@substrat-run/adapter-sqlite 0.140.0 → 0.142.0

package/dist/index.js

@@ -1,11 +1,12 @@
 import { existsSync, mkdirSync, readdirSync, readFileSync, realpathSync, rmSync, writeFileSync } from 'node:fs';
 import { dirname, join } from 'node:path';
 import Database from 'better-sqlite3';
-import { accessLogEntry, adminLogEntry, delegatedReadParams, operationSeriesCount, opsFailureEntry, opsFailureFingerprint, issueEntry, FRESHNESS_HEARTBEAT_MINUTES, sweepRunEntry, modelUsageEntry, ATTACHMENT_ADDED, ATTACHMENT_REMOVED, attachmentRecord, createTenantInput, domainEvent, domainEventInput, exportReadInput, importBatch, importCursorMove, exportsOfManifestJson, importsOfManifestJson, entitlementGrant, entitlementGrantInput, eventId, meterReading, platformRequestInput, platformRequestId, MAX_PENDING_PLATFORM_REQUESTS, identityLink, identityPool, instant, connection, capabilityGrant, connectionGrant, connectionGrantRecord, connectionSecret, systemGrant, systemSwitch, systemSwitchRecord, peerSwitch, verticalCaller, verticalSlug as verticalSlugOf, subjectRef, requestFingerprint, createConnectionInput, connectLinkFilter, connectLinkKey, consumeConnectLinkInput, mintConnectLinkInput, projectedConnectionGrant, projectedConnectionKey, moduleManifest, createOrgInput, promotionAcknowledgement, bindAcknowledgement, bindHostnameInput, channelHistoryEntry, hostnameBinding, publishVersionInput, AUTO_ADMISSION_NOTE, routeTarget, ROUTE_SCOPE_HOSTNAMES_MAX, registerVerticalInput, vertical as verticalSchema, verticalChannel, verticalVersion, objectRef, entityObjectRef, assertModuleEmittableType, assertKernelAuthoredType, grantRefFromProof, org as orgSchema, orgMembership, principalId, resolvedIdentity, identityMembership, roleDefinition, scope as scopeSchema, tenant as tenantSchema, tenantRole, subjectShredReceipt, SCOPE_TABLE_PAGE_DEFAULT, SCOPE_TABLE_PAGE_MAX, SCOPE_QUERY_ROW_MAX, verticalServingState, callsOfManifestJson, outboundOfManifestJson, listLimitOf, pageOf, countedPageOf, SCOPE_GATE_REASONS, substratError, assertReplayableDump, delegatedReadRecord, ownerTransferAudit, memberChangeAudit, peerBindingAudit, copyMarkAudit, redrainEventsInput, REDRAIN_BATCH, } from '@substrat-run/contracts';
-import { actorOf, asPrincipal, assertAllowed, assertNoSecret, assertPermissionKey, CAPABILITY_DDL, COPY_ORIGIN_DDL, ENTITY_STATE_MOVES_DDL, CAPABILITY_EXCHANGE_OPERATION, capabilityAttachmentWriteRefused, capabilityTokenHash, createCapabilityVerbs, createEntityEdgeVerbs, createEntityStateVerbs, createTrashedReads, CONTINUATION_POSITION_CAP, visibleContinuation, searchStateWhere, uncheckedView, addStatePlans, entityStateMigrations, assertNoCallerPurge, isUnreachableParent, heldPurgePass, purgeDueOf, purgeHeldBy, lifecycleRefusal, purgeOnlyKeysOf, purgeReportOf, purgeStillDue, refuseTrashedTarget, registerTrashTargets, runPurgePass, withheldKeysFor, statefulTablesOf, afterMigration, afterRuntimeDdl, derivesAnything, repairDerivedObjects, StateColumnLost, exchangeCapability as exchangeCapabilitySecret, guardSecrets, mintBecomeCapability, plausibleSessionToken, readCapabilityPage, redactSecrets, redactSecretText, moduleLog, consoleLogSink, asyncInvocationId, asyncLinePass, consoleInvocationLineSink, resolveCapabilitySession, revokeCapabilityAsPlatform, assertReadOnlyQuery, attachmentBlobKey, attachmentSha256, entitlementDenial, requiredEntitlementFor, foldMeterReading, guardSpine, guardSqlLimits, DO_SQL_LIMITS, tooManyResultColumns, tooManyTableColumns, parseValidationRecords, resolveScopeRecord, ulid, ISSUE_RETENTION_DAYS, telemetryRetentionStatements, FINDINGS_DDL, CONNECT_LINKS_DDL, consumeConnectLinkRow, insertConnectLink, listConnectLinks as listConnectLinkRows, readConnectLink, restoreConnectLinkRow, revokeConnectLinkRow, createFindingRule, findingOfOpsFailure, findingOfSweepRun, pruneFindings, listFindingRules, listFindings, observeFinding, revokeFindingRule, setFindingStatus, assertRowLimit, assertRowOffset, OPS_FAILURE_RETENTION_DAYS, SWEEP_RUN_RETENTION_DAYS, SWEEP_RUNS_INTENT_INDEX, sweepRunsIntentHasKind, MODEL_USAGE_RETENTION_DAYS, foldModelUsage, backoffAt, platformRequestHistoryQuery, platformRequestOf, PLATFORM_REQUEST_COLUMNS, PLATFORM_REQUEST_REDACTION_SQL, platformRequestRedactionParams, platformRequestRedactionQuery, intentPayloadCarriesSubject, redactSubjectJobRuns, eraseSubjectFromModules, moduleRowsErased, moduleErasurePlan, redactSubjectScopeText, redactSubjectDirectoryText, ISSUE_EXEMPLAR_OWNER_BACKFILL_SQL, issueExemplarOwner, JOB_RUN_PATCH_SQL, JOB_RUN_CLAIM_SQL, JOB_RUN_RENEW_SQL, JOB_RUN_BEGIN_SQL, JOB_RUN_MISS_SQL, JOB_RUN_MISS_SETTLE_SQL, admissionMissOutcome, JOB_STEP_RECORD_SQL, JOB_LEASE_EXPIRED_NOTE, assertLeaseMs, DELIVERY_ERROR_REDACTION_SQL, REDACTED_DELIVERY_NOTE, seatScopeTuple, applyScopeRoleChange, changeScopeRole, revokeScopeRoles, scopeRoleHolders, admitPeer, collectPeers, peerSeats, resolveVerticalInstanceFrom, resolvePeerInstanceFrom, peerGrantsStatus, systemGrantsStatus, systemScheduleState, systemSwitchedOff, systemSwitchedOffMessage, tenantSystemSwitchedOffMessage, PEER_SWITCHES_DDL, PEER_BINDINGS_DDL, SWITCH_OWED_DDL, SWITCH_FENCES_DDL, TABLE_OWNERS_DDL, assertMigrationLeavesLedgerAlone, recordOwnershipSteps, runMigrationStatements, executableSqlStatements, blankSqlComments, recordWriteSuperseded, switchFencesOf, switchSupersededMessage, SWITCH_KINDS, SYSTEM_SWITCHES_DDL, forgetSwitchesOf, listSystemSwitchRecords, moveSwitch, reassertActionOf, reassertEntry, reassertOffRow, recordSwitchedOff, recordSwitchedOn, restoreSwitchRecord, scopesSwitchedOffFor, switchActionOf, switchAuditSubject, recordAuditOutcome, auditWarningOf, switchNotFoundMessage, switchRecordsOf, switchedOffOf, switchesBackfillSqlOf, switchesTableExists, tenantHeldOf, tenantHoldsGrant, inUnitMovesToAudit, staleCarryRevertRow, staleCarryReverts, withRecorded, VERSION_MIGRATIONS_DDL, splitManifestMigrations, splitVersionMigrationsBatch, versionMigrationsOf, writeVersionMigrations, denialListQuery, refusalListQuery, mapRefusalRow, denialSummaryQuery, denialTotalsQuery, DENIAL_WINDOW_QUERY, mapDenialRow, mapDenialSummaryBuckets, IMPERSONATION_COLUMNS, IMPERSONATION_DDL, ImpersonationRefused, assertImpersonationWrites, assertModuleEnqueueableKind, assertSessionUsable, impersonationByIdQuery, impersonationListQuery, impersonationRowValues, impersonationStampOf, mapImpersonationRow, newImpersonationSession, resolveRetryPolicy, executorOutcomeOf, isDeliveryRefusal, refusalJournalText, membershipFencesBackfillSql