@substrat-run/adapter-sqlite 0.137.0 → 0.139.0

package/dist/index.js

@@ -1,13 +1,13 @@
 import { existsSync, mkdirSync, readdirSync, readFileSync, rmSync, writeFileSync } from 'node:fs';
 import { dirname, join } from 'node:path';
 import Database from 'better-sqlite3';
-import { accessLogEntry, adminLogEntry, delegatedReadParams, opsFailureEntry, opsFailureFingerprint, issueEntry, FRESHNESS_HEARTBEAT_MINUTES, sweepRunEntry, modelUsageEntry, ATTACHMENT_ADDED, ATTACHMENT_REMOVED, attachmentRecord, createTenantInput, domainEvent, domainEventInput, exportReadInput, importBatch, importCursorMove, exportsOfManifestJson, importsOfManifestJson, entitlementGrant, entitlementGrantInput, eventId, meterReading, platformRequestInput, platformRequestId, MAX_PENDING_PLATFORM_REQUESTS, identityLink, identityPool, instant, connection, capabilityGrant, connectionGrant, connectionGrantRecord, connectionSecret, systemGrant, systemSwitch, systemSwitchRecord, peerSwitch, verticalCaller, verticalSlug as verticalSlugOf, subjectRef, requestFingerprint, createConnectionInput, projectedConnectionGrant, projectedConnectionKey, moduleManifest, createOrgInput, promotionAcknowledgement, bindAcknowledgement, bindHostnameInput, channelHistoryEntry, hostnameBinding, publishVersionInput, AUTO_ADMISSION_NOTE, routeTarget, ROUTE_SCOPE_HOSTNAMES_MAX, registerVerticalInput, vertical as verticalSchema, verticalChannel, verticalVersion, objectRef, entityObjectRef, assertModuleEmittableType, assertKernelAuthoredType, grantRefFromProof, org as orgSchema, orgMembership, principalId, resolvedIdentity, identityMembership, roleDefinition, scope as scopeSchema, tenant as tenantSchema, tenantRole, subjectShredReceipt, SCOPE_TABLE_PAGE_DEFAULT, SCOPE_TABLE_PAGE_MAX, SCOPE_QUERY_ROW_MAX, verticalServingState, callsOfManifestJson, outboundOfManifestJson, listLimitOf, substratError, assertReplayableDump, delegatedReadRecord, ownerTransferAudit, copyMarkAudit, redrainEventsInput, REDRAIN_BATCH, } from '@substrat-run/contracts';
-import { actorOf, asPrincipal, assertAllowed, assertNoSecret, assertPermissionKey, CAPABILITY_DDL, COPY_ORIGIN_DDL, CAPABILITY_EXCHANGE_OPERATION, capabilityAttachmentWriteRefused, capabilityTokenHash, createCapabilityVerbs, createEntityEdgeVerbs, exchangeCapability as exchangeCapabilitySecret, guardSecrets, mintBecomeCapability, plausibleSessionToken, readCapabilityPage, redactSecrets, redactSecretText, moduleLog, consoleLogSink, asyncInvocationId, asyncLinePass, consoleInvocationLineSink, resolveCapabilitySession, revokeCapabilityAsPlatform, assertReadOnlyQuery, attachmentBlobKey, attachmentSha256, entitlementDenial, requiredEntitlementFor, foldMeterReading, guardSpine, guardSqlLimits, DO_SQL_LIMITS, tooManyResultColumns, tooManyTableColumns, parseValidationRecords, resolveScopeRecord, ulid, ISSUE_RETENTION_DAYS, telemetryRetentionStatements, assertRowLimit, assertRowOffset, OPS_FAILURE_RETENTION_DAYS, SWEEP_RUN_RETENTION_DAYS, SWEEP_RUNS_INTENT_INDEX, sweepRunsIntentHasKind, MODEL_USAGE_RETENTION_DAYS, foldModelUsage, backoffAt, platformRequestHistoryQuery, platformRequestOf, PLATFORM_REQUEST_COLUMNS, PLATFORM_REQUEST_REDACTION_SQL, platformRequestRedactionParams, platformRequestRedactionQuery, intentPayloadCarriesSubject, redactSubjectJobRuns, redactSubjectScopeText, redactSubjectDirectoryText, ISSUE_EXEMPLAR_OWNER_BACKFILL_SQL, issueExemplarOwner, JOB_RUN_PATCH_SQL, JOB_STEP_RECORD_SQL, DELIVERY_ERROR_REDACTION_SQL, REDACTED_DELIVERY_NOTE, seatScopeTuple, switchSystemSchedules, admitPeer, collectPeers, peerSeats, resolveVerticalInstanceFrom, switchPeer, peerGrantsStatus, systemGrantsStatus, systemScheduleState, systemSwitchedOff, systemSwitchedOffMessage, tenantSystemSwitchedOffMessage, SYSTEM_SWITCHES_BACKFILL_SQL, SYSTEM_SWITCHES_DDL, forgetSystemSwitchesOf, listSystemSwitchRecords, recordSystemSwitchedOff, recordSystemSwitchedOn, restoreSystemSwitchRecord, scopesSwitchedOffFor, tenantHoldsSystemGrant, switchedOffModulesOf, inUnitMovesToAudit, staleCarryRevertRow, staleCarryReverts, systemSwitchRecordsOf, systemSwitchesTableExists, withRecorded, VERSION_MIGRATIONS_DDL, splitManifestMigrations, splitVersionMigrationsBatch, versionMigrationsOf, writeVersionMigrations, denialListQuery, refusalListQuery, mapRefusalRow, denialSummaryQuery, denialTotalsQuery, DENIAL_WINDOW_QUERY, mapDenialRow, mapDenialSummaryBuckets, IMPERSONATION_COLUMNS, IMPERSONATION_DDL, ImpersonationRefused, assertImpersonationWrites, assertModuleEnqueueableKind, assertSessionUsable, impersonationByIdQuery, impersonationListQuery, impersonationRowValues, impersonationStampOf, mapImpersonationRow, newImpersonationSession, resolveRetryPolicy, isSecretBoxConfigured, unconfiguredSecretBox, createSubjectKeys, generateSealingKeyPair, noSealingKeyMessage, openSealed, sealTo, ConnectionSealingKeyUnavailableError, PermissionDenied, createAtomic, NotSearchable, NotListable, listIndexMigrations, listIndexPlans, listQuery, cursorOf, moduleMigrations, isSearchIndexTable, searchIndexDdl, searchIndexMigrations, searchIndexPlans, searchLimit, searchMatchExpression, searchQuery, ATTACHMENT_TEXT_DDL, assertAttachmentExtractors, assertJobRegistrable, attachmentRecordOfRow, attachmentTextJob, enqueueAttachmentText, isAttachmentTextRun, reconcileAttachmentText, recordAttachmentText, searchAttachments, entityVersionQuery, entityVersionOf, assertIfMatch, OUTBOX_ENTITY_INDEX, SCHEDULE_STATE_DDL, SCHEDULE_STATE_REBUILD, scheduleStateHasKind, VERTICAL_EVENTS_DDL, EXPORT_HOPS_SQL, IMPORT_CURSORS_SQL, IMPORT_CURSOR_OF_SQL, OUTBOX_MARK_SQL, emittedSinceQuery, emittedReportOf, EMITTED_REPORT_CAP, exportedSinceQuery, IMPORT_CURSOR_ADVANCE_SQL, IMPORT_RECORD_SQL, moveImportCursor, importCursorSourceOf, exportBreaksOf, exportBreakRefusal, bindExportBreaksOf, bindExportBreakRefusal, CrossVerticalRegistry, exportReadPlan, exportReadQuery, planExportBatch, withheldNote, JOB_RUN_DDL, JOB_RUN_DUE_AT, jobRunListLimit, jobRunOf, runDueJobRuns, startJobRun, IDEMPOTENCY_DDL, REFUSALS_TABLE_DDL, REFUSALS_INDEX, refusalInsert, refusalOf, markGuardRefusal, REFUSALS_REBUILD, refusalsAdmitGuards, assertIdempotencyKey, idempotencyLookupQuery, idempotencyPruneStatement, idempotencyRecordStatement, idempotencyOptedOutMessage, replayFor, globalFetch, createUlid, facetEvents, readHistory, walkEventCause, walkEventEffects, assertRedrainWindow, readInvocation, readDeadLetters, readLifecycleFlow, domainEventOf, readUndrainedOutbox, undrainedEventsOf, connectorCallRecord, noopConnectorCallRecorder, recordConnectorCall, settleConnectionUse, unknownRoleError, } from '@substrat-run/kernel';
-import { attributedHost } from '@substrat-run/kernel';
+import { accessLogEntry, adminLogEntry, delegatedReadParams, operationSeriesCount, opsFailureEntry, opsFailureFingerprint, issueEntry, FRESHNESS_HEARTBEAT_MINUTES, sweepRunEntry, modelUsageEntry, ATTACHMENT_ADDED, ATTACHMENT_REMOVED, attachmentRecord, createTenantInput, domainEvent, domainEventInput, exportReadInput, importBatch, importCursorMove, exportsOfManifestJson, importsOfManifestJson, entitlementGrant, entitlementGrantInput, eventId, meterReading, platformRequestInput, platformRequestId, MAX_PENDING_PLATFORM_REQUESTS, identityLink, identityPool, instant, connection, capabilityGrant, connectionGrant, connectionGrantRecord, connectionSecret, systemGrant, systemSwitch, systemSwitchRecord, peerSwitch, verticalCaller, verticalSlug as verticalSlugOf, subjectRef, requestFingerprint, createConnectionInput, projectedConnectionGrant, projectedConnectionKey, moduleManifest, createOrgInput, promotionAcknowledgement, bindAcknowledgement, bindHostnameInput, channelHistoryEntry, hostnameBinding, publishVersionInput, AUTO_ADMISSION_NOTE, routeTarget, ROUTE_SCOPE_HOSTNAMES_MAX, registerVerticalInput, vertical as verticalSchema, verticalChannel, verticalVersion, objectRef, entityObjectRef, assertModuleEmittableType, assertKernelAuthoredType, grantRefFromProof, org as orgSchema, orgMembership, principalId, resolvedIdentity, identityMembership, roleDefinition, scope as scopeSchema, tenant as tenantSchema, tenantRole, subjectShredReceipt, SCOPE_TABLE_PAGE_DEFAULT, SCOPE_TABLE_PAGE_MAX, SCOPE_QUERY_ROW_MAX, verticalServingState, callsOfManifestJson, outboundOfManifestJson, listLimitOf, SCOPE_GATE_REASONS, substratError, assertReplayableDump, delegatedReadRecord, ownerTransferAudit, memberChangeAudit, copyMarkAudit, redrainEventsInput, REDRAIN_BATCH, } from '@substrat-run/contracts';
+import { actorOf, asPrincipal, assertAllowed, assertNoSecret, assertPermissionKey, CAPABILITY_DDL, COPY_ORIGIN_DDL, ENTITY_STATE_MOVES_DDL, CAPABILITY_EXCHANGE_OPERATION, capabilityAttachmentWriteRefused, capabilityTokenHash, createCapabilityVerbs, createEntityEdgeVerbs, createEntityStateVerbs, createTrashedReads, searchStateWhere, uncheckedView, addStatePlans, entityStateMigrations, entityStateTriggerDdl, statefulTablesOf, assertEntityStateIntact, stateListIndexNames, exchangeCapability as exchangeCapabilitySecret, guardSecrets, mintBecomeCapability, plausibleSessionToken, readCapabilityPage, redactSecrets, redactSecretText, moduleLog, consoleLogSink, asyncInvocationId, asyncLinePass, consoleInvocationLineSink, resolveCapabilitySession, revokeCapabilityAsPlatform, assertReadOnlyQuery, attachmentBlobKey, attachmentSha256, entitlementDenial, requiredEntitlementFor, foldMeterReading, guardSpine, guardSqlLimits, DO_SQL_LIMITS, tooManyResultColumns, tooManyTableColumns, parseValidationRecords, resolveScopeRecord, ulid, ISSUE_RETENTION_DAYS, telemetryRetentionStatements, FINDINGS_DDL, createFindingRule, findingOfOpsFailure, findingOfSweepRun, pruneFindings, listFindingRules, listFindings, observeFinding, revokeFindingRule, setFindingStatus, assertRowLimit, assertRowOffset, OPS_FAILURE_RETENTION_DAYS, SWEEP_RUN_RETENTION_DAYS, SWEEP_RUNS_INTENT_INDEX, sweepRunsIntentHasKind, MODEL_USAGE_RETENTION_DAYS, foldModelUsage, backoffAt, platformRequestHistoryQuery, platformRequestOf, PLATFORM_REQUEST_COLUMNS, PLATFORM_REQUEST_REDACTION_SQL, platformRequestRedactionParams, platformRequestRedactionQuery, intentPayloadCarriesSubject, redactSubjectJobRuns, redactSubjectScopeText, redactSubjectDirectoryText, ISSUE_EXEMPLAR_OWNER_BACKFILL_SQL, issueExemplarOwner, JOB_RUN_PATCH_SQL, JOB_RUN_CLAIM_SQL, JOB_RUN_RENEW_SQL, JOB_RUN_BEGIN_SQL, JOB_RUN_MISS_SQL, JOB_RUN_MISS_SETTLE_SQL, admissionMissOutcome, JOB_STEP_RECORD_SQL, JOB_LEASE_EXPIRED_NOTE, assertLeaseMs, DELIVERY_ERROR_REDACTION_SQL, REDACTED_DELIVERY_NOTE, seatScopeTuple, applyScopeRoleChange, changeScopeRole, revokeScopeRoles, scopeRoleHolders, admitPeer, collectPeers, peerSeats, resolveVerticalInstanceFrom, peerGrantsStatus, systemGrantsStatus, systemScheduleState, systemSwitchedOff, systemSwitchedOffMessage, tenantSystemSwitchedOffMessage, PEER_SWITCHES_DDL, SWITCH_OWED_DDL, SWITCH_FENCES_DDL, recordWriteSuperseded, switchFencesOf, switchSupersededMessage, SWITCH_KINDS, SYSTEM_SWITCHES_DDL, forgetSwitchesOf, listSystemSwitchRecords, moveSwitch, reassertActionOf, reassertEntry, reassertOffRow, recordSwitchedOff, recordSwitchedOn, restoreSwitchRecord, scopesSwitchedOffFor, switchActionOf, switchAuditSubject, switchNotFoundMessage, switchRecordsOf, switchedOffOf, switchesBackfillSqlOf, switchesTableExists, tenantHeldOf, tenantHoldsGrant, inUnitMovesToAudit, staleCarryRevertRow, staleCarryReverts, withRecorded, VERSION_MIGRATIONS_DDL, splitManifestMigrations, splitVersionMigrationsBatch, versionMigrationsOf, writeVersionMigrations, denialListQuery, refusalListQuery, mapRefusalRow, denialSummaryQuery, denialTotalsQuery, DENIAL_WINDOW_QUERY, mapDenialRow, mapDenialSummaryBuckets, IMPERSONATION_COLUMNS, IMPERSONATION_DDL, ImpersonationRefused, assertImpersonationWrites, assertModuleEnqueueableKind, assertSessionUsable, impersonationByIdQuery, impersonationListQuery, impersonationRowValues, impersonationStampOf, mapImpersonationRow, newImpersonationSession, resolveRetryPolicy, executorOutcomeOf, isDeliveryRefusal, refusalJournalText, membershipFencesBackfillSql, MEMBERSHIP_FENCES_DDL, membershipFencesTableExists, MEMBERSHIP_FENCE_SINCE_SQL, RAISE_MEMBERSHIP_FENCE_SQL, memberAddedAudit, orgChangeBound, tenantCoverage, isSecretBoxConfigured, unconfiguredSecretBox, createSubjectKeys, generateSealingKeyPair, noSealingKeyMessage, openSealed, sealTo, ConnectionSealingKeyUnavailableError, PermissionDenied, createAtomic, NotSearchable, NotListable, listIndexDdl, listIndexMigrations, listIndexPlans, listQuery, cursorOf, moduleMigrations, isSearchIndexTable, searchIndexDdl, searchIndexMigrations, searchIndexPlans, searchLimit, searchMatchExpression, searchQuery, ATTACHMENT_TEXT_DDL, assertAttachmentExtractors, resolveAttachmentTextBounds, assertJobRegistrable, attachmentRecordOfRow, attachmentTextJob, enqueueAttachmentText, ATTACHMENT_TEXT_BACKFILL_JOB, ATTACHMENT_TEXT_JOB, kernelJobFor, queueAttachmentTextBackfill, startAttachmentTextBackfill, attachmentTextBackfillJob, reconcileAttachmentText, recordAttachmentText, searchAttachments, entityVersionQuery, entityVersionOf, assertIfMatch, OUTBOX_ENTITY_INDEX, SCHEDULE_STATE_DDL, SCHEDULE_STATE_REBUILD, scheduleStateHasKind, VERTICAL_EVENTS_DDL, EXPORT_HOPS_SQL, emptyImportResult, IMPORT_CURSORS_SQL, IMPORT_CURSOR_OF_SQL, OUTBOX_MARK_SQL, emittedSinceQuery, emittedReportOf, EMITTED_REPORT_CAP, exportedSinceQuery, IMPORT_CURSOR_ADVANCE_SQL, IMPORT_RECORD_SQL, moveImportCursor, importCursorSourceOf, exportBreaksOf, exportBreakRefusal, bindExportBreaksOf, bindExportBreakRefusal, CrossVerticalRegistry, exportReadPlan, exportReadQuery, planExportBatch, withheldNote, JOB_RUN_DDL, JOB_RUN_DUE_AT, jobRunListLimit, jobRunOf, runDueJobRuns, startJobRun, IDEMPOTENCY_DDL, REFUSALS_TABLE_DDL, REFUSALS_INDEX, refusalInsert, refusalOf, markGuardRefusal, REFUSALS_REBUILD, refusalsAdmitGuards, assertIdempotencyKey, idempotencyLookupQuery, idempotencyPruneStatement, idempotencyRecordStatement, idempotencyOptedOutMessage, replayFor, globalFetch, createUlid, facetEvents, readHistory, walkEventCause, walkEventEffects, assertRedrainWindow, readInvocation, readDeadLetters, readLifecycleFlow, readOperationSeries, domainEventOf, readUndrainedOutbox, undrainedEventsOf, connectorCallRecord, noopConnectorCallRecorder, recordConnectorCall, settleConnectionUse, unknownRoleError, } from '@substrat-run/kernel';
+import { attributedView } from '@substrat-run/kernel';
 import { INERT_SCOPE_REASON, isPrimaryScopeRow } from '@substrat-run/kernel';
 import { LEGACY_SCOPE_ROWS_BACKFILL, assertNoSpineReference, assertSpineTablesBuilt, capabilitiesForLoad, dumpRowsInsert, isSpineTable, loadDirectoryDump, repointScopeGrants, settleCopiedWork, emittedHere, spineColumnAdditions } from '@substrat-run/kernel';
 import { ScopeActor } from './actor.js';
-import { createTupleChecker } from './checker.js';
+import { createTupleChecker, directoryTenantReader } from './checker.js';
 /**
  * A fault in the database itself (full, corrupt, I/O), as opposed to one statement failing.
