@@ -66,6 +66,10 @@ deleted). For callers:
 - any other outcome, including a lost connection: retry the same request; a
   `400 Namespace already exists` on the retry means the earlier attempt did complete.
 
+In single-namespace mode (`--disable-namespaces`) creating the default namespace is a
+configuration upsert and always succeeds, except with a `dump_url`: a dump can only be imported
+into a namespace that does not exist yet, so that request is rejected like any other.
+
 See `docs/ATOMIC_NAMESPACE_CREATE_DESIGN.md`.
 
 ```HTTP
 
@@ -201,7 +201,7 @@ Ok(ns)
 - `pub(crate) const INCOMPLETE_MARKER: &str = ".incomplete";` in `namespace/mod.rs`.
 - Created by `FreshDir::begin` for every brand-new directory.
 - Removed by `Namespace::mark_complete(&self)` (`remove_file(self.path.join(MARKER))`, `NotFound` ok), called (a) by `create` after `flush`, (b) by `load_namespace`'s init after `make_namespace` — a namespace opened from the metastore is complete by definition, so lazily loaded namespaces (and single-namespace-mode auto-creation) never keep a marker.
-- Consulted in exactly one place: `ConfigureNamespace::discard_incomplete(name)` (new trait method, default no-op; primary and schema share `helpers::discard_incomplete(base, name)` = `if dbs/<name>/.incomplete exists → remove_dir_all`). `create` calls it after `acquire`, i.e. only for a name with **no row and no loaded namespace** — the only situation in which a marked directory is unambiguously garbage. Lazy loads never see it, so a stale marker on a published namespace (crash between `flush` and `mark_complete`) is removed, never acted upon.
+- Acted upon only for a name the metastore does **not** know: by `ConfigureNamespace::discard_incomplete(name)` (new trait method, default no-op; primary and schema delegate to `incomplete::discard_if_incomplete`), which `create` calls after `acquire` — i.e. with no row and nothing loaded — and by the startup `sweep` under the same condition. That is the only situation in which a marked directory is unambiguously garbage. Lazy loads never act on it, so a stale marker on a published namespace (crash between `flush` and unmark) is removed, never acted upon. The metastore's filesystem recovery (`maybe_recover_from_fs`, empty metastore only) skips marked directories rather than adopting them.
 - `MetaStoreInner::maybe_recover_from_fs` (metastore empty ⇒ adopt `dbs/*`) skips directories carrying the marker, so a crash during the very first creation on a fresh server does not get adopted as a namespace at the next start.
 
 A directory **without** a marker and without a row keeps today's semantics (`Dump` ⇒ `LoadDumpExistingDb`; `Latest` ⇒ adopted). Such directories can only come from pre-marker servers or manual intervention; being destructive there is not worth it.
@@ -224,7 +224,7 @@ Replace the `Bomb` + manual `to_lock` with `Reservation::acquire(to)`; order bec
 ## 5. Flow for a dump import (streaming or buffered)
 
 1. Admin handler resolves `dump_url` (errors here touch nothing).
-2. `create` → `Reservation::acquire` (409-class error if the name is loaded or has a row).
+2. `create` → `Reservation::acquire` (`NamespaceAlreadyExist`, HTTP 400, if the name is loaded or has a row).
 3. In-memory config; `discard_incomplete` (removes a crashed previous attempt, if any).
 4. `setup`: `FreshDir::begin` (mkdir + marker) → logger, WAL, connection maker → `load_dump` → `keep()`.
 5. `flush` — the namespace now exists durably.
@@ -243,7 +243,7 @@ Replace the `Bomb` + manual `to_lock` with `Reservation::acquire(to)`; order bec
 | between `publish` and marker removal | — (published; a stale marker is harmless) | same | row + marker + complete data ⇒ serves; marker removed on first lazy load |
 | after `publish` | — | response may be lost ⇒ client retries ⇒ `NamespaceAlreadyExist` ⇒ by the contract, complete | same |
 
-Client rule: **2xx ⇒ complete; anything else ⇒ retry; `NamespaceAlreadyExist` on retry ⇒ complete.** No inspection of tables needed.
+Client rule: **2xx ⇒ complete; anything else ⇒ retry; `NamespaceAlreadyExist` on retry ⇒ complete.** No inspection of tables needed. (For namespaces *created* through this path. The single-namespace-mode config upsert of the default namespace, and ghost rows left by older binaries, are outside it.)
