@substrat-run/adapter-sqlite 0.160.0 → 0.162.0

package/dist/index.js

@@ -1,9 +1,9 @@
 import { createHash } from 'node:crypto';
-import { closeSync, existsSync, mkdirSync, openSync, readdirSync, readFileSync, realpathSync, rmSync, writeFileSync, writeSync } from 'node:fs';
+import { closeSync, existsSync, fstatSync, mkdirSync, openSync, readdirSync, readFileSync, readSync, realpathSync, rmSync, writeFileSync, writeSync } from 'node:fs';
 import { dirname, join } from 'node:path';
 import Database from 'better-sqlite3';
 import { accessLogEntry, adminLogEntry, delegatedReadParams, operationSeriesCount, opsFailureEntry, opsFailureFingerprint, issueEntry, FRESHNESS_HEARTBEAT_MINUTES, sweepRunEntry, modelUsageEntry, ATTACHMENT_ADDED, ATTACHMENT_REMOVED, createTenantInput, domainEvent, domainEventInput, exportReadInput, importBatch, importCursorMove, exportsOfManifestJson, assertNoBindingShapeBreak, importsOfManifestJson, connectionLandingsOfManifestJson, entitlementGrant, entitlementGrantInput, eventId, meterReading, platformRequestInput, platformRequestId, identityLink, identityPool, instant, isSubstratError, connection, capabilityGrant, connectionGrant, connectionGrantRecord, connectionSecret, systemGrant, systemSwitch, systemSwitchRecord, peerSwitch, verticalCaller, verticalSlug as verticalSlugOf, subjectRef, requestFingerprint, createConnectionInput, connectLinkFilter, connectLinkKey, consumeConnectLinkInput, mintConnectLinkInput, projectedConnectionGrant, projectedConnectionKey, moduleManifest, createOrgInput, promotionAcknowledgement, bindAcknowledgement, bindHostnameInput, channelHistoryEntry, hostnameBinding, publishVersionInput, AUTO_ADMISSION_NOTE, routeTarget, ROUTE_SCOPE_HOSTNAMES_MAX, registerVerticalInput, vertical as verticalSchema, verticalChannel, verticalVersion, objectRef, entityObjectRef, assertModuleEmittableType, assertKernelAuthoredType, grantRefFromProof, org as orgSchema, orgMembership, principalId, resolvedIdentity, identityMembership, roleDefinition, scope as scopeSchema, tenant as tenantSchema, tenantRole, principalBecomeCapabilityInput, subjectShredReceipt, SCOPE_TABLE_PAGE_DEFAULT, SCOPE_TABLE_PAGE_MAX, SCOPE_QUERY_ROW_MAX, verticalServingState, deploymentWireAuth, callsOfManifestJson, outboundOfManifestJson, listLimitOf, pageOf, countedPageOf, SCOPE_GATE_REASONS, substratError, assertReplayableDump, delegatedReadRecord, ownerTransferAudit, memberChangeAudit, peerBindingAudit, connectionBindingAudit, copyMarkAudit, orphanSweepAudit, redrainEventsInput, REDRAIN_BATCH, errorCodeOf, } from '@substrat-run/contracts';
-import { actorOf, asPrincipal, assertAllowed, assertNoSecret, assertPermissionKey, CAPABILITY_DDL, UPLOAD_LINK_DDL, createAttachmentVerbs, inspectUploadLink, redeemUploadLinkInTransaction, redeemOrReplayUploadLink, COPY_ORIGIN_DDL, ENTITY_STATE_MOVES_DDL, CAPABILITY_EXCHANGE_OPERATION, CAPABILITY_BECOME_MINT_OPERATION, becomeMintCheck, mintBecomeCapabilityAsPrincipal, revokeBecomeCapabilityAsPrincipal, readBecomeLinkStates, ENTITY_UNBIND_OPERATION, allowedFor, unbindEntityHolderBounded, capabilityAttachmentWriteRefused, capabilityTokenHash, createCapabilityVerbs, createEntityEdgeVerbs, createEntityStateVerbs, createTrashedReads, CONTINUATION_POSITION_CAP, visibleContinuation, searchStateWhere, uncheckedView, addStatePlans, addUpdatedStampPlans, watchUpdatedStamps, entityStateMigrations, assertNoCallerPurge, assertPlatformRequestRoom, isUnreachableParent, heldPurgePass, purgeDueOf, purgeHeldBy, lifecycleRefusal, scopeNotHeldRefusal, purgeOnlyKeysOf, purgeReportOf, purgeStillDue, refuseTrashedTarget, assertBoundOperations, checkHeldOperationsOf, countChecks, noteUncheckedCompletion, registerTrashTargets, runPurgePass, withheldKeysFor, statefulTablesOf, afterMigration, afterRuntimeDdl, derivesAnything, repairDerivedObjects, StateColumnLost, exchangeCapability as exchangeCapabilitySecret, guardSecrets, mintBecomeCapability, plausibleSessionToken, readCapabilityPage, redactSecrets, redactSecretText, moduleLog, consoleLogSink, asyncInvocationId, asyncLinePass, consoleInvocationLineSink, resolveCapabilitySession, revokeCapabilityAsPlatform, assertReadOnlyQuery, attachmentBlobKey, attachmentSha256, isSizedByteStream, knownLengthStream, putAttachmentBytes, entitlementDenial, requiredEntitlementFor, foldMeterReading, guardSpine, guardSqlLimits, DO_SQL_LIMITS, tooManyResultColumns, tooManyTableColumns, parseValidationRecords, readableScopes, resolveScopeRecord, ulid, ISSUE_RETENTION_DAYS, telemetryRetentionStatements, FINDINGS_DDL, ATTACHMENT_BYTES_SQL, SCOPE_STORAGE_DDL, forgetScopeStorage, listScopeAttachmentStorageRows, retireScopeStorage, listScopeStorageAttemptRows, listScopeStorageRows, listScopeStoreStorageRows, pruneScopeStorageRows, recordScopeStorageRows, REQUEST_ROLLUP_DDL, listRequestDayRows, listRequestRollupDayRows, pruneRequestDayRows, recordRequestDayRows, METER_DAYS_DDL, VERTICAL_OWNERS_BACKFILL, VERTICAL_OWNERS_DDL, closeVerticalOwnerRow, listVerticalOwnerRows, openVerticalOwnerRow, verticalOwnerNow, listMeterDayRows, listMeterDayTakeRows, pruneMeterDayRows, recordMeterDayRows, CONNECT_LINKS_DDL, consumeConnectLinkRow, insertConnectLink, listConnectLinks as listConnectLinkRows, readConnectLink, restoreConnectLinkRow, revokeConnectLinkRow, createFindingRule, findingOfOpsFailure, findingOfSweepRun, pruneFindings, listFindingRules, listFindings, observeFinding, revokeFindingRule, setFindingStatus, assertRowLimit, assertRowOffset, OPS_FAILURE_RETENTION_DAYS, SWEEP_RUN_RETENTION_DAYS, SWEEP_RUNS_INTENT_INDEX, sweepRunsIntentHasKind, MODEL_USAGE_RETENTION_DAYS, foldModelUsage, backoffAt, platformRequestHistoryQuery, platformRequestOf, PLATFORM_REQUEST_COLUMNS, PLATFORM_REQUEST_REDACTION_SQL, platformRequestRedactionParams, platformRequestRedactionQuery, intentPayloadCarriesSubject, redactSubjectJobRuns, eraseSubjectFromModules, moduleRowsErased, moduleErasurePlan, redactSubjectScopeText, redactSubjectDirectoryText, ISSUE_EXEMPLAR_OWNER_BACKFILL_SQL, issueExemplarOwner, JOB_RUN_PATCH_SQL, JOB_RUN_CLAIM_SQL, JOB_RUN_RENEW_SQL, JOB_RUN_BEGIN_SQL, JOB_RUN_MISS_SQL, JOB_RUN_MISS_SETTLE_SQL, admissionMissOutcome, JOB_STEP_RECORD_SQL, JOB_LEASE_EXPIRED_NOTE, assertLeaseMs, DELIVERY_ERROR_REDACTION_SQL, REDACTED_DELIVERY_NOTE, seatScopeTuple, applyScopeRoleChange, changeScopeRole, revokeScopeRoles, scopeRoleHolders, assertModuleDeclared, noteDeclaredKeys, noteReservedKeys, reservedGrantRefusal, reservedRoleDefinitionRefusal, reservedRoleRefusal, reservedShapeRefusal, SCOPE_SEATED_ROLES_SQL, SEAT_HOLDING_SCOPE_STATUSES, TENANT_SEATED_ROLES_SQL, admitPeer, boundToPeerDeclarations, peerCallerAt, collectPeers, peerSeats, resolveVerticalInstanceFrom, resolvePeerInstanceFrom, peerVerticalSpellings, samePeerVertical, peerGrantsStatus, systemGrantsStatus, systemScheduleState, systemSwitchedOff, systemSwitchedOffMessage, tenantSystemSwitchedOffMessage, PEER_SWITCHES_DDL, PEER_BINDINGS_DDL, SWITCH_OWED_DDL, SWITCH_FENCES_DDL, TABLE_OWNERS_DDL, assertMigrationLeavesLedgerAlone, recordOwnershipSteps, runMigrationStatements, executableSqlStatements, blankSqlComments, recordWriteSuperseded, switchFencesOf, switchSupersededMessage, SWITCH_KINDS, SYSTEM_SWITCHES_DDL, forgetSwitchesOf, listSystemSwitchRecords, moveSwitch, reassertActionOf, reassertEntry, reassertOffRow, recordSwitchedOff, recordSwitchedOn, restoreSwitchRecord, scopesSwitchedOffFor, switchActionOf, switchAuditSubject, recordAuditOutcome, auditedCapabilityRevoke, auditWarningOf, switchNotFoundMessage, switchRecordsOf, switchedOffOf, switchesBackfillSqlOf, switchesTableExists, tenantHeldOf, tenantHoldsGrant, inUnitMovesToAudit, staleCarryRevertRow, staleCarryReverts, withRecorded, VERSION_MIGRATIONS_DDL, VERTICAL_SCOPE_STORES_DDL, forgetVerticalScopeStores, DEPLOYMENT_WIRE_AUTH_DDL, assertWireAuthFilter, deploymentWireAuthOf, forgetVerticalWireAuth, wireAuthAccessTarget, writeDeploymentWireAuth, indexVersionScopeStores, driverDeclarationsOf, verticalScopeStoresOf, STORE_DRIVER_RELEASES_DDL, legacyStoreDriverConflict, legacyStoreDriverRenames, beginStoreDriverRolloutIn, finishStoreDriverRolloutIn, holdStoreDriverIn, advanceStoreDriverRebuildIn, claimStoreDriverRebuildIn, storeDriverRebuildIn, recordStoreDriverReleaseIn, releaseStoreDriverHoldIn, storeDriverReleaseIn, storeDriverStateIn, storeDriverRolloutPendingIn, storeDriverRolloutWalkedIn, splitManifestMigrations, splitVersionMigrationsBatch, versionMigrationsOf, deriveVersionMigrationDigest, publishedMigrationDigest, migrationChangeRefusal, writeVersionMigrations, denialListQuery, refusalListQuery, mapRefusalRow, denialSummaryQuery, denialTotalsQuery, DENIAL_WINDOW_QUERY, mapDenialRow, mapDenialSummaryBuckets, IMPERSONATION_COLUMNS, IMPERSONATION_DDL, ImpersonationRefused, assertImpersonationWrites, assertModuleEnqueueableKind, assertSessionUsable, impersonationByIdQuery, impersonationListQuery, impersonationRowValues, impersonationStampOf, mapImpersonationRow, newImpersonationSession, resolveRetryPolicy, executorOutcomeOf, isDeliveryRefusal, refusalJournalText, membershipFencesBackfillSql, MEMBERSHIP_FENCES_DDL, membershipFencesTableExists, MEMBERSHIP_FENCE_SINCE_SQL, RAISE_MEMBERSHIP_FENCE_SQL, memberAddedAudit, orgChangeBound, tenantCoverage, isSecretBoxConfigured, unconfiguredSecretBox, createSubjectKeys, generateSealingKeyPair, noSealingKeyMessage, openSealed, sealTo, ConnectionSealingKeyUnavailableError, PermissionDenied, createAtomic, NotSearchable, NotListable, listIndexMigrations, listIndexPlans, listQuery, cursorOf, moduleMigrations, MIGRATION_DIGEST_FENCE_DDL, MIGRATION_DIGEST_MARK_LEGACY, assertJournalDumpCoherent, assertMigrationSql, migrationDivergence, migrationFailedError, migrationSetDivergence, migrationSteps, planMigrations, isSearchIndexTable, searchIndexMigrations, searchIndexPlans, searchLimit, searchMatchExpression, searchQuery, ATTACHMENT_TEXT_DDL, ATTACHMENT_CONDEMNED_DDL, ATTACHMENT_SWEEP_LICENCE_DDL, ATTACHMENT_SWEEP_LICENCE_TABLE, clearOrphanSweepLicence, condemnLicensedOrphanAttachments, consumeOrphanSweepLicence, licensedOrphanIds, recordOrphanSweepLicence, refuseUnlicensedOrphanSweep, fenceAttachmentSweep, refuseCondemnedAttachment, refuseCondemnedInDump, rowlessAttachmentIds, sweepOrphanAttachments, missingAttachmentStore, SETTLED_COPY_STATES, unsettledCopyRefusal, assertAttachmentExtractors, resolveAttachmentTextBounds, assertJobRegistrable, attachmentRecordOfRow, attachmentTextJob, enqueueAttachmentText, ATTACHMENT_TEXT_BACKFILL_JOB, ATTACHMENT_TEXT_JOB, kernelJobFor, queueAttachmentTextBackfill, startAttachmentTextBackfill, attachmentTextBackfillJob, reconcileAttachmentText, recordAttachmentText, searchAttachments, entityVersionQuery, entityVersionOf, assertIfMatch, OUTBOX_ENTITY_INDEX, SCHEDULE_STATE_DDL, SCHEDULE_STATE_REBUILD, scheduleStateHasKind, VERTICAL_EVENTS_DDL, EXPORT_HOPS_SQL, emptyImportResult, IMPORT_CURSORS_SQL, IMPORT_CURSOR_OF_SQL, OUTBOX_MARK_SQL, emittedSinceQuery, emittedReportOf, EMITTED_REPORT_CAP, exportedSinceQuery, IMPORT_CURSOR_ADVANCE_SQL, IMPORT_RECORD_SQL, moveImportCursor, importCursorSourceOf, exportBreaksOf, exportBreakRefusal, assertPromoteReviewCurrent, promoteRaceRefusal, rebindRaceRefusal, SERVES_NOW_CONDITION, SERVES_NOW_PREDICATE, servesNowParams, bindExportBreaksOf, bindExportBreakRefusal, scopeMoveOf, runningVersionOf, isPrimaryScope, PROVISIONED_VERSIONS_SQL, installsReconciledOf, strandJudgmentsOf, provisionedVersionsParams, boundShapesColumn, boundShapesOfColumn, installReconciled, CrossVerticalRegistry, exportReadPlan, exportReadQuery, planExportBatch, withheldNote, JOB_RUN_DDL, JOB_RUN_DUE_AT, jobRunListLimit, jobRunOf, runDueJobRuns, startJobRun, IDEMPOTENCY_DDL, REFUSALS_TABLE_DDL, REFUSALS_INDEX, refusalInsert, refusalOf, markGuardRefusal, REFUSALS_REBUILD, refusalsAdmitGuards, assertIdempotencyKey, idempotencyLookupQuery, idempotencyPruneStatement, idempotencyRecordStatement, idempotencyOptedOutMessage, replayFor, globalFetch, fetchLikeOf, deadlineFetch, createUlid, facetEvents, readHistory, walkEventCause, walkEventEffects, assertRedrainWindow, readInvocation, readDeadLetters, readLifecycleFlow, readOperationSeries, domainEventOf, readUndrainedOutbox, undrainedEventsOf, connectorCallRecord, noopConnectorCallRecorder, recordConnectorCall, settleConnectionUse, unknownRoleError, callReservedStoreOperation, callScopeStore, observeStoreCall, replayStoreErasures, scopeStoreLifecycleOf, scopeStoreRunnersOf, } from '@substrat-run/kernel';