  * The #1764 backfill logs and opens past a failed batch, but never past one of these.
@@ -213,6 +213,9 @@ const KERNEL_DDL = `
   -- #1686: where a copied scope's data came from, and the event id its own events start above.
   -- Shared with the other adapter from @substrat-run/kernel; the column comments are there.
   ${COPY_ORIGIN_DDL}
+  -- #119: the kernel's authorization for one archive/trash move, read by the derived update
+  -- trigger. Shared with the other adapter from @substrat-run/kernel; the comments are there.
+  ${ENTITY_STATE_MOVES_DDL}
   -- #383 / #1232 / #1288: the platform sweep's per-scope gating state, holding two
   -- families of row that the kind COLUMN — not the spelling of a key — tells apart.
   -- Spine (kernel-written), never a module migration. Shared with the DO adapter from
@@ -243,6 +246,7 @@ const KERNEL_DDL = `
     rows_changed INTEGER,
     PRIMARY KEY (module_id, version)
   );
+  ${SWITCH_FENCES_DDL}
   CREATE TABLE IF NOT EXISTS _substrat_tuples (
     subject TEXT NOT NULL,
     relation TEXT NOT NULL,
@@ -520,6 +524,8 @@ export class SqliteScopeHost {
     searchPlans = new Map();
     /** #811: the paged lists modules declare, by entity type. Same one-owner rule as search. */
     listPlans = new Map();
+    /** #119: entity type → its archive/trash plan, from every registered module. */
+    statePlans = new Map();
     /** entityType → the declared attachment gate (#473): read key + write key (default: read). */
     attachmentTargets = new Map();
     /** operation name → who binds it: the owning module, its entitlementKey and its declared
@@ -556,10 +562,10 @@ export class SqliteScopeHost {
      */
     jobs = new Map();
     /**
-     * The event currently being effected by an executor, stamped onto any admin rows
-     * it writes. Ambient rather than threaded through every HostAdmin signature: it is
-     * set and cleared immediately around one `await`, and executors run sequentially,
-     * so there is no window where it belongs to a different event.
+     * The event an executor is effecting, stamped onto the admin rows it writes (K-22). Like
+     * `onBehalfOf`, only ever set on a VIEW (`causedByView`, or `attributed` with a
+     * `causedBy`), never on the host: a field set around the handler's `await` stamped every
+     * admin call the host served meanwhile — a staff call included — with that event (#2055).
      */
     causedBy = null;
     /**
@@ -572,6 +578,7 @@ export class SqliteScopeHost {
     secretBox;
     /** The parsers attachment text is extracted with (K-43); the host's own, never imported here. */
     attachmentExtractors;
+    attachmentTextBounds;
     fetchImpl;
     connectorCalls;
     clock;
@@ -589,6 +596,7 @@ export class SqliteScopeHost {
         this.secretBox = options.secretBox ?? unconfiguredSecretBox;
         assertAttachmentExtractors(options.attachmentExtractors ?? []);
         this.attachmentExtractors = options.attachmentExtractors ?? [];
+        this.attachmentTextBounds = resolveAttachmentTextBounds(options.attachmentTextBounds);
         this.fetchImpl = options.fetch ?? globalFetch;
         this.connectorCalls = options.connectorCalls ?? noopConnectorCallRecorder;
         this.clock = options.clock ?? (() => instant.parse(new Date().toISOString()));
@@ -1063,6 +1071,9 @@ export class SqliteScopeHost {
       );
       ${IMPERSONATION_DDL}
       ${SYSTEM_SWITCHES_DDL}
+      ${MEMBERSHIP_FENCES_DDL}
+      ${PEER_SWITCHES_DDL}
+      ${SWITCH_OWED_DDL}
       CREATE TABLE IF NOT EXISTS _substrat_admin_log (
         id TEXT PRIMARY KEY,
         actor TEXT NOT NULL,
@@ -1142,6 +1153,8 @@ export class SqliteScopeHost {
         resolved_at TEXT
       );
       CREATE INDEX IF NOT EXISTS _substrat_issues_seen ON _substrat_issues (last_seen);
+      -- #1748: tenant findings and their suppress rules — kernel-owned DDL (findings.ts).
+      ${FINDINGS_DDL}
       -- The durable sweep record (#1232): one row per unit outcome per pass —
       -- a connection swept/skipped/failed, a schedule fired/skipped/failed. What
       -- makes "when was this last swept" answerable after the log line rolls off.
@@ -1237,10 +1250,16 @@ export class SqliteScopeHost {
      */
     ensureDirectorySchema() {
         this.directory.transaction(() => {
-            const switchRecordIsNew = !systemSwitchesTableExists(switchSqlOf(this.directory));
+            // Each kill switch's record (#1674, #2029) is backfilled on the pass that creates its table.
+            const newRecords = SWITCH_KINDS.filter((kind) => !switchesTableExists(switchSqlOf(this.directory), kind));
+            const fencesAreNew = !membershipFencesTableExists(switchSqlOf(this.directory));
             this.buildDirectorySchema();
-            if (switchRecordIsNew)
-                this.directory.exec(SYSTEM_SWITCHES_BACKFILL_SQL);
+            for (const kind of newRecords)
+                this.directory.exec(switchesBackfillSqlOf(kind));
+            // #1184: the removal fence, for everyone removed before it existed — the same once-only
+            // gate — stamped now, by the host clock (`membershipFencesBackfillSql` says why).
+            if (fencesAreNew)
+                this.directory.exec(membershipFencesBackfillSql(this.clock()));
         })();
         this.splitVersionMigrations();
     }
@@ -1448,14 +1467,17 @@ export class SqliteScopeHost {
         // #811: the list indexes this module's `lists` declare — same placement and
         // the same reason as the search indexes above: appended AFTER the module's
         // own migrations, so `CREATE INDEX` names a table that exists.
-        const listMigrations = listIndexMigrations(manifest.id, manifest.lists);
-        for (const m of listMigrations) {
+        // #119: the archive/trash columns, and the plans the verbs and the reads consult.
+        const stateMigrations = entityStateMigrations(manifest.id, manifest.entityStates);
+        const listMigrations = listIndexMigrations(manifest.id, manifest.lists, manifest.entityStates);
+        for (const m of [...stateMigrations, ...listMigrations]) {
             if (seen.has(m.version)) {
                 throw new Error(`duplicate migration version in ${manifest.id}: ${m.version}`);
             }
             seen.add(m.version);
         }
-        for (const plan of listIndexPlans(manifest.id, manifest.lists)) {
+        addStatePlans(this.statePlans, manifest.id, manifest.entityStates, manifest.permissions);
+        for (const plan of listIndexPlans(manifest.id, manifest.lists, manifest.entityStates)) {
             const existing = this.listPlans.get(plan.entityType);
             if (existing) {
                 throw new Error(`list: '${plan.entityType}' declares a paged list in both '${existing.moduleId}' and ` +
@@ -1578,10 +1600,10 @@ export class SqliteScopeHost {
             .prepare('SELECT status FROM tenants WHERE tenant_id = ?')
             .get(input.tenantId);
         if (!tenantRow) {
-            throw new Error(`cannot provision scope under unknown tenant: ${input.tenantId}`);
+            throw substratError('conflict', `cannot provision scope under unknown tenant: ${input.tenantId}`);
         }
         if (tenantRow.status !== 'active') {
-            throw new Error(`cannot provision scope under non-active tenant (status: ${tenantRow.status}): ${input.tenantId}`);
+            throw substratError('conflict', `cannot provision scope under non-active tenant (status: ${tenantRow.status}): ${input.tenantId}`);
         }
         const record = resolveScopeRecord(input);
         // Idempotency is on the scope_id (§3.3: provisioning is idempotent and
@@ -1600,7 +1622,7 @@ export class SqliteScopeHost {
                 .prepare("SELECT scope_id FROM scopes WHERE tenant_id = ? AND slug = ? AND status NOT IN ('archived', 'reaped')")
                 .get(input.tenantId, record.slug);
             if (slugOwner) {
-                throw new Error(`scope slug '${record.slug}' already taken under tenant ${input.tenantId} ` +
+                throw substratError('conflict', `scope slug '${record.slug}' already taken under tenant ${input.tenantId} ` +
                     `by ${slugOwner.scope_id} (slugs are unique within a tenant)`);
             }
             this.directory
@@ -1666,51 +1688,52 @@ export class SqliteScopeHost {
     }
     /**
      * `HostAdmin.reassertSystemSwitches`' body (#1674), run inside a turn the caller already
-     * holds on the scope's actor: every module the directory records OFF on the scope is
-     * switched off again. Already off answers `changed: false` and writes nothing, and a
-     * module with no authority reaching the scope (no grant here, no tenant-level grant) is left
-     * alone. Audited only when something moved.
+     * holds on the scope's actor: every module, and (#2029) every peer, the directory records OFF
+     * on the scope is switched off again. Already off answers `changed: false` and writes nothing,
+     * and a subject with no authority reaching the scope (no grant here, no tenant-level grant) is
+     * left alone. Audited only when something moved, under each kind's re-assert action.
      *
      * `audit` receives each row. By default it writes to the admin log at once. A caller running
      * this inside a scope transaction that may still roll back (a restore's replay) collects
      * the rows and writes them once the transaction commits. The admin log is another
      * database, and a row must not outlive a move that was rolled back.
      */
-    reassertSwitchesInTurn(rt, actor, tenantId, scopeId, opts, audit = (after) => this.recordAdmin(actor, 'reassertSystemSwitch', { tenantId, scopeId }, null, after)) {
+    reassertSwitchesInTurn(rt, actor, tenantId, scopeId, opts, audit = (action, after) => this.recordAdmin(actor, action, { tenantId, scopeId }, null, after)) {
         const at = new Date().toISOString();
-        // #1742 review: a move the deployment made from a stale list — the module was restored
-        // ON after the list was read — is undone first, so the operator's ON stands.
-        const recorded = systemSwitchRecordsOf(switchSqlOf(this.directory), tenantId, scopeId);
-        // One synchronous turn: no switch can land between this read and the moves below.
-        const reverted = new Set(staleCarryReverts(recorded, opts?.appliedInUnit));
-        for (const moduleId of reverted) {
-            const outcome = rt.db.transaction(() => switchSystemSchedules(switchSqlOf(rt.db), { moduleId, scopeId, to: 'on', at }))();
-            if (outcome.changed)
-                audit({ operationId: ulid(), ...staleCarryRevertRow(moduleId, outcome) });
-        }
-        const recordedOff = switchedOffModulesOf(switchSqlOf(this.directory), tenantId, scopeId);
-        // #1742: what a deployment already switched off inside its own unit, audited here — the
-        // switch below answers `changed: false` for it and would write no row.
-        // A move the revert above undid is not credited as an in-unit OFF.
-        const applied = opts?.appliedInUnit?.filter((a) => !reverted.has(a.moduleId));
-        for (const row of inUnitMovesToAudit(recordedOff, applied))
-            audit({ operationId: ulid(), ...row });
-        return recordedOff.map((moduleId) => {
-            // #1823: a module whose only authority here is a tenant-level grant is held too.
-            const tenantHeld = tenantHoldsSystemGrant(switchSqlOf(this.directory), tenantId, moduleId, this.clock());
-            const outcome = rt.db.transaction(() => switchSystemSchedules(switchSqlOf(rt.db), { moduleId, scopeId, to: 'off', at, tenantHeld }))();
-            if (outcome.changed) {
-                audit({
-                    operationId: ulid(),
-                    moduleId,
-                    schedules: 'off',
-                    phase: 'applied',
-                    changed: true,
-                    permissions: outcome.permissions,
-                });
+        const directorySql = switchSqlOf(this.directory);
+        const results = [];
+        for (const kind of SWITCH_KINDS) {
+            const action = reassertActionOf(kind);
+            // #2045: every move carries the fence of the call the record holds, so a scope moved since by
+            // a newer call stays as that call put it.
+            const fences = switchFencesOf(directorySql, kind, tenantId, scopeId);
+            const move = (key, to, tenantHeld) => rt.db.transaction(() => moveSwitch(switchSqlOf(rt.db), kind, { key, scopeId, to, at, tenantHeld, fence: fences.get(key) }))();
+            // #1742 review: a move the deployment made from a stale list — the subject was restored
+            // ON after the list was read — is undone first, so the operator's ON stands.
+            const recorded = switchRecordsOf(directorySql, kind, tenantId, scopeId);
+            // One synchronous turn: no switch can land between this read and the moves below.
+            const reverted = new Set(staleCarryReverts(kind, recorded, opts?.appliedInUnit));
+            for (const key of reverted) {
+                const outcome = move(key, 'on');
+                if (outcome.changed)
+                    audit(action, { operationId: ulid(), ...staleCarryRevertRow(kind, key, outcome) });
             }
-            return { moduleId, held: outcome.held, changed: outcome.changed };
-        });
+            const recordedOff = switchedOffOf(directorySql, kind, tenantId, scopeId);
+            // #1742: what a deployment already switched off inside its own unit, audited here — the
+            // switch below answers `changed: false` for it and would write no row. A move the revert
+            // above undid is not credited as an in-unit OFF.
+            for (const row of inUnitMovesToAudit(kind, recordedOff, opts?.appliedInUnit, reverted)) {
+                audit(action, { operationId: ulid(), ...row });
+            }
+            for (const key of recordedOff) {
+                // #1823 (#2030): a subject whose only authority here is a tenant-level grant is held too.
+                const outcome = move(key, 'off', tenantHoldsGrant(directorySql, kind, tenantId, key, this.clock()));
+                if (outcome.changed)
+                    audit(action, { operationId: ulid(), ...reassertOffRow(kind, key, outcome.permissions) });
+                results.push(reassertEntry(kind, key, outcome));
+            }
+        }
+        return results;
     }
     async provisionTenantStore(actor, input) {
         // Fail closed on an unknown/inactive tenant, exactly as provisionScope does: a store
@@ -1720,10 +1743,10 @@ export class SqliteScopeHost {
             .prepare('SELECT status FROM tenants WHERE tenant_id = ?')
             .get(input.tenantId);
         if (!tenantRow) {
-            throw new Error(`cannot provision tenant store under unknown tenant: ${input.tenantId}`);
+            throw substratError('not_found', `cannot provision tenant store under unknown tenant: ${input.tenantId}`);
         }
         if (tenantRow.status !== 'active') {
-            throw new Error(`cannot provision tenant store under non-active tenant (status: ${tenantRow.status}): ${input.tenantId}`);
+            throw substratError('conflict', `cannot provision tenant store under non-active tenant (status: ${tenantRow.status}): ${input.tenantId}`);
         }
         // Idempotent on (tenant, vertical, binding): a retried provision re-resolves the SAME
         // store rather than minting a second database (the K-31 ready-gate retries the whole
@@ -1791,10 +1814,10 @@ export class SqliteScopeHost {
             .prepare('SELECT status FROM tenants WHERE tenant_id = ?')
