@substrat-run/adapter-sqlite 0.137.0 → 0.138.0

package/dist/index.js

@@ -1,13 +1,13 @@
 import { existsSync, mkdirSync, readdirSync, readFileSync, rmSync, writeFileSync } from 'node:fs';
 import { dirname, join } from 'node:path';
 import Database from 'better-sqlite3';
-import { accessLogEntry, adminLogEntry, delegatedReadParams, opsFailureEntry, opsFailureFingerprint, issueEntry, FRESHNESS_HEARTBEAT_MINUTES, sweepRunEntry, modelUsageEntry, ATTACHMENT_ADDED, ATTACHMENT_REMOVED, attachmentRecord, createTenantInput, domainEvent, domainEventInput, exportReadInput, importBatch, importCursorMove, exportsOfManifestJson, importsOfManifestJson, entitlementGrant, entitlementGrantInput, eventId, meterReading, platformRequestInput, platformRequestId, MAX_PENDING_PLATFORM_REQUESTS, identityLink, identityPool, instant, connection, capabilityGrant, connectionGrant, connectionGrantRecord, connectionSecret, systemGrant, systemSwitch, systemSwitchRecord, peerSwitch, verticalCaller, verticalSlug as verticalSlugOf, subjectRef, requestFingerprint, createConnectionInput, projectedConnectionGrant, projectedConnectionKey, moduleManifest, createOrgInput, promotionAcknowledgement, bindAcknowledgement, bindHostnameInput, channelHistoryEntry, hostnameBinding, publishVersionInput, AUTO_ADMISSION_NOTE, routeTarget, ROUTE_SCOPE_HOSTNAMES_MAX, registerVerticalInput, vertical as verticalSchema, verticalChannel, verticalVersion, objectRef, entityObjectRef, assertModuleEmittableType, assertKernelAuthoredType, grantRefFromProof, org as orgSchema, orgMembership, principalId, resolvedIdentity, identityMembership, roleDefinition, scope as scopeSchema, tenant as tenantSchema, tenantRole, subjectShredReceipt, SCOPE_TABLE_PAGE_DEFAULT, SCOPE_TABLE_PAGE_MAX, SCOPE_QUERY_ROW_MAX, verticalServingState, callsOfManifestJson, outboundOfManifestJson, listLimitOf, substratError, assertReplayableDump, delegatedReadRecord, ownerTransferAudit, copyMarkAudit, redrainEventsInput, REDRAIN_BATCH, } from '@substrat-run/contracts';
-import { actorOf, asPrincipal, assertAllowed, assertNoSecret, assertPermissionKey, CAPABILITY_DDL, COPY_ORIGIN_DDL, CAPABILITY_EXCHANGE_OPERATION, capabilityAttachmentWriteRefused, capabilityTokenHash, createCapabilityVerbs, createEntityEdgeVerbs, exchangeCapability as exchangeCapabilitySecret, guardSecrets, mintBecomeCapability, plausibleSessionToken, readCapabilityPage, redactSecrets, redactSecretText, moduleLog, consoleLogSink, asyncInvocationId, asyncLinePass, consoleInvocationLineSink, resolveCapabilitySession, revokeCapabilityAsPlatform, assertReadOnlyQuery, attachmentBlobKey, attachmentSha256, entitlementDenial, requiredEntitlementFor, foldMeterReading, guardSpine, guardSqlLimits, DO_SQL_LIMITS, tooManyResultColumns, tooManyTableColumns, parseValidationRecords, resolveScopeRecord, ulid, ISSUE_RETENTION_DAYS, telemetryRetentionStatements, assertRowLimit, assertRowOffset, OPS_FAILURE_RETENTION_DAYS, SWEEP_RUN_RETENTION_DAYS, SWEEP_RUNS_INTENT_INDEX, sweepRunsIntentHasKind, MODEL_USAGE_RETENTION_DAYS, foldModelUsage, backoffAt, platformRequestHistoryQuery, platformRequestOf, PLATFORM_REQUEST_COLUMNS, PLATFORM_REQUEST_REDACTION_SQL, platformRequestRedactionParams, platformRequestRedactionQuery, intentPayloadCarriesSubject, redactSubjectJobRuns, redactSubjectScopeText, redactSubjectDirectoryText, ISSUE_EXEMPLAR_OWNER_BACKFILL_SQL, issueExemplarOwner, JOB_RUN_PATCH_SQL, JOB_STEP_RECORD_SQL, DELIVERY_ERROR_REDACTION_SQL, REDACTED_DELIVERY_NOTE, seatScopeTuple, switchSystemSchedules, admitPeer, collectPeers, peerSeats, resolveVerticalInstanceFrom, switchPeer, peerGrantsStatus, systemGrantsStatus, systemScheduleState, systemSwitchedOff, systemSwitchedOffMessage, tenantSystemSwitchedOffMessage, SYSTEM_SWITCHES_BACKFILL_SQL, SYSTEM_SWITCHES_DDL, forgetSystemSwitchesOf, listSystemSwitchRecords, recordSystemSwitchedOff, recordSystemSwitchedOn, restoreSystemSwitchRecord, scopesSwitchedOffFor, tenantHoldsSystemGrant, switchedOffModulesOf, inUnitMovesToAudit, staleCarryRevertRow, staleCarryReverts, systemSwitchRecordsOf, systemSwitchesTableExists, withRecorded, VERSION_MIGRATIONS_DDL, splitManifestMigrations, splitVersionMigrationsBatch, versionMigrationsOf, writeVersionMigrations, denialListQuery, refusalListQuery, mapRefusalRow, denialSummaryQuery, denialTotalsQuery, DENIAL_WINDOW_QUERY, mapDenialRow, mapDenialSummaryBuckets, IMPERSONATION_COLUMNS, IMPERSONATION_DDL, ImpersonationRefused, assertImpersonationWrites, assertModuleEnqueueableKind, assertSessionUsable, impersonationByIdQuery, impersonationListQuery, impersonationRowValues, impersonationStampOf, mapImpersonationRow, newImpersonationSession, resolveRetryPolicy, isSecretBoxConfigured, unconfiguredSecretBox, createSubjectKeys, generateSealingKeyPair, noSealingKeyMessage, openSealed, sealTo, ConnectionSealingKeyUnavailableError, PermissionDenied, createAtomic, NotSearchable, NotListable, listIndexMigrations, listIndexPlans, listQuery, cursorOf, moduleMigrations, isSearchIndexTable, searchIndexDdl, searchIndexMigrations, searchIndexPlans, searchLimit, searchMatchExpression, searchQuery, ATTACHMENT_TEXT_DDL, assertAttachmentExtractors, assertJobRegistrable, attachmentRecordOfRow, attachmentTextJob, enqueueAttachmentText, isAttachmentTextRun, reconcileAttachmentText, recordAttachmentText, searchAttachments, entityVersionQuery, entityVersionOf, assertIfMatch, OUTBOX_ENTITY_INDEX, SCHEDULE_STATE_DDL, SCHEDULE_STATE_REBUILD, scheduleStateHasKind, VERTICAL_EVENTS_DDL, EXPORT_HOPS_SQL, IMPORT_CURSORS_SQL, IMPORT_CURSOR_OF_SQL, OUTBOX_MARK_SQL, emittedSinceQuery, emittedReportOf, EMITTED_REPORT_CAP, exportedSinceQuery, IMPORT_CURSOR_ADVANCE_SQL, IMPORT_RECORD_SQL, moveImportCursor, importCursorSourceOf, exportBreaksOf, exportBreakRefusal, bindExportBreaksOf, bindExportBreakRefusal, CrossVerticalRegistry, exportReadPlan, exportReadQuery, planExportBatch, withheldNote, JOB_RUN_DDL, JOB_RUN_DUE_AT, jobRunListLimit, jobRunOf, runDueJobRuns, startJobRun, IDEMPOTENCY_DDL, REFUSALS_TABLE_DDL, REFUSALS_INDEX, refusalInsert, refusalOf, markGuardRefusal, REFUSALS_REBUILD, refusalsAdmitGuards, assertIdempotencyKey, idempotencyLookupQuery, idempotencyPruneStatement, idempotencyRecordStatement, idempotencyOptedOutMessage, replayFor, globalFetch, createUlid, facetEvents, readHistory, walkEventCause, walkEventEffects, assertRedrainWindow, readInvocation, readDeadLetters, readLifecycleFlow, domainEventOf, readUndrainedOutbox, undrainedEventsOf, connectorCallRecord, noopConnectorCallRecorder, recordConnectorCall, settleConnectionUse, unknownRoleError, } from '@substrat-run/kernel';
+import { accessLogEntry, adminLogEntry, delegatedReadParams, operationSeriesCount, opsFailureEntry, opsFailureFingerprint, issueEntry, FRESHNESS_HEARTBEAT_MINUTES, sweepRunEntry, modelUsageEntry, ATTACHMENT_ADDED, ATTACHMENT_REMOVED, attachmentRecord, createTenantInput, domainEvent, domainEventInput, exportReadInput, importBatch, importCursorMove, exportsOfManifestJson, importsOfManifestJson, entitlementGrant, entitlementGrantInput, eventId, meterReading, platformRequestInput, platformRequestId, MAX_PENDING_PLATFORM_REQUESTS, identityLink, identityPool, instant, connection, capabilityGrant, connectionGrant, connectionGrantRecord, connectionSecret, systemGrant, systemSwitch, systemSwitchRecord, peerSwitch, verticalCaller, verticalSlug as verticalSlugOf, subjectRef, requestFingerprint, createConnectionInput, projectedConnectionGrant, projectedConnectionKey, moduleManifest, createOrgInput, promotionAcknowledgement, bindAcknowledgement, bindHostnameInput, channelHistoryEntry, hostnameBinding, publishVersionInput, AUTO_ADMISSION_NOTE, routeTarget, ROUTE_SCOPE_HOSTNAMES_MAX, registerVerticalInput, vertical as verticalSchema, verticalChannel, verticalVersion, objectRef, entityObjectRef, assertModuleEmittableType, assertKernelAuthoredType, grantRefFromProof, org as orgSchema, orgMembership, principalId, resolvedIdentity, identityMembership, roleDefinition, scope as scopeSchema, tenant as tenantSchema, tenantRole, subjectShredReceipt, SCOPE_TABLE_PAGE_DEFAULT, SCOPE_TABLE_PAGE_MAX, SCOPE_QUERY_ROW_MAX, verticalServingState, callsOfManifestJson, outboundOfManifestJson, listLimitOf, SCOPE_GATE_REASONS, substratError, assertReplayableDump, delegatedReadRecord, ownerTransferAudit, copyMarkAudit, redrainEventsInput, REDRAIN_BATCH, } from '@substrat-run/contracts';
