@substrat-run/control-plane-api 0.177.0 → 0.179.0

package/dist/api.js

@@ -14,7 +14,7 @@ import { TENANT_HEADER, confinedTenant } from './auth.js';
 import { mintTenantToken } from './tenant-token.js';
 import { abandonCopy, beginTransfer, connectionGrantsForScope, transferScope, isScopeNotHeld, notHeldIsBenign } from './vertical-client.js';
 import { COPY_JOB_MAX_MS, copyJobAt, copyJobHeld, copyJobId, copyJobLive, copyTagId, versionIdOfOrder, versionOrderOf, } from './copy-job.js';
-import { runningVersionOf, runningVersionStoresOf, scopeStoreReachOf, scopeStoresOf, unrouteScope } from './platform-scope-stores.js';
+import { exportStoreDumps, runningVersionOf, runningVersionStoresOf, scopeStoreReachOf, scopeStoresOf, unrouteScope } from './platform-scope-stores.js';
 import { liveApprovalOf } from './store-script.js';
 import { STORE_REBUILD_REQUEST_SUBREQUESTS, runStoreFleetRebuild, storeRebuildBudget, storeRebuildStatus } from './store-rebuild.js';
 import { PUSH_HOLD_TTL_MS, STORE_RELEASE_STORED_MAX_BYTES, approveStoredDriverRelease, readStoreDriverApprovals, runStoreDriverRevoke, runStoreDriverRollout, storeDriverRelease, storedReleaseLoader } from './store-releases.js';
@@ -68,6 +68,8 @@ import { mintPushToken, pushActorFor } from './push-token.js';
 import { TENANT_SERIES_SCOPE_CAP, REQUEST_FACET_KEYS, LOGS_INCOMPLETE_HEADER } from './observability.js';
 import { parseTenantRequestQuery, parseTenantWindowQuery, refineTenantWindow, refuseSearchOnCounts, parseTenantLineQuery, REQUEST_WHERE_VALUES_MAX, scriptFamiliesOfScopes, } from './tenant-request-query.js';
 import { namespacesForScript } from './do-namespaces.js';
+import { discardMoves, moveStores } from './store-move.js';
+import { backupEnds, commitStages, inlineStoreSource, restoreEnds, snapshotEnds, StoreLandFailure, storeHoldsRows, } from './store-move-ends.js';
 import { backupDirectoryIfDue } from './directory-backup.js';
 import { deployedDoClasses, platformSweeperDecision } from './platform-entry.js';
 import { extractedMigrationsDigest, extractedMigrationsProblem, extractedMigrationsRefusal, MigrationExtractionError, MigrationLoaderUnavailable, } from './migration-extract.js';
@@ -75,7 +77,7 @@ import { wireSettingsRefusal, wireUploadFor } from './wire-upload.js';
 import { parseWireWalkCursor, runWireWalk, WIRE_WALK_LIMIT_DEFAULT, WIRE_WALK_LIMIT_MAX, WIRE_WALK_RELEASE_MAX, } from './wire-walk.js';
 import { wireKeyDropSince, wireReadinessReport, WIRE_READINESS_LIMIT_DEFAULT, WIRE_READINESS_LIMIT_MAX } from './wire-readiness.js';
 import { STORAGE_PAGE_DEFAULT, STORAGE_PAGE_MAX, readStoragePage } from './storage-meter.js';
-import { queryLakeEvents } from './lake-gateway.js';
+import { queryLakeEvents, teamWindowRefusal } from './lake-gateway.js';
 import { LakeQueryError } from './r2-sql-engine.js';
 import { isCustomHostname, validateBindableHostname, } from './custom-hostnames.js';
 import { isSocialRelayVertical, reconcileScopeSocialRelay, relayHostnames, } from './social-relay.js';
@@ -780,6 +782,8 @@ const TENANT_ROUTES = [
     // grant (`tenantGrantableEntitlement`): the pin alone would let it grant itself any.
     { method: 'PUT', re: /\/tenants\/[^/]+\/entitlements\/[^/]+$/, pin: 'path' },
     { method: 'GET', re: /\/tenants\/[^/]+\/cross-vertical\/edges$/, pin: 'path' },
+    // #1334: the team's own lake events. The handler adds the window rule for this credential.
+    { method: 'GET', re: /\/tenants\/[^/]+\/lake\/events$/, pin: 'path' },
     // Findings (#1748): the tenant's inbox, its verdicts and its suppress rules. The dashboard
     // checks WHO inside the tenant may read or act (its findings permissions) before calling.
     { method: 'PUT', re: /\/tenants\/[^/]+\/findings\/[^/]+\/status$/, pin: 'path' },
@@ -1014,7 +1018,7 @@ export function createControlPlaneApi(options) {
     /** `substrat.wipe` on each declared store, before the scope's own bytes go. */
     const wipePlatformStores = async (c, scope) => (await platformStoresWipe(c, scope))();
     /**
-     * `substrat.export` on each store the lifecycle reaches, for a backup, a full pull or a fork.
+     * The stores a backup, a full pull or a fork copies: those the scope's running version declares.
      *
      * A dump is only worth taking if it restores, and a restore imports only what the destination's
      * version declares (L8). So a binding only an earlier version declared (#2286) is left out of the
@@ -1023,24 +1027,29 @@ export function createControlPlaneApi(options) {
      * way out, rather than produce a dump its own scope could not restore. Wipe, reap and erasure
      * never export, so they reach such a store regardless.
      */
-    const exportPlatformStores = async (c, scope) => {
+    const platformStoreReach = async (c, scope) => {
         const caller = options.platformScopeStores;
         if (!caller || !scope.vertical)
             return undefined;
         const { running, all } = await scopeStoreReachOf(c.var.admin, c.get('actor'), scope, options.storeDrivers);
         if (all.length === 0)
             return undefined;
-        const exported = await caller.exportStores({ tenantId: scope.tenantId, scopeId: scope.id, vertical: scope.vertical, stores: all });
+        const place = { tenantId: scope.tenantId, scopeId: scope.id, vertical: scope.vertical };
         const current = new Set(running.map((store) => store.binding));
-        const dropped = exported.filter((store) => !current.has(store.binding));
-        const held = dropped.find((store) => store.tables.some((table) => table.rows.length > 0));
-        if (held) {
-            throw new ControlPlaneError(409, `scope ${scope.id}'s store '${held.binding}' was declared by an earlier version of '${scope.vertical}' and ` +
+        for (const dropped of all.filter((store) => !current.has(store.binding))) {
+            if (!(await storeHoldsRows(caller, place, dropped)))
+                continue;
+            throw new ControlPlaneError(409, `scope ${scope.id}'s store '${dropped.binding}' was declared by an earlier version of '${scope.vertical}' and ` +
                 `still holds data, and the version the scope runs does not declare it, so a dump of it could not be ` +
-                `restored. Declare '${held.binding}' as a '${held.driver}' again in a version the scope runs, then export; ` +
+                `restored. Declare '${dropped.binding}' as a '${dropped.driver}' again in a version the scope runs, then export; ` +
                 `or reap the scope without a backup, which wipes it`);
         }
-        return exported.filter((store) => current.has(store.binding));
+        return { caller, place, stores: running };
+    };
+    /** The stores a pull or a tenant export answers inline, each read whole (`exportStoreDumps`). */
+    const exportPlatformStores = async (c, scope) => {
+        const reach = await platformStoreReach(c, scope);
+        return reach && exportStoreDumps(reach.caller, reach.place, reach.stores);
     };
     /**
      * `substrat.erase` on the destination's stores for each subject tombstoned in the destination
@@ -1262,13 +1271,23 @@ export function createControlPlaneApi(options) {
         // #977: a tenant credential minted for a person writes through a view that names
         // them on every admin row. Only the credential's own claim can supply the person —
         // never a header or a body — and only the staff mint writes that claim.
-        const view = principal.kind === 'tenant' && principal.onBehalfOf && host.attributed
-            ? host.attributed(principal.onBehalfOf)
-            : host;
+        const view = viewOf(principal);
         c.set('host', view);
         c.set('admin', view.admin);
         await next();
     });
+    /**
+     * #977: the host a principal's request writes through — the attributed view for a tenant
+     * credential minted for a person, the configured host otherwise. The middleware sets it on
+     * the request; a helper handed only the principal derives the same view here (#2860), so its
+     * access rows name the person too.
+     */
+    function viewOf(principal) {
+        return principal.kind === 'tenant' && principal.onBehalfOf && host.attributed
+            ? host.attributed(principal.onBehalfOf)
+            : host;
+    }
+    const adminFor = (principal) => viewOf(principal).admin;
     // Confine a BUILDER to the vertical-management surface, fail-CLOSED (builder-plane.md
     // §4). Default-deny by design: a builder reaches only the routes on this allowlist,
     // and only for verticals its tenant owns (the per-route ownership checks below). A
@@ -1299,6 +1318,9 @@ export function createControlPlaneApi(options) {
         { method: 'GET', re: /\/verticals\/[^/]+\/versions\/[^/]+\/model$/ },
         { method: 'GET', re: /\/verticals\/[^/]+\/versions\/[^/]+\/concept$/ },
         { method: 'GET', re: /\/verticals\/[^/]+\/versions\/[^/]+\/schedules$/ },
+        // The scope-store drivers one vertical may use (#2813), so a push judges its stores as the
+        // upload will. `?vertical=` required; the answer names no other vertical.
+        { method: 'GET', re: /\/store-drivers$/ },
         { method: 'GET', re: /\/verticals\/[^/]+\/channels$/ },
         { method: 'GET', re: /\/verticals\/[^/]+\/channels\/[^/]+\/history$/ },
         { method: 'POST', re: /\/verticals\/[^/]+\/channels\/[^/]+\/promote$/ },
@@ -1542,7 +1564,7 @@ export function createControlPlaneApi(options) {
             const vertical = await resolveVerticalId(c, raw);
             const owner = (pathTenant ?? confined)
                 ? null
-                : ((await verticalOf(c.get('actor'), vertical))?.ownerTenant ?? null);
+                : ((await verticalOf(c.var.admin, c.get('actor'), vertical))?.ownerTenant ?? null);
             return { vertical, tenantId: pathTenant ?? confined ?? owner };
         }
         catch {
@@ -2944,7 +2966,7 @@ export function createControlPlaneApi(options) {
         resolveVertical: options.resolveVertical,
         resolveVerticalVersion: options.resolveVerticalVersion,
         resolveVerticalRef: options.resolveVerticalRef,
-        ownerOf,
+        ownerOf: (actor, slug) => ownerOf(c.var.admin, actor, slug),
         tenantSlugOf: async (actor, tenantId) => (await c.var.admin.getTenant(actor, tenantId).catch(() => null))?.slug ?? null,
     }, c.get('actor'), scope);
     /**
@@ -2959,11 +2981,11 @@ export function createControlPlaneApi(options) {
      * exact split so it is a seconds-long diagnosis, not a multi-hour hunt. A couple of
      * directory reads only when a call has already failed to resolve.
      */
-    const diagnoseUnboundScope = async (actor, scope) => {
+    const diagnoseUnboundScope = async (admin, actor, scope) => {
         const slug = scope.vertical;
         if (!slug)
             return 'scope has no vertical bound — nothing to deliver to';
-        const versions = await host.admin.listVersions(actor, slug).catch(() => []);
+        const versions = await admin.listVersions(actor, slug).catch(() => []);
         const boundId = scope.verticalVersionId;
         if (boundId && !versions.some((v) => v.id === boundId)) {
             return (`scope is bound to version '${boundId}', which is not among vertical '${slug}'’s ${versions.length} ` +
@@ -2976,7 +2998,7 @@ export function createControlPlaneApi(options) {
                 `pushes are on different slugs (a lineage fork). Push under '${slug}' by setting \`substrat.slug\`, ` +
                 `or rebind the install to the slug the versions live under.`);
         }
-        const serving = await host.admin.verticalServing(actor, slug).catch(() => null);
+        const serving = await admin.verticalServing(actor, slug).catch(() => null);
         if (!serving) {
             return `vertical '${slug}' has ${versions.length} version(s) but none is promoted to a serving channel — promote one to prod.`;
         }
@@ -2990,10 +3012,10 @@ export function createControlPlaneApi(options) {
      * `servingRef` is the route the scope takes in the same act (an adopt). The host's read also
      * refuses, whatever is acknowledged, a move that strands people a link bound (#2178).
