@substrat-run/kernel 0.137.0 → 0.138.0

package/dist/read-only-sql.js

@@ -1,3 +1,4 @@
+import { substratError } from '@substrat-run/contracts';
 /**
  * The textual gate in front of the scope SQL console (`HostAdmin.queryScope`, #219).
  *
@@ -46,10 +47,13 @@ const FORBIDDEN = new Set([
     'savepoint',
     'release',
 ]);
+/** The gate's refusal: the caller's mistake (`validation_failed`), under the `read-only console:` prefix. */
+const refuse = (reason) => substratError('validation_failed', `read-only console: ${reason}`);
+const SINGLE_STATEMENT = 'only a single statement is allowed';
 /**
  * Assert `sql` is one read-only statement; returns the trimmed statement to run.
- * Throws an `Error` whose message names the offending token — it crosses the RPC
- * boundary and lands in the console UI, so it is written for the person typing.
+ * Throws a `validation_failed` refusal whose message names the offending token — it
+ * lands in the console UI, so it is written for the person typing.
  */
 export function assertReadOnlyQuery(sql) {
     const tokens = [];
@@ -86,7 +90,7 @@ export function assertReadOnlyQuery(sql) {
                 i += 1;
             }
             if (statementEnded)
-                throw new Error('read-only console: only a single statement is allowed');
+                throw refuse(SINGLE_STATEMENT);
             continue;
         }
         if (c === '[') {
@@ -94,7 +98,7 @@ export function assertReadOnlyQuery(sql) {
                 i += 1;
             i += 1;
             if (statementEnded)
-                throw new Error('read-only console: only a single statement is allowed');
+                throw refuse(SINGLE_STATEMENT);
             continue;
         }
         if (c === ';') {
@@ -108,24 +112,24 @@ export function assertReadOnlyQuery(sql) {
             while (j < n && /[A-Za-z0-9_]/.test(sql[j]))
                 j += 1;
             if (statementEnded)
-                throw new Error('read-only console: only a single statement is allowed');
+                throw refuse(SINGLE_STATEMENT);
             tokens.push(sql.slice(i, j).toLowerCase());
             i = j;
             continue;
         }
         if (statementEnded && /\S/.test(c))
-            throw new Error('read-only console: only a single statement is allowed');
+            throw refuse(SINGLE_STATEMENT);
         i += 1;
     }
     const first = tokens[0];
     if (!first)
-        throw new Error('read-only console: empty statement');
+        throw refuse('empty statement');
     if (!FIRST_KEYWORDS.has(first)) {
-        throw new Error(`read-only console: statement must start with SELECT, WITH, VALUES, or EXPLAIN (got '${first.toUpperCase()}')`);
+        throw refuse(`statement must start with SELECT, WITH, VALUES, or EXPLAIN (got '${first.toUpperCase()}')`);
     }
     for (const t of tokens) {
         if (FORBIDDEN.has(t)) {
-            throw new Error(`read-only console: '${t.toUpperCase()}' is not allowed (quote it if it names a column or table)`);
+            throw refuse(`'${t.toUpperCase()}' is not allowed (quote it if it names a column or table)`);
         }
     }
     const trimmed = sql.trim();

package/dist/read-only-sql.js.map

@@ -1 +1 @@
-{"version":3,"file":"read-only-sql.js","sourceRoot":"","sources":["../src/read-only-sql.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AAEH,MAAM,cAAc,GAAG,IAAI,GAAG,CAAC,CAAC,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE,SAAS,CAAC,CAAC,CAAC;AAExE,kFAAkF;AAClF,2EAA2E;AAC3E,gFAAgF;AAChF,MAAM,SAAS,GAAG,IAAI,GAAG,CAAC;IACxB,QAAQ;IACR,MAAM;IACN,QAAQ;IACR,QAAQ;IACR,MAAM;IACN,QAAQ;IACR,OAAO;IACP,QAAQ;IACR,QAAQ;IACR,QAAQ;IACR,QAAQ;IACR,SAAS;IACT,SAAS;IACT,OAAO;IACP,QAAQ;IACR,UAAU;IACV,WAAW;IACX,SAAS;CACV,CAAC,CAAC;AAEH;;;;GAIG;AACH,MAAM,UAAU,mBAAmB,CAAC,GAAW;IAC7C,MAAM,MAAM,GAAa,EAAE,CAAC;IAC5B,IAAI,cAAc,GAAG,KAAK,CAAC;IAC3B,MAAM,CAAC,GAAG,GAAG,CAAC,MAAM,CAAC;IACrB,IAAI,CAAC,GAAG,CAAC,CAAC;IACV,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;QACb,MAAM,CAAC,GAAG,GAAG,CAAC,CAAC,CAAE,CAAC;QAClB,MAAM,EAAE,GAAG,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;QACtB,IAAI,CAAC,KAAK,GAAG,IAAI,EAAE,KAAK,GAAG,EAAE,CAAC;YAC5B,OAAO,CAAC,GAAG,CAAC,IAAI,GAAG,CAAC,CAAC,CAAC,KAAK,IAAI;gBAAE,CAAC,IAAI,CAAC,CAAC;YACxC,SAAS;QACX,CAAC;QACD,IAAI,CAAC,KAAK,GAAG,IAAI,EAAE,KAAK,GAAG,EAAE,CAAC;YAC5B,CAAC,IAAI,CAAC,CAAC;YACP,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,GAAG,IAAI,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,GAAG,CAAC;gBAAE,CAAC,IAAI,CAAC,CAAC;YAChE,CAAC,IAAI,CAAC,CAAC;YACP,SAAS;QACX,CAAC;QACD,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,GAAG,EAAE,CAAC;YACxC,4EAA4E;YAC5E,CAAC,IAAI,CAAC,CAAC;YACP,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;gBACb,IAAI,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC;oBACjB,IAAI,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC;wBACrB,CAAC,IAAI,CAAC,CAAC;wBACP,SAAS;oBACX,CAAC;oBACD,CAAC,IAAI,CAAC,CAAC;oBACP,MAAM;gBACR,CAAC;gBACD,CAAC,IAAI,CAAC,CAAC;YACT,CAAC;YACD,IAAI,cAAc;gBAAE,MAAM,IAAI,KAAK,CAAC,uDAAuD,CAAC,CAAC;YAC7F,SAAS;QACX,CAAC;QACD,IAAI,CAAC,KAAK,GAAG,EAAE,CAAC;YACd,OAAO,CAAC,GAAG,CAAC,IAAI,GAAG,CAAC,CAAC,CAAC,KAAK,GAAG;gBAAE,CAAC,