@substrat-run/adapter-sqlite 0.120.0 → 0.122.0

package/dist/index.js

@@ -1,10 +1,18 @@
 import { existsSync, mkdirSync, readdirSync, readFileSync, rmSync, writeFileSync } from 'node:fs';
 import { dirname, join } from 'node:path';
 import Database from 'better-sqlite3';
-import { accessLogEntry, adminLogEntry, opsFailureEntry, opsFailureFingerprint, issueEntry, FRESHNESS_HEARTBEAT_MINUTES, sweepRunEntry, modelUsageEntry, ATTACHMENT_ADDED, ATTACHMENT_REMOVED, attachmentRecord, createTenantInput, domainEvent, domainEventInput, exportReadInput, importBatch, entitlementGrant, entitlementGrantInput, eventId, meterReading, platformRequestInput, platformRequestId, MAX_PENDING_PLATFORM_REQUESTS, identityLink, identityPool, instant, connection, capabilityGrant, connectionGrant, connectionGrantRecord, connectionSecret, systemGrant, systemSwitch, peerSwitch, verticalCaller, verticalSlug as verticalSlugOf, subjectRef, requestFingerprint, createConnectionInput, projectedConnectionGrant, projectedConnectionKey, moduleManifest, createOrgInput, promotionAcknowledgement, bindHostnameInput, channelHistoryEntry, hostnameBinding, publishVersionInput, AUTO_ADMISSION_NOTE, routeTarget, registerVerticalInput, vertical as verticalSchema, verticalChannel, verticalVersion, objectRef, grantRefFromProof, org as orgSchema, orgMembership, principalId, resolvedIdentity, identityMembership, roleDefinition, scope as scopeSchema, tenant as tenantSchema, tenantRole, subjectShredReceipt, SCOPE_TABLE_PAGE_DEFAULT, SCOPE_TABLE_PAGE_MAX, SCOPE_QUERY_ROW_MAX, verticalServingState, callsOfManifestJson, outboundOfManifestJson, listLimitOf, substratError, assertReplayableDump, delegatedReadRecord, redrainEventsInput, REDRAIN_BATCH, } from '@substrat-run/contracts';
-import { actorOf, asPrincipal, assertAllowed, assertNoSecret, assertPermissionKey, CAPABILITY_DDL, CAPABILITY_EXCHANGE_OPERATION, capabilityAttachmentWriteRefused, capabilityTokenHash, createCapabilityVerbs, exchangeCapability as exchangeCapabilitySecret, guardSecrets, mintBecomeCapability, plausibleSessionToken, redactSecrets, resolveCapabilitySession, revokeCapabilityAsPlatform, assertReadOnlyQuery, attachmentBlobKey, entitlementDenial, foldMeterReading, guardSpine, parseValidationRecords, resolveScopeRecord, ulid, ISSUE_RETENTION_DAYS, OPS_FAILURE_RETENTION_DAYS, SWEEP_RUN_RETENTION_DAYS, SWEEP_RUNS_INTENT_INDEX, sweepRunsIntentHasKind, MODEL_USAGE_RETENTION_DAYS, foldModelUsage, backoffAt, platformRequestHistoryQuery, platformRequestOf, PLATFORM_REQUEST_COLUMNS, PLATFORM_REQUEST_REDACTION_SQL, platformRequestRedactionParams, platformRequestRedactionQuery, intentPayloadCarriesSubject, redactSubjectJobRuns, JOB_RUN_PATCH_SQL, JOB_STEP_RECORD_SQL, DELIVERY_ERROR_REDACTION_SQL, REDACTED_DELIVERY_NOTE, seatScopeTuple, switchSystemSchedules, admitPeer, collectPeers, peerSeats, resolveVerticalInstanceFrom, switchPeer, peerGrantsStatus, systemGrantsStatus, systemScheduleState, systemSwitchedOff, systemSwitchedOffMessage, denialListQuery, denialSummaryQuery, denialTotalsQuery, DENIAL_WINDOW_QUERY, mapDenialRow, mapDenialSummaryBuckets, IMPERSONATION_COLUMNS, IMPERSONATION_DDL, ImpersonationRefused, assertImpersonationWrites, assertModuleEnqueueableKind, assertSessionUsable, impersonationByIdQuery, impersonationListQuery, impersonationRowValues, impersonationStampOf, mapImpersonationRow, newImpersonationSession, resolveRetryPolicy, isSecretBoxConfigured, unconfiguredSecretBox, createSubjectKeys, generateSealingKeyPair, noSealingKeyMessage, openSealed, sealTo, ConnectionSealingKeyUnavailableError, PermissionDenied, createAtomic, NotSearchable, NotListable, listIndexMigrations, listIndexPlans, listQuery, cursorOf, isSearchIndexTable, searchIndexDdl, searchIndexMigrations, searchIndexPlans, searchLimit, searchMatchExpression, searchQuery, entityVersionQuery, entityVersionOf, assertIfMatch, OUTBOX_ENTITY_INDEX, SCHEDULE_STATE_DDL, SCHEDULE_STATE_REBUILD, scheduleStateHasKind, VERTICAL_EVENTS_DDL, EXPORT_HOPS_SQL, IMPORT_CURSORS_SQL, IMPORT_CURSOR_OF_SQL, IMPORT_CURSOR_ADVANCE_SQL, IMPORT_RECORD_SQL, CrossVerticalRegistry, exportReadPlan, exportReadQuery, planExportBatch, withheldNote, JOB_RUN_DDL, jobRunListLimit, jobRunOf, runDueJobRuns, startJobRun, IDEMPOTENCY_DDL, assertIdempotencyKey, idempotencyLookupQuery, idempotencyPruneStatement, idempotencyRecordStatement, idempotencyOptedOutMessage, replayFor, globalFetch, createUlid, facetEvents, readHistory, walkEventCause, walkEventEffects, assertRedrainWindow, readInvocation, readDeadLetters, domainEventOf, readUndrainedOutbox, undrainedEventsOf, connectorCallRecord, noopConnectorCallRecorder, recordConnectorCall, settleConnectionUse, } from '@substrat-run/kernel';
