@substrat-run/contract-tests 0.159.0 → 0.161.0

package/dist/scope-host-suite.js

@@ -1,7 +1,7 @@
 import { describe, it, expect, beforeAll, afterAll } from 'vitest';
 import { connectorCalls, connectorTestFetch, resetConnectorCalls } from './connector-fixture.js';
-import { connectionId, dataSubjectId, domainEvent, errorCodeOf, moduleId, SCOPE_GATE_REASONS, eventId, instant, moduleManifest, orgId, AUTO_ADMISSION_NOTE, permissionKey, platformActorId, platformRequestId, principalId, scopeId, tenantId, SCOPE_QUERY_ROW_MAX, KERNEL_AUTHORED_EVENT_TYPES, EMAIL_SENT, PLATFORM_REQUEST_ENTITY_TYPE, SEND_EMAIL_KIND, isUndecodablePlatformRequest, platformRequestEntry, SWEEP_RUNS_KIND, SCOPE_TABLE_PAGE_MAX, unheldMigrationDigest, } from '@substrat-run/contracts';
-import { INERT_SCOPE_REASON, BACKFILL_MOVE_ID, SCOPE_COPY_LEASE_MS, isSearchIndexTable, platformIntentFailureMessage, REDACTED_DELIVERY_NOTE, REDACTED_FAILURE_NOTE, REDACTED_INTENT_MARKER, runPlatformSweep, startPlatformSweeper, promoteReviewDigest, promoteReviewRefusalOf, rebindReviewRefusalOf, createUlid, ulid, } from '@substrat-run/kernel';
+import { connectionId, dataSubjectId, domainEvent, errorCodeOf, moduleId, SCOPE_GATE_REASONS, eventId, instant, moduleManifest, orgId, AUTO_ADMISSION_NOTE, permissionKey, platformActorId, platformRequestId, principalId, scopeId, tenantId, SCOPE_QUERY_ROW_MAX, LIST_PAGE_MAX, KERNEL_AUTHORED_EVENT_TYPES, EMAIL_SENT, PLATFORM_REQUEST_ENTITY_TYPE, SEND_EMAIL_KIND, isUndecodablePlatformRequest, platformRequestEntry, SWEEP_RUNS_KIND, SCOPE_TABLE_PAGE_MAX, unheldMigrationDigest, withUpstreamReference, } from '@substrat-run/contracts';
+import { INERT_SCOPE_REASON, BACKFILL_MOVE_ID, SCOPE_COPY_LEASE_MS, isSearchIndexTable, platformIntentFailureMessage, withheldOpsFailure, withheldStaffFailure, REDACTED_DELIVERY_NOTE, REDACTED_FAILURE_NOTE, REDACTED_INTENT_MARKER, runPlatformSweep, startPlatformSweeper, promoteReviewDigest, promoteReviewRefusalOf, rebindReviewRefusalOf, createUlid, ulid, WIRE_AUTH_FILTER_TEXT_MAX, } from '@substrat-run/kernel';
 import { billedMod, contractTestBareOps, contractTestInitialModules, gateModManifest, lateMod, TEST_LIFECYCLE, testModManifest, victimModManifest, } from './modules.js';
 import { testOperations } from './test-operations.js';
 import { derivedDigestOf, heldMigrations } from './held-migrations.js';
@@ -268,6 +268,62 @@ export function scopeHostContractSuite(adapterName, makeFixture, opts = {}) {
                 scopeId: scopeId.parse(ulid()),
             }), 'conflict');
         });
+        describe('provisioning takes a vertical slug and a non-empty kind and name', () => {
+            const tenant = tenantId.parse(ulid());
+            beforeAll(async () => {
+                await host.admin.createTenant(staff, { id: tenant, slug: 'vertical-grammar', name: 'Vertical grammar' });
+            });
+            it.each(['', '   ', '\t', 'Todo', 'my_vertical', 'a/b/c', '/todo', 'todo/', '-todo', 'todo-', 'to do'])('refuses %j as validation_failed and stores nothing', async (vertical) => {
+                const scope = scopeId.parse(ulid());
+                await expectRefusal(host.provisionScope(staff, { tenantId: tenant, scopeId: scope, vertical }), 'validation_failed', /vertical/);
+                expect(await host.admin.getScopeRecord(staff, tenant, scope)).toBeUndefined();
+                // The directory still reads whole: nothing unparsable was written.
+                await expect(host.admin.listScopes(staff, { tenantId: tenant })).resolves.toBeInstanceOf(Array);
+            });
+            it.each([
+                ['a bare slug', 'todo', 'todo'],
+                ['digits', 'ticket0', 'ticket0'],
+                ['a leading digit', '2do', '2do'],
+                ['an owner prefix', 'acme/todo', 'acme/todo'],
+                ['null', null, null],
+                ['no vertical at all', undefined, null],
+            ])('provisions with %s and stores it as given', async (_name, vertical, stored) => {
+                const scope = scopeId.parse(ulid());
+                await host.provisionScope(staff, { tenantId: tenant, scopeId: scope, ...(vertical === undefined ? {} : { vertical }) });
+                expect((await host.admin.getScopeRecord(staff, tenant, scope))?.vertical).toBe(stored);
+            });
+            it.each([
+                ['kind', ''],
+                ['kind', '   '],
+                ['kind', '\t'],
+                ['name', ''],
+                ['name', '   '],
+                ['name', '\n'],
+            ])('refuses %s %j as validation_failed naming the field, and stores nothing', async (field, value) => {
+                const scope = scopeId.parse(ulid());
+                await expectRefusal(host.provisionScope(staff, { tenantId: tenant, scopeId: scope, vertical: 'todo', [field]: value }), 'validation_failed', new RegExp(`^provisionScope: ${field} `));
+                expect(await host.admin.getScopeRecord(staff, tenant, scope)).toBeUndefined();
+            });
+            it.each([
+                ['given', { kind: 'brf', name: 'Brf Vasastan' }, { kind: 'brf', name: 'Brf Vasastan' }],
+                ['given with spaces around them, as sent', { kind: ' brf ', name: ' Brf ' }, { kind: ' brf ', name: ' Brf ' }],
+                ['absent, as the defaults', {}, { kind: 'scope' }],
+            ])('provisions with kind and name %s', async (_case, given, stored) => {
+                const scope = scopeId.parse(ulid());
+                await host.provisionScope(staff, { tenantId: tenant, scopeId: scope, vertical: 'todo', ...given });
+                const row = await host.admin.getScopeRecord(staff, tenant, scope);
+                expect(row).toMatchObject(stored);
+                // An absent name defaults to the slug, which defaults to the lowercased id.
+                if (!('name' in given))
+                    expect(row?.name).toBe(scope.toLowerCase());
+            });
+            it('refuses an invalid vertical on a re-provision of an existing scope too', async () => {
+                const scope = scopeId.parse(ulid());
+                await host.provisionScope(staff, { tenantId: tenant, scopeId: scope, vertical: 'todo' });
+                await expectRefusal(host.provisionScope(staff, { tenantId: tenant, scopeId: scope, vertical: '' }), 'validation_failed');
+                expect((await host.admin.getScopeRecord(staff, tenant, scope))?.vertical).toBe('todo');
+            });
+        });
         it('fails closed on a mismatched (tenantId, scopeId) pair (K-3)', async () => {
             await expect(host.getScope(alice, t2, s1)).rejects.toThrow();
             await expect(host.getScope(alice, t1, scopeId.parse(ulid()))).rejects.toThrow();
@@ -2312,6 +2368,21 @@ export function scopeHostContractSuite(adapterName, makeFixture, opts = {}) {
                 // The spine: present and flagged system, so the UI can group it apart.
                 expect(byName.get('_substrat_outbox')?.system).toBe(true);
             });
+            it('counts what is in force apart from what a table keeps as tombstones (#2531)', async () => {
+                const key = `introspect-${ulid().toLowerCase()}`;
+                await host.admin.defineRole(staff, t1, { key, permissions: [permissionKey.parse('thing:read')], source: 'vertical' });
+                const seat = { principalId: principalId.parse(ulid()), roleKey: key, node: { tenantId: t1, scopeId: s1 } };
+                const tuples = async () => (await host.admin.listScopeTables(staff, t1, s1)).find((t) => t.name === '_substrat_tuples');
+                const before = await tuples();
+                expect(before.liveRowCount).toBeDefined();
+                await host.admin.assignRole(staff, seat);
+                expect(await tuples()).toMatchObject({ rowCount: before.rowCount + 1, liveRowCount: before.liveRowCount + 1 });
+                // A revoke tombstones the seat: the row is kept, and it is no longer in force.
+                await host.admin.unassignRole(staff, seat);
+                expect(await tuples()).toMatchObject({ rowCount: before.rowCount + 1, liveRowCount: before.liveRowCount });
+                // A table that keeps no tombstones answers no live count.
+                expect((await host.admin.listScopeTables(staff, t1, s1)).find((t) => t.name === '_substrat_outbox')).not.toHaveProperty('liveRowCount');
+            });
             it('reads a bounded page of a table', async () => {
                 const stub = await host.getScope(alice, t1, s1);
                 await stub.invoke('test/write-marker', { v: 'page-row' });
@@ -3015,6 +3086,84 @@ export function scopeHostContractSuite(adapterName, makeFixture, opts = {}) {
                         expect((await failureOf(operation)).message).toBe(REDACTED_FAILURE_NOTE);
                         expect((await issueOf(operation)).lastMessage).toBe(REDACTED_FAILURE_NOTE);
                     });
+                    it('#2540: a pair filed under another tenant, whose staff text names this subject, is redacted on both', async () => {
+                        // The pair is the other tenant's failure, and its withheld text names this tenant's subject.
+                        const erased = dataSubjectId.parse(ulid());
+                        const operation = op('pair');
+                        await host.admin.recordOpsFailure({
+                            actor: staff,
+                            operation,
+                            stage: 'terminal',
+                            tenantId: t2,
+                            message: 'the step failed (reference r)',
+                            detail: `a store refused while reading contact ${erased}`,
+                            reference: `erase${ulid().toLowerCase()}`,
+                        });
+                        // The issue's sample is the staff text, so it is the platform's.
+                        expect(await exemplarOwnerOf(operation)).toEqual({ kind: 'platform', tenant: null });
+                        expect((await issueOf(operation)).lastMessage).toContain(erased);
+                        await host.admin.shredSubject(staff, t1, s1, erased);
+                        expect((await issueOf(operation)).lastMessage).toBe(REDACTED_FAILURE_NOTE);
+                        const rows = await host.admin.listOpsFailures(staff, { operation });
+                        // Staff's row with no tenant goes on the id match; the other tenant's row never named it.
+                        expect(rows.map((r) => [r.tenantId, r.message])).toEqual([
+                            [t2, 'the step failed (reference r)'],
+                            [null, REDACTED_FAILURE_NOTE],
+                        ]);
+                    });
+                    it("#2554: the drain's pair about a tombstoned intent is redacted on staff's row and the platform's sample too", async () => {
+                        const kind = `connector:erasure-${ulid()}`;
+                        const erased = dataSubjectId.parse(ulid());
+                        const spared = dataSubjectId.parse(ulid());
+                        const linked = await routeIntent(kind, erased, 'Anna Ek');
+                        const unlinked = await routeIntent(kind, spared, 'Bo Lund');
+                        // As the drain files it (`withheldOpsFailure`): the tenant's row says what became of the
+                        // intent, staff's row (no tenant, the same scope) quotes the error, marker first.
+                        const pair = (operation, id, error) => host.admin.recordOpsFailure(withheldOpsFailure({ actor: staff, operation, stage: 'terminal', tenantId: t1, scopeId: s1 }, platformIntentFailureMessage(id, `failed: ${error}; reference = up${ulid().toLowerCase()}`), (r) => platformIntentFailureMessage(id, `failed (reference ${r})`)));
+                        const ops = { linked: op('pair-linked'), unlinked: op('pair-unlinked'), elsewhere: op('pair-elsewhere') };
+                        await pair(ops.linked, linked, 'HTTP 409: Anna Ek needs a personal number');
+                        await pair(ops.unlinked, unlinked, 'HTTP 409: Bo Lund needs a personal number');
+                        // The twin: a staff row naming the same intent under another scope is not this erasure's.
