@jeffusion/bungee-core 5.23.2 → 5.23.3

package/dist/config-storage-worker.js

@@ -1,61 +1,54 @@
 // @bun
-// src/config-storage/config-repository.ts
-import { Database as Database3 } from "bun:sqlite";
-import { mkdirSync } from "fs";
-import { dirname } from "path";
+// src/supervision/process-lifetime-guard.ts
+import { dirname, join, resolve } from "path";
 
-// src/config-storage/repository-types.ts
-class ConfigRepositoryError extends Error {
-  code;
-  cause;
-  recovery;
-  name = "ConfigRepositoryError";
-  constructor(code, message, cause, recovery) {
-    super(message, { cause });
-    this.code = code;
-    this.cause = cause;
-    this.recovery = recovery;
+// ../../node_modules/canonicalize/lib/canonicalize.js
+function canonicalize(object, seen = new Set) {
+  if (typeof object === "number" && isNaN(object)) {
+    throw new Error("NaN is not allowed");
   }
-}
-
-// src/config-storage/sqlite-query.ts
-function sqliteAll(db, sql, ...params) {
-  const statement = db.prepare(sql);
-  try {
-    return statement.all(...params);
-  } finally {
-    statement.finalize();
+  if (typeof object === "number" && !isFinite(object)) {
+    throw new Error("Infinity is not allowed");
   }
-}
-function sqliteGet(db, sql, ...params) {
-  const statement = db.prepare(sql);
-  try {
-    return statement.get(...params);
-  } finally {
-    statement.finalize();
+  if (object === null || typeof object !== "object") {
+    return JSON.stringify(object);
   }
+  if (typeof object.toJSON === "function") {
+    if (seen.has(object)) {
+      throw new Error("Circular reference detected");
+    }
+    seen.add(object);
+    const result = canonicalize(object.toJSON(), seen);
+    seen.delete(object);
+    return result;
+  }
+  if (seen.has(object)) {
+    throw new Error("Circular reference detected");
+  }
+  seen.add(object);
+  let result;
+  if (Array.isArray(object)) {
+    const values = object.map((cv) => {
+      const value = cv === undefined || typeof cv === "symbol" ? null : cv;
+      return canonicalize(value, seen);
+    });
+    result = `[${values.join(",")}]`;
+  } else {
+    const parts = [];
+    for (const key of Object.keys(object).sort()) {
+      if (object[key] === undefined || typeof object[key] === "symbol") {
+        continue;
+      }
+      parts.push(`${canonicalize(key)}:${canonicalize(object[key], seen)}`);
+    }
+    result = `{${parts.join(",")}}`;
+  }
+  seen.delete(object);
+  return result;
 }
 
-// src/config-storage/global-scalars.ts
-var LOG_LEVELS = new Set(["trace", "debug", "info", "warn", "error", "fatal"]);
-var BODY_PARSER_LIMIT = /^([1-9][0-9]*)(b|kb|mb|gb)$/;
-var BODY_SIZE_UNITS = { b: 1, kb: 1024, mb: 1024 ** 2, gb: 1024 ** 3 };
-function isLogLevel(value) {
-  return LOG_LEVELS.has(value);
-}
-function isBodyParserLimit(value) {
-  const match = BODY_PARSER_LIMIT.exec(value);
-  if (match === null)
-    return false;
-  const numeric = match[1];
-  return numeric !== undefined && Number.isSafeInteger(Number(numeric));
-}
-
-// src/config-storage/plugin-name.ts
-var PLUGIN_NAME_PATTERN = /^[a-z][a-z0-9]*(?:-[a-z0-9]+)*$/;
-function isPluginName(value) {
-  return PLUGIN_NAME_PATTERN.test(value);
-}
+// src/config-storage/json-preflight.ts
+import { isProxy } from "util/types";
 
 // src/config-storage/validation.ts
 var LOWERCASE_UUID = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/;
@@ -181,48 +174,252 @@ function rejectUnknownFields(object, allowed, path, context) {
   }
 }
 
-// src/config-storage/persisted-validation.ts
-function corrupt(field) {
-  throw new ConfigRepositoryError("schema_corrupt", `${field} contains an invalid persisted value`);
+// src/config-storage/utf16.ts
+function hasLoneSurrogate(value) {
+  for (let index = 0;index < value.length; index += 1) {
+    const code = value.charCodeAt(index);
+    if (code >= 55296 && code <= 56319) {
+      if (index + 1 >= value.length)
+        return true;
+      const next = value.charCodeAt(index + 1);
+      if (next < 56320 || next > 57343)
+        return true;
+      index += 1;
+    } else if (code >= 56320 && code <= 57343) {
+      return true;
+    }
+  }
+  return false;
 }
-function requireSafeInteger(value, field, minimum = 0) {
-  if (!Number.isSafeInteger(value) || value < minimum)
-    return corrupt(field);
+
+// src/config-storage/json-preflight.ts
+var FORBIDDEN_KEYS = new Set(["__proto__", "prototype", "constructor"]);
+function childPath(parent, key) {
+  return parent ? `${parent}.${key}` : key;
+}
+function symbolPath(parent, key) {
+  const segment = `[Symbol(${key.description ?? ""})]`;
+  return `${parent}${segment}`;
+}
+function addInvalid(context, path) {
+  context.add("non_json_value", path, "Expected a JSON-compatible value");
+}
+function isCanonicalArrayIndex(key) {
+  if (!/^(?:0|[1-9]\d*)$/.test(key))
+    return false;
+  const index = Number(key);
+  return Number.isInteger(index) && index >= 0 && index <= 4294967294 && String(index) === key;
+}
+function inspectObject(pending, stack, seen, context) {
+  const source = pending.value;
+  let array;
+  let prototype;
+  let properties;
+  let arrayLength = 0;
+  try {
+    if (isProxy(source))
+      throw new TypeError("Proxy objects are not JSON values");
+    if (seen.has(source)) {
+      addInvalid(context, pending.path);
+      return;
+    }
+    seen.add(source);
+    array = Array.isArray(source);
+    prototype = Object.getPrototypeOf(source);
+    properties = Reflect.ownKeys(source).map((key) => {
+      const descriptor = Object.getOwnPropertyDescriptor(source, key);
+      if (!descriptor)
+        throw new TypeError("Missing own property descriptor");
+      return { key, descriptor };
+    });
+    if (array) {
+      const descriptor = Object.getOwnPropertyDescriptor(source, "length");
+      if (!descriptor || typeof descriptor.value !== "number") {
+        throw new TypeError("Invalid array length descriptor");
+      }
+      arrayLength = descriptor.value;
+    }
+    if (Object.getPrototypeOf(source) !== prototype) {
+      throw new TypeError("Prototype changed during reflection");
+    }
+  } catch {
+    addInvalid(context, pending.path);
+    return;
+  }
+  if (!array && prototype !== Object.prototype && prototype !== null || array && prototype !== Array.prototype) {
+    addInvalid(context, pending.path);
+    return;
+  }
+  const target = array ? [] : {};
+  pending.assign(target);
+  const children = [];
+  const indexes = [];
+  for (const { key, descriptor } of properties) {
+    if (array && key === "length")
+      continue;
+    if (typeof key === "symbol") {
+      addInvalid(context, symbolPath(pending.path, key));
+      continue;
+    }
+    const propertyName = String(key);
+    const arrayIndex = array && isCanonicalArrayIndex(propertyName);
+    const path = arrayIndex ? `${pending.path}[${propertyName}]` : childPath(pending.path, propertyName);
+    if (arrayIndex)
+      indexes.push(Number(propertyName));
+    if (array && !arrayIndex) {
+      addInvalid(context, path);
+      continue;
+    }
+    if (hasLoneSurrogate(propertyName))
+      addInvalid(context, path);
+    if (!descriptor.enumerable || !("value" in descriptor)) {
+      addInvalid(context, path);
+      continue;
+    }
+    if (FORBIDDEN_KEYS.has(propertyName)) {
+      context.add("forbidden_key", path, "Key is forbidden in JSON configuration");
+      children.push({ value: descriptor.value, path, assign() {} });
+      continue;
+    }
+    children.push({
+      value: descriptor.value,
+      path,
+      assign(value) {
+        if (array)
+          target[Number(propertyName)] = value;
+        else
+          Object.defineProperty(target, propertyName, {
+            value,
+            enumerable: true,
+            writable: true,
+            configurable: true
+          });
+      }
+    });
+  }
+  if (array && indexes.length !== arrayLength) {
+    indexes.sort((left, right) => left - right);
+    let expected = 0;
+    for (const index of indexes) {
+      if (index !== expected)
+        break;
+      expected += 1;
+    }
+    addInvalid(context, `${pending.path}[${expected}]`);
+  }
+  for (let index = children.length - 1;index >= 0; index -= 1) {
+    const child = children[index];
+    if (child !== undefined)
+      stack.push(child);
+  }
+}
+
+class JsonSnapshotError extends Error {
+  errors;
+  name = "JsonSnapshotError";
+  constructor(errors) {
+    super("Value is not a side-effect-free JSON graph");
+    this.errors = errors;
+  }
+}
+function snapshotJsonGraph(input) {
+  const context = new ValidationContext;
+  const value = preflightJsonGraph(input, context);
+  if (value === undefined || context.errors.length > 0) {
+    throw new JsonSnapshotError(context.errors);
+  }
   return value;
 }
-function requireBooleanInteger(value, field) {
-  if (value !== 0 && value !== 1)
-    return corrupt(field);
-  return value === 1;
+function preflightJsonGraph(input, context) {
+  let output;
+  const stack = [{ value: input, path: "", assign(value) {
+    output = value;
+  } }];
+  const seen = new WeakSet;
+  while (stack.length) {
+    const pending = stack.pop();
+    if (pending === undefined)
+      break;
+    const value = pending.value;
+    if (value === null || typeof value === "boolean")
+      pending.assign(value);
+    else if (typeof value === "string") {
+      if (hasLoneSurrogate(value))
+        addInvalid(context, pending.path);
+      else
+        pending.assign(value);
+    } else if (typeof value === "number") {
+      if (Number.isFinite(value))
+        pending.assign(value);
+      else
+        addInvalid(context, pending.path);
+    } else if (typeof value === "object")
+      inspectObject(pending, stack, seen, context);
+    else
+      addInvalid(context, pending.path);
+  }
+  return context.errors.length ? undefined : output;
 }
-function requirePositiveFinite(value, field) {
-  if (!Number.isFinite(value) || value <= 0)
-    return corrupt(field);
-  return value;
+
+// src/config-storage/content-hash.ts
+class ConfigurationHashError extends Error {
+  cause;
+  name = "ConfigurationHashError";
+  constructor(cause) {
+    super("RFC 8785 canonicalization failed", { cause });
+    this.cause = cause;
+  }
 }
-function requireUuid(value, field) {
-  if (!isLowercaseUuid(value))
-    return corrupt(field);
-  return value;
+function canonicalJson(value) {
+  try {
+    const result = canonicalize(snapshotJsonGraph(value));
+    if (result === undefined)
+      throw new TypeError("canonicalize returned undefined");
+    return result;
+  } catch (error) {
+    throw new ConfigurationHashError(error);
+  }
 }
-function requirePluginName(value, field) {
-  if (!isPluginName(value))
-    return corrupt(field);
-  return value;
+function hashConfigurationContent(value) {
+  const bytes = new TextEncoder().encode(canonicalJson(value));
+  const hex = new Bun.CryptoHasher("sha256").update(bytes).digest("hex");
+  return `sha256:${hex}`;
 }
-function requireOptionalGlobalScalar(value, field) {
-  if (value === null)
-    return;
-  const valid = field === "log_level" ? isLogLevel(value) : isBodyParserLimit(value);
-  if (!valid)
-    return corrupt(field);
-  return value;
+function hashConfigurationRequest(identity) {
+  return hashConfigurationContent({
+    kind: identity.kind,
+    expected_revision: identity.expected_revision,
+    aggregate: identity.aggregate,
+    target_worker_slots: [...identity.target_worker_slots].sort((left, right) => left - right)
+  });
 }
-function requireOneOf(value, allowed, field) {
-  const match = allowed.find((candidate) => candidate === value);
-  if (match === undefined)
-    return corrupt(field);
-  return match;
+
+// src/supervision/process-lifetime-guard.ts
+var PROCESS_LIFETIME_GUARD_DOMAIN = "bungee-local-flock";
+function parseProcessLifetimeGuardFacts(value) {
+  if (typeof value !== "object" || value === null || Array.isArray(value))
+    throw new Error("process lifetime guard facts are malformed");
+  const facts = value;
+  const keys = ["schema", "identity", "process_instance_id", "path", "device", "inode", "host_boot_id", "domain"];
+  if (Object.keys(facts).length !== keys.length || keys.some((key) => !Object.hasOwn(facts, key)) || facts.schema !== "bungee-process-lifetime-guard-v1" || facts.domain !== PROCESS_LIFETIME_GUARD_DOMAIN || typeof facts.identity !== "string" || !isLowercaseUuid(facts.identity) || typeof facts.process_instance_id !== "string" || !isLowercaseUuid(facts.process_instance_id) || typeof facts.path !== "string" || facts.path !== resolve(facts.path) || typeof facts.device !== "string" || !/^\d+$/.test(facts.device) || typeof facts.inode !== "string" || !/^[1-9]\d*$/.test(facts.inode) || typeof facts.host_boot_id !== "string" || !/^(linux:[0-9a-f-]{36}|darwin:\d+:\d+)$/.test(facts.host_boot_id)) {
+    throw new Error("process lifetime guard facts are malformed");
+  }
+  return Object.freeze({ ...facts });
+}
+var inheritedDescriptors = new Map;
+
+// src/config-storage/repository-types.ts
+class ConfigRepositoryError extends Error {
+  code;
+  cause;
+  recovery;
+  name = "ConfigRepositoryError";
+  constructor(code, message, cause, recovery) {
+    super(message, { cause });
+    this.code = code;
+    this.cause = cause;
+    this.recovery = recovery;
+  }
 }
 