 
 ## 7. Concurrency
 
@@ -289,7 +289,11 @@ Reviewers (correctness, architecture, testing, operations) plus a manual pass fo
 | MED | Cancel tests could fire before the creation started (turmoil latency) and so pass vacuously; the restart test never reached the `\|\| exists` guard. | Cancel once `dbs/foo/.incomplete` exists; create before any lookup after restart; "usable afterwards" assertion restored. |
 | LOW | Marked orphans were only reclaimed by a `create` of the same name; `maybe_recover_from_fs` skip untested; success not logged. | Startup `sweep`; `recovery_from_fs_skips_marked_directories`, `sweep_cleans_leftovers_of_a_crash`; `info!("namespace created")` with elapsed, `warn!` with the error on failure, distinct message on cancellation. |
 
-Not changed: bottomless objects uploaded under a never-published db_id are inert junk (as today); `fsync` of the marker (power loss between creating and syncing it could leave an unmarked orphan — accepted); the moka `get_with(default)` leftover in `checkpoint` is healed lazily rather than fixed at the source.
+LOW items closed in the follow-up commit: `publish` keeps the guard inside the reservation across `install`'s awaits, so a cancellation there undoes the creation instead of leaking the pin; `remove_incomplete_marker` stats before taking the blocking-pool hop (every cold load passes through it); a failure to remove the marker after publish is logged at `error`; `FreshDir`'s log is `info` (every failed create, including client errors, passes through it); `acquire` logs when it has to wait; store-level `aborted_creation_is_undone` test (`JoinHandle::abort` mid-import); the restart test drops the first server before starting the second; the unmarked-directory test asserts the outcome.
+
+Not changed: bottomless objects uploaded under a never-published db_id are inert junk (as today); `fsync` of the marker (power loss between creating and syncing it could leave an unmarked orphan — accepted); the moka `get_with(default)` leftover in `checkpoint` is healed lazily rather than fixed at the source; after an *abort* the (empty) cache entry stays until a lookup heals it or the cache evicts it — it counts toward capacity but is never served; a metastore rebuilt from the filesystem (`destroy_on_error` + `allow_recover_from_fs`) in the milliseconds between a namespace's flush and its unmark would skip that namespace.
+
+**Upgrade / downgrade.** Ghost rows and unmarked orphan directories left by failed creates on *older* binaries are untouched (everything here is marker-gated); for them the old remedy stays: `DELETE /v1/namespaces/:ns`, then create again. Downgrading the binary is safe: the metastore schema and the config protobuf are unchanged; an old binary ignores `.incomplete` and `.discarded/` (it may adopt a marked orphan via `maybe_recover_from_fs` on an empty metastore, as it always could with any leftover directory).
 
 ## 10. Interaction with the streaming importer
 
 
@@ -67,7 +67,7 @@ impl Drop for FreshDir {
         let Some(path) = self.path.take() else {
             return;
         };
-        tracing::warn!(
+        tracing::info!(
             path = %path.display(),
             "namespace creation did not complete; discarding its directory"
         );
 
@@ -57,15 +57,21 @@ pub enum NamespaceBottomlessDbIdInit {
     FetchFromConfig,
 }
 
-/// A namespace isolates the resources pertaining to a database of type T
 /// Remove the incomplete marker of the namespace directory `path`, if present.
 pub(crate) async fn remove_incomplete_marker(path: &Path) -> std::io::Result<()> {
-    match tokio::fs::remove_file(path.join(incomplete::INCOMPLETE_MARKER)).await {
+    let marker = path.join(incomplete::INCOMPLETE_MARKER);
+    // Almost always absent (every cold load passes through here): a stat is cheaper than a
+    // trip to the blocking pool.
+    if !marker.exists() {
+        return Ok(());
+    }
+    match tokio::fs::remove_file(marker).await {
         Err(e) if e.kind() != std::io::ErrorKind::NotFound => Err(e),
         _ => Ok(()),
     }
 }
 
+/// A namespace isolates the resources pertaining to a database of type T
 #[derive(Debug)]
 pub struct Namespace {
     pub db: Database,
 
@@ -93,6 +93,9 @@ impl Reservation {
                     .await
             }
         };
+        if entry.try_write().is_none() {
+            tracing::debug!(namespace = %name, "waiting for an operation in progress on the namespace");
+        }
         let guard = entry.write_arc().await;
         if guard.is_some() || store.inner.metadata.exists(&name).await {
             if guard.is_none() {
@@ -120,13 +123,17 @@ impl Reservation {
 
     /// Install the finished namespace and release the lock.
     async fn publish(mut self, ns: Namespace) {
-        let mut guard = self
-            .guard
-            .take()
-            .expect("a reservation is published at most once");
-        self.store
-            .install(&self.name, &self.entry, &mut guard, ns)
-            .await;
+        // `install` awaits (cache lookups). Keep the guard inside `self` across them: if this
+        // future is dropped there, `Drop` still sees an unpublished reservation and undoes the
+        // creation — rather than leaving the name pinned and the lock released.
