@jeffusion/bungee-core 6.4.1 → 6.5.0

package/dist/config-storage-worker.js

@@ -213,7 +213,7 @@ function copyJsonValue(value, path, context) {
   context.add("non_json_value", path, "Expected a JSON-compatible value");
   return;
 }
-function normalizePositions(values, path, context) {
+function normalizePositions(values, path, context, itemPath = (index) => `${path}[${index}]`) {
   const reserved = new Set;
   const seen = new Set;
   for (const value of values) {
@@ -224,7 +224,7 @@ function normalizePositions(values, path, context) {
   return values.map((value, index) => {
     if (isObject(value) && typeof value.position === "number" && Number.isSafeInteger(value.position) && value.position >= 0) {
       if (seen.has(value.position)) {
-        context.add("duplicate_position", `${path}[${index}].position`, "Position must be unique within its owner");
+        context.add("duplicate_position", `${itemPath(index)}.position`, "Position must be unique within its owner");
       }
       seen.add(value.position);
       return value.position;
@@ -566,8 +566,6 @@ function defaultMenuGroup(id) {
 }
 // src/config-storage/gateway-target-validation.ts
 function validateGatewayTargets(config, schemas, context) {
-  if (!schemas)
-    return;
   const routes = new Map(config.routes.map((route) => [route.id, route]));
   const services = new Map(config.services.map((service) => [service.id, service]));
   const edges = new Map;
@@ -593,39 +591,52 @@ function validateGatewayTargets(config, schemas, context) {
     plugins.forEach((plugin, index) => {
       if (!plugin.enabled)
         return;
-      for (const field of schemas.get(plugin.name) ?? [])
+      for (const field of schemas?.get(plugin.name) ?? [])
         visit(plugin.options?.[field.name], field, owner, `${path}[${index}].options.${field.name}`);
     });
   };
-  config.routes.forEach((route, index) => {
-    const owner = `route:${route.id}`;
-    bindings(route.plugins, owner, `routes[${index}].plugins`);
-    if (route.service_id) {
+  const references = (values, owner, path) => {
+    for (const [index, reference] of (values ?? []).entries()) {
+      const target = `service:${reference.service_id}`;
+      if (!services.has(reference.service_id))
+        context.add("unknown_service", `${path}[${index}].service_id`, "Service does not exist");
+      if (target === owner)
+        context.add("invalid_value", `${path}[${index}].service_id`, "Service cannot reference itself");
       const refs = edges.get(owner) ?? new Set;
-      refs.add(`service:${route.service_id}`);
+      refs.add(target);
       edges.set(owner, refs);
     }
-  });
-  config.services.forEach((service, index) => bindings(service.plugins, `service:${service.id}`, `services[${index}].plugins`));
-  const active = new Set, done = new Set;
-  const walk = (owner) => {
-    if (active.has(owner))
-      return false;
-    if (done.has(owner))
-      return true;
-    active.add(owner);
-    for (const target of edges.get(owner) ?? [])
-      if (!walk(target))
-        return false;
-    active.delete(owner);
-    done.add(owner);
-    return true;
   };
-  for (const owner of edges.keys())
-    if (!walk(owner)) {
-      context.add("invalid_value", "routes", "Internal dispatch cycle");
-      break;
+  config.routes.forEach((route, index) => {
+    const owner = `route:${route.id}`;
+    bindings(route.plugins, owner, `routes[${index}].plugins`);
+    references(route.service_references, owner, `routes[${index}].service_references`);
+    route.endpoints?.forEach((upstream, i) => bindings(upstream.plugins, owner, `routes[${index}].endpoints[${i}].plugins`));
+  });
+  config.services.forEach((service, index) => {
+    const owner = `service:${service.id}`;
+    bindings(service.plugins, owner, `services[${index}].plugins`);
+    references(service.service_references, owner, `services[${index}].service_references`);
+    service.endpoints.forEach((upstream, i) => bindings(upstream.plugins, owner, `services[${index}].endpoints[${i}].plugins`));
+  });
+  const incoming = new Map;
+  for (const [owner, targets] of edges) {
+    if (!incoming.has(owner))
+      incoming.set(owner, 0);
+    for (const target of targets)
+      incoming.set(target, (incoming.get(target) ?? 0) + 1);
+  }
+  const ready = [...incoming].filter(([, count]) => count === 0).map(([owner]) => owner);
+  for (let index = 0;index < ready.length; index++) {
+    for (const target of edges.get(ready[index]) ?? []) {
+      const count = incoming.get(target) - 1;
+      incoming.set(target, count);
+      if (count === 0)
+        ready.push(target);
     }
+  }
+  if (ready.length !== incoming.size)
+    context.add("invalid_value", "routes", "Internal dispatch cycle");
 }
 
 // ../../node_modules/acorn/dist/acorn.mjs
@@ -6458,6 +6469,131 @@ function validateDirectionalModificationRules(object, path, context) {
   }
 }
 
+// src/config-storage/service-policy-validation.ts
+var HEALTH_FIELDS = [
+  "enabled",
+  "interval_ms",
+  "timeout_ms",
+  "path",
+  "method",
+  "expected_status",
+  "unhealthy_threshold",
+  "healthy_threshold",
+  "body",
+  "content_type",
+  "headers",
+  "query",
+  "auto_enable_on_active_health_check"
+];
+var FAILOVER_FIELDS = ["enabled", "retry_on", "retry_on_response", "passive_health", "recovery", "slow_start"];
+function validateHealth(value, path, context) {
+  const object = objectField(value, path, HEALTH_FIELDS, context);
+  if (!object)
+    return;
+  booleanField(object, "enabled", path, context);
+  for (const field of ["interval_ms", "timeout_ms", "unhealthy_threshold", "healthy_threshold"]) {
+    numberField(object, field, path, context, { positive: true });
+  }
+  for (const field of ["path", "method", "body", "content_type"])
+    optionalString(object, field, path, context);
+  if (object.expected_status !== undefined) {
+    if (!Array.isArray(object.expected_status))
+      context.add("invalid_type", `${path}.expected_status`, "Expected an array");
+    else
+      object.expected_status.forEach((item, index) => {
+        validateStatus(item, `${path}.expected_status[${index}]`, context);
+      });
+  }
+  if (object.headers !== undefined)
+    stringRecord(object.headers, `${path}.headers`, context);
+  if (object.query !== undefined)
+    stringRecord(object.query, `${path}.query`, context);
+  optionalBoolean(object, "auto_enable_on_active_health_check", path, context);
+}
+function validateStatus(value, path, context) {
+  if (typeof value !== "number" || !Number.isInteger(value) || value < 100 || value > 599) {
+    context.add("invalid_value", path, "Expected an HTTP status");
+  }
+}
+function validateRetryOn(value, path, context) {
+  const valid = (item) => typeof item === "string" || typeof item === "number" && Number.isFinite(item);
+  if (Array.isArray(value)) {
+    value.forEach((item, index) => {
+      if (!valid(item))
+        context.add("invalid_type", `${path}[${index}]`, "Expected a string or number");
+    });
+  } else if (!valid(value))
+    context.add("invalid_type", path, "Expected a string, number, or array");
+}
+function validatePositiveObject(value, path, fields, context) {
+  const object = objectField(value, path, fields, context);
+  if (object)
+    fields.forEach((field) => {
+      numberField(object, field, path, context, { positive: true });
+    });
+  return object;
+}
+function validateFailover(value, path, context) {
+  const object = objectField(value, path, FAILOVER_FIELDS, context);
+  if (!object)
+    return;
+  booleanField(object, "enabled", path, context);
+  if (object.retry_on !== undefined)
+    validateRetryOn(object.retry_on, `${path}.retry_on`, context);
+  if (object.retry_on_response !== undefined)
+    stringArray(object.retry_on_response, `${path}.retry_on_response`, context);
+  validatePositiveObject(object.passive_health, `${path}.passive_health`, ["consecutive_failures", "healthy_successes", "auto_disable_threshold"], context);
+  validatePositiveObject(object.recovery, `${path}.recovery`, ["backoff_base_ms", "probe_timeout_ms"], context);
+  const slow = objectField(object.slow_start, `${path}.slow_start`, ["enabled", "duration_ms", "initial_weight_factor"], context);
+  if (!slow)
+    return;
+  booleanField(slow, "enabled", `${path}.slow_start`, context);
+  numberField(slow, "duration_ms", `${path}.slow_start`, context, { positive: true });
+  const factor = slow.initial_weight_factor;
+  if (factor !== undefined && (typeof factor !== "number" || !Number.isFinite(factor) || factor <= 0 || factor > 1)) {
+    context.add("invalid_value", `${path}.slow_start.initial_weight_factor`, "Expected a finite number in (0, 1]");
+  }
+}
+function validateLoadBalancing(value, path, context) {
+  const object = objectField(value, path, ["policy", "hash_policy"], context);
+  if (!object)
+    return;
+  const policies = new Set(["weighted_random", "round_robin", "least_requests", "consistent_hash"]);
+  if (typeof object.policy !== "string" || !policies.has(object.policy)) {
+    context.add("invalid_load_balancing", `${path}.policy`, "Unsupported load balancing policy");
+  }
+  const hash = objectField(object.hash_policy, `${path}.hash_policy`, ["header", "expression"], context);
+  if (hash) {
+    optionalString(hash, "header", `${path}.hash_policy`, context);
+    validateExpressionSyntax(hash.expression, `${path}.hash_policy.expression`, context);
+  }
+  if (object.policy === "consistent_hash") {
+    const header = typeof hash?.header === "string" ? hash.header.trim() : "";
+    const expression = typeof hash?.expression === "string" ? hash.expression.trim() : "";
+    const headerShapeValid = hash?.header === undefined || typeof hash.header === "string";
+    const expressionShapeValid = hash?.expression === undefined || typeof hash.expression === "string";
+    if (!header && !expression && headerShapeValid && expressionShapeValid) {
+      context.add("invalid_load_balancing", `${path}.hash_policy`, "Hash input is required");
+    }
+  }
+}
+function validateServicePolicies(object, path, context) {
+  validateHealth(object.health_check, `${path}.health_check`, context);
+  validateFailover(object.failover, `${path}.failover`, context);
+  validateLoadBalancing(object.load_balancing, `${path}.load_balancing`, context);
+}
+function validateServiceSelectionPolicies(object, path, context) {
+  validateLoadBalancing(object.load_balancing, `${path}.load_balancing`, context);
+  const failover = objectField(object.failover, `${path}.failover`, ["enabled", "retry_on", "retry_on_response"], context);
+  if (!failover)
+    return;
+  booleanField(failover, "enabled", `${path}.failover`, context);
+  if (failover.retry_on !== undefined)
+    validateRetryOn(failover.retry_on, `${path}.failover.retry_on`, context);
+  if (failover.retry_on_response !== undefined)
+    stringArray(failover.retry_on_response, `${path}.failover.retry_on_response`, context);
+}
+
 // src/config-storage/route-policy-validation.ts
 function validatePathRewrite(value, path, context) {
   if (value === undefined)
@@ -6611,6 +6747,7 @@ function validateRetry(value, path, context) {
   numberField(object, "per_retry_timeout_ms", path, context, { positive: true });
 }
 function validateRoutePolicies(object, path, context) {
+  validateServiceSelectionPolicies(object, path, context);
   validatePathRewrite(object.path_rewrite, `${path}.path_rewrite`, context);
   validateAuth(object.auth, `${path}.auth`, context);
   const websocket = objectField(object.websocket, `${path}.websocket`, ["enabled"], context);
@@ -6644,120 +6781,6 @@ function validateRoutePolicies(object, path, context) {
   validateRetry(object.retry, `${path}.retry`, context);
 }
 
