@substrat-run/control-plane-api 0.130.1 → 0.131.0

package/dist/api.js

@@ -1,6 +1,6 @@
 import { resolveObservabilityWindow } from './observability-window.js';
 import { Hono } from 'hono';
-import { parseHostname, withLabel, RESERVED_LABEL_SEPARATOR, adminAction, ownerTransferInput, OWNER_TRANSFER_AUDIT_ERROR_MAX, ASSET_PART_PREFIX, assetHash, channelName, connectionActivity, connectionActivitySource, connectionCredential, connectionFilter, connectionHealthState, connectionProvider, connectorDispatchKind, PROVISION_SIBLING_KIND, ARCHIVE_SCOPE_KIND, PROVISION_TENANT_KIND, SET_ENTITLEMENTS_KIND, MODEL_USAGE_KIND, SWEEP_RUNS_KIND, toConnectionHealthEntry, CONNECTION_EXPIRY_WARNING_DAYS, CONNECTION_STALE_DAYS, connectionProbe, createTenantInput, entitlementGrantInput, hostname as hostnameSchema, hostnameRegion, hostnameStatus, identityLink, errorCode, issueStatus, issueStatusInput, listPageQuery, matchesOutboundHost, pageOf, platformRequestFilter, principalId as principalIdSchema, promotionAcknowledgement, bindAcknowledgement, provisionableJurisdiction, publishVersionInput, queryScopeInput, readScopeTableInput, entityHistoryInput, eventFacetInput, eventCauseInput, eventEffectsInput, invocationEventsInput, deadLettersInput, lifecycleFlowInput, delegatedReadParams, createOrgInput, roleKey as roleKeySchema, peerSwitch, systemSwitch, DEFAULT_DENIAL_LIMIT, DENIAL_LIMIT_MAX, denialGroupBy, registerVerticalInput, serviceDimensions, sweepRunKind, sweepRunOutcome, scopeDump, dataSubjectId as dataSubjectIdSchema, scopeId as scopeIdSchema, scopeStatus, storageShape, surfaceName, tenantId as tenantIdSchema, tenantStatus, versionOrigin, z, PROBLEM_CONTENT_TYPE, toProblem, redrainEventsInput, importCursorMove, importCursorAcknowledgementMissing, REDRAIN_BATCH, migrationsOnTop, errorCodeOf, } from '@substrat-run/contracts';
+import { parseHostname, withLabel, RESERVED_LABEL_SEPARATOR, adminAction, ownerTransferInput, OWNER_TRANSFER_AUDIT_ERROR_MAX, ASSET_PART_PREFIX, assetHash, channelName, connectionActivity, connectionActivitySource, connectionCredential, connectionFilter, connectionHealthState, connectionProvider, connectorDispatchKind, PROVISION_SIBLING_KIND, ARCHIVE_SCOPE_KIND, PROVISION_TENANT_KIND, SET_ENTITLEMENTS_KIND, MODEL_USAGE_KIND, SWEEP_RUNS_KIND, toConnectionHealthEntry, CONNECTION_EXPIRY_WARNING_DAYS, CONNECTION_STALE_DAYS, connectionProbe, createTenantInput, entitlementGrantInput, hostname as hostnameSchema, hostnameRegion, hostnameStatus, identityLink, errorCode, issueStatus, issueStatusInput, listPageQuery, matchesOutboundHost, pageOf, platformRequestFilter, principalId as principalIdSchema, impersonationStamp, promotionAcknowledgement, bindAcknowledgement, provisionableJurisdiction, publishVersionInput, queryScopeInput, readScopeTableInput, entityHistoryInput, eventFacetInput, eventCauseInput, eventEffectsInput, invocationEventsInput, deadLettersInput, lifecycleFlowInput, delegatedReadParams, createOrgInput, roleKey as roleKeySchema, peerSwitch, systemSwitch, DEFAULT_DENIAL_LIMIT, DENIAL_LIMIT_MAX, denialGroupBy, registerVerticalInput, serviceDimensions, sweepRunKind, sweepRunOutcome, scopeDump, dataSubjectId as dataSubjectIdSchema, scopeId as scopeIdSchema, scopeStatus, storageShape, surfaceName, tenantId as tenantIdSchema, tenantStatus, versionOrigin, z, PROBLEM_CONTENT_TYPE, toProblem, redrainEventsInput, importCursorMove, importCursorAcknowledgementMissing, REDRAIN_BATCH, migrationsOnTop, errorCodeOf, } from '@substrat-run/contracts';
 import { attributeFailure } from './failure-attribution.js';
 import { BIND_EXPORT_BREAK_REFUSAL, bindExportBreakRefusal, crossVerticalHealth, exportBreakRefusal, isBindExportBreakRefusal, isExportBreakRefusal, migrationProgress, ulid, } from '@substrat-run/kernel';
 import { TENANT_HEADER, confinedTenant } from './auth.js';
@@ -492,15 +492,78 @@ export const DEFAULT_MODEL_MARGIN_PERCENT = 20;
  *  Cloudflare's `internal error; reference = <id>` shape (#559). */
 const UPSTREAM_REFERENCE = /\breference\s*=\s*([a-z0-9]+)/i;
 const TENANT_ROUTES = [
-    // Everything under one tenant's own path. One entry rather than sixty, because
-    // the confinement is carried by the URL shape and not by a list anybody has to
-    // keep current: `/tenants/<pin>/…` cannot address another tenant's row whatever
-    // the sub-route does. `/tenants` itself (the fleet list) does not match.
-    { method: 'GET', re: /\/tenants\/[^/]+(\/.*)?$/, pin: 'path' },
-    { method: 'POST', re: /\/tenants\/[^/]+(\/.*)?$/, pin: 'path' },
-    { method: 'PUT', re: /\/tenants\/[^/]+(\/.*)?$/, pin: 'path' },
-    { method: 'PATCH', re: /\/tenants\/[^/]+(\/.*)?$/, pin: 'path' },
-    { method: 'DELETE', re: /\/tenants\/[^/]+(\/.*)?$/, pin: 'path' },
+    // One tenant's own path, route by route (#977). It used to be ONE catch-all entry per
+    // method — `/tenants/<pin>/…` cannot address another tenant's row, so it looked safe —
+    // but a path that is confined is not a route that is harmless: it reached entitlement
+    // self-grant, the tenant's own status and admission, and the staff-only redrain doors,
+    // none of which the dashboard calls. The pin says WHOSE rows; this list says WHICH
+    // acts, and a route the dashboard does not issue is reach nobody asked for. The
+    // dashboard's `credential-reach` test holds the other direction — every route its
+    // authority seam issues is on this list — so a new call site fails in its own PR.
+    //
+    // The tenant row: read it, rename it. Not `/status` — suspending or admitting a
+    // tenant is the platform's act, not the tenant's.
+    { method: 'GET', re: /\/tenants\/[^/]+$/, pin: 'path' },
+    { method: 'PATCH', re: /\/tenants\/[^/]+$/, pin: 'path' },
+    // Integrations (#605/#726): connections, their grants, the consent round's verify.
+    { method: 'GET', re: /\/tenants\/[^/]+\/connection-grants$/, pin: 'path' },
+    { method: 'GET', re: /\/tenants\/[^/]+\/connections$/, pin: 'path' },
+    { method: 'POST', re: /\/tenants\/[^/]+\/connections$/, pin: 'path' },
+    { method: 'DELETE', re: /\/tenants\/[^/]+\/connections\/[^/]+$/, pin: 'path' },
+    { method: 'GET', re: /\/tenants\/[^/]+\/connections\/[^/]+\/activity$/, pin: 'path' },
+    { method: 'GET', re: /\/tenants\/[^/]+\/connections\/[^/]+\/credential$/, pin: 'path' },
+    { method: 'POST', re: /\/tenants\/[^/]+\/connections\/[^/]+\/verify$/, pin: 'path' },
+    // Members: identity links mirrored from the dashboard, orgs, role assignments.
+    { method: 'GET', re: /\/tenants\/[^/]+\/identities$/, pin: 'path' },
+    { method: 'PUT', re: /\/tenants\/[^/]+\/identities$/, pin: 'path' },
+    { method: 'DELETE', re: /\/tenants\/[^/]+\/identities\/[^/]+$/, pin: 'path' },
+    { method: 'GET', re: /\/tenants\/[^/]+\/orgs$/, pin: 'path' },
+    { method: 'POST', re: /\/tenants\/[^/]+\/orgs$/, pin: 'path' },
+    { method: 'POST', re: /\/tenants\/[^/]+\/role-assignments$/, pin: 'path' },
+    { method: 'DELETE', re: /\/tenants\/[^/]+\/role-assignments$/, pin: 'path' },
+    // An install's entitlement. The handler narrows WHICH key a tenant credential may
+    // grant (`tenantGrantableEntitlement`): the pin alone would let it grant itself any.
+    { method: 'PUT', re: /\/tenants\/[^/]+\/entitlements\/[^/]+$/, pin: 'path' },
+    { method: 'GET', re: /\/tenants\/[^/]+\/cross-vertical\/edges$/, pin: 'path' },
+    // Scopes: provision, read, and the lifecycle acts the Data and Deployments tabs offer.
+    { method: 'POST', re: /\/tenants\/[^/]+\/scopes$/, pin: 'path' },
+    { method: 'GET', re: /\/tenants\/[^/]+\/scopes\/[^/]+$/, pin: 'path' },
+    { method: 'DELETE', re: /\/tenants\/[^/]+\/scopes\/[^/]+$/, pin: 'path' },
+    { method: 'GET', re: /\/tenants\/[^/]+\/scopes\/[^/]+\/binding-impact$/, pin: 'path' },
+    { method: 'GET', re: /\/tenants\/[^/]+\/scopes\/[^/]+\/bookmarks$/, pin: 'path' },
+    { method: 'GET', re: /\/tenants\/[^/]+\/scopes\/[^/]+\/cause$/, pin: 'path' },
+    { method: 'GET', re: /\/tenants\/[^/]+\/scopes\/[^/]+\/dead-letters$/, pin: 'path' },
+    { method: 'GET', re: /\/tenants\/[^/]+\/scopes\/[^/]+\/denials$/, pin: 'path' },
+    { method: 'GET', re: /\/tenants\/[^/]+\/scopes\/[^/]+\/denials\/summary$/, pin: 'path' },
+    { method: 'GET', re: /\/tenants\/[^/]+\/scopes\/[^/]+\/effects$/, pin: 'path' },
+    { method: 'GET', re: /\/tenants\/[^/]+\/scopes\/[^/]+\/export$/, pin: 'path' },
+    { method: 'GET', re: /\/tenants\/[^/]+\/scopes\/[^/]+\/facets$/, pin: 'path' },
+    { method: 'GET', re: /\/tenants\/[^/]+\/scopes\/[^/]+\/history$/, pin: 'path' },
+    { method: 'GET', re: /\/tenants\/[^/]+\/scopes\/[^/]+\/intents$/, pin: 'path' },
+    { method: 'GET', re: /\/tenants\/[^/]+\/scopes\/[^/]+\/invocation$/, pin: 'path' },
+    { method: 'GET', re: /\/tenants\/[^/]+\/scopes\/[^/]+\/migrations$/, pin: 'path' },
+    { method: 'GET', re: /\/tenants\/[^/]+\/scopes\/[^/]+\/owner-seat$/, pin: 'path' },
+    { method: 'GET', re: /\/tenants\/[^/]+\/scopes\/[^/]+\/peer-grants$/, pin: 'path' },
+    // The peer switch (#1706): on is POST, off is DELETE, on the tenant's own scope.
+    { method: 'POST', re: /\/tenants\/[^/]+\/scopes\/[^/]+\/peer-grants$/, pin: 'path' },
+    { method: 'DELETE', re: /\/tenants\/[^/]+\/scopes\/[^/]+\/peer-grants$/, pin: 'path' },
+    { method: 'GET', re: /\/tenants\/[^/]+\/scopes\/[^/]+\/snapshots$/, pin: 'path' },
+    { method: 'GET', re: /\/tenants\/[^/]+\/scopes\/[^/]+\/tables$/, pin: 'path' },
+    { method: 'GET', re: /\/tenants\/[^/]+\/scopes\/[^/]+\/tables\/[^/]+$/, pin: 'path' },
+    { method: 'POST', re: /\/tenants\/[^/]+\/scopes\/[^/]+\/activate$/, pin: 'path' },
+    { method: 'POST', re: /\/tenants\/[^/]+\/scopes\/[^/]+\/archive$/, pin: 'path' },
+    { method: 'POST', re: /\/tenants\/[^/]+\/scopes\/[^/]+\/configure$/, pin: 'path' },
+    { method: 'POST', re: /\/tenants\/[^/]+\/scopes\/[^/]+\/import-cursor$/, pin: 'path' },
+    { method: 'POST', re: /\/tenants\/[^/]+\/scopes\/[^/]+\/lifecycle-flow$/, pin: 'path' },
+    { method: 'POST', re: /\/tenants\/[^/]+\/scopes\/[^/]+\/owner-claim$/, pin: 'path' },
+    { method: 'POST', re: /\/tenants\/[^/]+\/scopes\/[^/]+\/query$/, pin: 'path' },
+    { method: 'POST', re: /\/tenants\/[^/]+\/scopes\/[^/]+\/reap$/, pin: 'path' },
+    { method: 'POST', re: /\/tenants\/[^/]+\/scopes\/[^/]+\/rebind-vertical$/, pin: 'path' },
+    { method: 'POST', re: /\/tenants\/[^/]+\/scopes\/[^/]+\/restore$/, pin: 'path' },
+    { method: 'POST', re: /\/tenants\/[^/]+\/scopes\/[^/]+\/rewind$/, pin: 'path' },
+    { method: 'POST', re: /\/tenants\/[^/]+\/scopes\/[^/]+\/snapshots$/, pin: 'path' },
+    { method: 'POST', re: /\/tenants\/[^/]+\/scopes\/[^/]+\/suspend$/, pin: 'path' },
+    { method: 'POST', re: /\/tenants\/[^/]+\/scopes\/[^/]+\/version$/, pin: 'path' },
     // Create the tenant's own directory row (idempotent) — `id` is the pin.
     { method: 'POST', re: /\/tenants$/, pin: 'body' },
     // Provision an app + materialize its instance.
@@ -627,7 +690,6 @@ const namedTenants = (c) => {
  */
 export function createControlPlaneApi(options) {
     const { host, authenticate, authenticateBuilder, authenticateTenantService } = options;
-    const admin = host.admin;
     const app = new Hono();
     // The CLI version advisory (#971), stamped on EVERY response — including the 401 the
     // auth middleware below answers with, since a CLI too old to authenticate is exactly
@@ -659,7 +721,12 @@ export function createControlPlaneApi(options) {
         if (authenticateTenantService) {
             const tenant = await authenticateTenantService(c.req.raw);
             if (tenant) {
-                principal = { kind: 'tenant', actor: tenant.actor, tenantId: tenant.tenantId };
+                principal = {
+                    kind: 'tenant',
+                    actor: tenant.actor,
+                    tenantId: tenant.tenantId,
+                    ...(tenant.onBehalfOf ? { onBehalfOf: tenant.onBehalfOf } : {}),
+                };
             }
         }
         const staff = principal ? null : await authenticate(c.req.raw);
@@ -680,6 +747,14 @@ export function createControlPlaneApi(options) {
             return c.json({ error: 'unauthenticated' }, 401);
         c.set('principal', principal);
         c.set('actor', principal.actor);
+        // #977: a tenant credential minted for a person writes through a view that names
+        // them on every admin row. Only the credential's own claim can supply the person —
+        // never a header or a body — and only the staff mint writes that claim.
+        const view = principal.kind === 'tenant' && principal.onBehalfOf && host.attributed
+            ? host.attributed(principal.onBehalfOf)
+            : host;
+        c.set('host', view);
+        c.set('admin', view.admin);
         await next();
     });
     // Confine a BUILDER to the vertical-management surface, fail-CLOSED (builder-plane.md
@@ -839,7 +914,7 @@ export function createControlPlaneApi(options) {
         // regex a message. A caller with no throw in hand leaves the columns null,
         // which reads as "nobody classified this" rather than a guess nobody made.
         const attributed = cause === NO_CAUSE ? undefined : attributeFailure(cause);
-        void admin
+        void host.admin
             .recordOpsFailure({
             ...entry,
             origin: entry.origin ?? attributed?.origin ?? null,
@@ -927,7 +1002,7 @@ export function createControlPlaneApi(options) {
     // -- tenant registry (§4.1) ------------------------------------------------
     app.get('/tenants', async (c) => {
         const page = pageParams(c);
-        const entries = await admin.listTenants(c.get('actor'), page);
+        const entries = await c.var.admin.listTenants(c.get('actor'), page);
         return c.json(pageOf(entries, page.limit, (t) => t.id));
     });
     app.post('/tenants', async (c) => {
@@ -936,14 +1011,14 @@ export function createControlPlaneApi(options) {
         // (from the manager scope's directory row) — never caller-supplied. A direct staff
         // create is first-class by definition, so force it null even if a body carries it,
         // so the field can't be forged into a false ownership relationship.
-        await admin.createTenant(c.get('actor'), { ...input, provisionedByTenant: null });
+        await c.var.admin.createTenant(c.get('actor'), { ...input, provisionedByTenant: null });
         // Idempotent (§4.1): re-creating an existing tenant is a no-op, not an error,
         // so this reads back rather than reporting a create that may not have happened.
-        return c.json(await admin.getTenant(c.get('actor'), input.id), 201);
+        return c.json(await c.var.admin.getTenant(c.get('actor'), input.id), 201);
     });
     app.get('/tenants/:tenantId', async (c) => {
         const tenantId = tenantIdSchema.parse(c.req.param('tenantId'));
-        const tenant = await admin.getTenant(c.get('actor'), tenantId);
+        const tenant = await c.var.admin.getTenant(c.get('actor'), tenantId);
         if (!tenant)
             return c.json({ error: `unknown tenant: ${tenantId}` }, 404);
         return c.json(tenant);
@@ -955,8 +1030,8 @@ export function createControlPlaneApi(options) {
     app.patch('/tenants/:tenantId', async (c) => {
         const tenantId = tenantIdSchema.parse(c.req.param('tenantId'));
         const { name } = z.object({ name: z.string().trim().min(1).max(100) }).parse(await c.req.json());
-        await admin.setTenantName(c.get('actor'), tenantId, name);
-        return c.json(await admin.getTenant(c.get('actor'), tenantId));
+        await c.var.admin.setTenantName(c.get('actor'), tenantId, name);
+        return c.json(await c.var.admin.getTenant(c.get('actor'), tenantId));
     });
     app.patch('/tenants/:tenantId/status', async (c) => {
         const tenantId = tenantIdSchema.parse(c.req.param('tenantId'));
@@ -964,8 +1039,8 @@ export function createControlPlaneApi(options) {
         // The live weapon (§7): `suspended` fails getScope closed for EVERY scope
         // under the tenant. The blast radius is the console's to show; the audit row
         // is this layer's to guarantee.
-        await admin.setTenantStatus(c.get('actor'), tenantId, status);
-        return c.json(await admin.getTenant(c.get('actor'), tenantId));
+        await c.var.admin.setTenantStatus(c.get('actor'), tenantId, status);
+        return c.json(await c.var.admin.getTenant(c.get('actor'), tenantId));
     });
     // Reap a DELETING tenant now (control-plane.md §4.8) — the staff "reap now" that skips
     // the grace window, the tenant analogue of the scope reap route below. Refuses a tenant
@@ -980,7 +1055,7 @@ export function createControlPlaneApi(options) {
         const tenantId = tenantIdSchema.parse(c.req.param('tenantId'));
         const actor = c.get('actor');
         const { backup: wantsBackup } = reapScopeBody.parse(await c.req.json().catch(() => ({})));
-        const tenant = await admin.getTenant(actor, tenantId);
+        const tenant = await c.var.admin.getTenant(actor, tenantId);
         if (!tenant)
             return c.json({ error: `unknown tenant: ${tenantId}` }, 404);
         if (tenant.status !== 'deleting') {
@@ -989,11 +1064,11 @@ export function createControlPlaneApi(options) {
             }, 409);
         }
         try {
-            for (const scope of await admin.listScopes(actor, { tenantId })) {
+            for (const scope of await c.var.admin.listScopes(actor, { tenantId })) {
                 if (scope.status === 'reaped')
                     continue;
                 if (scope.status !== 'archived')
-                    await admin.archiveScope(actor, tenantId, scope.id);
+                    await c.var.admin.archiveScope(actor, tenantId, scope.id);
                 // A backup here is OPT-IN, the inverse of the per-scope reap's default (#493).
                 // A scope reap is operational cleanup, so leaving a copy is the safe default; a
                 // TENANT reap is the deletion of a customer, and §4.8 exists partly to serve an
@@ -1006,13 +1081,13 @@ export function createControlPlaneApi(options) {
                     await vertical.deleteScope({ scopeId: scope.id });
                 // Tenant teardown reaps every scope and releases every name by design — force past
                 // the bound-hostname guard (which fences the interactive per-scope reap route below).
