@kici-dev/orchestrator 0.1.17 → 0.1.18

package/dist/standalone.js

@@ -8,7 +8,7 @@ import { LOGGER_ENV_VARS, defineEnv, validateUnknownKiciVars } from "@kici-dev/s
 import WebSocket from "ws";
 import * as fs from "node:fs";
 import { chmodSync, closeSync, createReadStream, createWriteStream, mkdirSync, mkdtempSync, openSync, promises, readFileSync, rmSync, statSync, unlinkSync, unwatchFile, watchFile, writeFileSync } from "node:fs";
-import { ALLOWED_SYSTEM_VARS, AccessLogAction, AccessLogOutcome, AccessLogSource, AccessLogTargetType, ActorType, CacheRefScope, CheckRunConclusion, EnvDeleteErrorCode, EventLogSource, EventLogStatus, ExecutionJobStatus, ExecutionRunStatus, ExecutionStepStatus, FanoutError, HoldScope, IfFailedPolicy, InitFailureCategory, KICI_AGENT_ENV_PREFIX, KNOWN_ROLES, LockFileParseError, MIN_PROTOCOL_VERSION, PROTOCOL_VERSION, PayloadOmittedReason, RegisterableTriggerType, SCHEMA_VERSION, ScalerBackendType, ScalerEventType, ScalerEventType as ScalerEventType$1, SourceSubtype, TERMINAL_JOB_STATES, TERMINAL_RUN_STATES, TimeoutReason, TriggerSource, WS_CLOSE_AGENT_AUTH_FAILED, WS_CLOSE_AUTH_TIMEOUT, WS_CLOSE_DISPATCH_ACK_TIMEOUT, WS_CLOSE_GOING_AWAY, WS_CLOSE_HEARTBEAT_TIMEOUT, WS_CLOSE_INVALID_MESSAGE, WS_CLOSE_PROTOCOL_ERROR, WS_CLOSE_UNAUTHORIZED, WS_MAX_PAYLOAD_BYTES, WsRateLimiter, accessLogWarmSqlCase, agentAuthRequestSchema, agentToOrchestratorMessageSchema, agentTypeLabel, deriveOsArchLabels, flattenActor, getAccessLogColdDays, getSecretAuditLogColdDays, isLockDynamicJobFn, isLockInlineValue, isLockStaticJob, isSelfReportedLabel, matchAllWorkflows, materializeFanout, materializeResolvedMatrix, matrixEnvelopeFields, minAccessLogWarmDays, minSecretAuditLogWarmDays, peerAuthRequestSchema, peerFromPeerMessageSchema, peerHelloResponseSchema, peerHelloSchema, resolveRoleLabels, scalerAgentLabels, scalerLabel, secretAuditLogWarmSqlCase, shouldRecordAccess, shouldRecordSecretResolve } from "@kici-dev/engine";
+import { ALLOWED_SYSTEM_VARS, AccessLogAction, AccessLogOutcome, AccessLogSource, AccessLogTargetType, ActorType, CacheRefScope, CheckRunConclusion, EnvDeleteErrorCode, EventLogSource, EventLogStatus, ExecutionJobStatus, ExecutionRunStatus, ExecutionStepStatus, FanoutError, HoldScope, IfFailedPolicy, InitFailureCategory, KICI_AGENT_ENV_PREFIX, KNOWN_ROLES, LockFileParseError, MIN_PROTOCOL_VERSION, PROTOCOL_VERSION, PayloadOmittedReason, RegisterableTriggerType, SCHEMA_VERSION, ScalerBackendType, ScalerEventType, ScalerEventType as ScalerEventType$1, SourceSubtype, TERMINAL_JOB_STATES, TERMINAL_RUN_STATES, TimeoutReason, TriggerSource, VariantKind, WS_CLOSE_AGENT_AUTH_FAILED, WS_CLOSE_AUTH_TIMEOUT, WS_CLOSE_DISPATCH_ACK_TIMEOUT, WS_CLOSE_GOING_AWAY, WS_CLOSE_HEARTBEAT_TIMEOUT, WS_CLOSE_INVALID_MESSAGE, WS_CLOSE_PROTOCOL_ERROR, WS_CLOSE_UNAUTHORIZED, WS_MAX_PAYLOAD_BYTES, WsRateLimiter, accessLogWarmSqlCase, agentAuthRequestSchema, agentToOrchestratorMessageSchema, agentTypeLabel, deriveOsArchLabels, flattenActor, getAccessLogColdDays, getSecretAuditLogColdDays, isLockDynamicJobFn, isLockInlineValue, isLockStaticJob, isSelfReportedLabel, matchAllWorkflows, matcherSatisfiedBy, materializeFanout, materializeResolvedHosts, materializeResolvedMatrix, matrixEnvelopeFields, minAccessLogWarmDays, minSecretAuditLogWarmDays, partitionMatchers, peerAuthRequestSchema, peerFromPeerMessageSchema, peerHelloResponseSchema, peerHelloSchema, resolveRoleLabels, scalerAgentLabels, scalerLabel, secretAuditLogWarmSqlCase, shouldRecordAccess, shouldRecordSecretResolve } from "@kici-dev/engine";
 import { access, appendFile, chmod, constants, copyFile, link, mkdir, mkdtemp, open, readFile, readdir, rename, rm, stat, statfs, writeFile } from "node:fs/promises";
 import * as path$1 from "node:path";
 import path, { dirname, join, relative, resolve } from "node:path";
@@ -19,6 +19,7 @@ import { serve } from "@hono/node-server";
 import { parse } from "yaml";
 import { gunzipSync, gzipSync } from "node:zlib";
 import { LRUCache } from "lru-cache";
+import { assertMatchersSafe } from "@kici-dev/engine/labels/compile";
 import { bodyLimit } from "hono/body-limit";
 import { createNodeWebSocket } from "@hono/node-ws";
 import { getConnInfo } from "@hono/node-server/conninfo";
@@ -41,7 +42,7 @@ import { JSONPath } from "jsonpath-plus";
 import { execFile, spawn } from "node:child_process";
 import { promisify } from "node:util";
 import vm from "node:vm";
-import archiver from "archiver";
+import { ZipArchive } from "archiver";
 import { createInterface } from "node:readline";
 import Docker from "dockerode";
 import http from "node:http";
@@ -206,6 +207,9 @@ var init_config$5 = __esmMin((() => {
 		pgCustomerSecrets: z.enum(["true", "false"]).default("true").transform((v) => v === "true"),
 		agentAuth: z.enum(["token", "none"]).default("token"),
 		agentTokenTtlMs: z.coerce.number().default(36e5),
+		rosterGraceMs: z.coerce.number().int().min(1e3).default(3e5),
+		rosterTtlMs: z.coerce.number().int().min(1e3).default(18e5),
+		maxFanoutHosts: z.coerce.number().int().min(1).default(1024),
 		eventRouterMaxChainDepth: z.coerce.number().default(10),
 		eventRouterRateLimitPerWorkflowPerMinute: z.coerce.number().default(100),
 		eventRouterEventTtlSeconds: z.coerce.number().default(604800),
@@ -393,6 +397,9 @@ var init_config$5 = __esmMin((() => {
 			pgCustomerSecrets: "KICI_PG_CUSTOMER_SECRETS",
 			agentAuth: "KICI_AGENT_AUTH",
 			agentTokenTtlMs: "KICI_AGENT_TOKEN_TTL_MS",
+			rosterGraceMs: "KICI_ROSTER_GRACE_MS",
+			rosterTtlMs: "KICI_ROSTER_TTL_MS",
+			maxFanoutHosts: "KICI_MAX_FANOUT_HOSTS",
 			eventRouterMaxChainDepth: "KICI_EVENT_ROUTER_MAX_CHAIN_DEPTH",
 			eventRouterRateLimitPerWorkflowPerMinute: "KICI_EVENT_ROUTER_RATE_LIMIT_PER_WORKFLOW_PER_MINUTE",
 			eventRouterEventTtlSeconds: "KICI_EVENT_ROUTER_EVENT_TTL_SECONDS",
@@ -1053,12 +1060,12 @@ var init_peer_credentials = __esmMin((() => {
 * Authentication uses ECDH key exchange followed by join token (first connect)
 * or HMAC credential proof (reconnection).
 */
-var logger$87, SOFTWARE_VERSION$1, PeerClient$1;
+var logger$89, SOFTWARE_VERSION$1, PeerClient$1;
 var init_peer_client = __esmMin((() => {
 	init_peer_crypto();
 	init_peer_credentials();
-	logger$87 = createLogger({ prefix: "peer-client" });
-	SOFTWARE_VERSION$1 = "0.1.17";
+	logger$89 = createLogger({ prefix: "peer-client" });
+	SOFTWARE_VERSION$1 = "0.1.18";
 	PeerClient$1 = class {
 		ws = null;
 		_state = "disconnected";
@@ -1132,7 +1139,7 @@ var init_peer_client = __esmMin((() => {
 		*/
 		connect() {
 			if (this._state !== "disconnected") {
-				logger$87.warn("connect() called while not disconnected", { state: this._state });
+				logger$89.warn("connect() called while not disconnected", { state: this._state });
 				return;
 			}
 			this.intentionalDisconnect = false;
@@ -1266,20 +1273,20 @@ var init_peer_client = __esmMin((() => {
 					}
 				});
 			} catch (err) {
-				logger$87.error("Failed to create peer WebSocket", { error: toErrorMessage(err) });
+				logger$89.error("Failed to create peer WebSocket", { error: toErrorMessage(err) });
 				this._state = "disconnected";
 				this.scheduleReconnect();
 				return;
 			}
 			this.ws.on("open", () => {
 				this._state = "handshaking";
-				logger$87.info("Connected to peer, waiting for ECDH handshake", { url: this.url });
+				logger$89.info("Connected to peer, waiting for ECDH handshake", { url: this.url });
 			});
 			this.ws.on("message", (data) => {
 				this.handleMessage(data);
 			});
 			this.ws.on("close", (code, reason) => {
-				logger$87.info("Peer connection closed", {
+				logger$89.info("Peer connection closed", {
 					code,
 					reason: reason.toString(),
 					targetInstanceId: this._targetInstanceId
@@ -1292,7 +1299,7 @@ var init_peer_client = __esmMin((() => {
 				if (!this.intentionalDisconnect) this.scheduleReconnect();
 			});
 			this.ws.on("error", (err) => {
-				logger$87.error("Peer WebSocket error", { error: err.message });
+				logger$89.error("Peer WebSocket error", { error: err.message });
 				if (this.ws && this.ws.readyState === WebSocket.OPEN) this.ws.close();
 			});
 		}
@@ -1303,12 +1310,12 @@ var init_peer_client = __esmMin((() => {
 				try {
 					parsed = JSON.parse(raw);
 				} catch {
-					logger$87.warn("Malformed JSON during handshake");
+					logger$89.warn("Malformed JSON during handshake");
 					return;
 				}
 				const hello = peerHelloSchema.safeParse(parsed);
 				if (!hello.success) {
-					logger$87.warn("Expected peer.hello, got invalid message");
+					logger$89.warn("Expected peer.hello, got invalid message");
 					return;
 				}
 				const ecdh = generateEcdhKeyPair();
@@ -1317,7 +1324,7 @@ var init_peer_client = __esmMin((() => {
 				try {
 					this.sessionKey = deriveSessionKey(ecdh.privateKey, serverPubKey, nonce);
 				} catch (err) {
-					logger$87.error("ECDH key derivation failed", { error: toErrorMessage(err) });
+					logger$89.error("ECDH key derivation failed", { error: toErrorMessage(err) });
 					if (this.ws) this.ws.close(1e3, "Key derivation failed");
 					return;
 				}
@@ -1327,48 +1334,48 @@ var init_peer_client = __esmMin((() => {
 				}));
 				this._state = "authenticating";
 				this.sendAuthRequest(nonce).catch((err) => {
-					logger$87.error("Failed to send auth request", { error: toErrorMessage(err) });
+					logger$89.error("Failed to send auth request", { error: toErrorMessage(err) });
 					if (this.ws) this.ws.close(1e3, "Auth request failed");
 				});
 				return;
 			}
 			if (this._state === "authenticating") {
 				if (!this.sessionKey) {
-					logger$87.warn("No session key for auth response decryption");
+					logger$89.warn("No session key for auth response decryption");
 					return;
 				}
 				let decrypted;
 				try {
 					decrypted = decryptMessage(raw, this.sessionKey);
 				} catch {
-					logger$87.warn("Failed to decrypt auth response");
+					logger$89.warn("Failed to decrypt auth response");
 					return;
 				}
 				let parsed;
 				try {
 					parsed = JSON.parse(decrypted);
 				} catch {
-					logger$87.warn("Malformed JSON in decrypted auth response");
+					logger$89.warn("Malformed JSON in decrypted auth response");
 					return;
 				}
 				const msgResult = peerFromPeerMessageSchema.safeParse(parsed);
 				if (!msgResult.success) {
-					logger$87.warn("Invalid auth response", { errors: msgResult.error.issues });
+					logger$89.warn("Invalid auth response", { errors: msgResult.error.issues });
 					return;
 				}
 				if (msgResult.data.type !== "peer.auth.response") {
-					logger$87.warn("Expected peer.auth.response, got", { type: msgResult.data.type });
+					logger$89.warn("Expected peer.auth.response, got", { type: msgResult.data.type });
 					return;
 				}
 				const msg = msgResult.data;
 				if (msg.accepted) {
-					if (msg.softwareVersion) logger$87.info("Coordinator software version", {
+					if (msg.softwareVersion) logger$89.info("Coordinator software version", {
 						localVersion: SOFTWARE_VERSION$1,
 						coordinatorVersion: msg.softwareVersion
 					});
 					this._targetInstanceId = msg.instanceId ?? null;
 					if (msg.instanceId) this.onAuthenticated?.(msg.instanceId);
-					logger$87.info("Peer auth accepted", {
+					logger$89.info("Peer auth accepted", {
 						targetInstanceId: msg.instanceId,
 						agentCount: msg.agents?.length ?? 0,
 						scalerBackends: msg.scalerCapacity?.length ?? 0
@@ -1381,7 +1388,7 @@ var init_peer_client = __esmMin((() => {
 						role: msg.role ?? "coordinator",
 						issuedAt: (/* @__PURE__ */ new Date()).toISOString()
 					}).catch((err) => {
-						logger$87.error("Failed to persist credential file", { error: toErrorMessage(err) });
+						logger$89.error("Failed to persist credential file", { error: toErrorMessage(err) });
 					});
 					this.peerRegistry.addPeer({
 						instanceId: msg.instanceId,
@@ -1409,12 +1416,12 @@ var init_peer_client = __esmMin((() => {
 					}
 					this.startHeartbeat();
 				} else {
-					logger$87.error("Peer auth rejected", { reason: msg.reason });
+					logger$89.error("Peer auth rejected", { reason: msg.reason });
 					if (msg.reason === "Invalid proof" || msg.reason === "Unknown credential" || msg.reason === "Credential revoked") try {
 						unlinkSync(this.credentialFile);
-						logger$87.warn("Deleted stale credential file after server rejection", { reason: msg.reason });
+						logger$89.warn("Deleted stale credential file after server rejection", { reason: msg.reason });
 					} catch (err) {
-						if (err.code !== "ENOENT") logger$87.warn("Failed to delete stale credential file", {
+						if (err.code !== "ENOENT") logger$89.warn("Failed to delete stale credential file", {
 							error: toErrorMessage(err),
 							path: this.credentialFile
 						});
@@ -1428,19 +1435,19 @@ var init_peer_client = __esmMin((() => {
 			try {
 				decrypted = decryptMessage(raw, this.sessionKey);
 			} catch {
-				logger$87.warn("Failed to decrypt message from peer");
+				logger$89.warn("Failed to decrypt message from peer");
 				return;
 			}
 			let parsed;
 			try {
 				parsed = JSON.parse(decrypted);
 			} catch {
-				logger$87.warn("Malformed JSON from peer");
+				logger$89.warn("Malformed JSON from peer");
 				return;
 			}
 			const msgResult = peerFromPeerMessageSchema.safeParse(parsed);
 			if (!msgResult.success) {
-				logger$87.warn("Invalid message from peer", { errors: msgResult.error.issues });
+				logger$89.warn("Invalid message from peer", { errors: msgResult.error.issues });
 				return;
 			}
 			this.routeMessage(msgResult.data);
@@ -1482,7 +1489,7 @@ var init_peer_client = __esmMin((() => {
 					softwareVersion: SOFTWARE_VERSION$1,
 					role: this.role
 				};
-				logger$87.info("Sending credential-based auth request", {
+				logger$89.info("Sending credential-based auth request", {
 					targetUrl: this.url,
 					credentialInstanceId: cred.instanceId
 				});
@@ -1496,10 +1503,10 @@ var init_peer_client = __esmMin((() => {
 					softwareVersion: SOFTWARE_VERSION$1,
 					role: this.role
 				};
-				logger$87.info("Sending token-based auth request");
+				logger$89.info("Sending token-based auth request");
 				this.ws.send(encryptMessage(JSON.stringify(authRequest), this.sessionKey));
 			} else {
-				logger$87.error("No auth method available: no credential file and no join token");
+				logger$89.error("No auth method available: no credential file and no join token");
 				if (this.ws.readyState === WebSocket.OPEN) this.ws.close(1e3, "No auth method");
 			}
 		}
@@ -1510,7 +1517,7 @@ var init_peer_client = __esmMin((() => {
 					break;
 				case "job.reroute":
 					this.onJobReroute(msg).catch((err) => {
-						logger$87.error("Error handling job reroute", { error: toErrorMessage(err) });
+						logger$89.error("Error handling job reroute", { error: toErrorMessage(err) });
 					});
 					break;
 				case "job.reroute.ack": {
@@ -1518,7 +1525,7 @@ var init_peer_client = __esmMin((() => {
 					if (waiter) {
 						clearTimeout(waiter.timer);
 						this.ackWaiters.delete(msg.messageId);
-						if (!msg.accepted) logger$87.info("Reroute ACK rejected by peer", {
+						if (!msg.accepted) logger$89.info("Reroute ACK rejected by peer", {
 							targetInstanceId: this._targetInstanceId,
 							reason: msg.reason
 						});
@@ -1548,7 +1555,7 @@ var init_peer_client = __esmMin((() => {
 					if (this.onPeerCacheUploadRequest) this.onPeerCacheUploadRequest(msg).then((response) => {
 						this.send(response);
 					}).catch((err) => {
-						logger$87.error("Error handling cache upload request", { error: toErrorMessage(err) });
+						logger$89.error("Error handling cache upload request", { error: toErrorMessage(err) });
 					});
 					break;
 				case "peer.cache.upload.response": {
@@ -1561,7 +1568,7 @@ var init_peer_client = __esmMin((() => {
 					break;
 				}
 				case "peer.auth.request":
-					logger$87.warn("Unexpected peer.auth.request on outgoing connection");
+					logger$89.warn("Unexpected peer.auth.request on outgoing connection");
 					break;
 				case "raft.vote.response":
 					this.onRaftVoteResponse?.(msg);
@@ -1593,7 +1600,7 @@ var init_peer_client = __esmMin((() => {
 					handler(msg).then((result) => {
 						sendReply(result);
 					}).catch((err) => {
-						logger$87.error("Error executing peer config reload", { error: toErrorMessage(err) });
+						logger$89.error("Error executing peer config reload", { error: toErrorMessage(err) });
 						sendReply({
 							success: false,
 							errors: [toErrorMessage(err)]
@@ -1643,7 +1650,7 @@ var init_peer_client = __esmMin((() => {
 			this.cancelReconnect();
 			const delay = this.getReconnectDelay();
 			this.reconnectAttempts++;
-			logger$87.info("Scheduling peer reconnect", {
+			logger$89.info("Scheduling peer reconnect", {
 				attempt: this.reconnectAttempts,
 				delayMs: Math.round(delay)
 			});
@@ -1950,7 +1957,7 @@ function createPeerHandler(deps) {
 				break;
 			case "job.reroute":
 				onJobReroute(msg).catch((err) => {
-					logger$86.error("Error handling job reroute from peer", { error: toErrorMessage(err) });
+					logger$88.error("Error handling job reroute from peer", { error: toErrorMessage(err) });
 				});
 				break;
 			case "job.reroute.ack": {
@@ -1987,7 +1994,7 @@ function createPeerHandler(deps) {
 				if (onPeerCacheUploadRequest) onPeerCacheUploadRequest(msg, conn.peerInstanceId).then((response) => {
 					sendEncryptedMessage(conn.ws, conn.sessionKey, response);
 				}).catch((err) => {
-					logger$86.error("Error handling cache upload request from peer", {
+					logger$88.error("Error handling cache upload request from peer", {
 						peerId: conn.peerInstanceId,
 						error: toErrorMessage(err)
 					});
@@ -2008,13 +2015,13 @@ function createPeerHandler(deps) {
 				});
 				break;
 			case "peer.cache.upload.response":
-				logger$86.warn("Unexpected peer.cache.upload.response on incoming connection");
+				logger$88.warn("Unexpected peer.cache.upload.response on incoming connection");
 				break;
 			case "peer.auth.request":
-				logger$86.warn("Unexpected peer.auth.request after authentication");
+				logger$88.warn("Unexpected peer.auth.request after authentication");
 				break;
 			case "peer.auth.response":
-				logger$86.warn("Unexpected peer.auth.response on incoming connection");
+				logger$88.warn("Unexpected peer.auth.response on incoming connection");
 				break;
 			case "raft.vote.response":
 				onRaftVoteResponse?.(msg);
@@ -2046,7 +2053,7 @@ function createPeerHandler(deps) {
 				handler(msg).then((result) => {
 					sendResponse(result);
 				}).catch((err) => {
-					logger$86.error("Error executing peer config reload", {
+					logger$88.error("Error executing peer config reload", {
 						peerId: conn.peerInstanceId,
 						error: toErrorMessage(err)
 					});
@@ -2088,7 +2095,7 @@ function createPeerHandler(deps) {
 	function handleConnection(ws, remoteIp) {
 		const ip = remoteIp ?? "unknown";
 		if (isRateLimited(ip)) {
-			logger$86.warn("Rate limited peer connection attempt", { ip });
+			logger$88.warn("Rate limited peer connection attempt", { ip });
 			ws.close(WS_CLOSE_UNAUTHORIZED, "Rate limited");
 			return;
 		}
@@ -2098,7 +2105,7 @@ function createPeerHandler(deps) {
 		let handshakeNonce = null;
 		const authTimer = setTimeout(() => {
 			if (!authenticated) {
-				logger$86.warn("Peer auth timeout, closing connection");
+				logger$88.warn("Peer auth timeout, closing connection");
 				ws.close(WS_CLOSE_AUTH_TIMEOUT, "Auth timeout");
 			}
 		}, authTimeoutMs);
@@ -2118,12 +2125,12 @@ function createPeerHandler(deps) {
 				try {
 					parsed = JSON.parse(raw);
 				} catch {
-					logger$86.warn("Malformed JSON during ECDH handshake");
+					logger$88.warn("Malformed JSON during ECDH handshake");
 					return;
 				}
 				const helloResp = peerHelloResponseSchema.safeParse(parsed);
 				if (!helloResp.success) {
-					logger$86.warn("Expected peer.hello.response, got invalid message");
+					logger$88.warn("Expected peer.hello.response, got invalid message");
 					ws.close(WS_CLOSE_INVALID_MESSAGE, "Expected hello response");
 					clearTimeout(authTimer);
 					return;
@@ -2131,7 +2138,7 @@ function createPeerHandler(deps) {
 				try {
 					sessionKey = deriveSessionKey(ecdh.privateKey, Buffer.from(helloResp.data.ephemeralPublicKey, "base64"), nonce);
 				} catch (err) {
-					logger$86.warn("ECDH key derivation failed", { error: toErrorMessage(err) });
+					logger$88.warn("ECDH key derivation failed", { error: toErrorMessage(err) });
 					ws.close(WS_CLOSE_INVALID_MESSAGE, "Key derivation failed");
 					clearTimeout(authTimer);
 					return;
@@ -2141,7 +2148,7 @@ function createPeerHandler(deps) {
 			}
 			if (!authenticated) {
 				if (!sessionKey) {
-					logger$86.warn("No session key for auth decryption");
+					logger$88.warn("No session key for auth decryption");
 					ws.close(WS_CLOSE_INVALID_MESSAGE, "No session key");
 					clearTimeout(authTimer);
 					return;
@@ -2150,7 +2157,7 @@ function createPeerHandler(deps) {
 				try {
 					decrypted = decryptMessage(raw, sessionKey);
 				} catch (err) {
-					logger$86.warn("Failed to decrypt auth request", { error: toErrorMessage(err) });
+					logger$88.warn("Failed to decrypt auth request", { error: toErrorMessage(err) });
 					recordFailedAuth(ip);
 					ws.close(WS_CLOSE_UNAUTHORIZED, "Decryption failed");
 					clearTimeout(authTimer);
@@ -2160,14 +2167,14 @@ function createPeerHandler(deps) {
 				try {
 					authParsed = JSON.parse(decrypted);
 				} catch {
-					logger$86.warn("Malformed JSON in decrypted auth request");
+					logger$88.warn("Malformed JSON in decrypted auth request");
 					ws.close(WS_CLOSE_INVALID_MESSAGE, "Invalid auth format");
 					clearTimeout(authTimer);
 					return;
 				}
 				const authMsg = peerAuthRequestSchema.safeParse(authParsed);
 				if (!authMsg.success) {
-					logger$86.warn("Invalid peer.auth.request format", { errors: authMsg.error.issues });
+					logger$88.warn("Invalid peer.auth.request format", { errors: authMsg.error.issues });
 					ws.close(WS_CLOSE_INVALID_MESSAGE, "Invalid auth request");
 					clearTimeout(authTimer);
 					return;
@@ -2177,7 +2184,7 @@ function createPeerHandler(deps) {
 					authenticated = true;
 					peerInstanceId = authMsg.data.instanceId;
 					clearTimeout(authTimer);
-					logger$86.info("Peer authenticated", { peerInstanceId });
+					logger$88.info("Peer authenticated", { peerInstanceId });
 					peerRegistry.addPeer({
 						instanceId: peerInstanceId,
 						connectionId: randomUUID(),
@@ -2199,7 +2206,7 @@ function createPeerHandler(deps) {
 					connections.set(peerInstanceId, conn);
 					startHeartbeat(conn);
 				}).catch((err) => {
-					logger$86.error("Unexpected error during auth handling", { error: toErrorMessage(err) });
+					logger$88.error("Unexpected error during auth handling", { error: toErrorMessage(err) });
 					ws.close(WS_CLOSE_UNAUTHORIZED, "Auth error");
 					clearTimeout(authTimer);
 				});
@@ -2210,19 +2217,19 @@ function createPeerHandler(deps) {
 			try {
 				decrypted = decryptMessage(raw, sessionKey);
 			} catch {
-				logger$86.warn("Failed to decrypt message from authenticated peer");
+				logger$88.warn("Failed to decrypt message from authenticated peer");
 				return;
 			}
 			let parsed;
 			try {
 				parsed = JSON.parse(decrypted);
 			} catch {
-				logger$86.warn("Malformed JSON from peer connection");
+				logger$88.warn("Malformed JSON from peer connection");
 				return;
 			}
 			const msgResult = peerFromPeerMessageSchema.safeParse(parsed);
 			if (!msgResult.success) {
-				logger$86.warn("Invalid message from peer", { errors: msgResult.error.issues });
+				logger$88.warn("Invalid message from peer", { errors: msgResult.error.issues });
 				return;
 			}
 			const conn = connections.get(peerInstanceId);
@@ -2231,14 +2238,14 @@ function createPeerHandler(deps) {
 		ws.on("close", () => {
 			clearTimeout(authTimer);
 			if (peerInstanceId) {
-				logger$86.info("Peer disconnected", { peerInstanceId });
+				logger$88.info("Peer disconnected", { peerInstanceId });
 				rejectLogsCollectForPeer(peerInstanceId);
 				const conn = connections.get(peerInstanceId);
 				if (conn) cleanupConnection(conn);
 			}
 		});
 		ws.on("error", (err) => {
-			logger$86.error("Peer connection error", { error: toErrorMessage(err) });
+			logger$88.error("Peer connection error", { error: toErrorMessage(err) });
 		});
 	}
 	/**
@@ -2247,7 +2254,7 @@ function createPeerHandler(deps) {
 	*/
 	async function handleAuth(ws, sessionKey, nonce, authMsg, ip) {
 		if (authMsg.protocolVersion < MIN_PROTOCOL_VERSION) {
-			logger$86.warn("Peer protocol version below minimum", {
+			logger$88.warn("Peer protocol version below minimum", {
 				peerInstanceId: authMsg.instanceId,
 				received: authMsg.protocolVersion,
 				minimum: MIN_PROTOCOL_VERSION
@@ -2263,7 +2270,7 @@ function createPeerHandler(deps) {
 			ws.close(WS_CLOSE_PROTOCOL_ERROR, "Unsupported protocol version");
 			return false;
 		}
-		if (authMsg.softwareVersion) logger$86.info("Peer software version", {
+		if (authMsg.softwareVersion) logger$88.info("Peer software version", {
 			peerInstanceId: authMsg.instanceId,
 			localVersion: SOFTWARE_VERSION,
 			remoteVersion: authMsg.softwareVersion
@@ -2271,7 +2278,7 @@ function createPeerHandler(deps) {
 		if (authMsg.token) try {
 			const result = await tokenManager.validateAndConsumeToken(authMsg.token, instanceId);
 			if (!acceptedRoles.includes(result.routing.role)) {
-				logger$86.warn("Peer role mismatch", {
+				logger$88.warn("Peer role mismatch", {
 					peerInstanceId: authMsg.instanceId,
 					accepted: acceptedRoles,
 					actual: result.routing.role
@@ -2315,7 +2322,7 @@ function createPeerHandler(deps) {
 				const existing = await credentialStore.findByInstanceId(authMsg.instanceId);
 				if (existing && !existing.revokedAt && existing.sourceTokenHash === presentedHash) {
 					if (!acceptedRoles.includes(parsed.routing.role)) {
-						logger$86.warn("Peer role mismatch on token retry", {
+						logger$88.warn("Peer role mismatch on token retry", {
 							peerInstanceId: authMsg.instanceId,
 							accepted: acceptedRoles,
 							actual: parsed.routing.role
@@ -2339,7 +2346,7 @@ function createPeerHandler(deps) {
 						routingKeys: [parsed.routing.routingKey],
 						sourceTokenHash: presentedHash
 					});
-					logger$86.info("Peer idempotent token retry accepted", {
+					logger$88.info("Peer idempotent token retry accepted", {
 						peerInstanceId: authMsg.instanceId,
 						sourceTokenHash: presentedHash
 					});
@@ -2358,12 +2365,12 @@ function createPeerHandler(deps) {
 					return true;
 				}
 			} catch (recoveryErr) {
-				logger$86.warn("Peer token idempotent recovery failed", {
+				logger$88.warn("Peer token idempotent recovery failed", {
 					peerInstanceId: authMsg.instanceId,
 					error: toErrorMessage(recoveryErr)
 				});
 			}
-			logger$86.warn("Peer token validation failed", {
+			logger$88.warn("Peer token validation failed", {
 				peerInstanceId: authMsg.instanceId,
 				error: toErrorMessage(err)
 			});
@@ -2380,7 +2387,7 @@ function createPeerHandler(deps) {
 		else if (authMsg.proof) {
 			const stored = await credentialStore.findByInstanceId(authMsg.instanceId);
 			if (!stored) {
-				logger$86.warn("Peer credential not found", { peerInstanceId: authMsg.instanceId });
+				logger$88.warn("Peer credential not found", { peerInstanceId: authMsg.instanceId });
 				sendEncryptedMessage(ws, sessionKey, {
 					type: "peer.auth.response",
 					accepted: false,
@@ -2392,7 +2399,7 @@ function createPeerHandler(deps) {
 				return false;
 			}
 			if (stored.revokedAt) {
-				logger$86.warn("Peer credential revoked", { peerInstanceId: authMsg.instanceId });
+				logger$88.warn("Peer credential revoked", { peerInstanceId: authMsg.instanceId });
 				sendEncryptedMessage(ws, sessionKey, {
 					type: "peer.auth.response",
 					accepted: false,
@@ -2407,7 +2414,7 @@ function createPeerHandler(deps) {
 			const expectedProof = createHmac("sha256", Buffer.from(stored.credentialHash, "hex")).update(nonceB64 + ":" + authMsg.instanceId).digest();
 			const proofBuffer = Buffer.from(authMsg.proof, "hex");
 			if (proofBuffer.length !== expectedProof.length || !timingSafeEqual(proofBuffer, expectedProof)) {
-				logger$86.warn("Peer HMAC proof invalid", { peerInstanceId: authMsg.instanceId });
+				logger$88.warn("Peer HMAC proof invalid", { peerInstanceId: authMsg.instanceId });
 				sendEncryptedMessage(ws, sessionKey, {
 					type: "peer.auth.response",
 					accepted: false,
@@ -2431,7 +2438,7 @@ function createPeerHandler(deps) {
 			});
 			return true;
 		} else {
-			logger$86.warn("Peer auth request missing token and proof", { peerInstanceId: authMsg.instanceId });
+			logger$88.warn("Peer auth request missing token and proof", { peerInstanceId: authMsg.instanceId });
 			sendEncryptedMessage(ws, sessionKey, {
 				type: "peer.auth.response",
 				accepted: false,
@@ -2579,12 +2586,12 @@ function createPeerHandler(deps) {
 		closeAllInbound
 	};
 }
-var logger$86, SOFTWARE_VERSION, RATE_LIMIT_MAX, RATE_LIMIT_WINDOW_MS;
+var logger$88, SOFTWARE_VERSION, RATE_LIMIT_MAX, RATE_LIMIT_WINDOW_MS;
 var init_peer_handler = __esmMin((() => {
 	init_peer_crypto();
 	init_join_token();
-	logger$86 = createLogger({ prefix: "peer-handler" });
-	SOFTWARE_VERSION = "0.1.17";
+	logger$88 = createLogger({ prefix: "peer-handler" });
+	SOFTWARE_VERSION = "0.1.18";
 	RATE_LIMIT_MAX = 5;
 	RATE_LIMIT_WINDOW_MS = 6e4;
 }));
@@ -2606,9 +2613,9 @@ var init_peer_handler = __esmMin((() => {
 * heartbeat (peer.heartbeat every 30s). Raft heartbeat is purely for leader
 * liveness detection.
