@substrat-run/control-plane-api 0.119.0 → 0.121.0

package/dist/api.d.ts

@@ -1,7 +1,7 @@
 import { Hono } from 'hono';
 import { z } from '@substrat-run/contracts';
 import type { Connection, ConnectionActivity, ConnectionActivitySource, ConnectionCredential, ConnectionProbe, PlatformActorId } from '@substrat-run/contracts';
-import type { ScopeHost } from '@substrat-run/kernel';
+import type { CrossVerticalOptions, ScopeHost } from '@substrat-run/kernel';
 import type { PlatformActorAuth, BuilderAuth, Principal, TenantServiceAuth } from './auth.js';
 import { type VerticalClient } from './vertical-client.js';
 import type { DeployVerticalFn, FetchVerticalAssetFn, FetchVerticalModulesFn } from './deploy.js';
@@ -53,6 +53,14 @@ export interface ControlPlaneApiOptions {
      */
     modelMarginPercent?: number;
     host: ScopeHost;
+    /**
+     * How edge health reaches the two ends of a cross-vertical edge (#1705 PR 3): the phase's own
+     * reach (`hostedCrossVerticalReach` on the control plane). Absent, the host's own verbs, which
+     * is right where one host serves every scope. On a host that serves its apps elsewhere (the
+     * shared control plane without DISPATCH), the whole read answers `unavailable` instead of
+     * reporting no edges.
+     */
+    crossVertical?: CrossVerticalOptions | undefined;
     /**
      * How to reach each vertical, by slug (K-31). Absent slugs simply cannot be
      * provisioned — the route 501s rather than pretending, because a control plane that

package/dist/api.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"api.d.ts","sourceRoot":"","sources":["../src/api.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAE5B,OAAO,EAyEL,CAAC,EAKF,MAAM,yBAAyB,CAAC;AACjC,OAAO,KAAK,EACV,UAAU,EACV,kBAAkB,EAClB,wBAAwB,EACxB,oBAAoB,EAEpB,eAAe,EAGf,eAAe,EAQhB,MAAM,yBAAyB,CAAC;AACjC,OAAO,KAAK,EAAmB,SAAS,EAAE,MAAM,sBAAsB,CAAC;AAIvE,OAAO,KAAK,EAAE,iBAAiB,EAAE,WAAW,EAAE,SAAS,EAAE,iBAAiB,EAAE,MAAM,WAAW,CAAC;AAE9F,OAAO,EAA4B,KAAK,cAAc,EAAE,MAAM,sBAAsB,CAAC;AAqBrF,OAAO,KAAK,EAEV,gBAAgB,EAChB,oBAAoB,EACpB,sBAAsB,EACvB,MAAM,aAAa,CAAC;AACrB,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,UAAU,CAAC;AAyBtD,OAAO,EAA2B,KAAK,mBAAmB,EAAE,MAAM,oBAAoB,CAAC;AACvF,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AAC7D,OAAO,EAAuB,KAAK,iBAAiB,EAAE,MAAM,oBAAoB,CAAC;AACjF,OAAO,KAAK,EAEV,oBAAoB,EAEpB,gBAAgB,EACjB,MAAM,cAAc,CAAC;AAGtB,OAAO,EAGL,KAAK,yBAAyB,EAC/B,MAAM,uBAAuB,CAAC;AAE/B;;;;;;;;;;GAUG;AACH,MAAM,WAAW,mBAAmB;IAClC,KAAK,CAAC,EAAE,CAAC,IAAI,EAAE,SAAS,EAAE,UAAU,EAAE,UAAU,KAAK,OAAO,CAAC,eAAe,CAAC,CAAC;IAC9E,QAAQ,CAAC,EAAE,CACT,IAAI,EAAE,SAAS,EACf,UAAU,EAAE,UAAU,EACtB,IAAI,EAAE;QAAE,IAAI,EAAE,OAAO,CAAC;QAAC,MAAM,EAAE,wBAAwB,CAAA;KAAE,KACtD,OAAO,CAAC,kBAAkB,CAAC,CAAC;IACjC;;;;;OAKG;IACH,UAAU,CAAC,EAAE,CAAC,IAAI,EAAE,SAAS,EAAE,UAAU,EAAE,UAAU,KAAK,OAAO,CAAC,oBAAoB,CAAC,CAAC;IACxF;;;;;;;OAOG;IACH,cAAc,CAAC,EAAE,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,KAAK,OAAO,CAAC,eAAe,CAAC,CAAC;CAC/E;AAED,MAAM,WAAW,sBAAsB;IACrC;;;;OAIG;IACH,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B,IAAI,EAAE,SAAS,CAAC;IAChB;;;;;;;OAOG;IACH,SAAS,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,cAAc,CAAC,CAAC;IAC3C;;;;;;;;OAQG;IACH,eAAe,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,SAAS,MAAM,EAAE,CAAC,CAAC,CAAC;IAC9D;;;;;;OAMG;IACH,eAAe,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,eAAe,KAAK,OAAO,CAAC,cAAc,GAAG,SAAS,CAAC,CAAC;IAChG;;;;;;;;;OASG;IACH,sBAAsB,CAAC,EAAE,CACvB,IAAI,EAAE,MAAM,EACZ,SAAS,EAAE,MAAM,EACjB,KAAK,EAAE,eAAe,KACnB,OAAO,CAAC,cAAc,GAAG,SAAS,CAAC,CAAC;IACzC;;;;;;;OAOG;IACH,kBAAkB,CAAC,EAAE,CAAC,aAAa,EAAE,MAAM,KAAK,OAAO,CAAC,cAAc,GAAG,SAAS,CAAC,CAAC;IACpF;;;;;OAKG;IACH,cAAc,CAAC,EAAE,gBAAgB,CAAC;IAClC;;;;;OAKG;IACH,oBAAoB,CAAC,EAAE,sBAAsB,CAAC;IAC9C;;;;;;;;;;OAUG;IACH,kBAAkB,CAAC,EAAE,oBAAoB,CAAC;IAC1C;;;;;;OAMG;IACH,mBAAmB,CAAC,EAAE,qBAAqB,CAAC;IAC5C;;;;;;;;OAQG;IACH,sBAAsB,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAC3C;;;;OAIG;IACH,YAAY,EAAE,iBAAiB,CAAC;IAChC;;;;;;OAMG;IACH,mBAAmB,CAAC,EAAE,WAAW,CAAC;IAClC;;;;;;OAMG;IACH,yBAAyB,CAAC,EAAE,iBAAiB,CAAC;IAC9C;;;;;OAKG;IACH,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB;;;;;;;OAOG;IACH,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B;;;;;;;;;OASG;IACH,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB;;;;;;;;OAQG;IACH,aAAa,CAAC,EAAE,mBAAmB,CAAC;IACpC;;;;;;;;;;;;OAYG;IACH,oBAAoB,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,mBAAmB,CAAC,CAAC;IAC3D;;;;;;;;;OASG;IACH,eAAe,CAAC,EAAE,eAAe,CAAC;IAClC;;;;;OAKG;IACH,YAAY,CAAC,EAAE,iBAAiB,CAAC;IACjC;;;;;;;;;;;;;OAaG;IACH,YAAY,CAAC,EAAE,gBAAgB,CAAC;IAChC;;;;;;;;;OASG;IACH,gBAAgB,CAAC,EAAE,oBAAoB,CAAC;IACxC;;;;;;;OAOG;IACH,iBAAiB,CAAC,EAAE,yBAAyB,CAAC;IAC9C;;;;;;OAMG;IACH,mBAAmB,CAAC,EAAE,MAAM,EAAE,CAAC;IAC/B;;;;;;;;;;;OAWG;IACH,WAAW,CAAC,EAAE;QAAE,UAAU,CAAC,EAAE,MAAM,CAAC;QAAC,aAAa,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;CAC/D;AAED;;;;GAIG;AACH,eAAO,MAAM,sBAAsB,+BAA+B,CAAC;AACnE,eAAO,MAAM,yBAAyB,kCAAkC,CAAC;AAKzE,KAAK,IAAI,GAAG;IAAE,KAAK,EAAE,eAAe,CAAC;IAAC,SAAS,EAAE,SAAS,CAAA;CAAE,CAAC;AAuP7D;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,cAAc;;;;;;;;;;;iBASzB,CAAC;AAqCH,yFAAyF;AACzF,eAAO,MAAM,yBAAyB,MAAM,CAAC;AAgG7C,eAAO,MAAM,4BAA4B,KAAK,CAAC;AAuC/C,KAAK,SAAS,GAAG,MAAM,GAAG,OAAO,GAAG,SAAS,GAAG,MAAM,GAAG,OAAO,CAAC;AAqEjE;;;;;;;;;;GAUG;AACH,wBAAgB,mBAAmB,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,SAAS,GAAG,SAAS,CAEvF;AAuBD;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AACH,wBAAgB,qBAAqB,CAAC,OAAO,EAAE,sBAAsB,GAAG,IAAI,CAAC;IAAE,SAAS,EAAE,IAAI,CAAA;CAAE,CAAC,CAqjLhG"}
+{"version":3,"file":"api.d.ts","sourceRoot":"","sources":["../src/api.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAE5B,OAAO,EAyEL,CAAC,EAQF,MAAM,yBAAyB,CAAC;AACjC,OAAO,KAAK,EACV,UAAU,EACV,kBAAkB,EAClB,wBAAwB,EACxB,oBAAoB,EAEpB,eAAe,EAGf,eAAe,EAQhB,MAAM,yBAAyB,CAAC;AACjC,OAAO,KAAK,EAAE,oBAAoB,EAAmB,SAAS,EAAE,MAAM,sBAAsB,CAAC;AAI7F,OAAO,KAAK,EAAE,iBAAiB,EAAE,WAAW,EAAE,SAAS,EAAE,iBAAiB,EAAE,MAAM,WAAW,CAAC;AAE9F,OAAO,EAA4B,KAAK,cAAc,EAAE,MAAM,sBAAsB,CAAC;AAsBrF,OAAO,KAAK,EAEV,gBAAgB,EAChB,oBAAoB,EACpB,sBAAsB,EACvB,MAAM,aAAa,CAAC;AACrB,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,UAAU,CAAC;AAyBtD,OAAO,EAA2B,KAAK,mBAAmB,EAAE,MAAM,oBAAoB,CAAC;AACvF,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AAC7D,OAAO,EAAuB,KAAK,iBAAiB,EAAE,MAAM,oBAAoB,CAAC;AACjF,OAAO,KAAK,EAEV,oBAAoB,EAEpB,gBAAgB,EACjB,MAAM,cAAc,CAAC;AAGtB,OAAO,EAGL,KAAK,yBAAyB,EAC/B,MAAM,uBAAuB,CAAC;AAE/B;;;;;;;;;;GAUG;AACH,MAAM,WAAW,mBAAmB;IAClC,KAAK,CAAC,EAAE,CAAC,IAAI,EAAE,SAAS,EAAE,UAAU,EAAE,UAAU,KAAK,OAAO,CAAC,eAAe,CAAC,CAAC;IAC9E,QAAQ,CAAC,EAAE,CACT,IAAI,EAAE,SAAS,EACf,UAAU,EAAE,UAAU,EACtB,IAAI,EAAE;QAAE,IAAI,EAAE,OAAO,CAAC;QAAC,MAAM,EAAE,wBAAwB,CAAA;KAAE,KACtD,OAAO,CAAC,kBAAkB,CAAC,CAAC;IACjC;;;;;OAKG;IACH,UAAU,CAAC,EAAE,CAAC,IAAI,EAAE,SAAS,EAAE,UAAU,EAAE,UAAU,KAAK,OAAO,CAAC,oBAAoB,CAAC,CAAC;IACxF;;;;;;;OAOG;IACH,cAAc,CAAC,EAAE,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,KAAK,OAAO,CAAC,eAAe,CAAC,CAAC;CAC/E;AAED,MAAM,WAAW,sBAAsB;IACrC;;;;OAIG;IACH,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B,IAAI,EAAE,SAAS,CAAC;IAChB;;;;;;OAMG;IACH,aAAa,CAAC,EAAE,oBAAoB,GAAG,SAAS,CAAC;IACjD;;;;;;;OAOG;IACH,SAAS,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,cAAc,CAAC,CAAC;IAC3C;;;;;;;;OAQG;IACH,eAAe,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,SAAS,MAAM,EAAE,CAAC,CAAC,CAAC;IAC9D;;;;;;OAMG;IACH,eAAe,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,eAAe,KAAK,OAAO,CAAC,cAAc,GAAG,SAAS,CAAC,CAAC;IAChG;;;;;;;;;OASG;IACH,sBAAsB,CAAC,EAAE,CACvB,IAAI,EAAE,MAAM,EACZ,SAAS,EAAE,MAAM,EACjB,KAAK,EAAE,eAAe,KACnB,OAAO,CAAC,cAAc,GAAG,SAAS,CAAC,CAAC;IACzC;;;;;;;OAOG;IACH,kBAAkB,CAAC,EAAE,CAAC,aAAa,EAAE,MAAM,KAAK,OAAO,CAAC,cAAc,GAAG,SAAS,CAAC,CAAC;IACpF;;;;;OAKG;IACH,cAAc,CAAC,EAAE,gBAAgB,CAAC;IAClC;;;;;OAKG;IACH,oBAAoB,CAAC,EAAE,sBAAsB,CAAC;IAC9C;;;;;;;;;;OAUG;IACH,kBAAkB,CAAC,EAAE,oBAAoB,CAAC;IAC1C;;;;;;OAMG;IACH,mBAAmB,CAAC,EAAE,qBAAqB,CAAC;IAC5C;;;;;;;;OAQG;IACH,sBAAsB,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAC3C;;;;OAIG;IACH,YAAY,EAAE,iBAAiB,CAAC;IAChC;;;;;;OAMG;IACH,mBAAmB,CAAC,EAAE,WAAW,CAAC;IAClC;;;;;;OAMG;IACH,yBAAyB,CAAC,EAAE,iBAAiB,CAAC;IAC9C;;;;;OAKG;IACH,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB;;;;;;;OAOG;IACH,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B;;;;;;;;;OASG;IACH,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB;;;;;;;;OAQG;IACH,aAAa,CAAC,EAAE,mBAAmB,CAAC;IACpC;;;;;;;;;;;;OAYG;IACH,oBAAoB,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,mBAAmB,CAAC,CAAC;IAC3D;;;;;;;;;OASG;IACH,eAAe,CAAC,EAAE,eAAe,CAAC;IAClC;;;;;OAKG;IACH,YAAY,CAAC,EAAE,iBAAiB,CAAC;IACjC;;;;;;;;;;;