+                        await host.admin.recordOpsFailure({
+                            actor: staff, operation: ops.elsewhere, stage: 'terminal', tenantId: null, scopeId: s2,
+                            message: platformIntentFailureMessage(linked, 'failed: HTTP 409: Anna Ek'),
+                        });
+                        const rowsOf = async (operation) => (await host.admin.listOpsFailures(staff, { operation })).map((r) => [r.tenantId, r.message]);
+                        const before = { linked: await rowsOf(ops.linked), unlinked: await rowsOf(ops.unlinked), elsewhere: await rowsOf(ops.elsewhere) };
+                        expect(before.linked[1][1]).toMatch(/^\[upstream reference = up[0-9a-z]+\] platform intent /);
+                        expect(await exemplarOwnerOf(ops.linked)).toEqual({ kind: 'platform', tenant: null });
+                        await host.admin.shredSubject(staff, t1, s1, erased);
+                        // Both rows of the pair: the tenant's by the link it always had, staff's by #2554's.
+                        expect(await rowsOf(ops.linked)).toEqual([[t1, REDACTED_FAILURE_NOTE], [null, REDACTED_FAILURE_NOTE]]);
+                        expect((await issueOf(ops.linked)).lastMessage).toBe(REDACTED_FAILURE_NOTE);
+                        expect(await rowsOf(ops.unlinked)).toEqual(before.unlinked);
+                        expect((await issueOf(ops.unlinked)).lastMessage).toBe(before.unlinked[1][1]);
+                        expect(await rowsOf(ops.elsewhere)).toEqual(before.elsewhere);
+                        await host.settlePlatformRequest(t1, s1, unlinked, { status: 'done' });
+                    });
+                    it("#2556: staff's row alone, for a withheld pass that left a tombstoned intent pending, is redacted too", async () => {
+                        const kind = `connector:erasure-${ulid()}`;
+                        const erased = dataSubjectId.parse(ulid());
+                        const spared = dataSubjectId.parse(ulid());
+                        const linked = await routeIntent(kind, erased, 'Anna Ek');
+                        const unlinked = await routeIntent(kind, spared, 'Bo Lund');
+                        // As the drain files it (`withheldStaffFailure`): no tenant, the drained scope, marker first.
+                        const transient = (operation, id, error) => host.admin.recordOpsFailure({
+                            actor: staff,
+                            ...withheldStaffFailure({ operation, stage: 'transient', scopeId: s1 }, `${error}; reference = up${ulid().toLowerCase()}`, ulid(), platformIntentFailureMessage(id, 'pending (the call did not complete at its deployment): ')),
+                        });
+                        const ops = { linked: op('transient-linked'), unlinked: op('transient-unlinked') };
+                        await transient(ops.linked, linked, 'HTTP 500: Anna Ek is not on file');
+                        await transient(ops.unlinked, unlinked, 'HTTP 500: Bo Lund is not on file');
+                        const rowsOf = async (operation) => (await host.admin.listOpsFailures(staff, { operation })).map((r) => [r.tenantId, r.message]);
+                        const before = await rowsOf(ops.unlinked);
+                        expect((await rowsOf(ops.linked))[0][1]).toMatch(/^\[upstream reference = up[0-9a-z]+\] platform intent .* pending \(the call did not complete at its deployment\): HTTP 500: /);
+                        await host.admin.shredSubject(staff, t1, s1, erased);
+                        expect(await rowsOf(ops.linked)).toEqual([[null, REDACTED_FAILURE_NOTE]]);
+                        expect((await issueOf(ops.linked)).lastMessage).toBe(REDACTED_FAILURE_NOTE);
+                        expect(await rowsOf(ops.unlinked)).toEqual(before);
+                        await host.settlePlatformRequest(t1, s1, unlinked, { status: 'done' });
+                    });
                     /** Whose an exemplar is, as the directory stores it — not on the issue read shape. */
                     const exemplarOwnerOf = async (operation) => {
                         const dump = await host.admin.exportDirectory(staff);
@@ -4340,6 +4489,85 @@ export function scopeHostContractSuite(adapterName, makeFixture, opts = {}) {
                 expect(both.map((r) => r.code).sort()).toEqual(['permission_denied', null].sort());
                 expect(both.map((r) => r.origin).sort()).toEqual(['platform', null].sort());
             });
+            it('#2540: a tenant row with a detail is a pair under one reference, counted once', async () => {
+                const reference = `pair${ulid().toLowerCase()}`;
+                await host.admin.recordOpsFailure({
+                    actor: staff,
+                    operation: 'contract.paired',
+                    stage: 'withheld',
+                    tenantId: t1,
+                    vertical: 'acme/paired',
+                    status: 502,
+                    message: `the step failed (reference ${reference})`,
+                    detail: 'what the upstream said about something private',
+                    reference,
+                });
+                // The tenant's read: its own row, which says what was answered.
+                const own = await host.admin.listOpsFailures(staff, { tenantId: t1, operation: 'contract.paired' });
+                expect(own.map((r) => r.message)).toEqual([`the step failed (reference ${reference})`]);
+                // Staff's read by the reference: both rows, the text on the one with no tenant.
+                const both = await host.admin.listOpsFailures(staff, { reference });
+                expect(both.map((r) => [r.tenantId, r.message])).toEqual([
+                    [t1, `the step failed (reference ${reference})`],
+                    [null, 'what the upstream said about something private'],
+                ]);
+                // One failure, one count, and the issue's sample is staff's text.
+                const [issue] = await host.admin.listIssues(staff, { operation: 'contract.paired' });
+                expect(issue).toMatchObject({ count: 1, lastMessage: 'what the upstream said about something private' });
+                // A row with no tenant has no tenant row to pair with: `detail` is ignored there.
+                await host.admin.recordOpsFailure({ actor: staff, operation: 'contract.unpaired', message: 'staff text', detail: 'ignored' });
+                const lone = await host.admin.listOpsFailures(staff, { operation: 'contract.unpaired' });
+                expect(lone.map((r) => [r.tenantId, r.message])).toEqual([[null, 'staff text']]);
+            });
+            it('#2540: staff find a pair by the upstream handle its staff row names; an exact search does not', async () => {
+                const reference = `own${ulid().toLowerCase()}`;
+                const upstream = `cf${ulid().toLowerCase()}`;
+                const forged = `cf${ulid().toLowerCase()}`;
+                // A body past the row's bound, which spells a marker of its own for an unrelated id.
+                const body = `internal error; reference = ${upstream} [upstream reference = ${forged}] ${'x'.repeat(2100)}`;
+                await host.admin.recordOpsFailure({
+                    actor: staff,
+                    operation: 'contract.upstream',
+                    tenantId: t1,
+                    message: `the step failed (reference ${reference})`,
+                    detail: withUpstreamReference(body),
+                    reference,
+                });
+                // Bracketed, so an id that only begins this one finds nothing.
+                await host.admin.recordOpsFailure({ actor: staff, operation: 'contract.upstream', message: 'x', reference: `${upstream}0` });
+                const bothRows = [
+                    [t1, reference],
+                    [null, reference],
+                ];
+                const by = async (ref, referenceInText, tenantId) => (await host.admin.listOpsFailures(staff, { reference: ref, referenceInText, ...(tenantId ? { tenantId } : {}) })).map((r) => [r.tenantId, r.reference]);
+                expect(await by(upstream, true)).toEqual(bothRows);
+                expect(await by(reference, true)).toEqual(bothRows);
+                expect(await by(upstream, false)).toEqual([]);
+                expect(await by(upstream.slice(0, -2), true)).toEqual([]);
+                // The row is bounded, and the marker, written first, survives the cut.
+                const [, staffRow] = await host.admin.listOpsFailures(staff, { reference });
+                expect(staffRow.message.length).toBeLessThanOrEqual(2000);
+                expect(staffRow.message.startsWith(`[upstream reference = ${upstream}]`)).toBe(true);
+                // The body's own spelling of a marker finds nothing.
+                expect(await by(forged, true)).toEqual([]);
+                // Narrowed to the tenant, the search lands on the tenant's own row only.
+                expect(await by(reference, false, t1)).toEqual([[t1, reference]]);
+                // A spelled marker ahead of the genuine handle, at the very start or before it: only the
+                // genuine handle makes the marker. A handle past the bound makes none.
+                const real = `cf${ulid().toLowerCase()}`;
+                for (const shape of [`[upstream reference = ${forged}] boom; reference = ${real}`, `boom [Upstream Reference=${forged}] then reference = ${real}`]) {
+                    const pair = `shape${ulid().toLowerCase()}`;
+                    await host.admin.recordOpsFailure({ actor: staff, operation: 'contract.upstream', tenantId: t1, message: 'm', detail: withUpstreamReference(shape), reference: pair });
+                    expect((await by(real, true)).map(([, r]) => r)).toContain(pair);
+                    expect(await by(forged, true)).toEqual([]);
+                }
+                const long = `long${ulid().toLowerCase()}`;
+                const run = 'a'.repeat(100);
+                await host.admin.recordOpsFailure({ actor: staff, operation: 'contract.upstream', tenantId: t1, message: 'm', detail: withUpstreamReference(`reference = ${run}`), reference: long });
+                const [, unmarked] = await host.admin.listOpsFailures(staff, { reference: long });
+                expect(unmarked.message).toBe(`reference = ${run}`);
+                expect(await by(run, true)).toEqual([]);
+            });
             it('bounds the recorded message — a runaway upstream body never becomes a runaway row', async () => {
                 await host.admin.recordOpsFailure({
                     actor: staff,
@@ -7250,7 +7478,8 @@ export function scopeHostContractSuite(adapterName, makeFixture, opts = {}) {
             await host.admin.setVerticalListed(staff, slug, true);
             await host.admin.promoteVersion(staff, slug, 'prod', first);
             expect((await host.admin.getScopeRecord(staff, t2, install))?.verticalVersionId).toBe(next);
-        });
+            // Seven scopes, a snapshot and three promotions: about 3 s alone, past the 5 s default under CI load (#2576).
+        }, 30_000);
         it('publish refuses an auto-admitted prod version until a staff admit vouches for it', async () => {
             // Listing is the moment OTHER tenants start trusting this code, so the version
             // they would install needs a recorded human decision — the auto-admission note
@@ -8585,6 +8814,10 @@ export function scopeHostContractSuite(adapterName, makeFixture, opts = {}) {
             // #1524: a size read is refused BEFORE it reaches the storage. Addressing a reaped
             // DO to ask its size would recreate an empty database and report that as the scope.
             await expectRefusal(host.admin.scopeDatabaseSize(staff, t3, s), 'conflict', /reaped/);
+            // #2501: the attachment read is refused the same way, never answered as 0.
+            if (host.admin.scopeAttachmentBytes) {
+                await expectRefusal(host.admin.scopeAttachmentBytes(staff, t3, s), 'conflict', /reaped/);
+            }
             // Audited as reapScope against the right scope + actor.
             const reapEntry = (await host.admin.auditLog(staff, { tenantId: t3 })).find((r) => r.action === 'reapScope' && r.scopeId === s);
             expect(reapEntry?.actor).toBe(staff);
@@ -9249,15 +9482,87 @@ export function scopeHostContractSuite(adapterName, makeFixture, opts = {}) {
                     sampled: 1,
                 });
             });
-            it("forgets a reaped scope's samples, and never writes one for it again", async () => {
+            it('keeps attachment samples beside the databases, the day\'s latest, until retention, a reaped scope\'s too (#2501)', async () => {
+                const ta = tenantId.parse(ulid());
+                await host.admin.createTenant(staff, { id: ta, slug: 'gauge-attachments', name: 'Gauge Attachments' });
+                const [s, quiet] = [await newScope(ta), await newScope(ta)];
+                const attachmentsOf = async (tenant) => (await host.admin.readMeters(staff, { tenantId: tenant })).perTenant[0].storage;
+                await host.admin.recordScopeStorage(staff, [{ tenantId: ta, scopeId: s, bytes: 100, readAt: day(0, '08:00:00'), attachments: 300 }]);
+                // Beside the databases' figure, never inside it, which still names attachments as excluded.
+                expect(await attachmentsOf(ta)).toMatchObject({ bytes: 100, excluded: ['attachments', 'tenant-stores', 'lake'], attachments: { bytes: 300, sampled: 1 } });
+                // A later reading of the day replaces it; an older one, recorded after it, does not.
+                await host.admin.recordScopeStorage(staff, [{ tenantId: ta, scopeId: s, bytes: 100, readAt: day(0, '09:00:00'), attachments: 50 }]);
+                await host.admin.recordScopeStorage(staff, [{ tenantId: ta, scopeId: s, bytes: 100, readAt: day(0, '08:30:00'), attachments: 999 }]);
+                expect((await attachmentsOf(ta))?.attachments).toEqual({ bytes: 50, sampled: 1 });
+                // A reading that did not measure attachments (unsupported, failed, declined) leaves them.
