@substrat-run/control-plane-api 0.139.0 → 0.141.0

package/dist/api.js

@@ -1,15 +1,18 @@
 import { resolveObservabilityWindow } from './observability-window.js';
 import { Hono } from 'hono';
-import { parseHostname, withLabel, RESERVED_LABEL_SEPARATOR, adminAction, ownerTransferInput, OWNER_TRANSFER_AUDIT_ERROR_MAX, memberInviteInput, memberRoleInput, ASSET_PART_PREFIX, assetHash, channelName, connectionActivity, connectionActivitySource, connectionCredential, connectionFilter, connectionHealthState, connectionProvider, connectorDispatchKind, PROVISION_SIBLING_KIND, ARCHIVE_SCOPE_KIND, PROVISION_TENANT_KIND, SET_ENTITLEMENTS_KIND, MODEL_USAGE_KIND, SWEEP_RUNS_KIND, toConnectionHealthEntry, CONNECTION_EXPIRY_WARNING_DAYS, CONNECTION_STALE_DAYS, connectionProbe, createTenantInput, entitlementGrantInput, hostname as hostnameSchema, hostnameRegion, hostnameStatus, identityLink, errorCode, issueStatus, issueStatusInput, findingKind, findingRuleInput, findingStatus, findingStatusInput, listPageQuery, matchesOutboundHost, pageOf, platformRequestFilter, principalId as principalIdSchema, impersonationStamp, promotionAcknowledgement, bindAcknowledgement, provisionableJurisdiction, publishVersionInput, queryScopeInput, readScopeTableInput, entityHistoryInput, eventFacetInput, eventCauseInput, eventEffectsInput, invocationEventsInput, deadLettersInput, lifecycleFlowInput, operationSeriesCount, operationSeriesInput, delegatedReadParams, createOrgInput, roleKey as roleKeySchema, peerSwitch, systemSwitch, DEFAULT_DENIAL_LIMIT, DENIAL_LIMIT_MAX, denialGroupBy, registerVerticalInput, platformScriptCollision, platformScriptRefusal, PLATFORM_SCRIPT_NAMES, serviceDimensions, sweepRunKind, sweepRunOutcome, scopeDump, dataSubjectId as dataSubjectIdSchema, scopeId as scopeIdSchema, scopeStatus, storageShape, surfaceName, tenantId as tenantIdSchema, tenantStatus, versionOrigin, z, PROBLEM_CONTENT_TYPE, toProblem, redrainEventsInput, importCursorMove, importCursorAcknowledgementMissing, REDRAIN_BATCH, migrationsOnTop, errorCodeOf, capabilityFilterQuery, PLATFORM_FEATURES_HEADER, PLATFORM_FEATURE_SCOPE_SWEEPER, } from '@substrat-run/contracts';
+import { parseHostname, withLabel, RESERVED_LABEL_SEPARATOR, adminAction, ownerTransferInput, memberInviteInput, memberRoleInput, ASSET_PART_PREFIX, assetHash, channelName, connectLinkId, connectionActivity, connectionActivitySource, connectionCredential, connectionCertificate, connectionFilter, connectionHealthState, connectionProvider, connectorDispatchKind, PROVISION_SIBLING_KIND, ARCHIVE_SCOPE_KIND, PROVISION_TENANT_KIND, SET_ENTITLEMENTS_KIND, MODEL_USAGE_KIND, SWEEP_RUNS_KIND, toConnectionHealthEntry, CONNECTION_EXPIRY_WARNING_DAYS, CONNECTION_STALE_DAYS, connectionProbe, createTenantInput, entitlementGrantInput, hostname as hostnameSchema, hostnameRegion, hostnameStatus, identityLink, errorCode, issueStatus, issueStatusInput, findingKind, findingRuleInput, findingStatus, findingStatusInput, listPageQuery, matchesOutboundHost, pageOf, platformRequestFilter, principalId as principalIdSchema, impersonationStamp, promotionAcknowledgement, bindAcknowledgement, provisionableJurisdiction, publishVersionInput, queryScopeInput, readScopeTableInput, entityHistoryInput, eventFacetInput, eventCauseInput, eventEffectsInput, invocationEventsInput, deadLettersInput, lifecycleFlowInput, operationSeriesCount, operationSeriesInput, delegatedReadParams, createOrgInput, roleKey as roleKeySchema, peerSwitch, verticalSlug, systemSwitch, DEFAULT_DENIAL_LIMIT, DENIAL_LIMIT_MAX, denialGroupBy, registerVerticalInput, platformScriptCollision, platformScriptRefusal, PLATFORM_SCRIPT_NAMES, serviceDimensions, sweepRunKind, sweepRunOutcome, scopeDump, dataSubjectId as dataSubjectIdSchema, scopeId as scopeIdSchema, scopeStatus, storageShape, surfaceName, tenantId as tenantIdSchema, tenantStatus, versionOrigin, z, PROBLEM_CONTENT_TYPE, toProblem, redrainEventsInput, importCursorMove, importCursorAcknowledgementMissing, REDRAIN_BATCH, migrationsOnTop, errorCodeOf, capabilityFilterQuery, PLATFORM_FEATURES_HEADER, PLATFORM_FEATURE_SCOPE_SWEEPER, } from '@substrat-run/contracts';
+import { SCOPE_COPY_LEASE_MS, copyRestoreFence } from '@substrat-run/kernel';
 import { attributeFailure } from './failure-attribution.js';
-import { BIND_EXPORT_BREAK_REFUSAL, CARRIED_AWAY_KEY, bindExportBreakRefusal, carriedAwayDump, dumpMetaValue, metaValueIn, crossVerticalHealth, exportBreakRefusal, isBindExportBreakRefusal, isExportBreakRefusal, isPrimaryScope, migrationProgress, ulid, } from '@substrat-run/kernel';
+import { auditedChange, withAuditedOutcomes } from './audited-change.js';
+import { BIND_EXPORT_BREAK_REFUSAL, CARRIED_AWAY_KEY, bindExportBreakRefusal, carriedAwayDump, dumpMetaValue, metaValueIn, crossVerticalHealth, exportBreakRefusal, isBindExportBreakRefusal, isExportBreakRefusal, isPrimaryScope, migrationProgress, ulid, auditWarningOf, } from '@substrat-run/kernel';
 import { TENANT_HEADER, confinedTenant } from './auth.js';
 import { mintTenantToken } from './tenant-token.js';
 import { connectionGrantsForScope } from './vertical-client.js';
+import { assertNoUnreachableScopeCopies, listAllScopeScriptCopies, reapScopeScriptCopies, recordStrandedStorage } from './scope-copy-cleanup.js';
 import { oidcCallbackUrl, retireClientsOfReapedScope, wirePreviewAuth } from './preview-auth.js';
 import { versionReachedAt } from './scope-deployment.js';
 import { reconcileConnectionGrants } from './connection-grants.js';
-import { reconcileThenReassert, switchCarryFor } from './reconcile.js';
+import { reconcileThenReassert, reviewedEntityGrants, switchCarryFor } from './reconcile.js';
 import { ConnectionRelayError, relayConnectionUpsert } from './connection-relay.js';
 import { ControlPlaneError } from '@substrat-run/control-plane-client';
 import { provisionSiblingScope } from './platform-drain.js';
@@ -595,7 +598,16 @@ const TENANT_ROUTES = [
     { method: 'DELETE', re: /\/tenants\/[^/]+\/connections\/[^/]+$/, pin: 'path' },
     { method: 'GET', re: /\/tenants\/[^/]+\/connections\/[^/]+\/activity$/, pin: 'path' },
     { method: 'GET', re: /\/tenants\/[^/]+\/connections\/[^/]+\/credential$/, pin: 'path' },
+    // #2100: the PUBLIC certificate a connection signs in with — same pin as the credential view.
+    { method: 'GET', re: /\/tenants\/[^/]+\/connections\/[^/]+\/certificate$/, pin: 'path' },
     { method: 'POST', re: /\/tenants\/[^/]+\/connections\/[^/]+\/verify$/, pin: 'path' },
+    // A vertical's mailed connect links (connections.md §3.5.4): the consent landing's liveness
+    // read, the callback's spend and its undo, and the integrations card's list and revoke.
+    { method: 'GET', re: /\/tenants\/[^/]+\/connect-links$/, pin: 'path' },
+    { method: 'GET', re: /\/tenants\/[^/]+\/connect-links\/[^/]+$/, pin: 'path' },
+    { method: 'POST', re: /\/tenants\/[^/]+\/connect-links\/[^/]+\/consume$/, pin: 'path' },
+    { method: 'POST', re: /\/tenants\/[^/]+\/connect-links\/[^/]+\/restore$/, pin: 'path' },
+    { method: 'DELETE', re: /\/tenants\/[^/]+\/connect-links\/[^/]+$/, pin: 'path' },
     // Members: identity links mirrored from the dashboard, orgs, role assignments.
     { method: 'GET', re: /\/tenants\/[^/]+\/identities$/, pin: 'path' },
     { method: 'PUT', re: /\/tenants\/[^/]+\/identities$/, pin: 'path' },
@@ -633,6 +645,8 @@ const TENANT_ROUTES = [
     { method: 'GET', re: /\/tenants\/[^/]+\/scopes\/[^/]+\/migrations$/, pin: 'path' },
     { method: 'GET', re: /\/tenants\/[^/]+\/scopes\/[^/]+\/owner-seat$/, pin: 'path' },
     { method: 'GET', re: /\/tenants\/[^/]+\/scopes\/[^/]+\/peer-grants$/, pin: 'path' },
+    { method: 'GET', re: /\/tenants\/[^/]+\/scopes\/[^/]+\/peer-bindings$/, pin: 'path' },
+    { method: 'PUT', re: /\/tenants\/[^/]+\/scopes\/[^/]+\/peer-bindings$/, pin: 'path' },
     // The peer switch (#1706): on is POST, off is DELETE, on the tenant's own scope.