      */
-    const refuseOnBreaks = async (actor, tenantId, scopeId, versionId, opts) => {
+    const refuseOnBreaks = async (admin, actor, tenantId, scopeId, versionId, opts) => {
         // Asked even when acknowledged: the read also refuses a move that strands people a link
         // bound (#2178), which no acknowledgement passes.
-        const breaks = await host.admin.bindingImpact(actor, tenantId, scopeId, versionId, opts.servingRef !== undefined ? { servingRef: opts.servingRef } : undefined);
+        const breaks = await admin.bindingImpact(actor, tenantId, scopeId, versionId, opts.servingRef !== undefined ? { servingRef: opts.servingRef } : undefined);
         if (opts.acknowledge?.exportBreak)
             return;
         if (breaks.length > 0)
@@ -3025,7 +3047,7 @@ export function createControlPlaneApi(options) {
      * as it stood before the failed attempt. Every caller still re-asserts after it (the
      * fallback), passing what this reports.
      */
-    const restoreCarryingSwitches = async (actor, dest, tenantId, scopeId, tables, 
+    const restoreCarryingSwitches = async (admin, actor, dest, tenantId, scopeId, tables, 
     /** #1869: the scope `tables` were captured from — `scopeId` itself unless the copy moves —
      *  and `exact` when the platform exported them itself rather than a caller supplying them.
      *  #1722: `loadStamp`, the stamp a carry leaves on the copy it lands, and `expect`, the marker
@@ -3035,10 +3057,10 @@ export function createControlPlaneApi(options) {
         // the destination is not primary, the vertical marks it a copy in its own storage — a carry
         // of a copy made before every copy carried the marker brings none, and a CP-less host reads
         // the marker for primacy. Idempotent there; an install is never marked.
-        const rec = await host.admin.getScopeRecord(actor, tenantId, scopeId);
+        const rec = await admin.getScopeRecord(actor, tenantId, scopeId);
         const markCopy = rec ? copyLineageOf(rec) : undefined;
         return retryTransient(async () => dest.restoreScope(tenantId, scopeId, tables, {
-            ...(await switchCarryFor(host.admin, actor, { tenantId, scopeId })),
+            ...(await switchCarryFor(admin, actor, { tenantId, scopeId })),
             sourceScopeId: source.scopeId,
             exact: source.exact,
             loadStamp: source.loadStamp,
@@ -3072,7 +3094,7 @@ export function createControlPlaneApi(options) {
         }
         // #1756: onto the serving script, the scope runs the served version from the moment routing
         // flips — whatever its own version exported. Asked before the export below moves anything.
-        await refuseOnBreaks(actor, tenantId, scopeId, serving.versionId, {
+        await refuseOnBreaks(c.var.admin, actor, tenantId, scopeId, serving.versionId, {
             servingRef: serving.ref,
             acknowledge: opts.acknowledge,
         });
@@ -3115,7 +3137,7 @@ export function createControlPlaneApi(options) {
         const serving = await c.var.admin.verticalServing(actor, slug);
         if (!serving)
             return none; // embedded / not dispatch-backed — the host cascade handled rebinds
-        const v = await verticalOf(actor, slug);
+        const v = await verticalOf(c.var.admin, actor, slug);
         if (!v || v.ownerTenant === null || v.listed)
             return none; // private only, like the host cascade
         const owned = (await c.var.admin.listScopes(actor, { tenantId: v.ownerTenant, vertical: slug, status: ['active'] })).filter((s) => !s.forkedFrom && s.kind !== 'preview');
@@ -3213,7 +3235,7 @@ export function createControlPlaneApi(options) {
         const { review, ...bindAck } = opts.acknowledge ?? {};
         // #1756: within one lineage this is an adopt, and judged as one before anything moves. A
         // crossing is not judged (`bindExportBreaksOf`): the producer's slug itself changes.
-        await refuseOnBreaks(actor, tenantId, scopeId, serving.versionId, {
+        await refuseOnBreaks(c.var.admin, actor, tenantId, scopeId, serving.versionId, {
             servingRef: serving.ref,
             acknowledge: bindAck,
         });
@@ -3319,7 +3341,7 @@ export function createControlPlaneApi(options) {
             const erasureEpoch = await c.var.admin.scopeErasureEpoch(actor, tenantId, scopeId);
             // #2450: a page at a time into the destination's stage, so a scope of any size moves.
             const { dump, loadStamp: sourceStamp, revision: sourceRevision } = await transferScope(source, dest, { from: scopeId }, { retry: retryTransient });
-            const restored = await restoreCarryingSwitches(actor, dest, tenantId, scopeId, dump, {
+            const restored = await restoreCarryingSwitches(c.var.admin, actor, dest, tenantId, scopeId, dump, {
                 scopeId, exact: true, loadStamp: restoredStamp,
                 ...(moveId ? { fence: copyRestoreFence(moveId, recordedAt, copyLeaseMs, erasureEpoch) } : {}),
             });
@@ -3744,7 +3766,7 @@ export function createControlPlaneApi(options) {
                 throw new ControlPlaneError(412, `the copy of scope ${scope.id} in '${from}' was already carried to another script and wiped, so nothing ` +
                     `was moved or bound (#1722). Reload the scope and retry.`);
             }
-            const restored = await restoreCarryingSwitches(actor, dest, scope.tenantId, scope.id, dump, {
+            const restored = await restoreCarryingSwitches(c.var.admin, actor, dest, scope.tenantId, scope.id, dump, {
                 scopeId: scope.id,
                 exact: true,
                 loadStamp: restoredStamp,
@@ -4111,7 +4133,7 @@ export function createControlPlaneApi(options) {
                 await c.var.admin.recordScopeScriptCopy(actor, scope.tenantId, scope.id, carried.to, recarryId, { role: 'destination', loadStamp: restoredStamp, leaseMs: copyLeaseMs });
                 try {
                     const erasureEpoch = await c.var.admin.scopeErasureEpoch(actor, scope.tenantId, scope.id);
-                    await restoreCarryingSwitches(actor, carried.dest, scope.tenantId, scope.id, dump, {
+                    await restoreCarryingSwitches(c.var.admin, actor, carried.dest, scope.tenantId, scope.id, dump, {
                         scopeId: scope.id,
                         exact: true,
                         loadStamp: restoredStamp,
@@ -4277,13 +4299,13 @@ export function createControlPlaneApi(options) {
         const p = c.get('principal');
         const scopePin = confinedTenant(p);
         if (scopePin) {
-            const v = scope.vertical ? await verticalOf(actor, scope.vertical) : undefined;
+            const v = scope.vertical ? await verticalOf(c.var.admin, actor, scope.vertical) : undefined;
             if (!v || v.ownerTenant !== scopePin)
                 return refuse(c, 'forbidden', 'forbidden');
         }
         const reached = await deploymentForScope(c, scope);
         if (!reached)
-            return refuseStatus(c, 501, await diagnoseUnboundScope(c.get('actor'), scope));
+            return refuseStatus(c, 501, await diagnoseUnboundScope(c.var.admin, c.get('actor'), scope));
         const vertical = reached.client;
         const entitlements = await c.var.admin.listEntitlements(actor, tenantId);
         // #406: re-gathered and re-delivered like entitlements, so a reconcile also repairs a
@@ -4826,7 +4848,7 @@ export function createControlPlaneApi(options) {
             return refuse(c, 'not_found', `unknown scope for tenant: (${tenantId}, ${scopeId})`);
         const vertical = await verticalForScope(c, scope);
         if (!vertical)
-            return refuseStatus(c, 501, await diagnoseUnboundScope(c.get('actor'), scope));
+            return refuseStatus(c, 501, await diagnoseUnboundScope(c.var.admin, c.get('actor'), scope));
         try {
             return c.json(await vertical.ownerSeat(tenantId, scopeId));
         }
@@ -4862,7 +4884,7 @@ export function createControlPlaneApi(options) {
             return refuse(c, 'not_found', `unknown scope for tenant: (${tenantId}, ${scopeId})`);
         const vertical = await verticalForScope(c, scope);
         if (!vertical)
-            return refuseStatus(c, 501, await diagnoseUnboundScope(actor, scope));
+            return refuseStatus(c, 501, await diagnoseUnboundScope(c.var.admin, actor, scope));
         const origin = await instanceOrigin(c.var.admin, actor, scopeId);
         if (!origin) {
             return refuse(c, 'conflict', `scope ${scopeId} has no hostname bound — a claim link needs an address to open on`);
@@ -4903,7 +4925,7 @@ export function createControlPlaneApi(options) {
             return { refusal: refuse(c, 'not_found', `unknown scope for tenant: (${tenantId}, ${scopeId})`) };
         const vertical = await verticalForScope(c, scope);
         if (!vertical)
-            return { refusal: refuseStatus(c, 501, await diagnoseUnboundScope(actor, scope)) };
+            return { refusal: refuseStatus(c, 501, await diagnoseUnboundScope(c.var.admin, actor, scope)) };
         return { tenantId, scopeId, actor, vertical, person: memberPerson(principal) };
     };
     /**
@@ -5023,7 +5045,7 @@ export function createControlPlaneApi(options) {
             return refuse(c, 'not_found', `unknown scope for tenant: (${tenantId}, ${scopeId})`);
         const vertical = await verticalForScope(c, scope);
         if (!vertical)
-            return refuseStatus(c, 501, await diagnoseUnboundScope(actor, scope));
+            return refuseStatus(c, 501, await diagnoseUnboundScope(c.var.admin, actor, scope));
         const operationId = ulid();
         // An abandon (`abandon: true`) is audited the same way, every row marked, so the log tells
         // a hand-over closed without finishing from one that finished.
@@ -5059,7 +5081,7 @@ export function createControlPlaneApi(options) {
             return refuse(c, 'not_found', `unknown scope for tenant: (${tenantId}, ${scopeId})`);
         const vertical = await verticalForScope(c, scope);
         if (!vertical) {
-            return refuseStatus(c, 501, await diagnoseUnboundScope(c.get('actor'), scope));
+            return refuseStatus(c, 501, await diagnoseUnboundScope(c.var.admin, c.get('actor'), scope));
         }
         try {
             await vertical.configureInstance({ tenantId, scopeId, entries: input.entries });
@@ -5212,12 +5234,17 @@ export function createControlPlaneApi(options) {
             }
             await retryTransient(() => copier.snapshotScope({ sourceScopeId: scope.id, newScopeId: snapId, tenantId }));
             // The scope file was copied inside the script. The store objects are per scope, so the
-            // fork gets its own copy through the reserved export and import, signed by the
-            // control plane. A version that declares no stores has nothing to copy.
+            // fork gets its own copy, page by page from the source's store into a stage at the fork's,
+            // signed by the control plane (D-69); every store is staged before any is committed. A
+            // version that declares no stores has nothing to copy.
             if (reach) {
-                const stores = await reach.caller.exportStores({ tenantId, scopeId: scope.id, vertical: reach.vertical, stores: reach.stores });
-                if (stores.length > 0) {
-                    await reach.caller.importStores({ tenantId, scopeId: snapId, vertical: reach.vertical, stores });
+                const from = { tenantId, scopeId: scope.id, vertical: reach.vertical };
+                const to = { ...from, scopeId: snapId };
+                const moved = await moveStores(snapshotEnds(reach.caller, from, to), reach.stores, `scope ${scope.id}'s stores`, options.storeMoveBudget);
+                try {
+                    await commitStages(reach.caller, to, moved, retryTransient);
+                }
+                finally {
                     replay = await replayPlatformStoreErasures(c, { ...scope, id: snapId }, scope.id);
                 }
             }
@@ -5399,9 +5426,11 @@ export function createControlPlaneApi(options) {
         const { tables: hostTables, ...header } = await c.var.admin.exportScope(c.get('actor'), tenantId, scope.id);
         const vertical = await verticalForScope(c, scope);
         // Store tables are opaque and stay unsealed. The platform reads them from the store script
-        // (#2207); a store it cannot name or reach refuses the backup rather than omitting it.
