@substrat-run/adapter-sqlite 0.138.0 → 0.139.0

package/dist/index.js

@@ -1,9 +1,9 @@
 import { existsSync, mkdirSync, readdirSync, readFileSync, rmSync, writeFileSync } from 'node:fs';
 import { dirname, join } from 'node:path';
 import Database from 'better-sqlite3';
-import { accessLogEntry, adminLogEntry, delegatedReadParams, operationSeriesCount, opsFailureEntry, opsFailureFingerprint, issueEntry, FRESHNESS_HEARTBEAT_MINUTES, sweepRunEntry, modelUsageEntry, ATTACHMENT_ADDED, ATTACHMENT_REMOVED, attachmentRecord, createTenantInput, domainEvent, domainEventInput, exportReadInput, importBatch, importCursorMove, exportsOfManifestJson, importsOfManifestJson, entitlementGrant, entitlementGrantInput, eventId, meterReading, platformRequestInput, platformRequestId, MAX_PENDING_PLATFORM_REQUESTS, identityLink, identityPool, instant, connection, capabilityGrant, connectionGrant, connectionGrantRecord, connectionSecret, systemGrant, systemSwitch, systemSwitchRecord, peerSwitch, verticalCaller, verticalSlug as verticalSlugOf, subjectRef, requestFingerprint, createConnectionInput, projectedConnectionGrant, projectedConnectionKey, moduleManifest, createOrgInput, promotionAcknowledgement, bindAcknowledgement, bindHostnameInput, channelHistoryEntry, hostnameBinding, publishVersionInput, AUTO_ADMISSION_NOTE, routeTarget, ROUTE_SCOPE_HOSTNAMES_MAX, registerVerticalInput, vertical as verticalSchema, verticalChannel, verticalVersion, objectRef, entityObjectRef, assertModuleEmittableType, assertKernelAuthoredType, grantRefFromProof, org as orgSchema, orgMembership, principalId, resolvedIdentity, identityMembership, roleDefinition, scope as scopeSchema, tenant as tenantSchema, tenantRole, subjectShredReceipt, SCOPE_TABLE_PAGE_DEFAULT, SCOPE_TABLE_PAGE_MAX, SCOPE_QUERY_ROW_MAX, verticalServingState, callsOfManifestJson, outboundOfManifestJson, listLimitOf, SCOPE_GATE_REASONS, substratError, assertReplayableDump, delegatedReadRecord, ownerTransferAudit, copyMarkAudit, redrainEventsInput, REDRAIN_BATCH, } from '@substrat-run/contracts';
-import { actorOf, asPrincipal, assertAllowed, assertNoSecret, assertPermissionKey, CAPABILITY_DDL, COPY_ORIGIN_DDL, CAPABILITY_EXCHANGE_OPERATION, capabilityAttachmentWriteRefused, capabilityTokenHash, createCapabilityVerbs, createEntityEdgeVerbs, exchangeCapability as exchangeCapabilitySecret, guardSecrets, mintBecomeCapability, plausibleSessionToken, readCapabilityPage, redactSecrets, redactSecretText, moduleLog, consoleLogSink, asyncInvocationId, asyncLinePass, consoleInvocationLineSink, resolveCapabilitySession, revokeCapabilityAsPlatform, assertReadOnlyQuery, attachmentBlobKey, attachmentSha256, entitlementDenial, requiredEntitlementFor, foldMeterReading, guardSpine, guardSqlLimits, DO_SQL_LIMITS, tooManyResultColumns, tooManyTableColumns, parseValidationRecords, resolveScopeRecord, ulid, ISSUE_RETENTION_DAYS, telemetryRetentionStatements, assertRowLimit, assertRowOffset, OPS_FAILURE_RETENTION_DAYS, SWEEP_RUN_RETENTION_DAYS, SWEEP_RUNS_INTENT_INDEX, sweepRunsIntentHasKind, MODEL_USAGE_RETENTION_DAYS, foldModelUsage, backoffAt, platformRequestHistoryQuery, platformRequestOf, PLATFORM_REQUEST_COLUMNS, PLATFORM_REQUEST_REDACTION_SQL, platformRequestRedactionParams, platformRequestRedactionQuery, intentPayloadCarriesSubject, redactSubjectJobRuns, redactSubjectScopeText, redactSubjectDirectoryText, ISSUE_EXEMPLAR_OWNER_BACKFILL_SQL, issueExemplarOwner, JOB_RUN_PATCH_SQL, JOB_RUN_CLAIM_SQL, JOB_RUN_RENEW_SQL, JOB_RUN_BEGIN_SQL, JOB_RUN_MISS_SQL, JOB_RUN_MISS_SETTLE_SQL, admissionMissOutcome, JOB_STEP_RECORD_SQL, JOB_LEASE_EXPIRED_NOTE, assertLeaseMs, DELIVERY_ERROR_REDACTION_SQL, REDACTED_DELIVERY_NOTE, seatScopeTuple, admitPeer, collectPeers, peerSeats, resolveVerticalInstanceFrom, peerGrantsStatus, systemGrantsStatus, systemScheduleState, systemSwitchedOff, systemSwitchedOffMessage, tenantSystemSwitchedOffMessage, PEER_SWITCHES_DDL, SWITCH_OWED_DDL, SWITCH_FENCES_DDL, recordWriteSuperseded, switchFencesOf, switchSupersededMessage, SWITCH_KINDS, SYSTEM_SWITCHES_DDL, forgetSwitchesOf, listSystemSwitchRecords, moveSwitch, reassertActionOf, reassertEntry, reassertOffRow, recordSwitchedOff, recordSwitchedOn, restoreSwitchRecord, scopesSwitchedOffFor, switchActionOf, switchAuditSubject, switchNotFoundMessage, switchRecordsOf, switchedOffOf, switchesBackfillSqlOf, switchesTableExists, tenantHeldOf, tenantHoldsGrant, inUnitMovesToAudit, staleCarryRevertRow, staleCarryReverts, withRecorded, VERSION_MIGRATIONS_DDL, splitManifestMigrations, splitVersionMigrationsBatch, versionMigrationsOf, writeVersionMigrations, denialListQuery, refusalListQuery, mapRefusalRow, denialSummaryQuery, denialTotalsQuery, DENIAL_WINDOW_QUERY, mapDenialRow, mapDenialSummaryBuckets, IMPERSONATION_COLUMNS, IMPERSONATION_DDL, ImpersonationRefused, assertImpersonationWrites, assertModuleEnqueueableKind, assertSessionUsable, impersonationByIdQuery, impersonationListQuery, impersonationRowValues, impersonationStampOf, mapImpersonationRow, newImpersonationSession, resolveRetryPolicy, executorOutcomeOf, isDeliveryRefusal, refusalJournalText, membershipFencesBackfillSql, MEMBERSHIP_FENCES_DDL, membershipFencesTableExists, MEMBERSHIP_FENCE_SINCE_SQL, RAISE_MEMBERSHIP_FENCE_SQL, tenantCoverage, isSecretBoxConfigured, unconfiguredSecretBox, createSubjectKeys, generateSealingKeyPair, noSealingKeyMessage, openSealed, sealTo, ConnectionSealingKeyUnavailableError, PermissionDenied, createAtomic, NotSearchable, NotListable, listIndexMigrations, listIndexPlans, listQuery, cursorOf, moduleMigrations, isSearchIndexTable, searchIndexDdl, searchIndexMigrations, searchIndexPlans, searchLimit, searchMatchExpression, searchQuery, ATTACHMENT_TEXT_DDL, assertAttachmentExtractors, assertJobRegistrable, attachmentRecordOfRow, attachmentTextJob, enqueueAttachmentText, isAttachmentTextRun, reconcileAttachmentText, recordAttachmentText, searchAttachments, entityVersionQuery, entityVersionOf, assertIfMatch, OUTBOX_ENTITY_INDEX, SCHEDULE_STATE_DDL, SCHEDULE_STATE_REBUILD, scheduleStateHasKind, VERTICAL_EVENTS_DDL, EXPORT_HOPS_SQL, emptyImportResult, IMPORT_CURSORS_SQL, IMPORT_CURSOR_OF_SQL, OUTBOX_MARK_SQL, emittedSinceQuery, emittedReportOf, EMITTED_REPORT_CAP, exportedSinceQuery, IMPORT_CURSOR_ADVANCE_SQL, IMPORT_RECORD_SQL, moveImportCursor, importCursorSourceOf, exportBreaksOf, exportBreakRefusal, bindExportBreaksOf, bindExportBreakRefusal, CrossVerticalRegistry, exportReadPlan, exportReadQuery, planExportBatch, withheldNote, JOB_RUN_DDL, JOB_RUN_DUE_AT, jobRunListLimit, jobRunOf, runDueJobRuns, startJobRun, IDEMPOTENCY_DDL, REFUSALS_TABLE_DDL, REFUSALS_INDEX, refusalInsert, refusalOf, markGuardRefusal, REFUSALS_REBUILD, refusalsAdmitGuards, assertIdempotencyKey, idempotencyLookupQuery, idempotencyPruneStatement, idempotencyRecordStatement, idempotencyOptedOutMessage, replayFor, globalFetch, createUlid, facetEvents, readHistory, walkEventCause, walkEventEffects, assertRedrainWindow, readInvocation, readDeadLetters, readLifecycleFlow, readOperationSeries, domainEventOf, readUndrainedOutbox, undrainedEventsOf, connectorCallRecord, noopConnectorCallRecorder, recordConnectorCall, settleConnectionUse, unknownRoleError, } from '@substrat-run/kernel';
