@substrat-run/adapter-sqlite 0.144.0 → 0.146.0

package/dist/index.js

@@ -1,8 +1,8 @@
 import { existsSync, mkdirSync, readdirSync, readFileSync, realpathSync, rmSync, writeFileSync } from 'node:fs';
 import { dirname, join } from 'node:path';
 import Database from 'better-sqlite3';
-import { accessLogEntry, adminLogEntry, delegatedReadParams, operationSeriesCount, opsFailureEntry, opsFailureFingerprint, issueEntry, FRESHNESS_HEARTBEAT_MINUTES, sweepRunEntry, modelUsageEntry, ATTACHMENT_ADDED, ATTACHMENT_REMOVED, attachmentRecord, createTenantInput, domainEvent, domainEventInput, exportReadInput, importBatch, importCursorMove, exportsOfManifestJson, importsOfManifestJson, entitlementGrant, entitlementGrantInput, eventId, meterReading, platformRequestInput, platformRequestId, MAX_PENDING_PLATFORM_REQUESTS, identityLink, identityPool, instant, isSubstratError, connection, capabilityGrant, connectionGrant, connectionGrantRecord, connectionSecret, systemGrant, systemSwitch, systemSwitchRecord, peerSwitch, verticalCaller, verticalSlug as verticalSlugOf, subjectRef, requestFingerprint, createConnectionInput, connectLinkFilter, connectLinkKey, consumeConnectLinkInput, mintConnectLinkInput, projectedConnectionGrant, projectedConnectionKey, moduleManifest, createOrgInput, promotionAcknowledgement, bindAcknowledgement, bindHostnameInput, channelHistoryEntry, hostnameBinding, publishVersionInput, AUTO_ADMISSION_NOTE, routeTarget, ROUTE_SCOPE_HOSTNAMES_MAX, registerVerticalInput, vertical as verticalSchema, verticalChannel, verticalVersion, objectRef, entityObjectRef, assertModuleEmittableType, assertKernelAuthoredType, grantRefFromProof, org as orgSchema, orgMembership, principalId, resolvedIdentity, identityMembership, roleDefinition, scope as scopeSchema, tenant as tenantSchema, tenantRole, principalBecomeCapabilityInput, subjectShredReceipt, SCOPE_TABLE_PAGE_DEFAULT, SCOPE_TABLE_PAGE_MAX, SCOPE_QUERY_ROW_MAX, verticalServingState, callsOfManifestJson, outboundOfManifestJson, listLimitOf, pageOf, countedPageOf, SCOPE_GATE_REASONS, substratError, assertReplayableDump, delegatedReadRecord, ownerTransferAudit, memberChangeAudit, peerBindingAudit, copyMarkAudit, redrainEventsInput, REDRAIN_BATCH, } from '@substrat-run/contracts';
-import { actorOf, asPrincipal, assertAllowed, assertNoSecret, assertPermissionKey, CAPABILITY_DDL, COPY_ORIGIN_DDL, ENTITY_STATE_MOVES_DDL, CAPABILITY_EXCHANGE_OPERATION, CAPABILITY_BECOME_MINT_OPERATION, becomeMintCheck, mintBecomeCapabilityAsPrincipal, revokeBecomeCapabilityAsPrincipal, readBecomeLinkStates, ENTITY_UNBIND_OPERATION, allowedFor, unbindEntityHolderBounded, capabilityAttachmentWriteRefused, capabilityTokenHash, createCapabilityVerbs, createEntityEdgeVerbs, createEntityStateVerbs, createTrashedReads, CONTINUATION_POSITION_CAP, visibleContinuation, searchStateWhere, uncheckedView, addStatePlans, entityStateMigrations, assertNoCallerPurge, isUnreachableParent, heldPurgePass, purgeDueOf, purgeHeldBy, lifecycleRefusal, purgeOnlyKeysOf, purgeReportOf, purgeStillDue, refuseTrashedTarget, assertBoundOperations, registerTrashTargets, runPurgePass, withheldKeysFor, statefulTablesOf, afterMigration, afterRuntimeDdl, derivesAnything, repairDerivedObjects, StateColumnLost, exchangeCapability as exchangeCapabilitySecret, guardSecrets, mintBecomeCapability, plausibleSessionToken, readCapabilityPage, redactSecrets, redactSecretText, moduleLog, consoleLogSink, asyncInvocationId, asyncLinePass, consoleInvocationLineSink, resolveCapabilitySession, revokeCapabilityAsPlatform, assertReadOnlyQuery, attachmentBlobKey, attachmentSha256, entitlementDenial, requiredEntitlementFor, foldMeterReading, guardSpine, guardSqlLimits, DO_SQL_LIMITS, tooManyResultColumns, tooManyTableColumns, parseValidationRecords, resolveScopeRecord, ulid, ISSUE_RETENTION_DAYS, telemetryRetentionStatements, FINDINGS_DDL, SCOPE_STORAGE_DDL, forgetScopeStorage, listScopeStorageAttemptRows, listScopeStorageRows, pruneScopeStorageRows, recordScopeStorageRows, CONNECT_LINKS_DDL, consumeConnectLinkRow, insertConnectLink, listConnectLinks as listConnectLinkRows, readConnectLink, restoreConnectLinkRow, revokeConnectLinkRow, createFindingRule, findingOfOpsFailure, findingOfSweepRun, pruneFindings, listFindingRules, listFindings, observeFinding, revokeFindingRule, setFindingStatus, assertRowLimit, assertRowOffset, OPS_FAILURE_RETENTION_DAYS, SWEEP_RUN_RETENTION_DAYS, SWEEP_RUNS_INTENT_INDEX, sweepRunsIntentHasKind, MODEL_USAGE_RETENTION_DAYS, foldModelUsage, backoffAt, platformRequestHistoryQuery, platformRequestOf, PLATFORM_REQUEST_COLUMNS, PLATFORM_REQUEST_REDACTION_SQL, platformRequestRedactionParams, platformRequestRedactionQuery, intentPayloadCarriesSubject, redactSubjectJobRuns, eraseSubjectFromModules, moduleRowsErased, moduleErasurePlan, redactSubjectScopeText, redactSubjectDirectoryText, ISSUE_EXEMPLAR_OWNER_BACKFILL_SQL, issueExemplarOwner, JOB_RUN_PATCH_SQL, JOB_RUN_CLAIM_SQL, JOB_RUN_RENEW_SQL, JOB_RUN_BEGIN_SQL, JOB_RUN