, MEMBERSHIP_FENCES_DDL, membershipFencesTableExists, MEMBERSHIP_FENCE_SINCE_SQL, RAISE_MEMBERSHIP_FENCE_SQL, memberAddedAudit, orgChangeBound, tenantCoverage, isSecretBoxConfigured, unconfiguredSecretBox, createSubjectKeys, generateSealingKeyPair, noSealingKeyMessage, openSealed, sealTo, ConnectionSealingKeyUnavailableError, PermissionDenied, createAtomic, NotSearchable, NotListable, listIndexMigrations, listIndexPlans, listQuery, cursorOf, moduleMigrations, MIGRATION_DIGEST_FENCE_DDL, MIGRATION_DIGEST_MARK_LEGACY, assertJournalDumpCoherent, assertMigrationSql, migrationDivergence, migrationFailedError, migrationSteps, planMigrations, isSearchIndexTable, searchIndexMigrations, searchIndexPlans, searchLimit, searchMatchExpression, searchQuery, ATTACHMENT_TEXT_DDL, assertAttachmentExtractors, resolveAttachmentTextBounds, assertJobRegistrable, attachmentRecordOfRow, attachmentTextJob, enqueueAttachmentText, ATTACHMENT_TEXT_BACKFILL_JOB, ATTACHMENT_TEXT_JOB, kernelJobFor, queueAttachmentTextBackfill, startAttachmentTextBackfill, attachmentTextBackfillJob, reconcileAttachmentText, recordAttachmentText, searchAttachments, entityVersionQuery, entityVersionOf, assertIfMatch, OUTBOX_ENTITY_INDEX, SCHEDULE_STATE_DDL, SCHEDULE_STATE_REBUILD, scheduleStateHasKind, VERTICAL_EVENTS_DDL, EXPORT_HOPS_SQL, emptyImportResult, IMPORT_CURSORS_SQL, IMPORT_CURSOR_OF_SQL, OUTBOX_MARK_SQL, emittedSinceQuery, emittedReportOf, EMITTED_REPORT_CAP, exportedSinceQuery, IMPORT_CURSOR_ADVANCE_SQL, IMPORT_RECORD_SQL, moveImportCursor, importCursorSourceOf, exportBreaksOf, exportBreakRefusal, bindExportBreaksOf, bindExportBreakRefusal, CrossVerticalRegistry, exportReadPlan, exportReadQuery, planExportBatch, withheldNote, JOB_RUN_DDL, JOB_RUN_DUE_AT, jobRunListLimit, jobRunOf, runDueJobRuns, startJobRun, IDEMPOTENCY_DDL, REFUSALS_TABLE_DDL, REFUSALS_INDEX, refusalInsert, refusalOf, markGuardRefusal, REFUSALS_REBUILD, refusalsAdmitGuards, assertIdempotencyKey, idempotencyLookupQuery, idempotencyPruneStatement, idempotencyRecordStatement, idempotencyOptedOutMessage, replayFor, globalFetch, createUlid, facetEvents, readHistory, walkEventCause, walkEventEffects, assertRedrainWindow, readInvocation, readDeadLetters, readLifecycleFlow, readOperationSeries, domainEventOf, readUndrainedOutbox, undrainedEventsOf, connectorCallRecord, noopConnectorCallRecorder, recordConnectorCall, settleConnectionUse, unknownRoleError, } from '@substrat-run/kernel';
+import { accessLogEntry, adminLogEntry, delegatedReadParams, operationSeriesCount, opsFailureEntry, opsFailureFingerprint, issueEntry, FRESHNESS_HEARTBEAT_MINUTES, sweepRunEntry, modelUsageEntry, ATTACHMENT_ADDED, ATTACHMENT_REMOVED, attachmentRecord, createTenantInput, domainEvent, domainEventInput, exportReadInput, importBatch, importCursorMove, exportsOfManifestJson, importsOfManifestJson, entitlementGrant, entitlementGrantInput, eventId, meterReading, platformRequestInput, platformRequestId, MAX_PENDING_PLATFORM_REQUESTS, identityLink, identityPool, instant, isSubstratError, connection, capabilityGrant, connectionGrant, connectionGrantRecord, connectionSecret, systemGrant, systemSwitch, systemSwitchRecord, peerSwitch, verticalCaller, verticalSlug as verticalSlugOf, subjectRef, requestFingerprint, createConnectionInput, connectLinkFilter, connectLinkKey, consumeConnectLinkInput, mintConnectLinkInput, projectedConnectionGrant, projectedConnectionKey, moduleManifest, createOrgInput, promotionAcknowledgement, bindAcknowledgement, bindHostnameInput, channelHistoryEntry, hostnameBinding, publishVersionInput, AUTO_ADMISSION_NOTE, routeTarget, ROUTE_SCOPE_HOSTNAMES_MAX, registerVerticalInput, vertical as verticalSchema, verticalChannel, verticalVersion, objectRef, entityObjectRef, assertModuleEmittableType, assertKernelAuthoredType, grantRefFromProof, org as orgSchema, orgMembership, principalId, resolvedIdentity, identityMembership, roleDefinition, scope as scopeSchema, tenant as tenantSchema, tenantRole, principalBecomeCapabilityInput, subjectShredReceipt, SCOPE_TABLE_PAGE_DEFAULT, SCOPE_TABLE_PAGE_MAX, SCOPE_QUERY_ROW_MAX, verticalServingState, callsOfManifestJson, outboundOfManifestJson, listLimitOf, pageOf, countedPageOf, SCOPE_GATE_REASONS, substratError, assertReplayableDump, delegatedReadRecord, ownerTransferAudit, memberChangeAudit, peerBindingAudit, copyMarkAudit, redrainEventsInput, REDRAIN_BATCH, } from '@substrat-run/contracts';
+import { actorOf, asPrincipal, assertAllowed, assertNoSecret, assertPermissionKey, CAPABILITY_DDL, COPY_ORIGIN_DDL, ENTITY_STATE_MOVES_DDL, CAPABILITY_EXCHANGE_OPERATION, CAPABILITY_BECOME_MINT_OPERATION, becomeMintCheck, mintBecomeCapabilityAsPrincipal, revokeBecomeCapabilityAsPrincipal, readBecomeLinkStates, capabilityAttachmentWriteRefused, capabilityTokenHash, createCapabilityVerbs, createEntityEdgeVerbs, createEntityStateVerbs, createTrashedReads, CONTINUATION_POSITION_CAP, visibleContinuation, searchStateWhere, uncheckedView, addStatePlans, entityStateMigrations, assertNoCallerPurge, isUnreachableParent, heldPurgePass, purgeDueOf, purgeHeldBy, lifecycleRefusal, purgeOnlyKeysOf, purgeReportOf, purgeStillDue, refuseTrashedTarget, registerTrashTargets, runPurgePass, withheldKeysFor, statefulTablesOf, afterMigration, afterRuntimeDdl, derivesAnything, repairDerivedObjects, StateColumnLost, exchangeCapability as exchangeCapabilitySecret, guardSecrets, mintBecomeCapability, plausibleSessionToken, readCapabilityPage, redactSecrets, redactSecretText, moduleLog, consoleLogSink, asyncInvocationId, asyncLinePass, consoleInvocationLineSink, resolveCapabilitySession, revokeCapabilityAsPlatform, assertReadOnlyQuery, attachmentBlobKey, attachmentSha256, entitlementDenial, requiredEntitlementFor, foldMeterReading, guardSpine, guardSqlLimits, DO_SQL_LIMITS, tooManyResultColumns, tooManyTableColumns, parseValidationRecords, resolveScopeRecord, ulid, ISSUE_RETENTION_DAYS, telemetryRetentionStatements, FINDINGS_DDL, SCOPE_STORAGE_DDL, forgetScopeStorage, listScopeStorageAttemptRows, listScopeStorageRows, pruneScopeStorageRows, recordScopeStorageRows, CONNECT_LINKS_DDL, consumeConnectLinkRow, insertConnectLink, listConnectLinks as