IAAI,CAAC,CAAC;YACvC,CAAC,IAAI,CAAC,CAAC;YACP,IAAI,cAAc;gBAAE,MAAM,IAAI,KAAK,CAAC,uDAAuD,CAAC,CAAC;YAC7F,SAAS;QACX,CAAC;QACD,IAAI,CAAC,KAAK,GAAG,EAAE,CAAC;YACd,sEAAsE;YACtE,cAAc,GAAG,IAAI,CAAC;YACtB,CAAC,IAAI,CAAC,CAAC;YACP,SAAS;QACX,CAAC;QACD,IAAI,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC;YACxB,IAAI,CAAC,GAAG,CAAC,CAAC;YACV,OAAO,CAAC,GAAG,CAAC,IAAI,cAAc,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAE,CAAC;gBAAE,CAAC,IAAI,CAAC,CAAC;YACrD,IAAI,cAAc;gBAAE,MAAM,IAAI,KAAK,CAAC,uDAAuD,CAAC,CAAC;YAC7F,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC;YAC3C,CAAC,GAAG,CAAC,CAAC;YACN,SAAS;QACX,CAAC;QACD,IAAI,cAAc,IAAI,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,uDAAuD,CAAC,CAAC;QAC7G,CAAC,IAAI,CAAC,CAAC;IACT,CAAC;IAED,MAAM,KAAK,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC;IACxB,IAAI,CAAC,KAAK;QAAE,MAAM,IAAI,KAAK,CAAC,oCAAoC,CAAC,CAAC;IAClE,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC;QAC/B,MAAM,IAAI,KAAK,CAAC,uFAAuF,KAAK,CAAC,WAAW,EAAE,IAAI,CAAC,CAAC;IAClI,CAAC;IACD,KAAK,MAAM,CAAC,IAAI,MAAM,EAAE,CAAC;QACvB,IAAI,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;YACrB,MAAM,IAAI,KAAK,CACb,uBAAuB,CAAC,CAAC,WAAW,EAAE,2DAA2D,CAClG,CAAC;QACJ,CAAC;IACH,CAAC;IAED,MAAM,OAAO,GAAG,GAAG,CAAC,IAAI,EAAE,CAAC;IAC3B,OAAO,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC;AACvE,CAAC"}
+{"version":3,"file":"read-only-sql.js","sourceRoot":"","sources":["../src/read-only-sql.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,MAAM,yBAAyB,CAAC;AAExD;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AAEH,MAAM,cAAc,GAAG,IAAI,GAAG,CAAC,CAAC,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE,SAAS,CAAC,CAAC,CAAC;AAExE,kFAAkF;AAClF,2EAA2E;AAC3E,gFAAgF;AAChF,MAAM,SAAS,GAAG,IAAI,GAAG,CAAC;IACxB,QAAQ;IACR,MAAM;IACN,QAAQ;IACR,QAAQ;IACR,MAAM;IACN,QAAQ;IACR,OAAO;IACP,QAAQ;IACR,QAAQ;IACR,QAAQ;IACR,QAAQ;IACR,SAAS;IACT,SAAS;IACT,OAAO;IACP,QAAQ;IACR,UAAU;IACV,WAAW;IACX,SAAS;CACV,CAAC,CAAC;AAEH,6GAA6G;AAC7G,MAAM,MAAM,GAAG,CAAC,MAAc,EAAE,EAAE,CAAC,aAAa,CAAC,mBAAmB,EAAE,sBAAsB,MAAM,EAAE,CAAC,CAAC;AACtG,MAAM,gBAAgB,GAAG,oCAAoC,CAAC;AAE9D;;;;GAIG;AACH,MAAM,UAAU,mBAAmB,CAAC,GAAW;IAC7C,MAAM,MAAM,GAAa,EAAE,CAAC;IAC5B,IAAI,cAAc,GAAG,KAAK,CAAC;IAC3B,MAAM,CAAC,GAAG,GAAG,CAAC,MAAM,CAAC;IACrB,IAAI,CAAC,GAAG,CAAC,CAAC;IACV,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;QACb,MAAM,CAAC,GAAG,GAAG,CAAC,CAAC,CAAE,CAAC;QAClB,MAAM,EAAE,GAAG,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;QACtB,IAAI,CAAC,KAAK,GAAG,IAAI,EAAE,KAAK,GAAG,EAAE,CAAC;YAC5B,OAAO,CAAC,GAAG,CAAC,IAAI,GAAG,CAAC,CAAC,CAAC,KAAK,IAAI;gBAAE,CAAC,IAAI,CAAC,CAAC;YACxC,SAAS;QACX,CAAC;QACD,IAAI,CAAC,KAAK,GAAG,IAAI,EAAE,KAAK,GAAG,EAAE,CAAC;YAC5B,CAAC,IAAI,CAAC,CAAC;YACP,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,GAAG,IAAI,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,GAAG,CAAC;gBAAE,CAAC,IAAI,CAAC,CAAC;YAChE,CAAC,IAAI,CAAC,CAAC;YACP,SAAS;QACX,CAAC;QACD,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,GAAG,EAAE,CAAC;YACxC,4EAA4E;YAC5E,CAAC,IAAI,CAAC,CAAC;YACP,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;gBACb,IAAI,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC;oBACjB,IAAI,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC;wBACrB,CAAC,IAAI,CAAC,CAAC;wBACP,SAAS;oBACX,CAAC;oBACD,CAAC,IAAI,CAAC,CAAC;oBACP,MAAM;gBACR,CAAC;gBACD,CAAC,IAAI,CAAC,CAAC;YACT,CAAC;YACD,IAAI,cAAc;gBAAE,MAAM,MAAM,CAAC,gBAAgB,CAAC,CAAC;YACnD,SAAS;QACX,CAAC;QACD,IAAI,CAAC,KAAK,GAAG,EAAE,CAAC;YACd,OAAO,CAAC,GAAG,CAAC,IAAI,GAAG,CAAC,CAAC,CAAC,KAAK,GAAG;gBAAE,CAAC,IAAI,CAAC,CAAC;YACvC,CAAC,IAAI,CAAC,CAAC;YACP,IAAI,cAAc;gBAAE,MAAM,MAAM,CAAC,gBAAgB,CAAC,CAAC;YACnD,SAAS;QACX,CAAC;QACD,IAAI,CAAC,KAAK,GAAG,EAAE,CAAC;YACd,sEAAsE;YACtE,cAAc,GAAG,IAAI,CAAC;YACtB,CAAC,IAAI,CAAC,CAAC;YACP,SAAS;QACX,CAAC;QACD,IAAI,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC;YACxB,IAAI,CAAC,GAAG,CAAC,CAAC;YACV,OAAO,CAAC,GAAG,CAAC,IAAI,cAAc,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAE,CAAC;gBAAE,CAAC,IAAI,CAAC,CAAC;YACrD,IAAI,cAAc;gBAAE,MAAM,MAAM,CAAC,gBAAgB,CAAC,CAAC;YACnD,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC;YAC3C,CAAC,GAAG,CAAC,CAAC;YACN,SAAS;QACX,CAAC;QACD,IAAI,cAAc,IAAI,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;YAAE,MAAM,MAAM,CAAC,gBAAgB,CAAC,CAAC;QACnE,CAAC,IAAI,CAAC,CAAC;IACT,CAAC;IAED,MAAM,KAAK,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC;IACxB,IAAI,CAAC,KAAK;QAAE,MAAM,MAAM,CAAC,iBAAiB,CAAC,CAAC;IAC5C,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC;QAC/B,MAAM,MAAM,CAAC,oEAAoE,KAAK,CAAC,WAAW,EAAE,IAAI,CAAC,CAAC;IAC5G,CAAC;IACD,KAAK,MAAM,CAAC,IAAI,MAAM,EAAE,CAAC;QACvB,IAAI,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;YACrB,MAAM,MAAM,CACV,IAAI,CAAC,CAAC,WAAW,EAAE,2DAA2D,CAC/E,CAAC;QACJ,CAAC;IACH,CAAC;IAED,MAAM,OAAO,GAAG,GAAG,CAAC,IAAI,EAAE,CAAC;IAC3B,OAAO,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC;AACvE,CAAC"}

package/dist/scope-copy.d.ts

@@ -13,6 +13,24 @@ import type { SwitchSql } from './system-switch.js';
  * An unknown source (`sourceScopeId` or `destScopeId` absent) counts as a copy: a load that cannot
  * say where the dump came from cannot show it is a return. Only a control plane that predates the
  * field sends a restore with no source.
