@substrat-run/adapter-sqlite 0.139.0 → 0.141.0

package/dist/index.js

@@ -1,11 +1,14 @@
-import { existsSync, mkdirSync, readdirSync, readFileSync, rmSync, writeFileSync } from 'node:fs';
+import { existsSync, mkdirSync, readdirSync, readFileSync, realpathSync, rmSync, writeFileSync } from 'node:fs';
 import { dirname, join } from 'node:path';
 import Database from 'better-sqlite3';
-import { accessLogEntry, adminLogEntry, delegatedReadParams, operationSeriesCount, opsFailureEntry, opsFailureFingerprint, issueEntry, FRESHNESS_HEARTBEAT_MINUTES, sweepRunEntry, modelUsageEntry, ATTACHMENT_ADDED, ATTACHMENT_REMOVED, attachmentRecord, createTenantInput, domainEvent, domainEventInput, exportReadInput, importBatch, importCursorMove, exportsOfManifestJson, importsOfManifestJson, entitlementGrant, entitlementGrantInput, eventId, meterReading, platformRequestInput, platformRequestId, MAX_PENDING_PLATFORM_REQUESTS, identityLink, identityPool, instant, connection, capabilityGrant, connectionGrant, connectionGrantRecord, connectionSecret, systemGrant, systemSwitch, systemSwitchRecord, peerSwitch, verticalCaller, verticalSlug as verticalSlugOf, subjectRef, requestFingerprint, createConnectionInput, projectedConnectionGrant, projectedConnectionKey, moduleManifest, createOrgInput, promotionAcknowledgement, bindAcknowledgement, bindHostnameInput, channelHistoryEntry, hostnameBinding, publishVersionInput, AUTO_ADMISSION_NOTE, routeTarget, ROUTE_SCOPE_HOSTNAMES_MAX, registerVerticalInput, vertical as verticalSchema, verticalChannel, verticalVersion, objectRef, entityObjectRef, assertModuleEmittableType, assertKernelAuthoredType, grantRefFromProof, org as orgSchema, orgMembership, principalId, resolvedIdentity, identityMembership, roleDefinition, scope as scopeSchema, tenant as tenantSchema, tenantRole, subjectShredReceipt, SCOPE_TABLE_PAGE_DEFAULT, SCOPE_TABLE_PAGE_MAX, SCOPE_QUERY_ROW_MAX, verticalServingState, callsOfManifestJson, outboundOfManifestJson, listLimitOf, SCOPE_GATE_REASONS, substratError, assertReplayableDump, delegatedReadRecord, ownerTransferAudit, memberChangeAudit, copyMarkAudit, redrainEventsInput, REDRAIN_BATCH, } from '@substrat-run/contracts';
-import { actorOf, asPrincipal, assertAllowed, assertNoSecret, assertPermissionKey, CAPABILITY_DDL, COPY_ORIGIN_DDL, ENTITY_STATE_MOVES_DDL, CAPABILITY_EXCHANGE_OPERATION, capabilityAttachmentWriteRefused, capabilityTokenHash, createCapabilityVerbs, createEntityEdgeVerbs, createEntityStateVerbs, createTrashedReads, searchStateWhere, uncheckedView, addStatePlans, entityStateMigrations, entityStateTriggerDdl, statefulTablesOf, assertEntityStateIntact, stateListIndexNames, exchangeCapability as exchangeCapabilitySecret, guardSecrets, mintBecomeCapability, plausibleSessionToken, readCapabilityPage, redactSecrets, redactSecretText, moduleLog, consoleLogSink, asyncInvocationId, asyncLinePass, consoleInvocationLineSink, resolveCapabilitySession, revokeCapabilityAsPlatform, assertReadOnlyQuery, attachmentBlobKey, attachmentSha256, entitlementDenial, requiredEntitlementFor, foldMeterReading, guardSpine, guardSqlLimits, DO_SQL_LIMITS, tooManyResultColumns, tooManyTableColumns, parseValidationRecords, resolveScopeRecord, ulid, ISSUE_RETENTION_DAYS, telemetryRetentionStatements, FINDINGS_DDL, createFindingRule, findingOfOpsFailure, findingOfSweepRun, pruneFindings, listFindingRules, listFindings, observeFinding, revokeFindingRule, setFindingStatus, assertRowLimit, assertRowOffset, OPS_FAILURE_RETENTION_DAYS, SWEEP_RUN_RETENTION_DAYS, SWEEP_RUNS_INTENT_INDEX, sweepRunsIntentHasKind, MODEL_USAGE_RETENTION_DAYS, foldModelUsage, backoffAt, platformRequestHistoryQuery, platformRequestOf, PLATFORM_REQUEST_COLUMNS, PLATFORM_REQUEST_REDACTION_SQL, platformRequestRedactionParams, platformRequestRedactionQuery, intentPayloadCarriesSubject, redactSubjectJobRuns, redactSubjectScopeText, redactSubjectDirectoryText, ISSUE_EXEMPLAR_OWNER_BACKFILL_SQL, issueExemplarOwner, JOB_RUN_PATCH_SQL, JOB_RUN_CLAIM_SQL, JOB_RUN_RENEW_SQL, JOB_RUN_BEGIN_SQL, JOB_RUN_MISS_SQL, JOB_RUN_MISS_SETTLE_SQL, admissionMissOutcome, JOB_STEP_RECORD_SQL, JOB_LEASE_EXPIRED_NOTE, assertLeaseMs, DELIVERY_ERROR_REDACTION_SQL, REDACTED_DELIVERY_NOTE, seatScopeTuple, applyScopeRoleChange, changeScopeRole, revokeScopeRoles, scopeRoleHolders, admitPeer, collectPeers, peerSeats, resolveVerticalInstanceFrom, peerGrantsStatus, systemGrantsStatus, systemScheduleState, systemSwitchedOff, systemSwitchedOffMessage, tenantSystemSwitchedOffMessage, PEER_SWITCHES_DDL, SWITCH_OWED_DDL, SWITCH_FENCES_DDL, recordWriteSuperseded, switchFencesOf, switchSupersededMessage, SWITCH_KINDS, SYSTEM_SWITCHES_DDL, forgetSwitchesOf, listSystemSwitchRecords, moveSwitch, reassertActionOf, reassertEntry, reassertOffRow, recordSwitchedOff, recordSwitchedOn, restoreSwitchRecord, scopesSwitchedOffFor, switchActionOf, switchAuditSubject, switchNotFoundMessage, switchRecordsOf, switchedOffOf, switchesBackfillSqlOf, switchesTableExists, tenantHeldOf, tenantHoldsGrant, inUnitMovesToAudit, staleCarryRevertRow, staleCarryReverts, withRecorded, VERSION_MIGRATIONS_DDL, splitManifestMigrations, splitVersionMigrationsBatch, versionMigrationsOf, writeVersionMigrations, denialListQuery, refusalListQuery, mapRefusalRow, denialSummaryQuery, denialTotalsQuery, DENIAL_WINDOW_QUERY, mapDenialRow, mapDenialSummaryBuckets, IMPERSONATION_COLUMNS, IMPERSONATION_DDL, ImpersonationRefused, assertImpersonationWrites, assertModuleEnqueueableKind, assertSessionUsable, impersonationByIdQuery, impersonationListQuery, impersonationRowValues, impersonationStampOf, mapImpersonationRow, newImpersonationSession, resolveRetryPolicy, executorOutcomeOf, isDeliveryRefusal, refusalJournalText, membershipFencesBackfillSql, MEMBERSHIP_FENCES_DDL, membershipFencesTableExists, MEMBERSHIP_FENCE_SINCE_SQL, RAISE_MEMBERSHIP_FENCE_SQL, memberAddedAudit, orgChangeBound, tenantCoverage, isSecretBoxConfigured, unconfiguredSecretBox, createSubjectKeys, generateSealingKeyPair, noSealingKeyMessage, openSealed, sealTo, ConnectionSealingKeyUnavailableError, PermissionDenied, createAtomic, NotSearchable, NotListable, listIndexDdl, listIndexMigrations, listIndexPlans, listQuery, cursorOf, moduleMigrations, isSearchIndexTable, searchIndexDdl, searchIndexMigrations, searchIndexPlans, searchLimit, searchMatchExpression, searchQuery, ATTACHMENT_TEXT_DDL, assertAttachmentExtractors, resolveAttachmentTextBounds, assertJobRegistrable, attachmentRecordOfRow, attachmentTextJob, enqueueAttachmentText, ATTACHMENT_TEXT_BACKFILL_JOB, ATTACHMENT_TEXT_JOB, kernelJobFor, queueAttachmentTextBackfill, startAttachmentTextBackfill, attachmentTextBackfillJob, reconcileAttachmentText, recordAttachmentText, searchAttachments, entityVersionQuery, entityVersionOf, assertIfMatch, OUTBOX_ENTITY_INDEX, SCHEDULE_STATE_DDL, SCHEDULE_STATE_REBUILD, scheduleStateHasKind, VERTICAL_EVENTS_DDL, EXPORT_HOPS_SQL, emptyImportResult, IMPORT_CURSORS_SQL, IMPORT_CURSOR_OF_SQL, OUTBOX_MARK_SQL, emittedSinceQuery, emittedReportOf, EMITTED_REPORT_CAP, exportedSinceQuery, IMPORT_CURSOR_ADVANCE_SQL, IMPORT_RECORD_SQL, moveImportCursor, importCursorSourceOf, exportBreaksOf, exportBreakRefusal, bindExportBreaksOf, bindExportBreakRefusal, CrossVerticalRegistry, exportReadPlan, exportReadQuery, planExportBatch, withheldNote, JOB_RUN_DDL, JOB_RUN_DUE_AT, jobRunListLimit, jobRunOf, runDueJobRuns, startJobRun, IDEMPOTENCY_DDL, REFUSALS_TABLE_DDL, REFUSALS_INDEX, refusalInsert, refusalOf, markGuardRefusal, REFUSALS_REBUILD, refusalsAdmitGuards, assertIdempotencyKey, idempotencyLookupQuery, idempotencyPruneStatement, idempotencyRecordStatement, idempotencyOptedOutMessage, replayFor, globalFetch, createUlid, facetEvents, readHistory, walkEventCause, walkEventEffects, assertRedrainWindow, readInvocation, readDeadLetters, readLifecycleFlow, readOperationSeries, domainEventOf, readUndrainedOutbox, undrainedEventsOf, connectorCallRecord, noopConnectorCallRecorder, recordConnectorCall, settleConnectionUse, unknownRoleError, } from '@substrat-run/kernel';
-import { attributedView } from '@substrat-run/kernel';
+import { accessLogEntry, adminLogEntry, delegatedReadParams, operationSeriesCount, opsFailureEntry, opsFailureFingerprint, issueEntry, FRESHNESS_HEARTBEAT_MINUTES, sweepRunEntry, modelUsageEntry, ATTACHMENT_ADDED, ATTACHMENT_REMOVED, attachmentRecord, createTenantInput, domainEvent, domainEventInput, exportReadInput, importBatch, importCursorMove, exportsOfManifestJson, importsOfManifestJson, entitlementGrant, entitlementGrantInput, eventId, meterReading, platformRequestInput, platformRequestId, MAX_PENDING_PLATFORM_REQUESTS, identityLink, identityPool, instant, isSubstratError, connection, capabilityGrant, connectionGrant, connectionGrantRecord, connectionSecret, systemGrant, systemSwitch, systemSwitchRecord, peerSwitch, verticalCaller, verticalSlug as verticalSlugOf, subjectRef, requestFingerprint, createConnectionInput, connectLinkFilter, connectLinkKey, consumeConnectLinkInput, mintConnectLinkInput, projectedConnectionGrant, projectedConnectionKey, moduleManifest, createOrgInput, promotionAcknowledgement, bindAcknowledgement, bindHostnameInput, channelHistoryEntry, hostnameBinding, publishVersionInput, AUTO_ADMISSION_NOTE, routeTarget, ROUTE_SCOPE_HOSTNAMES_MAX, registerVerticalInput, vertical as verticalSchema, verticalChannel, verticalVersion, objectRef, entityObjectRef, assertModuleEmittableType, assertKernelAuthoredType, grantRefFromProof, org as orgSchema, orgMembership, principalId, resolvedIdentity, identityMembership, roleDefinition, scope as scopeSchema, tenant as tenantSchema, tenantRole, subjectShredReceipt, SCOPE_TABLE_PAGE_DEFAULT, SCOPE_TABLE_PAGE_MAX, SCOPE_QUERY_ROW_MAX, verticalServingState, callsOfManifestJson, outboundOfManifestJson, listLimitOf, pageOf, countedPageOf, SCOPE_GATE_REASONS, substratError, assertReplayableDump, delegatedReadRecord, ownerTransferAudit, memberChangeAudit, peerBindingAudit, copyMarkAudit, redrainEventsInput, REDRAIN_BATCH, } from '@substrat-run/contracts';
+import { actorOf, asPrincipal, assertAllowed, assertNoSecret, assertPermissionKey, CAPABILITY_DDL, COPY_ORIGIN_DDL, ENTITY_STATE_MOVES_DDL, CAPABILITY_EXCHANGE_OPERATION, capabilityAttachmentWriteRefused, capabilityTokenHash, createCapabilityVerbs, createEntityEdgeVerbs, createEntityStateVerbs, createTrashedReads, CONTINUATION_POSITION_CAP, visibleContinuation, searchStateWhere, uncheckedView, addStatePlans, entityStateMigrations, assertNoCallerPurge, isUnreachableParent, heldPurgePass, purgeDueOf, purgeHeldBy, lifecycleRefusal, purgeOnlyKeysOf, purgeReportOf, purgeStillDue, refuseTrashedTarget, registerTrashTargets, runPurgePass, withheldKeysFor, statefulTablesOf, afterMigration, afterRuntimeDdl, derivesAnything, repairDerivedObjects, StateColumnLost, exchangeCapability as exchangeCapabilitySecret, guardSecrets, mintBecomeCapability, plausibleSessionToken, readCapabilityPage, redactSecrets, redactSecretText, moduleLog, consoleLogSink, asyncInvocationId, asyncLinePass, consoleInvocationLineSink, resolveCapabilitySession, revokeCapabilityAsPlatform, assertReadOnlyQuery, attachmentBlobKey, attachmentSha256, entitlementDenial, requiredEntitlementFor, foldMeterReading, guardSpine, guardSqlLimits, DO_SQL_LIMITS, tooManyResultColumns, tooManyTableColumns, parseValidationRecords, resolveScopeRecord, ulid, ISSUE_RETENTION_DAYS, telemetryRetentionStatements, FINDINGS_DDL, CONNECT_LINKS_DDL, consumeConnectLinkRow, insertConnectLink, listConnectLinks as listConnectLinkRows, readConnectLink, restoreConnectLinkRow, revokeConnectLinkRow, createFindingRule, findingOfOpsFailure, findingOfSweepRun, pruneFindings, listFindingRules, listFindings, observeFinding, revokeFindingRule, setFindingStatus, assertRowLimit, assertRowOffset, OPS_FAILURE_RETENTION_DAYS, SWEEP_RUN_RETENTION_DAYS, SWEEP_RUNS_INTENT_INDEX, sweepRunsIntentHasKind, MODEL_USAGE_RETENTION_DAYS, foldModelUsage, backoffAt, platformRequestHistoryQuery, platformRequestOf, PLATFORM_REQUEST_COLUMNS, PLATFORM_REQUEST_REDACTION_SQL, platformRequestRedactionParams, platformRequestRedactionQuery, intentPayloadCarriesSubject, redactSubjectJobRuns, eraseSubjectFromModules, moduleRowsErased, moduleErasurePlan, redactSubjectScopeText, redactSubjectDirectoryText, ISSUE_EXEMPLAR_OWNER_BACKFILL_SQL, issueExemplarOwner, JOB_RUN_PATCH_SQL, JOB_RUN_CLAIM_SQL, JOB_RUN_RENEW_SQL, JOB_RUN_BEGIN_SQL, JOB_RUN_MISS_SQL, JOB_RUN_MISS_SETTLE_SQL, admissionMissOutcome, JOB_STEP_RECORD_SQL, JOB_LEASE_EXPIRED_NOTE, assertLeaseMs, DELIVERY_ERROR_REDACTION_SQL, REDACTED_DELIVERY_NOTE, seatScopeTuple, applyScopeRoleChange, changeScopeRole, revokeScopeRoles, scopeRoleHolders, admitPeer, collectPeers, peerSeats, resolveVerticalInstanceFrom, resolvePeerInstanceFrom, peerGrantsStatus, systemGrantsStatus, systemScheduleState, systemSwitchedOff, systemSwitchedOffMessage, tenantSystemSwitchedOffMessage, PEER_SWITCHES_DDL, PEER_BINDINGS_DDL, SWITCH_OWED_DDL, SWITCH_FENCES_DDL, TABLE_OWNERS_DDL, assertMigrationLeavesLedgerAlone, recordOwnershipSteps, runMigrationStatements, executableSqlStatements, blankSqlComments, recordWriteSuperseded, switchFencesOf, switchSupersededMessage, SWITCH_KINDS, SYSTEM_SWITCHES_DDL, forgetSwitchesOf, listSystemSwitchRecords, moveSwitch, reassertActionOf, reassertEntry, reassertOffRow, recordSwitchedOff, recordSwitchedOn, restoreSwitchRecord, scopesSwitchedOffFor, switchActionOf, switchAuditSubject, recordAuditOutcome, auditWarningOf, switchNotFoundMessage, switchRecordsOf, switchedOffOf, switchesBackfillSqlOf, switchesTableExists, tenantHeldOf, tenantHoldsGrant, inUnitMovesToAudit, staleCarryRevertRow, staleCarryReverts, withRecorded, VERSION_MIGRATIONS_DDL, splitManifestMigrations, splitVersionMigrationsBatch, versionMigrationsOf, writeVersionMigrations, denialListQuery, refusalListQuery, mapRefusalRow, denialSummaryQuery, denialTotalsQuery, DENIAL_WINDOW_QUERY, mapDenialRow, mapDenialSummaryBuckets, IMPERSONATION_COLUMNS, IMPERSONATION_DDL, ImpersonationRefused, assertImpersonationWrites, assertModuleEnqueueableKind, assertSessionUsable, impersonationByIdQuery, impersonationListQuery, impersonationRowValues, impersonationStampOf, mapImpersonationRow, newImpersonationSession, resolveRetryPolicy, executorOutcomeOf, isDeliveryRefusal, refusalJournalText, membershipFencesBackfillSql, MEMBERSHIP_FENCES_DDL, membershipFencesTableExists, MEMBERSHIP_FENCE_SINCE_SQL, RAISE_MEMBERSHIP_FENCE_SQL, memberAddedAudit, orgChangeBound, tenantCoverage, isSecretBoxConfigured, unconfiguredSecretBox, createSubjectKeys, generateSealingKeyPair, noSealingKeyMessage, openSealed, sealTo, ConnectionSealingKeyUnavailableError, PermissionDenied, createAtomic, NotSearchable, NotListable, listIndexMigrations, listIndexPlans, listQuery, cursorOf, moduleMigrations, MIGRATION_DIGEST_FENCE_DDL, MIGRATION_DIGEST_MARK_LEGACY, assertJournalDumpCoherent, assertMigrationSql, migrationDivergence, migrationFailedError, migrationSteps, planMigrations, isSearchIndexTable, searchIndexMigrations, searchIndexPlans, searchLimit, searchMatchExpression, searchQuery, ATTACHMENT_TEXT_DDL, assertAttachmentExtractors, resolveAttachmentTextBounds, assertJobRegistrable, attachmentRecordOfRow, attachmentTextJob, enqueueAttachmentText, ATTACHMENT_TEXT_BACKFILL_JOB, ATTACHMENT_TEXT_JOB, kernelJobFor, queueAttachmentTextBackfill, startAttachmentTextBackfill, attachmentTextBackfillJob, reconcileAttachmentText, recordAttachmentText, searchAttachments, entityVersionQuery, entityVersionOf, assertIfMatch, OUTBOX_ENTITY_INDEX, SCHEDULE_STATE_DDL, SCHEDULE_STATE_REBUILD, scheduleStateHasKind, VERTICAL_EVENTS_DDL, EXPORT_HOPS_SQL, emptyImportResult, IMPORT_CURSORS_SQL, IMPORT_CURSOR_OF_SQL, OUTBOX_MARK_SQL, emittedSinceQuery, emittedReportOf, EMITTED_REPORT_CAP, exportedSinceQuery, IMPORT_CURSOR_ADVANCE_SQL, IMPORT_RECORD_SQL, moveImportCursor, importCursorSourceOf, exportBreaksOf, exportBreakRefusal, bindExportBreaksOf, bindExportBreakRefusal, CrossVerticalRegistry, exportReadPlan, exportReadQuery, planExportBatch, withheldNote, JOB_RUN_DDL, JOB_RUN_DUE_AT, jobRunListLimit, jobRunOf, runDueJobRuns, startJobRun, IDEMPOTENCY_DDL, REFUSALS_TABLE_DDL, REFUSALS_INDEX, refusalInsert, refusalOf, markGuardRefusal, REFUSALS_REBUILD, refusalsAdmitGuards, assertIdempotencyKey, idempotencyLookupQuery, idempotencyPruneStatement, idempotencyRecordStatement, idempotencyOptedOutMessage, replayFor, globalFetch, createUlid, facetEvents, readHistory, walkEventCause, walkEventEffects, assertRedrainWindow, readInvocation, readDeadLetters, readLifecycleFlow, readOperationSeries, domainEventOf, readUndrainedOutbox, undrainedEventsOf, connectorCallRecord, noopConnectorCallRecorder, recordConnectorCall, settleConnectionUse, unknownRoleError, } from '@substrat-run/kernel';