             .get(input.tenantId);
         if (!tenantRow) {
-            throw new Error(`cannot provision blob store under unknown tenant: ${input.tenantId}`);
+            throw substratError('not_found', `cannot provision blob store under unknown tenant: ${input.tenantId}`);
         }
         if (tenantRow.status !== 'active') {
-            throw new Error(`cannot provision blob store under non-active tenant (status: ${tenantRow.status}): ${input.tenantId}`);
+            throw substratError('conflict', `cannot provision blob store under non-active tenant (status: ${tenantRow.status}): ${input.tenantId}`);
         }
         const existing = this.directory
             .prepare('SELECT ref FROM blob_stores WHERE tenant_id = ? AND vertical = ? AND binding = ?')
@@ -2255,6 +2278,18 @@ export class SqliteScopeHost {
                 if (present.has(plan.table))
                     db.exec(searchIndexDdl(plan));
             }
+            // #119: the guard triggers went with the dropped table. Put back AFTER the rows, which
+            // may legitimately arrive archived or trashed.
+            for (const plan of this.statePlans.values()) {
+                if (present.has(plan.table))
+                    db.exec(entityStateTriggerDdl(plan));
+            }
+            // #811 / #119: the derived list indexes went with it too, and a load never put them back —
+            // an archivable entity's partial indexes are part of what the kernel checks after DDL.
+            for (const plan of this.listPlans.values()) {
+                if (present.has(plan.table))
+                    db.exec(listIndexDdl(plan));
+            }
             // #1575: attachment text is not in a dump, so a load left it as it was. Drop the
             // text of attachments the dump did not bring back, and queue extraction for those
             // it brought back without text — the bytes decide what that run finds.
@@ -2316,9 +2351,9 @@ export class SqliteScopeHost {
         const rows = [];
         // #1869: the re-point's source is the separate hint when given; the dump is otherwise as sent.
         const source = { tables: dump.tables, scopeId: opts?.sourceScopeId ?? dump.scopeId };
-        await this.loadDump(tenantId, scopeId, source, (rt) => this.reassertSwitchesInTurn(rt, actor, tenantId, scopeId, undefined, (after) => rows.push(after)));
-        for (const after of rows)
-            this.recordAdmin(actor, 'reassertSystemSwitch', { tenantId, scopeId }, null, after);
+        await this.loadDump(tenantId, scopeId, source, (rt) => this.reassertSwitchesInTurn(rt, actor, tenantId, scopeId, undefined, (action, after) => rows.push([action, after])));
+        for (const [action, after] of rows)
+            this.recordAdmin(actor, action, { tenantId, scopeId }, null, after);
         this.recordAdmin(actor, 'restoreScope', { tenantId, scopeId }, null, { sourceScopeId: dump.scopeId, tables: dump.tables.length, capturedAt: dump.capturedAt });
     }
     async snapshotScope(actor, tenantId, scopeId, opts) {
@@ -2351,7 +2386,7 @@ export class SqliteScopeHost {
         if (!rec)
             throw substratError('not_found', `unknown scope ${scopeId} in tenant ${tenantId}`);
         if (!rec.forkedFrom && rec.kind !== 'preview') {
-            throw new Error(`scope ${scopeId} is not a fork or preview — only previews may be deleted; ` +
+            throw substratError('forbidden', `scope ${scopeId} is not a fork or preview — only previews may be deleted; ` +
                 `archive a primary scope instead`);
         }
         // Close and evict the runtime handle before touching the file.
@@ -2364,7 +2399,7 @@ export class SqliteScopeHost {
         // orphaned bytes with no record (the §9 hazard).
         this.directory.prepare('DELETE FROM hostnames WHERE scope_id = ?').run(scopeId);
         rmSync(join(this.dir, `${tenantId}__${scopeId}.sqlite`), { force: true });
-        forgetSystemSwitchesOf(switchSqlOf(this.directory), scopeId);
+        forgetSwitchesOf(switchSqlOf(this.directory), scopeId);
         this.directory.prepare('DELETE FROM scopes WHERE scope_id = ?').run(scopeId);
         this.recordAdmin(actor, 'deleteSnapshot', { tenantId, scopeId }, null, {
             forkedFrom: rec.forkedFrom,
@@ -2389,10 +2424,12 @@ export class SqliteScopeHost {
             .prepare('SELECT status FROM tenants WHERE tenant_id = ?')
             .get(tenantId);
         if (!tenantRow) {
-            throw new Error(`scope has no tenant record: (${tenantId}, ${scopeId})`);
+            throw substratError('not_found', `scope has no tenant record: (${tenantId}, ${scopeId})`, {
+                reason: SCOPE_GATE_REASONS.unrecorded,
+            });
         }
         if (tenantRow.status !== 'active') {
-            throw new Error(`tenant not active (status: ${tenantRow.status}): ${tenantId}`);
+            throw substratError('conflict', `tenant not active (status: ${tenantRow.status}): ${tenantId}`, { reason: SCOPE_GATE_REASONS.notActive });
         }
         // `provisioning` is handled BELOW rather than here, because a scope that never
         // finished setting up should still retry its migrations when touched — that lazy
@@ -2401,7 +2438,7 @@ export class SqliteScopeHost {
         // deliberate states, and running migrations for them would be work on behalf of a
         // request that is going to be refused anyway.
         if (row.status !== 'active' && row.status !== 'provisioning') {
-            throw new Error(`scope not active (status: ${row.status}): ${scopeId}`);
+            throw substratError('conflict', `scope not active (status: ${row.status}): ${scopeId}`, { reason: SCOPE_GATE_REASONS.notActive });
         }
         const rt = this.runtime(tenantId, scopeId);
         await this.applyPendingMigrations(rt);
@@ -2410,7 +2447,7 @@ export class SqliteScopeHost {
             // the scope exists on the vertical's side (K-31). Refused, but only after the
             // retry above has had its chance — and if THAT is what failed, it threw with
             // the migration's own message, which is the one an operator needs.
-            throw new Error(`scope not active (status: ${row.status}): ${scopeId}`);
+            throw substratError('conflict', `scope not active (status: ${row.status}): ${scopeId}`, { reason: SCOPE_GATE_REASONS.notActive });
         }
         return this.buildStub(tenantId, scopeId, rt, asPrincipal(principal), options);
     }
@@ -2446,7 +2483,7 @@ export class SqliteScopeHost {
                 `runs '${scope.vertical ?? 'none'}'`);
         }
         if (scope.status !== 'active') {
-            throw new Error(`scope not active (status: ${scope.status}): ${scopeId}`);
+            throw substratError('conflict', `scope not active (status: ${scope.status}): ${scopeId}`, { reason: SCOPE_GATE_REASONS.notActive });
         }
         const rt = this.runtime(conn.tenant_id, scopeId);
         await this.applyPendingMigrations(rt);
@@ -2474,7 +2511,7 @@ export class SqliteScopeHost {
                 `runs '${scope.vertical ?? 'none'}'`);
         }
         if (scope.status !== 'active') {
-            throw new Error(`scope not active (status: ${scope.status}): ${scopeId}`);
+            throw substratError('conflict', `scope not active (status: ${scope.status}): ${scopeId}`, { reason: SCOPE_GATE_REASONS.notActive });
         }
         const rt = this.runtime(conn.tenant_id, scopeId);
         await this.applyPendingMigrations(rt);
@@ -2509,7 +2546,7 @@ export class SqliteScopeHost {
             throw substratError('not_found', `unknown scope for tenant: (${tenantId}, ${scopeId})`);
         }
         if (scope.status !== 'active') {
-            throw new Error(`scope not active (status: ${scope.status}): ${scopeId}`);
+            throw substratError('conflict', `scope not active (status: ${scope.status}): ${scopeId}`, { reason: SCOPE_GATE_REASONS.notActive });
         }
         const rt = this.runtime(tenantId, scopeId);
         await this.applyPendingMigrations(rt);
@@ -2521,7 +2558,7 @@ export class SqliteScopeHost {
         // and the scope must be active. Authority is then an ordinary check against
         // `system:<moduleId>` grants inside the stub; nothing here is a person.
         if (!this.modules.has(moduleId)) {
-            throw new Error(`module not registered on this host: ${moduleId}`);
+            throw substratError('not_found', `module not registered on this host: ${moduleId}`);
         }
         const scope = this.directory
             .prepare('SELECT tenant_id, status FROM scopes WHERE scope_id = ?')
@@ -2530,7 +2567,7 @@ export class SqliteScopeHost {
             throw substratError('not_found', `unknown scope: ${scopeId}`);
         }
         if (scope.status !== 'active') {
-            throw new Error(`scope not active (status: ${scope.status}): ${scopeId}`);
+            throw substratError('conflict', `scope not active (status: ${scope.status}): ${scopeId}`, { reason: SCOPE_GATE_REASONS.notActive });
         }
         const rt = this.runtime(tenantId, scopeId);
         await this.applyPendingMigrations(rt);
@@ -2600,15 +2637,11 @@ export class SqliteScopeHost {
         const source = batch.source;
         const rt = await this.openActiveScope(tenantId, scopeId);
         return rt.actor.enqueue(async () => {
-            const result = {
-                delivered: 0,
-                deadLettered: 0,
-                duplicates: 0,
-                withheld: 0,
-                cursor: batch.after,
-                stale: false,
-                paused: null,
-            };
+            const result = emptyImportResult(batch);
+            // #2004: a copy consumes no other vertical's events, at the door as in the sweep
+            // (`scope-copy.ts`). A pause: nothing runs and the watermark stays.
+            if (!this.isPrimaryInDirectory(scopeId))
+                return { ...result, paused: { reason: INERT_SCOPE_REASON } };
             // #1706's door, for a delivery (`operation: null`): the producer must be a declared peer
             // of this vertical with its switch on. Admitted inside the actor task, before anything
             // runs, so a switch pulled between two passes refuses the second. A refusal is a PAUSE:
@@ -2676,16 +2709,14 @@ export class SqliteScopeHost {
                     const { hops: _hops, ...fact } = e;
                     const event = structuredClone({ ...fact, source });
                     const unit = unitOf(imp.moduleId, e.id, e.type);
-                    // What the handler emits was emitted BECAUSE of the producer's event (#1237). The id
-                    // resolves through `_substrat_imports`, which the row above has just written.
-                    rt.causedBy = e.id;
-                    rt.unitInvocationId = unit.invocationId;
                     rt.db.exec('BEGIN IMMEDIATE');
                     try {
                         // As the producer's principal, admitted above: the handler's checks are real ones,
                         // against the grants this vertical's `peers` gave it, and its emits carry the actor
-                        // `{ vertical, scope }` and the authorization they passed (K-34).
-                        await imp.handler(this.operationContext(rt, subject), event);
+                        // `{ vertical, scope }` and the authorization they passed (K-34). What it emits was
+                        // emitted BECAUSE of the producer's event (#1237); the id resolves through
+                        // `_substrat_imports`, which the row above has just written.
+                        await imp.handler(this.deliveryContext(rt, subject, undefined, { causedBy: e.id, invocationId: unit.invocationId }), event);
                         rt.db
                             .prepare(`INSERT INTO _substrat_deliveries (event_id, consumer_module, delivered_at, invocation_id)
                  VALUES (?, ?, ?, NULL)`)
@@ -2702,10 +2733,6 @@ export class SqliteScopeHost {
                         result.deadLettered += 1;
                         lines.write({ ...unit, outcome: 'dead-lettered', error: err });
                     }
-                    finally {
-                        rt.causedBy = null;
-                        rt.unitInvocationId = null;
-                    }
                 }
                 if (!ran)
                     result.duplicates += 1;
@@ -2797,10 +2824,10 @@ export class SqliteScopeHost {
             .prepare('SELECT status FROM tenants WHERE tenant_id = ?')
             .get(tenantId);
         if (!tenant || tenant.status !== 'active') {
-            throw new Error(`tenant not active (status: ${tenant?.status ?? 'missing'}): ${tenantId}`);
+            throw substratError('conflict', `tenant not active (status: ${tenant?.status ?? 'missing'}): ${tenantId}`, { reason: SCOPE_GATE_REASONS.notActive });
         }
         if (scope.status !== 'active') {
-            throw new Error(`scope not active (status: ${scope.status}): ${scopeId}`);
+            throw substratError('conflict', `scope not active (status: ${scope.status}): ${scopeId}`, { reason: SCOPE_GATE_REASONS.notActive });
         }
         const rt = this.runtime(tenantId, scopeId);
         await this.applyPendingMigrations(rt);
@@ -2916,20 +2943,44 @@ export class SqliteScopeHost {
         const target = principalId.parse(assignee);
         return rt.actor.turn(async () => {
             const bound = await this.assignmentBound(subject, tenantId, scopeId, roleKey);
-            if (bound.covered) {
-                rt.db.prepare(`INSERT OR REPLACE INTO _substrat_tuples (subject, relation, object, expires_at)
-           VALUES (?, ?, ?, NULL)`).run(`principal:${target}`, `role:${roleKey}`, `scope:${scopeId}`);
-            }
+            if (bound.covered)
+                applyScopeRoleChange(switchSqlOf(rt.db), scopeId, target, { revoke: [], grant: roleKey }, this.clock());
             return bound;
         });
     }
+    async listScopeRoleHolders(tenantId, scopeId, principal) {
+        const rt = await this.openActiveScope(tenantId, scopeId);
+        const who = principal === undefined ? undefined : principalId.parse(principal);
+        return rt.actor.enqueue(() => scopeRoleHolders(switchSqlOf(rt.db), scopeId, this.clock(), who));
+    }
+    async changeScopeRoleBounded(tenantId, scopeId, caller, principal, from, to) {
+        const rt = await this.openActiveScope(tenantId, scopeId);
+        const target = principalId.parse(principal);
+        const answer = await rt.actor.turn(() => changeScopeRole(switchSqlOf(rt.db), scopeId, target, from, to, this.clock(), this.roleBound(caller, tenantId, scopeId), (run) => rt.db.transaction(run)()));
+        if (answer === 'not-held')
+            throw substratError('conflict', `${target} does not hold '${from}' at this scope`);
+        if (answer === 'unknown-to')
+            throw unknownRoleError(to);
+        return answer;
+    }
+    async revokeScopeRolesBounded(tenantId, scopeId, caller, principal) {
+        const rt = await this.openActiveScope(tenantId, scopeId);
+        return rt.actor.turn(() => revokeScopeRoles(switchSqlOf(rt.db), scopeId, principalId.parse(principal), this.clock(), this.roleBound(caller, tenantId, scopeId), (run) => rt.db.transaction(run)()));
+    }
+    /** The caller's bound per role at the scope, `null` for a role this tenant does not define (#1150). */
+    roleBound(caller, tenantId, scopeId) {
+        const subject = asPrincipal(principalId.parse(caller));
+        return async (roleKey) => this.roles.has(`${tenantId}/${roleKey}`) ? this.assignmentBound(subject, tenantId, scopeId, roleKey) : null;
+    }
     /**
      * §5.1's assignment bound, resolved against the SAME role table the checker expands
      * — not a vertical's compile-time `ROLES` array. A tenant's projected role is what
      * assignment would actually confer, and that is what has to be bounded. The one
      * resolution both `ctx.canAssign` and the host's `canAssign` answer from.
      */
-    async assignmentBound(subject, tenantId, scopeId, roleKey) {
+    async assignmentBound(subject, tenantId, 
+    /** Null for the tenant node — the executor's `level: 'tenant'` (#1184). */
+    scopeId, roleKey) {
         const role = this.roles.get(`${tenantId}/${roleKey}`);
         if (!role) {
             throw unknownRoleError(roleKey);
@@ -3280,6 +3331,8 @@ export class SqliteScopeHost {
                 let replayed = false;
                 // #1746: what this call itself emitted, for `onEmitted`. Set only after a commit.
                 let emittedReport;
+                // #1184: what this call's executors did inline, for `onExecutorOutcomes`.
+                const executorOutcomes = invokeOptions?.onExecutorOutcomes ? [] : undefined;
                 const invoked = await rt.actor.enqueue(async () => {
                     // #1237: the invocation this call belongs to, for the duration of it. Set
                     // INSIDE the actor task — the actor serializes invoke and dispatch alike, so
@@ -3449,7 +3502,7 @@ export class SqliteScopeHost {
                             // #1525: still inside the actor task that set it, so these deliveries are
                             // this call's own work — the same tail its consumers' emits are stamped in.
                             await this.dispatch(rt, rt.invocationId);
-                            await this.dispatchExecutors(rt, rt.invocationId);
+                            await this.dispatchExecutors(rt, rt.invocationId, executorOutcomes);
                         }
                         if (exportMark !== null && !replayed) {
                             const q = exportedSinceQuery(exportTypes, exportMark);
@@ -3476,6 +3529,8 @@ export class SqliteScopeHost {
                     invokeOptions?.onIdempotentReplay?.();
                 if (emittedReport)
                     invokeOptions?.onEmitted?.(emittedReport);
+                if (executorOutcomes && !replayed && session?.mode !== 'read-only')
+                    invokeOptions?.onExecutorOutcomes?.(executorOutcomes);
                 return invoked;
             },
         };
@@ -3564,6 +3619,17 @@ export class SqliteScopeHost {
      * At-least-once still requires idempotent handlers. Retry is the backstop, not a
      * substitute.