_MISS_SQL, JOB_RUN_MISS_SETTLE_SQL, admissionMissOutcome, JOB_STEP_RECORD_SQL, JOB_LEASE_EXPIRED_NOTE, assertLeaseMs, DELIVERY_ERROR_REDACTION_SQL, REDACTED_DELIVERY_NOTE, seatScopeTuple, applyScopeRoleChange, changeScopeRole, revokeScopeRoles, scopeRoleHolders, admitPeer, collectPeers, peerSeats, resolveVerticalInstanceFrom, resolvePeerInstanceFrom, peerGrantsStatus, systemGrantsStatus, systemScheduleState, systemSwitchedOff, systemSwitchedOffMessage, tenantSystemSwitchedOffMessage, PEER_SWITCHES_DDL, PEER_BINDINGS_DDL, SWITCH_OWED_DDL, SWITCH_FENCES_DDL, TABLE_OWNERS_DDL, assertMigrationLeavesLedgerAlone, recordOwnershipSteps, runMigrationStatements, executableSqlStatements, blankSqlComments, recordWriteSuperseded, switchFencesOf, switchSupersededMessage, SWITCH_KINDS, SYSTEM_SWITCHES_DDL, forgetSwitchesOf, listSystemSwitchRecords, moveSwitch, reassertActionOf, reassertEntry, reassertOffRow, recordSwitchedOff, recordSwitchedOn, restoreSwitchRecord, scopesSwitchedOffFor, switchActionOf, switchAuditSubject, recordAuditOutcome, auditedCapabilityRevoke, auditWarningOf, switchNotFoundMessage, switchRecordsOf, switchedOffOf, switchesBackfillSqlOf, switchesTableExists, tenantHeldOf, tenantHoldsGrant, inUnitMovesToAudit, staleCarryRevertRow, staleCarryReverts, withRecorded, VERSION_MIGRATIONS_DDL, splitManifestMigrations, splitVersionMigrationsBatch, versionMigrationsOf, writeVersionMigrations, denialListQuery, refusalListQuery, mapRefusalRow, denialSummaryQuery, denialTotalsQuery, DENIAL_WINDOW_QUERY, mapDenialRow, mapDenialSummaryBuckets, IMPERSONATION_COLUMNS, IMPERSONATION_DDL, ImpersonationRefused, assertImpersonationWrites, assertModuleEnqueueableKind, assertSessionUsable, impersonationByIdQuery, impersonationListQuery, impersonationRowValues, impersonationStampOf, mapImpersonationRow, newImpersonationSession, resolveRetryPolicy, executorOutcomeOf, isDeliveryRefusal, refusalJournalText, membershipFencesBackfillSql, MEMBERSHIP_FENCES_DDL, membershipFencesTableExists, MEMBERSHIP_FENCE_SINCE_SQL, RAISE_MEMBERSHIP_FENCE_SQL, memberAddedAudit, orgChangeBound, tenantCoverage, isSecretBoxConfigured, unconfiguredSecretBox, createSubjectKeys, generateSealingKeyPair, noSealingKeyMessage, openSealed, sealTo, ConnectionSealingKeyUnavailableError, PermissionDenied, createAtomic, NotSearchable, NotListable, listIndexMigrations, listIndexPlans, listQuery, cursorOf, moduleMigrations, MIGRATION_DIGEST_FENCE_DDL, MIGRATION_DIGEST_MARK_LEGACY, assertJournalDumpCoherent, assertMigrationSql, migrationDivergence, migrationFailedError, migrationSteps, planMigrations, isSearchIndexTable, searchIndexMigrations, searchIndexPlans, searchLimit, searchMatchExpression, searchQuery, ATTACHMENT_TEXT_DDL, assertAttachmentExtractors, resolveAttachmentTextBounds, assertJobRegistrable, attachmentRecordOfRow, attachmentTextJob, enqueueAttachmentText, ATTACHMENT_TEXT_BACKFILL_JOB, ATTACHMENT_TEXT_JOB, kernelJobFor, queueAttachmentTextBackfill, startAttachmentTextBackfill, attachmentTextBackfillJob, reconcileAttachmentText, recordAttachmentText, searchAttachments, entityVersionQuery, entityVersionOf, assertIfMatch, OUTBOX_ENTITY_INDEX, SCHEDULE_STATE_DDL, SCHEDULE_STATE_REBUILD, scheduleStateHasKind, VERTICAL_EVENTS_DDL, EXPORT_HOPS_SQL, emptyImportResult, IMPORT_CURSORS_SQL, IMPORT_CURSOR_OF_SQL, OUTBOX_MARK_SQL, emittedSinceQuery, emittedReportOf, EMITTED_REPORT_CAP, exportedSinceQuery, IMPORT_CURSOR_ADVANCE_SQL, IMPORT_RECORD_SQL, moveImportCursor, importCursorSourceOf, exportBreaksOf, exportBreakRefusal, bindExportBreaksOf, bindExportBreakRefusal, CrossVerticalRegistry, exportReadPlan, exportReadQuery, planExportBatch, withheldNote, JOB_RUN_DDL, JOB_RUN_DUE_AT, jobRunListLimit, jobRunOf, runDueJobRuns, startJobRun, IDEMPOTENCY_DDL, REFUSALS_TABLE_DDL, REFUSALS_INDEX, refusalInsert, refusalOf, markGuardRefusal, REFUSALS_REBUILD, refusalsAdmitGuards, assertIdempotencyKey, idempotencyLookupQuery, idempotencyPruneStatement, idempotencyRecordStatement, idempotencyOptedOutMessage, replayFor, globalFetch, createUlid, facetEvents, readHistory, walkEventCause, walkEventEffects, assertRedrainWindow, readInvocation, readDeadLetters, readLifecycleFlow, readOperationSeries, domainEventOf, readUndrainedOutbox, undrainedEventsOf, connectorCallRecord, noopConnectorCallRecorder, recordConnectorCall, settleConnectionUse, unknownRoleError, } from '@substrat-run/kernel';