+import { actorOf, asPrincipal, assertAllowed, assertNoSecret, assertPermissionKey, CAPABILITY_DDL, UPLOAD_LINK_DDL, createAttachmentVerbs, inspectUploadLink, redeemUploadLinkInTransaction, redeemOrReplayUploadLink, COPY_ORIGIN_DDL, ENTITY_STATE_MOVES_DDL, CAPABILITY_EXCHANGE_OPERATION, CAPABILITY_BECOME_MINT_OPERATION, becomeMintCheck, mintBecomeCapabilityAsPrincipal, revokeBecomeCapabilityAsPrincipal, readBecomeLinkStates, ENTITY_UNBIND_OPERATION, allowedFor, unbindEntityHolderBounded, capabilityAttachmentWriteRefused, capabilityTokenHash, createCapabilityVerbs, createEntityEdgeVerbs, createEntityStateVerbs, createTrashedReads, CONTINUATION_POSITION_CAP, visibleContinuation, searchStateWhere, uncheckedView, addStatePlans, addUpdatedStampPlans, watchUpdatedStamps, entityStateMigrations, assertNoCallerPurge, assertPlatformRequestRoom, isUnreachableParent, heldPurgePass, purgeDueOf, purgeHeldBy, lifecycleRefusal, scopeNotHeldRefusal, purgeOnlyKeysOf, purgeReportOf, purgeStillDue, refuseTrashedTarget, assertBoundOperations, checkHeldOperationsOf, countChecks, noteUncheckedCompletion, registerTrashTargets, runPurgePass, withheldKeysFor, statefulTablesOf, afterMigration, afterRuntimeDdl, derivesAnything, repairDerivedObjects, StateColumnLost, exchangeCapability as exchangeCapabilitySecret, guardSecrets, mintBecomeCapability, plausibleSessionToken, readCapabilityPage, redactSecrets, redactSecretText, moduleLog, consoleLogSink, asyncInvocationId, asyncLinePass, consoleInvocationLineSink, resolveCapabilitySession, revokeCapabilityAsPlatform, assertReadOnlyQuery, attachmentBlobKey, attachmentSha256, isSizedByteStream, knownLengthStream, openAttachmentByteStream, putAttachmentBytes, entitlementDenial, requiredEntitlementFor, foldMeterReading, guardSpine, guardSqlLimits, DO_SQL_LIMITS, tooManyResultColumns, tooManyTableColumns, parseValidationRecords, readableScopes, resolveScopeRecord, ulid, ISSUE_RETENTION_DAYS, telemetryRetentionStatements, FINDINGS_DDL, ATTACHMENT_BYTES_SQL, SCOPE_STORAGE_DDL, forgetScopeStorage, listScopeAttachmentStorageRows, retireScopeStorage, listScopeStorageAttemptRows, listScopeStorageRows, listScopeStoreStorageRows, pruneScopeStorageRows, recordScopeStorageRows, REQUEST_ROLLUP_DDL, listRequestDayRows, listRequestRollupDayRows, pruneRequestDayRows, recordRequestDayRows, METER_DAYS_DDL, VERTICAL_OWNERS_BACKFILL, VERTICAL_OWNERS_DDL, closeVerticalOwnerRow, listVerticalOwnerRows, openVerticalOwnerRow, verticalOwnerNow, listMeterDayRows, listMeterDayTakeRows, pruneMeterDayRows, recordMeterDayRows, CONNECT_LINKS_DDL, consumeConnectLinkRow, insertConnectLink, listConnectLinks as listConnectLinkRows, readConnectLink, restoreConnectLinkRow, revokeConnectLinkRow, createFindingRule, findingOfOpsFailure, findingOfSweepRun, pruneFindings, listFindingRules, listFindings, observeFinding, revokeFindingRule, setFindingStatus, assertRowLimit, assertRowOffset, OPS_FAILURE_RETENTION_DAYS, SWEEP_RUN_RETENTION_DAYS, SWEEP_RUNS_INTENT_INDEX, sweepRunsIntentHasKind, MODEL_USAGE_RETENTION_DAYS, foldModelUsage, backoffAt, platformRequestHistoryQuery, platformRequestOf, PLATFORM_REQUEST_COLUMNS, PLATFORM_REQUEST_REDACTION_SQL, platformRequestRedactionParams, platformRequestRedactionQuery, intentPayloadCarriesSubject, redactSubjectJobRuns, eraseSubjectFromModules, moduleRowsErased, moduleErasurePlan, redactSubjectScopeText, redactSubjectDirectoryText, ISSUE_EXEMPLAR_OWNER_BACKFILL_SQL, issueExemplarOwner, JOB_RUN_PATCH_SQL, JOB_RUN_CLAIM_SQL, JOB_RUN_RENEW_SQL, JOB_RUN_BEGIN_SQL, JOB_RUN_MISS_SQL, JOB_RUN_MISS_SETTLE_SQL, admissionMissOutcome, JOB_STEP_RECORD_SQL, JOB_LEASE_EXPIRED_NOTE, assertLeaseMs, DELIVERY_ERROR_REDACTION_SQL, REDACTED_DELIVERY_NOTE, seatScopeTuple, applyScopeRoleChange, changeScopeRole, revokeScopeRoles, scopeRoleHolders, assertModuleDeclared, noteDeclaredKeys, noteReservedKeys, dumpRoleRefusal, reservedGrantRefusal, reservedRoleDefinitionRefusal, reservedRoleRefusal, reservedShapeRefusal, SCOPE_SEATED_ROLES_SQL, SEAT_HOLDING_SCOPE_STATUSES, TENANT_SEATED_ROLES_SQL, admitPeer, boundToPeerDeclarations, peerCallerAt, collectPeers, peerSeats, resolveVerticalInstanceFrom, resolvePeerInstanceFrom, peerVerticalSpellings, samePeerVertical, peerGrantsStatus, systemGrantsStatus, systemScheduleState, systemSwitchedOff, systemSwitchedOffMessage, tenantSystemSwitchedOffMessage, PEER_SWITCHES_DDL, PEER_BINDINGS_DDL, SWITCH_OWED_DDL, SWITCH_FENCES_DDL, TABLE_OWNERS_DDL, assertMigrationLeavesLedgerAlone, recordOwnershipSteps, runMigrationStatements, executableSqlStatements, blankSqlComments, recordWriteSuperseded, switchFencesOf, switchSupersededMessage, SWITCH_KINDS, SYSTEM_SWITCHES_DDL, forgetSwitchesOf, listSystemSwitchRecords, moveSwitch, reassertActionOf, reassertEntry, reassertOffRow, recordSwitchedOff, recordSwitchedOn, restoreSwitchRecord, scopesSwitchedOffFor, switchActionOf, switchAuditSubject, recordAuditOutcome, auditedCapabilityRevoke, auditWarningOf, switchNotFoundMessage, switchRecordsOf, switchedOffOf, switchesBackfillSqlOf, switchesTableExists, tenantHeldOf, tenantHoldsGrant, inUnitMovesToAudit, staleCarryRevertRow, staleCarryReverts, withRecorded, VERSION_MIGRATIONS_DDL, VERTICAL_SCOPE_STORES_DDL, forgetVerticalScopeStores, DEPLOYMENT_WIRE_AUTH_DDL, assertWireAuthFilter, deploymentWireAuthOf, forgetVerticalWireAuth, wireAuthAccessTarget, writeDeploymentWireAuth, indexVersionScopeStores, driverDeclarationsOf, verticalScopeStoresOf, STORE_DRIVER_RELEASES_DDL, legacyStoreDriverConflict, legacyStoreDriverRenames, beginStoreDriverRolloutIn, finishStoreDriverRolloutIn, holdStoreDriverIn, advanceStoreDriverRebuildIn, claimStoreDriverRebuildIn, storeDriverRebuildIn, recordStoreDriverReleaseIn, releaseStoreDriverHoldIn, storeDriverReleaseIn, storeDriverStateIn, storeDriverRolloutPendingIn, storeDriverRolloutWalkedIn, splitManifestMigrations, splitVersionMigrationsBatch, versionMigrationsOf, deriveVersionMigrationDigest, publishedMigrationDigest, migrationChangeRefusal, writeVersionMigrations, denialListQuery, refusalListQuery, mapRefusalRow, denialSummaryQuery, denialTotalsQuery, DENIAL_WINDOW_QUERY, mapDenialRow, mapDenialSummaryBuckets, IMPERSONATION_COLUMNS, IMPERSONATION_DDL, ImpersonationRefused, assertImpersonationWrites, assertModuleEnqueueableKind, assertSessionUsable, impersonationByIdQuery, impersonationListQuery, impersonationRowValues, impersonationStampOf, mapImpersonationRow, newImpersonationSession, resolveRetryPolicy, executorOutcomeOf, isDeliveryRefusal, refusalJournalText, membershipFencesBackfillSql, MEMBERSHIP_FENCES_DDL, membershipFencesTableExists, MEMBERSHIP_FENCE_SINCE_SQL, RAISE_MEMBERSHIP_FENCE_SQL, memberAddedAudit, orgChangeBound, tenantCoverage, isSecretBoxConfigured, unconfiguredSecretBox, createSubjectKeys, generateSealingKeyPair, noSealingKeyMessage, openSealed, sealTo, ConnectionSealingKeyUnavailableError, PermissionDenied, createAtomic, NotSearchable, NotListable, listIndexMigrations, listIndexPlans, listQuery, cursorOf, moduleMigrations, MIGRATION_DIGEST_FENCE_DDL, MIGRATION_DIGEST_MARK_LEGACY, assertJournalDumpCoherent, assertMigrationSql, migrationDivergence, migrationFailedError, migrationSetDivergence, migrationSteps, planMigrations, isSearchIndexTable, searchIndexMigrations, searchIndexPlans, searchLimit, searchMatchExpression, searchQuery, ATTACHMENT_TEXT_DDL, ATTACHMENT_CONDEMNED_DDL, ATTACHMENT_SWEEP_LICENCE_DDL, ATTACHMENT_SWEEP_LICENCE_TABLE, clearOrphanSweepLicence, condemnLicensedOrphanAttachments, consumeOrphanSweepLicence, licensedOrphanIds, recordOrphanSweepLicence, refuseUnlicensedOrphanSweep, fenceAttachmentSweep, refuseCondemnedAttachment, refuseCondemnedInDump, rowlessAttachmentIds, sweepOrphanAttachments, missingAttachmentStore, SETTLED_COPY_STATES, unsettledCopyRefusal, assertAttachmentExtractors, resolveAttachmentTextBounds, assertJobRegistrable, attachmentRecordOfRow, attachmentTextJob, enqueueAttachmentText, ATTACHMENT_TEXT_BACKFILL_JOB, ATTACHMENT_TEXT_JOB, kernelJobFor, queueAttachmentTextBackfill, startAttachmentTextBackfill, attachmentTextBackfillJob, reconcileAttachmentText, recordAttachmentText, searchAttachments, entityVersionQuery, entityVersionOf, assertIfMatch, OUTBOX_ENTITY_INDEX, SCHEDULE_STATE_DDL, SCHEDULE_STATE_REBUILD, scheduleStateHasKind, VERTICAL_EVENTS_DDL, EXPORT_HOPS_SQL, emptyImportResult, IMPORT_CURSORS_SQL, IMPORT_CURSOR_OF_SQL, OUTBOX_MARK_SQL, emittedSinceQuery, emittedReportOf, EMITTED_REPORT_CAP, exportedSinceQuery, IMPORT_CURSOR_ADVANCE_SQL, IMPORT_RECORD_SQL, moveImportCursor, importCursorSourceOf, exportBreaksOf, exportBreakRefusal, assertPromoteReviewCurrent, promoteRaceRefusal, servingRaceRefusal, rebindRaceRefusal, SERVES_NOW_CONDITION, SERVES_NOW_PREDICATE, servesNowParams, bindExportBreaksOf, bindExportBreakRefusal, scopeMoveOf, runningVersionOf, isPrimaryScope, PROVISIONED_VERSIONS_SQL, installsReconciledOf, strandJudgmentsOf, provisionedVersionsParams, boundShapesColumn, boundShapesOfColumn, installReconciled, CrossVerticalRegistry, exportReadPlan, exportReadQuery, planExportBatch, withheldNote, JOB_RUN_DDL, JOB_RUN_DUE_AT, jobRunListLimit, jobRunOf, runDueJobRuns, startJobRun, IDEMPOTENCY_DDL, REFUSALS_TABLE_DDL, REFUSALS_INDEX, refusalInsert, refusalOf, markGuardRefusal, REFUSALS_REBUILD, refusalsAdmitGuards, assertIdempotencyKey, idempotencyLookupQuery, idempotencyPruneStatement, idempotencyRecordStatement, idempotencyOptedOutMessage, replayFor, globalFetch, fetchLikeOf, deadlineFetch, createUlid, facetEvents, readHistory, walkEventCause, walkEventEffects, assertRedrainWindow, readInvocation, readDeadLetters, readLifecycleFlow, readOperationSeries, domainEventOf, readUndrainedOutbox, undrainedEventsOf, connectorCallRecord, noopConnectorCallRecorder, recordConnectorCall, settleConnectionUse, unknownRoleError, callReservedStoreOperation, callScopeStore, observeStoreCall, replayStoreErasures, scopeStoreLifecycleOf, scopeStoreRunnersOf, } from '@substrat-run/kernel';
 import { attributedView, delegatedRevokeSql, writeExplicitTupleIn, grantEntityShapeIn, shapeTopUpBatch, topUpEntityGrantShapes, settlePlatformRequestIn, } from '@substrat-run/kernel';
 import { ADMIN_LOG_INDEXES_SQL, SETTLE_INTENT_SQL, SETTLE_OUTCOME_SQL, settleOutcomeParamsOf, readAuditedOperations, unknownOutcomeOf, } from '@substrat-run/kernel';
 import { INERT_SCOPE_REASON, isPrimaryScopeRow, normalizeUploadMediaType } from '@substrat-run/kernel';
@@ -69,6 +69,62 @@ async function writeStreamToFile(path, body) {
         closeSync(fd);
     }
 }
+/**
+ * A dropped stream's file handle, closed when the stream is collected (#2514): a consumer that neither
+ * reads a stream to its end nor cancels it would otherwise hold the handle for the life of the process.