+                await host.admin.recordScopeStorage(staff, [{ tenantId: ta, scopeId: s, bytes: 120, readAt: day(0, '10:00:00') }]);
+                expect(await attachmentsOf(ta)).toMatchObject({ bytes: 120, attachments: { bytes: 50, sampled: 1 } });
+                // A scope with none holds 0 of them: a sample like any other, counted in `sampled`.
+                await host.admin.recordScopeStorage(staff, [{ tenantId: ta, scopeId: quiet, bytes: 10, readAt: day(0, '10:00:00'), attachments: 0 }]);
+                expect((await attachmentsOf(ta))?.attachments).toEqual({ bytes: 50, sampled: 2 });
+                // Named under another tenant, refused like the database sample.
+                const other = tenantId.parse(ulid());
+                await host.admin.createTenant(staff, { id: other, slug: 'gauge-attachments-other', name: 'Gauge Attachments Other' });
+                await newScope(other);
+                await host.admin.recordScopeStorage(staff, [{ tenantId: other, scopeId: s, bytes: 1, readAt: day(0, '11:00:00'), attachments: 7 }]);
+                expect((await attachmentsOf(other))?.attachments).toBeUndefined();
+                expect((await attachmentsOf(ta))?.attachments).toEqual({ bytes: 50, sampled: 2 });
+                // Past retention a sample goes with the database samples, the limit shared across the tables.
+                while ((await host.admin.pruneScopeStorage(staff, 500)) > 0)
+                    ;
+                const old = new Date();
+                old.setUTCMonth(old.getUTCMonth() - 14);
+                const aged = tenantId.parse(ulid());
+                await host.admin.createTenant(staff, { id: aged, slug: 'gauge-attachments-old', name: 'Gauge Attachments Old' });
+                const agedScope = await newScope(aged);
+                await host.admin.recordScopeStorage(staff, [{ tenantId: aged, scopeId: agedScope, bytes: 1, readAt: old.toISOString(), attachments: 9 }]);
+                expect((await attachmentsOf(aged))?.attachments).toEqual({ bytes: 9, sampled: 1 });
+                expect(await host.admin.pruneScopeStorage(staff, 1)).toBe(1);
+                expect(await host.admin.pruneScopeStorage(staff, 500)).toBe(1);
+                expect((await attachmentsOf(aged))?.attachments).toBeUndefined();
+                expect((await attachmentsOf(ta))?.attachments).toEqual({ bytes: 50, sampled: 2 });
+                // A reaped scope's attachment samples follow its database days (#2515): the reap keeps
+                // them for the invoice and the gauge, which describes live storage, stops counting them.
+                const reaped = await newScope(ta);
+                await host.admin.recordScopeStorage(staff, [{ tenantId: ta, scopeId: reaped, bytes: 1, readAt: old.toISOString(), attachments: 4 }]);
+                await host.admin.recordScopeStorage(staff, [{ tenantId: ta, scopeId: reaped, bytes: 1, readAt: day(0, '12:00:00'), attachments: 3 }]);
+                expect((await attachmentsOf(ta))?.attachments).toEqual({ bytes: 53, sampled: 3 });
+                await host.admin.archiveScope(staff, ta, reaped);
+                await host.admin.reapScope(staff, ta, reaped);
+                expect((await attachmentsOf(ta))?.attachments).toEqual({ bytes: 50, sampled: 2 });
+                // Retention, not the reap, ends them: the old database day and the old attachment day are
+                // both still there for the prune to take, and the current ones stay.
+                expect(await host.admin.pruneScopeStorage(staff, 500)).toBe(2);
+                expect((await host.admin.listScopeStorage(staff, { scopeId: reaped })).map((r) => r.bytes)).toEqual([1]);
+            });
+            it('a tenant reap forgets its attachment samples with its other storage rows (#2501)', async () => {
+                while ((await host.admin.pruneScopeStorage(staff, 500)) > 0)
+                    ;
+                const gone = tenantId.parse(ulid());
+                await host.admin.createTenant(staff, { id: gone, slug: 'gauge-attachments-tenant-reap', name: 'Gauge Attachments Tenant Reap' });
+                const s = await newScope(gone);
+                // Past retention, so the prune (which reads the raw tables) finds the row if the reap left it.
+                const old = new Date();
+                old.setUTCMonth(old.getUTCMonth() - 14);
+                await host.admin.recordScopeStorage(staff, [{ tenantId: gone, scopeId: s, bytes: 1, readAt: old.toISOString(), attachments: 9 }]);
+                // Its twin, before the reap: both old samples are there for the prune to find.
+                const kept = tenantId.parse(ulid());
+                await host.admin.createTenant(staff, { id: kept, slug: 'gauge-attachments-tenant-kept', name: 'Gauge Attachments Tenant Kept' });
+                const ks = await newScope(kept);
+                await host.admin.recordScopeStorage(staff, [{ tenantId: kept, scopeId: ks, bytes: 1, readAt: old.toISOString(), attachments: 9 }]);
+                await host.admin.setTenantStatus(staff, gone, 'deleting');
+                await host.admin.reapTenant(staff, gone);
+                // Only the kept tenant's two rows (database and attachments) were left to prune.
+                expect(await host.admin.pruneScopeStorage(staff, 500)).toBe(2);
+            });
+            it("keeps a reaped scope's days for the invoice, ends its attempts, and never writes one for it again", async () => {
                 const tr = tenantId.parse(ulid());
                 await host.admin.createTenant(staff, { id: tr, slug: 'gauge-reap', name: 'Gauge Reap' });
                 const [kept, reaped] = [await newScope(tr), await newScope(tr)];
                 await record(tr, kept, 1, day(0, '02:00:00'));
                 await record(tr, reaped, 2, day(-1, '02:00:00'));
                 await record(tr, reaped, 3, day(0, '02:00:00'));
-                // A sample past retention, so the prune below (which reads the raw table, with no join
-                // to scope status) can tell whether reap deleted the rows or only the join hides them.
+                // A sample past retention: retention, not the reap, is what ends a reaped scope's days.
                 while ((await host.admin.pruneScopeStorage(staff, 500)) > 0)
                     ;
                 const old = new Date();
@@ -9265,14 +9570,25 @@ export function scopeHostContractSuite(adapterName, makeFixture, opts = {}) {
                 expect(await record(tr, reaped, 5, old.toISOString())).toEqual({ recorded: 1 });
                 await host.admin.archiveScope(staff, tr, reaped);
                 await host.admin.reapScope(staff, tr, reaped);
-                expect(await host.admin.pruneScopeStorage(staff, 500)).toBe(0);
-                expect((await host.admin.listScopeStorage(staff, { tenantId: tr })).map((r) => r.scopeId)).toEqual([kept]);
+                // Right after the reap all three days are there, the old one included: the reap deleted none.
+                expect((await host.admin.listScopeStorage(staff, { scopeId: reaped })).map((r) => r.bytes)).toEqual([5, 2, 3]);
+                // The month it was reaped in is still readable for the tenant, scope by scope.
+                const history = await host.admin.listScopeStorage(staff, { tenantId: tr, since: day(-1, '00:00:00').slice(0, 10) });
+                expect(history.filter((r) => r.scopeId === reaped).map((r) => r.bytes)).toEqual([2, 3]);
+                expect(history.filter((r) => r.scopeId === kept).map((r) => r.bytes)).toEqual([1]);
+                // The current gauge and the attempts describe live storage only.
+                expect((await host.admin.listScopeStorage(staff, { tenantId: tr, latest: true })).map((r) => r.scopeId)).toEqual([kept]);
+                expect((await host.admin.listScopeStorageAttempts(staff)).some((a) => a.scopeId === reaped)).toBe(false);
                 expect(await record(tr, reaped, 4, day(0, '03:00:00'))).toEqual({ recorded: 0 });
                 expect((await host.admin.readMeters(staff, { tenantId: tr })).perTenant[0].storage).toMatchObject({
                     bytes: 1,
                     sampled: 1,
                     total: 1, // the tombstone is not in the denominator
                 });
+                // Retention, not the reap, takes the one past thirteen months, and only it.
+                while ((await host.admin.pruneScopeStorage(staff, 500)) > 0)
+                    ;
+                expect((await host.admin.listScopeStorage(staff, { scopeId: reaped })).map((r) => r.bytes)).toEqual([2, 3]);
             });
             it('keeps an archived scope in the figure and refreshes it, so the tenant is not stuck stale', async () => {
                 const ta = tenantId.parse(ulid());
@@ -9375,6 +9691,23 @@ export function scopeHostContractSuite(adapterName, makeFixture, opts = {}) {
                 await host.deleteSnapshot(staff, tk, fork);
                 expect(await host.admin.pruneScopeStorage(staff, 500)).toBe(0);
             });
+            it("deletes a fork's attachment samples with its other samples, and keeps its source's (#2501)", async () => {
+                const tk = tenantId.parse(ulid());
+                await host.admin.createTenant(staff, { id: tk, slug: 'gauge-fork-attachments', name: 'Gauge Fork Attachments' });
+                const source = await newScope(tk);
+                const fork = await host.snapshotScope(staff, tk, source);
+                while ((await host.admin.pruneScopeStorage(staff, 500)) > 0)
+                    ;
+                const old = new Date();
+                old.setUTCMonth(old.getUTCMonth() - 14);
+                // Past retention, so the prune (which reads the raw tables) finds whatever the delete left.
+                for (const s of [source, fork]) {
+                    await host.admin.recordScopeStorage(staff, [{ tenantId: tk, scopeId: s, bytes: 1, readAt: old.toISOString(), attachments: 5 }]);
+                }
+                await host.deleteSnapshot(staff, tk, fork);
+                // Only the source's database and attachment samples were left to prune: the fork's went with it.
+                expect(await host.admin.pruneScopeStorage(staff, 500)).toBe(2);
+            });
             it('prunes samples older than thirteen months, at most the limit per call', async () => {
                 const tp = tenantId.parse(ulid());
                 await host.admin.createTenant(staff, { id: tp, slug: 'gauge-prune', name: 'Gauge Prune' });
@@ -9395,6 +9728,984 @@ export function scopeHostContractSuite(adapterName, makeFixture, opts = {}) {
                 await expect(host.admin.pruneScopeStorage(staff, -1)).rejects.toThrow(/limit/);
             });
         });
+        // -- the daily request rollup (#2501) ----------------------------------------
+        // -- the capability record (RFC wire-signing §7, Q8) ---------------------------
+        describe('the capability record (RFC wire-signing §7, Q8)', () => {
+            // Each test owns its verticals: the records are fleet-wide.
+            const slugOf = (name) => `${name}-${ulid().slice(-8).toLowerCase()}`;
+            const record = (over = {}) => ({
+                envelope: 1,
+                entrySkipped: null,
+                state: 'dual',
+                audience: 'acme-serving',
+                routerKids: ['If4x36FUomE', 'fX5Yi3zNBp0'],
+                platformKids: ['OfcT0KZEJT8'],
+                withheld: null,
+                ...over,
+            });
+            /** A record of an upload that gave no lists, and why. */
+            const withheld = (reason) => record({ state: 'legacy-only', audience: null, routerKids: [], platformKids: [], withheld: reason });
+            const at = (time) => `2026-10-24T${time}.000Z`;
+            /** The whole fleet, one full page: every read names its reach and its limit. */
+            const fleet = { reach: { fleet: true }, limit: LIST_PAGE_MAX };
+            /** The verticals this block registered: a record is written only beside its vertical's registration. */
+            const registered = new Set();
+            const register = async (slug, ownerTenant) => {
+                await host.admin.registerVertical(staff, { slug, name: slug, source: 'cli', ...(ownerTenant ? { ownerTenant } : {}) });
+                registered.add(slug);
+            };
+            const forget = async (slug) => {
+                await host.admin.deleteVertical(staff, slug);
+                registered.delete(slug);
+            };
+            /** Record `rec` for the script `<vertical>-<script>`, registering the vertical (platform-owned) first when no test did. */
+            const put = async (vertical, script, versionId, rec, time) => {
+                if (!registered.has(vertical))
+                    await register(vertical);
+                await host.admin.recordWireAuth(staff, { deploymentRef: `${vertical}-${script}`, verticalSlug: vertical, versionId, record: rec, recordedAt: at(time) });
+            };
+            it('keeps one record per deployment, the last upload’s, and lists one vertical’s by deployment', async () => {
+                const [a, b] = [slugOf('wire-a'), slugOf('wire-b')];
+                await put(a, 'serving', 'v1', record({ audience: `${a}-serving` }), '10:00:00');
+                await put(a, 'archive', 'v1', record({ audience: `${a}-archive` }), '10:00:01');
+                await put(b, 'serving', null, withheld('not-in-rollout'), '10:00:02');
+                // The serving script uploaded again, for another version, given nothing this time: its record is replaced.