 // ../types/src/daemon-control.ts
@@ -6542,6 +6739,21 @@ function validateRouteDomain(object, path, hasService, endpointCount, context) {
   }
 }
 
+// src/config-storage/global-scalars.ts
+var LOG_LEVELS = new Set(["trace", "debug", "info", "warn", "error", "fatal"]);
+var BODY_PARSER_LIMIT = /^([1-9][0-9]*)(b|kb|mb|gb)$/;
+var BODY_SIZE_UNITS = { b: 1, kb: 1024, mb: 1024 ** 2, gb: 1024 ** 3 };
+function isLogLevel(value) {
+  return LOG_LEVELS.has(value);
+}
+function isBodyParserLimit(value) {
+  const match = BODY_PARSER_LIMIT.exec(value);
+  if (match === null)
+    return false;
+  const numeric = match[1];
+  return numeric !== undefined && Number.isSafeInteger(Number(numeric));
+}
+
 // src/config-storage/global-validation.ts
 function validateGlobalPolicies(object, context) {
   if (object.log_level !== undefined && (typeof object.log_level !== "string" || !isLogLevel(object.log_level))) {
@@ -6555,208 +6767,24 @@ function validateGlobalPolicies(object, context) {
     for (const error of validatePublicationPolicy(object.publication)) {
       const path = error.field === "publication" ? "publication" : `publication.${error.field}`;
       const code = error.message === "Required field is missing" ? "required" : error.message.startsWith("Expected") || error.field === "publication" ? "invalid_type" : "invalid_value";
-      context.add(code, path, error.message);
-    }
-  }
-  const logging = objectField(object.logging, "logging", ["body"], context);
-  if (!logging || logging.body === undefined)
-    return;
-  const body = objectField(logging.body, "logging.body", ["enabled", "max_size", "retention_days"], context);
-  if (!body)
-    return;
-  booleanField(body, "enabled", "logging.body", context);
-  numberField(body, "max_size", "logging.body", context, { required: true, positive: true });
-  numberField(body, "retention_days", "logging.body", context, { required: true, positive: true });
-}
-
-// src/config-storage/json-preflight.ts
-import { isProxy } from "util/types";
-
-// src/config-storage/utf16.ts
-function hasLoneSurrogate(value) {
-  for (let index = 0;index < value.length; index += 1) {
-    const code = value.charCodeAt(index);
-    if (code >= 55296 && code <= 56319) {
-      if (index + 1 >= value.length)
-        return true;
-      const next = value.charCodeAt(index + 1);
-      if (next < 56320 || next > 57343)
-        return true;
-      index += 1;
-    } else if (code >= 56320 && code <= 57343) {
-      return true;
-    }
-  }
-  return false;
-}
-
-// src/config-storage/json-preflight.ts
-var FORBIDDEN_KEYS = new Set(["__proto__", "prototype", "constructor"]);
-function childPath(parent, key) {
-  return parent ? `${parent}.${key}` : key;
-}
-function symbolPath(parent, key) {
-  const segment = `[Symbol(${key.description ?? ""})]`;
-  return `${parent}${segment}`;
-}
-function addInvalid(context, path) {
-  context.add("non_json_value", path, "Expected a JSON-compatible value");
-}
-function isCanonicalArrayIndex(key) {
-  if (!/^(?:0|[1-9]\d*)$/.test(key))
-    return false;
-  const index = Number(key);
-  return Number.isInteger(index) && index >= 0 && index <= 4294967294 && String(index) === key;
-}
-function inspectObject(pending, stack, seen, context) {
-  const source = pending.value;
-  let array;
-  let prototype;
-  let properties;
-  let arrayLength = 0;
-  try {
-    if (isProxy(source))
-      throw new TypeError("Proxy objects are not JSON values");
-    if (seen.has(source)) {
-      addInvalid(context, pending.path);
-      return;
-    }
-    seen.add(source);
-    array = Array.isArray(source);
-    prototype = Object.getPrototypeOf(source);
-    properties = Reflect.ownKeys(source).map((key) => {
-      const descriptor = Object.getOwnPropertyDescriptor(source, key);
-      if (!descriptor)
-        throw new TypeError("Missing own property descriptor");
-      return { key, descriptor };
-    });
-    if (array) {
-      const descriptor = Object.getOwnPropertyDescriptor(source, "length");
-      if (!descriptor || typeof descriptor.value !== "number") {
-        throw new TypeError("Invalid array length descriptor");
-      }
-      arrayLength = descriptor.value;
-    }
-    if (Object.getPrototypeOf(source) !== prototype) {
-      throw new TypeError("Prototype changed during reflection");
-    }
-  } catch {
-    addInvalid(context, pending.path);
-    return;
-  }
-  if (!array && prototype !== Object.prototype && prototype !== null || array && prototype !== Array.prototype) {
-    addInvalid(context, pending.path);
-    return;
-  }
-  const target = array ? [] : {};
-  pending.assign(target);
-  const children = [];
-  const indexes = [];
-  for (const { key, descriptor } of properties) {
-    if (array && key === "length")
-      continue;
-    if (typeof key === "symbol") {
-      addInvalid(context, symbolPath(pending.path, key));
-      continue;
-    }
-    const propertyName = String(key);
-    const arrayIndex = array && isCanonicalArrayIndex(propertyName);
-    const path = arrayIndex ? `${pending.path}[${propertyName}]` : childPath(pending.path, propertyName);
-    if (arrayIndex)
-      indexes.push(Number(propertyName));
-    if (array && !arrayIndex) {
-      addInvalid(context, path);
-      continue;
-    }
-    if (hasLoneSurrogate(propertyName))
-      addInvalid(context, path);
-    if (!descriptor.enumerable || !("value" in descriptor)) {
-      addInvalid(context, path);
-      continue;
-    }
-    if (FORBIDDEN_KEYS.has(propertyName)) {
-      context.add("forbidden_key", path, "Key is forbidden in JSON configuration");
-      children.push({ value: descriptor.value, path, assign() {} });
-      continue;
-    }
-    children.push({
-      value: descriptor.value,
-      path,
-      assign(value) {
-        if (array)
-          target[Number(propertyName)] = value;
-        else
-          Object.defineProperty(target, propertyName, {
-            value,
-            enumerable: true,
-            writable: true,
-            configurable: true
-          });
-      }
-    });
-  }
-  if (array && indexes.length !== arrayLength) {
-    indexes.sort((left, right) => left - right);
-    let expected = 0;
-    for (const index of indexes) {
-      if (index !== expected)
-        break;
-      expected += 1;
-    }
-    addInvalid(context, `${pending.path}[${expected}]`);
-  }
-  for (let index = children.length - 1;index >= 0; index -= 1) {
-    const child = children[index];
-    if (child !== undefined)
-      stack.push(child);
-  }
-}
-
-class JsonSnapshotError extends Error {
-  errors;
-  name = "JsonSnapshotError";
-  constructor(errors) {
-    super("Value is not a side-effect-free JSON graph");
-    this.errors = errors;
-  }
-}
-function snapshotJsonGraph(input) {
-  const context = new ValidationContext;
-  const value = preflightJsonGraph(input, context);
-  if (value === undefined || context.errors.length > 0) {
-    throw new JsonSnapshotError(context.errors);
+      context.add(code, path, error.message);
+    }
   }
-  return value;
+  const logging = objectField(object.logging, "logging", ["body"], context);
+  if (!logging || logging.body === undefined)
+    return;
+  const body = objectField(logging.body, "logging.body", ["enabled", "max_size", "retention_days"], context);
+  if (!body)
+    return;
+  booleanField(body, "enabled", "logging.body", context);
+  numberField(body, "max_size", "logging.body", context, { required: true, positive: true });
+  numberField(body, "retention_days", "logging.body", context, { required: true, positive: true });
 }
-function preflightJsonGraph(input, context) {
-  let output;
-  const stack = [{ value: input, path: "", assign(value) {
-    output = value;
-  } }];
-  const seen = new WeakSet;
-  while (stack.length) {
-    const pending = stack.pop();
-    if (pending === undefined)
-      break;
-    const value = pending.value;
-    if (value === null || typeof value === "boolean")
-      pending.assign(value);
-    else if (typeof value === "string") {
-      if (hasLoneSurrogate(value))
-        addInvalid(context, pending.path);
-      else
-        pending.assign(value);
-    } else if (typeof value === "number") {
-      if (Number.isFinite(value))
-        pending.assign(value);
-      else
-        addInvalid(context, pending.path);
-    } else if (typeof value === "object")
-      inspectObject(pending, stack, seen, context);
-    else
-      addInvalid(context, pending.path);
-  }
-  return context.errors.length ? undefined : output;
+
+// src/config-storage/plugin-name.ts
+var PLUGIN_NAME_PATTERN = /^[a-z][a-z0-9]*(?:-[a-z0-9]+)*$/;
+function isPluginName(value) {
+  return PLUGIN_NAME_PATTERN.test(value);
 }
 