 */
-var logger$85, RaftNode;
+var logger$87, RaftNode;
 var init_raft = __esmMin((() => {
-	logger$85 = createLogger({ prefix: "raft" });
+	logger$87 = createLogger({ prefix: "raft" });
 	RaftNode = class {
 		instanceId;
 		stateStore;
@@ -2659,7 +2666,7 @@ var init_raft = __esmMin((() => {
 			this.leaderId = state.leaderId;
 			this.role = "follower";
 			this.startedAt = Date.now();
-			logger$85.info("Raft node started", {
+			logger$87.info("Raft node started", {
 				instanceId: this.instanceId,
 				currentTerm: this.currentTerm,
 				leaderId: this.leaderId
@@ -2677,7 +2684,7 @@ var init_raft = __esmMin((() => {
 				votedFor: this.votedFor,
 				leaderId: this.leaderId
 			});
-			logger$85.info("Raft node stopped", { instanceId: this.instanceId });
+			logger$87.info("Raft node stopped", { instanceId: this.instanceId });
 		}
 		/** Whether this node is the current leader. */
 		isLeader() {
@@ -2703,11 +2710,11 @@ var init_raft = __esmMin((() => {
 		*/
 		handlePeerLeaving(instanceId) {
 			if (this.role === "leader") {
-				logger$85.debug("Ignoring peer.leaving (we are leader)", { leavingPeer: instanceId });
+				logger$87.debug("Ignoring peer.leaving (we are leader)", { leavingPeer: instanceId });
 				return;
 			}
 			if (instanceId === this.leaderId) {
-				logger$85.info("Current leader is leaving, starting immediate election", {
+				logger$87.info("Current leader is leaving, starting immediate election", {
 					leavingPeer: instanceId,
 					term: this.currentTerm
 				});
@@ -2715,7 +2722,7 @@ var init_raft = __esmMin((() => {
 				this.consecutiveUnansweredElections = 0;
 				this.clearElectionTimer();
 				this.startElection();
-			} else logger$85.debug("Non-leader peer leaving", { leavingPeer: instanceId });
+			} else logger$87.debug("Non-leader peer leaving", { leavingPeer: instanceId });
 		}
 		/**
 		* Reset the election timer with a randomized timeout.
@@ -2763,7 +2770,7 @@ var init_raft = __esmMin((() => {
 			this.votedFor = this.instanceId;
 			this.role = "candidate";
 			this.votesReceived = new Set([this.instanceId]);
-			logger$85.info("Starting election", {
+			logger$87.info("Starting election", {
 				instanceId: this.instanceId,
 				term: this.currentTerm
 			});
@@ -2772,12 +2779,12 @@ var init_raft = __esmMin((() => {
 				votedFor: this.votedFor,
 				leaderId: this.leaderId
 			}).catch((err) => {
-				logger$85.error("Failed to persist election state", { error: toErrorMessage(err) });
+				logger$87.error("Failed to persist election state", { error: toErrorMessage(err) });
 			});
 			const connectedPeerCount = this.peerRegistry.getConnectedCoordinatorPeerCount();
 			if (connectedPeerCount === 0) {
 				if (this.gracePeriodMs > 0 && Date.now() - this.startedAt < this.gracePeriodMs) {
-					logger$85.info("Dormant mode: deferring self-election (grace period active)", {
+					logger$87.info("Dormant mode: deferring self-election (grace period active)", {
 						instanceId: this.instanceId,
 						elapsedMs: Date.now() - this.startedAt,
 						gracePeriodMs: this.gracePeriodMs
@@ -2785,7 +2792,7 @@ var init_raft = __esmMin((() => {
 					this.resetElectionTimer();
 					return;
 				}
-				logger$85.info("No peers connected, self-electing as leader", {
+				logger$87.info("No peers connected, self-electing as leader", {
 					instanceId: this.instanceId,
 					term: this.currentTerm
 				});
@@ -2793,7 +2800,7 @@ var init_raft = __esmMin((() => {
 				return;
 			}
 			if (this.consecutiveUnansweredElections >= 2) {
-				logger$85.warn("No vote responses after consecutive elections, forcing self-election", {
+				logger$87.warn("No vote responses after consecutive elections, forcing self-election", {
 					instanceId: this.instanceId,
 					term: this.currentTerm,
 					consecutiveUnanswered: this.consecutiveUnansweredElections,
@@ -2828,14 +2835,14 @@ var init_raft = __esmMin((() => {
 					votedFor: this.votedFor,
 					leaderId: this.leaderId
 				}).catch((err) => {
-					logger$85.error("Failed to persist vote", { error: toErrorMessage(err) });
+					logger$87.error("Failed to persist vote", { error: toErrorMessage(err) });
 				});
 				this.resetElectionTimer();
-				logger$85.info("Vote granted", {
+				logger$87.info("Vote granted", {
 					candidateId: msg.candidateId,
 					term: msg.term
 				});
-			} else logger$85.info("Vote denied", {
+			} else logger$87.info("Vote denied", {
 				candidateId: msg.candidateId,
 				term: msg.term,
 				currentTerm: this.currentTerm,
@@ -2860,7 +2867,7 @@ var init_raft = __esmMin((() => {
 			this.consecutiveUnansweredElections = 0;
 			if (msg.voteGranted) {
 				this.votesReceived.add(msg.voterId);
-				logger$85.info("Vote received", {
+				logger$87.info("Vote received", {
 					from: msg.voterId,
 					term: msg.term,
 					totalVotes: this.votesReceived.size
@@ -2887,7 +2894,7 @@ var init_raft = __esmMin((() => {
 			this.leaderId = this.instanceId;
 			this.consecutiveUnansweredElections = 0;
 			this.clearElectionTimer();
-			logger$85.info("Became leader", {
+			logger$87.info("Became leader", {
 				instanceId: this.instanceId,
 				term: this.currentTerm
 			});
@@ -2897,7 +2904,7 @@ var init_raft = __esmMin((() => {
 				votedFor: this.votedFor,
 				leaderId: this.leaderId
 			}).catch((err) => {
-				logger$85.error("Failed to persist leader state", { error: toErrorMessage(err) });
+				logger$87.error("Failed to persist leader state", { error: toErrorMessage(err) });
 			});
 			this.onBecomeLeader();
 		}
@@ -2918,16 +2925,16 @@ var init_raft = __esmMin((() => {
 				votedFor: this.votedFor,
 				leaderId: this.leaderId
 			}).catch((err) => {
-				logger$85.error("Failed to persist step-down state", { error: toErrorMessage(err) });
+				logger$87.error("Failed to persist step-down state", { error: toErrorMessage(err) });
 			});
 			if (wasLeader) {
-				logger$85.info("Lost leadership", {
+				logger$87.info("Lost leadership", {
 					instanceId: this.instanceId,
 					newTerm,
 					newLeaderId
 				});
 				this.onLoseLeadership();
-			} else logger$85.info("Stepped down", {
+			} else logger$87.info("Stepped down", {
 				instanceId: this.instanceId,
 				newTerm,
 				newLeaderId
@@ -3035,9 +3042,9 @@ var init_raft_state = __esmMin((() => {
 }));
 //#endregion
 //#region src/cluster/orphan-recovery.ts
-var logger$84, DEFAULT_STALE_THRESHOLD_MS, DEFAULT_JOB_STUCK_THRESHOLD_MS, OrphanRecovery;
+var logger$86, DEFAULT_STALE_THRESHOLD_MS, DEFAULT_JOB_STUCK_THRESHOLD_MS, OrphanRecovery;
 var init_orphan_recovery = __esmMin((() => {
-	logger$84 = createLogger({ prefix: "orphan-recovery" });
+	logger$86 = createLogger({ prefix: "orphan-recovery" });
 	DEFAULT_STALE_THRESHOLD_MS = 300 * 1e3;
 	DEFAULT_JOB_STUCK_THRESHOLD_MS = 180 * 1e3;
 	OrphanRecovery = class {
@@ -3066,10 +3073,10 @@ var init_orphan_recovery = __esmMin((() => {
 			if (this.scanTimer) return;
 			this.scanTimer = setInterval(() => {
 				this.scanForOrphans().catch((err) => {
-					logger$84.error("Orphan recovery scan failed", { error: toErrorMessage(err) });
+					logger$86.error("Orphan recovery scan failed", { error: toErrorMessage(err) });
 				});
 			}, this.scanIntervalMs);
-			logger$84.info("Orphan recovery started", {
+			logger$86.info("Orphan recovery started", {
 				scanIntervalMs: this.scanIntervalMs,
 				staleThresholdMs: this.staleThresholdMs
 			});
@@ -3082,7 +3089,7 @@ var init_orphan_recovery = __esmMin((() => {
 				clearInterval(this.scanTimer);
 				this.scanTimer = null;
 			}
-			logger$84.info("Orphan recovery stopped");
+			logger$86.info("Orphan recovery stopped");
 		}
 		/**
 		* Scan for orphaned runs and recover them.
@@ -3100,7 +3107,7 @@ var init_orphan_recovery = __esmMin((() => {
 				"sha"
 			]).where("status", "=", ExecutionRunStatus.enum.running).where("started_at", "<", staleThreshold).execute();
 			if (staleRuns.length === 0) return;
-			logger$84.info("Found potentially orphaned runs", { count: staleRuns.length });
+			logger$86.info("Found potentially orphaned runs", { count: staleRuns.length });
 			for (const run of staleRuns) await this.recoverRun(run);
 		}
 		/**
@@ -3108,7 +3115,7 @@ var init_orphan_recovery = __esmMin((() => {
 		*/
 		async recoverRun(run) {
 			if (this.isCoordinatorStillConnected(run.routing_key)) return;
-			logger$84.info("Recovering orphan run", {
+			logger$86.info("Recovering orphan run", {
 				runId: run.run_id,
 				routingKey: run.routing_key,
 				workflowName: run.workflow_name
@@ -3125,7 +3132,7 @@ var init_orphan_recovery = __esmMin((() => {
 					completed_at: /* @__PURE__ */ new Date(),
 					failure_reason: "No jobs found for orphaned run"
 				}).where("run_id", "=", run.run_id).where("status", "=", ExecutionRunStatus.enum.running).execute();
-				logger$84.info("Finalized orphan run with no jobs", { runId: run.run_id });
+				logger$86.info("Finalized orphan run with no jobs", { runId: run.run_id });
 				this.executionTracker.emitInfraEvent(run.run_id, "orchestrator.run.orphan_recovered", { metadata: {
 					routingKey: run.routing_key,
 					reason: "No jobs found"
@@ -3152,7 +3159,7 @@ var init_orphan_recovery = __esmMin((() => {
 							reason: errorMsg
 						}
 					});
-					logger$84.info("Marked stuck job as failed", {
+					logger$86.info("Marked stuck job as failed", {
 						runId: run.run_id,
 						jobId: job.job_id,
 						jobName: job.job_name
@@ -3206,9 +3213,9 @@ function agentSatisfiesMandatoryLabels(agent, requiredLabels) {
 	const required = new Set(requiredLabels);
 	return mandatory.every((m) => required.has(m));
 }
-var logger$83, DEFAULT_ACK_TIMEOUT_MS, DEFAULT_MAX_HOPS, NAK_BACKOFF_BASE_MS, NAK_BACKOFF_MAX_MS, RunCoordinator;
+var logger$85, DEFAULT_ACK_TIMEOUT_MS, DEFAULT_MAX_HOPS, NAK_BACKOFF_BASE_MS, NAK_BACKOFF_MAX_MS, RunCoordinator;
 var init_coordinator = __esmMin((() => {
-	logger$83 = createLogger({ prefix: "coordinator" });
+	logger$85 = createLogger({ prefix: "coordinator" });
 	DEFAULT_ACK_TIMEOUT_MS = 15e3;
 	DEFAULT_MAX_HOPS = 3;
 	NAK_BACKOFF_BASE_MS = 1e3;
@@ -3266,6 +3273,8 @@ var init_coordinator = __esmMin((() => {
 					workflowName: runContext.workflowName,
 					jobName: job.jobName,
 					runsOnLabels: flatLabels,
+					runsOnPatterns: job.runsOnPatterns,
+					excludePatterns: job.excludePatterns,
 					excludeLabels: job.excludeLabels,
 					jobConfig: job.jobConfig,
 					repoUrl: job.repoUrl,
@@ -3317,7 +3326,7 @@ var init_coordinator = __esmMin((() => {
 				}));
 				await Promise.all(reroutePromises);
 			}
-			logger$83.info("Jobs routed", {
+			logger$85.info("Jobs routed", {
 				runId: runContext.runId,
 				local: result.localJobs.length,
 				rerouted: result.reroutedJobs.length,
@@ -3346,6 +3355,8 @@ var init_coordinator = __esmMin((() => {
 				jobName: msg.jobName,
 				runsOnLabels: flatLabels,
 				excludeLabels: msg.excludeLabels,
+				runsOnPatterns: msg.runsOnPatterns,
+				excludePatterns: msg.excludePatterns,
 				jobConfig: msg.jobConfig ?? msg.payload,
 				repoUrl: msg.repoUrl ?? "",
 				ref: msg.ref ?? "",
@@ -3378,7 +3389,7 @@ var init_coordinator = __esmMin((() => {
 						runId: msg.runId
 					});
 				} catch (err) {
-					logger$83.warn("Failed to create check runs for rerouted job", {
+					logger$85.warn("Failed to create check runs for rerouted job", {
 						runId: msg.runId,
 						error: toErrorMessage(err)
 					});
@@ -3395,7 +3406,7 @@ var init_coordinator = __esmMin((() => {
 					jobName: msg.jobName
 				}], msg.routingKey);
 			} catch (err) {
-				logger$83.warn("Failed to register rerouted execution for tracking", {
+				logger$85.warn("Failed to register rerouted execution for tracking", {
 					runId: msg.runId,
 					error: toErrorMessage(err)
 				});
@@ -3414,7 +3425,7 @@ var init_coordinator = __esmMin((() => {
 		*/
 		onPeerJobProgress(msg) {
 			if (this.executionTracker) (msg.kind === "job" ? this.executionTracker.onJobStatus(msg.runId, msg.jobId, msg.state, msg.timestamp, void 0, msg.data) : this.executionTracker.onStepStatus(msg.runId, msg.jobId, msg.stepIndex, msg.stepName, msg.state, msg.timestamp, msg.data)).catch((err) => {
-				logger$83.error("Failed to track peer job progress", {
+				logger$85.error("Failed to track peer job progress", {
 					error: toErrorMessage(err),
 					runId: msg.runId,
 					jobId: msg.jobId,
@@ -3428,7 +3439,7 @@ var init_coordinator = __esmMin((() => {
 					if (runJobs.size === 0) this.reroutedJobs.delete(msg.runId);
 				}
 			}
-			logger$83.debug("Peer job progress", {
+			logger$85.debug("Peer job progress", {
 				runId: msg.runId,
 				jobId: msg.jobId,
 				kind: msg.kind,
@@ -3461,7 +3472,7 @@ var init_coordinator = __esmMin((() => {
 		*/
 		onPeerJobComplete(runId, jobId, status, timestamp, data) {
 			if (this.executionTracker) this.executionTracker.onJobStatus(runId, jobId, status, timestamp, void 0, data).catch((err) => {
-				logger$83.error("Failed to track peer job completion", {
+				logger$85.error("Failed to track peer job completion", {
 					error: toErrorMessage(err),
 					runId,
 					jobId
@@ -3500,14 +3511,14 @@ var init_coordinator = __esmMin((() => {
 						jobId,
 						reason
 					};
-					if (!(client ? client.send(cancelMsg) : this.sendToPeerViaHandler?.(peerId, cancelMsg) ?? false)) logger$83.warn("Failed to send cancel to peer", {
+					if (!(client ? client.send(cancelMsg) : this.sendToPeerViaHandler?.(peerId, cancelMsg) ?? false)) logger$85.warn("Failed to send cancel to peer", {
 						peerId,
 						runId,
 						jobId
 					});
 				}
 			}
-			logger$83.info("Cancel propagated to peers", {
+			logger$85.info("Cancel propagated to peers", {
 				runId,
 				reason,
 				peerCount: peerJobs.size
@@ -3527,7 +3538,7 @@ var init_coordinator = __esmMin((() => {
 			if (this.staleEvictionTimer) clearInterval(this.staleEvictionTimer);
 			this.staleEvictionTimer = setInterval(() => {
 				const evicted = this.peerRegistry.evictStalePeers(staleTimeoutMs);
-				if (evicted.length > 0) logger$83.warn("Evicted stale peers", {
+				if (evicted.length > 0) logger$85.warn("Evicted stale peers", {
 					evicted,
 					count: evicted.length
 				});
@@ -3564,7 +3575,7 @@ var init_coordinator = __esmMin((() => {
 			if (peers.length === 0) {
 				const peersWithLabels = this.peerRegistry.findPeersWithLabels(labelSets);
 				const allPeers = this.peerRegistry.getConnectedPeers();
-				logger$83.debug("Reroute failed — peer registry state", {
+				logger$85.debug("Reroute failed — peer registry state", {
 					jobName: job.jobName,
 					requiredLabels: labelSets,
 					connectedPeers: allPeers.map((p) => ({
@@ -3594,7 +3605,7 @@ var init_coordinator = __esmMin((() => {
 			for (const peer of sortedPeers) {
 				const nakEntry = this.nakTracker.get(peer.instanceId);
 				if (nakEntry && nakEntry.backoffUntil > now) {
-					logger$83.debug("Skipping peer in NAK backoff", {
+					logger$85.debug("Skipping peer in NAK backoff", {
 						peerId: peer.instanceId,
 						jobName: job.jobName,
 						backoffRemainingMs: nakEntry.backoffUntil - now
@@ -3604,7 +3615,7 @@ var init_coordinator = __esmMin((() => {
 				const client = this.getPeerClient(peer.instanceId);
 				const canSendViaHandler = !client && this.sendAndWaitAckViaHandler;
 				if (!client && !canSendViaHandler) {
-					logger$83.warn("No PeerClient for peer (found in registry but no connection)", {
+					logger$85.warn("No PeerClient for peer (found in registry but no connection)", {
 						peerId: peer.instanceId,
 						jobName: job.jobName
 					});
@@ -3625,6 +3636,8 @@ var init_coordinator = __esmMin((() => {
 					workflowName: runContext.workflowName,
 					runsOnLabels: labelSets,
 					excludeLabels: job.excludeLabels,
+					runsOnPatterns: job.runsOnPatterns,
+					excludePatterns: job.excludePatterns,
 					triedConnections: [this.instanceId],
 					maxHops: DEFAULT_MAX_HOPS,
 					coordinatorId: this.instanceId,
@@ -3645,7 +3658,7 @@ var init_coordinator = __esmMin((() => {
 				if (client ? await client.sendAndWaitAck(rerouteMsg, this.ackTimeoutMs) : await this.sendAndWaitAckViaHandler(peer.instanceId, rerouteMsg, this.ackTimeoutMs)) {
 					this.nakTracker.delete(peer.instanceId);
 					this.trackReroutedJob(runContext.runId, allocatedJobId, peer.instanceId, job.jobName);
-					logger$83.info("Job rerouted to peer", {
+					logger$85.info("Job rerouted to peer", {
 						runId: runContext.runId,
 						jobName: job.jobName,
 						jobId: allocatedJobId,
@@ -3663,7 +3676,7 @@ var init_coordinator = __esmMin((() => {
 					count: nakCount,
 					backoffUntil: Date.now() + backoffMs
 				});
-				logger$83.warn("Peer NAKed job", {
+				logger$85.warn("Peer NAKed job", {
 					peerId: peer.instanceId,
 					jobName: job.jobName,
 					nakCount,
@@ -3893,6 +3906,39 @@ function resolveDataDir(explicit) {
 var init_data_dir = __esmMin((() => {}));
 //#endregion
 //#region src/metrics/prometheus.ts
+function meter$1() {
+	if (!_meter$1) _meter$1 = createMeter("kici-orchestrator");
+	return _meter$1;
+}
+/**
+* A counter whose real OTel instrument is created on first `.add()` — after
+* `initTelemetry()` has registered the global MeterProvider. The returned
+* value satisfies the OTel `Counter` interface, so call sites are unchanged.
+*/
+function lazyCounter$1(name, options) {
+	let inst;
+	const get = () => inst ??= meter$1().createCounter(name, options);
+	return { add: (...args) => get().add(...args) };
+}
+/**
+* A histogram whose real OTel instrument is created on first `.record()` —
+* after `initTelemetry()`. Satisfies the OTel `Histogram` interface.
+*/
+function lazyHistogram$1(name, options) {
+	let inst;
+	const get = () => inst ??= meter$1().createHistogram(name, options);
+	return { record: (...args) => get().record(...args) };
+}
+/**
+* Queue an observable gauge for registration. The gauge is created and its
+* callback attached lazily inside registerOrchestratorMetrics(), so the
+* instrument binds to the real MeterProvider rather than the no-op one.
+*/
+function defineObservableGauge(name, options, observe) {
+	_observableGauges.push(() => {
+		meter$1().createObservableGauge(name, options).addCallback(observe);
+	});
+}
 /** Set the current number of active agents. */
 function setAgentsActive(value) {
 	_agentsActiveValue = value;
@@ -3901,6 +3947,10 @@ function setAgentsActive(value) {
 function setConfigVersion(value) {
 	_configVersionValue = value;
 }
+/** Set the current number of declared (static) roster hosts that are unreachable. */
+function setDeclaredHostsUnreachable(value) {
+	_declaredHostsUnreachableValue = value;
+}
 /** Set the current number of stale runs detected. */
 function setStaleRunsCurrent(value) {
 	_staleRunsCurrentValue = value;
@@ -3958,21 +4008,32 @@ function setDispatchQueueDepthBreakdown(snapshot) {
 function setEventDlqDepth(value) {
 	_eventDlqDepthValue = value;
 }
-var meter$1, _agentsActiveValue, _configVersionValue, _staleRunsCurrentValue, _scalerUsageRows, _scalerSpawnRefusalsValue, _queueDepthBreakdown, _everSeenQueueLabels, webhooksReceivedTotal, webhooksProcessedTotal, triggerMatchDurationSeconds, dedupHitsTotal, pgPoolClientErrorsTotal, sourceCacheHitsTotal, sourceCacheMissesTotal, depCacheHitsTotal, depCacheMissesTotal, buildDurationSeconds, executionsTotal, executionDurationSeconds, stepsTotal, githubCheckRunTotal, logChunksReceivedTotal, logBytesStoredTotal, scalerConfigReloadsTotal, ScalerSpawnFailureBound, scalerSpawnFailuresTotal, configReloadTotal, staleRunsDetectedTotal, staleDetectionDurationSeconds, crossSourceFanoutSize, crossSourceErrorsTotal, universalGitRegistrationErrorsTotal, trustMatchRefusedNoIdTotal, eventDispatchSuccessTotal, eventRetryTotal, eventDlqTotal, eventLeaseExpirationsTotal, eventAttemptsHistogram, _eventDlqDepthValue, InstallSecretsDecisionReason, InstallSecretsChannel, installSecretsDecisionsTotal, installSecretsRegistryUsedTotal, installSecretsContributorStrippedTotal, installSecretsTokenResolutionDurationSeconds;
+/**
+* Register every queued orchestrator observable gauge on the real meter.
+*
+* Must run AFTER `initTelemetry()` has wired the global MeterProvider —
+* `createApp()` calls it once during bootstrap. Registering the gauges at
+* module-eval time instead would bind them to the no-op provider (the
+* bundler hoists some module init above the entry's `initTelemetry()` call),
+* leaving every `kici_orch_*` gauge absent from the /metrics scrape and the
+* Platform push. Idempotent: repeat calls are no-ops.
+*/
+function registerOrchestratorMetrics() {
+	if (_observableGaugesRegistered) return;
+	_observableGaugesRegistered = true;
+	for (const register of _observableGauges) register();
+}
+var _meter$1, _observableGauges, _agentsActiveValue, _configVersionValue, _declaredHostsUnreachableValue, _staleRunsCurrentValue, _scalerUsageRows, _scalerSpawnRefusalsValue, _queueDepthBreakdown, _everSeenQueueLabels, webhooksReceivedTotal, webhooksProcessedTotal, triggerMatchDurationSeconds, dedupHitsTotal, pgPoolClientErrorsTotal, sourceCacheHitsTotal, sourceCacheMissesTotal, depCacheHitsTotal, depCacheMissesTotal, buildDurationSeconds, executionsTotal, executionDurationSeconds, stepsTotal, githubCheckRunTotal, logChunksReceivedTotal, logBytesStoredTotal, scalerConfigReloadsTotal, ScalerSpawnFailureBound, scalerSpawnFailuresTotal, configReloadTotal, staleRunsDetectedTotal, staleDetectionDurationSeconds, crossSourceFanoutSize, crossSourceErrorsTotal, universalGitRegistrationErrorsTotal, trustMatchRefusedNoIdTotal, eventDispatchSuccessTotal, eventRetryTotal, eventDlqTotal, eventLeaseExpirationsTotal, eventAttemptsHistogram, _eventDlqDepthValue, InstallSecretsDecisionReason, InstallSecretsChannel, installSecretsDecisionsTotal, installSecretsRegistryUsedTotal, installSecretsContributorStrippedTotal, installSecretsTokenResolutionDurationSeconds, _observableGaugesRegistered;
 var init_prometheus = __esmMin((() => {
-	meter$1 = createMeter("kici-orchestrator");
+	_observableGauges = [];
 	_agentsActiveValue = 0;
-	meter$1.createObservableGauge("kici_orch_agents_active", { description: "Current number of active agents connected" }).addCallback((result) => {
-		result.observe(_agentsActiveValue);
-	});
+	defineObservableGauge("kici_orch_agents_active", { description: "Current number of active agents connected" }, (result) => result.observe(_agentsActiveValue));
 	_configVersionValue = 0;
-	meter$1.createObservableGauge("kici_orch_config_version", { description: "Current shared config version number" }).addCallback((result) => {
-		result.observe(_configVersionValue);
-	});
+	defineObservableGauge("kici_orch_config_version", { description: "Current shared config version number" }, (result) => result.observe(_configVersionValue));
+	_declaredHostsUnreachableValue = 0;
+	defineObservableGauge("kici_orch_declared_hosts_unreachable", { description: "Number of declared (static) roster hosts currently unreachable" }, (result) => result.observe(_declaredHostsUnreachableValue));
 	_staleRunsCurrentValue = 0;
-	meter$1.createObservableGauge("kici_orch_stale_runs_current", { description: "Current number of stale runs detected in last scan" }).addCallback((result) => {
-		result.observe(_staleRunsCurrentValue);
-	});
+	defineObservableGauge("kici_orch_stale_runs_current", { description: "Current number of stale runs detected in last scan" }, (result) => result.observe(_staleRunsCurrentValue));
 	_scalerUsageRows = [];
 	/**
 	* Current CPU reservations per scaler / machine pool.
