@substrat-run/control-plane-api 0.165.0 → 0.167.0

package/dist/api.js

@@ -1,21 +1,23 @@
+import { sourceBuildRequest } from '@substrat-run/contracts';
 import { PREVIEW_CONNECTIONS_REFUSAL } from './connection-relay.js';
-import { connectionBindingOptions } from './connection-binding-options.js';
+import { bindingChangeRefusal, connectionBindingOptions, refusesBindingChange } from './connection-binding-options.js';
 import { resolveObservabilityWindow } from './observability-window.js';
 import { Hono } from 'hono';
-import { permissionKey, parseHostname, withLabel, RESERVED_LABEL_SEPARATOR, adminAction, lakeEventsInput, ownerTransferInput, memberInviteInput, memberRoleInput, ASSET_PART_PREFIX, assetHash, STORE_DRIVERS, STORE_RELEASE_MAX_BYTES, channelName, connectLinkId, connectionActivity, connectionActivitySource, connectionCredential, connectionCertificate, connectionFilter, connectionHealthState, connectionProvider, connectorDispatchKind, PROVISION_SIBLING_KIND, ARCHIVE_SCOPE_KIND, PROVISION_TENANT_KIND, SET_ENTITLEMENTS_KIND, MODEL_USAGE_KIND, SWEEP_RUNS_KIND, toConnectionHealthEntry, CONNECTION_EXPIRY_WARNING_DAYS, CONNECTION_STALE_DAYS, connectionProbe, createTenantInput, entitlementGrantInput, hostname as hostnameSchema, hostnameRegion, hostnameStatus, identityLink, errorCode, issueStatus, issueStatusInput, FINDINGS_LIMIT_DEFAULT, FINDINGS_LIMIT_MAX, findingCursorOf, findingKind, findingRuleInput, findingStatus, findingStatusInput, listPageQuery, matchesOutboundHost, pageOf, platformRequestFilter, principalId as principalIdSchema, impersonationStamp, promotionAcknowledgement, bindAcknowledgement, rebindAcknowledgement, provisionableJurisdiction, publishVersionInput, queryScopeInput, readScopeTableInput, entityHistoryInput, eventFacetInput, eventCauseInput, eventEffectsInput, invocationEventsInput, deadLettersInput, lifecycleFlowInput, operationSeriesCount, operationSeriesInput, delegatedReadParams, createOrgInput, roleKey as roleKeySchema, peerSwitch, verticalSlug, scopeText, systemSwitch, DEFAULT_DENIAL_LIMIT, DENIAL_LIMIT_MAX, denialGroupBy, registerVerticalInput, platformScriptCollision, platformScriptRefusal, PLATFORM_SCRIPT_NAMES, serviceDimensions, sweepRunKind, sweepRunOutcome, scopeDump, dataSubjectId as dataSubjectIdSchema, scopeId as scopeIdSchema, scopeStatus, requestRollupReading, meterDaysReading, verticalOwnersReading, utcDay, storageShape, surfaceName, tenantId as tenantIdSchema, tenantStatus, versionOrigin, z, PROBLEM_CONTENT_TYPE, toProblem, validationIssuesFrom, redrainEventsInput, importCursorMove, importCursorAcknowledgementMissing, REDRAIN_BATCH, migrationsOnTop, substratError, errorCodeOf, envVarSpec, capabilityFilterQuery, capabilityId as capabilityIdSchema, PLATFORM_FEATURES_HEADER, PLATFORM_FEATURE_SCOPE_SWEEPER, SOCIAL_RELAY_VERTICALS, isVerticalConnectorProvider, } from '@substrat-run/contracts';
+import { permissionKey, parseHostname, withLabel, RESERVED_LABEL_SEPARATOR, adminAction, lakeEventsInput, ownerTransferInput, memberInviteInput, memberRoleInput, ASSET_PART_PREFIX, assetHash, STORE_DRIVERS, storeCatalogOperation, storeDriverBasisAdmits, channelName, connectLinkId, connectionActivity, connectionActivitySource, connectionCredential, connectionCertificate, connectionFilter, connectionHealthState, connectionProvider, connectorDispatchKind, PROVISION_SIBLING_KIND, ARCHIVE_SCOPE_KIND, PROVISION_TENANT_KIND, SET_ENTITLEMENTS_KIND, MODEL_USAGE_KIND, SWEEP_RUNS_KIND, toConnectionHealthEntry, CONNECTION_EXPIRY_WARNING_DAYS, CONNECTION_STALE_DAYS, connectionProbe, connectionSendTest, connectionSendTestResult, connectionSenders, createTenantInput, entitlementGrantInput, hostname as hostnameSchema, hostnameRegion, hostnameStatus, identityLink, errorCode, issueStatus, issueStatusInput, FINDINGS_LIMIT_DEFAULT, FINDINGS_LIMIT_MAX, findingCursorOf, findingKind, findingRuleInput, findingStatus, findingStatusInput, listPageQuery, matchesOutboundHost, pageOf, platformRequestFilter, principalId as principalIdSchema, impersonationStamp, promotionAcknowledgement, bindAcknowledgement, rebindAcknowledgement, provisionableJurisdiction, publishVersionInput, queryScopeInput, readScopeTableInput, entityHistoryInput, eventFacetInput, eventCauseInput, eventEffectsInput, invocationEventsInput, deadLettersInput, lifecycleFlowInput, operationSeriesCount, operationSeriesInput, delegatedReadParams, createOrgInput, roleKey as roleKeySchema, peerSwitch, verticalSlug, scopeText, systemSwitch, DEFAULT_DENIAL_LIMIT, DENIAL_LIMIT_MAX, denialGroupBy, registerVerticalInput, platformScriptCollision, platformScriptRefusal, PLATFORM_SCRIPT_NAMES, serviceDimensions, sweepRunKind, sweepRunOutcome, scopeDump, dataSubjectId as dataSubjectIdSchema, scopeId as scopeIdSchema, scopeStatus, requestRollupReading, meterDaysReading, verticalOwnersReading, utcDay, storageShape, surfaceName, tenantId as tenantIdSchema, tenantStatus, versionOrigin, z, PROBLEM_CONTENT_TYPE, toProblem, validationIssuesFrom, redrainEventsInput, importCursorMove, importCursorAcknowledgementMissing, REDRAIN_BATCH, migrationsOnTop, substratError, errorCodeOf, envVarSpec, capabilityFilterQuery, capabilityId as capabilityIdSchema, PLATFORM_FEATURES_HEADER, PLATFORM_FEATURE_SCOPE_SWEEPER, PLATFORM_FEATURE_SOURCE_BUILDS, SOCIAL_RELAY_VERTICALS, isVerticalConnectorProvider, } from '@substrat-run/contracts';