+ * Best effort, since collection has no deadline; reading or cancelling is what closes it promptly.
+ */
+const unreadFiles = new FinalizationRegistry((handle) => handle.close());
+/**
+ * The file at `path` as a stream read 64 KiB at a time as it is pulled (#2514), with its size, or
+ * `null` when there is no such file. The file is opened here, so a key removed after the open is still
+ * read whole from the open handle, and closed once the stream ends, errors or is cancelled, or (best
+ * effort) once a stream nobody finished is collected.
+ */
+function fileStream(path) {
+    const CHUNK = 64 * 1024;
+    let fd;
+    try {
+        fd = openSync(path, 'r');
+    }
+    catch (err) {
+        // Removed between the read gate and here: the same answer as a key that was never there.
+        if (err.code === 'ENOENT')
+            return null;
+        throw err;
+    }
+    const size = fstatSync(fd).size;
+    let closed = false;
+    const handle = {
+        close: () => {
+            if (!closed)
+                closeSync(fd);
+            closed = true;
+        },
+    };
+    const close = handle.close;
+    const stream = new ReadableStream({
+        pull(controller) {
+            try {
+                const chunk = new Uint8Array(CHUNK);
+                const read = readSync(fd, chunk, 0, CHUNK, null);
+                if (read === 0) {
+                    close();
+                    controller.close();
+                    return;
+                }
+                controller.enqueue(chunk.subarray(0, read));
+            }
+            catch (err) {
+                close();
+                controller.error(err);
+            }
+        },
+        cancel: close,
+    }, { highWaterMark: 0 });
+    unreadFiles.register(stream, handle);
+    return { stream, size };
+}
 function kernelEmit(ctx, event) {
     const write = kernelEmitters.get(ctx);
     if (!write)
@@ -553,6 +609,89 @@ const PROCESS_HOST_DIRS = new Map();
 const databaseBytesOf = (db) => db.pragma('page_count', { simple: true }) * db.pragma('page_size', { simple: true });
 /** What a scope database's attachment rows sum to (#2501). */
 const attachmentBytesOf = (db) => db.prepare(ATTACHMENT_BYTES_SQL).get().bytes;
+/**
+ * The introspection reads, over an already-resolved connection: the bodies behind both the
+ * directory-checked admin verbs and the `*Local` verbs a vertical's `/internal/*` routes call by
+ * scope id alone (#2544). How the connection was reached, and what is recorded, stay with the caller.
+ */
+function scopeTablesOf(db) {
+    const names = db.prepare(`SELECT name FROM sqlite_master WHERE type = 'table' ORDER BY name`).all().map((r) => r.name);
+    const count = (sql) => db.prepare(sql).get().c;
+    const tombstones = (name) => db.prepare(`SELECT name FROM pragma_table_info(?)`).all(name).some((c) => c.name === 'revoked_at');
+    return names.map((name) => ({
+        name,
+        rowCount: count(`SELECT COUNT(*) AS c FROM "${name}"`),
+        system: isSystemTable(name),
+        // #2531: rows whose `revoked_at` is null, for any table with that column (`ScopeTable.liveRowCount`; the Cloudflare adapter's twin).
+        ...(tombstones(name) ? { liveRowCount: count(`SELECT COUNT(*) AS c FROM "${name}" WHERE revoked_at IS NULL`) } : {}),
+    }));
+}
+function scopeTablePageOf(db, input) {
+    // Validate the table against the LIVE schema — an unknown name throws, it is
+    // never interpolated blind. That validated name is the only thing that reaches
+    // the query, so the quoted identifier below carries no user input.
+    const known = new Set(db.prepare(`SELECT name FROM sqlite_master WHERE type = 'table'`).all().map((r) => r.name));
+    if (!known.has(input.table))
+        throw substratError('not_found', `unknown table '${input.table}'`);
+    // The ceiling clamps; a bound SQLite would misread (NaN, non-finite, fractional,
+    // negative) is refused instead of reaching LIMIT / OFFSET (#1632).
+    const limit = Math.min(assertRowLimit('limit', input.limit ?? SCOPE_TABLE_PAGE_DEFAULT), SCOPE_TABLE_PAGE_MAX);
+    const offset = assertRowOffset('offset', input.offset ?? 0);
+    const stmt = db.prepare(`SELECT * FROM "${input.table}" LIMIT ? OFFSET ?`).raw(true);
+    const rows = stmt.all(limit, offset).map((row) => row.map(cellToJson));
+    const columns = stmt.columns().map((c) => c.name);
+    const rowCount = db.prepare(`SELECT COUNT(*) AS c FROM "${input.table}"`).get().c;
+    return { table: input.table, columns, rows, rowCount, limit, offset };
+}
+function scopeQueryOf(db, input) {
+    // Layer 1, shared: the kernel's textual gate (single statement, read verbs
+    // only) — the checked statement is the one that runs.
+    const sql = assertReadOnlyQuery(input.sql);
+    // Layer 2, authoritative: sqlite3_stmt_readonly via better-sqlite3. prepare()
+    // itself rejects multi-statement strings and bad SQL with the driver's message.
+    const stmt = db.prepare(sql);
+    if (!stmt.readonly)
+        throw substratError('validation_failed', 'read-only console: statement is not read-only');
+    if (!stmt.reader)
+        return { sql, reader: false, result: { columns: [], rows: [], truncated: false } };
+    stmt.raw(true);
+    const rows = [];
+    let truncated = false;
+    // Iterate rather than .all(): the row cap bounds what leaves the DB, so an
+    // over-broad SELECT costs a screenful, not the table.
+    for (const row of stmt.iterate()) {
+        if (rows.length >= SCOPE_QUERY_ROW_MAX) {
+            truncated = true;
+            break;
+        }
+        rows.push(row.map(cellToJson));
+    }
+    return { sql, reader: true, result: { columns: stmt.columns().map((c) => c.name), rows, truncated } };
+}
+function appliedMigrationsOf(db) {
+    const rows = db
+        .prepare(`SELECT module_id, version, applied_at, duration_ms, rows_changed FROM _substrat_migrations
+        ORDER BY applied_at DESC, rowid DESC`)
+        .all();
+    return rows.map((r) => ({
+        moduleId: r.module_id,
+        version: r.version,
+        appliedAt: r.applied_at ?? null,
+        durationMs: r.duration_ms,
+        rowsChanged: r.rows_changed,
+    }));
+}
+function undrainedEventsFrom(db, limit) {
+    const page = db.prepare(`SELECT * FROM _substrat_outbox WHERE drained_at IS NULL AND ${emittedHere()} ORDER BY id LIMIT ? OFFSET ?`);
+    // The kernel's read, shared with the DO: the envelope and the columns lifted beside
+    // it (#1242, #1237) are decoded once, and a row that will not decode is stepped over
+    // rather than stalling the scope on it (#1636).
+    return undrainedEventsOf(readUndrainedOutbox((offset, count) => page.all(count, offset), Math.min(assertRowLimit('limit', limit), 1000)));
+}
+const redrainCountOf = (db, drainedBefore) => db
+    .prepare(`SELECT COUNT(*) AS c FROM _substrat_outbox
+          WHERE drained_at IS NOT NULL AND drained_at < ?`)
+    .get(drainedBefore).c;
 /**
  * #119: claim a host directory for this process, for one live `SqliteScopeHost`. The first host in
  * the process takes an exclusive lock on `_host.lock` (a SQLite file: `locking_mode = EXCLUSIVE`
@@ -1633,6 +1772,12 @@ export class SqliteScopeHost {
                 if (!open) {
                     throw new Error(`no live '${provider}' connection for tenant ${rt.tenantId} / vertical '${vertical}'`);
                 }
+                const readSurface = () => this.buildAttachments(rt, { kind: 'connection', id: open.id }, this.attachmentStore(rt.tenantId, vertical), {
+                    reentrant: holdsActor,
+                    // #726 remedy (B): inside a dispatch the authority to read is the DELIVERY,
+                    // not a standing grant. See `admitByEvent` on `buildAttachments`.
+                    admitByEvent: eventId,
+                });
                 return {
                     ...open,
                     // The outbound read (#711), on THIS connection — so it is authorized as
@@ -1652,15 +1797,9 @@ export class SqliteScopeHost {
                     grants: async () => (await this.connectionGrantsInScope(rt.tenantId, rt.scopeId))
                         .filter((g) => g.connectionId === open.id)
                         .map((g) => g.permission),
-                    openAttachment: async (attachmentId) => {
-                        const store = this.attachmentStore(rt.tenantId, vertical);
-                        return this.buildAttachments(rt, { kind: 'connection', id: open.id }, store, {
-                            reentrant: holdsActor,
-                            // #726 remedy (B): inside a dispatch the authority to read is the DELIVERY,
-                            // not a standing grant. See `admitByEvent` on `buildAttachments`.
-                            admitByEvent: eventId,
-                        }).open(attachmentId);
-                    },
+                    openAttachment: async (attachmentId) => readSurface().open(attachmentId),
+                    // #2514: the same read, its bytes a stream.
+                    openAttachmentStream: async (attachmentId) => readSurface().openStream(attachmentId),
                     // #687: open a cell the scope sealed TO this connection. The keyId-indexed
                     // map goes in, never out — a connector is handed the plaintext of one cell,
                     // not a private key it could mislay. Retired keys are in the map too, so a
@@ -2184,6 +2323,16 @@ export class SqliteScopeHost {
                     out.push(r);
             }
         };
+        const contentTypeOf = (p) => {
+            try {
+                const meta = JSON.parse(readFileSync(`${p}.meta`, 'utf8'));
+                return meta.contentType != null ? { contentType: meta.contentType } : {};
+            }
+            catch {
+                // No sidecar (or unreadable): the caller falls back to the metadata row.
+                return {};
+            }
+        };
         return this.wrapBlobStore({
             put: async (key, body, opts) => {
                 const p = resolveKey(key);
@@ -2196,18 +2345,23 @@ export class SqliteScopeHost {
             },
             get: async (key) => {
                 const p = resolveKey(key);
-                if (!existsSync(p))
-                    return null;
-                const body = new Uint8Array(readFileSync(p));
-                let contentType;
+                let body;
                 try {
-                    const meta = JSON.parse(readFileSync(`${p}.meta`, 'utf8'));
-                    contentType = meta.contentType ?? undefined;
+                    body = new Uint8Array(readFileSync(p));
                 }
-                catch {
-                    // No sidecar (or unreadable): the caller falls back to the metadata row.
