@substrat-run/control-plane-api 0.122.1 → 0.125.0

package/dist/api.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"api.d.ts","sourceRoot":"","sources":["../src/api.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAE5B,OAAO,EA0EL,CAAC,EAQF,MAAM,yBAAyB,CAAC;AACjC,OAAO,KAAK,EAGV,UAAU,EACV,kBAAkB,EAElB,wBAAwB,EACxB,oBAAoB,EAEpB,eAAe,EAGf,eAAe,EAQhB,MAAM,yBAAyB,CAAC;AACjC,OAAO,KAAK,EAAE,oBAAoB,EAAmB,SAAS,EAAE,MAAM,sBAAsB,CAAC;AAa7F,OAAO,KAAK,EAAE,iBAAiB,EAAE,WAAW,EAAE,SAAS,EAAE,iBAAiB,EAAE,MAAM,WAAW,CAAC;AAE9F,OAAO,EAA4B,KAAK,cAAc,EAAE,MAAM,sBAAsB,CAAC;AAsBrF,OAAO,KAAK,EAEV,gBAAgB,EAChB,oBAAoB,EACpB,sBAAsB,EACvB,MAAM,aAAa,CAAC;AACrB,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,UAAU,CAAC;AAyBtD,OAAO,EAA2B,KAAK,mBAAmB,EAAE,MAAM,oBAAoB,CAAC;AACvF,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AAC7D,OAAO,EAAuB,KAAK,iBAAiB,EAAE,MAAM,oBAAoB,CAAC;AACjF,OAAO,KAAK,EAEV,oBAAoB,EAEpB,gBAAgB,EACjB,MAAM,cAAc,CAAC;AAGtB,OAAO,EAGL,KAAK,yBAAyB,EAC/B,MAAM,uBAAuB,CAAC;AAE/B;;;;;;;;;;GAUG;AACH,MAAM,WAAW,mBAAmB;IAClC,KAAK,CAAC,EAAE,CAAC,IAAI,EAAE,SAAS,EAAE,UAAU,EAAE,UAAU,KAAK,OAAO,CAAC,eAAe,CAAC,CAAC;IAC9E,QAAQ,CAAC,EAAE,CACT,IAAI,EAAE,SAAS,EACf,UAAU,EAAE,UAAU,EACtB,IAAI,EAAE;QAAE,IAAI,EAAE,OAAO,CAAC;QAAC,MAAM,EAAE,wBAAwB,CAAA;KAAE,KACtD,OAAO,CAAC,kBAAkB,CAAC,CAAC;IACjC;;;;;OAKG;IACH,UAAU,CAAC,EAAE,CAAC,IAAI,EAAE,SAAS,EAAE,UAAU,EAAE,UAAU,KAAK,OAAO,CAAC,oBAAoB,CAAC,CAAC;IACxF;;;;;;;OAOG;IACH,cAAc,CAAC,EAAE,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,KAAK,OAAO,CAAC,eAAe,CAAC,CAAC;CAC/E;AAED,MAAM,WAAW,sBAAsB;IACrC;;;;OAIG;IACH,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B,IAAI,EAAE,SAAS,CAAC;IAChB;;;;;;OAMG;IACH,aAAa,CAAC,EAAE,oBAAoB,GAAG,SAAS,CAAC;IACjD;;;;;;;OAOG;IACH,SAAS,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,cAAc,CAAC,CAAC;IAC3C;;;;;;;;OAQG;IACH,eAAe,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,SAAS,MAAM,EAAE,CAAC,CAAC,CAAC;IAC9D;;;;;;OAMG;IACH,eAAe,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,eAAe,KAAK,OAAO,CAAC,cAAc,GAAG,SAAS,CAAC,CAAC;IAChG;;;;;;;;;OASG;IACH,sBAAsB,CAAC,EAAE,CACvB,IAAI,EAAE,MAAM,EACZ,SAAS,EAAE,MAAM,EACjB,KAAK,EAAE,eAAe,KACnB,OAAO,CAAC,cAAc,GAAG,SAAS,CAAC,CAAC;IACzC;;;;;;;OAOG;IACH,kBAAkB,CAAC,EAAE,CAAC,aAAa,EAAE,MAAM,KAAK,OAAO,CAAC,cAAc,GAAG,SAAS,CAAC,CAAC;IACpF;;;;;OAKG;IACH,cAAc,CAAC,EAAE,gBAAgB,CAAC;IAClC;;;;;OAKG;IACH,oBAAoB,CAAC,EAAE,sBAAsB,CAAC;IAC9C;;;;;;;;;;OAUG;IACH,kBAAkB,CAAC,EAAE,oBAAoB,CAAC;IAC1C;;;;;;OAMG;IACH,mBAAmB,CAAC,EAAE,qBAAqB,CAAC;IAC5C;;;;;;;;OAQG;IACH,sBAAsB,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAC3C;;;;OAIG;IACH,YAAY,EAAE,iBAAiB,CAAC;IAChC;;;;;;OAMG;IACH,mBAAmB,CAAC,EAAE,WAAW,CAAC;IAClC;;;;;;OAMG;IACH,yBAAyB,CAAC,EAAE,iBAAiB,CAAC;IAC9C;;;;;OAKG;IACH,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB;;;;;;;OAOG;IACH,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B;;;;;;;;;OASG;IACH,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB;;;;;;;;OAQG;IACH,aAAa,CAAC,EAAE,mBAAmB,CAAC;IACpC;;;;;;;;;;;;OAYG;IACH,oBAAoB,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,mBAAmB,CAAC,CAAC;IAC3D;;;;;;;;;OASG;IACH,eAAe,CAAC,EAAE,eAAe,CAAC;IAClC;;;;;OAKG;IACH,YAAY,CAAC,EAAE,iBAAiB,CAAC;IACjC;;;;;;;;;;;;;OAaG;IACH,YAAY,CAAC,EAAE,gBAAgB,CAAC;IAChC;;;;;;;;;OASG;IACH,gBAAgB,CAAC,EAAE,oBAAoB,CAAC;IACxC;;;;;;;OAOG;IACH,iBAAiB,CAAC,EAAE,yBAAyB,CAAC;IAC9C;;;;;;OAMG;IACH,mBAAmB,CAAC,