@substrat-run/adapter-sqlite 0.147.0 → 0.149.0

package/dist/index.js

@@ -1,16 +1,17 @@
 import { existsSync, mkdirSync, readdirSync, readFileSync, realpathSync, rmSync, writeFileSync } from 'node:fs';
 import { dirname, join } from 'node:path';
 import Database from 'better-sqlite3';
-import { accessLogEntry, adminLogEntry, delegatedReadParams, operationSeriesCount, opsFailureEntry, opsFailureFingerprint, issueEntry, FRESHNESS_HEARTBEAT_MINUTES, sweepRunEntry, modelUsageEntry, ATTACHMENT_ADDED, ATTACHMENT_REMOVED, attachmentRecord, createTenantInput, domainEvent, domainEventInput, exportReadInput, importBatch, importCursorMove, exportsOfManifestJson, assertNoBindingShapeBreak, importsOfManifestJson, entitlementGrant, entitlementGrantInput, eventId, meterReading, platformRequestInput, platformRequestId, MAX_PENDING_PLATFORM_REQUESTS, identityLink, identityPool, instant, isSubstratError, connection, capabilityGrant, connectionGrant, connectionGrantRecord, connectionSecret, systemGrant, systemSwitch, systemSwitchRecord, peerSwitch, verticalCaller, verticalSlug as verticalSlugOf, subjectRef, requestFingerprint, createConnectionInput, connectLinkFilter, connectLinkKey, consumeConnectLinkInput, mintConnectLinkInput, projectedConnectionGrant, projectedConnectionKey, moduleManifest, createOrgInput, promotionAcknowledgement, bindAcknowledgement, bindHostnameInput, channelHistoryEntry, hostnameBinding, publishVersionInput, AUTO_ADMISSION_NOTE, routeTarget, ROUTE_SCOPE_HOSTNAMES_MAX, registerVerticalInput, vertical as verticalSchema, verticalChannel, verticalVersion, objectRef, entityObjectRef, assertModuleEmittableType, assertKernelAuthoredType, grantRefFromProof, org as orgSchema, orgMembership, principalId, resolvedIdentity, identityMembership, roleDefinition, scope as scopeSchema, tenant as tenantSchema, tenantRole, principalBecomeCapabilityInput, subjectShredReceipt, SCOPE_TABLE_PAGE_DEFAULT, SCOPE_TABLE_PAGE_MAX, SCOPE_QUERY_ROW_MAX, verticalServingState, callsOfManifestJson, outboundOfManifestJson, listLimitOf, pageOf, countedPageOf, SCOPE_GATE_REASONS, substratError, assertReplayableDump, delegatedReadRecord, ownerTransferAudit, memberChangeAudit, peerBindingAudit, copyMarkAudit, redrainEventsInput, REDRAIN_BATCH, } from '@substrat-run/contracts';
-import { actorOf, asPrincipal, assertAllowed, assertNoSecret, assertPermissionKey, CAPABILITY_DDL, COPY_ORIGIN_DDL, ENTITY_STATE_MOVES_DDL, CAPABILITY_EXCHANGE_OPERATION, CAPABILITY_BECOME_MINT_OPERATION, becomeMintCheck, mintBecomeCapabilityAsPrincipal, revokeBecomeCapabilityAsPrincipal, readBecomeLinkStates, ENTITY_UNBIND_OPERATION, allowedFor, unbindEntityHolderBounded, capabilityAttachmentWriteRefused, capabilityTokenHash, createCapabilityVerbs, createEntityEdgeVerbs, createEntityStateVerbs, createTrashedReads, CONTINUATION_POSITION_CAP, visibleContinuation, searchStateWhere, uncheckedView, addStatePlans, addUpdatedStampPlans, watchUpdatedStamps, entityStateMigrations, assertNoCallerPurge, isUnreachableParent, heldPurgePass, purgeDueOf, purgeHeldBy, lifecycleRefusal, purgeOnlyKeysOf, purgeReportOf, purgeStillDue, refuseTrashedTarget, assertBoundOperations, registerTrashTargets, runPurgePass, withheldKeysFor, statefulTablesOf, afterMigration, afterRuntimeDdl, derivesAnything, repairDerivedObjects, StateColumnLost, exchangeCapability as exchangeCapabilitySecret, guardSecrets, mintBecomeCapability, plausibleSessionToken, readCapabilityPage, redactSecrets, redactSecretText, moduleLog, consoleLogSink, asyncInvocationId, asyncLinePass, consoleInvocationLineSink, resolveCapabilitySession, revokeCapabilityAsPlatform, assertReadOnlyQuery, attachmentBlobKey, attachmentSha256, entitlementDenial, requiredEntitlementFor, foldMeterReading, guardSpine, guardSqlLimits, DO_SQL_LIMITS, tooManyResultColumns, tooManyTableColumns, parseValidationRecords, resolveScopeRecord, ulid, ISSUE_RETENTION_DAYS, telemetryRetentionStatements, FINDINGS_DDL, SCOPE_STORAGE_DDL, forgetScopeStorage, listScopeStorageAttemptRows, listScopeStorageRows, listScopeStoreStorageRows, pruneScopeStorageRows, recordScopeStorageRows, CONNECT_LINKS_DDL, consumeConnectLinkRow, insertConnectLink, listConnectLinks as listConnectLinkRows, readConnectLink, restoreConnectLinkRow, revokeConnectLinkRow, createFindingRule, findingOfOpsFailure, findingOfSweepRun, pruneFindings, listFindingRules, listFindings, observeFinding, revokeFindingRule, setFindingStatus, assertRowLimit, assertRowOffset, OPS_FAILURE_RETENTION_DAYS, SWEEP_RUN_RETENTION_DAYS, SWEEP_RUNS_INTENT_INDEX, sweepRunsIntentHasKind, MODEL_USAGE_RETENTION_DAYS, foldModelUsage, backoffAt, platformRequestHistoryQuery, platformRequestOf, PLATFORM_REQUEST_COLUMNS, PLATFORM_REQUEST_REDACTION_SQL, platformRequestRedactionParams, platformRequestRedactionQuery, intentPayloadCarriesSubject, redactSubjectJobRuns, eraseSubjectFromModules, moduleRowsErased, moduleErasurePlan, redactSubjectScopeText, redactSubjectDirectoryText, ISSUE_EXEMPLAR_OWNER_BACKFILL_SQL, issueExemplarOwner, JOB_RUN_PATCH_SQL, JOB_RUN_CLAIM_SQL, JOB_RUN_RENEW_SQL, JOB_RUN_BEGIN_SQL, JOB_RUN_MISS_SQL, JOB_RUN_MISS_SETTLE_SQL, admissionMissOutcome, JOB_STEP_RECORD_SQL, JOB_LEASE_EXPIRED_NOTE, assertLeaseMs, DELIVERY_ERROR_REDACTION_SQL, REDACTED_DELIVERY_NOTE, seatScopeTuple, applyScopeRoleChange, changeScopeRole, revokeScopeRoles, scopeRoleHolders, admitPeer, peerCallerAt, collectPeers, peerSeats, resolveVerticalInstanceFrom, resolvePeerInstanceFrom, peerVerticalSpellings, samePeerVertical, peerGrantsStatus, systemGrantsStatus, systemScheduleState, systemSwitchedOff, systemSwitchedOffMessage, tenantSystemSwitchedOffMessage, PEER_SWITCHES_DDL, PEER_BINDINGS_DDL, SWITCH_OWED_DDL, SWITCH_FENCES_DDL, TABLE_OWNERS_DDL, assertMigrationLeavesLedgerAlone, recordOwnershipSteps, runMigrationStatements, executableSqlStatements, blankSqlComments, recordWriteSuperseded, switchFencesOf, switchSupersededMessage, SWITCH_KINDS, SYSTEM_SWITCHES_DDL, forgetSwitchesOf, listSystemSwitchRecords, moveSwitch, reassertActionOf, reassertEntry, reassertOffRow, recordSwitchedOff, recordSwitchedOn, restoreSwitchRecord, scopesSwitchedOffFor, switchActionOf, switchAuditSubject, recordAuditOutcome, auditedCapabilityRevoke, auditWarningOf, switchNotFoundMessage, switchRecordsOf, switchedOffOf, switchesBackfillSqlOf, switchesTableExists, tenantHeldOf, tenantHoldsGrant, inUnitMovesToAudit, staleCarryRevertRow, staleCarryReverts, withRecorded, VERSION_MIGRATIONS_DDL, splitManifestMigrations, splitVersionMigrationsBatch, versionMigrationsOf, writeVersionMigrations, denialListQuery, refusalListQuery, mapRefusalRow, denialSummaryQuery, denialTotalsQuery, DENIAL_WINDOW_QUERY, mapDenialRow, mapDenialSummaryBuckets, IMPERSONATION_COLUMNS, IMPERSONATION_DDL, ImpersonationRefused, assertImpersonationWrites, assertModuleEnqueueableKind, assertSessionUsable, impersonationByIdQuery, impersonationListQuery, impersonationRowValues, impersonationStampOf, mapImpersonationRow, newImpersonationSession, resolveRetryPolicy, executorOutcomeOf, isDeliveryRefusal, refusalJournalText, membershipFencesBackfillSql, MEMBERSHIP_FENCES_DDL, membershipFencesTableExists, MEMBERSHIP_FENCE_SINCE_SQL, RAISE_MEMBERSHIP_FENCE_SQL, memberAddedAudit, orgChangeBound, tenantCoverage, isSecretBoxConfigured, unconfiguredSecretBox, createSubjectKeys, generateSealingKeyPair, noSealingKeyMessage, openSealed, sealTo, ConnectionSealingKeyUnavailableError, PermissionDenied, createAtomic, NotSearchable, NotListable, listIndexMigrations, listIndexPlans, listQuery, cursorOf, moduleMigrations, MIGRATION_DIGEST_FENCE_DDL, MIGRATION_DIGEST_MARK_LEGACY, assertJournalDumpCoherent, assertMigrationSql, migrationDivergence, migrationFailedError, migrationSteps, planMigrations, isSearchIndexTable, searchIndexMigrations, searchIndexPlans, searchLimit, searchMatchExpression, searchQuery, ATTACHMENT_TEXT_DDL, assertAttachmentExtractors, resolveAttachmentTextBounds, assertJobRegistrable, attachmentRecordOfRow, attachmentTextJob, enqueueAttachmentText, ATTACHMENT_TEXT_BACKFILL_JOB, ATTACHMENT_TEXT_JOB, kernelJobFor, queueAttachmentTextBackfill, startAttachmentTextBackfill, attachmentTextBackfillJob, reconcileAttachmentText, recordAttachmentText, searchAttachments, entityVersionQuery, entityVersionOf, assertIfMatch, OUTBOX_ENTITY_INDEX, SCHEDULE_STATE_DDL, SCHEDULE_STATE_REBUILD, scheduleStateHasKind, VERTICAL_EVENTS_DDL, EXPORT_HOPS_SQL, emptyImportResult, IMPORT_CURSORS_SQL, IMPORT_CURSOR_OF_SQL, OUTBOX_MARK_SQL, emittedSinceQuery, emittedReportOf, EMITTED_REPORT_CAP, exportedSinceQuery, IMPORT_CURSOR_ADVANCE_SQL, IMPORT_RECORD_SQL, moveImportCursor, importCursorSourceOf, exportBreaksOf, exportBreakRefusal, bindExportBreaksOf, bindExportBreakRefusal, scopeMoveOf, runningVersionOf, isPrimaryScope, PROVISIONED_VERSIONS_SQL, installsReconciledOf, strandJudgmentsOf, provisionedVersionsParams, boundShapesColumn, boundShapesOfColumn, installReconciled, CrossVerticalRegistry, exportReadPlan, exportReadQuery, planExportBatch, withheldNote, JOB_RUN_DDL, JOB_RUN_DUE_AT, jobRunListLimit, jobRunOf, runDueJobRuns, startJobRun, IDEMPOTENCY_DDL, REFUSALS_TABLE_DDL, REFUSALS_INDEX, refusalInsert, refusalOf, markGuardRefusal, REFUSALS_REBUILD, refusalsAdmitGuards, assertIdempotencyKey, idempotencyLookupQuery, idempotencyPruneStatement, idempotencyRecordStatement, idempotencyOptedOutMessage, replayFor, globalFetch, createUlid, facetEvents, readHistory, walkEventCause, walkEventEffects, assertRedrainWindow, readInvocation, readDeadLetters, readLifecycleFlow, readOperationSeries, domainEventOf, readUndrainedOutbox, undrainedEventsOf, connectorCallRecord, noopConnectorCallRecorder, recordConnectorCall, settleConnectionUse, unknownRoleError, callReservedStoreOperation, callScopeStore, observeStoreCall, replayStoreErasures, scopeStoreLifecycleOf, scopeStoreRunnersOf, } from '@substrat-run/kernel';
