@substrat-run/adapter-sqlite 0.148.0 → 0.150.0

package/dist/index.js

@@ -1,16 +1,17 @@
 import { existsSync, mkdirSync, readdirSync, readFileSync, realpathSync, rmSync, writeFileSync } from 'node:fs';
 import { dirname, join } from 'node:path';
 import Database from 'better-sqlite3';
-import { accessLogEntry, adminLogEntry, delegatedReadParams, operationSeriesCount, opsFailureEntry, opsFailureFingerprint, issueEntry, FRESHNESS_HEARTBEAT_MINUTES, sweepRunEntry, modelUsageEntry, ATTACHMENT_ADDED, ATTACHMENT_REMOVED, attachmentRecord, createTenantInput, domainEvent, domainEventInput, exportReadInput, importBatch, importCursorMove, exportsOfManifestJson, assertNoBindingShapeBreak, importsOfManifestJson, entitlementGrant, entitlementGrantInput, eventId, meterReading, platformRequestInput, platformRequestId, MAX_PENDING_PLATFORM_REQUESTS, identityLink, identityPool, instant, isSubstratError, connection, capabilityGrant, connectionGrant, connectionGrantRecord, connectionSecret, systemGrant, systemSwitch, systemSwitchRecord, peerSwitch, verticalCaller, verticalSlug as verticalSlugOf, subjectRef, requestFingerprint, createConnectionInput, connectLinkFilter, connectLinkKey, consumeConnectLinkInput, mintConnectLinkInput, projectedConnectionGrant, projectedConnectionKey, moduleManifest, createOrgInput, promotionAcknowledgement, bindAcknowledgement, bindHostnameInput, channelHistoryEntry, hostnameBinding, publishVersionInput, AUTO_ADMISSION_NOTE, routeTarget, ROUTE_SCOPE_HOSTNAMES_MAX, registerVerticalInput, vertical as verticalSchema, verticalChannel, verticalVersion, objectRef, entityObjectRef, assertModuleEmittableType, assertKernelAuthoredType, grantRefFromProof, org as orgSchema, orgMembership, principalId, resolvedIdentity, identityMembership, roleDefinition, scope as scopeSchema, tenant as tenantSchema, tenantRole, principalBecomeCapabilityInput, subjectShredReceipt, SCOPE_TABLE_PAGE_DEFAULT, SCOPE_TABLE_PAGE_MAX, SCOPE_QUERY_ROW_MAX, verticalServingState, callsOfManifestJson, outboundOfManifestJson, listLimitOf, pageOf, countedPageOf, SCOPE_GATE_REASONS, substratError, assertReplayableDump, delegatedReadRecord, ownerTransferAudit, memberChangeAudit, peerBindingAudit, connectionBindingAudit, copyMarkAudit, redrainEventsInput, REDRAIN_BATCH, } from '@substrat-run/contracts';
-import { actorOf, asPrincipal, assertAllowed, assertNoSecret, assertPermissionKey, CAPABILITY_DDL, UPLOAD_LINK_DDL, createAttachmentVerbs, inspectUploadLink, redeemUploadLinkInTransaction, COPY_ORIGIN_DDL, ENTITY_STATE_MOVES_DDL, CAPABILITY_EXCHANGE_OPERATION, CAPABILITY_BECOME_MINT_OPERATION, becomeMintCheck, mintBecomeCapabilityAsPrincipal, revokeBecomeCapabilityAsPrincipal, readBecomeLinkStates, ENTITY_UNBIND_OPERATION, allowedFor, unbindEntityHolderBounded, capabilityAttachmentWriteRefused, capabilityTokenHash, createCapabilityVerbs, createEntityEdgeVerbs, createEntityStateVerbs, createTrashedReads, CONTINUATION_POSITION_CAP, visibleContinuation, searchStateWhere, uncheckedView, addStatePlans, addUpdatedStampPlans, watchUpdatedStamps, entityStateMigrations, assertNoCallerPurge, isUnreachableParent, heldPurgePass, purgeDueOf, purgeHeldBy, lifecycleRefusal, purgeOnlyKeysOf, purgeReportOf, purgeStillDue, refuseTrashedTarget, assertBoundOperations, registerTrashTargets, runPurgePass, withheldKeysFor, statefulTablesOf, afterMigration, afterRuntimeDdl, derivesAnything, repairDerivedObjects, StateColumnLost, exchangeCapability as exchangeCapabilitySecret, guardSecrets, mintBecomeCapability, plausibleSessionToken, readCapabilityPage, redactSecrets, redactSecretText, moduleLog, consoleLogSink, asyncInvocationId, asyncLinePass, consoleInvocationLineSink, resolveCapabilitySession, revokeCapabilityAsPlatform, assertReadOnlyQuery, attachmentBlobKey, attachmentSha256, entitlementDenial, requiredEntitlementFor, foldMeterReading, guardSpine, guardSqlLimits, DO_SQL_LIMITS, tooManyResultColumns, tooManyTableColumns, parseValidationRecords, resolveScopeRecord, ulid, ISSUE_RETENTION_DAYS, telemetryRetentionStatements, FINDINGS_DDL, SCOPE_STORAGE_DDL, forgetScopeStorage, listScopeStorageAttemptRows, listScopeStorageRows, listScopeStoreStorageRows, pruneScopeStorageRows, recordScopeStorageRows, CONNECT_LINKS_DDL, consumeConnectLinkRow, insertConnectLink, listConnectLinks as listConnectLinkRows, readConnectLink, restoreConnectLinkRow, revokeConnectLinkRow, createFindingRule, findingOfOpsFailure, findingOfSweepRun, pruneFindings, listFindingRules, listFindings, observeFinding, revokeFindingRule, setFindingStatus, assertRowLimit, assertRowOffset, OPS_FAILURE_RETENTION_DAYS, SWEEP_RUN_RETENTION_DAYS, SWEEP_RUNS_INTENT_INDEX, sweepRunsIntentHasKind, MODEL_USAGE_RETENTION_DAYS, foldModelUsage, backoffAt, platformRequestHistoryQuery, platformRequestOf, PLATFORM_REQUEST_COLUMNS, PLATFORM_REQUEST_REDACTION_SQL, platformRequestRedactionParams, platformRequestRedactionQuery, intentPayloadCarriesSubject, redactSubjectJobRuns, eraseSubjectFromModules, moduleRowsErased, moduleErasurePlan, redactSubjectScopeText, redactSubjectDirectoryText, ISSUE_EXEMPLAR_OWNER_BACKFILL_SQL, issueExemplarOwner, JOB_RUN_PATCH_SQL, JOB_RUN_CLAIM_SQL, JOB_RUN_RENEW_SQL, JOB_RUN_BEGIN_SQL, JOB_RUN_MISS_SQL, JOB_RUN_MISS_SETTLE_SQL, admissionMissOutcome, JOB_STEP_RECORD_SQL, JOB_LEASE_EXPIRED_NOTE, assertLeaseMs, DELIVERY_ERROR_REDACTION_SQL, REDACTED_DELIVERY_NOTE, seatScopeTuple, applyScopeRoleChange, changeScopeRole, revokeScopeRoles, scopeRoleHolders, admitPeer, peerCallerAt, collectPeers, peerSeats, resolveVerticalInstanceFrom, resolvePeerInstanceFrom, peerVerticalSpellings, samePeerVertical, peerGrantsStatus, systemGrantsStatus, systemScheduleState, systemSwitchedOff, systemSwitchedOffMessage, tenantSystemSwitchedOffMessage, PEER_SWITCHES_DDL, PEER_BINDINGS_DDL, SWITCH_OWED_DDL, SWITCH_FENCES_DDL, TABLE_OWNERS_DDL, assertMigrationLeavesLedgerAlone, recordOwnershipSteps, runMigrationStatements, executableSqlStatements, blankSqlComments, recordWriteSuperseded, switchFencesOf, switchSupersededMessage, SWITCH_KINDS, SYSTEM_SWITCHES_DDL, forgetSwitchesOf, listSystemSwitchRecords, moveSwitch, reassertActionOf, reassertEntry, reassertOffRow, recordSwitchedOff, recordSwitchedOn, restoreSwitchRecord, scopesSwitchedOffFor, switchActionOf, switchAuditSubject, recordAuditOutcome, auditedCapabilityRevoke, auditWarningOf, switchNotFoundMessage, switchRecordsOf, switchedOffOf, switchesBackfillSqlOf, switchesTableExists, tenantHeldOf, tenantHoldsGrant, inUnitMovesToAudit, staleCarryRevertRow, staleCarryReverts, withRecorded, VERSION_MIGRATIONS_DDL, VERTICAL_SCOPE_STORES_DDL, forgetVerticalScopeStores, indexVersionScopeStores, kindDeclarationsOf, verticalScopeStoresOf, STORE_KIND_RELEASES_DDL, beginStoreKindRolloutIn, finishStoreKindRolloutIn, holdStoreKindIn, recordStoreKindReleaseIn, releaseStoreKindHoldIn, storeKindReleaseIn, storeKindStateIn, splitManifestMigrations, splitVersionMigrationsBatch, versionMigrationsOf, writeVersionMigrations, denialListQuery, refusalListQuery, mapRefusalRow, denialSummaryQuery, denialTotalsQuery, DENIAL_WINDOW_QUERY, mapDenialRow, mapDenialSummaryBuckets, IMPERSONATION_COLUMNS, IMPERSONATION_DDL, ImpersonationRefused, assertImpersonationWrites, assertModuleEnqueueableKind, assertSessionUsable, impersonationByIdQuery, impersonationListQuery, impersonationRowValues, impersonationStampOf, mapImpersonationRow, newImpersonationSession, resolveRetryPolicy, executorOutcomeOf, isDeliveryRefusal, refusalJournalText, membershipFencesBackfillSql, MEMBERSHIP_FENCES_DDL, membershipFencesTableExists, MEMBERSHIP_FENCE_SINCE_SQL, RAISE_MEMBERSHIP_FENCE_SQL, memberAddedAudit, orgChangeBound, tenantCoverage, isSecretBoxConfigured, unconfiguredSecretBox, createSubjectKeys, generateSealingKeyPair, noSealingKeyMessage, openSealed, sealTo, ConnectionSealingKeyUnavailableError, PermissionDenied, createAtomic, NotSearchable, NotListable, listIndexMigrations, listIndexPlans, listQuery, cursorOf, moduleMigrations, MIGRATION_DIGEST_FENCE_DDL, MIGRATION_DIGEST_MARK_LEGACY, assertJournalDumpCoherent, assertMigrationSql, migrationDivergence, migrationFailedError, migrationSteps, planMigrations, isSearchIndexTable, searchIndexMigrations, searchIndexPlans, searchLimit, searchMatchExpression, searchQuery, ATTACHMENT_TEXT_DDL, assertAttachmentExtractors, resolveAttachmentTextBounds, assertJobRegistrable, attachmentRecordOfRow, attachmentTextJob, enqueueAttachmentText, ATTACHMENT_TEXT_BACKFILL_JOB, ATTACHMENT_TEXT_JOB, kernelJobFor, queueAttachmentTextBackfill, startAttachmentTextBackfill, attachmentTextBackfillJob, reconcileAttachmentText, recordAttachmentText, searchAttachments, entityVersionQuery, entityVersionOf, assertIfMatch, OUTBOX_ENTITY_INDEX, SCHEDULE_STATE_DDL, SCHEDULE_STATE_REBUILD, scheduleStateHasKind, VERTICAL_EVENTS_DDL, EXPORT_HOPS_SQL, emptyImportResult, IMPORT_CURSORS_SQL, IMPORT_CURSOR_OF_SQL, OUTBOX_MARK_SQL, emittedSinceQuery, emittedReportOf, EMITTED_REPORT_CAP, exportedSinceQuery, IMPORT_CURSOR_ADVANCE_SQL, IMPORT_RECORD_SQL, moveImportCursor, importCursorSourceOf, exportBreaksOf, exportBreakRefusal, bindExportBreaksOf, bindExportBreakRefusal, scopeMoveOf, runningVersionOf, isPrimaryScope, PROVISIONED_VERSIONS_SQL, installsReconciledOf, strandJudgmentsOf, provisionedVersionsParams, boundShapesColumn, boundShapesOfColumn, installReconciled, CrossVerticalRegistry, exportReadPlan, exportReadQuery, planExportBatch, withheldNote, JOB_RUN_DDL, JOB_RUN_DUE_AT, jobRunListLimit, jobRunOf, runDueJobRuns, startJobRun, IDEMPOTENCY_DDL, REFUSALS_TABLE_DDL, REFUSALS_INDEX, refusalInsert, refusalOf, markGuardRefusal, REFUSALS_REBUILD, refusalsAdmitGuards, assertIdempotencyKey, idempotencyLookupQuery, idempotencyPruneStatement, idempotencyRecordStatement, idempotencyOptedOutMessage, replayFor, globalFetch, createUlid, facetEvents, readHistory, walkEventCause, walkEventEffects, assertRedrainWindow, readInvocation, readDeadLetters, readLifecycleFlow, readOperationSeries, domainEventOf, readUndrainedOutbox, undrainedEventsOf, connectorCallRecord, noopConnectorCallRecorder, recordConnectorCall, settleConnectionUse, unknownRoleError, callReservedStoreOperation, callScopeStore, observeStoreCall, replayStoreErasures, scopeStoreLifecycleOf, scopeStoreRunnersOf, } from '@substrat-run/kernel';