+import { actorOf, asPrincipal, assertAllowed, assertNoSecret, assertPermissionKey, CAPABILITY_DDL, COPY_ORIGIN_DDL, CAPABILITY_EXCHANGE_OPERATION, capabilityAttachmentWriteRefused, capabilityTokenHash, createCapabilityVerbs, createEntityEdgeVerbs, exchangeCapability as exchangeCapabilitySecret, guardSecrets, mintBecomeCapability, plausibleSessionToken, readCapabilityPage, redactSecrets, redactSecretText, moduleLog, consoleLogSink, asyncInvocationId, asyncLinePass, consoleInvocationLineSink, resolveCapabilitySession, revokeCapabilityAsPlatform, assertReadOnlyQuery, attachmentBlobKey, attachmentSha256, entitlementDenial, requiredEntitlementFor, foldMeterReading, guardSpine, guardSqlLimits, DO_SQL_LIMITS, tooManyResultColumns, tooManyTableColumns, parseValidationRecords, resolveScopeRecord, ulid, ISSUE_RETENTION_DAYS, telemetryRetentionStatements, assertRowLimit, assertRowOffset, OPS_FAILURE_RETENTION_DAYS, SWEEP_RUN_RETENTION_DAYS, SWEEP_RUNS_INTENT_INDEX, sweepRunsIntentHasKind, MODEL_USAGE_RETENTION_DAYS, foldModelUsage, backoffAt, platformRequestHistoryQuery, platformRequestOf, PLATFORM_REQUEST_COLUMNS, PLATFORM_REQUEST_REDACTION_SQL, platformRequestRedactionParams, platformRequestRedactionQuery, intentPayloadCarriesSubject, redactSubjectJobRuns, redactSubjectScopeText, redactSubjectDirectoryText, ISSUE_EXEMPLAR_OWNER_BACKFILL_SQL, issueExemplarOwner, JOB_RUN_PATCH_SQL, JOB_RUN_CLAIM_SQL, JOB_RUN_RENEW_SQL, JOB_RUN_BEGIN_SQL, JOB_RUN_MISS_SQL, JOB_RUN_MISS_SETTLE_SQL, admissionMissOutcome, JOB_STEP_RECORD_SQL, JOB_LEASE_EXPIRED_NOTE, assertLeaseMs, DELIVERY_ERROR_REDACTION_SQL, REDACTED_DELIVERY_NOTE, seatScopeTuple, admitPeer, collectPeers, peerSeats, resolveVerticalInstanceFrom, peerGrantsStatus, systemGrantsStatus, systemScheduleState, systemSwitchedOff, systemSwitchedOffMessage, tenantSystemSwitchedOffMessage, PEER_SWITCHES_DDL, SWITCH_OWED_DDL, SWITCH_FENCES_DDL, recordWriteSuperseded, switchFencesOf, switchSupersededMessage, SWITCH_KINDS, SYSTEM_SWITCHES_DDL, forgetSwitchesOf, listSystemSwitchRecords, moveSwitch, reassertActionOf, reassertEntry, reassertOffRow, recordSwitchedOff, recordSwitchedOn, restoreSwitchRecord, scopesSwitchedOffFor, switchActionOf, switchAuditSubject, switchNotFoundMessage, switchRecordsOf, switchedOffOf, switchesBackfillSqlOf, switchesTableExists, tenantHeldOf, tenantHoldsGrant, inUnitMovesToAudit, staleCarryRevertRow, staleCarryReverts, withRecorded, VERSION_MIGRATIONS_DDL, splitManifestMigrations, splitVersionMigrationsBatch, versionMigrationsOf, writeVersionMigrations, denialListQuery, refusalListQuery, mapRefusalRow, denialSummaryQuery, denialTotalsQuery, DENIAL_WINDOW_QUERY, mapDenialRow, mapDenialSummaryBuckets, IMPERSONATION_COLUMNS, IMPERSONATION_DDL, ImpersonationRefused, assertImpersonationWrites, assertModuleEnqueueableKind, assertSessionUsable, impersonationByIdQuery, impersonationListQuery, impersonationRowValues, impersonationStampOf, mapImpersonationRow, newImpersonationSession, resolveRetryPolicy, executorOutcomeOf, isDeliveryRefusal, refusalJournalText, membershipFencesBackfillSql, MEMBERSHIP_FENCES_DDL, membershipFencesTableExists, MEMBERSHIP_FENCE_SINCE_SQL, RAISE_MEMBERSHIP_FENCE_SQL, tenantCoverage, isSecretBoxConfigured, unconfiguredSecretBox, createSubjectKeys, generateSealingKeyPair, noSealingKeyMessage, openSealed, sealTo, ConnectionSealingKeyUnavailableError, PermissionDenied, createAtomic, NotSearchable, NotListable, listIndexMigrations, listIndexPlans, listQuery, cursorOf, moduleMigrations, isSearchIndexTable, searchIndexDdl, searchIndexMigrations, searchIndexPlans, searchLimit, searchMatchExpression, searchQuery, ATTACHMENT_TEXT_DDL, assertAttachmentExtractors, assertJobRegistrable, attachmentRecordOfRow, attachmentTextJob, enqueueAttachmentText, isAttachmentTextRun, reconcileAttachmentText, recordAttachmentText, searchAttachments, entityVersionQuery, entityVersionOf, assertIfMatch, OUTBOX_ENTITY_INDEX, SCHEDULE_STATE_DDL, SCHEDULE_STATE_REBUILD, scheduleStateHasKind, VERTICAL_EVENTS_DDL, EXPORT_HOPS_SQL, emptyImportResult, IMPORT_CURSORS_SQL, IMPORT_CURSOR_OF_SQL, OUTBOX_MARK_SQL, emittedSinceQuery, emittedReportOf, EMITTED_REPORT_CAP, exportedSinceQuery, IMPORT_CURSOR_ADVANCE_SQL, IMPORT_RECORD_SQL, moveImportCursor, importCursorSourceOf, exportBreaksOf, exportBreakRefusal, bindExportBreaksOf, bindExportBreakRefusal, CrossVerticalRegistry, exportReadPlan, exportReadQuery, planExportBatch, withheldNote, JOB_RUN_DDL, JOB_RUN_DUE_AT, jobRunListLimit, jobRunOf, runDueJobRuns, startJobRun, IDEMPOTENCY_DDL, REFUSALS_TABLE_DDL, REFUSALS_INDEX, refusalInsert, refusalOf, markGuardRefusal, REFUSALS_REBUILD, refusalsAdmitGuards, assertIdempotencyKey, idempotencyLookupQuery, idempotencyPruneStatement, idempotencyRecordStatement, idempotencyOptedOutMessage, replayFor, globalFetch, createUlid, facetEvents, readHistory, walkEventCause, walkEventEffects, assertRedrainWindow, readInvocation, readDeadLetters, readLifecycleFlow, readOperationSeries, domainEventOf, readUndrainedOutbox, undrainedEventsOf, connectorCallRecord, noopConnectorCallRecorder, recordConnectorCall, settleConnectionUse, unknownRoleError, } from '@substrat-run/kernel';
 import { attributedHost } from '@substrat-run/kernel';
 import { INERT_SCOPE_REASON, isPrimaryScopeRow } from '@substrat-run/kernel';
 import { LEGACY_SCOPE_ROWS_BACKFILL, assertNoSpineReference, assertSpineTablesBuilt, capabilitiesForLoad, dumpRowsInsert, isSpineTable, loadDirectoryDump, repointScopeGrants, settleCopiedWork, emittedHere, spineColumnAdditions } from '@substrat-run/kernel';
 import { ScopeActor } from './actor.js';
-import { createTupleChecker } from './checker.js';
+import { createTupleChecker, directoryTenantReader } from './checker.js';
 /**
  * A fault in the database itself (full, corrupt, I/O), as opposed to one statement failing.
  * The #1764 backfill logs and opens past a failed batch, but never past one of these.
@@ -243,6 +243,7 @@ const KERNEL_DDL = `
     rows_changed INTEGER,
     PRIMARY KEY (module_id, version)
   );
+  ${SWITCH_FENCES_DDL}
   CREATE TABLE IF NOT EXISTS _substrat_tuples (
     subject TEXT NOT NULL,
     relation TEXT NOT NULL,
@@ -1063,6 +1064,9 @@ export class SqliteScopeHost {
       );
       ${IMPERSONATION_DDL}
       ${SYSTEM_SWITCHES_DDL}
+      ${MEMBERSHIP_FENCES_DDL}
+      ${PEER_SWITCHES_DDL}
+      ${SWITCH_OWED_DDL}
       CREATE TABLE IF NOT EXISTS _substrat_admin_log (
         id TEXT PRIMARY KEY,
         actor TEXT NOT NULL,
@@ -1237,10 +1241,16 @@ export class SqliteScopeHost {
      */
     ensureDirectorySchema() {
         this.directory.transaction(() => {
-            const switchRecordIsNew = !systemSwitchesTableExists(switchSqlOf(this.directory));
+            // Each kill switch's record (#1674, #2029) is backfilled on the pass that creates its table.
+            const newRecords = SWITCH_KINDS.filter((kind) => !switchesTableExists(switchSqlOf(this.directory), kind));
+            const fencesAreNew = !membershipFencesTableExists(switchSqlOf(this.directory));
             this.buildDirectorySchema();
-            if (switchRecordIsNew)
-                this.directory.exec(SYSTEM_SWITCHES_BACKFILL_SQL);
+            for (const kind of newRecords)
+                this.directory.exec(switchesBackfillSqlOf(kind));
+            // #1184: the removal fence, for everyone removed before it existed — the same once-only
+            // gate — stamped now, by the host clock (`membershipFencesBackfillSql` says why).
+            if (fencesAreNew)
+                this.directory.exec(membershipFencesBackfillSql(this.clock()));
         })();
         this.splitVersionMigrations();
     }
@@ -1578,10 +1588,10 @@ export class SqliteScopeHost {
             .prepare('SELECT status FROM tenants WHERE tenant_id = ?')
             .get(input.tenantId);
         if (!tenantRow) {
-            throw new Error(`cannot provision scope under unknown tenant: ${input.tenantId}`);
+            throw substratError('conflict', `cannot provision scope under unknown tenant: ${input.tenantId}`);
         }
         if (tenantRow.status !== 'active') {
-            throw new Error(`cannot provision scope under non-active tenant (status: ${tenantRow.status}): ${input.tenantId}`);
+            throw substratError('conflict', `cannot provision scope under non-active tenant (status: ${tenantRow.status}): ${input.tenantId}`);
         }
         const record = resolveScopeRecord(input);
         // Idempotency is on the scope_id (§3.3: provisioning is idempotent and
@@ -1600,7 +1610,7 @@ export class SqliteScopeHost {
                 .prepare("SELECT scope_id FROM scopes WHERE tenant_id = ? AND slug = ? AND status NOT IN ('archived', 'reaped')")
                 .get(input.tenantId, record.slug);
             if (slugOwner) {
-                throw new Error(`scope slug '${record.slug}' already taken under tenant ${input.tenantId} ` +
+                throw substratError('conflict', `scope slug '${record.slug}' already taken under tenant ${input.tenantId} ` +
                     `by ${slugOwner.scope_id} (slugs are unique within a tenant)`);
             }
             this.directory
@@ -1666,51 +1676,52 @@ export class SqliteScopeHost {
     }
     /**
      * `HostAdmin.reassertSystemSwitches`' body (#1674), run inside a turn the caller already
-     * holds on the scope's actor: every module the directory records OFF on the scope is
-     * switched off again. Already off answers `changed: false` and writes nothing, and a
-     * module with no authority reaching the scope (no grant here, no tenant-level grant) is left
-     * alone. Audited only when something moved.
+     * holds on the scope's actor: every module, and (#2029) every peer, the directory records OFF
+     * on the scope is switched off again. Already off answers `changed: false` and writes nothing,
+     * and a subject with no authority reaching the scope (no grant here, no tenant-level grant) is
+     * left alone. Audited only when something moved, under each kind's re-assert action.
      *
      * `audit` receives each row. By default it writes to the admin log at once. A caller running
      * this inside a scope transaction that may still roll back (a restore's replay) collects
      * the rows and writes them once the transaction commits. The admin log is another
      * database, and a row must not outlive a move that was rolled back.
      */
-    reassertSwitchesInTurn(rt, actor, tenantId, scopeId, opts, audit = (after) => this.recordAdmin(actor, 'reassertSystemSwitch', { tenantId, scopeId }, null, after)) {
+    reassertSwitchesInTurn(rt, actor, tenantId, scopeId, opts, audit = (action, after) => this.recordAdmin(actor, action, { tenantId, scopeId }, null, after)) {
         const at = new Date().toISOString();
-        // #1742 review: a move the deployment made from a stale list — the module was restored
-        // ON after the list was read — is undone first, so the operator's ON stands.
-        const recorded = systemSwitchRecordsOf(switchSqlOf(this.directory), tenantId, scopeId);
-        // One synchronous turn: no switch can land between this read and the moves below.