+import { accessLogEntry, adminLogEntry, delegatedReadParams, operationSeriesCount, opsFailureEntry, opsFailureFingerprint, issueEntry, FRESHNESS_HEARTBEAT_MINUTES, sweepRunEntry, modelUsageEntry, ATTACHMENT_ADDED, ATTACHMENT_REMOVED, attachmentRecord, createTenantInput, domainEvent, domainEventInput, exportReadInput, importBatch, importCursorMove, exportsOfManifestJson, assertNoBindingShapeBreak, importsOfManifestJson, entitlementGrant, entitlementGrantInput, eventId, meterReading, platformRequestInput, platformRequestId, MAX_PENDING_PLATFORM_REQUESTS, identityLink, identityPool, instant, isSubstratError, connection, capabilityGrant, connectionGrant, connectionGrantRecord, connectionSecret, systemGrant, systemSwitch, systemSwitchRecord, peerSwitch, verticalCaller, verticalSlug as verticalSlugOf, subjectRef, requestFingerprint, createConnectionInput, connectLinkFilter, connectLinkKey, consumeConnectLinkInput, mintConnectLinkInput, projectedConnectionGrant, projectedConnectionKey, moduleManifest, createOrgInput, promotionAcknowledgement, bindAcknowledgement, bindHostnameInput, channelHistoryEntry, hostnameBinding, publishVersionInput, AUTO_ADMISSION_NOTE, routeTarget, ROUTE_SCOPE_HOSTNAMES_MAX, registerVerticalInput, vertical as verticalSchema, verticalChannel, verticalVersion, objectRef, entityObjectRef, assertModuleEmittableType, assertKernelAuthoredType, grantRefFromProof, org as orgSchema, orgMembership, principalId, resolvedIdentity, identityMembership, roleDefinition, scope as scopeSchema, tenant as tenantSchema, tenantRole, principalBecomeCapabilityInput, subjectShredReceipt, SCOPE_TABLE_PAGE_DEFAULT, SCOPE_TABLE_PAGE_MAX, SCOPE_QUERY_ROW_MAX, verticalServingState, callsOfManifestJson, outboundOfManifestJson, listLimitOf, pageOf, countedPageOf, SCOPE_GATE_REASONS, substratError, assertReplayableDump, delegatedReadRecord, ownerTransferAudit, memberChangeAudit, peerBindingAudit, connectionBindingAudit, copyMarkAudit, orphanSweepAudit, redrainEventsInput, REDRAIN_BATCH, } from '@substrat-run/contracts';
+import { actorOf, asPrincipal, assertAllowed, assertNoSecret, assertPermissionKey, CAPABILITY_DDL, UPLOAD_LINK_DDL, createAttachmentVerbs, inspectUploadLink, redeemUploadLinkInTransaction, redeemOrReplayUploadLink, COPY_ORIGIN_DDL, ENTITY_STATE_MOVES_DDL, CAPABILITY_EXCHANGE_OPERATION, CAPABILITY_BECOME_MINT_OPERATION, becomeMintCheck, mintBecomeCapabilityAsPrincipal, revokeBecomeCapabilityAsPrincipal, readBecomeLinkStates, ENTITY_UNBIND_OPERATION, allowedFor, unbindEntityHolderBounded, capabilityAttachmentWriteRefused, capabilityTokenHash, createCapabilityVerbs, createEntityEdgeVerbs, createEntityStateVerbs, createTrashedReads, CONTINUATION_POSITION_CAP, visibleContinuation, searchStateWhere, uncheckedView, addStatePlans, addUpdatedStampPlans, watchUpdatedStamps, entityStateMigrations, assertNoCallerPurge, isUnreachableParent, heldPurgePass, purgeDueOf, purgeHeldBy, lifecycleRefusal, purgeOnlyKeysOf, purgeReportOf, purgeStillDue, refuseTrashedTarget, assertBoundOperations, registerTrashTargets, runPurgePass, withheldKeysFor, statefulTablesOf, afterMigration, afterRuntimeDdl, derivesAnything, repairDerivedObjects, StateColumnLost, exchangeCapability as exchangeCapabilitySecret, guardSecrets, mintBecomeCapability, plausibleSessionToken, readCapabilityPage, redactSecrets, redactSecretText, moduleLog, consoleLogSink, asyncInvocationId, asyncLinePass, consoleInvocationLineSink, resolveCapabilitySession, revokeCapabilityAsPlatform, assertReadOnlyQuery, attachmentBlobKey, attachmentSha256, entitlementDenial, requiredEntitlementFor, foldMeterReading, guardSpine, guardSqlLimits, DO_SQL_LIMITS, tooManyResultColumns, tooManyTableColumns, parseValidationRecords, resolveScopeRecord, ulid, ISSUE_RETENTION_DAYS, telemetryRetentionStatements, FINDINGS_DDL, SCOPE_STORAGE_DDL, forgetScopeStorage, listScopeStorageAttemptRows, listScopeStorageRows, listScopeStoreStorageRows, pruneScopeStorageRows, recordScopeStorageRows, CONNECT_LINKS_DDL, consumeConnectLinkRow, insertConnectLink, listConnectLinks as listConnectLinkRows, readConnectLink, restoreConnectLinkRow, revokeConnectLinkRow, createFindingRule, findingOfOpsFailure, findingOfSweepRun, pruneFindings, listFindingRules, listFindings, observeFinding, revokeFindingRule, setFindingStatus, assertRowLimit, assertRowOffset, OPS_FAILURE_RETENTION_DAYS, SWEEP_RUN_RETENTION_DAYS, SWEEP_RUNS_INTENT_INDEX, sweepRunsIntentHasKind, MODEL_USAGE_RETENTION_DAYS, foldModelUsage, backoffAt, platformRequestHistoryQuery, platformRequestOf, PLATFORM_REQUEST_COLUMNS, PLATFORM_REQUEST_REDACTION_SQL, platformRequestRedactionParams, platformRequestRedactionQuery, intentPayloadCarriesSubject, redactSubjectJobRuns, eraseSubjectFromModules, moduleRowsErased, moduleErasurePlan, redactSubjectScopeText, redactSubjectDirectoryText, ISSUE_EXEMPLAR_OWNER_BACKFILL_SQL, issueExemplarOwner, JOB_RUN_PATCH_SQL, JOB_RUN_CLAIM_SQL, JOB_RUN_RENEW_SQL, JOB_RUN_BEGIN_SQL, JOB_RUN_MISS_SQL, JOB_RUN_MISS_SETTLE_SQL, admissionMissOutcome, JOB_STEP_RECORD_SQL, JOB_LEASE_EXPIRED_NOTE, assertLeaseMs, DELIVERY_ERROR_REDACTION_SQL, REDACTED_DELIVERY_NOTE, seatScopeTuple, applyScopeRoleChange, changeScopeRole, revokeScopeRoles, scopeRoleHolders, admitPeer, boundToPeerDeclarations, peerCallerAt, collectPeers, peerSeats, resolveVerticalInstanceFrom, resolvePeerInstanceFrom, peerVerticalSpellings, samePeerVertical, peerGrantsStatus, systemGrantsStatus, systemScheduleState, systemSwitchedOff, systemSwitchedOffMessage, tenantSystemSwitchedOffMessage, PEER_SWITCHES_DDL, PEER_BINDINGS_DDL, SWITCH_OWED_DDL, SWITCH_FENCES_DDL, TABLE_OWNERS_DDL, assertMigrationLeavesLedgerAlone, recordOwnershipSteps, runMigrationStatements, executableSqlStatements, blankSqlComments, recordWriteSuperseded, switchFencesOf, switchSupersededMessage, SWITCH_KINDS, SYSTEM_SWITCHES_DDL, forgetSwitchesOf, listSystemSwitchRecords, moveSwitch, reassertActionOf, reassertEntry, reassertOffRow, recordSwitchedOff, recordSwitchedOn, restoreSwitchRecord, scopesSwitchedOffFor, switchActionOf, switchAuditSubject, recordAuditOutcome, auditedCapabilityRevoke, auditWarningOf, switchNotFoundMessage, switchRecordsOf, switchedOffOf, switchesBackfillSqlOf, switchesTableExists, tenantHeldOf, tenantHoldsGrant, inUnitMovesToAudit, staleCarryRevertRow, staleCarryReverts, withRecorded, VERSION_MIGRATIONS_DDL, VERTICAL_SCOPE_STORES_DDL, forgetVerticalScopeStores, indexVersionScopeStores, driverDeclarationsOf, verticalScopeStoresOf, STORE_DRIVER_RELEASES_DDL, legacyStoreDriverConflict, legacyStoreDriverRenames, beginStoreDriverRolloutIn, finishStoreDriverRolloutIn, holdStoreDriverIn, advanceStoreDriverRebuildIn, claimStoreDriverRebuildIn, storeDriverRebuildIn, recordStoreDriverReleaseIn, releaseStoreDriverHoldIn, storeDriverReleaseIn, storeDriverStateIn, storeDriverRolloutPendingIn, storeDriverRolloutWalkedIn, splitManifestMigrations, splitVersionMigrationsBatch, versionMigrationsOf, deriveVersionMigrationDigest, publishedMigrationDigest, migrationChangeRefusal, writeVersionMigrations, denialListQuery, refusalListQuery, mapRefusalRow, denialSummaryQuery, denialTotalsQuery, DENIAL_WINDOW_QUERY, mapDenialRow, mapDenialSummaryBuckets, IMPERSONATION_COLUMNS, IMPERSONATION_DDL, ImpersonationRefused, assertImpersonationWrites, assertModuleEnqueueableKind, assertSessionUsable, impersonationByIdQuery, impersonationListQuery, impersonationRowValues, impersonationStampOf, mapImpersonationRow, newImpersonationSession, resolveRetryPolicy, executorOutcomeOf, isDeliveryRefusal, refusalJournalText, membershipFencesBackfillSql, MEMBERSHIP_FENCES_DDL, membershipFencesTableExists, MEMBERSHIP_FENCE_SINCE_SQL, RAISE_MEMBERSHIP_FENCE_SQL, memberAddedAudit, orgChangeBound, tenantCoverage, isSecretBoxConfigured, unconfiguredSecretBox, createSubjectKeys, generateSealingKeyPair, noSealingKeyMessage, openSealed, sealTo, ConnectionSealingKeyUnavailableError, PermissionDenied, createAtomic, NotSearchable, NotListable, listIndexMigrations, listIndexPlans, listQuery, cursorOf, moduleMigrations, MIGRATION_DIGEST_FENCE_DDL, MIGRATION_DIGEST_MARK_LEGACY, assertJournalDumpCoherent, assertMigrationSql, migrationDivergence, migrationFailedError, migrationSetDivergence, migrationSteps, planMigrations, isSearchIndexTable, searchIndexMigrations, searchIndexPlans, searchLimit, searchMatchExpression, searchQuery, ATTACHMENT_TEXT_DDL, ATTACHMENT_CONDEMNED_DDL, condemnOrphanAttachments, fenceAttachmentSweep, refuseCondemnedAttachment, refuseCondemnedInDump, rowlessAttachmentIds, sweepOrphanAttachments, missingAttachmentStore, SETTLED_COPY_STATES, unsettledCopyRefusal, assertAttachmentExtractors, resolveAttachmentTextBounds, assertJobRegistrable, attachmentRecordOfRow, attachmentTextJob, enqueueAttachmentText, ATTACHMENT_TEXT_BACKFILL_JOB, ATTACHMENT_TEXT_JOB, kernelJobFor, queueAttachmentTextBackfill, startAttachmentTextBackfill, attachmentTextBackfillJob, reconcileAttachmentText, recordAttachmentText, searchAttachments, entityVersionQuery, entityVersionOf, assertIfMatch, OUTBOX_ENTITY_INDEX, SCHEDULE_STATE_DDL, SCHEDULE_STATE_REBUILD, scheduleStateHasKind, VERTICAL_EVENTS_DDL, EXPORT_HOPS_SQL, emptyImportResult, IMPORT_CURSORS_SQL, IMPORT_CURSOR_OF_SQL, OUTBOX_MARK_SQL, emittedSinceQuery, emittedReportOf, EMITTED_REPORT_CAP, exportedSinceQuery, IMPORT_CURSOR_ADVANCE_SQL, IMPORT_RECORD_SQL, moveImportCursor, importCursorSourceOf, exportBreaksOf, exportBreakRefusal, assertPromoteReviewCurrent, promoteRaceRefusal, rebindRaceRefusal, SERVES_NOW_CONDITION, SERVES_NOW_PREDICATE, servesNowParams, bindExportBreaksOf, bindExportBreakRefusal, scopeMoveOf, runningVersionOf, isPrimaryScope, PROVISIONED_VERSIONS_SQL, installsReconciledOf, strandJudgmentsOf, provisionedVersionsParams, boundShapesColumn, boundShapesOfColumn, installReconciled, CrossVerticalRegistry, exportReadPlan, exportReadQuery, planExportBatch, withheldNote, JOB_RUN_DDL, JOB_RUN_DUE_AT, jobRunListLimit, jobRunOf, runDueJobRuns, startJobRun, IDEMPOTENCY_DDL, REFUSALS_TABLE_DDL, REFUSALS_INDEX, refusalInsert, refusalOf, markGuardRefusal, REFUSALS_REBUILD, refusalsAdmitGuards, assertIdempotencyKey, idempotencyLookupQuery, idempotencyPruneStatement, idempotencyRecordStatement, idempotencyOptedOutMessage, replayFor, globalFetch, createUlid, facetEvents, readHistory, walkEventCause, walkEventEffects, assertRedrainWindow, readInvocation, readDeadLetters, readLifecycleFlow, readOperationSeries, domainEventOf, readUndrainedOutbox, undrainedEventsOf, connectorCallRecord, noopConnectorCallRecorder, recordConnectorCall, settleConnectionUse, unknownRoleError, callReservedStoreOperation, callScopeStore, observeStoreCall, replayStoreErasures, scopeStoreLifecycleOf, scopeStoreRunnersOf, } from '@substrat-run/kernel';
