@substrat-run/contract-tests 0.134.0 → 0.136.0

package/dist/schedule-entitlement-suite.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"schedule-entitlement-suite.d.ts","sourceRoot":"","sources":["../src/schedule-entitlement-suite.ts"],"names":[],"mappings":"AAWA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,uBAAuB,CAAC;AAM9D;;;;;;;;;;;;;;;;;;;GAmBG;AACH,wBAAgB,gCAAgC,CAC9C,WAAW,EAAE,MAAM,EACnB,WAAW,EAAE,MAAM,OAAO,CAAC,gBAAgB,CAAC,GAC3C,IAAI,CAqFN"}

package/dist/schedule-entitlement-suite.js

@@ -0,0 +1,98 @@
+import { describe, it, expect, beforeAll, afterAll } from 'vitest';
+import { moduleId, permissionKey, platformActorId, principalId, scopeId, tenantId, } from '@substrat-run/contracts';
+import { ulid } from '@substrat-run/kernel';
+import { composedEngineMod, composerMod } from './modules.js';
+const ENGINE = moduleId.parse('@test/composed-engine');
+const COMPOSER = moduleId.parse('@test/composer');
+/**
+ * Contract suite for #1654: a COMPOSED engine's own declared schedule, on a tenant that
+ * holds the composing vertical's SKU and not the engine's.
+ *
+ * The §4.3 rule is "a module loads for a tenant only if the tenant holds its SKU flag".
+ * Its one exception is a module's own declared schedule fired through the system door,
+ * where the `system:<moduleId>` grant is the switch (#383) — the kernel's
+ * `requiredEntitlementFor`. Both adapters must agree on the exception AND on everything
+ * around it, so this suite pins the four edges together:
+ *
+ *   1. the engine's schedule fires without the engine's SKU;
+ *   2. a PRINCIPAL invoking the same operation is still refused — even holding the
+ *      permission — so the invoke surface does not widen;
+ *   3. the engine's system door is refused for an operation it does NOT declare as a
+ *      schedule, though its system principal would pass that operation's `ctx.check`;
+ *   4. another module's system door is refused for the engine's scheduled operation.
+ *
+ * `runDueSchedules` is called directly, never a sweep, so registering these modules
+ * changes no other suite's fired/skipped counts.
+ */
+export function scheduleEntitlementContractSuite(adapterName, makeFixture) {
+    describe(`composed-engine schedule entitlement (#1654): ${adapterName}`, () => {
+        let fixture;
+        let host;
+        const t = tenantId.parse(ulid());
+        const s = scopeId.parse(ulid());
+        const staff = platformActorId.parse(ulid());
+        // Holds the engine's permission through a role, so a refusal of this principal can
+        // only be the SKU gate — a permission refusal would prove nothing about the surface.
+        const user = principalId.parse(ulid());
+        beforeAll(async () => {
+            fixture = await makeFixture();
+            host = fixture.host;
+            host.registerModule(composedEngineMod);
+            host.registerModule(composerMod);
+            await host.admin.createTenant(staff, { id: t, slug: 'composer-co', name: 'Composer Co' });
+            // A standard install: the vertical's key only. Never the engine's.
+            await host.admin.grantEntitlement(staff, t, 'composer');
+            await host.provisionScope(staff, { tenantId: t, scopeId: s, vertical: 'composer-vertical' });
+            await host.admin.activateScope(staff, t, s);
+            await host.admin.defineRole(staff, t, {
+                key: 'sweeper',
+                permissions: [permissionKey.parse('composed-engine:sweep')],
+                source: 'vertical',
+            });
+            await host.admin.assignRole(staff, {
+                principalId: user,
+                roleKey: 'sweeper',
+                node: { tenantId: t, scopeId: null },
+            });
+        });
+        afterAll(async () => {
+            await fixture.cleanup();
+        });
+        const sweeps = async () => (await host.getScope(user, t, s)).invoke('composer/sweeps');
+        it("fires the engine's own schedule on a tenant holding only the vertical's key", async () => {
+            const report = await host.runDueSchedules(ENGINE, t, s);
+            expect(report.errors).toEqual([]);
+            expect(report.fired).toBe(1);
+            expect(report.failed).toBe(0);
+            expect(await sweeps()).toBe(1);
+        });
+        it("still refuses the engine's operation to a principal — the invoke surface does not widen", async () => {
+            const stub = await host.getScope(user, t, s);
+            const err = await stub.invoke('composed-engine/sweep').then(() => null, (e) => e.message);
+            expect(err).toMatch(/operation not entitled: composed-engine\/sweep/);
+            expect(err).toMatch(/does not hold 'composed-engine'/);
+            expect(await sweeps()).toBe(1);
+        });
+        it('still gates an operation the engine does not declare as a schedule, through its own system door', async () => {
+            // The system principal holds `composed-engine:sweep`, which is all `manual` checks:
+            // only the SKU gate stands between this call and a write.
