@substrat-run/adapter-sqlite 0.159.0 → 0.161.0

package/dist/index.js

@@ -1,11 +1,13 @@
-import { existsSync, mkdirSync, readdirSync, readFileSync, realpathSync, rmSync, writeFileSync } from 'node:fs';
+import { createHash } from 'node:crypto';
+import { closeSync, existsSync, fstatSync, mkdirSync, openSync, readdirSync, readFileSync, readSync, realpathSync, rmSync, writeFileSync, writeSync } from 'node:fs';
 import { dirname, join } from 'node:path';
 import Database from 'better-sqlite3';
-import { accessLogEntry, adminLogEntry, delegatedReadParams, operationSeriesCount, opsFailureEntry, opsFailureFingerprint, issueEntry, FRESHNESS_HEARTBEAT_MINUTES, sweepRunEntry, modelUsageEntry, ATTACHMENT_ADDED, ATTACHMENT_REMOVED, attachmentRecord, createTenantInput, domainEvent, domainEventInput, exportReadInput, importBatch, importCursorMove, exportsOfManifestJson, assertNoBindingShapeBreak, importsOfManifestJson, connectionLandingsOfManifestJson, entitlementGrant, entitlementGrantInput, eventId, meterReading, platformRequestInput, platformRequestId, MAX_PENDING_PLATFORM_REQUESTS, identityLink, identityPool, instant, isSubstratError, connection, capabilityGrant, connectionGrant, connectionGrantRecord, connectionSecret, systemGrant, systemSwitch, systemSwitchRecord, peerSwitch, verticalCaller, verticalSlug as verticalSlugOf, subjectRef, requestFingerprint, createConnectionInput, connectLinkFilter, connectLinkKey, consumeConnectLinkInput, mintConnectLinkInput, projectedConnectionGrant, projectedConnectionKey, moduleManifest, createOrgInput, promotionAcknowledgement, bindAcknowledgement, bindHostnameInput, channelHistoryEntry, hostnameBinding, publishVersionInput, AUTO_ADMISSION_NOTE, routeTarget, ROUTE_SCOPE_HOSTNAMES_MAX, registerVerticalInput, vertical as verticalSchema, verticalChannel, verticalVersion, objectRef, entityObjectRef, assertModuleEmittableType, assertKernelAuthoredType, grantRefFromProof, org as orgSchema, orgMembership, principalId, resolvedIdentity, identityMembership, roleDefinition, scope as scopeSchema, tenant as tenantSchema, tenantRole, principalBecomeCapabilityInput, subjectShredReceipt, SCOPE_TABLE_PAGE_DEFAULT, SCOPE_TABLE_PAGE_MAX, SCOPE_QUERY_ROW_MAX, verticalServingState, callsOfManifestJson, outboundOfManifestJson, listLimitOf, pageOf, countedPageOf, SCOPE_GATE_REASONS, substratError, assertReplayableDump, delegatedReadRecord, ownerTransferAudit, memberChangeAudit, peerBindingAudit, connectionBindingAudit, copyMarkAudit, orphanSweepAudit, redrainEventsInput, REDRAIN_BATCH, errorCodeOf, } from '@substrat-run/contracts';
-import { actorOf, asPrincipal, assertAllowed, assertNoSecret, assertPermissionKey, CAPABILITY_DDL, UPLOAD_LINK_DDL, createAttachmentVerbs, inspectUploadLink, redeemUploadLinkInTransaction, redeemOrReplayUploadLink, COPY_ORIGIN_DDL, ENTITY_STATE_MOVES_DDL, CAPABILITY_EXCHANGE_OPERATION, CAPABILITY_BECOME_MINT_OPERATION, becomeMintCheck, mintBecomeCapabilityAsPrincipal, revokeBecomeCapabilityAsPrincipal, readBecomeLinkStates, ENTITY_UNBIND_OPERATION, allowedFor, unbindEntityHolderBounded, capabilityAttachmentWriteRefused, capabilityTokenHash, createCapabilityVerbs, createEntityEdgeVerbs, createEntityStateVerbs, createTrashedReads, CONTINUATION_POSITION_CAP, visibleContinuation, searchStateWhere, uncheckedView, addStatePlans, addUpdatedStampPlans, watchUpdatedStamps, entityStateMigrations, assertNoCallerPurge, isUnreachableParent, heldPurgePass, purgeDueOf, purgeHeldBy, lifecycleRefusal, purgeOnlyKeysOf, purgeReportOf, purgeStillDue, refuseTrashedTarget, assertBoundOperations, checkHeldOperationsOf, countChecks, noteUncheckedCompletion, registerTrashTargets, runPurgePass, withheldKeysFor, statefulTablesOf, afterMigration, afterRuntimeDdl, derivesAnything, repairDerivedObjects, StateColumnLost, exchangeCapability as exchangeCapabilitySecret, guardSecrets, mintBecomeCapability, plausibleSessionToken, readCapabilityPage, redactSecrets, redactSecretText, moduleLog, consoleLogSink, asyncInvocationId, asyncLinePass, consoleInvocationLineSink, resolveCapabilitySession, revokeCapabilityAsPlatform, assertReadOnlyQuery, attachmentBlobKey, attachmentSha256, entitlementDenial, requiredEntitlementFor, foldMeterReading, guardSpine, guardSqlLimits, DO_SQL_LIMITS, tooManyResultColumns, tooManyTableColumns, parseValidationRecords, resolveScopeRecord, ulid, ISSUE_RETENTION_DAYS, telemetryRetentionStatements, FINDINGS_DDL, SCOPE_STORAGE_DDL, forgetScopeStorage, listScopeStorageAttemptRows, listScopeStorageRows, listScopeStoreStorageRows, pruneScopeStorageRows, recordScopeStorageRows, CONNECT_LINKS_DDL, consumeConnectLinkRow, insertConnectLink, listConnectLinks as listConnectLinkRows, readConnectLink, restoreConnectLinkRow, revokeConnectLinkRow, createFindingRule, findingOfOpsFailure, findingOfSweepRun, pruneFindings, listFindingRules, listFindings, observeFinding, revokeFindingRule, setFindingStatus, assertRowLimit, assertRowOffset, OPS_FAILURE_RETENTION_DAYS, SWEEP_RUN_RETENTION_DAYS, SWEEP_RUNS_INTENT_INDEX, sweepRunsIntentHasKind, MODEL_USAGE_RETENTION_DAYS, foldModelUsage, backoffAt, platformRequestHistoryQuery, platformRequestOf, PLATFORM_REQUEST_COLUMNS, PLATFORM_REQUEST_REDACTION_SQL, platformRequestRedactionParams, platformRequestRedactionQuery, intentPayloadCarriesSubject, redactSubjectJobRuns, eraseSubjectFromModules, moduleRowsErased, moduleErasurePlan, redactSubjectScopeText, redactSubjectDirectoryText, ISSUE_EXEMPLAR_OWNER_BACKFILL_SQL, issueExemplarOwner, JOB_RUN_PATCH_SQL, JOB_RUN_CLAIM_SQL, JOB_RUN_RENEW_SQL, JOB_RUN_BEGIN_SQL, JOB_RUN_MISS_SQL, JOB_RUN_MISS_SETTLE_SQL, admissionMissOutcome, JOB_STEP_RECORD_SQL, JOB_LEASE_EXPIRED_NOTE, assertLeaseMs, DELIVERY_ERROR_REDACTION_SQL, REDACTED_DELIVERY_NOTE, seatScopeTuple, applyScopeRoleChange, changeScopeRole, revokeScopeRoles, scopeRoleHolders, assertModuleDeclared, noteReservedKeys, reservedGrantRefusal, reservedRoleRefusal, reservedShapeRefusal, admitPeer, boundToPeerDeclarations, peerCallerAt, collectPeers, peerSeats, resolveVerticalInstanceFrom, resolvePeerInstanceFrom, peerVerticalSpellings, samePeerVertical, peerGrantsStatus, systemGrantsStatus, systemScheduleState, systemSwitchedOff, systemSwitchedOffMessage, tenantSystemSwitchedOffMessage, PEER_SWITCHES_DDL, PEER_BINDINGS_DDL, SWITCH_OWED_DDL, SWITCH_FENCES_DDL, TABLE_OWNERS_DDL, assertMigrationLeavesLedgerAlone, recordOwnershipSteps, runMigrationStatements, executableSqlStatements, blankSqlComments, recordWriteSuperseded, switchFencesOf, switchSupersededMessage, SWITCH_KINDS, SYSTEM_SWITCHES_DDL, forgetSwitchesOf, listSystemSwitchRecords, moveSwitch, reassertActionOf, reassertEntry, reassertOffRow, recordSwitchedOff, recordSwitchedOn, restoreSwitchRecord, scopesSwitchedOffFor, switchActionOf, switchAuditSubject, recordAuditOutcome, auditedCapabilityRevoke, auditWarningOf, switchNotFoundMessage, switchRecordsOf, switchedOffOf, switchesBackfillSqlOf, switchesTableExists, tenantHeldOf, tenantHoldsGrant, inUnitMovesToAudit, staleCarryRevertRow, staleCarryReverts, withRecorded, VERSION_MIGRATIONS_DDL, VERTICAL_SCOPE_STORES_DDL, forgetVerticalScopeStores, indexVersionScopeStores, driverDeclarationsOf, verticalScopeStoresOf, STORE_DRIVER_RELEASES_DDL, legacyStoreDriverConflict, legacyStoreDriverRenames, beginStoreDriverRolloutIn, finishStoreDriverRolloutIn, holdStoreDriverIn, advanceStoreDriverRebuildIn, claimStoreDriverRebuildIn, storeDriverRebuildIn, recordStoreDriverReleaseIn, releaseStoreDriverHoldIn, storeDriverReleaseIn, storeDriverStateIn, storeDriverRolloutPendingIn, storeDriverRolloutWalkedIn, splitManifestMigrations, splitVersionMigrationsBatch, versionMigrationsOf, deriveVersionMigrationDigest, publishedMigrationDigest, migrationChangeRefusal, writeVersionMigrations, denialListQuery, refusalListQuery, mapRefusalRow, denialSummaryQuery, denialTotalsQuery, DENIAL_WINDOW_QUERY, mapDenialRow, mapDenialSummaryBuckets, IMPERSONATION_COLUMNS, IMPERSONATION_DDL, ImpersonationRefused, assertImpersonationWrites, assertModuleEnqueueableKind, assertSessionUsable, impersonationByIdQuery, impersonationListQuery, impersonationRowValues, impersonationStampOf, mapImpersonationRow, newImpersonationSession, resolveRetryPolicy, executorOutcomeOf, isDeliveryRefusal, refusalJournalText, membershipFencesBackfillSql, MEMBERSHIP_FENCES_DDL, membershipFencesTableExists, MEMBERSHIP_FENCE_SINCE_SQL, RAISE_MEMBERSHIP_FENCE_SQL, memberAddedAudit, orgChangeBound, tenantCoverage, isSecretBoxConfigured, unconfiguredSecretBox, createSubjectKeys, generateSealingKeyPair, noSealingKeyMessage, openSealed, sealTo, ConnectionSealingKeyUnavailableError, PermissionDenied, createAtomic, NotSearchable, NotListable, listIndexMigrations, listIndexPlans, listQuery, cursorOf, moduleMigrations, MIGRATION_DIGEST_FENCE_DDL, MIGRATION_DIGEST_MARK_LEGACY, assertJournalDumpCoherent, assertMigrationSql, migrationDivergence, migrationFailedError, migrationSetDivergence, migrationSteps, planMigrations, isSearchIndexTable, searchIndexMigrations, searchIndexPlans, searchLimit, searchMatchExpression, searchQuery, ATTACHMENT_TEXT_DDL, ATTACHMENT_CONDEMNED_DDL, ATTACHMENT_SWEEP_LICENCE_DDL, ATTACHMENT_SWEEP_LICENCE_TABLE, clearOrphanSweepLicence, condemnLicensedOrphanAttachments, consumeOrphanSweepLicence, licensedOrphanIds, recordOrphanSweepLicence, refuseUnlicensedOrphanSweep, fenceAttachmentSweep, refuseCondemnedAttachment, refuseCondemnedInDump, rowlessAttachmentIds, sweepOrphanAttachments, missingAttachmentStore, SETTLED_COPY_STATES, unsettledCopyRefusal, assertAttachmentExtractors, resolveAttachmentTextBounds, assertJobRegistrable, attachmentRecordOfRow, attachmentTextJob, enqueueAttachmentText, ATTACHMENT_TEXT_BACKFILL_JOB, ATTACHMENT_TEXT_JOB, kernelJobFor, queueAttachmentTextBackfill, startAttachmentTextBackfill, attachmentTextBackfillJob, reconcileAttachmentText, recordAttachmentText, searchAttachments, entityVersionQuery, entityVersionOf, assertIfMatch, OUTBOX_ENTITY_INDEX, SCHEDULE_STATE_DDL, SCHEDULE_STATE_REBUILD, scheduleStateHasKind, VERTICAL_EVENTS_DDL, EXPORT_HOPS_SQL, emptyImportResult, IMPORT_CURSORS_SQL, IMPORT_CURSOR_OF_SQL, OUTBOX_MARK_SQL, emittedSinceQuery, emittedReportOf, EMITTED_REPORT_CAP, exportedSinceQuery, IMPORT_CURSOR_ADVANCE_SQL, IMPORT_RECORD_SQL, moveImportCursor, importCursorSourceOf, exportBreaksOf, exportBreakRefusal, assertPromoteReviewCurrent, promoteRaceRefusal, rebindRaceRefusal, SERVES_NOW_CONDITION, SERVES_NOW_PREDICATE, servesNowParams, bindExportBreaksOf, bindExportBreakRefusal, scopeMoveOf, runningVersionOf, isPrimaryScope, PROVISIONED_VERSIONS_SQL, installsReconciledOf, strandJudgmentsOf, provisionedVersionsParams, boundShapesColumn, boundShapesOfColumn, installReconciled, CrossVerticalRegistry, exportReadPlan, exportReadQuery, planExportBatch, withheldNote, JOB_RUN_DDL, JOB_RUN_DUE_AT, jobRunListLimit, jobRunOf, runDueJobRuns, startJobRun, IDEMPOTENCY_DDL, REFUSALS_TABLE_DDL, REFUSALS_INDEX, refusalInsert, refusalOf, markGuardRefusal, REFUSALS_REBUILD, refusalsAdmitGuards, assertIdempotencyKey, idempotencyLookupQuery, idempotencyPruneStatement, idempotencyRecordStatement, idempotencyOptedOutMessage, replayFor, globalFetch, createUlid, facetEvents, readHistory, walkEventCause, walkEventEffects, assertRedrainWindow, readInvocation, readDeadLetters, readLifecycleFlow, readOperationSeries, domainEventOf, readUndrainedOutbox, undrainedEventsOf, connectorCallRecord, noopConnectorCallRecorder, recordConnectorCall, settleConnectionUse, unknownRoleError, callReservedStoreOperation, callScopeStore, observeStoreCall, replayStoreErasures, scopeStoreLifecycleOf, scopeStoreRunnersOf, } from '@substrat-run/kernel';
+import { accessLogEntry, adminLogEntry, delegatedReadParams, operationSeriesCount, opsFailureEntry, opsFailureFingerprint, issueEntry, FRESHNESS_HEARTBEAT_MINUTES, sweepRunEntry, modelUsageEntry, ATTACHMENT_ADDED, ATTACHMENT_REMOVED, createTenantInput, domainEvent, domainEventInput, exportReadInput, importBatch, importCursorMove, exportsOfManifestJson, assertNoBindingShapeBreak, importsOfManifestJson, connectionLandingsOfManifestJson, entitlementGrant, entitlementGrantInput, eventId, meterReading, platformRequestInput, platformRequestId, identityLink, identityPool, instant, isSubstratError, connection, capabilityGrant, connectionGrant, connectionGrantRecord, connectionSecret, systemGrant, systemSwitch, systemSwitchRecord, peerSwitch, verticalCaller, verticalSlug as verticalSlugOf, subjectRef, requestFingerprint, createConnectionInput, connectLinkFilter, connectLinkKey, consumeConnectLinkInput, mintConnectLinkInput, projectedConnectionGrant, projectedConnectionKey, moduleManifest, createOrgInput, promotionAcknowledgement, bindAcknowledgement, bindHostnameInput, channelHistoryEntry, hostnameBinding, publishVersionInput, AUTO_ADMISSION_NOTE, routeTarget, ROUTE_SCOPE_HOSTNAMES_MAX, registerVerticalInput, vertical as verticalSchema, verticalChannel, verticalVersion, objectRef, entityObjectRef, assertModuleEmittableType, assertKernelAuthoredType, grantRefFromProof, org as orgSchema, orgMembership, principalId, resolvedIdentity, identityMembership, roleDefinition, scope as scopeSchema, tenant as tenantSchema, tenantRole, principalBecomeCapabilityInput, subjectShredReceipt, SCOPE_TABLE_PAGE_DEFAULT, SCOPE_TABLE_PAGE_MAX, SCOPE_QUERY_ROW_MAX, verticalServingState, deploymentWireAuth, callsOfManifestJson, outboundOfManifestJson, listLimitOf, pageOf, countedPageOf, SCOPE_GATE_REASONS, substratError, assertReplayableDump, delegatedReadRecord, ownerTransferAudit, memberChangeAudit, peerBindingAudit, connectionBindingAudit, copyMarkAudit, orphanSweepAudit, redrainEventsInput, REDRAIN_BATCH, errorCodeOf, } from '@substrat-run/contracts';