-        const stores = (await exportPlatformStores(c, scope)) ?? header.stores;
-        const backup = backupStage(store.begin({ vertical: scope.vertical, header: { ...header, stores } }), sealerFor(c, tenantId, scope.id));
+        // (#2207), a page at a time into entries of their own (D-69); a store it cannot name or reach
+        // refuses the backup rather than omitting it. Resolved before anything is written.
+        const reach = await platformStoreReach(c, scope);
+        const writer = store.begin({ vertical: scope.vertical, header: { ...header, stores: reach ? [] : header.stores } });
+        const backup = backupStage(writer, sealerFor(c, tenantId, scope.id));
         // #2839: from a vertical, the data moves into the store a page at a time, as a paged copy
         // moves it into another scope (#2450): captured, so a scope taking writes meanwhile is still
         // copied as it was at one moment, and never held whole here. A deployment that predates
@@ -5411,11 +5440,18 @@ export function createControlPlaneApi(options) {
             : hostTables;
         if (Array.isArray(moved))
             await backup.dest.stageScopePage(scope.id, ulid(), 0, moved);
+        // The scope, then its stores: two objects, so not one moment (D-69, question 3).
+        let stores = [];
         try {
-            return await backup.commit();
+            if (reach) {
+                stores = await moveStores(backupEnds(reach.caller, reach.place, writer), reach.stores, `scope ${scope.id}'s stores`, options.storeMoveBudget);
+            }
+            return await backup.commit(stores.map((s) => ({ binding: s.binding, driver: s.driver, stageId: s.moveId, entries: s.pages, revision: s.revision })));
         }
         catch (e) {
             await backup.discard();
+            for (const s of stores)
+                await writer.discard(s.moveId).catch(() => undefined);
             throw e;
         }
     };
@@ -5454,7 +5490,7 @@ export function createControlPlaneApi(options) {
                 },
                 discardStagedScope: (_, stageId) => writer.discard(stageId),
             },
-            commit: () => writer.commit({ stageId: last.stageId, entries: last.entries, tables: last.tables.size }),
+            commit: (storeEntries) => writer.commit({ stageId: last.stageId, entries: last.entries, tables: last.tables.size, storeEntries }),
             discard: () => writer.discard(last.stageId),
         };
     };
@@ -5494,6 +5530,16 @@ export function createControlPlaneApi(options) {
         if (held.entries > 1) {
             return refuseStatus(c, 413, `backup ${capturedAt} of scope ${scopeId} is stored in ${held.entries} entries (its pages, and any writes caught while it was taken), which only a restore applies; restore it with POST /tenants/${tenantId}/scopes/${scopeId}/backups/${capturedAt}/restore`);
         }
+        // A store held in one page is served inline, as `stores` always was; one held in more is a
+        // restore's to apply (D-69), so the backup is refused whole rather than handed back in part.
+        const paged = held.storeEntries.find((store) => store.entries > 1);
+        if (paged) {
+            return refuseStatus(c, 413, `backup ${capturedAt} of scope ${scopeId} holds scope store '${paged.binding}' in ${paged.entries} pages, which only a restore applies; restore it with POST /tenants/${tenantId}/scopes/${scopeId}/backups/${capturedAt}/restore`);
+        }
+        const pagedStores = [];
+        for (const store of held.storeEntries) {
+            pagedStores.push({ binding: store.binding, driver: store.driver, tables: mergeDumpPages([await held.storePage(store, 0)]) });
+        }
         const { tables } = await held.entry(0);
         // Unseal on the way out (#37). The bytes in the store stay sealed — this is the
         // authorized read opening them with the keys the platform holds. A subject shredded
@@ -5501,7 +5547,7 @@ export function createControlPlaneApi(options) {
         // working: the ciphertext never left the object, and nothing turns it back into a
         // person. A dump taken before sealing existed passes through untouched.
         const opened = await openDump(mergeDumpPages([tables]), sealerFor(c, tenantId, scopeId));
-        return c.json({ ...held.header, tables: opened });
+        return c.json({ ...held.header, stores: [...held.header.stores, ...pagedStores], tables: opened });
     });
     // Take a backup WITHOUT reaping — the standalone copy (a pre-migration checkpoint, an
     // export-to-keep). The reap route below takes its own; this is the same act made
@@ -5912,7 +5958,7 @@ export function createControlPlaneApi(options) {
         }
         const vertical = await verticalForScope(c, scope);
         if (!vertical)
-            return refuseStatus(c, 501, await diagnoseUnboundScope(actor, scope));
+            return refuseStatus(c, 501, await diagnoseUnboundScope(c.var.admin, actor, scope));
         const { cleared } = await vertical.clearCopyMark(scopeId, { kind: scope.kind, forkedFrom: scope.forkedFrom });
         await c.var.admin.recordCopyMark(actor, { action: 'clear', tenantId, scopeId, outcome: cleared ? 'cleared' : 'absent' });
         return c.json({ cleared });
@@ -6012,9 +6058,10 @@ export function createControlPlaneApi(options) {
     // closed `.strict()` list with no tenant in it, and a row of any other tenant fails the
     // read whole. Envelope only — no payload until erasure reaches the lake.
     //
-    // Staff only, by default-deny: on neither BUILDER_ROUTES nor TENANT_ROUTES. A tenant's
-    // own credential reaching this is a separate decision, with a dashboard call site and a
-    // member permission in front of it.
+    // Staff, and a team's own credential (TENANT_ROUTES, path-pinned). The dashboard checks
+    // `dashboard:read-event-lake` before it calls. A team's read must name a window of at most
+    // `LAKE_TEAM_WINDOW_DAYS` (`teamWindowRefusal`): nothing below the gateway prunes by tenant,
+    // so the window is what bounds the scan. Builders stay refused (not in BUILDER_ROUTES).
     //
     // K-24: the access row is written AFTER the engine answers and BEFORE anything is
     // returned, and a failed write fails the request — rows whose disclosure went unrecorded
@@ -6035,6 +6082,11 @@ export function createControlPlaneApi(options) {
                 issues: parsed.error.issues.map((i) => ({ path: i.path, message: i.message })),
             });
         }
+        if (c.get('principal').kind === 'tenant') {
+            const refusal = teamWindowRefusal(parsed.data, Date.now());
+            if (refusal)
+                return refuse(c, 'validation_failed', refusal);
+        }
         let page;
         try {
             page = await queryLakeEvents(options.lakeQuery, tenantId, parsed.data);
@@ -6370,9 +6422,15 @@ export function createControlPlaneApi(options) {
         if (!held)
             return refuse(c, 'not_found', `no backup for scope ${scopeId} at ${capturedAt}`);
         const { header } = held;
+        // A backup taken since D-69 holds its stores as store pages; one taken before, inline in its header.
+        const pagedStores = held.storeEntries.map((entry) => ({
+            binding: entry.binding,
+            driver: entry.driver,
+            source: { pages: entry.entries, revision: entry.revision, page: (seq) => held.storePage(entry, seq) },
+        }));
         if (options.platformScopeStores) {
             try {
-                await refuseUndeclaredDumpStores(c, scope, header.stores);
+                await refuseUndeclaredDumpStores(c, scope, [...header.stores, ...pagedStores]);
             }
             catch (e) {
                 if (e instanceof ControlPlaneError)
@@ -6387,7 +6445,7 @@ export function createControlPlaneApi(options) {
                 if (tables.length === 0) {
                     return refuseStatus(c, 422, 'restore refused: the backup has no tables — not a scope dump');
                 }
-                return c.json(await loadIntoScope(c, scope, { header, tables: await openDump(mergeDumpPages([tables]), sealer) }));
+                return c.json(await loadIntoScope(c, scope, { header, tables: await openDump(mergeDumpPages([tables]), sealer), pagedStores }));
             }
             // The host judges the roles the backup seats or defines before anything is replaced (#2555), and
             // records the tables it restores. So it is handed every table's schema and the role tables' rows,
@@ -6421,7 +6479,7 @@ export function createControlPlaneApi(options) {
                 }
                 return { dump: { stageId }, tables: judged.tables() };
             };
-            return c.json(await loadIntoScope(c, scope, { header, tables: [], stage }));
+            return c.json(await loadIntoScope(c, scope, { header, tables: [], stage, pagedStores }));
         }
         catch (e) {
             return restoreFailed(c, scope, e);
@@ -6450,32 +6508,55 @@ export function createControlPlaneApi(options) {
         // #2185: cleared before the load as well as after it (below): a step after the load can still
         // throw (the deployment's half, the re-assert), and the data that landed may predate a reconcile.
         await c.var.admin.markScopeProvisioned(actor, tenantId, scopeId, null);
-        const staged = input.stage && vertical ? await input.stage(vertical) : undefined;
-        const tables = staged?.tables ?? input.tables;
+        // D-69: every store is staged first, then the scope is loaded, then the stores are committed,
+        // then erasures are replayed. Until the first commit nothing of a store has changed, so a page
+        // that cannot be read, a refused stage or a refused load leaves every store as it was. Once a
+        // commit was attempted the replay runs whatever follows, and a restore run again converges.
+        const storesCaller = options.platformScopeStores;
+        const platform = storesCaller && vertical && scope.vertical
+            ? { caller: storesCaller, place: { tenantId, scopeId, vertical: scope.vertical } }
+            : undefined;
+        const pagedStores = input.pagedStores ?? [];
+        if (!platform && pagedStores.length > 0) {
+            throw new ControlPlaneError(409, `the backup holds scope stores in pages, and scope ${scopeId} has no deployment and no route to its stores to load them into`);
+        }
+        // With a route to the stores, an inline store moves as a paged one does; without one the host carries it.
+        const stores = platform ? [...inlineStoreSources(header.stores), ...pagedStores] : [];
+        const sources = new Map(stores.map((store) => [store.binding, store.source]));
+        const storeEnds = platform && restoreEnds(platform.caller, platform.place, (binding) => sources.get(binding));
+        const movedStores = storeEnds && stores.length > 0
+            ? await moveStores(storeEnds, stores.map(({ binding, driver }) => ({ binding, driver })), `the backup's stores for scope ${scopeId}`, options.storeMoveBudget)
+            : [];
+        let staged;
+        let committing = false;
         try {
-            const storesCaller = options.platformScopeStores;
-            const landing = { ...header, tables, stores: storesCaller && vertical ? [] : header.stores };
+            staged = input.stage && vertical ? await input.stage(vertical) : undefined;
+            const tables = staged?.tables ?? input.tables;
+            const landing = { ...header, tables, stores: platform ? [] : header.stores };
             const hostReplay = await c.var.host.restoreScope(actor, tenantId, scopeId, landing, sourceHint ? { sourceScopeId: sourceHint } : undefined);
-            if (storesCaller && vertical && scope.vertical && header.stores.length > 0) {
-                await storesCaller.importStores({
-                    tenantId,
-                    scopeId,
-                    vertical: scope.vertical,
-                    stores: header.stores,
-                });
-            }
-            const platformReplay = storesCaller && scope.vertical
-                ? await replayPlatformStoreErasures(c, scope, sourceHint ?? origin)
-                : undefined;
-            const replays = [hostReplay, platformReplay].filter((r) => !!r);
             // #1742: the recorded OFF positions ride the restore, so the deployment switches them
             // off in the replay's own event — its own sweeper cannot land in between.
             const restored = vertical
-                ? await restoreCarryingSwitches(actor, vertical, tenantId, scopeId, staged?.dump ?? tables, {
+                ? await restoreCarryingSwitches(c.var.admin, actor, vertical, tenantId, scopeId, staged?.dump ?? tables, {
                     scopeId: sourceHint ?? origin,
                     exact: false,
                 })
                 : undefined;
+            let landFailure;
+            if (platform && movedStores.length > 0) {
+                committing = true;
+                await commitStages(platform.caller, platform.place, movedStores, retryTransient).catch((e) => {
+                    if (!(e instanceof StoreLandFailure))
+                        throw e;
+                    landFailure = e;
+                });
+            }
+            const platformReplay = storesCaller && scope.vertical
+                ? await replayPlatformStoreErasures(c, scope, sourceHint ?? origin)
+                : undefined;
+            if (landFailure)
+                throw landFailure;
+            const replays = [hostReplay, platformReplay].filter((r) => !!r);
             // #1674: a backup from before a module was switched off brings it back on; the
             // directory's record puts it back off now, not at the next reconcile. Where the
             // deployment already did (#1742), this finds it done and audits what it reported.