     { method: 'POST', re: /\/tenants\/[^/]+\/scopes\/[^/]+\/peer-grants$/, pin: 'path' },
     { method: 'DELETE', re: /\/tenants\/[^/]+\/scopes\/[^/]+\/peer-grants$/, pin: 'path' },
@@ -684,6 +698,7 @@ const TENANT_ROUTES = [
     { method: 'GET', re: /\/observability\/tenant-metrics$/, pin: 'query' },
     { method: 'GET', re: /\/observability\/tenant-metrics-series$/, pin: 'query' },
     { method: 'GET', re: /\/observability\/tenant-logs$/, pin: 'query' },
+    { method: 'GET', re: /\/observability\/tenant-field-coverage$/, pin: 'query' },
     // #1746: the request record's histogram, facets and list — same grain, same forced tenant.
     { method: 'GET', re: /\/observability\/tenant-request-volume$/, pin: 'query' },
     { method: 'GET', re: /\/observability\/tenant-request-facets$/, pin: 'query' },
@@ -786,6 +801,7 @@ const namedTenants = (c) => {
  */
 export function createControlPlaneApi(options) {
     const { host, authenticate, authenticateBuilder, authenticateTenantService } = options;
+    const copyLeaseMs = options.copyLeaseMs ?? SCOPE_COPY_LEASE_MS;
     const app = new Hono();
     // The CLI version advisory (#971), stamped on EVERY response — including the 401 the
     // auth middleware below answers with, since a CLI too old to authenticate is exactly
@@ -947,6 +963,7 @@ export function createControlPlaneApi(options) {
         { method: 'GET', re: /\/observability\/tenant-metrics$/ },
         { method: 'GET', re: /\/observability\/tenant-metrics-series$/ },
         { method: 'GET', re: /\/observability\/tenant-logs$/ },
+        { method: 'GET', re: /\/observability\/tenant-field-coverage$/ },
         // #1746: the same lines, counted and listed. Tenant-keyed, so no fleet-wide fallback.
         { method: 'GET', re: /\/observability\/tenant-request-volume$/ },
         { method: 'GET', re: /\/observability\/tenant-request-facets$/ },
@@ -1588,7 +1605,7 @@ export function createControlPlaneApi(options) {
             return c.json({ error: 'body tenantId disagrees with the route tenant' }, 400);
         }
         try {
-            return c.json(await relayConnectionUpsert(c.var.host, c.get('actor'), { ...body, tenantId }, { probeCandidate }));
+            return c.json(await relayConnectionUpsert(c.var.host, c.get('actor'), { ...body, tenantId }, { probeCandidate, prepareCandidate }));
         }
         catch (err) {
             if (err instanceof ConnectionRelayError && err.status < 500) {
@@ -1618,6 +1635,80 @@ export function createControlPlaneApi(options) {
             await c.var.admin.revokeConnection(c.get('actor'), row.id);
         return c.body(null, 204);
     });
+    // -- a vertical's mailed connect links, tenant-scoped (connections.md §3.5.4) ---------
+    //
+    // The dashboard's half of a link a VERTICAL minted (`/internal/connections/connect-links`):
+    // its consent landing asks whether the row still stands, its callback spends the row
+    // before storing and restores it if the store fails, and its integrations card lists and
+    // revokes them. The tenant is the path's; the scope is named on every call and is half
+    // the store's key, so another scope's link — or another tenant's — reads as absent (K-3).
+    // Not in BUILDER_ROUTES: a builder has no business spending a tenant's consent round.
+    const connectLinkScope = z.object({ scopeId: scopeIdSchema });
+    app.get('/tenants/:tenantId/connect-links', async (c) => {
+        const tenantId = tenantIdSchema.parse(c.req.param('tenantId'));
+        const q = connectLinkScope
+            .extend({ provider: connectionProvider.optional(), outstanding: z.literal('1').optional() })
+            .parse({
+            scopeId: c.req.query('scopeId'),
+            provider: c.req.query('provider') || undefined,
+            outstanding: c.req.query('outstanding') || undefined,
+        });
+        return c.json(await c.var.admin.listConnectLinks(c.get('actor'), {
+            tenantId,
+            scopeId: q.scopeId,
+            ...(q.provider ? { provider: q.provider } : {}),
+            ...(q.outstanding ? { outstandingOnly: true } : {}),
+        }));
+    });
+    app.get('/tenants/:tenantId/connect-links/:linkId', async (c) => {
+        const tenantId = tenantIdSchema.parse(c.req.param('tenantId'));
+        const { scopeId } = connectLinkScope.parse({ scopeId: c.req.query('scopeId') });
+        const link = await c.var.admin.getConnectLink(c.get('actor'), {
+            tenantId,
+            scopeId,
+            id: connectLinkId.parse(c.req.param('linkId')),
+        });
+        return link ? c.json(link) : c.json({ error: 'unknown connect link' }, 404);
+    });
+    // The callback's spend. A refusal is a 200 carrying the typed reason, not an error status:
+    // "already used" is the answer to the question asked, and the callback renders each one.
+    app.post('/tenants/:tenantId/connect-links/:linkId/consume', async (c) => {
+        const tenantId = tenantIdSchema.parse(c.req.param('tenantId'));
+        const body = connectLinkScope
+            .extend({
+            provider: connectionProvider,
+            accountRef: z.string().max(256).optional(),
+            accountLabel: z.string().max(256).optional(),
+        })
+            .parse(await c.req.json());
+        return c.json(await c.var.admin.consumeConnectLink(c.get('actor'), {
+            ...body,
+            tenantId,
+            id: connectLinkId.parse(c.req.param('linkId')),
+        }));
+    });
+    app.post('/tenants/:tenantId/connect-links/:linkId/restore', async (c) => {
+        const tenantId = tenantIdSchema.parse(c.req.param('tenantId'));
+        const { scopeId } = connectLinkScope.parse(await c.req.json());
+        const restored = await c.var.admin.restoreConnectLink(c.get('actor'), {
+            tenantId,
+            scopeId,
+            id: connectLinkId.parse(c.req.param('linkId')),
+        });
+        return c.json({ restored });
+    });
+    // Idempotent, as the store is: a revoked or spent link answers 204 again. 404 only for a
+    // link this scope never held.
+    app.delete('/tenants/:tenantId/connect-links/:linkId', async (c) => {
+        const tenantId = tenantIdSchema.parse(c.req.param('tenantId'));
+        const { scopeId } = connectLinkScope.parse({ scopeId: c.req.query('scopeId') });
+        const link = await c.var.admin.revokeConnectLink(c.get('actor'), {
+            tenantId,
+            scopeId,
+            id: connectLinkId.parse(c.req.param('linkId')),
+        });
+        return link ? c.body(null, 204) : c.json({ error: 'unknown connect link' }, 404);
+    });
     /**
      * The tenant-scoped connection lookup the two inspection routes share. Same K-3
      * existence hiding as the revoke above — a foreign tenant's connection id reads
@@ -1630,6 +1721,8 @@ export function createControlPlaneApi(options) {
      * in which case the upsert behaves exactly as it always did, storing unverified.
      */
     const probeCandidate = async (provider, secret) => options.connectionInspectors?.[provider]?.probeCandidate?.(secret);
+    /** #2100: the provider's own half of a credential, made before the probe sees it. */
+    const prepareCandidate = (provider) => options.connectionInspectors?.[provider]?.prepareCandidate;
     const inspectableConnection = async (c) => {
         const tenantId = tenantIdSchema.parse(c.req.param('tenantId'));
         const id = c.req.param('id');
@@ -1703,6 +1796,20 @@ export function createControlPlaneApi(options) {
         }
         return c.json(connectionCredential.parse(await credential(c.var.host, row)));
     });
+    /**
+     * The public certificate a connection signs in with (#2100) — what the tenant downloads and
+     * uploads to the provider. Public by construction: the private key never leaves the sealed
+     * credential, and only a provider whose keypair the platform generates has one at all.
+     */
+    app.get('/tenants/:tenantId/connections/:id/certificate', async (c) => {
+        const row = await inspectableConnection(c);
+        if (!row)
+            return c.json({ error: 'unknown connection' }, 404);
+        const certificate = await options.connectionInspectors?.[row.provider]?.certificate?.(c.var.host, row);
+        if (!certificate)
+            return c.json({ error: 'this connection signs in with no certificate' }, 404);
+        return c.json(connectionCertificate.parse(certificate));
+    });
     // -- the scope directory (§3.2/§4.2) ---------------------------------------
     app.get('/scopes', async (c) => {
         const p = c.get('principal');
@@ -1962,6 +2069,7 @@ export function createControlPlaneApi(options) {
             exact: source.exact,
             loadStamp: source.loadStamp,
             expect: source.expect,
+            ...(source.fence ? { fence: source.fence } : {}),
             ...(markCopy ? { markCopy } : {}),
         }));
     };
@@ -1999,13 +2107,9 @@ export function createControlPlaneApi(options) {
         if (!source || !dest) {
             throw new ControlPlaneError(501, 'adopt-serving needs dispatch resolution for both ends');
         }
-        const dump = await source.exportScope(scopeId);
         // #1742: the recorded OFF positions ride the restore, applied in the replay's own event.
-        const restored = await restoreCarryingSwitches(actor, dest, tenantId, scopeId, dump, { scopeId, exact: true });
-        // Data landed — only now flip routing and move the version pointer.
-        await c.var.admin
-            .setScopeServingRef(actor, tenantId, scopeId, serving.ref, { acknowledge: opts.acknowledge })
-            .catch(relayHostRefusal);
+        // Data landed — only then does routing flip and the version pointer move.
+        const restored = await moveOntoServing(c, scope, source, dest, serving.ref, { acknowledge: opts.acknowledge });
         await c.var.admin
             .bindScopeVersion(actor, tenantId, scopeId, serving.versionId, { acknowledge: opts.acknowledge })
             .catch(relayHostRefusal);
@@ -2085,8 +2189,9 @@ export function createControlPlaneApi(options) {
      * independent, and the scope's DO carries the SOURCE lineage's applied-migration
      * journal. The digest gate refuses the crossing unless the scope's bound version and
      * the target's serving version carry the same migration digest — or the operator
-     * acknowledges having read both surfaces (`ackMigrations`). The source script's copy
-     * is never deleted — flipping `servingRef` + version back is the backout.
+     * acknowledges having read both surfaces (`ackMigrations`). Once the move is confirmed the
+     * source script's copy is wiped by the sweep (#1722, `moveOntoServing`), so it is no backout:
+     * rollback is an explicit snapshot or backup taken before the rebind.