;;OAaG;IACH,YAAY,CAAC,EAAE,gBAAgB,CAAC;IAChC;;;;;;;;;OASG;IACH,gBAAgB,CAAC,EAAE,oBAAoB,CAAC;IACxC;;;;;;;OAOG;IACH,iBAAiB,CAAC,EAAE,yBAAyB,CAAC;IAC9C;;;;;;OAMG;IACH,mBAAmB,CAAC,EAAE,MAAM,EAAE,CAAC;IAC/B;;;;;;;;;;;OAWG;IACH,WAAW,CAAC,EAAE;QAAE,UAAU,CAAC,EAAE,MAAM,CAAC;QAAC,aAAa,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;CAC/D;AAED;;;;GAIG;AACH,eAAO,MAAM,sBAAsB,+BAA+B,CAAC;AACnE,eAAO,MAAM,yBAAyB,kCAAkC,CAAC;AAKzE,KAAK,IAAI,GAAG;IAAE,KAAK,EAAE,eAAe,CAAC;IAAC,SAAS,EAAE,SAAS,CAAA;CAAE,CAAC;AAuQ7D;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,cAAc;;;;;;;;;;;iBASzB,CAAC;AAqCH,yFAAyF;AACzF,eAAO,MAAM,yBAAyB,MAAM,CAAC;AA8G7C,eAAO,MAAM,4BAA4B,KAAK,CAAC;AAuC/C,KAAK,SAAS,GAAG,MAAM,GAAG,OAAO,GAAG,SAAS,GAAG,MAAM,GAAG,OAAO,CAAC;AAuEjE;;;;;;;;;;GAUG;AACH,wBAAgB,mBAAmB,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,SAAS,GAAG,SAAS,CAEvF;AAuBD;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AACH,wBAAgB,qBAAqB,CAAC,OAAO,EAAE,sBAAsB,GAAG,IAAI,CAAC;IAAE,SAAS,EAAE,IAAI,CAAA;CAAE,CAAC,CAswLhG"}

package/dist/api.js

@@ -1,13 +1,15 @@
+import { resolveObservabilityWindow } from './observability-window.js';
 import { Hono } from 'hono';
-import { parseHostname, withLabel, RESERVED_LABEL_SEPARATOR, adminAction, ASSET_PART_PREFIX, assetHash, channelName, connectionActivity, connectionActivitySource, connectionCredential, connectionFilter, connectionHealthState, connectionProvider, connectorDispatchKind, PROVISION_SIBLING_KIND, ARCHIVE_SCOPE_KIND, PROVISION_TENANT_KIND, SET_ENTITLEMENTS_KIND, MODEL_USAGE_KIND, SWEEP_RUNS_KIND, toConnectionHealthEntry, CONNECTION_EXPIRY_WARNING_DAYS, CONNECTION_STALE_DAYS, connectionProbe, createTenantInput, entitlementGrantInput, hostname as hostnameSchema, hostnameRegion, hostnameStatus, identityLink, errorCode, issueStatus, issueStatusInput, listPageQuery, matchesOutboundHost, pageOf, platformRequestFilter, principalId as principalIdSchema, promotionAcknowledgement, provisionableJurisdiction, publishVersionInput, queryScopeInput, readScopeTableInput, entityHistoryInput, eventFacetInput, eventCauseInput, eventEffectsInput, invocationEventsInput, deadLettersInput, delegatedReadParams, createOrgInput, roleKey as roleKeySchema, peerSwitch, systemSwitch, DEFAULT_DENIAL_LIMIT, DENIAL_LIMIT_MAX, denialGroupBy, registerVerticalInput, serviceDimensions, sweepRunKind, sweepRunOutcome, scopeDump, dataSubjectId as dataSubjectIdSchema, scopeId as scopeIdSchema, scopeStatus, storageShape, surfaceName, tenantId as tenantIdSchema, tenantStatus, versionOrigin, z, PROBLEM_CONTENT_TYPE, toProblem, redrainEventsInput, REDRAIN_BATCH, } from '@substrat-run/contracts';
+import { parseHostname, withLabel, RESERVED_LABEL_SEPARATOR, adminAction, ASSET_PART_PREFIX, assetHash, channelName, connectionActivity, connectionActivitySource, connectionCredential, connectionFilter, connectionHealthState, connectionProvider, connectorDispatchKind, PROVISION_SIBLING_KIND, ARCHIVE_SCOPE_KIND, PROVISION_TENANT_KIND, SET_ENTITLEMENTS_KIND, MODEL_USAGE_KIND, SWEEP_RUNS_KIND, toConnectionHealthEntry, CONNECTION_EXPIRY_WARNING_DAYS, CONNECTION_STALE_DAYS, connectionProbe, createTenantInput, entitlementGrantInput, hostname as hostnameSchema, hostnameRegion, hostnameStatus, identityLink, errorCode, issueStatus, issueStatusInput, listPageQuery, matchesOutboundHost, pageOf, platformRequestFilter, principalId as principalIdSchema, promotionAcknowledgement, provisionableJurisdiction, publishVersionInput, queryScopeInput, readScopeTableInput, entityHistoryInput, eventFacetInput, eventCauseInput, eventEffectsInput, invocationEventsInput, deadLettersInput, delegatedReadParams, createOrgInput, roleKey as roleKeySchema, peerSwitch, systemSwitch, DEFAULT_DENIAL_LIMIT, DENIAL_LIMIT_MAX, denialGroupBy, registerVerticalInput, serviceDimensions, sweepRunKind, sweepRunOutcome, scopeDump, dataSubjectId as dataSubjectIdSchema, scopeId as scopeIdSchema, scopeStatus, storageShape, surfaceName, tenantId as tenantIdSchema, tenantStatus, versionOrigin, z, PROBLEM_CONTENT_TYPE, toProblem, redrainEventsInput, importCursorMove, importCursorAcknowledgementMissing, REDRAIN_BATCH, migrationsOnTop, } from '@substrat-run/contracts';
 import { attributeFailure } from './failure-attribution.js';
-import { migrationProgress, ulid } from '@substrat-run/kernel';