 import { attributedView, delegatedRevokeSql, writeExplicitTupleIn, grantEntityShapeIn, shapeTopUpBatch, topUpEntityGrantShapes, settlePlatformRequestIn, } from '@substrat-run/kernel';
 import { ADMIN_LOG_INDEXES_SQL, SETTLE_INTENT_SQL, SETTLE_OUTCOME_SQL, settleOutcomeParamsOf, readAuditedOperations, unknownOutcomeOf, } from '@substrat-run/kernel';
-import { INERT_SCOPE_REASON, isPrimaryScopeRow } from '@substrat-run/kernel';
-import { COPY_BACKFILL_SCOPE_SQL, COPY_BACKFILL_SQL, COPY_BACKFILL_SUPERSEDE_SQL, COPY_CLAIM_SQL, COPY_EXPIRED_SQL, copyBackfillParams, copyBackfillRefusal, COPY_MOVE_CONFIRM_SQL, COPY_MOVE_LIVE_PREDICATE, SCOPE_COPY_LEASE_MS, SCOPE_SCRIPT_COPY_COLUMNS, copyMoveConfirmParams, copyMoveLiveParams, scopeScriptCopyOf, } from '@substrat-run/kernel';
+import { INERT_SCOPE_REASON, isPrimaryScopeRow, normalizeUploadMediaType } from '@substrat-run/kernel';
+import { COPY_BACKFILL_SCOPE_SQL, COPY_BACKFILL_SQL, COPY_BACKFILL_SUPERSEDE_SQL, COPY_CLAIM_SQL, COPY_EXPIRED_SQL, copyBackfillParams, copyBackfillRefusal, SUBJECT_ERASURE_CLAIM_SQL, subjectErasureClaimParams, COPY_MOVE_CONFIRM_SQL, COPY_MOVE_LIVE_PREDICATE, SCOPE_COPY_LEASE_MS, SCOPE_SCRIPT_COPY_COLUMNS, copyMoveConfirmParams, copyMoveLiveParams, scopeScriptCopyOf, } from '@substrat-run/kernel';
 import { GRANT_CHILDREN_INDEX_DDL, SHAPE_MARKER_INDEX_DDL, grantedEntitiesForContext } from '@substrat-run/kernel';
 import { LEGACY_SCOPE_ROWS_BACKFILL, assertSpineTablesBuilt, capabilitiesForLoad, dumpRowsInsert, isSpineTable, loadDirectoryDump, repointScopeGrants, settleCopiedWork, emittedHere, spineColumnAdditions } from '@substrat-run/kernel';
 import { ScopeActor } from './actor.js';
 import { createTupleChecker, directoryTenantReader } from './checker.js';
+export { scopeStoreRunnersFor } from './scope-store-runners.js';
 /**
  * A fault in the database itself (full, corrupt, I/O), as opposed to one statement failing.
  * The #1764 backfill logs and opens past a failed batch, but never past one of these.
@@ -213,6 +214,9 @@ const KERNEL_DDL = `
   -- an exchange trades that secret for. Spine (kernel-written), shared with the DO adapter
   -- from @substrat-run/kernel so the two cannot part company; the column comments are there.
   ${CAPABILITY_DDL}
+  -- Upload links: a short-lived, single-use URL that lets a caller with no session upload ONE
+  -- file to ONE entity. Spine (kernel-written), shared with the DO adapter from the kernel.
+  ${UPLOAD_LINK_DDL}
   -- #1686: where a copied scope's data came from, and the event id its own events start above.
   -- Shared with the other adapter from @substrat-run/kernel; the column comments are there.
   ${COPY_ORIGIN_DDL}
@@ -318,11 +322,19 @@ const KERNEL_DDL = `
   -- #1575: attachment text and its FTS5 index, shared from @substrat-run/kernel. After
   -- _substrat_attachments, whose delete trigger it adds.
   ${ATTACHMENT_TEXT_DDL}
+  -- #2314: the orphan sweep's tombstones, shared from @substrat-run/kernel. An id here
+  -- never takes an attachment row again: the insert path refuses it.
+  ${ATTACHMENT_CONDEMNED_DDL}
   -- #901: an entity's version is the ULID of the last event about it (a state move
   -- excepted, #2191), so the newest id per (entity_type, entity_id) is the read. The id
   -- column sits last so SQLite walks the matched range backwards instead of aggregating.
   ${OUTBOX_ENTITY_INDEX}
 `;
+/**
+ * The scope spine a fresh scope gets, for a tool that replays a vertical's migrations outside a
+ * host — `pnpm lint:migration-fence` (#115), whose reviewed spine migrations read and write it.
+ */
+export const SCOPE_SPINE_DDL = KERNEL_DDL;
 /** Row → contract shape. Never reads the secrets table — that is the point of the split. */
 const toConnection = (r) => connection.parse({
     id: r.id,
@@ -637,6 +649,8 @@ export class SqliteScopeHost {
     erasurePlans = [];
     /** entityType → the declared attachment gate (#473): read key + write key (default: read). */
     attachmentTargets = new Map();
+    /** entityType → the `uploadLinks` policy its `attachmentTargets` entry declares; absent = no links. */
+    uploadLinkPolicies = new Map();
     /** operation name → who binds it: the owning module, its entitlementKey and its declared
      *  schedules — the §4.3 gate's input, resolved per invoke by `requiredEntitlementFor` (#1654). */
     operationEntitlement = new Map();
@@ -692,11 +706,13 @@ export class SqliteScopeHost {
     secretBox;
     /** The parsers attachment text is extracted with (K-43); the host's own, never imported here. */
     attachmentExtractors;
+    wrapBlobStore;
     attachmentTextBounds;
     fetchImpl;
     connectorCalls;
     clock;
     versionId;
+    migrationsDigest;
     /** #1746: where `ctx.log` lines go — the console unless a caller (a test) says otherwise. */
     logSink;
     /** #1901: where async work's invocation lines go. */
@@ -710,11 +726,13 @@ export class SqliteScopeHost {
         this.secretBox = options.secretBox ?? unconfiguredSecretBox;
         assertAttachmentExtractors(options.attachmentExtractors ?? []);
         this.attachmentExtractors = options.attachmentExtractors ?? [];
+        this.wrapBlobStore = options.wrapBlobStore ?? ((store) => store);
         this.attachmentTextBounds = resolveAttachmentTextBounds(options.attachmentTextBounds);
         this.fetchImpl = options.fetch ?? globalFetch;
         this.connectorCalls = options.connectorCalls ?? noopConnectorCallRecorder;
         this.clock = options.clock ?? (() => instant.parse(new Date().toISOString()));
         this.versionId = options.versionId ?? null;
+        this.migrationsDigest = options.migrationsDigest;
         this.scopeStoreVertical = options.scopeStores?.vertical;
         this.scopeStoreRunners = scopeStoreRunnersOf(options.scopeStores);
         this.scopeStoreLifecycle = scopeStoreLifecycleOf(this.scopeStoreRunners);
@@ -737,17 +755,17 @@ export class SqliteScopeHost {
             this.directory.pragma('journal_mode = WAL');
             this.ensureDirectorySchema();
             this.loadRoles();
-            this.checker =
-                customChecker ??
-                    createTupleChecker({
-                        directory: this.directory,
-                        scopeDb: (scopeId) => this.scopesById.get(scopeId)?.db,
-                        getRole: (tenantId, key) => this.roles.get(`${tenantId}/${key}`),
-                        // #956: the evaluator judges `expires_at` against the host's clock, so a
-                        // scripted one can actually expire a grant. A caller-supplied `checker`
-                        // keeps its own time source — this only binds the built-in one.
-                        clock: () => this.clock(),
-                    });
+            // #2263: whichever checker evaluates, a peer holds only what the running declaration names.
+            this.checker = boundToPeerDeclarations(customChecker ??
+                createTupleChecker({
+                    directory: this.directory,
+                    scopeDb: (scopeId) => this.scopesById.get(scopeId)?.db,
+                    getRole: (tenantId, key) => this.roles.get(`${tenantId}/${key}`),
+                    // #956: the evaluator judges `expires_at` against the host's clock, so a
+                    // scripted one can actually expire a grant. A caller-supplied `checker`
+                    // keeps its own time source — this only binds the built-in one.
+                    clock: () => this.clock(),
+                }), () => this.peerDeclarations());
             this.admin = this.buildAdmin();
             this.owner = owner;
         }
@@ -936,6 +954,8 @@ export class SqliteScopeHost {
         created_at TEXT NOT NULL,
         PRIMARY KEY (tenant_id, vertical, binding)
       );
+      -- A store driver's stored releases, rollouts and holds (D-63, #2300).
+      ${STORE_DRIVER_RELEASES_DDL}
       -- The vertical + version registry (#31). A scope binds to a VERSION, so
       -- dev/staging/prod are the same vertical pinned differently, and a preview
       -- deployment is a version nothing has been promoted to yet.
@@ -1002,10 +1022,14 @@ export class SqliteScopeHost {
         migration_count   INTEGER,
         -- 1 once the SQL is out of manifest_json. NULL = stored before #1764, not yet backfilled.
         migrations_split  INTEGER,
+        -- 1 once migration_digest is the one derived from the stored migrations (#2339).
+        -- NULL = stored before, still the pushed digest; derived on its next read.
+        migration_digest_derived INTEGER,
         created_at        TEXT NOT NULL,
         UNIQUE (vertical_slug, version)
       );
       ${VERSION_MIGRATIONS_DDL}
+      ${VERTICAL_SCOPE_STORES_DDL}
       -- Channels (#31 step 2): a named pointer per vertical. Promotion moves it,
       -- and promotion is where the migration and permission diffs fire — the
       -- moment a change reaches anyone, rather than the moment it was typed.