+import { accessLogEntry, adminLogEntry, delegatedReadParams, operationSeriesCount, opsFailureEntry, opsFailureFingerprint, issueEntry, FRESHNESS_HEARTBEAT_MINUTES, sweepRunEntry, modelUsageEntry, ATTACHMENT_ADDED, ATTACHMENT_REMOVED, attachmentRecord, createTenantInput, domainEvent, domainEventInput, exportReadInput, importBatch, importCursorMove, exportsOfManifestJson, assertNoBindingShapeBreak, importsOfManifestJson, entitlementGrant, entitlementGrantInput, eventId, meterReading, platformRequestInput, platformRequestId, MAX_PENDING_PLATFORM_REQUESTS, identityLink, identityPool, instant, isSubstratError, connection, capabilityGrant, connectionGrant, connectionGrantRecord, connectionSecret, systemGrant, systemSwitch, systemSwitchRecord, peerSwitch, verticalCaller, verticalSlug as verticalSlugOf, subjectRef, requestFingerprint, createConnectionInput, connectLinkFilter, connectLinkKey, consumeConnectLinkInput, mintConnectLinkInput, projectedConnectionGrant, projectedConnectionKey, moduleManifest, createOrgInput, promotionAcknowledgement, bindAcknowledgement, bindHostnameInput, channelHistoryEntry, hostnameBinding, publishVersionInput, AUTO_ADMISSION_NOTE, routeTarget, ROUTE_SCOPE_HOSTNAMES_MAX, registerVerticalInput, vertical as verticalSchema, verticalChannel, verticalVersion, objectRef, entityObjectRef, assertModuleEmittableType, assertKernelAuthoredType, grantRefFromProof, org as orgSchema, orgMembership, principalId, resolvedIdentity, identityMembership, roleDefinition, scope as scopeSchema, tenant as tenantSchema, tenantRole, principalBecomeCapabilityInput, subjectShredReceipt, SCOPE_TABLE_PAGE_DEFAULT, SCOPE_TABLE_PAGE_MAX, SCOPE_QUERY_ROW_MAX, verticalServingState, callsOfManifestJson, outboundOfManifestJson, listLimitOf, pageOf, countedPageOf, SCOPE_GATE_REASONS, substratError, assertReplayableDump, delegatedReadRecord, ownerTransferAudit, memberChangeAudit, peerBindingAudit, copyMarkAudit, redrainEventsInput, REDRAIN_BATCH, } from '@substrat-run/contracts';
+import { actorOf, asPrincipal, assertAllowed, assertNoSecret, assertPermissionKey, CAPABILITY_DDL, COPY_ORIGIN_DDL, ENTITY_STATE_MOVES_DDL, CAPABILITY_EXCHANGE_OPERATION, CAPABILITY_BECOME_MINT_OPERATION, becomeMintCheck, mintBecomeCapabilityAsPrincipal, revokeBecomeCapabilityAsPrincipal, readBecomeLinkStates, ENTITY_UNBIND_OPERATION, allowedFor, unbindEntityHolderBounded, capabilityAttachmentWriteRefused, capabilityTokenHash, createCapabilityVerbs, createEntityEdgeVerbs, createEntityStateVerbs, createTrashedReads, CONTINUATION_POSITION_CAP, visibleContinuation, searchStateWhere, uncheckedView, addStatePlans, addUpdatedStampPlans, watchUpdatedStamps, entityStateMigrations, assertNoCallerPurge, isUnreachableParent, heldPurgePass, purgeDueOf, purgeHeldBy, lifecycleRefusal, purgeOnlyKeysOf, purgeReportOf, purgeStillDue, refuseTrashedTarget, assertBoundOperations, registerTrashTargets, runPurgePass, withheldKeysFor, statefulTablesOf, afterMigration, afterRuntimeDdl, derivesAnything, repairDerivedObjects, StateColumnLost, exchangeCapability as exchangeCapabilitySecret, guardSecrets, mintBecomeCapability, plausibleSessionToken, readCapabilityPage, redactSecrets, redactSecretText, moduleLog, consoleLogSink, asyncInvocationId, asyncLinePass, consoleInvocationLineSink, resolveCapabilitySession, revokeCapabilityAsPlatform, assertReadOnlyQuery, attachmentBlobKey, attachmentSha256, entitlementDenial, requiredEntitlementFor, foldMeterReading, guardSpine, guardSqlLimits, DO_SQL_LIMITS, tooManyResultColumns, tooManyTableColumns, parseValidationRecords, resolveScopeRecord, ulid, ISSUE_RETENTION_DAYS, telemetryRetentionStatements, FINDINGS_DDL, SCOPE_STORAGE_DDL, forgetScopeStorage, listScopeStorageAttemptRows, listScopeStorageRows, pruneScopeStorageRows, recordScopeStorageRows, CONNECT_LINKS_DDL, consumeConnectLinkRow, insertConnectLink, listConnectLinks as listConnectLinkRows, readConnectLink, restoreConnectLinkRow, revokeConnectLinkRow, createFindingRule, findingOfOpsFailure, findingOfSweepRun, pruneFindings, listFindingRules, listFindings, observeFinding, revokeFindingRule, setFindingStatus, assertRowLimit, assertRowOffset, OPS_FAILURE_RETENTION_DAYS, SWEEP_RUN_RETENTION_DAYS, SWEEP_RUNS_INTENT_INDEX, sweepRunsIntentHasKind, MODEL_USAGE_RETENTION_DAYS, foldModelUsage, backoffAt, platformRequestHistoryQuery, platformRequestOf, PLATFORM_REQUEST_COLUMNS, PLATFORM_REQUEST_REDACTION_SQL, platformRequestRedactionParams, platformRequestRedactionQuery, intentPayloadCarriesSubject, redactSubjectJobRuns, eraseSubjectFromModules, moduleRowsErased, moduleErasurePlan, redactSubjectScopeText, redactSubjectDirectoryText, ISSUE_EXEMPLAR_OWNER_BACKFILL_SQL, issueExemplarOwner, JOB_RUN_PATCH_SQL, JOB_RUN_CLAIM_SQL, JOB_RUN_RENEW_SQL, JOB_RUN_BEGIN_SQL, JOB_RUN_MISS_SQL, JOB_RUN_MISS_SETTLE_SQL, admissionMissOutcome, JOB_STEP_RECORD_SQL, JOB_LEASE_EXPIRED_NOTE, assertLeaseMs, DELIVERY_ERROR_REDACTION_SQL, REDACTED_DELIVERY_NOTE, seatScopeTuple, applyScopeRoleChange, changeScopeRole, revokeScopeRoles, scopeRoleHolders, admitPeer, peerCallerAt, collectPeers, peerSeats, resolveVerticalInstanceFrom, resolvePeerInstanceFrom, peerVerticalSpellings, samePeerVertical, peerGrantsStatus, systemGrantsStatus, systemScheduleState, systemSwitchedOff, systemSwitchedOffMessage, tenantSystemSwitchedOffMessage, PEER_SWITCHES_DDL, PEER_BINDINGS_DDL, SWITCH_OWED_DDL, SWITCH_FENCES_DDL, TABLE_OWNERS_DDL, assertMigrationLeavesLedgerAlone, recordOwnershipSteps, runMigrationStatements, executableSqlStatements, blankSqlComments, recordWriteSuperseded, switchFencesOf, switchSupersededMessage, SWITCH_KINDS, SYSTEM_SWITCHES_DDL, forgetSwitchesOf, listSystemSwitchRecords, moveSwitch, reassertActionOf, reassertEntry, reassertOffRow, recordSwitchedOff, recordSwitchedOn, restoreSwitchRecord, scopesSwitchedOffFor, switchActionOf, switchAuditSubject, recordAuditOutcome, auditedCapabilityRevoke, auditWarningOf, switchNotFoundMessage, switchRecordsOf, switchedOffOf, switchesBackfillSqlOf, switchesTableExists, tenantHeldOf, tenantHoldsGrant, inUnitMovesToAudit, staleCarryRevertRow, staleCarryReverts, withRecorded, VERSION_MIGRATIONS_DDL, splitManifestMigrations, splitVersionMigrationsBatch, versionMigrationsOf, writeVersionMigrations, denialListQuery, refusalListQuery, mapRefusalRow, denialSummaryQuery, denialTotalsQuery, DENIAL_WINDOW_QUERY, mapDenialRow, mapDenialSummaryBuckets, IMPERSONATION_COLUMNS, IMPERSONATION_DDL, ImpersonationRefused, assertImpersonationWrites, assertModuleEnqueueableKind, assertSessionUsable, impersonationByIdQuery, impersonationListQuery, impersonationRowValues, impersonationStampOf, mapImpersonationRow, newImpersonationSession, resolveRetryPolicy, executorOutcomeOf, isDeliveryRefusal, refusalJournalText, membershipFencesBackfillSql, MEMBERSHIP_FENCES_DDL, membershipFencesTableExists, MEMBERSHIP_FENCE_SINCE_SQL, RAISE_MEMBERSHIP_FENCE_SQL, memberAddedAudit, orgChangeBound, tenantCoverage, isSecretBoxConfigured, unconfiguredSecretBox, createSubjectKeys, generateSealingKeyPair, noSealingKeyMessage, openSealed, sealTo, ConnectionSealingKeyUnavailableError, PermissionDenied, createAtomic, NotSearchable, NotListable, listIndexMigrations, listIndexPlans, listQuery, cursorOf, moduleMigrations, MIGRATION_DIGEST_FENCE_DDL, MIGRATION_DIGEST_MARK_LEGACY, assertJournalDumpCoherent, assertMigrationSql, migrationDivergence, migrationFailedError, migrationSteps, planMigrations, isSearchIndexTable, searchIndexMigrations, searchIndexPlans, searchLimit, searchMatchExpression, searchQuery, ATTACHMENT_TEXT_DDL, assertAttachmentExtractors, resolveAttachmentTextBounds, assertJobRegistrable, attachmentRecordOfRow, attachmentTextJob, enqueueAttachmentText, ATTACHMENT_TEXT_BACKFILL_JOB, ATTACHMENT_TEXT_JOB, kernelJobFor, queueAttachmentTextBackfill, startAttachmentTextBackfill, attachmentTextBackfillJob, reconcileAttachmentText, recordAttachmentText, searchAttachments, entityVersionQuery, entityVersionOf, assertIfMatch, OUTBOX_ENTITY_INDEX, SCHEDULE_STATE_DDL, SCHEDULE_STATE_REBUILD, scheduleStateHasKind, VERTICAL_EVENTS_DDL, EXPORT_HOPS_SQL, emptyImportResult, IMPORT_CURSORS_SQL, IMPORT_CURSOR_OF_SQL, OUTBOX_MARK_SQL, emittedSinceQuery, emittedReportOf, EMITTED_REPORT_CAP, exportedSinceQuery, IMPORT_CURSOR_ADVANCE_SQL, IMPORT_RECORD_SQL, moveImportCursor, importCursorSourceOf, exportBreaksOf, exportBreakRefusal, bindExportBreaksOf, bindExportBreakRefusal, scopeMoveOf, runningVersionOf, isPrimaryScope, PROVISIONED_VERSIONS_SQL, installsReconciledOf, strandJudgmentsOf, provisionedVersionsParams, boundShapesColumn, boundShapesOfColumn, installReconciled, CrossVerticalRegistry, exportReadPlan, exportReadQuery, planExportBatch, withheldNote, JOB_RUN_DDL, JOB_RUN_DUE_AT, jobRunListLimit, jobRunOf, runDueJobRuns, startJobRun, IDEMPOTENCY_DDL, REFUSALS_TABLE_DDL, REFUSALS_INDEX, refusalInsert, refusalOf, markGuardRefusal, REFUSALS_REBUILD, refusalsAdmitGuards, assertIdempotencyKey, idempotencyLookupQuery, idempotencyPruneStatement, idempotencyRecordStatement, idempotencyOptedOutMessage, replayFor, globalFetch, createUlid, facetEvents, readHistory, walkEventCause, walkEventEffects, assertRedrainWindow, readInvocation, readDeadLetters, readLifecycleFlow, readOperationSeries, domainEventOf, readUndrainedOutbox, undrainedEventsOf, connectorCallRecord, noopConnectorCallRecorder, recordConnectorCall, settleConnectionUse, unknownRoleError, } from '@substrat-run/kernel';
 import { attributedView, delegatedRevokeSql, writeExplicitTupleIn, grantEntityShapeIn, shapeTopUpBatch, topUpEntityGrantShapes, settlePlatformRequestIn, } from '@substrat-run/kernel';
 import { ADMIN_LOG_INDEXES_SQL, SETTLE_INTENT_SQL, SETTLE_OUTCOME_SQL, settleOutcomeParamsOf, readAuditedOperations, unknownOutcomeOf, } from '@substrat-run/kernel';
 import { INERT_SCOPE_REASON, isPrimaryScopeRow } from '@substrat-run/kernel';
@@ -318,9 +318,9 @@ const KERNEL_DDL = `
   -- #1575: attachment text and its FTS5 index, shared from @substrat-run/kernel. After
   -- _substrat_attachments, whose delete trigger it adds.
   ${ATTACHMENT_TEXT_DDL}
-  -- #901: an entity's version is the ULID of the last event about it, so
-  -- MAX(id) per (entity_type, entity_id) is the read. The id column sits last so
-  -- SQLite walks to the end of the matched range instead of aggregating over it.
+  -- #901: an entity's version is the ULID of the last event about it (a state move
+  -- excepted, #2191), so the newest id per (entity_type, entity_id) is the read. The id
+  -- column sits last so SQLite walks the matched range backwards instead of aggregating.