-import { attributedHost } from '@substrat-run/kernel';
+import { accessLogEntry, adminLogEntry, delegatedReadParams, operationSeriesCount, opsFailureEntry, opsFailureFingerprint, issueEntry, FRESHNESS_HEARTBEAT_MINUTES, sweepRunEntry, modelUsageEntry, ATTACHMENT_ADDED, ATTACHMENT_REMOVED, attachmentRecord, createTenantInput, domainEvent, domainEventInput, exportReadInput, importBatch, importCursorMove, exportsOfManifestJson, importsOfManifestJson, entitlementGrant, entitlementGrantInput, eventId, meterReading, platformRequestInput, platformRequestId, MAX_PENDING_PLATFORM_REQUESTS, identityLink, identityPool, instant, connection, capabilityGrant, connectionGrant, connectionGrantRecord, connectionSecret, systemGrant, systemSwitch, systemSwitchRecord, peerSwitch, verticalCaller, verticalSlug as verticalSlugOf, subjectRef, requestFingerprint, createConnectionInput, projectedConnectionGrant, projectedConnectionKey, moduleManifest, createOrgInput, promotionAcknowledgement, bindAcknowledgement, bindHostnameInput, channelHistoryEntry, hostnameBinding, publishVersionInput, AUTO_ADMISSION_NOTE, routeTarget, ROUTE_SCOPE_HOSTNAMES_MAX, registerVerticalInput, vertical as verticalSchema, verticalChannel, verticalVersion, objectRef, entityObjectRef, assertModuleEmittableType, assertKernelAuthoredType, grantRefFromProof, org as orgSchema, orgMembership, principalId, resolvedIdentity, identityMembership, roleDefinition, scope as scopeSchema, tenant as tenantSchema, tenantRole, subjectShredReceipt, SCOPE_TABLE_PAGE_DEFAULT, SCOPE_TABLE_PAGE_MAX, SCOPE_QUERY_ROW_MAX, verticalServingState, callsOfManifestJson, outboundOfManifestJson, listLimitOf, SCOPE_GATE_REASONS, substratError, assertReplayableDump, delegatedReadRecord, ownerTransferAudit, memberChangeAudit, copyMarkAudit, redrainEventsInput, REDRAIN_BATCH, } from '@substrat-run/contracts';
+import { actorOf, asPrincipal, assertAllowed, assertNoSecret, assertPermissionKey, CAPABILITY_DDL, COPY_ORIGIN_DDL, ENTITY_STATE_MOVES_DDL, CAPABILITY_EXCHANGE_OPERATION, capabilityAttachmentWriteRefused, capabilityTokenHash, createCapabilityVerbs, createEntityEdgeVerbs, createEntityStateVerbs, createTrashedReads, searchStateWhere, uncheckedView, addStatePlans, entityStateMigrations, entityStateTriggerDdl, statefulTablesOf, assertEntityStateIntact, stateListIndexNames, exchangeCapability as exchangeCapabilitySecret, guardSecrets, mintBecomeCapability, plausibleSessionToken, readCapabilityPage, redactSecrets, redactSecretText, moduleLog, consoleLogSink, asyncInvocationId, asyncLinePass, consoleInvocationLineSink, resolveCapabilitySession, revokeCapabilityAsPlatform, assertReadOnlyQuery, attachmentBlobKey, attachmentSha256, entitlementDenial, requiredEntitlementFor, foldMeterReading, guardSpine, guardSqlLimits, DO_SQL_LIMITS, tooManyResultColumns, tooManyTableColumns, parseValidationRecords, resolveScopeRecord, ulid, ISSUE_RETENTION_DAYS, telemetryRetentionStatements, FINDINGS_DDL, createFindingRule, findingOfOpsFailure, findingOfSweepRun, pruneFindings, listFindingRules, listFindings, observeFinding, revokeFindingRule, setFindingStatus, assertRowLimit, assertRowOffset, OPS_FAILURE_RETENTION_DAYS, SWEEP_RUN_RETENTION_DAYS, SWEEP_RUNS_INTENT_INDEX, sweepRunsIntentHasKind, MODEL_USAGE_RETENTION_DAYS, foldModelUsage, backoffAt, platformRequestHistoryQuery, platformRequestOf, PLATFORM_REQUEST_COLUMNS, PLATFORM_REQUEST_REDACTION_SQL, platformRequestRedactionParams, platformRequestRedactionQuery, intentPayloadCarriesSubject, redactSubjectJobRuns, redactSubjectScopeText, redactSubjectDirectoryText, ISSUE_EXEMPLAR_OWNER_BACKFILL_SQL, issueExemplarOwner, JOB_RUN_PATCH_SQL, JOB_RUN_CLAIM_SQL, JOB_RUN_RENEW_SQL, JOB_RUN_BEGIN_SQL, JOB_RUN_MISS_SQL, JOB_RUN_MISS_SETTLE_SQL, admissionMissOutcome, JOB_STEP_RECORD_SQL, JOB_LEASE_EXPIRED_NOTE, assertLeaseMs, DELIVERY_ERROR_REDACTION_SQL, REDACTED_DELIVERY_NOTE, seatScopeTuple, applyScopeRoleChange, changeScopeRole, revokeScopeRoles, scopeRoleHolders, admitPeer, collectPeers, peerSeats, resolveVerticalInstanceFrom, peerGrantsStatus, systemGrantsStatus, systemScheduleState, systemSwitchedOff, systemSwitchedOffMessage, tenantSystemSwitchedOffMessage, PEER_SWITCHES_DDL, SWITCH_OWED_DDL, SWITCH_FENCES_DDL, recordWriteSuperseded, switchFencesOf, switchSupersededMessage, SWITCH_KINDS, SYSTEM_SWITCHES_DDL, forgetSwitchesOf, listSystemSwitchRecords, moveSwitch, reassertActionOf, reassertEntry, reassertOffRow, recordSwitchedOff, recordSwitchedOn, restoreSwitchRecord, scopesSwitchedOffFor, switchActionOf, switchAuditSubject, switchNotFoundMessage, switchRecordsOf, switchedOffOf, switchesBackfillSqlOf, switchesTableExists, tenantHeldOf, tenantHoldsGrant, inUnitMovesToAudit, staleCarryRevertRow, staleCarryReverts, withRecorded, VERSION_MIGRATIONS_DDL, splitManifestMigrations, splitVersionMigrationsBatch, versionMigrationsOf, writeVersionMigrations, denialListQuery, refusalListQuery, mapRefusalRow, denialSummaryQuery, denialTotalsQuery, DENIAL_WINDOW_QUERY, mapDenialRow, mapDenialSummaryBuckets, IMPERSONATION_COLUMNS, IMPERSONATION_DDL, ImpersonationRefused, assertImpersonationWrites, assertModuleEnqueueableKind, assertSessionUsable, impersonationByIdQuery, impersonationListQuery, impersonationRowValues, impersonationStampOf, mapImpersonationRow, newImpersonationSession, resolveRetryPolicy, executorOutcomeOf, isDeliveryRefusal, refusalJournalText, membershipFencesBackfillSql, MEMBERSHIP_FENCES_DDL, membershipFencesTableExists, MEMBERSHIP_FENCE_SINCE_SQL, RAISE_MEMBERSHIP_FENCE_SQL, memberAddedAudit, orgChangeBound, tenantCoverage, isSecretBoxConfigured, unconfiguredSecretBox, createSubjectKeys, generateSealingKeyPair, noSealingKeyMessage, openSealed, sealTo, ConnectionSealingKeyUnavailableError, PermissionDenied, createAtomic, NotSearchable, NotListable, listIndexDdl, listIndexMigrations, listIndexPlans, listQuery, cursorOf, moduleMigrations, isSearchIndexTable, searchIndexDdl, searchIndexMigrations, searchIndexPlans, searchLimit, searchMatchExpression, searchQuery, ATTACHMENT_TEXT_DDL, assertAttachmentExtractors, resolveAttachmentTextBounds, assertJobRegistrable, attachmentRecordOfRow, attachmentTextJob, enqueueAttachmentText, ATTACHMENT_TEXT_BACKFILL_JOB, ATTACHMENT_TEXT_JOB, kernelJobFor, queueAttachmentTextBackfill, startAttachmentTextBackfill, attachmentTextBackfillJob, reconcileAttachmentText, recordAttachmentText, searchAttachments, entityVersionQuery, entityVersionOf, assertIfMatch, OUTBOX_ENTITY_INDEX, SCHEDULE_STATE_DDL, SCHEDULE_STATE_REBUILD, scheduleStateHasKind, VERTICAL_EVENTS_DDL, EXPORT_HOPS_SQL, emptyImportResult, IMPORT_CURSORS_SQL, IMPORT_CURSOR_OF_SQL, OUTBOX_MARK_SQL, emittedSinceQuery, emittedReportOf, EMITTED_REPORT_CAP, exportedSinceQuery, IMPORT_CURSOR_ADVANCE_SQL, IMPORT_RECORD_SQL, moveImportCursor, importCursorSourceOf, exportBreaksOf, exportBreakRefusal, bindExportBreaksOf, bindExportBreakRefusal, CrossVerticalRegistry, exportReadPlan, exportReadQuery, planExportBatch, withheldNote, JOB_RUN_DDL, JOB_RUN_DUE_AT, jobRunListLimit, jobRunOf, runDueJobRuns, startJobRun, IDEMPOTENCY_DDL, REFUSALS_TABLE_DDL, REFUSALS_INDEX, refusalInsert, refusalOf, markGuardRefusal, REFUSALS_REBUILD, refusalsAdmitGuards, assertIdempotencyKey, idempotencyLookupQuery, idempotencyPruneStatement, idempotencyRecordStatement, idempotencyOptedOutMessage, replayFor, globalFetch, createUlid, facetEvents, readHistory, walkEventCause, walkEventEffects, assertRedrainWindow, readInvocation, readDeadLetters, readLifecycleFlow, readOperationSeries, domainEventOf, readUndrainedOutbox, undrainedEventsOf, connectorCallRecord, noopConnectorCallRecorder, recordConnectorCall, settleConnectionUse, unknownRoleError, } from '@substrat-run/kernel';
+import { attributedView } from '@substrat-run/kernel';
 import { INERT_SCOPE_REASON, isPrimaryScopeRow } from '@substrat-run/kernel';
 import { LEGACY_SCOPE_ROWS_BACKFILL, assertNoSpineReference, assertSpineTablesBuilt, capabilitiesForLoad, dumpRowsInsert, isSpineTable, loadDirectoryDump, repointScopeGrants, settleCopiedWork, emittedHere, spineColumnAdditions } from '@substrat-run/kernel';
 import { ScopeActor } from './actor.js';
@@ -213,6 +213,9 @@ const KERNEL_DDL = `
   -- #1686: where a copied scope's data came from, and the event id its own events start above.
   -- Shared with the other adapter from @substrat-run/kernel; the column comments are there.
   ${COPY_ORIGIN_DDL}
+  -- #119: the kernel's authorization for one archive/trash move, read by the derived update
+  -- trigger. Shared with the other adapter from @substrat-run/kernel; the comments are there.
+  ${ENTITY_STATE_MOVES_DDL}
   -- #383 / #1232 / #1288: the platform sweep's per-scope gating state, holding two
   -- families of row that the kind COLUMN — not the spelling of a key — tells apart.
   -- Spine (kernel-written), never a module migration. Shared with the DO adapter from
@@ -521,6 +524,8 @@ export class SqliteScopeHost {
     searchPlans = new Map();
     /** #811: the paged lists modules declare, by entity type. Same one-owner rule as search. */
     listPlans = new Map();
+    /** #119: entity type → its archive/trash plan, from every registered module. */
+    statePlans = new Map();
     /** entityType → the declared attachment gate (#473): read key + write key (default: read). */
     attachmentTargets = new Map();
     /** operation name → who binds it: the owning module, its entitlementKey and its declared
@@ -557,10 +562,10 @@ export class SqliteScopeHost {
      */
     jobs = new Map();
     /**
-     * The event currently being effected by an executor, stamped onto any admin rows
-     * it writes. Ambient rather than threaded through every HostAdmin signature: it is
-     * set and cleared immediately around one `await`, and executors run sequentially,
-     * so there is no window where it belongs to a different event.
+     * The event an executor is effecting, stamped onto the admin rows it writes (K-22). Like
+     * `onBehalfOf`, only ever set on a VIEW (`causedByView`, or `attributed` with a
+     * `causedBy`), never on the host: a field set around the handler's `await` stamped every
+     * admin call the host served meanwhile — a staff call included — with that event (#2055).
      */
     causedBy = null;
     /**
@@ -573,6 +578,7 @@ export class SqliteScopeHost {
     secretBox;
     /** The parsers attachment text is extracted with (K-43); the host's own, never imported here. */
     attachmentExtractors;
+    attachmentTextBounds;
     fetchImpl;
     connectorCalls;
     clock;
@@ -590,6 +596,7 @@ export class SqliteScopeHost {
         this.secretBox = options.secretBox ?? unconfiguredSecretBox;
         assertAttachmentExtractors(options.attachmentExtractors ?? []);
         this.attachmentExtractors = options.attachmentExtractors ?? [];
+        this.attachmentTextBounds = resolveAttachmentTextBounds(options.attachmentTextBounds);
         this.fetchImpl = options.fetch ?? globalFetch;
         this.connectorCalls = options.connectorCalls ?? noopConnectorCallRecorder;
         this.clock = options.clock ?? (() => instant.parse(new Date().toISOString()));
@@ -1146,6 +1153,8 @@ export class SqliteScopeHost {
         resolved_at TEXT
       );
       CREATE INDEX IF NOT EXISTS _substrat_issues_seen ON _substrat_issues (last_seen);
+      -- #1748: tenant findings and their suppress rules — kernel-owned DDL (findings.ts).
+      ${FINDINGS_DDL}
       -- The durable sweep record (#1232): one row per unit outcome per pass —
       -- a connection swept/skipped/failed, a schedule fired/skipped/failed. What
       -- makes "when was this last swept" answerable after the log line rolls off.
@@ -1458,14 +1467,17 @@ export class SqliteScopeHost {
         // #811: the list indexes this module's `lists` declare — same placement and
         // the same reason as the search indexes above: appended AFTER the module's
         // own migrations, so `CREATE INDEX` names a table that exists.
-        const listMigrations = listIndexMigrations(manifest.id, manifest.lists);
-        for (const m of listMigrations) {
+        // #119: the archive/trash columns, and the plans the verbs and the reads consult.
+        const stateMigrations = entityStateMigrations(manifest.id, manifest.entityStates);
+        const listMigrations = listIndexMigrations(manifest.id, manifest.lists, manifest.entityStates);
+        for (const m of [...stateMigrations, ...listMigrations]) {
             if (seen.has(m.version)) {
                 throw new Error(`duplicate migration version in ${manifest.id}: ${m.version}`);
             }
             seen.add(m.version);
         }
-        for (const plan of listIndexPlans(manifest.id, manifest.lists)) {
+        addStatePlans(this.statePlans, manifest.id, manifest.entityStates, manifest.permissions);
+        for (const plan of listIndexPlans(manifest.id, manifest.lists, manifest.entityStates)) {
             const existing = this.listPlans.get(plan.entityType);
             if (existing) {
                 throw new Error(`list: '${plan.entityType}' declares a paged list in both '${existing.moduleId}' and ` +
@@ -2266,6 +2278,18 @@ export class SqliteScopeHost {
                 if (present.has(plan.table))
                     db.exec(searchIndexDdl(plan));
             }
+            // #119: the guard triggers went with the dropped table. Put back AFTER the rows, which
+            // may legitimately arrive archived or trashed.