+            const sys = await host.getSystemScope(ENGINE, t, s);
+            await expect(sys.invoke('composed-engine/manual')).rejects.toThrow(/operation not entitled: composed-engine\/manual/);
+            expect(await sweeps()).toBe(1);
+        });
+        it("never lends the exception to another module's system door", async () => {
+            const sys = await host.getSystemScope(COMPOSER, t, s);
+            await expect(sys.invoke('composed-engine/sweep')).rejects.toThrow(/operation not entitled: composed-engine\/sweep/);
+            expect(await sweeps()).toBe(1);
+        });
+        it("opens the principal's door once the tenant holds the engine's own key — the refusal above was the SKU", async () => {
+            await host.admin.grantEntitlement(staff, t, 'composed-engine');
+            const stub = await host.getScope(user, t, s);
+            await stub.invoke('composed-engine/sweep');
+            expect(await sweeps()).toBe(2);
+            await host.admin.revokeEntitlement(staff, t, 'composed-engine');
+            await expect(stub.invoke('composed-engine/sweep')).rejects.toThrow(/not entitled/);
+        });
+    });
+}
+//# sourceMappingURL=schedule-entitlement-suite.js.map

package/dist/schedule-entitlement-suite.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"schedule-entitlement-suite.js","sourceRoot":"","sources":["../src/schedule-entitlement-suite.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,MAAM,EAAE,SAAS,EAAE,QAAQ,EAAE,MAAM,QAAQ,CAAC;AACnE,OAAO,EACL,QAAQ,EACR,aAAa,EACb,eAAe,EACf,WAAW,EACX,OAAO,EACP,QAAQ,GAET,MAAM,yBAAyB,CAAC;AACjC,OAAO,EAAE,IAAI,EAAkB,MAAM,sBAAsB,CAAC;AAE5D,OAAO,EAAE,iBAAiB,EAAE,WAAW,EAAE,MAAM,cAAc,CAAC;AAE9D,MAAM,MAAM,GAAG,QAAQ,CAAC,KAAK,CAAC,uBAAuB,CAAC,CAAC;AACvD,MAAM,QAAQ,GAAG,QAAQ,CAAC,KAAK,CAAC,gBAAgB,CAAC,CAAC;AAElD;;;;;;;;;;;;;;;;;;;GAmBG;AACH,MAAM,UAAU,gCAAgC,CAC9C,WAAmB,EACnB,WAA4C;IAE5C,QAAQ,CAAC,iDAAiD,WAAW,EAAE,EAAE,GAAG,EAAE;QAC5E,IAAI,OAAyB,CAAC;QAC9B,IAAI,IAAe,CAAC;QACpB,MAAM,CAAC,GAAG,QAAQ,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC;QACjC,MAAM,CAAC,GAAG,OAAO,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC;QAChC,MAAM,KAAK,GAAG,eAAe,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC;QAC5C,mFAAmF;QACnF,qFAAqF;QACrF,MAAM,IAAI,GAAgB,WAAW,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC;QAEpD,SAAS,CAAC,KAAK,IAAI,EAAE;YACnB,OAAO,GAAG,MAAM,WAAW,EAAE,CAAC;YAC9B,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC;YACpB,IAAI,CAAC,cAAc,CAAC,iBAAiB,CAAC,CAAC;YACvC,IAAI,CAAC,cAAc,CAAC,WAAW,CAAC,CAAC;YACjC,MAAM,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,KAAK,EAAE,EAAE,EAAE,EAAE,CAAC,EAAE,IAAI,EAAE,aAAa,EAAE,IAAI,EAAE,aAAa,EAAE,CAAC,CAAC;YAC1F,mEAAmE;YACnE,MAAM,IAAI,CAAC,KAAK,CAAC,gBAAgB,CAAC,KAAK,EAAE,CAAC,EAAE,UAAU,CAAC,CAAC;YACxD,MAAM,IAAI,CAAC,cAAc,CAAC,KAAK,EAAE,EAAE,QAAQ,EAAE,CAAC,EAAE,OAAO,EAAE,CAAC,EAAE,QAAQ,EAAE,mBAAmB,EAAE,CAAC,CAAC;YAC7F,MAAM,IAAI,CAAC,KAAK,CAAC,aAAa,CAAC,KAAK,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC;YAC5C,MAAM,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,KAAK,EAAE,CAAC,EAAE;gBACpC,GAAG,EAAE,SAAS;gBACd,WAAW,EAAE,CAAC,aAAa,CAAC,KAAK,CAAC,uBAAuB,CAAC,CAAC;gBAC3D,MAAM,EAAE,UAAU;aACnB,CAAC,CAAC;YACH,MAAM,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,KAAK,EAAE;gBACjC,WAAW,EAAE,IAAI;gBACjB,OAAO,EAAE,SAAS;gBAClB,IAAI,EAAE,EAAE,QAAQ,EAAE,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE;aACrC,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;QAEH,QAAQ,CAAC,KAAK,IAAI,EAAE;YAClB,MAAM,OAAO,CAAC,OAAO,EAAE,CAAC;QAC1B,CAAC,CAAC,CAAC;QAEH,MAAM,MAAM,GAAG,KAAK,IAAI,EAAE,CAAC,CAAC,MAAM,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,MAAM,CAAS,iBAAiB,CAAC,CAAC;QAE/F,EAAE,CAAC,6EAA6E,EAAE,KAAK,IAAI,EAAE;YAC3F,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,eAAe,CAAC,MAAM,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC;YACxD,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;YAClC,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YAC7B,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YAC9B,MAAM,CAAC,MAAM,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QACjC,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,yFAAyF,EAAE,KAAK,IAAI,EAAE;YACvG,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC;YAC7C,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,uBAAuB,CAAC,CAAC,IAAI,CACzD,GAAG,EAAE,CAAC,IAAI,EACV,CAAC,CAAQ,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CACxB,CAAC;YACF,MAAM,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC,gDAAgD,CAAC,CAAC;YACtE,MAAM,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC,iCAAiC,CAAC,CAAC;YACvD,MAAM,CAAC,MAAM,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QACjC,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,iGAAiG,EAAE,KAAK,IAAI,EAAE;YAC/G,oFAAoF;YACpF,0DAA0D;YAC1D,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,MAAM,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC;YACpD,MAAM,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,wBAAwB,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CAChE,iDAAiD,CAClD,CAAC;YACF,MAAM,CAAC,MAAM,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QACjC,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,2DAA2D,EAAE,KAAK,IAAI,EAAE;YACzE,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,QAAQ,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC;YACtD,MAAM,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,uBAAuB,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CAC/D,gDAAgD,CACjD,CAAC;YACF,MAAM,CAAC,MAAM,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QACjC,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,uGAAuG,EAAE,KAAK,IAAI,EAAE;YACrH,MAAM,IAAI,CAAC,KAAK,CAAC,gBAAgB,CAAC,KAAK,EAAE,CAAC,EAAE,iBAAiB,CAAC,CAAC;YAC/D,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC;YAC7C,MAAM,IAAI,CAAC,MAAM,CAAC,uBAAuB,CAAC,CAAC;YAC3C,MAAM,CAAC,MAAM,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YAC/B,MAAM,IAAI,CAAC,KAAK,CAAC,iBAAiB,CAAC,KAAK,EAAE,CAAC,EAAE,iBAAiB,CAAC,CAAC;YAChE,MAAM,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,uBAAuB,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,cAAc,CAAC,CAAC;QACrF,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;AACL,CAAC"}

package/dist/scope-host-suite.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"scope-host-suite.d.ts","sourceRoot":"","sources":["../src/scope-host-suite.ts"],"names":[],"mappings":"AAEA,OAAO,EAkBL,KAAK,SAAS,EAYf,MAAM,yBAAyB,CAAC;AACjC,OAAO,EAWL,KAAK,SAAS,EACf,MAAM,sBAAsB,CAAC;AAW9B,MAAM,WAAW,gBAAgB;IAC/B,IAAI,EAAE,SAAS,CAAC;IAChB;;;;;OAKG;IACH,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,OAAO,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;CAC1B;AA2BD;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,eAAO,MAAM,aAAa,MACrB,OAAO,CAAC,OAAO,CAAC,QACb,SAAS,YACL,MAAM,KACf,OAAO,CAAC,IAAI,CAOd,CAAC;AAEF,iFAAiF;AACjF,MAAM,WAAW,qBAAqB;IACpC;;;;;;OAMG;IACH,2BAA2B,CAAC,EAAE,OAAO,CAAC;CACvC;AAED;;;;;GAKG;AACH,wBAAgB,sBAAsB,CACpC,WAAW,EAAE,MAAM,EACnB,WAAW,EAAE,MAAM,OAAO,CAAC,gBAAgB,CAAC,EAC5C,IAAI,GAAE,qBAA0B,GAC/B,IAAI,CAspQN"}
+{"version":3,"file":"scope-host-suite.d.ts","sourceRoot":"","sources":["../src/scope-host-suite.ts"],"names":[],"mappings":"AAEA,OAAO,EAkBL,KAAK,SAAS,EAYf,MAAM,yBAAyB,CAAC;AACjC,OAAO,EAaL,KAAK,SAAS,EACf,MAAM,sBAAsB,CAAC;AAW9B,MAAM,WAAW,gBAAgB;IAC/B,IAAI,EAAE,SAAS,CAAC;IAChB;;;;;OAKG;IACH,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,OAAO,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;CAC1B;AA2BD;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,eAAO,MAAM,aAAa,MACrB,OAAO,CAAC,OAAO,CAAC,QACb,SAAS,YACL,MAAM,KACf,OAAO,CAAC,IAAI,CAOd,CAAC;AAEF,iFAAiF;AACjF,MAAM,WAAW,qBAAqB;IACpC;;;;;;OAMG;IACH,2BAA2B,CAAC,EAAE,OAAO,CAAC;CACvC;AAED;;;;;GAKG;AACH,wBAAgB,sBAAsB,CACpC,WAAW,EAAE,MAAM,EACnB,WAAW,EAAE,MAAM,OAAO,CAAC,gBAAgB,CAAC,EAC5C,IAAI,GAAE,qBAA0B,GAC/B,IAAI,CA0hRN"}

package/dist/scope-host-suite.js

@@ -1,7 +1,7 @@
 import { describe, it, expect, beforeAll, afterAll } from 'vitest';
 import { connectorCalls, connectorTestFetch, resetConnectorCalls } from './connector-fixture.js';
 import { connectionId, dataSubjectId, domainEvent, errorCodeOf, eventId, instant, moduleManifest, orgId, AUTO_ADMISSION_NOTE, permissionKey, platformActorId, platformRequestId, principalId, scopeId, tenantId, SCOPE_QUERY_ROW_MAX, KERNEL_AUTHORED_EVENT_TYPES, SWEEP_RUNS_KIND, SCOPE_TABLE_PAGE_MAX, } from '@substrat-run/contracts';
-import { isSearchIndexTable, platformIntentFailureMessage, REDACTED_DELIVERY_NOTE, REDACTED_FAILURE_NOTE, REDACTED_INTENT_MARKER, runPlatformSweep, startPlatformSweeper, ulid, } from '@substrat-run/kernel';
+import { INERT_SCOPE_REASON, isSearchIndexTable, platformIntentFailureMessage, REDACTED_DELIVERY_NOTE, REDACTED_FAILURE_NOTE, REDACTED_INTENT_MARKER, runPlatformSweep, startPlatformSweeper, createUlid, ulid, } from '@substrat-run/kernel';
 import { billedMod, contractTestBareOps, contractTestInitialModules, gateModManifest, lateMod, testModManifest, victimModManifest, } from './modules.js';
 /**
