for module '${input.moduleId}' — nothing to switch ${to} ` +
+                    `(check the module id: it is the module's manifest id, e.g. '@substrat-run/engine-absence')`);
+            }
+            return {
+                operationId,
+                moduleId: input.moduleId,
+                schedules: to,
+                changed: outcome.changed,
+                permissions: outcome.permissions,
+            };
+        };
         return {
             // #603: fixed at construction — a host built without a box can never store a
             // credential, and saying so is what lets a transport answer 503 instead of 500.
@@ -3693,7 +3934,8 @@ export class SqliteScopeHost {
             assignRole: async (actor, assignment) => {
                 const subject = `principal:${assignment.principalId}`;
                 if (assignment.node.scopeId) {
-                    writeScopeTuple(assignment.node, subject, `role:${assignment.roleKey}`, `scope:${assignment.node.scopeId}`);
+                    const scopeNode = assignment.node.scopeId;
+                    await onNode(assignment.node, () => writeScopeTuple(assignment.node, subject, `role:${assignment.roleKey}`, `scope:${scopeNode}`));
                 }
                 else {
                     writeTenantTuple(assignment.node.tenantId, subject, `role:${assignment.roleKey}`, `tenant:${assignment.node.tenantId}`);
@@ -3709,11 +3951,14 @@ export class SqliteScopeHost {
                 const now = new Date().toISOString();
                 let changes;
                 if (assignment.node.scopeId) {
-                    const rt = this.runtime(assignment.node.tenantId, assignment.node.scopeId);
-                    changes = rt.db
+                    // On the scope actor (#1678): a revoke that joined a stranger's transaction and
+                    // rolled back with it left the role LIVE after the caller was told it was gone.
+                    const scopeNode = assignment.node.scopeId;
+                    const rt = this.runtime(assignment.node.tenantId, scopeNode);
+                    changes = await rt.actor.turn(() => rt.db
                         .prepare(`UPDATE _substrat_tuples SET revoked_at = ?
-               WHERE subject = ? AND relation = ? AND object = ? AND revoked_at IS NULL`)
-                        .run(now, subject, relation, `scope:${assignment.node.scopeId}`).changes;
+                   WHERE subject = ? AND relation = ? AND object = ? AND revoked_at IS NULL`)
+                        .run(now, subject, relation, `scope:${scopeNode}`).changes);
                 }
                 else {
                     changes = this.directory
@@ -3730,44 +3975,56 @@ export class SqliteScopeHost {
                 // trust: the parse is where an `expiresAt` carrying a UTC offset is normalised
                 // to Z text (#963), and liveness here is a lexicographic `expires_at > ?`.
                 const grant = capabilityGrant.parse(raw);
-                writeGrant(`principal:${grant.principalId}`, grant.permission, grant.node, grant.entity, grant.expiresAt);
+                await onNode(grant.node, () => writeGrant(`principal:${grant.principalId}`, grant.permission, grant.node, grant.entity, grant.expiresAt));
                 this.recordAdmin(actor, 'grant', { tenantId: grant.node.tenantId, scopeId: grant.node.scopeId }, null, grant);
             },
             grantToConnection: async (actor, raw) => {
                 const grant = connectionGrant.parse(raw);
-                const conn = this.connectionRow(grant.connectionId);
-                if (conn.revoked_at) {
-                    throw new Error(`connection ${grant.connectionId} is revoked — grant nothing to it`);
-                }
-                // The grant may not reach outside what the connection already is. A
-                // connection is keyed (tenant, vertical, provider); letting it hold a
-                // permission in another tenant would make the key decorative.
-                if (conn.tenant_id !== grant.node.tenantId) {
-                    throw new Error(`connection ${grant.connectionId} belongs to tenant ${conn.tenant_id} and cannot ` +
-                        `be granted anything in ${grant.node.tenantId}`);
-                }
-                if (grant.node.scopeId) {
-                    const scope = this.directory
-                        .prepare('SELECT tenant_id, vertical FROM scopes WHERE scope_id = ?')
-                        .get(grant.node.scopeId);
-                    if (!scope || scope.tenant_id !== grant.node.tenantId) {
-                        throw new Error(`unknown scope ${grant.node.scopeId} in tenant ${grant.node.tenantId}`);
+                const check = () => {
+                    const conn = this.connectionRow(grant.connectionId);
+                    if (conn.revoked_at) {
+                        throw new Error(`connection ${grant.connectionId} is revoked — grant nothing to it`);
                     }
-                    if (scope.vertical !== conn.vertical) {
-                        throw new Error(`connection ${grant.connectionId} is for vertical '${conn.vertical}' and scope ` +
-                            `${grant.node.scopeId} runs '${scope.vertical ?? 'none'}'`);
+                    // The grant may not reach outside what the connection already is. A
+                    // connection is keyed (tenant, vertical, provider); letting it hold a
+                    // permission in another tenant would make the key decorative.
+                    if (conn.tenant_id !== grant.node.tenantId) {
+                        throw new Error(`connection ${grant.connectionId} belongs to tenant ${conn.tenant_id} and cannot ` +
+                            `be granted anything in ${grant.node.tenantId}`);
                     }
-                }
-                writeGrant(subjectRef({ kind: 'connection', id: grant.connectionId }), grant.permission, grant.node, undefined, grant.expiresAt);
-                // #592: the directory-side record, alongside the tuple. The tuple is checked
-                // where it lives; this row is what provision/reconcile gather FROM, so the
-                // grant reaches scopes provisioned after it without a human replaying it.
-                this.directory
-                    .prepare(`INSERT OR REPLACE INTO _substrat_connection_grants
-               (connection_id, tenant_id, vertical, permission, scope_id, expires_at,
-                granted_by, granted_at, revoked_at)
-             VALUES (?, ?, ?, ?, ?, ?, ?, ?, NULL)`)
-                    .run(grant.connectionId, grant.node.tenantId, conn.vertical, grant.permission, grant.node.scopeId ?? null, grant.expiresAt ?? null, grant.grantedBy, new Date().toISOString());
+                    if (grant.node.scopeId) {
+                        const scope = this.directory
+                            .prepare('SELECT tenant_id, vertical FROM scopes WHERE scope_id = ?')