-        const reverted = new Set(staleCarryReverts(recorded, opts?.appliedInUnit));
-        for (const moduleId of reverted) {
-            const outcome = rt.db.transaction(() => switchSystemSchedules(switchSqlOf(rt.db), { moduleId, scopeId, to: 'on', at }))();
-            if (outcome.changed)
-                audit({ operationId: ulid(), ...staleCarryRevertRow(moduleId, outcome) });
-        }
-        const recordedOff = switchedOffModulesOf(switchSqlOf(this.directory), tenantId, scopeId);
-        // #1742: what a deployment already switched off inside its own unit, audited here — the
-        // switch below answers `changed: false` for it and would write no row.
-        // A move the revert above undid is not credited as an in-unit OFF.
-        const applied = opts?.appliedInUnit?.filter((a) => !reverted.has(a.moduleId));
-        for (const row of inUnitMovesToAudit(recordedOff, applied))
-            audit({ operationId: ulid(), ...row });
-        return recordedOff.map((moduleId) => {
-            // #1823: a module whose only authority here is a tenant-level grant is held too.
-            const tenantHeld = tenantHoldsSystemGrant(switchSqlOf(this.directory), tenantId, moduleId, this.clock());
-            const outcome = rt.db.transaction(() => switchSystemSchedules(switchSqlOf(rt.db), { moduleId, scopeId, to: 'off', at, tenantHeld }))();
-            if (outcome.changed) {
-                audit({
-                    operationId: ulid(),
-                    moduleId,
-                    schedules: 'off',
-                    phase: 'applied',
-                    changed: true,
-                    permissions: outcome.permissions,
-                });
+        const directorySql = switchSqlOf(this.directory);
+        const results = [];
+        for (const kind of SWITCH_KINDS) {
+            const action = reassertActionOf(kind);
+            // #2045: every move carries the fence of the call the record holds, so a scope moved since by
+            // a newer call stays as that call put it.
+            const fences = switchFencesOf(directorySql, kind, tenantId, scopeId);
+            const move = (key, to, tenantHeld) => rt.db.transaction(() => moveSwitch(switchSqlOf(rt.db), kind, { key, scopeId, to, at, tenantHeld, fence: fences.get(key) }))();
+            // #1742 review: a move the deployment made from a stale list — the subject was restored
+            // ON after the list was read — is undone first, so the operator's ON stands.
+            const recorded = switchRecordsOf(directorySql, kind, tenantId, scopeId);
+            // One synchronous turn: no switch can land between this read and the moves below.
+            const reverted = new Set(staleCarryReverts(kind, recorded, opts?.appliedInUnit));
+            for (const key of reverted) {
+                const outcome = move(key, 'on');
+                if (outcome.changed)
+                    audit(action, { operationId: ulid(), ...staleCarryRevertRow(kind, key, outcome) });
             }
-            return { moduleId, held: outcome.held, changed: outcome.changed };
-        });
+            const recordedOff = switchedOffOf(directorySql, kind, tenantId, scopeId);
+            // #1742: what a deployment already switched off inside its own unit, audited here — the
+            // switch below answers `changed: false` for it and would write no row. A move the revert
+            // above undid is not credited as an in-unit OFF.
+            for (const row of inUnitMovesToAudit(kind, recordedOff, opts?.appliedInUnit, reverted)) {
+                audit(action, { operationId: ulid(), ...row });
+            }
+            for (const key of recordedOff) {
+                // #1823 (#2030): a subject whose only authority here is a tenant-level grant is held too.
+                const outcome = move(key, 'off', tenantHoldsGrant(directorySql, kind, tenantId, key, this.clock()));
+                if (outcome.changed)
+                    audit(action, { operationId: ulid(), ...reassertOffRow(kind, key, outcome.permissions) });
+                results.push(reassertEntry(kind, key, outcome));
+            }
+        }
+        return results;
     }
     async provisionTenantStore(actor, input) {
         // Fail closed on an unknown/inactive tenant, exactly as provisionScope does: a store
@@ -1720,10 +1731,10 @@ export class SqliteScopeHost {
             .prepare('SELECT status FROM tenants WHERE tenant_id = ?')
             .get(input.tenantId);
         if (!tenantRow) {
-            throw new Error(`cannot provision tenant store under unknown tenant: ${input.tenantId}`);
+            throw substratError('not_found', `cannot provision tenant store under unknown tenant: ${input.tenantId}`);
         }
         if (tenantRow.status !== 'active') {
-            throw new Error(`cannot provision tenant store under non-active tenant (status: ${tenantRow.status}): ${input.tenantId}`);
+            throw substratError('conflict', `cannot provision tenant store under non-active tenant (status: ${tenantRow.status}): ${input.tenantId}`);
         }
         // Idempotent on (tenant, vertical, binding): a retried provision re-resolves the SAME
         // store rather than minting a second database (the K-31 ready-gate retries the whole
@@ -1791,10 +1802,10 @@ export class SqliteScopeHost {
             .prepare('SELECT status FROM tenants WHERE tenant_id = ?')
             .get(input.tenantId);
         if (!tenantRow) {
-            throw new Error(`cannot provision blob store under unknown tenant: ${input.tenantId}`);
+            throw substratError('not_found', `cannot provision blob store under unknown tenant: ${input.tenantId}`);
         }
         if (tenantRow.status !== 'active') {
-            throw new Error(`cannot provision blob store under non-active tenant (status: ${tenantRow.status}): ${input.tenantId}`);
+            throw substratError('conflict', `cannot provision blob store under non-active tenant (status: ${tenantRow.status}): ${input.tenantId}`);
         }
         const existing = this.directory
             .prepare('SELECT ref FROM blob_stores WHERE tenant_id = ? AND vertical = ? AND binding = ?')
@@ -2316,9 +2327,9 @@ export class SqliteScopeHost {
         const rows = [];
         // #1869: the re-point's source is the separate hint when given; the dump is otherwise as sent.
         const source = { tables: dump.tables, scopeId: opts?.sourceScopeId ?? dump.scopeId };
-        await this.loadDump(tenantId, scopeId, source, (rt) => this.reassertSwitchesInTurn(rt, actor, tenantId, scopeId, undefined, (after) => rows.push(after)));
-        for (const after of rows)
-            this.recordAdmin(actor, 'reassertSystemSwitch', { tenantId, scopeId }, null, after);
+        await this.loadDump(tenantId, scopeId, source, (rt) => this.reassertSwitchesInTurn(rt, actor, tenantId, scopeId, undefined, (action, after) => rows.push([action, after])));
+        for (const [action, after] of rows)
+            this.recordAdmin(actor, action, { tenantId, scopeId }, null, after);
         this.recordAdmin(actor, 'restoreScope', { tenantId, scopeId }, null, { sourceScopeId: dump.scopeId, tables: dump.tables.length, capturedAt: dump.capturedAt });
     }
     async snapshotScope(actor, tenantId, scopeId, opts) {
@@ -2351,7 +2362,7 @@ export class SqliteScopeHost {
         if (!rec)
             throw substratError('not_found', `unknown scope ${scopeId} in tenant ${tenantId}`);
         if (!rec.forkedFrom && rec.kind !== 'preview') {
-            throw new Error(`scope ${scopeId} is not a fork or preview — only previews may be deleted; ` +
+            throw substratError('forbidden', `scope ${scopeId} is not a fork or preview — only previews may be deleted; ` +
                 `archive a primary scope instead`);
         }
         // Close and evict the runtime handle before touching the file.
@@ -2364,7 +2375,7 @@ export class SqliteScopeHost {
         // orphaned bytes with no record (the §9 hazard).
         this.directory.prepare('DELETE FROM hostnames WHERE scope_id = ?').run(scopeId);
         rmSync(join(this.dir, `${tenantId}__${scopeId}.sqlite`), { force: true });
-        forgetSystemSwitchesOf(switchSqlOf(this.directory), scopeId);
+        forgetSwitchesOf(switchSqlOf(this.directory), scopeId);
         this.directory.prepare('DELETE FROM scopes WHERE scope_id = ?').run(scopeId);
         this.recordAdmin(actor, 'deleteSnapshot', { tenantId, scopeId }, null, {
             forkedFrom: rec.forkedFrom,
@@ -2389,10 +2400,12 @@ export class SqliteScopeHost {
             .prepare('SELECT status FROM tenants WHERE tenant_id = ?')
             .get(tenantId);
         if (!tenantRow) {
-            throw new Error(`scope has no tenant record: (${tenantId}, ${scopeId})`);
+            throw substratError('not_found', `scope has no tenant record: (${tenantId}, ${scopeId})`, {
+                reason: SCOPE_GATE_REASONS.unrecorded,
+            });
         }
         if (tenantRow.status !== 'active') {
-            throw new Error(`tenant not active (status: ${tenantRow.status}): ${tenantId}`);
+            throw substratError('conflict', `tenant not active (status: ${tenantRow.status}): ${tenantId}`, { reason: SCOPE_GATE_REASONS.notActive });
         }
         // `provisioning` is handled BELOW rather than here, because a scope that never
         // finished setting up should still retry its migrations when touched — that lazy
@@ -2401,7 +2414,7 @@ export class SqliteScopeHost {
         // deliberate states, and running migrations for them would be work on behalf of a
         // request that is going to be refused anyway.
         if (row.status !== 'active' && row.status !== 'provisioning') {
-            throw new Error(`scope not active (status: ${row.status}): ${scopeId}`);
+            throw substratError('conflict', `scope not active (status: ${row.status}): ${scopeId}`, { reason: SCOPE_GATE_REASONS.notActive });
         }
         const rt = this.runtime(tenantId, scopeId);
         await this.applyPendingMigrations(rt);
@@ -2410,7 +2423,7 @@ export class SqliteScopeHost {
             // the scope exists on the vertical's side (K-31). Refused, but only after the
             // retry above has had its chance — and if THAT is what failed, it threw with
             // the migration's own message, which is the one an operator needs.
-            throw new Error(`scope not active (status: ${row.status}): ${scopeId}`);
+            throw substratError('conflict', `scope not active (status: ${row.status}): ${scopeId}`, { reason: SCOPE_GATE_REASONS.notActive });
         }
         return this.buildStub(tenantId, scopeId, rt, asPrincipal(principal), options);
     }
@@ -2446,7 +2459,7 @@ export class SqliteScopeHost {
                 `runs '${scope.vertical ?? 'none'}'`);
         }
         if (scope.status !== 'active') {
-            throw new Error(`scope not active (status: ${scope.status}): ${scopeId}`);
+            throw substratError('conflict', `scope not active (status: ${scope.status}): ${scopeId}`, { reason: SCOPE_GATE_REASONS.notActive });
         }
         const rt = this.runtime(conn.tenant_id, scopeId);
         await this.applyPendingMigrations(rt);
@@ -2474,7 +2487,7 @@ export class SqliteScopeHost {
                 `runs '${scope.vertical ?? 'none'}'`);
         }
         if (scope.status !== 'active') {
-            throw new Error(`scope not active (status: ${scope.status}): ${scopeId}`);
+            throw substratError('conflict', `scope not active (status: ${scope.status}): ${scopeId}`, { reason: SCOPE_GATE_REASONS.notActive });
         }
         const rt = this.runtime(conn.tenant_id, scopeId);
         await this.applyPendingMigrations(rt);
@@ -2509,7 +2522,7 @@ export class SqliteScopeHost {
             throw substratError('not_found', `unknown scope for tenant: (${tenantId}, ${scopeId})`);
         }
         if (scope.status !== 'active') {
-            throw new Error(`scope not active (status: ${scope.status}): ${scopeId}`);
+            throw substratError('conflict', `scope not active (status: ${scope.status}): ${scopeId}`, { reason: SCOPE_GATE_REASONS.notActive });
         }
         const rt = this.runtime(tenantId, scopeId);
         await this.applyPendingMigrations(rt);
@@ -2521,7 +2534,7 @@ export class SqliteScopeHost {
         // and the scope must be active. Authority is then an ordinary check against
         // `system:<moduleId>` grants inside the stub; nothing here is a person.
         if (!this.modules.has(moduleId)) {
-            throw new Error(`module not registered on this host: ${moduleId}`);
+            throw substratError('not_found', `module not registered on this host: ${moduleId}`);
         }
         const scope = this.directory
             .prepare('SELECT tenant_id, status FROM scopes WHERE scope_id = ?')