-// src/config-storage/service-policy-validation.ts
-var HEALTH_FIELDS = [
-  "enabled",
-  "interval_ms",
-  "timeout_ms",
-  "path",
-  "method",
-  "expected_status",
-  "unhealthy_threshold",
-  "healthy_threshold",
-  "body",
-  "content_type",
-  "headers",
-  "query",
-  "auto_enable_on_active_health_check"
-];
-var FAILOVER_FIELDS = ["enabled", "retry_on", "retry_on_response", "passive_health", "recovery", "slow_start"];
-function validateHealth(value, path, context) {
-  const object = objectField(value, path, HEALTH_FIELDS, context);
-  if (!object)
-    return;
-  booleanField(object, "enabled", path, context);
-  for (const field of ["interval_ms", "timeout_ms", "unhealthy_threshold", "healthy_threshold"]) {
-    numberField(object, field, path, context, { positive: true });
-  }
-  for (const field of ["path", "method", "body", "content_type"])
-    optionalString(object, field, path, context);
-  if (object.expected_status !== undefined) {
-    if (!Array.isArray(object.expected_status))
-      context.add("invalid_type", `${path}.expected_status`, "Expected an array");
-    else
-      object.expected_status.forEach((item, index) => {
-        validateStatus(item, `${path}.expected_status[${index}]`, context);
-      });
-  }
-  if (object.headers !== undefined)
-    stringRecord(object.headers, `${path}.headers`, context);
-  if (object.query !== undefined)
-    stringRecord(object.query, `${path}.query`, context);
-  optionalBoolean(object, "auto_enable_on_active_health_check", path, context);
-}
-function validateStatus(value, path, context) {
-  if (typeof value !== "number" || !Number.isInteger(value) || value < 100 || value > 599) {
-    context.add("invalid_value", path, "Expected an HTTP status");
-  }
-}
-function validateRetryOn(value, path, context) {
-  const valid = (item) => typeof item === "string" || typeof item === "number" && Number.isFinite(item);
-  if (Array.isArray(value)) {
-    value.forEach((item, index) => {
-      if (!valid(item))
-        context.add("invalid_type", `${path}[${index}]`, "Expected a string or number");
-    });
-  } else if (!valid(value))
-    context.add("invalid_type", path, "Expected a string, number, or array");
-}
-function validatePositiveObject(value, path, fields, context) {
-  const object = objectField(value, path, fields, context);
-  if (object)
-    fields.forEach((field) => {
-      numberField(object, field, path, context, { positive: true });
-    });
-  return object;
-}
-function validateFailover(value, path, context) {
-  const object = objectField(value, path, FAILOVER_FIELDS, context);
-  if (!object)
-    return;
-  booleanField(object, "enabled", path, context);
-  if (object.retry_on !== undefined)
-    validateRetryOn(object.retry_on, `${path}.retry_on`, context);
-  if (object.retry_on_response !== undefined)
-    stringArray(object.retry_on_response, `${path}.retry_on_response`, context);
-  validatePositiveObject(object.passive_health, `${path}.passive_health`, ["consecutive_failures", "healthy_successes", "auto_disable_threshold"], context);
-  validatePositiveObject(object.recovery, `${path}.recovery`, ["backoff_base_ms", "probe_timeout_ms"], context);
-  const slow = objectField(object.slow_start, `${path}.slow_start`, ["enabled", "duration_ms", "initial_weight_factor"], context);
-  if (!slow)
-    return;
-  booleanField(slow, "enabled", `${path}.slow_start`, context);
-  numberField(slow, "duration_ms", `${path}.slow_start`, context, { positive: true });
-  const factor = slow.initial_weight_factor;
-  if (factor !== undefined && (typeof factor !== "number" || !Number.isFinite(factor) || factor <= 0 || factor > 1)) {
-    context.add("invalid_value", `${path}.slow_start.initial_weight_factor`, "Expected a finite number in (0, 1]");
-  }
-}
-function validateLoadBalancing(value, path, context) {
-  const object = objectField(value, path, ["policy", "hash_policy"], context);
-  if (!object)
-    return;
-  const policies = new Set(["weighted_random", "round_robin", "least_requests", "consistent_hash"]);
-  if (typeof object.policy !== "string" || !policies.has(object.policy)) {
-    context.add("invalid_load_balancing", `${path}.policy`, "Unsupported load balancing policy");
-  }
-  const hash = objectField(object.hash_policy, `${path}.hash_policy`, ["header", "expression"], context);
-  if (hash) {
-    optionalString(hash, "header", `${path}.hash_policy`, context);
-    validateExpressionSyntax(hash.expression, `${path}.hash_policy.expression`, context);
-  }
-  if (object.policy === "consistent_hash") {
-    const header = typeof hash?.header === "string" ? hash.header.trim() : "";
-    const expression = typeof hash?.expression === "string" ? hash.expression.trim() : "";
-    const headerShapeValid = hash?.header === undefined || typeof hash.header === "string";
-    const expressionShapeValid = hash?.expression === undefined || typeof hash.expression === "string";
-    if (!header && !expression && headerShapeValid && expressionShapeValid) {
-      context.add("invalid_load_balancing", `${path}.hash_policy`, "Hash input is required");
-    }
-  }
-}
-function validateServicePolicies(object, path, context) {
-  validateHealth(object.health_check, `${path}.health_check`, context);
-  validateFailover(object.failover, `${path}.failover`, context);
-  validateLoadBalancing(object.load_balancing, `${path}.load_balancing`, context);
-}
-
 // src/config-storage/domain-validation.ts
 var AUTH_FIELDS = ["enabled", "tokens"];
 function validateAuth(value, path, context) {
@@ -6811,7 +6834,7 @@ function validateUpstreamDomain(object, path, context) {
 }
 function validateServiceDomain(object, path, endpointCount, context) {
   if (endpointCount === 0)
-    context.add("empty_service", `${path}.endpoints`, "Service requires at least one upstream");
+    context.add("empty_service", `${path}.endpoints`, "Service requires at least one upstream or service reference");
   validateServicePolicies(object, path, context);
 }
 function validateRouteDomain(object, path, hasService, endpointCount, context) {
@@ -7234,7 +7257,9 @@ var ROUTE_KEYS = [
   "direct_response",
   "redirect",
   "retry",
-  "websocket"
+  "websocket",
+  "load_balancing",
+  "failover"
 ];
 var UPSTREAM_KEYS = ["request", "response", "description", "condition"];
 var ENTITY_KEYS = ["id", "position", "plugins"];
@@ -7243,8 +7268,8 @@ function allowed(...groups) {
 }
 var ROOT_FIELDS = allowed(GLOBAL_KEYS, ["services", "routes", "plugins"]);
 var PLUGIN_FIELDS = allowed(ENTITY_KEYS, ["name", "options", "enabled", "path"]);
-var SERVICE_FIELDS = allowed(ENTITY_KEYS, SERVICE_KEYS, ["name", "endpoints"]);
-var ROUTE_FIELDS = allowed(ENTITY_KEYS, ROUTE_KEYS, ["path", "service_id", "service", "endpoints"]);
+var SERVICE_FIELDS = allowed(ENTITY_KEYS, SERVICE_KEYS, ["name", "endpoints", "service_references"]);
+var ROUTE_FIELDS = allowed(ENTITY_KEYS, ROUTE_KEYS, ["path", "service_references", "endpoints"]);
 var UPSTREAM_FIELDS = allowed(ENTITY_KEYS, UPSTREAM_KEYS, [
   "target",
   "weight",
@@ -7339,10 +7364,10 @@ function booleanDefault(object, key, fallback, path, context) {
   context.add("invalid_type", `${path}.${key}`, "Expected a boolean");
   return fallback;
 }
-function parseUpstreams(value, path, catalog, context, present = false) {
+function parseUpstreams(value, path, catalog, context, present = false, sharedPositions) {
   const upstreams = [];
   const candidates = context.array(value, path, present);
-  const positions = normalizePositions(candidates, path, context);
+  const positions = sharedPositions ?? normalizePositions(candidates, path, context);
   candidates.forEach((candidate, index) => {
     const itemPath = `${path}[${index}]`;
     const object = context.object(candidate, itemPath);
@@ -7370,13 +7395,44 @@ function parseUpstreams(value, path, catalog, context, present = false) {
   });
   return upstreams.sort((left, right) => left.position - right.position);
 }
-function parseServices(value, catalog, context) {
-  const services = [];
-  const names = new Set;
-  const candidates = context.array(value, "services", value !== undefined);
-  const positions = normalizePositions(candidates, "services", context);
-  candidates.forEach((candidate, index) => {
-    const path = `services[${index}]`;
+var REFERENCE_FIELDS = new Set(["id", "position", "service_id", "weight", "priority", "is_disabled"]);
+function parseReferences(value, path, context, positions, present = false) {
+  const candidates = context.array(value, path, present);
+  const normalized = positions ?? normalizePositions(candidates, path, context);
+  const targets = new Set;
+  return candidates.flatMap((candidate, index) => {
+    const itemPath = `${path}[${index}]`;
+    const object = context.object(candidate, itemPath);
+    if (!object)
+      return [];
+    rejectUnknownFields(object, REFERENCE_FIELDS, itemPath, context);
+    const serviceId = context.string(object, "service_id", `${itemPath}.service_id`);
+    if (!isLowercaseUuid(serviceId))
+      context.add("invalid_uuid", `${itemPath}.service_id`, "Expected a lowercase UUID");
+    if (targets.has(serviceId))
+      context.add("invalid_value", `${itemPath}.service_id`, "Service reference must be unique within its owner");
+    targets.add(serviceId);
+    for (const key of ["weight", "priority"])
+      if (typeof object[key] === "number" && object[key] <= 0) {
+        context.add("invalid_positive_number", `${itemPath}.${key}`, "Expected a positive number");
+      }
+    return [{
+      id: context.id(object, `${itemPath}.id`),
+      position: context.position(object, normalized[index], `${itemPath}.position`),
+      service_id: serviceId,
+      weight: numberDefault(object, "weight", 100, itemPath, context),
+      priority: numberDefault(object, "priority", 1, itemPath, context),
+      is_disabled: booleanDefault(object, "is_disabled", false, itemPath, context)
+    }];
+  }).sort((left, right) => left.position - right.position);
+}
+function parseServices(value, catalog, context) {
+  const services = [];
+  const names = new Set;
+  const candidates = context.array(value, "services", value !== undefined);
+  const positions = normalizePositions(candidates, "services", context);
+  candidates.forEach((candidate, index) => {
+    const path = `services[${index}]`;
     const object = context.object(candidate, path);
     if (!object)
       return;
@@ -7387,7 +7443,11 @@ function parseServices(value, catalog, context) {
       context.add("duplicate_name", `${path}.name`, "Service name must be unique");
     else
       names.add(name);
-    const endpointCount = Array.isArray(object.endpoints) ? object.endpoints.length : 0;
+    const endpointCandidates = Array.isArray(object.endpoints) ? object.endpoints : [];
+    const referenceCandidates = Array.isArray(object.service_references) ? object.service_references : [];
+    const sharedPositions = normalizePositions([...endpointCandidates, ...referenceCandidates], path, context, (index) => index < endpointCandidates.length ? `${path}.endpoints[${index}]` : `${path}.service_references[${index - endpointCandidates.length}]`);
+    const references = parseReferences(object.service_references, `${path}.service_references`, context, sharedPositions.slice(endpointCandidates.length), "service_references" in object);
+    const endpointCount = endpointCandidates.length + references.length;
     const policies = copyKnown(object, SERVICE_KEYS, path, context);
     validateServiceDomain(object, path, endpointCount, context);
     services.push({
@@ -7395,13 +7455,14 @@ function parseServices(value, catalog, context) {
       id,
       position: context.position(object, positions[index], `${path}.position`),
       name,
-      endpoints: parseUpstreams(object.endpoints, `${path}.endpoints`, catalog, context, "endpoints" in object),
+      endpoints: parseUpstreams(object.endpoints, `${path}.endpoints`, catalog, context, "endpoints" in object, sharedPositions),
+      ...references.length ? { service_references: references } : {},
       plugins: parsePlugins(object.plugins, `${path}.plugins`, catalog, context, "plugins" in object)
     });
   });
   return services.sort((left, right) => left.position - right.position);
 }
-function parseRoutes(value, serviceIds, catalog, context) {
+function parseRoutes(value, catalog, context) {
   const routes = [];
   const paths = new Set;
   const candidates = context.array(value, "routes", value !== undefined);
@@ -7418,14 +7479,13 @@ function parseRoutes(value, serviceIds, catalog, context) {
       context.add("duplicate_path", `${itemPath}.path`, "Route path must be unique");
     else
       paths.add(path);
-    const serviceId = object.service_id;
-    const hasService = serviceId !== undefined;
+    const references = parseReferences(object.service_references, `${itemPath}.service_references`, context, undefined, "service_references" in object);
+    const hasService = references.length > 0;
+    if ("service_references" in object && !hasService)
+      context.add("invalid_value", `${itemPath}.service_references`, "Service route requires at least one reference");
     const endpointCount = Array.isArray(object.endpoints) ? object.endpoints.length : 0;
     const policies = copyKnown(object, ROUTE_KEYS, itemPath, context);
     validateRouteDomain(object, itemPath, hasService, endpointCount, context);
-    validateServiceReference(serviceId, itemPath, serviceIds, context);
-    if ("service" in object)
-      context.add("invalid_value", `${itemPath}.service`, "Use service_id");
     if (hasService && object.endpoints !== undefined) {
       context.add("conflicting_owner", `${itemPath}.endpoints`, "A service route cannot own upstreams");
     }
@@ -7437,22 +7497,12 @@ function parseRoutes(value, serviceIds, catalog, context) {
       plugins: parsePlugins(object.plugins, `${itemPath}.plugins`, catalog, context, "plugins" in object)
     };
     if (hasService)
-      routes.push({ ...base, service_id: typeof serviceId === "string" ? serviceId : "" });
+      routes.push({ ...base, service_references: references });
     else
       routes.push({ ...base, endpoints: parseUpstreams(object.endpoints, `${itemPath}.endpoints`, catalog, context, "endpoints" in object) });
   });
   return routes.sort((left, right) => left.position - right.position);
 }
-function validateServiceReference(value, path, serviceIds, context) {
-  if (value === undefined)
-    return;
-  if (typeof value !== "string")
-    context.add("invalid_type", `${path}.service_id`, "Expected a UUID string");
-  else if (!isLowercaseUuid(value))
-    context.add("invalid_uuid", `${path}.service_id`, "Expected a lowercase UUID");
-  else if (!serviceIds.has(value))
-    context.add("unknown_service", `${path}.service_id`, "Service does not exist");
-}
 function parseNormalizeCompile(input, options) {
   const context = new ValidationContext;
   const safeInput = preflightJsonGraph(input, context);
@@ -7474,11 +7524,10 @@ function parseNormalizeCompile(input, options) {
   const catalog = options?.availablePlugins === undefined ? options?.pluginSchemas : new Map([...options.pluginSchemas].filter(([name]) => options.availablePlugins?.has(name)));
   const plugins = parsePlugins(root.plugins, "plugins", catalog, context, "plugins" in root);
   const services = parseServices(root.services, catalog, context);
-  const serviceIds = new Set(services.map(({ id }) => id));
   const value = {
     ...policies,
     services,
-    routes: parseRoutes(root.routes, serviceIds, catalog, context),
+    routes: parseRoutes(root.routes, catalog, context),
     plugins
   };
   validateGatewayTargets(value, catalog, context);
@@ -8676,16 +8725,12 @@ function writeUpstreams(db, upstreams, owner) {
   }
 }
 function servicePolicy(service) {
-  const { id, position, name, endpoints, plugins, ...policy } = service;
+  const { id, position, name, endpoints, service_references, plugins, ...policy } = service;
   return policy;
 }
 function routePolicy(route) {
   const { id, position, path, plugins, ...remainder } = route;
-  if ("service_id" in remainder) {
-    const { service_id, ...policy } = remainder;
-    return policy;
-  }
-  const { endpoints, ...policy } = remainder;
+  const { endpoints, service_references, ...policy } = remainder;
   return policy;
 }
 function writeServices(db, services) {
@@ -8702,12 +8747,10 @@ function writeServices(db, services) {
 }
 function writeRoutes(db, routes) {
   for (const route of routes) {
-    const serviceId = typeof route.service_id === "string" ? route.service_id : null;
-    db.run("INSERT INTO routes (id,position,path,service_id,policy_json) VALUES (?,?,?,?,?)", [
+    db.run("INSERT INTO routes (id,position,path,policy_json) VALUES (?,?,?,?)", [
       route.id,
       route.position,
       route.path,
-      serviceId,
       canonicalJson(routePolicy(route))
     ]);
     if (route.endpoints !== undefined)
@@ -8716,6 +8759,8 @@ function writeRoutes(db, routes) {
   }
 }
 function replaceActiveMaterialization(db, aggregate) {
+  if (db.query("SELECT 1 FROM sqlite_schema WHERE name='service_references'").get())
+    db.run("DELETE FROM service_references");
   db.run("DELETE FROM plugin_bindings");
   db.run("DELETE FROM plugin_activations");
   db.run("DELETE FROM upstreams");
@@ -8736,11 +8781,30 @@ function replaceActiveMaterialization(db, aggregate) {
   ]);
   writeServices(db, logical.services);
   writeRoutes(db, logical.routes);
+  for (const service of logical.services)
+    writeReferences(db, service.service_references ?? [], "service", service.id);
+  for (const route of logical.routes)
+    writeReferences(db, route.service_references ?? [], "route", route.id);
   writeBindings(db, logical.plugins, { kind: "global", id: "" });
   for (const activation of aggregate.plugin_activations) {
     db.run("INSERT INTO plugin_activations (plugin_name) VALUES (?)", [activation.plugin_name]);
   }
 }
+function writeReferences(db, references, ownerKind, ownerId) {
+  for (const ref of references)
+    db.run(`INSERT INTO service_references
+    (id,owner_kind,owner_service_id,route_id,position,service_id,weight,priority,is_disabled) VALUES(?,?,?,?,?,?,?,?,?)`, [
+      ref.id,
+      ownerKind,
+      ownerKind === "service" ? ownerId : null,
+      ownerKind === "route" ? ownerId : null,
+      ref.position,
+      ref.service_id,
+      ref.weight,
+      ref.priority,
+      ref.is_disabled ? 1 : 0
+    ]);
+}
 
 // src/config-storage/recovery-store.ts
 var RECOVERY_MAX_ATTEMPTS = 6;
@@ -9279,520 +9343,261 @@ function commitTransaction(db, prepared, options, snapshot, offlineManagement =
   } };
 }
 
-// src/config-storage/schema-fingerprint.ts
-import { Database } from "bun:sqlite";
+// src/config-storage/service-reference-upgrade.ts
+import { randomUUID as randomUUID2 } from "crypto";
 
-// src/database-schema.ts
-function pragmaName(name) {
-  return `'${name.replaceAll("'", "''")}'`;
+// src/config-storage/persisted-json.ts
+function parseCanonicalObject(text, field, reserved = new Set) {
+  try {
+    const value = JSON.parse(text);
+    if (value === null || typeof value !== "object" || Array.isArray(value)) {
+      throw new TypeError("expected a JSON object");
+    }
+    if (text !== canonicalJson(value))
+      throw new TypeError("expected canonical JSON text");
+    const entries = Object.entries(value);
+    const key = entries.find(([name]) => reserved.has(name))?.[0];
+    if (key !== undefined)
+      throw new TypeError(`reserved key ${key}`);
+    return Object.fromEntries(entries);
+  } catch (error) {
+    throw new ConfigRepositoryError("schema_corrupt", `${field} is invalid`, error);
+  }
 }
-function normalizedSql(sql) {
-  return (sql ?? "").match(/'(?:''|[^'])*'|"(?:""|[^"])*"|`[^`]*`|\[[^\]]*\]|[^'"`\[]+/g)?.map((token) => /^['"`\[]/.test(token) ? token : token.replace(/\s+/g, " ")).join("").trim() ?? "";
+
+// src/config-storage/relation-materialization.ts
+var UPSTREAM_RESERVED = new Set(["id", "position", "target", "weight", "priority", "is_disabled", "plugins"]);
+function bindingValue(row) {
+  requireUuid(row.id, "plugin_bindings.id");
+  const scopeKind = requireOneOf(row.scope_kind, ["global", "service", "route", "upstream"], "plugin_bindings.scope_kind");
+  const compatibleOwner = scopeKind === "global" ? row.scope_owner === "" && row.service_id === null && row.route_id === null && row.upstream_id === null : scopeKind === "service" ? row.scope_owner === row.service_id && row.service_id !== null && row.route_id === null && row.upstream_id === null : scopeKind === "route" ? row.scope_owner === row.route_id && row.route_id !== null && row.service_id === null && row.upstream_id === null : row.scope_owner === row.upstream_id && row.upstream_id !== null && row.service_id === null && row.route_id === null;
+  if (!compatibleOwner)
+    throw new ConfigRepositoryError("schema_corrupt", "plugin binding owner is invalid");
+  if (scopeKind !== "global")
+    requireUuid(row.scope_owner, "plugin_bindings.scope_owner");
+  return {
+    id: row.id,
+    position: requireSafeInteger(row.position, "plugin_bindings.position"),
+    name: requirePluginName(row.plugin_name, "plugin_bindings.plugin_name"),
+    ...row.options_json === null ? {} : { options: parseCanonicalObject(row.options_json, "options_json") },
+    enabled: requireBooleanInteger(row.enabled, "plugin_bindings.enabled")
+  };
 }
-function indexDescriptor(db, table) {
-  const indexes = sqliteAll(db, 'SELECT name,"unique",origin,partial FROM pragma_index_list(?)', table);
-  return indexes.map((index) => ({
-    unique: index.unique,
-    origin: index.origin,
-    partial: index.partial,
-    columns: sqliteAll(db, `PRAGMA index_xinfo(${pragmaName(index.name)})`).map(({ seqno, cid, name, desc, coll, key }) => ({ seqno, cid, name, desc, coll, key }))
-  })).sort((left, right) => canonicalJson(left).localeCompare(canonicalJson(right)));
+function groupBindings(rows) {
+  const groups = new Map;
+  for (const row of rows) {
+    const key = `${row.scope_kind}:${row.scope_owner}`;
+    const values = groups.get(key) ?? [];
+    values.push(bindingValue(row));
+    groups.set(key, values);
+  }
+  return groups;
 }
-function databaseSchemaDescriptor(db) {
-  const definitions = new Map(sqliteAll(db, `SELECT name,sql FROM sqlite_schema
-    WHERE type='table' AND name NOT LIKE 'sqlite_%'`).map((row) => [row.name, row.sql]));
-  const tables = sqliteAll(db, `SELECT name,type,ncol,wr,strict FROM pragma_table_list
-    WHERE schema='main' AND name NOT LIKE 'sqlite_%' ORDER BY name`);
-  const objects = sqliteAll(db, `SELECT type,name,tbl_name,sql
-    FROM sqlite_schema WHERE name NOT LIKE 'sqlite_%' ORDER BY type,name`).map((row) => ({
-    type: row.type,
+function takeGroup(groups, key) {
+  const values = groups.get(key) ?? [];
+  groups.delete(key);
+  return values;
+}
+function groupUpstreams(rows, bindings) {
+  const groups = new Map;
+  for (const row of rows) {
+    requireUuid(row.id, "upstreams.id");
+    const ownerKind = requireOneOf(row.owner_kind, ["service", "route"], "upstreams.owner_kind");
+    if (ownerKind === "service" && row.route_id !== null || ownerKind === "route" && row.service_id !== null) {
+      throw new ConfigRepositoryError("schema_corrupt", "upstream has incompatible owners");
+    }
+    const ownerId = ownerKind === "service" ? row.service_id : row.route_id;
+    if (ownerId === null)
+      throw new ConfigRepositoryError("schema_corrupt", "upstream owner is missing");
+    requireUuid(ownerId, "upstreams.owner_id");
+    const key = `${ownerKind}:${ownerId}`;
+    const values = groups.get(key) ?? [];
+    values.push({
+      ...parseCanonicalObject(row.policy_json, "upstream policy_json", UPSTREAM_RESERVED),
+      id: row.id,
+      position: requireSafeInteger(row.position, "upstreams.position"),
+      target: row.target,
+      weight: requirePositiveFinite(row.weight, "upstreams.weight"),
+      priority: requirePositiveFinite(row.priority, "upstreams.priority"),
+      is_disabled: requireBooleanInteger(row.is_disabled, "upstreams.is_disabled"),
+      plugins: takeGroup(bindings, `upstream:${row.id}`)
+    });
+    groups.set(key, values);
+  }
+  return groups;
+}
+
+// src/config-storage/read-materialization.ts
+var SERVICE_RESERVED = new Set(["id", "position", "name", "endpoints", "service_references", "plugins"]);
+var ROUTE_RESERVED = new Set(["id", "position", "path", "service_id", "service", "service_references", "endpoints", "plugins"]);
+function readSettings(db) {
+  const hasPublication = sqliteAll(db, "PRAGMA table_info(settings)").some(({ name }) => name === "publication_json");
+  const rows = sqliteAll(db, `SELECT log_level,body_parser_limit,auth_json,logging_json${hasPublication ? ",publication_json" : ",NULL AS publication_json"} FROM settings`);
+  const row = rows[0];
+  if (rows.length !== 1 || row === undefined)
+    throw new ConfigRepositoryError("schema_corrupt", "settings singleton is broken");
+  return {
+    ...row.log_level === null ? {} : { log_level: requireOptionalGlobalScalar(row.log_level, "log_level") },
+    ...row.body_parser_limit === null ? {} : {
+      body_parser_limit: requireOptionalGlobalScalar(row.body_parser_limit, "body_parser_limit")
+    },
+    ...row.auth_json === null ? {} : { auth: parseCanonicalObject(row.auth_json, "auth_json") },
+    ...row.logging_json === null ? {} : { logging: parseCanonicalObject(row.logging_json, "logging_json") },
+    ...row.publication_json === null ? {} : { publication: parseCanonicalObject(row.publication_json, "publication_json") }
+  };
+}
+function readRawActiveAggregate(db) {
+  const references = new Map;
+  for (const row of sqliteAll(db, "SELECT id,owner_kind,owner_service_id,route_id,position,service_id,weight,priority,is_disabled FROM service_references ORDER BY owner_kind,position")) {
+    const ownerKind = requireOneOf(row.owner_kind, ["service", "route"], "service_references.owner_kind");
+    const ownerId = ownerKind === "service" ? row.owner_service_id : row.route_id;
+    if (ownerId === null || (ownerKind === "service" ? row.route_id !== null : row.owner_service_id !== null)) {
+      throw new ConfigRepositoryError("schema_corrupt", "service reference owner is invalid");
+    }
+    const key = `${ownerKind}:${requireUuid(ownerId, "service_references.owner_id")}`;
+    const values = references.get(key) ?? [];
+    values.push({
+      id: requireUuid(row.id, "service_references.id"),
+      position: requireSafeInteger(row.position, "service_references.position"),
+      service_id: requireUuid(row.service_id, "service_references.service_id"),
+      weight: requirePositiveFinite(row.weight, "service_references.weight"),
+      priority: requirePositiveFinite(row.priority, "service_references.priority"),
+      is_disabled: requireBooleanInteger(row.is_disabled, "service_references.is_disabled")
+    });
+    references.set(key, values);
+  }
+  const takeReferences = (key) => {
+    const values = references.get(key);
+    references.delete(key);
+    return values?.length ? { service_references: values } : {};
+  };
+  const bindings = groupBindings(sqliteAll(db, `SELECT id,scope_kind,scope_owner,service_id,route_id,
+    upstream_id,position,plugin_name,options_json,enabled FROM plugin_bindings ORDER BY scope_kind,scope_owner,position`));
+  const upstreams = groupUpstreams(sqliteAll(db, `SELECT id,owner_kind,service_id,route_id,
+    position,target,weight,priority,is_disabled,policy_json FROM upstreams ORDER BY owner_kind,position`), bindings);
+  const services = sqliteAll(db, "SELECT id,position,name,policy_json FROM services ORDER BY position").map((row) => ({
+    ...parseCanonicalObject(row.policy_json, "service policy_json", SERVICE_RESERVED),
+    id: requireUuid(row.id, "services.id"),
+    position: requireSafeInteger(row.position, "services.position"),
+    ...takeReferences(`service:${row.id}`),
     name: row.name,
-    table: row.tbl_name,
-    sql: normalizedSql(row.sql)
+    endpoints: takeGroup(upstreams, `service:${row.id}`),
+    plugins: takeGroup(bindings, `service:${row.id}`)
   }));
-  return canonicalJson({
-    objects,
-    tables: tables.map((table) => ({
-      name: table.name,
-      type: table.type,
-      ncol: table.ncol,
-      wr: table.wr,
-      strict: table.strict,
-      sql: normalizedSql(definitions.get(table.name) ?? null),
-      columns: sqliteAll(db, `SELECT cid,name,type,"notnull",dflt_value,pk,hidden
-        FROM pragma_table_xinfo(?) ORDER BY cid`, table.name),
-      foreignKeys: sqliteAll(db, `SELECT id,seq,"table","from","to",on_update,on_delete,"match"
-        FROM pragma_foreign_key_list(?) ORDER BY id,seq`, table.name),
-      indexes: indexDescriptor(db, table.name)
-    }))
-  });
+  const routes = sqliteAll(db, "SELECT id,position,path,policy_json FROM routes ORDER BY position").map((row) => ({
+    ...parseCanonicalObject(row.policy_json, "route policy_json", ROUTE_RESERVED),
+    id: requireUuid(row.id, "routes.id"),
+    position: requireSafeInteger(row.position, "routes.position"),
+    path: row.path,
+    ...references.has(`route:${row.id}`) ? takeReferences(`route:${row.id}`) : { endpoints: takeGroup(upstreams, `route:${row.id}`) },
+    plugins: takeGroup(bindings, `route:${row.id}`)
+  }));
+  const activations = sqliteAll(db, "SELECT plugin_name FROM plugin_activations ORDER BY plugin_name");
+  const input = { logical_configuration: {
+    ...readSettings(db),
+    services,
+    routes,
+    plugins: takeGroup(bindings, "global:")
+  }, plugin_activations: activations.map(({ plugin_name }) => ({
+    plugin_name: requirePluginName(plugin_name, "plugin_activations.plugin_name")
+  })) };
+  if (bindings.size !== 0 || upstreams.size !== 0 || references.size !== 0) {
+    throw new ConfigRepositoryError("schema_corrupt", "normalized relation rows were not consumed");
+  }
+  return input;
+}
+function readActiveAggregate(db) {
+  const result = parseNormalizeCompileAggregate(readRawActiveAggregate(db));
+  if (!result.ok)
+    throw new ConfigRepositoryError("schema_corrupt", "active configuration is invalid", result.errors);
+  return result.value;
 }
 