+import { actorOf, asPrincipal, assertAllowed, assertNoSecret, assertPermissionKey, CAPABILITY_DDL, UPLOAD_LINK_DDL, createAttachmentVerbs, inspectUploadLink, redeemUploadLinkInTransaction, redeemOrReplayUploadLink, COPY_ORIGIN_DDL, ENTITY_STATE_MOVES_DDL, CAPABILITY_EXCHANGE_OPERATION, CAPABILITY_BECOME_MINT_OPERATION, becomeMintCheck, mintBecomeCapabilityAsPrincipal, revokeBecomeCapabilityAsPrincipal, readBecomeLinkStates, ENTITY_UNBIND_OPERATION, allowedFor, unbindEntityHolderBounded, capabilityAttachmentWriteRefused, capabilityTokenHash, createCapabilityVerbs, createEntityEdgeVerbs, createEntityStateVerbs, createTrashedReads, CONTINUATION_POSITION_CAP, visibleContinuation, searchStateWhere, uncheckedView, addStatePlans, addUpdatedStampPlans, watchUpdatedStamps, entityStateMigrations, assertNoCallerPurge, assertPlatformRequestRoom, isUnreachableParent, heldPurgePass, purgeDueOf, purgeHeldBy, lifecycleRefusal, scopeNotHeldRefusal, purgeOnlyKeysOf, purgeReportOf, purgeStillDue, refuseTrashedTarget, assertBoundOperations, checkHeldOperationsOf, countChecks, noteUncheckedCompletion, registerTrashTargets, runPurgePass, withheldKeysFor, statefulTablesOf, afterMigration, afterRuntimeDdl, derivesAnything, repairDerivedObjects, StateColumnLost, exchangeCapability as exchangeCapabilitySecret, guardSecrets, mintBecomeCapability, plausibleSessionToken, readCapabilityPage, redactSecrets, redactSecretText, moduleLog, consoleLogSink, asyncInvocationId, asyncLinePass, consoleInvocationLineSink, resolveCapabilitySession, revokeCapabilityAsPlatform, assertReadOnlyQuery, attachmentBlobKey, attachmentSha256, isSizedByteStream, knownLengthStream, openAttachmentByteStream, putAttachmentBytes, entitlementDenial, requiredEntitlementFor, foldMeterReading, guardSpine, guardSqlLimits, DO_SQL_LIMITS, tooManyResultColumns, tooManyTableColumns, parseValidationRecords, readableScopes, resolveScopeRecord, ulid, ISSUE_RETENTION_DAYS, telemetryRetentionStatements, FINDINGS_DDL, ATTACHMENT_BYTES_SQL, SCOPE_STORAGE_DDL, forgetScopeStorage, listScopeAttachmentStorageRows, retireScopeStorage, listScopeStorageAttemptRows, listScopeStorageRows, listScopeStoreStorageRows, pruneScopeStorageRows, recordScopeStorageRows, REQUEST_ROLLUP_DDL, listRequestDayRows, listRequestRollupDayRows, pruneRequestDayRows, recordRequestDayRows, METER_DAYS_DDL, VERTICAL_OWNERS_BACKFILL, VERTICAL_OWNERS_DDL, closeVerticalOwnerRow, listVerticalOwnerRows, openVerticalOwnerRow, verticalOwnerNow, listMeterDayRows, listMeterDayTakeRows, pruneMeterDayRows, recordMeterDayRows, CONNECT_LINKS_DDL, consumeConnectLinkRow, insertConnectLink, listConnectLinks as listConnectLinkRows, readConnectLink, restoreConnectLinkRow, revokeConnectLinkRow, createFindingRule, findingOfOpsFailure, findingOfSweepRun, pruneFindings, listFindingRules, listFindings, observeFinding, revokeFindingRule, setFindingStatus, assertRowLimit, assertRowOffset, OPS_FAILURE_RETENTION_DAYS, SWEEP_RUN_RETENTION_DAYS, SWEEP_RUNS_INTENT_INDEX, sweepRunsIntentHasKind, MODEL_USAGE_RETENTION_DAYS, foldModelUsage, backoffAt, platformRequestHistoryQuery, platformRequestOf, PLATFORM_REQUEST_COLUMNS, PLATFORM_REQUEST_REDACTION_SQL, platformRequestRedactionParams, platformRequestRedactionQuery, intentPayloadCarriesSubject, redactSubjectJobRuns, eraseSubjectFromModules, moduleRowsErased, moduleErasurePlan, redactSubjectScopeText, redactSubjectDirectoryText, ISSUE_EXEMPLAR_OWNER_BACKFILL_SQL, issueExemplarOwner, JOB_RUN_PATCH_SQL, JOB_RUN_CLAIM_SQL, JOB_RUN_RENEW_SQL, JOB_RUN_BEGIN_SQL, JOB_RUN_MISS_SQL, JOB_RUN_MISS_SETTLE_SQL, admissionMissOutcome, JOB_STEP_RECORD_SQL, JOB_LEASE_EXPIRED_NOTE, assertLeaseMs, DELIVERY_ERROR_REDACTION_SQL, REDACTED_DELIVERY_NOTE, seatScopeTuple, applyScopeRoleChange, changeScopeRole, revokeScopeRoles, scopeRoleHolders, assertModuleDeclared, noteDeclaredKeys, noteReservedKeys, dumpRoleRefusal, reservedGrantRefusal, reservedRoleDefinitionRefusal, reservedRoleRefusal, reservedShapeRefusal, SCOPE_SEATED_ROLES_SQL, SEAT_HOLDING_SCOPE_STATUSES, TENANT_SEATED_ROLES_SQL, admitPeer, boundToPeerDeclarations, peerCallerAt, collectPeers, peerSeats, resolveVerticalInstanceFrom, resolvePeerInstanceFrom, peerVerticalSpellings, samePeerVertical, peerGrantsStatus, systemGrantsStatus, systemScheduleState, systemSwitchedOff, systemSwitchedOffMessage, tenantSystemSwitchedOffMessage, PEER_SWITCHES_DDL, PEER_BINDINGS_DDL, SWITCH_OWED_DDL, SWITCH_FENCES_DDL, TABLE_OWNERS_DDL, assertMigrationLeavesLedgerAlone, recordOwnershipSteps, runMigrationStatements, executableSqlStatements, blankSqlComments, recordWriteSuperseded, switchFencesOf, switchSupersededMessage, SWITCH_KINDS, SYSTEM_SWITCHES_DDL, forgetSwitchesOf, listSystemSwitchRecords, moveSwitch, reassertActionOf, reassertEntry, reassertOffRow, recordSwitchedOff, recordSwitchedOn, restoreSwitchRecord, scopesSwitchedOffFor, switchActionOf, switchAuditSubject, recordAuditOutcome, auditedCapabilityRevoke, auditWarningOf, switchNotFoundMessage, switchRecordsOf, switchedOffOf, switchesBackfillSqlOf, switchesTableExists, tenantHeldOf, tenantHoldsGrant, inUnitMovesToAudit, staleCarryRevertRow, staleCarryReverts, withRecorded, VERSION_MIGRATIONS_DDL, VERTICAL_SCOPE_STORES_DDL, forgetVerticalScopeStores, DEPLOYMENT_WIRE_AUTH_DDL, assertWireAuthFilter, deploymentWireAuthOf, forgetVerticalWireAuth, wireAuthAccessTarget, writeDeploymentWireAuth, indexVersionScopeStores, driverDeclarationsOf, verticalScopeStoresOf, STORE_DRIVER_RELEASES_DDL, legacyStoreDriverConflict, legacyStoreDriverRenames, beginStoreDriverRolloutIn, finishStoreDriverRolloutIn, holdStoreDriverIn, advanceStoreDriverRebuildIn, claimStoreDriverRebuildIn, storeDriverRebuildIn, recordStoreDriverReleaseIn, releaseStoreDriverHoldIn, storeDriverReleaseIn, storeDriverStateIn, storeDriverRolloutPendingIn, storeDriverRolloutWalkedIn, splitManifestMigrations, splitVersionMigrationsBatch, versionMigrationsOf, deriveVersionMigrationDigest, publishedMigrationDigest, migrationChangeRefusal, writeVersionMigrations, denialListQuery, refusalListQuery, mapRefusalRow, denialSummaryQuery, denialTotalsQuery, DENIAL_WINDOW_QUERY, mapDenialRow, mapDenialSummaryBuckets, IMPERSONATION_COLUMNS, IMPERSONATION_DDL, ImpersonationRefused, assertImpersonationWrites, assertModuleEnqueueableKind, assertSessionUsable, impersonationByIdQuery, impersonationListQuery, impersonationRowValues, impersonationStampOf, mapImpersonationRow, newImpersonationSession, resolveRetryPolicy, executorOutcomeOf, isDeliveryRefusal, refusalJournalText, membershipFencesBackfillSql, MEMBERSHIP_FENCES_DDL, membershipFencesTableExists, MEMBERSHIP_FENCE_SINCE_SQL, RAISE_MEMBERSHIP_FENCE_SQL, memberAddedAudit, orgChangeBound, tenantCoverage, isSecretBoxConfigured, unconfiguredSecretBox, createSubjectKeys, generateSealingKeyPair, noSealingKeyMessage, openSealed, sealTo, ConnectionSealingKeyUnavailableError, PermissionDenied, createAtomic, NotSearchable, NotListable, listIndexMigrations, listIndexPlans, listQuery, cursorOf, moduleMigrations, MIGRATION_DIGEST_FENCE_DDL, MIGRATION_DIGEST_MARK_LEGACY, assertJournalDumpCoherent, assertMigrationSql, migrationDivergence, migrationFailedError, migrationSetDivergence, migrationSteps, planMigrations, isSearchIndexTable, searchIndexMigrations, searchIndexPlans, searchLimit, searchMatchExpression, searchQuery, ATTACHMENT_TEXT_DDL, ATTACHMENT_CONDEMNED_DDL, ATTACHMENT_SWEEP_LICENCE_DDL, ATTACHMENT_SWEEP_LICENCE_TABLE, clearOrphanSweepLicence, condemnLicensedOrphanAttachments, consumeOrphanSweepLicence, licensedOrphanIds, recordOrphanSweepLicence, refuseUnlicensedOrphanSweep, fenceAttachmentSweep, refuseCondemnedAttachment, refuseCondemnedInDump, rowlessAttachmentIds, sweepOrphanAttachments, missingAttachmentStore, SETTLED_COPY_STATES, unsettledCopyRefusal, assertAttachmentExtractors, resolveAttachmentTextBounds, assertJobRegistrable, attachmentRecordOfRow, attachmentTextJob, enqueueAttachmentText, ATTACHMENT_TEXT_BACKFILL_JOB, ATTACHMENT_TEXT_JOB, kernelJobFor, queueAttachmentTextBackfill, startAttachmentTextBackfill, attachmentTextBackfillJob, reconcileAttachmentText, recordAttachmentText, searchAttachments, entityVersionQuery, entityVersionOf, assertIfMatch, OUTBOX_ENTITY_INDEX, SCHEDULE_STATE_DDL, SCHEDULE_STATE_REBUILD, scheduleStateHasKind, VERTICAL_EVENTS_DDL, EXPORT_HOPS_SQL, emptyImportResult, IMPORT_CURSORS_SQL, IMPORT_CURSOR_OF_SQL, OUTBOX_MARK_SQL, emittedSinceQuery, emittedReportOf, EMITTED_REPORT_CAP, exportedSinceQuery, IMPORT_CURSOR_ADVANCE_SQL, IMPORT_RECORD_SQL, moveImportCursor, importCursorSourceOf, exportBreaksOf, exportBreakRefusal, assertPromoteReviewCurrent, promoteRaceRefusal, servingRaceRefusal, rebindRaceRefusal, SERVES_NOW_CONDITION, SERVES_NOW_PREDICATE, servesNowParams, bindExportBreaksOf, bindExportBreakRefusal, scopeMoveOf, runningVersionOf, isPrimaryScope, PROVISIONED_VERSIONS_SQL, installsReconciledOf, strandJudgmentsOf, provisionedVersionsParams, boundShapesColumn, boundShapesOfColumn, installReconciled, CrossVerticalRegistry, exportReadPlan, exportReadQuery, planExportBatch, withheldNote, JOB_RUN_DDL, JOB_RUN_DUE_AT, jobRunListLimit, jobRunOf, runDueJobRuns, startJobRun, IDEMPOTENCY_DDL, REFUSALS_TABLE_DDL, REFUSALS_INDEX, refusalInsert, refusalOf, markGuardRefusal, REFUSALS_REBUILD, refusalsAdmitGuards, assertIdempotencyKey, idempotencyLookupQuery, idempotencyPruneStatement, idempotencyRecordStatement, idempotencyOptedOutMessage, replayFor, globalFetch, fetchLikeOf, deadlineFetch, createUlid, facetEvents, readHistory, walkEventCause, walkEventEffects, assertRedrainWindow, readInvocation, readDeadLetters, readLifecycleFlow, readOperationSeries, domainEventOf, readUndrainedOutbox, undrainedEventsOf, connectorCallRecord, noopConnectorCallRecorder, recordConnectorCall, settleConnectionUse, unknownRoleError, callReservedStoreOperation, callScopeStore, observeStoreCall, replayStoreErasures, scopeStoreLifecycleOf, scopeStoreRunnersOf, } from '@substrat-run/kernel';
 import { attributedView, delegatedRevokeSql, writeExplicitTupleIn, grantEntityShapeIn, shapeTopUpBatch, topUpEntityGrantShapes, settlePlatformRequestIn, } from '@substrat-run/kernel';
 import { ADMIN_LOG_INDEXES_SQL, SETTLE_INTENT_SQL, SETTLE_OUTCOME_SQL, settleOutcomeParamsOf, readAuditedOperations, unknownOutcomeOf, } from '@substrat-run/kernel';
 import { INERT_SCOPE_REASON, isPrimaryScopeRow, normalizeUploadMediaType } from '@substrat-run/kernel';
+import { opsFailureReferenceWhere } from '@substrat-run/kernel';
 import { COPY_BACKFILL_SCOPE_SQL, COPY_BACKFILL_SQL, COPY_BACKFILL_SUPERSEDE_SQL, COPY_CLAIM_SQL, COPY_EXPIRED_SQL, COPY_MOVE_RENEW_SQL, copyMoveRenewParams, PENDING_COPY_KEEP_ALIVE_SQL, pendingCopyKeepAliveParams, copyBackfillParams, copyBackfillRefusal, SUBJECT_ERASURE_CLAIM_SQL, subjectErasureClaimParams, COPY_MOVE_CONFIRM_SQL, COPY_MOVE_LIVE_PREDICATE, SCOPE_COPY_LEASE_MS, SCOPE_SCRIPT_COPY_COLUMNS, copyMoveConfirmParams, copyMoveLiveParams, scopeScriptCopyOf, } from '@substrat-run/kernel';
 import { GRANT_CHILDREN_INDEX_DDL, SHAPE_MARKER_INDEX_DDL, grantedEntitiesForContext } from '@substrat-run/kernel';
 import { LEGACY_SCOPE_ROWS_BACKFILL, assertSpineTablesBuilt, capabilitiesForLoad, dumpRowsInsert, isSpineTable, loadDirectoryDump, repointScopeGrants, settleCopiedWork, emittedHere, spineColumnAdditions } from '@substrat-run/kernel';
@@ -28,6 +30,101 @@ export function isStorageFault(err) {
  * this map — cannot write one. Registered as each context is built.
  */
 const kernelEmitters = new WeakMap();
+/**
+ * Node's running SHA-256 (#2498), for a streamed upload — the kernel's `putAttachmentBytes` takes
+ * it. `node:crypto` because Web Crypto has no running digest, and hashing the written file
+ * afterwards would read it whole into memory, which is what streaming is for.
+ */
+function nodeSha256() {
+    const hash = createHash('sha256');
+    return {
+        update: (chunk) => {
+            hash.update(chunk);
+        },
+        hex: async () => hash.digest('hex'),
+    };
+}
+/**
+ * Write a sized stream to `path` one chunk at a time (#2498), so the file is never held whole,
+ * held to its declared length as the store contract says: a stream that carries more or fewer
+ * bytes leaves no file.