+            for (const plan of this.statePlans.values()) {
+                if (present.has(plan.table))
+                    db.exec(entityStateTriggerDdl(plan));
+            }
+            // #811 / #119: the derived list indexes went with it too, and a load never put them back —
+            // an archivable entity's partial indexes are part of what the kernel checks after DDL.
+            for (const plan of this.listPlans.values()) {
+                if (present.has(plan.table))
+                    db.exec(listIndexDdl(plan));
+            }
             // #1575: attachment text is not in a dump, so a load left it as it was. Drop the
             // text of attachments the dump did not bring back, and queue extraction for those
             // it brought back without text — the bytes decide what that run finds.
@@ -2685,16 +2709,14 @@ export class SqliteScopeHost {
                     const { hops: _hops, ...fact } = e;
                     const event = structuredClone({ ...fact, source });
                     const unit = unitOf(imp.moduleId, e.id, e.type);
-                    // What the handler emits was emitted BECAUSE of the producer's event (#1237). The id
-                    // resolves through `_substrat_imports`, which the row above has just written.
-                    rt.causedBy = e.id;
-                    rt.unitInvocationId = unit.invocationId;
                     rt.db.exec('BEGIN IMMEDIATE');
                     try {
                         // As the producer's principal, admitted above: the handler's checks are real ones,
                         // against the grants this vertical's `peers` gave it, and its emits carry the actor
-                        // `{ vertical, scope }` and the authorization they passed (K-34).
-                        await imp.handler(this.operationContext(rt, subject), event);
+                        // `{ vertical, scope }` and the authorization they passed (K-34). What it emits was
+                        // emitted BECAUSE of the producer's event (#1237); the id resolves through
+                        // `_substrat_imports`, which the row above has just written.
+                        await imp.handler(this.deliveryContext(rt, subject, undefined, { causedBy: e.id, invocationId: unit.invocationId }), event);
                         rt.db
                             .prepare(`INSERT INTO _substrat_deliveries (event_id, consumer_module, delivered_at, invocation_id)
                  VALUES (?, ?, ?, NULL)`)
@@ -2711,10 +2733,6 @@ export class SqliteScopeHost {
                         result.deadLettered += 1;
                         lines.write({ ...unit, outcome: 'dead-lettered', error: err });
                     }
-                    finally {
-                        rt.causedBy = null;
-                        rt.unitInvocationId = null;
-                    }
                 }
                 if (!ran)
                     result.duplicates += 1;
@@ -2925,13 +2943,35 @@ export class SqliteScopeHost {
         const target = principalId.parse(assignee);
         return rt.actor.turn(async () => {
             const bound = await this.assignmentBound(subject, tenantId, scopeId, roleKey);
-            if (bound.covered) {
-                rt.db.prepare(`INSERT OR REPLACE INTO _substrat_tuples (subject, relation, object, expires_at)
-           VALUES (?, ?, ?, NULL)`).run(`principal:${target}`, `role:${roleKey}`, `scope:${scopeId}`);
-            }
+            if (bound.covered)
+                applyScopeRoleChange(switchSqlOf(rt.db), scopeId, target, { revoke: [], grant: roleKey }, this.clock());
             return bound;
         });
     }
+    async listScopeRoleHolders(tenantId, scopeId, principal) {
+        const rt = await this.openActiveScope(tenantId, scopeId);
+        const who = principal === undefined ? undefined : principalId.parse(principal);
+        return rt.actor.enqueue(() => scopeRoleHolders(switchSqlOf(rt.db), scopeId, this.clock(), who));
+    }
+    async changeScopeRoleBounded(tenantId, scopeId, caller, principal, from, to) {
+        const rt = await this.openActiveScope(tenantId, scopeId);
+        const target = principalId.parse(principal);
+        const answer = await rt.actor.turn(() => changeScopeRole(switchSqlOf(rt.db), scopeId, target, from, to, this.clock(), this.roleBound(caller, tenantId, scopeId), (run) => rt.db.transaction(run)()));
+        if (answer === 'not-held')
+            throw substratError('conflict', `${target} does not hold '${from}' at this scope`);
+        if (answer === 'unknown-to')
+            throw unknownRoleError(to);
+        return answer;
+    }
+    async revokeScopeRolesBounded(tenantId, scopeId, caller, principal) {
+        const rt = await this.openActiveScope(tenantId, scopeId);
+        return rt.actor.turn(() => revokeScopeRoles(switchSqlOf(rt.db), scopeId, principalId.parse(principal), this.clock(), this.roleBound(caller, tenantId, scopeId), (run) => rt.db.transaction(run)()));
+    }
+    /** The caller's bound per role at the scope, `null` for a role this tenant does not define (#1150). */
+    roleBound(caller, tenantId, scopeId) {
+        const subject = asPrincipal(principalId.parse(caller));
+        return async (roleKey) => this.roles.has(`${tenantId}/${roleKey}`) ? this.assignmentBound(subject, tenantId, scopeId, roleKey) : null;
+    }
     /**
      * §5.1's assignment bound, resolved against the SAME role table the checker expands
      * — not a vertical's compile-time `ROLES` array. A tenant's projected role is what
@@ -3683,16 +3723,17 @@ export class SqliteScopeHost {
                     lines.write({ ...unit, attempt: attempts, outcome: 'inert' });
                     continue;
                 }
-                this.causedBy = event.id;
+                // #2055: the handler writes through a view bound to its event, never through the host.
+                const caused = this.causedByView(event.id);
                 try {
                     let result;
                     if (executor.kind === 'connector') {
                         // `true`: dispatchExecutors is only ever reached from inside
                         // `rt.actor.enqueue` (invoke's post-commit tail, or drainDue).
-                        await executor.handler(this.connectorContext(rt, executor.timeoutMs, true, event.id), event);
+                        await executor.handler(caused.connectorContext(rt, executor.timeoutMs, true, event.id), event);
                     }
                     else {
-                        result = await executor.handler(this.admin, event, scope);
+                        result = await executor.handler(caused.admin, event, scope);
                     }
                     // #1184: a refusal is the handler's own terminal decision — journaled with its
                     // reason, never retried, and listed by `executorDeadLetters` beside an exhausted one.
@@ -3719,9 +3760,6 @@ export class SqliteScopeHost {
                     outcomeOf(dead ? 'dead-lettered' : 'retrying', err);
                     lines.write({ ...unit, attempt: attempts, outcome: dead ? 'dead-lettered' : 'retrying', error: err });
                 }
-                finally {
-                    this.causedBy = null;
-                }
             }
         }
     }
@@ -3948,7 +3986,7 @@ export class SqliteScopeHost {
             write: (attachmentId, outcome) => rt.actor.enqueue(() => recordAttachmentText(spineSql(rt.db), attachmentId, outcome, this.clock())),
         }, 
         // K-43: the host's parsers, handed in — this adapter imports none.
-        this.attachmentExtractors);
+        this.attachmentExtractors, this.attachmentTextBounds);
     }
     async startJobRun(tenantId, scopeId, input) {
         const rt = this.runtime(tenantId, scopeId);
@@ -3958,12 +3996,19 @@ export class SqliteScopeHost {
     async runDueJobs(tenantId, scopeId, options) {
         const rt = this.runtime(tenantId, scopeId);
         await this.applyPendingMigrations(rt);
-        // #1575: the kernel's extraction job is this host's own, bound to this scope — no
-        // deployment registers it, and none can shadow it.
-        const attachmentText = { handler: this.attachmentTextHandler(rt) };
+        // #1575: the kernel's extraction jobs are this host's own, bound to this scope — no
+        // deployment registers them, and none can shadow them. The backfill starts here, on
+        // the drive, so a scope's first request never pays for attachments that predate it.