+ *
+ * Two kinds of state are decided here without a rule in the load, because the load never sees
+ * the part that holds the power (#2004):
+ *
+ * - **Staff impersonation sessions (K-42).** `_substrat_impersonations` is a DIRECTORY table on
+ *   both adapters, never a scope table, so no dump carries a session and a copy holds none. The
+ *   session's power is checked at the door, against the (tenant, scope) the session names
+ *   (`assertSessionUsable`), so a live session opened on the source is refused at every copy of
+ *   it and still honoured at the source after a return. What a copy does carry is the history:
+ *   the impersonation stamps on the rows the session wrote, as the source recorded them.
+ * - **Cross-vertical import cursors (#1705).** `_substrat_import_cursors` and `_substrat_imports`
+ *   are carried as they are, on a copy and on a return. A cursor is written in the same
+ *   transaction as the import handlers' writes, so it describes the data it sits beside, and the
+ *   journal is what dedupes a re-delivery. Reset either and the data would be handed events whose
+ *   effects it already holds. The power to consume lives in the delivery, not the cursor: the
+ *   sweep visits primary scopes only (`isPrimaryScope`), and `deliverToPeer` into a copy answers
+ *   `paused` with nothing run and the watermark unmoved. The producer keeps no record of a
+ *   consumer's position, so a copy's cursor acknowledges nothing at the source either.
  */
 export declare const isCopyLoad: (destScopeId: string | undefined, sourceScopeId: string | undefined) => boolean;
 /**

package/dist/scope-copy.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"scope-copy.d.ts","sourceRoot":"","sources":["../src/scope-copy.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAC;AAEpD;;;;;;;;;;;;;;GAcG;AACH,eAAO,MAAM,UAAU,gBAAiB,MAAM,GAAG,SAAS,iBAAiB,MAAM,GAAG,SAAS,KAAG,OACpC,CAAC;AAK7D;;;;;;;;GAQG;AACH,wBAAgB,mBAAmB,CAAC,CAAC,SAAS;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,SAAS,OAAO,EAAE,CAAA;CAAE,EACtF,MAAM,EAAE,CAAC,EAAE,EACX,WAAW,EAAE,MAAM,GAAG,SAAS,EAC/B,aAAa,EAAE,MAAM,GAAG,SAAS,GAChC,CAAC,EAAE,CAGL;AAcD;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,eAAO,MAAM,eAAe,8cAW3B,CAAC;AAEF;;;;;GAKG;AACH,eAAO,MAAM,WAAW,sBAAiB,MACqD,CAAC;AAE/F;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,wBAAgB,gBAAgB,CAC9B,GAAG,EAAE,SAAS,EACd,WAAW,EAAE,MAAM,GAAG,SAAS,EAC/B,aAAa,EAAE,MAAM,GAAG,SAAS,EACjC,GAAG,EAAE,MAAM,GACV,IAAI,CAiDN;AAED;;;;;;;GAOG;AACH,wBAAgB,cAAc,CAAC,GAAG,EAAE,SAAS,EAAE,GAAG,EAAE,MAAM,GAAG,OAAO,CAInE;AAED;;;;;;;GAOG;AACH,eAAO,MAAM,oBAAoB,QAEa,CAAC;AAE/C;;;;;;;GAOG;AACH,wBAAgB,eAAe,CAAC,GAAG,EAAE,SAAS,GAAG,SAAS,GAAG,QAAQ,CAIpE;AAED;;;;;GAKG;AACH,eAAO,MAAM,WAAW,0FAA0F,CAAC"}
+{"version":3,"file":"scope-copy.d.ts","sourceRoot":"","sources":["../src/scope-copy.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAC;AAEpD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AACH,eAAO,MAAM,UAAU,gBAAiB,MAAM,GAAG,SAAS,iBAAiB,MAAM,GAAG,SAAS,KAAG,OACpC,CAAC;AAK7D;;;;;;;;GAQG;AACH,wBAAgB,mBAAmB,CAAC,CAAC,SAAS;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,SAAS,OAAO,EAAE,CAAA;CAAE,EACtF,MAAM,EAAE,CAAC,EAAE,EACX,WAAW,EAAE,MAAM,GAAG,SAAS,EAC/B,aAAa,EAAE,MAAM,GAAG,SAAS,GAChC,CAAC,EAAE,CAGL;AAcD;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,eAAO,MAAM,eAAe,8cAW3B,CAAC;AAEF;;;;;GAKG;AACH,eAAO,MAAM,WAAW,sBAAiB,MACqD,CAAC;AAE/F;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,wBAAgB,gBAAgB,CAC9B,GAAG,EAAE,SAAS,EACd,WAAW,EAAE,MAAM,GAAG,SAAS,EAC/B,aAAa,EAAE,MAAM,GAAG,SAAS,EACjC,GAAG,EAAE,MAAM,GACV,IAAI,CAiDN;AAED;;;;;;;GAOG;AACH,wBAAgB,cAAc,CAAC,GAAG,EAAE,SAAS,EAAE,GAAG,EAAE,MAAM,GAAG,OAAO,CAInE;AAED;;;;;;;GAOG;AACH,eAAO,MAAM,oBAAoB,QAEa,CAAC;AAE/C;;;;;;;GAOG;AACH,wBAAgB,eAAe,CAAC,GAAG,EAAE,SAAS,GAAG,SAAS,GAAG,QAAQ,CAIpE;AAED;;;;;GAKG;AACH,eAAO,MAAM,WAAW,0FAA0F,CAAC"}

package/dist/scope-copy.js

@@ -13,6 +13,24 @@ import { CAPABILITY_TABLE_NAMES } from './capability.js';
  * An unknown source (`sourceScopeId` or `destScopeId` absent) counts as a copy: a load that cannot
  * say where the dump came from cannot show it is a return. Only a control plane that predates the
  * field sends a restore with no source.
+ *
+ * Two kinds of state are decided here without a rule in the load, because the load never sees
+ * the part that holds the power (#2004):
+ *
+ * - **Staff impersonation sessions (K-42).** `_substrat_impersonations` is a DIRECTORY table on
+ *   both adapters, never a scope table, so no dump carries a session and a copy holds none. The
+ *   session's power is checked at the door, against the (tenant, scope) the session names
+ *   (`assertSessionUsable`), so a live session opened on the source is refused at every copy of
+ *   it and still honoured at the source after a return. What a copy does carry is the history:
+ *   the impersonation stamps on the rows the session wrote, as the source recorded them.
