@substrat-run/adapter-sqlite 0.145.0 → 0.147.0

package/dist/index.js

@@ -2,7 +2,7 @@ import { existsSync, mkdirSync, readdirSync, readFileSync, realpathSync, rmSync,
 import { dirname, join } from 'node:path';
 import Database from 'better-sqlite3';
 import { accessLogEntry, adminLogEntry, delegatedReadParams, operationSeriesCount, opsFailureEntry, opsFailureFingerprint, issueEntry, FRESHNESS_HEARTBEAT_MINUTES, sweepRunEntry, modelUsageEntry, ATTACHMENT_ADDED, ATTACHMENT_REMOVED, attachmentRecord, createTenantInput, domainEvent, domainEventInput, exportReadInput, importBatch, importCursorMove, exportsOfManifestJson, assertNoBindingShapeBreak, importsOfManifestJson, entitlementGrant, entitlementGrantInput, eventId, meterReading, platformRequestInput, platformRequestId, MAX_PENDING_PLATFORM_REQUESTS, identityLink, identityPool, instant, isSubstratError, connection, capabilityGrant, connectionGrant, connectionGrantRecord, connectionSecret, systemGrant, systemSwitch, systemSwitchRecord, peerSwitch, verticalCaller, verticalSlug as verticalSlugOf, subjectRef, requestFingerprint, createConnectionInput, connectLinkFilter, connectLinkKey, consumeConnectLinkInput, mintConnectLinkInput, projectedConnectionGrant, projectedConnectionKey, moduleManifest, createOrgInput, promotionAcknowledgement, bindAcknowledgement, bindHostnameInput, channelHistoryEntry, hostnameBinding, publishVersionInput, AUTO_ADMISSION_NOTE, routeTarget, ROUTE_SCOPE_HOSTNAMES_MAX, registerVerticalInput, vertical as verticalSchema, verticalChannel, verticalVersion, objectRef, entityObjectRef, assertModuleEmittableType, assertKernelAuthoredType, grantRefFromProof, org as orgSchema, orgMembership, principalId, resolvedIdentity, identityMembership, roleDefinition, scope as scopeSchema, tenant as tenantSchema, tenantRole, principalBecomeCapabilityInput, subjectShredReceipt, SCOPE_TABLE_PAGE_DEFAULT, SCOPE_TABLE_PAGE_MAX, SCOPE_QUERY_ROW_MAX, verticalServingState, callsOfManifestJson, outboundOfManifestJson, listLimitOf, pageOf, countedPageOf, SCOPE_GATE_REASONS, substratError, assertReplayableDump, delegatedReadRecord, ownerTransferAudit, memberChangeAudit, peerBindingAudit, copyMarkAudit, redrainEventsInput, REDRAIN_BATCH, } from '@substrat-run/contracts';
-import { actorOf, asPrincipal, assertAllowed, assertNoSecret, assertPermissionKey, CAPABILITY_DDL, COPY_ORIGIN_DDL, ENTITY_STATE_MOVES_DDL, CAPABILITY_EXCHANGE_OPERATION, CAPABILITY_BECOME_MINT_OPERATION, becomeMintCheck, mintBecomeCapabilityAsPrincipal, revokeBecomeCapabilityAsPrincipal, readBecomeLinkStates, ENTITY_UNBIND_OPERATION, allowedFor, unbindEntityHolderBounded, capabilityAttachmentWriteRefused, capabilityTokenHash, createCapabilityVerbs, createEntityEdgeVerbs, createEntityStateVerbs, createTrashedReads, CONTINUATION_POSITION_CAP, visibleContinuation, searchStateWhere, uncheckedView, addStatePlans, addUpdatedStampPlans, watchUpdatedStamps, entityStateMigrations, assertNoCallerPurge, isUnreachableParent, heldPurgePass, purgeDueOf, purgeHeldBy, lifecycleRefusal, purgeOnlyKeysOf, purgeReportOf, purgeStillDue, refuseTrashedTarget, assertBoundOperations, registerTrashTargets, runPurgePass, withheldKeysFor, statefulTablesOf, afterMigration, afterRuntimeDdl, derivesAnything, repairDerivedObjects, StateColumnLost, exchangeCapability as exchangeCapabilitySecret, guardSecrets, mintBecomeCapability, plausibleSessionToken, readCapabilityPage, redactSecrets, redactSecretText, moduleLog, consoleLogSink, asyncInvocationId, asyncLinePass, consoleInvocationLineSink, resolveCapabilitySession, revokeCapabilityAsPlatform, assertReadOnlyQuery, attachmentBlobKey, attachmentSha256, entitlementDenial, requiredEntitlementFor, foldMeterReading, guardSpine, guardSqlLimits, DO_SQL_LIMITS, tooManyResultColumns, tooManyTableColumns, parseValidationRecords, resolveScopeRecord, ulid, ISSUE_RETENTION_DAYS, telemetryRetentionStatements, FINDINGS_DDL, SCOPE_STORAGE_DDL, forgetScopeStorage, listScopeStorageAttemptRows, listScopeStorageRows, pruneScopeStorageRows, recordScopeStorageRows, CONNECT_LINKS_DDL, consumeConnectLinkRow, insertConnectLink, listConnectLinks as listConnectLinkRows, readConnectLink, restoreConnectLinkRow, revokeConnectLinkRow, createFindingRule, findingOfOpsFailure, findingOfSweepRun, pruneFindings, listFindingRules, listFindings, observeFinding, revokeFindingRule, setFindingStatus, assertRowLimit, assertRowOffset, OPS_FAILURE_RETENTION_DAYS, SWEEP_RUN_RETENTION_DAYS, SWEEP_RUNS_INTENT_INDEX, sweepRunsIntentHasKind, MODEL_USAGE_RETENTION_DAYS, foldModelUsage, backoffAt, platformRequestHistoryQuery, platformRequestOf, PLATFORM_REQUEST_COLUMNS, PLATFORM_REQUEST_REDACTION_SQL, platformRequestRedactionParams, platformRequestRedactionQuery, intentPayloadCarriesSubject, redactSubjectJobRuns, eraseSubjectFromModules, moduleRowsErased, moduleErasurePlan, redactSubjectScopeText, redactSubjectDirectoryText, ISSUE_EXEMPLAR_OWNER_BACKFILL_SQL, issueExemplarOwner, JOB_RUN_PATCH_SQL, JOB_RUN_CLAIM_SQL, JOB_RUN_RENEW_SQL, JOB_RUN_BEGIN_SQL, JOB_RUN_MISS_SQL, JOB_RUN_MISS_SETTLE_SQL, admissionMissOutcome, JOB_STEP_RECORD_SQL, JOB_LEASE_EXPIRED_NOTE, assertLeaseMs, DELIVERY_ERROR_REDACTION_SQL, REDACTED_DELIVERY_NOTE, seatScopeTuple, applyScopeRoleChange, changeScopeRole, revokeScopeRoles, scopeRoleHolders, admitPeer, collectPeers, peerSeats, resolveVerticalInstanceFrom, resolvePeerInstanceFrom, peerGrantsStatus, systemGrantsStatus, systemScheduleState, systemSwitchedOff, systemSwitchedOffMessage, tenantSystemSwitchedOffMessage, PEER_SWITCHES_DDL, PEER_BINDINGS_DDL, SWITCH_OWED_DDL, SWITCH_FENCES_DDL, TABLE_OWNERS_DDL, assertMigrationLeavesLedgerAlone, recordOwnershipSteps, runMigrationStatements, executableSqlStatements, blankSqlComments, recordWriteSuperseded, switchFencesOf, switchSupersededMessage, SWITCH_KINDS, SYSTEM_SWITCHES_DDL, forgetSwitchesOf, listSystemSwitchRecords, moveSwitch, reassertActionOf, reassertEntry, reassertOffRow, recordSwitchedOff, recordSwitchedOn, restoreSwitchRecord, scopesSwitchedOffFor, switchActionOf, switchAuditSubject, recordAuditOutcome, auditedCapabilityRevoke, auditWarningOf, switchNotFoundMessage, switchRecordsOf, switchedOffOf, switchesBackfillSqlOf, switchesTableExists, tenantHeldOf, tenantHoldsGrant, inUnitMovesToAudit, staleCarryRevertRow, staleCarryReverts, withRecorded, VERSION_MIGRATIONS_DDL, splitManifestMigrations, splitVersionMigrationsBatch, versionMigrationsOf, writeVersionMigrations, denialListQuery, refusalListQuery, mapRefusalRow, denialSummaryQuery, denialTotalsQuery, DENIAL_WINDOW_QUERY, mapDenialRow, mapDenialSummaryBuckets, IMPERSONATION_COLUMNS, IMPERSONATION_DDL, ImpersonationRefused, assertImpersonationWrites, assertModuleEnqueueableKind, assertSessionUsable, impersonationByIdQuery, impersonationListQuery, impersonationRowValues, impersonationStampOf, mapImpersonationRow, newImpersonationSession, resolveRetryPolicy, executorOutcomeOf, isDeliveryRefusal, refusalJournalText, membershipFencesBackfillSql, MEMBERSHIP_FENCES_DDL, membershipFencesTableExists, MEMBERSHIP_FENCE_SINCE_SQL, RAISE_MEMBERSHIP_FENCE_SQL, memberAddedAudit, orgChangeBound, tenantCoverage, isSecretBoxConfigured, unconfiguredSecretBox, createSubjectKeys, generateSealingKeyPair, noSealingKeyMessage, openSealed, sealTo, ConnectionSealingKeyUnavailableError, PermissionDenied, createAtomic, NotSearchable, NotListable, listIndexMigrations, listIndexPlans, listQuery, cursorOf, moduleMigrations, MIGRATION_DIGEST_FENCE_DDL, MIGRATION_DIGEST_MARK_LEGACY, assertJournalDumpCoherent, assertMigrationSql, migrationDivergence, migrationFailedError, migrationSteps, planMigrations, isSearchIndexTable, searchIndexMigrations, searchIndexPlans, searchLimit, searchMatchExpression, searchQuery, ATTACHMENT_TEXT_DDL, assertAttachmentExtractors, resolveAttachmentTextBounds, assertJobRegistrable, attachmentRecordOfRow, attachmentTextJob, enqueueAttachmentText, ATTACHMENT_TEXT_BACKFILL_JOB, ATTACHMENT_TEXT_JOB, kernelJobFor, queueAttachmentTextBackfill, startAttachmentTextBackfill, attachmentTextBackfillJob, reconcileAttachmentText, recordAttachmentText, searchAttachments, entityVersionQuery, entityVersionOf, assertIfMatch, OUTBOX_ENTITY_INDEX, SCHEDULE_STATE_DDL, SCHEDULE_STATE_REBUILD, scheduleStateHasKind, VERTICAL_EVENTS_DDL, EXPORT_HOPS_SQL, emptyImportResult, IMPORT_CURSORS_SQL, IMPORT_CURSOR_OF_SQL, OUTBOX_MARK_SQL, emittedSinceQuery, emittedReportOf, EMITTED_REPORT_CAP, exportedSinceQuery, IMPORT_CURSOR_ADVANCE_SQL, IMPORT_RECORD_SQL, moveImportCursor, importCursorSourceOf, exportBreaksOf, exportBreakRefusal, bindExportBreaksOf, bindExportBreakRefusal, scopeMoveOf, runningVersionOf, isPrimaryScope, PROVISIONED_VERSIONS_SQL, installsReconciledOf, strandJudgmentsOf, provisionedVersionsParams, boundShapesColumn, boundShapesOfColumn, installReconciled, CrossVerticalRegistry, exportReadPlan, exportReadQuery, planExportBatch, withheldNote, JOB_RUN_DDL, JOB_RUN_DUE_AT, jobRunListLimit, jobRunOf, runDueJobRuns, startJobRun, IDEMPOTENCY_DDL, REFUSALS_TABLE_DDL, REFUSALS_INDEX, refusalInsert, refusalOf, markGuardRefusal, REFUSALS_REBUILD, refusalsAdmitGuards, assertIdempotencyKey, idempotencyLookupQuery, idempotencyPruneStatement, idempotencyRecordStatement, idempotencyOptedOutMessage, replayFor, globalFetch, createUlid, facetEvents, readHistory, walkEventCause, walkEventEffects, assertRedrainWindow, readInvocation, readDeadLetters, readLifecycleFlow, readOperationSeries, domainEventOf, readUndrainedOutbox, undrainedEventsOf, connectorCallRecord, noopConnectorCallRecorder, recordConnectorCall, settleConnectionUse, unknownRoleError, } from '@substrat-run/kernel';