+                await put(a, 'serving', 'v2', withheld('lists-refused'), '10:05:00');
+                expect(await host.admin.listWireAuth(staff, { ...fleet, verticalSlug: a })).toEqual([
+                    { deploymentRef: `${a}-archive`, verticalSlug: a, versionId: 'v1', record: record({ audience: `${a}-archive` }), recordedAt: at('10:00:01') },
+                    { deploymentRef: `${a}-serving`, verticalSlug: a, versionId: 'v2', record: withheld('lists-refused'), recordedAt: at('10:05:00') },
+                ]);
+                const all = await host.admin.listWireAuth(staff, { ...fleet });
+                expect(all.filter((r) => r.verticalSlug === a || r.verticalSlug === b).map((r) => r.deploymentRef)).toEqual([`${a}-archive`, `${a}-serving`, `${b}-serving`]);
+                // An entry the uploader left off is recorded as such: no envelope, and why.
+                await put(b, 'serving', null, record({ envelope: null, entrySkipped: 'an older bundle' }), '10:06:00');
+                expect((await host.admin.listWireAuth(staff, { ...fleet, verticalSlug: b }))[0].record).toMatchObject({ envelope: null, entrySkipped: 'an older bundle' });
+            });
+            it('writes each record to the admin log, naming the vertical, the script and the version, never a key', async () => {
+                const a = slugOf('wire-log');
+                await put(a, 'serving', 'v1', record(), '11:00:00');
+                const rows = (await host.admin.auditLog(staff, { action: 'recordWireAuth' })).filter((r) => r.vertical === a);
+                expect(rows).toHaveLength(1);
+                expect(rows[0].actor).toBe(staff);
+                expect(rows[0].after).toEqual({ vertical: a, deploymentRef: `${a}-serving`, versionId: 'v1', record: record() });
+            });
+            it('refuses a record that does not parse, or contradicts itself, and stores nothing for it', async () => {
+                const a = slugOf('wire-bad');
+                const good = { deploymentRef: `${a}-serving`, verticalSlug: a, versionId: null, record: record(), recordedAt: at('12:00:00') };
+                for (const bad of [
+                    { ...good, deploymentRef: '' },
+                    { ...good, verticalSlug: '' },
+                    { ...good, recordedAt: 'yesterday' },
+                    { ...good, record: { ...record(), envelope: 2 } },
+                    { ...good, record: { ...record(), state: 'on' } },
+                    { ...good, record: { ...record(), withheld: 'because' } },
+                    // An envelope beside a reason the entry was left off, or neither.
+                    { ...good, record: record({ entrySkipped: 'an older bundle' }) },
+                    { ...good, record: record({ envelope: null }) },
+                    // Lists given beside a reason none were, lists given naming no key, and a reason with lists still named.
+                    { ...good, record: record({ withheld: 'unconfigured' }) },
+                    { ...good, record: record({ routerKids: [] }) },
+                    { ...good, record: record({ platformKids: [] }) },
+                    { ...good, record: { ...withheld('unconfigured'), routerKids: ['If4x36FUomE'] } },
+                    { ...good, record: { ...withheld('unconfigured'), state: 'dual' } },
+                ]) {
+                    await expectRefusal(host.admin.recordWireAuth(staff, bad), 'validation_failed');
+                }
+                expect(await host.admin.listWireAuth(staff, { ...fleet, verticalSlug: a })).toEqual([]);
+            });
+            it('reads a page at a time by script name, and each read is access-logged', async () => {
+                const a = slugOf('wire-page');
+                for (const [i, script] of ['a1', 'a2', 'a3'].entries())
+                    await put(a, script, null, record(), `14:00:0${i}`);
+                const reach = { fleet: true };
+                const first = await host.admin.listWireAuth(staff, { reach, verticalSlug: a, limit: 2 });
+                expect(first.map((r) => r.deploymentRef)).toEqual([`${a}-a1`, `${a}-a2`]);
+                const rest = await host.admin.listWireAuth(staff, { reach, verticalSlug: a, limit: 2, cursor: first.at(-1).deploymentRef });
+                expect(rest.map((r) => r.deploymentRef)).toEqual([`${a}-a3`]);
+                expect((await host.admin.listWireAuth(staff, { reach, verticalSlug: a, order: 'desc', limit: 1 })).map((r) => r.deploymentRef)).toEqual([`${a}-a3`]);
+                // The cap is a full page, and one past it is refused, not clamped.
+                expect(await host.admin.listWireAuth(staff, { reach, verticalSlug: a, limit: LIST_PAGE_MAX })).toHaveLength(3);
+                const reads = (await host.admin.accessLog(staff, { method: 'listWireAuth' }))
+                    .map((e) => ({ actor: e.actor, params: JSON.parse(e.params ?? 'null'), count: e.resultCount }))
+                    .filter((e) => e.params?.['verticalSlug'] === a);
+                expect(reads).toEqual([
+                    { actor: staff, params: { reach, verticalSlug: a, limit: 2 }, count: 2 },
+                    { actor: staff, params: { reach, verticalSlug: a, limit: 2, cursor: `${a}-a2` }, count: 1 },
+                    { actor: staff, params: { reach, verticalSlug: a, order: 'desc', limit: 1 }, count: 1 },
+                    { actor: staff, params: { reach, verticalSlug: a, limit: LIST_PAGE_MAX }, count: 3 },
+                ]);
+            });
+            it('refuses a read that does not name its reach and its limit, and logs no access for it', async () => {
+                const a = slugOf('wire-refuse');
+                await put(a, 'serving', null, record(), '15:00:00');
+                const t = ulid();
+                for (const bad of [
+                    // No filter, no reach, an empty reach, both reaches, a reach that is not one.
+                    undefined,
+                    { limit: 10, verticalSlug: a },
+                    { reach: {}, limit: 10, verticalSlug: a },
+                    { reach: { tenantId: t, fleet: true }, limit: 10, verticalSlug: a },
+                    { reach: { fleet: false }, limit: 10, verticalSlug: a },
+                    { reach: { fleet: 'yes' }, limit: 10, verticalSlug: a },
+                    { reach: { tenantId: 'acme' }, limit: 10, verticalSlug: a },
+                    { reach: { tenantId: '' }, limit: 10, verticalSlug: a },
+                    { reach: { tenantId: t, extra: 1 }, limit: 10, verticalSlug: a },
+                    { reach: 'fleet', limit: 10, verticalSlug: a },
+                    // No limit, or one outside 1..LIST_PAGE_MAX.
+                    { reach: { fleet: true }, verticalSlug: a },
+                    ...[0, -1, 1.5, LIST_PAGE_MAX + 1, Number.POSITIVE_INFINITY, Number.NaN, '10'].map((limit) => ({ reach: { fleet: true }, limit, verticalSlug: a })),
+                    // The optional fields in their own types, and the text ones no longer than their bound.
+                    { reach: { fleet: true }, limit: 10, verticalSlug: '' },
+                    { reach: { fleet: true }, limit: 10, verticalSlug: 'x'.repeat(257) },
+                    { reach: { fleet: true }, limit: 10, verticalSlug: a, cursor: 7 },
+                    { reach: { fleet: true }, limit: 10, verticalSlug: a, cursor: '' },
+                    { reach: { fleet: true }, limit: 10, verticalSlug: a, cursor: 'x'.repeat(257) },
+                    { reach: { fleet: true }, limit: 10, verticalSlug: a, order: 'sideways' },
+                    // Only the filter's own keys: an unknown one is refused, never carried across or logged.
+                    { reach: { fleet: true }, limit: 10, verticalSlug: a, tenantId: t },
+                    { reach: { fleet: true }, limit: 10, verticalSlug: a, extra: 'x'.repeat(400) },
+                    { reach: { fleet: true }, limit: 10, verticalSlug: a, offset: 0 },
+                    // Arrays are not a filter, nor a reach.
+                    [{ reach: { fleet: true }, limit: 10, verticalSlug: a }],
+                    { reach: [{ fleet: true }], limit: 10, verticalSlug: a },
+                ]) {
+                    await expectRefusal(host.admin.listWireAuth(staff, bad), 'validation_failed');
+                }
+                const reads = (await host.admin.accessLog(staff, { method: 'listWireAuth' })).filter((e) => (e.params ?? '').includes(a));
+                expect(reads).toEqual([]);
+            });
+            it('confines a tenant’s read to the verticals it owns now', async () => {
+                const [owner, other] = [tenantId.parse(ulid()), tenantId.parse(ulid())];
+                await host.admin.createTenant(staff, { id: owner, slug: `wire-own-${owner.slice(-6).toLowerCase()}`, name: 'Wire Owner' });
+                await host.admin.createTenant(staff, { id: other, slug: `wire-oth-${other.slice(-6).toLowerCase()}`, name: 'Wire Other' });
+                const [mine, theirs, platform] = [slugOf('wire-mine'), slugOf('wire-theirs'), slugOf('wire-plat')];
+                await register(mine, owner);
+                await register(theirs, other);
+                await register(platform);
+                for (const [i, slug] of [mine, theirs, platform].entries()) {
+                    await put(slug, 'serving', null, record(), `16:00:0${i}`);
+                    await put(slug, 'archive', 'v1', record(), `16:00:1${i}`);
+                }
+                const refs = async (reach, verticalSlug) => (await host.admin.listWireAuth(staff, { reach, limit: LIST_PAGE_MAX, ...(verticalSlug ? { verticalSlug } : {}) }))
+                    .map((r) => r.deploymentRef)
+                    .filter((ref) => [mine, theirs, platform].some((slug) => ref.startsWith(`${slug}-`)));
+                expect(await refs({ tenantId: owner })).toEqual([`${mine}-archive`, `${mine}-serving`]);
+                expect(await refs({ tenantId: other })).toEqual([`${theirs}-archive`, `${theirs}-serving`]);
+                // Naming another tenant's vertical inside one tenant's reach reaches nothing, not that vertical.
+                expect(await refs({ tenantId: owner }, theirs)).toEqual([]);
+                expect(await refs({ tenantId: owner }, mine)).toEqual([`${mine}-archive`, `${mine}-serving`]);
+                // A tenant that owns nothing reaches nothing; a vertical no tenant owns is reached by the fleet alone.
+                expect(await refs({ tenantId: tenantId.parse(ulid()) })).toEqual([]);
+                for (const slug of [mine, theirs, platform]) {
+                    expect(await refs({ fleet: true }, slug)).toEqual([`${slug}-archive`, `${slug}-serving`]);
+                }
+                // A page inside the reach pages over the tenant's records only.
+                const page = await host.admin.listWireAuth(staff, { reach: { tenantId: owner }, limit: 1 });
+                expect(page.map((r) => r.deploymentRef)).toEqual([`${mine}-archive`]);
+                const next = await host.admin.listWireAuth(staff, { reach: { tenantId: owner }, limit: 1, cursor: page[0].deploymentRef });
+                expect(next.map((r) => r.deploymentRef)).toEqual([`${mine}-serving`]);
+                expect(await host.admin.listWireAuth(staff, { reach: { tenantId: owner }, limit: 1, cursor: next[0].deploymentRef })).toEqual([]);
+            });
+            it('reads only the filter’s own fields, and echoes an unknown key no longer than its bound', async () => {
+                const a = slugOf('wire-own');
+                await put(a, 'archive', null, record(), '19:00:00');
+                await put(a, 'serving', null, record(), '19:00:01');
+                const refs = (rows) => rows.map((r) => r.deploymentRef);
+                // An inherited cursor or order is not the caller's: it is neither applied nor judged, and the
+                // judged copy that is logged carries none of it.
+                const inherited = Object.assign(Object.create({ cursor: `${a}-serving`, order: 'sideways' }), {
+                    reach: { fleet: true },
+                    limit: LIST_PAGE_MAX,
+                    verticalSlug: a,
+                });
+                expect(refs(await host.admin.listWireAuth(staff, inherited))).toEqual([`${a}-archive`, `${a}-serving`]);
+                const logged = (await host.admin.accessLog(staff, { method: 'listWireAuth' })).filter((e) => (e.params ?? '').includes(a));
+                expect(logged.map((e) => e.params)).toEqual([JSON.stringify({ reach: { fleet: true }, verticalSlug: a, limit: LIST_PAGE_MAX })]);
+                // A reach or a limit only inherited is no reach or limit at all, and an inherited tenant is no tenant.