@@ -1405,13 +1429,27 @@ export class SqliteScopeHost {
      * it inside its transaction onto an emptied directory, before loading any row.
      */
     buildDirectorySchema() {
+        // A directory built before the store driver rename keeps its rows under the old names (and one
+        // that ran pre-rename code again, a rollback, holds both names), and
+        // `applyDirectorySchema` would only create empty tables beside them.
+        const tables = this.directory.prepare(`SELECT name FROM sqlite_master WHERE type = 'table'`).all().map((t) => t.name);
+        const hasRows = (table) => this.directory.prepare(`SELECT 1 FROM "${table}" LIMIT 1`).get() !== undefined;
+        // Asked before the moves below, which drop a name with no rows.
+        const bothNames = legacyStoreDriverConflict(tables, hasRows);
+        if (bothNames)
+            console.error(bothNames);
+        for (const stmt of legacyStoreDriverRenames(tables, (table) => builtColumnsOf(this.directory, table), hasRows))
+            this.directory.exec(stmt);
         // #1764: `VERSION_MIGRATIONS_DDL` indexes these two columns, so a directory created
         // before them needs them before `applyDirectorySchema` reaches that statement.
         if (this.directory.prepare('PRAGMA table_info(vertical_versions)').all().length > 0) {
             this.ensureColumn(this.directory, 'vertical_versions', 'migration_count', 'migration_count INTEGER');
             this.ensureColumn(this.directory, 'vertical_versions', 'migrations_split', 'migrations_split INTEGER');
+            this.ensureColumn(this.directory, 'vertical_versions', 'migration_digest_derived', 'migration_digest_derived INTEGER');
         }
         this.applyDirectorySchema();
+        // #2322: a migration's declared moves and discards, on a table created before they were carried.
+        this.ensureColumn(this.directory, 'vertical_version_migrations', 'declarations', 'declarations TEXT');
     }
     /**
      * `applyDirectorySchema`, plus the backfill of the schedule switch's record (#1674) from
@@ -1673,6 +1711,7 @@ export class SqliteScopeHost {
         }
         // #1705: validated whole and kept only if it passes, so a refused module leaves nothing.
         this.crossVertical.register(manifest, registration.imports);
+        this.peerUnion = undefined; // #2263: the next check reads the new module set's declarations
         this.modules.set(manifest.id, {
             id: manifest.id,
             // The order the kernel writes once (#1677): authored, then search, then list indexes.
@@ -1707,6 +1746,13 @@ export class SqliteScopeHost {
                     `(${existing.read}/${existing.write}) vs (${gate.read}/${gate.write})`);
             }
             this.attachmentTargets.set(target.entityType, gate);
+            if (target.uploadLinks) {
+                const known = this.uploadLinkPolicies.get(target.entityType);
+                if (known && JSON.stringify(known) !== JSON.stringify(target.uploadLinks)) {
+                    throw new Error(`conflicting uploadLinks policies for attachment target '${target.entityType}'`);
+                }
+                this.uploadLinkPolicies.set(target.entityType, target.uploadLinks);
+            }
         }
         // WITHDRAWAL (K-17): suppress another module's default binding. Order
         // independent — a manifest may withdraw an operation whose module has not
@@ -2057,7 +2103,7 @@ export class SqliteScopeHost {
                     out.push(r);
             }
         };
-        return {
+        return this.wrapBlobStore({
             put: async (key, body, opts) => {
                 const p = resolveKey(key);
                 mkdirSync(dirname(p), { recursive: true });
@@ -2089,7 +2135,7 @@ export class SqliteScopeHost {
                 walk(root, '', out);
                 return out.filter((k) => k.startsWith(prefix)).sort();
             },
-        };
+        }, ref);
     }
     /** Resolve the blob store that carries a scope's attachments (#473): the platform-minted
      *  store for (tenant, the scope's vertical). Fails loudly when none was provisioned —
@@ -2124,6 +2170,100 @@ export class SqliteScopeHost {
         const store = this.attachmentStore(tenantId, scopeRow?.vertical ?? null);
         return this.buildAttachments(rt, asPrincipal(principal), store);
     }
+    /** The declared write key and link policy of an attachment target — what `ctx.attachments` mints against. */
+    uploadTargetOf(entityType) {
+        const gate = this.attachmentTargets.get(entityType);
+        if (!gate)
+            return undefined;
+        const uploadLinks = this.uploadLinkPolicies.get(entityType);
+        return uploadLinks ? { write: gate.write, uploadLinks } : { write: gate.write };
+    }
+    async inspectUploadLink(tenantId, scopeId, secret, target, idempotencyKey) {
+        const rt = await this.openActiveScope(tenantId, scopeId);
+        return rt.actor.enqueue(async () => (await inspectUploadLink({ sql: spineSql(rt.db), now: this.clock() }, secret, target, idempotencyKey)).view);
+    }
+    /**
+     * #2314: one orphan-sweep pass over a scope's attachment bytes (`sweepOrphanAttachments` in the
+     * kernel has the guards). Only an active PRIMARY scope of `tenantId` is judged: a fork or a
+     * preview holds another scope's rows, never this one's.
+     */
+    async sweepOrphanAttachments(tenantId, scopeId, request = {}) {
+        const row = this.directory
+            .prepare('SELECT vertical, kind, forked_from FROM scopes WHERE scope_id = ? AND tenant_id = ?')
+            .get(scopeId, tenantId);
+        if (row && !isPrimaryScopeRow(row)) {
+            throw substratError('conflict', `refused: scope ${scopeId} is a copy, and a copy may not judge orphan attachments`);
+        }
+        const copies = this.directory
+            .prepare(`SELECT script_ref AS scriptRef, state FROM scope_script_copies
+          WHERE tenant_id = ? AND scope_id = ? AND state NOT IN (${SETTLED_COPY_STATES.map(() => '?').join(', ')})`)
+            .all(tenantId, scopeId, ...SETTLED_COPY_STATES);
+        const unsettled = unsettledCopyRefusal(scopeId, copies);
+        if (unsettled)
+            throw unsettled;
+        // Only an active scope: an archived or reaped one is not this pass's to judge.
+        const rt = await this.openActiveScope(tenantId, scopeId);
+        // A scope with no blob store holds no bytes: answered as that, marked, after every guard above,
+        // so the platform's pass tells it from a failure and from a store that held nothing.
+        const stores = row?.vertical
+            ? this.directory.prepare('SELECT 1 FROM blob_stores WHERE tenant_id = ? AND vertical = ? LIMIT 1').get(tenantId, row.vertical)
+            : undefined;
+        if (!stores) {
+            // A scope that holds an attachment row does keep files: its missing store is a misconfiguration.
+            const holds = await rt.actor.enqueue(() => {
+                const table = rt.db.prepare(`SELECT 1 FROM sqlite_master WHERE type = 'table' AND name = '_substrat_attachments'`).get();
+                return table !== undefined && rt.db.prepare('SELECT 1 FROM _substrat_attachments LIMIT 1').get() !== undefined;
+            });
+            if (holds)
+                throw missingAttachmentStore(tenantId, scopeId);
+            return { listed: 0, candidates: 0, orphans: 0, deleted: 0, keys: [], dryRun: request.dryRun === true, bucket: 'none' };
+        }
+        const store = this.attachmentStore(tenantId, row?.vertical ?? null);
+        return sweepOrphanAttachments(store, scopeId, {
+            rowless: async (ids) => rt.actor.enqueue(() => rowlessAttachmentIds(spineSql(rt.db), ids)),
+            condemn: async (ids, now) => rt.actor.enqueue(() => rt.db.transaction(() => condemnOrphanAttachments(spineSql(rt.db), ids, now))()),
+        }, {
+            // The host's own clock, never a caller's: no request can step past the floor or the fence.
+            now: this.clock(),
+            ...(request.dryRun ? { dryRun: true } : {}),
+            ...(request.limit !== undefined ? { limit: request.limit } : {}),
+        });
+    }
+    /**
+     * #2314: the orphan sweep's restore fence for a scope whose rows are about to be replaced. A
+     * scope whose vertical has no blob store has no bytes, so nothing is fenced; a fence that cannot
+     * be written throws, and the caller refuses the replacement.
+     */
+    fenceOrphanSweep(tenantId, scopeId, vertical) {
+        const held = vertical
+            ? this.directory.prepare('SELECT 1 FROM blob_stores WHERE tenant_id = ? AND vertical = ? LIMIT 1').get(tenantId, vertical)
+            : undefined;
+        if (!held)
+            return Promise.resolve();
+        return fenceAttachmentSweep(this.attachmentStore(tenantId, vertical), scopeId, this.clock());
+    }
+    async redeemUploadLink(tenantId, scopeId, secret, input) {
+        const rt = await this.openActiveScope(tenantId, scopeId);
+        // The target first (the kernel judges it before the state), so a wrong path never reads as
+        // gone; a replay (#2315) is answered from the inspection and never reaches the write.
+        const inspect = () => rt.actor.enqueue(() => inspectUploadLink({ sql: spineSql(rt.db), now: this.clock() }, secret, input.entity, input.idempotencyKey));
+        return redeemOrReplayUploadLink(inspect, input, async ({ view, mintedBy }) => {
+            // The write is made AS the minter: the same gates `attachments()` puts in front of a person.
+            await this.getScope(mintedBy, tenantId, scopeId);
+            const scopeRow = this.directory
+                .prepare('SELECT vertical FROM scopes WHERE scope_id = ?')
+                .get(scopeId);
+            const files = this.buildAttachments(rt, asPrincipal(mintedBy), this.attachmentStore(tenantId, scopeRow?.vertical ?? null), { uploadLink: { secret, idempotencyKey: input.idempotencyKey } });
+            return files.upload({
+                entity: view.entity,
+                filename: view.filename ?? input.filename,
+                // Recorded as it is judged: the essence, never a parameter or a stray space.
+                contentType: normalizeUploadMediaType(input.contentType),
+                visibility: view.visibility,
+                body: input.body,
+            });
+        });
+    }
     async getSystemAttachments(moduleId, tenantId, scopeId) {
         // The same registered-module and lifecycle gate as a system invoke. The
         // attachment surface checks the target's read key as system:<moduleId>.
@@ -2188,8 +2328,17 @@ export class SqliteScopeHost {
             }
             // #1525: null, for the reason the denial two lines up records null — this task
             // is the attachment RPC's own and no invoke set an id on the runtime.
-            await this.dispatch(rt, null);
-            await this.dispatchExecutors(rt, null);
+            // The write has COMMITTED, so a failed drain must not reach the caller as a refusal:
+            // `upload` deletes the bytes on a refusal, which would leave this row without them
+            // (and a redeemed link spent) (#2311). An undelivered event has no delivery row, so
+            // the next drain in this scope delivers it.
+            try {
+                await this.dispatch(rt, null);
+                await this.dispatchExecutors(rt, null);
+            }
+            catch (err) {
+                console.error('substrat: consumer drain failed after an attachment committed', err);
+            }
             return result;
         });
         /**
@@ -2248,13 +2397,15 @@ export class SqliteScopeHost {
                     createdBy: creator.id,
                     createdAt: new Date().toISOString(),
                 });
-                // Bytes first, row second: a crash between the two leaves an orphaned object
-                // (harmless, GC-able via list), never a row without bytes. A refused check
-                // compensates the object away below.
+                // Bytes first, row second: a crash between the two leaves an orphaned object that no
+                // row points at (#2314). A refused check compensates the object away below; a drain
+                // fault after the commit is not a refusal (`serialized` keeps it from becoming one).
                 await store.put(key, input.body, { contentType: input.contentType });
                 try {
                     return await guarded('attachments.upload', async (ctx) => {
                         assertAllowed(await ctx.check(gate.write, input.entity));
+                        // #2314: an id the orphan sweep condemned takes no row, in this same transaction.