+import { accessLogEntry, adminLogEntry, opsFailureEntry, opsFailureFingerprint, issueEntry, FRESHNESS_HEARTBEAT_MINUTES, sweepRunEntry, modelUsageEntry, ATTACHMENT_ADDED, ATTACHMENT_REMOVED, attachmentRecord, createTenantInput, domainEvent, domainEventInput, exportReadInput, importBatch, importCursorMove, exportsOfManifestJson, importsOfManifestJson, entitlementGrant, entitlementGrantInput, eventId, meterReading, platformRequestInput, platformRequestId, MAX_PENDING_PLATFORM_REQUESTS, identityLink, identityPool, instant, connection, capabilityGrant, connectionGrant, connectionGrantRecord, connectionSecret, systemGrant, systemSwitch, systemSwitchRecord, peerSwitch, verticalCaller, verticalSlug as verticalSlugOf, subjectRef, requestFingerprint, createConnectionInput, projectedConnectionGrant, projectedConnectionKey, moduleManifest, createOrgInput, promotionAcknowledgement, bindAcknowledgement, bindHostnameInput, channelHistoryEntry, hostnameBinding, publishVersionInput, AUTO_ADMISSION_NOTE, routeTarget, registerVerticalInput, vertical as verticalSchema, verticalChannel, verticalVersion, objectRef, grantRefFromProof, org as orgSchema, orgMembership, principalId, resolvedIdentity, identityMembership, roleDefinition, scope as scopeSchema, tenant as tenantSchema, tenantRole, subjectShredReceipt, SCOPE_TABLE_PAGE_DEFAULT, SCOPE_TABLE_PAGE_MAX, SCOPE_QUERY_ROW_MAX, verticalServingState, callsOfManifestJson, outboundOfManifestJson, listLimitOf, substratError, assertReplayableDump, delegatedReadRecord, redrainEventsInput, REDRAIN_BATCH, } from '@substrat-run/contracts';
+import { actorOf, asPrincipal, assertAllowed, assertNoSecret, assertPermissionKey, CAPABILITY_DDL, CAPABILITY_EXCHANGE_OPERATION, capabilityAttachmentWriteRefused, capabilityTokenHash, createCapabilityVerbs, exchangeCapability as exchangeCapabilitySecret, guardSecrets, mintBecomeCapability, plausibleSessionToken, redactSecrets, resolveCapabilitySession, revokeCapabilityAsPlatform, assertReadOnlyQuery, attachmentBlobKey, entitlementDenial, foldMeterReading, guardSpine, guardSqlLimits, parseValidationRecords, resolveScopeRecord, ulid, ISSUE_RETENTION_DAYS, OPS_FAILURE_RETENTION_DAYS, SWEEP_RUN_RETENTION_DAYS, SWEEP_RUNS_INTENT_INDEX, sweepRunsIntentHasKind, MODEL_USAGE_RETENTION_DAYS, foldModelUsage, backoffAt, platformRequestHistoryQuery, platformRequestOf, PLATFORM_REQUEST_COLUMNS, PLATFORM_REQUEST_REDACTION_SQL, platformRequestRedactionParams, platformRequestRedactionQuery, intentPayloadCarriesSubject, redactSubjectJobRuns, JOB_RUN_PATCH_SQL, JOB_STEP_RECORD_SQL, DELIVERY_ERROR_REDACTION_SQL, REDACTED_DELIVERY_NOTE, seatScopeTuple, switchSystemSchedules, admitPeer, collectPeers, peerSeats, resolveVerticalInstanceFrom, switchPeer, peerGrantsStatus, systemGrantsStatus, systemScheduleState, systemSwitchedOff, systemSwitchedOffMessage, SYSTEM_SWITCHES_BACKFILL_SQL, SYSTEM_SWITCHES_DDL, forgetSystemSwitchesOf, listSystemSwitchRecords, recordSystemSwitchedOff, recordSystemSwitchedOn, restoreSystemSwitchRecord, switchedOffModulesOf, systemSwitchRecordsOf, systemSwitchesTableExists, withRecorded, VERSION_MIGRATIONS_DDL, splitManifestMigrations, splitVersionMigrationsBatch, versionMigrationsOf, writeVersionMigrations, denialListQuery, denialSummaryQuery, denialTotalsQuery, DENIAL_WINDOW_QUERY, mapDenialRow, mapDenialSummaryBuckets, IMPERSONATION_COLUMNS, IMPERSONATION_DDL, ImpersonationRefused, assertImpersonationWrites, assertModuleEnqueueableKind, assertSessionUsable, impersonationByIdQuery, impersonationListQuery, impersonationRowValues, impersonationStampOf, mapImpersonationRow, newImpersonationSession, resolveRetryPolicy, isSecretBoxConfigured, unconfiguredSecretBox, createSubjectKeys, generateSealingKeyPair, noSealingKeyMessage, openSealed, sealTo, ConnectionSealingKeyUnavailableError, PermissionDenied, createAtomic, NotSearchable, NotListable, listIndexMigrations, listIndexPlans, listQuery, cursorOf, moduleMigrations, isSearchIndexTable, searchIndexDdl, searchIndexMigrations, searchIndexPlans, searchLimit, searchMatchExpression, searchQuery, entityVersionQuery, entityVersionOf, assertIfMatch, OUTBOX_ENTITY_INDEX, SCHEDULE_STATE_DDL, SCHEDULE_STATE_REBUILD, scheduleStateHasKind, VERTICAL_EVENTS_DDL, EXPORT_HOPS_SQL, IMPORT_CURSORS_SQL, IMPORT_CURSOR_OF_SQL, OUTBOX_MARK_SQL, exportedSinceQuery, IMPORT_CURSOR_ADVANCE_SQL, IMPORT_RECORD_SQL, moveImportCursor, importCursorSourceOf, exportBreaksOf, exportBreakRefusal, bindExportBreaksOf, bindExportBreakRefusal, CrossVerticalRegistry, exportReadPlan, exportReadQuery, planExportBatch, withheldNote, JOB_RUN_DDL, jobRunListLimit, jobRunOf, runDueJobRuns, startJobRun, IDEMPOTENCY_DDL, assertIdempotencyKey, idempotencyLookupQuery, idempotencyPruneStatement, idempotencyRecordStatement, idempotencyOptedOutMessage, replayFor, globalFetch, createUlid, facetEvents, readHistory, walkEventCause, walkEventEffects, assertRedrainWindow, readInvocation, readDeadLetters, domainEventOf, readUndrainedOutbox, undrainedEventsOf, connectorCallRecord, noopConnectorCallRecorder, recordConnectorCall, settleConnectionUse, } from '@substrat-run/kernel';
 import { ScopeActor } from './actor.js';
 import { createTupleChecker } from './checker.js';
+/**
+ * A fault in the database itself (full, corrupt, I/O), as opposed to one statement failing.
+ * The #1764 backfill logs and opens past a failed batch, but never past one of these.
+ */
+export function isStorageFault(err) {
+    const code = err?.code;
+    return typeof code === 'string' && /^SQLITE_(FULL|CORRUPT|IOERR|NOTADB)/.test(code);
+}
 /** The kernel's schedule-switch SQL (#1666), over one scope's database handle. */
 const switchSqlOf = (db) => ({
     all: (sql, ...params) => db.prepare(sql).all(...params),
@@ -512,7 +520,7 @@ export class SqliteScopeHost {
         mkdirSync(this.dir, { recursive: true });
         this.directory = new Database(join(this.dir, '_directory.sqlite'));
         this.directory.pragma('journal_mode = WAL');
-        this.applyDirectorySchema();
+        this.ensureDirectorySchema();
         this.loadRoles();
         this.checker =
             options.checker ??