+import { accessLogEntry, adminLogEntry, delegatedReadParams, operationSeriesCount, opsFailureEntry, opsFailureFingerprint, issueEntry, FRESHNESS_HEARTBEAT_MINUTES, sweepRunEntry, modelUsageEntry, ATTACHMENT_ADDED, ATTACHMENT_REMOVED, attachmentRecord, createTenantInput, domainEvent, domainEventInput, exportReadInput, importBatch, importCursorMove, exportsOfManifestJson, assertNoBindingShapeBreak, importsOfManifestJson, entitlementGrant, entitlementGrantInput, eventId, meterReading, platformRequestInput, platformRequestId, MAX_PENDING_PLATFORM_REQUESTS, identityLink, identityPool, instant, isSubstratError, connection, capabilityGrant, connectionGrant, connectionGrantRecord, connectionSecret, systemGrant, systemSwitch, systemSwitchRecord, peerSwitch, verticalCaller, verticalSlug as verticalSlugOf, subjectRef, requestFingerprint, createConnectionInput, connectLinkFilter, connectLinkKey, consumeConnectLinkInput, mintConnectLinkInput, projectedConnectionGrant, projectedConnectionKey, moduleManifest, createOrgInput, promotionAcknowledgement, bindAcknowledgement, bindHostnameInput, channelHistoryEntry, hostnameBinding, publishVersionInput, AUTO_ADMISSION_NOTE, routeTarget, ROUTE_SCOPE_HOSTNAMES_MAX, registerVerticalInput, vertical as verticalSchema, verticalChannel, verticalVersion, objectRef, entityObjectRef, assertModuleEmittableType, assertKernelAuthoredType, grantRefFromProof, org as orgSchema, orgMembership, principalId, resolvedIdentity, identityMembership, roleDefinition, scope as scopeSchema, tenant as tenantSchema, tenantRole, principalBecomeCapabilityInput, subjectShredReceipt, SCOPE_TABLE_PAGE_DEFAULT, SCOPE_TABLE_PAGE_MAX, SCOPE_QUERY_ROW_MAX, verticalServingState, callsOfManifestJson, outboundOfManifestJson, listLimitOf, pageOf, countedPageOf, SCOPE_GATE_REASONS, substratError, assertReplayableDump, delegatedReadRecord, ownerTransferAudit, memberChangeAudit, peerBindingAudit, connectionBindingAudit, copyMarkAudit, orphanSweepAudit, redrainEventsInput, REDRAIN_BATCH, errorCodeOf, } from '@substrat-run/contracts';
+import { actorOf, asPrincipal, assertAllowed, assertNoSecret, assertPermissionKey, CAPABILITY_DDL, UPLOAD_LINK_DDL, createAttachmentVerbs, inspectUploadLink, redeemUploadLinkInTransaction, redeemOrReplayUploadLink, COPY_ORIGIN_DDL, ENTITY_STATE_MOVES_DDL, CAPABILITY_EXCHANGE_OPERATION, CAPABILITY_BECOME_MINT_OPERATION, becomeMintCheck, mintBecomeCapabilityAsPrincipal, revokeBecomeCapabilityAsPrincipal, readBecomeLinkStates, ENTITY_UNBIND_OPERATION, allowedFor, unbindEntityHolderBounded, capabilityAttachmentWriteRefused, capabilityTokenHash, createCapabilityVerbs, createEntityEdgeVerbs, createEntityStateVerbs, createTrashedReads, CONTINUATION_POSITION_CAP, visibleContinuation, searchStateWhere, uncheckedView, addStatePlans, addUpdatedStampPlans, watchUpdatedStamps, entityStateMigrations, assertNoCallerPurge, isUnreachableParent, heldPurgePass, purgeDueOf, purgeHeldBy, lifecycleRefusal, purgeOnlyKeysOf, purgeReportOf, purgeStillDue, refuseTrashedTarget, assertBoundOperations, registerTrashTargets, runPurgePass, withheldKeysFor, statefulTablesOf, afterMigration, afterRuntimeDdl, derivesAnything, repairDerivedObjects, StateColumnLost, exchangeCapability as exchangeCapabilitySecret, guardSecrets, mintBecomeCapability, plausibleSessionToken, readCapabilityPage, redactSecrets, redactSecretText, moduleLog, consoleLogSink, asyncInvocationId, asyncLinePass, consoleInvocationLineSink, resolveCapabilitySession, revokeCapabilityAsPlatform, assertReadOnlyQuery, attachmentBlobKey, attachmentSha256, entitlementDenial, requiredEntitlementFor, foldMeterReading, guardSpine, guardSqlLimits, DO_SQL_LIMITS, tooManyResultColumns, tooManyTableColumns, parseValidationRecords, resolveScopeRecord, ulid, ISSUE_RETENTION_DAYS, telemetryRetentionStatements, FINDINGS_DDL, SCOPE_STORAGE_DDL, forgetScopeStorage, listScopeStorageAttemptRows, listScopeStorageRows, listScopeStoreStorageRows, pruneScopeStorageRows, recordScopeStorageRows, CONNECT_LINKS_DDL, consumeConnectLinkRow, insertConnectLink, listConnectLinks as listConnectLinkRows, readConnectLink, restoreConnectLinkRow, revokeConnectLinkRow, createFindingRule, findingOfOpsFailure, findingOfSweepRun, pruneFindings, listFindingRules, listFindings, observeFinding, revokeFindingRule, setFindingStatus, assertRowLimit, assertRowOffset, OPS_FAILURE_RETENTION_DAYS, SWEEP_RUN_RETENTION_DAYS, SWEEP_RUNS_INTENT_INDEX, sweepRunsIntentHasKind, MODEL_USAGE_RETENTION_DAYS, foldModelUsage, backoffAt, platformRequestHistoryQuery, platformRequestOf, PLATFORM_REQUEST_COLUMNS, PLATFORM_REQUEST_REDACTION_SQL, platformRequestRedactionParams, platformRequestRedactionQuery, intentPayloadCarriesSubject, redactSubjectJobRuns, eraseSubjectFromModules, moduleRowsErased, moduleErasurePlan, redactSubjectScopeText, redactSubjectDirectoryText, ISSUE_EXEMPLAR_OWNER_BACKFILL_SQL, issueExemplarOwner, JOB_RUN_PATCH_SQL, JOB_RUN_CLAIM_SQL, JOB_RUN_RENEW_SQL, JOB_RUN_BEGIN_SQL, JOB_RUN_MISS_SQL, JOB_RUN_MISS_SETTLE_SQL, admissionMissOutcome, JOB_STEP_RECORD_SQL, JOB_LEASE_EXPIRED_NOTE, assertLeaseMs, DELIVERY_ERROR_REDACTION_SQL, REDACTED_DELIVERY_NOTE, seatScopeTuple, applyScopeRoleChange, changeScopeRole, revokeScopeRoles, scopeRoleHolders, admitPeer, boundToPeerDeclarations, peerCallerAt, collectPeers, peerSeats, resolveVerticalInstanceFrom, resolvePeerInstanceFrom, peerVerticalSpellings, samePeerVertical, peerGrantsStatus, systemGrantsStatus, systemScheduleState, systemSwitchedOff, systemSwitchedOffMessage, tenantSystemSwitchedOffMessage, PEER_SWITCHES_DDL, PEER_BINDINGS_DDL, SWITCH_OWED_DDL, SWITCH_FENCES_DDL, TABLE_OWNERS_DDL, assertMigrationLeavesLedgerAlone, recordOwnershipSteps, runMigrationStatements, executableSqlStatements, blankSqlComments, recordWriteSuperseded, switchFencesOf, switchSupersededMessage, SWITCH_KINDS, SYSTEM_SWITCHES_DDL, forgetSwitchesOf, listSystemSwitchRecords, moveSwitch, reassertActionOf, reassertEntry, reassertOffRow, recordSwitchedOff, recordSwitchedOn, restoreSwitchRecord, scopesSwitchedOffFor, switchActionOf, switchAuditSubject, recordAuditOutcome, auditedCapabilityRevoke, auditWarningOf, switchNotFoundMessage, switchRecordsOf, switchedOffOf, switchesBackfillSqlOf, switchesTableExists, tenantHeldOf, tenantHoldsGrant, inUnitMovesToAudit, staleCarryRevertRow, staleCarryReverts, withRecorded, VERSION_MIGRATIONS_DDL, VERTICAL_SCOPE_STORES_DDL, forgetVerticalScopeStores, indexVersionScopeStores, driverDeclarationsOf, verticalScopeStoresOf, STORE_DRIVER_RELEASES_DDL, legacyStoreDriverConflict, legacyStoreDriverRenames, beginStoreDriverRolloutIn, finishStoreDriverRolloutIn, holdStoreDriverIn, advanceStoreDriverRebuildIn, claimStoreDriverRebuildIn, storeDriverRebuildIn, recordStoreDriverReleaseIn, releaseStoreDriverHoldIn, storeDriverReleaseIn, storeDriverStateIn, storeDriverRolloutPendingIn, storeDriverRolloutWalkedIn, splitManifestMigrations, splitVersionMigrationsBatch, versionMigrationsOf, deriveVersionMigrationDigest, publishedMigrationDigest, migrationChangeRefusal, writeVersionMigrations, denialListQuery, refusalListQuery, mapRefusalRow, denialSummaryQuery, denialTotalsQuery, DENIAL_WINDOW_QUERY, mapDenialRow, mapDenialSummaryBuckets, IMPERSONATION_COLUMNS, IMPERSONATION_DDL, ImpersonationRefused, assertImpersonationWrites, assertModuleEnqueueableKind, assertSessionUsable, impersonationByIdQuery, impersonationListQuery, impersonationRowValues, impersonationStampOf, mapImpersonationRow, newImpersonationSession, resolveRetryPolicy, executorOutcomeOf, isDeliveryRefusal, refusalJournalText, membershipFencesBackfillSql, MEMBERSHIP_FENCES_DDL, membershipFencesTableExists, MEMBERSHIP_FENCE_SINCE_SQL, RAISE_MEMBERSHIP_FENCE_SQL, memberAddedAudit, orgChangeBound, tenantCoverage, isSecretBoxConfigured, unconfiguredSecretBox, createSubjectKeys, generateSealingKeyPair, noSealingKeyMessage, openSealed, sealTo, ConnectionSealingKeyUnavailableError, PermissionDenied, createAtomic, NotSearchable, NotListable, listIndexMigrations, listIndexPlans, listQuery, cursorOf, moduleMigrations, MIGRATION_DIGEST_FENCE_DDL, MIGRATION_DIGEST_MARK_LEGACY, assertJournalDumpCoherent, assertMigrationSql, migrationDivergence, migrationFailedError, migrationSetDivergence, migrationSteps, planMigrations, isSearchIndexTable, searchIndexMigrations, searchIndexPlans, searchLimit, searchMatchExpression, searchQuery, ATTACHMENT_TEXT_DDL, ATTACHMENT_CONDEMNED_DDL, ATTACHMENT_SWEEP_LICENCE_DDL, ATTACHMENT_SWEEP_LICENCE_TABLE, clearOrphanSweepLicence, condemnLicensedOrphanAttachments, consumeOrphanSweepLicence, licensedOrphanIds, recordOrphanSweepLicence, refuseUnlicensedOrphanSweep, fenceAttachmentSweep, refuseCondemnedAttachment, refuseCondemnedInDump, rowlessAttachmentIds, sweepOrphanAttachments, missingAttachmentStore, SETTLED_COPY_STATES, unsettledCopyRefusal, assertAttachmentExtractors, resolveAttachmentTextBounds, assertJobRegistrable, attachmentRecordOfRow, attachmentTextJob, enqueueAttachmentText, ATTACHMENT_TEXT_BACKFILL_JOB, ATTACHMENT_TEXT_JOB, kernelJobFor, queueAttachmentTextBackfill, startAttachmentTextBackfill, attachmentTextBackfillJob, reconcileAttachmentText, recordAttachmentText, searchAttachments, entityVersionQuery, entityVersionOf, assertIfMatch, OUTBOX_ENTITY_INDEX, SCHEDULE_STATE_DDL, SCHEDULE_STATE_REBUILD, scheduleStateHasKind, VERTICAL_EVENTS_DDL, EXPORT_HOPS_SQL, emptyImportResult, IMPORT_CURSORS_SQL, IMPORT_CURSOR_OF_SQL, OUTBOX_MARK_SQL, emittedSinceQuery, emittedReportOf, EMITTED_REPORT_CAP, exportedSinceQuery, IMPORT_CURSOR_ADVANCE_SQL, IMPORT_RECORD_SQL, moveImportCursor, importCursorSourceOf, exportBreaksOf, exportBreakRefusal, assertPromoteReviewCurrent, promoteRaceRefusal, rebindRaceRefusal, SERVES_NOW_CONDITION, SERVES_NOW_PREDICATE, servesNowParams, bindExportBreaksOf, bindExportBreakRefusal, scopeMoveOf, runningVersionOf, isPrimaryScope, PROVISIONED_VERSIONS_SQL, installsReconciledOf, strandJudgmentsOf, provisionedVersionsParams, boundShapesColumn, boundShapesOfColumn, installReconciled, CrossVerticalRegistry, exportReadPlan, exportReadQuery, planExportBatch, withheldNote, JOB_RUN_DDL, JOB_RUN_DUE_AT, jobRunListLimit, jobRunOf, runDueJobRuns, startJobRun, IDEMPOTENCY_DDL, REFUSALS_TABLE_DDL, REFUSALS_INDEX, refusalInsert, refusalOf, markGuardRefusal, REFUSALS_REBUILD, refusalsAdmitGuards, assertIdempotencyKey, idempotencyLookupQuery, idempotencyPruneStatement, idempotencyRecordStatement, idempotencyOptedOutMessage, replayFor, globalFetch, createUlid, facetEvents, readHistory, walkEventCause, walkEventEffects, assertRedrainWindow, readInvocation, readDeadLetters, readLifecycleFlow, readOperationSeries, domainEventOf, readUndrainedOutbox, undrainedEventsOf, connectorCallRecord, noopConnectorCallRecorder, recordConnectorCall, settleConnectionUse, unknownRoleError, callReservedStoreOperation, callScopeStore, observeStoreCall, replayStoreErasures, scopeStoreLifecycleOf, scopeStoreRunnersOf, } from '@substrat-run/kernel';