      */
     const rebindScopeOntoVertical = async (c, tenantId, scopeId, target, opts) => {
         const actor = c.get('actor');
@@ -2118,10 +2223,25 @@ export function createControlPlaneApi(options) {
         const move = { acknowledge: opts.acknowledge };
         if (opts.abandonData) {
             // Directory-only crossing: no bytes move, so the frontier gate has nothing to
-            // protect — the target provisions its own schema from scratch. The source
-            // script's copy is untouched and remains the backout, same as a carried rebind.
-            // The scope serves nothing until `/verticals/:slug/instances` re-provisions it.
-            await c.var.admin.setScopeServingRef(actor, tenantId, scopeId, serving.ref, move).catch(relayHostRefusal);
+            // protect — the target provisions its own schema from scratch. The source script's
+            // copy is the only copy of the scope's data, and its deployment predates the export a
+            // fenced wipe needs, so it is kept (`retained`), never swept, and reap and erasure still
+            // reach it. The scope serves nothing until `/verticals/:slug/instances` re-provisions it.
+            const sourceRef = await routeOf(c, scope);
+            const moveId = sourceRef && sourceRef !== serving.ref ? ulid() : null;
+            if (moveId && sourceRef) {
+                await c.var.admin.recordScopeScriptCopy(actor, tenantId, scopeId, sourceRef, moveId, { role: 'source' });
+            }
+            try {
+                const erasureEpoch = await c.var.admin.scopeErasureEpoch(actor, tenantId, scopeId);
+                await c.var.admin.setScopeServingRef(actor, tenantId, scopeId, serving.ref, {
+                    ...move, expectedErasureEpoch: erasureEpoch, ...(moveId ? { confirmMove: { moveId, source: 'retained' } } : {}),
+                }).catch(relayHostRefusal);
+            }
+            finally {
+                if (moveId)
+                    await c.var.admin.settleScopeScriptCopy(actor, tenantId, scopeId, sourceRef, moveId, 'retained');
+            }
             await c.var.admin.bindScopeVersion(actor, tenantId, scopeId, serving.versionId, move).catch(relayHostRefusal);
             return { servingRef: serving.ref, versionId: serving.versionId, dataAbandoned: true };
         }
@@ -2144,18 +2264,68 @@ export function createControlPlaneApi(options) {
         if (!source || !dest) {
             throw new ControlPlaneError(501, 'rebind-vertical needs dispatch resolution for both ends');
         }
-        const dump = await source.exportScope(scopeId);
-        const restored = await restoreCarryingSwitches(actor, dest, tenantId, scopeId, dump, { scopeId, exact: true }); // #1742, as adopt
-        // Data landed on the target script — only now flip routing and cross the pointer.
-        // `bindScopeVersion` rewrites `scopes.vertical` from the version row, audited. No
-        // extra snapshot here (adopt-serving's precedent): the source script's copy is the
-        // pre-migration state, and it is never deleted — that copy is the backout.
-        await c.var.admin.setScopeServingRef(actor, tenantId, scopeId, serving.ref, move).catch(relayHostRefusal);
+        // #1742, as adopt. Data landed on the target script — only then do routing flip and the
+        // pointer cross. `bindScopeVersion` rewrites `scopes.vertical` from the version row, audited.
+        // No snapshot is taken here: the old copy is swept once the move is confirmed, so an
+        // operator who wants a way back takes a snapshot or backup first.
+        const restored = await moveOntoServing(c, scope, source, dest, serving.ref, move);
         await c.var.admin.bindScopeVersion(actor, tenantId, scopeId, serving.versionId, move).catch(relayHostRefusal);
         // #1674: re-assert the recorded OFF positions in the store the scope now routes to.
         await c.var.admin.reassertSystemSwitches(actor, { tenantId, scopeId }, { appliedInUnit: restored.switchedOff });
         return { servingRef: serving.ref, versionId: serving.versionId, tables: restored.tables };
     };
+    /**
+     * The copy move under adopt-serving and rebind-vertical (#1722): export from the script the
+     * scope routes to, restore onto the serving script, then flip the route. Both ends are in the
+     * ledger, leased to this move, before any bytes move, and the destination's entry names the
+     * stamp its restore leaves, so a crash-recovery sweep can wipe an unbound restore if this
+     * request dies. The route flips only while that lease is live and unclaimed, and the same
+     * write settles the destination `done`.
+     *
+     * The old source is then `eligible`, as a carry's is: the scheduled sweep wipes it, fenced on
+     * the stamp and revision this export read, so a copy that took a write since is kept for staff
+     * rather than deleted. The old copy is not a backout; rollback is an explicit snapshot or
+     * backup taken before the move (the decided policy). A source whose deployment predates the
+     * stamped export cannot be wiped under a fence, and stays `retained`. A move that fails or is
+     * never confirmed keeps its source too: the catch below settles both ends `retained`.
+     */
+    const moveOntoServing = async (c, scope, source, dest, servingRef, routeOpts) => {
+        const actor = c.get('actor');
+        const { tenantId, id: scopeId } = scope;
+        const sourceRef = await routeOf(c, scope);
+        const moveId = sourceRef !== servingRef ? ulid() : null;
+        const restoredStamp = ulid();
+        const recordedAt = Date.now();
+        if (moveId && sourceRef) {
+            await c.var.admin.recordScopeScriptCopy(actor, tenantId, scopeId, sourceRef, moveId, { role: 'source', leaseMs: copyLeaseMs });
+        }
+        try {
+            if (moveId) {
+                await c.var.admin.recordScopeScriptCopy(actor, tenantId, scopeId, servingRef, moveId, { role: 'destination', loadStamp: restoredStamp, leaseMs: copyLeaseMs });
+            }
+            const erasureEpoch = await c.var.admin.scopeErasureEpoch(actor, tenantId, scopeId);
+            const { tables: dump, loadStamp: sourceStamp, revision: sourceRevision } = await retryTransient(() => source.exportScopeStamped(scopeId));
+            const restored = await restoreCarryingSwitches(actor, dest, tenantId, scopeId, dump, {
+                scopeId, exact: true, loadStamp: restoredStamp,
+                ...(moveId ? { fence: copyRestoreFence(moveId, recordedAt, copyLeaseMs, erasureEpoch) } : {}),
+            });
+            await c.var.admin.setScopeServingRef(actor, tenantId, scopeId, servingRef, {
+                ...routeOpts, expectedErasureEpoch: erasureEpoch,
+                ...(moveId ? { confirmMove: sourceStamp
+                        ? { moveId, source: 'eligible', sourceMarker: { loadStamp: sourceStamp, revision: sourceRevision } }
+                        : { moveId, source: 'retained' } } : {}),
+            }).catch(relayHostRefusal);
+            return restored;
+        }
+        catch (error) {
+            if (moveId)
+                await Promise.allSettled([
+                    ...(sourceRef ? [c.var.admin.settleScopeScriptCopy(actor, tenantId, scopeId, sourceRef, moveId, 'retained')] : []),
+                    c.var.admin.settleScopeScriptCopy(actor, tenantId, scopeId, servingRef, moveId, 'retained'),
+                ]);
+            throw error;
+        }
+    };
     /** The script a scope's requests reach: its serving pin, else its bound version's own script. */
     const routeOf = async (c, scope) => {
         if (scope.servingRef)
@@ -2249,43 +2419,74 @@ export function createControlPlaneApi(options) {
             throw new ControlPlaneError(502, `cannot move scope ${scope.id} from '${from}' to '${to}': ${missing} could not be reached, ` +
                 `so the version was not bound (#1710)`);
         }
-        const { tables: dump, loadStamp: sourceStamp, revision: sourceRevision } = await retryTransient(() => source.exportScopeStamped(scope.id));
-        // What the destination holds now, read before the binding is checked again. The restore
-        // sends it back and is refused if the store moved since: another carry into the same script
-        // loaded it, or it went live under another carry's bind and took a write. That is a CI retry
-        // of the same version, held before its restore while the first run bound and served.
-        const destMarker = await retryTransient(() => dest.loadMarker(scope.id));
-        const now = await c.var.admin.getScopeRecord(actor, scope.tenantId, scope.id);
-        if (!now ||
-            (now.verticalVersionId ?? null) !== (scope.verticalVersionId ?? null) ||
-            (now.servingRef ?? null) !== (scope.servingRef ?? null)) {
-            throw new ControlPlaneError(412, `scope ${scope.id} was re-pointed while its data was being copied out of '${from}', so nothing was ` +
-                `moved or bound (#1722). Reload the scope and retry.`);
-        }
-        if (dumpMetaValue(dump, CARRIED_AWAY_KEY) !== null) {
-            throw new ControlPlaneError(412, `the copy of scope ${scope.id} in '${from}' was already carried to another script and wiped, so nothing ` +
-                `was moved or bound (#1722). Reload the scope and retry.`);
-        }
+        // Before exporting or restoring anything, retain the script identity in the directory, so a
+        // failed carry stays named for reap and erasure. Both entries are leased to this move: if this
+        // request dies, a sweep settles them once the lease runs out, and the move can then no longer
+        // confirm its bind.
+        const moveId = ulid();
         // #1742: the recorded OFF positions ride the restore, as on adopt and rebind. #1722: so does
-        // a stamp of this carry's own, which a refused bind's wipe of the copy expects.
+        // a stamp of this carry's own, which a refused bind's wipe of the copy expects, and which the
+        // destination's entry names before the restore so a crash-recovery sweep can fence on it.
         const restoredStamp = ulid();
-        const restored = await restoreCarryingSwitches(actor, dest, scope.tenantId, scope.id, dump, {
-            scopeId: scope.id,
-            exact: true,
-            loadStamp: restoredStamp,
-            ...(destMarker === 'unfenced' ? {} : { expect: destMarker }),
-        });
-        return {
-            from,
-            to,
-            tables: restored.tables,
-            switchedOff: restored.switchedOff,
-            source,
-            dest,
-            sourceStamp,
-            sourceRevision,
-            restoredStamp,
-        };
+        const recordedAt = Date.now();
+        await c.var.admin.recordScopeScriptCopy(actor, scope.tenantId, scope.id, from, moveId, { role: 'source', leaseMs: copyLeaseMs });
+        try {
+            // The unbound destination can also survive a refused bind or a failed best-effort
+            // cleanup. Name it before any bytes are restored so reap and erasure can find it.