-// src/config-storage/migrations/management-protection.ts
-var MANAGEMENT_PROTECTION_MIGRATION = {
-  version: 4,
-  name: "management_protection",
-  up(db) {
-    db.run(`CREATE TABLE management_protection (
-      id INTEGER PRIMARY KEY CHECK(id=1),
-      required INTEGER NOT NULL CHECK(required IN (0,1)),
-      selected_provider TEXT REFERENCES plugin_activations(plugin_name) DEFERRABLE INITIALLY DEFERRED,
-      generation INTEGER NOT NULL CHECK(generation BETWEEN 0 AND 9007199254740991),
-      CHECK((required=0 AND selected_provider IS NULL) OR (required=1 AND selected_provider IS NOT NULL))
-    ) STRICT`);
-    db.run("INSERT INTO management_protection(id,required,selected_provider,generation) VALUES(1,0,NULL,0)");
-    db.run("CREATE TRIGGER management_protection_no_delete BEFORE DELETE ON management_protection BEGIN SELECT RAISE(ABORT,'management protection cannot be deleted'); END");
-    db.run("CREATE TRIGGER management_protection_no_replace BEFORE INSERT ON management_protection WHEN EXISTS(SELECT 1 FROM management_protection) BEGIN SELECT RAISE(ABORT,'management protection cannot be replaced'); END");
-    db.run("CREATE TRIGGER management_protection_fixed_identity BEFORE UPDATE OF id ON management_protection BEGIN SELECT RAISE(ABORT,'management protection identity is immutable'); END");
-    db.run("ALTER TABLE configuration_operations ADD COLUMN management_provider TEXT");
-    db.run("ALTER TABLE configuration_operations ADD COLUMN offline_management INTEGER NOT NULL DEFAULT 0 CHECK(offline_management IN (0,1))");
-  }
+// src/config-storage/cross-table-audit.ts
+var EMPTY_AGGREGATE = {
+  logical_configuration: { services: [], routes: [], plugins: [] },
+  plugin_activations: []
 };
-
-// src/config-storage/migrations/ui-menus.ts
-var UI_MENUS_MIGRATION = {
-  version: 3,
-  name: "instance_ui_menus",
-  up(db) {
-    db.run(`CREATE TABLE ui_menu_layout (
-      id INTEGER PRIMARY KEY CHECK(id=1),
-      revision INTEGER NOT NULL CHECK(revision >= 0 AND revision <= 9007199254740991),
-      layout_json TEXT CHECK(layout_json IS NULL OR (json_valid(layout_json) AND json_type(layout_json)='array'
-        AND length(CAST(layout_json AS BLOB)) <= 262144)),
-      CHECK((revision=0 AND layout_json IS NULL) OR (revision>0 AND layout_json IS NOT NULL))
-    ) STRICT`);
-    db.run("INSERT INTO ui_menu_layout(id,revision,layout_json) VALUES(1,0,NULL)");
-    db.run("CREATE TRIGGER ui_menu_layout_no_delete BEFORE DELETE ON ui_menu_layout BEGIN SELECT RAISE(ABORT,'menu singleton cannot be deleted'); END");
-    db.run("CREATE TRIGGER ui_menu_layout_no_replace BEFORE INSERT ON ui_menu_layout WHEN EXISTS(SELECT 1 FROM ui_menu_layout) BEGIN SELECT RAISE(ABORT,'menu singleton cannot be replaced'); END");
-    db.run("CREATE TRIGGER ui_menu_layout_fixed_identity BEFORE UPDATE OF id ON ui_menu_layout BEGIN SELECT RAISE(ABORT,'menu singleton identity is immutable'); END");
+var INITIAL_REVISION_HASH = hashConfigurationContent(EMPTY_AGGREGATE);
+function auditConfigurationTables(db) {
+  const states = sqliteAll(db, `SELECT id,active_revision,schema_version,created_at,updated_at
+    FROM configuration_state ORDER BY id`);
+  const state = states[0];
+  if (states.length !== 1 || state === undefined || state.id !== 1 || state.schema_version !== 4) {
+    throw new ConfigRepositoryError("schema_corrupt", "configuration state singleton is broken");
   }
-};
-
-// src/config-storage/migrations/baseline.ts
-import { randomUUID } from "crypto";
-
-// src/config-storage/schema.ts
-var CONFIG_SCHEMA_STATEMENTS = [
-  `CREATE TABLE configuration_operation_workers (
-    mutation_id TEXT NOT NULL,
-    worker_slot INTEGER NOT NULL CHECK(worker_slot >= 0 AND worker_slot <= 9007199254740991),
-    target_revision INTEGER NOT NULL CHECK(target_revision > 0 AND target_revision <= 9007199254740991),
-    drain_recovery_generation INTEGER NOT NULL DEFAULT 0
-      CHECK(drain_recovery_generation >= 0 AND drain_recovery_generation <= 9007199254740991),
-    attempt_no INTEGER NOT NULL DEFAULT 0 CHECK(attempt_no >= 0 AND attempt_no <= 9007199254740991),
-    last_begin_previous_attempt_no INTEGER CHECK(last_begin_previous_attempt_no IS NULL OR
-      (last_begin_previous_attempt_no >= 0 AND last_begin_previous_attempt_no < 9007199254740991)),
-    last_begin_reason TEXT CHECK(last_begin_reason IS NULL OR last_begin_reason IN ('initial','retry','master_recovery')),
-    state TEXT NOT NULL CHECK(state IN ('pending','converged','failed')),
-    applied_revision INTEGER CHECK(applied_revision IS NULL OR (applied_revision > 0 AND applied_revision <= 9007199254740991)),
-    last_error TEXT,
-    updated_at INTEGER NOT NULL CHECK(updated_at >= 0 AND updated_at <= 9007199254740991),
-    PRIMARY KEY(mutation_id,worker_slot),
-    FOREIGN KEY(mutation_id,target_revision) REFERENCES configuration_operations(mutation_id,committed_revision) ON DELETE CASCADE,
-    CHECK((attempt_no=0 AND last_begin_previous_attempt_no IS NULL AND last_begin_reason IS NULL) OR
-          (attempt_no=1 AND last_begin_previous_attempt_no=0 AND last_begin_reason IN ('initial','master_recovery')) OR
-          (attempt_no > 1 AND last_begin_previous_attempt_no=attempt_no-1 AND
-            last_begin_reason IN ('retry','master_recovery'))),
-    CHECK((state='pending' AND applied_revision IS NULL AND last_error IS NULL) OR
-          (state='converged' AND attempt_no > 0 AND applied_revision=target_revision AND last_error IS NULL) OR
-          (state='failed' AND attempt_no > 0 AND last_error IS NOT NULL AND
-            length(last_error) <= 512 AND length(trim(last_error)) > 0))
-  ) STRICT, WITHOUT ROWID`,
-  `CREATE TABLE configuration_operations (
-    mutation_id TEXT PRIMARY KEY CHECK(length(mutation_id) BETWEEN 1 AND 128),
-    request_hash TEXT NOT NULL CHECK(length(request_hash)=71 AND substr(request_hash,1,7)='sha256:' AND substr(request_hash,8) NOT GLOB '*[^0-9a-f]*'),
-    expected_revision INTEGER NOT NULL CHECK(expected_revision > 0 AND expected_revision <= 9007199254740991),
-    committed_revision INTEGER NOT NULL CHECK(committed_revision > 0 AND committed_revision <= 9007199254740991)
-      REFERENCES configuration_revisions(revision),
-    kind TEXT NOT NULL CHECK(kind IN ('config','admin_state')),
-    target_worker_count INTEGER NOT NULL CHECK(target_worker_count >= 0 AND target_worker_count <= 9007199254740991),
-    state TEXT NOT NULL CHECK(state IN ('committed','publishing','draining','converged','degraded')),
-    result_status INTEGER,
-    error_code TEXT,
-    error_detail TEXT,
-    drain_recovery_generation INTEGER NOT NULL DEFAULT 0
-      CHECK(drain_recovery_generation >= 0 AND drain_recovery_generation <= 9007199254740991),
-    last_drain_recovery_previous_generation INTEGER
-      CHECK(last_drain_recovery_previous_generation IS NULL OR
-        (last_drain_recovery_previous_generation >= 0 AND
-         last_drain_recovery_previous_generation < 9007199254740991)),
-    created_at INTEGER NOT NULL CHECK(created_at >= 0 AND created_at <= 9007199254740991),
-    updated_at INTEGER NOT NULL CHECK(updated_at >= created_at AND updated_at <= 9007199254740991),
-    UNIQUE(mutation_id,committed_revision),
-    CHECK((drain_recovery_generation=0 AND last_drain_recovery_previous_generation IS NULL) OR
-          (drain_recovery_generation > 0 AND
-            last_drain_recovery_previous_generation=drain_recovery_generation-1)),
-    CHECK((state IN ('committed','publishing') AND drain_recovery_generation=0 AND
-            result_status IS NULL AND error_code IS NULL AND error_detail IS NULL) OR
-          (state='draining' AND result_status IS NULL AND error_code IS NULL AND error_detail IS NULL) OR
-          (state='converged' AND drain_recovery_generation=0 AND
-            result_status=200 AND error_code IS NULL AND error_detail IS NULL) OR
-          (state='degraded' AND result_status=202 AND
-            error_code IN ('replacement_convergence_failed','old_worker_drain_failed','control_readiness_failed') AND
-            (error_code <> 'replacement_convergence_failed' OR drain_recovery_generation=0) AND
-            error_detail IS NOT NULL AND length(error_detail) <= 512 AND length(trim(error_detail)) > 0))
-  ) STRICT`,
-  `CREATE TABLE configuration_recoveries (
-      recovery_sequence INTEGER PRIMARY KEY AUTOINCREMENT CHECK(recovery_sequence > 0),
-      recovery_id TEXT NOT NULL UNIQUE CHECK(length(recovery_id)=36 AND substr(recovery_id,9,1)='-' AND substr(recovery_id,14,1)='-' AND substr(recovery_id,19,1)='-' AND substr(recovery_id,24,1)='-' AND replace(recovery_id,'-','') NOT GLOB '*[^0-9a-f]*'),
-      source_mutation_id TEXT NOT NULL,
-      target_revision INTEGER NOT NULL CHECK(target_revision > 0 AND target_revision <= 9007199254740991),
-      trigger TEXT NOT NULL CHECK(trigger IN ('automatic','manual')),
-      state TEXT NOT NULL CHECK(state IN ('scheduled','running','succeeded','stopped')),
-      attempt_count INTEGER NOT NULL CHECK(attempt_count >= 0 AND attempt_count <= 6),
-      max_attempts INTEGER NOT NULL CHECK(max_attempts=6),
-      next_retry_at INTEGER CHECK(next_retry_at IS NULL OR (next_retry_at >= 0 AND next_retry_at <= 9007199254740991)),
-      final_reason_code TEXT CHECK(final_reason_code IS NULL OR final_reason_code IN
-  ('target_serving','already_serving','deterministic_worker_rejection','deterministic_protocol_failure',
-   'deterministic_control_failure','retry_exhausted','revision_superseded','safety_outcome_unknown','fatal_source_failure')), final_reason_detail TEXT,
-      created_at INTEGER NOT NULL CHECK(created_at >= 0 AND created_at <= 9007199254740991),
-      updated_at INTEGER NOT NULL CHECK(updated_at >= created_at AND updated_at <= 9007199254740991),
-      FOREIGN KEY(source_mutation_id) REFERENCES configuration_operations(mutation_id),
-      FOREIGN KEY(target_revision) REFERENCES configuration_revisions(revision),
-      CHECK((state='scheduled' AND final_reason_code IS NULL AND final_reason_detail IS NULL) OR
-        (state='running' AND next_retry_at IS NULL AND final_reason_code IS NULL AND final_reason_detail IS NULL) OR
-        (state='succeeded' AND ((final_reason_code='already_serving' AND attempt_count=0) OR
-          (final_reason_code='target_serving' AND attempt_count > 0)) AND next_retry_at IS NULL) OR
-        (state='stopped' AND final_reason_code IN ('deterministic_worker_rejection','deterministic_protocol_failure',
-          'deterministic_control_failure','revision_superseded') AND next_retry_at IS NULL) OR
-        (state='stopped' AND final_reason_code='retry_exhausted' AND attempt_count=6 AND next_retry_at IS NULL) OR
-        (state='stopped' AND final_reason_code='safety_outcome_unknown' AND attempt_count > 0 AND next_retry_at IS NULL) OR
-        (state='stopped' AND final_reason_code='fatal_source_failure' AND attempt_count=0 AND next_retry_at IS NULL)),
-      CHECK(state <> 'scheduled' OR next_retry_at IS NULL OR next_retry_at > updated_at),
-      CHECK(state <> 'scheduled' OR attempt_count < 6), CHECK(state <> 'running' OR attempt_count > 0),
-      CHECK(final_reason_detail IS NULL OR (length(final_reason_detail) <= 512 AND length(trim(final_reason_detail)) > 0))
-    ) STRICT`,
-  `CREATE TABLE configuration_revisions (
-    revision INTEGER PRIMARY KEY CHECK(revision > 0 AND revision <= 9007199254740991),
-    content_hash TEXT NOT NULL CHECK(length(content_hash)=71 AND substr(content_hash,1,7)='sha256:' AND substr(content_hash,8) NOT GLOB '*[^0-9a-f]*'),
-    kind TEXT NOT NULL CHECK(kind IN ('config','admin_state')),
-    created_at INTEGER NOT NULL CHECK(created_at >= 0 AND created_at <= 9007199254740991)
-  ) STRICT`,
-  `CREATE TABLE configuration_serving_snapshots (
-      revision INTEGER NOT NULL CHECK(revision > 0 AND revision <= 9007199254740991),
-      content_hash TEXT NOT NULL CHECK(length(content_hash)=71 AND substr(content_hash,1,7)='sha256:' AND substr(content_hash,8) NOT GLOB '*[^0-9a-f]*'),
-      plugin_catalog_hash TEXT NOT NULL CHECK(length(plugin_catalog_hash)=71 AND substr(plugin_catalog_hash,1,7)='sha256:' AND substr(plugin_catalog_hash,8) NOT GLOB '*[^0-9a-f]*'),
-      aggregate_json TEXT NOT NULL CHECK(json_valid(aggregate_json) AND json_type(aggregate_json)='object'
-        AND length(CAST(aggregate_json AS BLOB)) BETWEEN 2 AND 1048576),
-      PRIMARY KEY(revision,content_hash,plugin_catalog_hash),
-      FOREIGN KEY(revision,content_hash)
-        REFERENCES configuration_revisions(revision,content_hash)
-    ) STRICT, WITHOUT ROWID`,
-  `CREATE TABLE configuration_state (
-      id INTEGER PRIMARY KEY CHECK(id=1),
-      schema_version INTEGER NOT NULL CHECK(schema_version=4),
-      active_revision INTEGER NOT NULL CHECK(active_revision > 0 AND active_revision <= 9007199254740991)
-        REFERENCES configuration_revisions(revision),
-      created_at INTEGER NOT NULL CHECK(created_at >= 0 AND created_at <= 9007199254740991),
-      updated_at INTEGER NOT NULL CHECK(updated_at >= created_at AND updated_at <= 9007199254740991)
-    ) STRICT`,
-  `CREATE TABLE plugin_activations (
-    plugin_name TEXT PRIMARY KEY CHECK(length(plugin_name) > 0 AND plugin_name=lower(plugin_name)
-      AND plugin_name NOT GLOB '*[^a-z0-9-]*' AND substr(plugin_name,1,1) GLOB '[a-z]'
-      AND substr(plugin_name,-1,1)<>'-' AND plugin_name NOT LIKE '%--%')
-  ) STRICT, WITHOUT ROWID`,
-  `CREATE TABLE plugin_bindings (
-    id TEXT PRIMARY KEY CHECK(length(id)=36 AND substr(id,9,1)='-' AND substr(id,14,1)='-' AND substr(id,19,1)='-' AND substr(id,24,1)='-' AND replace(id,'-','') NOT GLOB '*[^0-9a-f]*'),
-    scope_kind TEXT NOT NULL CHECK(scope_kind IN ('global','service','route','upstream')),
-    scope_owner TEXT NOT NULL,
-    service_id TEXT REFERENCES services(id) ON DELETE CASCADE,
-    route_id TEXT REFERENCES routes(id) ON DELETE CASCADE,
-    upstream_id TEXT REFERENCES upstreams(id) ON DELETE CASCADE,
-    position INTEGER NOT NULL CHECK(position >= 0 AND position <= 9007199254740991),
-    plugin_name TEXT NOT NULL CHECK(length(plugin_name) > 0 AND plugin_name=lower(plugin_name)
-      AND plugin_name NOT GLOB '*[^a-z0-9-]*' AND substr(plugin_name,1,1) GLOB '[a-z]'
-      AND substr(plugin_name,-1,1)<>'-' AND plugin_name NOT LIKE '%--%'),
-    options_json TEXT CHECK(options_json IS NULL OR (json_valid(options_json) AND json_type(options_json)='object')),
-    enabled INTEGER NOT NULL CHECK(enabled IN (0,1)),
-    CHECK((scope_kind='global' AND scope_owner='' AND service_id IS NULL AND route_id IS NULL AND upstream_id IS NULL) OR
-          (scope_kind='service' AND service_id IS NOT NULL AND scope_owner=service_id AND route_id IS NULL AND upstream_id IS NULL) OR
-          (scope_kind='route' AND route_id IS NOT NULL AND scope_owner=route_id AND service_id IS NULL AND upstream_id IS NULL) OR
-          (scope_kind='upstream' AND upstream_id IS NOT NULL AND scope_owner=upstream_id AND service_id IS NULL AND route_id IS NULL)),
-    UNIQUE(scope_kind,scope_owner,position)
-  ) STRICT`,
-  `CREATE TABLE routes (
-    id TEXT PRIMARY KEY CHECK(length(id)=36 AND substr(id,9,1)='-' AND substr(id,14,1)='-' AND substr(id,19,1)='-' AND substr(id,24,1)='-' AND replace(id,'-','') NOT GLOB '*[^0-9a-f]*'),
-    position INTEGER NOT NULL UNIQUE CHECK(position >= 0 AND position <= 9007199254740991),
-    path TEXT NOT NULL UNIQUE CHECK(substr(path,1,1)='/'),
-    service_id TEXT REFERENCES services(id),
-    policy_json TEXT NOT NULL CHECK(json_valid(policy_json) AND json_type(policy_json)='object')
-  ) STRICT`,
-  `CREATE TABLE schema_migrations (
-    version INTEGER PRIMARY KEY CHECK(version > 0 AND version <= 9007199254740991),
-    name TEXT NOT NULL UNIQUE
-  ) STRICT`,
-  `CREATE TABLE services (
-    id TEXT PRIMARY KEY CHECK(length(id)=36 AND substr(id,9,1)='-' AND substr(id,14,1)='-' AND substr(id,19,1)='-' AND substr(id,24,1)='-' AND replace(id,'-','') NOT GLOB '*[^0-9a-f]*'),
-    position INTEGER NOT NULL UNIQUE CHECK(position >= 0 AND position <= 9007199254740991),
-    name TEXT NOT NULL UNIQUE CHECK(length(name) > 0),
-    policy_json TEXT NOT NULL CHECK(json_valid(policy_json) AND json_type(policy_json)='object')
-  ) STRICT`,
-  `CREATE TABLE settings (
-    id INTEGER PRIMARY KEY CHECK(id=1),
-    log_level TEXT CHECK(log_level IS NULL OR log_level IN ('trace','debug','info','warn','error','fatal')),
-    body_parser_limit TEXT CHECK(body_parser_limit IS NULL OR CASE
-      WHEN substr(body_parser_limit,-2) IN ('gb','mb','kb') THEN
-        length(substr(body_parser_limit,1,length(body_parser_limit)-2)) > 0
-        AND body_parser_limit=substr(body_parser_limit,1,length(body_parser_limit)-2)||substr(body_parser_limit,-2)
-        AND substr(body_parser_limit,1,1) GLOB '[1-9]'
-        AND substr(body_parser_limit,1,length(body_parser_limit)-2) NOT GLOB '*[^0-9]*'
-        AND (length(substr(body_parser_limit,1,length(body_parser_limit)-2)) < 16 OR
-          (length(substr(body_parser_limit,1,length(body_parser_limit)-2))=16 AND
-           substr(body_parser_limit,1,length(body_parser_limit)-2)<='9007199254740991'))
-      WHEN substr(body_parser_limit,-1)='b' THEN
-        length(substr(body_parser_limit,1,length(body_parser_limit)-1)) > 0
-        AND body_parser_limit=substr(body_parser_limit,1,length(body_parser_limit)-1)||'b'
-        AND substr(body_parser_limit,1,1) GLOB '[1-9]'
-        AND substr(body_parser_limit,1,length(body_parser_limit)-1) NOT GLOB '*[^0-9]*'
-        AND (length(substr(body_parser_limit,1,length(body_parser_limit)-1)) < 16 OR
-          (length(substr(body_parser_limit,1,length(body_parser_limit)-1))=16 AND
-           substr(body_parser_limit,1,length(body_parser_limit)-1)<='9007199254740991'))
-      ELSE 0 END),
-    auth_json TEXT CHECK(auth_json IS NULL OR json_valid(auth_json)),
-    logging_json TEXT CHECK(logging_json IS NULL OR json_valid(logging_json))
-  , publication_json TEXT) STRICT`,
-  `CREATE TABLE supervision_state (
-      id INTEGER PRIMARY KEY CHECK(id=1),
-      instance_id TEXT NOT NULL UNIQUE CHECK(length(instance_id)=36),
-      controller_epoch INTEGER NOT NULL CHECK(controller_epoch >= 0 AND controller_epoch < 9007199254740991),
-      current_controller_id TEXT,
-      updated_at INTEGER NOT NULL CHECK(updated_at >= 0 AND updated_at < 9007199254740991)
-    ) STRICT, WITHOUT ROWID`,
-  `CREATE TABLE upstreams (
-    id TEXT PRIMARY KEY CHECK(length(id)=36 AND substr(id,9,1)='-' AND substr(id,14,1)='-' AND substr(id,19,1)='-' AND substr(id,24,1)='-' AND replace(id,'-','') NOT GLOB '*[^0-9a-f]*'),
-    owner_kind TEXT NOT NULL CHECK(owner_kind IN ('service','route')),
-    service_id TEXT REFERENCES services(id) ON DELETE CASCADE,
-    route_id TEXT REFERENCES routes(id) ON DELETE CASCADE,
-    position INTEGER NOT NULL CHECK(position >= 0 AND position <= 9007199254740991),
-    target TEXT NOT NULL CHECK(length(target) > 0),
-    weight REAL NOT NULL CHECK(weight > 0),