+        await rt.actor.enqueue(() => startAttachmentTextBackfill(spineSql(rt.db), ulid(), this.clock()));
+        const kernelJobs = {
+            [ATTACHMENT_TEXT_JOB]: this.attachmentTextHandler(rt),
+            [ATTACHMENT_TEXT_BACKFILL_JOB]: attachmentTextBackfillJob({
+                queueBatch: (after) => rt.actor.enqueue(() => rt.db.transaction(() => queueAttachmentTextBackfill(spineSql(rt.db), after, ulid, this.clock()))()),
+            }),
+        };
         return runDueJobRuns({
             store: this.jobStore(rt),
-            handlerFor: (run) => isAttachmentTextRun(run) ? attachmentText : this.jobs.get(`${run.module_id}/${run.job}`),
+            handlerFor: (run) => kernelJobFor(run, kernelJobs) ?? this.jobs.get(`${run.module_id}/${run.job}`),
             now: this.clock,
             openScope: (run) => this.getSystemScope(run.module_id, tenantId, scopeId),
             maxPasses: options?.maxPasses,
@@ -3983,15 +4028,10 @@ export class SqliteScopeHost {
         // Cloudflare one does; the context build is the same one `dispatchExecutors` hands
         // an in-process connector.
         const rt = this.runtime(tenantId, scopeId);
-        this.causedBy = event.id;
-        try {
-            // `false`: this path deliberately does NOT enqueue, so nothing is held and
-            // the connection's reads take an ordinary serialized turn.
-            await handler(this.connectorContext(rt, options?.timeoutMs ?? 30_000, false, event.id), event);
-        }
-        finally {
-            this.causedBy = null;
-        }
+        // `false`: this path deliberately does NOT enqueue, so nothing is held and
+        // the connection's reads take an ordinary serialized turn. Built on a view bound to
+        // the event, so its admin rows carry it and nothing else the host serves does (#2055).
+        await handler(this.causedByView(event.id).connectorContext(rt, options?.timeoutMs ?? 30_000, false, event.id), event);
     }
     /**
      * The scope's own answer to "what may this connection do here" (#726 gap 1) — read
@@ -4211,16 +4251,12 @@ export class SqliteScopeHost {
                             lines.write({ ...unit, outcome: 'dead-lettered' });
                             continue;
                         }
-                        const ctx = this.operationContext(rt, asPrincipal(this.systemPrincipal), {
-                            system: mod.id,
+                        // #1237: anything this consumer emits was emitted BECAUSE of this event — where a
+                        // backwards walk used to stop. #1901: its `ctx.log` lines join this delivery's line.
+                        const ctx = this.deliveryContext(rt, asPrincipal(this.systemPrincipal), { system: mod.id }, {
+                            causedBy: event.id,
+                            invocationId: unit.invocationId,
                         });
-                        // #1237: anything this consumer emits was emitted BECAUSE of this event.
-                        // `dispatchExecutors` already did this for the admin log; the module
-                        // consumers never did, which is exactly where a backwards walk stopped.
-                        // On the runtime rather than the host — see `ScopeRuntime.causedBy`.
-                        rt.causedBy = event.id;
-                        // #1901: the handler's `ctx.log` lines join this delivery's line.
-                        rt.unitInvocationId = unit.invocationId;
                         rt.db.exec('BEGIN IMMEDIATE');
                         try {
                             await consumer.handler(ctx, event);
@@ -4244,14 +4280,6 @@ export class SqliteScopeHost {
                                 .run(event.id, mod.id, new Date().toISOString(), String(err), invocationId);
                             lines.write({ ...unit, outcome: 'dead-lettered', error: err });
                         }
-                        finally {
-                            rt.unitInvocationId = null;
-                            // Cleared on BOTH paths. Left set, the id would leak onto every later
-                            // emit in this scope — an operation's own event stamped as caused by
-                            // whatever happened to be delivered last, which is worse than no cause
-                            // at all, because it reads as a recorded fact.
-                            rt.causedBy = null;
-                        }
                     }
                 }
             }
@@ -4532,6 +4560,14 @@ export class SqliteScopeHost {
             throw new Error(`connection not found: ${id}`);
         return row;
     }
+    /**
+     * A findings mutation (#1748) and the audit rows it hands back, in ONE directory transaction:
+     * an audit write that fails rolls the mutation back, so no verdict, rule or stale resolution
+     * stands without its row.
+     */
+    auditedFindings(actor, run) {
+        return this.directory.transaction(() => run(redactionSqlOf(this.directory), (a) => this.recordAdmin(actor, a.action, a.target, a.before, a.after)))();
+    }
     recordAdmin(actor, action, target, before, after, 
     /** When the row says it happened; the wall clock unless the write took its time elsewhere (#1184). */
     at = new Date().toISOString()) {
@@ -4539,7 +4575,9 @@ export class SqliteScopeHost {
             .prepare(`INSERT INTO _substrat_admin_log
            (id, actor, action, tenant_id, scope_id, vertical, before, after, caused_by, on_behalf_of, at)
          VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`)
-            .run(ulid(), actor, action, target.tenantId ?? null, target.scopeId ?? null, target.vertical ?? null, before == null ? null : JSON.stringify(before), after == null ? null : JSON.stringify(after), this.causedBy, 
+            .run(ulid(), actor, action, target.tenantId ?? null, target.scopeId ?? null, target.vertical ?? null, before == null ? null : JSON.stringify(before), after == null ? null : JSON.stringify(after), 
+        // #2055: like `onBehalfOf`, set only on a view, never on the host itself.
+        this.causedBy, 
         // #977: set only on an attributed view (`attributed`), never on the host itself.
         this.onBehalfOf === null ? null : JSON.stringify(this.onBehalfOf), at);
     }
@@ -4562,8 +4600,12 @@ export class SqliteScopeHost {
             .all(tenantId).map((r) => ({ key: r.entitlement_key, expired: r.expires_at !== null && r.expires_at <= now }));
     }
     /** #977: this host, with every admin row it writes naming who the actor acted for. */
-    attributed(onBehalfOf) {
-        return attributedHost(this, onBehalfOf, this.buildAdmin);
+    attributed(onBehalfOf, options) {
+        return attributedView(this, { onBehalfOf, causedBy: options?.causedBy }, this.buildAdmin);
+    }
+    /** #2055: this host, with every admin row it writes naming `eventId` as its cause. */
+    causedByView(eventId) {
+        return attributedView(this, { causedBy: eventId }, this.buildAdmin);
     }
     buildAdmin() {
         // #977: an admin whose audit rows say on whose behalf it acts. Built over a VIEW of this
@@ -4808,6 +4850,13 @@ export class SqliteScopeHost {
             const { tenantId } = assignment.node;
             return revokeAndFence(tenantId, assignment.principalId, `role:${assignment.roleKey}`, `tenant:${tenantId}`, (at) => this.recordAdmin(actor, 'unassignRole', { tenantId, scopeId: null }, assignment, null, at));
         };
+        // An org membership written or tombstoned with its audit row — `addMember` and `removeMember`,
+        // and the membership executor's unit (#2047), one spelling each. Leaving raises the fence too.
+        const joinOrg = (actor, tenantId, principal, orgId, expiresAt) => {
+            writeTenantTuple(tenantId, `principal:${principal}`, 'member', `org:${orgId}`, expiresAt);
+            this.recordAdmin(actor, 'addMember', { tenantId }, null, memberAddedAudit(principal, orgId, expiresAt));
+        };
+        const leaveOrgAndFence = (actor, tenantId, principal, orgId) => revokeAndFence(tenantId, principal, 'member', `org:${orgId}`, (at) => this.recordAdmin(actor, 'removeMember', { tenantId }, { principal, orgId }, null, at));
         // The tenant-level reads the checker makes, synchronous, for the bound inside a unit.
         const directoryReader = directoryTenantReader({
             directory: this.directory,
@@ -6444,14 +6493,13 @@ export class SqliteScopeHost {
                 this.recordAccess(actor, 'getOrg', { tenantId }, { orgId }, o ? 1 : 0);
                 return o;
             },
-            addMember: async (actor, tenantId, principal, orgId) => {
+            addMember: async (actor, tenantId, principal, orgId, opts) => {
                 requireOrg(tenantId, orgId);
                 // INSERT OR REPLACE, so re-adding a revoked member clears the tombstone —
                 // they are a member again. The add/revoke history is not lost: it lives in
                 // the append-only admin log, which is where "what happened" belongs. The
                 // tuple carries "what is true now" plus enough to explain a live proof.