+            await c.var.admin.recordScopeScriptCopy(actor, scope.tenantId, scope.id, to, moveId, { role: 'destination', loadStamp: restoredStamp, leaseMs: copyLeaseMs });
+            const erasureEpoch = await c.var.admin.scopeErasureEpoch(actor, scope.tenantId, scope.id);
+            const { tables: dump, loadStamp: sourceStamp, revision: sourceRevision } = await retryTransient(() => source.exportScopeStamped(scope.id));
+            // What the destination holds now, read before the binding is checked again. The restore
+            // sends it back and is refused if the store moved since: another carry into the same script
+            // loaded it, or it went live under another carry's bind and took a write. That is a CI retry
+            // of the same version, held before its restore while the first run bound and served.
+            const destMarker = await retryTransient(() => dest.loadMarker(scope.id));
+            const now = await c.var.admin.getScopeRecord(actor, scope.tenantId, scope.id);
+            if (!now ||
+                (now.verticalVersionId ?? null) !== (scope.verticalVersionId ?? null) ||
+                (now.servingRef ?? null) !== (scope.servingRef ?? null)) {
+                throw new ControlPlaneError(412, `scope ${scope.id} was re-pointed while its data was being copied out of '${from}', so nothing was ` +
+                    `moved or bound (#1722). Reload the scope and retry.`);
+            }
+            if (dumpMetaValue(dump, CARRIED_AWAY_KEY) !== null) {
+                throw new ControlPlaneError(412, `the copy of scope ${scope.id} in '${from}' was already carried to another script and wiped, so nothing ` +
+                    `was moved or bound (#1722). Reload the scope and retry.`);
+            }
+            const restored = await restoreCarryingSwitches(actor, dest, scope.tenantId, scope.id, dump, {
+                scopeId: scope.id,
+                exact: true,
+                loadStamp: restoredStamp,
+                ...(destMarker === 'unfenced' ? {} : { expect: destMarker }),
+                // The store refuses this load once the move's lease can have run out (#1722).
+                fence: copyRestoreFence(moveId, recordedAt, copyLeaseMs, erasureEpoch),
+            });
+            return {
+                moveId,
+                erasureEpoch,
+                from,
+                to,
+                tables: restored.tables,
+                switchedOff: restored.switchedOff,
+                source,
+                dest,
+                sourceStamp,
+                sourceRevision,
+                restoredStamp,
+            };
+        }
+        catch (error) {
+            // Neither script can be discarded based on this unconfirmed move. A retry or reap
+            // can still reach both. A crash leaves them pending and blocks key finalization.
+            const settled = await Promise.allSettled([
+                c.var.admin.settleScopeScriptCopy(actor, scope.tenantId, scope.id, from, moveId, 'retained'),
+                c.var.admin.settleScopeScriptCopy(actor, scope.tenantId, scope.id, to, moveId, 'retained'),
+            ]);
+            for (const result of settled) {
+                if (result.status === 'rejected')
+                    recordCarryCleanup(c, scope, versionId, 'copy-ledger', result.reason);
+            }
+            throw error;
+        }
     };
     /**
      * Wipe one copy of a scope that no route reaches (#1722), without reaping it. Fenced where the
@@ -2403,14 +2604,29 @@ export function createControlPlaneApi(options) {
                 await dropUnboundCopy(c, scope, versionId, stale);
                 throw new CarrySourceChanged(scope.id, stale.from, stale.to, attempt);
             }
+            // The fresh carry restored over the stale one's copy in the same script and holds its own
+            // entries for both ends, so the stale move leaves nothing of its own behind (#1722).
+            await supersedeMove(c, scope, versionId, stale);
             carried = next;
         }
+        // #1722: the write that moves the route confirms the move, while its lease is live. That is the
+        // bind itself, unless a pin still routes the scope to the source until it is cleared below.
+        // The source is confirmed `retained`, not `eligible`: `settleCarriedSource` may still have to
+        // carry it again (an overtaken destination), and promotes it only once that is ruled out, so
+        // no sweep can wipe it first. A request that dies in between leaves it kept, not swept.
+        const unpins = Boolean(opts.clearServingRef && scope.servingRef);
+        const confirmMove = carried
+            ? { confirmMove: { moveId: carried.moveId, source: 'retained',
+                    sourceMarker: { loadStamp: carried.sourceStamp, revision: carried.sourceRevision } } }
+            : {};
         try {
             await c.var.admin
                 .bindScopeVersion(actor, scope.tenantId, scope.id, versionId, {
                 acknowledge: opts.acknowledge,
                 ...(opts.snapshot ? { snapshot: true } : {}),
                 expectedVersionId: scope.verticalVersionId ?? null,
+                ...(carried ? { expectedErasureEpoch: carried.erasureEpoch } : {}),
+                ...(unpins ? {} : confirmMove),
             })
                 .catch(relayHostRefusal);
         }
@@ -2419,8 +2635,15 @@ export function createControlPlaneApi(options) {
                 await dropUnboundCopy(c, scope, versionId, carried);
             throw e;
         }
-        if (opts.clearServingRef && scope.servingRef) {
-            await c.var.admin.setScopeServingRef(actor, scope.tenantId, scope.id, null).catch(relayHostRefusal);
+        if (unpins) {
+            try {
+                await c.var.admin.setScopeServingRef(actor, scope.tenantId, scope.id, null, carried ? { expectedErasureEpoch: carried.erasureEpoch, ...confirmMove } : undefined).catch(relayHostRefusal);
+            }
+            catch (e) {
+                if (carried)
+                    await dropUnboundCopy(c, scope, versionId, carried);
+                throw e;
+            }
         }
         try {
             await c.var.admin.reassertSystemSwitches(actor, { tenantId: scope.tenantId, scopeId: scope.id }, { appliedInUnit: carried?.switchedOff });
@@ -2432,19 +2655,36 @@ export function createControlPlaneApi(options) {
                 await settleCarriedSource(c, scope, versionId, carried);
         }
     };
+    /** Settle a carry that a fresh carry into the same script replaced. Best effort, recorded. */
+    const supersedeMove = async (c, scope, versionId, stale) => {
+        const settled = await Promise.allSettled([stale.from, stale.to].map((ref) => c.var.admin.settleScopeScriptCopy(c.get('actor'), scope.tenantId, scope.id, ref, stale.moveId, 'done')));
+        for (const result of settled) {
+            if (result.status === 'rejected')
+                recordCarryCleanup(c, scope, versionId, 'copy-ledger', result.reason);
+        }
+    };
     /**
      * The copy a carry restored for a bind that did not land, wiped unless the scope routes to
      * that script now. Best effort: it never throws, and a failure is recorded.
      */
     const dropUnboundCopy = async (c, scope, versionId, carried) => {
+        let route = null;
         try {
-            const route = await currentRoute(c, scope, versionId, carried);
-            if (route === carried.to)
+            route = await currentRoute(c, scope, versionId, carried);
+            if (route === carried.to) {
+                await c.var.admin.settleScopeScriptCopy(c.get('actor'), scope.tenantId, scope.id, carried.to, carried.moveId, 'done');
                 return;
-            await wipeCarriedCopy(carried.dest, scope, { loadStamp: carried.restoredStamp }, route ?? carried.from);
+            }
+            const wiped = await wipeCarriedCopy(carried.dest, scope, { loadStamp: carried.restoredStamp }, route ?? carried.from);
+            await c.var.admin.settleScopeScriptCopy(c.get('actor'), scope.tenantId, scope.id, carried.to, carried.moveId, wiped ? 'done' : 'retained');
         }
         catch (e) {
             recordCarryCleanup(c, scope, versionId, 'unbound-copy', e);
+            await c.var.admin.settleScopeScriptCopy(c.get('actor'), scope.tenantId, scope.id, carried.to, carried.moveId, 'retained').catch((err) => recordCarryCleanup(c, scope, versionId, 'unbound-copy-ledger', err));
+        }
+        finally {
+            await c.var.admin.settleScopeScriptCopy(c.get('actor'), scope.tenantId, scope.id, carried.from, carried.moveId, route === carried.from ? 'done' : 'retained')
+                .catch((err) => recordCarryCleanup(c, scope, versionId, 'source-copy-ledger', err));
         }
     };
     /**
@@ -2526,8 +2766,10 @@ export function createControlPlaneApi(options) {
         // The caller read the route elsewhere, so a copy that changed in any way since the export (a
         // load as much as a write: a staff restore-forward into it racing this carry, Codex #2008 r8)
         // is kept in the store rather than left an unmarked orphan.
-        if (await wipeCarriedCopy(carried.source, scope, expect, carried.to, true))
+        if (await wipeCarriedCopy(carried.source, scope, expect, carried.to, true)) {
+            await c.var.admin.settleScopeScriptCopy(c.get('actor'), scope.tenantId, scope.id, carried.from, carried.moveId, 'done', expect);
             return;
+        }
         // A rollback that restored into it since made it the live store again: it is no kept copy, and
         // a marker this refusal set while the rollback had not yet bound comes off.
         const route = await currentRoute(c, scope, versionId, carried);
@@ -2535,8 +2777,11 @@ export function createControlPlaneApi(options) {
             await releaseIfLive(c, scope, versionId, carried, carried.source, carried.from);
             return;
         }
-        if (route === carried.to && (await bringClearForward(c, scope, versionId, carried)))
+        if (route === carried.to && (await bringClearForward(c, scope, versionId, carried))) {
+            await c.var.admin.settleScopeScriptCopy(c.get('actor'), scope.tenantId, scope.id, carried.from, carried.moveId, 'done', expect);
             return;
+        }
+        await c.var.admin.settleScopeScriptCopy(c.get('actor'), scope.tenantId, scope.id, carried.from, carried.moveId, 'kept', expect);
         recordCarryCleanup(c, scope, versionId, 'source-copy-kept', new ControlPlaneError(409, `scope ${scope.id}'s copy in '${carried.from}' changed after it was carried to '${carried.to}', so it was ` +
             `kept: it holds what reached it in between, which the carry did not copy (#1722)`));
     };
@@ -2556,35 +2801,68 @@ export function createControlPlaneApi(options) {
      */
     const settleCarriedSource = async (c, scope, versionId, carried) => {
         const actor = c.get('actor');
+        const finishDestination = async () => {
+            if ((await currentRoute(c, scope, versionId, carried)) === carried.to) {
+                await c.var.admin.settleScopeScriptCopy(actor, scope.tenantId, scope.id, carried.to, carried.moveId, 'done');
+            }
+            else {
+                await dropUnboundCopy(c, scope, versionId, carried);
+            }
+        };
         try {
             const route = await currentRoute(c, scope, versionId, carried);
-            if (route === carried.from)
+            if (route !== carried.to) {
+                await dropUnboundCopy(c, scope, versionId, carried);
                 return;
+            }
             // The store this carry landed in is live; a kept marker another carry set while racing it
             // does not belong on it (#1722 r8).