   ${OUTBOX_ENTITY_INDEX}
 `;
 /** Row → contract shape. Never reads the secrets table — that is the point of the split. */
@@ -628,6 +628,8 @@ export class SqliteScopeHost {
     listPlans = new Map();
     /** #119: entity type → its archive/trash plan, from every registered module. */
     statePlans = new Map();
+    /** #2166: entity type → the updated stamps the host holds, from every registered module. */
+    updatedStampPlans = new Map();
     /** #2068: each registered module's erasure, in registration order — what `shredSubject` runs. */
     erasurePlans = [];
     /** entityType → the declared attachment gate (#473): read key + write key (default: read). */
@@ -1654,6 +1656,7 @@ export class SqliteScopeHost {
             seen.add(m.version);
         }
         addStatePlans(this.statePlans, manifest.id, manifest.entityStates, manifest.permissions);
+        addUpdatedStampPlans(this.updatedStampPlans, manifest.id, manifest.updatedStamps);
         for (const plan of listIndexPlans(manifest.id, manifest.lists, manifest.entityStates)) {
             const existing = this.listPlans.get(plan.entityType);
             if (existing) {
@@ -2905,7 +2908,10 @@ export class SqliteScopeHost {
                         // `{ vertical, scope }` and the authorization they passed (K-34). What it emits was
                         // emitted BECAUSE of the producer's event (#1237); the id resolves through
                         // `_substrat_imports`, which the row above has just written.
-                        await imp.handler(this.deliveryContext(rt, subject, undefined, { causedBy: e.id, invocationId: unit.invocationId }), event);
+                        const ctx = this.deliveryContext(rt, subject, undefined, { causedBy: e.id, invocationId: unit.invocationId });
+                        const stamps = watchUpdatedStamps(spineSql(rt.db), this.updatedStampPlans);
+                        await imp.handler(ctx, event);
+                        stamps?.assertHeld(ctx, `${imp.moduleId} consuming ${e.type}`);
                         rt.db
                             .prepare(`INSERT INTO _substrat_deliveries (event_id, consumer_module, delivered_at, invocation_id)
                  VALUES (?, ?, ?, NULL)`)
@@ -2956,24 +2962,63 @@ export class SqliteScopeHost {
      * move, the one case it decides anything.
      */
     bindBreaks(actor, scope, incoming, servingRef) {
-        const vertical = scope.vertical && (scope.servingRef || servingRef)
-            ? this.directory
-                .prepare('SELECT serving_ref, serving_version_id FROM verticals WHERE slug = ?')
-                .get(scope.vertical)
-            : undefined;
         return bindExportBreaksOf({
             admin: this.admin,
             actor,
             scope,
             incoming: { id: incoming.id, verticalSlug: incoming.verticalSlug },
             ...(servingRef !== undefined ? { servingRef } : {}),
-            serving: vertical?.serving_ref && vertical.serving_version_id
-                ? { ref: vertical.serving_ref, versionId: vertical.serving_version_id }
-                : null,
+            serving: this.servingPointerOf(scope, servingRef),
             readExports: async (versionId) => exportsOfManifestJson(this.manifestJsonOf(versionId) ?? null),
             readImports: async (slug, versionId) => this.versionImports(slug, versionId),
         });
     }
+    /**
+     * The serving pointer of `scope`'s vertical, read only when the scope is on a serving script
+     * before or after a move (`servingRef`), the one case it decides what the scope runs.
+     */
+    servingPointerOf(scope, servingRef) {
+        return scope.vertical && (scope.servingRef || servingRef) ? this.servingPointerOfVertical(scope.vertical) : null;
+    }
+    /** What `slug` serves in place, or null when nothing is. */
+    servingPointerOfVertical(slug) {
+        const v = this.directory
+            .prepare('SELECT serving_ref, serving_version_id FROM verticals WHERE slug = ?')
+            .get(slug);
+        return v?.serving_ref && v.serving_version_id ? { ref: v.serving_ref, versionId: v.serving_version_id } : null;
+    }
+    /**
+     * #2178: refuse running `incomingId` where any of `froms` ran, each distinct version judged once,
+     * and where installs last reconciled one of `receipts` — a refusal from those names them.
+     */
+    assertNoStrandFrom(froms, incomingId, receipts = []) {
+        const incoming = this.manifestJsonOf(incomingId);
+        const judged = [...new Set(froms)].filter((f) => !!f && f !== incomingId);
+        for (const from of judged)
+            assertNoBindingShapeBreak(this.manifestJsonOf(from), incoming);
+        // What each group of installs is judged from, and how (`strandJudgmentsOf`, one rule for both adapters).
+        for (const r of receipts)
+            for (const j of strandJudgmentsOf(r, judged, incomingId))
+                assertNoBindingShapeBreak(this.manifestJsonOf(j.from), incoming, j.opts);
+    }
+    /**
+     * #2178: refuse moving `scope` (a bind, or a route with `servingRef`) onto code that strands
+     * people a link bound — any scope, fork or preview included, since bound people live in its own
+     * spine. No acknowledgement passes it.
+     */
+    assertBindingShapesKept(scope, incomingId, servingRef) {
+        const move = scopeMoveOf(scope, incomingId, servingRef, this.servingPointerOf(scope, servingRef));
+        // A primary scope is also judged from the version it last reconciled: until then, a retirement
+        // the running version declares has not reached it (`PROVISIONED_VERSIONS_SQL`).
+        if (!move)
+            return;
+        const receipt = isPrimaryScope(scope) ? [installReconciled(scope, move.before)] : [];
+        this.assertNoStrandFrom([move.before], move.after, receipt);
+    }
+    /** `PROVISIONED_VERSIONS_SQL` over the directory. */
+    provisionedVersionsOf(vertical, serving, ownerTenant) {
+        return installsReconciledOf(this.directory.prepare(PROVISIONED_VERSIONS_SQL).all(...provisionedVersionsParams(vertical, serving, ownerTenant)));
+    }
     /** What one version of `slug` imports, from the registry; `not_found` for a version it does not know. */
     versionImports(slug, versionId) {
         const manifest = this.manifestJsonOf(versionId, slug);
@@ -3022,6 +3067,32 @@ export class SqliteScopeHost {
         await this.applyPendingMigrations(rt);
         return rt;
     }
+    /**
+     * The tenant a peer name is read in (#2252): the directory's own slug for that tenant, the one
+     * prefix a push pinned to it registers under. Never parsed out of the name being matched.
+     */
+    peerTenant(tenantId) {
+        const row = this.directory.prepare('SELECT slug FROM tenants WHERE tenant_id = ?').get(tenantId);
+        return { id: tenantId, slug: row?.slug ?? null };
+    }
+    /**
+     * Every scope of the tenant registered under a spelling of the peer name `vertical` in
+     * `tenant` (`peerVerticalSpellings`), for the kernel's resolvers to choose among (#2252).