+import { attributedView, delegatedRevokeSql, writeExplicitTupleIn, grantEntityShapeIn, shapeTopUpBatch, topUpEntityGrantShapes, settlePlatformRequestIn, } from '@substrat-run/kernel';
+import { ADMIN_LOG_INDEXES_SQL, SETTLE_INTENT_SQL, SETTLE_OUTCOME_SQL, settleOutcomeParamsOf, readAuditedOperations, unknownOutcomeOf, } from '@substrat-run/kernel';
 import { INERT_SCOPE_REASON, isPrimaryScopeRow } from '@substrat-run/kernel';
-import { LEGACY_SCOPE_ROWS_BACKFILL, assertNoSpineReference, assertSpineTablesBuilt, capabilitiesForLoad, dumpRowsInsert, isSpineTable, loadDirectoryDump, repointScopeGrants, settleCopiedWork, emittedHere, spineColumnAdditions } from '@substrat-run/kernel';
+import { COPY_CLAIM_SQL, COPY_EXPIRED_SQL, COPY_MOVE_CONFIRM_SQL, COPY_MOVE_LIVE_PREDICATE, SCOPE_COPY_LEASE_MS, SCOPE_SCRIPT_COPY_COLUMNS, copyMoveConfirmParams, copyMoveLiveParams, scopeScriptCopyOf, } from '@substrat-run/kernel';
+import { GRANT_CHILDREN_INDEX_DDL, grantedEntitiesForContext } from '@substrat-run/kernel';
+import { LEGACY_SCOPE_ROWS_BACKFILL, assertSpineTablesBuilt, capabilitiesForLoad, dumpRowsInsert, isSpineTable, loadDirectoryDump, repointScopeGrants, settleCopiedWork, emittedHere, spineColumnAdditions } from '@substrat-run/kernel';
 import { ScopeActor } from './actor.js';
 import { createTupleChecker, directoryTenantReader } from './checker.js';
 /**
@@ -244,9 +247,15 @@ const KERNEL_DDL = `
     applied_at TEXT NOT NULL,
     duration_ms INTEGER,
     rows_changed INTEGER,
+    -- #2066: SHA-256 of the SQL that ran (kernel migrationDigest). NULL on a row written
+    -- before the column: unrecorded, accepted, never backfilled.
+    sql_digest TEXT,
     PRIMARY KEY (module_id, version)
   );
+  -- #2066: no new journal row without its digest (the kernel's comment says why).
+  ${MIGRATION_DIGEST_FENCE_DDL}
   ${SWITCH_FENCES_DDL}
+  ${TABLE_OWNERS_DDL}
   CREATE TABLE IF NOT EXISTS _substrat_tuples (
     subject TEXT NOT NULL,
     relation TEXT NOT NULL,
@@ -258,6 +267,7 @@ const KERNEL_DDL = `
     revoked_at TEXT,
     PRIMARY KEY (subject, relation, object)
   );
+  ${GRANT_CHILDREN_INDEX_DDL};
   CREATE TABLE IF NOT EXISTS _substrat_deliveries (
     event_id TEXT NOT NULL,
     consumer_module TEXT NOT NULL,
@@ -470,6 +480,66 @@ const admitByDelivery = (rt, eventId, row) => {
             `the attachments of the entity its event names, and no others`);
     }
 };
+/**
+ * #119: this thread's claim on each host directory it has open, by real path — the OS lock and
+ * how many live hosts on this thread share it. Several hosts on ONE thread may share a directory
+ * (that is how the pure adapter models several verticals on one platform directory, #1705): the
+ * guarantees that read the directory and a scope's file together do so with no `await` in between,
+ * and one thread's JS runs one task at a time, so nothing it runs can interleave there. A writer on
+ * another thread or in ANOTHER process could. This map is module state, so each worker thread has
+ * its own: a second thread opens its own `_host.lock` connection, and SQLite refuses it exactly as
+ * it refuses another process.
+ */
+const PROCESS_HOST_DIRS = new Map();
+/**
+ * #119: claim a host directory for this process, for one live `SqliteScopeHost`. The first host in
+ * the process takes an exclusive lock on `_host.lock` (a SQLite file: `locking_mode = EXCLUSIVE`
+ * plus a write holds SQLite's file lock until the connection closes); later hosts in the process
+ * share it, and the last `release()` drops it. The operating system drops it when the process
+ * exits, however it exits, so it never goes stale. No busy timeout: another process's claim is
+ * refused at once — `conflict`, reason `host_dir_in_use`, naming the directory — never queued.
+ */
+function claimHostDir(dir) {
+    const key = realpathSync(dir);
+    let claim = PROCESS_HOST_DIRS.get(key);
+    if (!claim) {
+        const lock = new Database(join(key, '_host.lock'), { timeout: 0 });
+        try {
+            lock.pragma('locking_mode = EXCLUSIVE');
+            // No journal file beside the directory: the one write only takes the lock.
+            lock.pragma('journal_mode = MEMORY');
+            lock.exec('CREATE TABLE IF NOT EXISTS owner (id INTEGER PRIMARY KEY CHECK (id = 1), pid INTEGER NOT NULL, at TEXT NOT NULL)');
+            lock.prepare('INSERT OR REPLACE INTO owner (id, pid, at) VALUES (1, ?, ?)').run(process.pid, new Date().toISOString());
+        }
+        catch (err) {
+            lock.close();
+            const code = err.code;
+            if (code === 'SQLITE_BUSY' || code === 'SQLITE_LOCKED') {
+                throw substratError('conflict', `host directory already in use by another process: ${key} — one process owns a host directory`, {
+                    reason: 'host_dir_in_use',
+                });
+            }
+            throw err;
+        }
+        claim = { lock, hosts: 0 };
+        PROCESS_HOST_DIRS.set(key, claim);
+    }
+    claim.hosts += 1;
+    const held = claim;
+    let released = false;
+    return {
+        release: () => {
+            if (released)
+                return;
+            released = true;
+            held.hosts -= 1;
+            if (held.hosts > 0)
+                return;
+            PROCESS_HOST_DIRS.delete(key);
+            held.lock.close();
+        },
+    };
+}
 export class SqliteScopeHost {
     admin;
     /**
@@ -499,8 +569,39 @@ export class SqliteScopeHost {
      */
     liveReads;
     dir;
+    /** #119: this host's share of its process's claim on `dir` (`claimHostDir`), released by `close()`. */
+    owner;
     checker;
     directory;
+    /** A private directory seam: module SQL and scope/directory exports never reach it. */
+    continuationStore(scopeId, writable) {
+        const pruneExpired = () => this.directory.prepare('DELETE FROM private_continuation_positions WHERE expires_at <= ?').run(Date.parse(this.clock()));
+        return {
+            keys: async () => {
+                const row = this.directory.prepare('SELECT keyring FROM private_continuation_keys WHERE scope_id = ?').get(scopeId);
+                return row ? JSON.parse(row.keyring) : null;
+            },
+            setKeys: async (keys) => {
+                this.directory.prepare(`INSERT INTO private_continuation_keys (scope_id, keyring) VALUES (?, ?)
+           ON CONFLICT(scope_id) DO UPDATE SET keyring = excluded.keyring`).run(scopeId, JSON.stringify(keys));
+            },
+            position: async (id, expiresAt) => {
+                if (writable)
+                    pruneExpired();
+                const row = this.directory.prepare(`SELECT ciphertext FROM private_continuation_positions
+           WHERE scope_id = ? AND expires_at = ? AND locator = ?`).get(scopeId, expiresAt, id);
+                return row ? { sealed: JSON.parse(row.ciphertext), expiresAt } : null;
+            },
+            setPosition: async (id, position) => {
+                pruneExpired();
+                this.directory.prepare(`INSERT INTO private_continuation_positions (scope_id, expires_at, locator, ciphertext)
+           VALUES (?, ?, ?, ?)`).run(scopeId, position.expiresAt, id, JSON.stringify(position.sealed));
+                this.directory.prepare(`DELETE FROM private_continuation_positions WHERE rowid IN (
+             SELECT rowid FROM private_continuation_positions WHERE scope_id = ?
+             ORDER BY rowid DESC LIMIT -1 OFFSET ?)`).run(scopeId, CONTINUATION_POSITION_CAP);
+            },
+        };
+    }
     scopes = new Map();
     scopesById = new Map();
     /** The runtimes holding an open `reader` (#1624), least recently read first — `READER_CAP`'s LRU. */
@@ -526,6 +627,8 @@ export class SqliteScopeHost {
     listPlans = new Map();
     /** #119: entity type → its archive/trash plan, from every registered module. */
     statePlans = new Map();
+    /** #2068: each registered module's erasure, in registration order — what `shredSubject` runs. */
+    erasurePlans = [];
     /** entityType → the declared attachment gate (#473): read key + write key (default: read). */
     attachmentTargets = new Map();
     /** operation name → who binds it: the owning module, its entitlementKey and its declared
@@ -544,6 +647,11 @@ export class SqliteScopeHost {
      * a bare `defineOperation` carries no declaration to read one off.
      */
     operationConcurrency = new Map();
+    /**
+     * #119: name → the entity the operation addresses by id, its declared key and whether it
+     * reaches a trashed one — what the host's trash refusal reads. Populated by `registerModule`.
+     */
+    operationTarget = new Map();
     /**
      * #116: the operations that declared `idempotency: false` — a set of refusals,
      * because that is what the declaration is. Every name NOT in here honours an
@@ -603,24 +711,43 @@ export class SqliteScopeHost {
         this.versionId = options.versionId ?? null;
         this.logSink = options.logSink ?? consoleLogSink;
         this.invocationLineSink = options.invocationLineSink ?? consoleInvocationLineSink;
+        // Every option is read above and here, BEFORE the directory is claimed: an option that throws
+        // (a getter, a bad value) then fails the constructor with nothing yet held.
+        const customChecker = options.checker;
         this.dir = options.dir;
         mkdirSync(this.dir, { recursive: true });
-        this.directory = new Database(join(this.dir, '_directory.sqlite'));
-        this.directory.pragma('journal_mode = WAL');
-        this.ensureDirectorySchema();
-        this.loadRoles();
-        this.checker =
-            options.checker ??
-                createTupleChecker({
-                    directory: this.directory,
-                    scopeDb: (scopeId) => this.scopesById.get(scopeId)?.db,
-                    getRole: (tenantId, key) => this.roles.get(`${tenantId}/${key}`),
-                    // #956: the evaluator judges `expires_at` against the host's clock, so a
-                    // scripted one can actually expire a grant. A caller-supplied `checker`
-                    // keeps its own time source — this only binds the built-in one.
-                    clock: () => this.clock(),
-                });
-        this.admin = this.buildAdmin();
+        // #119: from the claim to the end of the constructor is ONE guard. A constructor that throws
+        // leaves no host for anyone to close, so whatever it opened must be released here, and the
+        // only way to keep that true as lines are added is that every line after the claim is inside
+        // this `try`. Do not add work after it; add it inside, before `this.owner`.
+        const owner = claimHostDir(this.dir);
+        let directory;
+        try {
+            directory = new Database(join(this.dir, '_directory.sqlite'));
+            this.directory = directory;
+            this.directory.pragma('journal_mode = WAL');
+            this.ensureDirectorySchema();
+            this.loadRoles();
+            this.checker =
+                customChecker ??
+                    createTupleChecker({
+                        directory: this.directory,
+                        scopeDb: (scopeId) => this.scopesById.get(scopeId)?.db,
+                        getRole: (tenantId, key) => this.roles.get(`${tenantId}/${key}`),
+                        // #956: the evaluator judges `expires_at` against the host's clock, so a
+                        // scripted one can actually expire a grant. A caller-supplied `checker`
+                        // keeps its own time source — this only binds the built-in one.
+                        clock: () => this.clock(),
+                    });
+            this.admin = this.buildAdmin();
+            this.owner = owner;
+        }
+        catch (err) {
+            // A host that never finished opening owns nothing: the next one may open the directory.
+            directory?.close();
+            owner.release();
+            throw err;
+        }
     }
     /**
      * The directory schema, applied on every open, and inside a restore's transaction onto an
@@ -648,7 +775,7 @@ export class SqliteScopeHost {
      * recorded answer to #969; `docs/architecture/kernel-design.md` §8 says why.
      */
     applyDirectorySchema() {
-        this.directory.exec(`
+        execSqlStatements(this.directory, `
       -- The tenant registry (control-plane.md §4.1). Before this a tenant was an
       -- FK string on scope rows; now it is a real record with a lifecycle status.
       CREATE TABLE IF NOT EXISTS tenants (
@@ -684,6 +811,10 @@ export class SqliteScopeHost {
         status TEXT NOT NULL DEFAULT 'active',
         schema_version TEXT NOT NULL DEFAULT '0',
         vertical_version_id TEXT,
+        erasure_epoch INTEGER,
+        -- #1722: set once a reap has started draining this scope's script copies, and never
+        -- cleared: only deleting the row ends it. While set, no copy move is recorded or bound.
+        reap_claimed_at TEXT,
         provisioned_version_id TEXT,
         -- Last FAILED migration attempt (§5.3). All null / 0 = healthy. Written on
         -- the failure path so a scope that fails closed stops rendering as active;
@@ -707,6 +838,40 @@ export class SqliteScopeHost {
         archived_at TEXT,
         created_at TEXT NOT NULL
       );
+      -- #1722: additive copy inventory; historical audit backfill is a separate act.
+      CREATE TABLE IF NOT EXISTS scope_script_copies (
+        tenant_id TEXT NOT NULL,
+        scope_id TEXT NOT NULL,
+        script_ref TEXT NOT NULL,
+        move_id TEXT NOT NULL,
+        state TEXT NOT NULL,
+        load_stamp TEXT,
+        revision TEXT,
+        last_attempt_at TEXT NOT NULL DEFAULT (strftime('%Y-%m-%dT%H:%M:%fZ','now')),
+        -- 'source' | 'destination'. A pending entry belongs to its move until lease_until; a
+        -- sweep that claims it after that sets lease_owner (kernel scope-copy-ledger.ts).