@@ -6495,12 +6576,17 @@ export function createControlPlaneApi(options) {
             };
         }
         catch (e) {
-            // A stage the refused load left at the deployment goes now rather than waiting for a wipe.
+            // A stage the refused load left at the deployment goes now rather than waiting for a wipe,
+            // and so do the stores' stages, none of which was committed.
             if (staged && vertical)
                 await abandonCopy({ dest: vertical }, { from: scopeId, into: scopeId, stageId: staged.dump.stageId });
+            if (storeEnds && !committing)
+                await discardMoves(storeEnds, movedStores);
             throw e;
         }
     };
+    /** A dump's inline stores as restore sources, each cut at its driver's page size (D-69). */
+    const inlineStoreSources = (stores) => stores.map((store) => ({ binding: store.binding, driver: store.driver, source: inlineStoreSource(store) }));
     /** How a refused or failed restore answers, on either route. */
     const restoreFailed = async (c, scope, e) => {
         // #2185: and once more on the way out of a failure, for a sweep reconcile that wrote the
@@ -6622,11 +6708,11 @@ export function createControlPlaneApi(options) {
         const actor = c.get('actor');
         const adoptPin = confinedTenant(p);
         if (adoptPin) {
-            const v = await verticalOf(actor, slug);
+            const v = await verticalOf(c.var.admin, actor, slug);
             if (!v || v.ownerTenant !== adoptPin)
                 return refuse(c, 'forbidden', 'forbidden');
         }
-        const v = await verticalOf(actor, slug);
+        const v = await verticalOf(c.var.admin, actor, slug);
         if (!v)
             return refuse(c, 'not_found', `unknown vertical '${slug}'`);
         if (v.ownerTenant === null) {
@@ -6932,7 +7018,7 @@ export function createControlPlaneApi(options) {
             // #2185: before the load as well as after it, so a throw once the kept copy has landed (the
             // re-assert) cannot leave the receipt set over older data.
             await c.var.admin.markScopeProvisioned(actor, tenantId, scopeId, null);
-            const restored = await restoreCarryingSwitches(actor, live, tenantId, scopeId, dump, {
+            const restored = await restoreCarryingSwitches(c.var.admin, actor, live, tenantId, scopeId, dump, {
                 scopeId,
                 exact: true,
                 loadStamp: ulid(),
@@ -6999,7 +7085,7 @@ export function createControlPlaneApi(options) {
         // first (a version not admitted) the same way. An unknown scope has no impact to read, and
         // the bind below refuses it as it always has.
         if (scope)
-            await refuseOnBreaks(actor, tenantId, scopeId, versionId, { acknowledge });
+            await refuseOnBreaks(c.var.admin, actor, tenantId, scopeId, versionId, { acknowledge });
         // A refusal throws a ControlPlaneError, which the app's error boundary relays with its
         // status and records as an ops failure. An unknown scope carries nothing, and the bind
         // below refuses it as it always has.
@@ -7045,7 +7131,7 @@ export function createControlPlaneApi(options) {
                     try {
                         // Asked again after the carry: a promote landing since the first question would
                         // otherwise leave an archive behind for a bind the host then refuses.
-                        await refuseOnBreaks(actor, tenantId, scopeId, versionId, { acknowledge });
+                        await refuseOnBreaks(c.var.admin, actor, tenantId, scopeId, versionId, { acknowledge });
                         await orchestratedSnapshot(c, tenantId, scope, {});
                     }
                     catch (e) {
@@ -7241,14 +7327,14 @@ export function createControlPlaneApi(options) {
     // registry row's owner_tenant (undefined ⇒ not registered — a claimable slug).
     // `listVerticals` returns every row (the adapter does not narrow); the transport is
     // where per-principal filtering happens — here and on GET /verticals.
-    const ownerOf = async (actor, slug) => {
-        const v = (await host.admin.listVerticals(actor)).find((x) => x.slug === slug);
+    const ownerOf = async (admin, actor, slug) => {
+        const v = (await admin.listVerticals(actor)).find((x) => x.slug === slug);
         return v ? v.ownerTenant : undefined;
     };
     // The full registry row, for the checks that need more than the owner — whether the
     // vertical is PRIVATE (owned + not listed), which is what scopes a builder's prod
     // self-serve below.
-    const verticalOf = async (actor, slug) => (await host.admin.listVerticals(actor)).find((x) => x.slug === slug);
+    const verticalOf = async (admin, actor, slug) => (await admin.listVerticals(actor)).find((x) => x.slug === slug);
     /**
      * "This principal is confined, and this vertical is not its tenant's." The one
      * predicate every slug-addressed route asks.
@@ -7260,7 +7346,7 @@ export function createControlPlaneApi(options) {
      */
     const notOwned = async (p, slug) => {
         const pin = confinedTenant(p);
-        return pin !== null && (await ownerOf(p.actor, slug)) !== pin;
+        return pin !== null && (await ownerOf(adminFor(p), p.actor, slug)) !== pin;
     };
     /**
      * The READ twin of `notOwned`, for the routes an installed app's own pages ask
@@ -7273,7 +7359,7 @@ export function createControlPlaneApi(options) {
      * the prod history).
      */
     /** The bare slug of every registered vertical: what a manager's SKU may not be (#2388). */
-    const verticalSlugsOf = async (actor) => (await host.admin.listVerticals(actor)).map((v) => bareSlug(v.slug));
+    const verticalSlugsOf = async (admin, actor) => (await admin.listVerticals(actor)).map((v) => bareSlug(v.slug));
     /**
      * Whether a CONFINED principal may grant its own tenant `key` (#977): some vertical it
      * can read — its own, or a listed one — declares the key, or is the vertical whose
@@ -7288,8 +7374,8 @@ export function createControlPlaneApi(options) {
      * the first push). Its own slug and the engine keys are always declarable, so they reserve nothing.
      * Only a new slug is judged; the sentence names no other vertical.
      */
-    const slugClaimsSku = async (actor, slug) => {
-        const all = await host.admin.listVerticals(actor);
+    const slugClaimsSku = async (admin, actor, slug) => {
+        const all = await admin.listVerticals(actor);
         if (all.some((v) => v.slug === slug))
             return undefined;
         const name = bareSlug(slug);
@@ -7306,7 +7392,7 @@ export function createControlPlaneApi(options) {
         const pin = confinedTenant(p);
         if (pin === null)
             return true;
-        const all = await host.admin.listVerticals(p.actor);
+        const all = await adminFor(p).listVerticals(p.actor);
         const slugs = all.map((v) => bareSlug(v.slug));
         const visible = all.filter((v) => v.ownerTenant === pin || v.listed);
         return visible.some((v) => {
@@ -7320,7 +7406,7 @@ export function createControlPlaneApi(options) {
         const pin = confinedTenant(p);
         if (pin === null)
             return false;
-        const v = await verticalOf(p.actor, slug);
+        const v = await verticalOf(adminFor(p), p.actor, slug);
         return !v || (v.ownerTenant !== pin && !v.listed);
     };
     /**
@@ -7366,10 +7452,10 @@ export function createControlPlaneApi(options) {
         const workspace = (await c.var.admin.listTenants(actor)).find((t) => t.slug === pin || t.id === pin);
         if (!workspace || raw.startsWith(`${workspace.slug}/`))
             return raw;
-        if ((await ownerOf(actor, raw)) === workspace.id)
+        if ((await ownerOf(c.var.admin, actor, raw)) === workspace.id)
             return raw;
         const prefixed = `${workspace.slug}/${raw}`;
-        return (await ownerOf(actor, prefixed)) !== undefined ? prefixed : raw;
+        return (await ownerOf(c.var.admin, actor, prefixed)) !== undefined ? prefixed : raw;
     };
     app.get('/verticals', async (c) => {
         const page = pageParams(c);
@@ -7417,13 +7503,13 @@ export function createControlPlaneApi(options) {
      * same enumeration, and #977's observability narrowing must not be a second copy of
      * it that can drift when a third ref scheme appears.
      */
-    const tenantServiceRefs = async (actor, tenantId, slug) => {
-        const all = (await host.admin.listVerticals(actor)).filter((v) => v.ownerTenant === tenantId);
+    const tenantServiceRefs = async (admin, actor, tenantId, slug) => {
+        const all = (await admin.listVerticals(actor)).filter((v) => v.ownerTenant === tenantId);
         const considered = slug === undefined ? all : all.filter((v) => v.slug === slug);
         const verticalsTruncated = considered.length > MAX_SERVICE_REF_VERTICALS;
         const entries = [];
         for (const v of considered.slice(0, MAX_SERVICE_REF_VERTICALS)) {
-            const versions = await host.admin.listVersions(actor, v.slug);
+            const versions = await admin.listVersions(actor, v.slug);
             const labelOf = new Map(versions.map((ver) => [ver.id, ver.version]));
             // The stable serving script — where real traffic lands. Its version is the
             // registry row's own servingVersionId: authoritative, not the scope-derived
@@ -7463,7 +7549,7 @@ export function createControlPlaneApi(options) {
         const pin = confinedTenant(p);
         if (pin === null)
             return null;
-        const refs = await tenantServiceRefs(actor, pin);
+        const refs = await tenantServiceRefs(adminFor(p), actor, pin);
         if (refs.verticalsTruncated) {
             throw new ControlPlaneError(503, 'service map truncated: too many verticals to resolve in one answer');
         }
@@ -7482,7 +7568,7 @@ export function createControlPlaneApi(options) {
             .parse({ tenantId, vertical: c.req.query('vertical') });
         const actor = c.get('actor');
         const slug = query.vertical === undefined ? undefined : await resolveVerticalId(c, query.vertical);
-        const { entries, verticalsTruncated, matched } = await tenantServiceRefs(actor, query.tenantId, slug);
+        const { entries, verticalsTruncated, matched } = await tenantServiceRefs(c.var.admin, actor, query.tenantId, slug);
         // Non-ownership reads as absence (K-3), exactly like the per-slug registry reads.
         if (slug !== undefined && matched === 0)
             throw new ControlPlaneError(404, 'not found');
@@ -7497,17 +7583,17 @@ export function createControlPlaneApi(options) {
             // the prefix, backstopped by the ownership check). Owner + prefix come from the
             // principal, never trusted from the body.
             input.slug = effectiveSlug(p, input.slug);
-            const owner = await ownerOf(p.actor, input.slug);
+            const owner = await ownerOf(adminFor(p), p.actor, input.slug);
             if (owner !== undefined && owner !== p.tenantId)
                 return refuse(c, 'forbidden', 'forbidden');
             input.ownerTenant = p.tenantId;
         }
-        const claimed = await slugClaimsSku(c.get('actor'), input.slug);
+        const claimed = await slugClaimsSku(c.var.admin, c.get('actor'), input.slug);
         if (claimed)
             return refuseStatus(c, 422, claimed);
         // #2388: the same declaration rule as a push, for any principal that is not staff.
         if (p.kind !== 'staff') {
-            const foreignKey = entitlementNamespaceRefusal(input.slug, input.entitlements ?? [], input.provisions?.length ? await verticalSlugsOf(c.get('actor')) : undefined);
+            const foreignKey = entitlementNamespaceRefusal(input.slug, input.entitlements ?? [], input.provisions?.length ? await verticalSlugsOf(c.var.admin, c.get('actor')) : undefined);
             if (foreignKey)
                 return refuseStatus(c, 422, foreignKey);
         }
@@ -7593,9 +7679,12 @@ export function createControlPlaneApi(options) {
         }
         // #2210: publishing records the version's store bindings for the whole vertical's lifecycle
         // (backup, wipe, erasure, the meter), so its store scripts are put in place first, as a push
-        // does: a driver with no approved release refuses here, and nothing is published.