listConnectLinkRows, readConnectLink, restoreConnectLinkRow, revokeConnectLinkRow, createFindingRule, findingOfOpsFailure, findingOfSweepRun, pruneFindings, listFindingRules, listFindings, observeFinding, revokeFindingRule, setFindingStatus, assertRowLimit, assertRowOffset, OPS_FAILURE_RETENTION_DAYS, SWEEP_RUN_RETENTION_DAYS, SWEEP_RUNS_INTENT_INDEX, sweepRunsIntentHasKind, MODEL_USAGE_RETENTION_DAYS, foldModelUsage, backoffAt, platformRequestHistoryQuery, platformRequestOf, PLATFORM_REQUEST_COLUMNS, PLATFORM_REQUEST_REDACTION_SQL, platformRequestRedactionParams, platformRequestRedactionQuery, intentPayloadCarriesSubject, redactSubjectJobRuns, eraseSubjectFromModules, moduleRowsErased, moduleErasurePlan, redactSubjectScopeText, redactSubjectDirectoryText, ISSUE_EXEMPLAR_OWNER_BACKFILL_SQL, issueExemplarOwner, JOB_RUN_PATCH_SQL, JOB_RUN_CLAIM_SQL, JOB_RUN_RENEW_SQL, JOB_RUN_BEGIN_SQL, JOB_RUN_MISS_SQL, JOB_RUN_MISS_SETTLE_SQL, admissionMissOutcome, JOB_STEP_RECORD_SQL, JOB_LEASE_EXPIRED_NOTE, assertLeaseMs, DELIVERY_ERROR_REDACTION_SQL, REDACTED_DELIVERY_NOTE, seatScopeTuple, applyScopeRoleChange, changeScopeRole, revokeScopeRoles, scopeRoleHolders, admitPeer, collectPeers, peerSeats, resolveVerticalInstanceFrom, resolvePeerInstanceFrom, peerGrantsStatus, systemGrantsStatus, systemScheduleState, systemSwitchedOff, systemSwitchedOffMessage, tenantSystemSwitchedOffMessage, PEER_SWITCHES_DDL, PEER_BINDINGS_DDL, SWITCH_OWED_DDL, SWITCH_FENCES_DDL, TABLE_OWNERS_DDL, assertMigrationLeavesLedgerAlone, recordOwnershipSteps, runMigrationStatements, executableSqlStatements, blankSqlComments, recordWriteSuperseded, switchFencesOf, switchSupersededMessage, SWITCH_KINDS, SYSTEM_SWITCHES_DDL, forgetSwitchesOf, listSystemSwitchRecords, moveSwitch, reassertActionOf, reassertEntry, reassertOffRow, recordSwitchedOff, recordSwitchedOn, restoreSwitchRecord, scopesSwitchedOffFor, switchActionOf, switchAuditSubject, recordAuditOutcome, auditWarningOf, switchNotFoundMessage, switchRecordsOf, switchedOffOf, switchesBackfillSqlOf, switchesTableExists, tenantHeldOf, tenantHoldsGrant, inUnitMovesToAudit, staleCarryRevertRow, staleCarryReverts, withRecorded, VERSION_MIGRATIONS_DDL, splitManifestMigrations, splitVersionMigrationsBatch, versionMigrationsOf, writeVersionMigrations, denialListQuery, refusalListQuery, mapRefusalRow, denialSummaryQuery, denialTotalsQuery, DENIAL_WINDOW_QUERY, mapDenialRow, mapDenialSummaryBuckets, IMPERSONATION_COLUMNS, IMPERSONATION_DDL, ImpersonationRefused, assertImpersonationWrites, assertModuleEnqueueableKind, assertSessionUsable, impersonationByIdQuery, impersonationListQuery, impersonationRowValues, impersonationStampOf, mapImpersonationRow, newImpersonationSession, resolveRetryPolicy, executorOutcomeOf, isDeliveryRefusal, refusalJournalText, membershipFencesBackfillSql, MEMBERSHIP_FENCES_DDL, membershipFencesTableExists, MEMBERSHIP_FENCE_SINCE_SQL, RAISE_MEMBERSHIP_FENCE_SQL, memberAddedAudit, orgChangeBound, tenantCoverage, isSecretBoxConfigured, unconfiguredSecretBox, createSubjectKeys, generateSealingKeyPair, noSealingKeyMessage, openSealed, sealTo, ConnectionSealingKeyUnavailableError, PermissionDenied, createAtomic, NotSearchable, NotListable, listIndexMigrations, listIndexPlans, listQuery, cursorOf, moduleMigrations, MIGRATION_DIGEST_FENCE_DDL, MIGRATION_DIGEST_MARK_LEGACY, assertJournalDumpCoherent, assertMigrationSql, migrationDivergence, migrationFailedError, migrationSteps, planMigrations, isSearchIndexTable, searchIndexMigrations, searchIndexPlans, searchLimit, searchMatchExpression, searchQuery, ATTACHMENT_TEXT_DDL, assertAttachmentExtractors, resolveAttachmentTextBounds, assertJobRegistrable, attachmentRecordOfRow, attachmentTextJob, enqueueAttachmentText, ATTACHMENT_TEXT_BACKFILL_JOB, ATTACHMENT_TEXT_JOB, kernelJobFor, queueAttachmentTextBackfill, startAttachmentTextBackfill, attachmentTextBackfillJob, reconcileAttachmentText, recordAttachmentText, searchAttachments, entityVersionQuery, entityVersionOf, assertIfMatch, OUTBOX_ENTITY_INDEX, SCHEDULE_STATE_DDL, SCHEDULE_STATE_REBUILD, scheduleStateHasKind, VERTICAL_EVENTS_DDL, EXPORT_HOPS_SQL, emptyImportResult, IMPORT_CURSORS_SQL, IMPORT_CURSOR_OF_SQL, OUTBOX_MARK_SQL, emittedSinceQuery, emittedReportOf, EMITTED_REPORT_CAP, exportedSinceQuery, IMPORT_CURSOR_ADVANCE_SQL, IMPORT_RECORD_SQL, moveImportCursor, importCursorSourceOf, exportBreaksOf, exportBreakRefusal, bindExportBreaksOf, bindExportBreakRefusal, CrossVerticalRegistry, exportReadPlan, exportReadQuery, planExportBatch, withheldNote, JOB_RUN_DDL, JOB_RUN_DUE_AT, jobRunListLimit, jobRunOf, runDueJobRuns, startJobRun, IDEMPOTENCY_DDL, REFUSALS_TABLE_DDL, REFUSALS_INDEX, refusalInsert, refusalOf, markGuardRefusal, REFUSALS_REBUILD, refusalsAdmitGuards, assertIdempotencyKey, idempotencyLookupQuery, idempotencyPruneStatement, idempotencyRecordStatement, idempotencyOptedOutMessage, replayFor, globalFetch, createUlid, facetEvents, readHistory, walkEventCause, walkEventEffects, assertRedrainWindow, readInvocation, readDeadLetters, readLifecycleFlow, readOperationSeries, domainEventOf, readUndrainedOutbox, undrainedEventsOf, connectorCallRecord, noopConnectorCallRecorder, recordConnectorCall, settleConnectionUse, unknownRoleError, } from '@substrat-run/kernel';
 import { attributedView, delegatedRevokeSql, writeExplicitTupleIn, grantEntityShapeIn, shapeTopUpBatch, topUpEntityGrantShapes, settlePlatformRequestIn, } from '@substrat-run/kernel';
 import { ADMIN_LOG_INDEXES_SQL, SETTLE_INTENT_SQL, SETTLE_OUTCOME_SQL, settleOutcomeParamsOf, readAuditedOperations, unknownOutcomeOf, } from '@substrat-run/kernel';
 import { INERT_SCOPE_REASON, isPrimaryScopeRow } from '@substrat-run/kernel';
+import { COPY_BACKFILL_SCOPE_SQL, COPY_BACKFILL_SQL, COPY_BACKFILL_SUPERSEDE_SQL, COPY_CLAIM_SQL, COPY_EXPIRED_SQL, copyBackfillParams, copyBackfillRefusal, COPY_MOVE_CONFIRM_SQL, COPY_MOVE_LIVE_PREDICATE, SCOPE_COPY_LEASE_MS, SCOPE_SCRIPT_COPY_COLUMNS, copyMoveConfirmParams, copyMoveLiveParams, scopeScriptCopyOf, } from '@substrat-run/kernel';
 import { GRANT_CHILDREN_INDEX_DDL, grantedEntitiesForContext } from '@substrat-run/kernel';
 import { LEGACY_SCOPE_ROWS_BACKFILL, assertSpineTablesBuilt, capabilitiesForLoad, dumpRowsInsert, isSpineTable, loadDirectoryDump, repointScopeGrants, settleCopiedWork, emittedHere, spineColumnAdditions } from '@substrat-run/kernel';
 import { ScopeActor } from './actor.js';
@@ -810,6 +811,10 @@ export class SqliteScopeHost {
         status TEXT NOT NULL DEFAULT 'active',
         schema_version TEXT NOT NULL DEFAULT '0',
         vertical_version_id TEXT,
+        erasure_epoch INTEGER,
+        -- #1722: set once a reap has started draining this scope's script copies, and never
+        -- cleared: only deleting the row ends it. While set, no copy move is recorded or bound.