+                            .get(grant.node.scopeId);
+                        if (!scope || scope.tenant_id !== grant.node.tenantId) {
+                            throw new Error(`unknown scope ${grant.node.scopeId} in tenant ${grant.node.tenantId}`);
+                        }
+                        if (scope.vertical !== conn.vertical) {
+                            throw new Error(`connection ${grant.connectionId} is for vertical '${conn.vertical}' and scope ` +
+                                `${grant.node.scopeId} runs '${scope.vertical ?? 'none'}'`);
+                        }
+                    }
+                    return conn;
+                };
+                // Once BEFORE the turn, so a refused grant never opens (and so creates) the scope's
+                // file; then again inside it, with the tuple and the directory row, in ONE body on
+                // the scope actor (#1678) — so the tuple cannot roll back with a stranger's
+                // transaction and leave the directory row (#592) claiming a grant the scope lacks.
+                check();
+                const conn = await onNode(grant.node, () => {
+                    const row = check();
+                    writeGrant(subjectRef({ kind: 'connection', id: grant.connectionId }), grant.permission, grant.node, undefined, grant.expiresAt);
+                    // #592: the directory-side record, alongside the tuple. The tuple is checked
+                    // where it lives; this row is what provision/reconcile gather FROM, so the
+                    // grant reaches scopes provisioned after it without a human replaying it.
+                    this.directory
+                        .prepare(`INSERT OR REPLACE INTO _substrat_connection_grants
+                 (connection_id, tenant_id, vertical, permission, scope_id, expires_at,
+                  granted_by, granted_at, revoked_at)
+               VALUES (?, ?, ?, ?, ?, ?, ?, ?, NULL)`)
+                        .run(grant.connectionId, grant.node.tenantId, row.vertical, grant.permission, grant.node.scopeId ?? null, grant.expiresAt ?? null, grant.grantedBy, new Date().toISOString());
+                    return row;
+                });
                 this.recordAdmin(actor, 'grantToConnection', { tenantId: grant.node.tenantId, scopeId: grant.node.scopeId, vertical: conn.vertical }, null, {
                     connectionId: grant.connectionId,
                     provider: conn.provider,
@@ -3783,15 +4040,79 @@ export class SqliteScopeHost {
                 // principal is bound to the module, and a scope only ever runs the modules
                 // its own host registered.
                 const grant = systemGrant.parse(raw);
-                writeGrant(subjectRef({ kind: 'system', id: grant.moduleId }), grant.permission, grant.node, undefined, grant.expiresAt);
+                const write = () => writeGrant(subjectRef({ kind: 'system', id: grant.moduleId }), grant.permission, grant.node, undefined, grant.expiresAt);
+                const scope = grant.node.scopeId;
+                if (scope) {
+                    // #1666: refused while the module is switched off on this scope. The check and the
+                    // write share one synchronous body inside one turn on the scope actor, so no switch
+                    // can move between them — and (#1666 review) neither can land inside an unrelated
+                    // `invoke`'s open transaction and roll back with it after this verb returned. The
+                    // turn is re-entrant: from inside one of this scope's tasks it joins that task.
+                    // Restore is the lever; a grant is not.
+                    const rt = this.runtime(grant.node.tenantId, scope);
+                    await rt.actor.turn(() => {
+                        if (systemSwitchedOff(switchSqlOf(rt.db), grant.moduleId)) {
+                            throw substratError('conflict', systemSwitchedOffMessage(grant.moduleId, scope));
+                        }
+                        write();
+                    });
+                }
+                else {
+                    // Tenant-level: a directory write, which no scope's transaction can hold.
+                    write();
+                }
                 this.recordAdmin(actor, 'grantToSystem', { tenantId: grant.node.tenantId, scopeId: grant.node.scopeId }, null, { moduleId: grant.moduleId, permission: grant.permission, node: grant.node });
             },
+            // #1666: the schedule kill switch and its lever back — `system-switch.ts` is the
+            // whole rule, shared with the Cloudflare adapter; this is the directory check, the
+            // transaction and the audit row around it.
+            revokeFromSystem: async (actor, raw) => switchSystem(actor, raw, 'off'),
+            restoreToSystem: async (actor, raw) => switchSystem(actor, raw, 'on'),
+            // #1672 — the platform's two capability verbs, both a turn on the scope actor
+            // (#1678: every scope-level admin write takes one, so none lands mid-invoke inside a
+            // stranger's transaction) and both in the admin log without the secret or its hash.
+            mintCapability: async (actor, tenantId, scopeId, input) => {
+                const rt = await this.openActiveScope(tenantId, scopeId);
+                const minted = await rt.actor.turn(() => mintBecomeCapability(spineSql(rt.db), input, actor, this.clock()));
+                this.recordAdmin(actor, 'mintCapability', { tenantId, scopeId }, null, {
+                    capabilityId: minted.id,
+                    mode: 'become',
+                    principal: input.principal,
+                    expiresAt: input.expiresAt,
+                    maxUses: input.maxUses,
+                    label: input.label ?? null,
+                });
+                return minted;
+            },
+            revokeCapability: async (actor, tenantId, scopeId, capabilityId) => {
+                const scope = this.directory
+                    .prepare('SELECT tenant_id FROM scopes WHERE scope_id = ?')
+                    .get(scopeId);
+                if (!scope || scope.tenant_id !== tenantId) {
+                    throw substratError('not_found', `unknown scope for tenant: (${tenantId}, ${scopeId})`);
+                }
+                const rt = this.runtime(tenantId, scopeId);
+                await this.applyPendingMigrations(rt);
+                const before = await rt.actor.turn(() => rt.db.transaction(() => revokeCapabilityAsPlatform(spineSql(rt.db), capabilityId, actor, this.clock()))());
+                if (!before) {
+                    throw substratError('not_found', `no capability ${capabilityId} in scope ${scopeId}`);
+                }
+                this.recordAdmin(actor, 'revokeCapability', { tenantId, scopeId }, before, {
+                    capabilityId,
+                    revoked: true,
+                });
+            },
             grantToOrg: async (actor, orgId, permission, node, entity) => {
                 // The org must exist in the node's tenant. A grant to a phantom org is
                 // worse than an error: it looks applied, resolves for nobody, and shows up
                 // in the permission diff as though access were conferred.