+ */
+async function writeStreamToFile(path, body) {
+    const reader = knownLengthStream(body).getReader();
+    const fd = openSync(path, 'w');
+    try {
+        for (;;) {
+            const { done, value } = await reader.read();
+            if (done)
+                break;
+            if (value)
+                writeSync(fd, value);
+        }
+    }
+    catch (err) {
+        rmSync(path, { force: true });
+        throw err;
+    }
+    finally {
+        closeSync(fd);
+    }
+}
+/**
+ * A dropped stream's file handle, closed when the stream is collected (#2514): a consumer that neither
+ * reads a stream to its end nor cancels it would otherwise hold the handle for the life of the process.
+ * Best effort, since collection has no deadline; reading or cancelling is what closes it promptly.
+ */
+const unreadFiles = new FinalizationRegistry((handle) => handle.close());
+/**
+ * The file at `path` as a stream read 64 KiB at a time as it is pulled (#2514), with its size, or
+ * `null` when there is no such file. The file is opened here, so a key removed after the open is still
+ * read whole from the open handle, and closed once the stream ends, errors or is cancelled, or (best
+ * effort) once a stream nobody finished is collected.
+ */
+function fileStream(path) {
+    const CHUNK = 64 * 1024;
+    let fd;
+    try {
+        fd = openSync(path, 'r');
+    }
+    catch (err) {
+        // Removed between the read gate and here: the same answer as a key that was never there.
+        if (err.code === 'ENOENT')
+            return null;
+        throw err;
+    }
+    const size = fstatSync(fd).size;
+    let closed = false;
+    const handle = {
+        close: () => {
+            if (!closed)
+                closeSync(fd);
+            closed = true;
+        },
+    };
+    const close = handle.close;
+    const stream = new ReadableStream({
+        pull(controller) {
+            try {
+                const chunk = new Uint8Array(CHUNK);
+                const read = readSync(fd, chunk, 0, CHUNK, null);
+                if (read === 0) {
+                    close();
+                    controller.close();
+                    return;
+                }
+                controller.enqueue(chunk.subarray(0, read));
+            }
+            catch (err) {
+                close();
+                controller.error(err);
+            }
+        },
+        cancel: close,
+    }, { highWaterMark: 0 });
+    unreadFiles.register(stream, handle);
+    return { stream, size };
+}
 function kernelEmit(ctx, event) {
     const write = kernelEmitters.get(ctx);
     if (!write)
@@ -508,6 +605,93 @@ const admitByDelivery = (rt, eventId, row) => {
  * it refuses another process.
  */
 const PROCESS_HOST_DIRS = new Map();
+/** A scope database's size in bytes: allocated pages, free ones included, which is what the file costs on disk (#1524). */
+const databaseBytesOf = (db) => db.pragma('page_count', { simple: true }) * db.pragma('page_size', { simple: true });
+/** What a scope database's attachment rows sum to (#2501). */
+const attachmentBytesOf = (db) => db.prepare(ATTACHMENT_BYTES_SQL).get().bytes;
+/**
+ * The introspection reads, over an already-resolved connection: the bodies behind both the
+ * directory-checked admin verbs and the `*Local` verbs a vertical's `/internal/*` routes call by
+ * scope id alone (#2544). How the connection was reached, and what is recorded, stay with the caller.
+ */
+function scopeTablesOf(db) {
+    const names = db.prepare(`SELECT name FROM sqlite_master WHERE type = 'table' ORDER BY name`).all().map((r) => r.name);
+    const count = (sql) => db.prepare(sql).get().c;
+    const tombstones = (name) => db.prepare(`SELECT name FROM pragma_table_info(?)`).all(name).some((c) => c.name === 'revoked_at');
+    return names.map((name) => ({
+        name,
+        rowCount: count(`SELECT COUNT(*) AS c FROM "${name}"`),
+        system: isSystemTable(name),
+        // #2531: rows whose `revoked_at` is null, for any table with that column (`ScopeTable.liveRowCount`; the Cloudflare adapter's twin).
+        ...(tombstones(name) ? { liveRowCount: count(`SELECT COUNT(*) AS c FROM "${name}" WHERE revoked_at IS NULL`) } : {}),
+    }));
+}
+function scopeTablePageOf(db, input) {
+    // Validate the table against the LIVE schema — an unknown name throws, it is
+    // never interpolated blind. That validated name is the only thing that reaches
+    // the query, so the quoted identifier below carries no user input.
+    const known = new Set(db.prepare(`SELECT name FROM sqlite_master WHERE type = 'table'`).all().map((r) => r.name));
+    if (!known.has(input.table))
+        throw substratError('not_found', `unknown table '${input.table}'`);
+    // The ceiling clamps; a bound SQLite would misread (NaN, non-finite, fractional,
+    // negative) is refused instead of reaching LIMIT / OFFSET (#1632).
+    const limit = Math.min(assertRowLimit('limit', input.limit ?? SCOPE_TABLE_PAGE_DEFAULT), SCOPE_TABLE_PAGE_MAX);
+    const offset = assertRowOffset('offset', input.offset ?? 0);
+    const stmt = db.prepare(`SELECT * FROM "${input.table}" LIMIT ? OFFSET ?`).raw(true);
+    const rows = stmt.all(limit, offset).map((row) => row.map(cellToJson));
+    const columns = stmt.columns().map((c) => c.name);
+    const rowCount = db.prepare(`SELECT COUNT(*) AS c FROM "${input.table}"`).get().c;
+    return { table: input.table, columns, rows, rowCount, limit, offset };
+}
+function scopeQueryOf(db, input) {
+    // Layer 1, shared: the kernel's textual gate (single statement, read verbs
+    // only) — the checked statement is the one that runs.
+    const sql = assertReadOnlyQuery(input.sql);
+    // Layer 2, authoritative: sqlite3_stmt_readonly via better-sqlite3. prepare()
+    // itself rejects multi-statement strings and bad SQL with the driver's message.
+    const stmt = db.prepare(sql);
+    if (!stmt.readonly)
+        throw substratError('validation_failed', 'read-only console: statement is not read-only');
+    if (!stmt.reader)
+        return { sql, reader: false, result: { columns: [], rows: [], truncated: false } };
+    stmt.raw(true);
+    const rows = [];
+    let truncated = false;
+    // Iterate rather than .all(): the row cap bounds what leaves the DB, so an
+    // over-broad SELECT costs a screenful, not the table.
+    for (const row of stmt.iterate()) {
+        if (rows.length >= SCOPE_QUERY_ROW_MAX) {
+            truncated = true;
+            break;
+        }
+        rows.push(row.map(cellToJson));
+    }
+    return { sql, reader: true, result: { columns: stmt.columns().map((c) => c.name), rows, truncated } };
+}
+function appliedMigrationsOf(db) {
+    const rows = db
+        .prepare(`SELECT module_id, version, applied_at, duration_ms, rows_changed FROM _substrat_migrations
+        ORDER BY applied_at DESC, rowid DESC`)
+        .all();
+    return rows.map((r) => ({
+        moduleId: r.module_id,
+        version: r.version,
+        appliedAt: r.applied_at ?? null,
+        durationMs: r.duration_ms,
+        rowsChanged: r.rows_changed,
+    }));
+}
+function undrainedEventsFrom(db, limit) {
+    const page = db.prepare(`SELECT * FROM _substrat_outbox WHERE drained_at IS NULL AND ${emittedHere()} ORDER BY id LIMIT ? OFFSET ?`);
+    // The kernel's read, shared with the DO: the envelope and the columns lifted beside
+    // it (#1242, #1237) are decoded once, and a row that will not decode is stepped over
+    // rather than stalling the scope on it (#1636).
+    return undrainedEventsOf(readUndrainedOutbox((offset, count) => page.all(count, offset), Math.min(assertRowLimit('limit', limit), 1000)));
+}
+const redrainCountOf = (db, drainedBefore) => db
+    .prepare(`SELECT COUNT(*) AS c FROM _substrat_outbox
+          WHERE drained_at IS NOT NULL AND drained_at < ?`)
+    .get(drainedBefore).c;
 /**
  * #119: claim a host directory for this process, for one live `SqliteScopeHost`. The first host in
  * the process takes an exclusive lock on `_host.lock` (a SQLite file: `locking_mode = EXCLUSIVE`
@@ -631,6 +815,8 @@ export class SqliteScopeHost {
     modules = new Map();
     /** #2430: what a registered module declares `holder: 'system'` — the role doors' refusal reads it. */
     reservedKeys = new Set();
+    /** #2447: every key a registered or listed module declares, marked or not — a role definition reads it. */
+    declaredKeys = new Set();
     /** #2430: the declared permission surface `registerModule` holds each module to, when given. */
     permissions;
     /** #1705: what this deployment exports to other verticals and imports from them. */
@@ -722,6 +908,7 @@ export class SqliteScopeHost {
     wrapBlobStore;
     attachmentTextBounds;
     fetchImpl;
+    streamIdleMs;
     connectorCalls;
     clock;
     versionId;
@@ -741,15 +928,19 @@ export class SqliteScopeHost {
         this.attachmentExtractors = options.attachmentExtractors ?? [];
         this.wrapBlobStore = options.wrapBlobStore ?? ((store) => store);
         this.attachmentTextBounds = resolveAttachmentTextBounds(options.attachmentTextBounds);
-        this.fetchImpl = options.fetch ?? globalFetch;
+        // #2498: whatever fetch is injected, a sized stream body reaches it converted (`fetchLikeOf`).
+        this.fetchImpl = fetchLikeOf(options.fetch ?? globalFetch);
+        this.streamIdleMs = options.streamIdleTimeoutMs;
         this.connectorCalls = options.connectorCalls ?? noopConnectorCallRecorder;
         this.clock = options.clock ?? (() => instant.parse(new Date().toISOString()));
         this.versionId = options.versionId ?? null;
         this.migrationsDigest = options.migrationsDigest;
         this.permissions = options.permissions;
         // #2430: what the declared surface reserves holds here too, whatever is registered under its ids.
-        for (const m of options.permissions?.modules ?? [])
+        for (const m of options.permissions?.modules ?? []) {
             noteReservedKeys(this.reservedKeys, m.manifest);
+            noteDeclaredKeys(this.declaredKeys, m.manifest);
+        }
         this.scopeStoreVertical = options.scopeStores?.vertical;
         this.scopeStoreRunners = scopeStoreRunnersOf(options.scopeStores);
         this.scopeStoreLifecycle = scopeStoreLifecycleOf(this.scopeStoreRunners);
@@ -1047,6 +1238,7 @@ export class SqliteScopeHost {
       );
       ${VERSION_MIGRATIONS_DDL}
       ${VERTICAL_SCOPE_STORES_DDL}
+      ${DEPLOYMENT_WIRE_AUTH_DDL}
       -- Channels (#31 step 2): a named pointer per vertical. Promotion moves it,
       -- and promotion is where the migration and permission diffs fire — the
       -- moment a change reaches anyone, rather than the moment it was typed.
@@ -1437,6 +1629,12 @@ export class SqliteScopeHost {
       CREATE INDEX IF NOT EXISTS _substrat_model_usage_at ON _substrat_model_usage (at);
       -- #1524: the stored storage gauge — one row per (scope, UTC day), kernel-owned DDL.
       ${SCOPE_STORAGE_DDL}
+      -- #2501: the daily request rollup — one row per (UTC day, tenant, vertical, scope), kernel-owned DDL.
+      ${REQUEST_ROLLUP_DDL}
+      -- #2501: the daily meter snapshot — one row per (UTC day, tenant), kernel-owned DDL.
+      ${METER_DAYS_DDL}
+      -- #2501: who owned each vertical slug, period by period — kernel-owned DDL.
+      ${VERTICAL_OWNERS_DDL}
       CREATE INDEX IF NOT EXISTS scopes_tenant ON scopes (tenant_id, scope_id);
     `);
         this.ensureDirectoryColumns();
@@ -1558,7 +1756,8 @@ export class SqliteScopeHost {
             .prepare('SELECT vertical FROM scopes WHERE scope_id = ?')
             .get(rt.scopeId)?.vertical ?? null;
         const admin = this.admin;
-        const fetchImpl = this.fetchImpl;
+        // #2518: the call under `timeoutMs`, a streamed body under the idle window instead.
+        const fetchImpl = deadlineFetch(this.fetchImpl, timeoutMs, { idleMs: this.streamIdleMs });
         return {
             admin,
             tenantId: rt.tenantId,
@@ -1573,6 +1772,12 @@ export class SqliteScopeHost {
                 if (!open) {
                     throw new Error(`no live '${provider}' connection for tenant ${rt.tenantId} / vertical '${vertical}'`);
                 }
+                const readSurface = () => this.buildAttachments(rt, { kind: 'connection', id: open.id }, this.attachmentStore(rt.tenantId, vertical), {
+                    reentrant: holdsActor,
+                    // #726 remedy (B): inside a dispatch the authority to read is the DELIVERY,
+                    // not a standing grant. See `admitByEvent` on `buildAttachments`.
+                    admitByEvent: eventId,
+                });
                 return {
                     ...open,
                     // The outbound read (#711), on THIS connection — so it is authorized as
@@ -1592,15 +1797,9 @@ export class SqliteScopeHost {
                     grants: async () => (await this.connectionGrantsInScope(rt.tenantId, rt.scopeId))
                         .filter((g) => g.connectionId === open.id)
                         .map((g) => g.permission),
-                    openAttachment: async (attachmentId) => {
-                        const store = this.attachmentStore(rt.tenantId, vertical);
-                        return this.buildAttachments(rt, { kind: 'connection', id: open.id }, store, {
-                            reentrant: holdsActor,
-                            // #726 remedy (B): inside a dispatch the authority to read is the DELIVERY,
-                            // not a standing grant. See `admitByEvent` on `buildAttachments`.
-                            admitByEvent: eventId,
-                        }).open(attachmentId);
-                    },
+                    openAttachment: async (attachmentId) => readSurface().open(attachmentId),
+                    // #2514: the same read, its bytes a stream.
+                    openAttachmentStream: async (attachmentId) => readSurface().openStream(attachmentId),
                     // #687: open a cell the scope sealed TO this connection. The keyId-indexed
                     // map goes in, never out — a connector is handed the plaintext of one cell,
                     // not a private key it could mislay. Retired keys are in the map too, so a
@@ -1611,10 +1810,7 @@ export class SqliteScopeHost {
                         // records beside the health line carries a duration.
                         const started = Date.now();
                         try {
-                            const res = await fetchImpl(input, {
-                                ...init,
-                                signal: AbortSignal.timeout(timeoutMs),
-                            });
+                            const res = await fetchImpl(input, init);
                             // A 5xx is the provider failing; a 4xx is usually us. Both are
                             // worth recording, because "the connection stopped working" is the
                             // question a health view answers.
@@ -1744,6 +1940,7 @@ export class SqliteScopeHost {
             purgeOnlyKeys: purgeOnlyKeysOf(manifest.schedules ?? []),
         });
         noteReservedKeys(this.reservedKeys, manifest);
+        noteDeclaredKeys(this.declaredKeys, manifest);
         if (erasure)
             this.erasurePlans.push(erasure);
         for (const rel of manifest.entityRelations ?? []) {
@@ -2126,27 +2323,45 @@ export class SqliteScopeHost {
                     out.push(r);
             }
         };
+        const contentTypeOf = (p) => {
+            try {
+                const meta = JSON.parse(readFileSync(`${p}.meta`, 'utf8'));
+                return meta.contentType != null ? { contentType: meta.contentType } : {};
+            }
+            catch {
+                // No sidecar (or unreadable): the caller falls back to the metadata row.
+                return {};
+            }
+        };
         return this.wrapBlobStore({
             put: async (key, body, opts) => {
                 const p = resolveKey(key);
                 mkdirSync(dirname(p), { recursive: true });
-                writeFileSync(p, body);
+                if (isSizedByteStream(body))
+                    await writeStreamToFile(p, body);
+                else
+                    writeFileSync(p, body);
                 writeFileSync(`${p}.meta`, JSON.stringify({ contentType: opts?.contentType ?? null }));
             },
             get: async (key) => {
                 const p = resolveKey(key);
-                if (!existsSync(p))
-                    return null;
-                const body = new Uint8Array(readFileSync(p));
-                let contentType;
+                let body;
                 try {
-                    const meta = JSON.parse(readFileSync(`${p}.meta`, 'utf8'));
-                    contentType = meta.contentType ?? undefined;
+                    body = new Uint8Array(readFileSync(p));
                 }
-                catch {
-                    // No sidecar (or unreadable): the caller falls back to the metadata row.
+                catch (err) {
+                    // Absent, or removed after the read gate: one answer either way, naming no host path (#2514).
+                    if (err.code === 'ENOENT')
+                        return null;
+                    throw err;
                 }
-                return contentType !== undefined ? { body, contentType } : { body };
+                return { body, ...contentTypeOf(p) };
+            },
+            // #2514: the file read as the stream is read, never whole.
+            getStream: async (key) => {
+                const p = resolveKey(key);
+                const file = fileStream(p);
+                return file && { ...file, ...contentTypeOf(p) };
             },
             delete: async (key) => {
                 const p = resolveKey(key);
@@ -2403,6 +2618,21 @@ export class SqliteScopeHost {
             }
         };
         const guarded = opts.reentrant ? reentrant : serialized;
+        // The read gate, decided before the blob store is touched: a refused read never reaches it.