+                        refuseCondemnedAttachment(spineSql(rt.db), record.id);
                         rt.db
                             .prepare(`INSERT INTO _substrat_attachments
                    (id, entity_type, entity_id, filename, content_type, size, sha256,
@@ -2271,6 +2422,11 @@ export class SqliteScopeHost {
                         // #1575: queue its text extraction in the same transaction — a `pending` row
                         // and a job run. Nothing is extracted here, so nothing here can fail the upload.
                         enqueueAttachmentText(spineSql(rt.db), record.id, ulid(), this.clock());
+                        // An upload-link redemption spends its link HERE, in the same transaction as the
+                        // row it produced: a refusal anywhere above or below rolls the spend back.
+                        if (opts.uploadLink !== undefined) {
+                            await redeemUploadLinkInTransaction({ sql: spineSql(rt.db), now: this.clock(), emit: (event) => kernelEmit(ctx, event) }, opts.uploadLink.secret, record, opts.uploadLink.idempotencyKey);
+                        }
                         return record;
                     });
                 }
@@ -2409,6 +2565,16 @@ export class SqliteScopeHost {
             // rows are gone and the new ones are in. It also covers what a topological sort
             // cannot express: FK cycles, and self-referencing rows within one table.
             db.pragma('defer_foreign_keys = ON');
+            // A dump written before indexes were excluded may still carry them; skip those
+            // too rather than failing a restore over data that is about to be recomputed.
+            // Matched without case, as SQLite resolves a table name (#1883 review).
+            const replayable = dumped.filter((t) => !isSearchIndexTable(t.name.toLowerCase()));
+            // A Durable Object's dump carries spine tables this adapter keeps in its directory, or does
+            // not keep at all; they are skipped by name, and any other unknown spine table is refused.
+            const loadable = replayable.filter((t) => !DO_SCOPE_ONLY_SPINE_TABLES.has(t.name.toLowerCase()));
+            // #2314: a row for an id the orphan sweep condemned here is refused, as the insert refuses it.
+            // Judged on `loadable`, the very tables whose rows the replay below inserts, before any drop.
+            refuseCondemnedInDump(spineSql(db), loadable);
             // Drop the current schema: a vertical's tables are rebuilt from the dump's DDL, the
             // spine from KERNEL_DDL (below). Only real tables (never `sqlite_*` internals, which
             // are auto-managed and un-droppable).
@@ -2423,10 +2589,6 @@ export class SqliteScopeHost {
                     continue;
                 db.exec(`DROP TABLE IF EXISTS "${name}"`);
             }
-            // A dump written before indexes were excluded may still carry them; skip those
-            // too rather than failing a restore over data that is about to be recomputed.
-            // Matched without case, as SQLite resolves a table name (#1883 review).
-            const replayable = dumped.filter((t) => !isSearchIndexTable(t.name.toLowerCase()));
             // The dump is untrusted input (#1143): its names reach SQL as identifiers, and
             // `db.exec` would run every statement its `ddl` contains, not just the CREATE
             // TABLE. Judged as a whole before any of it executes — a check interleaved with
@@ -2438,9 +2600,6 @@ export class SqliteScopeHost {
             // contributes only rows, by column name (`dumpRowsInsert`). Otherwise a dump could
             // declare a column the checker compares on as COLLATE NOCASE. The column pass follows,
             // for the one outbox index KERNEL_DDL leaves to it.
-            // A Durable Object's dump carries spine tables this adapter keeps in its directory, or does
-            // not keep at all; they are skipped by name, and any other unknown spine table is refused.
-            const loadable = replayable.filter((t) => !DO_SCOPE_ONLY_SPINE_TABLES.has(t.name.toLowerCase()));
             // Comment-blanked (#2068), as the Durable Object replays it: the dump's DDL is
             // `sqlite_master.sql` verbatim, and `prepare` still compiles exactly one statement.
             for (const t of loadable)
@@ -2531,6 +2690,8 @@ export class SqliteScopeHost {
         if (!existing)
             throw substratError('not_found', `unknown scope ${scopeId} in tenant ${tenantId}`);
         this.refuseUnusableScopeStores(dump.stores, existing.vertical);
+        // #2314: the load replaces the scope's rows, so the orphan sweep is fenced first.
+        await this.fenceOrphanSweep(tenantId, scopeId, existing.vertical ?? null);
         // #1742: a dump from before a switch was pulled brings the module's grants back live, so
         // the directory's recorded-off modules go back off in the load's own turn, as a
         // provision's seat does — no schedule pass can run in between.
@@ -2733,6 +2894,13 @@ export class SqliteScopeHost {
             return undefined;
         return vertical;
     }
+    /** The erasure claim (`SUBJECT_ERASURE_CLAIM_SQL`); a scope that moved refuses with the key kept. */
+    claimSubjectErasure(tenantId, scopeId, fence) {
+        const claimed = this.directory.prepare(SUBJECT_ERASURE_CLAIM_SQL).run(...subjectErasureClaimParams(tenantId, scopeId, fence));
+        if (claimed.changes === 0) {
+            throw substratError('precondition_failed', 'scope route or copy inventory changed during subject erasure; retry after it settles');
+        }
+    }
     /**
      * `substrat.erase` on each declared binding. A store error throws, so the caller
      * can leave the subject key untouched. Fail closed (#2242): an empty answer means
@@ -2757,7 +2925,7 @@ export class SqliteScopeHost {
     }
     /**
      * A dump's stores this host cannot load are refused before any write (#2211, L8): a
-     * binding that is not bound, a store with no kind or a kind other than the bound runner's,
+     * binding that is not bound, a store with no driver or a driver other than the bound runner's,
      * any store at all for a destination with no vertical (no store object can be named for
      * it, so loading would drop them), or a destination on a vertical other than the one this
      * host is pinned to.
@@ -2777,11 +2945,11 @@ export class SqliteScopeHost {
             if (!runner) {
                 throw substratError('not_found', `dump names scope store '${store.binding}', which is not bound`);
             }
-            if (!store.kind) {
-                throw substratError('validation_failed', `dump's scope store '${store.binding}' names no kind`);
+            if (!store.driver) {
+                throw substratError('validation_failed', `dump's scope store '${store.binding}' names no driver`);
             }
-            if (store.kind !== runner.kind) {
-                throw substratError('conflict', `dump's scope store '${store.binding}' is kind '${store.kind}', and this host binds kind '${runner.kind}'`);
+            if (store.driver !== runner.driver) {
+                throw substratError('conflict', `dump's scope store '${store.binding}' is driver '${store.driver}', and this host binds driver '${runner.driver}'`);
             }
         }
     }
@@ -2798,7 +2966,7 @@ export class SqliteScopeHost {
             if (!runner)
                 throw substratError('not_found', `no scope store is bound for '${binding}'`);
             const exported = await this.invokeReservedStore({ tenantId, vertical, scopeId, binding }, 'substrat.export');
-            stores.push({ binding, kind: runner.kind, tables: exported.tables });
+            stores.push({ binding, driver: runner.driver, tables: exported.tables });
         }
         return stores;
     }
@@ -3385,10 +3553,15 @@ export class SqliteScopeHost {
         const store = this.attachmentStore(tenantId, scopeRow?.vertical ?? null);
         return this.buildAttachments(rt, { kind: 'capability-session', hash }, store);
     }
-    /** Every registered module's `peers`, as one declaration per peer vertical (#1706). */
+    /**
+     * Every registered module's `peers`, as one declaration per peer vertical (#1706). Built once
+     * per registered module set and dropped by `registerModule` (#2263): the checker reads it on
+     * every check, so it must be a lookup, never a rebuild.
+     */
     peerDeclarations() {
-        return collectPeers(this.modules.values());
+        return (this.peerUnion ??= collectPeers(this.modules.values()));
     }
+    peerUnion;
     /**
      * The peer door (#1706) — mirror of the connection, system and capability doors. The caller is
      * the local broker's word (the platform's, on the pure host); the pair and lifecycle gate run
@@ -3762,7 +3935,8 @@ export class SqliteScopeHost {
             try {
                 if (schedule.purge) {
                     // #119: a purge horizon's schedule runs its operation once per due entity, never once.
-                    const pass = await this.runPurgeSweep(moduleId, tenantId, scopeId, schedule.operation);
+                    // #2192: under the run's own id, so the purges and their deliveries join this run's line.
+                    const pass = await this.runPurgeSweep(moduleId, tenantId, scopeId, schedule.operation, invocationId);
                     stillDue = purgeStillDue(pass);
                     const outcome = purgeReportOf(schedule.operation, schedule.purge.entityType, pass);
                     report.errors.push(...outcome.errors);
@@ -3833,7 +4007,9 @@ export class SqliteScopeHost {
      * through a purge stub (`openSystemScope`) that never leaves this method, each in its own
      * transaction and under the cutoff the host re-checks inside it (`refuseTrashedTarget`).
      */
-    async runPurgeSweep(moduleId, tenantId, scopeId, operation) {
+    async runPurgeSweep(moduleId, tenantId, scopeId, operation, 
+    /** #2192: the schedule run this pass belongs to; every purge in it runs under that id. */
+    runInvocationId) {
         const entityType = this.modules
             .get(moduleId)
             ?.schedules.find((s) => s.operation === operation && s.purge)?.purge?.entityType;
@@ -3860,7 +4036,7 @@ export class SqliteScopeHost {
             return heldPurgePass(due.held);
         const stub = await this.openSystemScope(moduleId, tenantId, scopeId, true);
         return runPurgePass(operation, due, async (entityId) => {
-            await stub.invoke(operation, { [due.idFrom]: entityId }, { invocationId: ulid() });
+            await stub.invoke(operation, { [due.idFrom]: entityId }, { invocationId: runInvocationId });
         }, (write) => rt.actor.turn(() => write(spineSql(rt.db))));
     }
     /**
@@ -5460,10 +5636,15 @@ export class SqliteScopeHost {
             calls: callsOfManifestJson(r.manifest_json),
             createdAt: r.created_at,
         });
-        const readVersion = (id) => {
-            const r = this.directory
-                .prepare('SELECT * FROM vertical_versions WHERE id = ?')
-                .get(id);
+        // #2339: a version stored before the server derived migration digests is derived on its
+        // first read, so no gate here ever compares the digest its push sent.
+        const readVersion = async (id) => {
+            const read = () => this.directory.prepare('SELECT * FROM vertical_versions WHERE id = ?').get(id);
+            let r = read();
+            if (r && r.migration_digest_derived === null) {
+                await deriveVersionMigrationDigest(switchSqlOf(this.directory), id);
+                r = read();
+            }
             return r ? mapVersion(r) : undefined;
         };
         const mapOrg = (r) => orgSchema.parse({
@@ -5529,8 +5710,8 @@ export class SqliteScopeHost {
         });
         // The (version, scope) pair a bind and its impact read both start from, and the refusals
         // that come before any export-break question, in the order the bind makes them (#1756).
-        const bindTarget = (tenantId, scopeId, versionId) => {
-            const v = readVersion(versionId);
+        const bindTarget = async (tenantId, scopeId, versionId) => {
+            const v = await readVersion(versionId);
             if (!v)
                 throw substratError('not_found', `unknown version ${versionId}`);
             const scope = this.directory.prepare('SELECT * FROM scopes WHERE scope_id = ?').get(scopeId);
@@ -5911,7 +6092,7 @@ export class SqliteScopeHost {
                 throw substratError('not_found', `unknown scope for tenant: (${tenantId}, ${scopeId})`);
             }
             const rt = this.runtime(tenantId, scopeId);
-            const states = await rt.actor.turn(() => peerGrantsStatus(switchSqlOf(rt.db), new Date().toISOString()));
+            const states = await rt.actor.turn(() => peerGrantsStatus(switchSqlOf(rt.db), new Date().toISOString(), this.peerDeclarations()));
             const offPeers = new Set(states.filter((p) => p.calls === 'off').map((p) => p.vertical));
             const explanations = offPeers.size > 0 ? lastSwitchedOffBy(tenantId, scopeId, 'revokeFromPeer', 'vertical', offPeers) : new Map();
             const result = states.map((p) => ({
@@ -6331,14 +6512,16 @@ export class SqliteScopeHost {
                 }
                 this.recordAdmin(actor, 'setHostnameIssuance', { tenantId: row.tenant_id, scopeId: row.scope_id }, { status: row.status }, { status: fields.status, note: fields.note ?? null });
             },
-            unbindHostname: async (actor, raw) => {
+            unbindHostname: async (actor, raw, owner) => {
                 const hostname = raw.toLowerCase(); // DNS is case-insensitive; the map is normalized
+                // One statement: the row it removes is the row it audits, and an owner is judged by the
+                // delete itself, so a name rebound to another scope in between is left alone (#2285).
                 const row = this.directory
-                    .prepare('SELECT tenant_id, scope_id, status FROM hostnames WHERE hostname = ?')
