@substrat-run/adapter-sqlite 0.119.0 → 0.121.0

package/dist/index.js

@@ -1,8 +1,8 @@
 import { existsSync, mkdirSync, readdirSync, readFileSync, rmSync, writeFileSync } from 'node:fs';
 import { dirname, join } from 'node:path';
 import Database from 'better-sqlite3';
-import { accessLogEntry, adminLogEntry, opsFailureEntry, opsFailureFingerprint, issueEntry, FRESHNESS_HEARTBEAT_MINUTES, sweepRunEntry, modelUsageEntry, ATTACHMENT_ADDED, ATTACHMENT_REMOVED, attachmentRecord, createTenantInput, domainEvent, domainEventInput, exportReadInput, importBatch, entitlementGrant, entitlementGrantInput, eventId, meterReading, platformRequestInput, platformRequestId, MAX_PENDING_PLATFORM_REQUESTS, identityLink, identityPool, instant, connection, capabilityGrant, connectionGrant, connectionGrantRecord, connectionSecret, systemGrant, systemSwitch, peerSwitch, verticalCaller, verticalSlug as verticalSlugOf, subjectRef, requestFingerprint, createConnectionInput, projectedConnectionGrant, projectedConnectionKey, moduleManifest, createOrgInput, promotionAcknowledgement, bindHostnameInput, channelHistoryEntry, hostnameBinding, publishVersionInput, AUTO_ADMISSION_NOTE, routeTarget, registerVerticalInput, vertical as verticalSchema, verticalChannel, verticalVersion, objectRef, grantRefFromProof, org as orgSchema, orgMembership, principalId, resolvedIdentity, identityMembership, roleDefinition, scope as scopeSchema, tenant as tenantSchema, tenantRole, subjectShredReceipt, SCOPE_TABLE_PAGE_DEFAULT, SCOPE_TABLE_PAGE_MAX, SCOPE_QUERY_ROW_MAX, verticalServingState, callsOfManifestJson, outboundOfManifestJson, listLimitOf, substratError, assertReplayableDump, delegatedReadRecord, redrainEventsInput, REDRAIN_BATCH, } from '@substrat-run/contracts';
-import { actorOf, asPrincipal, assertAllowed, assertNoSecret, assertPermissionKey, CAPABILITY_DDL, CAPABILITY_EXCHANGE_OPERATION, capabilityAttachmentWriteRefused, capabilityTokenHash, createCapabilityVerbs, exchangeCapability as exchangeCapabilitySecret, guardSecrets, mintBecomeCapability, plausibleSessionToken, redactSecrets, resolveCapabilitySession, revokeCapabilityAsPlatform, assertReadOnlyQuery, attachmentBlobKey, entitlementDenial, foldMeterReading, guardSpine, parseValidationRecords, resolveScopeRecord, ulid, ISSUE_RETENTION_DAYS, OPS_FAILURE_RETENTION_DAYS, SWEEP_RUN_RETENTION_DAYS, SWEEP_RUNS_INTENT_INDEX, sweepRunsIntentHasKind, MODEL_USAGE_RETENTION_DAYS, foldModelUsage, backoffAt, platformRequestHistoryQuery, platformRequestOf, PLATFORM_REQUEST_COLUMNS, PLATFORM_REQUEST_REDACTION_SQL, platformRequestRedactionParams, platformRequestRedactionQuery, intentPayloadCarriesSubject, redactSubjectJobRuns, JOB_RUN_PATCH_SQL, JOB_STEP_RECORD_SQL, DELIVERY_ERROR_REDACTION_SQL, REDACTED_DELIVERY_NOTE, seatScopeTuple, switchSystemSchedules, admitPeer, collectPeers, peerSeats, resolveVerticalInstanceFrom, switchPeer, peerGrantsStatus, systemGrantsStatus, systemScheduleState, systemSwitchedOff, systemSwitchedOffMessage, denialListQuery, denialSummaryQuery, denialTotalsQuery, DENIAL_WINDOW_QUERY, mapDenialRow, mapDenialSummaryBuckets, IMPERSONATION_COLUMNS, IMPERSONATION_DDL, ImpersonationRefused, assertImpersonationWrites, assertModuleEnqueueableKind, assertSessionUsable, impersonationByIdQuery, impersonationListQuery, impersonationRowValues, impersonationStampOf, mapImpersonationRow, newImpersonationSession, resolveRetryPolicy, isSecretBoxConfigured, unconfiguredSecretBox, createSubjectKeys, generateSealingKeyPair, noSealingKeyMessage, openSealed, sealTo, ConnectionSealingKeyUnavailableError, PermissionDenied, createAtomic, NotSearchable, NotListable, listIndexMigrations, listIndexPlans, listQuery, cursorOf, isSearchIndexTable, searchIndexDdl, searchIndexMigrations, searchIndexPlans, searchLimit, searchMatchExpression, searchQuery, entityVersionQuery, entityVersionOf, assertIfMatch, OUTBOX_ENTITY_INDEX, SCHEDULE_STATE_DDL, SCHEDULE_STATE_REBUILD, scheduleStateHasKind, VERTICAL_EVENTS_DDL, EXPORT_HOPS_SQL, IMPORT_CURSORS_SQL, IMPORT_CURSOR_OF_SQL, IMPORT_CURSOR_ADVANCE_SQL, IMPORT_RECORD_SQL, CrossVerticalRegistry, exportReadPlan, exportReadQuery, planExportBatch, withheldNote, JOB_RUN_DDL, jobRunListLimit, jobRunOf, runDueJobRuns, startJobRun, IDEMPOTENCY_DDL, assertIdempotencyKey, idempotencyLookupQuery, idempotencyPruneStatement, idempotencyRecordStatement, idempotencyOptedOutMessage, replayFor, globalFetch, createUlid, facetEvents, readHistory, walkEventCause, walkEventEffects, assertRedrainWindow, readInvocation, readDeadLetters, domainEventOf, readUndrainedOutbox, undrainedEventsOf, connectorCallRecord, noopConnectorCallRecorder, recordConnectorCall, settleConnectionUse, } from '@substrat-run/kernel';