      */
+    /**
+     * #1184: the scope reads an executor's handler may make, built over `rt` directly. The
+     * handler runs INSIDE this scope's actor task, so a host read that re-enqueued — the
+     * public `canAssign`, `admin.entityHistory` — would wait on the task holding it.
+     */
+    executorScope(rt) {
+        return {
+            history: async (entity, page) => readHistory({ sql: scopedSql(rt.db) }, entity, page),
+            covers: (principal, roleKey, level) => this.assignmentBound(asPrincipal(principalId.parse(principal)), rt.tenantId, level === 'scope' ? rt.scopeId : null, roleKey),
+        };
+    }
     async dispatchExecutors(rt, 
     /**
      * #1525: the call this drain pass is running in, or null — PASSED, not read off
@@ -3572,7 +3638,9 @@ export class SqliteScopeHost {
      * and journal over RPC, so the id has to travel as an argument on that side, and
      * a recorded fact whose correctness argument differs per adapter drifts.
      */
-    invocationId) {
+    invocationId, 
+    /** #1184: what each attempt did, for the emitting call's `onExecutorOutcomes`. */
+    outcomes) {
         const report = {
             attempted: 0,
             delivered: 0,
@@ -3583,15 +3651,16 @@ export class SqliteScopeHost {
             return report;
         const lines = asyncLinePass(this.invocationLineSink);
         try {
-            await this.dispatchExecutorsPass(rt, invocationId, report, lines);
+            await this.dispatchExecutorsPass(rt, invocationId, report, lines, outcomes);
         }
         finally {
             lines.end();
         }
         return report;
     }
-    async dispatchExecutorsPass(rt, invocationId, report, lines) {
+    async dispatchExecutorsPass(rt, invocationId, report, lines, outcomes) {
         const now = new Date().toISOString();
+        const scope = this.executorScope(rt);
         // #2005: a non-primary scope (a fork, a snapshot, a preview of either kind) causes no
         // outbound effects. Every executor is host code acting with platform authority — a
         // connector with the tenant's credential, a plain executor with `HostAdmin` — so its
@@ -3643,26 +3712,44 @@ export class SqliteScopeHost {
                     lines.write({ ...unit, attempt: attempts, outcome: 'dead-lettered' });
                     continue;
                 }
+                const outcomeOf = (outcome, error) => {
+                    outcomes?.push(executorOutcomeOf(id, event, outcome, error));
+                };
                 if (isInert()) {
                     const { attempts } = this.recordExecutorDelivery(rt, row.id, deliveryId, INERT_SCOPE_REASON, TERMINAL_RETRY, invocationId);
                     report.inert = (report.inert ?? 0) + 1;
+                    outcomeOf('inert', INERT_SCOPE_REASON);
                     // Its own outcome, never `delivered`: no handler ran (#2005).
                     lines.write({ ...unit, attempt: attempts, outcome: 'inert' });
                     continue;
                 }
-                this.causedBy = event.id;
+                // #2055: the handler writes through a view bound to its event, never through the host.
+                const caused = this.causedByView(event.id);
                 try {
+                    let result;
                     if (executor.kind === 'connector') {
                         // `true`: dispatchExecutors is only ever reached from inside
                         // `rt.actor.enqueue` (invoke's post-commit tail, or drainDue).
-                        await executor.handler(this.connectorContext(rt, executor.timeoutMs, true, event.id), event);
+                        await executor.handler(caused.connectorContext(rt, executor.timeoutMs, true, event.id), event);
                     }
                     else {
-                        await executor.handler(this.admin, event);
+                        result = await executor.handler(caused.admin, event, scope);
+                    }
+                    // #1184: a refusal is the handler's own terminal decision — journaled with its
+                    // reason, never retried, and listed by `executorDeadLetters` beside an exhausted one.
+                    const refused = isDeliveryRefusal(result) ? result : null;
+                    const text = refused && refusalJournalText(refused);
+                    const { attempts } = this.recordExecutorDelivery(rt, row.id, deliveryId, text, refused ? TERMINAL_RETRY : executor.retry, invocationId);
+                    if (refused) {
+                        report.deadLettered += 1;
+                        outcomeOf('refused', refused.reason);
+                        lines.write({ ...unit, attempt: attempts, outcome: 'dead-lettered', error: text });
+                    }
+                    else {
+                        report.delivered += 1;
+                        outcomeOf('delivered');
+                        lines.write({ ...unit, attempt: attempts, outcome: 'delivered' });
                     }
-                    const { attempts } = this.recordExecutorDelivery(rt, row.id, deliveryId, null, executor.retry, invocationId);
-                    report.delivered += 1;
-                    lines.write({ ...unit, attempt: attempts, outcome: 'delivered' });
                 }
                 catch (err) {
                     const { dead, attempts } = this.recordExecutorDelivery(rt, row.id, deliveryId, err instanceof Error ? (err.stack ?? err.message) : String(err), executor.retry, invocationId);
@@ -3670,11 +3757,9 @@ export class SqliteScopeHost {
                         report.deadLettered += 1;
                     else
                         report.retrying += 1;
+                    outcomeOf(dead ? 'dead-lettered' : 'retrying', err);
                     lines.write({ ...unit, attempt: attempts, outcome: dead ? 'dead-lettered' : 'retrying', error: err });
                 }
-                finally {
-                    this.causedBy = null;
-                }
             }
         }
     }
@@ -3727,13 +3812,14 @@ export class SqliteScopeHost {
         // emitting operation's own tail made.
         return rt.actor.enqueue(() => this.dispatchExecutors(rt, null));
     }
-    registerJob(moduleId, name, handler, retry) {
+    registerJob(moduleId, name, handler, retry, options) {
         // #1575: the kernel's own jobs are dispatched before this registry is read.
         assertJobRegistrable(moduleId, name);
+        assertLeaseMs(options?.leaseMs);
         const key = `${moduleId}/${name}`;
         if (this.jobs.has(key))
             throw new Error(`job '${key}' is already registered`);
-        this.jobs.set(key, { handler, retry });
+        this.jobs.set(key, { handler, retry, leaseMs: options?.leaseMs });
     }
     /**
      * D-14's in-process driver: the run store is direct SQL on the scope db.
@@ -3766,11 +3852,24 @@ export class SqliteScopeHost {
          (id, module_id, job, instance, payload, status, cursor, counters, attempts,
           last_error, started_at, updated_at, next_attempt_at, ended_at, subject_id)
        VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`);
-        // A compare-and-set on `running` (#1632): a pass that outlived an erasure must not
-        // write its cursor back over the redaction. The kernel's statement, so both adapters
-        // hold the same line.
+        // A compare-and-set on `running` (#1632) and on the pass's lease (#2034): a pass that
+        // outlived an erasure, or lost its run to a takeover, must not write back over it. The
+        // kernel's statement, so both adapters hold the same line.
         const patchRun = db.prepare(JOB_RUN_PATCH_SQL);
-        const patchArgs = (id, p) => [p.status, p.cursor, p.counters, p.attempts, p.lastError, p.updatedAt, p.nextAttemptAt, p.endedAt, id];
+        const patchArgs = (id, p, owner) => [p.status, p.cursor, p.counters, p.attempts, p.lastError, p.updatedAt, p.nextAttemptAt, p.endedAt, id, owner];
+        const beganAt = db.prepare('SELECT lease_began_at FROM _substrat_job_runs WHERE id = ?');
+        const beginRun = db.prepare(JOB_RUN_BEGIN_SQL);
+        const missRun = db.prepare(JOB_RUN_MISS_SQL);
+        const missSettle = db.prepare(JOB_RUN_MISS_SETTLE_SQL);
+        // #2042 r4: every lease time is this host's clock as the statement runs, inside its turn —
+        // never a time the drive computed, which a skew or a wait in the queue would make wrong.
+        const now = () => this.clock();
+        const plus = (at, ms) => new Date(Date.parse(at) + ms).toISOString();
+        const claimRun = db.prepare(JOB_RUN_CLAIM_SQL);
+        const renewRun = db.prepare(JOB_RUN_RENEW_SQL);
+        const recordStepRow = db.prepare(JOB_STEP_RECORD_SQL);
+        const dropSteps = db.prepare('DELETE FROM _substrat_job_steps WHERE run_id = ?');
+        const stepRow = db.prepare('SELECT step, result, attempts, last_error FROM _substrat_job_steps WHERE run_id = ? AND step = ?');
         // `db.transaction` on better-sqlite3 runs its body SYNCHRONOUSLY inside a real
         // SQLite transaction, so nothing — not another turn of the event loop, not
         // another caller of this host — can interleave between the read and the write.
@@ -3782,9 +3881,37 @@ export class SqliteScopeHost {
             insertRun.run(r.id, r.module_id, r.job, r.instance, r.payload, r.status, r.cursor, r.counters, r.attempts, r.last_error, r.started_at, r.updated_at, r.next_attempt_at, r.ended_at, r.subject_id ?? null);
             return r;
         });
-        const commitPassTx = db.transaction((id, p) => {
-            patchRun.run(...patchArgs(id, p));
-            db.prepare('DELETE FROM _substrat_job_steps WHERE run_id = ?').run(id);
+        const commitPassTx = db.transaction((id, p, owner) => {
+            // #2034: the ledger goes only with a patch that applied — a stale holder's commit must
+            // not empty the ledger of the pass that took the run over.
+            if (patchRun.run(...patchArgs(id, p, owner)).changes === 0)
+                return false;
+            dropSteps.run(id);
+            return true;
+        });
+        // #2034: the claim, and whether it took over a lease, read in the same transaction.
+        const claimTx = db.transaction((id, owner, leaseMs) => {
+            // #2042 r2, r4: a takeover is charged only when the lease it takes had BEGUN its pass.
+            const before = beganAt.get(id);
+            const at = now();
+            const claimed = row(claimRun.get(owner, plus(at, leaseMs), at, JOB_LEASE_EXPIRED_NOTE, id, at));
+            return claimed && { run: claimed, takeover: (before?.lease_began_at ?? null) !== null };
+        });
+        // #2042 r3, r4: an admission miss — the relative count, then the backoff or failure it calls for.
+        const missTx = db.transaction((id, owner, note) => {
+            const at = now();
+            const counted = missRun.get(at, id, owner);
+            if (!counted)
+                return null;
+            const o = admissionMissOutcome(counted.admission_misses, at, note);
+            missSettle.run(o.status, o.nextAttemptAt, o.endedAt, o.lastError, id, counted.admission_misses);
+            return { misses: counted.admission_misses, failed: o.status === 'failed' };
+        });
+        const recordStepTx = db.transaction((runId, name, result, attempts, lastError, at, owner, leaseMs) => {
+            if (renewRun.run(plus(now(), leaseMs), runId, owner).changes === 0)
+                return false;
+            recordStepRow.run(runId, name, result, attempts, lastError, at, runId, owner);
+            return true;
         });
         // Every store operation takes its own short turn on the scope actor, so no
         // statement here can land inside an `invoke`'s open transaction. `turn` is the
@@ -3792,7 +3919,13 @@ export class SqliteScopeHost {
         const turn = (fn) => rt.actor.enqueue(fn);
         return {
             startOrJoin: (key, r) => turn(() => startOrJoinTx(key, r)),
-            get: (id) => turn(() => row(db.prepare('SELECT * FROM _substrat_job_runs WHERE id = ?').get(id))),
+            claim: (id, owner, leaseMs) => turn(() => claimTx(id, owner, leaseMs)),
+            // #2042 r4: BEGIN, the commitment point, judged by this host's clock as it runs.
+            begin: (id, owner, marginMs) => turn(() => {
+                const at = now();
+                return beginRun.run(at, id, owner, plus(at, marginMs)).changes > 0;
+            }),
+            miss: (id, owner, note) => turn(() => missTx(id, owner, note)),
             // #1834: the drive's one snapshot — keys only, in the order runs became due.
             dueKeys: (now, max) => turn(() => db
                 .prepare(`SELECT id, module_id, job FROM _substrat_job_runs
@@ -3820,17 +3953,18 @@ export class SqliteScopeHost {
              ORDER BY id DESC LIMIT ?`)
                     .all(...params);
             }),
-            patch: (id, p) => turn(() => {
-                patchRun.run(...patchArgs(id, p));
-            }),
-            commitPass: (id, p) => turn(() => commitPassTx(id, p)),
-            step: (runId, name) => turn(() => db
-                .prepare('SELECT step, result, attempts, last_error FROM _substrat_job_steps WHERE run_id = ? AND step = ?')
-                .get(runId, name) ?? null),
-            recordStep: (runId, name, result, attempts, lastError, at) => turn(() => {
-                // Only while the run is still `running` (#1632) — see `JOB_STEP_RECORD_SQL`.
-                db.prepare(JOB_STEP_RECORD_SQL).run(runId, name, result, attempts, lastError, at, runId);
+            patch: (id, p, owner) => turn(() => patchRun.run(...patchArgs(id, p, owner)).changes > 0),
+            commitPass: (id, p, owner) => turn(() => commitPassTx(id, p, owner)),
+            // #2034: a step boundary renews the lease; a pass that lost it reads nothing.
+            beginStep: (runId, name, owner, leaseMs) => turn(() => {
+                if (renewRun.run(plus(now(), leaseMs), runId, owner).changes === 0)
+                    return { held: false, row: null };
+                return { held: true, row: stepRow.get(runId, name) ?? null };
             }),
+            recordStep: (runId, name, result, attempts, lastError, at, owner, leaseMs) => 
+            // Only while the run is still `running` (#1632) and this pass holds it (#2034), renewing
+            // the lease in the same transaction — see `JOB_STEP_RECORD_SQL`.
+            turn(() => recordStepTx(runId, name, result, attempts, lastError, at, owner, leaseMs)),
         };
     }
     /**
@@ -3852,7 +3986,7 @@ export class SqliteScopeHost {
             write: (attachmentId, outcome) => rt.actor.enqueue(() => recordAttachmentText(spineSql(rt.db), attachmentId, outcome, this.clock())),
         }, 
         // K-43: the host's parsers, handed in — this adapter imports none.
-        this.attachmentExtractors);
+        this.attachmentExtractors, this.attachmentTextBounds);
     }
     async startJobRun(tenantId, scopeId, input) {
         const rt = this.runtime(tenantId, scopeId);
@@ -3862,12 +3996,19 @@ export class SqliteScopeHost {
     async runDueJobs(tenantId, scopeId, options) {
         const rt = this.runtime(tenantId, scopeId);
         await this.applyPendingMigrations(rt);
-        // #1575: the kernel's extraction job is this host's own, bound to this scope — no
-        // deployment registers it, and none can shadow it.
-        const attachmentText = { handler: this.attachmentTextHandler(rt) };
+        // #1575: the kernel's extraction jobs are this host's own, bound to this scope — no
+        // deployment registers them, and none can shadow them. The backfill starts here, on
+        // the drive, so a scope's first request never pays for attachments that predate it.
+        await rt.actor.enqueue(() => startAttachmentTextBackfill(spineSql(rt.db), ulid(), this.clock()));
+        const kernelJobs = {
+            [ATTACHMENT_TEXT_JOB]: this.attachmentTextHandler(rt),
+            [ATTACHMENT_TEXT_BACKFILL_JOB]: attachmentTextBackfillJob({
+                queueBatch: (after) => rt.actor.enqueue(() => rt.db.transaction(() => queueAttachmentTextBackfill(spineSql(rt.db), after, ulid, this.clock()))()),
+            }),
+        };
         return runDueJobRuns({
             store: this.jobStore(rt),
-            handlerFor: (run) => isAttachmentTextRun(run) ? attachmentText : this.jobs.get(`${run.module_id}/${run.job}`),
+            handlerFor: (run) => kernelJobFor(run, kernelJobs) ?? this.jobs.get(`${run.module_id}/${run.job}`),
             now: this.clock,
             openScope: (run) => this.getSystemScope(run.module_id, tenantId, scopeId),
             maxPasses: options?.maxPasses,
@@ -3887,15 +4028,10 @@ export class SqliteScopeHost {
         // Cloudflare one does; the context build is the same one `dispatchExecutors` hands
         // an in-process connector.
         const rt = this.runtime(tenantId, scopeId);
-        this.causedBy = event.id;
-        try {
-            // `false`: this path deliberately does NOT enqueue, so nothing is held and
-            // the connection's reads take an ordinary serialized turn.
-            await handler(this.connectorContext(rt, options?.timeoutMs ?? 30_000, false, event.id), event);
-        }
-        finally {
-            this.causedBy = null;
-        }
+        // `false`: this path deliberately does NOT enqueue, so nothing is held and
+        // the connection's reads take an ordinary serialized turn. Built on a view bound to
+        // the event, so its admin rows carry it and nothing else the host serves does (#2055).