-            if (route === carried.to)
-                await releaseIfLive(c, scope, versionId, carried, carried.dest, carried.to);
-            if (route === carried.to && (await isCarriedAway(carried.dest, scope))) {
+            await releaseIfLive(c, scope, versionId, carried, carried.dest, carried.to);
+            let sourceMarker = { loadStamp: carried.sourceStamp, revision: carried.sourceRevision };
+            if (await isCarriedAway(carried.dest, scope)) {
                 const { tables: dump, loadStamp: stamp, revision } = await retryTransient(() => carried.source.exportScopeStamped(scope.id));
                 if (dumpMetaValue(dump, CARRIED_AWAY_KEY) !== null) {
                     throw new ControlPlaneError(500, `both copies of scope ${scope.id} hold the carried_away tombstone; nothing was wiped`);
                 }
-                await restoreCarryingSwitches(actor, carried.dest, scope.tenantId, scope.id, dump, {
-                    scopeId: scope.id,
-                    exact: true,
-                    loadStamp: ulid(),
-                });
+                // The re-carry is a copy move of its own (#1722): in the ledger and leased before it
+                // writes, and fenced, so it cannot land after a reap or an erasure has settled the scope.
+                const recarryId = ulid();
+                const restoredStamp = ulid();
+                const recordedAt = Date.now();
+                await c.var.admin.recordScopeScriptCopy(actor, scope.tenantId, scope.id, carried.to, recarryId, { role: 'destination', loadStamp: restoredStamp, leaseMs: copyLeaseMs });
+                try {
+                    const erasureEpoch = await c.var.admin.scopeErasureEpoch(actor, scope.tenantId, scope.id);
+                    await restoreCarryingSwitches(actor, carried.dest, scope.tenantId, scope.id, dump, {
+                        scopeId: scope.id,
+                        exact: true,
+                        loadStamp: restoredStamp,
+                        fence: copyRestoreFence(recarryId, recordedAt, copyLeaseMs, erasureEpoch),
+                    });
+                }
+                finally {
+                    // The scope routes to this store, so the route reaches whatever landed in it.
+                    await c.var.admin.settleScopeScriptCopy(actor, scope.tenantId, scope.id, carried.to, recarryId, 'done');
+                }
                 if (await isCarriedAway(carried.dest, scope)) {
                     throw new ControlPlaneError(500, `scope ${scope.id}'s store in '${carried.to}' was wiped again; its source copy stays`);
                 }
                 // Re-carried, so the fence expects what the re-export read.
-                await keepOrWipeSource(c, scope, versionId, carried, { loadStamp: stamp, revision });
+                sourceMarker = { loadStamp: stamp, revision };
+            }
+            // Only now may the sweep wipe the source: the destination holds the data.
+            const eligible = await c.var.admin.settleScopeScriptCopy(actor, scope.tenantId, scope.id, carried.from, carried.moveId, 'eligible', sourceMarker);
+            if (!eligible) {
+                await finishDestination(); // a later move through this script superseded this carry
                 return;
             }
-            await keepOrWipeSource(c, scope, versionId, carried, { loadStamp: carried.sourceStamp, revision: carried.sourceRevision });
+            await keepOrWipeSource(c, scope, versionId, carried, sourceMarker);
+            await finishDestination();
         }
         catch (e) {
             recordCarryCleanup(c, scope, versionId, 'source-copy', e);
+            // This call can no longer restore another destination copy. Clear its pending
+            // move if it is still serving, even when the source wipe needs a sweep retry.
+            await finishDestination().catch((err) => recordCarryCleanup(c, scope, versionId, 'destination-copy-ledger', err));
         }
     };
     app.get('/tenants/:tenantId/scopes/:scopeId/tables', async (c) => {
@@ -2825,6 +3103,9 @@ export function createControlPlaneApi(options) {
             ? await c.var.admin.verticalServing(actor, scope.vertical).catch(() => null)
             : null;
         const ranAs = versionReachedAt(reached.via, scope, serving);
+        // #2071: the shapes this reconcile tops holders up to, from the reviewed registry of the
+        // version it reaches — never anything the vertical's own code names.
+        const entityGrants = scope.vertical && ranAs ? await reviewedEntityGrants(c.var.admin, actor, scope.vertical, ranAs) : undefined;
         try {
             // #1674: the recorded OFF positions go back after the reconcile, before the receipt.
             const result = await reconcileThenReassert(c.var.admin, actor, { tenantId, scopeId }, (carry) => vertical.reconcileInstance({
@@ -2834,6 +3115,7 @@ export function createControlPlaneApi(options) {
                 identityLinks,
                 connectionGrants,
                 connectionKeys,
+                ...(entityGrants ? { entityGrants } : {}),
                 ...carry,
                 // Handed over exactly as at provision: a store minted HERE has never been migrated
                 // by the vertical, so the reconcile must carry it into the same ready-gate — a bound
@@ -3256,28 +3538,46 @@ export function createControlPlaneApi(options) {
             return { refusal: c.json({ error: await diagnoseUnboundScope(actor, scope) }, 501) };
         return { tenantId, scopeId, actor, vertical, person: memberPerson(principal) };
     };
-    /** Run one audited member change: intent, the vertical's call, then the outcome row. */
-    const auditedMemberChange = async (c, entry, run, applied) => {
-        const actor = c.get('actor');
-        const base = { ...entry, operationId: ulid() };
-        await c.var.admin.recordMemberChange(actor, { ...base, phase: 'intent' });
-        let result;
-        try {
-            result = await run();
-        }
-        catch (e) {
-            const status = e instanceof ControlPlaneError ? e.status : 500;
-            const error = (e instanceof Error ? e.message : String(e)).slice(0, OWNER_TRANSFER_AUDIT_ERROR_MAX);
-            await c.var.admin
-                .recordMemberChange(actor, { ...base, phase: status < 500 ? 'refused' : 'failed', error })
-                .catch(() => undefined);
-            if (e instanceof ControlPlaneError) {
-                return { ok: false, response: c.json({ error: e.message }, e.status) };
+    /**
+     * Answer for one `auditedChange` (#2064). A refusal or failure answers with the vertical's own
+     * status (a non-`ControlPlaneError` throw is rethrown). A change that went through answers
+     * `ok`, with its `operationId`, whether or not its outcome row could be written. When it could
+     * not, the answer also carries `auditWarning`, which says so. That is a success on purpose:
+     * the change happened, so no client should read a retryable error and make it twice (a second
+     * invite, a second hand-over). The missing row is logged, and the scheduled settle closes it.
+     */
+    const auditedAnswer = (c, done, what, ok) => {
+        const { operationId } = done;
+        if ('error' in done) {
+            if (done.error instanceof ControlPlaneError) {
+                return c.json({ error: done.error.message, operationId }, done.error.status);
             }
-            throw e;
+            throw done.error;
         }
-        await c.var.admin.recordMemberChange(actor, { ...base, phase: 'applied', ...applied(result) });
-        return { ok: true, result };
+        if ('unrecorded' in done) {
+            return ok(done.result, {
+                operationId,
+                auditWarning: auditWarningOf(what, done.unrecorded),
+            });
+        }
+        return ok(done.result, { operationId });
+    };
+    /** Run one audited member change: intent, the vertical's call, then the outcome row. */
+    const auditedMemberChange = (c, entry, run, applied) => {
+        const actor = c.get('actor');
+        const operationId = ulid();
+        return auditedChange({
+            flow: 'member-change',
+            operationId,
+            run,
+            // A 4xx is the vertical's refusal: nothing was written there.
+            refused: (e) => e instanceof ControlPlaneError && e.status < 500,
+            record: (row) => c.var.admin.recordMemberChange(actor, {
+                ...entry,
+                operationId,
+                ...(row.phase === 'applied' ? { phase: 'applied', ...applied(row.result) } : row),
+            }),
+        });
     };
     const NO_PERSON = 'a member change needs the signed-in person it is made for — this credential names nobody';
     app.get('/tenants/:tenantId/scopes/:scopeId/members', async (c) => {
@@ -3306,7 +3606,7 @@ export function createControlPlaneApi(options) {
         }
         const { tenantId, scopeId, person } = target;
         const done = await auditedMemberChange(c, { tenantId, scopeId, change: 'invite', caller: person, roleKey: body.roleKey }, () => target.vertical.inviteMember({ tenantId, scopeId, caller: person, origin, roleKey: body.roleKey, email: body.email ?? null }), (link) => ({ principal: link.principal }));
-        return done.ok ? c.json(done.result, 201) : done.response;
+        return auditedAnswer(c, done, 'the invite', (link, audit) => c.json({ ...link, ...audit }, 201));
     });
     app.post('/tenants/:tenantId/scopes/:scopeId/members/:principal/role', async (c) => {
         const target = await memberTarget(c);
@@ -3318,7 +3618,7 @@ export function createControlPlaneApi(options) {
         const body = memberRoleInput.parse(await c.req.json());
         const { tenantId, scopeId, person } = target;
         const done = await auditedMemberChange(c, { tenantId, scopeId, change: 'role', caller: person, principal: member, from: body.from, to: body.to }, () => target.vertical.changeMemberRole({ tenantId, scopeId, caller: person, principal: member, from: body.from, to: body.to }), () => ({}));
-        return done.ok ? c.json({ principal: member, from: body.from, to: body.to }) : done.response;
+        return auditedAnswer(c, done, 'the role change', (_, audit) => c.json({ principal: member, from: body.from, to: body.to, ...audit }));
     });
     app.post('/tenants/:tenantId/scopes/:scopeId/members/:principal/remove', async (c) => {
         const target = await memberTarget(c);
@@ -3329,7 +3629,7 @@ export function createControlPlaneApi(options) {
         const member = principalIdSchema.parse(c.req.param('principal'));
         const { tenantId, scopeId, person } = target;
         const done = await auditedMemberChange(c, { tenantId, scopeId, change: 'remove', caller: person, principal: member }, () => target.vertical.removeMember({ tenantId, scopeId, caller: person, principal: member }), (removal) => ({ revoked: removal.revoked }));
-        return done.ok ? c.json(done.result) : done.response;
+        return auditedAnswer(c, done, 'the removal', (removal, audit) => c.json({ ...removal, ...audit }));
     });
     // The owner HAND-OVER (#1665). The move runs in the VERTICAL, behind `/internal/owner-transfer`
     // (vertical-host says in what order and why). This route decides who may ask, and audits every
@@ -3360,41 +3660,19 @@ export function createControlPlaneApi(options) {
         // An abandon (`abandon: true`) is audited the same way, every row marked, so the log tells
         // a hand-over closed without finishing from one that finished.