+     */
+    peerCandidates(tenant, vertical) {
+        const rows = this.directory
+            .prepare(`SELECT scope_id, tenant_id, vertical, status, kind, forked_from FROM scopes
+          WHERE tenant_id = ? AND vertical IN (SELECT value FROM json_each(?))`)
+            .all(tenant.id, JSON.stringify(peerVerticalSpellings(vertical, tenant.slug)));
+        return rows.map((r) => ({
+            id: r.scope_id,
+            tenantId: r.tenant_id,
+            vertical: r.vertical,
+            status: r.status,
+            kind: r.kind ?? '',
+            forkedFrom: r.forked_from ?? null,
+        }));
+    }
     /** The directory's current hold, read again when background work is about to run. */
     scopeWorkRefusal(tenantId, scopeId, allowProvisioning = false) {
         const row = this.directory
@@ -3116,7 +3187,8 @@ export class SqliteScopeHost {
      * here, and `admitPeer` runs inside the scope's actor task on every invoke (`buildStub`).
      */
     async getVerticalScope(caller, tenantId, scopeId, options) {
-        const parsed = verticalCaller.parse(caller);
+        // #2252: the caller as this vertical's `peers` names it, as on the hosted door.
+        const parsed = peerCallerAt(this.peerDeclarations(), verticalCaller.parse(caller));
         const rt = await this.openActiveScope(tenantId, scopeId);
         return this.buildStub(tenantId, scopeId, rt, { kind: 'vertical-peer', caller: parsed }, options);
     }
@@ -3826,15 +3898,18 @@ export class SqliteScopeHost {
                             // so the only loss is effort on a path that was already failing.
                             const ref = guarded ? this.concurrencyRef(operation, guarded, parsed) : undefined;
                             const seen = ref && invokeOptions?.ifMatch !== undefined ? this.versionAt(rt, ref) : undefined;
+                            // #2166: what the guards and the handler emit about a stamped entity, held below.
+                            const stamps = watchUpdatedStamps(spineSql(rt.db), this.updatedStampPlans);
                             // #119: an operation on a TRASHED entity it did not declare it reaches is refused
                             // here, before the guards and the handler — the declared key first, so a caller
                             // without it meets the same `forbidden` an active entity gives (`entity-trash.ts`).
-                            await refuseTrashedTarget({ sql: spineSql(rt.db), plans: this.statePlans, check: ctx.check }, operation, target, parsed, purging ? { now: this.clock(), gate: this.purgeGateFacts(rt, subject.id, tenantId, scopeId) } : undefined);
+                            await refuseTrashedTarget({ sql: spineSql(rt.db), plans: this.statePlans, check: ctx.check, now: ctx.now() }, operation, target, parsed, purging ? { gate: this.purgeGateFacts(rt, subject.id, tenantId, scopeId) } : undefined);
                             // Manifest guards (K-17): pre-conditions, inside the operation's own
                             // transaction, before the handler. A throw here blocks the operation
                             // and rolls back exactly like a handler throw — fail closed.
                             await this.runGuards(operation, ctx, parsed);
                             result = await handler(ctx, parsed);
+                            stamps?.assertHeld(ctx, operation);
                             // #119: the purge gate's AUTHORITATIVE read. Lifecycle, primacy and tenant live in the
                             // directory, which this transaction does not cover and whose writers (a suspend, a
                             // tenant status, a reclassification) do not take the scope's actor — so a hold could
@@ -4682,7 +4757,9 @@ export class SqliteScopeHost {
                         });
                         rt.db.exec('BEGIN IMMEDIATE');
                         try {
+                            const stamps = watchUpdatedStamps(spineSql(rt.db), this.updatedStampPlans);
                             await consumer.handler(ctx, event);
+                            stamps?.assertHeld(ctx, `${mod.id} consuming ${event.type}`);
                             rt.db
                                 .prepare(`INSERT INTO _substrat_deliveries
                      (event_id, consumer_module, delivered_at, invocation_id)
@@ -5226,6 +5303,8 @@ export class SqliteScopeHost {
             schemaVersion: r.schema_version,
             verticalVersionId: r.vertical_version_id,
             provisionedVersionId: r.provisioned_version_id ?? null,
+            retirementsFinishedVersionId: r.retirements_finished_version_id ?? null,
+            boundShapes: boundShapesOfColumn(r.bound_shapes),
             migrationFailure: mapMigrationFailure(r),
             forkedFrom: r.forked_from,
             forkedAt: r.forked_at,
@@ -6078,32 +6157,16 @@ export class SqliteScopeHost {
                 return rows.map(mapHostname);
             },
             // #1706: the directory's answer to "vertical Y in tenant T", by the kernel's one rule.
+            // Names match EXACTLY: this is the cross-vertical edges' read (the import cursor's
+            // producer). A peer call's tenant-pinned spelling is `resolvePeerInstance`'s (#2252).