+                catch (err) {
+                    // Absent, or removed after the read gate: one answer either way, naming no host path (#2514).
+                    if (err.code === 'ENOENT')
+                        return null;
+                    throw err;
                 }
-                return contentType !== undefined ? { body, contentType } : { body };
+                return { body, ...contentTypeOf(p) };
+            },
+            // #2514: the file read as the stream is read, never whole.
+            getStream: async (key) => {
+                const p = resolveKey(key);
+                const file = fileStream(p);
+                return file && { ...file, ...contentTypeOf(p) };
             },
             delete: async (key) => {
                 const p = resolveKey(key);
@@ -2464,6 +2618,21 @@ export class SqliteScopeHost {
             }
         };
         const guarded = opts.reentrant ? reentrant : serialized;
+        // The read gate, decided before the blob store is touched: a refused read never reaches it.
+        const authorizeRead = (attachmentId) => guarded('attachments.open', async (ctx) => {
+            const row = rt.db
+                .prepare('SELECT * FROM _substrat_attachments WHERE id = ?')
+                .get(attachmentId);
+            if (!row)
+                return null;
+            if (opts.admitByEvent !== undefined) {
+                admitByDelivery(rt, opts.admitByEvent, row);
+                return attachmentRecordOfRow(row);
+            }
+            const gate = targetGate(row.entity_type);
+            assertAllowed(await ctx.check(gate.read, { entityType: row.entity_type, entityId: row.entity_id }));
+            return attachmentRecordOfRow(row);
+        });
         return {
             upload: async (input) => {
                 if (capabilitySession !== undefined) {
@@ -2551,20 +2720,7 @@ export class SqliteScopeHost {
                 return rows.map(attachmentRecordOfRow);
             }),
             open: async (attachmentId) => {
-                const record = await guarded('attachments.open', async (ctx) => {
-                    const row = rt.db
-                        .prepare('SELECT * FROM _substrat_attachments WHERE id = ?')
-                        .get(attachmentId);
-                    if (!row)
-                        return null;
-                    if (opts.admitByEvent !== undefined) {
-                        admitByDelivery(rt, opts.admitByEvent, row);
-                        return attachmentRecordOfRow(row);
-                    }
-                    const gate = targetGate(row.entity_type);
-                    assertAllowed(await ctx.check(gate.read, { entityType: row.entity_type, entityId: row.entity_id }));
-                    return attachmentRecordOfRow(row);
-                });
+                const record = await authorizeRead(attachmentId);
                 if (!record)
                     return null;
                 const obj = await store.get(attachmentBlobKey(rt.scopeId, record.id));
@@ -2577,6 +2733,14 @@ export class SqliteScopeHost {
                 }
                 return { record, body: obj.body, contentType: obj.contentType ?? record.contentType };
             },
+            // #2514: the same gate, then the file as it is read, checked against the record as it passes.
+            // The bytes are read after the gate's turn has ended, so a long read holds no actor turn.
+            openStream: async (attachmentId) => {
+                const record = await authorizeRead(attachmentId);
+                if (!record)
+                    return null;
+                return openAttachmentByteStream(store, attachmentBlobKey(rt.scopeId, record.id), record, nodeSha256);
+            },
             remove: async (attachmentId) => {
                 const removed = await guarded('attachments.remove', async (ctx, subject) => {
                     const row = rt.db
@@ -2623,7 +2787,31 @@ export class SqliteScopeHost {
         };
     }
     async importScope(actor, input, dump) {
+        await this.importScopeFrom(actor, input, dump, true);
+    }
+    /**
+     * `importScope`, with its role judgement (#2555) when `judge`: once before the scope is created,
+     * so a refused import leaves nothing behind, and again inside the load's transaction, so a role
+     * defined since that read is judged too. That second refusal comes after the scope was created, so
+     * the scope goes with it. A snapshot passes false: it is the platform's copy of a live scope of this
+     * host, made at once, so its seats are the ones that scope holds now (K-55).
+     */
+    async importScopeFrom(actor, input, dump, judge) {
         this.refuseUnusableScopeStores(dump.stores, input.vertical ?? null);
+        if (judge)
+            this.refuseDumpRoles(input.tenantId, dump);
+        let refusedInLoad = false;
+        const recheck = judge
+            ? () => {
+                try {
+                    this.refuseDumpRoles(input.tenantId, dump);
+                }
+                catch (e) {
+                    refusedInLoad = true;
+                    throw e;
+                }
+            }
+            : undefined;
         // Create the destination scope (directory row + storage). Its migration step
         // creates some tables; the dump then replaces them wholesale, so the end state
         // is the dump, not whatever the local module set would have built. Provenance is
@@ -2635,7 +2823,33 @@ export class SqliteScopeHost {
             forkedAt: input.forkedAt ?? dump.capturedAt,
         });
         // A fork: its callers (snapshotScope) hand it a dump the platform exported.
-        await this.loadDump(input.tenantId, input.scopeId, { ...dump, exact: true });
+        try {
+            await this.loadDump(input.tenantId, input.scopeId, { ...dump, exact: true }, undefined, recheck);
+        }
+        catch (e) {
+            // The scope was created for this import alone and holds nothing loaded, so it goes with the
+            // refusal, and a retry meets no scope. Best effort: the refusal is the answer whatever the
+            // teardown does, and a teardown that fails is a staff-only ops row (no tenant on it), with the
+            // scope left in `provisioning` for staff to reap. No admin row is written for the teardown:
+            // the import never happened, and its `provisionScope` row stays as the record of the attempt.
+            if (refusedInLoad) {
+                await this.dropScopeOutright(input.tenantId, input.scopeId).catch((teardown) => {
+                    try {
+                        this.writeOpsFailure({
+                            actor,
+                            operation: 'importScope',
+                            stage: 'refused-import-teardown',
+                            scopeId: input.scopeId,
+                            message: `a refused import's scope could not be taken down: ${teardown instanceof Error ? teardown.message : String(teardown)}`,
+                        });
+                    }
+                    catch {
+                        // Nothing more to do here: the refusal below is still the answer.
+                    }
+                });
+            }
+            throw e;
+        }
         await this.importScopeStores(input.tenantId, input.scopeId, dump.stores);
         await this.admin.activateScope(actor, input.tenantId, input.scopeId);
         this.recordAdmin(actor, 'importScope', { tenantId: input.tenantId, scopeId: input.scopeId }, null, { sourceScopeId: dump.scopeId, tables: dump.tables.length, capturedAt: dump.capturedAt });
@@ -2647,10 +2861,14 @@ export class SqliteScopeHost {
     dump, 
     /** Run inside the load's own transaction, after the replay (#1742) — the restore's re-assert
      *  of the switch. It throws to roll the load back. */
-    afterLoad) {
+    afterLoad, 
+    /** Run first inside the load's own transaction, before any drop (#2555): the role judgement,
+     *  against the roles stored at the moment of the load. It throws to refuse with nothing moved. */
+    beforeLoad) {
         const rt = this.runtime(tenantId, scopeId);
         const db = rt.db;
         const load = db.transaction((dumped) => {
+            beforeLoad?.();
             // Deferred foreign keys cover the WHOLE drop-then-replay, drops included.
             //
             // Two distinct FK hazards, and the second is why this cannot wrap the inserts alone:
@@ -2797,6 +3015,8 @@ export class SqliteScopeHost {
         if (!existing)
             throw substratError('not_found', `unknown scope ${scopeId} in tenant ${tenantId}`);
         this.refuseUnusableScopeStores(dump.stores, existing.vertical);
+        // #2555: judged before the fence, so a refused restore moves nothing; again inside the load.
+        this.refuseDumpRoles(tenantId, dump);
         // #2314: the load replaces the scope's rows, so the orphan sweep is fenced first.
         await this.fenceOrphanSweep(tenantId, scopeId, existing.vertical ?? null);
         // #1742: a dump from before a switch was pulled brings the module's grants back live, so
@@ -2806,7 +3026,7 @@ export class SqliteScopeHost {
         const rows = [];
         // #1869: the re-point's source is the separate hint when given; the dump is otherwise as sent.
         const source = { tables: dump.tables, scopeId: opts?.sourceScopeId ?? dump.scopeId };
-        await this.loadDump(tenantId, scopeId, source, (rt) => this.reassertSwitchesInTurn(rt, actor, tenantId, scopeId, undefined, (action, after) => rows.push([action, after])));
+        await this.loadDump(tenantId, scopeId, source, (rt) => this.reassertSwitchesInTurn(rt, actor, tenantId, scopeId, undefined, (action, after) => rows.push([action, after])), () => this.refuseDumpRoles(tenantId, dump));
         await this.importScopeStores(tenantId, scopeId, dump.stores);
         const replay = await this.replayShreddedStoreErasures(actor, tenantId, scopeId, (opts?.sourceScopeId ?? dump.scopeId));
         for (const [action, after] of rows)
@@ -2825,7 +3045,7 @@ export class SqliteScopeHost {
             throw substratError('not_found', `unknown scope ${scopeId} in tenant ${tenantId}`);
         const dump = await this.admin.exportScope(actor, tenantId, scopeId);
         const snapshotId = ulid();
-        await this.importScope(actor, {
+        await this.importScopeFrom(actor, {
             tenantId,
             scopeId: snapshotId,
             kind: opts?.kind ?? 'archive',
@@ -2834,7 +3054,7 @@ export class SqliteScopeHost {
             jurisdiction: source.jurisdiction,
             expiresAt: opts?.expiresAt,
             // forkedFrom/forkedAt are stamped from the dump by importScope.
-        }, dump);
+        }, dump, false);
         // Bind the snapshot to the source's current version so it is a runnable copy at the
         // same frontier (a fresh bind, so it never re-triggers the snapshot path).
         if (source.verticalVersionId) {
@@ -2854,6 +3074,16 @@ export class SqliteScopeHost {
             throw substratError('forbidden', `scope ${scopeId} is not a fork or preview — only previews may be deleted; ` +
                 `archive a primary scope instead`);
         }
+        await this.dropScopeOutright(tenantId, scopeId);
+        this.recordAdmin(actor, 'deleteSnapshot', { tenantId, scopeId }, null, {
+            forkedFrom: rec.forkedFrom,
+            forkedAt: rec.forkedAt,
+            expiresAt: rec.expiresAt,
+            kind: rec.kind,
+        });
+    }
+    /** `deleteSnapshot`'s teardown, without its refusal or its audit row: the scope's stores, file and directory rows. */
+    async dropScopeOutright(tenantId, scopeId) {
         await this.wipeScopeStores(tenantId, scopeId);
         // Close and evict the runtime handle before touching the file.
         const rt = this.scopes.get(`${tenantId}/${scopeId}`);
@@ -2873,12 +3103,6 @@ export class SqliteScopeHost {
             forgetScopeStorage(redactionSqlOf(this.directory), scopeId);
             this.directory.prepare('DELETE FROM scopes WHERE scope_id = ?').run(scopeId);
         })();
-        this.recordAdmin(actor, 'deleteSnapshot', { tenantId, scopeId }, null, {
-            forkedFrom: rec.forkedFrom,
-            forkedAt: rec.forkedAt,
-            expiresAt: rec.expiresAt,
-            kind: rec.kind,
-        });
     }
     async getScope(principal, tenantId, scopeId, options) {
         const row = this.directory
@@ -3871,6 +4095,19 @@ export class SqliteScopeHost {
         if (refusal)
             throw substratError('forbidden', refusal);
     }
+    /**
+     * #2555: refuse loading `dump` into a scope of `tenantId` (`dumpRoleRefusal`): the tenant's roles
+     * as this host stores them now, against the dump's role rows and seats, with the keys the modules
+     * registered or listed here reserve and declare. Synchronous, so a caller inside the load's
+     * transaction judges the roles stored at that moment.
+     */
+    refuseDumpRoles(tenantId, dump) {
+        const prefix = `${tenantId}/`;
+        const roles = [...this.roles].filter(([k]) => k.startsWith(prefix)).map(([, r]) => r);
+        const refusal = dumpRoleRefusal(roles, { reserved: this.reservedKeys, declared: this.declaredKeys }, dump, this.clock());
+        if (refusal)
+            throw substratError('forbidden', refusal);
+    }
     /**
      * #2447: does anyone but a system principal hold a live seat in `roleKey` in this tenant — a
      * tenant-level assignment, or a scope-level one in any of its scopes not reaped
@@ -3928,6 +4165,66 @@ export class SqliteScopeHost {
     async attachmentSizeLocal(scopeId) {
         return attachmentBytesOf(this.heldReadDb(scopeId));
     }
+    // -- the introspection reads a vertical's `/internal/*` routes make by scope id alone (#2544) --------
+    // The Cloudflare host's `*Local` verbs, refused from the directory before any store is opened
+    // (`heldReadDb`), so a scope this host does not hold is `conflict`, never an empty answer and never
+    // a store file created for it. No audit row, as there: the control plane that called is the auditor.