         const base = { tenantId, scopeId, operationId, from: body.from, to: body.to, ...(body.abandon ? { abandon: true } : {}) };
-        await c.var.admin.recordOwnerTransfer(actor, { ...base, phase: 'intent' });
-        let moved;
-        try {
-            moved = await vertical.transferOwner({ tenantId, scopeId, ...body });
-        }
-        catch (e) {
-            const refused = e instanceof ControlPlaneError && e.status === 409;
-            const error = (e instanceof Error ? e.message : String(e)).slice(0, OWNER_TRANSFER_AUDIT_ERROR_MAX);
-            await c.var.admin
-                .recordOwnerTransfer(actor, { ...base, phase: refused ? 'refused' : 'failed', error })
-                .catch(() => undefined);
-            if (e instanceof ControlPlaneError) {
-                return c.json({ error: e.message, operationId }, e.status);
-            }
-            throw e;
-        }
-        try {
-            await c.var.admin.recordOwnerTransfer(actor, {
-                ...base,
-                phase: 'applied',
-                outcome: moved.outcome,
-                fromRevoked: moved.fromRevoked,
-            });
-        }
-        catch (e) {
-            // The owner HAS moved; only the outcome row is missing. Say exactly that, so nobody retries
-            // a hand-over believing it failed, and name the operation whose intent row stands alone.
-            const why = e instanceof Error ? e.message : String(e);
-            return c.json({
-                error: `the hand-over completed, but its outcome could not be written to the admin log: ${why}`,
-                operationId,
-                ...moved,
-            }, 500);
-        }
-        return c.json({ operationId, ...moved });
+        const done = await auditedChange({
+            flow: 'owner-transfer',
+            operationId,
+            run: () => vertical.transferOwner({ tenantId, scopeId, ...body }),
+            // Only the vertical's 409 is a refusal: anything else may have stopped part-way.
+            refused: (e) => e instanceof ControlPlaneError && e.status === 409,
+            record: (row) => c.var.admin.recordOwnerTransfer(actor, row.phase === 'applied'
+                ? { ...base, phase: 'applied', outcome: row.result.outcome, fromRevoked: row.result.fromRevoked }
+                : { ...base, ...row }),
+        });
+        // A missing outcome row is said in `auditWarning` on a success, so nobody retries a hand-over
+        // believing it failed, under the operation whose intent row stands alone.
+        return auditedAnswer(c, done, 'the hand-over', (moved, audit) => c.json({ ...audit, ...moved }));
     });
     // Deliver per-instance CONFIG to the scope's own storage (vertical-auth-detach.md
     // §2.2) — the missing "delivery" step behind the dashboard's Env tab. Same K-3
@@ -3490,12 +3768,53 @@ export function createControlPlaneApi(options) {
     // on); the DIRECTORY half — provenance row, activation, version bind — runs here.
     // With no vertical client resolved (co-located host, tests, self-host) the host's
     // in-process snapshotScope does both halves against its own SCOPE namespace.
+    /**
+     * The script a slug-resolved scope lives in, by the hosted resolver's rule: the vertical's
+     * stable serving script, else its prod channel's version script (control-plane worker
+     * `resolveVerticalFor`). Null unless the platform can also reach that script by ref.
+     */
+    const slugRefOf = async (c, slug) => {
+        const actor = c.get('actor');
+        const serving = await c.var.admin.verticalServing(actor, slug).catch(() => null);
+        let ref = serving?.ref ?? null;
+        if (!ref) {
+            const prod = (await c.var.admin.listChannels(actor, slug).catch(() => [])).find((ch) => ch.channel === 'prod');
+            ref = prod ? ((await c.var.admin.getVersion(actor, prod.versionId, slug))?.deploymentRef ?? null) : null;
+        }
+        return ref && (await options.resolveVerticalRef?.(ref)) ? ref : null;
+    };
     const orchestratedSnapshot = async (c, tenantId, scope, opts) => {
         const actor = c.get('actor');
-        const vertical = await verticalForScope(c, scope);
+        const deployment = await deploymentForScope(c, scope);
+        const vertical = deployment?.client;
         if (!vertical)
             return c.var.host.snapshotScope(actor, tenantId, scope.id, opts);
         const snapId = scopeIdSchema.parse(ulid());
+        // #1722: the script the copy lands in (the source's own), named in the ledger before the
+        // copy, so a bind that fails, or a request that dies, leaves a fork reap and erasure reach.
+        // A pinned or bound source names it with the same value its client was resolved from. A
+        // source resolved by slug is resolved once, here (`slugRefOf`), and copied through THAT
+        // ref's client, so a serving move or a promote between two reads cannot put the bytes in
+        // one script and the ledger entry on another. Without a ref (no per-script resolution, or
+        // a slug script the platform cannot reach by ref) the fork has no entry, and reap and
+        // erasure reach it through the slug resolution instead.
+        let ref = null;
+        let copier = vertical;
+        if (options.resolveVerticalRef) {
+            if (deployment.via === 'serving-script')
+                ref = scope.servingRef ?? null;
+            else if (deployment.via === 'bound-version' && scope.vertical && scope.verticalVersionId) {
+                ref = (await c.var.admin.getVersion(actor, scope.verticalVersionId, scope.vertical))?.deploymentRef ?? null;
+            }
+            else if (deployment.via === 'slug' && scope.vertical) {
+                ref = await slugRefOf(c, scope.vertical);
+                const byRef = ref ? await options.resolveVerticalRef(ref) : undefined;
+                if (byRef)
+                    copier = byRef;
+                else
+                    ref = null;
+            }
+        }
         // Directory row FIRST, as `provisioning` (K-31's two-phase shape, used as
         // intended): a crash between the row and the data copy leaves an inert
         // provisioning row — which, carrying provenance and an expiry, the GC sweep
@@ -3510,12 +3829,34 @@ export function createControlPlaneApi(options) {
             forkedAt: new Date().toISOString(),
             expiresAt: opts.expiresAt,
         });
-        await retryTransient(() => vertical.snapshotScope({ sourceScopeId: scope.id, newScopeId: snapId, tenantId }));
-        await c.var.admin.activateScope(actor, tenantId, snapId);
-        // Bound to the SOURCE's current version: source and fork share a deployment, so
-        // the fork resolves to the DO namespace its bytes actually live in.
-        if (scope.verticalVersionId) {
-            await c.var.admin.bindScopeVersion(actor, tenantId, snapId, scope.verticalVersionId);
+        const moveId = ref ? ulid() : null;
+        try {
+            if (moveId && ref) {
+                // No load stamp: the vertical's in-script copy leaves none, so a crash-recovery sweep keeps
+                // this copy (`retained`) rather than wiping it, and reap and erasure still reach it.
+                await c.var.admin.recordScopeScriptCopy(actor, tenantId, snapId, ref, moveId, { role: 'destination', leaseMs: copyLeaseMs });
+            }
+            await retryTransient(() => copier.snapshotScope({ sourceScopeId: scope.id, newScopeId: snapId, tenantId }));
+            await c.var.admin.activateScope(actor, tenantId, snapId);
+            // Bound to the SOURCE's current version: source and fork share a deployment, so
+            // the fork resolves to the DO namespace its bytes actually live in.
+            if (scope.verticalVersionId) {
+                await c.var.admin.bindScopeVersion(actor, tenantId, snapId, scope.verticalVersionId);
+            }
+            // The fork's route is the script its bytes were copied into, never the serving pointer
+            // `provisionScope` stamped (which may have moved since), and the write that sets it confirms
+            // the move. A fork of a bound source routes by its bound version, whose script is `ref`: its
+            // stamped pin is cleared, so a later bind of the fork carries its data like any other scope's.
+            // A fork of a pinned or slug-resolved source is pinned to `ref`, the script it lives in.
+            if (moveId && ref) {
+                await c.var.admin.setScopeServingRef(actor, tenantId, snapId, deployment.via === 'bound-version' ? null : ref, { confirmMove: { moveId, source: 'retained' } });
+            }
+        }
+        catch (e) {
+            if (moveId && ref) {
+                await c.var.admin.settleScopeScriptCopy(actor, tenantId, snapId, ref, moveId, 'retained').catch(() => undefined);
+            }
+            throw e;
         }
         return snapId;
     };
@@ -3575,6 +3916,37 @@ export function createControlPlaneApi(options) {
             throw e;
         }
     };
+    /**
+     * Delete a scope's storage in every script that may hold it, before the directory forgets it.
+     * Answers whether some of it is stranded (a script that predates `/internal/delete-scope`).
+     *
+     * #1722: with per-script resolution, the ledger names every copy a move or a fork wrote, and
+     * the route names the live store; `reapScopeScriptCopies` reaches both, under the reap claim.
+     * A scope nothing routes (no pin, no bound version) may still keep its store where its vertical
+     * resolves by slug, which is where it was provisioned, so that deployment is reached too, as
+     * it was before the ledger. Without per-script resolution there is only that deployment, and
+     * a ledgered copy the platform cannot reach refuses the reap.
+     */
+    const reapScopeStorage = async (c, scope) => {
+        const actor = c.get('actor');
+        // The deployment the scope's vertical resolves to, deleted through; a 501 there is recorded
+        // as stranded storage, as `reapScopeScriptCopies` records its own.