+import { accessLogEntry, adminLogEntry, opsFailureEntry, opsFailureFingerprint, issueEntry, FRESHNESS_HEARTBEAT_MINUTES, sweepRunEntry, modelUsageEntry, ATTACHMENT_ADDED, ATTACHMENT_REMOVED, attachmentRecord, createTenantInput, domainEvent, domainEventInput, exportReadInput, importBatch, importCursorMove, exportsOfManifestJson, importsOfManifestJson, entitlementGrant, entitlementGrantInput, eventId, meterReading, platformRequestInput, platformRequestId, MAX_PENDING_PLATFORM_REQUESTS, identityLink, identityPool, instant, connection, capabilityGrant, connectionGrant, connectionGrantRecord, connectionSecret, systemGrant, systemSwitch, systemSwitchRecord, peerSwitch, verticalCaller, verticalSlug as verticalSlugOf, subjectRef, requestFingerprint, createConnectionInput, projectedConnectionGrant, projectedConnectionKey, moduleManifest, createOrgInput, promotionAcknowledgement, bindHostnameInput, channelHistoryEntry, hostnameBinding, publishVersionInput, AUTO_ADMISSION_NOTE, routeTarget, registerVerticalInput, vertical as verticalSchema, verticalChannel, verticalVersion, objectRef, grantRefFromProof, org as orgSchema, orgMembership, principalId, resolvedIdentity, identityMembership, roleDefinition, scope as scopeSchema, tenant as tenantSchema, tenantRole, subjectShredReceipt, SCOPE_TABLE_PAGE_DEFAULT, SCOPE_TABLE_PAGE_MAX, SCOPE_QUERY_ROW_MAX, verticalServingState, callsOfManifestJson, outboundOfManifestJson, listLimitOf, substratError, assertReplayableDump, delegatedReadRecord, redrainEventsInput, REDRAIN_BATCH, } from '@substrat-run/contracts';
+import { actorOf, asPrincipal, assertAllowed, assertNoSecret, assertPermissionKey, CAPABILITY_DDL, CAPABILITY_EXCHANGE_OPERATION, capabilityAttachmentWriteRefused, capabilityTokenHash, createCapabilityVerbs, exchangeCapability as exchangeCapabilitySecret, guardSecrets, mintBecomeCapability, plausibleSessionToken, redactSecrets, resolveCapabilitySession, revokeCapabilityAsPlatform, assertReadOnlyQuery, attachmentBlobKey, entitlementDenial, foldMeterReading, guardSpine, guardSqlLimits, parseValidationRecords, resolveScopeRecord, ulid, ISSUE_RETENTION_DAYS, OPS_FAILURE_RETENTION_DAYS, SWEEP_RUN_RETENTION_DAYS, SWEEP_RUNS_INTENT_INDEX, sweepRunsIntentHasKind, MODEL_USAGE_RETENTION_DAYS, foldModelUsage, backoffAt, platformRequestHistoryQuery, platformRequestOf, PLATFORM_REQUEST_COLUMNS, PLATFORM_REQUEST_REDACTION_SQL, platformRequestRedactionParams, platformRequestRedactionQuery, intentPayloadCarriesSubject, redactSubjectJobRuns, JOB_RUN_PATCH_SQL, JOB_STEP_RECORD_SQL, DELIVERY_ERROR_REDACTION_SQL, REDACTED_DELIVERY_NOTE, seatScopeTuple, switchSystemSchedules, admitPeer, collectPeers, peerSeats, resolveVerticalInstanceFrom, switchPeer, peerGrantsStatus, systemGrantsStatus, systemScheduleState, systemSwitchedOff, systemSwitchedOffMessage, SYSTEM_SWITCHES_BACKFILL_SQL, SYSTEM_SWITCHES_DDL, forgetSystemSwitchesOf, listSystemSwitchRecords, recordSystemSwitchedOff, recordSystemSwitchedOn, restoreSystemSwitchRecord, switchedOffModulesOf, systemSwitchRecordsOf, systemSwitchesTableExists, withRecorded, denialListQuery, denialSummaryQuery, denialTotalsQuery, DENIAL_WINDOW_QUERY, mapDenialRow, mapDenialSummaryBuckets, IMPERSONATION_COLUMNS, IMPERSONATION_DDL, ImpersonationRefused, assertImpersonationWrites, assertModuleEnqueueableKind, assertSessionUsable, impersonationByIdQuery, impersonationListQuery, impersonationRowValues, impersonationStampOf, mapImpersonationRow, newImpersonationSession, resolveRetryPolicy, isSecretBoxConfigured, unconfiguredSecretBox, createSubjectKeys, generateSealingKeyPair, noSealingKeyMessage, openSealed, sealTo, ConnectionSealingKeyUnavailableError, PermissionDenied, createAtomic, NotSearchable, NotListable, listIndexMigrations, listIndexPlans, listQuery, cursorOf, moduleMigrations, isSearchIndexTable, searchIndexDdl, searchIndexMigrations, searchIndexPlans, searchLimit, searchMatchExpression, searchQuery, entityVersionQuery, entityVersionOf, assertIfMatch, OUTBOX_ENTITY_INDEX, SCHEDULE_STATE_DDL, SCHEDULE_STATE_REBUILD, scheduleStateHasKind, VERTICAL_EVENTS_DDL, EXPORT_HOPS_SQL, IMPORT_CURSORS_SQL, IMPORT_CURSOR_OF_SQL, OUTBOX_MARK_SQL, exportedSinceQuery, IMPORT_CURSOR_ADVANCE_SQL, IMPORT_RECORD_SQL, moveImportCursor, importCursorSourceOf, exportBreaksOf, exportBreakRefusal, CrossVerticalRegistry, exportReadPlan, exportReadQuery, planExportBatch, withheldNote, JOB_RUN_DDL, jobRunListLimit, jobRunOf, runDueJobRuns, startJobRun, IDEMPOTENCY_DDL, assertIdempotencyKey, idempotencyLookupQuery, idempotencyPruneStatement, idempotencyRecordStatement, idempotencyOptedOutMessage, replayFor, globalFetch, createUlid, facetEvents, readHistory, walkEventCause, walkEventEffects, assertRedrainWindow, readInvocation, readDeadLetters, domainEventOf, readUndrainedOutbox, undrainedEventsOf, connectorCallRecord, noopConnectorCallRecorder, recordConnectorCall, settleConnectionUse, } from '@substrat-run/kernel';
 import { ScopeActor } from './actor.js';
 import { createTupleChecker } from './checker.js';
 /** The kernel's schedule-switch SQL (#1666), over one scope's database handle. */
@@ -512,7 +512,7 @@ export class SqliteScopeHost {
         mkdirSync(this.dir, { recursive: true });
         this.directory = new Database(join(this.dir, '_directory.sqlite'));
         this.directory.pragma('journal_mode = WAL');
-        this.applyDirectorySchema();
+        this.ensureDirectorySchema();
         this.loadRoles();
         this.checker =
             options.checker ??