+ * - **Cross-vertical import cursors (#1705).** `_substrat_import_cursors` and `_substrat_imports`
+ *   are carried as they are, on a copy and on a return. A cursor is written in the same
+ *   transaction as the import handlers' writes, so it describes the data it sits beside, and the
+ *   journal is what dedupes a re-delivery. Reset either and the data would be handed events whose
+ *   effects it already holds. The power to consume lives in the delivery, not the cursor: the
+ *   sweep visits primary scopes only (`isPrimaryScope`), and `deliverToPeer` into a copy answers
+ *   `paused` with nothing run and the watermark unmoved. The producer keeps no record of a
+ *   consumer's position, so a copy's cursor acknowledges nothing at the source either.
  */
 export const isCopyLoad = (destScopeId, sourceScopeId) => destScopeId === undefined || sourceScopeId !== destScopeId;
 /** The capability tables, as `capabilitiesForLoad` matches a dump's (lowercased) names. */

package/dist/scope-copy.js.map

@@ -1 +1 @@
-{"version":3,"file":"scope-copy.js","sourceRoot":"","sources":["../src/scope-copy.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,sBAAsB,EAAE,MAAM,iBAAiB,CAAC;AAGzD;;;;;;;;;;;;;;GAcG;AACH,MAAM,CAAC,MAAM,UAAU,GAAG,CAAC,WAA+B,EAAE,aAAiC,EAAW,EAAE,CACxG,WAAW,KAAK,SAAS,IAAI,aAAa,KAAK,WAAW,CAAC;AAE7D,2FAA2F;AAC3F,MAAM,iBAAiB,GAAwB,IAAI,GAAG,CAAC,sBAAsB,CAAC,CAAC;AAE/E;;;;;;;;GAQG;AACH,MAAM,UAAU,mBAAmB,CACjC,MAAW,EACX,WAA+B,EAC/B,aAAiC;IAEjC,IAAI,CAAC,UAAU,CAAC,WAAW,EAAE,aAAa,CAAC;QAAE,OAAO,MAAM,CAAC;IAC3D,OAAO,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,iBAAiB,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AACnG,CAAC;AAED,mGAAmG;AACnG,MAAM,UAAU,GAAG,CAAC,aAAiC,EAAU,EAAE,CAC/D,4BAA4B,aAAa,CAAC,CAAC,CAAC,SAAS,aAAa,EAAE,CAAC,CAAC,CAAC,eAAe,kBAAkB;IACxG,yDAAyD,CAAC;AAE5D,0FAA0F;AAC1F,MAAM,mBAAmB,GAAG,IAAI,CAAC,SAAS,CAAC;IACzC,MAAM,EAAE,UAAU;IAClB,IAAI,EAAE,qBAAqB;IAC3B,UAAU,EAAE,IAAI;CACgB,CAAC,CAAC;AAEpC;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,MAAM,CAAC,MAAM,eAAe,GAAG;;;;;;;;;;;CAW9B,CAAC;AAEF;;;;;GAKG;AACH,MAAM,CAAC,MAAM,WAAW,GAAG,CAAC,KAAK,GAAG,EAAE,EAAU,EAAE,CAChD,GAAG,KAAK,oFAAoF,CAAC;AAE/F;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,MAAM,UAAU,gBAAgB,CAC9B,GAAc,EACd,WAA+B,EAC/B,aAAiC,EACjC,GAAW;IAEX,IAAI,CAAC,UAAU,CAAC,WAAW,EAAE,aAAa,CAAC;QAAE,OAAO;IACpD,MAAM,MAAM,GAAG,UAAU,CAAC,aAAa,CAAC,CAAC;IACzC,GAAG,CAAC,GAAG,CACL;;+BAE2B,EAC3B,MAAM,EACN,mBAAmB,EACnB,GAAG,CACJ,CAAC;IACF,GAAG,CAAC,GAAG,CACL;wCACoC,EACpC,MAAM,EACN,GAAG,CACJ,CAAC;IACF,GAAG,CAAC,GAAG,CACL;;+BAE2B,EAC3B,MAAM,EACN,GAAG,EACH,GAAG,CACJ,CAAC;IACF,MAAM,OAAO,GAAG,GAAG,CAAC,GAAG,CAAC,4CAA4C,CAAC,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC;IAC7E,8FAA8F;IAC9F,+FAA+F;IAC/F,6FAA6F;IAC7F,yBAAyB;IACzB,EAAE;IACF,6FAA6F;IAC7F,wFAAwF;IACxF,0FAA0F;IAC1F,qBAAqB;IACrB,GAAG,CAAC,GAAG,CACL;;;;;;;;mEAQ+D,EAC/D,aAAa,IAAI,IAAI,EACrB,OAAO,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,EAC1C,GAAG,CACJ,CAAC;AACJ,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,cAAc,CAAC,GAAc,EAAE,GAAW;IACxD,IAAI,GAAG,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,KAAK,CAAC;IAClD,GAAG,CAAC,GAAG,CAAC,oBAAoB,EAAE,GAAG,CAAC,CAAC;IACnC,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAC/B,yHAAyH;IACzH,4CAA4C,CAAC;AAE/C;;;;;;;GAOG;AACH,MAAM,UAAU,eAAe,CAAC,GAAc;IAC5C,IAAI,GAAG,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,QAAQ,CAAC;IACvD,GAAG,CAAC,GAAG,CAAC,2DAA2D,CAAC,CAAC;IACrE,OAAO,SAAS,CAAC;AACnB,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,MAAM,WAAW,GAAG,uFAAuF,CAAC"}
+{"version":3,"file":"scope-copy.js","sourceRoot":"","sources":["../src/scope-copy.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,sBAAsB,EAAE,MAAM,iBAAiB,CAAC;AAGzD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AACH,MAAM,CAAC,MAAM,UAAU,GAAG,CAAC,WAA+B,EAAE,aAAiC,EAAW,EAAE,CACxG,WAAW,KAAK,SAAS,IAAI,aAAa,KAAK,WAAW,CAAC;AAE7D,2FAA2F;AAC3F,MAAM,iBAAiB,GAAwB,IAAI,GAAG,CAAC,sBAAsB,CAAC,CAAC;AAE/E;;;;;;;;GAQG;AACH,MAAM,UAAU,mBAAmB,CACjC,MAAW,EACX,WAA+B,EAC/B,aAAiC;IAEjC,IAAI,CAAC,UAAU,CAAC,WAAW,EAAE,aAAa,CAAC;QAAE,OAAO,MAAM,CAAC;IAC3D,OAAO,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,iBAAiB,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AACnG,CAAC;AAED,mGAAmG;AACnG,MAAM,UAAU,GAAG,CAAC,aAAiC,EAAU,EAAE,CAC/D,4BAA4B,aAAa,CAAC,CAAC,CAAC,SAAS,aAAa,EAAE,CAAC,CAAC,CAAC,eAAe,kBAAkB;IACxG,yDAAyD,CAAC;AAE5D,0FAA0F;AAC1F,MAAM,mBAAmB,GAAG,IAAI,CAAC,SAAS,CAAC;IACzC,MAAM,EAAE,UAAU;IAClB,IAAI,EAAE,qBAAqB;IAC3B,UAAU,EAAE,IAAI;CACgB,CAAC,CAAC;AAEpC;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,MAAM,CAAC,MAAM,eAAe,GAAG;;;;;;;;;;;CAW9B,CAAC;AAEF;;;;;GAKG;AACH,MAAM,CAAC,MAAM,WAAW,GAAG,CAAC,KAAK,GAAG,EAAE,EAAU,EAAE,CAChD,GAAG,KAAK,oFAAoF,CAAC;AAE/F;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,MAAM,UAAU,gBAAgB,CAC9B,GAAc,EACd,WAA+B,EAC/B,aAAiC,EACjC,GAAW;IAEX,IAAI,CAAC,UAAU,CAAC,WAAW,EAAE,aAAa,CAAC;QAAE,OAAO;IACpD,MAAM,MAAM,GAAG,UAAU,CAAC,aAAa,CAAC,CAAC;IACzC,GAAG,CAAC,GAAG,CACL;;+BAE2B,EAC3B,MAAM,EACN,mBAAmB,EACnB,GAAG,CACJ,CAAC;IACF,GAAG,CAAC,GAAG,CACL;wCACoC,EACpC,MAAM,EACN,GAAG,CACJ,CAAC;IACF,GAAG,CAAC,GAAG,CACL;;+BAE2B,EAC3B,MAAM,EACN,GAAG,EACH,GAAG,CACJ,CAAC;IACF,MAAM,OAAO,GAAG,GAAG,CAAC,GAAG,CAAC,4CAA4C,CAAC,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC;IAC7E,8FAA8F;IAC9F,+FAA+F;IAC/F,6FAA6F;IAC7F,yBAAyB;IACzB,EAAE;IACF,6FAA6F;IAC7F,wFAAwF;IACxF,0FAA0F;IAC1F,qBAAqB;IACrB,GAAG,CAAC,GAAG,CACL;;;;;;;;mEAQ+D,EAC/D,aAAa,IAAI,IAAI,EACrB,OAAO,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,EAC1C,GAAG,CACJ,CAAC;AACJ,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,cAAc,CAAC,GAAc,EAAE,GAAW;IACxD,IAAI,GAAG,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,KAAK,CAAC;IAClD,GAAG,CAAC,GAAG,CAAC,oBAAoB,EAAE,GAAG,CAAC,CAAC;IACnC,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAC/B,yHAAyH;IACzH,4CAA4C,CAAC;AAE/C;;;;;;;GAOG;AACH,MAAM,UAAU,eAAe,CAAC,GAAc;IAC5C,IAAI,GAAG,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,QAAQ,CAAC;IACvD,GAAG,CAAC,GAAG,CAAC,2DAA2D,CAAC,CAAC;IACrE,OAAO,SAAS,CAAC;AACnB,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,MAAM,WAAW,GAAG,uFAAuF,CAAC"}