+        const authorizeRead = (attachmentId) => guarded('attachments.open', async (ctx) => {
+            const row = rt.db
+                .prepare('SELECT * FROM _substrat_attachments WHERE id = ?')
+                .get(attachmentId);
+            if (!row)
+                return null;
+            if (opts.admitByEvent !== undefined) {
+                admitByDelivery(rt, opts.admitByEvent, row);
+                return attachmentRecordOfRow(row);
+            }
+            const gate = targetGate(row.entity_type);
+            assertAllowed(await ctx.check(gate.read, { entityType: row.entity_type, entityId: row.entity_id }));
+            return attachmentRecordOfRow(row);
+        });
         return {
             upload: async (input) => {
                 if (capabilitySession !== undefined) {
@@ -2416,24 +2646,33 @@ export class SqliteScopeHost {
                     });
                 }
                 const gate = targetGate(input.entity.entityType);
+                // A streamed body is the case where bytes are the cost, so the write gate is asked before
+                // the first one is read (#2516). The row's own check below stays: this one is only early.
+                if (isSizedByteStream(input.body)) {
+                    // A read that writes nothing: one actor turn, no transaction and no drain (the denial is
+                    // still recorded). Already inside the turn on a reentrant surface, which must not queue again.
+                    const askGate = () => reentrant('attachments.upload', async (ctx) => {
+                        assertAllowed(await ctx.check(gate.write, input.entity));
+                    });
+                    await (opts.reentrant ? askGate() : rt.actor.enqueue(askGate));
+                }
                 const creator = authority;
                 const id = ulid();
                 const key = attachmentBlobKey(rt.scopeId, id);
-                const record = attachmentRecord.parse({
+                const fields = {
                     id,
                     entity: input.entity,
                     filename: input.filename,
                     contentType: input.contentType,
-                    size: input.body.byteLength,
-                    sha256: await attachmentSha256(input.body),
                     visibility: input.visibility,
                     createdBy: creator.id,
                     createdAt: new Date().toISOString(),
-                });
+                };
                 // Bytes first, row second: a crash between the two leaves an orphaned object that no
                 // row points at (#2314). A refused check compensates the object away below; a drain
                 // fault after the commit is not a refusal (`serialized` keeps it from becoming one).
-                await store.put(key, input.body, { contentType: input.contentType });
+                // A streamed body is hashed and counted as it is written (#2498).
+                const record = await putAttachmentBytes(store, key, fields, input.body, nodeSha256);
                 try {
                     return await guarded('attachments.upload', async (ctx) => {
                         assertAllowed(await ctx.check(gate.write, input.entity));
@@ -2481,20 +2720,7 @@ export class SqliteScopeHost {
                 return rows.map(attachmentRecordOfRow);
             }),
             open: async (attachmentId) => {
-                const record = await guarded('attachments.open', async (ctx) => {
-                    const row = rt.db
-                        .prepare('SELECT * FROM _substrat_attachments WHERE id = ?')
-                        .get(attachmentId);
-                    if (!row)
-                        return null;
-                    if (opts.admitByEvent !== undefined) {
-                        admitByDelivery(rt, opts.admitByEvent, row);
-                        return attachmentRecordOfRow(row);
-                    }
-                    const gate = targetGate(row.entity_type);
-                    assertAllowed(await ctx.check(gate.read, { entityType: row.entity_type, entityId: row.entity_id }));
-                    return attachmentRecordOfRow(row);
-                });
+                const record = await authorizeRead(attachmentId);
                 if (!record)
                     return null;
                 const obj = await store.get(attachmentBlobKey(rt.scopeId, record.id));
@@ -2507,6 +2733,14 @@ export class SqliteScopeHost {
                 }
                 return { record, body: obj.body, contentType: obj.contentType ?? record.contentType };
             },
+            // #2514: the same gate, then the file as it is read, checked against the record as it passes.
+            // The bytes are read after the gate's turn has ended, so a long read holds no actor turn.
+            openStream: async (attachmentId) => {
+                const record = await authorizeRead(attachmentId);
+                if (!record)
+                    return null;
+                return openAttachmentByteStream(store, attachmentBlobKey(rt.scopeId, record.id), record, nodeSha256);
+            },
             remove: async (attachmentId) => {
                 const removed = await guarded('attachments.remove', async (ctx, subject) => {
                     const row = rt.db
@@ -2553,7 +2787,31 @@ export class SqliteScopeHost {
         };
     }
     async importScope(actor, input, dump) {
+        await this.importScopeFrom(actor, input, dump, true);
+    }
+    /**
+     * `importScope`, with its role judgement (#2555) when `judge`: once before the scope is created,
+     * so a refused import leaves nothing behind, and again inside the load's transaction, so a role
+     * defined since that read is judged too. That second refusal comes after the scope was created, so
+     * the scope goes with it. A snapshot passes false: it is the platform's copy of a live scope of this
+     * host, made at once, so its seats are the ones that scope holds now (K-55).
+     */
+    async importScopeFrom(actor, input, dump, judge) {
         this.refuseUnusableScopeStores(dump.stores, input.vertical ?? null);
+        if (judge)
+            this.refuseDumpRoles(input.tenantId, dump);
+        let refusedInLoad = false;
+        const recheck = judge
+            ? () => {
+                try {
+                    this.refuseDumpRoles(input.tenantId, dump);
+                }
+                catch (e) {
+                    refusedInLoad = true;
+                    throw e;
+                }
+            }
+            : undefined;
         // Create the destination scope (directory row + storage). Its migration step
         // creates some tables; the dump then replaces them wholesale, so the end state
         // is the dump, not whatever the local module set would have built. Provenance is
@@ -2565,7 +2823,33 @@ export class SqliteScopeHost {
             forkedAt: input.forkedAt ?? dump.capturedAt,
         });
         // A fork: its callers (snapshotScope) hand it a dump the platform exported.
-        await this.loadDump(input.tenantId, input.scopeId, { ...dump, exact: true });
+        try {
+            await this.loadDump(input.tenantId, input.scopeId, { ...dump, exact: true }, undefined, recheck);
+        }
+        catch (e) {
+            // The scope was created for this import alone and holds nothing loaded, so it goes with the
+            // refusal, and a retry meets no scope. Best effort: the refusal is the answer whatever the
+            // teardown does, and a teardown that fails is a staff-only ops row (no tenant on it), with the
+            // scope left in `provisioning` for staff to reap. No admin row is written for the teardown:
+            // the import never happened, and its `provisionScope` row stays as the record of the attempt.
+            if (refusedInLoad) {
+                await this.dropScopeOutright(input.tenantId, input.scopeId).catch((teardown) => {
+                    try {
+                        this.writeOpsFailure({
+                            actor,
+                            operation: 'importScope',
+                            stage: 'refused-import-teardown',
+                            scopeId: input.scopeId,
+                            message: `a refused import's scope could not be taken down: ${teardown instanceof Error ? teardown.message : String(teardown)}`,
+                        });
+                    }
+                    catch {
+                        // Nothing more to do here: the refusal below is still the answer.
+                    }
+                });
+            }
+            throw e;
+        }
         await this.importScopeStores(input.tenantId, input.scopeId, dump.stores);
         await this.admin.activateScope(actor, input.tenantId, input.scopeId);
         this.recordAdmin(actor, 'importScope', { tenantId: input.tenantId, scopeId: input.scopeId }, null, { sourceScopeId: dump.scopeId, tables: dump.tables.length, capturedAt: dump.capturedAt });
@@ -2577,10 +2861,14 @@ export class SqliteScopeHost {
     dump, 
     /** Run inside the load's own transaction, after the replay (#1742) — the restore's re-assert
      *  of the switch. It throws to roll the load back. */
-    afterLoad) {
+    afterLoad, 
+    /** Run first inside the load's own transaction, before any drop (#2555): the role judgement,
+     *  against the roles stored at the moment of the load. It throws to refuse with nothing moved. */
+    beforeLoad) {
         const rt = this.runtime(tenantId, scopeId);
         const db = rt.db;
         const load = db.transaction((dumped) => {
+            beforeLoad?.();
             // Deferred foreign keys cover the WHOLE drop-then-replay, drops included.
             //
             // Two distinct FK hazards, and the second is why this cannot wrap the inserts alone:
@@ -2727,6 +3015,8 @@ export class SqliteScopeHost {
         if (!existing)
             throw substratError('not_found', `unknown scope ${scopeId} in tenant ${tenantId}`);
         this.refuseUnusableScopeStores(dump.stores, existing.vertical);
+        // #2555: judged before the fence, so a refused restore moves nothing; again inside the load.
+        this.refuseDumpRoles(tenantId, dump);
         // #2314: the load replaces the scope's rows, so the orphan sweep is fenced first.
         await this.fenceOrphanSweep(tenantId, scopeId, existing.vertical ?? null);
         // #1742: a dump from before a switch was pulled brings the module's grants back live, so
@@ -2736,7 +3026,7 @@ export class SqliteScopeHost {
         const rows = [];
         // #1869: the re-point's source is the separate hint when given; the dump is otherwise as sent.
         const source = { tables: dump.tables, scopeId: opts?.sourceScopeId ?? dump.scopeId };
-        await this.loadDump(tenantId, scopeId, source, (rt) => this.reassertSwitchesInTurn(rt, actor, tenantId, scopeId, undefined, (action, after) => rows.push([action, after])));
+        await this.loadDump(tenantId, scopeId, source, (rt) => this.reassertSwitchesInTurn(rt, actor, tenantId, scopeId, undefined, (action, after) => rows.push([action, after])), () => this.refuseDumpRoles(tenantId, dump));
         await this.importScopeStores(tenantId, scopeId, dump.stores);
         const replay = await this.replayShreddedStoreErasures(actor, tenantId, scopeId, (opts?.sourceScopeId ?? dump.scopeId));
         for (const [action, after] of rows)
@@ -2755,15 +3045,16 @@ export class SqliteScopeHost {
             throw substratError('not_found', `unknown scope ${scopeId} in tenant ${tenantId}`);
         const dump = await this.admin.exportScope(actor, tenantId, scopeId);
         const snapshotId = ulid();
-        await this.importScope(actor, {
+        await this.importScopeFrom(actor, {
             tenantId,
             scopeId: snapshotId,
             kind: opts?.kind ?? 'archive',
             vertical: source.vertical,
+            verticalSource: 'copy',
             jurisdiction: source.jurisdiction,
             expiresAt: opts?.expiresAt,
             // forkedFrom/forkedAt are stamped from the dump by importScope.
-        }, dump);
+        }, dump, false);
         // Bind the snapshot to the source's current version so it is a runnable copy at the
         // same frontier (a fresh bind, so it never re-triggers the snapshot path).
         if (source.verticalVersionId) {
@@ -2783,6 +3074,16 @@ export class SqliteScopeHost {
             throw substratError('forbidden', `scope ${scopeId} is not a fork or preview — only previews may be deleted; ` +
                 `archive a primary scope instead`);
         }
+        await this.dropScopeOutright(tenantId, scopeId);
+        this.recordAdmin(actor, 'deleteSnapshot', { tenantId, scopeId }, null, {
+            forkedFrom: rec.forkedFrom,
+            forkedAt: rec.forkedAt,
+            expiresAt: rec.expiresAt,
+            kind: rec.kind,
+        });
+    }
+    /** `deleteSnapshot`'s teardown, without its refusal or its audit row: the scope's stores, file and directory rows. */
+    async dropScopeOutright(tenantId, scopeId) {
         await this.wipeScopeStores(tenantId, scopeId);
         // Close and evict the runtime handle before touching the file.
         const rt = this.scopes.get(`${tenantId}/${scopeId}`);
@@ -2802,12 +3103,6 @@ export class SqliteScopeHost {
             forgetScopeStorage(redactionSqlOf(this.directory), scopeId);
             this.directory.prepare('DELETE FROM scopes WHERE scope_id = ?').run(scopeId);
         })();
-        this.recordAdmin(actor, 'deleteSnapshot', { tenantId, scopeId }, null, {
-            forkedFrom: rec.forkedFrom,
-            forkedAt: rec.forkedAt,
-            expiresAt: rec.expiresAt,
-            kind: rec.kind,
-        });
     }
     async getScope(principal, tenantId, scopeId, options) {
         const row = this.directory
@@ -3785,6 +4080,165 @@ export class SqliteScopeHost {
         if (refusal)
             throw substratError('forbidden', refusal);
     }
+    /**
+     * #2447: refuse defining `role` for `tenantId` (`reservedRoleDefinitionRefusal`): against the keys
+     * the modules registered or listed here reserve and declare, and the tenant's other roles.
+     */
+    refuseReservedDefinition(tenantId, role) {
+        const prefix = `${tenantId}/`;
+        const tenantRoles = [...this.roles].filter(([k]) => k.startsWith(prefix)).map(([, r]) => r);
+        const stored = this.roles.get(`${tenantId}/${role.key}`);
+        // The seats are read only for the one case they decide: a system-held definition of a key with no
+        // system-held definition stored (none at all included: a seat can outlive its role's row).
+        const seated = stored?.holder !== 'system' && role.holder === 'system' && this.roleSeated(tenantId, role.key);
+        const refusal = reservedRoleDefinitionRefusal(role, { reserved: this.reservedKeys, declared: this.declaredKeys }, tenantRoles, seated);
+        if (refusal)
+            throw substratError('forbidden', refusal);
+    }
+    /**
+     * #2555: refuse loading `dump` into a scope of `tenantId` (`dumpRoleRefusal`): the tenant's roles
+     * as this host stores them now, against the dump's role rows and seats, with the keys the modules
+     * registered or listed here reserve and declare. Synchronous, so a caller inside the load's
+     * transaction judges the roles stored at that moment.
+     */
+    refuseDumpRoles(tenantId, dump) {
+        const prefix = `${tenantId}/`;
+        const roles = [...this.roles].filter(([k]) => k.startsWith(prefix)).map(([, r]) => r);
+        const refusal = dumpRoleRefusal(roles, { reserved: this.reservedKeys, declared: this.declaredKeys }, dump, this.clock());
+        if (refusal)
+            throw substratError('forbidden', refusal);
+    }
+    /**
+     * #2447: does anyone but a system principal hold a live seat in `roleKey` in this tenant — a
+     * tenant-level assignment, or a scope-level one in any of its scopes not reaped
+     * (`SEAT_HOLDING_SCOPE_STATUSES`: an archived scope's seats come back on unarchive, one archived
+     * straight from provisioning included)? A scope with no store on disk holds none and is not opened.
+     */
+    roleSeated(tenantId, roleKey) {
+        const now = this.clock();
+        const holds = (rows) => rows.some((r) => r.role_key === roleKey);
+        if (holds(this.directory.prepare(TENANT_SEATED_ROLES_SQL).all(tenantId, now)))
+            return true;
+        const scopes = this.directory
+            .prepare(`SELECT scope_id FROM scopes WHERE tenant_id = ? AND status IN (${SEAT_HOLDING_SCOPE_STATUSES.map(() => '?').join(', ')})`)
+            .all(tenantId, ...SEAT_HOLDING_SCOPE_STATUSES);
+        return scopes.some((s) => {
+            // Read without creating storage: a scope whose store is neither open nor on disk never held a
+            // seat (a scope archived straight from provisioning may be one), and opening it would create it.
+            const id = s.scope_id;
+            if (!this.scopes.has(`${tenantId}/${id}`) && !existsSync(join(this.dir, `${tenantId}__${id}.sqlite`)))
+                return false;
+            return holds(this.runtime(tenantId, id).db.prepare(SCOPE_SEATED_ROLES_SQL).all(now));
+        });
+    }
+    /**
+     * #2446: the roles this host stores for `tenantId` and the role keys anyone but a system principal
+     * holds a live seat in at `scopeId` (`SCOPE_SEATED_ROLES_SQL`): the Cloudflare host's
+     * `roleStateLocal`, the state a CP-less reconcile judges a role set against and a promote judges the
+     * incoming version's set with. It is deliberately narrower than this host's own `defineRole`
+     * judgement (`roleSeated`), which also counts tenant-level seats and every other scope's: a
+     * reconcile defines a scope's role set and reads that scope's seats only, and this answers what it
+     * reads (`roleStateContractSuite` pins the two adapters to the same answer, a tenant-level seat
+     * and another scope's seat excluded). Read-only: a scope with no store on disk holds no seat and is
+     * not opened, so the read creates nothing.
+     */
+    async roleStateLocal(tenantId, scopeId) {
+        const prefix = `${tenantId}/`;
+        const roles = [...this.roles]
+            .filter(([k]) => k.startsWith(prefix))
+            .map(([, r]) => ({ key: r.key, permissions: [...r.permissions], ...(r.holder ? { holder: r.holder } : {}) }));
+        const stored = this.scopes.has(`${tenantId}/${scopeId}`) || existsSync(join(this.dir, `${tenantId}__${scopeId}.sqlite`));
+        const seated = stored
+            ? [...new Set(this.runtime(tenantId, scopeId).db.prepare(SCOPE_SEATED_ROLES_SQL).all(this.clock()).map((r) => r.role_key))]
+            : [];
+        return { roles, seated };
+    }
+    /**
+     * The scope database's size in bytes, asked by scope id alone (#2541): the Cloudflare host's
+     * `databaseSizeLocal`, which a vertical's `/internal/database-size` calls. Counts as
+     * `scopeDatabaseSize` does. A scope this host does not hold is refused before any store is opened.