 import { upstreamHandleIn, upstreamReferenceOf, withUpstreamReference } from '@substrat-run/contracts';
 import { ENGINE_ENTITLEMENT_KEYS, bareSlug, declarableEntitlementKey, entitlementNamespaceRefusal, grantableEntitlements } from '@substrat-run/contracts';
 import { SCOPE_COPY_LEASE_MS, copyRestoreFence, publishedMigrationDigest, replayStoreErasures } from '@substrat-run/kernel';
 import { attributeFailure } from './failure-attribution.js';
 import { auditedChange, withAuditedOutcomes } from './audited-change.js';
-import { BIND_EXPORT_BREAK_REFUSAL, CARRIED_AWAY_KEY, bindExportBreakRefusal, carriedAwayDump, dumpMetaValue, metaValueIn, crossVerticalHealth, exportBreakRefusal, isBindExportBreakRefusal, isExportBreakRefusal, listedPromoteRefusal, isExportBreakUnjudged, isPrimaryScope, promoteReviewDigest, rebindReviewDigest, assertRebindReviewCurrent, migrationProgress, ulid, auditWarningOf, REQUEST_ROLLUP_LIMIT_DEFAULT, REQUEST_ROLLUP_LIMIT_MAX, METER_DAYS_LIMIT_DEFAULT, METER_DAYS_LIMIT_MAX, releaseRolesAskScopes, releaseRoleSetRefusal, withheldOpsFailure, } from '@substrat-run/kernel';
+import { BIND_EXPORT_BREAK_REFUSAL, CARRIED_AWAY_KEY, bindExportBreakRefusal, carriedAwayDump, dumpMetaValue, metaValueIn, crossVerticalHealth, exportBreakRefusal, isBindExportBreakRefusal, isExportBreakRefusal, listedPromoteRefusal, isExportBreakUnjudged, isPrimaryScope, promoteReviewDigest, rebindReviewDigest, assertRebindReviewCurrent, migrationProgress, ulid, auditWarningOf, REQUEST_ROLLUP_LIMIT_DEFAULT, REQUEST_ROLLUP_LIMIT_MAX, STORAGE_GAUGE_RETENTION_MONTHS, MODEL_USAGE_RETENTION_DAYS, BILLING_ROLLUP_RETENTION_MONTHS, METER_DAYS_LIMIT_DEFAULT, METER_DAYS_LIMIT_MAX, releaseRolesAskScopes, releaseRoleSetRefusal, withheldOpsFailure, } from '@substrat-run/kernel';
 import { TENANT_HEADER, confinedTenant } from './auth.js';
 import { mintTenantToken } from './tenant-token.js';
 import { beginTransfer, connectionGrantsForScope, transferScope, isScopeNotHeld, notHeldIsBenign } from './vertical-client.js';
 import { COPY_JOB_MAX_MS, copyJobAt, copyJobHeld, copyJobId, copyJobLive, copyTagId, versionIdOfOrder, versionOrderOf, } from './copy-job.js';
 import { runningVersionOf, runningVersionStoresOf, scopeStoreReachOf, scopeStoresOf, unrouteScope } from './platform-scope-stores.js';
+import { liveApprovalOf } from './store-script.js';
 import { STORE_REBUILD_REQUEST_SUBREQUESTS, runStoreFleetRebuild, storeRebuildBudget, storeRebuildStatus } from './store-rebuild.js';
-import { PUSH_HOLD_TTL_MS, runStoreDriverRollout, storeDriverRelease, storedReleaseLoader } from './store-releases.js';
+import { PUSH_HOLD_TTL_MS, STORE_RELEASE_STORED_MAX_BYTES, approveStoredDriverRelease, readStoreDriverApprovals, runStoreDriverRevoke, runStoreDriverRollout, storeDriverRelease, storedReleaseLoader } from './store-releases.js';
 import { assertNoUnreachableScopeCopies, claimScopeScriptReap, drainScopeScriptCopies, listAllScopeScriptCopies, recordStrandedStorage } from './scope-copy-cleanup.js';
 import { BACKFILL_PAGE_MAX, backfillScopeScriptCopies } from './scope-copy-backfill.js';
 import { oidcCallbackUrl, retireClientsOfReapedScope, wirePreviewAuth } from './preview-auth.js';
@@ -76,6 +78,8 @@ import { queryLakeEvents } from './lake-gateway.js';
 import { LakeQueryError } from './r2-sql-engine.js';
 import { isCustomHostname, validateBindableHostname, } from './custom-hostnames.js';
 import { isSocialRelayVertical, reconcileScopeSocialRelay, relayHostnames, } from './social-relay.js';
+/** The body of a connection's test message (#2343), plain enough to be the same in HTML and text. */
+const SEND_TEST_TEXT = 'This is a test message from a mail connection. It reached you, so its sender address can send.';
 /**
  * Response headers carrying the CLI version advisory (`ControlPlaneApiOptions.cliAdvisory`).
  * The CLI reads these by the same spelling (`packages/cli/src/version.ts`); exported so a
@@ -700,6 +704,9 @@ const TENANT_ROUTES = [
     // #2100: the PUBLIC certificate a connection signs in with — same pin as the credential view.
     { method: 'GET', re: /\/tenants\/[^/]+\/connections\/[^/]+\/certificate$/, pin: 'path' },
     { method: 'POST', re: /\/tenants\/[^/]+\/connections\/[^/]+\/verify$/, pin: 'path' },
+    // #2343: a mail connection's test send. The dashboard sends it only to the signed-in person.
+    { method: 'POST', re: /\/tenants\/[^/]+\/connections\/[^/]+\/send-test$/, pin: 'path' },
+    { method: 'GET', re: /\/tenants\/[^/]+\/connections\/[^/]+\/senders$/, pin: 'path' },
     // A vertical's mailed connect links (connections.md §3.5.4): the consent landing's liveness
     // read, the callback's spend and its undo, and the integrations card's list and revoke.
     { method: 'GET', re: /\/tenants\/[^/]+\/connect-links$/, pin: 'path' },
@@ -715,6 +722,8 @@ const TENANT_ROUTES = [
     { method: 'POST', re: /\/tenants\/[^/]+\/orgs$/, pin: 'path' },
     { method: 'POST', re: /\/tenants\/[^/]+\/role-assignments$/, pin: 'path' },
     { method: 'DELETE', re: /\/tenants\/[^/]+\/role-assignments$/, pin: 'path' },
+    { method: 'GET', re: /\/tenants\/[^/]+\/entitlements$/, pin: 'path' },
+    { method: 'GET', re: /\/tenants\/[^/]+\/metered-usage$/, pin: 'path' },
     // An install's entitlement. The handler narrows WHICH key a tenant credential may
     // grant (`tenantGrantableEntitlement`): the pin alone would let it grant itself any.