  * Assert a refusal by the CODE it declared, not by the sentence it happens to carry
@@ -376,6 +376,253 @@ export function scopeHostContractSuite(adapterName, makeFixture, opts = {}) {
             expect(settled.lastError).toMatch(/personal number field/);
             expect(settled.payload).toEqual({ contract: 'c1' });
         });
+        /**
+         * #1686. The platform's drain walks every active scope, and a fork, a snapshot or a preview
+         * is one, so an intent copied while still pending would be executed a second time from the
+         * copy: an email sent twice, a connector delivery repeated. `listPlatformRequests` is the
+         * drain's one read, so what it returns on the copy is exactly what a drain would run.
+         */
+        describe("a copy never runs the source's pending intents (#1686)", () => {
+            let source;
+            let id;
+            const pendingAt = async (s) => (await host.listPlatformRequests(t1, s)).map((r) => r.id);
+            const historyAt = async (s) => (await host.listPlatformRequestHistory(t1, s)).find((r) => r.id === id);
+            /** The copy: the intent is not drainable there, and its journal says why. */
+            const notCarriedAt = async (copy) => {
+                expect(await pendingAt(copy)).not.toContain(id);
+                expect(await historyAt(copy)).toMatchObject({
+                    status: 'failed',
+                    failure: { origin: 'platform', code: 'precondition_failed', permission: null },
+                    lastError: expect.stringMatching(new RegExp(`^not carried: copied from scope ${source}`)),
+                    settledAt: expect.any(String),
+                });
+                // The twin: the source still holds it pending, for its own drain.
+                expect(await pendingAt(source)).toContain(id);
+            };
+            beforeAll(async () => {
+                source = scopeId.parse(ulid());
+                await host.provisionScope(staff, { tenantId: t1, scopeId: source, jurisdiction: 'eu', vertical: 'connector-vertical' });
+                await host.admin.activateScope(staff, t1, source);
+                id = await (await host.getScope(alice, t1, source)).invoke('platform/request', {
+                    kind: 'provision-sibling',
+                    payload: { slug: 'copied' },
+                });
+                expect(await pendingAt(source)).toContain(id);
+            });
+            it('a fork (importScope) settles it not-carried; the source keeps it pending', async () => {
+                const fork = scopeId.parse(ulid());
+                await host.importScope(staff, { tenantId: t1, scopeId: fork, jurisdiction: 'eu', vertical: 'connector-vertical' }, await host.admin.exportScope(staff, t1, source));
+                await notCarriedAt(fork);
+            });
+            it('a snapshot (snapshotScope): the same', async () => {
+                await notCarriedAt(await host.snapshotScope(staff, t1, source, { kind: 'preview' }));
+            });
+            it("a restore of the source's backup onto another scope: the same", async () => {
+                const other = scopeId.parse(ulid());
+                await host.provisionScope(staff, { tenantId: t1, scopeId: other, jurisdiction: 'eu', vertical: 'connector-vertical' });
+                await host.admin.activateScope(staff, t1, other);
+                await host.restoreScope(staff, t1, other, await host.admin.exportScope(staff, t1, source));
+                await notCarriedAt(other);
+            });
+            it('a restore into the scope the backup came from keeps it pending, payload and all', async () => {
+                await host.restoreScope(staff, t1, source, await host.admin.exportScope(staff, t1, source));
+                const back = (await host.listPlatformRequests(t1, source)).find((r) => r.id === id);
+                expect(back).toMatchObject({ status: 'pending', payload: { slug: 'copied' }, lastError: null, settledAt: null });
+            });
+        });
+        /**
+         * #1686, the rest of the queue. Delivery is "no delivery row yet", so an event the source
+         * emitted and nobody reached is owed work in the copy too, and an executor retry is due work.
+         * The dump below is the source's own export with the journal set back: the consumer's row
+         * for one event removed (never delivered), one executor delivery made due for a retry, and
+         * another removed (never attempted).