package/dist/scope-host.d.ts

@@ -1,5 +1,6 @@
 import type { ModuleLog } from './module-log.js';
-import type { OnBehalfOf, ExportReadInput, ExportedBatch, ImportBatch, ImportedEvent, ImportResult, ImportState, ImportCursorMove, ImportCursorMoved, AdminAction, BecomeCapabilityInput, CapabilityExchange, CapabilityFilter, CapabilityId, CapabilityPage, MintedCapability, ListPage, Connection, ConnectionFilter, ConnectionId, ConnectionGrant, ConnectionGrantRecord, ConnectionSecret, CreateConnectionInput, OpenConnection, ProjectedConnectionGrant, ProjectedConnectionKey, AccessLogEntry, DelegatedReadRecord, OwnerTransferAudit, CopyMarkAudit, BindHostnameInput, AdminLogEntry, OpsFailureEntry, PlatformRequestDrainTotalsEntry, SweepRunEntry, SweepRunKind, SweepRunOutcome, ModelUsageEntry, ModelUsageSummary, CapabilityGrant, CreateTenantInput, Decision, Instant, DomainEvent, DomainEventInput, PlatformRequestInput, PlatformRequestId, PlatformRequest, PlatformRequestFilter, PlatformRequestStatus, PlatformRequestFailure, EntitlementGrant, EntitlementGrantInput, EntitlementView, MeterReading, EntityRef, IdentityLink, IdentityPool, Jurisdiction, ModuleId, ModuleManifest, ScheduleSpec, SystemGrant, PeerGrantsStatusEntry, SystemGrantsStatusEntry, SystemSwitchRecord, SystemSwitch, SystemSwitchResult, PeerCoverage, PeerSwitch, PeerSwitchResult, VerticalCaller, VerticalResolution, CreateOrgInput, Node, Org, OrgId, OrgMembership, PermissionKey, PlatformActorId, ChannelName, ExportBreak, ChannelHistoryEntry, DnsRecord, HostnameBinding, HostnameStatus, PromotionAcknowledgement, BindAcknowledgement, PublishVersionInput, RegisterVerticalInput, VerticalServingState, RouteTarget, DirectoryDump, IdentityMembership, PrincipalId, ResolvedIdentity, RoleAssignment, RoleDefinition, QueryScopeInput, ReadScopeTableInput, Scope, ScopeDump, SubjectShredReceipt, ScopeQueryResult, ScopeId, ScopeStatus, ScopeTable, DenialFilter, DenialSummary, RefusalFilter, RefusalRecord, PermissionDenial, Coverage, BeginImpersonationInput, ImpersonationFilter, ImpersonationSession, ImpersonationSessionId, ScopeTablePage, StorageShape, Tenant, TenantId, TenantRole, TenantStoreHandle, AttachmentRecord, BlobStoreHandle, Visibility, Vertical, VerticalChannel, VerticalVersion, TenantStatus, Page, CountedPage, FreshnessSpec, EntityHistoryInput, EventFacetInput, EventCauseInput, EventEffectsInput, EffectsTree, InvocationEventsInput, InvocationEvents, DeadLettersInput, DeadLetter, LifecycleFlowInput, LifecycleFlowResult, CauseChain, EventFacetResult, HistoryEntry, ErrorCode, PlatformRequestFailureOrigin, IssueEntry, IssueStatus, IssueStatusInput, DeclaredMigration, CheckSubject } from '@substrat-run/contracts';
+import type { DeliveryRefusal } from './delivery-refusal.js';
+import type { OnBehalfOf, ExportReadInput, ExportedBatch, ImportBatch, ImportedEvent, ImportResult, ImportState, ImportCursorMove, ImportCursorMoved, AdminAction, BecomeCapabilityInput, CapabilityExchange, CapabilityFilter, CapabilityId, CapabilityPage, MintedCapability, ListPage, Connection, ConnectionFilter, ConnectionId, ConnectionGrant, ConnectionGrantRecord, ConnectionSecret, CreateConnectionInput, OpenConnection, ProjectedConnectionGrant, ProjectedConnectionKey, AccessLogEntry, DelegatedReadRecord, OwnerTransferAudit, CopyMarkAudit, BindHostnameInput, AdminLogEntry, OpsFailureEntry, PlatformRequestDrainTotalsEntry, SweepRunEntry, SweepRunKind, SweepRunOutcome, ModelUsageEntry, ModelUsageSummary, CapabilityGrant, CreateTenantInput, Decision, Instant, DomainEvent, DomainEventInput, PlatformRequestInput, PlatformRequestId, PlatformRequest, PlatformRequestFilter, PlatformRequestStatus, PlatformRequestFailure, EntitlementGrant, EntitlementGrantInput, EntitlementView, MeterReading, EntityRef, IdentityLink, IdentityPool, Jurisdiction, ModuleId, ModuleManifest, ScheduleSpec, SystemGrant, PeerGrantsStatusEntry, SystemGrantsStatusEntry, SystemSwitchRecord, SystemSwitch, SystemSwitchResult, PeerCoverage, PeerSwitch, PeerSwitchResult, VerticalCaller, VerticalResolution, CreateOrgInput, Node, Org, OrgId, OrgMembership, PermissionKey, PlatformActorId, ChannelName, ExportBreak, ChannelHistoryEntry, DnsRecord, HostnameBinding, HostnameStatus, PromotionAcknowledgement, BindAcknowledgement, PublishVersionInput, RegisterVerticalInput, VerticalServingState, RouteTarget, DirectoryDump, IdentityMembership, PrincipalId, ResolvedIdentity, RoleAssignment, RoleDefinition, QueryScopeInput, ReadScopeTableInput, Scope, ScopeDump, SubjectShredReceipt, ScopeQueryResult, ScopeId, ScopeStatus, ScopeTable, DenialFilter, DenialSummary, RefusalFilter, RefusalRecord, PermissionDenial, Coverage, BeginImpersonationInput, ImpersonationFilter, ImpersonationSession, ImpersonationSessionId, ScopeTablePage, StorageShape, Tenant, TenantId, TenantRole, TenantStoreHandle, AttachmentRecord, BlobStoreHandle, Visibility, Vertical, VerticalChannel, VerticalVersion, TenantStatus, Page, CountedPage, FreshnessSpec, EntityHistoryInput, EventFacetInput, EventCauseInput, EventEffectsInput, EffectsTree, InvocationEventsInput, InvocationEvents, DeadLettersInput, DeadLetter, LifecycleFlowInput, LifecycleFlowResult, OperationSeriesInput, OperationSeriesResult, CauseChain, EventFacetResult, HistoryEntry, ErrorCode, PlatformRequestFailureOrigin, IssueEntry, IssueStatus, IssueStatusInput, DeclaredMigration, CheckSubject } from '@substrat-run/contracts';