-        await ensureScopeStoresOf(c.get('actor'), 'deploy', slug, scopeStores, async () => (await ownerOf(c.get('actor'), slug)) ?? null);
-        await c.var.admin.publishVersion(c.get('actor'), input);
+        // does: a driver with no approved release refuses here, and nothing is published. The publish is
+        // made under the push's shared hold (#2816), so a rollout walks this vertical or waits for it.
+        await ensureScopeStoresOf(c.var.admin, c.get('actor'), 'deploy', slug, scopeStores, async () => (await ownerOf(c.var.admin, c.get('actor'), slug)) ?? null, async (renew) => {
+            await renew();
+            await c.var.admin.publishVersion(c.get('actor'), input);
+        });
         const version = await c.var.admin.getVersion(c.get('actor'), input.id, slug);
         return c.json(version, 201);
     });
@@ -7813,7 +7902,7 @@ export function createControlPlaneApi(options) {
         const slug = c.req.param('slug');
         if (await notOwned(c.get('principal'), slug))
             return refuse(c, 'forbidden', 'forbidden');
-        const vertical = await verticalOf(c.get('actor'), slug);
+        const vertical = await verticalOf(c.var.admin, c.get('actor'), slug);
         if (!vertical)
             return refuse(c, 'not_found', 'vertical not found');
         return c.json({ slug, emailSender: !!vertical.emailSender });
@@ -7892,10 +7981,16 @@ export function createControlPlaneApi(options) {
      * (#559), then rethrown, so the push or serve answers it and the vertical upload never runs.
      * The row carries the vertical's owner, so it shows in that tenant's failure view; the serve
      * path reads the owner only once something has failed.
+     *
+     * `then` runs after the uploads, still under the shared holds (#2816): a push or a publish passes
+     * the step that records the version's store declarations, so a rollout either finds the vertical
+     * in what it walks or is refused until that step is done. `renew` renews every hold, and refuses
+     * (409) once one has lapsed; `then` calls it right before it records. A failure in `then` is not
+     * recorded here: it is the caller's to answer.
      */
-    const ensureScopeStoresOf = async (actor, operation, slug, stores, owner) => {
+    const ensureScopeStoresOf = async (admin, actor, operation, slug, stores, owner, then = async () => undefined) => {
         if (stores.length === 0)
-            return;
+            return then(async () => undefined);
         // D-67: a driver whose registration names its verticals serves those only, refused before any
         // hold is taken or anything is uploaded.
         for (const store of stores) {
@@ -7907,54 +8002,61 @@ export function createControlPlaneApi(options) {
         const holder = ulid();
         const drivers = [...new Set(stores.map((store) => store.driver))].sort();
         const held = [];
+        const renewHolds = async (when) => {
+            for (const each of held) {
+                if (!(await admin.holdStoreDriver(actor, { driver: each, holder, mode: 'shared', ttlMs: PUSH_HOLD_TTL_MS, renew: true }))) {
+                    throw new ControlPlaneError(409, `${operation} refused: the hold on scope store driver '${each}' lapsed ${when}; try again`);
+                }
+            }
+        };
+        const renew = () => renewHolds('during the upload');
         try {
-            if (!options.ensureScopeStores) {
-                throw new ControlPlaneError(501, `${operation} refused: '${slug}' declares a scope store and this control plane uploads no store script`);
-            }
-            // A shared hold on each driver (#2300): a rollout holds it exclusively, and a rebuild that read
-            // a script's release before a rollout moved it would upload the old release back over it.
-            // Neither the refusal nor anything else here names another vertical: a push answers its own.
-            for (const driver of drivers) {
-                if (!(await host.admin.holdStoreDriver(actor, { driver, holder, mode: 'shared', ttlMs: PUSH_HOLD_TTL_MS }))) {
-                    throw new ControlPlaneError(409, `${operation} refused: scope store driver '${driver}' is being rolled out; try again in a few minutes`);
+            try {
+                if (!options.ensureScopeStores) {
+                    throw new ControlPlaneError(501, `${operation} refused: '${slug}' declares a scope store and this control plane uploads no store script`);
                 }
-                held.push(driver);
-            }
-            const loadRelease = options.storeReleases
-                ? storedReleaseLoader({ admin: host.admin, actor, bytes: options.storeReleases.bytes })
-                : async () => undefined;
-            // One driver at a time, each renewing every hold first: a push whose uploads outlast a hold
-            // stops (409) rather than upload after a rollout could have taken the driver.
-            for (const driver of drivers) {
-                for (const each of held) {
-                    if (!(await host.admin.holdStoreDriver(actor, { driver: each, holder, mode: 'shared', ttlMs: PUSH_HOLD_TTL_MS, renew: true }))) {
-                        throw new ControlPlaneError(409, `${operation} refused: the hold on scope store driver '${each}' lapsed during the upload; try again`);
+                // A shared hold on each driver (#2300): a rollout holds it exclusively, and a rebuild that read
+                // a script's release before a rollout moved it would upload the old release back over it.
+                // Neither the refusal nor anything else here names another vertical: a push answers its own.
+                for (const driver of drivers) {
+                    if (!(await admin.holdStoreDriver(actor, { driver, holder, mode: 'shared', ttlMs: PUSH_HOLD_TTL_MS }))) {
+                        throw new ControlPlaneError(409, `${operation} refused: scope store driver '${driver}' is being rolled out; try again in a few minutes`);
                     }
+                    held.push(driver);
+                }
+                const loadRelease = options.storeReleases
+                    ? storedReleaseLoader({ admin, actor, bytes: options.storeReleases.bytes })
+                    : async () => undefined;
+                // One driver at a time, each renewing every hold first: a push whose uploads outlast a hold
+                // stops (409) rather than upload after a rollout could have taken the driver.
+                for (const driver of drivers) {
+                    await renew();
+                    const registration = (options.storeDrivers ?? STORE_DRIVERS).find((k) => k.driver === driver);
+                    if (!registration)
+                        throw new ControlPlaneError(403, `scope store driver '${driver}' is not registered`);
+                    // Read under the shared hold (D-65): a revoke takes the driver exclusively, so one written
+                    // before this read is seen, and none is written until this upload is done.
+                    const approvals = await readStoreDriverApprovals(admin, actor, registration);
+                    await options.ensureScopeStores({ vertical: slug, stores: stores.filter((store) => store.driver === driver), loadRelease, approvals });
                 }
-                const registration = (options.storeDrivers ?? STORE_DRIVERS).find((k) => k.driver === driver);
-                if (!registration)
-                    throw new ControlPlaneError(403, `scope store driver '${driver}' is not registered`);
-                // Read under the shared hold (D-65): a revoke takes the driver exclusively, so one written
-                // before this read is seen, and none is written until this upload is done.
-                const approvals = await readStoreDriverApprovals(host.admin, actor, registration);
-                await options.ensureScopeStores({ vertical: slug, stores: stores.filter((store) => store.driver === driver), loadRelease, approvals });
             }
-        }
-        catch (e) {
-            recordFailure({
-                actor,
-                operation: `${operation}.store-upload`,
-                stage: 'store-upload',
-                vertical: slug,
-                tenantId: await owner().catch(() => null),
-                status: e instanceof ControlPlaneError ? e.status : 502,
-                message: e instanceof Error ? e.message : String(e),
-            }, e);
-            throw e;
+            catch (e) {
+                recordFailure({
+                    actor,
+                    operation: `${operation}.store-upload`,
+                    stage: 'store-upload',
+                    vertical: slug,
+                    tenantId: await owner().catch(() => null),
+                    status: e instanceof ControlPlaneError ? e.status : 502,
+                    message: e instanceof Error ? e.message : String(e),
+                }, e);
+                throw e;
+            }
+            return await then(() => renewHolds('before the version was recorded'));
         }
         finally {
             for (const driver of held)
-                await host.admin.releaseStoreDriverHold(actor, { driver, holder }).catch(() => undefined);
+                await admin.releaseStoreDriverHold(actor, { driver, holder }).catch(() => undefined);
         }
     };
     /**
@@ -8059,12 +8161,12 @@ export function createControlPlaneApi(options) {
     const serveVersionInPlace = async (admin, actor, slug, versionId) => {
         if (!options.deployVertical || !options.fetchVerticalModules)
             return; // not configured: pre-#286 behavior
-        const version = await host.admin.getVersion(actor, versionId, slug);
+        const version = await admin.getVersion(actor, versionId, slug);
         if (!version?.deploymentRef) {
             throw new ControlPlaneError(502, `version ${versionId} has no archive script to serve from`);
         }
         const archiveRef = version.deploymentRef;
-        const manifestJson = await host.admin.versionManifest(actor, slug, versionId);
+        const manifestJson = await admin.versionManifest(actor, slug, versionId);
         if (!manifestJson) {
             throw new ControlPlaneError(502, `version ${versionId} retained no manifest — pushed pre-#286; push it again to serve in place`);
         }
@@ -8074,7 +8176,7 @@ export function createControlPlaneApi(options) {
         // serving record below all read this one set; the manifest's own `doClasses` would leave
         // the record a class short of the script, and the next serve re-declaring a live class.
         const doClasses = deployedDoClasses(manifest.doClasses, manifest.platformSweeper);
-        const serving = await host.admin.verticalServing(actor, slug);
+        const serving = await admin.verticalServing(actor, slug);
         const ref = serving?.ref ?? stableDeploymentRefFor(slug);
         // #1923: the serving upload is the other door a script name is minted through.
         const collision = platformScriptCollision(slug) ?? (PLATFORM_SCRIPT_NAMES.has(ref) ? ref : null);
@@ -8088,16 +8190,16 @@ export function createControlPlaneApi(options) {
         // tenant's store. Platform-granted after the §4 sandbox check, like injectSecrets:
         // the builder never declared these and never named the ids.
         const storeBindings = [
-            ...tenantStoreBindings(await host.admin.listTenantStores(actor, { vertical: slug })),
+            ...tenantStoreBindings(await admin.listTenantStores(actor, { vertical: slug })),
             // #473: the per-tenant blob-store r2_bucket bindings, re-derived from the ledger on
             // every serving upload for the same reason — an upload replaces the script's binding
             // set, so a re-deploy must never drop a tenant's attachment bucket.
-            ...blobStoreBindings(await host.admin.listBlobStores(actor, { vertical: slug })),
+            ...blobStoreBindings(await admin.listBlobStores(actor, { vertical: slug })),
         ].map((b) => b.type === 'd1'
             ? { type: 'd1', name: b.name, id: b.id }
             : { type: 'r2_bucket', name: b.name, bucket_name: b.bucketName });
         // #2210: the store scripts first, so the vertical is never served before what it reaches.