-                    .get(hostname);
+                    .prepare(`DELETE FROM hostnames WHERE hostname = ?${owner ? ' AND tenant_id = ? AND scope_id = ?' : ''}
+            RETURNING tenant_id, scope_id, status`)
+                    .get(hostname, ...(owner ? [owner.tenantId, owner.scopeId] : []));
                 if (!row)
                     return; // idempotent, and a no-op is not audited
-                this.directory.prepare('DELETE FROM hostnames WHERE hostname = ?').run(hostname);
                 this.recordAdmin(actor, 'unbindHostname', { tenantId: row.tenant_id, scopeId: row.scope_id }, { hostname, status: row.status }, null);
             },
             listHostnames: async (actor, filter) => {
@@ -6565,34 +6748,54 @@ export class SqliteScopeHost {
                 // The SQL migrations are stored apart from the manifest (#1764), so no read of the
                 // version but the promote review's carries them.
                 const split = splitManifestMigrations(manifestJson ?? null, 'push');
+                // #2339: the digest a promote compares is the one derived from what is stored, never the pushed one.
+                const migrationDigest = await publishedMigrationDigest({
+                    id: audited.id, migrationDigest: audited.migrationDigest, manifestJson: manifestJson ?? null, migrations: split.migrations,
+                });
                 this.directory.transaction(() => {
                     this.directory
                         .prepare(`INSERT INTO vertical_versions
                  (id, vertical_slug, version, manifest_digest, permission_digest,
                   migration_digest, deployment_ref, admission, admission_note, manifest_json,
-                  origin_json, migration_count, migrations_split, created_at)
-               VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, 1, ?)`)
-                        .run(audited.id, audited.verticalSlug, audited.version, audited.manifestDigest, audited.permissionDigest, audited.migrationDigest, audited.deploymentRef, selfAdmits ? 'admitted' : 'pending', selfAdmits ? AUTO_ADMISSION_NOTE : null, split.manifestJson, origin ? JSON.stringify(origin) : null, split.migrations?.length ?? null, new Date().toISOString());
+                  origin_json, migration_count, migrations_split, migration_digest_derived, created_at)
+               VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, 1, 1, ?)`)
+                        .run(audited.id, audited.verticalSlug, audited.version, audited.manifestDigest, audited.permissionDigest, migrationDigest, audited.deploymentRef, selfAdmits ? 'admitted' : 'pending', selfAdmits ? AUTO_ADMISSION_NOTE : null, split.manifestJson, origin ? JSON.stringify(origin) : null, split.migrations?.length ?? null, new Date().toISOString());
                     writeVersionMigrations(switchSqlOf(this.directory), audited.id, split.migrations);
+                    // #2286: the version's scope-store bindings, refusing one moved to another driver, in the insert's transaction.
+                    indexVersionScopeStores(switchSqlOf(this.directory), audited.verticalSlug, audited.id, split.manifestJson);
                 })();
                 this.recordAdmin(actor, 'publishVersion', { tenantId: null }, null, {
                     ...audited,
+                    // The digest the registry holds, which differs from the pushed one only for an unheld version.
+                    migrationDigest,
                     ...(origin ? { origin } : {}),
                     admission: selfAdmits ? 'admitted' : 'pending',
                 });
             },
+            verticalScopeStores: async (actor, verticalSlug) => {
+                // One transaction: versions not indexed yet are indexed by the read (#2286).
+                const stores = this.directory.transaction(() => verticalScopeStoresOf(switchSqlOf(this.directory), verticalSlug))();
+                this.recordAccess(actor, 'verticalScopeStores', {}, { verticalSlug }, stores.length);
+                return stores;
+            },
             listVersions: async (actor, verticalSlug, page) => {
                 const where = ['vertical_slug = ?'];
                 const params = [verticalSlug];
                 const tail = keysetTail(where, params, 'id', page);
-                const rows = this.directory
-                    .prepare(`SELECT * FROM vertical_versions WHERE ${where.join(' AND ')}${tail}`)
-                    .all(...params);
+                const sql = `SELECT * FROM vertical_versions WHERE ${where.join(' AND ')}${tail}`;
+                let rows = this.directory.prepare(sql).all(...params);
+                // #2339: a page holding versions whose digest is still the pushed one derives them first.
+                const underived = rows.filter((r) => r.migration_digest_derived === null);
+                if (underived.length > 0) {
+                    for (const r of underived)
+                        await deriveVersionMigrationDigest(switchSqlOf(this.directory), r.id);
+                    rows = this.directory.prepare(sql).all(...params);
+                }
                 this.recordAccess(actor, 'listVersions', {}, { verticalSlug }, rows.length);
                 return rows.map(mapVersion);
             },
             getVersion: async (actor, versionId, verticalSlug) => {
-                const v = readVersion(versionId);
+                const v = await readVersion(versionId);
                 // A version of another vertical reads as absent when the caller named one.
                 const hit = v && (verticalSlug === undefined || v.verticalSlug === verticalSlug) ? v : undefined;
                 this.recordAccess(actor, 'getVersion', {}, { versionId, verticalSlug }, hit ? 1 : 0);
@@ -6609,7 +6812,7 @@ export class SqliteScopeHost {
                     const prod = this.directory
                         .prepare("SELECT version_id FROM vertical_channels WHERE vertical_slug = ? AND channel = 'prod'")
                         .get(slug);
-                    const prodVersion = prod ? readVersion(prod.version_id) : undefined;
+                    const prodVersion = prod ? await readVersion(prod.version_id) : undefined;
                     if (prodVersion?.admissionNote === AUTO_ADMISSION_NOTE) {
                         throw substratError('conflict', `vertical '${slug}' prod version ${prodVersion.id} is auto-admitted (private self-serve) — ` +
                             `a staff admit must vouch for it before listing`);
@@ -6684,12 +6887,13 @@ export class SqliteScopeHost {
                     .prepare(`DELETE FROM vertical_version_migrations
               WHERE version_id IN (SELECT id FROM vertical_versions WHERE vertical_slug = ?)`)
                     .run(slug);
+                forgetVerticalScopeStores(switchSqlOf(this.directory), slug);
                 this.directory.prepare('DELETE FROM vertical_versions WHERE vertical_slug = ?').run(slug);
                 this.directory.prepare('DELETE FROM verticals WHERE slug = ?').run(slug);
                 this.recordAdmin(actor, 'deleteVertical', { tenantId: null }, { slug, source: existing.source, ownerTenant: existing.ownerTenant }, null);
             },
             admitVersion: async (actor, versionId) => {
-                const v = readVersion(versionId);
+                const v = await readVersion(versionId);
                 if (!v)
                     throw substratError('not_found', `unknown version ${versionId}`);
                 if (v.admission === 'admitted') {
@@ -6717,7 +6921,7 @@ export class SqliteScopeHost {
                 });
             },
             rejectVersion: async (actor, versionId, note) => {
-                const v = readVersion(versionId);
+                const v = await readVersion(versionId);
                 if (!v)
                     throw substratError('not_found', `unknown version ${versionId}`);
                 if (v.admission === 'admitted') {
@@ -6734,7 +6938,7 @@ export class SqliteScopeHost {
                 });
             },
             promotionImpact: async (actor, verticalSlug, channel, versionId) => {
-                const incoming = readVersion(versionId);
+                const incoming = await readVersion(versionId);
                 if (!incoming || incoming.verticalSlug !== verticalSlug) {
                     throw substratError('not_found', `unknown version ${versionId} for vertical '${verticalSlug}'`);
                 }
@@ -6746,7 +6950,7 @@ export class SqliteScopeHost {
                 return breaks;
             },
             promoteVersion: async (actor, verticalSlug, channel, versionId, acknowledge) => {
-                const incoming = readVersion(versionId);
+                const incoming = await readVersion(versionId);
                 if (!incoming)
                     throw substratError('not_found', `unknown version ${versionId}`);
                 if (incoming.verticalSlug !== verticalSlug) {
@@ -6758,7 +6962,7 @@ export class SqliteScopeHost {
                 const current = this.directory
                     .prepare('SELECT version_id FROM vertical_channels WHERE vertical_slug = ? AND channel = ?')
                     .get(verticalSlug, channel);
-                const outgoing = current ? readVersion(current.version_id) : undefined;
+                const outgoing = current ? await readVersion(current.version_id) : undefined;
                 const ack = promotionAcknowledgement.parse(acknowledge ?? {});
                 // The owning tenant's live scopes a PRIVATE prod promote re-points — below for an embedded
                 // vertical, after the in-place serve for a dispatch-backed one (#321) — read before
@@ -6781,6 +6985,18 @@ export class SqliteScopeHost {
                     served?.versionId,
                     ...owned.map((s) => runningVersionOf(mapScope(s), served)),
                 ], versionId, served || owned.length > 0 ? this.provisionedVersionsOf(verticalSlug, served, owned.length > 0 ? owning.ownerTenant : null) : []);
+                // #2333: the acknowledgements answer the review they were given against, or none at all.
+                const reviewed = (v) => ({
+                    ...v,
+                    migrations: versionMigrationsOf(switchSqlOf(this.directory), v.id)?.migrations ?? null,
+                });
+                await assertPromoteReviewCurrent({
+                    ack,
+                    channel,
+                    baseId: outgoing?.id ?? null,
+                    migrationsChange: outgoing !== undefined && outgoing.migrationDigest !== incoming.migrationDigest,
+                    read: async () => ({ base: outgoing ? reviewed(outgoing) : null, incoming: reviewed(incoming) }),
+                });
                 // §4's two checkpoints, fired where the blast radius is. A FIRST promotion
                 // has nothing to diff against, so there is nothing to acknowledge — the
                 // gate is about change, not about existence.
@@ -6790,8 +7006,7 @@ export class SqliteScopeHost {
                             `${incoming.permissionDigest}) — acknowledge it explicitly to promote`);
                     }
                     if (outgoing.migrationDigest !== incoming.migrationDigest && !ack.migrationChange) {
-                        throw substratError('conflict', `promotion changes migrations (${outgoing.migrationDigest} → ` +
-                            `${incoming.migrationDigest}) — acknowledge it explicitly to promote`);
+                        throw substratError('conflict', migrationChangeRefusal(outgoing.migrationDigest, incoming.migrationDigest));
                     }
                     // #1705 PR 3: an export an installed consumer imports, dropped or re-versioned.
                     if (!ack.exportBreak) {
@@ -6801,18 +7016,32 @@ export class SqliteScopeHost {
                     }
                 }
                 const promotedAt = new Date().toISOString();
-                this.directory
-                    .prepare(`INSERT INTO vertical_channels (vertical_slug, channel, version_id, updated_at)
-             VALUES (?, ?, ?, ?)
-             ON CONFLICT (vertical_slug, channel) DO UPDATE SET version_id = ?, updated_at = ?`)
-                    .run(verticalSlug, channel, versionId, promotedAt, versionId, promotedAt);
-                // The timeline row: what makes rollback a choice among recorded moments, and
-                // `at` the PITR anchor a data rollback would rewind to.
-                this.directory
-                    .prepare(`INSERT INTO vertical_channel_history
-               (id, vertical_slug, channel, version_id, from_version_id, actor, at)
-             VALUES (?, ?, ?, ?, ?, ?, ?)`)
-                    .run(ulid(), verticalSlug, channel, versionId, outgoing?.id ?? null, actor, promotedAt);
+                // #2333: a compare-and-set. Every gate above — the review binding, the digest checkpoints,
+                // the export breaks — was judged against `outgoing`, across awaits another promote can run
+                // in. So the pointer moves only if it still names `outgoing`, read and written in one
+                // transaction; the promote that lost the race is refused as stale and writes nothing.