+    async facetEventsLocal(scopeId, input) {
+        return facetEvents({ sql: scopedSql(this.heldReadDb(scopeId)) }, input);
+    }
+    async eventEffectsLocal(scopeId, input) {
+        return walkEventEffects({ sql: scopedSql(this.heldReadDb(scopeId)) }, input.eventId, input.maxNodes);
+    }
+    async invocationEventsLocal(scopeId, input) {
+        return readInvocation({ sql: scopedSql(this.heldReadDb(scopeId)) }, input.invocationId, input.limit);
+    }
+    async deadLettersLocal(scopeId, input) {
+        return readDeadLetters({ sql: scopedSql(this.heldReadDb(scopeId)) }, { limit: input.limit, cursor: input.cursor });
+    }
+    async lifecycleFlowLocal(scopeId, input) {
+        return readLifecycleFlow({ sql: scopedSql(this.heldReadDb(scopeId)) }, input);
+    }
+    async operationSeriesLocal(scopeId, input) {
+        return readOperationSeries({ sql: scopedSql(this.heldReadDb(scopeId)) }, input);
+    }
+    async eventCauseLocal(scopeId, input) {
+        return walkEventCause({ sql: scopedSql(this.heldReadDb(scopeId)) }, input.eventId, input.maxDepth);
+    }
+    async entityHistoryLocal(scopeId, input) {
+        return readHistory({ sql: scopedSql(this.heldReadDb(scopeId)) }, { entityType: input.entityType, entityId: input.entityId }, { limit: input.limit, cursor: input.cursor });
+    }
+    async appliedMigrationsLocal(scopeId) {
+        return appliedMigrationsOf(this.heldReadDb(scopeId));
+    }
+    /** No PITR on plain SQLite: an empty list for a held scope, as `scopeMigrationBookmarks` answers. */
+    async migrationBookmarksLocal(scopeId) {
+        this.heldReadDb(scopeId);
+        return [];
+    }
+    async introspectScopeTables(scopeId) {
+        return scopeTablesOf(this.heldReadDb(scopeId));
+    }
+    /** The Data view's table page (#2563): refused `conflict` with the shared sentence for a scope this host does not hold. */
+    async introspectScopeTable(scopeId, input) {
+        return scopeTablePageOf(this.heldReadDb(scopeId), input);
+    }
+    /**
+     * The carry's read of a wiped copy's tombstone (#2563). Plain SQLite has no carry and no wipe, so
+     * a store it does not hold is one it does not have: this reads what `introspectScopeTable` reads.
+     */
+    async readTombstoneTable(scopeId, input) {
+        return scopeTablePageOf(this.heldReadDb(scopeId), input);
+    }
+    /** The SQL console's CP-less path (#219), guarded as the table page is (#2563). */
+    async introspectScopeQuery(scopeId, input) {
+        return scopeQueryOf(this.heldReadDb(scopeId), input).result;
+    }
+    async undrainedEventsLocal(scopeId, limit) {
+        return undrainedEventsFrom(this.heldReadDb(scopeId), Math.max(limit, 1));
+    }
+    async redrainCountLocal(scopeId, drainedBefore) {
+        return redrainCountOf(this.heldReadDb(scopeId), drainedBefore);
+    }
     /**
      * The read connection of a scope this host holds, for a read that names only the scope id (#2541),
      * with the directory read ONCE. Refused `conflict` before anything is opened: no row, a reaped one
@@ -5937,6 +6234,20 @@ export class SqliteScopeHost {
                 .get(slugValue);
             return r ? mapVertical(r) : undefined;
         };
+        /**
+         * #2528: one vertical row update whose admin row takes its `before` (and whose guard runs, by
+         * throwing) from the vertical as the write's own transaction reads it.
+         */
+        const updateVertical = (actor, action, slugValue, set, args, judge, after) => {
+            let before = null;
+            this.directoryWriteAndAudit(() => {
+                const existing = readVertical(slugValue);
+                if (!existing)
+                    throw substratError('not_found', `unknown vertical '${slugValue}'`);
+                before = judge(existing);
+                return this.directory.prepare(`UPDATE verticals SET ${set} WHERE slug = ?`).run(...args, slugValue).changes > 0;
+            }, () => this.recordAdmin(actor, action, { tenantId: null }, before, after));
+        };
         const mapVersion = (r) => verticalVersion.parse({
             id: r.id,
             verticalSlug: r.vertical_slug,
@@ -5963,6 +6274,14 @@ export class SqliteScopeHost {
             }
             return r ? mapVersion(r) : undefined;
         };
+        /** A version's admission, read synchronously so a transaction can judge it (#2528). */
+        const versionAdmission = (id) => {
+            const v = this.directory.prepare('SELECT admission, admission_note FROM vertical_versions WHERE id = ?')
+                .get(id);
+            if (!v)
+                throw substratError('not_found', `unknown version ${id}`);
+            return v;
+        };
         const mapOrg = (r) => orgSchema.parse({
             id: r.org_id,
             tenantId: r.tenant_id,
@@ -6200,6 +6519,19 @@ export class SqliteScopeHost {
         const onNode = (node, body) => node.scopeId
             ? this.runtime(node.tenantId, node.scopeId).actor.turn(body)
             : Promise.resolve().then(body);
+        /**
+         * `onNode`, with the write's admin row (#2526). At the tenant node the write is a directory
+         * row, so it and its row are one directory transaction. At a scope node it is in the scope's
+         * own store, which no directory transaction reaches, so the row follows it (#1292's window).
+         */
+        const auditedOnNode = async (node, write, audit) => {
+            if (!node.scopeId) {
+                this.directoryWriteAndAudit(() => { write(); return true; }, audit);
+                return;
+            }
+            await onNode(node, write);
+            audit();
+        };
         /**
          * One kill switch moved on one scope — the ONE body `revokeFromSystem` / `restoreToSystem`
          * (#1666, a module's `system:` authority) and `revokeFromPeer` / `restoreToPeer` (#1706, a
@@ -6456,14 +6788,25 @@ export class SqliteScopeHost {
                 // #2447: judged before the write, against this host's keys and the tenant's other roles, so a
                 // role assigned through a door cannot be widened afterwards. A refusal writes nothing, so a
                 // seat of the role as it was stored keeps working.
-                this.refuseReservedDefinition(tenantId, parsed);
-                const before = this.roles.get(`${tenantId}/${parsed.key}`) ?? null;
-                this.directory
-                    .prepare(`INSERT OR REPLACE INTO _substrat_roles (tenant_id, role_key, permissions, source, holder)
-             VALUES (?, ?, ?, ?, ?)`)
-                    .run(tenantId, parsed.key, JSON.stringify(parsed.permissions), String(parsed.source), parsed.holder ?? 'person');
+                // #2526: the judgement, the row's `before`, the write and the row are one directory unit.
+                let before = null;
+                this.directoryWriteAndAudit(() => {
+                    this.refuseReservedDefinition(tenantId, parsed);
+                    // The row as stored, read as `loadRoles` reads one.
+                    const stored = this.directory
+                        .prepare('SELECT permissions, source, holder FROM _substrat_roles WHERE tenant_id = ? AND role_key = ?')
+                        .get(tenantId, parsed.key);
+                    before = stored
+                        ? { key: parsed.key, permissions: JSON.parse(stored.permissions), source: stored.source, holder: stored.holder ?? undefined }
+                        : null;
+                    this.directory
+                        .prepare(`INSERT OR REPLACE INTO _substrat_roles (tenant_id, role_key, permissions, source, holder)
+               VALUES (?, ?, ?, ?, ?)`)
+                        .run(tenantId, parsed.key, JSON.stringify(parsed.permissions), String(parsed.source), parsed.holder ?? 'person');
+                    return true;
+                }, () => this.recordAdmin(actor, 'defineRole', { tenantId }, before, parsed));
+                // The cache follows the commit, so a rolled-back definition is never served.
                 this.roles.set(`${tenantId}/${parsed.key}`, { ...parsed, holder: parsed.holder ?? 'person' });
-                this.recordAdmin(actor, 'defineRole', { tenantId }, before, parsed);
             },
             listRoles: async (actor, filter) => {
                 const where = [];
@@ -6508,17 +6851,18 @@ export class SqliteScopeHost {
                 }));
             },
             assignRole: async (actor, assignment) => {
-                // #2430: the platform's door — a role mixing reserved and other keys is refused (K-55).
-                this.refuseReservedRole(assignment.node.tenantId, assignment.roleKey, 'platform');
                 const subject = `principal:${assignment.principalId}`;
-                if (assignment.node.scopeId) {
-                    const scopeNode = assignment.node.scopeId;
-                    await onNode(assignment.node, () => writeScopeTuple(assignment.node, subject, `role:${assignment.roleKey}`, `scope:${scopeNode}`));
-                }
-                else {
-                    writeTenantTuple(assignment.node.tenantId, subject, `role:${assignment.roleKey}`, `tenant:${assignment.node.tenantId}`);
-                }
-                this.recordAdmin(actor, 'assignRole', { tenantId: assignment.node.tenantId, scopeId: assignment.node.scopeId }, null, assignment);
+                const { tenantId, scopeId } = assignment.node;
+                // #2430: the platform's door — a role mixing reserved and other keys is refused (K-55).
+                // Before the write opens a scope's file; synchronous with a tenant node's unit, so no
+                // definition lands between the two.
+                this.refuseReservedRole(tenantId, assignment.roleKey, 'platform');
+                await auditedOnNode(assignment.node, () => {
+                    if (scopeId)
+                        writeScopeTuple(assignment.node, subject, `role:${assignment.roleKey}`, `scope:${scopeId}`);
+                    else
+                        writeTenantTuple(tenantId, subject, `role:${assignment.roleKey}`, `tenant:${tenantId}`);
+                }, () => this.recordAdmin(actor, 'assignRole', { tenantId, scopeId }, null, assignment));
             },
             unassignRole: async (actor, assignment) => {
                 // Tombstone (K-21), never DELETE — the checker skips revoked_at rows, so the
@@ -6547,8 +6891,7 @@ export class SqliteScopeHost {
                 // to Z text (#963), and liveness here is a lexicographic `expires_at > ?`.
                 const grant = capabilityGrant.parse(raw);
                 this.refuseReservedGrant([grant.permission]); // #2430
-                await onNode(grant.node, () => writeGrant(`principal:${grant.principalId}`, grant.permission, grant.node, grant.entity, grant.expiresAt));
-                this.recordAdmin(actor, 'grant', { tenantId: grant.node.tenantId, scopeId: grant.node.scopeId }, null, grant);
+                await auditedOnNode(grant.node, () => writeGrant(`principal:${grant.principalId}`, grant.permission, grant.node, grant.entity, grant.expiresAt), () => this.recordAdmin(actor, 'grant', { tenantId: grant.node.tenantId, scopeId: grant.node.scopeId }, null, grant));
             },
             grantEntityShape: async (actor, grant) => {
                 const { tenantId, scopeId } = grant.node;
@@ -6629,29 +6972,35 @@ export class SqliteScopeHost {
                 // row, so a refused grant is gathered by no later provision. A grant recorded before stays.
                 this.refuseReservedGrant([grant.permission]);
                 // Once BEFORE the turn, so a refused grant never opens (and so creates) the scope's
-                // file; then again inside it, with the tuple and the directory row, in ONE body on
-                // the scope actor (#1678) — so the tuple cannot roll back with a stranger's
-                // transaction and leave the directory row (#592) claiming a grant the scope lacks.
+                // file; then again inside it, in ONE body on the scope actor (#1678), so the tuple
+                // cannot roll back with a stranger's transaction.
                 check();
-                const conn = await onNode(grant.node, () => {
-                    const row = check();
-                    writeGrant(subjectRef({ kind: 'connection', id: grant.connectionId }), grant.permission, grant.node, undefined, grant.expiresAt);
-                    // #592: the directory-side record, alongside the tuple. The tuple is checked
-                    // where it lives; this row is what provision/reconcile gather FROM, so the
-                    // grant reaches scopes provisioned after it without a human replaying it.
-                    this.directory
-                        .prepare(`INSERT OR REPLACE INTO _substrat_connection_grants
-                 (connection_id, tenant_id, vertical, permission, scope_id, expires_at,
-                  granted_by, granted_at, revoked_at)
-               VALUES (?, ?, ?, ?, ?, ?, ?, ?, NULL)`)
-                        .run(grant.connectionId, grant.node.tenantId, row.vertical, grant.permission, grant.node.scopeId ?? null, grant.expiresAt ?? null, grant.grantedBy, new Date().toISOString());
-                    return row;
-                });
-                this.recordAdmin(actor, 'grantToConnection', { tenantId: grant.node.tenantId, scopeId: grant.node.scopeId, vertical: conn.vertical }, null, {
-                    connectionId: grant.connectionId,
-                    provider: conn.provider,
-                    permission: grant.permission,
-                    node: grant.node,
+                const tuple = () => writeGrant(subjectRef({ kind: 'connection', id: grant.connectionId }), grant.permission, grant.node, undefined, grant.expiresAt);
+                await onNode(grant.node, () => {
+                    // #2526: the check, the directory record (#592) and the admin row are one directory unit,
+                    // with the tuple too at the tenant node, where it is a directory row. A scope tuple lives
+                    // in the scope's own store and is written after the unit: if it fails, the call throws and
+                    // the record and its row stand without it. The Cloudflare host's reconcile re-seats a
+                    // tuple from the record; this host does not (#2586), so a re-grant is what delivers it.