EAAE,MAAM,EAAE,CAAC;IAC/B;;;;;;;;;;;OAWG;IACH,WAAW,CAAC,EAAE;QAAE,UAAU,CAAC,EAAE,MAAM,CAAC;QAAC,aAAa,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;CAC/D;AAED;;;;GAIG;AACH,eAAO,MAAM,sBAAsB,+BAA+B,CAAC;AACnE,eAAO,MAAM,yBAAyB,kCAAkC,CAAC;AAKzE,KAAK,IAAI,GAAG;IAAE,KAAK,EAAE,eAAe,CAAC;IAAC,SAAS,EAAE,SAAS,CAAA;CAAE,CAAC;AAgS7D;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,cAAc;;;;;;;;;;;iBASzB,CAAC;AAqCH,yFAAyF;AACzF,eAAO,MAAM,yBAAyB,MAAM,CAAC;AA8G7C,eAAO,MAAM,4BAA4B,KAAK,CAAC;AAuC/C,KAAK,SAAS,GAAG,MAAM,GAAG,OAAO,GAAG,SAAS,GAAG,MAAM,GAAG,OAAO,CAAC;AAuEjE;;;;;;;;;;GAUG;AACH,wBAAgB,mBAAmB,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,SAAS,GAAG,SAAS,CAEvF;AAuBD;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AACH,wBAAgB,qBAAqB,CAAC,OAAO,EAAE,sBAAsB,GAAG,IAAI,CAAC;IAAE,SAAS,EAAE,IAAI,CAAA;CAAE,CAAC,CAq9LhG"}
+{"version":3,"file":"api.d.ts","sourceRoot":"","sources":["../src/api.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAE5B,OAAO,EA0EL,CAAC,EAQF,MAAM,yBAAyB,CAAC;AACjC,OAAO,KAAK,EAGV,UAAU,EACV,kBAAkB,EAElB,wBAAwB,EACxB,oBAAoB,EAEpB,eAAe,EAKf,eAAe,EAShB,MAAM,yBAAyB,CAAC;AACjC,OAAO,KAAK,EAAE,oBAAoB,EAAmB,SAAS,EAAE,MAAM,sBAAsB,CAAC;AAa7F,OAAO,KAAK,EAAE,iBAAiB,EAAE,WAAW,EAAE,SAAS,EAAE,iBAAiB,EAAE,MAAM,WAAW,CAAC;AAE9F,OAAO,EAA4B,KAAK,cAAc,EAAE,MAAM,sBAAsB,CAAC;AAsBrF,OAAO,KAAK,EAEV,gBAAgB,EAChB,oBAAoB,EACpB,sBAAsB,EACvB,MAAM,aAAa,CAAC;AACrB,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,UAAU,CAAC;AAyBtD,OAAO,EAA+C,KAAK,mBAAmB,EAAE,MAAM,oBAAoB,CAAC;AAE3G,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AAC7D,OAAO,EAAuB,KAAK,iBAAiB,EAAE,MAAM,oBAAoB,CAAC;AACjF,OAAO,KAAK,EAEV,oBAAoB,EAEpB,gBAAgB,EACjB,MAAM,cAAc,CAAC;AAGtB,OAAO,EAGL,KAAK,yBAAyB,EAC/B,MAAM,uBAAuB,CAAC;AAE/B;;;;;;;;;;GAUG;AACH,MAAM,WAAW,mBAAmB;IAClC,KAAK,CAAC,EAAE,CAAC,IAAI,EAAE,SAAS,EAAE,UAAU,EAAE,UAAU,KAAK,OAAO,CAAC,eAAe,CAAC,CAAC;IAC9E,QAAQ,CAAC,EAAE,CACT,IAAI,EAAE,SAAS,EACf,UAAU,EAAE,UAAU,EACtB,IAAI,EAAE;QAAE,IAAI,EAAE,OAAO,CAAC;QAAC,MAAM,EAAE,wBAAwB,CAAA;KAAE,KACtD,OAAO,CAAC,kBAAkB,CAAC,CAAC;IACjC;;;;;OAKG;IACH,UAAU,CAAC,EAAE,CAAC,IAAI,EAAE,SAAS,EAAE,UAAU,EAAE,UAAU,KAAK,OAAO,CAAC,oBAAoB,CAAC,CAAC;IACxF;;;;;;;OAOG;IACH,cAAc,CAAC,EAAE,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,KAAK,OAAO,CAAC,eAAe,CAAC,CAAC;CAC/E;AAED,MAAM,WAAW,sBAAsB;IACrC;;;;OAIG;IACH,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B,IAAI,EAAE,SAAS,CAAC;IAChB;;;;;;OAMG;IACH,aAAa,CAAC,EAAE,oBAAoB,GAAG,SAAS,CAAC;IACjD;;;;;;;OAOG;IACH,SAAS,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,cAAc,CAAC,CAAC;IAC3C;;;;;;;;OAQG;IACH,eAAe,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,SAAS,MAAM,EAAE,CAAC,CAAC,CAAC;IAC9D;;;;;;OAMG;IACH,eAAe,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,eAAe,KAAK,OAAO,CAAC,cAAc,GAAG,SAAS,CAAC,CAAC;IAChG;;;;;;;;;OASG;IACH,sBAAsB,CAAC,EAAE,CACvB,IAAI,EAAE,MAAM,EACZ,SAAS,EAAE,MAAM,EACjB,KAAK,EAAE,eAAe,KACnB,OAAO,CAAC,cAAc,GAAG,SAAS,CAAC,CAAC;IACzC;;;;;;;OAOG;IACH,kBAAkB,CAAC,EAAE,CAAC,aAAa,EAAE,MAAM,KAAK,OAAO,CAAC,cAAc,GAAG,SAAS,CAAC,CAAC;IACpF;;;;;OAKG;IACH,cAAc,CAAC,EAAE,gBAAgB,CAAC;IAClC;;;;;OAKG;IACH,oBAAoB,CAAC,EAAE,sBAAsB,CAAC;IAC9C;;;;;;;;;;OAUG;IACH,kBAAkB,CAAC,EAAE,oBAAoB,CAAC;IAC1C;;;;;;OAMG;IACH,mBAAmB,CAAC,EAAE,qBAAqB,CAAC;IAC5C;;;;;;;;OAQG;IACH,sBAAsB,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAC3C;;;;OAIG;IACH,YAAY,EAAE,iBAAiB,CAAC;IAChC;;;;;;OAMG;