-                await admin.reapScope(actor, tenantId, scope.id, {
+                await c.var.admin.reapScope(actor, tenantId, scope.id, {
                     force: true,
                     ...(backup ? { backupRef: backupRefOf(backup) } : {}),
                 });
             }
-            await admin.reapTenant(actor, tenantId);
-            return c.json(await admin.getTenant(actor, tenantId));
+            await c.var.admin.reapTenant(actor, tenantId);
+            return c.json(await c.var.admin.getTenant(actor, tenantId));
         }
         catch (e) {
             if (e instanceof ControlPlaneError) {
@@ -1022,20 +1097,35 @@ export function createControlPlaneApi(options) {
         }
     });
     // -- entitlements (§4.3) ---------------------------------------------------
-    app.get('/tenants/:tenantId/entitlements', async (c) => c.json(await admin.listEntitlements(c.get('actor'), tenantIdSchema.parse(c.req.param('tenantId')))));
+    app.get('/tenants/:tenantId/entitlements', async (c) => c.json(await c.var.admin.listEntitlements(c.get('actor'), tenantIdSchema.parse(c.req.param('tenantId')))));
     app.put('/tenants/:tenantId/entitlements/:key', async (c) => {
         const tenantId = tenantIdSchema.parse(c.req.param('tenantId'));
         // The body is the plan half (#33) and optional — a bodyless PUT is the
         // pre-widening bare flag grant, and PATCH semantics in the store mean it
         // preserves whatever plan fields the grant already carries.
         const plan = entitlementGrantInput.parse(await c.req.json().catch(() => ({})));
-        await admin.grantEntitlement(c.get('actor'), tenantId, c.req.param('key'), plan);
-        return c.json(await admin.listEntitlements(c.get('actor'), tenantId));
+        const key = c.req.param('key');
+        const p = c.get('principal');
+        if (p.kind === 'tenant') {
+            // #977: a tenant credential may grant its own tenant only what an INSTALL grants —
+            // a key some vertical it can see declares (or that vertical's bare slug, the key a
+            // vertical declaring none gates on). Anything else is the platform's to grant:
+            // `builder`, a plan-gated feature, a key no vertical asked for. And never the plan
+            // half: an expiry, a quota or a plan name is pricing, which is not the tenant's.
+            if (plan.expiresAt != null || plan.quota != null || plan.plan != null) {
+                return c.json({ error: 'a tenant credential grants entitlements without plan fields' }, 403);
+            }
+            if (!(await tenantGrantable(p, key))) {
+                return c.json({ error: `entitlement '${key}' is not declared by a vertical this tenant can install` }, 403);
+            }
+        }
+        await c.var.admin.grantEntitlement(c.get('actor'), tenantId, key, plan);
+        return c.json(await c.var.admin.listEntitlements(c.get('actor'), tenantId));
     });
     app.delete('/tenants/:tenantId/entitlements/:key', async (c) => {
         const tenantId = tenantIdSchema.parse(c.req.param('tenantId'));
-        await admin.revokeEntitlement(c.get('actor'), tenantId, c.req.param('key'));
-        return c.json(await admin.listEntitlements(c.get('actor'), tenantId));
+        await c.var.admin.revokeEntitlement(c.get('actor'), tenantId, c.req.param('key'));
+        return c.json(await c.var.admin.listEntitlements(c.get('actor'), tenantId));
     });
     // -- the meters (§5, #38) --------------------------------------------------
     // Meters 1 and 2, read fleet-wide or narrowed with `?tenantId=`. Meters 3 and 4 have
@@ -1049,7 +1139,7 @@ export function createControlPlaneApi(options) {
     app.get('/meters', async (c) => {
         const raw = c.req.query('tenantId');
         const tenantId = raw ? tenantIdSchema.parse(raw) : undefined;
-        return c.json(await admin.readMeters(c.get('actor'), tenantId ? { tenantId } : undefined));
+        return c.json(await c.var.admin.readMeters(c.get('actor'), tenantId ? { tenantId } : undefined));
     });
     // Storage, read on demand (#1524): one tenant's scope-database sizes and their sum.
     // Staff-only like `/meters` (on neither allowlist, so a builder or a tenant token is
@@ -1076,7 +1166,7 @@ export function createControlPlaneApi(options) {
             limit: c.req.query('limit') || undefined,
         });
         const actor = c.get('actor');
-        const scopes = await admin.listScopes(actor, { tenantId: q.tenantId });
+        const scopes = await c.var.admin.listScopes(actor, { tenantId: q.tenantId });
         return c.json(await readStoragePage({
             tenantId: q.tenantId,
             readAt: new Date().toISOString(),
@@ -1085,13 +1175,13 @@ export function createControlPlaneApi(options) {
             limit: q.limit,
             read: async (scope) => {
                 if (!scope.vertical)
-                    return admin.scopeDatabaseSize(actor, q.tenantId, scope.id);
+                    return c.var.admin.scopeDatabaseSize(actor, q.tenantId, scope.id);
                 const vertical = await verticalForScope(c, scope);
                 if (vertical)
                     return vertical.databaseSize(scope.id);
                 if (delegatesToVerticals)
                     throw new Error(`no deployment resolves for vertical ${scope.vertical}`);
-                return admin.scopeDatabaseSize(actor, q.tenantId, scope.id);
+                return c.var.admin.scopeDatabaseSize(actor, q.tenantId, scope.id);
             },
         }));
     });
@@ -1106,8 +1196,8 @@ export function createControlPlaneApi(options) {
         const tenantId = tenantIdSchema.parse(c.req.param('tenantId'));
         const actor = c.get('actor');
         const [tenantStores, blobStores] = await Promise.all([
-            admin.listTenantStores(actor, { tenantId }),
-            admin.listBlobStores(actor, { tenantId }),
+            c.var.admin.listTenantStores(actor, { tenantId }),
+            c.var.admin.listBlobStores(actor, { tenantId }),
         ]);
         return c.json({ tenantStores, blobStores });
     });
@@ -1124,26 +1214,26 @@ export function createControlPlaneApi(options) {
         const link = mirrorIdentityBody.parse(await c.req.json());
         // The pool must exist before a link can land in it (central topology, K-23);
         // registering an existing pool is a no-op.
-        await admin.registerIdentityPool(c.get('actor'), { provider: link.provider, topology: 'central', tenantId: null });
-        await admin.linkIdentity(c.get('actor'), { ...link, tenantId });
+        await c.var.admin.registerIdentityPool(c.get('actor'), { provider: link.provider, topology: 'central', tenantId: null });
+        await c.var.admin.linkIdentity(c.get('actor'), { ...link, tenantId });
         return c.body(null, 204);
     });
     app.delete('/tenants/:tenantId/identities/:principal', async (c) => {
         const tenantId = tenantIdSchema.parse(c.req.param('tenantId'));
-        await admin.unlinkIdentity(c.get('actor'), tenantId, principalIdSchema.parse(c.req.param('principal')));
+        await c.var.admin.unlinkIdentity(c.get('actor'), tenantId, principalIdSchema.parse(c.req.param('principal')));
         return c.body(null, 204);
     });
     // The read half of the mirror seam (#406): what the directory currently links for a
     // tenant — the console's offboarding view, and the way to verify an unlink landed.
     app.get('/tenants/:tenantId/identities', async (c) => {
         const tenantId = tenantIdSchema.parse(c.req.param('tenantId'));
-        return c.json(await admin.listIdentityLinks(c.get('actor'), tenantId));
+        return c.json(await c.var.admin.listIdentityLinks(c.get('actor'), tenantId));
     });
     // The tenant's live connection grants (#592) — the readable "what may this connection
     // invoke" (connections.md §6.2.4 Q2), and the rows provision/reconcile deliver from.
     app.get('/tenants/:tenantId/connection-grants', async (c) => {
         const tenantId = tenantIdSchema.parse(c.req.param('tenantId'));
-        return c.json(await admin.listConnectionGrants(c.get('actor'), tenantId));
+        return c.json(await c.var.admin.listConnectionGrants(c.get('actor'), tenantId));
     });
     // -- the connection store, tenant-scoped (connections.md §3.5) -------------
     //
@@ -1162,7 +1252,7 @@ export function createControlPlaneApi(options) {
             provider: c.req.query('provider'),
             includeRevoked: c.req.query('includeRevoked') === '1' ? true : undefined,
         });
-        return c.json(await admin.listConnections(c.get('actor'), filter));
+        return c.json(await c.var.admin.listConnections(c.get('actor'), filter));
     });
     // -- connection health, fleet-wide (#1690) -----------------------------------
     //
@@ -1198,7 +1288,7 @@ export function createControlPlaneApi(options) {
             order: c.req.query('order'),
         });
         const now = new Date();
-        const rows = await admin.listConnections(c.get('actor'), {
+        const rows = await c.var.admin.listConnections(c.get('actor'), {
             ...(q.tenantId ? { tenantId: q.tenantId } : {}),
             ...(q.provider ? { provider: q.provider } : {}),
         });
@@ -1243,7 +1333,7 @@ export function createControlPlaneApi(options) {
         const since = new Date(now.getTime() - CONNECTOR_DEAD_LETTER_WINDOW_DAYS * 86_400_000).toISOString();
         const providers = q.provider ? [q.provider] : [...new Set(rows.map((r) => r.provider))].sort();
         const deadLetters = await Promise.all(providers.map(async (provider) => {
-            const found = await admin.listOpsFailures(c.get('actor'), {
+            const found = await c.var.admin.listOpsFailures(c.get('actor'), {
                 operation: `intent.${connectorDispatchKind(provider)}`,
                 ...(q.tenantId ? { tenantId: q.tenantId } : {}),
                 since,
@@ -1312,7 +1402,7 @@ export function createControlPlaneApi(options) {
         // per provider that has (or had) a live connection anywhere in the fleet — the same
         // derivation the dead-letter count above uses, since that kind only exists for a
         // provider some connection actually names.
-        const providers = [...new Set((await admin.listConnections(c.get('actor'), { includeRevoked: true })).map((r) => r.provider))];
+        const providers = [...new Set((await c.var.admin.listConnections(c.get('actor'), { includeRevoked: true })).map((r) => r.provider))];
         const kinds = [
             PROVISION_SIBLING_KIND,
             ARCHIVE_SCOPE_KIND,
@@ -1325,7 +1415,7 @@ export function createControlPlaneApi(options) {
         // The drain's newest pass is independent of the failure counts, so it rides alongside them.
         const [counts, [lastPass]] = await Promise.all([
             Promise.all(kinds.map(async (kind) => {
-                const found = await admin.listOpsFailures(c.get('actor'), {
+                const found = await c.var.admin.listOpsFailures(c.get('actor'), {
                     operation: `intent.${kind}`,
                     since,
                     limit: PLATFORM_REQUEST_BACKLOG_CAP + 1,
@@ -1335,7 +1425,7 @@ export function createControlPlaneApi(options) {
                     capped: found.length > PLATFORM_REQUEST_BACKLOG_CAP,
                 };
             })),
-            admin.listSweepRuns(c.get('actor'), { kind: 'platform-request', unit: 'fleet', limit: 1 }),
+            c.var.admin.listSweepRuns(c.get('actor'), { kind: 'platform-request', unit: 'fleet', limit: 1 }),
         ]);
         const body = {
             total: counts.reduce((sum, k) => sum + k.count, 0),
@@ -1363,7 +1453,7 @@ export function createControlPlaneApi(options) {
             return c.json({ error: 'body tenantId disagrees with the route tenant' }, 400);
         }
         try {
-            return c.json(await relayConnectionUpsert(host, c.get('actor'), { ...body, tenantId }, { probeCandidate }));
+            return c.json(await relayConnectionUpsert(c.var.host, c.get('actor'), { ...body, tenantId }, { probeCandidate }));
         }
         catch (err) {
             if (err instanceof ConnectionRelayError && err.status < 500) {
@@ -1385,12 +1475,12 @@ export function createControlPlaneApi(options) {
     app.delete('/tenants/:tenantId/connections/:id', async (c) => {
         const tenantId = tenantIdSchema.parse(c.req.param('tenantId'));
         const id = c.req.param('id');
-        const rows = await admin.listConnections(c.get('actor'), { tenantId, includeRevoked: true });
+        const rows = await c.var.admin.listConnections(c.get('actor'), { tenantId, includeRevoked: true });
         const row = rows.find((r) => r.id === id);
         if (!row)
             return c.json({ error: 'unknown connection' }, 404);
         if (row.status !== 'revoked')
-            await admin.revokeConnection(c.get('actor'), row.id);
+            await c.var.admin.revokeConnection(c.get('actor'), row.id);
         return c.body(null, 204);
     });
     /**
@@ -1408,7 +1498,7 @@ export function createControlPlaneApi(options) {
     const inspectableConnection = async (c) => {
         const tenantId = tenantIdSchema.parse(c.req.param('tenantId'));
         const id = c.req.param('id');
-        const rows = await admin.listConnections(c.get('actor'), { tenantId });
+        const rows = await c.var.admin.listConnections(c.get('actor'), { tenantId });
         return rows.find((r) => r.id === id);
     };
     /**
@@ -1433,7 +1523,7 @@ export function createControlPlaneApi(options) {
         if (!probe) {
             return c.json({ error: `no probe registered for provider '${row.provider}'` }, 501);
         }
-        return c.json(connectionProbe.parse(await probe(host, row)));
+        return c.json(connectionProbe.parse(await probe(c.var.host, row)));
     });
     /**
      * **What the connection has done** (#605) — the connector's dispatch ledger, projected.
@@ -1457,7 +1547,7 @@ export function createControlPlaneApi(options) {
         }
         const source = connectionActivitySource.catch('ledger').parse(c.req.query('source'));
         const live = c.req.query('live') === '1';
-        return c.json(connectionActivity.parse(await activity(host, row, { live, source })));
+        return c.json(connectionActivity.parse(await activity(c.var.host, row, { live, source })));
     });
     /**
      * **The stored credential, reduced** (#605) — identifiers whole, secrets masked.
@@ -1476,7 +1566,7 @@ export function createControlPlaneApi(options) {
         if (!credential) {
             return c.json({ error: `no credential view registered for provider '${row.provider}'` }, 501);
         }
-        return c.json(connectionCredential.parse(await credential(host, row)));
+        return c.json(connectionCredential.parse(await credential(c.var.host, row)));
     });
     // -- the scope directory (§3.2/§4.2) ---------------------------------------
     app.get('/scopes', async (c) => {
@@ -1489,7 +1579,7 @@ export function createControlPlaneApi(options) {
             vertical: c.req.query('vertical'),
         });
         const page = pageParams(c);
-        const entries = await admin.listScopes(c.get('actor'), { ...filter, ...page });
+        const entries = await c.var.admin.listScopes(c.get('actor'), { ...filter, ...page });
         return c.json(pageOf(entries, page.limit, (s) => s.id));
     });
     // -- fleet migration progress (kernel-design §5.3, #49) ---------------------
@@ -1501,7 +1591,7 @@ export function createControlPlaneApi(options) {
     // an unfiltered read is meaningful only where one deployment runs everything.
     app.get('/fleet/migrations', async (c) => {
         const filter = fleetMigrationsQuery.parse({ vertical: c.req.query('vertical') });
-        const scopes = await admin.listScopes(c.get('actor'), {
+        const scopes = await c.var.admin.listScopes(c.get('actor'), {
             status: ['active', 'provisioning'],
             ...(filter.vertical ? { vertical: filter.vertical } : {}),
         });
@@ -1509,8 +1599,8 @@ export function createControlPlaneApi(options) {
     });
     app.post('/scopes', async (c) => {
         const input = provisionScopeBody.parse(await c.req.json());
-        await host.provisionScope(c.get('actor'), input);
-        const record = await admin.getScopeRecord(c.get('actor'), input.tenantId, input.scopeId);
+        await c.var.host.provisionScope(c.get('actor'), input);
+        const record = await c.var.admin.getScopeRecord(c.get('actor'), input.tenantId, input.scopeId);
         return c.json(record, 201);
     });
     // Add a SIBLING scope — a new "site" — to an app the tenant already runs (multi-scope
@@ -1538,7 +1628,7 @@ export function createControlPlaneApi(options) {
         // The provisioning sequence lives in one place — `provisionSiblingScope` — shared with the
         // platform-intent drain's `provision-sibling` handler (platform-intents.md B2).
         try {
-            const result = await provisionSiblingScope({ host, actor, resolveVerticalForScope: (scope) => verticalForScope({ get: () => actor }, scope) }, {
+            const result = await provisionSiblingScope({ host: c.var.host, actor, resolveVerticalForScope: (scope) => verticalForScope(c, scope) }, {
                 tenantId,
                 parentScopeId: input.parentScopeId,
                 scopeId: input.scopeId,
@@ -1548,7 +1638,7 @@ export function createControlPlaneApi(options) {
             });
             if (!result.ok)
                 return c.json({ error: result.error }, result.status);
-            return c.json(await admin.getScopeRecord(actor, tenantId, input.scopeId), 201);
+            return c.json(await c.var.admin.getScopeRecord(actor, tenantId, input.scopeId), 201);
         }
         catch (e) {
             if (e instanceof ControlPlaneError)
@@ -1564,7 +1654,7 @@ export function createControlPlaneApi(options) {
         if (outsideTenant(p, tenantId)) {
             return c.json({ error: `unknown scope for tenant: (${tenantId}, ${scopeId})` }, 404);
         }
-        const record = await admin.getScopeRecord(c.get('actor'), tenantId, scopeId);
+        const record = await c.var.admin.getScopeRecord(c.get('actor'), tenantId, scopeId);
         // Absent, or present under another tenant — indistinguishable on purpose (K-3).
         if (!record)
             return c.json({ error: `unknown scope for tenant: (${tenantId}, ${scopeId})` }, 404);
@@ -1594,8 +1684,8 @@ export function createControlPlaneApi(options) {
      * protect a subject's data is itself a thing an incident asks about.
      */
     const sealerFor = (c, tenantId, scopeId) => ({
-        seal: (items) => admin.sealSubjectPayloads(c.get('actor'), tenantId, scopeId, items),
-        open: (items) => admin.openSubjectPayloads(c.get('actor'), tenantId, scopeId, items),
+        seal: (items) => c.var.admin.sealSubjectPayloads(c.get('actor'), tenantId, scopeId, items),
+        open: (items) => c.var.admin.openSubjectPayloads(c.get('actor'), tenantId, scopeId, items),
     });
     const verticalForScope = async (c, scope) => (await deploymentForScope(c, scope))?.client;
     /**
@@ -1637,7 +1727,7 @@ export function createControlPlaneApi(options) {
         // under its bare spelling. Retry once under the registry id; anything else still
         // misses and surfaces through `diagnoseUnboundScope` as before.
         if (scope.tenantId && !scope.vertical.includes('/') && (await ownerOf(actor, scope.vertical)) === undefined) {
-            const tenant = await admin.getTenant(actor, scope.tenantId).catch(() => null);
+            const tenant = await c.var.admin.getTenant(actor, scope.tenantId).catch(() => null);
             const prefixed = tenant ? `${tenant.slug}/${scope.vertical}` : null;
             if (prefixed && (await ownerOf(actor, prefixed)) !== undefined)
                 return bySlug(prefixed);
@@ -1660,7 +1750,7 @@ export function createControlPlaneApi(options) {
         const slug = scope.vertical;
         if (!slug)
             return 'scope has no vertical bound — nothing to deliver to';
-        const versions = await admin.listVersions(actor, slug).catch(() => []);
+        const versions = await host.admin.listVersions(actor, slug).catch(() => []);
         const boundId = scope.verticalVersionId;
         if (boundId && !versions.some((v) => v.id === boundId)) {
             return (`scope is bound to version '${boundId}', which is not among vertical '${slug}'’s ${versions.length} ` +
@@ -1673,7 +1763,7 @@ export function createControlPlaneApi(options) {
                 `pushes are on different slugs (a lineage fork). Push under '${slug}' by setting \`substrat.slug\`, ` +
                 `or rebind the install to the slug the versions live under.`);
         }
-        const serving = await admin.verticalServing(actor, slug).catch(() => null);
+        const serving = await host.admin.verticalServing(actor, slug).catch(() => null);
         if (!serving) {
             return `vertical '${slug}' has ${versions.length} version(s) but none is promoted to a serving channel — promote one to prod.`;
         }
@@ -1689,7 +1779,7 @@ export function createControlPlaneApi(options) {
     const refuseOnBreaks = async (actor, tenantId, scopeId, versionId, opts) => {
         if (opts.acknowledge?.exportBreak)
             return;
-        const breaks = await admin.bindingImpact(actor, tenantId, scopeId, versionId, opts.servingRef !== undefined ? { servingRef: opts.servingRef } : undefined);
+        const breaks = await host.admin.bindingImpact(actor, tenantId, scopeId, versionId, opts.servingRef !== undefined ? { servingRef: opts.servingRef } : undefined);
         if (breaks.length > 0)
             throw new ExportBreakRefused(breaks);
     };
@@ -1724,14 +1814,14 @@ export function createControlPlaneApi(options) {
      *  and `exact` when the platform exported them itself rather than a caller supplying them. */
     source) => {
         return retryTransient(async () => dest.restoreScope(tenantId, scopeId, tables, {
-            ...(await switchCarryFor(admin, actor, { tenantId, scopeId })),
+            ...(await switchCarryFor(host.admin, actor, { tenantId, scopeId })),
             sourceScopeId: source.scopeId,
             exact: source.exact,
         }));
     };
     const adoptScopeOntoServing = async (c, tenantId, scopeId, opts = {}) => {
         const actor = c.get('actor');
-        const scope = await admin.getScopeRecord(actor, tenantId, scopeId);
+        const scope = await c.var.admin.getScopeRecord(actor, tenantId, scopeId);
         if (!scope) {
             throw new ControlPlaneError(404, `unknown scope for tenant: (${tenantId}, ${scopeId})`);
         }
@@ -1742,13 +1832,13 @@ export function createControlPlaneApi(options) {
             // #1674 (Copilot review): an adopt that flipped routing and then failed to re-assert is
             // retried HERE, so the retry re-asserts too — else a store that lost its OFF marker in
             // the copy would stay on for good. Cheap and idempotent when nothing is owed.