@@ -968,6 +968,7 @@ export class SqliteScopeHost {
         PRIMARY KEY (scope_id, subject_id)
       );
       ${IMPERSONATION_DDL}
+      ${SYSTEM_SWITCHES_DDL}
       CREATE TABLE IF NOT EXISTS _substrat_admin_log (
         id TEXT PRIMARY KEY,
         actor TEXT NOT NULL,
@@ -1101,6 +1102,25 @@ export class SqliteScopeHost {
     `);
         this.ensureDirectoryColumns();
     }
+    /**
+     * `applyDirectorySchema`, plus the backfill of the schedule switch's record (#1674) from
+     * the admin log. Whether the table exists is asked BEFORE the DDL creates it, so the
+     * backfill runs only on an application that creates the table: once on a directory that
+     * never had it, and again after a directory restore whose dump predates it (from that
+     * dump's own log). A directory that already holds the table is never backfilled over.
+     *
+     * One transaction (Copilot review, #1674): the table and its backfill commit together, so
+     * a backfill that fails leaves no table behind, and the next start tries again rather than
+     * reading an empty table as already migrated.
+     */
+    ensureDirectorySchema() {
+        this.directory.transaction(() => {
+            const switchRecordIsNew = !systemSwitchesTableExists(switchSqlOf(this.directory));
+            this.applyDirectorySchema();
+            if (switchRecordIsNew)
+                this.directory.exec(SYSTEM_SWITCHES_BACKFILL_SQL);
+        })();
+    }
     registerExecutor(id, eventType, handler, retry) {
         if (this.executors.has(id))
             throw new Error(`executor '${id}' is already registered`);
@@ -1303,7 +1323,9 @@ export class SqliteScopeHost {
         this.crossVertical.register(manifest, registration.imports);
         this.modules.set(manifest.id, {
             id: manifest.id,
-            migrations: [...migrations, ...searchMigrations, ...listMigrations],
+            // The order the kernel writes once (#1677): authored, then search, then list indexes.
+            // The two derived sets are still computed above, for the duplicate-version refusals.
+            migrations: moduleMigrations(registration),
             consumers,
             schedules: manifest.schedules ?? [],
             freshness: manifest.freshness ?? [],
@@ -1484,12 +1506,38 @@ export class SqliteScopeHost {
                 const seat = seatScopeTuple(peer.subject, peer.relation, peer.object, null);
                 rt.db.prepare(seat.sql).run(...seat.params);
             }
+            // #1674: re-assert the recorded OFF positions after the seat, in the same turn
+            // (`system-switch-record.ts`).
+            this.reassertSwitchesInTurn(rt, actor, input.tenantId, input.scopeId);
         });
         // Audit a real provision only; an idempotent re-provision changed nothing.
         if (!existing) {
             this.recordAdmin(actor, 'provisionScope', { tenantId: input.tenantId, scopeId: input.scopeId, vertical: record.vertical }, null, record);
         }
     }
+    /**
+     * `HostAdmin.reassertSystemSwitches`' body (#1674), run inside a turn the caller already
+     * holds on the scope's actor: every module the directory records OFF on the scope is
+     * switched off again. Already off answers `changed: false` and writes nothing, and a
+     * module the scope does not hold is left alone. Audited only when something moved.
+     */
+    reassertSwitchesInTurn(rt, actor, tenantId, scopeId) {
+        const at = new Date().toISOString();
+        return switchedOffModulesOf(switchSqlOf(this.directory), tenantId, scopeId).map((moduleId) => {
+            const outcome = rt.db.transaction(() => switchSystemSchedules(switchSqlOf(rt.db), { moduleId, scopeId, to: 'off', at }))();
+            if (outcome.changed) {
+                this.recordAdmin(actor, 'reassertSystemSwitch', { tenantId, scopeId }, null, {
+                    operationId: ulid(),
+                    moduleId,
+                    schedules: 'off',
+                    phase: 'applied',
+                    changed: true,
+                    permissions: outcome.permissions,
+                });
+            }
+            return { moduleId, held: outcome.held, changed: outcome.changed };
+        });
+    }
     async provisionTenantStore(actor, input) {
         // Fail closed on an unknown/inactive tenant, exactly as provisionScope does: a store
         // for a tenant that does not exist is the same "FK string" hole (§4.1). A store is
@@ -2031,14 +2079,14 @@ export class SqliteScopeHost {
         // Restore never creates a scope (that is importScope) — an unknown target fails closed.
         const existing = await this.admin.getScopeRecord(actor, tenantId, scopeId);
         if (!existing)
-            throw new Error(`unknown scope ${scopeId} in tenant ${tenantId}`);
+            throw substratError('not_found', `unknown scope ${scopeId} in tenant ${tenantId}`);
         await this.loadDump(tenantId, scopeId, dump.tables);
         this.recordAdmin(actor, 'restoreScope', { tenantId, scopeId }, null, { sourceScopeId: dump.scopeId, tables: dump.tables.length, capturedAt: dump.capturedAt });
     }
     async snapshotScope(actor, tenantId, scopeId, opts) {
         const source = await this.admin.getScopeRecord(actor, tenantId, scopeId);
         if (!source)
-            throw new Error(`unknown scope ${scopeId} in tenant ${tenantId}`);
+            throw substratError('not_found', `unknown scope ${scopeId} in tenant ${tenantId}`);
         const dump = await this.admin.exportScope(actor, tenantId, scopeId);
         const snapshotId = ulid();
         await this.importScope(actor, {
@@ -2063,7 +2111,7 @@ export class SqliteScopeHost {
         // #509 ask (b)). A PRIMARY scope keeps the platform's tombstone-only rule (archive it).
         const rec = await this.admin.getScopeRecord(actor, tenantId, scopeId);
         if (!rec)
-            throw new Error(`unknown scope ${scopeId} in tenant ${tenantId}`);
+            throw substratError('not_found', `unknown scope ${scopeId} in tenant ${tenantId}`);
         if (!rec.forkedFrom && rec.kind !== 'preview') {
             throw new Error(`scope ${scopeId} is not a fork or preview — only previews may be deleted; ` +
                 `archive a primary scope instead`);
@@ -2078,6 +2126,7 @@ export class SqliteScopeHost {
         // orphaned bytes with no record (the §9 hazard).
         this.directory.prepare('DELETE FROM hostnames WHERE scope_id = ?').run(scopeId);
         rmSync(join(this.dir, `${tenantId}__${scopeId}.sqlite`), { force: true });
+        forgetSystemSwitchesOf(switchSqlOf(this.directory), scopeId);
         this.directory.prepare('DELETE FROM scopes WHERE scope_id = ?').run(scopeId);
         this.recordAdmin(actor, 'deleteSnapshot', { tenantId, scopeId }, null, {
             forkedFrom: rec.forkedFrom,
@@ -2091,7 +2140,7 @@ export class SqliteScopeHost {
             .prepare('SELECT tenant_id, status FROM scopes WHERE scope_id = ?')