+                const moved = this.directory.transaction(() => {
+                    const now = this.directory
+                        .prepare('SELECT version_id FROM vertical_channels WHERE vertical_slug = ? AND channel = ?')
+                        .get(verticalSlug, channel);
+                    if ((now?.version_id ?? null) !== (outgoing?.id ?? null))
+                        return false;
+                    this.directory
+                        .prepare(`INSERT INTO vertical_channels (vertical_slug, channel, version_id, updated_at)
+               VALUES (?, ?, ?, ?)
+               ON CONFLICT (vertical_slug, channel) DO UPDATE SET version_id = ?, updated_at = ?`)
+                        .run(verticalSlug, channel, versionId, promotedAt, versionId, promotedAt);
+                    // The timeline row: what makes rollback a choice among recorded moments, and
+                    // `at` the PITR anchor a data rollback would rewind to.
+                    this.directory
+                        .prepare(`INSERT INTO vertical_channel_history
+                 (id, vertical_slug, channel, version_id, from_version_id, actor, at)
+               VALUES (?, ?, ?, ?, ?, ?, ?)`)
+                        .run(ulid(), verticalSlug, channel, versionId, outgoing?.id ?? null, actor, promotedAt);
+                    return true;
+                })();
+                if (!moved)
+                    throw promoteRaceRefusal(channel);
                 // For a PRIVATE vertical, prod IS what the owner's apps run: re-point the
                 // owning tenant's live scopes in the same act, so merge-to-main (push +
                 // promote) is a complete deploy and a rollback promote reaches the running
@@ -6832,7 +7061,7 @@ export class SqliteScopeHost {
                 for (const s of incoming.deploymentRef ? [] : owned) {
                     if (s.vertical_version_id === versionId)
                         continue;
-                    const prev = s.vertical_version_id ? readVersion(s.vertical_version_id) : undefined;
+                    const prev = s.vertical_version_id ? await readVersion(s.vertical_version_id) : undefined;
                     if (prev && prev.migrationDigest !== incoming.migrationDigest) {
                         await this.snapshotScope(actor, s.tenant_id, s.scope_id);
                     }
@@ -6894,7 +7123,7 @@ export class SqliteScopeHost {
                 }));
             },
             bindingImpact: async (actor, tenantId, scopeId, versionId, opts) => {
-                const { v, scope } = bindTarget(tenantId, scopeId, versionId);
+                const { v, scope } = await bindTarget(tenantId, scopeId, versionId);
                 // #2178: a move no acknowledgement passes is refused here too, so a caller asking first
                 // (an adopt, an Update) stops before anything is copied.
                 this.assertBindingShapesKept(mapScope(scope), versionId, opts?.servingRef);
@@ -6903,22 +7132,30 @@ export class SqliteScopeHost {
                 return breaks;
             },
             bindScopeVersion: async (actor, tenantId, scopeId, versionId, opts) => {
-                const { v, scope } = bindTarget(tenantId, scopeId, versionId);
-                if (opts?.expectedVersionId !== undefined && scope.vertical_version_id !== opts.expectedVersionId) {
-                    throw substratError('precondition_failed', 'scope binding changed; reload the scope and retry');
-                }
+                const { v, scope } = await bindTarget(tenantId, scopeId, versionId);
+                // #2347: a rebind judged against both lineages loses its race as stale, so its client reads
+                // the review again; any other conditional bind keeps the refusal it always had.
+                const lost = () => opts?.expectedServing
+                    ? rebindRaceRefusal(opts.expectedServing.vertical)
+                    : substratError('precondition_failed', 'scope binding changed; reload the scope and retry');
+                if (opts?.expectedVersionId !== undefined && scope.vertical_version_id !== opts.expectedVersionId)
+                    throw lost();
+                if (opts?.expectedServing && !this.servesNow(opts.expectedServing))
+                    throw lost();
                 const epoch = this.directory.prepare('SELECT COALESCE(erasure_epoch, 0) AS erasure_epoch FROM scopes WHERE tenant_id = ? AND scope_id = ?')
                     .get(tenantId, scopeId);
                 if (opts?.expectedErasureEpoch !== undefined && epoch?.erasure_epoch !== opts.expectedErasureEpoch) {
                     throw substratError('precondition_failed', 'scope erasure changed; reload the scope and retry');
                 }
                 const ack = bindAcknowledgement.parse(opts?.acknowledge ?? {});
+                // #2347: a route moving in the same write is judged with it, as `bindingImpact` is.
+                const servingRef = opts?.servingRef;
                 // #2178 first: no acknowledgement passes it, so none should be asked for ahead of it.
-                this.assertBindingShapesKept(mapScope(scope), versionId);
+                this.assertBindingShapesKept(mapScope(scope), versionId, servingRef);
                 // #1756: an export an app in this tenant imports, dropped or re-versioned by what this
                 // scope would run. Before the snapshot, so a refused bind leaves nothing behind.
                 if (!ack.exportBreak) {
-                    const breaks = await this.bindBreaks(actor, mapScope(scope), v);
+                    const breaks = await this.bindBreaks(actor, mapScope(scope), v, servingRef);
                     if (breaks.length > 0)
                         throw substratError('precondition_failed', bindExportBreakRefusal(breaks));
                 }
@@ -6926,19 +7163,29 @@ export class SqliteScopeHost {
                 // crosses a migration boundary. Gated on a real digest change — a code-only
                 // rebind snapshots nothing — and on the caller opting in (until GC ships).
                 if (opts?.snapshot && scope.vertical_version_id) {
-                    const outgoing = readVersion(scope.vertical_version_id);
+                    const outgoing = await readVersion(scope.vertical_version_id);
                     if (outgoing && outgoing.migrationDigest !== v.migrationDigest) {
                         await this.snapshotScope(actor, tenantId, scopeId);
                     }
                 }
-                if (!this.moveScopeRow('vertical_version_id = ?, vertical = ?', [versionId, v.verticalSlug], tenantId, scopeId, opts)) {
-                    throw substratError('precondition_failed', 'scope binding changed; reload the scope and retry');
-                }
-                this.recordAdmin(actor, 'bindScopeVersion', { tenantId, scopeId }, null, {
+                const moved = servingRef === undefined
+                    ? this.moveScopeRow('vertical_version_id = ?, vertical = ?', [versionId, v.verticalSlug], tenantId, scopeId, opts)
+                    : this.moveScopeRow('vertical_version_id = ?, vertical = ?, serving_ref = ?', [versionId, v.verticalSlug, servingRef], tenantId, scopeId, opts);
+                if (!moved) {
+                    // The erasure and copy-move conditions keep their own refusal: only a moved binding or a
+                    // moved serving version is the race a rebind's review answers.
+                    const now = this.directory.prepare('SELECT vertical_version_id FROM scopes WHERE scope_id = ?').get(scopeId);
+                    const raced = (opts?.expectedVersionId !== undefined && now?.vertical_version_id !== opts.expectedVersionId)
+                        || (opts?.expectedServing !== undefined && !this.servesNow(opts.expectedServing));
+                    throw raced ? lost() : substratError('precondition_failed', 'scope binding changed; reload the scope and retry');
+                }
+                this.recordAdmin(actor, 'bindScopeVersion', { tenantId, scopeId }, servingRef === undefined ? null : { servingRef: scope.serving_ref }, {
                     versionId,
                     vertical: v.verticalSlug,
                     version: v.version,
+                    ...(servingRef !== undefined ? { servingRef } : {}),
                     ...(opts?.expectedVersionId !== undefined ? { expectedVersionId: opts.expectedVersionId } : {}),
+                    ...(opts?.expectedServing ? { expectedServing: opts.expectedServing } : {}),
                     ...(ack.exportBreak ? { acknowledged: ack } : {}),
                 });
             },
@@ -7123,7 +7370,7 @@ export class SqliteScopeHost {
                 const ack = bindAcknowledgement.parse(opts?.acknowledge ?? {});
                 // #1756: onto (or off) a serving script, the scope runs other code before its pointer
                 // moves. Judged here, so no caller that routes first and binds second passes unasked.
-                const bound = scope.vertical_version_id ? readVersion(scope.vertical_version_id) : undefined;
+                const bound = scope.vertical_version_id ? await readVersion(scope.vertical_version_id) : undefined;
                 if (bound)
                     this.assertBindingShapesKept(mapScope(scope), bound.id, servingRef);
                 if (!ack.exportBreak && bound) {
@@ -7700,6 +7947,74 @@ export class SqliteScopeHost {
                     createdAt: r.created_at,
                 }));
             },
+            // -- store-driver releases, rollouts and holds (D-63, #2300) -------------------
+            // The state is kernel code over the directory (store-driver-releases.ts), shared with the
+            // Cloudflare control plane; each call is one transaction. A hold's expiry is judged against
+            // this host's clock, so a test can let a lease lapse without waiting.
+            recordStoreDriverRelease: async (actor, input) => {
+                const at = this.clock();
+                const { record, created } = this.directory.transaction(() => recordStoreDriverReleaseIn(switchSqlOf(this.directory), { ...input, actor, at }))();
+                if (created)
+                    this.recordAdmin(actor, 'uploadStoreDriverRelease', { tenantId: null }, null, record, at);
+                return record;
+            },
+            getStoreDriverRelease: async (actor, driver, sha256) => {
+                const record = storeDriverReleaseIn(switchSqlOf(this.directory), driver, sha256);
+                this.recordAccess(actor, 'getStoreDriverRelease', { tenantId: null }, { driver, sha256 }, record ? 1 : 0);
+                return record;
+            },
+            storeDriverState: async (actor, driver) => {
+                const state = storeDriverStateIn(switchSqlOf(this.directory), driver, Date.parse(this.clock()));
+                this.recordAccess(actor, 'storeDriverState', { tenantId: null }, { driver }, state.rollouts.length);
+                return state;
+            },
+            storeDriverDeclarations: async (actor, driver) => {
+                const declared = this.directory.transaction(() => driverDeclarationsOf(switchSqlOf(this.directory), driver))();
+                this.recordAccess(actor, 'storeDriverDeclarations', { tenantId: null }, { driver }, declared.verticals.length);
+                return declared;
+            },
+            storeDriverRolloutPending: async (actor, input) => {
+                const page = this.directory.transaction(() => storeDriverRolloutPendingIn(switchSqlOf(this.directory), input))();
+                this.recordAccess(actor, 'storeDriverRolloutPending', { tenantId: null }, { driver: input.driver, sha256: input.sha256, action: input.action }, page.verticals.length);
+                return page;
+            },
+            storeDriverRolloutWalked: async (actor, input) => {
+                const walked = this.directory.transaction(() => storeDriverRolloutWalkedIn(switchSqlOf(this.directory), input))();
+                this.recordAccess(actor, 'storeDriverRolloutWalked', { tenantId: null }, { driver: input.driver, seq: input.seq }, walked.verticals.length);
+                return walked;
+            },
+            holdStoreDriver: async (_actor, input) => this.directory.transaction(() => holdStoreDriverIn(switchSqlOf(this.directory), { ...input, nowMs: Date.parse(this.clock()) }))(),
+            releaseStoreDriverHold: async (_actor, input) => {
+                releaseStoreDriverHoldIn(switchSqlOf(this.directory), input);
+            },
+            beginStoreDriverRollout: async (actor, input) => {
+                const at = this.clock();
+                const row = this.directory.transaction(() => beginStoreDriverRolloutIn(switchSqlOf(this.directory), { ...input, actor, at, nowMs: Date.parse(at) }))();
+                this.recordAdmin(actor, input.action === 'rollback' ? 'rollBackStoreDriver' : 'rollOutStoreDriver', { tenantId: null }, null, row, at);
+                return row;
+            },
+            finishStoreDriverRollout: async (actor, input) => {
+                const at = this.clock();
+                const row = this.directory.transaction(() => finishStoreDriverRolloutIn(switchSqlOf(this.directory), { ...input, at, nowMs: Date.parse(at) }))();
+                this.recordAdmin(actor, row.action === 'rollback' ? 'rollBackStoreDriver' : 'rollOutStoreDriver', { tenantId: null }, null, row, at);
+                return row;
+            },
+            storeDriverRebuild: async (actor, driver) => {
+                const rebuild = storeDriverRebuildIn(switchSqlOf(this.directory), driver);
+                this.recordAccess(actor, 'storeDriverRebuild', { tenantId: null }, { driver }, rebuild ? 1 : 0);
+                return rebuild;
+            },
+            claimStoreDriverRebuild: async (_actor, input) => {
+                const at = this.clock();
+                return this.directory.transaction(() => claimStoreDriverRebuildIn(switchSqlOf(this.directory), { ...input, at, nowMs: Date.parse(at) }))();
+            },
+            advanceStoreDriverRebuild: async (_actor, input) => {
+                const at = this.clock();
+                return this.directory.transaction(() => advanceStoreDriverRebuildIn(switchSqlOf(this.directory), { ...input, at, nowMs: Date.parse(at) }))();
+            },
+            recordStoreDriverRebuildRun: async (actor, entry) => {
+                this.recordAdmin(actor, 'rebuildStoreDriver', { tenantId: null }, null, entry, this.clock());
+            },
             getScopeRecord: async (actor, tenantId, scopeId) => {
                 const r = this.directory.prepare('SELECT * FROM scopes WHERE scope_id = ?').get(scopeId);
                 // Cross-check the pair (K-3): a scope that exists under a DIFFERENT tenant
@@ -8021,13 +8336,17 @@ export class SqliteScopeHost {
                 this.recordAccess(actor, 'listShreddedSubjects', { tenantId, scopeId }, null, subjects.length);
                 return { subjects, nextCursor };
             },
-            shredSubject: async (actor, tenantId, scopeId, subjectId, stamp, storeErasures) => {
+            shredSubject: async (actor, tenantId, scopeId, subjectId, fence, stamp, storeErasures) => {
                 this.assertScope(tenantId, scopeId);
                 const before = stamp ?? {
                     erasureEpoch: this.directory.prepare(COPY_BACKFILL_SCOPE_SQL).get(tenantId, scopeId)
                         ?.erasure_epoch ?? 0,
                     path: 'direct',
                 };
+                // #2285: a direct shred with a fence claims what it read, as the finalize does; the epoch
+                // it records is the one its claim compared.