+import { crossVerticalHealth, isExportBreakRefusal, migrationProgress, ulid } from '@substrat-run/kernel';
 import { TENANT_HEADER, confinedTenant } from './auth.js';
 import { mintTenantToken } from './tenant-token.js';
 import { connectionGrantsForScope } from './vertical-client.js';
 import { oidcCallbackUrl, retireClientsOfReapedScope, wirePreviewAuth } from './preview-auth.js';
 import { versionReachedAt } from './scope-deployment.js';
 import { reconcileConnectionGrants } from './connection-grants.js';
+import { reconcileThenReassert } from './reconcile.js';
 import { ConnectionRelayError, relayConnectionUpsert } from './connection-relay.js';
 import { ControlPlaneError } from './client.js';
 import { provisionSiblingScope } from './platform-drain.js';
@@ -55,6 +57,19 @@ function outsideTenant(p, tenantId) {
     const pin = confinedTenant(p);
     return pin !== null && pin !== tenantId;
 }
+/**
+ * A fleet-wide report, narrowed to what a caller may see: a confined caller gets its own
+ * tenant's rows and a COUNT of the other tenants, never their ids (K-3's forced filter, held on
+ * reports that have to be computed fleet-wide). Staff (`pin === null`) get every row.
+ */
+function narrowToCaller(rows, pin) {
+    if (pin === null)
+        return { visible: [...rows], otherTenants: 0 };
+    return {
+        visible: rows.filter((r) => r.tenantId === pin),
+        otherTenants: new Set(rows.filter((r) => r.tenantId !== pin).map((r) => r.tenantId)).size,
+    };
+}
 // -- request schemas ---------------------------------------------------------
 // Parse, don't trust: every input crosses Zod at the boundary. The ids stay
 // CALLER-SUPPLIED rather than minted here, exactly as the contract has them —
@@ -370,6 +385,19 @@ const tenantRoleAssignmentBody = z
  * spells out; `.strict()` so a body that tried to name one is refused, not stripped.
  */
 const systemSwitchBody = systemSwitch.pick({ moduleId: true, reason: true }).strict();
+/**
+ * The fleet read's filter (#1674). `position` defaults to `off` — "what is switched off
+ * across the fleet" is the question the route exists for — and `all` asks for both. Paged
+ * by `operationId`, ascending by default (oldest switch first, as the admin log reads).
+ */
+const systemSwitchesQuery = z.object({
+    position: z.enum(['on', 'off', 'all']).default('off'),
+    tenantId: tenantIdSchema.optional(),
+    scopeId: scopeIdSchema.optional(),
+    moduleId: systemSwitch.shape.moduleId.optional(),
+    vertical: z.string().min(1).optional(),
+    ...listPageQuery.shape,
+});
 /** The peer kill switch's body (#1706) — the tenant and scope come from the path. */
 const peerSwitchBody = peerSwitch.pick({ vertical: true, reason: true }).strict();
 /** A new org under an addressed tenant (#1343) — `tenantId` comes from the path. */
@@ -452,6 +480,7 @@ const TENANT_ROUTES = [
     { method: 'DELETE', re: /\/verticals\/[^/]+$/, pin: 'owner' },
     { method: 'GET', re: /\/verticals\/[^/]+\/versions$/, pin: 'owner' },
     { method: 'GET', re: /\/verticals\/[^/]+\/versions\/[^/]+\/registry$/, pin: 'owner' },
+    { method: 'GET', re: /\/verticals\/[^/]+\/versions\/[^/]+\/migrations$/, pin: 'owner' },
     { method: 'GET', re: /\/verticals\/[^/]+\/versions\/[^/]+\/model$/, pin: 'owner' },
     { method: 'GET', re: /\/verticals\/[^/]+\/versions\/[^/]+\/flow$/, pin: 'owner' },
     { method: 'GET', re: /\/verticals\/[^/]+\/versions\/[^/]+\/assets$/, pin: 'owner' },
@@ -459,6 +488,7 @@ const TENANT_ROUTES = [
     { method: 'GET', re: /\/verticals\/[^/]+\/channels$/, pin: 'owner' },
     { method: 'GET', re: /\/verticals\/[^/]+\/channels\/[^/]+\/history$/, pin: 'owner' },
     { method: 'POST', re: /\/verticals\/[^/]+\/channels\/[^/]+\/promote$/, pin: 'owner' },
+    { method: 'GET', re: /\/verticals\/[^/]+\/channels\/[^/]+\/promote-impact$/, pin: 'owner' },
     { method: 'GET', re: /\/verticals\/[^/]+\/previews$/, pin: 'owner' },
     { method: 'POST', re: /\/verticals\/[^/]+\/previews$/, pin: 'owner' },
     { method: 'DELETE', re: /\/verticals\/[^/]+\/previews\/[^/]+$/, pin: 'owner' },
@@ -611,6 +641,9 @@ export function createControlPlaneApi(options) {
         // The declared permission registry of one version (D-39, #336) — owner-narrowed in the
         // handler like the versions list; the builder-facing Permissions tab reads it.
