@substrat-run/contract-tests 0.114.0 → 0.117.0

package/dist/scope-host-suite.js

@@ -1,8 +1,35 @@
 import { describe, it, expect, beforeAll, afterAll } from 'vitest';
 import { connectorCalls, connectorTestFetch, resetConnectorCalls } from './connector-fixture.js';
-import { connectionId, dataSubjectId, eventId, instant, moduleManifest, orgId, AUTO_ADMISSION_NOTE, permissionKey, platformActorId, principalId, scopeId, tenantId, SCOPE_QUERY_ROW_MAX, } from '@substrat-run/contracts';
-import { isSearchIndexTable, runPlatformSweep, ulid, } from '@substrat-run/kernel';
+import { connectionId, dataSubjectId, domainEvent, errorCodeOf, eventId, instant, moduleManifest, orgId, AUTO_ADMISSION_NOTE, permissionKey, platformActorId, platformRequestId, principalId, scopeId, tenantId, SCOPE_QUERY_ROW_MAX, } from '@substrat-run/contracts';
+import { isSearchIndexTable, REDACTED_INTENT_MARKER, runPlatformSweep, ulid, } from '@substrat-run/kernel';
 import { billedMod, contractTestBareOps, contractTestInitialModules, gateModManifest, lateMod, testModManifest, victimModManifest, } from './modules.js';
+/**
+ * Assert a refusal by the CODE it declared, not by the sentence it happens to carry
+ * (#113 phase 5).
+ *
+ * `errorCodeOf` is the same reading the control plane's `mapError` does, so what this
+ * pins and the problem document a transport renders agree by construction. A `/message/`
+ * match agreed with it only by coincidence — and that coincidence was load-bearing:
+ * `CODE_PATTERNS` in `packages/control-plane-api/src/errors.ts` guessed the code by
+ * regex, so rewording a throw silently changed a 404 into a 500, and the suite's own
+ * message assertion was the only thing standing in the way. Moving the assertion here
+ * makes the message free to change and the TYPE the thing that cannot.
+ *
+ * A promise that RESOLVES fails this too: `errorCodeOf(undefined)` is `undefined`, which
+ * is never a code — so it cannot pass by not throwing at all.
+ *
+ * `message` is for the minority of refusals where the sentence carries something the code
+ * cannot: WHICH branch fired, when two branches share one code. `deleteVertical` refuses a
+ * live scope with "delete or rebind" and an archived one with "reap or restore" — both
+ * `conflict`, and an adapter that answered the wrong one would send an operator to a button
+ * that is not there. Pass it only for that; a code is the contract everywhere else.
+ */
+const expectRefusal = async (p, code, message) => {
+    const err = await p.then(() => undefined, (e) => e);
+    expect(errorCodeOf(err)).toBe(code);
+    if (message !== undefined)
+        expect(err?.message).toMatch(message);
+};
 /**
  * The scope-host contract suite (design doc §11). Every adapter — pure SQLite,
  * Cloudflare, and any future one — must pass this unchanged (D-14). If an
@@ -349,6 +376,574 @@ export function scopeHostContractSuite(adapterName, makeFixture, opts = {}) {
             expect(settled.lastError).toMatch(/personal number field/);
             expect(settled.payload).toEqual({ contract: 'c1' });
         });
+        /**
+         * #1588. Every read of the intent journal returns a LIST, and the row decode behind all
+         * three was strict — so ONE row whose JSON would not parse threw out of the map and took
+         * the scope's every other intent with it. The drain could not read its own queue, and the
+         * history read, which exists so a failed intent explains itself (#618), was switched off
+         * by exactly the row that failed.
+         *
+         * Nothing module code can do produces such a row (`ctx.sql` refuses `_substrat_*` writes,
+         * #954). A restore does: `importDump` replays rows verbatim, so a dump from another world
+         * or edited by hand is the whole reproduction — the lever #1587's run-driver test uses.
+         * The dump is the scope's OWN export with only the journal's rows replaced, so the rest of
+         * the spine comes back as it was and the in-scope read can still be invoked.
+         */
+        describe('one undecodable intent row (#1588)', () => {
+            /** Sorts before every ULID, so the pending read (ORDER BY id) meets it FIRST. */
+            const brokenPendingId = platformRequestId.parse('00000000000000000000000000');
+            const brokenSettledId = platformRequestId.parse('00000000000000000000000001');
+            const at = '2026-09-01T00:00:00.000Z';
+            const healthyPending = {
+                id: ulid(),
+                kind: 'connector:test',
+                payload: JSON.stringify({ doc: 1 }),
+                requested_by: JSON.stringify({ system: 'connector-dispatch' }),
+                status: 'pending',
+                attempts: 0,
+                requested_at: at,
+            };
+            const healthySettled = {
+                id: ulid(),
+                kind: 'connector:test',
+                payload: JSON.stringify({ doc: 2 }),
+                requested_by: JSON.stringify(alice),
+                status: 'failed',
+                attempts: 1,
+                last_error: 'HTTP 409 requires valid personal number field',
+                last_failure: JSON.stringify({ origin: 'provider', code: null, permission: null }),
+                result: JSON.stringify({ eventId: 'E1' }),
+                requested_at: at,
+                settled_at: at,
+            };
+            /** The queue's bad row: a payload nothing could act on. */
+            const brokenPending = { ...healthyPending, id: brokenPendingId, payload: 'not json at all' };
+            /** The journal's bad row: the failure is on record, beside two columns that are not. */
+            const brokenSettled = {
+                ...healthySettled,
+                id: brokenSettledId,
+                last_error: 'HTTP 422 the evidence an operator came here to read',
+                last_failure: 'nope',
+                result: '{"eventId":',
+            };
+            /** A fresh scope whose journal holds exactly `rows`, planted by a restore. */
+            const restoredWith = async (rows) => {
+                const s = scopeId.parse(ulid());
+                await host.provisionScope(staff, {
+                    tenantId: t1,
+                    scopeId: s,
+                    jurisdiction: 'eu',
+                    vertical: 'connector-vertical',
+                });
+                await host.admin.activateScope(staff, t1, s);
+                const backup = await host.admin.exportScope(staff, t1, s);
+                const journal = backup.tables.find((t) => t.name === '_substrat_platform_requests');
+                // Without the table in the export this test would plant nothing and pass vacuously.
+                expect(journal).toBeDefined();
+                await host.restoreScope(staff, t1, s, {
+                    ...backup,
+                    tables: backup.tables.map((t) => t === journal ? { ...t, rows: rows.map((r) => t.columns.map((c) => r[c] ?? null)) } : t),
+                });
+                return s;
+            };
+            /** All three reads, so each of the three decode sites is on the hook. */
+            const readAll = async (s) => ({
+                pending: await host.listPlatformRequests(t1, s),
+                history: await host.listPlatformRequestHistory(t1, s),
+                inScope: await (await host.getScope(alice, t1, s)).invoke('platform/intents'),
+            });
+            const byId = (rows, id) => rows.find((r) => r.id === id);
+            it('a clean journal reads exactly as before — no decodeError anywhere (the positive twin)', async () => {
+                const s = await restoredWith([healthyPending, healthySettled]);
+                const { pending, history, inScope } = await readAll(s);
+                expect(pending.map((r) => r.id)).toEqual([healthyPending.id]);
+                expect(history.map((r) => r.id).sort()).toEqual([healthyPending.id, healthySettled.id].sort());
+                expect(inScope.map((r) => r.id).sort()).toEqual([healthyPending.id, healthySettled.id].sort());
+                for (const row of [...pending, ...history, ...inScope]) {
+                    // ABSENT rather than null, so a healthy list is the shape it always was.
+                    expect(row).not.toHaveProperty('decodeError');
+                }
+                expect(byId(history, healthySettled.id)).toMatchObject({
+                    payload: { doc: 2 },
+                    requestedBy: alice,
+                    failure: { origin: 'provider', code: null, permission: null },
+                    result: { eventId: 'E1' },
+                });
+            });
+            it('returns every other row beside the bad one, and the bad one says why', async () => {
+                const clean = await readAll(await restoredWith([healthyPending, healthySettled]));
+                const s = await restoredWith([brokenPending, healthyPending, brokenSettled, healthySettled]);
+                const { pending, history, inScope } = await readAll(s);
+                // The healthy rows are all there, and read EXACTLY as they do with no bad neighbour.
+                expect(byId(pending, healthyPending.id)).toEqual(byId(clean.pending, healthyPending.id));
+                for (const [read, twin] of [
+                    [history, clean.history],
+                    [inScope, clean.inScope],
+                ]) {
+                    expect(read).toHaveLength(4);
+                    expect(byId(read, healthyPending.id)).toEqual(byId(twin, healthyPending.id));
+                    expect(byId(read, healthySettled.id)).toEqual(byId(twin, healthySettled.id));
+                }
+                // The drain's queue: the bad row is listed — it was listed first — and flagged, with
+                // an EMPTY payload rather than the raw text, which would read as a string payload.
+                expect(pending.map((r) => r.id)).toEqual([brokenPendingId, healthyPending.id]);
+                const queued = byId(pending, brokenPendingId);
+                expect(queued.decodeError).toMatch(/^payload: .*JSON/);
+                expect(queued.payload).toBeNull();
+                expect(queued.kind).toBe('connector:test');
+                // The journal: the failure the row records is READABLE, which is the whole point of
+                // the read — and every column that did not decode is named, not only the first.
+                for (const read of [history, inScope]) {
+                    const settled = byId(read, brokenSettledId);
+                    expect(settled.lastError).toBe('HTTP 422 the evidence an operator came here to read');
+                    expect(settled.status).toBe('failed');
+                    expect(settled.decodeError).toMatch(/^last_failure: .*; result: /);
+                    // `null` beside a reason, never a silent `null` that reads as "unclassified".
+                    expect(settled.failure).toBeNull();
+                    expect(settled.result).toBeNull();
+                }
+            });
+            it('lets the drain settle the bad row failed — out of the queue, the evidence kept', async () => {
+                // The drain lives in control-plane-api and refuses any row carrying `decodeError`
+                // without running a handler (tested there, against this adapter's pure twin). What
+                // BOTH adapters owe it is that the refusal lands: a bad row can be settled like any
+                // other, leaves the queue, and still reads back with its reason.
+                const s = await restoredWith([brokenPending, healthyPending]);
+                const refusal = 'not executed: the intent row could not be decoded (payload: …)';
+                await host.settlePlatformRequest(t1, s, brokenPendingId, {
+                    status: 'failed',
+                    lastError: refusal,
+                    failure: { origin: 'platform', code: 'validation_failed', permission: null },
+                });
+                expect((await host.listPlatformRequests(t1, s)).map((r) => r.id)).toEqual([healthyPending.id]);
+                const after = byId(await host.listPlatformRequestHistory(t1, s), brokenPendingId);
+                expect(after.status).toBe('failed');
+                expect(after.lastError).toBe(refusal);
+                expect(after.failure).toEqual({ origin: 'platform', code: 'validation_failed', permission: null });
+                // The stored payload is untouched by the settle, so the row still says it is not whole.