 // src/plugin-manifest-catalog/manifest-json.ts
@@ -7543,6 +7571,417 @@ function validateCommitCommand(command, compileOptions) {
   return result.value;
 }
 
+// src/config-storage/sqlite-query.ts
+function sqliteAll(db, sql, ...params) {
+  const statement = db.prepare(sql);
+  try {
+    return statement.all(...params);
+  } finally {
+    statement.finalize();
+  }
+}
+function sqliteGet(db, sql, ...params) {
+  const statement = db.prepare(sql);
+  try {
+    return statement.get(...params);
+  } finally {
+    statement.finalize();
+  }
+}
+
+// src/config-storage/retirement-store.ts
+function readPublicationRetirementRetry(db, requestId) {
+  if (!isLowercaseUuid(requestId))
+    invalid("retirement retry identity is invalid");
+  const row = sqliteGet(db, "SELECT request_id,mutation_id,expected_revision FROM configuration_retirement_retry_requests WHERE request_id=?", requestId);
+  return row ? { request_id: row.request_id, source_mutation_id: row.mutation_id, target_revision: row.expected_revision, status: "accepted" } : null;
+}
+function requestPublicationRetirementRetry(db, requestId, mutationId, revision, now) {
+  if (!isLowercaseUuid(requestId) || !natural(revision, 1) || !natural(now))
+    invalid("retirement retry request is invalid");
+  const existing = readPublicationRetirementRetry(db, requestId);
+  if (existing) {
+    if (existing.source_mutation_id !== mutationId || existing.target_revision !== revision)
+      throw new ConfigRepositoryError("cas_conflict", "retirement retry identity was reused");
+    return existing;
+  }
+  const operation = sqliteGet(db, "SELECT state,committed_revision FROM configuration_operations WHERE mutation_id=?", mutationId);
+  const retirement = readPublicationRetirement(db, mutationId);
+  if (operation?.state !== "draining" || operation.committed_revision !== revision || retirement?.state !== "stopped")
+    invalid("only stopped active draining cleanup may retry");
+  db.run("INSERT INTO configuration_retirement_retry_requests(request_id,mutation_id,expected_revision,created_at) VALUES(?,?,?,?)", [requestId, mutationId, revision, now]);
+  retryPublicationRetirement(db, mutationId, now);
+  return readPublicationRetirementRetry(db, requestId);
+}
+function invalid(message) {
+  throw new ConfigRepositoryError("invalid_operation", message);
+}
+function natural(value, minimum = 0) {
+  return typeof value === "number" && Number.isSafeInteger(value) && value >= minimum;
+}
+function parseMembers(value) {
+  const input = snapshotJsonGraph(value);
+  if (!Array.isArray(input))
+    invalid("retirement members must be an array");
+  const seen = new Set;
+  const result = input.map((raw) => {
+    if (typeof raw !== "object" || raw === null || Array.isArray(raw))
+      invalid("retirement member is invalid");
+    const item = raw;
+    const identity = item.identity;
+    if (!identity || !isLowercaseUuid(identity.master_generation) || !isLowercaseUuid(identity.worker_instance_id) || !natural(identity.worker_slot) || !isLowercaseUuid(item.boot_nonce) || !natural(item.pid, 1) || !natural(item.private_port, 1) || item.private_port > 65535 || !natural(item.revision, 1) || !validateDigest(item.content_hash) || !validateDigest(item.plugin_catalog_hash) || !isLowercaseUuid(item.drain_id) || typeof item.deadline_boot_id !== "string" || !item.deadline_boot_id.length || item.start_deadline_ns !== null && (typeof item.start_deadline_ns !== "string" || !/^[1-9]\d{0,24}$/.test(item.start_deadline_ns)))
+      invalid("retirement member identity or deadline is invalid");
+    if (seen.has(identity.worker_instance_id))
+      invalid("retirement members contain duplicate identities");
+    seen.add(identity.worker_instance_id);
+    if (item.publication !== null && (!item.publication || typeof item.publication.mutation_id !== "string" || !natural(item.publication.attempt_no, 1) || !natural(item.publication.drain_recovery_generation)))
+      invalid("retirement publication attempt is invalid");
+    const guard = item.guard === null ? null : parseProcessLifetimeGuardFacts(item.guard);
+    if (guard !== null && guard.process_instance_id !== identity.worker_instance_id)
+      invalid("retirement guard belongs to another process");
+    return Object.freeze({ ...item, identity: Object.freeze({ ...identity }), guard });
+  });
+  return Object.freeze(result);
+}
+function readPublicationRetirement(db, mutationId) {
+  const row = sqliteGet(db, "SELECT generation,members_json,state,reason_code FROM configuration_retirements WHERE mutation_id=?", mutationId);
+  if (row === null)
+    return null;
+  const members = parseMembers(JSON.parse(row.members_json));
+  const evidence = sqliteAll(db, "SELECT member_id,exit_state,cleanup_state,exit_boot_id,exit_deadline_ns,start_boot_id,start_deadline_ns FROM configuration_retirement_evidence WHERE mutation_id=? ORDER BY member_id", mutationId);
+  if (evidence.length !== members.length || evidence.some((item) => !members.some((member) => member.identity.worker_instance_id === item.member_id))) {
+    throw new ConfigRepositoryError("schema_corrupt", "retirement evidence does not cover the frozen members");
+  }
+  return Object.freeze({
+    mutation_id: mutationId,
+    generation: row.generation,
+    members,
+    state: row.state,
+    reason_code: row.reason_code,
+    evidence: Object.freeze(evidence.map((item) => Object.freeze(item)))
+  });
+}
+function freezePublicationRetirement(db, mutationId, generation, value, now) {
+  if (!natural(generation) || !natural(now))
+    invalid("retirement generation or timestamp is invalid");
+  const members = parseMembers(value);
+  const prior = readPublicationRetirement(db, mutationId);
+  if (prior !== null) {
+    if (prior.generation !== generation || canonicalJson(prior.members) !== canonicalJson(members)) {
+      throw new ConfigRepositoryError("cas_conflict", "retirement membership is already frozen");
+    }
+    return prior;
+  }
+  const operation = sqliteGet(db, "SELECT state,drain_recovery_generation FROM configuration_operations WHERE mutation_id=?", mutationId);
+  if (operation === null || operation.state === "converged" || operation.state === "degraded" || operation.drain_recovery_generation !== generation)
+    invalid("retirement must match the active publication generation");
+  db.run("INSERT INTO configuration_retirements(mutation_id,generation,members_json,state,updated_at) VALUES(?,?,?,'pending',?)", [mutationId, generation, canonicalJson(members), now]);
+  for (const member of members)
+    db.run(`INSERT INTO configuration_retirement_evidence(mutation_id,member_id,exit_state,cleanup_state,updated_at)
+    VALUES(?,?,'unknown','unknown',?)`, [mutationId, member.identity.worker_instance_id, now]);
+  return readPublicationRetirement(db, mutationId);
+}
+function freezePublicationRetirementDrainStart(db, mutationId, memberId, bootId, deadlineNs, now) {
+  const before = readPublicationRetirement(db, mutationId);
+  const member = before?.members.find((item) => item.identity.worker_instance_id === memberId);
+  if (!before || !member || member.deadline_boot_id !== bootId || !natural(now) || !/^[1-9]\d{0,24}$/.test(deadlineNs))
+    invalid("retirement drain start is invalid");
+  const saved = before.evidence.find((item) => item.member_id === memberId);
+  if (saved.start_deadline_ns !== null)
+    return before;
+  const deadline = member.start_deadline_ns ?? deadlineNs;
+  db.run("UPDATE configuration_retirement_evidence SET start_boot_id=?,start_deadline_ns=?,updated_at=? WHERE mutation_id=? AND member_id=?", [bootId, deadline, now, mutationId, memberId]);
+  return readPublicationRetirement(db, mutationId);
+}
+function recordPublicationRetirementEvidence(db, mutationId, memberId, exit, cleanup, now, deadline) {
+  if (!["live", "confirmed", "unknown"].includes(exit) || !["success", "failed", "unknown"].includes(cleanup) || !natural(now))
+    invalid("retirement evidence is invalid");
+  const before = readPublicationRetirement(db, mutationId);
+  const evidence = before?.evidence.find((item) => item.member_id === memberId);
+  if (!before || !evidence)
+    invalid("retirement member is not part of the frozen authority");
+  if (deadline !== undefined && (deadline.boot_id !== before.members.find((member) => member.identity.worker_instance_id === memberId).deadline_boot_id || !/^[1-9]\d{0,24}$/.test(deadline.exit_deadline_ns)))
+    invalid("retirement terminal exit deadline is invalid");
+  if (evidence.exit_deadline_ns !== null && deadline !== undefined && (evidence.exit_boot_id !== deadline.boot_id || evidence.exit_deadline_ns !== deadline.exit_deadline_ns))
+    invalid("retirement terminal exit deadline is already frozen");
+  if (evidence.cleanup_state !== "unknown") {
+    if (cleanup !== "unknown" && cleanup !== evidence.cleanup_state)
