@substrat-run/control-plane-api 0.148.0 → 0.149.0

package/dist/api.js

@@ -1,16 +1,17 @@
 import { PREVIEW_CONNECTIONS_REFUSAL } from './connection-relay.js';
 import { resolveObservabilityWindow } from './observability-window.js';
 import { Hono } from 'hono';
-import { permissionKey, parseHostname, withLabel, RESERVED_LABEL_SEPARATOR, adminAction, lakeEventsInput, ownerTransferInput, memberInviteInput, memberRoleInput, ASSET_PART_PREFIX, assetHash, STORE_KINDS, STORE_RELEASE_MAX_BYTES, channelName, connectLinkId, connectionActivity, connectionActivitySource, connectionCredential, connectionCertificate, connectionFilter, connectionHealthState, connectionProvider, connectorDispatchKind, PROVISION_SIBLING_KIND, ARCHIVE_SCOPE_KIND, PROVISION_TENANT_KIND, SET_ENTITLEMENTS_KIND, MODEL_USAGE_KIND, SWEEP_RUNS_KIND, toConnectionHealthEntry, CONNECTION_EXPIRY_WARNING_DAYS, CONNECTION_STALE_DAYS, connectionProbe, createTenantInput, entitlementGrantInput, hostname as hostnameSchema, hostnameRegion, hostnameStatus, identityLink, errorCode, issueStatus, issueStatusInput, FINDINGS_LIMIT_DEFAULT, FINDINGS_LIMIT_MAX, findingCursorOf, findingKind, findingRuleInput, findingStatus, findingStatusInput, listPageQuery, matchesOutboundHost, pageOf, platformRequestFilter, principalId as principalIdSchema, impersonationStamp, promotionAcknowledgement, bindAcknowledgement, provisionableJurisdiction, publishVersionInput, queryScopeInput, readScopeTableInput, entityHistoryInput, eventFacetInput, eventCauseInput, eventEffectsInput, invocationEventsInput, deadLettersInput, lifecycleFlowInput, operationSeriesCount, operationSeriesInput, delegatedReadParams, createOrgInput, roleKey as roleKeySchema, peerSwitch, verticalSlug, systemSwitch, DEFAULT_DENIAL_LIMIT, DENIAL_LIMIT_MAX, denialGroupBy, registerVerticalInput, platformScriptCollision, platformScriptRefusal, PLATFORM_SCRIPT_NAMES, serviceDimensions, sweepRunKind, sweepRunOutcome, scopeDump, dataSubjectId as dataSubjectIdSchema, scopeId as scopeIdSchema, scopeStatus, storageShape, surfaceName, tenantId as tenantIdSchema, tenantStatus, versionOrigin, z, PROBLEM_CONTENT_TYPE, toProblem, validationIssuesFrom, redrainEventsInput, importCursorMove, importCursorAcknowledgementMissing, REDRAIN_BATCH, migrationsOnTop, errorCodeOf, capabilityFilterQuery, capabilityId as capabilityIdSchema, PLATFORM_FEATURES_HEADER, PLATFORM_FEATURE_SCOPE_SWEEPER, } from '@substrat-run/contracts';
-import { SCOPE_COPY_LEASE_MS, copyRestoreFence, replayStoreErasures } from '@substrat-run/kernel';
+import { permissionKey, parseHostname, withLabel, RESERVED_LABEL_SEPARATOR, adminAction, lakeEventsInput, ownerTransferInput, memberInviteInput, memberRoleInput, ASSET_PART_PREFIX, assetHash, STORE_DRIVERS, STORE_RELEASE_MAX_BYTES, channelName, connectLinkId, connectionActivity, connectionActivitySource, connectionCredential, connectionCertificate, connectionFilter, connectionHealthState, connectionProvider, connectorDispatchKind, PROVISION_SIBLING_KIND, ARCHIVE_SCOPE_KIND, PROVISION_TENANT_KIND, SET_ENTITLEMENTS_KIND, MODEL_USAGE_KIND, SWEEP_RUNS_KIND, toConnectionHealthEntry, CONNECTION_EXPIRY_WARNING_DAYS, CONNECTION_STALE_DAYS, connectionProbe, createTenantInput, entitlementGrantInput, hostname as hostnameSchema, hostnameRegion, hostnameStatus, identityLink, errorCode, issueStatus, issueStatusInput, FINDINGS_LIMIT_DEFAULT, FINDINGS_LIMIT_MAX, findingCursorOf, findingKind, findingRuleInput, findingStatus, findingStatusInput, listPageQuery, matchesOutboundHost, pageOf, platformRequestFilter, principalId as principalIdSchema, impersonationStamp, promotionAcknowledgement, bindAcknowledgement, rebindAcknowledgement, provisionableJurisdiction, publishVersionInput, queryScopeInput, readScopeTableInput, entityHistoryInput, eventFacetInput, eventCauseInput, eventEffectsInput, invocationEventsInput, deadLettersInput, lifecycleFlowInput, operationSeriesCount, operationSeriesInput, delegatedReadParams, createOrgInput, roleKey as roleKeySchema, peerSwitch, verticalSlug, systemSwitch, DEFAULT_DENIAL_LIMIT, DENIAL_LIMIT_MAX, denialGroupBy, registerVerticalInput, platformScriptCollision, platformScriptRefusal, PLATFORM_SCRIPT_NAMES, serviceDimensions, sweepRunKind, sweepRunOutcome, scopeDump, dataSubjectId as dataSubjectIdSchema, scopeId as scopeIdSchema, scopeStatus, storageShape, surfaceName, tenantId as tenantIdSchema, tenantStatus, versionOrigin, z, PROBLEM_CONTENT_TYPE, toProblem, validationIssuesFrom, redrainEventsInput, importCursorMove, importCursorAcknowledgementMissing, REDRAIN_BATCH, migrationsOnTop, substratError, errorCodeOf, capabilityFilterQuery, capabilityId as capabilityIdSchema, PLATFORM_FEATURES_HEADER, PLATFORM_FEATURE_SCOPE_SWEEPER, } from '@substrat-run/contracts';
+import { SCOPE_COPY_LEASE_MS, copyRestoreFence, publishedMigrationDigest, replayStoreErasures } from '@substrat-run/kernel';
 import { attributeFailure } from './failure-attribution.js';
 import { auditedChange, withAuditedOutcomes } from './audited-change.js';
-import { BIND_EXPORT_BREAK_REFUSAL, CARRIED_AWAY_KEY, bindExportBreakRefusal, carriedAwayDump, dumpMetaValue, metaValueIn, crossVerticalHealth, exportBreakRefusal, isBindExportBreakRefusal, isExportBreakRefusal, isPrimaryScope, migrationProgress, ulid, auditWarningOf, } from '@substrat-run/kernel';
+import { BIND_EXPORT_BREAK_REFUSAL, CARRIED_AWAY_KEY, bindExportBreakRefusal, carriedAwayDump, dumpMetaValue, metaValueIn, crossVerticalHealth, exportBreakRefusal, isBindExportBreakRefusal, isExportBreakRefusal, isPrimaryScope, promoteReviewDigest, rebindReviewDigest, assertRebindReviewCurrent, migrationProgress, ulid, auditWarningOf, } from '@substrat-run/kernel';
 import { TENANT_HEADER, confinedTenant } from './auth.js';
 import { mintTenantToken } from './tenant-token.js';
 import { connectionGrantsForScope } from './vertical-client.js';
 import { runningVersionOf, runningVersionStoresOf, scopeStoreReachOf, scopeStoresOf, unrouteScope } from './platform-scope-stores.js';
-import { PUSH_HOLD_TTL_MS, runStoreKindRollout, storeKindRelease, storedReleaseLoader } from './store-releases.js';