+import { actorOf, asPrincipal, assertAllowed, assertNoSecret, assertPermissionKey, CAPABILITY_DDL, COPY_ORIGIN_DDL, ENTITY_STATE_MOVES_DDL, CAPABILITY_EXCHANGE_OPERATION, CAPABILITY_BECOME_MINT_OPERATION, becomeMintCheck, mintBecomeCapabilityAsPrincipal, revokeBecomeCapabilityAsPrincipal, readBecomeLinkStates, ENTITY_UNBIND_OPERATION, allowedFor, unbindEntityHolderBounded, capabilityAttachmentWriteRefused, capabilityTokenHash, createCapabilityVerbs, createEntityEdgeVerbs, createEntityStateVerbs, createTrashedReads, CONTINUATION_POSITION_CAP, visibleContinuation, searchStateWhere, uncheckedView, addStatePlans, addUpdatedStampPlans, watchUpdatedStamps, entityStateMigrations, assertNoCallerPurge, isUnreachableParent, heldPurgePass, purgeDueOf, purgeHeldBy, lifecycleRefusal, purgeOnlyKeysOf, purgeReportOf, purgeStillDue, refuseTrashedTarget, assertBoundOperations, registerTrashTargets, runPurgePass, withheldKeysFor, statefulTablesOf, afterMigration, afterRuntimeDdl, derivesAnything, repairDerivedObjects, StateColumnLost, exchangeCapability as exchangeCapabilitySecret, guardSecrets, mintBecomeCapability, plausibleSessionToken, readCapabilityPage, redactSecrets, redactSecretText, moduleLog, consoleLogSink, asyncInvocationId, asyncLinePass, consoleInvocationLineSink, resolveCapabilitySession, revokeCapabilityAsPlatform, assertReadOnlyQuery, attachmentBlobKey, attachmentSha256, entitlementDenial, requiredEntitlementFor, foldMeterReading, guardSpine, guardSqlLimits, DO_SQL_LIMITS, tooManyResultColumns, tooManyTableColumns, parseValidationRecords, resolveScopeRecord, ulid, ISSUE_RETENTION_DAYS, telemetryRetentionStatements, FINDINGS_DDL, SCOPE_STORAGE_DDL, forgetScopeStorage, listScopeStorageAttemptRows, listScopeStorageRows, listScopeStoreStorageRows, pruneScopeStorageRows, recordScopeStorageRows, CONNECT_LINKS_DDL, consumeConnectLinkRow, insertConnectLink, listConnectLinks as listConnectLinkRows, readConnectLink, restoreConnectLinkRow, revokeConnectLinkRow, createFindingRule, findingOfOpsFailure, findingOfSweepRun, pruneFindings, listFindingRules, listFindings, observeFinding, revokeFindingRule, setFindingStatus, assertRowLimit, assertRowOffset, OPS_FAILURE_RETENTION_DAYS, SWEEP_RUN_RETENTION_DAYS, SWEEP_RUNS_INTENT_INDEX, sweepRunsIntentHasKind, MODEL_USAGE_RETENTION_DAYS, foldModelUsage, backoffAt, platformRequestHistoryQuery, platformRequestOf, PLATFORM_REQUEST_COLUMNS, PLATFORM_REQUEST_REDACTION_SQL, platformRequestRedactionParams, platformRequestRedactionQuery, intentPayloadCarriesSubject, redactSubjectJobRuns, eraseSubjectFromModules, moduleRowsErased, moduleErasurePlan, redactSubjectScopeText, redactSubjectDirectoryText, ISSUE_EXEMPLAR_OWNER_BACKFILL_SQL, issueExemplarOwner, JOB_RUN_PATCH_SQL, JOB_RUN_CLAIM_SQL, JOB_RUN_RENEW_SQL, JOB_RUN_BEGIN_SQL, JOB_RUN_MISS_SQL, JOB_RUN_MISS_SETTLE_SQL, admissionMissOutcome, JOB_STEP_RECORD_SQL, JOB_LEASE_EXPIRED_NOTE, assertLeaseMs, DELIVERY_ERROR_REDACTION_SQL, REDACTED_DELIVERY_NOTE, seatScopeTuple, applyScopeRoleChange, changeScopeRole, revokeScopeRoles, scopeRoleHolders, admitPeer, peerCallerAt, collectPeers, peerSeats, resolveVerticalInstanceFrom, resolvePeerInstanceFrom, peerVerticalSpellings, samePeerVertical, peerGrantsStatus, systemGrantsStatus, systemScheduleState, systemSwitchedOff, systemSwitchedOffMessage, tenantSystemSwitchedOffMessage, PEER_SWITCHES_DDL, PEER_BINDINGS_DDL, SWITCH_OWED_DDL, SWITCH_FENCES_DDL, TABLE_OWNERS_DDL, assertMigrationLeavesLedgerAlone, recordOwnershipSteps, runMigrationStatements, executableSqlStatements, blankSqlComments, recordWriteSuperseded, switchFencesOf, switchSupersededMessage, SWITCH_KINDS, SYSTEM_SWITCHES_DDL, forgetSwitchesOf, listSystemSwitchRecords, moveSwitch, reassertActionOf, reassertEntry, reassertOffRow, recordSwitchedOff, recordSwitchedOn, restoreSwitchRecord, scopesSwitchedOffFor, switchActionOf, switchAuditSubject, recordAuditOutcome, auditedCapabilityRevoke, auditWarningOf, switchNotFoundMessage, switchRecordsOf, switchedOffOf, switchesBackfillSqlOf, switchesTableExists, tenantHeldOf, tenantHoldsGrant, inUnitMovesToAudit, staleCarryRevertRow, staleCarryReverts, withRecorded, VERSION_MIGRATIONS_DDL, splitManifestMigrations, splitVersionMigrationsBatch, versionMigrationsOf, writeVersionMigrations, denialListQuery, refusalListQuery, mapRefusalRow, denialSummaryQuery, denialTotalsQuery, DENIAL_WINDOW_QUERY, mapDenialRow, mapDenialSummaryBuckets, IMPERSONATION_COLUMNS, IMPERSONATION_DDL, ImpersonationRefused, assertImpersonationWrites, assertModuleEnqueueableKind, assertSessionUsable, impersonationByIdQuery, impersonationListQuery, impersonationRowValues, impersonationStampOf, mapImpersonationRow, newImpersonationSession, resolveRetryPolicy, executorOutcomeOf, isDeliveryRefusal, refusalJournalText, membershipFencesBackfillSql, MEMBERSHIP_FENCES_DDL, membershipFencesTableExists, MEMBERSHIP_FENCE_SINCE_SQL, RAISE_MEMBERSHIP_FENCE_SQL, memberAddedAudit, orgChangeBound, tenantCoverage, isSecretBoxConfigured, unconfiguredSecretBox, createSubjectKeys, generateSealingKeyPair, noSealingKeyMessage, openSealed, sealTo, ConnectionSealingKeyUnavailableError, PermissionDenied, createAtomic, NotSearchable, NotListable, listIndexMigrations, listIndexPlans, listQuery, cursorOf, moduleMigrations, MIGRATION_DIGEST_FENCE_DDL, MIGRATION_DIGEST_MARK_LEGACY, assertJournalDumpCoherent, assertMigrationSql, migrationDivergence, migrationFailedError, migrationSteps, planMigrations, isSearchIndexTable, searchIndexMigrations, searchIndexPlans, searchLimit, searchMatchExpression, searchQuery, ATTACHMENT_TEXT_DDL, assertAttachmentExtractors, resolveAttachmentTextBounds, assertJobRegistrable, attachmentRecordOfRow, attachmentTextJob, enqueueAttachmentText, ATTACHMENT_TEXT_BACKFILL_JOB, ATTACHMENT_TEXT_JOB, kernelJobFor, queueAttachmentTextBackfill, startAttachmentTextBackfill, attachmentTextBackfillJob, reconcileAttachmentText, recordAttachmentText, searchAttachments, entityVersionQuery, entityVersionOf, assertIfMatch, OUTBOX_ENTITY_INDEX, SCHEDULE_STATE_DDL, SCHEDULE_STATE_REBUILD, scheduleStateHasKind, VERTICAL_EVENTS_DDL, EXPORT_HOPS_SQL, emptyImportResult, IMPORT_CURSORS_SQL, IMPORT_CURSOR_OF_SQL, OUTBOX_MARK_SQL, emittedSinceQuery, emittedReportOf, EMITTED_REPORT_CAP, exportedSinceQuery, IMPORT_CURSOR_ADVANCE_SQL, IMPORT_RECORD_SQL, moveImportCursor, importCursorSourceOf, exportBreaksOf, exportBreakRefusal, bindExportBreaksOf, bindExportBreakRefusal, scopeMoveOf, runningVersionOf, isPrimaryScope, PROVISIONED_VERSIONS_SQL, installsReconciledOf, strandJudgmentsOf, provisionedVersionsParams, boundShapesColumn, boundShapesOfColumn, installReconciled, CrossVerticalRegistry, exportReadPlan, exportReadQuery, planExportBatch, withheldNote, JOB_RUN_DDL, JOB_RUN_DUE_AT, jobRunListLimit, jobRunOf, runDueJobRuns, startJobRun, IDEMPOTENCY_DDL, REFUSALS_TABLE_DDL, REFUSALS_INDEX, refusalInsert, refusalOf, markGuardRefusal, REFUSALS_REBUILD, refusalsAdmitGuards, assertIdempotencyKey, idempotencyLookupQuery, idempotencyPruneStatement, idempotencyRecordStatement, idempotencyOptedOutMessage, replayFor, globalFetch, createUlid, facetEvents, readHistory, walkEventCause, walkEventEffects, assertRedrainWindow, readInvocation, readDeadLetters, readLifecycleFlow, readOperationSeries, domainEventOf, readUndrainedOutbox, undrainedEventsOf, connectorCallRecord, noopConnectorCallRecorder, recordConnectorCall, settleConnectionUse, unknownRoleError, callReservedStoreOperation, callScopeStore, observeStoreCall, replayStoreErasures, scopeStoreLifecycleOf, scopeStoreRunnersOf, } from '@substrat-run/kernel';
 import { attributedView, delegatedRevokeSql, writeExplicitTupleIn, grantEntityShapeIn, shapeTopUpBatch, topUpEntityGrantShapes, settlePlatformRequestIn, } from '@substrat-run/kernel';
 import { ADMIN_LOG_INDEXES_SQL, SETTLE_INTENT_SQL, SETTLE_OUTCOME_SQL, settleOutcomeParamsOf, readAuditedOperations, unknownOutcomeOf, } from '@substrat-run/kernel';
 import { INERT_SCOPE_REASON, isPrimaryScopeRow } from '@substrat-run/kernel';
@@ -620,6 +620,9 @@ export class SqliteScopeHost {
     /** predicate name → the module-contributed implementation. Names are global. */
     predicates = new Map();
     /** operation names whose default binding some manifest withdrew (K-17). */
+    scopeStoreRunners;
+    scopeStoreVertical;
+    scopeStoreLifecycle;
     withdrawn = new Map(); // operation → withdrawing module
     relations = new Map();
     /** entityType → its derived FTS5 index (#827). One entity type, one index. */
@@ -712,6 +715,9 @@ export class SqliteScopeHost {
         this.connectorCalls = options.connectorCalls ?? noopConnectorCallRecorder;
         this.clock = options.clock ?? (() => instant.parse(new Date().toISOString()));
         this.versionId = options.versionId ?? null;
+        this.scopeStoreVertical = options.scopeStores?.vertical;
+        this.scopeStoreRunners = scopeStoreRunnersOf(options.scopeStores);
+        this.scopeStoreLifecycle = scopeStoreLifecycleOf(this.scopeStoreRunners);
         this.logSink = options.logSink ?? consoleLogSink;
         this.invocationLineSink = options.invocationLineSink ?? consoleInvocationLineSink;
         // Every option is read above and here, BEFORE the directory is claimed: an option that throws
@@ -2358,6 +2364,7 @@ export class SqliteScopeHost {
         };
     }
     async importScope(actor, input, dump) {
+        this.refuseUnusableScopeStores(dump.stores, input.vertical ?? null);
         // Create the destination scope (directory row + storage). Its migration step
         // creates some tables; the dump then replaces them wholesale, so the end state
         // is the dump, not whatever the local module set would have built. Provenance is
@@ -2370,6 +2377,7 @@ export class SqliteScopeHost {
         });
         // A fork: its callers (snapshotScope) hand it a dump the platform exported.
         await this.loadDump(input.tenantId, input.scopeId, { ...dump, exact: true });
+        await this.importScopeStores(input.tenantId, input.scopeId, dump.stores);
         await this.admin.activateScope(actor, input.tenantId, input.scopeId);
         this.recordAdmin(actor, 'importScope', { tenantId: input.tenantId, scopeId: input.scopeId }, null, { sourceScopeId: dump.scopeId, tables: dump.tables.length, capturedAt: dump.capturedAt });
     }
@@ -2522,6 +2530,7 @@ export class SqliteScopeHost {
         const existing = await this.admin.getScopeRecord(actor, tenantId, scopeId);
         if (!existing)
             throw substratError('not_found', `unknown scope ${scopeId} in tenant ${tenantId}`);
+        this.refuseUnusableScopeStores(dump.stores, existing.vertical);
         // #1742: a dump from before a switch was pulled brings the module's grants back live, so
         // the directory's recorded-off modules go back off in the load's own turn, as a
         // provision's seat does — no schedule pass can run in between.