+        role TEXT,
+        lease_until TEXT,
+        lease_owner TEXT,
+        PRIMARY KEY (tenant_id, scope_id, script_ref, move_id)
+      );
+      CREATE INDEX IF NOT EXISTS scope_script_copies_state ON scope_script_copies (state, scope_id);
+      -- Private host state. Module SQL opens only the scope file, never this directory;
+      -- neither table is included in directory exports or scope dumps (#2074).
+      CREATE TABLE IF NOT EXISTS private_continuation_keys (
+        scope_id TEXT PRIMARY KEY,
+        keyring TEXT NOT NULL
+      );
+      CREATE TABLE IF NOT EXISTS private_continuation_positions (
+        scope_id TEXT NOT NULL,
+        expires_at INTEGER NOT NULL,
+        locator TEXT NOT NULL,
+        ciphertext TEXT NOT NULL,
+        PRIMARY KEY (scope_id, expires_at, locator)
+      );
+      CREATE INDEX IF NOT EXISTS private_continuation_positions_expiry
+        ON private_continuation_positions (expires_at);
+      ${PEER_BINDINGS_DDL}
       -- The hostname map (K-26). A single environment-wide router resolves against
       -- this before dispatching to the vertical's worker.
       --
@@ -1007,6 +1172,9 @@ export class SqliteScopeHost {
         updated_at    TEXT NOT NULL,
         PRIMARY KEY (connection_id, state_key)
       );
+      -- A vertical's mailed connect links (connections.md §3.5.4) — kernel-owned DDL, so
+      -- both adapters build the same table.
+      ${CONNECT_LINKS_DDL}
       CREATE TABLE IF NOT EXISTS _substrat_identities (
         provider     TEXT NOT NULL,
         external_id  TEXT NOT NULL,
@@ -1094,14 +1262,9 @@ export class SqliteScopeHost {
         on_behalf_of TEXT,
         at TEXT NOT NULL
       );
-      -- Read-path indexes for the console (control-plane.md §4.5). The admin log
-      -- is append-only and only grows, so every filter it offers needs one; the
-      -- trailing id column makes each a covering index for the ORDER BY.
-      CREATE INDEX IF NOT EXISTS _substrat_admin_log_tenant ON _substrat_admin_log (tenant_id, id);
-      CREATE INDEX IF NOT EXISTS _substrat_admin_log_scope ON _substrat_admin_log (scope_id, id);
-      CREATE INDEX IF NOT EXISTS _substrat_admin_log_actor ON _substrat_admin_log (actor, id);
-      CREATE INDEX IF NOT EXISTS _substrat_admin_log_action ON _substrat_admin_log (action, id);
-      CREATE INDEX IF NOT EXISTS _substrat_admin_log_at ON _substrat_admin_log (at);
+      -- Every admin-log index, from the kernel's one list (#2064), which the legacy
+      -- rebuild below runs again after its rename.
+      ${ADMIN_LOG_INDEXES_SQL}
       -- Operational failures (#559): what the platform could NOT do. Unlike the
       -- never-swept admin log above, this is retention-bounded telemetry, pruned
       -- on write (OPS_FAILURE_RETENTION_DAYS). reference carries the upstream
@@ -1402,6 +1565,11 @@ export class SqliteScopeHost {
         if (this.modules.has(manifest.id)) {
             throw new Error(`module already registered: ${manifest.id}`);
         }
+        // #119: refused before anything is recorded, so a module the trash rules refuse leaves nothing.
+        const trashTargets = registerTrashTargets(manifest.id, new Set(Object.keys(registration.operations ?? {})), registration.operationInputs, manifest.entityStates, manifest.schedules);
+        // #2068: refused here, before anything is recorded, when the module claims an erasure it
+        // cannot deliver (a hook with no reach declared, a `custom` entity with no hook).
+        const erasure = moduleErasurePlan(registration);
         const migrations = registration.migrations ?? [];
         const seen = new Set();
         for (const m of migrations) {
@@ -1492,11 +1660,15 @@ export class SqliteScopeHost {
             // The order the kernel writes once (#1677): authored, then search, then list indexes.
             // The two derived sets are still computed above, for the duplicate-version refusals.
             migrations: moduleMigrations(registration),
+            steps: migrationSteps(registration),
             consumers,
             schedules: manifest.schedules ?? [],
             freshness: manifest.freshness ?? [],
             peers: manifest.peers ?? [],
+            purgeOnlyKeys: purgeOnlyKeysOf(manifest.schedules ?? []),
         });
+        if (erasure)
+            this.erasurePlans.push(erasure);
         for (const rel of manifest.entityRelations ?? []) {
             const parents = this.relations.get(rel.entityType) ?? new Set();
             parents.add(rel.parentType);
@@ -1583,6 +1755,9 @@ export class SqliteScopeHost {
             if (declaredOptOuts.includes(name) && this.operations.has(name)) {
                 this.operationIdempotencyOptOut.add(name);
             }
+            const target = trashTargets.get(name);
+            if (target && this.operations.has(name))
+                this.operationTarget.set(name, target);
         }
     }
     defineOperation(name, handler) {
@@ -1961,7 +2136,7 @@ export class SqliteScopeHost {
         const actingAs = (operation) => authority.kind === 'capability-session'
             ? {
                 kind: 'capability',
-                id: resolveCapabilitySession(spineSql(rt.db), authority.hash, this.clock(), operation),
+                id: resolveCapabilitySession(spineSql(rt.db), authority.hash, this.clock(), operation, true),
             }
             : authority;
         const node = { tenantId: rt.tenantId, scopeId: rt.scopeId };
@@ -2246,13 +2421,16 @@ export class SqliteScopeHost {
             // A Durable Object's dump carries spine tables this adapter keeps in its directory, or does
             // not keep at all; they are skipped by name, and any other unknown spine table is refused.
             const loadable = replayable.filter((t) => !DO_SCOPE_ONLY_SPINE_TABLES.has(t.name.toLowerCase()));
+            // Comment-blanked (#2068), as the Durable Object replays it: the dump's DDL is
+            // `sqlite_master.sql` verbatim, and `prepare` still compiles exactly one statement.
             for (const t of loadable)
                 if (!isSpineTable(t.name))
-                    db.prepare(t.ddl).run();
-            db.exec(KERNEL_DDL);
+                    db.prepare(blankSqlComments(t.ddl)).run();
+            execSqlStatements(db, KERNEL_DDL);
             this.ensureSpineColumns(db);
             const columnsOf = (name) => builtColumnsOf(db, name);
             assertSpineTablesBuilt(loadable.map((t) => t.name), columnsOf);
+            assertJournalDumpCoherent(loadable);
             // A spine column this kernel does not know (a dump from a newer one) is kept, as a plain
             // untyped column the checker never reads.
             for (const t of loadable) {
@@ -2268,28 +2446,15 @@ export class SqliteScopeHost {
                 for (const row of t.rows)
                     stmt.run(...row);
             }
-            // Rebuild the derived search indexes over the rows just loaded (#827). The DDL
-            // drops and recreates, so this also repairs an index the dump left stale, and
-            // the triggers it recreates are what keep the restored scope in step from here.
-            // Skipped for a plan whose content table this dump did not carry — a restore
-            // must not invent a table for an index to point at.
-            const present = new Set(db.prepare(`SELECT name FROM sqlite_master WHERE type = 'table'`).all().map((r) => r.name));
-            for (const plan of this.searchPlans.values()) {
-                if (present.has(plan.table))
-                    db.exec(searchIndexDdl(plan));
-            }
-            // #119: the guard triggers went with the dropped table. Put back AFTER the rows, which
-            // may legitimately arrive archived or trashed.
-            for (const plan of this.statePlans.values()) {
-                if (present.has(plan.table))
-                    db.exec(entityStateTriggerDdl(plan));
-            }
-            // #811 / #119: the derived list indexes went with it too, and a load never put them back —
-            // an archivable entity's partial indexes are part of what the kernel checks after DDL.
-            for (const plan of this.listPlans.values()) {
-                if (present.has(plan.table))
-                    db.exec(listIndexDdl(plan));
-            }
+            // #827 / #119 / #811: the search triggers, the archive/trash guard triggers, the purge
+            // sweep's index and the derived list indexes went with the dropped tables, and the search index points at rows that are
+            // gone. Put back, and the search index rebuilt, AFTER the rows — which may legitimately
+            // arrive archived or trashed — as the dump's own journal says they were derived (#2090).
+            // A plan whose table this dump did not carry is skipped: a restore must not invent one.
+            repairDerivedObjects(spineSql(db), (ddl) => execSqlStatements(db, ddl), this.derivedPlans(), {
+                after: 'the restored dump',
+                absentTable: 'skip',
+            });
             // #1575: attachment text is not in a dump, so a load left it as it was. Drop the
             // text of attachments the dump did not bring back, and queue extraction for those
             // it brought back without text — the bytes decide what that run finds.
@@ -2333,10 +2498,11 @@ export class SqliteScopeHost {
             }
             // The frontier came in with the dump — refresh the cached applied-migration set so
             // a later bind/migrate builds on the loaded state, not the previous one.
-            rt.appliedMigrations.clear();
-            for (const r of db.prepare('SELECT module_id, version FROM _substrat_migrations').all()) {
-                rt.appliedMigrations.add(`${r.module_id}@${r.version}`);
-            }
+            rt.appliedMigrations = readAppliedMigrations(db);
+            // The directory is a separate database, but the actor serializes the load
+            // and the next invocation. Old locators must be gone before that next turn.
+            this.directory.prepare('DELETE FROM private_continuation_positions WHERE scope_id = ?').run(scopeId);
+            this.directory.prepare('DELETE FROM private_continuation_keys WHERE scope_id = ?').run(scopeId);
         });
     }
     async restoreScope(actor, tenantId, scopeId, dump, opts) {
@@ -2399,8 +2565,13 @@ export class SqliteScopeHost {
         // orphaned bytes with no record (the §9 hazard).
         this.directory.prepare('DELETE FROM hostnames WHERE scope_id = ?').run(scopeId);
         rmSync(join(this.dir, `${tenantId}__${scopeId}.sqlite`), { force: true });
-        forgetSwitchesOf(switchSqlOf(this.directory), scopeId);
-        this.directory.prepare('DELETE FROM scopes WHERE scope_id = ?').run(scopeId);
+        this.directory.transaction(() => {
+            this.directory.prepare('UPDATE peer_bindings SET invalidated = 1 WHERE target_scope_id = ?').run(scopeId);
+            forgetSwitchesOf(switchSqlOf(this.directory), scopeId);
+            this.directory.prepare('DELETE FROM private_continuation_positions WHERE scope_id = ?').run(scopeId);
+            this.directory.prepare('DELETE FROM private_continuation_keys WHERE scope_id = ?').run(scopeId);
+            this.directory.prepare('DELETE FROM scopes WHERE scope_id = ?').run(scopeId);
+        })();
         this.recordAdmin(actor, 'deleteSnapshot', { tenantId, scopeId }, null, {
             forkedFrom: rec.forkedFrom,
             forkedAt: rec.forkedAt,
@@ -2540,19 +2711,27 @@ export class SqliteScopeHost {
         // Same lifecycle gates as the principal door, and reached the same way: a
         // suspended tenant refuses a support session exactly as it refuses a user.
         const scope = this.directory
-            .prepare('SELECT tenant_id, status FROM scopes WHERE scope_id = ?')
+            .prepare('SELECT tenant_id FROM scopes WHERE scope_id = ?')
             .get(scopeId);
         if (!scope || scope.tenant_id !== tenantId) {
             throw substratError('not_found', `unknown scope for tenant: (${tenantId}, ${scopeId})`);
         }
-        if (scope.status !== 'active') {
-            throw substratError('conflict', `scope not active (status: ${scope.status}): ${scopeId}`, { reason: SCOPE_GATE_REASONS.notActive });
-        }
+        const refusal = this.scopeWorkRefusal(tenantId, scopeId);
+        if (refusal)
+            throw substratError('conflict', refusal, { reason: SCOPE_GATE_REASONS.notActive });
         const rt = this.runtime(tenantId, scopeId);
         await this.applyPendingMigrations(rt);
         return this.buildStub(tenantId, scopeId, rt, asPrincipal(record.principal), options, record.id);
     }
     async getSystemScope(moduleId, tenantId, scopeId) {
+        return this.openSystemScope(moduleId, tenantId, scopeId, false);
+    }
+    /**
+     * The system door's stub. `purge` (#119) is set only by `runPurgeSweep`, which never hands the
+     * stub on: it is the one stub whose invokes may use the module's purge-only keys, and only on
+     * the purge operation. Every stub any caller can get is built with it off.
+     */
+    async openSystemScope(moduleId, tenantId, scopeId, purge) {
         // The scheduler's door (#383) — mirror of getConnectorScope. The module must be
         // registered on this host (a schedule can only invoke its own vertical's ops),
         // and the scope must be active. Authority is then an ordinary check against
@@ -2561,17 +2740,17 @@ export class SqliteScopeHost {
             throw substratError('not_found', `module not registered on this host: ${moduleId}`);
         }
         const scope = this.directory
-            .prepare('SELECT tenant_id, status FROM scopes WHERE scope_id = ?')
+            .prepare('SELECT tenant_id FROM scopes WHERE scope_id = ?')
             .get(scopeId);
         if (!scope || scope.tenant_id !== tenantId) {
             throw substratError('not_found', `unknown scope: ${scopeId}`);
         }
-        if (scope.status !== 'active') {
-            throw substratError('conflict', `scope not active (status: ${scope.status}): ${scopeId}`, { reason: SCOPE_GATE_REASONS.notActive });
-        }
+        const refusal = this.scopeWorkRefusal(tenantId, scopeId);
+        if (refusal)
+            throw substratError('conflict', refusal, { reason: SCOPE_GATE_REASONS.notActive });
         const rt = this.runtime(tenantId, scopeId);
         await this.applyPendingMigrations(rt);
-        return this.buildStub(tenantId, scopeId, rt, { kind: 'system', id: moduleId });
+        return this.buildStub(tenantId, scopeId, rt, { kind: 'system', id: moduleId }, undefined, undefined, purge);
     }
     /**
      * #1705: the producer's release, decided by THIS deployment's own declarations. The admin
@@ -2833,6 +3012,20 @@ export class SqliteScopeHost {
         await this.applyPendingMigrations(rt);
         return rt;
     }
+    /** The directory's current hold, read again when background work is about to run. */
+    scopeWorkRefusal(tenantId, scopeId, allowProvisioning = false) {
+        const row = this.directory
+            .prepare(`SELECT s.status AS scope, t.status AS tenant
+                  FROM scopes s JOIN tenants t ON t.tenant_id = s.tenant_id
+                  WHERE s.scope_id = ? AND s.tenant_id = ?`)
+            .get(scopeId, tenantId);
+        if (!row)
+            return `unknown scope for tenant: (${tenantId}, ${scopeId})`;
+        // A connector can serve provisioning work; suspension still holds it.
+        if (allowProvisioning && row.scope === 'provisioning' && row.tenant === 'active')
+            return null;
+        return lifecycleRefusal(row, { tenantId, scopeId });
+    }
     /**
      * The exchange (#1672) — a secret traded for a session, or for the principal a `become`
      * capability yields. One serialized scope task and one transaction, so the use it takes
@@ -3029,10 +3222,7 @@ export class SqliteScopeHost {
         const report = { checks: [] };
         if (!this.modules.has(moduleId))
             return report;
-        const scope = this.directory
-            .prepare('SELECT status FROM scopes WHERE scope_id = ? AND tenant_id = ?')
-            .get(scopeId, tenantId);
-        if (!scope || scope.status !== 'active')
+        if (this.scopeWorkRefusal(tenantId, scopeId))
             return report;
         const rt = this.runtime(tenantId, scopeId);
         await this.applyPendingMigrations(rt);
@@ -3109,10 +3299,7 @@ export class SqliteScopeHost {
         // not this driver's problem to raise — it simply has nothing due (the sweep
         // already enumerated `active` scopes; this guards a race where one archived
         // between enumeration and here).
-        const scope = this.directory
-            .prepare('SELECT status FROM scopes WHERE scope_id = ? AND tenant_id = ?')
-            .get(scopeId, tenantId);
-        if (!scope || scope.status !== 'active')
+        if (this.scopeWorkRefusal(tenantId, scopeId))
             return report;
         const rt = this.runtime(tenantId, scopeId);
         await this.applyPendingMigrations(rt);
@@ -3186,19 +3373,42 @@ export class SqliteScopeHost {
             const startedAt = Date.now();
             let emitted;
             let failure;
+            // #119, #2096: more of a purge horizon's lap is due — the schedule stays due, so the next pass continues it.
+            let stillDue = false;
             try {
-                const stub = await this.getSystemScope(moduleId, tenantId, scopeId);
-                await stub.invoke(schedule.operation, schedule.input, { invocationId, onEmitted: (r) => (emitted = r) });
+                if (schedule.purge) {
+                    // #119: a purge horizon's schedule runs its operation once per due entity, never once.
+                    const pass = await this.runPurgeSweep(moduleId, tenantId, scopeId, schedule.operation);
+                    stillDue = purgeStillDue(pass);
+                    const outcome = purgeReportOf(schedule.operation, schedule.purge.entityType, pass);
+                    report.errors.push(...outcome.errors);
+                    if (outcome.failure)
+                        throw outcome.failure;
+                }
+                else {
+                    const stub = await this.getSystemScope(moduleId, tenantId, scopeId);
+                    await stub.invoke(schedule.operation, schedule.input, { invocationId, onEmitted: (r) => (emitted = r) });
+                }
                 report.fired += 1;
             }
             catch (err) {
+                // The system door can meet a suspension after the cadence gate. A refused
+                // fire did not run, so leave its row due for the first live pass.