-            await admin.reassertSystemSwitches(actor, { tenantId, scopeId });
+            await c.var.admin.reassertSystemSwitches(actor, { tenantId, scopeId });
             return { servingRef: scope.servingRef, alreadyAdopted: true };
         }
         if (!scope.vertical) {
             throw new ControlPlaneError(409, 'scope has no vertical — nothing to adopt onto');
         }
-        const serving = await admin.verticalServing(actor, scope.vertical);
+        const serving = await c.var.admin.verticalServing(actor, scope.vertical);
         if (!serving) {
             throw new ControlPlaneError(409, `vertical '${scope.vertical}' has no serving script yet — promote a version to prod first`);
         }
@@ -1767,15 +1857,15 @@ export function createControlPlaneApi(options) {
         // #1742: the recorded OFF positions ride the restore, applied in the replay's own event.
         const restored = await restoreCarryingSwitches(actor, dest, tenantId, scopeId, dump, { scopeId, exact: true });
         // Data landed — only now flip routing and move the version pointer.
-        await admin
+        await c.var.admin
             .setScopeServingRef(actor, tenantId, scopeId, serving.ref, { acknowledge: opts.acknowledge })
             .catch(relayHostRefusal);
-        await admin
+        await c.var.admin
             .bindScopeVersion(actor, tenantId, scopeId, serving.versionId, { acknowledge: opts.acknowledge })
             .catch(relayHostRefusal);
         // #1674: the scope now routes to a different store, so put the directory's recorded
         // OFF positions back there — cheap and idempotent when the dump or the restore did.
-        await admin.reassertSystemSwitches(actor, { tenantId, scopeId }, { appliedInUnit: restored.switchedOff });
+        await c.var.admin.reassertSystemSwitches(actor, { tenantId, scopeId }, { appliedInUnit: restored.switchedOff });
         return { servingRef: serving.ref, tables: restored.tables };
     };
     /**
@@ -1798,13 +1888,13 @@ export function createControlPlaneApi(options) {
     acknowledge) => {
         const actor = c.get('actor');
         const none = { refused: [] };
-        const serving = await admin.verticalServing(actor, slug);
+        const serving = await c.var.admin.verticalServing(actor, slug);
         if (!serving)
             return none; // embedded / not dispatch-backed — the host cascade handled rebinds
         const v = await verticalOf(actor, slug);
         if (!v || v.ownerTenant === null || v.listed)
             return none; // private only, like the host cascade
-        const owned = (await admin.listScopes(actor, { tenantId: v.ownerTenant, vertical: slug, status: ['active'] })).filter((s) => !s.forkedFrom && s.kind !== 'preview');
+        const owned = (await c.var.admin.listScopes(actor, { tenantId: v.ownerTenant, vertical: slug, status: ['active'] })).filter((s) => !s.forkedFrom && s.kind !== 'preview');
         // An install refused for what it would break is left where it is, and the rest still move:
         // one lagging app must not keep every other install's pointer, or the store backfill after
         // this, from happening. The caller answers with what was refused.
@@ -1822,7 +1912,7 @@ export function createControlPlaneApi(options) {
                     // Already on the serving script (born there, or adopted earlier): routing is
                     // pinned to servingRef, so advancing the version pointer only affects Update
                     // offers. Snapshot on a migration-digest crossing (fork-before-promote, §4).
-                    await admin.bindScopeVersion(actor, s.tenantId, s.id, versionId, { snapshot: true, acknowledge });
+                    await c.var.admin.bindScopeVersion(actor, s.tenantId, s.id, versionId, { snapshot: true, acknowledge });
                 }
             }
             catch (e) {
@@ -1854,7 +1944,7 @@ export function createControlPlaneApi(options) {
      */
     const rebindScopeOntoVertical = async (c, tenantId, scopeId, target, opts) => {
         const actor = c.get('actor');
-        const scope = await admin.getScopeRecord(actor, tenantId, scopeId);
+        const scope = await c.var.admin.getScopeRecord(actor, tenantId, scopeId);
         if (!scope) {
             throw new ControlPlaneError(404, `unknown scope for tenant: (${tenantId}, ${scopeId})`);
         }
@@ -1864,13 +1954,13 @@ export function createControlPlaneApi(options) {
         if (!scope.vertical) {
             throw new ControlPlaneError(409, 'scope has no vertical — nothing to rebind');
         }
-        const serving = await admin.verticalServing(actor, target);
+        const serving = await c.var.admin.verticalServing(actor, target);
         if (!serving) {
             throw new ControlPlaneError(409, `vertical '${target}' has no serving script yet — promote a version to prod first`);
         }
         if (scope.vertical === target && scope.servingRef === serving.ref) {
             // #1674: a rebind retried after its re-assert failed lands here; re-assert, as adopt does.
-            await admin.reassertSystemSwitches(actor, { tenantId, scopeId });
+            await c.var.admin.reassertSystemSwitches(actor, { tenantId, scopeId });
             return { servingRef: serving.ref, versionId: serving.versionId, alreadyBound: true };
         }
         // #1756: within one lineage this is an adopt, and judged as one before anything moves. A
@@ -1885,8 +1975,8 @@ export function createControlPlaneApi(options) {
             // protect — the target provisions its own schema from scratch. The source
             // script's copy is untouched and remains the backout, same as a carried rebind.
             // The scope serves nothing until `/verticals/:slug/instances` re-provisions it.
-            await admin.setScopeServingRef(actor, tenantId, scopeId, serving.ref, move).catch(relayHostRefusal);
-            await admin.bindScopeVersion(actor, tenantId, scopeId, serving.versionId, move).catch(relayHostRefusal);
+            await c.var.admin.setScopeServingRef(actor, tenantId, scopeId, serving.ref, move).catch(relayHostRefusal);
+            await c.var.admin.bindScopeVersion(actor, tenantId, scopeId, serving.versionId, move).catch(relayHostRefusal);
             return { servingRef: serving.ref, versionId: serving.versionId, dataAbandoned: true };
         }
         // The frontier gate. Digest equality proves the target's migration set is exactly
@@ -1894,9 +1984,9 @@ export function createControlPlaneApi(options) {
         // brought — the crossing is then no riskier than an ordinary version bind. Anything
         // else (differing digests, or a scope with no bound version to compare) needs the
         // operator's explicit acknowledgement.
-        const targetV = await admin.getVersion(actor, serving.versionId, target);
+        const targetV = await c.var.admin.getVersion(actor, serving.versionId, target);
         const currentV = scope.verticalVersionId
-            ? await admin.getVersion(actor, scope.verticalVersionId, scope.vertical)
+            ? await c.var.admin.getVersion(actor, scope.verticalVersionId, scope.vertical)
             : undefined;
         const digestsMatch = Boolean(currentV && targetV && currentV.migrationDigest === targetV.migrationDigest);
         if (!digestsMatch && !opts.ackMigrations) {
@@ -1914,10 +2004,10 @@ export function createControlPlaneApi(options) {
         // `bindScopeVersion` rewrites `scopes.vertical` from the version row, audited. No
         // extra snapshot here (adopt-serving's precedent): the source script's copy is the
         // pre-migration state, and it is never deleted — that copy is the backout.
-        await admin.setScopeServingRef(actor, tenantId, scopeId, serving.ref, move).catch(relayHostRefusal);
-        await admin.bindScopeVersion(actor, tenantId, scopeId, serving.versionId, move).catch(relayHostRefusal);
+        await c.var.admin.setScopeServingRef(actor, tenantId, scopeId, serving.ref, move).catch(relayHostRefusal);
+        await c.var.admin.bindScopeVersion(actor, tenantId, scopeId, serving.versionId, move).catch(relayHostRefusal);
         // #1674: re-assert the recorded OFF positions in the store the scope now routes to.
-        await admin.reassertSystemSwitches(actor, { tenantId, scopeId }, { appliedInUnit: restored.switchedOff });
+        await c.var.admin.reassertSystemSwitches(actor, { tenantId, scopeId }, { appliedInUnit: restored.switchedOff });
         return { servingRef: serving.ref, versionId: serving.versionId, tables: restored.tables };
     };
     /**
@@ -1960,7 +2050,7 @@ export function createControlPlaneApi(options) {
         if (!scope.vertical)
             return null;
         const actor = c.get('actor');
-        const incoming = await admin.getVersion(actor, versionId, scope.vertical);
+        const incoming = await c.var.admin.getVersion(actor, versionId, scope.vertical);
         // The bind refuses a version that is not admitted, except onto a preview. Check that
         // BEFORE the copy. Otherwise unreviewed code would receive the scope's data through its
         // own restore handler, only for the bind to refuse afterwards.
@@ -1974,7 +2064,7 @@ export function createControlPlaneApi(options) {
             return null;
         const to = incoming.deploymentRef ?? null;
         const bound = scope.verticalVersionId
-            ? await admin.getVersion(actor, scope.verticalVersionId, scope.vertical)
+            ? await c.var.admin.getVersion(actor, scope.verticalVersionId, scope.vertical)
             : undefined;
         const from = scope.servingRef ?? bound?.deploymentRef ?? null;
         if (!to || !from || from === to)
@@ -2005,12 +2095,12 @@ export function createControlPlaneApi(options) {
     app.get('/tenants/:tenantId/scopes/:scopeId/tables', async (c) => {
         const tenantId = tenantIdSchema.parse(c.req.param('tenantId'));
         const scopeId = scopeIdSchema.parse(c.req.param('scopeId'));
-        const scope = await admin.getScopeRecord(c.get('actor'), tenantId, scopeId);
+        const scope = await c.var.admin.getScopeRecord(c.get('actor'), tenantId, scopeId);
         if (!scope)
             return c.json({ error: `unknown scope for tenant: (${tenantId}, ${scopeId})` }, 404);
         return c.json(await delegatedRead(c, tenantId, scopeId, scope, 'listScopeTables', null, {
             viaVertical: (v) => v.listScopeTables(scopeId),
-            colocated: () => admin.listScopeTables(c.get('actor'), tenantId, scopeId),
+            colocated: () => c.var.admin.listScopeTables(c.get('actor'), tenantId, scopeId),
         }, (r) => r.length));
     });
     // Scope health (#321, criterion #3). The silent failure the field report chased was an
@@ -2039,21 +2129,21 @@ export function createControlPlaneApi(options) {
         if (outsideTenant(principal, tenantId)) {
             return c.json({ error: `unknown scope for tenant: (${tenantId}, ${scopeId})` }, 404);
         }
-        const scope = await admin.getScopeRecord(c.get('actor'), tenantId, scopeId);
+        const scope = await c.var.admin.getScopeRecord(c.get('actor'), tenantId, scopeId);
         if (!scope)
             return c.json({ error: `unknown scope for tenant: (${tenantId}, ${scopeId})` }, 404);
         // Health reads the scope the same way the Data view does, so it leaves the same
         // row: an auditor should not be able to tell which route reached the tables.
         const tables = await delegatedRead(c, tenantId, scopeId, scope, 'listScopeTables', null, {
             viaVertical: (v) => v.listScopeTables(scopeId),
-            colocated: () => admin.listScopeTables(c.get('actor'), tenantId, scopeId),
+            colocated: () => c.var.admin.listScopeTables(c.get('actor'), tenantId, scopeId),
         }, (r) => r.length);
         const roles = tables.find((t) => t.name === '_substrat_roles');
         const roleCount = roles ? roles.rowCount : null;
         const roleProjectionEmpty = scope.status === 'active' && roleCount === 0;
         const missingStores = scope.vertical
             ? await missingStoresForTenant({
-                host: options.host,
+                host: c.var.host,
                 actor: c.get('actor'),
                 slug: scope.vertical,
                 tenantId,
@@ -2096,7 +2186,7 @@ export function createControlPlaneApi(options) {
             status: c.req.query('status'),
             limit: c.req.query('limit') ? Number(c.req.query('limit')) : undefined,
         });
-        const scope = await admin.getScopeRecord(c.get('actor'), tenantId, scopeId);
+        const scope = await c.var.admin.getScopeRecord(c.get('actor'), tenantId, scopeId);
         if (!scope)
             return c.json({ error: `unknown scope for tenant: (${tenantId}, ${scopeId})` }, 404);
         // Same delegation ladder as the table reads: the intents live in the DO of the scope's BOUND
@@ -2104,7 +2194,7 @@ export function createControlPlaneApi(options) {
         const vertical = await verticalForScope(c, scope);
         return c.json(vertical
             ? await vertical.listPlatformRequestHistory(tenantId, scopeId, filter)
-            : await host.listPlatformRequestHistory(tenantId, scopeId, filter));
+            : await c.var.host.listPlatformRequestHistory(tenantId, scopeId, filter));
     });
     // #332: re-provision a scope stuck at "roles projected, zero tuples" — the enforcement flip
     // switched on against an empty tuple table, so every login denies and the owner is locked out
@@ -2117,7 +2207,7 @@ export function createControlPlaneApi(options) {
         const tenantId = tenantIdSchema.parse(c.req.param('tenantId'));
         const scopeId = scopeIdSchema.parse(c.req.param('scopeId'));
         const actor = c.get('actor');
-        const scope = await admin.getScopeRecord(actor, tenantId, scopeId);
+        const scope = await c.var.admin.getScopeRecord(actor, tenantId, scopeId);
         if (!scope)
             return c.json({ error: `unknown scope for tenant: (${tenantId}, ${scopeId})` }, 404);
         const p = c.get('principal');
@@ -2131,10 +2221,10 @@ export function createControlPlaneApi(options) {
         if (!reached)
             return c.json({ error: await diagnoseUnboundScope(c.get('actor'), scope) }, 501);
         const vertical = reached.client;
-        const entitlements = await admin.listEntitlements(actor, tenantId);
+        const entitlements = await c.var.admin.listEntitlements(actor, tenantId);
         // #406: re-gathered and re-delivered like entitlements, so a reconcile also repairs a
         // dropped identity-link delivery — and is the channel a link/unlink after provision rides.
-        const identityLinks = (await admin.listIdentityLinks(actor, tenantId)).map(({ tenantId: _tenantId, ...link }) => link);
+        const identityLinks = (await c.var.admin.listIdentityLinks(actor, tenantId)).map(({ tenantId: _tenantId, ...link }) => link);
         // #592: connection grants ride the same authoritative gather — the back-fill for a
         // scope provisioned before `grantToConnection` ran, and how a revoked connection's
         // grants stop being delivered (they are absent from the directory's live rows).
@@ -2148,18 +2238,18 @@ export function createControlPlaneApi(options) {
         // Best-effort: healing reaches the directory and must never take the reconcile down
         // with it. A failure here leaves exactly the behaviour that shipped before it existed.
         try {
-            await reconcileConnectionGrants({ admin, actor, declared: options.connectorGrants ?? {} }, tenantId, scope.vertical);
+            await reconcileConnectionGrants({ admin: c.var.admin, actor, declared: options.connectorGrants ?? {} }, tenantId, scope.vertical);
         }
         catch {
             // The next reconcile tries again; the read-back still shows what is missing.
         }
-        const connectionGrants = connectionGrantsForScope(await admin.listConnectionGrants(actor, tenantId), scope.vertical, scopeId);
+        const connectionGrants = connectionGrantsForScope(await c.var.admin.listConnectionGrants(actor, tenantId), scope.vertical, scopeId);
         // #687: connection sealing keys ride the same gather — the back-fill for a scope
         // provisioned before its connection existed, and the channel a connection made AFTER
         // provision rides. Minted on first ask, so this is also how a connection older than
         // the feature acquires a keypair without being reconnected.
         const connectionKeys = scope.vertical
-            ? await admin.connectionSealingKeys(tenantId, scope.vertical)
+            ? await c.var.admin.connectionSealingKeys(tenantId, scope.vertical)
             : [];
         // #825: the BACKFILL seam for per-tenant stores. Minting lived only in the
         // tenant-creation lifecycle, so a tenant created before its vertical declared a
@@ -2213,7 +2303,7 @@ export function createControlPlaneApi(options) {
         // need a second run to discover the other.
         const tenantStores = scope.vertical
             ? ((await mintBestEffort('tenant-stores', () => collectTenantStoreHandles({
-                host: options.host,
+                host: c.var.host,
                 actor,
                 slug: scope.vertical,
                 tenantId,
@@ -2222,7 +2312,7 @@ export function createControlPlaneApi(options) {
             : [];
         if (scope.vertical) {
             await mintBestEffort('blob-stores', () => collectBlobStoreHandles({
-                host: options.host,
+                host: c.var.host,
                 actor,
                 slug: scope.vertical,
                 tenantId,
@@ -2237,12 +2327,12 @@ export function createControlPlaneApi(options) {
         // one before. Best-effort: without it the receipt falls back to the bound version, the
         // pre-#1653 answer, which costs at most one more reconcile.
         const serving = reached.via === 'serving-script' && scope.vertical
-            ? await admin.verticalServing(actor, scope.vertical).catch(() => null)
+            ? await c.var.admin.verticalServing(actor, scope.vertical).catch(() => null)
             : null;
         const ranAs = versionReachedAt(reached.via, scope, serving);
         try {
             // #1674: the recorded OFF positions go back after the reconcile, before the receipt.
-            const result = await reconcileThenReassert(admin, actor, { tenantId, scopeId }, (carry) => vertical.reconcileInstance({
+            const result = await reconcileThenReassert(c.var.admin, actor, { tenantId, scopeId }, (carry) => vertical.reconcileInstance({
                 tenantId,
                 scopeId,
                 entitlements,
@@ -2261,7 +2351,7 @@ export function createControlPlaneApi(options) {
             // button means nothing to the thing that watches. Both name it with
             // `versionReachedAt`, from the deployment each actually reached.
             if (ranAs) {
-                await admin.markScopeProvisioned(actor, tenantId, scopeId, ranAs);
+                await c.var.admin.markScopeProvisioned(actor, tenantId, scopeId, ranAs);
             }
             // The reconcile succeeded; a store that did not mint rides back as a diagnosis
             // (`substrat scope provision` prints it, and `/health` keeps reporting the gap
@@ -2295,14 +2385,14 @@ export function createControlPlaneApi(options) {
             until: c.req.query('until') ?? undefined,
             limit: c.req.query('limit') ? Number(c.req.query('limit')) : undefined,
         });
-        const scope = await admin.getScopeRecord(c.get('actor'), tenantId, scopeId);
+        const scope = await c.var.admin.getScopeRecord(c.get('actor'), tenantId, scopeId);
         if (!scope)
             return c.json({ error: `unknown scope for tenant: (${tenantId}, ${scopeId})` }, 404);
         return c.json(await delegatedRead(c, tenantId, scopeId, scope, 'facetEvents', input, {
             // #1762: only the vertical's answer needs the guard. The co-located read runs
             // this platform's own kernel, which withholds by construction.
             viaVertical: async (v) => withholdIfPredatesRule(input, await v.facetEvents(scopeId, input)),
-            colocated: () => admin.facetEvents(c.get('actor'), tenantId, scopeId, input),
+            colocated: () => c.var.admin.facetEvents(c.get('actor'), tenantId, scopeId, input),
         }, 
         // The buckets RETURNED, not `total`: the row says how much this read handed
         // back, and a capped facet hands back fewer than it counted.
@@ -2343,7 +2433,7 @@ export function createControlPlaneApi(options) {
         if (!vertical)
             return run.colocated();
         const answer = await run.viaVertical(vertical);
-        await admin.recordDelegatedRead(c.get('actor'), {
+        await c.var.admin.recordDelegatedRead(c.get('actor'), {
             method,
             tenantId,
             scopeId,
@@ -2364,12 +2454,12 @@ export function createControlPlaneApi(options) {
             eventId: c.req.query('eventId'),
             maxDepth: c.req.query('maxDepth') ? Number(c.req.query('maxDepth')) : undefined,
         });
-        const scope = await admin.getScopeRecord(c.get('actor'), tenantId, scopeId);
+        const scope = await c.var.admin.getScopeRecord(c.get('actor'), tenantId, scopeId);
         if (!scope)
             return c.json({ error: `unknown scope for tenant: (${tenantId}, ${scopeId})` }, 404);
         return c.json(await delegatedRead(c, tenantId, scopeId, scope, 'eventCause', input, {
             viaVertical: (v) => v.eventCause(scopeId, input),
-            colocated: () => admin.eventCause(c.get('actor'), tenantId, scopeId, input),
+            colocated: () => c.var.admin.eventCause(c.get('actor'), tenantId, scopeId, input),
         }, (r) => r.chain.length));
     });
     // #1237 forward: what one event set off. Delegated like its backwards twin.