+        reap_claimed_at TEXT,
         provisioned_version_id TEXT,
         -- Last FAILED migration attempt (§5.3). All null / 0 = healthy. Written on
         -- the failure path so a scope that fails closed stops rendering as active;
@@ -831,8 +836,29 @@ export class SqliteScopeHost {
         -- When the scope last entered the archived state (§4.4). Drives the reap sweep's
         -- age filter; null for scopes that never archived, cleared on unarchive.
         archived_at TEXT,
+        -- #1524: the status it was archived FROM. 'provisioning' = it never held data, so the
+        -- storage gauge neither reads nor counts it. Written with archived_at, cleared with it.
+        archived_from_status TEXT,
         created_at TEXT NOT NULL
       );
+      -- #1722: additive copy inventory; historical audit backfill is a separate act.
+      CREATE TABLE IF NOT EXISTS scope_script_copies (
+        tenant_id TEXT NOT NULL,
+        scope_id TEXT NOT NULL,
+        script_ref TEXT NOT NULL,
+        move_id TEXT NOT NULL,
+        state TEXT NOT NULL,
+        load_stamp TEXT,
+        revision TEXT,
+        last_attempt_at TEXT NOT NULL DEFAULT (strftime('%Y-%m-%dT%H:%M:%fZ','now')),
+        -- 'source' | 'destination'. A pending entry belongs to its move until lease_until; a
+        -- sweep that claims it after that sets lease_owner (kernel scope-copy-ledger.ts).
+        role TEXT,
+        lease_until TEXT,
+        lease_owner TEXT,
+        PRIMARY KEY (tenant_id, scope_id, script_ref, move_id)
+      );
+      CREATE INDEX IF NOT EXISTS scope_script_copies_state ON scope_script_copies (state, scope_id);
       -- Private host state. Module SQL opens only the scope file, never this directory;
       -- neither table is included in directory exports or scope dumps (#2074).
       CREATE TABLE IF NOT EXISTS private_continuation_keys (
@@ -1358,6 +1384,8 @@ export class SqliteScopeHost {
       );
       CREATE INDEX IF NOT EXISTS _substrat_model_usage_tenant ON _substrat_model_usage (tenant_id, at);
       CREATE INDEX IF NOT EXISTS _substrat_model_usage_at ON _substrat_model_usage (at);
+      -- #1524: the stored storage gauge — one row per (scope, UTC day), kernel-owned DDL.
+      ${SCOPE_STORAGE_DDL}
       CREATE INDEX IF NOT EXISTS scopes_tenant ON scopes (tenant_id, scope_id);
     `);
         this.ensureDirectoryColumns();
@@ -2113,7 +2141,7 @@ export class SqliteScopeHost {
         const actingAs = (operation) => authority.kind === 'capability-session'
             ? {
                 kind: 'capability',
-                id: resolveCapabilitySession(spineSql(rt.db), authority.hash, this.clock(), operation),
+                id: resolveCapabilitySession(spineSql(rt.db), authority.hash, this.clock(), operation, true),
             }
             : authority;
         const node = { tenantId: rt.tenantId, scopeId: rt.scopeId };
@@ -2547,6 +2575,7 @@ export class SqliteScopeHost {
             forgetSwitchesOf(switchSqlOf(this.directory), scopeId);
             this.directory.prepare('DELETE FROM private_continuation_positions WHERE scope_id = ?').run(scopeId);
             this.directory.prepare('DELETE FROM private_continuation_keys WHERE scope_id = ?').run(scopeId);
+            forgetScopeStorage(redactionSqlOf(this.directory), scopeId);
             this.directory.prepare('DELETE FROM scopes WHERE scope_id = ?').run(scopeId);
         })();
         this.recordAdmin(actor, 'deleteSnapshot', { tenantId, scopeId }, null, {
@@ -2688,14 +2717,14 @@ export class SqliteScopeHost {
         // Same lifecycle gates as the principal door, and reached the same way: a
         // suspended tenant refuses a support session exactly as it refuses a user.
         const scope = this.directory
-            .prepare('SELECT tenant_id, status FROM scopes WHERE scope_id = ?')
+            .prepare('SELECT tenant_id FROM scopes WHERE scope_id = ?')
             .get(scopeId);
         if (!scope || scope.tenant_id !== tenantId) {
             throw substratError('not_found', `unknown scope for tenant: (${tenantId}, ${scopeId})`);
         }
-        if (scope.status !== 'active') {
-            throw substratError('conflict', `scope not active (status: ${scope.status}): ${scopeId}`, { reason: SCOPE_GATE_REASONS.notActive });
-        }
+        const refusal = this.scopeWorkRefusal(tenantId, scopeId);
+        if (refusal)
+            throw substratError('conflict', refusal, { reason: SCOPE_GATE_REASONS.notActive });
         const rt = this.runtime(tenantId, scopeId);
         await this.applyPendingMigrations(rt);
         return this.buildStub(tenantId, scopeId, rt, asPrincipal(record.principal), options, record.id);
@@ -2717,14 +2746,14 @@ export class SqliteScopeHost {
             throw substratError('not_found', `module not registered on this host: ${moduleId}`);
         }
         const scope = this.directory
-            .prepare('SELECT tenant_id, status FROM scopes WHERE scope_id = ?')
+            .prepare('SELECT tenant_id FROM scopes WHERE scope_id = ?')
             .get(scopeId);
         if (!scope || scope.tenant_id !== tenantId) {
             throw substratError('not_found', `unknown scope: ${scopeId}`);
         }
-        if (scope.status !== 'active') {
-            throw substratError('conflict', `scope not active (status: ${scope.status}): ${scopeId}`, { reason: SCOPE_GATE_REASONS.notActive });
-        }
+        const refusal = this.scopeWorkRefusal(tenantId, scopeId);
+        if (refusal)
+            throw substratError('conflict', refusal, { reason: SCOPE_GATE_REASONS.notActive });
         const rt = this.runtime(tenantId, scopeId);
         await this.applyPendingMigrations(rt);
         return this.buildStub(tenantId, scopeId, rt, { kind: 'system', id: moduleId }, undefined, undefined, purge);
@@ -2989,6 +3018,20 @@ export class SqliteScopeHost {
         await this.applyPendingMigrations(rt);
         return rt;
     }
+    /** The directory's current hold, read again when background work is about to run. */
+    scopeWorkRefusal(tenantId, scopeId, allowProvisioning = false) {
+        const row = this.directory
+            .prepare(`SELECT s.status AS scope, t.status AS tenant
+                  FROM scopes s JOIN tenants t ON t.tenant_id = s.tenant_id
+                  WHERE s.scope_id = ? AND s.tenant_id = ?`)
+            .get(scopeId, tenantId);
+        if (!row)
+            return `unknown scope for tenant: (${tenantId}, ${scopeId})`;
+        // A connector can serve provisioning work; suspension still holds it.
+        if (allowProvisioning && row.scope === 'provisioning' && row.tenant === 'active')
+            return null;
+        return lifecycleRefusal(row, { tenantId, scopeId });
+    }
     /**
      * The exchange (#1672) — a secret traded for a session, or for the principal a `become`
      * capability yields. One serialized scope task and one transaction, so the use it takes
@@ -3011,6 +3054,7 @@ export class SqliteScopeHost {
                     // pseudo-operation name — the actor is the capability, as on every event it
                     // goes on to cause.
                     emit: (capability, event) => kernelEmit(this.operationContext(rt, { kind: 'capability', id: capability }, undefined, undefined, undefined, CAPABILITY_EXCHANGE_OPERATION, [], now), event),
+                    holdings: this.holdingsAt(tenantId, scopeId),
                 }, secret, options?.mode);
                 rt.db.exec('COMMIT');
             }
@@ -3123,6 +3167,65 @@ export class SqliteScopeHost {
         const rt = await this.openActiveScope(tenantId, scopeId);
         return rt.actor.turn(() => revokeScopeRoles(switchSqlOf(rt.db), scopeId, principalId.parse(principal), this.clock(), this.roleBound(caller, tenantId, scopeId), (run) => rt.db.transaction(run)()));
     }
+    /**
+     * A principal's `become` mint (#1686) — a member invite's link. The kernel's `becomeMintCheck`
+     * and the write in ONE scope turn and one transaction, so nothing the target or the caller
+     * holds can move between the check and the mint; a refusal writes nothing. The mint is on the
+     * spine as `capability.become-minted`, the caller its actor.