@@ -2530,9 +2539,17 @@ export class SqliteScopeHost {
         // #1869: the re-point's source is the separate hint when given; the dump is otherwise as sent.
         const source = { tables: dump.tables, scopeId: opts?.sourceScopeId ?? dump.scopeId };
         await this.loadDump(tenantId, scopeId, source, (rt) => this.reassertSwitchesInTurn(rt, actor, tenantId, scopeId, undefined, (action, after) => rows.push([action, after])));
+        await this.importScopeStores(tenantId, scopeId, dump.stores);
+        const replay = await this.replayShreddedStoreErasures(actor, tenantId, scopeId, (opts?.sourceScopeId ?? dump.scopeId));
         for (const [action, after] of rows)
             this.recordAdmin(actor, action, { tenantId, scopeId }, null, after);
-        this.recordAdmin(actor, 'restoreScope', { tenantId, scopeId }, null, { sourceScopeId: dump.scopeId, tables: dump.tables.length, capturedAt: dump.capturedAt });
+        this.recordAdmin(actor, 'restoreScope', { tenantId, scopeId }, null, {
+            sourceScopeId: dump.scopeId,
+            tables: dump.tables.length,
+            capturedAt: dump.capturedAt,
+            ...replay,
+        });
+        return replay;
     }
     async snapshotScope(actor, tenantId, scopeId, opts) {
         const source = await this.admin.getScopeRecord(actor, tenantId, scopeId);
@@ -2554,6 +2571,7 @@ export class SqliteScopeHost {
         if (source.verticalVersionId) {
             await this.admin.bindScopeVersion(actor, tenantId, snapshotId, source.verticalVersionId);
         }
+        await this.replayShreddedStoreErasures(actor, tenantId, snapshotId, scopeId);
         return snapshotId;
     }
     async deleteSnapshot(actor, tenantId, scopeId) {
@@ -2567,6 +2585,7 @@ export class SqliteScopeHost {
             throw substratError('forbidden', `scope ${scopeId} is not a fork or preview — only previews may be deleted; ` +
                 `archive a primary scope instead`);
         }
+        await this.wipeScopeStores(tenantId, scopeId);
         // Close and evict the runtime handle before touching the file.
         const rt = this.scopes.get(`${tenantId}/${scopeId}`);
         if (rt)
@@ -2635,6 +2654,195 @@ export class SqliteScopeHost {
         }
         return this.buildStub(tenantId, scopeId, rt, asPrincipal(principal), options);
     }
+    async getScopeStore(principal, tenantId, scopeId, binding, options) {
+        // The directory check is the same one `getScope` makes. With no runners
+        // configured, the binding is refused after that check.
+        await this.getScope(principal, tenantId, scopeId);
+        if (this.scopeStoreRunners.size === 0) {
+            throw substratError('unavailable', `no scope-store runner is configured for binding '${binding}'`);
+        }
+        const vertical = this.scopeStoreVerticalOf(scopeId);
+        const runner = this.scopeStoreRunners.get(binding);
+        if (!runner) {
+            throw substratError('not_found', `no scope store is bound for '${binding}'`);
+        }
+        await this.scopeStoreLifecycle.start();
+        return {
+            tenantId,
+            scopeId,
+            subjectKind: 'principal',
+            invoke: (operation, input, ...extra) => observeStoreCall(binding, operation, () => callScopeStore((request) => runner.invoke({ tenantId, vertical, scopeId, binding }, request), operation, input, ...extra), options?.onStoreCall),
+        };
+    }
+    /** The scope's vertical when it has one. No vertical means this host has no store to touch. */
+    scopeStoreVerticalIfPresent(scopeId) {
+        const row = this.directory.prepare('SELECT vertical FROM scopes WHERE scope_id = ?').get(scopeId);
+        const vertical = row?.vertical;
+        if (!vertical)
+            return undefined;
+        if (this.scopeStoreVertical !== undefined && vertical !== this.scopeStoreVertical) {
+            throw substratError('forbidden', `this host serves vertical '${this.scopeStoreVertical}', and scope ${scopeId} runs '${vertical}'`);
+        }
+        return vertical;
+    }
+    /** The scope's vertical, refused when this host is limited to another one. */
+    scopeStoreVerticalOf(scopeId) {
+        const vertical = this.scopeStoreVerticalIfPresent(scopeId);
+        if (!vertical) {
+            throw substratError('not_found', `scope ${scopeId} has no vertical, so it has no scope store`);
+        }
+        return vertical;
+    }
+    /**
+     * One reserved call on a declared binding. The vertical's stub never reaches
+     * this; `callReservedStoreOperation` refuses a name that is not reserved.
+     */
+    async invokeReservedStore(address, operation, input) {
+        const runner = this.scopeStoreRunners.get(address.binding);
+        if (!runner)
+            throw substratError('not_found', `no scope store is bound for '${address.binding}'`);
+        await this.scopeStoreLifecycle.start();
+        return callReservedStoreOperation((request) => runner.invoke(address, request), operation, input);
+    }
+    /**
+     * Each declared binding's `substrat.size`. No runners means an empty list,
+     * and the scope is not opened to discover that.
+     */
+    async readScopeStoreSizes(tenantId, scopeId) {
+        const bindings = [...this.scopeStoreRunners.keys()];
+        if (bindings.length === 0)
+            return [];
+        this.scopeReadDbFor(tenantId, scopeId);
+        const vertical = this.scopeStoreVerticalOf(scopeId);
+        const sizes = [];
+        for (const binding of bindings) {
+            const { bytes } = await this.invokeReservedStore({ tenantId, vertical, scopeId, binding }, 'substrat.size');
+            sizes.push({ binding, bytes });
+        }
+        return sizes;
+    }
+    /** The vertical whose stores this scope has on this host, or nothing when it has none. */
+    storeVerticalOf(scopeId) {
+        if (this.scopeStoreRunners.size === 0)
+            return undefined;
+        const row = this.directory.prepare('SELECT vertical FROM scopes WHERE scope_id = ?').get(scopeId);
+        const vertical = row?.vertical ?? undefined;
+        if (!vertical)
+            return undefined;
+        if (this.scopeStoreVertical !== undefined && vertical !== this.scopeStoreVertical)
+            return undefined;
+        return vertical;
+    }
+    /**
+     * `substrat.erase` on each declared binding. A store error throws, so the caller
+     * can leave the subject key untouched. Fail closed (#2242): an empty answer means
+     * this host KNOWS it holds nothing for the scope. It always can tell — the
+     * directory names the scope's vertical, and the runners are this host's own — so
+     * unlike a Cloudflare host with no control plane it has no "cannot tell" case.