+                // Checked once before the turn, so a refusal opens no scope file; then again with
+                // the write in one body, on the scope actor when the node is a scope (#1678).
                 requireOrg(node.tenantId, orgId);
-                writeGrant(`org:${orgId}`, permission, node, entity);
+                await onNode(node, () => {
+                    requireOrg(node.tenantId, orgId);
+                    writeGrant(`org:${orgId}`, permission, node, entity);
+                });
                 this.recordAdmin(actor, 'grantToOrg', { tenantId: node.tenantId, scopeId: node.scopeId }, null, { orgId, permission, node, entity });
             },
             // -- vertical + version registry (#31) ---------------------------------
@@ -4452,24 +4773,18 @@ export class SqliteScopeHost {
                 this.recordAdmin(actor, 'setScopeExpiresAt', { tenantId, scopeId }, { expiresAt: scope.expires_at }, { expiresAt });
             },
             readUndrainedEvents: async (actor, tenantId, scopeId, limit) => {
-                const db = this.scopeDbFor(tenantId, scopeId);
-                const rows = db
-                    .prepare(`SELECT * FROM _substrat_outbox WHERE drained_at IS NULL ORDER BY id LIMIT ?`)
-                    .all(Math.min(Math.max(limit ?? 200, 1), 1000));
-                this.recordAccess(actor, 'readUndrainedEvents', { tenantId, scopeId }, { limit }, rows.length);
-                return rows.map((r) => ({
-                    ...this.parseOutboxRow(r),
-                    operation: r.operation ?? null,
-                    version: r.version ?? null,
-                    // #1237 — lifted like the two above, and for the same reason: the column
-                    // exists on the outbox but not on the envelope `parseOutboxRow` returns,
-                    // whose `domainEvent.parse` strips anything it does not declare.
-                    causedBy: r.caused_by ?? null,
-                    // Same lift, same reason. `drainedEvent` requires this field, and the `as never`
-                    // below is what let it be missed: without it a SQLite-backed lake loses the
-                    // call grouping permanently, while a Cloudflare-backed one keeps it.
-                    invocationId: r.invocation_id ?? null,
-                }));
+                // The COMMITTED outbox (#1624). On the shared connection this read saw an in-flight
+                // operation's uncommitted event, the drain shipped it, and the rollback left the lake
+                // — which is append-only — holding an event the scope never had. The mark that
+                // follows needs no such care: it stamps only rows that exist and are undrained.
+                const db = this.scopeReadDbFor(tenantId, scopeId);
+                const page = db.prepare(`SELECT * FROM _substrat_outbox WHERE drained_at IS NULL ORDER BY id LIMIT ? OFFSET ?`);
+                // The kernel's read, shared with the DO: the envelope and the columns lifted beside
+                // it (#1242, #1237) are decoded once, and a row that will not decode is stepped over
+                // rather than stalling the scope on it (#1636).
+                const read = readUndrainedOutbox((offset, count) => page.all(count, offset), Math.min(Math.max(limit ?? 200, 1), 1000));
+                this.recordAccess(actor, 'readUndrainedEvents', { tenantId, scopeId }, { limit }, read.events.length);
+                return undrainedEventsOf(read);
             },
             markEventsDrained: async (actor, tenantId, scopeId, eventIds) => {
                 // BEFORE the empty-batch shortcut, not after. "Nothing to mark" and "you may
@@ -4490,12 +4805,16 @@ export class SqliteScopeHost {
                 // cannot absorb: the next read resumes from the middle of a batch already
                 // in the lake, and the object it writes overlaps the one already there —
                 // the duplication the first-id object key exists to prevent.
-                const drained = db.transaction(() => {
+                //
+                // On the scope actor (#1678): issued mid-invoke, this transaction was a SAVEPOINT
+                // inside the invoke's, and its rollback un-marked a batch already in the lake — so
+                // the next pass shipped it again, the same duplicate by another road.
+                const drained = await this.runtime(tenantId, scopeId).actor.turn(() => db.transaction(() => {
                     let n = 0;
                     for (const id of eventIds)
                         n += stmt.run(at, id).changes;
                     return n;
-                })();
+                })());
                 // K-24's rule, one tier down (#1334): declaring domain payloads shipped is an
                 // EGRESS, and the admin log is where "these events left the platform, at this
                 // time, on this actor's say-so" is recorded. `drainAccessLog` audits the same
@@ -4532,7 +4851,8 @@ export class SqliteScopeHost {
                 // an access row — the count itself as the result count, which is the fact an
                 // auditor asking "who counted this tenant's outbox, and how much was there" wants.
                 if (countOnly) {
-                    const redrainable = db
+                    // The committed count (#1624): a stranger's uncommitted drain mark is not a fact yet.
+                    const redrainable = this.scopeReadDbFor(tenantId, scopeId)
                         .prepare(`SELECT COUNT(*) AS c FROM _substrat_outbox
                   WHERE drained_at IS NOT NULL AND drained_at < ?`)
                         .get(drainedBefore).c;
@@ -4556,14 +4876,17 @@ export class SqliteScopeHost {
                 // is never pruned, so the unbounded form scales with the scope's whole history.
                 // SQLite is built here without UPDATE...LIMIT, so the batch is a subselect over the
                 // primary key — oldest first, so a partial run leaves a prefix rather than holes.
-                const redrained = db
+                //
+                // On the scope actor (#1678), so a stranger's rollback cannot undo a reopen this
+                // verb has already counted and receipted.
+                const redrained = await this.runtime(tenantId, scopeId).actor.turn(() => db
                     .prepare(`UPDATE _substrat_outbox SET drained_at = NULL
-              WHERE id IN (
-                SELECT id FROM _substrat_outbox
-                 WHERE drained_at IS NOT NULL AND drained_at < ?
-                 ORDER BY id LIMIT ?
-              )`)
-                    .run(drainedBefore, REDRAIN_BATCH).changes;
+                  WHERE id IN (
+                    SELECT id FROM _substrat_outbox
+                     WHERE drained_at IS NOT NULL AND drained_at < ?
+                     ORDER BY id LIMIT ?