IACH,mBAAmB,CAAC,EAAE,WAAW,CAAC;IAClC;;;;;;OAMG;IACH,yBAAyB,CAAC,EAAE,iBAAiB,CAAC;IAC9C;;;;;OAKG;IACH,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB;;;;;;;OAOG;IACH,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B;;;;;;;;;OASG;IACH,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB;;;;;;;;OAQG;IACH,aAAa,CAAC,EAAE,mBAAmB,CAAC;IACpC;;;;;;;;;;;;OAYG;IACH,oBAAoB,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,mBAAmB,CAAC,CAAC;IAC3D;;;;;;;;;OASG;IACH,eAAe,CAAC,EAAE,eAAe,CAAC;IAClC;;;;;OAKG;IACH,YAAY,CAAC,EAAE,iBAAiB,CAAC;IACjC;;;;;;;;;;;;;OAaG;IACH,YAAY,CAAC,EAAE,gBAAgB,CAAC;IAChC;;;;;;;;;OASG;IACH,gBAAgB,CAAC,EAAE,oBAAoB,CAAC;IACxC;;;;;;;OAOG;IACH,iBAAiB,CAAC,EAAE,yBAAyB,CAAC;IAC9C;;;;;;OAMG;IACH,mBAAmB,CAAC,EAAE,MAAM,EAAE,CAAC;IAC/B;;;;;;;;;;;OAWG;IACH,WAAW,CAAC,EAAE;QAAE,UAAU,CAAC,EAAE,MAAM,CAAC;QAAC,aAAa,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;CAC/D;AAED;;;;GAIG;AACH,eAAO,MAAM,sBAAsB,+BAA+B,CAAC;AACnE,eAAO,MAAM,yBAAyB,kCAAkC,CAAC;AAKzE,KAAK,IAAI,GAAG;IAAE,KAAK,EAAE,eAAe,CAAC;IAAC,SAAS,EAAE,SAAS,CAAA;CAAE,CAAC;AA+T7D;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,cAAc;;;;;;;;;;;iBASzB,CAAC;AAqCH,yFAAyF;AACzF,eAAO,MAAM,yBAAyB,MAAM,CAAC;AA8G7C,eAAO,MAAM,4BAA4B,KAAK,CAAC;AAuC/C,KAAK,SAAS,GAAG,MAAM,GAAG,OAAO,GAAG,SAAS,GAAG,MAAM,GAAG,OAAO,CAAC;AA6EjE;;;;;;;;;;GAUG;AACH,wBAAgB,mBAAmB,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,SAAS,GAAG,SAAS,CAEvF;AAuBD;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AACH,wBAAgB,qBAAqB,CAAC,OAAO,EAAE,sBAAsB,GAAG,IAAI,CAAC;IAAE,SAAS,EAAE,IAAI,CAAA;CAAE,CAAC,CAslMhG"}

package/dist/api.js

@@ -9,7 +9,7 @@ import { connectionGrantsForScope } from './vertical-client.js';
 import { oidcCallbackUrl, retireClientsOfReapedScope, wirePreviewAuth } from './preview-auth.js';
 import { versionReachedAt } from './scope-deployment.js';
 import { reconcileConnectionGrants } from './connection-grants.js';
-import { reconcileThenReassert } from './reconcile.js';
+import { reconcileThenReassert, switchCarryFor } from './reconcile.js';
 import { ConnectionRelayError, relayConnectionUpsert } from './connection-relay.js';
 import { ControlPlaneError } from './client.js';
 import { provisionSiblingScope } from './platform-drain.js';
@@ -33,7 +33,8 @@ function problem(c, answer) {
 }
 import { backfillDeclaredStores, blobStoreBindings, collectBlobStoreHandles, collectTenantStoreHandles, missingStoresForTenant, tenantStoreBindings, } from './tenant-stores.js';
 import { mintPushToken, pushActorFor } from './push-token.js';
-import { TENANT_SERIES_SCOPE_CAP } from './observability.js';
+import { TENANT_SERIES_SCOPE_CAP, REQUEST_FACET_KEYS } from './observability.js';
+import { parseTenantRequestQuery, parseTenantWindowQuery, refineTenantWindow } from './tenant-request-query.js';
 import { namespacesForScript } from './do-namespaces.js';
 import { backupDirectoryIfDue } from './directory-backup.js';
 import { STORAGE_PAGE_DEFAULT, STORAGE_PAGE_MAX, readStoragePage } from './storage-meter.js';
@@ -73,6 +74,38 @@ class ExportBreakRefused extends ControlPlaneError {
 function exportBreakBody(e) {
     return { error: e.message, ...(e instanceof ExportBreakRefused ? { exportBreaks: { affected: e.breaks } } : {}) };
 }
+/**
+ * A delegated facet answer, normalized — and refused when the vertical that produced it
+ * predates #1762.