+                if (isSubstratError(err) && err.code === 'conflict' && err.extensions.reason === SCOPE_GATE_REASONS.notActive) {
+                    report.lifecycleHeld = true;
+                    report.skipped += 1;
+                    report.runs.push({ operation: schedule.operation, outcome: 'skipped' });
+                    continue;
+                }
                 status = 'failed';
                 failure = { error: err };
                 report.failed += 1;
-                report.errors.push({
-                    operation: schedule.operation,
-                    error: err instanceof Error ? err.message : String(err),
-                });
+                if (!schedule.purge) {
+                    report.errors.push({
+                        operation: schedule.operation,
+                        error: err instanceof Error ? err.message : String(err),
+                    });
+                }
             }
             lines.write({
                 kind: 'schedule',
@@ -3215,6 +3425,9 @@ export class SqliteScopeHost {
                 ...(emitted ? { emitted } : {}),
                 versionId: this.versionId,
             });
+            report.runs.push({ operation: schedule.operation, outcome: status === 'ok' ? 'ok' : 'failed' });
+            if (stillDue)
+                continue;
             // On the scope actor (#1678): the cadence row joined whatever transaction an invoke
             // held open, so its rollback forgot the run and the next pass fired it AGAIN.
             await rt.actor.turn(() => rt.db
@@ -3224,11 +3437,65 @@ export class SqliteScopeHost {
                                                           last_status = excluded.last_status,
                                                           invocation_id = excluded.invocation_id`)
                 .run(schedule.operation, new Date(now).toISOString(), status, invocationId));
-            report.runs.push({ operation: schedule.operation, outcome: status === 'ok' ? 'ok' : 'failed' });
         }
         lines.end();
         return report;
     }
+    /**
+     * One pass of a purge horizon's schedule on one scope (#119) — the Durable Object's
+     * `runPurgeSweep`, mirrored. The caller names only which schedule: the module and the entity come
+     * from the registered schedule, the cutoff from this host's clock and the declared horizon, the
+     * ids from the scope's own bin, read in a turn. Then the purge operation is invoked once per id
+     * through a purge stub (`openSystemScope`) that never leaves this method, each in its own
+     * transaction and under the cutoff the host re-checks inside it (`refuseTrashedTarget`).
+     */
+    async runPurgeSweep(moduleId, tenantId, scopeId, operation) {
+        const entityType = this.modules
+            .get(moduleId)
+            ?.schedules.find((s) => s.operation === operation && s.purge)?.purge?.entityType;
+        if (entityType === undefined)
+            throw substratError('not_found', `no purge schedule of ${moduleId} runs ${operation}`);
+        // The pair first, from the directory, before the scope's storage is opened for it.
+        const owner = this.directory.prepare('SELECT tenant_id FROM scopes WHERE scope_id = ?').get(scopeId);
+        if (!owner || owner.tenant_id !== tenantId)
+            throw substratError('not_found', `unknown scope: ${scopeId}`);
+        this.directory.prepare('DELETE FROM private_continuation_positions WHERE expires_at <= ?')
+            .run(Date.parse(this.clock()));
+        const rt = this.runtime(tenantId, scopeId);
+        await this.applyPendingMigrations(rt);
+        const now = this.clock();
+        // #119: the gate the schedule run applies, applied by the sweep itself (`purgeHeldBy`), and
+        // again inside each purge's transaction. A held scope selects nothing.
+        const due = await rt.actor.turn(() => {
+            const held = purgeHeldBy(this.purgeGateFacts(rt, moduleId, tenantId, scopeId));
+            return held !== null
+                ? { held }
+                : purgeDueOf(spineSql(rt.db), this.statePlans, this.operationTarget, operation, entityType, now);
+        });
+        if ('held' in due)
+            return heldPurgePass(due.held);
+        const stub = await this.openSystemScope(moduleId, tenantId, scopeId, true);
+        return runPurgePass(operation, due, async (entityId) => {
+            await stub.invoke(operation, { [due.idFrom]: entityId }, { invocationId: ulid() });
+        }, (write) => rt.actor.turn(() => write(spineSql(rt.db))));
+    }
+    /**
+     * #119: the purge gate's facts (`PurgeGateFacts`) — the module's switch from the scope's own
+     * storage, and the lifecycle, the primacy and the tenant from this host's directory, which is
+     * their authority here.
+     */
+    purgeGateFacts(rt, moduleId, tenantId, scopeId) {
+        const row = this.directory
+            .prepare(`SELECT s.tenant_id AS tenant_id, s.status AS scope, t.status AS tenant
+           FROM scopes s LEFT JOIN tenants t ON t.tenant_id = s.tenant_id WHERE s.scope_id = ?`)
+            .get(scopeId);
+        return {
+            switched: systemScheduleState(switchSqlOf(rt.db), moduleId, this.clock()),
+            lifecycle: row ? lifecycleRefusal({ scope: row.scope, tenant: row.tenant ?? 'active' }) : null,
+            copy: !this.isPrimaryInDirectory(scopeId),
+            foreignTenant: row?.tenant_id !== tenantId,
+        };
+    }
     /** The stub body, shared by the principal, connection, system, impersonation and capability doors. */
     buildStub(tenantId, scopeId, rt, 
     /**
@@ -3244,7 +3511,9 @@ export class SqliteScopeHost {
      * about them with no override branch anywhere — and this is what every
      * record additionally keeps, plus the bound a read-only session is held to.
      */
-    sessionId) {
+    sessionId, 
+    /** #119: a purge stub — `openSystemScope`'s, built only by `runPurgeSweep`, never handed on. */
+    purge = false) {
         const operations = this.operations;
         return {
             tenantId,
@@ -3258,6 +3527,15 @@ export class SqliteScopeHost {
                     : authority.kind,
             invoke: async (operation, input, invokeOptions) => {
                 const handler = operations.get(operation);
+                // #119: purge authority is never an invoke option — only a purge stub, which
+                // `runPurgeSweep` builds and keeps, purges — and an options object naming a cutoff is
+                // refused outright.
+                try {
+                    assertNoCallerPurge(invokeOptions);
+                }
+                catch (err) {
+                    return Promise.reject(err);
+                }
                 // `not_found`, not a bare throw (#113) — the same code `adapter-cloudflare`
                 // gives it, so a demo and a hosted vertical answer 404 for the same reason.
                 if (!handler)
@@ -3369,7 +3647,15 @@ export class SqliteScopeHost {
                         const minted = [];
                         // Fresh per operation: the context carries the K-34 authorization accumulator,
                         // which must not leak across operations (invokes are serialized per scope).
-                        const ctx = this.operationContext(rt, subject, undefined, signals, session, operation, minted);
+                        // #119: the keys the module's system principal holds only for its purge schedules are
+                        // withheld from every call but the purge sweep's own invoke of the purge operation.
+                        const target = this.operationTarget.get(operation);
+                        // Through the system door only: the sweep's mark on any other subject's call means nothing.
+                        const purging = purge && subject.kind === 'system';
+                        const withheld = subject.kind === 'system'
+                            ? withheldKeysFor(this.modules.get(subject.id)?.purgeOnlyKeys, target, purging)
+                            : undefined;
+                        const ctx = this.operationContext(rt, subject, undefined, signals, session, operation, minted, undefined, undefined, withheld);
                         const clonedInput = structuredClone(input);
                         // #893: parse, don't trust — at the scope door, from the operation's own
                         // declaration. BEFORE `BEGIN`, so a malformed call never opens a
@@ -3436,11 +3722,28 @@ export class SqliteScopeHost {
                             // so the only loss is effort on a path that was already failing.
                             const ref = guarded ? this.concurrencyRef(operation, guarded, parsed) : undefined;
                             const seen = ref && invokeOptions?.ifMatch !== undefined ? this.versionAt(rt, ref) : undefined;
+                            // #119: an operation on a TRASHED entity it did not declare it reaches is refused
+                            // here, before the guards and the handler — the declared key first, so a caller
+                            // without it meets the same `forbidden` an active entity gives (`entity-trash.ts`).
+                            await refuseTrashedTarget({ sql: spineSql(rt.db), plans: this.statePlans, check: ctx.check }, operation, target, parsed, purging ? { now: this.clock(), gate: this.purgeGateFacts(rt, subject.id, tenantId, scopeId) } : undefined);
                             // Manifest guards (K-17): pre-conditions, inside the operation's own
                             // transaction, before the handler. A throw here blocks the operation
                             // and rolls back exactly like a handler throw — fail closed.
                             await this.runGuards(operation, ctx, parsed);
                             result = await handler(ctx, parsed);
+                            // #119: the purge gate's AUTHORITATIVE read. Lifecycle, primacy and tenant live in the
+                            // directory, which this transaction does not cover and whose writers (a suspend, a
+                            // tenant status, a reclassification) do not take the scope's actor — so a hold could
+                            // commit while the handler above was awaiting. From here to `COMMIT` nothing awaits:
+                            // better-sqlite3 is synchronous and this process's JS single-threaded, so nothing in
+                            // this process — another host on the same directory included — can write between this
+                            // read and the commit of the delete; and this process owns the directory
+                            // (`claimHostDir`), so no other process can either.
+                            if (purging) {
+                                const held = purgeHeldBy(this.purgeGateFacts(rt, subject.id, tenantId, scopeId));
+                                if (held !== null)
+                                    throw substratError('conflict', `${operation}: ${held}`, { reason: 'purge_held' });
+                            }
                             if (ref && invokeOptions?.ifMatch !== undefined) {
                                 assertIfMatch(ref, invokeOptions.ifMatch, seen ?? null);
                             }
@@ -3593,6 +3896,7 @@ export class SqliteScopeHost {
         for (const rt of [...this.scopes.values()])
             this.closeRuntime(rt);
         this.directory.close();
+        this.owner.release();
     }
     // -------------------------------------------------------------------------
     // Event dispatch (testrun spec §9.2.3): at-least-once, kernel-journaled,
@@ -3659,6 +3963,12 @@ export class SqliteScopeHost {
         return report;
     }
     async dispatchExecutorsPass(rt, invocationId, report, lines, outcomes) {
+        // A request that started while live may commit after a suspension. Its outbox
+        // stays due without an attempt, just as a scheduled retry does.
+        if (this.scopeWorkRefusal(rt.tenantId, rt.scopeId)) {
+            report.lifecycleHeld = true;
+            return;
+        }
         const now = new Date().toISOString();
         const scope = this.executorScope(rt);
         // #2005: a non-primary scope (a fork, a snapshot, a preview of either kind) causes no
@@ -3682,6 +3992,10 @@ export class SqliteScopeHost {
            ORDER BY o.id`)
                 .all(deliveryId, executor.eventType, now);
             for (const row of rows) {
+                if (this.scopeWorkRefusal(rt.tenantId, rt.scopeId)) {
+                    report.lifecycleHeld = true;
+                    return;
+                }
                 report.attempted += 1;
                 // #1901: this attempt's line. Its number is the one the journal records, which
                 // `recordExecutorDelivery` answers — the Durable Object's RPC does the same.
@@ -3805,6 +4119,9 @@ export class SqliteScopeHost {
         return isPrimaryScopeRow(this.directory.prepare('SELECT kind, forked_from FROM scopes WHERE scope_id = ?').get(scopeId));
     }
     async drainDue(tenantId, scopeId) {
+        if (this.scopeWorkRefusal(tenantId, scopeId)) {
+            return { attempted: 0, delivered: 0, retrying: 0, deadLettered: 0, lifecycleHeld: true };
+        }
         const rt = this.runtime(tenantId, scopeId);
         await this.applyPendingMigrations(rt);
         // #1525: null, and honestly so — a sweep is not a call. An attempt this pass makes
@@ -3989,13 +4306,11 @@ export class SqliteScopeHost {
         this.attachmentExtractors, this.attachmentTextBounds);
     }
     async startJobRun(tenantId, scopeId, input) {
-        const rt = this.runtime(tenantId, scopeId);
-        await this.applyPendingMigrations(rt);
+        const rt = await this.openActiveScope(tenantId, scopeId);
         return jobRunOf(await startJobRun(this.jobStore(rt), input, ulid, this.clock));
     }
     async runDueJobs(tenantId, scopeId, options) {
-        const rt = this.runtime(tenantId, scopeId);
-        await this.applyPendingMigrations(rt);
+        const rt = await this.openActiveScope(tenantId, scopeId);
         // #1575: the kernel's extraction jobs are this host's own, bound to this scope — no
         // deployment registers them, and none can shadow them. The backfill starts here, on
         // the drive, so a scope's first request never pays for attachments that predate it.
@@ -4027,6 +4342,9 @@ export class SqliteScopeHost {
         // directory, so a node control plane can drain routed intents exactly as the
         // Cloudflare one does; the context build is the same one `dispatchExecutors` hands
         // an in-process connector.
+        const refusal = this.scopeWorkRefusal(tenantId, scopeId, true);
+        if (refusal)
+            throw substratError('conflict', refusal, { reason: SCOPE_GATE_REASONS.notActive });
         const rt = this.runtime(tenantId, scopeId);
         // `false`: this path deliberately does NOT enqueue, so nothing is held and
         // the connection's reads take an ordinary serialized turn. Built on a view bound to
@@ -4101,17 +4419,17 @@ export class SqliteScopeHost {
         // Nothing pending FOR THIS HOST → noop, and deliberately no state write: a
         // host that does not run the scope's modules must never clear (or overwrite)
         // a failure recorded by the deployment that does.
-        let pending = false;
-        for (const mod of this.modules.values()) {
-            for (const migration of mod.migrations) {
-                if (!rt.appliedMigrations.has(`${mod.id}@${migration.version}`))
-                    pending = true;
-            }
-        }
+        // A scope that applied different SQL (#2066) is not a noop: the pass below fails it.
+        const plan = await planMigrations(this.modules.values(), rt.appliedMigrations);
+        const pending = plan.pending.length > 0 || plan.diverged !== undefined;
+        // #2090: with nothing pending, the pass still checks and repairs what the kernel derived —
+        // the one way a scope stripped before that check existed is ever put right.
         if (!pending)
-            return { status: 'noop' };
+            rt.derivedRepaired = false;
         try {
-            await this.applyPendingMigrations(rt);
+            await this.applyPendingMigrations(rt, plan);
+            if (!pending)
+                return { status: 'noop' };
             return { status: 'migrated', schemaVersion: String(rt.appliedMigrations.size) };
         }
         catch {
@@ -4169,21 +4487,22 @@ export class SqliteScopeHost {
     async settlePlatformRequest(tenantId, scopeId, id, outcome) {
         const rt = this.runtime(tenantId, scopeId);
         await this.applyPendingMigrations(rt);
-        await rt.actor.enqueue(() => {
-            // Compare-and-set on `pending` (#1600 review). The drain reads pending rows, runs a
-            // handler, then settles — and between the read and the settle a subject erasure can
-            // redact the row. Settling by `id` alone let that stale pass overwrite the redaction
-            // and write a provider's reply, which can quote the person, back into `last_error`.
-            // Nothing legitimate is refused by this: `listPlatformRequests` returns only pending
-            // rows, so every settle in the tree targets one that was pending when it was read.
-            // A settle that finds the row already terminal does nothing, deliberately silently —
-            // throwing would make the drain's blanket catch retry a row that is correctly over.
-            rt.db
-                .prepare(`UPDATE _substrat_platform_requests
-             SET status = ?, result = COALESCE(?, result), last_error = ?, last_failure = ?,
-                 attempts = attempts + 1, settled_at = ?
-           WHERE id = ? AND status = 'pending'`)
-                .run(outcome.status, outcome.result === undefined ? null : JSON.stringify(outcome.result), outcome.lastError ?? null, outcome.failure == null ? null : JSON.stringify(outcome.failure), outcome.status === 'pending' ? null : new Date().toISOString(), id);
+        await rt.actor.enqueue(async () => {
+            // The kernel's one settle (#2102): compare-and-set on `pending` (#1600 review), and the
+            // outcome event written in the same transaction, only by the settle that moved the row.
+            rt.db.transaction(() => settlePlatformRequestIn(switchSqlOf(rt.db), id, outcome, {
+                tenantId: rt.tenantId,
+                scopeId: rt.scopeId,
+                now: new Date().toISOString(),
+                mintEventId: (ms) => rt.mintEventId(ms),
+                version: this.versionId,
+            }))();
+            // What the event announces reaches this scope's consumers and executors in the same
+            // tail, as an import's events do. A settle that wrote none has nothing to deliver.
+            if (outcome.event) {
+                await this.dispatch(rt, null);
+                await this.dispatchExecutors(rt, null);
+            }
         });
     }
     async dispatch(rt, 
@@ -4568,6 +4887,65 @@ export class SqliteScopeHost {
     auditedFindings(actor, run) {
         return this.directory.transaction(() => run(redactionSqlOf(this.directory), (a) => this.recordAdmin(actor, a.action, a.target, a.before, a.after)))();
     }
+    /**
+     * A connect-link move and the audit row it hands back, in ONE directory transaction
+     * (connections.md §3.5.4): a consume whose audit write failed must not leave the link spent
+     * with no connection and no record.
+     */
+    auditedConnectLink(actor, run) {
+        return this.directory.transaction(() => run(redactionSqlOf(this.directory), (a) => this.recordAdmin(actor, a.action, a.target, a.before, a.after)))();
+    }
+    /**
+     * #559: one ops-failure row with its issue and finding, in one transaction (a savepoint when
+     * the caller holds one: #2064's settle writes it beside the `unknown` row it reports).
+     */
+    writeOpsFailure(entry) {
+        const at = new Date().toISOString();
+        const fingerprint = opsFailureFingerprint(entry);
+        // #1748: the evidence, its issue and its finding in ONE transaction — a detector that
+        // throws takes the evidence with it, so the caller's retry observes it rather than finding
+        // the row already there and the observation lost.
+        this.directory.transaction(() => {
+            this.directory
+                .prepare(`INSERT INTO _substrat_ops_failures
+             (id, actor, operation, stage, tenant_id, scope_id, vertical, version, status, message, reference, origin, code, fingerprint, at)
+           VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`)
+                .run(ulid(), entry.actor, entry.operation, entry.stage ?? null, entry.tenantId ?? null, entry.scopeId ?? null, entry.vertical ?? null, entry.version ?? null, entry.status ?? null, 
+            // Bounded here, not trusted from the catch site: one runaway upstream
+            // body must not become a runaway directory row (#559).