+                expect(after.decodeError).toMatch(/^payload: /);
+            });
+        });
+        /**
+         * #1636 — #1588's shape everywhere else it lived. One outbox or denial row whose JSON
+         * would not parse still took a WHOLE list with it: an entity's history and its walks,
+         * the denial log and its summary — and, worse, the outbox's executed paths, where the
+         * decode sat above each loop's per-event containment, so one bad event halted every
+         * event behind it on every pass.
+         *
+         * Planted the #1588 way: a fresh scope's OWN export, restored with one table's rows
+         * rewritten, because `importDump` replays rows verbatim and nothing else can write a
+         * spine row that module code did not (#954). The bad row's id sorts before every ULID,
+         * so each read and each loop meets it FIRST — the position that used to halt it.
+         */
+        describe('one undecodable spine row (#1636)', () => {
+            /** Sorts before every ULID; `n` keeps several of them distinct and in order. */
+            const badId = (n = 0) => `0000000000000000000000${String(n).padStart(4, '0')}`;
+            const UNDECODED = { system: 'undecodable' };
+            /** A fresh scope, seeded through real operations, and its export. */
+            const seeded = async (vertical, seed) => {
+                const s = scopeId.parse(ulid());
+                await host.provisionScope(staff, { tenantId: t1, scopeId: s, jurisdiction: 'eu', vertical });
+                await host.admin.activateScope(staff, t1, s);
+                await seed(await host.getScope(alice, t1, s));
+                return { s, dump: await host.admin.exportScope(staff, t1, s) };
+            };
+            const rowsOf = (dump, table) => {
+                const t = dump.tables.find((x) => x.name === table);
+                // Without the table in the export these tests would plant nothing and pass vacuously.
+                expect(t).toBeDefined();
+                return t.rows.map((r) => Object.fromEntries(t.columns.map((c, i) => [c, r[i]])));
+            };
+            /** Restore `s` from `dump` with each named table's rows replaced by `replace[table]`. */
+            const restore = async (s, dump, replace) => {
+                for (const name of Object.keys(replace))
+                    expect(dump.tables.some((t) => t.name === name)).toBe(true);
+                await host.restoreScope(staff, t1, s, {
+                    ...dump,
+                    tables: dump.tables.map((t) => t.name in replace ? { ...t, rows: replace[t.name].map((r) => t.columns.map((c) => r[c] ?? null)) } : t),
+                });
+            };
+            describe('pure reads: the bad row comes back beside its neighbours, saying why', () => {
+                it('history, timeline, both walks and an invocation read (the outbox)', async () => {
+                    const call = ulid();
+                    const { s, dump } = await seeded('connector-vertical', async (stub) => {
+                        for (let i = 0; i < 3; i++)
+                            await stub.invoke('test/emit-event');
+                    });
+                    // One call's worth, so `invocationEvents` has something to read.
+                    const outbox = rowsOf(dump, '_substrat_outbox').map((r) => r.type === 'test.happened' ? { ...r, invocation_id: call } : r);
+                    const target = outbox.filter((r) => r.type === 'test.happened')[1];
+                    const targetId = eventId.parse(target.id);
+                    const readAll = async () => ({
+                        history: (await host.admin.entityHistory(staff, t1, s, { entityType: 'test-thing', entityId: 'x1' })).entries,
+                        timeline: (await (await host.getScope(alice, t1, s)).invoke('test/timeline', {
+                            entityType: 'test-thing',
+                            entityId: 'x1',
+                        })).entries,
+                        cause: await host.admin.eventCause(staff, t1, s, { eventId: targetId }),
+                        effects: await host.admin.eventEffects(staff, t1, s, { eventId: targetId }),
+                        call: (await host.admin.invocationEvents(staff, t1, s, { invocationId: call })).events,
+                    });
+                    // The positive twin: the scope's own rows, untouched — nothing says it is not whole.
+                    await restore(s, dump, { _substrat_outbox: outbox });
+                    const clean = await readAll();
+                    expect(clean.history).toHaveLength(3);
+                    for (const entry of [...clean.history, ...clean.timeline, ...clean.cause.chain, ...clean.call]) {
+                        expect(entry).not.toHaveProperty('decodeError');
+                    }
+                    expect(clean.effects.root.event).not.toHaveProperty('decodeError');
+                    // The same scope with ONE row's actor and payload unreadable.
+                    await restore(s, dump, {
+                        _substrat_outbox: outbox.map((r) => (r.id === target.id ? { ...r, actor: '{', payload: 'not json at all' } : r)),
+                    });
+                    const planted = await readAll();
+                    const reason = 'actor: not valid JSON; payload: not valid JSON';
+                    // Every row comes back, and every healthy one reads EXACTLY as with no bad neighbour.
+                    expect(planted.history.map((e) => e.id)).toEqual(clean.history.map((e) => e.id));
+                    planted.history.forEach((entry, i) => {
+                        if (entry.id === target.id)
+                            return;
+                        expect(entry).toEqual(clean.history[i]);
+                    });
+                    const bad = planted.history.find((e) => e.id === target.id);
+                    expect(bad.decodeError).toBe(reason);
+                    expect(bad.actor).toEqual(UNDECODED);
+                    // Null beside a reason — the one thing that keeps it from reading as an erasure.
+                    expect(bad.payload).toBeNull();
+                    expect(bad.type).toBe('test.happened');
+                    expect(planted.timeline).toHaveLength(3);
+                    expect(planted.timeline.find((e) => e.id === target.id)).toMatchObject({
+                        actor: UNDECODED,
+                        decodeError: 'actor: not valid JSON',
+                    });
+                    // The walks read it rather than ending in an exception, and end where they did.
+                    expect(planted.cause.chain[0]).toMatchObject({ id: target.id, decodeError: reason });
+                    expect(planted.cause.terminal).toBe(clean.cause.terminal);
+                    expect(planted.effects.root.event.decodeError).toBe(reason);
+                    expect(planted.call.map((e) => e.id)).toEqual(clean.call.map((e) => e.id));
+                    expect(planted.call.find((e) => e.id === target.id).decodeError).toBe(reason);
+                });
+                it('the denial log and its summary', async () => {
+                    const at = '2026-09-01T00:00:00.000Z';
+                    const { s, dump } = await seeded('connector-vertical', async () => undefined);
+                    const denial = (id, over = {}) => ({
+                        id,
+                        actor: JSON.stringify(alice),
+                        permission: 'test:read',
+                        tenant_id: t1,
+                        scope_id: s,
+                        operation: 'test/read',
+                        impersonation: null,
+                        invocation_id: null,
+                        at,
+                        drained_at: null,
+                        ...over,
+                    });
+                    const healthy = [
+                        denial(ulid()),
+                        denial(ulid(), { actor: JSON.stringify({ system: '@test/flow' }), permission: 'test:write' }),
+                    ];
+                    const readAll = async () => ({
+                        rows: await host.admin.listDenials(staff, t1, s),
+                        summary: await host.admin.summarizeDenials(staff, t1, s),
+                    });
+                    await restore(s, dump, { _substrat_denials: healthy });
+                    const clean = await readAll();
+                    expect(clean.rows).toHaveLength(2);
+                    for (const row of clean.rows)
+                        expect(row).not.toHaveProperty('decodeError');
+                    for (const bucket of clean.summary.buckets)
+                        expect(bucket).not.toHaveProperty('decodeError');
+                    const bad = denial(badId(), { actor: '{', impersonation: 'nope' });
+                    // A key a module CAST rather than declared — reachable from live code, since nothing
+                    // validates a checked key at runtime. The key is the evidence, so it is kept.
+                    const badKey = denial(ulid(), { permission: 'Workorder:Read' });
+                    await restore(s, dump, { _substrat_denials: [bad, badKey, ...healthy] });
+                    const planted = await readAll();
+                    expect(planted.rows).toHaveLength(4);
+                    for (const row of clean.rows)
+                        expect(planted.rows.find((r) => r.id === row.id)).toEqual(row);
+                    const refused = planted.rows.find((r) => r.id === bad.id);
+                    expect(refused.decodeError).toBe('actor: not valid JSON; impersonation: not valid JSON');
+                    expect(refused.actor).toEqual(UNDECODED);
+                    // Null beside a reason, never a silent null that reads as "nobody was impersonating".
+                    expect(refused.impersonation).toBeNull();
+                    expect(refused.permission).toBe('test:read');
+                    // The malformed key is listed under the marker, the stored key quoted verbatim.
+                    const castKey = planted.rows.find((r) => r.id === badKey.id);
+                    expect(castKey.permission).toBe('undecodable:permission');
+                    expect(castKey.decodeError).toMatch(/^permission: .* \(stored "Workorder:Read"\)$/);
+                    expect(castKey.actor).toBe(alice);
+                    // The summary — "the read a console opens first" — keeps both buckets, counted.
+                    expect(planted.summary.total).toBe(4);
+                    expect(planted.summary.groupBy).toBe('actor-permission');
+                    const buckets = planted.summary.groupBy === 'actor-permission' ? planted.summary.buckets : [];
+                    expect(buckets).toHaveLength(4);
+                    expect(buckets.find((b) => b.decodeError === 'actor: not valid JSON')).toMatchObject({
+                        actor: UNDECODED,
+                        permission: 'test:read',
+                        count: 1,
+                    });
+                    expect(buckets.find((b) => b.permission === 'undecodable:permission')).toMatchObject({
+                        actor: alice,
+                        count: 1,
+                        decodeError: expect.stringContaining('(stored "Workorder:Read")'),
+                    });
+                    for (const bucket of clean.summary.buckets)
+                        expect(planted.summary.buckets).toContainEqual(bucket);
+                });
+            });
+            describe('the three mappers #1641 left casting (#1643): decoded, or thrown naming the column', () => {
+                const at = '2026-09-01T00:00:00.000Z';
+                it('dead letters and deliveries: a healthy row reads whole; a broken `attempts` is refused, never typed as valid', async () => {
+                    const { s, dump } = await seeded('connector-vertical', async (stub) => {
+                        for (let i = 0; i < 2; i++)
+                            await stub.invoke('test/emit-event');
+                    });
+                    const [first, second] = rowsOf(dump, '_substrat_outbox').filter((r) => r.type === 'test.happened');
+                    const delivery = (event, over = {}) => ({
+                        event_id: event.id,
+                        consumer_module: '@test/doomed',
+                        delivered_at: at,
+                        error: 'gave up',
+                        attempts: 3,
+                        next_attempt_at: null,
+                        invocation_id: null,
+                        ...over,
+                    });
+                    const readAll = async (event) => ({
+                        letters: (await host.admin.deadLetters(staff, t1, s, {})).entries,
+                        effects: (await host.admin.eventEffects(staff, t1, s, { eventId: eventId.parse(event.id) })).root.deliveries,
+                    });
+                    // The positive twin: two dead letters, one of them an EXECUTOR's — whose id is not a
+                    // module id, and which a decode against a bare `moduleId` would have refused.