-        await ensureScopeStoresOf(actor, 'serve', slug, manifest.scopeStores, async () => (await ownerOf(actor, slug)) ?? null);
+        await ensureScopeStoresOf(admin, actor, 'serve', slug, manifest.scopeStores, async () => (await ownerOf(admin, actor, slug)) ?? null);
         const wire = await deployVerticalScript(options.deployVertical, actor, slug, ref, {
             entry: manifest.entry,
             compatibilityDate: manifest.compatibilityDate,
@@ -8259,14 +8361,14 @@ export function createControlPlaneApi(options) {
         if (!options.deployVertical || !options.fetchVerticalModules)
             return none; // no in-place serve moves anything
         const actor = c.get('actor');
-        const incoming = await host.admin.getVersion(actor, versionId, slug);
+        const incoming = await c.var.admin.getVersion(actor, versionId, slug);
         if (!incoming?.deploymentRef)
             return none;
-        const manifestJson = await host.admin.versionManifest(actor, slug, versionId);
+        const manifestJson = await c.var.admin.versionManifest(actor, slug, versionId);
         const registry = manifestJson ? storedDeployManifest.parse(JSON.parse(manifestJson)).registry : undefined;
         if (!registry || !releaseRolesAskScopes(registry))
             return none;
-        const v = await verticalOf(actor, slug);
+        const v = await verticalOf(c.var.admin, actor, slug);
         const owner = v && v.ownerTenant !== null && !v.listed ? v.ownerTenant : null;
         const moved = (await c.var.admin.listScopes(actor, { vertical: slug, status: ['active', 'suspended'] }))
             .filter((s) => !s.forkedFrom && s.kind !== 'preview' && (!!s.servingRef || (s.tenantId === owner && s.status === 'active')))
@@ -8320,23 +8422,23 @@ export function createControlPlaneApi(options) {
      * Over-approximates for a host that cannot serve in place, where no adopt runs: an extra line
      * costs a read, a missing one a silent stall.
      */
-    const promoteImpactOf = async (actor, slug, channel, versionId) => {
-        const gate = await host.admin.promotionImpact(actor, slug, channel, versionId);
+    const promoteImpactOf = async (admin, actor, slug, channel, versionId) => {
+        const gate = await admin.promotionImpact(actor, slug, channel, versionId);
         if (channel !== 'prod')
             return gate;
-        const v = await verticalOf(actor, slug);
+        const v = await verticalOf(admin, actor, slug);
         if (!v || v.ownerTenant === null || v.listed)
             return gate;
-        const incoming = await host.admin.getVersion(actor, versionId, slug);
+        const incoming = await admin.getVersion(actor, versionId, slug);
         if (!incoming?.deploymentRef || incoming.admission !== 'admitted')
             return gate;
-        const lagging = (await host.admin.listScopes(actor, { tenantId: v.ownerTenant, vertical: slug, status: ['active'] })).filter((s) => !s.forkedFrom && s.kind !== 'preview' && !s.servingRef && s.verticalVersionId !== versionId);
+        const lagging = (await admin.listScopes(actor, { tenantId: v.ownerTenant, vertical: slug, status: ['active'] })).filter((s) => !s.forkedFrom && s.kind !== 'preview' && !s.servingRef && s.verticalVersionId !== versionId);
         const seen = new Set(gate.map((b) => `${b.scopeId}|${b.type}`));
         const out = [...gate];
         for (const s of lagging) {
             // After the adopt it runs the promoted version, served in place: that pointer move, from
             // what it runs now, is the move to judge.
-            for (const b of await host.admin.bindingImpact(actor, s.tenantId, s.id, versionId)) {
+            for (const b of await admin.bindingImpact(actor, s.tenantId, s.id, versionId)) {
                 const key = `${b.scopeId}|${b.type}`;
                 if (!seen.has(key))
                     (seen.add(key), out.push(b));
@@ -8355,11 +8457,11 @@ export function createControlPlaneApi(options) {
         const versionId = z.string().min(1).parse(c.req.query('versionId'));
         const pin = confinedTenant(p);
         if (pin) {
-            const v = await verticalOf(p.actor, slug);
+            const v = await verticalOf(adminFor(p), p.actor, slug);
             if (!v || v.ownerTenant !== pin)
                 return refuse(c, 'forbidden', 'forbidden');
         }
-        const breaks = await promoteImpactOf(c.get('actor'), slug, channel, versionId);
+        const breaks = await promoteImpactOf(c.var.admin, c.get('actor'), slug, channel, versionId);
         const { visible, otherTenants } = narrowToCaller(breaks, pin);
         return c.json({ affected: visible, ...(otherTenants ? { otherTenants } : {}) });
     });
@@ -8377,7 +8479,7 @@ export function createControlPlaneApi(options) {
         const promotePin = confinedTenant(p);
         if (promotePin) {
             // A confined principal promotes only verticals its tenant owns.
-            const v = await verticalOf(p.actor, slug);
+            const v = await verticalOf(adminFor(p), p.actor, slug);
             if (!v || v.ownerTenant !== promotePin)
                 return refuse(c, 'forbidden', 'forbidden');
             // …and a BUILDER promotes prod only while the vertical is PRIVATE (not listed).
@@ -8411,7 +8513,7 @@ export function createControlPlaneApi(options) {
         // counts only the gate's half of them.
         let counted = [];
         const breaksOf = async () => {
-            const breaks = await promoteImpactOf(c.get('actor'), slug, channel, versionId);
+            const breaks = await promoteImpactOf(c.var.admin, c.get('actor'), slug, channel, versionId);
             counted = breaks;
             if (breaks.length === 0)
                 return null;
@@ -8582,9 +8684,9 @@ export function createControlPlaneApi(options) {
         if (c.req.method === 'POST') {
             const input = z.object({ slug: z.string().min(1), name: z.string().min(1), repository: z.unknown().optional() }).parse(await c.req.json());
             const team = tenants.find((t) => t.id === tenant);
-            const slug = await ownerOf(c.get('actor'), input.slug) === tenant || input.slug.startsWith(`${team.slug}/`) ? input.slug : `${team.slug}/${input.slug}`;
+            const slug = await ownerOf(c.var.admin, c.get('actor'), input.slug) === tenant || input.slug.startsWith(`${team.slug}/`) ? input.slug : `${team.slug}/${input.slug}`;
             verticalSlug.parse(slug);
-            const owner = await ownerOf(c.get('actor'), slug);
+            const owner = await ownerOf(c.var.admin, c.get('actor'), slug);
             if (owner !== undefined && owner !== tenant)
                 return refuse(c, 'forbidden', 'forbidden');
             body = JSON.stringify({ ...input, slug });
@@ -8639,9 +8741,9 @@ export function createControlPlaneApi(options) {
                 if (!tenant)
                     return refuse(c, 'not_found', 'unknown workspace');
                 sourceTenant = tenant.id;
-                sourceSlug = bare.startsWith(`${tenant.slug}/`) || await ownerOf(c.get('actor'), bare) === tenant.id ? bare : `${tenant.slug}/${bare}`;
+                sourceSlug = bare.startsWith(`${tenant.slug}/`) || await ownerOf(c.var.admin, c.get('actor'), bare) === tenant.id ? bare : `${tenant.slug}/${bare}`;
             }
-            const owner = await ownerOf(c.get('actor'), sourceSlug);
+            const owner = await ownerOf(c.var.admin, c.get('actor'), sourceSlug);
             if (sourceTenant && owner !== undefined && owner !== sourceTenant)
                 return refuse(c, 'forbidden', 'forbidden');
             sourceTenant ??= owner ?? null;
@@ -8733,7 +8835,7 @@ export function createControlPlaneApi(options) {
             }
             slug = effectiveSlug(p, bare);
             // A builder pushes to a slug it owns, or claims an unregistered one (§3).
-            const existingOwner = await ownerOf(c.get('actor'), slug);
+            const existingOwner = await ownerOf(c.var.admin, c.get('actor'), slug);
             if (existingOwner !== undefined && existingOwner !== p.tenantId) {
                 return refuse(c, 'forbidden', 'forbidden');
             }
@@ -8747,9 +8849,9 @@ export function createControlPlaneApi(options) {
             // hand-registration predating prefixed claims) stays addressable as itself.
             // Otherwise the claim lands under the tenant prefix, exactly like a builder push —
             // same namespace, no claim race with other workspaces' bare names.
-            const bareOwner = await ownerOf(c.get('actor'), bare);
+            const bareOwner = await ownerOf(c.var.admin, c.get('actor'), bare);
             slug = bare.startsWith(`${workspace.slug}/`) || bareOwner === workspace.id ? bare : `${workspace.slug}/${bare}`;
-            const existingOwner = slug === bare ? bareOwner : await ownerOf(c.get('actor'), slug);
+            const existingOwner = slug === bare ? bareOwner : await ownerOf(c.var.admin, c.get('actor'), slug);
             if (existingOwner !== undefined && existingOwner !== workspace.id) {
                 return refuse(c, 'forbidden', `vertical '${slug}' is not owned by workspace '${pin}'`);
             }
@@ -8759,7 +8861,7 @@ export function createControlPlaneApi(options) {
             // No pin: the raw slug is the identity and an existing owner is preserved
             // (null ⇒ platform-owned for a first-party vertical) — unchanged staff behavior.
             slug = bare;
-            ownerTenant = (await ownerOf(c.get('actor'), slug)) ?? null;
+            ownerTenant = (await ownerOf(c.var.admin, c.get('actor'), slug)) ?? null;
         }
         // #1923: a slug that would deploy under one of the platform's own script names is refused
         // before anything is uploaded. Registration refuses it too; this is the deploy half, for a
@@ -8837,10 +8939,10 @@ export function createControlPlaneApi(options) {
         // is judged here and honoured by the grant paths only for a tenant-provisioner. Earlier versions
         // are not re-judged.
         // Declaring `provisions` marks a manager: the capability itself is granted after a first push.
-        const foreignKey = entitlementNamespaceRefusal(slug, manifest.entitlements ?? [], manifest.provisions?.length ? await verticalSlugsOf(c.get('actor')) : undefined);
+        const foreignKey = entitlementNamespaceRefusal(slug, manifest.entitlements ?? [], manifest.provisions?.length ? await verticalSlugsOf(c.var.admin, c.get('actor')) : undefined);
         if (foreignKey)
             return refuseStatus(c, 422, foreignKey);
-        const claimed = await slugClaimsSku(c.get('actor'), slug);
+        const claimed = await slugClaimsSku(c.var.admin, c.get('actor'), slug);
         if (claimed)
             return refuseStatus(c, 422, claimed);
         // The static-asset half of the §4 sandbox contract (self-serve-deploy.md §4.1). The
@@ -8907,117 +9009,128 @@ export function createControlPlaneApi(options) {
         const id = ulid();
         const deploymentRef = deploymentRefFor(slug, id);
         // #2210: the store scripts first, outside the vertical upload's try, so a store failure
-        // answers as itself and the vertical is not uploaded at all.
-        await ensureScopeStoresOf(c.get('actor'), 'deploy', slug, manifest.scopeStores, async () => ownerTenant ?? null);
-        let wire;
-        try {
-            wire = await deployVerticalScript(options.deployVertical, c.get('actor'), slug, deploymentRef, {
-                entry: manifest.entry,
-                compatibilityDate: manifest.compatibilityDate,
-                compatibilityFlags: manifest.compatibilityFlags,
-                modules,
-                doClasses: manifest.doClasses,
-                bindings: verticalUploadBindings({
+        // answers as itself and the vertical is not uploaded at all. The upload, the registration and
+        // the publish run under the store push's shared hold (#2816): a rollout that starts before the
+        // version records its stores is refused, and one after walks this vertical.
+        const deployVertical = options.deployVertical;
+        const pushed = await ensureScopeStoresOf(c.var.admin, c.get('actor'), 'deploy', slug, manifest.scopeStores, async () => ownerTenant ?? null, async (renew) => {
+            let wire;
+            try {
+                wire = await deployVerticalScript(deployVertical, c.get('actor'), slug, deploymentRef, {
+                    entry: manifest.entry,
+                    compatibilityDate: manifest.compatibilityDate,
+                    compatibilityFlags: manifest.compatibilityFlags,
+                    modules,
+                    doClasses: manifest.doClasses,
+                    bindings: verticalUploadBindings({
+                        vertical: slug,
+                        manifest,
+                        drivers: options.storeDrivers,
+                        // #2349: the migrations this push declares, which are the ones the version stores.
+                        platformBindings: await migrationsDigestBindings(manifest.migrations ?? null),
+                    }),
+                    // #1242: the freshly minted version id — this archive script IS that version,
+                    // and a preview routed at it stamps the signals `version` dimension honestly.