@@ -723,10 +731,16 @@ export class SqliteScopeHost {
         admission_note    TEXT,
         -- The pushed DeployManifest (JSON) — what a serve rebuilds upload metadata
         -- from (#286). NULL = pre-#286 push, archivable but never served in place.
+        -- Stored WITHOUT its SQL migrations, which live in vertical_version_migrations (#1764).
         manifest_json     TEXT,
+        -- How many migration rows the version stored. NULL = it carries no SQL to show.
+        migration_count   INTEGER,
+        -- 1 once the SQL is out of manifest_json. NULL = stored before #1764, not yet backfilled.
+        migrations_split  INTEGER,
         created_at        TEXT NOT NULL,
         UNIQUE (vertical_slug, version)
       );
+      ${VERSION_MIGRATIONS_DDL}
       -- Channels (#31 step 2): a named pointer per vertical. Promotion moves it,
       -- and promotion is where the migration and permission diffs fire — the
       -- moment a change reaches anyone, rather than the moment it was typed.
@@ -968,6 +982,7 @@ export class SqliteScopeHost {
         PRIMARY KEY (scope_id, subject_id)
       );
       ${IMPERSONATION_DDL}
+      ${SYSTEM_SWITCHES_DDL}
       CREATE TABLE IF NOT EXISTS _substrat_admin_log (
         id TEXT PRIMARY KEY,
         actor TEXT NOT NULL,
@@ -1101,6 +1116,48 @@ export class SqliteScopeHost {
     `);
         this.ensureDirectoryColumns();
     }
+    /**
+     * `applyDirectorySchema`, plus the backfill of the schedule switch's record (#1674) from
+     * the admin log. Whether the table exists is asked BEFORE the DDL creates it, so the
+     * backfill runs only on an application that creates the table: once on a directory that
+     * never had it, and again after a directory restore whose dump predates it (from that
+     * dump's own log). A directory that already holds the table is never backfilled over.
+     *
+     * One transaction (Copilot review, #1674): the table and its backfill commit together, so
+     * a backfill that fails leaves no table behind, and the next start tries again rather than
+     * reading an empty table as already migrated.
+     */
+    ensureDirectorySchema() {
+        this.directory.transaction(() => {
+            const switchRecordIsNew = !systemSwitchesTableExists(switchSqlOf(this.directory));
+            // #1764: `VERSION_MIGRATIONS_DDL` indexes these two columns, so a directory created
+            // before them needs them before `applyDirectorySchema` reaches that statement.
+            if (this.directory.prepare('PRAGMA table_info(vertical_versions)').all().length > 0) {
+                this.ensureColumn(this.directory, 'vertical_versions', 'migration_count', 'migration_count INTEGER');
+                this.ensureColumn(this.directory, 'vertical_versions', 'migrations_split', 'migrations_split INTEGER');
+            }
+            this.applyDirectorySchema();
+            if (switchRecordIsNew)
+                this.directory.exec(SYSTEM_SWITCHES_BACKFILL_SQL);
+        })();
+        // #1764: move the SQL out of every version stored before the split. A batch per
+        // transaction, the same resumable step the Durable-Object adapter runs per alarm. This
+        // adapter has no constructor budget to protect, so it runs them all on open. A batch that
+        // fails is logged and the rest left for the next open: the host must still open, and a
+        // version the backfill has not reached reads from its manifest.
+        const sql = switchSqlOf(this.directory);
+        try {
+            while (this.directory.transaction(() => splitVersionMigrationsBatch(sql))().more)
+                ;
+        }
+        catch (err) {
+            // The directory's own storage failing is not a backfill problem, and must not be
+            // opened past as one.
+            if (isStorageFault(err))
+                throw err;
+            console.error('substrat: version-migrations backfill failed; unsplit versions read from their manifests', err);
+        }
+    }
     registerExecutor(id, eventType, handler, retry) {
         if (this.executors.has(id))
             throw new Error(`executor '${id}' is already registered`);
@@ -1303,7 +1360,9 @@ export class SqliteScopeHost {
         this.crossVertical.register(manifest, registration.imports);
         this.modules.set(manifest.id, {
             id: manifest.id,
-            migrations: [...migrations, ...searchMigrations, ...listMigrations],
+            // The order the kernel writes once (#1677): authored, then search, then list indexes.
+            // The two derived sets are still computed above, for the duplicate-version refusals.
+            migrations: moduleMigrations(registration),
             consumers,
             schedules: manifest.schedules ?? [],
             freshness: manifest.freshness ?? [],
@@ -1484,12 +1543,38 @@ export class SqliteScopeHost {
                 const seat = seatScopeTuple(peer.subject, peer.relation, peer.object, null);
                 rt.db.prepare(seat.sql).run(...seat.params);
             }
+            // #1674: re-assert the recorded OFF positions after the seat, in the same turn
+            // (`system-switch-record.ts`).
+            this.reassertSwitchesInTurn(rt, actor, input.tenantId, input.scopeId);
         });
         // Audit a real provision only; an idempotent re-provision changed nothing.
         if (!existing) {
             this.recordAdmin(actor, 'provisionScope', { tenantId: input.tenantId, scopeId: input.scopeId, vertical: record.vertical }, null, record);
         }
     }
+    /**
+     * `HostAdmin.reassertSystemSwitches`' body (#1674), run inside a turn the caller already
+     * holds on the scope's actor: every module the directory records OFF on the scope is
+     * switched off again. Already off answers `changed: false` and writes nothing, and a
+     * module the scope does not hold is left alone. Audited only when something moved.
+     */
+    reassertSwitchesInTurn(rt, actor, tenantId, scopeId) {
+        const at = new Date().toISOString();
+        return switchedOffModulesOf(switchSqlOf(this.directory), tenantId, scopeId).map((moduleId) => {
+            const outcome = rt.db.transaction(() => switchSystemSchedules(switchSqlOf(rt.db), { moduleId, scopeId, to: 'off', at }))();
+            if (outcome.changed) {
+                this.recordAdmin(actor, 'reassertSystemSwitch', { tenantId, scopeId }, null, {
+                    operationId: ulid(),
+                    moduleId,
+                    schedules: 'off',
+                    phase: 'applied',
+                    changed: true,
+                    permissions: outcome.permissions,
+                });
+            }
+            return { moduleId, held: outcome.held, changed: outcome.changed };
+        });
+    }
     async provisionTenantStore(actor, input) {
         // Fail closed on an unknown/inactive tenant, exactly as provisionScope does: a store
         // for a tenant that does not exist is the same "FK string" hole (§4.1). A store is
@@ -2078,6 +2163,7 @@ export class SqliteScopeHost {
         // orphaned bytes with no record (the §9 hazard).
         this.directory.prepare('DELETE FROM hostnames WHERE scope_id = ?').run(scopeId);
         rmSync(join(this.dir, `${tenantId}__${scopeId}.sqlite`), { force: true });
+        forgetSystemSwitchesOf(switchSqlOf(this.directory), scopeId);
         this.directory.prepare('DELETE FROM scopes WHERE scope_id = ?').run(scopeId);
         this.recordAdmin(actor, 'deleteSnapshot', { tenantId, scopeId }, null, {
             forkedFrom: rec.forkedFrom,
@@ -2411,6 +2497,60 @@ export class SqliteScopeHost {
             return result;
         });
     }
+    /**
+     * A stored version's manifest, unaudited: the platform reading its own code metadata (#1705).