@@ -3980,7 +4041,7 @@ var init_prometheus = __esmMin((() => {
 	* - scaler: __global__ | container | firecracker | bare-metal | stateful
 	* - machinePool: optional pool name (operator-defined; capped at the Platform filter)
 	*/
-	meter$1.createObservableGauge("kici_orch_scaler_cpus_used", { description: "Current CPU reservations summed by scaler / pool. scaler=\"__global__\" is the orchestrator-wide total; machinePool=\"<name>\" rows reflect the on-disk ledger." }).addCallback((result) => {
+	defineObservableGauge("kici_orch_scaler_cpus_used", { description: "Current CPU reservations summed by scaler / pool. scaler=\"__global__\" is the orchestrator-wide total; machinePool=\"<name>\" rows reflect the on-disk ledger." }, (result) => {
 		for (const row of _scalerUsageRows) {
 			const attrs = { scaler: row.scaler };
 			if (row.machinePool) attrs.machinePool = row.machinePool;
@@ -3993,7 +4054,7 @@ var init_prometheus = __esmMin((() => {
 	* - scaler: __global__ | container | firecracker | bare-metal | stateful
 	* - machinePool: optional pool name (operator-defined; capped at the Platform filter)
 	*/
-	meter$1.createObservableGauge("kici_orch_scaler_memory_bytes_used", { description: "Current memory reservations (bytes) summed by scaler / pool. scaler=\"__global__\" is the orchestrator-wide total; machinePool=\"<name>\" rows reflect the on-disk ledger." }).addCallback((result) => {
+	defineObservableGauge("kici_orch_scaler_memory_bytes_used", { description: "Current memory reservations (bytes) summed by scaler / pool. scaler=\"__global__\" is the orchestrator-wide total; machinePool=\"<name>\" rows reflect the on-disk ledger." }, (result) => {
 		for (const row of _scalerUsageRows) {
 			const attrs = { scaler: row.scaler };
 			if (row.machinePool) attrs.machinePool = row.machinePool;
@@ -4001,9 +4062,7 @@ var init_prometheus = __esmMin((() => {
 		}
 	});
 	_scalerSpawnRefusalsValue = 0;
-	meter$1.createObservableGauge("kici_orch_scaler_spawn_refusals_total", { description: "Cumulative count of scaler spawn requests refused due to resource caps (maxAgents, resourceCap, globalResourceCap, machinePool)." }).addCallback((result) => {
-		result.observe(_scalerSpawnRefusalsValue);
-	});
+	defineObservableGauge("kici_orch_scaler_spawn_refusals_total", { description: "Cumulative count of scaler spawn requests refused due to resource caps (maxAgents, resourceCap, globalResourceCap, machinePool)." }, (result) => result.observe(_scalerSpawnRefusalsValue));
 	_queueDepthBreakdown = {
 		byStatus: {
 			pending: 0,
@@ -4017,7 +4076,7 @@ var init_prometheus = __esmMin((() => {
 	* Labels:
 	* - status: pending | dispatched
 	*/
-	meter$1.createObservableGauge("kici_orch_dispatch_queue_depth", { description: "Current dispatch_queue depth per status (pending, dispatched)" }).addCallback((result) => {
+	defineObservableGauge("kici_orch_dispatch_queue_depth", { description: "Current dispatch_queue depth per status (pending, dispatched)" }, (result) => {
 		result.observe(_queueDepthBreakdown.byStatus.pending, { status: "pending" });
 		result.observe(_queueDepthBreakdown.byStatus.dispatched, { status: "dispatched" });
 	});
@@ -4027,15 +4086,15 @@ var init_prometheus = __esmMin((() => {
 	* - status: pending (only emitted status)
 	* - label: a runs_on label string from the workflow's runtime config
 	*/
-	meter$1.createObservableGauge("kici_orch_dispatch_queue_depth_by_label", { description: "Current pending dispatch_queue depth per runs_on label (multi-label jobs fan out)" }).addCallback((result) => {
+	defineObservableGauge("kici_orch_dispatch_queue_depth_by_label", { description: "Current pending dispatch_queue depth per runs_on label (multi-label jobs fan out)" }, (result) => {
 		for (const [label, count] of Object.entries(_queueDepthBreakdown.byLabel)) result.observe(count, {
 			status: "pending",
 			label
 		});
 	});
-	webhooksReceivedTotal = meter$1.createCounter("kici_orch_webhooks_received_total", { description: "Total number of webhooks received" });
-	webhooksProcessedTotal = meter$1.createCounter("kici_orch_webhooks_processed_total", { description: "Total number of webhooks processed" });
-	triggerMatchDurationSeconds = meter$1.createHistogram("kici_orch_trigger_match_duration_seconds", {
+	webhooksReceivedTotal = lazyCounter$1("kici_orch_webhooks_received_total", { description: "Total number of webhooks received" });
+	webhooksProcessedTotal = lazyCounter$1("kici_orch_webhooks_processed_total", { description: "Total number of webhooks processed" });
+	triggerMatchDurationSeconds = lazyHistogram$1("kici_orch_trigger_match_duration_seconds", {
 		description: "Duration of trigger matching operations in seconds",
 		advice: { explicitBucketBoundaries: [
 			.001,
@@ -4048,13 +4107,13 @@ var init_prometheus = __esmMin((() => {
 			5
 		] }
 	});
-	dedupHitsTotal = meter$1.createCounter("kici_orch_dedup_hits_total", { description: "Total number of deduplication cache hits" });
-	pgPoolClientErrorsTotal = meter$1.createCounter("kici_orch_pg_pool_client_errors_total", { description: "Total pg connection errors absorbed without a process restart" });
-	sourceCacheHitsTotal = meter$1.createCounter("kici_orch_source_cache_hits_total", { description: "Total number of source tarball cache hits" });
-	sourceCacheMissesTotal = meter$1.createCounter("kici_orch_source_cache_misses_total", { description: "Total number of source tarball cache misses" });
-	depCacheHitsTotal = meter$1.createCounter("kici_orch_dep_cache_hits_total", { description: "Total number of dep cache hits" });
-	depCacheMissesTotal = meter$1.createCounter("kici_orch_dep_cache_misses_total", { description: "Total number of dep cache misses" });
-	buildDurationSeconds = meter$1.createHistogram("kici_orch_build_duration_seconds", {
+	dedupHitsTotal = lazyCounter$1("kici_orch_dedup_hits_total", { description: "Total number of deduplication cache hits" });
+	pgPoolClientErrorsTotal = lazyCounter$1("kici_orch_pg_pool_client_errors_total", { description: "Total pg connection errors absorbed without a process restart" });
+	sourceCacheHitsTotal = lazyCounter$1("kici_orch_source_cache_hits_total", { description: "Total number of source tarball cache hits" });
+	sourceCacheMissesTotal = lazyCounter$1("kici_orch_source_cache_misses_total", { description: "Total number of source tarball cache misses" });
+	depCacheHitsTotal = lazyCounter$1("kici_orch_dep_cache_hits_total", { description: "Total number of dep cache hits" });
+	depCacheMissesTotal = lazyCounter$1("kici_orch_dep_cache_misses_total", { description: "Total number of dep cache misses" });
+	buildDurationSeconds = lazyHistogram$1("kici_orch_build_duration_seconds", {
 		description: "Duration of build agent operations in seconds",
 		advice: { explicitBucketBoundaries: [
 			1,
@@ -4067,8 +4126,8 @@ var init_prometheus = __esmMin((() => {
 			600
 		] }
 	});
-	executionsTotal = meter$1.createCounter("kici_orch_executions_total", { description: "Total number of execution runs" });
-	executionDurationSeconds = meter$1.createHistogram("kici_orch_execution_duration_seconds", {
+	executionsTotal = lazyCounter$1("kici_orch_executions_total", { description: "Total number of execution runs" });
+	executionDurationSeconds = lazyHistogram$1("kici_orch_execution_duration_seconds", {
 		description: "Duration of execution runs in seconds",
 		advice: { explicitBucketBoundaries: [
 			1,
@@ -4082,19 +4141,19 @@ var init_prometheus = __esmMin((() => {
 			1800
 		] }
 	});
-	stepsTotal = meter$1.createCounter("kici_orch_steps_total", { description: "Total number of steps executed" });
-	githubCheckRunTotal = meter$1.createCounter("kici_orch_github_check_run_total", { description: "Total number of GitHub check run API calls" });
-	logChunksReceivedTotal = meter$1.createCounter("kici_orch_log_chunks_received_total", { description: "Total number of log chunks received from agents" });
-	logBytesStoredTotal = meter$1.createCounter("kici_orch_log_bytes_stored_total", { description: "Total bytes of log data written to storage" });
-	scalerConfigReloadsTotal = meter$1.createCounter("kici_orch_scaler_config_reloads_total", { description: "Total number of scaler config reload operations" });
+	stepsTotal = lazyCounter$1("kici_orch_steps_total", { description: "Total number of steps executed" });
+	githubCheckRunTotal = lazyCounter$1("kici_orch_github_check_run_total", { description: "Total number of GitHub check run API calls" });
+	logChunksReceivedTotal = lazyCounter$1("kici_orch_log_chunks_received_total", { description: "Total number of log chunks received from agents" });
+	logBytesStoredTotal = lazyCounter$1("kici_orch_log_bytes_stored_total", { description: "Total bytes of log data written to storage" });
+	scalerConfigReloadsTotal = lazyCounter$1("kici_orch_scaler_config_reloads_total", { description: "Total number of scaler config reload operations" });
 	ScalerSpawnFailureBound = {
 		Bound: "true",
 		Unbound: "false"
 	};
-	scalerSpawnFailuresTotal = meter$1.createCounter("kici_orch_scaler_spawn_failures_total", { description: "Total scaler agent spawn failures (job-bound and warm-pool)" });
-	configReloadTotal = meter$1.createCounter("kici_orch_config_reload_total", { description: "Total number of config reload operations" });
-	staleRunsDetectedTotal = meter$1.createCounter("kici_orch_stale_runs_detected_total", { description: "Total number of stale runs detected and marked as failed" });
-	staleDetectionDurationSeconds = meter$1.createHistogram("kici_orch_stale_detection_duration_seconds", {
+	scalerSpawnFailuresTotal = lazyCounter$1("kici_orch_scaler_spawn_failures_total", { description: "Total scaler agent spawn failures (job-bound and warm-pool)" });
+	configReloadTotal = lazyCounter$1("kici_orch_config_reload_total", { description: "Total number of config reload operations" });
+	staleRunsDetectedTotal = lazyCounter$1("kici_orch_stale_runs_detected_total", { description: "Total number of stale runs detected and marked as failed" });
+	staleDetectionDurationSeconds = lazyHistogram$1("kici_orch_stale_detection_duration_seconds", {
 		description: "Time between job becoming stale and detection (seconds)",
 		advice: { explicitBucketBoundaries: [
 			10,
@@ -4105,7 +4164,7 @@ var init_prometheus = __esmMin((() => {
 			600
 		] }
 	});
-	crossSourceFanoutSize = meter$1.createHistogram("kici_cross_source_fanout_size", {
+	crossSourceFanoutSize = lazyHistogram$1("kici_cross_source_fanout_size", {
 		description: "Number of webhook-trigger registrations matched when an inbound generic webhook fans out across sources in the same org",
 		advice: { explicitBucketBoundaries: [
 			0,
@@ -4118,18 +4177,16 @@ var init_prometheus = __esmMin((() => {
 			100
 		] }
 	});
-	crossSourceErrorsTotal = meter$1.createCounter("kici_cross_source_errors_total", { description: "Errors encountered during cross-source webhook dispatch" });
-	universalGitRegistrationErrorsTotal = meter$1.createCounter("kici_universal_git_registration_errors_total", { description: "Errors encountered while registering universal-git provider bundles" });
-	trustMatchRefusedNoIdTotal = meter$1.createCounter("kici_orch_trust_match_refused_no_id_total", { description: "Trust-resolution attempts refused because the provider numeric id was missing or did not match" });
-	eventDispatchSuccessTotal = meter$1.createCounter("kici_orch_event_dispatch_success_total", { description: "Internal events delivered to all matching workflows successfully (after the lease commits processed=true)" });
-	eventRetryTotal = meter$1.createCounter("kici_orch_event_retry_total", { description: "Internal-event dispatch failures that triggered a retry (lease released, next_retry_at scheduled)" });
-	eventDlqTotal = meter$1.createCounter("kici_orch_event_dlq_total", { description: "Internal events moved to the DLQ after exhausting retries" });
-	eventLeaseExpirationsTotal = meter$1.createCounter("kici_orch_event_lease_expirations_total", { description: "Dispatch leases that timed out before the holding node finalised them (signals node crash mid-dispatch)" });
-	eventAttemptsHistogram = meter$1.createHistogram("kici_orch_event_attempts", { description: "Distribution of dispatch attempts at terminal outcome (success or DLQ)" });
+	crossSourceErrorsTotal = lazyCounter$1("kici_cross_source_errors_total", { description: "Errors encountered during cross-source webhook dispatch" });
+	universalGitRegistrationErrorsTotal = lazyCounter$1("kici_universal_git_registration_errors_total", { description: "Errors encountered while registering universal-git provider bundles" });
+	trustMatchRefusedNoIdTotal = lazyCounter$1("kici_orch_trust_match_refused_no_id_total", { description: "Trust-resolution attempts refused because the provider numeric id was missing or did not match" });
+	eventDispatchSuccessTotal = lazyCounter$1("kici_orch_event_dispatch_success_total", { description: "Internal events delivered to all matching workflows successfully (after the lease commits processed=true)" });
+	eventRetryTotal = lazyCounter$1("kici_orch_event_retry_total", { description: "Internal-event dispatch failures that triggered a retry (lease released, next_retry_at scheduled)" });
+	eventDlqTotal = lazyCounter$1("kici_orch_event_dlq_total", { description: "Internal events moved to the DLQ after exhausting retries" });
+	eventLeaseExpirationsTotal = lazyCounter$1("kici_orch_event_lease_expirations_total", { description: "Dispatch leases that timed out before the holding node finalised them (signals node crash mid-dispatch)" });
+	eventAttemptsHistogram = lazyHistogram$1("kici_orch_event_attempts", { description: "Distribution of dispatch attempts at terminal outcome (success or DLQ)" });
 	_eventDlqDepthValue = 0;
-	meter$1.createObservableGauge("kici_orch_event_dlq_depth", { description: "Current count of events sitting in the DLQ awaiting operator triage" }).addCallback((result) => {
-		result.observe(_eventDlqDepthValue);
-	});
+	defineObservableGauge("kici_orch_event_dlq_depth", { description: "Current count of events sitting in the DLQ awaiting operator triage" }, (result) => result.observe(_eventDlqDepthValue));
 	InstallSecretsDecisionReason = {
 		Ok: "ok",
 		MalformedRef: "malformed_ref",
@@ -4147,10 +4204,10 @@ var init_prometheus = __esmMin((() => {
 		Registries: "registries",
 		InstallEnv: "install_env"
 	};
-	installSecretsDecisionsTotal = meter$1.createCounter("kici_orch_install_secrets_decisions_total", { description: "Total install-secrets resolution decisions (pass / reject / hold + reason)" });
-	installSecretsRegistryUsedTotal = meter$1.createCounter("kici_orch_install_secrets_npm_registry_used_total", { description: "Total registry / installEnv entries successfully resolved per channel / provider / scope" });
-	installSecretsContributorStrippedTotal = meter$1.createCounter("kici_orch_install_secrets_contributor_stripped_total", { description: "Dispatches where registry tokens were stripped because the contributor tier was not `trusted`" });
-	installSecretsTokenResolutionDurationSeconds = meter$1.createHistogram("kici_orch_install_secrets_token_resolution_duration_seconds", {
+	installSecretsDecisionsTotal = lazyCounter$1("kici_orch_install_secrets_decisions_total", { description: "Total install-secrets resolution decisions (pass / reject / hold + reason)" });
+	installSecretsRegistryUsedTotal = lazyCounter$1("kici_orch_install_secrets_npm_registry_used_total", { description: "Total registry / installEnv entries successfully resolved per channel / provider / scope" });
+	installSecretsContributorStrippedTotal = lazyCounter$1("kici_orch_install_secrets_contributor_stripped_total", { description: "Dispatches where registry tokens were stripped because the contributor tier was not `trusted`" });
+	installSecretsTokenResolutionDurationSeconds = lazyHistogram$1("kici_orch_install_secrets_token_resolution_duration_seconds", {
 		description: "Duration of per-environment secret resolution during install-secrets evaluation",
 		advice: { explicitBucketBoundaries: [
 			.001,
@@ -4163,6 +4220,7 @@ var init_prometheus = __esmMin((() => {
 			5
 		] }
 	});
+	_observableGaugesRegistered = false;
 }));
 //#endregion
 //#region src/config/reload.ts
@@ -4428,6 +4486,8 @@ var init_schema = __esmMin((() => {
 		}).optional(),
 		agentAuth: z.enum(["token", "none"]).optional(),
 		agentTokenTtlMs: z.coerce.number().optional(),
+		rosterGraceMs: z.coerce.number().optional(),
+		rosterTtlMs: z.coerce.number().optional(),
 		queue: z.object({
 			maxDepth: z.coerce.number().optional(),
 			timeoutMs: z.coerce.number().optional(),
@@ -4504,6 +4564,8 @@ var init_schema = __esmMin((() => {
 		}).optional(),
 		agentAuth: z.enum(["token", "none"]).default("token"),
 		agentTokenTtlMs: z.coerce.number().default(36e5),
+		rosterGraceMs: z.coerce.number().default(3e5),
+		rosterTtlMs: z.coerce.number().default(18e5),
 		queueMaxDepth: z.coerce.number().default(1e3),
 		queueTimeoutMs: z.coerce.number().default(36e5),
 		/**
@@ -4925,6 +4987,9 @@ function getDefaults() {
 	return {
 		agentAuth: "token",
 		agentTokenTtlMs: 36e5,
+		rosterGraceMs: 3e5,
+		rosterTtlMs: 18e5,
+		maxFanoutHosts: 1024,
 		queue: {
 			maxDepth: 1e3,
 			timeoutMs: 36e5,
@@ -4974,6 +5039,9 @@ function flattenToAppConfig(merged) {
 	if (merged.storage) flat.storage = merged.storage;
 	flat.agentAuth = merged.agentAuth ?? "token";
 	flat.agentTokenTtlMs = merged.agentTokenTtlMs ?? 36e5;
+	flat.rosterGraceMs = merged.rosterGraceMs ?? 3e5;
+	flat.rosterTtlMs = merged.rosterTtlMs ?? 18e5;
+	flat.maxFanoutHosts = merged.maxFanoutHosts ?? 1024;
 	const queue = merged.queue;
 	flat.queueMaxDepth = queue?.maxDepth ?? 1e3;
 	flat.queueTimeoutMs = queue?.timeoutMs ?? 36e5;
@@ -5068,8 +5136,9 @@ function satisfiesMandatoryLabels(agent, requiredLabels) {
 	for (const label of agent.mandatoryLabels) if (!requiredSet.has(label)) return false;
 	return true;
 }
-var AgentRegistry;
+var logger$84, AgentRegistry;
 var init_registry = __esmMin((() => {
+	logger$84 = createLogger({ prefix: "agent-registry" });
 	AgentRegistry = class {
 		/** Primary: agentId -> AgentEntry */
 		agents = /* @__PURE__ */ new Map();
@@ -5107,6 +5176,27 @@ var init_registry = __esmMin((() => {
 		*/
 		tokenExpiryTimers = /* @__PURE__ */ new Map();
 		/**
+		* Per-agent last roster `last_seen` stamp time (epoch ms). Throttles the
+		* coarse heartbeat write so we don't issue a DB write per agent per
+		* heartbeat — `grace`/`ttl` are minute-scale, so a throttled stamp is
+		* sufficient. Cleaned up alongside the agent in `removeFromIndexes`.
+		*/
+		lastRosterStampAt = /* @__PURE__ */ new Map();
+		/** Minimum interval between coarse roster `last_seen` stamps per agent. */
+		ROSTER_STAMP_THROTTLE_MS = 6e4;
+		/** Optional host-roster reconciler + this instance's id (see AgentRegistryDeps). */
+		rosterStore;
+		instanceId;
+		/**
+		* The roster reconcile seam is optional: when no store is injected (workers
+		* with no DB, unit tests), every reconcile hook is a no-op and the in-memory
+		* registry behaves exactly as before.
+		*/
+		constructor(deps = {}) {
+			this.rosterStore = deps.rosterStore;
+			this.instanceId = deps.instanceId;
+		}
+		/**
 		* Register an agent. If the agentId already exists, updates the existing
 		* entry (agent reconnection scenario).
 		*/
@@ -5138,7 +5228,8 @@ var init_registry = __esmMin((() => {
 				runningAsUid: metadata?.runningAsUid ?? null,
 				memoryUsedMb: null,
 				memoryAvailableMb: null,
-				uptimeSeconds: null
+				uptimeSeconds: null,
+				tokenAgentType: metadata?.tokenAgentType ?? null
 			};
 			this.agents.set(agentId, entry);
 			this.wsToAgentId.set(ws, agentId);
@@ -5158,6 +5249,22 @@ var init_registry = __esmMin((() => {
 				}
 				tokenAgents.add(agentId);
 			}
+			if (this.rosterStore && this.instanceId) {
+				const instanceId = this.instanceId;
+				this.rosterStore.upsert({
+					agentId,
+					tokenId,
+					lifecycleClass: metadata?.tokenAgentType ?? "ephemeral",
+					labels,
+					hostname: metadata?.hostname ?? null,
+					platform,
+					arch,
+					instanceId
+				}).catch((err) => logger$84.warn("host_roster upsert failed (best-effort)", {
+					agentId,
+					error: toErrorMessage(err)
+				}));
+			}
 		}
 		/**
 		* Unregister an agent by ID. Removes from all indexes.
@@ -5168,6 +5275,7 @@ var init_registry = __esmMin((() => {
 			if (!entry) return void 0;
 			this.removeFromIndexes(agentId, entry);
 			this.agents.delete(agentId);
+			if (this.rosterStore && this.instanceId) this.rosterStore.markDisconnected(agentId, this.instanceId).catch(() => {});
 			return entry;
 		}
 		/**
@@ -5268,7 +5376,7 @@ var init_registry = __esmMin((() => {
 		* @param requiredLabels - All labels the agent must have (intersection semantics).
 		* @returns Array of matching available AgentEntry objects.
 		*/
-		findAvailable(requiredLabels, excludeLabels = []) {
+		findAvailable(requiredLabels, requiredPatterns = [], excludeLabels = [], excludePatterns = []) {
 			let candidates;
 			if (requiredLabels.length === 0) candidates = [...this.agents.values()].filter((e) => e.activeJobs < e.maxConcurrency);
 			else {
@@ -5287,14 +5395,29 @@ var init_registry = __esmMin((() => {
 					if (entry.activeJobs < entry.maxConcurrency) candidates.push(entry);
 				}
 			}
+			if (requiredPatterns.length > 0) candidates = candidates.filter((a) => requiredPatterns.every((p) => matcherSatisfiedBy(p, a.labels)));
 			let filtered = candidates;
 			if (excludeLabels.length > 0) filtered = filtered.filter((agent) => {
 				for (const excluded of excludeLabels) if (agent.labels.has(excluded)) return false;
 				return true;
 			});
+			if (excludePatterns.length > 0) filtered = filtered.filter((a) => !excludePatterns.some((p) => matcherSatisfiedBy(p, a.labels)));
 			return filtered.filter((agent) => satisfiesMandatoryLabels(agent, requiredLabels));
 		}
 		/**
+		* Whether a specific agent satisfies the same label / exclude / mandatory
+		* gate `findAvailable` applies per-agent, ignoring capacity. Used by the
+		* host-fanout pin to verify the resolved agent still matches before pinning
+		* (guards against roster label drift between resolution and dispatch).
+		*/
+		agentSatisfies(agent, requiredLabels, requiredPatterns = [], excludeLabels = [], excludePatterns = []) {
+			for (const required of requiredLabels) if (!agent.labels.has(required)) return false;
+			for (const p of requiredPatterns) if (!matcherSatisfiedBy(p, agent.labels)) return false;
+			for (const excluded of excludeLabels) if (agent.labels.has(excluded)) return false;
+			for (const p of excludePatterns) if (matcherSatisfiedBy(p, agent.labels)) return false;
+			return satisfiesMandatoryLabels(agent, requiredLabels);
+		}
+		/**
 		* Check if ANY registered agent matches the required labels, regardless of capacity.
 		* Used to decide whether to queue (agent exists but busy) vs reject (no agent at all).
 		*
@@ -5305,23 +5428,20 @@ var init_registry = __esmMin((() => {
 		* an off-gate gated agent as "matching but busy" and skip the peer
 		* reroute path even though the local agent can never accept the job.
 		*/
-		hasMatchingAgent(requiredLabels, excludeLabels = []) {
+		hasMatchingAgent(requiredLabels, requiredPatterns = [], excludeLabels = [], excludePatterns = []) {
 			const candidateIds = this.intersectLabelCandidates(requiredLabels);
 			if (candidateIds === null) return false;
+			const ok = (entry) => {
+				if (excludeLabels.some((e) => entry.labels.has(e))) return false;
+				if (requiredPatterns.some((p) => !matcherSatisfiedBy(p, entry.labels))) return false;
+				if (excludePatterns.some((p) => matcherSatisfiedBy(p, entry.labels))) return false;
+				return satisfiesMandatoryLabels(entry, requiredLabels);
+			};
 			if (requiredLabels.length === 0) {
-				for (const entry of this.agents.values()) {
-					if (excludeLabels.some((e) => entry.labels.has(e))) continue;
-					if (!satisfiesMandatoryLabels(entry, requiredLabels)) continue;
-					return true;
-				}
+				for (const entry of this.agents.values()) if (ok(entry)) return true;
 				return false;
 			}
-			for (const id of candidateIds) {
-				const entry = this.agents.get(id);
-				if (excludeLabels.length > 0 && excludeLabels.some((e) => entry.labels.has(e))) continue;
-				if (!satisfiesMandatoryLabels(entry, requiredLabels)) continue;
-				return true;
-			}
+			for (const id of candidateIds) if (ok(this.agents.get(id))) return true;
 			return false;
 		}
 		/**
@@ -5371,6 +5491,16 @@ var init_registry = __esmMin((() => {
 			const entry = this.agents.get(agentId);
 			if (!entry) return false;
 			entry.lastHeartbeatAt = Date.now();
+			if (this.rosterStore && this.instanceId) {
+				const now = Date.now();
+				const last = this.lastRosterStampAt.get(agentId) ?? now;
+				if (!this.lastRosterStampAt.has(agentId)) this.lastRosterStampAt.set(agentId, now);
+				else if (now - last >= this.ROSTER_STAMP_THROTTLE_MS) {
+					this.lastRosterStampAt.set(agentId, now);
+					const instanceId = this.instanceId;
+					this.rosterStore.stampLastSeen(agentId, instanceId).catch(() => {});
+				}
+			}
 			return true;
 		}
 		/**
@@ -5405,6 +5535,7 @@ var init_registry = __esmMin((() => {
 		*/
 		removeFromIndexes(agentId, entry) {
 			this.wsToAgentId.delete(entry.ws);
+			this.lastRosterStampAt.delete(agentId);
 			for (const label of entry.labels) {
 				const agentIds = this.labelIndex.get(label);
 				if (agentIds) {
@@ -5428,7 +5559,222 @@ var init_registry = __esmMin((() => {
 			}
 		}
 	};
-})), JobQueue;
+}));
+//#endregion
+//#region src/agent/host-roster.ts
+/**
+* The ONE status-derivation function — used by the store and the kici-admin
+* host CLI. `ready` requires the host to be genuinely live (connected to some
+* instance AND heartbeat fresh — the freshness check catches a crashed
+* instance that never cleared `connected_instance_id`). It never returns
+* `ready` for a not-currently-live host: a not-live `static` reads
+* `unreachable` (the declared-but-absent alarm), a not-live `ephemeral` reads
+* `stale` (scaled down, awaiting reap).
+*/
+function deriveHostStatus(row, nowMs, graceMs) {
+	const ageMs = nowMs - new Date(row.last_seen).getTime();
+	if (row.connected_instance_id !== null && ageMs <= graceMs) return "ready";
+	if (row.lifecycle_class === "ephemeral") return "stale";
+	return "unreachable";
+}
+var HostRosterStore;
+var init_host_roster = __esmMin((() => {
+	HostRosterStore = class {
+		db;
+		constructor(db) {
+			this.db = db;
+		}
+		/** Idempotent upsert on agent_id; stamps connected_instance_id + last_seen. */
+		async upsert(input) {
+			const labelsJson = JSON.stringify(input.labels);
+			await this.db.insertInto("host_roster").values({
+				agent_id: input.agentId,
+				token_id: input.tokenId,
+				lifecycle_class: input.lifecycleClass,
+				labels: labelsJson,
+				hostname: input.hostname,
+				platform: input.platform,
+				arch: input.arch,
+				connected_instance_id: input.instanceId,
+				last_seen: sql`now()`,
+				updated_at: sql`now()`
+			}).onConflict((oc) => oc.column("agent_id").doUpdateSet({
+				token_id: input.tokenId,
+				lifecycle_class: input.lifecycleClass,
+				labels: labelsJson,
+				hostname: input.hostname,
+				platform: input.platform,
+				arch: input.arch,
+				connected_instance_id: input.instanceId,
+				last_seen: sql`now()`,
+				updated_at: sql`now()`
+			})).execute();
+		}
+		/** Clear liveness on disconnect — but only if THIS instance still owns it. */
+		async markDisconnected(agentId, instanceId) {
+			await this.db.updateTable("host_roster").set({
+				connected_instance_id: null,
+				updated_at: sql`now()`
+			}).where("agent_id", "=", agentId).where("connected_instance_id", "=", instanceId).execute();
+		}
+		/** Coarse heartbeat stamp — same owner-guard as markDisconnected. */
+		async stampLastSeen(agentId, instanceId) {
+			await this.db.updateTable("host_roster").set({ last_seen: sql`now()` }).where("agent_id", "=", agentId).where("connected_instance_id", "=", instanceId).execute();
+		}
+		/** Operator pre-declare of a static host before its agent dials in. */
+		async declareStatic(input) {
+			await this.db.insertInto("host_roster").values({
+				agent_id: input.agentId,
+				token_id: null,
+				lifecycle_class: "static",
+				labels: JSON.stringify(input.labels),
+				hostname: input.hostname ?? null,
+				connected_instance_id: null,
+				last_seen: sql`now()`,
+				updated_at: sql`now()`
+			}).onConflict((oc) => oc.column("agent_id").doNothing()).execute();
+		}
+		async get(agentId) {
+			return await this.db.selectFrom("host_roster").selectAll().where("agent_id", "=", agentId).executeTakeFirst() ?? null;
+		}
+		async listAll() {
+			return this.db.selectFrom("host_roster").selectAll().orderBy("agent_id", "asc").execute();
+		}
+		/**
+		* Resolve every roster host matching a `runsOnAll` predicate (OR-of-AND
+		* include groups, minus exclude labels), tagged with its derived status. This
+		* is the host-fanout resolver: it returns declared-but-absent static hosts
+		* (status `unreachable`) so the caller can apply `onUnreachable` — the live
+		* registry alone cannot name an expected-but-absent host.
+		*/
+		async findMatching(include, exclude, graceMs) {
+			const rows = await this.db.selectFrom("host_roster").selectAll().execute();
+			const now = Date.now();
+			const out = [];
+			for (const row of rows) {
+				const labels = JSON.parse(row.labels);
+				const set = new Set(labels);
+				if (exclude.some((e) => matcherSatisfiedBy(e, set))) continue;
+				if (include.length && !include.some((grp) => grp.every((m) => matcherSatisfiedBy(m, set)))) continue;
+				out.push({
+					agentId: row.agent_id,
+					host: row.hostname ?? row.agent_id,
+					labels,
+					lifecycleClass: row.lifecycle_class,
+					connectedInstanceId: row.connected_instance_id,
+					status: deriveHostStatus(row, now, graceMs),
+					platform: row.platform,
+					arch: row.arch
+				});
+			}
+			out.sort((a, b) => a.agentId.localeCompare(b.agentId));
+			return out;
+		}
+		/**
+		* Count `static` (declared) hosts whose derived status is `unreachable` —
+		* the "declared-but-absent" alarm population. Reuses the single-source
+		* {@link deriveHostStatus} so the count never diverges from what
+		* `kici-admin host list` shows. A not-currently-connected static host reads
+		* `unreachable` regardless of grace (only the connected-but-stale case
+		* depends on `graceMs`).