     { method: 'PUT', re: /\/tenants\/[^/]+\/entitlements\/[^/]+$/, pin: 'path' },
@@ -1147,7 +1156,7 @@ export function createControlPlaneApi(options) {
     const advisory = options.cliAdvisory;
     app.use('*', async (c, next) => {
         await next();
-        c.header(PLATFORM_FEATURES_HEADER, PLATFORM_FEATURE_SCOPE_SWEEPER);
+        c.header(PLATFORM_FEATURES_HEADER, [PLATFORM_FEATURE_SCOPE_SWEEPER, ...(options.sourceBuilds ? [PLATFORM_FEATURE_SOURCE_BUILDS] : [])].join(','));
         if (advisory?.minVersion)
             c.header(CLI_MIN_VERSION_HEADER, advisory.minVersion);
         if (advisory?.latestVersion)
@@ -1238,6 +1247,8 @@ export function createControlPlaneApi(options) {
         { method: 'GET', re: /\/verticals\/[^/]+\/channels$/ },
         { method: 'GET', re: /\/verticals\/[^/]+\/channels\/[^/]+\/history$/ },
         { method: 'POST', re: /\/verticals\/[^/]+\/channels\/[^/]+\/promote$/ },
+        { method: 'GET', re: /\/projects$/ },
+        { method: 'POST', re: /\/projects$/ },
         { method: 'POST', re: /\/verticals\/[^/]+\/deploy$/ },
         // A builder REQUESTS publication of a vertical it owns (marketplace-publish.md §5); the
         // `listing` flip stays staff-only. Ownership is checked in the handler.
@@ -1679,6 +1690,168 @@ export function createControlPlaneApi(options) {
     });
     // -- entitlements (§4.3) ---------------------------------------------------
     app.get('/tenants/:tenantId/entitlements', async (c) => c.json(await c.var.admin.listEntitlements(c.get('actor'), tenantIdSchema.parse(c.req.param('tenantId')))));
+    // One tenant's persisted usage, with no price-bearing fields (#2689). This read never
+    // wakes a scope or writes a row. A gauge projection is capped at 501 narrow scope rows;
+    // request rows at 10,000 plus 30 status rows; model pages at 25 x 501: at most 28
+    // directory calls and 23,056 projected rows. Labels are capped at the read source,
+    // and no staff ledger row crosses the RPC. The 5-second cooperative budget stops new
+    // reads, though it cannot interrupt one in flight. Every cap marks a lower bound.
+    // The dashboard credential reaches this path only when its signed tenant pin matches.
+    app.get('/tenants/:tenantId/metered-usage', async (c) => {
+        const tenantId = tenantIdSchema.parse(c.req.param('tenantId'));
+        if (outsideTenant(c.get('principal'), tenantId))
+            return refuse(c, 'forbidden', 'forbidden');
+        const admin = c.var.admin;
+        const actor = c.get('actor');
+        const usageNow = options.meteredUsageNow ?? (() => performance.now());
+        const deadline = usageNow() + 5_000;
+        const readAt = new Date().toISOString();
+        const until = readAt.slice(0, 10);
+        const since = new Date(Date.parse(`${until}T00:00:00Z`) - 30 * 86_400_000).toISOString().slice(0, 10);
+        const through = new Date(Date.parse(`${until}T00:00:00Z`) - 86_400_000).toISOString().slice(0, 10);
+        const gaugeRead = await admin.readTenantStorageGauge(actor, tenantId, 500);
+        const gauge = gaugeRead.gauge;
+        const stale = gauge?.oldestReadAt ? Date.parse(readAt) - Date.parse(gauge.oldestReadAt) > 2 * 86_400_000 : false;
+        const storageState = gaugeRead.truncated ? 'truncated' : !gauge ? 'unavailable' : gauge.sampled === 0 ? (gauge.total === 0 ? 'empty' : 'not-sampled')
+            : gauge.failing > 0 ? 'failing' : stale ? 'stale' : gauge.sampled < gauge.total ? 'partial' : 'complete';
+        // Literal output allowlist: never spread a meter row (which also carries plan data).
+        const storage = {
+            state: storageState,
+            bytes: gauge && gauge.sampled > 0 ? gauge.bytes : null,
+            estimated: false,
+            lowerBound: gaugeRead.truncated,
+            truncatedReason: gaugeRead.truncated ? 'scope-cap' : null,
+            basis: 'scope-databases',
+            sampled: gauge?.sampled ?? 0,
+            total: gauge?.total ?? 0,
+            failing: gauge?.failing ?? 0,
+            oldestReadAt: gauge?.oldestReadAt ?? null,
+            excluded: gauge?.excluded ?? [],
+        };
+        let requests = {
+            state: 'unavailable', requests: null, estimated: true, lowerBound: false,
+            coveredDays: 0, totalDays: 30, sinceDay: since, untilDay: through,
+            lastReadAt: null, byVertical: [], breakdownTruncated: false,
+        };
+        if (usageNow() < deadline && admin.listTenantRequestMeter && admin.listRequestMeterDays) {
+            const [rows, days] = await Promise.all([
+                admin.listTenantRequestMeter(actor, tenantId, since, through, REQUEST_ROLLUP_LIMIT_MAX),
+                admin.listRequestMeterDays(actor, since, through),
+            ]);
+            const covered = days.filter((d) => d.readAt !== null && !d.saturated);
+            const coveredDaySet = new Set(covered.map((day) => day.day));
+            const clipped = rows.length === REQUEST_ROLLUP_LIMIT_MAX;
+            const groups = new Map();
+            let count = 0;
+            let countedRows = 0;
+            let requestLabelsTruncated = false;
+            for (const row of rows.slice(0, REQUEST_ROLLUP_LIMIT_MAX - 1)) {
+                if (!coveredDaySet.has(row.day))
+                    continue;
+                countedRows++;
+                count += row.requests;
+                if (row.labelTruncated)
+                    requestLabelsTruncated = true;
+                else
+                    groups.set(row.vertical, (groups.get(row.vertical) ?? 0) + row.requests);
+            }
+            const byVertical = [...groups].sort((a, b) => (a[0] ?? '').localeCompare(b[0] ?? ''));
+            const incomplete = covered.length < 30 || clipped;
+            requests = {
+                state: covered.length === 0 ? 'unavailable' : clipped ? 'truncated' : countedRows === 0 ? 'empty' : incomplete ? 'partial' : 'complete',
+                requests: countedRows > 0 ? count : null,
+                estimated: true,
+                lowerBound: countedRows > 0 && incomplete,
+                coveredDays: covered.length,
+                totalDays: 30,
+                sinceDay: since,
+                untilDay: through,
+                lastReadAt: covered.reduce((latest, day) => !latest || day.readAt > latest ? day.readAt : latest, null),
+                byVertical: covered.length > 0 ? byVertical.slice(0, 50).map(([vertical, n]) => ({ vertical, requests: n })) : [],
+                breakdownTruncated: covered.length > 0 && (byVertical.length > 50 || requestLabelsTruncated),
+            };
+        }
+        const groups = new Map();
+        let calls = 0;
+        let reportedCalls = 0;