+                  )`)
+                    .run(drainedBefore, REDRAIN_BATCH).changes);
                 // The outcome beside the intent above — only when something changed, so a re-run
                 // over an already reopened window leaves no row claiming it did something.
                 if (redrained > 0) {
@@ -4574,7 +4897,7 @@ export class SqliteScopeHost {
             facetEvents: async (actor, tenantId, scopeId, input) => {
                 // `facetEvents` is the sanctioned read: an erased payload yields the same
                 // NULL a missing field does, and only the helper counts them apart.
-                const db = this.scopeDbFor(tenantId, scopeId);
+                const db = this.scopeReadDbFor(tenantId, scopeId);
                 const result = facetEvents({ sql: scopedSql(db) }, input);
                 this.recordAccess(actor, 'facetEvents', { tenantId, scopeId }, input, result.buckets.length);
                 return result;
@@ -4584,7 +4907,7 @@ export class SqliteScopeHost {
                 // only one that decodes the envelope's nullable facts (an erased payload, an
                 // unrecorded authorization chain, nobody impersonating) as facts rather than
                 // as missing data.
-                const db = this.scopeDbFor(tenantId, scopeId);
+                const db = this.scopeReadDbFor(tenantId, scopeId);
                 const page = readHistory({ sql: scopedSql(db) }, { entityType: input.entityType, entityId: input.entityId }, { limit: input.limit, cursor: input.cursor });
                 this.recordAccess(actor, 'entityHistory', { tenantId, scopeId }, { entityType: input.entityType, entityId: input.entityId }, page.entries.length);
                 return page;
@@ -4593,7 +4916,7 @@ export class SqliteScopeHost {
                 // #1237: the sanctioned walk. The helper owns the one distinction the whole
                 // view rests on — a null cause with an operation is the beginning of the
                 // chain, a null cause without one is the trail running out.
-                const db = this.scopeDbFor(tenantId, scopeId);
+                const db = this.scopeReadDbFor(tenantId, scopeId);
                 const result = walkEventCause({ sql: scopedSql(db) }, input.eventId, input.maxDepth);
                 this.recordAccess(actor, 'eventCause', { tenantId, scopeId }, { eventId: input.eventId }, result.chain.length);
                 return result;
@@ -4601,27 +4924,27 @@ export class SqliteScopeHost {
             eventEffects: async (actor, tenantId, scopeId, input) => {
                 // #1237 forward: the helper owns the two delivery traps — `delivered_at`
                 // meaning two different things, and an empty list being ambiguous.
-                const db = this.scopeDbFor(tenantId, scopeId);
+                const db = this.scopeReadDbFor(tenantId, scopeId);
                 const tree = walkEventEffects({ sql: scopedSql(db) }, input.eventId, input.maxNodes);
                 this.recordAccess(actor, 'eventEffects', { tenantId, scopeId }, { eventId: input.eventId }, tree.count);
                 return tree;
             },
             invocationEvents: async (actor, tenantId, scopeId, input) => {
                 // #1237: one call's events, siblings included — what neither walk reaches.
-                const db = this.scopeDbFor(tenantId, scopeId);
+                const db = this.scopeReadDbFor(tenantId, scopeId);
                 const read = readInvocation({ sql: scopedSql(db) }, input.invocationId, input.limit);
                 this.recordAccess(actor, 'invocationEvents', { tenantId, scopeId }, { invocationId: input.invocationId }, read.events.length);
                 return read;
             },
             deadLetters: async (actor, tenantId, scopeId, input) => {
                 // #1525: every delivery that gave up, scope-wide — what the walks reach only by event.
-                const db = this.scopeDbFor(tenantId, scopeId);
+                const db = this.scopeReadDbFor(tenantId, scopeId);
                 const page = readDeadLetters({ sql: scopedSql(db) }, { limit: input.limit, cursor: input.cursor });
                 this.recordAccess(actor, 'deadLetters', { tenantId, scopeId }, null, page.entries.length);
                 return page;
             },
             scopeAppliedMigrations: async (actor, tenantId, scopeId) => {
-                const db = this.scopeDbFor(tenantId, scopeId);
+                const db = this.scopeReadDbFor(tenantId, scopeId);
                 const rows = db
                     .prepare(`SELECT module_id, version, applied_at FROM _substrat_migrations
               ORDER BY applied_at DESC, module_id, version LIMIT 100`)
@@ -4645,6 +4968,16 @@ export class SqliteScopeHost {
                 this.recordAccess(actor, 'scopeMigrationBookmarks', { tenantId, scopeId }, null, 0);
                 return [];
             },
+            scopeDatabaseSize: async (actor, tenantId, scopeId) => {
+                // #1524: the SQLite twin of a DO's `databaseSize`. It counts allocated pages,
+                // free ones included, which is what the file costs on disk, not the live row bytes.
+                const db = this.scopeReadDbFor(tenantId, scopeId);
+                const pages = db.pragma('page_count', { simple: true });
+                const pageSize = db.pragma('page_size', { simple: true });
+                const bytes = pages * pageSize;
+                this.recordAccess(actor, 'scopeDatabaseSize', { tenantId, scopeId }, null, 1);
+                return bytes;
+            },
             rewindScope: async () => {
                 throw new Error('point-in-time rewind is not available on this host (PITR is a Durable-Object-plane mechanism) — use the backup restore path');
             },
@@ -4877,7 +5210,7 @@ export class SqliteScopeHost {
             listScopeTables: async (actor, tenantId, scopeId) => {
                 // K-3: the (tenantId, scopeId) pair is cross-checked before we open anything;
                 // a scope under a different tenant is unreachable, never another tenant's DB.
-                const db = this.scopeDbFor(tenantId, scopeId);
+                const db = this.scopeReadDbFor(tenantId, scopeId);
                 const names = db
                     .prepare(`SELECT name FROM sqlite_master WHERE type = 'table' ORDER BY name`)
                     .all().map((r) => r.name);
@@ -4890,7 +5223,7 @@ export class SqliteScopeHost {
                 return tables;
             },
             readScopeTable: async (actor, tenantId, scopeId, input) => {
-                const db = this.scopeDbFor(tenantId, scopeId);
+                const db = this.scopeReadDbFor(tenantId, scopeId);
                 // Validate the table against the LIVE schema — an unknown name throws, it is
                 // never interpolated blind. That validated name is the only thing that reaches
                 // the query, so the quoted identifier below carries no user input.