+        const viaDeployment = async () => {
+            const stranded = await deleteScopeStorageOrStrand(await verticalForScope(c, scope), scope.tenantId, scope.id);
+            if (stranded) {
+                await recordStrandedStorage(c.var.admin, actor, scope.tenantId, scope.id, `the deployment its vertical '${scope.vertical}' resolves to`);
+            }
+            return stranded;
+        };
+        if (!options.resolveVerticalRef) {
+            await assertNoUnreachableScopeCopies(c.var.admin, actor, scope.tenantId, scope.id);
+            return viaDeployment();
+        }
+        const unrouted = (await routeOf(c, scope)) === null;
+        const { storageStranded } = await reapScopeScriptCopies({ admin: c.var.admin, actor, resolveRef: options.resolveVerticalRef }, scope.tenantId, scope.id);
+        const bySlug = unrouted ? await viaDeployment() : false;
+        return storageStranded || bySlug;
+    };
     app.delete('/tenants/:tenantId/scopes/:scopeId', async (c) => {
         const tenantId = tenantIdSchema.parse(c.req.param('tenantId'));
         const scopeId = scopeIdSchema.parse(c.req.param('scopeId'));
@@ -3590,8 +3962,7 @@ export function createControlPlaneApi(options) {
             // local/placeholder wipe, hostnames + directory row, audit) — the same
             // storage-before-row ordering deleteSnapshot itself keeps, so a crash
             // between the two converges on retry.
-            const vertical = await verticalForScope(c, scope);
-            const storageStranded = await deleteScopeStorageOrStrand(vertical, tenantId, scopeId);
+            const storageStranded = await reapScopeStorage(c, scope);
             await c.var.host.deleteSnapshot(actor, tenantId, scopeId);
             return c.json({ deleted: scopeId, ...(storageStranded ? { storageStranded: true } : {}) });
         }
@@ -3717,7 +4088,42 @@ export function createControlPlaneApi(options) {
         const scope = await c.var.admin.getScopeRecord(c.get('actor'), tenantId, scopeId);
         if (!scope)
             return c.json({ error: `unknown scope for tenant: (${tenantId}, ${scopeId})` }, 404);
-        return c.json(await c.var.admin.shredSubject(c.get('actor'), tenantId, scopeId, subjectId));
+        const copies = await listAllScopeScriptCopies(c.var.admin, c.get('actor'), tenantId, scopeId);
+        // A move in flight can still restore a copy no inventory read now would name. Its entries
+        // settle when it confirms or fails, or, if it died, when the sweep finds its lease run out.
+        if (copies.some((copy) => copy.state === 'pending')) {
+            throw new ControlPlaneError(412, `scope ${scopeId} has a copy move in flight; retry the erasure after it settles`);
+        }
+        const erasureEpoch = await c.var.admin.scopeErasureEpoch(c.get('actor'), tenantId, scopeId);
+        const currentRef = await routeOf(c, scope);
+        if (!options.resolveVerticalRef) {
+            if (currentRef || copies.some((copy) => copy.state !== 'done')) {
+                throw new ControlPlaneError(502, `scope ${scopeId} has script copies, but this control plane cannot reach their deployments`);
+            }
+            return c.json(await c.var.admin.shredSubject(c.get('actor'), tenantId, scopeId, subjectId));
+        }
+        // A scope nothing routes may still keep its store where its vertical resolves by slug (where
+        // it was provisioned), so erasure reaches that deployment too, as reap does (`reapScopeStorage`).
+        const bySlug = currentRef ? undefined : await verticalForScope(c, scope);
+        if (!currentRef && !bySlug && copies.every((copy) => copy.state === 'done')) {
+            return c.json(await c.var.admin.shredSubject(c.get('actor'), tenantId, scopeId, subjectId));
+        }
+        const refs = new Set(copies.filter((copy) => copy.state !== 'done').map((copy) => copy.scriptRef));
+        if (currentRef)
+            refs.add(currentRef);
+        const redactions = [];
+        for (const ref of refs) {
+            const script = await options.resolveVerticalRef(ref);
+            if (!script)
+                throw new ControlPlaneError(502, `scope ${scopeId}'s copy in '${ref}' cannot be reached for erasure`);
+            redactions.push(await script.redactSubject(scopeId, subjectId));
+        }
+        if (bySlug)
+            redactions.push(await bySlug.redactSubject(scopeId, subjectId));
+        return c.json(await c.var.admin.finalizeSubjectShred(c.get('actor'), tenantId, scopeId, subjectId, redactions, {
+            versionId: scope.verticalVersionId, servingRef: scope.servingRef ?? null, epoch: erasureEpoch,
+            copyCount: copies.length,
+        }).catch(relayHostRefusal));
     });
     // -- directory backups (#40) -----------------------------------------------
     // The platform's own disaster recovery, on the same store posture as the scope
@@ -4164,10 +4570,9 @@ export function createControlPlaneApi(options) {
             }
         }
         try {
-            const vertical = await verticalForScope(c, scope);
             // By this point the backup contract has resolved (a copy landed, or the caller
             // explicitly declined one), so stranding is a bookkeeping fact, not data loss.
-            const storageStranded = await deleteScopeStorageOrStrand(vertical, tenantId, scopeId);
+            const storageStranded = await reapScopeStorage(c, scope);
             await c.var.admin.reapScope(actor, tenantId, scopeId, {
                 ...(backup ? { backupRef: backupRefOf(backup) } : {}),
             });
@@ -6224,6 +6629,9 @@ export function createControlPlaneApi(options) {
             // `emailSender` grant itself is never touched by a push. Refreshes on every re-push
             // like the rest of the install spec, exactly because it grants nothing.
             ...(manifest.sendsEmail ? { sendsEmail: true } : {}),
+            // Where the scope lifecycle is held (#1713): `'router'` keeps the vertical's scopes out of
+            // the lifecycle delivery. Refreshes on every re-push like the rest of the install spec.
+            ...(manifest.lifecycle ? { lifecycle: manifest.lifecycle } : {}),
             // The declared surfaces (K-26) ride like envSpec: registry metadata for the
             // hostname-binding picker, never behavior. Not part of any admission digest.
             ...(manifest.surfaces ? { surfaces: manifest.surfaces } : {}),
@@ -6517,6 +6925,45 @@ export function createControlPlaneApi(options) {
         const services = await appServices(c.get('actor'), input.tenantId, input.scopeId, input.vertical);
         return c.json(await options.observability.tenantLogs({ ...input, services }));
     });
+    // #1331: one app's sampled field reports, joined to the router's own request lines.
+    app.get('/observability/tenant-field-coverage', async (c) => {
+        if (!options.observability?.fieldCoverage) {
+            return c.json({ error: 'field coverage is not configured on this control plane' }, 501);
+        }
+        const tenantId = confinedTenant(c.get('principal')) ?? c.req.query('tenantId');
+        if (!tenantId)
+            throw new ControlPlaneError(400, 'tenantId is required');
+        const input = z.object({
+            tenantId: tenantIdSchema,
+            scopeId: z.string().min(1).max(64),
+            versionId: z.string().min(1).max(64),
+            hours: z.coerce.number().int().min(1).max(72).default(24),
+            since: z.string().datetime({ offset: true }).optional(),
+            until: z.string().datetime({ offset: true }).optional(),
+        }).parse({ tenantId, scopeId: c.req.query('scopeId'), versionId: c.req.query('versionId'),
+            hours: c.req.query('hours'), since: c.req.query('since') || undefined, until: c.req.query('until') || undefined });
+        try {
+            resolveObservabilityWindow(input);
+        }
+        catch (e) {
+            throw new ControlPlaneError(400, e.message);
+        }
+        const scopes = await host.admin.listScopes(c.get('actor'), { tenantId: input.tenantId });
+        const installed = scopes.find((s) => s.id === input.scopeId);
+        if (!installed?.vertical)
+            return c.json({ error: 'app not found' }, 404);
+        const services = scriptFamiliesOfScopes(scopes, { scopeId: input.scopeId });
+        const json = await c.var.admin.versionManifest(c.get('actor'), installed.vertical, input.versionId);
+        if (!json)
+            return c.json({ error: 'version not found' }, 404);
+        const outputSurface = storedDeployManifest.parse(JSON.parse(json)).outputSurface ?? [];
+        const declared = Object.fromEntries(outputSurface.map((op) => [op.operationId, op.fields]));
+        return c.json(await options.observability.fieldCoverage({
+            tenantId: input.tenantId, vertical: installed.vertical, scopeId: input.scopeId, services, declared,
+            versionId: input.versionId, hours: input.hours,
+            ...(input.since ? { since: input.since, until: input.until } : {}),
+        }));
+    });
     // #1746: the per-request record, read at the tenant grain. The three routes take ONE
     // query — tenant, window, facet filters (`tenant-request-query.ts`) — so the histogram,
     // the facet counts and the list beside them always describe the same set of requests.
@@ -6962,15 +7409,29 @@ export function createControlPlaneApi(options) {
      *  its hostnames. Storage-before-row, the same ordering the DELETE route uses — a crash
      *  between the two converges on retry. Shared by that route and by the create path, which
      *  reaps a HALF-BUILT leftover before re-forking (see `orchestratedPreview`). */
+    /** Answers whether some of the preview's storage was stranded (and recorded as such). */
     const reapPreview = async (c, preview) => {
         // A fork's own sign-in clients go FIRST (#1704): a failure here leaves the preview in
         // place, so the retry a PR-close job makes still finds it — after the row is gone, nothing
         // would name those clients again. A clean room never had one.
         await retireClientsOfReapedScope(previewAuthDeps(c), preview);
-        const vertical = await verticalForScope(c, preview);
-        if (vertical)
-            await vertical.deleteScope({ tenantId: preview.tenantId, scopeId: preview.id });
+        let storageStranded = false;
+        if (options.resolveVerticalRef) {
+            ({ storageStranded } = await reapScopeScriptCopies({
+                admin: c.var.admin,
+                actor: c.get('actor'),
+                resolveRef: options.resolveVerticalRef,
+            }, preview.tenantId, preview.id));
+        }
+        else {
+            await assertNoUnreachableScopeCopies(c.var.admin, c.get('actor'), preview.tenantId, preview.id);
+            const vertical = await verticalForScope(c, preview);
+            if (vertical)
+                await vertical.deleteScope({ tenantId: preview.tenantId, scopeId: preview.id });
+        }
+        // Co-located hosts have no script ref; their storage is wiped by deleteSnapshot.
         await c.var.host.deleteSnapshot(c.get('actor'), preview.tenantId, preview.id);
+        return { storageStranded };
     };
     /** The preview-login seam (#1704, `preview-auth.ts`): the directory, and each issuer's deployment. */
     const previewAuthDeps = (c) => ({
@@ -7267,6 +7728,7 @@ export function createControlPlaneApi(options) {
             }
         };
         let row;
+        /** `fenced`: the ledger stamp and lease of this fork's restore (#1722), when it has one. */
         let restore;
         /** #2009: the directory's classification of the row below, which every restore of it carries. */
         const markCopyOfRow = () => {
@@ -7305,7 +7767,7 @@ export function createControlPlaneApi(options) {
             // pushes a fresh version per try) — #559 (2).