+        let inputTokens = 0;
+        let outputTokens = 0;
+        let oldestRecordedAt = null;
+        let newestRecordedAt = null;
+        let truncated = false;
+        let truncatedReason = null;
+        let modelSkipped = false;
+        let labelsTruncated = false;
+        const earlier = (a, b) => a === null || b < a ? b : a;
+        const later = (a, b) => a === null || b > a ? b : a;
+        if (typeof admin.listTenantModelUsageMeter === 'function') {
+            let cursor;
+            for (let page = 0; page < 25; page++) {
+                if (usageNow() >= deadline) {
+                    if (calls > 0) {
+                        truncated = true;
+                        truncatedReason = 'time-budget';
+                    }
+                    else
+                        modelSkipped = true;
+                    break;
+                }
+                const entries = await admin.listTenantModelUsageMeter(actor, { tenantId, since: `${since}T00:00:00Z`, until: `${until}T00:00:00Z`, limit: 501, ...(cursor ? { cursor } : {}) });
+                for (const entry of entries.slice(0, 500)) {
+                    calls++;
+                    if (entry.reported) {
+                        reportedCalls++;
+                        inputTokens += entry.inputTokens;
+                        outputTokens += entry.outputTokens;
+                    }
+                    oldestRecordedAt = earlier(oldestRecordedAt, entry.at);
+                    newestRecordedAt = later(newestRecordedAt, entry.at);
+                    if (entry.labelTruncated)
+                        labelsTruncated = true;
+                    else {
+                        const key = `${entry.vertical}\u0000${entry.model}`;
+                        const row = groups.get(key) ?? { vertical: entry.vertical, model: entry.model, calls: 0, reportedCalls: 0, inputTokens: 0, outputTokens: 0 };
+                        row.calls++;
+                        if (entry.reported) {
+                            row.reportedCalls++;
+                            row.inputTokens += entry.inputTokens;
+                            row.outputTokens += entry.outputTokens;
+                        }
+                        groups.set(key, row);
+                    }
+                }
+                truncated = entries.length > 500;
+                truncatedReason = truncated ? 'page-cap' : null;
+                if (!truncated)
+                    break;
+                cursor = { at: entries[499].at, id: entries[499].id };
+            }
+        }
+        const modelGroups = [...groups.values()].sort((a, b) => a.vertical.localeCompare(b.vertical) || a.model.localeCompare(b.model));
+        const models = {
+            state: typeof admin.listTenantModelUsageMeter !== 'function' || modelSkipped ? 'unavailable' : calls === 0 ? 'empty' : truncated ? 'truncated' : 'complete',
+            calls: calls > 0 ? calls : null,
+            reportedCalls,
+            inputTokens: reportedCalls > 0 ? inputTokens : null,
+            outputTokens: reportedCalls > 0 ? outputTokens : null,
+            estimated: false,
+            lowerBound: truncated,
+            truncatedReason,
+            since: `${since}T00:00:00Z`,
+            until: `${until}T00:00:00Z`,
+            oldestRecordedAt,
+            newestRecordedAt,
+            byVerticalModel: modelGroups.slice(0, 50).map((row) => ({ vertical: row.vertical, model: row.model, calls: row.calls, reportedCalls: row.reportedCalls, inputTokens: row.reportedCalls > 0 ? row.inputTokens : null, outputTokens: row.reportedCalls > 0 ? row.outputTokens : null })),
+            breakdownTruncated: modelGroups.length > 50 || labelsTruncated,
+        };
+        return c.json({
+            readAt,
+            retention: { storageMonths: STORAGE_GAUGE_RETENTION_MONTHS, modelDays: MODEL_USAGE_RETENTION_DAYS, requestMonths: BILLING_ROLLUP_RETENTION_MONTHS },
+            storage,
+            requests,
+            models,
+        });
+    });
     app.put('/tenants/:tenantId/entitlements/:key', async (c) => {
         const tenantId = tenantIdSchema.parse(c.req.param('tenantId'));
         // The body is the plan half (#33) and optional — a bodyless PUT is the
@@ -2361,6 +2534,13 @@ export function createControlPlaneApi(options) {
         if (!grants.some((g) => g.connectionId === row.id && g.permission === input.permission)) {
             return refuseStatus(c, 409, `connection does not hold '${input.permission}' on scope ${scopeId}; grant it through the tenant's authorized connection flow, then bind`);
         }
+        // A change the held binding cannot take in place is the operator's to act on, not a failed write.
+        const held = refusesBindingChange(row.provider)
+            ? (await inspectorOf(row)?.bindings?.(c.var.host, row))?.find((b) => b.scopeId === scopeId)
+            : undefined;
+        const changeRefused = bindingChangeRefusal(row.provider, held, input);
+        if (changeRefused)
+            return refuseStatus(c, 409, changeRefused);
         const operationId = ulid();
         const done = await auditedChange({
             flow: 'connection-binding', operationId,
@@ -2400,6 +2580,70 @@ export function createControlPlaneApi(options) {
         }
         return c.json(connectionProbe.parse(await probe(c.var.host, row)));
     });
+    /** The addresses a mail connection may send as (#2343) — the send test's picker, whole and uncut. */
+    app.get('/tenants/:tenantId/connections/:id/senders', async (c) => {
+        const row = await inspectableConnection(c);
+        if (!row)
+            return refuse(c, 'not_found', 'unknown connection');
+        const sender = options.mailSenders?.[row.provider];
+        if (!sender)
+            return refuseStatus(c, 501, `no mail sender registered for provider '${row.provider}'`);
+        return c.json(connectionSenders.parse({ senders: await sender.senders(c.var.host, row) }));
+    });
+    /**
+     * **Send a test message through a connection** (#2343) — the probe for mail, which cannot be
+     * probed without sending. From one of the connection's own senders, to one recipient; the
+     * dashboard's door sends only to the signed-in person's own address.
+     *
+     * Like `/verify`, a refusal is `200 { ok: false, error }` in the connector's own words (outside
+     * the granted scope, throttled, sign-in failed), and the send rides the connector's recorded
+     * egress, so health is written as for any send. A success is recorded by the connector as that
+     * sender's verification. Not an audited admin-log mutation, the same class as a probe; who
+     * asked is logged on the request record instead, never the recipient.