+                    await restore(s, dump, {
+                        _substrat_deliveries: [delivery(first), delivery(second, { consumer_module: 'executor:mailer' })],
+                    });
+                    const clean = await readAll(second);
+                    expect(clean.letters).toHaveLength(2);
+                    expect(clean.letters.map((l) => l.consumer).sort()).toEqual(['@test/doomed', 'executor:mailer']);
+                    for (const l of clean.letters)
+                        expect(l).not.toHaveProperty('decodeError');
+                    expect(clean.effects).toMatchObject([{ consumer: 'executor:mailer', state: 'dead', attempts: 3 }]);
+                    expect(clean.effects[0]).not.toHaveProperty('decodeError');
+                    // The same rows with one `attempts` that cannot be decoded as a non-negative integer (a
+                    // negative number, or text). It has no honest empty value, so the read names the column —
+                    // on both reads, on both adapters.
+                    for (const attempts of [-1, 'many']) {
+                        await restore(s, dump, { _substrat_deliveries: [delivery(first), delivery(second, { attempts })] });
+                        await expect(host.admin.deadLetters(staff, t1, s, {})).rejects.toThrow(/DeadLetter — attempts: /);
+                        await expect(host.admin.eventEffects(staff, t1, s, { eventId: eventId.parse(second.id) })).rejects.toThrow(/valid EventDelivery — attempts: /);
+                    }
+                    // …and the row that is fine is still fine once the bad one is repaired.
+                    await restore(s, dump, { _substrat_deliveries: [delivery(first), delivery(second, { attempts: 2 })] });
+                    expect((await readAll(second)).letters.map((l) => l.attempts).sort()).toEqual([2, 3]);
+                });
+                it('an executor delivery is read whatever id registration let through — the reader matches the writer', async () => {
+                    // `registerExecutor` accepts any string and both adapters persist `executor:${id}`, so the
+                    // kernel can itself write an empty id or one with a newline. Refusing those would throw
+                    // the whole page on a delivery the kernel wrote.
+                    const { s, dump } = await seeded('connector-vertical', (stub) => stub.invoke('test/emit-event'));
+                    const [event] = rowsOf(dump, '_substrat_outbox').filter((r) => r.type === 'test.happened');
+                    const consumers = ['executor:mailer', 'executor:', 'executor:line\nbreak', 'executor:a b/ç'];
+                    await restore(s, dump, {
+                        _substrat_deliveries: consumers.map((consumer_module) => ({
+                            event_id: event.id,
+                            consumer_module,
+                            delivered_at: at,
+                            error: 'gave up',
+                            attempts: 3,
+                            next_attempt_at: null,
+                            invocation_id: null,
+                        })),
+                    });
+                    const letters = (await host.admin.deadLetters(staff, t1, s, {})).entries;
+                    expect(letters.map((l) => l.consumer).sort()).toEqual([...consumers].sort());
+                    const effects = (await host.admin.eventEffects(staff, t1, s, { eventId: eventId.parse(event.id) })).root.deliveries;
+                    expect(effects.map((d) => d.consumer).sort()).toEqual([...consumers].sort());
+                    for (const row of [...letters, ...effects])
+                        expect(row).not.toHaveProperty('decodeError');
+                });
+                it('the operation summary: healthy buckets read whole; a broken time is refused naming its column', async () => {
+                    const { s, dump } = await seeded('connector-vertical', async () => undefined);
+                    const denial = (over = {}) => ({
+                        id: ulid(),
+                        actor: JSON.stringify(alice),
+                        permission: 'test:read',
+                        tenant_id: t1,
+                        scope_id: s,
+                        operation: 'test/read',
+                        impersonation: null,
+                        invocation_id: null,
+                        at,
+                        drained_at: null,
+                        ...over,
+                    });
+                    const summarize = () => host.admin.summarizeDenials(staff, t1, s, { groupBy: 'operation' });
+                    await restore(s, dump, {
+                        _substrat_denials: [denial(), denial(), denial({ operation: 'test/write' }), denial({ operation: null })],
+                    });
+                    const clean = await summarize();
+                    expect(clean.groupBy).toBe('operation');
+                    expect(clean.buckets).toHaveLength(3);
+                    const byOp = (op) => clean.buckets.find((b) => b.operation === op);
+                    expect(byOp('test/read')).toMatchObject({ count: 2, firstAt: at, lastAt: at });
+                    expect(byOp('test/write')).toMatchObject({ count: 1 });
+                    // The refusal outside any operation is a bucket of its own — and that null is a fact.
+                    expect(byOp(null)).toMatchObject({ count: 1 });
+                    for (const b of clean.buckets)
+                        expect(b).not.toHaveProperty('decodeError');
+                    // One denial with an empty time: the bucket it lands in cannot state when it began.
+                    await restore(s, dump, {
+                        _substrat_denials: [denial({ operation: 'test/write', at: '' }), denial()],
+                    });
+                    await expect(summarize()).rejects.toThrow(/DenialOperationBucket — first_at: /);
+                });
+            });
+            describe('executed rows: the bad event is dead-lettered, and the one behind it runs', () => {
+                it('consumer delivery', async () => {
+                    const { s, dump } = await seeded('flow-vertical', (stub) => stub.invoke('flow/produce'));
+                    const step1 = rowsOf(dump, '_substrat_outbox').find((r) => r.type === 'flow.step1');
+                    const healthy = { ...step1, id: ulid() };
+                    const deliveredIds = async () => {
+                        const stub = await host.getScope(alice, t1, s);
+                        // Any invoke drains the scope's consumers in its tail.
+                        await stub.invoke('flow/produce');
+                        return {
+                            log: (await stub.invoke('flow/log')).map((r) => r.event_id),
+                            deliveries: await stub.invoke('flow/deliveries'),
+                        };
+                    };
+                    // Undelivered, the both of them: no deliveries and no consumer-side rows.
+                    const fresh = { _substrat_deliveries: [], flow_log: [] };
+                    await restore(s, dump, { ...fresh, _substrat_outbox: [healthy] });
+                    const clean = await deliveredIds();
+                    expect(clean.log).toContain(healthy.id);
+                    expect(clean.deliveries.every((d) => d.error === null)).toBe(true);
+                    await restore(s, dump, { ...fresh, _substrat_outbox: [{ ...step1, id: badId(), actor: '{' }, healthy] });
+                    const planted = await deliveredIds();
+                    // The event BEHIND the bad one is delivered — the handler ran on it — and the bad
+                    // one never reached the handler at all.
+                    expect(planted.log).toContain(healthy.id);
+                    expect(planted.log).not.toContain(badId());
+                    const dead = planted.deliveries.find((d) => d.event_id === badId());
+                    expect(dead.error).toMatch(/cannot be decoded — actor: not valid JSON/);
+                    expect(planted.deliveries.find((d) => d.event_id === healthy.id).error).toBeNull();
+                    // …and it is a dead letter like any other, readable where operators look.
+                    const letters = await host.admin.deadLetters(staff, t1, s, {});
+                    expect(letters.entries.find((d) => d.eventId === badId())).toMatchObject({ consumer: '@test/flow' });
+                });
+                it('executor dispatch', async () => {
+                    const tag = `after-bad-${ulid()}`;
+                    const { s, dump } = await seeded('connector-vertical', (stub) => stub.invoke('connector/request-effect', { tag: `seed-${ulid()}` }));
+                    const template = rowsOf(dump, '_substrat_outbox').find((r) => r.type === 'effect.requested');
+                    const healthy = { ...template, id: ulid(), payload: JSON.stringify({ tag }) };
+                    const fresh = { _substrat_deliveries: [] };
+                    // The positive twin: one healthy event, delivered, nothing dead.
+                    await restore(s, dump, { ...fresh, _substrat_outbox: [healthy] });
+                    const cleanReport = await host.drainDue(t1, s);
+                    expect(cleanReport).toMatchObject({ attempted: 1, delivered: 1, deadLettered: 0 });
+                    expect(effected).toContain(tag);
+                    const next = `after-bad-${ulid()}`;
+                    const behind = { ...template, id: ulid(), payload: JSON.stringify({ tag: next }) };
+                    await restore(s, dump, {
+                        ...fresh,
+                        _substrat_outbox: [{ ...template, id: badId(), payload: 'not json at all' }, behind],
+                    });
+                    const report = await host.drainDue(t1, s);
+                    // Both attempted; the bad one dead at once — `flaky-effector` allows five attempts,
+                    // and a decode that failed once can never succeed.
+                    expect(report).toMatchObject({ attempted: 2, delivered: 1, deadLettered: 1, retrying: 0 });
+                    expect(effected).toContain(next);
+                    const dead = (await host.admin.deadLetters(staff, t1, s, {})).entries.find((d) => d.eventId === badId());
+                    expect(dead).toMatchObject({ consumer: 'executor:flaky-effector', attempts: 1 });
+                    expect(dead.error).toMatch(/cannot be decoded — payload: not valid JSON/);
+                    // Terminal: the next pass does not attempt it again.
+                    expect(await host.drainDue(t1, s)).toMatchObject({ attempted: 0 });
+                });
+                it('the Tier-2 read steps over it, ships nothing built from stand-ins, and says so', async () => {
+                    const { s, dump } = await seeded('connector-vertical', async (stub) => {
+                        await stub.invoke('test/emit-event');
+                        await stub.invoke('test/emit-event');
+                    });
+                    const rows = rowsOf(dump, '_substrat_outbox');
+                    const events = rows.filter((r) => r.type === 'test.happened');
+                    // The positive twin: a clean read carries no `skipped` at all.
+                    await restore(s, dump, { _substrat_outbox: rows });
+                    const clean = await host.admin.readUndrainedEvents(staff, t1, s, 200);
+                    expect(clean.map((e) => e.id)).toEqual(expect.arrayContaining(events.map((e) => e.id)));
+                    expect(clean.skipped).toBeUndefined();
+                    const bad = { ...events[0], id: badId(), actor: '{' };
+                    await restore(s, dump, { _substrat_outbox: [bad, ...rows] });
+                    const read = await host.admin.readUndrainedEvents(staff, t1, s, 200);
+                    // Every healthy row, exactly as the clean read had it; the bad one nowhere in it.
+                    expect(read.map((e) => e.id)).toEqual(clean.map((e) => e.id));
+                    expect([...read]).toEqual([...clean]);
+                    expect(read.skipped).toEqual({ count: 1, eventIds: [bad.id] });
+                    // The cost of the skip, pinned: it is never stamped, so it is still undrained — and
+                    // still reported — once everything behind it has shipped. The lake never has it.
+                    await host.admin.markEventsDrained(staff, t1, s, read.map((e) => e.id));
+                    const after = await host.admin.readUndrainedEvents(staff, t1, s, 200);
+                    expect(after).toHaveLength(0);
+                    expect(after.skipped).toEqual({ count: 1, eventIds: [bad.id] });
+                });
+                // #1641 review. Two shapes the first cut let through: an optional column stored as
+                // `''` was tested for truthiness and read as ABSENT, skipping validation; and the
+                // drain's lifted columns were copied onto a validated envelope unparsed. Both are
+                // values the published schema refuses, and both must be contained like any other.