+     */
+    async mintBecomeCapabilityBounded(tenantId, scopeId, caller, input) {
+        const rt = await this.openActiveScope(tenantId, scopeId);
+        const minter = principalId.parse(caller);
+        const parsed = principalBecomeCapabilityInput.parse(input);
+        const outcome = await rt.actor.turn(async () => {
+            const checked = await becomeMintCheck({ sql: spineSql(rt.db), checker: this.checker }, minter, parsed.principal, { tenantId, scopeId });
+            if (!checked.ok)
+                return checked;
+            const now = this.clock();
+            rt.db.exec('BEGIN IMMEDIATE');
+            try {
+                const minted = await mintBecomeCapabilityAsPrincipal({
+                    sql: spineSql(rt.db),
+                    now,
+                    emit: (event) => kernelEmit(this.operationContext(rt, asPrincipal(minter), undefined, undefined, undefined, CAPABILITY_BECOME_MINT_OPERATION, [], now), event),
+                }, minter, parsed, checked.targetDigest);
+                rt.db.exec('COMMIT');
+                return { ok: true, minted };
+            }
+            catch (err) {
+                rt.db.exec('ROLLBACK');
+                throw err;
+            }
+        });
+        if (outcome.ok) {
+            await this.dispatch(rt, null);
+            await this.dispatchExecutors(rt, null);
+        }
+        return outcome;
+    }
+    /**
+     * Revoke a `become` capability a principal minted (#1686) — withdrawing a member invite's
+     * link, recorded with `by` as the revoker. `revoked` is false for anything else: a platform-minted
+     * or an `act` capability is not this verb's. The kernel bounds `by` in the same turn: the link's
+     * minter, or someone holding everything its principal holds now.
+     */
+    async revokeBecomeCapability(tenantId, scopeId, capabilityId, by) {
+        const rt = await this.openActiveScope(tenantId, scopeId);
+        return rt.actor.turn(() => revokeBecomeCapabilityAsPrincipal({ sql: spineSql(rt.db), checker: this.checker, node: { tenantId, scopeId }, now: this.clock() }, capabilityId, principalId.parse(by)));
+    }
+    /**
+     * Where each named `become` link stands (#1686) — what a pending-invite list shows, so a link the
+     * kernel revoked or that expired is never shown as open. A read in the scope's task.
+     */
+    async becomeLinkStates(tenantId, scopeId, ids) {
+        const rt = await this.openActiveScope(tenantId, scopeId);
+        return rt.actor.enqueue(() => readBecomeLinkStates(spineSql(rt.db), ids, this.clock(), this.holdingsAt(tenantId, scopeId)));
+    }
+    /** What a principal holds at this scope, for a `become` exchange (#1686); absent with a checker that cannot say. */
+    holdingsAt(tenantId, scopeId) {
+        const checker = this.checker;
+        return checker.holdings ? (principal) => checker.holdings(asPrincipal(principal), { tenantId, scopeId }) : undefined;
+    }
     /** The caller's bound per role at the scope, `null` for a role this tenant does not define (#1150). */
     roleBound(caller, tenantId, scopeId) {
         const subject = asPrincipal(principalId.parse(caller));
@@ -3185,10 +3288,7 @@ export class SqliteScopeHost {
         const report = { checks: [] };
         if (!this.modules.has(moduleId))
             return report;
-        const scope = this.directory
-            .prepare('SELECT status FROM scopes WHERE scope_id = ? AND tenant_id = ?')
-            .get(scopeId, tenantId);
-        if (!scope || scope.status !== 'active')
+        if (this.scopeWorkRefusal(tenantId, scopeId))
             return report;
         const rt = this.runtime(tenantId, scopeId);
         await this.applyPendingMigrations(rt);
@@ -3265,10 +3365,7 @@ export class SqliteScopeHost {
         // not this driver's problem to raise — it simply has nothing due (the sweep
         // already enumerated `active` scopes; this guards a race where one archived
         // between enumeration and here).
-        const scope = this.directory
-            .prepare('SELECT status FROM scopes WHERE scope_id = ? AND tenant_id = ?')
-            .get(scopeId, tenantId);
-        if (!scope || scope.status !== 'active')
+        if (this.scopeWorkRefusal(tenantId, scopeId))
             return report;
         const rt = this.runtime(tenantId, scopeId);
         await this.applyPendingMigrations(rt);
@@ -3361,6 +3458,14 @@ export class SqliteScopeHost {
                 report.fired += 1;
             }
             catch (err) {
+                // The system door can meet a suspension after the cadence gate. A refused
+                // fire did not run, so leave its row due for the first live pass.
+                if (isSubstratError(err) && err.code === 'conflict' && err.extensions.reason === SCOPE_GATE_REASONS.notActive) {
+                    report.lifecycleHeld = true;
+                    report.skipped += 1;
+                    report.runs.push({ operation: schedule.operation, outcome: 'skipped' });
+                    continue;
+                }
                 status = 'failed';
                 failure = { error: err };
                 report.failed += 1;
@@ -3924,6 +4029,12 @@ export class SqliteScopeHost {
         return report;
     }
     async dispatchExecutorsPass(rt, invocationId, report, lines, outcomes) {
+        // A request that started while live may commit after a suspension. Its outbox
+        // stays due without an attempt, just as a scheduled retry does.
+        if (this.scopeWorkRefusal(rt.tenantId, rt.scopeId)) {
+            report.lifecycleHeld = true;
+            return;
+        }
         const now = new Date().toISOString();
         const scope = this.executorScope(rt);
         // #2005: a non-primary scope (a fork, a snapshot, a preview of either kind) causes no
@@ -3947,6 +4058,10 @@ export class SqliteScopeHost {
            ORDER BY o.id`)
                 .all(deliveryId, executor.eventType, now);
             for (const row of rows) {
+                if (this.scopeWorkRefusal(rt.tenantId, rt.scopeId)) {
+                    report.lifecycleHeld = true;
+                    return;
+                }
                 report.attempted += 1;
                 // #1901: this attempt's line. Its number is the one the journal records, which
                 // `recordExecutorDelivery` answers — the Durable Object's RPC does the same.
@@ -4070,6 +4185,9 @@ export class SqliteScopeHost {
         return isPrimaryScopeRow(this.directory.prepare('SELECT kind, forked_from FROM scopes WHERE scope_id = ?').get(scopeId));
     }
     async drainDue(tenantId, scopeId) {
+        if (this.scopeWorkRefusal(tenantId, scopeId)) {
+            return { attempted: 0, delivered: 0, retrying: 0, deadLettered: 0, lifecycleHeld: true };
+        }
         const rt = this.runtime(tenantId, scopeId);
         await this.applyPendingMigrations(rt);
         // #1525: null, and honestly so — a sweep is not a call. An attempt this pass makes
@@ -4254,13 +4372,11 @@ export class SqliteScopeHost {
         this.attachmentExtractors, this.attachmentTextBounds);
     }
     async startJobRun(tenantId, scopeId, input) {
-        const rt = this.runtime(tenantId, scopeId);
-        await this.applyPendingMigrations(rt);
+        const rt = await this.openActiveScope(tenantId, scopeId);
         return jobRunOf(await startJobRun(this.jobStore(rt), input, ulid, this.clock));
     }
     async runDueJobs(tenantId, scopeId, options) {
-        const rt = this.runtime(tenantId, scopeId);
-        await this.applyPendingMigrations(rt);
+        const rt = await this.openActiveScope(tenantId, scopeId);
         // #1575: the kernel's extraction jobs are this host's own, bound to this scope — no
         // deployment registers them, and none can shadow them. The backfill starts here, on
         // the drive, so a scope's first request never pays for attachments that predate it.
@@ -4292,6 +4408,9 @@ export class SqliteScopeHost {
         // directory, so a node control plane can drain routed intents exactly as the
         // Cloudflare one does; the context build is the same one `dispatchExecutors` hands
         // an in-process connector.