             .get(scopeId);
         if (!row || row.tenant_id !== tenantId) {
-            throw new Error(`unknown scope for tenant: (${tenantId}, ${scopeId})`);
+            throw substratError('not_found', `unknown scope for tenant: (${tenantId}, ${scopeId})`);
         }
         // Lifecycle gates (control-plane.md §4.1/§4.2), all the K-3 fail-closed path.
         // The tenant record is mandatory: every scope has a tenant with a status
@@ -2152,7 +2201,7 @@ export class SqliteScopeHost {
         if (!scope || scope.tenant_id !== conn.tenant_id) {
             // Same wording as the principal path: a scope in another tenant is
             // indistinguishable from one that does not exist.
-            throw new Error(`unknown scope for connection: ${scopeId}`);
+            throw substratError('not_found', `unknown scope for connection: ${scopeId}`);
         }
         if (scope.vertical !== conn.vertical) {
             throw new Error(`connection ${connectionId} is for vertical '${conn.vertical}' and scope ${scopeId} ` +
@@ -2180,7 +2229,7 @@ export class SqliteScopeHost {
             .prepare('SELECT tenant_id, vertical, status FROM scopes WHERE scope_id = ?')
             .get(scopeId);
         if (!scope || scope.tenant_id !== conn.tenant_id) {
-            throw new Error(`unknown scope for connection: ${scopeId}`);
+            throw substratError('not_found', `unknown scope for connection: ${scopeId}`);
         }
         if (scope.vertical !== conn.vertical) {
             throw new Error(`connection ${connectionId} is for vertical '${conn.vertical}' and scope ${scopeId} ` +
@@ -2219,7 +2268,7 @@ export class SqliteScopeHost {
             .prepare('SELECT tenant_id, status FROM scopes WHERE scope_id = ?')
             .get(scopeId);
         if (!scope || scope.tenant_id !== tenantId) {
-            throw new Error(`unknown scope for tenant: (${tenantId}, ${scopeId})`);
+            throw substratError('not_found', `unknown scope for tenant: (${tenantId}, ${scopeId})`);
         }
         if (scope.status !== 'active') {
             throw new Error(`scope not active (status: ${scope.status}): ${scopeId}`);
@@ -2240,7 +2289,7 @@ export class SqliteScopeHost {
             .prepare('SELECT tenant_id, status FROM scopes WHERE scope_id = ?')
             .get(scopeId);
         if (!scope || scope.tenant_id !== tenantId) {
-            throw new Error(`unknown scope: ${scopeId}`);
+            throw substratError('not_found', `unknown scope: ${scopeId}`);
         }
         if (scope.status !== 'active') {
             throw new Error(`scope not active (status: ${scope.status}): ${scopeId}`);
@@ -2411,6 +2460,34 @@ export class SqliteScopeHost {
             return result;
         });
     }
+    /**
+     * A stored version's manifest, unaudited: the platform reading its own code metadata (#1705).
+     * `undefined` when the registry has no such version (under `slug`, when one is named).
+     */
+    manifestJsonOf(versionId, slug) {
+        const row = (slug === undefined
+            ? this.directory.prepare('SELECT manifest_json FROM vertical_versions WHERE id = ?').get(versionId)
+            : this.directory
+                .prepare('SELECT manifest_json FROM vertical_versions WHERE id = ? AND vertical_slug = ?')
+                .get(versionId, slug));
+        return row ? row.manifest_json : undefined;
+    }
+    /** #1705 PR 3: the promote gate's question, over two stored versions (`exportBreaksOf`). */
+    exportBreaksBetween(actor, producer, outgoingId, incomingId) {
+        return exportBreaksOf({
+            admin: this.admin,
+            actor,
+            producer,
+            outgoing: exportsOfManifestJson(this.manifestJsonOf(outgoingId)),
+            incoming: exportsOfManifestJson(this.manifestJsonOf(incomingId)),
+            readImports: async (slug, versionId) => {
+                const manifest = this.manifestJsonOf(versionId, slug);
+                if (manifest === undefined)
+                    throw substratError('not_found', `unknown version ${versionId} for vertical '${slug}'`);
+                return importsOfManifestJson(manifest);
+            },
+        });
+    }
     /**
      * The lifecycle gate the capability doors share (#1672): the scope must exist in this
      * tenant, the tenant must be active, the scope must be active — K-3's fail-closed pair
@@ -2826,6 +2903,11 @@ export class SqliteScopeHost {
                 // harness only after the enqueue task resolves — i.e. after COMMIT — so a
                 // rolled-back intent never signals.
                 const signals = { platformRequests: 0 };
+                // #1705 PR 2: exported-type rows this invoke (and its consumers' tail) committed, for
+                // `onExportedEvents`. Counted only in a deployment that exports something, and never
+                // for a read-only session, which commits nothing.
+                const exportTypes = session?.mode === 'read-only' ? [] : this.crossVertical.exportTypes();
+                let exported = 0;
                 // #129: read inside the transaction, reported after it commits — a tag
                 // handed out for writes that were rolled back is a tag nobody may hold.
                 let committedVersion;
@@ -2839,6 +2921,9 @@ export class SqliteScopeHost {
                     // `finally` so a later consumer carries none rather than the last caller's,
                     // which is the leak `causedBy` had to be moved off the host to avoid.
                     rt.invocationId = invokeOptions?.invocationId ?? null;
+                    // The outbox's insertion mark, inside the actor task so nothing else writes between it
+                    // and this invoke (`OUTBOX_MARK_SQL` says why rowid and not the id).
+                    const exportMark = exportTypes.length > 0 ? Number(rt.db.prepare(OUTBOX_MARK_SQL).get().mark) : null;
                     try {
                         // #1672: the capability door's session, re-resolved on EVERY invoke and inside the
                         // actor task — so nothing can revoke between this read and the transaction below.