+                    versionId: id,
+                    // #1902: the platform's scope sweeper, as decided above and recorded with the version.
+                    ...(sweeper.supply ? { supplySweeper: true } : {}),
+                    // #340: the verified bytes go up with the bundle. The manifest's routing config
+                    // rides along untouched — it decides what the RUNTIME does with paths, and carries
+                    // no reach, so there is nothing in it for the sandbox contract to refuse.
+                    ...(manifest.assets ? { assets: { ...manifest.assets, files: assets } } : {}),
+                });
+            }
+            catch (e) {
+                // The upload to the runtime failed. Surface the detail (the builder is
+                // authenticated) rather than the anonymous 500 the generic handler would give, so a
+                // push failure is diagnosable without reading worker logs. The version label is NOT
+                // consumed here: registration/publish happen only AFTER a successful upload (below),
+                // so a failed push leaves the same --version reusable (#307).
+                //
+                // Answer the upstream status honestly: a runtime 4xx is a bad-bundle rejection — the
+                // builder's own script (e.g. a module-top-level throw → CF 10021), well-formed HTTP
+                // but refused — so a 422, not a 502 that reads as a platform outage. A 5xx (or any
+                // throw with no upstream status) is a platform failure and stays a 502.
+                const detail = e instanceof Error ? e.message : String(e);
+                const upstream = upstreamStatusOf(e);
+                console.error('deploy.upload.failed', { slug, deploymentRef, detail, upstream });
+                const rejected = upstream !== undefined && upstream >= 400 && upstream < 500;
+                // Both outcomes land an ops-failure row (#559): the 502 is the platform's to
+                // explain, and the 422 is what the builder-facing failure view (step 5) will
+                // list — a red push should be explainable from a durable record either way.
+                recordFailure({
+                    actor: c.get('actor'),
+                    operation: 'deploy.upload',
+                    stage: 'wfp-upload',
                     vertical: slug,
-                    manifest,
-                    drivers: options.storeDrivers,
-                    // #2349: the migrations this push declares, which are the ones the version stores.
-                    platformBindings: await migrationsDigestBindings(manifest.migrations ?? null),
-                }),
-                // #1242: the freshly minted version id — this archive script IS that version,
-                // and a preview routed at it stamps the signals `version` dimension honestly.
-                versionId: id,
-                // #1902: the platform's scope sweeper, as decided above and recorded with the version.
-                ...(sweeper.supply ? { supplySweeper: true } : {}),
-                // #340: the verified bytes go up with the bundle. The manifest's routing config
-                // rides along untouched — it decides what the RUNTIME does with paths, and carries
-                // no reach, so there is nothing in it for the sandbox contract to refuse.
-                ...(manifest.assets ? { assets: { ...manifest.assets, files: assets } } : {}),
+                    tenantId: ownerTenant ?? null,
+                    status: rejected ? 422 : 502,
+                    message: detail,
+                }, e);
+                c.set('failureRecorded', true);
+                return rejected
+                    ? refuseStatus(c, 422, 'deploy rejected', { detail })
+                    : refuseStatus(c, 502, 'deploy upload failed', { detail });
+            }
+            // Register-then-publish, both idempotent-ish below the seam: a first push of a
+            // slug registers it; publishVersion lands the version pending with deploymentRef
+            // (or admitted, for a PRIVATE vertical — the registry's self-admit rule). The owner
+            // was resolved with the slug above: the builder's tenant, the pinned workspace, or
+            // the preserved existing owner for an unpinned staff push. An upload that outlasted the
+            // store hold refuses here (409) before the vertical or its version is registered, so the
+            // label stays reusable; unlike a failed upload, it lands no ops-failure row.
+            await renew();
+            await c.var.admin.registerVertical(c.get('actor'), {
+                slug,
+                name: manifest.name ?? slug,
+                source: 'cli',
+                ownerTenant,
+                // The vertical's declared config surface rides to the registry, so the dashboard
+                // renders a settings form for a pushed vertical exactly like a builtin.
+                ...(manifest.envSpec ? { envSpec: manifest.envSpec } : {}),
+                // Registry-driven install metadata (marketplace-publish.md §3) — so the dashboard
+                // installs a pushed vertical without a hardcoded catalog entry.
+                ...(manifest.ownerGrants ? { ownerGrants: manifest.ownerGrants } : {}),
+                ...(manifest.entitlements ? { entitlements: manifest.entitlements } : {}),
+                ...(manifest.provides ? { provides: manifest.provides } : {}),
+                ...(manifest.requires ? { requires: manifest.requires } : {}),
+                // The declared vertical-defined connectors (vertical-connectors.md §7.2): what the dashboard's
+                // door renders. The proxy never reads this copy; it reads the running version's manifest.
+                ...(manifest.connectors ? { connectors: manifest.connectors } : {}),
+                // The declared provisioner intent (#455) — a REQUEST the console reviews; the
+                // tenant-provisioner grant itself is never touched by a push. Refreshes on every
+                // re-push like the rest of the install spec, exactly because it grants nothing.
+                ...(manifest.provisions ? { provisions: manifest.provisions } : {}),
+                // The declared email-sender intent (#303) — a REQUEST the console reviews; the
+                // `emailSender` grant itself is never touched by a push. Refreshes on every re-push
+                // like the rest of the install spec, exactly because it grants nothing.
+                ...(manifest.sendsEmail ? { sendsEmail: true } : {}),
+                // Where the scope lifecycle is held (#1713): `'router'` keeps the vertical's scopes out of
+                // the lifecycle delivery. Refreshes on every re-push like the rest of the install spec.
+                ...(manifest.lifecycle ? { lifecycle: manifest.lifecycle } : {}),
+                // The declared surfaces (K-26) ride like envSpec: registry metadata for the
+                // hostname-binding picker, never behavior. Not part of any admission digest.
+                ...(manifest.surfaces ? { surfaces: manifest.surfaces } : {}),
             });
-        }
-        catch (e) {
-            // The upload to the runtime failed. Surface the detail (the builder is
-            // authenticated) rather than the anonymous 500 the generic handler would give, so a
-            // push failure is diagnosable without reading worker logs. The version label is NOT
-            // consumed here: registration/publish happen only AFTER a successful upload (below),
-            // so a failed push leaves the same --version reusable (#307).
-            //
-            // Answer the upstream status honestly: a runtime 4xx is a bad-bundle rejection — the
-            // builder's own script (e.g. a module-top-level throw → CF 10021), well-formed HTTP
-            // but refused — so a 422, not a 502 that reads as a platform outage. A 5xx (or any
-            // throw with no upstream status) is a platform failure and stays a 502.
-            const detail = e instanceof Error ? e.message : String(e);
-            const upstream = upstreamStatusOf(e);
-            console.error('deploy.upload.failed', { slug, deploymentRef, detail, upstream });
-            const rejected = upstream !== undefined && upstream >= 400 && upstream < 500;
-            // Both outcomes land an ops-failure row (#559): the 502 is the platform's to
-            // explain, and the 422 is what the builder-facing failure view (step 5) will
-            // list — a red push should be explainable from a durable record either way.
-            recordFailure({
-                actor: c.get('actor'),
-                operation: 'deploy.upload',
-                stage: 'wfp-upload',
-                vertical: slug,
-                tenantId: ownerTenant ?? null,
-                status: rejected ? 422 : 502,
-                message: detail,
-            }, e);
-            c.set('failureRecorded', true);
-            return rejected
-                ? refuseStatus(c, 422, 'deploy rejected', { detail })
-                : refuseStatus(c, 502, 'deploy upload failed', { detail });
-        }
-        // Register-then-publish, both idempotent-ish below the seam: a first push of a
-        // slug registers it; publishVersion lands the version pending with deploymentRef
-        // (or admitted, for a PRIVATE vertical — the registry's self-admit rule). The owner
-        // was resolved with the slug above: the builder's tenant, the pinned workspace, or
-        // the preserved existing owner for an unpinned staff push.
-        await c.var.admin.registerVertical(c.get('actor'), {
-            slug,
-            name: manifest.name ?? slug,
-            source: 'cli',
-            ownerTenant,
-            // The vertical's declared config surface rides to the registry, so the dashboard
-            // renders a settings form for a pushed vertical exactly like a builtin.
-            ...(manifest.envSpec ? { envSpec: manifest.envSpec } : {}),
-            // Registry-driven install metadata (marketplace-publish.md §3) — so the dashboard
-            // installs a pushed vertical without a hardcoded catalog entry.
-            ...(manifest.ownerGrants ? { ownerGrants: manifest.ownerGrants } : {}),
-            ...(manifest.entitlements ? { entitlements: manifest.entitlements } : {}),
-            ...(manifest.provides ? { provides: manifest.provides } : {}),
-            ...(manifest.requires ? { requires: manifest.requires } : {}),
-            // The declared vertical-defined connectors (vertical-connectors.md §7.2): what the dashboard's
-            // door renders. The proxy never reads this copy; it reads the running version's manifest.
-            ...(manifest.connectors ? { connectors: manifest.connectors } : {}),
-            // The declared provisioner intent (#455) — a REQUEST the console reviews; the
-            // tenant-provisioner grant itself is never touched by a push. Refreshes on every
-            // re-push like the rest of the install spec, exactly because it grants nothing.
-            ...(manifest.provisions ? { provisions: manifest.provisions } : {}),
-            // The declared email-sender intent (#303) — a REQUEST the console reviews; the
-            // `emailSender` grant itself is never touched by a push. Refreshes on every re-push
-            // like the rest of the install spec, exactly because it grants nothing.
-            ...(manifest.sendsEmail ? { sendsEmail: true } : {}),
-            // Where the scope lifecycle is held (#1713): `'router'` keeps the vertical's scopes out of
-            // the lifecycle delivery. Refreshes on every re-push like the rest of the install spec.
-            ...(manifest.lifecycle ? { lifecycle: manifest.lifecycle } : {}),
-            // The declared surfaces (K-26) ride like envSpec: registry metadata for the
-            // hostname-binding picker, never behavior. Not part of any admission digest.
-            ...(manifest.surfaces ? { surfaces: manifest.surfaces } : {}),
-        });
-        await c.var.admin.publishVersion(c.get('actor'), {
-            id,
-            verticalSlug: slug,
-            version: manifest.version,
-            manifestDigest: manifest.digests.manifest,
-            permissionDigest: manifest.digests.permission,
-            migrationDigest: manifest.digests.migration,
-            deploymentRef,
-            ...(origin ? { origin } : {}),
-            // Retained for the serving upload (#286): the archive script keeps the module
-            // bytes, this keeps their shape (entry, compat, doClasses, bindings).
-            // #1902: with the sweeper decision the push made, which no later upload re-makes.
-            manifestJson: JSON.stringify({ ...manifest, platformSweeper: sweeper.supply }),
+            await c.var.admin.publishVersion(c.get('actor'), {
+                id,
+                verticalSlug: slug,
+                version: manifest.version,
+                manifestDigest: manifest.digests.manifest,
+                permissionDigest: manifest.digests.permission,
+                migrationDigest: manifest.digests.migration,
+                deploymentRef,
+                ...(origin ? { origin } : {}),
+                // Retained for the serving upload (#286): the archive script keeps the module
+                // bytes, this keeps their shape (entry, compat, doClasses, bindings).
+                // #1902: with the sweeper decision the push made, which no later upload re-makes.
+                manifestJson: JSON.stringify({ ...manifest, platformSweeper: sweeper.supply }),
+            });
+            return { wire };
         });
+        if (pushed instanceof Response)
+            return pushed;
+        const { wire } = pushed;
         await recordWireUpload(c.var.admin, c.get('actor'), id, wire);
         if (migrationsExtracted)
             await c.var.admin.recordMigrationsExtracted?.(c.get('actor'), slug, id, migrationsExtracted);
@@ -9305,7 +9418,7 @@ export function createControlPlaneApi(options) {
             limit: c.req.query('limit'),
         });
         // #1877: scoped to the app's own scripts — the scan and trust boundary.