+		*/
+		async countStaticUnreachable(graceMs) {
+			const rows = await this.db.selectFrom("host_roster").selectAll().where("lifecycle_class", "=", "static").execute();
+			const now = Date.now();
+			return rows.filter((r) => deriveHostStatus(r, now, graceMs) === "unreachable").length;
+		}
+		/** Delete ephemeral rows whose last_seen is older than ttl. Returns count. */
+		async reapEphemeralPastTtl(ttlMs) {
+			const res = await this.db.deleteFrom("host_roster").where("lifecycle_class", "=", "ephemeral").where("last_seen", "<", sql`now() - (${ttlMs}::text || ' milliseconds')::interval`).executeTakeFirst();
+			return Number(res.numDeletedRows ?? 0n);
+		}
+	};
+}));
+//#endregion
+//#region src/agent/host-roster-reaper.ts
+var logger$83, HostRosterReaper;
+var init_host_roster_reaper = __esmMin((() => {
+	logger$83 = createLogger({ prefix: "host-roster-reaper" });
+	HostRosterReaper = class {
+		store;
+		ttlMs;
+		graceMs;
+		scanIntervalMs;
+		setUnreachableGauge;
+		timer = null;
+		isLeader = false;
+		constructor(opts) {
+			this.store = opts.store;
+			this.ttlMs = opts.ttlMs;
+			this.graceMs = opts.graceMs;
+			this.scanIntervalMs = opts.scanIntervalMs;
+			this.setUnreachableGauge = opts.setUnreachableGauge;
+		}
+		onBecomeLeader() {
+			if (this.timer) {
+				clearInterval(this.timer);
+				this.timer = null;
+			}
+			this.isLeader = true;
+			logger$83.info("Became leader, starting host roster reaper", {
+				ttlMs: this.ttlMs,
+				scanIntervalMs: this.scanIntervalMs
+			});
+			this.timer = setInterval(() => {
+				this.tick().catch((err) => logger$83.error("roster reaper tick failed", { error: toErrorMessage(err) }));
+			}, this.scanIntervalMs);
+			this.timer.unref?.();
+		}
+		onLoseLeadership() {
+			this.isLeader = false;
+			if (this.timer) {
+				clearInterval(this.timer);
+				this.timer = null;
+			}
+			logger$83.info("Lost leadership, stopped host roster reaper");
+		}
+		stop() {
+			if (this.timer) {
+				clearInterval(this.timer);
+				this.timer = null;
+			}
+			this.isLeader = false;
+		}
+		/** One reap pass. Public for tests. */
+		async tick() {
+			if (!this.isLeader) return;
+			const deleted = await this.store.reapEphemeralPastTtl(this.ttlMs);
+			if (deleted > 0) logger$83.info("Reaped expired ephemeral hosts", { deleted });
+			const unreachable = await this.store.countStaticUnreachable(this.graceMs);
+			this.setUnreachableGauge(unreachable);
+			if (unreachable > 0) logger$83.warn("Declared hosts unreachable", { count: unreachable });
+		}
+	};
+}));
+//#endregion
+//#region src/queue/job-queue.ts
+/**
+* Parse a `dispatch_queue` jsonb pattern column into a `LabelMatcher[]`. Handles
+* both the auto-parsed array form (from the pg driver) and the JSON string form
+* (from tests / a non-parsing driver). A missing / malformed value yields `[]`.
+*/
+function parseMatcherColumn(v) {
+	if (Array.isArray(v)) return v;
+	if (typeof v === "string") return JSON.parse(v);
+	return [];
+}
+/**
+* Whether an agent's label set satisfies a job's regex matchers: every
+* `runsOnPatterns` matcher must match some label AND no `excludePatterns`
+* matcher may match any label. The single matching authority is the engine's
+* `matcherSatisfiedBy` (JS RegExp) — never a Postgres `~`.
+*/
+function jobPatternsSatisfiedBy(job, labels) {
+	if (!job.runsOnPatterns.every((p) => matcherSatisfiedBy(p, labels))) return false;
+	if (job.excludePatterns.some((p) => matcherSatisfiedBy(p, labels))) return false;
+	return true;
+}
+var JobQueue;
 var init_job_queue = __esmMin((() => {
 	JobQueue = class {
 		db;
@@ -5480,7 +5826,10 @@ var init_job_queue = __esmMin((() => {
 				deps_hash: job.depsHash ?? null,
 				request_id: job.requestId ?? null,
 				exclude_labels: JSON.stringify(job.excludeLabels ?? []),
-				routing_key: job.routingKey
+				runs_on_patterns: JSON.stringify(job.runsOnPatterns ?? []),
+				exclude_patterns: JSON.stringify(job.excludePatterns ?? []),
+				routing_key: job.routingKey,
+				pinned_agent_id: job.pinnedAgentId ?? null
 			}).execute();
 			this.depthCache = null;
 			this.breakdownCache = null;
@@ -5507,18 +5856,79 @@ var init_job_queue = __esmMin((() => {
 		*   (empty for static / non-scaler agents).
 		* @returns The matching job, or null if none found.
 		*/
-		async dequeueForLabels(agentLabels, agentMandatoryLabels = []) {
+		async dequeueForLabels(agentLabels, agentMandatoryLabels = [], agentId) {
+			const fast = await this.claimPatternFree(agentLabels, agentMandatoryLabels, agentId);
+			if (fast) return fast;
+			return this.claimWithPatterns(agentLabels, agentMandatoryLabels, agentId);
+		}
+		/**
+		* Build the shared drain WHERE chain (status / expiry / exact-label @> /
+		* exclude-label / pin / mandatory-label gate) common to both drain passes.
+		* The pattern columns are NOT filtered here — each pass adds its own
+		* pattern-free / pattern-bearing guard on top.
+		*/
+		drainBaseQuery(agentLabels, agentMandatoryLabels, agentId) {
 			const agentLabelsJson = JSON.stringify(agentLabels);
 			const mandatoryLabelsJson = JSON.stringify(agentMandatoryLabels);
 			let query = this.db.selectFrom("dispatch_queue").selectAll().where("status", "=", "pending").where(sql`(expires_at IS NULL OR expires_at >= now())`).where(sql`${sql.lit(agentLabelsJson)}::jsonb @> runs_on_labels`).where(sql`NOT EXISTS (
           SELECT 1 FROM jsonb_array_elements_text(exclude_labels) AS e
           WHERE e.value = ANY(${sql.val(agentLabels)}::text[])
         )`);
+			query = query.where(sql`(pinned_agent_id IS NULL${agentId ? sql` OR pinned_agent_id = ${sql.val(agentId)}` : sql``})`);
 			if (agentMandatoryLabels.length > 0) query = query.where(sql`runs_on_labels @> ${sql.lit(mandatoryLabelsJson)}::jsonb`);
-			const row = await query.orderBy("created_at", "asc").limit(1).forUpdate().skipLocked().executeTakeFirst();
+			return query;
+		}
+		/**
+		* Fast path: claim the oldest pending pattern-free row. The
+		* `runs_on_patterns = '[]' AND exclude_patterns = '[]'` guard restricts this
+		* pass to rows that need no JS post-filter, so the single-row atomic claim
+		* (FOR UPDATE SKIP LOCKED) keeps the original hot-path semantics intact.
+		*/
+		async claimPatternFree(agentLabels, agentMandatoryLabels, agentId) {
+			const row = await this.drainBaseQuery(agentLabels, agentMandatoryLabels, agentId).where(sql`runs_on_patterns = '[]'::jsonb AND exclude_patterns = '[]'::jsonb`).orderBy("created_at", "asc").limit(1).forUpdate().skipLocked().executeTakeFirst();
 			return row ? this.rowToQueuedJob(row) : null;
 		}
 		/**
+		* Pattern path: load a small batch of pattern-bearing candidate rows, apply
+		* the JS regex post-filter (matcherSatisfiedBy), and atomically claim the
+		* first match by id with a conditional `status = Pending` guard. The claim is
+		* a conditional UPDATE rather than relying on the SELECT lock alone because
+		* the JS filter runs after the per-statement lock window has closed, so two
+		* agents could both pass the filter for the same row; the `where status =
+		* Pending` makes exactly one of them win. The claim transitions the row to
+		* Dispatched, matching the value the caller-side markDispatched would set
+		* (which then re-sets it idempotently).
+		*/
+		async claimWithPatterns(agentLabels, agentMandatoryLabels, agentId) {
+			const labelSet = new Set(agentLabels);
+			const rows = await this.drainBaseQuery(agentLabels, agentMandatoryLabels, agentId).where(sql`(runs_on_patterns <> '[]'::jsonb OR exclude_patterns <> '[]'::jsonb)`).orderBy("created_at", "asc").limit(10).forUpdate().skipLocked().execute();
+			for (const row of rows) {
+				const job = this.rowToQueuedJob(row);
+				if (!jobPatternsSatisfiedBy(job, labelSet)) continue;
+				if (((await this.db.updateTable("dispatch_queue").set({ status: "dispatched" }).where("id", "=", row.id).where("status", "=", "pending").executeTakeFirst()).numUpdatedRows ?? 0n) > 0n) return job;
+			}
+			return null;
+		}
+		/**
+		* Atomically claim the oldest pending job pinned to a specific agent. Used by
+		* the eager pin drain when the pinned agent (re)registers or frees a slot —
+		* the host-fanout analog of `dispatchBoundJob`'s eager path. Ignores the exact
+		* label gate: the pin was resolved against the roster at materialize time.
+		*
+		* Still applies the JS regex post-filter (`jobPatternsSatisfiedBy`) when
+		* `agentLabels` is supplied, mirroring `dequeueById`: a pinned child whose
+		* `runsOn`/`exclude` patterns no longer match the agent's current labels must
+		* not be claimed. The single matching authority is the engine's
+		* `matcherSatisfiedBy` (never a Postgres `~`).
+		*/
+		async dequeueByPinnedAgent(agentId, agentLabels) {
+			const row = await this.db.selectFrom("dispatch_queue").selectAll().where("status", "=", "pending").where("pinned_agent_id", "=", agentId).where(sql`(expires_at IS NULL OR expires_at >= now())`).orderBy("created_at", "asc").limit(1).forUpdate().skipLocked().executeTakeFirst();
+			if (!row) return null;
+			const job = this.rowToQueuedJob(row);
+			if (agentLabels && !jobPatternsSatisfiedBy(job, new Set(agentLabels))) return null;
+			return job;
+		}
+		/**
 		* Atomically claim a specific pending job by ID, validating it still
 		* matches the agent's labels and isn't expired.
 		*
@@ -5544,7 +5954,10 @@ var init_job_queue = __esmMin((() => {
         )`);
 			if (agentMandatoryLabels.length > 0) query = query.where(sql`runs_on_labels @> ${sql.lit(mandatoryLabelsJson)}::jsonb`);
 			const row = await query.forUpdate().skipLocked().executeTakeFirst();
-			return row ? this.rowToQueuedJob(row) : null;
+			if (!row) return null;
+			const job = this.rowToQueuedJob(row);
+			if (!jobPatternsSatisfiedBy(job, new Set(agentLabels))) return null;
+			return job;
 		}
 		/**
 		* Insert a job directly with status='dispatched' (bypasses the queue).
@@ -5576,7 +5989,10 @@ var init_job_queue = __esmMin((() => {
 				deps_hash: job.depsHash ?? null,
 				request_id: job.requestId ?? null,
 				exclude_labels: JSON.stringify(job.excludeLabels ?? []),
-				routing_key: job.routingKey
+				runs_on_patterns: JSON.stringify(job.runsOnPatterns ?? []),
+				exclude_patterns: JSON.stringify(job.excludePatterns ?? []),
+				routing_key: job.routingKey,
+				pinned_agent_id: job.pinnedAgentId ?? null
 			}).execute();
 			return id;
 		}
@@ -6006,7 +6422,10 @@ var init_job_queue = __esmMin((() => {
 				depsHash: row.deps_hash ?? void 0,
 				requestId: row.request_id ?? void 0,
 				excludeLabels: typeof row.exclude_labels === "string" ? JSON.parse(row.exclude_labels) : Array.isArray(row.exclude_labels) ? row.exclude_labels : [],
-				routingKey: row.routing_key
+				runsOnPatterns: parseMatcherColumn(row.runs_on_patterns),
+				excludePatterns: parseMatcherColumn(row.exclude_patterns),
+				routingKey: row.routing_key,
+				pinnedAgentId: row.pinned_agent_id ?? void 0
 			};
 		}
 	};
@@ -6111,14 +6530,66 @@ var init_cleanup$1 = __esmMin((() => {
 * Prometheus can address multiple KiCI services from one dashboard.
 * The orchestrator runs setInterval-driven schedulers (no pg-boss
 * dependency) but the outward observability shape is identical.
+*
+* Lazy meter + instrument initialization: the `@kici-dev/shared` barrel
+* is imported statically at the top of the orchestrator entry points
+* (server.ts, standalone.ts), which evaluates this module BEFORE
+* `initTelemetry()` sets the global MeterProvider. Creating the meter or
+* any instrument at module-eval time would bind it to the no-op provider,
+* so its samples never reach the Prometheus exporter (the `/metrics`
+* scrape) or the Platform push. We therefore resolve the meter and every
+* instrument on first use — counters/histograms on first `.add()` /
+* `.record()`, observable gauges on first `.set()` — all of which happen
+* at job-run time, long after telemetry is wired up. Same hazard, same
+* fix as `prometheus.ts` and `@kici-dev/shared`'s cold-store metrics
+* module.
+*/
+function meter() {
+	if (!_meter) _meter = createMeter("kici-orchestrator");
+	return _meter;
+}
+/**
+* A counter whose real OTel instrument is created on first `.add()` —
+* after `initTelemetry()` has registered the global MeterProvider. The
+* returned value satisfies the OTel `Counter` interface, so call sites
+* are unchanged.
+*/
+function lazyCounter(name, description) {
+	let inst;
+	const get = () => inst ??= meter().createCounter(name, { description });
+	return { add: (...args) => get().add(...args) };
+}
+/**
+* A histogram whose real OTel instrument is created on first `.record()` —
+* after `initTelemetry()`. Satisfies the OTel `Histogram` interface.
+*/
+function lazyHistogram(name, description, explicitBucketBoundaries) {
+	let inst;
+	const get = () => inst ??= meter().createHistogram(name, {
+		description,
+		advice: { explicitBucketBoundaries }
+	});
+	return { record: (...args) => get().record(...args) };
+}
+/**
+* An observable gauge backed by per-label state. The underlying OTel
+* instrument + scrape callback are created on first `.set()`, so the
+* gauge binds to the real MeterProvider rather than the no-op one. The
+* callback reads the latest per-label value on each Prometheus scrape.
 */
 function createGaugeWithState(name, description) {
 	const state = /* @__PURE__ */ new Map();
-	meter.createObservableGauge(name, { description }).addCallback((result) => {
-		for (const entry of state.values()) result.observe(entry.value, entry.attributes);
-	});
+	let registered = false;
+	function ensureRegistered() {
+		if (registered) return;
+		registered = true;
+		meter().createObservableGauge(name, { description }).addCallback((result) => {
+			for (const entry of state.values()) result.observe(entry.value, entry.attributes);
+		});
+	}
 	return {
 		set(labels, value) {
+			ensureRegistered();
 			const key = JSON.stringify(labels);
 			state.set(key, {
 				attributes: labels,
@@ -6130,24 +6601,20 @@ function createGaugeWithState(name, description) {
 		}
 	};
 }
-var meter, jobRunsTotal, jobDurationSeconds, jobLastSuccessTimestamp, jobLastFailureTimestamp, jobConsecutiveFailures;
+var _meter, jobRunsTotal, jobDurationSeconds, jobLastSuccessTimestamp, jobLastFailureTimestamp, jobConsecutiveFailures;
 var init_scheduled_jobs = __esmMin((() => {
-	meter = createMeter("kici-orchestrator");
-	jobRunsTotal = meter.createCounter("kici_orch_job_runs_total", { description: "Scheduled job run outcomes, by job and result (success/failure)" });
-	jobDurationSeconds = meter.createHistogram("kici_orch_job_duration_seconds", {
-		description: "Scheduled job tick duration in seconds",
-		advice: { explicitBucketBoundaries: [
-			.01,
-			.05,
-			.1,
-			.5,
-			1,
-			5,
-			30,
-			120,
-			600
-		] }
-	});
+	jobRunsTotal = lazyCounter("kici_orch_job_runs_total", "Scheduled job run outcomes, by job and result (success/failure)");
+	jobDurationSeconds = lazyHistogram("kici_orch_job_duration_seconds", "Scheduled job tick duration in seconds", [
+		.01,
+		.05,
+		.1,
+		.5,
+		1,
+		5,
+		30,
+		120,
+		600
+	]);
 	jobLastSuccessTimestamp = createGaugeWithState("kici_orch_job_last_success_timestamp_seconds", "Unix timestamp of the most recent successful scheduled job tick");
 	jobLastFailureTimestamp = createGaugeWithState("kici_orch_job_last_failure_timestamp_seconds", "Unix timestamp of the most recent failed scheduled job tick");
 	jobConsecutiveFailures = createGaugeWithState("kici_orch_job_consecutive_failures", "Consecutive failures for each scheduled job since its last success");
@@ -8428,7 +8895,8 @@ var init_dispatcher = __esmMin((() => {
 		* 4. If queue full: return 'rejected'.
 		*/
 		async dispatch(job) {
-			const available = this.registry.findAvailable(job.runsOnLabels, job.excludeLabels ?? []);
+			if (job.pinnedAgentId) return this.dispatchPinned(job);
+			const available = this.registry.findAvailable(job.runsOnLabels, job.runsOnPatterns ?? [], job.excludeLabels ?? [], job.excludePatterns ?? []);
 			if (available.length > 0) {
 				const agent = available[0];
 				this.registry.incrementActiveJobs(agent.agentId);
@@ -8461,6 +8929,8 @@ var init_dispatcher = __esmMin((() => {
 					depsHash: job.depsHash,
 					requestId: job.requestId,
 					excludeLabels: job.excludeLabels ?? [],
+					runsOnPatterns: job.runsOnPatterns ?? [],
+					excludePatterns: job.excludePatterns ?? [],
 					routingKey: job.routingKey,
 					resources: job.resources
 				};
@@ -8490,7 +8960,7 @@ var init_dispatcher = __esmMin((() => {
 				throw err;
 			}
 			if (this.onNoMatchingAgent) {
-				if ((await this.onNoMatchingAgent(job.runsOnLabels, jobId, job.runId, job.excludeLabels ?? [], job.resources)).action === "no-backend" && !this.registry.hasMatchingAgent(job.runsOnLabels, job.excludeLabels ?? [])) return {
+				if ((await this.onNoMatchingAgent(job.runsOnLabels, jobId, job.runId, job.excludeLabels ?? [], job.resources)).action === "no-backend" && !this.registry.hasMatchingAgent(job.runsOnLabels, job.runsOnPatterns ?? [], job.excludeLabels ?? [], job.excludePatterns ?? [])) return {
 					status: "queued-no-backend",
 					jobId
 				};
@@ -8501,6 +8971,84 @@ var init_dispatcher = __esmMin((() => {
 			};
 		}
 		/**
+		* Dispatch a host-fanout pinned child. The job targets exactly
+		* `job.pinnedAgentId`: if that agent is locally connected, satisfies the
+		* runsOn/exclude/mandatory gate, and has capacity, dispatch immediately;
+		* otherwise queue it WITH the pin so the pin-aware drain delivers it when the
+		* agent frees up or (re)connects. A pinned job never falls through to a
+		* different agent.
+		*/
+		async dispatchPinned(job) {
+			const agentId = job.pinnedAgentId;
+			const agent = this.registry.get(agentId);
+			if (agent && this.registry.agentSatisfies(agent, job.runsOnLabels, job.runsOnPatterns ?? [], job.excludeLabels ?? [], job.excludePatterns ?? []) && agent.activeJobs < agent.maxConcurrency) {
+				this.registry.incrementActiveJobs(agentId);
+				let jobId;
+				try {
+					jobId = await this.queue.insertDispatched(job);
+				} catch (err) {
+					this.registry.decrementActiveJobs(agentId);
+					throw err;
+				}
+				const queuedJob = {
+					id: jobId,
+					runId: job.runId,
+					workflowName: job.workflowName,
+					jobName: job.jobName,
+					runsOnLabels: job.runsOnLabels,
+					jobConfig: job.jobConfig,
+					repoUrl: job.repoUrl,
+					ref: job.ref,
+					sha: job.sha,
+					status: "dispatched",
+					createdAt: (/* @__PURE__ */ new Date()).toISOString(),
+					expiresAt: null,
+					deliveryId: job.deliveryId,
+					provider: job.provider,
+					providerContext: job.providerContext,
+					sourceTarUrl: job.sourceTarUrl,
+					sourceTarHash: job.sourceTarHash,
+					depsUrl: job.depsUrl,
+					depsHash: job.depsHash,
+					requestId: job.requestId,
+					excludeLabels: job.excludeLabels ?? [],
+					runsOnPatterns: job.runsOnPatterns ?? [],
+					excludePatterns: job.excludePatterns ?? [],
+					routingKey: job.routingKey,
+					resources: job.resources,
+					pinnedAgentId: agentId
+				};
+				this.trackJobForAgent(agentId, jobId, queuedJob.runId);
+				await this.onDispatch(agentId, queuedJob);
+				await this.armAckDeadline(agentId, queuedJob);
+				this.metrics.incJobsDispatched("dispatched");
+				return {
+					status: "dispatched",
+					agentId,
+					jobId
+				};
+			}
+			let jobId;
+			try {
+				jobId = await this.queue.enqueue(job);
+				this.metrics.incJobsDispatched("queued");
+				await this.updateQueueDepthMetric();
+			} catch (err) {
+				if (toErrorMessage(err) === "queue full") {
+					this.metrics.incJobsDispatched("rejected");
+					return {
+						status: "rejected",
+						reason: "queue full"
+					};
+				}
+				throw err;
+			}
+			return {
+				status: "queued",
+				jobId
+			};
+		}
+		/**
 		* Eagerly dispatch a specific bound job to a freshly-registered
 		* scaler-managed agent.
 		*
@@ -8554,7 +9102,7 @@ var init_dispatcher = __esmMin((() => {
 				this.registry.incrementActiveJobs(agentId);
 				let job = null;
 				try {
-					job = await this.queue.dequeueForLabels(agentLabels, agentMandatoryLabels);
+					job = await this.queue.dequeueByPinnedAgent(agentId, agentLabels) ?? await this.queue.dequeueForLabels(agentLabels, agentMandatoryLabels, agentId);
 				} finally {
 					if (!job) this.registry.decrementActiveJobs(agentId);
 				}
@@ -8770,7 +9318,7 @@ var init_dispatcher = __esmMin((() => {
 		async redispatch(jobId) {
 			const job = await this.queue.getFullJobById(jobId);
 			if (!job || job.status !== "pending") return;
-			const available = this.registry.findAvailable(job.runsOnLabels, job.excludeLabels ?? []);
+			const available = this.registry.findAvailable(job.runsOnLabels, job.runsOnPatterns ?? [], job.excludeLabels ?? [], job.excludePatterns ?? []);
 			if (available.length > 0) {
 				if (await this.dispatchBoundJob(available[0].agentId, jobId)) return;
 			}
@@ -9220,6 +9768,37 @@ var init_dispatcher = __esmMin((() => {
 	};
 }));
 //#endregion
+//#region src/lockfile-redos-guard.ts
+/**
+* Lock-load ReDoS revalidation.
+*
+* Re-validates every regex matcher in a fetched lock file before it is cached
+* or dispatched. Defense-in-depth against a hand-edited or non-compiled lock
+* that smuggled a ReDoS-prone pattern past the compile-time gate: the compiler
+* runs the same `assertMatchersSafe` check when it emits the lock, but the
+* orchestrator does not trust that the lock it fetched was produced by our
+* compiler.
+*/
+/**
+* Walk every static job's `runsOn` / `excludeLabels` / `runsOnAll` matchers and
+* throw if any regex matcher is ReDoS-prone. Dynamic job generators carry no
+* static routing matchers (they materialize jobs at eval time, which re-runs the
+* compile-time gate), so only static jobs are checked.
+*/
+function assertLockFileRegexesSafe(lockFile) {
+	for (const wf of lockFile.workflows ?? []) for (const job of wf.jobs ?? []) {
+		if (!isLockStaticJob(job)) continue;
+		const ctx = `lock workflow '${wf.name}' job '${job.name}'`;
+		if (job.runsOn) assertMatchersSafe(job.runsOn, `${ctx} runsOn`);
+		if (job.excludeLabels) assertMatchersSafe(job.excludeLabels, `${ctx} excludeLabels`);
+		if (job.runsOnAll) {
+			for (const grp of job.runsOnAll.include ?? []) assertMatchersSafe(grp, `${ctx} runsOnAll`);
+			if (job.runsOnAll.exclude) assertMatchersSafe(job.runsOnAll.exclude, `${ctx} runsOnAll exclude`);
+		}
+	}
+}
+var init_lockfile_redos_guard = __esmMin((() => {}));
+//#endregion
 //#region src/lockfile-cache.ts
 /**
 * Provider-agnostic LRU cache for lock files.
@@ -9232,6 +9811,7 @@ var init_dispatcher = __esmMin((() => {
 */
 var logger$76, LockFileCache;
 var init_lockfile_cache = __esmMin((() => {
+	init_lockfile_redos_guard();
 	logger$76 = createLogger({ prefix: "lockfile-cache" });
 	LockFileCache = class {
 		cache;
@@ -9287,6 +9867,17 @@ var init_lockfile_cache = __esmMin((() => {
 				});
 				return null;
 			}
+			try {
+				assertLockFileRegexesSafe(lockFile);
+			} catch (error) {
+				const message = toErrorMessage(error);
+				logger$76.warn("Lock file carries a ReDoS-prone regex matcher", {
+					repoIdentifier,
+					ref,
+					error: message
+				});
+				throw new LockFileParseError(repoIdentifier, ref, message);
+			}
 			this.cache.set(cacheKey, lockFile);
 			return lockFile;
 		}
@@ -11697,6 +12288,15 @@ var init_agent_job_failed_error = __esmMin((() => {
 //#endregion
 //#region src/ws/agent-handler.ts
 /**
+* Narrow the token's `agent_type` column (a free string at the DB layer) to
+* the host-roster lifecycle class. Anything other than the two known values
+* (including `undefined` under `agentAuth: 'none'`) maps to `null` so the
+* roster's reconcile hook treats it as the GC-able default class.
+*/
+function toLifecycleClass(agentType) {
+	return agentType === "static" || agentType === "ephemeral" ? agentType : null;
+}
+/**
 * Run the three token-bound authorization gates against a wire-supplied
 * `agent.register` payload. The gates are identical at first register
 * (Phase 2 / `pendingRegistration`) and on every subsequent re-register
@@ -12080,7 +12680,8 @@ function createAgentWsHandler(deps) {
 					runningAsUid: parsed.data.runningAsUid,
 					tokenId: regEntry.tokenId ?? null,
 					mandatoryLabels: scalerInfo?.mandatoryLabels,
-					scalerManaged: scalerInfo !== null
+					scalerManaged: scalerInfo !== null,
+					tokenAgentType: toLifecycleClass(regEntry.tokenAgentType)
 				});
 				wsToAgentId.set(ws, agentId);
 				if (regEntry.tokenId !== void 0 && regEntry.tokenExpiresAt !== void 0 && regEntry.tokenExpiresAt !== null) registry.scheduleExpiryKick(regEntry.tokenId, regEntry.tokenExpiresAt);
@@ -12192,7 +12793,8 @@ function createAgentWsHandler(deps) {
 						runningAsUser: msg.runningAsUser,
 						runningAsUid: msg.runningAsUid,
 						mandatoryLabels: existingEntry ? [...existingEntry.mandatoryLabels] : void 0,
-						scalerManaged: existingEntry?.scalerManaged ?? false
+						scalerManaged: existingEntry?.scalerManaged ?? false,
+						tokenAgentType: toLifecycleClass(reregisterAuthState?.tokenAgentType) ?? existingEntry?.tokenAgentType ?? null
 					});
 					wsToAgentId.set(ws, msg.agentId);
 					setAgentsActive(registry.getActiveCount());
@@ -13614,7 +14216,8 @@ var init_rbac = __esmMin((() => {
 * Shared error handler for admin route files.
 *
 * Handles common error types: RBAC permission denied, Zod validation,
-* PostgreSQL unique constraint violations, and generic errors.
+* PostgreSQL unique constraint violations, PostgreSQL invalid-text-representation
+* (malformed typed input → 400), and generic errors.
 */
 function handleAdminError(c, err, logger) {
 	if (err instanceof PermissionDeniedError) return c.json({ error: err.message }, 403);
@@ -13623,6 +14226,7 @@ function handleAdminError(c, err, logger) {
 		details: err.issues
 	}, 400);
 	if (err instanceof Error && "code" in err && err.code === "23505") return c.json({ error: "Conflict: resource already exists" }, 409);
+	if (err instanceof Error && "code" in err && err.code === "22P02") return c.json({ error: "Invalid request: malformed value for a typed field" }, 400);
 	logger.error("Admin API error", {
 		error: toErrorMessage(err),
 		stack: err instanceof Error ? err.stack : void 0
@@ -13865,10 +14469,10 @@ var init_admin_sources = __esmMin((() => {
 //#endregion
 //#region src/db/migrations/001_initial.ts
 var _001_initial_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$37,
-	up: () => up$37
+	down: () => down$41,
+	up: () => up$41
 });
-async function up$37(db) {
+async function up$41(db) {
 	for (const stmt of DDL_STATEMENTS) await sql.raw(stmt).execute(db);
 	await sql`
     INSERT INTO cluster_meta (key, value)
@@ -13890,7 +14494,7 @@ async function up$37(db) {
 * Rollback drops everything created above. Uses CASCADE on table drops to cut
 * through the FK graph without relying on exact topological order.
 */
-async function down$37(db) {
+async function down$41(db) {
 	for (const [trig, tbl] of [["source_secrets_change_trigger", "scoped_secrets"], ["sources_change_trigger", "sources"]]) await sql.raw(`DROP TRIGGER IF EXISTS ${trig} ON public.${tbl}`).execute(db);
 	for (const table of [
 		"workflow_registrations",
@@ -14610,8 +15214,8 @@ var init__001_initial = __esmMin((() => {
 //#endregion
 //#region src/db/migrations/002_config_versions_key_version.ts
 var _002_config_versions_key_version_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$36,
-	up: () => up$36
+	down: () => down$40,
+	up: () => up$40
 });
 /**
 * Add key_version column to config_versions so that sensitive-field encryption
@@ -14625,13 +15229,13 @@ var _002_config_versions_key_version_exports = /* @__PURE__ */ __exportAll({
 * No index is needed: rotation does a full-table scan; reads are by
 * `version` primary key and never filter on `key_version`.
 */
-async function up$36(db) {
+async function up$40(db) {
 	await sql`
     ALTER TABLE public.config_versions
       ADD COLUMN key_version integer NOT NULL DEFAULT 1
   `.execute(db);
 }
-async function down$36(db) {
+async function down$40(db) {
 	await sql`
     ALTER TABLE public.config_versions
       DROP COLUMN key_version
@@ -14641,8 +15245,8 @@ var init__002_config_versions_key_version = __esmMin((() => {}));
 //#endregion
 //#region src/db/migrations/003_access_log.ts
 var _003_access_log_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$35,
-	up: () => up$35
+	down: () => down$39,
+	up: () => up$39
 });
 /**
 * Access log: one row per read or orchestrator-admin mutation attributable
@@ -14666,7 +15270,7 @@ var _003_access_log_exports = /* @__PURE__ */ __exportAll({
 * Retention is TTL-based via expires_at; packages/orchestrator/src/queue/
 * cleanup.ts picks up the prune pass.
 */
-async function up$35(db) {
+async function up$39(db) {
 	await sql`
     CREATE TABLE public.access_log (
       id            UUID PRIMARY KEY DEFAULT gen_random_uuid(),
@@ -14704,21 +15308,21 @@ async function up$35(db) {
       ON public.access_log (actor_type, actor_id, created_at DESC)
   `.execute(db);
 }
-async function down$35(db) {
+async function down$39(db) {
 	await sql`DROP TABLE IF EXISTS public.access_log`.execute(db);
 }
 var init__003_access_log = __esmMin((() => {}));
 //#endregion
 //#region src/db/migrations/004_rename_bundle_to_source.ts
 var _004_rename_bundle_to_source_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$34,
-	up: () => up$34
+	down: () => down$38,
+	up: () => up$38
 });
-async function up$34(db) {
+async function up$38(db) {
 	await db.schema.alterTable("dispatch_queue").renameColumn("bundle_url", "source_tar_url").execute();
 	await db.schema.alterTable("dispatch_queue").renameColumn("bundle_hash", "source_tar_hash").execute();
 }
-async function down$34(db) {
+async function down$38(db) {
 	await db.schema.alterTable("dispatch_queue").renameColumn("source_tar_url", "bundle_url").execute();
 	await db.schema.alterTable("dispatch_queue").renameColumn("source_tar_hash", "bundle_hash").execute();
 }
@@ -14726,8 +15330,8 @@ var init__004_rename_bundle_to_source = __esmMin((() => {}));
 //#endregion
 //#region src/db/migrations/005_cold_store_chunk_counter.ts
 var _005_cold_store_chunk_counter_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$33,
-	up: () => up$33
+	down: () => down$37,
+	up: () => up$37
 });
 /**
 * Cold-store chunk counter table.