+        await handler(this.causedByView(event.id).connectorContext(rt, options?.timeoutMs ?? 30_000, false, event.id), event);
     }
     /**
      * The scope's own answer to "what may this connection do here" (#726 gap 1) — read
@@ -3959,7 +4095,7 @@ export class SqliteScopeHost {
         // `provisioning` allowed — a scope stuck there on a failed migration is a
         // sweep target. Suspended/archived are deliberate states; not disturbed.
         if (row.status !== 'active' && row.status !== 'provisioning') {
-            throw new Error(`scope not migratable (status: ${row.status}): ${scopeId}`);
+            throw substratError('conflict', `scope not migratable (status: ${row.status}): ${scopeId}`);
         }
         const rt = this.runtime(tenantId, scopeId);
         // Nothing pending FOR THIS HOST → noop, and deliberately no state write: a
@@ -4115,16 +4251,12 @@ export class SqliteScopeHost {
                             lines.write({ ...unit, outcome: 'dead-lettered' });
                             continue;
                         }
-                        const ctx = this.operationContext(rt, asPrincipal(this.systemPrincipal), {
-                            system: mod.id,
+                        // #1237: anything this consumer emits was emitted BECAUSE of this event — where a
+                        // backwards walk used to stop. #1901: its `ctx.log` lines join this delivery's line.
+                        const ctx = this.deliveryContext(rt, asPrincipal(this.systemPrincipal), { system: mod.id }, {
+                            causedBy: event.id,
+                            invocationId: unit.invocationId,
                         });
-                        // #1237: anything this consumer emits was emitted BECAUSE of this event.
-                        // `dispatchExecutors` already did this for the admin log; the module
-                        // consumers never did, which is exactly where a backwards walk stopped.
-                        // On the runtime rather than the host — see `ScopeRuntime.causedBy`.
-                        rt.causedBy = event.id;
-                        // #1901: the handler's `ctx.log` lines join this delivery's line.
-                        rt.unitInvocationId = unit.invocationId;
                         rt.db.exec('BEGIN IMMEDIATE');
                         try {
                             await consumer.handler(ctx, event);
@@ -4148,14 +4280,6 @@ export class SqliteScopeHost {
                                 .run(event.id, mod.id, new Date().toISOString(), String(err), invocationId);
                             lines.write({ ...unit, outcome: 'dead-lettered', error: err });
                         }
-                        finally {
-                            rt.unitInvocationId = null;
-                            // Cleared on BOTH paths. Left set, the id would leak onto every later
-                            // emit in this scope — an operation's own event stamped as caused by
-                            // whatever happened to be delivered last, which is worse than no cause
-                            // at all, because it reads as a recorded fact.
-                            rt.causedBy = null;
-                        }
                     }
                 }
             }
@@ -4436,14 +4560,26 @@ export class SqliteScopeHost {
             throw new Error(`connection not found: ${id}`);
         return row;
     }
-    recordAdmin(actor, action, target, before, after) {
+    /**
+     * A findings mutation (#1748) and the audit rows it hands back, in ONE directory transaction:
+     * an audit write that fails rolls the mutation back, so no verdict, rule or stale resolution
+     * stands without its row.
+     */
+    auditedFindings(actor, run) {
+        return this.directory.transaction(() => run(redactionSqlOf(this.directory), (a) => this.recordAdmin(actor, a.action, a.target, a.before, a.after)))();
+    }
+    recordAdmin(actor, action, target, before, after, 
+    /** When the row says it happened; the wall clock unless the write took its time elsewhere (#1184). */
+    at = new Date().toISOString()) {
         this.directory
             .prepare(`INSERT INTO _substrat_admin_log
            (id, actor, action, tenant_id, scope_id, vertical, before, after, caused_by, on_behalf_of, at)
          VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`)
-            .run(ulid(), actor, action, target.tenantId ?? null, target.scopeId ?? null, target.vertical ?? null, before == null ? null : JSON.stringify(before), after == null ? null : JSON.stringify(after), this.causedBy, 
+            .run(ulid(), actor, action, target.tenantId ?? null, target.scopeId ?? null, target.vertical ?? null, before == null ? null : JSON.stringify(before), after == null ? null : JSON.stringify(after), 
+        // #2055: like `onBehalfOf`, set only on a view, never on the host itself.
+        this.causedBy, 
         // #977: set only on an attributed view (`attributed`), never on the host itself.
-        this.onBehalfOf === null ? null : JSON.stringify(this.onBehalfOf), new Date().toISOString());
+        this.onBehalfOf === null ? null : JSON.stringify(this.onBehalfOf), at);
     }
     tenantHoldsEntitlement(tenantId, key) {
         // An expired grant fails closed, exactly as if revoked (#33) — evaluated
@@ -4464,8 +4600,12 @@ export class SqliteScopeHost {
             .all(tenantId).map((r) => ({ key: r.entitlement_key, expired: r.expires_at !== null && r.expires_at <= now }));
     }
     /** #977: this host, with every admin row it writes naming who the actor acted for. */
-    attributed(onBehalfOf) {
-        return attributedHost(this, onBehalfOf, this.buildAdmin);
+    attributed(onBehalfOf, options) {
+        return attributedView(this, { onBehalfOf, causedBy: options?.causedBy }, this.buildAdmin);
+    }
+    /** #2055: this host, with every admin row it writes naming `eventId` as its cause. */
+    causedByView(eventId) {
+        return attributedView(this, { causedBy: eventId }, this.buildAdmin);
     }
     buildAdmin() {
         // #977: an admin whose audit rows say on whose behalf it acts. Built over a VIEW of this
@@ -4503,12 +4643,12 @@ export class SqliteScopeHost {
         const requirePoolServes = (provider, tenant) => {
             const pool = readPool(provider);
             if (!pool) {
-                throw new Error(`identity pool '${provider}' is not registered — a pool must declare its ` +
+                throw substratError('conflict', `identity pool '${provider}' is not registered — a pool must declare its ` +
                     `topology before it may link (central vs tenant-bound decides whether the ` +
                     `same externalId in two tenants is one person or two)`);
             }
             if (pool.topology === 'tenant-bound' && pool.tenantId !== tenant) {
-                throw new Error(`identity pool '${provider}' is bound to tenant ${pool.tenantId} and cannot link into ${tenant}`);
+                throw substratError('conflict', `identity pool '${provider}' is bound to tenant ${pool.tenantId} and cannot link into ${tenant}`);
             }
         };
         const mapVertical = (r) => verticalSchema.parse({
@@ -4578,7 +4718,7 @@ export class SqliteScopeHost {
          */
         const requireOrg = (tenant, id) => {
             if (!readOrg(tenant, id)) {
-                throw new Error(`unknown org ${id} in tenant ${tenant}`);
+                throw substratError('not_found', `unknown org ${id} in tenant ${tenant}`);
             }
         };
         // The directory row → the `scope` contract. Parsed, not cast: the columns are
@@ -4650,7 +4790,7 @@ export class SqliteScopeHost {
                 throw substratError('not_found', `unknown scope for tenant: (${tenantId}, ${scopeId})`);
             }
             if (!from.includes(row.status)) {
-                throw new Error(`illegal scope transition for ${action}: ${row.status} → ${to} ` +
+                throw substratError('conflict', `illegal scope transition for ${action}: ${row.status} → ${to} ` +
                     `(allowed from: ${from.join('|')})`);
             }
             // One directory transaction: the status, the audit row and — on a reap — the scope's
@@ -4674,7 +4814,7 @@ export class SqliteScopeHost {
                     this.directory.prepare('UPDATE scopes SET status = ? WHERE scope_id = ?').run(to, scopeId);
                 }
                 if (to === 'reaped')
-                    forgetSystemSwitchesOf(switchSqlOf(this.directory), scopeId);
+                    forgetSwitchesOf(switchSqlOf(this.directory), scopeId);
                 // The audit target carries the scope's vertical (control-plane.md §4.4:
                 // "vertical stays null until §4.2 lifecycle actions that name one"). It is
                 // read from the scope rather than passed in, so the trail cannot disagree
@@ -4687,6 +4827,42 @@ export class SqliteScopeHost {
              (tenant_id, subject, relation, object, expires_at)
            VALUES (?, ?, ?, ?, ?)`)
             .run(tenantId, subject, relation, object, expiresAt ?? null);
+        // #1184: a tenant-level removal, for inside a directory transaction — the tombstone
+        // (K-21), the removal fence, raised even when nothing was held so an add still on its way
+        // cannot land after this, and the audit row (`audit`), which K-21 writes only when
+        // something changed. The shape of the Durable-Object adapter's `revokeAndFence`.
+        //
+        // All three are stamped by the HOST clock, the one that stamps a scope event's `occurredAt`:
+        // the fence is compared with an add's `occurredAt`, and two clocks would let a host clock
+        // running ahead of the wall push a removal under the skew window (Codex round 3).
+        let revokeStmt;
+        let fenceStmt;
+        const revokeAndFence = (tenantId, principal, relation, object, audit) => {
+            const now = this.clock();
+            const changed = (revokeStmt ??= this.directory.prepare(`UPDATE _substrat_tenant_tuples SET revoked_at = ?
+           WHERE tenant_id = ? AND subject = ? AND relation = ? AND object = ? AND revoked_at IS NULL`)).run(now, tenantId, `principal:${principal}`, relation, object).changes > 0;
+            (fenceStmt ??= this.directory.prepare(RAISE_MEMBERSHIP_FENCE_SQL)).run(tenantId, principal, now);
+            if (changed)
+                audit(now);
+            return changed;
+        };
+        const revokeTenantRoleAndFence = (actor, assignment) => {
+            const { tenantId } = assignment.node;
+            return revokeAndFence(tenantId, assignment.principalId, `role:${assignment.roleKey}`, `tenant:${tenantId}`, (at) => this.recordAdmin(actor, 'unassignRole', { tenantId, scopeId: null }, assignment, null, at));
+        };
+        // An org membership written or tombstoned with its audit row — `addMember` and `removeMember`,
+        // and the membership executor's unit (#2047), one spelling each. Leaving raises the fence too.
+        const joinOrg = (actor, tenantId, principal, orgId, expiresAt) => {
+            writeTenantTuple(tenantId, `principal:${principal}`, 'member', `org:${orgId}`, expiresAt);
+            this.recordAdmin(actor, 'addMember', { tenantId }, null, memberAddedAudit(principal, orgId, expiresAt));
+        };
+        const leaveOrgAndFence = (actor, tenantId, principal, orgId) => revokeAndFence(tenantId, principal, 'member', `org:${orgId}`, (at) => this.recordAdmin(actor, 'removeMember', { tenantId }, { principal, orgId }, null, at));
+        // The tenant-level reads the checker makes, synchronous, for the bound inside a unit.
+        const directoryReader = directoryTenantReader({
+            directory: this.directory,
+            getRole: (tenantId, key) => this.roles.get(`${tenantId}/${key}`),
+            clock: () => this.clock(),
+        });
         // The EXPLICIT grant: `INSERT OR REPLACE` clears a tombstone, because a re-grant must
         // grant. Provisioning seats with `seatScopeTuple` instead, which never un-revokes
         // (#1659) — keep the two apart.
@@ -4722,10 +4898,14 @@ export class SqliteScopeHost {
         const onNode = (node, body) => node.scopeId
             ? this.runtime(node.tenantId, node.scopeId).actor.turn(body)
             : Promise.resolve().then(body);
-        /** #1666: move one module's schedule switch on one scope — see `HostAdmin.revokeFromSystem`. */
-        const switchSystem = async (actor, raw, to) => {
-            const input = systemSwitch.parse(raw);
-            const { tenantId, scopeId } = input.node;
+        /**
+         * One kill switch moved on one scope — the ONE body `revokeFromSystem` / `restoreToSystem`
+         * (#1666, a module's `system:` authority) and `revokeFromPeer` / `restoreToPeer` (#1706, a
+         * peer vertical's) share, so the two levers cannot disagree about the record, the audit or
+         * the undo. `kind` says which; `key` is the module id or the peer's slug.
+         */
+        const switchSubject = async (actor, kind, node, key, reason, to) => {
+            const { tenantId, scopeId } = node;
             const scope = this.directory
                 .prepare('SELECT tenant_id FROM scopes WHERE scope_id = ?')
                 .get(scopeId);
@@ -4737,20 +4917,20 @@ export class SqliteScopeHost {
             // scope's file are separate databases, so a crash between them leaves an intent with
             // no recorded outcome — never a moved switch with no audit row.
             const operationId = ulid();
-            const action = to === 'off' ? 'revokeFromSystem' : 'restoreToSystem';
+            const action = switchActionOf(kind, to);
             const target = { tenantId, scopeId };
-            const base = { operationId, moduleId: input.moduleId, schedules: to };
-            this.recordAdmin(actor, action, target, null, { ...base, phase: 'intent', reason: input.reason });
-            // The directory's record (#1674), written BEFORE the scope moves, both ways, and undone
-            // if the move throws or holds nothing — see `recordSystemSwitchedOn` and (#1823)
-            // `recordSystemSwitchedOff` for why that order is the safe one.
+            const base = { operationId, ...switchAuditSubject(kind, key, to) };
+            this.recordAdmin(actor, action, target, null, { ...base, phase: 'intent', reason });
+            // The directory's record (#1674; #2029 for a peer), written BEFORE the scope moves, both
+            // ways, and undone if the move throws or holds nothing — see `recordSwitchedOn` and
+            // (#1823) `recordSwitchedOff` for why that order is the safe one.
             const at = new Date().toISOString();
             const directorySql = switchSqlOf(this.directory);
-            const record = { tenantId, scopeId, moduleId: input.moduleId, actor, reason: input.reason, operationId, at };
+            const record = { kind, tenantId, scopeId, key, actor, reason, operationId, at };
             const errorOf = (err) => (err instanceof Error ? err.message : String(err));
             let prior;
             try {
-                prior = to === 'on' ? recordSystemSwitchedOn(directorySql, record) : recordSystemSwitchedOff(directorySql, record);
+                prior = to === 'on' ? recordSwitchedOn(directorySql, record) : recordSwitchedOff(directorySql, record);
             }
             catch (err) {
                 // Nothing has moved: fail the call here, audited — the Cloudflare adapter's posture.
@@ -4762,9 +4942,15 @@ export class SqliteScopeHost {
                 }
                 throw err;
             }
+            // #2045: a newer call on this subject has recorded its position already: this one writes
+            // nothing, here or in the scope, and says so.
+            if (recordWriteSuperseded(prior, record)) {
+                this.recordAdmin(actor, action, target, null, { ...base, phase: 'refused', superseded: true });
+                throw substratError('conflict', switchSupersededMessage(kind, scopeId, key, to));
+            }
             /** The record's undo, after the scope's move threw or held nothing: retried once, never swallowed. */
             const undoRecord = () => {
-                const undo = () => restoreSystemSwitchRecord(directorySql, record, prior);
+                const undo = () => restoreSwitchRecord(directorySql, record, prior);
                 try {
                     undo();
                     return null;
@@ -4787,12 +4973,13 @@ export class SqliteScopeHost {
                 // with it — after this verb had already audited `applied`. `turn` is re-entrant, so a
                 // caller already inside one of this scope's tasks joins it rather than deadlocking.
                 //
-                // #1823: read in the same turn, so no tenant grant moves between the read and the switch.
-                // The directory is this process's own database, so the read is synchronous.
+                // #1823 (#2030 for a peer): read in the same turn, so no tenant grant moves between the
+                // read and the switch. The directory is this process's own database, so the read is
+                // synchronous.
                 const rt = this.runtime(tenantId, scopeId);
                 outcome = await rt.actor.turn(() => {
-                    const tenantHeld = tenantHoldsSystemGrant(directorySql, tenantId, input.moduleId, this.clock());
-                    return rt.db.transaction(() => switchSystemSchedules(switchSqlOf(rt.db), { moduleId: input.moduleId, scopeId, to, at, tenantHeld }))();
+                    const tenantHeld = tenantHoldsGrant(directorySql, kind, tenantId, key, this.clock());
+                    return rt.db.transaction(() => moveSwitch(switchSqlOf(rt.db), kind, { key, scopeId, to, at, tenantHeld, fence: operationId }))();
                 });
             }
             catch (err) {
@@ -4810,10 +4997,16 @@ export class SqliteScopeHost {
                 }
                 throw err;
             }
-            // A call that held nothing moved nothing (the module has no authority reaching the scope,
-            // its own or the tenant's), so its record write is undone: left `off`, it
-            // would switch the module off the day it is installed; left `on`, the next reconcile of
-            // a wiped scope would leave the module running.
+            // #2045: the scope has applied a newer call on this subject, so this move wrote nothing. The
+            // record is that newer call's too (its write overwrote this one's), so nothing is undone.