+        const refusal = this.scopeWorkRefusal(tenantId, scopeId, true);
+        if (refusal)
+            throw substratError('conflict', refusal, { reason: SCOPE_GATE_REASONS.notActive });
         const rt = this.runtime(tenantId, scopeId);
         // `false`: this path deliberately does NOT enqueue, so nothing is held and
         // the connection's reads take an ordinary serialized turn. Built on a view bound to
@@ -5075,6 +5194,7 @@ export class SqliteScopeHost {
             expiresAt: r.expires_at,
             ...(r.serving_ref ? { servingRef: r.serving_ref } : {}),
             archivedAt: r.archived_at ?? null,
+            archivedFromStatus: (r.archived_from_status ?? null),
             createdAt: r.created_at,
         });
         // The (version, scope) pair a bind and its impact read both start from, and the refusals
@@ -5125,14 +5245,15 @@ export class SqliteScopeHost {
                 // Stamp/clear archived_at so the reap sweep can age scopes (§4.4). Entering
                 // `archived` records when; `unarchive` (→ active, a restore) clears it so a later
                 // re-archive dates from the new event; `reaped` keeps it as terminal history.
+                // #1524: the status it left is recorded beside the stamp and cleared with it.
                 if (to === 'archived') {
                     this.directory
-                        .prepare('UPDATE scopes SET status = ?, archived_at = ? WHERE scope_id = ?')
-                        .run(to, new Date().toISOString(), scopeId);
+                        .prepare('UPDATE scopes SET status = ?, archived_at = ?, archived_from_status = ? WHERE scope_id = ?')
+                        .run(to, new Date().toISOString(), row.status, scopeId);
                 }
                 else if (to === 'active') {
                     this.directory
-                        .prepare('UPDATE scopes SET status = ?, archived_at = NULL WHERE scope_id = ?')
+                        .prepare('UPDATE scopes SET status = ?, archived_at = NULL, archived_from_status = NULL WHERE scope_id = ?')
                         .run(to, scopeId);
                 }
                 else {
@@ -5141,8 +5262,11 @@ export class SqliteScopeHost {
                 if (to === 'archived' || to === 'reaped') {
                     this.directory.prepare('UPDATE peer_bindings SET invalidated = 1 WHERE tenant_id = ? AND target_scope_id = ?').run(tenantId, scopeId);
                 }
-                if (to === 'reaped')
+                if (to === 'reaped') {
                     forgetSwitchesOf(switchSqlOf(this.directory), scopeId);
+                    // #1524: its storage is gone, so its samples describe nothing.
+                    forgetScopeStorage(redactionSqlOf(this.directory), scopeId);
+                }
                 // The audit target carries the scope's vertical (control-plane.md §4.4:
                 // "vertical stays null until §4.2 lifecycle actions that name one"). It is
                 // read from the scope rather than passed in, so the trail cannot disagree
@@ -6449,6 +6573,11 @@ export class SqliteScopeHost {
                 if (opts?.expectedVersionId !== undefined && scope.vertical_version_id !== opts.expectedVersionId) {
                     throw substratError('precondition_failed', 'scope binding changed; reload the scope and retry');
                 }
+                const epoch = this.directory.prepare('SELECT COALESCE(erasure_epoch, 0) AS erasure_epoch FROM scopes WHERE tenant_id = ? AND scope_id = ?')
+                    .get(tenantId, scopeId);
+                if (opts?.expectedErasureEpoch !== undefined && epoch?.erasure_epoch !== opts.expectedErasureEpoch) {
+                    throw substratError('precondition_failed', 'scope erasure changed; reload the scope and retry');
+                }
                 const ack = bindAcknowledgement.parse(opts?.acknowledge ?? {});
                 // #1756: an export an app in this tenant imports, dropped or re-versioned by what this
                 // scope would run. Before the snapshot, so a refused bind leaves nothing behind.
@@ -6466,12 +6595,7 @@ export class SqliteScopeHost {
                         await this.snapshotScope(actor, tenantId, scopeId);
                     }
                 }
-                const update = opts?.expectedVersionId === undefined
-                    ? this.directory.prepare('UPDATE scopes SET vertical_version_id = ?, vertical = ? WHERE scope_id = ?')
-                        .run(versionId, v.verticalSlug, scopeId)
-                    : this.directory.prepare('UPDATE scopes SET vertical_version_id = ?, vertical = ? WHERE scope_id = ? AND vertical_version_id IS ?')
-                        .run(versionId, v.verticalSlug, scopeId, opts.expectedVersionId);
-                if (update.changes === 0) {
+                if (!this.moveScopeRow('vertical_version_id = ?, vertical = ?', [versionId, v.verticalSlug], tenantId, scopeId, opts)) {
                     throw substratError('precondition_failed', 'scope binding changed; reload the scope and retry');
                 }
                 this.recordAdmin(actor, 'bindScopeVersion', { tenantId, scopeId }, null, {
@@ -6482,6 +6606,106 @@ export class SqliteScopeHost {
                     ...(ack.exportBreak ? { acknowledged: ack } : {}),
                 });
             },
+            recordScopeScriptCopy: async (_actor, tenantId, scopeId, scriptRef, moveId, opts) => {
+                if (!scriptRef || !moveId)
+                    throw substratError('conflict', 'copy script and move must name a real script');
+                const result = this.directory.prepare(`INSERT INTO scope_script_copies (tenant_id, scope_id, script_ref, move_id, state, role, load_stamp, lease_until)
+           SELECT tenant_id, scope_id, ?, ?, 'pending', ?, ?, ? FROM scopes
+           WHERE tenant_id = ? AND scope_id = ? AND reap_claimed_at IS NULL
+           ON CONFLICT (tenant_id, scope_id, script_ref, move_id) DO NOTHING`).run(scriptRef, moveId, opts?.role ?? null, opts?.loadStamp ?? null, new Date(Date.now() + (opts?.leaseMs ?? SCOPE_COPY_LEASE_MS)).toISOString(), tenantId, scopeId);
+                if (result.changes > 0)
+                    return;
+                const scope = this.directory.prepare('SELECT reap_claimed_at FROM scopes WHERE tenant_id = ? AND scope_id = ?')
+                    .get(tenantId, scopeId);
+                if (!scope)
+                    throw substratError('not_found', `unknown scope ${scopeId} in tenant ${tenantId}`);
+                if (scope.reap_claimed_at !== null)
+                    throw substratError('precondition_failed', `scope ${scopeId} is being reaped`);
+            },
+            backfillScopeScriptCopy: async (actor, tenantId, scopeId, scriptRef, opts) => {
+                if (!scriptRef)
+                    throw substratError('conflict', 'a backfilled copy must name a real script');
+                // The audit row commits with the entry, stamped with the erasure epoch read in the same unit.
+                return this.directory.transaction(() => {
+                    const written = this.directory.prepare(COPY_BACKFILL_SQL).run(...copyBackfillParams(tenantId, scopeId, scriptRef)).changes > 0;
+                    const scope = this.directory.prepare(COPY_BACKFILL_SCOPE_SQL).get(tenantId, scopeId);
+                    if (!written)
+                        return copyBackfillRefusal(scope);
+                    this.recordAdmin(actor, 'backfillScopeCopy', { tenantId, scopeId }, { erasureEpoch: scope.erasure_epoch }, { scriptRef, fromLogId: opts?.fromLogId ?? null });
+                    return 'recorded';
+                })();
+            },
+            claimExpiredScopeScriptCopies: async (_actor, input) => {
+                const limit = assertRowLimit('limit', input.limit);
+                return this.directory.transaction(() => {
+                    const due = this.directory.prepare(COPY_EXPIRED_SQL).all(input.now, limit);
+                    const claimed = [];
+                    for (const r of due) {
+                        if (this.directory.prepare(COPY_CLAIM_SQL).run(input.owner, input.leaseUntil, r.tenant_id, r.scope_id, r.script_ref, r.move_id, input.now).changes === 0)
+                            continue;
+                        claimed.push(this.directory.prepare(`SELECT ${SCOPE_SCRIPT_COPY_COLUMNS} FROM scope_script_copies
+               WHERE tenant_id = ? AND scope_id = ? AND script_ref = ? AND move_id = ?`).get(r.tenant_id, r.scope_id, r.script_ref, r.move_id));
+                    }
+                    return claimed.map(scopeScriptCopyOf);
+                })();
+            },
+            beginScopeScriptReap: async (_actor, tenantId, scopeId) => {
+                const result = this.directory.prepare(`UPDATE scopes SET reap_claimed_at = strftime('%Y-%m-%dT%H:%M:%fZ','now')
+           WHERE tenant_id = ? AND scope_id = ? AND reap_claimed_at IS NULL
+             AND NOT EXISTS (SELECT 1 FROM scope_script_copies AS move
+               WHERE move.tenant_id = scopes.tenant_id AND move.scope_id = scopes.scope_id
+                 AND move.state = 'pending')`).run(tenantId, scopeId);
+                if (result.changes > 0)
+                    return;
+                const scope = this.directory.prepare('SELECT reap_claimed_at FROM scopes WHERE tenant_id = ? AND scope_id = ?')