@@ -2380,12 +2470,12 @@ export function createControlPlaneApi(options) {
             eventId: c.req.query('eventId'),
             maxNodes: c.req.query('maxNodes') ? Number(c.req.query('maxNodes')) : undefined,
         });
-        const scope = await admin.getScopeRecord(c.get('actor'), tenantId, scopeId);
+        const scope = await c.var.admin.getScopeRecord(c.get('actor'), tenantId, scopeId);
         if (!scope)
             return c.json({ error: `unknown scope for tenant: (${tenantId}, ${scopeId})` }, 404);
         return c.json(await delegatedRead(c, tenantId, scopeId, scope, 'eventEffects', input, {
             viaVertical: (v) => v.eventEffects(scopeId, input),
-            colocated: () => admin.eventEffects(c.get('actor'), tenantId, scopeId, input),
+            colocated: () => c.var.admin.eventEffects(c.get('actor'), tenantId, scopeId, input),
         }, (r) => r.count));
     });
     // #1237: everything one call emitted — the siblings neither walk reaches. Delegated
@@ -2397,12 +2487,12 @@ export function createControlPlaneApi(options) {
             invocationId: c.req.query('invocationId'),
             limit: c.req.query('limit') ? Number(c.req.query('limit')) : undefined,
         });
-        const scope = await admin.getScopeRecord(c.get('actor'), tenantId, scopeId);
+        const scope = await c.var.admin.getScopeRecord(c.get('actor'), tenantId, scopeId);
         if (!scope)
             return c.json({ error: `unknown scope for tenant: (${tenantId}, ${scopeId})` }, 404);
         return c.json(await delegatedRead(c, tenantId, scopeId, scope, 'invocationEvents', input, {
             viaVertical: (v) => v.invocationEvents(scopeId, input),
-            colocated: () => admin.invocationEvents(c.get('actor'), tenantId, scopeId, input),
+            colocated: () => c.var.admin.invocationEvents(c.get('actor'), tenantId, scopeId, input),
         }, (r) => r.events.length));
     });
     // #1525: every delivery in the scope that gave up — the list the walks can only reach
@@ -2414,12 +2504,12 @@ export function createControlPlaneApi(options) {
             limit: c.req.query('limit') ? Number(c.req.query('limit')) : undefined,
             cursor: c.req.query('cursor') ?? undefined,
         });
-        const scope = await admin.getScopeRecord(c.get('actor'), tenantId, scopeId);
+        const scope = await c.var.admin.getScopeRecord(c.get('actor'), tenantId, scopeId);
         if (!scope)
             return c.json({ error: `unknown scope for tenant: (${tenantId}, ${scopeId})` }, 404);
         return c.json(await delegatedRead(c, tenantId, scopeId, scope, 'deadLetters', input, {
             viaVertical: (v) => v.deadLetters(scopeId, input),
-            colocated: () => admin.deadLetters(c.get('actor'), tenantId, scopeId, input),
+            colocated: () => c.var.admin.deadLetters(c.get('actor'), tenantId, scopeId, input),
         }, (r) => r.entries.length));
     });
     // #1744: one entity's declared lifecycle replayed over the scope's outbox — the process
@@ -2429,12 +2519,12 @@ export function createControlPlaneApi(options) {
         const tenantId = tenantIdSchema.parse(c.req.param('tenantId'));
         const scopeId = scopeIdSchema.parse(c.req.param('scopeId'));
         const input = lifecycleFlowInput.parse(await c.req.json());
-        const scope = await admin.getScopeRecord(c.get('actor'), tenantId, scopeId);
+        const scope = await c.var.admin.getScopeRecord(c.get('actor'), tenantId, scopeId);
         if (!scope)
             return c.json({ error: `unknown scope for tenant: (${tenantId}, ${scopeId})` }, 404);
         return c.json(await delegatedRead(c, tenantId, scopeId, scope, 'lifecycleFlow', input, {
             viaVertical: (v) => v.lifecycleFlow(scopeId, input),
-            colocated: () => admin.lifecycleFlow(c.get('actor'), tenantId, scopeId, input),
+            colocated: () => c.var.admin.lifecycleFlow(c.get('actor'), tenantId, scopeId, input),
         }, (r) => r.observation.events));
     });
     // #1235: one record's event history — the per-entity pivot of the audit spine.
@@ -2449,12 +2539,12 @@ export function createControlPlaneApi(options) {
             limit: c.req.query('limit') ? Number(c.req.query('limit')) : undefined,
             cursor: c.req.query('cursor') ?? undefined,
         });
-        const scope = await admin.getScopeRecord(c.get('actor'), tenantId, scopeId);
+        const scope = await c.var.admin.getScopeRecord(c.get('actor'), tenantId, scopeId);
         if (!scope)
             return c.json({ error: `unknown scope for tenant: (${tenantId}, ${scopeId})` }, 404);
         return c.json(await delegatedRead(c, tenantId, scopeId, scope, 'entityHistory', input, {
             viaVertical: (v) => v.entityHistory(scopeId, input),
-            colocated: () => admin.entityHistory(c.get('actor'), tenantId, scopeId, input),
+            colocated: () => c.var.admin.entityHistory(c.get('actor'), tenantId, scopeId, input),
         }, (r) => r.entries.length));
     });
     app.get('/tenants/:tenantId/scopes/:scopeId/tables/:table', async (c) => {
@@ -2465,12 +2555,12 @@ export function createControlPlaneApi(options) {
             limit: c.req.query('limit') ? Number(c.req.query('limit')) : undefined,
             offset: c.req.query('offset') ? Number(c.req.query('offset')) : undefined,
         });
-        const scope = await admin.getScopeRecord(c.get('actor'), tenantId, scopeId);
+        const scope = await c.var.admin.getScopeRecord(c.get('actor'), tenantId, scopeId);
         if (!scope)
             return c.json({ error: `unknown scope for tenant: (${tenantId}, ${scopeId})` }, 404);
         return c.json(await delegatedRead(c, tenantId, scopeId, scope, 'readScopeTable', input, {
             viaVertical: (v) => v.readScopeTable(scopeId, input),
-            colocated: () => admin.readScopeTable(c.get('actor'), tenantId, scopeId, input),
+            colocated: () => c.var.admin.readScopeTable(c.get('actor'), tenantId, scopeId, input),
         }, (r) => r.rows.length));
     });
     // The SQL console (#219): one read-only statement, POSTed because SQL does not
@@ -2482,7 +2572,7 @@ export function createControlPlaneApi(options) {
         const tenantId = tenantIdSchema.parse(c.req.param('tenantId'));
         const scopeId = scopeIdSchema.parse(c.req.param('scopeId'));
         const input = queryScopeInput.parse(await c.req.json());
-        const scope = await admin.getScopeRecord(c.get('actor'), tenantId, scopeId);
+        const scope = await c.var.admin.getScopeRecord(c.get('actor'), tenantId, scopeId);
         if (!scope)
             return c.json({ error: `unknown scope for tenant: (${tenantId}, ${scopeId})` }, 404);
         return c.json(await delegatedRead(
@@ -2491,7 +2581,7 @@ export function createControlPlaneApi(options) {
         // statement would answer "someone queried" and nothing a reader needs.
         c, tenantId, scopeId, scope, 'queryScope', input, {
             viaVertical: (v) => v.queryScope(scopeId, input),
-            colocated: () => admin.queryScope(c.get('actor'), tenantId, scopeId, input),
+            colocated: () => c.var.admin.queryScope(c.get('actor'), tenantId, scopeId, input),
         }, (r) => r.rows.length));
     });
     // The K-35 denial log (#867) — the third of the platform's three logs and the last to
@@ -2513,12 +2603,12 @@ export function createControlPlaneApi(options) {
             return c.json({ error: `unknown scope for tenant: (${tenantId}, ${scopeId})` }, 404);
         }
         const filter = denialLogQuery.parse(c.req.query());
-        const scope = await admin.getScopeRecord(c.get('actor'), tenantId, scopeId);
+        const scope = await c.var.admin.getScopeRecord(c.get('actor'), tenantId, scopeId);
         if (!scope)
             return c.json({ error: `unknown scope for tenant: (${tenantId}, ${scopeId})` }, 404);
         return c.json(await delegatedRead(c, tenantId, scopeId, scope, 'listDenials', filter, {
             viaVertical: (v) => v.listDenials(scopeId, filter),
-            colocated: () => admin.listDenials(c.get('actor'), tenantId, scopeId, filter),
+            colocated: () => c.var.admin.listDenials(c.get('actor'), tenantId, scopeId, filter),
         }, (r) => r.length));
     });
     app.get('/tenants/:tenantId/scopes/:scopeId/denials/summary', async (c) => {
@@ -2529,12 +2619,12 @@ export function createControlPlaneApi(options) {
             return c.json({ error: `unknown scope for tenant: (${tenantId}, ${scopeId})` }, 404);
         }
         const filter = denialLogQuery.parse(c.req.query());
-        const scope = await admin.getScopeRecord(c.get('actor'), tenantId, scopeId);
+        const scope = await c.var.admin.getScopeRecord(c.get('actor'), tenantId, scopeId);
         if (!scope)
             return c.json({ error: `unknown scope for tenant: (${tenantId}, ${scopeId})` }, 404);
         return c.json(await delegatedRead(c, tenantId, scopeId, scope, 'summarizeDenials', filter, {
             viaVertical: (v) => v.summarizeDenials(scopeId, filter),
-            colocated: () => admin.summarizeDenials(c.get('actor'), tenantId, scopeId, filter),
+            colocated: () => c.var.admin.summarizeDenials(c.get('actor'), tenantId, scopeId, filter),
         }, (r) => r.buckets.length));
     });
     // The owner seat (#925). Both reads go to the VERTICAL — the seat lives in its identity
@@ -2551,7 +2641,7 @@ export function createControlPlaneApi(options) {
         if (outsideTenant(principal, tenantId)) {
             return c.json({ error: `unknown scope for tenant: (${tenantId}, ${scopeId})` }, 404);
         }
-        const scope = await admin.getScopeRecord(c.get('actor'), tenantId, scopeId);
+        const scope = await c.var.admin.getScopeRecord(c.get('actor'), tenantId, scopeId);
         if (!scope)
             return c.json({ error: `unknown scope for tenant: (${tenantId}, ${scopeId})` }, 404);
         const vertical = await verticalForScope(c, scope);
@@ -2574,7 +2664,7 @@ export function createControlPlaneApi(options) {
             return c.json({ error: `unknown scope for tenant: (${tenantId}, ${scopeId})` }, 404);
         }
         const actor = c.get('actor');
-        const scope = await admin.getScopeRecord(actor, tenantId, scopeId);
+        const scope = await c.var.admin.getScopeRecord(actor, tenantId, scopeId);
         if (!scope)
             return c.json({ error: `unknown scope for tenant: (${tenantId}, ${scopeId})` }, 404);
         const vertical = await verticalForScope(c, scope);
@@ -2584,7 +2674,7 @@ export function createControlPlaneApi(options) {
         // the platform has activated but not requiring it — a platform hostname is bound
         // `pending` and activated a step later, and that step can fail while the app is fully
         // reachable (#294). `failed` is the one state that never routes, so only it is skipped.
-        const bound = (await admin.listHostnames(actor, { scopeId })).filter((h) => h.status !== 'failed');
+        const bound = (await c.var.admin.listHostnames(actor, { scopeId })).filter((h) => h.status !== 'failed');
         const pick = (hs) => hs.find((h) => h.surface === 'app' && h.canonical) ?? hs.find((h) => h.surface === 'app') ?? hs[0];
         const host = pick(bound.filter((h) => h.status === 'active')) ?? pick(bound);
         if (!host) {
@@ -2618,7 +2708,7 @@ export function createControlPlaneApi(options) {
         const body = ownerTransferInput.parse(await c.req.json());
         const actor = c.get('actor');
         // K-3 first, so a scope of another tenant reads as absent before anything is reached.
-        const scope = await admin.getScopeRecord(actor, tenantId, scopeId);
+        const scope = await c.var.admin.getScopeRecord(actor, tenantId, scopeId);
         if (!scope)
             return c.json({ error: `unknown scope for tenant: (${tenantId}, ${scopeId})` }, 404);
         const vertical = await verticalForScope(c, scope);
@@ -2628,7 +2718,7 @@ export function createControlPlaneApi(options) {
         // An abandon (`abandon: true`) is audited the same way, every row marked, so the log tells
         // a hand-over closed without finishing from one that finished.
         const base = { tenantId, scopeId, operationId, from: body.from, to: body.to, ...(body.abandon ? { abandon: true } : {}) };
-        await admin.recordOwnerTransfer(actor, { ...base, phase: 'intent' });
+        await c.var.admin.recordOwnerTransfer(actor, { ...base, phase: 'intent' });
         let moved;
         try {
             moved = await vertical.transferOwner({ tenantId, scopeId, ...body });
@@ -2636,7 +2726,7 @@ export function createControlPlaneApi(options) {
         catch (e) {
             const refused = e instanceof ControlPlaneError && e.status === 409;
             const error = (e instanceof Error ? e.message : String(e)).slice(0, OWNER_TRANSFER_AUDIT_ERROR_MAX);
-            await admin
+            await c.var.admin
                 .recordOwnerTransfer(actor, { ...base, phase: refused ? 'refused' : 'failed', error })
                 .catch(() => undefined);
             if (e instanceof ControlPlaneError) {
@@ -2645,7 +2735,7 @@ export function createControlPlaneApi(options) {
             throw e;
         }
         try {
-            await admin.recordOwnerTransfer(actor, {
+            await c.var.admin.recordOwnerTransfer(actor, {
                 ...base,
                 phase: 'applied',
                 outcome: moved.outcome,
@@ -2676,7 +2766,7 @@ export function createControlPlaneApi(options) {
         const tenantId = tenantIdSchema.parse(c.req.param('tenantId'));
         const scopeId = scopeIdSchema.parse(c.req.param('scopeId'));
         const input = configureInstanceBody.parse(await c.req.json());
-        const scope = await admin.getScopeRecord(c.get('actor'), tenantId, scopeId);
+        const scope = await c.var.admin.getScopeRecord(c.get('actor'), tenantId, scopeId);
         if (!scope)
             return c.json({ error: `unknown scope for tenant: (${tenantId}, ${scopeId})` }, 404);
         const vertical = await verticalForScope(c, scope);
@@ -2699,18 +2789,18 @@ export function createControlPlaneApi(options) {
     // status the transition graph forbids. The graph is enforced below the seam;
     // an illegal transition surfaces as a 409.
     const transitions = {
-        activate: (a, t, s) => admin.activateScope(a, t, s),
-        suspend: (a, t, s) => admin.suspendScope(a, t, s),
-        unsuspend: (a, t, s) => admin.unsuspendScope(a, t, s),
-        archive: (a, t, s) => admin.archiveScope(a, t, s),
-        unarchive: (a, t, s) => admin.unarchiveScope(a, t, s),
+        activate: (admin, a, t, s) => admin.activateScope(a, t, s),
+        suspend: (admin, a, t, s) => admin.suspendScope(a, t, s),
+        unsuspend: (admin, a, t, s) => admin.unsuspendScope(a, t, s),
+        archive: (admin, a, t, s) => admin.archiveScope(a, t, s),
+        unarchive: (admin, a, t, s) => admin.unarchiveScope(a, t, s),
     };
     for (const [action, run] of Object.entries(transitions)) {
         app.post(`/tenants/:tenantId/scopes/:scopeId/${action}`, async (c) => {
             const tenantId = tenantIdSchema.parse(c.req.param('tenantId'));
             const scopeId = scopeIdSchema.parse(c.req.param('scopeId'));
-            await run(c.get('actor'), tenantId, scopeId);
-            return c.json(await admin.getScopeRecord(c.get('actor'), tenantId, scopeId));
+            await run(c.var.admin, c.get('actor'), tenantId, scopeId);
+            return c.json(await c.var.admin.getScopeRecord(c.get('actor'), tenantId, scopeId));
         });
     }
     // -- snapshots (preview-and-snapshots.md §3/§9) -----------------------------
@@ -2723,13 +2813,13 @@ export function createControlPlaneApi(options) {
         const actor = c.get('actor');
         const vertical = await verticalForScope(c, scope);
         if (!vertical)
-            return options.host.snapshotScope(actor, tenantId, scope.id, opts);
+            return c.var.host.snapshotScope(actor, tenantId, scope.id, opts);
         const snapId = scopeIdSchema.parse(ulid());
         // Directory row FIRST, as `provisioning` (K-31's two-phase shape, used as
         // intended): a crash between the row and the data copy leaves an inert
         // provisioning row — which, carrying provenance and an expiry, the GC sweep
         // eventually reaps — never copied data with no record.
-        await options.host.provisionScope(actor, {
+        await c.var.host.provisionScope(actor, {
             tenantId,
             scopeId: snapId,
             kind: opts.kind ?? 'archive',
@@ -2740,11 +2830,11 @@ export function createControlPlaneApi(options) {
             expiresAt: opts.expiresAt,
         });
         await retryTransient(() => vertical.snapshotScope({ sourceScopeId: scope.id, newScopeId: snapId }));
-        await admin.activateScope(actor, tenantId, snapId);
+        await c.var.admin.activateScope(actor, tenantId, snapId);
         // Bound to the SOURCE's current version: source and fork share a deployment, so
         // the fork resolves to the DO namespace its bytes actually live in.
         if (scope.verticalVersionId) {
-            await admin.bindScopeVersion(actor, tenantId, snapId, scope.verticalVersionId);
+            await c.var.admin.bindScopeVersion(actor, tenantId, snapId, scope.verticalVersionId);
         }
         return snapId;
     };
@@ -2753,7 +2843,7 @@ export function createControlPlaneApi(options) {
     app.get('/tenants/:tenantId/scopes/:scopeId/snapshots', async (c) => {
         const tenantId = tenantIdSchema.parse(c.req.param('tenantId'));
         const scopeId = scopeIdSchema.parse(c.req.param('scopeId'));
-        const scopes = await admin.listScopes(c.get('actor'), { tenantId });
+        const scopes = await c.var.admin.listScopes(c.get('actor'), { tenantId });
         return c.json(scopes
             .filter((s) => s.forkedFrom === scopeId)
             .sort((a, b) => (a.forkedAt < b.forkedAt ? 1 : -1)));
@@ -2762,12 +2852,12 @@ export function createControlPlaneApi(options) {
         const tenantId = tenantIdSchema.parse(c.req.param('tenantId'));
         const scopeId = scopeIdSchema.parse(c.req.param('scopeId'));
         const body = snapshotScopeBody.parse(await c.req.json().catch(() => ({})));
-        const scope = await admin.getScopeRecord(c.get('actor'), tenantId, scopeId);
+        const scope = await c.var.admin.getScopeRecord(c.get('actor'), tenantId, scopeId);
         if (!scope)
             return c.json({ error: `unknown scope for tenant: (${tenantId}, ${scopeId})` }, 404);
         try {
             const snapId = await orchestratedSnapshot(c, tenantId, scope, body);
-            return c.json(await admin.getScopeRecord(c.get('actor'), tenantId, snapId), 201);
+            return c.json(await c.var.admin.getScopeRecord(c.get('actor'), tenantId, snapId), 201);
         }
         catch (e) {
             if (e instanceof ControlPlaneError) {
@@ -2808,7 +2898,7 @@ export function createControlPlaneApi(options) {
         const tenantId = tenantIdSchema.parse(c.req.param('tenantId'));
         const scopeId = scopeIdSchema.parse(c.req.param('scopeId'));
         const actor = c.get('actor');
-        const scope = await admin.getScopeRecord(actor, tenantId, scopeId);
+        const scope = await c.var.admin.getScopeRecord(actor, tenantId, scopeId);
         if (!scope)
             return c.json({ error: `unknown scope for tenant: (${tenantId}, ${scopeId})` }, 404);
         if (!scope.forkedFrom) {
@@ -2821,7 +2911,7 @@ export function createControlPlaneApi(options) {
             // between the two converges on retry.
             const vertical = await verticalForScope(c, scope);
             const storageStranded = await deleteScopeStorageOrStrand(vertical, scopeId);
-            await options.host.deleteSnapshot(actor, tenantId, scopeId);
+            await c.var.host.deleteSnapshot(actor, tenantId, scopeId);
             return c.json({ deleted: scopeId, ...(storageStranded ? { storageStranded: true } : {}) });
         }
         catch (e) {
@@ -2852,7 +2942,7 @@ export function createControlPlaneApi(options) {
                 `store is global, so a backup would move its data out of that jurisdiction ` +
                 `(K-32); refused until a per-jurisdiction store exists`);
         }
-        const dump = await admin.exportScope(c.get('actor'), tenantId, scope.id);
+        const dump = await c.var.admin.exportScope(c.get('actor'), tenantId, scope.id);
         const vertical = await verticalForScope(c, scope);
         const tables = vertical ? await vertical.exportScope(scope.id) : dump.tables;
         // Seal classified payloads per subject on the way in (#37). This copy is full-fidelity
@@ -2875,7 +2965,7 @@ export function createControlPlaneApi(options) {
             return c.json({ error: 'no backup target configured' }, 501);
         // Reads the directory, not the store, for the tenant cross-check: the store is keyed
         // by (tenant, scope) but nothing there proves the caller's tenant owns the scope.