-                writeTenantTuple(tenantId, `principal:${principal}`, 'member', `org:${orgId}`);
-                this.recordAdmin(actor, 'addMember', { tenantId }, null, { principal, orgId });
+                joinOrg(actor, tenantId, principal, orgId, opts?.expiresAt ?? null);
             },
             applyMembership: async (actor, change) => {
                 // ONE directory transaction, synchronous throughout (#1184): the fence (an add's), the
@@ -6473,10 +6521,24 @@ export class SqliteScopeHost {
                     const bound = tenantCoverage(directoryReader, tenantId, boundedBy, role.permissions);
                     if (!bound.covered)
                         return { applied: false, missing: bound.missing };
-                    if (change.op === 'remove')
-                        return { applied: true, changed: revokeTenantRoleAndFence(actor, assignment) };
+                    // #2047: the org, bounded by `boundedBy`'s own live membership of it.
+                    const { orgId } = change;
+                    const org = orgId ? { orgId, ...orgChangeBound(directoryReader, tenantId, { ...change, orgId }) } : undefined;
+                    if (org) {
+                        if (!readOrg(tenantId, org.orgId))
+                            return { applied: false, unknownOrg: org.orgId };
+                        if (!org.bounded)
+                            return { applied: false, notMember: org.orgId };
+                    }
+                    if (change.op === 'remove') {
+                        const roleTaken = revokeTenantRoleAndFence(actor, assignment);
+                        const orgLeft = !!org && leaveOrgAndFence(actor, tenantId, principal, org.orgId);
+                        return { applied: true, changed: roleTaken || orgLeft };
+                    }
                     writeTenantTuple(tenantId, `principal:${principal}`, `role:${roleKey}`, `tenant:${tenantId}`);
                     this.recordAdmin(actor, 'assignRole', { tenantId, scopeId: null }, null, assignment);
+                    if (org?.bounded)
+                        joinOrg(actor, tenantId, principal, org.orgId, org.expiresAt);
                     return { applied: true };
                 })();
             },
@@ -6485,12 +6547,12 @@ export class SqliteScopeHost {
                 // Tombstone (K-21), never DELETE: a repeat revoke neither moves the timestamp nor writes
                 // a second audit row. One transaction with the removal fence (#1184), which a no-op
                 // raises too.
-                this.directory.transaction(() => revokeAndFence(tenantId, principal, 'member', `org:${orgId}`, (at) => this.recordAdmin(actor, 'removeMember', { tenantId }, { principal, orgId }, null, at)))();
+                this.directory.transaction(() => leaveOrgAndFence(actor, tenantId, principal, orgId))();
             },
             listMembers: async (actor, tenantId, orgId, options) => {
                 requireOrg(tenantId, orgId);
                 const rows = this.directory
-                    .prepare(`SELECT subject, revoked_at FROM _substrat_tenant_tuples
+                    .prepare(`SELECT subject, revoked_at, expires_at FROM _substrat_tenant_tuples
              WHERE tenant_id = ? AND relation = 'member' AND object = ?
              ${options?.includeRevoked ? '' : 'AND revoked_at IS NULL'}
              ORDER BY subject`)
@@ -6500,6 +6562,7 @@ export class SqliteScopeHost {
                     principal: r.subject.slice('principal:'.length),
                     orgId,
                     revokedAt: r.revoked_at,
+                    expiresAt: r.expires_at,
                 }));
             },
             createTenant: async (actor, input) => {
@@ -7089,6 +7152,8 @@ export class SqliteScopeHost {
                     '_substrat_membership_fences', // #1184: the latest removal, per principal
                     '_substrat_peer_switches', // #2029: the peer switch's record, per scope
                     '_substrat_switch_owed', // #2045: subjects owed a re-assert, per scope
+                    '_substrat_findings', // #1748: the tenant's findings
+                    '_substrat_finding_rules', // #1748: the tenant's suppress rules
                 ];
                 const clear = this.directory.transaction(() => {
                     for (const table of tables) {
@@ -7590,6 +7655,11 @@ export class SqliteScopeHost {
                 const { tenantId, scopeId, ...after } = ownerTransferAudit.parse(entry);
                 this.recordAdmin(actor, 'transferOwner', { tenantId, scopeId }, null, after);
             },
+            /** #1150: one phase of a dashboard member change, written around the vertical's own. */
+            recordMemberChange: async (actor, entry) => {
+                const { tenantId, scopeId, ...after } = memberChangeAudit.parse(entry);
+                this.recordAdmin(actor, 'manageScopeMember', { tenantId, scopeId }, null, after);
+            },
             /** #2005: one change to a scope's copy marker, written around the vertical's own change. */
             recordCopyMark: async (actor, entry) => {
                 const { tenantId, scopeId, action, ...after } = copyMarkAudit.parse(entry);
@@ -7732,40 +7802,49 @@ export class SqliteScopeHost {
             recordOpsFailure: async (entry) => {
                 const at = new Date().toISOString();
                 const fingerprint = opsFailureFingerprint(entry);
-                this.directory
-                    .prepare(`INSERT INTO _substrat_ops_failures
-               (id, actor, operation, stage, tenant_id, scope_id, vertical, version, status, message, reference, origin, code, fingerprint, at)
-             VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`)
-                    .run(ulid(), entry.actor, entry.operation, entry.stage ?? null, entry.tenantId ?? null, entry.scopeId ?? null, entry.vertical ?? null, entry.version ?? null, entry.status ?? null, 
-                // Bounded here, not trusted from the catch site: one runaway upstream
-                // body must not become a runaway directory row (#559).
-                entry.message.slice(0, 2000), entry.reference ?? null, entry.origin ?? null, entry.code ?? null, fingerprint, at);
-                // Prune-on-write (#559): retention lives here, not in a cron — every insert
-                // pays for its own housekeeping, so the table stays bounded even where no
-                // scheduled pass runs (this adapter has none).
-                const horizon = new Date(Date.now() - OPS_FAILURE_RETENTION_DAYS * 86_400_000).toISOString();
-                this.directory.prepare('DELETE FROM _substrat_ops_failures WHERE at < ?').run(horizon);
-                // The issues materialization (#1233): the group's counters live on their
-                // own row, bumped in the same call, because the evidence self-prunes above
-                // and a count must survive its own exemplars. A fresh arrival regresses a
-                // resolved issue; an ignored one stays ignored — that is what ignoring means.
-                this.directory
-                    .prepare(`INSERT INTO _substrat_issues
-               (fingerprint, operation, stage, origin, code, status, seen_count, first_seen, last_seen, last_message, last_tenant_id, last_owner_kind, last_vertical, last_version, resolved_version, resolved_at)
-             VALUES (?, ?, ?, ?, ?, 'new', 1, ?, ?, ?, ?, ?, ?, ?, NULL, NULL)
-             ON CONFLICT (fingerprint) DO UPDATE SET
-               seen_count = seen_count + 1,
-               last_seen = excluded.last_seen,
-               last_message = excluded.last_message,
-               last_tenant_id = excluded.last_tenant_id,
-               last_owner_kind = excluded.last_owner_kind,
-               last_vertical = COALESCE(excluded.last_vertical, last_vertical),
-               last_version = COALESCE(excluded.last_version, last_version),
-               origin = COALESCE(excluded.origin, origin),
-               status = CASE WHEN status = 'resolved' THEN 'regressed' ELSE status END`)
-                    .run(fingerprint, entry.operation, entry.stage ?? null, entry.origin ?? null, entry.code ?? null, at, at, entry.message.slice(0, 2000), entry.tenantId ?? null, issueExemplarOwner(entry.tenantId ?? null), entry.vertical ?? null, entry.version ?? null);
-                const issueHorizon = new Date(Date.now() - ISSUE_RETENTION_DAYS * 86_400_000).toISOString();
-                this.directory.prepare('DELETE FROM _substrat_issues WHERE last_seen < ?').run(issueHorizon);
+                // #1748: the evidence, its issue and its finding in ONE transaction — a detector that
+                // throws takes the evidence with it, so the caller's retry observes it rather than finding
+                // the row already there and the observation lost.
+                this.directory.transaction(() => {
+                    this.directory
+                        .prepare(`INSERT INTO _substrat_ops_failures
+                 (id, actor, operation, stage, tenant_id, scope_id, vertical, version, status, message, reference, origin, code, fingerprint, at)
+               VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`)
+                        .run(ulid(), entry.actor, entry.operation, entry.stage ?? null, entry.tenantId ?? null, entry.scopeId ?? null, entry.vertical ?? null, entry.version ?? null, entry.status ?? null, 
+                    // Bounded here, not trusted from the catch site: one runaway upstream
+                    // body must not become a runaway directory row (#559).