+                    this.directory.transaction(() => {
+                        const conn = check();
+                        if (!grant.node.scopeId)
+                            tuple();
+                        this.directory
+                            .prepare(`INSERT OR REPLACE INTO _substrat_connection_grants
+                   (connection_id, tenant_id, vertical, permission, scope_id, expires_at,
+                    granted_by, granted_at, revoked_at)
+                 VALUES (?, ?, ?, ?, ?, ?, ?, ?, NULL)`)
+                            .run(grant.connectionId, grant.node.tenantId, conn.vertical, grant.permission, grant.node.scopeId ?? null, grant.expiresAt ?? null, grant.grantedBy, new Date().toISOString());
+                        this.recordAdmin(actor, 'grantToConnection', { tenantId: grant.node.tenantId, scopeId: grant.node.scopeId, vertical: conn.vertical }, null, {
+                            connectionId: grant.connectionId,
+                            provider: conn.provider,
+                            permission: grant.permission,
+                            node: grant.node,
+                        });
+                    })();
+                    if (grant.node.scopeId)
+                        tuple();
                 });
             },
             grantToSystem: async (actor, raw) => {
@@ -6664,6 +7013,7 @@ export class SqliteScopeHost {
                 const grant = systemGrant.parse(raw);
                 const write = () => writeGrant(subjectRef({ kind: 'system', id: grant.moduleId }), grant.permission, grant.node, undefined, grant.expiresAt);
                 const scope = grant.node.scopeId;
+                const audit = () => this.recordAdmin(actor, 'grantToSystem', { tenantId: grant.node.tenantId, scopeId: grant.node.scopeId }, null, { moduleId: grant.moduleId, permission: grant.permission, node: grant.node });
                 if (scope) {
                     // #1666: refused while the module is switched off on this scope. The check and the
                     // write share one synchronous body inside one turn on the scope actor, so no switch
@@ -6678,19 +7028,21 @@ export class SqliteScopeHost {
                         }
                         write();
                     });
+                    audit();
                 }
                 else {
                     // Tenant-level: a directory write, which no scope's transaction can hold. #1743:
                     // refused while the record holds the module off on any scope (`scopesSwitchedOffFor`);
-                    // the record and the tenant tuple share the directory, so this is one transaction.
-                    this.directory.transaction(() => {
+                    // the record, the tenant tuple and (#2526) the row share the directory, so this is one
+                    // transaction.
+                    this.directoryWriteAndAudit(() => {
                         const off = scopesSwitchedOffFor(switchSqlOf(this.directory), grant.node.tenantId, grant.moduleId);
                         if (off.length > 0)
                             throw substratError('conflict', tenantSystemSwitchedOffMessage(grant.moduleId, off));
                         write();
-                    })();
+                        return true;
+                    }, audit);
                 }
-                this.recordAdmin(actor, 'grantToSystem', { tenantId: grant.node.tenantId, scopeId: grant.node.scopeId }, null, { moduleId: grant.moduleId, permission: grant.permission, node: grant.node });
             },
             // #1666: the schedule kill switch and its lever back — `system-switch.ts` is the
             // whole rule, shared with the Cloudflare adapter; this is the directory check, the
@@ -6781,11 +7133,10 @@ export class SqliteScopeHost {
                 // the write in one body, on the scope actor when the node is a scope (#1678).
                 requireOrg(node.tenantId, orgId);
                 this.refuseReservedGrant([permission]); // #2430: an org's members are people
-                await onNode(node, () => {
+                await auditedOnNode(node, () => {
                     requireOrg(node.tenantId, orgId);
                     writeGrant(`org:${orgId}`, permission, node, entity);
-                });
-                this.recordAdmin(actor, 'grantToOrg', { tenantId: node.tenantId, scopeId: node.scopeId }, null, { orgId, permission, node, entity });
+                }, () => this.recordAdmin(actor, 'grantToOrg', { tenantId: node.tenantId, scopeId: node.scopeId }, null, { orgId, permission, node, entity }));
             },
             // -- vertical + version registry (#31) ---------------------------------
             // -- the hostname map (K-26) -------------------------------------------
@@ -7100,15 +7451,15 @@ export class SqliteScopeHost {
             },
             publishVersion: async (actor, input) => {
                 const parsed = publishVersionInput.parse(input);
-                const owning = readVertical(parsed.verticalSlug);
-                if (!owning) {
-                    throw substratError('not_found', `unknown vertical '${parsed.verticalSlug}'`);
-                }
+                const unknownVertical = () => substratError('not_found', `unknown vertical '${parsed.verticalSlug}'`);
+                if (!readVertical(parsed.verticalSlug))
+                    throw unknownVertical();
                 // Lands PENDING — a push is not a deploy — except for a PRIVATE vertical
                 // (tenant-owned, not listed), whose blast radius is its own tenant: there the
                 // sandbox contract is the gate and the version self-admits, noted so the
-                // publish seam can tell a staff vouch from this shortcut.
-                const selfAdmits = owning.ownerTenant !== null && !owning.listed;
+                // publish seam can tell a staff vouch from this shortcut. Judged in the insert's
+                // transaction (#2528), on the vertical as it reads it there.
+                let selfAdmits = false;
                 // The manifest is retained for the serving upload (#286), not audited — a whole
                 // manifest per publish would drown the admin log in bundle metadata.
                 const { manifestJson, origin, ...audited } = parsed;
@@ -7120,6 +7471,10 @@ export class SqliteScopeHost {
                     id: audited.id, migrationDigest: audited.migrationDigest, manifestJson: manifestJson ?? null, migrations: split.migrations,
                 });
                 this.directoryWriteAndAudit(() => {
+                    const owning = readVertical(parsed.verticalSlug);
+                    if (!owning)
+                        throw unknownVertical();
+                    selfAdmits = owning.ownerTenant !== null && !owning.listed;
                     this.directory
                         .prepare(`INSERT INTO vertical_versions
                  (id, vertical_slug, version, manifest_digest, permission_digest,
@@ -7168,85 +7523,66 @@ export class SqliteScopeHost {
                 this.recordAccess(actor, 'getVersion', {}, { versionId, verticalSlug }, hit ? 1 : 0);
                 return hit;
             },
+            // #2528: each vertical write below reads its row's `before`, and runs its guard, inside the
+            // transaction that writes (`updateVertical`).
             setVerticalListed: async (actor, slug, listed) => {
-                const existing = readVertical(slug);
-                if (!existing)
-                    throw substratError('not_found', `unknown vertical '${slug}'`);
-                // Listing is the moment other tenants start trusting this code, so the
-                // version they would install must carry a real staff vouch — an auto-admitted
-                // prod version has never been read by anyone but its author.
-                if (listed) {
-                    const prod = this.directory
-                        .prepare("SELECT version_id FROM vertical_channels WHERE vertical_slug = ? AND channel = 'prod'")
-                        .get(slug);
-                    const prodVersion = prod ? await readVersion(prod.version_id) : undefined;
-                    if (prodVersion?.admissionNote === AUTO_ADMISSION_NOTE) {
-                        throw substratError('conflict', `vertical '${slug}' prod version ${prodVersion.id} is auto-admitted (private self-serve) — ` +
-                            `a staff admit must vouch for it before listing`);
-                    }
-                }
                 // Resolve any pending publish request either way, and set the flag.
-                this.directoryWriteAndAudit(() => this.directory
-                    .prepare('UPDATE verticals SET listed = ?, publish_requested_at = NULL WHERE slug = ?')
-                    .run(listed ? 1 : 0, slug).changes > 0, () => this.recordAdmin(actor, 'setVerticalListed', { tenantId: null }, { listed: existing.listed }, { listed }));
+                updateVertical(actor, 'setVerticalListed', slug, 'listed = ?, publish_requested_at = NULL', [listed ? 1 : 0], (existing) => {
+                    // Listing is the moment other tenants start trusting this code, so the
+                    // version they would install must carry a real staff vouch — an auto-admitted
+                    // prod version has never been read by anyone but its author.
+                    if (listed) {
+                        const prod = this.directory
+                            .prepare(`SELECT v.id, v.admission_note FROM vertical_channels c JOIN vertical_versions v ON v.id = c.version_id
+                  WHERE c.vertical_slug = ? AND c.channel = 'prod'`)
+                            .get(slug);
+                        if (prod?.admission_note === AUTO_ADMISSION_NOTE) {
+                            throw substratError('conflict', `vertical '${slug}' prod version ${prod.id} is auto-admitted (private self-serve) — ` +
+                                `a staff admit must vouch for it before listing`);
+                        }
+                    }
+                    return { listed: existing.listed };
+                }, { listed });
             },
             requestPublish: async (actor, slug) => {
-                const existing = readVertical(slug);
-                if (!existing)
-                    throw substratError('not_found', `unknown vertical '${slug}'`);
-                this.directoryWriteAndAudit(() => this.directory
-                    .prepare('UPDATE verticals SET publish_requested_at = ? WHERE slug = ?')
-                    .run(new Date().toISOString(), slug).changes > 0, () => this.recordAdmin(actor, 'requestPublish', { tenantId: null }, null, { slug }));
+                updateVertical(actor, 'requestPublish', slug, 'publish_requested_at = ?', [new Date().toISOString()], () => null, { slug });
             },
             setVerticalInstallsBlocked: async (actor, slug, blocked) => {
-                const existing = readVertical(slug);
-                if (!existing)
-                    throw substratError('not_found', `unknown vertical '${slug}'`);
-                this.directoryWriteAndAudit(() => this.directory
-                    .prepare('UPDATE verticals SET installs_blocked = ? WHERE slug = ?')
-                    .run(blocked ? 1 : 0, slug).changes > 0, () => this.recordAdmin(actor, 'setVerticalInstallsBlocked', { tenantId: null }, { installsBlocked: existing.installsBlocked }, { installsBlocked: blocked }));
+                updateVertical(actor, 'setVerticalInstallsBlocked', slug, 'installs_blocked = ?', [blocked ? 1 : 0], (existing) => ({ installsBlocked: existing.installsBlocked }), { installsBlocked: blocked });
             },
             setVerticalTenantProvisioner: async (actor, slug, granted) => {
-                const existing = readVertical(slug);
-                if (!existing)
-                    throw substratError('not_found', `unknown vertical '${slug}'`);
-                this.directoryWriteAndAudit(() => this.directory
-                    .prepare('UPDATE verticals SET tenant_provisioner = ? WHERE slug = ?')
-                    .run(granted ? 1 : 0, slug).changes > 0, () => this.recordAdmin(actor, 'setVerticalTenantProvisioner', { tenantId: null }, { tenantProvisioner: existing.tenantProvisioner }, { tenantProvisioner: granted }));
+                updateVertical(actor, 'setVerticalTenantProvisioner', slug, 'tenant_provisioner = ?', [granted ? 1 : 0], (existing) => ({ tenantProvisioner: existing.tenantProvisioner }), { tenantProvisioner: granted });
             },
             setVerticalEmailSender: async (actor, slug, granted) => {
-                const existing = readVertical(slug);
-                if (!existing)
-                    throw substratError('not_found', `unknown vertical '${slug}'`);
-                this.directoryWriteAndAudit(() => this.directory
-                    .prepare('UPDATE verticals SET email_sender = ? WHERE slug = ?')
-                    .run(granted ? 1 : 0, slug).changes > 0, () => this.recordAdmin(actor, 'setVerticalEmailSender', { tenantId: null }, { emailSender: existing.emailSender }, { emailSender: granted }));
+                updateVertical(actor, 'setVerticalEmailSender', slug, 'email_sender = ?', [granted ? 1 : 0], (existing) => ({ emailSender: existing.emailSender }), { emailSender: granted });
             },
             deleteVertical: async (actor, slug) => {
-                const existing = readVertical(slug);
-                if (!existing)
-                    throw substratError('not_found', `unknown vertical '${slug}'`);
-                // Refuse while any restorable scope is bound: a deleted registry row would strand
-                // those scopes' version pins and routing. An `archived` scope (a deleted app) still
-                // blocks — unarchive can bring it back — but the refusal names reap/restore, not
-                // "delete", because the app itself is already gone. `reaped` is terminal history
-                // and never blocks. The count names the blast radius.
-                const bound = this.directory
-                    .prepare('SELECT ' +
-                    "COUNT(*) FILTER (WHERE status NOT IN ('archived', 'reaped')) AS live, " +
-                    "COUNT(*) FILTER (WHERE status = 'archived') AS archived " +
-                    'FROM scopes WHERE vertical = ?')
-                    .get(slug);
-                if (bound.live > 0) {
-                    throw substratError('conflict', `vertical '${slug}' still backs ${bound.live} scope(s) — delete or rebind them first`);
-                }
-                if (bound.archived > 0) {
-                    throw substratError('conflict', `vertical '${slug}' still backs ${bound.archived} archived scope(s) — reap or restore them first`);
-                }
                 // Deployed dispatch scripts are NOT reaped here — they become orphans for the
                 // cleanup script (#248), never destroyed alongside a registry row.
-                // #2501: one transaction, so the row and its ownership period close together.
+                // #2501: one transaction, so the row and its ownership period close together; #2528: its
+                // `before` and the bound-scope refusal are read in it too.
+                let existing;
                 this.directoryWriteAndAudit(() => {
+                    existing = readVertical(slug);
+                    if (!existing)
+                        throw substratError('not_found', `unknown vertical '${slug}'`);
+                    // Refuse while any restorable scope is bound: a deleted registry row would strand
+                    // those scopes' version pins and routing. An `archived` scope (a deleted app) still
+                    // blocks — unarchive can bring it back — but the refusal names reap/restore, not
+                    // "delete", because the app itself is already gone. `reaped` is terminal history
+                    // and never blocks. The count names the blast radius.
+                    const bound = this.directory
+                        .prepare('SELECT ' +
+                        "COUNT(*) FILTER (WHERE status NOT IN ('archived', 'reaped')) AS live, " +
+                        "COUNT(*) FILTER (WHERE status = 'archived') AS archived " +
+                        'FROM scopes WHERE vertical = ?')