             resolveVerticalInstance: async (tenantId, vertical) => {
-                const rows = this.directory
-                    .prepare(`SELECT scope_id, tenant_id, vertical, status, kind, forked_from FROM scopes
-              WHERE tenant_id = ? AND vertical = ?`)
-                    .all(tenantId, vertical);
-                return resolveVerticalInstanceFrom(rows.map((r) => ({
-                    id: r.scope_id,
-                    tenantId: r.tenant_id,
-                    vertical: r.vertical,
-                    status: r.status,
-                    kind: r.kind ?? '',
-                    forkedFrom: r.forked_from ?? null,
-                })), tenantId, vertical);
+                const tenant = { id: tenantId, slug: null };
+                return resolveVerticalInstanceFrom(this.peerCandidates(tenant, vertical), tenant, vertical);
             },
             resolvePeerInstance: async (tenantId, callerScopeId, vertical) => {
                 const binding = this.directory.prepare('SELECT target_scope_id, invalidated FROM peer_bindings WHERE tenant_id = ? AND caller_scope_id = ? AND vertical = ?').get(tenantId, callerScopeId, vertical);
-                const rows = this.directory.prepare(`SELECT scope_id, tenant_id, vertical, status, kind, forked_from FROM scopes
-           WHERE tenant_id = ? AND vertical = ?`).all(tenantId, vertical);
-                return resolvePeerInstanceFrom(rows.map((r) => ({
-                    id: r.scope_id,
-                    tenantId: r.tenant_id,
-                    vertical: r.vertical,
-                    status: r.status,
-                    kind: r.kind ?? '',
-                    forkedFrom: r.forked_from,
-                })), tenantId, vertical, binding?.target_scope_id ?? null, binding?.invalidated === 1);
+                const tenant = this.peerTenant(tenantId);
+                return resolvePeerInstanceFrom(this.peerCandidates(tenant, vertical), tenant, vertical, binding?.target_scope_id ?? null, binding?.invalidated === 1);
             },
             peerBinding: async (actor, tenantId, callerScopeId, vertical) => {
                 const row = this.directory.prepare('SELECT target_scope_id, invalidated FROM peer_bindings WHERE tenant_id = ? AND caller_scope_id = ? AND vertical = ?').get(tenantId, callerScopeId, vertical);
@@ -6122,7 +6185,7 @@ export class SqliteScopeHost {
                 }
                 if (targetScopeId !== null) {
                     const target = this.directory.prepare('SELECT tenant_id, vertical, status, kind, forked_from FROM scopes WHERE scope_id = ?').get(targetScopeId);
-                    if (!target || target.tenant_id !== tenantId || target.vertical !== vertical || target.status !== 'active' || !isPrimaryScopeRow(target)) {
+                    if (!target || target.tenant_id !== tenantId || !samePeerVertical(target.vertical, vertical, this.peerTenant(tenantId).slug) || target.status !== 'active' || !isPrimaryScopeRow(target)) {
                         throw substratError('not_found', 'target is not a live primary instance of this vertical in this tenant');
                     }
                 }
@@ -6484,6 +6547,27 @@ export class SqliteScopeHost {
                     .get(verticalSlug, channel);
                 const outgoing = current ? readVersion(current.version_id) : undefined;
                 const ack = promotionAcknowledgement.parse(acknowledge ?? {});
+                // The owning tenant's live scopes a PRIVATE prod promote re-points — below for an embedded
+                // vertical, after the in-place serve for a dispatch-backed one (#321) — read before
+                // anything moves so the #2178 gate can judge each one.
+                const owning = channel === 'prod' ? readVertical(verticalSlug) : undefined;
+                const owned = owning && owning.ownerTenant !== null && !owning.listed
+                    ? this.directory
+                        .prepare(`SELECT * FROM scopes
+                   WHERE vertical = ? AND tenant_id = ? AND status = 'active' AND forked_from IS NULL AND kind != 'preview'`)
+                        .all(verticalSlug, owning.ownerTenant)
+                    : [];
+                // #2178, ahead of the acknowledgements below because none of them passes it. What the promote
+                // moves something from: the channel's version, the version served in place (a prod promote
+                // serves the incoming one next, and a failed serve leaves it behind the channel), and what each
+                // re-pointed scope RUNS (`runningVersionOf`: on the serving script, the served version).
+                const served = channel === 'prod' ? this.servingPointerOfVertical(verticalSlug) : null;
+                // And what each scope it moves last reconciled (`PROVISIONED_VERSIONS_SQL`).
+                this.assertNoStrandFrom([
+                    outgoing?.id,
+                    served?.versionId,
+                    ...owned.map((s) => runningVersionOf(mapScope(s), served)),
+                ], versionId, served || owned.length > 0 ? this.provisionedVersionsOf(verticalSlug, served, owned.length > 0 ? owning.ownerTenant : null) : []);
                 // §4's two checkpoints, fired where the blast radius is. A FIRST promotion
                 // has nothing to diff against, so there is nothing to acknowledge — the
                 // gate is about change, not about existence.
@@ -6532,26 +6616,17 @@ export class SqliteScopeHost {
                 // adopt-then-rebind for those (serve → adopt legacy scopes → advance versions),
                 // so we skip the rebind here. An EMBEDDED vertical (deploymentRef null) has no
                 // per-version script and keeps the rebind here. See adapter-cloudflare parity.
-                if (channel === 'prod' && !incoming.deploymentRef) {
-                    const owning = readVertical(verticalSlug);
-                    if (owning && owning.ownerTenant !== null && !owning.listed) {
-                        const bound = this.directory
-                            .prepare(`SELECT scope_id, tenant_id, vertical_version_id FROM scopes
-                 WHERE vertical = ? AND tenant_id = ? AND status = 'active' AND forked_from IS NULL AND kind != 'preview'`)
-                            .all(verticalSlug, owning.ownerTenant);
-                        for (const s of bound) {
-                            if (s.vertical_version_id === versionId)
-                                continue;
-                            const prev = s.vertical_version_id ? readVersion(s.vertical_version_id) : undefined;
-                            if (prev && prev.migrationDigest !== incoming.migrationDigest) {
-                                await this.snapshotScope(actor, s.tenant_id, s.scope_id);
-                            }
-                            this.directory
-                                .prepare('UPDATE scopes SET vertical_version_id = ?, vertical = ? WHERE scope_id = ?')
-                                .run(versionId, verticalSlug, s.scope_id);
-                            this.recordAdmin(actor, 'bindScopeVersion', { tenantId: s.tenant_id, scopeId: s.scope_id }, prev ? { versionId: prev.id, version: prev.version } : null, { versionId, vertical: verticalSlug, version: incoming.version, via: 'promoteVersion' });
-                        }
+                for (const s of incoming.deploymentRef ? [] : owned) {
+                    if (s.vertical_version_id === versionId)
+                        continue;
+                    const prev = s.vertical_version_id ? readVersion(s.vertical_version_id) : undefined;
+                    if (prev && prev.migrationDigest !== incoming.migrationDigest) {
+                        await this.snapshotScope(actor, s.tenant_id, s.scope_id);
                     }
+                    this.directory
+                        .prepare('UPDATE scopes SET vertical_version_id = ?, vertical = ? WHERE scope_id = ?')
+                        .run(versionId, verticalSlug, s.scope_id);
+                    this.recordAdmin(actor, 'bindScopeVersion', { tenantId: s.tenant_id, scopeId: s.scope_id }, prev ? { versionId: prev.id, version: prev.version } : null, { versionId, vertical: verticalSlug, version: incoming.version, via: 'promoteVersion' });
                 }
                 // The acknowledgement is recorded, not just enforced: that is what turns
                 // "someone reviewed the permission change" into evidence.
@@ -6607,6 +6682,9 @@ export class SqliteScopeHost {
             },
             bindingImpact: async (actor, tenantId, scopeId, versionId, opts) => {
                 const { v, scope } = bindTarget(tenantId, scopeId, versionId);
+                // #2178: a move no acknowledgement passes is refused here too, so a caller asking first
+                // (an adopt, an Update) stops before anything is copied.