+                    entry.message.slice(0, 2000), entry.reference ?? null, entry.origin ?? null, entry.code ?? null, fingerprint, at);
+                    // Prune-on-write (#559): retention lives here, not in a cron — every insert
+                    // pays for its own housekeeping, so the table stays bounded even where no
+                    // scheduled pass runs (this adapter has none).
+                    const horizon = new Date(Date.now() - OPS_FAILURE_RETENTION_DAYS * 86_400_000).toISOString();
+                    this.directory.prepare('DELETE FROM _substrat_ops_failures WHERE at < ?').run(horizon);
+                    // The issues materialization (#1233): the group's counters live on their
+                    // own row, bumped in the same call, because the evidence self-prunes above
+                    // and a count must survive its own exemplars. A fresh arrival regresses a
+                    // resolved issue; an ignored one stays ignored — that is what ignoring means.
+                    this.directory
+                        .prepare(`INSERT INTO _substrat_issues
+                 (fingerprint, operation, stage, origin, code, status, seen_count, first_seen, last_seen, last_message, last_tenant_id, last_owner_kind, last_vertical, last_version, resolved_version, resolved_at)
+               VALUES (?, ?, ?, ?, ?, 'new', 1, ?, ?, ?, ?, ?, ?, ?, NULL, NULL)
+               ON CONFLICT (fingerprint) DO UPDATE SET
+                 seen_count = seen_count + 1,
+                 last_seen = excluded.last_seen,
+                 last_message = excluded.last_message,
+                 last_tenant_id = excluded.last_tenant_id,
+                 last_owner_kind = excluded.last_owner_kind,
+                 last_vertical = COALESCE(excluded.last_vertical, last_vertical),
+                 last_version = COALESCE(excluded.last_version, last_version),
+                 origin = COALESCE(excluded.origin, origin),
+                 status = CASE WHEN status = 'resolved' THEN 'regressed' ELSE status END`)
+                        .run(fingerprint, entry.operation, entry.stage ?? null, entry.origin ?? null, entry.code ?? null, at, at, entry.message.slice(0, 2000), entry.tenantId ?? null, issueExemplarOwner(entry.tenantId ?? null), entry.vertical ?? null, entry.version ?? null);
+                    const issueHorizon = new Date(Date.now() - ISSUE_RETENTION_DAYS * 86_400_000).toISOString();
+                    this.directory.prepare('DELETE FROM _substrat_issues WHERE last_seen < ?').run(issueHorizon);
+                    // #1748: the tenant's Recurring finding, over the tenant's own occurrences only.
+                    const finding = findingOfOpsFailure(entry);
+                    if (finding)
+                        observeFinding(redactionSqlOf(this.directory), finding, at);
+                })();
             },
             listOpsFailures: async (actor, filter) => {
                 const where = [];
@@ -7847,19 +7926,30 @@ export class SqliteScopeHost {
                 }));
             },
             recordSweepRun: async (entry) => {
-                this.directory
-                    .prepare(`INSERT OR IGNORE INTO _substrat_sweep_runs
-               (id, kind, unit, outcome, tenant_id, scope_id, vertical, version, operation,
-                connection_id, error, elapsed_ms, request_id, event_type, observed_at, platform_requests, at)
-             VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`)
-                    .run(ulid(), entry.kind, entry.unit, entry.outcome, entry.tenantId ?? null, entry.scopeId ?? null, entry.vertical ?? null, entry.version ?? null, entry.operation ?? null, entry.connectionId ?? null, 
-                // Bounded here, not trusted from the sweep: one runaway provider body
-                // must not become a runaway directory row (the #559 rule).
-                entry.error == null ? null : entry.error.slice(0, 2000), entry.elapsedMs ?? null, entry.requestId ?? null, entry.eventType ?? null, entry.observedAt ?? null, entry.platformRequests == null ? null : JSON.stringify(entry.platformRequests), entry.at ?? new Date().toISOString());
-                // Prune-on-write, like ops failures and for the same reason: the table stays
-                // bounded even on a deployment whose scheduled pass is broken.
-                const horizon = new Date(Date.now() - SWEEP_RUN_RETENTION_DAYS * 86_400_000).toISOString();
-                this.directory.prepare('DELETE FROM _substrat_sweep_runs WHERE at < ?').run(horizon);
+                const at = entry.at ?? new Date().toISOString();
+                // #1748: the row and its finding in ONE transaction. A replayed drain the unique index
+                // ignores observes nothing, which is right only because the first arrival's observation
+                // committed with it, or did not commit at all.
+                this.directory.transaction(() => {
+                    const { changes } = this.directory
+                        .prepare(`INSERT OR IGNORE INTO _substrat_sweep_runs
+                 (id, kind, unit, outcome, tenant_id, scope_id, vertical, version, operation,
+                  connection_id, error, elapsed_ms, request_id, event_type, observed_at, platform_requests, at)
+               VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`)
+                        .run(ulid(), entry.kind, entry.unit, entry.outcome, entry.tenantId ?? null, entry.scopeId ?? null, entry.vertical ?? null, entry.version ?? null, entry.operation ?? null, entry.connectionId ?? null, 
+                    // Bounded here, not trusted from the sweep: one runaway provider body
+                    // must not become a runaway directory row (the #559 rule).
+                    entry.error == null ? null : entry.error.slice(0, 2000), entry.elapsedMs ?? null, entry.requestId ?? null, entry.eventType ?? null, entry.observedAt ?? null, entry.platformRequests == null ? null : JSON.stringify(entry.platformRequests), at);
+                    // Prune-on-write, like ops failures and for the same reason: the table stays
+                    // bounded even on a deployment whose scheduled pass is broken.
+                    const horizon = new Date(Date.now() - SWEEP_RUN_RETENTION_DAYS * 86_400_000).toISOString();
+                    this.directory.prepare('DELETE FROM _substrat_sweep_runs WHERE at < ?').run(horizon);
+                    // #1748: a failed schedule (Invariant) or a stale freshness verdict (Drift). Only when the
+                    // row was written: a replayed drain the unique index ignored is not a second occurrence.
+                    const finding = changes > 0 ? findingOfSweepRun(entry) : null;
+                    if (finding)
+                        observeFinding(redactionSqlOf(this.directory), finding, at);
+                })();
             },
             listSweepRuns: async (actor, filter) => {
                 const where = [];
@@ -7929,6 +8019,8 @@ export class SqliteScopeHost {
                 }
                 return pruned;
             },
+            // #1748: one transaction, so a stale resolution never lands without its audit row.
+            pruneFindings: async (actor, limit) => this.auditedFindings(actor, (sql, audit) => pruneFindings(sql, Date.now(), limit, audit)),
             listIssues: async (actor, filter) => {
                 const where = [];
                 const params = [];
@@ -7973,6 +8065,25 @@ export class SqliteScopeHost {
                 this.recordAdmin(actor, 'setIssueStatus', { tenantId: null, vertical: after.lastVertical }, { fingerprint, status: existing.status }, { fingerprint, status: after.status });
                 return after;
             },
+            listFindings: async (actor, filter) => {
+                const rows = listFindings(redactionSqlOf(this.directory), filter);
+                this.recordAccess(actor, 'listFindings', { tenantId: filter?.tenantId ?? null }, filter, rows.length);
+                return rows;
+            },
+            // #1748: every findings mutation runs in ONE transaction with its audit row (`audited`).
+            setFindingStatus: async (actor, tenantId, id, status) => this.auditedFindings(actor, (sql, audit) => setFindingStatus(sql, tenantId, id, status, new Date().toISOString(), audit))
+                ?.after,
+            createFindingRule: async (actor, tenantId, input) => {
+                const { rule, suppressed } = this.auditedFindings(actor, (sql, audit) => createFindingRule(sql, tenantId, input, actor, new Date().toISOString(), audit));
+                return { rule, suppressed: suppressed.length };
+            },
+            revokeFindingRule: async (actor, tenantId, ruleId) => this.auditedFindings(actor, (sql, audit) => revokeFindingRule(sql, tenantId, ruleId, new Date().toISOString(), audit))
+                ?.after,
+            listFindingRules: async (actor, tenantId, filter) => {
+                const rows = listFindingRules(redactionSqlOf(this.directory), tenantId, filter?.active ? new Date().toISOString() : undefined, filter?.limit);
+                this.recordAccess(actor, 'listFindingRules', { tenantId }, filter, rows.length);
+                return rows;
+            },
             recordModelUsage: async (input) => {
                 const l = input.line;
                 // INSERT OR IGNORE on the UNIQUE request id: the drain may replay a settled-then-
@@ -8314,6 +8425,10 @@ export class SqliteScopeHost {
      * can never disagree about who acted (#97). `overrideActor` remains for the
      * system-actor path, where the acting module is the honest answer.