+                for (const bad of [
+                    Object.create({ reach: { fleet: true }, limit: 10 }),
+                    Object.assign(Object.create({ limit: 10 }), { reach: { fleet: true }, verticalSlug: a }),
+                    Object.assign(Object.create({ reach: { fleet: true } }), { limit: 10, verticalSlug: a }),
+                    { reach: Object.create({ tenantId: ulid() }), limit: 10, verticalSlug: a },
+                    { reach: Object.create({ fleet: true }), limit: 10, verticalSlug: a },
+                ]) {
+                    await expectRefusal(host.admin.listWireAuth(staff, bad), 'validation_failed');
+                }
+                // An unknown key is named in the refusal, cut to its bound with an ellipsis.
+                const longKey = 'k'.repeat(400);
+                const error = await host.admin.listWireAuth(staff, { reach: { fleet: true }, limit: 10, [longKey]: 1 }).then(() => null, (e) => e);
+                expect(errorCodeOf(error)).toBe('validation_failed');
+                const message = error.message;
+                expect(message).toContain(`${'k'.repeat(64)}…`);
+                expect(message).not.toContain('k'.repeat(65));
+            });
+            it('logs a tenant’s read against that tenant and the fleet’s against none, the judged filter with its reach first', async () => {
+                const owner = tenantId.parse(ulid());
+                await host.admin.createTenant(staff, { id: owner, slug: `wire-log-${owner.slice(-6).toLowerCase()}`, name: 'Wire Log' });
+                const mine = slugOf('wire-logged');
+                await register(mine, owner);
+                await put(mine, 'serving', null, record(), '17:00:00');
+                // The reach given last, as a caller may spell it: the log still names it first.
+                await host.admin.listWireAuth(staff, { limit: 5, verticalSlug: mine, reach: { tenantId: owner } });
+                const forTenant = await host.admin.accessLog(staff, { method: 'listWireAuth', tenantId: owner });
+                expect(forTenant.map((e) => ({ tenantId: e.tenantId, params: e.params, count: e.resultCount }))).toEqual([
+                    { tenantId: owner, params: JSON.stringify({ reach: { tenantId: owner }, verticalSlug: mine, limit: 5 }), count: 1 },
+                ]);
+                // The fleet's read is logged against no tenant, and is told apart by its reach.
+                await host.admin.listWireAuth(staff, { reach: { fleet: true }, limit: 5, verticalSlug: mine });
+                const fleetRows = (await host.admin.accessLog(staff, { method: 'listWireAuth' })).filter((e) => (e.params ?? '').includes(mine) && e.tenantId === null);
+                expect(fleetRows.map((e) => e.params)).toEqual([JSON.stringify({ reach: { fleet: true }, verticalSlug: mine, limit: 5 })]);
+                expect(await host.admin.accessLog(staff, { method: 'listWireAuth', tenantId: owner })).toHaveLength(1);
+                // A vertical and a cursor at their longest cannot push the reach out of the logged text, which
+                // the log keeps cut to a bounded length.
+                const long = 'z'.repeat(WIRE_AUTH_FILTER_TEXT_MAX);
+                await host.admin.listWireAuth(staff, { cursor: long, verticalSlug: long, limit: 5, reach: { tenantId: owner } });
+                const logged = (await host.admin.accessLog(staff, { method: 'listWireAuth', tenantId: owner })).map((e) => e.params ?? '');
+                expect(logged).toHaveLength(2);
+                for (const params of logged)
+                    expect(params.startsWith(`{"reach":{"tenantId":"${owner}"}`)).toBe(true);
+            });
+            it('follows the vertical’s current owner, resolved when the read runs', async () => {
+                const [first, second] = [tenantId.parse(ulid()), tenantId.parse(ulid())];
+                await host.admin.createTenant(staff, { id: first, slug: `wire-fst-${first.slice(-6).toLowerCase()}`, name: 'Wire First' });
+                await host.admin.createTenant(staff, { id: second, slug: `wire-snd-${second.slice(-6).toLowerCase()}`, name: 'Wire Second' });
+                const slug = slugOf('wire-owned');
+                const refsOf = async (owner) => (await host.admin.listWireAuth(staff, { reach: { tenantId: owner }, limit: LIST_PAGE_MAX, verticalSlug: slug })).map((r) => r.deploymentRef);
+                // The owner reads what was recorded while it held the slug.
+                await register(slug, first);
+                await put(slug, 'archive', 'v0', record(), '18:00:00');
+                expect(await refsOf(first)).toEqual([`${slug}-archive`]);
+                await put(slug, 'serving', 'v1', record(), '18:00:01');
+                expect(await refsOf(first)).toEqual([`${slug}-archive`, `${slug}-serving`]);
+                // An owner changes by deleting the vertical, which takes its records, and registering it again:
+                // the tenant that held it reads nothing after, the new owner reads only what was recorded since.
+                await forget(slug);
+                await register(slug, second);
+                expect(await refsOf(first)).toEqual([]);
+                expect(await refsOf(second)).toEqual([]);
+                await put(slug, 'serving', 'v2', record(), '18:00:02');
+                expect(await refsOf(first)).toEqual([]);
+                expect(await refsOf(second)).toEqual([`${slug}-serving`]);
+            });
+            it('writes no record, and no admin row, for a vertical the registry does not hold', async () => {
+                const never = slugOf('wire-unreg');
+                const gone = slugOf('wire-gone');
+                await put(gone, 'serving', 'v1', record(), '20:00:00');
+                await forget(gone);
+                for (const slug of [never, gone]) {
+                    await expectRefusal(host.admin.recordWireAuth(staff, { deploymentRef: `${slug}-serving`, verticalSlug: slug, versionId: 'v2', record: record(), recordedAt: at('20:00:01') }), 'not_found');
+                    expect(await host.admin.listWireAuth(staff, { ...fleet, verticalSlug: slug })).toEqual([]);
+                }
+                const rows = (await host.admin.auditLog(staff, { action: 'recordWireAuth' })).filter((r) => r.vertical === never || r.vertical === gone);
+                // Only the one write made while `gone` was registered.
+                expect(rows.map((r) => r.after.versionId)).toEqual(['v1']);
+                // Registered again, the slug's records start empty: nothing written while unregistered survives.
+                await register(gone);
+                expect(await host.admin.listWireAuth(staff, { ...fleet, verticalSlug: gone })).toEqual([]);
+            });
+            it('keeps a walk’s hold on a record, by binding name, and refuses a hold it cannot read', async () => {
+                const a = slugOf('wire-hold');
+                const hold = { reason: 'verify', bindings: ['SCOPE', 'SUBSTRAT_WIRE_STATE'], at: at('22:00:00') };
+                await put(a, 'archive', 'v1', { ...record(), walkHold: hold }, '22:00:00');
+                expect((await host.admin.listWireAuth(staff, { ...fleet, verticalSlug: a }))[0].record.walkHold).toEqual(hold);
+                // The next upload of the script writes a record without it.
+                await put(a, 'archive', 'v1', record(), '22:00:01');
+                expect((await host.admin.listWireAuth(staff, { ...fleet, verticalSlug: a }))[0].record.walkHold).toBeUndefined();
+                const good = { deploymentRef: `${a}-archive`, verticalSlug: a, versionId: 'v1', recordedAt: at('22:00:02') };
+                for (const walkHold of [
+                    { ...hold, reason: 'because' },
+                    { ...hold, at: 'yesterday' },
+                    { ...hold, bindings: [''] },
+                    { ...hold, bindings: Array.from({ length: 65 }, (_, i) => `B${i}`) },
+                    { ...hold, value: 'not a field' },
+                    // The count of names past the cap is a positive whole number when given.
+                    { ...hold, more: 0 },
+                    { ...hold, more: 1.5 },
+                ]) {
+                    await expectRefusal(host.admin.recordWireAuth(staff, { ...good, record: { ...record(), walkHold } }), 'validation_failed');
+                }
+                expect((await host.admin.listWireAuth(staff, { ...fleet, verticalSlug: a }))[0].record.walkHold).toBeUndefined();
+                // A hold of more names than it keeps: the first ones, and how many more.
+                const many = { ...hold, bindings: Array.from({ length: 64 }, (_, i) => `B${i}`), more: 6 };
+                await put(a, 'archive', 'v1', { ...record(), walkHold: many }, '22:00:02');
+                expect((await host.admin.listWireAuth(staff, { ...fleet, verticalSlug: a }))[0].record.walkHold).toEqual(many);
+                await put(a, 'archive', 'v1', record(), '22:00:02');
+                // `unverified`, the walk's record of a script it could not confirm: lists claimed by none, and
+                // only beside a hold. Without the hold, or beside lists, it is refused.
+                const unverified = withheld('unverified');
+                await expectRefusal(host.admin.recordWireAuth(staff, { ...good, record: unverified }), 'validation_failed');
+                await expectRefusal(host.admin.recordWireAuth(staff, { ...good, record: { ...record(), withheld: 'unverified', walkHold: hold } }), 'validation_failed');
+                await put(a, 'archive', 'v1', { ...unverified, walkHold: hold }, '22:00:03');
+                expect((await host.admin.listWireAuth(staff, { ...fleet, verticalSlug: a }))[0].record).toMatchObject({ withheld: 'unverified', state: 'legacy-only', routerKids: [], walkHold: hold });
+            });
+            it('audits a pass of the fleet walk as walkWireAuth, naming scripts and reasons, never a value', async () => {
+                const entry = {
+                    apply: true,
+                    confirm: false,
+                    from: null,
+                    next: 'acme/crm|01HZZZZZZZZZZZZZZZZZZZZZZZ',
+                    walked: 3,
+                    updated: ['acme-crm'],
+                    held: ['acme-crm-01hzzzzzzzzzzzzzzzzzzzzzzz'],
+                    released: [],
+                    skipped: [{ deploymentRef: 'acme-crm-01hyyyyyyyyyyyyyyyyyyyyyyy', reason: 'no-entry' }],
+                    failed: [{ deploymentRef: 'acme-crm-01hzzzzzzzzzzzzzzzzzzzzzzz', reason: 'verify' }],
+                };
+                await host.admin.recordWireWalk(staff, entry);
+                const rows = (await host.admin.auditLog(staff, { action: 'walkWireAuth' })).filter((r) => r.after.next === entry.next);
+                expect(rows).toHaveLength(1);
+                expect(rows[0].actor).toBe(staff);
+                expect(rows[0].after).toEqual(entry);
+            });
+            it('restores the owners and the records together, from one dump', async () => {
+                const [first, second] = [tenantId.parse(ulid()), tenantId.parse(ulid())];
+                await host.admin.createTenant(staff, { id: first, slug: `wire-rst-${first.slice(-6).toLowerCase()}`, name: 'Wire Restore' });
+                const slug = slugOf('wire-restore');
+                await register(slug, first);
+                await put(slug, 'serving', 'v1', record(), '21:00:00');
+                const backup = await host.admin.exportDirectory(staff);
+                // Diverge past the copy: the vertical deleted (its records with it) and taken by another tenant.
+                await host.admin.createTenant(staff, { id: second, slug: `wire-rs2-${second.slice(-6).toLowerCase()}`, name: 'Wire Restore 2' });
+                await forget(slug);
+                await register(slug, second);
+                await put(slug, 'archive', 'v2', record(), '21:00:01');
+                await host.admin.restoreDirectory(staff, backup);
+                registered.add(slug);
+                // The copy's owner reads the copy's records, and nothing of the divergence came back with it.
+                const reads = async (reach) => (await host.admin.listWireAuth(staff, { reach, limit: LIST_PAGE_MAX, verticalSlug: slug })).map((r) => [r.deploymentRef, r.versionId]);
+                expect(await reads({ tenantId: first })).toEqual([[`${slug}-serving`, 'v1']]);
+                expect(await reads({ tenantId: second })).toEqual([]);
+                expect(await reads({ fleet: true })).toEqual([[`${slug}-serving`, 'v1']]);
+            });
+            it('forgets a vertical’s records with the vertical', async () => {
+                const a = slugOf('wire-del');
+                await register(a);
+                await put(a, 'serving', null, record(), '13:00:00');
+                const kept = slugOf('wire-kept');
+                await put(kept, 'serving', null, record(), '13:00:01');
+                await forget(a);
+                expect(await host.admin.listWireAuth(staff, { ...fleet, verticalSlug: a })).toEqual([]);
+                // Another vertical's record is not touched.
+                expect(await host.admin.listWireAuth(staff, { ...fleet, verticalSlug: kept })).toHaveLength(1);
+            });
+        });
+        describe('the daily request rollup (#2501)', () => {
+            // Each test owns its days, because the rollup's record of a day is fleet-wide.