+                it('an empty optional column, or a corrupt lifted one, is contained too', async () => {
+                    const tag = `behind-${ulid()}`;
+                    const { s, dump } = await seeded('connector-vertical', (stub) => stub.invoke('connector/request-effect', { tag: `seed-${ulid()}` }));
+                    const template = rowsOf(dump, '_substrat_outbox').find((r) => r.type === 'effect.requested');
+                    const behind = { ...template, id: ulid(), payload: JSON.stringify({ tag }) };
+                    const planted = [
+                        // Envelope columns — every path: delivery, dispatch and the drain.
+                        { ...template, id: badId(0), impersonation: '' },
+                        { ...template, id: badId(1), authorization: '' },
+                        // Lifted columns — the drain's alone.
+                        { ...template, id: badId(2), version: '' },
+                        { ...template, id: badId(3), caused_by: 'not-an-event-id' },
+                    ];
+                    await restore(s, dump, { _substrat_deliveries: [], _substrat_outbox: [...planted, behind] });
+                    // The drain: none of the four ships; the event behind them does; all four counted.
+                    const read = await host.admin.readUndrainedEvents(staff, t1, s, 200);
+                    expect(read.map((e) => e.id)).toEqual([behind.id]);
+                    expect(read.skipped).toEqual({ count: 4, eventIds: planted.map((r) => r.id) });
+                    // Dispatch: the two envelope-broken rows are dead at once and never handled; the
+                    // lifted columns are not part of an executor's event, so those two deliver as before.
+                    const report = await host.drainDue(t1, s);
+                    expect(report).toMatchObject({ attempted: 5, delivered: 3, deadLettered: 2 });
+                    expect(effected).toContain(tag);
+                    const dead = (await host.admin.deadLetters(staff, t1, s, {})).entries.map((d) => d.eventId).sort();
+                    expect(dead).toEqual([badId(0), badId(1)]);
+                });
+                it('the Tier-2 read is bounded: past limit × 10 bad rows in a row, a pass ships nothing', async () => {
+                    const { s, dump } = await seeded('connector-vertical', (stub) => stub.invoke('test/emit-event'));
+                    const rows = rowsOf(dump, '_substrat_outbox');
+                    const event = rows.find((r) => r.type === 'test.happened');
+                    const others = rows.filter((r) => r !== event);
+                    const bad = (n) => Array.from({ length: n }, (_, i) => ({ ...event, id: badId(i), payload: '{' }));
+                    // Already-drained, so the only undrained rows are the planted ones and `event`.
+                    const drainedOthers = others.map((r) => ({ ...r, drained_at: '2026-09-01T00:00:00.000Z' }));
+                    // One under the bound (limit 1 → ten rows looked at): the healthy row still ships.
+                    await restore(s, dump, { _substrat_outbox: [...bad(9), event, ...drainedOthers] });
+                    const under = await host.admin.readUndrainedEvents(staff, t1, s, 1);
+                    expect(under.map((e) => e.id)).toEqual([event.id]);
+                    expect(under.skipped?.count).toBe(9);
+                    // At the bound: nothing ships, this pass or the next — the known limit. A spine
+                    // this broken is a restore to repair; the count is what makes it visible.
+                    await restore(s, dump, { _substrat_outbox: [...bad(10), event, ...drainedOthers] });
+                    for (let pass = 0; pass < 2; pass++) {
+                        const stalled = await host.admin.readUndrainedEvents(staff, t1, s, 1);
+                        expect(stalled).toHaveLength(0);
+                        expect(stalled.skipped?.count).toBe(10);
+                    }
+                    // A larger budget reaches past it.
+                    const wider = await host.admin.readUndrainedEvents(staff, t1, s, 2);
+                    expect(wider.map((e) => e.id)).toEqual([event.id]);
+                });
+            });
+        });
         it('isolates scope storage: a write in one scope is invisible in another', async () => {
             const stub1 = await host.getScope(alice, t1, s1);
             const stub2 = await host.getScope(alice, t2, s2);
@@ -451,6 +1046,44 @@ export function scopeHostContractSuite(adapterName, makeFixture, opts = {}) {
             // rebuild instant went to the new table, and reopening it would write it there twice.
             await expect(host.admin.redrainEvents(staff, t1, sDrain, { drainedBefore: stampedAt })).resolves.toBe(0);
             const justAfter = new Date(Date.parse(stampedAt) + 1).toISOString();
+            // COUNT ONLY (#1545) — the same window asked read-only, which is what a dry run needs
+            // and what nothing could answer before: the verb only ever reopened, so a caller could
+            // learn the number by changing the rows or not at all.
+            const redrainRows = async () => (await host.admin.auditLog(staff, { tenantId: t1 })).filter((r) => r.action === 'redrainEvents' && r.scopeId === sDrain).length;
+            const receiptsBefore = await redrainRows();
+            const undrainedBefore = await host.admin.readUndrainedEvents(staff, t1, sDrain, 200);
+            // Strictly before, on the same boundary the reopen holds: a count that included the
+            // instant would rehearse a different window from the one the real run touches.
+            await expect(host.admin.redrainEvents(staff, t1, sDrain, { drainedBefore: stampedAt, countOnly: true })).resolves.toBe(0);
+            // Asked TWICE on purpose: a "count" that reopened its own window would answer
+            // differently the second time, which is the one failure a rehearsal must not have.
+            await expect(host.admin.redrainEvents(staff, t1, sDrain, { drainedBefore: justAfter, countOnly: true })).resolves.toBe(first.length);
+            await expect(host.admin.redrainEvents(staff, t1, sDrain, { drainedBefore: justAfter, countOnly: true })).resolves.toBe(first.length);
+            // …and it moved nothing: the stamped rows are still stamped, so the drain has exactly
+            // the same work in front of it as before the count.
+            expect((await host.admin.readUndrainedEvents(staff, t1, sDrain, 200)).map((e) => e.id)).toEqual(undrainedBefore.map((e) => e.id));
+            // …and wrote no receipt. The intent row exists because a reopen that crashed before
+            // its outcome row would leave a second egress with no trace; a count egresses nothing,
+            // and a row claiming a redrain on a scope that was only counted is a false statement
+            // in the one log that is evidence.
+            expect(await redrainRows()).toBe(receiptsBefore);
+            // It is still a READ, and K-24 takes all reads rather than a chosen subset — so the
+            // access log carries a row per count, naming the window and the number it found.
+            // "Nobody can tell who counted every tenant's outbox" is the hole that would be.
+            const counts = (await host.admin.accessLog(staff, { tenantId: t1, method: 'redrainEvents' })).filter((r) => r.scopeId === sDrain);
+            expect(counts).toHaveLength(3);
+            expect(counts.map((r) => r.resultCount)).toEqual(expect.arrayContaining([0, first.length]));
+            // The future refusal is the verb's, not the reopen's alone — the window rule is
+            // checked before the two branches part.
+            await expect(host.admin.redrainEvents(staff, t1, sDrain, {
+                drainedBefore: new Date(Date.now() + 60_000).toISOString(),
+                countOnly: true,
+            })).rejects.toThrow(/future/);
+            // K-3 holds for the count as for the reopen: a foreign pair is refused, never answered
+            // 0 — "nothing to reopen" would read as a finished rehearsal of a scope never touched.
+            await expect(host.admin.redrainEvents(staff, t2, sDrain, { drainedBefore: justAfter, countOnly: true })).rejects.toThrow(/unknown scope/);
+            // The number the count gave IS the number the reopen changes — the property that makes
+            // a dry run a rehearsal rather than a second, differently-shaped question.
             await expect(host.admin.redrainEvents(staff, t1, sDrain, { drainedBefore: justAfter })).resolves.toBe(first.length);
             // The reopened rows come back through the ordinary read, unchanged — nothing about the
             // event moves except that it may leave again.
@@ -820,6 +1453,29 @@ export function scopeHostContractSuite(adapterName, makeFixture, opts = {}) {
             it('rejects an unknown table', async () => {
                 await expect(host.admin.readScopeTable(staff, t1, s1, { table: 'no_such_table', limit: 50, offset: 0 })).rejects.toThrow(/unknown table/);
             });
+            // #1524: the size behind the on-demand storage reading. The growth assertion is what
+            // separates a real size from a constant. A host that answered a fixed number, or
+            // the size of some other database, passes "positive integer" and fails this.
+            it('answers the scope database size in bytes, and it grows with what is written (#1524)', async () => {
+                const stub = await host.getScope(alice, t1, s1);
+                const before = await host.admin.scopeDatabaseSize(staff, t1, s1);
+                expect(Number.isInteger(before)).toBe(true);
+                expect(before).toBeGreaterThan(0);
+                // ~1 MiB of marker rows: far past any page-rounding or free-page slack.
+                const chunk = 'x'.repeat(64 * 1024);
+                for (let i = 0; i < 16; i += 1)
+                    await stub.invoke('test/write-marker', { v: `${i}-${chunk}` });
+                const after = await host.admin.scopeDatabaseSize(staff, t1, s1);
+                expect(after - before).toBeGreaterThanOrEqual(512 * 1024);
+                // A size of ANOTHER scope must not answer for this one.
+                const other = await host.admin.scopeDatabaseSize(staff, t2, s2);
+                expect(other).toBeLessThan(after);
+                const reads = await host.admin.accessLog(staff, { tenantId: t1, method: 'scopeDatabaseSize' });
+                expect(reads.some((r) => r.scopeId === s1)).toBe(true);
+            });
+            it('refuses a database size for a mismatched (tenantId, scopeId) pair (K-3, #1524)', async () => {
+                await expect(host.admin.scopeDatabaseSize(staff, t2, s1)).rejects.toThrow();
+            });
             it('fails closed on a mismatched (tenantId, scopeId) pair (K-3)', async () => {
                 await expect(host.admin.listScopeTables(staff, t2, s1)).rejects.toThrow();
                 await expect(host.admin.readScopeTable(staff, t2, s1, { table: 'marker', limit: 50, offset: 0 })).rejects.toThrow();
@@ -1063,6 +1719,217 @@ export function scopeHostContractSuite(adapterName, makeFixture, opts = {}) {
                 await expect(host.admin.shredSubject(staff, t2, s1, subject)).rejects.toThrow();
                 await expect(host.admin.sealSubjectPayloads(staff, t2, s1, [{ subjectId: subject, plaintext: 'x' }])).rejects.toThrow();
             });
+            // -- the spine's OTHER copy of an event (#1600) -------------------------
+            //
+            // `_substrat_platform_requests` holds whole `DomainEvent`s. A CP-less host cannot
+            // run a connector, so each delivery becomes a `connector:<provider>` intent whose
+            // payload is the entire envelope, payload included — deliberately fat, because the
+            // platform's handler needs what the in-process handler would have been handed. And
+            // nothing ever deletes those rows: `listPlatformRequestHistory` exists precisely so
+            // a settled one stays readable. For a year the redaction reached the outbox and not
+            // this, so a shredded subject's name sat in the live scope database, and in every
+            // export, backup and PITR window taken from it afterwards.