+     */
+    app.post('/tenants/:tenantId/connections/:id/send-test', async (c) => {
+        const row = await inspectableConnection(c);
+        if (!row)
+            return refuse(c, 'not_found', 'unknown connection');
+        const sender = options.mailSenders?.[row.provider];
+        if (!sender)
+            return refuseStatus(c, 501, `no mail sender registered for provider '${row.provider}'`);
+        const body = connectionSendTest.safeParse(await c.req.json().catch(() => null));
+        if (!body.success)
+            return refuse(c, 'validation_failed', 'from and to must each be one email address');
+        const { from, to } = body.data;
+        const senders = await sender.senders(c.var.host, row);
+        if (!senders.some((s) => s.toLowerCase() === from.toLowerCase())) {
+            return refuse(c, 'validation_failed', `'${from}' is not one of this connection's sender addresses`);
+        }
+        const principal = c.get('principal');
+        console.log('connection.send-test', {
+            tenantId: row.tenantId,
+            connectionId: row.id,
+            provider: row.provider,
+            actor: c.get('actor'),
+            onBehalfOf: principal.kind === 'tenant' ? (principal.onBehalfOf?.principal ?? null) : null,
+        });
+        try {
+            await sender.send(c.var.host, row, {
+                from: { email: from },
+                to: [{ email: to }],
+                subject: 'Substrat test message',
+                html: `<p>${SEND_TEST_TEXT}</p>`,
+                text: SEND_TEST_TEXT,
+                attachments: [],
+            });
+            return c.json(connectionSendTestResult.parse({ ok: true, status: null, error: null }));
+        }
+        catch (e) {
+            const status = e?.status;
+            return c.json(connectionSendTestResult.parse({
+                ok: false,
+                status: typeof status === 'number' ? status : null,
+                error: (e instanceof Error ? e.message : String(e)).slice(0, 600),
+            }));
+        }
+    });
     /**
      * **What the connection has done** (#605) — the connector's dispatch ledger, projected.
      *
@@ -7410,7 +7654,13 @@ export function createControlPlaneApi(options) {
                         throw new ControlPlaneError(409, `${operation} refused: the hold on scope store driver '${each}' lapsed during the upload; try again`);
                     }
                 }
-                await options.ensureScopeStores({ vertical: slug, stores: stores.filter((store) => store.driver === driver), loadRelease });
+                const registration = (options.storeDrivers ?? STORE_DRIVERS).find((k) => k.driver === driver);
+                if (!registration)
+                    throw new ControlPlaneError(403, `scope store driver '${driver}' is not registered`);
+                // Read under the shared hold (D-65): a revoke takes the driver exclusively, so one written
+                // before this read is seen, and none is written until this upload is done.
+                const approvals = await readStoreDriverApprovals(host.admin, actor, registration);
+                await options.ensureScopeStores({ vertical: slug, stores: stores.filter((store) => store.driver === driver), loadRelease, approvals });
             }
         }
         catch (e) {
@@ -7982,12 +8232,98 @@ export function createControlPlaneApi(options) {
     // pointing at a deployment that is not there. The version lands PENDING — except a
     // PRIVATE vertical's, which self-admits below the seam (its blast radius is its own
     // tenant); for everything else admission still gates serving.
+    app.all('/projects', async (c) => {
+        if (!options.sourceBuilds)
+            return refuseStatus(c, 501, 'source builds are not configured');
+        const p = c.get('principal');
+        if (p.kind !== 'builder' && p.kind !== 'staff')
+            return refuse(c, 'forbidden', 'forbidden');
+        const tenant = p.kind === 'builder' ? p.tenantId : c.req.query('tenant');
+        if (!tenant)
+            return refuse(c, 'validation_failed', 'tenant id is required');
+        const tenants = await c.var.admin.listTenants(c.get('actor'));
+        if (!tenants.some((t) => t.id === tenant))
+            return refuse(c, 'not_found', 'unknown workspace');
+        let body;
+        if (c.req.method === 'POST') {
+            const input = z.object({ slug: z.string().min(1), name: z.string().min(1), repository: z.unknown().optional() }).parse(await c.req.json());
+            const team = tenants.find((t) => t.id === tenant);
+            const slug = await ownerOf(c.get('actor'), input.slug) === tenant || input.slug.startsWith(`${team.slug}/`) ? input.slug : `${team.slug}/${input.slug}`;
+            verticalSlug.parse(slug);
+            const owner = await ownerOf(c.get('actor'), slug);
+            if (owner !== undefined && owner !== tenant)
+                return refuse(c, 'forbidden', 'forbidden');
+            body = JSON.stringify({ ...input, slug });
+        }
+        else if (c.req.method !== 'GET')
+            return refuseStatus(c, 405, 'method not allowed');
+        return options.sourceBuilds.projects(tenant, new Request('https://source/projects', {
+            method: c.req.method, ...(body ? { headers: { 'content-type': 'application/json' }, body } : {}),
+        }));
+    });
+    app.post('/source/github-access', async (c) => {
+        if (c.get('principal').kind !== 'staff')
+            return refuse(c, 'forbidden', 'forbidden');
+        if (!options.githubRepositoryAccess)
+            return refuseStatus(c, 501, 'GitHub source access is not configured');
+        const input = z.object({ tenantId: tenantIdSchema, owner: z.string().regex(/^[\w-]+$/), repo: z.string().regex(/^[\w.-]+$/), scope: z.enum(['read', 'write']).default('read') }).parse(await c.req.json());
+        const connection = await c.var.admin.openConnection(input.tenantId, 'dashboard', 'github', input.owner);
+        const installationId = connection?.secret.installationId;
+        if (typeof installationId !== 'string')
+            return refuse(c, 'not_found', 'no connected GitHub installation for this tenant and owner');
+        return c.json(await options.githubRepositoryAccess(input.tenantId, input.owner, input.repo, installationId, input.scope));
+    });
     app.post('/verticals/:slug/deploy', async (c) => {
         if (!options.deployVertical) {
             return refuseStatus(c, 501, 'deploy is not configured on this control plane');
         }
         const p = c.get('principal');
-        const form = await c.req.formData();
+        let built;
+        let requestedVersion;
+        let form;
+        if (options.sourceBuilds) {
+            if (!c.req.header('content-type')?.startsWith('application/json')) {
+                return refuseStatus(c, 415, 'submit source JSON; client-built module uploads are no longer accepted');
+            }
+            const input = sourceBuildRequest.parse(await c.req.json());
+            const bare = c.req.param('slug');
+            let sourceSlug = bare;
+            let sourceTenant = null;
+            if (p.kind === 'builder') {
+                if (input.tenant && input.tenant !== p.tenantId && input.tenant !== p.tenantSlug) {
+                    return refuse(c, 'forbidden', `push is pinned to workspace '${input.tenant}' but this session acts for '${p.tenantSlug}'`);
+                }
+                sourceTenant = p.tenantId;
+                sourceSlug = effectiveSlug(p, bare);
+            }
+            else if (input.tenant) {
+                const tenant = (await c.var.admin.listTenants(c.get('actor'))).find((t) => t.id === input.tenant || t.slug === input.tenant);
+                if (!tenant)
+                    return refuse(c, 'not_found', 'unknown workspace');
+                sourceTenant = tenant.id;
+                sourceSlug = bare.startsWith(`${tenant.slug}/`) || await ownerOf(c.get('actor'), bare) === tenant.id ? bare : `${tenant.slug}/${bare}`;
+            }
+            const owner = await ownerOf(c.get('actor'), sourceSlug);
+            if (sourceTenant && owner !== undefined && owner !== sourceTenant)
+                return refuse(c, 'forbidden', 'forbidden');
+            sourceTenant ??= owner ?? null;
+            verticalSlug.parse(sourceSlug);
+            if (platformScriptCollision(sourceSlug))
+                return refuseStatus(c, 422, 'reserved platform script name');
+            requestedVersion = input.version;
+            built = await options.sourceBuilds.build(sourceTenant ?? 'platform', sourceSlug, input);
+            form = built.form;
+            // Addressing is the authenticated caller's, never a field emitted by project code.