-    priority REAL NOT NULL CHECK(priority > 0),
-    is_disabled INTEGER NOT NULL CHECK(is_disabled IN (0,1)),
-    policy_json TEXT NOT NULL CHECK(json_valid(policy_json) AND json_type(policy_json)='object'),
-    CHECK((owner_kind='service' AND service_id IS NOT NULL AND route_id IS NULL) OR
-          (owner_kind='route' AND route_id IS NOT NULL AND service_id IS NULL)),
-    UNIQUE(owner_kind,service_id,position), UNIQUE(owner_kind,route_id,position)
-  ) STRICT`,
-  `CREATE UNIQUE INDEX configuration_recoveries_active_target_revision
-      ON configuration_recoveries(target_revision) WHERE state IN ('scheduled','running')`,
-  `CREATE UNIQUE INDEX configuration_revisions_revision_content_hash
-      ON configuration_revisions(revision,content_hash)`,
-  `CREATE TRIGGER configuration_operations_terminal_immutable_delete
-      BEFORE DELETE ON configuration_operations
-      WHEN OLD.state IN ('converged','degraded')
-      BEGIN
-        SELECT RAISE(ABORT,'terminal configuration operations are immutable');
-      END`,
-  `CREATE TRIGGER configuration_operations_terminal_immutable_update
-      BEFORE UPDATE ON configuration_operations
-      WHEN OLD.state IN ('converged','degraded')
-      BEGIN
-        SELECT RAISE(ABORT,'terminal configuration operations are immutable');
-      END`,
-  `CREATE TRIGGER configuration_recoveries_no_delete BEFORE DELETE ON configuration_recoveries
-      BEGIN SELECT RAISE(ABORT,'configuration recovery cannot be deleted'); END`,
-  `CREATE TRIGGER configuration_recoveries_sequence_insert_guard BEFORE INSERT ON configuration_recoveries
-      WHEN NEW.recovery_sequence != -1 BEGIN SELECT RAISE(ABORT,'recovery sequence is database assigned'); END`,
-  `CREATE TRIGGER configuration_recoveries_sequence_update_guard BEFORE UPDATE OF recovery_sequence ON configuration_recoveries
-      BEGIN SELECT RAISE(ABORT,'recovery sequence is immutable'); END`,
-  `CREATE TRIGGER configuration_serving_snapshots_immutable_delete
-      BEFORE DELETE ON configuration_serving_snapshots
-      BEGIN
-        SELECT RAISE(ABORT,'configuration serving snapshots are immutable');
-      END`,
-  `CREATE TRIGGER configuration_serving_snapshots_immutable_update
-      BEFORE UPDATE ON configuration_serving_snapshots
-      BEGIN
-        SELECT RAISE(ABORT,'configuration serving snapshots are immutable');
-      END`,
-  `CREATE TRIGGER configuration_state_singleton_id_immutable
-      BEFORE UPDATE OF id ON configuration_state
-      BEGIN
-        SELECT RAISE(ABORT,'configuration state singleton identity is immutable');
-      END`,
-  `CREATE TRIGGER configuration_state_singleton_no_delete
-      BEFORE DELETE ON configuration_state
-      BEGIN
-        SELECT RAISE(ABORT,'configuration state singleton cannot be deleted');
-      END`,
-  `CREATE TRIGGER configuration_state_singleton_no_replace
-      BEFORE INSERT ON configuration_state
-      WHEN EXISTS(SELECT 1 FROM configuration_state)
-      BEGIN
-        SELECT RAISE(ABORT,'configuration state singleton cannot be replaced');
-      END`
-];
-
-// src/config-storage/migrations/baseline.ts
-var CONFIG_BASELINE_VERSION = 1;
-var CONFIG_BASELINE_NAME = "current_storage_baseline";
-var CONFIG_BASELINE = {
-  version: CONFIG_BASELINE_VERSION,
-  name: CONFIG_BASELINE_NAME,
-  up(db) {
-    for (const statement of CONFIG_SCHEMA_STATEMENTS)
-      db.run(statement);
-    const aggregate = { logical_configuration: { services: [], routes: [], plugins: [] }, plugin_activations: [] };
-    replaceActiveMaterialization(db, aggregate);
-    db.run("INSERT INTO configuration_revisions(revision,content_hash,kind,created_at) VALUES(1,?,'config',0)", [hashConfigurationContent(aggregate)]);
-    db.run("INSERT INTO configuration_state(id,schema_version,active_revision,created_at,updated_at) VALUES(1,4,1,0,0)");
-    db.run("INSERT INTO supervision_state(id,instance_id,controller_epoch,current_controller_id,updated_at) VALUES(1,?,0,NULL,0)", [randomUUID()]);
+  requireSafeInteger(state.active_revision, "configuration_state.active_revision", 1);
+  requireSafeInteger(state.created_at, "configuration_state.created_at");
+  requireSafeInteger(state.updated_at, "configuration_state.updated_at", state.created_at);
+  const revisions = sqliteAll(db, `SELECT revision,content_hash,kind,created_at
+    FROM configuration_revisions ORDER BY revision`);
+  if (revisions.length !== state.active_revision) {
+    throw new ConfigRepositoryError("schema_corrupt", "configuration revisions are not contiguous");
   }
-};
-
-// src/config-storage/migrations/publication-retirement.ts
-var PUBLICATION_RETIREMENT_MIGRATION = {
-  version: 2,
-  name: "publication_retirement_and_runtime_recovery",
-  up(db) {
-    db.run(`CREATE TABLE configuration_retirements (
-      mutation_id TEXT PRIMARY KEY REFERENCES configuration_operations(mutation_id),
-      generation INTEGER NOT NULL CHECK(generation >= 0),
-      members_json TEXT NOT NULL CHECK(json_valid(members_json) AND json_type(members_json)='array'),
-      state TEXT NOT NULL CHECK(state IN ('pending','stopped','released')),
-      reason_code TEXT CHECK(reason_code IS NULL OR reason_code IN ('exit_unknown','cleanup_unknown','release_unknown')),
-      updated_at INTEGER NOT NULL CHECK(updated_at >= 0)
-    ) STRICT`);
-    db.run(`CREATE TABLE configuration_retirement_evidence (
-      mutation_id TEXT NOT NULL REFERENCES configuration_retirements(mutation_id),
-      member_id TEXT NOT NULL,
-      exit_state TEXT NOT NULL CHECK(exit_state IN ('live','confirmed','unknown')),
-      cleanup_state TEXT NOT NULL CHECK(cleanup_state IN ('success','failed','unknown')),
-      exit_boot_id TEXT,
-      exit_deadline_ns TEXT,
-      start_boot_id TEXT,
-      start_deadline_ns TEXT,
-      updated_at INTEGER NOT NULL CHECK(updated_at >= 0),
-      CHECK((exit_boot_id IS NULL AND exit_deadline_ns IS NULL) OR (exit_boot_id IS NOT NULL AND exit_deadline_ns IS NOT NULL)),
-      CHECK((start_boot_id IS NULL AND start_deadline_ns IS NULL) OR (start_boot_id IS NOT NULL AND start_deadline_ns IS NOT NULL)),
-      PRIMARY KEY(mutation_id,member_id)
-    ) STRICT, WITHOUT ROWID`);
-    db.run("CREATE TRIGGER retirement_start_deadline_immutable BEFORE UPDATE OF start_boot_id,start_deadline_ns ON configuration_retirement_evidence WHEN OLD.start_deadline_ns IS NOT NULL AND (NEW.start_boot_id IS NOT OLD.start_boot_id OR NEW.start_deadline_ns IS NOT OLD.start_deadline_ns) BEGIN SELECT RAISE(ABORT,'retirement start deadline is immutable'); END");
-    db.run(`CREATE TABLE configuration_publication_serving_sets (
-      mutation_id TEXT NOT NULL REFERENCES configuration_operations(mutation_id),
-      generation INTEGER NOT NULL CHECK(generation >= 0),
-      attempt_key TEXT NOT NULL CHECK(json_valid(attempt_key) AND json_type(attempt_key)='array'),
-      workers_json TEXT NOT NULL CHECK(json_valid(workers_json) AND json_type(workers_json)='array'),
-      exited_json TEXT NOT NULL CHECK(json_valid(exited_json) AND json_type(exited_json)='array'),
-      PRIMARY KEY(mutation_id,generation,attempt_key)
-    ) STRICT, WITHOUT ROWID`);
-    db.run("CREATE TRIGGER publication_serving_authority_no_delete BEFORE DELETE ON configuration_publication_serving_sets BEGIN SELECT RAISE(ABORT,'publication serving authority history is immutable'); END");
-    db.run("CREATE TRIGGER publication_serving_authority_no_update BEFORE UPDATE OF mutation_id,generation,attempt_key,workers_json ON configuration_publication_serving_sets BEGIN SELECT RAISE(ABORT,'publication serving attempt identity is immutable'); END");
-    db.run("CREATE TRIGGER publication_serving_authority_no_replace BEFORE INSERT ON configuration_publication_serving_sets WHEN EXISTS(SELECT 1 FROM configuration_publication_serving_sets WHERE mutation_id=NEW.mutation_id AND generation=NEW.generation AND attempt_key=NEW.attempt_key) BEGIN SELECT RAISE(ABORT,'publication serving authority history is immutable'); END");
-    db.run(`CREATE TABLE runtime_recovery_budget (
-      id INTEGER PRIMARY KEY CHECK(id=1),
-      tickets INTEGER NOT NULL CHECK(tickets BETWEEN 0 AND 2),
-      ticket_id TEXT,
-      ticket_boot_id TEXT,
-      retry_at_ns TEXT,
-      healthy_owner TEXT,
-      healthy_boot_id TEXT,
-      healthy_since_ns TEXT,
-      healthy_last_ns TEXT,
-      CHECK((tickets=0 AND ticket_id IS NULL AND ticket_boot_id IS NULL AND retry_at_ns IS NULL) OR
-        (tickets>0 AND ticket_id IS NOT NULL AND ticket_boot_id IS NOT NULL AND retry_at_ns IS NOT NULL)),
-      CHECK((healthy_owner IS NULL AND healthy_boot_id IS NULL AND healthy_since_ns IS NULL AND healthy_last_ns IS NULL) OR
-        (healthy_owner IS NOT NULL AND healthy_boot_id IS NOT NULL AND healthy_since_ns IS NOT NULL AND healthy_last_ns IS NOT NULL))
-    ) STRICT`);
-    db.run("INSERT INTO runtime_recovery_budget(id,tickets) VALUES(1,0)");
-    db.run(`CREATE TABLE configuration_retirement_retry_requests (
-      request_id TEXT PRIMARY KEY,
-      mutation_id TEXT NOT NULL REFERENCES configuration_retirements(mutation_id),
-      expected_revision INTEGER NOT NULL CHECK(expected_revision>0),
-      created_at INTEGER NOT NULL CHECK(created_at>=0)
-    ) STRICT, WITHOUT ROWID`);
-    db.run("CREATE TRIGGER retirement_retry_no_delete BEFORE DELETE ON configuration_retirement_retry_requests BEGIN SELECT RAISE(ABORT,'retirement retry identity is immutable'); END");
-    db.run("CREATE TRIGGER retirement_retry_no_update BEFORE UPDATE ON configuration_retirement_retry_requests BEGIN SELECT RAISE(ABORT,'retirement retry identity is immutable'); END");
-    db.run("CREATE TRIGGER retirement_retry_no_replace BEFORE INSERT ON configuration_retirement_retry_requests WHEN EXISTS(SELECT 1 FROM configuration_retirement_retry_requests WHERE request_id=NEW.request_id) BEGIN SELECT RAISE(ABORT,'retirement retry identity is immutable'); END");
-    db.run(`CREATE TABLE runtime_recovery_tickets (
-      ticket_id TEXT PRIMARY KEY,
-      owner TEXT NOT NULL,
-      boot_id TEXT NOT NULL,
-      consumed_at_ns TEXT NOT NULL,
-      retry_at_ns TEXT NOT NULL
-    ) STRICT, WITHOUT ROWID`);
-    db.run("CREATE TRIGGER runtime_recovery_tickets_no_delete BEFORE DELETE ON runtime_recovery_tickets BEGIN SELECT RAISE(ABORT,'runtime recovery ticket history is immutable'); END");
-    db.run("CREATE TRIGGER runtime_recovery_tickets_no_update BEFORE UPDATE ON runtime_recovery_tickets BEGIN SELECT RAISE(ABORT,'runtime recovery ticket history is immutable'); END");
-    db.run("CREATE TRIGGER runtime_recovery_tickets_no_replace BEFORE INSERT ON runtime_recovery_tickets WHEN EXISTS(SELECT 1 FROM runtime_recovery_tickets WHERE ticket_id=NEW.ticket_id) BEGIN SELECT RAISE(ABORT,'runtime recovery ticket history is immutable'); END");
-    db.run("CREATE TRIGGER runtime_recovery_budget_no_delete BEFORE DELETE ON runtime_recovery_budget BEGIN SELECT RAISE(ABORT,'runtime recovery budget cannot be deleted'); END");
-    db.run("CREATE TRIGGER runtime_recovery_budget_no_replace BEFORE INSERT ON runtime_recovery_budget WHEN EXISTS(SELECT 1 FROM runtime_recovery_budget) BEGIN SELECT RAISE(ABORT,'runtime recovery budget cannot be replaced'); END");
-    db.run("CREATE TRIGGER runtime_recovery_budget_fixed_identity BEFORE UPDATE OF id ON runtime_recovery_budget BEGIN SELECT RAISE(ABORT,'runtime recovery budget identity is immutable'); END");
+  for (const [index, revision] of revisions.entries()) {
+    requireSafeInteger(revision.revision, "configuration_revisions.revision", 1);
+    requireSafeInteger(revision.created_at, "configuration_revisions.created_at");
+    if (revision.revision !== index + 1 || !validateDigest(revision.content_hash) || revision.kind !== "config" && revision.kind !== "admin_state") {
+      throw new ConfigRepositoryError("schema_corrupt", "configuration revision metadata is invalid");
+    }
+  }
+  const initialRevision = revisions[0];
+  if (initialRevision === undefined || initialRevision.content_hash !== INITIAL_REVISION_HASH || initialRevision.kind !== "config" || initialRevision.created_at !== 0) {
+    throw new ConfigRepositoryError("schema_corrupt", "initial revision identity is invalid");
+  }
+  const operations = readAllOperations(db);
+  if (operations.length !== revisions.length - 1) {
+    throw new ConfigRepositoryError("schema_corrupt", "revision operation cardinality is invalid");
   }
-};
-
-// src/config-storage/migrations/plan.ts
-var CONFIG_MIGRATIONS = [CONFIG_BASELINE, PUBLICATION_RETIREMENT_MIGRATION, UI_MENUS_MIGRATION, MANAGEMENT_PROTECTION_MIGRATION];
-var CONFIG_SCHEMA_VERSION = CONFIG_MIGRATIONS.at(-1).version;
-
-// src/config-storage/schema-fingerprint.ts
-function readSchemaObjectFingerprint(db) {
-  return canonicalJson(sqliteAll(db, `SELECT type,name,tbl_name,sql
-    FROM sqlite_schema WHERE name NOT LIKE 'sqlite_%' ORDER BY type,name`));
-}
-var expectedDescriptors = new Map;
-function verifySchemaFingerprint(db, version = CONFIG_SCHEMA_VERSION, plan = CONFIG_MIGRATIONS) {
-  if (!plan.some((migration) => migration.version === version)) {
-    throw new ConfigRepositoryError("schema_corrupt", "unsupported configuration schema version");
+  const operationsByRevision = new Map(operations.map((operation) => [operation.committed_revision, operation]));
+  for (const revision of revisions.slice(1)) {
+    const operation = operationsByRevision.get(revision.revision);
+    if (operation === undefined || operation.expected_revision !== revision.revision - 1 || operation.kind !== revision.kind || operation.created_at !== revision.created_at) {
+      throw new ConfigRepositoryError("schema_corrupt", "revision operation metadata is incoherent");
+    }
   }
-  let expected = plan === CONFIG_MIGRATIONS ? expectedDescriptors.get(version) : undefined;
-  if (expected === undefined) {
-    const reference = new Database(":memory:", { strict: true });
-    try {
-      for (const migration of plan.filter((migration) => migration.version <= version))
-        migration.up(reference);
-      expected = databaseSchemaDescriptor(reference);
-    } finally {
-      reference.close(true);
+  const operationsByMutation = new Map(operations.map((operation) => [operation.mutation_id, operation]));
+  const workersByMutation = new Map;
+  for (const worker of readAllWorkers(db)) {
+    const operation = operationsByMutation.get(worker.mutation_id);
+    if (operation === undefined || worker.target_revision !== operation.committed_revision || worker.updated_at < operation.created_at || worker.updated_at > operation.updated_at) {
+      throw new ConfigRepositoryError("schema_corrupt", "operation worker metadata is incoherent");
     }
-    if (plan === CONFIG_MIGRATIONS)
-      expectedDescriptors.set(version, expected);
+    workersByMutation.set(worker.mutation_id, [...workersByMutation.get(worker.mutation_id) ?? [], worker]);
   }
-  if (databaseSchemaDescriptor(db) !== expected) {
-    throw new ConfigRepositoryError("schema_corrupt", "configuration schema fingerprint is invalid");
+  for (const operation of operations) {
+    const workers = workersByMutation.get(operation.mutation_id) ?? [];
+    validateOperationRelations(operation, workers);
+    if (operation.committed_revision !== state.active_revision && (operation.state === "committed" || operation.state === "publishing" || operation.state === "draining")) {
+      throw new ConfigRepositoryError("schema_corrupt", "non-active operation is not terminal");
+    }
   }
+  const activeRevisionRow = revisions.at(-1);
+  if (activeRevisionRow === undefined)
+    throw new ConfigRepositoryError("schema_corrupt", "active revision is missing");
+  const activeOperation = operationsByRevision.get(state.active_revision) ?? null;
+  const activeTargetSlots = activeOperation === null ? [] : (workersByMutation.get(activeOperation.mutation_id) ?? []).map(({ worker_slot }) => worker_slot).sort((left, right) => left - right);
+  return {
+    activeRevision: state.active_revision,
+    activeRevisionRow,
+    activeOperation,
+    activeTargetSlots,
+    managementIdentity: activeOperation === null ? null : readManagementRequestIdentity(db, activeOperation.mutation_id)
+  };
 }
-
-// src/config-storage/sqlite-errors.ts
-function isSqliteBusyError(error) {
-  if (!(error instanceof Error))
-    return false;
-  const sqliteError = error;
-  const errno = sqliteError.errno;
-  if (typeof errno === "number" && ((errno & 255) === 5 || (errno & 255) === 6))
-    return true;
-  const code = sqliteError.code;
-  return code === "SQLITE_BUSY" || code === "SQLITE_LOCKED" || code?.startsWith("SQLITE_BUSY_") === true || code?.startsWith("SQLITE_LOCKED_") === true;
-}
-function repositoryFailure(message, cause) {
-  return new ConfigRepositoryError("repository_failure", message, cause);
-}
-
-// src/config-storage/migrations/index.ts
-function migrateConfigurationDatabase(db, plan = CONFIG_MIGRATIONS) {
-  try {
-    db.transaction(() => {
-      if (!plan.length || plan[0] !== CONFIG_MIGRATIONS[0] || plan.some((m, i) => i > 0 && m.version !== plan[i - 1].version + 1) || new Set(plan.map((m) => m.name)).size !== plan.length)
-        throw new ConfigRepositoryError("migration_failed", "invalid configuration migration plan");
-      const count = db.query("SELECT count(*) AS count FROM sqlite_schema WHERE name NOT LIKE 'sqlite_%'").get().count;
-      let applied = [];
-      if (count > 0) {
-        applied = db.query("SELECT version,name FROM schema_migrations ORDER BY version").all();
-        if (!applied.length || applied.length > plan.length || applied.some((r, i) => r.version !== plan[i]?.version || r.name !== plan[i]?.name))
-          throw new ConfigRepositoryError("schema_corrupt", "configuration migration history is not an exact baseline prefix");
-        verifySchemaFingerprint(db, applied.at(-1).version, plan);
-      }
-      for (const migration of plan.slice(applied.length)) {
-        migration.up(db);
-        db.run("INSERT INTO schema_migrations(version,name) VALUES(?,?)", [migration.version, migration.name]);
-      }
-      verifySchemaFingerprint(db, plan.at(-1).version, plan);
-    }).immediate();
-  } catch (error) {
-    if (error instanceof ConfigRepositoryError)
-      throw error;
-    if (isSqliteBusyError(error))
-      throw repositoryFailure("configuration migration was blocked by SQLite", error);
-    throw new ConfigRepositoryError("migration_failed", "configuration migration failed", error);
+function verifyActiveRequestIdentity(audited, aggregate) {
+  const operation = audited.activeOperation;
+  if (operation === null)
+    return;
+  const requestHash = hashConfigurationRequest({
+    ...audited.managementIdentity,
+    kind: operation.kind,
+    expected_revision: operation.expected_revision,
+    aggregate,
+    target_worker_slots: audited.activeTargetSlots
+  });
+  if (requestHash !== operation.request_hash) {
+    throw new ConfigRepositoryError("schema_corrupt", "active operation request hash is incoherent");
   }
 }
 