+     * `undefined` when the registry has no such version (under `slug`, when one is named).
+     */
+    manifestJsonOf(versionId, slug) {
+        const row = (slug === undefined
+            ? this.directory.prepare('SELECT manifest_json FROM vertical_versions WHERE id = ?').get(versionId)
+            : this.directory
+                .prepare('SELECT manifest_json FROM vertical_versions WHERE id = ? AND vertical_slug = ?')
+                .get(versionId, slug));
+        return row ? row.manifest_json : undefined;
+    }
+    /**
+     * #1756: the bind gate's question for one install (`bindExportBreaksOf`), from the directory.
+     * The serving pointer is read only when the scope is on a serving script before or after the
+     * move, the one case it decides anything.
+     */
+    bindBreaks(actor, scope, incoming, servingRef) {
+        const vertical = scope.vertical && (scope.servingRef || servingRef)
+            ? this.directory
+                .prepare('SELECT serving_ref, serving_version_id FROM verticals WHERE slug = ?')
+                .get(scope.vertical)
+            : undefined;
+        return bindExportBreaksOf({
+            admin: this.admin,
+            actor,
+            scope,
+            incoming: { id: incoming.id, verticalSlug: incoming.verticalSlug },
+            ...(servingRef !== undefined ? { servingRef } : {}),
+            serving: vertical?.serving_ref && vertical.serving_version_id
+                ? { ref: vertical.serving_ref, versionId: vertical.serving_version_id }
+                : null,
+            readExports: async (versionId) => exportsOfManifestJson(this.manifestJsonOf(versionId) ?? null),
+            readImports: async (slug, versionId) => this.versionImports(slug, versionId),
+        });
+    }
+    /** What one version of `slug` imports, from the registry; `not_found` for a version it does not know. */
+    versionImports(slug, versionId) {
+        const manifest = this.manifestJsonOf(versionId, slug);
+        if (manifest === undefined)
+            throw substratError('not_found', `unknown version ${versionId} for vertical '${slug}'`);
+        return importsOfManifestJson(manifest);
+    }
+    /** #1705 PR 3: the promote gate's question, over two stored versions (`exportBreaksOf`). */
+    exportBreaksBetween(actor, producer, outgoingId, incomingId) {
+        return exportBreaksOf({
+            admin: this.admin,
+            actor,
+            producer,
+            outgoing: exportsOfManifestJson(this.manifestJsonOf(outgoingId)),
+            incoming: exportsOfManifestJson(this.manifestJsonOf(incomingId)),
+            readImports: async (slug, versionId) => this.versionImports(slug, versionId),
+        });
+    }
     /**
      * The lifecycle gate the capability doors share (#1672): the scope must exist in this
      * tenant, the tenant must be active, the scope must be active — K-3's fail-closed pair
@@ -2610,8 +2750,9 @@ export class SqliteScopeHost {
             const observed = new Map();
             for (const row of rt.db
                 .prepare(`SELECT type, MAX(occurred_at) AS at FROM _substrat_outbox
-            WHERE type IN (${types.map(() => '?').join(', ')}) GROUP BY type`)
-                .all(...types)) {
+            WHERE type IN (SELECT value FROM json_each(?)) GROUP BY type`)
+                // One JSON array, the shape the DO twin needs for its 100-parameter limit (#1776).
+                .all(JSON.stringify(types))) {
                 if (row.at !== null)
                     observed.set(row.type, row.at);
             }
@@ -2826,6 +2967,11 @@ export class SqliteScopeHost {
                 // harness only after the enqueue task resolves — i.e. after COMMIT — so a
                 // rolled-back intent never signals.
                 const signals = { platformRequests: 0 };
+                // #1705 PR 2: exported-type rows this invoke (and its consumers' tail) committed, for
+                // `onExportedEvents`. Counted only in a deployment that exports something, and never
+                // for a read-only session, which commits nothing.
+                const exportTypes = session?.mode === 'read-only' ? [] : this.crossVertical.exportTypes();
+                let exported = 0;
                 // #129: read inside the transaction, reported after it commits — a tag
                 // handed out for writes that were rolled back is a tag nobody may hold.
                 let committedVersion;
@@ -2839,6 +2985,9 @@ export class SqliteScopeHost {
                     // `finally` so a later consumer carries none rather than the last caller's,
                     // which is the leak `causedBy` had to be moved off the host to avoid.
                     rt.invocationId = invokeOptions?.invocationId ?? null;
+                    // The outbox's insertion mark, inside the actor task so nothing else writes between it
+                    // and this invoke (`OUTBOX_MARK_SQL` says why rowid and not the id).
+                    const exportMark = exportTypes.length > 0 ? Number(rt.db.prepare(OUTBOX_MARK_SQL).get().mark) : null;
                     try {
                         // #1672: the capability door's session, re-resolved on EVERY invoke and inside the
                         // actor task — so nothing can revoke between this read and the transaction below.
@@ -2986,6 +3135,10 @@ export class SqliteScopeHost {
                             await this.dispatch(rt, rt.invocationId);
                             await this.dispatchExecutors(rt, rt.invocationId);
                         }
+                        if (exportMark !== null && !replayed) {
+                            const q = exportedSinceQuery(exportTypes, exportMark);
+                            exported = Number(rt.db.prepare(q.sql).get(...q.params).n);
+                        }
                         return structuredClone(result);
                     }
                     finally {
@@ -2999,6 +3152,8 @@ export class SqliteScopeHost {
                 });
                 if (signals.platformRequests > 0)
                     options?.onPlatformRequests?.(signals.platformRequests);
+                if (exported > 0)
+                    options?.onExportedEvents?.(exported);
                 if (committedVersion !== undefined)
                     invokeOptions?.onEntityVersion?.(committedVersion);
                 if (replayed)
@@ -3996,6 +4151,28 @@ export class SqliteScopeHost {
             archivedAt: r.archived_at ?? null,
             createdAt: r.created_at,
         });
+        // The (version, scope) pair a bind and its impact read both start from, and the refusals
+        // that come before any export-break question, in the order the bind makes them (#1756).