@@ -2530,7 +2543,7 @@ export class SqliteScopeHost {
             throw substratError('not_found', `unknown scope: ${scopeId}`);
         }
         if (scope.status !== 'active') {
-            throw new Error(`scope not active (status: ${scope.status}): ${scopeId}`);
+            throw substratError('conflict', `scope not active (status: ${scope.status}): ${scopeId}`, { reason: SCOPE_GATE_REASONS.notActive });
         }
         const rt = this.runtime(tenantId, scopeId);
         await this.applyPendingMigrations(rt);
@@ -2600,15 +2613,11 @@ export class SqliteScopeHost {
         const source = batch.source;
         const rt = await this.openActiveScope(tenantId, scopeId);
         return rt.actor.enqueue(async () => {
-            const result = {
-                delivered: 0,
-                deadLettered: 0,
-                duplicates: 0,
-                withheld: 0,
-                cursor: batch.after,
-                stale: false,
-                paused: null,
-            };
+            const result = emptyImportResult(batch);
+            // #2004: a copy consumes no other vertical's events, at the door as in the sweep
+            // (`scope-copy.ts`). A pause: nothing runs and the watermark stays.
+            if (!this.isPrimaryInDirectory(scopeId))
+                return { ...result, paused: { reason: INERT_SCOPE_REASON } };
             // #1706's door, for a delivery (`operation: null`): the producer must be a declared peer
             // of this vertical with its switch on. Admitted inside the actor task, before anything
             // runs, so a switch pulled between two passes refuses the second. A refusal is a PAUSE:
@@ -2797,10 +2806,10 @@ export class SqliteScopeHost {
             .prepare('SELECT status FROM tenants WHERE tenant_id = ?')
             .get(tenantId);
         if (!tenant || tenant.status !== 'active') {
-            throw new Error(`tenant not active (status: ${tenant?.status ?? 'missing'}): ${tenantId}`);
+            throw substratError('conflict', `tenant not active (status: ${tenant?.status ?? 'missing'}): ${tenantId}`, { reason: SCOPE_GATE_REASONS.notActive });
         }
         if (scope.status !== 'active') {
-            throw new Error(`scope not active (status: ${scope.status}): ${scopeId}`);
+            throw substratError('conflict', `scope not active (status: ${scope.status}): ${scopeId}`, { reason: SCOPE_GATE_REASONS.notActive });
         }
         const rt = this.runtime(tenantId, scopeId);
         await this.applyPendingMigrations(rt);
@@ -2929,7 +2938,9 @@ export class SqliteScopeHost {
      * assignment would actually confer, and that is what has to be bounded. The one
      * resolution both `ctx.canAssign` and the host's `canAssign` answer from.
      */
-    async assignmentBound(subject, tenantId, scopeId, roleKey) {
+    async assignmentBound(subject, tenantId, 
+    /** Null for the tenant node — the executor's `level: 'tenant'` (#1184). */
+    scopeId, roleKey) {
         const role = this.roles.get(`${tenantId}/${roleKey}`);
         if (!role) {
             throw unknownRoleError(roleKey);
@@ -3280,6 +3291,8 @@ export class SqliteScopeHost {
                 let replayed = false;
                 // #1746: what this call itself emitted, for `onEmitted`. Set only after a commit.
                 let emittedReport;
+                // #1184: what this call's executors did inline, for `onExecutorOutcomes`.
+                const executorOutcomes = invokeOptions?.onExecutorOutcomes ? [] : undefined;
                 const invoked = await rt.actor.enqueue(async () => {
                     // #1237: the invocation this call belongs to, for the duration of it. Set
                     // INSIDE the actor task — the actor serializes invoke and dispatch alike, so
@@ -3449,7 +3462,7 @@ export class SqliteScopeHost {
                             // #1525: still inside the actor task that set it, so these deliveries are
                             // this call's own work — the same tail its consumers' emits are stamped in.
                             await this.dispatch(rt, rt.invocationId);
-                            await this.dispatchExecutors(rt, rt.invocationId);
+                            await this.dispatchExecutors(rt, rt.invocationId, executorOutcomes);
                         }
                         if (exportMark !== null && !replayed) {
                             const q = exportedSinceQuery(exportTypes, exportMark);
@@ -3476,6 +3489,8 @@ export class SqliteScopeHost {
                     invokeOptions?.onIdempotentReplay?.();
                 if (emittedReport)
                     invokeOptions?.onEmitted?.(emittedReport);
+                if (executorOutcomes && !replayed && session?.mode !== 'read-only')
+                    invokeOptions?.onExecutorOutcomes?.(executorOutcomes);
                 return invoked;
             },
         };
@@ -3564,6 +3579,17 @@ export class SqliteScopeHost {
      * At-least-once still requires idempotent handlers. Retry is the backstop, not a
      * substitute.
      */
+    /**
+     * #1184: the scope reads an executor's handler may make, built over `rt` directly. The
+     * handler runs INSIDE this scope's actor task, so a host read that re-enqueued — the
+     * public `canAssign`, `admin.entityHistory` — would wait on the task holding it.
+     */
+    executorScope(rt) {
+        return {
+            history: async (entity, page) => readHistory({ sql: scopedSql(rt.db) }, entity, page),
+            covers: (principal, roleKey, level) => this.assignmentBound(asPrincipal(principalId.parse(principal)), rt.tenantId, level === 'scope' ? rt.scopeId : null, roleKey),
+        };
+    }
     async dispatchExecutors(rt, 
     /**
      * #1525: the call this drain pass is running in, or null — PASSED, not read off
@@ -3572,7 +3598,9 @@ export class SqliteScopeHost {
      * and journal over RPC, so the id has to travel as an argument on that side, and
      * a recorded fact whose correctness argument differs per adapter drifts.
      */
-    invocationId) {
+    invocationId, 
+    /** #1184: what each attempt did, for the emitting call's `onExecutorOutcomes`. */
+    outcomes) {
         const report = {
             attempted: 0,
             delivered: 0,
@@ -3583,15 +3611,16 @@ export class SqliteScopeHost {
             return report;
         const lines = asyncLinePass(this.invocationLineSink);
         try {
-            await this.dispatchExecutorsPass(rt, invocationId, report, lines);
+            await this.dispatchExecutorsPass(rt, invocationId, report, lines, outcomes);
         }
         finally {
             lines.end();
         }
         return report;
     }
-    async dispatchExecutorsPass(rt, invocationId, report, lines) {
+    async dispatchExecutorsPass(rt, invocationId, report, lines, outcomes) {
         const now = new Date().toISOString();
+        const scope = this.executorScope(rt);
         // #2005: a non-primary scope (a fork, a snapshot, a preview of either kind) causes no
         // outbound effects. Every executor is host code acting with platform authority — a
         // connector with the tenant's credential, a plain executor with `HostAdmin` — so its
@@ -3643,26 +3672,43 @@ export class SqliteScopeHost {
                     lines.write({ ...unit, attempt: attempts, outcome: 'dead-lettered' });
                     continue;
                 }
+                const outcomeOf = (outcome, error) => {
+                    outcomes?.push(executorOutcomeOf(id, event, outcome, error));
+                };
                 if (isInert()) {
                     const { attempts } = this.recordExecutorDelivery(rt, row.id, deliveryId, INERT_SCOPE_REASON, TERMINAL_RETRY, invocationId);
                     report.inert = (report.inert ?? 0) + 1;
+                    outcomeOf('inert', INERT_SCOPE_REASON);
                     // Its own outcome, never `delivered`: no handler ran (#2005).
                     lines.write({ ...unit, attempt: attempts, outcome: 'inert' });
                     continue;
                 }
                 this.causedBy = event.id;
                 try {
+                    let result;
                     if (executor.kind === 'connector') {
                         // `true`: dispatchExecutors is only ever reached from inside
                         // `rt.actor.enqueue` (invoke's post-commit tail, or drainDue).
                         await executor.handler(this.connectorContext(rt, executor.timeoutMs, true, event.id), event);
                     }
                     else {
-                        await executor.handler(this.admin, event);
+                        result = await executor.handler(this.admin, event, scope);
+                    }
+                    // #1184: a refusal is the handler's own terminal decision — journaled with its
+                    // reason, never retried, and listed by `executorDeadLetters` beside an exhausted one.
+                    const refused = isDeliveryRefusal(result) ? result : null;
+                    const text = refused && refusalJournalText(refused);
+                    const { attempts } = this.recordExecutorDelivery(rt, row.id, deliveryId, text, refused ? TERMINAL_RETRY : executor.retry, invocationId);
+                    if (refused) {
+                        report.deadLettered += 1;
+                        outcomeOf('refused', refused.reason);
+                        lines.write({ ...unit, attempt: attempts, outcome: 'dead-lettered', error: text });
+                    }
+                    else {
+                        report.delivered += 1;
+                        outcomeOf('delivered');
+                        lines.write({ ...unit, attempt: attempts, outcome: 'delivered' });
                     }
-                    const { attempts } = this.recordExecutorDelivery(rt, row.id, deliveryId, null, executor.retry, invocationId);
-                    report.delivered += 1;
-                    lines.write({ ...unit, attempt: attempts, outcome: 'delivered' });
                 }
                 catch (err) {
                     const { dead, attempts } = this.recordExecutorDelivery(rt, row.id, deliveryId, err instanceof Error ? (err.stack ?? err.message) : String(err), executor.retry, invocationId);
@@ -3670,6 +3716,7 @@ export class SqliteScopeHost {
                         report.deadLettered += 1;
                     else
                         report.retrying += 1;
+                    outcomeOf(dead ? 'dead-lettered' : 'retrying', err);
                     lines.write({ ...unit, attempt: attempts, outcome: dead ? 'dead-lettered' : 'retrying', error: err });
                 }
                 finally {
@@ -3727,13 +3774,14 @@ export class SqliteScopeHost {
         // emitting operation's own tail made.
         return rt.actor.enqueue(() => this.dispatchExecutors(rt, null));
     }
-    registerJob(moduleId, name, handler, retry) {
+    registerJob(moduleId, name, handler, retry, options) {
         // #1575: the kernel's own jobs are dispatched before this registry is read.
         assertJobRegistrable(moduleId, name);
+        assertLeaseMs(options?.leaseMs);
         const key = `${moduleId}/${name}`;
         if (this.jobs.has(key))
             throw new Error(`job '${key}' is already registered`);
-        this.jobs.set(key, { handler, retry });
+        this.jobs.set(key, { handler, retry, leaseMs: options?.leaseMs });
     }
     /**
      * D-14's in-process driver: the run store is direct SQL on the scope db.
@@ -3766,11 +3814,24 @@ export class SqliteScopeHost {
          (id, module_id, job, instance, payload, status, cursor, counters, attempts,
           last_error, started_at, updated_at, next_attempt_at, ended_at, subject_id)
        VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`);
-        // A compare-and-set on `running` (#1632): a pass that outlived an erasure must not
-        // write its cursor back over the redaction. The kernel's statement, so both adapters
-        // hold the same line.