-        const scope = await admin.getScopeRecord(c.get('actor'), tenantId, scopeId);
+        const scope = await c.var.admin.getScopeRecord(c.get('actor'), tenantId, scopeId);
         if (!scope)
             return c.json({ error: `unknown scope for tenant: (${tenantId}, ${scopeId})` }, 404);
         return c.json(await options.scopeBackups.list({ tenantId, scopeId }));
@@ -2889,7 +2979,7 @@ export function createControlPlaneApi(options) {
         const capturedAt = c.req.param('capturedAt');
         if (!options.scopeBackups)
             return c.json({ error: 'no backup target configured' }, 501);
-        const scope = await admin.getScopeRecord(c.get('actor'), tenantId, scopeId);
+        const scope = await c.var.admin.getScopeRecord(c.get('actor'), tenantId, scopeId);
         if (!scope)
             return c.json({ error: `unknown scope for tenant: (${tenantId}, ${scopeId})` }, 404);
         const dump = await options.scopeBackups.get({ tenantId, scopeId, capturedAt });
@@ -2909,7 +2999,7 @@ export function createControlPlaneApi(options) {
     app.post('/tenants/:tenantId/scopes/:scopeId/backups', async (c) => {
         const tenantId = tenantIdSchema.parse(c.req.param('tenantId'));
         const scopeId = scopeIdSchema.parse(c.req.param('scopeId'));
-        const scope = await admin.getScopeRecord(c.get('actor'), tenantId, scopeId);
+        const scope = await c.var.admin.getScopeRecord(c.get('actor'), tenantId, scopeId);
         if (!scope)
             return c.json({ error: `unknown scope for tenant: (${tenantId}, ${scopeId})` }, 404);
         try {
@@ -2943,10 +3033,10 @@ export function createControlPlaneApi(options) {
         // A ULID, like every other subject id the spine carries — parsed rather than trusted,
         // so a wildcard or an injection attempt is a 400 and never reaches the UPDATE.
         const subjectId = dataSubjectIdSchema.parse(c.req.param('subjectId'));
-        const scope = await admin.getScopeRecord(c.get('actor'), tenantId, scopeId);
+        const scope = await c.var.admin.getScopeRecord(c.get('actor'), tenantId, scopeId);
         if (!scope)
             return c.json({ error: `unknown scope for tenant: (${tenantId}, ${scopeId})` }, 404);
-        return c.json(await admin.shredSubject(c.get('actor'), tenantId, scopeId, subjectId));
+        return c.json(await c.var.admin.shredSubject(c.get('actor'), tenantId, scopeId, subjectId));
     });
     // -- directory backups (#40) -----------------------------------------------
     // The platform's own disaster recovery, on the same store posture as the scope
@@ -2971,7 +3061,7 @@ export function createControlPlaneApi(options) {
         if (!options.directoryBackups)
             return c.json({ error: 'no directory backup target configured' }, 501);
         const result = await backupDirectoryIfDue({
-            admin,
+            admin: c.var.admin,
             store: options.directoryBackups,
             actor: c.get('actor'),
             force: true,
@@ -3008,14 +3098,14 @@ export function createControlPlaneApi(options) {
         if (!dump)
             return c.json({ error: `no directory backup at ${body.capturedAt}` }, 404);
         const actor = c.get('actor');
-        const live = await admin.listTenants(actor, { limit: 1 });
+        const live = await c.var.admin.listTenants(actor, { limit: 1 });
         if (live.length > 0 && !body.overwrite) {
             return c.json({
                 error: 'the directory is not empty — a restore REPLACES it, so anything created ' +
                     'since this copy was taken would be lost; pass overwrite=true to confirm',
             }, 409);
         }
-        await admin.restoreDirectory(actor, dump);
+        await c.var.admin.restoreDirectory(actor, dump);
         return c.json({ capturedAt: dump.capturedAt, tables: dump.tables.length });
     });
     // Reap an ARCHIVED primary scope (control-plane.md §4.4): free its DO storage —
@@ -3059,12 +3149,12 @@ export function createControlPlaneApi(options) {
         if (parsed.data.countOnly !== undefined) {
             return c.json({ error: 'countOnly is not honoured here — POST the same body to …/redrain-count for a read-only count' }, 400);
         }
-        const scope = await admin.getScopeRecord(actor, tenantId, scopeId);
+        const scope = await c.var.admin.getScopeRecord(actor, tenantId, scopeId);
         if (!scope)
             return c.json({ error: `unknown scope for tenant: (${tenantId}, ${scopeId})` }, 404);
         // The instant alone, never `parsed.data`, so the field cannot reach the adapter from
         // this door even if the refusal above is ever relaxed.
-        const redrained = await admin.redrainEvents(actor, tenantId, scopeId, {
+        const redrained = await c.var.admin.redrainEvents(actor, tenantId, scopeId, {
             drainedBefore: parsed.data.drainedBefore,
         });
         // `more` rather than silence: the verb reopens a bounded batch, so a caller that posts
@@ -3103,10 +3193,10 @@ export function createControlPlaneApi(options) {
                     'already shipped to the rebuilt table. Pass the instant the old table stopped receiving.',
             }, 400);
         }
-        const scope = await admin.getScopeRecord(actor, tenantId, scopeId);
+        const scope = await c.var.admin.getScopeRecord(actor, tenantId, scopeId);
         if (!scope)
             return c.json({ error: `unknown scope for tenant: (${tenantId}, ${scopeId})` }, 404);
-        const redrainable = await admin.redrainEvents(actor, tenantId, scopeId, {
+        const redrainable = await c.var.admin.redrainEvents(actor, tenantId, scopeId, {
             drainedBefore: parsed.data.drainedBefore,
             countOnly: true,
         });
@@ -3119,7 +3209,7 @@ export function createControlPlaneApi(options) {
         // Body is optional so the bare `POST …/reap` every existing caller sends still
         // parses; `backup` tri-states on purpose (see the ordering comment below).
         const { backup: wantsBackup } = reapScopeBody.parse(await c.req.json().catch(() => ({})));
-        const scope = await admin.getScopeRecord(actor, tenantId, scopeId);
+        const scope = await c.var.admin.getScopeRecord(actor, tenantId, scopeId);
         if (!scope)
             return c.json({ error: `unknown scope for tenant: (${tenantId}, ${scopeId})` }, 404);
         if (scope.status !== 'archived') {
@@ -3130,7 +3220,7 @@ export function createControlPlaneApi(options) {
         // only in `reapScope` after. A serving app always holds a bound name; unbind it first.
         // (This route is the interactive per-scope reap; the tenant-teardown route forces past
         // the same guard because releasing every name is the point there.)
-        const boundNames = await admin.listHostnames(actor, { scopeId, limit: 1 });
+        const boundNames = await c.var.admin.listHostnames(actor, { scopeId, limit: 1 });
         if (boundNames.length > 0) {
             return c.json({
                 error: `scope ${scopeId} still resolves hostname '${boundNames[0].hostname}' — ` +
@@ -3168,10 +3258,10 @@ export function createControlPlaneApi(options) {
             // By this point the backup contract has resolved (a copy landed, or the caller
             // explicitly declined one), so stranding is a bookkeeping fact, not data loss.
             const storageStranded = await deleteScopeStorageOrStrand(vertical, scopeId);
-            await admin.reapScope(actor, tenantId, scopeId, {
+            await c.var.admin.reapScope(actor, tenantId, scopeId, {
                 ...(backup ? { backupRef: backupRefOf(backup) } : {}),
             });
-            const reaped = await admin.getScopeRecord(actor, tenantId, scopeId);
+            const reaped = await c.var.admin.getScopeRecord(actor, tenantId, scopeId);
             return c.json({ ...reaped, backup, ...(storageStranded ? { storageStranded: true } : {}) });
         }
         catch (e) {
@@ -3191,7 +3281,7 @@ export function createControlPlaneApi(options) {
         const tenantId = tenantIdSchema.parse(c.req.param('tenantId'));
         const scopeId = scopeIdSchema.parse(c.req.param('scopeId'));
         const actor = c.get('actor');
-        const scope = await admin.getScopeRecord(actor, tenantId, scopeId);
+        const scope = await c.var.admin.getScopeRecord(actor, tenantId, scopeId);
         if (!scope)
             return c.json({ error: `unknown scope for tenant: (${tenantId}, ${scopeId})` }, 404);
         // Residency (K-7/K-32): jurisdiction pins EXECUTION, not just storage. A pull
@@ -3209,7 +3299,7 @@ export function createControlPlaneApi(options) {
             // bytes when the host is co-located. When the scope's data lives in a vertical
             // deployment, its dump OVERLAYS the (placeholder) tables — audit stays on the
             // one canonical path either way.
-            const dump = await admin.exportScope(actor, tenantId, scopeId);
+            const dump = await c.var.admin.exportScope(actor, tenantId, scopeId);
             const vertical = await verticalForScope(c, scope);
             const tables = vertical ? await vertical.exportScope(scopeId) : dump.tables;
             if (full)
@@ -3248,13 +3338,13 @@ export function createControlPlaneApi(options) {
     app.get('/tenants/:tenantId/export', async (c) => {
         const tenantId = tenantIdSchema.parse(c.req.param('tenantId'));
         const actor = c.get('actor');
-        const tenant = await admin.getTenant(actor, tenantId);
+        const tenant = await c.var.admin.getTenant(actor, tenantId);
         if (!tenant)
             return c.json({ error: `unknown tenant: ${tenantId}` }, 404);
         // Every scope, tombstones included: an archived or reaped scope is part of the
         // tenant's history, and an export that quietly dropped them would misrepresent what
         // the tenant was. Their DATA is a different question, handled below.
-        const scopes = await admin.listScopes(actor, { tenantId });
+        const scopes = await c.var.admin.listScopes(actor, { tenantId });
         // Residency (K-7/K-32), checked across the WHOLE tenant before anything is read: an
         // export lands on a machine outside the platform's control, so one pinned scope
         // taints the file. Refused as a unit rather than silently exporting the global
@@ -3271,18 +3361,18 @@ export function createControlPlaneApi(options) {
         }
         const full = c.req.query('full') === 'true';
         try {
-            const orgs = await admin.listOrgs(actor, tenantId);
+            const orgs = await c.var.admin.listOrgs(actor, tenantId);
             // Revoked memberships included: K-21 makes a removal a tombstone precisely because
             // "was a member until March" is the fact an audit asks for.
-            const members = (await Promise.all(orgs.map((o) => admin.listMembers(actor, tenantId, o.id, { includeRevoked: true })))).flat();
+            const members = (await Promise.all(orgs.map((o) => c.var.admin.listMembers(actor, tenantId, o.id, { includeRevoked: true })))).flat();
             const [roles, entitlements, identityLinks, hostnames, stores, blobStores, connections] = await Promise.all([
-                admin.listRoles(actor, { tenantId }),
-                admin.listEntitlements(actor, tenantId),
-                admin.listIdentityLinks(actor, tenantId),
-                admin.listHostnames(actor, { tenantId }),
-                admin.listTenantStores(actor, { tenantId }),
-                admin.listBlobStores(actor, { tenantId }),
-                admin.listConnections(actor, { tenantId }),
+                c.var.admin.listRoles(actor, { tenantId }),
+                c.var.admin.listEntitlements(actor, tenantId),
+                c.var.admin.listIdentityLinks(actor, tenantId),
+                c.var.admin.listHostnames(actor, { tenantId }),
+                c.var.admin.listTenantStores(actor, { tenantId }),
+                c.var.admin.listBlobStores(actor, { tenantId }),
+                c.var.admin.listConnections(actor, { tenantId }),
             ]);
             // Scope DATA, from the same delegation the per-scope export route uses: the
             // canonical `exportScope` writes the audit entry and is the bytes when co-located;
@@ -3296,7 +3386,7 @@ export function createControlPlaneApi(options) {
             const live = scopes.filter((s) => s.status !== 'reaped');
             const data = [];
             for (const scope of live) {
-                const dump = await admin.exportScope(actor, tenantId, scope.id);
+                const dump = await c.var.admin.exportScope(actor, tenantId, scope.id);
                 const vertical = await verticalForScope(c, scope);
                 const tables = vertical ? await vertical.exportScope(scope.id) : dump.tables;
                 data.push({ ...dump, tables: mask ? await maskDump(tables, mask) : tables });
@@ -3305,7 +3395,7 @@ export function createControlPlaneApi(options) {
             // customer's Art. 20 data, and it carries staff actor ids and internal action
             // names. An escrow or a dispute needs it, which is why break-glass reaches it
             // rather than nothing reaching it.
-            const adminLog = full ? await admin.auditLog(actor, { tenantId }) : null;
+            const adminLog = full ? await c.var.admin.auditLog(actor, { tenantId }) : null;
             const body = {
                 tenantId,
                 capturedAt: new Date().toISOString(),
@@ -3358,7 +3448,7 @@ export function createControlPlaneApi(options) {
         const tenantId = tenantIdSchema.parse(c.req.param('tenantId'));
         const scopeId = scopeIdSchema.parse(c.req.param('scopeId'));
         const actor = c.get('actor');
-        const scope = await admin.getScopeRecord(actor, tenantId, scopeId);
+        const scope = await c.var.admin.getScopeRecord(actor, tenantId, scopeId);
         if (!scope)
             return c.json({ error: `unknown scope for tenant: (${tenantId}, ${scopeId})` }, 404);
         const raw = await c.req.json();
@@ -3386,7 +3476,7 @@ export function createControlPlaneApi(options) {
             const origin = { tenantId: tenantIdSchema.parse(dump.tenantId), scopeId: scopeIdSchema.parse(dump.scopeId) };
             const tables = await openDump(dump.tables, sealerFor(c, origin.tenantId, origin.scopeId));
             const landing = { ...dump, tables };
-            await host.restoreScope(actor, tenantId, scopeId, landing, sourceHint ? { sourceScopeId: sourceHint } : undefined);
+            await c.var.host.restoreScope(actor, tenantId, scopeId, landing, sourceHint ? { sourceScopeId: sourceHint } : undefined);
             const vertical = await verticalForScope(c, scope);
             // #1742: the recorded OFF positions ride the restore, so the deployment switches them
             // off in the replay's own event — its own sweeper cannot land in between.
@@ -3399,7 +3489,7 @@ export function createControlPlaneApi(options) {
             // #1674: a backup from before a module was switched off brings it back on; the
             // directory's record puts it back off now, not at the next reconcile. Where the
             // deployment already did (#1742), this finds it done and audits what it reported.
-            await admin.reassertSystemSwitches(actor, { tenantId, scopeId }, { appliedInUnit: restored?.switchedOff });
+            await c.var.admin.reassertSystemSwitches(actor, { tenantId, scopeId }, { appliedInUnit: restored?.switchedOff });
             return c.json({ restored: scopeId, tables: tables.length });
         }
         catch (e) {
@@ -3423,13 +3513,13 @@ export function createControlPlaneApi(options) {
         const tenantId = tenantIdSchema.parse(c.req.param('tenantId'));
         const scopeId = scopeIdSchema.parse(c.req.param('scopeId'));
         const actor = c.get('actor');
-        const scope = await admin.getScopeRecord(actor, tenantId, scopeId);
+        const scope = await c.var.admin.getScopeRecord(actor, tenantId, scopeId);
         if (!scope)
             return c.json({ error: `unknown scope for tenant: (${tenantId}, ${scopeId})` }, 404);
         const vertical = await verticalForScope(c, scope);
         return c.json(vertical
             ? await vertical.appliedMigrations(scopeId)
-            : await admin.scopeAppliedMigrations(actor, tenantId, scopeId));
+            : await c.var.admin.scopeAppliedMigrations(actor, tenantId, scopeId));
     });
     // #286: the PITR bookmarks a scope recorded before its migration passes — the
     // rewind points the deployments UI offers for a backout. Read through the
@@ -3439,13 +3529,13 @@ export function createControlPlaneApi(options) {
         const tenantId = tenantIdSchema.parse(c.req.param('tenantId'));
         const scopeId = scopeIdSchema.parse(c.req.param('scopeId'));
         const actor = c.get('actor');
-        const scope = await admin.getScopeRecord(actor, tenantId, scopeId);
+        const scope = await c.var.admin.getScopeRecord(actor, tenantId, scopeId);
         if (!scope)
             return c.json({ error: `unknown scope for tenant: (${tenantId}, ${scopeId})` }, 404);
         const vertical = await verticalForScope(c, scope);
         return c.json(vertical
             ? await vertical.migrationBookmarks(scopeId)
-            : await admin.scopeMigrationBookmarks(actor, tenantId, scopeId));
+            : await c.var.admin.scopeMigrationBookmarks(actor, tenantId, scopeId));
     });
     // #286's backout: rewind a scope to a pre-migration bookmark — schema AND data,
     // discarding every write since. Audited below the seam BEFORE the rewind runs;
@@ -3459,12 +3549,12 @@ export function createControlPlaneApi(options) {
             .object({ bookmark: z.string().min(1), force: z.boolean().optional() })
             .parse(await c.req.json());
         const actor = c.get('actor');
-        const scope = await admin.getScopeRecord(actor, tenantId, scopeId);
+        const scope = await c.var.admin.getScopeRecord(actor, tenantId, scopeId);
         if (!scope)
             return c.json({ error: `unknown scope for tenant: (${tenantId}, ${scopeId})` }, 404);
         try {
             const vertical = await verticalForScope(c, scope);
-            const result = await admin.rewindScope(actor, tenantId, scopeId, bookmark, {
+            const result = await c.var.admin.rewindScope(actor, tenantId, scopeId, bookmark, {
                 force,
                 localApply: !vertical,
             });
@@ -3478,7 +3568,7 @@ export function createControlPlaneApi(options) {
             // Meanwhile, the deployment that rewound it holds those modules off (#1819). A hold is
             // released by that reconcile's re-assert, or earlier by a switch move known to land on the
             // rewound storage, such as an operator's ON.
-            await admin.markScopeProvisioned(actor, tenantId, scopeId, null);
+            await c.var.admin.markScopeProvisioned(actor, tenantId, scopeId, null);
             return c.json(answer);
         }
         catch (e) {
@@ -3529,7 +3619,7 @@ export function createControlPlaneApi(options) {
         if (v.ownerTenant === null) {
             return c.json({ error: 'adopt-serving is a private-vertical operation' }, 409);
         }
-        const owned = (await admin.listScopes(actor, { tenantId: v.ownerTenant, vertical: slug })).filter((s) => !s.forkedFrom && s.kind !== 'preview' && s.status === 'active');
+        const owned = (await c.var.admin.listScopes(actor, { tenantId: v.ownerTenant, vertical: slug })).filter((s) => !s.forkedFrom && s.kind !== 'preview' && s.status === 'active');
         const { acknowledge } = adoptServingBody.parse(await c.req.json().catch(() => ({})));
         const adopted = [];
         const alreadyAdopted = [];
@@ -3556,6 +3646,13 @@ export function createControlPlaneApi(options) {
         const tenantId = tenantIdSchema.parse(c.req.param('tenantId'));
         const scopeId = scopeIdSchema.parse(c.req.param('scopeId'));
         const { vertical, ackMigrations, abandonData, acknowledge } = rebindScopeVerticalBody.parse(await c.req.json());
+        // #977: the TARGET must be a vertical this principal can read — its own tenant's, or a
+        // listed one. The path pin confines whose scope moves; without this, it could move onto
+        // another tenant's private vertical, which a confined caller must not even learn exists
+        // (404, as `GET /verticals/:slug` answers it).
+        if (await notReadable(c.get('principal'), vertical)) {
+            return c.json({ error: `unknown vertical: ${vertical}` }, 404);
+        }
         try {
             const r = await rebindScopeOntoVertical(c, tenantId, scopeId, vertical, {
                 ackMigrations,
@@ -3581,7 +3678,7 @@ export function createControlPlaneApi(options) {
         const tenantId = tenantIdSchema.parse(c.req.param('tenantId'));
         const scopeId = scopeIdSchema.parse(c.req.param('scopeId'));
         const versionId = z.string().min(1).parse(c.req.query('versionId'));
-        return c.json({ affected: await admin.bindingImpact(c.get('actor'), tenantId, scopeId, versionId) });
+        return c.json({ affected: await c.var.admin.bindingImpact(c.get('actor'), tenantId, scopeId, versionId) });
     });
     // Pin a scope to a vertical version (#31; orchestration.md §4). Refuses a
     // non-admitted version below the seam — that refusal is the registry's reason to
@@ -3600,7 +3697,7 @@ export function createControlPlaneApi(options) {
         const scopeId = scopeIdSchema.parse(c.req.param('scopeId'));
         const { versionId, snapshot, acknowledge } = bindScopeVersionBody.parse(await c.req.json());
         const actor = c.get('actor');
-        const scope = await admin.getScopeRecord(actor, tenantId, scopeId);
+        const scope = await c.var.admin.getScopeRecord(actor, tenantId, scopeId);
         // #1756: the apps in this tenant the bind would break, asked BEFORE the carry and the
         // snapshot below, which move data. The host refuses too, whoever calls, but by then a
         // refusal would land after the bytes had moved. It refuses what the bind would refuse
@@ -3621,12 +3718,12 @@ export function createControlPlaneApi(options) {
         // already did so in the restore's own event; what it reports is audited here.
         const reassert = async () => {
             if (scope) {
-                await admin.reassertSystemSwitches(actor, { tenantId, scopeId }, { appliedInUnit: carried?.switchedOff });
+                await c.var.admin.reassertSystemSwitches(actor, { tenantId, scopeId }, { appliedInUnit: carried?.switchedOff });
             }
         };
         // The host's own refusal, should the impact have changed since it was read above (a
         // promote landing in between): relayed as the same 409, never as a 500.