+ *
+ * The facet runs inside the vertical holding the scope, on the kernel that vertical was
+ * pushed with, and a kernel from before the rule groups a payload field over personal
+ * data too — one bucket per email address. It says so by omitting `withheldPersonal`.
+ * Such a PAYLOAD grouping is not relayed: no buckets, every event that was not erased
+ * counted as withheld, and `withheldReason` saying why. An envelope grouping is a
+ * kernel-stamped column, which the old kernel answered correctly, so it passes with the
+ * count it could not have withheld anything under — 0 — filled in, as the schema
+ * requires.
+ *
+ * A numeric `withheldPersonal` is trusted as it comes. This guard is for version skew,
+ * not a defence against a dishonest vertical: a vertical is tenant code that can already
+ * read its own scope, so one that lied here would be disclosing nothing it could not
+ * show its own users some other way.
+ */
+function withholdIfPredatesRule(input, answer) {
+    if (input.groupBy.kind !== 'payload')
+        return { ...answer, withheldPersonal: answer.withheldPersonal ?? 0 };
+    if (typeof answer.withheldPersonal === 'number')
+        return answer;
+    return {
+        buckets: [],
+        erased: answer.erased,
+        withheldPersonal: Math.max(0, answer.total - answer.erased),
+        withheldReason: 'vertical-predates-rule',
+        total: answer.total,
+        truncated: false,
+    };
+}
 /**
  * A fleet-wide report, narrowed to what a caller may see: a confined caller gets its own
  * tenant's rows and a COUNT of the other tenants, never their ids (K-3's forced filter, held on
@@ -492,6 +525,12 @@ const TENANT_ROUTES = [
     { method: 'GET', re: /\/observability\/tenant-metrics$/, pin: 'query' },
     { method: 'GET', re: /\/observability\/tenant-metrics-series$/, pin: 'query' },
     { method: 'GET', re: /\/observability\/tenant-logs$/, pin: 'query' },
+    // #1746: the request record's histogram, facets and list — same grain, same forced tenant.
+    { method: 'GET', re: /\/observability\/tenant-request-volume$/, pin: 'query' },
+    { method: 'GET', re: /\/observability\/tenant-request-facets$/, pin: 'query' },
+    { method: 'GET', re: /\/observability\/tenant-requests$/, pin: 'query' },
+    // #1747: the tenant's `ctx.log` lines grouped by template — same grain, same forced tenant.
+    { method: 'GET', re: /\/observability\/tenant-log-patterns$/, pin: 'query' },
     { method: 'GET', re: /\/hostnames$/, pin: 'query' },
     { method: 'POST', re: /\/hostnames$/, pin: 'body' },
     // The registry + install catalog.
@@ -732,6 +771,12 @@ export function createControlPlaneApi(options) {
         { method: 'GET', re: /\/observability\/tenant-metrics$/ },
         { method: 'GET', re: /\/observability\/tenant-metrics-series$/ },
         { method: 'GET', re: /\/observability\/tenant-logs$/ },
+        // #1746: the same lines, counted and listed. Tenant-keyed, so no fleet-wide fallback.
+        { method: 'GET', re: /\/observability\/tenant-request-volume$/ },
+        { method: 'GET', re: /\/observability\/tenant-request-facets$/ },
+        { method: 'GET', re: /\/observability\/tenant-requests$/ },
+        // #1747: the same tenant's `ctx.log` lines, grouped by template.
+        { method: 'GET', re: /\/observability\/tenant-log-patterns$/ },
     ];
     app.use('*', async (c, next) => {
         if (c.get('principal').kind === 'builder') {
@@ -1253,10 +1298,13 @@ export function createControlPlaneApi(options) {
     // `/connections/health` — absent from BUILDER_ROUTES and TENANT_ROUTES, so both
     // credentials default-deny it.
     //
-    // This is a count of terminal FAILURES, never a queue depth (see `platformRequestBacklog`'s
+    // `total` is a count of terminal FAILURES, never a queue depth (see `platformRequestBacklog`'s
     // doc): a still-`pending` intent lives in the vertical's own scope DO and nothing here
     // walks the fleet to find it. A `0` means "nothing has given up lately", not "nothing is
     // waiting" — the console tile is worded to keep that distinction, not just this comment.