+import { STORE_REBUILD_REQUEST_SUBREQUESTS, runStoreFleetRebuild, storeRebuildBudget, storeRebuildStatus } from './store-rebuild.js';
+import { PUSH_HOLD_TTL_MS, runStoreDriverRollout, storeDriverRelease, storedReleaseLoader } from './store-releases.js';
 import { assertNoUnreachableScopeCopies, claimScopeScriptReap, drainScopeScriptCopies, listAllScopeScriptCopies, recordStrandedStorage } from './scope-copy-cleanup.js';
 import { BACKFILL_PAGE_MAX, backfillScopeScriptCopies } from './scope-copy-backfill.js';
 import { oidcCallbackUrl, retireClientsOfReapedScope, wirePreviewAuth } from './preview-auth.js';
@@ -24,7 +25,7 @@ import { NON_PROBLEM_REFUSAL, coded, mapError, relayed } from './errors.js';
 import { maskDump, maskRecords } from './mask.js';
 import { createPseudonymizer } from './pseudonymize.js';
 import { openDump, sealDump } from './seal.js';
-import { assertSandboxContract, verticalUploadBindings, deployManifest, storedDeployManifest, pushedPermissionRegistry, deploymentRefFor, stableDeploymentRefFor, nextMigrationTag, upstreamStatusOf, } from './deploy.js';
+import { assertSandboxContract, verticalUploadBindings, migrationsDigestBindings, deployManifest, storedDeployManifest, pushedPermissionRegistry, deploymentRefFor, stableDeploymentRefFor, nextMigrationTag, upstreamStatusOf, } from './deploy.js';
 /**
  * Answer with a problem document (#113 phase 4).
  *
@@ -297,6 +298,8 @@ const rebindScopeVerticalBody = z.object({
     // version carry the SAME migration digest — or the operator acknowledges having
     // read both migration surfaces. Same discipline as a promote's `--ack-migrations`.
     ackMigrations: z.boolean().optional(),
+    // (#2347: the acknowledgement names the review it answers, `acknowledge.review`, as a
+    // promote's does; an `ackMigrations` without one is refused where the digests differ.)
     // Rebind the DIRECTORY only — no export/restore. For a scope whose source script
     // predates the `/internal/export` surface (#236) and so cannot be dumped at all.
     // The data is not deleted: it stays on the source script, which remains the
@@ -304,7 +307,8 @@ const rebindScopeVerticalBody = z.object({
     // on the target afterwards (`/verticals/:slug/instances` is idempotent, K-31).
     abandonData: z.boolean().optional(),
     // #1756: within one lineage the rebind is an adopt, refused when it breaks an app in the tenant.
-    acknowledge: bindAcknowledgement.optional(),
+    // #2347: `review`, the rebind review `ackMigrations` answers (`GET …/rebind-review`).
+    acknowledge: rebindAcknowledgement.optional(),
 });
 // #1756: an adopt moves the scope onto what its vertical serves, and is refused when that breaks
 // an app in the tenant. The body is optional, as it always was.
@@ -694,6 +698,8 @@ const TENANT_ROUTES = [
     { method: 'POST', re: /\/tenants\/[^/]+\/scopes\/[^/]+\/query$/, pin: 'path' },
     { method: 'POST', re: /\/tenants\/[^/]+\/scopes\/[^/]+\/reap$/, pin: 'path' },
     { method: 'POST', re: /\/tenants\/[^/]+\/scopes\/[^/]+\/rebind-vertical$/, pin: 'path' },
+    // #2347: the review a rebind's migration acknowledgement answers; visible exactly as the rebind is.
+    { method: 'GET', re: /\/tenants\/[^/]+\/scopes\/[^/]+\/rebind-review$/, pin: 'path' },
     { method: 'POST', re: /\/tenants\/[^/]+\/scopes\/[^/]+\/restore$/, pin: 'path' },
     { method: 'POST', re: /\/tenants\/[^/]+\/scopes\/[^/]+\/rewind$/, pin: 'path' },
     { method: 'POST', re: /\/tenants\/[^/]+\/scopes\/[^/]+\/snapshots$/, pin: 'path' },
@@ -845,7 +851,7 @@ export function createControlPlaneApi(options) {
     const { host, authenticate, authenticateBuilder, authenticateTenantService } = options;
     const copyLeaseMs = options.copyLeaseMs ?? SCOPE_COPY_LEASE_MS;
     /** The stores of the version the scope's deployment runs (`scopeStoresOf`, #2207). */
-    const manifestStores = (c, scope, running) => scopeStoresOf(c.var.admin, c.get('actor'), scope, options.storeKinds, running);
+    const manifestStores = (c, scope, running) => scopeStoresOf(c.var.admin, c.get('actor'), scope, options.storeDrivers, running);
     /**
      * The platform's path to a scope's stores, or nothing: no caller is a co-located host whose
      * own export, restore, wipe and erasure carry its stores, and a scope that declares none has
@@ -887,7 +893,7 @@ export function createControlPlaneApi(options) {
         const caller = options.platformScopeStores;
         if (!caller || !scope.vertical)
             return undefined;
-        const { running, all } = await scopeStoreReachOf(c.var.admin, c.get('actor'), scope, options.storeKinds);
+        const { running, all } = await scopeStoreReachOf(c.var.admin, c.get('actor'), scope, options.storeDrivers);
         if (all.length === 0)
             return undefined;
         const exported = await caller.exportStores({ tenantId: scope.tenantId, scopeId: scope.id, vertical: scope.vertical, stores: all });
@@ -897,7 +903,7 @@ export function createControlPlaneApi(options) {
         if (held) {
             throw new ControlPlaneError(409, `scope ${scope.id}'s store '${held.binding}' was declared by an earlier version of '${scope.vertical}' and ` +
                 `still holds data, and the version the scope runs does not declare it, so a dump of it could not be ` +
-                `restored. Declare '${held.binding}' as a '${held.kind}' again in a version the scope runs, then export; ` +
+                `restored. Declare '${held.binding}' as a '${held.driver}' again in a version the scope runs, then export; ` +
                 `or reap the scope without a backup, which wipes it`);
         }
         return exported.filter((store) => current.has(store.binding));
@@ -948,7 +954,7 @@ export function createControlPlaneApi(options) {
         };
     /**
      * A dump's stores, checked against what the destination's version declares (#2207), before
-     * any write: a binding it does not declare, or one of another kind, would be imported into an
+     * any write: a binding it does not declare, or one of another driver, would be imported into an
      * object nothing reads, or into one of the wrong shape.