+                this.assertBindingShapesKept(mapScope(scope), versionId, opts?.servingRef);
                 const breaks = await this.bindBreaks(actor, mapScope(scope), v, opts?.servingRef);
                 this.recordAccess(actor, 'bindingImpact', { tenantId, scopeId }, { versionId, ...opts }, breaks.length);
                 return breaks;
@@ -6622,6 +6700,8 @@ export class SqliteScopeHost {
                     throw substratError('precondition_failed', 'scope erasure changed; reload the scope and retry');
                 }
                 const ack = bindAcknowledgement.parse(opts?.acknowledge ?? {});
+                // #2178 first: no acknowledgement passes it, so none should be asked for ahead of it.
+                this.assertBindingShapesKept(mapScope(scope), versionId);
                 // #1756: an export an app in this tenant imports, dropped or re-versioned by what this
                 // scope would run. Before the snapshot, so a refused bind leaves nothing behind.
                 if (!ack.exportBreak) {
@@ -6753,17 +6833,25 @@ export class SqliteScopeHost {
              * Record that this scope's provision has now run against `versionId` (#1172).
              * Written only after a provision or reconcile succeeded — a receipt, never a hope.
              */
-            markScopeProvisioned: async (actor, tenantId, scopeId, versionId) => {
+            markScopeProvisioned: async (actor, tenantId, scopeId, versionId, outcome) => {
                 const scope = this.directory
                     .prepare('SELECT tenant_id FROM scopes WHERE scope_id = ?')
                     .get(scopeId);
                 if (!scope || scope.tenant_id !== tenantId) {
                     throw substratError('not_found', `unknown scope ${scopeId} in tenant ${tenantId}`);
                 }
+                // #2185: both in one write — the retirements count as finished only for the version
+                // this receipt names, and a receipt written without that answer clears them.
+                const finished = versionId !== null && outcome?.retirementsFinished === true ? versionId : null;
+                // #2184: and the binding shapes it reported bound, paired with this receipt's version.
                 this.directory
-                    .prepare('UPDATE scopes SET provisioned_version_id = ? WHERE scope_id = ?')
-                    .run(versionId, scopeId);
-                this.recordAdmin(actor, 'markScopeProvisioned', { tenantId, scopeId }, null, { versionId });
+                    .prepare('UPDATE scopes SET provisioned_version_id = ?, retirements_finished_version_id = ?, bound_shapes = ? WHERE scope_id = ?')
+                    .run(versionId, finished, boundShapesColumn(versionId, outcome?.boundShapes), scopeId);
+                this.recordAdmin(actor, 'markScopeProvisioned', { tenantId, scopeId }, null, {
+                    versionId,
+                    ...(finished ? { retirementsFinished: true } : {}),
+                    ...(versionId !== null && outcome?.boundShapes ? { boundShapes: outcome.boundShapes } : {}),
+                });
             },
             verticalServing: async (actor, verticalSlug) => {
                 const r = this.directory
@@ -6788,6 +6876,8 @@ export class SqliteScopeHost {
                     .get(verticalSlug);
                 if (!r)
                     throw substratError('not_found', `unknown vertical '${verticalSlug}'`);
+                // #2178: every install on the serving script runs the new version from this moment.
+                this.assertNoStrandFrom([r.serving_version_id], parsed.versionId, r.serving_ref ? this.provisionedVersionsOf(verticalSlug, r.serving_version_id ? { ref: r.serving_ref, versionId: r.serving_version_id } : null, null) : []);
                 this.directory
                     .prepare(`UPDATE verticals SET serving_ref = ?, serving_version_id = ?,
                     serving_do_classes = ?, serving_migration_tag = ? WHERE slug = ?`)
@@ -6821,6 +6911,8 @@ export class SqliteScopeHost {
                 // #1756: onto (or off) a serving script, the scope runs other code before its pointer
                 // moves. Judged here, so no caller that routes first and binds second passes unasked.
                 const bound = scope.vertical_version_id ? readVersion(scope.vertical_version_id) : undefined;
+                if (bound)
+                    this.assertBindingShapesKept(mapScope(scope), bound.id, servingRef);
                 if (!ack.exportBreak && bound) {
                     const breaks = await this.bindBreaks(actor, mapScope(scope), bound, servingRef);
                     if (breaks.length > 0)
@@ -9112,6 +9204,11 @@ export class SqliteScopeHost {
         // #1172: which version this scope's provision hook last ran against. Null on every
         // existing row, which reads as "unknown, reconcile once" rather than "up to date".
         this.ensureColumn(this.directory, 'scopes', 'provisioned_version_id', 'provisioned_version_id TEXT');
+        // #2185: the version whose reconcile finished its retirements here. Null on every existing
+        // row, which reads as "not finished": the sweep reconciles each such install once more.
+        this.ensureColumn(this.directory, 'scopes', 'retirements_finished_version_id', 'retirements_finished_version_id TEXT');
+        // #2184: null on every existing row, which reads as unknown (the sweep reconciles it once more).
+        this.ensureColumn(this.directory, 'scopes', 'bound_shapes', 'bound_shapes TEXT');
         this.ensureColumn(this.directory, 'scopes', 'erasure_epoch', 'erasure_epoch INTEGER');
         this.ensureColumn(this.directory, 'scopes', 'reap_claimed_at', 'reap_claimed_at TEXT');
         // §4.8's grace-window timestamp on tenants (mirrors scopes' archived_at).
@@ -9421,6 +9518,8 @@ export class SqliteScopeHost {
             // envelope data module code could set or branch on.
             rt.invocationId, full.payload === undefined ? null : JSON.stringify(full.payload));
         };
+        // #2192: the call's invocation id, one reader for `ctx.log` and `ctx.requestId`.
+        const requestIdNow = () => rt.invocationId ?? delivery?.invocationId ?? null;
         const ctxRef = {
             tenantId: rt.tenantId,
             scopeId: rt.scopeId,
@@ -9440,13 +9539,17 @@ export class SqliteScopeHost {
                 tenantId: rt.tenantId,
                 scopeId: rt.scopeId,
                 operation: operation ?? null,
-                invocationId: () => rt.invocationId ?? delivery?.invocationId ?? null,
+                invocationId: requestIdNow,
                 // A consumer runs under the system override, so it logs as `system`.
                 principalKind: overrideActor ? 'system' : subject.kind,
                 // The string-safe redaction: `redactSecrets` parses its serialization back, and a
                 // log's text is not JSON.
                 redact: (text) => redactSecretText(text, minted),
             }, this.logSink),
+            // #2192: the same id the log lines carry.
+            get requestId() {
+                return requestIdNow();
+            },
             emit: (event) => writeEvent(event, 'module'),
             requestPlatform: (request) => {
                 assertImpersonationWrites(impersonation, 'ctx.requestPlatform');