+            if (outcome.superseded) {
+                this.recordAdmin(actor, action, target, null, { ...base, phase: 'refused', superseded: true });
+                throw substratError('conflict', switchSupersededMessage(kind, scopeId, key, to));
+            }
+            // A call that held nothing moved nothing (the subject has no authority reaching the
+            // scope, its own or the tenant's), so its record write is undone: left `off`, it would
+            // switch the subject off the day it is installed; left `on`, the next reconcile of a
+            // wiped scope would leave it running.
             const recordError = outcome.held ? null : undoRecord();
             this.recordAdmin(actor, action, target, null, {
                 ...base,
@@ -4823,10 +5016,15 @@ export class SqliteScopeHost {
                 ...(recordError ? { recordError } : {}),
             });
             if (!outcome.held) {
-                throw substratError('not_found', `scope ${scopeId} holds no system grant for module '${input.moduleId}' — nothing to switch ${to} ` +
-                    `(check the module id: it is the module's manifest id, e.g. '@substrat-run/engine-absence')` +
+                throw substratError('not_found', switchNotFoundMessage(kind, scopeId, key, to) +
                     (recordError ? `; and its directory record could not be put back (${recordError})` : ''));
             }
+            return { operationId, outcome };
+        };
+        /** #1666: move one module's schedule switch on one scope — see `HostAdmin.revokeFromSystem`. */
+        const switchSystem = async (actor, raw, to) => {
+            const input = systemSwitch.parse(raw);
+            const { operationId, outcome } = await switchSubject(actor, 'system', input.node, input.moduleId, input.reason, to);
             return {
                 operationId,
                 moduleId: input.moduleId,
@@ -4835,58 +5033,10 @@ export class SqliteScopeHost {
                 permissions: outcome.permissions,
             };
         };
-        /**
-         * #1706: move one PEER's kill switch on one scope — see `HostAdmin.revokeFromPeer`. The
-         * schedule switch's body with the subject swapped (`switchPeer` → `switchSubjectGrants`):
-         * audit first, one turn on the scope actor, outcome after, `not_found` when nothing was held.
-         */
+        /** #1706: move one PEER's kill switch on one scope — see `HostAdmin.revokeFromPeer`. */
         const switchPeerAt = async (actor, raw, to) => {
             const input = peerSwitch.parse(raw);
-            const { tenantId, scopeId } = input.node;
-            const scope = this.directory
-                .prepare('SELECT tenant_id FROM scopes WHERE scope_id = ?')
-                .get(scopeId);
-            if (!scope || scope.tenant_id !== tenantId) {
-                throw substratError('not_found', `unknown scope for tenant: (${tenantId}, ${scopeId})`);
-            }
-            const operationId = ulid();
-            const action = to === 'off' ? 'revokeFromPeer' : 'restoreToPeer';
-            const target = { tenantId, scopeId };
-            const base = { operationId, vertical: input.vertical, calls: to };
-            this.recordAdmin(actor, action, target, null, { ...base, phase: 'intent', reason: input.reason });
-            let outcome;
-            try {
-                const rt = this.runtime(tenantId, scopeId);
-                outcome = await rt.actor.turn(() => rt.db.transaction(() => switchPeer(switchSqlOf(rt.db), {
-                    vertical: input.vertical,
-                    scopeId,
-                    to,
-                    at: new Date().toISOString(),
-                }))());
-            }
-            catch (err) {
-                try {
-                    this.recordAdmin(actor, action, target, null, {
-                        ...base,
-                        phase: 'failed',
-                        error: err instanceof Error ? err.message : String(err),
-                    });
-                }
-                catch {
-                    // Best effort: the original error is what the caller must see.
-                }
-                throw err;
-            }
-            this.recordAdmin(actor, action, target, null, {
-                ...base,
-                phase: outcome.held ? 'applied' : 'refused',
-                changed: outcome.changed,
-                permissions: outcome.permissions,
-            });
-            if (!outcome.held) {
-                throw substratError('not_found', `scope ${scopeId} holds no grant for peer '${input.vertical}' — nothing to switch ${to} ` +
-                    `(check the slug: it is the calling vertical's registry id, as the target's \`peers\` names it)`);
-            }
+            const { operationId, outcome } = await switchSubject(actor, 'peer', input.node, input.vertical, input.reason, to);
             return {
                 operationId,
                 vertical: input.vertical,
@@ -4961,7 +5111,7 @@ export class SqliteScopeHost {
             const states = await rt.actor.turn(() => systemGrantsStatus(switchSqlOf(rt.db), new Date().toISOString()));
             const offModules = new Set(states.filter((s) => s.schedules === 'off').map((s) => s.moduleId));
             const explanations = offModules.size > 0 ? lastSwitchedOff(tenantId, scopeId, offModules) : new Map();
-            const recorded = systemSwitchRecordsOf(switchSqlOf(this.directory), tenantId, scopeId);
+            const recorded = switchRecordsOf(switchSqlOf(this.directory), 'system', tenantId, scopeId);
             const result = withRecorded(states, recorded).map((s) => ({
                 moduleId: s.moduleId,
                 schedules: s.schedules,
@@ -5070,29 +5220,22 @@ export class SqliteScopeHost {
                 // Tombstone (K-21), never DELETE — the checker skips revoked_at rows, so the
                 // assignment stops resolving while staying visible to audit. Guarded on
                 // `revoked_at IS NULL` so a repeat unassign is a silent no-op.
-                const subject = `principal:${assignment.principalId}`;
-                const relation = `role:${assignment.roleKey}`;
-                const now = new Date().toISOString();
-                let changes;
-                if (assignment.node.scopeId) {
-                    // On the scope actor (#1678): a revoke that joined a stranger's transaction and
-                    // rolled back with it left the role LIVE after the caller was told it was gone.
-                    const scopeNode = assignment.node.scopeId;
-                    const rt = this.runtime(assignment.node.tenantId, scopeNode);
-                    changes = await rt.actor.turn(() => rt.db
-                        .prepare(`UPDATE _substrat_tuples SET revoked_at = ?
-                   WHERE subject = ? AND relation = ? AND object = ? AND revoked_at IS NULL`)
-                        .run(now, subject, relation, `scope:${scopeNode}`).changes);
-                }
-                else {
-                    changes = this.directory
-                        .prepare(`UPDATE _substrat_tenant_tuples SET revoked_at = ?
-               WHERE tenant_id = ? AND subject = ? AND relation = ? AND object = ? AND revoked_at IS NULL`)
-                        .run(now, assignment.node.tenantId, subject, relation, `tenant:${assignment.node.tenantId}`).changes;
+                const scopeNode = assignment.node.scopeId;
+                if (!scopeNode) {
+                    // One directory transaction (#1184): the revoke, the removal fence and the audit row.
+                    this.directory.transaction(() => revokeTenantRoleAndFence(actor, assignment))();
+                    return;
                 }
+                // On the scope actor (#1678): a revoke that joined a stranger's transaction and
+                // rolled back with it left the role LIVE after the caller was told it was gone.
+                const rt = this.runtime(assignment.node.tenantId, scopeNode);
+                const changes = await rt.actor.turn(() => rt.db
+                    .prepare(`UPDATE _substrat_tuples SET revoked_at = ?
+                 WHERE subject = ? AND relation = ? AND object = ? AND revoked_at IS NULL`)
+                    .run(new Date().toISOString(), `principal:${assignment.principalId}`, `role:${assignment.roleKey}`, `scope:${scopeNode}`).changes);
                 if (changes === 0)
                     return; // never assigned, or already revoked — idempotent, unaudited
-                this.recordAdmin(actor, 'unassignRole', { tenantId: assignment.node.tenantId, scopeId: assignment.node.scopeId }, assignment, null);
+                this.recordAdmin(actor, 'unassignRole', { tenantId: assignment.node.tenantId, scopeId: scopeNode }, assignment, null);
             },
             grant: async (actor, raw) => {
                 // Parsed like its `grantToConnection`/`grantToSystem` siblings, not taken on
@@ -5213,10 +5356,19 @@ export class SqliteScopeHost {
             },
             tenantHeldSystemModules: async (actor, tenantId, moduleIds) => {
                 const now = this.clock();
-                const held = moduleIds.filter((m) => tenantHoldsSystemGrant(switchSqlOf(this.directory), tenantId, m, now));
+                const held = tenantHeldOf(switchSqlOf(this.directory), 'system', tenantId, moduleIds, now);
                 this.recordAccess(actor, 'tenantHeldSystemModules', { tenantId }, { moduleIds: [...moduleIds] }, held.length);
                 return held;
             },
+            peerSwitchCarry: async (actor, node) => {
+                const directorySql = switchSqlOf(this.directory);
+                const switchedOffPeers = switchedOffOf(directorySql, 'peer', node.tenantId, node.scopeId);
+                const tenantHeldPeers = tenantHeldOf(directorySql, 'peer', node.tenantId, switchedOffPeers, this.clock());
+                const all = switchFencesOf(directorySql, 'peer', node.tenantId, node.scopeId);
+                const fences = Object.fromEntries(switchedOffPeers.map((v) => [v, all.get(v)]));
+                this.recordAccess(actor, 'peerSwitchCarry', node, null, switchedOffPeers.length);
+                return { switchedOffPeers, tenantHeldPeers, fences };
+            },
             reassertSystemSwitches: async (actor, node, opts) => {
                 this.assertScope(node.tenantId, node.scopeId);
                 const rt = this.runtime(node.tenantId, node.scopeId);
@@ -5300,7 +5452,7 @@ export class SqliteScopeHost {
                     // rebinding it would move another tenant's traffic. Exception: the holder is
                     // ARCHIVED or REAPED (a deleted app, storage since wiped) — it released the
                     // name, so the rebind reclaims it.
-                    throw new Error(`hostname '${parsed.hostname}' is already bound to another scope`);
+                    throw substratError('conflict', `hostname '${parsed.hostname}' is already bound to another scope`);
                 }
                 // Exactly one canonical per (scope, surface): "which one do certs and
                 // redirects use" has to have one answer, so a new canonical demotes the old.
@@ -5326,7 +5478,7 @@ export class SqliteScopeHost {
                     .prepare('SELECT tenant_id, scope_id, status FROM hostnames WHERE hostname = ?')
                     .get(hostname);
                 if (!row)
-                    throw new Error(`unknown hostname '${hostname}'`);
+                    throw substratError('not_found', `unknown hostname '${hostname}'`);
                 if (row.status === status)
                     return; // idempotent, and a no-op is not audited
                 this.directory
@@ -5340,7 +5492,7 @@ export class SqliteScopeHost {
                     .prepare('SELECT tenant_id, scope_id, status, custom_hostname_id, validation_records FROM hostnames WHERE hostname = ?')
                     .get(hostname);
                 if (!row)
-                    throw new Error(`unknown hostname '${hostname}'`);
+                    throw substratError('not_found', `unknown hostname '${hostname}'`);
                 const recordsJson = fields.validationRecords.length
                     ? JSON.stringify(fields.validationRecords)
                     : null;
@@ -5529,7 +5681,7 @@ export class SqliteScopeHost {
                     if (existing.ownerTenant !== parsed.ownerTenant) {
                         throw substratError('conflict', `vertical '${parsed.slug}' is owned by ${existing.ownerTenant ?? 'the platform'}, not ${parsed.ownerTenant ?? 'the platform'}`);
                     }
-                    throw new Error(`vertical '${parsed.slug}' is already registered as ${existing.source}`);
+                    throw substratError('conflict', `vertical '${parsed.slug}' is already registered as ${existing.source}`);
                 }
                 this.directory
                     .prepare('INSERT INTO verticals (slug, name, source, owner_tenant, env_spec, install_spec, listed, created_at) VALUES (?, ?, ?, ?, ?, ?, ?, ?)')
@@ -5762,11 +5914,11 @@ export class SqliteScopeHost {
                 // gate is about change, not about existence.
                 if (outgoing) {
                     if (outgoing.permissionDigest !== incoming.permissionDigest && !ack.permissionChange) {
-                        throw new Error(`promotion changes the permission surface (${outgoing.permissionDigest} → ` +
+                        throw substratError('conflict', `promotion changes the permission surface (${outgoing.permissionDigest} → ` +
                             `${incoming.permissionDigest}) — acknowledge it explicitly to promote`);
                     }
                     if (outgoing.migrationDigest !== incoming.migrationDigest && !ack.migrationChange) {
-                        throw new Error(`promotion changes migrations (${outgoing.migrationDigest} → ` +
+                        throw substratError('conflict', `promotion changes migrations (${outgoing.migrationDigest} → ` +
                             `${incoming.migrationDigest}) — acknowledge it explicitly to promote`);
                     }
                     // #1705 PR 3: an export an installed consumer imports, dropped or re-versioned.
@@ -6264,6 +6416,13 @@ export class SqliteScopeHost {
                 this.recordAccess(actor, 'lifecycleFlow', { tenantId, scopeId }, delegatedReadParams.lifecycleFlow(input), flow.observation.events);
                 return flow;
             },
+            operationSeries: async (actor, tenantId, scopeId, input) => {
+                // #1750: business volumes per bucket, for Pulse.
+                const db = this.scopeReadDbFor(tenantId, scopeId);
+                const series = readOperationSeries({ sql: scopedSql(db) }, input);
+                this.recordAccess(actor, 'operationSeries', { tenantId, scopeId }, delegatedReadParams.operationSeries(input), operationSeriesCount(series));
+                return series;
+            },
             scopeAppliedMigrations: async (actor, tenantId, scopeId) => {
                 const db = this.scopeReadDbFor(tenantId, scopeId);
                 const rows = db
@@ -6315,7 +6474,7 @@ export class SqliteScopeHost {
                     .prepare('SELECT org_id FROM orgs WHERE tenant_id = ? AND slug = ?')
                     .get(parsed.tenantId, parsed.slug);
                 if (slugOwner) {
-                    throw new Error(`org slug '${parsed.slug}' already taken by ${slugOwner.org_id} (slugs are unique per tenant)`);
+                    throw substratError('conflict', `org slug '${parsed.slug}' already taken by ${slugOwner.org_id} (slugs are unique per tenant)`);
                 }
                 this.directory
                     .prepare('INSERT INTO orgs (org_id, tenant_id, slug, name, created_at) VALUES (?, ?, ?, ?, ?)')
@@ -6334,32 +6493,66 @@ export class SqliteScopeHost {
                 this.recordAccess(actor, 'getOrg', { tenantId }, { orgId }, o ? 1 : 0);
                 return o;
             },
-            addMember: async (actor, tenantId, principal, orgId) => {
+            addMember: async (actor, tenantId, principal, orgId, opts) => {
                 requireOrg(tenantId, orgId);
                 // INSERT OR REPLACE, so re-adding a revoked member clears the tombstone —
                 // they are a member again. The add/revoke history is not lost: it lives in
                 // the append-only admin log, which is where "what happened" belongs. The
                 // tuple carries "what is true now" plus enough to explain a live proof.
-                writeTenantTuple(tenantId, `principal:${principal}`, 'member', `org:${orgId}`);
-                this.recordAdmin(actor, 'addMember', { tenantId }, null, { principal, orgId });
+                joinOrg(actor, tenantId, principal, orgId, opts?.expiresAt ?? null);
+            },
+            applyMembership: async (actor, change) => {
+                // ONE directory transaction, synchronous throughout (#1184): the fence (an add's), the
+                // bound and the write. Nothing else on this host lands between them, and a failure
+                // leaves none.
+                const { tenantId, principal, roleKey, boundedBy } = change;
+                const assignment = { principalId: principal, roleKey, node: { tenantId, scopeId: null } };
+                return this.directory.transaction(() => {
+                    if (change.op === 'add') {
+                        const fence = this.directory
+                            .prepare(MEMBERSHIP_FENCE_SINCE_SQL)
+                            .get(tenantId, principal, change.unlessRemovedSince);
+                        if (fence)
+                            return { applied: false, removedAt: fence.removed_at };
+                    }
+                    const role = directoryReader.getRole(tenantId, roleKey);
+                    if (!role)
+                        return { applied: false, unknownRole: roleKey };
+                    const bound = tenantCoverage(directoryReader, tenantId, boundedBy, role.permissions);
+                    if (!bound.covered)
+                        return { applied: false, missing: bound.missing };
+                    // #2047: the org, bounded by `boundedBy`'s own live membership of it.
+                    const { orgId } = change;
+                    const org = orgId ? { orgId, ...orgChangeBound(directoryReader, tenantId, { ...change, orgId }) } : undefined;
+                    if (org) {
+                        if (!readOrg(tenantId, org.orgId))
+                            return { applied: false, unknownOrg: org.orgId };
+                        if (!org.bounded)
+                            return { applied: false, notMember: org.orgId };
+                    }
+                    if (change.op === 'remove') {
+                        const roleTaken = revokeTenantRoleAndFence(actor, assignment);
+                        const orgLeft = !!org && leaveOrgAndFence(actor, tenantId, principal, org.orgId);
+                        return { applied: true, changed: roleTaken || orgLeft };
+                    }
+                    writeTenantTuple(tenantId, `principal:${principal}`, `role:${roleKey}`, `tenant:${tenantId}`);
+                    this.recordAdmin(actor, 'assignRole', { tenantId, scopeId: null }, null, assignment);
+                    if (org?.bounded)
+                        joinOrg(actor, tenantId, principal, org.orgId, org.expiresAt);
+                    return { applied: true };
+                })();
             },
             removeMember: async (actor, tenantId, principal, orgId) => {
                 requireOrg(tenantId, orgId);
-                // Tombstone (K-21), never DELETE. Guarded on `revoked_at IS NULL` so a
-                // repeat revoke neither moves the timestamp nor writes a second audit row.