+        // A compare-and-set on `running` (#1632) and on the pass's lease (#2034): a pass that
+        // outlived an erasure, or lost its run to a takeover, must not write back over it. The
+        // kernel's statement, so both adapters hold the same line.
         const patchRun = db.prepare(JOB_RUN_PATCH_SQL);
-        const patchArgs = (id, p) => [p.status, p.cursor, p.counters, p.attempts, p.lastError, p.updatedAt, p.nextAttemptAt, p.endedAt, id];
+        const patchArgs = (id, p, owner) => [p.status, p.cursor, p.counters, p.attempts, p.lastError, p.updatedAt, p.nextAttemptAt, p.endedAt, id, owner];
+        const beganAt = db.prepare('SELECT lease_began_at FROM _substrat_job_runs WHERE id = ?');
+        const beginRun = db.prepare(JOB_RUN_BEGIN_SQL);
+        const missRun = db.prepare(JOB_RUN_MISS_SQL);
+        const missSettle = db.prepare(JOB_RUN_MISS_SETTLE_SQL);
+        // #2042 r4: every lease time is this host's clock as the statement runs, inside its turn —
+        // never a time the drive computed, which a skew or a wait in the queue would make wrong.
+        const now = () => this.clock();
+        const plus = (at, ms) => new Date(Date.parse(at) + ms).toISOString();
+        const claimRun = db.prepare(JOB_RUN_CLAIM_SQL);
+        const renewRun = db.prepare(JOB_RUN_RENEW_SQL);
+        const recordStepRow = db.prepare(JOB_STEP_RECORD_SQL);
+        const dropSteps = db.prepare('DELETE FROM _substrat_job_steps WHERE run_id = ?');
+        const stepRow = db.prepare('SELECT step, result, attempts, last_error FROM _substrat_job_steps WHERE run_id = ? AND step = ?');
         // `db.transaction` on better-sqlite3 runs its body SYNCHRONOUSLY inside a real
         // SQLite transaction, so nothing — not another turn of the event loop, not
         // another caller of this host — can interleave between the read and the write.
@@ -3782,9 +3843,37 @@ export class SqliteScopeHost {
             insertRun.run(r.id, r.module_id, r.job, r.instance, r.payload, r.status, r.cursor, r.counters, r.attempts, r.last_error, r.started_at, r.updated_at, r.next_attempt_at, r.ended_at, r.subject_id ?? null);
             return r;
         });
-        const commitPassTx = db.transaction((id, p) => {
-            patchRun.run(...patchArgs(id, p));
-            db.prepare('DELETE FROM _substrat_job_steps WHERE run_id = ?').run(id);
+        const commitPassTx = db.transaction((id, p, owner) => {
+            // #2034: the ledger goes only with a patch that applied — a stale holder's commit must
+            // not empty the ledger of the pass that took the run over.
+            if (patchRun.run(...patchArgs(id, p, owner)).changes === 0)
+                return false;
+            dropSteps.run(id);
+            return true;
+        });
+        // #2034: the claim, and whether it took over a lease, read in the same transaction.
+        const claimTx = db.transaction((id, owner, leaseMs) => {
+            // #2042 r2, r4: a takeover is charged only when the lease it takes had BEGUN its pass.
+            const before = beganAt.get(id);
+            const at = now();
+            const claimed = row(claimRun.get(owner, plus(at, leaseMs), at, JOB_LEASE_EXPIRED_NOTE, id, at));
+            return claimed && { run: claimed, takeover: (before?.lease_began_at ?? null) !== null };
+        });
+        // #2042 r3, r4: an admission miss — the relative count, then the backoff or failure it calls for.
+        const missTx = db.transaction((id, owner, note) => {
+            const at = now();
+            const counted = missRun.get(at, id, owner);
+            if (!counted)
+                return null;
+            const o = admissionMissOutcome(counted.admission_misses, at, note);
+            missSettle.run(o.status, o.nextAttemptAt, o.endedAt, o.lastError, id, counted.admission_misses);
+            return { misses: counted.admission_misses, failed: o.status === 'failed' };
+        });
+        const recordStepTx = db.transaction((runId, name, result, attempts, lastError, at, owner, leaseMs) => {
+            if (renewRun.run(plus(now(), leaseMs), runId, owner).changes === 0)
+                return false;
+            recordStepRow.run(runId, name, result, attempts, lastError, at, runId, owner);
+            return true;
         });
         // Every store operation takes its own short turn on the scope actor, so no
         // statement here can land inside an `invoke`'s open transaction. `turn` is the
@@ -3792,7 +3881,13 @@ export class SqliteScopeHost {
         const turn = (fn) => rt.actor.enqueue(fn);
         return {
             startOrJoin: (key, r) => turn(() => startOrJoinTx(key, r)),
-            get: (id) => turn(() => row(db.prepare('SELECT * FROM _substrat_job_runs WHERE id = ?').get(id))),
+            claim: (id, owner, leaseMs) => turn(() => claimTx(id, owner, leaseMs)),
+            // #2042 r4: BEGIN, the commitment point, judged by this host's clock as it runs.
+            begin: (id, owner, marginMs) => turn(() => {
+                const at = now();
+                return beginRun.run(at, id, owner, plus(at, marginMs)).changes > 0;
+            }),
+            miss: (id, owner, note) => turn(() => missTx(id, owner, note)),
             // #1834: the drive's one snapshot — keys only, in the order runs became due.
             dueKeys: (now, max) => turn(() => db
                 .prepare(`SELECT id, module_id, job FROM _substrat_job_runs
@@ -3820,17 +3915,18 @@ export class SqliteScopeHost {
              ORDER BY id DESC LIMIT ?`)
                     .all(...params);
             }),
-            patch: (id, p) => turn(() => {
-                patchRun.run(...patchArgs(id, p));
-            }),
-            commitPass: (id, p) => turn(() => commitPassTx(id, p)),
-            step: (runId, name) => turn(() => db
-                .prepare('SELECT step, result, attempts, last_error FROM _substrat_job_steps WHERE run_id = ? AND step = ?')
-                .get(runId, name) ?? null),
-            recordStep: (runId, name, result, attempts, lastError, at) => turn(() => {
-                // Only while the run is still `running` (#1632) — see `JOB_STEP_RECORD_SQL`.
-                db.prepare(JOB_STEP_RECORD_SQL).run(runId, name, result, attempts, lastError, at, runId);
+            patch: (id, p, owner) => turn(() => patchRun.run(...patchArgs(id, p, owner)).changes > 0),
+            commitPass: (id, p, owner) => turn(() => commitPassTx(id, p, owner)),
+            // #2034: a step boundary renews the lease; a pass that lost it reads nothing.
+            beginStep: (runId, name, owner, leaseMs) => turn(() => {
+                if (renewRun.run(plus(now(), leaseMs), runId, owner).changes === 0)
+                    return { held: false, row: null };
+                return { held: true, row: stepRow.get(runId, name) ?? null };
             }),
+            recordStep: (runId, name, result, attempts, lastError, at, owner, leaseMs) => 
+            // Only while the run is still `running` (#1632) and this pass holds it (#2034), renewing
+            // the lease in the same transaction — see `JOB_STEP_RECORD_SQL`.
+            turn(() => recordStepTx(runId, name, result, attempts, lastError, at, owner, leaseMs)),
         };
     }
     /**
@@ -3959,7 +4055,7 @@ export class SqliteScopeHost {
         // `provisioning` allowed — a scope stuck there on a failed migration is a
         // sweep target. Suspended/archived are deliberate states; not disturbed.
         if (row.status !== 'active' && row.status !== 'provisioning') {
-            throw new Error(`scope not migratable (status: ${row.status}): ${scopeId}`);
+            throw substratError('conflict', `scope not migratable (status: ${row.status}): ${scopeId}`);
         }
         const rt = this.runtime(tenantId, scopeId);
         // Nothing pending FOR THIS HOST → noop, and deliberately no state write: a
@@ -4436,14 +4532,16 @@ export class SqliteScopeHost {
             throw new Error(`connection not found: ${id}`);
         return row;
     }
-    recordAdmin(actor, action, target, before, after) {
+    recordAdmin(actor, action, target, before, after, 
+    /** When the row says it happened; the wall clock unless the write took its time elsewhere (#1184). */
+    at = new Date().toISOString()) {
         this.directory
             .prepare(`INSERT INTO _substrat_admin_log
            (id, actor, action, tenant_id, scope_id, vertical, before, after, caused_by, on_behalf_of, at)
          VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`)
             .run(ulid(), actor, action, target.tenantId ?? null, target.scopeId ?? null, target.vertical ?? null, before == null ? null : JSON.stringify(before), after == null ? null : JSON.stringify(after), this.causedBy, 
         // #977: set only on an attributed view (`attributed`), never on the host itself.
-        this.onBehalfOf === null ? null : JSON.stringify(this.onBehalfOf), new Date().toISOString());
+        this.onBehalfOf === null ? null : JSON.stringify(this.onBehalfOf), at);
     }
     tenantHoldsEntitlement(tenantId, key) {
         // An expired grant fails closed, exactly as if revoked (#33) — evaluated
@@ -4503,12 +4601,12 @@ export class SqliteScopeHost {
         const requirePoolServes = (provider, tenant) => {
             const pool = readPool(provider);
             if (!pool) {
-                throw new Error(`identity pool '${provider}' is not registered — a pool must declare its ` +
+                throw substratError('conflict', `identity pool '${provider}' is not registered — a pool must declare its ` +
                     `topology before it may link (central vs tenant-bound decides whether the ` +
                     `same externalId in two tenants is one person or two)`);
             }
             if (pool.topology === 'tenant-bound' && pool.tenantId !== tenant) {
-                throw new Error(`identity pool '${provider}' is bound to tenant ${pool.tenantId} and cannot link into ${tenant}`);
+                throw substratError('conflict', `identity pool '${provider}' is bound to tenant ${pool.tenantId} and cannot link into ${tenant}`);
             }
         };
         const mapVertical = (r) => verticalSchema.parse({
@@ -4578,7 +4676,7 @@ export class SqliteScopeHost {
          */
         const requireOrg = (tenant, id) => {
             if (!readOrg(tenant, id)) {
-                throw new Error(`unknown org ${id} in tenant ${tenant}`);
+                throw substratError('not_found', `unknown org ${id} in tenant ${tenant}`);
             }
         };
         // The directory row → the `scope` contract. Parsed, not cast: the columns are
@@ -4650,7 +4748,7 @@ export class SqliteScopeHost {
                 throw substratError('not_found', `unknown scope for tenant: (${tenantId}, ${scopeId})`);
             }
             if (!from.includes(row.status)) {
-                throw new Error(`illegal scope transition for ${action}: ${row.status} → ${to} ` +
+                throw substratError('conflict', `illegal scope transition for ${action}: ${row.status} → ${to} ` +
                     `(allowed from: ${from.join('|')})`);
             }
             // One directory transaction: the status, the audit row and — on a reap — the scope's
@@ -4674,7 +4772,7 @@ export class SqliteScopeHost {
                     this.directory.prepare('UPDATE scopes SET status = ? WHERE scope_id = ?').run(to, scopeId);
                 }
                 if (to === 'reaped')
-                    forgetSystemSwitchesOf(switchSqlOf(this.directory), scopeId);
+                    forgetSwitchesOf(switchSqlOf(this.directory), scopeId);
                 // The audit target carries the scope's vertical (control-plane.md §4.4:
                 // "vertical stays null until §4.2 lifecycle actions that name one"). It is
                 // read from the scope rather than passed in, so the trail cannot disagree
@@ -4687,6 +4785,35 @@ export class SqliteScopeHost {
              (tenant_id, subject, relation, object, expires_at)
            VALUES (?, ?, ?, ?, ?)`)
             .run(tenantId, subject, relation, object, expiresAt ?? null);
+        // #1184: a tenant-level removal, for inside a directory transaction — the tombstone
+        // (K-21), the removal fence, raised even when nothing was held so an add still on its way
+        // cannot land after this, and the audit row (`audit`), which K-21 writes only when
+        // something changed. The shape of the Durable-Object adapter's `revokeAndFence`.