+        {
+            let guard = self
+                .guard
+                .as_deref_mut()
+                .expect("a reservation is published at most once");
+            self.store.install(&self.name, &self.entry, guard, ns).await;
+        }
+        let guard = self.guard.take().expect("checked above");
         // Unpin before unlocking: a lookup racing with us either still finds the pinned entry
         // (and waits for the lock, then sees the namespace) or goes through the cache, where
         // the namespace now is.
@@ -513,7 +520,9 @@ impl NamespaceStore {
         let marker_dir = ns.path.clone();
         reservation.publish(ns).await;
         if let Err(e) = super::remove_incomplete_marker(&marker_dir).await {
-            tracing::warn!(namespace = %name, "could not remove creation marker: {e}");
+            // The namespace is published and serves; the marker is removed at its next load. It
+            // matters only if the metastore is lost and rebuilt from the filesystem meanwhile.
+            tracing::error!(namespace = %name, "could not remove creation marker: {e}");
         }
     }
 
@@ -1260,4 +1269,68 @@ mod test {
             .unwrap();
         assert!(!store.exists(&linked).await);
     }
+
+    /// The creating task is aborted mid-import (the request was cancelled). The reservation is
+    /// dropped unpublished: config discarded, directory discarded, name released — and a
+    /// lookup that was waiting sees "doesn't exist".
+    #[tokio::test]
+    async fn aborted_creation_is_undone() {
+        let tmp = tempfile::tempdir().unwrap();
+        let store = make_store(tmp.path()).await;
+        let foo = NamespaceName::from_string("foo".into()).unwrap();
+        let dir = tmp.path().join("dbs").join("foo");
+
+        let (tx, dump) = slow_dump();
+        let create = tokio::spawn({
+            let (store, foo) = (store.clone(), foo.clone());
+            async move {
+                store
+                    .create(foo, RestoreOption::Dump(dump), Default::default())
+                    .await
+            }
+        });
+        tx.send(Ok(Bytes::from_static(
+            b"BEGIN TRANSACTION; CREATE TABLE test (x); INSERT INTO test VALUES (1);",
+        )))
+        .await
+        .unwrap();
+        wait_until_in_flight(&store, &foo).await;
+        assert!(dir
+            .join(crate::namespace::incomplete::INCOMPLETE_MARKER)
+            .exists());
+
+        let lookup = tokio::spawn({
+            let store = store.clone();
+            async move { count_test_rows(&store, "foo").await }
+        });
+        tokio::time::sleep(Duration::from_millis(100)).await;
+        assert!(!lookup.is_finished());
+
+        create.abort();
+        assert!(create.await.unwrap_err().is_cancelled());
+
+        assert!(matches!(
+            lookup.await.unwrap(),
+            Err(Error::NamespaceDoesntExist(_))
+        ));
+        // the cleanup ran on the blocking pool; the lookup's completion proves the lock was
+        // released after it, so by now everything is undone
+        assert!(!store.exists(&foo).await);
+        assert!(!dir.exists());
+        assert!(store.inner.in_flight.lock().is_empty());
+
+        // the importer's executor thread is still unwinding its channel; the name is free anyway
+        let (tx, dump) = slow_dump();
+        tx.send(Ok(Bytes::from_static(
+            b"BEGIN TRANSACTION; CREATE TABLE test (x); INSERT INTO test VALUES (1); COMMIT;",
+        )))
+        .await
+        .unwrap();
+        drop(tx);
+        store
+            .create(foo.clone(), RestoreOption::Dump(dump), Default::default())
+            .await
+            .unwrap();
+        assert_eq!(count_test_rows(&store, "foo").await.unwrap(), 1);
+    }
 }
@@ -263,14 +263,19 @@ fn unmarked_directory_is_left_alone() {
 
     sim.client("client", async move {
         let client = Client::new();
-        let _ = create_from_dump(
+        // No database in there, so the import proceeds into the existing directory ...
+        let resp = create_from_dump(
             &client,
             "foo",
             &file_url(&tmp_path.join("good.sql")),
             STREAMING,
         )
         .await?;
+        assert_eq!(resp.status(), StatusCode::OK);
+        assert_eq!(count_rows("foo", "test").await?, 1);
+        // ... and whatever was in it is left alone, before and after.
         assert_eq!(std::fs::read(dir.join("keep.txt"))?, b"precious");
+        assert!(!dir.join(INCOMPLETE_MARKER).exists());
         Ok(())
     });
 
@@ -321,6 +326,7 @@ fn marker_on_published_namespace_is_ignored() {
         }
     });
     first.run().unwrap();
+    drop(first); // the first server must be gone before the second opens the same files
 
     // restart: nothing is loaded yet, the marker is still there and the metastore knows the
     // name. A `create` must be rejected on the strength of the metastore alone (not wipe the