@@ -4907,7 +5240,7 @@ export class SqliteScopeHost {
                 return { table: input.table, columns, rows, rowCount, limit, offset };
             },
             queryScope: async (actor, tenantId, scopeId, input) => {
-                const db = this.scopeDbFor(tenantId, scopeId);
+                const db = this.scopeReadDbFor(tenantId, scopeId);
                 // Layer 1, shared: the kernel's textual gate (single statement, read verbs
                 // only) — the checked statement is the one that runs.
                 const sql = assertReadOnlyQuery(input.sql);
@@ -4942,14 +5275,14 @@ export class SqliteScopeHost {
             // read records to the K-24 access log. What differs is that these two answer a
             // question about the permission model rather than about the data.
             listDenials: async (actor, tenantId, scopeId, filter) => {
-                const db = this.scopeDbFor(tenantId, scopeId);
+                const db = this.scopeReadDbFor(tenantId, scopeId);
                 const q = denialListQuery(filter);
                 const rows = db.prepare(q.sql).all(...q.params).map(mapDenialRow);
                 this.recordAccess(actor, 'listDenials', { tenantId, scopeId }, filter ?? null, rows.length);
                 return rows;
             },
             summarizeDenials: async (actor, tenantId, scopeId, filter) => {
-                const db = this.scopeDbFor(tenantId, scopeId);
+                const db = this.scopeReadDbFor(tenantId, scopeId);
                 const b = denialSummaryQuery(filter);
                 // Grouped as the filter asked (#1456), and the answer says which way.
                 const grouped = mapDenialSummaryBuckets(b.groupBy, db.prepare(b.sql).all(...b.params));
@@ -4969,7 +5302,7 @@ export class SqliteScopeHost {
             },
             exportScope: async (actor, tenantId, scopeId) => {
                 // K-3: cross-check the pair before opening anything (same as the introspection reads).
-                const db = this.scopeDbFor(tenantId, scopeId);
+                const db = this.scopeReadDbFor(tenantId, scopeId);
                 // Every real table, keeping the `_substrat_*` spine but dropping SQLite's own
                 // `sqlite_*` internals — those are auto-managed and `CREATE TABLE sqlite_*` is
                 // rejected on reload. `sql` is the CREATE statement, replayed to rebuild the schema.
@@ -5110,13 +5443,11 @@ export class SqliteScopeHost {
                     throw new Error(`scope ${scopeId} still resolves hostname '${bound.hostname}' — ` +
                         `unbind it before reaping (reap wipes storage and cannot be undone)`);
                 }
-                const key = `${tenantId}/${scopeId}`;
-                const rt = this.scopes.get(key);
-                if (rt) {
-                    rt.db.close();
-                    this.scopes.delete(key);
-                    this.scopesById.delete(scopeId);
-                }
+                // The reader goes with the writer (#1624): an open handle on a removed file keeps
+                // reading the unlinked bytes, which is the reaped data answering as if it were live.
+                const rt = this.scopes.get(`${tenantId}/${scopeId}`);
+                if (rt)
+                    this.closeRuntime(rt);
                 rmSync(join(this.dir, `${tenantId}__${scopeId}.sqlite`), { force: true });
                 // The recoverable copy the caller stored first (#493), named in the audit entry so
                 // the trail answers "was there a backup" without correlating two timestamps.
@@ -5155,15 +5486,31 @@ export class SqliteScopeHost {
                 // and transaction facts remain". A consumer's timeline still shows that something
                 // happened, to what, and when; it no longer shows who or what was said.
                 const db = this.scopeDbFor(tenantId, scopeId);
-                const redacted = db
-                    .prepare(`UPDATE _substrat_outbox SET payload = NULL
-              WHERE subject_id = ? AND pii_class != 'none' AND payload IS NOT NULL`)
-                    .run(subjectId);
+                // One instant for the whole erasure, read before the first write: the intent
+                // tombstones below and the key's own tombstone should not disagree about when a
+                // person was erased.
                 const at = new Date().toISOString();
+                // Both scope-side redactions in ONE turn on the scope actor (#1678): issued while an
+                // invoke held its transaction open, they joined it, and its rollback put the
+                // person's PII back after this verb had destroyed the key and receipted the erasure.
+                const { redacted, intentsRedacted } = await this.runtime(tenantId, scopeId).actor.turn(() => ({
+                    redacted: db
+                        .prepare(`UPDATE _substrat_outbox SET payload = NULL
+                WHERE subject_id = ? AND pii_class != 'none' AND payload IS NOT NULL`)
+                        .run(subjectId),
+                    // The spine's OTHER copy of an event (#1600). A CP-less host routes a connector
+                    // delivery it cannot run into `_substrat_platform_requests` with the whole event
+                    // embedded, and nothing ever deletes those rows — so the same line has to be held
+                    // here, or the redaction above only moves the name one table across. Same
+                    // idempotence as the outbox half: a re-run finds the tombstones and changes
+                    // nothing.
+                    intentsRedacted: this.redactSubjectIntents(db, subjectId, at),
+                }));
                 const { existed } = await this.subjectKeysFor(tenantId, scopeId).destroy(subjectId, at);
                 const receipt = subjectShredReceipt.parse({
                     subjectId,
                     eventsRedacted: redacted.changes,
+                    intentsRedacted,
                     keyDestroyed: existed,
                     tombstoned: true,
                 });
@@ -5171,7 +5518,9 @@ export class SqliteScopeHost {
                 // mutation, the access log because it destroys evidence. An erasure is the one
                 // action where "who asked for this to disappear" is itself the record.
                 this.recordAdmin(actor, 'shredSubject', { tenantId, scopeId }, null, receipt);
-                this.recordAccess(actor, 'shredSubject', { tenantId, scopeId }, { subjectId }, redacted.changes);
+                // BOTH counts: the access log's number is "how much evidence this destroyed", and
+                // an intent payload is a whole event's worth of it.