@@ -2986,6 +3071,10 @@ export class SqliteScopeHost {
                             await this.dispatch(rt, rt.invocationId);
                             await this.dispatchExecutors(rt, rt.invocationId);
                         }
+                        if (exportMark !== null && !replayed) {
+                            const q = exportedSinceQuery(exportTypes, exportMark);
+                            exported = Number(rt.db.prepare(q.sql).get(...q.params).n);
+                        }
                         return structuredClone(result);
                     }
                     finally {
@@ -2999,6 +3088,8 @@ export class SqliteScopeHost {
                 });
                 if (signals.platformRequests > 0)
                     options?.onPlatformRequests?.(signals.platformRequests);
+                if (exported > 0)
+                    options?.onExportedEvents?.(exported);
                 if (committedVersion !== undefined)
                     invokeOptions?.onEntityVersion?.(committedVersion);
                 if (replayed)
@@ -3401,7 +3492,7 @@ export class SqliteScopeHost {
             .get(scopeId);
         // K-3: a scope under another tenant is indistinguishable from one that does not exist.
         if (!row || row.tenant_id !== tenantId) {
-            throw new Error(`unknown scope for tenant: (${tenantId}, ${scopeId})`);
+            throw substratError('not_found', `unknown scope for tenant: (${tenantId}, ${scopeId})`);
         }
         // `provisioning` allowed — a scope stuck there on a failed migration is a
         // sweep target. Suspended/archived are deliberate states; not disturbed.
@@ -3694,7 +3785,7 @@ export class SqliteScopeHost {
             .prepare('SELECT tenant_id FROM scopes WHERE scope_id = ?')
             .get(scopeId);
         if (!rec || rec.tenant_id !== tenantId) {
-            throw new Error(`unknown scope for tenant: (${tenantId}, ${scopeId})`);
+            throw substratError('not_found', `unknown scope for tenant: (${tenantId}, ${scopeId})`);
         }
     }
     /**
@@ -4009,33 +4100,40 @@ export class SqliteScopeHost {
                 .prepare('SELECT tenant_id, status, vertical FROM scopes WHERE scope_id = ?')
                 .get(scopeId);
             if (!row || row.tenant_id !== tenantId) {
-                throw new Error(`unknown scope for tenant: (${tenantId}, ${scopeId})`);
+                throw substratError('not_found', `unknown scope for tenant: (${tenantId}, ${scopeId})`);
             }
             if (!from.includes(row.status)) {
                 throw new Error(`illegal scope transition for ${action}: ${row.status} → ${to} ` +
                     `(allowed from: ${from.join('|')})`);
             }
-            // Stamp/clear archived_at so the reap sweep can age scopes (§4.4). Entering
-            // `archived` records when; `unarchive` (→ active, a restore) clears it so a later
-            // re-archive dates from the new event; `reaped` keeps it as terminal history.
-            if (to === 'archived') {
-                this.directory
-                    .prepare('UPDATE scopes SET status = ?, archived_at = ? WHERE scope_id = ?')
-                    .run(to, new Date().toISOString(), scopeId);
-            }
-            else if (to === 'active') {
-                this.directory
-                    .prepare('UPDATE scopes SET status = ?, archived_at = NULL WHERE scope_id = ?')
-                    .run(to, scopeId);
-            }
-            else {
-                this.directory.prepare('UPDATE scopes SET status = ? WHERE scope_id = ?').run(to, scopeId);
-            }
-            // The audit target carries the scope's vertical (control-plane.md §4.4:
-            // "vertical stays null until §4.2 lifecycle actions that name one"). It is
-            // read from the scope rather than passed in, so the trail cannot disagree
-            // with the directory about which deployment the action touched.
-            this.recordAdmin(actor, action, { tenantId, scopeId, vertical: row.vertical }, { status: row.status }, { status: to, ...afterExtra });
+            // One directory transaction: the status, the audit row and — on a reap — the scope's
+            // switch records (#1674). Reaped is terminal, so a cleanup that failed after the flip
+            // could never be retried; together, a failure leaves the scope where it was.
+            this.directory.transaction(() => {
+                // Stamp/clear archived_at so the reap sweep can age scopes (§4.4). Entering
+                // `archived` records when; `unarchive` (→ active, a restore) clears it so a later
+                // re-archive dates from the new event; `reaped` keeps it as terminal history.
+                if (to === 'archived') {
+                    this.directory
+                        .prepare('UPDATE scopes SET status = ?, archived_at = ? WHERE scope_id = ?')
+                        .run(to, new Date().toISOString(), scopeId);
+                }
+                else if (to === 'active') {
+                    this.directory
+                        .prepare('UPDATE scopes SET status = ?, archived_at = NULL WHERE scope_id = ?')
+                        .run(to, scopeId);
+                }
+                else {
+                    this.directory.prepare('UPDATE scopes SET status = ? WHERE scope_id = ?').run(to, scopeId);
+                }
+                if (to === 'reaped')
+                    forgetSystemSwitchesOf(switchSqlOf(this.directory), scopeId);
+                // The audit target carries the scope's vertical (control-plane.md §4.4:
+                // "vertical stays null until §4.2 lifecycle actions that name one"). It is
+                // read from the scope rather than passed in, so the trail cannot disagree
+                // with the directory about which deployment the action touched.
+                this.recordAdmin(actor, action, { tenantId, scopeId, vertical: row.vertical }, { status: row.status }, { status: to, ...afterExtra });
+            })();
         };
         const writeTenantTuple = (tenantId, subject, relation, object, expiresAt) => this.directory
             .prepare(`INSERT OR REPLACE INTO _substrat_tenant_tuples
@@ -4095,6 +4193,44 @@ export class SqliteScopeHost {
             const target = { tenantId, scopeId };
             const base = { operationId, moduleId: input.moduleId, schedules: to };
             this.recordAdmin(actor, action, target, null, { ...base, phase: 'intent', reason: input.reason });
+            // The directory's record (#1674): ON before the scope moves, OFF after it held — see
+            // `recordSystemSwitchedOn` for why that order is the safe one.
+            const at = new Date().toISOString();
+            const directorySql = switchSqlOf(this.directory);
+            const record = { tenantId, scopeId, moduleId: input.moduleId, actor, reason: input.reason, operationId, at };
+            const errorOf = (err) => (err instanceof Error ? err.message : String(err));
+            let prior = null;
+            if (to === 'on') {
+                try {
+                    prior = recordSystemSwitchedOn(directorySql, record);
+                }
+                catch (err) {
+                    // Nothing has moved: fail the call here, audited — the Cloudflare adapter's posture.
+                    try {
+                        this.recordAdmin(actor, action, target, null, { ...base, phase: 'failed', error: errorOf(err) });
+                    }
+                    catch {
+                        // Best effort: the original error is what the caller must see.