-        const bind = (opts) => admin.bindScopeVersion(actor, tenantId, scopeId, versionId, opts).catch(relayHostRefusal);
+        const bind = (opts) => c.var.admin.bindScopeVersion(actor, tenantId, scopeId, versionId, opts).catch(relayHostRefusal);
         if (snapshot) {
             if (!scope) {
                 return c.json({ error: `unknown scope for tenant: (${tenantId}, ${scopeId})` }, 404);
@@ -3638,8 +3735,8 @@ export function createControlPlaneApi(options) {
                 let migrationCrossing = false;
                 if (scope.vertical && scope.verticalVersionId) {
                     const [current, incoming] = await Promise.all([
-                        admin.getVersion(actor, scope.verticalVersionId, scope.vertical),
-                        admin.getVersion(actor, versionId, scope.vertical),
+                        c.var.admin.getVersion(actor, scope.verticalVersionId, scope.vertical),
+                        c.var.admin.getVersion(actor, versionId, scope.vertical),
                     ]);
                     migrationCrossing = Boolean(current && incoming && current.migrationDigest !== incoming.migrationDigest);
                 }
@@ -3657,12 +3754,12 @@ export function createControlPlaneApi(options) {
                 await bind({ acknowledge, snapshot: true });
             }
             await reassert();
-            return c.json(await admin.getScopeRecord(actor, tenantId, scopeId));
+            return c.json(await c.var.admin.getScopeRecord(actor, tenantId, scopeId));
         }
         await carry();
         await bind({ acknowledge });
         await reassert();
-        return c.json(await admin.getScopeRecord(actor, tenantId, scopeId));
+        return c.json(await c.var.admin.getScopeRecord(actor, tenantId, scopeId));
     });
     // -- instances (K-31) -------------------------------------------------------
     // The one place this surface calls OUT rather than sitting over `HostAdmin`, and
@@ -3679,7 +3776,7 @@ export function createControlPlaneApi(options) {
         // The install kill-switch: a blocked vertical takes no NEW instances, for anyone
         // including its owner. Refused before deployment resolution so the answer is
         // uniform whether or not anything is deployed. Existing scopes keep serving.
-        const registered = (await admin.listVerticals(c.get('actor'))).find((v) => v.slug === slug);
+        const registered = (await c.var.admin.listVerticals(c.get('actor'))).find((v) => v.slug === slug);
         if (registered?.installsBlocked) {
             return c.json({ error: `new installs of vertical '${slug}' are blocked` }, 403);
         }
@@ -3696,11 +3793,11 @@ export function createControlPlaneApi(options) {
         // (#304). A vertical predating the field ignores it; grant/revoke AFTER provision ride
         // a re-provision (this endpoint is idempotent, K-31), meanwhile expiry still enforces
         // locally because the projected row carries it.
-        const entitlements = await admin.listEntitlements(c.get('actor'), input.tenantId);
+        const entitlements = await c.var.admin.listEntitlements(c.get('actor'), input.tenantId);
         // #406: identity links ride the same authoritative gather — the vertical projects them
         // so its auth adapter resolves logins from local storage, and offboarding becomes an
         // unlink + re-deliver instead of a source edit + deploy.
-        const identityLinks = (await admin.listIdentityLinks(c.get('actor'), input.tenantId)).map(({ tenantId: _tenantId, ...link }) => link);
+        const identityLinks = (await c.var.admin.listIdentityLinks(c.get('actor'), input.tenantId)).map(({ tenantId: _tenantId, ...link }) => link);
         // #592: connection grants too — tenant-wide rows materialize for the NEW scope, so an
         // install provisioned after `grantToConnection` holds the same `connection:<id>` tuple
         // as one provisioned before it, and the connector return path works without a human
@@ -3709,24 +3806,24 @@ export function createControlPlaneApi(options) {
         // connector has since declared another grant receives it — rather than inheriting the
         // gap the tenant's first install was created with.
         try {
-            await reconcileConnectionGrants({ admin, actor: c.get('actor'), declared: options.connectorGrants ?? {} }, input.tenantId, slug);
+            await reconcileConnectionGrants({ admin: c.var.admin, actor: c.get('actor'), declared: options.connectorGrants ?? {} }, input.tenantId, slug);
         }
         catch {
             // Best-effort, exactly as on the reconcile route.
         }
-        const connectionGrants = connectionGrantsForScope(await admin.listConnectionGrants(c.get('actor'), input.tenantId), slug, input.scopeId);
+        const connectionGrants = connectionGrantsForScope(await c.var.admin.listConnectionGrants(c.get('actor'), input.tenantId), slug, input.scopeId);
         // #687: and the public sealing keys of this tenant's live connections for the same
         // vertical, so the new install can seal a value TO a connector from its first
         // operation — before this, a scope could only receive a connector's answer, never
         // hand it something the spine must not carry in the clear.
-        const connectionKeys = await admin.connectionSealingKeys(input.tenantId, slug);
+        const connectionKeys = await c.var.admin.connectionSealingKeys(input.tenantId, slug);
         // #301 PR-2: per-tenant relational stores the vertical DECLARED, minted here (before
         // the callback — the vertical migrates the store inside the K-31 ready-gate, so it
         // must exist and be bound first). Idempotent like the endpoint: a retried provision
         // re-resolves the same handles and the binding attach no-ops once present. `[]` for
         // every vertical that declares none — the payload is unchanged for them.
         const tenantStores = await collectTenantStoreHandles({
-            host: options.host,
+            host: c.var.host,
             actor: c.get('actor'),
             slug,
             tenantId: input.tenantId,
@@ -3736,7 +3833,7 @@ export function createControlPlaneApi(options) {
         // No handle rides the provision callback (a blob store has no schema to migrate), so
         // the effect is purely the ledger row + the attached r2_bucket binding.
         await collectBlobStoreHandles({
-            host: options.host,
+            host: c.var.host,
             actor: c.get('actor'),
             slug,
             tenantId: input.tenantId,
@@ -3745,7 +3842,7 @@ export function createControlPlaneApi(options) {
         // #1742: the recorded OFF positions ride the provision into the seat's own unit. Read
         // from the directory whether or not the row exists yet: a brand-new install has no
         // record, so nothing is carried and the body is unchanged.
-        const switches = await switchCarryFor(admin, c.get('actor'), { tenantId: input.tenantId, scopeId: input.scopeId });
+        const switches = await switchCarryFor(c.var.admin, c.get('actor'), { tenantId: input.tenantId, scopeId: input.scopeId });
         try {
             // #424 case 2: the binding attach above races Cloudflare script-settings
             // propagation, so the vertical's FIRST answer can be a transient 5xx that a
@@ -3767,17 +3864,17 @@ export function createControlPlaneApi(options) {
             // is the right trade — a receipt written before a bind would name no version, and
             // one guessed from the serving pointer would claim a hook ran against code this
             // scope was not running.
-            const provisioned = await admin.getScopeRecord(c.get('actor'), input.tenantId, input.scopeId);
+            const provisioned = await c.var.admin.getScopeRecord(c.get('actor'), input.tenantId, input.scopeId);
             // #1674: this route is idempotent (K-31), so an already-bound scope that was wiped can
             // come back through it, re-seated live by the deployment — and the receipt below means
             // no sweep follows. Re-assert the recorded OFF positions before it. Only once the
             // directory row exists: a brand-new install's is written after this call (see above),
             // has no record to re-assert, and `reassertSystemSwitches` refuses an unknown scope.
             if (provisioned) {
-                await admin.reassertSystemSwitches(c.get('actor'), { tenantId: input.tenantId, scopeId: input.scopeId }, { appliedInUnit: instance.switchedOff });
+                await c.var.admin.reassertSystemSwitches(c.get('actor'), { tenantId: input.tenantId, scopeId: input.scopeId }, { appliedInUnit: instance.switchedOff });
             }
             if (provisioned?.verticalVersionId) {
-                await admin.markScopeProvisioned(c.get('actor'), input.tenantId, input.scopeId, provisioned.verticalVersionId);
+                await c.var.admin.markScopeProvisioned(c.get('actor'), input.tenantId, input.scopeId, provisioned.verticalVersionId);
             }
             return c.json(instance, 201);
         }
@@ -3816,13 +3913,13 @@ export function createControlPlaneApi(options) {
     // `listVerticals` returns every row (the adapter does not narrow); the transport is
     // where per-principal filtering happens — here and on GET /verticals.
     const ownerOf = async (actor, slug) => {
-        const v = (await admin.listVerticals(actor)).find((x) => x.slug === slug);
+        const v = (await host.admin.listVerticals(actor)).find((x) => x.slug === slug);
         return v ? v.ownerTenant : undefined;
     };
     // The full registry row, for the checks that need more than the owner — whether the
     // vertical is PRIVATE (owned + not listed), which is what scopes a builder's prod
     // self-serve below.
-    const verticalOf = async (actor, slug) => (await admin.listVerticals(actor)).find((x) => x.slug === slug);
+    const verticalOf = async (actor, slug) => (await host.admin.listVerticals(actor)).find((x) => x.slug === slug);
     /**
      * "This principal is confined, and this vertical is not its tenant's." The one
      * predicate every slug-addressed route asks.
@@ -3846,6 +3943,22 @@ export function createControlPlaneApi(options) {
      * vertical stays owner-only, and so do the reads narrowed on purpose (migration SQL,
      * the prod history).
      */
+    /**
+     * Whether a CONFINED principal may grant its own tenant `key` (#977): some vertical it
+     * can read — its own, or a listed one — declares the key, or is the vertical whose
+     * bare slug it is. The same derivation the dashboard's install makes
+     * (`installEntitlements`), checked here so a credential cannot grant what no install
+     * would. Read through the configured host: a check audits nothing.
+     */
+    const tenantGrantable = async (p, key) => {
+        const pin = confinedTenant(p);
+        if (pin === null)
+            return true;
+        const visible = (await host.admin.listVerticals(p.actor)).filter((v) => v.ownerTenant === pin || v.listed);
+        return visible.some((v) => v.entitlements && v.entitlements.length > 0
+            ? v.entitlements.includes(key)
+            : (v.slug.split('/').pop() || v.slug) === key);
+    };
     const notReadable = async (p, slug) => {
         const pin = confinedTenant(p);
         if (pin === null)
@@ -3883,7 +3996,7 @@ export function createControlPlaneApi(options) {
         if (!pin)
             return raw;
         const actor = c.get('actor');
-        const workspace = (await admin.listTenants(actor)).find((t) => t.slug === pin || t.id === pin);
+        const workspace = (await c.var.admin.listTenants(actor)).find((t) => t.slug === pin || t.id === pin);
         if (!workspace || raw.startsWith(`${workspace.slug}/`))
             return raw;
         if ((await ownerOf(actor, raw)) === workspace.id)
@@ -3893,7 +4006,7 @@ export function createControlPlaneApi(options) {
     };
     app.get('/verticals', async (c) => {
         const page = pageParams(c);
-        const all = await admin.listVerticals(c.get('actor'));
+        const all = await c.var.admin.listVerticals(c.get('actor'));
         const p = c.get('principal');
         // A builder sees only what it owns; staff see the whole registry. The narrowing
         // runs above the adapter, so the page is sliced here — over the narrowed list.
@@ -3932,12 +4045,12 @@ export function createControlPlaneApi(options) {
      * it that can drift when a third ref scheme appears.
      */
     const tenantServiceRefs = async (actor, tenantId, slug) => {
-        const all = (await admin.listVerticals(actor)).filter((v) => v.ownerTenant === tenantId);
+        const all = (await host.admin.listVerticals(actor)).filter((v) => v.ownerTenant === tenantId);
         const considered = slug === undefined ? all : all.filter((v) => v.slug === slug);
         const verticalsTruncated = considered.length > MAX_SERVICE_REF_VERTICALS;
         const entries = [];
         for (const v of considered.slice(0, MAX_SERVICE_REF_VERTICALS)) {
-            const versions = await admin.listVersions(actor, v.slug);
+            const versions = await host.admin.listVersions(actor, v.slug);
             const labelOf = new Map(versions.map((ver) => [ver.id, ver.version]));
             // The stable serving script — where real traffic lands. Its version is the
             // registry row's own servingVersionId: authoritative, not the scope-derived
@@ -4016,10 +4129,10 @@ export function createControlPlaneApi(options) {
                 return c.json({ error: 'forbidden' }, 403);
             input.ownerTenant = p.tenantId;
         }
-        await admin.registerVertical(c.get('actor'), input);
+        await c.var.admin.registerVertical(c.get('actor'), input);
         // Idempotent on the slug (a conflicting re-register throws below the seam), so
         // read back rather than echo the request.
-        const registered = (await admin.listVerticals(c.get('actor'))).find((v) => v.slug === input.slug);
+        const registered = (await c.var.admin.listVerticals(c.get('actor'))).find((v) => v.slug === input.slug);
         return c.json(registered, 201);
     });
     app.get('/verticals/:slug/versions', async (c) => {
@@ -4031,7 +4144,7 @@ export function createControlPlaneApi(options) {
             return c.json({ error: 'not found' }, 404);
         }
         const page = pageParams(c);
-        const entries = await admin.listVersions(c.get('actor'), slug, page);
+        const entries = await c.var.admin.listVersions(c.get('actor'), slug, page);
         return c.json(pageOf(entries, page.limit, (v) => v.id));
     });
     app.post('/verticals/:slug/versions', async (c) => {
@@ -4077,8 +4190,8 @@ export function createControlPlaneApi(options) {
                     return refuse(registry.error.issues[0], ['registry']);
             }
         }
-        await admin.publishVersion(c.get('actor'), input);
-        const version = await admin.getVersion(c.get('actor'), input.id, slug);
+        await c.var.admin.publishVersion(c.get('actor'), input);
+        const version = await c.var.admin.getVersion(c.get('actor'), input.id, slug);
         return c.json(version, 201);
     });
     // The declared permission registry (D-39, #336) that ships inside one version's manifest:
@@ -4093,7 +4206,7 @@ export function createControlPlaneApi(options) {
         if (await notReadable(p, slug)) {
             return c.json({ error: 'not found' }, 404);
         }
-        const json = await admin.versionManifest(c.get('actor'), slug, c.req.param('id'));
+        const json = await c.var.admin.versionManifest(c.get('actor'), slug, c.req.param('id'));
         const registry = json ? (storedDeployManifest.parse(JSON.parse(json)).registry ?? null) : null;
         return c.json({ registry });
     });
@@ -4112,7 +4225,7 @@ export function createControlPlaneApi(options) {
             return c.json({ error: 'not found' }, 404);
         }
         // `versionMigrations` refuses a version of another vertical, so `base` cannot reach one.
-        const migrationsOf = (id) => admin.versionMigrations(c.get('actor'), slug, id);
+        const migrationsOf = (id) => c.var.admin.versionMigrations(c.get('actor'), slug, id);
         const base = c.req.query('base');
         const [incoming, baseline] = await Promise.all([
             migrationsOf(c.req.param('id')),
@@ -4133,7 +4246,7 @@ export function createControlPlaneApi(options) {
         if (await notReadable(p, slug)) {
             return c.json({ error: 'not found' }, 404);
         }
-        const json = await admin.versionManifest(c.get('actor'), slug, c.req.param('id'));
+        const json = await c.var.admin.versionManifest(c.get('actor'), slug, c.req.param('id'));
         const parsed = json ? storedDeployManifest.parse(JSON.parse(json)) : null;
         // #1232: freshness rides the same read — the manifest is already in hand, and a
         // sibling route would cost a second full parse for a field sitting beside this one.
@@ -4156,7 +4269,7 @@ export function createControlPlaneApi(options) {
         if (await notReadable(p, slug)) {
             return c.json({ error: 'not found' }, 404);
         }
-        const json = await admin.versionManifest(c.get('actor'), slug, c.req.param('id'));
+        const json = await c.var.admin.versionManifest(c.get('actor'), slug, c.req.param('id'));
         const parsed = json ? storedDeployManifest.parse(JSON.parse(json)) : null;
         return c.json({
             declaredEvents: parsed?.declaredEvents ?? null,
@@ -4184,7 +4297,7 @@ export function createControlPlaneApi(options) {
         if (await notReadable(p, slug)) {
             return c.json({ error: 'not found' }, 404);
         }
-        const json = await admin.versionManifest(c.get('actor'), slug, c.req.param('id'));
+        const json = await c.var.admin.versionManifest(c.get('actor'), slug, c.req.param('id'));
         const parsed = json ? storedDeployManifest.parse(JSON.parse(json)) : null;
         // #1321 rides this read for the reason the freshness field rides the schedules
         // one: the manifest is already parsed, and the field sits beside the model the
@@ -4203,22 +4316,22 @@ export function createControlPlaneApi(options) {
         if (await notReadable(p, slug)) {
             return c.json({ error: 'not found' }, 404);
         }
-        const json = await admin.versionManifest(c.get('actor'), slug, c.req.param('id'));
+        const json = await c.var.admin.versionManifest(c.get('actor'), slug, c.req.param('id'));
         const assets = json ? (storedDeployManifest.parse(JSON.parse(json)).assets ?? null) : null;
         return c.json({ assets });
     });
     app.post('/verticals/:slug/versions/:id/admit', async (c) => {
         const slug = c.req.param('slug');
         const id = c.req.param('id');
-        await admin.admitVersion(c.get('actor'), id);
-        return c.json(await admin.getVersion(c.get('actor'), id, slug));
+        await c.var.admin.admitVersion(c.get('actor'), id);
+        return c.json(await c.var.admin.getVersion(c.get('actor'), id, slug));
     });
     app.post('/verticals/:slug/versions/:id/reject', async (c) => {
         const slug = c.req.param('slug');
         const id = c.req.param('id');
         const { note } = rejectVersionBody.parse(await c.req.json());
-        await admin.rejectVersion(c.get('actor'), id, note);
-        return c.json(await admin.getVersion(c.get('actor'), id, slug));
+        await c.var.admin.rejectVersion(c.get('actor'), id, note);
+        return c.json(await c.var.admin.getVersion(c.get('actor'), id, slug));
     });
     // A builder REQUESTS publication of a vertical it owns (marketplace-publish.md §5) — any owner
     // may ask; the staff `listing` flip below is the review gate. Owner-checked (like promote).
@@ -4228,7 +4341,7 @@ export function createControlPlaneApi(options) {
         if (await notOwned(p, slug)) {
             return c.json({ error: 'not found' }, 404);
         }
-        await admin.requestPublish(c.get('actor'), slug);
+        await c.var.admin.requestPublish(c.get('actor'), slug);
         return c.json({ slug, requested: true });
     });
     // Publish/unpublish a vertical to the PUBLIC marketplace (marketplace-publish.md §5). Staff
@@ -4237,7 +4350,7 @@ export function createControlPlaneApi(options) {
     app.post('/verticals/:slug/listing', async (c) => {
         const slug = c.req.param('slug');
         const { listed } = z.object({ listed: z.boolean() }).parse(await c.req.json());
-        await admin.setVerticalListed(c.get('actor'), slug, listed);
+        await c.var.admin.setVerticalListed(c.get('actor'), slug, listed);
         return c.json({ slug, listed });
     });
     // The install kill-switch (staff-only — not in BUILDER_ROUTES, so a builder is
@@ -4246,7 +4359,7 @@ export function createControlPlaneApi(options) {
     app.post('/verticals/:slug/install-block', async (c) => {
         const slug = c.req.param('slug');
         const { blocked } = z.object({ blocked: z.boolean() }).parse(await c.req.json());
-        await admin.setVerticalInstallsBlocked(c.get('actor'), slug, blocked);
+        await c.var.admin.setVerticalInstallsBlocked(c.get('actor'), slug, blocked);
         return c.json({ slug, installsBlocked: blocked });
     });
     // Grant/revoke the TENANT-PROVISIONER capability (#412) — whether this vertical's scopes
@@ -4256,7 +4369,7 @@ export function createControlPlaneApi(options) {
     app.post('/verticals/:slug/tenant-provisioner', async (c) => {
         const slug = c.req.param('slug');
         const { granted } = z.object({ granted: z.boolean() }).parse(await c.req.json());
-        await admin.setVerticalTenantProvisioner(c.get('actor'), slug, granted);
+        await c.var.admin.setVerticalTenantProvisioner(c.get('actor'), slug, granted);
         return c.json({ slug, tenantProvisioner: granted });
     });
     // Grant/revoke the EMAIL-SENDER capability (#303) — whether this vertical's scopes may POST to
@@ -4266,7 +4379,7 @@ export function createControlPlaneApi(options) {
     app.post('/verticals/:slug/email-sender', async (c) => {
         const slug = c.req.param('slug');
         const { granted } = z.object({ granted: z.boolean() }).parse(await c.req.json());
-        await admin.setVerticalEmailSender(c.get('actor'), slug, granted);
+        await c.var.admin.setVerticalEmailSender(c.get('actor'), slug, granted);
         return c.json({ slug, emailSender: granted });
     });
     // Delete a vertical + its versions and channels. Refused below the seam while any
@@ -4283,7 +4396,7 @@ export function createControlPlaneApi(options) {
         // existence-hiding reflex the registry's other per-slug reads use (K-3).
         if (await notOwned(c.get('principal'), slug))
             return c.json({ error: 'not found' }, 404);
-        await admin.deleteVertical(c.get('actor'), slug);
+        await c.var.admin.deleteVertical(c.get('actor'), slug);
         return c.json({ slug, deleted: true });
     });
     app.get('/verticals/:slug/channels', async (c) => {
@@ -4293,7 +4406,7 @@ export function createControlPlaneApi(options) {
             return c.json({ error: 'not found' }, 404);
         }
         const page = pageParams(c);
-        const entries = await admin.listChannels(c.get('actor'), slug, page);
+        const entries = await c.var.admin.listChannels(c.get('actor'), slug, page);
         return c.json(pageOf(entries, page.limit, (ch) => ch.channel));
     });
     // The promotion timeline (newest first) — what a rollback UI picks a target from.