      */
+    /** The context a consumer or an import runs in: no operation, and the delivery it is for (#2055). */
+    deliveryContext(rt, subject, overrideActor, delivery) {
+        return this.operationContext(rt, subject, overrideActor, undefined, undefined, undefined, [], undefined, delivery);
+    }
     operationContext(rt, subject, overrideActor, 
     /** #458: per-invoke tally of `ctx.requestPlatform` calls; absent for consumer dispatch. */
     signals, 
@@ -8343,7 +8458,9 @@ export class SqliteScopeHost {
      * instant its row write used, so the `capability.exercised` event's `occurredAt` and the
      * row's `last_used_at` are the same value — a second clock read could disagree.
      */
-    at = this.clock()) {
+    at = this.clock(), 
+    /** #2055: the delivery a consumer's or an import's context runs for; absent otherwise. */
+    delivery) {
         // For a connection, system, capability or peer-vertical subject this carries THAT id so
         // the type holds — it is not a person, and the event actor below says what it is instead.
         const principal = subject.id;
@@ -8351,6 +8468,7 @@ export class SqliteScopeHost {
         const relations = this.relations;
         const searchPlans = this.searchPlans;
         const listPlans = this.listPlans;
+        const statePlans = this.statePlans;
         // K-34: the checks that passed in THIS operation. The context is created per invoke
         // (see buildStub), so this accumulates one operation's authorizations; `emit` snapshots
         // whatever has passed up to that point. A system/override actor is unconditionally
@@ -8472,11 +8590,10 @@ export class SqliteScopeHost {
             // about the process, so it never rides `DomainEvent` for module code to
             // branch on; it exists for the observability joins the column serves.
             this.versionId, 
-            // #1237: whatever delivery is in flight FOR THIS SCOPE, if any — read off
-            // the runtime, not the host, because the host serves every scope at once
-            // and this context outlives an `await`. A fact about the surrounding
-            // dispatch, never envelope data module code could set or branch on.
-            rt.causedBy, 
+            // #1237: the delivery this context was built for, if any — passed in, never read
+            // off the runtime or the host (#2055). A fact about the surrounding dispatch,
+            // never envelope data module code could set or branch on.
+            delivery?.causedBy ?? null, 
             // #1237: a fact about the surrounding CALL, like the version above — never
             // envelope data module code could set or branch on.
             rt.invocationId, full.payload === undefined ? null : JSON.stringify(full.payload));
@@ -8485,7 +8602,11 @@ export class SqliteScopeHost {
             tenantId: rt.tenantId,
             scopeId: rt.scopeId,
             principal,
-            sql: guardSecrets(guardSqlLimits(scopedSql(rt.db, true)), minted),
+            sql: guardSecrets(guardSqlLimits(scopedSql(rt.db, true, statefulTablesOf(statePlans), 
+            // #119: after runtime DDL, the stateful tables must still carry what the kernel derived.
+            statePlans.size
+                ? () => assertEntityStateIntact(spineSql(rt.db), statePlans, stateListIndexNames(listPlans.values()))
+                : undefined)), minted),
             now: () => at,
             // #1746/#1747: the host stamps who and where; module code supplies only the template
             // and its fields. The invocation id is read per call — it is set for the duration of
@@ -8494,7 +8615,7 @@ export class SqliteScopeHost {
                 tenantId: rt.tenantId,
                 scopeId: rt.scopeId,
                 operation: operation ?? null,
-                invocationId: () => rt.invocationId ?? rt.unitInvocationId,
+                invocationId: () => rt.invocationId ?? delivery?.invocationId ?? null,
                 // A consumer runs under the system override, so it logs as `system`.
                 principalKind: overrideActor ? 'system' : subject.kind,
                 // The string-safe redaction: `redactSecrets` parses its serialization back, and a
@@ -8555,7 +8676,9 @@ export class SqliteScopeHost {
                 const plan = searchPlans.get(entityType);
                 if (!plan)
                     throw new NotSearchable(entityType);
-                const q = searchQuery(plan, searchMatchExpression(term, plan.tokenizer), searchLimit(options?.limit));
+                const q = searchQuery(plan, searchMatchExpression(term, plan.tokenizer), searchLimit(options?.limit), 
+                // #119: active rows unless the archive is asked for.
+                searchStateWhere(statePlans, entityType, options?.view));
                 return rt.db.prepare(q.sql).all(...q.params).map((row) => ({ entityType, id: row.id, rank: row.rank }));
             },
             /**
@@ -8576,13 +8699,15 @@ export class SqliteScopeHost {
                     order: params.order,
                     cursor: params.cursor,
                     filters: params.filters,
+                    // #119: the bin is the checked reader's, never this one's.
+                    view: uncheckedView('ctx.page', entityType, params.view),
                 });
                 const rows = rt.db.prepare(q.sql).all(...q.params);
                 // A FULL page may have more; a short one is the end of the walk. Same rule
                 // as `pageOf`, applied here because the cursor is a COLUMN's value (plus
                 // the tie-break) rather than a field the caller could name.
                 const last = rows.length >= limit ? rows[rows.length - 1] : undefined;
-                const nextCursor = last === undefined ? null : cursorOf(last, q.sortColumn, plan.idColumn, q.order);
+                const nextCursor = last === undefined ? null : cursorOf(last, q.sortColumn, plan.idColumn, q.order, q.view);
                 const page = { entries: rows, nextCursor };
                 if (!params.total)
                     return page;
@@ -8661,6 +8786,24 @@ export class SqliteScopeHost {
                 emit: (event) => writeEvent(event, 'kernel'),
                 assertWrites: (verb) => assertImpersonationWrites(impersonation, verb),
             }),
+            // #119: archive and trash, written once in the kernel. The raw seam, because the guarded
+            // `ctx.sql` refuses the very columns these write; the operation's own check, so the
+            // declared key's pass is one of its authorizations.
+            ...createEntityStateVerbs({
+                sql: spineSql(rt.db),
+                plans: statePlans,
+                now: at,
+                check: runCheck,
+                emit: (event) => writeEvent(event, 'kernel'),
+                assertWrites: (verb) => assertImpersonationWrites(impersonation, verb),
+            }),
+            ...createTrashedReads({
+                query: (q, params) => rt.db.prepare(q).all(...params),
+                listPlans,
+                searchPlans,
+                statePlans,
+                check: runCheck,
+            }),
             // #304: the request-time entitlement read. The pure adapter is single-process, so the
             // directory is local — no projection needed; it reads `_substrat_entitlements` straight,
             // with the same expiry-at-read filter as the gate (#33), and the SAME contract the DO
@@ -9049,9 +9192,7 @@ export class SqliteScopeHost {
             actor: new ScopeActor(),
             appliedMigrations,
             mintEventId,
-            causedBy: null,
             invocationId: null,
-            unitInvocationId: null,
         };
         this.scopes.set(key, created);
         this.scopesById.set(scopeId, created);
@@ -9116,7 +9257,11 @@ function assertTablesWithinColumnLimit(db) {
     if (wide)
         throw new Error(tooManyTableColumns(wide.name, wide.width));
 }
-function scopedSql(db, judgeWidth = false) {
+function scopedSql(db, judgeWidth = false, 
+/** #119: the module tables carrying archive/trash columns — `guardSpine` refuses positional writes to them. */
+statefulTables, 
+/** #119: the kernel's integrity check, run after any runtime DDL — see `guardSpine`. */
+afterDdl) {
     // #1811: a Durable Object refuses a result set over its column cap, `exec` of a SELECT included.
     // The driver knows the width, so it is read off the prepared statement rather than parsed out
     // of the text (a `SELECT *` is as wide as the tables under it). Module SQL only, like the
@@ -9143,7 +9288,7 @@ function scopedSql(db, judgeWidth = false) {
                 assertTablesWithinColumnLimit(db);
             return { changes: info.changes };
         },
-    });
+    }, statefulTables, afterDdl);
 }
 const schemaVersion = (db) => db.pragma('schema_version', { simple: true });
 //# sourceMappingURL=index.js.map