@@ -14744,7 +15348,7 @@ var _005_cold_store_chunk_counter_exports = /* @__PURE__ */ __exportAll({
 *
 * sections 5 and 8.
 */
-async function up$33(db) {
+async function up$37(db) {
 	await sql`
     CREATE TABLE public.cold_store_chunk_counts (
       db                TEXT        NOT NULL,
@@ -14762,15 +15366,15 @@ async function up$33(db) {
       ON public.cold_store_chunk_counts (db, table_name)
   `.execute(db);
 }
-async function down$33(db) {
+async function down$37(db) {
 	await sql`DROP TABLE IF EXISTS public.cold_store_chunk_counts`.execute(db);
 }
 var init__005_cold_store_chunk_counter = __esmMin((() => {}));
 //#endregion
 //#region src/db/migrations/006_runs_jobs_steps_archived_at.ts
 var _006_runs_jobs_steps_archived_at_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$32,
-	up: () => up$32
+	down: () => down$36,
+	up: () => up$36
 });
 /**
 * `execution_runs` / `execution_jobs` / `execution_steps` cold-store
@@ -14806,7 +15410,7 @@ var _006_runs_jobs_steps_archived_at_exports = /* @__PURE__ */ __exportAll({
 *   - `idx_execution_jobs_routing_key_created  (routing_key, created_at)`
 *   - `idx_execution_steps_routing_key_created (routing_key, created_at)`
 */
-async function up$32(db) {
+async function up$36(db) {
 	await sql`
     ALTER TABLE public.execution_runs
       ADD COLUMN archived_at         TIMESTAMPTZ NULL,
@@ -14851,7 +15455,7 @@ async function up$32(db) {
       ON public.execution_steps (routing_key, created_at)
   `.execute(db);
 }
-async function down$32(db) {
+async function down$36(db) {
 	await sql`DROP INDEX IF EXISTS public.idx_execution_steps_routing_key_created`.execute(db);
 	await sql`
     ALTER TABLE public.execution_steps
@@ -14877,8 +15481,8 @@ var init__006_runs_jobs_steps_archived_at = __esmMin((() => {}));
 //#endregion
 //#region src/db/migrations/007_audit_logs_archived_at.ts
 var _007_audit_logs_archived_at_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$31,
-	up: () => up$31
+	down: () => down$35,
+	up: () => up$35
 });
 /**
 * `secret_audit_log` and `access_log` cold-store schema additions, plus
@@ -14918,7 +15522,7 @@ var _007_audit_logs_archived_at_exports = /* @__PURE__ */ __exportAll({
 * `down()` would not have meaningful retention bounds. Acceptable for
 * staging.
 */
-async function up$31(db) {
+async function up$35(db) {
 	await sql`
     ALTER TABLE public.secret_audit_log
       ADD COLUMN archived_at         TIMESTAMPTZ NULL,
@@ -14939,7 +15543,7 @@ async function up$31(db) {
       DROP COLUMN IF EXISTS expires_at
   `.execute(db);
 }
-async function down$31(db) {
+async function down$35(db) {
 	await sql`
     ALTER TABLE public.access_log
       ADD COLUMN expires_at TIMESTAMPTZ NOT NULL DEFAULT (now() + INTERVAL '90 days')
@@ -14968,8 +15572,8 @@ var init__007_audit_logs_archived_at = __esmMin((() => {}));
 //#endregion
 //#region src/db/migrations/008_event_log_archived_at.ts
 var _008_event_log_archived_at_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$30,
-	up: () => up$30
+	down: () => down$34,
+	up: () => up$34
 });
 /**
 * `event_log` cold-store schema additions plus removal of the
@@ -15007,7 +15611,7 @@ var _008_event_log_archived_at_exports = /* @__PURE__ */ __exportAll({
 * — best effort; rows inserted between `up()` and a hypothetical
 * `down()` would not have meaningful retention bounds.
 */
-async function up$30(db) {
+async function up$34(db) {
 	await sql`
     ALTER TABLE public.event_log
       ADD COLUMN archived_at         TIMESTAMPTZ NULL,
@@ -15023,7 +15627,7 @@ async function up$30(db) {
       DROP COLUMN IF EXISTS expires_at
   `.execute(db);
 }
-async function down$30(db) {
+async function down$34(db) {
 	await sql`
     ALTER TABLE public.event_log
       ADD COLUMN expires_at TIMESTAMPTZ NOT NULL DEFAULT (now() + INTERVAL '30 days')
@@ -15043,8 +15647,8 @@ var init__008_event_log_archived_at = __esmMin((() => {}));
 //#endregion
 //#region src/db/migrations/009_access_log_trigram.ts
 var _009_access_log_trigram_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$29,
-	up: () => up$29
+	down: () => down$33,
+	up: () => up$33
 });
 /**
 * Trigram (pg_trgm) index on access_log.error_message for the federated
@@ -15057,7 +15661,7 @@ var _009_access_log_trigram_exports = /* @__PURE__ */ __exportAll({
 * EXISTS` are both safe to re-run. No CONCURRENTLY because Kysely runs
 * migrations inside a transaction; the lock is brief on a sampled table.
 */
-async function up$29(db) {
+async function up$33(db) {
 	await sql`CREATE EXTENSION IF NOT EXISTS pg_trgm`.execute(db);
 	await sql`
     CREATE INDEX IF NOT EXISTS access_log_error_message_trgm_idx
@@ -15066,15 +15670,15 @@ async function up$29(db) {
       WHERE error_message IS NOT NULL
   `.execute(db);
 }
-async function down$29(db) {
+async function down$33(db) {
 	await sql`DROP INDEX IF EXISTS public.access_log_error_message_trgm_idx`.execute(db);
 }
 var init__009_access_log_trigram = __esmMin((() => {}));
 //#endregion
 //#region src/db/migrations/010_cold_store_chunks.ts
 var _010_cold_store_chunks_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$28,
-	up: () => up$28
+	down: () => down$32,
+	up: () => up$32
 });
 /**
 * Cold-store chunk index — Phase 2 (cold-store purge).
@@ -15106,7 +15710,7 @@ var _010_cold_store_chunks_exports = /* @__PURE__ */ __exportAll({
 * forever. Adapters that don't opt into per-bucket archival via
 * `coldTtlDays` don't insert here either.
 */
-async function up$28(db) {
+async function up$32(db) {
 	await sql`
     CREATE TABLE public.cold_store_chunks (
       db              TEXT        NOT NULL,
@@ -15133,15 +15737,15 @@ async function up$28(db) {
       ON public.cold_store_chunks (db, table_name, tenant_id, archived_at DESC)
   `.execute(db);
 }
-async function down$28(db) {
+async function down$32(db) {
 	await sql`DROP TABLE IF EXISTS public.cold_store_chunks`.execute(db);
 }
 var init__010_cold_store_chunks = __esmMin((() => {}));
 //#endregion
 //#region src/db/migrations/011_drop_source_secrets_notify.ts
 var _011_drop_source_secrets_notify_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$27,
-	up: () => up$27
+	down: () => down$31,
+	up: () => up$31
 });
 /**
 * Drop the `source_secrets_change_trigger` and the
@@ -15160,11 +15764,11 @@ var _011_drop_source_secrets_notify_exports = /* @__PURE__ */ __exportAll({
 * in `001_initial.ts`. They wake up no consumer until the `WebhookSecretManager`
 * is restored, so this migration is safe to roll back.
 */
-async function up$27(db) {
+async function up$31(db) {
 	await sql`DROP TRIGGER IF EXISTS source_secrets_change_trigger ON public.scoped_secrets`.execute(db);
 	await sql`DROP FUNCTION IF EXISTS public.notify_source_secrets_change() CASCADE`.execute(db);
 }
-async function down$27(db) {
+async function down$31(db) {
 	await sql`
     CREATE OR REPLACE FUNCTION public.notify_source_secrets_change() RETURNS trigger
       LANGUAGE plpgsql
@@ -15204,8 +15808,8 @@ var init__011_drop_source_secrets_notify = __esmMin((() => {}));
 //#endregion
 //#region src/db/migrations/012_peer_credentials_active_uniq.ts
 var _012_peer_credentials_active_uniq_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$26,
-	up: () => up$26
+	down: () => down$30,
+	up: () => up$30
 });
 /**
 * Add a partial unique index on `peer_credentials (instance_id) WHERE
@@ -15231,7 +15835,7 @@ var _012_peer_credentials_active_uniq_exports = /* @__PURE__ */ __exportAll({
 * `down()` only drops the index; it does NOT undo the dedupe (there's no
 * safe way to recreate revoked rows, and the dedupe is monotonic).
 */
-async function up$26(db) {
+async function up$30(db) {
 	await sql`
     UPDATE public.peer_credentials
     SET revoked_at = NOW()
@@ -15249,15 +15853,15 @@ async function up$26(db) {
       WHERE revoked_at IS NULL
   `.execute(db);
 }
-async function down$26(db) {
+async function down$30(db) {
 	await sql`DROP INDEX IF EXISTS public.peer_credentials_active_uniq`.execute(db);
 }
 var init__012_peer_credentials_active_uniq = __esmMin((() => {}));
 //#endregion
 //#region src/db/migrations/013_execution_log_bytes.ts
 var _013_execution_log_bytes_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$25,
-	up: () => up$25
+	down: () => down$29,
+	up: () => up$29
 });
 /**
 * Add `log_bytes BIGINT NOT NULL DEFAULT 0` columns to `execution_runs` and
@@ -15276,7 +15880,7 @@ var _013_execution_log_bytes_exports = /* @__PURE__ */ __exportAll({
 *
 * Idempotent (`ADD COLUMN IF NOT EXISTS`).
 */
-async function up$25(db) {
+async function up$29(db) {
 	await sql`
     ALTER TABLE public.execution_runs
       ADD COLUMN IF NOT EXISTS log_bytes BIGINT NOT NULL DEFAULT 0
@@ -15286,7 +15890,7 @@ async function up$25(db) {
       ADD COLUMN IF NOT EXISTS log_bytes BIGINT NOT NULL DEFAULT 0
   `.execute(db);
 }
-async function down$25(db) {
+async function down$29(db) {
 	await sql`ALTER TABLE public.execution_runs DROP COLUMN IF EXISTS log_bytes`.execute(db);
 	await sql`ALTER TABLE public.execution_jobs DROP COLUMN IF EXISTS log_bytes`.execute(db);
 }
@@ -15294,8 +15898,8 @@ var init__013_execution_log_bytes = __esmMin((() => {}));
 //#endregion
 //#region src/db/migrations/014_kici_events_lease_retry.ts
 var _014_kici_events_lease_retry_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$24,
-	up: () => up$24
+	down: () => down$28,
+	up: () => up$28
 });
 /**
 * Add lease + retry + DLQ columns to `kici_events` so the EventRouter can
@@ -15329,7 +15933,7 @@ var _014_kici_events_lease_retry_exports = /* @__PURE__ */ __exportAll({
 *
 * Idempotent (`ADD COLUMN IF NOT EXISTS` + `CREATE INDEX IF NOT EXISTS`).
 */
-async function up$24(db) {
+async function up$28(db) {
 	await sql`
     ALTER TABLE public.kici_events
       ADD COLUMN IF NOT EXISTS claimed_at TIMESTAMPTZ,
@@ -15360,7 +15964,7 @@ async function up$24(db) {
       WHERE dlq_at IS NOT NULL
   `.execute(db);
 }
-async function down$24(db) {
+async function down$28(db) {
 	await sql`DROP INDEX IF EXISTS public.idx_kici_events_dlq`.execute(db);
 	await sql`DROP INDEX IF EXISTS public.idx_kici_events_lease_expired`.execute(db);
 	await sql`DROP INDEX IF EXISTS public.idx_kici_events_retry_due`.execute(db);
@@ -15379,8 +15983,8 @@ var init__014_kici_events_lease_retry = __esmMin((() => {}));
 //#endregion
 //#region src/db/migrations/015_org_settings_customer_scoped.ts
 var _015_org_settings_customer_scoped_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$23,
-	up: () => up$23
+	down: () => down$27,
+	up: () => up$27
 });
 /**
 * Org-scope `org_settings` and qualify each glob entry by source.
@@ -15408,7 +16012,7 @@ var _015_org_settings_customer_scoped_exports = /* @__PURE__ */ __exportAll({
 * Idempotent: a re-run on an already-migrated DB sees `customer_id` exists
 * and the list columns are already jsonb, so it is a no-op.
 */
-async function up$23(db) {
+async function up$27(db) {
 	if ((await sql`
     SELECT EXISTS (
       SELECT 1 FROM information_schema.columns
@@ -15533,7 +16137,7 @@ async function up$23(db) {
 	await sql`DROP TABLE _org_settings_merged`.execute(db);
 	await sql`DROP TABLE _org_settings_stage`.execute(db);
 }
-async function down$23(db) {
+async function down$27(db) {
 	if (!(await sql`
     SELECT EXISTS (
       SELECT 1 FROM information_schema.columns
@@ -15559,8 +16163,8 @@ var init__015_org_settings_customer_scoped = __esmMin((() => {}));
 //#endregion
 //#region src/db/migrations/016_org_settings_allow_http_npm.ts
 var _016_org_settings_allow_http_npm_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$22,
-	up: () => up$22
+	down: () => down$26,
+	up: () => up$26
 });
 /**
 * Add `org_settings.allow_http_npm_registries boolean NOT NULL DEFAULT false`.
@@ -15573,7 +16177,7 @@ var _016_org_settings_allow_http_npm_exports = /* @__PURE__ */ __exportAll({
 *
 * Idempotent: a re-run on a DB that already has the column is a no-op.
 */
-async function up$22(db) {
+async function up$26(db) {
 	if ((await sql`
     SELECT EXISTS (
       SELECT 1 FROM information_schema.columns
@@ -15587,7 +16191,7 @@ async function up$22(db) {
       ADD COLUMN allow_http_npm_registries boolean NOT NULL DEFAULT false
   `.execute(db);
 }
-async function down$22(db) {
+async function down$26(db) {
 	await sql`
     ALTER TABLE public.org_settings DROP COLUMN IF EXISTS allow_http_npm_registries
   `.execute(db);
@@ -15596,13 +16200,13 @@ var init__016_org_settings_allow_http_npm = __esmMin((() => {}));
 //#endregion
 //#region src/db/migrations/017_org_id_widen.ts
 var _017_org_id_widen_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$21,
-	up: () => up$21
+	down: () => down$25,
+	up: () => up$25
 });
-async function up$21(db) {
+async function up$25(db) {
 	for (const table of ORG_ID_TABLES$1) await sql.raw(`ALTER TABLE public.${table} ALTER COLUMN org_id TYPE varchar(16)`).execute(db);
 }
-async function down$21(db) {
+async function down$25(db) {
 	for (const table of ORG_ID_TABLES$1) await sql.raw(`ALTER TABLE public.${table} ALTER COLUMN org_id TYPE varchar(12)`).execute(db);
 }
 var ORG_ID_TABLES$1;
@@ -15621,14 +16225,14 @@ var init__017_org_id_widen = __esmMin((() => {
 //#endregion
 //#region src/db/migrations/018_org_id_prefix_backfill.ts
 var _018_org_id_prefix_backfill_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$20,
-	up: () => up$20
+	down: () => down$24,
+	up: () => up$24
 });
-async function up$20(db) {
+async function up$24(db) {
 	for (const table of ORG_ID_TABLES) await sql.raw(`UPDATE public.${table} SET org_id = 'org_' || org_id WHERE org_id <> 'kici-admin' AND org_id NOT LIKE 'org\\_%' ESCAPE '\\'`).execute(db);
 	for (const table of CUSTOMER_ID_TABLES) await sql.raw(`UPDATE public.${table} SET customer_id = 'org_' || customer_id WHERE customer_id <> 'kici-admin' AND customer_id NOT LIKE 'org\\_%' ESCAPE '\\'`).execute(db);
 }
-async function down$20(db) {
+async function down$24(db) {
 	for (const table of CUSTOMER_ID_TABLES) await sql.raw(`UPDATE public.${table} SET customer_id = substring(customer_id from 5) WHERE customer_id LIKE 'org\\_%' ESCAPE '\\'`).execute(db);
 	for (const table of ORG_ID_TABLES) await sql.raw(`UPDATE public.${table} SET org_id = substring(org_id from 5) WHERE org_id LIKE 'org\\_%' ESCAPE '\\'`).execute(db);
 }
@@ -15654,8 +16258,8 @@ var init__018_org_id_prefix_backfill = __esmMin((() => {
 //#endregion
 //#region src/db/migrations/019_generic_sources_change_notify.ts
 var _019_generic_sources_change_notify_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$19,
-	up: () => up$19
+	down: () => down$23,
+	up: () => up$23
 });
 /**
 * Add a Postgres trigger on `generic_webhook_sources` that emits
@@ -15678,7 +16282,7 @@ var _019_generic_sources_change_notify_exports = /* @__PURE__ */ __exportAll({
 * (`notify_sources_change()` + `sources_change_trigger`, defined in
 * `001_initial.ts`).
 */
-async function up$19(db) {
+async function up$23(db) {
 	await sql`
     CREATE FUNCTION public.notify_generic_sources_change() RETURNS trigger
       LANGUAGE plpgsql
@@ -15699,7 +16303,7 @@ async function up$19(db) {
       FOR EACH ROW EXECUTE FUNCTION public.notify_generic_sources_change()
   `.execute(db);
 }
-async function down$19(db) {
+async function down$23(db) {
 	await sql`DROP TRIGGER IF EXISTS generic_sources_change_trigger ON public.generic_webhook_sources`.execute(db);
 	await sql`DROP FUNCTION IF EXISTS public.notify_generic_sources_change()`.execute(db);
 }
@@ -15707,8 +16311,8 @@ var init__019_generic_sources_change_notify = __esmMin((() => {}));
 //#endregion
 //#region src/db/migrations/020_org_settings_dashboard_write_policy.ts
 var _020_org_settings_dashboard_write_policy_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$18,
-	up: () => up$18
+	down: () => down$22,
+	up: () => up$22
 });
 /**
 * Add `org_settings.dashboard_write_policy jsonb NOT NULL DEFAULT '{}'`.
@@ -15723,7 +16327,7 @@ var _020_org_settings_dashboard_write_policy_exports = /* @__PURE__ */ __exportA
 *
 * Idempotent: a re-run on a DB that already has the column is a no-op.
 */
-async function up$18(db) {
+async function up$22(db) {
 	if ((await sql`
     SELECT EXISTS (
       SELECT 1 FROM information_schema.columns
@@ -15737,7 +16341,7 @@ async function up$18(db) {
       ADD COLUMN dashboard_write_policy jsonb NOT NULL DEFAULT '{}'::jsonb
   `.execute(db);
 }
-async function down$18(db) {
+async function down$22(db) {
 	await sql`
     ALTER TABLE public.org_settings DROP COLUMN IF EXISTS dashboard_write_policy
   `.execute(db);
@@ -15746,8 +16350,8 @@ var init__020_org_settings_dashboard_write_policy = __esmMin((() => {}));
 //#endregion
 //#region src/db/migrations/021_check_run_tracking.ts
 var _021_check_run_tracking_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$17,
-	up: () => up$17
+	down: () => down$21,
+	up: () => up$21
 });
 /**
 * Add `check_run_tracking` table for HA-safe check-run state persistence.
@@ -15771,7 +16375,7 @@ var _021_check_run_tracking_exports = /* @__PURE__ */ __exportAll({
 *
 * Idempotent: a re-run on a DB that already has the table is a no-op.
 */
-async function up$17(db) {
+async function up$21(db) {
 	if ((await sql`
     SELECT EXISTS (
       SELECT 1 FROM information_schema.tables
@@ -15802,15 +16406,15 @@ async function up$17(db) {
       WHERE run_id IS NOT NULL
   `.execute(db);
 }
-async function down$17(db) {
+async function down$21(db) {
 	await sql`DROP TABLE IF EXISTS public.check_run_tracking`.execute(db);
 }
 var init__021_check_run_tracking = __esmMin((() => {}));
 //#endregion
 //#region src/db/migrations/022_scaler_manager_state.ts
 var _022_scaler_manager_state_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$16,
-	up: () => up$16
+	down: () => down$20,
+	up: () => up$20
 });
 /**
 * Add three tables persisting `ScalerManager` per-coord state:
@@ -15837,7 +16441,7 @@ var _022_scaler_manager_state_exports = /* @__PURE__ */ __exportAll({
 * Idempotent: a re-run on a DB that already has any of these tables
 * leaves the existing one alone.
 */
-async function up$16(db) {
+async function up$20(db) {
 	const tableExists = async (name) => {
 		return (await sql`
       SELECT EXISTS (
@@ -15887,7 +16491,7 @@ async function up$16(db) {
     `.execute(db);
 	}
 }
-async function down$16(db) {
+async function down$20(db) {
 	await sql`DROP TABLE IF EXISTS public.scaler_reservations`.execute(db);
 	await sql`DROP TABLE IF EXISTS public.scaler_agent_jobs`.execute(db);
 	await sql`DROP TABLE IF EXISTS public.scaler_spawning_agents`.execute(db);
@@ -15896,8 +16500,8 @@ var init__022_scaler_manager_state = __esmMin((() => {}));
 //#endregion
 //#region src/db/migrations/023_dispatch_queue_recovery_deadline.ts
 var _023_dispatch_queue_recovery_deadline_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$15,
-	up: () => up$15
+	down: () => down$19,
+	up: () => up$19
 });
 /**
 * Add `dispatch_queue.recovery_deadline TIMESTAMPTZ` and
@@ -15921,7 +16525,7 @@ var _023_dispatch_queue_recovery_deadline_exports = /* @__PURE__ */ __exportAll(
 * Idempotent: re-running on a DB that already has either column is a
 * no-op.
 */
-async function up$15(db) {
+async function up$19(db) {
 	const colExists = async (name) => {
 		return (await sql`
       SELECT EXISTS (
@@ -15946,7 +16550,7 @@ async function up$15(db) {
       WHERE recovery_deadline IS NOT NULL
   `.execute(db);
 }
-async function down$15(db) {
+async function down$19(db) {
 	await sql`DROP INDEX IF EXISTS public.idx_dispatch_queue_recovery_deadline`.execute(db);
 	await sql`
     ALTER TABLE public.dispatch_queue DROP COLUMN IF EXISTS recovery_agent_id
@@ -15959,8 +16563,8 @@ var init__023_dispatch_queue_recovery_deadline = __esmMin((() => {}));
 //#endregion
 //#region src/db/migrations/024_dispatch_queue_provisioning_error.ts
 var _024_dispatch_queue_provisioning_error_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$14,
-	up: () => up$14
+	down: () => down$18,
+	up: () => up$18
 });
 /**
 * Add `dispatch_queue.last_provisioning_error TEXT` recording the most
@@ -15976,7 +16580,7 @@ var _024_dispatch_queue_provisioning_error_exports = /* @__PURE__ */ __exportAll
 *
 * Idempotent: re-running on a DB that already has the column is a no-op.
 */
-async function up$14(db) {
+async function up$18(db) {
 	const colExists = async (name) => {
 		return (await sql`
       SELECT EXISTS (
@@ -15992,7 +16596,7 @@ async function up$14(db) {
         ADD COLUMN last_provisioning_error TEXT
     `.execute(db);
 }
-async function down$14(db) {
+async function down$18(db) {
 	await sql`
     ALTER TABLE public.dispatch_queue DROP COLUMN IF EXISTS last_provisioning_error
   `.execute(db);
@@ -16001,8 +16605,8 @@ var init__024_dispatch_queue_provisioning_error = __esmMin((() => {}));
 //#endregion
 //#region src/db/migrations/025_init_failure.ts
 var _025_init_failure_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$13,
-	up: () => up$13
+	down: () => down$17,
+	up: () => up$17
 });
 /**
 * Add `init_failure jsonb` columns to `execution_runs` and `execution_jobs`.
@@ -16016,7 +16620,7 @@ var _025_init_failure_exports = /* @__PURE__ */ __exportAll({
 * Idempotent: re-running on a DB that already has either column is a no-op
 * for that column.
 */
-async function up$13(db) {
+async function up$17(db) {
 	const colExists = async (table, name) => {
 		return (await sql`
       SELECT EXISTS (
@@ -16036,7 +16640,7 @@ async function up$13(db) {
         ADD COLUMN init_failure JSONB DEFAULT NULL
     `.execute(db);
 }
-async function down$13(db) {
+async function down$17(db) {
 	await sql`
     ALTER TABLE public.execution_jobs DROP COLUMN IF EXISTS init_failure
   `.execute(db);
@@ -16048,8 +16652,8 @@ var init__025_init_failure = __esmMin((() => {}));
 //#endregion
 //#region src/db/migrations/026_event_log_lockfile_corrupt.ts
 var _026_event_log_lockfile_corrupt_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$12,
-	up: () => up$12
+	down: () => down$16,
+	up: () => up$16
 });
 /**
 * Extend the event_log.status CHECK constraint with 'lockfile_corrupt' so the
@@ -16058,7 +16662,7 @@ var _026_event_log_lockfile_corrupt_exports = /* @__PURE__ */ __exportAll({
 *
 * Idempotent: the DROP ... IF EXISTS / re-ADD pair re-runs cleanly.
 */
-async function up$12(db) {
+async function up$16(db) {
 	await sql`ALTER TABLE event_log DROP CONSTRAINT IF EXISTS event_log_status_check`.execute(db);
 	await sql`
     ALTER TABLE event_log ADD CONSTRAINT event_log_status_check
@@ -16068,7 +16672,7 @@ async function up$12(db) {
     ])))
   `.execute(db);
 }
-async function down$12(db) {
+async function down$16(db) {
 	await sql`ALTER TABLE event_log DROP CONSTRAINT IF EXISTS event_log_status_check`.execute(db);
 	await sql`
     ALTER TABLE event_log ADD CONSTRAINT event_log_status_check
@@ -16082,8 +16686,8 @@ var init__026_event_log_lockfile_corrupt = __esmMin((() => {}));
 //#endregion
 //#region src/db/migrations/027_workflow_timeout.ts
 var _027_workflow_timeout_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$11,
-	up: () => up$11
+	down: () => down$15,
+	up: () => up$15
 });
 /**
 * Add `workflow_timeout_ms integer` to `execution_runs`.
@@ -16101,13 +16705,13 @@ var _027_workflow_timeout_exports = /* @__PURE__ */ __exportAll({
 *
 * Idempotent: re-running on a DB that already has the column is a no-op.
 */
-async function up$11(db) {
+async function up$15(db) {
 	await sql`
     ALTER TABLE public.execution_runs
       ADD COLUMN IF NOT EXISTS workflow_timeout_ms INTEGER DEFAULT NULL
   `.execute(db);
 }
-async function down$11(db) {
+async function down$15(db) {
 	await sql`
     ALTER TABLE public.execution_runs DROP COLUMN IF EXISTS workflow_timeout_ms
   `.execute(db);
@@ -16116,8 +16720,8 @@ var init__027_workflow_timeout = __esmMin((() => {}));
 //#endregion
 //#region src/db/migrations/028_org_settings_user_cache.ts
 var _028_org_settings_user_cache_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$10,
-	up: () => up$10
+	down: () => down$14,
+	up: () => up$14
 });
 /**
 * Add `org_settings.user_cache_quota_bytes bigint` and
@@ -16146,7 +16750,7 @@ async function columnExists(db, column) {
     ) AS exists
   `.execute(db)).rows[0]?.exists ?? false;
 }
-async function up$10(db) {
+async function up$14(db) {
 	if (!await columnExists(db, "user_cache_quota_bytes")) await sql`
       ALTER TABLE public.org_settings
         ADD COLUMN user_cache_quota_bytes bigint
@@ -16156,7 +16760,7 @@ async function up$10(db) {
         ADD COLUMN user_cache_ttl_ms bigint
     `.execute(db);
 }
-async function down$10(db) {
+async function down$14(db) {
 	await sql`
     ALTER TABLE public.org_settings DROP COLUMN IF EXISTS user_cache_quota_bytes
   `.execute(db);
@@ -16168,8 +16772,8 @@ var init__028_org_settings_user_cache = __esmMin((() => {}));
 //#endregion
 //#region src/db/migrations/029_dispatch_queue_attempts.ts
 var _029_dispatch_queue_attempts_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$9,
-	up: () => up$9
+	down: () => down$13,
+	up: () => up$13
 });
 /**
 * Add `dispatch_queue.dispatch_attempts INT NOT NULL DEFAULT 0`.
@@ -16183,7 +16787,7 @@ var _029_dispatch_queue_attempts_exports = /* @__PURE__ */ __exportAll({
 *
 * Idempotent: re-running on a DB that already has the column is a no-op.
 */
-async function up$9(db) {
+async function up$13(db) {
 	if (!((await sql`
     SELECT EXISTS (
       SELECT 1 FROM information_schema.columns
@@ -16196,7 +16800,7 @@ async function up$9(db) {
         ADD COLUMN dispatch_attempts INT NOT NULL DEFAULT 0
     `.execute(db);
 }
-async function down$9(db) {
+async function down$13(db) {
 	await sql`
     ALTER TABLE public.dispatch_queue DROP COLUMN IF EXISTS dispatch_attempts
   `.execute(db);
@@ -16205,8 +16809,8 @@ var init__029_dispatch_queue_attempts = __esmMin((() => {}));
 //#endregion
 //#region src/db/migrations/030_held_runs_env_set_null.ts
 var _030_held_runs_env_set_null_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$8,
-	up: () => up$8
+	down: () => down$12,
+	up: () => up$12
 });
 /**
 * held_runs.environment_id becomes nullable with ON DELETE SET NULL so
@@ -16217,14 +16821,14 @@ var _030_held_runs_env_set_null_exports = /* @__PURE__ */ __exportAll({
 * Idempotent: dropping the NOT NULL and the constraint are both no-ops on a
 * re-run, and the constraint is re-created with the SET NULL action.
 */
-async function up$8(db) {
+async function up$12(db) {
 	await sql`ALTER TABLE public.held_runs ALTER COLUMN environment_id DROP NOT NULL`.execute(db);
 	await sql`ALTER TABLE public.held_runs DROP CONSTRAINT IF EXISTS held_runs_environment_id_fkey`.execute(db);
 	await sql`ALTER TABLE public.held_runs
     ADD CONSTRAINT held_runs_environment_id_fkey
     FOREIGN KEY (environment_id) REFERENCES public.environments(id) ON DELETE SET NULL`.execute(db);
 }
-async function down$8(db) {
+async function down$12(db) {
 	await sql`ALTER TABLE public.held_runs DROP CONSTRAINT IF EXISTS held_runs_environment_id_fkey`.execute(db);
 	await sql`ALTER TABLE public.held_runs
     ADD CONSTRAINT held_runs_environment_id_fkey
@@ -16235,8 +16839,8 @@ var init__030_held_runs_env_set_null = __esmMin((() => {}));
 //#endregion
 //#region src/db/migrations/031_dispatch_queue_ack_deadline.ts
 var _031_dispatch_queue_ack_deadline_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$7,
-	up: () => up$7
+	down: () => down$11,
+	up: () => up$11
 });
 /**
 * Add `dispatch_queue.ack_deadline TIMESTAMPTZ` and
@@ -16253,7 +16857,7 @@ var _031_dispatch_queue_ack_deadline_exports = /* @__PURE__ */ __exportAll({
 *
 * Idempotent: re-running on a DB that already has either column is a no-op.