+     */
+    async databaseSizeLocal(scopeId) {
+        return databaseBytesOf(this.heldReadDb(scopeId));
+    }
+    /** What the scope's attachment rows sum to (#2501), asked by scope id alone: refused as the size is (#2541). */
+    async attachmentSizeLocal(scopeId) {
+        return attachmentBytesOf(this.heldReadDb(scopeId));
+    }
+    // -- the introspection reads a vertical's `/internal/*` routes make by scope id alone (#2544) --------
+    // The Cloudflare host's `*Local` verbs, refused from the directory before any store is opened
+    // (`heldReadDb`), so a scope this host does not hold is `conflict`, never an empty answer and never
+    // a store file created for it. No audit row, as there: the control plane that called is the auditor.
+    async facetEventsLocal(scopeId, input) {
+        return facetEvents({ sql: scopedSql(this.heldReadDb(scopeId)) }, input);
+    }
+    async eventEffectsLocal(scopeId, input) {
+        return walkEventEffects({ sql: scopedSql(this.heldReadDb(scopeId)) }, input.eventId, input.maxNodes);
+    }
+    async invocationEventsLocal(scopeId, input) {
+        return readInvocation({ sql: scopedSql(this.heldReadDb(scopeId)) }, input.invocationId, input.limit);
+    }
+    async deadLettersLocal(scopeId, input) {
+        return readDeadLetters({ sql: scopedSql(this.heldReadDb(scopeId)) }, { limit: input.limit, cursor: input.cursor });
+    }
+    async lifecycleFlowLocal(scopeId, input) {
+        return readLifecycleFlow({ sql: scopedSql(this.heldReadDb(scopeId)) }, input);
+    }
+    async operationSeriesLocal(scopeId, input) {
+        return readOperationSeries({ sql: scopedSql(this.heldReadDb(scopeId)) }, input);
+    }
+    async eventCauseLocal(scopeId, input) {
+        return walkEventCause({ sql: scopedSql(this.heldReadDb(scopeId)) }, input.eventId, input.maxDepth);
+    }
+    async entityHistoryLocal(scopeId, input) {
+        return readHistory({ sql: scopedSql(this.heldReadDb(scopeId)) }, { entityType: input.entityType, entityId: input.entityId }, { limit: input.limit, cursor: input.cursor });
+    }
+    async appliedMigrationsLocal(scopeId) {
+        return appliedMigrationsOf(this.heldReadDb(scopeId));
+    }
+    /** No PITR on plain SQLite: an empty list for a held scope, as `scopeMigrationBookmarks` answers. */
+    async migrationBookmarksLocal(scopeId) {
+        this.heldReadDb(scopeId);
+        return [];
+    }
+    async introspectScopeTables(scopeId) {
+        return scopeTablesOf(this.heldReadDb(scopeId));
+    }
+    /** The Data view's table page (#2563): refused `conflict` with the shared sentence for a scope this host does not hold. */
+    async introspectScopeTable(scopeId, input) {
+        return scopeTablePageOf(this.heldReadDb(scopeId), input);
+    }
+    /**
+     * The carry's read of a wiped copy's tombstone (#2563). Plain SQLite has no carry and no wipe, so
+     * a store it does not hold is one it does not have: this reads what `introspectScopeTable` reads.
+     */
+    async readTombstoneTable(scopeId, input) {
+        return scopeTablePageOf(this.heldReadDb(scopeId), input);
+    }
+    /** The SQL console's CP-less path (#219), guarded as the table page is (#2563). */
+    async introspectScopeQuery(scopeId, input) {
+        return scopeQueryOf(this.heldReadDb(scopeId), input).result;
+    }
+    async undrainedEventsLocal(scopeId, limit) {
+        return undrainedEventsFrom(this.heldReadDb(scopeId), Math.max(limit, 1));
+    }
+    async redrainCountLocal(scopeId, drainedBefore) {
+        return redrainCountOf(this.heldReadDb(scopeId), drainedBefore);
+    }
+    /**
+     * The read connection of a scope this host holds, for a read that names only the scope id (#2541),
+     * with the directory read ONCE. Refused `conflict` before anything is opened: no row, a reaped one
+     * (a tombstone whose store is gone), or a scope with no store open or on disk (archived straight
+     * from provisioning, as the Cloudflare host's object holding nothing is), since `runtime()` would
+     * create the store those leave absent.
+     */
+    heldReadDb(scopeId) {
+        const row = this.directory.prepare('SELECT tenant_id, status FROM scopes WHERE scope_id = ?').get(scopeId);
+        const stored = row !== undefined && (this.scopes.has(`${row.tenant_id}/${scopeId}`) || existsSync(join(this.dir, `${row.tenant_id}__${scopeId}.sqlite`)));
+        if (!row || row.status === 'reaped' || !stored)
+            throw substratError('conflict', scopeNotHeldRefusal(scopeId));
+        return this.readDb(this.runtime(row.tenant_id, scopeId));
+    }
     /** #2430: refuse a raw grant of a key a module registered here reserves (`reservedGrantRefusal`). */
     refuseReservedGrant(permissions) {
         const refusal = reservedGrantRefusal(permissions, this.reservedKeys);
@@ -3921,7 +4375,9 @@ export class SqliteScopeHost {
         });
         return report;
     }
-    async runDueSchedules(moduleId, tenantId, scopeId) {
+    async runDueSchedules(moduleId, tenantId, scopeId, 
+    /** #2517: what the sweep tick's earlier calls did to this scope (`ScopeHost.runDueSchedules`). */
+    tick) {
         const report = { fired: 0, skipped: 0, failed: 0, errors: [], runs: [] };
         const mod = this.modules.get(moduleId);
         if (!mod || mod.schedules.length === 0)
@@ -3989,6 +4445,16 @@ export class SqliteScopeHost {
         // scope at once. `ScheduleRunReport.platformRequests` says what that does and does not count.
         let platformRequests = 0;
         const counted = { onPlatformRequests: (n) => (platformRequests += n) };
+        // #2517: the part of that the purge runs enqueued, which is what defers a later purge head the
+        // cap refuses (`runPurgePass`): this call's, on top of what the tick's earlier calls report.
+        const earlierPurgeRequests = tick?.earlierPurgeRequests ?? 0;
+        let purgeRequests = 0;
+        const purgeCounted = {
+            onPlatformRequests: (n) => {
+                platformRequests += n;
+                purgeRequests += n;
+            },
+        };
         for (const schedule of mod.schedules) {
             const lastRunAt = gate.lastRuns.get(schedule.operation) ?? null;
             const lastRun = lastRunAt ? Date.parse(lastRunAt) : null;
@@ -4016,7 +4482,16 @@ export class SqliteScopeHost {
                     // #119: a purge horizon's schedule runs its operation once per due entity, never once.
                     // #2192: under the run's own id, so the purges and their deliveries join this run's line.
                     // #2431: each purge is an invoke, and reports what it enqueued through `counted` like any other.
-                    const pass = await this.runPurgeSweep(moduleId, tenantId, scopeId, schedule.operation, invocationId, counted);
+                    // #2517: what the purge runs before this one in the tick enqueued, so a head the cap refuses
+                    // because they filled the queue is deferred to the next tick rather than failed.
+                    const pass = await this.runPurgeSweep(moduleId, tenantId, scopeId, schedule.operation, invocationId, purgeCounted, earlierPurgeRequests + purgeRequests);
+                    if (pass.deferred) {
+                        // Ran nothing: no line, no cadence row, `skipped` like any run that did not happen.
+                        report.skipped += 1;
+                        report.deferred = (report.deferred ?? 0) + 1;
+                        report.runs.push({ operation: schedule.operation, outcome: 'skipped' });
+                        continue;
+                    }
                     stillDue = purgeStillDue(pass);
                     const outcome = purgeReportOf(schedule.operation, schedule.purge.entityType, pass);
                     report.errors.push(...outcome.errors);
@@ -4079,6 +4554,8 @@ export class SqliteScopeHost {
         lines.end();
         if (platformRequests > 0)
             report.platformRequests = platformRequests;
+        if (purgeRequests > 0)
+            report.purgeRequests = purgeRequests;
         return report;
     }
     /**
@@ -4093,7 +4570,9 @@ export class SqliteScopeHost {
     /** #2192: the schedule run this pass belongs to; every purge in it runs under that id. */
     runInvocationId, 
     /** #2431: how each purge reports the platform requests it enqueued. */
-    counted) {
+    counted, 
+    /** #2517: platform requests the purge runs earlier in this tick enqueued. */
+    earlierPurgeRequests = 0) {
         const entityType = this.modules
             .get(moduleId)
             ?.schedules.find((s) => s.operation === operation && s.purge)?.purge?.entityType;
@@ -4121,7 +4600,7 @@ export class SqliteScopeHost {
         const stub = await this.openSystemScope(moduleId, tenantId, scopeId, true, counted);
         return runPurgePass(operation, due, async (entityId) => {
             await stub.invoke(operation, { [due.idFrom]: entityId }, { invocationId: runInvocationId });
-        }, (write) => rt.actor.turn(() => write(spineSql(rt.db))));
+        }, (write) => rt.actor.turn(() => write(spineSql(rt.db))), earlierPurgeRequests);
     }
     /**
      * #119: the purge gate's facts (`PurgeGateFacts`) — the module's switch from the scope's own
@@ -5600,15 +6079,20 @@ export class SqliteScopeHost {
         // #1748: the evidence, its issue and its finding in ONE transaction — a detector that
         // throws takes the evidence with it, so the caller's retry observes it rather than finding
         // the row already there and the observation lost.
+        // #2540: a tenant's row with a `detail` is a pair — the tenant's row says what was answered, and
+        // a row with no tenant, which only staff read, carries the failure's own text. Counted once.
+        const detail = entry.tenantId && typeof entry.detail === 'string' ? entry.detail : null;
         this.directory.transaction(() => {
-            this.directory
-                .prepare(`INSERT INTO _substrat_ops_failures
-             (id, actor, operation, stage, tenant_id, scope_id, vertical, version, status, message, reference, origin, code, fingerprint, at)
-           VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`)
-                .run(ulid(), entry.actor, entry.operation, entry.stage ?? null, entry.tenantId ?? null, entry.scopeId ?? null, entry.vertical ?? null, entry.version ?? null, entry.status ?? null, 
+            const insert = this.directory.prepare(`INSERT INTO _substrat_ops_failures
+           (id, actor, operation, stage, tenant_id, scope_id, vertical, version, status, message, reference, origin, code, fingerprint, at)
+         VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`);
+            const row = (tenantId, message) => insert.run(ulid(), entry.actor, entry.operation, entry.stage ?? null, tenantId, entry.scopeId ?? null, entry.vertical ?? null, entry.version ?? null, entry.status ?? null, 
             // Bounded here, not trusted from the catch site: one runaway upstream
             // body must not become a runaway directory row (#559).
-            entry.message.slice(0, 2000), entry.reference ?? null, entry.origin ?? null, entry.code ?? null, fingerprint, at);
+            message.slice(0, 2000), entry.reference ?? null, entry.origin ?? null, entry.code ?? null, fingerprint, at);
+            if (detail !== null)
+                row(null, detail);
+            row(entry.tenantId ?? null, entry.message);
             // Prune-on-write (#559): retention lives here, not in a cron — every insert
             // pays for its own housekeeping, so the table stays bounded even where no
             // scheduled pass runs (this adapter has none).
@@ -5632,7 +6116,11 @@ export class SqliteScopeHost {
              last_version = COALESCE(excluded.last_version, last_version),
              origin = COALESCE(excluded.origin, origin),
              status = CASE WHEN status = 'resolved' THEN 'regressed' ELSE status END`)
-                .run(fingerprint, entry.operation, entry.stage ?? null, entry.origin ?? null, entry.code ?? null, at, at, entry.message.slice(0, 2000), entry.tenantId ?? null, issueExemplarOwner(entry.tenantId ?? null), entry.vertical ?? null, entry.version ?? null);
+                .run(fingerprint, entry.operation, entry.stage ?? null, entry.origin ?? null, entry.code ?? null, at, at, 
+            // The issues are staff's (#2540): a pair's exemplar is its own text, not the tenant's
+            // sentence, and it is owned as the row it is copied from is, the platform's — so erasure
+            // reaches it on an id match, as it reaches that row.
+            (detail ?? entry.message).slice(0, 2000), detail !== null ? null : (entry.tenantId ?? null), issueExemplarOwner(detail !== null ? null : (entry.tenantId ?? null)), entry.vertical ?? null, entry.version ?? null);
             const issueHorizon = new Date(Date.now() - ISSUE_RETENTION_DAYS * 86_400_000).toISOString();
             this.directory.prepare('DELETE FROM _substrat_issues WHERE last_seen < ?').run(issueHorizon);
             // #1748: the tenant's Recurring finding, over the tenant's own occurrences only.
@@ -5746,6 +6234,20 @@ export class SqliteScopeHost {
                 .get(slugValue);
             return r ? mapVertical(r) : undefined;
         };
+        /**
+         * #2528: one vertical row update whose admin row takes its `before` (and whose guard runs, by
+         * throwing) from the vertical as the write's own transaction reads it.
+         */
+        const updateVertical = (actor, action, slugValue, set, args, judge, after) => {
+            let before = null;
+            this.directoryWriteAndAudit(() => {
+                const existing = readVertical(slugValue);
+                if (!existing)
+                    throw substratError('not_found', `unknown vertical '${slugValue}'`);
+                before = judge(existing);
+                return this.directory.prepare(`UPDATE verticals SET ${set} WHERE slug = ?`).run(...args, slugValue).changes > 0;
+            }, () => this.recordAdmin(actor, action, { tenantId: null }, before, after));
+        };
         const mapVersion = (r) => verticalVersion.parse({
             id: r.id,
             verticalSlug: r.vertical_slug,
@@ -5772,6 +6274,14 @@ export class SqliteScopeHost {
             }
             return r ? mapVersion(r) : undefined;
         };
+        /** A version's admission, read synchronously so a transaction can judge it (#2528). */
+        const versionAdmission = (id) => {
+            const v = this.directory.prepare('SELECT admission, admission_note FROM vertical_versions WHERE id = ?')
+                .get(id);
+            if (!v)
+                throw substratError('not_found', `unknown version ${id}`);
+            return v;
+        };
         const mapOrg = (r) => orgSchema.parse({
             id: r.org_id,
             tenantId: r.tenant_id,
@@ -5833,6 +6343,32 @@ export class SqliteScopeHost {
             archivedFromStatus: (r.archived_from_status ?? null),
             createdAt: r.created_at,
         });
+        // The directory rows `listScopes` and `listScopesReadable` map, filtered and paged alike.
+        const scopeRows = (filter) => {
+            const where = [];
+            const params = [];
+            if (filter?.tenantId) {
+                where.push('tenant_id = ?');
+                params.push(filter.tenantId);
+            }
+            if (filter?.status) {
+                const statuses = Array.isArray(filter.status) ? filter.status : [filter.status];
+                // An empty array means "no status is acceptable" — match nothing, rather
+                // than degenerating into an unfiltered read of the whole fleet.
+                if (statuses.length === 0)
+                    return [];
+                // One JSON array, the shape the DO twin needs for its 100-parameter limit (#1776).
+                where.push('status IN (SELECT value FROM json_each(?))');
+                params.push(JSON.stringify(statuses));
+            }
+            if (filter?.vertical) {
+                where.push('vertical = ?');
+                params.push(filter.vertical);
+            }
+            const tail = keysetTail(where, params, 'scope_id', filter);
+            const sql = 'SELECT * FROM scopes' + (where.length ? ` WHERE ${where.join(' AND ')}` : '') + tail;
+            return this.directory.prepare(sql).all(...params);
+        };
         // The (version, scope) pair a bind and its impact read both start from, and the refusals
         // that come before any export-break question, in the order the bind makes them (#1756).
         const bindTarget = async (tenantId, scopeId, versionId) => {
@@ -5900,8 +6436,8 @@ export class SqliteScopeHost {
                 }
                 if (to === 'reaped') {
                     forgetSwitchesOf(switchSqlOf(this.directory), scopeId);
-                    // #1524: its storage is gone, so its samples describe nothing.
-                    forgetScopeStorage(redactionSqlOf(this.directory), scopeId);
+                    // #2515: its storage is gone, and its measured days are kept for the invoice (retention ends them).