+         */
+        describe('a copy never runs work the source queued (#1686)', () => {
+            let source;
+            let queued;
+            let step1;
+            const count = (tag) => effected.filter((e) => e === tag).length;
+            const logOf = async (s) => (await (await host.getScope(alice, t1, s)).invoke('flow/log')).map((r) => r.event_id);
+            /**
+             * The events whose executor delivery a copy journaled INERT (#2005): its own work, which
+             * reached dispatch — so `emittedHere` let it through — and was then held, because a copy
+             * causes no outbound effects. The source's work never reaches dispatch at all.
+             */
+            const inertIn = async (s) => (await host.executorDeadLetters(t1, s)).filter((d) => d.error === INERT_SCOPE_REASON).map((d) => d.eventId);
+            const eventIdOf = async (s, entityId) => {
+                const outbox = (await host.admin.exportScope(staff, t1, s)).tables.find((t) => t.name === '_substrat_outbox');
+                return String(outbox.rows.find((r) => r[outbox.columns.indexOf('entity_id')] === entityId)[outbox.columns.indexOf('id')]);
+            };
+            const activeScope = async () => {
+                const s = scopeId.parse(ulid());
+                await host.provisionScope(staff, { tenantId: t1, scopeId: s, jurisdiction: 'eu', vertical: 'connector-vertical' });
+                await host.admin.activateScope(staff, t1, s);
+                return s;
+            };
+            beforeAll(async () => {
+                source = await activeScope();
+                const stub = await host.getScope(alice, t1, source);
+                await stub.invoke('flow/produce');
+                await stub.invoke('connector/request-effect', { tag: 'copy-retry' });
+                await stub.invoke('connector/request-effect', { tag: 'copy-unattempted' });
+                // The source ran all three: the consumer logged step1, the executor effected both.
+                expect(count('copy-retry')).toBe(1);
+                expect(count('copy-unattempted')).toBe(1);
+                const dump = await host.admin.exportScope(staff, t1, source);
+                const outbox = dump.tables.find((t) => t.name === '_substrat_outbox');
+                const col = (name) => outbox.columns.indexOf(name);
+                const idOf = (type, entityId) => String(outbox.rows.find((r) => r[col('type')] === type && r[col('entity_id')] === entityId)[col('id')]);
+                step1 = idOf('flow.step1', 'f1');
+                const retry = idOf('effect.requested', 'copy-retry');
+                const unattempted = idOf('effect.requested', 'copy-unattempted');
+                expect(await logOf(source)).toContain(step1);
+                queued = {
+                    ...dump,
+                    tables: dump.tables.map((t) => {
+                        // The consumer's own record of the delivery goes with the delivery row.
+                        if (t.name === 'flow_log')
+                            return { ...t, rows: [] };
+                        if (t.name !== '_substrat_deliveries')
+                            return t;
+                        const at = (name) => t.columns.indexOf(name);
+                        const rows = t.rows
+                            .filter((r) => !(r[at('event_id')] === step1 && r[at('consumer_module')] === '@test/flow'))
+                            .filter((r) => r[at('event_id')] !== unattempted)
+                            .map((r) => {
+                            if (r[at('event_id')] !== retry)
+                                return r;
+                            const due = [...r];
+                            due[at('error')] = 'boom';
+                            due[at('attempts')] = 1;
+                            due[at('next_attempt_at')] = '2000-01-01T00:00:00.000Z';
+                            return due;
+                        });
+                        return { ...t, rows };
+                    }),
+                };
+            });
+            it('a fork: no consumer reaches the copied event and no executor runs, on dispatch or on drainDue', async () => {
+                const fork = scopeId.parse(ulid());
+                await host.importScope(staff, { tenantId: t1, scopeId: fork, jurisdiction: 'eu', vertical: 'connector-vertical' }, queued);
+                const stub = await host.getScope(alice, t1, fork);
+                await stub.invoke('flow/log'); // an invocation in the copy dispatches
+                await host.drainDue(t1, fork);
+                expect(count('copy-retry')).toBe(1);
+                expect(count('copy-unattempted')).toBe(1);
+                // The consumer never ran on the copied event.
+                expect(await logOf(fork)).toEqual([]);
+                expect(await host.listPlatformRequests(t1, fork)).toEqual([]);
+                // The retry reads settled, saying why, rather than vanishing.
+                const settled = (await host.executorDeadLetters(t1, fork)).find((d) => d.executorId === 'flaky-effector');
+                expect(settled?.error).toMatch(new RegExp(`^not carried: copied from scope ${source}`));
+                // Nor does it ship the source's events to Tier 2 again: the drain's read is empty here,
+                // while the source's own read still holds them.
+                expect(await host.admin.readUndrainedEvents(staff, t1, fork, 200)).toHaveLength(0);
+                expect((await host.admin.readUndrainedEvents(staff, t1, source, 200)).map((e) => e.id)).toContain(step1);
+                // The twin: work the copy creates itself flows as it always did, to Tier 2 included.
+                await stub.invoke('flow/produce');
+                expect((await host.admin.readUndrainedEvents(staff, t1, fork, 200)).map((e) => e.type)).toContain('flow.step1');
+                const own = await logOf(fork);
+                expect(own).toHaveLength(2); // its own step1, and the step2 that consumer emitted
+                expect(own).not.toContain(step1);
+                // Its own executor work reaches dispatch too, and is held there: a fork is inert (#2005).