+        const bindTarget = (tenantId, scopeId, versionId) => {
+            const v = readVersion(versionId);
+            if (!v)
+                throw substratError('not_found', `unknown version ${versionId}`);
+            const scope = this.directory.prepare('SELECT * FROM scopes WHERE scope_id = ?').get(scopeId);
+            if (!scope || scope.tenant_id !== tenantId) {
+                throw substratError('not_found', `unknown scope ${scopeId} in tenant ${tenantId}`);
+            }
+            // The refusal this registry exists for. Without it, "a push lands pending"
+            // is a convention, and D-30's argument is that we cannot afford conventions
+            // where lockstep upgrades are the failure mode. Scoped to a SERVING bind, though:
+            // a PREVIEW fork serves no install (the builder's own tenant's data, non-canonical
+            // URL), so it may run pending PR code — the own-tenant blast radius that lets a
+            // private vertical self-admit, and what lets a LISTED vertical's builder keep
+            // previewing their own new code (issue #509 ask (d)).
+            if (v.admission !== 'admitted' && scope.kind !== 'preview') {
+                throw new Error(`version ${versionId} is ${v.admission}, not admitted — it cannot be bound to a scope`);
+            }
+            return { v, scope };
+        };
         // Scope lifecycle transition (control-plane.md §4.2): validate ownership,
         // enforce the legal transition graph (fail closed on an illegal one), flip
         // the status, and audit before/after. un-archive is just another entry here
@@ -4015,27 +4192,34 @@ export class SqliteScopeHost {
                 throw new Error(`illegal scope transition for ${action}: ${row.status} → ${to} ` +
                     `(allowed from: ${from.join('|')})`);
             }
-            // Stamp/clear archived_at so the reap sweep can age scopes (§4.4). Entering
-            // `archived` records when; `unarchive` (→ active, a restore) clears it so a later
-            // re-archive dates from the new event; `reaped` keeps it as terminal history.
-            if (to === 'archived') {
-                this.directory
-                    .prepare('UPDATE scopes SET status = ?, archived_at = ? WHERE scope_id = ?')
-                    .run(to, new Date().toISOString(), scopeId);
-            }
-            else if (to === 'active') {
-                this.directory
-                    .prepare('UPDATE scopes SET status = ?, archived_at = NULL WHERE scope_id = ?')
-                    .run(to, scopeId);
-            }
-            else {
-                this.directory.prepare('UPDATE scopes SET status = ? WHERE scope_id = ?').run(to, scopeId);
-            }
-            // The audit target carries the scope's vertical (control-plane.md §4.4:
-            // "vertical stays null until §4.2 lifecycle actions that name one"). It is
-            // read from the scope rather than passed in, so the trail cannot disagree
-            // with the directory about which deployment the action touched.
-            this.recordAdmin(actor, action, { tenantId, scopeId, vertical: row.vertical }, { status: row.status }, { status: to, ...afterExtra });
+            // One directory transaction: the status, the audit row and — on a reap — the scope's
+            // switch records (#1674). Reaped is terminal, so a cleanup that failed after the flip
+            // could never be retried; together, a failure leaves the scope where it was.
+            this.directory.transaction(() => {
+                // Stamp/clear archived_at so the reap sweep can age scopes (§4.4). Entering
+                // `archived` records when; `unarchive` (→ active, a restore) clears it so a later
+                // re-archive dates from the new event; `reaped` keeps it as terminal history.
+                if (to === 'archived') {
+                    this.directory
+                        .prepare('UPDATE scopes SET status = ?, archived_at = ? WHERE scope_id = ?')
+                        .run(to, new Date().toISOString(), scopeId);
+                }
+                else if (to === 'active') {
+                    this.directory
+                        .prepare('UPDATE scopes SET status = ?, archived_at = NULL WHERE scope_id = ?')
+                        .run(to, scopeId);
+                }
+                else {
+                    this.directory.prepare('UPDATE scopes SET status = ? WHERE scope_id = ?').run(to, scopeId);
+                }
+                if (to === 'reaped')
+                    forgetSystemSwitchesOf(switchSqlOf(this.directory), scopeId);
+                // The audit target carries the scope's vertical (control-plane.md §4.4:
+                // "vertical stays null until §4.2 lifecycle actions that name one"). It is
+                // read from the scope rather than passed in, so the trail cannot disagree
+                // with the directory about which deployment the action touched.
+                this.recordAdmin(actor, action, { tenantId, scopeId, vertical: row.vertical }, { status: row.status }, { status: to, ...afterExtra });
+            })();
         };
         const writeTenantTuple = (tenantId, subject, relation, object, expiresAt) => this.directory
             .prepare(`INSERT OR REPLACE INTO _substrat_tenant_tuples
@@ -4095,6 +4279,44 @@ export class SqliteScopeHost {
             const target = { tenantId, scopeId };
             const base = { operationId, moduleId: input.moduleId, schedules: to };
             this.recordAdmin(actor, action, target, null, { ...base, phase: 'intent', reason: input.reason });
+            // The directory's record (#1674): ON before the scope moves, OFF after it held — see
+            // `recordSystemSwitchedOn` for why that order is the safe one.
+            const at = new Date().toISOString();
+            const directorySql = switchSqlOf(this.directory);
+            const record = { tenantId, scopeId, moduleId: input.moduleId, actor, reason: input.reason, operationId, at };
+            const errorOf = (err) => (err instanceof Error ? err.message : String(err));
+            let prior = null;
+            if (to === 'on') {
+                try {
+                    prior = recordSystemSwitchedOn(directorySql, record);
+                }
+                catch (err) {
+                    // Nothing has moved: fail the call here, audited — the Cloudflare adapter's posture.
+                    try {
+                        this.recordAdmin(actor, action, target, null, { ...base, phase: 'failed', error: errorOf(err) });
+                    }
+                    catch {
+                        // Best effort: the original error is what the caller must see.
+                    }
+                    throw err;
+                }
+            }
+            /** A record write after the scope moved (review #5): retried once, never swallowed. */
+            const recordWrite = (write) => {
+                try {
+                    write();
+                    return null;
+                }
+                catch {
+                    try {
+                        write();
+                        return null;
+                    }
+                    catch (err) {
+                        return errorOf(err);
+                    }
+                }
+            };
             let outcome;
             try {
                 // A turn on the scope actor (#1666 review), exactly as the job store (#1577): `invoke`
@@ -4103,19 +4325,16 @@ export class SqliteScopeHost {
                 // with it — after this verb had already audited `applied`. `turn` is re-entrant, so a
                 // caller already inside one of this scope's tasks joins it rather than deadlocking.
                 const rt = this.runtime(tenantId, scopeId);
-                outcome = await rt.actor.turn(() => rt.db.transaction(() => switchSystemSchedules(switchSqlOf(rt.db), {
-                    moduleId: input.moduleId,
-                    scopeId,
-                    to,
-                    at: new Date().toISOString(),
-                }))());
+                outcome = await rt.actor.turn(() => rt.db.transaction(() => switchSystemSchedules(switchSqlOf(rt.db), { moduleId: input.moduleId, scopeId, to, at }))());
             }
             catch (err) {
+                const recordError = recordWrite(() => restoreSystemSwitchRecord(directorySql, record, prior));
                 try {
                     this.recordAdmin(actor, action, target, null, {
                         ...base,
                         phase: 'failed',
-                        error: err instanceof Error ? err.message : String(err),
+                        error: errorOf(err),
+                        ...(recordError ? { recordError } : {}),
                     });
                 }
                 catch {
@@ -4123,15 +4342,30 @@ export class SqliteScopeHost {
                 }
                 throw err;
             }
+            // OFF is recorded once the scope held it. A refused ON moved nothing, so its record
+            // write is undone: left `on`, the next reconcile of a wiped scope would leave the
+            // module running.