+      invalid("terminal retirement cleanup cannot be changed");
+    cleanup = evidence.cleanup_state;
+  }
+  if (before.state === "released") {
+    if (evidence.exit_state === exit && evidence.cleanup_state === cleanup)
+      return before;
+    throw new ConfigRepositoryError("cas_conflict", "released retirement is immutable");
+  }
+  if (evidence.exit_state === "confirmed" && exit !== "confirmed")
+    invalid("confirmed retirement exit cannot be revoked");
+  db.run("UPDATE configuration_retirement_evidence SET exit_state=?,cleanup_state=?,exit_boot_id=?,exit_deadline_ns=?,updated_at=? WHERE mutation_id=? AND member_id=?", [exit, cleanup, evidence.exit_boot_id ?? deadline?.boot_id ?? null, evidence.exit_deadline_ns ?? deadline?.exit_deadline_ns ?? null, now, mutationId, memberId]);
+  return readPublicationRetirement(db, mutationId);
+}
+function stopPublicationRetirement(db, mutationId, reason, now) {
+  if (!["exit_unknown", "cleanup_unknown", "release_unknown"].includes(reason) || !natural(now))
+    invalid("retirement stop reason is invalid");
+  const before = readPublicationRetirement(db, mutationId);
+  if (!before)
+    invalid("retirement is not frozen");
+  if (before.state === "released")
+    return before;
+  db.run("UPDATE configuration_retirements SET state='stopped',reason_code=?,updated_at=? WHERE mutation_id=?", [reason, now, mutationId]);
+  return readPublicationRetirement(db, mutationId);
+}
+function retryPublicationRetirement(db, mutationId, now) {
+  const before = readPublicationRetirement(db, mutationId);
+  if (!before || !natural(now))
+    invalid("retirement retry is invalid");
+  if (before.state === "released" || before.state === "pending")
+    return before;
+  db.run("UPDATE configuration_retirements SET state='pending',reason_code=NULL,updated_at=? WHERE mutation_id=?", [now, mutationId]);
+  return readPublicationRetirement(db, mutationId);
+}
+function markPublicationRetirementReleased(db, mutationId, now) {
+  const before = readPublicationRetirement(db, mutationId);
+  if (!before || !natural(now))
+    invalid("retirement release is invalid");
+  if (before.state === "released")
+    return before;
+  if (before.evidence.some((item) => item.exit_state !== "confirmed"))
+    invalid("retirement release requires every durable exit fence");
+  db.run("UPDATE configuration_retirements SET state='released',reason_code=NULL,updated_at=? WHERE mutation_id=?", [now, mutationId]);
+  return readPublicationRetirement(db, mutationId);
+}
+function readRetiredWorkerInstanceIds(db) {
+  const rows = sqliteAll(db, "SELECT member_id FROM configuration_retirement_evidence WHERE exit_state='confirmed' UNION SELECT value AS member_id FROM configuration_publication_serving_sets,json_each(exited_json) ORDER BY member_id");
+  if (rows.some((row) => !isLowercaseUuid(row.member_id)))
+    throw new ConfigRepositoryError("schema_corrupt", "retired process identity is invalid");
+  return Object.freeze(rows.map((row) => row.member_id));
+}
+function readRetirementDescriptorCleanupState(db, workerInstanceId) {
+  if (!isLowercaseUuid(workerInstanceId))
+    invalid("retirement descriptor identity is invalid");
+  const rows = sqliteAll(db, `SELECT o.state FROM configuration_retirement_evidence e
+    JOIN configuration_operations o USING(mutation_id) WHERE e.member_id=?`, workerInstanceId);
+  if (!rows.length)
+    return "absent";
+  return rows.every((row) => row.state === "converged" || row.state === "degraded") ? "terminal" : "pending";
+}
+function parseServingMembers(value) {
+  const input = snapshotJsonGraph(value);
+  if (!Array.isArray(input))
+    invalid("publication serving members are invalid");
+  const identities = new Set;
+  return Object.freeze(input.map((raw) => {
+    if (typeof raw !== "object" || raw === null || Array.isArray(raw))
+      invalid("publication serving member is invalid");
+    const item = raw;
+    const identity = item.identity;
+    if (!identity || !isLowercaseUuid(identity.master_generation) || !isLowercaseUuid(identity.worker_instance_id) || !natural(identity.worker_slot) || !isLowercaseUuid(item.boot_nonce) || !natural(item.pid, 1) || !natural(item.private_port, 1) || item.private_port > 65535 || !natural(item.revision, 1) || !validateDigest(item.content_hash) || !validateDigest(item.plugin_catalog_hash) || item.publication === null || !item.publication || typeof item.publication.mutation_id !== "string" || !natural(item.publication.attempt_no, 1) || !natural(item.publication.drain_recovery_generation) || typeof item.kernel_boot_id !== "string" || !item.kernel_boot_id.length || identities.has(identity.worker_instance_id))
+      invalid("publication serving member identity or attempt is invalid");
+    identities.add(identity.worker_instance_id);
+    const guard = item.guard === null ? null : parseProcessLifetimeGuardFacts(item.guard);
+    if (guard !== null && guard.process_instance_id !== identity.worker_instance_id)
+      invalid("publication serving guard identity is invalid");
+    return Object.freeze({ ...item, identity: Object.freeze({ ...identity }), guard });
+  }));
+}
+function readPublicationServingSet(db, mutationId, generation) {
+  if (!natural(generation))
+    invalid("publication serving generation is invalid");
+  const attemptKey = currentServingAttemptKey(db, mutationId);
+  const row = sqliteGet(db, "SELECT workers_json,exited_json FROM configuration_publication_serving_sets WHERE mutation_id=? AND generation=? AND attempt_key=?", mutationId, generation, attemptKey);
+  if (row === null)
+    return null;
+  const workers = parseServingMembers(JSON.parse(row.workers_json));
+  if (canonicalJson(workers.map((worker) => [worker.identity.worker_slot, worker.publication.attempt_no]).sort((a, b) => a[0] - b[0])) !== attemptKey || workers.some((worker) => worker.publication.mutation_id !== mutationId || worker.publication.drain_recovery_generation !== generation)) {
+    throw new ConfigRepositoryError("schema_corrupt", "publication serving attempt identity is invalid");
+  }
+  const exited = JSON.parse(row.exited_json);
+  if (!Array.isArray(exited) || new Set(exited).size !== exited.length || exited.some((id) => typeof id !== "string" || !workers.some((worker) => worker.identity.worker_instance_id === id))) {
+    throw new ConfigRepositoryError("schema_corrupt", "publication serving exit fence is invalid");
+  }
+  return Object.freeze({ mutation_id: mutationId, generation, attempt_key: attemptKey, workers, exited: Object.freeze(exited) });
+}
+function currentServingAttemptKey(db, mutationId) {
+  const targets = sqliteAll(db, "SELECT worker_slot,attempt_no FROM configuration_operation_workers WHERE mutation_id=? ORDER BY worker_slot", mutationId);
+  return canonicalJson(targets.map((target) => [target.worker_slot, target.attempt_no]));
+}
+function assertPublicationServingAttemptsExited(db, mutationId) {
+  const history = sqliteAll(db, "SELECT workers_json,exited_json FROM configuration_publication_serving_sets WHERE mutation_id=?", mutationId);
+  for (const prior of history) {
+    const exited = JSON.parse(prior.exited_json);
+    const workers = parseServingMembers(JSON.parse(prior.workers_json));
+    if (!Array.isArray(exited) || exited.some((id) => typeof id !== "string" || !workers.some((worker) => worker.identity.worker_instance_id === id))) {
+      throw new ConfigRepositoryError("schema_corrupt", "publication serving exit fence is invalid");
+    }
+    if (workers.some((worker) => !exited.includes(worker.identity.worker_instance_id))) {
+      invalid("a prior serving attempt has no complete durable exit fence");
+    }
+  }
+}
+function freezePublicationServingSet(db, mutationId, generation, input) {
+  const workers = parseServingMembers(input);
+  const before = readPublicationServingSet(db, mutationId, generation);
+  if (before !== null) {
+    if (canonicalJson(before.workers) !== canonicalJson(workers))
+      throw new ConfigRepositoryError("cas_conflict", "publication serving members are already frozen");
+    return before;
+  }
+  const operation = sqliteGet(db, "SELECT state,committed_revision,target_worker_count,drain_recovery_generation FROM configuration_operations WHERE mutation_id=?", mutationId);
+  if (!operation || operation.state === "converged" || operation.state === "degraded" || operation.drain_recovery_generation !== generation || workers.length !== operation.target_worker_count || workers.some((worker) => worker.revision !== operation.committed_revision || worker.publication?.mutation_id !== mutationId || worker.publication.drain_recovery_generation !== generation))
+    invalid("publication serving authority does not match the current attempt");
+  const attemptKey = currentServingAttemptKey(db, mutationId);