 import type { ConnectionUseOutcome } from './connector-calls.js';
 import type { CapabilityVerbs } from './capability.js';
 import type { ModelUsageFilter, ModelUsageInput, ModelUsageWindow } from './model-usage.js';
@@ -593,6 +594,18 @@ export interface InvokeOptions {
      * uncapped count, so a reader can tell a short list from a truncated one.
      */
     readonly onEmitted?: (report: EmittedReport) => void;
+    /**
+     * Called after the operation COMMITS and its executors ran inline (#1184), with what each
+     * delivery of this call's events did. The inline path is the common case of K-22 §4.2,
+     * so the request holder is the one who can tell a person their accept was refused rather
+     * than report success for an effect that never happened.
+     *
+     * Every delivery the call's post-commit tail attempted, which can include an earlier
+     * call's retry that came due: a caller picks out its own by `eventType` and `entity`.
+     * Never called for a rolled-back operation, a read-only session or an
+     * idempotent replay. Absent from a host that predates it — read that as "not reported".
+     */
+    readonly onExecutorOutcomes?: (outcomes: readonly ExecutorOutcome[]) => void;
 }
 /** How many of an invocation's own events `onEmitted` names (#1746). `total` is uncapped. */
 export declare const EMITTED_REPORT_CAP = 20;
@@ -723,6 +736,48 @@ export type ConsumerHandler = (ctx: OperationContext, event: DomainEvent) => voi
  * code, and the version you declared is the only one you will be handed.
  */
 export type ImportHandler = (ctx: OperationContext, event: ImportedEvent) => void | Promise<void>;
+/**
+ * One membership change for `HostAdmin.applyMembership` (#1184): a TENANT-level role assigned
+ * or taken away, and nothing else. No org is joined or left — what an org confers lives partly
+ * in each scope's own store, where no directory unit can bound it, so authorizing an org
+ * membership is its own capability.
+ */
+export type MembershipChange = {
+    tenantId: TenantId;
+    principal: PrincipalId;
+    /** The tenant-level role assigned or taken away. */
+    roleKey: string;
+    /**
+     * Whose authority bounds the write (§5.1) — the inviter of an add, the remover of a removal:
+     * the unit applies nothing unless this principal covers every permission `roleKey` carries,
+     * read inside the unit (`tenantCoverage`).
+     */
+    boundedBy: PrincipalId;
+} & ({
+    op: 'add';
+    /** Apply nothing when `principal`'s removal fence stands at or after this instant. */
+    unlessRemovedSince: Instant;
+} | {
+    op: 'remove';
+});
+/**
+ * What the unit did: applied, or why not — fenced by a removal (an add only), or out of the
+ * bound. A removal that applied says whether it took anything (`changed`); one that took
+ * nothing still raised the fence.
+ */
+export type MembershipChangeResult = {
+    applied: true;
+    changed?: boolean;
+} | {
+    applied: false;
+    removedAt: string;
+} | {
+    applied: false;
+    missing: PermissionKey[];
+} | {
+    applied: false;
+    unknownRole: string;
+};
 /**
  * An **executor**: out-of-band host code that effects, outside a scope, what a module
  * asked for inside one (K-22 §4.2; D-18's triage rule — effects on the outside world
@@ -742,8 +797,53 @@ export type ImportHandler = (ctx: OperationContext, event: ImportedEvent) => voi
  * It receives `HostAdmin`, not `ctx`: it acts with platform authority, which is
  * precisely what module code must never hold. Admin writes it makes are stamped with
  * the causing event's id (`causedBy`), so the split trail joins.
+ *
+ * A handler that decides an event must never be effected RETURNS `refuseDelivery(reason)`
+ * (#1184). The delivery is journaled terminal with the reason, never retried. A return
+ * value rather than a thrown error, so module code cannot produce one: the most an
+ * operation can do is throw, and a throw is retried like any other failure.
  */
-export type ExecutorHandler = (admin: HostAdmin, event: DomainEvent) => void | Promise<void>;
+export type ExecutorHandler = (admin: HostAdmin, event: DomainEvent, scope: ExecutorScope) => void | DeliveryRefusal | Promise<void | DeliveryRefusal>;
+/**
+ * The scope an executor's event came from, as the executor may read it (#1184).
+ *
+ * Here rather than through `HostAdmin` or the host, and the pure adapter is why: its
+ * handler runs INSIDE the scope's actor task, and every host read of a scope re-enqueues
+ * on that actor, so `host.canAssign` from a handler waits on the task holding it and never
+ * returns. The adapter builds this to suit where the handler runs, as it builds a
+ * connector's `openAttachment`.
+ *
+ * Reads only, and checks no permission: the caller is host code that already holds
+ * platform authority. Both answer about the event's own (tenant, scope), never another.