@@ -4311,7 +4424,7 @@ export function createControlPlaneApi(options) {
             return c.json({ error: 'not found' }, 404);
         }
         const page = pageParams(c);
-        const entries = await admin.listChannelHistory(c.get('actor'), slug, channel, page);
+        const entries = await c.var.admin.listChannelHistory(c.get('actor'), slug, channel, page);
         return c.json(pageOf(entries, page.limit, (e) => e.id));
     });
     /**
@@ -4326,20 +4439,20 @@ export function createControlPlaneApi(options) {
      * the caller surfaces it — and leaves `servingVersionId` trailing the channel:
      * visible, and retried by promoting again.
      */
-    const serveVersionInPlace = async (actor, slug, versionId) => {
+    const serveVersionInPlace = async (admin, actor, slug, versionId) => {
         if (!options.deployVertical || !options.fetchVerticalModules)
             return; // not configured: pre-#286 behavior
-        const version = await admin.getVersion(actor, versionId, slug);
+        const version = await host.admin.getVersion(actor, versionId, slug);
         if (!version?.deploymentRef) {
             throw new ControlPlaneError(502, `version ${versionId} has no archive script to serve from`);
         }
         const archiveRef = version.deploymentRef;
-        const manifestJson = await admin.versionManifest(actor, slug, versionId);
+        const manifestJson = await host.admin.versionManifest(actor, slug, versionId);
         if (!manifestJson) {
             throw new ControlPlaneError(502, `version ${versionId} retained no manifest — pushed pre-#286; push it again to serve in place`);
         }
         const manifest = storedDeployManifest.parse(JSON.parse(manifestJson));
-        const serving = await admin.verticalServing(actor, slug);
+        const serving = await host.admin.verticalServing(actor, slug);
         const ref = serving?.ref ?? stableDeploymentRefFor(slug);
         const modules = await options.fetchVerticalModules(version.deploymentRef);
         // #301 PR-2: every serving upload re-derives the per-tenant store D1 bindings from
@@ -4349,11 +4462,11 @@ export function createControlPlaneApi(options) {
         // tenant's store. Platform-granted after the §4 sandbox check, like injectSecrets:
         // the builder never declared these and never named the ids.
         const storeBindings = [
-            ...tenantStoreBindings(await admin.listTenantStores(actor, { vertical: slug })),
+            ...tenantStoreBindings(await host.admin.listTenantStores(actor, { vertical: slug })),
             // #473: the per-tenant blob-store r2_bucket bindings, re-derived from the ledger on
             // every serving upload for the same reason — an upload replaces the script's binding
             // set, so a re-deploy must never drop a tenant's attachment bucket.
-            ...blobStoreBindings(await admin.listBlobStores(actor, { vertical: slug })),
+            ...blobStoreBindings(await host.admin.listBlobStores(actor, { vertical: slug })),
         ].map((b) => b.type === 'd1'
             ? { type: 'd1', name: b.name, id: b.id }
             : { type: 'r2_bucket', name: b.name, bucket_name: b.bucketName });
@@ -4438,7 +4551,7 @@ export function createControlPlaneApi(options) {
         try {
             // Every tenant with an install that can still serve. Archived/reaped scopes are
             // excluded — minting a bucket for storage that is gone is pure waste.
-            const scopes = await admin.listScopes(actor, {
+            const scopes = await c.var.admin.listScopes(actor, {
                 vertical: slug,
                 status: ['provisioning', 'active', 'suspended'],
             });
@@ -4446,7 +4559,7 @@ export function createControlPlaneApi(options) {
             if (tenantIds.length === 0)
                 return { minted: [] };
             const minted = await backfillDeclaredStores({
-                host: options.host,
+                host: c.var.host,
                 actor,
                 slug,
                 tenantIds,
@@ -4474,22 +4587,22 @@ export function createControlPlaneApi(options) {
      * costs a read, a missing one a silent stall.
      */
     const promoteImpactOf = async (actor, slug, channel, versionId) => {
-        const gate = await admin.promotionImpact(actor, slug, channel, versionId);
+        const gate = await host.admin.promotionImpact(actor, slug, channel, versionId);
         if (channel !== 'prod')
             return gate;
         const v = await verticalOf(actor, slug);
         if (!v || v.ownerTenant === null || v.listed)
             return gate;
-        const incoming = await admin.getVersion(actor, versionId, slug);
+        const incoming = await host.admin.getVersion(actor, versionId, slug);
         if (!incoming?.deploymentRef || incoming.admission !== 'admitted')
             return gate;
-        const lagging = (await admin.listScopes(actor, { tenantId: v.ownerTenant, vertical: slug, status: ['active'] })).filter((s) => !s.forkedFrom && s.kind !== 'preview' && !s.servingRef && s.verticalVersionId !== versionId);
+        const lagging = (await host.admin.listScopes(actor, { tenantId: v.ownerTenant, vertical: slug, status: ['active'] })).filter((s) => !s.forkedFrom && s.kind !== 'preview' && !s.servingRef && s.verticalVersionId !== versionId);
         const seen = new Set(gate.map((b) => `${b.scopeId}|${b.type}`));
         const out = [...gate];
         for (const s of lagging) {
             // After the adopt it runs the promoted version, served in place: that pointer move, from
             // what it runs now, is the move to judge.
-            for (const b of await admin.bindingImpact(actor, s.tenantId, s.id, versionId)) {
+            for (const b of await host.admin.bindingImpact(actor, s.tenantId, s.id, versionId)) {
                 const key = `${b.scopeId}|${b.type}`;
                 if (!seen.has(key))
                     (seen.add(key), out.push(b));
@@ -4575,7 +4688,7 @@ export function createControlPlaneApi(options) {
         // and refuses a non-admitted version. Both are enforced below the seam and
         // surface as a 4xx through mapError, not a 500.
         try {
-            await admin.promoteVersion(c.get('actor'), slug, channel, versionId, acknowledge);
+            await c.var.admin.promoteVersion(c.get('actor'), slug, channel, versionId, acknowledge);
         }
         catch (err) {
             if (!isExportBreakRefusal(err))
@@ -4596,7 +4709,7 @@ export function createControlPlaneApi(options) {
         let adopted = { refused: [] };
         if (channel === 'prod') {
             try {
-                await serveVersionInPlace(c.get('actor'), slug, versionId);
+                await serveVersionInPlace(c.var.admin, c.get('actor'), slug, versionId);
                 // Adopt any still-legacy owned scope onto the serving script and advance every
                 // owned scope's version — the rebind the host cascade delegated to us for a
                 // dispatch-backed vertical (#321), in the correct order (serve → adopt → rebind),
@@ -4643,7 +4756,7 @@ export function createControlPlaneApi(options) {
                     : {}),
             }, 409);
         }
-        const promoted = (await admin.listChannels(c.get('actor'), slug)).find((ch) => ch.channel === channel);
+        const promoted = (await c.var.admin.listChannels(c.get('actor'), slug)).find((ch) => ch.channel === channel);
         // The store backfill rides the response only when it has something to say (#825), so
         // nothing changes for the overwhelming majority of promotes — and when a store WAS
         // minted, or could not be, the builder reads it at the terminal rather than finding out
@@ -4733,7 +4846,7 @@ export function createControlPlaneApi(options) {
             ownerTenant = p.tenantId;
         }
         else if (pin) {
-            const workspace = (await admin.listTenants(c.get('actor'))).find((t) => t.slug === pin || t.id === pin);
+            const workspace = (await c.var.admin.listTenants(c.get('actor'))).find((t) => t.slug === pin || t.id === pin);
             if (!workspace)
                 return c.json({ error: `unknown workspace '${pin}'` }, 404);
             // Back-compat: a BARE slug already registered as the pinned tenant's (a staff
@@ -4772,7 +4885,7 @@ export function createControlPlaneApi(options) {
         // scoping is also what keeps existence-hiding intact — a builder is never told about
         // a foreign private slug.
         if (form.get('allowFork') !== '1') {
-            const registry = await admin.listVerticals(c.get('actor'));
+            const registry = await c.var.admin.listVerticals(c.get('actor'));
             const tail = slug.split('/').pop();
             const siblings = registry.some((v) => v.slug === slug)
                 ? []
@@ -4920,7 +5033,7 @@ export function createControlPlaneApi(options) {
         // (or admitted, for a PRIVATE vertical — the registry's self-admit rule). The owner
         // was resolved with the slug above: the builder's tenant, the pinned workspace, or
         // the preserved existing owner for an unpinned staff push.
-        await admin.registerVertical(c.get('actor'), {
+        await c.var.admin.registerVertical(c.get('actor'), {
             slug,
             name: manifest.name ?? slug,
             source: 'cli',
@@ -4946,7 +5059,7 @@ export function createControlPlaneApi(options) {
             // hostname-binding picker, never behavior. Not part of any admission digest.
             ...(manifest.surfaces ? { surfaces: manifest.surfaces } : {}),
         });
-        await admin.publishVersion(c.get('actor'), {
+        await c.var.admin.publishVersion(c.get('actor'), {
             id,
             verticalSlug: slug,
             version: manifest.version,
@@ -4972,14 +5085,14 @@ export function createControlPlaneApi(options) {
             // one push depend on every other tenant's routing rows parsing cleanly — a
             // malformed cert-validation blob on an unrelated domain took the whole deploy down
             // with a blank 500, after the version had already been published.
-            const bound = await admin.listHostnames(c.get('actor'), { verticalSlug: slug });
+            const bound = await c.var.admin.listHostnames(c.get('actor'), { verticalSlug: slug });
             for (const h of bound) {
                 if (!declared.has(h.surface)) {
                     warnings.push(`hostname '${h.hostname}' is bound to surface '${h.surface}', which this version no longer declares`);
                 }
             }
         }
-        const version = await admin.getVersion(c.get('actor'), id, slug);
+        const version = await c.var.admin.getVersion(c.get('actor'), id, slug);
         return c.json({ ...version, ...(warnings.length ? { warnings } : {}) }, 201);
     });
     // -- where this platform runs (ops ergonomics) -----------------------------
@@ -5258,7 +5371,7 @@ export function createControlPlaneApi(options) {
      * nothing. `listScopes`, not `getScopeRecord`: a dashboard read must not write an access
      * row per page view.
      */
-    const appServices = async (actor, tenantId, scopeId, vertical) => scriptFamiliesOfScopes(await admin.listScopes(actor, { tenantId: tenantIdSchema.parse(tenantId) }), { scopeId, vertical });
+    const appServices = async (actor, tenantId, scopeId, vertical) => scriptFamiliesOfScopes(await host.admin.listScopes(actor, { tenantId: tenantIdSchema.parse(tenantId) }), { scopeId, vertical });
     app.get('/observability/tenant-request-volume', async (c) => {
         if (!options.observability?.tenantRequestVolume) {
             return c.json({ error: 'request aggregation is not configured on this control plane' }, 501);
@@ -5359,7 +5472,7 @@ export function createControlPlaneApi(options) {
             .parse({ hours: c.req.query('hours'), limit: c.req.query('limit') });
         // Deployed versions only: a version with no `deploymentRef` has never run, so there is
         // nothing it could have been observed reaching.
-        const versions = (await admin.listVersions(c.get('actor'), slug)).filter((v) => v.deploymentRef);
+        const versions = (await c.var.admin.listVersions(c.get('actor'), slug)).filter((v) => v.deploymentRef);
         // Cap the fan-out — each service is another backend query. Truncating the SERVICE list
         // is exactly the silent-drop #859 calls a defect, so it is reported, not swallowed.
         const MAX_SERVICES = 20;
@@ -5422,7 +5535,7 @@ export function createControlPlaneApi(options) {
             return c.json({ error: 'push tokens are not configured on this control plane' }, 501);
         }
         const { tenantId } = z.object({ tenantId: tenantIdSchema }).parse(await c.req.json());
-        const tenant = await admin.getTenant(c.get('actor'), tenantId);
+        const tenant = await c.var.admin.getTenant(c.get('actor'), tenantId);
         if (!tenant)
             return c.json({ error: `unknown tenant: ${tenantId}` }, 404);
         const token = await mintPushToken(options.pushTokenSecret, {
@@ -5443,12 +5556,22 @@ export function createControlPlaneApi(options) {
         if (!options.tenantTokenSecret) {
             return c.json({ error: 'tenant tokens are not configured on this control plane' }, 501);
         }
-        const { tenantId } = z.object({ tenantId: tenantIdSchema }).parse(await c.req.json());
+        const { tenantId, principal, impersonation } = z
+            .object({
+            tenantId: tenantIdSchema,
+            // #977: the signed-in person the token will act for — attribution on every admin
+            // row it writes, never reach. Optional: a token for background work names nobody.
+            principal: principalIdSchema.optional(),
+            // K-42: the staff member acting as `principal`. Meaningless without the person.
+            impersonation: impersonationStamp.optional(),
+        })
+            .refine((b) => !b.impersonation || b.principal, { message: 'impersonation names no principal' })
+            .parse(await c.req.json());
         // Unlike the push-token mint, this does NOT require the tenant to exist: a token
         // for a tenant with no directory row reaches nothing except creating that row
         // (`POST /tenants`, body-pinned to the same id), which is the sign-up bootstrap.
         // See the mint's docblock in tenant-token.ts.
-        const token = await mintTenantToken(options.tenantTokenSecret, { tenantId });
+        const token = await mintTenantToken(options.tenantTokenSecret, { tenantId, principal, impersonation });
         return c.json({ token }, 201);
     });
     // -- the hostname map (§4.7, K-26) -----------------------------------------
@@ -5466,7 +5589,7 @@ export function createControlPlaneApi(options) {
         const p = c.get('principal');
         const pin = confinedTenant(p);
         const filter = pin ? { tenantId: pin } : {};
-        return (await admin.listHostnames(c.get('actor'), filter)).find((h) => h.hostname === name.toLowerCase());
+        return (await c.var.admin.listHostnames(c.get('actor'), filter)).find((h) => h.hostname === name.toLowerCase());
     };
     app.get('/hostnames', async (c) => {
         const p = c.get('principal');
@@ -5483,7 +5606,7 @@ export function createControlPlaneApi(options) {
         if (hostnamePin)
             filter.tenantId = hostnamePin;
         const page = pageParams(c);
-        const entries = await admin.listHostnames(c.get('actor'), { ...filter, ...page });
+        const entries = await c.var.admin.listHostnames(c.get('actor'), { ...filter, ...page });
         return c.json(pageOf(entries, page.limit, (h) => h.hostname));
     });
     // Which base domains ride the platform wildcard cert (go straight to `active`);
@@ -5501,7 +5624,7 @@ export function createControlPlaneApi(options) {
      * Failures are swallowed to a `failed`/`pending` note rather than thrown: a bind that
      * recorded the row must still return 201, and the reconcile sweep retries.
      */
-    const runIssuance = async (actor, row) => {
+    const runIssuance = async (admin, actor, row) => {
         if (!custom(row.hostname)) {
             // Platform mint: rides *.<base> — no per-hostname CF object, immediately servable.
             // A mint carrying issuance relics (a CF id, publish-these-records rows) was born
@@ -5549,7 +5672,7 @@ export function createControlPlaneApi(options) {
             });
         }
     };
-    const hostnameRow = async (c, name) => (await admin.listHostnames(c.get('actor'), {})).find((h) => h.hostname === name.toLowerCase());
+    const hostnameRow = async (c, name) => (await c.var.admin.listHostnames(c.get('actor'), {})).find((h) => h.hostname === name.toLowerCase());
     app.post('/hostnames', async (c) => {
         const p = c.get('principal');
         const input = bindHostnameBody.parse(await c.req.json());
@@ -5578,13 +5701,13 @@ export function createControlPlaneApi(options) {
             if (bad)
                 return c.json({ error: bad }, 422);
         }
-        await admin.bindHostname(c.get('actor'), input);
-        const bound = (await admin.listHostnames(c.get('actor'), { scopeId: input.scopeId })).find((h) => h.hostname === input.hostname);
+        await c.var.admin.bindHostname(c.get('actor'), input);
+        const bound = (await c.var.admin.listHostnames(c.get('actor'), { scopeId: input.scopeId })).find((h) => h.hostname === input.hostname);
         if (bound)
-            await runIssuance(c.get('actor'), bound);
+            await runIssuance(c.var.admin, c.get('actor'), bound);
         // Re-read so the response carries the post-issuance status + DNS records the caller
         // (dashboard / CLI) renders — a custom bind comes back `verifying` with records.
-        const out = (await admin.listHostnames(c.get('actor'), { scopeId: input.scopeId })).find((h) => h.hostname === input.hostname);
+        const out = (await c.var.admin.listHostnames(c.get('actor'), { scopeId: input.scopeId })).find((h) => h.hostname === input.hostname);
         return c.json(out ?? bound, 201);
     });
     // Re-poll a custom hostname's issuance ("check again" in the dashboard). Tenant-narrowed
@@ -5598,7 +5721,7 @@ export function createControlPlaneApi(options) {
         const row = await hostnameRow(c, name);
         if (!row)
             return c.json({ error: `unknown hostname: ${name.toLowerCase()}` }, 404);
-        await runIssuance(c.get('actor'), row);
+        await runIssuance(c.var.admin, c.get('actor'), row);
         return c.json(await hostnameRow(c, name));
     });
     app.patch('/hostnames/:hostname/status', async (c) => {
@@ -5609,8 +5732,8 @@ export function createControlPlaneApi(options) {
         if (confinedTenant(c.get('principal')) !== null && !(await tenantHostname(c, name))) {
             return c.json({ error: `unknown hostname: ${name.toLowerCase()}` }, 404);
         }
-        await admin.setHostnameStatus(c.get('actor'), name, status, note);
-        const row = (await admin.listHostnames(c.get('actor'), {})).find((h) => h.hostname === name.toLowerCase());
+        await c.var.admin.setHostnameStatus(c.get('actor'), name, status, note);
+        const row = (await c.var.admin.listHostnames(c.get('actor'), {})).find((h) => h.hostname === name.toLowerCase());
         return c.json(row);
     });
     // Unbind (hard-delete) a hostname row — what the orphan cleanup uses on rows
@@ -5631,7 +5754,7 @@ export function createControlPlaneApi(options) {
         if (row?.customHostnameId && options.provisionHostname) {
             await options.provisionHostname.remove(row.customHostnameId).catch(() => { });
         }
-        await admin.unbindHostname(c.get('actor'), name);
+        await c.var.admin.unbindHostname(c.get('actor'), name);
         return c.json({ deleted: name.toLowerCase() });
     });
     // -- per-PR previews (preview-and-snapshots.md §2/§9) ----------------------
@@ -5677,23 +5800,23 @@ export function createControlPlaneApi(options) {
         const vertical = await verticalForScope(c, preview);
         if (vertical)
             await vertical.deleteScope({ scopeId: preview.id });
-        await options.host.deleteSnapshot(c.get('actor'), preview.tenantId, preview.id);
+        await c.var.host.deleteSnapshot(c.get('actor'), preview.tenantId, preview.id);
     };
     /** The preview-login seam (#1704, `preview-auth.ts`): the directory, and each issuer's deployment. */
     const previewAuthDeps = (c) => ({
-        admin,
+        admin: c.var.admin,
         actor: c.get('actor'),
         issuerClient: (scope) => verticalForScope(c, scope),
     });
     /** Given a base hostname `<label>.<domain>`, mint (or find) the preview's `--<tag>`
      *  hostname `<label>--<tag>.<domain>` bound to `previewId`. Non-canonical, so it never
      *  demotes the prod surface. Shared by the fork and clean-room paths. */
-    const bindPreviewHostname = async (actor, baseHostname, tenantId, previewId, tag, surface) => {
+    const bindPreviewHostname = async (admin, actor, baseHostname, tenantId, previewId, tag, surface) => {
         const parsed = parseHostname(baseHostname);
         if (!parsed)
             throw new ControlPlaneError(400, `'${baseHostname}' is not a hostname a preview can be minted beside`);
         const hostname = withLabel(parsed, `${parsed.label}${RESERVED_LABEL_SEPARATOR}${tag}`);
-        const existing = (await admin.listHostnames(actor, { scopeId: previewId })).find((h) => h.hostname === hostname);
+        const existing = (await host.admin.listHostnames(actor, { scopeId: previewId })).find((h) => h.hostname === hostname);
         if (!existing) {
             await admin.bindHostname(actor, {
                 hostname,
@@ -5704,9 +5827,9 @@ export function createControlPlaneApi(options) {
                 canonical: false,
             });
         }
-        const bound = (await admin.listHostnames(actor, { scopeId: previewId })).find((h) => h.hostname === hostname);
+        const bound = (await host.admin.listHostnames(actor, { scopeId: previewId })).find((h) => h.hostname === hostname);
         if (bound)
-            await runIssuance(actor, bound); // platform mint rides the wildcard cert → active
+            await runIssuance(admin, actor, bound); // platform mint rides the wildcard cert → active
         return hostname;
     };
     /** The base hostname a preview's `--<tag>` URL is derived from. A FORK inherits the
@@ -5715,7 +5838,7 @@ export function createControlPlaneApi(options) {
      *  the same scheme provisioning mints (`callout-sesamy.global.substrat.run`). */
     const previewBaseHostname = async (actor, source, tenantId, slug, surface) => {
         if (source) {
-            const own = await admin.listHostnames(actor, { scopeId: source.id });
+            const own = await host.admin.listHostnames(actor, { scopeId: source.id });
             const src = own.find((h) => h.canonical && h.surface === surface) ??
                 own.find((h) => h.canonical) ??
                 own[0];
@@ -5737,7 +5860,7 @@ export function createControlPlaneApi(options) {
         // bare apex and stranded clean-room previews on a hostname that never resolves.
         const baseDomain = [...platformBaseDomains].sort((a, b) => a.length - b.length)[0];
         const jurisdiction = 'global';
-        const tenant = await admin.getTenant(actor, tenantId);
+        const tenant = await host.admin.getTenant(actor, tenantId);
         const handle = tenant?.slug ?? tenantId;
         return `${slug.split('/').at(-1)}-${handle}.${jurisdiction}.${baseDomain}`;
     };
@@ -5753,12 +5876,12 @@ export function createControlPlaneApi(options) {
         // prod build) while we report success. That is worse than a failure: it sends a reviewer
         // to redo correct work. So refuse to return success for a URL that would serve other code.
         const assertServesBoundVersion = async (previewId) => {
-            const bound = await admin.getVersion(actor, opts.versionId, slug);
+            const bound = await c.var.admin.getVersion(actor, opts.versionId, slug);
             // A co-located / embedded vertical has no per-version dispatch script (deploymentRef
             // null) and routes via the static fallback — nothing to compare, so nothing to guard.
             if (!bound?.deploymentRef)
                 return;
-            const rec = await admin.getScopeRecord(actor, tenantId, previewId);
+            const rec = await c.var.admin.getScopeRecord(actor, tenantId, previewId);
             const effectiveRef = rec?.servingRef ?? bound.deploymentRef;
             if (effectiveRef !== bound.deploymentRef) {
                 throw new ControlPlaneError(500, `preview ${previewId} bound version ${opts.versionId} but would route to '${effectiveRef}' ` +
@@ -5784,7 +5907,7 @@ export function createControlPlaneApi(options) {
         // every push is its own script, so the rebind first CARRIES the preview's data into
         // the new version's script (#1710). The preview's data then follows it from push to
         // push, and each push's migrations run forward over it (§4's rehearsal case).