      */
     const refuseUndeclaredDumpStores = async (c, scope, stores) => {
@@ -958,15 +964,15 @@ export function createControlPlaneApi(options) {
             throw new ControlPlaneError(422, 'restore refused: the dump names stores and the scope names no vertical');
         // The destination's running version only (L8): a binding only an earlier version declared
         // would be imported into an object nothing in the code the scope runs reads.
-        const declared = new Map((await runningVersionStoresOf(c.var.admin, c.get('actor'), scope, options.storeKinds))
-            .map((d) => [d.binding, d.kind]));
+        const declared = new Map((await runningVersionStoresOf(c.var.admin, c.get('actor'), scope, options.storeDrivers))
+            .map((d) => [d.binding, d.driver]));
         for (const store of stores) {
-            const kind = declared.get(store.binding);
-            if (kind === undefined) {
+            const driver = declared.get(store.binding);
+            if (driver === undefined) {
                 throw new ControlPlaneError(422, `restore refused: the dump names store '${store.binding}', which this scope's version does not declare`);
             }
-            if (kind !== store.kind) {
-                throw new ControlPlaneError(422, `restore refused: the dump's store '${store.binding}' is a '${store.kind}', and this scope's version declares a '${kind}'`);
+            if (driver !== store.driver) {
+                throw new ControlPlaneError(422, `restore refused: the dump's store '${store.binding}' is a '${store.driver}', and this scope's version declares a '${driver}'`);
             }
         }
     };
@@ -2044,7 +2050,11 @@ export function createControlPlaneApi(options) {
                     .refine((w) => w.toYear >= w.fromYear, 'window ends before it starts').nullable().optional(),
                 horizonYears: z.number().int().min(0).optional(),
             }).strict()
-            : z.object(fields).strict();
+            : row.provider === 'microsoft365'
+                // #2101: the channel folder, by its drive path. The connector resolves it and holds the
+                // fence to it; this only bounds the input.
+                ? z.object({ ...fields, folder: z.string().trim().min(1).max(400) }).strict()
+                : z.object(fields).strict();
         const input = schema.parse(await c.req.json());
         const grants = await c.var.host.connectionGrantsInScope(row.tenantId, scopeId);
         if (!grants.some((g) => g.connectionId === row.id && g.permission === input.permission)) {
@@ -2488,6 +2498,27 @@ export function createControlPlaneApi(options) {
         }
         return { refused, ...(refusal ? { refusal } : {}) };
     };
+    /**
+     * The two sides of a rebind review (#2347), as the host stores them: the version the scope is
+     * bound to (null: none, or one its lineage no longer holds) and the target lineage's serving
+     * version, each with its stored migrations. The read route and the rebind gate both read
+     * through here, so the digest a review hands out and the one the rebind recomputes are taken
+     * from the same rows the same way.
+     */
+    const rebindSidesOf = async (c, scope, target, servingVersionId) => {
+        const actor = c.get('actor');
+        const side = async (slug, id) => {
+            const v = await c.var.admin.getVersion(actor, id, slug);
+            return v ? { ...v, migrations: await c.var.admin.versionMigrations(actor, slug, id) } : null;
+        };
+        const [base, incoming] = await Promise.all([
+            scope.vertical && scope.verticalVersionId ? side(scope.vertical, scope.verticalVersionId) : null,
+            side(target, servingVersionId),
+        ]);
+        if (!incoming)
+            throw substratError('not_found', `unknown serving version for vertical '${target}'`);
+        return { base, target: incoming };
+    };
     /**
      * Move ONE scope onto a DIFFERENT vertical lineage's serving script (#389) — the
      * update-rebind behind retiring a platform-owned lineage in favour of a tenant-owned
@@ -2525,13 +2556,15 @@ export function createControlPlaneApi(options) {
             await c.var.admin.reassertSystemSwitches(actor, { tenantId, scopeId });
             return { servingRef: serving.ref, versionId: serving.versionId, alreadyBound: true };
         }
+        // #2347: the review binding is the rebind's own; what the host's bind takes is the rest.
+        const { review, ...bindAck } = opts.acknowledge ?? {};
         // #1756: within one lineage this is an adopt, and judged as one before anything moves. A
         // crossing is not judged (`bindExportBreaksOf`): the producer's slug itself changes.
         await refuseOnBreaks(actor, tenantId, scopeId, serving.versionId, {
             servingRef: serving.ref,
-            acknowledge: opts.acknowledge,
+            acknowledge: bindAck,
         });
-        const move = { acknowledge: opts.acknowledge };
+        const move = { acknowledge: bindAck };
         if (opts.abandonData) {
             // Directory-only crossing: no bytes move, so the frontier gate has nothing to
             // protect — the target provisions its own schema from scratch. The source script's
@@ -2560,15 +2593,22 @@ export function createControlPlaneApi(options) {
         // what this DO has already applied plus whatever a same-lineage update would have
         // brought — the crossing is then no riskier than an ordinary version bind. Anything
         // else (differing digests, or a scope with no bound version to compare) needs the
-        // operator's explicit acknowledgement.
-        const targetV = await c.var.admin.getVersion(actor, serving.versionId, target);
-        const currentV = scope.verticalVersionId
-            ? await c.var.admin.getVersion(actor, scope.verticalVersionId, scope.vertical)
-            : undefined;
-        const digestsMatch = Boolean(currentV && targetV && currentV.migrationDigest === targetV.migrationDigest);
+        // operator's explicit acknowledgement, bound to the review it answers (#2347).