+                this.recordAccess(actor, 'shredSubject', { tenantId, scopeId }, { subjectId }, redacted.changes + intentsRedacted);
                 return receipt;
             },
             // -- impersonation (K-42, #868) ----------------------------------------
@@ -6148,6 +6497,24 @@ export class SqliteScopeHost {
         // where the whole replay is already inside one.
         db.transaction(() => db.exec(SCHEDULE_STATE_REBUILD))();
     }
+    /**
+     * #1573: run a create-copy-drop-rename against the directory as ONE transaction.
+     * `exec` of four statements is four autocommits, and the state between DROP and
+     * RENAME is the one to fear: the next open runs the bootstrap first, whose `CREATE
+     * TABLE IF NOT EXISTS` puts an EMPTY table of the new shape back, detection then
+     * reads that shape and concludes the migration is done — and every copied row stays
+     * orphaned in the `_new` table, with nothing ever erroring. Atomic, neither
+     * intermediate state is reachable, so there is no recovery path to write (or to
+     * leave untested).
+     *
+     * `db.transaction` nests as a SAVEPOINT, as `ensureScheduleStateKind` (#1571) relies
+     * on. Each script leads with `DROP TABLE IF EXISTS <table>_new` to absorb a scratch
+     * table arriving from BELOW the transaction (a torn copy of the file, a backup that
+     * captured one mid-rebuild) — belt, not the fix.
+     */
+    rebuildAtomically(script) {
+        this.directory.transaction(() => this.directory.exec(script))();
+    }
     /**
      * Rebuild `_substrat_identities` when it still carries the pre-K-22 global key.
      * A PRIMARY KEY cannot be ALTERed, so this is create-copy-drop-rename.
@@ -6168,7 +6535,9 @@ export class SqliteScopeHost {
             .get('_substrat_identities');
         if (!row || row.sql.includes('PRIMARY KEY (tenant_id, provider, external_id)'))
             return;
-        this.directory.exec(`
+        // #1573: one transaction — see `rebuildAtomically`.
+        this.rebuildAtomically(`
+      DROP TABLE IF EXISTS _substrat_identities_new;
       CREATE TABLE _substrat_identities_new (
         provider     TEXT NOT NULL,
         external_id  TEXT NOT NULL,
@@ -6199,7 +6568,9 @@ export class SqliteScopeHost {
             .get('_substrat_admin_log');
         if (!row || !/tenant_id TEXT NOT NULL/.test(row.sql))
             return;
-        this.directory.exec(`
+        // #1573: one transaction — see `rebuildAtomically`.
+        this.rebuildAtomically(`
+      DROP TABLE IF EXISTS _substrat_admin_log_new;
       CREATE TABLE _substrat_admin_log_new (
         id TEXT PRIMARY KEY,
         actor TEXT NOT NULL,
@@ -6218,6 +6589,30 @@ export class SqliteScopeHost {
       ALTER TABLE _substrat_admin_log_new RENAME TO _substrat_admin_log;
     `);
     }
+    /**
+     * #1572: `_substrat_sweep_runs_intent` with `kind` in it, on a directory whose index
+     * predates that. `CREATE UNIQUE INDEX IF NOT EXISTS` matches on the name alone, so the
+     * bootstrap cannot do this: on an existing directory it sees the old index and skips,
+     * and the schedule/freshness collision the new key refuses stays live for good.
+     *
+     * Detected from `sqlite_master.sql`, like the table rebuilds above, and replaced as
+     * DROP-then-CREATE in one transaction (`rebuildAtomically`). Less rides on that than on
+     * a table rebuild — the index holds no rows, and one dropped but not re-created comes
+     * back on the next open, because the bootstrap creates it by name — but there is then
+     * no committed directory with no dedupe key at all. The CREATE cannot meet a row it
+     * refuses: every set of rows unique on (request_id, unit) is unique on the wider key.
+     */
+    ensureSweepRunsIntentKind() {
+        const row = this.directory
+            .prepare("SELECT sql FROM sqlite_master WHERE type = 'index' AND name = ?")
+            .get('_substrat_sweep_runs_intent');
+        if (row && sweepRunsIntentHasKind(row.sql))
+            return;
+        this.rebuildAtomically(`
+      DROP INDEX IF EXISTS _substrat_sweep_runs_intent;
+      ${SWEEP_RUNS_INTENT_INDEX}
+    `);
+    }
     ensureDirectoryColumns() {
         this.ensureIdentityKey();
         this.ensureAdminLogTenantNullable();
@@ -6286,7 +6681,7 @@ export class SqliteScopeHost {
         this.ensureColumn(this.directory, '_substrat_sweep_runs', 'request_id', 'request_id TEXT');
         this.ensureColumn(this.directory, '_substrat_sweep_runs', 'event_type', 'event_type TEXT');
         this.ensureColumn(this.directory, '_substrat_sweep_runs', 'observed_at', 'observed_at TEXT');
-        this.directory.exec('CREATE UNIQUE INDEX IF NOT EXISTS _substrat_sweep_runs_intent ON _substrat_sweep_runs (request_id, unit)');
+        this.ensureSweepRunsIntentKind();
         const existing = new Set(this.directory.prepare('PRAGMA table_info(scopes)').all().map((c) => c.name));
         for (const [column, ddl] of [
             ['parent_scope_id', 'parent_scope_id TEXT'],
@@ -6363,7 +6758,23 @@ export class SqliteScopeHost {
      * onto every event it emits. Absent for consumer dispatch: a consumer runs on
      * behalf of no operation, and the emitted row's NULL says so.
      */
-    operation) {
+    operation, 
+    /**
+     * #1672: the secrets `ctx.capabilities.mint` hands out during this invocation. The
+     * stub owns the array (it withholds them from the idempotency recording); this
+     * context appends to it and holds `ctx.sql`, `ctx.emit` and `ctx.requestPlatform` to
+     * it — the tripwire that catches a module persisting one by accident (not a boundary
+     * against one that means to; see `assertNoSecret`).
+     */
+    minted = [], 
+    /**
+     * #1672: the instant to stamp, when the caller already read one. The exchange passes the
+     * instant its row write used, so the `capability.exercised` event's `occurredAt` and the
+     * row's `last_used_at` are the same value — a second clock read could disagree.