+            entry.message.slice(0, 2000), entry.reference ?? null, entry.origin ?? null, entry.code ?? null, fingerprint, at);
+            // Prune-on-write (#559): retention lives here, not in a cron — every insert
+            // pays for its own housekeeping, so the table stays bounded even where no
+            // scheduled pass runs (this adapter has none).
+            const horizon = new Date(Date.now() - OPS_FAILURE_RETENTION_DAYS * 86_400_000).toISOString();
+            this.directory.prepare('DELETE FROM _substrat_ops_failures WHERE at < ?').run(horizon);
+            // The issues materialization (#1233): the group's counters live on their
+            // own row, bumped in the same call, because the evidence self-prunes above
+            // and a count must survive its own exemplars. A fresh arrival regresses a
+            // resolved issue; an ignored one stays ignored — that is what ignoring means.
+            this.directory
+                .prepare(`INSERT INTO _substrat_issues
+             (fingerprint, operation, stage, origin, code, status, seen_count, first_seen, last_seen, last_message, last_tenant_id, last_owner_kind, last_vertical, last_version, resolved_version, resolved_at)
+           VALUES (?, ?, ?, ?, ?, 'new', 1, ?, ?, ?, ?, ?, ?, ?, NULL, NULL)
+           ON CONFLICT (fingerprint) DO UPDATE SET
+             seen_count = seen_count + 1,
+             last_seen = excluded.last_seen,
+             last_message = excluded.last_message,
+             last_tenant_id = excluded.last_tenant_id,
+             last_owner_kind = excluded.last_owner_kind,
+             last_vertical = COALESCE(excluded.last_vertical, last_vertical),
+             last_version = COALESCE(excluded.last_version, last_version),
+             origin = COALESCE(excluded.origin, origin),
+             status = CASE WHEN status = 'resolved' THEN 'regressed' ELSE status END`)
+                .run(fingerprint, entry.operation, entry.stage ?? null, entry.origin ?? null, entry.code ?? null, at, at, entry.message.slice(0, 2000), entry.tenantId ?? null, issueExemplarOwner(entry.tenantId ?? null), entry.vertical ?? null, entry.version ?? null);
+            const issueHorizon = new Date(Date.now() - ISSUE_RETENTION_DAYS * 86_400_000).toISOString();
+            this.directory.prepare('DELETE FROM _substrat_issues WHERE last_seen < ?').run(issueHorizon);
+            // #1748: the tenant's Recurring finding, over the tenant's own occurrences only.
+            const finding = findingOfOpsFailure(entry);
+            if (finding)
+                observeFinding(redactionSqlOf(this.directory), finding, at);
+        })();
+    }
     recordAdmin(actor, action, target, before, after, 
     /** When the row says it happened; the wall clock unless the write took its time elsewhere (#1184). */
     at = new Date().toISOString()) {
@@ -4813,6 +5191,9 @@ export class SqliteScopeHost {
                 else {
                     this.directory.prepare('UPDATE scopes SET status = ? WHERE scope_id = ?').run(to, scopeId);
                 }
+                if (to === 'archived' || to === 'reaped') {
+                    this.directory.prepare('UPDATE peer_bindings SET invalidated = 1 WHERE tenant_id = ? AND target_scope_id = ?').run(tenantId, scopeId);
+                }
                 if (to === 'reaped')
                     forgetSwitchesOf(switchSqlOf(this.directory), scopeId);
                 // The audit target carries the scope's vertical (control-plane.md §4.4:
@@ -4870,10 +5251,7 @@ export class SqliteScopeHost {
             if (!node.scopeId)
                 throw new Error('scope tuple requires node.scopeId');
             const rt = this.runtime(node.tenantId, node.scopeId);
-            rt.db
-                .prepare(`INSERT OR REPLACE INTO _substrat_tuples (subject, relation, object, expires_at)
-           VALUES (?, ?, ?, ?)`)
-                .run(subject, relation, object, expiresAt ?? null);
+            writeExplicitTupleIn(switchSqlOf(rt.db), subject, relation, object, { kind: 'replace', expiresAt: expiresAt ?? null });
         };
         const writeGrant = (subject, permission, node, entity, expiresAt) => {
             if (entity) {
@@ -4915,12 +5293,19 @@ export class SqliteScopeHost {
             // AUDIT FIRST (#1666 review), exactly as the Cloudflare adapter: the intent row before
             // anything moves, the outcome row after, on every attempt. The directory and the
             // scope's file are separate databases, so a crash between them leaves an intent with
-            // no recorded outcome — never a moved switch with no audit row.
+            // no recorded outcome — never a moved switch with no audit row. #2089: every outcome row
+            // goes through the kernel's `recordAuditOutcome`, exactly as the Cloudflare adapter — one
+            // that cannot be written is logged, never swallowed, and the settle closes its intent.
             const operationId = ulid();
             const action = switchActionOf(kind, to);
             const target = { tenantId, scopeId };
             const base = { operationId, ...switchAuditSubject(kind, key, to) };
             this.recordAdmin(actor, action, target, null, { ...base, phase: 'intent', reason });
+            const recordOutcome = (row) => recordAuditOutcome(() => this.recordAdmin(actor, action, target, null, { ...base, ...row }), {
+                flow: `${kind}-switch`,
+                operationId,
+                phase: row.phase,
+            }, (message, fields) => console.error(message, fields));
             // The directory's record (#1674; #2029 for a peer), written BEFORE the scope moves, both
             // ways, and undone if the move throws or holds nothing — see `recordSwitchedOn` and
             // (#1823) `recordSwitchedOff` for why that order is the safe one.
@@ -4934,18 +5319,13 @@ export class SqliteScopeHost {
             }
             catch (err) {
                 // Nothing has moved: fail the call here, audited — the Cloudflare adapter's posture.
-                try {
-                    this.recordAdmin(actor, action, target, null, { ...base, phase: 'failed', error: errorOf(err) });
-                }
-                catch {
-                    // Best effort: the original error is what the caller must see.
-                }
+                await recordOutcome({ phase: 'failed', error: errorOf(err) });
                 throw err;
             }
             // #2045: a newer call on this subject has recorded its position already: this one writes
             // nothing, here or in the scope, and says so.
             if (recordWriteSuperseded(prior, record)) {
-                this.recordAdmin(actor, action, target, null, { ...base, phase: 'refused', superseded: true });
+                await recordOutcome({ phase: 'refused', superseded: true });
                 throw substratError('conflict', switchSupersededMessage(kind, scopeId, key, to));
             }
             /** The record's undo, after the scope's move threw or held nothing: retried once, never swallowed. */
@@ -4984,23 +5364,13 @@ export class SqliteScopeHost {
             }
             catch (err) {
                 const recordError = undoRecord();
-                try {
-                    this.recordAdmin(actor, action, target, null, {
-                        ...base,
-                        phase: 'failed',
-                        error: errorOf(err),
-                        ...(recordError ? { recordError } : {}),
-                    });
-                }
-                catch {
-                    // Best effort: the original error is what the caller must see.
-                }
+                await recordOutcome({ phase: 'failed', error: errorOf(err), ...(recordError ? { recordError } : {}) });
                 throw err;
             }
             // #2045: the scope has applied a newer call on this subject, so this move wrote nothing. The
             // record is that newer call's too (its write overwrote this one's), so nothing is undone.
             if (outcome.superseded) {
-                this.recordAdmin(actor, action, target, null, { ...base, phase: 'refused', superseded: true });
+                await recordOutcome({ phase: 'refused', superseded: true });
                 throw substratError('conflict', switchSupersededMessage(kind, scopeId, key, to));
             }
             // A call that held nothing moved nothing (the subject has no authority reaching the
@@ -5008,8 +5378,7 @@ export class SqliteScopeHost {
             // switch the subject off the day it is installed; left `on`, the next reconcile of a
             // wiped scope would leave it running.
             const recordError = outcome.held ? null : undoRecord();
-            this.recordAdmin(actor, action, target, null, {
-                ...base,
+            const unrecorded = await recordOutcome({
                 phase: outcome.held ? 'applied' : 'refused',
                 changed: outcome.changed,
                 permissions: outcome.permissions,
@@ -5019,30 +5388,32 @@ export class SqliteScopeHost {
                 throw substratError('not_found', switchNotFoundMessage(kind, scopeId, key, to) +
                     (recordError ? `; and its directory record could not be put back (${recordError})` : ''));
             }
-            return { operationId, outcome };
+            return { operationId, outcome, ...(unrecorded !== null ? { auditWarning: auditWarningOf('the switch', unrecorded) } : {}) };
         };
         /** #1666: move one module's schedule switch on one scope — see `HostAdmin.revokeFromSystem`. */
         const switchSystem = async (actor, raw, to) => {
             const input = systemSwitch.parse(raw);
-            const { operationId, outcome } = await switchSubject(actor, 'system', input.node, input.moduleId, input.reason, to);
+            const { operationId, outcome, auditWarning } = await switchSubject(actor, 'system', input.node, input.moduleId, input.reason, to);
             return {
                 operationId,
                 moduleId: input.moduleId,
                 schedules: to,
                 changed: outcome.changed,
                 permissions: outcome.permissions,
+                ...(auditWarning ? { auditWarning } : {}),
             };
         };
         /** #1706: move one PEER's kill switch on one scope — see `HostAdmin.revokeFromPeer`. */
         const switchPeerAt = async (actor, raw, to) => {
             const input = peerSwitch.parse(raw);
-            const { operationId, outcome } = await switchSubject(actor, 'peer', input.node, input.vertical, input.reason, to);
+            const { operationId, outcome, auditWarning } = await switchSubject(actor, 'peer', input.node, input.vertical, input.reason, to);
             return {
                 operationId,
                 vertical: input.vertical,
                 calls: to,
                 changed: outcome.changed,
                 permissions: outcome.permissions,
+                ...(auditWarning ? { auditWarning } : {}),
             };
         };
         /**
@@ -5151,6 +5522,8 @@ export class SqliteScopeHost {
             return result;
         };
         return {
+            // #2069: a view of the view this admin was built over — the person added, its event kept.
+            attributed: (onBehalfOf) => this.attributed(onBehalfOf).admin,
             // #603: fixed at construction — a host built without a box can never store a
             // credential, and saying so is what lets a transport answer 503 instead of 500.
             canStoreSecrets: isSecretBoxConfigured(this.secretBox),
@@ -5245,6 +5618,42 @@ export class SqliteScopeHost {
                 await onNode(grant.node, () => writeGrant(`principal:${grant.principalId}`, grant.permission, grant.node, grant.entity, grant.expiresAt));
                 this.recordAdmin(actor, 'grant', { tenantId: grant.node.tenantId, scopeId: grant.node.scopeId }, null, grant);
             },
+            grantEntityShape: async (actor, grant) => {
+                const { tenantId, scopeId } = grant.node;
+                this.assertScope(tenantId, scopeId);
+                const rt = this.runtime(tenantId, scopeId);
+                // One unit on the scope actor (#1678): the marker and its keys land together or not at all.
+                await rt.actor.turn(() => rt.db.transaction(() => grantEntityShapeIn(switchSqlOf(rt.db), grant.principalId, grant.entity, grant.permissions))());
+                this.recordAdmin(actor, 'grantEntityShape', { tenantId, scopeId }, null, grant);
+            },
+            reconcileEntityGrantShapes: async (actor, node, shapes, opts) => {
+                const limit = shapeTopUpBatch(opts?.batch);
+                const { tenantId, scopeId } = node;
+                this.assertScope(tenantId, scopeId);
+                const rt = this.runtime(tenantId, scopeId);
+                let toppedUp = 0;
+                let retired = 0;
+                // #2071: one bounded transaction per pass, so a large scope never holds one long; a pass
+                // that did not use its whole budget found everything.
+                for (let done = false; !done;) {
+                    const pass = await rt.actor.turn(() => rt.db.transaction(() => topUpEntityGrantShapes(switchSqlOf(rt.db), {
+                        tenantId,
+                        scopeId,
+                        shapes,
+                        now: new Date().toISOString(),
+                        limit,
+                        mintEventId: (ms) => rt.mintEventId(ms),
+                        version: this.versionId,
+                    }))());
+                    toppedUp += pass.toppedUp;
+                    retired += pass.retired;
+                    done = pass.done;
+                }
+                if (toppedUp > 0 || retired > 0) {
+                    this.recordAdmin(actor, 'reconcileEntityGrantShapes', { tenantId, scopeId }, null, { shapes, toppedUp, retired });
+                }
+                return { toppedUp, retired };
+            },
             grantToConnection: async (actor, raw) => {
                 const grant = connectionGrant.parse(raw);
                 const check = () => {
@@ -5569,6 +5978,55 @@ export class SqliteScopeHost {
                     forkedFrom: r.forked_from ?? null,
                 })), tenantId, vertical);
             },
+            resolvePeerInstance: async (tenantId, callerScopeId, vertical) => {
+                const binding = this.directory.prepare('SELECT target_scope_id, invalidated FROM peer_bindings WHERE tenant_id = ? AND caller_scope_id = ? AND vertical = ?').get(tenantId, callerScopeId, vertical);
+                const rows = this.directory.prepare(`SELECT scope_id, tenant_id, vertical, status, kind, forked_from FROM scopes
+           WHERE tenant_id = ? AND vertical = ?`).all(tenantId, vertical);
+                return resolvePeerInstanceFrom(rows.map((r) => ({
+                    id: r.scope_id,
+                    tenantId: r.tenant_id,
+                    vertical: r.vertical,
+                    status: r.status,
+                    kind: r.kind ?? '',
+                    forkedFrom: r.forked_from,
+                })), tenantId, vertical, binding?.target_scope_id ?? null, binding?.invalidated === 1);
+            },
+            peerBinding: async (actor, tenantId, callerScopeId, vertical) => {
+                const row = this.directory.prepare('SELECT target_scope_id, invalidated FROM peer_bindings WHERE tenant_id = ? AND caller_scope_id = ? AND vertical = ?').get(tenantId, callerScopeId, vertical);
+                this.recordAccess(actor, 'peerBinding', { tenantId, scopeId: callerScopeId }, { vertical }, row ? 1 : 0);
+                return row ? { tenantId, callerScopeId, vertical, targetScopeId: row.target_scope_id, invalidated: row.invalidated === 1 } : undefined;
+            },
+            peerBindings: async (actor, tenantId, callerScopeId) => {
+                const rows = this.directory.prepare('SELECT vertical, target_scope_id, invalidated FROM peer_bindings WHERE tenant_id = ? AND caller_scope_id = ? ORDER BY vertical').all(tenantId, callerScopeId);
+                this.recordAccess(actor, 'peerBindings', { tenantId, scopeId: callerScopeId }, null, rows.length);
+                return rows.map((r) => ({ tenantId, callerScopeId, vertical: r.vertical, targetScopeId: r.target_scope_id, invalidated: r.invalidated === 1 }));
+            },
+            setPeerBinding: async (_actor, tenantId, callerScopeId, vertical, targetScopeId) => this.directory.transaction(() => {
+                const caller = this.directory.prepare('SELECT tenant_id, status, kind, forked_from FROM scopes WHERE scope_id = ?').get(callerScopeId);
+                if (!caller || caller.tenant_id !== tenantId || caller.status !== 'active' || !isPrimaryScopeRow(caller)) {
+                    throw substratError('not_found', 'calling app is not a live primary scope in this tenant');
+                }
+                if (targetScopeId !== null) {
+                    const target = this.directory.prepare('SELECT tenant_id, vertical, status, kind, forked_from FROM scopes WHERE scope_id = ?').get(targetScopeId);
+                    if (!target || target.tenant_id !== tenantId || target.vertical !== vertical || target.status !== 'active' || !isPrimaryScopeRow(target)) {
+                        throw substratError('not_found', 'target is not a live primary instance of this vertical in this tenant');
+                    }
+                }
+                const key = [tenantId, callerScopeId, vertical];
+                const before = this.directory.prepare('SELECT target_scope_id, invalidated FROM peer_bindings WHERE tenant_id = ? AND caller_scope_id = ? AND vertical = ?').get(...key);
+                const previous = before?.target_scope_id;
+                if ((previous ?? null) === targetScopeId && before?.invalidated !== 1)
+                    return { changed: false, previous: previous ?? null };
+                if (targetScopeId === null) {
+                    this.directory.prepare('DELETE FROM peer_bindings WHERE tenant_id = ? AND caller_scope_id = ? AND vertical = ?').run(...key);
+                }
+                else {
+                    this.directory.prepare(`INSERT INTO peer_bindings (tenant_id, caller_scope_id, vertical, target_scope_id)
+               VALUES (?, ?, ?, ?) ON CONFLICT (tenant_id, caller_scope_id, vertical)
+               DO UPDATE SET target_scope_id = excluded.target_scope_id, invalidated = 0`).run(...key, targetScopeId);
+                }
+                return { changed: true, previous: previous ?? null };
+            })(),
             resolveHostname: async (raw) => {
                 // The router's per-request read. No actor, not logged — same carve-out as
                 // resolveIdentity (K-24): this is a machine path, not a staff read.
@@ -5649,6 +6107,9 @@ export class SqliteScopeHost {
                     installSpec.provisions = parsed.provisions;
                 if (parsed.sendsEmail)
                     installSpec.sendsEmail = parsed.sendsEmail;
+                // Where the scope lifecycle is held (#1713) — read by the lifecycle delivery's targets.
+                if (parsed.lifecycle)
+                    installSpec.lifecycle = parsed.lifecycle;
                 if (parsed.surfaces)
                     installSpec.surfaces = parsed.surfaces;
                 const installSpecJson = Object.keys(installSpec).length ? JSON.stringify(installSpec) : null;
@@ -6041,6 +6502,11 @@ export class SqliteScopeHost {
                 if (opts?.expectedVersionId !== undefined && scope.vertical_version_id !== opts.expectedVersionId) {
                     throw substratError('precondition_failed', 'scope binding changed; reload the scope and retry');
                 }
+                const epoch = this.directory.prepare('SELECT COALESCE(erasure_epoch, 0) AS erasure_epoch FROM scopes WHERE tenant_id = ? AND scope_id = ?')