 import { attributedView, delegatedRevokeSql, writeExplicitTupleIn, grantEntityShapeIn, shapeTopUpBatch, topUpEntityGrantShapes, settlePlatformRequestIn, } from '@substrat-run/kernel';
 import { ADMIN_LOG_INDEXES_SQL, SETTLE_INTENT_SQL, SETTLE_OUTCOME_SQL, settleOutcomeParamsOf, readAuditedOperations, unknownOutcomeOf, } from '@substrat-run/kernel';
-import { INERT_SCOPE_REASON, isPrimaryScopeRow, UPLOAD_LINK_WRONG_TARGET } from '@substrat-run/kernel';
+import { INERT_SCOPE_REASON, isPrimaryScopeRow, normalizeUploadMediaType } from '@substrat-run/kernel';
 import { COPY_BACKFILL_SCOPE_SQL, COPY_BACKFILL_SQL, COPY_BACKFILL_SUPERSEDE_SQL, COPY_CLAIM_SQL, COPY_EXPIRED_SQL, copyBackfillParams, copyBackfillRefusal, SUBJECT_ERASURE_CLAIM_SQL, subjectErasureClaimParams, COPY_MOVE_CONFIRM_SQL, COPY_MOVE_LIVE_PREDICATE, SCOPE_COPY_LEASE_MS, SCOPE_SCRIPT_COPY_COLUMNS, copyMoveConfirmParams, copyMoveLiveParams, scopeScriptCopyOf, } from '@substrat-run/kernel';
 import { GRANT_CHILDREN_INDEX_DDL, SHAPE_MARKER_INDEX_DDL, grantedEntitiesForContext } from '@substrat-run/kernel';
 import { LEGACY_SCOPE_ROWS_BACKFILL, assertSpineTablesBuilt, capabilitiesForLoad, dumpRowsInsert, isSpineTable, loadDirectoryDump, repointScopeGrants, settleCopiedWork, emittedHere, spineColumnAdditions } from '@substrat-run/kernel';
 import { ScopeActor } from './actor.js';
 import { createTupleChecker, directoryTenantReader } from './checker.js';
+import { decidedByOf, entityString, forgetInvocationTrace, invocationTrace, tracedSql } from './trace.js';
 export { scopeStoreRunnersFor } from './scope-store-runners.js';
 /**
  * A fault in the database itself (full, corrupt, I/O), as opposed to one statement failing.
@@ -322,11 +323,22 @@ const KERNEL_DDL = `
   -- #1575: attachment text and its FTS5 index, shared from @substrat-run/kernel. After
   -- _substrat_attachments, whose delete trigger it adds.
   ${ATTACHMENT_TEXT_DDL}
+  -- #2314: the orphan sweep's tombstones, shared from @substrat-run/kernel. An id here
+  -- never takes an attachment row again: the insert path refuses it.
+  ${ATTACHMENT_CONDEMNED_DDL}
+  -- #2350: the orphan sweep's dry-run licence, shared from @substrat-run/kernel. Store-local:
+  -- never dumped, and every load drops it.
+  ${ATTACHMENT_SWEEP_LICENCE_DDL}
   -- #901: an entity's version is the ULID of the last event about it (a state move
   -- excepted, #2191), so the newest id per (entity_type, entity_id) is the read. The id
   -- column sits last so SQLite walks the matched range backwards instead of aggregating.
   ${OUTBOX_ENTITY_INDEX}
 `;
+/**
+ * The scope spine a fresh scope gets, for a tool that replays a vertical's migrations outside a
+ * host — `pnpm lint:migration-fence` (#115), whose reviewed spine migrations read and write it.
+ */
+export const SCOPE_SPINE_DDL = KERNEL_DDL;
 /** Row → contract shape. Never reads the secrets table — that is the point of the split. */
 const toConnection = (r) => connection.parse({
     id: r.id,
@@ -698,11 +710,13 @@ export class SqliteScopeHost {
     secretBox;
     /** The parsers attachment text is extracted with (K-43); the host's own, never imported here. */
     attachmentExtractors;
+    wrapBlobStore;
     attachmentTextBounds;
     fetchImpl;
     connectorCalls;
     clock;
     versionId;
+    migrationsDigest;
     /** #1746: where `ctx.log` lines go — the console unless a caller (a test) says otherwise. */
     logSink;
     /** #1901: where async work's invocation lines go. */
@@ -716,11 +730,13 @@ export class SqliteScopeHost {
         this.secretBox = options.secretBox ?? unconfiguredSecretBox;
         assertAttachmentExtractors(options.attachmentExtractors ?? []);
         this.attachmentExtractors = options.attachmentExtractors ?? [];
+        this.wrapBlobStore = options.wrapBlobStore ?? ((store) => store);
         this.attachmentTextBounds = resolveAttachmentTextBounds(options.attachmentTextBounds);
         this.fetchImpl = options.fetch ?? globalFetch;
         this.connectorCalls = options.connectorCalls ?? noopConnectorCallRecorder;
         this.clock = options.clock ?? (() => instant.parse(new Date().toISOString()));
         this.versionId = options.versionId ?? null;
+        this.migrationsDigest = options.migrationsDigest;
         this.scopeStoreVertical = options.scopeStores?.vertical;
         this.scopeStoreRunners = scopeStoreRunnersOf(options.scopeStores);
         this.scopeStoreLifecycle = scopeStoreLifecycleOf(this.scopeStoreRunners);
@@ -743,17 +759,17 @@ export class SqliteScopeHost {
             this.directory.pragma('journal_mode = WAL');
             this.ensureDirectorySchema();
             this.loadRoles();
-            this.checker =
-                customChecker ??
-                    createTupleChecker({
-                        directory: this.directory,
-                        scopeDb: (scopeId) => this.scopesById.get(scopeId)?.db,
-                        getRole: (tenantId, key) => this.roles.get(`${tenantId}/${key}`),
-                        // #956: the evaluator judges `expires_at` against the host's clock, so a
-                        // scripted one can actually expire a grant. A caller-supplied `checker`
-                        // keeps its own time source — this only binds the built-in one.
-                        clock: () => this.clock(),
-                    });
+            // #2263: whichever checker evaluates, a peer holds only what the running declaration names.
+            this.checker = boundToPeerDeclarations(customChecker ??
+                createTupleChecker({
+                    directory: this.directory,
+                    scopeDb: (scopeId) => this.scopesById.get(scopeId)?.db,
+                    getRole: (tenantId, key) => this.roles.get(`${tenantId}/${key}`),
+                    // #956: the evaluator judges `expires_at` against the host's clock, so a
+                    // scripted one can actually expire a grant. A caller-supplied `checker`
+                    // keeps its own time source — this only binds the built-in one.
+                    clock: () => this.clock(),
+                }), () => this.peerDeclarations());
             this.admin = this.buildAdmin();
             this.owner = owner;
         }
@@ -942,8 +958,8 @@ export class SqliteScopeHost {
         created_at TEXT NOT NULL,
         PRIMARY KEY (tenant_id, vertical, binding)
       );
-      -- A store kind's stored releases, rollouts and holds (D-63, #2300).
-      ${STORE_KIND_RELEASES_DDL}
+      -- A store driver's stored releases, rollouts and holds (D-63, #2300).
+      ${STORE_DRIVER_RELEASES_DDL}
       -- The vertical + version registry (#31). A scope binds to a VERSION, so
       -- dev/staging/prod are the same vertical pinned differently, and a preview
       -- deployment is a version nothing has been promoted to yet.
@@ -1010,6 +1026,9 @@ export class SqliteScopeHost {
         migration_count   INTEGER,
         -- 1 once the SQL is out of manifest_json. NULL = stored before #1764, not yet backfilled.
         migrations_split  INTEGER,
+        -- 1 once migration_digest is the one derived from the stored migrations (#2339).
+        -- NULL = stored before, still the pushed digest; derived on its next read.
+        migration_digest_derived INTEGER,
         created_at        TEXT NOT NULL,
         UNIQUE (vertical_slug, version)
       );
@@ -1414,13 +1433,27 @@ export class SqliteScopeHost {
      * it inside its transaction onto an emptied directory, before loading any row.
      */
     buildDirectorySchema() {
+        // A directory built before the store driver rename keeps its rows under the old names (and one
+        // that ran pre-rename code again, a rollback, holds both names), and
+        // `applyDirectorySchema` would only create empty tables beside them.
+        const tables = this.directory.prepare(`SELECT name FROM sqlite_master WHERE type = 'table'`).all().map((t) => t.name);
+        const hasRows = (table) => this.directory.prepare(`SELECT 1 FROM "${table}" LIMIT 1`).get() !== undefined;
+        // Asked before the moves below, which drop a name with no rows.
+        const bothNames = legacyStoreDriverConflict(tables, hasRows);
+        if (bothNames)
+            console.error(bothNames);
+        for (const stmt of legacyStoreDriverRenames(tables, (table) => builtColumnsOf(this.directory, table), hasRows))
+            this.directory.exec(stmt);
         // #1764: `VERSION_MIGRATIONS_DDL` indexes these two columns, so a directory created
         // before them needs them before `applyDirectorySchema` reaches that statement.
         if (this.directory.prepare('PRAGMA table_info(vertical_versions)').all().length > 0) {
             this.ensureColumn(this.directory, 'vertical_versions', 'migration_count', 'migration_count INTEGER');
             this.ensureColumn(this.directory, 'vertical_versions', 'migrations_split', 'migrations_split INTEGER');
+            this.ensureColumn(this.directory, 'vertical_versions', 'migration_digest_derived', 'migration_digest_derived INTEGER');
         }
         this.applyDirectorySchema();
+        // #2322: a migration's declared moves and discards, on a table created before they were carried.
+        this.ensureColumn(this.directory, 'vertical_version_migrations', 'declarations', 'declarations TEXT');
     }
     /**
      * `applyDirectorySchema`, plus the backfill of the schedule switch's record (#1674) from
@@ -1682,6 +1715,7 @@ export class SqliteScopeHost {
         }
         // #1705: validated whole and kept only if it passes, so a refused module leaves nothing.
         this.crossVertical.register(manifest, registration.imports);
+        this.peerUnion = undefined; // #2263: the next check reads the new module set's declarations
         this.modules.set(manifest.id, {
             id: manifest.id,
             // The order the kernel writes once (#1677): authored, then search, then list indexes.