+                await stub.invoke('connector/request-effect', { tag: 'fork-own' });
+                expect(count('fork-own')).toBe(0);
+                expect(await inertIn(fork)).toEqual([await eventIdOf(fork, 'fork-own')]);
+            });
+            it("the copy's own events still sort above a copied event stamped by a clock that ran ahead", async () => {
+                // A copied event from a source whose clock was ahead: without the loader re-seeding the
+                // copy's id floor from the outbox it brought, the copy's next event would sort below the
+                // mark and be withheld as if it were the source's.
+                const ahead = createUlid()(Date.parse('2099-01-01T00:00:00.000Z'));
+                const withAhead = {
+                    ...queued,
+                    tables: queued.tables.map((t) => {
+                        if (t.name !== '_substrat_outbox')
+                            return t;
+                        const at = (name) => t.columns.indexOf(name);
+                        const template = t.rows.find((r) => r[at('type')] === 'effect.requested');
+                        const future = [...template];
+                        future[at('id')] = ahead;
+                        future[at('entity_id')] = 'copy-ahead';
+                        future[at('payload')] = JSON.stringify({ tag: 'copy-ahead' });
+                        return { ...t, rows: [...t.rows, future] };
+                    }),
+                };
+                const fork = scopeId.parse(ulid());
+                await host.importScope(staff, { tenantId: t1, scopeId: fork, jurisdiction: 'eu', vertical: 'connector-vertical' }, withAhead);
+                await (await host.getScope(alice, t1, fork)).invoke('connector/request-effect', { tag: 'fork-after-ahead' });
+                // The copy's own event reached dispatch (held inert there, #2005); the copied one did not.
+                expect(await inertIn(fork)).toEqual([await eventIdOf(fork, 'fork-after-ahead')]);
+                expect(count('fork-after-ahead')).toBe(0);
+                expect(count('copy-ahead')).toBe(0);
+            });
+            it('a snapshot: the same', async () => {
+                const snap = scopeId.parse(ulid());
+                await host.importScope(staff, { tenantId: t1, scopeId: snap, jurisdiction: 'eu', vertical: 'connector-vertical' }, queued);
+                await host.drainDue(t1, snap);
+                await (await host.getScope(alice, t1, snap)).invoke('flow/log');
+                expect(count('copy-retry')).toBe(1);
+                expect(count('copy-unattempted')).toBe(1);
+                expect(await logOf(snap)).toEqual([]);
+            });
+            /** A scope's export with one executor delivery removed, so that event is owed again. */
+            const owing = async (s, entityId) => {
+                const dump = await host.admin.exportScope(staff, t1, s);
+                const outbox = dump.tables.find((t) => t.name === '_substrat_outbox');
+                const id = outbox.rows.find((r) => r[outbox.columns.indexOf('entity_id')] === entityId)[outbox.columns.indexOf('id')];
+                return {
+                    ...dump,
+                    tables: dump.tables.map((t) => t.name === '_substrat_deliveries' ? { ...t, rows: t.rows.filter((r) => r[t.columns.indexOf('event_id')] !== id) } : t),
+                };
+            };
+            it("a copy of a copy runs neither source's work; the copy's own backup, returned, runs only its own", async () => {
+                const first = scopeId.parse(ulid());
+                await host.importScope(staff, { tenantId: t1, scopeId: first, jurisdiction: 'eu', vertical: 'connector-vertical' }, queued);
+                await (await host.getScope(alice, t1, first)).invoke('connector/request-effect', { tag: 'first-own' });
+                // A copy's own work reaches dispatch and is held inert there (#2005), never effected.
+                const firstOwn = await eventIdOf(first, 'first-own');
+                expect(await inertIn(first)).toEqual([firstOwn]);
+                const firstsBackup = await owing(first, 'first-own');
+                // copy → copy: the second copy's mark is above the first copy's own events too.
+                const second = scopeId.parse(ulid());
+                await host.importScope(staff, { tenantId: t1, scopeId: second, jurisdiction: 'eu', vertical: 'connector-vertical' }, firstsBackup);
+                await (await host.getScope(alice, t1, second)).invoke('flow/log');
+                await host.drainDue(t1, second);
+                expect(count('copy-retry')).toBe(1);
+                expect(count('copy-unattempted')).toBe(1);
+                // The first copy's own event is the second's INHERITED work: it never reaches dispatch.
+                expect(await inertIn(second)).toEqual([]);
+                await (await host.getScope(alice, t1, second)).invoke('connector/request-effect', { tag: 'second-own' });
+                expect(await inertIn(second)).toEqual([await eventIdOf(second, 'second-own')]);
+                // The first copy's backup returned to it: its own owed event runs, and the source's
+                // still do not, because the copy's origin came back with its backup.
+                await host.restoreScope(staff, t1, first, firstsBackup);
+                expect(await inertIn(first)).toEqual([]); // the backup had its delivery row removed
+                await (await host.getScope(alice, t1, first)).invoke('flow/log');
+                await host.drainDue(t1, first);
+                // Owed again and the first copy's own, so it reaches dispatch again: held inert (#2005).