+                    }
+                    throw err;
+                }
+            }
+            /** A record write after the scope moved (review #5): retried once, never swallowed. */
+            const recordWrite = (write) => {
+                try {
+                    write();
+                    return null;
+                }
+                catch {
+                    try {
+                        write();
+                        return null;
+                    }
+                    catch (err) {
+                        return errorOf(err);
+                    }
+                }
+            };
             let outcome;
             try {
                 // A turn on the scope actor (#1666 review), exactly as the job store (#1577): `invoke`
@@ -4103,19 +4239,16 @@ export class SqliteScopeHost {
                 // with it — after this verb had already audited `applied`. `turn` is re-entrant, so a
                 // caller already inside one of this scope's tasks joins it rather than deadlocking.
                 const rt = this.runtime(tenantId, scopeId);
-                outcome = await rt.actor.turn(() => rt.db.transaction(() => switchSystemSchedules(switchSqlOf(rt.db), {
-                    moduleId: input.moduleId,
-                    scopeId,
-                    to,
-                    at: new Date().toISOString(),
-                }))());
+                outcome = await rt.actor.turn(() => rt.db.transaction(() => switchSystemSchedules(switchSqlOf(rt.db), { moduleId: input.moduleId, scopeId, to, at }))());
             }
             catch (err) {
+                const recordError = recordWrite(() => restoreSystemSwitchRecord(directorySql, record, prior));
                 try {
                     this.recordAdmin(actor, action, target, null, {
                         ...base,
                         phase: 'failed',
-                        error: err instanceof Error ? err.message : String(err),
+                        error: errorOf(err),
+                        ...(recordError ? { recordError } : {}),
                     });
                 }
                 catch {
@@ -4123,15 +4256,30 @@ export class SqliteScopeHost {
                 }
                 throw err;
             }
+            // OFF is recorded once the scope held it. A refused ON moved nothing, so its record
+            // write is undone: left `on`, the next reconcile of a wiped scope would leave the
+            // module running.
+            const recordError = to === 'off' && outcome.held
+                ? recordWrite(() => recordSystemSwitchedOff(directorySql, record))
+                : to === 'on' && !outcome.held
+                    ? recordWrite(() => restoreSystemSwitchRecord(directorySql, record, prior))
+                    : null;
             this.recordAdmin(actor, action, target, null, {
                 ...base,
                 phase: outcome.held ? 'applied' : 'refused',
                 changed: outcome.changed,
                 permissions: outcome.permissions,
+                ...(recordError ? { recordError } : {}),
             });
             if (!outcome.held) {
                 throw substratError('not_found', `scope ${scopeId} holds no system grant for module '${input.moduleId}' — nothing to switch ${to} ` +
-                    `(check the module id: it is the module's manifest id, e.g. '@substrat-run/engine-absence')`);
+                    `(check the module id: it is the module's manifest id, e.g. '@substrat-run/engine-absence')` +
+                    (recordError ? `; and its directory record could not be put back (${recordError})` : ''));
+            }
+            if (recordError) {
+                throw substratError('unavailable', `module '${input.moduleId}' is switched ${to} on scope ${scopeId}, but the directory's record of it ` +
+                    `could not be written (${recordError}) — repeat the call to record it; a wipe of this scope would ` +
+                    `otherwise lose the switch`);
             }
             return {
                 operationId,
@@ -4267,10 +4415,12 @@ export class SqliteScopeHost {
             const states = await rt.actor.turn(() => systemGrantsStatus(switchSqlOf(rt.db), new Date().toISOString()));
             const offModules = new Set(states.filter((s) => s.schedules === 'off').map((s) => s.moduleId));
             const explanations = offModules.size > 0 ? lastSwitchedOff(tenantId, scopeId, offModules) : new Map();
-            const result = states.map((s) => ({
+            const recorded = systemSwitchRecordsOf(switchSqlOf(this.directory), tenantId, scopeId);
+            const result = withRecorded(states, recorded).map((s) => ({
                 moduleId: s.moduleId,
                 schedules: s.schedules,
                 switchedOff: explanations.get(s.moduleId) ?? null,
+                recorded: s.recorded,
             }));
             // K-24: reading the switch's position and any live incident reason is itself
             // access-logged, the same as every other HostAdmin read.
@@ -4425,7 +4575,7 @@ export class SqliteScopeHost {
                             .prepare('SELECT tenant_id, vertical FROM scopes WHERE scope_id = ?')
                             .get(grant.node.scopeId);
                         if (!scope || scope.tenant_id !== grant.node.tenantId) {
-                            throw new Error(`unknown scope ${grant.node.scopeId} in tenant ${grant.node.tenantId}`);
+                            throw substratError('not_found', `unknown scope ${grant.node.scopeId} in tenant ${grant.node.tenantId}`);
                         }
                         if (scope.vertical !== conn.vertical) {
                             throw new Error(`connection ${grant.connectionId} is for vertical '${conn.vertical}' and scope ` +
@@ -4501,6 +4651,18 @@ export class SqliteScopeHost {
             // #1674: the switch's status read — same gate, the admin log to explain an `off`
             // entry. Nothing to delegate here: the pure adapter's scope storage IS the store.
             systemGrantsStatus: systemGrantsStatusOf,
+            // #1674: the switch's directory record — the fleet read, and the re-assert (whose body
+            // is `reassertSwitchesInTurn`; this is the scope check and the turn around it).
+            listSystemSwitches: async (actor, filter) => {
+                const rows = listSystemSwitchRecords(switchSqlOf(this.directory), filter);
+                this.recordAccess(actor, 'listSystemSwitches', { tenantId: filter?.tenantId ?? null }, filter ?? null, rows.length);
+                return rows.map((r) => systemSwitchRecord.parse(r));
+            },
+            reassertSystemSwitches: async (actor, node) => {
+                this.assertScope(node.tenantId, node.scopeId);
+                const rt = this.runtime(node.tenantId, node.scopeId);
+                return rt.actor.turn(() => this.reassertSwitchesInTurn(rt, actor, node.tenantId, node.scopeId));
+            },
             peerGrantsStatus: peerGrantsStatusOf,
             // #1672 — the platform's two capability verbs, both a turn on the scope actor
             // (#1678: every scope-level admin write takes one, so none lands mid-invoke inside a
@@ -4557,7 +4719,7 @@ export class SqliteScopeHost {
                     .prepare('SELECT tenant_id, vertical FROM scopes WHERE scope_id = ?')