+        //
+        // All three are stamped by the HOST clock, the one that stamps a scope event's `occurredAt`:
+        // the fence is compared with an add's `occurredAt`, and two clocks would let a host clock
+        // running ahead of the wall push a removal under the skew window (Codex round 3).
+        let revokeStmt;
+        let fenceStmt;
+        const revokeAndFence = (tenantId, principal, relation, object, audit) => {
+            const now = this.clock();
+            const changed = (revokeStmt ??= this.directory.prepare(`UPDATE _substrat_tenant_tuples SET revoked_at = ?
+           WHERE tenant_id = ? AND subject = ? AND relation = ? AND object = ? AND revoked_at IS NULL`)).run(now, tenantId, `principal:${principal}`, relation, object).changes > 0;
+            (fenceStmt ??= this.directory.prepare(RAISE_MEMBERSHIP_FENCE_SQL)).run(tenantId, principal, now);
+            if (changed)
+                audit(now);
+            return changed;
+        };
+        const revokeTenantRoleAndFence = (actor, assignment) => {
+            const { tenantId } = assignment.node;
+            return revokeAndFence(tenantId, assignment.principalId, `role:${assignment.roleKey}`, `tenant:${tenantId}`, (at) => this.recordAdmin(actor, 'unassignRole', { tenantId, scopeId: null }, assignment, null, at));
+        };
+        // The tenant-level reads the checker makes, synchronous, for the bound inside a unit.
+        const directoryReader = directoryTenantReader({
+            directory: this.directory,
+            getRole: (tenantId, key) => this.roles.get(`${tenantId}/${key}`),
+            clock: () => this.clock(),
+        });
         // The EXPLICIT grant: `INSERT OR REPLACE` clears a tombstone, because a re-grant must
         // grant. Provisioning seats with `seatScopeTuple` instead, which never un-revokes
         // (#1659) — keep the two apart.
@@ -4722,10 +4849,14 @@ export class SqliteScopeHost {
         const onNode = (node, body) => node.scopeId
             ? this.runtime(node.tenantId, node.scopeId).actor.turn(body)
             : Promise.resolve().then(body);
-        /** #1666: move one module's schedule switch on one scope — see `HostAdmin.revokeFromSystem`. */
-        const switchSystem = async (actor, raw, to) => {
-            const input = systemSwitch.parse(raw);
-            const { tenantId, scopeId } = input.node;
+        /**
+         * One kill switch moved on one scope — the ONE body `revokeFromSystem` / `restoreToSystem`
+         * (#1666, a module's `system:` authority) and `revokeFromPeer` / `restoreToPeer` (#1706, a
+         * peer vertical's) share, so the two levers cannot disagree about the record, the audit or
+         * the undo. `kind` says which; `key` is the module id or the peer's slug.
+         */
+        const switchSubject = async (actor, kind, node, key, reason, to) => {
+            const { tenantId, scopeId } = node;
             const scope = this.directory
                 .prepare('SELECT tenant_id FROM scopes WHERE scope_id = ?')
                 .get(scopeId);
@@ -4737,20 +4868,20 @@ export class SqliteScopeHost {
             // scope's file are separate databases, so a crash between them leaves an intent with
             // no recorded outcome — never a moved switch with no audit row.
             const operationId = ulid();
-            const action = to === 'off' ? 'revokeFromSystem' : 'restoreToSystem';
+            const action = switchActionOf(kind, to);
             const target = { tenantId, scopeId };
-            const base = { operationId, moduleId: input.moduleId, schedules: to };
-            this.recordAdmin(actor, action, target, null, { ...base, phase: 'intent', reason: input.reason });
-            // The directory's record (#1674), written BEFORE the scope moves, both ways, and undone
-            // if the move throws or holds nothing — see `recordSystemSwitchedOn` and (#1823)
-            // `recordSystemSwitchedOff` for why that order is the safe one.
+            const base = { operationId, ...switchAuditSubject(kind, key, to) };
+            this.recordAdmin(actor, action, target, null, { ...base, phase: 'intent', reason });
+            // The directory's record (#1674; #2029 for a peer), written BEFORE the scope moves, both
+            // ways, and undone if the move throws or holds nothing — see `recordSwitchedOn` and
+            // (#1823) `recordSwitchedOff` for why that order is the safe one.
             const at = new Date().toISOString();
             const directorySql = switchSqlOf(this.directory);
-            const record = { tenantId, scopeId, moduleId: input.moduleId, actor, reason: input.reason, operationId, at };
+            const record = { kind, tenantId, scopeId, key, actor, reason, operationId, at };
             const errorOf = (err) => (err instanceof Error ? err.message : String(err));
             let prior;
             try {
-                prior = to === 'on' ? recordSystemSwitchedOn(directorySql, record) : recordSystemSwitchedOff(directorySql, record);
+                prior = to === 'on' ? recordSwitchedOn(directorySql, record) : recordSwitchedOff(directorySql, record);
             }
             catch (err) {
                 // Nothing has moved: fail the call here, audited — the Cloudflare adapter's posture.
@@ -4762,9 +4893,15 @@ export class SqliteScopeHost {
                 }
                 throw err;
             }
+            // #2045: a newer call on this subject has recorded its position already: this one writes
+            // nothing, here or in the scope, and says so.
+            if (recordWriteSuperseded(prior, record)) {
+                this.recordAdmin(actor, action, target, null, { ...base, phase: 'refused', superseded: true });
+                throw substratError('conflict', switchSupersededMessage(kind, scopeId, key, to));
+            }
             /** The record's undo, after the scope's move threw or held nothing: retried once, never swallowed. */
             const undoRecord = () => {
-                const undo = () => restoreSystemSwitchRecord(directorySql, record, prior);
+                const undo = () => restoreSwitchRecord(directorySql, record, prior);
                 try {
                     undo();
                     return null;
@@ -4787,12 +4924,13 @@ export class SqliteScopeHost {
                 // with it — after this verb had already audited `applied`. `turn` is re-entrant, so a
                 // caller already inside one of this scope's tasks joins it rather than deadlocking.
                 //
-                // #1823: read in the same turn, so no tenant grant moves between the read and the switch.
-                // The directory is this process's own database, so the read is synchronous.
+                // #1823 (#2030 for a peer): read in the same turn, so no tenant grant moves between the
+                // read and the switch. The directory is this process's own database, so the read is
+                // synchronous.
                 const rt = this.runtime(tenantId, scopeId);
                 outcome = await rt.actor.turn(() => {
-                    const tenantHeld = tenantHoldsSystemGrant(directorySql, tenantId, input.moduleId, this.clock());
-                    return rt.db.transaction(() => switchSystemSchedules(switchSqlOf(rt.db), { moduleId: input.moduleId, scopeId, to, at, tenantHeld }))();
+                    const tenantHeld = tenantHoldsGrant(directorySql, kind, tenantId, key, this.clock());
+                    return rt.db.transaction(() => moveSwitch(switchSqlOf(rt.db), kind, { key, scopeId, to, at, tenantHeld, fence: operationId }))();
                 });
             }
             catch (err) {
@@ -4810,10 +4948,16 @@ export class SqliteScopeHost {
                 }
                 throw err;
             }
-            // A call that held nothing moved nothing (the module has no authority reaching the scope,
-            // its own or the tenant's), so its record write is undone: left `off`, it
-            // would switch the module off the day it is installed; left `on`, the next reconcile of
-            // a wiped scope would leave the module running.
+            // #2045: the scope has applied a newer call on this subject, so this move wrote nothing. The
+            // record is that newer call's too (its write overwrote this one's), so nothing is undone.
+            if (outcome.superseded) {
+                this.recordAdmin(actor, action, target, null, { ...base, phase: 'refused', superseded: true });
+                throw substratError('conflict', switchSupersededMessage(kind, scopeId, key, to));
+            }
+            // A call that held nothing moved nothing (the subject has no authority reaching the
+            // scope, its own or the tenant's), so its record write is undone: left `off`, it would
+            // switch the subject off the day it is installed; left `on`, the next reconcile of a
+            // wiped scope would leave it running.
             const recordError = outcome.held ? null : undoRecord();
             this.recordAdmin(actor, action, target, null, {
                 ...base,
@@ -4823,10 +4967,15 @@ export class SqliteScopeHost {
                 ...(recordError ? { recordError } : {}),
             });
             if (!outcome.held) {
-                throw substratError('not_found', `scope ${scopeId} holds no system grant for module '${input.moduleId}' — nothing to switch ${to} ` +
-                    `(check the module id: it is the module's manifest id, e.g. '@substrat-run/engine-absence')` +
+                throw substratError('not_found', switchNotFoundMessage(kind, scopeId, key, to) +
                     (recordError ? `; and its directory record could not be put back (${recordError})` : ''));
             }
+            return { operationId, outcome };
+        };
+        /** #1666: move one module's schedule switch on one scope — see `HostAdmin.revokeFromSystem`. */
+        const switchSystem = async (actor, raw, to) => {
+            const input = systemSwitch.parse(raw);
+            const { operationId, outcome } = await switchSubject(actor, 'system', input.node, input.moduleId, input.reason, to);
             return {
                 operationId,
                 moduleId: input.moduleId,
@@ -4835,58 +4984,10 @@ export class SqliteScopeHost {
                 permissions: outcome.permissions,
             };
         };
-        /**
-         * #1706: move one PEER's kill switch on one scope — see `HostAdmin.revokeFromPeer`. The
-         * schedule switch's body with the subject swapped (`switchPeer` → `switchSubjectGrants`):
-         * audit first, one turn on the scope actor, outcome after, `not_found` when nothing was held.
-         */
+        /** #1706: move one PEER's kill switch on one scope — see `HostAdmin.revokeFromPeer`. */
         const switchPeerAt = async (actor, raw, to) => {
             const input = peerSwitch.parse(raw);
-            const { tenantId, scopeId } = input.node;
-            const scope = this.directory
-                .prepare('SELECT tenant_id FROM scopes WHERE scope_id = ?')
-                .get(scopeId);
-            if (!scope || scope.tenant_id !== tenantId) {
-                throw substratError('not_found', `unknown scope for tenant: (${tenantId}, ${scopeId})`);
-            }
-            const operationId = ulid();
-            const action = to === 'off' ? 'revokeFromPeer' : 'restoreToPeer';
-            const target = { tenantId, scopeId };
-            const base = { operationId, vertical: input.vertical, calls: to };
-            this.recordAdmin(actor, action, target, null, { ...base, phase: 'intent', reason: input.reason });
-            let outcome;
-            try {
-                const rt = this.runtime(tenantId, scopeId);
-                outcome = await rt.actor.turn(() => rt.db.transaction(() => switchPeer(switchSqlOf(rt.db), {
-                    vertical: input.vertical,
-                    scopeId,
-                    to,
-                    at: new Date().toISOString(),
-                }))());
-            }
-            catch (err) {
-                try {
-                    this.recordAdmin(actor, action, target, null, {
-                        ...base,
-                        phase: 'failed',
-                        error: err instanceof Error ? err.message : String(err),
-                    });
-                }
-                catch {
-                    // Best effort: the original error is what the caller must see.