+            const recordError = to === 'off' && outcome.held
+                ? recordWrite(() => recordSystemSwitchedOff(directorySql, record))
+                : to === 'on' && !outcome.held
+                    ? recordWrite(() => restoreSystemSwitchRecord(directorySql, record, prior))
+                    : null;
             this.recordAdmin(actor, action, target, null, {
                 ...base,
                 phase: outcome.held ? 'applied' : 'refused',
                 changed: outcome.changed,
                 permissions: outcome.permissions,
+                ...(recordError ? { recordError } : {}),
             });
             if (!outcome.held) {
                 throw substratError('not_found', `scope ${scopeId} holds no system grant for module '${input.moduleId}' — nothing to switch ${to} ` +
-                    `(check the module id: it is the module's manifest id, e.g. '@substrat-run/engine-absence')`);
+                    `(check the module id: it is the module's manifest id, e.g. '@substrat-run/engine-absence')` +
+                    (recordError ? `; and its directory record could not be put back (${recordError})` : ''));
+            }
+            if (recordError) {
+                throw substratError('unavailable', `module '${input.moduleId}' is switched ${to} on scope ${scopeId}, but the directory's record of it ` +
+                    `could not be written (${recordError}) — repeat the call to record it; a wipe of this scope would ` +
+                    `otherwise lose the switch`);
             }
             return {
                 operationId,
@@ -4267,10 +4501,12 @@ export class SqliteScopeHost {
             const states = await rt.actor.turn(() => systemGrantsStatus(switchSqlOf(rt.db), new Date().toISOString()));
             const offModules = new Set(states.filter((s) => s.schedules === 'off').map((s) => s.moduleId));
             const explanations = offModules.size > 0 ? lastSwitchedOff(tenantId, scopeId, offModules) : new Map();
-            const result = states.map((s) => ({
+            const recorded = systemSwitchRecordsOf(switchSqlOf(this.directory), tenantId, scopeId);
+            const result = withRecorded(states, recorded).map((s) => ({
                 moduleId: s.moduleId,
                 schedules: s.schedules,
                 switchedOff: explanations.get(s.moduleId) ?? null,
+                recorded: s.recorded,
             }));
             // K-24: reading the switch's position and any live incident reason is itself
             // access-logged, the same as every other HostAdmin read.
@@ -4501,6 +4737,18 @@ export class SqliteScopeHost {
             // #1674: the switch's status read — same gate, the admin log to explain an `off`
             // entry. Nothing to delegate here: the pure adapter's scope storage IS the store.
             systemGrantsStatus: systemGrantsStatusOf,
+            // #1674: the switch's directory record — the fleet read, and the re-assert (whose body
+            // is `reassertSwitchesInTurn`; this is the scope check and the turn around it).
+            listSystemSwitches: async (actor, filter) => {
+                const rows = listSystemSwitchRecords(switchSqlOf(this.directory), filter);
+                this.recordAccess(actor, 'listSystemSwitches', { tenantId: filter?.tenantId ?? null }, filter ?? null, rows.length);
+                return rows.map((r) => systemSwitchRecord.parse(r));
+            },
+            reassertSystemSwitches: async (actor, node) => {
+                this.assertScope(node.tenantId, node.scopeId);
+                const rt = this.runtime(node.tenantId, node.scopeId);
+                return rt.actor.turn(() => this.reassertSwitchesInTurn(rt, actor, node.tenantId, node.scopeId));
+            },
             peerGrantsStatus: peerGrantsStatusOf,
             // #1672 — the platform's two capability verbs, both a turn on the scope actor
             // (#1678: every scope-level admin write takes one, so none lands mid-invoke inside a
@@ -4817,13 +5065,19 @@ export class SqliteScopeHost {
                 // The manifest is retained for the serving upload (#286), not audited — a whole
                 // manifest per publish would drown the admin log in bundle metadata.
                 const { manifestJson, origin, ...audited } = parsed;
-                this.directory
-                    .prepare(`INSERT INTO vertical_versions
-               (id, vertical_slug, version, manifest_digest, permission_digest,
-                migration_digest, deployment_ref, admission, admission_note, manifest_json,
-                origin_json, created_at)
-             VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`)
-                    .run(audited.id, audited.verticalSlug, audited.version, audited.manifestDigest, audited.permissionDigest, audited.migrationDigest, audited.deploymentRef, selfAdmits ? 'admitted' : 'pending', selfAdmits ? AUTO_ADMISSION_NOTE : null, manifestJson ?? null, origin ? JSON.stringify(origin) : null, new Date().toISOString());
+                // The SQL migrations are stored apart from the manifest (#1764), so no read of the
+                // version but the promote review's carries them.
+                const split = splitManifestMigrations(manifestJson ?? null, 'push');
+                this.directory.transaction(() => {
+                    this.directory
+                        .prepare(`INSERT INTO vertical_versions
+                 (id, vertical_slug, version, manifest_digest, permission_digest,
+                  migration_digest, deployment_ref, admission, admission_note, manifest_json,
+                  origin_json, migration_count, migrations_split, created_at)
+               VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, 1, ?)`)
+                        .run(audited.id, audited.verticalSlug, audited.version, audited.manifestDigest, audited.permissionDigest, audited.migrationDigest, audited.deploymentRef, selfAdmits ? 'admitted' : 'pending', selfAdmits ? AUTO_ADMISSION_NOTE : null, split.manifestJson, origin ? JSON.stringify(origin) : null, split.migrations?.length ?? null, new Date().toISOString());
+                    writeVersionMigrations(switchSqlOf(this.directory), audited.id, split.migrations);
+                })();
                 this.recordAdmin(actor, 'publishVersion', { tenantId: null }, null, {
                     ...audited,
                     ...(origin ? { origin } : {}),
@@ -4929,6 +5183,10 @@ export class SqliteScopeHost {
                 // cleanup script (#248), never destroyed alongside a registry row.