+                    .get(tenantId, scopeId);
+                if (opts?.expectedErasureEpoch !== undefined && epoch?.erasure_epoch !== opts.expectedErasureEpoch) {
+                    throw substratError('precondition_failed', 'scope erasure changed; reload the scope and retry');
+                }
                 const ack = bindAcknowledgement.parse(opts?.acknowledge ?? {});
                 // #1756: an export an app in this tenant imports, dropped or re-versioned by what this
                 // scope would run. Before the snapshot, so a refused bind leaves nothing behind.
@@ -6058,12 +6524,7 @@ export class SqliteScopeHost {
                         await this.snapshotScope(actor, tenantId, scopeId);
                     }
                 }
-                const update = opts?.expectedVersionId === undefined
-                    ? this.directory.prepare('UPDATE scopes SET vertical_version_id = ?, vertical = ? WHERE scope_id = ?')
-                        .run(versionId, v.verticalSlug, scopeId)
-                    : this.directory.prepare('UPDATE scopes SET vertical_version_id = ?, vertical = ? WHERE scope_id = ? AND vertical_version_id IS ?')
-                        .run(versionId, v.verticalSlug, scopeId, opts.expectedVersionId);
-                if (update.changes === 0) {
+                if (!this.moveScopeRow('vertical_version_id = ?, vertical = ?', [versionId, v.verticalSlug], tenantId, scopeId, opts)) {
                     throw substratError('precondition_failed', 'scope binding changed; reload the scope and retry');
                 }
                 this.recordAdmin(actor, 'bindScopeVersion', { tenantId, scopeId }, null, {
@@ -6074,6 +6535,88 @@ export class SqliteScopeHost {
                     ...(ack.exportBreak ? { acknowledged: ack } : {}),
                 });
             },
+            recordScopeScriptCopy: async (_actor, tenantId, scopeId, scriptRef, moveId, opts) => {
+                if (!scriptRef || !moveId)
+                    throw substratError('conflict', 'copy script and move must name a real script');
+                const result = this.directory.prepare(`INSERT INTO scope_script_copies (tenant_id, scope_id, script_ref, move_id, state, role, load_stamp, lease_until)
+           SELECT tenant_id, scope_id, ?, ?, 'pending', ?, ?, ? FROM scopes
+           WHERE tenant_id = ? AND scope_id = ? AND reap_claimed_at IS NULL
+           ON CONFLICT (tenant_id, scope_id, script_ref, move_id) DO NOTHING`).run(scriptRef, moveId, opts?.role ?? null, opts?.loadStamp ?? null, new Date(Date.now() + (opts?.leaseMs ?? SCOPE_COPY_LEASE_MS)).toISOString(), tenantId, scopeId);
+                if (result.changes > 0)
+                    return;
+                const scope = this.directory.prepare('SELECT reap_claimed_at FROM scopes WHERE tenant_id = ? AND scope_id = ?')
+                    .get(tenantId, scopeId);
+                if (!scope)
+                    throw substratError('not_found', `unknown scope ${scopeId} in tenant ${tenantId}`);
+                if (scope.reap_claimed_at !== null)
+                    throw substratError('precondition_failed', `scope ${scopeId} is being reaped`);
+            },
+            claimExpiredScopeScriptCopies: async (_actor, input) => {
+                const limit = assertRowLimit('limit', input.limit);
+                return this.directory.transaction(() => {
+                    const due = this.directory.prepare(COPY_EXPIRED_SQL).all(input.now, limit);
+                    const claimed = [];
+                    for (const r of due) {
+                        if (this.directory.prepare(COPY_CLAIM_SQL).run(input.owner, input.leaseUntil, r.tenant_id, r.scope_id, r.script_ref, r.move_id, input.now).changes === 0)
+                            continue;
+                        claimed.push(this.directory.prepare(`SELECT ${SCOPE_SCRIPT_COPY_COLUMNS} FROM scope_script_copies
+               WHERE tenant_id = ? AND scope_id = ? AND script_ref = ? AND move_id = ?`).get(r.tenant_id, r.scope_id, r.script_ref, r.move_id));
+                    }
+                    return claimed.map(scopeScriptCopyOf);
+                })();
+            },
+            beginScopeScriptReap: async (_actor, tenantId, scopeId) => {
+                const result = this.directory.prepare(`UPDATE scopes SET reap_claimed_at = strftime('%Y-%m-%dT%H:%M:%fZ','now')
+           WHERE tenant_id = ? AND scope_id = ? AND reap_claimed_at IS NULL
+             AND NOT EXISTS (SELECT 1 FROM scope_script_copies AS move
+               WHERE move.tenant_id = scopes.tenant_id AND move.scope_id = scopes.scope_id
+                 AND move.state = 'pending')`).run(tenantId, scopeId);
+                if (result.changes > 0)
+                    return;
+                const scope = this.directory.prepare('SELECT reap_claimed_at FROM scopes WHERE tenant_id = ? AND scope_id = ?')
+                    .get(tenantId, scopeId);
+                if (!scope)
+                    throw substratError('not_found', `unknown scope ${scopeId} in tenant ${tenantId}`);
+                if (scope.reap_claimed_at !== null)
+                    return; // a reaper resumes its earlier claim
+                throw substratError('precondition_failed', `scope ${scopeId} has a copy move in flight; retry reap after it settles`);
+            },
+            settleScopeScriptCopy: async (_actor, tenantId, scopeId, scriptRef, moveId, state, marker, opts) => this.directory.prepare(`UPDATE scope_script_copies SET state = ?, load_stamp = ?, revision = ?,
+             last_attempt_at = strftime('%Y-%m-%dT%H:%M:%fZ','now')
+           WHERE tenant_id = ? AND scope_id = ? AND script_ref = ? AND move_id = ?
+             AND (state <> 'done' OR ? = 'done')
+             ${opts?.claimedBy === undefined ? '' : "AND state = 'pending' AND lease_owner = ?"}`).run(state, marker?.loadStamp ?? null, marker?.revision ?? null, tenantId, scopeId, scriptRef, moveId, state, ...(opts?.claimedBy === undefined ? [] : [opts.claimedBy])).changes > 0,
+            touchScopeScriptCopy: async (_actor, tenantId, scopeId, scriptRef, moveId) => {
+                this.directory.prepare(`UPDATE scope_script_copies SET last_attempt_at = strftime('%Y-%m-%dT%H:%M:%fZ','now')
+           WHERE tenant_id = ? AND scope_id = ? AND script_ref = ? AND move_id = ? AND state = 'eligible'`).run(tenantId, scopeId, scriptRef, moveId);
+            },
+            listScopeScriptCopies: async (_actor, filter) => {
+                const where = [];
+                const args = [];
+                if (filter.tenantId) {
+                    where.push('tenant_id = ?');
+                    args.push(filter.tenantId);
+                }
+                if (filter.scopeId) {
+                    where.push('scope_id = ?');
+                    args.push(filter.scopeId);
+                }
+                if (filter.state) {
+                    where.push('state = ?');
+                    args.push(filter.state);
+                }
+                if (filter.after) {
+                    if (!filter.tenantId || !filter.scopeId)
+                        throw substratError('validation_failed', 'copy cursor requires tenant and scope');
+                    where.push('(script_ref > ? OR (script_ref = ? AND move_id > ?))');
+                    args.push(filter.after.scriptRef, filter.after.scriptRef, filter.after.moveId);
+                }
+                const limit = assertRowLimit('limit', filter.limit ?? 100);
+                const order = filter.scopeId ? 'script_ref, move_id' : 'last_attempt_at, tenant_id, scope_id, script_ref';
+                const rows = this.directory.prepare(`SELECT ${SCOPE_SCRIPT_COPY_COLUMNS} FROM scope_script_copies ${where.length ? `WHERE ${where.join(' AND ')}` : ''}
+           ORDER BY ${order} LIMIT ?`).all(...args, limit);
+                return rows.map(scopeScriptCopyOf);
+            },
             /**
              * Record that this scope's provision has now run against `versionId` (#1172).
              * Written only after a provision or reconcile succeeded — a receipt, never a hope.
@@ -6151,9 +6694,9 @@ export class SqliteScopeHost {
                     if (breaks.length > 0)
                         throw substratError('precondition_failed', bindExportBreakRefusal(breaks));
                 }
-                this.directory
-                    .prepare('UPDATE scopes SET serving_ref = ? WHERE scope_id = ?')
-                    .run(servingRef, scopeId);
+                if (!this.moveScopeRow('serving_ref = ?', [servingRef], tenantId, scopeId, opts)) {
+                    throw substratError('precondition_failed', 'scope erasure or reap changed; reload and retry');
+                }
                 this.recordAdmin(actor, 'setScopeServingRef', { tenantId, scopeId }, { servingRef: scope.serving_ref }, { servingRef, ...(ack.exportBreak ? { acknowledged: ack } : {}) });
             },
             recordKeptCopyResolution: async (actor, tenantId, scopeId, r) => {
@@ -6258,10 +6801,20 @@ export class SqliteScopeHost {
                 this.assertScopeReachable(tenantId, scopeId);
                 const rec = this.directory.prepare('SELECT vertical FROM scopes WHERE scope_id = ?').get(scopeId);
                 const source = await importCursorSourceOf((t, v) => this.admin.resolveVerticalInstance(t, v), { tenantId, scopeId, vertical: rec.vertical }, move.from);
+                // #2114: the replay's id is also its audit `operationId`, so the scheduled settle pairs
+                // and closes the lever's rows exactly as it does the kill switches'.
                 const replayId = ulid();
                 const target = { tenantId, scopeId };
-                const base = { replayId, mode: move.mode, from: move.from, source: source.scopeId };
+                const base = { operationId: replayId, replayId, mode: move.mode, from: move.from, source: source.scopeId };
                 this.recordAdmin(actor, 'moveImportCursor', target, null, { ...base, phase: 'intent', reason: move.reason });
+                // #2114: every outcome row goes through the kernel's `recordAuditOutcome`, exactly as the
+                // Cloudflare adapter and the kill switches (#2089): logged when it cannot be written, never
+                // swallowed, and never in place of the move's own error or result.
+                const recordOutcome = (row) => recordAuditOutcome(() => this.recordAdmin(actor, 'moveImportCursor', target, null, { ...base, ...row }), {
+                    flow: 'import-cursor',
+                    operationId: replayId,
+                    phase: row.phase,
+                }, (message, fields) => console.error(message, fields));
                 let moved;
                 try {
                     const rt = this.runtime(tenantId, scopeId);
@@ -6271,26 +6824,16 @@ export class SqliteScopeHost {
                     moved = await rt.actor.turn(() => rt.db.transaction(() => moveImportCursor(switchSqlOf(rt.db), { move, source, replayId, now, imports: this.crossVertical.consumes() }))());
                 }
                 catch (err) {
-                    try {
-                        this.recordAdmin(actor, 'moveImportCursor', target, null, {
-                            ...base,
-                            phase: 'failed',
-                            error: err instanceof Error ? err.message : String(err),
-                        });
-                    }
-                    catch {
-                        // Best effort: the original error is what the caller must see.
-                    }
+                    await recordOutcome({ phase: 'failed', error: err instanceof Error ? err.message : String(err) });
                     throw err;
                 }
-                this.recordAdmin(actor, 'moveImportCursor', target, null, {
-                    ...base,
+                const unrecorded = await recordOutcome({
                     phase: 'applied',
                     previous: moved.previous,
                     cursor: moved.cursor,
                     archived: moved.archived,
                 });
-                return moved;
+                return unrecorded === null ? moved : { ...moved, auditWarning: auditWarningOf('the move', unrecorded) };
             },
             redrainEvents: async (actor, tenantId, scopeId, input) => {
                 // Directory check first, on mark's reasoning: "nothing to reopen" and "you may not
@@ -6870,7 +7413,8 @@ export class SqliteScopeHost {
               WHERE type = 'table' AND name NOT GLOB 'sqlite_*' AND sql IS NOT NULL
               ORDER BY name`)
                     .all();
-                const tables = defs.map(({ name, sql }) => {
+                const privateTables = new Set(['private_continuation_keys', 'private_continuation_positions']);
+                const tables = defs.filter(({ name }) => !privateTables.has(name)).map(({ name, sql }) => {
                     const stmt = this.directory.prepare(`SELECT * FROM "${name}"`).raw(true);
                     const rows = stmt.all();
                     const columns = stmt.columns().map((c) => c.name);
@@ -6888,7 +7432,11 @@ export class SqliteScopeHost {
                 // as identifiers, and its `ddl`, never executed here since #1912, is still held to one
                 // CREATE TABLE. Judged as a whole before the first DROP, so a refused dump leaves the
                 // directory untouched.
-                assertReplayableDump(dump.tables);
+                // Older backup producers and local migration fixtures may include these
+                // tables. Ignore them entirely: neither their DDL nor their rows may set
+                // a restored key epoch or make an old hidden locator valid again.
+                const publicTables = dump.tables.filter((table) => !['private_continuation_keys', 'private_continuation_positions'].includes(table.name.toLowerCase()));
+                assertReplayableDump(publicTables);
                 // One transaction, foreign keys deferred to commit: the dump is ordered by table NAME
                 // (which says nothing about references — a `tenants` row can name another as
                 // `provisioned_by_tenant`), and the DROPs themselves delete rows a populated child would
@@ -6911,7 +7459,7 @@ export class SqliteScopeHost {
                     this.buildDirectorySchema();
                     // Refuses a table this code does not build, adds unknown columns bare, loads the rows
                     // by name, then the legacy scope and #1674 backfills, all inside this transaction.
-                    loadDirectoryDump(dump.tables, {
+                    loadDirectoryDump(publicTables, {
                         columnsOf: (name) => builtColumnsOf(this.directory, name),
                         exec: (sql) => this.directory.exec(sql),
                         now: () => this.clock(),
@@ -7028,6 +7576,10 @@ export class SqliteScopeHost {
                 // and transaction facts remain". A consumer's timeline still shows that something
                 // happened, to what, and when; it no longer shows who or what was said.
                 const db = this.scopeDbFor(tenantId, scopeId);
+                // #2068: the module half reaches the scope's own tables, so they have to exist — the
+                // same migrations an invoke would apply first.
+                const rt = this.runtime(tenantId, scopeId);
+                await this.applyPendingMigrations(rt);
                 // One instant for the whole erasure, read before the first write: the intent
                 // tombstones below and the key's own tombstone should not disagree about when a
                 // person was erased.
@@ -7035,8 +7587,24 @@ export class SqliteScopeHost {
                 // Both scope-side redactions in ONE turn on the scope actor (#1678): issued while an
                 // invoke held its transaction open, they joined it, and its rollback put the
                 // person's PII back after this verb had destroyed the key and receipted the erasure.
+                //
+                // And in ONE transaction (#2068): a module's `onSubjectErased` hook that throws rolls
+                // the whole scope side back, the spine redaction with it, and the erasure throws
+                // before the key below is touched — nothing receipts an erasure that did not happen.
                 const scopeSql = redactionSqlOf(db);
-                const { redacted, intentsRedacted, jobRunsRedacted, text } = await this.runtime(tenantId, scopeId).actor.turn(() => ({
+                const { redacted, intentsRedacted, jobRunsRedacted, text, vertical } = await rt.actor.turn(() => db.transaction(() => ({
+                    // The module half first (#2068): the declared entities, then each hook, with the
+                    // search indexes over them under FTS5 secure-delete. The spine half follows in the same
+                    // transaction, so the order between them decides nothing but the reading order.
+                    vertical: eraseSubjectFromModules({
+                        sql: spineSql(db),
+                        plans: this.erasurePlans,
+                        searchPlans: this.searchPlans.values(),
+                        statefulTables: statefulTablesOf(this.statePlans),
+                        subjectId,
+                        at,
+                        migrationSqlOf: (moduleId, version) => this.modules.get(moduleId)?.migrations.find((m) => m.version === version)?.sql,
+                    }),
                     redacted: db
                         .prepare(`UPDATE _substrat_outbox SET payload = NULL
                 WHERE subject_id = ? AND pii_class != 'none' AND payload IS NOT NULL`)
@@ -7059,7 +7627,7 @@ export class SqliteScopeHost {
                     // The free-text copies (#1632), and the tombstoned intents the directory half
                     // follows. Last, so those ids include every intent tombstoned above.
                     text: redactSubjectScopeText(scopeSql, subjectId, at),
-                }));
+                }))());
                 const { idempotencyResults, intentIds } = text;
                 // The directory's failure text (#1632) — a drain failure quoting one of those
                 // intents, an issue's exemplar, a sweep record's error. Before the key, for the
@@ -7071,6 +7639,7 @@ export class SqliteScopeHost {
                     eventsRedacted: redacted.changes,
                     intentsRedacted,
                     jobRunsRedacted,
+                    ...vertical,
                     keyDestroyed: existed,
                     tombstoned: true,
                 });
@@ -7080,9 +7649,34 @@ export class SqliteScopeHost {
                 this.recordAdmin(actor, 'shredSubject', { tenantId, scopeId }, null, receipt);
                 // BOTH counts: the access log's number is "how much evidence this destroyed", and
                 // an intent payload is a whole event's worth of it.
-                this.recordAccess(actor, 'shredSubject', { tenantId, scopeId }, { subjectId }, redacted.changes + intentsRedacted + jobRunsRedacted + idempotencyResults);
+                this.recordAccess(actor, 'shredSubject', { tenantId, scopeId }, { subjectId }, redacted.changes + intentsRedacted + jobRunsRedacted + idempotencyResults + moduleRowsErased(vertical));
                 return receipt;
             },
+            scopeErasureEpoch: async (_actor, tenantId, scopeId) => {
+                // NULL on every row from before the column (#1722): the same 0 every CAS compares against.
+                const row = this.directory.prepare('SELECT COALESCE(erasure_epoch, 0) AS erasure_epoch FROM scopes WHERE tenant_id = ? AND scope_id = ?')