         { method: 'GET', re: /\/verticals\/[^/]+\/versions\/[^/]+\/registry$/ },
+        // The SQL migrations one version adds on top of another (#1677), owner-narrowed the same
+        // way; the promote dialog and `substrat promote` read it.
+        { method: 'GET', re: /\/verticals\/[^/]+\/versions\/[^/]+\/migrations$/ },
         // The emitted entity model of one version (#1214) — owner-narrowed the same way;
         // the dashboard's Model tab reads it.
         { method: 'GET', re: /\/verticals\/[^/]+\/versions\/[^/]+\/model$/ },
@@ -1573,7 +1606,8 @@ export function createControlPlaneApi(options) {
      * current dispatch — resolved BEFORE any version rebind), restore into the serving
      * script (which re-projects the vertical's roles), and only then `setScopeServingRef` +
      * advance the version pointer. A crash before the flip leaves the scope serving its old
-     * script intact, and the adopt retries idempotently. Already-adopted scopes short-circuit.
+     * script intact, and the adopt retries idempotently. Previews are refused; already-adopted
+     * installs short-circuit.
      * Throws `ControlPlaneError` so callers surface an actionable status, never a bare 500.
      */
     const adoptScopeOntoServing = async (c, tenantId, scopeId) => {
@@ -1582,8 +1616,16 @@ export function createControlPlaneApi(options) {
         if (!scope) {
             throw new ControlPlaneError(404, `unknown scope for tenant: (${tenantId}, ${scopeId})`);
         }
-        if (scope.servingRef)
+        if (scope.kind === 'preview') {
+            throw new ControlPlaneError(409, 'preview scopes cannot adopt the production serving script');
+        }
+        if (scope.servingRef) {
+            // #1674 (Copilot review): an adopt that flipped routing and then failed to re-assert is
+            // retried HERE, so the retry re-asserts too — else a store that lost its OFF marker in
+            // the copy would stay on for good. Cheap and idempotent when nothing is owed.
+            await admin.reassertSystemSwitches(actor, { tenantId, scopeId });
             return { servingRef: scope.servingRef, alreadyAdopted: true };
+        }
         if (!scope.vertical) {
             throw new ControlPlaneError(409, 'scope has no vertical — nothing to adopt onto');
         }
@@ -1601,6 +1643,9 @@ export function createControlPlaneApi(options) {
         // Data landed — only now flip routing and move the version pointer.
         await admin.setScopeServingRef(actor, tenantId, scopeId, serving.ref);
         await admin.bindScopeVersion(actor, tenantId, scopeId, serving.versionId);
+        // #1674: the scope now routes to a different store, so put the directory's recorded
+        // OFF positions back there — cheap and idempotent when the dump carried them.
+        await admin.reassertSystemSwitches(actor, { tenantId, scopeId });
         return { servingRef: serving.ref, tables: restored.tables };
     };
     /**
@@ -1610,8 +1655,8 @@ export function createControlPlaneApi(options) {
      * pointer to the promoted version so Update stops offering a crossing already made.
      *
      * Gated exactly where the host cascade would have run: PRIVATE (owned, unlisted) only,
-     * active non-fork scopes only. Runs only when a serving script exists — i.e. the serve
-     * actually happened (dispatch-backed + deploy configured); for an embedded vertical the
+     * active non-fork, non-preview scopes only. Runs only when a serving script exists —
+     * i.e. the serve actually happened (dispatch-backed + deploy configured); for an embedded vertical the
      * host cascade already rebound, and `verticalServing` is null, so this is a no-op.
      * Idempotent and retry-safe: the host cascade never rebound these scopes, so their data
      * is still findable on a retry after a failed serve.
@@ -1624,7 +1669,7 @@ export function createControlPlaneApi(options) {
         const v = await verticalOf(actor, slug);
         if (!v || v.ownerTenant === null || v.listed)
             return; // private only, like the host cascade
-        const owned = (await admin.listScopes(actor, { tenantId: v.ownerTenant, vertical: slug, status: ['active'] })).filter((s) => !s.forkedFrom);
+        const owned = (await admin.listScopes(actor, { tenantId: v.ownerTenant, vertical: slug, status: ['active'] })).filter((s) => !s.forkedFrom && s.kind !== 'preview');
         for (const s of owned) {
             if (!s.servingRef) {
                 // Adopt: export from the scope's current (un-rebound) dispatch → serving script,
@@ -1672,6 +1717,8 @@ export function createControlPlaneApi(options) {
             throw new ControlPlaneError(409, `vertical '${target}' has no serving script yet — promote a version to prod first`);
         }
         if (scope.vertical === target && scope.servingRef === serving.ref) {
+            // #1674: a rebind retried after its re-assert failed lands here; re-assert, as adopt does.
+            await admin.reassertSystemSwitches(actor, { tenantId, scopeId });
             return { servingRef: serving.ref, versionId: serving.versionId, alreadyBound: true };
         }
         if (opts.abandonData) {
@@ -1710,6 +1757,8 @@ export function createControlPlaneApi(options) {
         // pre-migration state, and it is never deleted — that copy is the backout.
         await admin.setScopeServingRef(actor, tenantId, scopeId, serving.ref);
         await admin.bindScopeVersion(actor, tenantId, scopeId, serving.versionId);
+        // #1674: re-assert the recorded OFF positions in the store the scope now routes to.
+        await admin.reassertSystemSwitches(actor, { tenantId, scopeId });
         return { servingRef: serving.ref, versionId: serving.versionId, tables: restored.tables };
     };
     /**
@@ -2029,7 +2078,8 @@ export function createControlPlaneApi(options) {
             : null;
         const ranAs = versionReachedAt(reached.via, scope, serving);
         try {
-            const result = await vertical.reconcileInstance({
+            // #1674: the recorded OFF positions go back after the reconcile, before the receipt.
+            const result = await reconcileThenReassert(admin, actor, { tenantId, scopeId }, () => vertical.reconcileInstance({
                 tenantId,
                 scopeId,
                 entitlements,
@@ -2040,7 +2090,7 @@ export function createControlPlaneApi(options) {
                 // by the vertical, so the reconcile must carry it into the same ready-gate — a bound
                 // but unmigrated database fails as loudly as an absent one.
                 ...(tenantStores.length ? { tenantStores } : {}),
-            });
+            }));
             // #1172: the reconcile succeeded, so record WHICH version it ran against. Without
             // this the sweep would come back and do it again on the next pass — the console
             // button and the automatic phase have to write the same receipt, or pressing the
@@ -3085,6 +3135,9 @@ export function createControlPlaneApi(options) {
             const vertical = await verticalForScope(c, scope);
             if (vertical)
                 await retryTransient(() => vertical.restoreScope(tenantId, scopeId, tables));
+            // #1674: a backup from before a module was switched off brings it back on; the
+            // directory's record puts it back off now, not at the next reconcile.