@@ -2073,7 +2107,7 @@ export class SqliteScopeHost {
                     out.push(r);
             }
         };
-        return {
+        return this.wrapBlobStore({
             put: async (key, body, opts) => {
                 const p = resolveKey(key);
                 mkdirSync(dirname(p), { recursive: true });
@@ -2105,7 +2139,7 @@ export class SqliteScopeHost {
                 walk(root, '', out);
                 return out.filter((k) => k.startsWith(prefix)).sort();
             },
-        };
+        }, ref);
     }
     /** Resolve the blob store that carries a scope's attachments (#473): the platform-minted
      *  store for (tenant, the scope's vertical). Fails loudly when none was provisioned —
@@ -2148,30 +2182,100 @@ export class SqliteScopeHost {
         const uploadLinks = this.uploadLinkPolicies.get(entityType);
         return uploadLinks ? { write: gate.write, uploadLinks } : { write: gate.write };
     }
-    async inspectUploadLink(tenantId, scopeId, secret) {
+    async inspectUploadLink(tenantId, scopeId, secret, target, idempotencyKey) {
+        const rt = await this.openActiveScope(tenantId, scopeId);
+        return rt.actor.enqueue(async () => (await inspectUploadLink({ sql: spineSql(rt.db), now: this.clock() }, secret, target, idempotencyKey)).view);
+    }
+    /**
+     * #2314: one orphan-sweep pass over a scope's attachment bytes (`sweepOrphanAttachments` in the
+     * kernel has the guards). Only an active PRIMARY scope of `tenantId` is judged: a fork or a
+     * preview holds another scope's rows, never this one's.
+     */
+    async sweepOrphanAttachments(tenantId, scopeId, request = {}) {
+        const row = this.directory
+            .prepare('SELECT vertical, kind, forked_from FROM scopes WHERE scope_id = ? AND tenant_id = ?')
+            .get(scopeId, tenantId);
+        if (row && !isPrimaryScopeRow(row)) {
+            throw substratError('conflict', `refused: scope ${scopeId} is a copy, and a copy may not judge orphan attachments`);
+        }
+        const copies = this.directory
+            .prepare(`SELECT script_ref AS scriptRef, state FROM scope_script_copies
+          WHERE tenant_id = ? AND scope_id = ? AND state NOT IN (${SETTLED_COPY_STATES.map(() => '?').join(', ')})`)
+            .all(tenantId, scopeId, ...SETTLED_COPY_STATES);
+        const unsettled = unsettledCopyRefusal(scopeId, copies);
+        if (unsettled)
+            throw unsettled;
+        // Only an active scope: an archived or reaped one is not this pass's to judge.
         const rt = await this.openActiveScope(tenantId, scopeId);
-        return rt.actor.enqueue(async () => (await inspectUploadLink({ sql: spineSql(rt.db), now: this.clock() }, secret)).view);
+        const now = this.clock();
+        // #2350: a destructive pass needs the scope's own dry-run licence, asked before anything is
+        // listed, so a pass with nothing to condemn is refused all the same.
+        if (request.dryRun !== true)
+            await rt.actor.enqueue(() => refuseUnlicensedOrphanSweep(spineSql(rt.db), now));
+        // A scope with no blob store holds no bytes: answered as that, marked, after every guard above,
+        // so the platform's pass tells it from a failure and from a store that held nothing.
+        const stores = row?.vertical
+            ? this.directory.prepare('SELECT 1 FROM blob_stores WHERE tenant_id = ? AND vertical = ? LIMIT 1').get(tenantId, row.vertical)
+            : undefined;
+        if (!stores) {
+            // A scope that holds an attachment row does keep files: its missing store is a misconfiguration.
+            const holds = await rt.actor.enqueue(() => {
+                const table = rt.db.prepare(`SELECT 1 FROM sqlite_master WHERE type = 'table' AND name = '_substrat_attachments'`).get();
+                return table !== undefined && rt.db.prepare('SELECT 1 FROM _substrat_attachments LIMIT 1').get() !== undefined;
+            });
+            if (holds)
+                throw missingAttachmentStore(tenantId, scopeId);
+            return { listed: 0, candidates: 0, orphans: 0, deleted: 0, keys: [], dryRun: request.dryRun === true, bucket: 'none' };
+        }
+        const store = this.attachmentStore(tenantId, row?.vertical ?? null);
+        return sweepOrphanAttachments(store, scopeId, {
+            rowless: async (ids) => rt.actor.enqueue(() => rowlessAttachmentIds(spineSql(rt.db), ids)),
+            condemn: async (ids, at) => rt.actor.enqueue(() => rt.db.transaction(() => condemnLicensedOrphanAttachments(spineSql(rt.db), ids, at))()),
+            license: async (ids, at) => {
+                await rt.actor.enqueue(() => rt.db.transaction(() => recordOrphanSweepLicence(spineSql(rt.db), ids, at))());
+            },
+            licensed: async () => rt.actor.enqueue(() => licensedOrphanIds(spineSql(rt.db))),
+            consume: async (ids) => rt.actor.enqueue(() => rt.db.transaction(() => consumeOrphanSweepLicence(spineSql(rt.db), ids))()),
+        }, {
+            // The host's own clock, never a caller's: no request can step past the floor or the fence.
+            now,
+            ...(request.dryRun ? { dryRun: true } : {}),
+            ...(request.limit !== undefined ? { limit: request.limit } : {}),
+        });
+    }
+    /**
+     * #2314: the orphan sweep's restore fence for a scope whose rows are about to be replaced. A
+     * scope whose vertical has no blob store has no bytes, so nothing is fenced; a fence that cannot
+     * be written throws, and the caller refuses the replacement.
+     */
+    fenceOrphanSweep(tenantId, scopeId, vertical) {
+        const held = vertical
+            ? this.directory.prepare('SELECT 1 FROM blob_stores WHERE tenant_id = ? AND vertical = ? LIMIT 1').get(tenantId, vertical)
+            : undefined;
+        if (!held)
+            return Promise.resolve();
+        return fenceAttachmentSweep(this.attachmentStore(tenantId, vertical), scopeId, this.clock());
     }
     async redeemUploadLink(tenantId, scopeId, secret, input) {
         const rt = await this.openActiveScope(tenantId, scopeId);
-        const { view, mintedBy } = await rt.actor.enqueue(() => inspectUploadLink({ sql: spineSql(rt.db), now: this.clock() }, secret));
-        if (view.entity.entityType !== input.entity.entityType || view.entity.entityId !== input.entity.entityId) {
-            throw substratError('not_found', 'This upload link is not valid for that target.', {
-                reason: UPLOAD_LINK_WRONG_TARGET,
+        // The target first (the kernel judges it before the state), so a wrong path never reads as
+        // gone; a replay (#2315) is answered from the inspection and never reaches the write.
+        const inspect = () => rt.actor.enqueue(() => inspectUploadLink({ sql: spineSql(rt.db), now: this.clock() }, secret, input.entity, input.idempotencyKey));
+        return redeemOrReplayUploadLink(inspect, input, async ({ view, mintedBy }) => {
+            // The write is made AS the minter: the same gates `attachments()` puts in front of a person.
+            await this.getScope(mintedBy, tenantId, scopeId);
+            const scopeRow = this.directory
+                .prepare('SELECT vertical FROM scopes WHERE scope_id = ?')
+                .get(scopeId);
+            const files = this.buildAttachments(rt, asPrincipal(mintedBy), this.attachmentStore(tenantId, scopeRow?.vertical ?? null), { uploadLink: { secret, idempotencyKey: input.idempotencyKey } });
+            return files.upload({
+                entity: view.entity,
+                filename: view.filename ?? input.filename,
+                // Recorded as it is judged: the essence, never a parameter or a stray space.
+                contentType: normalizeUploadMediaType(input.contentType),
+                visibility: view.visibility,
+                body: input.body,
             });
-        }
-        // The write is made AS the minter: the same gates `attachments()` puts in front of a person.
-        await this.getScope(mintedBy, tenantId, scopeId);
-        const scopeRow = this.directory
-            .prepare('SELECT vertical FROM scopes WHERE scope_id = ?')
-            .get(scopeId);
-        const files = this.buildAttachments(rt, asPrincipal(mintedBy), this.attachmentStore(tenantId, scopeRow?.vertical ?? null), { uploadLinkSecret: secret });
-        return files.upload({
-            entity: view.entity,
-            filename: view.filename ?? input.filename,
-            contentType: input.contentType,
-            visibility: view.visibility,
-            body: input.body,
         });
     }
     async getSystemAttachments(moduleId, tenantId, scopeId) {
@@ -2314,6 +2418,8 @@ export class SqliteScopeHost {
                 try {
                     return await guarded('attachments.upload', async (ctx) => {
                         assertAllowed(await ctx.check(gate.write, input.entity));
+                        // #2314: an id the orphan sweep condemned takes no row, in this same transaction.
+                        refuseCondemnedAttachment(spineSql(rt.db), record.id);
                         rt.db
                             .prepare(`INSERT INTO _substrat_attachments
                    (id, entity_type, entity_id, filename, content_type, size, sha256,
@@ -2332,8 +2438,8 @@ export class SqliteScopeHost {
                         enqueueAttachmentText(spineSql(rt.db), record.id, ulid(), this.clock());
                         // An upload-link redemption spends its link HERE, in the same transaction as the
                         // row it produced: a refusal anywhere above or below rolls the spend back.
-                        if (opts.uploadLinkSecret !== undefined) {
-                            await redeemUploadLinkInTransaction({ sql: spineSql(rt.db), now: this.clock(), emit: (event) => kernelEmit(ctx, event) }, opts.uploadLinkSecret, record);
+                        if (opts.uploadLink !== undefined) {
+                            await redeemUploadLinkInTransaction({ sql: spineSql(rt.db), now: this.clock(), emit: (event) => kernelEmit(ctx, event) }, opts.uploadLink.secret, record, opts.uploadLink.idempotencyKey);
                         }
                         return record;
                     });
@@ -2473,6 +2579,16 @@ export class SqliteScopeHost {
             // rows are gone and the new ones are in. It also covers what a topological sort
             // cannot express: FK cycles, and self-referencing rows within one table.
             db.pragma('defer_foreign_keys = ON');
+            // A dump written before indexes were excluded may still carry them; skip those
+            // too rather than failing a restore over data that is about to be recomputed.
+            // Matched without case, as SQLite resolves a table name (#1883 review).
+            const replayable = dumped.filter((t) => !isSearchIndexTable(t.name.toLowerCase()));
+            // A Durable Object's dump carries spine tables this adapter keeps in its directory, or does
+            // not keep at all; they are skipped by name, and any other unknown spine table is refused.
+            const loadable = replayable.filter((t) => !DO_SCOPE_ONLY_SPINE_TABLES.has(t.name.toLowerCase()));
+            // #2314: a row for an id the orphan sweep condemned here is refused, as the insert refuses it.
+            // Judged on `loadable`, the very tables whose rows the replay below inserts, before any drop.
+            refuseCondemnedInDump(spineSql(db), loadable);
             // Drop the current schema: a vertical's tables are rebuilt from the dump's DDL, the
             // spine from KERNEL_DDL (below). Only real tables (never `sqlite_*` internals, which
             // are auto-managed and un-droppable).
@@ -2487,10 +2603,6 @@ export class SqliteScopeHost {
                     continue;
                 db.exec(`DROP TABLE IF EXISTS "${name}"`);
             }
-            // A dump written before indexes were excluded may still carry them; skip those
-            // too rather than failing a restore over data that is about to be recomputed.
-            // Matched without case, as SQLite resolves a table name (#1883 review).
-            const replayable = dumped.filter((t) => !isSearchIndexTable(t.name.toLowerCase()));
             // The dump is untrusted input (#1143): its names reach SQL as identifiers, and
             // `db.exec` would run every statement its `ddl` contains, not just the CREATE
             // TABLE. Judged as a whole before any of it executes — a check interleaved with
@@ -2502,9 +2614,6 @@ export class SqliteScopeHost {
             // contributes only rows, by column name (`dumpRowsInsert`). Otherwise a dump could
             // declare a column the checker compares on as COLLATE NOCASE. The column pass follows,
             // for the one outbox index KERNEL_DDL leaves to it.
-            // A Durable Object's dump carries spine tables this adapter keeps in its directory, or does
-            // not keep at all; they are skipped by name, and any other unknown spine table is refused.
-            const loadable = replayable.filter((t) => !DO_SCOPE_ONLY_SPINE_TABLES.has(t.name.toLowerCase()));
             // Comment-blanked (#2068), as the Durable Object replays it: the dump's DDL is
             // `sqlite_master.sql` verbatim, and `prepare` still compiles exactly one statement.
             for (const t of loadable)
@@ -2530,6 +2639,10 @@ export class SqliteScopeHost {
                 for (const row of t.rows)
                     stmt.run(...row);
             }
+            // #2350: the orphan sweep's licence describes this store's last dry run, never the dump's.