 */
-async function up$7(db) {
+async function up$11(db) {
 	const colExists = async (name) => {
 		return (await sql`
       SELECT EXISTS (
@@ -16278,7 +16882,7 @@ async function up$7(db) {
       WHERE ack_deadline IS NOT NULL
   `.execute(db);
 }
-async function down$7(db) {
+async function down$11(db) {
 	await sql`DROP INDEX IF EXISTS public.idx_dispatch_queue_ack_deadline`.execute(db);
 	await sql`ALTER TABLE public.dispatch_queue DROP COLUMN IF EXISTS ack_agent_id`.execute(db);
 	await sql`ALTER TABLE public.dispatch_queue DROP COLUMN IF EXISTS ack_deadline`.execute(db);
@@ -16287,8 +16891,8 @@ var init__031_dispatch_queue_ack_deadline = __esmMin((() => {}));
 //#endregion
 //#region src/db/migrations/032_org_settings_dispatch_ack_timeout.ts
 var _032_org_settings_dispatch_ack_timeout_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$6,
-	up: () => up$6
+	down: () => down$10,
+	up: () => up$10
 });
 /**
 * Add `org_settings.dispatch_ack_timeout_ms BIGINT` (nullable).
@@ -16300,7 +16904,7 @@ var _032_org_settings_dispatch_ack_timeout_exports = /* @__PURE__ */ __exportAll
 *
 * Idempotent: a re-run on a DB that already has the column is a no-op.
 */
-async function up$6(db) {
+async function up$10(db) {
 	if ((await sql`
     SELECT EXISTS (
       SELECT 1 FROM information_schema.columns
@@ -16314,7 +16918,7 @@ async function up$6(db) {
       ADD COLUMN dispatch_ack_timeout_ms BIGINT
   `.execute(db);
 }
-async function down$6(db) {
+async function down$10(db) {
 	await sql`
     ALTER TABLE public.org_settings DROP COLUMN IF EXISTS dispatch_ack_timeout_ms
   `.execute(db);
@@ -16323,8 +16927,8 @@ var init__032_org_settings_dispatch_ack_timeout = __esmMin((() => {}));
 //#endregion
 //#region src/db/migrations/033_org_settings_approval.ts
 var _033_org_settings_approval_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$5,
-	up: () => up$5
+	down: () => down$9,
+	up: () => up$9
 });
 /**
 * Add the two approval-policy columns to `org_settings`:
@@ -16341,7 +16945,7 @@ var _033_org_settings_approval_exports = /* @__PURE__ */ __exportAll({
 * and the orchestrator admin route. Idempotent: a re-run on a DB that already
 * has the columns is a no-op (each column is guarded independently).
 */
-async function up$5(db) {
+async function up$9(db) {
 	const colExists = async (column) => {
 		return (await sql`
       SELECT EXISTS (
@@ -16361,7 +16965,7 @@ async function up$5(db) {
         ADD COLUMN allow_self_approval BOOLEAN NOT NULL DEFAULT true
     `.execute(db);
 }
-async function down$5(db) {
+async function down$9(db) {
 	await sql`
     ALTER TABLE public.org_settings DROP COLUMN IF EXISTS approval_expiry_seconds
   `.execute(db);
@@ -16373,8 +16977,8 @@ var init__033_org_settings_approval = __esmMin((() => {}));
 //#endregion
 //#region src/db/migrations/034_held_runs_generalize.ts
 var _034_held_runs_generalize_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$4,
-	up: () => up$4
+	down: () => down$8,
+	up: () => up$8
 });
 /**
 * Generalize `held_runs` from an environment-only hold into the unified
@@ -16396,7 +17000,7 @@ var _034_held_runs_generalize_exports = /* @__PURE__ */ __exportAll({
 * New `held_run_approvals` table: one row per approver decision, FK to
 * `held_runs.id` (uuid) with ON DELETE CASCADE.
 */
-async function up$4(db) {
+async function up$8(db) {
 	const colExists = async (column) => {
 		return (await sql`
       SELECT EXISTS (
@@ -16429,7 +17033,7 @@ async function up$4(db) {
       ON public.held_run_approvals USING btree (held_run_id)
   `.execute(db);
 }
-async function down$4(db) {
+async function down$8(db) {
 	await sql`DROP TABLE IF EXISTS public.held_run_approvals`.execute(db);
 	await sql`ALTER TABLE public.held_runs DROP COLUMN IF EXISTS approval_requirement`.execute(db);
 	await sql`ALTER TABLE public.held_runs DROP COLUMN IF EXISTS trigger_source`.execute(db);
@@ -16440,8 +17044,8 @@ var init__034_held_runs_generalize = __esmMin((() => {}));
 //#endregion
 //#region src/db/migrations/035_pending_workflow_contexts.ts
 var _035_pending_workflow_contexts_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$3,
-	up: () => up$3
+	down: () => down$7,
+	up: () => up$7
 });
 /**
 * Pending workflow dispatch context — backs resume of a workflow whose install
@@ -16450,7 +17054,7 @@ var _035_pending_workflow_contexts_exports = /* @__PURE__ */ __exportAll({
 * wait-timer expiry, concurrency slot free). The row is deleted once the resume
 * dispatch has been kicked off.
 */
-async function up$3(db) {
+async function up$7(db) {
 	await sql`
     CREATE TABLE IF NOT EXISTS public.pending_workflow_contexts (
       run_id     text PRIMARY KEY,
@@ -16460,15 +17064,15 @@ async function up$3(db) {
     )
   `.execute(db);
 }
-async function down$3(db) {
+async function down$7(db) {
 	await sql`DROP TABLE IF EXISTS public.pending_workflow_contexts`.execute(db);
 }
 var init__035_pending_workflow_contexts = __esmMin((() => {}));
 //#endregion
 //#region src/db/migrations/036_attestations.ts
 var _036_attestations_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$2,
-	up: () => up$2
+	down: () => down$6,
+	up: () => up$6
 });
 /**
 * Add the `attestations` table for build-provenance bundles.
@@ -16481,7 +17085,7 @@ var _036_attestations_exports = /* @__PURE__ */ __exportAll({
 *
 * Idempotent: a re-run on a DB that already has the table is a no-op.
 */
-async function up$2(db) {
+async function up$6(db) {
 	if ((await sql`
     SELECT EXISTS (
       SELECT 1 FROM information_schema.tables
@@ -16507,15 +17111,15 @@ async function up$2(db) {
       ON public.attestations (run_id, job_id)
   `.execute(db);
 }
-async function down$2(db) {
+async function down$6(db) {
 	await sql`DROP TABLE IF EXISTS public.attestations`.execute(db);
 }
 var init__036_attestations = __esmMin((() => {}));
 //#endregion
 //#region src/db/migrations/037_generic_sources_provider_type_local.ts
 var _037_generic_sources_provider_type_local_exports = /* @__PURE__ */ __exportAll({
-	down: () => down$1,
-	up: () => up$1
+	down: () => down$5,
+	up: () => up$5
 });
 /**
 * Replace the `generic_webhook_sources.provider_type` CHECK constraint so it
@@ -16532,7 +17136,7 @@ var _037_generic_sources_provider_type_local_exports = /* @__PURE__ */ __exportA
 * Idempotent: the constraint is dropped IF EXISTS and recreated; the data
 * backfill is a plain UPDATE that is a no-op once no `'internal'` rows remain.
 */
-async function up$1(db) {
+async function up$5(db) {
 	await sql`
     ALTER TABLE public.generic_webhook_sources
       DROP CONSTRAINT IF EXISTS generic_webhook_sources_provider_type_check
@@ -16548,7 +17152,7 @@ async function up$1(db) {
       CHECK (provider_type = ANY (ARRAY['generic'::text, 'local'::text]))
   `.execute(db);
 }
-async function down$1(db) {
+async function down$5(db) {
 	await sql`
     ALTER TABLE public.generic_webhook_sources
       DROP CONSTRAINT IF EXISTS generic_webhook_sources_provider_type_check
@@ -16568,8 +17172,8 @@ var init__037_generic_sources_provider_type_local = __esmMin((() => {}));
 //#endregion
 //#region src/db/migrations/038_remote_sources.ts
 var _038_remote_sources_exports = /* @__PURE__ */ __exportAll({
-	down: () => down,
-	up: () => up
+	down: () => down$4,
+	up: () => up$4
 });
 /**
 * `remote_sources` anchors a Platform-relayed `kici run remote` to its real
@@ -16581,7 +17185,7 @@ var _038_remote_sources_exports = /* @__PURE__ */ __exportAll({
 *
 * Idempotent: a re-run on a DB that already has the table is a no-op.
 */
-async function up(db) {
+async function up$4(db) {
 	if ((await sql`
     SELECT EXISTS (
       SELECT 1 FROM information_schema.tables
@@ -16600,11 +17204,205 @@ async function up(db) {
     )
   `.execute(db);
 }
-async function down(db) {
+async function down$4(db) {
 	await sql`DROP TABLE IF EXISTS public.remote_sources`.execute(db);
 }
 var init__038_remote_sources = __esmMin((() => {}));
 //#endregion
+//#region src/db/migrations/039_host_roster.ts
+var _039_host_roster_exports = /* @__PURE__ */ __exportAll({
+	down: () => down$3,
+	up: () => up$3
+});
+/**
+* `host_roster` is KiCI's declared inventory: one durable row per agent the
+* cluster has ever enrolled, reconciled from the in-memory AgentRegistry on
+* every register/unregister. `lifecycle_class` (snapshot of the auth token's
+* agent_type) drives reaping — `ephemeral` rows are GC'd past their TTL,
+* `static` rows persist and read as `unreachable` when their heartbeat goes
+* stale. `connected_instance_id` records which orchestrator holds the live WS
+* (cluster liveness + the host-fanout reroute target); NULL = disconnected.
+*
+* The roster lives in the shared cluster DB (one table, all instances). Status
+* is derived at read from the shared `last_seen` + `connected_instance_id`, so
+* every instance agrees regardless of which one holds the agent's live WS.
+*
+* Idempotent: a re-run on a DB that already has the table is a no-op.
+*/
+async function up$3(db) {
+	if ((await sql`
+    SELECT EXISTS (
+      SELECT 1 FROM information_schema.tables
+       WHERE table_schema = 'public' AND table_name = 'host_roster'
+    ) AS exists
+  `.execute(db)).rows[0]?.exists) return;
+	await sql`
+    CREATE TABLE public.host_roster (
+      id                    uuid DEFAULT gen_random_uuid() NOT NULL,
+      agent_id              text NOT NULL,
+      token_id              uuid,
+      lifecycle_class       text NOT NULL,
+      labels                text NOT NULL DEFAULT '[]',
+      hostname              text,
+      platform              text,
+      arch                  text,
+      connected_instance_id text,
+      last_seen             timestamptz NOT NULL DEFAULT now(),
+      created_at            timestamptz NOT NULL DEFAULT now(),
+      updated_at            timestamptz NOT NULL DEFAULT now(),
+      CONSTRAINT host_roster_pkey PRIMARY KEY (id),
+      CONSTRAINT host_roster_agent_id_key UNIQUE (agent_id),
+      CONSTRAINT host_roster_lifecycle_class_check
+        CHECK (lifecycle_class = ANY (ARRAY['static'::text, 'ephemeral'::text]))
+    )
+  `.execute(db);
+	await sql`CREATE INDEX idx_host_roster_reap
+              ON public.host_roster (lifecycle_class, last_seen)`.execute(db);
+}
+async function down$3(db) {
+	await sql`DROP TABLE IF EXISTS public.host_roster`.execute(db);
+}
+var init__039_host_roster = __esmMin((() => {}));
+//#endregion
+//#region src/db/migrations/040_runsonall_pin.ts
+var _040_runsonall_pin_exports = /* @__PURE__ */ __exportAll({
+	down: () => down$2,
+	up: () => up$2
+});
+/**
+* Add the `runsOnAll` host fan-out columns:
+*
+* - `dispatch_queue.pinned_agent_id TEXT` — when set, the queued/dispatched job
+*   targets exactly that agent (a host-fanout child). The dispatcher routes it
+*   only to that agent; the queue drain never hands it to a different one.
+* - `execution_jobs.base_job_name` / `variant_kind` / `variant_label` — generic
+*   fan-out columns (matrix + host uniform). `variant_kind` is `'matrix'` or
+*   `'host'`; `variant_label` is the matrix suffix or the hostname. They make the
+*   logical fan-out job first-class server-side so the dashboard groups on real
+*   fields instead of string-parsing the job name. (`matrix_values` / `group_name`
+*   already exist; the matrix path now also backfills `variant_kind='matrix'`.)
+*
+* Idempotent: re-running on a DB that already has any column is a no-op.
+*/
+async function colExists$2(db, table, name) {
+	return (await sql`
+    SELECT EXISTS (
+      SELECT 1 FROM information_schema.columns
+       WHERE table_schema = 'public'
+         AND table_name = ${table}
+         AND column_name = ${name}
+    ) AS exists
+  `.execute(db)).rows[0]?.exists ?? false;
+}
+async function up$2(db) {
+	if (!await colExists$2(db, "dispatch_queue", "pinned_agent_id")) await sql`ALTER TABLE public.dispatch_queue ADD COLUMN pinned_agent_id TEXT`.execute(db);
+	if (!await colExists$2(db, "execution_jobs", "base_job_name")) await sql`ALTER TABLE public.execution_jobs ADD COLUMN base_job_name TEXT`.execute(db);
+	if (!await colExists$2(db, "execution_jobs", "variant_kind")) await sql`ALTER TABLE public.execution_jobs ADD COLUMN variant_kind TEXT`.execute(db);
+	if (!await colExists$2(db, "execution_jobs", "variant_label")) await sql`ALTER TABLE public.execution_jobs ADD COLUMN variant_label TEXT`.execute(db);
+	await sql`
+    CREATE INDEX IF NOT EXISTS idx_dispatch_queue_pinned_agent
+      ON public.dispatch_queue (pinned_agent_id)
+      WHERE pinned_agent_id IS NOT NULL
+  `.execute(db);
+}
+async function down$2(db) {
+	await sql`DROP INDEX IF EXISTS public.idx_dispatch_queue_pinned_agent`.execute(db);
+	await sql`ALTER TABLE public.dispatch_queue DROP COLUMN IF EXISTS pinned_agent_id`.execute(db);
+	await sql`ALTER TABLE public.execution_jobs DROP COLUMN IF EXISTS variant_label`.execute(db);
+	await sql`ALTER TABLE public.execution_jobs DROP COLUMN IF EXISTS variant_kind`.execute(db);
+	await sql`ALTER TABLE public.execution_jobs DROP COLUMN IF EXISTS base_job_name`.execute(db);
+}
+var init__040_runsonall_pin = __esmMin((() => {}));
+//#endregion
+//#region src/db/migrations/041_wave_gated.ts
+var _041_wave_gated_exports = /* @__PURE__ */ __exportAll({
+	down: () => down$1,
+	up: () => up$1
+});
+/**
+* Add the rolling fan-out wave-gate columns:
+*
+* - `execution_jobs.wave_gated boolean NOT NULL DEFAULT false` — when a fan-out
+*   job declares `maxParallel`, children beyond the sliding window are persisted
+*   `wave_gated=true` (held, not enqueued). The dispatch loop skips them; the
+*   wave-scheduler clears the flag one-per-terminal as siblings complete (or, on
+*   `failFast`, skips the held remainder).
+* - `execution_jobs.wave_max_parallel int` / `wave_fail_fast boolean` — the
+*   base's wave policy, stamped on every fan-out child so the wave-scheduler can
+*   read it at terminal time without re-fetching the lock file (the tracker has
+*   no lock access). NULL for any job not part of a bounded wave.
+*
+* A composite index on (run_id, base_job_name, wave_gated) supports the
+* wave-scheduler's "next held sibling of this base" lookups.
+*
+* Idempotent: re-running on a DB that already has the columns is a no-op.
+*/
+async function colExists$1(db, table, name) {
+	return (await sql`
+    SELECT EXISTS (
+      SELECT 1 FROM information_schema.columns
+       WHERE table_schema = 'public'
+         AND table_name = ${table}
+         AND column_name = ${name}
+    ) AS exists
+  `.execute(db)).rows[0]?.exists ?? false;
+}
+async function up$1(db) {
+	if (!await colExists$1(db, "execution_jobs", "wave_gated")) await sql`ALTER TABLE public.execution_jobs ADD COLUMN wave_gated boolean NOT NULL DEFAULT false`.execute(db);
+	if (!await colExists$1(db, "execution_jobs", "wave_max_parallel")) await sql`ALTER TABLE public.execution_jobs ADD COLUMN wave_max_parallel integer`.execute(db);
+	if (!await colExists$1(db, "execution_jobs", "wave_fail_fast")) await sql`ALTER TABLE public.execution_jobs ADD COLUMN wave_fail_fast boolean`.execute(db);
+	await sql`
+    CREATE INDEX IF NOT EXISTS idx_execution_jobs_wave
+      ON public.execution_jobs (run_id, base_job_name, wave_gated)
+  `.execute(db);
+}
+async function down$1(db) {
+	await sql`DROP INDEX IF EXISTS public.idx_execution_jobs_wave`.execute(db);
+	await sql`ALTER TABLE public.execution_jobs DROP COLUMN IF EXISTS wave_fail_fast`.execute(db);
+	await sql`ALTER TABLE public.execution_jobs DROP COLUMN IF EXISTS wave_max_parallel`.execute(db);
+	await sql`ALTER TABLE public.execution_jobs DROP COLUMN IF EXISTS wave_gated`.execute(db);
+}
+var init__041_wave_gated = __esmMin((() => {}));
+//#endregion
+//#region src/db/migrations/042_dispatch_queue_patterns.ts
+var _042_dispatch_queue_patterns_exports = /* @__PURE__ */ __exportAll({
+	down: () => down,
+	up: () => up
+});
+/**
+* Add pattern columns to dispatch_queue. Exact labels stay in runs_on_labels /
+* exclude_labels (the SQL @> prefilter); regex matchers go here and are applied
+* as a JS post-filter at drain time, since Postgres `~` regex semantics differ
+* from JavaScript `RegExp` and the engine's `matcherSatisfiedBy` is the single
+* matching authority.
+*
+* - `runs_on_patterns jsonb NOT NULL DEFAULT '[]'` — regex matchers the agent's
+*   labels must satisfy.
+* - `exclude_patterns jsonb NOT NULL DEFAULT '[]'` — regex matchers that
+*   disqualify an agent.
+*
+* Idempotent: re-running on a DB that already has the columns is a no-op.
+*/
+async function colExists(db, table, name) {
+	return (await sql`
+    SELECT EXISTS (
+      SELECT 1 FROM information_schema.columns
+       WHERE table_schema = 'public'
+         AND table_name = ${table}
+         AND column_name = ${name}
+    ) AS exists
+  `.execute(db)).rows[0]?.exists ?? false;
+}
+async function up(db) {
+	if (!await colExists(db, "dispatch_queue", "runs_on_patterns")) await sql`ALTER TABLE public.dispatch_queue ADD COLUMN runs_on_patterns jsonb NOT NULL DEFAULT '[]'::jsonb`.execute(db);
+	if (!await colExists(db, "dispatch_queue", "exclude_patterns")) await sql`ALTER TABLE public.dispatch_queue ADD COLUMN exclude_patterns jsonb NOT NULL DEFAULT '[]'::jsonb`.execute(db);
+}
+async function down(db) {
+	await sql`ALTER TABLE public.dispatch_queue DROP COLUMN IF EXISTS exclude_patterns`.execute(db);
+	await sql`ALTER TABLE public.dispatch_queue DROP COLUMN IF EXISTS runs_on_patterns`.execute(db);
+}
+var init__042_dispatch_queue_patterns = __esmMin((() => {}));
+//#endregion
 //#region src/db/migration-provider.ts
 function createMigrationProvider() {
 	return { async getMigrations() {
@@ -16646,7 +17444,11 @@ function createMigrationProvider() {
 			"035_pending_workflow_contexts": _035_pending_workflow_contexts_exports,
 			"036_attestations": _036_attestations_exports,
 			"037_generic_sources_provider_type_local": _037_generic_sources_provider_type_local_exports,
-			"038_remote_sources": _038_remote_sources_exports
+			"038_remote_sources": _038_remote_sources_exports,
+			"039_host_roster": _039_host_roster_exports,
+			"040_runsonall_pin": _040_runsonall_pin_exports,
+			"041_wave_gated": _041_wave_gated_exports,
+			"042_dispatch_queue_patterns": _042_dispatch_queue_patterns_exports
 		};
 	} };
 }
@@ -16689,6 +17491,10 @@ var init_migration_provider = __esmMin((() => {
 	init__036_attestations();
 	init__037_generic_sources_provider_type_local();
 	init__038_remote_sources();
+	init__039_host_roster();
+	init__040_runsonall_pin();
+	init__041_wave_gated();
+	init__042_dispatch_queue_patterns();
 }));
 //#endregion
 //#region src/db/migrator.ts
@@ -22739,15 +23545,15 @@ var init_admin_config = __esmMin((() => {
 function createHealthRoutes$1(deps = {}) {
 	return createHealthRoutes({
 		livenessInfo: () => ({
-			version: "0.1.17",
-			buildDate: "2026-06-14T11:18:19.818Z",
-			buildCommit: "5596f8a3c",
-			sdkVersion: "0.1.17",
-			sdkBundleHash: "df47ed5db86eaaa2de8394c0db08335f368e8d620a898cc409765f4545eb3972",
-			sharedVersion: "0.1.17",
-			sharedBundleHash: "9e8a753da73b26fb87d08817f70b4d836f67f599385fa268b2c1f68b97996f54",
-			engineVersion: "0.1.17",
-			engineBundleHash: "706d94fa54a47aea0f69bde105d40213befff401f717604aded2c62a1291cb51"
+			version: "0.1.18",
+			buildDate: "2026-06-17T09:57:52.557Z",
+			buildCommit: "d8cff38bb",
+			sdkVersion: "0.1.18",
+			sdkBundleHash: "8308089347c304e41b457d3867b17bbff11d6b5cd9706b6823e7abdbd849f33f",
+			sharedVersion: "0.1.18",
+			sharedBundleHash: "5f2c220f24d166b0f13d0620a2e80d19689ac8b683a12154daef44e938fd46a7",
+			engineVersion: "0.1.18",
+			engineBundleHash: "79ce14640d1798eaaa7cb3aa6c4bc325da3bff1e9f4716936e19614eabb1d858"
 		}),
 		readinessCheck: deps.db ? async () => {
 			const checks = {};
@@ -22781,7 +23587,7 @@ function createCapabilitiesRoutes() {
 	const app = new Hono();
 	app.get("/api/v1/capabilities", (c) => {
 		const manifest = {
-			orchestratorVersion: "0.1.17",
+			orchestratorVersion: "0.1.18",
 			protocolVersion: PROTOCOL_VERSION,
 			minProtocolVersion: MIN_PROTOCOL_VERSION
 		};
@@ -24987,8 +25793,9 @@ function chooseTargetPlatform(workflow, agentRegistry) {
 		targetPlatform,
 		targetArch
 	};
-	const firstRunsOn = workflow.jobs.filter(isLockStaticJob)[0]?.runsOn ?? "default";
-	const representativeLabels = workflow.jobs.length > 0 ? Array.isArray(firstRunsOn) ? [...firstRunsOn] : [firstRunsOn] : ["default"];
+	const firstJob = workflow.jobs.filter(isLockStaticJob)[0];
+	const firstExact = partitionMatchers(firstJob?.runsOn ?? []).exact;
+	const representativeLabels = workflow.jobs.length > 0 ? firstExact.length > 0 ? firstExact : ["default"] : ["default"];
 	const candidates = agentRegistry.findAvailable(representativeLabels);
 	if (candidates.length > 0) {
 		targetPlatform = candidates[0].platform;
@@ -25279,12 +26086,112 @@ async function readPostBuildCacheUrls(args) {
 * other jobs still proceed. Dynamic-matrix jobs pass through with a
 * `pendingDynamicMatrix` marker for the eval flow.
 */
-function materializeStaticJobsSafe(staticJobs) {
+/**
+* Resolve a `runsOnAll` lock job against the declared host roster and partition
+* the matched hosts into the target set per the `onUnreachable` policy (R2):
+* `ready` hosts always run; unreachable durable (`static`) hosts hold / fail /
+* skip; stale ephemeral hosts are always skipped. Throws {@link FanoutError}
+* when the run can't proceed (fail policy with an absent host, or zero targets).
+*/
+async function resolveHostFanoutTargets(lockJob, deps) {
+	if (!deps.hostRosterStore) throw new FanoutError(lockJob.name, `runsOnAll for job '${lockJob.name}': roster unavailable`);
+	const predicate = lockJob.runsOnAll;
+	const onUnreachable = lockJob.onUnreachable ?? "hold";
+	const matched = await deps.hostRosterStore.findMatching(predicate.include, predicate.exclude, deps.rosterGraceMs ?? 3e5);
+	const targets = [];
+	const unreachableDurable = [];
+	for (const h of matched) if (h.status === "ready") targets.push(h);
+	else if (h.lifecycleClass === "ephemeral") continue;
+	else unreachableDurable.push(h);
+	if (unreachableDurable.length > 0) {
+		if (onUnreachable === "fail") throw new FanoutError(lockJob.name, `runsOnAll '${lockJob.name}': ${unreachableDurable.length} expected host(s) unreachable`);
+		if (onUnreachable === "hold") targets.push(...unreachableDurable);
+	}
+	if (targets.length === 0) throw new FanoutError(lockJob.name, `runsOnAll '${lockJob.name}' matched zero usable hosts`);
+	return targets.map((h) => ({
+		agentId: h.agentId,
+		host: h.host,
+		labels: h.labels,
+		platform: h.platform ?? void 0,
+		arch: h.arch ?? void 0,
+		connectedInstanceId: h.connectedInstanceId
+	}));
+}
+/**
+* Partition a lock job's runsOn / excludeLabels matchers into exact labels (SQL
+* `@>` prefilter + registry index) and regex patterns (JS post-filter). A
+* `runsOnAll` host-fanout job has no `runsOn`; its pinned children carry no
+* routing (the pin targets the resolved agent directly).
+*/
+function runsOnSelectorsForLockJob(lockJob) {
+	const include = partitionMatchers(lockJob.runsOn ?? []);
+	const exclude = partitionMatchers(lockJob.excludeLabels ?? []);
+	return {
+		runsOnLabels: include.exact,
+		runsOnPatterns: include.regex,
+		excludeLabels: exclude.exact,
+		excludePatterns: exclude.regex
+	};
+}
+/**
+* The generic fan-out tracking fields persisted on `execution_jobs` for a
+* materialized child: `baseJobName` + `variantKind` + `variantLabel`. Serves
+* matrix (label = combination suffix) and host (label = hostname) uniformly so
+* the dashboard groups on real columns instead of string-parsing the name.
+*/
+function variantTrackingFields(mat) {
+	if (!mat.variantKind) return {};
+	const variantLabel = mat.variantKind === VariantKind.host ? mat.host : mat.variantValues ? mat.expandedName.slice(mat.baseName.length + 2, -1) : void 0;
+	return {
+		baseJobName: mat.baseName,
+		variantKind: mat.variantKind,
+		...variantLabel && { variantLabel }
+	};
+}
+/**
+* Compute the rolling-wave plan for a materialized job set.
+*
+* For each base job declaring `maxParallel` whose fan-out produced more than one
+* child, children are ordered deterministically by `variant_label` (the matrix
+* suffix / hostname, via `expandedName`) and every child at index `>=
+* maxParallel` is held (`wave_gated=true`). The first `maxParallel` dispatch
+* immediately; held children release one-per-terminal via the wave-scheduler.
+* Every child of a bounded-wave base — held or not — gets a `policy` entry so
+* the wave-scheduler can read the width/failFast at terminal time. A non-fan-out
+* job (single child) or one without `maxParallel` contributes nothing.
+*/
+function computeWavePlan(materializedJobs) {
+	const byBase = /* @__PURE__ */ new Map();
+	for (const mat of materializedJobs) {
+		const list = byBase.get(mat.baseName);
+		if (list) list.push(mat);
+		else byBase.set(mat.baseName, [mat]);
+	}
+	const held = /* @__PURE__ */ new Set();
+	const policy = /* @__PURE__ */ new Map();
+	for (const children of byBase.values()) {
+		const maxParallel = children[0]?.lockJob.maxParallel;
+		if (maxParallel === void 0 || children.length <= 1) continue;
+		const failFast = children[0]?.lockJob.failFast ?? false;
+		[...children].sort((a, b) => a.expandedName.localeCompare(b.expandedName)).forEach((mat, i) => {
+			policy.set(mat.expandedName, {
+				maxParallel,
+				failFast
+			});
+			if (i >= maxParallel) held.add(mat.expandedName);
+		});
+	}
+	return {
+		held,
+		policy
+	};
+}
+async function materializeStaticJobsSafe(staticJobs, deps) {
 	const materializedJobs = [];
 	const expansionMap = /* @__PURE__ */ new Map();
 	const matrixFailures = [];
 	for (const lockJob of staticJobs) try {
-		const result = materializeFanout([lockJob]);
+		const result = lockJob.runsOnAll ? materializeResolvedHosts(lockJob, await resolveHostFanoutTargets(lockJob, deps), deps.maxFanoutHosts ?? 1024) : materializeFanout([lockJob]);
 		materializedJobs.push(...result.jobs);
 		for (const [k, v] of result.expansionMap) expansionMap.set(k, v);
 	} catch (err) {
@@ -25428,7 +26335,7 @@ async function prepareCacheAndBuild(ctx, setup) {
 		}
 	}
 	if (!contentHash && deps.sourceCache) logger$38.debug("Workflow missing contentHash, agents will compile from source", { workflow: workflow.name });
-	const { materializedJobs, expansionMap, matrixFailures } = materializeStaticJobsSafe(staticJobs);
+	const { materializedJobs, expansionMap, matrixFailures } = await materializeStaticJobsSafe(staticJobs, deps);
 	return {
 		sourceTarUrl,
 		sourceTarHash,
@@ -25903,6 +26810,13 @@ function makeBuildJobConfig(args) {
 			name: mat.expandedName,
 			baseJobName: mat.baseName,
 			...mat.variantValues && { matrixValues: mat.variantValues },
+			...mat.host && { host: mat.host },
+			...mat.agent && { agent: {
+				host: mat.agent.host,
+				labels: [...mat.agent.labels],
+				...mat.agent.platform && { platform: mat.agent.platform },
+				...mat.agent.arch && { arch: mat.agent.arch }
+			} },
 			steps: lockJob.steps,
 			needs: lockJob.needs,
 			rules: lockJob.rules,
@@ -25931,15 +26845,17 @@ function makeBuildJobConfig(args) {
 * single-orch paths).