+        const sides = await rebindSidesOf(c, scope, target, serving.versionId);
+        const digestsMatch = Boolean(sides.base && sides.base.migrationDigest === sides.target.migrationDigest);
+        await assertRebindReviewCurrent({
+            ackMigrations: opts.ackMigrations === true,
+            review,
+            target,
+            baseId: scope.verticalVersionId ?? null,
+            migrationsChange: !digestsMatch,
+            read: async () => ({ base: sides.base, baseVertical: scope.vertical, target: sides.target }),
+        });
         if (!digestsMatch && !opts.ackMigrations) {
-            throw new ControlPlaneError(409, `migration surfaces differ across lineages ('${scope.vertical}' ${currentV?.migrationDigest ?? '(unbound)'} → ` +
-                `'${target}' ${targetV?.migrationDigest ?? '(unknown)'}) — read both migration diffs, then re-run with ackMigrations`);
+            throw new ControlPlaneError(409, `migration surfaces differ across lineages ('${scope.vertical}' ${sides.base?.migrationDigest ?? '(unbound)'} → ` +
+                `'${target}' ${sides.target.migrationDigest}) — read the rebind review (GET ` +
+                `/tenants/:tenantId/scopes/:scopeId/rebind-review?vertical=<target>), then re-run with ackMigrations and the ` +
+                'acknowledge.review it returned');
         }
         const source = await verticalForScope(c, scope);
         const dest = await options.resolveVerticalRef?.(serving.ref);
@@ -2579,8 +2619,17 @@ export function createControlPlaneApi(options) {
         // pointer cross. `bindScopeVersion` rewrites `scopes.vertical` from the version row, audited.
         // No snapshot is taken here: the old copy is swept once the move is confirmed, so an
         // operator who wants a way back takes a snapshot or backup first.
-        const restored = await moveOntoServing(c, scope, source, dest, serving.ref, move);
-        await c.var.admin.bindScopeVersion(actor, tenantId, scopeId, serving.versionId, move).catch(relayHostRefusal);
+        // #2347: the route flips and the pointer crosses in ONE write, and only if the scope is still
+        // bound to the version the gate judged and the target still serves the version it judged: a
+        // promote on either lineage since then is refused as stale, and the move settles `retained`.
+        const restored = await moveOntoServing(c, scope, source, dest, serving.ref, {
+            ...move,
+            bind: {
+                versionId: serving.versionId,
+                expectedVersionId: scope.verticalVersionId ?? null,
+                expectedServing: { vertical: target, ref: serving.ref, versionId: serving.versionId },
+            },
+        });
         // #1674: re-assert the recorded OFF positions in the store the scope now routes to.
         await c.var.admin.reassertSystemSwitches(actor, { tenantId, scopeId }, { appliedInUnit: restored.switchedOff });
         return { servingRef: serving.ref, versionId: serving.versionId, tables: restored.tables };
@@ -2620,12 +2669,18 @@ export function createControlPlaneApi(options) {
                 scopeId, exact: true, loadStamp: restoredStamp,
                 ...(moveId ? { fence: copyRestoreFence(moveId, recordedAt, copyLeaseMs, erasureEpoch) } : {}),
             });
-            await c.var.admin.setScopeServingRef(actor, tenantId, scopeId, servingRef, {
-                ...routeOpts, expectedErasureEpoch: erasureEpoch,
+            const flip = {
+                acknowledge: routeOpts.acknowledge, expectedErasureEpoch: erasureEpoch,
                 ...(moveId ? { confirmMove: sourceStamp
                         ? { moveId, source: 'eligible', sourceMarker: { loadStamp: sourceStamp, revision: sourceRevision } }
                         : { moveId, source: 'retained' } } : {}),
-            }).catch(relayHostRefusal);
+            };
+            const { bind } = routeOpts;
+            await (bind
+                ? c.var.admin.bindScopeVersion(actor, tenantId, scopeId, bind.versionId, {
+                    ...flip, servingRef, expectedVersionId: bind.expectedVersionId, expectedServing: bind.expectedServing,
+                })
+                : c.var.admin.setScopeServingRef(actor, tenantId, scopeId, servingRef, flip)).catch(relayHostRefusal);
             return restored;
         }
         catch (error) {
@@ -4464,7 +4519,7 @@ export function createControlPlaneApi(options) {
         // and the claim before the key goes requires it, and the serving pointer as read, to still hold.
         const running = await runningVersionOf(c.var.admin, c.get('actor'), scope);
         // #2207: the stores of the version the deployment runs, resolved before anything is erased. A
-        // version that declares none is not asked. One that cannot be resolved while a kind is
+        // version that declares none is not asked. One that cannot be resolved while a driver is
         // registered refuses (503): the key must not be destroyed while a store may hold the subject.
         const reach = await platformStoresOf(c, scope, running);
         /**
@@ -5353,7 +5408,7 @@ export function createControlPlaneApi(options) {
                 force,
                 localApply: !vertical,
             });
-            const answer = vertical ? await vertical.rewindScope(scopeId, bookmark, { force }) : result;
+            const answer = vertical ? await vertical.rewindScope(scopeId, bookmark, { force, tenantId }) : result;
             // #1674: a rewind takes the scope's grants back to the bookmark, and with them any
             // schedule kill switch pulled since — a tenant owner could otherwise undo a staff
             // switch this way. Clearing the provisioned receipt, only once the rewind has gone
@@ -5434,10 +5489,10 @@ export function createControlPlaneApi(options) {
         return c.json({ vertical: slug, adopted, alreadyAdopted });
     });
     // Rebind ONE scope onto a different vertical lineage (#389) — the update-rebind that
-    // retires a platform-owned lineage in favour of a tenant-owned one. Deliberately NOT
-    // in BUILDER_ROUTES: a lineage crossing re-homes a customer's data under a different
-    // registry owner, which is a staff decision like admission — the allowlist's
-    // default-deny 403s a builder without a line here.
+    // retires a platform-owned lineage in favour of a tenant-owned one. Callers: staff, and a
+    // tenant credential pinned to the tenant in the path (TENANT_ROUTES); the crossing is judged
+    // by `crossingHidden`, the rule the review read shares. Deliberately NOT in BUILDER_ROUTES:
+    // a builder's push token is default-denied it.
     app.post('/tenants/:tenantId/scopes/:scopeId/rebind-vertical', async (c) => {
         const tenantId = tenantIdSchema.parse(c.req.param('tenantId'));
         const scopeId = scopeIdSchema.parse(c.req.param('scopeId'));
@@ -5445,10 +5500,11 @@ export function createControlPlaneApi(options) {
         // #977: the TARGET must be a vertical this principal can read — its own tenant's, or a
         // listed one. The path pin confines whose scope moves; without this, it could move onto
         // another tenant's private vertical, which a confined caller must not even learn exists
-        // (404, as `GET /verticals/:slug` answers it).