+                    .get(tenantId, scopeId);
+                if (!row)
+                    throw substratError('not_found', `unknown scope ${scopeId} in tenant ${tenantId}`);
+                return row.erasure_epoch;
+            },
+            finalizeSubjectShred: async (actor, tenantId, scopeId, subjectId, redactions, expected) => {
+                if (redactions.length === 0)
+                    throw substratError('conflict', 'subject erasure has no confirmed scope redaction');
+                const claimed = this.directory.prepare(`UPDATE scopes SET erasure_epoch = COALESCE(erasure_epoch, 0) + 1
+           WHERE tenant_id = ? AND scope_id = ? AND vertical_version_id IS ?
+             AND serving_ref IS ? AND COALESCE(erasure_epoch, 0) = ?
+             AND NOT EXISTS (SELECT 1 FROM scope_script_copies AS copy
+               WHERE copy.tenant_id = scopes.tenant_id AND copy.scope_id = scopes.scope_id
+                 AND copy.state = 'pending')
+             AND (SELECT COUNT(*) FROM scope_script_copies AS copy
+               WHERE copy.tenant_id = scopes.tenant_id AND copy.scope_id = scopes.scope_id) = ?`).run(tenantId, scopeId, expected.versionId, expected.servingRef, expected.epoch, expected.copyCount);
+                if (claimed.changes === 0)
+                    throw substratError('precondition_failed', 'scope route or copy inventory changed during subject erasure; retry after it settles');
+                // The pure adapter has one co-located scope store. Its existing atomic shred is
+                // the final local redaction and key destruction, after remote copies confirmed.
+                return this.admin.shredSubject(actor, tenantId, scopeId, subjectId);
+            },
             // -- impersonation (K-42, #868) ----------------------------------------
             beginImpersonation: async (actor, input) => {
                 // Fail closed on the scope before minting anything, exactly as the
@@ -7151,6 +7745,7 @@ export class SqliteScopeHost {
                     '_substrat_system_switches', // #1674: the schedule switch's record, per scope
                     '_substrat_membership_fences', // #1184: the latest removal, per principal
                     '_substrat_peer_switches', // #2029: the peer switch's record, per scope
+                    'peer_bindings', // #1720: a tenant's explicit caller-to-target choices
                     '_substrat_switch_owed', // #2045: subjects owed a re-assert, per scope
                     '_substrat_findings', // #1748: the tenant's findings
                     '_substrat_finding_rules', // #1748: the tenant's suppress rules
@@ -7469,7 +8064,7 @@ export class SqliteScopeHost {
                     .prepare(`UPDATE _substrat_connections
              SET status = 'active', expires_at = ?, last_error = NULL, last_error_at = NULL
              WHERE id = ?`)
-                    .run(expiresAt ?? row.expires_at, id);
+                    .run(expiresAt === undefined ? row.expires_at : expiresAt, id);
                 // The event, never the token. "Rotated at T" is the auditable fact — plus WHO
                 // authorized it when the rotation was a tenant admin's act (§3.5.1's attribution,
                 // rotate-side): the principal, never laundered into the actor column.
@@ -7477,7 +8072,7 @@ export class SqliteScopeHost {
                     id,
                     provider: row.provider,
                     rotatedAt: now,
-                    expiresAt: expiresAt ?? row.expires_at,
+                    expiresAt: expiresAt === undefined ? row.expires_at : expiresAt,
                     ...(opts?.rotatedBy ? { rotatedBy: opts.rotatedBy } : {}),
                 });
             },
@@ -7508,6 +8103,51 @@ export class SqliteScopeHost {
                     .run(now, id);
                 this.recordAdmin(actor, 'revokeConnection', { tenantId: row.tenant_id, vertical: row.vertical }, { status: row.status }, { id, provider: row.provider, status: 'revoked', revokedAt: now });
             },
+            // -- a vertical's mailed connect links (connections.md §3.5.4) --------------
+            // The statements are the kernel's (`connect-links.ts`), shared with the hosted
+            // adapter; what is here is the clock, the parse at the edge, and the transaction:
+            // each move commits with the audit row it hands back, or not at all.
+            mintConnectLink: async (actor, raw) => {
+                const input = mintConnectLinkInput.parse(raw);
+                return this.auditedConnectLink(actor, (sql, audit) => insertConnectLink(sql, {
+                    id: ulid(),
+                    tenantId: input.tenantId,
+                    scopeId: input.scopeId,
+                    vertical: input.vertical,
+                    provider: input.provider,
+                    createdBy: input.createdBy,
+                    subjectRef: input.subjectRef ?? null,
+                    returnUrl: input.returnUrl ?? null,
+                    createdAt: this.clock(),
+                    expiresAt: input.expiresAt,
+                }, audit));
+            },
+            getConnectLink: async (actor, raw) => {
+                const key = connectLinkKey.parse(raw);
+                const link = readConnectLink(redactionSqlOf(this.directory), key);
+                this.recordAccess(actor, 'getConnectLink', key, { id: key.id }, link ? 1 : 0);
+                return link;
+            },
+            listConnectLinks: async (actor, raw) => {
+                const filter = connectLinkFilter.parse(raw);
+                const links = listConnectLinkRows(redactionSqlOf(this.directory), filter, this.clock());
+                this.recordAccess(actor, 'listConnectLinks', filter, filter, links.length);
+                return links;
+            },
+            revokeConnectLink: async (actor, raw) => {
+                const key = connectLinkKey.parse(raw);
+                // Idempotent, and a no-op is not audited (the statement hands back no row for one).
+                return this.auditedConnectLink(actor, (sql, audit) => revokeConnectLinkRow(sql, key, audit))?.link;
+            },
+            consumeConnectLink: async (actor, raw) => {
+                const input = consumeConnectLinkInput.parse(raw);
+                return this.auditedConnectLink(actor, (sql, audit) => consumeConnectLinkRow(sql, input, this.clock(), audit));
+            },
+            restoreConnectLink: async (actor, raw) => {
+                const key = connectLinkKey.parse(raw);
+                const link = this.auditedConnectLink(actor, (sql, audit) => restoreConnectLinkRow(sql, key, this.clock(), audit));
+                return link !== undefined;
+            },
             openConnection: async (tenantId, vertical, provider, externalAccountRef) => {
                 const rows = this.directory
                     .prepare(`SELECT * FROM _substrat_connections
@@ -7660,6 +8300,10 @@ export class SqliteScopeHost {
                 const { tenantId, scopeId, ...after } = memberChangeAudit.parse(entry);
                 this.recordAdmin(actor, 'manageScopeMember', { tenantId, scopeId }, null, after);
             },
+            recordPeerBindingChange: async (actor, entry) => {
+                const { tenantId, scopeId, ...after } = peerBindingAudit.parse(entry);
+                this.recordAdmin(actor, 'setPeerBinding', { tenantId, scopeId }, null, after);
+            },
             /** #2005: one change to a scope's copy marker, written around the vertical's own change. */
             recordCopyMark: async (actor, entry) => {
                 const { tenantId, scopeId, action, ...after } = copyMarkAudit.parse(entry);
@@ -7800,52 +8444,24 @@ export class SqliteScopeHost {
                 }));
             },
             recordOpsFailure: async (entry) => {
-                const at = new Date().toISOString();
-                const fingerprint = opsFailureFingerprint(entry);
-                // #1748: the evidence, its issue and its finding in ONE transaction — a detector that
-                // throws takes the evidence with it, so the caller's retry observes it rather than finding
-                // the row already there and the observation lost.
-                this.directory.transaction(() => {
-                    this.directory
-                        .prepare(`INSERT INTO _substrat_ops_failures
-                 (id, actor, operation, stage, tenant_id, scope_id, vertical, version, status, message, reference, origin, code, fingerprint, at)
-               VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`)
-                        .run(ulid(), entry.actor, entry.operation, entry.stage ?? null, entry.tenantId ?? null, entry.scopeId ?? null, entry.vertical ?? null, entry.version ?? null, entry.status ?? null, 
-                    // Bounded here, not trusted from the catch site: one runaway upstream
-                    // body must not become a runaway directory row (#559).
-                    entry.message.slice(0, 2000), entry.reference ?? null, entry.origin ?? null, entry.code ?? null, fingerprint, at);
-                    // Prune-on-write (#559): retention lives here, not in a cron — every insert
-                    // pays for its own housekeeping, so the table stays bounded even where no
-                    // scheduled pass runs (this adapter has none).
-                    const horizon = new Date(Date.now() - OPS_FAILURE_RETENTION_DAYS * 86_400_000).toISOString();
-                    this.directory.prepare('DELETE FROM _substrat_ops_failures WHERE at < ?').run(horizon);
-                    // The issues materialization (#1233): the group's counters live on their
-                    // own row, bumped in the same call, because the evidence self-prunes above
-                    // and a count must survive its own exemplars. A fresh arrival regresses a
-                    // resolved issue; an ignored one stays ignored — that is what ignoring means.
-                    this.directory
-                        .prepare(`INSERT INTO _substrat_issues
-                 (fingerprint, operation, stage, origin, code, status, seen_count, first_seen, last_seen, last_message, last_tenant_id, last_owner_kind, last_vertical, last_version, resolved_version, resolved_at)
-               VALUES (?, ?, ?, ?, ?, 'new', 1, ?, ?, ?, ?, ?, ?, ?, NULL, NULL)
-               ON CONFLICT (fingerprint) DO UPDATE SET
-                 seen_count = seen_count + 1,
-                 last_seen = excluded.last_seen,
-                 last_message = excluded.last_message,
-                 last_tenant_id = excluded.last_tenant_id,
-                 last_owner_kind = excluded.last_owner_kind,
-                 last_vertical = COALESCE(excluded.last_vertical, last_vertical),
-                 last_version = COALESCE(excluded.last_version, last_version),
-                 origin = COALESCE(excluded.origin, origin),
-                 status = CASE WHEN status = 'resolved' THEN 'regressed' ELSE status END`)
-                        .run(fingerprint, entry.operation, entry.stage ?? null, entry.origin ?? null, entry.code ?? null, at, at, entry.message.slice(0, 2000), entry.tenantId ?? null, issueExemplarOwner(entry.tenantId ?? null), entry.vertical ?? null, entry.version ?? null);
-                    const issueHorizon = new Date(Date.now() - ISSUE_RETENTION_DAYS * 86_400_000).toISOString();
-                    this.directory.prepare('DELETE FROM _substrat_issues WHERE last_seen < ?').run(issueHorizon);
-                    // #1748: the tenant's Recurring finding, over the tenant's own occurrences only.
-                    const finding = findingOfOpsFailure(entry);
-                    if (finding)
-                        observeFinding(redactionSqlOf(this.directory), finding, at);
-                })();
+                this.writeOpsFailure(entry);
             },
+            /** #2064: an audited operation's rows, by the operation-id index, in bounded batches. */
+            auditedOperations: async (actor, refs) => {
+                const rows = readAuditedOperations((sql, params) => this.directory.prepare(sql).all(...params), refs);
+                this.recordAccess(actor, 'auditedOperations', {}, { operations: refs.length }, rows.length);
+                return rows;
+            },
+            /** #2064: settle an intent with no outcome, in one transaction — see `audit-outcome.ts`. */
+            settleUnrecordedOutcome: async (actor, input) => this.directory.transaction(() => {
+                const row = this.directory.prepare(SETTLE_INTENT_SQL).get(input.intentId);
+                const outcome = unknownOutcomeOf(row, input.intentId, input.error);
+                if (this.directory.prepare(SETTLE_OUTCOME_SQL).get(...settleOutcomeParamsOf(outcome.operation)))
+                    return false;
+                this.recordAdmin(actor, outcome.action, outcome.target, null, outcome.after);
+                this.writeOpsFailure({ ...outcome.failure, actor });
+                return true;
+            })(),
             listOpsFailures: async (actor, filter) => {
                 const where = [];
                 const params = [];
@@ -8125,13 +8741,43 @@ export class SqliteScopeHost {
      * directory. `PRAGMA table_info` is available in the pure adapter (the DO adapter
      * has to attempt-and-tolerate instead — see its `ensureDirectoryColumns`).
      */
+    /**
+     * Move a scope's binding or route (#1722), conditionally: on the binding the caller read, on
+     * the erasure epoch its carry read (a NULL epoch, from before the column, is 0) with no reap
+     * claimed, and on its copy move still owning a live lease. The move's confirmation commits in
+     * the same transaction as the row. False when any condition failed and nothing was written.
+     */
+    moveScopeRow(set, setArgs, tenantId, scopeId, cond) {
+        const now = new Date().toISOString();
+        return this.directory.transaction(() => {
+            const moved = this.directory.prepare(`UPDATE scopes SET ${set} WHERE scope_id = ?
+         ${cond?.expectedVersionId === undefined ? '' : 'AND vertical_version_id IS ?'}
+         ${cond?.expectedErasureEpoch === undefined ? '' : 'AND COALESCE(erasure_epoch, 0) = ? AND reap_claimed_at IS NULL'}
+         ${cond?.confirmMove === undefined ? '' : COPY_MOVE_LIVE_PREDICATE}`).run(...setArgs, scopeId, ...(cond?.expectedVersionId === undefined ? [] : [cond.expectedVersionId]), ...(cond?.expectedErasureEpoch === undefined ? [] : [cond.expectedErasureEpoch]), ...(cond?.confirmMove === undefined ? [] : copyMoveLiveParams(cond.confirmMove, now)));
+            if (moved.changes === 0)
+                return false;
+            if (cond?.confirmMove) {
+                this.directory.prepare(COPY_MOVE_CONFIRM_SQL).run(...copyMoveConfirmParams(cond.confirmMove, tenantId, scopeId, now));
+            }
+            return true;
+        })();
+    }
     ensureColumn(db, table, column, ddl) {
         // Without case, as SQLite resolves a column name: a restore may have added this column
         // already, untyped and spelled as a newer kernel's dump spelled it (#1883).
         const existing = db.prepare(`PRAGMA table_info(${table})`).all().some((c) => c.name.toLowerCase() === column.toLowerCase());
         if (existing)
             return false;
-        db.exec(`ALTER TABLE ${table} ADD COLUMN ${ddl}`);
+        try {
+            db.exec(`ALTER TABLE ${table} ADD COLUMN ${ddl}`);
+        }
+        catch (err) {
+            // A second opener of the same file can add it between the PRAGMA and here (#2066 review):
+            // the column is there, which is all this wanted. The DO's ALTER pass tolerates it the same way.
+            if (!/duplicate column name/i.test(err.message))
+                throw err;
+            return false;
+        }
         return true;
     }
     /**
@@ -8166,7 +8812,7 @@ export class SqliteScopeHost {
         // behind an empty table `CREATE TABLE IF NOT EXISTS` put back. `db.transaction`
         // nests as a SAVEPOINT, which is what makes this safe on the `loadDump` path too,
         // where the whole replay is already inside one.
-        db.transaction(() => db.exec(script))();
+        db.transaction(() => execSqlStatements(db, script))();
     }
     /**
      * #1573: run a create-copy-drop-rename against the directory as ONE transaction.
@@ -8186,7 +8832,7 @@ export class SqliteScopeHost {
      * capture one.
      */
     rebuildAtomically(script) {
-        this.directory.transaction(() => this.directory.exec(script))();
+        this.directory.transaction(() => execSqlStatements(this.directory, script))();
     }
     /**
      * Rebuild `_substrat_identities` when it still carries the pre-K-22 global key.
@@ -8233,7 +8879,8 @@ export class SqliteScopeHost {
      * constraint in place, so this is the same create-copy-drop-rename the identity key
      * uses, detected the same way — from `sqlite_master.sql`, which works on DO SQLite
      * too. Rows are copied verbatim: the log stays append-only in content, this only
-     * widens what a future row may say.
+     * widens what a future row may say. The DROP takes every index on the table with it, so
+     * the same transaction rebuilds them from the kernel's list (#2064).
      */
     ensureAdminLogTenantNullable() {
         const row = this.directory
@@ -8260,6 +8907,7 @@ export class SqliteScopeHost {
         FROM _substrat_admin_log;
       DROP TABLE _substrat_admin_log;
       ALTER TABLE _substrat_admin_log_new RENAME TO _substrat_admin_log;
+      ${ADMIN_LOG_INDEXES_SQL}
     `);
     }
     /**
@@ -8300,6 +8948,8 @@ export class SqliteScopeHost {
         // #1172: which version this scope's provision hook last ran against. Null on every
         // existing row, which reads as "unknown, reconcile once" rather than "up to date".
         this.ensureColumn(this.directory, 'scopes', 'provisioned_version_id', 'provisioned_version_id TEXT');
+        this.ensureColumn(this.directory, 'scopes', 'erasure_epoch', 'erasure_epoch INTEGER');
+        this.ensureColumn(this.directory, 'scopes', 'reap_claimed_at', 'reap_claimed_at TEXT');
         // §4.8's grace-window timestamp on tenants (mirrors scopes' archived_at).
         this.ensureColumn(this.directory, 'tenants', 'deleting_at', 'deleting_at TEXT');
         this.ensureColumn(this.directory, 'tenants', 'provisioned_by_tenant', 'provisioned_by_tenant TEXT REFERENCES tenants(tenant_id)');
@@ -8460,7 +9110,12 @@ export class SqliteScopeHost {
      */
     at = this.clock(), 
     /** #2055: the delivery a consumer's or an import's context runs for; absent otherwise. */
-    delivery) {
+    delivery, 
+    /**
+     * #119: keys this context's checks refuse whatever the subject holds — a module's
+     * purge-only keys, outside the purge sweep's own invoke (`purgeOnlyKeysOf`).