+            // A dump does not carry it; a hand-made one that does is dropped here all the same, so a
+            // loaded store's next pass is a dry run.
+            clearOrphanSweepLicence(spineSql(db));
             // #827 / #119 / #811: the search triggers, the archive/trash guard triggers, the purge
             // sweep's index and the derived list indexes went with the dropped tables, and the search index points at rows that are
             // gone. Put back, and the search index rebuilt, AFTER the rows — which may legitimately
@@ -2595,6 +2708,8 @@ export class SqliteScopeHost {
         if (!existing)
             throw substratError('not_found', `unknown scope ${scopeId} in tenant ${tenantId}`);
         this.refuseUnusableScopeStores(dump.stores, existing.vertical);
+        // #2314: the load replaces the scope's rows, so the orphan sweep is fenced first.
+        await this.fenceOrphanSweep(tenantId, scopeId, existing.vertical ?? null);
         // #1742: a dump from before a switch was pulled brings the module's grants back live, so
         // the directory's recorded-off modules go back off in the load's own turn, as a
         // provision's seat does — no schedule pass can run in between.
@@ -2828,7 +2943,7 @@ export class SqliteScopeHost {
     }
     /**
      * A dump's stores this host cannot load are refused before any write (#2211, L8): a
-     * binding that is not bound, a store with no kind or a kind other than the bound runner's,
+     * binding that is not bound, a store with no driver or a driver other than the bound runner's,
      * any store at all for a destination with no vertical (no store object can be named for
      * it, so loading would drop them), or a destination on a vertical other than the one this
      * host is pinned to.
@@ -2848,11 +2963,11 @@ export class SqliteScopeHost {
             if (!runner) {
                 throw substratError('not_found', `dump names scope store '${store.binding}', which is not bound`);
             }
-            if (!store.kind) {
-                throw substratError('validation_failed', `dump's scope store '${store.binding}' names no kind`);
+            if (!store.driver) {
+                throw substratError('validation_failed', `dump's scope store '${store.binding}' names no driver`);
             }
-            if (store.kind !== runner.kind) {
-                throw substratError('conflict', `dump's scope store '${store.binding}' is kind '${store.kind}', and this host binds kind '${runner.kind}'`);
+            if (store.driver !== runner.driver) {
+                throw substratError('conflict', `dump's scope store '${store.binding}' is driver '${store.driver}', and this host binds driver '${runner.driver}'`);
             }
         }
     }
@@ -2869,7 +2984,7 @@ export class SqliteScopeHost {
             if (!runner)
                 throw substratError('not_found', `no scope store is bound for '${binding}'`);
             const exported = await this.invokeReservedStore({ tenantId, vertical, scopeId, binding }, 'substrat.export');
-            stores.push({ binding, kind: runner.kind, tables: exported.tables });
+            stores.push({ binding, driver: runner.driver, tables: exported.tables });
         }
         return stores;
     }
@@ -3456,10 +3571,15 @@ export class SqliteScopeHost {
         const store = this.attachmentStore(tenantId, scopeRow?.vertical ?? null);
         return this.buildAttachments(rt, { kind: 'capability-session', hash }, store);
     }
-    /** Every registered module's `peers`, as one declaration per peer vertical (#1706). */
+    /**
+     * Every registered module's `peers`, as one declaration per peer vertical (#1706). Built once
+     * per registered module set and dropped by `registerModule` (#2263): the checker reads it on
+     * every check, so it must be a lookup, never a rebuild.
+     */
     peerDeclarations() {
-        return collectPeers(this.modules.values());
+        return (this.peerUnion ??= collectPeers(this.modules.values()));
     }
+    peerUnion;
     /**
      * The peer door (#1706) — mirror of the connection, system and capability doors. The caller is
      * the local broker's word (the platform's, on the pure host); the pair and lifecycle gate run
@@ -3833,7 +3953,8 @@ export class SqliteScopeHost {
             try {
                 if (schedule.purge) {
                     // #119: a purge horizon's schedule runs its operation once per due entity, never once.
-                    const pass = await this.runPurgeSweep(moduleId, tenantId, scopeId, schedule.operation);
+                    // #2192: under the run's own id, so the purges and their deliveries join this run's line.
+                    const pass = await this.runPurgeSweep(moduleId, tenantId, scopeId, schedule.operation, invocationId);
                     stillDue = purgeStillDue(pass);
                     const outcome = purgeReportOf(schedule.operation, schedule.purge.entityType, pass);
                     report.errors.push(...outcome.errors);
@@ -3904,7 +4025,9 @@ export class SqliteScopeHost {
      * through a purge stub (`openSystemScope`) that never leaves this method, each in its own
      * transaction and under the cutoff the host re-checks inside it (`refuseTrashedTarget`).
      */
-    async runPurgeSweep(moduleId, tenantId, scopeId, operation) {
+    async runPurgeSweep(moduleId, tenantId, scopeId, operation, 
+    /** #2192: the schedule run this pass belongs to; every purge in it runs under that id. */
+    runInvocationId) {
         const entityType = this.modules
             .get(moduleId)
             ?.schedules.find((s) => s.operation === operation && s.purge)?.purge?.entityType;
@@ -3931,7 +4054,7 @@ export class SqliteScopeHost {
             return heldPurgePass(due.held);
         const stub = await this.openSystemScope(moduleId, tenantId, scopeId, true);
         return runPurgePass(operation, due, async (entityId) => {
-            await stub.invoke(operation, { [due.idFrom]: entityId }, { invocationId: ulid() });
+            await stub.invoke(operation, { [due.idFrom]: entityId }, { invocationId: runInvocationId });
         }, (write) => rt.actor.turn(() => write(spineSql(rt.db))));
     }
     /**
@@ -4073,6 +4196,15 @@ export class SqliteScopeHost {
                     // `finally` so a later consumer carries none rather than the last caller's,
                     // which is the leak `causedBy` had to be moved off the host to avoid.
                     rt.invocationId = invokeOptions?.invocationId ?? null;
+                    // #2358: this call's trace, when `substrat dev` has installed a sink; undefined otherwise.
+                    const trace = invocationTrace(rt.invocationId);
+                    // #1672: the secrets this invocation mints — withheld from its idempotency recording,
+                    // and what the tripwire on its writes looks for. Declared here, outside the `try`, so the
+                    // trace's error step can withhold them from a message too.
+                    const minted = [];
+                    // #2358: the input error already recorded as a `validation` step, so the `error` step
+                    // below does not repeat its message.
+                    let refusedInput;
                     // The outbox's insertion mark, inside the actor task so nothing else writes between it
                     // and this invoke (`OUTBOX_MARK_SQL` says why rowid and not the id).
                     const exportMark = exportTypes.length > 0 ? Number(rt.db.prepare(OUTBOX_MARK_SQL).get().mark) : null;
@@ -4097,9 +4229,6 @@ export class SqliteScopeHost {
                             : authority.kind === 'vertical-peer'
                                 ? admitPeer(switchSqlOf(rt.db), this.peerDeclarations(), authority.caller, operation)
                                 : authority;
-                        // #1672: the secrets this invocation mints — withheld from its idempotency recording,
-                        // and what the tripwire on its writes looks for.
-                        const minted = [];
                         // Fresh per operation: the context carries the K-34 authorization accumulator,
                         // which must not leak across operations (invokes are serialized per scope).
                         // #119: the keys the module's system principal holds only for its purge schedules are
@@ -4110,6 +4239,7 @@ export class SqliteScopeHost {
                         const withheld = subject.kind === 'system'
                             ? withheldKeysFor(this.modules.get(subject.id)?.purgeOnlyKeys, target, purging)
                             : undefined;
+                        trace?.head({ operation, tenantId, scopeId, principalKind: subject.kind, principal: actorOf(subject) });
                         const ctx = this.operationContext(rt, subject, undefined, signals, session, operation, minted, undefined, undefined, withheld);
                         const clonedInput = structuredClone(input);
                         // #893: parse, don't trust — at the scope door, from the operation's own
@@ -4121,9 +4251,21 @@ export class SqliteScopeHost {
                         // schedule. That is the point — parsing at the mount alone would leave
                         // the demos' own suites exercising an unparsed path, and the wire is
                         // where the untrusted input actually arrives.
-                        const parsed = this.operationInput.has(operation)
-                            ? this.operationInput.get(operation).parse(clonedInput)
-                            : clonedInput;
+                        let parsed;
+                        try {
+                            parsed = this.operationInput.has(operation)
+                                ? this.operationInput.get(operation).parse(clonedInput)
+                                : clonedInput;
+                        }
+                        catch (err) {
+                            // #2358: the issues a refused input carries, with the dotted path of each.
+                            const issues = err?.issues;
+                            if (trace && Array.isArray(issues)) {
+                                trace.step({ type: 'validation', issues: issues.map((i) => ({ path: i.path.map(String).join('.'), message: i.message })) });
+                                refusedInput = err;
+                            }
+                            throw err;
+                        }
                         // #116: fingerprinted from the PARSED input, so a retry that omits an
                         // optional field the original sent at its default value is still the
                         // same request. Computed before `BEGIN` — it is a pure hash of what the
@@ -4271,7 +4413,22 @@ export class SqliteScopeHost {
                         }
                         return structuredClone(result);
                     }
+                    catch (err) {
+                        // #2358: the error that ended the call, with the secrets this call minted withheld.
+                        // A refused input was recorded above, issue by issue. Its error's message is those
+                        // issues as JSON, which can carry the values that failed, so it is not repeated here.
+                        trace?.step({
+                            type: 'error',
+                            code: errorCodeOf(err) ?? null,
+                            message: err === refusedInput
+                                ? 'input failed validation'
+                                : redactSecretText(err instanceof Error ? err.message : String(err), minted),
+                            ...(err !== refusedInput && err instanceof Error && err.stack ? { stack: redactSecretText(err.stack, minted) } : {}),
+                        });
+                        throw err;
+                    }
                     finally {
+                        forgetInvocationTrace(rt.invocationId);
                         // Cleared on BOTH paths, inside the task. The actor runs one task at a
                         // time, so a value left set here would be read by whichever task ran next
                         // and did not set its own — a connector drain, say — stamping its events
@@ -5531,10 +5688,15 @@ export class SqliteScopeHost {
             calls: callsOfManifestJson(r.manifest_json),
             createdAt: r.created_at,
         });
-        const readVersion = (id) => {
-            const r = this.directory
-                .prepare('SELECT * FROM vertical_versions WHERE id = ?')
-                .get(id);
+        // #2339: a version stored before the server derived migration digests is derived on its
+        // first read, so no gate here ever compares the digest its push sent.
+        const readVersion = async (id) => {
+            const read = () => this.directory.prepare('SELECT * FROM vertical_versions WHERE id = ?').get(id);
+            let r = read();
+            if (r && r.migration_digest_derived === null) {
+                await deriveVersionMigrationDigest(switchSqlOf(this.directory), id);
+                r = read();
+            }
             return r ? mapVersion(r) : undefined;
         };
         const mapOrg = (r) => orgSchema.parse({
@@ -5600,8 +5762,8 @@ export class SqliteScopeHost {
         });
         // The (version, scope) pair a bind and its impact read both start from, and the refusals
         // that come before any export-break question, in the order the bind makes them (#1756).
-        const bindTarget = (tenantId, scopeId, versionId) => {
-            const v = readVersion(versionId);
+        const bindTarget = async (tenantId, scopeId, versionId) => {
+            const v = await readVersion(versionId);
             if (!v)
                 throw substratError('not_found', `unknown version ${versionId}`);
             const scope = this.directory.prepare('SELECT * FROM scopes WHERE scope_id = ?').get(scopeId);
@@ -5982,7 +6144,7 @@ export class SqliteScopeHost {
                 throw substratError('not_found', `unknown scope for tenant: (${tenantId}, ${scopeId})`);
             }
             const rt = this.runtime(tenantId, scopeId);
-            const states = await rt.actor.turn(() => peerGrantsStatus(switchSqlOf(rt.db), new Date().toISOString()));
+            const states = await rt.actor.turn(() => peerGrantsStatus(switchSqlOf(rt.db), new Date().toISOString(), this.peerDeclarations()));
             const offPeers = new Set(states.filter((p) => p.calls === 'off').map((p) => p.vertical));
             const explanations = offPeers.size > 0 ? lastSwitchedOffBy(tenantId, scopeId, 'revokeFromPeer', 'vertical', offPeers) : new Map();
             const result = states.map((p) => ({
@@ -6638,20 +6800,26 @@ export class SqliteScopeHost {
                 // The SQL migrations are stored apart from the manifest (#1764), so no read of the
                 // version but the promote review's carries them.
                 const split = splitManifestMigrations(manifestJson ?? null, 'push');
+                // #2339: the digest a promote compares is the one derived from what is stored, never the pushed one.