+     */
+    async eraseScopeStores(tenantId, scopeId, subjectId) {
+        const bindings = [...this.scopeStoreRunners.keys()];
+        // Shred calls this for every scope. No vertical names no store object, and a
+        // vertical this host is not pinned to is one its runners never served: both hold
+        // nothing here, and the key is still destroyed.
+        const vertical = this.storeVerticalOf(scopeId);
+        if (!vertical)
+            return [];
+        const erasures = [];
+        for (const binding of bindings) {
+            const { erased } = await this.invokeReservedStore({ tenantId, vertical, scopeId, binding }, 'substrat.erase', { subjectId });
+            erasures.push({ binding, erased });
+        }
+        return erasures;
+    }
+    /**
+     * A dump's stores this host cannot load are refused before any write (#2211, L8): a
+     * binding that is not bound, a store with no kind or a kind other than the bound runner's,
+     * any store at all for a destination with no vertical (no store object can be named for
+     * it, so loading would drop them), or a destination on a vertical other than the one this
+     * host is pinned to.
+     */
+    refuseUnusableScopeStores(stores, vertical) {
+        const listed = stores ?? [];
+        if (listed.length === 0)
+            return;
+        if (vertical === null) {
+            throw substratError('conflict', 'dump carries scope stores, and the destination scope has no vertical to hold them');
+        }
+        if (this.scopeStoreVertical !== undefined && vertical !== this.scopeStoreVertical) {
+            throw substratError('forbidden', `this host serves vertical '${this.scopeStoreVertical}', and the destination scope runs '${vertical}'`);
+        }
+        for (const store of listed) {
+            const runner = this.scopeStoreRunners.get(store.binding);
+            if (!runner) {
+                throw substratError('not_found', `dump names scope store '${store.binding}', which is not bound`);
+            }
+            if (!store.kind) {
+                throw substratError('validation_failed', `dump's scope store '${store.binding}' names no kind`);
+            }
+            if (store.kind !== runner.kind) {
+                throw substratError('conflict', `dump's scope store '${store.binding}' is kind '${store.kind}', and this host binds kind '${runner.kind}'`);
+            }
+        }
+    }
+    async exportScopeStores(tenantId, scopeId) {
+        const bindings = [...this.scopeStoreRunners.keys()];
+        if (bindings.length === 0)
+            return [];
+        const vertical = this.scopeStoreVerticalIfPresent(scopeId);
+        if (!vertical)
+            return [];
+        const stores = [];
+        for (const binding of bindings) {
+            const runner = this.scopeStoreRunners.get(binding);
+            if (!runner)
+                throw substratError('not_found', `no scope store is bound for '${binding}'`);
+            const exported = await this.invokeReservedStore({ tenantId, vertical, scopeId, binding }, 'substrat.export');
+            stores.push({ binding, kind: runner.kind, tables: exported.tables });
+        }
+        return stores;
+    }
+    async importScopeStores(tenantId, scopeId, stores) {
+        const listed = stores ?? [];
+        if (listed.length === 0)
+            return;
+        const vertical = this.scopeStoreVerticalIfPresent(scopeId);
+        if (!vertical) {
+            throw substratError('conflict', `dump carries scope stores, and scope ${scopeId} has no vertical to hold them`);
+        }
+        for (const store of listed) {
+            await this.invokeReservedStore({ tenantId, vertical, scopeId, binding: store.binding }, 'substrat.import', { tables: store.tables });
+        }
+    }
+    /**
+     * `substrat.erase` again for every tombstoned subject (#2207), on the target's and the
+     * source's marks (`replayStoreErasures`). A target this host names no store for (no
+     * runner, or no vertical a store is kept for) has nothing to replay into: nothing is read.
+     */
+    async replayShreddedStoreErasures(actor, tenantId, target, source) {
+        if (!this.storeVerticalOf(target))
+            return undefined;
+        return replayStoreErasures({
+            admin: this.admin,
+            actor,
+            tenantId,
+            target,
+            source,
+            erase: async (subjectId) => (await this.eraseScopeStores(tenantId, target, subjectId)).length,
+        });
+    }
+    /** `substrat.wipe` on each declared binding, before the scope's own storage goes. */
+    async wipeScopeStores(tenantId, scopeId) {
+        const bindings = [...this.scopeStoreRunners.keys()];
+        if (bindings.length === 0)
+            return;
+        const vertical = this.scopeStoreVerticalIfPresent(scopeId);
+        if (!vertical)
+            return;
+        for (const binding of bindings) {
+            await this.invokeReservedStore({ tenantId, vertical, scopeId, binding }, 'substrat.wipe');
+        }
+    }
     /**
      * A scope stub whose authority is a CONNECTION (#97).
      *
@@ -3067,6 +3275,32 @@ export class SqliteScopeHost {
         await this.applyPendingMigrations(rt);
         return rt;
     }
+    /**
+     * The tenant a peer name is read in (#2252): the directory's own slug for that tenant, the one
+     * prefix a push pinned to it registers under. Never parsed out of the name being matched.
+     */
+    peerTenant(tenantId) {
+        const row = this.directory.prepare('SELECT slug FROM tenants WHERE tenant_id = ?').get(tenantId);
+        return { id: tenantId, slug: row?.slug ?? null };
+    }
+    /**
+     * Every scope of the tenant registered under a spelling of the peer name `vertical` in
+     * `tenant` (`peerVerticalSpellings`), for the kernel's resolvers to choose among (#2252).
+     */
+    peerCandidates(tenant, vertical) {
+        const rows = this.directory
+            .prepare(`SELECT scope_id, tenant_id, vertical, status, kind, forked_from FROM scopes
+          WHERE tenant_id = ? AND vertical IN (SELECT value FROM json_each(?))`)
+            .all(tenant.id, JSON.stringify(peerVerticalSpellings(vertical, tenant.slug)));
+        return rows.map((r) => ({
+            id: r.scope_id,
+            tenantId: r.tenant_id,
+            vertical: r.vertical,
+            status: r.status,
+            kind: r.kind ?? '',
+            forkedFrom: r.forked_from ?? null,
+        }));
+    }
     /** The directory's current hold, read again when background work is about to run. */
     scopeWorkRefusal(tenantId, scopeId, allowProvisioning = false) {
         const row = this.directory
@@ -3161,7 +3395,8 @@ export class SqliteScopeHost {
      * here, and `admitPeer` runs inside the scope's actor task on every invoke (`buildStub`).