+            //
+            // These drive the intent through `ctx.requestPlatform` with the exact payload the
+            // CP-less router writes (`{ executorId, event }`, `connectorDispatchPayload`), which
+            // is the one shape both adapters can be held to — the routing itself only exists on
+            // the Durable-Object host, and `connector-route.test.ts` asserts that what it really
+            // writes is a payload this redaction selects.
+            describe('the intent journal (#1600)', () => {
+                /** The whole spine envelope, as an intent embeds it. Parsed, so the fixture IS one. */
+                const envelopeFor = (subject, said) => domainEvent.parse({
+                    id: eventId.parse(ulid()),
+                    type: 'protocol.signatures-requested',
+                    schemaVersion: 1,
+                    occurredAt: instant.parse(new Date().toISOString()),
+                    tenantId: t1,
+                    scopeId: s1,
+                    actor: { system: '@substrat-run/engine-protocol' },
+                    entity: { entityType: 'protocol', entityId: ulid() },
+                    piiClass: 'direct',
+                    subjectId: subject,
+                    payload: { senderParty: { label: said }, parties: [{ label: said }] },
+                });
+                /** Enqueue one routed-connector-shaped intent and hand back its id. */
+                const routeIntent = async (kind, subject, said) => {
+                    const scope = await host.getScope(alice, t1, s1);
+                    const id = await scope.invoke('platform/request', {
+                        kind,
+                        payload: { executorId: 'signer', event: envelopeFor(subject, said) },
+                    });
+                    return id;
+                };
+                const journal = async (kind) => host.listPlatformRequestHistory(t1, s1, { kind });
+                it('redacts the routed copy of the event, and leaves the neighbour intact', async () => {
+                    // A distinct kind per test: this scope's journal is shared with every other
+                    // suite that enqueues, and `connector:<provider>` IS a family of kinds.
+                    const kind = `connector:erasure-${ulid()}`;
+                    const erased = dataSubjectId.parse(ulid());
+                    const spared = dataSubjectId.parse(ulid());
+                    const theirs = await routeIntent(kind, erased, 'Anna Ek');
+                    const neighbour = await routeIntent(kind, spared, 'Bo Lund');
+                    const before = await journal(kind);
+                    expect(JSON.stringify(before.find((r) => r.id === theirs))).toContain('Anna Ek');
+                    const receipt = await host.admin.shredSubject(staff, t1, s1, erased);
+                    const after = await journal(kind);
+                    const mine = after.find((r) => r.id === theirs);
+                    // THE property, asserted before the receipt that claims it: no trace of the
+                    // name, anywhere in the row.
+                    expect(JSON.stringify(mine)).not.toContain('Anna Ek');
+                    // And the positive twin, without which a redact-everything bug passes the
+                    // line above: the intent belonging to somebody else still says what it said,
+                    // and is still waiting to be drained.
+                    const other = after.find((r) => r.id === neighbour);
+                    expect(JSON.stringify(other)).toContain('Bo Lund');
+                    expect(other.status).toBe('pending');
+                    expect(receipt.intentsRedacted).toBe(1);
+                    // Settled afterwards so this test does not spend one of the scope's 32 pending
+                    // slots for the rest of the run.
+                    await host.settlePlatformRequest(t1, s1, neighbour, { status: 'done' });
+                });
+                it('keeps the envelope — the row is still there, still listed, still dated', async () => {
+                    const kind = `connector:erasure-${ulid()}`;
+                    const erased = dataSubjectId.parse(ulid());
+                    const id = await routeIntent(kind, erased, 'Anna Ek');
+                    const before = (await journal(kind)).find((r) => r.id === id);
+                    await host.admin.shredSubject(staff, t1, s1, erased);
+                    const after = (await journal(kind)).find((r) => r.id === id);
+                    // The retention is intended, so the redaction must not become a delete: what
+                    // this row proves — that something was asked of the platform, by whom, and
+                    // when — is the audit trail, and it survives the erasure of what was said.
+                    expect(after).toBeDefined();
+                    expect(after.kind).toBe(kind);
+                    expect(after.requestedAt).toBe(before.requestedAt);
+                    expect(after.requestedBy).toEqual(before.requestedBy);
+                    // Obviously redacted rather than plausible data — a reader must not need the
+                    // kind's schema to see that the content is gone.
+                    expect(after.payload).toEqual({
+                        [REDACTED_INTENT_MARKER]: expect.objectContaining({
+                            reason: 'subject-erasure',
+                            subjectId: erased,
+                        }),
+                    });
+                });
+                it('never leaves a redacted intent drainable — a pending one settles failed', async () => {
+                    const kind = `connector:erasure-${ulid()}`;
+                    const erased = dataSubjectId.parse(ulid());
+                    const id = await routeIntent(kind, erased, 'Anna Ek');
+                    expect((await host.listPlatformRequests(t1, s1)).some((r) => r.id === id)).toBe(true);
+                    await host.admin.shredSubject(staff, t1, s1, erased);
+                    // Redacting and leaving it pending would hand the drain a tombstone to execute;
+                    // leaving it pending and intact would keep the name. `failed` is the truthful
+                    // terminal state — the delivery did not happen and now cannot.
+                    const settled = (await journal(kind)).find((r) => r.id === id);
+                    expect(settled.status).toBe('failed');
+                    expect(settled.settledAt).not.toBeNull();
+                    expect(settled.lastError).toContain('subject erasure');
+                    const stillPending = await host.listPlatformRequests(t1, s1);
+                    expect(stillPending.some((r) => r.id === id)).toBe(false);
+                });
+                it('redacts what the provider said back, not only what we sent', async () => {
+                    const kind = `connector:erasure-${ulid()}`;
+                    const erased = dataSubjectId.parse(ulid());
+                    const id = await routeIntent(kind, erased, 'Anna Ek');
+                    // #618 made a provider's own sentence readable on the journal, which is exactly
+                    // why it can quote the person back at us. An erasure that emptied `payload` and
+                    // left a name two columns over is the same defect, one column to the right.
+                    await host.settlePlatformRequest(t1, s1, id, {
+                        status: 'failed',
+                        lastError: 'HTTP 409: Anna Ek requires a valid personal number field',
+                    });
+                    await host.admin.shredSubject(staff, t1, s1, erased);
+                    const after = (await journal(kind)).find((r) => r.id === id);
+                    expect(after.lastError).not.toContain('Anna Ek');
+                    // Already settled, so the redaction does not re-date it or reopen it.
+                    expect(after.status).toBe('failed');
+                });
+                it('keeps `result`, which is envelope — what the intent DID, not what it said', async () => {
+                    // The redaction spares `result` on purpose, and until now nothing held it to
+                    // that: for a routed dispatch it is `{ eventId }`, which names the event the
+                    // outbox already keeps a redacted row for, so it is the same class of fact as
+                    // `kind` and `requestedAt`. Asserted beside the two columns that DO go, so the
+                    // line between them is a test rather than a sentence in the PR.
+                    const kind = `connector:erasure-${ulid()}`;
+                    const erased = dataSubjectId.parse(ulid());
+                    const id = await routeIntent(kind, erased, 'Anna Ek');
+                    await host.settlePlatformRequest(t1, s1, id, {
+                        status: 'failed',
+                        result: { eventId: 'evt-01', deliveredAt: '2026-09-20T00:00:00.000Z' },
+                        lastError: 'HTTP 409: Anna Ek requires a valid personal number field',
+                    });
+                    await host.admin.shredSubject(staff, t1, s1, erased);
+                    const after = (await journal(kind)).find((r) => r.id === id);
+                    // What was said goes — both columns that could carry it.
+                    expect(JSON.stringify(after.payload)).not.toContain('Anna Ek');
+                    expect(after.lastError).not.toContain('Anna Ek');
+                    expect(after.lastError).toContain('subject erasure');
+                    // What happened stays, unchanged and whole.
+                    expect(after.result).toEqual({
+                        eventId: 'evt-01',
+                        deliveredAt: '2026-09-20T00:00:00.000Z',
+                    });
+                });
+                it('refuses a stale drain settling a row the erasure already redacted', async () => {
+                    // The drain reads pending rows, runs the handler, then settles — so a settle can
+                    // arrive after the erasure landed, carrying a provider's reply that quotes the
+                    // person. Settling by id alone wrote that name back into `last_error` on a row
+                    // whose payload had just been emptied. The settle is a compare-and-set on
+                    // `pending`, so the stale pass is ignored rather than undoing the erasure.
+                    //
+                    // What this does NOT claim to stop is the DELIVERY: a handler that already read
+                    // the payload has it. Only the writeback onto the redacted row is refused.
+                    const kind = `connector:erasure-${ulid()}`;
+                    const erased = dataSubjectId.parse(ulid());
+                    const id = await routeIntent(kind, erased, 'Anna Ek');
+                    await host.admin.shredSubject(staff, t1, s1, erased);
+                    await host.settlePlatformRequest(t1, s1, id, {
+                        status: 'done',
+                        result: { eventId: 'delivered-before-the-shred' },
+                        lastError: 'HTTP 409: Anna Ek requires a valid personal number field',
+                    });
+                    const after = (await journal(kind)).find((r) => r.id === id);
+                    expect(JSON.stringify(after)).not.toContain('Anna Ek');
+                    // The erasure's own settlement stands; the stale pass changed nothing at all.
+                    expect(after.status).toBe('failed');
+                    expect(after.result).toBeNull();
+                    expect(after.attempts).toBe(0);
+                });
+                it('spares an intent whose embedded event is classified `none`', async () => {
+                    // The outbox spares such an event even when it names the subject, so a COPY of
+                    // it judged more harshly than its original would be incoherent, not stricter.
+                    const kind = `connector:erasure-${ulid()}`;
+                    const erased = dataSubjectId.parse(ulid());
+                    const scope = await host.getScope(alice, t1, s1);
+                    const id = (await scope.invoke('platform/request', {
+                        kind,
+                        payload: {
+                            executorId: 'signer',
+                            event: {
+                                ...envelopeFor(erased, 'Anna Ek'),
+                                piiClass: 'none',
+                                payload: { reference: 'nothing about anybody' },
+                            },
+                        },
+                    }));
+                    const receipt = await host.admin.shredSubject(staff, t1, s1, erased);
+                    expect(receipt.intentsRedacted).toBe(0);
+                    const after = (await journal(kind)).find((r) => r.id === id);
+                    expect(JSON.stringify(after.payload)).toContain('nothing about anybody');
+                    await host.settlePlatformRequest(t1, s1, id, { status: 'done' });
+                });
+                it('is idempotent — a second shred finds the tombstone and changes nothing', async () => {
+                    const kind = `connector:erasure-${ulid()}`;
+                    const erased = dataSubjectId.parse(ulid());
+                    const id = await routeIntent(kind, erased, 'Anna Ek');
+                    expect((await host.admin.shredSubject(staff, t1, s1, erased)).intentsRedacted).toBe(1);
+                    const once = (await journal(kind)).find((r) => r.id === id);
+                    // The tombstone names the subject, so it survives the candidate read and is
+                    // declined by the predicate — which is the property, not a lucky shape.