+                const migrationDigest = await publishedMigrationDigest({
+                    id: audited.id, migrationDigest: audited.migrationDigest, manifestJson: manifestJson ?? null, migrations: split.migrations,
+                });
                 this.directory.transaction(() => {
                     this.directory
                         .prepare(`INSERT INTO vertical_versions
                  (id, vertical_slug, version, manifest_digest, permission_digest,
                   migration_digest, deployment_ref, admission, admission_note, manifest_json,
-                  origin_json, migration_count, migrations_split, created_at)
-               VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, 1, ?)`)
-                        .run(audited.id, audited.verticalSlug, audited.version, audited.manifestDigest, audited.permissionDigest, audited.migrationDigest, audited.deploymentRef, selfAdmits ? 'admitted' : 'pending', selfAdmits ? AUTO_ADMISSION_NOTE : null, split.manifestJson, origin ? JSON.stringify(origin) : null, split.migrations?.length ?? null, new Date().toISOString());
+                  origin_json, migration_count, migrations_split, migration_digest_derived, created_at)
+               VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, 1, 1, ?)`)
+                        .run(audited.id, audited.verticalSlug, audited.version, audited.manifestDigest, audited.permissionDigest, migrationDigest, audited.deploymentRef, selfAdmits ? 'admitted' : 'pending', selfAdmits ? AUTO_ADMISSION_NOTE : null, split.manifestJson, origin ? JSON.stringify(origin) : null, split.migrations?.length ?? null, new Date().toISOString());
                     writeVersionMigrations(switchSqlOf(this.directory), audited.id, split.migrations);
-                    // #2286: the version's scope-store bindings, refusing one re-kinded, in the insert's transaction.
+                    // #2286: the version's scope-store bindings, refusing one moved to another driver, in the insert's transaction.
                     indexVersionScopeStores(switchSqlOf(this.directory), audited.verticalSlug, audited.id, split.manifestJson);
                 })();
                 this.recordAdmin(actor, 'publishVersion', { tenantId: null }, null, {
                     ...audited,
+                    // The digest the registry holds, which differs from the pushed one only for an unheld version.
+                    migrationDigest,
                     ...(origin ? { origin } : {}),
                     admission: selfAdmits ? 'admitted' : 'pending',
                 });
@@ -6666,14 +6834,20 @@ export class SqliteScopeHost {
                 const where = ['vertical_slug = ?'];
                 const params = [verticalSlug];
                 const tail = keysetTail(where, params, 'id', page);
-                const rows = this.directory
-                    .prepare(`SELECT * FROM vertical_versions WHERE ${where.join(' AND ')}${tail}`)
-                    .all(...params);
+                const sql = `SELECT * FROM vertical_versions WHERE ${where.join(' AND ')}${tail}`;
+                let rows = this.directory.prepare(sql).all(...params);
+                // #2339: a page holding versions whose digest is still the pushed one derives them first.
+                const underived = rows.filter((r) => r.migration_digest_derived === null);
+                if (underived.length > 0) {
+                    for (const r of underived)
+                        await deriveVersionMigrationDigest(switchSqlOf(this.directory), r.id);
+                    rows = this.directory.prepare(sql).all(...params);
+                }
                 this.recordAccess(actor, 'listVersions', {}, { verticalSlug }, rows.length);
                 return rows.map(mapVersion);
             },
             getVersion: async (actor, versionId, verticalSlug) => {
-                const v = readVersion(versionId);
+                const v = await readVersion(versionId);
                 // A version of another vertical reads as absent when the caller named one.
                 const hit = v && (verticalSlug === undefined || v.verticalSlug === verticalSlug) ? v : undefined;
                 this.recordAccess(actor, 'getVersion', {}, { versionId, verticalSlug }, hit ? 1 : 0);
@@ -6690,7 +6864,7 @@ export class SqliteScopeHost {
                     const prod = this.directory
                         .prepare("SELECT version_id FROM vertical_channels WHERE vertical_slug = ? AND channel = 'prod'")
                         .get(slug);
-                    const prodVersion = prod ? readVersion(prod.version_id) : undefined;
+                    const prodVersion = prod ? await readVersion(prod.version_id) : undefined;
                     if (prodVersion?.admissionNote === AUTO_ADMISSION_NOTE) {
                         throw substratError('conflict', `vertical '${slug}' prod version ${prodVersion.id} is auto-admitted (private self-serve) — ` +
                             `a staff admit must vouch for it before listing`);
@@ -6771,7 +6945,7 @@ export class SqliteScopeHost {
                 this.recordAdmin(actor, 'deleteVertical', { tenantId: null }, { slug, source: existing.source, ownerTenant: existing.ownerTenant }, null);
             },
             admitVersion: async (actor, versionId) => {
-                const v = readVersion(versionId);
+                const v = await readVersion(versionId);
                 if (!v)
                     throw substratError('not_found', `unknown version ${versionId}`);
                 if (v.admission === 'admitted') {
@@ -6799,7 +6973,7 @@ export class SqliteScopeHost {
                 });
             },
             rejectVersion: async (actor, versionId, note) => {
-                const v = readVersion(versionId);
+                const v = await readVersion(versionId);
                 if (!v)
                     throw substratError('not_found', `unknown version ${versionId}`);
                 if (v.admission === 'admitted') {
@@ -6816,7 +6990,7 @@ export class SqliteScopeHost {
                 });
             },
             promotionImpact: async (actor, verticalSlug, channel, versionId) => {
-                const incoming = readVersion(versionId);
+                const incoming = await readVersion(versionId);
                 if (!incoming || incoming.verticalSlug !== verticalSlug) {
                     throw substratError('not_found', `unknown version ${versionId} for vertical '${verticalSlug}'`);
                 }
@@ -6828,7 +7002,7 @@ export class SqliteScopeHost {
                 return breaks;
             },
             promoteVersion: async (actor, verticalSlug, channel, versionId, acknowledge) => {
-                const incoming = readVersion(versionId);
+                const incoming = await readVersion(versionId);
                 if (!incoming)
                     throw substratError('not_found', `unknown version ${versionId}`);
                 if (incoming.verticalSlug !== verticalSlug) {
@@ -6840,7 +7014,7 @@ export class SqliteScopeHost {
                 const current = this.directory
                     .prepare('SELECT version_id FROM vertical_channels WHERE vertical_slug = ? AND channel = ?')
                     .get(verticalSlug, channel);
-                const outgoing = current ? readVersion(current.version_id) : undefined;
+                const outgoing = current ? await readVersion(current.version_id) : undefined;
                 const ack = promotionAcknowledgement.parse(acknowledge ?? {});
                 // The owning tenant's live scopes a PRIVATE prod promote re-points — below for an embedded
                 // vertical, after the in-place serve for a dispatch-backed one (#321) — read before
@@ -6863,6 +7037,18 @@ export class SqliteScopeHost {
                     served?.versionId,
                     ...owned.map((s) => runningVersionOf(mapScope(s), served)),
                 ], versionId, served || owned.length > 0 ? this.provisionedVersionsOf(verticalSlug, served, owned.length > 0 ? owning.ownerTenant : null) : []);
+                // #2333: the acknowledgements answer the review they were given against, or none at all.
+                const reviewed = (v) => ({
+                    ...v,
+                    migrations: versionMigrationsOf(switchSqlOf(this.directory), v.id)?.migrations ?? null,
+                });
+                await assertPromoteReviewCurrent({
+                    ack,
+                    channel,
+                    baseId: outgoing?.id ?? null,
+                    migrationsChange: outgoing !== undefined && outgoing.migrationDigest !== incoming.migrationDigest,
+                    read: async () => ({ base: outgoing ? reviewed(outgoing) : null, incoming: reviewed(incoming) }),
+                });
                 // §4's two checkpoints, fired where the blast radius is. A FIRST promotion
                 // has nothing to diff against, so there is nothing to acknowledge — the
                 // gate is about change, not about existence.
@@ -6872,8 +7058,7 @@ export class SqliteScopeHost {
                             `${incoming.permissionDigest}) — acknowledge it explicitly to promote`);
                     }
                     if (outgoing.migrationDigest !== incoming.migrationDigest && !ack.migrationChange) {
-                        throw substratError('conflict', `promotion changes migrations (${outgoing.migrationDigest} → ` +
-                            `${incoming.migrationDigest}) — acknowledge it explicitly to promote`);
+                        throw substratError('conflict', migrationChangeRefusal(outgoing.migrationDigest, incoming.migrationDigest));
                     }
                     // #1705 PR 3: an export an installed consumer imports, dropped or re-versioned.
                     if (!ack.exportBreak) {
@@ -6883,18 +7068,32 @@ export class SqliteScopeHost {
                     }
                 }
                 const promotedAt = new Date().toISOString();
-                this.directory
-                    .prepare(`INSERT INTO vertical_channels (vertical_slug, channel, version_id, updated_at)
-             VALUES (?, ?, ?, ?)
-             ON CONFLICT (vertical_slug, channel) DO UPDATE SET version_id = ?, updated_at = ?`)
-                    .run(verticalSlug, channel, versionId, promotedAt, versionId, promotedAt);
-                // The timeline row: what makes rollback a choice among recorded moments, and
-                // `at` the PITR anchor a data rollback would rewind to.
-                this.directory
-                    .prepare(`INSERT INTO vertical_channel_history
-               (id, vertical_slug, channel, version_id, from_version_id, actor, at)
-             VALUES (?, ?, ?, ?, ?, ?, ?)`)
-                    .run(ulid(), verticalSlug, channel, versionId, outgoing?.id ?? null, actor, promotedAt);
+                // #2333: a compare-and-set. Every gate above — the review binding, the digest checkpoints,
+                // the export breaks — was judged against `outgoing`, across awaits another promote can run
+                // in. So the pointer moves only if it still names `outgoing`, read and written in one
+                // transaction; the promote that lost the race is refused as stale and writes nothing.
+                const moved = this.directory.transaction(() => {
+                    const now = this.directory
+                        .prepare('SELECT version_id FROM vertical_channels WHERE vertical_slug = ? AND channel = ?')
+                        .get(verticalSlug, channel);
+                    if ((now?.version_id ?? null) !== (outgoing?.id ?? null))
+                        return false;
+                    this.directory
+                        .prepare(`INSERT INTO vertical_channels (vertical_slug, channel, version_id, updated_at)
+               VALUES (?, ?, ?, ?)
+               ON CONFLICT (vertical_slug, channel) DO UPDATE SET version_id = ?, updated_at = ?`)
+                        .run(verticalSlug, channel, versionId, promotedAt, versionId, promotedAt);
+                    // The timeline row: what makes rollback a choice among recorded moments, and
+                    // `at` the PITR anchor a data rollback would rewind to.
+                    this.directory
+                        .prepare(`INSERT INTO vertical_channel_history
+                 (id, vertical_slug, channel, version_id, from_version_id, actor, at)
+               VALUES (?, ?, ?, ?, ?, ?, ?)`)
+                        .run(ulid(), verticalSlug, channel, versionId, outgoing?.id ?? null, actor, promotedAt);
+                    return true;
+                })();
+                if (!moved)
+                    throw promoteRaceRefusal(channel);
                 // For a PRIVATE vertical, prod IS what the owner's apps run: re-point the
                 // owning tenant's live scopes in the same act, so merge-to-main (push +
                 // promote) is a complete deploy and a rollback promote reaches the running
@@ -6914,7 +7113,7 @@ export class SqliteScopeHost {
                 for (const s of incoming.deploymentRef ? [] : owned) {
                     if (s.vertical_version_id === versionId)
                         continue;
-                    const prev = s.vertical_version_id ? readVersion(s.vertical_version_id) : undefined;
+                    const prev = s.vertical_version_id ? await readVersion(s.vertical_version_id) : undefined;
                     if (prev && prev.migrationDigest !== incoming.migrationDigest) {
                         await this.snapshotScope(actor, s.tenant_id, s.scope_id);
                     }
@@ -6976,7 +7175,7 @@ export class SqliteScopeHost {
                 }));
             },
             bindingImpact: async (actor, tenantId, scopeId, versionId, opts) => {
-                const { v, scope } = bindTarget(tenantId, scopeId, versionId);
+                const { v, scope } = await bindTarget(tenantId, scopeId, versionId);
                 // #2178: a move no acknowledgement passes is refused here too, so a caller asking first
                 // (an adopt, an Update) stops before anything is copied.
                 this.assertBindingShapesKept(mapScope(scope), versionId, opts?.servingRef);
@@ -6985,22 +7184,30 @@ export class SqliteScopeHost {
                 return breaks;
             },
             bindScopeVersion: async (actor, tenantId, scopeId, versionId, opts) => {
-                const { v, scope } = bindTarget(tenantId, scopeId, versionId);
-                if (opts?.expectedVersionId !== undefined && scope.vertical_version_id !== opts.expectedVersionId) {
-                    throw substratError('precondition_failed', 'scope binding changed; reload the scope and retry');
-                }
+                const { v, scope } = await bindTarget(tenantId, scopeId, versionId);
+                // #2347: a rebind judged against both lineages loses its race as stale, so its client reads
+                // the review again; any other conditional bind keeps the refusal it always had.