-                const info = this.directory
-                    .prepare(`UPDATE _substrat_tenant_tuples SET revoked_at = ?
-             WHERE tenant_id = ? AND subject = ? AND relation = 'member' AND object = ?
-               AND revoked_at IS NULL`)
-                    .run(new Date().toISOString(), tenantId, `principal:${principal}`, `org:${orgId}`);
-                if (info.changes === 0)
-                    return; // never a member, or already revoked
-                this.recordAdmin(actor, 'removeMember', { tenantId }, { principal, orgId }, null);
+                // Tombstone (K-21), never DELETE: a repeat revoke neither moves the timestamp nor writes
+                // a second audit row. One transaction with the removal fence (#1184), which a no-op
+                // raises too.
+                this.directory.transaction(() => leaveOrgAndFence(actor, tenantId, principal, orgId))();
             },
             listMembers: async (actor, tenantId, orgId, options) => {
                 requireOrg(tenantId, orgId);
                 const rows = this.directory
-                    .prepare(`SELECT subject, revoked_at FROM _substrat_tenant_tuples
+                    .prepare(`SELECT subject, revoked_at, expires_at FROM _substrat_tenant_tuples
              WHERE tenant_id = ? AND relation = 'member' AND object = ?
              ${options?.includeRevoked ? '' : 'AND revoked_at IS NULL'}
              ORDER BY subject`)
@@ -6369,6 +6562,7 @@ export class SqliteScopeHost {
                     principal: r.subject.slice('principal:'.length),
                     orgId,
                     revokedAt: r.revoked_at,
+                    expiresAt: r.expires_at,
                 }));
             },
             createTenant: async (actor, input) => {
@@ -6385,7 +6579,7 @@ export class SqliteScopeHost {
                     .prepare('SELECT tenant_id FROM tenants WHERE slug = ?')
                     .get(parsed.slug);
                 if (slugOwner) {
-                    throw new Error(`tenant slug '${parsed.slug}' already taken by ${slugOwner.tenant_id} (slugs are unique)`);
+                    throw substratError('conflict', `tenant slug '${parsed.slug}' already taken by ${slugOwner.tenant_id} (slugs are unique)`);
                 }
                 this.directory
                     .prepare(`INSERT INTO tenants (tenant_id, slug, name, status, created_at, provisioned_by_tenant)
@@ -6396,12 +6590,12 @@ export class SqliteScopeHost {
             setTenantStatus: async (actor, tenantId, status) => {
                 const before = readTenant(tenantId);
                 if (!before)
-                    throw new Error(`unknown tenant: ${tenantId}`);
+                    throw substratError('not_found', `unknown tenant: ${tenantId}`);
                 // `reaped` is terminal and destroys data — it is unreachable here and only
                 // ever set by reapTenant, so a plain status flip cannot forge a tombstone
                 // over live data (§4.8, the tenant analogue of reapScope's archived-only gate).
                 if (status === 'reaped') {
-                    throw new Error(`tenant ${tenantId} cannot be set to 'reaped' via setTenantStatus — reap goes through reapTenant (control-plane.md §4.8)`);
+                    throw substratError('validation_failed', `tenant ${tenantId} cannot be set to 'reaped' via setTenantStatus — reap goes through reapTenant (control-plane.md §4.8)`);
                 }
                 // Stamp/clear deleting_at so the grace-window sweep can age tenants (§4.8):
                 // entering `deleting` stamps, leaving it (an un-delete) clears — exactly the
@@ -6421,7 +6615,7 @@ export class SqliteScopeHost {
             setTenantName: async (actor, tenantId, name) => {
                 const before = readTenant(tenantId);
                 if (!before)
-                    throw new Error(`unknown tenant: ${tenantId}`);
+                    throw substratError('not_found', `unknown tenant: ${tenantId}`);
                 if (before.name === name)
                     return; // no-op is not audited — nothing changed
                 this.directory.prepare('UPDATE tenants SET name = ? WHERE tenant_id = ?').run(name, tenantId);
@@ -6553,7 +6747,7 @@ export class SqliteScopeHost {
                 // the query, so the quoted identifier below carries no user input.
                 const known = new Set(db.prepare(`SELECT name FROM sqlite_master WHERE type = 'table'`).all().map((r) => r.name));
                 if (!known.has(input.table))
-                    throw new Error(`unknown table '${input.table}'`);
+                    throw substratError('not_found', `unknown table '${input.table}'`);
                 // The ceiling clamps; a bound SQLite would misread (NaN, non-finite, fractional,
                 // negative) is refused instead of reaching LIMIT / OFFSET (#1632).
                 const limit = Math.min(assertRowLimit('limit', input.limit ?? SCOPE_TABLE_PAGE_DEFAULT), SCOPE_TABLE_PAGE_MAX);
@@ -6574,7 +6768,7 @@ export class SqliteScopeHost {
                 // itself rejects multi-statement strings and bad SQL with the driver's message.
                 const stmt = db.prepare(sql);
                 if (!stmt.readonly)
-                    throw new Error('read-only console: statement is not read-only');
+                    throw substratError('validation_failed', 'read-only console: statement is not read-only');
                 if (!stmt.reader)
                     return { columns: [], rows: [], truncated: false };
                 stmt.raw(true);
@@ -6720,6 +6914,7 @@ export class SqliteScopeHost {
                     loadDirectoryDump(dump.tables, {
                         columnsOf: (name) => builtColumnsOf(this.directory, name),
                         exec: (sql) => this.directory.exec(sql),
+                        now: () => this.clock(),
                         insert: (sql, rows) => {
                             const insert = this.directory.prepare(sql);
                             for (const row of rows)
@@ -6771,7 +6966,7 @@ export class SqliteScopeHost {
                     throw substratError('not_found', `unknown scope for tenant: (${tenantId}, ${scopeId})`);
                 }
                 if (rec.status !== 'archived') {
-                    throw new Error(`scope ${scopeId} is ${rec.status}, not archived — only an archived scope may be reaped`);
+                    throw substratError('conflict', `scope ${scopeId} is ${rec.status}, not archived — only an archived scope may be reaped`);
                 }
                 // A serving scope always holds ≥1 bound hostname; a truly-dead one has been
                 // unbound. The dashboard delete path unbinds AT archive, but a bare console
@@ -6787,7 +6982,7 @@ export class SqliteScopeHost {
                         .prepare('SELECT hostname FROM hostnames WHERE scope_id = ? LIMIT 1')
                         .get(scopeId);
                 if (bound) {
-                    throw new Error(`scope ${scopeId} still resolves hostname '${bound.hostname}' — ` +
+                    throw substratError('conflict', `scope ${scopeId} still resolves hostname '${bound.hostname}' — ` +
                         `unbind it before reaping (reap wipes storage and cannot be undone)`);
                 }
                 // The reader goes with the writer (#1624): an open handle on a removed file keeps
@@ -6938,9 +7133,9 @@ export class SqliteScopeHost {
                 // reaped — an illegal source fails closed, like reapScope's archived-only gate.
                 const before = readTenant(tenantId);
                 if (!before)
-                    throw new Error(`unknown tenant: ${tenantId}`);
+                    throw substratError('not_found', `unknown tenant: ${tenantId}`);
                 if (before.status !== 'deleting') {
-                    throw new Error(`tenant ${tenantId} is ${before.status}, not deleting — only a deleting tenant may be reaped`);
+                    throw substratError('conflict', `tenant ${tenantId} is ${before.status}, not deleting — only a deleting tenant may be reaped`);
                 }
                 // Clear the tenant's directory-side rows. Idempotent (set-to-empty), so a crash
                 // mid-reap converges on retry. KEPT as the tombstone: the `tenants` row itself
@@ -6954,6 +7149,11 @@ export class SqliteScopeHost {
                     '_substrat_entitlements', // per-tenant SKU flags
                     'orgs', // K-22 org records
                     '_substrat_system_switches', // #1674: the schedule switch's record, per scope
+                    '_substrat_membership_fences', // #1184: the latest removal, per principal
+                    '_substrat_peer_switches', // #2029: the peer switch's record, per scope
+                    '_substrat_switch_owed', // #2045: subjects owed a re-assert, per scope
+                    '_substrat_findings', // #1748: the tenant's findings
+                    '_substrat_finding_rules', // #1748: the tenant's suppress rules
                 ];
                 const clear = this.directory.transaction(() => {
                     for (const table of tables) {
@@ -7072,7 +7272,7 @@ export class SqliteScopeHost {
                     if (existing.topology === parsed.topology && existing.tenantId === parsed.tenantId) {
                         return;
                     }
-                    throw new Error(`identity pool '${parsed.provider}' is already registered as ${existing.topology}` +
+                    throw substratError('conflict', `identity pool '${parsed.provider}' is already registered as ${existing.topology}` +
                         `${existing.tenantId ? ` for tenant ${existing.tenantId}` : ''}`);
                 }
                 this.directory
@@ -7091,9 +7291,9 @@ export class SqliteScopeHost {
             listIdentityTenants: async (actor, provider, externalId) => {
                 const pool = readPool(provider);
                 if (!pool)
-                    throw new Error(`identity pool '${provider}' is not registered`);
+                    throw substratError('not_found', `identity pool '${provider}' is not registered`);
                 if (pool.topology !== 'central') {
-                    throw new Error(`identity pool '${provider}' is tenant-bound — enumerating tenants is only ` +
+                    throw substratError('forbidden', `identity pool '${provider}' is tenant-bound — enumerating tenants is only ` +
                         `meaningful on a central pool, where the same externalId is the same person`);
                 }
                 const tenants = this.directory
@@ -7107,9 +7307,9 @@ export class SqliteScopeHost {
             listIdentityMemberships: async (actor, provider, externalId) => {
                 const pool = readPool(provider);
                 if (!pool)
-                    throw new Error(`identity pool '${provider}' is not registered`);
+                    throw substratError('not_found', `identity pool '${provider}' is not registered`);
                 if (pool.topology !== 'central') {
-                    throw new Error(`identity pool '${provider}' is tenant-bound — enumerating tenants is only ` +
+                    throw substratError('forbidden', `identity pool '${provider}' is tenant-bound — enumerating tenants is only ` +
                         `meaningful on a central pool, where the same externalId is the same person`);
                 }
                 const rows = this.directory
@@ -7408,7 +7608,7 @@ export class SqliteScopeHost {
                 if (existing) {
                     if (existing.principal_id === parsed.principal)
                         return; // idempotent, unaudited
-                    throw new Error(`identity ${parsed.provider}:${parsed.externalId} in tenant ${parsed.tenantId} ` +
+                    throw substratError('conflict', `identity ${parsed.provider}:${parsed.externalId} in tenant ${parsed.tenantId} ` +
                         `is already bound to ${existing.principal_id}`);
                 }
                 this.directory
@@ -7455,6 +7655,11 @@ export class SqliteScopeHost {
                 const { tenantId, scopeId, ...after } = ownerTransferAudit.parse(entry);
                 this.recordAdmin(actor, 'transferOwner', { tenantId, scopeId }, null, after);
             },
+            /** #1150: one phase of a dashboard member change, written around the vertical's own. */
+            recordMemberChange: async (actor, entry) => {
+                const { tenantId, scopeId, ...after } = memberChangeAudit.parse(entry);
+                this.recordAdmin(actor, 'manageScopeMember', { tenantId, scopeId }, null, after);
+            },
             /** #2005: one change to a scope's copy marker, written around the vertical's own change. */
             recordCopyMark: async (actor, entry) => {
                 const { tenantId, scopeId, action, ...after } = copyMarkAudit.parse(entry);
@@ -7597,40 +7802,49 @@ export class SqliteScopeHost {
             recordOpsFailure: async (entry) => {
                 const at = new Date().toISOString();
                 const fingerprint = opsFailureFingerprint(entry);
-                this.directory
-                    .prepare(`INSERT INTO _substrat_ops_failures
-               (id, actor, operation, stage, tenant_id, scope_id, vertical, version, status, message, reference, origin, code, fingerprint, at)
-             VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`)
-                    .run(ulid(), entry.actor, entry.operation, entry.stage ?? null, entry.tenantId ?? null, entry.scopeId ?? null, entry.vertical ?? null, entry.version ?? null, entry.status ?? null, 
-                // Bounded here, not trusted from the catch site: one runaway upstream
-                // body must not become a runaway directory row (#559).
-                entry.message.slice(0, 2000), entry.reference ?? null, entry.origin ?? null, entry.code ?? null, fingerprint, at);
-                // Prune-on-write (#559): retention lives here, not in a cron — every insert
-                // pays for its own housekeeping, so the table stays bounded even where no
-                // scheduled pass runs (this adapter has none).
-                const horizon = new Date(Date.now() - OPS_FAILURE_RETENTION_DAYS * 86_400_000).toISOString();
-                this.directory.prepare('DELETE FROM _substrat_ops_failures WHERE at < ?').run(horizon);
-                // The issues materialization (#1233): the group's counters live on their
-                // own row, bumped in the same call, because the evidence self-prunes above
-                // and a count must survive its own exemplars. A fresh arrival regresses a
-                // resolved issue; an ignored one stays ignored — that is what ignoring means.
-                this.directory
-                    .prepare(`INSERT INTO _substrat_issues
-               (fingerprint, operation, stage, origin, code, status, seen_count, first_seen, last_seen, last_message, last_tenant_id, last_owner_kind, last_vertical, last_version, resolved_version, resolved_at)
-             VALUES (?, ?, ?, ?, ?, 'new', 1, ?, ?, ?, ?, ?, ?, ?, NULL, NULL)
-             ON CONFLICT (fingerprint) DO UPDATE SET
-               seen_count = seen_count + 1,
-               last_seen = excluded.last_seen,
-               last_message = excluded.last_message,
-               last_tenant_id = excluded.last_tenant_id,
-               last_owner_kind = excluded.last_owner_kind,
-               last_vertical = COALESCE(excluded.last_vertical, last_vertical),
-               last_version = COALESCE(excluded.last_version, last_version),
-               origin = COALESCE(excluded.origin, origin),
-               status = CASE WHEN status = 'resolved' THEN 'regressed' ELSE status END`)
-                    .run(fingerprint, entry.operation, entry.stage ?? null, entry.origin ?? null, entry.code ?? null, at, at, entry.message.slice(0, 2000), entry.tenantId ?? null, issueExemplarOwner(entry.tenantId ?? null), entry.vertical ?? null, entry.version ?? null);
-                const issueHorizon = new Date(Date.now() - ISSUE_RETENTION_DAYS * 86_400_000).toISOString();
-                this.directory.prepare('DELETE FROM _substrat_issues WHERE last_seen < ?').run(issueHorizon);
+                // #1748: the evidence, its issue and its finding in ONE transaction — a detector that
+                // throws takes the evidence with it, so the caller's retry observes it rather than finding
+                // the row already there and the observation lost.
+                this.directory.transaction(() => {
+                    this.directory
+                        .prepare(`INSERT INTO _substrat_ops_failures
+                 (id, actor, operation, stage, tenant_id, scope_id, vertical, version, status, message, reference, origin, code, fingerprint, at)
+               VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`)
+                        .run(ulid(), entry.actor, entry.operation, entry.stage ?? null, entry.tenantId ?? null, entry.scopeId ?? null, entry.vertical ?? null, entry.version ?? null, entry.status ?? null, 
+                    // Bounded here, not trusted from the catch site: one runaway upstream
+                    // body must not become a runaway directory row (#559).
+                    entry.message.slice(0, 2000), entry.reference ?? null, entry.origin ?? null, entry.code ?? null, fingerprint, at);
+                    // Prune-on-write (#559): retention lives here, not in a cron — every insert
+                    // pays for its own housekeeping, so the table stays bounded even where no
+                    // scheduled pass runs (this adapter has none).
+                    const horizon = new Date(Date.now() - OPS_FAILURE_RETENTION_DAYS * 86_400_000).toISOString();
+                    this.directory.prepare('DELETE FROM _substrat_ops_failures WHERE at < ?').run(horizon);
+                    // The issues materialization (#1233): the group's counters live on their
+                    // own row, bumped in the same call, because the evidence self-prunes above
+                    // and a count must survive its own exemplars. A fresh arrival regresses a
+                    // resolved issue; an ignored one stays ignored — that is what ignoring means.