-        const existing = (await admin.listScopes(actor, { tenantId, vertical: slug })).find((s) => s.kind === 'preview' && s.slug === previewSlug(slug, opts.tag));
+        const existing = (await c.var.admin.listScopes(actor, { tenantId, vertical: slug })).find((s) => s.kind === 'preview' && s.slug === previewSlug(slug, opts.tag));
         // A preview only HAS data once its two-phase create finished: the directory row lands
         // first as `provisioning` (K-31), the fork's export→restore runs, and `activateScope`
         // is the last step. So a row still at `provisioning` is a create that DIED mid-fork —
@@ -5898,20 +6021,20 @@ export function createControlPlaneApi(options) {
             // Heal a preview provisioned before #527: clear any inherited serving_ref so routing
             // follows the bound version (its per-version script), not the prod serving script.
             if (existing.servingRef)
-                await admin.setScopeServingRef(actor, tenantId, existing.id, null);
-            await admin.bindScopeVersion(actor, tenantId, existing.id, opts.versionId);
+                await c.var.admin.setScopeServingRef(actor, tenantId, existing.id, null);
+            await c.var.admin.bindScopeVersion(actor, tenantId, existing.id, opts.versionId);
             // #1674: re-assert any recorded OFF in the script the preview now routes to.
-            await admin.reassertSystemSwitches(actor, { tenantId, scopeId: existing.id }, { appliedInUnit: carried?.switchedOff });
+            await c.var.admin.reassertSystemSwitches(actor, { tenantId, scopeId: existing.id }, { appliedInUnit: carried?.switchedOff });
             // Renew (or clear) the preview's GC deadline so a reused preview does not silently die.
-            await admin.setScopeExpiresAt(actor, tenantId, existing.id, expiresAt);
-            const hostname = await bindPreviewHostname(actor, baseHostname, tenantId, existing.id, opts.tag, surface);
+            await c.var.admin.setScopeExpiresAt(actor, tenantId, existing.id, expiresAt);
+            const hostname = await bindPreviewHostname(c.var.admin, actor, baseHostname, tenantId, existing.id, opts.tag, surface);
             await assertServesBoundVersion(existing.id);
             // The fork it was made from, not whichever prod scope this call picked: a reuse is the
             // same preview. Every push is a new version with an EMPTY config store, and the carry
             // above moves the scope's data but not the vertical's config store, so the login is
             // wired again on every reuse, never assumed to have survived.
             const parent = existing.forkedFrom
-                ? ((await admin.getScopeRecord(actor, tenantId, existing.forkedFrom)) ?? null)
+                ? ((await c.var.admin.getScopeRecord(actor, tenantId, existing.forkedFrom)) ?? null)
                 : null;
             const auth = await wireLogin(existing.id, hostname, parent);
             return {
@@ -5981,7 +6104,7 @@ export function createControlPlaneApi(options) {
             if (!target) {
                 throw new ControlPlaneError(501, 'preview needs dispatch resolution for the PR version');
             }
-            const canonical = await admin.exportScope(actor, tenantId, source.id);
+            const canonical = await c.var.admin.exportScope(actor, tenantId, source.id);
             const tables = sourceClient ? await sourceClient.exportScope(source.id) : canonical.tables;
             // Directory row FIRST as `provisioning` (K-31 two-phase): a crash before the data
             // copy leaves an inert row that — carrying `forkedFrom` + `expiresAt` — the GC sweep
@@ -6028,10 +6151,10 @@ export function createControlPlaneApi(options) {
             // seats, so a provision that throws can leave a `provisioning` row too. A provision
             // that never wrote one (the tag's slug taken by a racing create) marks nothing: the
             // write below targets this create's own id, which does not exist, and is swallowed.
-            await options.host.provisionScope(actor, row);
+            await c.var.host.provisionScope(actor, row);
             if (restore)
                 await restoreOrRecord(restore);
-            await admin.activateScope(actor, tenantId, previewId);
+            await c.var.admin.activateScope(actor, tenantId, previewId);
         }
         catch (e) {
             // Expire the row this create left behind, so the next create reaps it at once rather
@@ -6039,7 +6162,7 @@ export function createControlPlaneApi(options) {
             // CLI's retry after a known-dead attempt (#1918). The row stays until then, or until
             // the GC sweep's next pass reaps it as expired; the #559 ops-failure row outlives both.
             // Best-effort: if this write fails too, the age bound still frees the tag.
-            await admin
+            await c.var.admin
                 .setScopeExpiresAt(actor, tenantId, previewId, new Date().toISOString())
                 .catch(() => undefined);
             throw e;
@@ -6047,8 +6170,8 @@ export function createControlPlaneApi(options) {
         // Bind the PR version. A private vertical's push self-admitted, so this is accepted; a
         // preview scope also admits a pending version (#513), which is what a clean-room rehearsal
         // of not-yet-admitted code needs.
-        await admin.bindScopeVersion(actor, tenantId, previewId, opts.versionId);
-        const hostname = await bindPreviewHostname(actor, baseHostname, tenantId, previewId, opts.tag, surface);
+        await c.var.admin.bindScopeVersion(actor, tenantId, previewId, opts.versionId);
+        const hostname = await bindPreviewHostname(c.var.admin, actor, baseHostname, tenantId, previewId, opts.tag, surface);
         await assertServesBoundVersion(previewId);
         const auth = await wireLogin(previewId, hostname, source);
         return {
@@ -6095,7 +6218,7 @@ export function createControlPlaneApi(options) {
         // Everything else forks the tenant's own active, non-fork scope for this vertical.
         let source = null;
         if (!body.empty) {
-            const owned = (await admin.listScopes(actor, { tenantId, vertical: slug, status: ['active'] })).filter((s) => !s.forkedFrom && s.kind !== 'preview');
+            const owned = (await c.var.admin.listScopes(actor, { tenantId, vertical: slug, status: ['active'] })).filter((s) => !s.forkedFrom && s.kind !== 'preview');
             source = body.sourceScopeId
                 ? (owned.find((s) => s.id === body.sourceScopeId) ?? null)
                 : owned.length === 1
@@ -6127,12 +6250,12 @@ export function createControlPlaneApi(options) {
             return c.json({ error: gate.error }, gate.status);
         const { tenantId, slug } = gate;
         const actor = c.get('actor');
-        const previews = (await admin.listScopes(actor, { tenantId, vertical: slug }))
+        const previews = (await c.var.admin.listScopes(actor, { tenantId, vertical: slug }))
             .filter((s) => s.kind === 'preview')
             .sort((a, b) => ((a.forkedAt ?? '') < (b.forkedAt ?? '') ? 1 : -1));
         const out = [];
         for (const s of previews) {
-            const hosts = await admin.listHostnames(actor, { scopeId: s.id });
+            const hosts = await c.var.admin.listHostnames(actor, { scopeId: s.id });
             out.push({
                 scopeId: s.id,
                 tag: s.slug?.split('--').at(-1) ?? null,
@@ -6154,7 +6277,7 @@ export function createControlPlaneApi(options) {
         const { tenantId, slug } = gate;
         const tag = c.req.param('tag');
         const actor = c.get('actor');
-        const preview = (await admin.listScopes(actor, { tenantId, vertical: slug })).find((s) => s.kind === 'preview' && s.slug === previewSlug(slug, tag));
+        const preview = (await c.var.admin.listScopes(actor, { tenantId, vertical: slug })).find((s) => s.kind === 'preview' && s.slug === previewSlug(slug, tag));
         // Idempotent: an already-reaped (or never-created) preview is a no-op success, so a
         // PR-close job never fails because the preview was already gone.
         if (!preview)
@@ -6183,7 +6306,7 @@ export function createControlPlaneApi(options) {
             source: c.req.query('source'),
         });
         const page = pageParams(c);
-        const entries = await admin.listRoles(c.get('actor'), { ...filter, ...page });
+        const entries = await c.var.admin.listRoles(c.get('actor'), { ...filter, ...page });
         // Composite sort key (tenant_id, role_key) — the `|` join is the documented
         // cursor shape (scope-host.ts listRoles).
         return c.json(pageOf(entries, page.limit, (r) => `${r.tenantId}|${r.key}`));
@@ -6209,7 +6332,7 @@ export function createControlPlaneApi(options) {
         // The whole node comes from the path. Pinning only the tenant would pin
         // nothing — see the schema's note: a node carrying a scope is written to that
         // scope's DO directly, with no tenant cross-check below.
-        await admin.assignRole(c.get('actor'), {
+        await c.var.admin.assignRole(c.get('actor'), {
             principalId: body.principalId,
             roleKey: body.roleKey,
             node: { tenantId, scopeId: null },
@@ -6222,7 +6345,7 @@ export function createControlPlaneApi(options) {
         // Tombstones rather than deletes (K-21) and is idempotent — unassigning what
         // was never assigned is a silent no-op, so a retry is safe. Node from the
         // path, for the same reason as the assign above.
-        await admin.unassignRole(c.get('actor'), {
+        await c.var.admin.unassignRole(c.get('actor'), {
             principalId: body.principalId,
             roleKey: body.roleKey,
             node: { tenantId, scopeId: null },
@@ -6262,11 +6385,11 @@ export function createControlPlaneApi(options) {
         const body = systemSwitchBody.parse(await c.req.json());
         const actor = c.get('actor');
         // K-3 first, so a scope of another tenant reads as absent before anything is reached.
-        if (!(await admin.getScopeRecord(actor, tenantId, scopeId))) {
+        if (!(await c.var.admin.getScopeRecord(actor, tenantId, scopeId))) {
             return c.json({ error: `unknown scope for tenant: (${tenantId}, ${scopeId})` }, 404);
         }
         const input = { moduleId: body.moduleId, node: { tenantId, scopeId }, reason: body.reason };
-        return c.json(to === 'off' ? await admin.revokeFromSystem(actor, input) : await admin.restoreToSystem(actor, input));
+        return c.json(to === 'off' ? await c.var.admin.revokeFromSystem(actor, input) : await c.var.admin.restoreToSystem(actor, input));
     };
     app.delete('/tenants/:tenantId/scopes/:scopeId/system-grants', switchScheduleRoute('off'));
     app.post('/tenants/:tenantId/scopes/:scopeId/system-grants', switchScheduleRoute('on'));
@@ -6283,10 +6406,10 @@ export function createControlPlaneApi(options) {
         const scopeId = scopeIdSchema.parse(c.req.param('scopeId'));
         const actor = c.get('actor');
         // K-3 first, so a scope of another tenant reads as absent before anything is reached.
-        if (!(await admin.getScopeRecord(actor, tenantId, scopeId))) {
+        if (!(await c.var.admin.getScopeRecord(actor, tenantId, scopeId))) {
             return c.json({ error: `unknown scope for tenant: (${tenantId}, ${scopeId})` }, 404);
         }
-        return c.json(await admin.systemGrantsStatus(actor, { tenantId, scopeId }));
+        return c.json(await c.var.admin.systemGrantsStatus(actor, { tenantId, scopeId }));
     });
     // The fleet read (#1674): every scope with a module switched off, from the directory's
     // record of the switch, so it needs no walk of every scope's store. The record is not the
@@ -6312,7 +6435,7 @@ export function createControlPlaneApi(options) {
             order: c.req.query('order'),
         });
         const { position, ...rest } = q;
-        const entries = await admin.listSystemSwitches(c.get('actor'), {
+        const entries = await c.var.admin.listSystemSwitches(c.get('actor'), {
             ...rest,
             ...(position === 'all' ? {} : { position }),
         });
@@ -6341,11 +6464,11 @@ export function createControlPlaneApi(options) {
         const body = peerSwitchBody.parse(await c.req.json());
         const actor = c.get('actor');
         // K-3 first, so a scope of another tenant reads as absent before anything is reached.
-        if (!(await admin.getScopeRecord(actor, tenantId, scopeId))) {
+        if (!(await c.var.admin.getScopeRecord(actor, tenantId, scopeId))) {
             return c.json({ error: `unknown scope for tenant: (${tenantId}, ${scopeId})` }, 404);
         }
         const input = { vertical: body.vertical, node: { tenantId, scopeId }, reason: body.reason };
-        return c.json(to === 'off' ? await admin.revokeFromPeer(actor, input) : await admin.restoreToPeer(actor, input));
+        return c.json(to === 'off' ? await c.var.admin.revokeFromPeer(actor, input) : await c.var.admin.restoreToPeer(actor, input));
     };
     app.delete('/tenants/:tenantId/scopes/:scopeId/peer-grants', switchPeerRoute('off'));
     app.post('/tenants/:tenantId/scopes/:scopeId/peer-grants', switchPeerRoute('on'));
@@ -6359,22 +6482,22 @@ export function createControlPlaneApi(options) {
         if (pin !== null && pin !== tenantId)
             return c.json({ error: 'forbidden' }, 403);
         const actor = c.get('actor');
-        if (!(await admin.getScopeRecord(actor, tenantId, scopeId))) {
+        if (!(await c.var.admin.getScopeRecord(actor, tenantId, scopeId))) {
             return c.json({ error: `unknown scope for tenant: (${tenantId}, ${scopeId})` }, 404);
         }
-        return c.json(await admin.peerGrantsStatus(actor, { tenantId, scopeId }));
+        return c.json(await c.var.admin.peerGrantsStatus(actor, { tenantId, scopeId }));
     });
     // Orgs: the portal-customer grouping (§4.1). Creating one mints no permission —
     // members reach what the org was GRANTED, and granting stays off this surface.
     app.post('/tenants/:tenantId/orgs', async (c) => {
         const tenantId = tenantIdSchema.parse(c.req.param('tenantId'));
         const body = tenantOrgBody.parse(await c.req.json());
-        await admin.createOrg(c.get('actor'), { ...body, tenantId });
+        await c.var.admin.createOrg(c.get('actor'), { ...body, tenantId });
         return c.body(null, 201);
     });
     app.get('/tenants/:tenantId/orgs', async (c) => {
         const tenantId = tenantIdSchema.parse(c.req.param('tenantId'));
-        return c.json(await admin.listOrgs(c.get('actor'), tenantId));
+        return c.json(await c.var.admin.listOrgs(c.get('actor'), tenantId));
     });
     // -- the admin log (§4.4/§4.5) ---------------------------------------------
     app.get('/admin-log', async (c) => {
@@ -6389,7 +6512,7 @@ export function createControlPlaneApi(options) {
             cursor: c.req.query('cursor'),
             order: c.req.query('order'),
         });
-        const entries = await admin.auditLog(c.get('actor'), filter);
+        const entries = await c.var.admin.auditLog(c.get('actor'), filter);
         // The cursor IS the last entry's id (ULID order is chronological), so the
         // page carries its own continuation and the console never assembles one.
         return c.json(pageOf(entries, filter.limit, (e) => e.id));
@@ -6415,7 +6538,7 @@ export function createControlPlaneApi(options) {
             cursor: c.req.query('cursor'),
             order: c.req.query('order'),
         });
-        const entries = await admin.listOpsFailures(c.get('actor'), filter);
+        const entries = await c.var.admin.listOpsFailures(c.get('actor'), filter);
         return c.json(pageOf(entries, filter.limit, (e) => e.id));
     });
     // -- sweep runs (#1232): the durable record of what a sweep pass touched -------
@@ -6437,7 +6560,7 @@ export function createControlPlaneApi(options) {
             cursor: c.req.query('cursor'),
             order: c.req.query('order'),
         });
-        const entries = await admin.listSweepRuns(c.get('actor'), filter);
+        const entries = await c.var.admin.listSweepRuns(c.get('actor'), filter);
         return c.json(pageOf(entries, filter.limit, (e) => e.id));
     });
     // -- the replay lever (#1705 PR 3): move a consumer's watermark on one edge ----
@@ -6462,10 +6585,10 @@ export function createControlPlaneApi(options) {
         const move = importCursorMove.parse(raw);
         const actor = c.get('actor');
         // K-3 first, so a scope of another tenant reads as absent before anything is reached.
-        if (!(await admin.getScopeRecord(actor, tenantId, scopeId))) {
+        if (!(await c.var.admin.getScopeRecord(actor, tenantId, scopeId))) {
             return c.json({ error: `unknown scope for tenant: (${tenantId}, ${scopeId})` }, 404);
         }
-        return c.json(await admin.moveImportCursor(actor, tenantId, scopeId, move));
+        return c.json(await c.var.admin.moveImportCursor(actor, tenantId, scopeId, move));
     });
     // -- edge health (#1705 PR 3): where each cross-vertical edge of one tenant stands -
     // Read live, through the phase's own reach, so it cannot disagree with the next pass about
@@ -6478,7 +6601,7 @@ export function createControlPlaneApi(options) {
         if (pin !== null && pin !== tenantId)
             return c.json({ error: 'forbidden' }, 403);
         const focus = c.req.query('scopeId');
-        return c.json(await crossVerticalHealth(host, {
+        return c.json(await crossVerticalHealth(c.var.host, {
             actor: c.get('actor'),
             tenantId,
             ...(focus ? { focus: scopeIdSchema.parse(focus) } : {}),
@@ -6496,7 +6619,7 @@ export function createControlPlaneApi(options) {
             code: c.req.query('code'),
             limit: c.req.query('limit'),
         });
-        const entries = await admin.listIssues(c.get('actor'), filter);
+        const entries = await c.var.admin.listIssues(c.get('actor'), filter);
         // No cursor, deliberately — see issuesQuery. `entries` alone, so a client
         // never walks a continuation that cannot exist.
         return c.json({ entries });
@@ -6506,7 +6629,7 @@ export function createControlPlaneApi(options) {
     // rather than an invented row.
     app.put('/issues/status', async (c) => {
         const input = issueStatusUpdate.parse(await c.req.json());
-        const updated = await admin.setIssueStatus(c.get('actor'), input.fingerprint, input.status);
+        const updated = await c.var.admin.setIssueStatus(c.get('actor'), input.fingerprint, input.status);
         if (!updated)
             return c.json({ error: 'unknown issue fingerprint' }, 404);
         return c.json(updated);
@@ -6527,7 +6650,7 @@ export function createControlPlaneApi(options) {
             cursor: c.req.query('cursor'),
             order: c.req.query('order'),
         });
-        const entries = await admin.listModelUsage(c.get('actor'), filter);
+        const entries = await c.var.admin.listModelUsage(c.get('actor'), filter);
         return c.json(pageOf(entries, filter.limit, (e) => e.id));
     });
     // Folded per (tenant, vertical, model) with the platform's margin applied at read
@@ -6541,7 +6664,7 @@ export function createControlPlaneApi(options) {
         const now = new Date();
         const since = q.since ?? new Date(Date.UTC(now.getUTCFullYear(), now.getUTCMonth(), 1)).toISOString();
         const until = q.until ?? now.toISOString();
-        const summary = await admin.summarizeModelUsage(c.get('actor'), { ...(q.tenantId ? { tenantId: q.tenantId } : {}), since, until }, options.modelMarginPercent ?? DEFAULT_MODEL_MARGIN_PERCENT);
+        const summary = await c.var.admin.summarizeModelUsage(c.get('actor'), { ...(q.tenantId ? { tenantId: q.tenantId } : {}), since, until }, options.modelMarginPercent ?? DEFAULT_MODEL_MARGIN_PERCENT);
         return c.json(summary);
     });
     return app;