@@ -9856,241 +9661,643 @@ function prepareCommitCommand(input, compileOptions) {
   };
 }
 
-// src/config-storage/cross-table-audit.ts
-var EMPTY_AGGREGATE = {
-  logical_configuration: { services: [], routes: [], plugins: [] },
-  plugin_activations: []
-};
-var INITIAL_REVISION_HASH = hashConfigurationContent(EMPTY_AGGREGATE);
-function auditConfigurationTables(db) {
-  const states = sqliteAll(db, `SELECT id,active_revision,schema_version,created_at,updated_at
-    FROM configuration_state ORDER BY id`);
-  const state = states[0];
-  if (states.length !== 1 || state === undefined || state.id !== 1 || state.schema_version !== 4) {
-    throw new ConfigRepositoryError("schema_corrupt", "configuration state singleton is broken");
-  }
-  requireSafeInteger(state.active_revision, "configuration_state.active_revision", 1);
-  requireSafeInteger(state.created_at, "configuration_state.created_at");
-  requireSafeInteger(state.updated_at, "configuration_state.updated_at", state.created_at);
-  const revisions = sqliteAll(db, `SELECT revision,content_hash,kind,created_at
-    FROM configuration_revisions ORDER BY revision`);
-  if (revisions.length !== state.active_revision) {
-    throw new ConfigRepositoryError("schema_corrupt", "configuration revisions are not contiguous");
-  }
-  for (const [index, revision] of revisions.entries()) {
-    requireSafeInteger(revision.revision, "configuration_revisions.revision", 1);
-    requireSafeInteger(revision.created_at, "configuration_revisions.created_at");
-    if (revision.revision !== index + 1 || !validateDigest(revision.content_hash) || revision.kind !== "config" && revision.kind !== "admin_state") {
-      throw new ConfigRepositoryError("schema_corrupt", "configuration revision metadata is invalid");
-    }
+// src/config-storage/consistent-read.ts
+function withConsistentRead(db, fn) {
+  if (db.inTransaction)
+    return fn();
+  return db.transaction(fn).deferred();
+}
+
+// src/config-storage/serving-snapshot.ts
+var MAX_AGGREGATE_BYTES = 1048576;
+function invalid4(message) {
+  throw new ConfigRepositoryError("invalid_configuration", message);
+}
+function corrupt3(message) {
+  throw new ConfigRepositoryError("serving_snapshot_corrupt", message);
+}
+function canonicalAggregate(aggregate) {
+  const result = parseNormalizeCompileAggregate(aggregate, undefined);
+  if (!result.ok)
+    invalid4("configuration aggregate is invalid");
+  const aggregateJson = canonicalJson(result.value);
+  const bytes = new TextEncoder().encode(aggregateJson).byteLength;
+  if (bytes < 2 || bytes > MAX_AGGREGATE_BYTES) {
+    invalid4("configuration aggregate is too large");
   }
-  const initialRevision = revisions[0];
-  if (initialRevision === undefined || initialRevision.content_hash !== INITIAL_REVISION_HASH || initialRevision.kind !== "config" || initialRevision.created_at !== 0) {
-    throw new ConfigRepositoryError("schema_corrupt", "initial revision identity is invalid");
+  return { aggregateJson, contentHash: hashConfigurationContent(result.value) };
+}
+function appendServingSnapshot(db, snapshot, pluginCatalogHash) {
+  if (!Number.isSafeInteger(snapshot?.revision) || snapshot.revision <= 0 || typeof snapshot.content_hash !== "string" || !validateDigest(snapshot.content_hash) || !validateDigest(pluginCatalogHash)) {
+    invalid4("serving snapshot identity is invalid");
   }
-  const operations = readAllOperations(db);
-  if (operations.length !== revisions.length - 1) {
-    throw new ConfigRepositoryError("schema_corrupt", "revision operation cardinality is invalid");
+  const normalized = canonicalAggregate(snapshot.aggregate);
+  if (normalized.contentHash !== snapshot.content_hash) {
+    invalid4("configuration aggregate content hash does not match");
   }
-  const operationsByRevision = new Map(operations.map((operation) => [operation.committed_revision, operation]));
-  for (const revision of revisions.slice(1)) {
-    const operation = operationsByRevision.get(revision.revision);
-    if (operation === undefined || operation.expected_revision !== revision.revision - 1 || operation.kind !== revision.kind || operation.created_at !== revision.created_at) {
-      throw new ConfigRepositoryError("schema_corrupt", "revision operation metadata is incoherent");
+  const transaction = db.transaction(() => {
+    const revision = sqliteGet(db, "SELECT revision,content_hash FROM configuration_revisions WHERE revision=?", snapshot.revision);
+    if (revision === null || revision.content_hash !== snapshot.content_hash) {
+      invalid4("serving snapshot revision does not match configuration history");
     }
-  }
-  const operationsByMutation = new Map(operations.map((operation) => [operation.mutation_id, operation]));
-  const workersByMutation = new Map;
-  for (const worker of readAllWorkers(db)) {
-    const operation = operationsByMutation.get(worker.mutation_id);
-    if (operation === undefined || worker.target_revision !== operation.committed_revision || worker.updated_at < operation.created_at || worker.updated_at > operation.updated_at) {
-      throw new ConfigRepositoryError("schema_corrupt", "operation worker metadata is incoherent");
+    const existing = sqliteGet(db, `SELECT revision,content_hash,plugin_catalog_hash,aggregate_json
+       FROM configuration_serving_snapshots
+       WHERE revision=? AND content_hash=? AND plugin_catalog_hash=?`, snapshot.revision, snapshot.content_hash, pluginCatalogHash);
+    if (existing !== null) {
+      if (existing.aggregate_json !== normalized.aggregateJson) {
+        corrupt3("configuration serving snapshot is immutable and inconsistent");
+      }
+      return;
     }
-    workersByMutation.set(worker.mutation_id, [...workersByMutation.get(worker.mutation_id) ?? [], worker]);
+    db.run(`INSERT INTO configuration_serving_snapshots
+      (revision,content_hash,plugin_catalog_hash,aggregate_json) VALUES (?,?,?,?)`, [snapshot.revision, snapshot.content_hash, pluginCatalogHash, normalized.aggregateJson]);
+  });
+  transaction.immediate();
+}
+function getServingSnapshot(db, key) {
+  if (!Number.isSafeInteger(key?.revision) || key.revision <= 0 || typeof key.content_hash !== "string" || !validateDigest(key.content_hash) || typeof key.plugin_catalog_hash !== "string" || !validateDigest(key.plugin_catalog_hash)) {
+    invalid4("serving snapshot lookup identity is invalid");
   }
-  for (const operation of operations) {
-    const workers = workersByMutation.get(operation.mutation_id) ?? [];
-    validateOperationRelations(operation, workers);
-    if (operation.committed_revision !== state.active_revision && (operation.state === "committed" || operation.state === "publishing" || operation.state === "draining")) {
-      throw new ConfigRepositoryError("schema_corrupt", "non-active operation is not terminal");
+  return withConsistentRead(db, () => {
+    const row = sqliteGet(db, `SELECT revision,content_hash,plugin_catalog_hash,aggregate_json
+       FROM configuration_serving_snapshots
+       WHERE revision=? AND content_hash=? AND plugin_catalog_hash=?`, key.revision, key.content_hash, key.plugin_catalog_hash);
+    if (row === null)
+      return null;
+    if (row.revision !== key.revision || row.content_hash !== key.content_hash || row.plugin_catalog_hash !== key.plugin_catalog_hash || !Number.isSafeInteger(row.revision) || row.revision <= 0 || !validateDigest(row.content_hash) || !validateDigest(row.plugin_catalog_hash)) {
+      corrupt3("configuration serving snapshot identity is invalid");
+    }
+    const bytes = new TextEncoder().encode(row.aggregate_json).byteLength;
+    if (bytes < 2 || bytes > MAX_AGGREGATE_BYTES)
+      corrupt3("configuration serving snapshot size is invalid");
+    let parsed;
+    try {
+      parsed = JSON.parse(row.aggregate_json);
+    } catch {
+      corrupt3("configuration serving snapshot JSON is invalid");
+    }
+    let canonical;
+    try {
+      canonical = canonicalJson(parsed);
+    } catch {
+      corrupt3("configuration serving snapshot JSON is invalid");
+    }
+    if (canonical !== row.aggregate_json)
+      corrupt3("configuration serving snapshot JSON is not canonical");
+    const normalized = parseNormalizeCompileAggregate(parsed, undefined);
+    if (!normalized.ok) {
+      if (normalized.errors.some((error) => error.code === "unknown_field" && /^logical_configuration\.routes\[\d+\]\.(service_id|service)$/.test(error.path))) {
+        throw new ConfigRepositoryError("invalid_configuration", "historical serving snapshot does not use the current configuration schema and cannot be loaded");
+      }
+      corrupt3("configuration serving snapshot aggregate is invalid");
+    }
+    if (canonicalJson(normalized.value) !== row.aggregate_json) {
+      corrupt3("configuration serving snapshot aggregate normalization drifted");
+    }
+    if (hashConfigurationContent(normalized.value) !== key.content_hash) {
+      corrupt3("configuration serving snapshot content hash is invalid");
+    }
+    const revision = sqliteGet(db, "SELECT revision,content_hash FROM configuration_revisions WHERE revision=?", key.revision);
+    if (revision === null || revision.revision !== key.revision || revision.content_hash !== key.content_hash) {
+      corrupt3("configuration serving snapshot revision is invalid");
+    }
+    return { revision: row.revision, content_hash: row.content_hash, aggregate: normalized.value };
+  });
+}
+function auditServingSnapshotHistory(db) {
+  const rows = db.query(`SELECT s.revision,s.content_hash,s.plugin_catalog_hash,s.aggregate_json,
+    r.content_hash AS revision_hash FROM configuration_serving_snapshots s
+    LEFT JOIN configuration_revisions r ON r.revision=s.revision`).all();
+  for (const row of rows) {
+    if (row.revision_hash !== row.content_hash || !validateDigest(row.content_hash) || !validateDigest(row.plugin_catalog_hash)) {
+      corrupt3("historical serving snapshot identity is invalid");
+    }
+    try {
+      const parsed = JSON.parse(row.aggregate_json);
+      if (new TextEncoder().encode(row.aggregate_json).byteLength > MAX_AGGREGATE_BYTES || canonicalJson(parsed) !== row.aggregate_json || hashConfigurationContent(parsed) !== row.content_hash)
+        corrupt3("historical serving snapshot content is invalid");
+    } catch (error) {
+      if (error instanceof ConfigRepositoryError)
+        throw error;
+      corrupt3("historical serving snapshot JSON is invalid");
     }
   }
-  const activeRevisionRow = revisions.at(-1);
-  if (activeRevisionRow === undefined)
-    throw new ConfigRepositoryError("schema_corrupt", "active revision is missing");
-  const activeOperation = operationsByRevision.get(state.active_revision) ?? null;
-  const activeTargetSlots = activeOperation === null ? [] : (workersByMutation.get(activeOperation.mutation_id) ?? []).map(({ worker_slot }) => worker_slot).sort((left, right) => left - right);
-  return {
-    activeRevision: state.active_revision,
-    activeRevisionRow,
-    activeOperation,
-    activeTargetSlots,
-    managementIdentity: activeOperation === null ? null : readManagementRequestIdentity(db, activeOperation.mutation_id)
-  };
 }
-function verifyActiveRequestIdentity(audited, aggregate) {
-  const operation = audited.activeOperation;
-  if (operation === null)
-    return;
-  const requestHash = hashConfigurationRequest({
-    ...audited.managementIdentity,
-    kind: operation.kind,
-    expected_revision: operation.expected_revision,
-    aggregate,
-    target_worker_slots: audited.activeTargetSlots
+
+// src/config-storage/schema-fingerprint.ts
+import { Database } from "bun:sqlite";
+
+// src/database-schema.ts
+function pragmaName(name) {
+  return `'${name.replaceAll("'", "''")}'`;
+}
+function normalizedSql(sql) {
+  return (sql ?? "").match(/'(?:''|[^'])*'|"(?:""|[^"])*"|`[^`]*`|\[[^\]]*\]|[^'"`\[]+/g)?.map((token) => /^['"`\[]/.test(token) ? token : token.replace(/\s+/g, " ")).join("").trim() ?? "";
+}
+function indexDescriptor(db, table) {
+  const indexes = sqliteAll(db, 'SELECT name,"unique",origin,partial FROM pragma_index_list(?)', table);
+  return indexes.map((index) => ({
+    unique: index.unique,
+    origin: index.origin,
+    partial: index.partial,
+    columns: sqliteAll(db, `PRAGMA index_xinfo(${pragmaName(index.name)})`).map(({ seqno, cid, name, desc, coll, key }) => ({ seqno, cid, name, desc, coll, key }))
+  })).sort((left, right) => canonicalJson(left).localeCompare(canonicalJson(right)));
+}
+function databaseSchemaDescriptor(db) {
+  const definitions = new Map(sqliteAll(db, `SELECT name,sql FROM sqlite_schema
+    WHERE type='table' AND name NOT LIKE 'sqlite_%'`).map((row) => [row.name, row.sql]));
+  const tables = sqliteAll(db, `SELECT name,type,ncol,wr,strict FROM pragma_table_list
+    WHERE schema='main' AND name NOT LIKE 'sqlite_%' ORDER BY name`);
+  const objects = sqliteAll(db, `SELECT type,name,tbl_name,sql
+    FROM sqlite_schema WHERE name NOT LIKE 'sqlite_%' ORDER BY type,name`).map((row) => ({
+    type: row.type,
+    name: row.name,
+    table: row.tbl_name,
+    sql: normalizedSql(row.sql)
+  }));
+  return canonicalJson({
+    objects,
+    tables: tables.map((table) => ({
+      name: table.name,
+      type: table.type,
+      ncol: table.ncol,
+      wr: table.wr,
+      strict: table.strict,
+      sql: normalizedSql(definitions.get(table.name) ?? null),
+      columns: sqliteAll(db, `SELECT cid,name,type,"notnull",dflt_value,pk,hidden
+        FROM pragma_table_xinfo(?) ORDER BY cid`, table.name),
+      foreignKeys: sqliteAll(db, `SELECT id,seq,"table","from","to",on_update,on_delete,"match"
+        FROM pragma_foreign_key_list(?) ORDER BY id,seq`, table.name),
+      indexes: indexDescriptor(db, table.name)
+    }))
   });
-  if (requestHash !== operation.request_hash) {
-    throw new ConfigRepositoryError("schema_corrupt", "active operation request hash is incoherent");
-  }
 }
 