+                    this.directory
+                        .prepare(`INSERT INTO _substrat_issues
+                 (fingerprint, operation, stage, origin, code, status, seen_count, first_seen, last_seen, last_message, last_tenant_id, last_owner_kind, last_vertical, last_version, resolved_version, resolved_at)
+               VALUES (?, ?, ?, ?, ?, 'new', 1, ?, ?, ?, ?, ?, ?, ?, NULL, NULL)
+               ON CONFLICT (fingerprint) DO UPDATE SET
+                 seen_count = seen_count + 1,
+                 last_seen = excluded.last_seen,
+                 last_message = excluded.last_message,
+                 last_tenant_id = excluded.last_tenant_id,
+                 last_owner_kind = excluded.last_owner_kind,
+                 last_vertical = COALESCE(excluded.last_vertical, last_vertical),
+                 last_version = COALESCE(excluded.last_version, last_version),
+                 origin = COALESCE(excluded.origin, origin),
+                 status = CASE WHEN status = 'resolved' THEN 'regressed' ELSE status END`)
+                        .run(fingerprint, entry.operation, entry.stage ?? null, entry.origin ?? null, entry.code ?? null, at, at, entry.message.slice(0, 2000), entry.tenantId ?? null, issueExemplarOwner(entry.tenantId ?? null), entry.vertical ?? null, entry.version ?? null);
+                    const issueHorizon = new Date(Date.now() - ISSUE_RETENTION_DAYS * 86_400_000).toISOString();
+                    this.directory.prepare('DELETE FROM _substrat_issues WHERE last_seen < ?').run(issueHorizon);
+                    // #1748: the tenant's Recurring finding, over the tenant's own occurrences only.
+                    const finding = findingOfOpsFailure(entry);
+                    if (finding)
+                        observeFinding(redactionSqlOf(this.directory), finding, at);
+                })();
             },
             listOpsFailures: async (actor, filter) => {
                 const where = [];
@@ -7712,19 +7926,30 @@ export class SqliteScopeHost {
                 }));
             },
             recordSweepRun: async (entry) => {
-                this.directory
-                    .prepare(`INSERT OR IGNORE INTO _substrat_sweep_runs
-               (id, kind, unit, outcome, tenant_id, scope_id, vertical, version, operation,
-                connection_id, error, elapsed_ms, request_id, event_type, observed_at, platform_requests, at)
-             VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`)
-                    .run(ulid(), entry.kind, entry.unit, entry.outcome, entry.tenantId ?? null, entry.scopeId ?? null, entry.vertical ?? null, entry.version ?? null, entry.operation ?? null, entry.connectionId ?? null, 
-                // Bounded here, not trusted from the sweep: one runaway provider body
-                // must not become a runaway directory row (the #559 rule).
-                entry.error == null ? null : entry.error.slice(0, 2000), entry.elapsedMs ?? null, entry.requestId ?? null, entry.eventType ?? null, entry.observedAt ?? null, entry.platformRequests == null ? null : JSON.stringify(entry.platformRequests), entry.at ?? new Date().toISOString());
-                // Prune-on-write, like ops failures and for the same reason: the table stays
-                // bounded even on a deployment whose scheduled pass is broken.
-                const horizon = new Date(Date.now() - SWEEP_RUN_RETENTION_DAYS * 86_400_000).toISOString();
-                this.directory.prepare('DELETE FROM _substrat_sweep_runs WHERE at < ?').run(horizon);
+                const at = entry.at ?? new Date().toISOString();
+                // #1748: the row and its finding in ONE transaction. A replayed drain the unique index
+                // ignores observes nothing, which is right only because the first arrival's observation
+                // committed with it, or did not commit at all.
+                this.directory.transaction(() => {
+                    const { changes } = this.directory
+                        .prepare(`INSERT OR IGNORE INTO _substrat_sweep_runs
+                 (id, kind, unit, outcome, tenant_id, scope_id, vertical, version, operation,
+                  connection_id, error, elapsed_ms, request_id, event_type, observed_at, platform_requests, at)
+               VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`)
+                        .run(ulid(), entry.kind, entry.unit, entry.outcome, entry.tenantId ?? null, entry.scopeId ?? null, entry.vertical ?? null, entry.version ?? null, entry.operation ?? null, entry.connectionId ?? null, 
+                    // Bounded here, not trusted from the sweep: one runaway provider body
+                    // must not become a runaway directory row (the #559 rule).
+                    entry.error == null ? null : entry.error.slice(0, 2000), entry.elapsedMs ?? null, entry.requestId ?? null, entry.eventType ?? null, entry.observedAt ?? null, entry.platformRequests == null ? null : JSON.stringify(entry.platformRequests), at);
+                    // Prune-on-write, like ops failures and for the same reason: the table stays
+                    // bounded even on a deployment whose scheduled pass is broken.
+                    const horizon = new Date(Date.now() - SWEEP_RUN_RETENTION_DAYS * 86_400_000).toISOString();
+                    this.directory.prepare('DELETE FROM _substrat_sweep_runs WHERE at < ?').run(horizon);
+                    // #1748: a failed schedule (Invariant) or a stale freshness verdict (Drift). Only when the
+                    // row was written: a replayed drain the unique index ignored is not a second occurrence.
+                    const finding = changes > 0 ? findingOfSweepRun(entry) : null;
+                    if (finding)
+                        observeFinding(redactionSqlOf(this.directory), finding, at);
+                })();
             },
             listSweepRuns: async (actor, filter) => {
                 const where = [];
@@ -7794,6 +8019,8 @@ export class SqliteScopeHost {
                 }
                 return pruned;
             },
+            // #1748: one transaction, so a stale resolution never lands without its audit row.
+            pruneFindings: async (actor, limit) => this.auditedFindings(actor, (sql, audit) => pruneFindings(sql, Date.now(), limit, audit)),
             listIssues: async (actor, filter) => {
                 const where = [];
                 const params = [];
@@ -7838,6 +8065,25 @@ export class SqliteScopeHost {
                 this.recordAdmin(actor, 'setIssueStatus', { tenantId: null, vertical: after.lastVertical }, { fingerprint, status: existing.status }, { fingerprint, status: after.status });
                 return after;
             },
+            listFindings: async (actor, filter) => {
+                const rows = listFindings(redactionSqlOf(this.directory), filter);
+                this.recordAccess(actor, 'listFindings', { tenantId: filter?.tenantId ?? null }, filter, rows.length);
+                return rows;
+            },
+            // #1748: every findings mutation runs in ONE transaction with its audit row (`audited`).
+            setFindingStatus: async (actor, tenantId, id, status) => this.auditedFindings(actor, (sql, audit) => setFindingStatus(sql, tenantId, id, status, new Date().toISOString(), audit))
+                ?.after,
+            createFindingRule: async (actor, tenantId, input) => {
+                const { rule, suppressed } = this.auditedFindings(actor, (sql, audit) => createFindingRule(sql, tenantId, input, actor, new Date().toISOString(), audit));
+                return { rule, suppressed: suppressed.length };
+            },
+            revokeFindingRule: async (actor, tenantId, ruleId) => this.auditedFindings(actor, (sql, audit) => revokeFindingRule(sql, tenantId, ruleId, new Date().toISOString(), audit))
+                ?.after,
+            listFindingRules: async (actor, tenantId, filter) => {
+                const rows = listFindingRules(redactionSqlOf(this.directory), tenantId, filter?.active ? new Date().toISOString() : undefined, filter?.limit);
+                this.recordAccess(actor, 'listFindingRules', { tenantId }, filter, rows.length);
+                return rows;
+            },
             recordModelUsage: async (input) => {
                 const l = input.line;
                 // INSERT OR IGNORE on the UNIQUE request id: the drain may replay a settled-then-
@@ -8179,6 +8425,10 @@ export class SqliteScopeHost {
      * can never disagree about who acted (#97). `overrideActor` remains for the
      * system-actor path, where the acting module is the honest answer.
      */
+    /** The context a consumer or an import runs in: no operation, and the delivery it is for (#2055). */
+    deliveryContext(rt, subject, overrideActor, delivery) {
+        return this.operationContext(rt, subject, overrideActor, undefined, undefined, undefined, [], undefined, delivery);
+    }
     operationContext(rt, subject, overrideActor, 
     /** #458: per-invoke tally of `ctx.requestPlatform` calls; absent for consumer dispatch. */
     signals, 
@@ -8208,7 +8458,9 @@ export class SqliteScopeHost {
      * instant its row write used, so the `capability.exercised` event's `occurredAt` and the
      * row's `last_used_at` are the same value — a second clock read could disagree.
      */
-    at = this.clock()) {
+    at = this.clock(), 
+    /** #2055: the delivery a consumer's or an import's context runs for; absent otherwise. */
+    delivery) {
         // For a connection, system, capability or peer-vertical subject this carries THAT id so
         // the type holds — it is not a person, and the event actor below says what it is instead.
         const principal = subject.id;
@@ -8216,6 +8468,7 @@ export class SqliteScopeHost {
         const relations = this.relations;
         const searchPlans = this.searchPlans;
         const listPlans = this.listPlans;
+        const statePlans = this.statePlans;
         // K-34: the checks that passed in THIS operation. The context is created per invoke
         // (see buildStub), so this accumulates one operation's authorizations; `emit` snapshots
         // whatever has passed up to that point. A system/override actor is unconditionally
@@ -8337,11 +8590,10 @@ export class SqliteScopeHost {
             // about the process, so it never rides `DomainEvent` for module code to
             // branch on; it exists for the observability joins the column serves.
             this.versionId, 
-            // #1237: whatever delivery is in flight FOR THIS SCOPE, if any — read off
-            // the runtime, not the host, because the host serves every scope at once
-            // and this context outlives an `await`. A fact about the surrounding
-            // dispatch, never envelope data module code could set or branch on.
-            rt.causedBy, 
+            // #1237: the delivery this context was built for, if any — passed in, never read
+            // off the runtime or the host (#2055). A fact about the surrounding dispatch,
+            // never envelope data module code could set or branch on.
+            delivery?.causedBy ?? null, 
             // #1237: a fact about the surrounding CALL, like the version above — never
             // envelope data module code could set or branch on.
             rt.invocationId, full.payload === undefined ? null : JSON.stringify(full.payload));
@@ -8350,7 +8602,11 @@ export class SqliteScopeHost {
             tenantId: rt.tenantId,
             scopeId: rt.scopeId,
             principal,
-            sql: guardSecrets(guardSqlLimits(scopedSql(rt.db, true)), minted),
+            sql: guardSecrets(guardSqlLimits(scopedSql(rt.db, true, statefulTablesOf(statePlans), 
+            // #119: after runtime DDL, the stateful tables must still carry what the kernel derived.
+            statePlans.size
+                ? () => assertEntityStateIntact(spineSql(rt.db), statePlans, stateListIndexNames(listPlans.values()))
+                : undefined)), minted),
             now: () => at,
             // #1746/#1747: the host stamps who and where; module code supplies only the template
             // and its fields. The invocation id is read per call — it is set for the duration of
@@ -8359,7 +8615,7 @@ export class SqliteScopeHost {
                 tenantId: rt.tenantId,
                 scopeId: rt.scopeId,
                 operation: operation ?? null,
-                invocationId: () => rt.invocationId ?? rt.unitInvocationId,
+                invocationId: () => rt.invocationId ?? delivery?.invocationId ?? null,
                 // A consumer runs under the system override, so it logs as `system`.
                 principalKind: overrideActor ? 'system' : subject.kind,
                 // The string-safe redaction: `redactSecrets` parses its serialization back, and a
@@ -8420,7 +8676,9 @@ export class SqliteScopeHost {
                 const plan = searchPlans.get(entityType);
                 if (!plan)
                     throw new NotSearchable(entityType);
-                const q = searchQuery(plan, searchMatchExpression(term, plan.tokenizer), searchLimit(options?.limit));
+                const q = searchQuery(plan, searchMatchExpression(term, plan.tokenizer), searchLimit(options?.limit), 
+                // #119: active rows unless the archive is asked for.
+                searchStateWhere(statePlans, entityType, options?.view));
                 return rt.db.prepare(q.sql).all(...q.params).map((row) => ({ entityType, id: row.id, rank: row.rank }));
             },
             /**
@@ -8441,13 +8699,15 @@ export class SqliteScopeHost {
                     order: params.order,
                     cursor: params.cursor,
                     filters: params.filters,
+                    // #119: the bin is the checked reader's, never this one's.
+                    view: uncheckedView('ctx.page', entityType, params.view),
                 });
                 const rows = rt.db.prepare(q.sql).all(...q.params);
                 // A FULL page may have more; a short one is the end of the walk. Same rule
                 // as `pageOf`, applied here because the cursor is a COLUMN's value (plus
                 // the tie-break) rather than a field the caller could name.
                 const last = rows.length >= limit ? rows[rows.length - 1] : undefined;
-                const nextCursor = last === undefined ? null : cursorOf(last, q.sortColumn, plan.idColumn, q.order);
+                const nextCursor = last === undefined ? null : cursorOf(last, q.sortColumn, plan.idColumn, q.order, q.view);
                 const page = { entries: rows, nextCursor };
                 if (!params.total)
                     return page;
@@ -8526,6 +8786,24 @@ export class SqliteScopeHost {
                 emit: (event) => writeEvent(event, 'kernel'),
                 assertWrites: (verb) => assertImpersonationWrites(impersonation, verb),
             }),
+            // #119: archive and trash, written once in the kernel. The raw seam, because the guarded
+            // `ctx.sql` refuses the very columns these write; the operation's own check, so the
+            // declared key's pass is one of its authorizations.
+            ...createEntityStateVerbs({
+                sql: spineSql(rt.db),
+                plans: statePlans,
+                now: at,
+                check: runCheck,
+                emit: (event) => writeEvent(event, 'kernel'),
+                assertWrites: (verb) => assertImpersonationWrites(impersonation, verb),
+            }),
+            ...createTrashedReads({
+                query: (q, params) => rt.db.prepare(q).all(...params),
+                listPlans,
+                searchPlans,
+                statePlans,
+                check: runCheck,
+            }),
             // #304: the request-time entitlement read. The pure adapter is single-process, so the
             // directory is local — no projection needed; it reads `_substrat_entitlements` straight,
             // with the same expiry-at-read filter as the gate (#33), and the SAME contract the DO
@@ -8689,7 +8967,7 @@ export class SqliteScopeHost {
         if (!r || r.tenant_id !== tenantId)
             throw substratError('not_found', `unknown scope for tenant: (${tenantId}, ${scopeId})`);
         if (r.status === 'reaped') {
-            throw new Error(`scope ${scopeId} is reaped — its storage is gone and cannot be read`);
+            throw substratError('conflict', `scope ${scopeId} is reaped — its storage is gone and cannot be read`);
         }
     }
     /**
@@ -8859,6 +9137,13 @@ export class SqliteScopeHost {
         // executes, the table always already has `kind` in its key, never `invocation_id`.
         this.ensureColumn(db, '_substrat_schedule_state', 'invocation_id', 'invocation_id TEXT');
         this.ensureColumn(db, '_substrat_job_runs', 'subject_id', 'subject_id TEXT');
+        // #2034: the lease, on a scope DB built before it. NULL = nobody holds the run.
+        this.ensureColumn(db, '_substrat_job_runs', 'lease_owner', 'lease_owner TEXT');
+        // #2042 r2, r4: whether the holder BEGAN its pass. NULL = it has not, which is right for any lease
+        // already there: a takeover of it costs nothing.
+        this.ensureColumn(db, '_substrat_job_runs', 'lease_began_at', 'lease_began_at TEXT');
+        // #2042 r3: consecutive admission misses. NULL = none, right for every run already there.
+        this.ensureColumn(db, '_substrat_job_runs', 'admission_misses', 'admission_misses INTEGER');
         // #2009: the copy classification on a scope DB built before it (NULL reads as a copy; see
         // `COPY_ORIGIN_DDL`).
         this.ensureColumn(db, '_substrat_copy_origin', 'is_copy', 'is_copy INTEGER');
@@ -8907,9 +9192,7 @@ export class SqliteScopeHost {
             actor: new ScopeActor(),
             appliedMigrations,
             mintEventId,
-            causedBy: null,
             invocationId: null,
-            unitInvocationId: null,
         };
         this.scopes.set(key, created);
         this.scopesById.set(scopeId, created);
@@ -8974,7 +9257,11 @@ function assertTablesWithinColumnLimit(db) {
     if (wide)
         throw new Error(tooManyTableColumns(wide.name, wide.width));
 }
-function scopedSql(db, judgeWidth = false) {
+function scopedSql(db, judgeWidth = false, 
+/** #119: the module tables carrying archive/trash columns — `guardSpine` refuses positional writes to them. */
+statefulTables, 
+/** #119: the kernel's integrity check, run after any runtime DDL — see `guardSpine`. */
+afterDdl) {
     // #1811: a Durable Object refuses a result set over its column cap, `exec` of a SELECT included.
     // The driver knows the width, so it is read off the prepared statement rather than parsed out
     // of the text (a `SELECT *` is as wide as the tables under it). Module SQL only, like the
@@ -9001,7 +9288,7 @@ function scopedSql(db, judgeWidth = false) {
                 assertTablesWithinColumnLimit(db);
             return { changes: info.changes };
         },
-    });
+    }, statefulTables, afterDdl);
 }
 const schemaVersion = (db) => db.pragma('schema_version', { simple: true });
 //# sourceMappingURL=index.js.map