+                    .get(tenantId, scopeId);
+                if (!scope)
+                    throw substratError('not_found', `unknown scope ${scopeId} in tenant ${tenantId}`);
+                if (scope.reap_claimed_at !== null)
+                    return; // a reaper resumes its earlier claim
+                throw substratError('precondition_failed', `scope ${scopeId} has a copy move in flight; retry reap after it settles`);
+            },
+            settleScopeScriptCopy: async (_actor, tenantId, scopeId, scriptRef, moveId, state, marker, opts) => this.directory.transaction(() => {
+                const settled = this.directory.prepare(`UPDATE scope_script_copies SET state = ?, load_stamp = ?, revision = ?,
+               last_attempt_at = strftime('%Y-%m-%dT%H:%M:%fZ','now')
+             WHERE tenant_id = ? AND scope_id = ? AND script_ref = ? AND move_id = ?
+               AND (state <> 'done' OR ? = 'done')
+               ${opts?.claimedBy === undefined ? '' : "AND state = 'pending' AND lease_owner = ?"}`).run(state, marker?.loadStamp ?? null, marker?.revision ?? null, tenantId, scopeId, scriptRef, moveId, state, ...(opts?.claimedBy === undefined ? [] : [opts.claimedBy])).changes > 0;
+                if (settled && state === 'done')
+                    this.directory.prepare(COPY_BACKFILL_SUPERSEDE_SQL).run(tenantId, scopeId);
+                return settled;
+            })(),
+            touchScopeScriptCopy: async (_actor, tenantId, scopeId, scriptRef, moveId) => {
+                this.directory.prepare(`UPDATE scope_script_copies SET last_attempt_at = strftime('%Y-%m-%dT%H:%M:%fZ','now')
+           WHERE tenant_id = ? AND scope_id = ? AND script_ref = ? AND move_id = ? AND state = 'eligible'`).run(tenantId, scopeId, scriptRef, moveId);
+            },
+            listScopeScriptCopies: async (_actor, filter) => {
+                const where = [];
+                const args = [];
+                if (filter.tenantId) {
+                    where.push('tenant_id = ?');
+                    args.push(filter.tenantId);
+                }
+                if (filter.scopeId) {
+                    where.push('scope_id = ?');
+                    args.push(filter.scopeId);
+                }
+                if (filter.state) {
+                    where.push('state = ?');
+                    args.push(filter.state);
+                }
+                if (filter.after) {
+                    if (!filter.tenantId || !filter.scopeId)
+                        throw substratError('validation_failed', 'copy cursor requires tenant and scope');
+                    where.push('(script_ref > ? OR (script_ref = ? AND move_id > ?))');
+                    args.push(filter.after.scriptRef, filter.after.scriptRef, filter.after.moveId);
+                }
+                const limit = assertRowLimit('limit', filter.limit ?? 100);
+                const order = filter.scopeId ? 'script_ref, move_id' : 'last_attempt_at, tenant_id, scope_id, script_ref';
+                const rows = this.directory.prepare(`SELECT ${SCOPE_SCRIPT_COPY_COLUMNS} FROM scope_script_copies ${where.length ? `WHERE ${where.join(' AND ')}` : ''}
+           ORDER BY ${order} LIMIT ?`).all(...args, limit);
+                return rows.map(scopeScriptCopyOf);
+            },
             /**
              * Record that this scope's provision has now run against `versionId` (#1172).
              * Written only after a provision or reconcile succeeded — a receipt, never a hope.
@@ -6559,9 +6783,9 @@ export class SqliteScopeHost {
                     if (breaks.length > 0)
                         throw substratError('precondition_failed', bindExportBreakRefusal(breaks));
                 }
-                this.directory
-                    .prepare('UPDATE scopes SET serving_ref = ? WHERE scope_id = ?')
-                    .run(servingRef, scopeId);
+                if (!this.moveScopeRow('serving_ref = ?', [servingRef], tenantId, scopeId, opts)) {
+                    throw substratError('precondition_failed', 'scope erasure or reap changed; reload and retry');
+                }
                 this.recordAdmin(actor, 'setScopeServingRef', { tenantId, scopeId }, { servingRef: scope.serving_ref }, { servingRef, ...(ack.exportBreak ? { acknowledged: ack } : {}) });
             },
             recordKeptCopyResolution: async (actor, tenantId, scopeId, r) => {
@@ -7428,8 +7652,15 @@ export class SqliteScopeHost {
                 this.recordAccess(actor, 'openSubjectPayloads', { tenantId, scopeId }, { subjects: new Set(items.map((i) => i.subjectId)).size }, opened.filter((o) => o !== null).length);
                 return opened;
             },
-            shredSubject: async (actor, tenantId, scopeId, subjectId) => {
+            // `stamp` is the erasure epoch an orchestrated erasure's claim compared (#1722). A direct shred
+            // claims nothing and records the epoch it ran under: the backfill orders erasures by them.
+            shredSubject: async (actor, tenantId, scopeId, subjectId, stamp) => {
                 this.assertScope(tenantId, scopeId);
+                const before = stamp ?? {
+                    erasureEpoch: this.directory.prepare(COPY_BACKFILL_SCOPE_SQL).get(tenantId, scopeId)
+                        ?.erasure_epoch ?? 0,
+                    path: 'direct',
+                };
                 // Redact the live spine FIRST. Both halves are idempotent and a crash between them
                 // converges on retry, so the order is decided by which half-done state harms the
                 // person: dying after this leaves ciphertext in a backup that no key opens; dying
@@ -7511,12 +7742,38 @@ export class SqliteScopeHost {
                 // BOTH logs, which is unusual and deliberate: the admin log because this is a
                 // mutation, the access log because it destroys evidence. An erasure is the one
                 // action where "who asked for this to disappear" is itself the record.
-                this.recordAdmin(actor, 'shredSubject', { tenantId, scopeId }, null, receipt);
+                this.recordAdmin(actor, 'shredSubject', { tenantId, scopeId }, before, receipt);
                 // BOTH counts: the access log's number is "how much evidence this destroyed", and
                 // an intent payload is a whole event's worth of it.
                 this.recordAccess(actor, 'shredSubject', { tenantId, scopeId }, { subjectId }, redacted.changes + intentsRedacted + jobRunsRedacted + idempotencyResults + moduleRowsErased(vertical));
                 return receipt;
             },
+            scopeErasureEpoch: async (_actor, tenantId, scopeId) => {
+                // NULL on every row from before the column (#1722): the same 0 every CAS compares against.
+                const row = this.directory.prepare('SELECT COALESCE(erasure_epoch, 0) AS erasure_epoch FROM scopes WHERE tenant_id = ? AND scope_id = ?')
+                    .get(tenantId, scopeId);
+                if (!row)
+                    throw substratError('not_found', `unknown scope ${scopeId} in tenant ${tenantId}`);
+                return row.erasure_epoch;
+            },
+            finalizeSubjectShred: async (actor, tenantId, scopeId, subjectId, redactions, expected) => {
+                if (redactions.length === 0)
+                    throw substratError('conflict', 'subject erasure has no confirmed scope redaction');
+                const claimed = this.directory.prepare(`UPDATE scopes SET erasure_epoch = COALESCE(erasure_epoch, 0) + 1
+           WHERE tenant_id = ? AND scope_id = ? AND vertical_version_id IS ?
+             AND serving_ref IS ? AND COALESCE(erasure_epoch, 0) = ?
+             AND NOT EXISTS (SELECT 1 FROM scope_script_copies AS copy
+               WHERE copy.tenant_id = scopes.tenant_id AND copy.scope_id = scopes.scope_id
+                 AND copy.state = 'pending')
+             AND (SELECT COUNT(*) FROM scope_script_copies AS copy
+               WHERE copy.tenant_id = scopes.tenant_id AND copy.scope_id = scopes.scope_id) = ?`).run(tenantId, scopeId, expected.versionId, expected.servingRef, expected.epoch, expected.copyCount);
+                if (claimed.changes === 0)
+                    throw substratError('precondition_failed', 'scope route or copy inventory changed during subject erasure; retry after it settles');
+                // The pure adapter has one co-located scope store. Its existing atomic shred is
+                // the final local redaction and key destruction, after remote copies confirmed.