                 this.directory.prepare('DELETE FROM vertical_channels WHERE vertical_slug = ?').run(slug);
                 this.directory.prepare('DELETE FROM vertical_channel_history WHERE vertical_slug = ?').run(slug);
+                this.directory
+                    .prepare(`DELETE FROM vertical_version_migrations
+              WHERE version_id IN (SELECT id FROM vertical_versions WHERE vertical_slug = ?)`)
+                    .run(slug);
                 this.directory.prepare('DELETE FROM vertical_versions WHERE vertical_slug = ?').run(slug);
                 this.directory.prepare('DELETE FROM verticals WHERE slug = ?').run(slug);
                 this.recordAdmin(actor, 'deleteVertical', { tenantId: null }, { slug, source: existing.source, ownerTenant: existing.ownerTenant }, null);
@@ -4978,6 +5236,18 @@ export class SqliteScopeHost {
                     note,
                 });
             },
+            promotionImpact: async (actor, verticalSlug, channel, versionId) => {
+                const incoming = readVersion(versionId);
+                if (!incoming || incoming.verticalSlug !== verticalSlug) {
+                    throw substratError('not_found', `unknown version ${versionId} for vertical '${verticalSlug}'`);
+                }
+                const current = this.directory
+                    .prepare('SELECT version_id FROM vertical_channels WHERE vertical_slug = ? AND channel = ?')
+                    .get(verticalSlug, channel);
+                const breaks = current ? await this.exportBreaksBetween(actor, verticalSlug, current.version_id, versionId) : [];
+                this.recordAccess(actor, 'promotionImpact', { tenantId: null }, { verticalSlug, channel, versionId }, breaks.length);
+                return breaks;
+            },
             promoteVersion: async (actor, verticalSlug, channel, versionId, acknowledge) => {
                 const incoming = readVersion(versionId);
                 if (!incoming)
@@ -5005,6 +5275,12 @@ export class SqliteScopeHost {
                         throw new Error(`promotion changes migrations (${outgoing.migrationDigest} → ` +
                             `${incoming.migrationDigest}) — acknowledge it explicitly to promote`);
                     }
+                    // #1705 PR 3: an export an installed consumer imports, dropped or re-versioned.
+                    if (!ack.exportBreak) {
+                        const breaks = await this.exportBreaksBetween(actor, verticalSlug, outgoing.id, incoming.id);
+                        if (breaks.length > 0)
+                            throw substratError('precondition_failed', exportBreakRefusal(breaks));
+                    }
                 }
                 const promotedAt = new Date().toISOString();
                 this.directory
@@ -5108,25 +5384,21 @@ export class SqliteScopeHost {
                     at: r.at,
                 }));
             },
+            bindingImpact: async (actor, tenantId, scopeId, versionId, opts) => {
+                const { v, scope } = bindTarget(tenantId, scopeId, versionId);
+                const breaks = await this.bindBreaks(actor, mapScope(scope), v, opts?.servingRef);
+                this.recordAccess(actor, 'bindingImpact', { tenantId, scopeId }, { versionId, ...opts }, breaks.length);
+                return breaks;
+            },
             bindScopeVersion: async (actor, tenantId, scopeId, versionId, opts) => {
-                const v = readVersion(versionId);
-                if (!v)
-                    throw substratError('not_found', `unknown version ${versionId}`);
-                const scope = this.directory
-                    .prepare('SELECT tenant_id, kind, vertical_version_id FROM scopes WHERE scope_id = ?')
-                    .get(scopeId);
-                if (!scope || scope.tenant_id !== tenantId) {
-                    throw substratError('not_found', `unknown scope ${scopeId} in tenant ${tenantId}`);
-                }
-                // The refusal this registry exists for. Without it, "a push lands pending"
-                // is a convention, and D-30's argument is that we cannot afford conventions
-                // where lockstep upgrades are the failure mode. Scoped to a SERVING bind, though:
-                // a PREVIEW fork serves no install (the builder's own tenant's data, non-canonical
-                // URL), so it may run pending PR code — the own-tenant blast radius that lets a
-                // private vertical self-admit, and what lets a LISTED vertical's builder keep
-                // previewing their own new code (issue #509 ask (d)).
-                if (v.admission !== 'admitted' && scope.kind !== 'preview') {
-                    throw new Error(`version ${versionId} is ${v.admission}, not admitted — it cannot be bound to a scope`);
+                const { v, scope } = bindTarget(tenantId, scopeId, versionId);
+                const ack = bindAcknowledgement.parse(opts?.acknowledge ?? {});
+                // #1756: an export an app in this tenant imports, dropped or re-versioned by what this
+                // scope would run. Before the snapshot, so a refused bind leaves nothing behind.
+                if (!ack.exportBreak) {
+                    const breaks = await this.bindBreaks(actor, mapScope(scope), v);
+                    if (breaks.length > 0)
+                        throw substratError('precondition_failed', bindExportBreakRefusal(breaks));
                 }
                 // Fork-before-promote (§4): snapshot the pre-migration data if this rebind
                 // crosses a migration boundary. Gated on a real digest change — a code-only
@@ -5144,6 +5416,7 @@ export class SqliteScopeHost {
                     versionId,
                     vertical: v.verticalSlug,
                     version: v.version,
+                    ...(ack.exportBreak ? { acknowledged: ack } : {}),
                 });
             },
             /**
@@ -5201,17 +5474,32 @@ export class SqliteScopeHost {
                 this.recordAccess(actor, 'versionManifest', {}, { verticalSlug, versionId }, v.manifest_json ? 1 : 0);
                 return v.manifest_json;
             },
-            setScopeServingRef: async (actor, tenantId, scopeId, servingRef) => {
-                const scope = this.directory
-                    .prepare('SELECT tenant_id, serving_ref FROM scopes WHERE scope_id = ?')
-                    .get(scopeId);
+            versionMigrations: async (actor, verticalSlug, versionId) => {
+                const v = versionMigrationsOf(switchSqlOf(this.directory), versionId);
+                if (!v || v.verticalSlug !== verticalSlug) {
+                    throw substratError('not_found', `unknown version ${versionId} for vertical '${verticalSlug}'`);
+                }
+                this.recordAccess(actor, 'versionMigrations', {}, { verticalSlug, versionId }, v.migrations?.length ?? 0);
+                return v.migrations;
+            },
+            setScopeServingRef: async (actor, tenantId, scopeId, servingRef, opts) => {
+                const scope = this.directory.prepare('SELECT * FROM scopes WHERE scope_id = ?').get(scopeId);
                 if (!scope || scope.tenant_id !== tenantId) {
                     throw substratError('not_found', `unknown scope ${scopeId} in tenant ${tenantId}`);
                 }
+                const ack = bindAcknowledgement.parse(opts?.acknowledge ?? {});
+                // #1756: onto (or off) a serving script, the scope runs other code before its pointer
+                // moves. Judged here, so no caller that routes first and binds second passes unasked.