+            form.delete('tenant');
+            if (input.tenant)
+                form.set('tenant', input.tenant);
+            form.delete('allowFork');
+            if (input.allowFork)
+                form.set('allowFork', '1');
+        }
+        else {
+            return refuseStatus(c, 501, 'platform source builds are not configured');
+        }
         const raw = form.get('manifest');
         if (typeof raw !== 'string')
             return refuse(c, 'validation_failed', 'missing manifest part');
@@ -7996,6 +8332,8 @@ export function createControlPlaneApi(options) {
             return refuse(c, 'validation_failed', 'manifest registry: required when modules are present');
         }
         const manifest = deployManifest.parse(parsed);
+        if (requestedVersion && manifest.version !== requestedVersion)
+            return refuseStatus(c, 502, 'build service produced a different release version');
         const moduleProblems = pushedModuleRegistryProblems(manifest.modules, manifest.registry);
         if (moduleProblems.length > 0)
             return refuse(c, 'validation_failed', `manifest registry.permissions: ${moduleProblems.join('; ')}`);
@@ -8067,7 +8405,7 @@ export function createControlPlaneApi(options) {
             // Otherwise the claim lands under the tenant prefix, exactly like a builder push —
             // same namespace, no claim race with other workspaces' bare names.
             const bareOwner = await ownerOf(c.get('actor'), bare);
-            slug = bareOwner === workspace.id ? bare : `${workspace.slug}/${bare}`;
+            slug = bare.startsWith(`${workspace.slug}/`) || bareOwner === workspace.id ? bare : `${workspace.slug}/${bare}`;
             const existingOwner = slug === bare ? bareOwner : await ownerOf(c.get('actor'), slug);
             if (existingOwner !== undefined && existingOwner !== workspace.id) {
                 return refuse(c, 'forbidden', `vertical '${slug}' is not owned by workspace '${pin}'`);
@@ -8345,7 +8683,7 @@ export function createControlPlaneApi(options) {
             }
         }
         const version = await c.var.admin.getVersion(c.get('actor'), id, slug);
-        return c.json({ ...version, ...(warnings.length ? { warnings } : {}) }, 201);
+        return c.json({ ...version, ...(built ? { projectId: built.projectId, revision: built.revision, dataLoss: built.dataLoss } : {}), ...(warnings.length ? { warnings } : {}) }, 201);
     });
     // -- where this platform runs (ops ergonomics) -----------------------------
     // The console renders refs it already has — `servingRef`, a store's `ref`, a version's
@@ -10641,10 +10979,7 @@ export function createControlPlaneApi(options) {
      * `text/plain` beacon cannot set it without a CORS preflight, 415) and refuse a request a
      * browser marks as from another origin (403). A request with neither header is the CLI's.
      */
-    const byAPerson = async (c, words = { write: 'a store driver release write', person: 'a store driver release is published by a person' }) => {
-        if (!/^application\/json\s*(;|$)/i.test(c.req.header('content-type') ?? '')) {
-            throw new ControlPlaneError(415, `${words.write} takes application/json`);
-        }
+    const staffPerson = async (c, words) => {
         const origin = c.req.header('origin');
         const site = c.req.header('sec-fetch-site');
         if ((origin && origin !== new URL(c.req.url).origin) || (site && site !== 'same-origin' && site !== 'none')) {
@@ -10657,20 +10992,87 @@ export function createControlPlaneApi(options) {
         }
         return actor;
     };
-    /** The pin a release is run under, or a refusal: the platform runs only what this repo pins. */
-    const pinOf = async (c, registration, sha256) => {
-        const stored = await c.var.admin.getStoreDriverRelease(c.get('actor'), registration.driver, sha256);
-        if (!stored)
-            throw new ControlPlaneError(404, `release ${sha256} of '${registration.driver}' is not stored`);
-        const pin = registration.releases.find((p) => p.sha256 === sha256);
-        if (!pin) {
-            throw new ControlPlaneError(422, `release ${sha256} of '${registration.driver}' is not pinned in its registration; it runs once a reviewed change pins it and the control plane is deployed`);
-        }
-        if (pin.sourceCommit !== stored.sourceCommit) {
-            throw new ControlPlaneError(422, `release ${sha256} is pinned at ${pin.sourceCommit} and was stored as built from ${stored.sourceCommit}`);
-        }
-        return pin;
+    const byAPerson = async (c, words = { write: 'a store driver release write', person: 'a store driver release is published by a person' }) => {
+        if (!/^application\/json\s*(;|$)/i.test(c.req.header('content-type') ?? '')) {
+            throw new ControlPlaneError(415, `${words.write} takes application/json`);
+        }
+        return staffPerson(c, words);
     };
+    const approvalWords = { write: 'a store driver release approval', person: 'a store driver release is approved by a person' };
+    const revokeWords = { write: 'a store driver release revoke', person: 'a store driver release is revoked by a person' };
+    const statusWords = { write: 'store driver release status', person: 'store driver release status is read by a person' };
+    const nonPrinting = /[\p{Cc}\p{Cf}\u2028\u2029]/u;
+    const auditText = z.string().min(1).max(2048).refine((value) => value.trim().length > 0 && !nonPrinting.test(value), { message: 'must be printable text' });
+    const reviewEvidence = z.object({ met: z.boolean(), evidence: auditText }).strict();
+    const checkedEvidence = z.object({ checked: z.literal(true), evidence: auditText }).strict();
+    // D-66 stores the reviewer's exact references: one HTTPS repository URL and one hex revision.