+                    expect((await host.admin.shredSubject(staff, t1, s1, erased)).intentsRedacted).toBe(0);
+                    const twice = (await journal(kind)).find((r) => r.id === id);
+                    expect(twice).toEqual(once);
+                });
+            });
             it('records the erasure in BOTH logs — mutation and evidence-destruction', async () => {
                 const subject = dataSubjectId.parse(ulid());
                 await host.admin.shredSubject(staff, t1, s1, subject);
@@ -1395,6 +2262,103 @@ export function scopeHostContractSuite(adapterName, makeFixture, opts = {}) {
                 const tables = await host.admin.listScopeTables(staff, t1, spineScope);
                 expect(tables.some((t) => t.name === '_substrat_migrations')).toBe(true);
             });
+            it('rebuilds a module table the dump did not carry — on a host that has ALREADY migrated (#1589)', async () => {
+                // A restore replays only what the dump carries and then re-asserts the spine,
+                // so a MODULE's own tables are dropped and not rebuilt by the restore itself.
+                // Both adapters lean on the next migration pass to recreate them, and this is
+                // the assertion that holds them to the same answer.
+                //
+                // ALREADY MIGRATED is the whole point, not scene-setting. The pure host reads
+                // its applied-migration set on every pass, so it re-applies by construction —
+                // but the Cloudflare ScopeDO memoises the pass itself in `migrationPromise`,
+                // and a WARM instance kept answering "migrations are done" over a scope whose
+                // tables the dump had just dropped. The next operation failed with a bare
+                // `no such table`, and kept failing until an eviction or `migrateScope` — so
+                // the restore reported success and the scope was broken (#1589). A cold host
+                // re-derives everything and would pass this vacuously; the operation below is
+                // what makes the host warm before the dump lands.
+                const memoScope = scopeId.parse(ulid());
+                await host.provisionScope(staff, {
+                    tenantId: t1,
+                    scopeId: memoScope,
+                    jurisdiction: 'eu',
+                    vertical: 'connector-vertical',
+                });
+                await host.admin.activateScope(staff, t1, memoScope);
+                const warm = await host.getScope(alice, t1, memoScope);
+                await warm.invoke('testmod/add', { id: 'before-restore', box: 'b1' });
+                // The dump of a targeted repair: the spine and every other module's tables,
+                // but neither `@test/mod`'s tables nor the journal rows claiming they exist.
+                // Stripping the journal row is what makes the dump self-consistent — a dump
+                // that dropped the table and KEPT the row would be asking for a schema no
+                // migration pass is allowed to rebuild.
+                const backup = await host.admin.exportScope(staff, t1, memoScope);
+                const journal = backup.tables.find((t) => t.name === '_substrat_migrations');
+                const moduleCol = journal.columns.indexOf('module_id');
+                expect(backup.tables.some((t) => t.name === 'testmod_items')).toBe(true);
+                expect(journal.rows.some((r) => r[moduleCol] === '@test/mod')).toBe(true);
+                const stripped = {
+                    ...backup,
+                    tables: backup.tables
+                        // BOTH of the module's tables: its one migration creates the pair in a
+                        // single statement list, so leaving `testmod_notes` behind would stop the
+                        // re-apply on "table testmod_notes already exists" — a different failure
+                        // wearing this one's clothes.
+                        .filter((t) => t.name !== 'testmod_items' && t.name !== 'testmod_notes')
+                        .map((t) => t.name === '_substrat_migrations'
+                        ? { ...t, rows: t.rows.filter((r) => r[moduleCol] !== '@test/mod') }
+                        : t),
+                };
+                await host.restoreScope(staff, t1, memoScope, stripped);
+                // Both tables are back, and the module writes on them — this is the line that
+                // threw `no such table: testmod_items` on the hosted adapter.
+                const after = await host.getScope(alice, t1, memoScope);
+                await after.invoke('testmod/add', { id: 'after-restore', box: 'b1' });
+                expect(await after.invoke('testmod/read-items')).toEqual([
+                    { id: 'after-restore' },
+                ]);
+                expect(await after.invoke('testmod/read-notes')).toEqual([]);
+                // The journal records the re-applied version exactly once, so the pass after
+                // this one has nothing to do.
+                const frontier = await after.invoke('testmod/read-journal');
+                expect(frontier.filter((r) => r.module_id === '@test/mod')).toEqual([
+                    { module_id: '@test/mod', version: '0001-init' },
+                ]);
+            });
+            it('leaves a module table the dump DID carry exactly as the dump left it (#1589)', async () => {
+                // The twin of the test above, and what stops "rebuild what the dump dropped"
+                // from becoming "rebuild on every restore". A dump carrying the table and its
+                // journal row must come back as the dump left it: re-running the migration
+                // here would stop on "table testmod_items already exists" and fail the scope
+                // closed — the same outage, reached from the other side — and a restore that
+                // rebuilt the table empty would lose the rows it exists to bring back.
+                const keptScope = scopeId.parse(ulid());
+                await host.provisionScope(staff, {
+                    tenantId: t1,
+                    scopeId: keptScope,
+                    jurisdiction: 'eu',
+                    vertical: 'connector-vertical',
+                });
+                await host.admin.activateScope(staff, t1, keptScope);
+                const warm = await host.getScope(alice, t1, keptScope);
+                await warm.invoke('testmod/add', { id: 'kept', box: 'b1' });
+                const backup = await host.admin.exportScope(staff, t1, keptScope);
+                expect(backup.tables.some((t) => t.name === 'testmod_items')).toBe(true);
+                await warm.invoke('testmod/add', { id: 'zz-diverged', box: 'b1' });
+                await host.restoreScope(staff, t1, keptScope, backup);
+                // The dump's row, and only it — the divergence is gone and nothing was wiped.
+                const after = await host.getScope(alice, t1, keptScope);
+                expect(await after.invoke('testmod/read-items')).toEqual([
+                    { id: 'kept' },
+                ]);
+                // …and the scope still writes: a re-applied migration would have failed the
+                // scope closed here rather than accepting this row.
+                await after.invoke('testmod/add', { id: 'post-restore', box: 'b1' });
+                expect(await after.invoke('testmod/read-items')).toEqual([
+                    { id: 'kept' },
+                    { id: 'post-restore' },
+                ]);
+            });
             it('loads a dump whose child table sorts before its parent — FK order is not alphabetical', async () => {
                 // A dump is ordered by table NAME. A vertical whose child sorts first (a CRM's
                 // `crm_bank_accounts` before `crm_vendors`) used to fail its first insert with a
@@ -1762,6 +2726,11 @@ export function scopeHostContractSuite(adapterName, makeFixture, opts = {}) {
         // -- the integrations hub: connections (#101) -----------------------------
         // -- model usage (#1054): meter 3's ledger, idempotent on the intent id ----------------
         describe('model usage (#1054)', () => {
+            // Window edges are derived from the real clock, never literals: the host prunes model
+            // usage older than MODEL_USAGE_RETENTION_DAYS against Date.now(), so a fixed date is a
+            // fixture that expires. `day(n)` is midnight UTC, `n` days after a base 40 days back.
+            const BASE = new Date(Date.now() - 40 * 86_400_000).setUTCHours(0, 0, 0, 0);
+            const day = (n, hour = 0) => new Date(BASE + n * 86_400_000 + hour * 3_600_000).toISOString();
             const line = (at, over = {}) => ({
                 attribution: {
                     tenant: t1,
@@ -1786,23 +2755,23 @@ export function scopeHostContractSuite(adapterName, makeFixture, opts = {}) {
             it('records a line once per intent id, lists it, and folds the window exactly', async () => {
                 const first = await host.admin.recordModelUsage({
                     requestId: 'req-model-usage-1',
-                    line: line('2026-08-01T10:00:00.000Z', { listUsd: '0.75' }),
+                    line: line(day(0, 10), { listUsd: '0.75' }),
                 });
                 expect(first.recorded).toBe(true);
                 // The drain replays a settled-then-retried intent: nothing is billed twice.
                 const again = await host.admin.recordModelUsage({
                     requestId: 'req-model-usage-1',
-                    line: line('2026-08-01T10:00:00.000Z', { listUsd: '0.75' }),
+                    line: line(day(0, 10), { listUsd: '0.75' }),
                 });
                 expect(again.recorded).toBe(false);
                 await host.admin.recordModelUsage({
                     requestId: 'req-model-usage-2',
-                    line: line('2026-08-02T10:00:00.000Z', { listUsd: '0.5', inputTokens: 50_000, outputTokens: 5_000 }),
+                    line: line(day(1, 10), { listUsd: '0.5', inputTokens: 50_000, outputTokens: 5_000 }),
                 });
                 // An unpriced call: counted, never folded in as $0.
                 await host.admin.recordModelUsage({
                     requestId: 'req-model-usage-3',
-                    line: line('2026-08-03T10:00:00.000Z', {
+                    line: line(day(2, 10), {
                         listUsd: null,
                         model: 'cloudflare:@cf/meta/llama-3.1-8b-instruct-fast',
                         provider: 'cloudflare',
@@ -1814,13 +2783,13 @@ export function scopeHostContractSuite(adapterName, makeFixture, opts = {}) {
                 // Outside the window below.
                 await host.admin.recordModelUsage({
                     requestId: 'req-model-usage-4',
-                    line: line('2026-09-01T00:00:00.000Z', { listUsd: '9' }),
+                    line: line(day(30), { listUsd: '9' }),
                 });
-                const listed = await host.admin.listModelUsage(staff, { tenantId: t1, since: '2026-08-01T00:00:00.000Z' });
+                const listed = await host.admin.listModelUsage(staff, { tenantId: t1, since: day(0) });
                 expect(listed.length).toBe(4);
                 expect(listed[0].requestId).toBe('req-model-usage-4'); // newest first
                 expect(listed.every((e) => e.attribution.tenant === t1)).toBe(true);
-                const summary = await host.admin.summarizeModelUsage(staff, { tenantId: t1, since: '2026-08-01T00:00:00.000Z', until: '2026-09-01T00:00:00.000Z' }, 20);
+                const summary = await host.admin.summarizeModelUsage(staff, { tenantId: t1, since: day(0), until: day(30) }, 20);
                 expect(summary.marginPercent).toBe(20);
                 expect(summary.rows.length).toBe(2);
                 const opus = summary.rows.find((r) => r.model === 'anthropic:claude-opus-5');
@@ -2087,14 +3056,18 @@ export function scopeHostContractSuite(adapterName, makeFixture, opts = {}) {
                 expect(row.error).toBeNull();
                 expect(row.elapsedMs).toBeNull();
             });
-            it('dedupes on (requestId, unit) — a replayed drained batch writes nothing twice (#1232)', async () => {
+            it('dedupes on (requestId, kind, unit) — a replayed drained batch writes nothing twice (#1232)', async () => {
                 const unit = `${ulid()}:sched/tick`;
+                // Relative to the real clock, never a literal: the host prunes a sweep run older
+                // than SWEEP_RUN_RETENTION_DAYS against Date.now(), so a fixed date is a fixture
+                // that expires and takes the suite with it.