-// src/config-storage/persisted-json.ts
-function parseCanonicalObject(text, field, reserved = new Set) {
-  try {
-    const value = JSON.parse(text);
-    if (value === null || typeof value !== "object" || Array.isArray(value)) {
-      throw new TypeError("expected a JSON object");
-    }
-    if (text !== canonicalJson(value))
-      throw new TypeError("expected canonical JSON text");
-    const entries = Object.entries(value);
-    const key = entries.find(([name]) => reserved.has(name))?.[0];
-    if (key !== undefined)
-      throw new TypeError(`reserved key ${key}`);
-    return Object.fromEntries(entries);
-  } catch (error) {
-    throw new ConfigRepositoryError("schema_corrupt", `${field} is invalid`, error);
+// src/config-storage/migrations/service-references.ts
+var SERVICE_REFERENCES_MIGRATION = {
+  version: 5,
+  name: "service_references",
+  up(db) {
+    db.run(`CREATE TABLE service_references (
+      id TEXT PRIMARY KEY CHECK(length(id)=36 AND substr(id,9,1)='-' AND substr(id,14,1)='-' AND substr(id,19,1)='-' AND substr(id,24,1)='-' AND replace(id,'-','') NOT GLOB '*[^0-9a-f]*'),
+      owner_kind TEXT NOT NULL CHECK(owner_kind IN ('service','route')),
+      owner_service_id TEXT REFERENCES services(id) ON DELETE CASCADE,
+      route_id TEXT REFERENCES routes(id) ON DELETE CASCADE,
+      position INTEGER NOT NULL CHECK(position BETWEEN 0 AND 9007199254740991),
+      service_id TEXT NOT NULL REFERENCES services(id),
+      weight REAL NOT NULL CHECK(weight>0),
+      priority REAL NOT NULL CHECK(priority>0),
+      is_disabled INTEGER NOT NULL CHECK(is_disabled IN (0,1)),
+      CHECK((owner_kind='service' AND owner_service_id IS NOT NULL AND route_id IS NULL AND owner_service_id<>service_id)
+        OR (owner_kind='route' AND route_id IS NOT NULL AND owner_service_id IS NULL)),
+      UNIQUE(owner_service_id,position), UNIQUE(route_id,position),
+      UNIQUE(owner_service_id,service_id), UNIQUE(route_id,service_id)
+    ) STRICT`);
+    db.run(`INSERT INTO service_references(id,owner_kind,owner_service_id,route_id,position,service_id,weight,priority,is_disabled)
+      SELECT lower(hex(randomblob(4))) || '-' || lower(hex(randomblob(2))) || '-4' || substr(lower(hex(randomblob(2))),2)
+        || '-8' || substr(lower(hex(randomblob(2))),2) || '-' || lower(hex(randomblob(6))),
+        'route',NULL,id,0,service_id,100,1,0 FROM routes WHERE service_id IS NOT NULL`);
+    db.run("ALTER TABLE routes DROP COLUMN service_id");
+  }
+};
+
+// src/config-storage/migrations/management-protection.ts
+var MANAGEMENT_PROTECTION_MIGRATION = {
+  version: 4,
+  name: "management_protection",
+  up(db) {
+    db.run(`CREATE TABLE management_protection (
+      id INTEGER PRIMARY KEY CHECK(id=1),
+      required INTEGER NOT NULL CHECK(required IN (0,1)),
+      selected_provider TEXT REFERENCES plugin_activations(plugin_name) DEFERRABLE INITIALLY DEFERRED,
+      generation INTEGER NOT NULL CHECK(generation BETWEEN 0 AND 9007199254740991),
+      CHECK((required=0 AND selected_provider IS NULL) OR (required=1 AND selected_provider IS NOT NULL))
+    ) STRICT`);
+    db.run("INSERT INTO management_protection(id,required,selected_provider,generation) VALUES(1,0,NULL,0)");
+    db.run("CREATE TRIGGER management_protection_no_delete BEFORE DELETE ON management_protection BEGIN SELECT RAISE(ABORT,'management protection cannot be deleted'); END");
+    db.run("CREATE TRIGGER management_protection_no_replace BEFORE INSERT ON management_protection WHEN EXISTS(SELECT 1 FROM management_protection) BEGIN SELECT RAISE(ABORT,'management protection cannot be replaced'); END");
+    db.run("CREATE TRIGGER management_protection_fixed_identity BEFORE UPDATE OF id ON management_protection BEGIN SELECT RAISE(ABORT,'management protection identity is immutable'); END");
+    db.run("ALTER TABLE configuration_operations ADD COLUMN management_provider TEXT");
+    db.run("ALTER TABLE configuration_operations ADD COLUMN offline_management INTEGER NOT NULL DEFAULT 0 CHECK(offline_management IN (0,1))");
+  }
+};
+
+// src/config-storage/migrations/ui-menus.ts
+var UI_MENUS_MIGRATION = {
+  version: 3,
+  name: "instance_ui_menus",
+  up(db) {
+    db.run(`CREATE TABLE ui_menu_layout (
+      id INTEGER PRIMARY KEY CHECK(id=1),
+      revision INTEGER NOT NULL CHECK(revision >= 0 AND revision <= 9007199254740991),
+      layout_json TEXT CHECK(layout_json IS NULL OR (json_valid(layout_json) AND json_type(layout_json)='array'
+        AND length(CAST(layout_json AS BLOB)) <= 262144)),
+      CHECK((revision=0 AND layout_json IS NULL) OR (revision>0 AND layout_json IS NOT NULL))
+    ) STRICT`);
+    db.run("INSERT INTO ui_menu_layout(id,revision,layout_json) VALUES(1,0,NULL)");
+    db.run("CREATE TRIGGER ui_menu_layout_no_delete BEFORE DELETE ON ui_menu_layout BEGIN SELECT RAISE(ABORT,'menu singleton cannot be deleted'); END");
+    db.run("CREATE TRIGGER ui_menu_layout_no_replace BEFORE INSERT ON ui_menu_layout WHEN EXISTS(SELECT 1 FROM ui_menu_layout) BEGIN SELECT RAISE(ABORT,'menu singleton cannot be replaced'); END");
+    db.run("CREATE TRIGGER ui_menu_layout_fixed_identity BEFORE UPDATE OF id ON ui_menu_layout BEGIN SELECT RAISE(ABORT,'menu singleton identity is immutable'); END");
+  }
+};
+
+// src/config-storage/migrations/baseline.ts
+import { randomUUID } from "crypto";
+
+// src/config-storage/schema.ts
+var CONFIG_SCHEMA_STATEMENTS = [
+  `CREATE TABLE configuration_operation_workers (
+    mutation_id TEXT NOT NULL,
+    worker_slot INTEGER NOT NULL CHECK(worker_slot >= 0 AND worker_slot <= 9007199254740991),
+    target_revision INTEGER NOT NULL CHECK(target_revision > 0 AND target_revision <= 9007199254740991),
+    drain_recovery_generation INTEGER NOT NULL DEFAULT 0
+      CHECK(drain_recovery_generation >= 0 AND drain_recovery_generation <= 9007199254740991),
+    attempt_no INTEGER NOT NULL DEFAULT 0 CHECK(attempt_no >= 0 AND attempt_no <= 9007199254740991),
+    last_begin_previous_attempt_no INTEGER CHECK(last_begin_previous_attempt_no IS NULL OR
+      (last_begin_previous_attempt_no >= 0 AND last_begin_previous_attempt_no < 9007199254740991)),
+    last_begin_reason TEXT CHECK(last_begin_reason IS NULL OR last_begin_reason IN ('initial','retry','master_recovery')),
+    state TEXT NOT NULL CHECK(state IN ('pending','converged','failed')),
+    applied_revision INTEGER CHECK(applied_revision IS NULL OR (applied_revision > 0 AND applied_revision <= 9007199254740991)),
+    last_error TEXT,
+    updated_at INTEGER NOT NULL CHECK(updated_at >= 0 AND updated_at <= 9007199254740991),
+    PRIMARY KEY(mutation_id,worker_slot),
+    FOREIGN KEY(mutation_id,target_revision) REFERENCES configuration_operations(mutation_id,committed_revision) ON DELETE CASCADE,
+    CHECK((attempt_no=0 AND last_begin_previous_attempt_no IS NULL AND last_begin_reason IS NULL) OR
+          (attempt_no=1 AND last_begin_previous_attempt_no=0 AND last_begin_reason IN ('initial','master_recovery')) OR
+          (attempt_no > 1 AND last_begin_previous_attempt_no=attempt_no-1 AND
+            last_begin_reason IN ('retry','master_recovery'))),
+    CHECK((state='pending' AND applied_revision IS NULL AND last_error IS NULL) OR
+          (state='converged' AND attempt_no > 0 AND applied_revision=target_revision AND last_error IS NULL) OR
+          (state='failed' AND attempt_no > 0 AND last_error IS NOT NULL AND
+            length(last_error) <= 512 AND length(trim(last_error)) > 0))
+  ) STRICT, WITHOUT ROWID`,
+  `CREATE TABLE configuration_operations (
+    mutation_id TEXT PRIMARY KEY CHECK(length(mutation_id) BETWEEN 1 AND 128),
+    request_hash TEXT NOT NULL CHECK(length(request_hash)=71 AND substr(request_hash,1,7)='sha256:' AND substr(request_hash,8) NOT GLOB '*[^0-9a-f]*'),
+    expected_revision INTEGER NOT NULL CHECK(expected_revision > 0 AND expected_revision <= 9007199254740991),
+    committed_revision INTEGER NOT NULL CHECK(committed_revision > 0 AND committed_revision <= 9007199254740991)
+      REFERENCES configuration_revisions(revision),
+    kind TEXT NOT NULL CHECK(kind IN ('config','admin_state')),
+    target_worker_count INTEGER NOT NULL CHECK(target_worker_count >= 0 AND target_worker_count <= 9007199254740991),
+    state TEXT NOT NULL CHECK(state IN ('committed','publishing','draining','converged','degraded')),
+    result_status INTEGER,
+    error_code TEXT,
+    error_detail TEXT,
+    drain_recovery_generation INTEGER NOT NULL DEFAULT 0
+      CHECK(drain_recovery_generation >= 0 AND drain_recovery_generation <= 9007199254740991),
+    last_drain_recovery_previous_generation INTEGER
+      CHECK(last_drain_recovery_previous_generation IS NULL OR
+        (last_drain_recovery_previous_generation >= 0 AND
+         last_drain_recovery_previous_generation < 9007199254740991)),
+    created_at INTEGER NOT NULL CHECK(created_at >= 0 AND created_at <= 9007199254740991),
+    updated_at INTEGER NOT NULL CHECK(updated_at >= created_at AND updated_at <= 9007199254740991),
+    UNIQUE(mutation_id,committed_revision),
+    CHECK((drain_recovery_generation=0 AND last_drain_recovery_previous_generation IS NULL) OR
+          (drain_recovery_generation > 0 AND
+            last_drain_recovery_previous_generation=drain_recovery_generation-1)),
+    CHECK((state IN ('committed','publishing') AND drain_recovery_generation=0 AND
+            result_status IS NULL AND error_code IS NULL AND error_detail IS NULL) OR
+          (state='draining' AND result_status IS NULL AND error_code IS NULL AND error_detail IS NULL) OR
+          (state='converged' AND drain_recovery_generation=0 AND
+            result_status=200 AND error_code IS NULL AND error_detail IS NULL) OR
+          (state='degraded' AND result_status=202 AND
+            error_code IN ('replacement_convergence_failed','old_worker_drain_failed','control_readiness_failed') AND
+            (error_code <> 'replacement_convergence_failed' OR drain_recovery_generation=0) AND
+            error_detail IS NOT NULL AND length(error_detail) <= 512 AND length(trim(error_detail)) > 0))
+  ) STRICT`,
+  `CREATE TABLE configuration_recoveries (
+      recovery_sequence INTEGER PRIMARY KEY AUTOINCREMENT CHECK(recovery_sequence > 0),
+      recovery_id TEXT NOT NULL UNIQUE CHECK(length(recovery_id)=36 AND substr(recovery_id,9,1)='-' AND substr(recovery_id,14,1)='-' AND substr(recovery_id,19,1)='-' AND substr(recovery_id,24,1)='-' AND replace(recovery_id,'-','') NOT GLOB '*[^0-9a-f]*'),
+      source_mutation_id TEXT NOT NULL,
+      target_revision INTEGER NOT NULL CHECK(target_revision > 0 AND target_revision <= 9007199254740991),
+      trigger TEXT NOT NULL CHECK(trigger IN ('automatic','manual')),
+      state TEXT NOT NULL CHECK(state IN ('scheduled','running','succeeded','stopped')),
+      attempt_count INTEGER NOT NULL CHECK(attempt_count >= 0 AND attempt_count <= 6),
+      max_attempts INTEGER NOT NULL CHECK(max_attempts=6),
+      next_retry_at INTEGER CHECK(next_retry_at IS NULL OR (next_retry_at >= 0 AND next_retry_at <= 9007199254740991)),
+      final_reason_code TEXT CHECK(final_reason_code IS NULL OR final_reason_code IN
+  ('target_serving','already_serving','deterministic_worker_rejection','deterministic_protocol_failure',
+   'deterministic_control_failure','retry_exhausted','revision_superseded','safety_outcome_unknown','fatal_source_failure')), final_reason_detail TEXT,
+      created_at INTEGER NOT NULL CHECK(created_at >= 0 AND created_at <= 9007199254740991),
+      updated_at INTEGER NOT NULL CHECK(updated_at >= created_at AND updated_at <= 9007199254740991),
+      FOREIGN KEY(source_mutation_id) REFERENCES configuration_operations(mutation_id),
+      FOREIGN KEY(target_revision) REFERENCES configuration_revisions(revision),
+      CHECK((state='scheduled' AND final_reason_code IS NULL AND final_reason_detail IS NULL) OR
+        (state='running' AND next_retry_at IS NULL AND final_reason_code IS NULL AND final_reason_detail IS NULL) OR
+        (state='succeeded' AND ((final_reason_code='already_serving' AND attempt_count=0) OR
+          (final_reason_code='target_serving' AND attempt_count > 0)) AND next_retry_at IS NULL) OR
+        (state='stopped' AND final_reason_code IN ('deterministic_worker_rejection','deterministic_protocol_failure',
+          'deterministic_control_failure','revision_superseded') AND next_retry_at IS NULL) OR
+        (state='stopped' AND final_reason_code='retry_exhausted' AND attempt_count=6 AND next_retry_at IS NULL) OR
+        (state='stopped' AND final_reason_code='safety_outcome_unknown' AND attempt_count > 0 AND next_retry_at IS NULL) OR
+        (state='stopped' AND final_reason_code='fatal_source_failure' AND attempt_count=0 AND next_retry_at IS NULL)),
+      CHECK(state <> 'scheduled' OR next_retry_at IS NULL OR next_retry_at > updated_at),
+      CHECK(state <> 'scheduled' OR attempt_count < 6), CHECK(state <> 'running' OR attempt_count > 0),
+      CHECK(final_reason_detail IS NULL OR (length(final_reason_detail) <= 512 AND length(trim(final_reason_detail)) > 0))
+    ) STRICT`,
+  `CREATE TABLE configuration_revisions (
+    revision INTEGER PRIMARY KEY CHECK(revision > 0 AND revision <= 9007199254740991),
+    content_hash TEXT NOT NULL CHECK(length(content_hash)=71 AND substr(content_hash,1,7)='sha256:' AND substr(content_hash,8) NOT GLOB '*[^0-9a-f]*'),
+    kind TEXT NOT NULL CHECK(kind IN ('config','admin_state')),
+    created_at INTEGER NOT NULL CHECK(created_at >= 0 AND created_at <= 9007199254740991)
+  ) STRICT`,
+  `CREATE TABLE configuration_serving_snapshots (
+      revision INTEGER NOT NULL CHECK(revision > 0 AND revision <= 9007199254740991),
+      content_hash TEXT NOT NULL CHECK(length(content_hash)=71 AND substr(content_hash,1,7)='sha256:' AND substr(content_hash,8) NOT GLOB '*[^0-9a-f]*'),
+      plugin_catalog_hash TEXT NOT NULL CHECK(length(plugin_catalog_hash)=71 AND substr(plugin_catalog_hash,1,7)='sha256:' AND substr(plugin_catalog_hash,8) NOT GLOB '*[^0-9a-f]*'),
+      aggregate_json TEXT NOT NULL CHECK(json_valid(aggregate_json) AND json_type(aggregate_json)='object'
+        AND length(CAST(aggregate_json AS BLOB)) BETWEEN 2 AND 1048576),
+      PRIMARY KEY(revision,content_hash,plugin_catalog_hash),
+      FOREIGN KEY(revision,content_hash)
+        REFERENCES configuration_revisions(revision,content_hash)
+    ) STRICT, WITHOUT ROWID`,
+  `CREATE TABLE configuration_state (
+      id INTEGER PRIMARY KEY CHECK(id=1),
+      schema_version INTEGER NOT NULL CHECK(schema_version=4),
+      active_revision INTEGER NOT NULL CHECK(active_revision > 0 AND active_revision <= 9007199254740991)
+        REFERENCES configuration_revisions(revision),
+      created_at INTEGER NOT NULL CHECK(created_at >= 0 AND created_at <= 9007199254740991),
+      updated_at INTEGER NOT NULL CHECK(updated_at >= created_at AND updated_at <= 9007199254740991)
+    ) STRICT`,
+  `CREATE TABLE plugin_activations (
+    plugin_name TEXT PRIMARY KEY CHECK(length(plugin_name) > 0 AND plugin_name=lower(plugin_name)
+      AND plugin_name NOT GLOB '*[^a-z0-9-]*' AND substr(plugin_name,1,1) GLOB '[a-z]'
+      AND substr(plugin_name,-1,1)<>'-' AND plugin_name NOT LIKE '%--%')
+  ) STRICT, WITHOUT ROWID`,
+  `CREATE TABLE plugin_bindings (
+    id TEXT PRIMARY KEY CHECK(length(id)=36 AND substr(id,9,1)='-' AND substr(id,14,1)='-' AND substr(id,19,1)='-' AND substr(id,24,1)='-' AND replace(id,'-','') NOT GLOB '*[^0-9a-f]*'),
+    scope_kind TEXT NOT NULL CHECK(scope_kind IN ('global','service','route','upstream')),
+    scope_owner TEXT NOT NULL,
+    service_id TEXT REFERENCES services(id) ON DELETE CASCADE,
+    route_id TEXT REFERENCES routes(id) ON DELETE CASCADE,
+    upstream_id TEXT REFERENCES upstreams(id) ON DELETE CASCADE,
+    position INTEGER NOT NULL CHECK(position >= 0 AND position <= 9007199254740991),
+    plugin_name TEXT NOT NULL CHECK(length(plugin_name) > 0 AND plugin_name=lower(plugin_name)
+      AND plugin_name NOT GLOB '*[^a-z0-9-]*' AND substr(plugin_name,1,1) GLOB '[a-z]'
+      AND substr(plugin_name,-1,1)<>'-' AND plugin_name NOT LIKE '%--%'),
+    options_json TEXT CHECK(options_json IS NULL OR (json_valid(options_json) AND json_type(options_json)='object')),
+    enabled INTEGER NOT NULL CHECK(enabled IN (0,1)),
+    CHECK((scope_kind='global' AND scope_owner='' AND service_id IS NULL AND route_id IS NULL AND upstream_id IS NULL) OR
+          (scope_kind='service' AND service_id IS NOT NULL AND scope_owner=service_id AND route_id IS NULL AND upstream_id IS NULL) OR
+          (scope_kind='route' AND route_id IS NOT NULL AND scope_owner=route_id AND service_id IS NULL AND upstream_id IS NULL) OR
+          (scope_kind='upstream' AND upstream_id IS NOT NULL AND scope_owner=upstream_id AND service_id IS NULL AND route_id IS NULL)),
+    UNIQUE(scope_kind,scope_owner,position)
+  ) STRICT`,
+  `CREATE TABLE routes (
+    id TEXT PRIMARY KEY CHECK(length(id)=36 AND substr(id,9,1)='-' AND substr(id,14,1)='-' AND substr(id,19,1)='-' AND substr(id,24,1)='-' AND replace(id,'-','') NOT GLOB '*[^0-9a-f]*'),
+    position INTEGER NOT NULL UNIQUE CHECK(position >= 0 AND position <= 9007199254740991),
+    path TEXT NOT NULL UNIQUE CHECK(substr(path,1,1)='/'),
+    service_id TEXT REFERENCES services(id),
+    policy_json TEXT NOT NULL CHECK(json_valid(policy_json) AND json_type(policy_json)='object')
+  ) STRICT`,
+  `CREATE TABLE schema_migrations (
+    version INTEGER PRIMARY KEY CHECK(version > 0 AND version <= 9007199254740991),
+    name TEXT NOT NULL UNIQUE
+  ) STRICT`,
+  `CREATE TABLE services (
+    id TEXT PRIMARY KEY CHECK(length(id)=36 AND substr(id,9,1)='-' AND substr(id,14,1)='-' AND substr(id,19,1)='-' AND substr(id,24,1)='-' AND replace(id,'-','') NOT GLOB '*[^0-9a-f]*'),
+    position INTEGER NOT NULL UNIQUE CHECK(position >= 0 AND position <= 9007199254740991),
+    name TEXT NOT NULL UNIQUE CHECK(length(name) > 0),
+    policy_json TEXT NOT NULL CHECK(json_valid(policy_json) AND json_type(policy_json)='object')
+  ) STRICT`,
+  `CREATE TABLE settings (
+    id INTEGER PRIMARY KEY CHECK(id=1),
+    log_level TEXT CHECK(log_level IS NULL OR log_level IN ('trace','debug','info','warn','error','fatal')),
+    body_parser_limit TEXT CHECK(body_parser_limit IS NULL OR CASE
+      WHEN substr(body_parser_limit,-2) IN ('gb','mb','kb') THEN
+        length(substr(body_parser_limit,1,length(body_parser_limit)-2)) > 0
+        AND body_parser_limit=substr(body_parser_limit,1,length(body_parser_limit)-2)||substr(body_parser_limit,-2)
+        AND substr(body_parser_limit,1,1) GLOB '[1-9]'
+        AND substr(body_parser_limit,1,length(body_parser_limit)-2) NOT GLOB '*[^0-9]*'
+        AND (length(substr(body_parser_limit,1,length(body_parser_limit)-2)) < 16 OR
+          (length(substr(body_parser_limit,1,length(body_parser_limit)-2))=16 AND
+           substr(body_parser_limit,1,length(body_parser_limit)-2)<='9007199254740991'))
+      WHEN substr(body_parser_limit,-1)='b' THEN
+        length(substr(body_parser_limit,1,length(body_parser_limit)-1)) > 0
+        AND body_parser_limit=substr(body_parser_limit,1,length(body_parser_limit)-1)||'b'
+        AND substr(body_parser_limit,1,1) GLOB '[1-9]'
+        AND substr(body_parser_limit,1,length(body_parser_limit)-1) NOT GLOB '*[^0-9]*'
+        AND (length(substr(body_parser_limit,1,length(body_parser_limit)-1)) < 16 OR
+          (length(substr(body_parser_limit,1,length(body_parser_limit)-1))=16 AND
+           substr(body_parser_limit,1,length(body_parser_limit)-1)<='9007199254740991'))
+      ELSE 0 END),
+    auth_json TEXT CHECK(auth_json IS NULL OR json_valid(auth_json)),
+    logging_json TEXT CHECK(logging_json IS NULL OR json_valid(logging_json))
+  , publication_json TEXT) STRICT`,
+  `CREATE TABLE supervision_state (
+      id INTEGER PRIMARY KEY CHECK(id=1),
+      instance_id TEXT NOT NULL UNIQUE CHECK(length(instance_id)=36),
+      controller_epoch INTEGER NOT NULL CHECK(controller_epoch >= 0 AND controller_epoch < 9007199254740991),
+      current_controller_id TEXT,
+      updated_at INTEGER NOT NULL CHECK(updated_at >= 0 AND updated_at < 9007199254740991)
+    ) STRICT, WITHOUT ROWID`,
+  `CREATE TABLE upstreams (
+    id TEXT PRIMARY KEY CHECK(length(id)=36 AND substr(id,9,1)='-' AND substr(id,14,1)='-' AND substr(id,19,1)='-' AND substr(id,24,1)='-' AND replace(id,'-','') NOT GLOB '*[^0-9a-f]*'),
+    owner_kind TEXT NOT NULL CHECK(owner_kind IN ('service','route')),
+    service_id TEXT REFERENCES services(id) ON DELETE CASCADE,
+    route_id TEXT REFERENCES routes(id) ON DELETE CASCADE,
+    position INTEGER NOT NULL CHECK(position >= 0 AND position <= 9007199254740991),
+    target TEXT NOT NULL CHECK(length(target) > 0),
+    weight REAL NOT NULL CHECK(weight > 0),
+    priority REAL NOT NULL CHECK(priority > 0),
+    is_disabled INTEGER NOT NULL CHECK(is_disabled IN (0,1)),
+    policy_json TEXT NOT NULL CHECK(json_valid(policy_json) AND json_type(policy_json)='object'),
+    CHECK((owner_kind='service' AND service_id IS NOT NULL AND route_id IS NULL) OR
+          (owner_kind='route' AND route_id IS NOT NULL AND service_id IS NULL)),
+    UNIQUE(owner_kind,service_id,position), UNIQUE(owner_kind,route_id,position)
+  ) STRICT`,
+  `CREATE UNIQUE INDEX configuration_recoveries_active_target_revision
+      ON configuration_recoveries(target_revision) WHERE state IN ('scheduled','running')`,
+  `CREATE UNIQUE INDEX configuration_revisions_revision_content_hash
+      ON configuration_revisions(revision,content_hash)`,
+  `CREATE TRIGGER configuration_operations_terminal_immutable_delete
+      BEFORE DELETE ON configuration_operations
+      WHEN OLD.state IN ('converged','degraded')
+      BEGIN
+        SELECT RAISE(ABORT,'terminal configuration operations are immutable');
+      END`,
+  `CREATE TRIGGER configuration_operations_terminal_immutable_update
+      BEFORE UPDATE ON configuration_operations
+      WHEN OLD.state IN ('converged','degraded')
+      BEGIN
+        SELECT RAISE(ABORT,'terminal configuration operations are immutable');
+      END`,
+  `CREATE TRIGGER configuration_recoveries_no_delete BEFORE DELETE ON configuration_recoveries
+      BEGIN SELECT RAISE(ABORT,'configuration recovery cannot be deleted'); END`,
+  `CREATE TRIGGER configuration_recoveries_sequence_insert_guard BEFORE INSERT ON configuration_recoveries
+      WHEN NEW.recovery_sequence != -1 BEGIN SELECT RAISE(ABORT,'recovery sequence is database assigned'); END`,
+  `CREATE TRIGGER configuration_recoveries_sequence_update_guard BEFORE UPDATE OF recovery_sequence ON configuration_recoveries
+      BEGIN SELECT RAISE(ABORT,'recovery sequence is immutable'); END`,
+  `CREATE TRIGGER configuration_serving_snapshots_immutable_delete
+      BEFORE DELETE ON configuration_serving_snapshots
+      BEGIN
+        SELECT RAISE(ABORT,'configuration serving snapshots are immutable');
+      END`,
+  `CREATE TRIGGER configuration_serving_snapshots_immutable_update
+      BEFORE UPDATE ON configuration_serving_snapshots
+      BEGIN
+        SELECT RAISE(ABORT,'configuration serving snapshots are immutable');
+      END`,
+  `CREATE TRIGGER configuration_state_singleton_id_immutable
+      BEFORE UPDATE OF id ON configuration_state
+      BEGIN
+        SELECT RAISE(ABORT,'configuration state singleton identity is immutable');
+      END`,
+  `CREATE TRIGGER configuration_state_singleton_no_delete
+      BEFORE DELETE ON configuration_state
+      BEGIN
+        SELECT RAISE(ABORT,'configuration state singleton cannot be deleted');
+      END`,
+  `CREATE TRIGGER configuration_state_singleton_no_replace
+      BEFORE INSERT ON configuration_state
+      WHEN EXISTS(SELECT 1 FROM configuration_state)
+      BEGIN
+        SELECT RAISE(ABORT,'configuration state singleton cannot be replaced');
+      END`
+];
+
+// src/config-storage/migrations/baseline.ts
+var CONFIG_BASELINE_VERSION = 1;
+var CONFIG_BASELINE_NAME = "current_storage_baseline";
+var CONFIG_BASELINE = {
+  version: CONFIG_BASELINE_VERSION,
+  name: CONFIG_BASELINE_NAME,
+  up(db) {
+    for (const statement of CONFIG_SCHEMA_STATEMENTS)
+      db.run(statement);
+    const aggregate = { logical_configuration: { services: [], routes: [], plugins: [] }, plugin_activations: [] };
+    replaceActiveMaterialization(db, aggregate);
+    db.run("INSERT INTO configuration_revisions(revision,content_hash,kind,created_at) VALUES(1,?,'config',0)", [hashConfigurationContent(aggregate)]);
+    db.run("INSERT INTO configuration_state(id,schema_version,active_revision,created_at,updated_at) VALUES(1,4,1,0,0)");
+    db.run("INSERT INTO supervision_state(id,instance_id,controller_epoch,current_controller_id,updated_at) VALUES(1,?,0,NULL,0)", [randomUUID()]);
   }
-}
+};
 