             // #2009: a load classifies nothing by itself, so the restore carries the directory's
             // classification of the row below, as every restore onto a non-primary scope does.
-            restore = () => target.restoreScope(tenantId, previewId, tables, { sourceScopeId: source.id, exact: true, ...markCopyOfRow() });
+            restore = (fenced) => target.restoreScope(tenantId, previewId, tables, { sourceScopeId: source.id, exact: true, ...markCopyOfRow(), ...fenced });
         }
         else {
             // A clean-room preview (#509 (b)): an EMPTY scope, no source to export. No `forkedFrom`
@@ -7324,19 +7786,49 @@ export function createControlPlaneApi(options) {
                 expiresAt: expiresAt ?? undefined,
             };
             // #2009: marked a copy on the directory's word, as the fork above.
-            restore = target ? () => target.restoreScope(tenantId, previewId, [], markCopyOfRow()) : null;
+            restore = target ? (fenced) => target.restoreScope(tenantId, previewId, [], { ...markCopyOfRow(), ...fenced }) : null;
         }
+        // #1722: the PR version's script, named in the ledger before the restore writes into it.
+        // Nothing routes the new row there until the bind, so without the entry a failure between
+        // the two leaves a fork of the source's data that reap and erasure never reach.
+        const targetRef = restore && options.resolveVerticalRef
+            ? ((await c.var.admin.getVersion(actor, opts.versionId, slug))?.deploymentRef ?? null)
+            : null;
+        let fork = null;
         try {
             // Inside the try: a host writes the directory row FIRST and then migrates, projects and
             // seats, so a provision that throws can leave a `provisioning` row too. A provision
             // that never wrote one (the tag's slug taken by a racing create) marks nothing: the
             // write below targets this create's own id, which does not exist, and is swallowed.
             await c.var.host.provisionScope(actor, row);
-            if (restore)
-                await restoreOrRecord(restore);
+            if (restore) {
+                let fenced = {};
+                if (targetRef) {
+                    const moveId = ulid();
+                    const restoredStamp = ulid();
+                    const recordedAt = Date.now();
+                    await c.var.admin.recordScopeScriptCopy(actor, tenantId, previewId, targetRef, moveId, { role: 'destination', loadStamp: restoredStamp, leaseMs: copyLeaseMs });
+                    fork = { moveId };
+                    const erasureEpoch = await c.var.admin.scopeErasureEpoch(actor, tenantId, previewId);
+                    fenced = { loadStamp: restoredStamp, fence: copyRestoreFence(moveId, recordedAt, copyLeaseMs, erasureEpoch) };
+                }
+                const load = restore;
+                await restoreOrRecord(() => load(fenced));
+            }
             await c.var.admin.activateScope(actor, tenantId, previewId);
+            // Bind the PR version. A private vertical's push self-admitted, so this is accepted; a
+            // preview scope also admits a pending version (#513), which is what a clean-room rehearsal
+            // of not-yet-admitted code needs. It routes the row onto the fork, so it confirms the move.
+            await c.var.admin.bindScopeVersion(actor, tenantId, previewId, opts.versionId, fork ? { confirmMove: { moveId: fork.moveId, source: 'retained' } } : undefined);
         }
         catch (e) {
+            // The fork stays named for reap and erasure; if this request had died instead, the sweep
+            // would settle the entry once its lease ran out.
+            const unbound = fork;
+            if (unbound && targetRef) {
+                await c.var.admin.settleScopeScriptCopy(actor, tenantId, previewId, targetRef, unbound.moveId, 'retained')
+                    .catch(() => undefined);
+            }
             // Expire the row this create left behind, so the next create reaps it at once rather
             // than refusing it as in flight for the whole bound (#1920) — that next create is the
             // CLI's retry after a known-dead attempt (#1918). The row stays until then, or until
@@ -7347,10 +7839,6 @@ export function createControlPlaneApi(options) {
                 .catch(() => undefined);
             throw e;
         }
-        // Bind the PR version. A private vertical's push self-admitted, so this is accepted; a
-        // preview scope also admits a pending version (#513), which is what a clean-room rehearsal
-        // of not-yet-admitted code needs.
-        await c.var.admin.bindScopeVersion(actor, tenantId, previewId, opts.versionId);
         const hostname = await bindPreviewHostname(c.var.admin, actor, baseHostname, tenantId, previewId, opts.tag, surface);
         await assertServesBoundVersion(previewId);
         const auth = await wireLogin(previewId, hostname, source);
@@ -7466,8 +7954,8 @@ export function createControlPlaneApi(options) {
             // Storage-before-row, the same ordering as the fork hard-delete: wipe the DO in the
             // PR version's deployment, then deleteSnapshot (fork-only re-check, hostnames + row,
             // audit). A crash between the two converges on retry.
-            await reapPreview(c, preview);
-            return c.json({ deleted: preview.id });
+            const { storageStranded } = await reapPreview(c, preview);
+            return c.json({ deleted: preview.id, ...(storageStranded ? { storageStranded: true } : {}) });
         }
         catch (e) {
             if (e instanceof ControlPlaneError)
@@ -7667,6 +8155,56 @@ export function createControlPlaneApi(options) {
         }
         return c.json(await c.var.admin.peerGrantsStatus(actor, { tenantId, scopeId }));
     });
+    // #1720: a caller's explicit target is a tenant decision. The dashboard checks its own
+    // app-management permission; this route confines the tenant and both directory endpoints.
+    const peerBindingBody = z.object({ vertical: verticalSlug, targetScopeId: scopeIdSchema.nullable() }).strict();
+    app.get('/tenants/:tenantId/scopes/:scopeId/peer-bindings', async (c) => {
+        const tenantId = tenantIdSchema.parse(c.req.param('tenantId'));
+        const scopeId = scopeIdSchema.parse(c.req.param('scopeId'));
+        const vertical = c.req.query('vertical');
+        const pin = confinedTenant(c.get('principal'));
+        if (pin !== null && pin !== tenantId)
+            return c.json({ error: 'forbidden' }, 403);
+        const actor = c.get('actor');
+        if (!(await c.var.admin.getScopeRecord(actor, tenantId, scopeId)))
+            return c.json({ error: 'app not found' }, 404);
+        return c.json(vertical === undefined
+            ? await c.var.admin.peerBindings(actor, tenantId, scopeId)
+            : await c.var.admin.peerBinding(actor, tenantId, scopeId, verticalSlug.parse(vertical)) ?? null);
+    });
+    app.put('/tenants/:tenantId/scopes/:scopeId/peer-bindings', async (c) => {
+        const tenantId = tenantIdSchema.parse(c.req.param('tenantId'));
+        const scopeId = scopeIdSchema.parse(c.req.param('scopeId'));
+        const pin = confinedTenant(c.get('principal'));
+        // The target choice is the tenant's alone. Staff may inspect it through GET, but cannot
+        // choose a tenant's site on its behalf.
+        if (pin !== tenantId)
+            return c.json({ error: 'forbidden' }, 403);
+        const body = peerBindingBody.parse(await c.req.json());
+        const actor = c.get('actor');
+        if (!(await c.var.admin.getScopeRecord(actor, tenantId, scopeId)))
+            return c.json({ error: 'app not found' }, 404);
+        const operationId = ulid();
+        const base = { tenantId, scopeId, operationId, vertical: body.vertical, targetScopeId: body.targetScopeId };
+        const done = await auditedChange({
+            flow: 'peer-binding', operationId,
+            run: async () => {
+                try {
+                    return await c.var.admin.setPeerBinding(actor, tenantId, scopeId, body.vertical, body.targetScopeId);
+                }
+                catch (e) {
+                    if (errorCodeOf(e) === 'not_found')
+                        throw new ControlPlaneError(404, e instanceof Error ? e.message : String(e));
+                    throw e;
+                }
+            },
+            refused: (e) => e instanceof ControlPlaneError && e.status < 500,
+            record: (row) => c.var.admin.recordPeerBindingChange(actor, row.phase === 'applied'
+                ? { ...base, phase: 'applied', changed: row.result.changed, previousScopeId: row.result.previous }
+                : { ...base, ...row }),
+        });
+        return auditedAnswer(c, done, 'the peer binding', (result, audit) => c.json({ ...result, ...audit }));
+    });
     // Orgs: the portal-customer grouping (§4.1). Creating one mints no permission —
     // members reach what the org was GRANTED, and granting stays off this surface.
     app.post('/tenants/:tenantId/orgs', async (c) => {
@@ -7693,9 +8231,12 @@ export function createControlPlaneApi(options) {
             order: c.req.query('order'),
         });
         const entries = await c.var.admin.auditLog(c.get('actor'), filter);
+        // #2064: each audited change's row says the outcome its operation stands at — the latest
+        // outcome row wins — beside the raw row, which is returned as written.
+        const resolved = await withAuditedOutcomes(c.var.admin, c.get('actor'), entries);
         // The cursor IS the last entry's id (ULID order is chronological), so the
         // page carries its own continuation and the console never assembles one.
-        return c.json(pageOf(entries, filter.limit, (e) => e.id));
+        return c.json(pageOf(resolved, filter.limit, (e) => e.id));
     });
     // The recorded operational failures (#559) — the console's failures view, and the
     // "what does this `reference = <id>` belong to" lookup. Newest first by default,