                     .get(parsed.scopeId);
                 if (!scope || scope.tenant_id !== parsed.tenantId) {
-                    throw new Error(`unknown scope ${parsed.scopeId} in tenant ${parsed.tenantId}`);
+                    throw substratError('not_found', `unknown scope ${parsed.scopeId} in tenant ${parsed.tenantId}`);
                 }
                 const existing = this.directory
                     .prepare(`SELECT h.scope_id AS scope_id, s.status AS scope_status
@@ -4690,6 +4852,8 @@ export class SqliteScopeHost {
             resolveHostname: async (raw) => {
                 // The router's per-request read. No actor, not logged — same carve-out as
                 // resolveIdentity (K-24): this is a machine path, not a staff read.
+                // Like readRoute in Cloudflare, require an active binding, correctly paired
+                // active scope and active owning tenant. Refusal leaves the binding intact.
                 const hostname = raw.toLowerCase();
                 // Join the scope's dispatch script in the same read (orchestration.md §5.4).
                 // A scope on the stable serving script (#286) routes THERE; falls back to the
@@ -4704,11 +4868,13 @@ export class SqliteScopeHost {
                          THEN json_extract(sv.manifest_json, '$.outbound')
                          ELSE json_extract(vv.manifest_json, '$.outbound') END AS outbound_json
                FROM hostnames h
-               LEFT JOIN scopes s ON s.scope_id = h.scope_id
+               JOIN scopes s ON s.scope_id = h.scope_id AND s.tenant_id = h.tenant_id
+               JOIN tenants t ON t.tenant_id = s.tenant_id
                LEFT JOIN vertical_versions vv ON vv.id = s.vertical_version_id
                LEFT JOIN verticals vr ON vr.slug = s.vertical
                LEFT JOIN vertical_versions sv ON sv.id = vr.serving_version_id
-              WHERE h.hostname = ? AND h.status = 'active'`)
+              WHERE h.hostname = ? AND h.status = 'active'
+                AND s.status = 'active' AND t.status = 'active'`)
                     .get(hostname);
                 if (!r)
                     return undefined;
@@ -4974,6 +5140,18 @@ export class SqliteScopeHost {
                     note,
                 });
             },
+            promotionImpact: async (actor, verticalSlug, channel, versionId) => {
+                const incoming = readVersion(versionId);
+                if (!incoming || incoming.verticalSlug !== verticalSlug) {
+                    throw substratError('not_found', `unknown version ${versionId} for vertical '${verticalSlug}'`);
+                }
+                const current = this.directory
+                    .prepare('SELECT version_id FROM vertical_channels WHERE vertical_slug = ? AND channel = ?')
+                    .get(verticalSlug, channel);
+                const breaks = current ? await this.exportBreaksBetween(actor, verticalSlug, current.version_id, versionId) : [];
+                this.recordAccess(actor, 'promotionImpact', { tenantId: null }, { verticalSlug, channel, versionId }, breaks.length);
+                return breaks;
+            },
             promoteVersion: async (actor, verticalSlug, channel, versionId, acknowledge) => {
                 const incoming = readVersion(versionId);
                 if (!incoming)
@@ -5001,6 +5179,12 @@ export class SqliteScopeHost {
                         throw new Error(`promotion changes migrations (${outgoing.migrationDigest} → ` +
                             `${incoming.migrationDigest}) — acknowledge it explicitly to promote`);
                     }
+                    // #1705 PR 3: an export an installed consumer imports, dropped or re-versioned.
+                    if (!ack.exportBreak) {
+                        const breaks = await this.exportBreaksBetween(actor, verticalSlug, outgoing.id, incoming.id);
+                        if (breaks.length > 0)
+                            throw substratError('precondition_failed', exportBreakRefusal(breaks));
+                    }
                 }
                 const promotedAt = new Date().toISOString();
                 this.directory
@@ -5020,8 +5204,8 @@ export class SqliteScopeHost {
                 // promote) is a complete deploy and a rollback promote reaches the running
                 // app. D-30's lockstep concern is a SHARED vertical's many tenants, which a
                 // private vertical cannot have — this fires for no one else. Snapshots and
-                // forks (forked_from set) keep their frontier untouched, and a rebind that
-                // crosses a migration digest snapshots first (fork-before-promote, §4).
+                // forks (forked_from set) and all previews keep their frontier untouched. A rebind
+                // that crosses a migration digest snapshots first (fork-before-promote, §4).
                 //
                 // EXCEPTION (#321): a DISPATCH-BACKED vertical (its version has a
                 // `deploymentRef`) serves in place off a stable script. Rebinding a legacy
@@ -5036,7 +5220,7 @@ export class SqliteScopeHost {
                     if (owning && owning.ownerTenant !== null && !owning.listed) {
                         const bound = this.directory
                             .prepare(`SELECT scope_id, tenant_id, vertical_version_id FROM scopes
-                 WHERE vertical = ? AND tenant_id = ? AND status = 'active' AND forked_from IS NULL`)
+                 WHERE vertical = ? AND tenant_id = ? AND status = 'active' AND forked_from IS NULL AND kind != 'preview'`)
                             .all(verticalSlug, owning.ownerTenant);
                         for (const s of bound) {
                             if (s.vertical_version_id === versionId)
@@ -5112,7 +5296,7 @@ export class SqliteScopeHost {
                     .prepare('SELECT tenant_id, kind, vertical_version_id FROM scopes WHERE scope_id = ?')
                     .get(scopeId);
                 if (!scope || scope.tenant_id !== tenantId) {
-                    throw new Error(`unknown scope ${scopeId} in tenant ${tenantId}`);
+                    throw substratError('not_found', `unknown scope ${scopeId} in tenant ${tenantId}`);
                 }
                 // The refusal this registry exists for. Without it, "a push lands pending"
                 // is a convention, and D-30's argument is that we cannot afford conventions
@@ -5151,7 +5335,7 @@ export class SqliteScopeHost {
                     .prepare('SELECT tenant_id FROM scopes WHERE scope_id = ?')
                     .get(scopeId);
                 if (!scope || scope.tenant_id !== tenantId) {
-                    throw new Error(`unknown scope ${scopeId} in tenant ${tenantId}`);
+                    throw substratError('not_found', `unknown scope ${scopeId} in tenant ${tenantId}`);
                 }
                 this.directory
                     .prepare('UPDATE scopes SET provisioned_version_id = ? WHERE scope_id = ?')
@@ -5202,7 +5386,7 @@ export class SqliteScopeHost {
                     .prepare('SELECT tenant_id, serving_ref FROM scopes WHERE scope_id = ?')