+                const bound = scope.vertical_version_id ? readVersion(scope.vertical_version_id) : undefined;
+                if (!ack.exportBreak && bound) {
+                    const breaks = await this.bindBreaks(actor, mapScope(scope), bound, servingRef);
+                    if (breaks.length > 0)
+                        throw substratError('precondition_failed', bindExportBreakRefusal(breaks));
+                }
                 this.directory
                     .prepare('UPDATE scopes SET serving_ref = ? WHERE scope_id = ?')
                     .run(servingRef, scopeId);
-                this.recordAdmin(actor, 'setScopeServingRef', { tenantId, scopeId }, { servingRef: scope.serving_ref }, { servingRef });
+                this.recordAdmin(actor, 'setScopeServingRef', { tenantId, scopeId }, { servingRef: scope.serving_ref }, { servingRef, ...(ack.exportBreak ? { acknowledged: ack } : {}) });
             },
             setScopeExpiresAt: async (actor, tenantId, scopeId, expiresAt) => {
                 const scope = this.directory
@@ -5299,6 +5587,47 @@ export class SqliteScopeHost {
                 this.recordAccess(actor, 'importState', { tenantId, scopeId }, null, cursors.length);
                 return { consumes, cursors };
             },
+            moveImportCursor: async (actor, tenantId, scopeId, raw) => {
+                // #1705 PR 3: the replay lever. Parsed at the door: the acknowledgement literal is part
+                // of the input, and a move without it never reaches the store.
+                const move = importCursorMove.parse(raw);
+                this.assertScopeReachable(tenantId, scopeId);
+                const rec = this.directory.prepare('SELECT vertical FROM scopes WHERE scope_id = ?').get(scopeId);
+                const source = await importCursorSourceOf((t, v) => this.admin.resolveVerticalInstance(t, v), { tenantId, scopeId, vertical: rec.vertical }, move.from);
+                const replayId = ulid();
+                const target = { tenantId, scopeId };
+                const base = { replayId, mode: move.mode, from: move.from, source: source.scopeId };
+                this.recordAdmin(actor, 'moveImportCursor', target, null, { ...base, phase: 'intent', reason: move.reason });
+                let moved;
+                try {
+                    const rt = this.runtime(tenantId, scopeId);
+                    const now = Date.parse(this.clock());
+                    // One turn on the scope actor, which is where `deliverToPeer` runs: a delivery on this
+                    // edge is either wholly before the move or refused by its compare-and-set after it.
+                    moved = await rt.actor.turn(() => rt.db.transaction(() => moveImportCursor(switchSqlOf(rt.db), { move, source, replayId, now, imports: this.crossVertical.consumes() }))());
+                }
+                catch (err) {
+                    try {
+                        this.recordAdmin(actor, 'moveImportCursor', target, null, {
+                            ...base,
+                            phase: 'failed',
+                            error: err instanceof Error ? err.message : String(err),
+                        });
+                    }
+                    catch {
+                        // Best effort: the original error is what the caller must see.
+                    }
+                    throw err;
+                }
+                this.recordAdmin(actor, 'moveImportCursor', target, null, {
+                    ...base,
+                    phase: 'applied',
+                    previous: moved.previous,
+                    cursor: moved.cursor,
+                    archived: moved.archived,
+                });
+                return moved;
+            },
             redrainEvents: async (actor, tenantId, scopeId, input) => {
                 // Directory check first, on mark's reasoning: "nothing to reopen" and "you may not
                 // address this scope" are different answers.
@@ -5605,8 +5934,9 @@ export class SqliteScopeHost {
                     // than degenerating into an unfiltered read of the whole fleet.
                     if (statuses.length === 0)
                         return [];
-                    where.push(`status IN (${statuses.map(() => '?').join(', ')})`);
-                    params.push(...statuses);
+                    // One JSON array, the shape the DO twin needs for its 100-parameter limit (#1776).
+                    where.push('status IN (SELECT value FROM json_each(?))');
+                    params.push(JSON.stringify(statuses));
                 }
                 if (filter?.vertical) {
                     where.push('vertical = ?');
@@ -5854,7 +6184,7 @@ export class SqliteScopeHost {
                 })();
                 // Carry a copy taken before a directory migration forward to the running
                 // code's shape — the same assertion a cold start makes.
-                this.applyDirectorySchema();
+                this.ensureDirectorySchema();
                 // Roles are held in memory (`loadRoles`), so a restore that only rewrote the
                 // table would leave every permission check reading the PRE-restore roles until
                 // the process restarted — the exact silent-divergence a recovery must not have.
@@ -6076,6 +6406,7 @@ export class SqliteScopeHost {
                     '_substrat_roles', // operator-defined roles
                     '_substrat_entitlements', // per-tenant SKU flags
                     'orgs', // K-22 org records
+                    '_substrat_system_switches', // #1674: the schedule switch's record, per scope
                 ];
                 const clear = this.directory.transaction(() => {
                     for (const table of tables) {
@@ -6657,8 +6988,9 @@ export class SqliteScopeHost {
                     const actions = Array.isArray(filter.action) ? filter.action : [filter.action];
                     if (actions.length === 0)
                         return []; // no action is acceptable — match nothing
-                    where.push(`action IN (${actions.map(() => '?').join(', ')})`);
-                    params.push(...actions);
+                    // One JSON array, the shape the DO twin needs for its 100-parameter limit (#1776).
+                    where.push('action IN (SELECT value FROM json_each(?))');
+                    params.push(JSON.stringify(actions));
                 }
                 if (filter?.since) {
                     where.push('at >= ?');
@@ -7152,6 +7484,8 @@ export class SqliteScopeHost {
         this.ensureColumn(this.directory, 'vertical_versions', 'manifest_json', 'manifest_json TEXT');
         // Push provenance (git CI vs a terminal) — null for a pre-tracking push.
         this.ensureColumn(this.directory, 'vertical_versions', 'origin_json', 'origin_json TEXT');
+        // #1764's `migration_count` and `migrations_split` are added in `ensureDirectorySchema`,
+        // BEFORE the DDL, because `VERSION_MIGRATIONS_DDL` indexes one of them.
         // #33: the SKU flag learns to express a plan. All nullable — a legacy row
         // reads as a perpetual boolean flag, exactly its pre-widening semantics.
         for (const [col, ddl] of [
@@ -7379,7 +7713,7 @@ export class SqliteScopeHost {
             tenantId: rt.tenantId,
             scopeId: rt.scopeId,
             principal,
-            sql: guardSecrets(scopedSql(rt.db), minted),
+            sql: guardSecrets(guardSqlLimits(scopedSql(rt.db)), minted),
             now: () => at,
             emit: (event) => {
                 assertImpersonationWrites(impersonation, 'ctx.emit');