+  if (canonicalJson(workers.map((worker) => [worker.identity.worker_slot, worker.publication.attempt_no]).sort((a, b) => a[0] - b[0])) !== attemptKey) {
+    invalid("publication serving authority does not cover every target attempt");
+  }
+  for (const worker of workers) {
+    const target = sqliteGet(db, "SELECT attempt_no,state FROM configuration_operation_workers WHERE mutation_id=? AND worker_slot=?", mutationId, worker.identity.worker_slot);
+    if (target === null || target.state !== "converged" || target.attempt_no !== worker.publication?.attempt_no)
+      invalid("publication serving attempt is not converged");
+  }
+  assertPublicationServingAttemptsExited(db, mutationId);
+  db.run("INSERT INTO configuration_publication_serving_sets(mutation_id,generation,attempt_key,workers_json,exited_json) VALUES(?,?,?,?,'[]')", [mutationId, generation, attemptKey, canonicalJson(workers)]);
+  return readPublicationServingSet(db, mutationId, generation);
+}
+function confirmPublicationServingMemberExit(db, mutationId, generation, workerInstanceId) {
+  const before = readPublicationServingSet(db, mutationId, generation);
+  if (!before || !before.workers.some((worker) => worker.identity.worker_instance_id === workerInstanceId))
+    invalid("publication serving member is outside durable authority");
+  if (before.exited.includes(workerInstanceId))
+    return before;
+  db.run("UPDATE configuration_publication_serving_sets SET exited_json=? WHERE mutation_id=? AND generation=? AND attempt_key=?", [canonicalJson([...before.exited, workerInstanceId].sort()), mutationId, generation, before.attempt_key]);
+  return readPublicationServingSet(db, mutationId, generation);
+}
+
+// src/config-storage/runtime-recovery-budget.ts
+var BACKOFF_NS = [5000000000n, 30000000000n];
+var HEALTHY_RESET_NS = 30n * 60n * 1000000000n;
+var MAX_HEALTH_SAMPLE_GAP_NS = 60n * 1000000000n;
+function sample(input) {
+  if (!isLowercaseUuid(input.owner) || typeof input.boot_id !== "string" || input.boot_id.length < 1 || input.boot_id.length > 256 || typeof input.monotonic_ns !== "string" || !/^(0|[1-9]\d{0,24})$/.test(input.monotonic_ns)) {
+    throw new ConfigRepositoryError("invalid_operation", "runtime recovery sample is invalid");
+  }
+  return BigInt(input.monotonic_ns);
+}
+function readRuntimeRecoveryBudget(db) {
+  const row = sqliteGet(db, "SELECT tickets,ticket_id,ticket_boot_id,retry_at_ns,healthy_owner,healthy_boot_id,healthy_since_ns,healthy_last_ns FROM runtime_recovery_budget WHERE id=1");
+  if (row === null || !Number.isSafeInteger(row.tickets) || row.tickets < 0 || row.tickets > 2 || row.tickets > 0 && (row.ticket_id === null || !isLowercaseUuid(row.ticket_id) || typeof row.ticket_boot_id !== "string" || !row.ticket_boot_id.length || row.retry_at_ns === null) || row.healthy_owner !== null && (!isLowercaseUuid(row.healthy_owner) || typeof row.healthy_boot_id !== "string" || !row.healthy_boot_id.length || row.healthy_since_ns === null || row.healthy_last_ns === null) || [row.retry_at_ns, row.healthy_since_ns, row.healthy_last_ns].some((value) => value !== null && !/^(0|[1-9]\d{0,24})$/.test(value))) {
+    throw new ConfigRepositoryError("schema_corrupt", "runtime recovery budget is corrupt");
+  }
+  return Object.freeze({
+    tickets: row.tickets,
+    last_ticket_id: row.ticket_id,
+    retry_boot_id: row.ticket_boot_id,
+    retry_at_ns: row.retry_at_ns,
+    healthy_owner: row.healthy_owner,
+    healthy_boot_id: row.healthy_boot_id,
+    healthy_since_ns: row.healthy_since_ns,
+    healthy_last_ns: row.healthy_last_ns
+  });
+}
+function consumeRuntimeRecoveryRestartTicket(db, ticketId, input) {
+  const now = sample(input);
+  if (!isLowercaseUuid(ticketId))
+    throw new ConfigRepositoryError("invalid_operation", "runtime recovery ticket identity is invalid");
+  const before = readRuntimeRecoveryBudget(db);
+  const prior = sqliteGet(db, "SELECT owner,boot_id FROM runtime_recovery_tickets WHERE ticket_id=?", ticketId);
+  if (prior !== null) {
+    if (prior.owner !== input.owner || prior.boot_id !== input.boot_id) {
+      throw new ConfigRepositoryError("invalid_operation", "runtime recovery ticket belongs to another owner or kernel boot");
+    }
+    return before;
+  }
+  if (before.tickets >= 2)
+    throw new ConfigRepositoryError("attempts_exhausted", "runtime recovery restart budget is exhausted");
+  if (before.retry_at_ns !== null && before.retry_boot_id === input.boot_id && now < BigInt(before.retry_at_ns)) {
+    throw new ConfigRepositoryError("retry_not_due", "runtime recovery restart backoff has not elapsed");
+  }
+  const retry = now + BACKOFF_NS[before.tickets];
+  db.run("INSERT INTO runtime_recovery_tickets(ticket_id,owner,boot_id,consumed_at_ns,retry_at_ns) VALUES(?,?,?,?,?)", [ticketId, input.owner, input.boot_id, now.toString(), retry.toString()]);
+  db.run(`UPDATE runtime_recovery_budget SET tickets=tickets+1,ticket_id=?,ticket_boot_id=?,retry_at_ns=?,
+    healthy_owner=NULL,healthy_boot_id=NULL,healthy_since_ns=NULL,healthy_last_ns=NULL WHERE id=1`, [ticketId, input.boot_id, retry.toString()]);
+  return readRuntimeRecoveryBudget(db);
+}
+function readRuntimeRecoveryStartupGate(db, input) {
+  const now = sample(input);
+  const budget = readRuntimeRecoveryBudget(db);
+  if (budget.retry_at_ns === null)
+    return { kind: "ready", budget };
+  if (budget.retry_boot_id !== input.boot_id)
+    return { kind: "stopped", reason: "clock_domain_unknown", budget };
+  const remaining = BigInt(budget.retry_at_ns) - now;
+  if (remaining > 0n)
+    return { kind: "waiting", remaining_ms: Number((remaining + 999999n) / 1000000n), budget };
+  return { kind: "ready", budget };
+}
+function observeRuntimeRecoveryHealth(db, input, healthy) {
+  const now = sample(input);
+  const before = readRuntimeRecoveryBudget(db);
+  if (typeof healthy !== "boolean")
+    throw new ConfigRepositoryError("invalid_operation", "runtime health sample is invalid");
+  if (!healthy) {
+    db.run("UPDATE runtime_recovery_budget SET healthy_owner=NULL,healthy_boot_id=NULL,healthy_since_ns=NULL,healthy_last_ns=NULL WHERE id=1");
+    return readRuntimeRecoveryBudget(db);
+  }
+  const continuous = before.healthy_owner === input.owner && before.healthy_boot_id === input.boot_id && before.healthy_since_ns !== null && before.healthy_last_ns !== null && now >= BigInt(before.healthy_last_ns) && now - BigInt(before.healthy_last_ns) <= MAX_HEALTH_SAMPLE_GAP_NS;
+  const since = continuous ? BigInt(before.healthy_since_ns) : now;
+  if (now - since >= HEALTHY_RESET_NS) {
+    db.run(`UPDATE runtime_recovery_budget SET tickets=0,ticket_id=NULL,ticket_boot_id=NULL,retry_at_ns=NULL,
+      healthy_owner=?,healthy_boot_id=?,healthy_since_ns=?,healthy_last_ns=? WHERE id=1`, [input.owner, input.boot_id, since.toString(), now.toString()]);
+  } else {
+    db.run("UPDATE runtime_recovery_budget SET healthy_owner=?,healthy_boot_id=?,healthy_since_ns=?,healthy_last_ns=? WHERE id=1", [input.owner, input.boot_id, since.toString(), now.toString()]);
+  }
+  return readRuntimeRecoveryBudget(db);
+}
+
+// src/config-storage/config-repository.ts
+import { Database as Database3 } from "bun:sqlite";
+import { mkdirSync } from "fs";
+import { dirname as dirname2 } from "path";
+
+// src/config-storage/persisted-validation.ts
+function corrupt(field) {
+  throw new ConfigRepositoryError("schema_corrupt", `${field} contains an invalid persisted value`);
+}
+function requireSafeInteger(value, field, minimum = 0) {
+  if (!Number.isSafeInteger(value) || value < minimum)
+    return corrupt(field);
+  return value;
+}
+function requireBooleanInteger(value, field) {
+  if (value !== 0 && value !== 1)
+    return corrupt(field);
+  return value === 1;
+}
+function requirePositiveFinite(value, field) {
+  if (!Number.isFinite(value) || value <= 0)
+    return corrupt(field);
+  return value;
+}
+function requireUuid(value, field) {
+  if (!isLowercaseUuid(value))
+    return corrupt(field);
+  return value;
+}
+function requirePluginName(value, field) {
+  if (!isPluginName(value))
+    return corrupt(field);
+  return value;
+}
+function requireOptionalGlobalScalar(value, field) {
+  if (value === null)
+    return;
+  const valid = field === "log_level" ? isLogLevel(value) : isBodyParserLimit(value);
+  if (!valid)
+    return corrupt(field);
+  return value;
+}
+function requireOneOf(value, allowed, field) {
+  const match = allowed.find((candidate) => candidate === value);
+  if (match === undefined)
+    return corrupt(field);
+  return match;
+}
+
 // src/config-storage/operation-records.ts
 var OPERATION_SELECT = `SELECT mutation_id,request_hash,expected_revision,committed_revision,kind,state,
   target_worker_count,result_status,error_code,error_detail,drain_recovery_generation,
@@ -7892,84 +8331,6 @@ function readActiveRevision(db) {
   return revision;
 }
 