+                    retireScopeStorage(redactionSqlOf(this.directory), scopeId);
                 }
                 // The audit target carries the scope's vertical (control-plane.md §4.4:
                 // "vertical stays null until §4.2 lifecycle actions that name one"). It is
@@ -6236,6 +6772,10 @@ export class SqliteScopeHost {
             canStoreSecrets: isSecretBoxConfigured(this.secretBox),
             defineRole: async (actor, tenantId, role) => {
                 const parsed = roleDefinition.parse(role);
+                // #2447: judged before the write, against this host's keys and the tenant's other roles, so a
+                // role assigned through a door cannot be widened afterwards. A refusal writes nothing, so a
+                // seat of the role as it was stored keeps working.
+                this.refuseReservedDefinition(tenantId, parsed);
                 const before = this.roles.get(`${tenantId}/${parsed.key}`) ?? null;
                 this.directory
                     .prepare(`INSERT OR REPLACE INTO _substrat_roles (tenant_id, role_key, permissions, source, holder)
@@ -6856,10 +7396,17 @@ export class SqliteScopeHost {
                     }
                     throw substratError('conflict', `vertical '${parsed.slug}' is already registered as ${existing.source}`);
                 }
-                this.directory
-                    .prepare('INSERT INTO verticals (slug, name, source, owner_tenant, env_spec, install_spec, listed, created_at) VALUES (?, ?, ?, ?, ?, ?, ?, ?)')
-                    .run(parsed.slug, parsed.name, parsed.source, parsed.ownerTenant, envSpecJson, installSpecJson, parsed.listed ? 1 : 0, new Date().toISOString());
-                this.recordAdmin(actor, 'registerVertical', { tenantId: null }, null, parsed);
+                const createdAt = verticalOwnerNow();
+                // #2501: the slug's ownership period opens with its row, in the same transaction.
+                this.directoryWriteAndAudit(() => {
+                    const changed = this.directory
+                        .prepare('INSERT INTO verticals (slug, name, source, owner_tenant, env_spec, install_spec, listed, created_at) VALUES (?, ?, ?, ?, ?, ?, ?, ?)')
+                        .run(parsed.slug, parsed.name, parsed.source, parsed.ownerTenant, envSpecJson, installSpecJson, parsed.listed ? 1 : 0, createdAt)
+                        .changes > 0;
+                    if (changed)
+                        openVerticalOwnerRow(redactionSqlOf(this.directory), parsed.slug, parsed.ownerTenant, createdAt);
+                    return changed;
+                }, () => this.recordAdmin(actor, 'registerVertical', { tenantId: null }, null, parsed));
             },
             listVerticals: async (actor, page) => {
                 const where = [];
@@ -6872,15 +7419,15 @@ export class SqliteScopeHost {
             },
             publishVersion: async (actor, input) => {
                 const parsed = publishVersionInput.parse(input);
-                const owning = readVertical(parsed.verticalSlug);
-                if (!owning) {
-                    throw substratError('not_found', `unknown vertical '${parsed.verticalSlug}'`);
-                }
+                const unknownVertical = () => substratError('not_found', `unknown vertical '${parsed.verticalSlug}'`);
+                if (!readVertical(parsed.verticalSlug))
+                    throw unknownVertical();
                 // Lands PENDING — a push is not a deploy — except for a PRIVATE vertical
                 // (tenant-owned, not listed), whose blast radius is its own tenant: there the
                 // sandbox contract is the gate and the version self-admits, noted so the
-                // publish seam can tell a staff vouch from this shortcut.
-                const selfAdmits = owning.ownerTenant !== null && !owning.listed;
+                // publish seam can tell a staff vouch from this shortcut. Judged in the insert's
+                // transaction (#2528), on the vertical as it reads it there.
+                let selfAdmits = false;
                 // The manifest is retained for the serving upload (#286), not audited — a whole
                 // manifest per publish would drown the admin log in bundle metadata.
                 const { manifestJson, origin, ...audited } = parsed;
@@ -6891,7 +7438,11 @@ export class SqliteScopeHost {
                 const migrationDigest = await publishedMigrationDigest({
                     id: audited.id, migrationDigest: audited.migrationDigest, manifestJson: manifestJson ?? null, migrations: split.migrations,
                 });
-                this.directory.transaction(() => {
+                this.directoryWriteAndAudit(() => {
+                    const owning = readVertical(parsed.verticalSlug);
+                    if (!owning)
+                        throw unknownVertical();
+                    selfAdmits = owning.ownerTenant !== null && !owning.listed;
                     this.directory
                         .prepare(`INSERT INTO vertical_versions
                  (id, vertical_slug, version, manifest_digest, permission_digest,
@@ -6902,14 +7453,14 @@ export class SqliteScopeHost {
                     writeVersionMigrations(switchSqlOf(this.directory), audited.id, split.migrations);
                     // #2286: the version's scope-store bindings, refusing one moved to another driver, in the insert's transaction.
                     indexVersionScopeStores(switchSqlOf(this.directory), audited.verticalSlug, audited.id, split.manifestJson);
-                })();
-                this.recordAdmin(actor, 'publishVersion', { tenantId: null }, null, {
+                    return true;
+                }, () => this.recordAdmin(actor, 'publishVersion', { tenantId: null }, null, {
                     ...audited,
                     // The digest the registry holds, which differs from the pushed one only for an unheld version.
                     migrationDigest,
                     ...(origin ? { origin } : {}),
                     admission: selfAdmits ? 'admitted' : 'pending',
-                });
+                }));
             },
             verticalScopeStores: async (actor, verticalSlug) => {
                 // One transaction: versions not indexed yet are indexed by the read (#2286).
@@ -6940,141 +7491,120 @@ export class SqliteScopeHost {
                 this.recordAccess(actor, 'getVersion', {}, { versionId, verticalSlug }, hit ? 1 : 0);
                 return hit;
             },
+            // #2528: each vertical write below reads its row's `before`, and runs its guard, inside the
+            // transaction that writes (`updateVertical`).
             setVerticalListed: async (actor, slug, listed) => {
-                const existing = readVertical(slug);
-                if (!existing)
-                    throw substratError('not_found', `unknown vertical '${slug}'`);
-                // Listing is the moment other tenants start trusting this code, so the
-                // version they would install must carry a real staff vouch — an auto-admitted
-                // prod version has never been read by anyone but its author.
-                if (listed) {
-                    const prod = this.directory
-                        .prepare("SELECT version_id FROM vertical_channels WHERE vertical_slug = ? AND channel = 'prod'")
-                        .get(slug);
-                    const prodVersion = prod ? await readVersion(prod.version_id) : undefined;
-                    if (prodVersion?.admissionNote === AUTO_ADMISSION_NOTE) {
-                        throw substratError('conflict', `vertical '${slug}' prod version ${prodVersion.id} is auto-admitted (private self-serve) — ` +
-                            `a staff admit must vouch for it before listing`);
-                    }
-                }
                 // Resolve any pending publish request either way, and set the flag.
-                this.directory
-                    .prepare('UPDATE verticals SET listed = ?, publish_requested_at = NULL WHERE slug = ?')
-                    .run(listed ? 1 : 0, slug);
-                this.recordAdmin(actor, 'setVerticalListed', { tenantId: null }, { listed: existing.listed }, { listed });
+                updateVertical(actor, 'setVerticalListed', slug, 'listed = ?, publish_requested_at = NULL', [listed ? 1 : 0], (existing) => {
+                    // Listing is the moment other tenants start trusting this code, so the
+                    // version they would install must carry a real staff vouch — an auto-admitted
+                    // prod version has never been read by anyone but its author.
+                    if (listed) {
+                        const prod = this.directory
+                            .prepare(`SELECT v.id, v.admission_note FROM vertical_channels c JOIN vertical_versions v ON v.id = c.version_id
+                  WHERE c.vertical_slug = ? AND c.channel = 'prod'`)
+                            .get(slug);
+                        if (prod?.admission_note === AUTO_ADMISSION_NOTE) {
+                            throw substratError('conflict', `vertical '${slug}' prod version ${prod.id} is auto-admitted (private self-serve) — ` +
+                                `a staff admit must vouch for it before listing`);
+                        }
+                    }
+                    return { listed: existing.listed };
+                }, { listed });
             },
             requestPublish: async (actor, slug) => {
-                const existing = readVertical(slug);
-                if (!existing)
-                    throw substratError('not_found', `unknown vertical '${slug}'`);
-                this.directory.prepare('UPDATE verticals SET publish_requested_at = ? WHERE slug = ?').run(new Date().toISOString(), slug);
-                this.recordAdmin(actor, 'requestPublish', { tenantId: null }, null, { slug });
+                updateVertical(actor, 'requestPublish', slug, 'publish_requested_at = ?', [new Date().toISOString()], () => null, { slug });
             },
             setVerticalInstallsBlocked: async (actor, slug, blocked) => {
-                const existing = readVertical(slug);
-                if (!existing)
-                    throw substratError('not_found', `unknown vertical '${slug}'`);
-                this.directory
-                    .prepare('UPDATE verticals SET installs_blocked = ? WHERE slug = ?')
-                    .run(blocked ? 1 : 0, slug);
-                this.recordAdmin(actor, 'setVerticalInstallsBlocked', { tenantId: null }, { installsBlocked: existing.installsBlocked }, { installsBlocked: blocked });
+                updateVertical(actor, 'setVerticalInstallsBlocked', slug, 'installs_blocked = ?', [blocked ? 1 : 0], (existing) => ({ installsBlocked: existing.installsBlocked }), { installsBlocked: blocked });
             },
             setVerticalTenantProvisioner: async (actor, slug, granted) => {
-                const existing = readVertical(slug);
-                if (!existing)
-                    throw substratError('not_found', `unknown vertical '${slug}'`);
-                this.directory
-                    .prepare('UPDATE verticals SET tenant_provisioner = ? WHERE slug = ?')
-                    .run(granted ? 1 : 0, slug);
-                this.recordAdmin(actor, 'setVerticalTenantProvisioner', { tenantId: null }, { tenantProvisioner: existing.tenantProvisioner }, { tenantProvisioner: granted });
+                updateVertical(actor, 'setVerticalTenantProvisioner', slug, 'tenant_provisioner = ?', [granted ? 1 : 0], (existing) => ({ tenantProvisioner: existing.tenantProvisioner }), { tenantProvisioner: granted });
             },
             setVerticalEmailSender: async (actor, slug, granted) => {
-                const existing = readVertical(slug);
-                if (!existing)
-                    throw substratError('not_found', `unknown vertical '${slug}'`);
-                this.directory
-                    .prepare('UPDATE verticals SET email_sender = ? WHERE slug = ?')
-                    .run(granted ? 1 : 0, slug);
-                this.recordAdmin(actor, 'setVerticalEmailSender', { tenantId: null }, { emailSender: existing.emailSender }, { emailSender: granted });
+                updateVertical(actor, 'setVerticalEmailSender', slug, 'email_sender = ?', [granted ? 1 : 0], (existing) => ({ emailSender: existing.emailSender }), { emailSender: granted });
             },
             deleteVertical: async (actor, slug) => {
-                const existing = readVertical(slug);
-                if (!existing)
-                    throw substratError('not_found', `unknown vertical '${slug}'`);
-                // Refuse while any restorable scope is bound: a deleted registry row would strand
-                // those scopes' version pins and routing. An `archived` scope (a deleted app) still
-                // blocks — unarchive can bring it back — but the refusal names reap/restore, not
-                // "delete", because the app itself is already gone. `reaped` is terminal history
-                // and never blocks. The count names the blast radius.
-                const bound = this.directory
-                    .prepare('SELECT ' +
-                    "COUNT(*) FILTER (WHERE status NOT IN ('archived', 'reaped')) AS live, " +
-                    "COUNT(*) FILTER (WHERE status = 'archived') AS archived " +
-                    'FROM scopes WHERE vertical = ?')
-                    .get(slug);
-                if (bound.live > 0) {
-                    throw substratError('conflict', `vertical '${slug}' still backs ${bound.live} scope(s) — delete or rebind them first`);
-                }
-                if (bound.archived > 0) {
-                    throw substratError('conflict', `vertical '${slug}' still backs ${bound.archived} archived scope(s) — reap or restore them first`);
-                }
                 // Deployed dispatch scripts are NOT reaped here — they become orphans for the
                 // cleanup script (#248), never destroyed alongside a registry row.
-                this.directory.prepare('DELETE FROM vertical_channels WHERE vertical_slug = ?').run(slug);
-                this.directory.prepare('DELETE FROM vertical_channel_history WHERE vertical_slug = ?').run(slug);
-                this.directory
-                    .prepare(`DELETE FROM vertical_version_migrations
-              WHERE version_id IN (SELECT id FROM vertical_versions WHERE vertical_slug = ?)`)
-                    .run(slug);
-                forgetVerticalScopeStores(switchSqlOf(this.directory), slug);
-                this.directory.prepare('DELETE FROM vertical_versions WHERE vertical_slug = ?').run(slug);
-                this.directory.prepare('DELETE FROM verticals WHERE slug = ?').run(slug);
-                this.recordAdmin(actor, 'deleteVertical', { tenantId: null }, { slug, source: existing.source, ownerTenant: existing.ownerTenant }, null);
-            },
-            admitVersion: async (actor, versionId) => {
-                const v = await readVersion(versionId);
-                if (!v)
-                    throw substratError('not_found', `unknown version ${versionId}`);
-                if (v.admission === 'admitted') {
-                    // Idempotent — except an AUTO-admitted version, which this upgrades to a
-                    // manual vouch by clearing the note (what the publish seam requires).
-                    if (v.admissionNote !== AUTO_ADMISSION_NOTE)
-                        return;
+                // #2501: one transaction, so the row and its ownership period close together; #2528: its
+                // `before` and the bound-scope refusal are read in it too.
+                let existing;
+                this.directoryWriteAndAudit(() => {
+                    existing = readVertical(slug);
+                    if (!existing)
+                        throw substratError('not_found', `unknown vertical '${slug}'`);
+                    // Refuse while any restorable scope is bound: a deleted registry row would strand
+                    // those scopes' version pins and routing. An `archived` scope (a deleted app) still
+                    // blocks — unarchive can bring it back — but the refusal names reap/restore, not
+                    // "delete", because the app itself is already gone. `reaped` is terminal history
+                    // and never blocks. The count names the blast radius.
+                    const bound = this.directory
+                        .prepare('SELECT ' +
+                        "COUNT(*) FILTER (WHERE status NOT IN ('archived', 'reaped')) AS live, " +
+                        "COUNT(*) FILTER (WHERE status = 'archived') AS archived " +
+                        'FROM scopes WHERE vertical = ?')
+                        .get(slug);
+                    if (bound.live > 0) {
+                        throw substratError('conflict', `vertical '${slug}' still backs ${bound.live} scope(s) — delete or rebind them first`);
+                    }
+                    if (bound.archived > 0) {
+                        throw substratError('conflict', `vertical '${slug}' still backs ${bound.archived} archived scope(s) — reap or restore them first`);
+                    }
+                    this.directory.prepare('DELETE FROM vertical_channels WHERE vertical_slug = ?').run(slug);
+                    this.directory.prepare('DELETE FROM vertical_channel_history WHERE vertical_slug = ?').run(slug);
                     this.directory
-                        .prepare('UPDATE vertical_versions SET admission_note = NULL WHERE id = ?')
-                        .run(versionId);
-                    this.recordAdmin(actor, 'admitVersion', { tenantId: null }, { admission: v.admission, note: v.admissionNote }, {
-                        admission: 'admitted',
-                        note: null,
-                    });
-                    return;
-                }
-                if (v.admission === 'rejected') {
-                    throw substratError('conflict', `version ${versionId} was rejected — publish a new one`);
-                }
-                this.directory
-                    .prepare("UPDATE vertical_versions SET admission = 'admitted' WHERE id = ?")
-                    .run(versionId);
-                this.recordAdmin(actor, 'admitVersion', { tenantId: null }, { admission: v.admission }, {
-                    admission: 'admitted',
-                });
+                        .prepare(`DELETE FROM vertical_version_migrations
+                WHERE version_id IN (SELECT id FROM vertical_versions WHERE vertical_slug = ?)`)
+                        .run(slug);
+                    forgetVerticalScopeStores(switchSqlOf(this.directory), slug);
+                    forgetVerticalWireAuth(switchSqlOf(this.directory), slug);
+                    this.directory.prepare('DELETE FROM vertical_versions WHERE vertical_slug = ?').run(slug);
+                    const changed = this.directory.prepare('DELETE FROM verticals WHERE slug = ?').run(slug).changes > 0;
+                    if (changed)
+                        closeVerticalOwnerRow(redactionSqlOf(this.directory), slug, verticalOwnerNow());
+                    return changed;
+                }, () => this.recordAdmin(actor, 'deleteVertical', { tenantId: null }, { slug, source: existing.source, ownerTenant: existing.ownerTenant }, null));
+            },
+            listVerticalOwners: async (actor, slug) => {
+                const periods = listVerticalOwnerRows(redactionSqlOf(this.directory), slug);
+                this.recordAccess(actor, 'listVerticalOwners', { tenantId: null }, { slug }, periods.length);
+                return periods;
+            },
+            // #2528: the admission is judged, and the row's `before` read, in the transaction that writes.