+     */
+    at = this.clock()) {
+        // For a connection, system or capability subject this carries THAT id so the type
+        // holds — it is not a person, and the event actor below says what it is instead.
         const principal = subject.id;
         const checker = this.checker;
         const relations = this.relations;
@@ -6388,7 +6799,6 @@ export class SqliteScopeHost {
          * `ctx.now()` deterministic only in the sense that each reading is separately
          * unpredictable.
          */
-        const at = this.clock();
         /**
          * The scope host's half of `ctx.atomic` (#770) — everything else is the
          * kernel's (`createAtomic`). SQLite gives us savepoints, which nest inside
@@ -6424,7 +6834,10 @@ export class SqliteScopeHost {
         // Lifted out of the object literal so `grant` can reuse it: a delegation
         // check has to be the SAME check the operation itself passes, or the two
         // could disagree about what the caller holds.
-        const runCheck = async (permission, entity) => {
+        const runCheck = async (unparsed, entity) => {
+            // #1642: parsed before the override actor's early return, which never reaches
+            // the checker — a cast key would otherwise become that path's proof relation.
+            const permission = assertPermissionKey(unparsed);
             if (overrideActor) {
                 return {
                     allowed: true,
@@ -6462,15 +6875,17 @@ export class SqliteScopeHost {
                 scopeId: rt.scopeId,
             });
         };
-        return {
+        const ctxRef = {
             tenantId: rt.tenantId,
             scopeId: rt.scopeId,
             principal,
-            sql: scopedSql(rt.db),
+            sql: guardSecrets(scopedSql(rt.db), minted),
             now: () => at,
             emit: (event) => {
                 assertImpersonationWrites(impersonation, 'ctx.emit');
                 const input = domainEventInput.parse(event);
+                // #1672: the COMPLETE parsed event — entity id, type and subject as well as payload.
+                assertNoSecret('ctx.emit', input, minted);
                 const full = domainEvent.parse({
                     ...input,
                     // #956: from the operation's instant, not the wall clock. `ORDER BY id`
@@ -6481,12 +6896,7 @@ export class SqliteScopeHost {
                     occurredAt: at,
                     tenantId: rt.tenantId,
                     scopeId: rt.scopeId,
-                    actor: overrideActor ??
-                        (subject.kind === 'system'
-                            ? { system: subject.id }
-                            : subject.kind === 'connection'
-                                ? { connection: subject.id }
-                                : principal),
+                    actor: overrideActor ?? actorOf(subject),
                     ...(passed.length ? { authorization: passed.map((p) => ({ ...p })) } : {}),
                     ...(stamp ? { impersonation: stamp } : {}),
                     // #1231: kernel-stamped like the two above — `domainEventInput.parse`
@@ -6516,6 +6926,8 @@ export class SqliteScopeHost {
             requestPlatform: (request) => {
                 assertImpersonationWrites(impersonation, 'ctx.requestPlatform');
                 const input = platformRequestInput.parse(request);
+                // #1672: the COMPLETE parsed request — its `kind` is persisted as surely as its payload.
+                assertNoSecret('ctx.requestPlatform', input, minted);
                 // #1474: a platform-authored kind (`sweep-runs`) is the platform's to enqueue, never
                 // module code's — its drain handler writes schedule verdicts the dashboard trusts.
                 assertModuleEnqueueableKind(input.kind);
@@ -6528,12 +6940,7 @@ export class SqliteScopeHost {
                     throw new Error(`too many pending platform requests (${pending}); retry once some have drained`);
                 }
                 const id = platformRequestId.parse(ulid());
-                const requestedBy = overrideActor ??
-                    (subject.kind === 'system'
-                        ? { system: subject.id }
-                        : subject.kind === 'connection'
-                            ? { connection: subject.id }
-                            : principal);
+                const requestedBy = overrideActor ?? actorOf(subject);
                 rt.db
                     .prepare(`INSERT INTO _substrat_platform_requests
                (id, kind, payload, requested_by, impersonation, status, attempts, requested_at)
@@ -6547,7 +6954,7 @@ export class SqliteScopeHost {
             // predicate is needed or possible: the runtime IS the scope.
             platformRequests: (filter) => {
                 const q = platformRequestHistoryQuery(filter);
-                return rt.db.prepare(q.sql).all(...q.params).map(rowToPlatformRequest);
+                return rt.db.prepare(q.sql).all(...q.params).map(platformRequestOf);
             },
             // #901. This scope's own spine, so no tenancy predicate is needed or
             // possible — the runtime IS the scope. The version is the last event's
@@ -6647,6 +7054,21 @@ export class SqliteScopeHost {
                     .run(`principal:${principal}`, `granted:${permission}`, `${entity.entityType}:${entity.entityId}`);
             },
             atomic: createAtomic(runSub, { passed, signals }),
+            // #1672: mint / revoke / list, written once in the kernel. The raw spine seam (this
+            // is the kernel's own write to `_substrat_capabilities`), the operation's OWN check —
+            // the predicate `grant` shares — and `ctx.emit` for the minted/revoked events. A
+            // consumer's override actor is passed as the system actor it is, so a consumer cannot
+            // mint: its checks allow unconditionally, which would make "the minter holds it" vacuous.
+            capabilities: createCapabilityVerbs({
+                sql: spineSql(rt.db),
+                subject: overrideActor ? { kind: 'system', id: overrideActor.system } : subject,
+                now: at,
+                check: runCheck,
+                emit: (event) => ctxRef.emit(event),
+                isOperation: (name) => this.operations.has(name),
+                assertWrites: (verb) => assertImpersonationWrites(impersonation, verb),
+                minted,
+            }),
             link: (child, parent) => {
                 assertImpersonationWrites(impersonation, 'ctx.link');
                 const allowed = relations.get(child.entityType);
@@ -6708,6 +7130,7 @@ export class SqliteScopeHost {
                 return sealTo({ keyId: key.keyId, publicKey: key.publicKey }, plaintext);
             },
         };
+        return ctxRef;
     }
     async applyPendingMigrations(rt) {
         const pending = [];
@@ -6816,10 +7239,98 @@ export class SqliteScopeHost {
             throw new Error(`scope ${scopeId} is reaped — its storage is gone and cannot be read`);
         }
     }
+    /**
+     * The intent-journal half of `shredSubject` (#1600) — the DO's `redactSubject` twin.