-// ../../node_modules/canonicalize/lib/canonicalize.js
-function canonicalize(object, seen = new Set) {
-  if (typeof object === "number" && isNaN(object)) {
-    throw new Error("NaN is not allowed");
-  }
-  if (typeof object === "number" && !isFinite(object)) {
-    throw new Error("Infinity is not allowed");
-  }
-  if (object === null || typeof object !== "object") {
-    return JSON.stringify(object);
-  }
-  if (typeof object.toJSON === "function") {
-    if (seen.has(object)) {
-      throw new Error("Circular reference detected");
-    }
-    seen.add(object);
-    const result = canonicalize(object.toJSON(), seen);
-    seen.delete(object);
-    return result;
-  }
-  if (seen.has(object)) {
-    throw new Error("Circular reference detected");
-  }
-  seen.add(object);
-  let result;
-  if (Array.isArray(object)) {
-    const values = object.map((cv) => {
-      const value = cv === undefined || typeof cv === "symbol" ? null : cv;
-      return canonicalize(value, seen);
-    });
-    result = `[${values.join(",")}]`;
-  } else {
-    const parts = [];
-    for (const key of Object.keys(object).sort()) {
-      if (object[key] === undefined || typeof object[key] === "symbol") {
-        continue;
-      }
-      parts.push(`${canonicalize(key)}:${canonicalize(object[key], seen)}`);
-    }
-    result = `{${parts.join(",")}}`;
-  }
-  seen.delete(object);
-  return result;
-}
-
-// src/config-storage/content-hash.ts
-class ConfigurationHashError extends Error {
-  cause;
-  name = "ConfigurationHashError";
-  constructor(cause) {
-    super("RFC 8785 canonicalization failed", { cause });
-    this.cause = cause;
-  }
-}
-function canonicalJson(value) {
-  try {
-    const result = canonicalize(snapshotJsonGraph(value));
-    if (result === undefined)
-      throw new TypeError("canonicalize returned undefined");
-    return result;
-  } catch (error) {
-    throw new ConfigurationHashError(error);
-  }
-}
-function hashConfigurationContent(value) {
-  const bytes = new TextEncoder().encode(canonicalJson(value));
-  const hex = new Bun.CryptoHasher("sha256").update(bytes).digest("hex");
-  return `sha256:${hex}`;
-}
-function hashConfigurationRequest(identity) {
-  return hashConfigurationContent({
-    kind: identity.kind,
-    expected_revision: identity.expected_revision,
-    aggregate: identity.aggregate,
-    target_worker_slots: [...identity.target_worker_slots].sort((left, right) => left - right)
-  });
-}
-
 // src/config-storage/operation-relations.ts
 function validateActiveOperationIdentity(db, operation, workers, snapshot) {
   validateOperationRelations(operation, workers);
@@ -8197,7 +8558,7 @@ var REASON_CODES = [
 var RECOVERY_SELECT = `SELECT recovery_sequence,recovery_id,source_mutation_id,target_revision,trigger,state,
   attempt_count,max_attempts,next_retry_at,final_reason_code,final_reason_detail,created_at,updated_at
   FROM configuration_recoveries`;
-function invalid(message) {
+function invalid2(message) {
   throw new ConfigRepositoryError("invalid_operation", message);
 }
 function corrupt2(message) {
@@ -8317,28 +8678,28 @@ function readActiveRecovery(db, targetRevision) {
 }
 function requireRecoveryId(recoveryId) {
   if (typeof recoveryId !== "string" || !isLowercaseUuid(recoveryId)) {
-    invalid("recovery_id is invalid");
+    invalid2("recovery_id is invalid");
   }
 }
 function requireNow(now) {
   if (!Number.isSafeInteger(now) || now < 0 || now > Number.MAX_SAFE_INTEGER)
-    invalid("recovery timestamp is invalid");
+    invalid2("recovery timestamp is invalid");
 }
 function initialRetryAt(trigger, now) {
   if (trigger === "manual")
     return null;
   if (now > Number.MAX_SAFE_INTEGER - RECOVERY_INITIAL_DELAY_MS)
-    invalid("automatic recovery retry timestamp would overflow");
+    invalid2("automatic recovery retry timestamp would overflow");
   return now + RECOVERY_INITIAL_DELAY_MS;
 }
 function requireAttempt(attemptCount) {
   if (!Number.isSafeInteger(attemptCount) || attemptCount < 0 || attemptCount > RECOVERY_MAX_ATTEMPTS) {
-    invalid("recovery attempt count is invalid");
+    invalid2("recovery attempt count is invalid");
   }
 }
 function requireDetail(detail) {
   if (detail !== null && (detail.length > 512 || detail.trim().length === 0))
-    invalid("recovery reason detail is invalid");
+    invalid2("recovery reason detail is invalid");
 }
 function requireReasonCompatible(db, recovery, reason) {
   if (reason !== "deterministic_worker_rejection" && reason !== "deterministic_protocol_failure" && reason !== "deterministic_control_failure" && reason !== "fatal_source_failure")
@@ -8351,12 +8712,12 @@ function requireReasonCompatible(db, recovery, reason) {
 function requireRevisionDrift(db, recovery) {
   const currentRevision = sqliteGet(db, "SELECT active_revision FROM configuration_state WHERE id=1")?.active_revision;
   if (currentRevision === undefined || currentRevision <= recovery.target_revision)
-    invalid("revision has not been superseded");
+    invalid2("revision has not been superseded");
 }
 function requireTimestamp2(now, recovery) {
   requireNow(now);
   if (now < recovery.updated_at)
-    invalid("recovery timestamp regressed");
+    invalid2("recovery timestamp regressed");
 }
 function sameIdentity(recovery, trigger, sourceMutationId, targetRevision) {
   return recovery.trigger === trigger && recovery.source_mutation_id === sourceMutationId && recovery.target_revision === targetRevision;
@@ -8379,7 +8740,7 @@ function requireNoActivePublication(db) {
      WHERE committed_revision=(SELECT active_revision FROM configuration_state WHERE id=1)
        AND state IN ('committed','publishing','draining') LIMIT 1`);
   if (active !== null)
-    invalid("an active publication already exists");
+    invalid2("an active publication already exists");
 }
 function insertRecovery(db, recoveryId, sourceMutationId, targetRevision, trigger, now, initial = { state: "scheduled", final_reason_code: null, final_reason_detail: null }) {
   requireRecoveryId(recoveryId);
@@ -8397,14 +8758,14 @@ function insertRecovery(db, recoveryId, sourceMutationId, targetRevision, trigge
   }
   const latest = readLatestRecovery(db, targetRevision);
   if (latest !== null && now < latest.updated_at)
-    invalid("recovery timestamp regressed");
+    invalid2("recovery timestamp regressed");
   const latestCreatedAt = sqliteGet(db, "SELECT created_at FROM configuration_recoveries ORDER BY recovery_sequence DESC LIMIT 1")?.created_at;
   if (latestCreatedAt !== null && latestCreatedAt !== undefined && now < latestCreatedAt) {
-    invalid("recovery creation timestamp regressed");
+    invalid2("recovery creation timestamp regressed");
   }
   const nextRetryAt = initial.state === "scheduled" ? initialRetryAt(trigger, now) : null;
   if (initial.state === "stopped" && (initial.final_reason_code === null || initial.final_reason_code === "target_serving" || initial.final_reason_code === "already_serving" || initial.final_reason_code === "retry_exhausted" || initial.final_reason_code === "revision_superseded" || initial.final_reason_code === "safety_outcome_unknown")) {
-    invalid("initial stopped recovery reason is invalid");
+    invalid2("initial stopped recovery reason is invalid");
   }
   if (initial.final_reason_detail !== null)
     requireDetail(initial.final_reason_detail);
@@ -8456,7 +8817,7 @@ function createManualRecovery(db, recoveryId, sourceMutationId, expectedRevision
 function claimRecoveryAttempt(db, recoveryId, previousAttemptCount, now) {
   const recovery = readRecovery(db, recoveryId);
   if (recovery === null)
-    invalid("recovery was not found");
+    invalid2("recovery was not found");
   requireCurrentTarget(db, recovery);
   requireAttempt(previousAttemptCount);
   requireNow(now);
@@ -8485,7 +8846,7 @@ function claimRecoveryAttempt(db, recoveryId, previousAttemptCount, now) {
 function scheduleRecoveryRetry(db, recoveryId, attemptCount, nextRetryAt, now) {
   const recovery = readRecovery(db, recoveryId);
   if (recovery === null)
-    invalid("recovery was not found");
+    invalid2("recovery was not found");
   requireCurrentTarget(db, recovery);
   requireAttempt(attemptCount);
   requireNow(nextRetryAt);
@@ -8498,7 +8859,7 @@ function scheduleRecoveryRetry(db, recoveryId, attemptCount, nextRetryAt, now) {
     throw new ConfigRepositoryError("attempts_exhausted", "recovery attempt limit reached");
   }
   if (nextRetryAt <= now)
-    invalid("next retry time must be in the future");
+    invalid2("next retry time must be in the future");
   const result = db.run(`UPDATE configuration_recoveries SET state='scheduled',next_retry_at=?,updated_at=?
     WHERE recovery_id=? AND state='running' AND attempt_count=?`, [nextRetryAt, now, recoveryId, attemptCount]);
   if (result.changes !== 1)
@@ -8511,9 +8872,9 @@ function scheduleRecoveryRetry(db, recoveryId, attemptCount, nextRetryAt, now) {
 function terminalTransition(db, recoveryId, attemptCount, state, finalReasonCode, finalReasonDetail, now) {
   const recovery = readRecovery(db, recoveryId);
   if (recovery === null)
-    invalid("recovery was not found");
+    invalid2("recovery was not found");
   requireAttempt(attemptCount);
-  validateTerminalMatrix(state, attemptCount, finalReasonCode, invalid);
+  validateTerminalMatrix(state, attemptCount, finalReasonCode, invalid2);
   requireDetail(finalReasonDetail);
   if (recovery.state === state && recovery.attempt_count === attemptCount && recovery.final_reason_code === finalReasonCode && recovery.final_reason_detail === finalReasonDetail)
     return recovery;
@@ -8544,7 +8905,7 @@ function stopRecovery(db, recoveryId, attemptCount, finalReasonCode, finalReason
 function requeueRecovery(db, recoveryId, attemptCount, now) {
   const recovery = readRecovery(db, recoveryId);
   if (recovery === null)
-    invalid("recovery was not found");
+    invalid2("recovery was not found");
   requireCurrentTarget(db, recovery);
   requireAttempt(attemptCount);
   requireNow(now);
@@ -9029,8 +9390,88 @@ var CONFIG_BASELINE = {
   }
 };
 