      */
     async getVerticalScope(caller, tenantId, scopeId, options) {
-        const parsed = verticalCaller.parse(caller);
+        // #2252: the caller as this vertical's `peers` names it, as on the hosted door.
+        const parsed = peerCallerAt(this.peerDeclarations(), verticalCaller.parse(caller));
         const rt = await this.openActiveScope(tenantId, scopeId);
         return this.buildStub(tenantId, scopeId, rt, { kind: 'vertical-peer', caller: parsed }, options);
     }
@@ -4045,10 +4280,15 @@ export class SqliteScopeHost {
         }
     }
     async close() {
-        for (const rt of [...this.scopes.values()])
-            this.closeRuntime(rt);
-        this.directory.close();
-        this.owner.release();
+        try {
+            await this.scopeStoreLifecycle.stop();
+        }
+        finally {
+            for (const rt of [...this.scopes.values()])
+                this.closeRuntime(rt);
+            this.directory.close();
+            this.owner.release();
+        }
     }
     // -------------------------------------------------------------------------
     // Event dispatch (testrun spec §9.2.3): at-least-once, kernel-journaled,
@@ -6130,32 +6370,16 @@ export class SqliteScopeHost {
                 return rows.map(mapHostname);
             },
             // #1706: the directory's answer to "vertical Y in tenant T", by the kernel's one rule.
+            // Names match EXACTLY: this is the cross-vertical edges' read (the import cursor's
+            // producer). A peer call's tenant-pinned spelling is `resolvePeerInstance`'s (#2252).
             resolveVerticalInstance: async (tenantId, vertical) => {
-                const rows = this.directory
-                    .prepare(`SELECT scope_id, tenant_id, vertical, status, kind, forked_from FROM scopes
-              WHERE tenant_id = ? AND vertical = ?`)
-                    .all(tenantId, vertical);
-                return resolveVerticalInstanceFrom(rows.map((r) => ({
-                    id: r.scope_id,
-                    tenantId: r.tenant_id,
-                    vertical: r.vertical,
-                    status: r.status,
-                    kind: r.kind ?? '',
-                    forkedFrom: r.forked_from ?? null,
-                })), tenantId, vertical);
+                const tenant = { id: tenantId, slug: null };
+                return resolveVerticalInstanceFrom(this.peerCandidates(tenant, vertical), tenant, vertical);
             },
             resolvePeerInstance: async (tenantId, callerScopeId, vertical) => {
                 const binding = this.directory.prepare('SELECT target_scope_id, invalidated FROM peer_bindings WHERE tenant_id = ? AND caller_scope_id = ? AND vertical = ?').get(tenantId, callerScopeId, vertical);
-                const rows = this.directory.prepare(`SELECT scope_id, tenant_id, vertical, status, kind, forked_from FROM scopes
-           WHERE tenant_id = ? AND vertical = ?`).all(tenantId, vertical);
-                return resolvePeerInstanceFrom(rows.map((r) => ({
-                    id: r.scope_id,
-                    tenantId: r.tenant_id,
-                    vertical: r.vertical,
-                    status: r.status,
-                    kind: r.kind ?? '',
-                    forkedFrom: r.forked_from,
-                })), tenantId, vertical, binding?.target_scope_id ?? null, binding?.invalidated === 1);
+                const tenant = this.peerTenant(tenantId);
+                return resolvePeerInstanceFrom(this.peerCandidates(tenant, vertical), tenant, vertical, binding?.target_scope_id ?? null, binding?.invalidated === 1);
             },
             peerBinding: async (actor, tenantId, callerScopeId, vertical) => {
                 const row = this.directory.prepare('SELECT target_scope_id, invalidated FROM peer_bindings WHERE tenant_id = ? AND caller_scope_id = ? AND vertical = ?').get(tenantId, callerScopeId, vertical);
@@ -6174,7 +6398,7 @@ export class SqliteScopeHost {
                 }
                 if (targetScopeId !== null) {
                     const target = this.directory.prepare('SELECT tenant_id, vertical, status, kind, forked_from FROM scopes WHERE scope_id = ?').get(targetScopeId);
-                    if (!target || target.tenant_id !== tenantId || target.vertical !== vertical || target.status !== 'active' || !isPrimaryScopeRow(target)) {
+                    if (!target || target.tenant_id !== tenantId || !samePeerVertical(target.vertical, vertical, this.peerTenant(tenantId).slug) || target.status !== 'active' || !isPrimaryScopeRow(target)) {
                         throw substratError('not_found', 'target is not a live primary instance of this vertical in this tenant');
                     }
                 }
@@ -7216,6 +7440,11 @@ export class SqliteScopeHost {
                 this.recordAccess(actor, 'scopeDatabaseSize', { tenantId, scopeId }, null, 1);
                 return bytes;
             },
+            scopeStoreSizes: async (actor, tenantId, scopeId) => {
+                const sizes = await this.readScopeStoreSizes(tenantId, scopeId);
+                this.recordAccess(actor, 'scopeStoreSizes', { tenantId, scopeId }, null, sizes.length);
+                return sizes;
+            },
             rewindScope: async () => {
                 throw new Error('point-in-time rewind is not available on this host (PITR is a Durable-Object-plane mechanism) — use the backup restore path');
             },
@@ -7611,7 +7840,8 @@ export class SqliteScopeHost {
                     return { name, ddl: sql, columns, rows };
                 });
                 this.recordAccess(actor, 'exportScope', { tenantId, scopeId }, null, tables.length);
-                return { tenantId, scopeId, capturedAt: new Date().toISOString(), tables };
+                const stores = await this.exportScopeStores(tenantId, scopeId);
+                return { tenantId, scopeId, capturedAt: new Date().toISOString(), tables, stores };
             },
             // -- directory disaster recovery (#40) ----------------------------------
             // The self-hosted half of the same story. A self-host has no DO point-in-time
@@ -7751,6 +7981,7 @@ export class SqliteScopeHost {
                 const rt = this.scopes.get(`${tenantId}/${scopeId}`);
                 if (rt)
                     this.closeRuntime(rt);
+                await this.wipeScopeStores(tenantId, scopeId);
                 rmSync(join(this.dir, `${tenantId}__${scopeId}.sqlite`), { force: true });
                 // The recoverable copy the caller stored first (#493), named in the audit entry so
                 // the trail answers "was there a backup" without correlating two timestamps.