+            const dayAgo = (n) => new Date(Date.now() - n * 86_400_000).toISOString().slice(0, 10);
+            const monthsAgo = (m) => {
+                const d = new Date();
+                d.setUTCMonth(d.getUTCMonth() - m);
+                return d.toISOString().slice(0, 10);
+            };
+            const at = (day, time) => `${day}T${time}.000Z`;
+            const ids = () => ({ tenant: tenantId.parse(ulid()), scope: scopeId.parse(ulid()) });
+            // `n` requests, all served (2xx) unless a split is given.
+            const served = (n, split = {}) => ({ requests: n, class2xx: n, class3xx: 0, class4xx: 0, class5xx: 0, rateLimited: 0, ...split });
+            it('keeps one row per (day, tenant, vertical, scope) with its status split, every count an estimate, and a later read replaces the day', async () => {
+                const day = dayAgo(2);
+                const [a, b] = [ids(), ids()];
+                // 40 routed: 30 served, 1 redirected, 7 refused (5 of them the router's rate limit), 2 failed.
+                const split = { class2xx: 30, class3xx: 1, class4xx: 7, class5xx: 2, rateLimited: 5 };
+                expect(await host.admin.recordRequestDay(staff, {
+                    day,
+                    attemptedAt: at(day, '23:00:00'),
+                    counts: [
+                        { tenantId: a.tenant, vertical: 'acme-crm', scopeId: a.scope, ...served(40, split), sampled: true },
+                        // A request that resolved to no vertical is kept under none.
+                        { tenantId: a.tenant, vertical: null, scopeId: a.scope, ...served(2), sampled: false },
+                        { tenantId: b.tenant, vertical: 'acme-crm', scopeId: b.scope, ...served(5), sampled: false },
+                    ],
+                })).toEqual({ recorded: 3 });
+                expect(await host.admin.listRequestDays(staff, { tenantId: a.tenant })).toEqual([
+                    { day, tenantId: a.tenant, vertical: null, scopeId: a.scope, ...served(2), sampled: false, estimated: true },
+                    { day, tenantId: a.tenant, vertical: 'acme-crm', scopeId: a.scope, ...served(40, split), sampled: true, estimated: true },
+                ]);
+                // Read again, the day is what the newer read counted: a key it no longer names is gone.
+                await host.admin.recordRequestDay(staff, {
+                    day,
+                    attemptedAt: at(day, '23:30:00'),
+                    counts: [{ tenantId: a.tenant, vertical: 'acme-crm', scopeId: a.scope, ...served(41), sampled: true }],
+                });
+                expect((await host.admin.listRequestDays(staff, { since: day, until: day })).map((r) => [r.tenantId, r.requests])).toEqual([
+                    [a.tenant, 41],
+                ]);
+                expect(await host.admin.listRequestRollupDays(staff, { since: day, until: day })).toEqual([
+                    {
+                        day,
+                        attemptedAt: at(day, '23:30:00'),
+                        readAt: at(day, '23:30:00'),
+                        rows: 1,
+                        error: null,
+                        saturated: false,
+                        failingSince: null,
+                        failingCount: null,
+                    },
+                ]);
+                // K-24: both reads are attributable.
+                const reads = await host.admin.accessLog(staff, { method: 'listRequestDays' });
+                expect(reads.some((r) => r.tenantId === a.tenant)).toBe(true);
+                expect((await host.admin.accessLog(staff, { method: 'listRequestRollupDays' })).length).toBeGreaterThan(0);
+            });
+            it('records a failed read as the attempt, writes nothing of the day, and keeps a read that succeeded', async () => {
+                const day = dayAgo(3);
+                const t = ids();
+                expect(await host.admin.recordRequestDay(staff, { day, attemptedAt: at(day, '01:00:00'), error: 'HTTP 503' })).toEqual({
+                    recorded: 0,
+                });
+                expect(await host.admin.listRequestRollupDays(staff, { since: day, until: day })).toEqual([
+                    // A failure named no run, so it starts one of its own.
+                    {
+                        day,
+                        attemptedAt: at(day, '01:00:00'),
+                        readAt: null,
+                        rows: null,
+                        error: 'HTTP 503',
+                        saturated: false,
+                        failingSince: at(day, '01:00:00'),
+                        failingCount: 1,
+                    },
+                ]);
+                expect(await host.admin.listRequestDays(staff, { since: day, until: day })).toEqual([]);
+                // A success clears the error, and ends the run the failure had started.
+                await host.admin.recordRequestDay(staff, {
+                    day,
+                    attemptedAt: at(day, '02:00:00'),
+                    counts: [{ tenantId: t.tenant, vertical: 'acme-crm', scopeId: t.scope, ...served(9), sampled: false }],
+                });
+                expect((await host.admin.listRequestRollupDays(staff, { since: day, until: day }))[0]).toMatchObject({
+                    readAt: at(day, '02:00:00'),
+                    error: null,
+                    failingSince: null,
+                    failingCount: null,
+                });
+                // A later failure records the attempt and leaves the day's rows and its successful read. It
+                // names the run it extends, and the record keeps that run's start and length.
+                await host.admin.recordRequestDay(staff, {
+                    day,
+                    attemptedAt: at(day, '03:00:00'),
+                    error: 'HTTP 503',
+                    failingSince: at(day, '00:30:00'),
+                    failingCount: 4,
+                });
+                expect(await host.admin.listRequestRollupDays(staff, { since: day, until: day })).toEqual([
+                    {
+                        day,
+                        attemptedAt: at(day, '03:00:00'),
+                        readAt: at(day, '02:00:00'),
+                        rows: 1,
+                        error: 'HTTP 503',
+                        saturated: false,
+                        failingSince: at(day, '00:30:00'),
+                        failingCount: 4,
+                    },
+                ]);
+                await expect(host.admin.recordRequestDay(staff, { day, attemptedAt: at(day, '04:00:00'), error: 'HTTP 503', failingCount: 0 })).rejects.toThrow(/failingCount/);
+                expect((await host.admin.listRequestDays(staff, { since: day, until: day })).map((r) => r.requests)).toEqual([9]);
+            });
+            it('records a saturated day as a standing state on its record, and a later read clears it', async () => {
+                const day = dayAgo(8);
+                const t = ids();
+                await host.admin.recordRequestDay(staff, {
+                    day,
+                    attemptedAt: at(day, '01:00:00'),
+                    error: 'more than 50000 groups',
+                    saturated: true,
+                    failingSince: at(day, '00:00:00'),
+                    failingCount: 3,
+                });
+                // Saturated belongs to no run of failures, even when it is handed one.
+                expect(await host.admin.listRequestRollupDays(staff, { since: day, until: day })).toEqual([
+                    {
+                        day,
+                        attemptedAt: at(day, '01:00:00'),
+                        readAt: null,
+                        rows: null,
+                        error: 'more than 50000 groups',
+                        saturated: true,
+                        failingSince: null,
+                        failingCount: null,
+                    },
+                ]);
+                // Its twin: an ordinary failure of the same day is not saturated, and does start a run.
+                await host.admin.recordRequestDay(staff, { day, attemptedAt: at(day, '02:00:00'), error: 'HTTP 503' });
+                expect((await host.admin.listRequestRollupDays(staff, { since: day, until: day }))[0]).toMatchObject({
+                    saturated: false,
+                    failingCount: 1,
+                });
+                await host.admin.recordRequestDay(staff, { day, attemptedAt: at(day, '03:00:00'), error: 'too many', saturated: true });
+                await host.admin.recordRequestDay(staff, {
+                    day,
+                    attemptedAt: at(day, '04:00:00'),
+                    counts: [{ tenantId: t.tenant, vertical: 'acme-crm', scopeId: t.scope, ...served(2), sampled: false }],
+                });
+                expect((await host.admin.listRequestRollupDays(staff, { since: day, until: day }))[0]).toMatchObject({
+                    readAt: at(day, '04:00:00'),
+                    error: null,
+                    saturated: false,
+                    failingSince: null,
+                    failingCount: null,
+                });
+            });
+            it('refuses a malformed count whole, writing none of the day; the same day well formed is written', async () => {
+                const day = dayAgo(4);
+                const t = ids();
+                const good = { tenantId: t.tenant, vertical: 'acme-crm', scopeId: t.scope, ...served(3), sampled: false };
+                await expect(host.admin.recordRequestDay(staff, {
+                    day,
+                    attemptedAt: at(day, '04:00:00'),
+                    counts: [good, { ...good, tenantId: 'not-a-tenant-id', ...served(1) }],
+                })).rejects.toThrow();
+                await expect(host.admin.recordRequestDay(staff, { day, attemptedAt: at(day, '04:00:00'), counts: [good, { ...good, requests: -1 }] })).rejects.toThrow();
+                // A split that does not fit inside its total, or 429s beyond the 4xx, is malformed too.
+                await expect(host.admin.recordRequestDay(staff, { day, attemptedAt: at(day, '04:00:00'), counts: [good, { ...good, ...served(3, { class5xx: 1 }) }] })).rejects.toThrow();
+                await expect(host.admin.recordRequestDay(staff, {
+                    day,
+                    attemptedAt: at(day, '04:00:00'),
+                    counts: [good, { ...good, ...served(3, { class2xx: 2, class4xx: 1, rateLimited: 2 }) }],
+                })).rejects.toThrow();
+                expect(await host.admin.listRequestDays(staff, { since: day, until: day })).toEqual([]);
+                expect(await host.admin.listRequestRollupDays(staff, { since: day, until: day })).toEqual([]);
+                // Two counts for one key are summed, every column of them, never one dropped. Each column
+                // is non-zero on both sides and differs between them, so a column taken from one side
+                // instead of summed cannot pass for the sum.
+                const one = served(4, { class2xx: 1, class3xx: 1, class4xx: 1, class5xx: 1, rateLimited: 1 });
+                const other = served(10, { class2xx: 2, class3xx: 3, class4xx: 2, class5xx: 3, rateLimited: 2 });
+                expect(await host.admin.recordRequestDay(staff, {
+                    day,
+                    attemptedAt: at(day, '05:00:00'),
+                    counts: [
+                        { ...good, ...one },
+                        { ...good, ...other, sampled: true },
+                    ],
+                })).toEqual({ recorded: 1 });
+                expect(await host.admin.listRequestDays(staff, { since: day, until: day })).toEqual([
+                    {
+                        day,
+                        tenantId: t.tenant,
+                        vertical: 'acme-crm',
+                        scopeId: t.scope,
+                        ...served(14, { class2xx: 3, class3xx: 4, class4xx: 3, class5xx: 4, rateLimited: 3 }),
+                        sampled: true,
+                        estimated: true,
+                    },
+                ]);
+            });
+            it('filters by tenant, vertical, scope and an inclusive window of days, and bounds the page', async () => {
+                const [d5, d6, d7] = [dayAgo(5), dayAgo(6), dayAgo(7)];
+                const t = tenantId.parse(ulid());
+                const [s1, s2] = [scopeId.parse(ulid()), scopeId.parse(ulid())];
+                for (const day of [d5, d6, d7]) {
+                    await host.admin.recordRequestDay(staff, {
+                        day,
+                        attemptedAt: at(day, '23:59:00'),
+                        counts: [
+                            { tenantId: t, vertical: 'acme-crm', scopeId: s1, ...served(1), sampled: false },
+                            { tenantId: t, vertical: 'acme-desk', scopeId: s2, ...served(2), sampled: false },
+                        ],
+                    });
+                }
+                expect(await host.admin.listRequestDays(staff, { tenantId: t })).toHaveLength(6);
+                expect((await host.admin.listRequestDays(staff, { tenantId: t, since: d6 })).map((r) => r.day)).toEqual([d6, d6, d5, d5]);
+                expect((await host.admin.listRequestDays(staff, { tenantId: t, until: d6 })).map((r) => r.day)).toEqual([d7, d7, d6, d6]);
+                expect((await host.admin.listRequestDays(staff, { tenantId: t, vertical: 'acme-desk' })).map((r) => r.scopeId)).toEqual([s2, s2, s2]);
+                expect(await host.admin.listRequestDays(staff, { tenantId: t, scopeId: s1, since: d5 })).toHaveLength(1);
+                expect(await host.admin.listRequestDays(staff, { tenantId: t, limit: 2 })).toHaveLength(2);
+                await expect(host.admin.listRequestDays(staff, { limit: 0 })).rejects.toThrow(/limit/);
+                await expect(host.admin.listRequestDays(staff, { since: '2026-13-01' })).rejects.toThrow(/UTC day/);
+            });
+            it('prunes days older than an explicit horizon, at most the limit per call; a null horizon prunes nothing', async () => {
+                const t = ids();
+                const days = [monthsAgo(16), monthsAgo(15), monthsAgo(14), monthsAgo(2), dayAgo(1)];
+                for (const day of days) {
+                    await host.admin.recordRequestDay(staff, {
+                        day,
+                        attemptedAt: at(day, '12:00:00'),
+                        counts: [{ tenantId: t.tenant, vertical: 'acme-crm', scopeId: t.scope, ...served(1), sampled: false }],
+                    });
+                }
+                // The default keeps everything: nothing goes, however old.