+    // What IS waiting is `pending` (#1840): the newest `platform-request` sweep row, which the
+    // platform sweep writes once per pass from the fan-out it already pays. As fresh as that
+    // pass, and null — never 0 — when no pass is on record.
     app.get('/platform-requests/backlog', async (c) => {
         const now = new Date();
         const since = new Date(now.getTime() - PLATFORM_REQUEST_BACKLOG_WINDOW_DAYS * 86_400_000).toISOString();
@@ -1274,22 +1322,31 @@ export function createControlPlaneApi(options) {
             SWEEP_RUNS_KIND,
             ...providers.map(connectorDispatchKind),
         ];
-        const counts = await Promise.all(kinds.map(async (kind) => {
-            const found = await admin.listOpsFailures(c.get('actor'), {
-                operation: `intent.${kind}`,
-                since,
-                limit: PLATFORM_REQUEST_BACKLOG_CAP + 1,
-            });
-            return {
-                count: Math.min(found.length, PLATFORM_REQUEST_BACKLOG_CAP),
-                capped: found.length > PLATFORM_REQUEST_BACKLOG_CAP,
-            };
-        }));
+        // The drain's newest pass is independent of the failure counts, so it rides alongside them.
+        const [counts, [lastPass]] = await Promise.all([
+            Promise.all(kinds.map(async (kind) => {
+                const found = await admin.listOpsFailures(c.get('actor'), {
+                    operation: `intent.${kind}`,
+                    since,
+                    limit: PLATFORM_REQUEST_BACKLOG_CAP + 1,
+                });
+                return {
+                    count: Math.min(found.length, PLATFORM_REQUEST_BACKLOG_CAP),
+                    capped: found.length > PLATFORM_REQUEST_BACKLOG_CAP,
+                };
+            })),
+            admin.listSweepRuns(c.get('actor'), { kind: 'platform-request', unit: 'fleet', limit: 1 }),
+        ]);
         const body = {
             total: counts.reduce((sum, k) => sum + k.count, 0),
             capped: counts.some((k) => k.capped),
             since,
             windowDays: PLATFORM_REQUEST_BACKLOG_WINDOW_DAYS,
+            // A row without totals is not a pass this route can read a count from; it answers
+            // null like no row at all rather than inventing a zero.
+            pending: lastPass?.platformRequests
+                ? { count: lastPass.platformRequests.pending, asOf: lastPass.at, floor: lastPass.outcome !== 'ok' }
+                : null,
         };
         return c.json(body);
     });
@@ -1655,6 +1712,16 @@ export function createControlPlaneApi(options) {
      * installs short-circuit.
      * Throws `ControlPlaneError` so callers surface an actionable status, never a bare 500.
      */
+    /**
+     * #1742: restore a dump into a deployment carrying the scope's recorded-off modules, so the
+     * deployment switches them off in the replay's own event. The record is read on EVERY
+     * attempt, inside the retry, so a retried restore carries the record as it stands then, not
+     * as it stood before the failed attempt. Every caller still re-asserts after it (the
+     * fallback), passing what this reports.
+     */
+    const restoreCarryingSwitches = async (actor, dest, tenantId, scopeId, tables) => {
+        return retryTransient(async () => dest.restoreScope(tenantId, scopeId, tables, await switchCarryFor(admin, actor, { tenantId, scopeId })));
+    };
     const adoptScopeOntoServing = async (c, tenantId, scopeId, opts = {}) => {
         const actor = c.get('actor');
         const scope = await admin.getScopeRecord(actor, tenantId, scopeId);
@@ -1690,7 +1757,8 @@ export function createControlPlaneApi(options) {
             throw new ControlPlaneError(501, 'adopt-serving needs dispatch resolution for both ends');
         }
         const dump = await source.exportScope(scopeId);
-        const restored = await retryTransient(() => dest.restoreScope(tenantId, scopeId, dump));
+        // #1742: the recorded OFF positions ride the restore, applied in the replay's own event.
+        const restored = await restoreCarryingSwitches(actor, dest, tenantId, scopeId, dump);
         // Data landed — only now flip routing and move the version pointer.
         await admin
             .setScopeServingRef(actor, tenantId, scopeId, serving.ref, { acknowledge: opts.acknowledge })
@@ -1699,8 +1767,8 @@ export function createControlPlaneApi(options) {
             .bindScopeVersion(actor, tenantId, scopeId, serving.versionId, { acknowledge: opts.acknowledge })
             .catch(relayHostRefusal);
         // #1674: the scope now routes to a different store, so put the directory's recorded
-        // OFF positions back there — cheap and idempotent when the dump carried them.
-        await admin.reassertSystemSwitches(actor, { tenantId, scopeId });
+        // OFF positions back there — cheap and idempotent when the dump or the restore did.
+        await admin.reassertSystemSwitches(actor, { tenantId, scopeId }, { appliedInUnit: restored.switchedOff });
         return { servingRef: serving.ref, tables: restored.tables };
     };
     /**
@@ -1834,7 +1902,7 @@ export function createControlPlaneApi(options) {
             throw new ControlPlaneError(501, 'rebind-vertical needs dispatch resolution for both ends');
         }
         const dump = await source.exportScope(scopeId);
-        const restored = await retryTransient(() => dest.restoreScope(tenantId, scopeId, dump));
+        const restored = await restoreCarryingSwitches(actor, dest, tenantId, scopeId, dump); // #1742, as adopt
         // Data landed on the target script — only now flip routing and cross the pointer.
         // `bindScopeVersion` rewrites `scopes.vertical` from the version row, audited. No
         // extra snapshot here (adopt-serving's precedent): the source script's copy is the
@@ -1842,7 +1910,7 @@ export function createControlPlaneApi(options) {
         await admin.setScopeServingRef(actor, tenantId, scopeId, serving.ref, move).catch(relayHostRefusal);
         await admin.bindScopeVersion(actor, tenantId, scopeId, serving.versionId, move).catch(relayHostRefusal);
         // #1674: re-assert the recorded OFF positions in the store the scope now routes to.