+                const passAt = new Date(Date.now() - 3_600_000).toISOString();
                 const write = () => host.admin.recordSweepRun({
                     kind: 'schedule',
                     unit,
                     outcome: 'ok',
                     tenantId: t1,
-                    at: '2026-09-07T10:00:00.000Z',
+                    at: passAt,
                     requestId: '01JDEDUPEINTENTAAAAAAAAAAA',
                 });
                 await write();
@@ -2102,7 +3075,7 @@ export function scopeHostContractSuite(adapterName, makeFixture, opts = {}) {
                 const rows = await host.admin.listSweepRuns(staff, { unit });
                 expect(rows).toHaveLength(1);
                 // The carried pass time survives, never overwritten by write time.
-                expect(rows[0].at).toBe('2026-09-07T10:00:00.000Z');
+                expect(rows[0].at).toBe(passAt);
                 // The DIRECT path (no requestId) never dedupes: NULLs are distinct, and two
                 // real passes over one unit are two facts.
                 const direct = `${ulid()}:direct`;
@@ -2110,6 +3083,28 @@ export function scopeHostContractSuite(adapterName, makeFixture, opts = {}) {
                 await host.admin.recordSweepRun({ kind: 'schedule', unit: direct, outcome: 'ok' });
                 expect(await host.admin.listSweepRuns(staff, { unit: direct })).toHaveLength(2);
             });
+            it('keeps a schedule row and a freshness row of one batch that derive the same unit (#1572)', async () => {
+                // The drain derives a schedule's unit from its operation and a freshness unit
+                // from its event type, and nothing keeps those apart: `orders.placed` is an
+                // ordinary spelling for both. One batch shares one requestId, so under the old
+                // (requestId, unit) key the second write was IGNOREd, silently.
+                const unit = `${ulid()}:orders.placed`;
+                const requestId = '01JKINDINTENTAAAAAAAAAAAAA';
+                const schedule = () => host.admin.recordSweepRun({ kind: 'schedule', unit, outcome: 'skipped', operation: 'orders.placed', requestId });
+                const freshness = () => host.admin.recordSweepRun({ kind: 'freshness', unit, outcome: 'failed', eventType: 'orders.placed', requestId });
+                await schedule();
+                await freshness();
+                const both = await host.admin.listSweepRuns(staff, { unit });
+                expect(both.map((r) => [r.kind, r.outcome]).sort()).toEqual([
+                    ['freshness', 'failed'],
+                    ['schedule', 'skipped'],
+                ]);
+                // The twin: kind widened the key, it did not drop it. A replay of either entry
+                // is still the same row and still writes nothing.
+                await schedule();
+                await freshness();
+                expect(await host.admin.listSweepRuns(staff, { unit })).toHaveLength(2);
+            });
             it('bounds the recorded error — one runaway provider body never becomes a runaway row', async () => {
                 const unit = ulid();
                 await host.admin.recordSweepRun({
@@ -2950,8 +3945,8 @@ export function scopeHostContractSuite(adapterName, makeFixture, opts = {}) {
             expect((await at('listtest'))?.publishRequestedAt).toBeTruthy();
             await host.admin.setVerticalListed(staff, 'listtest', true);
             expect((await at('listtest'))?.publishRequestedAt).toBeUndefined(); // cleared on review
-            await expect(host.admin.setVerticalListed(staff, 'no-such-vertical', true)).rejects.toThrow(/unknown vertical/);
-            await expect(host.admin.requestPublish(staff, 'no-such-vertical')).rejects.toThrow(/unknown vertical/);
+            await expectRefusal(host.admin.setVerticalListed(staff, 'no-such-vertical', true), 'not_found');
+            await expectRefusal(host.admin.requestPublish(staff, 'no-such-vertical'), 'not_found');
         });
         it('blocks new installs (setVerticalInstallsBlocked) — a provisioning gate, not a delete', async () => {
             const at = (slug) => host.admin.listVerticals(staff).then((vs) => vs.find((v) => v.slug === slug));
@@ -2964,7 +3959,7 @@ export function scopeHostContractSuite(adapterName, makeFixture, opts = {}) {
             expect((await at('blocktest'))?.listed).toBe(false);
             await host.admin.setVerticalInstallsBlocked(staff, 'blocktest', false);
             expect((await at('blocktest'))?.installsBlocked).toBe(false);
-            await expect(host.admin.setVerticalInstallsBlocked(staff, 'no-such-vertical', true)).rejects.toThrow(/unknown vertical/);
+            await expectRefusal(host.admin.setVerticalInstallsBlocked(staff, 'no-such-vertical', true), 'not_found');
         });
         it('grants the tenant-provisioner capability (setVerticalTenantProvisioner) — a staff grant a re-push cannot touch', async () => {
             const at = (slug) => host.admin.listVerticals(staff).then((vs) => vs.find((v) => v.slug === slug));
@@ -2979,7 +3974,7 @@ export function scopeHostContractSuite(adapterName, makeFixture, opts = {}) {
             expect((await at('managertest'))?.tenantProvisioner).toBe(true);
             await host.admin.setVerticalTenantProvisioner(staff, 'managertest', false);
             expect((await at('managertest'))?.tenantProvisioner).toBe(false);
-            await expect(host.admin.setVerticalTenantProvisioner(staff, 'no-such-vertical', true)).rejects.toThrow(/unknown vertical/);
+            await expectRefusal(host.admin.setVerticalTenantProvisioner(staff, 'no-such-vertical', true), 'not_found');
         });
         it('carries the declared provisioner intent (#455) — a refreshable request, orthogonal to the grant', async () => {
             const at = (slug) => host.admin.listVerticals(staff).then((vs) => vs.find((v) => v.slug === slug));
@@ -3030,12 +4025,13 @@ export function scopeHostContractSuite(adapterName, makeFixture, opts = {}) {
             expect((await at('mailer'))?.emailSender).toBe(true);
             await host.admin.setVerticalEmailSender(staff, 'mailer', false);
             expect((await at('mailer'))?.emailSender).toBe(false);
-            await expect(host.admin.setVerticalEmailSender(staff, 'no-such-vertical', true)).rejects.toThrow(/unknown vertical/);
+            await expectRefusal(host.admin.setVerticalEmailSender(staff, 'no-such-vertical', true), 'not_found');
         });
         it('deletes a vertical — refused while a scope is bound, total once nothing is', async () => {
             // 'callout' still backs s1 (bound above): the refusal that stops a delete from
-            // stranding a live scope's version pin and routing.
-            await expect(host.admin.deleteVertical(staff, 'callout')).rejects.toThrow(/still backs/);
+            // stranding a live scope's version pin and routing. Pinned by the CODE (#113
+            // phase 5) — the sentence is free to change, the 409 is not.
+            await expectRefusal(host.admin.deleteVertical(staff, 'callout'), 'conflict');
             expect((await host.admin.listVerticals(staff)).some((v) => v.slug === 'callout')).toBe(true);
             // A vertical nothing is bound to deletes totally: row, versions, channels.
             const versionId = ulid();
@@ -3059,7 +4055,55 @@ export function scopeHostContractSuite(adapterName, makeFixture, opts = {}) {
             await host.admin.registerVertical(staff, { slug: 'deletable', name: 'Deletable', source: 'cli', ownerTenant: t2 });
             expect(await host.admin.listVersions(staff, 'deletable')).toEqual([]); // no resurrected versions
             await host.admin.deleteVertical(staff, 'deletable');
-            await expect(host.admin.deleteVertical(staff, 'no-such-vertical')).rejects.toThrow(/unknown vertical/);
+            await expectRefusal(host.admin.deleteVertical(staff, 'no-such-vertical'), 'not_found');
+        });
+        it('refuses the serving-state read and write for a vertical that does not exist', async () => {
+            await expectRefusal(host.admin.verticalServing(staff, 'no-such-vertical'), 'not_found');
+            await expectRefusal(host.admin.setVerticalServing(staff, 'no-such-vertical', {
+                ref: 'serving-script', versionId: ulid(), doClasses: [], migrationTag: 'g1',
+            }), 'not_found');
+        });
+        it('refuses every registry verb that addresses a version which does not exist (#113 phase 5)', async () => {
+            // The five `unknown version …` throw sites, one per verb, on both adapters. Nothing
+            // asserted them before this case: each was a bare `Error` whose 404 came from a
+            // `/unknown version /` regex in the control plane, so a reword — or a regression to
+            // `new Error` — changed the status with no test to notice. The code is the contract
+            // now, and it is pinned here rather than in the transport.
+            //
+            // The id is well-formed and simply names nothing, which is what separates this from
+            // a parse failure: `not_found`, never `validation_failed`.
+            const ghost = ulid();
+            await expectRefusal(host.admin.admitVersion(staff, ghost), 'not_found');
+            await expectRefusal(host.admin.rejectVersion(staff, ghost, 'no such version'), 'not_found');
+            await expectRefusal(host.admin.promoteVersion(staff, 'callout', 'prod', ghost), 'not_found');
+            await expectRefusal(host.admin.bindScopeVersion(staff, t1, s1, ghost), 'not_found');
+            await expectRefusal(host.admin.versionManifest(staff, 'callout', ghost), 'not_found');
+            // versionManifest refuses on the PAIR — `!v || v.vertical_slug !== verticalSlug` —
+            // so the absent id above only exercises HALF its guard. A version that really
+            // exists, under a DIFFERENT vertical, must read as absent too: asking for it under
+            // someone else's slug is not a way in. Without this second call an implementation
+            // that dropped the ownership check would still pass the case, which is the same
+            // shape of hole this whole change exists to close.
+            await host.admin.registerVertical(staff, {
+                slug: 'otherowner',
+                name: 'OtherOwner',
+                source: 'cli',
+                ownerTenant: t1,
+            });
+            const elsewhere = ulid();
+            await host.admin.publishVersion(staff, {
+                id: elsewhere,
+                verticalSlug: 'otherowner',
+                version: '1.0.0',
+                manifestDigest: 'm-other',
+                permissionDigest: 'p-other',
+                migrationDigest: 'g-other',
+                deploymentRef: null,
+            });
+            // It resolves under its OWN vertical — so the refusal below is the pair check
+            // firing, not the version failing to exist.