+            admitVersion: async (actor, versionId) => {
+                let row = { before: null, after: null };
+                this.directoryWriteAndAudit(() => {
+                    const v = versionAdmission(versionId);
+                    if (v.admission === 'admitted') {
+                        // Idempotent — except an AUTO-admitted version, which this upgrades to a
+                        // manual vouch by clearing the note (what the publish seam requires).
+                        if (v.admission_note !== AUTO_ADMISSION_NOTE)
+                            return false;
+                        row = { before: { admission: v.admission, note: v.admission_note }, after: { admission: 'admitted', note: null } };
+                        return this.directory.prepare('UPDATE vertical_versions SET admission_note = NULL WHERE id = ?').run(versionId).changes > 0;
+                    }
+                    if (v.admission === 'rejected') {
+                        throw substratError('conflict', `version ${versionId} was rejected — publish a new one`);
+                    }
+                    row = { before: { admission: v.admission }, after: { admission: 'admitted' } };
+                    return this.directory.prepare("UPDATE vertical_versions SET admission = 'admitted' WHERE id = ?").run(versionId).changes > 0;
+                }, () => this.recordAdmin(actor, 'admitVersion', { tenantId: null }, row.before, row.after));
             },
             rejectVersion: async (actor, versionId, note) => {
-                const v = await readVersion(versionId);
-                if (!v)
-                    throw substratError('not_found', `unknown version ${versionId}`);
-                if (v.admission === 'admitted') {
-                    throw substratError('conflict', `version ${versionId} is already admitted — it may be bound`);
-                }
-                if (v.admission === 'rejected')
-                    return; // idempotent
-                this.directory
-                    .prepare("UPDATE vertical_versions SET admission = 'rejected', admission_note = ? WHERE id = ?")
-                    .run(note, versionId);
-                this.recordAdmin(actor, 'rejectVersion', { tenantId: null }, { admission: v.admission }, {
-                    admission: 'rejected',
-                    note,
-                });
+                let before = null;
+                this.directoryWriteAndAudit(() => {
+                    const v = versionAdmission(versionId);
+                    if (v.admission === 'admitted') {
+                        throw substratError('conflict', `version ${versionId} is already admitted — it may be bound`);
+                    }
+                    if (v.admission === 'rejected')
+                        return false; // idempotent
+                    before = { admission: v.admission };
+                    return this.directory
+                        .prepare("UPDATE vertical_versions SET admission = 'rejected', admission_note = ? WHERE id = ?")
+                        .run(note, versionId).changes > 0;
+                }, () => this.recordAdmin(actor, 'rejectVersion', { tenantId: null }, before, { admission: 'rejected', note }));
             },
             promotionImpact: async (actor, verticalSlug, channel, versionId) => {
                 const incoming = await readVersion(versionId);
@@ -7158,8 +7688,9 @@ export class SqliteScopeHost {
                 // #2333: a compare-and-set. Every gate above — the review binding, the digest checkpoints,
                 // the export breaks — was judged against `outgoing`, across awaits another promote can run
                 // in. So the pointer moves only if it still names `outgoing`, read and written in one
-                // transaction; the promote that lost the race is refused as stale and writes nothing.
-                const moved = this.directory.transaction(() => {
+                // transaction; the promote that lost the race is refused as stale and writes nothing. Its admin
+                // row commits with the move, ahead of the rebinds below, which record their own.
+                const moved = this.directoryWriteAndAudit(() => {
                     const now = this.directory
                         .prepare('SELECT version_id FROM vertical_channels WHERE vertical_slug = ? AND channel = ?')
                         .get(verticalSlug, channel);
@@ -7178,7 +7709,10 @@ export class SqliteScopeHost {
                VALUES (?, ?, ?, ?, ?, ?, ?)`)
                         .run(ulid(), verticalSlug, channel, versionId, outgoing?.id ?? null, actor, promotedAt);
                     return true;
-                })();
+                }, 
+                // The acknowledgement is recorded, not just enforced: that is what turns
+                // "someone reviewed the permission change" into evidence.
+                () => this.recordAdmin(actor, 'promoteVersion', { tenantId: null, vertical: verticalSlug }, outgoing ? { versionId: outgoing.id, version: outgoing.version } : null, { channel, versionId, version: incoming.version, acknowledged: ack }));
                 if (!moved)
                     throw promoteRaceRefusal(channel);
                 // For a PRIVATE vertical, prod IS what the owner's apps run: re-point the
@@ -7208,9 +7742,6 @@ export class SqliteScopeHost {
                         .prepare('UPDATE scopes SET vertical_version_id = ?, vertical = ? WHERE scope_id = ?')
                         .run(versionId, verticalSlug, s.scope_id).changes > 0, () => this.recordAdmin(actor, 'bindScopeVersion', { tenantId: s.tenant_id, scopeId: s.scope_id }, prev ? { versionId: prev.id, version: prev.version } : null, { versionId, vertical: verticalSlug, version: incoming.version, via: 'promoteVersion' }));
                 }
-                // The acknowledgement is recorded, not just enforced: that is what turns
-                // "someone reviewed the permission change" into evidence.
-                this.recordAdmin(actor, 'promoteVersion', { tenantId: null, vertical: verticalSlug }, outgoing ? { versionId: outgoing.id, version: outgoing.version } : null, { channel, versionId, version: incoming.version, acknowledged: ack });
             },
             listChannels: async (actor, verticalSlug, page) => {
                 // `prod` is the only live channel (#509 retired dev/staging). Filtering here keeps a
@@ -7482,11 +8013,27 @@ export class SqliteScopeHost {
                     throw substratError('not_found', `unknown vertical '${verticalSlug}'`);
                 // #2178: every install on the serving script runs the new version from this moment.
                 this.assertNoStrandFrom([r.serving_version_id], parsed.versionId, r.serving_ref ? this.provisionedVersionsOf(verticalSlug, r.serving_version_id ? { ref: r.serving_ref, versionId: r.serving_version_id } : null, null) : []);
-                this.directory
-                    .prepare(`UPDATE verticals SET serving_ref = ?, serving_version_id = ?,
-                    serving_do_classes = ?, serving_migration_tag = ? WHERE slug = ?`)
-                    .run(parsed.ref, parsed.versionId, JSON.stringify(parsed.doClasses), parsed.migrationTag, verticalSlug);
-                this.recordAdmin(actor, 'setVerticalServing', { tenantId: null }, r.serving_ref ? { ref: r.serving_ref, versionId: r.serving_version_id } : null, { vertical: verticalSlug, ref: parsed.ref, versionId: parsed.versionId });
+                // #2528: a compare-and-set on the serving ref and version the gate judged
+                // (`SERVES_NOW_CONDITION`), and the row's `before` read in the transaction that moves it,
+                // as the Cloudflare host does.
+                let before = null;
+                let raced = false;
+                this.directoryWriteAndAudit(() => {
+                    const now = this.directory
+                        .prepare('SELECT serving_ref, serving_version_id FROM verticals WHERE slug = ?')
+                        .get(verticalSlug);
+                    if (!now)
+                        throw substratError('not_found', `unknown vertical '${verticalSlug}'`);
+                    before = now.serving_ref ? { ref: now.serving_ref, versionId: now.serving_version_id } : null;
+                    const moved = this.directory
+                        .prepare(`UPDATE verticals SET serving_ref = ?, serving_version_id = ?,
+                      serving_do_classes = ?, serving_migration_tag = ? WHERE ${SERVES_NOW_CONDITION}`)
+                        .run(parsed.ref, parsed.versionId, JSON.stringify(parsed.doClasses), parsed.migrationTag, verticalSlug, r.serving_ref ?? null, r.serving_version_id ?? null).changes > 0;
+                    raced = !moved;
+                    return moved;
+                }, () => this.recordAdmin(actor, 'setVerticalServing', { tenantId: null }, before, { vertical: verticalSlug, ref: parsed.ref, versionId: parsed.versionId }));
+                if (raced)
+                    throw servingRaceRefusal(verticalSlug);
             },
             versionManifest: async (actor, verticalSlug, versionId) => {
                 const v = this.directory
@@ -7506,6 +8053,19 @@ export class SqliteScopeHost {
                 this.recordAccess(actor, 'versionMigrations', {}, { verticalSlug, versionId }, v.migrations?.length ?? 0);
                 return v.migrations;
             },
+            recordWireAuth: async (actor, input) => {
+                const row = deploymentWireAuth.parse(input);
+                const written = this.directoryWriteAndAudit(() => writeDeploymentWireAuth(switchSqlOf(this.directory), row), () => this.recordAdmin(actor, 'recordWireAuth', { tenantId: null, vertical: row.verticalSlug }, null, { vertical: row.verticalSlug, deploymentRef: row.deploymentRef, versionId: row.versionId, record: row.record }));
+                if (!written)
+                    throw substratError('not_found', `no capability record for '${row.deploymentRef}': vertical '${row.verticalSlug}' is not registered`);
+            },
+            listWireAuth: async (actor, input) => {
+                // The judged copy, not the caller's object: only its own fields, the reach first, reach the log.
+                const filter = assertWireAuthFilter(input);
+                const rows = deploymentWireAuthOf(switchSqlOf(this.directory), filter);
+                this.recordAccess(actor, 'listWireAuth', wireAuthAccessTarget(filter), filter, rows.length);
+                return rows;
+            },
             setScopeServingRef: async (actor, tenantId, scopeId, servingRef, opts) => {
                 const scope = this.directory.prepare('SELECT * FROM scopes WHERE scope_id = ?').get(scopeId);
                 if (!scope || scope.tenant_id !== tenantId) {
@@ -7555,14 +8115,9 @@ export class SqliteScopeHost {
                 // operation's uncommitted event, the drain shipped it, and the rollback left the lake
                 // — which is append-only — holding an event the scope never had. The mark that
                 // follows needs no such care: it stamps only rows that exist and are undrained.
-                const db = this.scopeReadDbFor(tenantId, scopeId);
-                const page = db.prepare(`SELECT * FROM _substrat_outbox WHERE drained_at IS NULL AND ${emittedHere()} ORDER BY id LIMIT ? OFFSET ?`);
-                // The kernel's read, shared with the DO: the envelope and the columns lifted beside
-                // it (#1242, #1237) are decoded once, and a row that will not decode is stepped over
-                // rather than stalling the scope on it (#1636).
-                const read = readUndrainedOutbox((offset, count) => page.all(count, offset), Math.min(assertRowLimit('limit', limit ?? 200), 1000));
-                this.recordAccess(actor, 'readUndrainedEvents', { tenantId, scopeId }, { limit }, read.events.length);
-                return undrainedEventsOf(read);
+                const events = undrainedEventsFrom(this.scopeReadDbFor(tenantId, scopeId), limit ?? 200);
+                this.recordAccess(actor, 'readUndrainedEvents', { tenantId, scopeId }, { limit }, events.length);
+                return events;
             },
             markEventsDrained: async (actor, tenantId, scopeId, eventIds) => {
                 // BEFORE the empty-batch shortcut, not after. "Nothing to mark" and "you may
@@ -7691,10 +8246,7 @@ export class SqliteScopeHost {
                 // auditor asking "who counted this tenant's outbox, and how much was there" wants.
                 if (countOnly) {
                     // The committed count (#1624): a stranger's uncommitted drain mark is not a fact yet.
-                    const redrainable = this.scopeReadDbFor(tenantId, scopeId)
-                        .prepare(`SELECT COUNT(*) AS c FROM _substrat_outbox
-                  WHERE drained_at IS NOT NULL AND drained_at < ?`)
-                        .get(drainedBefore).c;
+                    const redrainable = redrainCountOf(this.scopeReadDbFor(tenantId, scopeId), drainedBefore);
                     this.recordAccess(actor, 'redrainEvents', { tenantId, scopeId }, { drainedBefore, countOnly: true }, redrainable);
                     return redrainable;
                 }
@@ -7796,20 +8348,12 @@ export class SqliteScopeHost {
                 this.recordAccess(actor, 'operationSeries', { tenantId, scopeId }, delegatedReadParams.operationSeries(input), operationSeriesCount(series));
                 return series;
             },
+            // Every row, newest first (#2553); `rowid DESC` orders migrations stamped in one millisecond.
             scopeAppliedMigrations: async (actor, tenantId, scopeId) => {
                 const db = this.scopeReadDbFor(tenantId, scopeId);
-                const rows = db
-                    .prepare(`SELECT module_id, version, applied_at, duration_ms, rows_changed FROM _substrat_migrations
-              ORDER BY applied_at DESC, module_id, version LIMIT 100`)
-                    .all();
-                this.recordAccess(actor, 'scopeAppliedMigrations', { tenantId, scopeId }, null, rows.length);
-                return rows.map((r) => ({
-                    moduleId: r.module_id,
-                    version: r.version,
-                    appliedAt: r.applied_at ?? null,
-                    durationMs: r.duration_ms,
-                    rowsChanged: r.rows_changed,
-                }));
+                const migrations = appliedMigrationsOf(db);
+                this.recordAccess(actor, 'scopeAppliedMigrations', { tenantId, scopeId }, null, migrations.length);
+                return migrations;
             },
             scopeMigrationBookmarks: async (actor, tenantId, scopeId) => {
                 const scope = this.directory
@@ -7826,10 +8370,7 @@ export class SqliteScopeHost {
             scopeDatabaseSize: async (actor, tenantId, scopeId) => {
                 // #1524: the SQLite twin of a DO's `databaseSize`. It counts allocated pages,
                 // free ones included, which is what the file costs on disk, not the live row bytes.
-                const db = this.scopeReadDbFor(tenantId, scopeId);
-                const pages = db.pragma('page_count', { simple: true });
-                const pageSize = db.pragma('page_size', { simple: true });
-                const bytes = pages * pageSize;
+                const bytes = databaseBytesOf(this.scopeReadDbFor(tenantId, scopeId));
                 this.recordAccess(actor, 'scopeDatabaseSize', { tenantId, scopeId }, null, 1);
                 return bytes;
             },
@@ -7838,6 +8379,11 @@ export class SqliteScopeHost {
                 this.recordAccess(actor, 'scopeStoreSizes', { tenantId, scopeId }, null, sizes.length);
                 return sizes;
             },
+            scopeAttachmentBytes: async (actor, tenantId, scopeId) => {
+                const bytes = attachmentBytesOf(this.scopeReadDbFor(tenantId, scopeId));
+                this.recordAccess(actor, 'scopeAttachmentBytes', { tenantId, scopeId }, null, 1);
+                return bytes;
+            },
             rewindScope: async () => {
                 throw new Error('point-in-time rewind is not available on this host (PITR is a Durable-Object-plane mechanism) — use the backup restore path');
             },
@@ -7960,18 +8506,18 @@ export class SqliteScopeHost {
                 const slugOwner = this.directory
                     .prepare('SELECT tenant_id FROM tenants WHERE slug = ?')
                     .get(parsed.slug);
+                // #2556: the refusal never names the owner. Another tenant holds it, and the text
+                // reaches whoever asked (a manager vertical's intent journal among them).
                 if (slugOwner) {
-                    throw substratError('conflict', `tenant slug '${parsed.slug}' already taken by ${slugOwner.tenant_id} (slugs are unique)`);
+                    throw substratError('conflict', `tenant slug '${parsed.slug}' is already taken (slugs are unique)`);
                 }
-                this.directory
+                this.directoryWriteAndAudit(() => this.directory
                     .prepare(`INSERT INTO tenants (tenant_id, slug, name, status, created_at, provisioned_by_tenant)
              VALUES (?, ?, ?, 'active', ?, ?)`)
-                    .run(parsed.id, parsed.slug, parsed.name, new Date().toISOString(), parsed.provisionedByTenant ?? null);
-                this.recordAdmin(actor, 'createTenant', { tenantId: parsed.id }, null, readTenant(parsed.id));
+                    .run(parsed.id, parsed.slug, parsed.name, new Date().toISOString(), parsed.provisionedByTenant ?? null).changes > 0, () => this.recordAdmin(actor, 'createTenant', { tenantId: parsed.id }, null, readTenant(parsed.id)));
             },
             setTenantStatus: async (actor, tenantId, status) => {
-                const before = readTenant(tenantId);
-                if (!before)
+                if (!readTenant(tenantId))
                     throw substratError('not_found', `unknown tenant: ${tenantId}`);
                 // `reaped` is terminal and destroys data — it is unreachable here and only
                 // ever set by reapTenant, so a plain status flip cannot forge a tombstone
@@ -7981,27 +8527,33 @@ export class SqliteScopeHost {
                 }
                 // Stamp/clear deleting_at so the grace-window sweep can age tenants (§4.8):
                 // entering `deleting` stamps, leaving it (an un-delete) clears — exactly the
-                // shape suspendScope/archiveScope use for archived_at.
-                if (status === 'deleting') {
-                    this.directory
-                        .prepare('UPDATE tenants SET status = ?, deleting_at = ? WHERE tenant_id = ?')
-                        .run(status, new Date().toISOString(), tenantId);
-                }
-                else {
-                    this.directory
-                        .prepare('UPDATE tenants SET status = ?, deleting_at = NULL WHERE tenant_id = ?')