+    const repositoryReference = z.string().min(1).max(1024).refine((value) => {
+        if (!value.startsWith('https://') || /[\s\\?#]/u.test(value) || nonPrinting.test(value))
+            return false;
+        try {
+            const url = new URL(value);
+            return url.protocol === 'https:' && !!url.hostname && !url.username && !url.password &&
+                !url.search && !url.hash && url.pathname.split('/').some(Boolean);
+        }
+        catch {
+            return false;
+        }
+    }, { message: 'a source repository is an HTTPS URL with a host and path' });
+    const sourceCommit = z.string().regex(/^(?:[0-9a-f]{40}|[0-9a-f]{64})$/, { message: 'a source commit is 40 or 64 lowercase hex characters' });
+    // The release entry loads a Python class by identifier; catalog names keep their existing
+    // fixed-label grammar and additionally exclude characters that cannot safely appear in audit.
+    const approvalClassName = z.string().min(1).max(256).regex(/^[A-Za-z_][A-Za-z0-9_]*$/);
+    const approvalOperation = storeCatalogOperation.refine((name) => !nonPrinting.test(name));
+    const approvalBody = z.object({
+        reason: auditText,
+        sourceReferences: z.array(z.object({ repository: repositoryReference, commit: sourceCommit }).strict()).min(1).max(64),
+        isolationReview: z.object({
+            separateScriptPerTenant: reviewEvidence,
+            noOutboundAccess: reviewEvidence,
+            envelopeVerifiedOutsideDriver: reviewEvidence,
+            envelopeChecked: checkedEvidence,
+            reservedOperationsChecked: checkedEvidence,
+            noModuleStateChecked: checkedEvidence,
+        }).strict(),
+        schema: z.number().int().min(0),
+        className: approvalClassName,
+        operations: z.array(approvalOperation).max(256),
+    }).strict();
+    const revokeBody = z.object({ reason: auditText, emergency: z.boolean().optional() }).strict();
+    const approvalPathParts = new Set([
+        'reason', 'sourceReferences', 'repository', 'commit', 'isolationReview', 'separateScriptPerTenant',
+        'noOutboundAccess', 'envelopeVerifiedOutsideDriver', 'envelopeChecked', 'reservedOperationsChecked',
+        'noModuleStateChecked', 'met', 'checked', 'evidence', 'schema', 'className', 'operations', 'emergency',
+    ]);
+    const issueCodes = {
+        unrecognized_keys: 'unrecognized_key', invalid_type: 'invalid_type', too_small: 'out_of_range',
+        too_big: 'out_of_range', invalid_format: 'invalid_format', custom: 'invalid_value',
+    };
+    const safeIssue = (issue) => {
+        const knownPath = issue.path.every((part) => (typeof part === 'number' && Number.isSafeInteger(part) && part >= 0) ||
+            (typeof part === 'string' && approvalPathParts.has(part)));
+        const path = knownPath && issue.path.length ? issue.path.join('.') : '(body)';
+        return `${path}: ${issueCodes[issue.code] ?? 'invalid_value'}`;
+    };
+    const releaseSha = (value) => {
+        if (!/^[0-9a-f]{64}$/.test(value))
+            throw new ControlPlaneError(422, 'a release sha256 is 64 lowercase hex characters');
+        return value;
+    };
+    const parseApprovalBody = (raw) => {
+        const parsed = approvalBody.safeParse(raw);
+        if (!parsed.success)
+            throw new ControlPlaneError(422, `not a store driver approval: ${parsed.error.issues.map(safeIssue).join('; ')}`);
+        return parsed.data;
+    };
+    const parseRevokeBody = (raw) => {
+        const parsed = revokeBody.safeParse(raw);
+        if (!parsed.success)
+            throw new ControlPlaneError(422, `not a store driver revoke: ${parsed.error.issues.map(safeIssue).join('; ')}`);
+        return parsed.data;
+    };
+    // Whether the release is stored, approved and keeps the schema is judged inside
+    // `runStoreDriverRollout`, under its exclusive hold (D-65), never here before it.
     const rollOut = async (c, registration, sha256, action) => {
         const { flow, ensureScopeStores } = releaseFlow();
         const actor = c.get('actor');
@@ -10685,22 +11087,11 @@ export function createControlPlaneApi(options) {
                 const result = await ensureScopeStores({ ...input, loadRelease });
                 return result ? result.uploaded > 0 : true;
             },
-            ensureCanary: (to) => flow.ensureCanary({ driver: registration.driver, to, loadRelease }),
+            ensureCanary: (to, approvals) => flow.ensureCanary({ driver: registration.driver, to, loadRelease, approvals }),
             callCanary: flow.callCanary,
         });
         return c.json(result, result.complete ? 200 : 202);
     };
-    /** Neither a rollout nor a rollback lowers the stored schema: a driver migrates forward only. */
-    const assertSchemaKept = (registration, from, to) => {
-        if (from === null || from === to.sha256)
-            return;
-        const leaving = registration.releases.find((p) => p.sha256 === from);
-        if (!leaving)
-            throw new ControlPlaneError(409, `the current release ${from} of '${registration.driver}' is not pinned, so its schema cannot be judged`);
-        if (to.schema < leaving.schema) {
-            throw new ControlPlaneError(409, `release ${to.sha256} has schema ${to.schema}, below the current release's ${leaving.schema}: objects may already have migrated`);
-        }
-    };
     /** Where the platform's rebuild of every script of the driver stands (#2309), if it rebuilds them. */
     const rebuildView = async (admin, actor, driver, known) => {
         const fingerprint = known ?? (await options.storeReleases?.fingerprint?.());
@@ -10711,29 +11102,87 @@ export function createControlPlaneApi(options) {
         return { fingerprint, ...storeRebuildStatus(walk, fingerprint, verticals, options.storeReleases?.settleMs), walk: walk ?? null };
     };
     app.get('/store-drivers/:driver', async (c) => {
+        await staffPerson(c, statusWords);
         const registration = registeredDriver(c.req.param('driver'));
-        const state = await c.var.admin.storeDriverState(c.get('actor'), registration.driver);
+        const [state, approvals] = await Promise.all([
+            c.var.admin.storeDriverState(c.get('actor'), registration.driver),
+            readStoreDriverApprovals(c.var.admin, c.get('actor'), registration),
+        ]);
         const rebuild = await rebuildView(c.var.admin, c.get('actor'), registration.driver);
-        return c.json({ driver: registration.driver, pins: registration.releases, ...state, ...(rebuild ? { rebuild } : {}) });
+        // `pins` stays for released CLIs (RFC §5 step 3): the releases a move may go to now, one per live approval.