+                expect(await host.admin.pruneRequestDays(staff, 500, null)).toBe(0);
+                expect(await host.admin.listRequestDays(staff, { tenantId: t.tenant })).toHaveLength(5);
+                // Its positive twin: thirteen months named, the three older days go, two per call.
+                expect(await host.admin.pruneRequestDays(staff, 2, 13)).toBe(2);
+                expect(await host.admin.pruneRequestDays(staff, 2, 13)).toBe(1);
+                expect(await host.admin.pruneRequestDays(staff, 2, 13)).toBe(0);
+                expect((await host.admin.listRequestDays(staff, { tenantId: t.tenant })).map((r) => r.day)).toEqual([monthsAgo(2), dayAgo(1)]);
+                // The record of a pruned day goes with it; a kept day's stays.
+                const recorded = (await host.admin.listRequestRollupDays(staff)).map((r) => r.day);
+                expect(recorded).not.toContain(monthsAgo(14));
+                expect(recorded).toEqual(expect.arrayContaining([monthsAgo(2), dayAgo(1)]));
+                await expect(host.admin.pruneRequestDays(staff, 0, 13)).rejects.toThrow(/limit/);
+                await expect(host.admin.pruneRequestDays(staff, 10, 0)).rejects.toThrow(/whole number of months/);
+            });
+            it('the sweep phase rolls up due days into this directory, stops at a failed day, and retries it only after an hour', async () => {
+                // Days far from every other test's, so the fleet-wide record of a day is this test's alone.
+                const now = '2031-05-10T12:00:00.000Z';
+                const t = ids();
+                const asked = [];
+                let failing = '2031-05-08';
+                const options = (nowIso) => ({
+                    actor: staff,
+                    fetch: connectorTestFetch,
+                    sweepers: {},
+                    drainRetries: false,
+                    requestRollup: {
+                        lookbackDays: 3,
+                        now: () => nowIso,
+                        read: async (day) => {
+                            asked.push(day);
+                            if (day === failing)
+                                throw new Error('Cloudflare Analytics Engine query failed: HTTP 503');
+                            return [{ tenantId: t.tenant, vertical: 'acme-crm', scopeId: t.scope, ...served(Number(day.slice(-2))), sampled: false }];
+                        },
+                    },
+                });
+                // The failed day ends the pass's reads: the day after it is left for the next pass.
+                const first = await runPlatformSweep(host, options(now));
+                expect(asked).toEqual(['2031-05-07', '2031-05-08']);
+                expect(first.requestRollup).toMatchObject({ due: 3, read: 1, failed: 1, recorded: 1 });
+                expect(first.errors.filter((e) => e.kind === 'request-rollup')).toEqual([
+                    { kind: 'request-rollup', id: '2031-05-08', error: expect.stringMatching(/HTTP 503/) },
+                ]);
+                expect((await host.admin.listRequestDays(staff, { tenantId: t.tenant })).map((r) => [r.day, r.requests])).toEqual([
+                    ['2031-05-07', 7],
+                ]);
+                // Inside the hour the failed day is not read again; the day after it is.
+                failing = '';
+                const soon = await runPlatformSweep(host, options('2031-05-10T12:30:00.000Z'));
+                expect(soon.requestRollup).toMatchObject({ due: 1, read: 1 });
+                expect(asked.slice(2)).toEqual(['2031-05-09']);
+                // An hour on, the failed day is read, and only it.
+                const later = await runPlatformSweep(host, options('2031-05-10T13:00:00.000Z'));
+                expect(later.requestRollup).toMatchObject({ due: 1, read: 1, failed: 0, recorded: 1 });
+                expect(asked.slice(3)).toEqual(['2031-05-08']);
+                expect((await host.admin.listRequestRollupDays(staff, { since: '2031-05-07', until: '2031-05-09' })).map((r) => [r.day, r.error])).toEqual([
+                    ['2031-05-07', null],
+                    ['2031-05-08', null],
+                    ['2031-05-09', null],
+                ]);
+            });
+        });
+        // -- the daily meter snapshot (#2501) -----------------------------------------
+        describe('the daily meter snapshot (#2501)', () => {
+            // A snapshot reads the whole directory, which every other test also writes to, so each test
+            // narrows its reads to its own tenants. The record of a day is fleet-wide, so each test owns its
+            // days: far from today, and from each other's.
+            const newTenant = async () => {
+                const t = tenantId.parse(ulid());
+                await host.admin.createTenant(staff, { id: t, slug: `meter-day-${t.toLowerCase()}`, name: 'Meter day' });
+                return t;
+            };
+            const newScope = async (tenant, vertical) => {
+                const s = scopeId.parse(ulid());
+                await host.provisionScope(staff, { tenantId: tenant, scopeId: s, ...(vertical ? { vertical } : {}) });
+                await host.admin.activateScope(staff, tenant, s);
+                return s;
+            };
+            const counts = (c) => ({
+                total: 0,
+                active: 0,
+                suspended: 0,
+                provisioning: 0,
+                archived: 0,
+                reaped: 0,
+                ...c,
+            });
+            const monthsAgo = (m) => {
+                const d = new Date();
+                d.setUTCMonth(d.getUTCMonth() - m);
+                return d.toISOString().slice(0, 10);
+            };
+            it('keeps one row per tenant not reaped: its scopes by effective status, split by vertical, and each grant live or lapsed at the instant', async () => {
+                const at = '2032-03-04T00:07:00.000Z';
+                const t = await newTenant();
+                await newScope(t, 'meter-crm');
+                await newScope(t, 'meter-crm');
+                const archived = await newScope(t, 'meter-crm');
+                await newScope(t, 'meter-desk');
+                await newScope(t);
+                await host.admin.archiveScope(staff, t, archived);
+                await host.admin.grantEntitlement(staff, t, 'meter-sku', { plan: 'pro' });
+                // Lapsed AT the instant: a grant is live only while its expiry is after the reading.
+                await host.admin.grantEntitlement(staff, t, 'meter-aux', { expiresAt: at });
+                // Its twin, a millisecond later, is live.
+                await host.admin.grantEntitlement(staff, t, 'meter-trial', { expiresAt: '2032-03-04T00:07:00.001Z' });
+                // A suspended tenant's active scope is counted suspended, and the tenant bills nothing.
+                const off = await newTenant();
+                await newScope(off, 'meter-crm');
+                await host.admin.setTenantStatus(staff, off, 'suspended');
+                // A reaped tenant is a tombstone: no row. Its twin, a tenant being deleted, has one.
+                const [gone, going] = [await newTenant(), await newTenant()];
+                await host.admin.setTenantStatus(staff, gone, 'deleting');
+                await host.admin.reapTenant(staff, gone);
+                await host.admin.setTenantStatus(staff, going, 'deleting');
+                const taken = await host.admin.recordMeterDay(staff, { at });
+                expect(taken).toMatchObject({ day: '2032-03-04', taken: true });
+                const fleet = await host.admin.listMeterDays(staff, { since: '2032-03-04', until: '2032-03-04', limit: 10_000 });
+                expect(taken.tenants).toBe(fleet.length);
+                expect(fleet.map((r) => r.tenantId)).not.toContain(gone);
+                expect(fleet.find((r) => r.tenantId === going)).toMatchObject({ status: 'deleting', billable: false, scopes: counts({}) });
+                expect(await host.admin.listMeterDays(staff, { tenantId: t })).toEqual([
+                    {
+                        day: '2032-03-04',
+                        tenantId: t,
+                        readAt: at,
+                        status: 'active',
+                        billable: true,
+                        scopes: counts({ total: 5, active: 4, archived: 1 }),
+                        // Null first, then by vertical; the split sums to the tenant's counts.
+                        verticals: [
+                            { vertical: null, ...counts({ total: 1, active: 1 }) },
+                            { vertical: 'meter-crm', ...counts({ total: 3, active: 2, archived: 1 }) },
+                            { vertical: 'meter-desk', ...counts({ total: 1, active: 1 }) },
+                        ],
+                        entitlements: [
+                            { entitlementKey: 'meter-aux', plan: null, expiresAt: at, live: false },
+                            { entitlementKey: 'meter-sku', plan: 'pro', expiresAt: null, live: true },
+                            { entitlementKey: 'meter-trial', plan: null, expiresAt: '2032-03-04T00:07:00.001Z', live: true },
+                        ],
+                    },
+                ]);
+                expect((await host.admin.listMeterDays(staff, { tenantId: off }))[0]).toMatchObject({
+                    status: 'suspended',
+                    billable: false,
+                    scopes: counts({ total: 1, suspended: 1 }),
+                    verticals: [{ vertical: 'meter-crm', ...counts({ total: 1, suspended: 1 }) }],
+                });
+                expect(await host.admin.listMeterDayTakes(staff, { since: '2032-03-04', until: '2032-03-04' })).toEqual([
+                    {
+                        day: '2032-03-04',
+                        attemptedAt: at,
+                        takenAt: at,
+                        tenants: fleet.length,
+                        error: null,
+                        failingSince: null,
+                        failingCount: null,
+                    },
+                ]);
+                // K-24: both reads are attributable, the first to the tenant it narrowed to.
+                expect((await host.admin.accessLog(staff, { method: 'listMeterDays' })).some((r) => r.tenantId === t)).toBe(true);
+                expect((await host.admin.accessLog(staff, { method: 'listMeterDayTakes' })).length).toBeGreaterThan(0);
+            });
+            it('agrees with /meters read at the same moment', async () => {
+                const t = await newTenant();
+                await newScope(t, 'meter-crm');
+                const archived = await newScope(t);
+                await host.admin.archiveScope(staff, t, archived);
+                await host.admin.grantEntitlement(staff, t, 'meter-sku', { plan: 'pro' });
+                await host.admin.grantEntitlement(staff, t, 'meter-old', { expiresAt: new Date(Date.now() - 86_400_000).toISOString() });
+                const live = (await host.admin.readMeters(staff, { tenantId: t })).perTenant[0];
+                await host.admin.recordMeterDay(staff, { at: new Date().toISOString() });
+                const [kept] = await host.admin.listMeterDays(staff, { tenantId: t });
+                expect(kept.scopes).toEqual(live.scopes);
+                expect(kept.billable).toBe(live.billable);
+                expect({
+                    live: kept.entitlements.filter((g) => g.live).length,
+                    expired: kept.entitlements.filter((g) => !g.live).length,
+                }).toEqual(live.entitlements);
+            });
+            it('the first snapshot of a day stands: a later attempt that day writes nothing, and a failure never overwrites it', async () => {
+                const t = await newTenant();
+                await newScope(t);
+                const first = '2032-04-01T00:05:00.000Z';
+                expect(await host.admin.recordMeterDay(staff, { at: first })).toMatchObject({ taken: true });
+                await newScope(t);
+                expect(await host.admin.recordMeterDay(staff, { at: '2032-04-01T00:20:00.000Z' })).toEqual({
+                    day: '2032-04-01',
+                    taken: false,
+                    tenants: 0,
+                });
+                // A failure recorded after the snapshot committed (its caller stopped waiting) is not the day's record.
+                await host.admin.recordMeterDay(staff, { at: '2032-04-01T00:35:00.000Z', error: 'took longer than 30000 ms' });
+                expect(await host.admin.listMeterDays(staff, { tenantId: t })).toEqual([
+                    expect.objectContaining({ readAt: first, scopes: counts({ total: 1, active: 1 }) }),
+                ]);
+                expect((await host.admin.listMeterDayTakes(staff, { since: '2032-04-01', until: '2032-04-01' }))[0]).toMatchObject({
+                    attemptedAt: first,
+                    takenAt: first,
+                    error: null,
+                });
+                // Its positive twin: the next day is a new snapshot, and sees the second scope.
+                expect(await host.admin.recordMeterDay(staff, { at: '2032-04-02T00:05:00.000Z' })).toMatchObject({ taken: true });
+                expect((await host.admin.listMeterDays(staff, { tenantId: t })).map((r) => [r.day, r.scopes.total])).toEqual([
+                    ['2032-04-01', 1],
+                    ['2032-04-02', 2],
+                ]);
+            });
+            it('records a failed attempt with its run and writes nothing of the day; a snapshot later that day clears the run', async () => {
+                const t = await newTenant();
+                const day = '2032-05-01';
+                expect(await host.admin.recordMeterDay(staff, { at: `${day}T00:05:00.000Z`, error: 'directory busy' })).toEqual({
+                    day,
+                    taken: false,
+                    tenants: 0,
+                });
+                // A failure that names no run starts one of its own.