+// src/config-storage/migrations/publication-retirement.ts
+var PUBLICATION_RETIREMENT_MIGRATION = {
+  version: 2,
+  name: "publication_retirement_and_runtime_recovery",
+  up(db) {
+    db.run(`CREATE TABLE configuration_retirements (
+      mutation_id TEXT PRIMARY KEY REFERENCES configuration_operations(mutation_id),
+      generation INTEGER NOT NULL CHECK(generation >= 0),
+      members_json TEXT NOT NULL CHECK(json_valid(members_json) AND json_type(members_json)='array'),
+      state TEXT NOT NULL CHECK(state IN ('pending','stopped','released')),
+      reason_code TEXT CHECK(reason_code IS NULL OR reason_code IN ('exit_unknown','cleanup_unknown','release_unknown')),
+      updated_at INTEGER NOT NULL CHECK(updated_at >= 0)
+    ) STRICT`);
+    db.run(`CREATE TABLE configuration_retirement_evidence (
+      mutation_id TEXT NOT NULL REFERENCES configuration_retirements(mutation_id),
+      member_id TEXT NOT NULL,
+      exit_state TEXT NOT NULL CHECK(exit_state IN ('live','confirmed','unknown')),
+      cleanup_state TEXT NOT NULL CHECK(cleanup_state IN ('success','failed','unknown')),
+      exit_boot_id TEXT,
+      exit_deadline_ns TEXT,
+      start_boot_id TEXT,
+      start_deadline_ns TEXT,
+      updated_at INTEGER NOT NULL CHECK(updated_at >= 0),
+      CHECK((exit_boot_id IS NULL AND exit_deadline_ns IS NULL) OR (exit_boot_id IS NOT NULL AND exit_deadline_ns IS NOT NULL)),
+      CHECK((start_boot_id IS NULL AND start_deadline_ns IS NULL) OR (start_boot_id IS NOT NULL AND start_deadline_ns IS NOT NULL)),
+      PRIMARY KEY(mutation_id,member_id)
+    ) STRICT, WITHOUT ROWID`);
+    db.run("CREATE TRIGGER retirement_start_deadline_immutable BEFORE UPDATE OF start_boot_id,start_deadline_ns ON configuration_retirement_evidence WHEN OLD.start_deadline_ns IS NOT NULL AND (NEW.start_boot_id IS NOT OLD.start_boot_id OR NEW.start_deadline_ns IS NOT OLD.start_deadline_ns) BEGIN SELECT RAISE(ABORT,'retirement start deadline is immutable'); END");
+    db.run(`CREATE TABLE configuration_publication_serving_sets (
+      mutation_id TEXT NOT NULL REFERENCES configuration_operations(mutation_id),
+      generation INTEGER NOT NULL CHECK(generation >= 0),
+      attempt_key TEXT NOT NULL CHECK(json_valid(attempt_key) AND json_type(attempt_key)='array'),
+      workers_json TEXT NOT NULL CHECK(json_valid(workers_json) AND json_type(workers_json)='array'),
+      exited_json TEXT NOT NULL CHECK(json_valid(exited_json) AND json_type(exited_json)='array'),
+      PRIMARY KEY(mutation_id,generation,attempt_key)
+    ) STRICT, WITHOUT ROWID`);
+    db.run("CREATE TRIGGER publication_serving_authority_no_delete BEFORE DELETE ON configuration_publication_serving_sets BEGIN SELECT RAISE(ABORT,'publication serving authority history is immutable'); END");
+    db.run("CREATE TRIGGER publication_serving_authority_no_update BEFORE UPDATE OF mutation_id,generation,attempt_key,workers_json ON configuration_publication_serving_sets BEGIN SELECT RAISE(ABORT,'publication serving attempt identity is immutable'); END");
+    db.run("CREATE TRIGGER publication_serving_authority_no_replace BEFORE INSERT ON configuration_publication_serving_sets WHEN EXISTS(SELECT 1 FROM configuration_publication_serving_sets WHERE mutation_id=NEW.mutation_id AND generation=NEW.generation AND attempt_key=NEW.attempt_key) BEGIN SELECT RAISE(ABORT,'publication serving authority history is immutable'); END");
+    db.run(`CREATE TABLE runtime_recovery_budget (
+      id INTEGER PRIMARY KEY CHECK(id=1),
+      tickets INTEGER NOT NULL CHECK(tickets BETWEEN 0 AND 2),
+      ticket_id TEXT,
+      ticket_boot_id TEXT,
+      retry_at_ns TEXT,
+      healthy_owner TEXT,
+      healthy_boot_id TEXT,
+      healthy_since_ns TEXT,
+      healthy_last_ns TEXT,
+      CHECK((tickets=0 AND ticket_id IS NULL AND ticket_boot_id IS NULL AND retry_at_ns IS NULL) OR
+        (tickets>0 AND ticket_id IS NOT NULL AND ticket_boot_id IS NOT NULL AND retry_at_ns IS NOT NULL)),
+      CHECK((healthy_owner IS NULL AND healthy_boot_id IS NULL AND healthy_since_ns IS NULL AND healthy_last_ns IS NULL) OR
+        (healthy_owner IS NOT NULL AND healthy_boot_id IS NOT NULL AND healthy_since_ns IS NOT NULL AND healthy_last_ns IS NOT NULL))
+    ) STRICT`);
+    db.run("INSERT INTO runtime_recovery_budget(id,tickets) VALUES(1,0)");
+    db.run(`CREATE TABLE configuration_retirement_retry_requests (
+      request_id TEXT PRIMARY KEY,
+      mutation_id TEXT NOT NULL REFERENCES configuration_retirements(mutation_id),
+      expected_revision INTEGER NOT NULL CHECK(expected_revision>0),
+      created_at INTEGER NOT NULL CHECK(created_at>=0)
+    ) STRICT, WITHOUT ROWID`);
+    db.run("CREATE TRIGGER retirement_retry_no_delete BEFORE DELETE ON configuration_retirement_retry_requests BEGIN SELECT RAISE(ABORT,'retirement retry identity is immutable'); END");
+    db.run("CREATE TRIGGER retirement_retry_no_update BEFORE UPDATE ON configuration_retirement_retry_requests BEGIN SELECT RAISE(ABORT,'retirement retry identity is immutable'); END");
+    db.run("CREATE TRIGGER retirement_retry_no_replace BEFORE INSERT ON configuration_retirement_retry_requests WHEN EXISTS(SELECT 1 FROM configuration_retirement_retry_requests WHERE request_id=NEW.request_id) BEGIN SELECT RAISE(ABORT,'retirement retry identity is immutable'); END");
+    db.run(`CREATE TABLE runtime_recovery_tickets (
+      ticket_id TEXT PRIMARY KEY,
+      owner TEXT NOT NULL,
+      boot_id TEXT NOT NULL,
+      consumed_at_ns TEXT NOT NULL,
+      retry_at_ns TEXT NOT NULL
+    ) STRICT, WITHOUT ROWID`);
+    db.run("CREATE TRIGGER runtime_recovery_tickets_no_delete BEFORE DELETE ON runtime_recovery_tickets BEGIN SELECT RAISE(ABORT,'runtime recovery ticket history is immutable'); END");
+    db.run("CREATE TRIGGER runtime_recovery_tickets_no_update BEFORE UPDATE ON runtime_recovery_tickets BEGIN SELECT RAISE(ABORT,'runtime recovery ticket history is immutable'); END");
+    db.run("CREATE TRIGGER runtime_recovery_tickets_no_replace BEFORE INSERT ON runtime_recovery_tickets WHEN EXISTS(SELECT 1 FROM runtime_recovery_tickets WHERE ticket_id=NEW.ticket_id) BEGIN SELECT RAISE(ABORT,'runtime recovery ticket history is immutable'); END");
+    db.run("CREATE TRIGGER runtime_recovery_budget_no_delete BEFORE DELETE ON runtime_recovery_budget BEGIN SELECT RAISE(ABORT,'runtime recovery budget cannot be deleted'); END");
+    db.run("CREATE TRIGGER runtime_recovery_budget_no_replace BEFORE INSERT ON runtime_recovery_budget WHEN EXISTS(SELECT 1 FROM runtime_recovery_budget) BEGIN SELECT RAISE(ABORT,'runtime recovery budget cannot be replaced'); END");
+    db.run("CREATE TRIGGER runtime_recovery_budget_fixed_identity BEFORE UPDATE OF id ON runtime_recovery_budget BEGIN SELECT RAISE(ABORT,'runtime recovery budget identity is immutable'); END");
+  }
+};
+
 // src/config-storage/migrations/plan.ts
-var CONFIG_MIGRATIONS = [CONFIG_BASELINE];
+var CONFIG_MIGRATIONS = [CONFIG_BASELINE, PUBLICATION_RETIREMENT_MIGRATION];
 var CONFIG_SCHEMA_VERSION = CONFIG_MIGRATIONS.at(-1).version;
 