 */
 function buildExecutionJobInput(args) {
-	const { ctx, setup, buildPrep, buildJobConfig, mat, runsOnLabels, excludeLabels } = args;
+	const { ctx, setup, buildPrep, buildJobConfig, mat, selectors } = args;
 	const lockJob = mat.lockJob;
 	const { workflow, bundle, repoIdentifier, credentials, event, ref, runId } = ctx;
 	return {
 		runId,
 		workflowName: workflow.name,
 		jobName: mat.expandedName,
-		runsOnLabels,
-		excludeLabels,
+		runsOnLabels: selectors.runsOnLabels,
+		runsOnPatterns: selectors.runsOnPatterns,
+		excludeLabels: selectors.excludeLabels,
+		excludePatterns: selectors.excludePatterns,
 		jobConfig: buildJobConfig(mat),
 		repoUrl: bundle.repoUrlBuilder?.buildCloneUrl(repoIdentifier) ?? "",
 		ref: event.sourceBranch ?? event.targetBranch,
@@ -25953,7 +26869,9 @@ function buildExecutionJobInput(args) {
 		depsUrl: buildPrep.depsUrl,
 		depsHash: buildPrep.depsHash,
 		requestId: getRequestContext().requestId,
-		...lockJob.resources && { resources: lockJob.resources }
+		...lockJob.resources && { resources: lockJob.resources },
+		...mat.pinnedAgentId && { pinnedAgentId: mat.pinnedAgentId },
+		...mat.connectedInstanceId !== void 0 && { connectedInstanceId: mat.connectedInstanceId }
 	};
 }
 /**
@@ -25967,7 +26885,8 @@ async function holdJobForApproval(args) {
 	const { ctx, setup, buildPrep, buildJobConfig, mat, envData, dispatchedJobs } = args;
 	const lockJob = mat.lockJob;
 	const { deps, workflow, runId } = ctx;
-	const runsOnLabels = Array.isArray(lockJob.runsOn) ? [...lockJob.runsOn] : [lockJob.runsOn];
+	const selectors = runsOnSelectorsForLockJob(lockJob);
+	const runsOnLabels = selectors.runsOnLabels;
 	const hold = envData.approvalHold;
 	if (!hold || !deps.heldRunStore || !deps.db) {
 		logger$38.info("Job held by protection rules", {
@@ -25983,8 +26902,7 @@ async function holdJobForApproval(args) {
 		buildPrep,
 		buildJobConfig,
 		mat,
-		runsOnLabels,
-		excludeLabels: lockJob._type === "static" && lockJob.excludeLabels ? [...lockJob.excludeLabels] : void 0
+		selectors
 	});
 	const heldRow = await deps.heldRunStore.createHold(ctx.resolvedOrgId, {
 		runId,
@@ -26072,15 +26990,15 @@ async function preRegisterNonRootJobs(args) {
 	const { deps, workflow, runId } = ctx;
 	for (const gated of needsGatedJobs) {
 		const gatedJob = gated.lockJob;
-		const runsOnLabels = Array.isArray(gatedJob.runsOn) ? [...gatedJob.runsOn] : [gatedJob.runsOn];
+		const selectors = runsOnSelectorsForLockJob(gatedJob);
+		const runsOnLabels = selectors.runsOnLabels;
 		const jobInput = buildExecutionJobInput({
 			ctx,
 			setup,
 			buildPrep,
 			buildJobConfig,
 			mat: gated,
-			runsOnLabels,
-			excludeLabels: gatedJob._type === "static" && gatedJob.excludeLabels ? [...gatedJob.excludeLabels] : void 0
+			selectors
 		});
 		await storePendingJobContext(deps.db, runId, gated.expandedName, {
 			jobInput,
@@ -26139,9 +27057,12 @@ async function clusterRouteRootJobs(args) {
 	};
 	const jobsToRoute = rootDispatchableJobs.map((mj) => {
 		const j = mj.lockJob;
+		const sel = runsOnSelectorsForLockJob(j);
 		return {
 			jobName: mj.expandedName,
-			runsOnLabels: [Array.isArray(j.runsOn) ? [...j.runsOn] : [j.runsOn]],
+			runsOnLabels: [sel.runsOnLabels],
+			runsOnPatterns: sel.runsOnPatterns,
+			excludePatterns: sel.excludePatterns,
 			jobConfig: buildJobConfig(mj),
 			repoUrl: bundle.repoUrlBuilder?.buildCloneUrl(repoIdentifier) ?? "",
 			ref: event.sourceBranch ?? event.targetBranch,
@@ -26150,7 +27071,7 @@ async function clusterRouteRootJobs(args) {
 			sourceTarHash: buildPrep.sourceTarHash,
 			depsUrl: buildPrep.depsUrl,
 			depsHash: buildPrep.depsHash,
-			excludeLabels: j._type === "static" && j.excludeLabels ? [...j.excludeLabels] : void 0,
+			excludeLabels: sel.excludeLabels,
 			...j.resources ? { resources: j.resources } : {}
 		};
 	});
@@ -26174,6 +27095,8 @@ async function clusterRouteRootJobs(args) {
 				workflowName: workflow.name,
 				jobName: jtr.jobName,
 				runsOnLabels: flatLabels,
+				runsOnPatterns: jtr.runsOnPatterns,
+				excludePatterns: jtr.excludePatterns,
 				excludeLabels: jtr.excludeLabels,
 				jobConfig: jtr.jobConfig,
 				repoUrl: jtr.repoUrl,
@@ -26253,6 +27176,15 @@ async function clusterRouteRootJobs(args) {
 async function dispatchSingleOrchPath(args) {
 	const { ctx, setup, buildPrep, buildJobConfig, jobEnvironmentData, dispatchedJobs, rejectedJobs } = args;
 	const { deps, workflow, runId } = ctx;
+	const wavePlan = computeWavePlan(buildPrep.materializedJobs);
+	/** The wave-policy fields persisted on a bounded-wave child's execution_jobs row. */
+	const wavePolicyFields = (name) => {
+		const p = wavePlan.policy.get(name);
+		return p ? {
+			waveMaxParallel: p.maxParallel,
+			waveFailFast: p.failFast
+		} : {};
+	};
 	for (const mat of buildPrep.materializedJobs) {
 		const lockJob = mat.lockJob;
 		const matrixValues = mat.variantValues;
@@ -26279,16 +27211,16 @@ async function dispatchSingleOrchPath(args) {
 			continue;
 		}
 		if (envData?.pendingInit) continue;
-		const runsOnLabels = Array.isArray(lockJob.runsOn) ? [...lockJob.runsOn] : [lockJob.runsOn];
-		const excludeLabels = lockJob._type === "static" && lockJob.excludeLabels ? [...lockJob.excludeLabels] : void 0;
+		const selectors = runsOnSelectorsForLockJob(lockJob);
+		const runsOnLabels = selectors.runsOnLabels;
+		const excludeLabels = selectors.excludeLabels;
 		const jobInput = buildExecutionJobInput({
 			ctx,
 			setup,
 			buildPrep,
 			buildJobConfig,
 			mat,
-			runsOnLabels,
-			excludeLabels
+			selectors
 		});
 		if (!isRootJob(lockJob)) {
 			await storePendingJobContext(deps.db, runId, mat.expandedName, {
@@ -26300,6 +27232,7 @@ async function dispatchSingleOrchPath(args) {
 				jobId: syntheticId,
 				jobName: mat.expandedName,
 				...matrixValues && { matrixValues },
+				...variantTrackingFields(mat),
 				runsOnLabels
 			});
 			logger$38.info("Job gated by needs scheduler (not dispatched yet)", {
@@ -26309,6 +27242,29 @@ async function dispatchSingleOrchPath(args) {
 			});
 			continue;
 		}
+		if (wavePlan.held.has(mat.expandedName)) {
+			await storePendingJobContext(deps.db, runId, mat.expandedName, {
+				jobInput,
+				runsOnLabels
+			});
+			const syntheticId = `needs-pending-${mat.expandedName}-${randomUUID()}`;
+			dispatchedJobs.push({
+				jobId: syntheticId,
+				jobName: mat.expandedName,
+				...matrixValues && { matrixValues },
+				...variantTrackingFields(mat),
+				...wavePolicyFields(mat.expandedName),
+				runsOnLabels,
+				waveGated: true
+			});
+			logger$38.info("Fan-out child held by rolling wave (maxParallel)", {
+				runId,
+				workflow: workflow.name,
+				job: mat.expandedName,
+				maxParallel: lockJob.maxParallel
+			});
+			continue;
+		}
 		const result = await setup.dispatcher.dispatch(jobInput);
 		if (result.status === "rejected") {
 			const syntheticId = `rejected-${randomUUID()}`;
@@ -26316,6 +27272,8 @@ async function dispatchSingleOrchPath(args) {
 				jobId: syntheticId,
 				jobName: mat.expandedName,
 				...matrixValues && { matrixValues },
+				...variantTrackingFields(mat),
+				...wavePolicyFields(mat.expandedName),
 				runsOnLabels
 			});
 			rejectedJobs.push({
@@ -26334,6 +27292,8 @@ async function dispatchSingleOrchPath(args) {
 			jobId: result.jobId,
 			jobName: mat.expandedName,
 			...matrixValues && { matrixValues },
+			...variantTrackingFields(mat),
+			...wavePolicyFields(mat.expandedName),
 			runsOnLabels
 		});
 		logger$38.info("Job dispatched", {
@@ -26505,22 +27465,24 @@ async function dispatchExecutionAfterInit(args) {
 	const lockJob = mat.lockJob;
 	const matrixValues = mat.variantValues;
 	const { deps, workflow, repoIdentifier, credentials, event, ref, runId, bundle } = ctx;
-	const runsOnLabels = Array.isArray(lockJob.runsOn) ? [...lockJob.runsOn] : [lockJob.runsOn];
-	const excludeLabels = lockJob.excludeLabels ? [...lockJob.excludeLabels] : void 0;
+	const selectors = runsOnSelectorsForLockJob(lockJob);
+	const runsOnLabels = selectors.runsOnLabels;
+	const excludeLabels = selectors.excludeLabels;
 	const jobInput = buildExecutionJobInput({
 		ctx,
 		setup,
 		buildPrep,
 		buildJobConfig,
 		mat,
-		runsOnLabels,
-		excludeLabels
+		selectors
 	});
 	let dispatchStatus;
 	if (deps.coordinator && deps.coordinator.hasConnectedPeers()) {
 		const jobToRoute = {
 			jobName: mat.expandedName,
 			runsOnLabels: [runsOnLabels],
+			runsOnPatterns: selectors.runsOnPatterns,
+			excludePatterns: selectors.excludePatterns,
 			jobConfig: buildJobConfig(mat),
 			repoUrl: bundle.repoUrlBuilder?.buildCloneUrl(repoIdentifier) ?? "",
 			ref: event.sourceBranch ?? event.targetBranch,
@@ -26716,7 +27678,7 @@ function startDeferredInitDispatch(args) {
 						jobId,
 						jobName: mat.expandedName,
 						...mat.variantValues && { matrixValues: mat.variantValues },
-						runsOnLabels: Array.isArray(lockJob.runsOn) ? [...lockJob.runsOn] : [lockJob.runsOn]
+						runsOnLabels: runsOnSelectorsForLockJob(lockJob).runsOnLabels
 					}]).catch(() => {});
 					const carried = err instanceof AgentJobFailedError ? err.initFailure : void 0;
 					await deps.executionTracker.onJobStatus(runId, jobId, ExecutionJobStatus.enum.failed, Date.now(), void 0, {
@@ -26734,14 +27696,15 @@ function startDeferredInitDispatch(args) {
 	}
 }
 async function dispatchEvalJob(args) {
-	const { ctx, setup, buildPrep, dynamicEntry } = args;
+	const { ctx, setup, buildPrep, dynamicEntry, upstreamSnapshot } = args;
 	const { deps, workflow, repoIdentifier, credentials, event, ref, runId, bundle } = ctx;
 	const evalJobName = `__dynamic__${workflow.name}__${dynamicEntry.source.index}`;
 	logger$38.info("Dispatching dynamic eval job", {
 		runId,
 		workflow: workflow.name,
 		evalJob: evalJobName,
-		sourceIndex: dynamicEntry.source.index
+		sourceIndex: dynamicEntry.source.index,
+		resultAware: !!upstreamSnapshot
 	});
 	const evalJobInput = {
 		runId,
@@ -26759,7 +27722,12 @@ async function dispatchEvalJob(args) {
 			event,
 			timeoutMs: 12e4,
 			...workflow.contentHash && { contentHash: workflow.contentHash },
-			...workflow.resolvedHashFiles?.length && { resolvedHashFiles: workflow.resolvedHashFiles }
+			...workflow.resolvedHashFiles?.length && { resolvedHashFiles: workflow.resolvedHashFiles },
+			...upstreamSnapshot && {
+				resultAware: true,
+				declaredNeeds: dynamicEntry.needs ?? [],
+				upstreamSnapshot
+			}
 		},
 		repoUrl: bundle.repoUrlBuilder?.buildCloneUrl(repoIdentifier) ?? "",
 		ref: event.sourceBranch ?? event.targetBranch,
@@ -26774,38 +27742,65 @@ async function dispatchEvalJob(args) {
 		depsUrl: buildPrep.depsUrl,
 		depsHash: buildPrep.depsHash
 	};
+	const replaceSyntheticId = upstreamSnapshot && deps.executionTracker ? await deps.executionTracker.findDynamicEvalSyntheticId(runId, evalJobName) : void 0;
 	const evalResult = await setup.dispatcher.dispatch(evalJobInput);
 	if (evalResult.status !== "dispatched" && evalResult.status !== "queued") throw new Error(`Dynamic eval job dispatch rejected: ${evalResult.status}`);
-	if (deps.executionTracker) await deps.executionTracker.addJobsToRun(runId, [{
-		jobId: evalResult.jobId,
-		jobName: evalJobName,
-		runsOnLabels: evalJobInput.runsOnLabels
-	}]);
 	return {
 		evalJobId: evalResult.jobId,
-		evalJobLabels: evalJobInput.runsOnLabels
+		evalJobLabels: evalJobInput.runsOnLabels,
+		evalJobName,
+		replaceSyntheticId,
+		runsOnLabels: evalJobInput.runsOnLabels
 	};
 }
 /**
 * Resolve env/secrets per generated job and build their job configs.
 * Skips jobs that fail individual secret resolution.
 */
+/**
+* Records a dropped generated-job matrix as a `matrix_expansion` init failure so
+* the run's dashboard surfaces it, mirroring the static / top-level dynamic-matrix
+* paths. A no-op when the run has no execution tracker.
+*/
+async function recordGeneratedMatrixFailure(deps, runId, err) {
+	if (!deps.executionTracker) return;
+	const jobId = `matrix-failed-${randomUUID()}`;
+	await deps.executionTracker.addJobsToRun(runId, [{
+		jobId,
+		jobName: err.jobName,
+		runsOnLabels: []
+	}]).catch(() => {});
+	await deps.executionTracker.onJobStatus(runId, jobId, ExecutionJobStatus.enum.failed, Date.now(), void 0, {
+		error: err.message,
+		initFailure: {
+			scope: "job",
+			category: InitFailureCategory.enum.matrix_expansion,
+			message: err.message,
+			jobName: err.jobName
+		}
+	}).catch(() => {});
+}
 async function resolveGeneratedJobConfigs(args) {
-	const { ctx, workflow, fullLockFile, resolvedSecrets, resolvedNamespacedSecrets, runPublicKeyBase64, npmRegistries, installEnvSecrets, generatedJobs, dynamicEntry } = args;
+	const { ctx, workflow, fullLockFile, resolvedSecrets, resolvedNamespacedSecrets, runPublicKeyBase64, npmRegistries, installEnvSecrets, generatedJobs, dynamicEntry, upstreamSnapshot } = args;
 	const { deps, runId, resolvedOrgId, event } = ctx;
 	const out = [];
 	let fanout;
-	try {
-		fanout = materializeFanout(generatedJobs);
+	const remaining = [...generatedJobs];
+	for (;;) try {
+		fanout = materializeFanout(remaining);
+		break;
 	} catch (err) {
-		if (err instanceof FanoutError) {
-			logger$38.error("Dynamic generated job matrix materialization failed", {
-				runId,
-				job: err.jobName,
-				error: err.message
-			});
-			fanout = materializeFanout(generatedJobs.filter((j) => j.name !== err.jobName));
-		} else throw err;
+		if (!(err instanceof FanoutError)) throw err;
+		logger$38.error("Dynamic generated job matrix materialization failed", {
+			runId,
+			job: err.jobName,
+			error: err.message
+		});
+		await recordGeneratedMatrixFailure(deps, runId, err);
+		const before = remaining.length;
+		const idx = remaining.findIndex((j) => j.name === err.jobName);
+		if (idx >= 0) remaining.splice(idx, 1);
+		if (remaining.length === before) throw err;
 	}
 	const expectedJobNames = [...new Set(fanout.jobs.map((m) => m.baseName))];
 	const expandNeeds = (needs) => {
@@ -26883,9 +27878,14 @@ async function resolveGeneratedJobConfigs(args) {
 				dynamicSource: {
 					index: dynamicEntry.source.index,
 					event,
-					expectedJobNames
+					expectedJobNames,
+					...upstreamSnapshot && {
+						upstreamSnapshot,
+						declaredNeeds: dynamicEntry.needs ?? []
+					}
 				}
 			};
+			const genSel = runsOnSelectorsForLockJob(genJob);
 			out.push({
 				genJob: {
 					...genJob,
@@ -26893,7 +27893,10 @@ async function resolveGeneratedJobConfigs(args) {
 					needs: expandedNeeds
 				},
 				genJobConfig,
-				runsOnLabels: Array.isArray(genJob.runsOn) ? [...genJob.runsOn] : [genJob.runsOn],
+				runsOnLabels: genSel.runsOnLabels,
+				runsOnPatterns: genSel.runsOnPatterns,
+				excludeLabels: genSel.excludeLabels,
+				excludePatterns: genSel.excludePatterns,
 				...envelope.matrixValues && { matrixValues: envelope.matrixValues }
 			});
 		} catch (err) {
@@ -26924,13 +27927,15 @@ async function gateAndStoreNonRootGeneratedJobs(args) {
 		if_failed: need.ifFailed ?? "skip"
 	});
 	if (gatedEdgeRows.length > 0) await deps.db.insertInto("execution_job_needs").values(gatedEdgeRows).onConflict((oc) => oc.doNothing()).execute();
-	for (const { genJob, genJobConfig, runsOnLabels, matrixValues } of gatedGeneratedConfigs) {
+	for (const { genJob, genJobConfig, runsOnLabels, runsOnPatterns, excludeLabels, excludePatterns, matrixValues } of gatedGeneratedConfigs) {
 		const gatedJobInput = {
 			runId,
 			workflowName: workflow.name,
 			jobName: genJob.name,
 			runsOnLabels,
-			excludeLabels: genJob.excludeLabels ? [...genJob.excludeLabels] : void 0,
+			runsOnPatterns,
+			excludeLabels,
+			excludePatterns,
 			jobConfig: genJobConfig,
 			repoUrl: bundle.repoUrlBuilder?.buildCloneUrl(repoIdentifier) ?? "",
 			ref: event.sourceBranch ?? event.targetBranch,
@@ -26967,13 +27972,15 @@ async function gateAndStoreNonRootGeneratedJobs(args) {
 async function directDispatchGeneratedJobs(args) {
 	const { ctx, setup, buildPrep, configs } = args;
 	const { deps, workflow, repoIdentifier, credentials, event, ref, runId, bundle } = ctx;
-	for (const { genJob, genJobConfig, runsOnLabels, matrixValues } of configs) try {
+	for (const { genJob, genJobConfig, runsOnLabels, runsOnPatterns, excludeLabels, excludePatterns, matrixValues } of configs) try {
 		const genJobInput = {
 			runId,
 			workflowName: workflow.name,
 			jobName: genJob.name,
 			runsOnLabels,
-			excludeLabels: genJob.excludeLabels ? [...genJob.excludeLabels] : void 0,
+			runsOnPatterns,
+			excludeLabels,
+			excludePatterns,
 			jobConfig: genJobConfig,
 			repoUrl: bundle.repoUrlBuilder?.buildCloneUrl(repoIdentifier) ?? "",
 			ref: event.sourceBranch ?? event.targetBranch,
@@ -27012,9 +28019,11 @@ async function routeRootGeneratedJobs(args) {
 	const { ctx, setup, buildPrep, rootGeneratedConfigs } = args;
 	const { deps, workflow, repoIdentifier, credentials, event, ref, runId, bundle } = ctx;
 	if (rootGeneratedConfigs.length === 0) return;
-	const generatedJobsToRoute = rootGeneratedConfigs.map(({ genJob, genJobConfig, runsOnLabels }) => ({
+	const generatedJobsToRoute = rootGeneratedConfigs.map(({ genJob, genJobConfig, runsOnLabels, runsOnPatterns, excludeLabels, excludePatterns }) => ({
 		jobName: genJob.name,
 		runsOnLabels: [runsOnLabels],
+		runsOnPatterns,
+		excludePatterns,
 		jobConfig: genJobConfig,
 		repoUrl: bundle.repoUrlBuilder?.buildCloneUrl(repoIdentifier) ?? "",
 		ref: event.sourceBranch ?? event.targetBranch,
@@ -27023,7 +28032,7 @@ async function routeRootGeneratedJobs(args) {
 		sourceTarHash: buildPrep.contentHash || void 0,
 		depsUrl: buildPrep.depsUrl,
 		depsHash: buildPrep.depsHash,
-		excludeLabels: genJob.excludeLabels ? [...genJob.excludeLabels] : void 0,
+		excludeLabels,
 		...genJob.resources ? { resources: genJob.resources } : {}
 	}));
 	if (!(deps.coordinator && deps.coordinator.hasConnectedPeers())) {
@@ -27216,18 +28225,140 @@ async function recomputeAndDispatchReady(args) {
 		if (skipJobRow) await deps.executionTracker.onJobStatus(runId, skipJobRow.job_id, ExecutionJobStatus.enum.skipped, Date.now(), void 0, { error: result.reason });
 	}
 }
+/**
+* Split a result-aware generator's declared needs into static/named upstream job
+* names and dynamic-group names. Reuses the same normalized lock edge shapes the
+* static-job `needs` serializer produces.
+*/
+function splitDeclaredNeeds(needs) {
+	const jobNames = [];
+	const groupNames = [];
+	for (const need of needs ?? []) if (typeof need === "string") jobNames.push(need);
+	else if ("group" in need) groupNames.push(need.group);
+	else if ("name" in need) jobNames.push(need.name);
+	return {
+		jobNames,
+		groupNames
+	};
+}
+/**
+* Register a result-aware generator's eval job as a deferred, needs-gated DAG
+* job: insert a synthetic pending execution_jobs row plus its execution_job_needs
+* edges, so the existing scheduler gates the eval exactly like any other job.
+* Group needs expand to their member job names (members already carry group_name
+* from setGroupNameAndResolveEdges on the group's own eval completion).
+*/
+async function registerDeferredEvalJob(args) {
+	const { ctx, evalJobName, dynamicEntry } = args;
+	const { deps, runId } = ctx;
+	if (!deps.db) return;
+	const { jobNames, groupNames } = splitDeclaredNeeds(dynamicEntry.needs);
+	const groupMembers = [];
+	for (const groupName of groupNames) {
+		const members = await deps.db.selectFrom("execution_jobs").select("job_name").where("run_id", "=", runId).where("group_name", "=", groupName).execute();
+		for (const m of members) groupMembers.push(m.job_name);
+	}
+	const upstreamNames = [...new Set([...jobNames, ...groupMembers])];
+	const ifFailedByName = /* @__PURE__ */ new Map();
+	for (const need of dynamicEntry.needs ?? []) if (typeof need === "object" && "name" in need) ifFailedByName.set(need.name, need.ifFailed ?? "skip");
+	const groupIfFailed = /* @__PURE__ */ new Map();
+	for (const need of dynamicEntry.needs ?? []) if (typeof need === "object" && "group" in need) groupIfFailed.set(need.group, need.ifFailed ?? "skip");
+	const syntheticId = `dynamic-eval-pending-${evalJobName}-${randomUUID()}`;
+	if (deps.executionTracker) await deps.executionTracker.addJobsToRun(runId, [{
+		jobId: syntheticId,
+		jobName: evalJobName,
+		runsOnLabels: []
+	}]);
+	const edgeRows = upstreamNames.map((upstreamName) => ({
+		run_id: runId,
+		job_name: evalJobName,
+		upstream_name: upstreamName,
+		if_failed: ifFailedByName.get(upstreamName) ?? [...groupIfFailed.values()][0] ?? "skip"
+	}));
+	if (edgeRows.length > 0) await deps.db.insertInto("execution_job_needs").values(edgeRows).onConflict((oc) => oc.doNothing()).execute();
+	logger$38.info("Registered deferred result-aware eval job", {
+		runId,
+		evalJob: evalJobName,
+		upstreams: upstreamNames
+	});
+	const results = await recomputeNeedsSatisfied(deps.db, runId, [evalJobName]);
+	for (const result of results) if (result.action === "dispatch" && deps.executionTracker?.onJobReadyCallback) await deps.executionTracker.onJobReadyCallback(runId, evalJobName);
+	else if (result.action === "skip") {
+		if (deps.executionTracker?.onJobReadyCallback) await deps.executionTracker.onJobReadyCallback(runId, evalJobName);
+	}
+}
+/**
+* Gather the frozen upstream snapshot for a result-aware eval: each declared
+* job/group-member's stored outputs (the same plain outputs map that backs
+* jobRef.result), plus group → ordered member names. Captured once, at eval
+* dispatch, and replayed unchanged on agent-side re-eval.
+*/
+async function gatherUpstreamSnapshot(args) {
+	const { ctx, dynamicEntry } = args;
+	const { deps, runId } = ctx;
+	const snapshot = {
+		jobs: {},
+		groups: {}
+	};
+	if (!deps.db) return snapshot;
+	const { jobNames, groupNames } = splitDeclaredNeeds(dynamicEntry.needs);
+	const groupMembers = [];
+	for (const groupName of groupNames) {
+		const memberNames = (await deps.db.selectFrom("execution_jobs").select(["job_name", "ready_at"]).where("run_id", "=", runId).where("group_name", "=", groupName).orderBy("ready_at", "asc").orderBy("job_name", "asc").execute()).map((m) => m.job_name);
+		snapshot.groups[groupName] = memberNames;
+		for (const n of memberNames) groupMembers.push(n);
+	}
+	const allJobNames = [...new Set([...jobNames, ...groupMembers])];
+	if (allJobNames.length > 0) {
+		const rows = await deps.db.selectFrom("execution_jobs").select(["job_name", "outputs"]).where("run_id", "=", runId).where("job_name", "in", allJobNames).execute();
+		for (const row of rows) {
+			const parsed = parseOutputsCell(row.outputs);
+			if (parsed) snapshot.jobs[row.job_name] = parsed;
+		}
+	}
+	return snapshot;
+}
 async function processDynamicEntry(args) {
 	const { ctx, setup, buildPrep, secrets, dynamicEntry } = args;
 	const { deps, workflow, fullLockFile, runId } = ctx;
 	if (!deps.pendingDynamics) return;
+	const evalJobName = `__dynamic__${workflow.name}__${dynamicEntry.source.index}`;
 	try {
-		const { evalJobId } = await dispatchEvalJob({
+		let upstreamSnapshot;
+		if (dynamicEntry.resultAware) {
+			const gateOpened = trackEvalGate(runId, evalJobName);
+			await registerDeferredEvalJob({
+				ctx,
+				evalJobName,
+				dynamicEntry
+			});
+			await gateOpened;
+			upstreamSnapshot = await gatherUpstreamSnapshot({
+				ctx,
+				dynamicEntry
+			});
+			logger$38.info("Result-aware eval gate opened, dispatching eval with snapshot", {
+				runId,
+				workflow: workflow.name,
+				evalJob: evalJobName,
+				snapshotJobs: Object.keys(upstreamSnapshot.jobs).length,
+				snapshotGroups: Object.keys(upstreamSnapshot.groups).length
+			});
+		}
+		const { evalJobId, replaceSyntheticId, runsOnLabels } = await dispatchEvalJob({
 			ctx,
 			setup,
 			buildPrep,
-			dynamicEntry
+			dynamicEntry,
+			upstreamSnapshot
 		});
-		const generatedJobs = await deps.pendingDynamics.track(evalJobId);
+		const generatedJobsPromise = deps.pendingDynamics.track(evalJobId);
+		if (deps.executionTracker) await deps.executionTracker.addJobsToRun(runId, [{
+			jobId: evalJobId,
+			jobName: evalJobName,
+			runsOnLabels
+		}], void 0, replaceSyntheticId);
+		const generatedJobs = await generatedJobsPromise;
 		logger$38.info("Dynamic eval completed, dispatching generated jobs", {
 			runId,
 			workflow: workflow.name,
@@ -27244,7 +28375,8 @@ async function processDynamicEntry(args) {
 			npmRegistries: secrets.npmRegistries,
 			installEnvSecrets: secrets.installEnvSecrets,
 			generatedJobs,
-			dynamicEntry
+			dynamicEntry,
+			upstreamSnapshot
 		});
 		const rootGeneratedConfigs = generatedJobConfigs.filter((c) => isRootJob(c.genJob));
 		await gateAndStoreNonRootGeneratedJobs({
@@ -27562,6 +28694,8 @@ async function dispatchMatchedWorkflow(ctx, opts = {}) {
 }
 var logger$38;
 var init_dispatch_matched_workflow = __esmMin((() => {
+	init_host_roster();
+	init_orchestrator_core();
 	init_agent_job_failed_error();
 	init_pipeline();
 	init_environment_store();
@@ -28217,7 +29351,9 @@ function buildGlobalWorkflowJobInputs(args) {
 	const materialized = materializeFanout(globalWorkflow.jobs.filter(isLockStaticJob)).jobs;
 	for (const mat of materialized) {
 		const lockJob = mat.lockJob;
-		const flatLabels = Array.isArray(lockJob.runsOn) ? [...lockJob.runsOn] : [lockJob.runsOn];
+		const runsOnParts = partitionMatchers(lockJob.runsOn ?? []);
+		const excludeParts = partitionMatchers(lockJob.excludeLabels ?? []);
+		const flatLabels = runsOnParts.exact;
 		const jobConfig = {
 			source: globalWorkflow.source ?? reg.lockEntry.source,
 			workflowName: globalWorkflow.name,
@@ -28240,7 +29376,9 @@ function buildGlobalWorkflowJobInputs(args) {
 				workflowName: globalWorkflow.name,
 				jobName: mat.expandedName,
 				runsOnLabels: flatLabels,
-				excludeLabels: lockJob.excludeLabels ? [...lockJob.excludeLabels] : void 0,
+				runsOnPatterns: runsOnParts.regex,
+				excludeLabels: excludeParts.exact,
+				excludePatterns: excludeParts.regex,
 				jobConfig,
 				repoUrl: dispatchBundle.repoUrlBuilder?.buildCloneUrl(repoIdentifier) ?? "",
 				ref: event.sourceBranch ?? event.targetBranch,
@@ -28845,6 +29983,36 @@ var init_process_webhook = __esmMin((() => {
 * Decision traces are forwarded to Platform via platformClient.send() (which buffers
 * internally when disconnected -- the caller does NOT check connection state).
 */
+function evalGateKey(runId, evalJobName) {
+	return `${runId}:${evalJobName}`;
+}
+/**
+* Register an eval gate and return a promise that resolves when the scheduler
+* opens it (the eval job's upstream needs are all satisfied).
+*/
+function trackEvalGate(runId, evalJobName) {
+	return new Promise((resolve) => {
+		pendingEvalGates.set(evalGateKey(runId, evalJobName), resolve);
+	});
+}
+/**
+* Open a registered eval gate, unblocking the deferred dispatch task. Returns
+* true if a gate was registered for this eval job (so the scheduler knows it
+* handled the ready signal itself and must not run the normal dispatch path).
+*/
+function openEvalGate(runId, evalJobName) {
+	const key = evalGateKey(runId, evalJobName);
+	const resolve = pendingEvalGates.get(key);
+	if (!resolve) return false;
+	pendingEvalGates.delete(key);
+	resolve();
+	return true;
+}
+/** Clear all eval gates for a run (called on run completion / cleanup). */
+function clearEvalGatesForRun(runId) {
+	const prefix = `${runId}:`;
+	for (const key of pendingEvalGates.keys()) if (key.startsWith(prefix)) pendingEvalGates.delete(key);
+}
 /**
 * Store a pending dispatch context for a job that will be dispatched later
 * by the needs scheduler. The key is `${runId}:${jobName}`.