-        const services = await appServices(c.get('actor'), input.tenantId, input.scopeId, input.vertical);
+        const services = await appServices(c.var.admin, c.get('actor'), input.tenantId, input.scopeId, input.vertical);
         const { operation, principalKind, ...rest } = input;
         const { events, incomplete } = await options.observability.tenantLogs({
             ...rest,
@@ -9342,7 +9455,7 @@ export function createControlPlaneApi(options) {
         catch (e) {
             throw new ControlPlaneError(400, e.message);
         }
-        const scopes = await host.admin.listScopes(c.get('actor'), { tenantId: input.tenantId });
+        const scopes = await c.var.admin.listScopes(c.get('actor'), { tenantId: input.tenantId });
         const installed = scopes.find((s) => s.id === input.scopeId);
         if (!installed?.vertical)
             return refuse(c, 'not_found', 'app not found');
@@ -9382,7 +9495,7 @@ export function createControlPlaneApi(options) {
      * nothing. `listScopes`, not `getScopeRecord`: a dashboard read must not write an access
      * row per page view.
      */
-    const appServices = async (actor, tenantId, scopeId, vertical) => scriptFamiliesOfScopes(await host.admin.listScopes(actor, { tenantId: tenantIdSchema.parse(tenantId) }), { scopeId, vertical });
+    const appServices = async (admin, actor, tenantId, scopeId, vertical) => scriptFamiliesOfScopes(await admin.listScopes(actor, { tenantId: tenantIdSchema.parse(tenantId) }), { scopeId, vertical });
     app.get('/observability/tenant-request-volume', async (c) => {
         if (!options.observability?.tenantRequestVolume) {
             return refuseStatus(c, 501, 'request aggregation is not configured on this control plane');
@@ -9392,7 +9505,7 @@ export function createControlPlaneApi(options) {
         // A bucket COUNT: zooming in keeps it and narrows the window, so the bucket shrinks.
         // 90 is the design's histogram; the bounds keep a chart drawable and a query cheap.
         const buckets = z.coerce.number().int().min(10).max(240).default(90).parse(c.req.query('buckets'));
-        const services = await appServices(c.get('actor'), scope.tenantId, scope.scopeId, scope.vertical);
+        const services = await appServices(c.var.admin, c.get('actor'), scope.tenantId, scope.scopeId, scope.vertical);
         return c.json(await options.observability.tenantRequestVolume({ ...scope, services, buckets }));
     });
     app.get('/observability/tenant-request-facets', async (c) => {
@@ -9405,7 +9518,7 @@ export function createControlPlaneApi(options) {
         // that shows three asks for three.
         const asked = (c.req.queries('facet') ?? []).filter((k) => k.length > 0);
         const keys = asked.length === 0 ? undefined : z.array(z.enum(REQUEST_FACET_KEYS)).parse([...new Set(asked)]);
-        const services = await appServices(c.get('actor'), scope.tenantId, scope.scopeId, scope.vertical);
+        const services = await appServices(c.var.admin, c.get('actor'), scope.tenantId, scope.scopeId, scope.vertical);
         return c.json(await options.observability.tenantRequestFacets({ ...scope, services, ...(keys ? { keys } : {}) }));
     });
     // #1747: the tenant's `ctx.log` lines grouped by the template they were written from.
@@ -9434,7 +9547,7 @@ export function createControlPlaneApi(options) {
             buckets: narrow.buckets,
             ...(narrow.level.length ? { level: narrow.level } : {}),
             ...(narrow.operation.length ? { operation: narrow.operation } : {}),
-            services: await appServices(c.get('actor'), scope.tenantId, scope.scopeId, scope.vertical),
+            services: await appServices(c.var.admin, c.get('actor'), scope.tenantId, scope.scopeId, scope.vertical),
         }));
     });
     // #2762: the Lines histogram and facets — a tenant's request lines and `ctx.log` lines, counted
@@ -9445,7 +9558,7 @@ export function createControlPlaneApi(options) {
         }
         const scope = parseTenantLineQuery(requestTenantOf(c), requestQueryOf(c));
         const buckets = z.coerce.number().int().min(10).max(240).default(90).parse(c.req.query('buckets'));
-        const services = await appServices(c.get('actor'), scope.tenantId, scope.scopeId, scope.vertical);
+        const services = await appServices(c.var.admin, c.get('actor'), scope.tenantId, scope.scopeId, scope.vertical);
         return c.json(await options.observability.tenantLogVolume({ ...scope, services, buckets }));
     });
     app.get('/observability/tenant-log-facets', async (c) => {
@@ -9453,7 +9566,7 @@ export function createControlPlaneApi(options) {
             return refuseStatus(c, 501, 'line aggregation is not configured on this control plane');
         }
         const scope = parseTenantLineQuery(requestTenantOf(c), requestQueryOf(c));
-        const services = await appServices(c.get('actor'), scope.tenantId, scope.scopeId, scope.vertical);
+        const services = await appServices(c.var.admin, c.get('actor'), scope.tenantId, scope.scopeId, scope.vertical);
         return c.json(await options.observability.tenantLogFacets({ ...scope, services }));
     });
     app.get('/observability/tenant-requests', async (c) => {
@@ -9462,7 +9575,7 @@ export function createControlPlaneApi(options) {
         }
         const scope = parseTenantRequestQuery(requestTenantOf(c), requestQueryOf(c));
         const limit = z.coerce.number().int().min(1).max(200).default(50).parse(c.req.query('limit'));
-        const services = await appServices(c.get('actor'), scope.tenantId, scope.scopeId, scope.vertical);
+        const services = await appServices(c.var.admin, c.get('actor'), scope.tenantId, scope.scopeId, scope.vertical);
         return c.json(await options.observability.tenantRequests({ ...scope, services, limit }));
     });
     /**
@@ -9921,7 +10034,7 @@ export function createControlPlaneApi(options) {
         if (!parsed)
             throw new ControlPlaneError(400, `'${baseHostname}' is not a hostname a preview can be minted beside`);
         const hostname = withLabel(parsed, `${parsed.label}${RESERVED_LABEL_SEPARATOR}${tag}`);
-        const existing = (await host.admin.listHostnames(actor, { scopeId: previewId })).find((h) => h.hostname === hostname);
+        const existing = (await admin.listHostnames(actor, { scopeId: previewId })).find((h) => h.hostname === hostname);
         if (!existing) {
             await admin.bindHostname(actor, {
                 hostname,
@@ -9932,7 +10045,7 @@ export function createControlPlaneApi(options) {
                 canonical: false,
             });
         }
-        const bound = (await host.admin.listHostnames(actor, { scopeId: previewId })).find((h) => h.hostname === hostname);
+        const bound = (await admin.listHostnames(actor, { scopeId: previewId })).find((h) => h.hostname === hostname);
         if (bound)
             await runIssuance(admin, actor, bound); // platform mint rides the wildcard cert → active
         return hostname;
@@ -9941,9 +10054,9 @@ export function createControlPlaneApi(options) {
      *  source scope's canonical URL; a clean-room preview (no source, #509 ask (b)) has none,
      *  so it is built from the platform tenant-app convention `<vertical>-<tenant>.<base>` —
      *  the same scheme provisioning mints (`callout-sesamy.global.substrat.run`). */
-    const previewBaseHostname = async (actor, source, tenantId, slug, surface) => {
+    const previewBaseHostname = async (admin, actor, source, tenantId, slug, surface) => {
         if (source) {
-            const own = await host.admin.listHostnames(actor, { scopeId: source.id });
+            const own = await admin.listHostnames(actor, { scopeId: source.id });
             const src = own.find((h) => h.canonical && h.surface === surface) ??
                 own.find((h) => h.canonical) ??
                 own[0];
@@ -9965,7 +10078,7 @@ export function createControlPlaneApi(options) {
         // bare apex and stranded clean-room previews on a hostname that never resolves.
         const baseDomain = [...platformBaseDomains].sort((a, b) => a.length - b.length)[0];
         const jurisdiction = 'global';
-        const tenant = await host.admin.getTenant(actor, tenantId);
+        const tenant = await admin.getTenant(actor, tenantId);
         const handle = tenant?.slug ?? tenantId;
         return `${slug.split('/').at(-1)}-${handle}.${jurisdiction}.${baseDomain}`;
     };
@@ -10203,7 +10316,7 @@ export function createControlPlaneApi(options) {
             : [];
         // The `--<tag>` URL's base — the source's canonical hostname (fork) or the tenant-app
         // convention (clean-room). Computed once so reuse and fresh mint the same URL.
-        const baseHostname = await previewBaseHostname(actor, source, tenantId, slug, surface);
+        const baseHostname = await previewBaseHostname(c.var.admin, actor, source, tenantId, slug, surface);
         // The founding #559 case lands its durable row HERE, not in onError: the previews
         // route answers a ControlPlaneError directly (its own catch, never the app-level
         // recorder), and only this frame knows the preview's scopeId (`intoId`) — the key that lets
@@ -10769,7 +10882,7 @@ export function createControlPlaneApi(options) {
     const previewVertical = async (c) => {
         const p = c.get('principal');
         const slug = await resolveVerticalId(c, c.req.param('slug'));
-        const v = await verticalOf(c.get('actor'), slug);
+        const v = await verticalOf(c.var.admin, c.get('actor'), slug);
         if (!v)
             return { refused: 'not_found', error: `unknown vertical '${slug}'` };
         if (confinedTenant(p) !== null && v.ownerTenant !== confinedTenant(p)) {
@@ -11530,6 +11643,32 @@ export function createControlPlaneApi(options) {
         const verticals = [...new Set([...declared.verticals.map((v) => v.vertical), ...declared.unreadable])].sort();
         return { fingerprint, ...storeRebuildStatus(walk, fingerprint, verticals, options.storeReleases?.settleMs), walk: walk ?? null };
     };
+    // The scope-store registry a push is judged by, for ONE vertical (#2813): `?vertical=` is the slug the
+    // push deploys as, required (bare, or already prefixed with the caller's own workspace). Every registration comes back, with `verticals` reduced to
+    // `[vertical]` when it serves that vertical and `[]` when it does not (omitted when it serves
+    // every one), so the CLI's own check can say "does not serve" and no other vertical's slug is
+    // read. "Serves" is judged for the registry id the deploy forms (`<tenant>/<name>` for a builder
+    // or a pinned staff push), the same one `ensureScopeStoresOf` judges. The staff-only
+    // `/store-drivers/:driver` below is the driver's release state and stays as it was.
+    app.get('/store-drivers', async (c) => {
+        const parsed = verticalSlug.safeParse(c.req.query('vertical'));
+        if (!parsed.success)
+            return refuse(c, 'validation_failed', 'vertical is required: the slug the push deploys as');
+        const vertical = parsed.data;
+        const p = c.get('principal');
+        const pin = c.req.header(TENANT_HEADER)?.trim();
+        let id = effectiveSlug(p, vertical);
+        if (p.kind !== 'builder' && pin) {
+            // The pinned-staff branch of the deploy's own slug derivation (`POST /verticals/:slug/deploy`).
+            const workspace = (await c.var.admin.listTenants(c.get('actor'))).find((t) => t.slug === pin || t.id === pin);
+            if (!workspace)
+                return refuse(c, 'not_found', `unknown workspace '${pin}'`);
+            const bareOwner = await ownerOf(c.var.admin, c.get('actor'), vertical);
+            id = vertical.startsWith(`${workspace.slug}/`) || bareOwner === workspace.id ? vertical : `${workspace.slug}/${vertical}`;
+        }
+        const drivers = (options.storeDrivers ?? STORE_DRIVERS).map((d) => d.verticals ? { ...d, verticals: storeDriverServesVertical(d, id) ? [vertical] : [] } : d);
+        return c.json({ drivers });
+    });
     app.get('/store-drivers/:driver', async (c) => {
         await staffPerson(c, statusWords);
         const registration = registeredDriver(c.req.param('driver'));