-        await admin.reassertSystemSwitches(actor, { tenantId, scopeId });
+        await admin.reassertSystemSwitches(actor, { tenantId, scopeId }, { appliedInUnit: restored.switchedOff });
         return { servingRef: serving.ref, versionId: serving.versionId, tables: restored.tables };
     };
     /**
@@ -1920,8 +1988,9 @@ export function createControlPlaneApi(options) {
                 `so the version was not bound (#1710)`);
         }
         const dump = await retryTransient(() => source.exportScope(scope.id));
-        const restored = await retryTransient(() => dest.restoreScope(scope.tenantId, scope.id, dump));
-        return { from, to, tables: restored.tables };
+        // #1742: the recorded OFF positions ride the restore, as on adopt and rebind.
+        const restored = await restoreCarryingSwitches(actor, dest, scope.tenantId, scope.id, dump);
+        return { from, to, tables: restored.tables, switchedOff: restored.switchedOff };
     };
     app.get('/tenants/:tenantId/scopes/:scopeId/tables', async (c) => {
         const tenantId = tenantIdSchema.parse(c.req.param('tenantId'));
@@ -2163,13 +2232,14 @@ export function createControlPlaneApi(options) {
         const ranAs = versionReachedAt(reached.via, scope, serving);
         try {
             // #1674: the recorded OFF positions go back after the reconcile, before the receipt.
-            const result = await reconcileThenReassert(admin, actor, { tenantId, scopeId }, () => vertical.reconcileInstance({
+            const result = await reconcileThenReassert(admin, actor, { tenantId, scopeId }, (carry) => vertical.reconcileInstance({
                 tenantId,
                 scopeId,
                 entitlements,
                 identityLinks,
                 connectionGrants,
                 connectionKeys,
+                ...carry,
                 // Handed over exactly as at provision: a store minted HERE has never been migrated
                 // by the vertical, so the reconcile must carry it into the same ready-gate — a bound
                 // but unmigrated database fails as loudly as an absent one.
@@ -2219,7 +2289,9 @@ export function createControlPlaneApi(options) {
         if (!scope)
             return c.json({ error: `unknown scope for tenant: (${tenantId}, ${scopeId})` }, 404);
         return c.json(await delegatedRead(c, tenantId, scopeId, scope, 'facetEvents', input, {
-            viaVertical: (v) => v.facetEvents(scopeId, input),
+            // #1762: only the vertical's answer needs the guard. The co-located read runs
+            // this platform's own kernel, which withholds by construction.
+            viaVertical: async (v) => withholdIfPredatesRule(input, await v.facetEvents(scopeId, input)),
             colocated: () => admin.facetEvents(c.get('actor'), tenantId, scopeId, input),
         }, 
         // The buckets RETURNED, not `total`: the row says how much this read handed
@@ -2265,7 +2337,9 @@ export function createControlPlaneApi(options) {
             method,
             tenantId,
             scopeId,
-            params: delegatedReadParams[method](input),
+            // The answer rides along for the one method whose row describes it (a facet's
+            // withheld counts, #1762); every other projection ignores it.
+            params: delegatedReadParams[method](input, answer),
             resultCount: count(answer),
         });
         return answer;
@@ -3217,11 +3291,13 @@ export function createControlPlaneApi(options) {
             const landing = { ...dump, tables };
             await host.restoreScope(actor, tenantId, scopeId, landing);
             const vertical = await verticalForScope(c, scope);
-            if (vertical)
-                await retryTransient(() => vertical.restoreScope(tenantId, scopeId, tables));
+            // #1742: the recorded OFF positions ride the restore, so the deployment switches them
+            // off in the replay's own event — its own sweeper cannot land in between.
+            const restored = vertical ? await restoreCarryingSwitches(actor, vertical, tenantId, scopeId, tables) : undefined;
             // #1674: a backup from before a module was switched off brings it back on; the
-            // directory's record puts it back off now, not at the next reconcile.
-            await admin.reassertSystemSwitches(actor, { tenantId, scopeId });
+            // directory's record puts it back off now, not at the next reconcile. Where the
+            // deployment already did (#1742), this finds it done and audits what it reported.
+            await admin.reassertSystemSwitches(actor, { tenantId, scopeId }, { appliedInUnit: restored?.switchedOff });
             return c.json({ restored: scopeId, tables: tables.length });
         }
         catch (e) {
@@ -3297,6 +3373,9 @@ export function createControlPlaneApi(options) {
             // through, makes the next sweep reconcile the scope, and that reconcile re-asserts
             // what the directory records as off. Left to the sweep rather than done here: the
             // scope's store restarts to finish the restore, and a re-assert now would race it.
+            // Meanwhile, the deployment that rewound it holds those modules off (#1819). A hold is
+            // released by that reconcile's re-assert, or earlier by a switch move known to land on the
+            // rewound storage, such as an operator's ON.
             await admin.markScopeProvisioned(actor, tenantId, scopeId, null);
             return c.json(answer);
         }
@@ -3430,15 +3509,18 @@ export function createControlPlaneApi(options) {
         // A refusal throws a ControlPlaneError, which the app's error boundary relays with its
         // status and records as an ops failure. An unknown scope carries nothing, and the bind
         // below refuses it as it always has.