+            await admin.reassertSystemSwitches(actor, { tenantId, scopeId });
             return c.json({ restored: scopeId, tables: tables.length });
         }
         catch (e) {
@@ -3153,10 +3206,15 @@ export function createControlPlaneApi(options) {
                 force,
                 localApply: !vertical,
             });
-            if (vertical) {
-                return c.json(await vertical.rewindScope(scopeId, bookmark, { force }));
-            }
-            return c.json(result);
+            const answer = vertical ? await vertical.rewindScope(scopeId, bookmark, { force }) : result;
+            // #1674: a rewind takes the scope's grants back to the bookmark, and with them any
+            // schedule kill switch pulled since — a tenant owner could otherwise undo a staff
+            // switch this way. Clearing the provisioned receipt, only once the rewind has gone
+            // through, makes the next sweep reconcile the scope, and that reconcile re-asserts
+            // what the directory records as off. Left to the sweep rather than done here: the
+            // scope's store restarts to finish the restore, and a re-assert now would race it.
+            await admin.markScopeProvisioned(actor, tenantId, scopeId, null);
+            return c.json(answer);
         }
         catch (e) {
             if (e instanceof ControlPlaneError) {
@@ -3205,7 +3263,7 @@ export function createControlPlaneApi(options) {
         if (v.ownerTenant === null) {
             return c.json({ error: 'adopt-serving is a private-vertical operation' }, 409);
         }
-        const owned = (await admin.listScopes(actor, { tenantId: v.ownerTenant, vertical: slug })).filter((s) => !s.forkedFrom && s.status === 'active');
+        const owned = (await admin.listScopes(actor, { tenantId: v.ownerTenant, vertical: slug })).filter((s) => !s.forkedFrom && s.kind !== 'preview' && s.status === 'active');
         const adopted = [];
         const alreadyAdopted = [];
         try {
@@ -3270,6 +3328,12 @@ export function createControlPlaneApi(options) {
             if (scope)
                 await carryOntoVersion(c, scope, versionId);
         };
+        // #1674: after the bind, the scope may route to a different store (the carry's
+        // destination); put the directory's recorded OFF positions back there.
+        const reassert = async () => {
+            if (scope)
+                await admin.reassertSystemSwitches(actor, { tenantId, scopeId });
+        };
         if (snapshot) {
             if (!scope) {
                 return c.json({ error: `unknown scope for tenant: (${tenantId}, ${scopeId})` }, 404);
@@ -3295,10 +3359,12 @@ export function createControlPlaneApi(options) {
                 await carry();
                 await admin.bindScopeVersion(actor, tenantId, scopeId, versionId, { snapshot: true });
             }
+            await reassert();
             return c.json(await admin.getScopeRecord(actor, tenantId, scopeId));
         }
         await carry();
         await admin.bindScopeVersion(actor, tenantId, scopeId, versionId);
+        await reassert();
         return c.json(await admin.getScopeRecord(actor, tenantId, scopeId));
     });
     // -- instances (K-31) -------------------------------------------------------
@@ -3400,6 +3466,14 @@ export function createControlPlaneApi(options) {
             // one guessed from the serving pointer would claim a hook ran against code this
             // scope was not running.
             const provisioned = await admin.getScopeRecord(c.get('actor'), input.tenantId, input.scopeId);
+            // #1674: this route is idempotent (K-31), so an already-bound scope that was wiped can
+            // come back through it, re-seated live by the deployment — and the receipt below means
+            // no sweep follows. Re-assert the recorded OFF positions before it. Only once the
+            // directory row exists: a brand-new install's is written after this call (see above),
+            // has no record to re-assert, and `reassertSystemSwitches` refuses an unknown scope.
+            if (provisioned) {
+                await admin.reassertSystemSwitches(c.get('actor'), { tenantId: input.tenantId, scopeId: input.scopeId });
+            }
             if (provisioned?.verticalVersionId) {
                 await admin.markScopeProvisioned(c.get('actor'), input.tenantId, input.scopeId, provisioned.verticalVersionId);
             }
@@ -3675,6 +3749,31 @@ export function createControlPlaneApi(options) {
         const registry = json ? (storedDeployManifest.parse(JSON.parse(json)).registry ?? null) : null;
         return c.json({ registry });
     });
+    // The SQL migrations one version adds on top of another (#1677): what the promote dialog
+    // and `substrat promote` show before a migration change is acknowledged. `?base=` names the
+    // version to compare against (the one `prod` serves); without it every migration is listed.
+    // Owner-narrowed like `/registry`, and never widened: migration SQL describes a schema.
+    // `migrations` is null for a version whose manifest carries none (pushed before the field,
+    // or over the push's cap), which a reader must show as "SQL not available", never as
+    // "no migrations". Bounded in count and bytes (`migrationsOnTop`).
+    app.get('/verticals/:slug/versions/:id/migrations', async (c) => {
+        const p = c.get('principal');
+        const slug = await resolveVerticalId(c, c.req.param('slug'));
+        if (await notOwned(p, slug)) {
+            return c.json({ error: 'not found' }, 404);
+        }
+        // `versionManifest` refuses a version of another vertical, so `base` cannot reach one.
+        const migrationsOf = async (id) => {
+            const json = await admin.versionManifest(c.get('actor'), slug, id);
+            return json ? (storedDeployManifest.parse(JSON.parse(json)).migrations ?? null) : null;
+        };
+        const base = c.req.query('base');
+        const [incoming, baseline] = await Promise.all([
+            migrationsOf(c.req.param('id')),
+            base === undefined ? undefined : migrationsOf(base),
+        ]);
+        return c.json({ migrations: incoming === null ? null : migrationsOnTop(incoming, baseline) });
+    });
     // The emitted entity model (#1214) one version ships: entities, field schemas, parent
     // edges, declared lifecycles — read out of the same retained manifest as the registry
     // above, and owner-narrowed the same way. `model` is null for a version pushed by a
@@ -4019,6 +4118,25 @@ export function createControlPlaneApi(options) {
             return { minted: [], error: message };
         }
     };
+    // #1705 PR 3: which installed apps promoting `?versionId=` would break (an export they import,
+    // dropped or re-versioned), BEFORE promoting, so a dialog can show it and ask for the
+    // acknowledgement up front, as it does for the digests. The promote's own 409 carries the same
+    // listing. Narrowed to the caller exactly as that 409 is. Owner-checked like the promote.