-                }
-                throw err;
-            }
-            this.recordAdmin(actor, action, target, null, {
-                ...base,
-                phase: outcome.held ? 'applied' : 'refused',
-                changed: outcome.changed,
-                permissions: outcome.permissions,
-            });
-            if (!outcome.held) {
-                throw substratError('not_found', `scope ${scopeId} holds no grant for peer '${input.vertical}' — nothing to switch ${to} ` +
-                    `(check the slug: it is the calling vertical's registry id, as the target's \`peers\` names it)`);
-            }
+            const { operationId, outcome } = await switchSubject(actor, 'peer', input.node, input.vertical, input.reason, to);
             return {
                 operationId,
                 vertical: input.vertical,
@@ -4961,7 +5062,7 @@ export class SqliteScopeHost {
             const states = await rt.actor.turn(() => systemGrantsStatus(switchSqlOf(rt.db), new Date().toISOString()));
             const offModules = new Set(states.filter((s) => s.schedules === 'off').map((s) => s.moduleId));
             const explanations = offModules.size > 0 ? lastSwitchedOff(tenantId, scopeId, offModules) : new Map();
-            const recorded = systemSwitchRecordsOf(switchSqlOf(this.directory), tenantId, scopeId);
+            const recorded = switchRecordsOf(switchSqlOf(this.directory), 'system', tenantId, scopeId);
             const result = withRecorded(states, recorded).map((s) => ({
                 moduleId: s.moduleId,
                 schedules: s.schedules,
@@ -5070,29 +5171,22 @@ export class SqliteScopeHost {
                 // Tombstone (K-21), never DELETE — the checker skips revoked_at rows, so the
                 // assignment stops resolving while staying visible to audit. Guarded on
                 // `revoked_at IS NULL` so a repeat unassign is a silent no-op.
-                const subject = `principal:${assignment.principalId}`;
-                const relation = `role:${assignment.roleKey}`;
-                const now = new Date().toISOString();
-                let changes;
-                if (assignment.node.scopeId) {
-                    // On the scope actor (#1678): a revoke that joined a stranger's transaction and
-                    // rolled back with it left the role LIVE after the caller was told it was gone.
-                    const scopeNode = assignment.node.scopeId;
-                    const rt = this.runtime(assignment.node.tenantId, scopeNode);
-                    changes = await rt.actor.turn(() => rt.db
-                        .prepare(`UPDATE _substrat_tuples SET revoked_at = ?
-                   WHERE subject = ? AND relation = ? AND object = ? AND revoked_at IS NULL`)
-                        .run(now, subject, relation, `scope:${scopeNode}`).changes);
-                }
-                else {
-                    changes = this.directory
-                        .prepare(`UPDATE _substrat_tenant_tuples SET revoked_at = ?
-               WHERE tenant_id = ? AND subject = ? AND relation = ? AND object = ? AND revoked_at IS NULL`)
-                        .run(now, assignment.node.tenantId, subject, relation, `tenant:${assignment.node.tenantId}`).changes;
+                const scopeNode = assignment.node.scopeId;
+                if (!scopeNode) {
+                    // One directory transaction (#1184): the revoke, the removal fence and the audit row.
+                    this.directory.transaction(() => revokeTenantRoleAndFence(actor, assignment))();
+                    return;
                 }
+                // On the scope actor (#1678): a revoke that joined a stranger's transaction and
+                // rolled back with it left the role LIVE after the caller was told it was gone.
+                const rt = this.runtime(assignment.node.tenantId, scopeNode);
+                const changes = await rt.actor.turn(() => rt.db
+                    .prepare(`UPDATE _substrat_tuples SET revoked_at = ?
+                 WHERE subject = ? AND relation = ? AND object = ? AND revoked_at IS NULL`)
+                    .run(new Date().toISOString(), `principal:${assignment.principalId}`, `role:${assignment.roleKey}`, `scope:${scopeNode}`).changes);
                 if (changes === 0)
                     return; // never assigned, or already revoked — idempotent, unaudited
-                this.recordAdmin(actor, 'unassignRole', { tenantId: assignment.node.tenantId, scopeId: assignment.node.scopeId }, assignment, null);
+                this.recordAdmin(actor, 'unassignRole', { tenantId: assignment.node.tenantId, scopeId: scopeNode }, assignment, null);
             },
             grant: async (actor, raw) => {
                 // Parsed like its `grantToConnection`/`grantToSystem` siblings, not taken on
@@ -5213,10 +5307,19 @@ export class SqliteScopeHost {
             },
             tenantHeldSystemModules: async (actor, tenantId, moduleIds) => {
                 const now = this.clock();
-                const held = moduleIds.filter((m) => tenantHoldsSystemGrant(switchSqlOf(this.directory), tenantId, m, now));
+                const held = tenantHeldOf(switchSqlOf(this.directory), 'system', tenantId, moduleIds, now);
                 this.recordAccess(actor, 'tenantHeldSystemModules', { tenantId }, { moduleIds: [...moduleIds] }, held.length);
                 return held;
             },
+            peerSwitchCarry: async (actor, node) => {
+                const directorySql = switchSqlOf(this.directory);
+                const switchedOffPeers = switchedOffOf(directorySql, 'peer', node.tenantId, node.scopeId);
+                const tenantHeldPeers = tenantHeldOf(directorySql, 'peer', node.tenantId, switchedOffPeers, this.clock());
+                const all = switchFencesOf(directorySql, 'peer', node.tenantId, node.scopeId);
+                const fences = Object.fromEntries(switchedOffPeers.map((v) => [v, all.get(v)]));
+                this.recordAccess(actor, 'peerSwitchCarry', node, null, switchedOffPeers.length);
+                return { switchedOffPeers, tenantHeldPeers, fences };
+            },
             reassertSystemSwitches: async (actor, node, opts) => {
                 this.assertScope(node.tenantId, node.scopeId);
                 const rt = this.runtime(node.tenantId, node.scopeId);
@@ -5300,7 +5403,7 @@ export class SqliteScopeHost {
                     // rebinding it would move another tenant's traffic. Exception: the holder is
                     // ARCHIVED or REAPED (a deleted app, storage since wiped) — it released the
                     // name, so the rebind reclaims it.
-                    throw new Error(`hostname '${parsed.hostname}' is already bound to another scope`);
+                    throw substratError('conflict', `hostname '${parsed.hostname}' is already bound to another scope`);
                 }
                 // Exactly one canonical per (scope, surface): "which one do certs and
                 // redirects use" has to have one answer, so a new canonical demotes the old.
@@ -5326,7 +5429,7 @@ export class SqliteScopeHost {
                     .prepare('SELECT tenant_id, scope_id, status FROM hostnames WHERE hostname = ?')
                     .get(hostname);
                 if (!row)
-                    throw new Error(`unknown hostname '${hostname}'`);
+                    throw substratError('not_found', `unknown hostname '${hostname}'`);
                 if (row.status === status)
                     return; // idempotent, and a no-op is not audited
                 this.directory
@@ -5340,7 +5443,7 @@ export class SqliteScopeHost {
                     .prepare('SELECT tenant_id, scope_id, status, custom_hostname_id, validation_records FROM hostnames WHERE hostname = ?')
                     .get(hostname);
                 if (!row)
-                    throw new Error(`unknown hostname '${hostname}'`);
+                    throw substratError('not_found', `unknown hostname '${hostname}'`);
                 const recordsJson = fields.validationRecords.length
                     ? JSON.stringify(fields.validationRecords)
                     : null;
@@ -5529,7 +5632,7 @@ export class SqliteScopeHost {
                     if (existing.ownerTenant !== parsed.ownerTenant) {
                         throw substratError('conflict', `vertical '${parsed.slug}' is owned by ${existing.ownerTenant ?? 'the platform'}, not ${parsed.ownerTenant ?? 'the platform'}`);
                     }
-                    throw new Error(`vertical '${parsed.slug}' is already registered as ${existing.source}`);
+                    throw substratError('conflict', `vertical '${parsed.slug}' is already registered as ${existing.source}`);
                 }
                 this.directory
                     .prepare('INSERT INTO verticals (slug, name, source, owner_tenant, env_spec, install_spec, listed, created_at) VALUES (?, ?, ?, ?, ?, ?, ?, ?)')
@@ -5762,11 +5865,11 @@ export class SqliteScopeHost {
                 // gate is about change, not about existence.
                 if (outgoing) {
                     if (outgoing.permissionDigest !== incoming.permissionDigest && !ack.permissionChange) {
-                        throw new Error(`promotion changes the permission surface (${outgoing.permissionDigest} → ` +
+                        throw substratError('conflict', `promotion changes the permission surface (${outgoing.permissionDigest} → ` +
                             `${incoming.permissionDigest}) — acknowledge it explicitly to promote`);
                     }
                     if (outgoing.migrationDigest !== incoming.migrationDigest && !ack.migrationChange) {
-                        throw new Error(`promotion changes migrations (${outgoing.migrationDigest} → ` +
+                        throw substratError('conflict', `promotion changes migrations (${outgoing.migrationDigest} → ` +
                             `${incoming.migrationDigest}) — acknowledge it explicitly to promote`);
                     }
                     // #1705 PR 3: an export an installed consumer imports, dropped or re-versioned.
@@ -6264,6 +6367,13 @@ export class SqliteScopeHost {
                 this.recordAccess(actor, 'lifecycleFlow', { tenantId, scopeId }, delegatedReadParams.lifecycleFlow(input), flow.observation.events);
                 return flow;
             },
+            operationSeries: async (actor, tenantId, scopeId, input) => {
+                // #1750: business volumes per bucket, for Pulse.
+                const db = this.scopeReadDbFor(tenantId, scopeId);
+                const series = readOperationSeries({ sql: scopedSql(db) }, input);
+                this.recordAccess(actor, 'operationSeries', { tenantId, scopeId }, delegatedReadParams.operationSeries(input), operationSeriesCount(series));
+                return series;
+            },
             scopeAppliedMigrations: async (actor, tenantId, scopeId) => {
                 const db = this.scopeReadDbFor(tenantId, scopeId);
                 const rows = db
@@ -6315,7 +6425,7 @@ export class SqliteScopeHost {
                     .prepare('SELECT org_id FROM orgs WHERE tenant_id = ? AND slug = ?')
                     .get(parsed.tenantId, parsed.slug);
                 if (slugOwner) {
-                    throw new Error(`org slug '${parsed.slug}' already taken by ${slugOwner.org_id} (slugs are unique per tenant)`);
+                    throw substratError('conflict', `org slug '${parsed.slug}' already taken by ${slugOwner.org_id} (slugs are unique per tenant)`);
                 }
                 this.directory
                     .prepare('INSERT INTO orgs (org_id, tenant_id, slug, name, created_at) VALUES (?, ?, ?, ?, ?)')
@@ -6343,18 +6453,39 @@ export class SqliteScopeHost {
                 writeTenantTuple(tenantId, `principal:${principal}`, 'member', `org:${orgId}`);
                 this.recordAdmin(actor, 'addMember', { tenantId }, null, { principal, orgId });
             },
+            applyMembership: async (actor, change) => {
+                // ONE directory transaction, synchronous throughout (#1184): the fence (an add's), the
+                // bound and the write. Nothing else on this host lands between them, and a failure
+                // leaves none.
+                const { tenantId, principal, roleKey, boundedBy } = change;
+                const assignment = { principalId: principal, roleKey, node: { tenantId, scopeId: null } };
+                return this.directory.transaction(() => {
+                    if (change.op === 'add') {
+                        const fence = this.directory
+                            .prepare(MEMBERSHIP_FENCE_SINCE_SQL)
+                            .get(tenantId, principal, change.unlessRemovedSince);
+                        if (fence)
+                            return { applied: false, removedAt: fence.removed_at };
+                    }
+                    const role = directoryReader.getRole(tenantId, roleKey);
+                    if (!role)
+                        return { applied: false, unknownRole: roleKey };
+                    const bound = tenantCoverage(directoryReader, tenantId, boundedBy, role.permissions);
+                    if (!bound.covered)
+                        return { applied: false, missing: bound.missing };
+                    if (change.op === 'remove')
+                        return { applied: true, changed: revokeTenantRoleAndFence(actor, assignment) };
+                    writeTenantTuple(tenantId, `principal:${principal}`, `role:${roleKey}`, `tenant:${tenantId}`);
+                    this.recordAdmin(actor, 'assignRole', { tenantId, scopeId: null }, null, assignment);
+                    return { applied: true };
+                })();
+            },
             removeMember: async (actor, tenantId, principal, orgId) => {
                 requireOrg(tenantId, orgId);
-                // Tombstone (K-21), never DELETE. Guarded on `revoked_at IS NULL` so a
-                // repeat revoke neither moves the timestamp nor writes a second audit row.