+        let carried = null;
         const carry = async () => {
             if (scope)
-                await carryOntoVersion(c, scope, versionId);
+                carried = await carryOntoVersion(c, scope, versionId);
         };
         // #1674: after the bind, the scope may route to a different store (the carry's
-        // destination); put the directory's recorded OFF positions back there.
+        // destination); put the directory's recorded OFF positions back there. #1742: the carry
+        // already did so in the restore's own event; what it reports is audited here.
         const reassert = async () => {
-            if (scope)
-                await admin.reassertSystemSwitches(actor, { tenantId, scopeId });
+            if (scope) {
+                await admin.reassertSystemSwitches(actor, { tenantId, scopeId }, { appliedInUnit: carried?.switchedOff });
+            }
         };
         // The host's own refusal, should the impact have changed since it was read above (a
         // promote landing in between): relayed as the same 409, never as a 500.
@@ -3558,6 +3640,10 @@ export function createControlPlaneApi(options) {
             tenantId: input.tenantId,
             patchBindings: options.patchScriptBindings,
         });
+        // #1742: the recorded OFF positions ride the provision into the seat's own unit. Read
+        // from the directory whether or not the row exists yet: a brand-new install has no
+        // record, so nothing is carried and the body is unchanged.
+        const switches = await switchCarryFor(admin, c.get('actor'), { tenantId: input.tenantId, scopeId: input.scopeId });
         try {
             // #424 case 2: the binding attach above races Cloudflare script-settings
             // propagation, so the vertical's FIRST answer can be a transient 5xx that a
@@ -3570,6 +3656,7 @@ export function createControlPlaneApi(options) {
                 connectionGrants,
                 connectionKeys,
                 ...(tenantStores.length ? { tenantStores } : {}),
+                ...switches,
             }));
             // #1172: the hook has just run, so record what it ran against — WHEN the scope is
             // already bound to a version. Often it is not: this route does not bind, and the
@@ -3585,7 +3672,7 @@ export function createControlPlaneApi(options) {
             // directory row exists: a brand-new install's is written after this call (see above),
             // has no record to re-assert, and `reassertSystemSwitches` refuses an unknown scope.
             if (provisioned) {
-                await admin.reassertSystemSwitches(c.get('actor'), { tenantId: input.tenantId, scopeId: input.scopeId });
+                await admin.reassertSystemSwitches(c.get('actor'), { tenantId: input.tenantId, scopeId: input.scopeId }, { appliedInUnit: instance.switchedOff });
             }
             if (provisioned?.verticalVersionId) {
                 await admin.markScopeProvisioned(c.get('actor'), input.tenantId, input.scopeId, provisioned.verticalVersionId);
@@ -5005,6 +5092,9 @@ export function createControlPlaneApi(options) {
             // 0–7, so `Z000…` is not a ULID however it looks. The contracts package exports
             // no generic ULID schema to reuse — each id brands its own private copy.
             invocationId: z.string().regex(/^[0-7][0-9A-HJKMNP-TV-Z]{25}$/, 'invocationId must be a ULID').optional(),
+            // #1747: one pattern's lines — a `ctx.log` template, verbatim. The line bounds a
+            // template at 500 characters, so a longer one can match nothing and is refused.
+            template: z.string().min(1).max(500).optional(),
             hours: z.coerce.number().int().min(1).max(72).default(24),
             // The chart's time cursor (#1447): a window that ENDS in the past, which `hours`
             // cannot spell — it always ends at now.
@@ -5012,30 +5102,8 @@ export function createControlPlaneApi(options) {
             until: z.string().datetime({ offset: true }).optional(),
             limit: z.coerce.number().int().min(1).max(200).default(100),
         })
-            .superRefine((v, ctx) => {
-            const now = Date.now();
-            const to = v.until ? Date.parse(v.until) : now;
-            const from = v.since ? Date.parse(v.since) : to - v.hours * 3_600_000;
-            // On the resolved bounds rather than on the pair, so a lone `since` in the future
-            // is refused by the same line: with no `until` it is measured against now, and
-            // without this it would reach the backend as a window that cannot contain
-            // anything and come back as an empty page nobody could explain.
-            if (from >= to) {
-                ctx.addIssue({ code: 'custom', path: ['since'], message: 'since must be before until' });
-            }
-            // The SAME ceiling `hours` carries, applied to the window however it was spelled.
-            // Otherwise the pair is a second door onto a read the first one caps at three
-            // days, and the two spellings together would read past what either allows.
-            if (to - from > 72 * 3_600_000) {
-                ctx.addIssue({ code: 'custom', path: ['since'], message: 'the window may not exceed 72 hours' });
-            }
-            // A window ending in the future returns nothing and says nothing about why, which
-            // a reader takes for "my app was quiet". Five minutes of slack, because the
-            // instant is stamped by a browser's clock rather than by ours.
-            if (to > now + 5 * 60_000) {
-                ctx.addIssue({ code: 'custom', path: ['until'], message: 'until may not be more than 5 minutes in the future' });
-            }
-        })
+            // The window rules every tenant-grain read shares (`refineTenantWindow` says why each).
+            .superRefine((v, ctx) => refineTenantWindow(v, ctx))
             .parse({
             tenantId,
             scopeId: c.req.query('scopeId') || undefined,
@@ -5045,6 +5113,9 @@ export function createControlPlaneApi(options) {
             // Raw, not `|| undefined`: an EMPTY id is a caller bug, and folding it into
             // "absent" would answer it with the tenant's whole log.
             invocationId: c.req.query('invocationId'),
+            // Raw, like the invocation id: an EMPTY template is a caller bug, and folding it into
+            // "absent" would answer it with the app's whole log instead of the schema's 400.