                     .get(scopeId);
                 if (!scope || scope.tenant_id !== tenantId) {
-                    throw new Error(`unknown scope ${scopeId} in tenant ${tenantId}`);
+                    throw substratError('not_found', `unknown scope ${scopeId} in tenant ${tenantId}`);
                 }
                 this.directory
                     .prepare('UPDATE scopes SET serving_ref = ? WHERE scope_id = ?')
@@ -5214,7 +5398,7 @@ export class SqliteScopeHost {
                     .prepare('SELECT tenant_id, expires_at FROM scopes WHERE scope_id = ?')
                     .get(scopeId);
                 if (!scope || scope.tenant_id !== tenantId) {
-                    throw new Error(`unknown scope ${scopeId} in tenant ${tenantId}`);
+                    throw substratError('not_found', `unknown scope ${scopeId} in tenant ${tenantId}`);
                 }
                 this.directory
                     .prepare('UPDATE scopes SET expires_at = ? WHERE scope_id = ?')
@@ -5295,6 +5479,47 @@ export class SqliteScopeHost {
                 this.recordAccess(actor, 'importState', { tenantId, scopeId }, null, cursors.length);
                 return { consumes, cursors };
             },
+            moveImportCursor: async (actor, tenantId, scopeId, raw) => {
+                // #1705 PR 3: the replay lever. Parsed at the door: the acknowledgement literal is part
+                // of the input, and a move without it never reaches the store.
+                const move = importCursorMove.parse(raw);
+                this.assertScopeReachable(tenantId, scopeId);
+                const rec = this.directory.prepare('SELECT vertical FROM scopes WHERE scope_id = ?').get(scopeId);
+                const source = await importCursorSourceOf((t, v) => this.admin.resolveVerticalInstance(t, v), { tenantId, scopeId, vertical: rec.vertical }, move.from);
+                const replayId = ulid();
+                const target = { tenantId, scopeId };
+                const base = { replayId, mode: move.mode, from: move.from, source: source.scopeId };
+                this.recordAdmin(actor, 'moveImportCursor', target, null, { ...base, phase: 'intent', reason: move.reason });
+                let moved;
+                try {
+                    const rt = this.runtime(tenantId, scopeId);
+                    const now = Date.parse(this.clock());
+                    // One turn on the scope actor, which is where `deliverToPeer` runs: a delivery on this
+                    // edge is either wholly before the move or refused by its compare-and-set after it.
+                    moved = await rt.actor.turn(() => rt.db.transaction(() => moveImportCursor(switchSqlOf(rt.db), { move, source, replayId, now, imports: this.crossVertical.consumes() }))());
+                }
+                catch (err) {
+                    try {
+                        this.recordAdmin(actor, 'moveImportCursor', target, null, {
+                            ...base,
+                            phase: 'failed',
+                            error: err instanceof Error ? err.message : String(err),
+                        });
+                    }
+                    catch {
+                        // Best effort: the original error is what the caller must see.
+                    }
+                    throw err;
+                }
+                this.recordAdmin(actor, 'moveImportCursor', target, null, {
+                    ...base,
+                    phase: 'applied',
+                    previous: moved.previous,
+                    cursor: moved.cursor,
+                    archived: moved.archived,
+                });
+                return moved;
+            },
             redrainEvents: async (actor, tenantId, scopeId, input) => {
                 // Directory check first, on mark's reasoning: "nothing to reopen" and "you may not
                 // address this scope" are different answers.
@@ -5430,7 +5655,7 @@ export class SqliteScopeHost {
                     .prepare('SELECT tenant_id FROM scopes WHERE scope_id = ?')
                     .get(scopeId);
                 if (!scope || scope.tenant_id !== tenantId) {
-                    throw new Error(`unknown scope ${scopeId} in tenant ${tenantId}`);
+                    throw substratError('not_found', `unknown scope ${scopeId} in tenant ${tenantId}`);
                 }
                 // No PITR on plain SQLite — an empty list, not an error: there is simply
                 // nothing to offer. The backup/restore path (#278) is this host's rewind.
@@ -5850,7 +6075,7 @@ export class SqliteScopeHost {
                 })();
                 // Carry a copy taken before a directory migration forward to the running
                 // code's shape — the same assertion a cold start makes.
-                this.applyDirectorySchema();
+                this.ensureDirectorySchema();
                 // Roles are held in memory (`loadRoles`), so a restore that only rewrote the
                 // table would leave every permission check reading the PRE-restore roles until
                 // the process restarted — the exact silent-divergence a recovery must not have.
@@ -5890,7 +6115,7 @@ export class SqliteScopeHost {
                     .prepare('SELECT tenant_id, status FROM scopes WHERE scope_id = ?')
                     .get(scopeId);
                 if (!rec || rec.tenant_id !== tenantId) {
-                    throw new Error(`unknown scope for tenant: (${tenantId}, ${scopeId})`);
+                    throw substratError('not_found', `unknown scope for tenant: (${tenantId}, ${scopeId})`);
                 }
                 if (rec.status !== 'archived') {
                     throw new Error(`scope ${scopeId} is ${rec.status}, not archived — only an archived scope may be reaped`);
@@ -6072,6 +6297,7 @@ export class SqliteScopeHost {
                     '_substrat_roles', // operator-defined roles
                     '_substrat_entitlements', // per-tenant SKU flags
                     'orgs', // K-22 org records
+                    '_substrat_system_switches', // #1674: the schedule switch's record, per scope
                 ];
                 const clear = this.directory.transaction(() => {
                     for (const table of tables) {
@@ -7375,7 +7601,7 @@ export class SqliteScopeHost {
             tenantId: rt.tenantId,
             scopeId: rt.scopeId,
             principal,
-            sql: guardSecrets(scopedSql(rt.db), minted),
+            sql: guardSecrets(guardSqlLimits(scopedSql(rt.db)), minted),
             now: () => at,
             emit: (event) => {
                 assertImpersonationWrites(impersonation, 'ctx.emit');
@@ -7730,7 +7956,7 @@ export class SqliteScopeHost {
     assertScopeReachable(tenantId, scopeId) {
         const r = this.directory.prepare('SELECT tenant_id, status FROM scopes WHERE scope_id = ?').get(scopeId);
         if (!r || r.tenant_id !== tenantId)
-            throw new Error(`unknown scope for tenant: (${tenantId}, ${scopeId})`);
+            throw substratError('not_found', `unknown scope for tenant: (${tenantId}, ${scopeId})`);
         if (r.status === 'reaped') {
             throw new Error(`scope ${scopeId} is reaped — its storage is gone and cannot be read`);
         }