-// src/config-storage/relation-materialization.ts
-var UPSTREAM_RESERVED = new Set(["id", "position", "target", "weight", "priority", "is_disabled", "plugins"]);
-function bindingValue(row) {
-  requireUuid(row.id, "plugin_bindings.id");
-  const scopeKind = requireOneOf(row.scope_kind, ["global", "service", "route", "upstream"], "plugin_bindings.scope_kind");
-  const compatibleOwner = scopeKind === "global" ? row.scope_owner === "" && row.service_id === null && row.route_id === null && row.upstream_id === null : scopeKind === "service" ? row.scope_owner === row.service_id && row.service_id !== null && row.route_id === null && row.upstream_id === null : scopeKind === "route" ? row.scope_owner === row.route_id && row.route_id !== null && row.service_id === null && row.upstream_id === null : row.scope_owner === row.upstream_id && row.upstream_id !== null && row.service_id === null && row.route_id === null;
-  if (!compatibleOwner)
-    throw new ConfigRepositoryError("schema_corrupt", "plugin binding owner is invalid");
-  if (scopeKind !== "global")
-    requireUuid(row.scope_owner, "plugin_bindings.scope_owner");
-  return {
-    id: row.id,
-    position: requireSafeInteger(row.position, "plugin_bindings.position"),
-    name: requirePluginName(row.plugin_name, "plugin_bindings.plugin_name"),
-    ...row.options_json === null ? {} : { options: parseCanonicalObject(row.options_json, "options_json") },
-    enabled: requireBooleanInteger(row.enabled, "plugin_bindings.enabled")
-  };
-}
-function groupBindings(rows) {
-  const groups = new Map;
-  for (const row of rows) {
-    const key = `${row.scope_kind}:${row.scope_owner}`;
-    const values = groups.get(key) ?? [];
-    values.push(bindingValue(row));
-    groups.set(key, values);
+// src/config-storage/migrations/publication-retirement.ts
+var PUBLICATION_RETIREMENT_MIGRATION = {
+  version: 2,
+  name: "publication_retirement_and_runtime_recovery",
+  up(db) {
+    db.run(`CREATE TABLE configuration_retirements (
+      mutation_id TEXT PRIMARY KEY REFERENCES configuration_operations(mutation_id),
+      generation INTEGER NOT NULL CHECK(generation >= 0),
+      members_json TEXT NOT NULL CHECK(json_valid(members_json) AND json_type(members_json)='array'),
+      state TEXT NOT NULL CHECK(state IN ('pending','stopped','released')),
+      reason_code TEXT CHECK(reason_code IS NULL OR reason_code IN ('exit_unknown','cleanup_unknown','release_unknown')),
+      updated_at INTEGER NOT NULL CHECK(updated_at >= 0)
+    ) STRICT`);
+    db.run(`CREATE TABLE configuration_retirement_evidence (
+      mutation_id TEXT NOT NULL REFERENCES configuration_retirements(mutation_id),
+      member_id TEXT NOT NULL,
+      exit_state TEXT NOT NULL CHECK(exit_state IN ('live','confirmed','unknown')),
+      cleanup_state TEXT NOT NULL CHECK(cleanup_state IN ('success','failed','unknown')),
+      exit_boot_id TEXT,
+      exit_deadline_ns TEXT,
+      start_boot_id TEXT,
+      start_deadline_ns TEXT,
+      updated_at INTEGER NOT NULL CHECK(updated_at >= 0),
+      CHECK((exit_boot_id IS NULL AND exit_deadline_ns IS NULL) OR (exit_boot_id IS NOT NULL AND exit_deadline_ns IS NOT NULL)),
+      CHECK((start_boot_id IS NULL AND start_deadline_ns IS NULL) OR (start_boot_id IS NOT NULL AND start_deadline_ns IS NOT NULL)),
+      PRIMARY KEY(mutation_id,member_id)
+    ) STRICT, WITHOUT ROWID`);
+    db.run("CREATE TRIGGER retirement_start_deadline_immutable BEFORE UPDATE OF start_boot_id,start_deadline_ns ON configuration_retirement_evidence WHEN OLD.start_deadline_ns IS NOT NULL AND (NEW.start_boot_id IS NOT OLD.start_boot_id OR NEW.start_deadline_ns IS NOT OLD.start_deadline_ns) BEGIN SELECT RAISE(ABORT,'retirement start deadline is immutable'); END");
+    db.run(`CREATE TABLE configuration_publication_serving_sets (
+      mutation_id TEXT NOT NULL REFERENCES configuration_operations(mutation_id),
+      generation INTEGER NOT NULL CHECK(generation >= 0),
+      attempt_key TEXT NOT NULL CHECK(json_valid(attempt_key) AND json_type(attempt_key)='array'),
+      workers_json TEXT NOT NULL CHECK(json_valid(workers_json) AND json_type(workers_json)='array'),
+      exited_json TEXT NOT NULL CHECK(json_valid(exited_json) AND json_type(exited_json)='array'),
+      PRIMARY KEY(mutation_id,generation,attempt_key)
+    ) STRICT, WITHOUT ROWID`);
+    db.run("CREATE TRIGGER publication_serving_authority_no_delete BEFORE DELETE ON configuration_publication_serving_sets BEGIN SELECT RAISE(ABORT,'publication serving authority history is immutable'); END");
+    db.run("CREATE TRIGGER publication_serving_authority_no_update BEFORE UPDATE OF mutation_id,generation,attempt_key,workers_json ON configuration_publication_serving_sets BEGIN SELECT RAISE(ABORT,'publication serving attempt identity is immutable'); END");
+    db.run("CREATE TRIGGER publication_serving_authority_no_replace BEFORE INSERT ON configuration_publication_serving_sets WHEN EXISTS(SELECT 1 FROM configuration_publication_serving_sets WHERE mutation_id=NEW.mutation_id AND generation=NEW.generation AND attempt_key=NEW.attempt_key) BEGIN SELECT RAISE(ABORT,'publication serving authority history is immutable'); END");
+    db.run(`CREATE TABLE runtime_recovery_budget (
+      id INTEGER PRIMARY KEY CHECK(id=1),
+      tickets INTEGER NOT NULL CHECK(tickets BETWEEN 0 AND 2),
+      ticket_id TEXT,
+      ticket_boot_id TEXT,
+      retry_at_ns TEXT,
+      healthy_owner TEXT,
+      healthy_boot_id TEXT,
+      healthy_since_ns TEXT,
+      healthy_last_ns TEXT,
+      CHECK((tickets=0 AND ticket_id IS NULL AND ticket_boot_id IS NULL AND retry_at_ns IS NULL) OR
+        (tickets>0 AND ticket_id IS NOT NULL AND ticket_boot_id IS NOT NULL AND retry_at_ns IS NOT NULL)),
+      CHECK((healthy_owner IS NULL AND healthy_boot_id IS NULL AND healthy_since_ns IS NULL AND healthy_last_ns IS NULL) OR
+        (healthy_owner IS NOT NULL AND healthy_boot_id IS NOT NULL AND healthy_since_ns IS NOT NULL AND healthy_last_ns IS NOT NULL))
+    ) STRICT`);
+    db.run("INSERT INTO runtime_recovery_budget(id,tickets) VALUES(1,0)");
+    db.run(`CREATE TABLE configuration_retirement_retry_requests (
+      request_id TEXT PRIMARY KEY,
+      mutation_id TEXT NOT NULL REFERENCES configuration_retirements(mutation_id),
+      expected_revision INTEGER NOT NULL CHECK(expected_revision>0),
+      created_at INTEGER NOT NULL CHECK(created_at>=0)
+    ) STRICT, WITHOUT ROWID`);
+    db.run("CREATE TRIGGER retirement_retry_no_delete BEFORE DELETE ON configuration_retirement_retry_requests BEGIN SELECT RAISE(ABORT,'retirement retry identity is immutable'); END");
+    db.run("CREATE TRIGGER retirement_retry_no_update BEFORE UPDATE ON configuration_retirement_retry_requests BEGIN SELECT RAISE(ABORT,'retirement retry identity is immutable'); END");
+    db.run("CREATE TRIGGER retirement_retry_no_replace BEFORE INSERT ON configuration_retirement_retry_requests WHEN EXISTS(SELECT 1 FROM configuration_retirement_retry_requests WHERE request_id=NEW.request_id) BEGIN SELECT RAISE(ABORT,'retirement retry identity is immutable'); END");
+    db.run(`CREATE TABLE runtime_recovery_tickets (
+      ticket_id TEXT PRIMARY KEY,
+      owner TEXT NOT NULL,
+      boot_id TEXT NOT NULL,
+      consumed_at_ns TEXT NOT NULL,
+      retry_at_ns TEXT NOT NULL
+    ) STRICT, WITHOUT ROWID`);
+    db.run("CREATE TRIGGER runtime_recovery_tickets_no_delete BEFORE DELETE ON runtime_recovery_tickets BEGIN SELECT RAISE(ABORT,'runtime recovery ticket history is immutable'); END");
+    db.run("CREATE TRIGGER runtime_recovery_tickets_no_update BEFORE UPDATE ON runtime_recovery_tickets BEGIN SELECT RAISE(ABORT,'runtime recovery ticket history is immutable'); END");
+    db.run("CREATE TRIGGER runtime_recovery_tickets_no_replace BEFORE INSERT ON runtime_recovery_tickets WHEN EXISTS(SELECT 1 FROM runtime_recovery_tickets WHERE ticket_id=NEW.ticket_id) BEGIN SELECT RAISE(ABORT,'runtime recovery ticket history is immutable'); END");
+    db.run("CREATE TRIGGER runtime_recovery_budget_no_delete BEFORE DELETE ON runtime_recovery_budget BEGIN SELECT RAISE(ABORT,'runtime recovery budget cannot be deleted'); END");
+    db.run("CREATE TRIGGER runtime_recovery_budget_no_replace BEFORE INSERT ON runtime_recovery_budget WHEN EXISTS(SELECT 1 FROM runtime_recovery_budget) BEGIN SELECT RAISE(ABORT,'runtime recovery budget cannot be replaced'); END");
+    db.run("CREATE TRIGGER runtime_recovery_budget_fixed_identity BEFORE UPDATE OF id ON runtime_recovery_budget BEGIN SELECT RAISE(ABORT,'runtime recovery budget identity is immutable'); END");
   }
-  return groups;
-}
-function takeGroup(groups, key) {
-  const values = groups.get(key) ?? [];
-  groups.delete(key);
-  return values;
+};
+
+// src/config-storage/migrations/plan.ts
+var CONFIG_MIGRATIONS = [CONFIG_BASELINE, PUBLICATION_RETIREMENT_MIGRATION, UI_MENUS_MIGRATION, MANAGEMENT_PROTECTION_MIGRATION, SERVICE_REFERENCES_MIGRATION];
+var CONFIG_SCHEMA_VERSION = CONFIG_MIGRATIONS.at(-1).version;
+
+// src/config-storage/schema-fingerprint.ts
+function readSchemaObjectFingerprint(db) {
+  return canonicalJson(sqliteAll(db, `SELECT type,name,tbl_name,sql
+    FROM sqlite_schema WHERE name NOT LIKE 'sqlite_%' ORDER BY type,name`));
 }
-function groupUpstreams(rows, bindings) {
-  const groups = new Map;
-  for (const row of rows) {
-    requireUuid(row.id, "upstreams.id");
-    const ownerKind = requireOneOf(row.owner_kind, ["service", "route"], "upstreams.owner_kind");
-    if (ownerKind === "service" && row.route_id !== null || ownerKind === "route" && row.service_id !== null) {
-      throw new ConfigRepositoryError("schema_corrupt", "upstream has incompatible owners");
+var expectedDescriptors = new Map;
+function verifySchemaFingerprint(db, version = CONFIG_SCHEMA_VERSION, plan = CONFIG_MIGRATIONS) {
+  if (!plan.some((migration) => migration.version === version)) {
+    throw new ConfigRepositoryError("schema_corrupt", "unsupported configuration schema version");
+  }
+  let expected = plan === CONFIG_MIGRATIONS ? expectedDescriptors.get(version) : undefined;
+  if (expected === undefined) {
+    const reference = new Database(":memory:", { strict: true });
+    try {
+      for (const migration of plan.filter((migration) => migration.version <= version))
+        migration.up(reference);
+      expected = databaseSchemaDescriptor(reference);
+    } finally {
+      reference.close(true);
     }
-    const ownerId = ownerKind === "service" ? row.service_id : row.route_id;
-    if (ownerId === null)
-      throw new ConfigRepositoryError("schema_corrupt", "upstream owner is missing");
-    requireUuid(ownerId, "upstreams.owner_id");
-    const key = `${ownerKind}:${ownerId}`;
-    const values = groups.get(key) ?? [];
-    values.push({
-      ...parseCanonicalObject(row.policy_json, "upstream policy_json", UPSTREAM_RESERVED),
-      id: row.id,
-      position: requireSafeInteger(row.position, "upstreams.position"),
-      target: row.target,
-      weight: requirePositiveFinite(row.weight, "upstreams.weight"),
-      priority: requirePositiveFinite(row.priority, "upstreams.priority"),
-      is_disabled: requireBooleanInteger(row.is_disabled, "upstreams.is_disabled"),
-      plugins: takeGroup(bindings, `upstream:${row.id}`)
-    });
-    groups.set(key, values);
+    if (plan === CONFIG_MIGRATIONS)
+      expectedDescriptors.set(version, expected);
   }
-  return groups;
-}
-
-// src/config-storage/read-materialization.ts
-var SERVICE_RESERVED = new Set(["id", "position", "name", "endpoints", "plugins"]);
-var ROUTE_RESERVED = new Set(["id", "position", "path", "service_id", "service", "endpoints", "plugins"]);
-function readSettings(db) {
-  const hasPublication = sqliteAll(db, "PRAGMA table_info(settings)").some(({ name }) => name === "publication_json");
-  const rows = sqliteAll(db, `SELECT log_level,body_parser_limit,auth_json,logging_json${hasPublication ? ",publication_json" : ",NULL AS publication_json"} FROM settings`);
-  const row = rows[0];
-  if (rows.length !== 1 || row === undefined)
-    throw new ConfigRepositoryError("schema_corrupt", "settings singleton is broken");
-  return {
-    ...row.log_level === null ? {} : { log_level: requireOptionalGlobalScalar(row.log_level, "log_level") },
-    ...row.body_parser_limit === null ? {} : {
-      body_parser_limit: requireOptionalGlobalScalar(row.body_parser_limit, "body_parser_limit")
-    },
-    ...row.auth_json === null ? {} : { auth: parseCanonicalObject(row.auth_json, "auth_json") },
-    ...row.logging_json === null ? {} : { logging: parseCanonicalObject(row.logging_json, "logging_json") },
-    ...row.publication_json === null ? {} : { publication: parseCanonicalObject(row.publication_json, "publication_json") }
-  };
-}
-function readRawActiveAggregate(db) {
-  const bindings = groupBindings(sqliteAll(db, `SELECT id,scope_kind,scope_owner,service_id,route_id,
-    upstream_id,position,plugin_name,options_json,enabled FROM plugin_bindings ORDER BY scope_kind,scope_owner,position`));
-  const upstreams = groupUpstreams(sqliteAll(db, `SELECT id,owner_kind,service_id,route_id,
-    position,target,weight,priority,is_disabled,policy_json FROM upstreams ORDER BY owner_kind,position`), bindings);
-  const services = sqliteAll(db, "SELECT id,position,name,policy_json FROM services ORDER BY position").map((row) => ({
-    ...parseCanonicalObject(row.policy_json, "service policy_json", SERVICE_RESERVED),
-    id: requireUuid(row.id, "services.id"),
-    position: requireSafeInteger(row.position, "services.position"),
-    name: row.name,
-    endpoints: takeGroup(upstreams, `service:${row.id}`),
-    plugins: takeGroup(bindings, `service:${row.id}`)
-  }));
-  const routes = sqliteAll(db, "SELECT id,position,path,service_id,policy_json FROM routes ORDER BY position").map((row) => ({
-    ...parseCanonicalObject(row.policy_json, "route policy_json", ROUTE_RESERVED),
-    id: requireUuid(row.id, "routes.id"),
-    position: requireSafeInteger(row.position, "routes.position"),
-    path: row.path,
-    ...row.service_id === null ? { endpoints: takeGroup(upstreams, `route:${row.id}`) } : { service_id: requireUuid(row.service_id, "routes.service_id") },
-    plugins: takeGroup(bindings, `route:${row.id}`)
-  }));
-  const activations = sqliteAll(db, "SELECT plugin_name FROM plugin_activations ORDER BY plugin_name");
-  const input = { logical_configuration: {
-    ...readSettings(db),
-    services,
-    routes,
-    plugins: takeGroup(bindings, "global:")
-  }, plugin_activations: activations.map(({ plugin_name }) => ({
-    plugin_name: requirePluginName(plugin_name, "plugin_activations.plugin_name")
-  })) };
-  if (bindings.size !== 0 || upstreams.size !== 0) {
-    throw new ConfigRepositoryError("schema_corrupt", "normalized relation rows were not consumed");
+  if (databaseSchemaDescriptor(db) !== expected) {
+    throw new ConfigRepositoryError("schema_corrupt", "configuration schema fingerprint is invalid");
   }
-  return input;
-}
-function readActiveAggregate(db) {
-  const result = parseNormalizeCompileAggregate(readRawActiveAggregate(db));
-  if (!result.ok)
-    throw new ConfigRepositoryError("schema_corrupt", "active configuration is invalid", result.errors);
-  return result.value;
 }
 