+            await host.admin.versionManifest(staff, 'otherowner', elsewhere);
+            await expectRefusal(host.admin.versionManifest(staff, 'callout', elsewhere), 'not_found');
         });
         it('an archived scope blocks the delete naming the reap step; a reaped tombstone never blocks', async () => {
             // A deleted app leaves an `archived` row (restorable via unarchive), then a
@@ -3070,9 +4114,14 @@ export function scopeHostContractSuite(adapterName, makeFixture, opts = {}) {
             const sRet = scopeId.parse(ulid());
             await host.admin.registerVertical(staff, { slug: 'retirable', name: 'Retirable', source: 'cli', ownerTenant: t2 });
             await host.provisionScope(staff, { tenantId: t2, scopeId: sRet, jurisdiction: 'eu', vertical: 'retirable' });
-            await expect(host.admin.deleteVertical(staff, 'retirable')).rejects.toThrow(/still backs 1 scope\(s\) — delete or rebind/);
+            // Both halves are `conflict` and the sentence is what tells them apart, so both are
+            // asserted (#113 phase 5). The CODE is what the transport renders the 409 from —
+            // the archived half reached the control plane as a generic 500 until these throws
+            // were typed, because the pattern row that carried the live one read
+            // `/still backs \d+ scope\(s\)/` and the word `archived` sits in the middle of it.
+            await expectRefusal(host.admin.deleteVertical(staff, 'retirable'), 'conflict', /still backs 1 scope\(s\) — delete or rebind/);
             await host.admin.archiveScope(staff, t2, sRet);
-            await expect(host.admin.deleteVertical(staff, 'retirable')).rejects.toThrow(/1 archived scope\(s\) — reap or restore/);
+            await expectRefusal(host.admin.deleteVertical(staff, 'retirable'), 'conflict', /1 archived scope\(s\) — reap or restore/);
             await host.admin.reapScope(staff, t2, sRet);
             await host.admin.deleteVertical(staff, 'retirable');
             expect((await host.admin.listVerticals(staff)).some((v) => v.slug === 'retirable')).toBe(false);
@@ -3104,7 +4153,7 @@ export function scopeHostContractSuite(adapterName, makeFixture, opts = {}) {
             await host.admin.rejectVersion(staff, versionId, 'permission diff widened a role');
             await expect(host.admin.bindScopeVersion(staff, t1, s1, versionId)).rejects.toThrow(/rejected, not admitted/);
             // Terminal: a rejected version is not resurrected, a new one is published.
-            await expect(host.admin.admitVersion(staff, versionId)).rejects.toThrow(/was rejected/);
+            await expectRefusal(host.admin.admitVersion(staff, versionId), 'conflict');
             const rejected = (await host.admin.listVersions(staff, 'callout')).find((v) => v.id === versionId);
             expect(rejected?.admissionNote).toContain('widened a role');
         });
@@ -3120,7 +4169,7 @@ export function scopeHostContractSuite(adapterName, makeFixture, opts = {}) {
             }
         });
         it('refuses a version for a vertical nobody registered', async () => {
-            await expect(host.admin.publishVersion(staff, {
+            await expectRefusal(host.admin.publishVersion(staff, {
                 id: ulid(),
                 verticalSlug: 'ghost',
                 version: '1.0.0',
@@ -3128,7 +4177,7 @@ export function scopeHostContractSuite(adapterName, makeFixture, opts = {}) {
                 permissionDigest: 'p',
                 migrationDigest: 'g',
                 deploymentRef: null,
-            })).rejects.toThrow(/unknown vertical/);
+            }), 'not_found');
         });
         // -- channels and promotion-time checkpoints (#31 step 2) ----------------
         // Promotion is the moment a change reaches anyone, so it is where §4's two
@@ -3871,6 +4920,124 @@ export function scopeHostContractSuite(adapterName, makeFixture, opts = {}) {
             expect(reactions).toHaveLength(2);
             expect(new Set(reactions.map((r) => r.caused_by)).size).toBe(2);
         });
+        // -- the invocation a DELIVERY belongs to (#1525) -------------------------
+        //
+        // #1237 put `invocation_id` on the outbox, which answers "which call emitted this
+        // event". A delivery joins to that through `event_id`, so the tempting reading is
+        // that deliveries needed nothing. What the event's id cannot say is which call
+        // attempted the DELIVERY — and for an executor those come apart by design: attempt
+        // one runs in the emitting call's post-commit tail, every retry after it in a drain
+        // that is a different call or none at all.
+        //
+        // Each test takes its own scope: they assert over the whole delivery log they read.
+        describe('the invocation a delivery belongs to (#1525)', () => {
+            const flowScope = async () => {
+                const s = scopeId.parse(ulid());
+                await host.provisionScope(staff, { tenantId: t1, scopeId: s, vertical: 'flow-vertical' });
+                await host.admin.activateScope(staff, t1, s);
+                return s;
+            };
+            it('stamps a consumer delivery with the invocation the call carried', async () => {
+                const s = await flowScope();
+                const stub = await host.getScope(alice, t1, s);
+                const call = ulid();
+                await stub.invoke('flow/produce', undefined, { invocationId: call });
+                // The VALUE, not merely the column: a delivery that recorded null here would
+                // satisfy every "the column exists" assertion and join to nothing.
+                const rows = (await stub.invoke('flow/deliveries'));
+                expect(rows).toHaveLength(2);
+                expect(rows.map((r) => r.invocation_id)).toEqual([call, call]);
+                // A SECOND call is a second id. The field is cleared after each invocation
+                // (#1237), so a leak would file this call's deliveries under the previous one
+                // — which a single-call assertion cannot see.
+                const next = ulid();
+                await stub.invoke('flow/produce', undefined, { invocationId: next });
+                const after = (await stub.invoke('flow/deliveries'));
+                expect(after).toHaveLength(4);
+                expect(after.filter((r) => r.invocation_id === call)).toHaveLength(2);
+                expect(after.filter((r) => r.invocation_id === next)).toHaveLength(2);
+            });
+            it('records null when the caller carried no invocation, and still delivers', async () => {
+                // A seed, a test, an internal call. Null is the honest answer — and the
+                // delivery itself must still happen and still be journalled, since a drain that
+                // failed because no id was carried is a far worse outcome than an unjoined row.
+                // The positive twin above shares this mechanism, so breaking the write reddens
+                // that one rather than leaving both green on a column nobody fills.
+                const s = await flowScope();
+                const stub = await host.getScope(alice, t1, s);
+                await stub.invoke('flow/produce');
+                const rows = (await stub.invoke('flow/deliveries'));
+                expect(rows).toHaveLength(2);
+                expect(rows.every((r) => r.invocation_id === null)).toBe(true);
+                expect(rows.every((r) => r.error === null)).toBe(true);
+            });
+            it('carries the delivery\'s invocation out through the effects walk', async () => {
+                // The column is written; this is what makes it reachable. `walkEventEffects`
+                // is the read that renders a delivery, so a column added to the store and
+                // missed there would leave the join invisible to every surface that shows one.
+                const s = await flowScope();
+                const stub = await host.getScope(alice, t1, s);
+                const call = ulid();
+                await stub.invoke('flow/produce', undefined, { invocationId: call });
+                const rows = (await stub.invoke('flow/causes'));
+                const step1 = rows.find((r) => r.type === 'flow.step1');
+                const tree = await host.admin.eventEffects(staff, t1, s, {
+                    eventId: eventId.parse(step1.id),
+                });
+                expect(tree.root.deliveries).not.toHaveLength(0);
+                expect(tree.root.deliveries.every((d) => d.invocationId === call)).toBe(true);
+            });
+            it('stamps an executor delivery with the call whose tail ran it', async () => {
+                // Executors are the half the event's own id could never have covered. On the
+                // hosted adapter this journal is written from the COORDINATOR over an RPC, so
+                // there is no ambient field to read and the id has to survive the hop.
+                const s = scopeId.parse(ulid());
+                await host.provisionScope(staff, {
+                    tenantId: t1,
+                    scopeId: s,
+                    vertical: 'connector-vertical',
+                });
+                await host.admin.activateScope(staff, t1, s);
+                const stub = await host.getScope(alice, t1, s);
+                const call = ulid();
+                await stub.invoke('connector/request-effect', { tag: 'inv-ok' }, { invocationId: call });
+                const emitted = await host.admin.invocationEvents(staff, t1, s, { invocationId: call });
+                const requested = emitted.events.find((e) => e.type === 'effect.requested');
+                const tree = await host.admin.eventEffects(staff, t1, s, { eventId: requested.id });
+                const delivery = tree.root.deliveries.find((d) => d.consumer === 'executor:flaky-effector');
+                expect(delivery).toBeDefined();
+                expect(delivery.state).toBe('delivered');
+                expect(delivery.invocationId).toBe(call);
+            });
+            it('files a RETRY under the call that re-attempted it, not the one that emitted', async () => {
+                // The test that proves this column is not a copy of the outbox's. A doomed
+                // executor is attempted once in the emitting call's tail and once more on a
+                // drain — and the drain is not a call. So the dead row's event still names the
+                // request that produced it while the attempt that gave up names none, which is
+                // exactly the pair `DeadLetter` could not previously tell apart.
+                const s = scopeId.parse(ulid());
+                await host.provisionScope(staff, {
+                    tenantId: t1,
+                    scopeId: s,
+                    vertical: 'connector-vertical',
+                });
+                await host.admin.activateScope(staff, t1, s);
+                const stub = await host.getScope(alice, t1, s);
+                const call = ulid();
+                await stub.invoke('connector/request-doomed', { tag: 'inv-doomed' }, { invocationId: call });
+                // maxAttempts 2: attempt one ran inline under `call`, attempt two runs here.
+                expect((await host.drainDue(t1, s)).deadLettered).toBe(1);
+                const page = await host.admin.deadLetters(staff, t1, s, {});
+                const dead = page.entries.find((d) => d.consumer === 'executor:doomed-effector');
+                expect(dead).toBeDefined();
+                // The EVENT still joins to the request that emitted it…
+                expect(dead.invocationId).toBe(call);
+                // …and the ATTEMPT that gave up names no call, because a drain is not one. An
+                // implementation that copied the event's id here would read `call` and claim a
+                // request had done something it did not do.
+                expect(dead.attemptInvocationId).toBeNull();
+            });
+        });
         it('creates a tenant record, idempotently; only real creates are audited', async () => {
             await host.admin.createTenant(staff, { id: t3, slug: 'acme-co', name: 'Acme Co' });
             await host.admin.createTenant(staff, { id: t3, slug: 'acme-co', name: 'Acme Co' }); // no-op
@@ -3986,6 +5153,9 @@ export function scopeHostContractSuite(adapterName, makeFixture, opts = {}) {
             await expect(host.admin.facetEvents(staff, t3, s, { groupBy: { kind: 'type' } })).rejects.toThrow(/reaped/);
             await expect(host.admin.entityHistory(staff, t3, s, { entityType: 'test-thing', entityId: 'x1' })).rejects.toThrow(/reaped/);
             await expect(host.admin.listScopeTables(staff, t3, s)).rejects.toThrow(/reaped/);
+            // #1524: a size read is refused BEFORE it reaches the storage. Addressing a reaped
+            // DO to ask its size would recreate an empty database and report that as the scope.
+            await expect(host.admin.scopeDatabaseSize(staff, t3, s)).rejects.toThrow(/reaped/);
             // Audited as reapScope against the right scope + actor.
             const reapEntry = (await host.admin.auditLog(staff, { tenantId: t3 })).find((r) => r.action === 'reapScope' && r.scopeId === s);
             expect(reapEntry?.actor).toBe(staff);