+                const shred = this.admin.shredSubject;
+                return shred(actor, tenantId, scopeId, subjectId, { erasureEpoch: expected.epoch, path: 'orchestrated' });
+            },
             // -- impersonation (K-42, #868) ----------------------------------------
             beginImpersonation: async (actor, input) => {
                 // Fail closed on the scope before minting anything, exactly as the
@@ -7589,6 +7846,8 @@ export class SqliteScopeHost {
                     '_substrat_switch_owed', // #2045: subjects owed a re-assert, per scope
                     '_substrat_findings', // #1748: the tenant's findings
                     '_substrat_finding_rules', // #1748: the tenant's suppress rules
+                    '_substrat_scope_storage', // #1524: storage samples of scopes whose storage is gone
+                    '_substrat_scope_storage_attempts', // #1524: and the phase's last try at each
                 ];
                 const clear = this.directory.transaction(() => {
                     for (const table of tables) {
@@ -7681,7 +7940,11 @@ export class SqliteScopeHost {
                 const reading = foldMeterReading({
                     readAt: instant.parse(new Date().toISOString()),
                     tenants: this.directory.prepare(`SELECT tenant_id, slug, status FROM tenants${where}`).all(...args).map((r) => ({ tenantId: r.tenant_id, slug: r.slug, status: r.status })),
-                    scopes: this.directory.prepare(`SELECT tenant_id, status FROM scopes${where}`).all(...args).map((r) => ({ tenantId: r.tenant_id, status: r.status })),
+                    scopes: this.directory.prepare(`SELECT tenant_id, status, archived_from_status FROM scopes${where}`).all(...args).map((r) => ({
+                        tenantId: r.tenant_id,
+                        status: r.status,
+                        archivedFromStatus: r.archived_from_status,
+                    })),
                     entitlements: this.directory
                         .prepare(`SELECT tenant_id, entitlement_key, plan, expires_at FROM _substrat_entitlements${where}`)
                         .all(...args).map((r) => ({
@@ -7690,6 +7953,9 @@ export class SqliteScopeHost {
                         plan: r.plan,
                         expiresAt: r.expires_at,
                     })),
+                    // #1524: the stored gauge's latest sample per non-reaped scope. A directory read only.
+                    storage: listScopeStorageRows(redactionSqlOf(this.directory), { tenantId: only, latest: true }),
+                    storageAttempts: listScopeStorageAttemptRows(redactionSqlOf(this.directory), only),
                 });
                 // The count that matters for K-24 is how many TENANTS this reading covered —
                 // "read the meter for one tenant" and "metered the whole fleet" are different
@@ -8554,6 +8820,20 @@ export class SqliteScopeHost {
                 this.directory.prepare('DELETE FROM _substrat_model_usage WHERE at < ?').run(horizon);
                 return { recorded: res.changes > 0 };
             },
+            recordScopeStorage: async (_actor, readings) => ({
+                recorded: this.directory.transaction(() => recordScopeStorageRows(redactionSqlOf(this.directory), readings))(),
+            }),
+            listScopeStorage: async (actor, filter) => {
+                const rows = listScopeStorageRows(redactionSqlOf(this.directory), filter);
+                this.recordAccess(actor, 'listScopeStorage', { tenantId: filter?.tenantId ?? null, scopeId: filter?.scopeId ?? null }, filter ?? null, rows.length);
+                return rows;
+            },
+            listScopeStorageAttempts: async (actor) => {
+                const rows = listScopeStorageAttemptRows(redactionSqlOf(this.directory));
+                this.recordAccess(actor, 'listScopeStorageAttempts', { tenantId: null }, null, rows.length);
+                return rows;
+            },
+            pruneScopeStorage: async (_actor, limit) => pruneScopeStorageRows(redactionSqlOf(this.directory), Date.now(), limit),
             listModelUsage: async (actor, filter) => {
                 const rows = this.selectModelUsage(filter);
                 this.recordAccess(actor, 'listModelUsage', { tenantId: filter?.tenantId ?? null, scopeId: filter?.scopeId ?? null }, filter, rows.length);
@@ -8581,6 +8861,28 @@ export class SqliteScopeHost {
      * directory. `PRAGMA table_info` is available in the pure adapter (the DO adapter
      * has to attempt-and-tolerate instead — see its `ensureDirectoryColumns`).
      */
+    /**
+     * Move a scope's binding or route (#1722), conditionally: on the binding the caller read, on
+     * the erasure epoch its carry read (a NULL epoch, from before the column, is 0) with no reap
+     * claimed, and on its copy move still owning a live lease. The move's confirmation commits in
+     * the same transaction as the row. False when any condition failed and nothing was written.
+     */
+    moveScopeRow(set, setArgs, tenantId, scopeId, cond) {
+        const now = new Date().toISOString();
+        return this.directory.transaction(() => {
+            const moved = this.directory.prepare(`UPDATE scopes SET ${set} WHERE scope_id = ?
+         ${cond?.expectedVersionId === undefined ? '' : 'AND vertical_version_id IS ?'}
+         ${cond?.expectedErasureEpoch === undefined ? '' : 'AND COALESCE(erasure_epoch, 0) = ? AND reap_claimed_at IS NULL'}
+         ${cond?.confirmMove === undefined ? '' : COPY_MOVE_LIVE_PREDICATE}`).run(...setArgs, scopeId, ...(cond?.expectedVersionId === undefined ? [] : [cond.expectedVersionId]), ...(cond?.expectedErasureEpoch === undefined ? [] : [cond.expectedErasureEpoch]), ...(cond?.confirmMove === undefined ? [] : copyMoveLiveParams(cond.confirmMove, now)));
+            if (moved.changes === 0)
+                return false;
+            if (cond?.confirmMove) {
+                this.directory.prepare(COPY_MOVE_CONFIRM_SQL).run(...copyMoveConfirmParams(cond.confirmMove, tenantId, scopeId, now));
+                this.directory.prepare(COPY_BACKFILL_SUPERSEDE_SQL).run(tenantId, scopeId);
+            }
+            return true;
+        })();
+    }
     ensureColumn(db, table, column, ddl) {
         // Without case, as SQLite resolves a column name: a restore may have added this column
         // already, untyped and spelled as a newer kernel's dump spelled it (#1883).
@@ -8767,6 +9069,8 @@ export class SqliteScopeHost {
         // #1172: which version this scope's provision hook last ran against. Null on every
         // existing row, which reads as "unknown, reconcile once" rather than "up to date".
         this.ensureColumn(this.directory, 'scopes', 'provisioned_version_id', 'provisioned_version_id TEXT');
+        this.ensureColumn(this.directory, 'scopes', 'erasure_epoch', 'erasure_epoch INTEGER');
+        this.ensureColumn(this.directory, 'scopes', 'reap_claimed_at', 'reap_claimed_at TEXT');
         // §4.8's grace-window timestamp on tenants (mirrors scopes' archived_at).
         this.ensureColumn(this.directory, 'tenants', 'deleting_at', 'deleting_at TEXT');
         this.ensureColumn(this.directory, 'tenants', 'provisioned_by_tenant', 'provisioned_by_tenant TEXT REFERENCES tenants(tenant_id)');
@@ -8853,6 +9157,7 @@ export class SqliteScopeHost {
             ['expires_at', 'expires_at TEXT'],
             ['serving_ref', 'serving_ref TEXT'],
             ['archived_at', 'archived_at TEXT'],
+            ['archived_from_status', 'archived_from_status TEXT'],
         ]) {
             if (!existing.has(column))
                 this.directory.exec(`ALTER TABLE scopes ADD COLUMN ${ddl}`);
@@ -9617,6 +9922,11 @@ export class SqliteScopeHost {
         // KERNEL_DDL is all IF NOT EXISTS, so a scope DB created before K-21 keeps the
         // old shape — ALTER the tombstone in.
         this.ensureColumn(db, '_substrat_tuples', 'revoked_at', 'revoked_at TEXT');
+        // #2126: NULL keeps every existing capability's attachment behavior unchanged.
+        this.ensureColumn(db, '_substrat_capabilities', 'attachments', 'attachments TEXT');
+        // #1686: NULL on every row already there — none is a principal-minted become.
+        this.ensureColumn(db, '_substrat_capabilities', 'target_digest', 'target_digest TEXT');
+        this.ensureColumn(db, '_substrat_capabilities', 'revoked_reason', 'revoked_reason TEXT');
         db.exec(GRANT_CHILDREN_INDEX_DDL);
         // Executor retry state (#100), same reasoning: scopes provisioned before it
         // already have the table. Defaults read as "terminal", which is exactly right