-                        .run(status, tenantId);
-                }
-                this.recordAdmin(actor, 'setTenantStatus', { tenantId }, { status: before.status }, { status });
+                // shape suspendScope/archiveScope use for archived_at. #2528: the row's `before` is the
+                // status the write's own transaction reads.
+                let before;
+                this.directoryWriteAndAudit(() => {
+                    before = readTenant(tenantId);
+                    if (!before)
+                        throw substratError('not_found', `unknown tenant: ${tenantId}`);
+                    return (status === 'deleting'
+                        ? this.directory
+                            .prepare('UPDATE tenants SET status = ?, deleting_at = ? WHERE tenant_id = ?')
+                            .run(status, new Date().toISOString(), tenantId)
+                        : this.directory
+                            .prepare('UPDATE tenants SET status = ?, deleting_at = NULL WHERE tenant_id = ?')
+                            .run(status, tenantId)).changes > 0;
+                }, () => this.recordAdmin(actor, 'setTenantStatus', { tenantId }, { status: before.status }, { status }));
             },
             setTenantName: async (actor, tenantId, name) => {
-                const before = readTenant(tenantId);
-                if (!before)
-                    throw substratError('not_found', `unknown tenant: ${tenantId}`);
-                if (before.name === name)
-                    return; // no-op is not audited — nothing changed
-                this.directory.prepare('UPDATE tenants SET name = ? WHERE tenant_id = ?').run(name, tenantId);
-                this.recordAdmin(actor, 'setTenantName', { tenantId }, { name: before.name }, { name });
+                // A no-op rename is not audited — nothing changed. #2528: judged, and `before` read, in the
+                // write's own transaction.
+                let before;
+                this.directoryWriteAndAudit(() => {
+                    before = readTenant(tenantId);
+                    if (!before)
+                        throw substratError('not_found', `unknown tenant: ${tenantId}`);
+                    return before.name !== name
+                        && this.directory.prepare('UPDATE tenants SET name = ? WHERE tenant_id = ?').run(name, tenantId).changes > 0;
+                }, () => this.recordAdmin(actor, 'setTenantName', { tenantId }, { name: before.name }, { name }));
             },
             listTenants: async (actor, page) => {
                 const where = [];
@@ -8019,32 +8571,15 @@ export class SqliteScopeHost {
                 return t;
             },
             listScopes: async (actor, filter) => {
-                const where = [];
-                const params = [];
-                if (filter?.tenantId) {
-                    where.push('tenant_id = ?');
-                    params.push(filter.tenantId);
-                }
-                if (filter?.status) {
-                    const statuses = Array.isArray(filter.status) ? filter.status : [filter.status];
-                    // An empty array means "no status is acceptable" — match nothing, rather
-                    // than degenerating into an unfiltered read of the whole fleet.
-                    if (statuses.length === 0)
-                        return [];
-                    // One JSON array, the shape the DO twin needs for its 100-parameter limit (#1776).
-                    where.push('status IN (SELECT value FROM json_each(?))');
-                    params.push(JSON.stringify(statuses));
-                }
-                if (filter?.vertical) {
-                    where.push('vertical = ?');
-                    params.push(filter.vertical);
-                }
-                const tail = keysetTail(where, params, 'scope_id', filter);
-                const sql = 'SELECT * FROM scopes' + (where.length ? ` WHERE ${where.join(' AND ')}` : '') + tail;
-                const scopes = this.directory.prepare(sql).all(...params).map(mapScope);
+                const scopes = scopeRows(filter).map(mapScope);
                 this.recordAccess(actor, 'listScopes', { tenantId: filter?.tenantId ?? null }, filter, scopes.length);
                 return scopes;
             },
+            listScopesReadable: async (actor, filter) => {
+                const rows = scopeRows(filter);
+                this.recordAccess(actor, 'listScopesReadable', { tenantId: filter?.tenantId ?? null }, filter, rows.length);
+                return readableScopes(rows, mapScope);
+            },
             listTenantStores: async (actor, filter) => {
                 const where = [];
                 const params = [];
@@ -8165,6 +8700,9 @@ export class SqliteScopeHost {
             recordStoreDriverRebuildRun: async (actor, entry) => {
                 this.recordAdmin(actor, 'rebuildStoreDriver', { tenantId: null }, null, entry, this.clock());
             },
+            recordWireWalk: async (actor, entry) => {
+                this.recordAdmin(actor, 'walkWireAuth', { tenantId: null }, null, entry, this.clock());
+            },
             getScopeRecord: async (actor, tenantId, scopeId) => {
                 const r = this.directory.prepare('SELECT * FROM scopes WHERE scope_id = ?').get(scopeId);
                 // Cross-check the pair (K-3): a scope that exists under a DIFFERENT tenant
@@ -8179,65 +8717,26 @@ export class SqliteScopeHost {
                 // K-3: the (tenantId, scopeId) pair is cross-checked before we open anything;
                 // a scope under a different tenant is unreachable, never another tenant's DB.
                 const db = this.scopeReadDbFor(tenantId, scopeId);
-                const names = db
-                    .prepare(`SELECT name FROM sqlite_master WHERE type = 'table' ORDER BY name`)
-                    .all().map((r) => r.name);
-                const tables = names.map((name) => ({
-                    name,
-                    rowCount: db.prepare(`SELECT COUNT(*) AS c FROM "${name}"`).get().c,
-                    system: isSystemTable(name),
-                }));
+                const tables = scopeTablesOf(db);
                 this.recordAccess(actor, 'listScopeTables', { tenantId, scopeId }, null, tables.length);
                 return tables;
             },
             readScopeTable: async (actor, tenantId, scopeId, input) => {
                 const db = this.scopeReadDbFor(tenantId, scopeId);
-                // Validate the table against the LIVE schema — an unknown name throws, it is
-                // never interpolated blind. That validated name is the only thing that reaches
-                // the query, so the quoted identifier below carries no user input.
-                const known = new Set(db.prepare(`SELECT name FROM sqlite_master WHERE type = 'table'`).all().map((r) => r.name));
-                if (!known.has(input.table))
-                    throw substratError('not_found', `unknown table '${input.table}'`);
-                // The ceiling clamps; a bound SQLite would misread (NaN, non-finite, fractional,
-                // negative) is refused instead of reaching LIMIT / OFFSET (#1632).
-                const limit = Math.min(assertRowLimit('limit', input.limit ?? SCOPE_TABLE_PAGE_DEFAULT), SCOPE_TABLE_PAGE_MAX);
-                const offset = assertRowOffset('offset', input.offset ?? 0);
-                const stmt = db.prepare(`SELECT * FROM "${input.table}" LIMIT ? OFFSET ?`).raw(true);
-                const rows = stmt.all(limit, offset).map((row) => row.map(cellToJson));
-                const columns = stmt.columns().map((c) => c.name);
-                const rowCount = db.prepare(`SELECT COUNT(*) AS c FROM "${input.table}"`).get().c;
-                this.recordAccess(actor, 'readScopeTable', { tenantId, scopeId }, { table: input.table, limit, offset }, rows.length);
-                return { table: input.table, columns, rows, rowCount, limit, offset };
+                const page = scopeTablePageOf(db, input);
+                this.recordAccess(actor, 'readScopeTable', { tenantId, scopeId }, { table: input.table, limit: page.limit, offset: page.offset }, page.rows.length);
+                return page;
             },
             queryScope: async (actor, tenantId, scopeId, input) => {
                 const db = this.scopeReadDbFor(tenantId, scopeId);
-                // Layer 1, shared: the kernel's textual gate (single statement, read verbs
-                // only) — the checked statement is the one that runs.
-                const sql = assertReadOnlyQuery(input.sql);
-                // Layer 2, authoritative: sqlite3_stmt_readonly via better-sqlite3. prepare()
-                // itself rejects multi-statement strings and bad SQL with the driver's message.
-                const stmt = db.prepare(sql);
-                if (!stmt.readonly)
-                    throw substratError('validation_failed', 'read-only console: statement is not read-only');
-                if (!stmt.reader)
-                    return { columns: [], rows: [], truncated: false };
-                stmt.raw(true);
-                const rows = [];
-                let truncated = false;
-                // Iterate rather than .all(): the row cap bounds what leaves the DB, so an
-                // over-broad SELECT costs a screenful, not the table.
-                for (const row of stmt.iterate()) {
-                    if (rows.length >= SCOPE_QUERY_ROW_MAX) {
-                        truncated = true;
-                        break;
-                    }
-                    rows.push(row.map(cellToJson));
-                }
-                const columns = stmt.columns().map((c) => c.name);
+                const { sql, reader, result } = scopeQueryOf(db, input);
+                // A statement that reads nothing returns before any row is recorded, as it always has.
+                if (!reader)
+                    return result;
                 // The statement itself is the logged argument — the K-24 access log is the
                 // evidence trail for what staff read, and here the read IS the SQL.
-                this.recordAccess(actor, 'queryScope', { tenantId, scopeId }, { sql }, rows.length);
-                return { columns, rows, truncated };
+                this.recordAccess(actor, 'queryScope', { tenantId, scopeId }, { sql }, result.rows.length);
+                return result;
             },
             // -- the denial log (K-35, #867) -------------------------------------
             // Same shape as the introspection reads above: `scopeDbFor` is the K-3
@@ -8659,13 +9158,9 @@ export class SqliteScopeHost {
                 // caller (the reap route / grace-window sweep) has already reaped every scope's
                 // storage above the kernel; this clears the tenant's directory-side PII/config
                 // and flips the row to a `reaped` tombstone. Only a `deleting` tenant may be
-                // reaped — an illegal source fails closed, like reapScope's archived-only gate.
-                const before = readTenant(tenantId);
-                if (!before)
-                    throw substratError('not_found', `unknown tenant: ${tenantId}`);
-                if (before.status !== 'deleting') {
-                    throw substratError('conflict', `tenant ${tenantId} is ${before.status}, not deleting — only a deleting tenant may be reaped`);
-                }
+                // reaped — an illegal source fails closed, like reapScope's archived-only gate. #2528: that
+                // gate and the row's `before` are read in the transaction that reaps.
+                let before;
                 // Clear the tenant's directory-side rows. Idempotent (set-to-empty), so a crash
                 // mid-reap converges on retry. KEPT as the tombstone: the `tenants` row itself
                 // and `_substrat_admin_log` (the compliance witness — never swept). Scope rows
@@ -8687,23 +9182,28 @@ export class SqliteScopeHost {
                     '_substrat_scope_storage', // #1524: storage samples of scopes whose storage is gone
                     '_substrat_scope_storage_attempts', // #1524: and the phase's last try at each
                     '_substrat_scope_store_storage', // #2212: scope-store samples, gone with the tenant
+                    '_substrat_scope_attachment_storage', // #2501: attachment samples, gone with the tenant
                 ];
-                const clear = this.directory.transaction(() => {
+                this.directoryWriteAndAudit(() => {
+                    before = readTenant(tenantId);
+                    if (!before)
+                        throw substratError('not_found', `unknown tenant: ${tenantId}`);
+                    if (before.status !== 'deleting') {
+                        throw substratError('conflict', `tenant ${tenantId} is ${before.status}, not deleting — only a deleting tenant may be reaped`);
+                    }
                     for (const table of tables) {
                         this.directory.prepare(`DELETE FROM ${table} WHERE tenant_id = ?`).run(tenantId);
                     }
-                    this.directory
+                    return this.directory
                         .prepare(`UPDATE tenants SET status = 'reaped', deleting_at = NULL WHERE tenant_id = ?`)
-                        .run(tenantId);
-                });
-                clear();
+                        .run(tenantId).changes > 0;
+                }, () => this.recordAdmin(actor, 'reapTenant', { tenantId }, { status: before.status }, { status: 'reaped' }));
                 // Evict the in-memory role cache for this tenant (the one directory table
                 // mirrored in memory) so a reaped role never resolves after the DELETE.
                 for (const cacheKey of [...this.roles.keys()]) {
                     if (cacheKey.startsWith(`${tenantId}/`))
                         this.roles.delete(cacheKey);
                 }
-                this.recordAdmin(actor, 'reapTenant', { tenantId }, { status: before.status }, { status: 'reaped' });
             },
             grantEntitlement: async (actor, tenantId, entitlementKey, plan) => {
                 const input = entitlementGrantInput.parse(plan ?? {});
@@ -8796,6 +9296,7 @@ export class SqliteScopeHost {
                     storage: listScopeStorageRows(redactionSqlOf(this.directory), { tenantId: only, latest: true }),
                     storageAttempts: listScopeStorageAttemptRows(redactionSqlOf(this.directory), only),
                     storeStorage: listScopeStoreStorageRows(redactionSqlOf(this.directory), only),
+                    attachmentStorage: listScopeAttachmentStorageRows(redactionSqlOf(this.directory), only),
                 });
                 // The count that matters for K-24 is how many TENANTS this reading covered —
                 // "read the meter for one tenant" and "metered the whole fleet" are different
@@ -9449,8 +9950,9 @@ export class SqliteScopeHost {
                     params.push(filter.fingerprint);
                 }
                 if (filter?.reference) {
-                    where.push('reference = ?');
-                    params.push(filter.reference);
+                    const byReference = opsFailureReferenceWhere(filter.reference, filter.referenceInText === true);
+                    where.push(byReference.sql);
+                    params.push(...byReference.params);
                 }
                 if (filter?.since) {
                     where.push('at >= ?');
@@ -9683,6 +10185,33 @@ export class SqliteScopeHost {
                 return rows;
             },
             pruneScopeStorage: async (_actor, limit) => pruneScopeStorageRows(redactionSqlOf(this.directory), Date.now(), limit),
+            recordRequestDay: async (_actor, input) => ({
+                recorded: this.directory.transaction(() => recordRequestDayRows(redactionSqlOf(this.directory), input))(),
+            }),
+            listRequestDays: async (actor, filter) => {
+                const rows = listRequestDayRows(redactionSqlOf(this.directory), filter);
+                this.recordAccess(actor, 'listRequestDays', { tenantId: filter?.tenantId ?? null, scopeId: filter?.scopeId ?? null }, filter ?? null, rows.length);
+                return rows;
+            },
+            listRequestRollupDays: async (actor, filter) => {
+                const rows = listRequestRollupDayRows(redactionSqlOf(this.directory), filter);
+                this.recordAccess(actor, 'listRequestRollupDays', { tenantId: null }, filter ?? null, rows.length);
+                return rows;
+            },
+            pruneRequestDays: async (_actor, limit, retentionMonths) => this.directory.transaction(() => pruneRequestDayRows(redactionSqlOf(this.directory), Date.now(), limit, retentionMonths))(),
+            // #2501: the snapshot reads and writes in one transaction, so its rows are one instant's reading.
+            recordMeterDay: async (_actor, input) => this.directory.transaction(() => recordMeterDayRows(redactionSqlOf(this.directory), input))(),
+            listMeterDays: async (actor, filter) => {
+                const rows = listMeterDayRows(redactionSqlOf(this.directory), filter);
+                this.recordAccess(actor, 'listMeterDays', { tenantId: filter?.tenantId ?? null }, filter ?? null, rows.length);
+                return rows;
+            },
+            listMeterDayTakes: async (actor, filter) => {
+                const rows = listMeterDayTakeRows(redactionSqlOf(this.directory), filter);
+                this.recordAccess(actor, 'listMeterDayTakes', { tenantId: null }, filter ?? null, rows.length);
+                return rows;
+            },
+            pruneMeterDays: async (_actor, limit, retentionMonths) => this.directory.transaction(() => pruneMeterDayRows(redactionSqlOf(this.directory), Date.now(), limit, retentionMonths))(),
             listModelUsage: async (actor, filter) => {
                 const rows = this.selectModelUsage(filter);
                 this.recordAccess(actor, 'listModelUsage', { tenantId: filter?.tenantId ?? null, scopeId: filter?.scopeId ?? null }, filter, rows.length);
@@ -10034,6 +10563,8 @@ export class SqliteScopeHost {
         }
         for (const stmt of LEGACY_SCOPE_ROWS_BACKFILL)
             this.directory.exec(stmt);
+        // #2501: an ownership period for every vertical registered before the history existed.
+        this.directory.exec(VERTICAL_OWNERS_BACKFILL);
         // Created after the backfill: a UNIQUE index over NULL slugs would permit the
         // duplicates it exists to forbid (SQLite treats NULLs as distinct).
         //
@@ -10364,9 +10895,7 @@ export class SqliteScopeHost {
                 const pending = rt.db
                     .prepare(`SELECT COUNT(*) AS c FROM _substrat_platform_requests WHERE status = 'pending'`)
                     .get().c;
-                if (pending >= MAX_PENDING_PLATFORM_REQUESTS) {
-                    throw new Error(`too many pending platform requests (${pending}); retry once some have drained`);
-                }
+                assertPlatformRequestRoom(pending);
                 const id = platformRequestId.parse(ulid());
                 const requestedBy = overrideActor ?? actorOf(subject);
                 rt.db