+                if (fence)
+                    before.erasureEpoch = fence.epoch;
                 // Redact the live spine FIRST. Both halves are idempotent and a crash between them
                 // converges on retry, so the order is decided by which half-done state harms the
                 // person: dying after this leaves ciphertext in a backup that no key opens; dying
@@ -8101,6 +8420,8 @@ export class SqliteScopeHost {
                 // An orchestrated caller passes the serving script's result and this host does
                 // not erase again.
                 const erasures = storeErasures ?? (await this.eraseScopeStores(tenantId, scopeId, subjectId));
+                if (fence)
+                    this.claimSubjectErasure(tenantId, scopeId, fence);
                 const { existed } = await this.subjectKeysFor(tenantId, scopeId).destroy(subjectId, at);
                 const receipt = subjectShredReceipt.parse({
                     subjectId,
@@ -8132,20 +8453,11 @@ export class SqliteScopeHost {
             finalizeSubjectShred: async (actor, tenantId, scopeId, subjectId, redactions, expected, storeErasures) => {
                 if (redactions.length === 0)
                     throw substratError('conflict', 'subject erasure has no confirmed scope redaction');
-                const claimed = this.directory.prepare(`UPDATE scopes SET erasure_epoch = COALESCE(erasure_epoch, 0) + 1
-           WHERE tenant_id = ? AND scope_id = ? AND vertical_version_id IS ?
-             AND serving_ref IS ? AND COALESCE(erasure_epoch, 0) = ?
-             AND NOT EXISTS (SELECT 1 FROM scope_script_copies AS copy
-               WHERE copy.tenant_id = scopes.tenant_id AND copy.scope_id = scopes.scope_id
-                 AND copy.state = 'pending')
-             AND (SELECT COUNT(*) FROM scope_script_copies AS copy
-               WHERE copy.tenant_id = scopes.tenant_id AND copy.scope_id = scopes.scope_id) = ?`).run(tenantId, scopeId, expected.versionId, expected.servingRef, expected.epoch, expected.copyCount);
-                if (claimed.changes === 0)
-                    throw substratError('precondition_failed', 'scope route or copy inventory changed during subject erasure; retry after it settles');
+                this.claimSubjectErasure(tenantId, scopeId, expected);
                 // The pure adapter has one co-located scope store. Its existing atomic shred is
                 // the final local redaction and key destruction, after remote copies confirmed.
                 const shred = this.admin.shredSubject;
-                return shred(actor, tenantId, scopeId, subjectId, { erasureEpoch: expected.epoch, path: 'orchestrated' }, storeErasures);
+                return shred(actor, tenantId, scopeId, subjectId, undefined, { erasureEpoch: expected.epoch, path: 'orchestrated' }, storeErasures);
             },
             // -- impersonation (K-42, #868) ----------------------------------------
             beginImpersonation: async (actor, input) => {
@@ -8781,6 +9093,10 @@ export class SqliteScopeHost {
                 const { tenantId, scopeId, ...after } = memberChangeAudit.parse(entry);
                 this.recordAdmin(actor, 'manageScopeMember', { tenantId, scopeId }, null, after);
             },
+            recordConnectionBindingChange: async (actor, entry) => {
+                const { tenantId, scopeId, ...after } = connectionBindingAudit.parse(entry);
+                this.recordAdmin(actor, 'bindConnectionScope', { tenantId, scopeId }, null, after);
+            },
             recordPeerBindingChange: async (actor, entry) => {
                 const { tenantId, scopeId, ...after } = peerBindingAudit.parse(entry);
                 this.recordAdmin(actor, 'setPeerBinding', { tenantId, scopeId }, null, after);
@@ -8790,6 +9106,11 @@ export class SqliteScopeHost {
                 const { tenantId, scopeId, action, ...after } = copyMarkAudit.parse(entry);
                 this.recordAdmin(actor, action === 'mark' ? 'markScopeCopy' : 'clearScopeCopyMark', { tenantId, scopeId }, null, after);
             },
+            /** #2314: one orphan-attachment pass over a scope, written after the vertical's own pass. */
+            recordOrphanSweep: async (actor, entry) => {
+                const { tenantId, scopeId, ...after } = orphanSweepAudit.parse(entry);
+                this.recordAdmin(actor, 'sweepOrphanAttachments', { tenantId, scopeId }, null, after);
+            },
             accessLog: async (actor, filter) => {
                 const where = [];
                 const params = [];
@@ -9248,7 +9569,8 @@ export class SqliteScopeHost {
             const moved = this.directory.prepare(`UPDATE scopes SET ${set} WHERE scope_id = ?
          ${cond?.expectedVersionId === undefined ? '' : 'AND vertical_version_id IS ?'}
          ${cond?.expectedErasureEpoch === undefined ? '' : 'AND COALESCE(erasure_epoch, 0) = ? AND reap_claimed_at IS NULL'}
-         ${cond?.confirmMove === undefined ? '' : COPY_MOVE_LIVE_PREDICATE}`).run(...setArgs, scopeId, ...(cond?.expectedVersionId === undefined ? [] : [cond.expectedVersionId]), ...(cond?.expectedErasureEpoch === undefined ? [] : [cond.expectedErasureEpoch]), ...(cond?.confirmMove === undefined ? [] : copyMoveLiveParams(cond.confirmMove, now)));
+         ${cond?.confirmMove === undefined ? '' : COPY_MOVE_LIVE_PREDICATE}
+         ${cond?.expectedServing === undefined ? '' : SERVES_NOW_PREDICATE}`).run(...setArgs, scopeId, ...(cond?.expectedVersionId === undefined ? [] : [cond.expectedVersionId]), ...(cond?.expectedErasureEpoch === undefined ? [] : [cond.expectedErasureEpoch]), ...(cond?.confirmMove === undefined ? [] : copyMoveLiveParams(cond.confirmMove, now)), ...(cond?.expectedServing === undefined ? [] : servesNowParams(cond.expectedServing)));
             if (moved.changes === 0)
                 return false;
             if (cond?.confirmMove) {
@@ -9258,6 +9580,10 @@ export class SqliteScopeHost {
             return true;
         })();
     }
+    /** #2347: whether a lineage's serving script still runs the version a rebind was judged against. */
+    servesNow(expected) {
+        return this.directory.prepare(`SELECT 1 FROM verticals WHERE ${SERVES_NOW_CONDITION}`).get(...servesNowParams(expected)) !== undefined;
+    }
     ensureColumn(db, table, column, ddl) {
         // Without case, as SQLite resolves a column name: a restore may have added this column
         // already, untyped and spelled as a newer kernel's dump spelled it (#1883).
@@ -9947,6 +10273,18 @@ export class SqliteScopeHost {
                 assertWrites: (verb) => assertImpersonationWrites(impersonation, verb),
                 minted,
             }),
+            // Upload links: mint / revoke / list, written once in the kernel — the same four things
+            // `capabilities` is handed, and the same consumer-is-system-actor rule.
+            attachments: createAttachmentVerbs({
+                sql: spineSql(rt.db),
+                subject: overrideActor ? { kind: 'system', id: overrideActor.system } : subject,
+                now: at,
+                check: runCheck,
+                emit: (event) => writeEvent(event, 'kernel'),
+                assertWrites: (verb) => assertImpersonationWrites(impersonation, verb),
+                minted,
+                targetOf: (entityType) => this.uploadTargetOf(entityType),
+            }),
             // K-16 / #1864: link and relink, written once in the kernel over the raw spine seam.
             ...createEntityEdgeVerbs({
                 sql: spineSql(rt.db),
@@ -10073,6 +10411,14 @@ export class SqliteScopeHost {
                 await this.repairDerived(rt);
             return;
         }
+        // #2349: before any SQL, the registered set is held to the one stored for this version.
+        // Only here, so a scope with nothing pending never computes it.
+        const unstored = await migrationSetDivergence(this.modules.values(), this.migrationsDigest);
+        if (unstored) {
+            const refused = { version: `${pending[0].moduleId}@${pending[0].migration.version}`, error: unstored };
+            this.recordMigrationState(rt, refused);
+            throw migrationFailedError(refused.version, refused.error);
+        }
         // The failing `module@version` and its cause, captured structurally rather than
         // re-parsed out of the thrown message — the directory record has to name both.
         let failure;
@@ -10106,7 +10452,8 @@ export class SqliteScopeHost {
                             assertMigrationLeavesLedgerAlone(migration.sql, `migration ${key}`);
                             // #2068: one statement at a time, keeping the table set either side of each — the
                             // same splitter the Durable Object runs, so both hosts execute identical statements.
-                            const steps = runMigrationStatements(spineSql(rt.db), migration.sql, (stmt) => rt.db.exec(stmt));
+                            // #115: an authored one is also held to the data-loss fence, inside this transaction.
+                            const steps = runMigrationStatements(spineSql(rt.db), migration, (stmt) => rt.db.exec(stmt), { key, authored });
                             assertTablesWithinColumnLimit(rt.db);
                             // #2090: the state columns this migration must have left, and after the last of the
                             // pass, the triggers and indexes a create-copy-rename rebuild dropped.
@@ -10386,6 +10733,9 @@ export class SqliteScopeHost {
         // #2009: the copy classification on a scope DB built before it (NULL reads as a copy; see
         // `COPY_ORIGIN_DDL`).
         this.ensureColumn(db, '_substrat_copy_origin', 'is_copy', 'is_copy INTEGER');
+        // #2315: the hash of the key a redemption carried, on a scope DB built before it. NULL = the
+        // spending request carried none, the honest reading of every link already spent.
+        this.ensureColumn(db, '_substrat_upload_links', 'redeemed_key_hash', 'redeemed_key_hash TEXT');
         // #1237: `readInvocation`'s lookup — WHERE invocation_id = ? ORDER BY id — over an outbox
         // that is never pruned. No index leads with invocation_id, so without this one SQLite
         // walks the PRIMARY KEY from the oldest event until it reaches the call, and reading a