+                const lost = () => opts?.expectedServing
+                    ? rebindRaceRefusal(opts.expectedServing.vertical)
+                    : substratError('precondition_failed', 'scope binding changed; reload the scope and retry');
+                if (opts?.expectedVersionId !== undefined && scope.vertical_version_id !== opts.expectedVersionId)
+                    throw lost();
+                if (opts?.expectedServing && !this.servesNow(opts.expectedServing))
+                    throw lost();
                 const epoch = this.directory.prepare('SELECT COALESCE(erasure_epoch, 0) AS erasure_epoch FROM scopes WHERE tenant_id = ? AND scope_id = ?')
                     .get(tenantId, scopeId);
                 if (opts?.expectedErasureEpoch !== undefined && epoch?.erasure_epoch !== opts.expectedErasureEpoch) {
                     throw substratError('precondition_failed', 'scope erasure changed; reload the scope and retry');
                 }
                 const ack = bindAcknowledgement.parse(opts?.acknowledge ?? {});
+                // #2347: a route moving in the same write is judged with it, as `bindingImpact` is.
+                const servingRef = opts?.servingRef;
                 // #2178 first: no acknowledgement passes it, so none should be asked for ahead of it.
-                this.assertBindingShapesKept(mapScope(scope), versionId);
+                this.assertBindingShapesKept(mapScope(scope), versionId, servingRef);
                 // #1756: an export an app in this tenant imports, dropped or re-versioned by what this
                 // scope would run. Before the snapshot, so a refused bind leaves nothing behind.
                 if (!ack.exportBreak) {
-                    const breaks = await this.bindBreaks(actor, mapScope(scope), v);
+                    const breaks = await this.bindBreaks(actor, mapScope(scope), v, servingRef);
                     if (breaks.length > 0)
                         throw substratError('precondition_failed', bindExportBreakRefusal(breaks));
                 }
@@ -7008,19 +7215,29 @@ export class SqliteScopeHost {
                 // crosses a migration boundary. Gated on a real digest change — a code-only
                 // rebind snapshots nothing — and on the caller opting in (until GC ships).
                 if (opts?.snapshot && scope.vertical_version_id) {
-                    const outgoing = readVersion(scope.vertical_version_id);
+                    const outgoing = await readVersion(scope.vertical_version_id);
                     if (outgoing && outgoing.migrationDigest !== v.migrationDigest) {
                         await this.snapshotScope(actor, tenantId, scopeId);
                     }
                 }
-                if (!this.moveScopeRow('vertical_version_id = ?, vertical = ?', [versionId, v.verticalSlug], tenantId, scopeId, opts)) {
-                    throw substratError('precondition_failed', 'scope binding changed; reload the scope and retry');
-                }
-                this.recordAdmin(actor, 'bindScopeVersion', { tenantId, scopeId }, null, {
+                const moved = servingRef === undefined
+                    ? this.moveScopeRow('vertical_version_id = ?, vertical = ?', [versionId, v.verticalSlug], tenantId, scopeId, opts)
+                    : this.moveScopeRow('vertical_version_id = ?, vertical = ?, serving_ref = ?', [versionId, v.verticalSlug, servingRef], tenantId, scopeId, opts);
+                if (!moved) {
+                    // The erasure and copy-move conditions keep their own refusal: only a moved binding or a
+                    // moved serving version is the race a rebind's review answers.
+                    const now = this.directory.prepare('SELECT vertical_version_id FROM scopes WHERE scope_id = ?').get(scopeId);
+                    const raced = (opts?.expectedVersionId !== undefined && now?.vertical_version_id !== opts.expectedVersionId)
+                        || (opts?.expectedServing !== undefined && !this.servesNow(opts.expectedServing));
+                    throw raced ? lost() : substratError('precondition_failed', 'scope binding changed; reload the scope and retry');
+                }
+                this.recordAdmin(actor, 'bindScopeVersion', { tenantId, scopeId }, servingRef === undefined ? null : { servingRef: scope.serving_ref }, {
                     versionId,
                     vertical: v.verticalSlug,
                     version: v.version,
+                    ...(servingRef !== undefined ? { servingRef } : {}),
                     ...(opts?.expectedVersionId !== undefined ? { expectedVersionId: opts.expectedVersionId } : {}),
+                    ...(opts?.expectedServing ? { expectedServing: opts.expectedServing } : {}),
                     ...(ack.exportBreak ? { acknowledged: ack } : {}),
                 });
             },
@@ -7205,7 +7422,7 @@ export class SqliteScopeHost {
                 const ack = bindAcknowledgement.parse(opts?.acknowledge ?? {});
                 // #1756: onto (or off) a serving script, the scope runs other code before its pointer
                 // moves. Judged here, so no caller that routes first and binds second passes unasked.
-                const bound = scope.vertical_version_id ? readVersion(scope.vertical_version_id) : undefined;
+                const bound = scope.vertical_version_id ? await readVersion(scope.vertical_version_id) : undefined;
                 if (bound)
                     this.assertBindingShapesKept(mapScope(scope), bound.id, servingRef);
                 if (!ack.exportBreak && bound) {
@@ -7782,48 +7999,74 @@ export class SqliteScopeHost {
                     createdAt: r.created_at,
                 }));
             },
-            // -- store-kind releases, rollouts and holds (D-63, #2300) -------------------
-            // The state is kernel code over the directory (store-kind-releases.ts), shared with the
+            // -- store-driver releases, rollouts and holds (D-63, #2300) -------------------
+            // The state is kernel code over the directory (store-driver-releases.ts), shared with the
             // Cloudflare control plane; each call is one transaction. A hold's expiry is judged against
             // this host's clock, so a test can let a lease lapse without waiting.
-            recordStoreKindRelease: async (actor, input) => {
+            recordStoreDriverRelease: async (actor, input) => {
                 const at = this.clock();
-                const { record, created } = this.directory.transaction(() => recordStoreKindReleaseIn(switchSqlOf(this.directory), { ...input, actor, at }))();
+                const { record, created } = this.directory.transaction(() => recordStoreDriverReleaseIn(switchSqlOf(this.directory), { ...input, actor, at }))();
                 if (created)
-                    this.recordAdmin(actor, 'uploadStoreKindRelease', { tenantId: null }, null, record, at);
+                    this.recordAdmin(actor, 'uploadStoreDriverRelease', { tenantId: null }, null, record, at);
                 return record;
             },
-            getStoreKindRelease: async (actor, kind, sha256) => {
-                const record = storeKindReleaseIn(switchSqlOf(this.directory), kind, sha256);
-                this.recordAccess(actor, 'getStoreKindRelease', { tenantId: null }, { kind, sha256 }, record ? 1 : 0);
+            getStoreDriverRelease: async (actor, driver, sha256) => {
+                const record = storeDriverReleaseIn(switchSqlOf(this.directory), driver, sha256);
+                this.recordAccess(actor, 'getStoreDriverRelease', { tenantId: null }, { driver, sha256 }, record ? 1 : 0);
                 return record;
             },
-            storeKindState: async (actor, kind) => {
-                const state = storeKindStateIn(switchSqlOf(this.directory), kind, Date.parse(this.clock()));
-                this.recordAccess(actor, 'storeKindState', { tenantId: null }, { kind }, state.rollouts.length);
+            storeDriverState: async (actor, driver) => {
+                const state = storeDriverStateIn(switchSqlOf(this.directory), driver, Date.parse(this.clock()));
+                this.recordAccess(actor, 'storeDriverState', { tenantId: null }, { driver }, state.rollouts.length);
                 return state;
             },
-            storeKindDeclarations: async (actor, kind) => {
-                const declared = this.directory.transaction(() => kindDeclarationsOf(switchSqlOf(this.directory), kind))();
-                this.recordAccess(actor, 'storeKindDeclarations', { tenantId: null }, { kind }, declared.verticals.length);
+            storeDriverDeclarations: async (actor, driver) => {
+                const declared = this.directory.transaction(() => driverDeclarationsOf(switchSqlOf(this.directory), driver))();
+                this.recordAccess(actor, 'storeDriverDeclarations', { tenantId: null }, { driver }, declared.verticals.length);
                 return declared;
             },
-            holdStoreKind: async (_actor, input) => this.directory.transaction(() => holdStoreKindIn(switchSqlOf(this.directory), { ...input, nowMs: Date.parse(this.clock()) }))(),
-            releaseStoreKindHold: async (_actor, input) => {
-                releaseStoreKindHoldIn(switchSqlOf(this.directory), input);
+            storeDriverRolloutPending: async (actor, input) => {
+                const page = this.directory.transaction(() => storeDriverRolloutPendingIn(switchSqlOf(this.directory), input))();
+                this.recordAccess(actor, 'storeDriverRolloutPending', { tenantId: null }, { driver: input.driver, sha256: input.sha256, action: input.action }, page.verticals.length);
+                return page;
+            },
+            storeDriverRolloutWalked: async (actor, input) => {
+                const walked = this.directory.transaction(() => storeDriverRolloutWalkedIn(switchSqlOf(this.directory), input))();
+                this.recordAccess(actor, 'storeDriverRolloutWalked', { tenantId: null }, { driver: input.driver, seq: input.seq }, walked.verticals.length);
+                return walked;
+            },
+            holdStoreDriver: async (_actor, input) => this.directory.transaction(() => holdStoreDriverIn(switchSqlOf(this.directory), { ...input, nowMs: Date.parse(this.clock()) }))(),
+            releaseStoreDriverHold: async (_actor, input) => {
+                releaseStoreDriverHoldIn(switchSqlOf(this.directory), input);
             },
-            beginStoreKindRollout: async (actor, input) => {
+            beginStoreDriverRollout: async (actor, input) => {
                 const at = this.clock();
-                const row = this.directory.transaction(() => beginStoreKindRolloutIn(switchSqlOf(this.directory), { ...input, actor, at, nowMs: Date.parse(at) }))();
-                this.recordAdmin(actor, input.action === 'rollback' ? 'rollBackStoreKind' : 'rollOutStoreKind', { tenantId: null }, null, row, at);
+                const row = this.directory.transaction(() => beginStoreDriverRolloutIn(switchSqlOf(this.directory), { ...input, actor, at, nowMs: Date.parse(at) }))();
+                this.recordAdmin(actor, input.action === 'rollback' ? 'rollBackStoreDriver' : 'rollOutStoreDriver', { tenantId: null }, null, row, at);
                 return row;
             },
-            finishStoreKindRollout: async (actor, input) => {
+            finishStoreDriverRollout: async (actor, input) => {
                 const at = this.clock();
-                const row = this.directory.transaction(() => finishStoreKindRolloutIn(switchSqlOf(this.directory), { ...input, at, nowMs: Date.parse(at) }))();
-                this.recordAdmin(actor, row.action === 'rollback' ? 'rollBackStoreKind' : 'rollOutStoreKind', { tenantId: null }, null, row, at);
+                const row = this.directory.transaction(() => finishStoreDriverRolloutIn(switchSqlOf(this.directory), { ...input, at, nowMs: Date.parse(at) }))();
+                this.recordAdmin(actor, row.action === 'rollback' ? 'rollBackStoreDriver' : 'rollOutStoreDriver', { tenantId: null }, null, row, at);
                 return row;
             },
+            storeDriverRebuild: async (actor, driver) => {
+                const rebuild = storeDriverRebuildIn(switchSqlOf(this.directory), driver);
+                this.recordAccess(actor, 'storeDriverRebuild', { tenantId: null }, { driver }, rebuild ? 1 : 0);
+                return rebuild;
+            },
+            claimStoreDriverRebuild: async (_actor, input) => {
+                const at = this.clock();
+                return this.directory.transaction(() => claimStoreDriverRebuildIn(switchSqlOf(this.directory), { ...input, at, nowMs: Date.parse(at) }))();
+            },
+            advanceStoreDriverRebuild: async (_actor, input) => {
+                const at = this.clock();
+                return this.directory.transaction(() => advanceStoreDriverRebuildIn(switchSqlOf(this.directory), { ...input, at, nowMs: Date.parse(at) }))();
+            },
+            recordStoreDriverRebuildRun: async (actor, entry) => {
+                this.recordAdmin(actor, 'rebuildStoreDriver', { tenantId: null }, null, entry, this.clock());
+            },
             getScopeRecord: async (actor, tenantId, scopeId) => {
                 const r = this.directory.prepare('SELECT * FROM scopes WHERE scope_id = ?').get(scopeId);
                 // Cross-check the pair (K-3): a scope that exists under a DIFFERENT tenant
@@ -7958,7 +8201,10 @@ export class SqliteScopeHost {
                     // `.raw(true)` gives positional rows; cells stay as-is (blobs are Buffers, not
                     // nulled as in a UI read) so the dump is byte-faithful. The name is from the live
                     // schema, never user input, so the quoted identifier is safe.