+                        .get(slug);
+                    if (bound.live > 0) {
+                        throw substratError('conflict', `vertical '${slug}' still backs ${bound.live} scope(s) — delete or rebind them first`);
+                    }
+                    if (bound.archived > 0) {
+                        throw substratError('conflict', `vertical '${slug}' still backs ${bound.archived} archived scope(s) — reap or restore them first`);
+                    }
                     this.directory.prepare('DELETE FROM vertical_channels WHERE vertical_slug = ?').run(slug);
                     this.directory.prepare('DELETE FROM vertical_channel_history WHERE vertical_slug = ?').run(slug);
                     this.directory
@@ -7267,47 +7603,40 @@ export class SqliteScopeHost {
                 this.recordAccess(actor, 'listVerticalOwners', { tenantId: null }, { slug }, periods.length);
                 return periods;
             },
+            // #2528: the admission is judged, and the row's `before` read, in the transaction that writes.
             admitVersion: async (actor, versionId) => {
-                const v = await readVersion(versionId);
-                if (!v)
-                    throw substratError('not_found', `unknown version ${versionId}`);
-                if (v.admission === 'admitted') {
-                    // Idempotent — except an AUTO-admitted version, which this upgrades to a
-                    // manual vouch by clearing the note (what the publish seam requires).
-                    if (v.admissionNote !== AUTO_ADMISSION_NOTE)
-                        return;
-                    this.directoryWriteAndAudit(() => this.directory
-                        .prepare('UPDATE vertical_versions SET admission_note = NULL WHERE id = ?')
-                        .run(versionId).changes > 0, () => this.recordAdmin(actor, 'admitVersion', { tenantId: null }, { admission: v.admission, note: v.admissionNote }, {
-                        admission: 'admitted',
-                        note: null,
-                    }));
-                    return;
-                }
-                if (v.admission === 'rejected') {
-                    throw substratError('conflict', `version ${versionId} was rejected — publish a new one`);
-                }
-                this.directoryWriteAndAudit(() => this.directory
-                    .prepare("UPDATE vertical_versions SET admission = 'admitted' WHERE id = ?")
-                    .run(versionId).changes > 0, () => this.recordAdmin(actor, 'admitVersion', { tenantId: null }, { admission: v.admission }, {
-                    admission: 'admitted',
-                }));
+                let row = { before: null, after: null };
+                this.directoryWriteAndAudit(() => {
+                    const v = versionAdmission(versionId);
+                    if (v.admission === 'admitted') {
+                        // Idempotent — except an AUTO-admitted version, which this upgrades to a
+                        // manual vouch by clearing the note (what the publish seam requires).
+                        if (v.admission_note !== AUTO_ADMISSION_NOTE)
+                            return false;
+                        row = { before: { admission: v.admission, note: v.admission_note }, after: { admission: 'admitted', note: null } };
+                        return this.directory.prepare('UPDATE vertical_versions SET admission_note = NULL WHERE id = ?').run(versionId).changes > 0;
+                    }
+                    if (v.admission === 'rejected') {
+                        throw substratError('conflict', `version ${versionId} was rejected — publish a new one`);
+                    }
+                    row = { before: { admission: v.admission }, after: { admission: 'admitted' } };
+                    return this.directory.prepare("UPDATE vertical_versions SET admission = 'admitted' WHERE id = ?").run(versionId).changes > 0;
+                }, () => this.recordAdmin(actor, 'admitVersion', { tenantId: null }, row.before, row.after));
             },
             rejectVersion: async (actor, versionId, note) => {
-                const v = await readVersion(versionId);
-                if (!v)
-                    throw substratError('not_found', `unknown version ${versionId}`);
-                if (v.admission === 'admitted') {
-                    throw substratError('conflict', `version ${versionId} is already admitted — it may be bound`);
-                }
-                if (v.admission === 'rejected')
-                    return; // idempotent
-                this.directoryWriteAndAudit(() => this.directory
-                    .prepare("UPDATE vertical_versions SET admission = 'rejected', admission_note = ? WHERE id = ?")
-                    .run(note, versionId).changes > 0, () => this.recordAdmin(actor, 'rejectVersion', { tenantId: null }, { admission: v.admission }, {
-                    admission: 'rejected',
-                    note,
-                }));
+                let before = null;
+                this.directoryWriteAndAudit(() => {
+                    const v = versionAdmission(versionId);
+                    if (v.admission === 'admitted') {
+                        throw substratError('conflict', `version ${versionId} is already admitted — it may be bound`);
+                    }
+                    if (v.admission === 'rejected')
+                        return false; // idempotent
+                    before = { admission: v.admission };
+                    return this.directory
+                        .prepare("UPDATE vertical_versions SET admission = 'rejected', admission_note = ? WHERE id = ?")
+                        .run(note, versionId).changes > 0;
+                }, () => this.recordAdmin(actor, 'rejectVersion', { tenantId: null }, before, { admission: 'rejected', note }));
             },
             promotionImpact: async (actor, verticalSlug, channel, versionId) => {
                 const incoming = await readVersion(versionId);
@@ -7716,10 +8045,27 @@ export class SqliteScopeHost {
                     throw substratError('not_found', `unknown vertical '${verticalSlug}'`);
                 // #2178: every install on the serving script runs the new version from this moment.
                 this.assertNoStrandFrom([r.serving_version_id], parsed.versionId, r.serving_ref ? this.provisionedVersionsOf(verticalSlug, r.serving_version_id ? { ref: r.serving_ref, versionId: r.serving_version_id } : null, null) : []);
-                this.directoryWriteAndAudit(() => this.directory
-                    .prepare(`UPDATE verticals SET serving_ref = ?, serving_version_id = ?,
-                    serving_do_classes = ?, serving_migration_tag = ? WHERE slug = ?`)
-                    .run(parsed.ref, parsed.versionId, JSON.stringify(parsed.doClasses), parsed.migrationTag, verticalSlug).changes > 0, () => this.recordAdmin(actor, 'setVerticalServing', { tenantId: null }, r.serving_ref ? { ref: r.serving_ref, versionId: r.serving_version_id } : null, { vertical: verticalSlug, ref: parsed.ref, versionId: parsed.versionId }));
+                // #2528: a compare-and-set on the serving ref and version the gate judged
+                // (`SERVES_NOW_CONDITION`), and the row's `before` read in the transaction that moves it,
+                // as the Cloudflare host does.
+                let before = null;
+                let raced = false;
+                this.directoryWriteAndAudit(() => {
+                    const now = this.directory
+                        .prepare('SELECT serving_ref, serving_version_id FROM verticals WHERE slug = ?')
+                        .get(verticalSlug);
+                    if (!now)
+                        throw substratError('not_found', `unknown vertical '${verticalSlug}'`);
+                    before = now.serving_ref ? { ref: now.serving_ref, versionId: now.serving_version_id } : null;
+                    const moved = this.directory
+                        .prepare(`UPDATE verticals SET serving_ref = ?, serving_version_id = ?,
+                      serving_do_classes = ?, serving_migration_tag = ? WHERE ${SERVES_NOW_CONDITION}`)
+                        .run(parsed.ref, parsed.versionId, JSON.stringify(parsed.doClasses), parsed.migrationTag, verticalSlug, r.serving_ref ?? null, r.serving_version_id ?? null).changes > 0;
+                    raced = !moved;
+                    return moved;
+                }, () => this.recordAdmin(actor, 'setVerticalServing', { tenantId: null }, before, { vertical: verticalSlug, ref: parsed.ref, versionId: parsed.versionId }));
+                if (raced)
+                    throw servingRaceRefusal(verticalSlug);
             },
             versionManifest: async (actor, verticalSlug, versionId) => {
                 const v = this.directory
@@ -7741,10 +8087,9 @@ export class SqliteScopeHost {
             },
             recordWireAuth: async (actor, input) => {
                 const row = deploymentWireAuth.parse(input);
-                this.directoryWriteAndAudit(() => {
-                    writeDeploymentWireAuth(switchSqlOf(this.directory), row);
-                    return true;
-                }, () => this.recordAdmin(actor, 'recordWireAuth', { tenantId: null, vertical: row.verticalSlug }, null, { vertical: row.verticalSlug, deploymentRef: row.deploymentRef, versionId: row.versionId, record: row.record }));
+                const written = this.directoryWriteAndAudit(() => writeDeploymentWireAuth(switchSqlOf(this.directory), row), () => this.recordAdmin(actor, 'recordWireAuth', { tenantId: null, vertical: row.verticalSlug }, null, { vertical: row.verticalSlug, deploymentRef: row.deploymentRef, versionId: row.versionId, record: row.record }));
+                if (!written)
+                    throw substratError('not_found', `no capability record for '${row.deploymentRef}': vertical '${row.verticalSlug}' is not registered`);
             },
             listWireAuth: async (actor, input) => {
                 // The judged copy, not the caller's object: only its own fields, the reach first, reach the log.
@@ -7802,14 +8147,9 @@ export class SqliteScopeHost {
                 // operation's uncommitted event, the drain shipped it, and the rollback left the lake
                 // — which is append-only — holding an event the scope never had. The mark that
                 // follows needs no such care: it stamps only rows that exist and are undrained.
-                const db = this.scopeReadDbFor(tenantId, scopeId);
-                const page = db.prepare(`SELECT * FROM _substrat_outbox WHERE drained_at IS NULL AND ${emittedHere()} ORDER BY id LIMIT ? OFFSET ?`);
-                // The kernel's read, shared with the DO: the envelope and the columns lifted beside
-                // it (#1242, #1237) are decoded once, and a row that will not decode is stepped over
-                // rather than stalling the scope on it (#1636).
-                const read = readUndrainedOutbox((offset, count) => page.all(count, offset), Math.min(assertRowLimit('limit', limit ?? 200), 1000));
-                this.recordAccess(actor, 'readUndrainedEvents', { tenantId, scopeId }, { limit }, read.events.length);
-                return undrainedEventsOf(read);
+                const events = undrainedEventsFrom(this.scopeReadDbFor(tenantId, scopeId), limit ?? 200);
+                this.recordAccess(actor, 'readUndrainedEvents', { tenantId, scopeId }, { limit }, events.length);
+                return events;
             },
             markEventsDrained: async (actor, tenantId, scopeId, eventIds) => {
                 // BEFORE the empty-batch shortcut, not after. "Nothing to mark" and "you may
@@ -7938,10 +8278,7 @@ export class SqliteScopeHost {
                 // auditor asking "who counted this tenant's outbox, and how much was there" wants.
                 if (countOnly) {
                     // The committed count (#1624): a stranger's uncommitted drain mark is not a fact yet.
-                    const redrainable = this.scopeReadDbFor(tenantId, scopeId)
-                        .prepare(`SELECT COUNT(*) AS c FROM _substrat_outbox
-                  WHERE drained_at IS NOT NULL AND drained_at < ?`)
-                        .get(drainedBefore).c;
+                    const redrainable = redrainCountOf(this.scopeReadDbFor(tenantId, scopeId), drainedBefore);
                     this.recordAccess(actor, 'redrainEvents', { tenantId, scopeId }, { drainedBefore, countOnly: true }, redrainable);
                     return redrainable;
                 }
@@ -8046,18 +8383,9 @@ export class SqliteScopeHost {
             // Every row, newest first (#2553); `rowid DESC` orders migrations stamped in one millisecond.
             scopeAppliedMigrations: async (actor, tenantId, scopeId) => {
                 const db = this.scopeReadDbFor(tenantId, scopeId);
-                const rows = db
-                    .prepare(`SELECT module_id, version, applied_at, duration_ms, rows_changed FROM _substrat_migrations
-              ORDER BY applied_at DESC, rowid DESC`)
-                    .all();
-                this.recordAccess(actor, 'scopeAppliedMigrations', { tenantId, scopeId }, null, rows.length);
-                return rows.map((r) => ({
-                    moduleId: r.module_id,
-                    version: r.version,
-                    appliedAt: r.applied_at ?? null,
-                    durationMs: r.duration_ms,
-                    rowsChanged: r.rows_changed,
-                }));
+                const migrations = appliedMigrationsOf(db);
+                this.recordAccess(actor, 'scopeAppliedMigrations', { tenantId, scopeId }, null, migrations.length);
+                return migrations;
             },
             scopeMigrationBookmarks: async (actor, tenantId, scopeId) => {
                 const scope = this.directory
@@ -8093,21 +8421,24 @@ export class SqliteScopeHost {
             },
             createOrg: async (actor, input) => {
                 const parsed = createOrgInput.parse(input);
-                if (readOrg(parsed.tenantId, parsed.id))
-                    return; // idempotent, unaudited
-                // Checked explicitly rather than left to the UNIQUE index: OR IGNORE would
-                // swallow a collision from a DIFFERENT id and report success, silently not
-                // creating the org the caller asked for. Fail closed instead (as createTenant).
-                const slugOwner = this.directory
-                    .prepare('SELECT org_id FROM orgs WHERE tenant_id = ? AND slug = ?')
-                    .get(parsed.tenantId, parsed.slug);
-                if (slugOwner) {
-                    throw substratError('conflict', `org slug '${parsed.slug}' already taken by ${slugOwner.org_id} (slugs are unique per tenant)`);
-                }
-                this.directory
-                    .prepare('INSERT INTO orgs (org_id, tenant_id, slug, name, created_at) VALUES (?, ?, ?, ?, ?)')
-                    .run(parsed.id, parsed.tenantId, parsed.slug, parsed.name, new Date().toISOString());
-                this.recordAdmin(actor, 'createOrg', { tenantId: parsed.tenantId }, null, parsed);
+                // #2526: the checks, the insert and the row are one directory unit.