+ */
+export interface ExecutorScope {
+    /** One entity's history in this scope — `readHistory`'s answer, oldest first. */
+    history(entity: EntityRef, page?: ListPage): Promise<Page<HistoryEntry>>;
+    /**
+     * May `principal` confer `roleKey` at this scope's node, or at the tenant node
+     * (`level: 'tenant'`)? The K-21 set comparison `ctx.canAssign` answers, narrowing-aware,
+     * over the tenant's projected role. Throws `unknownRoleError` for a role this tenant does
+     * not define.
+     */
+    covers(principal: PrincipalId, roleKey: string, level: 'scope' | 'tenant'): Promise<Coverage>;
+}
+/**
+ * What one executor delivery did inside the call that emitted its event (#1184) — what
+ * `InvokeOptions.onExecutorOutcomes` reports. `refused` is terminal by the handler's own
+ * decision; `dead-lettered` is terminal by exhaustion; `retrying` will be tried again.
+ */
+export interface ExecutorOutcome {
+    readonly executorId: string;
+    readonly eventId: string;
+    readonly eventType: string;
+    /** The event's entity, as `<entityType>:<entityId>` — how a caller finds its own event. */
+    readonly entity: string;
+    readonly outcome: 'delivered' | 'retrying' | 'dead-lettered' | 'refused' | 'inert' | 'routed';
+    /** The refusal reason, or the failure's message. Absent on a delivery. */
+    readonly error?: string;
+}
+/** One delivery's `ExecutorOutcome` — the one builder both adapters report through. */
+export declare function executorOutcomeOf(executorId: string, event: DomainEvent, outcome: ExecutorOutcome['outcome'], error?: unknown): ExecutorOutcome;
 /**
  * How hard the host tries before it gives up on one delivery (#100).
  *
@@ -1433,6 +1533,10 @@ export interface HostAdmin {
      * role that was never assigned (or already revoked) is a silent no-op. Takes a
      * `PlatformActorId` like every admin mutation — the caller's own authority to do
      * this is decided above the kernel (e.g. the dashboard's manage-members check).
+     *
+     * At the TENANT node it also raises the principal's removal fence (#1184), in the same
+     * unit as the revoke and whether or not anything was held, so a membership-executor add
+     * still on its way for them is refused. The no-op stays unaudited.
      */
     unassignRole(actor: PlatformActorId, assignment: RoleAssignment): Promise<void>;
     grant(actor: PlatformActorId, grant: CapabilityGrant): Promise<void>;
@@ -1563,6 +1667,22 @@ export interface HostAdmin {
      * `moduleIds`. Access-logged (K-24), as the fleet read is.
      */
     tenantHeldSystemModules(actor: PlatformActorId, tenantId: TenantId, moduleIds: readonly ModuleId[]): Promise<ModuleId[]>;
+    /**
+     * The peer half of a carry (#2029): the peers the directory records OFF on this one scope
+     * (`revokeFromPeer` writes the record, as `revokeFromSystem` writes the module's), and of those
+     * the ones the tenant holds a live tenant-level `vertical:` grant for (#2030). Carried into a
+     * deployment's provision, reconcile or restore beside the modules, so its in-unit OFF puts them
+     * back off too. Empty lists when none is. Access-logged (K-24), as the module reads are.
+     */
+    peerSwitchCarry(actor: PlatformActorId, node: {
+        tenantId: TenantId;
+        scopeId: ScopeId;
+    }): Promise<{
+        switchedOffPeers: string[];
+        tenantHeldPeers: string[];
+        /** #2045: each recorded-off peer's fence (the record's operation id), by slug. */
+        fences: Record<string, string>;
+    }>;
     /**
      * Put the directory's OFF positions back into one scope (#1674), for a scope whose storage
      * lost them: a wipe then re-provision, or a restore of a dump taken before the switch was
@@ -1590,6 +1710,10 @@ export interface HostAdmin {
      * deployment applying it. That move is undone (switched back on) and audited as
      * `staleCarry`, BEFORE the record is read again for the OFF pass. Only a module recorded
      * `on` is ever switched on here.
+     *
+     * Every kind of switch (#2029): after the modules, every peer the record holds `off` on the
+     * scope is switched off again the same way (through `revokeFromPeer`'s switch), audited as
+     * `reassertPeerSwitch`, and answered as an entry naming `vertical` rather than `moduleId`.
      */
     reassertSystemSwitches(actor: PlatformActorId, node: {
         tenantId: TenantId;
@@ -1653,6 +1777,21 @@ export interface HostAdmin {
     revokeCapability(actor: PlatformActorId, tenantId: TenantId, scopeId: ScopeId, capabilityId: CapabilityId): Promise<void>;
     grantToOrg(actor: PlatformActorId, orgId: OrgId, permission: PermissionKey, node: Node, entity?: EntityRef): Promise<void>;
     addMember(actor: PlatformActorId, tenantId: TenantId, principal: PrincipalId, orgId: OrgId): Promise<void>;
+    /**
+     * One membership change, applied as ONE directory unit (#1184): a single SQLite transaction or
+     * a single synchronous ControlPlaneDO method, with no await inside it. In that unit it
+     * re-evaluates the bound — `boundedBy` must still cover every permission `roleKey` carries,
+     * against the directory as it stands (`tenantCoverage`) — and only then writes. An ADD also
+     * reads `principal`'s removal fence first, then assigns the TENANT-level role and writes its
+     * audit row. A REMOVE unassigns it and raises the fence, as a tenant-level `unassignRole`
+     * does. A removal, a grant, a role redefinition or a demotion lands wholly before the unit
+     * (and governs it) or wholly after it, never between its check and its write.
+     *
+     * The fence is `_substrat_membership_fences`: every tenant-level `unassignRole` and every
+     * `removeMember` raises it for the person, in the same unit as its revoke — a no-op included,
+     * since a removal of someone whose add is still on its way must still win.
+     */
+    applyMembership(actor: PlatformActorId, change: MembershipChange): Promise<MembershipChangeResult>;
     /**
      * Revoke a membership (K-21). **Tombstones, never deletes**: the tuple keeps its
      * row, gains a `revokedAt`, and the permission walk skips it. Deletion would
@@ -1664,6 +1803,9 @@ export interface HostAdmin {
      * no-op, and a no-op is not audited. Re-adding via `addMember` clears the
      * tombstone (they are a member again); the add/revoke history lives in the admin
      * log, which is append-only.
+     *
+     * Raises the principal's removal fence (#1184) in the same unit as the revoke, a no-op
+     * included, so a membership-executor add still on its way for them is refused.
      */
     removeMember(actor: PlatformActorId, tenantId: TenantId, principal: PrincipalId, orgId: OrgId): Promise<void>;
     /**
@@ -2359,6 +2501,13 @@ export interface HostAdmin {
      * Reads only the lifecycle field of unclassified payloads; logged like every read here.
      */
     lifecycleFlow(actor: PlatformActorId, tenantId: TenantId, scopeId: ScopeId, input: LifecycleFlowInput): Promise<LifecycleFlowResult>;
+    /**
+     * Calls per `(entityType, operation)` per time bucket over the scope's outbox (#1750) —
+     * `readOperationSeries`, hoisted: the business volumes Pulse draws. The caller passes
+     * the pairs (from the running version's declared lifecycles); the scope holds no model.
+     * Reads no payload; logged like every read here.