@@ -7778,7 +8009,19 @@ export class SqliteScopeHost {
             },
             // `stamp` is the erasure epoch an orchestrated erasure's claim compared (#1722). A direct shred
             // claims nothing and records the epoch it ran under: the backfill orders erasures by them.
-            shredSubject: async (actor, tenantId, scopeId, subjectId, stamp) => {
+            listShreddedSubjects: async (actor, tenantId, scopeId, cursor) => {
+                this.assertScope(tenantId, scopeId);
+                const rows = this.directory
+                    .prepare(`SELECT subject_id FROM _substrat_subject_keys
+              WHERE scope_id = ? AND tenant_id = ? AND shredded_at IS NOT NULL AND subject_id > ?
+              ORDER BY subject_id LIMIT 101`)
+                    .all(scopeId, tenantId, cursor ?? '');
+                const subjects = rows.slice(0, 100).map((row) => row.subject_id);
+                const nextCursor = rows.length > 100 ? (subjects[99] ?? null) : null;
+                this.recordAccess(actor, 'listShreddedSubjects', { tenantId, scopeId }, null, subjects.length);
+                return { subjects, nextCursor };
+            },
+            shredSubject: async (actor, tenantId, scopeId, subjectId, stamp, storeErasures) => {
                 this.assertScope(tenantId, scopeId);
                 const before = stamp ?? {
                     erasureEpoch: this.directory.prepare(COPY_BACKFILL_SCOPE_SQL).get(tenantId, scopeId)
@@ -7853,6 +8096,11 @@ export class SqliteScopeHost {
                 // intents, an issue's exemplar, a sweep record's error. Before the key, for the
                 // ordering reason above.
                 redactSubjectDirectoryText(redactionSqlOf(this.directory), { tenantId, scopeId, subjectId, intentIds });
+                // Scope stores after the scope-side redaction and before the key (#2068). A store
+                // that errors throws here, so the key below is untouched and a retry converges.
+                // An orchestrated caller passes the serving script's result and this host does
+                // not erase again.
+                const erasures = storeErasures ?? (await this.eraseScopeStores(tenantId, scopeId, subjectId));
                 const { existed } = await this.subjectKeysFor(tenantId, scopeId).destroy(subjectId, at);
                 const receipt = subjectShredReceipt.parse({
                     subjectId,
@@ -7860,6 +8108,7 @@ export class SqliteScopeHost {
                     intentsRedacted,
                     jobRunsRedacted,
                     ...vertical,
+                    storeErasures: erasures,
                     keyDestroyed: existed,
                     tombstoned: true,
                 });
@@ -7880,7 +8129,7 @@ export class SqliteScopeHost {
                     throw substratError('not_found', `unknown scope ${scopeId} in tenant ${tenantId}`);
                 return row.erasure_epoch;
             },
-            finalizeSubjectShred: async (actor, tenantId, scopeId, subjectId, redactions, expected) => {
+            finalizeSubjectShred: async (actor, tenantId, scopeId, subjectId, redactions, expected, storeErasures) => {
                 if (redactions.length === 0)
                     throw substratError('conflict', 'subject erasure has no confirmed scope redaction');
                 const claimed = this.directory.prepare(`UPDATE scopes SET erasure_epoch = COALESCE(erasure_epoch, 0) + 1
@@ -7896,7 +8145,7 @@ export class SqliteScopeHost {
                 // The pure adapter has one co-located scope store. Its existing atomic shred is
                 // the final local redaction and key destruction, after remote copies confirmed.
                 const shred = this.admin.shredSubject;
-                return shred(actor, tenantId, scopeId, subjectId, { erasureEpoch: expected.epoch, path: 'orchestrated' });
+                return shred(actor, tenantId, scopeId, subjectId, { erasureEpoch: expected.epoch, path: 'orchestrated' }, storeErasures);
             },
             // -- impersonation (K-42, #868) ----------------------------------------
             beginImpersonation: async (actor, input) => {
@@ -7972,6 +8221,7 @@ export class SqliteScopeHost {
                     '_substrat_finding_rules', // #1748: the tenant's suppress rules
                     '_substrat_scope_storage', // #1524: storage samples of scopes whose storage is gone
                     '_substrat_scope_storage_attempts', // #1524: and the phase's last try at each
+                    '_substrat_scope_store_storage', // #2212: scope-store samples, gone with the tenant
                 ];
                 const clear = this.directory.transaction(() => {
                     for (const table of tables) {
@@ -8080,6 +8330,7 @@ export class SqliteScopeHost {
                     // #1524: the stored gauge's latest sample per non-reaped scope. A directory read only.
                     storage: listScopeStorageRows(redactionSqlOf(this.directory), { tenantId: only, latest: true }),
                     storageAttempts: listScopeStorageAttemptRows(redactionSqlOf(this.directory), only),
+                    storeStorage: listScopeStoreStorageRows(redactionSqlOf(this.directory), only),
                 });
                 // The count that matters for K-24 is how many TENANTS this reading covered —
                 // "read the meter for one tenant" and "metered the whole fleet" are different
@@ -9507,6 +9758,8 @@ export class SqliteScopeHost {
             // envelope data module code could set or branch on.
             rt.invocationId, full.payload === undefined ? null : JSON.stringify(full.payload));
         };
+        // #2192: the call's invocation id, one reader for `ctx.log` and `ctx.requestId`.
+        const requestIdNow = () => rt.invocationId ?? delivery?.invocationId ?? null;
         const ctxRef = {
             tenantId: rt.tenantId,
             scopeId: rt.scopeId,
@@ -9526,13 +9779,17 @@ export class SqliteScopeHost {
                 tenantId: rt.tenantId,
                 scopeId: rt.scopeId,
                 operation: operation ?? null,
-                invocationId: () => rt.invocationId ?? delivery?.invocationId ?? null,
+                invocationId: requestIdNow,
                 // A consumer runs under the system override, so it logs as `system`.
                 principalKind: overrideActor ? 'system' : subject.kind,
                 // The string-safe redaction: `redactSecrets` parses its serialization back, and a
                 // log's text is not JSON.
                 redact: (text) => redactSecretText(text, minted),
             }, this.logSink),
+            // #2192: the same id the log lines carry.
+            get requestId() {
+                return requestIdNow();
+            },
             emit: (event) => writeEvent(event, 'module'),
             requestPlatform: (request) => {
                 assertImpersonationWrites(impersonation, 'ctx.requestPlatform');