+                expect(await host.admin.listMeterDayTakes(staff, { since: day, until: day })).toEqual([
+                    {
+                        day,
+                        attemptedAt: `${day}T00:05:00.000Z`,
+                        takenAt: null,
+                        tenants: null,
+                        error: 'directory busy',
+                        failingSince: `${day}T00:05:00.000Z`,
+                        failingCount: 1,
+                    },
+                ]);
+                expect(await host.admin.listMeterDays(staff, { tenantId: t })).toEqual([]);
+                // A failure that extends a run keeps its start and length.
+                await host.admin.recordMeterDay(staff, {
+                    at: `${day}T00:20:00.000Z`,
+                    error: 'directory busy',
+                    failingSince: '2032-04-30T23:50:00.000Z',
+                    failingCount: 4,
+                });
+                expect((await host.admin.listMeterDayTakes(staff, { since: day, until: day }))[0]).toMatchObject({
+                    attemptedAt: `${day}T00:20:00.000Z`,
+                    failingSince: '2032-04-30T23:50:00.000Z',
+                    failingCount: 4,
+                });
+                await expect(host.admin.recordMeterDay(staff, { at: `${day}T00:25:00.000Z`, error: 'directory busy', failingCount: 0 })).rejects.toThrow(/failingCount/);
+                // A snapshot taken later the same day stands, and ends the run.
+                await host.admin.recordMeterDay(staff, { at: `${day}T00:35:00.000Z` });
+                expect((await host.admin.listMeterDayTakes(staff, { since: day, until: day }))[0]).toEqual({
+                    day,
+                    attemptedAt: `${day}T00:35:00.000Z`,
+                    takenAt: `${day}T00:35:00.000Z`,
+                    tenants: expect.any(Number),
+                    error: null,
+                    failingSince: null,
+                    failingCount: null,
+                });
+                expect(await host.admin.listMeterDays(staff, { tenantId: t })).toHaveLength(1);
+            });
+            it('filters by tenant and an inclusive window of days, and bounds the page', async () => {
+                const t = await newTenant();
+                for (const day of ['2032-06-01', '2032-06-02', '2032-06-03']) {
+                    await host.admin.recordMeterDay(staff, { at: `${day}T01:00:00.000Z` });
+                }
+                expect((await host.admin.listMeterDays(staff, { tenantId: t })).map((r) => r.day)).toEqual(['2032-06-01', '2032-06-02', '2032-06-03']);
+                expect((await host.admin.listMeterDays(staff, { tenantId: t, since: '2032-06-02' })).map((r) => r.day)).toEqual(['2032-06-02', '2032-06-03']);
+                expect((await host.admin.listMeterDays(staff, { tenantId: t, until: '2032-06-02' })).map((r) => r.day)).toEqual(['2032-06-01', '2032-06-02']);
+                expect(await host.admin.listMeterDays(staff, { tenantId: t, limit: 2 })).toHaveLength(2);
+                expect((await host.admin.listMeterDayTakes(staff, { since: '2032-06-02', until: '2032-06-03' })).map((r) => r.day)).toEqual([
+                    '2032-06-02',
+                    '2032-06-03',
+                ]);
+                await expect(host.admin.listMeterDays(staff, { limit: 0 })).rejects.toThrow(/limit/);
+                await expect(host.admin.listMeterDays(staff, { since: '2032-13-01' })).rejects.toThrow(/UTC day/);
+                await expect(host.admin.listMeterDayTakes(staff, { until: '2032-02-30' })).rejects.toThrow(/UTC day/);
+            });
+            it('prunes snapshots older than an explicit horizon, at most the limit per call; a null horizon prunes nothing', async () => {
+                // Two tenants, so every day holds at least two rows and a prune of one leaves the day in part.
+                const t = await newTenant();
+                await newTenant();
+                const old = [monthsAgo(16), monthsAgo(15), monthsAgo(14)];
+                const kept = [monthsAgo(2)];
+                for (const day of [...old, ...kept])
+                    await host.admin.recordMeterDay(staff, { at: `${day}T12:00:00.000Z` });
+                // The default keeps everything: nothing goes, however old.
+                expect(await host.admin.pruneMeterDays(staff, 500, null)).toBe(0);
+                expect(await host.admin.listMeterDays(staff, { tenantId: t })).toHaveLength(4);
+                // Its positive twin: thirteen months named, the older days go, at most the limit per call.
+                expect(await host.admin.pruneMeterDays(staff, 1, 13)).toBe(1);
+                // The oldest day still holds a row, so it is still marked taken and cannot be taken again.
+                expect(await host.admin.listMeterDayTakes(staff, { since: old[0], until: old[0] })).toHaveLength(1);
+                while ((await host.admin.pruneMeterDays(staff, 500, 13)) > 0)
+                    ;
+                expect((await host.admin.listMeterDays(staff, { tenantId: t })).map((r) => r.day)).toEqual(kept);
+                // The record of a pruned day goes with it; a kept day's stays.
+                const recorded = (await host.admin.listMeterDayTakes(staff, { since: old[0], until: kept[0] })).map((r) => r.day);
+                expect(recorded).toEqual(kept);
+                await expect(host.admin.pruneMeterDays(staff, 0, 13)).rejects.toThrow(/limit/);
+                await expect(host.admin.pruneMeterDays(staff, 10, 0)).rejects.toThrow(/whole number of months/);
+            });
+            it('the sweep phase takes the day on its first pass into this directory, and not again until the next day', async () => {
+                const t = await newTenant();
+                await newScope(t, 'meter-crm');
+                const pass = (now) => runPlatformSweep(host, {
+                    actor: staff,
+                    fetch: connectorTestFetch,
+                    sweepers: {},
+                    drainRetries: false,
+                    meterSnapshot: { now: () => now },
+                });
+                const first = await pass('2033-01-01T00:04:00.000Z');
+                expect(first.errors.filter((e) => e.kind === 'meter-snapshot')).toEqual([]);
+                expect(first.meterSnapshot).toMatchObject({ day: '2033-01-01', taken: true, failed: 0, streak: null });
+                const later = await pass('2033-01-01T00:19:00.000Z');
+                expect(later.meterSnapshot).toMatchObject({ day: '2033-01-01', taken: false, tenants: 0, failed: 0 });
+                const next = await pass('2033-01-02T00:04:00.000Z');
+                expect(next.meterSnapshot).toMatchObject({ day: '2033-01-02', taken: true });
+                expect((await host.admin.listMeterDays(staff, { tenantId: t })).map((r) => [r.day, r.readAt, r.scopes.active])).toEqual([
+                    ['2033-01-01', '2033-01-01T00:04:00.000Z', 1],
+                    ['2033-01-02', '2033-01-02T00:04:00.000Z', 1],
+                ]);
+            });
+        });
+        // -- the history of vertical ownership (#2501) ---------------------------------
+        describe('the history of vertical ownership (#2501)', () => {
+            const newSlug = () => `owned-${ulid().toLowerCase()}`;
+            const newOwner = async () => {
+                const t = tenantId.parse(ulid());
+                await host.admin.createTenant(staff, { id: t, slug: `owner-${t.toLowerCase()}`, name: 'Owner' });
+                return t;
+            };
+            const createdAtOf = async (slug) => (await host.admin.listVerticals(staff)).find((v) => v.slug === slug).createdAt;
+            it('opens a period with the registration and closes it with the delete; a slug registered again opens a new one', async () => {
+                const [first, second] = [await newOwner(), await newOwner()];
+                const slug = newSlug();
+                await host.admin.registerVertical(staff, { slug, name: 'Owned', source: 'cli', ownerTenant: first });
+                const since = await createdAtOf(slug);
+                expect(await host.admin.listVerticalOwners(staff, slug)).toEqual([{ slug, owner: first, since, until: null }]);
+                // An identical registration opens nothing; a conflicting one is refused and opens nothing.
+                await host.admin.registerVertical(staff, { slug, name: 'Owned', source: 'cli', ownerTenant: first });
+                await expect(host.admin.registerVertical(staff, { slug, name: 'Owned', source: 'cli', ownerTenant: second })).rejects.toThrow();
+                expect(await host.admin.listVerticalOwners(staff, slug)).toHaveLength(1);
+                // The delete closes the period, and the history outlives the registry row.
+                await host.admin.deleteVertical(staff, slug);
+                const [closed] = await host.admin.listVerticalOwners(staff, slug);
+                expect(closed).toEqual({ slug, owner: first, since, until: expect.any(String) });
+                expect(closed.until >= since).toBe(true);
+                // Registered again, by another tenant: the first owner's period stays closed, a new one opens.
+                await host.admin.registerVertical(staff, { slug, name: 'Owned', source: 'cli', ownerTenant: second });
+                expect(await host.admin.listVerticalOwners(staff, slug)).toEqual([
+                    closed,
+                    { slug, owner: second, since: await createdAtOf(slug), until: null },
+                ]);
+                // K-24: the read is attributable.
+                expect((await host.admin.accessLog(staff, { method: 'listVerticalOwners' })).length).toBeGreaterThan(0);
+                await host.admin.deleteVertical(staff, slug);
+            });
+            it("a platform vertical's owner is none, and a slug never registered has no period", async () => {
+                const slug = newSlug();
+                await host.admin.registerVertical(staff, { slug, name: 'Platform', source: 'builtin' });
+                expect(await host.admin.listVerticalOwners(staff, slug)).toEqual([{ slug, owner: null, since: await createdAtOf(slug), until: null }]);
+                expect(await host.admin.listVerticalOwners(staff, newSlug())).toEqual([]);
+                await host.admin.deleteVertical(staff, slug);
+            });
+            it("a tenant reap keeps the periods it owned: the history is the invoice's, kept for good", async () => {
+                const owner = await newOwner();
+                const [past, standing] = [newSlug(), newSlug()];
+                await host.admin.registerVertical(staff, { slug: past, name: 'Past', source: 'cli', ownerTenant: owner });
+                await host.admin.deleteVertical(staff, past);
+                await host.admin.registerVertical(staff, { slug: standing, name: 'Standing', source: 'cli', ownerTenant: owner });
+                const before = [await host.admin.listVerticalOwners(staff, past), await host.admin.listVerticalOwners(staff, standing)];
+                await host.admin.setTenantStatus(staff, owner, 'deleting');
+                await host.admin.reapTenant(staff, owner);
+                expect([await host.admin.listVerticalOwners(staff, past), await host.admin.listVerticalOwners(staff, standing)]).toEqual(before);
+                expect(before.flat().map((p) => p.owner)).toEqual([owner, owner]);
+                await host.admin.deleteVertical(staff, standing);
+            });
+            it('a delete refused while a scope still runs the vertical leaves the period open', async () => {
+                const owner = await newOwner();
+                const slug = newSlug();
+                await host.admin.registerVertical(staff, { slug, name: 'Bound', source: 'cli', ownerTenant: owner });
+                await host.provisionScope(staff, { tenantId: owner, scopeId: scopeId.parse(ulid()), vertical: slug });
+                await expect(host.admin.deleteVertical(staff, slug)).rejects.toThrow(/still backs/);
+                expect(await host.admin.listVerticalOwners(staff, slug)).toEqual([{ slug, owner, since: await createdAtOf(slug), until: null }]);
+            });
+        });
         it('leaves bare (module-less) operations ungated', async () => {
             // test/read-counter was registered via defineOperation, no manifest — it
             // must resolve regardless of entitlements.
@@ -9468,6 +10779,16 @@ export function scopeHostContractSuite(adapterName, makeFixture, opts = {}) {
                 name: 'Impostor Co',
             }), 'conflict', /already taken/);
         });
+        it('words the tenant slug refusal without the tenant that holds the slug (#2556)', async () => {
+            const holder = tenantId.parse(ulid());
+            const slug = `held-${holder.toLowerCase()}`;
+            await host.admin.createTenant(staff, { id: holder, slug, name: 'Holder Co' });
+            const taken = await host.admin
+                .createTenant(staff, { id: tenantId.parse(ulid()), slug, name: 'Impostor Co' })
+                .then(() => null, (e) => e);
+            expect(taken?.message).toBe(`tenant slug '${slug}' is already taken (slugs are unique)`);
+            expect(taken?.message).not.toContain(holder);
+        });
         it('enumerates the scopes under a tenant, and filters by status (§4.5)', async () => {
             const all = await host.admin.listScopes(staff, { tenantId: t5 });
             expect(all.length).toBeGreaterThanOrEqual(2);