-                    const stmt = db.prepare(`SELECT * FROM "${name}"`).raw(true);
+                    // #2350: the orphan sweep's licence is this store's own, so its rows never leave in a dump.
+                    const stmt = db
+                        .prepare(name === ATTACHMENT_SWEEP_LICENCE_TABLE ? `SELECT * FROM "${name}" WHERE 0` : `SELECT * FROM "${name}"`)
+                        .raw(true);
                     const rows = stmt.all();
                     const columns = stmt.columns().map((c) => c.name);
                     return { name, ddl: sql, columns, rows };
@@ -8915,6 +9161,11 @@ export class SqliteScopeHost {
                 const { tenantId, scopeId, action, ...after } = copyMarkAudit.parse(entry);
                 this.recordAdmin(actor, action === 'mark' ? 'markScopeCopy' : 'clearScopeCopyMark', { tenantId, scopeId }, null, after);
             },
+            /** #2314: one orphan-attachment pass over a scope, written after the vertical's own pass. */
+            recordOrphanSweep: async (actor, entry) => {
+                const { tenantId, scopeId, ...after } = orphanSweepAudit.parse(entry);
+                this.recordAdmin(actor, 'sweepOrphanAttachments', { tenantId, scopeId }, null, after);
+            },
             accessLog: async (actor, filter) => {
                 const where = [];
                 const params = [];
@@ -9373,7 +9624,8 @@ export class SqliteScopeHost {
             const moved = this.directory.prepare(`UPDATE scopes SET ${set} WHERE scope_id = ?
          ${cond?.expectedVersionId === undefined ? '' : 'AND vertical_version_id IS ?'}
          ${cond?.expectedErasureEpoch === undefined ? '' : 'AND COALESCE(erasure_epoch, 0) = ? AND reap_claimed_at IS NULL'}
-         ${cond?.confirmMove === undefined ? '' : COPY_MOVE_LIVE_PREDICATE}`).run(...setArgs, scopeId, ...(cond?.expectedVersionId === undefined ? [] : [cond.expectedVersionId]), ...(cond?.expectedErasureEpoch === undefined ? [] : [cond.expectedErasureEpoch]), ...(cond?.confirmMove === undefined ? [] : copyMoveLiveParams(cond.confirmMove, now)));
+         ${cond?.confirmMove === undefined ? '' : COPY_MOVE_LIVE_PREDICATE}
+         ${cond?.expectedServing === undefined ? '' : SERVES_NOW_PREDICATE}`).run(...setArgs, scopeId, ...(cond?.expectedVersionId === undefined ? [] : [cond.expectedVersionId]), ...(cond?.expectedErasureEpoch === undefined ? [] : [cond.expectedErasureEpoch]), ...(cond?.confirmMove === undefined ? [] : copyMoveLiveParams(cond.confirmMove, now)), ...(cond?.expectedServing === undefined ? [] : servesNowParams(cond.expectedServing)));
             if (moved.changes === 0)
                 return false;
             if (cond?.confirmMove) {
@@ -9383,6 +9635,10 @@ export class SqliteScopeHost {
             return true;
         })();
     }
+    /** #2347: whether a lineage's serving script still runs the version a rebind was judged against. */
+    servesNow(expected) {
+        return this.directory.prepare(`SELECT 1 FROM verticals WHERE ${SERVES_NOW_CONDITION}`).get(...servesNowParams(expected)) !== undefined;
+    }
     ensureColumn(db, table, column, ddl) {
         // Without case, as SQLite resolves a column name: a restore may have added this column
         // already, untyped and spelled as a newer kernel's dump spelled it (#1883).
@@ -9805,7 +10061,7 @@ export class SqliteScopeHost {
         // Lifted out of the object literal so `grant` can reuse it: a delegation
         // check has to be the SAME check the operation itself passes, or the two
         // could disagree about what the caller holds.
-        const runCheck = async (unparsed, entity) => {
+        const decideCheck = async (unparsed, entity) => {
             // #1642: parsed before the override actor's early return, which never reaches
             // the checker — a cast key would otherwise become that path's proof relation.
             const permission = assertPermissionKey(unparsed);
@@ -9834,6 +10090,59 @@ export class SqliteScopeHost {
             }
             return decision;
         };
+        // #2358: the same check, recorded. It reads the decision `decideCheck` already made and
+        // changes nothing about it; the explanation of a refusal (which roles would have allowed it,
+        // which the caller holds) is gathered only when a sink is installed.
+        // Only inside a call that has an id on the runtime: a background delivery's fresh id would
+        // open a trace nothing ever ends.
+        const trace = invocationTrace(rt.invocationId);
+        const runCheck = trace
+            ? async (unparsed, entity) => {
+                const started = trace.now();
+                const decision = await decideCheck(unparsed, entity);
+                // Taken before the explanation below, which reads the role table and the checker's
+                // holdings: the step times the check, not the work of describing a refusal.
+                const durationMs = Math.max(0, Math.round(trace.now() - started));
+                let requires = [];
+                let callerHas = [];
+                if (!decision.allowed) {
+                    try {
+                        const prefix = `${rt.tenantId}/`;
+                        requires = [...this.roles.entries()]
+                            .filter(([key, role]) => key.startsWith(prefix) && role.permissions.includes(decision.checked))
+                            .map(([, role]) => role.key);
+                        // On one entity, a grant on that entity would also have allowed it: say so, so the
+                        // trace does not point at assigning a role when the missing piece is a grant.
+                        if (entity)
+                            requires.push(`grant:${decision.checked}@${entityString(entity)}`);
+                        if (subject.kind === 'principal' && this.checker.holdings) {
+                            const held = await this.checker.holdings(asPrincipal(subject.id), { tenantId: rt.tenantId, scopeId: rt.scopeId });
+                            callerHas = [
+                                ...held.roles,
+                                ...held.granted.filter((p) => p === decision.checked).map((p) => `grant:${p}`),
+                                ...held.narrowed
+                                    .filter((n) => n.permission === decision.checked)
+                                    .map((n) => `grant:${n.permission}@${entityString(n.entity)}`),
+                            ];
+                        }
+                    }
+                    catch {
+                        /* an explanation that cannot be gathered is left empty, never an error */
+                    }
+                }
+                trace.step({
+                    type: 'check',
+                    permission: decision.allowed ? String(unparsed) : decision.checked,
+                    entity: entityString(entity),
+                    allowed: decision.allowed,
+                    decidedBy: decision.allowed ? decidedByOf(decision.proof) : null,
+                    requires,
+                    callerHas,
+                    durationMs,
+                });
+                return decision;
+            }
+            : decideCheck;
         const runCanAssign = (roleKey) => this.assignmentBound(subject, rt.tenantId, rt.scopeId, roleKey);
         // ctx.emit's writer, and the kernel's own events' (#1864): one path to the outbox, with the
         // reserved-type refusal applied to module code only. Never handed to module code as-is.
@@ -9882,6 +10191,8 @@ export class SqliteScopeHost {
             // #1237: a fact about the surrounding CALL, like the version above — never
             // envelope data module code could set or branch on.
             rt.invocationId, full.payload === undefined ? null : JSON.stringify(full.payload));
+            // #2358: type and entity only; the payload stays out of the trace.
+            trace?.step({ type: 'emit', eventType: full.type, entity: `${full.entity.entityType}:${full.entity.entityId}` });
         };
         // #2192: the call's invocation id, one reader for `ctx.log` and `ctx.requestId`.
         const requestIdNow = () => rt.invocationId ?? delivery?.invocationId ?? null;
@@ -9890,12 +10201,13 @@ export class SqliteScopeHost {
             scopeId: rt.scopeId,
             principal,
             pageContinuation: (list, query) => visibleContinuation(this.continuationStore(rt.scopeId, impersonation?.mode !== 'read-only' && this.isPrimaryInDirectory(rt.scopeId)), { scopeId: rt.scopeId, principal: `${subject.kind}:${subject.id}`, operation: operation ?? 'kernel', list, query }, () => Date.parse(this.clock()), () => ctxRef.log.info('legacy filtered-list cursor accepted', { list }), impersonation?.mode !== 'read-only' && this.isPrimaryInDirectory(rt.scopeId)),
-            sql: guardSecrets(guardSqlLimits(scopedSql(rt.db, true, statefulTablesOf(statePlans), 
+            // #2358: the outermost layer, so a statement refused by a guard below is recorded too.
+            sql: tracedSql(guardSecrets(guardSqlLimits(scopedSql(rt.db, true, statefulTablesOf(statePlans), 
             // #119 / #2090: after runtime DDL, inside this operation's transaction, what the kernel
             // derived onto any table is repaired — and a lost state column fails the operation.
             derivesAnything(this.derivedPlans())
                 ? () => afterRuntimeDdl(spineSql(rt.db), (ddl) => execSqlStatements(rt.db, ddl), this.derivedPlans())
-                : undefined)), minted),
+                : undefined)), minted), trace, (text) => redactSecretText(text, minted), (value) => redactSecrets(value, minted)),
             now: () => at,
             // #1746/#1747: the host stamps who and where; module code supplies only the template
             // and its fields. The invocation id is read per call — it is set for the duration of
@@ -9910,7 +10222,12 @@ export class SqliteScopeHost {
                 // The string-safe redaction: `redactSecrets` parses its serialization back, and a
                 // log's text is not JSON.
                 redact: (text) => redactSecretText(text, minted),
-            }, this.logSink),
+            }, trace
+                ? (line) => {
+                    trace.step({ type: 'log', level: line.level, message: line.message });
+                    this.logSink(line);
+                }
+                : this.logSink),
             // #2192: the same id the log lines carry.
             get requestId() {
                 return requestIdNow();
@@ -10210,6 +10527,14 @@ export class SqliteScopeHost {
                 await this.repairDerived(rt);
             return;
         }
+        // #2349: before any SQL, the registered set is held to the one stored for this version.
+        // Only here, so a scope with nothing pending never computes it.
+        const unstored = await migrationSetDivergence(this.modules.values(), this.migrationsDigest);
+        if (unstored) {
+            const refused = { version: `${pending[0].moduleId}@${pending[0].migration.version}`, error: unstored };
+            this.recordMigrationState(rt, refused);
+            throw migrationFailedError(refused.version, refused.error);
+        }
         // The failing `module@version` and its cause, captured structurally rather than
         // re-parsed out of the thrown message — the directory record has to name both.
         let failure;
@@ -10243,7 +10568,8 @@ export class SqliteScopeHost {
                             assertMigrationLeavesLedgerAlone(migration.sql, `migration ${key}`);
                             // #2068: one statement at a time, keeping the table set either side of each — the
                             // same splitter the Durable Object runs, so both hosts execute identical statements.
-                            const steps = runMigrationStatements(spineSql(rt.db), migration.sql, (stmt) => rt.db.exec(stmt));
+                            // #115: an authored one is also held to the data-loss fence, inside this transaction.
+                            const steps = runMigrationStatements(spineSql(rt.db), migration, (stmt) => rt.db.exec(stmt), { key, authored });
                             assertTablesWithinColumnLimit(rt.db);
                             // #2090: the state columns this migration must have left, and after the last of the
                             // pass, the triggers and indexes a create-copy-rename rebuild dropped.
@@ -10523,6 +10849,9 @@ export class SqliteScopeHost {
         // #2009: the copy classification on a scope DB built before it (NULL reads as a copy; see
         // `COPY_ORIGIN_DDL`).
         this.ensureColumn(db, '_substrat_copy_origin', 'is_copy', 'is_copy INTEGER');
+        // #2315: the hash of the key a redemption carried, on a scope DB built before it. NULL = the
+        // spending request carried none, the honest reading of every link already spent.
+        this.ensureColumn(db, '_substrat_upload_links', 'redeemed_key_hash', 'redeemed_key_hash TEXT');
         // #1237: `readInvocation`'s lookup — WHERE invocation_id = ? ORDER BY id — over an outbox
         // that is never pruned. No index leads with invocation_id, so without this one SQLite
         // walks the PRIMARY KEY from the oldest event until it reaches the call, and reading a