 // src/config-storage/schema-fingerprint.ts
@@ -9446,7 +9887,7 @@ function verifyRepositoryIntegrity(db) {
 
 // src/config-storage/serving-snapshot.ts
 var MAX_AGGREGATE_BYTES = 1048576;
-function invalid2(message) {
+function invalid3(message) {
   throw new ConfigRepositoryError("invalid_configuration", message);
 }
 function corrupt3(message) {
@@ -9455,26 +9896,26 @@ function corrupt3(message) {
 function canonicalAggregate(aggregate) {
   const result = parseNormalizeCompileAggregate(aggregate, undefined);
   if (!result.ok)
-    invalid2("configuration aggregate is invalid");
+    invalid3("configuration aggregate is invalid");
   const aggregateJson = canonicalJson(result.value);
   const bytes = new TextEncoder().encode(aggregateJson).byteLength;
   if (bytes < 2 || bytes > MAX_AGGREGATE_BYTES) {
-    invalid2("configuration aggregate is too large");
+    invalid3("configuration aggregate is too large");
   }
   return { aggregateJson, contentHash: hashConfigurationContent(result.value) };
 }
 function appendServingSnapshot(db, snapshot, pluginCatalogHash) {
   if (!Number.isSafeInteger(snapshot?.revision) || snapshot.revision <= 0 || typeof snapshot.content_hash !== "string" || !validateDigest(snapshot.content_hash) || !validateDigest(pluginCatalogHash)) {
-    invalid2("serving snapshot identity is invalid");
+    invalid3("serving snapshot identity is invalid");
   }
   const normalized = canonicalAggregate(snapshot.aggregate);
   if (normalized.contentHash !== snapshot.content_hash) {
-    invalid2("configuration aggregate content hash does not match");
+    invalid3("configuration aggregate content hash does not match");
   }
   const transaction = db.transaction(() => {
     const revision = sqliteGet(db, "SELECT revision,content_hash FROM configuration_revisions WHERE revision=?", snapshot.revision);
     if (revision === null || revision.content_hash !== snapshot.content_hash) {
-      invalid2("serving snapshot revision does not match configuration history");
+      invalid3("serving snapshot revision does not match configuration history");
     }
     const existing = sqliteGet(db, `SELECT revision,content_hash,plugin_catalog_hash,aggregate_json
        FROM configuration_serving_snapshots
@@ -9492,7 +9933,7 @@ function appendServingSnapshot(db, snapshot, pluginCatalogHash) {
 }
 function getServingSnapshot(db, key) {
   if (!Number.isSafeInteger(key?.revision) || key.revision <= 0 || typeof key.content_hash !== "string" || !validateDigest(key.content_hash) || typeof key.plugin_catalog_hash !== "string" || !validateDigest(key.plugin_catalog_hash)) {
-    invalid2("serving snapshot lookup identity is invalid");
+    invalid3("serving snapshot lookup identity is invalid");
   }
   return withConsistentRead(db, () => {
     const row = sqliteGet(db, `SELECT revision,content_hash,plugin_catalog_hash,aggregate_json
@@ -9743,7 +10184,7 @@ class ConfigRepository {
   static open(dbPath, options = {}) {
     let db;
     try {
-      mkdirSync(dirname(dbPath), { recursive: true });
+      mkdirSync(dirname2(dbPath), { recursive: true });
       db = new Database3(dbPath, { create: true, readwrite: true, strict: true });
       configureConnection(db);
       migrateConfigurationDatabase(db);
@@ -9751,6 +10192,7 @@ class ConfigRepository {
       const repository = new ConfigRepository(db, options, freezeSnapshot(readRepositorySnapshot(db)));
       repository.getSnapshot();
       repository.getSupervisionState();
+      repository.getRuntimeRecoveryBudget();
       return repository;
     } catch (error) {
       db?.close(true);
@@ -9898,12 +10340,18 @@ class ConfigRepository {
   }
   beginWorkerAttempt(mutationId, workerSlot, previousAttemptNo, reason, updatedAt) {
     return runRepositoryAction(() => this.publicationTransaction(mutationId, () => {
+      const current = readOperationWorkers(this.db, mutationId).find((target) => target.worker_slot === workerSlot);
+      if (current?.attempt_no === previousAttemptNo)
+        assertPublicationServingAttemptsExited(this.db, mutationId);
       const worker = beginWorkerAttempt(this.db, mutationId, workerSlot, previousAttemptNo, reason, updatedAt);
       return worker;
     }));
   }
   beginDrainingRecovery(mutationId, previousGeneration, updatedAt) {
     return runRepositoryAction(() => this.publicationTransaction(mutationId, () => {
+      if (getOperation(this.db, mutationId)?.drain_recovery_generation === previousGeneration) {
+        assertPublicationServingAttemptsExited(this.db, mutationId);
+      }
       const operation = beginDrainingRecovery(this.db, mutationId, previousGeneration, updatedAt);
       return operation;
     }));
@@ -9947,9 +10395,68 @@ class ConfigRepository {
       return operation;
     }));
   }
+  getPublicationServingSet(...args) {
+    return runRepositoryAction(() => withConsistentRead(this.db, () => readPublicationServingSet(this.db, ...args)));
+  }
+  freezePublicationServingSet(...args) {
+    return runRepositoryAction(() => this.mutationTransaction(() => freezePublicationServingSet(this.db, ...args)));
+  }
+  confirmPublicationServingMemberExit(...args) {
+    return runRepositoryAction(() => this.mutationTransaction(() => confirmPublicationServingMemberExit(this.db, ...args)));
+  }
+  getRetirementDescriptorCleanupState(workerInstanceId) {
+    return runRepositoryAction(() => withConsistentRead(this.db, () => readRetirementDescriptorCleanupState(this.db, workerInstanceId)));
+  }
+  getRetiredWorkerInstanceIds() {
+    return runRepositoryAction(() => withConsistentRead(this.db, () => readRetiredWorkerInstanceIds(this.db)));
+  }
+  getPublicationRetirement(...args) {
+    return runRepositoryAction(() => withConsistentRead(this.db, () => readPublicationRetirement(this.db, ...args)));
+  }
+  freezePublicationRetirement(...args) {
+    return runRepositoryAction(() => this.publicationTransaction(args[0], () => freezePublicationRetirement(this.db, ...args)));
+  }
+  recordPublicationRetirementEvidence(...args) {
+    return runRepositoryAction(() => this.mutationTransaction(() => recordPublicationRetirementEvidence(this.db, ...args)));
+  }
+  stopPublicationRetirement(...args) {
+    return runRepositoryAction(() => this.mutationTransaction(() => stopPublicationRetirement(this.db, ...args)));
+  }
+  retryPublicationRetirement(...args) {
+    return runRepositoryAction(() => this.mutationTransaction(() => retryPublicationRetirement(this.db, ...args)));
+  }
+  freezePublicationRetirementDrainStart(...args) {
+    return runRepositoryAction(() => this.mutationTransaction(() => freezePublicationRetirementDrainStart(this.db, ...args)));
+  }
+  getPublicationRetirementRetry(...args) {
+    return runRepositoryAction(() => withConsistentRead(this.db, () => readPublicationRetirementRetry(this.db, ...args)));
+  }
+  requestPublicationRetirementRetry(...args) {
+    return runRepositoryAction(() => this.mutationTransaction(() => {
+      if (this.snapshot.revision !== args[2])
+        throw new ConfigRepositoryError("cas_conflict", "retirement retry revision changed");
+      return requestPublicationRetirementRetry(this.db, ...args);
+    }));
+  }
+  markPublicationRetirementReleased(...args) {
+    return runRepositoryAction(() => this.mutationTransaction(() => markPublicationRetirementReleased(this.db, ...args)));
+  }
+  getRuntimeRecoveryBudget(...args) {
+    return runRepositoryAction(() => withConsistentRead(this.db, () => readRuntimeRecoveryBudget(this.db, ...args)));
+  }
+  consumeRuntimeRecoveryRestartTicket(...args) {
+    return runRepositoryAction(() => this.mutationTransaction(() => consumeRuntimeRecoveryRestartTicket(this.db, ...args)));
+  }
+  getRuntimeRecoveryStartupGate(...args) {
+    return runRepositoryAction(() => withConsistentRead(this.db, () => readRuntimeRecoveryStartupGate(this.db, ...args)));
+  }
+  observeRuntimeRecoveryHealth(...args) {
+    return runRepositoryAction(() => this.mutationTransaction(() => observeRuntimeRecoveryHealth(this.db, ...args)));
+  }
   verify() {
     verifyRepositoryIntegrity(this.db);
     readRepositorySnapshot(this.db);
+    this.getRuntimeRecoveryBudget();
   }
   claimController(controllerId, updatedAt) {
     return runRepositoryAction(() => this.mutationTransaction(() => this.supervision.claim(controllerId, updatedAt)));
@@ -9982,6 +10489,9 @@ class ConfigRepository {
 
 // src/config-storage/storage-protocol.ts
 var STORAGE_METHODS = [
+  "getPublicationRetirementRetry",
+  "requestPublicationRetirementRetry",
+  "freezePublicationRetirementDrainStart",
   "commitPrepared",
   "appendServingSnapshot",
   "getServingSnapshot",
@@ -10005,9 +10515,26 @@ var STORAGE_METHODS = [
   "recordWorkerResult",
   "finalizePublication",
   "markDraining",
-  "verify"
+  "verify",
+  "getPublicationServingSet",
+  "freezePublicationServingSet",
+  "confirmPublicationServingMemberExit",
+  "getRetirementDescriptorCleanupState",
+  "getRetiredWorkerInstanceIds",
+  "getPublicationRetirement",
+  "freezePublicationRetirement",
+  "recordPublicationRetirementEvidence",
+  "stopPublicationRetirement",
+  "retryPublicationRetirement",
+  "markPublicationRetirementReleased",
+  "getRuntimeRecoveryBudget",
+  "consumeRuntimeRecoveryRestartTicket",
+  "getRuntimeRecoveryStartupGate",
+  "observeRuntimeRecoveryHealth"
 ];
 var READ_METHODS = new Set([
+  "getPublicationRetirementRetry",
+  "getPublicationServingSet",
   "getServingSnapshot",
   "getActivePublication",
   "getOperation",
@@ -10016,7 +10543,12 @@ var READ_METHODS = new Set([
   "getRecovery",
   "getCurrentRecovery",
   "getLatestRecovery",
-  "verify"
+  "verify",
+  "getRetirementDescriptorCleanupState",
+  "getRetiredWorkerInstanceIds",
+  "getPublicationRetirement",
+  "getRuntimeRecoveryBudget",
+  "getRuntimeRecoveryStartupGate"
 ]);
 function safeStorageError(error) {
   const code = error instanceof ConfigRepositoryError ? error.code : "repository_failure";