+     */
+    withheld) {
         // For a connection, system, capability or peer-vertical subject this carries THAT id so
         // the type holds — it is not a person, and the event actor below says what it is instead.
         const principal = subject.id;
@@ -8527,6 +9182,9 @@ export class SqliteScopeHost {
             // #1642: parsed before the override actor's early return, which never reaches
             // the checker — a cast key would otherwise become that path's proof relation.
             const permission = assertPermissionKey(unparsed);
+            if (withheld?.has(permission)) {
+                return { allowed: false, checked: permission, node: { tenantId: rt.tenantId, scopeId: rt.scopeId } };
+            }
             if (overrideActor) {
                 return {
                     allowed: true,
@@ -8602,10 +9260,12 @@ export class SqliteScopeHost {
             tenantId: rt.tenantId,
             scopeId: rt.scopeId,
             principal,
+            pageContinuation: (list, query) => visibleContinuation(this.continuationStore(rt.scopeId, impersonation?.mode !== 'read-only' && this.isPrimaryInDirectory(rt.scopeId)), { scopeId: rt.scopeId, principal: `${subject.kind}:${subject.id}`, operation: operation ?? 'kernel', list, query }, () => Date.parse(this.clock()), () => ctxRef.log.info('legacy filtered-list cursor accepted', { list }), impersonation?.mode !== 'read-only' && this.isPrimaryInDirectory(rt.scopeId)),
             sql: guardSecrets(guardSqlLimits(scopedSql(rt.db, true, statefulTablesOf(statePlans), 
-            // #119: after runtime DDL, the stateful tables must still carry what the kernel derived.
-            statePlans.size
-                ? () => assertEntityStateIntact(spineSql(rt.db), statePlans, stateListIndexNames(listPlans.values()))
+            // #119 / #2090: after runtime DDL, inside this operation's transaction, what the kernel
+            // derived onto any table is repaired — and a lost state column fails the operation.
+            derivesAnything(this.derivedPlans())
+                ? () => afterRuntimeDdl(spineSql(rt.db), (ddl) => execSqlStatements(rt.db, ddl), this.derivedPlans())
                 : undefined)), minted),
             now: () => at,
             // #1746/#1747: the host stamps who and where; module code supplies only the template
@@ -8665,6 +9325,10 @@ export class SqliteScopeHost {
                 return entityVersionOf(rt.db.prepare(q.sql).all(...q.params));
             },
             check: runCheck,
+            grantedEntities: async (unparsed, entityType, options) => {
+                const permission = assertPermissionKey(unparsed);
+                return grantedEntitiesForContext(checker, subject, permission, { tenantId: rt.tenantId, scopeId: rt.scopeId }, entityType, options, runCheck, withheld, Boolean(overrideActor));
+            },
             canAssign: runCanAssign,
             /**
              * #827. The plan is registration state, the index is scope state: an entity
@@ -8703,16 +9367,14 @@ export class SqliteScopeHost {
                     view: uncheckedView('ctx.page', entityType, params.view),
                 });
                 const rows = rt.db.prepare(q.sql).all(...q.params);
-                // A FULL page may have more; a short one is the end of the walk. Same rule
-                // as `pageOf`, applied here because the cursor is a COLUMN's value (plus
-                // the tie-break) rather than a field the caller could name.
-                const last = rows.length >= limit ? rows[rows.length - 1] : undefined;
-                const nextCursor = last === undefined ? null : cursorOf(last, q.sortColumn, plan.idColumn, q.order, q.view);
-                const page = { entries: rows, nextCursor };
+                // `pageOf`'s rule — a FULL page may have more, a short one is the end — with the
+                // cursor minted from the row's COLUMN (plus the tie-break), and each row's own
+                // cursor when asked (#2073: `pageVisible` may stop at a visible row mid-page).
+                const mint = (row) => cursorOf(row, q.sortColumn, plan.idColumn, q.order, q.view);
                 if (!params.total)
-                    return page;
+                    return pageOf(rows, limit, mint, params.rowCursors);
                 const counted = rt.db.prepare(q.countSql).all(...q.countParams);
-                return { ...page, total: counted[0]?.n ?? 0 };
+                return countedPageOf(rows, limit, mint, counted[0]?.n ?? 0, params.rowCursors);
             },
             /**
              * Narrow a permission this caller already holds onto one entity (#K-sharing).
@@ -8741,10 +9403,8 @@ export class SqliteScopeHost {
                     throw new PermissionDenied(`cannot grant '${permission}' on ${entity.entityType}:${entity.entityId} — ` +
                         'the caller does not hold it there (a grant delegates, it never elevates)');
                 }
-                rt.db
-                    .prepare(`INSERT OR IGNORE INTO _substrat_tuples (subject, relation, object)
-             VALUES (?, ?, ?)`)
-                    .run(`principal:${principal}`, `granted:${permission}`, `${entity.entityType}:${entity.entityId}`);
+                // #2071: an explicit grant, so it clears a tombstone `revoke` left.
+                writeExplicitTupleIn(switchSqlOf(rt.db), `principal:${principal}`, `granted:${permission}`, `${entity.entityType}:${entity.entityId}`, { kind: 'delegated' });
             },
             /**
              * Withdraw a grant this caller could have made. Same guardrails, same reason — but NOT
@@ -8758,9 +9418,10 @@ export class SqliteScopeHost {
                     throw new PermissionDenied(`cannot revoke '${permission}' on ${entity.entityType}:${entity.entityId} — ` +
                         'the caller does not hold it there');
                 }
-                rt.db
-                    .prepare(`DELETE FROM _substrat_tuples WHERE subject = ? AND relation = ? AND object = ?`)
-                    .run(`principal:${principal}`, `granted:${permission}`, `${entity.entityType}:${entity.entityId}`);
+                // K-21 (#2071): a tombstone, never a delete — a declared shape's top-up must be able
+                // to tell a key taken back from one never held.
+                const r = delegatedRevokeSql(principal, permission, `${entity.entityType}:${entity.entityId}`, at);
+                rt.db.prepare(r.sql).run(...r.params);
             },
             atomic: createAtomic(runSub, { passed, signals }),
             // #1672: mint / revoke / list, written once in the kernel. The raw spine seam (this
@@ -8785,6 +9446,7 @@ export class SqliteScopeHost {
                 now: at,
                 emit: (event) => writeEvent(event, 'kernel'),
                 assertWrites: (verb) => assertImpersonationWrites(impersonation, verb),
+                isUnreachableParent: (entity) => isUnreachableParent(spineSql(rt.db), statePlans, entity),
             }),
             // #119: archive and trash, written once in the kernel. The raw seam, because the guarded
             // `ctx.sql` refuses the very columns these write; the operation's own check, so the
@@ -8803,6 +9465,7 @@ export class SqliteScopeHost {
                 searchPlans,
                 statePlans,
                 check: runCheck,
+                continuation: (entityType, params) => ctxRef.pageContinuation(`trash:${entityType}`, { ...params, view: 'trashed' }),
             }),
             // #304: the request-time entitlement read. The pure adapter is single-process, so the
             // directory is local — no projection needed; it reads `_substrat_entitlements` straight,
@@ -8856,56 +9519,109 @@ export class SqliteScopeHost {
         kernelEmitters.set(ctxRef, (event) => writeEvent(event, 'kernel'));
         return ctxRef;
     }
-    async applyPendingMigrations(rt) {
-        const pending = [];
-        for (const mod of this.modules.values()) {
-            for (const migration of mod.migrations) {
-                if (!rt.appliedMigrations.has(`${mod.id}@${migration.version}`)) {
-                    pending.push({ moduleId: mod.id, migration });
-                }
+    /** Every registered module's derivation plans — what `repairDerivedObjects` and its checks read. */
+    derivedPlans() {
+        return { state: this.statePlans, lists: this.listPlans, search: this.searchPlans };
+    }
+    /**
+     * #2090: a pass with nothing pending, once per runtime — check and repair what the kernel
+     * derived onto the scope's tables, in a transaction of its own. Its migrations are journaled
+     * and will never run again, so this is what reaches a scope stripped before the migration
+     * pass checked. A lost state column fails the scope closed like a failed migration, named by
+     * the journaled migration that added the column; every later call tries again and fails again.
+     */
+    async repairDerived(rt) {
+        let failure;
+        await rt.actor.enqueue(() => {
+            rt.db.exec('BEGIN IMMEDIATE');
+            try {
+                repairDerivedObjects(spineSql(rt.db), (ddl) => execSqlStatements(rt.db, ddl), this.derivedPlans(), {
+                    after: 'an applied migration',
+                });
+                rt.db.exec('COMMIT');
+            }
+            catch (err) {
+                rt.db.exec('ROLLBACK');
+                failure = { version: err instanceof StateColumnLost ? err.migration : 'kernel@derived-objects', error: err.message };
             }
+        });
+        if (failure) {
+            this.recordMigrationState(rt, failure);
+            throw migrationFailedError(failure.version, failure.error);
+        }
+        rt.derivedRepaired = true;
+    }
+    async applyPendingMigrations(rt, plan) {
+        const { pending, diverged } = plan ?? (await planMigrations(this.modules.values(), rt.appliedMigrations));
+        if (diverged) {
+            this.recordMigrationState(rt, diverged);
+            throw migrationFailedError(diverged.version, diverged.error);
         }
         // Nothing pending → nothing to record. A scope provisioned before any module
-        // registers legitimately sits at schema_version '0'.
-        if (pending.length === 0)
+        // registers legitimately sits at schema_version '0'. Still, once per runtime, what the
+        // kernel derived onto the tables is checked and repaired (#2090).
+        if (pending.length === 0) {
+            if (!rt.derivedRepaired)
+                await this.repairDerived(rt);
             return;
+        }
         // The failing `module@version` and its cause, captured structurally rather than
         // re-parsed out of the thrown message — the directory record has to name both.
         let failure;
         try {
             await rt.actor.enqueue(() => {
-                for (const { moduleId, migration } of pending) {
+                for (const [i, { moduleId, migration, digest, authored }] of pending.entries()) {
                     const key = `${moduleId}@${migration.version}`;
                     if (rt.appliedMigrations.has(key))
                         continue;
                     rt.db.exec('BEGIN IMMEDIATE');
+                    let recorded = digest;
                     try {
                         const already = rt.db
-                            .prepare('SELECT 1 FROM _substrat_migrations WHERE module_id = ? AND version = ?')
+                            .prepare('SELECT sql_digest FROM _substrat_migrations WHERE module_id = ? AND version = ?')
                             .get(moduleId, migration.version);
-                        if (!already) {
+                        if (already) {
+                            // Applied since this pass read the journal: held to the same digest rule.
+                            const error = migrationDivergence(already.sql_digest, digest, authored);
+                            if (error)
+                                throw new Error(error);
+                            recorded = already.sql_digest;
+                        }
+                        else {
                             const started = performance.now();
                             const before = rt.db.prepare('SELECT total_changes() AS n').get().n;
-                            // #1898: a migration runs on the scope's own handle, not `ctx.sql`, so the
-                            // spine guard's REFERENCES rule is applied here.
-                            assertNoSpineReference(migration.sql, `migration ${key}`);
-                            rt.db.exec(migration.sql);
+                            // #1898, #2066: a migration runs on the scope's own handle, not `ctx.sql`, so the
+                            // spine rules a migration is held to are applied here.
+                            assertMigrationSql(migration.sql, { key, digest, authored });
+                            // #2068: the ownership ledger is the kernel's — no migration may name it, not even to
+                            // read it (the spine rules above allow reads).
+                            assertMigrationLeavesLedgerAlone(migration.sql, `migration ${key}`);
+                            // #2068: one statement at a time, keeping the table set either side of each — the
+                            // same splitter the Durable Object runs, so both hosts execute identical statements.
+                            const steps = runMigrationStatements(spineSql(rt.db), migration.sql, (stmt) => rt.db.exec(stmt));
                             assertTablesWithinColumnLimit(rt.db);
+                            // #2090: the state columns this migration must have left, and after the last of the
+                            // pass, the triggers and indexes a create-copy-rename rebuild dropped.
+                            const last = i === pending.length - 1;
+                            afterMigration(spineSql(rt.db), (ddl) => execSqlStatements(rt.db, ddl), this.derivedPlans(), key, last);
                             const after = rt.db.prepare('SELECT total_changes() AS n').get().n;
+                            // After the count: `rows_changed` is the migration's own, never the kernel's bookkeeping.
+                            recordOwnershipSteps(spineSql(rt.db), moduleId, steps, this.clock());
                             rt.db
-                                .prepare('INSERT INTO _substrat_migrations (module_id, version, applied_at, duration_ms, rows_changed) VALUES (?, ?, ?, ?, ?)')
-                                .run(moduleId, migration.version, this.clock(), Math.max(0, Math.round(performance.now() - started)), after - before);
+                                .prepare('INSERT INTO _substrat_migrations (module_id, version, applied_at, duration_ms, rows_changed, sql_digest) VALUES (?, ?, ?, ?, ?, ?)')
+                                .run(moduleId, migration.version, this.clock(), Math.max(0, Math.round(performance.now() - started)), after - before, digest);
                         }
                         rt.db.exec('COMMIT');
                     }
                     catch (err) {
                         rt.db.exec('ROLLBACK');
                         failure = { version: key, error: err.message };
-                        throw new Error(`migration failed for ${key} — scope fails closed: ${err.message}`);
+                        throw migrationFailedError(key, err.message);
                     }
-                    rt.appliedMigrations.add(key);
+                    rt.appliedMigrations.set(key, recorded);
                 }
             });
+            rt.derivedRepaired = true;
         }
         finally {
             // `finally`, not the success path: a scope that failed closed is exactly the
@@ -9077,9 +9793,16 @@ export class SqliteScopeHost {
         // #1763: old journal rows keep NULL, meaning their cost was never recorded.
         this.ensureColumn(db, '_substrat_migrations', 'duration_ms', 'duration_ms INTEGER');
         this.ensureColumn(db, '_substrat_migrations', 'rows_changed', 'rows_changed INTEGER');
+        // #2066: the rows already there get the legacy mark, never a digest — what they ran was never
+        // measured. KERNEL_DDL's fence keeps any other NULL out, so the mark finds only those.
+        this.ensureColumn(db, '_substrat_migrations', 'sql_digest', 'sql_digest TEXT');
+        db.exec(MIGRATION_DIGEST_MARK_LEGACY);
         // KERNEL_DDL is all IF NOT EXISTS, so a scope DB created before K-21 keeps the
         // old shape — ALTER the tombstone in.
         this.ensureColumn(db, '_substrat_tuples', 'revoked_at', 'revoked_at TEXT');
+        // #2126: NULL keeps every existing capability's attachment behavior unchanged.
+        this.ensureColumn(db, '_substrat_capabilities', 'attachments', 'attachments TEXT');
+        db.exec(GRANT_CHILDREN_INDEX_DDL);
         // Executor retry state (#100), same reasoning: scopes provisioned before it
         // already have the table. Defaults read as "terminal", which is exactly right
         // for the rows already there — every one of them is a completed delivery or a
@@ -9136,6 +9859,9 @@ export class SqliteScopeHost {
         // from the kernel's (now widened) DDL when it runs — so by the time this ALTER
         // executes, the table always already has `kind` in its key, never `invocation_id`.
         this.ensureColumn(db, '_substrat_schedule_state', 'invocation_id', 'invocation_id TEXT');
+        // #2096: a purge horizon's lap in progress, on a scope DB built before the column. NULL is the
+        // start of a lap — the honest reading of every row already there. After the #1288 rebuild, as above.
+        this.ensureColumn(db, '_substrat_schedule_state', 'purge_cursor', 'purge_cursor TEXT');
         this.ensureColumn(db, '_substrat_job_runs', 'subject_id', 'subject_id TEXT');
         // #2034: the lease, on a scope DB built before it. NULL = nobody holds the run.
         this.ensureColumn(db, '_substrat_job_runs', 'lease_owner', 'lease_owner TEXT');
@@ -9171,9 +9897,9 @@ export class SqliteScopeHost {
         // WAL is also what the read connection rests on (#1624): a reader sees the last
         // committed snapshot and never blocks, or is blocked by, the writer.
         db.pragma('journal_mode = WAL');
-        db.exec(KERNEL_DDL);
+        execSqlStatements(db, KERNEL_DDL);
         this.ensureSpineColumns(db);
-        const appliedMigrations = new Set(db.prepare('SELECT module_id, version FROM _substrat_migrations').all().map((r) => `${r.module_id}@${r.version}`));
+        const appliedMigrations = readAppliedMigrations(db);
         // #1335: the floor this scope's ids have to clear is the highest id already in
         // its outbox, not wherever the wall clock happens to be. Read once, here, because
         // this is the one place a scope's runtime is built — a reopened host, a revived
@@ -9191,6 +9917,7 @@ export class SqliteScopeHost {
             reader: null,
             actor: new ScopeActor(),
             appliedMigrations,
+            derivedRepaired: false,
             mintEventId,
             invocationId: null,
         };
@@ -9199,6 +9926,11 @@ export class SqliteScopeHost {
         return created;
     }
 }
+/** A scope's migration journal: `module@version` → the SQL digest it recorded (#2066). */
+function readAppliedMigrations(db) {
+    const rows = db.prepare('SELECT module_id, version, sql_digest FROM _substrat_migrations').all();
+    return new Map(rows.map((r) => [`${r.module_id}@${r.version}`, r.sql_digest]));
+}
 /** The platform spine (`_substrat_*`) and SQLite internals — the UI groups these apart. */
 function isSystemTable(name) {
     return name.startsWith('_substrat') || name.startsWith('sqlite_');
@@ -9228,6 +9960,15 @@ function redactionSqlOf(db) {
  * `_substrat_*`" a mechanism rather than a lint rule (#954) — the kernel's own
  * spine writes use `rt.db` directly and never pass through here.
  */
+/**
+ * Run a multi-statement DDL blob one statement at a time, as its comment-blanked text (#2068) —
+ * the same statements and the same text the Durable Object executes, so both hosts store the
+ * same DDL in `sqlite_master` and a later `ALTER TABLE … DROP COLUMN` rewrites the same thing.
+ */
+function execSqlStatements(db, sql) {
+    for (const statement of executableSqlStatements(sql))
+        db.exec(statement);
+}
 /**
  * The kernel's OWN spine access (#1672) — the same seam as `scopedSql` without `guardSpine`,
  * because these are the kernel's writes to `_substrat_capabilities`, which module code may