-        if (await notReadable(c.get('principal'), vertical)) {
-            return refuse(c, 'not_found', `unknown vertical: ${vertical}`);
-        }
+        // (404, as `GET /verticals/:slug` answers it). #2347: the one rule its review read shares.
+        const scope = await c.var.admin.getScopeRecord(c.get('actor'), tenantId, scopeId);
+        // An unknown scope answers the same bytes as a hidden crossing, so the two cannot be told apart.
+        if (!scope || (await crossingHidden(c.get('principal'), scope.vertical ?? null, vertical)))
+            return crossingNotFound(c);
         try {
             const r = await rebindScopeOntoVertical(c, tenantId, scopeId, vertical, {
                 ackMigrations,
@@ -5464,6 +5520,55 @@ export function createControlPlaneApi(options) {
             throw e;
         }
     });
+    // #2347: the review a rebind's migration acknowledgement answers — what the target lineage's
+    // serving version adds over the version the scope is bound to, with the binding
+    // (`acknowledge.review`) computed from the very rows this answer shows. The server picks both
+    // sides, so a caller cannot bind a review of a base the scope is not on.
+    //
+    // Who may read it is exactly who may make the rebind it answers (`crossingHidden`): a confined
+    // caller must be able to read both verticals, its own tenant's or a listed one. An unknown
+    // scope, a scope with no vertical, an unknown target and a vertical the caller cannot read all
+    // answer the same 404, so the read is no oracle for another tenant's verticals.
+    // Callers: staff, and a tenant credential pinned to the tenant in the path, as the rebind.
+    //
+    // The migration SQL itself stays owner-only, as `/versions/:id/migrations` keeps it: it describes
+    // a schema. A caller that does not own both verticals gets `migrations: null` and
+    // `migrationsWithheld: true`, with everything else: both sides, whether the digests differ, and
+    // the binding, so it can still acknowledge the review and rebind onto a listed vertical.
+    app.get('/tenants/:tenantId/scopes/:scopeId/rebind-review', async (c) => {
+        const tenantId = tenantIdSchema.parse(c.req.param('tenantId'));
+        const scopeId = scopeIdSchema.parse(c.req.param('scopeId'));
+        const target = z.string().min(1).parse(c.req.query('vertical'));
+        const actor = c.get('actor');
+        const scope = await c.var.admin.getScopeRecord(actor, tenantId, scopeId);
+        if (!scope?.vertical || (await crossingHidden(c.get('principal'), scope.vertical, target)))
+            return crossingNotFound(c);
+        const serving = await c.var.admin.verticalServing(actor, target).catch((e) => {
+            if (errorCodeOf(e) === 'not_found')
+                return undefined;
+            throw e;
+        });
+        if (serving === undefined)
+            return crossingNotFound(c);
+        if (serving === null) {
+            return refuseStatus(c, 409, `vertical '${target}' has no serving script yet — promote a version to prod first`);
+        }
+        const { base, target: incoming } = await rebindSidesOf(c, scope, target, serving.versionId);
+        const p = c.get('principal');
+        const withheld = (await notOwned(p, scope.vertical)) || (await notOwned(p, target));
+        const review = {
+            base: scope.verticalVersionId ?? null,
+            digest: await rebindReviewDigest(base && { vertical: scope.vertical, version: base }, { vertical: target, version: incoming }),
+        };
+        return c.json({
+            base: scope.verticalVersionId ? { vertical: scope.vertical, versionId: scope.verticalVersionId } : null,
+            target: { vertical: target, versionId: incoming.id },
+            digestsMatch: Boolean(base && base.migrationDigest === incoming.migrationDigest),
+            migrations: withheld || incoming.migrations === null ? null : migrationsOnTop(incoming.migrations, base ? base.migrations : undefined),
+            migrationsWithheld: withheld,
+            review,
+        });
+    });
     // #1756: which apps in this tenant binding `versionId` onto the scope would break — the
     // question the bind below refuses on, as a read, so a client can ask it before it records
     // anything of its own (the dashboard's Activity line) and show what an acknowledgement would
@@ -6022,6 +6127,16 @@ export function createControlPlaneApi(options) {
         const v = await verticalOf(p.actor, slug);
         return !v || (v.ownerTenant !== pin && !v.listed);
     };
+    /**
+     * #2347: the one visibility rule for a rebind across verticals and for the review it answers.
+     * A confined caller sees a crossing only when it can read both ends (`notReadable`: its own
+     * tenant's vertical, or a listed one), so whoever may make a rebind may read what it applies, and
+     * nobody reads the migrations of a vertical it could not see. A scope with no vertical (null)
+     * hides nothing here: the rebind refuses it on its own terms.
+     */
+    const crossingHidden = async (p, source, target) => (await notReadable(p, target)) || (source !== null && (await notReadable(p, source)));
+    /** What a hidden crossing answers, the same bytes whichever end is hidden. */
+    const crossingNotFound = (c) => refuse(c, 'not_found', 'not found');
     // The vertical id a request actually addresses. For a BUILDER it is `<tenantSlug>/<name>`
     // (builder-plane.md §5): they send a bare `--slug`, the control plane forms the prefix
     // from their authenticated tenant — so two builders can each own a `helpdesk` with no
@@ -6282,12 +6397,28 @@ export function createControlPlaneApi(options) {
         }
         // `versionMigrations` refuses a version of another vertical, so `base` cannot reach one.
         const migrationsOf = (id) => c.var.admin.versionMigrations(c.get('actor'), slug, id);
+        const versionOf = async (id) => {
+            const v = await c.var.admin.getVersion(c.get('actor'), id, slug);
+            if (!v)
+                throw substratError('not_found', `unknown version ${id} for vertical '${slug}'`);
+            return v;
+        };
         const base = c.req.query('base');
-        const [incoming, baseline] = await Promise.all([
-            migrationsOf(c.req.param('id')),
+        const incomingId = c.req.param('id');
+        const [incoming, baseline, incomingVersion, baseVersion] = await Promise.all([
+            migrationsOf(incomingId),
             base === undefined ? undefined : migrationsOf(base),
+            versionOf(incomingId),
+            base === undefined ? null : versionOf(base),
         ]);
-        return c.json({ migrations: incoming === null ? null : migrationsOnTop(incoming, baseline) });
+        // #2333: the binding a promote's acknowledgement carries, computed from the very rows this
+        // answer shows, in this answer — so a client cannot show one diff and bind another. The
+        // promote recomputes it from its own stored rows and refuses when it no longer matches.