-// src/config-storage/consistent-read.ts
-function withConsistentRead(db, fn) {
-  if (db.inTransaction)
-    return fn();
-  return db.transaction(fn).deferred();
+// src/config-storage/sqlite-errors.ts
+function isSqliteBusyError(error) {
+  if (!(error instanceof Error))
+    return false;
+  const sqliteError = error;
+  const errno = sqliteError.errno;
+  if (typeof errno === "number" && ((errno & 255) === 5 || (errno & 255) === 6))
+    return true;
+  const code = sqliteError.code;
+  return code === "SQLITE_BUSY" || code === "SQLITE_LOCKED" || code?.startsWith("SQLITE_BUSY_") === true || code?.startsWith("SQLITE_LOCKED_") === true;
+}
+function repositoryFailure(message, cause) {
+  return new ConfigRepositoryError("repository_failure", message, cause);
 }
 
 // src/config-storage/repository-snapshot.ts
@@ -10098,6 +10305,8 @@ function verifyIntegrity(db, allowActiveRecoveryDrift = false, checkDatabasePage
   verifySchemaFingerprint(db);
   readManagementProtection(db);
   verifyRecoveryIntegrity(db, allowActiveRecoveryDrift);
+  if (checkDatabasePages)
+    auditServingSnapshotHistory(db);
   const integrity = checkDatabasePages ? sqliteGet(db, "PRAGMA integrity_check")?.integrity_check : "ok";
   const foreignKeyFailures = sqliteAll(db, "PRAGMA foreign_key_check");
   if (integrity !== "ok" || foreignKeyFailures.length > 0) {
@@ -10144,101 +10353,109 @@ function verifyRepositoryIntegrity(db) {
   }
 }
 
-// src/config-storage/serving-snapshot.ts
-var MAX_AGGREGATE_BYTES = 1048576;
-function invalid4(message) {
-  throw new ConfigRepositoryError("invalid_configuration", message);
-}
-function corrupt3(message) {
-  throw new ConfigRepositoryError("serving_snapshot_corrupt", message);
-}
-function canonicalAggregate(aggregate) {
-  const result = parseNormalizeCompileAggregate(aggregate, undefined);
-  if (!result.ok)
-    invalid4("configuration aggregate is invalid");
-  const aggregateJson = canonicalJson(result.value);
-  const bytes = new TextEncoder().encode(aggregateJson).byteLength;
-  if (bytes < 2 || bytes > MAX_AGGREGATE_BYTES) {
-    invalid4("configuration aggregate is too large");
-  }
-  return { aggregateJson, contentHash: hashConfigurationContent(result.value) };
-}
-function appendServingSnapshot(db, snapshot, pluginCatalogHash) {
-  if (!Number.isSafeInteger(snapshot?.revision) || snapshot.revision <= 0 || typeof snapshot.content_hash !== "string" || !validateDigest(snapshot.content_hash) || !validateDigest(pluginCatalogHash)) {
-    invalid4("serving snapshot identity is invalid");
-  }
-  const normalized = canonicalAggregate(snapshot.aggregate);
-  if (normalized.contentHash !== snapshot.content_hash) {
-    invalid4("configuration aggregate content hash does not match");
-  }
-  const transaction = db.transaction(() => {
-    const revision = sqliteGet(db, "SELECT revision,content_hash FROM configuration_revisions WHERE revision=?", snapshot.revision);
-    if (revision === null || revision.content_hash !== snapshot.content_hash) {
-      invalid4("serving snapshot revision does not match configuration history");
-    }
-    const existing = sqliteGet(db, `SELECT revision,content_hash,plugin_catalog_hash,aggregate_json
-       FROM configuration_serving_snapshots
-       WHERE revision=? AND content_hash=? AND plugin_catalog_hash=?`, snapshot.revision, snapshot.content_hash, pluginCatalogHash);
-    if (existing !== null) {
-      if (existing.aggregate_json !== normalized.aggregateJson) {
-        corrupt3("configuration serving snapshot is immutable and inconsistent");
-      }
-      return;
+// src/config-storage/service-reference-upgrade.ts
+function convertServiceReferenceRevision(db, options) {
+  const unfinished = db.query(`
+    SELECT 'publication' AS kind,mutation_id AS identity,state FROM configuration_operations
+      WHERE state IN ('committed','publishing','draining')
+    UNION ALL SELECT 'retirement',mutation_id,state FROM configuration_retirements WHERE state<>'released'
+    UNION ALL SELECT 'recovery',recovery_id,state FROM configuration_recoveries
+      WHERE state IN ('scheduled','running') OR (state='stopped'
+        AND target_revision=(SELECT active_revision FROM configuration_state WHERE id=1)
+        AND recovery_sequence=(SELECT max(recovery_sequence) FROM configuration_recoveries
+          WHERE target_revision=(SELECT active_revision FROM configuration_state WHERE id=1)))
+    LIMIT 1`).get();
+  if (unfinished)
+    throw new ConfigRepositoryError("migration_failed", `service reference upgrade cannot resume ${unfinished.kind} ${unfinished.identity} (${unfinished.state}); finish it with the previous executable before upgrading`);
+  verifyRepositoryIntegrity(db);
+  const audited = auditConfigurationTables(db);
+  const aggregate = readActiveAggregate(db);
+  const previous = {
+    ...aggregate,
+    logical_configuration: {
+      ...aggregate.logical_configuration,
+      routes: aggregate.logical_configuration.routes.map((route) => {
+        if (!route.service_references)
+          return route;
+        const { service_references, ...rest } = route;
+        if (service_references.length !== 1)
+          throw new ConfigRepositoryError("migration_failed", "unexpected route references during upgrade");
+        return { ...rest, service_id: service_references[0].service_id };
+      })
     }
-    db.run(`INSERT INTO configuration_serving_snapshots
-      (revision,content_hash,plugin_catalog_hash,aggregate_json) VALUES (?,?,?,?)`, [snapshot.revision, snapshot.content_hash, pluginCatalogHash, normalized.aggregateJson]);
+  };
+  const previousHash = hashConfigurationContent(previous);
+  if (previousHash !== audited.activeRevisionRow.content_hash) {
+    throw new ConfigRepositoryError("schema_corrupt", "pre-upgrade configuration content hash does not match");
+  }
+  verifyActiveRequestIdentity(audited, previous);
+  if (hashConfigurationContent(aggregate) === previousHash)
+    return;
+  const snapshot = { revision: audited.activeRevision, content_hash: previousHash, aggregate: previous };
+  const operationId = randomUUID2(), now = Math.max(Date.now(), audited.activeOperation?.updated_at ?? 0);
+  const prepared = prepareCommitCommand({
+    mutation_id: operationId,
+    expected_revision: snapshot.revision,
+    aggregate,
+    kind: "config",
+    created_at: now,
+    target_worker_slots: []
   });
-  transaction.immediate();
+  const provider = readManagementProtection(db).selectedProvider;
+  const command = {
+    ...prepared,
+    managementProvider: provider,
+    requestHash: hashConfigurationRequest({
+      kind: prepared.kind,
+      expected_revision: prepared.expectedRevision,
+      aggregate: prepared.aggregate,
+      target_worker_slots: [],
+      management_provider: provider
+    })
+  };
+  const result = commitTransaction(db, command, options, snapshot);
+  if (result.kind !== "committed")
+    throw new ConfigRepositoryError("migration_failed", `service reference revision commit failed (${result.kind})`);
+  beginPublication(db, operationId, now);
+  markDraining(db, operationId, now);
+  finalizePublication(db, operationId, { outcome: "converged", old_workers_exited: true }, now);
+  readRepositorySnapshot(db);
 }
-function getServingSnapshot(db, key) {
-  if (!Number.isSafeInteger(key?.revision) || key.revision <= 0 || typeof key.content_hash !== "string" || !validateDigest(key.content_hash) || typeof key.plugin_catalog_hash !== "string" || !validateDigest(key.plugin_catalog_hash)) {
-    invalid4("serving snapshot lookup identity is invalid");
+
+// src/config-storage/migrations/index.ts
+function migrateConfigurationDatabase(db, plan = CONFIG_MIGRATIONS, options = {}) {
+  try {
+    db.transaction(() => {
+      if (!plan.length || plan[0] !== CONFIG_MIGRATIONS[0] || plan.some((m, i) => i > 0 && m.version !== plan[i - 1].version + 1) || new Set(plan.map((m) => m.name)).size !== plan.length)
+        throw new ConfigRepositoryError("migration_failed", "invalid configuration migration plan");
+      const count = db.query("SELECT count(*) AS count FROM sqlite_schema WHERE name NOT LIKE 'sqlite_%'").get().count;
+      let applied = [];
+      if (count > 0) {
+        applied = db.query("SELECT version,name FROM schema_migrations ORDER BY version").all();
+        if (!applied.length || applied.length > plan.length || applied.some((r, i) => r.version !== plan[i]?.version || r.name !== plan[i]?.name))
+          throw new ConfigRepositoryError("schema_corrupt", "configuration migration history is not an exact baseline prefix");
+        verifySchemaFingerprint(db, applied.at(-1).version, plan);
+      }
+      for (const migration of plan.slice(applied.length)) {
+        migration.up(db);
+        db.run("INSERT INTO schema_migrations(version,name) VALUES(?,?)", [migration.version, migration.name]);
+      }
+      verifySchemaFingerprint(db, plan.at(-1).version, plan);
+      if (plan === CONFIG_MIGRATIONS && applied.length > 0 && applied.at(-1).version < 5) {
+        convertServiceReferenceRevision(db, options);
+      }
+    }).immediate();
+  } catch (error) {
+    if (error instanceof ConfigRepositoryError)
+      throw error;
+    if (isSqliteBusyError(error))
+      throw repositoryFailure("configuration migration was blocked by SQLite", error);
+    throw new ConfigRepositoryError("migration_failed", "configuration migration failed", error);
   }
-  return withConsistentRead(db, () => {
-    const row = sqliteGet(db, `SELECT revision,content_hash,plugin_catalog_hash,aggregate_json
-       FROM configuration_serving_snapshots
-       WHERE revision=? AND content_hash=? AND plugin_catalog_hash=?`, key.revision, key.content_hash, key.plugin_catalog_hash);
-    if (row === null)
-      return null;
-    if (row.revision !== key.revision || row.content_hash !== key.content_hash || row.plugin_catalog_hash !== key.plugin_catalog_hash || !Number.isSafeInteger(row.revision) || row.revision <= 0 || !validateDigest(row.content_hash) || !validateDigest(row.plugin_catalog_hash)) {
-      corrupt3("configuration serving snapshot identity is invalid");
-    }
-    const bytes = new TextEncoder().encode(row.aggregate_json).byteLength;
-    if (bytes < 2 || bytes > MAX_AGGREGATE_BYTES)
-      corrupt3("configuration serving snapshot size is invalid");
-    let parsed;
-    try {
-      parsed = JSON.parse(row.aggregate_json);
-    } catch {
-      corrupt3("configuration serving snapshot JSON is invalid");
-    }
-    let canonical;
-    try {
-      canonical = canonicalJson(parsed);
-    } catch {
-      corrupt3("configuration serving snapshot JSON is invalid");
-    }
-    if (canonical !== row.aggregate_json)
-      corrupt3("configuration serving snapshot JSON is not canonical");
-    const normalized = parseNormalizeCompileAggregate(parsed, undefined);
-    if (!normalized.ok)
-      corrupt3("configuration serving snapshot aggregate is invalid");
-    if (canonicalJson(normalized.value) !== row.aggregate_json) {
-      corrupt3("configuration serving snapshot aggregate normalization drifted");
-    }
-    if (hashConfigurationContent(normalized.value) !== key.content_hash) {
-      corrupt3("configuration serving snapshot content hash is invalid");
-    }
-    const revision = sqliteGet(db, "SELECT revision,content_hash FROM configuration_revisions WHERE revision=?", key.revision);
-    if (revision === null || revision.revision !== key.revision || revision.content_hash !== key.content_hash) {
-      corrupt3("configuration serving snapshot revision is invalid");
-    }
-    return { revision: row.revision, content_hash: row.content_hash, aggregate: normalized.value };
-  });
 }
 
 // src/config-storage/config-repository.ts
-import { randomUUID as randomUUID2 } from "crypto";
+import { randomUUID as randomUUID3 } from "crypto";
 
 // src/config-storage/sqlite-version.ts
 class SqliteVersionError extends Error {
@@ -10446,7 +10663,7 @@ class ConfigRepository {
       mkdirSync(dirname2(dbPath), { recursive: true });
       db = new Database3(dbPath, { create: true, readwrite: true, strict: true });
       configureConnection(db);
-      migrateConfigurationDatabase(db);
+      migrateConfigurationDatabase(db, undefined, options);
       verifyRepositoryIntegrity(db);
       const repository = new ConfigRepository(db, options, freezeSnapshot(readRepositorySnapshot(db)));
       repository.removeUnavailablePlugins();
@@ -10525,7 +10742,7 @@ class ConfigRepository {
         return;
       const protection = readManagementProtection(this.db);
       const provider = protection.selectedProvider !== null && available.has(protection.selectedProvider) ? protection.selectedProvider : null;
-      const now = Date.now(), operationId = randomUUID2();
+      const now = Date.now(), operationId = randomUUID3();
       const prepared = prepareCommitCommand({
         mutation_id: operationId,
         expected_revision: snapshot.revision,
@@ -10780,14 +10997,14 @@ class ConfigRepository {
       if (before.state !== "converged" && before.state !== "degraded" && outcome.outcome === "degraded" && (outcome.error_code === "replacement_convergence_failed" || outcome.error_code === "control_readiness_failed")) {
         switch (outcome.recovery_disposition) {
           case "retryable":
-            createAutomaticRecovery(this.db, randomUUID2(), mutationId, operation.committed_revision, updatedAt);
+            createAutomaticRecovery(this.db, randomUUID3(), mutationId, operation.committed_revision, updatedAt);
             this.options.faultInjection?.("after_automatic_recovery");
             break;
           case "deterministic_worker_rejection":
           case "deterministic_protocol_failure":
           case "deterministic_control_failure":
           case "fatal":
-            createStoppedRecovery(this.db, randomUUID2(), mutationId, operation.committed_revision, outcome.recovery_disposition === "fatal" ? "fatal_source_failure" : outcome.recovery_disposition, outcome.error_detail, updatedAt);
+            createStoppedRecovery(this.db, randomUUID3(), mutationId, operation.committed_revision, outcome.recovery_disposition === "fatal" ? "fatal_source_failure" : outcome.recovery_disposition, outcome.error_detail, updatedAt);
             break;
           default: {
             const unhandled = outcome.recovery_disposition;