+     */
+    operationSeries(actor: PlatformActorId, tenantId: TenantId, scopeId: ScopeId, input: OperationSeriesInput): Promise<OperationSeriesResult>;
     /**
      * One read-only SQL statement against the scope's database — the console the two
      * table-shaped reads deliberately weren't (#219). User SQL DOES reach the DB here,
@@ -4140,12 +4289,19 @@ export interface ScopeHost {
      * and this driver's contract in `job-run.ts`. `retry` is the DEFAULT policy for
      * the job's steps; a step may pass its own.
      *
+     * `options.leaseMs` (#2034) is how long one pass holds its run without reaching a
+     * step boundary, which renews it — default `JOB_LEASE_MS`. Past it, the run is due
+     * again and the next drive takes it over, counting the silent pass as a failed
+     * attempt. A job whose pass may go longer than that between two steps says so here.
+     *
      * The fourth driver, and a SIBLING of the three that already exist rather than a
      * widening of any of them. An executor retries one delivery whole; a schedule
      * fires one operation that must finish; the platform sweep does a pass of
      * maintenance. None of them can stop halfway through an hour and carry on.
      */
-    registerJob(moduleId: ModuleId, name: string, handler: JobHandler, retry?: ExecutorRetryPolicy): void;
+    registerJob(moduleId: ModuleId, name: string, handler: JobHandler, retry?: ExecutorRetryPolicy, options?: {
+        leaseMs?: number;
+    }): void;
     /**
      * Start a run, or JOIN the one already in flight for the same
      * `(module, job, instance)` — the coalescing half of the driver.
@@ -4187,12 +4343,10 @@ export interface ScopeHost {
      * grant gate here would STALL it silently rather than refuse it. The authority it
      * exercises is checked where it is used, inside the operations its steps invoke.
      *
-     * **One driver per scope at a time**, and that is a bound the caller holds, not one
-     * this enforces — there is no lease. Coalescing stops duplicate RUNS; two concurrent
-     * calls of THIS would advance the same run together. Every topology the driver is
-     * built for gives a scope one tick (the platform sweep does one call per scope, a
-     * scope DO's alarm fires for its own), so the bound holds by construction; the full
-     * argument, and what an overlap would actually cost, is in `job-run.ts`.
+     * **Overlapping calls are safe** (#2034): each run is CLAIMED before its pass, with a
+     * lease the pass renews at every step boundary, so two calls on one scope never run
+     * one run's handler together. A run whose pass died is taken over once its lease
+     * expires. The full argument is in `job-run.ts`.
      */
     runDueJobs(tenantId: TenantId, scopeId: ScopeId, options?: {
         maxPasses?: number;
@@ -4341,6 +4495,11 @@ export interface ScopeHost {
  * changed at 14:02 is information about that row, so "the body was empty" is not a
  * defence: the filter runs whether or not there is a payload to withhold.
  *
+ * A subscription may be narrowed `within` one entity (#1853), which only removes frames;
+ * the one exception to the per-principal check is a `within` the vertical built with
+ * `vouchedWithin`, whose subscriber is sent bare `LiveNudge` frames and nothing that
+ * names an entity.
+ *
  * **Generic over the runtime's request and response, because the kernel names
  * neither.** This package has one dependency and no DOM or workers lib
  * (`docs/architecture/dependency-policy.md`), which is why `FetchLike` above describes
@@ -4375,8 +4534,58 @@ export interface LiveReadSurface<Req extends LiveUpgradeRequest = LiveUpgradeReq
         principal: PrincipalId;
         /** The upgrade request as it arrived, carried whole so the host reads its own headers. */
         request: Req;
+        /**
+         * Narrow the feed to one entity and what hangs beneath it (#1853).
+         *
+         * A frame is then delivered only if its entity IS this one or reaches it upward
+         * through live declared `parent` edges (what `ctx.link` / `ctx.relink` write) — the
+         * walk `ctx.check` makes, rooted here instead of at a grant.
+         *
+         * - **An `EntityRef` narrows and nothing else.** The principal's own per-frame
+         *   `liveTargets` check still runs; `within` is ANDed with it, so it can only take
+         *   frames away. A screen watching one conversation passes it to stop hearing the
+         *   rest of the desk.
+         * - **A `vouchedWithin(…)` value replaces the principal's check.** For a subscriber
+         *   confined by something other than a grant — a widget visitor holding a session
+         *   token the vertical has just redeemed. The vertical asserts access to the root,
+         *   the same trust it already extends in naming `principal`, and the scope's walk is
+         *   the whole filter. Such a subscriber receives `LiveNudge` frames only, which name
+         *   no event type and no entity.
+         */
+        within?: EntityRef | VouchedWithin;
     }): Promise<Res>;
 }
+/** The brand only `vouchedWithin` can apply — a literal cannot type-check as one. */
+declare const vouchedBrand: unique symbol;
+/**
+ * A `within` root the VERTICAL vouches the subscriber may watch, in place of the
+ * principal's own grants (#1853). Built only by `vouchedWithin`.
+ */
+export interface VouchedWithin {
+    readonly [vouchedBrand]: true;
+    readonly entity: EntityRef;
+    /** Why the vertical vouches — what it checked. Required, and kept on the subscription. */
+    readonly because: string;
+}
+/**
+ * Vouch that the subscriber may watch `entity` and everything beneath it, though the
+ * principal it subscribes as holds no read on it.
+ *
+ * The one way to reach the replacing mode, so every use is greppable and none is an
+ * accident: an object literal is refused by the type checker, and anything not built
+ * here is refused by the host at run time (`isVouchedWithin`). Call it only after the
+ * vertical itself has proven access — for ticket0's widget, by redeeming the session
+ * token for the session it names.
+ *
+ * What it costs the subscriber is detail: a vouched feed carries `LiveNudge` frames, so
+ * the scope never tells it which entity changed or how. Root it at an entity whose
+ * subtree holds only what the subscriber may see — the walk is the whole filter.
+ */
+export declare function vouchedWithin(entity: EntityRef, opts: {
+    because: string;
+}): VouchedWithin;
+/** Was this value built by `vouchedWithin`? A host asks before it drops the principal's check. */
+export declare function isVouchedWithin(value: unknown): value is VouchedWithin;
 /**
  * Is this request asking to be upgraded to a WebSocket?
  *
@@ -4436,6 +4645,24 @@ export interface LiveChange {
     /** When the event was emitted (ISO 8601), i.e. the emitting operation's instant. */
     readonly at: string;
 }
+/**
+ * What a vouched subscriber is told (#1853): something beneath its root changed, and
+ * nothing else.
+ *
+ * No event type and no entity, deliberately. A vouched subscriber holds no read on the
+ * entities its frames are about — the vertical vouched for the ROOT, and the scope
+ * cannot know which rows under it the vertical's own read would show. Naming the type
+ * or the id would tell it what it never asked to read. The client re-reads, as it does
+ * on a `LiveChange`.
+ */
+export interface LiveNudge {
+    readonly kind: 'nudge';
+    /** The event id, as on `LiveChange` — for ordering and de-duplication only. */
+    readonly id: string;
+    readonly at: string;
+}
+/** Any frame a live read sends. */
+export type LiveFrame = LiveChange | LiveNudge;
 /**
  * Refuse a cutoff in the future — at the HostAdmin boundary, not only at the HTTP door.
  *