+                this.directoryWriteAndAudit(() => {
+                    if (readOrg(parsed.tenantId, parsed.id))
+                        return false; // idempotent, unaudited
+                    // Checked explicitly rather than left to the UNIQUE index: OR IGNORE would
+                    // swallow a collision from a DIFFERENT id and report success, silently not
+                    // creating the org the caller asked for. Fail closed instead (as createTenant).
+                    const slugOwner = this.directory
+                        .prepare('SELECT org_id FROM orgs WHERE tenant_id = ? AND slug = ?')
+                        .get(parsed.tenantId, parsed.slug);
+                    if (slugOwner) {
+                        throw substratError('conflict', `org slug '${parsed.slug}' already taken by ${slugOwner.org_id} (slugs are unique per tenant)`);
+                    }
+                    this.directory
+                        .prepare('INSERT INTO orgs (org_id, tenant_id, slug, name, created_at) VALUES (?, ?, ?, ?, ?)')
+                        .run(parsed.id, parsed.tenantId, parsed.slug, parsed.name, new Date().toISOString());
+                    return true;
+                }, () => this.recordAdmin(actor, 'createOrg', { tenantId: parsed.tenantId }, null, parsed));
             },
             listOrgs: async (actor, tenantId) => {
                 const rows = this.directory
@@ -8122,12 +8453,15 @@ export class SqliteScopeHost {
                 return o;
             },
             addMember: async (actor, tenantId, principal, orgId, opts) => {
-                requireOrg(tenantId, orgId);
                 // INSERT OR REPLACE, so re-adding a revoked member clears the tombstone —
                 // they are a member again. The add/revoke history is not lost: it lives in
                 // the append-only admin log, which is where "what happened" belongs. The
                 // tuple carries "what is true now" plus enough to explain a live proof.
-                joinOrg(actor, tenantId, principal, orgId, opts?.expiresAt ?? null);
+                // #2526: the org's check, the tuple and the row are one directory unit.
+                this.directory.transaction(() => {
+                    requireOrg(tenantId, orgId);
+                    joinOrg(actor, tenantId, principal, orgId, opts?.expiresAt ?? null);
+                })();
             },
             applyMembership: async (actor, change) => {
                 // ONE directory transaction, synchronous throughout (#1184): the fence (an add's), the
@@ -8210,8 +8544,10 @@ export class SqliteScopeHost {
                 const slugOwner = this.directory
                     .prepare('SELECT tenant_id FROM tenants WHERE slug = ?')
                     .get(parsed.slug);
+                // #2556: the refusal never names the owner. Another tenant holds it, and the text
+                // reaches whoever asked (a manager vertical's intent journal among them).
                 if (slugOwner) {
-                    throw substratError('conflict', `tenant slug '${parsed.slug}' already taken by ${slugOwner.tenant_id} (slugs are unique)`);
+                    throw substratError('conflict', `tenant slug '${parsed.slug}' is already taken (slugs are unique)`);
                 }
                 this.directoryWriteAndAudit(() => this.directory
                     .prepare(`INSERT INTO tenants (tenant_id, slug, name, status, created_at, provisioned_by_tenant)
@@ -8219,8 +8555,7 @@ export class SqliteScopeHost {
                     .run(parsed.id, parsed.slug, parsed.name, new Date().toISOString(), parsed.provisionedByTenant ?? null).changes > 0, () => this.recordAdmin(actor, 'createTenant', { tenantId: parsed.id }, null, readTenant(parsed.id)));
             },
             setTenantStatus: async (actor, tenantId, status) => {
-                const before = readTenant(tenantId);
-                if (!before)
+                if (!readTenant(tenantId))
                     throw substratError('not_found', `unknown tenant: ${tenantId}`);
                 // `reaped` is terminal and destroys data — it is unreachable here and only
                 // ever set by reapTenant, so a plain status flip cannot forge a tombstone
@@ -8230,22 +8565,33 @@ export class SqliteScopeHost {
                 }
                 // Stamp/clear deleting_at so the grace-window sweep can age tenants (§4.8):
                 // entering `deleting` stamps, leaving it (an un-delete) clears — exactly the
-                // shape suspendScope/archiveScope use for archived_at.
-                this.directoryWriteAndAudit(() => (status === 'deleting'
-                    ? this.directory
-                        .prepare('UPDATE tenants SET status = ?, deleting_at = ? WHERE tenant_id = ?')
-                        .run(status, new Date().toISOString(), tenantId)
-                    : this.directory
-                        .prepare('UPDATE tenants SET status = ?, deleting_at = NULL WHERE tenant_id = ?')
-                        .run(status, tenantId)).changes > 0, () => this.recordAdmin(actor, 'setTenantStatus', { tenantId }, { status: before.status }, { status }));
+                // shape suspendScope/archiveScope use for archived_at. #2528: the row's `before` is the
+                // status the write's own transaction reads.
+                let before;
+                this.directoryWriteAndAudit(() => {
+                    before = readTenant(tenantId);
+                    if (!before)
+                        throw substratError('not_found', `unknown tenant: ${tenantId}`);
+                    return (status === 'deleting'
+                        ? this.directory
+                            .prepare('UPDATE tenants SET status = ?, deleting_at = ? WHERE tenant_id = ?')
+                            .run(status, new Date().toISOString(), tenantId)
+                        : this.directory
+                            .prepare('UPDATE tenants SET status = ?, deleting_at = NULL WHERE tenant_id = ?')
+                            .run(status, tenantId)).changes > 0;
+                }, () => this.recordAdmin(actor, 'setTenantStatus', { tenantId }, { status: before.status }, { status }));
             },
             setTenantName: async (actor, tenantId, name) => {
-                const before = readTenant(tenantId);
-                if (!before)
-                    throw substratError('not_found', `unknown tenant: ${tenantId}`);
-                if (before.name === name)
-                    return; // no-op is not audited — nothing changed
-                this.directoryWriteAndAudit(() => this.directory.prepare('UPDATE tenants SET name = ? WHERE tenant_id = ?').run(name, tenantId).changes > 0, () => this.recordAdmin(actor, 'setTenantName', { tenantId }, { name: before.name }, { name }));
+                // A no-op rename is not audited — nothing changed. #2528: judged, and `before` read, in the
+                // write's own transaction.
+                let before;
+                this.directoryWriteAndAudit(() => {
+                    before = readTenant(tenantId);
+                    if (!before)
+                        throw substratError('not_found', `unknown tenant: ${tenantId}`);
+                    return before.name !== name
+                        && this.directory.prepare('UPDATE tenants SET name = ? WHERE tenant_id = ?').run(name, tenantId).changes > 0;
+                }, () => this.recordAdmin(actor, 'setTenantName', { tenantId }, { name: before.name }, { name }));
             },
             listTenants: async (actor, page) => {
                 const where = [];
@@ -8392,6 +8738,9 @@ export class SqliteScopeHost {
             recordStoreDriverRebuildRun: async (actor, entry) => {
                 this.recordAdmin(actor, 'rebuildStoreDriver', { tenantId: null }, null, entry, this.clock());
             },
+            recordWireWalk: async (actor, entry) => {
+                this.recordAdmin(actor, 'walkWireAuth', { tenantId: null }, null, entry, this.clock());
+            },
             getScopeRecord: async (actor, tenantId, scopeId) => {
                 const r = this.directory.prepare('SELECT * FROM scopes WHERE scope_id = ?').get(scopeId);
                 // Cross-check the pair (K-3): a scope that exists under a DIFFERENT tenant
@@ -8406,65 +8755,26 @@ export class SqliteScopeHost {
                 // K-3: the (tenantId, scopeId) pair is cross-checked before we open anything;
                 // a scope under a different tenant is unreachable, never another tenant's DB.
                 const db = this.scopeReadDbFor(tenantId, scopeId);
-                const names = db
-                    .prepare(`SELECT name FROM sqlite_master WHERE type = 'table' ORDER BY name`)
-                    .all().map((r) => r.name);
-                const tables = names.map((name) => ({
-                    name,
-                    rowCount: db.prepare(`SELECT COUNT(*) AS c FROM "${name}"`).get().c,
-                    system: isSystemTable(name),
-                }));
+                const tables = scopeTablesOf(db);
                 this.recordAccess(actor, 'listScopeTables', { tenantId, scopeId }, null, tables.length);
                 return tables;
             },
             readScopeTable: async (actor, tenantId, scopeId, input) => {
                 const db = this.scopeReadDbFor(tenantId, scopeId);
-                // Validate the table against the LIVE schema — an unknown name throws, it is
-                // never interpolated blind. That validated name is the only thing that reaches
-                // the query, so the quoted identifier below carries no user input.
-                const known = new Set(db.prepare(`SELECT name FROM sqlite_master WHERE type = 'table'`).all().map((r) => r.name));
-                if (!known.has(input.table))
-                    throw substratError('not_found', `unknown table '${input.table}'`);
-                // The ceiling clamps; a bound SQLite would misread (NaN, non-finite, fractional,
-                // negative) is refused instead of reaching LIMIT / OFFSET (#1632).
-                const limit = Math.min(assertRowLimit('limit', input.limit ?? SCOPE_TABLE_PAGE_DEFAULT), SCOPE_TABLE_PAGE_MAX);
-                const offset = assertRowOffset('offset', input.offset ?? 0);
-                const stmt = db.prepare(`SELECT * FROM "${input.table}" LIMIT ? OFFSET ?`).raw(true);
-                const rows = stmt.all(limit, offset).map((row) => row.map(cellToJson));
-                const columns = stmt.columns().map((c) => c.name);
-                const rowCount = db.prepare(`SELECT COUNT(*) AS c FROM "${input.table}"`).get().c;
-                this.recordAccess(actor, 'readScopeTable', { tenantId, scopeId }, { table: input.table, limit, offset }, rows.length);
-                return { table: input.table, columns, rows, rowCount, limit, offset };
+                const page = scopeTablePageOf(db, input);
+                this.recordAccess(actor, 'readScopeTable', { tenantId, scopeId }, { table: input.table, limit: page.limit, offset: page.offset }, page.rows.length);
+                return page;
             },
             queryScope: async (actor, tenantId, scopeId, input) => {
                 const db = this.scopeReadDbFor(tenantId, scopeId);
-                // Layer 1, shared: the kernel's textual gate (single statement, read verbs
-                // only) — the checked statement is the one that runs.
-                const sql = assertReadOnlyQuery(input.sql);
-                // Layer 2, authoritative: sqlite3_stmt_readonly via better-sqlite3. prepare()
-                // itself rejects multi-statement strings and bad SQL with the driver's message.
-                const stmt = db.prepare(sql);
-                if (!stmt.readonly)
-                    throw substratError('validation_failed', 'read-only console: statement is not read-only');
-                if (!stmt.reader)
-                    return { columns: [], rows: [], truncated: false };
-                stmt.raw(true);
-                const rows = [];
-                let truncated = false;
-                // Iterate rather than .all(): the row cap bounds what leaves the DB, so an
-                // over-broad SELECT costs a screenful, not the table.
-                for (const row of stmt.iterate()) {
-                    if (rows.length >= SCOPE_QUERY_ROW_MAX) {
-                        truncated = true;
-                        break;
-                    }
-                    rows.push(row.map(cellToJson));
-                }
-                const columns = stmt.columns().map((c) => c.name);
+                const { sql, reader, result } = scopeQueryOf(db, input);
+                // A statement that reads nothing returns before any row is recorded, as it always has.
+                if (!reader)
+                    return result;
                 // The statement itself is the logged argument — the K-24 access log is the
                 // evidence trail for what staff read, and here the read IS the SQL.
-                this.recordAccess(actor, 'queryScope', { tenantId, scopeId }, { sql }, rows.length);
-                return { columns, rows, truncated };
+                this.recordAccess(actor, 'queryScope', { tenantId, scopeId }, { sql }, result.rows.length);
+                return result;
             },
             // -- the denial log (K-35, #867) -------------------------------------
             // Same shape as the introspection reads above: `scopeDbFor` is the K-3
@@ -8886,13 +9196,9 @@ export class SqliteScopeHost {
                 // caller (the reap route / grace-window sweep) has already reaped every scope's
                 // storage above the kernel; this clears the tenant's directory-side PII/config
                 // and flips the row to a `reaped` tombstone. Only a `deleting` tenant may be
-                // reaped — an illegal source fails closed, like reapScope's archived-only gate.
-                const before = readTenant(tenantId);
-                if (!before)
-                    throw substratError('not_found', `unknown tenant: ${tenantId}`);
-                if (before.status !== 'deleting') {
-                    throw substratError('conflict', `tenant ${tenantId} is ${before.status}, not deleting — only a deleting tenant may be reaped`);
-                }
+                // reaped — an illegal source fails closed, like reapScope's archived-only gate. #2528: that
+                // gate and the row's `before` are read in the transaction that reaps.
+                let before;
                 // Clear the tenant's directory-side rows. Idempotent (set-to-empty), so a crash
                 // mid-reap converges on retry. KEPT as the tombstone: the `tenants` row itself
                 // and `_substrat_admin_log` (the compliance witness — never swept). Scope rows
@@ -8917,6 +9223,12 @@ export class SqliteScopeHost {
                     '_substrat_scope_attachment_storage', // #2501: attachment samples, gone with the tenant
                 ];
                 this.directoryWriteAndAudit(() => {
+                    before = readTenant(tenantId);
+                    if (!before)
+                        throw substratError('not_found', `unknown tenant: ${tenantId}`);
+                    if (before.status !== 'deleting') {
+                        throw substratError('conflict', `tenant ${tenantId} is ${before.status}, not deleting — only a deleting tenant may be reaped`);
+                    }
                     for (const table of tables) {
                         this.directory.prepare(`DELETE FROM ${table} WHERE tenant_id = ?`).run(tenantId);
                     }