+    app.get('/verticals/:slug/channels/:channel/promote-impact', async (c) => {
+        const p = c.get('principal');
+        const slug = await resolveVerticalId(c, c.req.param('slug'));
+        const channel = channelName.parse(c.req.param('channel'));
+        const versionId = z.string().min(1).parse(c.req.query('versionId'));
+        const pin = confinedTenant(p);
+        if (pin) {
+            const v = await verticalOf(p.actor, slug);
+            if (!v || v.ownerTenant !== pin)
+                return c.json({ error: 'forbidden' }, 403);
+        }
+        const breaks = await admin.promotionImpact(c.get('actor'), slug, channel, versionId);
+        const { visible, otherTenants } = narrowToCaller(breaks, pin);
+        return c.json({ affected: visible, ...(otherTenants ? { otherTenants } : {}) });
+    });
     app.post('/verticals/:slug/channels/:channel/promote', async (c) => {
         const p = c.get('principal');
         const slug = await resolveVerticalId(c, c.req.param('slug'));
@@ -4055,10 +4173,37 @@ export function createControlPlaneApi(options) {
             }
         }
         const { versionId, acknowledge } = promoteVersionBody.parse(await c.req.json());
+        // #1705 PR 3: the installed consumers a promotion breaks (an export they import, dropped or
+        // re-versioned). The host refuses it without `exportBreak` whoever calls, in counts only,
+        // because it does not know who is asking. This door knows, so it adds the listing, narrowed
+        // the way the store backfill below is: a confined caller sees its own tenant's apps and the
+        // rest as a count, never another tenant's id. Read only when there is something to say: on
+        // the refusal, and before an acknowledged promotion moves the channel it is measured from.
+        const breaksOf = async () => {
+            const breaks = await admin.promotionImpact(c.get('actor'), slug, channel, versionId);
+            if (breaks.length === 0)
+                return null;
+            const { visible, otherTenants } = narrowToCaller(breaks, confinedTenant(p));
+            return { affected: visible, ...(otherTenants ? { otherTenants } : {}) };
+        };
+        const exportBreaks = acknowledge?.exportBreak ? await breaksOf() : null;
         // The blast-radius moment: refuses a changed digest without the acknowledgement,
         // and refuses a non-admitted version. Both are enforced below the seam and
         // surface as a 4xx through mapError, not a 500.
-        await admin.promoteVersion(c.get('actor'), slug, channel, versionId, acknowledge);
+        try {
+            await admin.promoteVersion(c.get('actor'), slug, channel, versionId, acknowledge);
+        }
+        catch (err) {
+            if (!isExportBreakRefusal(err))
+                throw err;
+            // The refusal stands whether or not the listing can be read. A listing that fails turns
+            // into a note, never into a 500 that would hide that the promote was refused.
+            const listing = await breaksOf().then((exportBreaks) => ({ exportBreaks }), (e) => ({
+                exportBreaks: null,
+                exportBreaksUnavailable: `which apps it breaks could not be read: ${e instanceof Error ? e.message : String(e)}`,
+            }));
+            return c.json({ error: err.message, ...listing }, 409);
+        }
         // The in-place serve (#286), prod only, AFTER every promote gate has passed —
         // uploading first would deploy to live scopes before the acknowledgement check.
         // A failed serve is NOT a failed promote: the channel moved (audited), old code
@@ -4098,12 +4243,11 @@ export function createControlPlaneApi(options) {
         // report must not be the one place that hands them the tenant ids of everyone who
         // installed their vertical. The rest is a count, which tells them the fleet was covered
         // without naming who is in it.
-        const p2 = c.get('principal');
-        const reportPin = confinedTenant(p2);
-        const visible = reportPin ? backfill.minted.filter((m) => m.tenantId === reportPin) : backfill.minted;
-        const otherTenants = new Set(backfill.minted.filter((m) => !visible.includes(m)).map((m) => m.tenantId)).size;
+        const { visible, otherTenants } = narrowToCaller(backfill.minted, confinedTenant(c.get('principal')));
         return c.json({
             ...promoted,
+            // What the acknowledged break reached, so a promoter who passed `exportBreak` reads it.
+            ...(exportBreaks ? { exportBreaks } : {}),
             ...(backfill.minted.length || backfill.error
                 ? {
                     storeBackfill: {
@@ -4561,14 +4705,28 @@ export function createControlPlaneApi(options) {
             // than somebody else's, and needs no ownership check of its own to be safe.
             scopeId: z.string().min(1).max(64).optional(),
             vertical: z.string().min(1).max(200).optional(),
+            // A coarser grouping of the same rows (#1767) — never a wider read.
+            grain: z.enum(['surface', 'scope']).optional(),
             hours: z.coerce.number().int().min(1).max(72).default(24),
+            since: z.string().datetime({ offset: true }).optional(),
+            until: z.string().datetime({ offset: true }).optional(),
         })
             .parse({
             tenantId,
             scopeId: c.req.query('scopeId') || undefined,
             vertical: c.req.query('vertical') || undefined,
-            hours: c.req.query('hours'),
+            grain: c.req.query('grain') || undefined,
+            hours: c.req.query('hours'), since: c.req.query('since'), until: c.req.query('until'),
         });
+        try {
+            resolveObservabilityWindow(input);
+        }
+        catch (e) {
+            throw new ControlPlaneError(400, e.message);
+        }
+        if (input.since !== undefined && !options.observability.absoluteTenantWindows) {
+            throw new ControlPlaneError(501, 'absolute tenant telemetry windows are not supported by this backend');
+        }
         return c.json(await options.observability.tenantMetrics(input));
     });
     // The bucketed twin (#1447): the series a team-level chart plots, one line per app.