+        const pins = approvals.records
+            .filter((a) => liveApprovalOf(approvals, a.sha256) === a)
+            .map((a) => ({ sha256: a.sha256, sourceCommit: a.sourceCommit, schema: a.schema }));
+        return c.json({ driver: registration.driver, pins, approvals: approvals.records, ...state, ...(rebuild ? { rebuild } : {}) });
     });
-    // Store a release's bytes, before or after its pin lands (D-63). Idempotent per bundle.
+    // Store a release's bytes, before or after a person approves them (D-65). Idempotent per bundle.
     app.put('/store-drivers/:driver/releases', async (c) => {
         const registration = registeredDriver(c.req.param('driver'));
         const actor = await byAPerson(c);
         const { flow } = releaseFlow();
         const body = await readCappedJson(c.req.raw, STORE_RELEASE_REQUEST_MAX_BYTES);
         const release = await storeDriverRelease({ admin: c.var.admin, actor, bytes: flow.bytes, driver: registration.driver, body });
-        return c.json({ release, pinned: registration.releases.some((p) => p.sha256 === release.sha256 && p.sourceCommit === release.sourceCommit) }, 201);
+        const live = liveApprovalOf(await readStoreDriverApprovals(c.var.admin, actor, registration), release.sha256);
+        const approved = live !== undefined && live.sourceCommit === release.sourceCommit;
+        // `pinned` stays beside `approved` for released CLIs, meaning the same (RFC §5 step 3).
+        return c.json({ release, pinned: approved, approved }, 201);
+    });
+    // The approval is a second, person-only write over bytes the platform already named by digest.
+    app.post('/store-drivers/:driver/releases/:sha256/approvals', async (c) => {
+        const registration = registeredDriver(c.req.param('driver'));
+        const actor = await byAPerson(c, approvalWords);
+        const sha256 = releaseSha(c.req.param('sha256'));
+        const body = parseApprovalBody(await readCappedJson(c.req.raw, 64 * 1024));
+        // Refused here, not only by the readers (D-65 §3): a row its basis does not admit could never
+        // run, yet as a live approval it would hold the one slot a corrected approval needs. Fixed text,
+        // no input echoed.
+        if (!storeDriverBasisAdmits(registration.isolationBasis, body.sourceReferences)) {
+            throw new ControlPlaneError(422, 'not a store driver approval: sourceReferences: outside_isolation_basis');
+        }
+        const flow = options.storeReleases;
+        if (!flow)
+            throw new ControlPlaneError(501, 'this control plane cannot read stored release bytes for approval');
+        const approval = await approveStoredDriverRelease({ admin: c.var.admin, actor, bytes: flow.bytes, driver: registration.driver, sha256, approval: body });
+        const state = await c.var.admin.storeDriverState(actor, registration.driver);
+        const approvals = state.current ? await c.var.admin.storeDriverApprovals(actor, registration.driver) : [];
+        // The current release's approval facts, revoked or not: they are fixed at its first approval.
+        const currentSchema = state.current ? approvals.find((a) => a.sha256 === state.current.sha256)?.schema ?? null : null;
+        return c.json({ approval, currentSchema }, 201);
+    });
+    app.post('/store-drivers/:driver/releases/:sha256/revoke', async (c) => {
+        const registration = registeredDriver(c.req.param('driver'));
+        const actor = await byAPerson(c, revokeWords);
+        const sha256 = releaseSha(c.req.param('sha256'));
+        const body = parseRevokeBody(await readCappedJson(c.req.raw, 8 * 1024));
+        const flow = options.storeReleases;
+        if (!body.emergency && !flow?.readScriptRelease) {
+            throw new ControlPlaneError(501, 'this control plane cannot read store script releases for a guarded revoke');
+        }
+        const result = await runStoreDriverRevoke({
+            admin: c.var.admin,
+            actor,
+            driver: registration.driver,
+            sha256,
+            reason: body.reason,
+            emergency: body.emergency === true,
+            readScriptRelease: flow?.readScriptRelease ?? (async () => ({ exists: false })),
+            ensureCanary: async (to) => {
+                if (!flow)
+                    throw new ControlPlaneError(501, 'this control plane cannot move the store canary');
+                const loadRelease = storedReleaseLoader({ admin: c.var.admin, actor, bytes: flow.bytes });
+                // Called under the revoke's exclusive hold, so the approvals read here are the ones it judges.
+                const approvals = await readStoreDriverApprovals(c.var.admin, actor, registration);
+                await flow.ensureCanary({ driver: registration.driver, to, loadRelease, approvals });
+            },
+        });
+        return c.json(result, result.complete ? 200 : 202);
     });
-    // Roll a stored, pinned release out: the canary, then every vertical that ever declared the
+    // Roll a stored, approved release out: the canary, then every vertical that ever declared the
     // driver. Posting the same release again converges a rollout that stopped.
     app.post('/store-drivers/:driver/rollouts', async (c) => {
         const registration = registeredDriver(c.req.param('driver'));
         await byAPerson(c);
         const { sha256 } = z.object({ sha256: z.string().regex(/^[0-9a-f]{64}$/) }).strict().parse(await c.req.json());
-        const pin = await pinOf(c, registration, sha256);
-        const { current } = await c.var.admin.storeDriverState(c.get('actor'), registration.driver);
-        assertSchemaKept(registration, current?.sha256 ?? null, pin);
         return rollOut(c, registration, sha256, 'rollout');
     });
     // Return to the immediately previous good release (D-63), never further and never a guess. After
@@ -10746,8 +11195,6 @@ export function createControlPlaneApi(options) {
         const { current, rollbackTarget } = await c.var.admin.storeDriverState(c.get('actor'), registration.driver);
         if (!current || !rollbackTarget)
             throw new ControlPlaneError(409, `driver '${registration.driver}' has no previous good release to roll back to`);
-        const pin = await pinOf(c, registration, rollbackTarget);
-        assertSchemaKept(registration, current.sha256, pin);
         return rollOut(c, registration, rollbackTarget, 'rollback');
     });
     // Run a pass of the platform's rebuild of every script of the driver now (#2309): the scheduled
@@ -10937,7 +11384,7 @@ const WIRE_WALK_REQUEST_MAX_BYTES = 64 * 1024;
  * The most a release upload's body may be: the decoded cap, as base64 (4 bytes per 3), plus room
  * for the JSON around it. A bigger body is refused (413) before it is read whole.
  */
-const STORE_RELEASE_REQUEST_MAX_BYTES = Math.ceil((STORE_RELEASE_MAX_BYTES * 4) / 3) + 1024 * 1024;
+const STORE_RELEASE_REQUEST_MAX_BYTES = STORE_RELEASE_STORED_MAX_BYTES;
 /** A JSON body read to at most `max` bytes: a declared length over it, or a stream past it, is 413. */
 async function readCappedJson(request, max) {
     const declared = Number(request.headers.get('content-length') ?? NaN);