+        const review = {
+            base: base ?? null,
+            digest: await promoteReviewDigest(baseVersion && { ...baseVersion, migrations: baseline ?? null }, { ...incomingVersion, migrations: incoming }),
+        };
+        return c.json({ migrations: incoming === null ? null : migrationsOnTop(incoming, baseline), review });
     });
     // The emitted entity model (#1214) one version ships: entities, field schemas, parent
     // edges, declared lifecycles — read out of the same retained manifest as the registry
@@ -6495,33 +6626,33 @@ export function createControlPlaneApi(options) {
         if (stores.length === 0)
             return;
         const holder = ulid();
-        const kinds = [...new Set(stores.map((store) => store.kind))].sort();
+        const drivers = [...new Set(stores.map((store) => store.driver))].sort();
         const held = [];
         try {
             if (!options.ensureScopeStores) {
                 throw new ControlPlaneError(501, `${operation} refused: '${slug}' declares a scope store and this control plane uploads no store script`);
             }
-            // A shared hold on each kind (#2300): a rollout holds it exclusively, and a rebuild that read
+            // A shared hold on each driver (#2300): a rollout holds it exclusively, and a rebuild that read
             // a script's release before a rollout moved it would upload the old release back over it.
             // Neither the refusal nor anything else here names another vertical: a push answers its own.
-            for (const kind of kinds) {
-                if (!(await host.admin.holdStoreKind(actor, { kind, holder, mode: 'shared', ttlMs: PUSH_HOLD_TTL_MS }))) {
-                    throw new ControlPlaneError(409, `${operation} refused: scope store kind '${kind}' is being rolled out; try again in a few minutes`);
+            for (const driver of drivers) {
+                if (!(await host.admin.holdStoreDriver(actor, { driver, holder, mode: 'shared', ttlMs: PUSH_HOLD_TTL_MS }))) {
+                    throw new ControlPlaneError(409, `${operation} refused: scope store driver '${driver}' is being rolled out; try again in a few minutes`);
                 }
-                held.push(kind);
+                held.push(driver);
             }
             const loadRelease = options.storeReleases
                 ? storedReleaseLoader({ admin: host.admin, actor, bytes: options.storeReleases.bytes })
                 : async () => undefined;
-            // One kind at a time, each renewing every hold first: a push whose uploads outlast a hold
-            // stops (409) rather than upload after a rollout could have taken the kind.
-            for (const kind of kinds) {
+            // One driver at a time, each renewing every hold first: a push whose uploads outlast a hold
+            // stops (409) rather than upload after a rollout could have taken the driver.
+            for (const driver of drivers) {
                 for (const each of held) {
-                    if (!(await host.admin.holdStoreKind(actor, { kind: each, holder, mode: 'shared', ttlMs: PUSH_HOLD_TTL_MS, renew: true }))) {
-                        throw new ControlPlaneError(409, `${operation} refused: the hold on scope store kind '${each}' lapsed during the upload; try again`);
+                    if (!(await host.admin.holdStoreDriver(actor, { driver: each, holder, mode: 'shared', ttlMs: PUSH_HOLD_TTL_MS, renew: true }))) {
+                        throw new ControlPlaneError(409, `${operation} refused: the hold on scope store driver '${each}' lapsed during the upload; try again`);
                     }
                 }
-                await options.ensureScopeStores({ vertical: slug, stores: stores.filter((store) => store.kind === kind), loadRelease });
+                await options.ensureScopeStores({ vertical: slug, stores: stores.filter((store) => store.driver === driver), loadRelease });
             }
         }
         catch (e) {
@@ -6537,8 +6668,8 @@ export function createControlPlaneApi(options) {
             throw e;
         }
         finally {
-            for (const kind of held)
-                await host.admin.releaseStoreKindHold(actor, { kind, holder }).catch(() => undefined);
+            for (const driver of held)
+                await host.admin.releaseStoreDriverHold(actor, { driver, holder }).catch(() => undefined);
         }
     };
     /**
@@ -6602,8 +6733,17 @@ export function createControlPlaneApi(options) {
             modules,
             doClasses,
             // #2210: a declared scope store adds no binding to either upload (L1), held at both call
-            // sites with a kind registered by upload-scope-store-bindings.test.ts.
-            bindings: verticalUploadBindings({ vertical: slug, manifest, platformBindings: storeBindings }),
+            // sites with a driver registered by upload-scope-store-bindings.test.ts.
+            bindings: verticalUploadBindings({
+                vertical: slug,
+                manifest,
+                // #2349: the digest of the served version's stored migrations, which its scopes hold
+                // the SQL they apply to.
+                platformBindings: [
+                    ...storeBindings,
+                    ...(await migrationsDigestBindings(await admin.versionMigrations(actor, slug, versionId))),
+                ],
+            }),
             // #1242: the version now being served, injected as `SUBSTRAT_VERSION_ID` so the
             // scope host stamps the signals `version` dimension. The serving script is one
             // stable script updated in place, so this refresh is what keeps the binding
@@ -6923,6 +7063,12 @@ export function createControlPlaneApi(options) {
         const manifest = deployManifest.parse(JSON.parse(raw));
         // §4 sandbox contract, before anything reaches the namespace.
         assertSandboxContract(manifest);
+        // #2339: a push whose migration digest is not the one its migrations give is refused here,
+        // before the upload, by the derivation `publishVersion` stores (and refuses with) again.
+        await publishedMigrationDigest({
+            id: 'push', migrationDigest: manifest.digests.migration, manifestJson: JSON.stringify(manifest),
+            migrations: manifest.migrations ?? null,
+        });
         // The workspace this push is FOR — the project's pin (package.json `substrat.tenant`),
         // sent by the CLI alongside the bundle. The pin is intent, and intent is honored or
         // refused, never silently reinterpreted: a BUILDER's workspace is already fixed by
@@ -7118,7 +7264,12 @@ export function createControlPlaneApi(options) {
                 compatibilityFlags: manifest.compatibilityFlags,
                 modules,
                 doClasses: manifest.doClasses,
-                bindings: verticalUploadBindings({ vertical: slug, manifest, platformBindings: [] }),
+                bindings: verticalUploadBindings({
+                    vertical: slug,
+                    manifest,
+                    // #2349: the migrations this push declares, which are the ones the version stores.
+                    platformBindings: await migrationsDigestBindings(manifest.migrations ?? null),
+                }),
                 // #1242: the freshly minted version id — this archive script IS that version,
                 // and a preview routed at it stamps the signals `version` dimension honestly.
                 versionId: id,
@@ -9010,19 +9161,19 @@ export function createControlPlaneApi(options) {
         const summary = await c.var.admin.summarizeModelUsage(c.get('actor'), { ...(q.tenantId ? { tenantId: q.tenantId } : {}), since, until }, options.modelMarginPercent ?? DEFAULT_MODEL_MARGIN_PERCENT);
         return c.json(summary);
     });
-    // -- store-kind releases (D-63, #2300) ----------------------------------------
+    // -- store-driver releases (D-63, #2300) ----------------------------------------
     // Staff only: none of these is on the builder or the tenant allowlist. A write is also made by a
     // person: `humanStaffActor` must name the same actor from a human staff sign-in, so the
     // automation token, which resolves to a staff actor as well, publishes nothing.