+                expect(await inertIn(first)).toEqual([firstOwn]);
+                expect(count('first-own')).toBe(0);
+                expect(count('copy-retry')).toBe(1);
+                expect(count('copy-unattempted')).toBe(1);
+                expect(await logOf(first)).toEqual([]);
+            });
+            it('a return (the same dump restored into its own scope) runs all of it — from a dump that predates the origin table too', async () => {
+                // A backup taken before `_substrat_copy_origin` existed: the loader builds the table from
+                // the kernel's DDL, as every wake does on an existing scope, and no row means nothing here
+                // was copied.
+                const legacy = { ...queued, tables: queued.tables.filter((t) => t.name !== '_substrat_copy_origin') };
+                expect(legacy.tables.length).toBe(queued.tables.length - 1);
+                await host.restoreScope(staff, t1, source, legacy);
+                expect((await host.admin.listScopeTables(staff, t1, source)).map((t) => t.name)).toContain('_substrat_copy_origin');
+                await (await host.getScope(alice, t1, source)).invoke('flow/log');
+                await host.drainDue(t1, source);
+                expect(count('copy-retry')).toBe(2);
+                expect(count('copy-unattempted')).toBe(2);
+                expect(await logOf(source)).toContain(step1);
+            });
+        });
         /**
          * #1588. Every read of the intent journal returns a LIST, and the row decode behind all
          * three was strict — so ONE row whose JSON would not parse threw out of the map and took
@@ -1606,6 +1853,47 @@ export function scopeHostContractSuite(adapterName, makeFixture, opts = {}) {
             // `test/move` leads to two states where it is legal, so the attempt is not one of them.
             expect(flow.refused).toEqual([{ from: 'done', attempted: null, operation: 'test/move', count: 2, actors: { principal: 2 } }]);
         });
+        it('reads a refused transition back as a row — record, states, actor, call — like a denial (#1745)', async () => {
+            // A record of its own and a call id of its own, so the case above does not leak in.
+            const stub = await host.getScope(alice, t1, s1);
+            const call = ulid();
+            await expect(stub.invoke('test/refuse', { entityId: 'r2', from: 'done' }, { invocationId: call })).rejects.toThrow(/invalid transition/);
+            const rows = await host.admin.listRefusals(staff, t1, s1, { entityType: 'test-lifecycle', entityId: 'r2' });
+            expect(rows).toHaveLength(1);
+            expect(rows[0]).toMatchObject({
+                kind: 'transition',
+                reason: 'invalid_transition',
+                actor: alice,
+                actorKind: 'principal',
+                tenantId: t1,
+                scopeId: s1,
+                entityType: 'test-lifecycle',
+                entityId: 'r2',
+                fromState: 'done',
+                attemptedState: null,
+                operation: 'test/move',
+                invokedOperation: 'test/refuse',
+                impersonation: null,
+                invocationId: call,
+                drainedAt: null,
+            });
+            expect(rows[0].decodeError).toBeUndefined();
+            // The row survived the operation's rollback — and the operation itself left nothing
+            // behind in the outbox for that call.
+            expect((await host.admin.invocationEvents(staff, t1, s1, { invocationId: call })).events).toEqual([]);
+            // Narrowed like the denial log: by call, by actor, by window; newest first, bounded.
+            expect(await host.admin.listRefusals(staff, t1, s1, { invocationId: call })).toHaveLength(1);
+            expect(await host.admin.listRefusals(staff, t1, s1, { invocationId: ulid() })).toEqual([]);
+            const all = await host.admin.listRefusals(staff, t1, s1, { actor: alice });
+            expect(all.length).toBeGreaterThanOrEqual(3); // r1 twice (the case above) + r2
+            expect(all[0].entityId).toBe('r2');
+            expect(await host.admin.listRefusals(staff, t1, s1, { until: all[all.length - 1].at })).toEqual([]);
+            expect(await host.admin.listRefusals(staff, t1, s1, { limit: 1 })).toHaveLength(1);
+            // K-24: the read is recorded; K-3: a mismatched pair is refused, never another tenant's log.
+            const logged = await host.admin.accessLog(staff, { tenantId: t1, method: 'listRefusals' });
+            expect(logged.length).toBeGreaterThan(0);
+            await expect(host.admin.listRefusals(staff, t2, s1)).rejects.toThrow();
+        });
         // -- scope data introspection: the §5.4 admin-query RPC --------------------
         //
         // A read-only window into a scope's OWN database (the console/dashboard Data
@@ -2643,9 +2931,12 @@ export function scopeHostContractSuite(adapterName, makeFixture, opts = {}) {
                 const dump = await host.admin.exportScope(staff, t1, s1);
                 const copy = scopeId.parse(ulid());
                 await host.importScope(staff, { tenantId: t1, scopeId: copy, jurisdiction: 'eu', vertical: 'connector-vertical' }, dump);
-                // Same tables and row counts as the source (the spine came across too).
-                const src = (await host.admin.listScopeTables(staff, t1, s1))
-                    .map((t) => `${t.name}:${t.rowCount}`)
+                // Same tables and row counts as the source (the spine came across too), but for the one
+                // row every copy adds: where it came from, and the mark (#1686, and #2005: an empty copy
+                // holds it too, which is how a host with no directory knows a copy).