@@ -4592,8 +4750,19 @@ export function createControlPlaneApi(options) {
             // zero rows rather than somebody else's, so no ownership check is needed here.
             scopeIds: z.array(z.string().min(1).max(64)).min(1).max(TENANT_SERIES_SCOPE_CAP),
             hours: z.coerce.number().int().min(1).max(72).default(24),
+            since: z.string().datetime({ offset: true }).optional(),
+            until: z.string().datetime({ offset: true }).optional(),
         })
-            .parse({ tenantId, scopeIds, hours: c.req.query('hours') });
+            .parse({ tenantId, scopeIds, hours: c.req.query('hours'), since: c.req.query('since'), until: c.req.query('until') });
+        try {
+            resolveObservabilityWindow(input);
+        }
+        catch (e) {
+            throw new ControlPlaneError(400, e.message);
+        }
+        if (input.since !== undefined && !options.observability.absoluteTenantWindows) {
+            throw new ControlPlaneError(501, 'absolute tenant telemetry windows are not supported by this backend');
+        }
         return c.json(await options.observability.tenantMetricsSeries(input));
     });
     app.get('/observability/tenant-logs', async (c) => {
@@ -5213,6 +5382,8 @@ export function createControlPlaneApi(options) {
             if (existing.servingRef)
                 await admin.setScopeServingRef(actor, tenantId, existing.id, null);
             await admin.bindScopeVersion(actor, tenantId, existing.id, opts.versionId);
+            // #1674: re-assert any recorded OFF in the script the preview now routes to.
+            await admin.reassertSystemSwitches(actor, { tenantId, scopeId: existing.id });
             // Renew (or clear) the preview's GC deadline so a reused preview does not silently die.
             await admin.setScopeExpiresAt(actor, tenantId, existing.id, expiresAt);
             const hostname = await bindPreviewHostname(actor, baseHostname, tenantId, existing.id, opts.tag, surface);
@@ -5572,6 +5743,36 @@ export function createControlPlaneApi(options) {
         }
         return c.json(await admin.systemGrantsStatus(actor, { tenantId, scopeId }));
     });
+    // The fleet read (#1674): every scope with a module switched off, from the directory's
+    // record of the switch, so it needs no walk of every scope's store. The record is not the
+    // gate; the per-scope read above is where a drift between the two shows (`recorded`).
+    //
+    // **Staff and the platform service token ONLY.** Outside `/tenants/:id`, and in neither
+    // BUILDER_ROUTES nor TENANT_ROUTES, so a builder and a tenant credential are both refused
+    // by default-deny before this runs. The `confinedTenant` check is the second lock, not
+    // the first: a fleet-wide read is exactly what a confined credential must never make, and
+    // it must not start answering if this path is ever allowlisted for a narrowed read.
+    app.get('/system-switches', async (c) => {
+        if (confinedTenant(c.get('principal')) !== null) {
+            return c.json({ error: 'forbidden: the schedule switch is staff-only' }, 403);
+        }
+        const q = systemSwitchesQuery.parse({
+            position: c.req.query('position'),
+            tenantId: c.req.query('tenantId'),
+            scopeId: c.req.query('scopeId'),
+            moduleId: c.req.query('moduleId'),
+            vertical: c.req.query('vertical'),
+            limit: c.req.query('limit'),
+            cursor: c.req.query('cursor'),
+            order: c.req.query('order'),
+        });
+        const { position, ...rest } = q;
+        const entries = await admin.listSystemSwitches(c.get('actor'), {
+            ...rest,
+            ...(position === 'all' ? {} : { position }),
+        });
+        return c.json(pageOf(entries, q.limit, (e) => e.operationId));
+    });
     // -- the peer kill switch (#1706) ------------------------------------------
     //
     // One calling vertical's access to ONE scope, off and back on — `revokeFromPeer` and
@@ -5694,6 +5895,51 @@ export function createControlPlaneApi(options) {
         const entries = await admin.listSweepRuns(c.get('actor'), filter);
         return c.json(pageOf(entries, filter.limit, (e) => e.id));
     });
+    // -- the replay lever (#1705 PR 3): move a consumer's watermark on one edge ----
+    // Staff (the console) and a tenant credential (the dashboard, for someone who may manage the
+    // tenant's apps) may pull it: the edge is between two of the tenant's own apps, and what a
+    // replay runs lands in the tenant's own scope. The peer switch's posture, for that reason.
+    // Builders may not: this route is absent from BUILDER_ROUTES, which is default-deny.
+    //
+    // The acknowledgement is refused HERE with the sentence it stands for, rather than left to a
+    // Zod message about a literal. The person pulling the lever has to be told, in words, that a
+    // replay runs handlers again and repeats what they send or call outside the app.
+    app.post('/tenants/:tenantId/scopes/:scopeId/import-cursor', async (c) => {
+        const tenantId = tenantIdSchema.parse(c.req.param('tenantId'));
+        const scopeId = scopeIdSchema.parse(c.req.param('scopeId'));
+        const pin = confinedTenant(c.get('principal'));
+        if (pin !== null && pin !== tenantId)
+            return c.json({ error: 'forbidden' }, 403);
+        const raw = await c.req.json().catch(() => ({}));
+        const refused = importCursorAcknowledgementMissing(raw);
+        if (refused)
+            return c.json({ error: refused }, 400);
+        const move = importCursorMove.parse(raw);
+        const actor = c.get('actor');
+        // K-3 first, so a scope of another tenant reads as absent before anything is reached.
+        if (!(await admin.getScopeRecord(actor, tenantId, scopeId))) {
+            return c.json({ error: `unknown scope for tenant: (${tenantId}, ${scopeId})` }, 404);
+        }
+        return c.json(await admin.moveImportCursor(actor, tenantId, scopeId, move));
+    });
+    // -- edge health (#1705 PR 3): where each cross-vertical edge of one tenant stands -
+    // Read live, through the phase's own reach, so it cannot disagree with the next pass about
+    // which edges exist. Staff and the tenant's own credential, tenant-pinned (the dashboard shows
+    // a tenant its own apps' edges). Builders may not: absent from BUILDER_ROUTES. `?scopeId=`
+    // narrows it to one scope's edges, so a per-app view asks nothing about the rest.
+    app.get('/tenants/:tenantId/cross-vertical/edges', async (c) => {
+        const tenantId = tenantIdSchema.parse(c.req.param('tenantId'));
+        const pin = confinedTenant(c.get('principal'));
+        if (pin !== null && pin !== tenantId)
+            return c.json({ error: 'forbidden' }, 403);
+        const focus = c.req.query('scopeId');
+        return c.json(await crossVerticalHealth(host, {
+            actor: c.get('actor'),
+            tenantId,
+            ...(focus ? { focus: scopeIdSchema.parse(focus) } : {}),
+            ...(options.crossVertical ? { crossVertical: options.crossVertical } : {}),
+        }));
+    });
     // -- issues (#1233): failures grouped by fingerprint, with a lifecycle --------
     // Staff-only (absent from BUILDER_ROUTES): an issue is a fleet-scoped aggregate
     // with no tenant column, so the forced-filter posture cannot narrow it — a