-    const registeredKind = (kind) => {
-        const registration = (options.storeKinds ?? STORE_KINDS).find((k) => k.kind === kind);
+    const registeredDriver = (driver) => {
+        const registration = (options.storeDrivers ?? STORE_DRIVERS).find((k) => k.driver === driver);
         if (!registration)
-            throw new ControlPlaneError(403, `scope store kind '${kind}' is not registered`);
+            throw new ControlPlaneError(403, `scope store driver '${driver}' is not registered`);
         return registration;
     };
     const releaseFlow = () => {
         if (!options.storeReleases || !options.ensureScopeStores) {
-            throw new ControlPlaneError(501, 'this control plane keeps no store kind releases');
+            throw new ControlPlaneError(501, 'this control plane keeps no store driver releases');
         }
         return { flow: options.storeReleases, ensureScopeStores: options.ensureScopeStores };
     };
@@ -9034,28 +9185,28 @@ export function createControlPlaneApi(options) {
      */
     const byAPerson = async (c) => {
         if (!/^application\/json\s*(;|$)/i.test(c.req.header('content-type') ?? '')) {
-            throw new ControlPlaneError(415, 'a store kind release write takes application/json');
+            throw new ControlPlaneError(415, 'a store driver release write takes application/json');
         }
         const origin = c.req.header('origin');
         const site = c.req.header('sec-fetch-site');
         if ((origin && origin !== new URL(c.req.url).origin) || (site && site !== 'same-origin' && site !== 'none')) {
-            throw new ControlPlaneError(403, 'a store kind release write is not taken from another origin');
+            throw new ControlPlaneError(403, 'a store driver release write is not taken from another origin');
         }
         const actor = c.get('actor');
         const person = options.humanStaffActor ? await options.humanStaffActor(c.req.raw) : null;
         if (!person || person !== actor) {
-            throw new ControlPlaneError(403, 'a store kind release is published by a person: this takes a staff sign-in, not a service token');
+            throw new ControlPlaneError(403, 'a store driver release is published by a person: this takes a staff sign-in, not a service token');
         }
         return actor;
     };
     /** The pin a release is run under, or a refusal: the platform runs only what this repo pins. */
     const pinOf = async (c, registration, sha256) => {
-        const stored = await c.var.admin.getStoreKindRelease(c.get('actor'), registration.kind, sha256);
+        const stored = await c.var.admin.getStoreDriverRelease(c.get('actor'), registration.driver, sha256);
         if (!stored)
-            throw new ControlPlaneError(404, `release ${sha256} of '${registration.kind}' is not stored`);
+            throw new ControlPlaneError(404, `release ${sha256} of '${registration.driver}' is not stored`);
         const pin = registration.releases.find((p) => p.sha256 === sha256);
         if (!pin) {
-            throw new ControlPlaneError(422, `release ${sha256} of '${registration.kind}' is not pinned in its registration; it runs once a reviewed change pins it and the control plane is deployed`);
+            throw new ControlPlaneError(422, `release ${sha256} of '${registration.driver}' is not pinned in its registration; it runs once a reviewed change pins it and the control plane is deployed`);
         }
         if (pin.sourceCommit !== stored.sourceCommit) {
             throw new ControlPlaneError(422, `release ${sha256} is pinned at ${pin.sourceCommit} and was stored as built from ${stored.sourceCommit}`);
@@ -9066,7 +9217,7 @@ export function createControlPlaneApi(options) {
         const { flow, ensureScopeStores } = releaseFlow();
         const actor = c.get('actor');
         const loadRelease = storedReleaseLoader({ admin: c.var.admin, actor, bytes: flow.bytes });
-        const result = await runStoreKindRollout({
+        const result = await runStoreDriverRollout({
             admin: c.var.admin,
             actor,
             registration,
@@ -9076,61 +9227,138 @@ export function createControlPlaneApi(options) {
                 const result = await ensureScopeStores({ ...input, loadRelease });
                 return result ? result.uploaded > 0 : true;
             },
-            ensureCanary: (to) => flow.ensureCanary({ kind: registration.kind, to, loadRelease }),
+            ensureCanary: (to) => flow.ensureCanary({ driver: registration.driver, to, loadRelease }),
             callCanary: flow.callCanary,
         });
         return c.json(result, result.complete ? 200 : 202);
     };
-    /** Neither a rollout nor a rollback lowers the stored schema: a kind migrates forward only. */
+    /** Neither a rollout nor a rollback lowers the stored schema: a driver migrates forward only. */
     const assertSchemaKept = (registration, from, to) => {
         if (from === null || from === to.sha256)
             return;
         const leaving = registration.releases.find((p) => p.sha256 === from);
         if (!leaving)
-            throw new ControlPlaneError(409, `the current release ${from} of '${registration.kind}' is not pinned, so its schema cannot be judged`);
+            throw new ControlPlaneError(409, `the current release ${from} of '${registration.driver}' is not pinned, so its schema cannot be judged`);
         if (to.schema < leaving.schema) {
             throw new ControlPlaneError(409, `release ${to.sha256} has schema ${to.schema}, below the current release's ${leaving.schema}: objects may already have migrated`);
         }
     };
-    app.get('/store-kinds/:kind', async (c) => {
-        const registration = registeredKind(c.req.param('kind'));
-        const state = await c.var.admin.storeKindState(c.get('actor'), registration.kind);
-        return c.json({ kind: registration.kind, pins: registration.releases, ...state });
+    /** Where the platform's rebuild of every script of the driver stands (#2309), if it rebuilds them. */
+    const rebuildView = async (admin, actor, driver, known) => {
+        const fingerprint = known ?? (await options.storeReleases?.fingerprint?.());
+        if (!fingerprint)
+            return undefined;
+        const [walk, declared] = await Promise.all([admin.storeDriverRebuild(actor, driver), admin.storeDriverDeclarations(actor, driver)]);
+        const verticals = [...new Set([...declared.verticals.map((v) => v.vertical), ...declared.unreadable])].sort();
+        return { fingerprint, ...storeRebuildStatus(walk, fingerprint, verticals, options.storeReleases?.settleMs), walk: walk ?? null };
+    };
+    app.get('/store-drivers/:driver', async (c) => {
+        const registration = registeredDriver(c.req.param('driver'));
+        const state = await c.var.admin.storeDriverState(c.get('actor'), registration.driver);
+        const rebuild = await rebuildView(c.var.admin, c.get('actor'), registration.driver);
+        return c.json({ driver: registration.driver, pins: registration.releases, ...state, ...(rebuild ? { rebuild } : {}) });
     });
     // Store a release's bytes, before or after its pin lands (D-63). Idempotent per bundle.