+            template: c.req.query('template'),
             hours: c.req.query('hours'),
             since: c.req.query('since') || undefined,
             until: c.req.query('until') || undefined,
@@ -5052,6 +5123,78 @@ export function createControlPlaneApi(options) {
         });
         return c.json(await options.observability.tenantLogs(input));
     });
+    // #1746: the per-request record, read at the tenant grain. The three routes take ONE
+    // query — tenant, window, facet filters (`tenant-request-query.ts`) — so the histogram,
+    // the facet counts and the list beside them always describe the same set of requests.
+    // Each 501s when the reader cannot aggregate, never answers an empty set that would read
+    // as "no traffic".
+    const requestQueryOf = (c) => ({
+        one: (k) => c.req.query(k),
+        all: (k) => c.req.queries(k) ?? [],
+    });
+    const requestTenantOf = (c) => {
+        const tenantId = confinedTenant(c.get('principal')) ?? c.req.query('tenantId');
+        if (!tenantId)
+            throw new ControlPlaneError(400, 'tenantId is required');
+        return tenantId;
+    };
+    app.get('/observability/tenant-request-volume', async (c) => {
+        if (!options.observability?.tenantRequestVolume) {
+            return c.json({ error: 'request aggregation is not configured on this control plane' }, 501);
+        }
+        const scope = parseTenantRequestQuery(requestTenantOf(c), requestQueryOf(c));
+        // A bucket COUNT: zooming in keeps it and narrows the window, so the bucket shrinks.
+        // 90 is the design's histogram; the bounds keep a chart drawable and a query cheap.
+        const buckets = z.coerce.number().int().min(10).max(240).default(90).parse(c.req.query('buckets'));
+        return c.json(await options.observability.tenantRequestVolume({ ...scope, buckets }));
+    });
+    app.get('/observability/tenant-request-facets', async (c) => {
+        if (!options.observability?.tenantRequestFacets) {
+            return c.json({ error: 'request aggregation is not configured on this control plane' }, 501);
+        }
+        const scope = parseTenantRequestQuery(requestTenantOf(c), requestQueryOf(c));
+        // `facet` repeats; absent means every facet. Each one is a backend query, so a panel
+        // that shows three asks for three.
+        const asked = (c.req.queries('facet') ?? []).filter((k) => k.length > 0);
+        const keys = asked.length === 0 ? undefined : z.array(z.enum(REQUEST_FACET_KEYS)).parse([...new Set(asked)]);
+        return c.json(await options.observability.tenantRequestFacets({ ...scope, ...(keys ? { keys } : {}) }));
+    });
+    // #1747: the tenant's `ctx.log` lines grouped by the template they were written from.
+    app.get('/observability/tenant-log-patterns', async (c) => {
+        if (!options.observability?.tenantLogPatterns) {
+            return c.json({ error: 'log patterns are not configured on this control plane' }, 501);
+        }
+        const scope = parseTenantWindowQuery(requestTenantOf(c), requestQueryOf(c));
+        const narrow = z
+            .object({
+            // Each pattern's mini histogram. Few buckets: it is drawn 180px wide.
+            buckets: z.coerce.number().int().min(10).max(120).default(30),
+            level: z.array(z.enum(['debug', 'info', 'warn', 'error'])).max(4),
+            operation: z.array(z.string().min(1).max(200)).max(20),
+        })
+            .parse({
+            buckets: c.req.query('buckets'),
+            level: [...new Set((c.req.queries('level') ?? []).filter((v) => v.length > 0))],
+            operation: [...new Set((c.req.queries('operation') ?? []).filter((v) => v.length > 0))],
+        });
+        return c.json(await options.observability.tenantLogPatterns({
+            tenantId: scope.tenantId,
+            ...(scope.scopeId ? { scopeId: scope.scopeId } : {}),
+            from: scope.from,
+            to: scope.to,
+            buckets: narrow.buckets,
+            ...(narrow.level.length ? { level: narrow.level } : {}),
+            ...(narrow.operation.length ? { operation: narrow.operation } : {}),
+        }));
+    });
+    app.get('/observability/tenant-requests', async (c) => {
+        if (!options.observability?.tenantRequests) {
+            return c.json({ error: 'request aggregation is not configured on this control plane' }, 501);
+        }
+        const scope = parseTenantRequestQuery(requestTenantOf(c), requestQueryOf(c));
+        const limit = z.coerce.number().int().min(1).max(200).default(50).parse(c.req.query('limit'));
+        return c.json(await options.observability.tenantRequests({ ...scope, limit }));
+    });
     /**
      * Observed-vs-declared outbound egress for a vertical's deployed versions (#859, D-46).
      *
@@ -5599,7 +5742,7 @@ export function createControlPlaneApi(options) {
                 await admin.setScopeServingRef(actor, tenantId, existing.id, null);
             await admin.bindScopeVersion(actor, tenantId, existing.id, opts.versionId);
             // #1674: re-assert any recorded OFF in the script the preview now routes to.
-            await admin.reassertSystemSwitches(actor, { tenantId, scopeId: existing.id });
+            await admin.reassertSystemSwitches(actor, { tenantId, scopeId: existing.id }, { appliedInUnit: carried?.switchedOff });
             // Renew (or clear) the preview's GC deadline so a reused preview does not silently die.
             await admin.setScopeExpiresAt(actor, tenantId, existing.id, expiresAt);
             const hostname = await bindPreviewHostname(actor, baseHostname, tenantId, existing.id, opts.tag, surface);