+                const srcTables = await host.admin.listScopeTables(staff, t1, s1);
+                const src = srcTables
+                    .map((t) => (t.name === '_substrat_copy_origin' ? `${t.name}:1` : `${t.name}:${t.rowCount}`))
                     .sort();
                 const dst = (await host.admin.listScopeTables(staff, t1, copy))
                     .map((t) => `${t.name}:${t.rowCount}`)
@@ -4413,6 +4704,37 @@ export function scopeHostContractSuite(adapterName, makeFixture, opts = {}) {
             await host.admin.bindScopeVersion(staff, t1, s, v1); // legacy unconditional caller
             expect((await host.admin.getScopeRecord(staff, t1, s)).verticalVersionId).toBe(v1);
         });
+        // #1722 (Codex #2008 r7): the admin-log record of a staff resolution of a kept copy. The
+        // resolution itself runs in the vertical's store; the directory only records it, in full.
+        it('records a kept-copy resolution in the admin log, before and after, and refuses an unknown scope', async () => {
+            const s = scopeId.parse(ulid());
+            await host.provisionScope(staff, { tenantId: t1, scopeId: s, vertical: 'demo' });
+            await host.admin.recordKeptCopyResolution(staff, t1, s, {
+                action: 'restore-forward',
+                script: 'demo-v1',
+                liveScript: 'demo-v2',
+                keptAt: '2026-10-03T12:00:00.000Z',
+                revisionBefore: '41',
+                revisionAfter: '7',
+            });
+            const [row] = await host.admin.auditLog(staff, { action: 'resolveKeptCopy', scopeId: s });
+            expect(row).toMatchObject({
+                actor: staff,
+                action: 'resolveKeptCopy',
+                before: { script: 'demo-v1', keptAt: '2026-10-03T12:00:00.000Z', revision: '41' },
+                after: { action: 'restore-forward', liveScript: 'demo-v2', revision: '7' },
+            });
+            const other = scopeId.parse(ulid());
+            await expect(host.admin.recordKeptCopyResolution(staff, t1, other, {
+                action: 'discard',
+                script: 'demo-v1',
+                liveScript: null,
+                keptAt: '2026-10-03T12:00:00.000Z',
+                revisionBefore: null,
+                revisionAfter: null,
+            })).rejects.toThrow(/unknown scope/);
+            expect(await host.admin.auditLog(staff, { action: 'resolveKeptCopy', scopeId: other })).toEqual([]);
+        });
         it('publishes a version as pending, and refuses to bind it until admitted', async () => {
             const versionId = ulid();
             await host.admin.registerVertical(staff, {
@@ -4977,6 +5299,25 @@ export function scopeHostContractSuite(adapterName, makeFixture, opts = {}) {
             const rejected = (await host.admin.listVersions(staff, 'callout')).find((v) => v.id === versionId);
             expect(rejected?.admissionNote).toContain('widened a role');
         });
+        it('refuses to reject a version that is already admitted, and leaves it admitted', async () => {
+            // `conflict` (#113 phase 6): the version may already be bound, so admission is one-way
+            // from here. Rejecting an admitted version is the one refusal `rejectVersion` makes.
+            const versionId = ulid();
+            await host.admin.publishVersion(staff, {
+                id: versionId,
+                verticalSlug: 'callout',
+                version: '1.1.0-vouched',
+                manifestDigest: 'm3',
+                permissionDigest: 'p3',
+                migrationDigest: 'g3',
+                deploymentRef: null,
+            });
+            await host.admin.admitVersion(staff, versionId);
+            await expectRefusal(host.admin.rejectVersion(staff, versionId, 'changed my mind'), 'conflict');
+            const after = (await host.admin.listVersions(staff, 'callout')).find((v) => v.id === versionId);
+            expect(after?.admission).toBe('admitted');
+            expect(after?.admissionNote).toBeNull();
+        });
         it('carries the digests promotion compares', async () => {
             // "Has the permission surface changed between what is in prod and what I am
             // promoting?" is a string comparison here. Today it is a person remembering
@@ -5069,6 +5410,17 @@ export function scopeHostContractSuite(adapterName, makeFixture, opts = {}) {
             });
             await expectRefusal(host.admin.promoteVersion(staff, 'callout', 'prod', pending), 'conflict');
         });
+        it('refuses to promote a version through a vertical that does not own it', async () => {
+            // `conflict` (#113 phase 6). The version is real and admitted — it is the pairing that
+            // is wrong — so this is neither `not_found` (the version exists) nor a state to wait out.
+            const v = await publish('2.9.0', { perm: 'pZ', mig: 'gZ' });
+            await host.admin.registerVertical(staff, { slug: 'elsewhere', name: 'Elsewhere', source: 'builtin' });
+            await expectRefusal(host.admin.promoteVersion(staff, 'elsewhere', 'prod', v), 'conflict');
+            // Positive twin: through its own vertical the same version promotes (the earlier tests
+            // moved prod, so the digest checkpoints are acknowledged — they are not under test here).
+            await host.admin.promoteVersion(staff, 'callout', 'prod', v, { permissionChange: true, migrationChange: true });
+            expect((await host.admin.listChannels(staff, 'callout')).find((c) => c.channel === 'prod')?.versionId).toBe(v);
+        });
         // -- private verticals: self-serve prod (builder-plane.md §4-revised) ----
         // A private vertical's blast radius is its own tenant — dev/staging already
         // run the same bundle in the same sandbox — so its versions self-admit on