+     *
+     * Row-by-row rather than one `UPDATE … WHERE`: the decision is structural (does this
+     * payload embed an event the erasure redacts?) and SQL cannot make it, because an
+     * intent payload is opaque JSON with no `pii_class` column to test. The SQL narrows to
+     * the rows that could possibly match; the kernel predicate decides; the kernel's
+     * statement writes. All three are shared with the Durable-Object adapter so the two
+     * cannot drift about what a redacted intent is.
+     *
+     * Returns how many rows it redacted — zero on a re-run, the tombstones having already
+     * stopped matching.
+     */
+    redactSubjectIntents(db, subjectId, at) {
+        const q = platformRequestRedactionQuery(subjectId);
+        const candidates = db.prepare(q.sql).all(...q.params);
+        const write = db.prepare(PLATFORM_REQUEST_REDACTION_SQL);
+        let redacted = 0;
+        for (const row of candidates) {
+            if (!intentPayloadCarriesSubject(row.payload, subjectId))
+                continue;
+            write.run(...platformRequestRedactionParams(row.id, subjectId, at));
+            redacted += 1;
+        }
+        return redacted;
+    }
     scopeDbFor(tenantId, scopeId) {
         this.assertScopeReachable(tenantId, scopeId);
         return this.runtime(tenantId, scopeId).db;
     }
+    /**
+     * The connection a `HostAdmin` READ runs on (#1624) — `scopeDbFor`'s twin, with the
+     * same K-3 and reap gate in front of it.
+     *
+     * From OUTSIDE the scope's actor it is the scope's read-only connection. `invoke` holds
+     * a `BEGIN IMMEDIATE` open on the shared connection across its awaits, so a read there
+     * saw a stranger's uncommitted rows: a lake drain shipped an event that then rolled
+     * back — permanently, since the lake is append-only — and an export captured one into a
+     * backup. The file is WAL, so the reader sees exactly what was committed.
+     *
+     * From INSIDE one of the scope's actor tasks (an executor handed `HostAdmin`, reading
+     * its own scope) it is the shared connection, as before. The only transaction open
+     * there is the caller's own unit — the actor serializes everything else — so reading
+     * it is reading your own writes, which is the answer the caller is owed and the one it
+     * had. `ScopeActor.turn` makes the same call for the writers (#1678).
+     */
+    scopeReadDbFor(tenantId, scopeId) {
+        this.assertScopeReachable(tenantId, scopeId);
+        return this.readDb(this.runtime(tenantId, scopeId));
+    }
+    /**
+     * `scopeReadDbFor` without the directory gate, for the host-side reads that already
+     * resolved their runtime — the platform-intent drain's `listPlatformRequests` among them,
+     * where a stranger's uncommitted intent was a platform effect about to be carried out for
+     * an operation that then rolled back.
+     */
+    readDb(rt) {
+        if (rt.actor.holds())
+            return rt.db;
+        const key = `${rt.tenantId}/${rt.scopeId}`;
+        if (rt.reader) {
+            // Most recently used goes to the back of the insertion order, which is the cap's LRU.
+            this.readers.delete(key);
+            this.readers.set(key, rt);
+            return rt.reader;
+        }
+        // `runtime()` opened the writer first, in WAL, so the file and its `-shm` exist.
+        rt.reader = new Database(rt.file, { readonly: true, fileMustExist: true });
+        this.readers.set(key, rt);
+        // The cap: a lake drain sweeps every scope, and without it every open scope would end
+        // up holding two connections. The oldest reader is closed; the next read reopens it.
+        while (this.readers.size > READER_CAP) {
+            const [oldest, victim] = this.readers.entries().next().value;
+            this.readers.delete(oldest);
+            victim.reader?.close();
+            victim.reader = null;
+        }
+        return rt.reader;
+    }
+    /**
+     * Close a scope's connections and forget its runtime — the reader with the writer, so
+     * neither outlives the file a reap or a snapshot delete is about to remove.
+     */
+    closeRuntime(rt) {
+        const key = `${rt.tenantId}/${rt.scopeId}`;
+        rt.reader?.close();
+        rt.reader = null;
+        this.readers.delete(key);
+        rt.db.close();
+        this.scopes.delete(key);
+        this.scopesById.delete(rt.scopeId);
+    }
     /**
      * The additive spine-column migrations, shared by `runtime()` and the dump replay.
      * KERNEL_DDL is all IF NOT EXISTS, so a scope DB created before a column keeps the
@@ -6897,7 +7408,10 @@ export class SqliteScopeHost {
         const existing = this.scopes.get(key);
         if (existing)
             return existing;
-        const db = new Database(join(this.dir, `${tenantId}__${scopeId}.sqlite`));
+        const file = join(this.dir, `${tenantId}__${scopeId}.sqlite`);
+        const db = new Database(file);
+        // WAL is also what the read connection rests on (#1624): a reader sees the last
+        // committed snapshot and never blocks, or is blocked by, the writer.
         db.pragma('journal_mode = WAL');
         db.exec(KERNEL_DDL);
         this.ensureSpineColumns(db);
@@ -6914,7 +7428,9 @@ export class SqliteScopeHost {
         const created = {
             tenantId,
             scopeId,
+            file,
             db,
+            reader: null,
             actor: new ScopeActor(),
             appliedMigrations,
             mintEventId,
@@ -6945,6 +7461,20 @@ function cellToJson(v) {
  * `_substrat_*`" a mechanism rather than a lint rule (#954) — the kernel's own
  * spine writes use `rt.db` directly and never pass through here.
  */
+/**
+ * The kernel's OWN spine access (#1672) — the same seam as `scopedSql` without `guardSpine`,
+ * because these are the kernel's writes to `_substrat_capabilities`, which module code may
+ * never make. Never handed to module code.
+ */
+function spineSql(db) {
+    return {
+        query: (sql, params = []) => db.prepare(sql).all(...params),
+        exec: (sql, params = []) => {
+            const info = db.prepare(sql).run(...params);
+            return { changes: info.changes };
+        },
+    };
+}
 function scopedSql(db) {
     return guardSpine({
         query: (sql, params = []) => db.prepare(sql).all(...params),