-                const info = this.directory
-                    .prepare(`UPDATE _substrat_tenant_tuples SET revoked_at = ?
-             WHERE tenant_id = ? AND subject = ? AND relation = 'member' AND object = ?
-               AND revoked_at IS NULL`)
-                    .run(new Date().toISOString(), tenantId, `principal:${principal}`, `org:${orgId}`);
-                if (info.changes === 0)
-                    return; // never a member, or already revoked
-                this.recordAdmin(actor, 'removeMember', { tenantId }, { principal, orgId }, null);
+                // Tombstone (K-21), never DELETE: a repeat revoke neither moves the timestamp nor writes
+                // a second audit row. One transaction with the removal fence (#1184), which a no-op
+                // raises too.
+                this.directory.transaction(() => revokeAndFence(tenantId, principal, 'member', `org:${orgId}`, (at) => this.recordAdmin(actor, 'removeMember', { tenantId }, { principal, orgId }, null, at)))();
             },
             listMembers: async (actor, tenantId, orgId, options) => {
                 requireOrg(tenantId, orgId);
@@ -6385,7 +6516,7 @@ export class SqliteScopeHost {
                     .prepare('SELECT tenant_id FROM tenants WHERE slug = ?')
                     .get(parsed.slug);
                 if (slugOwner) {
-                    throw new Error(`tenant slug '${parsed.slug}' already taken by ${slugOwner.tenant_id} (slugs are unique)`);
+                    throw substratError('conflict', `tenant slug '${parsed.slug}' already taken by ${slugOwner.tenant_id} (slugs are unique)`);
                 }
                 this.directory
                     .prepare(`INSERT INTO tenants (tenant_id, slug, name, status, created_at, provisioned_by_tenant)
@@ -6396,12 +6527,12 @@ export class SqliteScopeHost {
             setTenantStatus: async (actor, tenantId, status) => {
                 const before = readTenant(tenantId);
                 if (!before)
-                    throw new Error(`unknown tenant: ${tenantId}`);
+                    throw substratError('not_found', `unknown tenant: ${tenantId}`);
                 // `reaped` is terminal and destroys data — it is unreachable here and only
                 // ever set by reapTenant, so a plain status flip cannot forge a tombstone
                 // over live data (§4.8, the tenant analogue of reapScope's archived-only gate).
                 if (status === 'reaped') {
-                    throw new Error(`tenant ${tenantId} cannot be set to 'reaped' via setTenantStatus — reap goes through reapTenant (control-plane.md §4.8)`);
+                    throw substratError('validation_failed', `tenant ${tenantId} cannot be set to 'reaped' via setTenantStatus — reap goes through reapTenant (control-plane.md §4.8)`);
                 }
                 // Stamp/clear deleting_at so the grace-window sweep can age tenants (§4.8):
                 // entering `deleting` stamps, leaving it (an un-delete) clears — exactly the
@@ -6421,7 +6552,7 @@ export class SqliteScopeHost {
             setTenantName: async (actor, tenantId, name) => {
                 const before = readTenant(tenantId);
                 if (!before)
-                    throw new Error(`unknown tenant: ${tenantId}`);
+                    throw substratError('not_found', `unknown tenant: ${tenantId}`);
                 if (before.name === name)
                     return; // no-op is not audited — nothing changed
                 this.directory.prepare('UPDATE tenants SET name = ? WHERE tenant_id = ?').run(name, tenantId);
@@ -6553,7 +6684,7 @@ export class SqliteScopeHost {
                 // the query, so the quoted identifier below carries no user input.
                 const known = new Set(db.prepare(`SELECT name FROM sqlite_master WHERE type = 'table'`).all().map((r) => r.name));
                 if (!known.has(input.table))
-                    throw new Error(`unknown table '${input.table}'`);
+                    throw substratError('not_found', `unknown table '${input.table}'`);
                 // The ceiling clamps; a bound SQLite would misread (NaN, non-finite, fractional,
                 // negative) is refused instead of reaching LIMIT / OFFSET (#1632).
                 const limit = Math.min(assertRowLimit('limit', input.limit ?? SCOPE_TABLE_PAGE_DEFAULT), SCOPE_TABLE_PAGE_MAX);
@@ -6574,7 +6705,7 @@ export class SqliteScopeHost {
                 // itself rejects multi-statement strings and bad SQL with the driver's message.
                 const stmt = db.prepare(sql);
                 if (!stmt.readonly)
-                    throw new Error('read-only console: statement is not read-only');
+                    throw substratError('validation_failed', 'read-only console: statement is not read-only');
                 if (!stmt.reader)
                     return { columns: [], rows: [], truncated: false };
                 stmt.raw(true);
@@ -6720,6 +6851,7 @@ export class SqliteScopeHost {
                     loadDirectoryDump(dump.tables, {
                         columnsOf: (name) => builtColumnsOf(this.directory, name),
                         exec: (sql) => this.directory.exec(sql),
+                        now: () => this.clock(),
                         insert: (sql, rows) => {
                             const insert = this.directory.prepare(sql);
                             for (const row of rows)
@@ -6771,7 +6903,7 @@ export class SqliteScopeHost {
                     throw substratError('not_found', `unknown scope for tenant: (${tenantId}, ${scopeId})`);
                 }
                 if (rec.status !== 'archived') {
-                    throw new Error(`scope ${scopeId} is ${rec.status}, not archived — only an archived scope may be reaped`);
+                    throw substratError('conflict', `scope ${scopeId} is ${rec.status}, not archived — only an archived scope may be reaped`);
                 }
                 // A serving scope always holds ≥1 bound hostname; a truly-dead one has been
                 // unbound. The dashboard delete path unbinds AT archive, but a bare console
@@ -6787,7 +6919,7 @@ export class SqliteScopeHost {
                         .prepare('SELECT hostname FROM hostnames WHERE scope_id = ? LIMIT 1')
                         .get(scopeId);
                 if (bound) {
-                    throw new Error(`scope ${scopeId} still resolves hostname '${bound.hostname}' — ` +
+                    throw substratError('conflict', `scope ${scopeId} still resolves hostname '${bound.hostname}' — ` +
                         `unbind it before reaping (reap wipes storage and cannot be undone)`);
                 }
                 // The reader goes with the writer (#1624): an open handle on a removed file keeps
@@ -6938,9 +7070,9 @@ export class SqliteScopeHost {
                 // reaped — an illegal source fails closed, like reapScope's archived-only gate.
                 const before = readTenant(tenantId);
                 if (!before)
-                    throw new Error(`unknown tenant: ${tenantId}`);
+                    throw substratError('not_found', `unknown tenant: ${tenantId}`);
                 if (before.status !== 'deleting') {
-                    throw new Error(`tenant ${tenantId} is ${before.status}, not deleting — only a deleting tenant may be reaped`);
+                    throw substratError('conflict', `tenant ${tenantId} is ${before.status}, not deleting — only a deleting tenant may be reaped`);
                 }
                 // Clear the tenant's directory-side rows. Idempotent (set-to-empty), so a crash
                 // mid-reap converges on retry. KEPT as the tombstone: the `tenants` row itself
@@ -6954,6 +7086,9 @@ export class SqliteScopeHost {
                     '_substrat_entitlements', // per-tenant SKU flags
                     'orgs', // K-22 org records
                     '_substrat_system_switches', // #1674: the schedule switch's record, per scope
+                    '_substrat_membership_fences', // #1184: the latest removal, per principal
+                    '_substrat_peer_switches', // #2029: the peer switch's record, per scope
+                    '_substrat_switch_owed', // #2045: subjects owed a re-assert, per scope
                 ];
                 const clear = this.directory.transaction(() => {
                     for (const table of tables) {
@@ -7072,7 +7207,7 @@ export class SqliteScopeHost {
                     if (existing.topology === parsed.topology && existing.tenantId === parsed.tenantId) {
                         return;
                     }
-                    throw new Error(`identity pool '${parsed.provider}' is already registered as ${existing.topology}` +
+                    throw substratError('conflict', `identity pool '${parsed.provider}' is already registered as ${existing.topology}` +
                         `${existing.tenantId ? ` for tenant ${existing.tenantId}` : ''}`);
                 }
                 this.directory
@@ -7091,9 +7226,9 @@ export class SqliteScopeHost {
             listIdentityTenants: async (actor, provider, externalId) => {
                 const pool = readPool(provider);
                 if (!pool)
-                    throw new Error(`identity pool '${provider}' is not registered`);
+                    throw substratError('not_found', `identity pool '${provider}' is not registered`);
                 if (pool.topology !== 'central') {
-                    throw new Error(`identity pool '${provider}' is tenant-bound — enumerating tenants is only ` +
+                    throw substratError('forbidden', `identity pool '${provider}' is tenant-bound — enumerating tenants is only ` +
                         `meaningful on a central pool, where the same externalId is the same person`);
                 }
                 const tenants = this.directory
@@ -7107,9 +7242,9 @@ export class SqliteScopeHost {
             listIdentityMemberships: async (actor, provider, externalId) => {
                 const pool = readPool(provider);
                 if (!pool)
-                    throw new Error(`identity pool '${provider}' is not registered`);
+                    throw substratError('not_found', `identity pool '${provider}' is not registered`);
                 if (pool.topology !== 'central') {
-                    throw new Error(`identity pool '${provider}' is tenant-bound — enumerating tenants is only ` +
+                    throw substratError('forbidden', `identity pool '${provider}' is tenant-bound — enumerating tenants is only ` +
                         `meaningful on a central pool, where the same externalId is the same person`);
                 }
                 const rows = this.directory
@@ -7408,7 +7543,7 @@ export class SqliteScopeHost {
                 if (existing) {
                     if (existing.principal_id === parsed.principal)
                         return; // idempotent, unaudited
-                    throw new Error(`identity ${parsed.provider}:${parsed.externalId} in tenant ${parsed.tenantId} ` +
+                    throw substratError('conflict', `identity ${parsed.provider}:${parsed.externalId} in tenant ${parsed.tenantId} ` +
                         `is already bound to ${existing.principal_id}`);
                 }
                 this.directory
@@ -8689,7 +8824,7 @@ export class SqliteScopeHost {
         if (!r || r.tenant_id !== tenantId)
             throw substratError('not_found', `unknown scope for tenant: (${tenantId}, ${scopeId})`);
         if (r.status === 'reaped') {
-            throw new Error(`scope ${scopeId} is reaped — its storage is gone and cannot be read`);
+            throw substratError('conflict', `scope ${scopeId} is reaped — its storage is gone and cannot be read`);
         }
     }
     /**
@@ -8859,6 +8994,13 @@ export class SqliteScopeHost {
         // executes, the table always already has `kind` in its key, never `invocation_id`.
         this.ensureColumn(db, '_substrat_schedule_state', 'invocation_id', 'invocation_id TEXT');
         this.ensureColumn(db, '_substrat_job_runs', 'subject_id', 'subject_id TEXT');
+        // #2034: the lease, on a scope DB built before it. NULL = nobody holds the run.
+        this.ensureColumn(db, '_substrat_job_runs', 'lease_owner', 'lease_owner TEXT');
+        // #2042 r2, r4: whether the holder BEGAN its pass. NULL = it has not, which is right for any lease
+        // already there: a takeover of it costs nothing.
+        this.ensureColumn(db, '_substrat_job_runs', 'lease_began_at', 'lease_began_at TEXT');
+        // #2042 r3: consecutive admission misses. NULL = none, right for every run already there.
+        this.ensureColumn(db, '_substrat_job_runs', 'admission_misses', 'admission_misses INTEGER');
         // #2009: the copy classification on a scope DB built before it (NULL reads as a copy; see
         // `COPY_ORIGIN_DDL`).
         this.ensureColumn(db, '_substrat_copy_origin', 'is_copy', 'is_copy INTEGER');