-    app.put('/store-kinds/:kind/releases', async (c) => {
-        const registration = registeredKind(c.req.param('kind'));
+    app.put('/store-drivers/:driver/releases', async (c) => {
+        const registration = registeredDriver(c.req.param('driver'));
         const actor = await byAPerson(c);
         const { flow } = releaseFlow();
         const body = await readCappedJson(c.req.raw, STORE_RELEASE_REQUEST_MAX_BYTES);
-        const release = await storeKindRelease({ admin: c.var.admin, actor, bytes: flow.bytes, kind: registration.kind, body });
+        const release = await storeDriverRelease({ admin: c.var.admin, actor, bytes: flow.bytes, driver: registration.driver, body });
         return c.json({ release, pinned: registration.releases.some((p) => p.sha256 === release.sha256 && p.sourceCommit === release.sourceCommit) }, 201);
     });
     // Roll a stored, pinned release out: the canary, then every vertical that ever declared the
-    // kind. Posting the same release again converges a rollout that stopped.
-    app.post('/store-kinds/:kind/rollouts', async (c) => {
-        const registration = registeredKind(c.req.param('kind'));
+    // driver. Posting the same release again converges a rollout that stopped.
+    app.post('/store-drivers/:driver/rollouts', async (c) => {
+        const registration = registeredDriver(c.req.param('driver'));
         await byAPerson(c);
         const { sha256 } = z.object({ sha256: z.string().regex(/^[0-9a-f]{64}$/) }).strict().parse(await c.req.json());
         const pin = await pinOf(c, registration, sha256);
-        const { current } = await c.var.admin.storeKindState(c.get('actor'), registration.kind);
+        const { current } = await c.var.admin.storeDriverState(c.get('actor'), registration.driver);
         assertSchemaKept(registration, current?.sha256 ?? null, pin);
         return rollOut(c, registration, sha256, 'rollout');
     });
     // Return to the immediately previous good release (D-63), never further and never a guess. After
     // a rollout that ended diverged, that is the current good release itself: undoing the bad
     // rollout converges every script back on the release the fleet was healthy on (kernel
-    // `storeKindStateIn`, `rollbackTarget`).
-    app.post('/store-kinds/:kind/rollback', async (c) => {
-        const registration = registeredKind(c.req.param('kind'));
+    // `storeDriverStateIn`, `rollbackTarget`).
+    app.post('/store-drivers/:driver/rollback', async (c) => {
+        const registration = registeredDriver(c.req.param('driver'));
         await byAPerson(c);
-        const { current, rollbackTarget } = await c.var.admin.storeKindState(c.get('actor'), registration.kind);
+        const { current, rollbackTarget } = await c.var.admin.storeDriverState(c.get('actor'), registration.driver);
         if (!current || !rollbackTarget)
-            throw new ControlPlaneError(409, `kind '${registration.kind}' has no previous good release to roll back to`);
+            throw new ControlPlaneError(409, `driver '${registration.driver}' has no previous good release to roll back to`);
         const pin = await pinOf(c, registration, rollbackTarget);
         assertSchemaKept(registration, current.sha256, pin);
         return rollOut(c, registration, rollbackTarget, 'rollback');
     });
+    // Run a pass of the platform's rebuild of every script of the driver now (#2309): the scheduled
+    // pass does the same every quarter hour, and this is for when that is too slow, after a key is
+    // revoked. Same lease and hold as the scheduled pass, so the two never walk the driver at once,
+    // and a rollout or rollback excludes both. Rebuilds at the release each script runs; moves none.
+    app.post('/store-drivers/:driver/rebuild', async (c) => {
+        const registration = registeredDriver(c.req.param('driver'));
+        const actor = await byAPerson(c);
+        // `deployFinished`: the person attests that no control-plane deploy is rolling out, so the walk
+        // this run starts proves every script current once done, without waiting out the settle window.
+        const text = await c.req.text();
+        let raw = {};
+        if (text.trim() !== '') {
+            try {
+                raw = JSON.parse(text);
+            }
+            catch {
+                throw new ControlPlaneError(422, 'the body is not JSON');
+            }
+        }
+        const body = z.object({ deployFinished: z.boolean().optional() }).strict().parse(raw);
+        const { flow, ensureScopeStores } = releaseFlow();
+        if (!flow.fingerprint)
+            throw new ControlPlaneError(501, 'this control plane does not rebuild store scripts');
+        let fingerprint;
+        let ran = {
+            driver: registration.driver,
+            outcome: 'error',
+            walked: [],
+            uploaded: [],
+            ...(body.deployFinished ? { deployFinished: true } : {}),
+        };
+        try {
+            // Inside the audited path: lists that cannot be read refuse the run, and that refusal is audited too.
+            fingerprint = await flow.fingerprint();
+            const [pass] = await runStoreFleetRebuild({
+                admin: c.var.admin,
+                actor,
+                drivers: [registration],
+                fingerprint,
+                bytes: flow.bytes,
+                ensure: ensureScopeStores,
+                ensureCanary: flow.ensureCanary,
+                budget: storeRebuildBudget(STORE_REBUILD_REQUEST_SUBREQUESTS),
+                // A person asking re-walks a driver that is done: after a control plane deploy has finished
+                // rolling out, that walk is the proof no script kept the older lists.
+                reverify: 'always',
+                ...(flow.settleMs === undefined ? {} : { settleMs: flow.settleMs }),
+                ...(body.deployFinished ? { attestedBy: actor } : {}),
+            });
+            const { rebuild: _row, ...result } = pass;
+            ran = { ...ran, ...result };
+        }
+        catch (e) {
+            ran = { ...ran, error: e instanceof Error ? e.message : String(e) };
+            throw e;
+        }
+        finally {
+            // Written however the pass ended, a refused one included: a staff request reached the fleet.
+            await c.var.admin.recordStoreDriverRebuildRun(actor, ran);
+        }
+        if (ran.outcome === 'error')
+            throw new ControlPlaneError(502, `the rebuild of '${registration.driver}' failed: ${ran.error}`);
+        const rebuild = (await rebuildView(c.var.admin, actor, registration.driver, fingerprint));
+        // Scripts remain, or another holder has the driver: post again.
+        const again = ran.outcome === 'paused' || ran.outcome === 'held' || ran.outcome === 'busy';
+        return c.json({ pass: ran, rebuild }, again ? 202 : 200);
+    });
     return app;
 }
 /**