@@ -29294,11 +30462,12 @@ function summarizeDecision(decision) {
 		checksCount: decision.checks.length
 	};
 }
-var logger$36, pendingJobContexts;
+var logger$36, pendingJobContexts, pendingEvalGates;
 var init_processor = __esmMin((() => {
 	init_process_webhook();
 	logger$36 = createLogger({ prefix: "pipeline" });
 	pendingJobContexts = /* @__PURE__ */ new Map();
+	pendingEvalGates = /* @__PURE__ */ new Map();
 }));
 //#endregion
 //#region src/concurrency/waiters.ts
@@ -29712,6 +30881,7 @@ var init_admin_event_dlq = __esmMin((() => {
 * @returns Object with Hono app instance and injectWebSocket function
 */
 function createApp(deps) {
+	registerOrchestratorMetrics();
 	const app = new Hono().basePath(deps.config.basePath);
 	const { injectWebSocket, upgradeWebSocket, wss } = createNodeWebSocket({ app });
 	configureSecureWsServer(wss);
@@ -30224,7 +31394,11 @@ function createApp(deps) {
 						eventLog: deps.eventLogWriter,
 						eventLogSource: "direct",
 						contributorCache: deps.contributorCache,
-						accessLogWriter: deps.accessLogWriter
+						accessLogWriter: deps.accessLogWriter,
+						hostRosterStore: deps.hostRosterStore,
+						instanceId: deps.config.instanceId,
+						rosterGraceMs: deps.config.rosterGraceMs,
+						maxFanoutHosts: deps.config.maxFanoutHosts
 					});
 				} catch (err) {
 					if (deps.eventLogWriter) try {
@@ -30556,7 +31730,7 @@ async function createDebugBundle(options) {
 	const dir = path$1.dirname(outputPath);
 	if (!fs.existsSync(dir)) fs.mkdirSync(dir, { recursive: true });
 	const output = fs.createWriteStream(outputPath);
-	const archive = archiver("zip", { zlib: { level: 6 } });
+	const archive = new ZipArchive({ zlib: { level: 6 } });
 	const finalized = new Promise((resolve, reject) => {
 		output.on("close", resolve);
 		archive.on("error", reject);
@@ -30632,7 +31806,7 @@ function classifyError(err) {
 	};
 }
 async function collectFleetSubtree(opts, deps) {
-	const archive = archiver("zip", { zlib: { level: 6 } });
+	const archive = new ZipArchive({ zlib: { level: 6 } });
 	const out = [];
 	archive.on("data", (d) => out.push(d));
 	const done = new Promise((res, rej) => {
@@ -37028,6 +38202,61 @@ var init_log_storage = __esmMin((() => {
 	init_s3_log_storage();
 }));
 //#endregion
+//#region src/pipeline/wave-scheduler.ts
+/**
+* Decide what happens after a fan-out child of `baseJobName` reaches terminal.
+*
+* The wave policy (`maxParallel` / `failFast`) is read from the base group's
+* own rows — every child of a bounded wave carries the same stamped
+* `wave_max_parallel` / `wave_fail_fast`, so the just-completed child's slot
+* being re-inserted without the policy on release does not break the chain
+* (the still-held siblings carry it). If no sibling carries a policy, this is
+* not a bounded wave → `noop`.
+*
+* - `failFast` + a child failure → `skip-remaining` every still-held sibling.
+* - in-flight count `< maxParallel` AND a held sibling exists → `release` the
+*   next held sibling (lowest `variant_label`).
+* - otherwise → `noop`.
+*
+* "In-flight" = a non-terminal, non-`wave_gated` child (it has been dispatched
+* and not yet completed). The just-completed child is terminal, so it does not
+* count against the window — its slot is the one we are filling.
+*/
+async function evaluateWave(db, evaluation) {
+	const { runId, baseJobName, completedStatus } = evaluation;
+	const children = await db.selectFrom("execution_jobs").select([
+		"job_name",
+		"status",
+		"wave_gated",
+		"variant_label",
+		"wave_max_parallel",
+		"wave_fail_fast"
+	]).where("run_id", "=", runId).where("base_job_name", "=", baseJobName).execute();
+	const policyRow = children.find((c) => c.wave_max_parallel != null);
+	if (!policyRow || policyRow.wave_max_parallel == null) return { action: "noop" };
+	const maxParallel = policyRow.wave_max_parallel;
+	const failFast = policyRow.wave_fail_fast ?? false;
+	const heldSiblings = children.filter((c) => c.wave_gated).sort((a, b) => (a.variant_label ?? a.job_name).localeCompare(b.variant_label ?? b.job_name));
+	const isFailure = completedStatus !== ExecutionJobStatus.enum.success;
+	if (failFast && isFailure) {
+		if (heldSiblings.length === 0) return { action: "noop" };
+		return {
+			action: "skip-remaining",
+			jobNames: heldSiblings.map((c) => c.job_name)
+		};
+	}
+	if (heldSiblings.length === 0) return { action: "noop" };
+	if (children.filter((c) => !c.wave_gated && !TERMINAL_JOB_STATES.has(c.status)).length >= maxParallel) return { action: "noop" };
+	return {
+		action: "release",
+		jobName: heldSiblings[0].job_name,
+		baseJobName,
+		maxParallel,
+		failFast
+	};
+}
+var init_wave_scheduler = __esmMin((() => {}));
+//#endregion
 //#region src/reporting/execution-tracker.ts
 /**
 * Execution state tracker with write-through DB persistence.
@@ -37046,6 +38275,7 @@ var logger$24, PRUNE_DELAY_MS, ExecutionTracker;
 var init_execution_tracker = __esmMin((() => {
 	init_prometheus();
 	init_needs_scheduler();
+	init_wave_scheduler();
 	logger$24 = createLogger({ prefix: "execution-tracker" });
 	PRUNE_DELAY_MS = 300 * 1e3;
 	ExecutionTracker = class {
@@ -37177,10 +38407,22 @@ var init_execution_tracker = __esmMin((() => {
 					job_name: job.jobName,
 					routing_key: routingKey ?? null,
 					matrix_values: job.matrixValues ? JSON.stringify(job.matrixValues) : null,
+					...job.baseJobName && { base_job_name: job.baseJobName },
+					...job.variantKind && { variant_kind: job.variantKind },
+					...job.variantLabel && { variant_label: job.variantLabel },
+					...job.waveGated && { wave_gated: true },
+					...job.waveMaxParallel !== void 0 && { wave_max_parallel: job.waveMaxParallel },
+					...job.waveFailFast !== void 0 && { wave_fail_fast: job.waveFailFast },
 					...runsOnLabelsJson && { runs_on_labels: runsOnLabelsJson },
 					...dispatchedContexts?.length && { dispatched_contexts: JSON.stringify(dispatchedContexts) }
 				}).onConflict((oc) => oc.columns(["run_id", "job_id"]).doUpdateSet({
 					job_name: job.jobName,
+					...job.baseJobName && { base_job_name: job.baseJobName },
+					...job.variantKind && { variant_kind: job.variantKind },
+					...job.variantLabel && { variant_label: job.variantLabel },
+					...job.waveGated && { wave_gated: true },
+					...job.waveMaxParallel !== void 0 && { wave_max_parallel: job.waveMaxParallel },
+					...job.waveFailFast !== void 0 && { wave_fail_fast: job.waveFailFast },
 					...runsOnLabelsJson && { runs_on_labels: runsOnLabelsJson },
 					...dispatchedContexts?.length && { dispatched_contexts: JSON.stringify(dispatchedContexts) }
 				})).execute();
@@ -37235,6 +38477,20 @@ var init_execution_tracker = __esmMin((() => {
 			return (await this.db.selectFrom("execution_jobs").select("job_id").where("run_id", "=", runId).where("job_name", "=", jobName).where("job_id", "like", `${prefix}%`).executeTakeFirst())?.job_id;
 		}
 		/**
+		* Find the synthetic deferred-eval placeholder job ID for a result-aware
+		* dynamic generator's eval job. Mirrors {@link findSyntheticJobId} but keys on
+		* the `dynamic-eval-pending-<evalJobName>-` prefix that registerDeferredEvalJob
+		* uses, so dispatchEvalJob can swap it for the real eval job id.
+		*/
+		async findDynamicEvalSyntheticId(runId, evalJobName) {
+			const run = this.runs.get(runId);
+			const prefix = `dynamic-eval-pending-${evalJobName}-`;
+			if (run) {
+				for (const key of run.jobs.keys()) if (key.startsWith(prefix)) return key;
+			}
+			return (await this.db.selectFrom("execution_jobs").select("job_id").where("run_id", "=", runId).where("job_name", "=", evalJobName).where("job_id", "like", `${prefix}%`).executeTakeFirst())?.job_id;
+		}
+		/**
 		* Run `fn` while holding a per-run lock, serializing the run-mutating methods
 		* (`onJobStatus`, `addJobsToRun`) so a status reply cannot interleave with the
 		* synthetic→real job swap and wedge the run in `running`.
@@ -37317,10 +38573,16 @@ var init_execution_tracker = __esmMin((() => {
 					job_name: job.jobName,
 					routing_key: run.routingKey ?? null,
 					matrix_values: job.matrixValues ? JSON.stringify(job.matrixValues) : null,
+					...job.baseJobName && { base_job_name: job.baseJobName },
+					...job.variantKind && { variant_kind: job.variantKind },
+					...job.variantLabel && { variant_label: job.variantLabel },
 					...runsOnLabelsJson && { runs_on_labels: runsOnLabelsJson },
 					...dispatchedContexts?.length && { dispatched_contexts: JSON.stringify(dispatchedContexts) }
 				}).onConflict((oc) => oc.columns(["run_id", "job_id"]).doUpdateSet({
 					job_name: job.jobName,
+					...job.baseJobName && { base_job_name: job.baseJobName },
+					...job.variantKind && { variant_kind: job.variantKind },
+					...job.variantLabel && { variant_label: job.variantLabel },
 					...runsOnLabelsJson && { runs_on_labels: runsOnLabelsJson },
 					...dispatchedContexts?.length && { dispatched_contexts: JSON.stringify(dispatchedContexts) }
 				})).execute();
@@ -37421,7 +38683,10 @@ var init_execution_tracker = __esmMin((() => {
 				workflowName: run.workflowName
 			});
 			if (TERMINAL_JOB_STATES.has(state) && data?.droppedJobs && Array.isArray(data.droppedJobs)) await this.handleDriftDroppedJobs(runId, data.droppedJobs);
-			if (TERMINAL_JOB_STATES.has(state) && job) await this.runSchedulerHook(runId, jobId, job.name, state);
+			if (TERMINAL_JOB_STATES.has(state) && job) {
+				await this.runSchedulerHook(runId, jobId, job.name, state);
+				await this.runWaveSchedulerHook(runId, jobId, state);
+			}
 			if (TERMINAL_JOB_STATES.has(state) && run && this.isRunComplete(runId)) {
 				if (await this.enforceSchedulerInvariantOrFail(runId)) return;
 			}
@@ -37725,6 +38990,60 @@ var init_execution_tracker = __esmMin((() => {
 			}
 		}
 		/**
+		* Rolling-wave hook: fires beside the needs-scheduler when a fan-out child of
+		* a bounded wave (`maxParallel` set) reaches terminal. Reads the completed
+		* child's row to recover the base + wave policy, asks {@link evaluateWave}
+		* what to do, then performs it:
+		*
+		* - `release`: clear the next held sibling's `wave_gated` flag and fire the
+		*   onJobReady callback (the existing ready→dispatch path).
+		* - `skip-remaining`: mark every still-held sibling `skipped` (failFast).
+		* - `noop`: nothing — a later terminal will free the next slot.
+		*/
+		async runWaveSchedulerHook(runId, jobId, state) {
+			try {
+				const row = await this.db.selectFrom("execution_jobs").select(["base_job_name"]).where("run_id", "=", runId).where("job_id", "=", jobId).executeTakeFirst();
+				if (!row?.base_job_name) return;
+				const result = await evaluateWave(this.db, {
+					runId,
+					baseJobName: row.base_job_name,
+					completedStatus: state
+				});
+				if (result.action === "release") {
+					await this.db.updateTable("execution_jobs").set({ wave_gated: false }).where("run_id", "=", runId).where("job_name", "=", result.jobName).execute();
+					if (this.onJobReadyCallback) await this.onJobReadyCallback(runId, result.jobName);
+					await this.db.updateTable("execution_jobs").set({
+						base_job_name: result.baseJobName,
+						wave_max_parallel: result.maxParallel,
+						wave_fail_fast: result.failFast
+					}).where("run_id", "=", runId).where("job_name", "=", result.jobName).execute();
+					logger$24.info("Rolling wave released next child", {
+						runId,
+						baseJobName: row.base_job_name,
+						released: result.jobName
+					});
+				} else if (result.action === "skip-remaining") {
+					logger$24.info("Rolling wave halting (failFast): skipping held remainder", {
+						runId,
+						baseJobName: row.base_job_name,
+						skipped: result.jobNames
+					});
+					for (const jobName of result.jobNames) {
+						const heldRow = await this.db.selectFrom("execution_jobs").select("job_id").where("run_id", "=", runId).where("job_name", "=", jobName).executeTakeFirst();
+						if (!heldRow) continue;
+						await this.db.updateTable("execution_jobs").set({ wave_gated: false }).where("run_id", "=", runId).where("job_id", "=", heldRow.job_id).execute();
+						await this.onJobStatus(runId, heldRow.job_id, ExecutionJobStatus.enum.skipped, Date.now(), void 0, { error: "fan-out halted by failFast" });
+					}
+				}
+			} catch (e) {
+				logger$24.error("Wave scheduler hook failed", {
+					runId,
+					jobId,
+					error: e
+				});
+			}
+		}
+		/**
 		* Phase 9: stuck-jobs invariant check ( Layer 3).
 		* Before declaring a run complete, verify no stuck jobs exist. If any are
 		* found, fail them via recursive onJobStatus calls and signal the caller to
@@ -40691,6 +42010,8 @@ var init_pg_secret_store = __esmMin((() => {
 		async renameScope(orgId, oldScope, newScope) {
 			await this.db.transaction().execute(async (trx) => {
 				const rows = await trx.selectFrom("scoped_secrets").selectAll().where("org_id", "=", orgId).where("scope", "=", oldScope).execute();
+				const bindings = await trx.selectFrom("environment_bindings").select("id").where("org_id", "=", orgId).where("scope_pattern", "=", oldScope).execute();
+				if (rows.length === 0 && bindings.length === 0) throw new Error(`Secret scope '${oldScope}' not found`);
 				for (const row of rows) {
 					const oldAad = `${orgId}:${oldScope}:${row.key}`;
 					const newAad = `${orgId}:${newScope}:${row.key}`;
@@ -44723,9 +46044,12 @@ var init_disk_guard = __esmMin((() => {
 */
 var orchestrator_core_exports = /* @__PURE__ */ __exportAll({
 	bootstrapOrchestrator: () => bootstrapOrchestrator$1,
+	buildHostOutputsEnvelope: () => buildHostOutputsEnvelope,
 	buildMatrixOutputsEnvelope: () => buildMatrixOutputsEnvelope,
 	buildUpstreamOutputsByBase: () => buildUpstreamOutputsByBase,
+	internalJobRunsOnSelectors: () => internalJobRunsOnSelectors,
 	mergeUpstreamOutputs: () => mergeUpstreamOutputs,
+	parseOutputsCell: () => parseOutputsCell,
 	upstreamBaseNamesFromNeeds: () => upstreamBaseNamesFromNeeds
 });
 async function initializeScaler(config, db, tokenStore, onScalerEvent) {
@@ -45054,6 +46378,23 @@ function upstreamBaseNamesFromNeeds(needs) {
 	}
 	return names;
 }
+/**
+* Partition a lock job's `runsOn` / `excludeLabels` matchers into exact label
+* strings and regex patterns for internal-event (cron / `ctx.emit`) dispatch.
+* Lock jobs carry `runsOn` as `LabelMatcher[]`; the coordinator routing and the
+* direct dispatcher both need exact labels for the indexed/SQL fast path and
+* regex patterns as a separate JS post-filter — never the raw matcher objects.
+*/
+function internalJobRunsOnSelectors(job) {
+	const include = partitionMatchers(job.runsOn ?? []);
+	const exclude = partitionMatchers(job.excludeLabels ?? []);
+	return {
+		runsOnLabels: include.exact,
+		runsOnPatterns: include.regex,
+		excludeLabels: exclude.exact,
+		excludePatterns: exclude.regex
+	};
+}
 /** Escape SQL LIKE wildcards (`%`, `_`) so a literal base name matches exactly. */
 function escapeLikePattern(value) {
 	return value.replace(/[\\%_]/g, (c) => `\\${c}`);
@@ -45081,6 +46422,16 @@ function parseOutputsCell(outputs) {
 function buildUpstreamOutputsByBase(baseNames, rows) {
 	let result;
 	for (const base of baseNames) {
+		const hostChildren = rows.filter((r) => r.variant_kind === VariantKind.host && r.job_name.startsWith(`${base} (`)).map((r) => ({
+			host: r.variant_label ?? r.job_name.slice(base.length + 2, -1),
+			status: r.status ?? null,
+			parsed: parseOutputsCell(r.outputs) ?? {}
+		}));
+		if (hostChildren.length > 0) {
+			if (!result) result = {};
+			result[base] = buildHostOutputsEnvelope(hostChildren);
+			continue;
+		}
 		const exact = rows.find((r) => r.job_name === base && !r.matrix_values);
 		const children = rows.filter((r) => r.matrix_values && r.job_name.startsWith(`${base} (`)).map((r) => ({
 			job_name: r.job_name,
@@ -45100,6 +46451,34 @@ function buildUpstreamOutputsByBase(baseNames, rows) {
 	return result;
 }
 /**
+* Fold a `runsOnAll` upstream's host children into the `byHost` envelope
+* `{ byHost: { '<host>': outputs }, summary: { succeededHosts, failedHosts, outputs } }`.
+* Unlike the matrix envelope, `summary.outputs[key]` is an array view across hosts
+* (host order), never a last-write-wins scalar; `succeededHosts`/`failedHosts`
+* record each host's terminal outcome.
+*/
+function buildHostOutputsEnvelope(children) {
+	const byHost = {};
+	const succeededHosts = [];
+	const failedHosts = [];
+	const outputs = {};
+	const ordered = [...children].sort((a, b) => a.host.localeCompare(b.host));
+	for (const child of ordered) {
+		byHost[child.host] = child.parsed;
+		if (child.status === ExecutionJobStatus.enum.success) succeededHosts.push(child.host);
+		else if (child.status === ExecutionJobStatus.enum.failed) failedHosts.push(child.host);
+		for (const [key, value] of Object.entries(child.parsed)) (outputs[key] ??= []).push(value);
+	}
+	return {
+		byHost,
+		summary: {
+			succeededHosts,
+			failedHosts,
+			outputs
+		}
+	};
+}
+/**
 * Group an upstream's child rows into the matrix outputs envelope
 * `{ byMatrix: { '<suffix>': outputs }, merged: <last-write-wins> }`. The suffix
 * is the text inside the `(...)` of each expanded child name; children are
@@ -45150,7 +46529,10 @@ async function mergeUpstreamOutputs(db, runId, jobName, needs, dispatchSecrets,
 			"job_id",
 			"job_name",
 			"outputs",
-			"matrix_values"
+			"matrix_values",
+			"variant_kind",
+			"variant_label",
+			"status"
 		]).where("run_id", "=", runId);
 		query = query.where((eb) => eb.or(baseNames.flatMap((base) => [eb("job_name", "=", base), eb("job_name", "like", `${escapeLikePattern(base)} (%`)])));
 		const upstreamJobs = await query.execute();
@@ -45365,15 +46747,21 @@ function buildOnSecretOutputs(config, db) {
 */
 async function routeInternalJobsViaCoordinator(coordinator, dispatcher, runId, workflow, staticJobs, ctx, buildInternalJobConfig) {
 	const dispatchedJobs = [];
-	const jobsToRoute = staticJobs.map((job) => ({
-		jobName: job.name,
-		runsOnLabels: [Array.isArray(job.runsOn) ? job.runsOn : [job.runsOn]],
-		jobConfig: buildInternalJobConfig(job),
-		repoUrl: ctx.repoUrl,
-		ref: "",
-		sha: ctx.cronCommitSha,
-		...job.resources && { resources: job.resources }
-	}));
+	const jobsToRoute = staticJobs.map((job) => {
+		const sel = internalJobRunsOnSelectors(job);
+		return {
+			jobName: job.name,
+			runsOnLabels: [sel.runsOnLabels],
+			runsOnPatterns: sel.runsOnPatterns,
+			excludeLabels: sel.excludeLabels,
+			excludePatterns: sel.excludePatterns,
+			jobConfig: buildInternalJobConfig(job),
+			repoUrl: ctx.repoUrl,
+			ref: "",
+			sha: ctx.cronCommitSha,
+			...job.resources && { resources: job.resources }
+		};
+	});
 	const runCtx = {
 		runId,
 		deliveryId: ctx.event.id,
@@ -45425,11 +46813,15 @@ async function dispatchInternalJobsDirect(dispatcher, runId, workflow, staticJob
 	const dispatchedJobs = [];
 	const buildJobConfig = (job) => buildInternalJobConfigForWorkflow(workflow, job);
 	for (const job of staticJobs) {
+		const sel = internalJobRunsOnSelectors(job);
 		const result = await dispatcher.dispatch({
 			runId,
 			workflowName: workflow.name,
 			jobName: job.name,
-			runsOnLabels: Array.isArray(job.runsOn) ? job.runsOn : [job.runsOn],
+			runsOnLabels: sel.runsOnLabels,
+			runsOnPatterns: sel.runsOnPatterns,
+			excludeLabels: sel.excludeLabels,
+			excludePatterns: sel.excludePatterns,
 			jobConfig: buildJobConfig(job),
 			repoUrl: ctx.repoUrl,
 			ref: "",
@@ -45858,7 +47250,11 @@ async function bootstrapOrchestrator$1(config, hooks, options) {
 	const tokenStore = new AgentTokenStore(db);
 	if (config.agentAuth === "none") logger$3.warn("Agent authentication disabled (KICI_AGENT_AUTH=none). All agents will be accepted without tokens.");
 	else logger$3.info("Agent authentication enabled (token mode)");
-	const agentRegistry = new AgentRegistry();
+	const hostRosterStore = new HostRosterStore(db);
+	const agentRegistry = new AgentRegistry({
+		rosterStore: hostRosterStore,
+		instanceId: config.instanceId
+	});
 	const fleetAgentCollector = new FleetAgentCollector({ timeoutMs: FLEET_NODE_TIMEOUT_MS });
 	const queue = new JobQueue(db, {
 		maxDepth: config.queueMaxDepth,
@@ -45918,6 +47314,7 @@ async function bootstrapOrchestrator$1(config, hooks, options) {
 						error: toErrorMessage(err)
 					});
 				});
+				clearEvalGatesForRun(runId);
 				const [owner, repo] = context.repoIdentifier.split("/");
 				checkRunReporter.updateWorkflowStatus({
 					provider: context.provider,
@@ -46005,6 +47402,7 @@ async function bootstrapOrchestrator$1(config, hooks, options) {
 	});
 	executionTrackerRef = executionTracker;
 	executionTracker.setOnJobReadyCallback(async (runId, jobName) => {
+		if (openEvalGate(runId, jobName)) return;
 		await dispatchReadyJob(runId, jobName, dispatcher, executionTracker, cluster.coordinator, db);
 	});
 	logger$3.info("Execution reporting initialized", { logStorageType: config.storage?.type ?? "filesystem" });
@@ -46165,8 +47563,21 @@ async function bootstrapOrchestrator$1(config, hooks, options) {
 		eventStore,
 		config: eventRouterConfig
 	});
-	eventRetryScannerRef.onBecomeLeader = () => eventRetryScanner.onBecomeLeader();
-	eventRetryScannerRef.onLoseLeadership = () => eventRetryScanner.onLoseLeadership();
+	const hostRosterReaper = new HostRosterReaper({
+		store: hostRosterStore,
+		ttlMs: config.rosterTtlMs,
+		graceMs: config.rosterGraceMs,
+		scanIntervalMs: 6e4,
+		setUnreachableGauge: setDeclaredHostsUnreachable
+	});
+	eventRetryScannerRef.onBecomeLeader = () => {
+		eventRetryScanner.onBecomeLeader();
+		hostRosterReaper.onBecomeLeader();
+	};
+	eventRetryScannerRef.onLoseLeadership = () => {
+		eventRetryScanner.onLoseLeadership();
+		hostRosterReaper.onLoseLeadership();
+	};
 	const cronStore = new CronStore(db);
 	const cronScheduler = new CronScheduler({
 		db,
@@ -46275,6 +47686,7 @@ async function bootstrapOrchestrator$1(config, hooks, options) {
 		pool,
 		providerRegistry,
 		agentRegistry,
+		hostRosterStore,
 		dispatcher,
 		queue,
 		scalerManager,
@@ -46485,6 +47897,7 @@ async function bootstrapOrchestrator$1(config, hooks, options) {
 		db,
 		pool,
 		registry: agentRegistry,
+		hostRosterStore,
 		dispatcher,
 		jobQueue: queue,
 		dedup,
@@ -46578,13 +47991,7 @@ async function bootstrapOrchestrator$1(config, hooks, options) {
 		scanIntervalMs: config.staleDetectorScanIntervalMs,
 		heldRunStore: modeResult.appDepsExtras?.heldRunStore,
 		stepApprovalBridge: modeResult.appDepsExtras?.stepApprovalBridge,
-		failRun: (runId, reason) => cancelRunWithReason({
-			db,
-			jobQueue: queue,
-			dispatcher,
-			registry: agentRegistry,
-			executionTracker
-		}, runId, reason).then(() => void 0),
+		failRun: (runId, reason) => executionTracker.failRun(runId, reason).then(() => void 0),
 		onWorkflowRelease: modeResult.appDepsExtras?.onWorkflowRelease,
 		accessLogWriter
 	});
@@ -46755,6 +48162,10 @@ async function bootstrapOrchestrator$1(config, hooks, options) {
 				name: "Stopping event retry scanner",
 				fn: () => eventRetryScanner.stop()
 			},
+			{
+				name: "Stopping host roster reaper",
+				fn: () => hostRosterReaper.stop()
+			},
 			{
 				name: "Stopping timers, cleanup, and reloader",
 				fn: () => {
@@ -46794,6 +48205,8 @@ var init_orchestrator_core = __esmMin((() => {
 	init_resolver();
 	init_client();
 	init_registry();
+	init_host_roster();
+	init_host_roster_reaper();
 	init_job_queue();
 	init_cleanup$1();
 	init_bootstrap();
@@ -47003,6 +48416,9 @@ function matchesGate(job, agentLabels, agentMandatoryLabels) {
 		const runsOnSet = new Set(job.runsOnLabels);
 		if (!agentMandatoryLabels.every((m) => runsOnSet.has(m))) return false;
 	}
+	const labelSet = new Set(agentLabels);
+	if (!job.runsOnPatterns.every((p) => matcherSatisfiedBy(p, labelSet))) return false;
+	if (job.excludePatterns.some((p) => matcherSatisfiedBy(p, labelSet))) return false;
 	return true;
 }
 var InMemoryJobQueue;
@@ -47039,6 +48455,8 @@ var init_in_memory_job_queue = __esmMin((() => {
 				depsHash: input.depsHash,
 				requestId: input.requestId,
 				excludeLabels: input.excludeLabels ?? [],
+				runsOnPatterns: input.runsOnPatterns ?? [],
+				excludePatterns: input.excludePatterns ?? [],
 				routingKey: input.routingKey
 			});
 			return id;
@@ -47786,6 +49204,8 @@ async function bootstrapWorker(config, _opts) {
 					jobName: msg.jobName,
 					runsOnLabels: flatLabels,
 					excludeLabels: msg.excludeLabels,
+					runsOnPatterns: msg.runsOnPatterns,
+					excludePatterns: msg.excludePatterns,
 					jobConfig,
 					repoUrl: msg.repoUrl ?? "",
 					ref: msg.ref ?? "",
@@ -48079,14 +49499,14 @@ var init_worker_core = __esmMin((() => {
 	init_fleet_wiring();
 	init_worker_status();
 	init_agent_heartbeat();
-	ORCHESTRATOR_VERSION$1 = "0.1.17";
-	WORKER_BUILD_COMMIT = "5596f8a3c";
-	WORKER_SDK_VERSION = "0.1.17";
-	WORKER_SDK_BUNDLE_HASH = "df47ed5db86eaaa2de8394c0db08335f368e8d620a898cc409765f4545eb3972";
-	WORKER_SHARED_VERSION = "0.1.17";
-	WORKER_SHARED_BUNDLE_HASH = "9e8a753da73b26fb87d08817f70b4d836f67f599385fa268b2c1f68b97996f54";
-	WORKER_ENGINE_VERSION = "0.1.17";
-	WORKER_ENGINE_BUNDLE_HASH = "706d94fa54a47aea0f69bde105d40213befff401f717604aded2c62a1291cb51";
+	ORCHESTRATOR_VERSION$1 = "0.1.18";
+	WORKER_BUILD_COMMIT = "d8cff38bb";
+	WORKER_SDK_VERSION = "0.1.18";
+	WORKER_SDK_BUNDLE_HASH = "8308089347c304e41b457d3867b17bbff11d6b5cd9706b6823e7abdbd849f33f";
+	WORKER_SHARED_VERSION = "0.1.18";
+	WORKER_SHARED_BUNDLE_HASH = "5f2c220f24d166b0f13d0620a2e80d19689ac8b683a12154daef44e938fd46a7";
+	WORKER_ENGINE_VERSION = "0.1.18";
+	WORKER_ENGINE_BUNDLE_HASH = "79ce14640d1798eaaa7cb3aa6c4bc325da3bff1e9f4716936e19614eabb1d858";
 	logger$2 = createLogger({ prefix: "worker" });
 	DRAIN_TIMEOUT_MS = 3e5;
 }));
@@ -48110,14 +49530,14 @@ var init_worker_core = __esmMin((() => {
 * Graceful shutdown:
 * agent WS -> heartbeat -> HTTP -> DB
 */
-const ORCHESTRATOR_VERSION = "0.1.17";
-const BUILD_COMMIT = "5596f8a3c";
-const SDK_VERSION = "0.1.17";
-const SDK_BUNDLE_HASH = "df47ed5db86eaaa2de8394c0db08335f368e8d620a898cc409765f4545eb3972";
-const SHARED_VERSION = "0.1.17";
-const SHARED_BUNDLE_HASH = "9e8a753da73b26fb87d08817f70b4d836f67f599385fa268b2c1f68b97996f54";
-const ENGINE_VERSION = "0.1.17";
-const ENGINE_BUNDLE_HASH = "706d94fa54a47aea0f69bde105d40213befff401f717604aded2c62a1291cb51";
+const ORCHESTRATOR_VERSION = "0.1.18";
+const BUILD_COMMIT = "d8cff38bb";
+const SDK_VERSION = "0.1.18";
+const SDK_BUNDLE_HASH = "8308089347c304e41b457d3867b17bbff11d6b5cd9706b6823e7abdbd849f33f";
+const SHARED_VERSION = "0.1.18";
+const SHARED_BUNDLE_HASH = "5f2c220f24d166b0f13d0620a2e80d19689ac8b683a12154daef44e938fd46a7";
+const ENGINE_VERSION = "0.1.18";
+const ENGINE_BUNDLE_HASH = "79ce14640d1798eaaa7cb3aa6c4bc325da3bff1e9f4716936e19614eabb1d858";
 const otelSdk = initTelemetry({
 	serviceName: "kici-orchestrator",
 	otlpEndpoint: process.env.OTEL_EXPORTER_OTLP_ENDPOINT